@smartledger/bsv 3.4.0 → 3.4.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (48) hide show
  1. package/CHANGELOG.md +64 -0
  2. package/README.md +60 -32
  3. package/bsv-anchor.min.js +12 -0
  4. package/bsv-covenant.min.js +8 -8
  5. package/bsv-didweb.min.js +12 -0
  6. package/bsv-gdaf.min.js +9 -9
  7. package/bsv-ltp.min.js +9 -9
  8. package/bsv-mnemonic.min.js +2 -2
  9. package/bsv-shamir.min.js +3 -3
  10. package/bsv-smartcontract.min.js +5 -5
  11. package/bsv-statuslist.min.js +18 -0
  12. package/bsv-vcjwt.min.js +12 -0
  13. package/bsv.bundle.js +9 -9
  14. package/bsv.min.js +5 -5
  15. package/build/webpack.anchor.config.js +9 -13
  16. package/build/webpack.didweb.config.js +10 -14
  17. package/build/webpack.statuslist.config.js +9 -14
  18. package/build/webpack.vcjwt.config.js +9 -13
  19. package/examples/legacy/README.md +11 -0
  20. package/index.js +24 -6
  21. package/lib/browser-utxo-manager-es5.js +11 -4
  22. package/lib/browser-utxo-manager.js +15 -8
  23. package/lib/ltp/claim.js +1 -0
  24. package/lib/ltp/obligation.js +1 -0
  25. package/lib/ltp/registry.js +2 -0
  26. package/lib/ltp/right.js +1 -0
  27. package/lib/transaction/transaction.js +1 -1
  28. package/lib/util/_.js +7 -1
  29. package/package.json +9 -11
  30. package/demos/gdaf_core_test.js +0 -131
  31. package/examples/scripts/custom_script_signature_test.js +0 -344
  32. package/tests/browser-compatibility/README.md +0 -35
  33. package/tests/browser-compatibility/test-cdn-vs-local.html +0 -186
  34. package/tests/browser-compatibility/test-pbkdf2.html +0 -51
  35. package/tests/bundle-completeness-test.html +0 -131
  36. package/tests/bundle-demo.html +0 -476
  37. package/tests/smartcontract-test.html +0 -239
  38. package/tests/standalone-modules-test.html +0 -260
  39. package/tests/test.html +0 -612
  40. package/tests/test_standalone_shamir.html +0 -83
  41. package/tests/unpkg-demo.html +0 -194
  42. package/utilities/blockchain-state.json +0 -118565
  43. /package/{lib/smart_contract/test_integration.js → examples/legacy/smart_contract_test_integration.js} +0 -0
  44. /package/{tests → examples/legacy}/test_builtin_verify.js +0 -0
  45. /package/{tests → examples/legacy}/test_debug_integration.js +0 -0
  46. /package/{tests → examples/legacy}/test_ecdsa_little.js +0 -0
  47. /package/{tests → examples/legacy}/test_shamir.js +0 -0
  48. /package/{tests → examples/legacy}/test_smartverify_der.js +0 -0
package/CHANGELOG.md CHANGED
@@ -5,6 +5,70 @@ All notable changes to SmartLedger-BSV will be documented in this file.
5
5
  The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
6
6
  and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
7
7
 
8
+ ## [3.4.2] - 2026-05-18
9
+
10
+ ### Changed (documentation honesty)
11
+
12
+ - **README Security section rewritten** to accurately describe what hardening ships and what is opt-in vs. on by default.
13
+ - `bsv.SmartVerify` and `bsv.EllipticFixed` are **opt-in helpers**; the default `transaction.verify()` / `signature.verify()` / `Message().verify()` paths do **not** route through them.
14
+ - `lib/crypto/ecdsa.js` (the default verify path) uses BSV's own pure-JS ECDSA and does not import the elliptic library at all.
15
+ - `elliptic@6.6.1` is the upstream-patched current release; SmartLedger does not patch elliptic's source. The patches in `lib/crypto/elliptic-fixed.js` add input validation on top of an already-patched elliptic.
16
+ - Added a usage example showing how to call `SmartVerify.smartVerify(...)` explicitly.
17
+ - **`index.js`**: added a doc comment above `bsv.isHardened` / `bsv.securityFeatures` clarifying these advertise that hardening helpers ship — not that they are wired into the default path. API surface unchanged.
18
+
19
+ ### Notes
20
+
21
+ - No code behavior changes. All `bsv.*` properties and methods continue to work exactly as before.
22
+ - A planned 3.5.0 will offer an opt-in flag to route the default verify path through `SmartVerify` so the protection is on by default for new users.
23
+
24
+ ## [3.4.1] - 2026-05-18
25
+
26
+ ### Fixed
27
+
28
+ - **Credential bundles now actually ship.** `bsv-didweb.min.js`, `bsv-vcjwt.min.js`, `bsv-statuslist.min.js`, and `bsv-anchor.min.js` were missing from the `files:` allowlist in 3.4.0, so they were never included in the published npm tarball even though the README advertised them.
29
+ - **`prepublishOnly` now builds every advertised bundle.** Previously it ran `npm run build`, which only produced 6 of the ~16 bundles. It now runs `npm run build-all`, so credential, covenant, ltp, gdaf, and other specialized bundles can't go out of sync with source at publish time.
30
+ - **CSPRNG-backed `Transaction.shuffleOutputs()`.** `lib/util/_.js` `_.shuffle` now draws entropy from `bsv.crypto.Random` (Node `crypto.randomBytes` / `window.crypto.getRandomValues`) instead of `Math.random`. Output ordering is a privacy primitive; a predictable PRNG defeated the purpose.
31
+ - **`Transaction._fromMultisigUtxo` returns a real error.** A reachable `throw new Error('@TODO')` for unsupported script types now throws `errors.Transaction.Input.UnsupportedScript` with the offending script in the message.
32
+ - **Module load failures surface in Node.** The `try/catch` blocks around optional modules (`DIDWeb`, `VcJwt`, `StatusList`, `Anchor`, `BrowserUTXOManager`) in `index.js` previously swallowed all errors. They now `console.warn` in Node and stay silent in the browser, so upgrade breakage is visible.
33
+
34
+ ### Changed
35
+
36
+ - **`tests/` no longer ships to npm consumers.** The directory of HTML demo pages and 5 orphan standalone scripts is removed from `package.json` `files:` and added to `.npmignore`.
37
+ - **`utilities/blockchain-state.json` (3.2MB) no longer ships.** Mock blockchain data added to `.npmignore`; not needed at install time.
38
+ - **Browser UTXO manager logs are gated.** `lib/browser-utxo-manager.js` and `lib/browser-utxo-manager-es5.js` info-level `console.log` calls now require `BSV_DEBUG=1` (Node) or `window.BSV_DEBUG = true` (browser). `console.warn`/`console.error` unchanged.
39
+ - **Orphan scripts moved out of `lib/` and `tests/`.** `lib/smart_contract/test_integration.js` (an integration script that called `process.exit`) plus 5 pre-mocha scripts from `tests/` moved to `examples/legacy/`.
40
+ - **`package-lock.json` is now committed.** Removed from `.gitignore` so `npm audit` and reproducible installs work.
41
+ - **Dead `files:` entries removed.** Seven file references in `package.json` `files:` pointed to files that don't exist; npm silently skipped them. Removed.
42
+
43
+ ### Notes
44
+
45
+ - No public API changes. All call sites continue to work.
46
+ - Dev-only vulnerabilities remain in `webpack 4` / `standard 12` / `mocha 8`; a toolchain upgrade is planned for 3.5.0 to address them without breaking downstream bundler integrations.
47
+
48
+ ## [3.4.0] - 2025-11-09
49
+
50
+ ### Added
51
+
52
+ - **DID:web module** (`bsv.DIDWeb`, `bsv-didweb.min.js`): W3C DID Core `did:web` method generation with both ES256 (NIST P-256) and ES256K (Bitcoin secp256k1) key types.
53
+ - **VC-JWT module** (`bsv.VcJwt`, `bsv-vcjwt.min.js`): W3C Verifiable Credentials issuance and verification as JWT (RFC 7515 / RFC 7519 compliant).
54
+ - **StatusList2021 module** (`bsv.StatusList`, `bsv-statuslist.min.js`): credential revocation supporting 100k credentials per list.
55
+ - **Anchor module** (`bsv.Anchor`, `bsv-anchor.min.js`): privacy-preserving SHA-256 hash-only anchoring helpers for BSV.
56
+ - **CLI tooling** (`bin/cli.js`): `didweb`, `vc`, `status`, `anchor` subcommands.
57
+ - Quickstart examples and updated module tables in the README.
58
+
59
+ ### Standards Compliance
60
+
61
+ - W3C Verifiable Credentials Data Model
62
+ - W3C DID Core (`did:web` method)
63
+ - RFC 7515 (JWS), RFC 7519 (JWT)
64
+ - StatusList2021 specification
65
+ - NIST P-256 and Bitcoin secp256k1 curves
66
+
67
+ ### Known Issues (fixed in 3.4.1)
68
+
69
+ - The four new credential bundles were not listed in `package.json` `files:`, so they did not ship to npm consumers despite being advertised in the README.
70
+ - `prepublishOnly` only built the core 6 bundles, not the credential set.
71
+
8
72
  ## [3.3.4] - 2025-10-31
9
73
 
10
74
  ### Fixed
package/README.md CHANGED
@@ -2,15 +2,17 @@
2
2
 
3
3
  **🚀 Complete Bitcoin SV Development Framework with W3C Verifiable Credentials, DID:web, Legal Compliance, and 16 Flexible Loading Options**
4
4
 
5
- [![Version](https://img.shields.io/badge/version-3.4.0-blue.svg)](https://www.npmjs.com/package/@smartledger/bsv)
5
+ [![Version](https://img.shields.io/badge/version-3.4.1-blue.svg)](https://www.npmjs.com/package/@smartledger/bsv)
6
6
  [![License](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
7
7
  [![BSV](https://img.shields.io/badge/BSV-Compatible-orange.svg)](https://bitcoinsv.com/)
8
8
  [![Modular](https://img.shields.io/badge/Loading-Modular-purple.svg)](#loading-options)
9
9
  [![W3C](https://img.shields.io/badge/W3C-Compliant-blueviolet.svg)](#verifiable-credentials)
10
10
 
11
- The most comprehensive and flexible Bitcoin SV library available. **NEW in v3.4.0**: Legally-recognizable DID:web + VC-JWT toolkit with ES256/ES256K support, StatusList2021 revocation, and BSV anchoring. Choose from 16 different distribution methods: standalone modules, complete bundle, or mix-and-match approach.
11
+ The most comprehensive and flexible Bitcoin SV library available. **In v3.4.x**: Legally-recognizable DID:web + VC-JWT toolkit with ES256/ES256K support, StatusList2021 revocation, and BSV anchoring. Choose from 16 different distribution methods: standalone modules, complete bundle, or mix-and-match approach.
12
12
 
13
- ## 🆕 **v3.4.0 - Legally-Recognizable Credentials**
13
+ > **v3.4.1 (bugfix)**: credential bundles now actually ship to npm consumers, `prepublishOnly` builds the full set, and `Transaction.shuffleOutputs()` uses a CSPRNG. See [CHANGELOG](./CHANGELOG.md#341---2026-05-18).
14
+
15
+ ## 🆕 **v3.4.x - Legally-Recognizable Credentials**
14
16
 
15
17
  ### **Why This Matters**
16
18
  - ✅ **W3C Standards**: Full VC-JWT and DID:web compliance for legal recognition
@@ -23,8 +25,8 @@ The most comprehensive and flexible Bitcoin SV library available. **NEW in v3.4.
23
25
  ### **Quick Start - Issue Your First Verifiable Credential**
24
26
 
25
27
  ```bash
26
- # Install SmartLedger BSV v3.4.0
27
- npm install @smartledger/bsv@3.4.0
28
+ # Install SmartLedger BSV v3.4.1
29
+ npm install @smartledger/bsv@3.4.1
28
30
 
29
31
  # Initialize DID:web issuer (generates ES256 keys)
30
32
  npx smartledger-bsv didweb init --domain example.com --alg ES256
@@ -133,42 +135,42 @@ console.log('Status:', status) // 'revoked'
133
135
  ### **Core Modules**
134
136
  | Module | Size | Use Case | CDN |
135
137
  |--------|------|----------|-----|
136
- | **bsv.min.js** | 449KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@3.4.0/bsv.min.js` |
137
- | **bsv.bundle.js** | 885KB | Everything in one file | `unpkg.com/@smartledger/bsv@3.4.0/bsv.bundle.js` |
138
+ | **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@3.4.1/bsv.min.js` |
139
+ | **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@3.4.1/bsv.bundle.js` |
138
140
 
139
- ### **🆕 W3C Verifiable Credentials (v3.4.0)**
141
+ ### **🆕 W3C Verifiable Credentials (v3.4.x)**
140
142
  | Module | Size | Use Case | CDN |
141
143
  |--------|------|----------|-----|
142
- | **🟢 bsv-didweb.min.js** | 418KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@3.4.0/bsv-didweb.min.js` |
143
- | **🟢 bsv-vcjwt.min.js** | 418KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@3.4.0/bsv-vcjwt.min.js` |
144
- | **🟢 bsv-statuslist.min.js** | 486KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@3.4.0/bsv-statuslist.min.js` |
145
- | **🟢 bsv-anchor.min.js** | 417KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@3.4.0/bsv-anchor.min.js` |
144
+ | **🟢 bsv-didweb.min.js** | 419KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@3.4.1/bsv-didweb.min.js` |
145
+ | **🟢 bsv-vcjwt.min.js** | 419KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@3.4.1/bsv-vcjwt.min.js` |
146
+ | **🟢 bsv-statuslist.min.js** | 487KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@3.4.1/bsv-statuslist.min.js` |
147
+ | **🟢 bsv-anchor.min.js** | 418KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@3.4.1/bsv-anchor.min.js` |
146
148
 
147
149
  ### **Smart Contract & Development**
148
150
  | Module | Size | Use Case | CDN |
149
151
  |--------|------|----------|-----|
150
- | **bsv-smartcontract.min.js** | 451KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@3.4.0/bsv-smartcontract.min.js` |
151
- | **bsv-covenant.min.js** | 32KB | Covenant operations | `unpkg.com/@smartledger/bsv@3.4.0/bsv-covenant.min.js` |
152
- | **bsv-script-helper.min.js** | 27KB | Custom script tools | `unpkg.com/@smartledger/bsv@3.4.0/bsv-script-helper.min.js` |
153
- | **bsv-security.min.js** | 290KB | Security enhancements | `unpkg.com/@smartledger/bsv@3.4.0/bsv-security.min.js` |
152
+ | **bsv-smartcontract.min.js** | 937KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@3.4.1/bsv-smartcontract.min.js` |
153
+ | **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@3.4.1/bsv-covenant.min.js` |
154
+ | **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@3.4.1/bsv-script-helper.min.js` |
155
+ | **bsv-security.min.js** | 26KB | Security enhancements | `unpkg.com/@smartledger/bsv@3.4.1/bsv-security.min.js` |
154
156
 
155
157
  ### **Legal & Compliance**
156
158
  | Module | Size | Use Case | CDN |
157
159
  |--------|------|----------|-----|
158
- | **bsv-ltp.min.js** | 817KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@3.4.0/bsv-ltp.min.js` |
159
- | **bsv-gdaf.min.js** | 604KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@3.4.0/bsv-gdaf.min.js` |
160
+ | **bsv-ltp.min.js** | 1184KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@3.4.1/bsv-ltp.min.js` |
161
+ | **bsv-gdaf.min.js** | 1184KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@3.4.1/bsv-gdaf.min.js` |
160
162
 
161
163
  ### **Advanced Cryptography**
162
164
  | Module | Size | Use Case | CDN |
163
165
  |--------|------|----------|-----|
164
- | **bsv-shamir.min.js** | 433KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@3.4.0/bsv-shamir.min.js` |
166
+ | **bsv-shamir.min.js** | 432KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@3.4.1/bsv-shamir.min.js` |
165
167
 
166
168
  ### **Utilities**
167
169
  | Module | Size | Use Case | CDN |
168
170
  |--------|------|----------|-----|
169
- | **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@3.4.0/bsv-ecies.min.js` |
170
- | **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@3.4.0/bsv-message.min.js` |
171
- | **bsv-mnemonic.min.js** | 670KB | HD wallets | `unpkg.com/@smartledger/bsv@3.4.0/bsv-mnemonic.min.js` |
171
+ | **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@3.4.1/bsv-ecies.min.js` |
172
+ | **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@3.4.1/bsv-message.min.js` |
173
+ | **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@3.4.1/bsv-mnemonic.min.js` |
172
174
 
173
175
  ## ⚡ **2-Minute Quick Start**
174
176
 
@@ -179,10 +181,10 @@ Get started with Bitcoin SV development in under 2 minutes:
179
181
  npm install @smartledger/bsv
180
182
 
181
183
  # Or include in HTML
182
- <script src="https://unpkg.com/@smartledger/bsv@3.4.0/bsv.min.js"></script>
184
+ <script src="https://unpkg.com/@smartledger/bsv@3.4.1/bsv.min.js"></script>
183
185
  ```
184
186
 
185
- > **🔧 v3.4.0 Update:** Added legally-recognizable W3C Verifiable Credentials with DID:web + VC-JWT toolkit. ES256/ES256K support, StatusList2021 revocation, and privacy-preserving BSV anchoring. Complete CLI tooling included!
187
+ > **🔧 v3.4.x:** Legally-recognizable W3C Verifiable Credentials with DID:web + VC-JWT toolkit. ES256/ES256K support, StatusList2021 revocation, and privacy-preserving BSV anchoring. Complete CLI tooling included! v3.4.1 ensures these bundles ship to npm consumers; see CHANGELOG.
186
188
 
187
189
  **Basic Transaction (30 seconds):**
188
190
  ```javascript
@@ -265,8 +267,8 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
265
267
  | **Debug Tools** | `SmartContract.examineStack()` | Analyze script | `SmartContract.examineStack(script)` |
266
268
  | | `interpretScript()` | Execute script | `SmartContract.interpretScript(script)` |
267
269
  | | `getScriptMetrics()` | Performance data | `SmartContract.getScriptMetrics(script)` |
268
- | **Security** | `SmartVerify.verify()` | Enhanced verification | `SmartVerify.verify(sig, hash, pubkey)` |
269
- | | `EllipticFixed.sign()` | Secure signing | `EllipticFixed.sign(hash, privateKey)` |
270
+ | **Security (opt-in)** | `SmartVerify.verify()` | Hardened verify with strict input validation — call explicitly; default `signature.verify()` does NOT route through this | `SmartVerify.verify(sig, hash, pubkey)` |
271
+ | | `EllipticFixed.sign()` | Canonicalized signing wrapper around elliptic | `EllipticFixed.sign(hash, privateKey)` |
270
272
 
271
273
  > 💡 **Tip:** All methods include comprehensive error handling and validation. See [documentation links](#documentation) for detailed guides.
272
274
 
@@ -346,7 +348,7 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
346
348
 
347
349
  ### 💼 **Core Library Excellence**
348
350
  - ✅ **Complete BSV API**: Full Bitcoin SV blockchain operations → [API Reference](#api-reference)
349
- - ✅ **Security Hardened**: SmartLedger elliptic curve fixes and enhanced validation → [Security Features](#security-features)
351
+ - ✅ **Opt-in security helpers**: `bsv.SmartVerify` and `bsv.EllipticFixed` add input validation and low-`s` canonicalization on top of standard verification — **not on the default verify path**, see [Security](#-security)
350
352
  - ✅ **Browser + Node.js**: Universal compatibility with proper polyfills → [Loading Options](#12-loading-options--choose-your-approach)
351
353
  - ✅ **TypeScript Ready**: Complete type definitions included
352
354
  - ✅ **Ultra-Low Fees**: 0.01 sats/byte configuration (91% fee reduction)
@@ -696,11 +698,37 @@ const timelockScript = helper.createTimelockScript(
696
698
 
697
699
  ## 🔐 Security
698
700
 
699
- ### Enhanced Security Features
700
- - **Elliptic Curve Fix**: Updated to secure elliptic@6.6.1
701
- - **Parameter Fixing**: Public key, ephemeral key, sighash flag validation
702
- - **DER Canonicalization**: Transaction malleability prevention
703
- - **Preimage Validation**: Complete BIP143 structure verification
701
+ ### What's actually in the box
702
+
703
+ | Surface | Status | Notes |
704
+ |---------|--------|-------|
705
+ | `elliptic@6.6.1` (pinned) | upstream-patched | All known CVEs through 6.6.1 are fixed by elliptic itself. SmartLedger does not patch elliptic's source. |
706
+ | Default `transaction.verify()` / `signature.verify()` / `Message().verify()` | uses BSV's own `lib/crypto/ecdsa.js` | This path does **not** import elliptic and is **not** routed through `SmartVerify` or `EllipticFixed`. |
707
+ | `bsv.SmartVerify` (opt-in helper) | available | Hardened standalone verify: rejects `r=0`, `s=0`, `r≥n`, `s≥n`; canonicalizes `s` to low half. Built on BSV's own `BN`/`ECDSA`. You must call it explicitly. |
708
+ | `bsv.EllipticFixed` (opt-in helper) | available | Wraps the elliptic `secp256k1` instance with the same input checks + low-`s` on sign. Only matters if you use elliptic directly. |
709
+ | `signature.validate()` / `isCanonical()` / `toCanonical()` | available | Real methods on `bsv.Signature`. |
710
+ | DER canonicalization on TX signing | available | BSV's signature path produces low-`s` DER by default. |
711
+ | BIP143 preimage utilities | available | `lib/smart_contract/preimage.js` and `examples/preimage/`. |
712
+
713
+ ### Using the opt-in helpers
714
+
715
+ ```js
716
+ const bsv = require('@smartledger/bsv')
717
+
718
+ // Hardened verify (recommended if you accept signatures from untrusted sources):
719
+ const ok = bsv.SmartVerify.smartVerify(msgHashBuffer, derSigBuffer, publicKey)
720
+
721
+ // Or call BSV's own ECDSA via the standard API (no SmartVerify hardening):
722
+ const okDefault = bsv.crypto.ECDSA.verify(msgHashBuffer, signature, publicKey)
723
+ ```
724
+
725
+ ### What this library does **not** claim
726
+
727
+ - It does not silently route every `verify()` call through `SmartVerify`. If you want the strict input validation on every verification, call `SmartVerify` explicitly or wrap `bsv.Signature.prototype.verify`.
728
+ - It does not patch the elliptic library's source — the patches in `lib/crypto/elliptic-fixed.js` add input validation on top of an already-upstream-patched `elliptic@6.6.1`.
729
+ - It does not turn `bsv.isHardened = true` into an automatic guarantee. That property indicates the hardening helpers ship; whether they're used is up to your code.
730
+
731
+ A planned 3.5.0 will offer an opt-in flag to route the default verify path through `SmartVerify` so the protection is on by default for new users.
704
732
 
705
733
  ## 📝 Changelog
706
734