@smartledger/bsv 9.18.0 → 9.20.0

package/docs/AUDIT_SCOPE.md

@@ -34,14 +34,14 @@ module sounds. That is a deliberate revision: an earlier version of this documen
 scoped Tier 1 as "the cryptographic core" and would have excluded four of the six real
 defects this codebase has produced. See §2.1.
 
-### Tier 1 — 12,269 lines
+### Tier 1 — 12,437 lines
 
 | Module | Lines | Why it matters |
 | --- | ---: | --- |
 | `lib/transaction/` | 2,786 | Sighash construction and signing — both BIP-143 and the Original Transaction Digest Algorithm. |
 | `lib/script/interpreter.js` | 2,962 | **Scoped to the flag and era surface, not opcode execution.** Consensus-flag selection and defaults, era derivation (Genesis/Chronicle), the limits derived from them, and the semantics of the exported `verify()`. Opcode execution is excluded — see §2.2. |
 | `lib/crypto/` | 2,519 | ECDSA, nonce derivation, signature encoding, the script-number type. **Scope this for an architectural judgement as well as for bugs** — see §2.3. |
-| `lib/notaryhash/` | 2,173 | BRC-220 signing and verification. Publicly reachable and relied on downstream. |
+| `lib/notaryhash/` | 2,341 | BRC-220 signing and verification. Publicly reachable and relied on downstream. |
 | `lib/privatekey.js`, `lib/publickey.js` | 843 | Key construction, serialisation, WIF. Recent defects here produced a *different* key without error. |
 | `lib/smart_contract/` (targeted) | 472 | `locks.js` and the covenant-facing entrypoints in `index.js`: CLTV and HTLC locking semantics, flag plumbing, and any wrapper claiming mainnet-equivalent verification. Not the whole 6,908-line module. |
 | `lib/covenant/` | 409 | The verification harness. Its flag word is what made covenants verify under 2019 rules while claiming to mirror mainnet. |
@@ -150,14 +150,14 @@ this repository.
 | `lib/address.js`, `lib/networks.js`, `lib/opcode.js`, `lib/hdprivatekey.js`, `lib/hdpublickey.js` (2,391 lines) | Cut to pay for §2.1 | Formatting, network constants and BIP-32 derivation. No defect has originated here, and `networks.js` in particular defines addressing constants — pubkey hashes, xpub prefixes, ports, DNS seeds — and contains **no consensus-flag logic at all**. |
 | The rest of the application layer — `lib/gdaf/`, `lib/ltp/`, `lib/ordinals/`, `lib/block/`, `lib/didweb/`, `lib/vcjwt/`, `lib/statuslist/`, most of `lib/smart_contract/`, plus assorted top-level files | Excluded | ~26,000 lines. Worth a separate engagement; including it here would blur the question in §1. Note the parts of it with a demonstrated defect history have been pulled *into* Tier 1 rather than left here — see §2.1. |
 
-Totals reconcile against `lib/`, which is 40,324 lines across 131 files:
+Totals reconcile against `lib/`, which is 40,562 lines across 131 files:
 
 ```
-tier 1      12,269
+tier 1      12,437
 tier 2       1,607
-excluded    26,448
+excluded    26,518
             ------
-total       40,324
+total       40,562
 ```
 
 Measured 2026-08-29 at `a954c27`. These figures drift as the library changes — an
@@ -228,7 +228,7 @@ seeking a quote for an independent security review.
 
 Scope, and we would like these priced separately:
 
-  Tier 1 — 12,269 lines. Sighash construction and signing; ECDSA, nonce
+  Tier 1 — 12,437 lines. Sighash construction and signing; ECDSA, nonce
   derivation and signature encoding; the consensus-flag and era-derivation
   surface of the script interpreter; BRC-220 signing and verification;
   key construction and serialisation; the covenant verification harness and

package/docs/MODULE_REFERENCE_COMPLETE.md

@@ -55,19 +55,19 @@ Three advanced modules totaling **~2.7MB** of functionality:
 - **Purpose**: Threshold cryptography for secure secret distribution
 - **Use Cases**: Backup keys, multi-party security, key recovery
 - **Features**: Split secrets into N shares, require M to reconstruct
-- **CDN**: `unpkg.com/@smartledger/bsv@9.18.0/bsv-shamir.min.js`
+- **CDN**: `unpkg.com/@smartledger/bsv@9.20.0/bsv-shamir.min.js`
 
 #### **🌐 Global Digital Attestation Framework - GDAF (1184KB)**  
 - **Purpose**: W3C Verifiable Credentials and decentralized identity
 - **Use Cases**: Identity verification, attestations, zero-knowledge proofs
 - **Features**: DID creation, credential issuance, selective disclosure
-- **CDN**: `unpkg.com/@smartledger/bsv@9.18.0/bsv-gdaf.min.js`
+- **CDN**: `unpkg.com/@smartledger/bsv@9.20.0/bsv-gdaf.min.js`
 
 #### **⚖️ Legal Token Protocol - LTP (1184KB)**
 - **Purpose**: Legal compliance framework for tokenized assets
 - **Use Cases**: Property rights, obligations, compliant tokenization  
 - **Features**: Legal primitives, compliance checking, attestation anchoring
-- **CDN**: `unpkg.com/@smartledger/bsv@9.18.0/bsv-ltp.min.js`
+- **CDN**: `unpkg.com/@smartledger/bsv@9.20.0/bsv-ltp.min.js`
 
 ### **2. Incorrect File Sizes in Documentation**
 
@@ -81,18 +81,18 @@ Three advanced modules totaling **~2.7MB** of functionality:
 
 | Module | Size | Use Case | CDN Link |
 |--------|------|----------|----------|
-| **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@9.18.0/bsv.min.js` |
-| **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@9.18.0/bsv.bundle.js` |
-| **bsv-smartcontract.min.js** | 937KB | Covenant development | `unpkg.com/@smartledger/bsv@9.18.0/bsv-smartcontract.min.js` |
-| **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@9.18.0/bsv-covenant.min.js` |
-| **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@9.18.0/bsv-script-helper.min.js` |
-| **bsv-security.min.js** | 26KB | Security enhancements (opt-in helpers — see README › Security) | `unpkg.com/@smartledger/bsv@9.18.0/bsv-security.min.js` |
-| **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@9.18.0/bsv-ecies.min.js` |
-| **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@9.18.0/bsv-message.min.js` |
-| **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@9.18.0/bsv-mnemonic.min.js` |
-| **🆕 bsv-shamir.min.js** | 432KB | **Secret sharing** | `unpkg.com/@smartledger/bsv@9.18.0/bsv-shamir.min.js` |
-| **🆕 bsv-gdaf.min.js** | 1184KB | **Digital attestation** | `unpkg.com/@smartledger/bsv@9.18.0/bsv-gdaf.min.js` |
-| **🆕 bsv-ltp.min.js** | 1184KB | **Legal tokens** | `unpkg.com/@smartledger/bsv@9.18.0/bsv-ltp.min.js` |
+| **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@9.20.0/bsv.min.js` |
+| **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@9.20.0/bsv.bundle.js` |
+| **bsv-smartcontract.min.js** | 937KB | Covenant development | `unpkg.com/@smartledger/bsv@9.20.0/bsv-smartcontract.min.js` |
+| **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@9.20.0/bsv-covenant.min.js` |
+| **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@9.20.0/bsv-script-helper.min.js` |
+| **bsv-security.min.js** | 26KB | Security enhancements (opt-in helpers — see README › Security) | `unpkg.com/@smartledger/bsv@9.20.0/bsv-security.min.js` |
+| **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@9.20.0/bsv-ecies.min.js` |
+| **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@9.20.0/bsv-message.min.js` |
+| **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@9.20.0/bsv-mnemonic.min.js` |
+| **🆕 bsv-shamir.min.js** | 432KB | **Secret sharing** | `unpkg.com/@smartledger/bsv@9.20.0/bsv-shamir.min.js` |
+| **🆕 bsv-gdaf.min.js** | 1184KB | **Digital attestation** | `unpkg.com/@smartledger/bsv@9.20.0/bsv-gdaf.min.js` |
+| **🆕 bsv-ltp.min.js** | 1184KB | **Legal tokens** | `unpkg.com/@smartledger/bsv@9.20.0/bsv-ltp.min.js` |
 
 ## 🎯 **Updated Usage Examples**
 
@@ -100,22 +100,22 @@ Three advanced modules totaling **~2.7MB** of functionality:
 
 #### **1. Basic Development (~963KB)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv-script-helper.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.20.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.20.0/bsv-script-helper.min.js"></script>
 ```
 
 #### **2. Smart Contract Development (~2.7MB — each bundle re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv-covenant.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.20.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.20.0/bsv-covenant.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.20.0/bsv-smartcontract.min.js"></script>
 ```
 
 #### **3. 🆕 Legal & Compliance Development (~3.2MB — each bundle re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv-ltp.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.20.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.20.0/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.20.0/bsv-gdaf.min.js"></script>
 <script>
   // Legal Token Protocol
   const legalToken = bsv.createLegalToken({
@@ -132,9 +132,9 @@ Three advanced modules totaling **~2.7MB** of functionality:
 
 #### **4. 🆕 Security & Cryptography (~1.4MB)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv-security.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv-shamir.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.20.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.20.0/bsv-security.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.20.0/bsv-shamir.min.js"></script>
 <script>
   // Shamir Secret Sharing
   const shares = bsv.splitSecret('my_secret_key', 5, 3); // 5 shares, 3 needed
@@ -146,7 +146,7 @@ Three advanced modules totaling **~2.7MB** of functionality:
 
 #### **5. Everything Bundle (937KB)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.20.0/bsv.bundle.js"></script>
 <script>
   // Everything available immediately
   const shares = bsv.splitSecret('secret', 5, 3);

package/docs/advanced/UTXO_MANAGER_GUIDE.md

@@ -722,7 +722,7 @@ interface UTXO {
 <html>
 <head>
     <title>UTXO Manager Demo</title>
-    <script src="https://cdn.jsdelivr.net/npm/@smartledger/bsv@9.18.0/bsv.min.js"></script>
+    <script src="https://cdn.jsdelivr.net/npm/@smartledger/bsv@9.20.0/bsv.min.js"></script>
 </head>
 <body>
     <script>

package/docs/audit-rfq/cure53.txt

@@ -15,7 +15,7 @@ seeking a quote for an independent security review of its cryptographic core.
 
 Scope, and we would like these priced separately:
 
-  Tier 1 — 12,269 lines. Sighash construction and signing; ECDSA, nonce
+  Tier 1 — 12,437 lines. Sighash construction and signing; ECDSA, nonce
   derivation and signature encoding; the consensus-flag and era surface of the
   script interpreter; BRC-220 signing; the covenant verification harness; RFC
   8785 canonicalization; and the covenant-facing entrypoints of the smart
@@ -30,7 +30,7 @@ Explicitly out of scope: elliptic-curve and hash primitives, which are supplied
 by the Noble libraries and already audited; opcode EXECUTION in the script
 interpreter, which passes 1,483 of 1,483 of the reference node's own consensus
 vectors with zero false accepts and zero false rejects; and the remaining
-26,448-line application layer (credentials, tokens, ordinals), which we would
+26,518-line application layer (credentials, tokens, ordinals), which we would
 treat as a separate engagement.
 
 Note the shape of that first exclusion, because it is what we want priced. The

package/docs/audit-rfq/ncc-group.txt

@@ -15,7 +15,7 @@ seeking a quote for an independent security review of its cryptographic core.
 
 Scope, and we would like these priced separately:
 
-  Tier 1 — 12,269 lines. Sighash construction and signing; ECDSA, nonce
+  Tier 1 — 12,437 lines. Sighash construction and signing; ECDSA, nonce
   derivation and signature encoding; the consensus-flag and era surface of the
   script interpreter; BRC-220 signing; the covenant verification harness; RFC
   8785 canonicalization; and the covenant-facing entrypoints of the smart
@@ -30,7 +30,7 @@ Explicitly out of scope: elliptic-curve and hash primitives, which are supplied
 by the Noble libraries and already audited; opcode EXECUTION in the script
 interpreter, which passes 1,483 of 1,483 of the reference node's own consensus
 vectors with zero false accepts and zero false rejects; and the remaining
-26,448-line application layer (credentials, tokens, ordinals), which we would
+26,518-line application layer (credentials, tokens, ordinals), which we would
 treat as a separate engagement.
 
 Note the shape of that first exclusion, because it is what we want priced. The

package/docs/audit-rfq/trail-of-bits.txt

@@ -15,7 +15,7 @@ seeking a quote for an independent security review of its cryptographic core.
 
 Scope, and we would like these priced separately:
 
-  Tier 1 — 12,269 lines. Sighash construction and signing; ECDSA, nonce
+  Tier 1 — 12,437 lines. Sighash construction and signing; ECDSA, nonce
   derivation and signature encoding; the consensus-flag and era surface of the
   script interpreter; BRC-220 signing; the covenant verification harness; RFC
   8785 canonicalization; and the covenant-facing entrypoints of the smart
@@ -30,7 +30,7 @@ Explicitly out of scope: elliptic-curve and hash primitives, which are supplied
 by the Noble libraries and already audited; opcode EXECUTION in the script
 interpreter, which passes 1,483 of 1,483 of the reference node's own consensus
 vectors with zero false accepts and zero false rejects; and the remaining
-26,448-line application layer (credentials, tokens, ordinals), which we would
+26,518-line application layer (credentials, tokens, ordinals), which we would
 treat as a separate engagement.
 
 Note the shape of that first exclusion, because it is what we want priced. The

package/docs/getting-started/INSTALLATION.md

@@ -48,7 +48,7 @@ const tx: Transaction = new Transaction();
 #### **Core Library Only (937KB)**
 For basic Bitcoin SV operations:
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.20.0/bsv.min.js"></script>
 <script>
   const privateKey = new bsv.PrivateKey();
   const address = privateKey.toAddress();
@@ -58,7 +58,7 @@ For basic Bitcoin SV operations:
 #### **Complete Bundle (937KB)**  
 Everything in one file:
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.20.0/bsv.bundle.js"></script>
 <script>
   // All features available immediately
   const shares = bsv.splitSecret('secret', 5, 3);
@@ -71,9 +71,9 @@ Everything in one file:
 
 #### **Smart Contract Development (~2.7MB total — each bundle is self-contained and re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv-covenant.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.20.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.20.0/bsv-covenant.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.20.0/bsv-smartcontract.min.js"></script>
 <script>
   const covenant = bsv.SmartContract.createCovenantBuilder()
     .extractField('amount').push(50000).greaterThanOrEqual().build();
@@ -82,9 +82,9 @@ Everything in one file:
 
 #### **Legal & Identity Development (~3.2MB total — each bundle is self-contained and re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv-ltp.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.20.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.20.0/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.20.0/bsv-gdaf.min.js"></script>
 <script>
   // Legal Token Protocol
   const propertyToken = bsv.createPropertyToken({
@@ -98,9 +98,9 @@ Everything in one file:
 
 #### **Security & Cryptography (~1.4MB total — each bundle is self-contained and re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv-security.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv-shamir.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.20.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.20.0/bsv-security.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.20.0/bsv-shamir.min.js"></script>
 <script>
   // Threshold Cryptography
   const shares = bsv.splitSecret('my_secret_key', 5, 3);
@@ -114,18 +114,18 @@ Everything in one file:
 
 | Module | Size | Purpose | CDN Link |
 |--------|------|---------|----------|
-| **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@9.18.0/bsv.min.js` |
-| **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@9.18.0/bsv.bundle.js` |
-| **bsv-smartcontract.min.js** | 937KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@9.18.0/bsv-smartcontract.min.js` |
-| **bsv-ltp.min.js** | 1184KB | **Legal Token Protocol** | `unpkg.com/@smartledger/bsv@9.18.0/bsv-ltp.min.js` |
-| **bsv-gdaf.min.js** | 1184KB | **Digital Identity & Attestation** | `unpkg.com/@smartledger/bsv@9.18.0/bsv-gdaf.min.js` |
-| **bsv-shamir.min.js** | 432KB | **Threshold Cryptography** | `unpkg.com/@smartledger/bsv@9.18.0/bsv-shamir.min.js` |
-| **bsv-security.min.js** | 26KB | Security enhancements (opt-in helpers — see README › Security) | `unpkg.com/@smartledger/bsv@9.18.0/bsv-security.min.js` |
-| **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@9.18.0/bsv-mnemonic.min.js` |
-| **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@9.18.0/bsv-ecies.min.js` |
-| **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@9.18.0/bsv-covenant.min.js` |
-| **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@9.18.0/bsv-script-helper.min.js` |
-| **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@9.18.0/bsv-message.min.js` |
+| **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@9.20.0/bsv.min.js` |
+| **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@9.20.0/bsv.bundle.js` |
+| **bsv-smartcontract.min.js** | 937KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@9.20.0/bsv-smartcontract.min.js` |
+| **bsv-ltp.min.js** | 1184KB | **Legal Token Protocol** | `unpkg.com/@smartledger/bsv@9.20.0/bsv-ltp.min.js` |
+| **bsv-gdaf.min.js** | 1184KB | **Digital Identity & Attestation** | `unpkg.com/@smartledger/bsv@9.20.0/bsv-gdaf.min.js` |
+| **bsv-shamir.min.js** | 432KB | **Threshold Cryptography** | `unpkg.com/@smartledger/bsv@9.20.0/bsv-shamir.min.js` |
+| **bsv-security.min.js** | 26KB | Security enhancements (opt-in helpers — see README › Security) | `unpkg.com/@smartledger/bsv@9.20.0/bsv-security.min.js` |
+| **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@9.20.0/bsv-mnemonic.min.js` |
+| **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@9.20.0/bsv-ecies.min.js` |
+| **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@9.20.0/bsv-covenant.min.js` |
+| **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@9.20.0/bsv-script-helper.min.js` |
+| **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@9.20.0/bsv-message.min.js` |
 
 ## ⚙️ **Development Environment Setup**
 

package/docs/getting-started/QUICK_START.md

@@ -14,10 +14,10 @@ npm install @smartledger/bsv
 ### Browser CDN (Instant)
 ```html
 <!-- Core library (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.20.0/bsv.min.js"></script>
 
 <!-- Everything included (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.20.0/bsv.bundle.js"></script>
 ```
 
 ## 💰 **Your First Transaction (60 seconds)**
@@ -127,19 +127,19 @@ SmartLedger-BSV offers 12 different loading options - use only what you need:
 
 ```html
 <!-- Core BSV only (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.20.0/bsv.min.js"></script>
 
 <!-- Smart contracts (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.20.0/bsv-smartcontract.min.js"></script>
 
 <!-- Legal tokens (1.16MB) -->
-<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.20.0/bsv-ltp.min.js"></script>
 
 <!-- Digital identity (1.16MB) -->
-<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.20.0/bsv-gdaf.min.js"></script>
 
 <!-- Everything (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.20.0/bsv.bundle.js"></script>
 ```
 
 ## ⚡ **Key Advantages**

package/docs/migration/FROM_BSV_1_5_6.md

@@ -159,17 +159,17 @@ const recovered = bsv.reconstructSecret([shares[0], shares[2], shares[4]]);
 ### **New Modular Options** 
 ```html
 <!-- Core compatibility (same size as bsv@1.5.6) -->
-<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.20.0/bsv.min.js"></script>
 
 <!-- Add smart contracts when ready -->
-<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.20.0/bsv-smartcontract.min.js"></script>
 
 <!-- Add advanced features as needed -->
-<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv-ltp.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.20.0/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.20.0/bsv-gdaf.min.js"></script>
 
 <!-- Everything in one file -->
-<script src="https://unpkg.com/@smartledger/bsv@9.18.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.20.0/bsv.bundle.js"></script>
 ```
 
 ## 🔍 **Testing Your Migration**

package/lib/gdaf/zk-prover.js

@@ -572,29 +572,99 @@ ZKProver.generateMembershipProof = function(set, value, salt) {
     proofPurpose: 'membershipVerification',
     setCommitments: commitments,
     valueCommitment: valueCommitment,
-    isMember: true
+    isMember: true,
+    // The salt is returned so the holder can build the opening the verifier now requires.
+    // It is NOT secret from the verifier: one salt covers every member, so a verifier given
+    // the salt and the set can recompute every commitment — which is exactly what
+    // verification does. See the note on verifyMembershipProof.
+    salt: salt
   }
 }
 
 /**
- * Verify membership proof
- * @param {Object} proof - Membership proof
- * @returns {Boolean} True if proof is valid
+ * Verify membership proof.
+ *
+ * The same defect as verifyAgeProof and verifyRangeProof had, and the same fix. This used
+ * to take the proof alone and return
+ *
+ *     proof.setCommitments.includes(proof.valueCommitment) && proof.isMember
+ *
+ * where EVERY value in that expression came from the prover. Nothing bound the commitments
+ * to a set the verifier knew, nothing opened the value commitment, and `isMember` was the
+ * prover's own claim. So this returned true:
+ *
+ *     verifyMembershipProof({ type: 'MembershipProof',
+ *                             setCommitments: ['x'], valueCommitment: 'x', isMember: true })
+ *
+ * A forged proof needed no key, no salt and no set. Reported against 9.19.0 by a consumer
+ * who had reviewed the GDAF proofs in July and re-tested them.
+ *
+ * The verifier must now supply the set it believes in, and the holder must supply an
+ * opening. Both commitments are recomputed and membership is decided against the VERIFIER's
+ * set, not the prover's array.
+ *
+ * This is not zero-knowledge and cannot be, consistent with the header note on this module.
+ * One salt covers every member, so a verifier holding the set and the salt can recompute
+ * every commitment — the set is not hidden from the verifier, and a low-entropy set is not
+ * hidden from anyone who sees the proof. The honest claim is "this value is in a set the
+ * verifier already holds", which is a membership CHECK, not a privacy-preserving proof. A
+ * caller who needs the value or the set hidden needs a different primitive; a reference
+ * construction is per-attribute fresh salts under an issuer-signed RFC 6962 root.
+ *
+ * @param {Object} proof - Membership proof from generateMembershipProof
+ * @param {Object} opening - { value, salt } as returned alongside the proof
+ * @param {Array} set - the set the VERIFIER believes in, supplied by the verifier
+ * @returns {Boolean} True if the opening commits to a member of the verifier's set
  */
-ZKProver.verifyMembershipProof = function(proof) {
+ZKProver.verifyMembershipProof = function(proof, opening, set) {
   try {
     $.checkArgument(proof && typeof proof === 'object', 'Invalid proof')
-    
+
     if (proof.type !== 'MembershipProof') {
       return false
     }
-    
+
     if (!Array.isArray(proof.setCommitments)) {
       return false
     }
-    
-    // Verify that the value commitment appears in the set commitments
-    return proof.setCommitments.includes(proof.valueCommitment) && proof.isMember
+
+    // Without a verifier-supplied set and an opening there is nothing to check the prover's
+    // array against, so there is no honest answer but false.
+    if (!Array.isArray(set) || set.length === 0) {
+      return false
+    }
+    if (!opening || typeof opening !== 'object' || typeof opening.salt !== 'string') {
+      return false
+    }
+    if (!('value' in opening)) {
+      return false
+    }
+
+    var commit = function (member) {
+      return Hash.sha256(
+        Buffer.from(JSON.stringify(member) + ':' + opening.salt, 'utf8')
+      ).toString('hex')
+    }
+
+    // The prover's array must be exactly the commitments the verifier's set implies, in
+    // order. Comparing as a set would let a prover append a commitment of its own.
+    var expected = set.map(commit)
+    if (expected.length !== proof.setCommitments.length) {
+      return false
+    }
+    for (var i = 0; i < expected.length; i++) {
+      if (expected[i] !== proof.setCommitments[i]) {
+        return false
+      }
+    }
+
+    // The opening must commit to the value the proof names.
+    if (commit(opening.value) !== proof.valueCommitment) {
+      return false
+    }
+
+    // Decided against the verifier's set, and `proof.isMember` is not consulted.
+    return expected.indexOf(proof.valueCommitment) !== -1
     
   } catch (error) {
     return false

package/lib/notaryhash/certificate.js

@@ -192,12 +192,44 @@ function sidedPath (path, leafIndex, leafCount) {
     return n && typeof n === 'object' && !Buffer.isBuffer(n) && 'side' in n
   })
   if (sided || path.length === 0) {
-    return path.map(function (n, i) {
+    var carried = path.map(function (n, i) {
       if (n.side !== 'left' && n.side !== 'right') {
         throw new Error('merkle.path[' + i + '].side must be "left" or "right"')
       }
       return { hash: hashHex(n.hash, 'merkle.path[' + i + '].hash'), side: n.side }
     })
+
+    // `leafIndex` must agree with the sides the path carries.
+    //
+    // A sided path is folded by its own sides, so until this check `leafIndex` was read and
+    // never used: it could be changed to any other value in range and the proof still
+    // verified. That makes it an UNVALIDATED assertion sitting beside validated ones, and a
+    // reader shown "leaf 3 of 25" has no way to tell which of those fields is load-bearing.
+    // `leafCount` is pinned by the on-chain `u32be` that `recordMatchesCertificate` compares;
+    // `leafIndex` is on chain nowhere, so this is the only place it can be checked.
+    //
+    // The position is already determined: RFC 6962 derives the side sequence from the index
+    // and the tree size, so recomputing it and comparing costs one pass and no hashing.
+    // Reported by the ordinals mint that anchors BRC-220 proofs, whose tamper test caught it
+    // when it moved from the legacy format — where the sides ARE derived from leafIndex, so
+    // flipping it correctly failed.
+    if (Number.isInteger(leafIndex) && Number.isInteger(leafCount) &&
+        leafCount > 0 && leafIndex >= 0 && leafIndex < leafCount) {
+      var implied = Merkle.pathSides(leafIndex, leafCount)
+      if (implied.length !== carried.length) {
+        throw new Error('merkle.leafIndex ' + leafIndex + ' in a tree of ' + leafCount +
+          ' leaves needs ' + implied.length + ' path nodes; the path has ' + carried.length)
+      }
+      for (var si = 0; si < implied.length; si++) {
+        if (implied[si] !== carried[si].side) {
+          throw new Error('merkle.leafIndex ' + leafIndex + ' disagrees with the path: node ' +
+            si + ' is marked "' + carried[si].side + '" but leaf ' + leafIndex + ' of ' +
+            leafCount + ' requires "' + implied[si] + '"')
+        }
+      }
+    }
+
+    return carried
   }
   var sides = Merkle.pathSides(leafIndex, leafCount)
   if (sides.length !== path.length) {
@@ -605,6 +637,37 @@ Certificate.validateShape = function (certificate) {
     if (c[field] === undefined) problems.push('missing required field: ' + field)
   })
 
+  // `createdAt` must be the canonical rendering of its second.
+  //
+  // The proofHash commits to `createdAtUnix`, which is the time truncated to a second, so
+  // `...04.000Z`, `...04.527Z` and `...04Z` all produce the SAME commitment. The sub-second
+  // component is therefore not covered by the proof: it is an editable field that reads as
+  // part of a verified record. Three different strings claiming three different instants
+  // verified identically.
+  //
+  // Requiring the canonical form removes the ambiguity rather than papering over it, and it
+  // costs real issuers nothing — the two live certificates checked against this rule, a
+  // mainnet batch anchor and a production drop record, both already emit `.000Z`.
+  //
+  // Applied to the REFERENCE format only. Certificates written by 8.3.0-9.8.0 carry a
+  // millisecond component — `test/data/notaryhash-9.8.0-certs.json` pins one that this
+  // library deliberately still reads — and those exist in the wild. Legacy certificates are
+  // read, never written, so rejecting them now would break holders of records that were
+  // valid when issued; the rule binds the format we actually emit.
+  if (typeof c.createdAt === 'string' && !Certificate.isLegacy(certificate)) {
+    var canonical = null
+    var parsed = new Date(c.createdAt)
+    if (!isNaN(parsed.getTime())) {
+      canonical = new Date(Math.floor(parsed.getTime() / 1000) * 1000).toISOString()
+    }
+    if (canonical === null) {
+      problems.push('createdAt is not a date: ' + c.createdAt)
+    } else if (c.createdAt !== canonical) {
+      problems.push('createdAt must be the canonical rendering of its second: expected ' +
+        canonical + ', got ' + c.createdAt)
+    }
+  }
+
   if (c.protocol !== undefined && c.protocol !== Certificate.PROTOCOL) {
     problems.push('protocol must be "' + Certificate.PROTOCOL + '"')
   }