@smartledger/bsv 7.5.1 → 7.5.2

package/docs/MODULE_REFERENCE_COMPLETE.md

@@ -55,19 +55,19 @@ Three advanced modules totaling **~2.7MB** of functionality:
 - **Purpose**: Threshold cryptography for secure secret distribution
 - **Use Cases**: Backup keys, multi-party security, key recovery
 - **Features**: Split secrets into N shares, require M to reconstruct
-- **CDN**: `unpkg.com/@smartledger/bsv@7.5.1/bsv-shamir.min.js`
+- **CDN**: `unpkg.com/@smartledger/bsv@7.5.2/bsv-shamir.min.js`
 
 #### **🌐 Global Digital Attestation Framework - GDAF (1184KB)**  
 - **Purpose**: W3C Verifiable Credentials and decentralized identity
 - **Use Cases**: Identity verification, attestations, zero-knowledge proofs
 - **Features**: DID creation, credential issuance, selective disclosure
-- **CDN**: `unpkg.com/@smartledger/bsv@7.5.1/bsv-gdaf.min.js`
+- **CDN**: `unpkg.com/@smartledger/bsv@7.5.2/bsv-gdaf.min.js`
 
 #### **⚖️ Legal Token Protocol - LTP (1184KB)**
 - **Purpose**: Legal compliance framework for tokenized assets
 - **Use Cases**: Property rights, obligations, compliant tokenization  
 - **Features**: Legal primitives, compliance checking, attestation anchoring
-- **CDN**: `unpkg.com/@smartledger/bsv@7.5.1/bsv-ltp.min.js`
+- **CDN**: `unpkg.com/@smartledger/bsv@7.5.2/bsv-ltp.min.js`
 
 ### **2. Incorrect File Sizes in Documentation**
 
@@ -81,18 +81,18 @@ Three advanced modules totaling **~2.7MB** of functionality:
 
 | Module | Size | Use Case | CDN Link |
 |--------|------|----------|----------|
-| **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@7.5.1/bsv.min.js` |
-| **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@7.5.1/bsv.bundle.js` |
-| **bsv-smartcontract.min.js** | 937KB | Covenant development | `unpkg.com/@smartledger/bsv@7.5.1/bsv-smartcontract.min.js` |
-| **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@7.5.1/bsv-covenant.min.js` |
-| **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@7.5.1/bsv-script-helper.min.js` |
-| **bsv-security.min.js** | 26KB | Security enhancements (opt-in helpers — see README › Security) | `unpkg.com/@smartledger/bsv@7.5.1/bsv-security.min.js` |
-| **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@7.5.1/bsv-ecies.min.js` |
-| **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@7.5.1/bsv-message.min.js` |
-| **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@7.5.1/bsv-mnemonic.min.js` |
-| **🆕 bsv-shamir.min.js** | 432KB | **Secret sharing** | `unpkg.com/@smartledger/bsv@7.5.1/bsv-shamir.min.js` |
-| **🆕 bsv-gdaf.min.js** | 1184KB | **Digital attestation** | `unpkg.com/@smartledger/bsv@7.5.1/bsv-gdaf.min.js` |
-| **🆕 bsv-ltp.min.js** | 1184KB | **Legal tokens** | `unpkg.com/@smartledger/bsv@7.5.1/bsv-ltp.min.js` |
+| **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@7.5.2/bsv.min.js` |
+| **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@7.5.2/bsv.bundle.js` |
+| **bsv-smartcontract.min.js** | 937KB | Covenant development | `unpkg.com/@smartledger/bsv@7.5.2/bsv-smartcontract.min.js` |
+| **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@7.5.2/bsv-covenant.min.js` |
+| **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@7.5.2/bsv-script-helper.min.js` |
+| **bsv-security.min.js** | 26KB | Security enhancements (opt-in helpers — see README › Security) | `unpkg.com/@smartledger/bsv@7.5.2/bsv-security.min.js` |
+| **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@7.5.2/bsv-ecies.min.js` |
+| **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@7.5.2/bsv-message.min.js` |
+| **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@7.5.2/bsv-mnemonic.min.js` |
+| **🆕 bsv-shamir.min.js** | 432KB | **Secret sharing** | `unpkg.com/@smartledger/bsv@7.5.2/bsv-shamir.min.js` |
+| **🆕 bsv-gdaf.min.js** | 1184KB | **Digital attestation** | `unpkg.com/@smartledger/bsv@7.5.2/bsv-gdaf.min.js` |
+| **🆕 bsv-ltp.min.js** | 1184KB | **Legal tokens** | `unpkg.com/@smartledger/bsv@7.5.2/bsv-ltp.min.js` |
 
 ## 🎯 **Updated Usage Examples**
 
@@ -100,22 +100,22 @@ Three advanced modules totaling **~2.7MB** of functionality:
 
 #### **1. Basic Development (~963KB)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv-script-helper.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.2/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.2/bsv-script-helper.min.js"></script>
 ```
 
 #### **2. Smart Contract Development (~2.7MB — each bundle re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv-covenant.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.2/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.2/bsv-covenant.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.2/bsv-smartcontract.min.js"></script>
 ```
 
 #### **3. 🆕 Legal & Compliance Development (~3.2MB — each bundle re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv-ltp.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.2/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.2/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.2/bsv-gdaf.min.js"></script>
 <script>
   // Legal Token Protocol
   const legalToken = bsv.createLegalToken({
@@ -132,9 +132,9 @@ Three advanced modules totaling **~2.7MB** of functionality:
 
 #### **4. 🆕 Security & Cryptography (~1.4MB)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv-security.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv-shamir.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.2/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.2/bsv-security.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.2/bsv-shamir.min.js"></script>
 <script>
   // Shamir Secret Sharing
   const shares = bsv.splitSecret('my_secret_key', 5, 3); // 5 shares, 3 needed
@@ -146,7 +146,7 @@ Three advanced modules totaling **~2.7MB** of functionality:
 
 #### **5. Everything Bundle (937KB)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.2/bsv.bundle.js"></script>
 <script>
   // Everything available immediately
   const shares = bsv.splitSecret('secret', 5, 3);

package/docs/advanced/UTXO_MANAGER_GUIDE.md

@@ -722,7 +722,7 @@ interface UTXO {
 <html>
 <head>
     <title>UTXO Manager Demo</title>
-    <script src="https://cdn.jsdelivr.net/npm/@smartledger/bsv@7.5.1/bsv.min.js"></script>
+    <script src="https://cdn.jsdelivr.net/npm/@smartledger/bsv@7.5.2/bsv.min.js"></script>
 </head>
 <body>
     <script>

package/docs/getting-started/INSTALLATION.md

@@ -48,7 +48,7 @@ const tx: Transaction = new Transaction();
 #### **Core Library Only (937KB)**
 For basic Bitcoin SV operations:
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.2/bsv.min.js"></script>
 <script>
   const privateKey = new bsv.PrivateKey();
   const address = privateKey.toAddress();
@@ -58,7 +58,7 @@ For basic Bitcoin SV operations:
 #### **Complete Bundle (937KB)**  
 Everything in one file:
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.2/bsv.bundle.js"></script>
 <script>
   // All features available immediately
   const shares = bsv.splitSecret('secret', 5, 3);
@@ -71,9 +71,9 @@ Everything in one file:
 
 #### **Smart Contract Development (~2.7MB total — each bundle is self-contained and re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv-covenant.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.2/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.2/bsv-covenant.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.2/bsv-smartcontract.min.js"></script>
 <script>
   const covenant = bsv.SmartContract.createCovenantBuilder()
     .extractField('amount').push(50000).greaterThanOrEqual().build();
@@ -82,9 +82,9 @@ Everything in one file:
 
 #### **Legal & Identity Development (~3.2MB total — each bundle is self-contained and re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv-ltp.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.2/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.2/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.2/bsv-gdaf.min.js"></script>
 <script>
   // Legal Token Protocol
   const propertyToken = bsv.createPropertyToken({
@@ -98,9 +98,9 @@ Everything in one file:
 
 #### **Security & Cryptography (~1.4MB total — each bundle is self-contained and re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv-security.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv-shamir.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.2/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.2/bsv-security.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.2/bsv-shamir.min.js"></script>
 <script>
   // Threshold Cryptography
   const shares = bsv.splitSecret('my_secret_key', 5, 3);
@@ -114,18 +114,18 @@ Everything in one file:
 
 | Module | Size | Purpose | CDN Link |
 |--------|------|---------|----------|
-| **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@7.5.1/bsv.min.js` |
-| **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@7.5.1/bsv.bundle.js` |
-| **bsv-smartcontract.min.js** | 937KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@7.5.1/bsv-smartcontract.min.js` |
-| **bsv-ltp.min.js** | 1184KB | **Legal Token Protocol** | `unpkg.com/@smartledger/bsv@7.5.1/bsv-ltp.min.js` |
-| **bsv-gdaf.min.js** | 1184KB | **Digital Identity & Attestation** | `unpkg.com/@smartledger/bsv@7.5.1/bsv-gdaf.min.js` |
-| **bsv-shamir.min.js** | 432KB | **Threshold Cryptography** | `unpkg.com/@smartledger/bsv@7.5.1/bsv-shamir.min.js` |
-| **bsv-security.min.js** | 26KB | Security enhancements (opt-in helpers — see README › Security) | `unpkg.com/@smartledger/bsv@7.5.1/bsv-security.min.js` |
-| **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@7.5.1/bsv-mnemonic.min.js` |
-| **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@7.5.1/bsv-ecies.min.js` |
-| **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@7.5.1/bsv-covenant.min.js` |
-| **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@7.5.1/bsv-script-helper.min.js` |
-| **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@7.5.1/bsv-message.min.js` |
+| **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@7.5.2/bsv.min.js` |
+| **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@7.5.2/bsv.bundle.js` |
+| **bsv-smartcontract.min.js** | 937KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@7.5.2/bsv-smartcontract.min.js` |
+| **bsv-ltp.min.js** | 1184KB | **Legal Token Protocol** | `unpkg.com/@smartledger/bsv@7.5.2/bsv-ltp.min.js` |
+| **bsv-gdaf.min.js** | 1184KB | **Digital Identity & Attestation** | `unpkg.com/@smartledger/bsv@7.5.2/bsv-gdaf.min.js` |
+| **bsv-shamir.min.js** | 432KB | **Threshold Cryptography** | `unpkg.com/@smartledger/bsv@7.5.2/bsv-shamir.min.js` |
+| **bsv-security.min.js** | 26KB | Security enhancements (opt-in helpers — see README › Security) | `unpkg.com/@smartledger/bsv@7.5.2/bsv-security.min.js` |
+| **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@7.5.2/bsv-mnemonic.min.js` |
+| **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@7.5.2/bsv-ecies.min.js` |
+| **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@7.5.2/bsv-covenant.min.js` |
+| **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@7.5.2/bsv-script-helper.min.js` |
+| **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@7.5.2/bsv-message.min.js` |
 
 ## ⚙️ **Development Environment Setup**
 

package/docs/getting-started/QUICK_START.md

@@ -14,10 +14,10 @@ npm install @smartledger/bsv
 ### Browser CDN (Instant)
 ```html
 <!-- Core library (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.2/bsv.min.js"></script>
 
 <!-- Everything included (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.2/bsv.bundle.js"></script>
 ```
 
 ## 💰 **Your First Transaction (60 seconds)**
@@ -127,19 +127,19 @@ SmartLedger-BSV offers 12 different loading options - use only what you need:
 
 ```html
 <!-- Core BSV only (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.2/bsv.min.js"></script>
 
 <!-- Smart contracts (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.2/bsv-smartcontract.min.js"></script>
 
 <!-- Legal tokens (1.16MB) -->
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.2/bsv-ltp.min.js"></script>
 
 <!-- Digital identity (1.16MB) -->
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.2/bsv-gdaf.min.js"></script>
 
 <!-- Everything (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.2/bsv.bundle.js"></script>
 ```
 
 ## ⚡ **Key Advantages**

package/docs/migration/FROM_BSV_1_5_6.md

@@ -159,17 +159,17 @@ const recovered = bsv.reconstructSecret([shares[0], shares[2], shares[4]]);
 ### **New Modular Options** 
 ```html
 <!-- Core compatibility (same size as bsv@1.5.6) -->
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.2/bsv.min.js"></script>
 
 <!-- Add smart contracts when ready -->
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.2/bsv-smartcontract.min.js"></script>
 
 <!-- Add advanced features as needed -->
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv-ltp.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.2/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.2/bsv-gdaf.min.js"></script>
 
 <!-- Everything in one file -->
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.2/bsv.bundle.js"></script>
 ```
 
 ## 🔍 **Testing Your Migration**

package/index.js

@@ -57,7 +57,10 @@ bsv.securityFeatures = [
   'canonical-signatures',
   'malleability-protection',
   'enhanced-validation',
-  'elliptic-patches'
+  // 'elliptic-patches' was listed here long after `elliptic` stopped being a dependency.
+  // This array is what a compliance reviewer reads, so it states what is actually true.
+  'audited-noble-curves',
+  'fail-closed-verification'
 ]
 
 // crypto

package/lib/smart_contract/authorizers.js

@@ -78,6 +78,14 @@ function redeemScript (m, pubkeys) {
 }
 
 function multisig (m, nKeys) {
+  // `nKeys` is a COUNT, not the keys. Passing an array made `m > nKeys` compare a number
+  // to an array, which coerces to NaN, so the guard passed and an authorizer was built
+  // with the array spliced into its name — broken, but silently.
+  if (typeof nKeys !== 'number' || !Number.isInteger(nKeys)) {
+    throw new Error('multisig(m, nKeys): nKeys is the NUMBER of keys, not the keys themselves' +
+      (Array.isArray(nKeys) ? ' — pass ' + nKeys.length + ' instead of the array' : ''))
+  }
+  if (typeof m !== 'number' || !Number.isInteger(m)) throw new Error('multisig(m, nKeys): m must be an integer')
   if (m < 1 || m > nKeys || nKeys < 1 || nKeys > 16) throw new Error('multisig requires 1 <= m <= n <= 16')
   return {
     name: m + '-of-' + nKeys + '-multisig',

package/lib/smart_contract/index.js

@@ -80,8 +80,10 @@ SmartContract.perpetualCovenant = function (fee) {
 }
 // Stateful ownership token (NFT) locking script. ownerPubKeyHash = HASH160 of the
 // owner's public key (SmartContract.Token.ownerId); transfers are ECDSA-authorized.
-SmartContract.ownershipToken = function (fee, ownerPubKeyHash) {
-  return SmartContract.Token.ownershipToken(fee, ownerPubKeyHash)
+// `auth` was NOT forwarded here, so a co-signed token built through this alias silently
+// came out single-key — the authorizer was accepted and dropped.
+SmartContract.ownershipToken = function (fee, ownerPubKeyHash, auth) {
+  return SmartContract.Token.ownershipToken(fee, ownerPubKeyHash, auth)
 }
 // OP_PUSH_TX value/output covenant: coins can only go where the covenant says.
 SmartContract.valueCovenant = function (expectedHashOutputs) {

package/lib/statuslist/index.js

@@ -115,6 +115,11 @@ async function updateStatusList(params) {
   if (!params.listVcJwt || params.index === undefined || !params.status || !params.privateJwk) {
     throw new Error('listVcJwt, index, status, and privateJwk are required')
   }
+  if (params.status === 'suspended') {
+    throw new Error("status 'suspended' is not supported by this list: its statusPurpose " +
+      "is 'revocation', and suspension would be written to the same bit and read back as " +
+      "'revoked'. Maintain a separate list for suspension until statusPurpose is configurable.")
+  }
 
   // Verify the existing list's signature+issuer before building on top of it —
   // an unverified base list lets an attacker seed forged revocation state.
@@ -132,9 +137,12 @@ async function updateStatusList(params) {
     throw new Error('Index out of range')
   }
 
-  // StatusList2021 uses 2 bits per credential for 4 states
-  // For simplicity, we'll use single bit: 0=valid, 1=revoked/suspended
-  var statusBit = (params.status === 'revoked' || params.status === 'suspended') ? 1 : 0
+  // StatusList2021 uses 2 bits per credential for 4 states; this implementation uses a
+  // single bit (0 = valid, 1 = revoked) and hardcodes statusPurpose: 'revocation'.
+  // 'suspended' therefore has nowhere to go: it used to set the SAME bit as 'revoked' and
+  // read back as 'revoked', so a suspension was silently recorded — and reported — as a
+  // permanent revocation. Fail closed rather than lie about which state was written.
+  var statusBit = params.status === 'revoked' ? 1 : 0
   
   if (statusBit === 1) {
     bitstring[byteIndex] |= (1 << bitIndex)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smartledger/bsv",
-  "version": "7.5.1",
+  "version": "7.5.2",
   "description": "🚀 Complete Bitcoin SV development framework with legally-recognizable DID:web + W3C VC-JWT toolkit, Legal Token Protocol (LTP), Global Digital Attestation Framework (GDAF), StatusList2021 revocation, and 16 flexible loading options. Standards-based credentials with ES256/ES256K support, on-chain BSV anchoring, and comprehensive Bitcoin SV API. Perfect for legal tokens, verifiable credentials, DeFi, smart contracts, and secure Bitcoin applications.",
   "author": "SmartLedger Technology <hello@smartledger.technology> (https://smartledger.technology)",
   "homepage": "https://github.com/codenlighten/smartledger-bsv#readme",
@@ -18,6 +18,17 @@
     },
     "./package.json": "./package.json",
     "./version": "./version.js",
+    "./anchor": "./anchor-entry.js",
+    "./covenant": "./covenant-entry.js",
+    "./didweb": "./didweb-entry.js",
+    "./gdaf": "./gdaf-entry.js",
+    "./ltp": "./ltp-entry.js",
+    "./script-helper": "./script-helper-entry.js",
+    "./security": "./security-entry.js",
+    "./shamir": "./shamir-entry.js",
+    "./smartcontract": "./smartcontract-entry.js",
+    "./statuslist": "./statuslist-entry.js",
+    "./vcjwt": "./vcjwt-entry.js",
     "./lib/*.js": "./lib/*.js",
     "./lib/*": "./lib/*.js",
     "./*": "./*"

package/test/types/dts_drift.js

@@ -45,7 +45,9 @@ function collectDeclaredPaths (source) {
       } else if (ts.isClassDeclaration(node) && node.name) {
         paths.push(prefix.concat(node.name.text))
       } else if (ts.isFunctionDeclaration(node) && node.name) {
-        paths.push(prefix.concat(node.name.text))
+        var p = prefix.concat(node.name.text)
+        p.returnType = node.type ? node.type.getText() : null
+        paths.push(p)
       } else if (ts.isVariableStatement(node)) {
         node.declarationList.declarations.forEach(function (d) {
           if (ts.isIdentifier(d.name)) paths.push(prefix.concat(d.name.text))
@@ -89,6 +91,26 @@ describe('types: bsv.d.ts does not drift from runtime', function () {
     { label: 'SPV', obj: bsv.SPV, decl: 'SPV' }
   ]
 
+  // An `async` runtime function declared with a non-Promise return type is the most
+  // dangerous kind of drift, because the type checker actively hides the bug rather than
+  // merely failing to catch it: `StatusList.getCredentialStatusEntry` was declared
+  // `: CredentialStatus` while being async, so `if (fn(...) === 'revoked')` compiled clean
+  // and was ALWAYS false — every revoked credential passed as valid.
+  it('no async runtime function is declared with a synchronous return type', function () {
+    var lies = []
+    declaredPaths.forEach(function (segs) {
+      if (!segs.returnType) return
+      var fn = resolve(bsv, segs)
+      if (typeof fn !== 'function') return
+      var isAsync = fn.constructor && fn.constructor.name === 'AsyncFunction'
+      var declaresPromise = /\bPromise\s*</.test(segs.returnType)
+      if (isAsync && !declaresPromise) {
+        lies.push(segs.join('.') + ' is async but is declared `: ' + segs.returnType + '`')
+      }
+    })
+    lies.should.deep.equal([], 'these declarations hide a Promise:\n  ' + lies.join('\n  '))
+  })
+
   AUDITED.forEach(function (ns) {
     it('every runtime function on ' + ns.label + ' is declared in bsv.d.ts', function () {
       ns.obj.should.be.an('object')

package/test/types/surface_honesty.js

@@ -0,0 +1,102 @@
+'use strict'
+
+/* global describe, it */
+
+// Runtime half of a field review that found declarations disagreeing with the code.
+// The declarations themselves are gated by dts_drift.js and by the tsc check in CI; the
+// cases below are the ones where the RUNTIME also had to change, because a declaration
+// that merely matched the old behaviour would have been documenting a bug.
+
+var should = require('chai').should()
+var bsv = require('../..')
+var SC = bsv.SmartContract
+
+describe('public surface tells the truth about itself', function () {
+  describe('SmartContract.ownershipToken forwards its authorizer', function () {
+    it('is not a two-argument alias that drops the third', function () {
+      // The top-level alias took (fee, ownerPubKeyHash) and called through with only
+      // those two, so a co-signed token built via this path came out single-key — the
+      // authorizer was accepted and silently discarded.
+      var auth = SC.Authorizers.multisig(2, 3)
+      var withAuth = SC.ownershipToken(1, Buffer.alloc(20), auth).toHex()
+      var without = SC.ownershipToken(1, Buffer.alloc(20)).toHex()
+      withAuth.should.not.equal(without)
+    })
+
+    it('agrees with SmartContract.Token.ownershipToken', function () {
+      var auth = SC.Authorizers.multisig(2, 3)
+      SC.ownershipToken(1, Buffer.alloc(20), auth).toHex()
+        .should.equal(SC.Token.ownershipToken(1, Buffer.alloc(20), auth).toHex())
+    })
+  })
+
+  describe('Authorizers.multisig takes a key COUNT', function () {
+    it('rejects an array of keys instead of silently building a broken authorizer', function () {
+      // `m > nKeys` compared a number to an array, which coerces to NaN, so the guard
+      // passed and the array was interpolated into the authorizer's name.
+      var keys = [1, 2, 3].map(function () {
+        return bsv.PrivateKey.fromRandom().toPublicKey().toBuffer()
+      })
+      ;(function () { SC.Authorizers.multisig(2, keys) }).should.throw(/NUMBER of keys/)
+      // The message names the fix.
+      ;(function () { SC.Authorizers.multisig(2, keys) }).should.throw(/pass 3 instead/)
+    })
+
+    it('still accepts the documented count form', function () {
+      SC.Authorizers.multisig(2, 3).n.should.equal(3)
+      SC.Authorizers.multisig(2, 3).m.should.equal(2)
+    })
+
+    it('rejects non-integer m', function () {
+      (function () { SC.Authorizers.multisig('2', 3) }).should.throw(/m must be an integer/)
+    })
+  })
+
+  describe('StatusList refuses to record a suspension as a revocation', function () {
+    it('throws on status: suspended rather than setting the revocation bit', function () {
+      // Both statuses set the SAME bit and read back as 'revoked', so a suspension was
+      // silently recorded — and later reported — as a permanent revocation.
+      return bsv.StatusList.updateStatusList({
+        listVcJwt: 'x', index: 1, status: 'suspended', privateJwk: {}
+      }).then(
+        function () { throw new Error('should not have accepted suspended') },
+        function (err) { err.message.should.match(/'suspended' is not supported/) }
+      )
+    })
+  })
+
+  describe('securityFeatures describes what is actually shipped', function () {
+    it('no longer claims elliptic patches, since elliptic is not a dependency', function () {
+      var pkg = require('../../package.json')
+      var deps = Object.keys(pkg.dependencies || {})
+      deps.indexOf('elliptic').should.equal(-1)
+      bsv.securityFeatures.indexOf('elliptic-patches').should.equal(-1)
+      bsv.securityFeatures.should.be.an('array')
+      bsv.securityFeatures.length.should.be.above(0)
+    })
+  })
+
+  describe('documented sub-path entry points resolve', function () {
+    // Every one of these was MODULE_NOT_FOUND: the package `exports` map had no aliases
+    // for the *-entry.js files, so a documented deep import could not be loaded at all.
+    var SUBPATHS = ['didweb', 'vcjwt', 'gdaf', 'ltp', 'statuslist', 'shamir',
+      'anchor', 'covenant', 'security', 'smartcontract', 'script-helper']
+
+    SUBPATHS.forEach(function (name) {
+      it('@smartledger/bsv/' + name, function () {
+        var mod = require('@smartledger/bsv/' + name)
+        // Some entry points export a class (a function), others a namespace object.
+        var t = typeof mod
+        t.should.be.oneOf(['object', 'function'])
+        should.exist(mod)
+      })
+    })
+
+    it('still resolves the package root and lib deep imports', function () {
+      require('@smartledger/bsv').should.be.an('object')
+      require('@smartledger/bsv/version').should.be.a('string')
+      // Directory deep-imports need the explicit file — a documented 7.0 exports break.
+      require('@smartledger/bsv/lib/ordinals/index.js').should.be.an('object')
+    })
+  })
+})

package/version.js

@@ -1,3 +1,3 @@
 'use strict'
 // GENERATED by scripts/sync-version.js on `npm version` — do not edit.
-module.exports = '7.5.1'
+module.exports = '7.5.2'