@smartledger/bsv 8.3.1 → 9.0.0

package/lib/smart_contract/locks.js

@@ -10,7 +10,6 @@ var H = require('../covenant/helpers')
 var Script = require('../script')
 var Opcode = require('../opcode')
 var signInput = H.signInput
-var n = H.scriptNum
 
 /** Hash-lock: reveal a preimage whose SHA-256 matches a digest. */
 function hashLock (secret) {
@@ -36,20 +35,6 @@ function p2pkh (privateKey) {
   }
 }
 
-/** CLTV absolute time-lock: <locktime> CLTV DROP <pk> CHECKSIG. */
-function timeLockCLTV (privateKey, locktime) {
-  var pub = privateKey.toPublicKey()
-  var lock = new Script()
-    .add(n(locktime)).add(Opcode.OP_CHECKLOCKTIMEVERIFY).add(Opcode.OP_DROP)
-    .add(pub.toBuffer()).add(Opcode.OP_CHECKSIG)
-  return {
-    lock: lock,
-    meta: { name: 'cltv-timelock', locktime: locktime },
-    // Caller must set spend.nLockTime >= locktime and input sequence < 0xffffffff.
-    unlock: function (spend, sats) { return new Script().add(signInput(spend, privateKey, 0, lock, sats)) }
-  }
-}
-
 /** m-of-n multisig. */
 function multisig (m, privateKeys) {
   var pubs = privateKeys.map(function (k) { return k.toPublicKey() })
@@ -68,33 +53,8 @@ function multisig (m, privateKeys) {
   }
 }
 
-/** HTLC: hash-OR-timeout. */
-function htlc (opts) {
-  var digest = Hash.sha256(opts.secret)
-  var lock = new Script()
-    .add(Opcode.OP_IF)
-    .add(Opcode.OP_SHA256).add(digest).add(Opcode.OP_EQUALVERIFY)
-    .add(opts.receiver.toPublicKey().toBuffer()).add(Opcode.OP_CHECKSIG)
-    .add(Opcode.OP_ELSE)
-    .add(n(opts.timeout)).add(Opcode.OP_CHECKLOCKTIMEVERIFY).add(Opcode.OP_DROP)
-    .add(opts.sender.toPublicKey().toBuffer()).add(Opcode.OP_CHECKSIG)
-    .add(Opcode.OP_ENDIF)
-  return {
-    lock: lock,
-    meta: { name: 'htlc', digest: digest.toString('hex'), timeout: opts.timeout },
-    unlockClaim: function (spend, sats) {
-      return new Script().add(signInput(spend, opts.receiver, 0, lock, sats)).add(opts.secret).add(Opcode.OP_1)
-    },
-    unlockRefund: function (spend, sats) {
-      return new Script().add(signInput(spend, opts.sender, 0, lock, sats)).add(Opcode.OP_0)
-    }
-  }
-}
-
 module.exports = {
   hashLock: hashLock,
   p2pkh: p2pkh,
-  timeLockCLTV: timeLockCLTV,
-  multisig: multisig,
-  htlc: htlc
+  multisig: multisig
 }

package/lib/smart_contract/pels.js

@@ -14,7 +14,7 @@
  * the slice preimage[104 : len-52] is exactly the `scriptlen||script` half of a
  * TxOut, so the next output is `<newValue:8-LE> || preimage[104:len-52]`.
  *
- * Requires post-Genesis limits (SmartContract.enableGenesis()).
+ * Verifies under mainnet consensus flags with no opt-in (8.4.0+).
  */
 
 var P = require('../covenant/pushtx')

package/lib/smart_contract/token.js

@@ -36,7 +36,7 @@
  *       surrounding output bytes and the token's value; the covenant binds them
  *       into the committed hashOutputs. Value conservation is left to the network.
  *
- * Requires post-Genesis limits (SmartContract.enableGenesis()).
+ * Verifies under mainnet consensus flags with no opt-in (8.4.0+).
  */
 
 var BN = require('../crypto/bn')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smartledger/bsv",
-  "version": "8.3.1",
+  "version": "9.0.0",
   "description": "🚀 Complete Bitcoin SV development framework with legally-recognizable DID:web + W3C VC-JWT toolkit, Legal Token Protocol (LTP), Global Digital Attestation Framework (GDAF), StatusList2021 revocation, and 16 flexible loading options. Standards-based credentials with ES256/ES256K support, on-chain BSV anchoring, and comprehensive Bitcoin SV API. Perfect for legal tokens, verifiable credentials, DeFi, smart contracts, and secure Bitcoin applications.",
   "author": "SmartLedger Technology <hello@smartledger.technology> (https://smartledger.technology)",
   "homepage": "https://github.com/codenlighten/smartledger-bsv#readme",

package/test/build/esm_wrapper.js

@@ -43,9 +43,30 @@ describe('ESM wrapper (index.mjs)', function () {
     var bsv = require('../..')
     var names = gen.exportableNames(bsv)
     names.length.should.be.above(100)
-    // SmartUTXO is an accessor (deprecated getter) and must be excluded.
-    names.should.not.include('SmartUTXO')
-    Object.getOwnPropertyDescriptor(bsv, 'SmartUTXO').get.should.be.a('function')
+  })
+
+  // The library currently has NO accessor properties — bsv.SmartUTXO, the last one,
+  // was removed in 9.0.0. The exclusion rule still matters: re-exporting a getter as a
+  // named ESM binding evaluates it at import time, which for a deprecated accessor
+  // means a warning (or worse, a side effect) fires on a bare `import`. Testing that
+  // against a synthetic accessor keeps the guarantee under test instead of letting it
+  // rot untested until someone adds a getter back.
+  itFromCheckout('excludes accessor properties from the named bindings', function () {
+    var bsv = require('../..')
+    var probe = '__esmAccessorProbe__'
+    var touched = false
+    Object.defineProperty(bsv, probe, {
+      configurable: true,
+      enumerable: true,
+      get: function () { touched = true; return 1 }
+    })
+    try {
+      var names = gen.exportableNames(bsv)
+      names.should.not.include(probe)
+      touched.should.equal(false, 'exportableNames must not invoke the getter')
+    } finally {
+      delete bsv[probe]
+    }
   })
 
   it('resolves real ESM default + named imports natively', function () {
@@ -55,9 +76,9 @@ describe('ESM wrapper (index.mjs)', function () {
       'PrivateKey === bsv.PrivateKey && typeof crypto.ECDSA === "function") ? 0 : 3)')
   })
 
-  it('does not emit the SmartUTXO deprecation warning at import (getter excluded)', function () {
-    // Re-exporting the getter would trip its console.warn at import time; stderr
-    // must be empty for a bare `import './index.mjs'`.
+  it('emits nothing on stderr at import', function () {
+    // Re-exporting a deprecated getter would trip its console.warn at import time;
+    // stderr must be empty for a bare `import './index.mjs'`.
     var res = spawnSync(process.execPath,
       ['--input-type=module', '-e', 'import ' + JSON.stringify('./index.mjs') + ';'],
       { cwd: ROOT, encoding: 'utf8' })
@@ -65,9 +86,12 @@ describe('ESM wrapper (index.mjs)', function () {
     res.stderr.should.equal('')
   })
 
-  it('keeps deprecated getters reachable via the default export only', function () {
+  it('no longer exposes bsv.SmartUTXO, which was removed in 9.0.0', function () {
+    // Deliberately asserted rather than dropped: the namespace export is gone, and the
+    // module is reached by direct import — require('@smartledger/bsv/lib/smartutxo') —
+    // which is what its deprecation warning instructed from 4.0.1 onward.
     runEsm(
       'import bsv from ' + JSON.stringify('./index.mjs') + ';' +
-      'process.exit(("SmartUTXO" in bsv) ? 0 : 3)')
+      'process.exit(("SmartUTXO" in bsv) ? 3 : 0)')
   })
 })

package/test/data/brc220-batch-vector.json

@@ -0,0 +1,129 @@
+{
+  "_comment": "BRC-220 batch-mode golden vector. Generated by tools/gen-brc220-batch-vector.js; do not hand-edit. Every value is derived from the labelled preimages recorded on each proof, so the file is reproducible from scratch in any language. THE POINT OF THIS FILE: BRC-220 writes the batch leaf as SHA256(0x00 || d) and never says what d is. This vector fixes d = proofHash. The `rejectedReading` block records what the same five proofs produce under d = canonicalBytes — equally sound cryptographically, a different root, and therefore not interoperable. An implementation matching `rejectedReading.root` has made the other choice, which is exactly the confusion this vector exists to make visible. This is a conformance target produced by @smartledger/bsv, not external validation. The tree beneath it is externally anchored: the RFC 6962 construction is verified against the published Certificate Transparency roots in test/notaryhash/merkle.js. n = 5 deliberately: RFC 6962 splits at the largest power of two BELOW n, so this splits 4/1 (a midpoint split would give 2/3 and a different root), and the odd count exercises the rule that the last leaf is never duplicated.",
+  "spec": "BRC-220",
+  "tree": "RFC 6962",
+  "leafDatum": "proofHash",
+  "leafRule": "leaf = SHA-256(0x00 || proofHash); node = SHA-256(0x01 || left || right)",
+  "leafCount": 5,
+  "root": "abb53eb3b2e3530d51685c6813bb85c85892d2f214c2dc504029d071434ac074",
+  "onChainRecordTail": {
+    "_comment": "The batch record is \"NOTARYHASH\" | u8(1) | u8(2) | merkleRoot(32) | u32be(leafCount).",
+    "merkleRoot": "abb53eb3b2e3530d51685c6813bb85c85892d2f214c2dc504029d071434ac074",
+    "leafCountU32be": "00000005"
+  },
+  "rejectedReading": {
+    "_comment": "What d = canonicalBytes yields over the SAME five proofs. Recorded so the divergence is checkable, not to endorse it.",
+    "leafDatum": "canonicalBytes",
+    "root": "4a59ade74941e4d6ca4b7c9f610e0a01a0c3f24cfa94efe816e53ef85f99e324"
+  },
+  "proofs": [
+    {
+      "leafIndex": 0,
+      "keyPreimage": "BRC-220/batch-vector/key/0",
+      "payloadPreimage": "BRC-220/batch-vector/payload/0",
+      "algorithm": "ECDSA-secp256k1",
+      "hashAlgorithm": "SHA-256",
+      "encoding": "raw",
+      "payloadHash": "c61d9c7e35b46dc1ceea30094e1a2809d45d16014fa70ccfc75fc4d6f672643b",
+      "publicKey": "02ce29a831e3d359386c7f70ef7fd85a75d79168d546dd8a60a520df0e24c65ef3",
+      "signature": "1026f99510a52863e43e3e5a57395c9838a3e44a768932d35b460a287630c24e3bc3b81e1bb2cb7c834f5be97936a6a49ff9eb7adaae7670e32d6bc3a5c067cf",
+      "createdAt": "2026-01-01T00:00:00.000Z",
+      "createdAtUnix": 1767225600,
+      "canonicalBytes": "0000000e4e6f74617279486173682f312e30010000000f45434453412d736563703235366b31000000075348412d32353600000020c61d9c7e35b46dc1ceea30094e1a2809d45d16014fa70ccfc75fc4d6f672643b0000002102ce29a831e3d359386c7f70ef7fd85a75d79168d546dd8a60a520df0e24c65ef3000000401026f99510a52863e43e3e5a57395c9838a3e44a768932d35b460a287630c24e3bc3b81e1bb2cb7c834f5be97936a6a49ff9eb7adaae7670e32d6bc3a5c067cf000000006955b900",
+      "proofHash": "83f3f73ebc5146b96cce1ee0b6ed4fd251a933a5332fbe5e5ab80da7920fe2c9",
+      "leafHash": "27547ba238fba426b766979a4a46cd97578945cf450c113e45b487291cb56ba4",
+      "leafHashUnderRejectedReading": "ab0ee539d3e08e07a6aac157af2d3df5da5f637c5c360fa158a00d14c6644f05",
+      "path": [
+        "7cd7c9b4bc74dcc5d586f7b04f1f7bdf025a15f7e173dba021c8ed7fd84acdbf",
+        "15c4df48172c7607990059e0f646616f7e68a33f8f5e1a7b54a9fa5ee770bbb4",
+        "8591a9b65f86529312b0eae212a95c15fd407f36cb8f4872a01bc0a64f13df83"
+      ]
+    },
+    {
+      "leafIndex": 1,
+      "keyPreimage": "BRC-220/batch-vector/key/1",
+      "payloadPreimage": "BRC-220/batch-vector/payload/1",
+      "algorithm": "ECDSA-secp256k1",
+      "hashAlgorithm": "SHA-256",
+      "encoding": "raw",
+      "payloadHash": "7509fe7fc39be0a6a6fc7350287f96a03911c8a3af188d8fb4b42f92957562a1",
+      "publicKey": "02b3dfb7e2a167aa401547d93e1b684b6c9896b67d3aadb7d938cdb00040e64ce3",
+      "signature": "1014debea11afb698d3fe0778bfd6390efdb28f8fe160eb4f382213f35641afd4a308a159d342a7507873fff587eaad5ae73eed047b1dbb27ee2b6b0924f6d60",
+      "createdAt": "2026-01-02T00:00:00.000Z",
+      "createdAtUnix": 1767312000,
+      "canonicalBytes": "0000000e4e6f74617279486173682f312e30010000000f45434453412d736563703235366b31000000075348412d323536000000207509fe7fc39be0a6a6fc7350287f96a03911c8a3af188d8fb4b42f92957562a10000002102b3dfb7e2a167aa401547d93e1b684b6c9896b67d3aadb7d938cdb00040e64ce3000000401014debea11afb698d3fe0778bfd6390efdb28f8fe160eb4f382213f35641afd4a308a159d342a7507873fff587eaad5ae73eed047b1dbb27ee2b6b0924f6d600000000069570a80",
+      "proofHash": "29fca10808a3653efbe38abd5f0b926aa09f13bff7847475139a422869729e77",
+      "leafHash": "7cd7c9b4bc74dcc5d586f7b04f1f7bdf025a15f7e173dba021c8ed7fd84acdbf",
+      "leafHashUnderRejectedReading": "320aeefe6077a6163d6d72bda3b54443bb973220ef94a448e7e8c9be787f1242",
+      "path": [
+        "27547ba238fba426b766979a4a46cd97578945cf450c113e45b487291cb56ba4",
+        "15c4df48172c7607990059e0f646616f7e68a33f8f5e1a7b54a9fa5ee770bbb4",
+        "8591a9b65f86529312b0eae212a95c15fd407f36cb8f4872a01bc0a64f13df83"
+      ]
+    },
+    {
+      "leafIndex": 2,
+      "keyPreimage": "BRC-220/batch-vector/key/2",
+      "payloadPreimage": "BRC-220/batch-vector/payload/2",
+      "algorithm": "ECDSA-secp256k1",
+      "hashAlgorithm": "SHA-256",
+      "encoding": "raw",
+      "payloadHash": "b09ac5900c811654d3c31b43ad6c65512f9baa6585b121bdc88f43b40cbc55a0",
+      "publicKey": "02363ba0177d207ee13a23b63c9feb5c297e071c88c1d859312bf7cb46778b17f7",
+      "signature": "726113d4d8dafbe8f03b89377ffad4a4086ee30450c3e03ea62ae30d26c216091147dbfb36fa6c6f7e7e59eeae21c9b379e8fd012c7f8b87ac4ff416981dff11",
+      "createdAt": "2026-01-03T00:00:00.000Z",
+      "createdAtUnix": 1767398400,
+      "canonicalBytes": "0000000e4e6f74617279486173682f312e30010000000f45434453412d736563703235366b31000000075348412d32353600000020b09ac5900c811654d3c31b43ad6c65512f9baa6585b121bdc88f43b40cbc55a00000002102363ba0177d207ee13a23b63c9feb5c297e071c88c1d859312bf7cb46778b17f700000040726113d4d8dafbe8f03b89377ffad4a4086ee30450c3e03ea62ae30d26c216091147dbfb36fa6c6f7e7e59eeae21c9b379e8fd012c7f8b87ac4ff416981dff110000000069585c00",
+      "proofHash": "3c44828bea3ca01dfcd5305a839ce02cc1e855f5a7c7028bb4931d42dea3aa2b",
+      "leafHash": "9419bb538d2bb38e931ea45f2a6e83d38f99bf2679f6e31cd02145e68cda1d54",
+      "leafHashUnderRejectedReading": "b6beedf0fd93c2d32fe08db38242ec737e9f03605c457f0910ab42ff0f7c2eed",
+      "path": [
+        "341883196d41f5956f6b87238f71018be2bfc6ced6676ba64f5b1b0369b199a5",
+        "503a52c36f87e417987746db6964fbc21a177f034cc58639784e1e5b313cc7e4",
+        "8591a9b65f86529312b0eae212a95c15fd407f36cb8f4872a01bc0a64f13df83"
+      ]
+    },
+    {
+      "leafIndex": 3,
+      "keyPreimage": "BRC-220/batch-vector/key/3",
+      "payloadPreimage": "BRC-220/batch-vector/payload/3",
+      "algorithm": "ECDSA-secp256k1",
+      "hashAlgorithm": "SHA-256",
+      "encoding": "raw",
+      "payloadHash": "158d3edf327c1994d7154f9271dadc5d96418b54713aafbbf9ad6c534bf3dbe2",
+      "publicKey": "02927267de13d07285b06122293a72350376cc85060b00b8426c48e0cb2e39e2f9",
+      "signature": "8c1625d984577226d3f229d83aa1b3025821d1ef076b890f21667c62f49508640eaeb5ac1bfc2250a0b475653a598fa5f69f28b7e23aad18986a6f4a468d490b",
+      "createdAt": "2026-01-04T00:00:00.000Z",
+      "createdAtUnix": 1767484800,
+      "canonicalBytes": "0000000e4e6f74617279486173682f312e30010000000f45434453412d736563703235366b31000000075348412d32353600000020158d3edf327c1994d7154f9271dadc5d96418b54713aafbbf9ad6c534bf3dbe20000002102927267de13d07285b06122293a72350376cc85060b00b8426c48e0cb2e39e2f9000000408c1625d984577226d3f229d83aa1b3025821d1ef076b890f21667c62f49508640eaeb5ac1bfc2250a0b475653a598fa5f69f28b7e23aad18986a6f4a468d490b000000006959ad80",
+      "proofHash": "0692e22da9b68634e5384bb012324c140c676d2301e078a67f17e335661a9565",
+      "leafHash": "341883196d41f5956f6b87238f71018be2bfc6ced6676ba64f5b1b0369b199a5",
+      "leafHashUnderRejectedReading": "ca8d122b3f396533867bbe79cc0b878a3ece675ef636622cb321843cfc2b0a6c",
+      "path": [
+        "9419bb538d2bb38e931ea45f2a6e83d38f99bf2679f6e31cd02145e68cda1d54",
+        "503a52c36f87e417987746db6964fbc21a177f034cc58639784e1e5b313cc7e4",
+        "8591a9b65f86529312b0eae212a95c15fd407f36cb8f4872a01bc0a64f13df83"
+      ]
+    },
+    {
+      "leafIndex": 4,
+      "keyPreimage": "BRC-220/batch-vector/key/4",
+      "payloadPreimage": "BRC-220/batch-vector/payload/4",
+      "algorithm": "ECDSA-secp256k1",
+      "hashAlgorithm": "SHA-256",
+      "encoding": "raw",
+      "payloadHash": "1c9be18eba3f6d45e49ba3cc651978d803c4a031e61e9c4ea0c5c4954d0fc7b8",
+      "publicKey": "02497aeb1118e5fe44af0aade81945dc23b8c727433a9d76e2ec37e914ce0467cf",
+      "signature": "c903ba5d61bdbd983168febeabba3997c8811a24cf4624f6952887f6dd50c9141d07a20abcb7e6822a1012f15c8b5df63d52d28b13cddf9efce451d2a020a953",
+      "createdAt": "2026-01-05T00:00:00.000Z",
+      "createdAtUnix": 1767571200,
+      "canonicalBytes": "0000000e4e6f74617279486173682f312e30010000000f45434453412d736563703235366b31000000075348412d323536000000201c9be18eba3f6d45e49ba3cc651978d803c4a031e61e9c4ea0c5c4954d0fc7b80000002102497aeb1118e5fe44af0aade81945dc23b8c727433a9d76e2ec37e914ce0467cf00000040c903ba5d61bdbd983168febeabba3997c8811a24cf4624f6952887f6dd50c9141d07a20abcb7e6822a1012f15c8b5df63d52d28b13cddf9efce451d2a020a95300000000695aff00",
+      "proofHash": "1a9c6bc1a6cf8319344ca8c30ca9e9eef8ab3df732748f6be2c824bb84ec0ca9",
+      "leafHash": "8591a9b65f86529312b0eae212a95c15fd407f36cb8f4872a01bc0a64f13df83",
+      "leafHashUnderRejectedReading": "40cfb9005011331c8cbb4524c27b04b3e62cbe525e07ec1dc443de25079b16d6",
+      "path": [
+        "060ca4e4bbcb647ab0162bb027cd8f08c1577aaa7069166dd629a3df7e57befd"
+      ]
+    }
+  ]
+}

package/test/notaryhash/batch_vector.js

@@ -0,0 +1,282 @@
+'use strict'
+
+/* global describe, it */
+
+// The BRC-220 batch-mode golden vector.
+//
+// BRC-220 writes the batch leaf as `SHA256(0x00 ‖ d)` and never says what `d` is. Prose
+// cannot reliably close that gap — two implementers read the same sentence and chose
+// differently — so this file holds a concrete vector that any implementation can check
+// itself against.
+//
+// What this vector is: a CONFORMANCE TARGET produced by this library. It is not external
+// validation, and nothing here proves our reading is the one the spec intended. What makes
+// it worth having is that the tree underneath it IS externally anchored — the RFC 6962
+// construction is checked against the published Certificate Transparency roots in
+// merkle.js. Given a tree that provably matches RFC 6962, this vector pins the one thing
+// the spec leaves open.
+//
+// These tests rebuild every value from the recorded inputs rather than reading the
+// recorded outputs back. A test that asserts `vector.root === vector.root` would pass
+// forever while proving nothing, which is the failure mode this repository has fixed most
+// often.
+//
+// See docs/BRC220_BATCH_LEAF_AMENDMENT.md and tools/gen-brc220-batch-vector.js.
+
+require('chai').should()
+var vector = require('../data/brc220-batch-vector.json')
+var Hash = require('../../lib/crypto/hash')
+var Encoding = require('../../lib/notaryhash/encoding')
+var Merkle = require('../../lib/notaryhash/merkle')
+var Suites = require('../../lib/notaryhash/suites')
+var NotaryHash = require('../../lib/notaryhash')
+var NotaryScript = require('../../lib/notaryhash/script')
+var BN = require('../../lib/crypto/bn')
+var PrivateKey = require('../../lib/privatekey')
+// Deliberately a SECOND implementation: see the independent-verification test below.
+var { secp256k1 } = require('@noble/curves/secp256k1.js')
+
+function hex (s) { return Buffer.from(s, 'hex') }
+
+describe('BRC-220 batch golden vector', function () {
+  describe('the vector describes the shape it claims', function () {
+    it('is five leaves, which is deliberate', function () {
+      // n=5 splits 4/1 under RFC 6962 (largest power of two BELOW n), where a midpoint
+      // split would give 2/3 and a different root. Odd n also exercises the rule that the
+      // last leaf is never duplicated. A power-of-two vector would catch neither.
+      vector.leafCount.should.equal(5)
+      vector.proofs.length.should.equal(5)
+      Merkle.largestPowerOfTwoBelow(5).should.equal(4)
+    })
+
+    it('names its tree and leaf datum explicitly', function () {
+      vector.tree.should.equal('RFC 6962')
+      vector.leafDatum.should.equal('proofHash')
+    })
+
+    // The 4/1 split shows up in the path lengths: the lone right-hand leaf needs one
+    // sibling, the four on the left need three. If a future change altered the split rule,
+    // this would move before any root did.
+    it('has path lengths matching a 4/1 split', function () {
+      vector.proofs.map(function (p) { return p.path.length })
+        .should.deep.equal([3, 3, 3, 3, 1])
+    })
+  })
+
+  describe('every input is derived, so the vector is reproducible', function () {
+    it('rebuilds each payloadHash from its recorded preimage', function () {
+      vector.proofs.forEach(function (p) {
+        Hash.sha256(Buffer.from(p.payloadPreimage, 'utf8')).toString('hex')
+          .should.equal(p.payloadHash, 'leaf ' + p.leafIndex)
+      })
+    })
+
+    it('records the preimage labels the generator actually uses', function () {
+      vector.proofs.forEach(function (p, i) {
+        p.keyPreimage.should.equal('BRC-220/batch-vector/key/' + i)
+        p.payloadPreimage.should.equal('BRC-220/batch-vector/payload/' + i)
+      })
+    })
+
+    it('uses raw encoding: 64-byte signatures and 33-byte compressed keys', function () {
+      vector.proofs.forEach(function (p) {
+        p.encoding.should.equal('raw')
+        hex(p.signature).length.should.equal(64, 'leaf ' + p.leafIndex + ' signature')
+        hex(p.publicKey).length.should.equal(33, 'leaf ' + p.leafIndex + ' publicKey')
+      })
+    })
+
+    it('rebuilds createdAtUnix from the recorded ISO timestamp', function () {
+      vector.proofs.forEach(function (p) {
+        Encoding.toUnixSeconds(p.createdAt).should.equal(p.createdAtUnix)
+      })
+    })
+  })
+
+  describe('every proof stands on its own', function () {
+    // Each signature must verify independently. Without this the vector could pin a tree
+    // built over five values that are not valid proofs at all.
+    it('verifies all five signatures under the named suite', function () {
+      vector.proofs.forEach(function (p) {
+        Suites.verify(p.algorithm, hex(p.payloadHash), hex(p.signature), hex(p.publicKey))
+          .should.equal(true, 'leaf ' + p.leafIndex + ' signature must verify')
+      })
+    })
+
+    // THE test this file most needs, and the one it originally lacked.
+    //
+    // The assertion above uses our own suite, and the generator uses our own signer, so
+    // the two agree by construction. The first version of this vector was generated with
+    // `endian: 'little'` — matching a verifier bug — and every signature in it was
+    // unverifiable by any other implementation. Both tests above still passed, because
+    // both sides of the comparison were wrong in the same direction.
+    //
+    // @noble/curves shares no signing or verification code with lib/crypto/ecdsa.js. If
+    // this vector is ever regenerated by a signer that disagrees with the rest of the
+    // world, this is the assertion that says so.
+    //
+    // { prehash: false } is REQUIRED: noble v2 hashes its input by default, so omitting
+    // it would compare our signature over `payloadHash` against noble's over
+    // `sha256(payloadHash)` — a mismatch that looks exactly like the bug this guards.
+    it('verifies all five signatures under an INDEPENDENT implementation', function () {
+      vector.proofs.forEach(function (p) {
+        secp256k1.verify(hex(p.signature), hex(p.payloadHash), hex(p.publicKey), { prehash: false })
+          .should.equal(true,
+            'leaf ' + p.leafIndex + ' signature must verify under @noble/curves, not just ours')
+      })
+    })
+
+    it('derives each public key from the recorded key preimage', function () {
+      // Ties the published public keys back to their labelled preimages, so a third party
+      // can reproduce the keys and not merely check the signatures against them.
+      vector.proofs.forEach(function (p) {
+        var priv = PrivateKey.fromObject({
+          bn: BN.fromBuffer(Hash.sha256(Buffer.from(p.keyPreimage, 'utf8'))),
+          compressed: true,
+          network: 'livenet'
+        })
+        priv.publicKey.toBuffer().toString('hex')
+          .should.equal(p.publicKey, 'leaf ' + p.leafIndex + ' public key must derive from its preimage')
+      })
+    })
+
+    it('rebuilds each canonicalBytes from the recorded fields', function () {
+      vector.proofs.forEach(function (p) {
+        Encoding.canonicalBytes({
+          algorithm: p.algorithm,
+          hashAlgorithm: p.hashAlgorithm,
+          payloadHash: hex(p.payloadHash),
+          publicKey: hex(p.publicKey),
+          signature: hex(p.signature),
+          createdAtUnix: p.createdAtUnix
+        }).toString('hex').should.equal(p.canonicalBytes, 'leaf ' + p.leafIndex)
+      })
+    })
+
+    it('rebuilds each proofHash as SHA-256 of those canonical bytes', function () {
+      vector.proofs.forEach(function (p) {
+        Hash.sha256(hex(p.canonicalBytes)).toString('hex')
+          .should.equal(p.proofHash, 'leaf ' + p.leafIndex)
+      })
+    })
+  })
+
+  describe('the leaf definition the spec leaves open', function () {
+    it('rebuilds each leaf as SHA-256(0x00 || proofHash)', function () {
+      vector.proofs.forEach(function (p) {
+        Merkle.hashLeaf(hex(p.proofHash)).toString('hex')
+          .should.equal(p.leafHash, 'leaf ' + p.leafIndex)
+      })
+    })
+
+    it('rebuilds the root from the five proofHash values', function () {
+      Merkle.root(vector.proofs.map(function (p) { return hex(p.proofHash) }))
+        .toString('hex').should.equal(vector.root)
+    })
+
+    it('rebuilds every inclusion path and folds each back to the root', function () {
+      var leaves = vector.proofs.map(function (p) { return hex(p.proofHash) })
+      vector.proofs.forEach(function (p, i) {
+        Merkle.path(leaves, i).map(function (n) { return n.toString('hex') })
+          .should.deep.equal(p.path, 'path for leaf ' + i)
+        Merkle.verifyInclusion(leaves[i], i, vector.leafCount,
+          p.path.map(hex), hex(vector.root)).should.equal(true, 'fold for leaf ' + i)
+      })
+    })
+
+    it('encodes leafCount as u32be for the on-chain record', function () {
+      var buf = Buffer.alloc(4)
+      buf.writeUInt32BE(vector.leafCount, 0)
+      buf.toString('hex').should.equal(vector.onChainRecordTail.leafCountU32be)
+      vector.onChainRecordTail.merkleRoot.should.equal(vector.root)
+    })
+  })
+
+  describe('the rejected reading is recorded and really does diverge', function () {
+    it('reproduces the canonicalBytes-leaf root the vector records', function () {
+      Merkle.root(vector.proofs.map(function (p) { return hex(p.canonicalBytes) }))
+        .toString('hex').should.equal(vector.rejectedReading.root)
+    })
+
+    // The whole reason the vector exists. Equal in strength, different root.
+    it('is a different root from the proofHash reading', function () {
+      vector.root.should.not.equal(vector.rejectedReading.root)
+    })
+
+    it('records each leaf hash under both readings, and they differ', function () {
+      vector.proofs.forEach(function (p) {
+        Merkle.hashLeaf(hex(p.canonicalBytes)).toString('hex')
+          .should.equal(p.leafHashUnderRejectedReading, 'leaf ' + p.leafIndex)
+        p.leafHash.should.not.equal(p.leafHashUnderRejectedReading)
+      })
+    })
+  })
+
+  // The amendment publishes these values as the text to put in the spec. A document that
+  // has drifted from the artifact it describes is worse than no document, and nothing
+  // else would notice: the doc is prose, the vector is JSON, and they are edited
+  // separately.
+  describe('the amendment document publishes the same values', function () {
+    var fs = require('fs')
+    var path = require('path')
+    var doc = fs.readFileSync(
+      path.join(__dirname, '..', '..', 'docs', 'BRC220_BATCH_LEAF_AMENDMENT.md'), 'utf8')
+
+    it('publishes the root', function () {
+      doc.indexOf(vector.root).should.be.above(-1, 'root missing from the amendment')
+    })
+
+    it('publishes the rejected reading root, so the divergence is diagnosable', function () {
+      doc.indexOf(vector.rejectedReading.root)
+        .should.be.above(-1, 'rejected reading root missing from the amendment')
+    })
+
+    it('publishes every proofHash', function () {
+      vector.proofs.forEach(function (p) {
+        doc.indexOf(p.proofHash).should.be.above(-1,
+          'proofHash for leaf ' + p.leafIndex + ' missing from the amendment')
+      })
+    })
+
+    it('publishes the leaf-4 audit path and the u32be leaf count', function () {
+      doc.indexOf(vector.proofs[4].path[0]).should.be.above(-1, 'leaf 4 path missing')
+      doc.indexOf(vector.onChainRecordTail.leafCountU32be).should.be.above(-1,
+        'u32be leaf count missing')
+    })
+  })
+
+  describe('the library verifies certificates built from this vector', function () {
+    it('accepts a batch certificate for every leaf', function () {
+      vector.proofs.forEach(function (p, i) {
+        var report = NotaryHash.verifyBatchInclusion({
+          mode: NotaryScript.MODE.BATCH,
+          proofHash: p.proofHash,
+          merkle: {
+            root: vector.root,
+            leafIndex: i,
+            leafCount: vector.leafCount,
+            path: p.path
+          }
+        })
+        report.valid.should.equal(true, 'leaf ' + i)
+        report.errors.should.deep.equal([])
+      })
+    })
+
+    // An implementation that chose the other reading produces exactly this, and this is
+    // what it looks like when it reaches our verifier.
+    it('rejects a certificate carrying the rejected reading root', function () {
+      var report = NotaryHash.verifyBatchInclusion({
+        mode: NotaryScript.MODE.BATCH,
+        proofHash: vector.proofs[0].proofHash,
+        merkle: {
+          root: vector.rejectedReading.root,
+          leafIndex: 0,
+          leafCount: vector.leafCount,
+          path: vector.proofs[0].path
+        }
+      })
+      report.valid.should.equal(false)
+    })
+  })
+})

package/test/ordinals/inscription.js

@@ -223,16 +223,19 @@ describe('Ordinals inscriptions', function () {
     })
   })
 
-  // The case that motivated making the script-size cap configurable: transferring a
-  // large inscription. The envelope is inert, so the spend is an ordinary P2PKH — but
-  // the interpreter could not even load the script, because total script size was a
-  // hard-coded 10,000 bytes that useGenesisLimits() did not lift.
+  // Transferring a large inscription. The envelope is inert, so the spend is an
+  // ordinary P2PKH — but under pre-Genesis rules the interpreter could not even load
+  // the script, because total script size was capped at 10,000 bytes.
   describe('transferring a large inscription', function () {
     var I = bsv.Script.Interpreter
     var Sighash = bsv.Transaction.Sighash
     var BN = bsv.crypto.BN
     var SIGHASH = bsv.crypto.Signature.SIGHASH_ALL | bsv.crypto.Signature.SIGHASH_FORKID
+    // Pre-Genesis: no era bit, so the 520-byte element cap and the 10,000-byte script
+    // cap both still apply. Kept deliberately, to show what they reject.
     var FLAGS = I.SCRIPT_VERIFY_STRICTENC | I.SCRIPT_ENABLE_SIGHASH_FORKID
+    // Current mainnet, where Genesis lifted both.
+    var MAINNET = I.mainnetFlags()
     var saved
 
     beforeEach(function () { saved = I.getLimits() })
@@ -265,35 +268,43 @@ describe('Ordinals inscriptions', function () {
       return { lock: lock, unlock: unlock, spend: spend, sig: sig, owner: owner }
     }
 
-    function evaluate (t) {
+    // Both caps are derived from the ERA flags, not from the limit statics: see
+    // Interpreter#maxScriptElementSize and #maxScriptSize, each of which branches on
+    // isAfterGenesis(). Passing the era is therefore the whole fix — these tests used
+    // to call SmartContract.enableGenesis(), which raised process-wide statics instead
+    // and had to be undone in an afterEach or it changed the rules for every test that
+    // ran later.
+    function evaluate (t, flags) {
       var interp = new I()
-      var ok = interp.verify(t.unlock, t.lock, t.spend, 0, FLAGS, new BN(1))
+      var ok = interp.verify(t.unlock, t.lock, t.spend, 0,
+        flags === undefined ? MAINNET : flags, new BN(1))
       return { ok: ok, err: interp.errstr }
     }
 
     it('cannot be evaluated under pre-Genesis limits — two separate caps bite', function () {
+      // Explicitly pre-Genesis: FLAGS carries no era bit, so both caps still apply.
       // Under 10 KB the script loads and the 520-byte push cap rejects the content...
-      var small = evaluate(transfer(3))
+      var small = evaluate(transfer(3), FLAGS)
       small.ok.should.equal(false)
       small.err.should.equal('SCRIPT_ERR_PUSH_SIZE')
       // ...over 10 KB it never gets that far: evaluate() refuses the script outright.
-      // This is the cap useGenesisLimits() could not lift.
-      var big = evaluate(transfer(50))
+      var big = evaluate(transfer(50), FLAGS)
       big.ok.should.equal(false)
       big.err.should.equal('SCRIPT_ERR_SCRIPT_SIZE')
     })
 
-    it('evaluates once Genesis limits are enabled', function () {
-      bsv.SmartContract.enableGenesis()
+    it('evaluates under mainnet consensus, with the limit statics untouched', function () {
+      var before = JSON.stringify(I.getLimits())
       var t = transfer(50)
-      t.lock.toBuffer().length.should.be.above(10000) // past the old hard-coded cap
+      t.lock.toBuffer().length.should.be.above(10000) // past the pre-Genesis cap
       evaluate(t).ok.should.equal(true)
+      // The point of the change: no process-wide mutation was needed to get here.
+      JSON.stringify(I.getLimits()).should.equal(before)
     })
 
     it('agrees with a direct signature check against the sighash', function () {
       // The fallback used when the interpreter cannot run: verify the signature over
       // the sighash directly. It must agree with the interpreter where both work.
-      bsv.SmartContract.enableGenesis()
       var t = transfer(50)
       var hash = Sighash.sighash(t.spend, SIGHASH, 0, t.lock, new BN(1), FLAGS)
       var sigOk = bsv.crypto.ECDSA.verify(hash, t.sig, t.owner.toPublicKey(), 'little')
@@ -302,7 +313,6 @@ describe('Ordinals inscriptions', function () {
     })
 
     it('rejects a signature made over the base lock instead of the full script', function () {
-      bsv.SmartContract.enableGenesis()
       var t = transfer(50)
       var baseLock = bsv.Script.buildPublicKeyHashOut(t.owner.toAddress())
       var wrong = Sighash.sign(t.spend, t.owner, SIGHASH, 0, baseLock, new BN(1), FLAGS)