@qrlwallet/connect 2.0.0 → 3.1.0

package/dist/index.d.ts

@@ -61,6 +61,7 @@ declare class KeyExchange extends EventEmitter<KeyExchangeEvents> {
     private awaitingSynAck;
     private awaitingAck;
     private keysExchanged;
+    private lastAck;
     constructor(isOriginator: boolean, restored?: Session);
     /**
      * Originator (dApp) side: begin a fresh handshake by generating an
@@ -91,6 +92,8 @@ declare class KeyExchange extends EventEmitter<KeyExchangeEvents> {
     reset(): void;
     private resetInternal;
     areKeysExchanged(): boolean;
+    /** The ACK produced for the current handshake, for duplicate-SYNACK replies. */
+    getLastAck(): AckMessage | null;
     getSession(): Session | null;
     getCurrentStep(): KeyExchangeMessageType;
     /** Export the current session as a JSON-safe persisted record. */
@@ -104,16 +107,26 @@ interface DAppMetadata {
     name: string;
     url: string;
     icon?: string;
+    /**
+     * Optional "return to dApp" target (a URL or app deep-link scheme). Sent to
+     * the wallet in ORIGINATOR_INFO; after the wallet resolves a restricted
+     * request it bounces the user back here (WalletConnect-style peer redirect)
+     * so a same-device deep-link flow does not strand the user in the wallet.
+     */
+    redirectUrl?: string;
 }
 /**
  * Stored session for reconnection.
  *
- * v2 persists the derived AES-256 session key (not the ML-KEM secret key) —
+ * Persists the derived AES-256 session key (not the ML-KEM secret key);
  * the ML-KEM keypair is ephemeral and zeroized after the handshake.
  * Re-pair (generate a new QR) to rotate the session key.
+ *
+ * v3 checkpoints the AEAD counters on every seal/open. v2 records (sparse
+ * checkpoints, stale-counter nonce-reuse risk on restore) are dropped.
  */
 interface DAppSession {
-    version: 2;
+    version: 3;
     channelId: string;
     keyExchange: PersistedSession;
     dappMetadata: DAppMetadata;
@@ -126,7 +139,7 @@ interface DAppSession {
 interface PendingRequest {
     id: string | number;
     method: string;
-    params?: unknown[];
+    params?: unknown[] | undefined;
     resolve: (result: unknown) => void;
     reject: (error: Error) => void;
     timestamp: number;
@@ -135,7 +148,7 @@ interface PendingRequest {
  * Key-exchange wire-message types.
  *
  * v2 note: only SYNACK (wallet→dApp) and ACK (dApp→wallet) are transmitted
- * over the relay. The SYN step is carried by the QR code itself — the dApp's
+ * over the relay. The SYN step is carried by the QR code itself - the dApp's
  * ML-KEM-768 encapsulation key is embedded in the URI, not sent on the wire.
  */
 declare enum KeyExchangeMessageType {
@@ -191,7 +204,7 @@ interface JsonRpcRequest {
     jsonrpc?: string;
     id?: string | number;
     method: string;
-    params?: unknown[];
+    params?: unknown[] | undefined;
 }
 /** JSON-RPC response */
 interface JsonRpcResponse {
@@ -204,6 +217,66 @@ interface JsonRpcResponse {
         data?: unknown;
     };
 }
+/**
+ * EIP-6963 wallet identity advertised to dApps.
+ *
+ * `rdns` MUST be unique to this wallet and SHOULD be a reverse-DNS string
+ * (per EIP-6963). Defaults work for most consumers - override only when
+ * embedding the SDK inside a different branded wallet.
+ */
+interface EIP6963ProviderInfoOverride {
+    name?: string;
+    icon?: string;
+    rdns?: string;
+}
+/**
+ * Rich response object returned by both `qrl_signMessage` and
+ * `qrl_signTypedData`. The signature alone is not enough to verify since
+ * ML-DSA-87 public keys cannot be recovered from a signature, so the
+ * wallet always returns the public key explicitly. Stateless verifiers
+ * (e.g. the SDK's `verifyMessage` / `verifyTypedData`) need every field.
+ */
+interface QrlSignedResult {
+    /** 0x-hex of the 4595-byte ML-DSA-87 signature. */
+    signature: string;
+    /** 0x-hex of the 2592-byte ML-DSA-87 public key. */
+    publicKey: string;
+    /** 41-char checksummed Q-address derived from `publicKey`. */
+    signer: string;
+    /** 0x-hex of the 64-byte SHAKE256 digest that was signed. */
+    digest: string;
+    /** Scheme tag: 'QRL-SIGN-MSG-v1' or 'QRL-SIGN-TYPED-v1'. */
+    schemeVersion: string;
+}
+/**
+ * Response from `qrl_signTypedData`. Echoes `domain` so a stateless
+ * verifier doesn't need to be told the domain out-of-band.
+ */
+interface QrlSignedTypedDataResult extends QrlSignedResult {
+    domain: Record<string, unknown>;
+}
+/**
+ * `qrl_signMessage` params: `[signer, messageHex]`. `signer` must equal the
+ * dApp's currently-connected account; the wallet rejects mismatches before
+ * unlocking. `messageHex` is strict `0x`-prefixed bytes (no UTF-8 strings).
+ */
+type QrlSignMessageParams = [string, string];
+/**
+ * `qrl_signTypedData` params: `[signer, payload]`. Payload mirrors EIP-712
+ * shape: `{ types, primaryType, domain, message }`, but with `QRLDomain`
+ * in place of `EIP712Domain` and SHAKE256-based hashing. See `signing/`
+ * for the full encoder.
+ */
+interface QrlTypedDataPayload {
+    types: Record<string, readonly {
+        name: string;
+        type: string;
+    }[]>;
+    primaryType: string;
+    domain: Record<string, unknown>;
+    message: Record<string, unknown>;
+}
+type QrlSignTypedDataParams = [string, QrlTypedDataPayload];
 /** QRL Connect configuration */
 interface QRLConnectOptions {
     dappMetadata: DAppMetadata;
@@ -215,6 +288,15 @@ interface QRLConnectOptions {
     storageKey?: string;
     /** Enable debug logging */
     debug?: boolean;
+    /**
+     * Announce the provider via EIP-6963 so dApp wallet pickers can see it
+     * alongside the QRL browser extension. Defaults to true in browser
+     * environments. Set false to suppress (e.g. when the dApp wires the
+     * provider in manually).
+     */
+    announceProvider?: boolean;
+    /** Override the EIP-6963 announce metadata (name / icon / rdns). */
+    providerInfo?: EIP6963ProviderInfoOverride;
 }
 
 /**
@@ -222,12 +304,46 @@ interface QRLConnectOptions {
  * Bridges JSON-RPC requests from dApp to QRL Wallet via the relay.
  */
 
+/**
+ * Default EIP-6963 identity for the QRL Connect provider. The `rdns` is
+ * deliberately distinct from the QRL browser extension (`theqrl.org`) so
+ * both wallets can coexist in the same dApp picker.
+ */
+declare const QRL_CONNECT_PROVIDER_INFO: {
+    readonly name: "MyQRLWallet (Mobile)";
+    readonly rdns: "com.qrlwallet.connect";
+    readonly icon: "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAMAAAADACAYAAABS3GwHAAAAAXNSR0IArs4c6QAAH1dJREFUeF7tnXt8XGWZ+L/PmaT3JpOkrVCKgD9wFcELwgoLArIsWnDLCnIVgZ8gF1lcylVsk5xMKuXiiiKLn7L82OWiK1ZBtgpdFRDdAu4P1EVAuaNoQbrNTJJek5nzbN+TpE0nk8yZmTMzZybv/AXNe3ue9/me9/a8zyvYn9XAJNaATGLZrehWA1gArBFMag1YACZ191vhLQDWBia1BiwAk7r7rfAWAGsDk1oDFoBJ3f1WeAuAtYFJrQELwKTufiu8BcDawKTWwKQEQF0cwGGtPQjMtv6ngA8m8ViJJ6D1TsekAEDZZugu01MeHxLlIBXmi7A7ymwxKNjfdg1ohkEV3sDhj+LxG8fhN7M7eVGkPmGodwBEXRp7MpwdE7pUZBYwq96FDpHnLQqbFF2dXsf5c29hY72NCnVrC6+6TGvxOA6HK1TlQyNGUbcCh2j1I0WNnv8IbFH0+kbhG7Nc3ixDdVUpsi7tQRXp66TDE7lSYEZVNFuPlQoZ9XhePF0UX8bL9SBi3QHwxtXMnTqFOx2Rj6J2kRu6kZq1gOqrHpzV0sWaWp8S1RUA6tLQq6wAOdvf5bG/smlAlDcyaT2m9RqeKVslFSi4bgDQk4gl38VpTkzutF/+CliOX4X+clD427kuaytVY9j11A0AvS4f8zx5QMROe8I2knHLM5MhR7/a4nJpxeoMuaK6AEBdZvSqfBPhePv1D9lC8hSnqhlxeGfc5ZXK1hxObXUBwLp2PhgTecQRZoejFltKYA0IKqqrmoQTxSUdOF9EEtY8AGbLM9nJchG5quaFiYhRFNoMsyBOD+rRbct5rtC81U5f8zbzrMuU3TxeR2RetZU5WetXYTOefqolwX21poOaB6CvnUM8kTXYxW9VbU887WzuJlHVRhRRec0D0NPOGXbrs4ieDz2LfqvZ5Yxac5qreQCS7ZwtMbnd7v6EbtEFFegvhLs43gJQkNpKT5zswEWks+ZJLl0VVSvBOM2J6oPNXRxnAahwN6RclqnKEgtAhRU/XN0Oj1H9SdzlGAtAhfsh1cEyRJaEXW2WK3DYxVesvOwrXWF/KCwAFevK3BWVGYC1Ar9WYSvKXwD7hm1A5VafwgaUx0Ukqei7BPYL01FwBAAR/XFzJx+1I0C5ezSr/LIBoDyVdvSCQXhu17UM9s5jgcbkq8Ci2oFAN6ny8fQWnpwzg409MF/SnOU0SHdYmwYWgAobfHZ1ZQFAzf1XvTCeMK7VO34plwNB/hNlapXFDlS94+llTd18ZXRic3Le6/I0iBkJSv7ZKVDJKiytgLIAAF7G0/e2dfPsTsZzHo2pXUiJSPRvmQnqoIc1uTyWreFkB3eKyKdL0/xQbjsChKHFEsooFwADm3S3eTeMvfua7GCDiMwsockVyaqKxlQPberm8Ryj5i2IXBhGQ+wIEIYWSyijXAA0bNLdZlUAAH8PvQT5x82qaMbRw9pyjAA9nXzDQS4Io1oLQBhaLKGMcgFQiRFg2Hg8M48QQ4HxZwrrHvMEAKQ6+QYWAN/qyvLxKcGeC85aLgDKPgIMXS7/sQ5yVXwKT/dvpcVr5DOKXI3QUnLHWAAC2VLJeg5USxkT9Q6fBIdchVdOAPwvv2r/xkH2WrCc9SNtNwNBbwfLNYy7DRaAQCZRDwAkPJX2kAUpPwDo3S1djNmJSbmcLCp3KEwL1IPjJao0AKI/jtuDsJK6rKjMPS6fc5Cbzf52iBCUDYBRi8abW7q4OFvoZDtHSExWmbilRSlkx3Ay7iI4zDXAqOp+EHdZZE+CS+q1wjMnl7IIR75vFpAWgFH6q9AIsL1G1RXNCS6stUBZIdpM4cYbRo7XFzN99mzWqMgHQhSmeiNAgiPEq60RQJWNip7SmuCHYfRpJcsI0WYq2eyd61rfznsckTUiNIfUCm9wUBfMvYY3xkxRQjgIG5oGae4pkMuRgvx7yVMgQTPkPgcIdQpk9rJEvxnv4sxa+/rXxTaob0oraOz9E2ci0sFQ3P9SwfYym3WPtuv5Y6UBSLkchcr9Jox7KTAbyDzRQ3MdhKU6uBWRz5ZSvn9ioWz20LtFuKrFJVVSeVXKXKqhVKnZY6s1r75sgDkDyhUxOA+V4heRDt5AWt89bxkv5likGleIkn2BxNGbm10+n13+epePxVRWopTmbmF8gWJ6WFPHWFeIpMud4skZJXReWhx9IOOxYn2Sh/f5OltLKKuqWesGgGwtbn8GCfhpQBUfCby0nljbDKa1XkdvrmxJl3jqNbbsuSfpoOWOLsfUQS+NNG9btLtsyq7jyfNofHsDU+euY4D34BVahyn/uWdx5s5lytwj2Swnk8mu49WzmbZnC/LURtL984O//OK33Zye1mAArPFMoG4BCGjzNtkk14AFYJIbwGQX3wIw2S1gkstvAZjkBjDZxa9bAMyDGX9cwJQFG0lTwEJvshvEePI/tRZpGyC25wGofL52d32y5atbAPpdTsio3BFmBAQLh7kCqa+0dLF/veiibgFIuZwLcmsIh2L10tchyaFes9AoLl5IBVa1mLoFINnOHeLImVXVbn1W7pHWD8W/xJP1IF5dAvCIS8P7lZcFeXs9dFKUZFDjAuHpP8QT3FyLvj91vwbwb1W5nIgn37FvBoSPztAlfn1gQDhlnsuG8GuobIl1NwKoy7Skx68dERPK0P7Ko4GUJ/rhVre23wg2qqk7AFJL+aTE5K6SrxSWx3DqotThUeC7zeb6ppkS1fCvrgDQi5na28IqRP6mhvsk8k33LV7QtKfHz0nwg1peC9QVAKkOrlGRq+tKqAjiMOqT/9y0Rj12+lJ+H8FmBmpSXdiKv/Bt5xxicovqtj3qQKLbRKVoYCSol6Dfbe7i1FodBWreVozx9yzhEKdRvo2ye10ubEqx1HLnFVRVv7RZWD4/x/2Gcldfavk1D8CGL/LegUZWjez517xApfZoNfKbB0TQpc0u/1hrI0FN24u5DB8TVqrIu+2XvxqWP6rO4TcVkg537OWypcqtCVx9rQIgqaW8Q2PyXYT3GX+fWhUkcE/VQEJVMg66uOm33CIrx17FjKIINWk3PVfR7EzjRypykDX+aJmVwFtk9LCmZbxUC9OhmgPALHqTnSxzRK6wOz7RMv7trRFe1y16eMu1vBbRFo5qatRbmNW+1BIOpIHHFWmw8/4Id57oyuZd+ZScz2CEW1lbrhD9LvMGPX4mw34+NTd8RdkSwm6bkgQ9KZ7gobCLDrO8mrEhf+rTwRdFJGFuedVMw8PsrVorS/VXzQk+GOW1QM3YUZ/LnLTKzwXMY8/2VwsaGLo7cGFzglujCkFN2JL5+qdcFm8Ld2gOWuyvhjSg8OtG0YWz3LEvbkZBjJqwp3VXMnvKdHpGFr5RUJxtQ34NDL+AuQXVM+IJvpc/R+VT1AQAyXYucWLyFfMKTOVVZGssRQPDdwe+3exyehTvDkTeoNRlSm+Ge3Dk70rpCJu3ihpQtPlNnSq3Rm9LNPIA9Lrs7XnyIxH2qmIX2qpL0YDxGPX0spYEN5ZSTDnyRh6AVAd/DfIfKsQi39hy9FC9lKm8Ek/o/4maOJG3qWQnX0fkIuvzEzXTCd6e4cszPekBPWTucl4InrP8KSMPQE8nv3WQd5VfFWNrGHPbW1GzkFPV14FnUNZFbmEnzBy+GHSAiDSqICObB9Xq7GE9blTVk1oTPFiNvhyvzmrpJJAO3rycmVNn0C9SHW/nkW08NUG2RB9FuL95Xx7iuW0hMjuHoyFETYMj1HYhSdhPMhxNTBahvBthrlRrJ01RD726JcH1UToUi1r3jQZDejr4uIPcX5UAV+b1Q/QnONzcAE/MdnkrELURTGRiJa3P8L6Yw+miXKQisZFmVswABBXVrzUJl0UprmjF5C/ULvyL7h2ciyMrKh3gVmGTI7q8B768p8vWKH2xCtXj6PTDwQMOwOFuVfmLkB8Xz9s0z9PVr/yZRQdGaDs00gCkOvmyiCyuKADK8+roF+Iu99eL4WdbZu9S9vEa+GdUjjB/q5QRqOqj8d34myi5SFdK9rxfh+wEZuHW67LaD3JVuXnrgIge0eTyi3o1/hE9+weMHj/FkYONrithCIo+E5dt3qEuAwUbRJkyVELuopruA9DFGlQOKaqAAjMppDSjn2pdxgP5spp7CZkBFiA4NOZLXdm/Dw7C1Eb6XofX3pPH0JIue6KsBDmwEoag6Np4G++I0gszlZC7KAsYHgEeAzm4qAIKyTR0UrksnqBzvC+/eXc4leZwhHYceYfAjAqOTIVIgwqDqvqWeNwbb+BLEy06e5ZwmBPjUUScgiopIrGqbo47tEqEokZEHAB5DCgrAMNbnS9s3qof3TXHHVazcOxbyt6eQyeIceiKrM6yFrx+/E5zZiHC4rjLfbng9l3NO7gBkcvKLpio9vcyc/cb2VwEP2XJUnaZi2310AhQGQDU04tbu7k5V1t7ExzkZbhdkP2KlaVa+bYf5Cn9it7csh/tuV6O37yMPbYMysOAGdnK97MABNdtpQBA9c1mh91yTRP8ub7Hz6iPtwYGRPXSpi5uyT69Ni9q9u7LTYp8rqy7QhaAiAFgDmc87WpKkMieHqx1mTE9wz0Sk+OiOtcPrs3tez9vOsL+TS7/k53XvKugMVlpAShcq2XJUaERwMuoHtuW4D+yhTCLQ2mQ+2Hboq0sElahUEE9T29rSXB+NvDrL6bJaZNUWV0l7AgQvNMrAYAqr3uqC9u6eTarZdLTzhXiyHV1Y/wjAopmnK28rWk563daNJs1VydrEdkleC8VmFJV+/vtIjiQ1ioBAPDSgOjCeS4vZRtDXxf/piqnBGpsLSUy0760Htu8jNVZu0YGgJsRubBsUz47AgS3lAoB8AKiC+Mur+xkDC5OUlkjyMF1NwIYQVU/mX1J3d/u7SShIkssAMHttGwpKwTA7zZv1YXZ+//+oZfHHxHZtZyLwnyvy5UNPtUL4glWZI8AqXYSErMAlM2oCym4EgAI/NbbqsdmB3E1APR6rFWRt4UJwIjBi/rz7w0qJEVGHQoN+Ty1qjllhl0E/PinYf881c+1JviGBaByjoAF92HVAVD+pAwtCIv9Eo/+woswiKc/8Rzubsjwe1F6BgdZ23ItfduVsxIn9d8saHRoGoixv6PmPjQnINIc5rTEArDDHIvt24INutAM9QCAcUXwlM2oPtrQyOLZS3mhkCuUfjzUq2hypnM1npwHNCFsv8xSqE5H0lsALAC+BiacApU6AhiHNE8fUFixPsnD+3zdvKNV/K/vat6pU/i0Il+gxKmRBcACUF4AhpzQuuNvsExuJW32XYo3/R05zdqkP80+Xsy4bMs7ii3TAmABKB8Awp8yGU20dvPP5bhU43tvtvNeiXEXxkGviMtCFgALQLkASKvoOXG4eyIffGPE27vAjA1d/v830MngyF/ywbPRZf6gmscnCg8ZYwGwAJQDgC2qem1Lgq6JpiappeylDoc7wpGKHOXH8Bm5iuL5M6XfAQ9kMtzb18gvJ3pytH8p7047sgrBj7gWdEfDAmABCB0AFb0j3sn/HW+XR29iamqd71/0KYG9TajHcacv5mEJpVdV18QGuXz2cp7PeZnFnFekOUEdvkMBwZMsABaAsAH4Q0x04WyX57K//mY7N/kFdpdp3CciHyh4zq4kM+j5rb/l3lxv75ry+1xu90TOCurJaQGwAIQHwNAzQFc3jxPxzGxfelO4B+T9xeza+JMipX+bA09nPMFXc40EySXsITF5hIARtC0AFoDQAPAjHXSxIJdhPusyZb7HE/6Xv8jfdvcJYat6+tl4YtsCO2tb1Xdk6+CfPJELg6wDLAAWgFAA8C/Ue3pVvJvrs+3bxDWdPoP/p1K6S/WOu736cibDEXO+xJ+y6+t1+UtP5fEgL2haACwAoQAAvInocXGXX2YbZMrlKFTMu1jxIj/+O2XbMRLoyrjLyWPWGkMerK8gske+UcACYAEIC4BfDogeNy/HC4gpl9tQOScM49+5DPViwvtmuzyTXXayg8WIfMUCEFzr+XQVvKSQU9aCM5yn+mCLw8dzHXqlOiSF0ByyWoZi/Xi6rCVBR3bZ61zmN6qMmR5lp7MjgB0BSh4BzJTEQ5e1ddGebWAblnJM2pHVZQvrLnLPuvXeWdkOdn4kC+XPgsyaCDwLgAUgFABQPbMlYXxydvz8EORLuZIGWV7wnn+e4WLUjtAvnK16XPbF9hcvZurcVn6uyEETDe0WAAtAyQCYAjzVM1oTfDMbgGQnNznD75qFOQUa5VL6pDl4y47voytoTK31PUWPNvWOB4EFwAJQVgBSndxUrof9hiHICcDwucMDiJibZBaAAF8fuwge705wgAsxonpGc44RoKedy5yYXF/Gly2fdHKMAGYKNKeV/8wX7tyOAHYEKHkEGHJR0EuzH3/2T2XbOcUT+Va5niASYVUTeqq4bBr9kXt9MdNnN5kQLxMHt7IAWABKBsC3f/T7LV18InukNY/S9apsNKeyAUbhwpIM3Tb7WryLS7NdIt5ymdXoSV++EO4WAAtAKACI8POB6Xrc3KuMs9rOv2Qn3xPkhMKsO39qAU88PbypmzVj6mznbBz5l3zzWguABSAUAIA/eKLHteY4le1p51REbhdh+kQL0vwmvyOFmXY56GMvvsGRuV5aTHbwMxH5cL4yLQAWgLAAwPP0tNZuvp1tdH1X05ZulB+K8KHQAFDdOOjxgXnLeDG7vrVX8fYZ0+TVINMuC4AFIDwAVH/RkuCQXO7Q2165PFg9+b4Kb8s3Lcn31QbSil4bfw4318WYVAdLcKQ7yOGbBcACEBoAZiWcUT21rZvvjFkMD/npm6nQvypMCWDkOyXZfvJr5v2ijzfBUbmeGO2/mrmZKWKiPR8QpA4LgAUgPAD8kvTphkGOmXUNfx4DwdB7vGepSIfAgiAG6pc4klDNS/V6+5ZNXLHLlzE7S9mQSLKDC0TEvHHmBBlpLAAWgJABwNOMuvFlLBvv8npSWRBD/k2FQyaapuwcQUs3Ocq5TXO4d7y3dde77BvzeEpFpgVda1gALAChAjB8b/fPafS0OQl+OsFbww19cLLncYkgB+SK8+nfMlPWgd7uDHLD7OX0jFden8ucTIZ7cOSokS61I0DQMXYoXRB9FVZiSKlr4T7AaFGHIViP6okt3Tw6kRp6Xfb2PB4Wkd1zTGnw3RzgR/mCa6U6+S7IopFYoUE7044AdgQIdQQYbcQCj2U8vaC127+xNW5M0GQn3YIszQbA5E+LLmxzR4VNz0qUWk6LbuVGQc40H4pCv2QWAAtA2QAYXsD+QVQvb3a2nQa7eLlGg94OLtKhhevOi1qPR+IxXSQuG3Lkk75raPW28E8qcmKxD2hYACwAZQVgWL0DqLpbNnFTrt2bng4ucnIAgMfDAzE9fl4WACYy9AY4POPJahWmFvrVHw2TBcACUAkA/Pu7qC5t7mJ59kJ2XADg4QEZC4A5Wc40ym8QSn63zAJgAagYAIJ2N7m4JQPgMsdTed68IVbqPoMFwAJQMQAUTcRdukICwESObrMAlKoBC0DlADAvxXSFNgJYAMKz/REbCLnEkIqrtXOAnGKbNQB6XbPLF0sdAYy/T3qKvCTmobwSf3YKZEeA0EYAcz3LcVjleST9qP4yfLg49F8iyg/iORzlCl0Er7uS2Y1TuV6FmX5IIvMz9Snq3zmI8WGQ+dYbtLCvQ9DDw8JKDSF1TYwAQlLRS+Kd3DXRmXouV4ZCARiy93FqUehtZ091+JGI7J1P/XYEsCNAKCOAonfG2zhvPEe1iQyx0HOAfEZt/v7WUvaZEhNzAj2h67UFwAIQCgC5wqIEMVSTZlwAlIcGHP277IOwIOWqy5Q+5SFFDpsovQXAAhAKAI7qlU0JbghinNlp+jq5wUMuz/53VZ7C0aNbXFKFlvuqy7QW5Tcw8TTIAmABCAUA4L/Mqe1c1wSkDfYYtpnHr1/C/IZGeRQdet1xp5+Sdhz9xGyXH5p/D1LuyNqgbwlLvJgkbFiU4J8OuwgeLzKcx1oVeduwEY6vUdUHcfhXzC6QQybt5V6oNjioCpoZpKXR4RKdIHqDSSeqyx3hcY+h4Fe5yjVl+ovjNLNo4EjgErMnlK9T7QhgR4DtI8CmrXrsrtfy2mgLN45nvUEBGCIkox6bRHJ7fvpl+zdd/G3LmQiNeb9R/hkCW/AYGHeHyZwyDN2DnGoc5IK6RlsALABDGlCex9OF8WWYcCLbfwaAlPIyyJ55R4C8lhytBP67Bp6e09bN7TvJDJJqJyExWRLkLKEoqUS1v5eZu9/I5qLylyFTvtGyDFUGK7IS5wDAS7JVFzZfy0ujW+W6OJ/P8KA4ckxkFRRMjTulGrmdo6qLWhOsygagr5OEShkBUNX+fgtAoK6rCADKy+LpwuasQFNmUZnq5DZBPhOosTWSyAfArC8yelC8m6fGjAAd3CWOnG5HgAh0aEUAEPodRxc2dYyNs5layieJiXn8ouB4PhFQ35gm7LibqU/HXd4vQ2uMHdM+RXpdkiDhv2s2UoudAgU3jQoBoJ6nn25J8K3s7cZ1VzK/cbo8BLwreKujndJsLXlbObR1OU+Mcc5rZ3/HkafLKoEFILh6KwGA/wn09OF4gqPHfBHNW18dfEaRFSLEgrc8milNVGkVXfkrOOMjLunsVvZ2cLGK3FTW1lsAgqu3EgAMtyatg3pQyzX8Ort1eh6NqV1YIkhH2V58DK6SklKq0hNz9NAmF3OnYKffepemmHIPyMdKqiRfZgtAPg1lz0nlMeDg4LmKS6mqqzb0c0qu7bk3L2fmtFl0qifnOg7xkb324mqqfC6BAU91TczjwqZlmCuVY37JJRwuDfIgMKOsLbQABFdvBUeAbcEb/MXwyc0uJsDsmJ9ezNRknL8Uh0tRFokjYtoX6S1Sc+SGvuDAP+JwX/aLkiNCGtl6W3gakXcG750iU1oAgiuukgAMtUqfHhAOncgL0/e5uYEZPX2c1ugwLwP7IGV4Bim4mnZOaRoorBN4LZPhv1ti23a3XHSCUI1Tkhm+5sTk/LJtfY5uoQUgeM9WHACzP47++6atfHbX5SY25/i/nS6mjBv7LbisoaUcNSTlc6LzH/Pr4HQVuYUQrlkGksECEEhNQ99jf1+6MmuAnVrl6bc3xThnftYLjMFbHv2U3zmJ2DHv4SPq+TfIKjeTswAEN45qAeD7rIneoxmua+nmV8FbXDspezr8MO6LRaS8i95slVgAghtJtQDwW+g/Rcobnqrb2sVt2WcEwaWITkpfn0v5IDHuVJF9io0rWpJEFoDg6qsqACPN9KM86P9XjxUNaZ6YNXXbI9QuW4NLUeWUCskvsHtsOvuqcqIipwvMGPLMrsLPAhBc6ZEAYEdzzcnpWoW3QJ8R5QmHsaepwaUrX8rtoagd9lI4DJVdBXYDP5xKdX8WgOD6jxgA2xtupkNR2vjJpdFR74sV/HZA8B4qIqUFILjSogpAcAmqm7Jq05yJxLYABDcKC0BwXdVMSgtA8K7yAejkMUTK7gsUvFU2ZSkaUHRTXGgTly2llBNm3qpsBgQRwACQ7OSnMUc+XGsOaEHkm5xp9JV1Pey7z9ejs5MWXQCGriV+VUQuroifyuS0yIpKLaJrmnblI3I+gxWteILKIg1Abwfn4sgKC0BUzKW0dgj6gybhE5LjQk5pJRefO7IAGJFSSziQmPxXrV9GKb576iinf7qu3XHzXFTWfeRqShlpAIzHYrKDPzgiC6qpJFt3KBrYguoZ8QT3TvR+cig1FVBIpAEwciQ7uVFE/sFOgwro1YglHYrfSDLj6F/NyXEls5rNjTwAPe0cKo6sFphVTUXZuovXwBAAel9LghOKL6U8OSMPQP81zM1skfsRDimPCmyp5daACplG9IBZLuUNu1KEIJEHwMjU4/L3DnKTnQYV0cNRyKJ6T3MXp0Vp8TuilpoAQG9iau96ngTZLwr9adsQXAMKKRE9Me7ycPBclUtZEwAYdaxfwsFOTB4UIV459diaStKA2e709PaX3uTCA2+NzuHXaJlqBgB1aUjBF0Wl04TEL6ljbOaya2DIbVyfUTi8mOeeyt7A4QpqBgB/LXAVzTKVR8SR99v1QKVMpLh6VPl9rFE/2tSeOxhXcaWGn6umADDi97vMS3vcjshx5v9rToDw+zB6Jaqm1eOk+POskpVkotfAHS2qSfvZ4LLLoCercXivmBfZ7S9CGtD/QTil2eWRfLGJotDomjWedS7zG5TlIJ8cHdOyZgWKgjWU0gb//TN93vM4z0SkE3eC99JKqSfkvDVtL4+4NLzPY7Eg1/nL4qjH6wy58yJTnDF91bviczlPPh8dX/8g+qlpAEYE7GlnfxEWI3K8QGsQwW2aEDSgbFb0CXW4bf16vheliy5BpasLAIyw+hWm9/Wx27aAVuercpEg00bcqEeiJNSNsEF7txzphp56VRH9oedxIw6/irv01sJ8P5c66s4m/MC159GQmsup0sCxiOyB0qZKswgzUaZplCI6l8NIQyhTzLQGBkT8J01Tah7sVv29Oqz20jzU1s3voujaUKjodQdAtgKSLnFJ00YDzQqzxGNqxqv9J48K7eiC0zvoFIetXobNoqQGlU2tL7A26tuahcpZ9wBMoJDJLHsQO4l6/K8gMuRNY40gr4psgnrWgAWgnnvXypZXAxaAvCqyCepZAxaAeu5dK1teDVgA8qrIJqhnDVgA6rl3rWx5NfC/zGV/wHfd+nEAAAAASUVORK5CYII=";
+};
 declare class QRLConnectProvider extends EventEmitter<ProviderEvents> {
     private connectionManager;
     private pendingRequests;
     private options;
+    private eip6963Detail;
+    private eip6963RequestListener;
+    private resumeListener;
+    private resumeDebounce;
+    private readonly requestIdPrefix;
+    private requestCounter;
     readonly isQRLConnect = true;
     constructor(options: QRLConnectOptions);
+    private startEip6963Announce;
+    /**
+     * Re-open the relay socket when the dApp tab regains focus or the network
+     * comes back. Debounced because visibilitychange + online can fire together.
+     * No-op when already connected (ConnectionManager.resume guards that).
+     */
+    private setupResumeListeners;
+    /**
+     * Remove the foreground/online resume listeners. Called on disconnect so a
+     * torn-down session can't be silently revived by a later tab focus; the
+     * listeners are re-armed by getConnectionURI()/newConnection() if the same
+     * provider is re-paired. Safe in any env.
+     */
+    private teardownResumeListeners;
+    /**
+     * Stop announcing this provider over EIP-6963. Safe to call from any env.
+     */
+    stopEip6963Announce(): void;
     private setupConnectionListeners;
     /**
      * Generate a connection URI for QR code display or deep link redirect.
@@ -277,14 +393,14 @@ declare class QRLConnectProvider extends EventEmitter<ProviderEvents> {
     /**
      * Disconnect from wallet and clean up. Returns once the TERMINATE has
      * either been flushed to the relay or the 800ms best-effort window has
-     * elapsed — the wallet gets an instant disconnect instead of landing in
+     * elapsed - the wallet gets an instant disconnect instead of landing in
      * its stale-session grace period.
      */
     disconnect(): Promise<void>;
 }
 
 /**
- * Connection Manager — orchestrates socket lifecycle, the post-quantum
+ * Connection Manager - orchestrates socket lifecycle, the post-quantum
  * handshake, encrypted message routing, and session persistence for the
  * dApp side of QRL Connect v2.
  */
@@ -312,16 +428,18 @@ declare class ConnectionManager extends EventEmitter<ConnectionManagerEvents> {
     private connectedAccounts;
     private storageKey;
     private unresponsiveTimer;
+    private reconnectProbeTimer;
     private failedReconnects;
     private walletPresent;
     private pendingRestore;
     private messageQueue;
+    private outboundQueue;
     private static MAX_RECONNECT_FAILURES;
     constructor(options: {
         dappMetadata: DAppMetadata;
-        relayUrl?: string;
-        chainId?: string;
-        storageKey?: string;
+        relayUrl?: string | undefined;
+        chainId?: string | undefined;
+        storageKey?: string | undefined;
     });
     private setupSocketListeners;
     private setupKeyExchangeListeners;
@@ -335,6 +453,30 @@ declare class ConnectionManager extends EventEmitter<ConnectionManagerEvents> {
      * Returns false if there is nothing to restore.
      */
     reconnect(): Promise<boolean>;
+    /**
+     * (Re)open the socket, join the persisted channel, drain buffered relay
+     * messages, and settle status. Shared by the cold-restore reconnect() and
+     * the warm resume() path whose socket was torn down by the reconnect probe.
+     * Assumes channelId and a hydrated keyExchange are already in place, and
+     * that the caller has reset walletPresent + set RECONNECTING status.
+     */
+    private joinAndSettle;
+    /**
+     * Nudge the connection back to life after the dApp tab / wallet app was
+     * backgrounded. Idempotent and safe to call from visibilitychange / online
+     * / pageshow handlers. If a restored session has not yet been hydrated,
+     * runs the full reconnect(); otherwise just re-opens the socket, whose
+     * own connect handler re-joins the channel and drains the relay buffer.
+     */
+    resume(): void;
+    /**
+     * A session was terminated for good (wallet sent a relay 'close', or the
+     * join ack reported a tombstone). Clear local state and surface
+     * DISCONNECTED so the consumer drops to a fresh-pairing UI.
+     */
+    private handleSessionTerminated;
+    private armReconnectProbe;
+    private clearReconnectProbe;
     /**
      * Send a JSON-RPC request to the wallet (async, fire-and-forget).
      */
@@ -365,7 +507,16 @@ declare class ConnectionManager extends EventEmitter<ConnectionManagerEvents> {
     private handleSynAck;
     private handleDecryptedMessage;
     private sendPlaintext;
+    /**
+     * Serialize every encrypt+persist+send on a single outbound queue.
+     * Callers like sendJsonRpc() are fire-and-forget, so without the queue two
+     * rapid provider.request() calls would interleave inside encryptMessage()
+     * across its await and could complete out of order; the receiver's
+     * contiguous-seq check would then drop the late one. (Nonce reuse itself is
+     * already prevented by the synchronous seq reservation in KeyExchange.)
+     */
     private sendEncrypted;
+    private sendEncryptedNow;
     private startUnresponsiveTimer;
     private clearUnresponsiveTimer;
     private setStatus;
@@ -384,7 +535,7 @@ interface SocketClientEvents {
     message: (data: RelayMessage) => void;
     connected: () => void;
     disconnected: (reason: string) => void;
-    reconnected: () => void;
+    reconnected: (result: JoinResult) => void;
     participants_changed: (data: {
         event: string;
         clientType?: string;
@@ -396,9 +547,21 @@ interface JoinResult {
     /**
      * Base64-encoded KEM public key the relay has bound to this channel.
      * Populated for wallet joins (v2 protocol). `null` if the dApp hasn't
-     * registered a PK yet — wallet callers must treat this as a retry signal.
+     * registered a PK yet - wallet callers must treat this as a retry signal.
      */
     channelPublicKey: string | null;
+    /**
+     * Client types of the OTHER participants already in the channel at join
+     * time (e.g. `['wallet']` or `[]`). Lets a (re)joining peer detect an
+     * absent counterparty immediately instead of waiting on a future
+     * participants_changed event. Empty array on older relays.
+     */
+    participants: string[];
+    /**
+     * True if the channel was explicitly closed (a terminated tombstone). The
+     * peer should drop its stored session rather than wait or re-pair.
+     */
+    terminated: boolean;
 }
 declare class SocketClient extends EventEmitter<SocketClientEvents> {
     private socket;
@@ -449,6 +612,100 @@ declare class SocketClient extends EventEmitter<SocketClientEvents> {
     getChannelId(): string | null;
 }
 
+/**
+ * Per-scheme domain-separation tags + version strings.
+ *
+ * The tag bytes are mixed into both:
+ *   1. The SHAKE256 preimage that produces the signed digest (so the digest
+ *      itself commits to which scheme is in use), and
+ *   2. The ML-DSA-87 `ctx` parameter (so the signature verifier rejects
+ *      cross-scheme replay even if a digest collision were ever found).
+ *
+ * Both stay well under FIPS 204's 255-byte ctx cap.
+ *
+ * NOTE: This file is byte-identical with the wallet's
+ * `myqrlwallet-frontend/src/utils/signing/ctx.ts`. Any divergence is a
+ * cross-repo bug that will surface as fixture mismatches in both test
+ * suites; keep them in lock-step.
+ */
+declare const SCHEME_VERSION_MSG = "QRL-SIGN-MSG-v1";
+declare const SCHEME_VERSION_TYPED = "QRL-SIGN-TYPED-v1";
+declare const SCHEME_TAG_MSG: Uint8Array;
+declare const SCHEME_TAG_TYPED: Uint8Array;
+/** SHAKE256 output length used throughout the signing module (NIST L5-matched). */
+declare const DIGEST_LEN = 64;
+
+/**
+ * Pure SHAKE256 digest for `qrl_signMessage` v1.
+ *
+ *   digest = SHAKE256("QRL-SIGN-MSG-v1" || messageBytes, 64)
+ *
+ * The scheme tag is committed into the preimage so a signature produced for
+ * this scheme cannot be re-interpreted as belonging to typed-data signing
+ * (or vice versa) even if the `ctx` parameter were ever stripped.
+ */
+declare function computeMessageDigest(messageBytes: Uint8Array): Uint8Array;
+
+/**
+ * EIP-712-shaped typed-data encoding for `qrl_signTypedData` v1.
+ *
+ * Byte-identical algorithm with the wallet's signing/typedData.ts; this
+ * file is the SDK port (only the import block differs: the SDK routes
+ * SHAKE256 through src/crypto/primitives.ts, its crypto boundary). See
+ * the wallet copy for the spec-level comments; behavior must stay in
+ * lock-step or the cross-repo parity test fails on next CI.
+ */
+type FieldType = string;
+interface TypedField {
+    name: string;
+    type: FieldType;
+}
+type StructDef = readonly TypedField[];
+type TypeMap = Record<string, StructDef>;
+type Domain = Record<string, unknown>;
+type Message = Record<string, unknown>;
+interface TypedDataPayload {
+    types: TypeMap;
+    primaryType: string;
+    domain: Domain;
+    message: Message;
+}
+declare function encodeType(primary: string, types: TypeMap): string;
+declare function typeHash(primary: string, types: TypeMap): Uint8Array;
+declare function encodeField(type: FieldType, value: unknown, types: TypeMap): Uint8Array;
+declare function hashStruct(primary: string, data: Message, types: TypeMap): Uint8Array;
+declare function computeTypedDataDigest(payload: TypedDataPayload): Uint8Array;
+
+/**
+ * Stateless verifiers for the two PQ signing schemes. The SDK exposes these
+ * so a dApp can re-verify the rich response object returned by the wallet
+ * without round-tripping back through the relay. They never touch a secret
+ * key and never derive an address; that's the wallet's job.
+ */
+
+interface VerifyMessageParams {
+    signature: Uint8Array | string;
+    publicKey: Uint8Array | string;
+    /** 0x-hex bytes that were originally signed. */
+    messageBytes: Uint8Array | string;
+}
+declare function verifyMessage({ signature, publicKey, messageBytes, }: VerifyMessageParams): boolean;
+interface VerifyTypedDataParams {
+    signature: Uint8Array | string;
+    publicKey: Uint8Array | string;
+    payload: TypedDataPayload;
+}
+declare function verifyTypedData({ signature, publicKey, payload }: VerifyTypedDataParams): boolean;
+
+/**
+ * Local hex/bytes utilities for the signing module.
+ *
+ * Byte-identical with the wallet's signing/bytes.ts.
+ */
+declare function hexToBytes(hex: string): Uint8Array;
+declare function bytesToHex(bytes: Uint8Array): string;
+declare function concatBytes(...parts: Uint8Array[]): Uint8Array;
+
 /**
  * v2 QR URI codec (PQP2).
  *
@@ -471,7 +728,7 @@ declare class SocketClient extends EventEmitter<SocketClientEvents> {
  * substitution of a maliciously-crafted PK with the same fingerprint.
  *
  * Legacy v2.0 URIs (magic=PQP1, 1208-byte blob with embedded PK) are
- * rejected with a clear error by parseConnectionURI — this is a hard
+ * rejected with a clear error by parseConnectionURI - this is a hard
  * break before 2.0.0 ships, no backcompat.
  */
 declare const CID_LEN = 16;
@@ -490,18 +747,18 @@ declare function computeFingerprint(cid: Uint8Array, pk: Uint8Array): Promise<Ui
 declare function fingerprintEquals(a: Uint8Array, b: Uint8Array): boolean;
 /**
  * Encode (cid, pk) as a qrlconnect:// URI. Note the PK is not stored in the
- * URI — we compute its fingerprint and embed only that. The caller must
+ * URI - we compute its fingerprint and embed only that. The caller must
  * upload the PK to the relay separately before publishing this URI.
  *
  * The optional `relayUrl` rides as a sibling query param (not inside the
  * fp-bound blob) so a tampered relay can cause the pairing to fail but
- * cannot substitute the PK — the fp still pins that.
+ * cannot substitute the PK - the fp still pins that.
  */
 declare function generateConnectionURI(cid: Uint8Array, pk: Uint8Array, relayUrl?: string): Promise<string>;
 interface ParsedURI {
     cid: Uint8Array;
     fp: Uint8Array;
-    relayUrl?: string;
+    relayUrl?: string | undefined;
 }
 declare function parseConnectionURI(uri: string): Promise<ParsedURI>;
 /** Convert 16 raw cid bytes to RFC 4122 UUID hex string. */
@@ -523,9 +780,19 @@ declare function getAppStoreUrl(): string;
 
 declare const DEFAULT_RELAY_URL = "https://qrlwallet.com";
 declare const PROTOCOL_VERSION = 2;
-/** RPC methods that require user approval in the wallet */
+/**
+ * RPC methods that require user approval in the wallet.
+ *
+ * v3.0.0 replaces the Ethereum-flavored signing surface with two
+ * post-quantum-native methods: `qrl_signMessage` for opaque bytes and
+ * `qrl_signTypedData` for structured payloads (EIP-712-shaped, but with
+ * SHAKE256 + native Dilithium ctx). The legacy methods (`personal_sign`,
+ * `qrl_sign`, `qrl_signTypedData_v3`, `qrl_signTypedData_v4`) are no
+ * longer accepted; a dApp calling them via this SDK will get a
+ * "method not supported" error before the relay round-trip.
+ */
 declare const RESTRICTED_METHODS: Set<string>;
 /** RPC methods that can be auto-proxied without approval */
 declare const UNRESTRICTED_METHODS: Set<string>;
 
-export { type AckMessage, BLOB_LEN, CID_LEN, ConnectionManager, ConnectionStatus, type DAppMetadata, type DAppSession, DEFAULT_RELAY_URL, FP_LEN, type JsonRpcRequest, type JsonRpcResponse, KeyExchange, KeyExchangeMessageType, MessageType, PROTOCOL_VERSION, type ParsedURI, type PendingRequest, type PersistedSession, type ProviderEvents, QRLConnectProvider as QRLConnect, type QRLConnectOptions, QRLConnectProvider, RESTRICTED_METHODS, type RelayMessage, type Session, SocketClient, type SynAckMessage, UNRESTRICTED_METHODS, cidFromString, cidRandom, cidToString, computeFingerprint, fingerprintEquals, generateConnectionURI, getAppStoreUrl, isMobileBrowser, parseConnectionURI };
+export { type AckMessage, BLOB_LEN, CID_LEN, ConnectionManager, ConnectionStatus, type DAppMetadata, type DAppSession, DEFAULT_RELAY_URL, DIGEST_LEN, type Domain, type EIP6963ProviderInfoOverride, FP_LEN, type JsonRpcRequest, type JsonRpcResponse, KeyExchange, KeyExchangeMessageType, type Message, MessageType, PROTOCOL_VERSION, type ParsedURI, type PendingRequest, type PersistedSession, type ProviderEvents, QRLConnectProvider as QRLConnect, type QRLConnectOptions, QRLConnectProvider, QRL_CONNECT_PROVIDER_INFO, type QrlSignMessageParams, type QrlSignTypedDataParams, type QrlSignedResult, type QrlSignedTypedDataResult, type QrlTypedDataPayload, RESTRICTED_METHODS, type RelayMessage, SCHEME_TAG_MSG, SCHEME_TAG_TYPED, SCHEME_VERSION_MSG, SCHEME_VERSION_TYPED, type Session, SocketClient, type StructDef, type SynAckMessage, type TypeMap, type TypedDataPayload, type TypedField, UNRESTRICTED_METHODS, type VerifyMessageParams, type VerifyTypedDataParams, bytesToHex, cidFromString, cidRandom, cidToString, computeFingerprint, computeMessageDigest, computeTypedDataDigest, concatBytes, encodeField, encodeType, fingerprintEquals, generateConnectionURI, getAppStoreUrl, hashStruct, hexToBytes, isMobileBrowser, parseConnectionURI, typeHash, verifyMessage, verifyTypedData };