refactor: migrate gift-wrap to mostro-core 0.10 dual identity/trade keys

mostro-core 0.10 reshapes wrap_message / unwrap_message to match the
Mostro key-management spec: the long-lived identity key signs the seal
(kind 13) while the per-trade key authors the rumor (kind 1) and
produces the inner tuple signature. Thread both keys through the
CLI's send_dm / send_plain_text_dm / publish_gift_wrap pipeline and
update every call site:

- User order flows (new_order, take_order, add_invoice, orders_info,
  rate_user, send_msg, send_dm) pass ctx.identity_keys + the per-order
  trade keys.
- Account-scoped requests (restore, last_trade_index) and admin flows
  (take_dispute, admin_send_dm, adm_send_dm) don't rotate trade keys,
  so they pass the same key for both — the full-privacy-mode wrap
  documented in the mostro-core NIP-59 transport spec.
- Kind-14 NIP-17 direct messages (to_user = true) are signed with
  trade_keys directly; identity doesn't apply because there's no seal.

Also refreshes the local wrap/unwrap unit tests to cover the
identity/trade split and adds a full-privacy-mode assertion.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: grunch

Cargo.lock

@@ -46,7 +46,7 @@ reqwest = { version = "0.12.23", default-features = false, features = [
   "json",
   "rustls-tls",
 ] }
-mostro-core = "0.9.1"
+mostro-core = "0.10.0"
 lnurl-rs = { version = "0.9.0", default-features = false, features = ["ureq"] }
 pretty_env_logger = "0.5.0"
 sqlx = { version = "0.8.6", features = ["sqlite", "runtime-tokio-rustls"] }

Cargo.toml

@@ -75,6 +75,7 @@ pub async fn execute_add_invoice(order_id: &Uuid, invoice: &str, ctx: &Context)
     // Send the DM
     let sent_message = send_dm(
         &ctx.client,
+        &ctx.identity_keys,
         &order_trade_keys,
         &ctx.mostro_pubkey,
         message_json,

src/cli/add_invoice.rs

@@ -29,7 +29,7 @@ pub async fn execute_adm_send_dm(receiver: PublicKey, ctx: &Context, message: &s
     println!("{table}");
     println!("💡 Sending admin gift wrap message...\n");
 
-    send_plain_text_dm(&ctx.client, admin_keys, &receiver, message).await?;
+    send_plain_text_dm(&ctx.client, admin_keys, admin_keys, &receiver, message).await?;
 
     println!(
         "✅ Admin gift wrap message sent successfully to {}",

src/cli/adm_send_dm.rs

@@ -24,12 +24,13 @@ pub async fn execute_last_trade_index(
         .map_err(|_| anyhow::anyhow!("Failed to serialize message"))?;
 
     // LastTradeIndex is account-scoped: the answer depends on which user
-    // is asking, and Mostro looks that up by the sender pubkey. Sign with
-    // `identity_keys` so the request resolves to the account, not to a
-    // (possibly unregistered) trade key.
+    // is asking, and Mostro looks that up by the sender pubkey. Sign both
+    // seal and rumor with `identity_keys` so the request resolves to the
+    // account, not to a (possibly unregistered) trade key.
     let sent_message = send_dm(
         &ctx.client,
         identity_keys,
+        identity_keys,
         &mostro_key,
         message_json,
         None,

src/cli/last_trade_index.rs

@@ -183,6 +183,7 @@ pub async fn execute_new_order(
     // Send the DM
     let sent_message = send_dm(
         &ctx.client,
+        &ctx.identity_keys,
         &ctx.trade_keys,
         &ctx.mostro_pubkey,
         message_json,

src/cli/new_order.rs

@@ -44,6 +44,7 @@ pub async fn execute_orders_info(order_ids: &[Uuid], ctx: &Context) -> Result<()
     // Send the DM
     let sent_message = send_dm(
         &ctx.client,
+        &ctx.identity_keys,
         &ctx.trade_keys,
         &ctx.mostro_pubkey,
         message_json,

src/cli/orders_info.rs

@@ -60,6 +60,7 @@ pub async fn execute_rate_user(order_id: &Uuid, rating: &u8, ctx: &Context) -> R
 
     let sent_message = send_dm(
         &ctx.client,
+        &ctx.identity_keys,
         &trade_keys,
         &ctx.mostro_pubkey,
         rate_message,

src/cli/rate_user.rs

@@ -22,10 +22,13 @@ pub async fn execute_restore(
     // Restore is account-scoped: Mostro indexes users by their identity
     // pubkey, so the whole exchange (send, wait, decrypt) runs on
     // `identity_keys` — an unregistered trade key would look like an
-    // unknown user and recovery would silently return nothing.
+    // unknown user and recovery would silently return nothing. With the
+    // mostro-core 0.10 dual-key split we pass `identity_keys` as both
+    // the seal signer and the rumor author.
     let sent_message = send_dm(
         &ctx.client,
         identity_keys,
+        identity_keys,
         &mostro_key,
         message_json,
         None,

src/cli/restore.rs

@@ -53,7 +53,16 @@ pub async fn execute_send_dm(
             return Err(anyhow::anyhow!("order {} not found", order_id));
         };
 
-    send_dm(&ctx.client, &trade_keys, &receiver, message, None, false).await?;
+    send_dm(
+        &ctx.client,
+        &ctx.identity_keys,
+        &trade_keys,
+        &receiver,
+        message,
+        None,
+        false,
+    )
+    .await?;
 
     println!("✅ Direct message sent successfully!");