@smartledger/bsv 9.16.0 → 9.18.0

package/docs/AUDIT_SCOPE.md

@@ -34,14 +34,14 @@ module sounds. That is a deliberate revision: an earlier version of this documen
 scoped Tier 1 as "the cryptographic core" and would have excluded four of the six real
 defects this codebase has produced. See §2.1.
 
-### Tier 1 — 12,181 lines
+### Tier 1 — 12,269 lines
 
 | Module | Lines | Why it matters |
 | --- | ---: | --- |
 | `lib/transaction/` | 2,786 | Sighash construction and signing — both BIP-143 and the Original Transaction Digest Algorithm. |
-| `lib/script/interpreter.js` | 2,943 | **Scoped to the flag and era surface, not opcode execution.** Consensus-flag selection and defaults, era derivation (Genesis/Chronicle), the limits derived from them, and the semantics of the exported `verify()`. Opcode execution is excluded — see §2.2. |
+| `lib/script/interpreter.js` | 2,962 | **Scoped to the flag and era surface, not opcode execution.** Consensus-flag selection and defaults, era derivation (Genesis/Chronicle), the limits derived from them, and the semantics of the exported `verify()`. Opcode execution is excluded — see §2.2. |
 | `lib/crypto/` | 2,519 | ECDSA, nonce derivation, signature encoding, the script-number type. **Scope this for an architectural judgement as well as for bugs** — see §2.3. |
-| `lib/notaryhash/` | 2,104 | BRC-220 signing and verification. Publicly reachable and relied on downstream. |
+| `lib/notaryhash/` | 2,173 | BRC-220 signing and verification. Publicly reachable and relied on downstream. |
 | `lib/privatekey.js`, `lib/publickey.js` | 843 | Key construction, serialisation, WIF. Recent defects here produced a *different* key without error. |
 | `lib/smart_contract/` (targeted) | 472 | `locks.js` and the covenant-facing entrypoints in `index.js`: CLTV and HTLC locking semantics, flag plumbing, and any wrapper claiming mainnet-equivalent verification. Not the whole 6,908-line module. |
 | `lib/covenant/` | 409 | The verification harness. Its flag word is what made covenants verify under 2019 rules while claiming to mirror mainnet. |
@@ -150,14 +150,14 @@ this repository.
 | `lib/address.js`, `lib/networks.js`, `lib/opcode.js`, `lib/hdprivatekey.js`, `lib/hdpublickey.js` (2,391 lines) | Cut to pay for §2.1 | Formatting, network constants and BIP-32 derivation. No defect has originated here, and `networks.js` in particular defines addressing constants — pubkey hashes, xpub prefixes, ports, DNS seeds — and contains **no consensus-flag logic at all**. |
 | The rest of the application layer — `lib/gdaf/`, `lib/ltp/`, `lib/ordinals/`, `lib/block/`, `lib/didweb/`, `lib/vcjwt/`, `lib/statuslist/`, most of `lib/smart_contract/`, plus assorted top-level files | Excluded | ~26,000 lines. Worth a separate engagement; including it here would blur the question in §1. Note the parts of it with a demonstrated defect history have been pulled *into* Tier 1 rather than left here — see §2.1. |
 
-Totals reconcile against `lib/`, which is 40,204 lines across 131 files:
+Totals reconcile against `lib/`, which is 40,324 lines across 131 files:
 
 ```
-tier 1      12,181
+tier 1      12,269
 tier 2       1,607
-excluded    26,416
+excluded    26,448
             ------
-total       40,204
+total       40,324
 ```
 
 Measured 2026-08-29 at `a954c27`. These figures drift as the library changes — an
@@ -228,7 +228,7 @@ seeking a quote for an independent security review.
 
 Scope, and we would like these priced separately:
 
-  Tier 1 — 12,181 lines. Sighash construction and signing; ECDSA, nonce
+  Tier 1 — 12,269 lines. Sighash construction and signing; ECDSA, nonce
   derivation and signature encoding; the consensus-flag and era-derivation
   surface of the script interpreter; BRC-220 signing and verification;
   key construction and serialisation; the covenant verification harness and

package/docs/MODULE_REFERENCE_COMPLETE.md

@@ -55,19 +55,19 @@ Three advanced modules totaling **~2.7MB** of functionality:
 - **Purpose**: Threshold cryptography for secure secret distribution
 - **Use Cases**: Backup keys, multi-party security, key recovery
 - **Features**: Split secrets into N shares, require M to reconstruct
-- **CDN**: `unpkg.com/@smartledger/bsv@9.16.0/bsv-shamir.min.js`
+- **CDN**: `unpkg.com/@smartledger/bsv@9.18.0/bsv-shamir.min.js`
 
 #### **🌐 Global Digital Attestation Framework - GDAF (1184KB)**  
 - **Purpose**: W3C Verifiable Credentials and decentralized identity
 - **Use Cases**: Identity verification, attestations, zero-knowledge proofs
 - **Features**: DID creation, credential issuance, selective disclosure
-- **CDN**: `unpkg.com/@smartledger/bsv@9.16.0/bsv-gdaf.min.js`
+- **CDN**: `unpkg.com/@smartledger/bsv@9.18.0/bsv-gdaf.min.js`
 
 #### **⚖️ Legal Token Protocol - LTP (1184KB)**
 - **Purpose**: Legal compliance framework for tokenized assets
 - **Use Cases**: Property rights, obligations, compliant tokenization  
 - **Features**: Legal primitives, compliance checking, attestation anchoring
-- **CDN**: `unpkg.com/@smartledger/bsv@9.16.0/bsv-ltp.min.js`
+- **CDN**: `unpkg.com/@smartledger/bsv@9.18.0/bsv-ltp.min.js`
 
 ### **2. Incorrect File Sizes in Documentation**
 
@@ -81,18 +81,18 @@ Three advanced modules totaling **~2.7MB** of functionality:
 
 | Module | Size | Use Case | CDN Link |
 |--------|------|----------|----------|
-| **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@9.16.0/bsv.min.js` |
-| **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@9.16.0/bsv.bundle.js` |
-| **bsv-smartcontract.min.js** | 937KB | Covenant development | `unpkg.com/@smartledger/bsv@9.16.0/bsv-smartcontract.min.js` |
-| **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@9.16.0/bsv-covenant.min.js` |
-| **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@9.16.0/bsv-script-helper.min.js` |
-| **bsv-security.min.js** | 26KB | Security enhancements (opt-in helpers — see README › Security) | `unpkg.com/@smartledger/bsv@9.16.0/bsv-security.min.js` |
-| **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@9.16.0/bsv-ecies.min.js` |
-| **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@9.16.0/bsv-message.min.js` |
-| **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@9.16.0/bsv-mnemonic.min.js` |
-| **🆕 bsv-shamir.min.js** | 432KB | **Secret sharing** | `unpkg.com/@smartledger/bsv@9.16.0/bsv-shamir.min.js` |
-| **🆕 bsv-gdaf.min.js** | 1184KB | **Digital attestation** | `unpkg.com/@smartledger/bsv@9.16.0/bsv-gdaf.min.js` |
-| **🆕 bsv-ltp.min.js** | 1184KB | **Legal tokens** | `unpkg.com/@smartledger/bsv@9.16.0/bsv-ltp.min.js` |
+| **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@9.18.0/bsv.min.js` |
+| **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@9.18.0/bsv.bundle.js` |
+| **bsv-smartcontract.min.js** | 937KB | Covenant development | `unpkg.com/@smartledger/bsv@9.18.0/bsv-smartcontract.min.js` |
+| **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@9.18.0/bsv-covenant.min.js` |
+| **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@9.18.0/bsv-script-helper.min.js` |
+| **bsv-security.min.js** | 26KB | Security enhancements (opt-in helpers — see README › Security) | `unpkg.com/@smartledger/bsv@9.18.0/bsv-security.min.js` |
+| **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@9.18.0/bsv-ecies.min.js` |
+| **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@9.18.0/bsv-message.min.js` |
+| **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@9.18.0/bsv-mnemonic.min.js` |
+| **🆕 bsv-shamir.min.js** | 432KB | **Secret sharing** | `unpkg.com/@smartledger/bsv@9.18.0/bsv-shamir.min.js` |
+| **🆕 bsv-gdaf.min.js** | 1184KB | **Digital attestation** | `unpkg.com/@smartledger/bsv@9.18.0/bsv-gdaf.min.js` |
+| **🆕 bsv-ltp.min.js** | 1184KB | **Legal tokens** | `unpkg.com/@smartledger/bsv@9.18.0/bsv-ltp.min.js` |
 
 ## 🎯 **Updated Usage Examples**
 
@@ -100,22 +100,22 @@ Three advanced modules totaling **~2.7MB** of functionality:
 
 #### **1. Basic Development (~963KB)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@9.16.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.16.0/bsv-script-helper.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv-script-helper.min.js"></script>
 ```
 
 #### **2. Smart Contract Development (~2.7MB — each bundle re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@9.16.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.16.0/bsv-covenant.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.16.0/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv-covenant.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv-smartcontract.min.js"></script>
 ```
 
 #### **3. 🆕 Legal & Compliance Development (~3.2MB — each bundle re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@9.16.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.16.0/bsv-ltp.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.16.0/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv-gdaf.min.js"></script>
 <script>
   // Legal Token Protocol
   const legalToken = bsv.createLegalToken({
@@ -132,9 +132,9 @@ Three advanced modules totaling **~2.7MB** of functionality:
 
 #### **4. 🆕 Security & Cryptography (~1.4MB)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@9.16.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.16.0/bsv-security.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.16.0/bsv-shamir.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv-security.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv-shamir.min.js"></script>
 <script>
   // Shamir Secret Sharing
   const shares = bsv.splitSecret('my_secret_key', 5, 3); // 5 shares, 3 needed
@@ -146,7 +146,7 @@ Three advanced modules totaling **~2.7MB** of functionality:
 
 #### **5. Everything Bundle (937KB)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@9.16.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv.bundle.js"></script>
 <script>
   // Everything available immediately
   const shares = bsv.splitSecret('secret', 5, 3);

package/docs/advanced/UTXO_MANAGER_GUIDE.md

@@ -722,7 +722,7 @@ interface UTXO {
 <html>
 <head>
     <title>UTXO Manager Demo</title>
-    <script src="https://cdn.jsdelivr.net/npm/@smartledger/bsv@9.16.0/bsv.min.js"></script>
+    <script src="https://cdn.jsdelivr.net/npm/@smartledger/bsv@9.18.0/bsv.min.js"></script>
 </head>
 <body>
     <script>

package/docs/audit-rfq/cure53.txt

@@ -15,7 +15,7 @@ seeking a quote for an independent security review of its cryptographic core.
 
 Scope, and we would like these priced separately:
 
-  Tier 1 — 12,181 lines. Sighash construction and signing; ECDSA, nonce
+  Tier 1 — 12,269 lines. Sighash construction and signing; ECDSA, nonce
   derivation and signature encoding; the consensus-flag and era surface of the
   script interpreter; BRC-220 signing; the covenant verification harness; RFC
   8785 canonicalization; and the covenant-facing entrypoints of the smart
@@ -30,7 +30,7 @@ Explicitly out of scope: elliptic-curve and hash primitives, which are supplied
 by the Noble libraries and already audited; opcode EXECUTION in the script
 interpreter, which passes 1,483 of 1,483 of the reference node's own consensus
 vectors with zero false accepts and zero false rejects; and the remaining
-26,416-line application layer (credentials, tokens, ordinals), which we would
+26,448-line application layer (credentials, tokens, ordinals), which we would
 treat as a separate engagement.
 
 Note the shape of that first exclusion, because it is what we want priced. The

package/docs/audit-rfq/ncc-group.txt

@@ -15,7 +15,7 @@ seeking a quote for an independent security review of its cryptographic core.
 
 Scope, and we would like these priced separately:
 
-  Tier 1 — 12,181 lines. Sighash construction and signing; ECDSA, nonce
+  Tier 1 — 12,269 lines. Sighash construction and signing; ECDSA, nonce
   derivation and signature encoding; the consensus-flag and era surface of the
   script interpreter; BRC-220 signing; the covenant verification harness; RFC
   8785 canonicalization; and the covenant-facing entrypoints of the smart
@@ -30,7 +30,7 @@ Explicitly out of scope: elliptic-curve and hash primitives, which are supplied
 by the Noble libraries and already audited; opcode EXECUTION in the script
 interpreter, which passes 1,483 of 1,483 of the reference node's own consensus
 vectors with zero false accepts and zero false rejects; and the remaining
-26,416-line application layer (credentials, tokens, ordinals), which we would
+26,448-line application layer (credentials, tokens, ordinals), which we would
 treat as a separate engagement.
 
 Note the shape of that first exclusion, because it is what we want priced. The

package/docs/audit-rfq/trail-of-bits.txt

@@ -15,7 +15,7 @@ seeking a quote for an independent security review of its cryptographic core.
 
 Scope, and we would like these priced separately:
 
-  Tier 1 — 12,181 lines. Sighash construction and signing; ECDSA, nonce
+  Tier 1 — 12,269 lines. Sighash construction and signing; ECDSA, nonce
   derivation and signature encoding; the consensus-flag and era surface of the
   script interpreter; BRC-220 signing; the covenant verification harness; RFC
   8785 canonicalization; and the covenant-facing entrypoints of the smart
@@ -30,7 +30,7 @@ Explicitly out of scope: elliptic-curve and hash primitives, which are supplied
 by the Noble libraries and already audited; opcode EXECUTION in the script
 interpreter, which passes 1,483 of 1,483 of the reference node's own consensus
 vectors with zero false accepts and zero false rejects; and the remaining
-26,416-line application layer (credentials, tokens, ordinals), which we would
+26,448-line application layer (credentials, tokens, ordinals), which we would
 treat as a separate engagement.
 
 Note the shape of that first exclusion, because it is what we want priced. The

package/docs/getting-started/INSTALLATION.md

@@ -48,7 +48,7 @@ const tx: Transaction = new Transaction();
 #### **Core Library Only (937KB)**
 For basic Bitcoin SV operations:
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@9.16.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv.min.js"></script>
 <script>
   const privateKey = new bsv.PrivateKey();
   const address = privateKey.toAddress();
@@ -58,7 +58,7 @@ For basic Bitcoin SV operations:
 #### **Complete Bundle (937KB)**  
 Everything in one file:
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@9.16.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv.bundle.js"></script>
 <script>
   // All features available immediately
   const shares = bsv.splitSecret('secret', 5, 3);
@@ -71,9 +71,9 @@ Everything in one file:
 
 #### **Smart Contract Development (~2.7MB total — each bundle is self-contained and re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@9.16.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.16.0/bsv-covenant.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.16.0/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv-covenant.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv-smartcontract.min.js"></script>
 <script>
   const covenant = bsv.SmartContract.createCovenantBuilder()
     .extractField('amount').push(50000).greaterThanOrEqual().build();
@@ -82,9 +82,9 @@ Everything in one file:
 
 #### **Legal & Identity Development (~3.2MB total — each bundle is self-contained and re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@9.16.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.16.0/bsv-ltp.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.16.0/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv-gdaf.min.js"></script>
 <script>
   // Legal Token Protocol
   const propertyToken = bsv.createPropertyToken({
@@ -98,9 +98,9 @@ Everything in one file:
 
 #### **Security & Cryptography (~1.4MB total — each bundle is self-contained and re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@9.16.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.16.0/bsv-security.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.16.0/bsv-shamir.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv-security.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv-shamir.min.js"></script>
 <script>
   // Threshold Cryptography
   const shares = bsv.splitSecret('my_secret_key', 5, 3);
@@ -114,18 +114,18 @@ Everything in one file:
 
 | Module | Size | Purpose | CDN Link |
 |--------|------|---------|----------|
-| **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@9.16.0/bsv.min.js` |
-| **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@9.16.0/bsv.bundle.js` |
-| **bsv-smartcontract.min.js** | 937KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@9.16.0/bsv-smartcontract.min.js` |
-| **bsv-ltp.min.js** | 1184KB | **Legal Token Protocol** | `unpkg.com/@smartledger/bsv@9.16.0/bsv-ltp.min.js` |
-| **bsv-gdaf.min.js** | 1184KB | **Digital Identity & Attestation** | `unpkg.com/@smartledger/bsv@9.16.0/bsv-gdaf.min.js` |
-| **bsv-shamir.min.js** | 432KB | **Threshold Cryptography** | `unpkg.com/@smartledger/bsv@9.16.0/bsv-shamir.min.js` |
-| **bsv-security.min.js** | 26KB | Security enhancements (opt-in helpers — see README › Security) | `unpkg.com/@smartledger/bsv@9.16.0/bsv-security.min.js` |
-| **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@9.16.0/bsv-mnemonic.min.js` |
-| **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@9.16.0/bsv-ecies.min.js` |
-| **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@9.16.0/bsv-covenant.min.js` |
-| **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@9.16.0/bsv-script-helper.min.js` |
-| **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@9.16.0/bsv-message.min.js` |
+| **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@9.18.0/bsv.min.js` |
+| **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@9.18.0/bsv.bundle.js` |
+| **bsv-smartcontract.min.js** | 937KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@9.18.0/bsv-smartcontract.min.js` |
+| **bsv-ltp.min.js** | 1184KB | **Legal Token Protocol** | `unpkg.com/@smartledger/bsv@9.18.0/bsv-ltp.min.js` |
+| **bsv-gdaf.min.js** | 1184KB | **Digital Identity & Attestation** | `unpkg.com/@smartledger/bsv@9.18.0/bsv-gdaf.min.js` |
+| **bsv-shamir.min.js** | 432KB | **Threshold Cryptography** | `unpkg.com/@smartledger/bsv@9.18.0/bsv-shamir.min.js` |
+| **bsv-security.min.js** | 26KB | Security enhancements (opt-in helpers — see README › Security) | `unpkg.com/@smartledger/bsv@9.18.0/bsv-security.min.js` |
+| **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@9.18.0/bsv-mnemonic.min.js` |
+| **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@9.18.0/bsv-ecies.min.js` |
+| **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@9.18.0/bsv-covenant.min.js` |
+| **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@9.18.0/bsv-script-helper.min.js` |
+| **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@9.18.0/bsv-message.min.js` |
 
 ## ⚙️ **Development Environment Setup**
 

package/docs/getting-started/QUICK_START.md

@@ -14,10 +14,10 @@ npm install @smartledger/bsv
 ### Browser CDN (Instant)
 ```html
 <!-- Core library (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@9.16.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv.min.js"></script>
 
 <!-- Everything included (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@9.16.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv.bundle.js"></script>
 ```
 
 ## 💰 **Your First Transaction (60 seconds)**
@@ -127,19 +127,19 @@ SmartLedger-BSV offers 12 different loading options - use only what you need:
 
 ```html
 <!-- Core BSV only (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@9.16.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv.min.js"></script>
 
 <!-- Smart contracts (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@9.16.0/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv-smartcontract.min.js"></script>
 
 <!-- Legal tokens (1.16MB) -->
-<script src="https://unpkg.com/@smartledger/bsv@9.16.0/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv-ltp.min.js"></script>
 
 <!-- Digital identity (1.16MB) -->
-<script src="https://unpkg.com/@smartledger/bsv@9.16.0/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv-gdaf.min.js"></script>
 
 <!-- Everything (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@9.16.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv.bundle.js"></script>
 ```
 
 ## ⚡ **Key Advantages**

package/docs/migration/FROM_BSV_1_5_6.md

@@ -159,17 +159,17 @@ const recovered = bsv.reconstructSecret([shares[0], shares[2], shares[4]]);
 ### **New Modular Options** 
 ```html
 <!-- Core compatibility (same size as bsv@1.5.6) -->
-<script src="https://unpkg.com/@smartledger/bsv@9.16.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv.min.js"></script>
 
 <!-- Add smart contracts when ready -->
-<script src="https://unpkg.com/@smartledger/bsv@9.16.0/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv-smartcontract.min.js"></script>
 
 <!-- Add advanced features as needed -->
-<script src="https://unpkg.com/@smartledger/bsv@9.16.0/bsv-ltp.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.16.0/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv-gdaf.min.js"></script>
 
 <!-- Everything in one file -->
-<script src="https://unpkg.com/@smartledger/bsv@9.16.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv.bundle.js"></script>
 ```
 
 ## 🔍 **Testing Your Migration**

package/lib/notaryhash/certificate.js

@@ -489,19 +489,45 @@ Certificate.normalize = function (certificate) {
  * @param {Object} certificate
  * @returns {Object} { algorithm, hashAlgorithm, payloadHash, publicKey, signature, createdAtUnix }
  */
-Certificate.toProofInput = function (certificate) {
-  $.checkArgument(certificate && typeof certificate === 'object', 'certificate is required')
-  var c = Certificate.normalize(certificate)
+/**
+ * The fields a SIGNATURE check depends on, and only those.
+ *
+ * Kept separate from `toProofInput` because the proofHash covers `createdAt` and the
+ * signature does not. Deriving both from one function meant a certificate with no
+ * `createdAt` could not be signature-checked at all: `toUnixSeconds(undefined)` threw,
+ * `NotaryHash.verifySignature` caught it, and the caller was told `false` — which from a
+ * function of that name says the signature does not match the payloadHash and public key.
+ * It reported a cryptographic verdict for a missing metadata field, and those two have
+ * very different remedies.
+ *
+ * Certificate completeness is still enforced: `validateShape` lists every missing
+ * required field by name, and `NotaryHash.verify` runs it first and returns before it
+ * reaches the signature.
+ */
+function signatureFieldsOf (c) {
   return {
     algorithm: c.algorithm,
     hashAlgorithm: c.hashAlgorithm,
     payloadHash: Certificate.decodeBytes(c.payloadHash, 'hex', 'payloadHash'),
     publicKey: Certificate.decodeBytes(c.publicKey, c.encoding, 'publicKey'),
-    signature: Certificate.decodeBytes(c.signature, c.encoding, 'signature'),
-    createdAtUnix: Encoding.toUnixSeconds(c.createdAt)
+    signature: Certificate.decodeBytes(c.signature, c.encoding, 'signature')
   }
 }
 
+Certificate.toSignatureInput = function (certificate) {
+  $.checkArgument(certificate && typeof certificate === 'object', 'certificate is required')
+  return signatureFieldsOf(Certificate.normalize(certificate))
+}
+
+Certificate.toProofInput = function (certificate) {
+  $.checkArgument(certificate && typeof certificate === 'object', 'certificate is required')
+  var c = Certificate.normalize(certificate)
+  var f = signatureFieldsOf(c)
+  // The proofHash commits to the creation time; the signature does not.
+  f.createdAtUnix = Encoding.toUnixSeconds(c.createdAt)
+  return f
+}
+
 /**
  * Recompute the proofHash a certificate's own fields imply.
  *

package/lib/notaryhash/index.js

@@ -48,6 +48,18 @@ NotaryHash.registerSuite = function (algorithm, suite) {
   return Suites.register(algorithm, suite)
 }
 
+/**
+ * Bytes from either a Buffer or hex. `Certificate.decodeBytes` takes strings only, because
+ * a certificate field is always a string; a caller holding a digest usually has a Buffer.
+ */
+function asBytes (value, name) {
+  if (Buffer.isBuffer(value)) {
+    if (value.length === 0) throw new Error(name + ' must not be empty')
+    return value
+  }
+  return Certificate.decodeBytes(value, 'hex', name)
+}
+
 /**
  * Check 1 — the signature, offline.
  *
@@ -57,13 +69,44 @@ NotaryHash.registerSuite = function (algorithm, suite) {
 NotaryHash.verifySignature = function (certificate) {
   try {
     if (!certificate || typeof certificate !== 'object') return false
-    var f = Certificate.toProofInput(certificate)
+    // toSignatureInput, not toProofInput: the proof input also decodes `createdAt`, which
+    // this check does not use. Taking the wider one meant a certificate with no createdAt
+    // threw, was caught below, and was answered `false` — reporting a signature mismatch
+    // for a missing metadata field. Completeness is Certificate.validateShape's job, and
+    // NotaryHash.verify runs it first.
+    var f = Certificate.toSignatureInput(certificate)
     return Suites.verify(f.algorithm, f.payloadHash, f.signature, f.publicKey)
   } catch (e) {
     return false
   }
 }
 
+/**
+ * Check a signature with no certificate in the picture at all.
+ *
+ * For the case that exposed the bug above: verifying a submitted signature BEFORE
+ * anchoring it, when there is no certificate yet and so no `createdAt`, no `proofHash` and
+ * no `anchor`. Passing a half-built certificate to `verifySignature` worked, but only
+ * because that function tolerates the absence — this entry point cannot be affected by
+ * certificate metadata, because it is not given any.
+ *
+ * Unlike `verifySignature` this THROWS on input it cannot decode, rather than returning
+ * false. A boolean that means both "the signature does not match" and "your hex was
+ * malformed" is the ambiguity worth removing here, and a pre-flight check is exactly where
+ * acting on the wrong one is expensive.
+ *
+ * @param {Buffer|String} payloadHash   the digest that was signed
+ * @param {Buffer|String} signature     raw signature bytes, or hex
+ * @param {Buffer|String} publicKey     public key bytes, or hex
+ * @param {String} [algorithm]          defaults to 'ECDSA-secp256k1'
+ * @returns {Boolean} whether the signature matches the digest and key
+ */
+NotaryHash.verifySignatureOnly = function (payloadHash, signature, publicKey, algorithm) {
+  var alg = algorithm || 'ECDSA-secp256k1'
+  return Suites.verify(alg, asBytes(payloadHash, 'payloadHash'),
+    asBytes(signature, 'signature'), asBytes(publicKey, 'publicKey'))
+}
+
 /**
  * Compute a txid from a raw transaction, the way the spec states it:
  * `txid = reverse(SHA256(SHA256(rawTx)))`.

package/lib/script/interpreter.js

@@ -1385,14 +1385,6 @@ Interpreter.prototype.checkSequence = function (nSequence) {
   return true
 }
 
-function padBufferToSize (buf, len) {
-  let b = buf
-  while (b.length < len) {
-    b = Buffer.concat([Buffer.from([0x00]), b])
-  }
-  return b
-}
-
 /**
  * Based on the inner loop of bitcoind's EvalScript function
  * bitcoind commit: b5d1b1092998bc95313856d535c632ea5a8f9104
@@ -2218,33 +2210,45 @@ Interpreter.prototype.step = function () {
           this.errstr = 'SCRIPT_ERR_INVALID_STACK_OPERATION'
           return false
         }
+        // The node's order, from bitcoin-sv v1.2.2 interpreter.cpp: decode n with the era's
+        // length and refuse a negative one BEFORE looking at the operand, then zero-fill when
+        // n >= 8 * size, and otherwise shift bytes in place:
+        //
+        //   CScriptNum n{top, requireMinimal, params.MaxScriptNumLength(), utxo_after_genesis};
+        //   if(n < 0) return SCRIPT_ERR_INVALID_NUMBER_RANGE;
+        //   if(n >= values.size() * bits_per_byte) fill(begin(values), end(values), 0);
+        //   else ... LShift(values, n.getint()) ...
+        //
+        // An empty operand is not a shortcut past the checks on n: `0 -1 LSHIFT` is
+        // INVALID_NUMBER_RANGE. The result always has the operand's length, and the work is
+        // proportional to that length, never to n.
         buf1 = stacktop(-2)
-        if (buf1.length === 0) {
-          this.stack.pop()
-        } else {
-          bn1 = new BN(buf1)
-          bn2 = BN.fromScriptNumBuffer(stacktop(-1), fRequireMinimal, this.maxScriptNumLength())
-          n = bn2.toNumber()
-          if (n < 0) {
-            this.errstr = 'SCRIPT_ERR_INVALID_NUMBER_RANGE'
-            return false
-          }
-          this.stack.pop()
-          this.stack.pop()
-          let shifted
-          if (opcodenum === Opcode.OP_LSHIFT) {
-            shifted = bn1.ushln(n)
-          }
-          if (opcodenum === Opcode.OP_RSHIFT) {
-            shifted = bn1.ushrn(n)
+        bn2 = BN.fromScriptNumBuffer(stacktop(-1), fRequireMinimal, this.maxScriptNumLength())
+        if (bn2.cmpn(0) < 0) {
+          this.errstr = 'SCRIPT_ERR_INVALID_NUMBER_RANGE'
+          return false
+        }
+        this.stack.pop()
+        this.stack.pop()
+        var shiftedBytes = Buffer.alloc(buf1.length)
+        if (bn2.lt(new BN(buf1.length).muln(8))) {
+          // n < 8 * size, so it fits a JS number exactly.
+          var shiftBits = bn2.toNumber()
+          var byteShift = Math.floor(shiftBits / 8)
+          var bitShift = shiftBits % 8
+          var left = opcodenum === Opcode.OP_LSHIFT
+          // Big-endian bit string: bits leaving one end are dropped, zeros enter the other.
+          for (var si = 0; si < buf1.length; si++) {
+            var src = left ? si + byteShift : si - byteShift
+            var near = src >= 0 && src < buf1.length ? buf1[src] : 0
+            var farIdx = left ? src + 1 : src - 1
+            var far = bitShift && farIdx >= 0 && farIdx < buf1.length ? buf1[farIdx] : 0
+            shiftedBytes[si] = left
+              ? ((near << bitShift) | (far >> (8 - bitShift))) & 0xff
+              : ((near >> bitShift) | (far << (8 - bitShift))) & 0xff
           }
-          // bitcoin client implementation of l/rshift is unconventional, therefore this implementation is a bit unconventional
-          // bn library has shift functions however it expands the carried bits into a new byte
-          // in contrast to the bitcoin client implementation which drops off the carried bits
-          // in other words, if operand was 1 byte then we put 1 byte back on the stack instead of expanding to more shifted bytes
-          let bufShifted = padBufferToSize(Buffer.from(shifted.toArray().slice(buf1.length * -1)), buf1.length)
-          this.stack.push(bufShifted)
         }
+        this.stack.push(shiftedBytes)
         break
 
       case Opcode.OP_EQUAL:
@@ -2857,12 +2861,27 @@ Interpreter.prototype.step = function () {
           return false
         }
 
-        var size = BN.fromScriptNumBuffer(stacktop(-1), fRequireMinimal, this.maxScriptNumLength()).toNumber()
         // A negative size is a push size failure, not an encoding one. Without
         // the lower bound it fell through to the rawnum.length > size test,
         // which any number passes when size is negative, and reported
         // IMPOSSIBLE_ENCODING instead.
-        if (size < 0 || size > this.maxScriptElementSize()) {
+        //
+        // The node caps the size at INT32_MAX in every era, before the era's own limit,
+        // and compares it as a script number, so nothing is allocated for a size it refuses:
+        //
+        //   if(n < 0 || n > std::numeric_limits<int32_t>::max()) return SCRIPT_ERR_PUSH_SIZE;
+        //   if(!utxo_after_genesis && (size > MAX_SCRIPT_ELEMENT_SIZE_BEFORE_GENESIS)) ...
+        //
+        // Compared as a BN before narrowing, in the node's order: past 2^53 toNumber()
+        // rounds, and past about 1024 bits it returns Infinity, so a bound checked on the
+        // narrowed value is a bound on an approximation.
+        var bnSize = BN.fromScriptNumBuffer(stacktop(-1), fRequireMinimal, this.maxScriptNumLength())
+        if (bnSize.cmpn(0) < 0 || bnSize.gt(new BN(0x7fffffff))) {
+          this.errstr = 'SCRIPT_ERR_PUSH_SIZE'
+          return false
+        }
+        var size = bnSize.toNumber()
+        if (size > this.maxScriptElementSize()) {
           this.errstr = 'SCRIPT_ERR_PUSH_SIZE'
           return false
         }