BUILD INSTRUCTIONS (the packaged JS is bundled with esbuild, so here is how to reproduce it exactly)

Environment: Node 22+, npm 10+. macOS or Linux.

1. Unpack the source archive and, from its root:
   npm install
2. Build the bundles:
   node build.mjs
   This runs esbuild and writes dist/background.js, dist/content.js,
   dist/inpage.js and dist/popup.js — the four files in the package.
3. Produce the packaged zip:
   node scripts/package.mjs
   The Firefox variant is written to store/qorex-firefox-0.2.4.zip. The script
   also verifies that every file the manifest references is present in the
   package.

The Firefox build differs from the Chrome one only in the manifest: it uses
background.scripts instead of a service worker, adds
browser_specific_settings.gecko, and drops the Chrome-only use_dynamic_url.

WHAT THIS VERSION CHANGES

The user-facing changes are in the release notes. Two points that may be
relevant to review:

1. The extension makes one new network request: GET
   https://api.qore.network/v1/price/QOR, to show the USD value of the user's
   balance. This is QoreChain's own endpoint, which fetches from the exchange
   server-side. The extension deliberately does NOT call any exchange directly,
   so no user IP reaches a third party. No user data is sent — the request
   carries only the symbol "QOR".
2. connectProof, used to link an account to the QoreChain dashboard, now lets
   the user choose which account is proved, in the extension's own approval
   window. The page requesting the link cannot choose.

No new permissions are requested in this version.

TESTING

The extension works without an account: install it, create a wallet with a
password, and the popup will show a balance (0 QOR for a fresh wallet) and the
USD value line once the price loads. No sign-in, no server account, no test
credentials are required.

Fixed — accounts
• The wallet now signs with the account you actually selected. Transfers, staking, handle claims and dashboard pairing previously used the first account regardless of which one was in use.
• Your selected account is remembered after the wallet locks and unlocks.
• A @handle now binds to the account you claim it from.
• The wallet refuses to sign if the key does not match the account shown.

Fixed — staking
• Claiming rewards from several validators no longer runs out of gas. A claim from six validators failed and still took the fee; a single-validator claim now costs less than before.
• Failures say what happened — "out of gas", not "something went wrong" — and say plainly that the fee was taken and nothing moved.

New
• Send and Stake show which account the QOR leaves from, and Stake lets you choose it.
• Revealing your recovery phrase now says it restores every one of your accounts.
• Firefox: the passkey option is hidden with an explanation, since Firefox does not allow passkeys inside extension pages. Your password still unlocks the wallet.
• More text translated across all ten languages.

Fixes staking approval from the QoreChain dashboard.

0.2.1 added everything needed to approve a staking request from the dashboard, but the page had no way to call it — the method existed inside the extension and was not exposed to websites. Pressing the button reported that the extension was out of date when it was not. This release exposes it.

Everything from 0.2.1 is included: the Stake screen in the popup with validators, staked total, rewards, delegate, unstake and claim; several accounts from one recovery phrase; and the build number at the bottom of the popup.

Staking, from the extension itself.

Until now a wallet created in this extension had no way to stake at all: a dashboard can put a delegation together but cannot sign it, because the post-quantum key never leaves your vault. The popup now has its own Stake screen — validators with their commission, how much you have staked, rewards waiting, and delegate, unstake and claim. Jailed validators are left out of the list rather than shown greyed: delegating to one is never what you want.

Several accounts from one recovery phrase. Create and switch between accounts in the same wallet; the phrase you already backed up restores every one of them. Switching moves everything with it — sending, staking, receiving and your @handle all follow the account you are on.

Approving from the QoreChain dashboard now covers staking too, not only sends. The request is checked here before anything is signed: it must be for this network, this address, and an action this version understands, and you always see the validator and the amount rather than a hash.

Claiming an @handle from the browser works now. It never did before — the registry did not answer the browser's preflight check, so the request stopped before it left. That was fixed on the server side, so it also applies to the version you already have.

The build number now appears at the bottom of the popup, so a bug report can say which version it came from.

Staking, from the extension itself.

Until now a wallet created in this extension had no way to stake at all: a dashboard can put a delegation together but cannot sign it, because the post-quantum key never leaves your vault. The popup now has its own Stake screen — validators with their commission, how much you have staked, rewards waiting, and delegate, unstake and claim. Jailed validators are left out of the list rather than shown greyed: delegating to one is never what you want.

Several accounts from one recovery phrase. Create and switch between accounts in the same wallet; the phrase you already backed up restores every one of them. Switching moves everything with it — sending, staking, receiving and your @handle all follow the account you are on.

Approving from the QoreChain dashboard now covers staking too, not only sends. The request is checked here before anything is signed: it must be for this network, this address, and a kind this version understands, and you always see the validator and the amount rather than a hash.

Claiming an @handle from the browser works now. It never did before — the registry did not answer the browser's preflight check, so the request stopped before it left. That was fixed on the server side, so this affects the extension you already have too.

Receive: the popup now has a Receive screen with your address and a QR code you can scan from a phone.

Send to an @handle: type @name instead of a 43-character address. The name is resolved through the QoreChain handle registry and the answer is verified against a signing key pinned in this build; the resulting address is always shown for confirmation before anything is signed, and if a handle points somewhere different from the last time you paid it, the wallet stops and shows both addresses.

Interface language: pick one of ten languages from the popup, or leave it to follow your browser.

Vesting accounts show available versus locked only — the unlock date has been removed.

0.1.8 — your language, and your @handle:
• QoreX now speaks ten languages and follows your browser automatically — Arabic, German, English, Spanish, French, Italian, Japanese, Korean, Romanian and Turkish. Arabic flips the layout, not just the words.
• Claim a @handle for your address straight from the popup, so people can send you QOR by name instead of a long address. A handle belongs to one address, and it resolves in the QoreX mobile apps too.
• Includes 0.1.7: your address and live balance on the popup home, with the unlocked-vs-vesting split for TGE accounts.

0.1.7 — your address and balance, at a glance:
• The popup home now shows your qor1… address (click to copy) and your live QOR balance.
• Vesting (TGE) accounts see the honest split: available now vs 🔒 still vesting, with the next unlock date.
• Includes 0.1.6: fixed signing for vesting accounts ("account sequence mismatch"), vesting-aware error messages, and a 10x lower one-time PQC registration fee (0.09 QOR).

0.1.6 — vesting account support & fair fees:
• Fixed transaction signing for vesting (TGE) accounts — resolves "account sequence mismatch, expected N, got 0" (the account parser now understands PeriodicVestingAccount and uses the flat account_info endpoint).
• When the network refuses a transfer of still-locked funds, the wallet now explains the vesting split (unlocked vs vesting, with the next unlock date) instead of a generic fee hint.
• 10x lower one-time PQC registration fee (0.09 QOR instead of 0.9), sized on measured mainnet gas usage.

0.1.5 — Passkey unlock + Solana Wallet Standard.

• Passkey unlock (WebAuthn PRF): enroll a hardware passkey as a second unlock factor for the vault, with the password always available as fallback. Note: Firefox does not expose WebAuthn to extension pages, so this option hides itself on Firefox — password unlock (Argon2id) is unchanged.
• Solana Wallet Standard: QoreX now appears in Solana dApps' wallet pickers. Connect, message signing and transaction signing all run behind explicit per-origin and per-transaction approvals, with decoded transaction previews (never blind-signing) and a clear classical-signature notice.
• QoreChain dApp signing (Keplr-pattern signDirect) unchanged: decoded SignDoc previews and the post-quantum layer check on every request.

No data collection — keys, vault and approvals stay on your device.

v0.1.3
- Fixed: the QoreX icon now appears in dApp wallet-connection dialogs (EIP-6963).
- Fixed: standard provider error codes (e.g. 4902 "unrecognized network") now
reach the dApp instead of being swallowed.
- Fixed: chain-suggestion requests from dApps are handled reliably; foreign
chains are rejected cleanly instead of failing silently later.
- Added: "Reveal recovery phrase" in the popup for manual backup — always
re-verifies your password before showing the phrase.
- Security & stability hardening across the approval/message bridge.

Non-custodial as always: your keys never leave your device.

QoreX 0.1.2

• Removed the unused "alarms" permission. The extension now requests a single permission: "storage" (your encrypted vault and per-site connection approvals). Nothing else changed for users.
• The wallet connects to QoreChain mainnet (qorechain-vladi) by default. Mainnet is publicly open, so dApp connections and signatures use the live network out of the box.
• No new features, no changes to data collection (none is collected).

QoreX 0.1.1
- The wallet now connects to QoreChain mainnet (qorechain-vladi) by default. Mainnet is publicly open, so dApp connections and signatures use the live network out of the box.
- Internal library updates for wallet recovery and account features. No new permissions, no changes to data collection (none is collected).