@tokamak-private-dapps/private-state-cli 1.1.0 → 1.1.1

package/CHANGELOG.md

@@ -1,7 +1,25 @@
 # Changelog
 
+## 1.1.1 - 2026-05-08
+
+- Added bridge deployment verification support for Etherscan-compatible explorers, including
+  proxy and implementation verification for the main bridge contracts after deploy or upgrade
+  flows.
+- Added an incremental ChannelManager verification script that scans channel creation events from
+  the last indexed block, skips already verified channel contracts, and persists scan progress for
+  later runs.
+- Required `channel join` to refresh through the recovery index before joining an existing channel,
+  while preserving the explicit `--from-genesis` path for recovery commands that intentionally
+  rebuild workspace state from channel genesis.
+- Verified the private-state CLI end-to-end flow with isolated local workspace state after the
+  indexed join recovery change.
+
 ## 1.1.0 - 2026-05-06
 
+- Required `channel join` to use an existing recovered channel workspace and refresh through the
+  recovery index before submitting the join transaction, so old channels are not silently replayed
+  from genesis during join. `wallet recover-workspace --from-genesis` now also replays encrypted
+  note delivery logs from channel genesis for existing wallets.
 - Refreshed channel workspaces through the existing recovery-indexed replay path after successful
   wallet transactions instead of manually patching local snapshots, and bounded post-transaction
   replay by the transaction receipt block so provider latest-block lag cannot skip the confirmed

package/README.md

@@ -110,6 +110,11 @@ private-state-cli wallet recover-workspace --channel-name <CHANNEL> --network ma
 `channel create` is the exception: after the channel is created on-chain, the CLI initializes that new local workspace
 by replaying from the channel's genesis block because no prior recovery index can exist for a new channel.
 
+`channel join` requires the channel workspace to have a usable recovery index and refreshes that workspace through the
+indexed path before submitting the registration transaction. For a channel that was created elsewhere, run
+`channel recover-workspace --from-genesis` once before joining; later joins and wallet commands resume from the saved
+index instead of silently replaying from genesis.
+
 Wallet getter commands that need channel state, including `wallet get-meta`, `wallet get-channel-fund`, and
 `wallet get-notes`, follow the same indexed recovery rule before reading local or on-chain state. `wallet get-notes` also uses
 the wallet's saved note-receive scan index for encrypted note delivery logs. If either index is unusable, the command

package/lib/private-state-cli-command-registry.mjs

@@ -332,6 +332,8 @@ export const PRIVATE_STATE_CLI_COMMANDS = Object.freeze([
     fields: ["channelName", "network", "account", "walletSecretPath", "rpcUrl"],
     usage: "--channel-name, --network, --account, --wallet-secret-path, and optional --rpc-url",
     help: [
+      "Requires a recovered channel workspace and refreshes it through the workspace recovery index before joining",
+      "Run channel recover-workspace --from-genesis once if no usable local recovery index exists",
       "--wallet-secret-path imports an existing source secret file into the protected wallet-local secret file",
       "Prints the immutable policy snapshot before first registration",
     ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokamak-private-dapps/private-state-cli",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "Command-line client for the Tokamak private-state DApp.",
   "license": "MIT OR Apache-2.0",
   "author": "Tokamak Network",

package/private-state-bridge-cli.mjs

@@ -846,11 +846,6 @@ async function syncChannelWorkspace({
     ethers.toBigInt(derivedAPubBlockHash) === ethers.toBigInt(normalizeBytes32Hex(channelInfo.aPubBlockHash)),
     `Derived channel block-info hash ${derivedAPubBlockHash} does not match onchain ${channelInfo.aPubBlockHash}.`,
   );
-  const localSnapshotReusable = !fromGenesis && canReuseLocalWorkspaceSnapshot({
-    existingArtifacts,
-    currentRootVectorHash,
-    managedStorageAddresses,
-  });
   const recoveryIndex = useWorkspaceRecoveryIndex && !fromGenesis
     ? getUsableWorkspaceRecoveryIndex({
       existingArtifacts,
@@ -859,6 +854,12 @@ async function syncChannelWorkspace({
       managedStorageAddresses,
     })
     : null;
+  const localSnapshotReusable = !fromGenesis && (!useWorkspaceRecoveryIndex || recoveryIndex)
+    && canReuseLocalWorkspaceSnapshot({
+      existingArtifacts,
+      currentRootVectorHash,
+      managedStorageAddresses,
+    });
   if (useWorkspaceRecoveryIndex && !fromGenesis && !localSnapshotReusable && !recoveryIndex) {
     throw new Error([
       `Workspace recovery index is missing or unusable for channel ${channelName} on ${networkNameFromChainId(network.chainId)}.`,
@@ -1155,6 +1156,7 @@ async function handleRecoverWallet({ args, network, provider, rpcUrl }) {
       signer,
       noteReceiveKeyMaterial,
       progressAction: "wallet recover-workspace",
+      fromGenesis: args.fromGenesis === true,
     });
     printJson({
       action: "wallet recover-workspace",
@@ -1202,6 +1204,7 @@ async function handleRecoverWallet({ args, network, provider, rpcUrl }) {
     signer,
     noteReceiveKeyMaterial,
     progressAction: "wallet recover-workspace",
+    fromGenesis: args.fromGenesis === true,
   });
 
   printJson({
@@ -2861,6 +2864,13 @@ async function handleJoinChannel({ args, network, provider, rpcUrl }) {
   );
   status = "joined";
 
+  await refreshPersistedWorkspaceAfterLocalTransaction({
+    context,
+    provider,
+    receipt,
+    progressAction: "channel join",
+  });
+
   const walletContext = ensureWallet({
     channelContext: context,
     signerAddress: signer.address,
@@ -3718,6 +3728,7 @@ async function recoverWalletReceivedNotes({
   signer,
   noteReceiveKeyMaterial = null,
   progressAction = null,
+  fromGenesis = false,
 }) {
   const resolvedNoteReceiveKeyMaterial = noteReceiveKeyMaterial ?? await deriveNoteReceiveKeyMaterial({
     signer,
@@ -3732,6 +3743,7 @@ async function recoverWalletReceivedNotes({
     provider,
     noteReceivePrivateKey: resolvedNoteReceiveKeyMaterial.privateKey,
     progressAction,
+    fromGenesis,
   });
   return {
     noteReceiveKeyMaterial: resolvedNoteReceiveKeyMaterial,
@@ -3745,13 +3757,16 @@ async function recoverDeliveredNotesFromEventLogs({
   provider,
   noteReceivePrivateKey,
   progressAction = null,
+  fromGenesis = false,
 }) {
   const latestBlock = await provider.getBlockNumber();
-  const scanStartBlock = requireUsableWalletNoteReceiveRecoveryIndex({
-    walletContext,
-    context,
-    latestBlock,
-  });
+  const scanStartBlock = fromGenesis
+    ? Number(context.workspace.genesisBlockNumber)
+    : requireUsableWalletNoteReceiveRecoveryIndex({
+      walletContext,
+      context,
+      latestBlock,
+    });
   const scanRange = {
     fromBlock: scanStartBlock,
     toBlock: latestBlock,
@@ -4695,13 +4710,16 @@ async function loadJoinChannelContext({ args, network, provider }) {
     network: { chainId, name: resolvedNetworkName },
     provider,
     bridgeResources,
-    persist: false,
+    persist: true,
+    allowExistingWorkspaceSync: true,
+    useWorkspaceRecoveryIndex: true,
+    progressAction: "channel join",
   });
 
   return {
     workspaceName: channelName,
-    workspaceDir: null,
-    persistChannelWorkspace: false,
+    workspaceDir: initialized.workspaceDir,
+    persistChannelWorkspace: true,
     workspace: initialized.workspace,
     bridgeAbiManifest: bridgeResources.bridgeAbiManifest,
     currentSnapshot: initialized.currentSnapshot,