@smartledger/bsv 9.1.0 → 9.2.0

package/CHANGELOG.md

@@ -7,6 +7,92 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [9.2.0] - 2026-08-25
+
+### Added — RFC 8785 canonicalization is now public API
+
+`@smartledger/bsv/jcs`, and `bsv.JCS` on the namespace. Both are the implementation
+that has been in `lib/util/jcs.js` since 8.2.0, unchanged in what it produces.
+
+It was private: absent from the `exports` map and from `bsv.d.ts`. So the only
+canonicalizer a consumer could reach was `bsv.canonicalizeClaim`, which is not RFC
+8785 — and downstream packages independently reimplemented the non-conformant form,
+because it was the one they could see.
+
+Use it for anything hashed or signed that someone else might check:
+
+```js
+const JCS = require('@smartledger/bsv/jcs')
+JCS.stringify({ 2: 'two', 10: 'ten' })   // {"10":"ten","2":"two"}
+```
+
+Two behaviours changed, neither reachable by input that previously succeeded:
+circular structures now throw a typed error instead of exhausting the call stack,
+and `bigint` throws instead of falling through to a generic type error. The function
+is now reachable from verifiers, and verifier input is untrusted.
+
+### Deprecated — the default canonicalization of LTP claim hashes
+
+`LTP.Claim.canonicalize`, `LTP.Claim.hash`, `bsv.canonicalizeClaim` and
+`bsv.hashClaim` take an optional second argument:
+`bsv.LTP.Claim.CANONICALIZATION.JCS` or `.LEGACY`. Omitting it selects `LEGACY`,
+warns once, and keeps working. **The default becomes `JCS` in 10.0.0.**
+
+The legacy form sorts keys and then rebuilds the object, which loses the sort: V8
+orders integer-like own properties numerically ahead of string keys whatever order
+they were inserted in.
+
+```
+LEGACY   {"2":"two","10":"ten"}
+JCS      {"10":"ten","2":"two"}      RFC 8785, UTF-16 code unit order
+```
+
+It is deterministic, so nothing already hashed is wrong and nothing is forgeable —
+signing and verification within this library have always agreed. It is not
+*interoperable*: an RFC 8785 implementation in another language computes a different
+claim hash and rejects a valid one. It only bites when a claim has integer-like keys
+— lot numbers, unit numbers, years — which is why it went unnoticed, and why it
+fails in a counterparty's verifier rather than in our own tests.
+
+Per STABILITY.md this is a minor, so the default does not move in 9.x. Pass the
+argument explicitly to pin behaviour across 10.0.0.
+
+An unrecognised value throws rather than falling back to `LEGACY`: a typo such as
+`'JCS'` quietly producing differently-hashed claims would recreate the exact failure
+this change exists to remove.
+
+`prepareClaimValidation`, `prepareClaimAttestation` and `prepareClaimDispute` emit
+hashes that callers store as identifiers and cannot pass an argument for. Those are
+pinned to `LEGACY` for all of 9.x and do not warn — a notice naming a function the
+caller never called is noise. They move to `JCS` in 10.0.0 as one documented change.
+
+## [9.1.1] - 2026-08-24
+
+### Fixed — MerkleBlock shared mutable state with its caller
+
+The constructor stored `arg.hashes` and `arg.flags` directly, and `toObject()` handed
+the same arrays back out. A MerkleBlock and the object it was built from — or the
+object it produced — were therefore the same arrays, and mutating either changed the
+other at a distance:
+
+```js
+const mb = new MerkleBlock(obj)
+mb.hashes.push(x)      // obj.hashes grew too
+const out = mb.toObject()
+out.flags.pop()        // mb.flags shrank too
+```
+
+Both directions now copy. Contents, round-trips and validation are unchanged; a
+non-array is still passed through rather than coerced, since the constructor never
+validated these fields and 9.x does not turn a tolerated input into a throw.
+
+Found as order-dependence in this library's own suite — tests that mutate a block
+built from the shared `data.JSON[0]` corrupted that fixture for every test after them,
+so a new test passed alone and failed in the full run. Measured before and after: the
+fixture does not survive `test/block/merkleblock.js` on 9.1.0, and does now. The tests
+were the messenger; the aliasing is the defect, and a caller building a MerkleBlock
+from their own object hits it the same way.
+
 ## [9.1.0] - 2026-08-23
 
 Nothing in this release breaks a caller. That is the release.

package/README.md

@@ -2,7 +2,7 @@
 
 Bitcoin SV library with an interpreter-verified script engine.
 
-[![Version](https://img.shields.io/badge/version-9.1.0-blue.svg)](https://www.npmjs.com/package/@smartledger/bsv)
+[![Version](https://img.shields.io/badge/version-9.2.0-blue.svg)](https://www.npmjs.com/package/@smartledger/bsv)
 [![License](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
 [![Stability](https://img.shields.io/badge/9.x%20stable%20until-2027--09--01-brightgreen.svg)](STABILITY.md)
 
@@ -155,44 +155,44 @@ const bsv = require('@smartledger/bsv')                 // 128 modules
 ### **Core Modules**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv.min.js** | 1041KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@9.1.0/bsv.min.js` |
-| **bsv.bundle.js** | 1041KB | Everything in one file | `unpkg.com/@smartledger/bsv@9.1.0/bsv.bundle.js` |
+| **bsv.min.js** | 1042KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@9.2.0/bsv.min.js` |
+| **bsv.bundle.js** | 1042KB | Everything in one file | `unpkg.com/@smartledger/bsv@9.2.0/bsv.bundle.js` |
 
 ### **W3C Verifiable Credentials**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **🟢 bsv-didweb.min.js** | 166KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@9.1.0/bsv-didweb.min.js` |
-| **🟢 bsv-vcjwt.min.js** | 166KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@9.1.0/bsv-vcjwt.min.js` |
-| **🟢 bsv-statuslist.min.js** | 256KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@9.1.0/bsv-statuslist.min.js` |
-| **🟢 bsv-anchor.min.js** | 164KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@9.1.0/bsv-anchor.min.js` |
+| **🟢 bsv-didweb.min.js** | 166KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@9.2.0/bsv-didweb.min.js` |
+| **🟢 bsv-vcjwt.min.js** | 166KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@9.2.0/bsv-vcjwt.min.js` |
+| **🟢 bsv-statuslist.min.js** | 256KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@9.2.0/bsv-statuslist.min.js` |
+| **🟢 bsv-anchor.min.js** | 164KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@9.2.0/bsv-anchor.min.js` |
 
 ### **Smart Contract & Development**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-smartcontract.min.js** | 140KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@9.1.0/bsv-smartcontract.min.js` |
-| **bsv-covenant.min.js** | 35KB | Covenant operations | `unpkg.com/@smartledger/bsv@9.1.0/bsv-covenant.min.js` |
-| **bsv-script-helper.min.js** | 33KB | Custom script tools | `unpkg.com/@smartledger/bsv@9.1.0/bsv-script-helper.min.js` |
-| **bsv-security.min.js** | 32KB | Security enhancements | `unpkg.com/@smartledger/bsv@9.1.0/bsv-security.min.js` |
+| **bsv-smartcontract.min.js** | 140KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@9.2.0/bsv-smartcontract.min.js` |
+| **bsv-covenant.min.js** | 35KB | Covenant operations | `unpkg.com/@smartledger/bsv@9.2.0/bsv-covenant.min.js` |
+| **bsv-script-helper.min.js** | 33KB | Custom script tools | `unpkg.com/@smartledger/bsv@9.2.0/bsv-script-helper.min.js` |
+| **bsv-security.min.js** | 32KB | Security enhancements | `unpkg.com/@smartledger/bsv@9.2.0/bsv-security.min.js` |
 
 ### **Legal & Compliance**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-ltp.min.js** | 535KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@9.1.0/bsv-ltp.min.js` |
-| **bsv-gdaf.min.js** | 1041KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@9.1.0/bsv-gdaf.min.js` |
+| **bsv-ltp.min.js** | 539KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@9.2.0/bsv-ltp.min.js` |
+| **bsv-gdaf.min.js** | 1042KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@9.2.0/bsv-gdaf.min.js` |
 
 ### **Advanced Cryptography**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-shamir.min.js** | 177KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@9.1.0/bsv-shamir.min.js` |
+| **bsv-shamir.min.js** | 177KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@9.2.0/bsv-shamir.min.js` |
 
 ### **Utilities**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-ecies.min.js** | 137KB | Encryption | `unpkg.com/@smartledger/bsv@9.1.0/bsv-ecies.min.js` |
-| **bsv-message.min.js** | 34KB | Message signing | `unpkg.com/@smartledger/bsv@9.1.0/bsv-message.min.js` |
-| **bsv-mnemonic.min.js** | 320KB | HD wallets | `unpkg.com/@smartledger/bsv@9.1.0/bsv-mnemonic.min.js` |
+| **bsv-ecies.min.js** | 137KB | Encryption | `unpkg.com/@smartledger/bsv@9.2.0/bsv-ecies.min.js` |
+| **bsv-message.min.js** | 34KB | Message signing | `unpkg.com/@smartledger/bsv@9.2.0/bsv-message.min.js` |
+| **bsv-mnemonic.min.js** | 320KB | HD wallets | `unpkg.com/@smartledger/bsv@9.2.0/bsv-mnemonic.min.js` |
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@9.1.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.2.0/bsv.min.js"></script>
 <script>
   const key = bsv.PrivateKey.fromRandom()
 </script>
@@ -240,4 +240,4 @@ MIT
 
 ---
 
-**SmartLedger-BSV v9.1.0**
+**SmartLedger-BSV v9.2.0**