@qrlwallet/connect 2.0.0 → 3.1.0

package/dist/index.mjs

@@ -3,68 +3,144 @@ import EventEmitter4 from "eventemitter3";
 
 // src/ConnectionManager.ts
 import EventEmitter3 from "eventemitter3";
-import { v4 as uuidv4 } from "uuid";
 
 // src/KeyExchange.ts
 import EventEmitter from "eventemitter3";
 
-// src/PQCrypto.ts
+// src/crypto/primitives.ts
 import { ml_kem768 } from "@noble/post-quantum/ml-kem.js";
-var textEncoder = new TextEncoder();
-var LABEL = textEncoder.encode("pq-pair/v1");
-var LABEL_AEAD_SUFFIX = textEncoder.encode(" aead");
-var DIR_DAPP_TX = new Uint8Array([0, 0, 0, 1]);
-var DIR_WALLET_TX = new Uint8Array([0, 0, 0, 2]);
-var ML_KEM_768_CT_LEN = 1088;
-var AEAD_KEY_LEN = 32;
-function subtle() {
+import { shake256 } from "@noble/hashes/sha3.js";
+import * as mldsa from "@theqrl/mldsa87";
+function webCrypto() {
   const c = globalThis.crypto;
-  if (!c || !c.subtle) {
-    throw new Error("PQCrypto: WebCrypto SubtleCrypto is not available in this environment");
+  if (!c) {
+    throw new Error("crypto: WebCrypto is not available in this environment");
+  }
+  return c;
+}
+function subtle() {
+  const c = webCrypto();
+  if (!c.subtle) {
+    throw new Error("crypto: WebCrypto SubtleCrypto is not available in this environment");
   }
   return c.subtle;
 }
 function bs(u) {
-  return u;
+  if (u.buffer instanceof ArrayBuffer) {
+    return new Uint8Array(u.buffer, u.byteOffset, u.byteLength);
+  }
+  const copy = new Uint8Array(u.byteLength);
+  copy.set(u);
+  return copy;
 }
-function kemKeygen() {
+function mlkemKeygen() {
   const { publicKey, secretKey } = ml_kem768.keygen();
   return { pk: publicKey, sk: secretKey };
 }
-function kemEncaps(pk) {
+function mlkemEncaps(pk) {
   const { cipherText, sharedSecret } = ml_kem768.encapsulate(pk);
   return { ct: cipherText, ss: sharedSecret };
 }
-function kemDecaps(sk, ct) {
+function mlkemDecaps(sk, ct) {
   return ml_kem768.decapsulate(ct, sk);
 }
-async function transcriptHash(cid, pk, ct) {
-  const buf = concat(LABEL, cid, pk, ct);
-  return new Uint8Array(await subtle().digest("SHA-256", bs(buf)));
+function shake256Digest(data, dkLen) {
+  return shake256(data, { dkLen });
 }
-async function deriveAeadKey(ss, htx) {
-  const ikm = await subtle().importKey("raw", bs(ss), "HKDF", false, ["deriveKey"]);
-  const info = concat(LABEL, LABEL_AEAD_SUFFIX, htx);
+async function sha256(data) {
+  return new Uint8Array(await subtle().digest("SHA-256", bs(data)));
+}
+function mldsaVerify(signature, digest, publicKey, ctx) {
+  return mldsa.cryptoSignVerify(signature, digest, publicKey, ctx);
+}
+async function hkdfAesGcmKey(ikm, salt, info) {
+  const ikmKey = await subtle().importKey("raw", bs(ikm), "HKDF", false, ["deriveKey"]);
   return subtle().deriveKey(
-    { name: "HKDF", hash: "SHA-256", salt: new Uint8Array(32), info: bs(info) },
-    ikm,
+    { name: "HKDF", hash: "SHA-256", salt: bs(salt), info: bs(info) },
+    ikmKey,
     { name: "AES-GCM", length: 256 },
     true,
     ["encrypt", "decrypt"]
   );
 }
-async function importRawAeadKey(raw) {
-  if (raw.length !== AEAD_KEY_LEN) {
-    throw new Error(`PQCrypto: raw AEAD key must be ${AEAD_KEY_LEN} bytes`);
-  }
+async function importAesGcmKey(raw) {
   return subtle().importKey("raw", bs(raw), { name: "AES-GCM", length: 256 }, true, [
     "encrypt",
     "decrypt"
   ]);
 }
+async function exportAesGcmKey(key) {
+  return new Uint8Array(await subtle().exportKey("raw", key));
+}
+async function aesGcmEncrypt(key, iv, aad2, plaintext) {
+  const ct = await subtle().encrypt(
+    { name: "AES-GCM", iv: bs(iv), additionalData: bs(aad2) },
+    key,
+    bs(plaintext)
+  );
+  return new Uint8Array(ct);
+}
+async function aesGcmDecrypt(key, iv, aad2, ciphertext) {
+  const pt = await subtle().decrypt(
+    { name: "AES-GCM", iv: bs(iv), additionalData: bs(aad2) },
+    key,
+    bs(ciphertext)
+  );
+  return new Uint8Array(pt);
+}
+function randomBytes(n) {
+  const c = webCrypto();
+  if (typeof c.getRandomValues !== "function") {
+    throw new Error("crypto: crypto.getRandomValues is not available");
+  }
+  return c.getRandomValues(new Uint8Array(n));
+}
+function randomUuid() {
+  const b = randomBytes(16);
+  b[6] = (b[6] ?? 0) & 15 | 64;
+  b[8] = (b[8] ?? 0) & 63 | 128;
+  const hex = Array.from(b, (v) => v.toString(16).padStart(2, "0")).join("");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+function constantTimeEquals(a, b) {
+  if (a.length !== b.length) return false;
+  let d = 0;
+  for (let i = 0; i < a.length; i++) d |= (a[i] ?? 0) ^ (b[i] ?? 0);
+  return d === 0;
+}
+
+// src/PQCrypto.ts
+var textEncoder = new TextEncoder();
+var LABEL = textEncoder.encode("pq-pair/v1");
+var LABEL_AEAD_SUFFIX = textEncoder.encode(" aead");
+var DIR_DAPP_TX = new Uint8Array([0, 0, 0, 1]);
+var DIR_WALLET_TX = new Uint8Array([0, 0, 0, 2]);
+var ML_KEM_768_CT_LEN = 1088;
+var AEAD_KEY_LEN = 32;
+function kemKeygen() {
+  return mlkemKeygen();
+}
+function kemEncaps(pk) {
+  return mlkemEncaps(pk);
+}
+function kemDecaps(sk, ct) {
+  return mlkemDecaps(sk, ct);
+}
+async function transcriptHash(cid, pk, ct) {
+  return sha256(concat(LABEL, cid, pk, ct));
+}
+async function deriveAeadKey(ss, htx) {
+  const info = concat(LABEL, LABEL_AEAD_SUFFIX, htx);
+  return hkdfAesGcmKey(ss, new Uint8Array(32), info);
+}
+async function importRawAeadKey(raw) {
+  if (raw.length !== AEAD_KEY_LEN) {
+    throw new Error(`PQCrypto: raw AEAD key must be ${AEAD_KEY_LEN} bytes`);
+  }
+  return importAesGcmKey(raw);
+}
 async function exportRawAeadKey(key) {
-  const buf = await subtle().exportKey("raw", key);
-  return new Uint8Array(buf);
+  return exportAesGcmKey(key);
 }
 function nonce(dir, seq) {
   if (dir.length !== 4) {
@@ -86,20 +162,10 @@ function aad(htx, seq) {
   return out;
 }
 async function seal(key, dir, seq, htx, pt) {
-  const ct = await subtle().encrypt(
-    { name: "AES-GCM", iv: bs(nonce(dir, seq)), additionalData: bs(aad(htx, seq)) },
-    key,
-    bs(pt)
-  );
-  return new Uint8Array(ct);
+  return aesGcmEncrypt(key, nonce(dir, seq), aad(htx, seq), pt);
 }
 async function open(key, dir, seq, htx, ct) {
-  const pt = await subtle().decrypt(
-    { name: "AES-GCM", iv: bs(nonce(dir, seq)), additionalData: bs(aad(htx, seq)) },
-    key,
-    bs(ct)
-  );
-  return new Uint8Array(pt);
+  return aesGcmDecrypt(key, nonce(dir, seq), aad(htx, seq), ct);
 }
 function zeroize(b) {
   b.fill(0);
@@ -120,7 +186,7 @@ function toBase64(bytes) {
   let bin = "";
   for (let i = 0; i < bytes.length; i += CHUNK) {
     const slice = bytes.subarray(i, i + CHUNK);
-    bin += String.fromCharCode.apply(null, slice);
+    bin += String.fromCharCode.apply(null, Array.from(slice));
   }
   return btoa(bin);
 }
@@ -130,12 +196,6 @@ function fromBase64(b64) {
   for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
   return out;
 }
-function constantTimeEquals(a, b) {
-  if (a.length !== b.length) return false;
-  let d = 0;
-  for (let i = 0; i < a.length; i++) d |= a[i] ^ b[i];
-  return d === 0;
-}
 
 // src/config.ts
 var DEFAULT_RELAY_URL = "https://qrlwallet.com";
@@ -145,15 +205,13 @@ var SESSION_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
 var STORAGE_KEY_PREFIX = "@qrlwallet/connect";
 var REQUEST_TIMEOUT_MS = 5 * 60 * 1e3;
 var WALLET_UNRESPONSIVE_MS = 30 * 1e3;
+var RECONNECT_WALLET_PROBE_MS = 12 * 1e3;
 var RESTRICTED_METHODS = /* @__PURE__ */ new Set([
   "qrl_requestAccounts",
   "qrl_sendTransaction",
   "qrl_signTransaction",
-  "qrl_sign",
-  "personal_sign",
+  "qrl_signMessage",
   "qrl_signTypedData",
-  "qrl_signTypedData_v3",
-  "qrl_signTypedData_v4",
   "wallet_addQrlChain",
   "wallet_switchQrlChain"
 ]);
@@ -257,6 +315,13 @@ var KeyExchange = class extends EventEmitter {
     this.awaitingSynAck = false;
     this.awaitingAck = false;
     this.keysExchanged = false;
+    // The ACK we produced for the current handshake. A wallet that lost its
+    // transport right after sending SYNACK re-sends the identical SYNACK on
+    // rejoin; we answer with this cached ACK so the handshake converges
+    // instead of stalling (onSynAck ignores duplicates and would otherwise
+    // never reply). Cleared on reset; not persisted (a reloaded dApp has a
+    // completed session and the wallet is no longer awaiting an ACK).
+    this.lastAck = null;
     this.isOriginator = isOriginator;
     if (restored) {
       this.session = restored;
@@ -287,7 +352,7 @@ var KeyExchange = class extends EventEmitter {
    */
   async onSynAck(cid, msg) {
     if (!this.isOriginator) {
-      warn("KeyExchange", "Responder received SYNACK \u2014 ignoring");
+      warn("KeyExchange", "Responder received SYNACK - ignoring");
       return null;
     }
     if (!this.awaitingSynAck || !this.keypair) {
@@ -330,11 +395,13 @@ var KeyExchange = class extends EventEmitter {
     this.step = "key_handshake_ACK" /* ACK */;
     this.emit("keys_exchanged");
     this.emit("step_change", this.step);
-    return {
+    const ack = {
       type: "key_handshake_ACK" /* ACK */,
       c1: toBase64(c1),
       v: PROTOCOL_VERSION
     };
+    this.lastAck = ack;
+    return ack;
   }
   /**
    * Responder (wallet) side: begin handshake from a scanned QR.
@@ -375,7 +442,7 @@ var KeyExchange = class extends EventEmitter {
    */
   async onAck(msg) {
     if (this.isOriginator) {
-      warn("KeyExchange", "Originator received ACK \u2014 ignoring");
+      warn("KeyExchange", "Originator received ACK - ignoring");
       return;
     }
     if (!this.awaitingAck) {
@@ -402,23 +469,17 @@ var KeyExchange = class extends EventEmitter {
   /** Encrypt a string for the counterparty. Returns base64. */
   async encryptMessage(data) {
     if (!this.session) {
-      throw new Error("KeyExchange: cannot encrypt \u2014 session not established");
+      throw new Error("KeyExchange: cannot encrypt - session not established");
     }
+    const seq = this.session.sendSeq++;
     const pt = textEncoder2.encode(data);
-    const ct = await seal(
-      this.session.key,
-      this.session.sendDir,
-      this.session.sendSeq,
-      this.session.htx,
-      pt
-    );
-    this.session.sendSeq++;
+    const ct = await seal(this.session.key, this.session.sendDir, seq, this.session.htx, pt);
     return toBase64(ct);
   }
   /** Decrypt a base64 ciphertext from the counterparty. */
   async decryptMessage(b64) {
     if (!this.session) {
-      throw new Error("KeyExchange: cannot decrypt \u2014 session not established");
+      throw new Error("KeyExchange: cannot decrypt - session not established");
     }
     const ct = fromBase64(b64);
     const pt = await open(
@@ -444,12 +505,17 @@ var KeyExchange = class extends EventEmitter {
     this.keysExchanged = false;
     this.awaitingSynAck = false;
     this.awaitingAck = false;
+    this.lastAck = null;
     this.step = "key_handshake_SYN" /* SYN */;
     if (emit) this.emit("step_change", this.step);
   }
   areKeysExchanged() {
     return this.keysExchanged;
   }
+  /** The ACK produced for the current handshake, for duplicate-SYNACK replies. */
+  getLastAck() {
+    return this.lastAck;
+  }
   getSession() {
     return this.session;
   }
@@ -516,7 +582,10 @@ var SocketClient = class extends EventEmitter2 {
    * Connect to the relay server.
    */
   connect() {
-    if (this.socket?.connected) return;
+    if (this.socket) {
+      if (!this.socket.connected) this.socket.connect();
+      return;
+    }
     log("Socket", `Connecting to ${this.relayUrl}`);
     this.socket = io(this.relayUrl, {
       path: RELAY_PATH,
@@ -534,7 +603,7 @@ var SocketClient = class extends EventEmitter2 {
         const reconnectChannelId = this.channelId;
         this.joinChannelNow(reconnectChannelId).then((result) => {
           this.settlePendingJoin(reconnectChannelId, { result });
-          this.emit("reconnected");
+          this.emit("reconnected", result);
         }).catch((err) => {
           const reconnectErr = err instanceof Error ? err : new Error(String(err));
           this.settlePendingJoin(reconnectChannelId, { error: reconnectErr });
@@ -552,8 +621,14 @@ var SocketClient = class extends EventEmitter2 {
       this.emit("message", data);
     });
     this.socket.on("participants_changed", (data) => {
-      log("Socket", `Participants changed: ${data.event}`);
-      this.emit("participants_changed", data);
+      if (typeof data !== "object" || data === null) return;
+      const rec = { ...data };
+      const event = typeof rec.event === "string" ? rec.event : "";
+      log("Socket", `Participants changed: ${event}`);
+      this.emit("participants_changed", {
+        event,
+        ...typeof rec.clientType === "string" ? { clientType: rec.clientType } : {}
+      });
     });
     this.socket.on("connect_error", (err) => {
       warn("Socket", `Connection error: ${err.message}`);
@@ -566,7 +641,7 @@ var SocketClient = class extends EventEmitter2 {
    * it doesn't fire after the fact.
    */
   settlePendingJoin(channelId, outcome) {
-    if (!this.pendingJoin || this.pendingJoin.channelId !== channelId) return;
+    if (this.pendingJoin?.channelId !== channelId) return;
     clearTimeout(this.pendingJoin.watchdog);
     const pending = this.pendingJoin;
     this.pendingJoin = null;
@@ -633,12 +708,14 @@ var SocketClient = class extends EventEmitter2 {
           if (response.success) {
             log("Socket", `Joined channel ${channelId}`);
             resolve({
-              bufferedMessages: response.bufferedMessages || [],
-              channelPublicKey: response.channelPublicKey ?? null
+              bufferedMessages: response.bufferedMessages ?? [],
+              channelPublicKey: response.channelPublicKey ?? null,
+              participants: response.participants ?? [],
+              terminated: response.terminated === true
             });
           } else {
             error("Socket", `Failed to join channel: ${response.error}`);
-            reject(new Error(response.error || "Failed to join channel"));
+            reject(new Error(response.error ?? "Failed to join channel"));
           }
         }
       );
@@ -661,7 +738,7 @@ var SocketClient = class extends EventEmitter2 {
           if (response?.success) {
             resolve({ success: true, buffered: response.buffered });
           } else {
-            reject(new Error(response?.error || "Failed to send message"));
+            reject(new Error(response?.error ?? "Failed to send message"));
           }
         }
       );
@@ -717,26 +794,26 @@ var DECODE = (() => {
 })();
 function decodeChar(charCode) {
   if (charCode < 0 || charCode >= 128) return -1;
-  return DECODE[charCode];
+  return DECODE[charCode] ?? -1;
 }
 function base45Encode(bytes) {
   const n = bytes.length;
   let out = "";
   let i = 0;
   while (i + 2 <= n) {
-    const v = bytes[i] << 8 | bytes[i + 1];
+    const v = (bytes[i] ?? 0) << 8 | (bytes[i + 1] ?? 0);
     const c2 = Math.floor(v / 2025);
     const r = v - c2 * 2025;
     const c1 = Math.floor(r / 45);
     const c0 = r - c1 * 45;
-    out += ALPHABET[c0] + ALPHABET[c1] + ALPHABET[c2];
+    out += `${ALPHABET[c0] ?? ""}${ALPHABET[c1] ?? ""}${ALPHABET[c2] ?? ""}`;
     i += 2;
   }
   if (i < n) {
-    const v = bytes[i];
+    const v = bytes[i] ?? 0;
     const c1 = Math.floor(v / 45);
     const c0 = v - c1 * 45;
-    out += ALPHABET[c0] + ALPHABET[c1];
+    out += `${ALPHABET[c0] ?? ""}${ALPHABET[c1] ?? ""}`;
   }
   return out;
 }
@@ -785,29 +862,18 @@ var FP_LABEL = new TextEncoder().encode("pq-fp/v2");
 var CID_LEN = 16;
 var FP_LEN = 32;
 var BLOB_LEN = 4 + CID_LEN + FP_LEN;
-function bs2(u) {
-  return u;
-}
 async function computeFingerprint(cid, pk) {
   if (cid.length !== CID_LEN) {
     throw new Error(`qrUri: cid must be ${CID_LEN} bytes`);
   }
-  const c = globalThis.crypto;
-  if (!c || !c.subtle) {
-    throw new Error("qrUri: WebCrypto SubtleCrypto is not available");
-  }
   const buf = new Uint8Array(FP_LABEL.length + cid.length + pk.length);
   buf.set(FP_LABEL, 0);
   buf.set(cid, FP_LABEL.length);
   buf.set(pk, FP_LABEL.length + cid.length);
-  const digest = await c.subtle.digest("SHA-256", bs2(buf));
-  return new Uint8Array(digest);
+  return sha256(buf);
 }
 function fingerprintEquals(a, b) {
-  if (a.length !== b.length) return false;
-  let diff = 0;
-  for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];
-  return diff === 0;
+  return constantTimeEquals(a, b);
 }
 async function generateConnectionURI(cid, pk, relayUrl) {
   if (cid.length !== CID_LEN) {
@@ -846,7 +912,7 @@ async function parseConnectionURI(uri) {
   }
   if (params.has("channelId") || params.has("pubKey")) {
     throw new Error(
-      "qrUri: legacy v1 URI detected \u2014 this wallet and this dApp must both run protocol v2"
+      "qrUri: legacy v1 URI detected - this wallet and this dApp must both run protocol v2"
     );
   }
   const q = params.get("q");
@@ -862,7 +928,7 @@ async function parseConnectionURI(uri) {
   }
   if (blob.length !== BLOB_LEN) {
     if (blob.length === 1208 && startsWith(blob, PQP1_MAGIC)) {
-      throw new Error("qrUri: legacy PQP1 URI detected \u2014 regenerate the QR with a v2.0+ dApp SDK");
+      throw new Error("qrUri: legacy PQP1 URI detected - regenerate the QR with a v2.0+ dApp SDK");
     }
     throw new Error(`qrUri: expected ${BLOB_LEN}-byte blob, got ${blob.length}`);
   }
@@ -871,8 +937,8 @@ async function parseConnectionURI(uri) {
   }
   const cid = blob.slice(4, 4 + CID_LEN);
   const fp = blob.slice(4 + CID_LEN, 4 + CID_LEN + FP_LEN);
-  const relayUrl = params.get("r") || void 0;
-  return { cid, fp, relayUrl };
+  const r = params.get("r");
+  return { cid, fp, relayUrl: r === null || r === "" ? void 0 : r };
 }
 function cidToString(cid) {
   if (cid.length !== CID_LEN) {
@@ -880,7 +946,7 @@ function cidToString(cid) {
   }
   let hex = "";
   for (let i = 0; i < CID_LEN; i++) {
-    hex += cid[i].toString(16).padStart(2, "0");
+    hex += (cid[i] ?? 0).toString(16).padStart(2, "0");
   }
   return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
 }
@@ -896,15 +962,79 @@ function cidFromString(s) {
   return out;
 }
 function cidRandom() {
-  const c = globalThis.crypto;
-  if (!c || typeof c.getRandomValues !== "function") {
-    throw new Error("qrUri: crypto.getRandomValues is not available");
-  }
-  return c.getRandomValues(new Uint8Array(CID_LEN));
+  return randomBytes(CID_LEN);
 }
 
 // src/ConnectionManager.ts
 var DAPP_PARTICIPANT_CONFLICT_ERROR_MSG = "dapp participant is already connected";
+function isRecord(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function isStringArray(v) {
+  return Array.isArray(v) && v.every((x) => typeof x === "string");
+}
+function isRelayMessage(v) {
+  return isRecord(v) && typeof v.id === "string" && (v.clientType === "dapp" || v.clientType === "wallet") && "message" in v && (typeof v.message === "string" || typeof v.message === "object" && v.message !== null);
+}
+var MESSAGE_TYPE_BY_VALUE = Object.fromEntries(
+  Object.values(MessageType).map((m) => [m, m])
+);
+function parseJsonRpcResponse(msg) {
+  if (typeof msg.id !== "string" && typeof msg.id !== "number") return null;
+  const out = {
+    jsonrpc: typeof msg.jsonrpc === "string" ? msg.jsonrpc : "2.0",
+    id: msg.id
+  };
+  if ("result" in msg) out.result = msg.result;
+  if (msg.error !== void 0) {
+    if (!isRecord(msg.error) || typeof msg.error.message !== "string") return null;
+    out.error = {
+      code: typeof msg.error.code === "number" ? msg.error.code : -32e3,
+      message: msg.error.message,
+      data: msg.error.data
+    };
+  }
+  return out;
+}
+function parsePersistedKex(v) {
+  if (!isRecord(v)) return null;
+  const { cid, kAeadRaw, htx, sendDir, recvDir, sendSeq, recvSeq } = v;
+  if (typeof cid !== "string" || typeof kAeadRaw !== "string" || typeof htx !== "string" || typeof sendDir !== "string" || typeof recvDir !== "string" || typeof sendSeq !== "number" || !Number.isInteger(sendSeq) || sendSeq < 0 || typeof recvSeq !== "number" || !Number.isInteger(recvSeq) || recvSeq < 0) {
+    return null;
+  }
+  return { cid, kAeadRaw, htx, sendDir, recvDir, sendSeq, recvSeq };
+}
+function parseDAppMetadata(v) {
+  if (!isRecord(v) || typeof v.name !== "string" || typeof v.url !== "string") return null;
+  const meta = { name: v.name, url: v.url };
+  if (typeof v.icon === "string") meta.icon = v.icon;
+  if (typeof v.redirectUrl === "string") meta.redirectUrl = v.redirectUrl;
+  return meta;
+}
+function parseStoredSession(raw) {
+  let v;
+  try {
+    v = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (!isRecord(v) || v.version !== 3) return null;
+  if (typeof v.channelId !== "string" || typeof v.chainId !== "string") return null;
+  if (typeof v.createdAt !== "number" || typeof v.lastActivity !== "number") return null;
+  const keyExchange = parsePersistedKex(v.keyExchange);
+  const dappMetadata = parseDAppMetadata(v.dappMetadata);
+  if (!keyExchange || !dappMetadata || !isStringArray(v.connectedAccounts)) return null;
+  return {
+    version: 3,
+    channelId: v.channelId,
+    keyExchange,
+    dappMetadata,
+    connectedAccounts: v.connectedAccounts,
+    chainId: v.chainId,
+    createdAt: v.createdAt,
+    lastActivity: v.lastActivity
+  };
+}
 var TERMINATE_SEND_TIMEOUT_MS = 800;
 var _ConnectionManager = class _ConnectionManager extends EventEmitter3 {
   constructor(options) {
@@ -913,14 +1043,16 @@ var _ConnectionManager = class _ConnectionManager extends EventEmitter3 {
     this.status = "disconnected" /* DISCONNECTED */;
     this.connectedAccounts = [];
     this.unresponsiveTimer = null;
+    this.reconnectProbeTimer = null;
     this.failedReconnects = 0;
     this.walletPresent = false;
     this.pendingRestore = null;
     this.messageQueue = Promise.resolve();
+    this.outboundQueue = Promise.resolve();
     this.dappMetadata = options.dappMetadata;
-    this.relayUrl = options.relayUrl || DEFAULT_RELAY_URL;
-    this.chainId = options.chainId || "0x0";
-    this.storageKey = options.storageKey || `${STORAGE_KEY_PREFIX}:session`;
+    this.relayUrl = options.relayUrl ?? DEFAULT_RELAY_URL;
+    this.chainId = options.chainId ?? "0x0";
+    this.storageKey = options.storageKey ?? `${STORAGE_KEY_PREFIX}:session`;
     const stored = this.readStoredSession();
     if (stored) {
       this.channelId = stored.channelId;
@@ -930,7 +1062,7 @@ var _ConnectionManager = class _ConnectionManager extends EventEmitter3 {
       this.pendingRestore = stored;
       log("ConnectionManager", `Found persisted session for channel ${this.channelId}`);
     } else {
-      this.channelId = uuidv4();
+      this.channelId = randomUuid();
     }
     this.socketClient = new SocketClient(this.relayUrl, "dapp");
     this.setupSocketListeners();
@@ -942,13 +1074,23 @@ var _ConnectionManager = class _ConnectionManager extends EventEmitter3 {
         this.failedReconnects = 0;
       }
     });
-    this.socketClient.on("reconnected", () => {
+    this.socketClient.on("reconnected", (result) => {
+      if (result?.terminated) {
+        log("ConnectionManager", "Channel terminated, observed on auto-reconnect");
+        this.handleSessionTerminated();
+        return;
+      }
+      if (result) {
+        this.walletPresent = result.participants.includes("wallet");
+      }
       if (this.keyExchange?.areKeysExchanged()) {
         if (this.walletPresent) {
+          this.clearReconnectProbe();
           this.setStatus("connected" /* CONNECTED */);
           this.failedReconnects = 0;
         } else {
           this.setStatus("waiting" /* WAITING */);
+          this.armReconnectProbe();
         }
       } else {
         this.setStatus("waiting" /* WAITING */);
@@ -975,11 +1117,17 @@ var _ConnectionManager = class _ConnectionManager extends EventEmitter3 {
         this.walletPresent = true;
         log("ConnectionManager", "Wallet joined channel");
         this.clearUnresponsiveTimer();
+        this.clearReconnectProbe();
         if (this.keyExchange?.areKeysExchanged()) {
           this.failedReconnects = 0;
           this.setStatus("connected" /* CONNECTED */);
         }
       }
+      if (data.event === "close") {
+        log("ConnectionManager", "Wallet closed the channel (explicit terminate)");
+        this.handleSessionTerminated();
+        return;
+      }
       if (data.event === "disconnect" || data.event === "leave") {
         if (data.clientType === "wallet" || !data.clientType) {
           this.walletPresent = false;
@@ -995,6 +1143,7 @@ var _ConnectionManager = class _ConnectionManager extends EventEmitter3 {
     if (!this.keyExchange) return;
     this.keyExchange.on("keys_exchanged", () => {
       log("ConnectionManager", "Key exchange complete");
+      this.clearReconnectProbe();
       this.setStatus("connected" /* CONNECTED */);
       this.walletPresent = true;
       this.failedReconnects = 0;
@@ -1015,6 +1164,7 @@ var _ConnectionManager = class _ConnectionManager extends EventEmitter3 {
    */
   async getConnectionURI(retryOnConflict = true) {
     this.setStatus("connecting" /* CONNECTING */);
+    this.clearReconnectProbe();
     this.pendingRestore = null;
     this.walletPresent = false;
     if (this.keyExchange) {
@@ -1024,7 +1174,7 @@ var _ConnectionManager = class _ConnectionManager extends EventEmitter3 {
       this.setupKeyExchangeListeners();
     }
     const pk = this.keyExchange.initiate();
-    this.channelId = uuidv4();
+    this.channelId = randomUuid();
     this.socketClient.setPublicKey(toBase64(pk));
     this.socketClient.connect();
     try {
@@ -1035,7 +1185,7 @@ var _ConnectionManager = class _ConnectionManager extends EventEmitter3 {
           "ConnectionManager",
           "Channel already has an active dApp participant. Rotating to a fresh channel."
         );
-        this.channelId = uuidv4();
+        this.channelId = randomUuid();
         return this.getConnectionURI(false);
       }
       this.setStatus("disconnected" /* DISCONNECTED */);
@@ -1069,17 +1219,39 @@ var _ConnectionManager = class _ConnectionManager extends EventEmitter3 {
       this.setStatus("disconnected" /* DISCONNECTED */);
       return false;
     }
+    return this.joinAndSettle();
+  }
+  /**
+   * (Re)open the socket, join the persisted channel, drain buffered relay
+   * messages, and settle status. Shared by the cold-restore reconnect() and
+   * the warm resume() path whose socket was torn down by the reconnect probe.
+   * Assumes channelId and a hydrated keyExchange are already in place, and
+   * that the caller has reset walletPresent + set RECONNECTING status.
+   */
+  async joinAndSettle() {
     this.socketClient.connect();
     try {
-      const { bufferedMessages } = await this.socketClient.joinChannel(this.channelId);
+      const { bufferedMessages, participants, terminated } = await this.socketClient.joinChannel(
+        this.channelId
+      );
+      if (terminated) {
+        log("ConnectionManager", "Stored session was terminated by the wallet; dropping it");
+        this.handleSessionTerminated();
+        return false;
+      }
+      if (participants.includes("wallet")) {
+        this.walletPresent = true;
+      }
       for (const msg of bufferedMessages) {
         this.enqueueRelayMessage(msg);
       }
       await this.messageQueue;
-      if (this.keyExchange?.areKeysExchanged()) {
-        this.setStatus(this.walletPresent ? "connected" /* CONNECTED */ : "waiting" /* WAITING */);
+      if (this.keyExchange?.areKeysExchanged() && this.walletPresent) {
+        this.clearReconnectProbe();
+        this.setStatus("connected" /* CONNECTED */);
       } else {
         this.setStatus("waiting" /* WAITING */);
+        this.armReconnectProbe();
       }
       return true;
     } catch (err) {
@@ -1088,6 +1260,65 @@ var _ConnectionManager = class _ConnectionManager extends EventEmitter3 {
       return false;
     }
   }
+  /**
+   * Nudge the connection back to life after the dApp tab / wallet app was
+   * backgrounded. Idempotent and safe to call from visibilitychange / online
+   * / pageshow handlers. If a restored session has not yet been hydrated,
+   * runs the full reconnect(); otherwise just re-opens the socket, whose
+   * own connect handler re-joins the channel and drains the relay buffer.
+   */
+  resume() {
+    if (this.status === "connected" /* CONNECTED */) return;
+    if (this.pendingRestore && !this.keyExchange?.areKeysExchanged()) {
+      void this.reconnect();
+      return;
+    }
+    if (this.channelId && this.keyExchange?.areKeysExchanged()) {
+      if (this.socketClient.getChannelId()) {
+        this.socketClient.connect();
+      } else {
+        this.setStatus("reconnecting" /* RECONNECTING */);
+        this.walletPresent = false;
+        void this.joinAndSettle();
+      }
+    }
+  }
+  /**
+   * A session was terminated for good (wallet sent a relay 'close', or the
+   * join ack reported a tombstone). Clear local state and surface
+   * DISCONNECTED so the consumer drops to a fresh-pairing UI.
+   */
+  handleSessionTerminated() {
+    this.clearReconnectProbe();
+    this.clearUnresponsiveTimer();
+    this.walletPresent = false;
+    this.pendingRestore = null;
+    this.keyExchange = null;
+    this.socketClient.leaveChannel();
+    this.socketClient.disconnect();
+    this.clearSession();
+    this.setStatus("disconnected" /* DISCONNECTED */);
+  }
+  armReconnectProbe() {
+    this.clearReconnectProbe();
+    this.reconnectProbeTimer = setTimeout(() => {
+      this.reconnectProbeTimer = null;
+      if (this.walletPresent) return;
+      warn(
+        "ConnectionManager",
+        `No wallet rejoined within ${RECONNECT_WALLET_PROBE_MS}ms; treating reconnect as dead`
+      );
+      this.socketClient.leaveChannel();
+      this.socketClient.disconnect();
+      this.setStatus("disconnected" /* DISCONNECTED */);
+    }, RECONNECT_WALLET_PROBE_MS);
+  }
+  clearReconnectProbe() {
+    if (this.reconnectProbeTimer) {
+      clearTimeout(this.reconnectProbeTimer);
+      this.reconnectProbeTimer = null;
+    }
+  }
   /**
    * Send a JSON-RPC request to the wallet (async, fire-and-forget).
    */
@@ -1124,8 +1355,8 @@ var _ConnectionManager = class _ConnectionManager extends EventEmitter3 {
     try {
       const raw = localStorage.getItem(this.storageKey);
       if (!raw) return false;
-      const session = JSON.parse(raw);
-      if (session.version !== 2) return false;
+      const session = parseStoredSession(raw);
+      if (!session) return false;
       return Date.now() - session.createdAt <= SESSION_TTL_MS;
     } catch {
       return false;
@@ -1140,8 +1371,7 @@ var _ConnectionManager = class _ConnectionManager extends EventEmitter3 {
    */
   async flushTerminate() {
     if (!this.keyExchange?.areKeysExchanged()) return;
-    const send = this.sendEncrypted({ type: "terminate" /* TERMINATE */ }).catch(() => {
-    });
+    const send = this.sendEncrypted({ type: "terminate" /* TERMINATE */ }).catch(() => void 0);
     const timeout = new Promise((resolve) => setTimeout(resolve, TERMINATE_SEND_TIMEOUT_MS));
     await Promise.race([send, timeout]);
   }
@@ -1152,6 +1382,7 @@ var _ConnectionManager = class _ConnectionManager extends EventEmitter3 {
    */
   async resetForNewChannel() {
     this.clearUnresponsiveTimer();
+    this.clearReconnectProbe();
     this.walletPresent = false;
     await this.flushTerminate();
     this.socketClient.leaveChannel();
@@ -1159,7 +1390,7 @@ var _ConnectionManager = class _ConnectionManager extends EventEmitter3 {
     this.clearSession();
     this.connectedAccounts = [];
     this.pendingRestore = null;
-    this.channelId = uuidv4();
+    this.channelId = randomUuid();
     this.keyExchange = null;
     this.socketClient = new SocketClient(this.relayUrl, "dapp");
     this.setupSocketListeners();
@@ -1167,6 +1398,7 @@ var _ConnectionManager = class _ConnectionManager extends EventEmitter3 {
   }
   async disconnect() {
     this.clearUnresponsiveTimer();
+    this.clearReconnectProbe();
     this.walletPresent = false;
     await this.flushTerminate();
     this.socketClient.leaveChannel();
@@ -1174,36 +1406,58 @@ var _ConnectionManager = class _ConnectionManager extends EventEmitter3 {
     this.setStatus("disconnected" /* DISCONNECTED */);
     this.clearSession();
     this.connectedAccounts = [];
+    this.pendingRestore = null;
+    this.keyExchange = null;
   }
   // ── Internals ──────────────────────────────────────────────
   enqueueRelayMessage(data) {
-    this.messageQueue = this.messageQueue.then(() => this.handleRelayMessage(data)).catch((err) => error("ConnectionManager", "messageQueue handler error:", err));
+    if (!isRelayMessage(data)) {
+      warn("ConnectionManager", "Dropping malformed relay envelope");
+      return;
+    }
+    this.messageQueue = this.messageQueue.then(() => this.handleRelayMessage(data)).catch((err) => {
+      error("ConnectionManager", "messageQueue handler error:", err);
+    });
   }
   async handleRelayMessage(data) {
     if (data.clientType === "wallet") {
       this.walletPresent = true;
+      this.clearReconnectProbe();
       if (this.keyExchange?.areKeysExchanged() && this.status !== "connected" /* CONNECTED */) {
         this.failedReconnects = 0;
         this.setStatus("connected" /* CONNECTED */);
       }
     }
     const message = data.message;
-    if (typeof message === "object" && message !== null) {
-      const msg = message;
-      if (msg.type === "key_handshake_SYNACK" /* SYNACK */) {
-        await this.handleSynAck(message);
+    if (isRecord(message)) {
+      if (message.type === "key_handshake_SYNACK" /* SYNACK */) {
+        if (typeof message.ct === "string" && typeof message.c0 === "string") {
+          await this.handleSynAck({
+            type: "key_handshake_SYNACK" /* SYNACK */,
+            ct: message.ct,
+            c0: message.c0,
+            v: typeof message.v === "number" ? message.v : 0
+          });
+        } else {
+          warn("ConnectionManager", "Dropping malformed SYNACK");
+        }
         return;
       }
-      if (msg.type === "key_handshake_SYN" /* SYN */ || msg.type === "key_handshake_ACK" /* ACK */) {
-        warn("ConnectionManager", `Unexpected ${msg.type} on dApp side \u2014 ignoring`);
+      if (message.type === "key_handshake_SYN" /* SYN */ || message.type === "key_handshake_ACK" /* ACK */) {
+        warn("ConnectionManager", `Unexpected ${message.type} on dApp side, ignoring`);
         return;
       }
     }
     if (typeof message === "string" && this.keyExchange?.areKeysExchanged()) {
       try {
         const decrypted = await this.keyExchange.decryptMessage(message);
+        await this.persistSession();
         const parsed = JSON.parse(decrypted);
-        this.handleDecryptedMessage(parsed);
+        if (isRecord(parsed)) {
+          this.handleDecryptedMessage(parsed);
+        } else {
+          warn("ConnectionManager", "Dropping non-object decrypted payload");
+        }
       } catch (err) {
         error("ConnectionManager", "Failed to decrypt message:", err);
       }
@@ -1223,16 +1477,21 @@ var _ConnectionManager = class _ConnectionManager extends EventEmitter3 {
     }
     if (response) {
       this.sendPlaintext(response);
+      return;
+    }
+    const cachedAck = this.keyExchange.getLastAck();
+    if (this.keyExchange.areKeysExchanged() && cachedAck) {
+      log("ConnectionManager", "Duplicate SYNACK after handshake; re-sending cached ACK");
+      this.sendPlaintext(cachedAck);
     }
   }
   handleDecryptedMessage(msg) {
     this.clearUnresponsiveTimer();
-    const type = msg.type;
-    switch (type) {
+    const type = typeof msg.type === "string" ? msg.type : "";
+    switch (MESSAGE_TYPE_BY_VALUE[type]) {
       case "wallet_info" /* WALLET_INFO */: {
-        const info = msg;
-        const nextAccounts = info.accounts || [];
-        const nextChainId = info.chainId || this.chainId;
+        const nextAccounts = isStringArray(msg.accounts) ? msg.accounts : [];
+        const nextChainId = typeof msg.chainId === "string" && msg.chainId ? msg.chainId : this.chainId;
         const accountsChanged = !this.areArraysEqual(this.connectedAccounts, nextAccounts);
         const chainChanged = this.chainId !== nextChainId;
         this.connectedAccounts = nextAccounts;
@@ -1247,7 +1506,11 @@ var _ConnectionManager = class _ConnectionManager extends EventEmitter3 {
         break;
       }
       case "jsonrpc" /* JSONRPC */: {
-        const response = msg;
+        const response = parseJsonRpcResponse(msg);
+        if (!response) {
+          warn("ConnectionManager", "Dropping malformed JSON-RPC response");
+          break;
+        }
         this.emit("jsonrpc_response", response);
         break;
       }
@@ -1269,11 +1532,28 @@ var _ConnectionManager = class _ConnectionManager extends EventEmitter3 {
       error("ConnectionManager", "Failed to send plaintext:", err);
     });
   }
-  async sendEncrypted(message) {
+  /**
+   * Serialize every encrypt+persist+send on a single outbound queue.
+   * Callers like sendJsonRpc() are fire-and-forget, so without the queue two
+   * rapid provider.request() calls would interleave inside encryptMessage()
+   * across its await and could complete out of order; the receiver's
+   * contiguous-seq check would then drop the late one. (Nonce reuse itself is
+   * already prevented by the synchronous seq reservation in KeyExchange.)
+   */
+  sendEncrypted(message) {
+    const task = this.outboundQueue.then(() => this.sendEncryptedNow(message));
+    this.outboundQueue = task.then(
+      () => void 0,
+      () => void 0
+    );
+    return task;
+  }
+  async sendEncryptedNow(message) {
     if (!this.keyExchange?.areKeysExchanged()) {
       throw new Error("sendEncrypted: not connected");
     }
     const encrypted = await this.keyExchange.encryptMessage(JSON.stringify(message));
+    await this.persistSession();
     await this.socketClient.sendMessage({
       id: this.channelId,
       clientType: "dapp",
@@ -1314,7 +1594,7 @@ var _ConnectionManager = class _ConnectionManager extends EventEmitter3 {
     const persistedKex = await this.keyExchange.exportPersisted();
     if (!persistedKex) return;
     const session = {
-      version: 2,
+      version: 3,
       channelId: this.channelId,
       keyExchange: persistedKex,
       dappMetadata: this.dappMetadata,
@@ -1334,13 +1614,13 @@ var _ConnectionManager = class _ConnectionManager extends EventEmitter3 {
     try {
       const raw = localStorage.getItem(this.storageKey);
       if (!raw) return null;
-      const session = JSON.parse(raw);
-      if (session.version !== 2) {
-        log("ConnectionManager", "Dropping legacy (pre-v2) session from storage");
+      const session = parseStoredSession(raw);
+      if (!session) {
+        log("ConnectionManager", "Dropping legacy or malformed session from storage");
         localStorage.removeItem(this.storageKey);
         return null;
       }
-      if (!session.createdAt || Date.now() - session.createdAt > SESSION_TTL_MS) {
+      if (Date.now() - session.createdAt > SESSION_TTL_MS) {
         localStorage.removeItem(this.storageKey);
         return null;
       }
@@ -1370,11 +1650,27 @@ function getAppStoreUrl() {
 }
 
 // src/QRLConnectProvider.ts
-var requestCounter = 0;
+var QRL_CONNECT_PROVIDER_INFO = {
+  name: "MyQRLWallet (Mobile)",
+  rdns: "com.qrlwallet.connect",
+  icon: "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAMAAAADACAYAAABS3GwHAAAAAXNSR0IArs4c6QAAH1dJREFUeF7tnXt8XGWZ+L/PmaT3JpOkrVCKgD9wFcELwgoLArIsWnDLCnIVgZ8gF1lcylVsk5xMKuXiiiKLn7L82OWiK1ZBtgpdFRDdAu4P1EVAuaNoQbrNTJJek5nzbN+TpE0nk8yZmTMzZybv/AXNe3ue9/me9/a8zyvYn9XAJNaATGLZrehWA1gArBFMag1YACZ191vhLQDWBia1BiwAk7r7rfAWAGsDk1oDFoBJ3f1WeAuAtYFJrQELwKTufiu8BcDawKTWwKQEQF0cwGGtPQjMtv6ngA8m8ViJJ6D1TsekAEDZZugu01MeHxLlIBXmi7A7ymwxKNjfdg1ohkEV3sDhj+LxG8fhN7M7eVGkPmGodwBEXRp7MpwdE7pUZBYwq96FDpHnLQqbFF2dXsf5c29hY72NCnVrC6+6TGvxOA6HK1TlQyNGUbcCh2j1I0WNnv8IbFH0+kbhG7Nc3ixDdVUpsi7tQRXp66TDE7lSYEZVNFuPlQoZ9XhePF0UX8bL9SBi3QHwxtXMnTqFOx2Rj6J2kRu6kZq1gOqrHpzV0sWaWp8S1RUA6tLQq6wAOdvf5bG/smlAlDcyaT2m9RqeKVslFSi4bgDQk4gl38VpTkzutF/+CliOX4X+clD427kuaytVY9j11A0AvS4f8zx5QMROe8I2knHLM5MhR7/a4nJpxeoMuaK6AEBdZvSqfBPhePv1D9lC8hSnqhlxeGfc5ZXK1hxObXUBwLp2PhgTecQRZoejFltKYA0IKqqrmoQTxSUdOF9EEtY8AGbLM9nJchG5quaFiYhRFNoMsyBOD+rRbct5rtC81U5f8zbzrMuU3TxeR2RetZU5WetXYTOefqolwX21poOaB6CvnUM8kTXYxW9VbU887WzuJlHVRhRRec0D0NPOGXbrs4ieDz2LfqvZ5Yxac5qreQCS7ZwtMbnd7v6EbtEFFegvhLs43gJQkNpKT5zswEWks+ZJLl0VVSvBOM2J6oPNXRxnAahwN6RclqnKEgtAhRU/XN0Oj1H9SdzlGAtAhfsh1cEyRJaEXW2WK3DYxVesvOwrXWF/KCwAFevK3BWVGYC1Ar9WYSvKXwD7hm1A5VafwgaUx0Ukqei7BPYL01FwBAAR/XFzJx+1I0C5ezSr/LIBoDyVdvSCQXhu17UM9s5jgcbkq8Ci2oFAN6ny8fQWnpwzg409MF/SnOU0SHdYmwYWgAobfHZ1ZQFAzf1XvTCeMK7VO34plwNB/hNlapXFDlS94+llTd18ZXRic3Le6/I0iBkJSv7ZKVDJKiytgLIAAF7G0/e2dfPsTsZzHo2pXUiJSPRvmQnqoIc1uTyWreFkB3eKyKdL0/xQbjsChKHFEsooFwADm3S3eTeMvfua7GCDiMwsockVyaqKxlQPberm8Ryj5i2IXBhGQ+wIEIYWSyijXAA0bNLdZlUAAH8PvQT5x82qaMbRw9pyjAA9nXzDQS4Io1oLQBhaLKGMcgFQiRFg2Hg8M48QQ4HxZwrrHvMEAKQ6+QYWAN/qyvLxKcGeC85aLgDKPgIMXS7/sQ5yVXwKT/dvpcVr5DOKXI3QUnLHWAAC2VLJeg5USxkT9Q6fBIdchVdOAPwvv2r/xkH2WrCc9SNtNwNBbwfLNYy7DRaAQCZRDwAkPJX2kAUpPwDo3S1djNmJSbmcLCp3KEwL1IPjJao0AKI/jtuDsJK6rKjMPS6fc5Cbzf52iBCUDYBRi8abW7q4OFvoZDtHSExWmbilRSlkx3Ay7iI4zDXAqOp+EHdZZE+CS+q1wjMnl7IIR75vFpAWgFH6q9AIsL1G1RXNCS6stUBZIdpM4cYbRo7XFzN99mzWqMgHQhSmeiNAgiPEq60RQJWNip7SmuCHYfRpJcsI0WYq2eyd61rfznsckTUiNIfUCm9wUBfMvYY3xkxRQjgIG5oGae4pkMuRgvx7yVMgQTPkPgcIdQpk9rJEvxnv4sxa+/rXxTaob0oraOz9E2ci0sFQ3P9SwfYym3WPtuv5Y6UBSLkchcr9Jox7KTAbyDzRQ3MdhKU6uBWRz5ZSvn9ioWz20LtFuKrFJVVSeVXKXKqhVKnZY6s1r75sgDkDyhUxOA+V4heRDt5AWt89bxkv5likGleIkn2BxNGbm10+n13+epePxVRWopTmbmF8gWJ6WFPHWFeIpMud4skZJXReWhx9IOOxYn2Sh/f5OltLKKuqWesGgGwtbn8GCfhpQBUfCby0nljbDKa1XkdvrmxJl3jqNbbsuSfpoOWOLsfUQS+NNG9btLtsyq7jyfNofHsDU+euY4D34BVahyn/uWdx5s5lytwj2Swnk8mu49WzmbZnC/LURtL984O//OK33Zye1mAArPFMoG4BCGjzNtkk14AFYJIbwGQX3wIw2S1gkstvAZjkBjDZxa9bAMyDGX9cwJQFG0lTwEJvshvEePI/tRZpGyC25wGofL52d32y5atbAPpdTsio3BFmBAQLh7kCqa+0dLF/veiibgFIuZwLcmsIh2L10tchyaFes9AoLl5IBVa1mLoFINnOHeLImVXVbn1W7pHWD8W/xJP1IF5dAvCIS8P7lZcFeXs9dFKUZFDjAuHpP8QT3FyLvj91vwbwb1W5nIgn37FvBoSPztAlfn1gQDhlnsuG8GuobIl1NwKoy7Skx68dERPK0P7Ko4GUJ/rhVre23wg2qqk7AFJL+aTE5K6SrxSWx3DqotThUeC7zeb6ppkS1fCvrgDQi5na28IqRP6mhvsk8k33LV7QtKfHz0nwg1peC9QVAKkOrlGRq+tKqAjiMOqT/9y0Rj12+lJ+H8FmBmpSXdiKv/Bt5xxicovqtj3qQKLbRKVoYCSol6Dfbe7i1FodBWreVozx9yzhEKdRvo2ye10ubEqx1HLnFVRVv7RZWD4/x/2Gcldfavk1D8CGL/LegUZWjez517xApfZoNfKbB0TQpc0u/1hrI0FN24u5DB8TVqrIu+2XvxqWP6rO4TcVkg537OWypcqtCVx9rQIgqaW8Q2PyXYT3GX+fWhUkcE/VQEJVMg66uOm33CIrx17FjKIINWk3PVfR7EzjRypykDX+aJmVwFtk9LCmZbxUC9OhmgPALHqTnSxzRK6wOz7RMv7trRFe1y16eMu1vBbRFo5qatRbmNW+1BIOpIHHFWmw8/4Id57oyuZd+ZScz2CEW1lbrhD9LvMGPX4mw34+NTd8RdkSwm6bkgQ9KZ7gobCLDrO8mrEhf+rTwRdFJGFuedVMw8PsrVorS/VXzQk+GOW1QM3YUZ/LnLTKzwXMY8/2VwsaGLo7cGFzglujCkFN2JL5+qdcFm8Ld2gOWuyvhjSg8OtG0YWz3LEvbkZBjJqwp3VXMnvKdHpGFr5RUJxtQ34NDL+AuQXVM+IJvpc/R+VT1AQAyXYucWLyFfMKTOVVZGssRQPDdwe+3exyehTvDkTeoNRlSm+Ge3Dk70rpCJu3ihpQtPlNnSq3Rm9LNPIA9Lrs7XnyIxH2qmIX2qpL0YDxGPX0spYEN5ZSTDnyRh6AVAd/DfIfKsQi39hy9FC9lKm8Ek/o/4maOJG3qWQnX0fkIuvzEzXTCd6e4cszPekBPWTucl4InrP8KSMPQE8nv3WQd5VfFWNrGHPbW1GzkFPV14FnUNZFbmEnzBy+GHSAiDSqICObB9Xq7GE9blTVk1oTPFiNvhyvzmrpJJAO3rycmVNn0C9SHW/nkW08NUG2RB9FuL95Xx7iuW0hMjuHoyFETYMj1HYhSdhPMhxNTBahvBthrlRrJ01RD726JcH1UToUi1r3jQZDejr4uIPcX5UAV+b1Q/QnONzcAE/MdnkrELURTGRiJa3P8L6Yw+miXKQisZFmVswABBXVrzUJl0UprmjF5C/ULvyL7h2ciyMrKh3gVmGTI7q8B768p8vWKH2xCtXj6PTDwQMOwOFuVfmLkB8Xz9s0z9PVr/yZRQdGaDs00gCkOvmyiCyuKADK8+roF+Iu99eL4WdbZu9S9vEa+GdUjjB/q5QRqOqj8d34myi5SFdK9rxfh+wEZuHW67LaD3JVuXnrgIge0eTyi3o1/hE9+weMHj/FkYONrithCIo+E5dt3qEuAwUbRJkyVELuopruA9DFGlQOKaqAAjMppDSjn2pdxgP5spp7CZkBFiA4NOZLXdm/Dw7C1Eb6XofX3pPH0JIue6KsBDmwEoag6Np4G++I0gszlZC7KAsYHgEeAzm4qAIKyTR0UrksnqBzvC+/eXc4leZwhHYceYfAjAqOTIVIgwqDqvqWeNwbb+BLEy06e5ZwmBPjUUScgiopIrGqbo47tEqEokZEHAB5DCgrAMNbnS9s3qof3TXHHVazcOxbyt6eQyeIceiKrM6yFrx+/E5zZiHC4rjLfbng9l3NO7gBkcvKLpio9vcyc/cb2VwEP2XJUnaZi2310AhQGQDU04tbu7k5V1t7ExzkZbhdkP2KlaVa+bYf5Cn9it7csh/tuV6O37yMPbYMysOAGdnK97MABNdtpQBA9c1mh91yTRP8ub7Hz6iPtwYGRPXSpi5uyT69Ni9q9u7LTYp8rqy7QhaAiAFgDmc87WpKkMieHqx1mTE9wz0Sk+OiOtcPrs3tez9vOsL+TS7/k53XvKugMVlpAShcq2XJUaERwMuoHtuW4D+yhTCLQ2mQ+2Hboq0sElahUEE9T29rSXB+NvDrL6bJaZNUWV0l7AgQvNMrAYAqr3uqC9u6eTarZdLTzhXiyHV1Y/wjAopmnK28rWk563daNJs1VydrEdkleC8VmFJV+/vtIjiQ1ioBAPDSgOjCeS4vZRtDXxf/piqnBGpsLSUy0760Htu8jNVZu0YGgJsRubBsUz47AgS3lAoB8AKiC+Mur+xkDC5OUlkjyMF1NwIYQVU/mX1J3d/u7SShIkssAMHttGwpKwTA7zZv1YXZ+//+oZfHHxHZtZyLwnyvy5UNPtUL4glWZI8AqXYSErMAlM2oCym4EgAI/NbbqsdmB3E1APR6rFWRt4UJwIjBi/rz7w0qJEVGHQoN+Ty1qjllhl0E/PinYf881c+1JviGBaByjoAF92HVAVD+pAwtCIv9Eo/+woswiKc/8Rzubsjwe1F6BgdZ23ItfduVsxIn9d8saHRoGoixv6PmPjQnINIc5rTEArDDHIvt24INutAM9QCAcUXwlM2oPtrQyOLZS3mhkCuUfjzUq2hypnM1npwHNCFsv8xSqE5H0lsALAC+BiacApU6AhiHNE8fUFixPsnD+3zdvKNV/K/vat6pU/i0Il+gxKmRBcACUF4AhpzQuuNvsExuJW32XYo3/R05zdqkP80+Xsy4bMs7ii3TAmABKB8Awp8yGU20dvPP5bhU43tvtvNeiXEXxkGviMtCFgALQLkASKvoOXG4eyIffGPE27vAjA1d/v830MngyF/ywbPRZf6gmscnCg8ZYwGwAJQDgC2qem1Lgq6JpiappeylDoc7wpGKHOXH8Bm5iuL5M6XfAQ9kMtzb18gvJ3pytH8p7047sgrBj7gWdEfDAmABCB0AFb0j3sn/HW+XR29iamqd71/0KYG9TajHcacv5mEJpVdV18QGuXz2cp7PeZnFnFekOUEdvkMBwZMsABaAsAH4Q0x04WyX57K//mY7N/kFdpdp3CciHyh4zq4kM+j5rb/l3lxv75ry+1xu90TOCurJaQGwAIQHwNAzQFc3jxPxzGxfelO4B+T9xeza+JMipX+bA09nPMFXc40EySXsITF5hIARtC0AFoDQAPAjHXSxIJdhPusyZb7HE/6Xv8jfdvcJYat6+tl4YtsCO2tb1Xdk6+CfPJELg6wDLAAWgFAA8C/Ue3pVvJvrs+3bxDWdPoP/p1K6S/WOu736cibDEXO+xJ+y6+t1+UtP5fEgL2haACwAoQAAvInocXGXX2YbZMrlKFTMu1jxIj/+O2XbMRLoyrjLyWPWGkMerK8gske+UcACYAEIC4BfDogeNy/HC4gpl9tQOScM49+5DPViwvtmuzyTXXayg8WIfMUCEFzr+XQVvKSQU9aCM5yn+mCLw8dzHXqlOiSF0ByyWoZi/Xi6rCVBR3bZ61zmN6qMmR5lp7MjgB0BSh4BzJTEQ5e1ddGebWAblnJM2pHVZQvrLnLPuvXeWdkOdn4kC+XPgsyaCDwLgAUgFABQPbMlYXxydvz8EORLuZIGWV7wnn+e4WLUjtAvnK16XPbF9hcvZurcVn6uyEETDe0WAAtAyQCYAjzVM1oTfDMbgGQnNznD75qFOQUa5VL6pDl4y47voytoTK31PUWPNvWOB4EFwAJQVgBSndxUrof9hiHICcDwucMDiJibZBaAAF8fuwge705wgAsxonpGc44RoKedy5yYXF/Gly2fdHKMAGYKNKeV/8wX7tyOAHYEKHkEGHJR0EuzH3/2T2XbOcUT+Va5niASYVUTeqq4bBr9kXt9MdNnN5kQLxMHt7IAWABKBsC3f/T7LV18InukNY/S9apsNKeyAUbhwpIM3Tb7WryLS7NdIt5ymdXoSV++EO4WAAtAKACI8POB6Xrc3KuMs9rOv2Qn3xPkhMKsO39qAU88PbypmzVj6mznbBz5l3zzWguABSAUAIA/eKLHteY4le1p51REbhdh+kQL0vwmvyOFmXY56GMvvsGRuV5aTHbwMxH5cL4yLQAWgLAAwPP0tNZuvp1tdH1X05ZulB+K8KHQAFDdOOjxgXnLeDG7vrVX8fYZ0+TVINMuC4AFIDwAVH/RkuCQXO7Q2165PFg9+b4Kb8s3Lcn31QbSil4bfw4318WYVAdLcKQ7yOGbBcACEBoAZiWcUT21rZvvjFkMD/npm6nQvypMCWDkOyXZfvJr5v2ijzfBUbmeGO2/mrmZKWKiPR8QpA4LgAUgPAD8kvTphkGOmXUNfx4DwdB7vGepSIfAgiAG6pc4klDNS/V6+5ZNXLHLlzE7S9mQSLKDC0TEvHHmBBlpLAAWgJABwNOMuvFlLBvv8npSWRBD/k2FQyaapuwcQUs3Ocq5TXO4d7y3dde77BvzeEpFpgVda1gALAChAjB8b/fPafS0OQl+OsFbww19cLLncYkgB+SK8+nfMlPWgd7uDHLD7OX0jFden8ucTIZ7cOSokS61I0DQMXYoXRB9FVZiSKlr4T7AaFGHIViP6okt3Tw6kRp6Xfb2PB4Wkd1zTGnw3RzgR/mCa6U6+S7IopFYoUE7044AdgQIdQQYbcQCj2U8vaC127+xNW5M0GQn3YIszQbA5E+LLmxzR4VNz0qUWk6LbuVGQc40H4pCv2QWAAtA2QAYXsD+QVQvb3a2nQa7eLlGg94OLtKhhevOi1qPR+IxXSQuG3Lkk75raPW28E8qcmKxD2hYACwAZQVgWL0DqLpbNnFTrt2bng4ucnIAgMfDAzE9fl4WACYy9AY4POPJahWmFvrVHw2TBcACUAkA/Pu7qC5t7mJ59kJ2XADg4QEZC4A5Wc40ym8QSn63zAJgAagYAIJ2N7m4JQPgMsdTed68IVbqPoMFwAJQMQAUTcRdukICwESObrMAlKoBC0DlADAvxXSFNgJYAMKz/REbCLnEkIqrtXOAnGKbNQB6XbPLF0sdAYy/T3qKvCTmobwSf3YKZEeA0EYAcz3LcVjleST9qP4yfLg49F8iyg/iORzlCl0Er7uS2Y1TuV6FmX5IIvMz9Snq3zmI8WGQ+dYbtLCvQ9DDw8JKDSF1TYwAQlLRS+Kd3DXRmXouV4ZCARiy93FqUehtZ091+JGI7J1P/XYEsCNAKCOAonfG2zhvPEe1iQyx0HOAfEZt/v7WUvaZEhNzAj2h67UFwAIQCgC5wqIEMVSTZlwAlIcGHP277IOwIOWqy5Q+5SFFDpsovQXAAhAKAI7qlU0JbghinNlp+jq5wUMuz/53VZ7C0aNbXFKFlvuqy7QW5Tcw8TTIAmABCAUA4L/Mqe1c1wSkDfYYtpnHr1/C/IZGeRQdet1xp5+Sdhz9xGyXH5p/D1LuyNqgbwlLvJgkbFiU4J8OuwgeLzKcx1oVeduwEY6vUdUHcfhXzC6QQybt5V6oNjioCpoZpKXR4RKdIHqDSSeqyx3hcY+h4Fe5yjVl+ovjNLNo4EjgErMnlK9T7QhgR4DtI8CmrXrsrtfy2mgLN45nvUEBGCIkox6bRHJ7fvpl+zdd/G3LmQiNeb9R/hkCW/AYGHeHyZwyDN2DnGoc5IK6RlsALABDGlCex9OF8WWYcCLbfwaAlPIyyJ55R4C8lhytBP67Bp6e09bN7TvJDJJqJyExWRLkLKEoqUS1v5eZu9/I5qLylyFTvtGyDFUGK7IS5wDAS7JVFzZfy0ujW+W6OJ/P8KA4ckxkFRRMjTulGrmdo6qLWhOsygagr5OEShkBUNX+fgtAoK6rCADKy+LpwuasQFNmUZnq5DZBPhOosTWSyAfArC8yelC8m6fGjAAd3CWOnG5HgAh0aEUAEPodRxc2dYyNs5layieJiXn8ouB4PhFQ35gm7LibqU/HXd4vQ2uMHdM+RXpdkiDhv2s2UoudAgU3jQoBoJ6nn25J8K3s7cZ1VzK/cbo8BLwreKujndJsLXlbObR1OU+Mcc5rZ3/HkafLKoEFILh6KwGA/wn09OF4gqPHfBHNW18dfEaRFSLEgrc8milNVGkVXfkrOOMjLunsVvZ2cLGK3FTW1lsAgqu3EgAMtyatg3pQyzX8Ort1eh6NqV1YIkhH2V58DK6SklKq0hNz9NAmF3OnYKffepemmHIPyMdKqiRfZgtAPg1lz0nlMeDg4LmKS6mqqzb0c0qu7bk3L2fmtFl0qifnOg7xkb324mqqfC6BAU91TczjwqZlmCuVY37JJRwuDfIgMKOsLbQABFdvBUeAbcEb/MXwyc0uJsDsmJ9ezNRknL8Uh0tRFokjYtoX6S1Sc+SGvuDAP+JwX/aLkiNCGtl6W3gakXcG750iU1oAgiuukgAMtUqfHhAOncgL0/e5uYEZPX2c1ugwLwP7IGV4Bim4mnZOaRoorBN4LZPhv1ti23a3XHSCUI1Tkhm+5sTk/LJtfY5uoQUgeM9WHACzP47++6atfHbX5SY25/i/nS6mjBv7LbisoaUcNSTlc6LzH/Pr4HQVuYUQrlkGksECEEhNQ99jf1+6MmuAnVrl6bc3xThnftYLjMFbHv2U3zmJ2DHv4SPq+TfIKjeTswAEN45qAeD7rIneoxmua+nmV8FbXDspezr8MO6LRaS8i95slVgAghtJtQDwW+g/Rcobnqrb2sVt2WcEwaWITkpfn0v5IDHuVJF9io0rWpJEFoDg6qsqACPN9KM86P9XjxUNaZ6YNXXbI9QuW4NLUeWUCskvsHtsOvuqcqIipwvMGPLMrsLPAhBc6ZEAYEdzzcnpWoW3QJ8R5QmHsaepwaUrX8rtoagd9lI4DJVdBXYDP5xKdX8WgOD6jxgA2xtupkNR2vjJpdFR74sV/HZA8B4qIqUFILjSogpAcAmqm7Jq05yJxLYABDcKC0BwXdVMSgtA8K7yAejkMUTK7gsUvFU2ZSkaUHRTXGgTly2llBNm3qpsBgQRwACQ7OSnMUc+XGsOaEHkm5xp9JV1Pey7z9ejs5MWXQCGriV+VUQuroifyuS0yIpKLaJrmnblI3I+gxWteILKIg1Abwfn4sgKC0BUzKW0dgj6gybhE5LjQk5pJRefO7IAGJFSSziQmPxXrV9GKb576iinf7qu3XHzXFTWfeRqShlpAIzHYrKDPzgiC6qpJFt3KBrYguoZ8QT3TvR+cig1FVBIpAEwciQ7uVFE/sFOgwro1YglHYrfSDLj6F/NyXEls5rNjTwAPe0cKo6sFphVTUXZuovXwBAAel9LghOKL6U8OSMPQP81zM1skfsRDimPCmyp5daACplG9IBZLuUNu1KEIJEHwMjU4/L3DnKTnQYV0cNRyKJ6T3MXp0Vp8TuilpoAQG9iau96ngTZLwr9adsQXAMKKRE9Me7ycPBclUtZEwAYdaxfwsFOTB4UIV459diaStKA2e709PaX3uTCA2+NzuHXaJlqBgB1aUjBF0Wl04TEL6ljbOaya2DIbVyfUTi8mOeeyt7A4QpqBgB/LXAVzTKVR8SR99v1QKVMpLh6VPl9rFE/2tSeOxhXcaWGn6umADDi97vMS3vcjshx5v9rToDw+zB6Jaqm1eOk+POskpVkotfAHS2qSfvZ4LLLoCercXivmBfZ7S9CGtD/QTil2eWRfLGJotDomjWedS7zG5TlIJ8cHdOyZgWKgjWU0gb//TN93vM4z0SkE3eC99JKqSfkvDVtL4+4NLzPY7Eg1/nL4qjH6wy58yJTnDF91bviczlPPh8dX/8g+qlpAEYE7GlnfxEWI3K8QGsQwW2aEDSgbFb0CXW4bf16vheliy5BpasLAIyw+hWm9/Wx27aAVuercpEg00bcqEeiJNSNsEF7txzphp56VRH9oedxIw6/irv01sJ8P5c66s4m/MC159GQmsup0sCxiOyB0qZKswgzUaZplCI6l8NIQyhTzLQGBkT8J01Tah7sVv29Oqz20jzU1s3voujaUKjodQdAtgKSLnFJ00YDzQqzxGNqxqv9J48K7eiC0zvoFIetXobNoqQGlU2tL7A26tuahcpZ9wBMoJDJLHsQO4l6/K8gMuRNY40gr4psgnrWgAWgnnvXypZXAxaAvCqyCepZAxaAeu5dK1teDVgA8qrIJqhnDVgA6rl3rWx5NfC/zGV/wHfd+nEAAAAASUVORK5CYII="
+};
+var EIP6963_ANNOUNCE_EVENT = "eip6963:announceProvider";
+var EIP6963_REQUEST_EVENT = "eip6963:requestProvider";
 var QRLConnectProvider = class extends EventEmitter4 {
   constructor(options) {
     super();
     this.pendingRequests = /* @__PURE__ */ new Map();
+    this.eip6963Detail = null;
+    this.eip6963RequestListener = null;
+    this.resumeListener = null;
+    this.resumeDebounce = null;
+    // Random per-instance prefix keeps request ids unique across page loads.
+    // A bare counter restarts at 1 on reload, and the relay buffers messages
+    // for 5 minutes, so a stale buffered response could otherwise be matched
+    // to a fresh request that drew the same small id.
+    this.requestIdPrefix = randomUuid().slice(0, 8);
+    this.requestCounter = 0;
     this.isQRLConnect = true;
     this.options = options;
     if (options.debug) {
@@ -1388,8 +1684,83 @@ var QRLConnectProvider = class extends EventEmitter4 {
     });
     this.setupConnectionListeners();
     if (options.autoReconnect !== false) {
-      this.connectionManager.reconnect();
+      void this.connectionManager.reconnect();
+    }
+    this.setupResumeListeners();
+    if (options.announceProvider !== false) {
+      this.startEip6963Announce();
+    }
+  }
+  startEip6963Announce() {
+    if (typeof window === "undefined" || typeof CustomEvent === "undefined") {
+      return;
+    }
+    const overrides = this.options.providerInfo ?? {};
+    this.eip6963Detail = Object.freeze({
+      info: Object.freeze({
+        uuid: randomUuid(),
+        name: overrides.name ?? QRL_CONNECT_PROVIDER_INFO.name,
+        icon: overrides.icon ?? QRL_CONNECT_PROVIDER_INFO.icon,
+        rdns: overrides.rdns ?? QRL_CONNECT_PROVIDER_INFO.rdns
+      }),
+      provider: this
+    });
+    const announce = () => {
+      if (!this.eip6963Detail) return;
+      window.dispatchEvent(new CustomEvent(EIP6963_ANNOUNCE_EVENT, { detail: this.eip6963Detail }));
+    };
+    this.eip6963RequestListener = announce;
+    window.addEventListener(EIP6963_REQUEST_EVENT, announce);
+    announce();
+  }
+  /**
+   * Re-open the relay socket when the dApp tab regains focus or the network
+   * comes back. Debounced because visibilitychange + online can fire together.
+   * No-op when already connected (ConnectionManager.resume guards that).
+   */
+  setupResumeListeners() {
+    if (typeof window === "undefined" || typeof document === "undefined") return;
+    if (this.resumeListener) return;
+    const resume = () => {
+      if (typeof document !== "undefined" && document.visibilityState === "hidden") return;
+      if (this.resumeDebounce) clearTimeout(this.resumeDebounce);
+      this.resumeDebounce = setTimeout(() => {
+        this.resumeDebounce = null;
+        this.connectionManager.resume();
+      }, 300);
+    };
+    this.resumeListener = resume;
+    document.addEventListener("visibilitychange", resume);
+    window.addEventListener("online", resume);
+    window.addEventListener("pageshow", resume);
+  }
+  /**
+   * Remove the foreground/online resume listeners. Called on disconnect so a
+   * torn-down session can't be silently revived by a later tab focus; the
+   * listeners are re-armed by getConnectionURI()/newConnection() if the same
+   * provider is re-paired. Safe in any env.
+   */
+  teardownResumeListeners() {
+    if (typeof window !== "undefined" && typeof document !== "undefined" && this.resumeListener) {
+      document.removeEventListener("visibilitychange", this.resumeListener);
+      window.removeEventListener("online", this.resumeListener);
+      window.removeEventListener("pageshow", this.resumeListener);
+    }
+    this.resumeListener = null;
+    if (this.resumeDebounce) {
+      clearTimeout(this.resumeDebounce);
+      this.resumeDebounce = null;
+    }
+  }
+  /**
+   * Stop announcing this provider over EIP-6963. Safe to call from any env.
+   */
+  stopEip6963Announce() {
+    if (typeof window !== "undefined" && this.eip6963RequestListener) {
+      window.removeEventListener(EIP6963_REQUEST_EVENT, this.eip6963RequestListener);
     }
+    this.eip6963RequestListener = null;
+    this.eip6963Detail = null;
   }
   setupConnectionListeners() {
     this.connectionManager.on("status_changed", (status) => {
@@ -1447,6 +1818,7 @@ var QRLConnectProvider = class extends EventEmitter4 {
    * Generate a connection URI for QR code display or deep link redirect.
    */
   async getConnectionURI() {
+    this.setupResumeListeners();
     return this.connectionManager.getConnectionURI();
   }
   /**
@@ -1479,7 +1851,7 @@ var QRLConnectProvider = class extends EventEmitter4 {
     if (this.connectionManager.getStatus() !== "connected" /* CONNECTED */) {
       throw new Error("Not connected to QRL Wallet");
     }
-    const id = ++requestCounter;
+    const id = `${this.requestIdPrefix}-${++this.requestCounter}`;
     return new Promise((resolve, reject) => {
       const pending = {
         id,
@@ -1560,7 +1932,7 @@ var QRLConnectProvider = class extends EventEmitter4 {
   /**
    * Disconnect from wallet and clean up. Returns once the TERMINATE has
    * either been flushed to the relay or the 800ms best-effort window has
-   * elapsed — the wallet gets an instant disconnect instead of landing in
+   * elapsed - the wallet gets an instant disconnect instead of landing in
    * its stale-session grace period.
    */
   async disconnect() {
@@ -1568,15 +1940,380 @@ var QRLConnectProvider = class extends EventEmitter4 {
       pending.reject(new Error("Disconnected"));
     }
     this.pendingRequests.clear();
+    this.teardownResumeListeners();
     await this.connectionManager.disconnect();
   }
 };
+
+// src/signing/ctx.ts
+var SCHEME_VERSION_MSG = "QRL-SIGN-MSG-v1";
+var SCHEME_VERSION_TYPED = "QRL-SIGN-TYPED-v1";
+var SCHEME_TAG_MSG = new TextEncoder().encode(SCHEME_VERSION_MSG);
+var SCHEME_TAG_TYPED = new TextEncoder().encode(SCHEME_VERSION_TYPED);
+var DIGEST_LEN = 64;
+
+// src/signing/bytes.ts
+function hexToBytes(hex) {
+  if (typeof hex !== "string") throw new Error("hex must be a string");
+  if (!/^0x([0-9a-fA-F]{2})*$/.test(hex)) {
+    throw new Error("hex must be 0x-prefixed even-length");
+  }
+  const n = (hex.length - 2) / 2;
+  const out = new Uint8Array(n);
+  for (let i = 0; i < n; i++) {
+    out[i] = parseInt(hex.slice(2 + i * 2, 4 + i * 2), 16);
+  }
+  return out;
+}
+function bytesToHex(bytes) {
+  if (!(bytes instanceof Uint8Array)) {
+    throw new Error("bytes must be a Uint8Array");
+  }
+  let s = "0x";
+  for (const v of bytes) s += v.toString(16).padStart(2, "0");
+  return s;
+}
+function concatBytes(...parts) {
+  return concatBytesArr(parts);
+}
+function concatBytesArr(parts) {
+  let total = 0;
+  for (const p of parts) total += p.length;
+  const out = new Uint8Array(total);
+  let off = 0;
+  for (const p of parts) {
+    out.set(p, off);
+    off += p.length;
+  }
+  return out;
+}
+
+// src/signing/messageDigest.ts
+function computeMessageDigest(messageBytes) {
+  if (!(messageBytes instanceof Uint8Array)) {
+    throw new Error("messageBytes must be a Uint8Array");
+  }
+  return shake256Digest(concatBytes(SCHEME_TAG_MSG, messageBytes), DIGEST_LEN);
+}
+
+// src/signing/typedData.ts
+var SLOT = 32;
+function isMessageObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+var ATOMIC_RE = /^(?:(address|bool|string|bytes)|(u?int)(\d+)|bytes(\d+)|(.+?)\[(\d*)\])$/;
+var MAX_TYPE_DEPTH = 12;
+function parseFieldType(type, types, depth = 0) {
+  if (depth > MAX_TYPE_DEPTH) throw new Error(`type nesting too deep: ${type}`);
+  if (Object.prototype.hasOwnProperty.call(types, type)) {
+    return { kind: "ref", name: type };
+  }
+  const m = ATOMIC_RE.exec(type);
+  if (!m) throw new Error(`unknown type: ${type}`);
+  const [, atomic, intKind, intWidthStr, bytesWidthStr, innerType, sizeStr] = m;
+  if (atomic === "address" || atomic === "bool" || atomic === "string" || atomic === "bytes") {
+    return { kind: atomic };
+  }
+  if (intKind) {
+    const width = Number(intWidthStr);
+    if (!Number.isInteger(width) || width < 8 || width > 256 || width % 8 !== 0) {
+      throw new Error(`invalid int width: ${type}`);
+    }
+    return { kind: intKind === "uint" ? "uintN" : "intN", width };
+  }
+  if (bytesWidthStr) {
+    const width = Number(bytesWidthStr);
+    if (!Number.isInteger(width) || width < 1 || width > 32) {
+      throw new Error(`invalid bytesN width: ${type}`);
+    }
+    return { kind: "bytesN", width };
+  }
+  if (innerType !== void 0) {
+    parseFieldType(innerType, types, depth + 1);
+    if (sizeStr) {
+      const size = Number(sizeStr);
+      if (!Number.isInteger(size) || size <= 0) {
+        throw new Error(`invalid array size: ${type}`);
+      }
+      return { kind: "array", inner: innerType, size };
+    }
+    return { kind: "array", inner: innerType };
+  }
+  throw new Error(`unhandled type: ${type}`);
+}
+function baseTypeName(type) {
+  return type.replace(/(\[\d*\])+$/, "");
+}
+function collectDependencies(primary, types) {
+  if (!Object.prototype.hasOwnProperty.call(types, primary)) {
+    throw new Error(`unknown primary type: ${primary}`);
+  }
+  const visited = /* @__PURE__ */ new Set();
+  const visit = (name, path) => {
+    if (path.includes(name)) {
+      throw new Error(`cyclic type reference: ${[...path, name].join(" -> ")}`);
+    }
+    if (visited.has(name)) return;
+    visited.add(name);
+    const def = types[name];
+    if (!def) throw new Error(`unknown type: ${name}`);
+    for (const f of def) {
+      const base = baseTypeName(f.type);
+      if (Object.prototype.hasOwnProperty.call(types, base)) {
+        visit(base, [...path, name]);
+      }
+      parseFieldType(f.type, types);
+    }
+  };
+  visit(primary, []);
+  return visited;
+}
+function validateTypeMap(types) {
+  for (const [name, def] of Object.entries(types)) {
+    const defUnknown = def;
+    if (!Array.isArray(defUnknown) || def.length === 0) {
+      throw new Error(`empty or invalid struct: ${name}`);
+    }
+    const seen = /* @__PURE__ */ new Set();
+    for (const f of def) {
+      if (!f || typeof f.name !== "string" || !f.name) {
+        throw new Error(`bad field in ${name}`);
+      }
+      if (typeof f.type !== "string" || !f.type) {
+        throw new Error(`bad field type in ${name}.${f.name}`);
+      }
+      if (seen.has(f.name)) {
+        throw new Error(`duplicate field "${f.name}" in ${name}`);
+      }
+      seen.add(f.name);
+    }
+  }
+}
+function encodeType(primary, types) {
+  const deps = collectDependencies(primary, types);
+  const others = [...deps].filter((n) => n !== primary).sort();
+  return [primary, ...others].map((name) => {
+    const fields = types[name];
+    if (!fields) throw new Error(`unknown type: ${name}`);
+    const inner = fields.map((f) => `${f.type} ${f.name}`).join(",");
+    return `${name}(${inner})`;
+  }).join("");
+}
+function typeHash(primary, types) {
+  return shake256Digest(new TextEncoder().encode(encodeType(primary, types)), DIGEST_LEN);
+}
+function parseQAddress(addr) {
+  if (typeof addr !== "string" || !/^Q[0-9a-fA-F]{40}$/.test(addr)) {
+    throw new Error(`invalid Q-address: ${addr}`);
+  }
+  return hexToBytes("0x" + addr.slice(1).toLowerCase());
+}
+function padLeft32(bytes) {
+  if (bytes.length > SLOT) throw new Error("cannot pad: bytes > 32");
+  const out = new Uint8Array(SLOT);
+  out.set(bytes, SLOT - bytes.length);
+  return out;
+}
+function padRight32(bytes) {
+  if (bytes.length > SLOT) throw new Error("cannot pad: bytes > 32");
+  const out = new Uint8Array(SLOT);
+  out.set(bytes, 0);
+  return out;
+}
+function bigIntToSlot(value, width, signed) {
+  if (signed) {
+    const limit = 1n << BigInt(width - 1);
+    if (value >= limit || value < -limit) {
+      throw new Error(`int${width} out of range: ${value}`);
+    }
+  } else {
+    if (value < 0n) throw new Error(`uint${width} negative: ${value}`);
+    const limit = 1n << BigInt(width);
+    if (value >= limit) throw new Error(`uint${width} out of range: ${value}`);
+  }
+  const slotMask = (1n << 256n) - 1n;
+  const repr = value < 0n ? value + (1n << 256n) & slotMask : value;
+  const out = new Uint8Array(SLOT);
+  let v = repr;
+  for (let i = SLOT - 1; i >= 0; i--) {
+    out[i] = Number(v & 0xffn);
+    v >>= 8n;
+  }
+  return out;
+}
+function parseIntValue(v, typeLabel) {
+  if (typeof v === "bigint") return v;
+  if (typeof v === "string") {
+    if (/^-?0x[0-9a-fA-F]+$/i.test(v)) {
+      const isNegative = v.startsWith("-");
+      const abs = BigInt(isNegative ? v.slice(1) : v);
+      return isNegative ? -abs : abs;
+    }
+    if (!/^-?(0|[1-9]\d*)$/.test(v)) {
+      throw new Error(`invalid ${typeLabel} string: ${v}`);
+    }
+    return BigInt(v);
+  }
+  if (typeof v === "number") {
+    if (!Number.isInteger(v) || !Number.isSafeInteger(v)) {
+      throw new Error(`unsafe ${typeLabel} number: ${v}, pass as string`);
+    }
+    return BigInt(v);
+  }
+  throw new Error(`unsupported ${typeLabel} value: ${typeof v}`);
+}
+function encodeField(type, value, types) {
+  const parsed = parseFieldType(type, types);
+  switch (parsed.kind) {
+    case "ref":
+      if (!isMessageObject(value)) {
+        throw new Error(`struct field expects object: ${type}`);
+      }
+      return hashStruct(parsed.name, value, types);
+    case "address":
+      if (typeof value !== "string") {
+        throw new Error(`address field expects string: ${typeof value}`);
+      }
+      return padLeft32(parseQAddress(value));
+    case "bool":
+      if (typeof value !== "boolean") {
+        throw new Error(`bool field expects boolean: ${typeof value}`);
+      }
+      return padLeft32(new Uint8Array([value ? 1 : 0]));
+    case "string":
+      if (typeof value !== "string") {
+        throw new Error(`string field expects string: ${typeof value}`);
+      }
+      return shake256Digest(new TextEncoder().encode(value), DIGEST_LEN);
+    case "bytes":
+      if (typeof value !== "string") {
+        throw new Error(`bytes field expects 0x-hex string: ${typeof value}`);
+      }
+      return shake256Digest(hexToBytes(value), DIGEST_LEN);
+    case "uintN":
+      return bigIntToSlot(parseIntValue(value, `uint${parsed.width}`), parsed.width, false);
+    case "intN":
+      return bigIntToSlot(parseIntValue(value, `int${parsed.width}`), parsed.width, true);
+    case "bytesN": {
+      if (typeof value !== "string") {
+        throw new Error(`bytes${parsed.width} expects 0x-hex string: ${typeof value}`);
+      }
+      const raw = hexToBytes(value);
+      if (raw.length !== parsed.width) {
+        throw new Error(`bytes${parsed.width} requires ${parsed.width} bytes, got ${raw.length}`);
+      }
+      return padRight32(raw);
+    }
+    case "array": {
+      if (!Array.isArray(value)) {
+        throw new Error(`array field expects array: ${typeof value}`);
+      }
+      if (parsed.size !== void 0 && value.length !== parsed.size) {
+        throw new Error(`fixed array ${type} requires length ${parsed.size}, got ${value.length}`);
+      }
+      const chunks = value.map((v) => encodeField(parsed.inner, v, types));
+      return shake256Digest(concatBytesArr(chunks), DIGEST_LEN);
+    }
+  }
+}
+function hashStruct(primary, data, types) {
+  const fields = types[primary];
+  if (!fields) throw new Error(`unknown struct: ${primary}`);
+  const expected = new Set(fields.map((f) => f.name));
+  for (const k of Object.keys(data)) {
+    if (!expected.has(k)) throw new Error(`unknown field in ${primary}: ${k}`);
+  }
+  const parts = [typeHash(primary, types)];
+  for (const f of fields) {
+    if (!(f.name in data)) throw new Error(`missing field ${primary}.${f.name}`);
+    parts.push(encodeField(f.type, data[f.name], types));
+  }
+  return shake256Digest(concatBytesArr(parts), DIGEST_LEN);
+}
+var RESERVED_DOMAIN_FIELDS = {
+  name: "string",
+  version: "string",
+  chainId: "uint256",
+  verifyingContract: "address",
+  salt: "bytes32"
+};
+function validateDomainTypes(types) {
+  const def = types.QRLDomain;
+  if (!def) throw new Error("QRLDomain type is required");
+  let hasName = false;
+  for (const f of def) {
+    const expected = RESERVED_DOMAIN_FIELDS[f.name];
+    if (!expected) {
+      throw new Error(
+        `QRLDomain field "${f.name}" not in reserved set (name, version, chainId, verifyingContract, salt)`
+      );
+    }
+    if (f.type !== expected) {
+      throw new Error(`QRLDomain field "${f.name}" must be type "${expected}", got "${f.type}"`);
+    }
+    if (f.name === "name") hasName = true;
+  }
+  if (!hasName) throw new Error("QRLDomain.name is required");
+}
+function validatePayloadReachability(primary, types) {
+  const reachable = /* @__PURE__ */ new Set();
+  for (const root of ["QRLDomain", primary]) {
+    for (const t of collectDependencies(root, types)) reachable.add(t);
+  }
+  for (const k of Object.keys(types)) {
+    if (!reachable.has(k)) throw new Error(`unused referenced type: ${k}`);
+  }
+}
+function computeTypedDataDigest(payload) {
+  if (!payload || typeof payload !== "object") {
+    throw new Error("invalid typed data payload");
+  }
+  validateTypeMap(payload.types);
+  validateDomainTypes(payload.types);
+  validatePayloadReachability(payload.primaryType, payload.types);
+  const domainHash = hashStruct("QRLDomain", payload.domain, payload.types);
+  const messageHash = hashStruct(payload.primaryType, payload.message, payload.types);
+  return shake256Digest(concatBytes(SCHEME_TAG_TYPED, domainHash, messageHash), DIGEST_LEN);
+}
+
+// src/signing/verify.ts
+function bytesOrHex(v) {
+  if (v instanceof Uint8Array) return v;
+  if (typeof v === "string") return hexToBytes(v);
+  throw new Error("expected Uint8Array or 0x-hex string");
+}
+function verifyMessage({
+  signature,
+  publicKey,
+  messageBytes
+}) {
+  try {
+    const sig = bytesOrHex(signature);
+    const pk = bytesOrHex(publicKey);
+    const msg = bytesOrHex(messageBytes);
+    const digest = computeMessageDigest(msg);
+    return mldsaVerify(sig, digest, pk, SCHEME_TAG_MSG);
+  } catch {
+    return false;
+  }
+}
+function verifyTypedData({ signature, publicKey, payload }) {
+  try {
+    const sig = bytesOrHex(signature);
+    const pk = bytesOrHex(publicKey);
+    const digest = computeTypedDataDigest(payload);
+    return mldsaVerify(sig, digest, pk, SCHEME_TAG_TYPED);
+  } catch {
+    return false;
+  }
+}
 export {
   BLOB_LEN,
   CID_LEN,
   ConnectionManager,
   ConnectionStatus,
   DEFAULT_RELAY_URL,
+  DIGEST_LEN,
   FP_LEN,
   KeyExchange,
   KeyExchangeMessageType,
@@ -1584,16 +2321,32 @@ export {
   PROTOCOL_VERSION,
   QRLConnectProvider as QRLConnect,
   QRLConnectProvider,
+  QRL_CONNECT_PROVIDER_INFO,
   RESTRICTED_METHODS,
+  SCHEME_TAG_MSG,
+  SCHEME_TAG_TYPED,
+  SCHEME_VERSION_MSG,
+  SCHEME_VERSION_TYPED,
   SocketClient,
   UNRESTRICTED_METHODS,
+  bytesToHex,
   cidFromString,
   cidRandom,
   cidToString,
   computeFingerprint,
+  computeMessageDigest,
+  computeTypedDataDigest,
+  concatBytes,
+  encodeField,
+  encodeType,
   fingerprintEquals,
   generateConnectionURI,
   getAppStoreUrl,
+  hashStruct,
+  hexToBytes,
   isMobileBrowser,
-  parseConnectionURI
+  parseConnectionURI,
+  typeHash,
+  verifyMessage,
+  verifyTypedData
 };