@smartledger/bsv 9.8.0 → 9.10.0

package/lib/notaryhash/index.js

@@ -22,6 +22,10 @@ var Merkle = require('./merkle')
  * saying which check failed is unactionable — a bad signature and an unmined transaction
  * are different problems with different fixes.
  *
+ * Certificates are in the reference implementation's format — see
+ * lib/notaryhash/certificate.js. Every check below normalises first, so a certificate
+ * written by 8.3.0–9.8.0 still verifies.
+ *
  * NOTE this library never fetches a block header. The spec is explicit that the verifier
  * "trusts only a block header, obtained from any source it chooses", and choosing that
  * source is the caller's decision, not ours: a single provider is a single point of
@@ -52,12 +56,8 @@ NotaryHash.registerSuite = function (algorithm, suite) {
 NotaryHash.verifySignature = function (certificate) {
   try {
     if (!certificate || typeof certificate !== 'object') return false
-    return Suites.verify(
-      certificate.algorithm,
-      Buffer.from(certificate.payloadHash, 'hex'),
-      Buffer.from(certificate.signature, 'hex'),
-      Buffer.from(certificate.publicKey, 'hex')
-    )
+    var f = Certificate.toProofInput(certificate)
+    return Suites.verify(f.algorithm, f.payloadHash, f.signature, f.publicKey)
   } catch (e) {
     return false
   }
@@ -115,36 +115,38 @@ NotaryHash.recordFromRawTx = function (rawTx) {
 NotaryHash.recordMatchesCertificate = function (record, certificate) {
   try {
     if (!record || !certificate) return false
-    if (record.mode !== certificate.mode) return false
-
-    if (record.mode === NotaryScript.MODE.BATCH) {
-      if (!certificate.merkle) return false
-      if (record.merkleRoot.toString('hex') !== String(certificate.merkle.root).toLowerCase()) {
+    var c = Certificate.normalize(certificate)
+    var recordIsBatch = record.mode === NotaryScript.MODE.BATCH
+    var certIsBatch = !!(c.anchor && c.anchor.type === Certificate.ANCHOR_TYPE.BATCH)
+
+    if (recordIsBatch || certIsBatch) {
+      // Both sides must agree it is a batch: a batch certificate pointed at a single
+      // proof's record, or the reverse, is a mismatch however the fields line up.
+      if (!recordIsBatch || !certIsBatch || !c.merkle) return false
+      if (!record.merkleRoot.equals(Certificate.decodeBytes(c.merkle.root, 'hex', 'merkle.root'))) {
         return false
       }
-      // leafCount is compared because the inclusion proof CANNOT be relied on to catch a
-      // wrong one. RFC 6962 derives the tree shape from the count, but for most indices
-      // the fold is identical across neighbouring counts — measured on an 8-leaf tree,
-      // only indices 6 and 7 fold differently when the count is claimed as 7. The
-      // on-chain u32be is the authoritative value, so it is checked here rather than
-      // assumed to be implied.
-      return record.leafCount === certificate.merkle.leafCount
+      // leafCount is compared because the inclusion proof cannot be relied on to catch a
+      // wrong one: for most indices the fold is identical across neighbouring counts.
+      // The on-chain u32be is authoritative.
+      return record.leafCount === c.merkle.leafCount
     }
 
-    if (record.algorithm !== certificate.algorithm) return false
-    if (record.hashAlgorithm !== certificate.hashAlgorithm) return false
-    if (record.payloadHash.toString('hex') !== String(certificate.payloadHash).toLowerCase()) return false
-    if (record.proofHash.toString('hex') !== String(certificate.proofHash).toLowerCase()) return false
+    var expected = c.mode === Certificate.MODE.FULL ? NotaryScript.MODE.FULL
+      : c.mode === Certificate.MODE.HYBRID ? NotaryScript.MODE.HYBRID : -1
+    if (record.mode !== expected) return false
 
-    var certPub = Buffer.from(certificate.publicKey, 'hex')
-    var certSig = Buffer.from(certificate.signature, 'hex')
+    var f = Certificate.toProofInput(c)
+    if (record.algorithm !== f.algorithm) return false
+    if (record.hashAlgorithm !== f.hashAlgorithm) return false
+    if (!record.payloadHash.equals(f.payloadHash)) return false
+    if (!record.proofHash.equals(Certificate.decodeBytes(c.proofHash, 'hex', 'proofHash'))) return false
 
     if (record.mode === NotaryScript.MODE.HYBRID) {
-      return record.publicKeyHash.equals(Hash.sha256(certPub)) &&
-        record.signatureHash.equals(Hash.sha256(certSig))
+      return record.publicKeyHash.equals(Hash.sha256(f.publicKey)) &&
+        record.signatureHash.equals(Hash.sha256(f.signature))
     }
-
-    return record.publicKey.equals(certPub) && record.signature.equals(certSig)
+    return record.publicKey.equals(f.publicKey) && record.signature.equals(f.signature)
   } catch (e) {
     return false
   }
@@ -163,6 +165,8 @@ NotaryHash.recordMatchesCertificate = function (record, certificate) {
  * @param {Object} certificate - must carry an `spv` envelope
  * @param {Object} opts
  * @param {String|Buffer|BlockHeader} opts.header - independently obtained
+ * @param {Number} [opts.height] - the height the header was obtained at. A header's 80
+ *   bytes do not carry it, so it is checked against spv.blockHeight only when supplied.
  * @param {Boolean} [opts.requirePow=true] - pass false only for test fixtures
  * @returns {Object} { valid, errors }
  */
@@ -171,7 +175,8 @@ NotaryHash.verifyAnchorSPV = function (certificate, opts) {
   opts = opts || {}
 
   try {
-    var spv = certificate && certificate.spv
+    var c = Certificate.normalize(certificate)
+    var spv = c && c.spv
     if (!spv) {
       return { valid: false, errors: ['certificate has no SPV envelope'] }
     }
@@ -184,14 +189,14 @@ NotaryHash.verifyAnchorSPV = function (certificate, opts) {
     }
 
     var txid = NotaryHash.txidFromRawTx(spv.rawTx)
-    if (txid !== String(certificate.anchor.txid).toLowerCase()) {
+    if (!c.anchor || txid !== String(c.anchor.txid).toLowerCase()) {
       errors.push('rawTx does not hash to anchor.txid')
     }
 
     var record = NotaryHash.recordFromRawTx(spv.rawTx)
     if (!record) {
       errors.push('no NotaryHash record found in rawTx')
-    } else if (!NotaryHash.recordMatchesCertificate(record, certificate)) {
+    } else if (!NotaryHash.recordMatchesCertificate(record, c)) {
       errors.push('on-chain record does not match the certificate')
     }
 
@@ -209,6 +214,22 @@ NotaryHash.verifyAnchorSPV = function (certificate, opts) {
         : 'block header failed proof-of-work validation')
     }
 
+    // The spec anchors the certificate in "the block header for spv.blockHash". A header
+    // the proof folds to, that is not that block, proves inclusion somewhere else — and the
+    // certificate's own statement of where would go unchecked. The reference compares
+    // the header's hash against the envelope; so does this.
+    if (spv.blockHash !== undefined &&
+      String(spv.blockHash).toLowerCase() !== String(inclusion.blockHash).toLowerCase()) {
+      errors.push('the supplied header is not the block the SPV envelope names')
+    }
+
+    // And "at spv.blockHeight". A header does not say what height it is at — that comes
+    // from wherever the caller obtained it — so a caller that knows passes it. It cannot be
+    // required without breaking every caller that holds only the 80 bytes.
+    if (opts.height !== undefined && opts.height !== spv.blockHeight) {
+      errors.push('the supplied header is not at the height the SPV envelope names')
+    }
+
     return { valid: errors.length === 0, errors: errors }
   } catch (e) {
     return { valid: false, errors: ['anchor verification error: ' + e.message] }
@@ -223,54 +244,57 @@ NotaryHash.verifyAnchorSPV = function (certificate, opts) {
  * NOT the Bitcoin tree in lib/spv — see lib/notaryhash/merkle.js for why the difference
  * matters and why reusing the other one would be silently wrong.
  *
- * ASSUMPTION, flagged rather than buried: the leaf data is the certificate's proofHash.
- * The spec says a batch "anchors many proofs" under one root and that the certificate's
- * merkle proof must fold to it, but does not state what a leaf contains. proofHash is the
- * only per-proof 32-byte value that identifies the proof, so it is the reading taken
- * here — and it needs confirming against the reference implementation before this is
- * relied on. See docs/BRC220_PLAN.md.
+ * The leaf data is the certificate's proofHash. The spec does not state what a leaf
+ * contains; the reference implementation uses proofHash, and a batch it built verifies
+ * here leaf for leaf — see test/notaryhash/reference_certs.js.
+ *
+ * The path is folded by the sides it carries, as the reference folds it. `leafIndex` is
+ * not used to re-derive them: the reference does not, and a verifier that refused
+ * certificates the reference accepts would not be a BRC-220 verifier.
  *
  * @param {Object} certificate
  * @returns {Object} { valid, errors }
  */
 NotaryHash.verifyBatchInclusion = function (certificate) {
   try {
-    if (!certificate || certificate.mode !== NotaryScript.MODE.BATCH) {
-      return { valid: false, errors: ['certificate is not in batch mode'] }
+    var c = Certificate.normalize(certificate)
+    if (!c || !c.anchor || c.anchor.type !== Certificate.ANCHOR_TYPE.BATCH) {
+      return { valid: false, errors: ['certificate is not batch-anchored (anchor.type is not "batch")'] }
     }
-    var m = certificate.merkle
-    if (!m) return { valid: false, errors: ['batch certificate has no merkle proof'] }
+    if (!c.merkle) return { valid: false, errors: ['batch certificate has no merkle proof'] }
+    return merkleFolds(c, 'merkle inclusion proof does not fold to the batch root')
+  } catch (e) {
+    return { valid: false, errors: ['batch inclusion error: ' + e.message] }
+  }
+}
+
+/**
+ * Does the certificate's merkle proof fold its proofHash to the root it states?
+ *
+ * The same question for a batch anchor and for a proof carried on a direct one; only
+ * what a failure means differs, so the caller supplies the message.
+ */
+function merkleFolds (c, failure) {
+  try {
+    var m = c.merkle
 
     // THE LEAF IS proofHash, NOT canonicalBytes.
     //
-    // BRC-220 §On-chain record says the batch tree is RFC 6962 and writes
-    // `leaf = SHA256(0x00 ‖ d)` — but that is RFC 6962's own generic notation for the
-    // construction, and the spec never binds `d` to a value. `canonicalBytes` appears
-    // once in the whole document, in the proofHash definition, and nowhere in the batch
-    // text.
-    //
-    // So this is a choice the implementation had to make, and it is:
-    //
-    //     leaf = SHA-256(0x00 ‖ proofHash) = SHA-256(0x00 ‖ SHA-256(canonicalBytes))
-    //
-    // The other reading — d = canonicalBytes — is equally sound cryptographically and
-    // produces a DIFFERENT root. A certificate built that way fails inclusion here with
-    // no error naming the cause: the fold simply does not reach the root. Anyone building
-    // batches with the exported NotaryHash.Merkle must use proofHash as the leaf datum.
-    //
-    // Reasoning and the proposed spec text: docs/BRC220_BATCH_LEAF_AMENDMENT.md.
-    // Enforced by test/notaryhash/batch_leaf.js, which checks that a canonicalBytes-leaf
-    // tree is rejected rather than trusting the comment.
-    var leafData = Buffer.from(certificate.proofHash, 'hex')
-    var path = (m.path || []).map(function (node) {
-      return Buffer.isBuffer(node) ? node : Buffer.from(node, 'hex')
-    })
-    var root = Buffer.isBuffer(m.root) ? m.root : Buffer.from(String(m.root), 'hex')
-
-    var included = Merkle.verifyInclusion(leafData, m.leafIndex, m.leafCount, path, root)
-    return included
+    // BRC-220 writes the batch tree as `leaf = SHA256(0x00 ‖ d)` without binding `d`, and
+    // the two readings — proofHash or canonicalBytes — are equally sound and produce
+    // different roots. proofHash is what the reference implementation's batcher uses
+    // (`leaves = batch.map(e => e.proofHash)`), and bsv-blockchain/BRCs#246 proposes
+    // stating it in the spec. test/notaryhash/batch_leaf.js checks that a
+    // canonicalBytes-leaf tree is rejected rather than trusting this comment.
+    var leafData = Certificate.decodeBytes(c.proofHash, 'hex', 'proofHash')
+    var root = Certificate.decodeBytes(m.root, 'hex', 'merkle.root')
+
+    // Folded by side, as the reference folds it. The sides are what the certificate
+    // carries; a legacy bare-hash path had them derived from leafIndex and leafCount when
+    // it was normalised.
+    return Merkle.verifyAuditPath(leafData, m.path, root)
       ? { valid: true, errors: [] }
-      : { valid: false, errors: ['merkle inclusion proof does not fold to the batch root'] }
+      : { valid: false, errors: [failure] }
   } catch (e) {
     return { valid: false, errors: ['batch inclusion error: ' + e.message] }
   }
@@ -288,9 +312,11 @@ NotaryHash.verifyBatchInclusion = function (certificate) {
  * @param {Object} certificate
  * @param {Object} [opts]
  * @param {String|Buffer} [opts.header] - an independently obtained block header
+ * @param {Number} [opts.height] - the height it was obtained at; see verifyAnchorSPV
  * @param {Boolean} [opts.skipAnchor] - check 1 and 2 only; the result is NOT a valid
  *   certificate, and `valid` will be false. For offline triage.
- * @returns {Object} { valid, signature, proofIntegrity, anchor, shape, errors }
+ * @returns {Object} { valid, signature, proofIntegrity, anchor, batchInclusion, shape,
+ *   legacy, errors } — `legacy` is true when the certificate was written by 8.3.0–9.8.0
  */
 NotaryHash.verify = function (certificate, opts) {
   opts = opts || {}
@@ -304,6 +330,11 @@ NotaryHash.verify = function (certificate, opts) {
     errors: []
   }
 
+  // Legacy certificates are translated once, here, and the translation is reported so a
+  // caller holding one knows to re-issue it in the current format.
+  report.legacy = Certificate.isLegacy(certificate)
+  certificate = Certificate.normalize(certificate)
+
   report.shape = Certificate.validateShape(certificate)
   if (report.shape.length) {
     report.errors = report.shape.slice()
@@ -328,9 +359,17 @@ NotaryHash.verify = function (certificate, opts) {
   // A batched certificate has a fourth thing to prove: that this proof is actually one
   // of the ones the on-chain root commits to. Without it, any certificate could point at
   // any batch anchor and the anchor check alone would not notice.
+  //
+  // A merkle proof is checked whenever one is present, not only on a batch anchor, as the
+  // reference checks it: a certificate whose path does not fold to its stated root fails
+  // even when nothing else relies on it. On a direct anchor that is the whole of it — the
+  // record is compared directly, so a proof that folds adds nothing and is accepted.
   report.batchInclusion = true
-  if (certificate.mode === NotaryScript.MODE.BATCH) {
-    var batch = NotaryHash.verifyBatchInclusion(certificate)
+  var batchAnchored = !!(certificate.anchor && certificate.anchor.type === Certificate.ANCHOR_TYPE.BATCH)
+  if (batchAnchored || certificate.merkle !== undefined) {
+    var batch = batchAnchored
+      ? NotaryHash.verifyBatchInclusion(certificate)
+      : merkleFolds(certificate, 'merkle proof does not fold to its stated root')
     report.batchInclusion = batch.valid
     batch.errors.forEach(function (e) { report.errors.push(e) })
   }

package/lib/notaryhash/merkle.js

@@ -214,4 +214,98 @@ Merkle.verifyInclusion = function (leafData, index, leafCount, path, expectedRoo
   }
 }
 
+/**
+ * Which side of the running hash each audit-path sibling sits on, leaf upward.
+ *
+ * Derived from the index and the tree size exactly as RFC 6962 derives the tree's shape,
+ * so it lines up entry for entry with Merkle.path(). Used to give the bare hashes that
+ * 8.3.0–9.8.0 wrote the sides the reference format carries.
+ *
+ * @param {Number} index
+ * @param {Number} leafCount
+ * @returns {Array<String>} 'left' | 'right' per sibling
+ */
+Merkle.pathSides = function (index, leafCount) {
+  $.checkArgument(Number.isInteger(leafCount) && leafCount > 0, 'leafCount must be a positive integer')
+  $.checkArgument(Number.isInteger(index) && index >= 0 && index < leafCount,
+    'index must be within the tree')
+  if (leafCount === 1) return []
+  var k = Merkle.largestPowerOfTwoBelow(leafCount)
+  return index < k
+    ? Merkle.pathSides(index, k).concat(['right'])
+    : Merkle.pathSides(index - k, leafCount - k).concat(['left'])
+}
+
+/**
+ * The audit path in the form BRC-220 certificates carry it: `{ hash, side }` per sibling,
+ * leaf upward, where `side` is the sibling's position relative to the running hash.
+ *
+ * This is the reference implementation's shape, and folding it needs no index or tree
+ * size — see rootFromPath(). Merkle.path() returns the same hashes without sides.
+ *
+ * @param {Array<Buffer>} leaves - leaf DATA (for BRC-220, each proof's proofHash)
+ * @param {Number} index
+ * @returns {Array<{hash: Buffer, side: String}>}
+ */
+Merkle.auditPath = function (leaves, index) {
+  var sides = Merkle.pathSides(index, leaves.length)
+  return Merkle.path(leaves, index).map(function (hash, i) {
+    return { hash: hash, side: sides[i] }
+  })
+}
+
+function nodeHash (value, i) {
+  var buf = Buffer.isBuffer(value) ? value : null
+  if (!buf) {
+    if (typeof value !== 'string') throw new Error('audit path node ' + i + ' has no hash')
+    var clean = value.slice(0, 2) === '0x' ? value.slice(2) : value
+    if (!/^[0-9a-fA-F]*$/.test(clean)) throw new Error('audit path node ' + i + ' is not hex')
+    buf = Buffer.from(clean, 'hex')
+  }
+  if (buf.length !== 32) throw new Error('audit path node ' + i + ' is not 32 bytes')
+  return buf
+}
+
+/**
+ * Fold a `{ hash, side }` audit path back to a root, as the reference implementation
+ * does: a 'left' sibling is hashed before the running value, a 'right' one after.
+ *
+ * @param {Buffer} leafData - the leaf DATA, hashed here
+ * @param {Array<{hash: Buffer|String, side: String}>} path
+ * @returns {Buffer} the computed root
+ */
+Merkle.rootFromPath = function (leafData, path) {
+  $.checkArgument(Buffer.isBuffer(leafData), 'leafData must be a Buffer')
+  $.checkArgument(Array.isArray(path), 'path must be an array')
+  var acc = Merkle.hashLeaf(leafData)
+  for (var i = 0; i < path.length; i++) {
+    var node = path[i]
+    if (!node || typeof node !== 'object') throw new Error('audit path node ' + i + ' is not an object')
+    var hash = nodeHash(node.hash, i)
+    if (node.side === 'left') acc = Merkle.hashNode(hash, acc)
+    else if (node.side === 'right') acc = Merkle.hashNode(acc, hash)
+    else throw new Error('audit path node ' + i + ' has side ' + JSON.stringify(node.side))
+  }
+  return acc
+}
+
+/**
+ * Does a `{ hash, side }` audit path fold this leaf to the expected root?
+ *
+ * Strict boolean, false on any malformed input rather than throwing.
+ *
+ * @param {Buffer} leafData
+ * @param {Array<{hash: Buffer|String, side: String}>} path
+ * @param {Buffer} expectedRoot
+ * @returns {Boolean}
+ */
+Merkle.verifyAuditPath = function (leafData, path, expectedRoot) {
+  try {
+    if (!Buffer.isBuffer(expectedRoot)) return false
+    return Merkle.rootFromPath(leafData, path).equals(expectedRoot)
+  } catch (e) {
+    return false
+  }
+}
+
 module.exports = Merkle

package/lib/notaryhash/script.js

@@ -35,6 +35,10 @@ NotaryScript.MODE = {
   BATCH: 2
 }
 
+// The certificate's spelling of the same modes, so a record can be built straight from a
+// certificate's `mode` field. The on-chain byte is the number either way.
+var MODE_BY_NAME = { full: NotaryScript.MODE.FULL, hybrid: NotaryScript.MODE.HYBRID, batch: NotaryScript.MODE.BATCH }
+
 function u8 (n) { return Buffer.from([n]) }
 
 function u32be (n) {
@@ -103,7 +107,10 @@ function readBuf (chunk, name) {
 NotaryScript.build = function (record) {
   $.checkArgument(record && typeof record === 'object', 'record is required')
 
-  var mode = record.mode
+  var mode = typeof record.mode === 'string' &&
+    Object.prototype.hasOwnProperty.call(MODE_BY_NAME, record.mode)
+    ? MODE_BY_NAME[record.mode]
+    : record.mode
   $.checkArgument(mode === NotaryScript.MODE.FULL ||
     mode === NotaryScript.MODE.HYBRID ||
     mode === NotaryScript.MODE.BATCH,

package/lib/notaryhash/suites.js

@@ -4,7 +4,6 @@ var BN = require('../crypto/bn')
 var ECDSA = require('../crypto/ecdsa')
 var Signature = require('../crypto/signature')
 var PublicKey = require('../publickey')
-var Point = require('../crypto/point')
 var $ = require('../util/preconditions')
 
 /**
@@ -105,14 +104,21 @@ Suites.verify = function (algorithm, payloadHash, signature, publicKey) {
  * schemes apply their own internal hashing"). There is no second hash, and no Bitcoin
  * sighash — this is a detached signature over a digest.
  *
- * Signatures are 64 raw bytes, `r || s`, each a 32-byte big-endian integer. DER is
- * accepted as a length-discriminated fallback for Bitcoin-native signers, because the
- * certificate's `encoding` field may say so; see docs/BRC220_ENCODING_AMENDMENT.md for
- * why raw is what new implementations should emit.
+ * What it accepts is what the reference implementation accepts, because a verifier that
+ * refuses certificates the reference issued is not a BRC-220 verifier:
  *
- * Low-S is REQUIRED. A high-S signature is rejected rather than normalised: normalising
- * changes the signature bytes, and those bytes are inside `proofHash`, so accepting both
- * forms would mean two valid certificates exist for one signing act.
+ *  - a signature of 64 bytes, `r || s`, each a 32-byte big-endian integer, OR DER,
+ *    told apart by the bytes themselves (DER opens with 0x30 and is not 64 bytes). The
+ *    certificate's `encoding` field says how the bytes are WRITTEN — hex or base64 — and
+ *    nothing about which of these they are;
+ *  - a 33-byte compressed or 65-byte uncompressed public key;
+ *  - a high-S signature.
+ *
+ * That last one reverses what 8.3.0–9.8.0 did, which was to reject high-S. The reference
+ * accepts it deliberately — "we attest to whatever valid signature the signer produced"
+ * — and the reasoning holds: proofHash covers the exact signature bytes, so the malleated
+ * form of a signature yields a DIFFERENT certificate, not a forgery of this one. Nothing
+ * that verifies under the low-S form stops verifying.
  */
 Suites.register('ECDSA-secp256k1', {
   verify: function (payloadHash, signature, publicKey) {
@@ -124,19 +130,16 @@ Suites.register('ECDSA-secp256k1', {
         BN.fromBuffer(signature.slice(0, 32)),
         BN.fromBuffer(signature.slice(32, 64))
       )
-    } else {
-      // DER, for the legacy `encoding: "der"` case.
+    } else if (signature[0] === 0x30) {
       try {
         sig = Signature.fromDER(signature)
       } catch (e) {
         return false
       }
+    } else {
+      return false
     }
 
-    // Low-S, enforced rather than normalised.
-    var halfOrder = Point.getN().div(new BN(2))
-    if (sig.s.gt(halfOrder)) return false
-
     var pubkey
     try {
       pubkey = PublicKey.fromBuffer(publicKey)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smartledger/bsv",
-  "version": "9.8.0",
+  "version": "9.10.0",
   "description": "Bitcoin SV library with an interpreter-verified script engine: OP_PUSH_TX covenants, BIP-143 preimage tooling, and consensus flags that match what miners actually enforce. Also ships DID:web / W3C VC-JWT credentials and the Legal Token Protocol.",
   "author": "SmartLedger Technology <hello@smartledger.technology> (https://smartledger.technology)",
   "homepage": "https://github.com/codenlighten/smartledger-bsv#readme",

package/tools/gen-brc220-batch-vector.js

@@ -69,7 +69,7 @@ function derive (label, i) {
   return Hash.sha256(Buffer.from('BRC-220/batch-vector/' + label + '/' + i, 'utf8'))
 }
 
-// Raw 64-byte r‖s, low-S, as `encoding: "raw"` requires. Not DER.
+// 64-byte r‖s, low-S — the form the reference implementation signs with. Not DER.
 function signRaw (payloadHash, privkey) {
   // set() rather than assigning fields directly: it derives `pubkey` from `privkey`,
   // which sign() requires. RFC 6979 makes this deterministic, so the vector reproduces.
@@ -137,7 +137,8 @@ for (var i = 0; i < LEAF_COUNT; i++) {
     payloadPreimage: 'BRC-220/batch-vector/payload/' + i,
     algorithm: ALGORITHM,
     hashAlgorithm: HASH_ALGORITHM,
-    encoding: 'raw',
+    // How publicKey and signature are written, as in a certificate. Not a byte format.
+    encoding: 'hex',
     payloadHash: payloadHash.toString('hex'),
     publicKey: publicKey.toString('hex'),
     signature: signature.toString('hex'),
@@ -156,7 +157,10 @@ var leaves = proofs.map(function (p) { return Buffer.from(p.proofHash, 'hex') })
 var root = Merkle.root(leaves)
 
 proofs.forEach(function (p, idx) {
-  p.path = Merkle.path(leaves, idx).map(function (n) { return n.toString('hex') })
+  // { hash, side } per sibling, leaf upward — the form certificates carry.
+  p.path = Merkle.auditPath(leaves, idx).map(function (n) {
+    return { hash: n.hash.toString('hex'), side: n.side }
+  })
 })
 
 var vector = {

package/version.js

@@ -1,3 +1,3 @@
 'use strict'
 // GENERATED by scripts/sync-version.js on `npm version` — do not edit.
-module.exports = '9.8.0'
+module.exports = '9.10.0'