smartledger-bsv 3.4.5 → 4.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (25) hide show
  1. package/CHANGELOG.md +184 -0
  2. package/README.md +40 -40
  3. package/SECURITY.md +6 -3
  4. package/bsv-covenant.min.js +7 -7
  5. package/bsv-ecies.min.js +1 -1
  6. package/bsv-gdaf.min.js +8 -8
  7. package/bsv-ltp.min.js +8 -8
  8. package/bsv-smartcontract.min.js +8 -8
  9. package/bsv.bundle.js +8 -8
  10. package/bsv.min.js +7 -7
  11. package/docs/COVENANT_DEVELOPMENT_RESOLVED.md +2 -2
  12. package/docs/MODULE_REFERENCE_COMPLETE.md +27 -27
  13. package/docs/advanced/UTXO_MANAGER_GUIDE.md +1 -1
  14. package/docs/getting-started/INSTALLATION.md +25 -25
  15. package/docs/getting-started/QUICK_START.md +7 -7
  16. package/docs/migration/FROM_BSV_1_5_6.md +5 -5
  17. package/index.js +29 -1
  18. package/lib/crypto/ecdsa.js +10 -27
  19. package/lib/ecies/electrum-ecies.js +12 -1
  20. package/lib/gdaf/attestation-signer.js +37 -2
  21. package/lib/gdaf/attestation-verifier.js +48 -10
  22. package/lib/smart_contract/utxo_generator.js +9 -4
  23. package/lib/smartutxo.js +44 -17
  24. package/package.json +1 -4
  25. package/utilities/wallet.json +0 -30
package/CHANGELOG.md CHANGED
@@ -5,6 +5,190 @@ All notable changes to SmartLedger-BSV will be documented in this file.
5
5
  The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
6
6
  and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
7
7
 
8
+ ## [4.0.1] - 2026-05-31
9
+
10
+ ### Deprecated
11
+
12
+ - **`bsv.SmartUTXO` is now soft-deprecated and will be removed in v5.0.0.**
13
+ `lib/smartutxo.js` is a development-only file-backed UTXO simulator —
14
+ it writes to `<package-root>/utilities/blockchain-state.json` (a path
15
+ inside `node_modules`), has no concurrency controls, ships with an
16
+ empty seed (the 3.3 MB dev fixture is `.npmignore`d), and was exposed
17
+ on the main `bsv.*` namespace where it looked like a production UTXO
18
+ manager. That conflation is the same class of footgun as the v4.0.0
19
+ `wallet.json` leak — dev fixtures don't belong on the production
20
+ surface.
21
+
22
+ The symbol is preserved (no semver break) but access now logs a
23
+ one-shot deprecation warning. Set `BSV_HIDE_DEPRECATIONS=1` to
24
+ silence. The supported import path is unchanged for users who
25
+ legitimately need the simulator:
26
+
27
+ ```js
28
+ const SmartUTXO = require('@smartledger/bsv/lib/smartutxo')
29
+ ```
30
+
31
+ All internal callers (`lib/smart_contract/utxo_generator.js`) and
32
+ in-repo demos/examples were migrated to the direct require so they
33
+ don't trigger the warning. `bsv.SmartMiner` and `bsv.CustomScriptHelper`
34
+ are unchanged in this release.
35
+
36
+ ### Fixed
37
+
38
+ - **`SmartUTXOManager.createMockUTXOs(address, ...)` produces correct
39
+ mocks.** Two bugs in one method:
40
+ 1. The P2PKH script encoded a *random* 20-byte hash rather than the
41
+ hash of the provided `address`, so the mock claimed to belong to
42
+ `address` but its locking script committed to a different address.
43
+ Anyone who attempted to sign these mocks with the private key for
44
+ `address` got a signature that wouldn't verify.
45
+ 2. It called Node's `crypto.randomBytes(...)` unconditionally, which
46
+ throws in browser bundles where `crypto` is undefined.
47
+
48
+ Both fixed: the script now derives from
49
+ `bsv.Script.buildPublicKeyHashOut(bsv.Address.fromString(address))`,
50
+ and randomness uses `bsv.crypto.Random.getRandomBuffer(32)` which
51
+ works in both Node and browser builds.
52
+
53
+ ### Documentation
54
+
55
+ - Added a clear "DEVELOPMENT ONLY" header block to `lib/smartutxo.js`
56
+ spelling out the supported import path, the deprecation status, and
57
+ why it shouldn't be used in production.
58
+ - Bumped CDN/install refs from `@4.0.0` to `@4.0.1` across README +
59
+ 6 docs files. SECURITY.md is unchanged (4.x is still the only
60
+ supported line, 3.4.x still flagged as vulnerable).
61
+
62
+ ### Semver note
63
+
64
+ This release deliberately stops short of a hard removal. Removing
65
+ `bsv.SmartUTXO` outright would be a major-version break, and v4.0.0
66
+ shipped less than 24 hours ago — bumping to v5.0.0 now would churn
67
+ consumers who are still digesting the v4.0.0 credential-verification
68
+ changes. The hard removal is queued for v5.0.0.
69
+
70
+ ## [4.0.0] - 2026-05-31
71
+
72
+ ### Security
73
+
74
+ This release fixes three critical vulnerabilities in the GDAF Verifiable
75
+ Credential signing/verification path. **Any credential signed by a version
76
+ prior to 4.0.0 should be considered unprotected and re-issued, and any
77
+ verification result produced by a prior version should be considered
78
+ untrustworthy.** See the Breaking Changes note below.
79
+
80
+ - **Credential signatures now cover the entire credential body, including
81
+ nested claims (e.g. `credentialSubject`).** `AttestationSigner._canonicalizeJSON`
82
+ previously called `JSON.stringify(obj, Object.keys(obj).sort())`. The second
83
+ argument is the JSON.stringify *replacer array*, which whitelists keys at
84
+ **every** nesting level to the top-level key set; every nested object
85
+ therefore serialized to `{}` and was excluded from the signed hash. An
86
+ attacker could rewrite the subject's identity and claims without
87
+ invalidating the proof. Canonicalization is now a recursive, depth-complete
88
+ key sort (`AttestationSigner._sortValue`).
89
+
90
+ - **The signature is now actually checked during verification.**
91
+ `AttestationVerifier._verifySignature` and `_verifyPresentationSignature`
92
+ assigned `var valid = ecdsa.verify()`. `ECDSA.prototype.verify()` returns the
93
+ ECDSA *instance* (always truthy), not a boolean, so the `if (valid)` branch
94
+ always passed — credentials and presentations were accepted regardless of
95
+ whether the signature was valid, or present at all. Both sites now read
96
+ `ecdsa.verify().verified`.
97
+
98
+ - **The signing key is now bound to the claimed issuer (issuer-spoofing fix).**
99
+ `_verifySignature` resolved the public key from the attacker-controlled
100
+ `proof.verificationMethod` and never compared it to `credential.issuer`. A
101
+ valid signature from any DID was accepted while the credential named a
102
+ different (e.g. trusted) authority as issuer. Verification now requires the
103
+ DID owning `proof.verificationMethod` to equal the credential issuer
104
+ (`AttestationVerifier._normalizeDID`, supporting both string and `{ id }`
105
+ issuer forms).
106
+
107
+ - **Removed a live private key from the published package.**
108
+ `utilities/wallet.json` shipped a valid mainnet WIF
109
+ (`KwbaQqFU…`, address `15XJXD7CSMqHL2ivFCu8PZTACQQ8MPbWY9`). The file has
110
+ been deleted and removed from the `files` allow-list. The dev utilities that
111
+ used it (`utilities/wallet-setup.js`, `utxo-manager.js`, `blockchain-state.js`)
112
+ already generate/import a local `wallet.json` at runtime and tolerate its
113
+ absence. **The published key must be considered compromised — do not reuse
114
+ it or send funds to that address.**
115
+
116
+ - **`trustedIssuers` is now enforced instead of advisory.** When a
117
+ `trustedIssuers` allow-list is passed to `verifyCredential`, an issuer outside
118
+ the list is now a hard verification failure (previously only a warning, so the
119
+ list had no effect). Comparison is done on normalized DIDs.
120
+
121
+ Regression coverage added in `test/gdaf/canonicalize.js` (8 tests): nested-key
122
+ coverage, key-order independence, array-order significance, tamper-detection at
123
+ the hash level, an untampered sign/verify round-trip, rejection of an
124
+ issuer-spoofed credential, enforcement of the `trustedIssuers` allow-list, and
125
+ rejection of a post-signing nested-claim tamper.
126
+
127
+ ### Changed
128
+
129
+ - **Constant-time MAC comparison in Electrum/BIE1 ECIES** (`lib/ecies/electrum-ecies.js`).
130
+ The decrypt path compared the authentication tag with `Buffer.equals()`, which
131
+ short-circuits on the first differing byte and can leak how many leading bytes
132
+ matched. Replaced with an unconditional byte-wise compare (matching the
133
+ existing loop in `bitcore-ecies.js`). Behaviour is unchanged for valid and
134
+ invalid tags.
135
+ - **Simplified ECDSA signature verification** (`lib/crypto/ecdsa.js#sigError`).
136
+ Removed a redundant s-canonicalization step and an unreachable
137
+ "backwards-compatibility" retry branch (because `(r, s)` and `(r, n - s)`
138
+ always verify identically, the retry could never succeed where the primary
139
+ check failed). Out-of-range rejection of `r`/`s` is retained. Accept/reject
140
+ results are byte-for-byte identical to 3.4.5; low-S is still enforced at
141
+ signing time via `ECDSA.toLowS`.
142
+
143
+ ### Removed
144
+
145
+ - Dropped the inaccurate `vulnerability-free` and `security-hardened` npm
146
+ keywords. `bsv.isHardened` and `bsv.securityFeatures` remain but only describe
147
+ opt-in helpers, as documented in `index.js` and the README Security section.
148
+
149
+ ### Tests / Tooling
150
+
151
+ - **The test runner now executes the whole suite.** mocha 8 dropped support for
152
+ `test/mocha.opts`, so its `--recursive` flag was silently ignored and
153
+ `npm test` only ran the 10 top-level `test/*.js` files (534 tests) — the ~40
154
+ files under `test/crypto`, `test/script`, `test/transaction`, `test/gdaf`,
155
+ etc. never ran in CI. Added `.mocharc.json` (`recursive`, `spec:
156
+ test/**/*.js`) and removed the defunct `test/mocha.opts`. `npm test` now runs
157
+ the full suite (4172 passing, 0 failing), including the new GDAF security
158
+ tests.
159
+ - **Repaired `test/crypto/security.js`.** It was 0 passing / 8 failing in 3.4.5
160
+ (missing `require('chai').should()`, plus calls to a non-existent
161
+ `SmartVerify.verifySignature`, `Signature.validate()` used as if it returned a
162
+ boolean rather than throwing, and an invalid TXID fixture). Rewritten against
163
+ the real API (`SmartVerify.smartVerify`, `Signature#validate/isCanonical/
164
+ toCanonical`); now 12 passing.
165
+ - **Fixed the 18 pre-existing failures that recursion surfaced** (all failed on
166
+ a pristine 3.4.5 checkout; the full suite is now green at 4172 passing):
167
+ - 3 in `test/crypto/ecdsa.js` — `ECDSA#sigError` did not reject negative
168
+ `r`/`s`. Tightened the range check to `[1, n-1]` (`lte(0)` now covers
169
+ negative and zero); negative-value DER vectors are correctly rejected as
170
+ 'r and s not in range'. (Real correctness fix, in `lib/crypto/ecdsa.js`.)
171
+ - 14 in `test/script/interpreter.js` — stale upstream Bitcoin Core vectors
172
+ asserting `DISABLED_OPCODE` for CAT/SPLIT/NUM2BIN/BIN2NUM/AND/OR/XOR/DIV/MOD
173
+ (re-enabled in BSV at Genesis) and `BAD_OPCODE` for `0xba` (which is OP_NOP8
174
+ in this build). The vendored `script_tests.json` is left untouched; a
175
+ documented `BSV_DIVERGENCES` override in the harness records each divergence
176
+ and asserts the correct BSV result.
177
+ - 1 in `test/script/script.js` — expected byte `0xba` to disassemble as raw
178
+ hex, but `0xba` is `OP_NOP8` in this build's opcode table; updated to the
179
+ correct disassembly with an explanatory comment.
180
+
181
+ ### Breaking Changes
182
+
183
+ - The bytes that get signed have changed (nested claims are now included), so
184
+ credentials and presentations signed by **≤ 3.4.5 will no longer verify**
185
+ under 4.0.0. This is intentional: the previous signatures did not protect
186
+ those bytes. Re-issue affected credentials with 4.0.0.
187
+ - Verification is now strict: callers relying on the previous (broken)
188
+ behaviour where verification effectively always succeeded will see
189
+ legitimate failures for unsigned, mis-signed, or issuer-mismatched
190
+ credentials.
191
+
8
192
  ## [3.4.5] - 2026-05-29
9
193
 
10
194
  ### Fixed
package/README.md CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  **🚀 Complete Bitcoin SV Development Framework with W3C Verifiable Credentials, DID:web, Legal Compliance, and 16 Flexible Loading Options**
4
4
 
5
- [![Version](https://img.shields.io/badge/version-3.4.5-blue.svg)](https://www.npmjs.com/package/@smartledger/bsv)
5
+ [![Version](https://img.shields.io/badge/version-4.0.1-blue.svg)](https://www.npmjs.com/package/@smartledger/bsv)
6
6
  [![License](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
7
7
  [![BSV](https://img.shields.io/badge/BSV-Compatible-orange.svg)](https://bitcoinsv.com/)
8
8
  [![Modular](https://img.shields.io/badge/Loading-Modular-purple.svg)](#loading-options)
@@ -25,8 +25,8 @@ The most comprehensive and flexible Bitcoin SV library available. **In v3.4.x**:
25
25
  ### **Quick Start - Issue Your First Verifiable Credential**
26
26
 
27
27
  ```bash
28
- # Install SmartLedger BSV v3.4.5
29
- npm install @smartledger/bsv@3.4.5
28
+ # Install SmartLedger BSV v4.0.1
29
+ npm install @smartledger/bsv@4.0.1
30
30
 
31
31
  # Initialize DID:web issuer (generates ES256 keys)
32
32
  npx smartledger-bsv didweb init --domain example.com --alg ES256
@@ -135,42 +135,42 @@ console.log('Status:', status) // 'revoked'
135
135
  ### **Core Modules**
136
136
  | Module | Size | Use Case | CDN |
137
137
  |--------|------|----------|-----|
138
- | **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@3.4.5/bsv.min.js` |
139
- | **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@3.4.5/bsv.bundle.js` |
138
+ | **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@4.0.1/bsv.min.js` |
139
+ | **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@4.0.1/bsv.bundle.js` |
140
140
 
141
141
  ### **🆕 W3C Verifiable Credentials (v3.4.x)**
142
142
  | Module | Size | Use Case | CDN |
143
143
  |--------|------|----------|-----|
144
- | **🟢 bsv-didweb.min.js** | 419KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@3.4.5/bsv-didweb.min.js` |
145
- | **🟢 bsv-vcjwt.min.js** | 419KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@3.4.5/bsv-vcjwt.min.js` |
146
- | **🟢 bsv-statuslist.min.js** | 487KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@3.4.5/bsv-statuslist.min.js` |
147
- | **🟢 bsv-anchor.min.js** | 418KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@3.4.5/bsv-anchor.min.js` |
144
+ | **🟢 bsv-didweb.min.js** | 419KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@4.0.1/bsv-didweb.min.js` |
145
+ | **🟢 bsv-vcjwt.min.js** | 419KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@4.0.1/bsv-vcjwt.min.js` |
146
+ | **🟢 bsv-statuslist.min.js** | 487KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@4.0.1/bsv-statuslist.min.js` |
147
+ | **🟢 bsv-anchor.min.js** | 418KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@4.0.1/bsv-anchor.min.js` |
148
148
 
149
149
  ### **Smart Contract & Development**
150
150
  | Module | Size | Use Case | CDN |
151
151
  |--------|------|----------|-----|
152
- | **bsv-smartcontract.min.js** | 937KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@3.4.5/bsv-smartcontract.min.js` |
153
- | **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@3.4.5/bsv-covenant.min.js` |
154
- | **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@3.4.5/bsv-script-helper.min.js` |
155
- | **bsv-security.min.js** | 26KB | Security enhancements | `unpkg.com/@smartledger/bsv@3.4.5/bsv-security.min.js` |
152
+ | **bsv-smartcontract.min.js** | 937KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@4.0.1/bsv-smartcontract.min.js` |
153
+ | **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@4.0.1/bsv-covenant.min.js` |
154
+ | **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@4.0.1/bsv-script-helper.min.js` |
155
+ | **bsv-security.min.js** | 26KB | Security enhancements | `unpkg.com/@smartledger/bsv@4.0.1/bsv-security.min.js` |
156
156
 
157
157
  ### **Legal & Compliance**
158
158
  | Module | Size | Use Case | CDN |
159
159
  |--------|------|----------|-----|
160
- | **bsv-ltp.min.js** | 1184KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@3.4.5/bsv-ltp.min.js` |
161
- | **bsv-gdaf.min.js** | 1184KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@3.4.5/bsv-gdaf.min.js` |
160
+ | **bsv-ltp.min.js** | 1184KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@4.0.1/bsv-ltp.min.js` |
161
+ | **bsv-gdaf.min.js** | 1184KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@4.0.1/bsv-gdaf.min.js` |
162
162
 
163
163
  ### **Advanced Cryptography**
164
164
  | Module | Size | Use Case | CDN |
165
165
  |--------|------|----------|-----|
166
- | **bsv-shamir.min.js** | 432KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@3.4.5/bsv-shamir.min.js` |
166
+ | **bsv-shamir.min.js** | 432KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@4.0.1/bsv-shamir.min.js` |
167
167
 
168
168
  ### **Utilities**
169
169
  | Module | Size | Use Case | CDN |
170
170
  |--------|------|----------|-----|
171
- | **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@3.4.5/bsv-ecies.min.js` |
172
- | **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@3.4.5/bsv-message.min.js` |
173
- | **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@3.4.5/bsv-mnemonic.min.js` |
171
+ | **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@4.0.1/bsv-ecies.min.js` |
172
+ | **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@4.0.1/bsv-message.min.js` |
173
+ | **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@4.0.1/bsv-mnemonic.min.js` |
174
174
 
175
175
  ## ⚡ **2-Minute Quick Start**
176
176
 
@@ -181,7 +181,7 @@ Get started with Bitcoin SV development in under 2 minutes:
181
181
  npm install @smartledger/bsv
182
182
 
183
183
  # Or include in HTML
184
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv.min.js"></script>
184
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.1/bsv.min.js"></script>
185
185
  ```
186
186
 
187
187
  > **🔧 v3.4.x:** Legally-recognizable W3C Verifiable Credentials with DID:web + VC-JWT toolkit. ES256/ES256K support, StatusList2021 revocation, and privacy-preserving BSV anchoring. Complete CLI tooling included! v3.4.1 ensures these bundles ship to npm consumers; see CHANGELOG.
@@ -276,8 +276,8 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
276
276
 
277
277
  ### 🔧 **Basic Development** (~963KB total)
278
278
  ```html
279
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv.min.js"></script>
280
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv-script-helper.min.js"></script>
279
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.1/bsv.min.js"></script>
280
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.1/bsv-script-helper.min.js"></script>
281
281
  <script>
282
282
  const privateKey = new bsv.PrivateKey();
283
283
  const utxos = new bsv.SmartContract.UTXOGenerator().createRealUTXOs(2, 100000);
@@ -286,9 +286,9 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
286
286
 
287
287
  ### 🔒 **Smart Contract Development** (~2.7MB total — each bundle re-embeds core BSV)
288
288
  ```html
289
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv.min.js"></script>
290
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv-covenant.min.js"></script>
291
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv-smartcontract.min.js"></script>
289
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.1/bsv.min.js"></script>
290
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.1/bsv-covenant.min.js"></script>
291
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.1/bsv-smartcontract.min.js"></script>
292
292
  <script>
293
293
  const covenant = bsv.SmartContract.createCovenantBuilder()
294
294
  .extractField('amount').push(50000).greaterThanOrEqual().verify().build();
@@ -298,9 +298,9 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
298
298
 
299
299
  ### 🆕 **Legal & Identity Development** (~3.2MB total — each bundle re-embeds core BSV)
300
300
  ```html
301
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv.min.js"></script>
302
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv-ltp.min.js"></script>
303
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv-gdaf.min.js"></script>
301
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.1/bsv.min.js"></script>
302
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.1/bsv-ltp.min.js"></script>
303
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.1/bsv-gdaf.min.js"></script>
304
304
  <script>
305
305
  // Legal Token Protocol
306
306
  const propertyToken = bsv.createPropertyToken({
@@ -314,9 +314,9 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
314
314
 
315
315
  ### 🆕 **Security & Cryptography** (~1.4MB total)
316
316
  ```html
317
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv.min.js"></script>
318
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv-security.min.js"></script>
319
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv-shamir.min.js"></script>
317
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.1/bsv.min.js"></script>
318
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.1/bsv-security.min.js"></script>
319
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.1/bsv-shamir.min.js"></script>
320
320
  <script>
321
321
  // Threshold Cryptography
322
322
  const shares = bsv.splitSecret('my_secret_key', 5, 3); // 5 shares, 3 needed
@@ -328,7 +328,7 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
328
328
 
329
329
  ### 🎯 **Everything Bundle** (937KB)
330
330
  ```html
331
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv.bundle.js"></script>
331
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.1/bsv.bundle.js"></script>
332
332
  <script>
333
333
  // Everything available immediately
334
334
  const shares = bsv.splitSecret('secret', 5, 3); // Shamir Secret Sharing
@@ -408,8 +408,8 @@ const contractTx = covenant.createCovenantTransaction({
408
408
 
409
409
  #### 1. **Minimal Setup** - Core + Script Helper (~963KB)
410
410
  ```html
411
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv.min.js"></script>
412
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv-script-helper.min.js"></script>
411
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.1/bsv.min.js"></script>
412
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.1/bsv-script-helper.min.js"></script>
413
413
  <script>
414
414
  const tx = new bsv.Transaction();
415
415
  const sig = bsvScriptHelper.createSignature(tx, privateKey, 0, script, satoshis);
@@ -418,9 +418,9 @@ const contractTx = covenant.createCovenantTransaction({
418
418
 
419
419
  #### 2. **DeFi Development** - Core + Covenants + Debug (~2.7MB — each bundle re-embeds core BSV)
420
420
  ```html
421
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv.min.js"></script>
422
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv-covenant.min.js"></script>
423
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv-smartcontract.min.js"></script>
421
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.1/bsv.min.js"></script>
422
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.1/bsv-covenant.min.js"></script>
423
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.1/bsv-smartcontract.min.js"></script>
424
424
  <script>
425
425
  const covenant = new bsvCovenant.CovenantInterface();
426
426
  const debugInfo = SmartContract.interpretScript(script);
@@ -430,8 +430,8 @@ const contractTx = covenant.createCovenantTransaction({
430
430
 
431
431
  #### 3. **Security First** - Core + Enhanced Security (~963KB)
432
432
  ```html
433
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv.min.js"></script>
434
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv-security.min.js"></script>
433
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.1/bsv.min.js"></script>
434
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.1/bsv-security.min.js"></script>
435
435
  <script>
436
436
  const verified = bsvSecurity.SmartVerify.verify(signature, hash, publicKey);
437
437
  const enhanced = bsvSecurity.EllipticFixed.createSignature(privateKey, hash);
@@ -440,7 +440,7 @@ const contractTx = covenant.createCovenantTransaction({
440
440
 
441
441
  #### 4. **Everything Bundle** - One File Solution (937KB)
442
442
  ```html
443
- <script src="https://unpkg.com/@smartledger/bsv@3.4.5/bsv.bundle.js"></script>
443
+ <script src="https://unpkg.com/@smartledger/bsv@4.0.1/bsv.bundle.js"></script>
444
444
  <script>
445
445
  // Everything available under bsv namespace
446
446
  const keys = bsv.SmartLedgerBundle.generateKeys();
package/SECURITY.md CHANGED
@@ -4,12 +4,15 @@ Thank you for helping keep `@smartledger/bsv` and its users safe.
4
4
 
5
5
  ## Supported Versions
6
6
 
7
- Security fixes are applied to the latest minor release line. Earlier releases
8
- are not patched; please upgrade.
7
+ Security fixes are applied to the latest major release line. Earlier releases
8
+ are not patched; please upgrade. **Versions ≤ 3.4.5 contain three known,
9
+ exploitable vulnerabilities in the GDAF credential verification path (see
10
+ CHANGELOG `## [4.0.0]`); upgrade to 4.x is strongly recommended.**
9
11
 
10
12
  | Version | Supported |
11
13
  | ------- | ------------------ |
12
- | 3.4.x | :white_check_mark: |
14
+ | 4.x | :white_check_mark: |
15
+ | 3.4.x | :x: (contains known credential-verification vulnerabilities; upgrade to 4.x) |
13
16
  | < 3.4 | :x: |
14
17
 
15
18
  ## Reporting a Vulnerability