@smartledger/bsv 7.5.1 → 7.5.3

package/CHANGELOG.md

@@ -7,6 +7,116 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [7.5.3] - 2026-08-07
+
+### Fixed (security)
+
+- **The anchor key-material guard added in 7.5.1 detected by field name only, which
+  was wrong in both directions.** It refused `{ d: '2026-01-01' }` — telling the
+  caller their date looked like a private key — while publishing a real WIF stored
+  under `note`, an `xprv` under `ref`, or a BIP39 mnemonic under `memo`, because
+  those field names were not on the list. Naming a secret innocuously is exactly
+  what an accidental leak looks like, so name-matching alone could not close the
+  hole it was written for.
+
+  Detection is now by value as well as name, on three independent signals:
+
+  1. **The anchor's own signing key**, in any representation (WIF, hex scalar, the
+     `bn`), is refused wherever it appears. This is the defect the guard exists for,
+     and knowing our own key makes a bare hex scalar catchable at all.
+  2. **Self-identifying secrets** — a WIF that decodes, an `xprv`/`tprv` that parses,
+     a BIP39 phrase that passes wordlist *and* checksum — are refused under **any**
+     field name, at any depth, including inside arrays.
+  3. **Field names**: always for `bn`/`wif`/`privateKey`/`xprv`/`mnemonic`/…, and for
+     ambiguous names (`d`, `seed`, `secret`, `key`) only when the value also decodes
+     as a private key.
+
+  A bare 64-character hex string that is *not* our own key is deliberately still
+  accepted: it cannot be distinguished from a SHA-256 digest, and anchoring a
+  document hash is what this module is for. Public material — addresses, public
+  keys, `xpub` — is accepted, since an anchor legitimately references it.
+
+  15 regression tests pin both directions, including the four leaks the previous
+  guard allowed and the two false positives it produced.
+
+Suite 4579 → 4594.
+
+## [7.5.2] - 2026-08-06
+
+The rest of the field review that produced 7.5.1: declarations that disagreed with
+the code. Most are declaration-only, but four cases needed the **runtime** to change,
+because a declaration matching the old behaviour would have been documenting a bug.
+
+### Fixed (security)
+
+- **`StatusList.getCredentialStatusEntry` was declared synchronous but is `async`.** So
+  `if (getCredentialStatusEntry(...) === 'revoked')` type-checked cleanly and compared a
+  `Promise` to a string — always false. **Every revoked credential passed as valid**, and
+  the type checker was what hid it. It now declares `Promise<CredentialStatus>`, which
+  turns that comparison into a compile error (`'Promise<string>' and '"revoked"' have no
+  overlap`).
+
+- **`updateStatusList` no longer records a suspension as a revocation.** `'suspended'`
+  set the *same bit* as `'revoked'` and read back as `'revoked'`, so a temporary
+  suspension was silently written — and later reported — as a permanent revocation. This
+  implementation hardcodes `statusPurpose: 'revocation'` and uses one bit, so there is
+  nowhere for suspension to go; it now throws, naming the limitation, instead of writing
+  the wrong state.
+
+- **`SmartContract.ownershipToken` dropped its authorizer.** The top-level alias was
+  `function (fee, ownerPubKeyHash)` and called through with only those two arguments, so
+  a **co-signed token built via this path came out single-key** — the authorizer was
+  accepted and discarded. Same silent-argument family as 7.0.1, 7.0.2, 7.2.0, 7.3.0 and
+  7.4.0.
+
+### Fixed
+
+- **`Authorizers.multisig(m, nKeys)` rejects an array.** `nKeys` is a count, but passing
+  keys made `m > nKeys` compare a number to an array — which coerces to `NaN`, so the
+  guard passed and an authorizer was built with the array spliced into its name. It now
+  throws and names the fix. (`Locks.multisig` genuinely does take keys, which is what
+  made this easy to walk into.)
+
+- **Sub-path imports resolve.** `@smartledger/bsv/didweb` and ten siblings were
+  `MODULE_NOT_FOUND`: the `exports` map had no aliases for the `*-entry.js` files, so
+  documented deep imports could not be loaded at all. Eleven aliases added.
+
+- **`securityFeatures` no longer claims `'elliptic-patches'`**, which it advertised long
+  after `elliptic` stopped being a dependency. It is the string a compliance reviewer
+  reads, so it now lists what is actually shipped.
+
+### Changed
+
+Declarations corrected to match the runtime: `Authorizers.multisig(m, nKeys: number)`;
+`AnchorKind` and `CredentialStatus` closed (both were `| string` while the runtime
+enforces a fixed set); `Script.buildSafeDataOut` declared (it was missing while
+`isSafeDataOut` was present, steering TypeScript users to `buildDataOut`, whose bare
+`OP_RETURN` is not provably unspendable); `Message` typed as callable without `new`, the
+form the examples use; `canonicalizeClaim` returns `string`, not `object`;
+`Networks.get`'s `keys` optional; both `ownershipToken` overloads take the authorizer;
+`StatusListReadParams` added so the mandatory `expectedIssuerDid` and key source are
+visible rather than surfacing as a runtime throw.
+
+### Added
+
+- **The type-drift gate now catches async-declared-as-sync.** `test/types/dts_drift.js`
+  compares each declared return type against the runtime function's
+  `constructor.name === 'AsyncFunction'`, so a declaration can no longer hide a Promise.
+  Verified adversarially: reverting the `getCredentialStatusEntry` declaration makes the
+  gate fail. This is the class that produced the revocation bypass above, so it is now
+  mechanically impossible to reintroduce.
+
+- `test/types/surface_honesty.js` covers the runtime-side fixes, including all eleven
+  sub-path entry points.
+
+### Breaking
+
+`updateStatusList` throws on `status: 'suspended'` instead of writing the revocation bit.
+`Authorizers.multisig` throws when handed an array. `AnchorKind` and `CredentialStatus`
+no longer accept arbitrary strings in TypeScript.
+
+Suite 4559 → 4579.
+
 ## [7.5.1] - 2026-08-06
 
 Three defects reported from the field against 7.4.0, each reproduced here before

package/README.md

@@ -186,42 +186,42 @@ console.log('Status:', status) // 'revoked'
 ### **Core Modules**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv.min.js** | 1149KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@7.5.1/bsv.min.js` |
-| **bsv.bundle.js** | 1149KB | Everything in one file | `unpkg.com/@smartledger/bsv@7.5.1/bsv.bundle.js` |
+| **bsv.min.js** | 1149KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@7.5.3/bsv.min.js` |
+| **bsv.bundle.js** | 1149KB | Everything in one file | `unpkg.com/@smartledger/bsv@7.5.3/bsv.bundle.js` |
 
 ### **W3C Verifiable Credentials**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **🟢 bsv-didweb.min.js** | 315KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@7.5.1/bsv-didweb.min.js` |
-| **🟢 bsv-vcjwt.min.js** | 315KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@7.5.1/bsv-vcjwt.min.js` |
-| **🟢 bsv-statuslist.min.js** | 415KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@7.5.1/bsv-statuslist.min.js` |
-| **🟢 bsv-anchor.min.js** | 314KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@7.5.1/bsv-anchor.min.js` |
+| **🟢 bsv-didweb.min.js** | 315KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@7.5.3/bsv-didweb.min.js` |
+| **🟢 bsv-vcjwt.min.js** | 315KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@7.5.3/bsv-vcjwt.min.js` |
+| **🟢 bsv-statuslist.min.js** | 415KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@7.5.3/bsv-statuslist.min.js` |
+| **🟢 bsv-anchor.min.js** | 314KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@7.5.3/bsv-anchor.min.js` |
 
 ### **Smart Contract & Development**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-smartcontract.min.js** | 873KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@7.5.1/bsv-smartcontract.min.js` |
-| **bsv-covenant.min.js** | 873KB | Covenant operations | `unpkg.com/@smartledger/bsv@7.5.1/bsv-covenant.min.js` |
-| **bsv-script-helper.min.js** | 30KB | Custom script tools | `unpkg.com/@smartledger/bsv@7.5.1/bsv-script-helper.min.js` |
-| **bsv-security.min.js** | 30KB | Security enhancements | `unpkg.com/@smartledger/bsv@7.5.1/bsv-security.min.js` |
+| **bsv-smartcontract.min.js** | 873KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@7.5.3/bsv-smartcontract.min.js` |
+| **bsv-covenant.min.js** | 873KB | Covenant operations | `unpkg.com/@smartledger/bsv@7.5.3/bsv-covenant.min.js` |
+| **bsv-script-helper.min.js** | 30KB | Custom script tools | `unpkg.com/@smartledger/bsv@7.5.3/bsv-script-helper.min.js` |
+| **bsv-security.min.js** | 30KB | Security enhancements | `unpkg.com/@smartledger/bsv@7.5.3/bsv-security.min.js` |
 
 ### **Legal & Compliance**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-ltp.min.js** | 1149KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@7.5.1/bsv-ltp.min.js` |
-| **bsv-gdaf.min.js** | 1149KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@7.5.1/bsv-gdaf.min.js` |
+| **bsv-ltp.min.js** | 1149KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@7.5.3/bsv-ltp.min.js` |
+| **bsv-gdaf.min.js** | 1149KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@7.5.3/bsv-gdaf.min.js` |
 
 ### **Advanced Cryptography**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-shamir.min.js** | 353KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@7.5.1/bsv-shamir.min.js` |
+| **bsv-shamir.min.js** | 353KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@7.5.3/bsv-shamir.min.js` |
 
 ### **Utilities**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-ecies.min.js** | 79KB | Encryption | `unpkg.com/@smartledger/bsv@7.5.1/bsv-ecies.min.js` |
-| **bsv-message.min.js** | 30KB | Message signing | `unpkg.com/@smartledger/bsv@7.5.1/bsv-message.min.js` |
-| **bsv-mnemonic.min.js** | 592KB | HD wallets | `unpkg.com/@smartledger/bsv@7.5.1/bsv-mnemonic.min.js` |
+| **bsv-ecies.min.js** | 79KB | Encryption | `unpkg.com/@smartledger/bsv@7.5.3/bsv-ecies.min.js` |
+| **bsv-message.min.js** | 30KB | Message signing | `unpkg.com/@smartledger/bsv@7.5.3/bsv-message.min.js` |
+| **bsv-mnemonic.min.js** | 592KB | HD wallets | `unpkg.com/@smartledger/bsv@7.5.3/bsv-mnemonic.min.js` |
 
 ## ⚡ **2-Minute Quick Start**
 
@@ -232,7 +232,7 @@ Get started with Bitcoin SV development in under 2 minutes:
 npm install @smartledger/bsv
 
 # Or include in HTML
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv.min.js"></script>
 ```
 
 > **🔒 v5.0.0 (production hardening — has breaking changes):** Shamir secret
@@ -332,8 +332,8 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
 
 ### 🔧 **Basic Development** (~1.2MB total)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv-script-helper.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv-script-helper.min.js"></script>
 <script>
   const privateKey = new bsv.PrivateKey();
   const utxos = new bsv.SmartContract.UTXOGenerator().createRealUTXOs(2, 100000);
@@ -342,9 +342,9 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
 
 ### 🔒 **Smart Contract Development** (~2.8MB total — each bundle re-embeds core BSV)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv-covenant.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv-covenant.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv-smartcontract.min.js"></script>
 <script>
   const covenant = bsv.SmartContract.createCovenantBuilder()
     .extractField('amount').push(50000).greaterThanOrEqual().verify().build();
@@ -354,9 +354,9 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
 
 ### 🆕 **Legal & Identity Development** (~3.4MB total — each bundle re-embeds core BSV)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv-ltp.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv-gdaf.min.js"></script>
 <script>
   // Legal Token Protocol
   const propertyToken = bsv.createPropertyToken({
@@ -370,9 +370,9 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
 
 ### 🆕 **Security & Cryptography** (~1.5MB total)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv-security.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv-shamir.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv-security.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv-shamir.min.js"></script>
 <script>
   // Threshold Cryptography
   const shares = bsv.splitSecret('my_secret_key', 5, 3); // 5 shares, 3 needed
@@ -384,7 +384,7 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
 
 ### 🎯 **Everything Bundle** (~1.1MB)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv.bundle.js"></script>
 <script>
   // Everything available immediately
   const shares = bsv.splitSecret('secret', 5, 3);           // Shamir Secret Sharing
@@ -494,8 +494,8 @@ const contractTx = covenant.createCovenantTransaction({
 
 #### 1. **Minimal Setup** - Core + Script Helper (~1.2MB)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv-script-helper.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv-script-helper.min.js"></script>
 <script>
   const tx = new bsv.Transaction();
   const sig = bsvScriptHelper.createSignature(tx, privateKey, 0, script, satoshis);
@@ -504,9 +504,9 @@ const contractTx = covenant.createCovenantTransaction({
 
 #### 2. **DeFi Development** - Core + Covenants + Debug (~2.8MB — each bundle re-embeds core BSV)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv-covenant.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv-covenant.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv-smartcontract.min.js"></script>
 <script>
   const covenant = new bsvCovenant.CovenantInterface();
   const debugInfo = SmartContract.interpretScript(script);
@@ -516,8 +516,8 @@ const contractTx = covenant.createCovenantTransaction({
 
 #### 3. **Security First** - Core + Enhanced Security (~1.2MB)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv-security.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv-security.min.js"></script>
 <script>
   const verified = bsvSecurity.SmartVerify.verify(signature, hash, publicKey);
   const enhanced = bsvSecurity.EllipticFixed.createSignature(privateKey, hash);
@@ -526,7 +526,7 @@ const contractTx = covenant.createCovenantTransaction({
 
 #### 4. **Everything Bundle** - One File Solution (~1.1MB)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.5.1/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.3/bsv.bundle.js"></script>
 <script>
   // Everything available under bsv namespace
   const keys = bsv.SmartLedgerBundle.generateKeys();
@@ -834,7 +834,7 @@ const timelockScript = helper.createTimelockScript(
 
 See the **[16 Loading Options](#-16-loading-options---choose-your-approach)**
 table near the top for the full list of bundles with current sizes and
-canonical `unpkg.com/@smartledger/bsv@7.5.1/...` URLs.
+canonical `unpkg.com/@smartledger/bsv@7.5.3/...` URLs.
 
 ## 🔐 Security