- Note v5.3.0+ for rekeyed accounts and v5.4.0+ for appSecret in the
  guide, README, Supported Wallets and Signing Data
- State which rekeyed accounts the passkey signs for, and that it can't
  sign as one key of a multisig
- Document what withAppSecret returns and its `failed` case when the
  session locks mid-request
- Say plainly that users can export a recovery phrase, and link the
  use-wallet-ui react-passkey and vue-passkey examples

- Note v5.3.0+ for rekeyed accounts and v5.4.0+ for appSecret in the
  guide, README, Supported Wallets and Signing Data
- State which rekeyed accounts the passkey signs for, and that it can't
  sign as one key of a multisig
- Document what withAppSecret returns and its `failed` case when the
  session locks mid-request
- Say plainly that users can export a recovery phrase, and link the
  use-wallet-ui react-passkey and vue-passkey examples

- deriveKey rejects an unknown derivationType with a RangeError instead of
  silently falling back to Khovratovich. This catches a leftover 1.x
  `metadata` argument that now binds to the 6th parameter in plain JS.
- Context-based methods (keyGen, signData, signAlgoTransaction, ECDH) reject
  keyIndex outside [0, 2^31), so a hardened-range value can no longer
  silently produce a hardened child while being documented as a soft one.
- Move FIRST_HARDENED_INDEX and MAX_INDEX_EXCLUSIVE to src/constants.ts,
  shared by bip32-ed25519 and x.hd.wallet.api.crypto instead of duplicated.
  The module is not re-exported from index, so the public API is unchanged.
- Tests cover both new RangeErrors and the README breaking changes mention
  the keyIndex/derivationType validation.

Follow-up to the previous commit, from review.

Derivation:
- harden() rejects levels outside [0, 2^31) with a RangeError, and
  deriveChildNodePrivate/deriveChildNodePublic reject indexes outside
  [0, 2^32) with a clear message instead of a RangeError from
  Buffer.writeUInt32LE deep inside the derivation. Tests cover both.

Build and test:
- tsconfig.json is build-only ("types": ["node"]); the jest types moved to
  a new tsconfig.spec.json, which the test scripts and ts-jest now use. The
  published build no longer needs @types/jest.
- "prepack" runs the build, so packing right after a test run can't ship
  the specs and src/test-utils that tests leave in dist.
- CI drops its redundant "Compile TypeScript" step; pnpm test already
  compiles (and type-checks) as its first step.

Docs and test helpers:
- README breaking changes now say that non-TX protocol payloads (MX,
  Program, ProgData, ...) must be signed with signData, that index misuse
  throws a RangeError, and which deep import path the exports map blocks.
- Comment why @parcel/watcher builds are denied, and why the test helper
  clamps the X25519 scalar (libsodium parity, not needed by noble).
- Keep the original failure as the cause of secretbox's "decryption failed".

No pnpm-lock.yaml change: a from-scratch resolve with pnpm 12.3.4 (what
pnpm/action-setup installs) is identical to the committed lockfile, and
pnpm install --frozen-lockfile leaves it untouched.

Fix audit 2026-11-12 findings (AW-2026-101..124)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

- /sign review reads amount, asset, receiver, app and keyreg details from the real transaction (shared TxReviewDetails)
- dApp fee ceiling/type allow-list apply to signers:[] entries; signatures forgotten on every request end path
- deleting an account needs the wallet password; last-account deletion is persisted
- payment QR uses link parsing and network confirmation; gateway time floor and host display
- node-parameter checks for library-built transactions; clipboard retry; locale guard hardening
- AW-2026-114 accepted by product owner

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

- Executive summary highlights findings from the audit covering the range f8a74a0..2073168.
- Identified 0 Critical, 1 High, 2 Medium, 9 Low, and 1 Informational new findings.
- Key findings include issues with multisig transaction visibility, incorrect labeling of key registrations, and security concerns with the ARC-56 registry container.
- Detailed recommendations provided for each finding to enhance security and user experience.
- Verification of unit tests, linting, and production build confirmed clean.
- Dependency review indicates an increase in advisories, with a total of 13 advisories noted.