@smartledger/bsv 9.10.1 → 9.11.1

package/CHANGELOG.md

@@ -7,6 +7,77 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [9.11.1] - 2026-09-17
+
+**A patch: a script written as ASM or as a string reads back as the same script.** No API change.
+
+### Fixed — a script written as text reads back as the same script
+
+An opcode with no name — `0xba` to `0xfc`, 67 of them — did not survive being written out:
+
+| | 9.11.0 | now |
+| --- | --- | --- |
+| `toASM()` of `51ba` | `OP_1 ba`, which `fromASM` reads as a one-byte push: `5101ba` | `OP_1 0xba`, read back as `51ba` |
+| `toString()` of `51ba` | `OP_1 0xba`, which `fromString` rejects | unchanged, and read back as `51ba` |
+
+ASM wrote the byte as bare hex, which is also how it writes a one-byte data push, so the two
+were indistinguishable and a script written to ASM and read back was a different script. Both
+forms now write the raw byte as `0xba`, as bitcoind's script test format does, and both read
+it back, in either case. The opcodes are not given names: `Opcode.map` invents none above
+`OP_NOP10`, and a name such as `OP_NOP11` would suggest a no-op where the node fails the
+script. They still execute as `SCRIPT_ERR_BAD_OPCODE`.
+
+`Script.fromASM('')` now returns an empty script. It returned `OP_0`, so an empty script
+written with `toASM()` read back as a different one.
+
+Only these outputs change: every other script writes the same ASM and the same string as in
+9.11.0, and every text 9.11.0 read is read the same way, except the two cases above, which it
+either misread or rejected. Checked by writing 4,000 generated scripts and reading back 8,000
+texts with both versions. ASM still cannot say how data was pushed, so a non-minimal push is
+written minimally; `toString()` keeps it.
+
+Reported by the scriptmin work (codenlighten/scriptmin#3).
+
+The conformance corpus recorded the old ASM for one case, `parse multisig`, whose script
+holds a raw `0xda`. That case's `asm` is the only value regenerated; its hex and string are
+unchanged.
+
+## [9.11.0] - 2026-09-16
+
+**The interpreter now accepts only what the node accepts when a script pushes a copy of a signature, and signature checks over large scripts are about eight times faster.** No API change. The consensus fix follows bitcoin-sv v1.2.0 `CleanupScriptCode`; every signature digest is byte-identical to 9.10.1.
+
+### Fixed — a spend the network rejects was accepted: signatures removed from the scriptCode where the node keeps them
+
+Before checking a signature, `OP_CHECKSIG`, `OP_CHECKSIGVERIFY` and `OP_CHECKMULTISIG(VERIFY)`
+removed every copy of the signature from the script it signs. The node does that only when
+FORKID is not in effect (bitcoin-sv `src/script/interpreter.cpp`, `CleanupScriptCode`):
+
+```cpp
+if (!(flags & SCRIPT_ENABLE_SIGHASH_FORKID) || !sigHashType.hasForkId())
+    scriptCode.FindAndDelete(CScript(vchSig));
+```
+
+So a locking script that pushes a copy of a signature could be satisfied by that signature
+made over the script *without* the push. The library removed the push, found the digest it
+expected and accepted; the node signs over the script as it is and rejects. A covenant or
+wallet relying on this library's verdict could build, and consider final, a transaction the
+network will never mine. All three opcodes now follow the node's rule.
+
+`Script#findAndDelete` also skipped the chunk after each removal, so of two consecutive copies
+only the first went. `CScript::FindAndDelete` removes consecutive occurrences, including every
+`OP_0` for an empty non-FORKID signature; so does this now. A byte-level transcription of the
+node's `FindAndDelete` agrees with it over 30,000 generated scripts, where the previous version
+disagreed on 15,380.
+
+### Changed — signature checks over large scripts are much faster
+
+On a 238 KB OP_PUSH_TX locking script one `OP_CHECKSIGVERIFY` took about 450 ms, against 0.2 ms to
+hash the bytes it signs. The scriptCode is no longer copied on the FORKID path, is serialized
+once rather than twice, `Script#toBuffer` writes one allocation, and `findAndDelete` serializes
+only chunks that can match. Measured on a 139 KB script: 207 ms → 27 ms. Every serialization and
+every digest is unchanged: 65,044 sighash digests over generated transactions and scriptCodes,
+both algorithms, all hash types, are byte-identical to 9.10.1.
+
 ## [9.10.1] - 2026-09-16
 
 **A patch: evaluating a script no longer rewrites it or the interpreter's shared boolean values.** No API change; consensus results are unchanged.

package/README.md

@@ -2,7 +2,7 @@
 
 Bitcoin SV library with an interpreter-verified script engine.
 
-[![Version](https://img.shields.io/badge/version-9.10.1-blue.svg)](https://www.npmjs.com/package/@smartledger/bsv)
+[![Version](https://img.shields.io/badge/version-9.11.1-blue.svg)](https://www.npmjs.com/package/@smartledger/bsv)
 [![License](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
 [![Stability](https://img.shields.io/badge/9.x%20stable%20until-2027--09--01-brightgreen.svg)](STABILITY.md)
 
@@ -155,44 +155,44 @@ const bsv = require('@smartledger/bsv')                 // 128 modules
 ### **Core Modules**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv.min.js** | 1056KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@9.10.1/bsv.min.js` |
-| **bsv.bundle.js** | 1056KB | Everything in one file | `unpkg.com/@smartledger/bsv@9.10.1/bsv.bundle.js` |
+| **bsv.min.js** | 1057KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@9.11.1/bsv.min.js` |
+| **bsv.bundle.js** | 1057KB | Everything in one file | `unpkg.com/@smartledger/bsv@9.11.1/bsv.bundle.js` |
 
 ### **W3C Verifiable Credentials**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **🟢 bsv-didweb.min.js** | 166KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@9.10.1/bsv-didweb.min.js` |
-| **🟢 bsv-vcjwt.min.js** | 166KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@9.10.1/bsv-vcjwt.min.js` |
-| **🟢 bsv-statuslist.min.js** | 256KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@9.10.1/bsv-statuslist.min.js` |
-| **🟢 bsv-anchor.min.js** | 164KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@9.10.1/bsv-anchor.min.js` |
+| **🟢 bsv-didweb.min.js** | 166KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@9.11.1/bsv-didweb.min.js` |
+| **🟢 bsv-vcjwt.min.js** | 166KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@9.11.1/bsv-vcjwt.min.js` |
+| **🟢 bsv-statuslist.min.js** | 256KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@9.11.1/bsv-statuslist.min.js` |
+| **🟢 bsv-anchor.min.js** | 164KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@9.11.1/bsv-anchor.min.js` |
 
 ### **Smart Contract & Development**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-smartcontract.min.js** | 141KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@9.10.1/bsv-smartcontract.min.js` |
-| **bsv-covenant.min.js** | 35KB | Covenant operations | `unpkg.com/@smartledger/bsv@9.10.1/bsv-covenant.min.js` |
-| **bsv-script-helper.min.js** | 33KB | Custom script tools | `unpkg.com/@smartledger/bsv@9.10.1/bsv-script-helper.min.js` |
-| **bsv-security.min.js** | 32KB | Security enhancements | `unpkg.com/@smartledger/bsv@9.10.1/bsv-security.min.js` |
+| **bsv-smartcontract.min.js** | 141KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@9.11.1/bsv-smartcontract.min.js` |
+| **bsv-covenant.min.js** | 35KB | Covenant operations | `unpkg.com/@smartledger/bsv@9.11.1/bsv-covenant.min.js` |
+| **bsv-script-helper.min.js** | 33KB | Custom script tools | `unpkg.com/@smartledger/bsv@9.11.1/bsv-script-helper.min.js` |
+| **bsv-security.min.js** | 32KB | Security enhancements | `unpkg.com/@smartledger/bsv@9.11.1/bsv-security.min.js` |
 
 ### **Legal & Compliance**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-ltp.min.js** | 540KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@9.10.1/bsv-ltp.min.js` |
-| **bsv-gdaf.min.js** | 1056KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@9.10.1/bsv-gdaf.min.js` |
+| **bsv-ltp.min.js** | 541KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@9.11.1/bsv-ltp.min.js` |
+| **bsv-gdaf.min.js** | 1057KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@9.11.1/bsv-gdaf.min.js` |
 
 ### **Advanced Cryptography**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-shamir.min.js** | 177KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@9.10.1/bsv-shamir.min.js` |
+| **bsv-shamir.min.js** | 177KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@9.11.1/bsv-shamir.min.js` |
 
 ### **Utilities**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-ecies.min.js** | 137KB | Encryption | `unpkg.com/@smartledger/bsv@9.10.1/bsv-ecies.min.js` |
-| **bsv-message.min.js** | 34KB | Message signing | `unpkg.com/@smartledger/bsv@9.10.1/bsv-message.min.js` |
-| **bsv-mnemonic.min.js** | 320KB | HD wallets | `unpkg.com/@smartledger/bsv@9.10.1/bsv-mnemonic.min.js` |
+| **bsv-ecies.min.js** | 137KB | Encryption | `unpkg.com/@smartledger/bsv@9.11.1/bsv-ecies.min.js` |
+| **bsv-message.min.js** | 34KB | Message signing | `unpkg.com/@smartledger/bsv@9.11.1/bsv-message.min.js` |
+| **bsv-mnemonic.min.js** | 320KB | HD wallets | `unpkg.com/@smartledger/bsv@9.11.1/bsv-mnemonic.min.js` |
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@9.10.1/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.11.1/bsv.min.js"></script>
 <script>
   const key = bsv.PrivateKey.fromRandom()
 </script>
@@ -240,4 +240,4 @@ MIT
 
 ---
 
-**SmartLedger-BSV v9.10.1**
+**SmartLedger-BSV v9.11.1**