@smartledger/bsv 9.22.0 → 9.22.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (20) hide show
  1. package/CHANGELOG.md +43 -0
  2. package/README.md +19 -19
  3. package/bsv-gdaf.min.js +2 -2
  4. package/bsv-ltp.min.js +29 -29
  5. package/bsv-smartcontract.min.js +1 -1
  6. package/bsv.bundle.js +2 -2
  7. package/bsv.min.js +2 -2
  8. package/docs/AUDIT_SCOPE.md +6 -6
  9. package/docs/MODULE_REFERENCE_COMPLETE.md +27 -27
  10. package/docs/advanced/UTXO_MANAGER_GUIDE.md +1 -1
  11. package/docs/audit-rfq/cure53.txt +1 -1
  12. package/docs/audit-rfq/ncc-group.txt +1 -1
  13. package/docs/audit-rfq/trail-of-bits.txt +1 -1
  14. package/docs/getting-started/INSTALLATION.md +23 -23
  15. package/docs/getting-started/QUICK_START.md +7 -7
  16. package/docs/migration/FROM_BSV_1_5_6.md +5 -5
  17. package/lib/transaction/sighash.js +33 -3
  18. package/lib/transaction/transaction.js +47 -7
  19. package/package.json +1 -1
  20. package/version.js +1 -1
package/CHANGELOG.md CHANGED
@@ -7,6 +7,49 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
7
7
 
8
8
  ## [Unreleased]
9
9
 
10
+ ## [9.22.1] - 2026-10-06
11
+
12
+ ### Changed — signing many inputs is no longer quadratic in the number of inputs
13
+
14
+ No behavioural change. **Verified byte-identical**: the same nine transactions signed before and
15
+ after produce the same bytes and the same txid, including the `SIGHASH_SINGLE` and `SIGHASH_NONE`
16
+ cases that take different preimage branches.
17
+
18
+ The FORKID preimage's `hashPrevouts`, `hashSequence` and `hashOutputs` were recomputed on every
19
+ sighash, and each costs a pass over all inputs or all outputs. They are **identical for every input
20
+ of a transaction**, so signing *n* inputs ran three O(n) digests *n* times:
21
+
22
+ | inputs | 9.22.0 | 9.22.1 |
23
+ |---|---|---|
24
+ | 100 | 0.9 s | 0.5 s |
25
+ | 1,000 | 10.7 s | 8.9 s |
26
+ | 3,000 | 70.1 s | 39.7 s |
27
+ | 5,000 | **194.2 s** | **~100 s** |
28
+
29
+ `Transaction#sign` now opens a cache for the duration of one call and removes it in a `finally`, so
30
+ nothing survives the call and **there is no invalidation to get wrong**. The alternative — memoizing
31
+ on the transaction and clearing at each of the 11 sites that mutate inputs or outputs — was rejected
32
+ for exactly that reason: a missed site yields a *wrong signature*, which is a different class of
33
+ failure from a stale fee.
34
+
35
+ The window covers the apply loop as well as signature collection, because `applySignature` →
36
+ `addSignature` **re-verifies** each signature before applying it, which recomputes the preimage —
37
+ measured larger than collection at 5,000 inputs (68.7 s against 50.3 s). Widening it is safe
38
+ because the apply loop only changes each input's *script*, and none of the three digests depends on
39
+ a script: `hashPrevouts` covers outpoints, `hashSequence` covers sequence numbers, `hashOutputs`
40
+ covers outputs.
41
+
42
+ `SIGHASH_SINGLE` is deliberately **not** cached: it hashes the one output at the input's index, so
43
+ it differs per input, and a shared value would sign every input over the same output. A test asserts
44
+ that `SIGHASH_SINGLE` still produces a distinct script per input.
45
+
46
+ **It is still superlinear** — per-input cost goes from 4.84 ms at 100 inputs to 20.50 ms at 5,000 —
47
+ so something else in the per-input path remains O(n). The signature re-verification on apply is the
48
+ largest remaining term. This release halves the cost; it does not make signing linear, and a
49
+ consolidation sweep over tens of thousands of coins will still feel it.
50
+
51
+ Found while answering a consumer that batches a daily settlement of up to 5,000 inputs.
52
+
10
53
  ## [9.22.0] - 2026-10-06
11
54
 
12
55
  ### Security — the membership commitment was over a non-injective encoding
package/README.md CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  Bitcoin SV library with an interpreter-verified script engine.
4
4
 
5
- [![Version](https://img.shields.io/badge/version-9.22.0-blue.svg)](https://www.npmjs.com/package/@smartledger/bsv)
5
+ [![Version](https://img.shields.io/badge/version-9.22.1-blue.svg)](https://www.npmjs.com/package/@smartledger/bsv)
6
6
  [![License](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
7
7
  [![Stability](https://img.shields.io/badge/9.x%20stable%20until-2027--09--01-brightgreen.svg)](STABILITY.md)
8
8
 
@@ -155,44 +155,44 @@ const bsv = require('@smartledger/bsv') // 128 modules
155
155
  ### **Core Modules**
156
156
  | Module | Size | Use Case | CDN |
157
157
  |--------|------|----------|-----|
158
- | **bsv.min.js** | 1069KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@9.22.0/bsv.min.js` |
159
- | **bsv.bundle.js** | 1069KB | Everything in one file | `unpkg.com/@smartledger/bsv@9.22.0/bsv.bundle.js` |
158
+ | **bsv.min.js** | 1070KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@9.22.1/bsv.min.js` |
159
+ | **bsv.bundle.js** | 1070KB | Everything in one file | `unpkg.com/@smartledger/bsv@9.22.1/bsv.bundle.js` |
160
160
 
161
161
  ### **W3C Verifiable Credentials**
162
162
  | Module | Size | Use Case | CDN |
163
163
  |--------|------|----------|-----|
164
- | **🟢 bsv-didweb.min.js** | 166KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@9.22.0/bsv-didweb.min.js` |
165
- | **🟢 bsv-vcjwt.min.js** | 166KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@9.22.0/bsv-vcjwt.min.js` |
166
- | **🟢 bsv-statuslist.min.js** | 256KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@9.22.0/bsv-statuslist.min.js` |
167
- | **🟢 bsv-anchor.min.js** | 164KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@9.22.0/bsv-anchor.min.js` |
164
+ | **🟢 bsv-didweb.min.js** | 166KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@9.22.1/bsv-didweb.min.js` |
165
+ | **🟢 bsv-vcjwt.min.js** | 166KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@9.22.1/bsv-vcjwt.min.js` |
166
+ | **🟢 bsv-statuslist.min.js** | 256KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@9.22.1/bsv-statuslist.min.js` |
167
+ | **🟢 bsv-anchor.min.js** | 164KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@9.22.1/bsv-anchor.min.js` |
168
168
 
169
169
  ### **Smart Contract & Development**
170
170
  | Module | Size | Use Case | CDN |
171
171
  |--------|------|----------|-----|
172
- | **bsv-smartcontract.min.js** | 141KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@9.22.0/bsv-smartcontract.min.js` |
173
- | **bsv-covenant.min.js** | 35KB | Covenant operations | `unpkg.com/@smartledger/bsv@9.22.0/bsv-covenant.min.js` |
174
- | **bsv-script-helper.min.js** | 33KB | Custom script tools | `unpkg.com/@smartledger/bsv@9.22.0/bsv-script-helper.min.js` |
175
- | **bsv-security.min.js** | 32KB | Security enhancements | `unpkg.com/@smartledger/bsv@9.22.0/bsv-security.min.js` |
172
+ | **bsv-smartcontract.min.js** | 141KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@9.22.1/bsv-smartcontract.min.js` |
173
+ | **bsv-covenant.min.js** | 35KB | Covenant operations | `unpkg.com/@smartledger/bsv@9.22.1/bsv-covenant.min.js` |
174
+ | **bsv-script-helper.min.js** | 33KB | Custom script tools | `unpkg.com/@smartledger/bsv@9.22.1/bsv-script-helper.min.js` |
175
+ | **bsv-security.min.js** | 32KB | Security enhancements | `unpkg.com/@smartledger/bsv@9.22.1/bsv-security.min.js` |
176
176
 
177
177
  ### **Legal & Compliance**
178
178
  | Module | Size | Use Case | CDN |
179
179
  |--------|------|----------|-----|
180
- | **bsv-ltp.min.js** | 544KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@9.22.0/bsv-ltp.min.js` |
181
- | **bsv-gdaf.min.js** | 1069KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@9.22.0/bsv-gdaf.min.js` |
180
+ | **bsv-ltp.min.js** | 544KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@9.22.1/bsv-ltp.min.js` |
181
+ | **bsv-gdaf.min.js** | 1070KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@9.22.1/bsv-gdaf.min.js` |
182
182
 
183
183
  ### **Advanced Cryptography**
184
184
  | Module | Size | Use Case | CDN |
185
185
  |--------|------|----------|-----|
186
- | **bsv-shamir.min.js** | 177KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@9.22.0/bsv-shamir.min.js` |
186
+ | **bsv-shamir.min.js** | 177KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@9.22.1/bsv-shamir.min.js` |
187
187
 
188
188
  ### **Utilities**
189
189
  | Module | Size | Use Case | CDN |
190
190
  |--------|------|----------|-----|
191
- | **bsv-ecies.min.js** | 139KB | Encryption | `unpkg.com/@smartledger/bsv@9.22.0/bsv-ecies.min.js` |
192
- | **bsv-message.min.js** | 34KB | Message signing | `unpkg.com/@smartledger/bsv@9.22.0/bsv-message.min.js` |
193
- | **bsv-mnemonic.min.js** | 320KB | HD wallets | `unpkg.com/@smartledger/bsv@9.22.0/bsv-mnemonic.min.js` |
191
+ | **bsv-ecies.min.js** | 139KB | Encryption | `unpkg.com/@smartledger/bsv@9.22.1/bsv-ecies.min.js` |
192
+ | **bsv-message.min.js** | 34KB | Message signing | `unpkg.com/@smartledger/bsv@9.22.1/bsv-message.min.js` |
193
+ | **bsv-mnemonic.min.js** | 320KB | HD wallets | `unpkg.com/@smartledger/bsv@9.22.1/bsv-mnemonic.min.js` |
194
194
  ```html
195
- <script src="https://unpkg.com/@smartledger/bsv@9.22.0/bsv.min.js"></script>
195
+ <script src="https://unpkg.com/@smartledger/bsv@9.22.1/bsv.min.js"></script>
196
196
  <script>
197
197
  const key = bsv.PrivateKey.fromRandom()
198
198
  </script>
@@ -240,4 +240,4 @@ MIT
240
240
 
241
241
  ---
242
242
 
243
- **SmartLedger-BSV v9.22.0**
243
+ **SmartLedger-BSV v9.22.1**