@ninsei-labs/sdk 0.53.0 → 0.55.0

package/CHANGELOG.md

@@ -1,4 +1,44 @@
-## Unreleased
+## 0.55.0 — 2026-10-30
+
+- `order.escrowNativeWei` reads the quote's own native amount (`payNative`) for a token-funded order and returns
+  its wei value. A quote without that figure is refused by name (`native-amount-unread`) instead of rescaling the
+  payment-token amount.
+- Relay public features now carry the `capabilities` list from relay wire revision 13, so a maker's signed
+  `node_features` has the type the relay verifies. A node without `firm/1` carries no HPKE key and no windows.
+- `@ninsei-labs/sdk/relay` exposes the relay digests, the node features verifier, the firm terms digest and the
+  HPKE view envelope for a node that embeds the SDK.
+- `swaps.start` keeps the exact atomic XMR amount from the signed order in the record's `escrow.expectedAtomic`.
+  The arrival check and a recovery file rebuilt from the chain compare that integer instead of the rounded
+  display number. A malformed or non-positive value is refused before the record is saved.
+
+## 0.54.0 — 2026-10-29
+
+- `findSwaps` no longer walks the allocator's 100,000 v1 indices in one synchronous call. One call scans at most
+  `RECOVERY_SCAN_DEFAULT` (1000) indices, yields to the event loop between chunks, and returns `nextIndex` with
+  `complete: false` and `incompleteReason: "max-index"` when it stopped. A caller continues from `nextIndex`; a search
+  that matched every order in the logs is complete without scanning the rest. `maxIndex` is the number of indices for
+  this call.
+- `findSwaps` accepts an AbortSignal-like `signal` and an `onProgress` callback. An aborted scan returns
+  `incompleteReason: "aborted"` with the same `nextIndex`; progress is reported after every chunk and after the final
+  index. The SDK creates no worker: a caller can run the same call in one.
+- The relay firm client has its signed-features check and request builder: a `NodeFeatures` digest with the
+  `FirmWindow` array, signature recovery, request binding, a normalised client half, and one HPKE envelope per
+  request. Ask carries one view scalar; bid carries two. Wire revision 13 removed the `capabilities` array: the
+  features now always carry a nonzero HPKE key and at least one firm window.
+- The relay firm client's HTTP hop is `requestFirmQuote`: it posts the exact payload once, keeps a relay refusal
+  code (`compliance`, `no_liquidity`, `size`, `paused`, `unavailable`, `bad_request`, `price_changed`), maps a
+  transport failure to `server-unavailable`, and verifies the outer frame and the inner `OrderQuote` before
+  returning. It also checks the relay/forwarded/answer relay-id equality.
+- `quotes.firmRelay` is the recovery-key adapter: it derives the client half and both view points from one
+  key, fills the provider's role for ask or bid, verifies the node half's DLEQ proof and commitment, sends one
+  relay request, and checks the registry provider and factory against the answer before returning the signed
+  `orderQuote`, the one-time joint XMR address, a `counterparty` object ready for `swaps.start`, and the maker
+  view half. `FirmOffer` now matches the direct `firm` call (`providerId`, `order`, optional `viewHalfClaimer`).
+- `swaps.sellWatch` is the client-side sell wait: it reads the escrow itself and returns `ready`,
+  `claimed` or `refunded` (or `sell-timeout`), with no backend watcher and no signature.
+- `swaps.startSell` records a sell from a verified relay offer: the one-time address, escrow, our half and the
+  order expectations survive a reload; the same offer resumes the same record. `swaps.sellClaim` claims from
+  that record, from the claimer's own wallet.
 
 ## 0.53.0 — 2026-10-28
 

package/LICENSE-POLICY.md

@@ -0,0 +1,46 @@
+# Dependency license policy
+
+The SDK is published as a public package under MIT. Its production dependency tree must stay compatible with
+that promise: a dependency with a copyleft, source-available, unknown or missing licence is a decision for a
+person, not something that enters a release by accident.
+
+## Allowed licences
+
+A production dependency may use one of these licences:
+
+- MIT
+- MIT-0
+- ISC
+- Apache-2.0
+- BSD-2-Clause
+- BSD-3-Clause
+- Unlicense
+- 0BSD
+- CC0-1.0
+- BlueOak-1.0.0
+
+An SPDX expression is read as written: `MIT OR Apache-2.0` is allowed when one branch is allowed, and
+`MIT AND ISC` is allowed when every branch is allowed. A `WITH` exception keeps the base licence's decision.
+`SEE LICENSE IN ...`, `UNLICENSED`, `UNKNOWN`, and every licence outside the list are refused.
+
+## How the check runs
+
+`pnpm licenses list --prod --json` reads the installed production tree, including transitive packages. The
+check is implemented in `tools/check-licenses.mjs`; CI runs it in the **License Compliance** workflow on every
+pull request and every push to `main`.
+
+```sh
+pnpm run check:licenses
+```
+
+The command prints the packages grouped by licence. If any package is outside the allowlist, it prints each
+package and its licence, then exits non-zero.
+
+## Notices travel with the package
+
+`pnpm run notices` regenerates `THIRD_PARTY_NOTICES.md` from the production tree, including the licence text and
+the `NOTICE` files each package ships. The file is published with the package and the same CI workflow checks that
+it is current. A dependency change that edits the lockfile but not the notices fails the check; run `pnpm run
+notices` and review the result with the dependency change.
+
+Development dependencies are not part of the published package and are not covered by these checks.

package/README.md

@@ -17,7 +17,8 @@ machine). The wallet arrives as an EIP-1193 provider, storage as an adapter, and
 | `recovery.open` — parsing the recovery file | works |
 | `sim` — sandbox scenarios and time | works (applying to a swap — stage 2) |
 | `quotes.watch` | works: live indicative quotes, its own client; a snapshot carries the display fields (sides, networks, `why`, signature, age, maturity), and the size can be NAMED (`size`) |
-| `quotes.firm` | answers `not-implemented` (stage 2: signing with a key and the order protocol) |
+| `quotes.firm` | works: a signed, binding quote with a TTL; a refusal is a named code |
+| `quotes.firmRelay` | works: a firm quote through a relay, built from one recovery key; the node half is DLEQ-checked |
 | `swaps.list` / `swaps.get` | read state from storage (and after a page reload) |
 | `swaps.start` | holds the order: guards → recovery file and the person's confirmation → order → locking funds → **recording with us and watching the Monero address**; returns the named state `step: "xmr-incoming"` |
 | `swaps.watch` | waits for XMR to arrive at the joint address with the same request as the page (`GET /swaps/{id}`): arrived — returns the fact (amount, confirmations, txid); did not wait — a refusal with the code `xmr-timeout`; already on the address but barred by `unlock_time` — a refusal with the code `xmr-locked` (the boundary is in `params.until`), and NO ready mark; the maker DECLINED the order — returns `SwapDeclinedWatch` (`declined: true`, `terminal: "declined"`, the node's own `code`), with every action off; with expectations and a wallet, places the ready mark after the arrival |
@@ -173,7 +174,7 @@ signature, the age (`ageMs`) and the maturity level (`finality`) — display fie
 The price does not depend on volume: the volume is needed by the provider to say whether it takes such a size. So
 the size is computed from the person's amount and is snapped to the node's grid **down**, and a size outside the
 range is not aligned: it is the provider's refusal, and it arrives as a code. Indicative quotes commit to nothing;
-`quotes.firm` commits (stage 2).
+`quotes.firm` and `quotes.firmRelay` commit, and the relay path carries the maker's signed terms and its view half.
 
 ## Found orders and the paying token
 
@@ -182,8 +183,12 @@ public `salt` in its own `OrderCreated`: the binding is `ninsei-taker-v2|<chain>
 words on another device or at another factory produce a different half and no number is reserved. The result says
 `derivation: "salt-v2"` and leaves `index` null. Existing v1 orders stay on `ninsei-taker-v1|<chain>|<index>` and are
 still found by the index path; a v2 result needs no range scan. For a v1 fallback, discovery does **not** stop after a
-run of empty numbers: the allocator's whole range is searched by default, a smaller caller-supplied `maxIndex` returns
-`complete: false` with `searchedUpTo`, and `gap` is ignored. Each found order reports:
+run of empty numbers. One call scans at most `RECOVERY_SCAN_DEFAULT` (1000) indices; that keeps a shared factory from
+freezing the page. The result names where it stopped: `complete: false`, `searchedUpTo`, `incompleteReason: "max-index"`
+and `nextIndex`. A caller that needs more passes `nextIndex` back as `fromIndex`; the scan yields between chunks so the
+page stays responsive. `maxIndex` is the number of indices for this call, and `gap` is ignored. `onProgress` receives
+`{ scanned, index }` after each chunk and after the final index; `signal` stops between chunks and returns
+`incompleteReason: "aborted"` with the same resumable shape.
 
 - `amount` — the escrow's **native** amount in wei;
 - `settlementToken: "native"` — what the escrow receives;
@@ -311,7 +316,10 @@ trigger where those exist; on another VM they simply do not appear, rather than
 5. **Workers and WASM are separate files** from `assetsBase`, so the interface's bundler (Astro/Vite) does not
    touch them: `atomic/order-worker.js`, the Monero bundles.
 6. **Strict CSP.** The package is designed for a policy without `eval` and inline.
-7. **Zero dependencies.**
+7. **Few dependencies, all permissive.** Every production dependency is checked in CI against an allowlist: MIT, MIT-0,
+   ISC, Apache-2.0, BSD-2-Clause, BSD-3-Clause, Unlicense, 0BSD, CC0-1.0 and BlueOak-1.0.0. Copyleft,
+   source-available, unknown or missing licences fail `pnpm run check:licenses`; the licence texts travel in
+   [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md), and the policy is in [LICENSE-POLICY.md](LICENSE-POLICY.md).
 
 ## Releases and prereleases