@ninsei-labs/sdk 0.51.2 → 0.53.0

package/src/recovery-key.mjs

@@ -17,7 +17,7 @@ import { generateMnemonic, mnemonicToSeedSync, validateMnemonic } from "@scure/b
 import { wordlist } from "@scure/bip39/wordlists/english.js";
 import { createHalves } from "../engine/atomic/halves.js";
 import { halfCommitmentHex } from "../engine/atomic/orderHalfCommit.js";
-import { ORDER_CREATED_TOPIC } from "../engine/evm/factory.js";
+import { ORDER_CREATED_TOPIC, ORDER_CREATED_TOPICS } from "../engine/evm/factory.js";
 import { SdkError } from "./errors.mjs";
 import { probeMoneroNode } from "./probes.mjs";
 import { ed25519, keccak256, randomBytes, secp256k1 } from "./primitives.mjs";
@@ -27,9 +27,16 @@ const halves = createHalves({ ed25519, secp256k1, keccak256, randomBytes });
 /** A BIP39 mnemonic with 128 bits of entropy: twelve words. */
 export const RECOVERY_KEY_VERSION = 1;
 export const RECOVERY_KEY_WORDS = 12;
+// The allocator's ceiling. Discovery must use the same range: a search that stops earlier can miss an order
+// whose number was skipped by an abandoned start or by a swap on another chain.
+export const RECOVERY_INDEX_MAX = 100000;
 export const RECOVERY_KEY_STORE = "ninsei.recovery.key.v1";
 export const RECOVERY_KEY_FILE_MAGIC = "NINSEI RECOVERY KEY";
 export const RECOVERY_KEY_DOMAIN = "ninsei-taker-v1";
+// THE SALT-BASED VERSION. A v1 number is the same at every factory and every device; a v2 binding names the fresh
+// order salt, the factory and the role, so two orders cannot share a taker half even when the words are restored
+// elsewhere. The salt is already public in `OrderCreated`; recovery reads it back instead of reserving a number.
+export const RECOVERY_KEY_DOMAIN_V2 = "ninsei-taker-v2";
 // The counterparty's view half is derived from the SAME ONE KEY, in a domain of its own. The taker sends this
 // number to the maker (the node), which uses it as its own view half; the taker keeps it, so the joint view key
 // can be rebuilt from the twelve words without any server.
@@ -40,6 +47,7 @@ export const RECOVERY_KEY_ITER = 600000;
 const ITER_MIN = 600000;
 const ITER_MAX = 6000000;
 
+const ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;
 const te = new TextEncoder();
 const td = new TextDecoder();
 
@@ -121,8 +129,38 @@ export function recoveryBinding(chainId, index) {
  * package is a hex string, and a BigInt that reaches JSON.stringify fails the whole record.
  */
 export function takerHalves({ mnemonic, chainId, index }) {
-  const binding = recoveryBinding(chainId, index);
-  const seed = seedOf(mnemonic);
+  return takerHalvesFromSeed(seedOf(mnemonic), chainId, index);
+}
+
+// THE SAME KEY, A PUBLIC PER-ORDER SALT. The factory and role are in the binding, so the same words, chain and
+// salt at another factory produce another half. `role` is fixed for the taker's side; the maker's view half is
+// separated by its own domain. Salt is the `salt` word from `OrderCreated`, never a secret.
+export function recoveryBindingV2({ chainId, factory, role = "taker", salt } = {}) {
+  if (typeof factory !== "string" || !ADDRESS_RE.test(factory)) throw bad("factory");
+  if (typeof role !== "string" || !/^[a-z0-9-]{1,32}$/.test(role)) throw bad("role");
+  return `${RECOVERY_KEY_DOMAIN_V2}|${numberField(chainId, "chainId")}|${factory.toLowerCase()}|${role}|${recoverySaltOf(salt)}`;
+}
+
+export function takerHalvesV2({ mnemonic, chainId, factory, role = "taker", salt } = {}) {
+  const normalized = recoverySaltOf(salt);
+  const binding = recoveryBindingV2({ chainId, factory, role, salt: normalized });
+  return {
+    ...halvesFromBinding(seedOf(mnemonic), binding),
+    index: null,
+    derivation: "salt-v2",
+    factory: factory.toLowerCase(),
+    role,
+    salt: normalized,
+  };
+}
+
+// Discovery derives thousands of numbers from one mnemonic. The BIP39 seed is the expensive part (PBKDF2), so it
+// is computed once by the caller and passed here; the per-number work is only HMAC and a curve point.
+function takerHalvesFromSeed(seed, chainId, index) {
+  return { index: numberField(index, "index"), ...halvesFromBinding(seed, recoveryBinding(chainId, index)) };
+}
+
+function halvesFromBinding(seed, binding) {
   const spendHalf = halves.halfFromSeed(seed, binding, halves.HALF_DOMAIN);
   const viewHalf = halves.halfFromSeed(seed, binding, halves.VIEW_HALF_DOMAIN);
   // THE OTHER SIDE'S VIEW HALF. The same key, a third domain: the taker gives this number to the maker, so the
@@ -132,7 +170,6 @@ export function takerHalves({ mnemonic, chainId, index }) {
   const view = halves.publicHalves(viewHalf);
   const makerView = halves.publicHalves(makerViewHalf);
   return {
-    index: numberField(index, "index"),
     binding,
     spendHalf: hex32(spendHalf),
     viewHalf: hex32(viewHalf),
@@ -144,6 +181,41 @@ export function takerHalves({ mnemonic, chainId, index }) {
   };
 }
 
+// DISCOVERY NEEDS ONE COMMITMENT, NOT THREE POINTS. The view and maker-view halves are not compared during a
+// search, and their Edwards points are the expensive part of `takerHalves`; deriving only the spend scalar keeps
+// a full-range scan practical.
+function spendCommitmentFromSeed(seed, chainId, index) {
+  const spendHalf = halves.halfFromSeed(seed, recoveryBinding(chainId, index), halves.HALF_DOMAIN);
+  return halfCommitmentHex(spendHalf, secp256k1, keccak256).toLowerCase();
+}
+
+function spendCommitmentFromSeedV2(seed, { chainId, factory, role = "taker", salt }) {
+  const binding = recoveryBindingV2({ chainId, factory, role, salt });
+  const spendHalf = halves.halfFromSeed(seed, binding, halves.HALF_DOMAIN);
+  return halfCommitmentHex(spendHalf, secp256k1, keccak256).toLowerCase();
+}
+
+// The salt is the 32-byte word from the order, not a secret and not a tag. Lower-case it so the binding is stable
+// across an event decoder and a caller that hand-wrote the value.
+/** A fresh public salt for one v2 order. The client owns it; a maker must not hand the same value back twice. */
+export function newRecoverySalt() {
+  return "0x" + Array.from(randomBytes(32), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+
+export function recoverySaltOf(value) {
+  if (typeof value === "bigint") return saltField("0x" + value.toString(16).padStart(64, "0"));
+  if (typeof value === "number" && Number.isSafeInteger(value) && value >= 0) {
+    return saltField("0x" + BigInt(value).toString(16).padStart(64, "0"));
+  }
+  return saltField(value);
+}
+
+function saltField(value) {
+  const salt = String(value == null ? "" : value).trim().toLowerCase();
+  if (!/^0x[0-9a-f]{64}$/.test(salt)) throw bad("salt");
+  return salt;
+}
+
 // ---------------------------------------------------------------------------------------------------
 // THE BACKUP FILE
 // ---------------------------------------------------------------------------------------------------
@@ -274,23 +346,31 @@ export async function openRecoveryKeyFile(contents, passphrase = "") {
 // RESERVATION
 // ---------------------------------------------------------------------------------------------------
 
+const storageFailure = (step) => new SdkError("storage-unavailable", { step });
 const readStore = (storage) => {
   if (!storage || typeof storage.get !== "function" || typeof storage.set !== "function" || typeof storage.remove !== "function") throw bad("storage");
-  const raw = storage.get(RECOVERY_KEY_STORE);
-  if (!raw) return null;
-  try {
-    const value = JSON.parse(raw);
-    if (!value || value.version !== RECOVERY_KEY_VERSION || typeof value.mnemonic !== "string") return null;
-    return value;
-  } catch {
-    return null;
-  }
+  let raw;
+  try { raw = storage.get(RECOVERY_KEY_STORE); } catch { throw storageFailure("read"); }
+  // NOTHING STORED IS NOT AN UNREADABLE STORE. `null`/absent means no key yet; a throwing read or a corrupt
+  // record must be named, because the next start would otherwise overwrite a key it could not read.
+  if (raw === undefined || raw === null || raw === "") return null;
+  let value;
+  try { value = JSON.parse(raw); } catch { throw storageFailure("parse"); }
+  if (!value || value.version !== RECOVERY_KEY_VERSION || typeof value.mnemonic !== "string") throw storageFailure("parse");
+  return value;
+};
+
+const writeStore = (storage, value) => {
+  let text;
+  try { text = JSON.stringify(value); } catch { throw storageFailure("serialize"); }
+  try { storage.set(RECOVERY_KEY_STORE, text); } catch { throw storageFailure("write"); }
 };
 
 /** Save the key next to the swap records. The words are the secret; the store is the caller's. */
 export function saveRecoveryKey(storage, key) {
   const checked = recoveryKeyOf(key && key.mnemonic, key && key.createdAt);
-  storage.set(RECOVERY_KEY_STORE, JSON.stringify({ ...checked, nextIndex: Number(key.nextIndex) || 0, reserved: key.reserved || {}, retired: key.retired || {} }));
+  writeStore(storage, { ...checked, nextIndex: Number(key.nextIndex) || 0,
+    reserved: key.reserved || {}, retired: key.retired || {}, backupConfirmed: key.backupConfirmed === true });
   return checked;
 }
 
@@ -316,13 +396,13 @@ export function reserveRecoveryIndex(storage, { chainId, swapId = null } = {}) {
   for (let i = 0; i < index; i += 1) {
     if (!Object.prototype.hasOwnProperty.call(reserved, i) && !Object.prototype.hasOwnProperty.call(retired, i)) {
       reserved[i] = { chainId: chain, swapId, at: new Date().toISOString() };
-      storage.set(RECOVERY_KEY_STORE, JSON.stringify({ ...key, reserved, retired }));
+      writeStore(storage, { ...key, reserved, retired });
       return i;
     }
   }
-  if (index >= 100000) throw failed("index-exhausted");
+  if (index >= RECOVERY_INDEX_MAX) throw failed("index-exhausted");
   reserved[index] = { chainId: chain, swapId, at: new Date().toISOString() };
-  storage.set(RECOVERY_KEY_STORE, JSON.stringify({ ...key, nextIndex: index + 1, reserved, retired }));
+  writeStore(storage, { ...key, nextIndex: index + 1, reserved, retired });
   return index;
 }
 
@@ -331,7 +411,7 @@ export function releaseRecoveryIndex(storage, index) {
   if (!key) throw failed("key-missing");
   const reserved = { ...(key.reserved || {}) };
   delete reserved[String(numberField(index, "index"))];
-  storage.set(RECOVERY_KEY_STORE, JSON.stringify({ ...key, reserved }));
+  writeStore(storage, { ...key, reserved });
 }
 
 /** Retire a number after its order exists on chain: it is never reused, so a later scan has no collision. */
@@ -343,15 +423,13 @@ export function commitRecoveryIndex(storage, index) {
   const n = numberField(index, "index");
   delete reserved[String(n)];
   retired[String(n)] = true;
-  storage.set(RECOVERY_KEY_STORE, JSON.stringify({ ...key, reserved, retired }));
+  writeStore(storage, { ...key, reserved, retired });
 }
 
 // ---------------------------------------------------------------------------------------------------
 // THE SEARCH
 // ---------------------------------------------------------------------------------------------------
 
-const ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;
-
 function topicAddress(address) {
   if (typeof address !== "string" || !ADDRESS_RE.test(address)) throw bad("address");
   return pad32(address);
@@ -359,10 +437,15 @@ function topicAddress(address) {
 
 function decodeOrderLog(log) {
   const topics = Array.isArray(log && log.topics) ? log.topics : [];
-  if (topics.length < 4 || String(topics[0]).toLowerCase() !== ORDER_CREATED_TOPIC) return null;
+  const topic0 = String(topics[0] || "").toLowerCase();
+  if (topics.length < 4 || !ORDER_CREATED_TOPICS.includes(topic0)) return null;
   const data = String(log.data || "").replace(/^0x/, "");
-  if (data.length < 64 * 2) return null;
+  const modern = topic0 === ORDER_CREATED_TOPIC;
+  if (data.length < 64 * (modern ? 13 : 12)) return null;
   const word = (i) => "0x" + data.slice(i * 64, (i + 1) * 64).toLowerCase();
+  // THE FIELD OFFSETS MOVED WHEN `xmrAmount` JOINED THE EVENT. The old topic has no XMR amount; its orders fall
+  // back to the clone read, and a caller can still tell why from `xmrAmountReason`.
+  const shift = modern ? 1 : 0;
   return {
     escrow: "0x" + String(topics[1]).slice(26).toLowerCase(),
     locker: "0x" + String(topics[2]).slice(26).toLowerCase(),
@@ -373,12 +456,13 @@ function decodeOrderLog(log) {
     edPointClaimer: word(3),
     edViewPointLocker: word(4),
     amount: BigInt(word(5)).toString(),
-    readyBy: Number(BigInt(word(6))),
-    t1: Number(BigInt(word(7))),
-    salt: word(8),
-    registry: "0x" + data.slice(9 * 64 + 24, 10 * 64),
-    provider: "0x" + data.slice(10 * 64 + 24, 11 * 64),
-    quoteKey: "0x" + data.slice(11 * 64 + 24, 12 * 64),
+    xmrAmount: modern ? BigInt(word(6)).toString() : null,
+    readyBy: Number(BigInt(word(6 + shift))),
+    t1: Number(BigInt(word(7 + shift))),
+    salt: word(8 + shift),
+    registry: "0x" + data.slice((9 + shift) * 64 + 24, (10 + shift) * 64),
+    provider: "0x" + data.slice((10 + shift) * 64 + 24, (11 + shift) * 64),
+    quoteKey: "0x" + data.slice((11 + shift) * 64 + 24, (12 + shift) * 64),
     transactionHash: log.transactionHash || null,
     blockNumber: log.blockNumber != null ? Number(log.blockNumber) : null,
     logIndex: log.logIndex != null ? Number(log.logIndex) : null,
@@ -431,7 +515,7 @@ async function readLogs(evmLogs, request) {
 export async function recoveryIndexTaken({ mnemonic, chainId, index, factory, evmLogs, fromBlock = 0, toBlock = "latest" } = {}) {
   if (typeof factory !== "string" || !ADDRESS_RE.test(factory)) throw bad("factory");
   const own = takerHalves({ mnemonic, chainId, index });
-  const logs = await readLogs(evmLogs, { address: factory, topics: [ORDER_CREATED_TOPIC], fromBlock, toBlock });
+  const logs = await readLogs(evmLogs, { address: factory, topics: [ORDER_CREATED_TOPICS], fromBlock, toBlock });
   return logs.map(decodeOrderLog).filter(Boolean).some((order) =>
     order.commitHalfLocker.toLowerCase() === own.spendCommitment.toLowerCase() ||
     order.commitHalfClaimer.toLowerCase() === own.spendCommitment.toLowerCase());
@@ -537,7 +621,13 @@ async function recoveredStartHeight(order, { evmBlockTime, moneroTip, moneroBloc
   // timestamp is already needed here for the Monero height, so it is returned with it.
   let timestamp = cache.get(order.blockNumber);
   if (timestamp === undefined) {
-    timestamp = typeof evmBlockTime === "function" ? secondsOf(await evmBlockTime(order.blockNumber)) : null;
+    // ONE UNREADABLE BLOCK TIME MUST NOT THROW AWAY THE ORDERS ALREADY MATCHED. The order is still a fact from
+    // its log; only the start height is unknown, and the reason says which read failed.
+    try {
+      timestamp = typeof evmBlockTime === "function" ? secondsOf(await evmBlockTime(order.blockNumber)) : null;
+    } catch {
+      return { startHeight: null, startHeightReason: "block-time-read", blockTime: null };
+    }
     if (timestamp === null) return { startHeight: null, startHeightReason: "no-block-time", blockTime: null };
     cache.set(order.blockNumber, timestamp);
   }
@@ -560,13 +650,16 @@ async function recoveredStartHeight(order, { evmBlockTime, moneroTip, moneroBloc
  * positions) and merges the answers. Without one, every OrderCreated of the factory is read and matched locally.
  */
 export async function findSwaps({ mnemonic, chainId, factory, address = null, evmLogs,
-  fromBlock = null, deploymentBlock = null, toBlock = "latest", gap = 5, maxIndex = 1000,
+  fromBlock = null, deploymentBlock = null, toBlock = "latest", gap = 5, maxIndex = RECOVERY_INDEX_MAX,
   evmBlockTime = null, evmCode = null, moneroTip = null, moneroBlockTimestamp = null,
   xmrNodes = null, moneroNetwork = null, fetchImpl = globalThis.fetch } = {}) {
   if (typeof factory !== "string" || !ADDRESS_RE.test(factory)) throw bad("factory");
   const chain = numberField(chainId, "chainId");
-  const max = numberField(maxIndex, "maxIndex") || 1000;
-  const missesAllowed = numberField(gap, "gap") || 5;
+  // `gap` is retained in the signature for callers of the old API, but it is deliberately NOT used: five empty
+  // numbers are ordinary when a start was abandoned or the key was used on another chain, and stopping there
+  // hides a funded order whose log is already in `logs`.
+  void gap;
+  const max = Math.min(numberField(maxIndex, "maxIndex") || RECOVERY_INDEX_MAX, RECOVERY_INDEX_MAX);
   // THE CHAIN SAYS WHERE ITS ORDERS CAN START. An explicit fromBlock wins; otherwise the caller can pass the
   // factory's deployment block (the SDK's chain registry exposes it as escrow.deploymentBlock). Zero remains the
   // last resort for a caller that knows the factory existed at genesis.
@@ -581,8 +674,8 @@ export async function findSwaps({ mnemonic, chainId, factory, address = null, ev
   if (address) {
     const padded = topicAddress(address);
     const [asLocker, asClaimer] = await Promise.all([
-      readLogs(evmLogs, { ...base, topics: [ORDER_CREATED_TOPIC, null, padded, null] }),
-      readLogs(evmLogs, { ...base, topics: [ORDER_CREATED_TOPIC, null, null, padded] }),
+      readLogs(evmLogs, { ...base, topics: [ORDER_CREATED_TOPICS, null, padded, null] }),
+      readLogs(evmLogs, { ...base, topics: [ORDER_CREATED_TOPICS, null, null, padded] }),
     ]);
     const seen = new Set();
     for (const log of asLocker.concat(asClaimer)) {
@@ -592,26 +685,67 @@ export async function findSwaps({ mnemonic, chainId, factory, address = null, ev
       logs.push(log);
     }
   } else {
-    logs = await readLogs(evmLogs, { ...base, topics: [ORDER_CREATED_TOPIC] });
+    logs = await readLogs(evmLogs, { ...base, topics: [ORDER_CREATED_TOPICS] });
   }
   const orders = logs.map(decodeOrderLog).filter(Boolean);
+  for (const order of orders) order.factory = factory;
+  const orderKey = (order) => `${order.transactionHash || ""}:${order.logIndex ?? ""}`;
+  const seed = seedOf(mnemonic);
   const found = [];
-  let misses = 0;
-  let scanned = 0;
-  for (let index = 0; index < max && misses < missesAllowed; index += 1) {
-    scanned = index + 1;
-    const own = takerHalves({ mnemonic, chainId: chain, index });
-    const matches = orders.filter((order) =>
-      order.commitHalfLocker.toLowerCase() === own.spendCommitment.toLowerCase() ||
-      order.commitHalfClaimer.toLowerCase() === own.spendCommitment.toLowerCase()
-    );
-    if (matches.length === 0) {
-      misses += 1;
+  const foundKeys = new Set();
+  const v2Matched = new Set();
+
+  // A V2 ORDER IS FOUND FROM ITS OWN SALT. No index is reserved and no range is scanned: the binding names the
+  // factory, the role and the public `OrderCreated` salt, so the same words on another device or at another
+  // factory produce a different half. The v2 pass runs first; v1 orders are left for the index scan below.
+  for (const order of orders) {
+    let commitment;
+    try {
+      commitment = spendCommitmentFromSeedV2(seed, { chainId: chain, factory, role: "taker", salt: order.salt });
+    } catch {
       continue;
     }
-    misses = 0;
-    for (const order of matches) {
-      found.push({ ...order, index, side: order.commitHalfLocker.toLowerCase() === own.spendCommitment.toLowerCase() ? "locker" : "claimer" });
+    const locker = order.commitHalfLocker.toLowerCase();
+    const claimer = order.commitHalfClaimer.toLowerCase();
+    const side = commitment === locker ? "locker" : commitment === claimer ? "claimer" : null;
+    if (!side) continue;
+    const key = orderKey(order);
+    if (foundKeys.has(key)) continue;
+    foundKeys.add(key);
+    v2Matched.add(key);
+    found.push({ ...order, index: null, derivation: "salt-v2", side });
+  }
+
+  // MATCH V1 BY COMMITMENT, NOT BY A DENSE INDEX RANGE. The logs are already in hand; the only cost of a missing
+  // index is one derivation. Building the map first also keeps each order from being compared against every
+  // index.
+  const byCommit = new Map();
+  for (const order of orders) {
+    if (v2Matched.has(orderKey(order))) continue;
+    const locker = order.commitHalfLocker.toLowerCase();
+    const claimer = order.commitHalfClaimer.toLowerCase();
+    if (locker) {
+      if (!byCommit.has(locker)) byCommit.set(locker, []);
+      byCommit.get(locker).push({ order, side: "locker" });
+    }
+    if (claimer && claimer !== locker) {
+      if (!byCommit.has(claimer)) byCommit.set(claimer, []);
+      byCommit.get(claimer).push({ order, side: "claimer" });
+    }
+  }
+  const v1Needed = orders.some((order) => !v2Matched.has(orderKey(order)));
+  let scanned = 0;
+  if (v1Needed) {
+    for (let index = 0; index < max; index += 1) {
+      scanned = index + 1;
+      const commitment = spendCommitmentFromSeed(seed, chain, index);
+      const matches = byCommit.get(commitment) || [];
+      for (const { order, side } of matches) {
+        const key = orderKey(order);
+        if (foundKeys.has(key)) continue;
+        foundKeys.add(key);
+        found.push({ ...order, index, derivation: "index-v1", side });
+      }
     }
   }
   // EACH FOUND ORDER CARRIES THE MONERO HEIGHT ITS WITHDRAWAL MAY START FROM. The rule lives here, not in a
@@ -637,9 +771,14 @@ export async function findSwaps({ mnemonic, chainId, factory, address = null, ev
   for (const order of found) {
     Object.assign(order, await recoveredStartHeight(order, { evmBlockTime, moneroTip: tip, moneroBlockTimestamp: header, cache, readersReason }));
   }
-  // THE XMR AMOUNT IS IN THE CLONE, NOT IN THE LOG. A caller without a code reader gets null and a named reason;
-  // an unreadable or differently-shaped contract does the same. This is data, not a withdrawal verdict.
+  // THE XMR AMOUNT COMES FROM THE EVENT IN THE CURRENT FACTORY. The previous event has no field; those orders fall
+  // back to the clone read, where word 18 is read only from a clone of the exact shape. This is data, not a
+  // withdrawal verdict.
   for (const order of found) {
+    if (order.xmrAmount !== null && order.xmrAmount !== undefined) {
+      order.xmrAmountReason = "event";
+      continue;
+    }
     if (typeof evmCode !== "function") {
       order.xmrAmount = null;
       order.xmrAmountReason = "no-code-reader";
@@ -657,5 +796,15 @@ export async function findSwaps({ mnemonic, chainId, factory, address = null, ev
     order.xmrAmount = read.value;
     order.xmrAmountReason = read.reason;
   }
-  return { swaps: found, scanned };
+  const complete = !v1Needed || max >= RECOVERY_INDEX_MAX;
+  return {
+    swaps: found,
+    scanned,
+    // A CALLER MUST NOT READ "NO SWAPS" AS "THE WHOLE RANGE WAS SEARCHED". The allocator ceiling is the only
+    // complete range; a smaller caller-supplied bound says where the search stopped. A result made only of v2
+    // orders has no range to search and is complete by construction.
+    searchedUpTo: scanned ? scanned - 1 : null,
+    complete,
+    ...(complete ? {} : { incompleteReason: "max-index" }),
+  };
 }

package/src/recovery.mjs

@@ -23,9 +23,17 @@ export function createRecovery({ http = null, config = null } = {}) {
     async open(file, passphrase) {
       const contents = contentsOf(file);
       if (contents === null) throw new SdkError("bad-input", { field: "file" });
+      // THE ENVELOPE IS PARSED AT THE BOUNDARY: `restoreFromFile` takes the OBJECT, while the file arrives as text.
+      // A text passed through reached the parser as a string and every valid file failed as `stage: restore`.
+      let envelope;
+      try {
+        envelope = JSON.parse(contents);
+      } catch {
+        throw new SdkError("recovery-failed", { stage: "parse" });
+      }
       let restored;
       try {
-        restored = await engine.restore.restoreFromFile(contents, passphrase);
+        restored = await engine.restore.restoreFromFile(envelope, passphrase);
       } catch (error) {
         // Parsing, decryption and the address check live in the engine; a code goes out, not the engine's wording.
         throw new SdkError("recovery-failed", { stage: "restore" });

package/src/swap-flow.mjs

@@ -193,7 +193,8 @@ export async function runAtomicOrder({
       // string, and that turned the check into a ritual: the stand-in's proof was bound to a different string,
       // that is, to nothing. Now exactly the path a real provider would take is checked.
       const mock = await worker.buildSide(orderContext);
-      counter = { proof: mock.proof, edPub: mock.pub.ed, mock, viewHalf: mock.viewHalf, viewPoint: mock.viewPub };
+      counter = { proof: mock.proof, edPub: mock.pub.ed, mock, viewHalf: mock.viewHalf, viewPoint: mock.viewPub,
+        commitHalfClaimer: (await worker.halfCommitment(mock.half)).commitment };
     }
     // THE COUNTERPARTY CHECK REMAINS ONE AND IT IS THE MAIN ONE: the DLEQ proof in the context of this order.
     // It confirms that both public points stand for ONE scalar - that is, that the half declared for the Monero
@@ -203,7 +204,7 @@ export async function runAtomicOrder({
     // receive: without that check a correct proof would guarantee nothing about the chain.
     say("verify", "dleq");
     const verdict = await worker.verifyCounterparty(orderContext, {
-      proof: counter.proof, edPub: counter.edPub,
+      proof: counter.proof, edPub: counter.edPub, commitHalfClaimer: counter.commitHalfClaimer,
     }, null);
     if (!verdict.ok) throw new SdkError("quote-refused", { step: "proof", why: "rejected" });