@smartledger/bsv 5.2.0 → 5.3.0

package/CHANGELOG.md

@@ -5,6 +5,55 @@ All notable changes to SmartLedger-BSV will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [5.3.0] - 2026-06-15
+
+Completes the migration of **all** of bsv's secp256k1 cryptography to the
+audited `@noble` suite and removes the `elliptic` dependency. No change to the
+documented public API or to signatures/keys/addresses (byte-identical).
+
+### Changed
+
+- **EC point math migrated from `elliptic` to the audited `@noble/curves`.**
+  `lib/crypto/point.js` — the single seam all secp256k1 point operations flow
+  through — is now backed by `@noble/curves`, so the entire signing/keys stack
+  (`ECDSA` sign/verify/recovery, public-key derivation, HD keys, message
+  signing) runs on audited, constant-time curve code. The `Point` API
+  (`mul`/`add`/`mulAdd`/`getX`/`getY`/`.x`/`.y`/`eq`/`isInfinity`/`validate` and
+  the `getG`/`getN`/`fromX`/`fromBuffer` statics) is unchanged, so `ecdsa.js`
+  and all consumers are untouched.
+  - **No API or behavioral change.** Verified by the full existing test suite
+    (4241 tests — ECDSA known-answer vectors, address/HD-key/transaction/message
+    vectors all pass unchanged), so signatures, keys and addresses are
+    byte-identical to prior versions. Scalar multiplication uses @noble's
+    *constant-time* `multiply` (important for the secret signing nonce).
+- **`lib/crypto/elliptic-fixed.js` (`bsv.EllipticFixed`) migrated to
+  `@noble/curves`.** Its hardened sign/verify/recover surface
+  (`keyFromPrivate`, `sign` → `{r, s, recoveryParam}`, `verify`,
+  `recoverPubKey`, `curve.n`) is unchanged and still produces low-S canonical
+  signatures with a consistent `recoveryParam`. `bsv.SmartVerify` already ran on
+  `@noble` (via `Point`/`ECDSA`).
+- **`elliptic` removed as a dependency.** With both `point.js` and
+  `elliptic-fixed.js` on `@noble`, no source code imports `elliptic` anymore and
+  it has been removed from `package.json`. **All of bsv's secp256k1
+  cryptography now runs on the audited `@noble` suite.** `bn.js` remains (it is
+  the codebase's general-purpose bignum, used well beyond crypto).
+
+### Removed
+
+- **`bsv.deps.elliptic`** is no longer exposed (the `elliptic` passthrough on the
+  internal `deps` object). The documented public API (`bsv.PrivateKey`,
+  `bsv.Transaction`, `bsv.crypto.*`, …) is unaffected; only code reaching into
+  `bsv.deps.elliptic` directly is impacted.
+
+### Notes
+
+- The standalone module bundles that don't embed the browser `crypto` polyfill
+  shrink (e.g. `bsv-smartcontract.min.js` / `bsv-covenant.min.js` ~939KB →
+  ~873KB). The full bundles are unchanged for now: they still pull `elliptic`
+  transitively through `crypto-browserify` (the browser CSPRNG polyfill, a
+  devDependency) for `createSign`/`createECDH` — APIs bsv never calls. Trimming
+  that from the browser build (so the full bundles shrink too) is a follow-up.
+
 ## [5.2.0] - 2026-06-15
 
 First migration of bsv's cryptography to the audited `@noble` suite (ECIES).

package/README.md

@@ -72,7 +72,7 @@ const ok = SC.verifyScript(unlockScript, lockingScript, tx, inputIndex, satoshis
 
 ```bash
 # Install SmartLedger BSV v5.0.0
-npm install @smartledger/bsv@5.2.0
+npm install @smartledger/bsv@5.3.0
 
 # Initialize DID:web issuer (generates ES256 keys)
 npx smartledger-bsv didweb init --domain example.com --alg ES256
@@ -181,42 +181,42 @@ console.log('Status:', status) // 'revoked'
 ### **Core Modules**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv.min.js** | 1270KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@5.2.0/bsv.min.js` |
-| **bsv.bundle.js** | 1270KB | Everything in one file | `unpkg.com/@smartledger/bsv@5.2.0/bsv.bundle.js` |
+| **bsv.min.js** | 1271KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@5.3.0/bsv.min.js` |
+| **bsv.bundle.js** | 1271KB | Everything in one file | `unpkg.com/@smartledger/bsv@5.3.0/bsv.bundle.js` |
 
 ### **W3C Verifiable Credentials**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **🟢 bsv-didweb.min.js** | 453KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@5.2.0/bsv-didweb.min.js` |
-| **🟢 bsv-vcjwt.min.js** | 454KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@5.2.0/bsv-vcjwt.min.js` |
-| **🟢 bsv-statuslist.min.js** | 553KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@5.2.0/bsv-statuslist.min.js` |
-| **🟢 bsv-anchor.min.js** | 452KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@5.2.0/bsv-anchor.min.js` |
+| **🟢 bsv-didweb.min.js** | 453KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@5.3.0/bsv-didweb.min.js` |
+| **🟢 bsv-vcjwt.min.js** | 454KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@5.3.0/bsv-vcjwt.min.js` |
+| **🟢 bsv-statuslist.min.js** | 553KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@5.3.0/bsv-statuslist.min.js` |
+| **🟢 bsv-anchor.min.js** | 452KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@5.3.0/bsv-anchor.min.js` |
 
 ### **Smart Contract & Development**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-smartcontract.min.js** | 943KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@5.2.0/bsv-smartcontract.min.js` |
-| **bsv-covenant.min.js** | 943KB | Covenant operations | `unpkg.com/@smartledger/bsv@5.2.0/bsv-covenant.min.js` |
-| **bsv-script-helper.min.js** | 30KB | Custom script tools | `unpkg.com/@smartledger/bsv@5.2.0/bsv-script-helper.min.js` |
-| **bsv-security.min.js** | 30KB | Security enhancements | `unpkg.com/@smartledger/bsv@5.2.0/bsv-security.min.js` |
+| **bsv-smartcontract.min.js** | 873KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@5.3.0/bsv-smartcontract.min.js` |
+| **bsv-covenant.min.js** | 873KB | Covenant operations | `unpkg.com/@smartledger/bsv@5.3.0/bsv-covenant.min.js` |
+| **bsv-script-helper.min.js** | 30KB | Custom script tools | `unpkg.com/@smartledger/bsv@5.3.0/bsv-script-helper.min.js` |
+| **bsv-security.min.js** | 30KB | Security enhancements | `unpkg.com/@smartledger/bsv@5.3.0/bsv-security.min.js` |
 
 ### **Legal & Compliance**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-ltp.min.js** | 1270KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@5.2.0/bsv-ltp.min.js` |
-| **bsv-gdaf.min.js** | 1270KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@5.2.0/bsv-gdaf.min.js` |
+| **bsv-ltp.min.js** | 1271KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@5.3.0/bsv-ltp.min.js` |
+| **bsv-gdaf.min.js** | 1271KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@5.3.0/bsv-gdaf.min.js` |
 
 ### **Advanced Cryptography**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-shamir.min.js** | 476KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@5.2.0/bsv-shamir.min.js` |
+| **bsv-shamir.min.js** | 476KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@5.3.0/bsv-shamir.min.js` |
 
 ### **Utilities**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-ecies.min.js** | 79KB | Encryption | `unpkg.com/@smartledger/bsv@5.2.0/bsv-ecies.min.js` |
-| **bsv-message.min.js** | 30KB | Message signing | `unpkg.com/@smartledger/bsv@5.2.0/bsv-message.min.js` |
-| **bsv-mnemonic.min.js** | 715KB | HD wallets | `unpkg.com/@smartledger/bsv@5.2.0/bsv-mnemonic.min.js` |
+| **bsv-ecies.min.js** | 79KB | Encryption | `unpkg.com/@smartledger/bsv@5.3.0/bsv-ecies.min.js` |
+| **bsv-message.min.js** | 30KB | Message signing | `unpkg.com/@smartledger/bsv@5.3.0/bsv-message.min.js` |
+| **bsv-mnemonic.min.js** | 715KB | HD wallets | `unpkg.com/@smartledger/bsv@5.3.0/bsv-mnemonic.min.js` |
 
 ## ⚡ **2-Minute Quick Start**
 
@@ -227,7 +227,7 @@ Get started with Bitcoin SV development in under 2 minutes:
 npm install @smartledger/bsv
 
 # Or include in HTML
-<script src="https://unpkg.com/@smartledger/bsv@5.2.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@5.3.0/bsv.min.js"></script>
 ```
 
 > **🔒 v5.0.0 (production hardening — has breaking changes):** Shamir secret
@@ -327,19 +327,19 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
 
 ### 🔧 **Basic Development** (~1.3MB total)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@5.2.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@5.2.0/bsv-script-helper.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@5.3.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@5.3.0/bsv-script-helper.min.js"></script>
 <script>
   const privateKey = new bsv.PrivateKey();
   const utxos = new bsv.SmartContract.UTXOGenerator().createRealUTXOs(2, 100000);
 </script>
 ```
 
-### 🔒 **Smart Contract Development** (~3.1MB total — each bundle re-embeds core BSV)
+### 🔒 **Smart Contract Development** (~3.0MB total — each bundle re-embeds core BSV)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@5.2.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@5.2.0/bsv-covenant.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@5.2.0/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@5.3.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@5.3.0/bsv-covenant.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@5.3.0/bsv-smartcontract.min.js"></script>
 <script>
   const covenant = bsv.SmartContract.createCovenantBuilder()
     .extractField('amount').push(50000).greaterThanOrEqual().verify().build();
@@ -349,9 +349,9 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
 
 ### 🆕 **Legal & Identity Development** (~3.7MB total — each bundle re-embeds core BSV)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@5.2.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@5.2.0/bsv-ltp.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@5.2.0/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@5.3.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@5.3.0/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@5.3.0/bsv-gdaf.min.js"></script>
 <script>
   // Legal Token Protocol
   const propertyToken = bsv.createPropertyToken({
@@ -365,9 +365,9 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
 
 ### 🆕 **Security & Cryptography** (~1.7MB total)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@5.2.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@5.2.0/bsv-security.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@5.2.0/bsv-shamir.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@5.3.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@5.3.0/bsv-security.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@5.3.0/bsv-shamir.min.js"></script>
 <script>
   // Threshold Cryptography
   const shares = bsv.splitSecret('my_secret_key', 5, 3); // 5 shares, 3 needed
@@ -379,7 +379,7 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
 
 ### 🎯 **Everything Bundle** (~1.3MB)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@5.2.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@5.3.0/bsv.bundle.js"></script>
 <script>
   // Everything available immediately
   const shares = bsv.splitSecret('secret', 5, 3);           // Shamir Secret Sharing
@@ -412,7 +412,7 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
 - � **PUSHTX Integration**: nChain techniques for advanced covenant patterns → [PUSHTX Insights](docs/pushtx-key-insights.md)
 
 ### 📦 **Flexible Architecture** 
-- 📦 **16 Modular Options**: Load only what you need (30KB to 1270KB) → [Loading Strategy](#-16-loading-options---choose-your-approach)
+- 📦 **16 Modular Options**: Load only what you need (30KB to 1271KB) → [Loading Strategy](#-16-loading-options---choose-your-approach)
 - 📦 **Standalone Modules**: Independent legal, identity, and crypto modules → [Standalone Test](https://github.com/codenlighten/smartledger-bsv/blob/main/tests/standalone-modules-test.html)
 - 📦 **Complete Bundle**: Everything in one file for convenience → [Bundle Demo](https://github.com/codenlighten/smartledger-bsv/blob/main/tests/bundle-demo.html)
 - 📦 **CDN Ready**: All modules available via unpkg and jsDelivr
@@ -488,19 +488,19 @@ const contractTx = covenant.createCovenantTransaction({
 
 #### 1. **Minimal Setup** - Core + Script Helper (~1.3MB)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@5.2.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@5.2.0/bsv-script-helper.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@5.3.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@5.3.0/bsv-script-helper.min.js"></script>
 <script>
   const tx = new bsv.Transaction();
   const sig = bsvScriptHelper.createSignature(tx, privateKey, 0, script, satoshis);
 </script>
 ```
 
-#### 2. **DeFi Development** - Core + Covenants + Debug (~3.1MB — each bundle re-embeds core BSV)
+#### 2. **DeFi Development** - Core + Covenants + Debug (~3.0MB — each bundle re-embeds core BSV)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@5.2.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@5.2.0/bsv-covenant.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@5.2.0/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@5.3.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@5.3.0/bsv-covenant.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@5.3.0/bsv-smartcontract.min.js"></script>
 <script>
   const covenant = new bsvCovenant.CovenantInterface();
   const debugInfo = SmartContract.interpretScript(script);
@@ -510,8 +510,8 @@ const contractTx = covenant.createCovenantTransaction({
 
 #### 3. **Security First** - Core + Enhanced Security (~1.3MB)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@5.2.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@5.2.0/bsv-security.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@5.3.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@5.3.0/bsv-security.min.js"></script>
 <script>
   const verified = bsvSecurity.SmartVerify.verify(signature, hash, publicKey);
   const enhanced = bsvSecurity.EllipticFixed.createSignature(privateKey, hash);
@@ -520,7 +520,7 @@ const contractTx = covenant.createCovenantTransaction({
 
 #### 4. **Everything Bundle** - One File Solution (~1.3MB)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@5.2.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@5.3.0/bsv.bundle.js"></script>
 <script>
   // Everything available under bsv namespace
   const keys = bsv.SmartLedgerBundle.generateKeys();
@@ -809,7 +809,7 @@ const timelockScript = helper.createTimelockScript(
 
 See the **[16 Loading Options](#-16-loading-options---choose-your-approach)**
 table near the top for the full list of bundles with current sizes and
-canonical `unpkg.com/@smartledger/bsv@5.2.0/...` URLs.
+canonical `unpkg.com/@smartledger/bsv@5.3.0/...` URLs.
 
 ## 🔐 Security