@smartledger/bsv 7.9.0 → 7.10.1

package/lib/smart_contract/stack_examiner.js

@@ -13,98 +13,105 @@
  */
 
 // Browser-safe require
-const bsv = (typeof window !== 'undefined' && window.bsv) ? window.bsv : require('../../index.js');
-const util = require('util');
+const _global = (typeof window !== 'undefined' && window.bsv) ? window.bsv : null
+const Script = _global ? _global.Script : require('../script')
+const Interpreter = _global ? _global.Script.Interpreter : require('../script/interpreter')
+const Opcode = _global ? _global.Opcode : require('../opcode')
+const Transaction = _global ? _global.Transaction : require('../transaction')
+const Input = _global ? _global.Transaction.Input : require('../transaction/input')
+const Output = _global ? _global.Transaction.Output : require('../transaction/output')
+const BN = _global ? _global.crypto.BN : require('../crypto/bn')
+const util = require('util')
 
-function bufferToHexArray(stack) {
-  return stack.map((buf) => buf.toString('hex'));
+function bufferToHexArray (stack) {
+  return stack.map((buf) => buf.toString('hex'))
 }
 
 /**
  * Executes a locking/unlocking script and prints intermediate stack states.
  */
-function runScript(lockingHex, unlockingHex) {
-  console.log("===========================================");
-  console.log("🔍 STACK EXAMINATION TOOL");
-  console.log("===========================================\n");
+function runScript (lockingHex, unlockingHex) {
+  console.log('===========================================')
+  console.log('🔍 STACK EXAMINATION TOOL')
+  console.log('===========================================\n')
 
-  console.log("🔐 Locking Script:", lockingHex);
-  console.log("🔓 Unlocking Script:", unlockingHex);
-  console.log("-------------------------------------------");
+  console.log('🔐 Locking Script:', lockingHex)
+  console.log('🔓 Unlocking Script:', unlockingHex)
+  console.log('-------------------------------------------')
 
   try {
-    const lockingScript = bsv.Script.fromHex(lockingHex);
-    const unlockingScript = bsv.Script.fromHex(unlockingHex);
+    const lockingScript = Script.fromHex(lockingHex)
+    const unlockingScript = Script.fromHex(unlockingHex)
 
-    const combined = bsv.Script.fromBuffer(
+    const combined = Script.fromBuffer(
       Buffer.concat([unlockingScript.toBuffer(), lockingScript.toBuffer()])
-    );
+    )
+
+    const interpreter = new Interpreter()
+    const tx = new Transaction()
 
-    const interpreter = new bsv.Script.Interpreter();
-    const tx = new bsv.Transaction();
-    
     // Create proper transaction context
-    const dummyInput = new bsv.Transaction.Input({
+    const dummyInput = new Input({
       prevTxId: '0'.repeat(64),
       outputIndex: 0,
-      script: bsv.Script.empty()
-    });
-    
-    tx.addInput(dummyInput);
-    tx.addOutput(new bsv.Transaction.Output({ 
-      satoshis: 100000, 
-      script: lockingScript 
-    }));
-
-    const scriptChunks = combined.chunks;
-    const sandbox = new bsv.Script.Interpreter();
-    sandbox.script = combined;
-    sandbox.tx = tx;
-    sandbox.nIn = 0;
-    sandbox.flags = bsv.Script.Interpreter.SCRIPT_ENABLE_SIGHASH_FORKID;
+      script: Script.empty()
+    })
+
+    tx.addInput(dummyInput)
+    tx.addOutput(new Output({
+      satoshis: 100000,
+      script: lockingScript
+    }))
+
+    const scriptChunks = combined.chunks
+    const sandbox = new Interpreter()
+    sandbox.script = combined
+    sandbox.tx = tx
+    sandbox.nIn = 0
+    sandbox.flags = Interpreter.SCRIPT_ENABLE_SIGHASH_FORKID
 
     // Step through each opcode
     for (let i = 0; i < scriptChunks.length; i++) {
-      const chunk = scriptChunks[i];
+      const chunk = scriptChunks[i]
       try {
         // Check if step method exists (compatibility check)
         if (typeof sandbox.step === 'function') {
-          sandbox.step();
+          sandbox.step()
         } else {
-          console.log("⚠️ Step-by-step execution not supported in this BSV version");
-          break;
+          console.log('⚠️ Step-by-step execution not supported in this BSV version')
+          break
         }
-        
-        console.log(`\n🧩 Step ${i + 1}: ${bsv.Opcode.reverseMap[chunk.opcodenum] || 'PUSH'}`);
-        console.log("Stack:", bufferToHexArray(sandbox.stack));
-        console.log("AltStack:", bufferToHexArray(sandbox.altstack));
+
+        console.log(`\n🧩 Step ${i + 1}: ${Opcode.reverseMap[chunk.opcodenum] || 'PUSH'}`)
+        console.log('Stack:', bufferToHexArray(sandbox.stack))
+        console.log('AltStack:', bufferToHexArray(sandbox.altstack))
       } catch (err) {
-        console.log(`⚠️ Error executing opcode ${i + 1}:`, err.message);
-        break;
+        console.log(`⚠️ Error executing opcode ${i + 1}:`, err.message)
+        break
       }
     }
 
     // Final verification with proper satoshis parameter
-    const satoshisBN = new bsv.crypto.BN(100000);
+    const satoshisBN = new BN(100000)
     const verified = interpreter.verify(
       unlockingScript,
       lockingScript,
       tx,
       0,
-      bsv.Script.Interpreter.SCRIPT_ENABLE_SIGHASH_FORKID,
+      Interpreter.SCRIPT_ENABLE_SIGHASH_FORKID,
       satoshisBN
-    );
-
-    console.log("\n===========================================");
-    console.log("✅ Final Result:", verified ? "TRUE (Success)" : "❌ FALSE (Failure)");
-    console.log("Final Stack:", bufferToHexArray(sandbox.stack || []));
-    console.log("AltStack:", bufferToHexArray(sandbox.altstack || []));
-    console.log("===========================================");
-    
-    return verified;
+    )
+
+    console.log('\n===========================================')
+    console.log('✅ Final Result:', verified ? 'TRUE (Success)' : '❌ FALSE (Failure)')
+    console.log('Final Stack:', bufferToHexArray(sandbox.stack || []))
+    console.log('AltStack:', bufferToHexArray(sandbox.altstack || []))
+    console.log('===========================================')
+
+    return verified
   } catch (err) {
-    console.error("❌ Error in script execution:", err.message);
-    return false;
+    console.error('❌ Error in script execution:', err.message)
+    return false
   }
 }
 
@@ -113,17 +120,17 @@ function runScript(lockingHex, unlockingHex) {
 // ============================================
 if (typeof require !== 'undefined' && require.main === module) {
   if (process.argv.length < 4) {
-    console.log("Usage: node stack_examiner.js <locking_script_hex> <unlocking_script_hex>");
-    process.exit(1);
+    console.log('Usage: node stack_examiner.js <locking_script_hex> <unlocking_script_hex>')
+    process.exit(1)
   }
 
-  const locking = process.argv[2];
-  const unlocking = process.argv[3];
-  runScript(locking, unlocking);
+  const locking = process.argv[2]
+  const unlocking = process.argv[3]
+  runScript(locking, unlocking)
 }
 
 // Export for module usage
 module.exports = {
   runScript,
   bufferToHexArray
-};
+}

package/lib/smart_contract/token.js

@@ -39,13 +39,13 @@
  * Requires post-Genesis limits (SmartContract.enableGenesis()).
  */
 
-var bsv = require('../..')
-var P = require('./pushtx')
-var H = require('./covenant_helpers')
+var BN = require('../crypto/bn')
+var P = require('../covenant/pushtx')
+var H = require('../covenant/helpers')
 var A = require('./authorizers')
 
-var Script = bsv.Script
-var Opcode = bsv.Opcode
+var Script = require('../script')
+var Opcode = require('../opcode')
 var n = H.scriptNum
 
 function resolveCommit (owner, auth) {
@@ -285,7 +285,7 @@ function transferOrdinal (signer, newOwnerHash, spend, ordinalSats, lockingScrip
   function ser (o) { return o.toBufferWriter().toBuffer() }
   var before = Buffer.concat(outs.slice(0, tokenIndex).map(ser))
   var after = Buffer.concat(outs.slice(tokenIndex + 1).map(ser))
-  var tokenValue = new bsv.crypto.BN(ordinalSats).toBuffer({ endian: 'little', size: 8 })
+  var tokenValue = new BN(ordinalSats).toBuffer({ endian: 'little', size: 8 })
 
   return unlockTransferMulti(signer, newOwnerHash, spend, ordinalSats, lockingScript, {
     before: before,

package/lib/smart_contract/utxo_generator.js

@@ -15,7 +15,13 @@
 
 'use strict'
 
-var bsv = require('../..')
+var sighash = require('../transaction/sighash')
+var Signature = require('../crypto/signature')
+var BN = require('../crypto/bn')
+var Transaction = require('../transaction')
+var PrivateKey = require('../privatekey')
+var Networks = require('../networks')
+var Script = require('../script')
 var crypto = require('crypto')
 
 /**
@@ -28,14 +34,14 @@ function UTXOGenerator(options) {
   }
 
   this.options = options || {}
-  this.network = this.options.network || bsv.Networks.mainnet
+  this.network = this.options.network || Networks.mainnet
   this.keyRing = {} // Store generated keys
   this.utxoPool = [] // Store generated UTXOs
   
   // Initialize with SmartUTXO integration via direct require so that
   // touching this internal integration path doesn't surface the
-  // bsv.SmartUTXO deprecation warning (the warning is for downstream
-  // consumers who reach for bsv.SmartUTXO themselves, not for our own
+  // SmartUTXO deprecation warning (the warning is for downstream
+  // consumers who reach for SmartUTXO themselves, not for our own
   // internal coupling). Try/catch because smartutxo is Node-only.
   try {
     var SmartUTXO = require('../smartutxo')
@@ -51,7 +57,7 @@ function UTXOGenerator(options) {
 UTXOGenerator.prototype.generateKeypair = function(label) {
   label = label || 'key_' + Date.now()
   
-  var privateKey = bsv.PrivateKey.fromRandom(this.network)
+  var privateKey = PrivateKey.fromRandom(this.network)
   var publicKey = privateKey.toPublicKey()
   var address = privateKey.toAddress(this.network)
   
@@ -119,25 +125,25 @@ UTXOGenerator.prototype._createSingleUTXO = function(config) {
   
   switch (config.scriptType) {
     case 'P2PKH':
-      script = bsv.Script.buildPublicKeyHashOut(config.keypair.address)
+      script = Script.buildPublicKeyHashOut(config.keypair.address)
       scriptHex = script.toHex()
       break
       
     case 'P2SH':
       // Create a simple multisig for P2SH example
-      var redeemScript = bsv.Script.buildMultisigOut([config.keypair.publicKey], 1)
-      script = bsv.Script.buildScriptHashOut(redeemScript)
+      var redeemScript = Script.buildMultisigOut([config.keypair.publicKey], 1)
+      script = Script.buildScriptHashOut(redeemScript)
       scriptHex = script.toHex()
       break
       
     case 'CUSTOM':
       // Allow custom script injection
-      script = config.customScript || bsv.Script.buildPublicKeyHashOut(config.keypair.address)
+      script = config.customScript || Script.buildPublicKeyHashOut(config.keypair.address)
       scriptHex = script.toHex()
       break
       
     default:
-      script = bsv.Script.buildPublicKeyHashOut(config.keypair.address)
+      script = Script.buildPublicKeyHashOut(config.keypair.address)
       scriptHex = script.toHex()
   }
   
@@ -174,7 +180,7 @@ UTXOGenerator.prototype.createTestTransaction = function(config) {
   }, 0)
   
   // Create transaction
-  var transaction = new bsv.Transaction()
+  var transaction = new Transaction()
   
   // Add inputs
   inputUTXOs.forEach(function(utxo) {
@@ -217,15 +223,15 @@ UTXOGenerator.prototype.createTestTransaction = function(config) {
     
     // Preimage generation helper
     generatePreimage: function(inputIndex, sighashType) {
-      sighashType = sighashType || bsv.crypto.Signature.SIGHASH_ALL | bsv.crypto.Signature.SIGHASH_FORKID
+      sighashType = sighashType || Signature.SIGHASH_ALL | Signature.SIGHASH_FORKID
       var utxo = inputUTXOs[inputIndex]
       
-      return bsv.Transaction.sighash.sighashPreimage(
+      return sighash.sighashPreimage(
         transaction,
         sighashType,
         inputIndex,
-        bsv.Script.fromHex(utxo.script),
-        new bsv.crypto.BN(utxo.satoshis)
+        Script.fromHex(utxo.script),
+        new BN(utxo.satoshis)
       )
     }
   }

package/lib/smartutxo.js

@@ -35,6 +35,13 @@ const debug = function () {
   if (enabled) console.log.apply(console, arguments)
 }
 
+// Library primitives, required directly rather than through the package root.
+// createMockUTXOs() previously did a lazy `require('../')` to dodge the
+// module-init cycle; with the cycle gone these can be plain top-level imports.
+const Script = require('./script')
+const Address = require('./address')
+const Random = require('./crypto/random')
+
 // Browser-compatible imports
 let fs, path, crypto, blockchainState
 
@@ -54,9 +61,9 @@ if (typeof window === 'undefined' && typeof require === 'function') {
  * Comprehensive UTXO Management System for BSV development
  */
 class SmartUTXOManager {
-  constructor(options = {}) {
+  constructor (options = {}) {
     this.options = options || {}
-    
+
     // Initialize blockchain state - this creates the file if needed
     this.loadState()
   }
@@ -64,7 +71,7 @@ class SmartUTXOManager {
   /**
    * Load blockchain state from file (initializes if needed)
    */
-  loadState() {
+  loadState () {
     try {
       const state = blockchainState.loadBlockchainState()
       return state
@@ -75,9 +82,9 @@ class SmartUTXOManager {
   }
 
   /**
-   * Save blockchain state to file  
+   * Save blockchain state to file
    */
-  saveState() {
+  saveState () {
     try {
       const state = blockchainState.loadBlockchainState()
       blockchainState.saveBlockchainState(state)
@@ -93,15 +100,15 @@ class SmartUTXOManager {
    * @param {string} address - Bitcoin address
    * @returns {Array} Array of UTXO objects
    */
-  getUTXOsForAddress(address) {
+  getUTXOsForAddress (address) {
     try {
       const state = blockchainState.loadBlockchainState()
-      
+
       // Check if wallet exists
       if (!state.wallets || !state.wallets[address]) {
         return []
       }
-      
+
       // Return the wallet's UTXOs
       return state.wallets[address].utxos || []
     } catch (error) {
@@ -114,7 +121,7 @@ class SmartUTXOManager {
    * Add a new UTXO to the system
    * @param {Object} utxo - UTXO object {txid, vout, address, satoshis, script}
    */
-  addUTXO(utxo) {
+  addUTXO (utxo) {
     try {
       // Use the correct API: addUTXO(utxo, ownerAddress)
       blockchainState.addUTXO(utxo, utxo.address)
@@ -128,7 +135,7 @@ class SmartUTXOManager {
    * @param {Array} inputs - Array of input objects {txid, vout}
    * @param {string} spentInTx - Optional transaction ID where UTXO was spent
    */
-  spendUTXOs(inputs, spentInTx = 'manual-spend') {
+  spendUTXOs (inputs, spentInTx = 'manual-spend') {
     try {
       for (const input of inputs) {
         // Use the correct API: spendUTXO(txid, vout, spentInTx)
@@ -153,18 +160,17 @@ class SmartUTXOManager {
    * @param {number} satoshis - Satoshis per UTXO
    * @returns {Array} Array of created UTXOs
    */
-  createMockUTXOs(address, count = 5, satoshis = 100000) {
+  createMockUTXOs (address, count = 5, satoshis = 100000) {
     // Use bsv's own RNG so this works in both Node and browser builds
     // (the Node `crypto` import above is undefined in browser context).
-    const bsv = require('../')
-    const lockingScriptHex = bsv.Script.buildPublicKeyHashOut(
-      bsv.Address.fromString(address)
+    const lockingScriptHex = Script.buildPublicKeyHashOut(
+      Address.fromString(address)
     ).toHex()
 
     const mockUTXOs = []
     for (let i = 0; i < count; i++) {
       mockUTXOs.push({
-        txid: bsv.crypto.Random.getRandomBuffer(32).toString('hex'),
+        txid: Random.getRandomBuffer(32).toString('hex'),
         vout: i,
         address,
         satoshis,
@@ -179,15 +185,15 @@ class SmartUTXOManager {
    * @param {string} address - Bitcoin address
    * @returns {number} Total satoshis
    */
-  getBalance(address) {
+  getBalance (address) {
     try {
       const state = blockchainState.loadBlockchainState()
-      
+
       // Check if wallet exists
       if (!state.wallets || !state.wallets[address]) {
         return 0
       }
-      
+
       // Return the wallet's total value
       return state.wallets[address].totalValue || 0
     } catch (error) {
@@ -200,7 +206,7 @@ class SmartUTXOManager {
    * Get blockchain statistics
    * @returns {Object} Stats object
    */
-  getStats() {
+  getStats () {
     try {
       const state = blockchainState.getBlockchainStats() // This returns the full state
       return {
@@ -219,7 +225,7 @@ class SmartUTXOManager {
   /**
    * Reset blockchain state
    */
-  reset() {
+  reset () {
     try {
       const statePath = path.join(__dirname, '../utilities/blockchain-state.json')
       if (fs.existsSync(statePath)) {
@@ -232,4 +238,4 @@ class SmartUTXOManager {
   }
 }
 
-module.exports = SmartUTXOManager
+module.exports = SmartUTXOManager

package/lib/spv/headerchain.js

@@ -15,14 +15,14 @@
  * (or anchor) must match; the headers around it are then real work extending a block
  * you trust. Full difficulty-retarget validation is intentionally out of scope here.
  */
-var bsv = require('../..')
+var BlockHeader = require('../block/blockheader')
 
 function rev (b) { return Buffer.from(b).reverse() }
 
 function toHeader (h) {
   if (h && typeof h.validProofOfWork === 'function') return h
-  if (Buffer.isBuffer(h)) return bsv.BlockHeader.fromBuffer(h)
-  if (typeof h === 'string') return bsv.BlockHeader.fromBuffer(Buffer.from(h, 'hex'))
+  if (Buffer.isBuffer(h)) return BlockHeader.fromBuffer(h)
+  if (typeof h === 'string') return BlockHeader.fromBuffer(Buffer.from(h, 'hex'))
   throw new Error('each header must be a BlockHeader, an 80-byte Buffer, or hex')
 }
 

package/lib/spv/merkleproof.js

@@ -15,8 +15,8 @@
  * lib/block/{block,merkleblock}.js. A node of '*' (or '' / null) means "duplicate the
  * working hash" — Bitcoin's odd-node rule, per the TSC Merkle Proof standard.
  */
-var bsv = require('../..')
-var Hash = bsv.crypto.Hash
+var BlockHeader = require('../block/blockheader')
+var Hash = require('../crypto/hash')
 
 var HEX32 = /^[0-9a-fA-F]{64}$/
 
@@ -81,7 +81,7 @@ function verifyMerkleProof (proof) {
 function verifyTxInclusion (params) {
   var header = params.header
   if (Buffer.isBuffer(header) || typeof header === 'string') {
-    header = bsv.BlockHeader.fromBuffer(Buffer.isBuffer(header) ? header : Buffer.from(header, 'hex'))
+    header = BlockHeader.fromBuffer(Buffer.isBuffer(header) ? header : Buffer.from(header, 'hex'))
   }
   if (!header || !header.merkleRoot) throw new Error('a valid block header is required')
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smartledger/bsv",
-  "version": "7.9.0",
+  "version": "7.10.1",
   "description": "🚀 Complete Bitcoin SV development framework with legally-recognizable DID:web + W3C VC-JWT toolkit, Legal Token Protocol (LTP), Global Digital Attestation Framework (GDAF), StatusList2021 revocation, and 16 flexible loading options. Standards-based credentials with ES256/ES256K support, on-chain BSV anchoring, and comprehensive Bitcoin SV API. Perfect for legal tokens, verifiable credentials, DeFi, smart contracts, and secure Bitcoin applications.",
   "author": "SmartLedger Technology <hello@smartledger.technology> (https://smartledger.technology)",
   "homepage": "https://github.com/codenlighten/smartledger-bsv#readme",
@@ -31,6 +31,7 @@
     "./vcjwt": "./vcjwt-entry.js",
     "./lib/anchor": "./lib/anchor/index.js",
     "./lib/block": "./lib/block/index.js",
+    "./lib/covenant": "./lib/covenant/index.js",
     "./lib/didweb": "./lib/didweb/index.js",
     "./lib/ecies": "./lib/ecies/index.js",
     "./lib/errors": "./lib/errors/index.js",
@@ -58,6 +59,8 @@
   "scripts": {
     "lint": "standard",
     "check:load-order": "node scripts/check-address-load-order.js",
+    "conformance": "node conformance/verify.js",
+    "conformance:generate": "node conformance/generate.js",
     "lint:ratchet": "node scripts/lint-ratchet.js",
     "lint:ratchet:update": "node scripts/lint-ratchet.js --update",
     "test": "mocha",
@@ -227,7 +230,6 @@
     "@noble/ciphers": "2.2.0",
     "@noble/curves": "2.2.0",
     "@noble/hashes": "2.2.0",
-    "aes-js": "^3.1.2",
     "bn.js": "=4.12.5",
     "bs58": "=4.0.1",
     "clone-deep": "^4.0.1",

package/test/build/bundle_externals.js

@@ -0,0 +1,116 @@
+'use strict'
+
+/* global describe, it, before */
+
+// Feature bundles must EXTERNALISE the shared primitives, not embed a second copy.
+//
+// Getting this wrong is not a size regression. If a feature bundle ships its own
+// PrivateKey class, a key built by bsv.min.js fails `instanceof` inside that bundle
+// and index.js's versionGuard reports two library instances — a failure that is
+// invisible to every test that stays inside one bundle.
+//
+// build/esbuild.js has always had a `metafile` option whose comment said it was "used
+// to assert" this property. Nothing consumed it: `grep -rn metafile` returned only the
+// option itself. This file is that consumer.
+
+require('chai').should()
+var esbuild = require('../../build/esbuild.js')
+
+// Bundles that resolve bsv from the global instead of embedding it.
+var EXTERNALISED = esbuild.BUNDLES.filter(function (c) { return c.externalBsv })
+
+describe('feature bundles externalise the shared primitives', function () {
+  this.timeout(120000)
+
+  var inputsByBundle = {}
+
+  before(function () {
+    // Build each one in memory (write:false) and keep its module graph.
+    return Promise.all(EXTERNALISED.map(function (cfg) {
+      return esbuild.buildOne(cfg, { metafile: true, write: false, logLevel: 'silent' })
+        .then(function (result) {
+          inputsByBundle[cfg.file] = Object.keys(result.metafile.inputs)
+            .filter(function (p) { return p.indexOf('lib/') === 0 })
+            .sort()
+        })
+    }))
+  })
+
+  it('has bundles to check', function () {
+    EXTERNALISED.length.should.be.above(0)
+    Object.keys(inputsByBundle).length.should.equal(EXTERNALISED.length)
+  })
+
+  // The primary assertion, derived from the config rather than hand-maintained: every
+  // path in LIB_GLOBALS is a module the build promises to take from the global bsv, so
+  // none of them may appear as a bundled input. Because it reads the same table the
+  // build uses, it cannot drift out of step with it.
+  it('never embeds a module that LIB_GLOBALS maps to the global bsv', function () {
+    var mapped = Object.keys(esbuild.LIB_GLOBALS)
+    var offences = []
+    Object.keys(inputsByBundle).forEach(function (file) {
+      inputsByBundle[file].forEach(function (input) {
+        // 'lib/privatekey.js' -> 'privatekey'; 'lib/script/index.js' -> 'script/index'
+        var key = input.replace(/^lib\//, '').replace(/\.js$/, '')
+        if (mapped.indexOf(key) !== -1) {
+          offences.push(file + ' embeds ' + input + ' (should come from global bsv.' +
+            esbuild.LIB_GLOBALS[key] + ')')
+        }
+      })
+    })
+    offences.should.deep.equal([])
+  })
+
+  // LIB_GLOBALS is deliberately not exhaustive — a feature bundle SHOULD contain its own
+  // feature code. So the catch-all is to pin what each bundle contains: anything new
+  // appearing here is either the feature growing or a primitive leaking in, and a human
+  // decides which. Without this, a `require('../mnemonic')` added to a module reachable
+  // from an externalised entry would bundle a second copy silently, with every existing
+  // test green.
+  it('contains only its own feature code, pinned per bundle', function () {
+    // Accepted in any bundle: a tiny lodash subset with no library state, deliberately
+    // duplicated rather than routed through the global.
+    var SHARED = ['lib/util/']
+    var EXPECTED = {
+      'bsv-ecies.min.js': ['lib/ecies/'],
+      'bsv-message.min.js': ['lib/message/'],
+      'bsv-mnemonic.min.js': ['lib/mnemonic/'],
+      'bsv-shamir.min.js': ['lib/crypto/'],
+      'bsv-smartcontract.min.js': ['lib/smart_contract/', 'lib/covenant/', 'lib/smartutxo.js'],
+      'bsv-covenant.min.js': ['lib/smart_contract/'],
+      'bsv-script-helper.min.js': ['lib/custom-script-helper.js']
+    }
+    var unexpected = []
+    Object.keys(inputsByBundle).forEach(function (file) {
+      var allowed = (EXPECTED[file] || []).concat(SHARED)
+      if (!EXPECTED[file]) {
+        unexpected.push(file + ' is externalised but has no expected-input list')
+        return
+      }
+      inputsByBundle[file].forEach(function (input) {
+        var ok = allowed.some(function (prefix) { return input.indexOf(prefix) === 0 })
+        if (!ok) unexpected.push(file + ' unexpectedly embeds ' + input)
+      })
+    })
+    unexpected.should.deep.equal([])
+  })
+
+  it('shares nothing but documented helpers across bundles', function () {
+    // A module appearing in two feature bundles is a duplicated copy in the shipped
+    // set. Only these are accepted, and each is a deliberate call rather than an
+    // accident: lib/util/_.js is a tiny lodash subset, and lib/smart_contract/covenant.js
+    // is genuinely the feature of both covenant-flavoured bundles.
+    var ACCEPTED_DUPLICATES = ['lib/util/_.js', 'lib/smart_contract/covenant.js']
+    var seen = {}
+    Object.keys(inputsByBundle).forEach(function (file) {
+      inputsByBundle[file].forEach(function (input) {
+        (seen[input] = seen[input] || []).push(file)
+      })
+    })
+    var duplicated = Object.keys(seen)
+      .filter(function (p) { return seen[p].length > 1 })
+      .filter(function (p) { return ACCEPTED_DUPLICATES.indexOf(p) === -1 })
+      .sort()
+    duplicated.should.deep.equal([])
+  })
+})

package/version.js

@@ -1,3 +1,3 @@
 'use strict'
 // GENERATED by scripts/sync-version.js on `npm version` — do not edit.
-module.exports = '7.9.0'
+module.exports = '7.10.1'