refactor: remove bitcoinjs-lib v5 and consolidate PSBT on v6

[kunal-595]

Hi, @bucko13

What do you think about this?

Current State

the repository depnds on two major versions of bitcoinjs-lib:

• v5.1.10
  • @caravan/bitcoin
  • @caravan/wallets
• v6.1.5
  • @caravan/psbt
  • @caravan/transactions

this results in duplicated dependncies, incompatible types, and incresed maintenance overhead

Duplicate PSBT Implementations

Two independent PsbtV2 implemntations exist:

• @caravan/bitcoin/src/psbtv2.ts
• @caravan/psbt/src/psbtv2/*

The v6 implementation is actively used and supports features not present in the v5 version
The v5-based implementation appears unused and redndant.

Issues

• multiple versions of the same core dependency
• type incompatibilities across package boundaries
• duplicated PSBT logic
• implicit and inconsistently enforced ECC initialzation

Proposed Direction

• standardize all packages on bitcoinjs-lib@^6.1.5
• migrate remaining v5-dependent code
• deprecate and remove PSBT exports from @caravan/bitcoin
• treat @caravan/psbt as the single PSBT implementation
• remove all v5 dependencies and aliases

If this direction makes sense to you, i am willing to start working on the migraton and consolidation outlined above

let me know if you would like me to proced, or if you would prefer any scope adjustments before implementation.

[bucko13]

this would be great! i would love to have this consolidation. there were some dependencies on the old psbt interfaces in the coordinator which I think we have since removed (at least the most important ones). We'll need to do some heavy testing after the change is made but I think this is a great project to take on.

[kunal-595]

Hi, @bucko13

Proposed Approach

Step 1: PSBT Ownership (no crypto changes)

• Update coordinator to use @caravan/psbt exclusvely
  -Deprecate and stop internal usage of PSBT exports from @caravan/bitcoin
• Guarantee byte-for-byte identical PSBTs

Step 2: ECC Abstraction (isolated)

• Introduce a noble-secp256k1 wrapper in @caravan/bitcoin behind the existing interface
• Keep bitcoinjs-lib v5
• Add explicit signing/verification parity tests

Step 3: bitcoinjs-lib v6 Migration

• Migrate @caravan/bitcoin to v6
• Limit changes to required modules only
• No wallet changes in this step

Step 4: Wallet Migrations (separate PRs)

• Migrate Ledger and Trezor independently
• Replace ECPair usage only
• Require identical device signtures

Step 5: Cleanup

• Remove v5 aliases and unused code
• Update build externals
• Run full test and e2e suites

Feedback Request

before starting, are there any adjustments you would prefer to the scope ?

[bucko13]

Great! you could probably do step 1 independently as well. Love this plan though. Thank you for going through and doing the breakdown.

[Legend101Zz]

@bucko13 @kunal-595 just a word of caution regarding the proposed approach—removing/deprecating PSBT exports from @caravan/bitcoin before fully migrating the coordinator would break several critical pieces of functionality in coordinator

Current Dependencies on @caravan/bitcoin PSBT exports in Coordinator:

1. finalizeOutputs reducer (transactionReducer.js):

   • Uses getUnsignedMultisigPsbtV0 (imported from @caravan/psbt)
   • Falls back to unsignedMultisigTransaction (from @caravan/bitcoin) when PSBT construction fails
   • This is the core transaction creation flow

2. Transaction.jsx (broadcast flow):

   • Uses getUnsignedMultisigPsbtV0 to rebuild PSBT for signing
   • Uses addSignaturesToPSBT from @caravan/bitcoin to add signatures before finalizing

3. SignatureImporter.jsx:

   • Uses addSignaturesToPSBT from @caravan/bitcoin to construct signed PSBTs for download
   • Uses validateMultisigPsbtSignature (now from @caravan/psbt)

4. Test suite (signing.jsx):

   • Uses unsignedMultisigPSBT and unsignedTransactionObjectFromPSBT from @caravan/bitcoin

just to quote a few on top of my mind
I'd recommend adjusting the sequence to avoid breakage:

• Move remaining PSBT functionality from @caravan/bitcoin to @caravan/psbt
• Keep @caravan/bitcoin exports as re-exports from @caravan/psbt temporarily
• This maintains backward compatibility while consolidating implementation
• Update @caravan/psbt to be the single source of truth

and if everything works we know that all went well and we can thejn introduce this to coordinator

and then :

• Update all coordinator imports to use @caravan/psbt exclusively
• Remove fallback to unsignedMultisigTransaction in finalizeOutputs (or handle differently)
• Update signature handling in Transaction.jsx and SignatureImporter.jsx
• This will be a single PR since these components are tightly coupled

rest steps look good to me too :)

Thoughts?