@smartledger/bsv 6.1.2 → 6.2.1

package/test/build/bundle_smoke.js

@@ -0,0 +1,55 @@
+'use strict'
+
+/* global describe, it */
+
+// Cutover safety net for the webpack -> esbuild bundle migration: every SHIPPED bundle
+// must load and expose an API. Each bundle is loaded in an ISOLATED child process (they
+// are self-contained bsv builds; loading them all into one process would collide), with a
+// global `bsv` present for the feature bundles that externalise it. Load/shape smoke only —
+// full browser behaviour (window.crypto CSPRNG) is covered by the Chrome browser-smoke.
+
+require('chai').should()
+var path = require('path')
+var execFileSync = require('child_process').execFileSync
+
+var ROOT = path.resolve(__dirname, '../..')
+
+// file -> a key that must be present on the loaded module (null = just needs a non-empty API).
+var BUNDLES = {
+  'bsv.min.js': 'PrivateKey',
+  'bsv.bundle.js': 'PrivateKey',
+  'bsv-ecies.min.js': null,
+  'bsv-message.min.js': null,
+  'bsv-mnemonic.min.js': null,
+  'bsv-shamir.min.js': null,
+  'bsv-smartcontract.min.js': 'Covenant',
+  'bsv-covenant.min.js': null,
+  'bsv-script-helper.min.js': null,
+  'bsv-security.min.js': null,
+  'bsv-ltp.min.js': null,
+  'bsv-gdaf.min.js': null,
+  'bsv-didweb.min.js': null,
+  'bsv-vcjwt.min.js': null,
+  'bsv-statuslist.min.js': null,
+  'bsv-anchor.min.js': null
+}
+
+describe('bundles: every shipped bundle loads (esbuild cutover)', function () {
+  this.timeout(20000)
+
+  Object.keys(BUNDLES).forEach(function (file) {
+    it(file + ' loads via require() and exposes an API', function () {
+      var key = BUNDLES[file]
+      var script =
+        'global.bsv=require(' + JSON.stringify(path.join(ROOT, 'index.js')) + ');' +
+        'var m=require(' + JSON.stringify(path.join(ROOT, file)) + ');' +
+        'if(m==null)process.exit(2);' +
+        'var ok=(typeof m==="function")||(typeof m==="object"&&Object.keys(m).length>0);' +
+        'if(!ok)process.exit(3);' +
+        (key ? 'if(m[' + JSON.stringify(key) + ']==null)process.exit(4);' : '') +
+        'process.exit(0)'
+      // execFileSync throws if the child exits non-zero (a broken/unloadable bundle).
+      execFileSync(process.execPath, ['-e', script], { stdio: 'pipe' })
+    })
+  })
+})

package/test/build/esbuild_main.js

@@ -0,0 +1,65 @@
+'use strict'
+
+/* global describe, it */
+
+// Build-integrity gate for the esbuild bundler migration. Proves every browser bundle
+// (all 16) builds — esbuild resolves each Node-core polyfill and, for the feature bundles,
+// externalises the bsv root to the global `bsv` — and that the output is a real UMD module
+// (browser global + require()/AMD). Full browser behaviour (Shamir CSPRNG via window.crypto)
+// is validated by the Chrome browser-smoke against the full bundle.
+
+require('chai').should()
+var fs = require('fs')
+var os = require('os')
+var path = require('path')
+var E = require('../../build/esbuild')
+
+describe('esbuild: all browser bundles build', function () {
+  this.timeout(60000)
+
+  it('all ' + E.BUNDLES.length + ' bundles build with no unresolved modules', function () {
+    return Promise.all(E.BUNDLES.map(function (cfg) {
+      return E.buildOne(cfg, { write: false, logLevel: 'silent' }).then(function (res) {
+        res.errors.length.should.equal(0)
+        var js = res.outputFiles[0].text
+        js.length.should.be.above(20000) // smallest bundle (message) ~31KB; a broken build is tiny
+        js.indexOf('var ' + cfg.global + '=').should.be.above(-1) // IIFE global assignment
+      })
+    }))
+  })
+
+  // UMD contract: the full bundle must load via CommonJS require() (as the webpack UMD bundle
+  // did). Browser <script> global is validated by the Chrome browser-smoke.
+  it('the full bundle is require()-able (UMD) with a working static API', function () {
+    return E.buildFullBundle({ write: false, logLevel: 'silent' }).then(function (res) {
+      var tmp = path.join(os.tmpdir(), 'bsv-esbuild-full-' + process.pid + '.js')
+      fs.writeFileSync(tmp, res.outputFiles[0].text)
+      try {
+        var bsv = require(tmp)
+        ;(typeof bsv.PrivateKey).should.equal('function')
+        bsv.version.should.be.a('string')
+        bsv.crypto.Hash.sha256(bsv.deps.Buffer.from('x')).length.should.equal(32)
+        ;(!!bsv.Ordinals && !!bsv.SPV).should.equal(true)
+      } finally { delete require.cache[tmp]; fs.unlinkSync(tmp) }
+    })
+  })
+
+  // A feature bundle that externalises bsv (bsv-covenant) must load against a global `bsv`.
+  it('a feature bundle (bsv-covenant) loads against the global bsv', function () {
+    var cfg = E.BUNDLES.filter(function (c) { return c.file === 'bsv-covenant.min.js' })[0]
+    return E.buildOne(cfg, { write: false, logLevel: 'silent' }).then(function (res) {
+      var tmp = path.join(os.tmpdir(), 'bsv-esbuild-cov-' + process.pid + '.js')
+      fs.writeFileSync(tmp, res.outputFiles[0].text)
+      var had = 'bsv' in global // Node: global === globalThis, which the bundle reads
+      global.bsv = require('../..')
+      try {
+        var cov = require(tmp)
+        ;(cov == null).should.equal(false)
+        Object.keys(cov).length.should.be.above(0)
+      } finally {
+        delete require.cache[tmp]; fs.unlinkSync(tmp)
+        if (!had) delete global.bsv
+      }
+    })
+  })
+})

package/test/build/version_sync.js

@@ -0,0 +1,14 @@
+'use strict'
+
+/* global describe, it */
+
+// version.js is generated from package.json by the `version` npm hook so the bundles
+// embed only the version string (not the whole package.json). Assert it hasn't drifted.
+
+require('chai').should()
+
+describe('version.js stays in sync with package.json', function () {
+  it('version.js === package.json.version', function () {
+    require('../../version').should.equal(require('../../package.json').version)
+  })
+})

package/test/security/threat_model_coverage.js

@@ -0,0 +1,31 @@
+'use strict'
+
+/* global describe, it */
+
+// Keeps docs/THREAT_MODEL.md honest: every `test/…js` the threat model cites as the
+// enforcer of a security property must actually exist. If a security test is renamed
+// or deleted, the threat model can no longer silently point at a ghost — this gate goes
+// red. (Same "docs are tested claims" principle as the type-drift gate.)
+
+require('chai').should()
+var fs = require('fs')
+var path = require('path')
+
+var ROOT = path.resolve(__dirname, '../..')
+var MODEL = path.join(ROOT, 'docs/THREAT_MODEL.md')
+
+describe('security: threat model references real tests', function () {
+  var text = fs.readFileSync(MODEL, 'utf8')
+  // Every referenced test path, e.g. `test/security/fail_closed_contracts.js`.
+  var refs = (text.match(/test\/[A-Za-z0-9_./-]+\.js/g) || [])
+  var unique = refs.filter(function (r, i) { return refs.indexOf(r) === i })
+
+  it('cites a meaningful number of enforcing tests', function () {
+    unique.length.should.be.above(6)
+  })
+
+  it('every cited test file exists', function () {
+    var missing = unique.filter(function (rel) { return !fs.existsSync(path.join(ROOT, rel)) })
+    missing.should.deep.equal([], 'THREAT_MODEL.md cites test files that do not exist:\n  ' + missing.join('\n  '))
+  })
+})

package/version.js

@@ -0,0 +1,3 @@
+'use strict'
+// GENERATED by scripts/sync-version.js on `npm version` — do not edit.
+module.exports = '6.2.1'

package/build/webpack.anchor.config.js

@@ -1,15 +0,0 @@
-const path = require('path')
-const { bundlePolyfills } = require('./webpack.base')
-
-module.exports = bundlePolyfills({
-  entry: path.join(__dirname, '../anchor-entry.js'),
-  mode: 'production',
-  output: {
-    path: path.resolve(__dirname, '../'),
-    filename: 'bsv-anchor.min.js',
-    library: 'bsvAnchor',
-    libraryTarget: 'umd',
-    globalObject: 'this'
-  },
-  target: 'web'
-})

package/build/webpack.base.js

@@ -1,125 +0,0 @@
-'use strict'
-
-// Shared webpack 5 helpers. webpack 5 removed the automatic Node-core polyfills
-// that webpack 4 provided, so every bundle must declare them explicitly:
-//  - bundlePolyfills(): for bundles that include bsv's own crypto (full bundle,
-//    feature bundles, Shamir CSPRNG via secrets.js) -> real browserify shims +
-//    Buffer/process globals.
-//  - externStubs(): for bundles that externalize bsv and don't need its crypto
-//    -> stub the Node-core modules to empty (the webpack 4 `node: {x:'empty'}`).
-//
-// Both also pin TerserPlugin with extractComments:false so no *.LICENSE.txt
-// sidecar files are emitted (webpack 4 did not emit them; keeps the published
-// file list unchanged).
-
-const webpack = require('webpack')
-const TerserPlugin = require('terser-webpack-plugin')
-
-const FULL_FALLBACK = {
-  crypto: require.resolve('crypto-browserify'),
-  stream: require.resolve('stream-browserify'),
-  buffer: require.resolve('buffer/'),
-  process: require.resolve('process/browser'),
-  assert: require.resolve('assert/'),
-  util: require.resolve('util/'),
-  path: require.resolve('path-browserify'),
-  zlib: require.resolve('browserify-zlib'),
-  vm: require.resolve('vm-browserify'),
-  http: false,
-  https: false,
-  os: false,
-  url: false,
-  fs: false,
-  net: false,
-  tls: false,
-  readline: false,
-  child_process: false
-}
-
-const STUB_FALLBACK = {
-  crypto: false,
-  stream: false,
-  buffer: false,
-  process: false,
-  assert: false,
-  util: false,
-  path: false,
-  zlib: false,
-  vm: false,
-  http: false,
-  https: false,
-  os: false,
-  url: false,
-  fs: false,
-  net: false,
-  tls: false,
-  readline: false,
-  child_process: false
-}
-
-function applyOptimization (config) {
-  config.optimization = Object.assign({ minimize: true }, config.optimization, {
-    minimizer: [new TerserPlugin({ extractComments: false })]
-  })
-  // These are library bundles; the browser asset-size hints are noise here.
-  config.performance = Object.assign({ hints: false }, config.performance)
-}
-
-function merge (config, fallback, plugins) {
-  config.resolve = config.resolve || {}
-  // config-provided fallbacks win over the shared defaults.
-  config.resolve.fallback = Object.assign({}, fallback, config.resolve.fallback)
-  config.plugins = (config.plugins || []).concat(plugins)
-  // Hash module/chunk content with webpack's built-in xxhash64 instead of the default
-  // md4. md4 goes through Node's OpenSSL, which OpenSSL 3 (Node 17+) disables — the sole
-  // reason the build needed `--openssl-legacy-provider` and a pinned Node 18. xxhash64 is
-  // pure (no OpenSSL), so `build-all` runs natively on any modern Node with no flag.
-  config.output = config.output || {}
-  if (!config.output.hashFunction) config.output.hashFunction = 'xxhash64'
-  applyOptimization(config)
-  return config
-}
-
-// For bundles that include bsv's crypto (need real Node-core shims).
-function bundlePolyfills (config) {
-  // secrets.js-grempe (Shamir) is a UMD whose AMD branch calls its factory
-  // WITHOUT the crypto argument. webpack provides `define.amd`, so it takes that
-  // branch and secrets.js receives `crypto === undefined` — its CSPRNG init then
-  // throws ("Initialization failed") and Shamir is broken in the browser.
-  // Disabling AMD for it forces the CommonJS branch — factory(require('crypto'))
-  // — so it gets crypto-browserify and initialises correctly.
-  config.module = config.module || {}
-  config.module.rules = (config.module.rules || []).concat([
-    { test: /secrets\.js-grempe/, parser: { amd: false } }
-  ])
-  // crypto-browserify drags in the whole `elliptic` library via browserify-sign
-  // + create-ecdh (for crypto.createSign/createVerify/createECDH) — APIs bsv
-  // never calls (its EC crypto is @noble). Stub them so `elliptic` is not bundled
-  // (~140KB/bundle). randomBytes/createHash/createHmac (the Shamir CSPRNG and
-  // hashing) are unaffected.
-  config.resolve = config.resolve || {}
-  config.resolve.alias = Object.assign(
-    { 'browserify-sign': false, 'create-ecdh': false },
-    config.resolve.alias
-  )
-  return merge(config, FULL_FALLBACK, [
-    new webpack.ProvidePlugin({ Buffer: ['buffer', 'Buffer'], process: 'process/browser' })
-  ])
-}
-
-// For bundles that externalize/already-embed bsv and don't need its crypto
-// polyfill: stub the heavy Node-core modules to empty (the webpack 4
-// `node: {x:'empty'}`), but still provide the Buffer and process globals —
-// webpack 4 provided both by default and the embedded bsv code relies on them
-// (e.g. process.browser, Buffer).
-function externStubs (config) {
-  const fallback = Object.assign({}, STUB_FALLBACK, {
-    buffer: require.resolve('buffer/'),
-    process: require.resolve('process/browser')
-  })
-  return merge(config, fallback, [
-    new webpack.ProvidePlugin({ Buffer: ['buffer', 'Buffer'], process: 'process/browser' })
-  ])
-}
-
-module.exports = { bundlePolyfills, externStubs }

package/build/webpack.bundle.config.js

@@ -1,15 +0,0 @@
-const path = require('path')
-const { bundlePolyfills } = require('./webpack.base')
-
-// Everything-in-one bundle (bsv.bundle.js). Same polyfill posture as bsv.min.js.
-module.exports = bundlePolyfills({
-  entry: path.join(__dirname, '../bundle-entry.js'),
-  output: {
-    library: 'bsv',
-    libraryTarget: 'umd',
-    globalObject: "typeof self !== 'undefined' ? self : this",
-    path: path.resolve(__dirname, '../'),
-    filename: 'bsv.bundle.js'
-  },
-  mode: 'production'
-})

package/build/webpack.config.js

@@ -1,17 +0,0 @@
-var path = require('path')
-var { bundlePolyfills } = require('./webpack.base')
-
-// Full library bundle (bsv.min.js). webpack 5: Node-core polyfills are declared
-// via bundlePolyfills (crypto-browserify so secrets.js/Shamir gets a CSPRNG in
-// the browser; Buffer global preserved). bsv's own crypto stays pure-JS.
-module.exports = bundlePolyfills({
-  entry: path.join(__dirname, '../index.js'),
-  output: {
-    library: 'bsv',
-    libraryTarget: 'umd',
-    globalObject: "typeof self !== 'undefined' ? self : this",
-    path: path.resolve(__dirname, '../'),
-    filename: 'bsv.min.js'
-  },
-  mode: 'production'
-})

package/build/webpack.covenant.config.js

@@ -1,17 +0,0 @@
-const path = require('path')
-const { externStubs } = require('./webpack.base')
-
-module.exports = externStubs({
-  mode: 'production',
-  entry: path.join(__dirname, '../covenant-entry.js'),
-  output: {
-    path: path.resolve(__dirname, '../'),
-    filename: 'bsv-covenant.min.js',
-    library: 'bsvCovenant',
-    libraryTarget: 'var'
-  },
-  externals: {
-    // Don't bundle BSV - it should be loaded separately
-    '../index.js': 'bsv'
-  }
-})

package/build/webpack.didweb.config.js

@@ -1,15 +0,0 @@
-const path = require('path')
-const { bundlePolyfills } = require('./webpack.base')
-
-module.exports = bundlePolyfills({
-  entry: path.join(__dirname, '../didweb-entry.js'),
-  mode: 'production',
-  output: {
-    path: path.resolve(__dirname, '../'),
-    filename: 'bsv-didweb.min.js',
-    library: 'bsvDIDWeb',
-    libraryTarget: 'umd',
-    globalObject: 'this'
-  },
-  target: 'web'
-})

package/build/webpack.ecies.config.js

@@ -1,15 +0,0 @@
-const path = require('path')
-const { bundlePolyfills } = require('./webpack.base')
-
-module.exports = bundlePolyfills({
-  entry: path.join(__dirname, '../ecies/index.js'),
-  mode: 'production',
-  output: {
-    path: path.resolve(__dirname, '../'),
-    filename: 'bsv-ecies.min.js',
-    library: 'bsvEcies',
-    libraryTarget: 'var'
-  },
-  externals: { '../../': 'bsv' },
-  target: 'web'
-})

package/build/webpack.gdaf.config.js

@@ -1,15 +0,0 @@
-const path = require('path')
-const { bundlePolyfills } = require('./webpack.base')
-
-module.exports = bundlePolyfills({
-  entry: path.join(__dirname, '../gdaf-entry.js'),
-  mode: 'production',
-  output: {
-    path: path.resolve(__dirname, '../'),
-    filename: 'bsv-gdaf.min.js',
-    library: 'bsvGDAF',
-    libraryTarget: 'umd',
-    globalObject: 'this'
-  },
-  target: 'web'
-})

package/build/webpack.ltp.config.js

@@ -1,15 +0,0 @@
-const path = require('path')
-const { bundlePolyfills } = require('./webpack.base')
-
-module.exports = bundlePolyfills({
-  entry: path.join(__dirname, '../ltp-entry.js'),
-  mode: 'production',
-  output: {
-    path: path.resolve(__dirname, '../'),
-    filename: 'bsv-ltp.min.js',
-    library: 'bsvLTP',
-    libraryTarget: 'umd',
-    globalObject: 'this'
-  },
-  target: 'web'
-})

package/build/webpack.message.config.js

@@ -1,15 +0,0 @@
-const path = require('path')
-const { bundlePolyfills } = require('./webpack.base')
-
-module.exports = bundlePolyfills({
-  entry: path.join(__dirname, '../message/index.js'),
-  mode: 'production',
-  output: {
-    path: path.resolve(__dirname, '../'),
-    filename: 'bsv-message.min.js',
-    library: 'bsvMessage',
-    libraryTarget: 'var'
-  },
-  externals: { '../../': 'bsv' },
-  target: 'web'
-})

package/build/webpack.mnemonic.config.js

@@ -1,15 +0,0 @@
-const path = require('path')
-const { bundlePolyfills } = require('./webpack.base')
-
-module.exports = bundlePolyfills({
-  entry: path.join(__dirname, '../mnemonic/index.js'),
-  mode: 'production',
-  output: {
-    path: path.resolve(__dirname, '../'),
-    filename: 'bsv-mnemonic.min.js',
-    library: 'bsvMnemonic',
-    libraryTarget: 'var'
-  },
-  externals: { '../../': 'bsv' },
-  target: 'web'
-})

package/build/webpack.script-helper.config.js

@@ -1,17 +0,0 @@
-const path = require('path')
-const { externStubs } = require('./webpack.base')
-
-module.exports = externStubs({
-  mode: 'production',
-  entry: path.join(__dirname, '../script-helper-entry.js'),
-  output: {
-    path: path.resolve(__dirname, '../'),
-    filename: 'bsv-script-helper.min.js',
-    library: 'bsvScriptHelper',
-    libraryTarget: 'var'
-  },
-  externals: {
-    // Don't bundle BSV - it should be loaded separately
-    '../index.js': 'bsv'
-  }
-})

package/build/webpack.security.config.js

@@ -1,15 +0,0 @@
-const path = require('path')
-const { bundlePolyfills } = require('./webpack.base')
-
-// security-entry embeds bsv (no externals) and needs the crypto polyfill so
-// Shamir/secrets.js gets a CSPRNG in the browser -> full polyfills.
-module.exports = bundlePolyfills({
-  mode: 'production',
-  entry: path.join(__dirname, '../security-entry.js'),
-  output: {
-    path: path.resolve(__dirname, '../'),
-    filename: 'bsv-security.min.js',
-    library: 'bsvSecurity',
-    libraryTarget: 'var'
-  }
-})

package/build/webpack.shamir.config.js

@@ -1,15 +0,0 @@
-const path = require('path')
-const { bundlePolyfills } = require('./webpack.base')
-
-module.exports = bundlePolyfills({
-  entry: path.join(__dirname, '../shamir-entry.js'),
-  mode: 'production',
-  output: {
-    path: path.resolve(__dirname, '../'),
-    filename: 'bsv-shamir.min.js',
-    library: 'bsvShamir',
-    libraryTarget: 'var'
-  },
-  externals: { '../../': 'bsv' },
-  target: 'web'
-})

package/build/webpack.smartcontract.config.js

@@ -1,18 +0,0 @@
-const path = require('path')
-const { externStubs } = require('./webpack.base')
-
-module.exports = externStubs({
-  entry: path.join(__dirname, '../smartcontract-entry.js'),
-  output: {
-    library: 'bsvSmartContract',
-    libraryTarget: 'umd',
-    globalObject: "typeof self !== 'undefined' ? self : this",
-    path: path.resolve(__dirname, '../'),
-    filename: 'bsv-smartcontract.min.js'
-  },
-  externals: {
-    // Don't bundle BSV - expect it to be loaded separately
-    './index.js': 'bsv'
-  },
-  mode: 'production'
-})

package/build/webpack.statuslist.config.js

@@ -1,15 +0,0 @@
-const path = require('path')
-const { bundlePolyfills } = require('./webpack.base')
-
-module.exports = bundlePolyfills({
-  entry: path.join(__dirname, '../statuslist-entry.js'),
-  mode: 'production',
-  output: {
-    path: path.resolve(__dirname, '../'),
-    filename: 'bsv-statuslist.min.js',
-    library: 'bsvStatusList',
-    libraryTarget: 'umd',
-    globalObject: 'this'
-  },
-  target: 'web'
-})

package/build/webpack.vcjwt.config.js

@@ -1,15 +0,0 @@
-const path = require('path')
-const { bundlePolyfills } = require('./webpack.base')
-
-module.exports = bundlePolyfills({
-  entry: path.join(__dirname, '../vcjwt-entry.js'),
-  mode: 'production',
-  output: {
-    path: path.resolve(__dirname, '../'),
-    filename: 'bsv-vcjwt.min.js',
-    library: 'bsvVcJwt',
-    libraryTarget: 'umd',
-    globalObject: 'this'
-  },
-  target: 'web'
-})