@qrlwallet/connect 5.1.1 → 5.1.2

package/README.md

@@ -286,6 +286,9 @@ npm run dev
 # Type-check
 npm run typecheck
 
+# Type-check tests
+npm run typecheck:test
+
 # Unit tests (vitest)
 npm test
 
@@ -296,6 +299,8 @@ npm run lint
 node test-e2e.mjs
 ```
 
+CI runs `node scripts/audit-gate.mjs` after the SDK install and `node scripts/audit-gate.mjs --dir ui` after the UI install; both read `audit-allowlist.json` at the repository root. The gate blocks high and critical production advisories unless a matching, dated exception in `audit-allowlist.json` explains why the advisory cannot reach users.
+
 ## Running the example dApp
 
 The `example/` directory contains a Vite test dApp with QR code generation, transaction sending, message signing, and read-only RPC calls.

package/dist/index.js

@@ -121,7 +121,8 @@ var import_ml_kem = require("@noble/post-quantum/ml-kem.js");
 var import_sha3 = require("@noble/hashes/sha3.js");
 var mldsa = __toESM(require("@theqrl/mldsa87"));
 function webCrypto() {
-  const c = globalThis.crypto;
+  const environment = globalThis;
+  const c = environment.crypto;
   if (!c) {
     throw new Error("crypto: WebCrypto is not available in this environment");
   }
@@ -641,7 +642,8 @@ var KeyExchange = class extends import_eventemitter3.default {
     this.lastAck = null;
     this.isOriginator = isOriginator;
     if (restored) {
-      if (restored.protocolVersion !== PROTOCOL_VERSION) {
+      const protocolVersion = restored.protocolVersion;
+      if (protocolVersion !== PROTOCOL_VERSION) {
         throw new Error("KeyExchange: cannot restore a pre-v3 session");
       }
       this.session = snapshotSession(restored);
@@ -975,7 +977,8 @@ var KeyExchange = class extends import_eventemitter3.default {
   }
   /** Rehydrate a Session from its persisted form. */
   static async sessionFromPersisted(p) {
-    if (p.protocolVersion !== PROTOCOL_VERSION) {
+    const protocolVersion = p.protocolVersion;
+    if (protocolVersion !== PROTOCOL_VERSION) {
       throw new Error("KeyExchange: cannot hydrate a pre-v3 session");
     }
     const kAeadRaw = fromBase64Exact(p.kAeadRaw, 32, "persisted AEAD key");
@@ -1553,7 +1556,12 @@ function startsWith(buf, prefix) {
   }
   return true;
 }
-async function parseConnectionURI(uri) {
+function parseConnectionURI(uri) {
+  return new Promise((resolve) => {
+    resolve(parseURI(uri));
+  });
+}
+function parseURI(uri) {
   if (typeof uri !== "string" || uri.length === 0) {
     throw new Error("qrUri: empty URI");
   }
@@ -1598,7 +1606,7 @@ async function parseConnectionURI(uri) {
     blob = base45Decode(q);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    throw new Error(`qrUri: base45 decode failed: ${msg}`);
+    throw new Error(`qrUri: base45 decode failed: ${msg}`, { cause: err });
   }
   try {
     if (blob.length !== BLOB_LEN) {
@@ -1671,7 +1679,8 @@ function getBrowserStorage() {
 function getBrowserLockManager() {
   try {
     if (typeof navigator === "undefined") return null;
-    return navigator.locks ?? null;
+    const browserNavigator = navigator;
+    return browserNavigator.locks ?? null;
   } catch {
     return null;
   }
@@ -2012,7 +2021,8 @@ var _ConnectionManager = class _ConnectionManager extends import_eventemitter33.
     });
     socketClient.on("participants_changed", (data) => {
       if (!isCurrentSocket()) return;
-      if (data.clientType !== "wallet") return;
+      const clientType = data.clientType;
+      if (clientType !== "wallet") return;
       if (data.event === "join" && data.clientType === "wallet") {
         this.walletPresent = true;
         log("ConnectionManager", "Wallet joined channel");
@@ -2179,7 +2189,8 @@ var _ConnectionManager = class _ConnectionManager extends import_eventemitter33.
       log("ConnectionManager", `Generated v3 connection URI for channel ${context.channelId}`);
       return uri;
     } catch (err) {
-      if (context ? this.isSessionWorkCurrent(context) : this.keyExchange !== null) {
+      const keyExchange = this.keyExchange;
+      if (context ? this.isSessionWorkCurrent(context) : keyExchange !== null) {
         this.invalidateSessionWork();
         this.keyExchange = null;
         this.socketClient.leaveChannel();
@@ -3001,7 +3012,7 @@ var _ConnectionManager = class _ConnectionManager extends import_eventemitter33.
     const persistedKex = await context.keyExchange.exportPersisted();
     if (!persistedKex) throw new Error("Cannot export established AEAD session");
     this.assertSessionWorkCurrent(context);
-    if (!this.sessionOwnership?.isOwned()) {
+    if (!this.sessionOwnership.isOwned()) {
       throw new Error("Browser-tab ownership changed while persisting AEAD counters");
     }
     const session = {
@@ -3020,7 +3031,7 @@ var _ConnectionManager = class _ConnectionManager extends import_eventemitter33.
       this.persistenceBroken = true;
       this.removeStoredSession();
       error("ConnectionManager", "Failed to persist AEAD counters:", err);
-      throw new Error("Failed to persist AEAD counters");
+      throw new Error("Failed to persist AEAD counters", { cause: err });
     }
   }
   readStoredSession() {
@@ -3702,7 +3713,8 @@ function canonicalChainId2(value) {
   return `0x${BigInt(value).toString(16)}`;
 }
 function requestedSwitchChainId(params) {
-  if (params?.length !== 1) {
+  const parameterCount = params?.length;
+  if (parameterCount !== 1) {
     throw new Error("wallet_switchQrlChain requires one chain configuration object");
   }
   const request = params?.[0];
@@ -3768,7 +3780,7 @@ function snapshotRequestParams(params) {
     return snapshot;
   } catch (error2) {
     const detail = error2 instanceof Error ? error2.message : String(error2);
-    throw new Error(`Request params must be JSON-serializable: ${detail}`);
+    throw new Error(`Request params must be JSON-serializable: ${detail}`, { cause: error2 });
   }
 }
 function validateRestrictedRequest(method, params, authorizedAccounts, currentChainId) {

package/dist/index.mjs

@@ -12,7 +12,8 @@ import { ml_kem768 } from "@noble/post-quantum/ml-kem.js";
 import { shake256 } from "@noble/hashes/sha3.js";
 import * as mldsa from "@theqrl/mldsa87";
 function webCrypto() {
-  const c = globalThis.crypto;
+  const environment = globalThis;
+  const c = environment.crypto;
   if (!c) {
     throw new Error("crypto: WebCrypto is not available in this environment");
   }
@@ -532,7 +533,8 @@ var KeyExchange = class extends EventEmitter {
     this.lastAck = null;
     this.isOriginator = isOriginator;
     if (restored) {
-      if (restored.protocolVersion !== PROTOCOL_VERSION) {
+      const protocolVersion = restored.protocolVersion;
+      if (protocolVersion !== PROTOCOL_VERSION) {
         throw new Error("KeyExchange: cannot restore a pre-v3 session");
       }
       this.session = snapshotSession(restored);
@@ -866,7 +868,8 @@ var KeyExchange = class extends EventEmitter {
   }
   /** Rehydrate a Session from its persisted form. */
   static async sessionFromPersisted(p) {
-    if (p.protocolVersion !== PROTOCOL_VERSION) {
+    const protocolVersion = p.protocolVersion;
+    if (protocolVersion !== PROTOCOL_VERSION) {
       throw new Error("KeyExchange: cannot hydrate a pre-v3 session");
     }
     const kAeadRaw = fromBase64Exact(p.kAeadRaw, 32, "persisted AEAD key");
@@ -1444,7 +1447,12 @@ function startsWith(buf, prefix) {
   }
   return true;
 }
-async function parseConnectionURI(uri) {
+function parseConnectionURI(uri) {
+  return new Promise((resolve) => {
+    resolve(parseURI(uri));
+  });
+}
+function parseURI(uri) {
   if (typeof uri !== "string" || uri.length === 0) {
     throw new Error("qrUri: empty URI");
   }
@@ -1489,7 +1497,7 @@ async function parseConnectionURI(uri) {
     blob = base45Decode(q);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    throw new Error(`qrUri: base45 decode failed: ${msg}`);
+    throw new Error(`qrUri: base45 decode failed: ${msg}`, { cause: err });
   }
   try {
     if (blob.length !== BLOB_LEN) {
@@ -1562,7 +1570,8 @@ function getBrowserStorage() {
 function getBrowserLockManager() {
   try {
     if (typeof navigator === "undefined") return null;
-    return navigator.locks ?? null;
+    const browserNavigator = navigator;
+    return browserNavigator.locks ?? null;
   } catch {
     return null;
   }
@@ -1903,7 +1912,8 @@ var _ConnectionManager = class _ConnectionManager extends EventEmitter3 {
     });
     socketClient.on("participants_changed", (data) => {
       if (!isCurrentSocket()) return;
-      if (data.clientType !== "wallet") return;
+      const clientType = data.clientType;
+      if (clientType !== "wallet") return;
       if (data.event === "join" && data.clientType === "wallet") {
         this.walletPresent = true;
         log("ConnectionManager", "Wallet joined channel");
@@ -2070,7 +2080,8 @@ var _ConnectionManager = class _ConnectionManager extends EventEmitter3 {
       log("ConnectionManager", `Generated v3 connection URI for channel ${context.channelId}`);
       return uri;
     } catch (err) {
-      if (context ? this.isSessionWorkCurrent(context) : this.keyExchange !== null) {
+      const keyExchange = this.keyExchange;
+      if (context ? this.isSessionWorkCurrent(context) : keyExchange !== null) {
         this.invalidateSessionWork();
         this.keyExchange = null;
         this.socketClient.leaveChannel();
@@ -2892,7 +2903,7 @@ var _ConnectionManager = class _ConnectionManager extends EventEmitter3 {
     const persistedKex = await context.keyExchange.exportPersisted();
     if (!persistedKex) throw new Error("Cannot export established AEAD session");
     this.assertSessionWorkCurrent(context);
-    if (!this.sessionOwnership?.isOwned()) {
+    if (!this.sessionOwnership.isOwned()) {
       throw new Error("Browser-tab ownership changed while persisting AEAD counters");
     }
     const session = {
@@ -2911,7 +2922,7 @@ var _ConnectionManager = class _ConnectionManager extends EventEmitter3 {
       this.persistenceBroken = true;
       this.removeStoredSession();
       error("ConnectionManager", "Failed to persist AEAD counters:", err);
-      throw new Error("Failed to persist AEAD counters");
+      throw new Error("Failed to persist AEAD counters", { cause: err });
     }
   }
   readStoredSession() {
@@ -3593,7 +3604,8 @@ function canonicalChainId2(value) {
   return `0x${BigInt(value).toString(16)}`;
 }
 function requestedSwitchChainId(params) {
-  if (params?.length !== 1) {
+  const parameterCount = params?.length;
+  if (parameterCount !== 1) {
     throw new Error("wallet_switchQrlChain requires one chain configuration object");
   }
   const request = params?.[0];
@@ -3659,7 +3671,7 @@ function snapshotRequestParams(params) {
     return snapshot;
   } catch (error2) {
     const detail = error2 instanceof Error ? error2.message : String(error2);
-    throw new Error(`Request params must be JSON-serializable: ${detail}`);
+    throw new Error(`Request params must be JSON-serializable: ${detail}`, { cause: error2 });
   }
 }
 function validateRestrictedRequest(method, params, authorizedAccounts, currentChainId) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qrlwallet/connect",
-  "version": "5.1.1",
+  "version": "5.1.2",
   "packageManager": "npm@10.9.8",
   "description": "Connect your dApp to QRL Wallet via QR code or deep link",
   "main": "dist/index.js",
@@ -13,16 +13,19 @@
   "scripts": {
     "build": "tsup src/index.ts --format cjs,esm --dts --clean",
     "dev": "tsup src/index.ts --format cjs,esm --dts --watch",
-    "typecheck": "tsc --noEmit",
+    "typecheck": "tsc --noEmit && npm run typecheck:test",
+    "typecheck:test": "tsc --noEmit -p tsconfig.eslint.json",
     "test": "vitest run",
     "test:watch": "vitest",
-    "lint": "eslint src/ test/ --ext .ts",
-    "lint:fix": "eslint src/ test/ --ext .ts --fix",
+    "lint": "eslint --config eslint.config.mjs src test scripts \"*.mjs\" vitest.config.ts --report-unused-disable-directives --max-warnings 0",
+    "lint:fix": "eslint --config eslint.config.mjs src test scripts \"*.mjs\" vitest.config.ts --report-unused-disable-directives --max-warnings 0 --fix",
     "format": "prettier --write src/",
     "format:check": "prettier --check src/",
     "size": "size-limit",
     "size:check": "size-limit --highlight-less",
-    "prepublishOnly": "npm run lint && npm run typecheck && npm test && npm run build"
+    "prepublishOnly": "npm run lint && npm run typecheck && npm test && npm run build",
+    "lint:ratchet": "node scripts/lint-ratchet.mjs --check",
+    "lint:ratchet:update": "node scripts/lint-ratchet.mjs"
   },
   "keywords": [
     "qrl",
@@ -49,13 +52,15 @@
     "socket.io-client": "^4.8.1"
   },
   "devDependencies": {
+    "@eslint/js": "^10.0.1",
     "@size-limit/file": "^11.0.0",
     "@theqrl/wallet.js": "^6.3.0",
     "@types/node": "^25.3.3",
     "@typescript-eslint/eslint-plugin": "^8.0.0",
     "@typescript-eslint/parser": "^8.0.0",
-    "eslint": "^8.57.0",
+    "eslint": "^10.12.0",
     "eslint-config-prettier": "^9.1.0",
+    "globals": "^17.13.0",
     "prettier": "^3.4.0",
     "size-limit": "^11.0.0",
     "tsup": "^8.4.0",