@qrlwallet/connect 3.0.0 → 3.1.1

package/dist/index.js

@@ -79,68 +79,144 @@ var import_eventemitter34 = __toESM(require("eventemitter3"));
 
 // src/ConnectionManager.ts
 var import_eventemitter33 = __toESM(require("eventemitter3"));
-var import_uuid = require("uuid");
 
 // src/KeyExchange.ts
 var import_eventemitter3 = __toESM(require("eventemitter3"));
 
-// src/PQCrypto.ts
+// src/crypto/primitives.ts
 var import_ml_kem = require("@noble/post-quantum/ml-kem.js");
-var textEncoder = new TextEncoder();
-var LABEL = textEncoder.encode("pq-pair/v1");
-var LABEL_AEAD_SUFFIX = textEncoder.encode(" aead");
-var DIR_DAPP_TX = new Uint8Array([0, 0, 0, 1]);
-var DIR_WALLET_TX = new Uint8Array([0, 0, 0, 2]);
-var ML_KEM_768_CT_LEN = 1088;
-var AEAD_KEY_LEN = 32;
-function subtle() {
+var import_sha3 = require("@noble/hashes/sha3.js");
+var mldsa = __toESM(require("@theqrl/mldsa87"));
+function webCrypto() {
   const c = globalThis.crypto;
-  if (!c || !c.subtle) {
-    throw new Error("PQCrypto: WebCrypto SubtleCrypto is not available in this environment");
+  if (!c) {
+    throw new Error("crypto: WebCrypto is not available in this environment");
+  }
+  return c;
+}
+function subtle() {
+  const c = webCrypto();
+  if (!c.subtle) {
+    throw new Error("crypto: WebCrypto SubtleCrypto is not available in this environment");
   }
   return c.subtle;
 }
 function bs(u) {
-  return u;
+  if (u.buffer instanceof ArrayBuffer) {
+    return new Uint8Array(u.buffer, u.byteOffset, u.byteLength);
+  }
+  const copy = new Uint8Array(u.byteLength);
+  copy.set(u);
+  return copy;
 }
-function kemKeygen() {
+function mlkemKeygen() {
   const { publicKey, secretKey } = import_ml_kem.ml_kem768.keygen();
   return { pk: publicKey, sk: secretKey };
 }
-function kemEncaps(pk) {
+function mlkemEncaps(pk) {
   const { cipherText, sharedSecret } = import_ml_kem.ml_kem768.encapsulate(pk);
   return { ct: cipherText, ss: sharedSecret };
 }
-function kemDecaps(sk, ct) {
+function mlkemDecaps(sk, ct) {
   return import_ml_kem.ml_kem768.decapsulate(ct, sk);
 }
-async function transcriptHash(cid, pk, ct) {
-  const buf = concat(LABEL, cid, pk, ct);
-  return new Uint8Array(await subtle().digest("SHA-256", bs(buf)));
+function shake256Digest(data, dkLen) {
+  return (0, import_sha3.shake256)(data, { dkLen });
 }
-async function deriveAeadKey(ss, htx) {
-  const ikm = await subtle().importKey("raw", bs(ss), "HKDF", false, ["deriveKey"]);
-  const info = concat(LABEL, LABEL_AEAD_SUFFIX, htx);
+async function sha256(data) {
+  return new Uint8Array(await subtle().digest("SHA-256", bs(data)));
+}
+function mldsaVerify(signature, digest, publicKey, ctx) {
+  return mldsa.cryptoSignVerify(signature, digest, publicKey, ctx);
+}
+async function hkdfAesGcmKey(ikm, salt, info) {
+  const ikmKey = await subtle().importKey("raw", bs(ikm), "HKDF", false, ["deriveKey"]);
   return subtle().deriveKey(
-    { name: "HKDF", hash: "SHA-256", salt: new Uint8Array(32), info: bs(info) },
-    ikm,
+    { name: "HKDF", hash: "SHA-256", salt: bs(salt), info: bs(info) },
+    ikmKey,
     { name: "AES-GCM", length: 256 },
     true,
     ["encrypt", "decrypt"]
   );
 }
-async function importRawAeadKey(raw) {
-  if (raw.length !== AEAD_KEY_LEN) {
-    throw new Error(`PQCrypto: raw AEAD key must be ${AEAD_KEY_LEN} bytes`);
-  }
+async function importAesGcmKey(raw) {
   return subtle().importKey("raw", bs(raw), { name: "AES-GCM", length: 256 }, true, [
     "encrypt",
     "decrypt"
   ]);
 }
+async function exportAesGcmKey(key) {
+  return new Uint8Array(await subtle().exportKey("raw", key));
+}
+async function aesGcmEncrypt(key, iv, aad2, plaintext) {
+  const ct = await subtle().encrypt(
+    { name: "AES-GCM", iv: bs(iv), additionalData: bs(aad2) },
+    key,
+    bs(plaintext)
+  );
+  return new Uint8Array(ct);
+}
+async function aesGcmDecrypt(key, iv, aad2, ciphertext) {
+  const pt = await subtle().decrypt(
+    { name: "AES-GCM", iv: bs(iv), additionalData: bs(aad2) },
+    key,
+    bs(ciphertext)
+  );
+  return new Uint8Array(pt);
+}
+function randomBytes(n) {
+  const c = webCrypto();
+  if (typeof c.getRandomValues !== "function") {
+    throw new Error("crypto: crypto.getRandomValues is not available");
+  }
+  return c.getRandomValues(new Uint8Array(n));
+}
+function randomUuid() {
+  const b = randomBytes(16);
+  b[6] = (b[6] ?? 0) & 15 | 64;
+  b[8] = (b[8] ?? 0) & 63 | 128;
+  const hex = Array.from(b, (v) => v.toString(16).padStart(2, "0")).join("");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+function constantTimeEquals(a, b) {
+  if (a.length !== b.length) return false;
+  let d = 0;
+  for (let i = 0; i < a.length; i++) d |= (a[i] ?? 0) ^ (b[i] ?? 0);
+  return d === 0;
+}
+
+// src/PQCrypto.ts
+var textEncoder = new TextEncoder();
+var LABEL = textEncoder.encode("pq-pair/v1");
+var LABEL_AEAD_SUFFIX = textEncoder.encode(" aead");
+var DIR_DAPP_TX = new Uint8Array([0, 0, 0, 1]);
+var DIR_WALLET_TX = new Uint8Array([0, 0, 0, 2]);
+var ML_KEM_768_CT_LEN = 1088;
+var AEAD_KEY_LEN = 32;
+function kemKeygen() {
+  return mlkemKeygen();
+}
+function kemEncaps(pk) {
+  return mlkemEncaps(pk);
+}
+function kemDecaps(sk, ct) {
+  return mlkemDecaps(sk, ct);
+}
+async function transcriptHash(cid, pk, ct) {
+  return sha256(concat(LABEL, cid, pk, ct));
+}
+async function deriveAeadKey(ss, htx) {
+  const info = concat(LABEL, LABEL_AEAD_SUFFIX, htx);
+  return hkdfAesGcmKey(ss, new Uint8Array(32), info);
+}
+async function importRawAeadKey(raw) {
+  if (raw.length !== AEAD_KEY_LEN) {
+    throw new Error(`PQCrypto: raw AEAD key must be ${AEAD_KEY_LEN} bytes`);
+  }
+  return importAesGcmKey(raw);
+}
 async function exportRawAeadKey(key) {
-  const buf = await subtle().exportKey("raw", key);
-  return new Uint8Array(buf);
+  return exportAesGcmKey(key);
 }
 function nonce(dir, seq) {
   if (dir.length !== 4) {
@@ -162,20 +238,10 @@ function aad(htx, seq) {
   return out;
 }
 async function seal(key, dir, seq, htx, pt) {
-  const ct = await subtle().encrypt(
-    { name: "AES-GCM", iv: bs(nonce(dir, seq)), additionalData: bs(aad(htx, seq)) },
-    key,
-    bs(pt)
-  );
-  return new Uint8Array(ct);
+  return aesGcmEncrypt(key, nonce(dir, seq), aad(htx, seq), pt);
 }
 async function open(key, dir, seq, htx, ct) {
-  const pt = await subtle().decrypt(
-    { name: "AES-GCM", iv: bs(nonce(dir, seq)), additionalData: bs(aad(htx, seq)) },
-    key,
-    bs(ct)
-  );
-  return new Uint8Array(pt);
+  return aesGcmDecrypt(key, nonce(dir, seq), aad(htx, seq), ct);
 }
 function zeroize(b) {
   b.fill(0);
@@ -196,7 +262,7 @@ function toBase64(bytes) {
   let bin = "";
   for (let i = 0; i < bytes.length; i += CHUNK) {
     const slice = bytes.subarray(i, i + CHUNK);
-    bin += String.fromCharCode.apply(null, slice);
+    bin += String.fromCharCode.apply(null, Array.from(slice));
   }
   return btoa(bin);
 }
@@ -206,12 +272,6 @@ function fromBase64(b64) {
   for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
   return out;
 }
-function constantTimeEquals(a, b) {
-  if (a.length !== b.length) return false;
-  let d = 0;
-  for (let i = 0; i < a.length; i++) d |= a[i] ^ b[i];
-  return d === 0;
-}
 
 // src/config.ts
 var DEFAULT_RELAY_URL = "https://qrlwallet.com";
@@ -331,6 +391,13 @@ var KeyExchange = class extends import_eventemitter3.default {
     this.awaitingSynAck = false;
     this.awaitingAck = false;
     this.keysExchanged = false;
+    // The ACK we produced for the current handshake. A wallet that lost its
+    // transport right after sending SYNACK re-sends the identical SYNACK on
+    // rejoin; we answer with this cached ACK so the handshake converges
+    // instead of stalling (onSynAck ignores duplicates and would otherwise
+    // never reply). Cleared on reset; not persisted (a reloaded dApp has a
+    // completed session and the wallet is no longer awaiting an ACK).
+    this.lastAck = null;
     this.isOriginator = isOriginator;
     if (restored) {
       this.session = restored;
@@ -361,7 +428,7 @@ var KeyExchange = class extends import_eventemitter3.default {
    */
   async onSynAck(cid, msg) {
     if (!this.isOriginator) {
-      warn("KeyExchange", "Responder received SYNACK \u2014 ignoring");
+      warn("KeyExchange", "Responder received SYNACK - ignoring");
       return null;
     }
     if (!this.awaitingSynAck || !this.keypair) {
@@ -404,11 +471,13 @@ var KeyExchange = class extends import_eventemitter3.default {
     this.step = "key_handshake_ACK" /* ACK */;
     this.emit("keys_exchanged");
     this.emit("step_change", this.step);
-    return {
+    const ack = {
       type: "key_handshake_ACK" /* ACK */,
       c1: toBase64(c1),
       v: PROTOCOL_VERSION
     };
+    this.lastAck = ack;
+    return ack;
   }
   /**
    * Responder (wallet) side: begin handshake from a scanned QR.
@@ -449,7 +518,7 @@ var KeyExchange = class extends import_eventemitter3.default {
    */
   async onAck(msg) {
     if (this.isOriginator) {
-      warn("KeyExchange", "Originator received ACK \u2014 ignoring");
+      warn("KeyExchange", "Originator received ACK - ignoring");
       return;
     }
     if (!this.awaitingAck) {
@@ -476,23 +545,17 @@ var KeyExchange = class extends import_eventemitter3.default {
   /** Encrypt a string for the counterparty. Returns base64. */
   async encryptMessage(data) {
     if (!this.session) {
-      throw new Error("KeyExchange: cannot encrypt \u2014 session not established");
+      throw new Error("KeyExchange: cannot encrypt - session not established");
     }
+    const seq = this.session.sendSeq++;
     const pt = textEncoder2.encode(data);
-    const ct = await seal(
-      this.session.key,
-      this.session.sendDir,
-      this.session.sendSeq,
-      this.session.htx,
-      pt
-    );
-    this.session.sendSeq++;
+    const ct = await seal(this.session.key, this.session.sendDir, seq, this.session.htx, pt);
     return toBase64(ct);
   }
   /** Decrypt a base64 ciphertext from the counterparty. */
   async decryptMessage(b64) {
     if (!this.session) {
-      throw new Error("KeyExchange: cannot decrypt \u2014 session not established");
+      throw new Error("KeyExchange: cannot decrypt - session not established");
     }
     const ct = fromBase64(b64);
     const pt = await open(
@@ -518,12 +581,17 @@ var KeyExchange = class extends import_eventemitter3.default {
     this.keysExchanged = false;
     this.awaitingSynAck = false;
     this.awaitingAck = false;
+    this.lastAck = null;
     this.step = "key_handshake_SYN" /* SYN */;
     if (emit) this.emit("step_change", this.step);
   }
   areKeysExchanged() {
     return this.keysExchanged;
   }
+  /** The ACK produced for the current handshake, for duplicate-SYNACK replies. */
+  getLastAck() {
+    return this.lastAck;
+  }
   getSession() {
     return this.session;
   }
@@ -629,8 +697,14 @@ var SocketClient = class extends import_eventemitter32.default {
       this.emit("message", data);
     });
     this.socket.on("participants_changed", (data) => {
-      log("Socket", `Participants changed: ${data.event}`);
-      this.emit("participants_changed", data);
+      if (typeof data !== "object" || data === null) return;
+      const rec = { ...data };
+      const event = typeof rec.event === "string" ? rec.event : "";
+      log("Socket", `Participants changed: ${event}`);
+      this.emit("participants_changed", {
+        event,
+        ...typeof rec.clientType === "string" ? { clientType: rec.clientType } : {}
+      });
     });
     this.socket.on("connect_error", (err) => {
       warn("Socket", `Connection error: ${err.message}`);
@@ -643,7 +717,7 @@ var SocketClient = class extends import_eventemitter32.default {
    * it doesn't fire after the fact.
    */
   settlePendingJoin(channelId, outcome) {
-    if (!this.pendingJoin || this.pendingJoin.channelId !== channelId) return;
+    if (this.pendingJoin?.channelId !== channelId) return;
     clearTimeout(this.pendingJoin.watchdog);
     const pending = this.pendingJoin;
     this.pendingJoin = null;
@@ -710,14 +784,14 @@ var SocketClient = class extends import_eventemitter32.default {
           if (response.success) {
             log("Socket", `Joined channel ${channelId}`);
             resolve({
-              bufferedMessages: response.bufferedMessages || [],
+              bufferedMessages: response.bufferedMessages ?? [],
               channelPublicKey: response.channelPublicKey ?? null,
-              participants: response.participants || [],
+              participants: response.participants ?? [],
               terminated: response.terminated === true
             });
           } else {
             error("Socket", `Failed to join channel: ${response.error}`);
-            reject(new Error(response.error || "Failed to join channel"));
+            reject(new Error(response.error ?? "Failed to join channel"));
           }
         }
       );
@@ -740,7 +814,7 @@ var SocketClient = class extends import_eventemitter32.default {
           if (response?.success) {
             resolve({ success: true, buffered: response.buffered });
           } else {
-            reject(new Error(response?.error || "Failed to send message"));
+            reject(new Error(response?.error ?? "Failed to send message"));
           }
         }
       );
@@ -796,26 +870,26 @@ var DECODE = (() => {
 })();
 function decodeChar(charCode) {
   if (charCode < 0 || charCode >= 128) return -1;
-  return DECODE[charCode];
+  return DECODE[charCode] ?? -1;
 }
 function base45Encode(bytes) {
   const n = bytes.length;
   let out = "";
   let i = 0;
   while (i + 2 <= n) {
-    const v = bytes[i] << 8 | bytes[i + 1];
+    const v = (bytes[i] ?? 0) << 8 | (bytes[i + 1] ?? 0);
     const c2 = Math.floor(v / 2025);
     const r = v - c2 * 2025;
     const c1 = Math.floor(r / 45);
     const c0 = r - c1 * 45;
-    out += ALPHABET[c0] + ALPHABET[c1] + ALPHABET[c2];
+    out += `${ALPHABET[c0] ?? ""}${ALPHABET[c1] ?? ""}${ALPHABET[c2] ?? ""}`;
     i += 2;
   }
   if (i < n) {
-    const v = bytes[i];
+    const v = bytes[i] ?? 0;
     const c1 = Math.floor(v / 45);
     const c0 = v - c1 * 45;
-    out += ALPHABET[c0] + ALPHABET[c1];
+    out += `${ALPHABET[c0] ?? ""}${ALPHABET[c1] ?? ""}`;
   }
   return out;
 }
@@ -864,29 +938,18 @@ var FP_LABEL = new TextEncoder().encode("pq-fp/v2");
 var CID_LEN = 16;
 var FP_LEN = 32;
 var BLOB_LEN = 4 + CID_LEN + FP_LEN;
-function bs2(u) {
-  return u;
-}
 async function computeFingerprint(cid, pk) {
   if (cid.length !== CID_LEN) {
     throw new Error(`qrUri: cid must be ${CID_LEN} bytes`);
   }
-  const c = globalThis.crypto;
-  if (!c || !c.subtle) {
-    throw new Error("qrUri: WebCrypto SubtleCrypto is not available");
-  }
   const buf = new Uint8Array(FP_LABEL.length + cid.length + pk.length);
   buf.set(FP_LABEL, 0);
   buf.set(cid, FP_LABEL.length);
   buf.set(pk, FP_LABEL.length + cid.length);
-  const digest = await c.subtle.digest("SHA-256", bs2(buf));
-  return new Uint8Array(digest);
+  return sha256(buf);
 }
 function fingerprintEquals(a, b) {
-  if (a.length !== b.length) return false;
-  let diff = 0;
-  for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];
-  return diff === 0;
+  return constantTimeEquals(a, b);
 }
 async function generateConnectionURI(cid, pk, relayUrl) {
   if (cid.length !== CID_LEN) {
@@ -925,7 +988,7 @@ async function parseConnectionURI(uri) {
   }
   if (params.has("channelId") || params.has("pubKey")) {
     throw new Error(
-      "qrUri: legacy v1 URI detected \u2014 this wallet and this dApp must both run protocol v2"
+      "qrUri: legacy v1 URI detected - this wallet and this dApp must both run protocol v2"
     );
   }
   const q = params.get("q");
@@ -941,7 +1004,7 @@ async function parseConnectionURI(uri) {
   }
   if (blob.length !== BLOB_LEN) {
     if (blob.length === 1208 && startsWith(blob, PQP1_MAGIC)) {
-      throw new Error("qrUri: legacy PQP1 URI detected \u2014 regenerate the QR with a v2.0+ dApp SDK");
+      throw new Error("qrUri: legacy PQP1 URI detected - regenerate the QR with a v2.0+ dApp SDK");
     }
     throw new Error(`qrUri: expected ${BLOB_LEN}-byte blob, got ${blob.length}`);
   }
@@ -950,8 +1013,8 @@ async function parseConnectionURI(uri) {
   }
   const cid = blob.slice(4, 4 + CID_LEN);
   const fp = blob.slice(4 + CID_LEN, 4 + CID_LEN + FP_LEN);
-  const relayUrl = params.get("r") || void 0;
-  return { cid, fp, relayUrl };
+  const r = params.get("r");
+  return { cid, fp, relayUrl: r === null || r === "" ? void 0 : r };
 }
 function cidToString(cid) {
   if (cid.length !== CID_LEN) {
@@ -959,7 +1022,7 @@ function cidToString(cid) {
   }
   let hex = "";
   for (let i = 0; i < CID_LEN; i++) {
-    hex += cid[i].toString(16).padStart(2, "0");
+    hex += (cid[i] ?? 0).toString(16).padStart(2, "0");
   }
   return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
 }
@@ -975,15 +1038,79 @@ function cidFromString(s) {
   return out;
 }
 function cidRandom() {
-  const c = globalThis.crypto;
-  if (!c || typeof c.getRandomValues !== "function") {
-    throw new Error("qrUri: crypto.getRandomValues is not available");
-  }
-  return c.getRandomValues(new Uint8Array(CID_LEN));
+  return randomBytes(CID_LEN);
 }
 
 // src/ConnectionManager.ts
 var DAPP_PARTICIPANT_CONFLICT_ERROR_MSG = "dapp participant is already connected";
+function isRecord(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function isStringArray(v) {
+  return Array.isArray(v) && v.every((x) => typeof x === "string");
+}
+function isRelayMessage(v) {
+  return isRecord(v) && typeof v.id === "string" && (v.clientType === "dapp" || v.clientType === "wallet") && "message" in v && (typeof v.message === "string" || typeof v.message === "object" && v.message !== null);
+}
+var MESSAGE_TYPE_BY_VALUE = Object.fromEntries(
+  Object.values(MessageType).map((m) => [m, m])
+);
+function parseJsonRpcResponse(msg) {
+  if (typeof msg.id !== "string" && typeof msg.id !== "number") return null;
+  const out = {
+    jsonrpc: typeof msg.jsonrpc === "string" ? msg.jsonrpc : "2.0",
+    id: msg.id
+  };
+  if ("result" in msg) out.result = msg.result;
+  if (msg.error !== void 0) {
+    if (!isRecord(msg.error) || typeof msg.error.message !== "string") return null;
+    out.error = {
+      code: typeof msg.error.code === "number" ? msg.error.code : -32e3,
+      message: msg.error.message,
+      data: msg.error.data
+    };
+  }
+  return out;
+}
+function parsePersistedKex(v) {
+  if (!isRecord(v)) return null;
+  const { cid, kAeadRaw, htx, sendDir, recvDir, sendSeq, recvSeq } = v;
+  if (typeof cid !== "string" || typeof kAeadRaw !== "string" || typeof htx !== "string" || typeof sendDir !== "string" || typeof recvDir !== "string" || typeof sendSeq !== "number" || !Number.isInteger(sendSeq) || sendSeq < 0 || typeof recvSeq !== "number" || !Number.isInteger(recvSeq) || recvSeq < 0) {
+    return null;
+  }
+  return { cid, kAeadRaw, htx, sendDir, recvDir, sendSeq, recvSeq };
+}
+function parseDAppMetadata(v) {
+  if (!isRecord(v) || typeof v.name !== "string" || typeof v.url !== "string") return null;
+  const meta = { name: v.name, url: v.url };
+  if (typeof v.icon === "string") meta.icon = v.icon;
+  if (typeof v.redirectUrl === "string") meta.redirectUrl = v.redirectUrl;
+  return meta;
+}
+function parseStoredSession(raw) {
+  let v;
+  try {
+    v = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (!isRecord(v) || v.version !== 3) return null;
+  if (typeof v.channelId !== "string" || typeof v.chainId !== "string") return null;
+  if (typeof v.createdAt !== "number" || typeof v.lastActivity !== "number") return null;
+  const keyExchange = parsePersistedKex(v.keyExchange);
+  const dappMetadata = parseDAppMetadata(v.dappMetadata);
+  if (!keyExchange || !dappMetadata || !isStringArray(v.connectedAccounts)) return null;
+  return {
+    version: 3,
+    channelId: v.channelId,
+    keyExchange,
+    dappMetadata,
+    connectedAccounts: v.connectedAccounts,
+    chainId: v.chainId,
+    createdAt: v.createdAt,
+    lastActivity: v.lastActivity
+  };
+}
 var TERMINATE_SEND_TIMEOUT_MS = 800;
 var _ConnectionManager = class _ConnectionManager extends import_eventemitter33.default {
   constructor(options) {
@@ -997,10 +1124,11 @@ var _ConnectionManager = class _ConnectionManager extends import_eventemitter33.
     this.walletPresent = false;
     this.pendingRestore = null;
     this.messageQueue = Promise.resolve();
+    this.outboundQueue = Promise.resolve();
     this.dappMetadata = options.dappMetadata;
-    this.relayUrl = options.relayUrl || DEFAULT_RELAY_URL;
-    this.chainId = options.chainId || "0x0";
-    this.storageKey = options.storageKey || `${STORAGE_KEY_PREFIX}:session`;
+    this.relayUrl = options.relayUrl ?? DEFAULT_RELAY_URL;
+    this.chainId = options.chainId ?? "0x0";
+    this.storageKey = options.storageKey ?? `${STORAGE_KEY_PREFIX}:session`;
     const stored = this.readStoredSession();
     if (stored) {
       this.channelId = stored.channelId;
@@ -1010,7 +1138,7 @@ var _ConnectionManager = class _ConnectionManager extends import_eventemitter33.
       this.pendingRestore = stored;
       log("ConnectionManager", `Found persisted session for channel ${this.channelId}`);
     } else {
-      this.channelId = (0, import_uuid.v4)();
+      this.channelId = randomUuid();
     }
     this.socketClient = new SocketClient(this.relayUrl, "dapp");
     this.setupSocketListeners();
@@ -1122,7 +1250,7 @@ var _ConnectionManager = class _ConnectionManager extends import_eventemitter33.
       this.setupKeyExchangeListeners();
     }
     const pk = this.keyExchange.initiate();
-    this.channelId = (0, import_uuid.v4)();
+    this.channelId = randomUuid();
     this.socketClient.setPublicKey(toBase64(pk));
     this.socketClient.connect();
     try {
@@ -1133,7 +1261,7 @@ var _ConnectionManager = class _ConnectionManager extends import_eventemitter33.
           "ConnectionManager",
           "Channel already has an active dApp participant. Rotating to a fresh channel."
         );
-        this.channelId = (0, import_uuid.v4)();
+        this.channelId = randomUuid();
         return this.getConnectionURI(false);
       }
       this.setStatus("disconnected" /* DISCONNECTED */);
@@ -1303,8 +1431,8 @@ var _ConnectionManager = class _ConnectionManager extends import_eventemitter33.
     try {
       const raw = localStorage.getItem(this.storageKey);
       if (!raw) return false;
-      const session = JSON.parse(raw);
-      if (session.version !== 2) return false;
+      const session = parseStoredSession(raw);
+      if (!session) return false;
       return Date.now() - session.createdAt <= SESSION_TTL_MS;
     } catch {
       return false;
@@ -1319,8 +1447,7 @@ var _ConnectionManager = class _ConnectionManager extends import_eventemitter33.
    */
   async flushTerminate() {
     if (!this.keyExchange?.areKeysExchanged()) return;
-    const send = this.sendEncrypted({ type: "terminate" /* TERMINATE */ }).catch(() => {
-    });
+    const send = this.sendEncrypted({ type: "terminate" /* TERMINATE */ }).catch(() => void 0);
     const timeout = new Promise((resolve) => setTimeout(resolve, TERMINATE_SEND_TIMEOUT_MS));
     await Promise.race([send, timeout]);
   }
@@ -1339,7 +1466,7 @@ var _ConnectionManager = class _ConnectionManager extends import_eventemitter33.
     this.clearSession();
     this.connectedAccounts = [];
     this.pendingRestore = null;
-    this.channelId = (0, import_uuid.v4)();
+    this.channelId = randomUuid();
     this.keyExchange = null;
     this.socketClient = new SocketClient(this.relayUrl, "dapp");
     this.setupSocketListeners();
@@ -1360,7 +1487,13 @@ var _ConnectionManager = class _ConnectionManager extends import_eventemitter33.
   }
   // ── Internals ──────────────────────────────────────────────
   enqueueRelayMessage(data) {
-    this.messageQueue = this.messageQueue.then(() => this.handleRelayMessage(data)).catch((err) => error("ConnectionManager", "messageQueue handler error:", err));
+    if (!isRelayMessage(data)) {
+      warn("ConnectionManager", "Dropping malformed relay envelope");
+      return;
+    }
+    this.messageQueue = this.messageQueue.then(() => this.handleRelayMessage(data)).catch((err) => {
+      error("ConnectionManager", "messageQueue handler error:", err);
+    });
   }
   async handleRelayMessage(data) {
     if (data.clientType === "wallet") {
@@ -1372,22 +1505,35 @@ var _ConnectionManager = class _ConnectionManager extends import_eventemitter33.
       }
     }
     const message = data.message;
-    if (typeof message === "object" && message !== null) {
-      const msg = message;
-      if (msg.type === "key_handshake_SYNACK" /* SYNACK */) {
-        await this.handleSynAck(message);
+    if (isRecord(message)) {
+      if (message.type === "key_handshake_SYNACK" /* SYNACK */) {
+        if (typeof message.ct === "string" && typeof message.c0 === "string") {
+          await this.handleSynAck({
+            type: "key_handshake_SYNACK" /* SYNACK */,
+            ct: message.ct,
+            c0: message.c0,
+            v: typeof message.v === "number" ? message.v : 0
+          });
+        } else {
+          warn("ConnectionManager", "Dropping malformed SYNACK");
+        }
         return;
       }
-      if (msg.type === "key_handshake_SYN" /* SYN */ || msg.type === "key_handshake_ACK" /* ACK */) {
-        warn("ConnectionManager", `Unexpected ${msg.type} on dApp side \u2014 ignoring`);
+      if (message.type === "key_handshake_SYN" /* SYN */ || message.type === "key_handshake_ACK" /* ACK */) {
+        warn("ConnectionManager", `Unexpected ${message.type} on dApp side, ignoring`);
         return;
       }
     }
     if (typeof message === "string" && this.keyExchange?.areKeysExchanged()) {
       try {
         const decrypted = await this.keyExchange.decryptMessage(message);
+        await this.persistSession();
         const parsed = JSON.parse(decrypted);
-        this.handleDecryptedMessage(parsed);
+        if (isRecord(parsed)) {
+          this.handleDecryptedMessage(parsed);
+        } else {
+          warn("ConnectionManager", "Dropping non-object decrypted payload");
+        }
       } catch (err) {
         error("ConnectionManager", "Failed to decrypt message:", err);
       }
@@ -1407,16 +1553,21 @@ var _ConnectionManager = class _ConnectionManager extends import_eventemitter33.
     }
     if (response) {
       this.sendPlaintext(response);
+      return;
+    }
+    const cachedAck = this.keyExchange.getLastAck();
+    if (this.keyExchange.areKeysExchanged() && cachedAck) {
+      log("ConnectionManager", "Duplicate SYNACK after handshake; re-sending cached ACK");
+      this.sendPlaintext(cachedAck);
     }
   }
   handleDecryptedMessage(msg) {
     this.clearUnresponsiveTimer();
-    const type = msg.type;
-    switch (type) {
+    const type = typeof msg.type === "string" ? msg.type : "";
+    switch (MESSAGE_TYPE_BY_VALUE[type]) {
       case "wallet_info" /* WALLET_INFO */: {
-        const info = msg;
-        const nextAccounts = info.accounts || [];
-        const nextChainId = info.chainId || this.chainId;
+        const nextAccounts = isStringArray(msg.accounts) ? msg.accounts : [];
+        const nextChainId = typeof msg.chainId === "string" && msg.chainId ? msg.chainId : this.chainId;
         const accountsChanged = !this.areArraysEqual(this.connectedAccounts, nextAccounts);
         const chainChanged = this.chainId !== nextChainId;
         this.connectedAccounts = nextAccounts;
@@ -1431,7 +1582,11 @@ var _ConnectionManager = class _ConnectionManager extends import_eventemitter33.
         break;
       }
       case "jsonrpc" /* JSONRPC */: {
-        const response = msg;
+        const response = parseJsonRpcResponse(msg);
+        if (!response) {
+          warn("ConnectionManager", "Dropping malformed JSON-RPC response");
+          break;
+        }
         this.emit("jsonrpc_response", response);
         break;
       }
@@ -1453,11 +1608,28 @@ var _ConnectionManager = class _ConnectionManager extends import_eventemitter33.
       error("ConnectionManager", "Failed to send plaintext:", err);
     });
   }
-  async sendEncrypted(message) {
+  /**
+   * Serialize every encrypt+persist+send on a single outbound queue.
+   * Callers like sendJsonRpc() are fire-and-forget, so without the queue two
+   * rapid provider.request() calls would interleave inside encryptMessage()
+   * across its await and could complete out of order; the receiver's
+   * contiguous-seq check would then drop the late one. (Nonce reuse itself is
+   * already prevented by the synchronous seq reservation in KeyExchange.)
+   */
+  sendEncrypted(message) {
+    const task = this.outboundQueue.then(() => this.sendEncryptedNow(message));
+    this.outboundQueue = task.then(
+      () => void 0,
+      () => void 0
+    );
+    return task;
+  }
+  async sendEncryptedNow(message) {
     if (!this.keyExchange?.areKeysExchanged()) {
       throw new Error("sendEncrypted: not connected");
     }
     const encrypted = await this.keyExchange.encryptMessage(JSON.stringify(message));
+    await this.persistSession();
     await this.socketClient.sendMessage({
       id: this.channelId,
       clientType: "dapp",
@@ -1498,7 +1670,7 @@ var _ConnectionManager = class _ConnectionManager extends import_eventemitter33.
     const persistedKex = await this.keyExchange.exportPersisted();
     if (!persistedKex) return;
     const session = {
-      version: 2,
+      version: 3,
       channelId: this.channelId,
       keyExchange: persistedKex,
       dappMetadata: this.dappMetadata,
@@ -1518,13 +1690,13 @@ var _ConnectionManager = class _ConnectionManager extends import_eventemitter33.
     try {
       const raw = localStorage.getItem(this.storageKey);
       if (!raw) return null;
-      const session = JSON.parse(raw);
-      if (session.version !== 2) {
-        log("ConnectionManager", "Dropping legacy (pre-v2) session from storage");
+      const session = parseStoredSession(raw);
+      if (!session) {
+        log("ConnectionManager", "Dropping legacy or malformed session from storage");
         localStorage.removeItem(this.storageKey);
         return null;
       }
-      if (!session.createdAt || Date.now() - session.createdAt > SESSION_TTL_MS) {
+      if (Date.now() - session.createdAt > SESSION_TTL_MS) {
         localStorage.removeItem(this.storageKey);
         return null;
       }
@@ -1554,22 +1726,13 @@ function getAppStoreUrl() {
 }
 
 // src/QRLConnectProvider.ts
-var requestCounter = 0;
 var QRL_CONNECT_PROVIDER_INFO = {
-  name: "MyQRLWallet (Mobile)",
+  name: "MyQRLWallet",
   rdns: "com.qrlwallet.connect",
   icon: "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAMAAAADACAYAAABS3GwHAAAAAXNSR0IArs4c6QAAH1dJREFUeF7tnXt8XGWZ+L/PmaT3JpOkrVCKgD9wFcELwgoLArIsWnDLCnIVgZ8gF1lcylVsk5xMKuXiiiKLn7L82OWiK1ZBtgpdFRDdAu4P1EVAuaNoQbrNTJJek5nzbN+TpE0nk8yZmTMzZybv/AXNe3ue9/me9/a8zyvYn9XAJNaATGLZrehWA1gArBFMag1YACZ191vhLQDWBia1BiwAk7r7rfAWAGsDk1oDFoBJ3f1WeAuAtYFJrQELwKTufiu8BcDawKTWwKQEQF0cwGGtPQjMtv6ngA8m8ViJJ6D1TsekAEDZZugu01MeHxLlIBXmi7A7ymwxKNjfdg1ohkEV3sDhj+LxG8fhN7M7eVGkPmGodwBEXRp7MpwdE7pUZBYwq96FDpHnLQqbFF2dXsf5c29hY72NCnVrC6+6TGvxOA6HK1TlQyNGUbcCh2j1I0WNnv8IbFH0+kbhG7Nc3ixDdVUpsi7tQRXp66TDE7lSYEZVNFuPlQoZ9XhePF0UX8bL9SBi3QHwxtXMnTqFOx2Rj6J2kRu6kZq1gOqrHpzV0sWaWp8S1RUA6tLQq6wAOdvf5bG/smlAlDcyaT2m9RqeKVslFSi4bgDQk4gl38VpTkzutF/+CliOX4X+clD427kuaytVY9j11A0AvS4f8zx5QMROe8I2knHLM5MhR7/a4nJpxeoMuaK6AEBdZvSqfBPhePv1D9lC8hSnqhlxeGfc5ZXK1hxObXUBwLp2PhgTecQRZoejFltKYA0IKqqrmoQTxSUdOF9EEtY8AGbLM9nJchG5quaFiYhRFNoMsyBOD+rRbct5rtC81U5f8zbzrMuU3TxeR2RetZU5WetXYTOefqolwX21poOaB6CvnUM8kTXYxW9VbU887WzuJlHVRhRRec0D0NPOGXbrs4ieDz2LfqvZ5Yxac5qreQCS7ZwtMbnd7v6EbtEFFegvhLs43gJQkNpKT5zswEWks+ZJLl0VVSvBOM2J6oPNXRxnAahwN6RclqnKEgtAhRU/XN0Oj1H9SdzlGAtAhfsh1cEyRJaEXW2WK3DYxVesvOwrXWF/KCwAFevK3BWVGYC1Ar9WYSvKXwD7hm1A5VafwgaUx0Ukqei7BPYL01FwBAAR/XFzJx+1I0C5ezSr/LIBoDyVdvSCQXhu17UM9s5jgcbkq8Ci2oFAN6ny8fQWnpwzg409MF/SnOU0SHdYmwYWgAobfHZ1ZQFAzf1XvTCeMK7VO34plwNB/hNlapXFDlS94+llTd18ZXRic3Le6/I0iBkJSv7ZKVDJKiytgLIAAF7G0/e2dfPsTsZzHo2pXUiJSPRvmQnqoIc1uTyWreFkB3eKyKdL0/xQbjsChKHFEsooFwADm3S3eTeMvfua7GCDiMwsockVyaqKxlQPberm8Ryj5i2IXBhGQ+wIEIYWSyijXAA0bNLdZlUAAH8PvQT5x82qaMbRw9pyjAA9nXzDQS4Io1oLQBhaLKGMcgFQiRFg2Hg8M48QQ4HxZwrrHvMEAKQ6+QYWAN/qyvLxKcGeC85aLgDKPgIMXS7/sQ5yVXwKT/dvpcVr5DOKXI3QUnLHWAAC2VLJeg5USxkT9Q6fBIdchVdOAPwvv2r/xkH2WrCc9SNtNwNBbwfLNYy7DRaAQCZRDwAkPJX2kAUpPwDo3S1djNmJSbmcLCp3KEwL1IPjJao0AKI/jtuDsJK6rKjMPS6fc5Cbzf52iBCUDYBRi8abW7q4OFvoZDtHSExWmbilRSlkx3Ay7iI4zDXAqOp+EHdZZE+CS+q1wjMnl7IIR75vFpAWgFH6q9AIsL1G1RXNCS6stUBZIdpM4cYbRo7XFzN99mzWqMgHQhSmeiNAgiPEq60RQJWNip7SmuCHYfRpJcsI0WYq2eyd61rfznsckTUiNIfUCm9wUBfMvYY3xkxRQjgIG5oGae4pkMuRgvx7yVMgQTPkPgcIdQpk9rJEvxnv4sxa+/rXxTaob0oraOz9E2ci0sFQ3P9SwfYym3WPtuv5Y6UBSLkchcr9Jox7KTAbyDzRQ3MdhKU6uBWRz5ZSvn9ioWz20LtFuKrFJVVSeVXKXKqhVKnZY6s1r75sgDkDyhUxOA+V4heRDt5AWt89bxkv5likGleIkn2BxNGbm10+n13+epePxVRWopTmbmF8gWJ6WFPHWFeIpMud4skZJXReWhx9IOOxYn2Sh/f5OltLKKuqWesGgGwtbn8GCfhpQBUfCby0nljbDKa1XkdvrmxJl3jqNbbsuSfpoOWOLsfUQS+NNG9btLtsyq7jyfNofHsDU+euY4D34BVahyn/uWdx5s5lytwj2Swnk8mu49WzmbZnC/LURtL984O//OK33Zye1mAArPFMoG4BCGjzNtkk14AFYJIbwGQX3wIw2S1gkstvAZjkBjDZxa9bAMyDGX9cwJQFG0lTwEJvshvEePI/tRZpGyC25wGofL52d32y5atbAPpdTsio3BFmBAQLh7kCqa+0dLF/veiibgFIuZwLcmsIh2L10tchyaFes9AoLl5IBVa1mLoFINnOHeLImVXVbn1W7pHWD8W/xJP1IF5dAvCIS8P7lZcFeXs9dFKUZFDjAuHpP8QT3FyLvj91vwbwb1W5nIgn37FvBoSPztAlfn1gQDhlnsuG8GuobIl1NwKoy7Skx68dERPK0P7Ko4GUJ/rhVre23wg2qqk7AFJL+aTE5K6SrxSWx3DqotThUeC7zeb6ppkS1fCvrgDQi5na28IqRP6mhvsk8k33LV7QtKfHz0nwg1peC9QVAKkOrlGRq+tKqAjiMOqT/9y0Rj12+lJ+H8FmBmpSXdiKv/Bt5xxicovqtj3qQKLbRKVoYCSol6Dfbe7i1FodBWreVozx9yzhEKdRvo2ye10ubEqx1HLnFVRVv7RZWD4/x/2Gcldfavk1D8CGL/LegUZWjez517xApfZoNfKbB0TQpc0u/1hrI0FN24u5DB8TVqrIu+2XvxqWP6rO4TcVkg537OWypcqtCVx9rQIgqaW8Q2PyXYT3GX+fWhUkcE/VQEJVMg66uOm33CIrx17FjKIINWk3PVfR7EzjRypykDX+aJmVwFtk9LCmZbxUC9OhmgPALHqTnSxzRK6wOz7RMv7trRFe1y16eMu1vBbRFo5qatRbmNW+1BIOpIHHFWmw8/4Id57oyuZd+ZScz2CEW1lbrhD9LvMGPX4mw34+NTd8RdkSwm6bkgQ9KZ7gobCLDrO8mrEhf+rTwRdFJGFuedVMw8PsrVorS/VXzQk+GOW1QM3YUZ/LnLTKzwXMY8/2VwsaGLo7cGFzglujCkFN2JL5+qdcFm8Ld2gOWuyvhjSg8OtG0YWz3LEvbkZBjJqwp3VXMnvKdHpGFr5RUJxtQ34NDL+AuQXVM+IJvpc/R+VT1AQAyXYucWLyFfMKTOVVZGssRQPDdwe+3exyehTvDkTeoNRlSm+Ge3Dk70rpCJu3ihpQtPlNnSq3Rm9LNPIA9Lrs7XnyIxH2qmIX2qpL0YDxGPX0spYEN5ZSTDnyRh6AVAd/DfIfKsQi39hy9FC9lKm8Ek/o/4maOJG3qWQnX0fkIuvzEzXTCd6e4cszPekBPWTucl4InrP8KSMPQE8nv3WQd5VfFWNrGHPbW1GzkFPV14FnUNZFbmEnzBy+GHSAiDSqICObB9Xq7GE9blTVk1oTPFiNvhyvzmrpJJAO3rycmVNn0C9SHW/nkW08NUG2RB9FuL95Xx7iuW0hMjuHoyFETYMj1HYhSdhPMhxNTBahvBthrlRrJ01RD726JcH1UToUi1r3jQZDejr4uIPcX5UAV+b1Q/QnONzcAE/MdnkrELURTGRiJa3P8L6Yw+miXKQisZFmVswABBXVrzUJl0UprmjF5C/ULvyL7h2ciyMrKh3gVmGTI7q8B768p8vWKH2xCtXj6PTDwQMOwOFuVfmLkB8Xz9s0z9PVr/yZRQdGaDs00gCkOvmyiCyuKADK8+roF+Iu99eL4WdbZu9S9vEa+GdUjjB/q5QRqOqj8d34myi5SFdK9rxfh+wEZuHW67LaD3JVuXnrgIge0eTyi3o1/hE9+weMHj/FkYONrithCIo+E5dt3qEuAwUbRJkyVELuopruA9DFGlQOKaqAAjMppDSjn2pdxgP5spp7CZkBFiA4NOZLXdm/Dw7C1Eb6XofX3pPH0JIue6KsBDmwEoag6Np4G++I0gszlZC7KAsYHgEeAzm4qAIKyTR0UrksnqBzvC+/eXc4leZwhHYceYfAjAqOTIVIgwqDqvqWeNwbb+BLEy06e5ZwmBPjUUScgiopIrGqbo47tEqEokZEHAB5DCgrAMNbnS9s3qof3TXHHVazcOxbyt6eQyeIceiKrM6yFrx+/E5zZiHC4rjLfbng9l3NO7gBkcvKLpio9vcyc/cb2VwEP2XJUnaZi2310AhQGQDU04tbu7k5V1t7ExzkZbhdkP2KlaVa+bYf5Cn9it7csh/tuV6O37yMPbYMysOAGdnK97MABNdtpQBA9c1mh91yTRP8ub7Hz6iPtwYGRPXSpi5uyT69Ni9q9u7LTYp8rqy7QhaAiAFgDmc87WpKkMieHqx1mTE9wz0Sk+OiOtcPrs3tez9vOsL+TS7/k53XvKugMVlpAShcq2XJUaERwMuoHtuW4D+yhTCLQ2mQ+2Hboq0sElahUEE9T29rSXB+NvDrL6bJaZNUWV0l7AgQvNMrAYAqr3uqC9u6eTarZdLTzhXiyHV1Y/wjAopmnK28rWk563daNJs1VydrEdkleC8VmFJV+/vtIjiQ1ioBAPDSgOjCeS4vZRtDXxf/piqnBGpsLSUy0760Htu8jNVZu0YGgJsRubBsUz47AgS3lAoB8AKiC+Mur+xkDC5OUlkjyMF1NwIYQVU/mX1J3d/u7SShIkssAMHttGwpKwTA7zZv1YXZ+//+oZfHHxHZtZyLwnyvy5UNPtUL4glWZI8AqXYSErMAlM2oCym4EgAI/NbbqsdmB3E1APR6rFWRt4UJwIjBi/rz7w0qJEVGHQoN+Ty1qjllhl0E/PinYf881c+1JviGBaByjoAF92HVAVD+pAwtCIv9Eo/+woswiKc/8Rzubsjwe1F6BgdZ23ItfduVsxIn9d8saHRoGoixv6PmPjQnINIc5rTEArDDHIvt24INutAM9QCAcUXwlM2oPtrQyOLZS3mhkCuUfjzUq2hypnM1npwHNCFsv8xSqE5H0lsALAC+BiacApU6AhiHNE8fUFixPsnD+3zdvKNV/K/vat6pU/i0Il+gxKmRBcACUF4AhpzQuuNvsExuJW32XYo3/R05zdqkP80+Xsy4bMs7ii3TAmABKB8Awp8yGU20dvPP5bhU43tvtvNeiXEXxkGviMtCFgALQLkASKvoOXG4eyIffGPE27vAjA1d/v830MngyF/ywbPRZf6gmscnCg8ZYwGwAJQDgC2qem1Lgq6JpiappeylDoc7wpGKHOXH8Bm5iuL5M6XfAQ9kMtzb18gvJ3pytH8p7047sgrBj7gWdEfDAmABCB0AFb0j3sn/HW+XR29iamqd71/0KYG9TajHcacv5mEJpVdV18QGuXz2cp7PeZnFnFekOUEdvkMBwZMsABaAsAH4Q0x04WyX57K//mY7N/kFdpdp3CciHyh4zq4kM+j5rb/l3lxv75ry+1xu90TOCurJaQGwAIQHwNAzQFc3jxPxzGxfelO4B+T9xeza+JMipX+bA09nPMFXc40EySXsITF5hIARtC0AFoDQAPAjHXSxIJdhPusyZb7HE/6Xv8jfdvcJYat6+tl4YtsCO2tb1Xdk6+CfPJELg6wDLAAWgFAA8C/Ue3pVvJvrs+3bxDWdPoP/p1K6S/WOu736cibDEXO+xJ+y6+t1+UtP5fEgL2haACwAoQAAvInocXGXX2YbZMrlKFTMu1jxIj/+O2XbMRLoyrjLyWPWGkMerK8gske+UcACYAEIC4BfDogeNy/HC4gpl9tQOScM49+5DPViwvtmuzyTXXayg8WIfMUCEFzr+XQVvKSQU9aCM5yn+mCLw8dzHXqlOiSF0ByyWoZi/Xi6rCVBR3bZ61zmN6qMmR5lp7MjgB0BSh4BzJTEQ5e1ddGebWAblnJM2pHVZQvrLnLPuvXeWdkOdn4kC+XPgsyaCDwLgAUgFABQPbMlYXxydvz8EORLuZIGWV7wnn+e4WLUjtAvnK16XPbF9hcvZurcVn6uyEETDe0WAAtAyQCYAjzVM1oTfDMbgGQnNznD75qFOQUa5VL6pDl4y47voytoTK31PUWPNvWOB4EFwAJQVgBSndxUrof9hiHICcDwucMDiJibZBaAAF8fuwge705wgAsxonpGc44RoKedy5yYXF/Gly2fdHKMAGYKNKeV/8wX7tyOAHYEKHkEGHJR0EuzH3/2T2XbOcUT+Va5niASYVUTeqq4bBr9kXt9MdNnN5kQLxMHt7IAWABKBsC3f/T7LV18InukNY/S9apsNKeyAUbhwpIM3Tb7WryLS7NdIt5ymdXoSV++EO4WAAtAKACI8POB6Xrc3KuMs9rOv2Qn3xPkhMKsO39qAU88PbypmzVj6mznbBz5l3zzWguABSAUAIA/eKLHteY4le1p51REbhdh+kQL0vwmvyOFmXY56GMvvsGRuV5aTHbwMxH5cL4yLQAWgLAAwPP0tNZuvp1tdH1X05ZulB+K8KHQAFDdOOjxgXnLeDG7vrVX8fYZ0+TVINMuC4AFIDwAVH/RkuCQXO7Q2165PFg9+b4Kb8s3Lcn31QbSil4bfw4318WYVAdLcKQ7yOGbBcACEBoAZiWcUT21rZvvjFkMD/npm6nQvypMCWDkOyXZfvJr5v2ijzfBUbmeGO2/mrmZKWKiPR8QpA4LgAUgPAD8kvTphkGOmXUNfx4DwdB7vGepSIfAgiAG6pc4klDNS/V6+5ZNXLHLlzE7S9mQSLKDC0TEvHHmBBlpLAAWgJABwNOMuvFlLBvv8npSWRBD/k2FQyaapuwcQUs3Ocq5TXO4d7y3dde77BvzeEpFpgVda1gALAChAjB8b/fPafS0OQl+OsFbww19cLLncYkgB+SK8+nfMlPWgd7uDHLD7OX0jFden8ucTIZ7cOSokS61I0DQMXYoXRB9FVZiSKlr4T7AaFGHIViP6okt3Tw6kRp6Xfb2PB4Wkd1zTGnw3RzgR/mCa6U6+S7IopFYoUE7044AdgQIdQQYbcQCj2U8vaC127+xNW5M0GQn3YIszQbA5E+LLmxzR4VNz0qUWk6LbuVGQc40H4pCv2QWAAtA2QAYXsD+QVQvb3a2nQa7eLlGg94OLtKhhevOi1qPR+IxXSQuG3Lkk75raPW28E8qcmKxD2hYACwAZQVgWL0DqLpbNnFTrt2bng4ucnIAgMfDAzE9fl4WACYy9AY4POPJahWmFvrVHw2TBcACUAkA/Pu7qC5t7mJ59kJ2XADg4QEZC4A5Wc40ym8QSn63zAJgAagYAIJ2N7m4JQPgMsdTed68IVbqPoMFwAJQMQAUTcRdukICwESObrMAlKoBC0DlADAvxXSFNgJYAMKz/REbCLnEkIqrtXOAnGKbNQB6XbPLF0sdAYy/T3qKvCTmobwSf3YKZEeA0EYAcz3LcVjleST9qP4yfLg49F8iyg/iORzlCl0Er7uS2Y1TuV6FmX5IIvMz9Snq3zmI8WGQ+dYbtLCvQ9DDw8JKDSF1TYwAQlLRS+Kd3DXRmXouV4ZCARiy93FqUehtZ091+JGI7J1P/XYEsCNAKCOAonfG2zhvPEe1iQyx0HOAfEZt/v7WUvaZEhNzAj2h67UFwAIQCgC5wqIEMVSTZlwAlIcGHP277IOwIOWqy5Q+5SFFDpsovQXAAhAKAI7qlU0JbghinNlp+jq5wUMuz/53VZ7C0aNbXFKFlvuqy7QW5Tcw8TTIAmABCAUA4L/Mqe1c1wSkDfYYtpnHr1/C/IZGeRQdet1xp5+Sdhz9xGyXH5p/D1LuyNqgbwlLvJgkbFiU4J8OuwgeLzKcx1oVeduwEY6vUdUHcfhXzC6QQybt5V6oNjioCpoZpKXR4RKdIHqDSSeqyx3hcY+h4Fe5yjVl+ovjNLNo4EjgErMnlK9T7QhgR4DtI8CmrXrsrtfy2mgLN45nvUEBGCIkox6bRHJ7fvpl+zdd/G3LmQiNeb9R/hkCW/AYGHeHyZwyDN2DnGoc5IK6RlsALABDGlCex9OF8WWYcCLbfwaAlPIyyJ55R4C8lhytBP67Bp6e09bN7TvJDJJqJyExWRLkLKEoqUS1v5eZu9/I5qLylyFTvtGyDFUGK7IS5wDAS7JVFzZfy0ujW+W6OJ/P8KA4ckxkFRRMjTulGrmdo6qLWhOsygagr5OEShkBUNX+fgtAoK6rCADKy+LpwuasQFNmUZnq5DZBPhOosTWSyAfArC8yelC8m6fGjAAd3CWOnG5HgAh0aEUAEPodRxc2dYyNs5layieJiXn8ouB4PhFQ35gm7LibqU/HXd4vQ2uMHdM+RXpdkiDhv2s2UoudAgU3jQoBoJ6nn25J8K3s7cZ1VzK/cbo8BLwreKujndJsLXlbObR1OU+Mcc5rZ3/HkafLKoEFILh6KwGA/wn09OF4gqPHfBHNW18dfEaRFSLEgrc8milNVGkVXfkrOOMjLunsVvZ2cLGK3FTW1lsAgqu3EgAMtyatg3pQyzX8Ort1eh6NqV1YIkhH2V58DK6SklKq0hNz9NAmF3OnYKffepemmHIPyMdKqiRfZgtAPg1lz0nlMeDg4LmKS6mqqzb0c0qu7bk3L2fmtFl0qifnOg7xkb324mqqfC6BAU91TczjwqZlmCuVY37JJRwuDfIgMKOsLbQABFdvBUeAbcEb/MXwyc0uJsDsmJ9ezNRknL8Uh0tRFokjYtoX6S1Sc+SGvuDAP+JwX/aLkiNCGtl6W3gakXcG750iU1oAgiuukgAMtUqfHhAOncgL0/e5uYEZPX2c1ugwLwP7IGV4Bim4mnZOaRoorBN4LZPhv1ti23a3XHSCUI1Tkhm+5sTk/LJtfY5uoQUgeM9WHACzP47++6atfHbX5SY25/i/nS6mjBv7LbisoaUcNSTlc6LzH/Pr4HQVuYUQrlkGksECEEhNQ99jf1+6MmuAnVrl6bc3xThnftYLjMFbHv2U3zmJ2DHv4SPq+TfIKjeTswAEN45qAeD7rIneoxmua+nmV8FbXDspezr8MO6LRaS8i95slVgAghtJtQDwW+g/Rcobnqrb2sVt2WcEwaWITkpfn0v5IDHuVJF9io0rWpJEFoDg6qsqACPN9KM86P9XjxUNaZ6YNXXbI9QuW4NLUeWUCskvsHtsOvuqcqIipwvMGPLMrsLPAhBc6ZEAYEdzzcnpWoW3QJ8R5QmHsaepwaUrX8rtoagd9lI4DJVdBXYDP5xKdX8WgOD6jxgA2xtupkNR2vjJpdFR74sV/HZA8B4qIqUFILjSogpAcAmqm7Jq05yJxLYABDcKC0BwXdVMSgtA8K7yAejkMUTK7gsUvFU2ZSkaUHRTXGgTly2llBNm3qpsBgQRwACQ7OSnMUc+XGsOaEHkm5xp9JV1Pey7z9ejs5MWXQCGriV+VUQuroifyuS0yIpKLaJrmnblI3I+gxWteILKIg1Abwfn4sgKC0BUzKW0dgj6gybhE5LjQk5pJRefO7IAGJFSSziQmPxXrV9GKb576iinf7qu3XHzXFTWfeRqShlpAIzHYrKDPzgiC6qpJFt3KBrYguoZ8QT3TvR+cig1FVBIpAEwciQ7uVFE/sFOgwro1YglHYrfSDLj6F/NyXEls5rNjTwAPe0cKo6sFphVTUXZuovXwBAAel9LghOKL6U8OSMPQP81zM1skfsRDimPCmyp5daACplG9IBZLuUNu1KEIJEHwMjU4/L3DnKTnQYV0cNRyKJ6T3MXp0Vp8TuilpoAQG9iau96ngTZLwr9adsQXAMKKRE9Me7ycPBclUtZEwAYdaxfwsFOTB4UIV459diaStKA2e709PaX3uTCA2+NzuHXaJlqBgB1aUjBF0Wl04TEL6ljbOaya2DIbVyfUTi8mOeeyt7A4QpqBgB/LXAVzTKVR8SR99v1QKVMpLh6VPl9rFE/2tSeOxhXcaWGn6umADDi97vMS3vcjshx5v9rToDw+zB6Jaqm1eOk+POskpVkotfAHS2qSfvZ4LLLoCercXivmBfZ7S9CGtD/QTil2eWRfLGJotDomjWedS7zG5TlIJ8cHdOyZgWKgjWU0gb//TN93vM4z0SkE3eC99JKqSfkvDVtL4+4NLzPY7Eg1/nL4qjH6wy58yJTnDF91bviczlPPh8dX/8g+qlpAEYE7GlnfxEWI3K8QGsQwW2aEDSgbFb0CXW4bf16vheliy5BpasLAIyw+hWm9/Wx27aAVuercpEg00bcqEeiJNSNsEF7txzphp56VRH9oedxIw6/irv01sJ8P5c66s4m/MC159GQmsup0sCxiOyB0qZKswgzUaZplCI6l8NIQyhTzLQGBkT8J01Tah7sVv29Oqz20jzU1s3voujaUKjodQdAtgKSLnFJ00YDzQqzxGNqxqv9J48K7eiC0zvoFIetXobNoqQGlU2tL7A26tuahcpZ9wBMoJDJLHsQO4l6/K8gMuRNY40gr4psgnrWgAWgnnvXypZXAxaAvCqyCepZAxaAeu5dK1teDVgA8qrIJqhnDVgA6rl3rWx5NfC/zGV/wHfd+nEAAAAASUVORK5CYII="
 };
 var EIP6963_ANNOUNCE_EVENT = "eip6963:announceProvider";
 var EIP6963_REQUEST_EVENT = "eip6963:requestProvider";
-function generateUuid() {
-  if (typeof globalThis !== "undefined" && globalThis.crypto?.randomUUID) {
-    return globalThis.crypto.randomUUID();
-  }
-  const r = (n) => Math.floor(Math.random() * n);
-  const hex = (n, len) => n.toString(16).padStart(len, "0");
-  return `${hex(r(4294967296), 8)}-${hex(r(65536), 4)}-${hex(16384 | r(4096), 4)}-${hex(32768 | r(16384), 4)}-${hex(r(4294967296), 8)}${hex(r(65536), 4)}`;
-}
 var QRLConnectProvider = class extends import_eventemitter34.default {
   constructor(options) {
     super();
@@ -1578,6 +1741,12 @@ var QRLConnectProvider = class extends import_eventemitter34.default {
     this.eip6963RequestListener = null;
     this.resumeListener = null;
     this.resumeDebounce = null;
+    // Random per-instance prefix keeps request ids unique across page loads.
+    // A bare counter restarts at 1 on reload, and the relay buffers messages
+    // for 5 minutes, so a stale buffered response could otherwise be matched
+    // to a fresh request that drew the same small id.
+    this.requestIdPrefix = randomUuid().slice(0, 8);
+    this.requestCounter = 0;
     this.isQRLConnect = true;
     this.options = options;
     if (options.debug) {
@@ -1591,7 +1760,7 @@ var QRLConnectProvider = class extends import_eventemitter34.default {
     });
     this.setupConnectionListeners();
     if (options.autoReconnect !== false) {
-      this.connectionManager.reconnect();
+      void this.connectionManager.reconnect();
     }
     this.setupResumeListeners();
     if (options.announceProvider !== false) {
@@ -1605,7 +1774,7 @@ var QRLConnectProvider = class extends import_eventemitter34.default {
     const overrides = this.options.providerInfo ?? {};
     this.eip6963Detail = Object.freeze({
       info: Object.freeze({
-        uuid: generateUuid(),
+        uuid: randomUuid(),
         name: overrides.name ?? QRL_CONNECT_PROVIDER_INFO.name,
         icon: overrides.icon ?? QRL_CONNECT_PROVIDER_INFO.icon,
         rdns: overrides.rdns ?? QRL_CONNECT_PROVIDER_INFO.rdns
@@ -1758,7 +1927,7 @@ var QRLConnectProvider = class extends import_eventemitter34.default {
     if (this.connectionManager.getStatus() !== "connected" /* CONNECTED */) {
       throw new Error("Not connected to QRL Wallet");
     }
-    const id = ++requestCounter;
+    const id = `${this.requestIdPrefix}-${++this.requestCounter}`;
     return new Promise((resolve, reject) => {
       const pending = {
         id,
@@ -1839,7 +2008,7 @@ var QRLConnectProvider = class extends import_eventemitter34.default {
   /**
    * Disconnect from wallet and clean up. Returns once the TERMINATE has
    * either been flushed to the relay or the 800ms best-effort window has
-   * elapsed — the wallet gets an instant disconnect instead of landing in
+   * elapsed - the wallet gets an instant disconnect instead of landing in
    * its stale-session grace period.
    */
   async disconnect() {
@@ -1859,9 +2028,6 @@ var SCHEME_TAG_MSG = new TextEncoder().encode(SCHEME_VERSION_MSG);
 var SCHEME_TAG_TYPED = new TextEncoder().encode(SCHEME_VERSION_TYPED);
 var DIGEST_LEN = 64;
 
-// src/signing/messageDigest.ts
-var import_sha3 = require("@noble/hashes/sha3.js");
-
 // src/signing/bytes.ts
 function hexToBytes(hex) {
   if (typeof hex !== "string") throw new Error("hex must be a string");
@@ -1903,12 +2069,14 @@ function computeMessageDigest(messageBytes) {
   if (!(messageBytes instanceof Uint8Array)) {
     throw new Error("messageBytes must be a Uint8Array");
   }
-  return (0, import_sha3.shake256)(concatBytes(SCHEME_TAG_MSG, messageBytes), { dkLen: DIGEST_LEN });
+  return shake256Digest(concatBytes(SCHEME_TAG_MSG, messageBytes), DIGEST_LEN);
 }
 
 // src/signing/typedData.ts
-var import_sha32 = require("@noble/hashes/sha3.js");
 var SLOT = 32;
+function isMessageObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
 var ATOMIC_RE = /^(?:(address|bool|string|bytes)|(u?int)(\d+)|bytes(\d+)|(.+?)\[(\d*)\])$/;
 var MAX_TYPE_DEPTH = 12;
 function parseFieldType(type, types, depth = 0) {
@@ -1919,7 +2087,9 @@ function parseFieldType(type, types, depth = 0) {
   const m = ATOMIC_RE.exec(type);
   if (!m) throw new Error(`unknown type: ${type}`);
   const [, atomic, intKind, intWidthStr, bytesWidthStr, innerType, sizeStr] = m;
-  if (atomic) return { kind: atomic };
+  if (atomic === "address" || atomic === "bool" || atomic === "string" || atomic === "bytes") {
+    return { kind: atomic };
+  }
   if (intKind) {
     const width = Number(intWidthStr);
     if (!Number.isInteger(width) || width < 8 || width > 256 || width % 8 !== 0) {
@@ -1936,11 +2106,14 @@ function parseFieldType(type, types, depth = 0) {
   }
   if (innerType !== void 0) {
     parseFieldType(innerType, types, depth + 1);
-    const size = sizeStr ? Number(sizeStr) : void 0;
-    if (sizeStr && (!Number.isInteger(size) || size <= 0)) {
-      throw new Error(`invalid array size: ${type}`);
+    if (sizeStr) {
+      const size = Number(sizeStr);
+      if (!Number.isInteger(size) || size <= 0) {
+        throw new Error(`invalid array size: ${type}`);
+      }
+      return { kind: "array", inner: innerType, size };
     }
-    return { kind: "array", inner: innerType, size };
+    return { kind: "array", inner: innerType };
   }
   throw new Error(`unhandled type: ${type}`);
 }
@@ -1958,7 +2131,9 @@ function collectDependencies(primary, types) {
     }
     if (visited.has(name)) return;
     visited.add(name);
-    for (const f of types[name]) {
+    const def = types[name];
+    if (!def) throw new Error(`unknown type: ${name}`);
+    for (const f of def) {
       const base = baseTypeName(f.type);
       if (Object.prototype.hasOwnProperty.call(types, base)) {
         visit(base, [...path, name]);
@@ -1971,7 +2146,8 @@ function collectDependencies(primary, types) {
 }
 function validateTypeMap(types) {
   for (const [name, def] of Object.entries(types)) {
-    if (!Array.isArray(def) || def.length === 0) {
+    const defUnknown = def;
+    if (!Array.isArray(defUnknown) || def.length === 0) {
       throw new Error(`empty or invalid struct: ${name}`);
     }
     const seen = /* @__PURE__ */ new Set();
@@ -1994,16 +2170,17 @@ function encodeType(primary, types) {
   const others = [...deps].filter((n) => n !== primary).sort();
   return [primary, ...others].map((name) => {
     const fields = types[name];
+    if (!fields) throw new Error(`unknown type: ${name}`);
     const inner = fields.map((f) => `${f.type} ${f.name}`).join(",");
     return `${name}(${inner})`;
   }).join("");
 }
 function typeHash(primary, types) {
-  return (0, import_sha32.shake256)(new TextEncoder().encode(encodeType(primary, types)), { dkLen: DIGEST_LEN });
+  return shake256Digest(new TextEncoder().encode(encodeType(primary, types)), DIGEST_LEN);
 }
 function parseQAddress(addr) {
   if (typeof addr !== "string" || !/^Q[0-9a-fA-F]{40}$/.test(addr)) {
-    throw new Error(`invalid Q-address: ${String(addr)}`);
+    throw new Error(`invalid Q-address: ${addr}`);
   }
   return hexToBytes("0x" + addr.slice(1).toLowerCase());
 }
@@ -2065,7 +2242,7 @@ function encodeField(type, value, types) {
   const parsed = parseFieldType(type, types);
   switch (parsed.kind) {
     case "ref":
-      if (value === null || typeof value !== "object" || Array.isArray(value)) {
+      if (!isMessageObject(value)) {
         throw new Error(`struct field expects object: ${type}`);
       }
       return hashStruct(parsed.name, value, types);
@@ -2083,12 +2260,12 @@ function encodeField(type, value, types) {
       if (typeof value !== "string") {
         throw new Error(`string field expects string: ${typeof value}`);
       }
-      return (0, import_sha32.shake256)(new TextEncoder().encode(value), { dkLen: DIGEST_LEN });
+      return shake256Digest(new TextEncoder().encode(value), DIGEST_LEN);
     case "bytes":
       if (typeof value !== "string") {
         throw new Error(`bytes field expects 0x-hex string: ${typeof value}`);
       }
-      return (0, import_sha32.shake256)(hexToBytes(value), { dkLen: DIGEST_LEN });
+      return shake256Digest(hexToBytes(value), DIGEST_LEN);
     case "uintN":
       return bigIntToSlot(parseIntValue(value, `uint${parsed.width}`), parsed.width, false);
     case "intN":
@@ -2111,7 +2288,7 @@ function encodeField(type, value, types) {
         throw new Error(`fixed array ${type} requires length ${parsed.size}, got ${value.length}`);
       }
       const chunks = value.map((v) => encodeField(parsed.inner, v, types));
-      return (0, import_sha32.shake256)(concatBytesArr(chunks), { dkLen: DIGEST_LEN });
+      return shake256Digest(concatBytesArr(chunks), DIGEST_LEN);
     }
   }
 }
@@ -2127,7 +2304,7 @@ function hashStruct(primary, data, types) {
     if (!(f.name in data)) throw new Error(`missing field ${primary}.${f.name}`);
     parts.push(encodeField(f.type, data[f.name], types));
   }
-  return (0, import_sha32.shake256)(concatBytesArr(parts), { dkLen: DIGEST_LEN });
+  return shake256Digest(concatBytesArr(parts), DIGEST_LEN);
 }
 var RESERVED_DOMAIN_FIELDS = {
   name: "string",
@@ -2172,11 +2349,10 @@ function computeTypedDataDigest(payload) {
   validatePayloadReachability(payload.primaryType, payload.types);
   const domainHash = hashStruct("QRLDomain", payload.domain, payload.types);
   const messageHash = hashStruct(payload.primaryType, payload.message, payload.types);
-  return (0, import_sha32.shake256)(concatBytes(SCHEME_TAG_TYPED, domainHash, messageHash), { dkLen: DIGEST_LEN });
+  return shake256Digest(concatBytes(SCHEME_TAG_TYPED, domainHash, messageHash), DIGEST_LEN);
 }
 
 // src/signing/verify.ts
-var mldsa = __toESM(require("@theqrl/mldsa87"));
 function bytesOrHex(v) {
   if (v instanceof Uint8Array) return v;
   if (typeof v === "string") return hexToBytes(v);
@@ -2192,7 +2368,7 @@ function verifyMessage({
     const pk = bytesOrHex(publicKey);
     const msg = bytesOrHex(messageBytes);
     const digest = computeMessageDigest(msg);
-    return mldsa.cryptoSignVerify(sig, digest, pk, SCHEME_TAG_MSG);
+    return mldsaVerify(sig, digest, pk, SCHEME_TAG_MSG);
   } catch {
     return false;
   }
@@ -2202,7 +2378,7 @@ function verifyTypedData({ signature, publicKey, payload }) {
     const sig = bytesOrHex(signature);
     const pk = bytesOrHex(publicKey);
     const digest = computeTypedDataDigest(payload);
-    return mldsa.cryptoSignVerify(sig, digest, pk, SCHEME_TAG_TYPED);
+    return mldsaVerify(sig, digest, pk, SCHEME_TAG_TYPED);
   } catch {
     return false;
   }