Ports the Falcon-1024 scheme support onto the refactored layout:
isEd25519Scheme and the scheme-aware signer encoding in arc60Wire,
SIGN_DATA_VERIFICATION_UNSUPPORTED in signArc60Data, the scheme field
on the models, and the version bump to 1.9.0. Its tests move into the
corresponding *.spec.ts files.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUJASfdAAc5HNUZoEkPjAd

e2e/ bundles dist/ into a small Vite dApp, the way an integrator's
bundler would, and drives it in Chromium with all external traffic
stubbed or dropped: the modal elements and legacy globals register, the
version shows in the header, the rendered QR decodes back to the
WalletConnect pairing URI, closing the modal rejects
CONNECT_MODAL_CLOSED, and the extension connect runs inside a real user
gesture (the stub refuses without navigator.userActivation).

Runs as its own CI job (pnpm test:e2e) and uploads traces on failure.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUJASfdAAc5HNUZoEkPjAd

src/__integration__ drives the SDK only through its entry point, with
the real modal elements, storage and algosdk keys, and fakes only the
outside world: a WalletConnect v1 client modelled on the real one, a
Pera Mobile that scans the rendered QR and signs with a real key, a
window.pera extension that only connects inside a user click, and the
config/algod endpoints. Covers connect (QR, extension, modal closed),
reconnect after reload, signing (toast, redirect modal, transaction
match, TransactionSigner), signData/ARC-60 verification, wallet-side
disconnect, empty signatures and disconnect.

Vitest now runs unit and integration as two projects
(pnpm test:unit / test:integration); coverage over both is gated at
95% lines/functions/statements and 90% branches. Known-wrong behaviour
found on the way is recorded as it.todo.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUJASfdAAc5HNUZoEkPjAd

Behavioural unit tests for every modal custom element (attribute wiring,
conditional views, the extension option event, close and download
actions) and for the gaps in util/ and transport/: the Pera Web
new-tab flows, the webview bridge, deep links, the signed-transaction
match check, ARC-60 signer resolution and the extension provider.
Third-party renderers (qr-code-styling, Lottie) are faked at the module
boundary; everything else runs for real.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUJASfdAAc5HNUZoEkPjAd

Bumps [github.com/getkin/kin-openapi](https://github.com/getkin/kin-openapi) from 0.144.0 to 0.149.0.
- [Release notes](https://github.com/getkin/kin-openapi/releases)
- [Commits](https://github.com/getkin/kin-openapi/compare/v0.144.0...v0.149.0)

---
updated-dependencies:
- dependency-name: github.com/getkin/kin-openapi
  dependency-version: 0.149.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUJASfdAAc5HNUZoEkPjAd

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUJASfdAAc5HNUZoEkPjAd

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUJASfdAAc5HNUZoEkPjAd

Two edges found in review of the refactor:

- signData and ARC-60 authenticatorData encoded through algosdk's
  bytesToBase64, which turns an ArrayBuffer into an empty string in
  browsers. Plain-JS dApps that pass ArrayBuffers, number arrays or
  strings now get the encoding the global Buffer gave them before.
- Unparseable wallet details in localStorage made reconnectSession()
  fail inside its own cleanup and leave the entry behind. It now clears
  the storage and rejects with SESSION_RECONNECT.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUJASfdAAc5HNUZoEkPjAd

docs: fix migration guide links in README and JSDoc typos

Unitless letter-spacing is invalid CSS. The old pipeline passed it
through and browsers dropped it; Vite's CSS minifier reads it as px, so
spell that out. Also stop shipping declaration maps, which point at
sources the package does not include.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUJASfdAAc5HNUZoEkPjAd

- CI / Pre-Merge runs lint, type-aware lint, format, typecheck, tests
  with an 80% coverage gate, the build and publint/attw, plus a lockfile
  drift check, pnpm audit and the gitleaks history scan.
- Release / Publish repeats those gates before publishing, and scans the
  built bundle.
- Workflow files follow the ci-/security-/release- naming; actions move
  to the same pinned SHAs as pera-react-native.
- Dependabot groups updates by risk, keeps @types/node on the runtime's
  major and holds pnpm/action-setup at v5.
- Hooks: commit-msg enforces Conventional Commits, pre-push runs lint,
  format check and typecheck; pnpm run setup:hooks enables them (the
  repo's ignore-scripts means install alone does not).
- CLAUDE.md, a rewritten CONTRIBUTING.md, a PR template and
  .git-blame-ignore-revs for the formatting commit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUJASfdAAc5HNUZoEkPjAd

The emitted .d.ts files imported each other without extensions, which
TypeScript projects on moduleResolution node16/nodenext cannot resolve
(arethetypeswrong: InternalResolutionError, present since 1.x). Relative
imports now carry .js, and oxlint's import/extensions keeps it that way;
check:package (publint + attw) guards the result in CI.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUJASfdAAc5HNUZoEkPjAd

Applies the comment rules from pera-react-native: drop JSDoc that repeats
signatures, banners, file narration and commented-out code; keep
rationale, traps and units. Comment-only apart from two fixes found on
the way:

- webviewBridge removed its message listener with a fresh bind(), so
  the removal never matched; it now keeps one bound handler.
- The window.pera provider docs sat on PeraAccount in the published
  types; they now document PeraProvider.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUJASfdAAc5HNUZoEkPjAd

- Drop the sign-txn modal and its open/close helpers; nothing has
  mounted it since Pera Web signing moved to a new tab.
- Drop detectPlatform/isMobileMethodAvailable from the webview bridge
  (unused) and waitForElementCreatedAtShadowDOM, whose observer never
  re-queried the shadow root.
- fetcher rejects on an HTTP error status instead of parsing the error
  body as config; getPeraConnectConfig is typed and still never rejects.
- Shared appendTemplateWithStyles for the modal components.
- Remove ESLint directives left behind by the toolchain move, the
  triple-slash reference and banner comments.
- Tests for the new modules (signature checks, signer slot mapping,
  event emitter, algod pool, font loader, vh variable).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUJASfdAAc5HNUZoEkPjAd

PeraWalletConnect.ts drops from ~1,350 to ~980 lines; the class keeps the
public surface and orchestration, and delegates to modules that can be
read and tested on their own:

- util/transaction/signedTransactionMatch: the check that the wallet
  returned the transactions that were asked for
- util/transaction/transactionSignerUtils: TransactionSigner slot mapping
- util/signature/signatureVerification: MX and ARC-60 signature checks
- util/arc60/arc60Signer: SIWA origin binding and signer resolution
- util/events/SessionEventEmitter: typed disconnect/networkChanged events
- util/algod: AlgodClientPool replaces AlgodManager and the unused
  provider-type indirection

Also:
- connect() and reconnectSession() no longer use async promise
  executors, so an unexpected throw can no longer leave the promise
  pending forever.
- MobileTransport shares one request path and types its connector from
  WalletConnect instead of any.
- Named exports only; no explicit any; no floating promises.
- PeraWalletConnectOptions and the event types are now exported.

No change to the public API or to wire behaviour; the existing suite
passes unchanged apart from following the moved internals.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUJASfdAAc5HNUZoEkPjAd