@smartledger/bsv 7.5.3 → 7.5.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (22) hide show
  1. package/CHANGELOG.md +82 -0
  2. package/README.md +38 -38
  3. package/bsv-anchor.min.js +8 -8
  4. package/bsv-didweb.min.js +8 -8
  5. package/bsv-gdaf.min.js +47 -47
  6. package/bsv-ltp.min.js +47 -47
  7. package/bsv-mnemonic.min.js +11 -11
  8. package/bsv-shamir.min.js +11 -11
  9. package/bsv-smartcontract.min.js +7 -7
  10. package/bsv-statuslist.min.js +29 -29
  11. package/bsv-vcjwt.min.js +10 -10
  12. package/bsv.bundle.js +47 -47
  13. package/bsv.min.js +47 -47
  14. package/docs/MODULE_REFERENCE_COMPLETE.md +27 -27
  15. package/docs/advanced/UTXO_MANAGER_GUIDE.md +1 -1
  16. package/docs/getting-started/INSTALLATION.md +23 -23
  17. package/docs/getting-started/QUICK_START.md +7 -7
  18. package/docs/migration/FROM_BSV_1_5_6.md +5 -5
  19. package/lib/privatekey.js +35 -1
  20. package/package.json +7 -5
  21. package/test/privatekey.js +35 -2
  22. package/version.js +1 -1
package/CHANGELOG.md CHANGED
@@ -7,6 +7,88 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
7
7
 
8
8
  ## [Unreleased]
9
9
 
10
+ ## [7.5.5] - 2026-08-07
11
+
12
+ ### Fixed (security)
13
+
14
+ - **`PrivateKey.fromObject` silently returned a different key when given malformed
15
+ input.** `bn.js@4` *skips* characters it cannot parse instead of failing, so a
16
+ malformed `bn` never raised — it produced whatever the surviving characters
17
+ happened to encode. Combined with the `toJSON` redaction added in 7.5.1, the most
18
+ natural persist/restore round-trip
19
+
20
+ ```js
21
+ PrivateKey.fromObject(JSON.parse(JSON.stringify(key)))
22
+ ```
23
+
24
+ parsed the marker `'[REDACTED]'` as `768491671261` and returned a valid-looking
25
+ key of roughly **40 bits** — with no error, a different WIF, and a different
26
+ address. Anyone performing that round-trip and funding the resulting address
27
+ would lose the funds: the value is deterministic and derivable by anyone who
28
+ knows the marker.
29
+
30
+ `_transformObject` now validates before parsing: `bn` must be a non-empty
31
+ hexadecimal string, must not be the redaction marker (which raises a message
32
+ pointing at `toObject()`/`toWIF()`), and must fall inside the valid key range
33
+ (non-zero, below *n*). `toObject()` round-trips exactly, as before, and the
34
+ redaction marker is now a single shared constant so the emitter and the guard
35
+ cannot drift apart.
36
+
37
+ Found while evaluating the `bn.js` 4 → 5 bump: v5 rejects the input correctly, so
38
+ the one suite failure under it was this latent defect surfacing, not an
39
+ incompatibility. The fix is in this library's validation and does not depend on
40
+ upgrading `bn.js`.
41
+
42
+ - The test asserting `fromObject(key.toJSON())` "does not throw" encoded the broken
43
+ behaviour as intent and has been inverted, alongside regression tests for
44
+ non-hex input, the redaction marker, zero, and *n*.
45
+
46
+ Suite 4594 → 4597.
47
+
48
+ ## [7.5.4] - 2026-08-07
49
+
50
+ Dependency maintenance, with each update tested in isolation rather than merged on
51
+ green CI alone. Two proposed majors were rejected for concrete reasons and are now
52
+ pinned.
53
+
54
+ ### Changed
55
+
56
+ - `inherits` 2.0.3 → 2.0.4 and `unorm` 1.4.1 → 1.6.0 (both runtime dependencies, so
57
+ the 16 browser bundles are regenerated here). `unorm` performs the NFKD
58
+ normalisation BIP39 depends on; verified unchanged, including the full-width
59
+ katakana case (`ｶﾞ` → `ガ`) that normalisation bugs surface in.
60
+ - `chai` 4.2.0 → 6.2.2 (dev). Full suite passes unmodified.
61
+ - `actions/checkout` and `actions/setup-node` v5 → v7.
62
+
63
+ ### Not upgraded, and why
64
+
65
+ - **`jose` is pinned to `^5`.** v6 is WebCrypto-only and WebCrypto has no secp256k1,
66
+ so it has dropped **ES256K**. Verified against 6.2.7: `ES256` and `ES384` generate,
67
+ `ES256K` raises `Invalid or unsupported JWK "alg" Parameter value`. The two ES256K
68
+ cases in `test/vcjwt/interop.js` fail under it — and those tests exist to prove an
69
+ *independent* JOSE implementation can verify tokens this library issues. ES256K is
70
+ the algorithm for Bitcoin keys, so the upgrade would delete the guarantee the
71
+ dependency is there to provide.
72
+
73
+ - **`typescript` is pinned to `^5`.** The 7.x npm package ships no compiler API: it
74
+ exports only `version` and `versionMajorMinor`, with `createSourceFile`,
75
+ `ScriptTarget` and `SyntaxKind` all `undefined`. `test/types/dts_drift.js` parses
76
+ `bsv.d.ts` through the TypeScript AST to assert every declared symbol exists at
77
+ runtime, and it is the only thing keeping the hand-curated `bsv.d.ts` honest.
78
+
79
+ Both reasons are recorded in `.github/dependabot.yml` so the bumps are not reproposed.
80
+
81
+ ### Security posture note
82
+
83
+ Dependabot alerts are now enabled on the repository. The 13 open alerts are **all in
84
+ the development toolchain** — `js-yaml`, `brace-expansion`, `tmp` and
85
+ `serialize-javascript` reached through `mocha`, `standard`, `eslint` and `inquirer`.
86
+ `npm audit --omit=dev` reports **0 vulnerabilities**, and the browserify shims flagged
87
+ via `crypto-browserify` (`browserify-sign`, `create-ecdh`, `elliptic`) are stubbed out
88
+ by the esbuild config and appear **zero times** in the shipped bundles. Clearing the
89
+ remainder requires major upgrades of `mocha` and `standard`; the latter is gated on
90
+ the lint-ratchet baseline and is tracked as its own piece of work.
91
+
10
92
  ## [7.5.3] - 2026-08-07
11
93
 
12
94
  ### Fixed (security)
package/README.md CHANGED
@@ -186,42 +186,42 @@ console.log('Status:', status) // 'revoked'
186
186
  ### **Core Modules**
187
187
  | Module | Size | Use Case | CDN |
188
188
  |--------|------|----------|-----|
189
- | **bsv.min.js** | 1149KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@7.5.3/bsv.min.js` |
190
- | **bsv.bundle.js** | 1149KB | Everything in one file | `unpkg.com/@smartledger/bsv@7.5.3/bsv.bundle.js` |
189
+ | **bsv.min.js** | 1149KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@7.5.5/bsv.min.js` |
190
+ | **bsv.bundle.js** | 1149KB | Everything in one file | `unpkg.com/@smartledger/bsv@7.5.5/bsv.bundle.js` |
191
191
 
192
192
  ### **W3C Verifiable Credentials**
193
193
  | Module | Size | Use Case | CDN |
194
194
  |--------|------|----------|-----|
195
- | **🟢 bsv-didweb.min.js** | 315KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@7.5.3/bsv-didweb.min.js` |
196
- | **🟢 bsv-vcjwt.min.js** | 315KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@7.5.3/bsv-vcjwt.min.js` |
197
- | **🟢 bsv-statuslist.min.js** | 415KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@7.5.3/bsv-statuslist.min.js` |
198
- | **🟢 bsv-anchor.min.js** | 314KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@7.5.3/bsv-anchor.min.js` |
195
+ | **🟢 bsv-didweb.min.js** | 315KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@7.5.5/bsv-didweb.min.js` |
196
+ | **🟢 bsv-vcjwt.min.js** | 315KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@7.5.5/bsv-vcjwt.min.js` |
197
+ | **🟢 bsv-statuslist.min.js** | 415KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@7.5.5/bsv-statuslist.min.js` |
198
+ | **🟢 bsv-anchor.min.js** | 314KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@7.5.5/bsv-anchor.min.js` |
199
199
 
200
200
  ### **Smart Contract & Development**
201
201
  | Module | Size | Use Case | CDN |
202
202
  |--------|------|----------|-----|
203
- | **bsv-smartcontract.min.js** | 873KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@7.5.3/bsv-smartcontract.min.js` |
204
- | **bsv-covenant.min.js** | 873KB | Covenant operations | `unpkg.com/@smartledger/bsv@7.5.3/bsv-covenant.min.js` |
205
- | **bsv-script-helper.min.js** | 30KB | Custom script tools | `unpkg.com/@smartledger/bsv@7.5.3/bsv-script-helper.min.js` |
206
- | **bsv-security.min.js** | 30KB | Security enhancements | `unpkg.com/@smartledger/bsv@7.5.3/bsv-security.min.js` |
203
+ | **bsv-smartcontract.min.js** | 873KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@7.5.5/bsv-smartcontract.min.js` |
204
+ | **bsv-covenant.min.js** | 873KB | Covenant operations | `unpkg.com/@smartledger/bsv@7.5.5/bsv-covenant.min.js` |
205
+ | **bsv-script-helper.min.js** | 30KB | Custom script tools | `unpkg.com/@smartledger/bsv@7.5.5/bsv-script-helper.min.js` |
206
+ | **bsv-security.min.js** | 30KB | Security enhancements | `unpkg.com/@smartledger/bsv@7.5.5/bsv-security.min.js` |
207
207
 
208
208
  ### **Legal & Compliance**
209
209
  | Module | Size | Use Case | CDN |
210
210
  |--------|------|----------|-----|
211
- | **bsv-ltp.min.js** | 1149KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@7.5.3/bsv-ltp.min.js` |
212
- | **bsv-gdaf.min.js** | 1149KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@7.5.3/bsv-gdaf.min.js` |
211
+ | **bsv-ltp.min.js** | 1149KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@7.5.5/bsv-ltp.min.js` |
212
+ | **bsv-gdaf.min.js** | 1149KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@7.5.5/bsv-gdaf.min.js` |
213
213
 
214
214
  ### **Advanced Cryptography**
215
215
  | Module | Size | Use Case | CDN |
216
216
  |--------|------|----------|-----|
217
- | **bsv-shamir.min.js** | 353KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@7.5.3/bsv-shamir.min.js` |
217
+ | **bsv-shamir.min.js** | 353KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@7.5.5/bsv-shamir.min.js` |
218
218
 
219
219
  ### **Utilities**
220
220
  | Module | Size | Use Case | CDN |
221
221
  |--------|------|----------|-----|
222
- | **bsv-ecies.min.js** | 79KB | Encryption | `unpkg.com/@smartledger/bsv@7.5.3/bsv-ecies.min.js` |
223
- | **bsv-message.min.js** | 30KB | Message signing | `unpkg.com/@smartledger/bsv@7.5.3/bsv-message.min.js` |
224
- | **bsv-mnemonic.min.js** | 592KB | HD wallets | `unpkg.com/@smartledger/bsv@7.5.3/bsv-mnemonic.min.js` |
222
+ | **bsv-ecies.min.js** | 79KB | Encryption | `unpkg.com/@smartledger/bsv@7.5.5/bsv-ecies.min.js` |
223
+ | **bsv-message.min.js** | 30KB | Message signing | `unpkg.com/@smartledger/bsv@7.5.5/bsv-message.min.js` |
224
+ | **bsv-mnemonic.min.js** | 592KB | HD wallets | `unpkg.com/@smartledger/bsv@7.5.5/bsv-mnemonic.min.js` |
225
225
 
226
226
  ## ⚡ **2-Minute Quick Start**
227
227
 
@@ -232,7 +232,7 @@ Get started with Bitcoin SV development in under 2 minutes:
232
232
  npm install @smartledger/bsv
233
233
 
234
234
  # Or include in HTML
235
- <script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv.min.js"></script>
235
+ <script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv.min.js"></script>
236
236
  ```
237
237
 
238
238
  > **🔒 v5.0.0 (production hardening — has breaking changes):** Shamir secret
@@ -332,8 +332,8 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
332
332
 
333
333
  ### 🔧 **Basic Development** (~1.2MB total)
334
334
  ```html
335
- <script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv.min.js"></script>
336
- <script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv-script-helper.min.js"></script>
335
+ <script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv.min.js"></script>
336
+ <script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv-script-helper.min.js"></script>
337
337
  <script>
338
338
  const privateKey = new bsv.PrivateKey();
339
339
  const utxos = new bsv.SmartContract.UTXOGenerator().createRealUTXOs(2, 100000);
@@ -342,9 +342,9 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
342
342
 
343
343
  ### 🔒 **Smart Contract Development** (~2.8MB total — each bundle re-embeds core BSV)
344
344
  ```html
345
- <script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv.min.js"></script>
346
- <script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv-covenant.min.js"></script>
347
- <script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv-smartcontract.min.js"></script>
345
+ <script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv.min.js"></script>
346
+ <script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv-covenant.min.js"></script>
347
+ <script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv-smartcontract.min.js"></script>
348
348
  <script>
349
349
  const covenant = bsv.SmartContract.createCovenantBuilder()
350
350
  .extractField('amount').push(50000).greaterThanOrEqual().verify().build();
@@ -354,9 +354,9 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
354
354
 
355
355
  ### 🆕 **Legal & Identity Development** (~3.4MB total — each bundle re-embeds core BSV)
356
356
  ```html
357
- <script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv.min.js"></script>
358
- <script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv-ltp.min.js"></script>
359
- <script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv-gdaf.min.js"></script>
357
+ <script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv.min.js"></script>
358
+ <script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv-ltp.min.js"></script>
359
+ <script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv-gdaf.min.js"></script>
360
360
  <script>
361
361
  // Legal Token Protocol
362
362
  const propertyToken = bsv.createPropertyToken({
@@ -370,9 +370,9 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
370
370
 
371
371
  ### 🆕 **Security & Cryptography** (~1.5MB total)
372
372
  ```html
373
- <script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv.min.js"></script>
374
- <script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv-security.min.js"></script>
375
- <script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv-shamir.min.js"></script>
373
+ <script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv.min.js"></script>
374
+ <script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv-security.min.js"></script>
375
+ <script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv-shamir.min.js"></script>
376
376
  <script>
377
377
  // Threshold Cryptography
378
378
  const shares = bsv.splitSecret('my_secret_key', 5, 3); // 5 shares, 3 needed
@@ -384,7 +384,7 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
384
384
 
385
385
  ### 🎯 **Everything Bundle** (~1.1MB)
386
386
  ```html
387
- <script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv.bundle.js"></script>
387
+ <script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv.bundle.js"></script>
388
388
  <script>
389
389
  // Everything available immediately
390
390
  const shares = bsv.splitSecret('secret', 5, 3); // Shamir Secret Sharing
@@ -494,8 +494,8 @@ const contractTx = covenant.createCovenantTransaction({
494
494
 
495
495
  #### 1. **Minimal Setup** - Core + Script Helper (~1.2MB)
496
496
  ```html
497
- <script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv.min.js"></script>
498
- <script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv-script-helper.min.js"></script>
497
+ <script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv.min.js"></script>
498
+ <script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv-script-helper.min.js"></script>
499
499
  <script>
500
500
  const tx = new bsv.Transaction();
501
501
  const sig = bsvScriptHelper.createSignature(tx, privateKey, 0, script, satoshis);
@@ -504,9 +504,9 @@ const contractTx = covenant.createCovenantTransaction({
504
504
 
505
505
  #### 2. **DeFi Development** - Core + Covenants + Debug (~2.8MB — each bundle re-embeds core BSV)
506
506
  ```html
507
- <script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv.min.js"></script>
508
- <script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv-covenant.min.js"></script>
509
- <script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv-smartcontract.min.js"></script>
507
+ <script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv.min.js"></script>
508
+ <script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv-covenant.min.js"></script>
509
+ <script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv-smartcontract.min.js"></script>
510
510
  <script>
511
511
  const covenant = new bsvCovenant.CovenantInterface();
512
512
  const debugInfo = SmartContract.interpretScript(script);
@@ -516,8 +516,8 @@ const contractTx = covenant.createCovenantTransaction({
516
516
 
517
517
  #### 3. **Security First** - Core + Enhanced Security (~1.2MB)
518
518
  ```html
519
- <script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv.min.js"></script>
520
- <script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv-security.min.js"></script>
519
+ <script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv.min.js"></script>
520
+ <script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv-security.min.js"></script>
521
521
  <script>
522
522
  const verified = bsvSecurity.SmartVerify.verify(signature, hash, publicKey);
523
523
  const enhanced = bsvSecurity.EllipticFixed.createSignature(privateKey, hash);
@@ -526,7 +526,7 @@ const contractTx = covenant.createCovenantTransaction({
526
526
 
527
527
  #### 4. **Everything Bundle** - One File Solution (~1.1MB)
528
528
  ```html
529
- <script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv.bundle.js"></script>
529
+ <script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv.bundle.js"></script>
530
530
  <script>
531
531
  // Everything available under bsv namespace
532
532
  const keys = bsv.SmartLedgerBundle.generateKeys();
@@ -834,7 +834,7 @@ const timelockScript = helper.createTimelockScript(
834
834
 
835
835
  See the **[16 Loading Options](#-16-loading-options---choose-your-approach)**
836
836
  table near the top for the full list of bundles with current sizes and
837
- canonical `unpkg.com/@smartledger/bsv@7.5.3/...` URLs.
837
+ canonical `unpkg.com/@smartledger/bsv@7.5.5/...` URLs.
838
838
 
839
839
  ## 🔐 Security
840
840