@smartledger/bsv 9.9.0 → 9.10.0

package/docs/migration/FROM_BSV_1_5_6.md

@@ -159,17 +159,17 @@ const recovered = bsv.reconstructSecret([shares[0], shares[2], shares[4]]);
 ### **New Modular Options** 
 ```html
 <!-- Core compatibility (same size as bsv@1.5.6) -->
-<script src="https://unpkg.com/@smartledger/bsv@9.9.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.10.0/bsv.min.js"></script>
 
 <!-- Add smart contracts when ready -->
-<script src="https://unpkg.com/@smartledger/bsv@9.9.0/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.10.0/bsv-smartcontract.min.js"></script>
 
 <!-- Add advanced features as needed -->
-<script src="https://unpkg.com/@smartledger/bsv@9.9.0/bsv-ltp.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@9.9.0/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.10.0/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.10.0/bsv-gdaf.min.js"></script>
 
 <!-- Everything in one file -->
-<script src="https://unpkg.com/@smartledger/bsv@9.9.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@9.10.0/bsv.bundle.js"></script>
 ```
 
 ## 🔍 **Testing Your Migration**

package/lib/notaryhash/certificate.js

@@ -101,11 +101,11 @@ var LEGACY_VERSION = 1
 var LEGACY_MODE = { 0: 'full', 1: 'hybrid', 2: 'full' }
 
 var HEX_RE = /^[0-9a-fA-F]*$/
-// The reference decodes base64 with Buffer.from(value, 'base64'), which also takes the
-// URL-safe alphabet and missing padding. Those are accepted here too, so nothing the
-// reference reads is refused. What is NOT accepted is any other character: Buffer.from
-// skips those silently, turning a corrupted field into different bytes instead of an
-// error.
+// Both RFC 4648 alphabets (§4 standard, §5 URL-safe) and missing padding are accepted, as
+// the reference accepts them. What is NOT accepted is anything that is not base64: a
+// character outside the alphabet, padding out of place, or a length no byte string
+// encodes. Buffer.from skips the first and truncates the last, turning a corrupted field
+// into different bytes instead of an error.
 var BASE64_RE = /^[A-Za-z0-9+/_-]*={0,2}$/
 
 /**
@@ -131,6 +131,10 @@ Certificate.decodeBytes = function (value, encoding, name) {
   }
   if (encoding === Certificate.ENCODING.BASE64) {
     if (!BASE64_RE.test(value)) throw new Error(name + ' must be base64')
+    var body = value.replace(/=+$/, '')
+    if ((body.length !== value.length && value.length % 4 !== 0) || body.length % 4 === 1) {
+      throw new Error(name + ' is not a valid base64 length')
+    }
     return Buffer.from(value, 'base64')
   }
   throw new Error('encoding must be "hex" or "base64", not ' + JSON.stringify(encoding))

package/lib/notaryhash/index.js

@@ -165,6 +165,8 @@ NotaryHash.recordMatchesCertificate = function (record, certificate) {
  * @param {Object} certificate - must carry an `spv` envelope
  * @param {Object} opts
  * @param {String|Buffer|BlockHeader} opts.header - independently obtained
+ * @param {Number} [opts.height] - the height the header was obtained at. A header's 80
+ *   bytes do not carry it, so it is checked against spv.blockHeight only when supplied.
  * @param {Boolean} [opts.requirePow=true] - pass false only for test fixtures
  * @returns {Object} { valid, errors }
  */
@@ -221,6 +223,13 @@ NotaryHash.verifyAnchorSPV = function (certificate, opts) {
       errors.push('the supplied header is not the block the SPV envelope names')
     }
 
+    // And "at spv.blockHeight". A header does not say what height it is at — that comes
+    // from wherever the caller obtained it — so a caller that knows passes it. It cannot be
+    // required without breaking every caller that holds only the 80 bytes.
+    if (opts.height !== undefined && opts.height !== spv.blockHeight) {
+      errors.push('the supplied header is not at the height the SPV envelope names')
+    }
+
     return { valid: errors.length === 0, errors: errors }
   } catch (e) {
     return { valid: false, errors: ['anchor verification error: ' + e.message] }
@@ -303,6 +312,7 @@ function merkleFolds (c, failure) {
  * @param {Object} certificate
  * @param {Object} [opts]
  * @param {String|Buffer} [opts.header] - an independently obtained block header
+ * @param {Number} [opts.height] - the height it was obtained at; see verifyAnchorSPV
  * @param {Boolean} [opts.skipAnchor] - check 1 and 2 only; the result is NOT a valid
  *   certificate, and `valid` will be false. For offline triage.
  * @returns {Object} { valid, signature, proofIntegrity, anchor, batchInclusion, shape,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smartledger/bsv",
-  "version": "9.9.0",
+  "version": "9.10.0",
   "description": "Bitcoin SV library with an interpreter-verified script engine: OP_PUSH_TX covenants, BIP-143 preimage tooling, and consensus flags that match what miners actually enforce. Also ships DID:web / W3C VC-JWT credentials and the Legal Token Protocol.",
   "author": "SmartLedger Technology <hello@smartledger.technology> (https://smartledger.technology)",
   "homepage": "https://github.com/codenlighten/smartledger-bsv#readme",

package/version.js

@@ -1,3 +1,3 @@
 'use strict'
 // GENERATED by scripts/sync-version.js on `npm version` — do not edit.
-module.exports = '9.9.0'
+module.exports = '9.10.0'