@smartledger/bsv 6.2.1 → 7.0.0

package/CHANGELOG.md

@@ -7,6 +7,72 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [7.0.0] - 2026-07-16
+
+Breaking major. Small and mechanical to adopt — see
+[`docs/MIGRATION_7.md`](docs/MIGRATION_7.md) for the full migration guide.
+
+### BREAKING
+
+- **`ECDSA.prototype.verify()` now returns a strict `boolean`** instead of the
+  ECDSA instance. This removes the truthy-instance trap where
+  `if (ecdsa.verify())` silently accepted forged signatures. The result is still
+  mirrored on `this.verified`, so only the chained `.verify().verified` idiom is
+  gone — replace it with `ecdsa.verify()`. The static `ECDSA.verify(...)`,
+  `Message.verify()`, and `verifyBool()` are unchanged. A security-contract test
+  now locks the trap **closed** (a forgery must make `verify()` return `false`).
+- **`package.json` now declares an `exports` map.** The main entry, `package.json`,
+  `./version`, all shipped bundles, and `lib/*` files (with or without `.js`)
+  resolve as before, and `import bsv from '@smartledger/bsv'` now works directly.
+  Directory-style deep imports without an explicit file (e.g.
+  `require('@smartledger/bsv/lib/smart_contract')`) are no longer auto-resolved —
+  use the main entry or point at the file. CDN usage is unaffected.
+
+### Added
+
+- **Real dual ESM entry.** The package ships `index.mjs` behind the `import`
+  condition, so `import { PrivateKey, Transaction } from '@smartledger/bsv'`
+  (named) and `import bsv from '@smartledger/bsv'` (default) both work natively.
+  `index.mjs` is generated from the CJS build's runtime surface (108 named
+  exports) by `scripts/gen-esm-wrapper.js` on every `npm version`; deprecated
+  accessors like `SmartUTXO` are excluded from the named exports (so importing
+  emits no deprecation warning) but stay reachable via the default export.
+- `test/build/exports_resolution.js` and `test/build/esm_wrapper.js` — guards for
+  the supported import surface (main, `package.json`, `./version`, bundles,
+  `lib/*` both extension styles, the ESM `import` condition, and ESM-wrapper
+  drift).
+- Adversarial `#verify` tests asserting `verify()` returns a strict boolean and
+  rejects a forgery.
+
+## [6.2.2] - 2026-07-15
+
+### Fixed
+
+- **`SmartContract.Preimage` now fails with an honest error on a too-short
+  buffer.** Previously a preimage shorter than the fixed BIP-143 fields threw a
+  misleading `"Invalid 8-byte CompactSize encoding"` (and emitted `console.warn`
+  noise) because extraction ran past the buffer before any length check. Construction
+  now throws `"Preimage too short: N bytes (BIP-143 preimage requires at least 157)"`,
+  and `decodeCompactSize` rejects out-of-range reads, truncated 2/4-byte prefixes,
+  and the invalid 8-byte (`0xff`) length prefix with clear messages instead of
+  salvaging garbage. `validate()`'s minimum was also corrected from the mislabeled
+  104 (left fixed zone only) to the true structural minimum of 157.
+
+### Added
+
+- `test/smart_contract/preimage.js` — first direct test coverage for the public
+  `SmartContract.Preimage` class (length guard, CompactSize edge cases, and a real
+  preimage round-trip).
+
+### Changed (dev toolchain only — no runtime/API/bundle change)
+
+- Removed the now-unused **webpack** devDependencies (`webpack`, `webpack-cli`,
+  `terser-webpack-plugin`, `brfs`) left over from the esbuild migration. `events`
+  — which `stream-browserify` requires but does not declare, and which had been
+  supplied transitively by webpack — is now an explicit devDependency so the
+  browser build no longer depends on dependency hoisting. Bundles rebuild
+  byte-identical; the published package is unchanged.
+
 ## [6.2.1] - 2026-07-15
 
 Bundle hygiene. No runtime/API change.

package/README.md

@@ -186,42 +186,42 @@ console.log('Status:', status) // 'revoked'
 ### **Core Modules**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv.min.js** | 1149KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@6.2.1/bsv.min.js` |
-| **bsv.bundle.js** | 1149KB | Everything in one file | `unpkg.com/@smartledger/bsv@6.2.1/bsv.bundle.js` |
+| **bsv.min.js** | 1149KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@7.0.0/bsv.min.js` |
+| **bsv.bundle.js** | 1149KB | Everything in one file | `unpkg.com/@smartledger/bsv@7.0.0/bsv.bundle.js` |
 
 ### **W3C Verifiable Credentials**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **🟢 bsv-didweb.min.js** | 315KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@6.2.1/bsv-didweb.min.js` |
-| **🟢 bsv-vcjwt.min.js** | 315KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@6.2.1/bsv-vcjwt.min.js` |
-| **🟢 bsv-statuslist.min.js** | 415KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@6.2.1/bsv-statuslist.min.js` |
-| **🟢 bsv-anchor.min.js** | 314KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@6.2.1/bsv-anchor.min.js` |
+| **🟢 bsv-didweb.min.js** | 315KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@7.0.0/bsv-didweb.min.js` |
+| **🟢 bsv-vcjwt.min.js** | 315KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@7.0.0/bsv-vcjwt.min.js` |
+| **🟢 bsv-statuslist.min.js** | 415KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@7.0.0/bsv-statuslist.min.js` |
+| **🟢 bsv-anchor.min.js** | 314KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@7.0.0/bsv-anchor.min.js` |
 
 ### **Smart Contract & Development**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-smartcontract.min.js** | 873KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@6.2.1/bsv-smartcontract.min.js` |
-| **bsv-covenant.min.js** | 873KB | Covenant operations | `unpkg.com/@smartledger/bsv@6.2.1/bsv-covenant.min.js` |
-| **bsv-script-helper.min.js** | 30KB | Custom script tools | `unpkg.com/@smartledger/bsv@6.2.1/bsv-script-helper.min.js` |
-| **bsv-security.min.js** | 30KB | Security enhancements | `unpkg.com/@smartledger/bsv@6.2.1/bsv-security.min.js` |
+| **bsv-smartcontract.min.js** | 873KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@7.0.0/bsv-smartcontract.min.js` |
+| **bsv-covenant.min.js** | 873KB | Covenant operations | `unpkg.com/@smartledger/bsv@7.0.0/bsv-covenant.min.js` |
+| **bsv-script-helper.min.js** | 30KB | Custom script tools | `unpkg.com/@smartledger/bsv@7.0.0/bsv-script-helper.min.js` |
+| **bsv-security.min.js** | 30KB | Security enhancements | `unpkg.com/@smartledger/bsv@7.0.0/bsv-security.min.js` |
 
 ### **Legal & Compliance**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-ltp.min.js** | 1149KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@6.2.1/bsv-ltp.min.js` |
-| **bsv-gdaf.min.js** | 1149KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@6.2.1/bsv-gdaf.min.js` |
+| **bsv-ltp.min.js** | 1149KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@7.0.0/bsv-ltp.min.js` |
+| **bsv-gdaf.min.js** | 1149KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@7.0.0/bsv-gdaf.min.js` |
 
 ### **Advanced Cryptography**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-shamir.min.js** | 353KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@6.2.1/bsv-shamir.min.js` |
+| **bsv-shamir.min.js** | 353KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@7.0.0/bsv-shamir.min.js` |
 
 ### **Utilities**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-ecies.min.js** | 79KB | Encryption | `unpkg.com/@smartledger/bsv@6.2.1/bsv-ecies.min.js` |
-| **bsv-message.min.js** | 30KB | Message signing | `unpkg.com/@smartledger/bsv@6.2.1/bsv-message.min.js` |
-| **bsv-mnemonic.min.js** | 592KB | HD wallets | `unpkg.com/@smartledger/bsv@6.2.1/bsv-mnemonic.min.js` |
+| **bsv-ecies.min.js** | 79KB | Encryption | `unpkg.com/@smartledger/bsv@7.0.0/bsv-ecies.min.js` |
+| **bsv-message.min.js** | 30KB | Message signing | `unpkg.com/@smartledger/bsv@7.0.0/bsv-message.min.js` |
+| **bsv-mnemonic.min.js** | 592KB | HD wallets | `unpkg.com/@smartledger/bsv@7.0.0/bsv-mnemonic.min.js` |
 
 ## ⚡ **2-Minute Quick Start**
 
@@ -232,7 +232,7 @@ Get started with Bitcoin SV development in under 2 minutes:
 npm install @smartledger/bsv
 
 # Or include in HTML
-<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.0.0/bsv.min.js"></script>
 ```
 
 > **🔒 v5.0.0 (production hardening — has breaking changes):** Shamir secret
@@ -332,8 +332,8 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
 
 ### 🔧 **Basic Development** (~1.2MB total)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv-script-helper.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.0.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.0.0/bsv-script-helper.min.js"></script>
 <script>
   const privateKey = new bsv.PrivateKey();
   const utxos = new bsv.SmartContract.UTXOGenerator().createRealUTXOs(2, 100000);
@@ -342,9 +342,9 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
 
 ### 🔒 **Smart Contract Development** (~2.8MB total — each bundle re-embeds core BSV)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv-covenant.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.0.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.0.0/bsv-covenant.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.0.0/bsv-smartcontract.min.js"></script>
 <script>
   const covenant = bsv.SmartContract.createCovenantBuilder()
     .extractField('amount').push(50000).greaterThanOrEqual().verify().build();
@@ -354,9 +354,9 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
 
 ### 🆕 **Legal & Identity Development** (~3.4MB total — each bundle re-embeds core BSV)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv-ltp.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.0.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.0.0/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.0.0/bsv-gdaf.min.js"></script>
 <script>
   // Legal Token Protocol
   const propertyToken = bsv.createPropertyToken({
@@ -370,9 +370,9 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
 
 ### 🆕 **Security & Cryptography** (~1.5MB total)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv-security.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv-shamir.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.0.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.0.0/bsv-security.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.0.0/bsv-shamir.min.js"></script>
 <script>
   // Threshold Cryptography
   const shares = bsv.splitSecret('my_secret_key', 5, 3); // 5 shares, 3 needed
@@ -384,7 +384,7 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
 
 ### 🎯 **Everything Bundle** (~1.1MB)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.0.0/bsv.bundle.js"></script>
 <script>
   // Everything available immediately
   const shares = bsv.splitSecret('secret', 5, 3);           // Shamir Secret Sharing
@@ -494,8 +494,8 @@ const contractTx = covenant.createCovenantTransaction({
 
 #### 1. **Minimal Setup** - Core + Script Helper (~1.2MB)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv-script-helper.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.0.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.0.0/bsv-script-helper.min.js"></script>
 <script>
   const tx = new bsv.Transaction();
   const sig = bsvScriptHelper.createSignature(tx, privateKey, 0, script, satoshis);
@@ -504,9 +504,9 @@ const contractTx = covenant.createCovenantTransaction({
 
 #### 2. **DeFi Development** - Core + Covenants + Debug (~2.8MB — each bundle re-embeds core BSV)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv-covenant.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.0.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.0.0/bsv-covenant.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.0.0/bsv-smartcontract.min.js"></script>
 <script>
   const covenant = new bsvCovenant.CovenantInterface();
   const debugInfo = SmartContract.interpretScript(script);
@@ -516,8 +516,8 @@ const contractTx = covenant.createCovenantTransaction({
 
 #### 3. **Security First** - Core + Enhanced Security (~1.2MB)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv-security.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.0.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.0.0/bsv-security.min.js"></script>
 <script>
   const verified = bsvSecurity.SmartVerify.verify(signature, hash, publicKey);
   const enhanced = bsvSecurity.EllipticFixed.createSignature(privateKey, hash);
@@ -526,7 +526,7 @@ const contractTx = covenant.createCovenantTransaction({
 
 #### 4. **Everything Bundle** - One File Solution (~1.1MB)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.0.0/bsv.bundle.js"></script>
 <script>
   // Everything available under bsv namespace
   const keys = bsv.SmartLedgerBundle.generateKeys();
@@ -834,7 +834,7 @@ const timelockScript = helper.createTimelockScript(
 
 See the **[16 Loading Options](#-16-loading-options---choose-your-approach)**
 table near the top for the full list of bundles with current sizes and
-canonical `unpkg.com/@smartledger/bsv@6.2.1/...` URLs.
+canonical `unpkg.com/@smartledger/bsv@7.0.0/...` URLs.
 
 ## 🔐 Security