@smartledger/bsv 9.21.0 → 9.22.1

package/docs/AUDIT_SCOPE.md

@@ -34,11 +34,11 @@ module sounds. That is a deliberate revision: an earlier version of this documen
 scoped Tier 1 as "the cryptographic core" and would have excluded four of the six real
 defects this codebase has produced. See §2.1.
 
-### Tier 1 — 12,469 lines
+### Tier 1 — 12,539 lines
 
 | Module | Lines | Why it matters |
 | --- | ---: | --- |
-| `lib/transaction/` | 2,786 | Sighash construction and signing — both BIP-143 and the Original Transaction Digest Algorithm. |
+| `lib/transaction/` | 2,856 | Sighash construction and signing — both BIP-143 and the Original Transaction Digest Algorithm. |
 | `lib/script/interpreter.js` | 2,962 | **Scoped to the flag and era surface, not opcode execution.** Consensus-flag selection and defaults, era derivation (Genesis/Chronicle), the limits derived from them, and the semantics of the exported `verify()`. Opcode execution is excluded — see §2.2. |
 | `lib/crypto/` | 2,519 | ECDSA, nonce derivation, signature encoding, the script-number type. **Scope this for an architectural judgement as well as for bugs** — see §2.3. |
 | `lib/notaryhash/` | 2,373 | BRC-220 signing and verification. Publicly reachable and relied on downstream. |
@@ -150,14 +150,14 @@ this repository.
 | `lib/address.js`, `lib/networks.js`, `lib/opcode.js`, `lib/hdprivatekey.js`, `lib/hdpublickey.js` (2,391 lines) | Cut to pay for §2.1 | Formatting, network constants and BIP-32 derivation. No defect has originated here, and `networks.js` in particular defines addressing constants — pubkey hashes, xpub prefixes, ports, DNS seeds — and contains **no consensus-flag logic at all**. |
 | The rest of the application layer — `lib/gdaf/`, `lib/ltp/`, `lib/ordinals/`, `lib/block/`, `lib/didweb/`, `lib/vcjwt/`, `lib/statuslist/`, most of `lib/smart_contract/`, plus assorted top-level files | Excluded | ~26,000 lines. Worth a separate engagement; including it here would blur the question in §1. Note the parts of it with a demonstrated defect history have been pulled *into* Tier 1 rather than left here — see §2.1. |
 
-Totals reconcile against `lib/`, which is 40,594 lines across 131 files:
+Totals reconcile against `lib/`, which is 40,721 lines across 131 files:
 
 ```
-tier 1      12,469
+tier 1      12,539
 tier 2       1,607
-excluded    26,518
+excluded    26,575
             ------
-total       40,594
+total       40,721
 ```
 
 Measured 2026-08-29 at `a954c27`. These figures drift as the library changes — an
@@ -228,7 +228,7 @@ seeking a quote for an independent security review.
 
 Scope, and we would like these priced separately:
 
-  Tier 1 — 12,469 lines. Sighash construction and signing; ECDSA, nonce
+  Tier 1 — 12,539 lines. Sighash construction and signing; ECDSA, nonce
   derivation and signature encoding; the consensus-flag and era-derivation
   surface of the script interpreter; BRC-220 signing and verification;
   key construction and serialisation; the covenant verification harness and

package/docs/MODULE_REFERENCE_COMPLETE.md

@@ -55,19 +55,19 @@ Three advanced modules totaling **~2.7MB** of functionality:
 - **Purpose**: Threshold cryptography for secure secret distribution
 - **Use Cases**: Backup keys, multi-party security, key recovery
 - **Features**: Split secrets into N shares, require M to reconstruct
-- **CDN**: `unpkg.com/@smartledger/bsv@9.21.0/bsv-shamir.min.js`
+- **CDN**: `unpkg.com/@smartledger/bsv@9.22.1/bsv-shamir.min.js`
 
 #### **🌐 Global Digital Attestation Framework - GDAF (1184KB)**  
 - **Purpose**: W3C Verifiable Credentials and decentralized identity
 - **Use Cases**: Identity verification, attestations, zero-knowledge proofs
 - **Features**: DID creation, credential issuance, selective disclosure
-- **CDN**: `unpkg.com/@smartledger/bsv@9.21.0/bsv-gdaf.min.js`
+- **CDN**: `unpkg.com/@smartledger/bsv@9.22.1/bsv-gdaf.min.js`
 
 #### **⚖️ Legal Token Protocol - LTP (1184KB)**
 - **Purpose**: Legal compliance framework for tokenized assets
 - **Use Cases**: Property rights, obligations, compliant tokenization  
 - **Features**: Legal primitives, compliance checking, attestation anchoring
-- **CDN**: `unpkg.com/@smartledger/bsv@9.21.0/bsv-ltp.min.js`
+- **CDN**: `unpkg.com/@smartledger/bsv@9.22.1/bsv-ltp.min.js`
 
 ### **2. Incorrect File Sizes in Documentation**
 
@@ -81,18 +81,18 @@ Three advanced modules totaling **~2.7MB** of functionality:
 
 | Module | Size | Use Case | CDN Link |
 |--------|------|----------|----------|
-| **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@9.21.0/bsv.min.js` |
-| **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@9.21.0/bsv.bundle.js` |
-| **bsv-smartcontract.min.js** | 937KB | Covenant development | `unpkg.com/@smartledger/bsv@9.21.0/bsv-smartcontract.min.js` |
-| **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@9.21.0/bsv-covenant.min.js` |
-| **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@9.21.0/bsv-script-helper.min.js` |
-| **bsv-security.min.js** | 26KB | Security enhancements (opt-in helpers — see README › Security) | `unpkg.com/@smartledger/bsv@9.21.0/bsv-security.min.js` |
-| **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@9.21.0/bsv-ecies.min.js` |
-| **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@9.21.0/bsv-message.min.js` |
-| **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@9.21.0/bsv-mnemonic.min.js` |
-| **🆕 bsv-shamir.min.js** | 432KB | **Secret sharing** | `unpkg.com/@smartledger/bsv@9.21.0/bsv-shamir.min.js` |
-| **🆕 bsv-gdaf.min.js** | 1184KB | **Digital attestation** | `unpkg.com/@smartledger/bsv@9.21.0/bsv-gdaf.min.js` |
-| **🆕 bsv-ltp.min.js** | 1184KB | **Legal tokens** | `unpkg.com/@smartledger/bsv@9.21.0/bsv-ltp.min.js` |
+| **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@9.22.1/bsv.min.js` |
+| **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@9.22.1/bsv.bundle.js` |
+| **bsv-smartcontract.min.js** | 937KB | Covenant development | `unpkg.com/@smartledger/bsv@9.22.1/bsv-smartcontract.min.js` |
+| **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@9.22.1/bsv-covenant.min.js` |
+| **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@9.22.1/bsv-script-helper.min.js` |
+| **bsv-security.min.js** | 26KB | Security enhancements (opt-in helpers — see README › Security) | `unpkg.com/@smartledger/bsv@9.22.1/bsv-security.min.js` |
+| **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@9.22.1/bsv-ecies.min.js` |
+| **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@9.22.1/bsv-message.min.js` |
+| **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@9.22.1/bsv-mnemonic.min.js` |
+| **🆕 bsv-shamir.min.js** | 432KB | **Secret sharing** | `unpkg.com/@smartledger/bsv@9.22.1/bsv-shamir.min.js` |
+| **🆕 bsv-gdaf.min.js** | 1184KB | **Digital attestation** | `unpkg.com/@smartledger/bsv@9.22.1/bsv-gdaf.min.js` |
+| **🆕 bsv-ltp.min.js** | 1184KB | **Legal tokens** | `unpkg.com/@smartledger/bsv@9.22.1/bsv-ltp.min.js` |
 
 ## 🎯 **Updated Usage Examples**
 
@@ -100,22 +100,22 @@ Three advanced modules totaling **~2.7MB** of functionality:
 
 #### **1. Basic Development (~963KB)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@9.21.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.21.0/bsv-script-helper.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.22.1/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.22.1/bsv-script-helper.min.js"></script>
 ```
 
 #### **2. Smart Contract Development (~2.7MB — each bundle re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@9.21.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.21.0/bsv-covenant.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.21.0/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.22.1/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.22.1/bsv-covenant.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.22.1/bsv-smartcontract.min.js"></script>
 ```
 
 #### **3. 🆕 Legal & Compliance Development (~3.2MB — each bundle re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@9.21.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.21.0/bsv-ltp.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.21.0/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.22.1/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.22.1/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.22.1/bsv-gdaf.min.js"></script>
 <script>
   // Legal Token Protocol
   const legalToken = bsv.createLegalToken({
@@ -132,9 +132,9 @@ Three advanced modules totaling **~2.7MB** of functionality:
 
 #### **4. 🆕 Security & Cryptography (~1.4MB)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@9.21.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.21.0/bsv-security.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.21.0/bsv-shamir.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.22.1/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.22.1/bsv-security.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.22.1/bsv-shamir.min.js"></script>
 <script>
   // Shamir Secret Sharing
   const shares = bsv.splitSecret('my_secret_key', 5, 3); // 5 shares, 3 needed
@@ -146,7 +146,7 @@ Three advanced modules totaling **~2.7MB** of functionality:
 
 #### **5. Everything Bundle (937KB)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@9.21.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.22.1/bsv.bundle.js"></script>
 <script>
   // Everything available immediately
   const shares = bsv.splitSecret('secret', 5, 3);

package/docs/advanced/UTXO_MANAGER_GUIDE.md

@@ -722,7 +722,7 @@ interface UTXO {
 <html>
 <head>
     <title>UTXO Manager Demo</title>
-    <script src="https://cdn.jsdelivr.net/npm/@smartledger/bsv@9.21.0/bsv.min.js"></script>
+    <script src="https://cdn.jsdelivr.net/npm/@smartledger/bsv@9.22.1/bsv.min.js"></script>
 </head>
 <body>
     <script>

package/docs/audit-rfq/cure53.txt

@@ -15,7 +15,7 @@ seeking a quote for an independent security review of its cryptographic core.
 
 Scope, and we would like these priced separately:
 
-  Tier 1 — 12,469 lines. Sighash construction and signing; ECDSA, nonce
+  Tier 1 — 12,539 lines. Sighash construction and signing; ECDSA, nonce
   derivation and signature encoding; the consensus-flag and era surface of the
   script interpreter; BRC-220 signing; the covenant verification harness; RFC
   8785 canonicalization; and the covenant-facing entrypoints of the smart
@@ -30,7 +30,7 @@ Explicitly out of scope: elliptic-curve and hash primitives, which are supplied
 by the Noble libraries and already audited; opcode EXECUTION in the script
 interpreter, which passes 1,483 of 1,483 of the reference node's own consensus
 vectors with zero false accepts and zero false rejects; and the remaining
-26,518-line application layer (credentials, tokens, ordinals), which we would
+26,575-line application layer (credentials, tokens, ordinals), which we would
 treat as a separate engagement.
 
 Note the shape of that first exclusion, because it is what we want priced. The

package/docs/audit-rfq/ncc-group.txt

@@ -15,7 +15,7 @@ seeking a quote for an independent security review of its cryptographic core.
 
 Scope, and we would like these priced separately:
 
-  Tier 1 — 12,469 lines. Sighash construction and signing; ECDSA, nonce
+  Tier 1 — 12,539 lines. Sighash construction and signing; ECDSA, nonce
   derivation and signature encoding; the consensus-flag and era surface of the
   script interpreter; BRC-220 signing; the covenant verification harness; RFC
   8785 canonicalization; and the covenant-facing entrypoints of the smart
@@ -30,7 +30,7 @@ Explicitly out of scope: elliptic-curve and hash primitives, which are supplied
 by the Noble libraries and already audited; opcode EXECUTION in the script
 interpreter, which passes 1,483 of 1,483 of the reference node's own consensus
 vectors with zero false accepts and zero false rejects; and the remaining
-26,518-line application layer (credentials, tokens, ordinals), which we would
+26,575-line application layer (credentials, tokens, ordinals), which we would
 treat as a separate engagement.
 
 Note the shape of that first exclusion, because it is what we want priced. The

package/docs/audit-rfq/trail-of-bits.txt

@@ -15,7 +15,7 @@ seeking a quote for an independent security review of its cryptographic core.
 
 Scope, and we would like these priced separately:
 
-  Tier 1 — 12,469 lines. Sighash construction and signing; ECDSA, nonce
+  Tier 1 — 12,539 lines. Sighash construction and signing; ECDSA, nonce
   derivation and signature encoding; the consensus-flag and era surface of the
   script interpreter; BRC-220 signing; the covenant verification harness; RFC
   8785 canonicalization; and the covenant-facing entrypoints of the smart
@@ -30,7 +30,7 @@ Explicitly out of scope: elliptic-curve and hash primitives, which are supplied
 by the Noble libraries and already audited; opcode EXECUTION in the script
 interpreter, which passes 1,483 of 1,483 of the reference node's own consensus
 vectors with zero false accepts and zero false rejects; and the remaining
-26,518-line application layer (credentials, tokens, ordinals), which we would
+26,575-line application layer (credentials, tokens, ordinals), which we would
 treat as a separate engagement.
 
 Note the shape of that first exclusion, because it is what we want priced. The

package/docs/getting-started/INSTALLATION.md

@@ -48,7 +48,7 @@ const tx: Transaction = new Transaction();
 #### **Core Library Only (937KB)**
 For basic Bitcoin SV operations:
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@9.21.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.22.1/bsv.min.js"></script>
 <script>
   const privateKey = new bsv.PrivateKey();
   const address = privateKey.toAddress();
@@ -58,7 +58,7 @@ For basic Bitcoin SV operations:
 #### **Complete Bundle (937KB)**  
 Everything in one file:
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@9.21.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.22.1/bsv.bundle.js"></script>
 <script>
   // All features available immediately
   const shares = bsv.splitSecret('secret', 5, 3);
@@ -71,9 +71,9 @@ Everything in one file:
 
 #### **Smart Contract Development (~2.7MB total — each bundle is self-contained and re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@9.21.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.21.0/bsv-covenant.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.21.0/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.22.1/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.22.1/bsv-covenant.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.22.1/bsv-smartcontract.min.js"></script>
 <script>
   const covenant = bsv.SmartContract.createCovenantBuilder()
     .extractField('amount').push(50000).greaterThanOrEqual().build();
@@ -82,9 +82,9 @@ Everything in one file:
 
 #### **Legal & Identity Development (~3.2MB total — each bundle is self-contained and re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@9.21.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.21.0/bsv-ltp.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.21.0/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.22.1/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.22.1/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.22.1/bsv-gdaf.min.js"></script>
 <script>
   // Legal Token Protocol
   const propertyToken = bsv.createPropertyToken({
@@ -98,9 +98,9 @@ Everything in one file:
 
 #### **Security & Cryptography (~1.4MB total — each bundle is self-contained and re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@9.21.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.21.0/bsv-security.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.21.0/bsv-shamir.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.22.1/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.22.1/bsv-security.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.22.1/bsv-shamir.min.js"></script>
 <script>
   // Threshold Cryptography
   const shares = bsv.splitSecret('my_secret_key', 5, 3);
@@ -114,18 +114,18 @@ Everything in one file:
 
 | Module | Size | Purpose | CDN Link |
 |--------|------|---------|----------|
-| **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@9.21.0/bsv.min.js` |
-| **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@9.21.0/bsv.bundle.js` |
-| **bsv-smartcontract.min.js** | 937KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@9.21.0/bsv-smartcontract.min.js` |
-| **bsv-ltp.min.js** | 1184KB | **Legal Token Protocol** | `unpkg.com/@smartledger/bsv@9.21.0/bsv-ltp.min.js` |
-| **bsv-gdaf.min.js** | 1184KB | **Digital Identity & Attestation** | `unpkg.com/@smartledger/bsv@9.21.0/bsv-gdaf.min.js` |
-| **bsv-shamir.min.js** | 432KB | **Threshold Cryptography** | `unpkg.com/@smartledger/bsv@9.21.0/bsv-shamir.min.js` |
-| **bsv-security.min.js** | 26KB | Security enhancements (opt-in helpers — see README › Security) | `unpkg.com/@smartledger/bsv@9.21.0/bsv-security.min.js` |
-| **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@9.21.0/bsv-mnemonic.min.js` |
-| **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@9.21.0/bsv-ecies.min.js` |
-| **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@9.21.0/bsv-covenant.min.js` |
-| **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@9.21.0/bsv-script-helper.min.js` |
-| **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@9.21.0/bsv-message.min.js` |
+| **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@9.22.1/bsv.min.js` |
+| **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@9.22.1/bsv.bundle.js` |
+| **bsv-smartcontract.min.js** | 937KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@9.22.1/bsv-smartcontract.min.js` |
+| **bsv-ltp.min.js** | 1184KB | **Legal Token Protocol** | `unpkg.com/@smartledger/bsv@9.22.1/bsv-ltp.min.js` |
+| **bsv-gdaf.min.js** | 1184KB | **Digital Identity & Attestation** | `unpkg.com/@smartledger/bsv@9.22.1/bsv-gdaf.min.js` |
+| **bsv-shamir.min.js** | 432KB | **Threshold Cryptography** | `unpkg.com/@smartledger/bsv@9.22.1/bsv-shamir.min.js` |
+| **bsv-security.min.js** | 26KB | Security enhancements (opt-in helpers — see README › Security) | `unpkg.com/@smartledger/bsv@9.22.1/bsv-security.min.js` |
+| **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@9.22.1/bsv-mnemonic.min.js` |
+| **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@9.22.1/bsv-ecies.min.js` |
+| **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@9.22.1/bsv-covenant.min.js` |
+| **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@9.22.1/bsv-script-helper.min.js` |
+| **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@9.22.1/bsv-message.min.js` |
 
 ## ⚙️ **Development Environment Setup**
 

package/docs/getting-started/QUICK_START.md

@@ -14,10 +14,10 @@ npm install @smartledger/bsv
 ### Browser CDN (Instant)
 ```html
 <!-- Core library (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@9.21.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.22.1/bsv.min.js"></script>
 
 <!-- Everything included (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@9.21.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.22.1/bsv.bundle.js"></script>
 ```
 
 ## 💰 **Your First Transaction (60 seconds)**
@@ -127,19 +127,19 @@ SmartLedger-BSV offers 12 different loading options - use only what you need:
 
 ```html
 <!-- Core BSV only (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@9.21.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.22.1/bsv.min.js"></script>
 
 <!-- Smart contracts (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@9.21.0/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.22.1/bsv-smartcontract.min.js"></script>
 
 <!-- Legal tokens (1.16MB) -->
-<script src="https://unpkg.com/@smartledger/bsv@9.21.0/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.22.1/bsv-ltp.min.js"></script>
 
 <!-- Digital identity (1.16MB) -->
-<script src="https://unpkg.com/@smartledger/bsv@9.21.0/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.22.1/bsv-gdaf.min.js"></script>
 
 <!-- Everything (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@9.21.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.22.1/bsv.bundle.js"></script>
 ```
 
 ## ⚡ **Key Advantages**

package/docs/migration/FROM_BSV_1_5_6.md

@@ -159,17 +159,17 @@ const recovered = bsv.reconstructSecret([shares[0], shares[2], shares[4]]);
 ### **New Modular Options** 
 ```html
 <!-- Core compatibility (same size as bsv@1.5.6) -->
-<script src="https://unpkg.com/@smartledger/bsv@9.21.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.22.1/bsv.min.js"></script>
 
 <!-- Add smart contracts when ready -->
-<script src="https://unpkg.com/@smartledger/bsv@9.21.0/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.22.1/bsv-smartcontract.min.js"></script>
 
 <!-- Add advanced features as needed -->
-<script src="https://unpkg.com/@smartledger/bsv@9.21.0/bsv-ltp.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.21.0/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.22.1/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.22.1/bsv-gdaf.min.js"></script>
 
 <!-- Everything in one file -->
-<script src="https://unpkg.com/@smartledger/bsv@9.21.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.22.1/bsv.bundle.js"></script>
 ```
 
 ## 🔍 **Testing Your Migration**

package/lib/gdaf/zk-prover.js

@@ -5,6 +5,7 @@ var AttestationSigner = require('./attestation-signer')
 var Hash = require('../crypto/hash')
 var BN = require('../crypto/bn')
 var $ = require('../util/preconditions')
+var JCS = require('../util/jcs')
 
 /**
  * ZKProver
@@ -552,19 +553,72 @@ ZKProver._generateAgeChallenge = function(birthDate, minimumAge, salt) {
  * @param {String} salt - Random salt
  * @returns {Object} Membership proof
  */
+/**
+ * The canonical bytes a set member or claimed value commits to.
+ *
+ * `JSON.stringify` is NOT injective, and the commitment inherited every collision. All of
+ * `null`, `NaN`, `Infinity` and `-Infinity` render as `"null"`, so a prover could claim `NaN`
+ * was a member of `[null]` and the recomputed commitments matched — a forgery that survived
+ * the 9.20.0 fix, found by red-teaming it rather than by a test. `{a:1,b:undefined}` renders
+ * identically to `{a:1}`, and key order made two spellings of the same object commit
+ * differently, so a legitimate caller could also be refused.
+ *
+ * So: a restricted value domain, validated recursively, encoded with RFC 8785 canonical JSON.
+ * JCS sorts keys (two spellings of one object now agree) and refuses non-finite numbers and
+ * `undefined` outright. The recursive check adds what JCS alone does not catch — an
+ * `undefined` PROPERTY VALUE, which JCS drops exactly as JSON does.
+ *
+ * Allowed: null, boolean, finite number, string, array, plain object of those.
+ */
+function canonicalMember (value, path) {
+  var where = path || 'value'
+  var t = typeof value
+  if (value === null || t === 'boolean' || t === 'string') {
+    // fine
+  } else if (t === 'number') {
+    if (!isFinite(value)) throw new Error(where + ' must be a finite number')
+  } else if (Array.isArray(value)) {
+    for (var i = 0; i < value.length; i++) {
+      if (value[i] === undefined) throw new Error(where + '[' + i + '] is undefined')
+      canonicalMember(value[i], where + '[' + i + ']')
+    }
+  } else if (t === 'object') {
+    if (Object.getPrototypeOf(value) !== Object.prototype &&
+        Object.getPrototypeOf(value) !== null) {
+      throw new Error(where + ' must be a plain object')
+    }
+    var keys = Object.keys(value)
+    for (var k = 0; k < keys.length; k++) {
+      if (value[keys[k]] === undefined) {
+        throw new Error(where + '.' + keys[k] + ' is undefined')
+      }
+      canonicalMember(value[keys[k]], where + '.' + keys[k])
+    }
+  } else {
+    throw new Error(where + ' is not a permitted type: ' + t)
+  }
+  return JCS.stringify(value)
+}
+
 ZKProver.generateMembershipProof = function(set, value, salt) {
   $.checkArgument(Array.isArray(set), 'Set must be array')
-  $.checkArgument(set.includes(value), 'Value not in set')
-  
+
+  // Membership is structural, over the canonical form. `set.includes(value)` compared objects
+  // by reference, so generating a proof for a structurally equal object threw "Value not in
+  // set" — a caller could not use this with object members at all.
+  var canonicalSet = set.map(function (member, i) {
+    return canonicalMember(member, 'set[' + i + ']')
+  })
+  var canonicalValue = canonicalMember(value)
+  $.checkArgument(canonicalSet.indexOf(canonicalValue) !== -1, 'Value not in set')
+
   salt = salt || Random.getRandomBuffer(32).toString('hex')
-  
-  // Create commitments to all set members
-  var commitments = set.map(function(member) {
-    return Hash.sha256(Buffer.from(JSON.stringify(member) + ':' + salt, 'utf8')).toString('hex')
+
+  var commitments = canonicalSet.map(function (form) {
+    return Hash.sha256(Buffer.from(form + ':' + salt, 'utf8')).toString('hex')
   })
-  
-  // Create commitment to the claimed value
-  var valueCommitment = Hash.sha256(Buffer.from(JSON.stringify(value) + ':' + salt, 'utf8')).toString('hex')
+
+  var valueCommitment = Hash.sha256(Buffer.from(canonicalValue + ':' + salt, 'utf8')).toString('hex')
   
   return {
     type: 'MembershipProof',
@@ -640,15 +694,18 @@ ZKProver.verifyMembershipProof = function(proof, opening, set) {
       return false
     }
 
-    var commit = function (member) {
+    // Canonical, injective encoding over a validated domain — see canonicalMember. Anything
+    // outside the domain throws, and the catch below answers false, which is the honest
+    // verdict for a value this construction cannot commit to unambiguously.
+    var commit = function (member, path) {
       return Hash.sha256(
-        Buffer.from(JSON.stringify(member) + ':' + opening.salt, 'utf8')
+        Buffer.from(canonicalMember(member, path) + ':' + opening.salt, 'utf8')
       ).toString('hex')
     }
 
     // The prover's array must be exactly the commitments the verifier's set implies, in
     // order. Comparing as a set would let a prover append a commitment of its own.
-    var expected = set.map(commit)
+    var expected = set.map(function (m, i) { return commit(m, 'set[' + i + ']') })
     if (expected.length !== proof.setCommitments.length) {
       return false
     }
@@ -659,7 +716,7 @@ ZKProver.verifyMembershipProof = function(proof, opening, set) {
     }
 
     // The opening must commit to the value the proof names.
-    if (commit(opening.value) !== proof.valueCommitment) {
+    if (commit(opening.value, 'opening.value') !== proof.valueCommitment) {
       return false
     }
 

package/lib/transaction/sighash.js

@@ -72,18 +72,48 @@ var sighashPreimageForForkId = function (transaction, sighashType, inputNumber,
   var hashSequence = Buffer.alloc(32)
   var hashOutputs = Buffer.alloc(32)
 
+  // These three digests are the same for EVERY input of a transaction, and computing them
+  // costs a pass over all the inputs or all the outputs. Recomputing them per input made
+  // signing quadratic: measured on 9.22.0, 100 inputs took 0.9 s and 5,000 took 194 s —
+  // 50x the inputs for 216x the time.
+  //
+  // `Transaction.prototype.getSignatures` opens a cache for the duration of its pass and
+  // closes it afterwards. That window is safe without any invalidation logic, because
+  // `sign()` collects every signature BEFORE applying any of them, so no input or output
+  // changes while the cache is open. Outside that window there is no cache and nothing is
+  // remembered, which is why this cannot go stale.
+  //
+  // The SIGHASH_SINGLE branch is deliberately NOT cached: it hashes one output chosen by
+  // `inputNumber`, so it differs per input and is O(1) anyway.
+  var midstates = transaction && transaction._sighashMidstates
+
   if (!(sighashType & Signature.SIGHASH_ANYONECANPAY)) {
-    hashPrevouts = GetPrevoutHash(transaction)
+    if (midstates) {
+      if (!midstates.prevouts) midstates.prevouts = GetPrevoutHash(transaction)
+      hashPrevouts = midstates.prevouts
+    } else {
+      hashPrevouts = GetPrevoutHash(transaction)
+    }
   }
 
   if (!(sighashType & Signature.SIGHASH_ANYONECANPAY) &&
     (sighashType & 31) !== Signature.SIGHASH_SINGLE &&
     (sighashType & 31) !== Signature.SIGHASH_NONE) {
-    hashSequence = GetSequenceHash(transaction)
+    if (midstates) {
+      if (!midstates.sequence) midstates.sequence = GetSequenceHash(transaction)
+      hashSequence = midstates.sequence
+    } else {
+      hashSequence = GetSequenceHash(transaction)
+    }
   }
 
   if ((sighashType & 31) !== Signature.SIGHASH_SINGLE && (sighashType & 31) !== Signature.SIGHASH_NONE) {
-    hashOutputs = GetOutputsHash(transaction)
+    if (midstates) {
+      if (!midstates.outputsAll) midstates.outputsAll = GetOutputsHash(transaction)
+      hashOutputs = midstates.outputsAll
+    } else {
+      hashOutputs = GetOutputsHash(transaction)
+    }
   } else if ((sighashType & 31) === Signature.SIGHASH_SINGLE && inputNumber < transaction.outputs.length) {
     hashOutputs = GetOutputsHash(transaction, inputNumber)
   }

package/lib/transaction/transaction.js

@@ -1080,9 +1080,30 @@ Transaction.prototype.sign = function (privateKey, sigtype) {
     })
     return this
   }
-  _.each(this.getSignatures(privateKey, sigtype), function (signature) {
-    self.applySignature(signature)
-  })
+
+  // The midstate cache covers the WHOLE signing call, not just signature collection.
+  //
+  // `applySignature` -> `addSignature` re-verifies each signature before applying it, which
+  // recomputes the preimage, so the apply loop was quadratic for the same reason the collect
+  // loop was — and measured larger: at 5,000 inputs, 68.7 s applying against 50.3 s
+  // collecting.
+  //
+  // Widening the window is safe because the only thing the apply loop changes is each input's
+  // SCRIPT, and none of the three cached digests depends on a script: hashPrevouts covers
+  // outpoints, hashSequence covers sequence numbers, hashOutputs covers outputs. A script
+  // cannot alter any of them.
+  //
+  // `_.isArray` recursion above re-enters this function, so an existing cache is left alone
+  // and only the outermost call clears it.
+  var owns = !this._sighashMidstates
+  if (owns) this._sighashMidstates = {}
+  try {
+    _.each(this.getSignatures(privateKey, sigtype), function (signature) {
+      self.applySignature(signature)
+    })
+  } finally {
+    if (owns) delete this._sighashMidstates
+  }
   return this
 }
 
@@ -1093,11 +1114,30 @@ Transaction.prototype.getSignatures = function (privKey, sigtype) {
   var transaction = this
   var results = []
   var hashData = Hash.sha256ripemd160(privKey.publicKey.toBuffer())
-  _.each(this.inputs, function forEachInput (input, index) {
-    _.each(input.getSignatures(transaction, privKey, index, sigtype, hashData), function (signature) {
-      results.push(signature)
+
+  // The FORKID preimage's hashPrevouts, hashSequence and hashOutputs are identical for every
+  // input of this transaction, and each costs a pass over all inputs or all outputs. Without
+  // this, signing n inputs recomputed them n times and the cost was quadratic: 5,000 inputs
+  // took 194 seconds on 9.22.0.
+  //
+  // The cache is opened for this pass only and removed in a `finally`, so nothing survives
+  // the call and no invalidation is needed. It is sound precisely because this loop only
+  // COLLECTS signatures — `sign()` applies them afterwards — so no input or output changes
+  // while it is open. Anything that mutates the transaction does so outside this window and
+  // finds no cache to go stale.
+  // Opened here too, so a caller using getSignatures directly also gets the linear path.
+  // Only whoever opened it closes it — `sign()` wraps both loops in one window.
+  var ownsCache = !this._sighashMidstates
+  if (ownsCache) this._sighashMidstates = {}
+  try {
+    _.each(this.inputs, function forEachInput (input, index) {
+      _.each(input.getSignatures(transaction, privKey, index, sigtype, hashData), function (signature) {
+        results.push(signature)
+      })
     })
-  })
+  } finally {
+    if (ownsCache) delete this._sighashMidstates
+  }
   return results
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smartledger/bsv",
-  "version": "9.21.0",
+  "version": "9.22.1",
   "description": "Bitcoin SV library with an interpreter-verified script engine: OP_PUSH_TX covenants, BIP-143 preimage tooling, and consensus flags that match what miners actually enforce. Also ships DID:web / W3C VC-JWT credentials and the Legal Token Protocol.",
   "author": "SmartLedger Technology <hello@smartledger.technology> (https://smartledger.technology)",
   "homepage": "https://github.com/codenlighten/smartledger-bsv#readme",

package/version.js

@@ -1,3 +1,3 @@
 'use strict'
 // GENERATED by scripts/sync-version.js on `npm version` — do not edit.
-module.exports = '9.21.0'
+module.exports = '9.22.1'