Add uri to relay private key generation

Making private key deterministic allows for easy session restoration

.gitlab-ci.yml

@@ -50,9 +50,11 @@ test-integration:
 
 publish:
   extends: .node-common
-  # npm trusted publishing via GitLab OIDC — no NPM_TOKEN needed.
+  # npm trusted publishing via GitLab OIDC — requires instance runner for OIDC support.
   # Each @wizardconnect/* package must be linked to this GitLab project
   # on npmjs.com: package Settings > Publishing access > Trusted publishers.
+  tags:
+    - saas-linux-small-amd64 # force gitlab instance runner
   id_tokens:
     SIGSTORE_ID_TOKEN:
       aud: sigstore
@@ -85,6 +87,8 @@ pages:
 
 force-publish:
   extends: .node-common
+  tags:
+    - saas-linux-small-amd64 # force gitlab instance runners
   id_tokens:
     SIGSTORE_ID_TOKEN:
       aud: sigstore

packages/test-cli/src/wallet.ts

@@ -37,7 +37,7 @@ async function buildAdapter(
     walletName: "wiz-test CLI wallet",
     walletIcon: "",
 
-    getRelayPrivateKey(): Uint8Array {
+    getRelayPrivateKey(_uri: string): Uint8Array {
       return relayPrivateKey;
     },
 

packages/wallet/src/integration/helpers.ts

@@ -65,7 +65,7 @@ export function makeTestAdapter(seed?: Uint8Array): WalletAdapter {
     walletName: "Test Wallet",
     walletIcon: "",
 
-    getRelayPrivateKey(): Uint8Array {
+    getRelayPrivateKey(_uri: string): Uint8Array {
       return hdMaster.privateKey;
     },
 

packages/wallet/src/wallet-adapter.ts

@@ -19,12 +19,12 @@ export interface WalletAdapter {
   walletIcon: string;
 
   /**
-   * Return the relay identity private key for this session.
+   * Return the relay identity private key for a given connection URI.
-   * May be ephemeral (random per session) or stable (HD-derived) — both work.
+   * Should be deterministic per URI so that reconnecting to the same URI
-   * The dapp learns the wallet's public key dynamically via wallet_ready
+   * produces the same Nostr identity (relay recognizes the wallet after reload).
-   * so stability across restarts is not required.
+   * Different URIs should yield different keys for privacy (dapps can't correlate).
    */
-  getRelayPrivateKey(): Uint8Array;
+  getRelayPrivateKey(uri: string): Uint8Array;
 
   /**
    * Derive the compressed public key (33 bytes) for a given HD path and index.

packages/wallet/src/wallet-connection-manager.ts

@@ -161,7 +161,7 @@ export class WalletConnectionManager extends EventEmitter<WalletConnectionManage
 
     const result = initiateWalletRelay(statusCallback, {
       uri,
-      walletPrivateKey: this.adapter.getRelayPrivateKey(),
+      walletPrivateKey: this.adapter.getRelayPrivateKey(uri),
     });
 
     conn.cleanup = result.cleanup;