@smartledger/bsv 9.24.0 → 9.25.0

package/CHANGELOG.md

@@ -7,6 +7,62 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [9.25.0] - 2026-10-07
+
+Two claims a certificate can carry that this library does not verify, and answered `valid` about
+anyway. Both found by the **block-penn-station session's differential fuzz** — 3,573 inputs, our
+`examples/gateway` adapter against an independent Python verifier written from the NotaryHash spec
+rather than from our code. Same verdict on 3,137 of them; the disagreements were ours.
+
+### Fixed — `anchor.seal` was not verified, and a certificate carrying one still verified
+
+A sealed record asserts it is the **one successor** of another: its transaction spends a
+one-satoshi seal output of the predecessor's transaction, and an output is spent once. That is
+checked by `@smartledger/notaryhash` (`verifySealedLink`, their SPEC 5b). **This library implements
+none of it**, and verified the 1.0 parts of such a certificate and answered `valid` — presenting an
+unchecked chain-of-custody claim as verified.
+
+319 fuzz inputs with a damaged seal verified here, including:
+
+- a certificate relabelled as the successor of a record it is not, naming a transaction its own
+  transaction does not spend;
+- a seal signature of 64 zero bytes;
+- a seal replaced by `true`, `"x"` or `[]`;
+- the **first** record of a chain given an invented predecessor.
+
+Their verifier and the notaryhash SDK refuse every one. A certificate carrying `anchor.seal` is now
+refused, with `opts.allowUncheckedSeal` for a caller that wants the 1.0 verdict and will check the
+seal itself. An absent or `null` seal is no claim and is unaffected.
+
+### Fixed — a false `anchor.blockHeight` verified when `spv.blockHeight` was null
+
+`anchor.blockHeight` was compared with `spv.blockHeight` **only when both were present**, so nulling
+or deleting `spv.blockHeight` removed the only value it was ever checked against. A certificate
+claiming `anchor.blockHeight: 1` then verified against a mainnet block at height 970038 — the height
+was bound to nothing. `anchor.blockTime` was still checked, so this was the height alone.
+
+A present `anchor.blockHeight` must now be **checkable**: if the SPV envelope does not say which
+height it proves, the claim is refused rather than skipped. Introduced in 9.20.0 with the rest of
+the anchor checks; the guard was written as a consistency test when it needed to be a coverage test.
+
+### Fixed — `examples/gateway` broke its own three-state contract
+
+The adapter returned `invalid` for a certificate with **no `spv` member**. The service issues
+certificates in that state and fills the envelope when a block arrives, so "there is no proof of
+inclusion yet" is `indeterminate` — the same "I could not look" the file spends two paragraphs
+insisting on. It now returns `indeterminate` and says to re-fetch.
+
+The adapter also enumerated the two options it knew about when calling `NotaryHash.verify` and
+dropped everything else, which silently disabled `allowUncheckedSeal` and `allowUnknownSpvFormat`
+for its callers. It forwards them now.
+
+### The common rule
+
+Both library fixes are the one adopted in 9.24.0 for `spv.format`: **verifying a proof is not
+accepting a self-described certificate.** A statement the verifier never read cannot be covered by a
+verdict of `valid`. Each refusal has an opt-out, because a caller that checks the claim by other
+means should not be blocked by our inability to check it.
+
 ## [9.24.0] - 2026-10-07
 
 ### Changed — a certificate whose `spv.format` is not TSC is now refused
@@ -39,8 +95,13 @@ fold is needed to reach it.
 - `opts.allowUnknownSpvFormat` accepts it anyway, for a caller that knows the label is wrong and
   does not care.
 
-The real repair belongs upstream — bring the field under the signature — which is a service and
-spec change, not one a verifier can make.
+**Correction to this entry, same day.** It first said the real repair was to bring the field under
+the signature. That is impossible, and the notaryhash service session was right to say so: the SPV
+envelope does not exist until the block does and is replaced after a reorganisation, so no key that
+signed the record can ever cover it. Everything under `spv` and `anchor` is unsigned **by
+construction**. The remedy is therefore not a signature but what this check does — decline to
+return a verdict about evidence we did not read — and, better, to say what *was* checked, which is
+why `proofIntegrity` stays `true` here.
 
 ### Added — the service's tamper vector, vendored
 

package/README.md

@@ -2,7 +2,7 @@
 
 Bitcoin SV library with an interpreter-verified script engine.
 
-[![Version](https://img.shields.io/badge/version-9.24.0-blue.svg)](https://www.npmjs.com/package/@smartledger/bsv)
+[![Version](https://img.shields.io/badge/version-9.25.0-blue.svg)](https://www.npmjs.com/package/@smartledger/bsv)
 [![License](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
 [![Stability](https://img.shields.io/badge/9.x%20stable%20until-2027--09--01-brightgreen.svg)](STABILITY.md)
 
@@ -155,44 +155,44 @@ const bsv = require('@smartledger/bsv')                 // 128 modules
 ### **Core Modules**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv.min.js** | 1070KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@9.24.0/bsv.min.js` |
-| **bsv.bundle.js** | 1070KB | Everything in one file | `unpkg.com/@smartledger/bsv@9.24.0/bsv.bundle.js` |
+| **bsv.min.js** | 1070KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@9.25.0/bsv.min.js` |
+| **bsv.bundle.js** | 1070KB | Everything in one file | `unpkg.com/@smartledger/bsv@9.25.0/bsv.bundle.js` |
 
 ### **W3C Verifiable Credentials**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **🟢 bsv-didweb.min.js** | 166KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@9.24.0/bsv-didweb.min.js` |
-| **🟢 bsv-vcjwt.min.js** | 166KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@9.24.0/bsv-vcjwt.min.js` |
-| **🟢 bsv-statuslist.min.js** | 256KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@9.24.0/bsv-statuslist.min.js` |
-| **🟢 bsv-anchor.min.js** | 164KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@9.24.0/bsv-anchor.min.js` |
+| **🟢 bsv-didweb.min.js** | 166KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@9.25.0/bsv-didweb.min.js` |
+| **🟢 bsv-vcjwt.min.js** | 166KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@9.25.0/bsv-vcjwt.min.js` |
+| **🟢 bsv-statuslist.min.js** | 256KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@9.25.0/bsv-statuslist.min.js` |
+| **🟢 bsv-anchor.min.js** | 164KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@9.25.0/bsv-anchor.min.js` |
 
 ### **Smart Contract & Development**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-smartcontract.min.js** | 141KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@9.24.0/bsv-smartcontract.min.js` |
-| **bsv-covenant.min.js** | 35KB | Covenant operations | `unpkg.com/@smartledger/bsv@9.24.0/bsv-covenant.min.js` |
-| **bsv-script-helper.min.js** | 33KB | Custom script tools | `unpkg.com/@smartledger/bsv@9.24.0/bsv-script-helper.min.js` |
-| **bsv-security.min.js** | 32KB | Security enhancements | `unpkg.com/@smartledger/bsv@9.24.0/bsv-security.min.js` |
+| **bsv-smartcontract.min.js** | 141KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@9.25.0/bsv-smartcontract.min.js` |
+| **bsv-covenant.min.js** | 35KB | Covenant operations | `unpkg.com/@smartledger/bsv@9.25.0/bsv-covenant.min.js` |
+| **bsv-script-helper.min.js** | 33KB | Custom script tools | `unpkg.com/@smartledger/bsv@9.25.0/bsv-script-helper.min.js` |
+| **bsv-security.min.js** | 32KB | Security enhancements | `unpkg.com/@smartledger/bsv@9.25.0/bsv-security.min.js` |
 
 ### **Legal & Compliance**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-ltp.min.js** | 544KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@9.24.0/bsv-ltp.min.js` |
-| **bsv-gdaf.min.js** | 1070KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@9.24.0/bsv-gdaf.min.js` |
+| **bsv-ltp.min.js** | 544KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@9.25.0/bsv-ltp.min.js` |
+| **bsv-gdaf.min.js** | 1070KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@9.25.0/bsv-gdaf.min.js` |
 
 ### **Advanced Cryptography**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-shamir.min.js** | 177KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@9.24.0/bsv-shamir.min.js` |
+| **bsv-shamir.min.js** | 177KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@9.25.0/bsv-shamir.min.js` |
 
 ### **Utilities**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-ecies.min.js** | 139KB | Encryption | `unpkg.com/@smartledger/bsv@9.24.0/bsv-ecies.min.js` |
-| **bsv-message.min.js** | 34KB | Message signing | `unpkg.com/@smartledger/bsv@9.24.0/bsv-message.min.js` |
-| **bsv-mnemonic.min.js** | 320KB | HD wallets | `unpkg.com/@smartledger/bsv@9.24.0/bsv-mnemonic.min.js` |
+| **bsv-ecies.min.js** | 139KB | Encryption | `unpkg.com/@smartledger/bsv@9.25.0/bsv-ecies.min.js` |
+| **bsv-message.min.js** | 34KB | Message signing | `unpkg.com/@smartledger/bsv@9.25.0/bsv-message.min.js` |
+| **bsv-mnemonic.min.js** | 320KB | HD wallets | `unpkg.com/@smartledger/bsv@9.25.0/bsv-mnemonic.min.js` |
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@9.24.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.25.0/bsv.min.js"></script>
 <script>
   const key = bsv.PrivateKey.fromRandom()
 </script>
@@ -240,4 +240,4 @@ MIT
 
 ---
 
-**SmartLedger-BSV v9.24.0**
+**SmartLedger-BSV v9.25.0**