@ninsei-labs/sdk 0.40.0-develop.1 → 0.41.0

package/CHANGELOG.md

@@ -1,3 +1,34 @@
+## 0.41.0 — 2026-10-11
+
+THE DEPOSITOR PATH IS GONE. The factory no longer offers `createOrderAndFundByDepositor`, so the package must
+stop building a call to a selector that does not exist in the deployed factory.
+
+- `src/swap-flow.mjs` no longer carries or relays `depositorSignature`: the funding path is the one where the
+  payer and the refund recipient are always the same address.
+- The engine mirror loses `evm/depositor.js` (47 modules instead of 48) and the EIP-712 spec comment now names
+  the order-quote form.
+- A consumer that meant to fund someone else's quote funds through `createOrderAndFund`.
+
+## 0.40.0 — 2026-10-11
+
+THE ASYNCHRONOUS ROUTE PROVIDERS REACH `latest`. This release moves the tag from 0.39.3; the demo pins this exact
+version rather than the tag.
+
+- Four asynchronous route providers, each declaring what it settles: CoWSwap (native), KyberSwap Limit Order
+  (wrapped: a liquidity leg, never the sole provider for a native need), UniswapX (native), and the relayed
+  Uniswap route through the UniversalRouter (native).
+- `submitUniswapxOrder` publishes an order through a submitter you name; the package never carries an API key.
+- A route can be composed of two legs - liquidity to the wrapped token, then a native leg - and a provider that
+  cannot carry the route to what the person needs can never be chosen alone.
+- The engine mirror is regenerated from the source of truth and the vendored browser bundle is rebuilt.
+- The config names the demo's current escrow (factory `0x1029D6bC53f6b9919F8ec6Ac922327F7e5A3DdF2`, cashier
+  `0x7E84035B4f42219F3fCE22855c6Dd7D36942B019`, registry `0x416d548B497d3AE808807172a5Bc3549512a64E5`): the
+  demo redeployed on 2026-10-11 and the retired router is gone from the configuration.
+- The test wallet adapter signs on the demo network: `arbitrum-sepolia` is on its allowlist, and it no longer
+  takes a gas price from a tick behind, which came out below the next block's base fee and was rejected.
+
+The synchronous swap path is untouched: nothing that already existed changed behaviour.
+
 ## 0.40.0-develop.1 — 2026-10-10
 
 A build of the asynchronous route-provider work, published for the demo and for our own testing. This build does NOT

package/engine/core/config.js

@@ -46,7 +46,7 @@ export const ENDPOINTS = Object.freeze({
 // with the page's actual origin, so a hard-coded host breaks the session on any other host.
 const PAGE_ORIGIN = typeof location !== "undefined" ? location.origin : "";
 
-// THE EIP-712 SIGNING DOMAIN (name/version) for the depositor signature. It is NOT a brand literal in the signer: it
+// THE EIP-712 SIGNING DOMAIN (name/version) for a signed order quote. It is NOT a brand literal in the signer: it
 // belongs to the registry contract (it returns DOMAIN_SEPARATOR()), so it is taken from the config here. The defaults
 // reproduce today's result byte for byte.
 export const SIGNING_DOMAIN = Object.freeze({ name: "NinseiEscrowFactory", version: "1" });
@@ -363,14 +363,19 @@ export const CHAINS = [
     explorerName: "arbiscan (sepolia)",
     gasUsd: 0.01,
     routeType: "atomic",
-    // THE DEMO'S MAIN NETWORK: the escrow went here, and the FEE ROUTER IS DEPLOYED here - also the factory (it
-    // spawns escrows, keeps the rate, holds the fee cashier). The address is a FACT, not an intention:
-    // 0xaEB1c0455C76551dcEb2E6B1245B65F0458b0aE8 (height 314323871, transaction
-    // 0x7a88c0249867b76b11c6cb678e6092fdc19404b51540a64c5fd03f5a32f74826, code 8223 bytes, keccak256
-    // 0x90f26f641b48a2a630463195d4429b0818d29187563e09711a40811fcf08a0ba); it added EARLY REFUND in the dead
-    // zone - with no mark, refund is open right after readyBy and it publishes the depositor's half. The code
-    // matches the current repo build byte for byte.
-    // `npm run check:deployed -- --address=0xaEB1c0455C76551dcEb2E6B1245B65F0458b0aE8`).
+    // THE DEMO'S MAIN NETWORK: the Ninsei escrow factory, the interface's fee cashier and the maker registry live
+    // here; the ArrakisFeeRouter is gone. The factory is a FACT, not an intention:
+    // 0x1029D6bC53f6b9919F8ec6Ac922327F7e5A3DdF2 (height 318033203, transaction
+    // 0x0f82c556f056f2dcaba5c12da75a749c257dfb1ccbf0eb6962a4e7f0119d166d, code 4226 bytes, keccak256
+    // 0x4b515f600c641bffde054b3a98f4e26bd43d2dd2b2d8e60e8cfe36ee03686dd9); every order is an EIP-1167 clone and
+    // the factory carries the pair (implementation(), implementationCodeHash()). The fee cashier is the second CREATE
+    // of the same pass - 0x7E84035B4f42219F3fCE22855c6Dd7D36942B019 (height 318033206, code 573 bytes, keccak256
+    // 0xcca1d8bc53d1d1c98901570800e093d0933f84637c6cdc727153b3ef8d8c3c36); the maker registry is the third -
+    // 0x416d548B497d3AE808807172a5Bc3549512a64E5 (height 318033209, code 4557 bytes). The code matches the current
+    // repo build byte for byte.
+    // `npm run check:deployed -- --address=0x1029D6bC53f6b9919F8ec6Ac922327F7e5A3DdF2`).
+    // PREVIOUS (the ArrakisFeeRouter of the previous rules, now removed): 0xaEB1c0455C76551dcEb2E6B1245B65F0458b0aE8
+    // (height 314323871, code 8223 bytes, keccak256 0x90f26f641b48a2a630463195d4429b0818d29187563e09711a40811fcf08a0ba).
     // PREVIOUS (ceiling 3%, no early refund): 0xEa619bDC78989627093B7830990367B2ECE52CE5 (height 314309038,
     // code 8143 bytes). PREVIOUS live (router with a 10% ceiling): 0x9f856cd9c14fd9493961473b804039b09a4012ef
     // (height 313597131, code 8723 bytes). PREVIOUS before it (factory without a fee):
@@ -379,9 +384,9 @@ export const CHAINS = [
     // (createOrderAndFund; the escrow has no separate funding function - an order is born funded, see FACTORY_METHODS
     // in www/js/evm/factory.js and ESCROW_METHODS in escrow.js). The old lock(sealedHalf) and hashlock are gone: the
     // half is not sent but revealed by presentation. Switching back to "simulated" is one edit, to show a demo with
-    // no money movement. cashier: the INTERFACE's fee cashier, named in quotes. The contracts on chain are still the
-    // previous ones, so there is no cashier there: the field is filled in the same pass as the factory address.
-    escrow: { address: "0xaEB1c0455C76551dcEb2E6B1245B65F0458b0aE8", mode: "live", cashier: null },
+    // no money movement. cashier: the INTERFACE's fee cashier, named in quotes and now deployed (the second CREATE of
+    // the same pass). implementationCodeHash: the escrow implementation the factory carries, checked against the chain.
+    escrow: { address: "0x1029D6bC53f6b9919F8ec6Ac922327F7e5A3DdF2", mode: "live", cashier: "0x7E84035B4f42219F3fCE22855c6Dd7D36942B019", implementationCodeHash: "0xfd1ef12c1d96d3ee7060bd5901e06108723783403fad00c9630dcdeb6193674b" },
     tokens: [
       // Test USDC (Circle): decimals 6 and symbol "USDC" verified on chain by the same node.
       { symbol: "USDC", address: "0x75faf114eafb1BDbe2F0316DF893fd58CE46AA4d", decimals: 6, usd: 1, cls: "ar-token-usdc" },

package/engine/evm/factory.js

@@ -19,9 +19,6 @@ export const FACTORY_METHODS = {
   predict: "0x0824d205",
   // create the escrow AND deposit funds in ONE transaction (a value transfer with the call).
   createOrderAndFund: "0x4703a9d3",
-  // create the escrow and deposit when the DEPOSITOR is recovered FROM THE SIGNATURE over the quote digest:
-  // anyone may send the transaction, and `locker` is set to the signer.
-  createOrderAndFundByDepositor: "0x2acd187b",
 };
 
 // The OrderCreated event topic. It grew the registry address, the provider and the signing key:
@@ -129,15 +126,6 @@ export function encodeCreateOrderAndFund(quote) {
   return FACTORY_METHODS.createOrderAndFund + quoteCallArgs(quote);
 }
 
-// CREATE AND DEPOSIT when the depositor is recovered FROM ITS SIGNATURE over the quote digest. Anyone may send
-// the transaction, so there are TWO signers: quote.signature (the provider, checked by the escrow) and
-// depositorSignature (the depositor, checked by the factory, which requires the recovered address to equal
-// quote.locker). Both over ONE digest.
-export function encodeCreateOrderAndFundByDepositor(quote, depositorSignature) {
-  return FACTORY_METHODS.createOrderAndFundByDepositor + quoteWords(quote) +
-    signatureWords(quote.signature) + signatureWords(depositorSignature) + lockerHalfWords(quote);
-}
-
 // predict() answer - one address in a 32-byte word.
 export function decodeAddress(returnedHex) {
   const hex = String(returnedHex || "").replace(/^0x/, "");

package/engine/evm/funding.js

@@ -14,10 +14,7 @@
 // keccak256 is passed in as a dependency, as in the address module: the caller loads the key library, not this
 // module. Monero and Ethereum share Keccak-256, so the hash computed by the bundle matches what Solidity checks.
 
-import { encodeCreateOrderAndFund, encodeCreateOrderAndFundByDepositor, encodePredict, decodeAddress, ORDER_CREATED_TOPIC } from "./factory.js";
-// THE DEPOSITOR BY SIGNATURE: the signature shape comes from one place (evm/depositor.js), next to the protocol
-// shape. Checking the shape here would be a second record of the same rule.
-import { depositorSignatureShape } from "./depositor.js";
+import { encodeCreateOrderAndFund, encodePredict, decodeAddress, ORDER_CREATED_TOPIC } from "./factory.js";
 import { encodeStatus, decodeStatus } from "./escrow.js";
 // THE FEE: rate, amount and recipient are PART OF THE SIGNED QUOTE. The factory no longer has them (the router was
 // removed), so the amount comes from the quote and is cross-checked by the formula mirror. Without a quote there
@@ -152,7 +149,7 @@ async function waitReceipt(receiptReader, hash, { tries = 12, delayMs = 1500 } =
 
 // The full funding path. Steps are returned outward so the interface can show each one: predict is a free call,
 // createOrder and lock are transactions in the user's wallet.
-export async function fundOrder({ factory, locker, claimer, commitHalfLocker, commitHalfClaimer, edPointLocker, edPointClaimer, edViewPointLocker, salt: providedSalt, amountWei, amountLabel, claimWindowSeconds, readyWindowSeconds, readyBy, t1, quote, depositorSignature = null, call, send, receipt, onStep }) {
+export async function fundOrder({ factory, locker, claimer, commitHalfLocker, commitHalfClaimer, edPointLocker, edPointClaimer, edViewPointLocker, salt: providedSalt, amountWei, amountLabel, claimWindowSeconds, readyWindowSeconds, readyBy, t1, quote, call, send, receipt, onStep }) {
   if (!factory) throw new Error("no escrow factory address set for this network");
   if (!locker) throw new Error("no EVM wallet connected: there is nobody to deposit");
   if (!claimer) throw new Error("the order recipient (claimer) is not set");
@@ -243,20 +240,10 @@ export async function fundOrder({ factory, locker, claimer, commitHalfLocker, co
     ? " (order " + amountWei + " + fee " + fee.feeWei + ")"
     : "";
   onStep?.("locking " + (amountLabel || "funds") + feeWords + " in one transaction - confirm in wallet");
-  // WHICH FACTORY DOOR THE DEPOSIT GOES THROUGH, AND IT IS NOT DECORATION. If a depositor signature is present, we
-  // deposit via part A: createOrderAndFundByDepositor recovers the depositor FROM THE SIGNATURE over the quote
-  // digest, so anyone may send the transaction (a relayer, our service) while the `locker` role (right to refund,
-  // right to mark readiness) stays with the signer. Without a signature, the old createOrderAndFund: one wallet
-  // deposits and sends, and the direct swap works as before. On neither path may the sender change the order terms
-  // - both signatures cover THE SAME quote digest.
-  if (depositorSignature !== null && depositorSignature !== undefined && depositorSignature !== "") {
-    const shape = depositorSignatureShape(depositorSignature);
-    if (!shape.ok) throw new Error("the depositor signature is unusable: " + shape.reason);
-  }
-  const relayedByDepositor = Boolean(depositorSignature);
-  const createData = relayedByDepositor
-    ? encodeCreateOrderAndFundByDepositor(quoteEnc, depositorSignature)
-    : encodeCreateOrderAndFund(quoteEnc);
+  // WHICH FACTORY DOOR THE DEPOSIT GOES THROUGH. There is ONE path: createOrderAndFund, where the wallet that
+  // sends the transaction becomes the locker. The sender may not change the order terms - the quote signature
+  // covers THE SAME digest the escrow checks.
+  const createData = encodeCreateOrderAndFund(quoteEnc);
   const createHash = await send({
     to: factory,
     data: createData,
@@ -300,8 +287,5 @@ export async function fundOrder({ factory, locker, claimer, commitHalfLocker, co
   // THE FEE GOES OUTWARD: it went into the transaction and the deal record must keep it - otherwise the record
   // cannot tell how much the person deposited, and it would diverge from what the chain shows.
   return { feeWei: fee.feeWei, feeTotalWei: totalValueWei, feeBps: fee.bps, feeWasLegacyFactory: Boolean(fee.legacy),
-           // WHICH FACTORY PATH RAN: visible outside, not only in the wallet's calldata. By it the checks and the
-           // deal record know whether the ETH returns to the signer and not to the sender.
-           depositorPath: relayedByDepositor,
            escrow: escrowToUse, predictedEscrow: escrow, escrowMismatch: Boolean(actualEscrow && actualEscrow !== String(escrow).toLowerCase()), salt, birthBlock, terms, createHash, lockHash };
 }

package/engine/evm/index.js

@@ -32,9 +32,8 @@ import { fundOrder } from "./funding.js";
 export * from "./factory.js";
 export * from "./escrow.js";
 export * from "./funding.js";
-// The depositor signature form (evm/depositor.js) and the permit verdict (evm/permit.js) go through the SAME
-// engine seam: the page and the SDK share one protocol code, not two lookalikes.
-export * from "./depositor.js";
+// The permit verdict (evm/permit.js) goes through the SAME engine seam: the page and the SDK share one
+// protocol code, not two lookalikes.
 export * from "./permit.js";
 // THE ASYNCHRONOUS ROUTE, EXECUTED - through the same engine seam as the decision that chooses it. The page reaches
 // it through the bridge; the SDK carries the same module in its engine mirror (tools/build-sdk-engine.mjs).
@@ -87,13 +86,10 @@ export async function simulateEscrowFunding(tx) {
 // could not pass even the first step. Neither syntax nor checks saw this, because the live path is never run.
 // FOUR FIELDS AND TWO DEADLINES EXPLICITLY. The deadlines come ready (readyBy, t1), not computed from now:
 // they go into the context the proof binds to, so they must be fixed before it.
-export async function fundOrderLive({ factory, locker, claimer, commitHalfLocker, commitHalfClaimer, edPointLocker, edPointClaimer, edViewPointLocker, salt, amountWei, amountLabel, claimWindowSeconds = 3600, readyWindowSeconds = 14400, readyBy, t1, quote, depositorSignature, onStep }) {
+export async function fundOrderLive({ factory, locker, claimer, commitHalfLocker, commitHalfClaimer, edPointLocker, edPointClaimer, edViewPointLocker, salt, amountWei, amountLabel, claimWindowSeconds = 3600, readyWindowSeconds = 14400, readyBy, t1, quote, onStep }) {
   return fundOrder({
     factory,
     quote,                         // signed quote: carries the fee, registry address and provider
-    // THE DEPOSITOR SIGNATURE OVER THE QUOTE DIGEST. Present: funding goes via
-    // createOrderAndFundByDepositor and anyone may send the transaction. Absent: the old path.
-    depositorSignature,
     locker,
     claimer,
     commitHalfLocker,

package/engine/evm/permit.js

@@ -22,8 +22,8 @@
 // cannot cover the gas - the swap settles first and the escrow is funded after it. See usdcWithoutEthVerdict below
 // and www/js/evm/asyncRoute.js - and it is a NAMED refusal only when no provider serves the network.
 //
-// THE DEPOSITOR SIGNATURE IS A DIFFERENT ALLOWANCE. It lets a relayer SEND the order-creation transaction, but
-// not pull the token. Pulling USDC needs a separate TOKEN allowance (approve or permit) addressed to the puller.
+// A RELAYED ORDER NEEDS A SEPARATE TOKEN ALLOWANCE. Letting a relayer SEND the order-creation transaction does
+// not let it pull the token. Pulling USDC needs a separate TOKEN allowance (approve or permit) addressed to the puller.
 
 // THE BALANCE-DRIVEN PATH CHOICE. Whether a provider serves a network ASYNCHRONOUSLY (an intent auction whose
 // settlement arrives later - see www/js/evm/asyncRoute.js) is what decides the path for a person with no own
@@ -179,7 +179,7 @@ export function usdcWithoutEthVerdict({
   if (!isAddr(orchestrator)) {
     return {
       ok: false, blocked: true, kind: "no-orchestrator", path: null,
-      reason: "no executor contract: only a contract could pull a token by the user signature and deposit native into the escrow in one transaction, and this build has none. The depositor signature without it lets a relayer SEND the order creation, but not pull the token",
+      reason: "no executor contract: only a contract could pull a token by the user signature and deposit native into the escrow in one transaction, and this build has none",
     };
   }
   if (permitSupported === false) {

package/engine/evm/session.js

@@ -551,12 +551,10 @@ export async function signMessage(message) {
 }
 
 // SIGNING TYPED DATA with the wallet (EIP-712, eth_signTypedData_v4). This is also NOT a transaction: the
-// signature moves no money and costs no gas, so a person WITHOUT their own ETH can give it. With it the
-// depositor lets the factory record his address in the order, and anyone may send the transaction for him
-// (the createOrderAndFundByDepositor path).
+// signature moves no money and costs no gas, so a wallet without its own ETH can give it.
 //
-// WHAT EXACTLY IS SIGNED IS DECIDED BY THE CALLER: ready typed data arrives here (www/js/evm/depositor.js),
-// not a string. Assembling the shape here would be a second record of the protocol next to the real one.
+// WHAT EXACTLY IS SIGNED IS DECIDED BY THE CALLER: ready typed data arrives here as an object, not a string.
+// Assembling the shape here would be a second record of the protocol next to the real one.
 export async function signTypedData(typedData) {
   if (!provider || state.status !== "connected") {
     throw new Error("wallet not connected: typed-data signing is impossible");

package/engine/sdk/bridge.js

@@ -68,7 +68,7 @@ import { height as nodeHeightValue } from "../monero/node.js";
 
 // THE CORE ADDRESS AS A STRING - THE BUILT BUNDLE UNDER www/: the page gets the core as ONE module, not a pile
 // of sdk/ sources; ?v=<hash> keeps the cache fresh.
-const SDK_BUNDLE = "/assets/vendors/sdk/sdk-browser.js?v=3ce64c53";
+const SDK_BUNDLE = "/assets/vendors/sdk/sdk-browser.js?v=69d79c13";
 
 // A NAMED SEAM FOR CHECKS - THE SAME TECHNIQUE AS sdkBookUse BELOW. The asynchronous path is driven against a
 // stand-in order book (the demo network has no provider), and the ordinary escrow funding that follows a settled

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ninsei-labs/sdk",
-  "version": "0.40.0-develop.1",
+  "version": "0.41.0",
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org/"

package/src/adapters/node-test-evm-wallet.mjs

@@ -43,8 +43,11 @@ export const CLAIMER_ENV = "NINSEI_TEST_EVM_CLAIMER";
 // the registry's production networks the escrow is marked "simulated", that is, by the letter of the rule they are
 // not production. So the test key would also sign on mainnet - the engine would not notice, and the engine's rule
 // must not be changed (it is shared by the page and all legs). So the "signing is ALLOWED here" marker is set
-// separately and EXPLICITLY: only what is listed, and nothing more. First - the local anvil by chainId 31337.
-export const TEST_CHAIN_IDS = Object.freeze([31337]);
+// separately and EXPLICITLY: only what is listed, and nothing more. The local anvil by chainId 31337, and the
+// demo testnet arbitrum-sepolia by chainId 421614 - the network the demo escrow lives on (the registry entry
+// marks it testnet: true with a live escrow, so the second line below already passes; without it in THIS list
+// the first line refuses the whole demo contour, and no headless run can sign).
+export const TEST_CHAIN_IDS = Object.freeze([31337, 421614]);
 
 const envOf = (name) => {
   const box = typeof process !== "undefined" && process ? process.env : null;
@@ -302,7 +305,16 @@ export function nodeTestEvmWallet({ privateKey, rpcUrl, chainId = null, id = "no
       const remote = await assertTestContour();
       const valueWei = BigInt(value === undefined || value === null ? 0 : value);
       const nonce = Number(BigInt(await provider.request({ method: "eth_getTransactionCount", params: [owner, "pending"] })));
-      const gasPrice = BigInt(await provider.request({ method: "eth_gasPrice" }));
+      // NEVER SIGN BELOW THE BLOCK BASE FEE. On a live node eth_gasPrice answers a tick behind and comes out
+      // slightly BELOW the next block's base - the signature is then rejected with "max fee per gas less than
+      // block base fee". The node's own sender already carries this rule (rfq/evm.mjs: base + base/8); the test
+      // adapter must not diverge from it, or a headless run cannot send anything on such a network.
+      let gasPrice = BigInt(await provider.request({ method: "eth_gasPrice" }));
+      try {
+        const block = await provider.request({ method: "eth_getBlockByNumber", params: ["latest", false] });
+        const baseFee = block && block.baseFeePerGas ? BigInt(block.baseFeePerGas) : 0n;
+        if (baseFee > 0n && gasPrice <= baseFee) gasPrice = baseFee + baseFee / 8n;
+      } catch { /* the base fee was not read - the node's own price stays */ }
       let gasLimit = gas === null || gas === undefined ? null : BigInt(gas);
       if (gasLimit === null) {
         const est = BigInt(await provider.request({

package/src/quoteEip712Spec.mjs

@@ -22,7 +22,7 @@
 //                          signature covers exactly the XMR the chain verifies at order birth. Earlier this field
 //                          rode in the quote object OUTSIDE the digest on purpose - a field the chain could not
 //                          see must not be signed; once the contract learned it, it moved in here together with
-//                          the typehash, the depositor form and the independent vector.
+//                          the typehash, the order-quote form and the independent vector.
 //   commitHalfClaimer,   - the provider's own commitment and ed25519 spend point: both are inputs to the
 //   edPointClaimer         escrow's termsHash, so they are bound and cannot be swapped for another order's.
 //   chainId              - bound in the domain AND in the message. A quote signed for one network does not

package/src/swap-flow.mjs

@@ -66,10 +66,6 @@ export function escrowCashierAddress(chainSlug) {
 // The full flow. onStage(stage, detail) is called on every step - the interface must show what is going on.
 export async function runAtomicOrder({
   chainSlug, locker, claimer, amountWei, amountLabel, providerId = null,
-  // THE DEPOSITOR'S SIGNATURE (issue #97, parts A/C): when given, the order is placed through
-  // createOrderAndFundByDepositor - any wallet may send the transaction, while the signer is recorded as the
-  // depositor.
-  depositorSignature = null,
   claimWindowSeconds = 3600, readyWindowSeconds = 14400, salt: providedSalt, onStage,
   // THE SUBSTITUTION POINTS FOR THE SAKE OF THE CHECK, and they are not decoration. The live flow could be
   // neither run in a check nor covered otherwise: it requires a browser Worker and a signature in the wallet.
@@ -261,9 +257,6 @@ export async function runAtomicOrder({
       // (or from the caller in a simulation) and already participates in the context over which our half was
       // computed.
       factory, locker, claimer: order.claimer,
-      // WE PASS THE DEPOSITOR'S SIGNATURE FURTHER instead of losing it halfway: without it the funding would go
-      // the previous way, and the relayer would get a NotLocker refusal only after the person had signed.
-      depositorSignature,
       // THE DEADLINES GO INTO THE CONTRACT EXACTLY THE ONES THAT ENTERED THE CONTEXT. This is not duplication but
       // a condition: diverge by even a second - and the proof by which the provider confirms the half stops
       // agreeing.

package/engine/evm/depositor.js

@@ -1,123 +0,0 @@
-// GENERATED FILE - a byte-for-byte copy of the engine module www/js/evm/depositor.js for the SDK package.
-// Edit the source under www/js and regenerate the mirror; a drift guard reddens on any difference.
-// Everything below this header is identical to the source.
-
-// THE DEPOSITOR BY SIGNATURE, CLIENT SIDE: EIP-712 typed data over the QUOTE DIGEST.
-//
-// WHY. The factory has a path createOrderAndFundByDepositor: ANYONE may send the transaction (a relayer, our
-// service), but the depositor is whoever signed the quote digest, so the depositor must sign first. A wallet
-// signature is typed data, not a transaction: it costs no gas and moves no money, so a person without ETH can give it.
-//
-// WHY THIS FORM, NOT AN INVENTED ONE. The field set and domain are PART OF THE PROTOCOL - the same OrderQuote
-// the escrow verifies and the node signs. Two swapped fields give a DIFFERENT digest and the factory refuses
-// BadDepositorSignature. So the form is ONE list below, and a check computes the digest with it and compares.
-//
-// DOMAIN. verifyingContract is the FACTORY ADDRESS FROM THE QUOTE (field `factory`), chainId is live: a signature
-// made for another factory or network will not recover here. There is no second source of the domain.
-//
-// NO CRYPTOGRAPHY HERE: the wallet computes the digest (eth_signTypedData_v4). Here is only the form and its check.
-
-import { SIGNING_DOMAIN } from "../core/config.js";
-
-// The domain name and version are quote protocol v8. They are NOT brand literals here: they belong to the registry
-// contract (it returns DOMAIN_SEPARATOR()), so they are read from the config. The defaults equal today's values.
-export const DEPOSITOR_DOMAIN_NAME = SIGNING_DOMAIN.name;
-export const DEPOSITOR_DOMAIN_VERSION = SIGNING_DOMAIN.version;
-
-// FIELD SET IN CONTRACT ORDER. The order is part of the ABI: a swap gives another digest. One list feeds both
-// the type string and the message, so they cannot diverge.
-export const ORDER_QUOTE_TYPED_FIELDS = [
-  ["provider", "address"],
-  ["quoteKey", "address"],
-  ["registry", "address"],
-  ["cashier", "address"],
-  ["locker", "address"],
-  ["claimer", "address"],
-  ["amount", "uint256"],
-  ["readyBy", "uint64"],
-  ["t1", "uint64"],
-  ["salt", "bytes32"],
-  ["commitHalfClaimer", "bytes32"],
-  ["edPointClaimer", "bytes32"],
-  ["chainId", "uint256"],
-  ["feeBps", "uint256"],
-  ["fee", "uint256"],
-  ["feeRecipient", "address"],
-  ["validUntil", "uint64"],
-  ["nonce", "uint256"],
-  // THE XMR SIDE OF THE DEAL, in atomic units: it joined the signed set together with the contract
-  // (OrderQuote.sol), the node/SDK spec and the vector, so the depositor's signature covers the same XMR the chain
-  // verifies. A field the chain could not see used to stay OUT of this list on purpose - that is no longer the case.
-  ["xmrAmount", "uint256"],
-];
-
-// The message type. Built from the list: editing the list changes both the type and the signature, so it cannot
-// go unnoticed.
-export const ORDER_QUOTE_TYPED_TYPE = "OrderQuote(" + ORDER_QUOTE_TYPED_FIELDS.map(([n, t]) => t + " " + n).join(",") + ")";
-
-const isHex = (v, bytes) => new RegExp("^(0x)?[0-9a-fA-F]{" + bytes * 2 + "}$").test(String(v === undefined || v === null ? "" : v).trim());
-const isNum = (v) => /^(0x[0-9a-fA-F]+|[0-9]+)$/.test(String(v === undefined || v === null ? "" : v).trim());
-
-// FORM IS NORMALISED, NOT DEMANDED. The quote carries ed25519 points WITHOUT the 0x prefix, while the wallet and
-// contract expect the same BYTES. So we normalise here and reject anything that is not address/bytes32/number.
-function normaliseField(name, type, value) {
-  const raw = String(value === undefined || value === null ? "" : value).trim();
-  if (raw === "") throw new Error("the quote carries no depositor-signature field: " + name);
-  if (type === "address") {
-    if (!isHex(raw, 20)) throw new Error("field " + name + " is not an address: " + raw);
-    return "0x" + raw.replace(/^0x/, "").toLowerCase();
-  }
-  if (type === "bytes32") {
-    if (!isHex(raw, 32)) throw new Error("field " + name + " is not bytes32: " + raw);
-    return "0x" + raw.replace(/^0x/, "").toLowerCase();
-  }
-  // uint64 / uint256: the wallet accepts a string; decimal and hex are parsed the same.
-  if (!isNum(raw)) throw new Error("field " + name + " is not a number: " + raw);
-  return String(BigInt(raw));
-}
-
-/**
- * EIP-712 typed data that the depositor signs (eth_signTypedData_v4).
- * The domain is built FROM THE QUOTE: verifyingContract = quote.factory, chainId = quote.chainId.
- * @returns {{ domain: object, types: object, primaryType: string, message: object }}
- */
-export function orderQuoteTypedData(quote) {
-  if (!quote || typeof quote !== "object") throw new Error("no signed quote: nothing to sign");
-  if (!isHex(quote.factory, 20)) throw new Error("the quote has no factory address - cannot build the signing domain");
-  if (!isNum(quote.chainId)) throw new Error("the quote has no chainId - cannot build the signing domain");
-  const message = {};
-  for (const [name, type] of ORDER_QUOTE_TYPED_FIELDS) {
-    message[name] = normaliseField(name, type, quote[name]);
-  }
-  return {
-    domain: {
-      name: DEPOSITOR_DOMAIN_NAME,
-      version: DEPOSITOR_DOMAIN_VERSION,
-      chainId: Number(BigInt(quote.chainId)),
-      verifyingContract: "0x" + String(quote.factory).replace(/^0x/, "").toLowerCase(),
-    },
-    types: {
-      // EIP712Domain explicit: wallets show it to the person, and it must match what the chain computes.
-      EIP712Domain: [
-        { name: "name", type: "string" },
-        { name: "version", type: "string" },
-        { name: "chainId", type: "uint256" },
-        { name: "verifyingContract", type: "address" },
-      ],
-      OrderQuote: ORDER_QUOTE_TYPED_FIELDS.map(([name, type]) => ({ name, type })),
-    },
-    primaryType: "OrderQuote",
-    message,
-  };
-}
-
-// SIGNATURE ON THE WIRE - 65 BYTES r || s || v. The form is checked HERE: the factory takes the signature as
-// three words, and a "signature-like" string must not reach the contract as consent.
-export function depositorSignatureShape(signature) {
-  const hex = String(signature === undefined || signature === null ? "" : signature).replace(/^0x/, "");
-  if (!/^[0-9a-fA-F]{130}$/.test(hex)) return { ok: false, reason: "the depositor signature must be 65 bytes (r || s || v), got " + hex.length / 2 + " bytes" };
-  let v = parseInt(hex.slice(128, 130), 16);
-  if (v < 27) v += 27;
-  if (v !== 27 && v !== 28) return { ok: false, reason: "depositor signature v outside {27,28}: " + v };
-  return { ok: true, r: "0x" + hex.slice(0, 64).toLowerCase(), s: "0x" + hex.slice(64, 128).toLowerCase(), v: 27 + (v - 27) };
-}