@multiplatform.one/gpg 6.0.0

package/dist/esm/index.native.js

@@ -0,0 +1,8 @@
+import { useGpg } from "./useGpg.native.js";
+import { GpgProvider, GPG_NONCE_QUERY_KEY } from "./GpgProvider.native.js";
+import { GpgContext, GpgStatusState } from "./GpgContext.native.js";
+import { default as default2 } from "./SignInWithGpg.native.js";
+import { default as default3, GPGButton } from "./GpgButton.native.js";
+import { gpgScreen, GpgScreenRegistrar, GpgBridge } from "./screens.native.js";
+export { GPGButton, GPG_NONCE_QUERY_KEY, GpgBridge, GpgContext, GpgProvider, GpgScreenRegistrar, GpgStatusState, default2 as SignInWithGpg, default3 as SignInWithGpgButton, gpgScreen, useGpg };
+//# sourceMappingURL=index.native.js.map

package/dist/esm/index.native.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["useGpg","GpgProvider","GPG_NONCE_QUERY_KEY","GpgContext","GpgStatusState","default","default2","default3","GPGButton","gpgScreen","GpgScreenRegistrar","GpgBridge"],"sources":["../../src/index.ts"],"sourcesContent":[null],"mappings":"AAKA,SAASA,MAAA,QAAc;AACvB,SAASC,WAAA,EAAaC,mBAAA,QAA2B;AACjD,SAASC,UAAA,EAAYC,cAAA,QAAsB;AAG3C,SAAoBC,OAAA,IAAXC,QAAA,QAAgC;AACzC,SAAoBD,OAAA,IAAXE,QAAA,EAAgCC,SAAA,QAAiB;AAE1D,SAASC,SAAA,EAAWC,kBAAA,EAAoBC,SAAA,QAAiB","ignoreList":[]}

package/dist/esm/screens.mjs

@@ -0,0 +1,32 @@
+import { ModalStateProvider, routes, useRegisterScreens } from "@multiplatform.one/connectkit";
+import { useContext as useReactContext } from "react";
+import SignInWithGpg from "./SignInWithGpg.mjs";
+import { GpgContext } from "./GpgContext.mjs";
+import { Fragment, jsx, jsxs } from "react/jsx-runtime";
+const gpgScreen = {
+  id: routes.SIGNINWITHGPG,
+  component: SignInWithGpg,
+  heading: "Sign in with GPG",
+  availableWhen: () => true,
+  showBack: false,
+  showInfo: false
+};
+const GpgScreenRegistrar = () => {
+  useRegisterScreens([gpgScreen]);
+  return null;
+};
+const GpgBridge = ({
+  children
+}) => {
+  const signInWithGpg = useReactContext(GpgContext)?.enabled ?? true;
+  return /* @__PURE__ */jsxs(Fragment, {
+    children: [/* @__PURE__ */jsx(GpgScreenRegistrar, {}), /* @__PURE__ */jsx(ModalStateProvider, {
+      value: {
+        signInWithGpg
+      },
+      children
+    })]
+  });
+};
+export { GpgBridge, GpgScreenRegistrar, gpgScreen };
+//# sourceMappingURL=screens.mjs.map

package/dist/esm/screens.mjs.map

@@ -0,0 +1 @@
+{"version":3,"names":["ModalStateProvider","routes","useRegisterScreens","useContext","useReactContext","SignInWithGpg","GpgContext","Fragment","jsx","jsxs","gpgScreen","id","SIGNINWITHGPG","component","heading","availableWhen","showBack","showInfo","GpgScreenRegistrar","GpgBridge","children","signInWithGpg","enabled","value"],"sources":["../../src/screens.tsx"],"sourcesContent":[null],"mappings":"AACA,SACEA,kBAAA,EACAC,MAAA,EACAC,kBAAA,QAGK;AACP,SAASC,UAAA,IAAcC,eAAA,QAAuB;AAC9C,OAAOC,aAAA,MAAmB;AAC1B,SAASC,UAAA,QAAkB;AAkCvB,SAAAC,QAAA,EACEC,GAAA,EADFC,IAAA;AA9BG,MAAMC,SAAA,GAAuB;EAClCC,EAAA,EAAIV,MAAA,CAAOW,aAAA;EACXC,SAAA,EAAWR,aAAA;EACXS,OAAA,EAAS;EACTC,aAAA,EAAeA,CAAA,KAAM;EACrBC,QAAA,EAAU;EACVC,QAAA,EAAU;AACZ;AAOO,MAAMC,kBAAA,GAA+BA,CAAA,KAAM;EAChDhB,kBAAA,CAAmB,CAACQ,SAAS,CAAC;EAC9B,OAAO;AACT;AAQO,MAAMS,SAAA,GAA6EA,CAAC;EACzFC;AACF,MAAM;EACJ,MAAMC,aAAA,GAAgBjB,eAAA,CAAgBE,UAAU,GAAGgB,OAAA,IAAW;EAC9D,OACE,eAAAb,IAAA,CAAAF,QAAA;IACEa,QAAA,kBAAAZ,GAAA,CAACU,kBAAA,IAAmB,GACpB,eAAAV,GAAA,CAACR,kBAAA;MAAmBuB,KAAA,EAAO;QAAEF;MAAc;MAAID;IAAA,CAAS;EAAA,CAC1D;AAEJ","ignoreList":[]}

package/dist/esm/screens.native.js

@@ -0,0 +1,38 @@
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import React from "react";
+import { ModalStateProvider, routes, useRegisterScreens } from "@multiplatform.one/connectkit";
+import { useContext as useReactContext } from "react";
+import SignInWithGpg from "./SignInWithGpg.native.js";
+import { GpgContext } from "./GpgContext.native.js";
+var gpgScreen = {
+  id: routes.SIGNINWITHGPG,
+  component: SignInWithGpg,
+  heading: "Sign in with GPG",
+  availableWhen: function availableWhen() {
+    return true;
+  },
+  showBack: false,
+  showInfo: false
+};
+var GpgScreenRegistrar = function GpgScreenRegistrar2() {
+  useRegisterScreens([gpgScreen]);
+  return null;
+};
+var GpgBridge = function GpgBridge2(param) {
+  var {
+    children
+  } = param;
+  var _ref;
+  var _useReactContext;
+  var signInWithGpg = (_ref = (_useReactContext = useReactContext(GpgContext)) === null || _useReactContext === void 0 ? void 0 : _useReactContext.enabled) !== null && _ref !== void 0 ? _ref : true;
+  return /* @__PURE__ */_jsxs(_Fragment, {
+    children: [/* @__PURE__ */_jsx(GpgScreenRegistrar, {}), /* @__PURE__ */_jsx(ModalStateProvider, {
+      value: {
+        signInWithGpg
+      },
+      children
+    })]
+  });
+};
+export { GpgBridge, GpgScreenRegistrar, gpgScreen };
+//# sourceMappingURL=screens.native.js.map

package/dist/esm/screens.native.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["jsx","_jsx","jsxs","_jsxs","Fragment","_Fragment","React","ModalStateProvider","routes","useRegisterScreens","useContext","useReactContext","SignInWithGpg","GpgContext","gpgScreen","id","SIGNINWITHGPG","component","heading","availableWhen","showBack","showInfo","GpgScreenRegistrar","GpgScreenRegistrar2","GpgBridge","GpgBridge2","param","children","_ref","_useReactContext","signInWithGpg","enabled"],"sources":["../../src/screens.tsx"],"sourcesContent":[null],"mappings":"AACA,SAAAA,GAAA,IAAAC,IAAA,EAAAC,IAAA,IAAAC,KAAA,EAAAC,QAAA,IAAAC,SAAA;AAAA,OACEC,KAAA;AAAA,SACAC,kBAAA,EAAAC,MAAA,EAAAC,kBAAA;AAAA,SACAC,UAAA,IAAAC,eAAA;AAAA,OAGKC,aAAA;AACP,SAASC,UAAA,QAAc;AACvB,IAAAC,SAAO;EACPC,EAAA,EAAAP,MAAS,CAAAQ,aAAA;EAkCLC,SAAA,EAAAL,aAAA;EA9BGM,OAAM,oBAAuB;EAClCC,aAAW,WAAAA,cAAA;IACX,WAAW;EACX;EACAC,QAAA,OAAe;EACfC,QAAA,EAAU;AAAA;AAEZ,IAAAC,kBAAA,YAAAC,oBAAA;EAOOd,kBAAM,EACXK,SAAA,CACA;EACF;AAQO;AAAoF,IACzFU,SAAA,YAAAC,WAAAC,KAAA;EACF,IAAM;IAAAC;EAAA,IAAAD,KAAA;EACJ,IAAAE,IAAM;EACN,IAAAC,gBACE;EACE,IAAAC,aAAA,IAAAF,IAAC,IAAAC,gBAAmB,GAAAlB,eAAA,CAAAE,UAAA,eAAAgB,gBAAA,uBAAAA,gBAAA,CAAAE,OAAA,cAAAH,IAAA,cAAAA,IAAA;EAAA,OACpB,eAACzB,KAAA,CAAAE,SAAA;IAAuDsB,QAC1D,GAEJ,eAAA1B,IAAA,CAAAqB,kBAAA,O","ignoreList":[]}

package/dist/esm/useGpg.mjs

@@ -0,0 +1,45 @@
+import { useContext } from "react";
+import { GpgContext, GpgStatusState } from "./GpgContext.mjs";
+const useGpg = () => {
+  const gpg = useContext(GpgContext);
+  if (!gpg) {
+    return {
+      message: null,
+      command: null,
+      status: GpgStatusState.ERROR,
+      error: new Error("useGpg hook must be inside a GpgProvider."),
+      isLoading: false,
+      isSuccess: false,
+      isError: true,
+      isReady: false,
+      signIn: () => Promise.reject(),
+      reset: () => {}
+    };
+  }
+  const {
+    nonce,
+    message,
+    command,
+    status,
+    signIn,
+    resetStatus
+  } = gpg;
+  const isLoading = status === GpgStatusState.LOADING || nonce.isLoading;
+  const isSuccess = status === GpgStatusState.SUCCESS;
+  const isError = status === GpgStatusState.ERROR;
+  const isReady = !!message && !isLoading;
+  return {
+    message,
+    command,
+    status,
+    error: nonce.error,
+    isLoading,
+    isSuccess,
+    isError,
+    isReady,
+    signIn,
+    reset: () => resetStatus()
+  };
+};
+export { useGpg };
+//# sourceMappingURL=useGpg.mjs.map

package/dist/esm/useGpg.mjs.map

@@ -0,0 +1 @@
+{"version":3,"names":["useContext","GpgContext","GpgStatusState","useGpg","gpg","message","command","status","ERROR","error","Error","isLoading","isSuccess","isError","isReady","signIn","Promise","reject","reset","nonce","resetStatus","LOADING","SUCCESS"],"sources":["../../src/useGpg.ts"],"sourcesContent":[null],"mappings":"AAAA,SAASA,UAAA,QAAkB;AAC3B,SAASC,UAAA,EAAYC,cAAA,QAAsB;AAoBpC,MAAMC,MAAA,GAASA,CAAA,KAAuB;EAC3C,MAAMC,GAAA,GAAMJ,UAAA,CAAWC,UAAU;EACjC,IAAI,CAACG,GAAA,EAAK;IACR,OAAO;MACLC,OAAA,EAAS;MACTC,OAAA,EAAS;MACTC,MAAA,EAAQL,cAAA,CAAeM,KAAA;MACvBC,KAAA,EAAO,IAAIC,KAAA,CAAM,2CAA2C;MAC5DC,SAAA,EAAW;MACXC,SAAA,EAAW;MACXC,OAAA,EAAS;MACTC,OAAA,EAAS;MACTC,MAAA,EAAQA,CAAA,KAAMC,OAAA,CAAQC,MAAA,CAAO;MAC7BC,KAAA,EAAOA,CAAA,KAAM,CAAC;IAChB;EACF;EAEA,MAAM;IAAEC,KAAA;IAAOd,OAAA;IAASC,OAAA;IAASC,MAAA;IAAQQ,MAAA;IAAQK;EAAY,IAAIhB,GAAA;EACjE,MAAMO,SAAA,GAAYJ,MAAA,KAAWL,cAAA,CAAemB,OAAA,IAAWF,KAAA,CAAMR,SAAA;EAC7D,MAAMC,SAAA,GAAYL,MAAA,KAAWL,cAAA,CAAeoB,OAAA;EAC5C,MAAMT,OAAA,GAAUN,MAAA,KAAWL,cAAA,CAAeM,KAAA;EAC1C,MAAMM,OAAA,GAAU,CAAC,CAACT,OAAA,IAAW,CAACM,SAAA;EAE9B,OAAO;IACLN,OAAA;IACAC,OAAA;IACAC,MAAA;IACAE,KAAA,EAAOU,KAAA,CAAMV,KAAA;IACbE,SAAA;IACAC,SAAA;IACAC,OAAA;IACAC,OAAA;IACAC,MAAA;IACAG,KAAA,EAAOA,CAAA,KAAME,WAAA,CAAY;EAC3B;AACF","ignoreList":[]}

package/dist/esm/useGpg.native.js

@@ -0,0 +1,49 @@
+import { useContext } from "react";
+import { GpgContext, GpgStatusState } from "./GpgContext.native.js";
+var useGpg = function useGpg2() {
+  var gpg = useContext(GpgContext);
+  if (!gpg) {
+    return {
+      message: null,
+      command: null,
+      status: GpgStatusState.ERROR,
+      error: new Error("useGpg hook must be inside a GpgProvider."),
+      isLoading: false,
+      isSuccess: false,
+      isError: true,
+      isReady: false,
+      signIn: function signIn2() {
+        return Promise.reject();
+      },
+      reset: function reset() {}
+    };
+  }
+  var {
+    nonce,
+    message,
+    command,
+    status,
+    signIn,
+    resetStatus
+  } = gpg;
+  var isLoading = status === GpgStatusState.LOADING || nonce.isLoading;
+  var isSuccess = status === GpgStatusState.SUCCESS;
+  var isError = status === GpgStatusState.ERROR;
+  var isReady = !!message && !isLoading;
+  return {
+    message,
+    command,
+    status,
+    error: nonce.error,
+    isLoading,
+    isSuccess,
+    isError,
+    isReady,
+    signIn,
+    reset: function reset() {
+      return resetStatus();
+    }
+  };
+};
+export { useGpg };
+//# sourceMappingURL=useGpg.native.js.map

package/dist/esm/useGpg.native.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["useContext","GpgContext","GpgStatusState","useGpg","useGpg2","gpg","message","command","status","ERROR","error","Error","isLoading","isSuccess","isError","isReady","signIn","signIn2","Promise","reject","reset","nonce","resetStatus","LOADING","SUCCESS"],"sources":["../../src/useGpg.ts"],"sourcesContent":[null],"mappings":"AAAA,SAASA,UAAA,QAAkB;AAC3B,SAASC,UAAA,EAAYC,cAAA,QAAsB;AAoBpC,IAAAC,MAAM,YAAgCC,QAAA;EAC3C,IAAAC,GAAM,GAAAL,UAAM,CAAAC,UAAW;EACvB,IAAI,CAACI,GAAA,EAAK;IACR,OAAO;MACLC,OAAA,EAAS;MACTC,OAAA,EAAS;MACTC,MAAA,EAAQN,cAAA,CAAeO,KAAA;MACvBC,KAAA,EAAO,IAAIC,KAAA,CAAM,2CAA2C;MAC5DC,SAAA,EAAW;MACXC,SAAA,EAAW;MACXC,OAAA,EAAS;MACTC,OAAA,EAAS;MACTC,MAAA,EAAQ,SAAMC,OAAQA,CAAA;QACtB,OAAOC,OAAM,CAAAC,MAAA;MAAC;MAChBC,KAAA,WAAAA,MAAA,GACF;IAEA;EACA;EACA;IAAMC,KAAA;IAAAf,OAAY;IAAAC,OAAW;IAAAC,MAAA;IAAAQ,MAAe;IAAAM;EAAA,IAAAjB,GAAA;EAC5C,IAAAO,SAAM,GAAUJ,MAAA,KAAWN,cAAA,CAAeqB,OAAA,IAAAF,KAAA,CAAAT,SAAA;EAC1C,IAAAC,SAAM,GAAUL,MAAE,KAAAN,cAAY,CAAAsB,OAAA;EAE9B,IAAAV,OAAO,GAAAN,MAAA,KAAAN,cAAA,CAAAO,KAAA;EAAA,IACLM,OAAA,KAAAT,OAAA,KAAAM,SAAA;EAAA,OACA;IACAN,OAAA;IACAC,OAAO;IACPC,MAAA;IACAE,KAAA,EAAAW,KAAA,CAAAX,KAAA;IACAE,SAAA;IACAC,SAAA;IACAC,OAAA;IACAC,OAAO;IACTC,MAAA;IACFI,KAAA,WAAAA,MAAA","ignoreList":[]}

package/package.json

@@ -0,0 +1,73 @@
+{
+  "name": "@multiplatform.one/gpg",
+  "version": "6.0.0",
+  "description": "Sign-In With GPG (SIWG) screen + GpgProvider for the connectkit modal — no viem",
+  "keywords": [
+    "connectkit",
+    "cross-platform",
+    "gpg",
+    "multiplatform",
+    "react",
+    "react-native",
+    "sign-in",
+    "siwg",
+    "tamagui"
+  ],
+  "homepage": "https://multiplatform.one",
+  "bugs": {
+    "url": "https://gitlab.com/bitspur/multiplatform.one/multiplatform.one/issues",
+    "email": "support@risserlabs.com"
+  },
+  "license": "Apache-2.0",
+  "author": "BitSpur <support@risserlabs.com> (https://risserlabs.com)",
+  "repository": {
+    "type": "git",
+    "url": "https://gitlab.com/bitspur/multiplatform.one/multiplatform.one.git"
+  },
+  "source": "src/index.ts",
+  "files": [
+    "dist",
+    "src",
+    "types"
+  ],
+  "sideEffects": false,
+  "main": "src/index.ts",
+  "module": "src/index.ts",
+  "types": "src/index.ts",
+  "exports": {
+    "./package.json": "./package.json",
+    ".": {
+      "source": "./src/index.ts",
+      "react-native": {
+        "types": "./src/index.ts",
+        "import": "./src/index.ts",
+        "require": "./src/index.ts",
+        "default": "./src/index.ts"
+      },
+      "types": "./src/index.ts",
+      "import": "./dist/esm/index.mjs",
+      "require": "./dist/cjs/index.cjs"
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@multiplatform.one/connectkit": "6.0.0"
+  },
+  "devDependencies": {
+    "@tamagui/build": "2.0.0-rc.41",
+    "@types/react": "~19.2.14",
+    "react": "19.2.5",
+    "typescript": "~5.9.3",
+    "@multiplatform.one/config": "6.0.0"
+  },
+  "peerDependencies": {
+    "@tanstack/react-query": "^5.62.0",
+    "react": "^19.1.0"
+  },
+  "scripts": {
+    "typecheck": "tsc --noEmit",
+    "build": "rm -rf dist types 2>/dev/null && tamagui-build --ts-project ./tsconfig.build.json && node scripts/fix-dist-specifiers.mjs"
+  }
+}

package/src/GpgButton.tsx

@@ -0,0 +1,37 @@
+import React from "react";
+import { Button, ResetContainer, useModal } from "@multiplatform.one/connectkit";
+
+// Standalone trigger for the GPG flow. GPG is NOT a wallet connector — there is nothing
+// to connect first — so this button simply opens the SAME modal straight to the GPG
+// screen (no connect step), mirroring how the SIWE button opens its screen.
+type ButtonProps = {
+  children?: React.ReactNode;
+};
+
+export const GPGButton: React.FC<ButtonProps> = ({ children }) => {
+  // GPG is connection-free: open the SAME modal straight to its screen via the
+  // generic registry opener (gpg registers the 'signInWithGpg' screen).
+  const { openScreen } = useModal();
+  return (
+    <Button
+      key="button"
+      style={{ margin: 0 }}
+      arrow
+      // preventDefault so we never submit a surrounding host <form> (e.g. keycloak's
+      // login form) — the underlying styled button can render as type=submit.
+      onClick={(e?: { preventDefault?: () => void }) => {
+        e?.preventDefault?.();
+        openScreen("signInWithGpg");
+      }}
+    >
+      {children ?? "Sign in with GPG"}
+    </Button>
+  );
+};
+
+const GPGButtonComponent: React.FC<ButtonProps> = ({ ...props }) => (
+  <ResetContainer>
+    <GPGButton {...props} />
+  </ResetContainer>
+);
+export default GPGButtonComponent;

package/src/GpgContext.tsx

@@ -0,0 +1,49 @@
+import { createContext } from "react";
+import { useQuery } from "@tanstack/react-query";
+
+// Sign-In With GPG (SIWG) is a SEPARATE, connection-free signer: unlike a wallet
+// there is nothing to "connect" first — the user signs a challenge in their terminal
+// and pastes the result back. This module deliberately pulls in NO wagmi/viem, so it
+// can later move into a standalone `@multiplatform.one/gpg` package on top of connectkit.
+
+export enum GpgStatusState {
+  READY = "ready",
+  LOADING = "loading",
+  SUCCESS = "success",
+  ERROR = "error",
+}
+
+export type GpgConfig = {
+  // Required: fetch a fresh nonce from the backend (e.g. keycloak /realms/<realm>/siww/nonce).
+  getNonce: () => Promise<string>;
+  // Required: submit the signed credential. The screen produces
+  //   username = base64(armoredSignature + armoredPublicKey)
+  //   password = base64(message)
+  // For a keycloak browser login this writes the login form and submits it (the page
+  // then navigates); an API consumer may POST and return a boolean instead.
+  onSign: (cred: {
+    username: string;
+    password: string;
+    message: string;
+  }) => Promise<boolean | void> | boolean | void;
+
+  // Optional: override the challenge message (default = the standard SIWG message).
+  buildMessage?: (args: { nonce: string }) => string;
+  enabled?: boolean;
+  nonceRefetchInterval?: number;
+};
+
+export type GpgContextValue = Required<
+  Pick<GpgConfig, "getNonce" | "onSign" | "enabled" | "nonceRefetchInterval">
+> & {
+  buildMessage?: GpgConfig["buildMessage"];
+  nonce: ReturnType<typeof useQuery<string | null>>;
+  // Derived from the nonce — what the user copies/signs, and the ready-to-run command.
+  message: string | null;
+  command: string | null;
+  status: GpgStatusState;
+  signIn: (pastedBlob: string) => Promise<boolean>;
+  resetStatus: () => void;
+};
+
+export const GpgContext = createContext<GpgContextValue | null>(null);

package/src/GpgProvider.tsx

@@ -0,0 +1,126 @@
+import { ReactNode, useContext, useMemo, useState } from "react";
+import { useQuery } from "@tanstack/react-query";
+
+import { Context as ConnectKitContext } from "@multiplatform.one/connectkit";
+import { GpgContext, GpgConfig, GpgStatusState } from "./GpgContext";
+
+type Props = GpgConfig & {
+  children: ReactNode;
+  onSignIn?: () => void;
+};
+
+export const GPG_NONCE_QUERY_KEY = "ckGpgNonce";
+
+// UTF-8-safe base64 — the server decodes with new String(decoder.decode(...), UTF_8),
+// so plain btoa would corrupt non-ASCII. Must keep the unescape(encodeURIComponent()).
+const b64 = (s: string) => window.btoa(unescape(encodeURIComponent(s)));
+
+// The default SIWG challenge. Only the header line (domain) and the Nonce line are
+// load-bearing per the server's GpgMessage grammar; the rest is a cosmetic envelope.
+function defaultBuildMessage({ nonce }: { nonce: string }): string {
+  return (
+    `${window.location.host} wants you to sign in with your GPG key.\n\n` +
+    `URI: ${window.location.origin}\n` +
+    `Version: 1\n` +
+    `Nonce: ${nonce}\n` +
+    `Issued At: ${new Date().toISOString()}`
+  );
+}
+
+export const GpgProvider = ({
+  children,
+  enabled = true,
+  nonceRefetchInterval = 1000 * 60 * 5,
+  buildMessage,
+  onSignIn,
+  ...gpgConfig
+}: Props) => {
+  const [status, setStatus] = useState<GpgStatusState>(GpgStatusState.READY);
+  const resetStatus = () => setStatus(GpgStatusState.READY);
+
+  // Mirror SIWEProvider's guards: single instance, and mounted OUTSIDE ConnectKitProvider
+  // so the modal's GPG screen can read this context.
+  if (useContext(GpgContext)) {
+    throw new Error("Multiple, nested usages of GpgProvider detected. Please use only one.");
+  }
+  if (useContext(ConnectKitContext)) {
+    throw new Error("ConnectKitProvider must be mounted inside GpgProvider.");
+  }
+
+  const nonce = useQuery({
+    queryKey: [GPG_NONCE_QUERY_KEY],
+    queryFn: () => gpgConfig.getNonce(),
+    refetchInterval: nonceRefetchInterval,
+  });
+
+  // Compute the challenge ONCE per nonce (it embeds an Issued At timestamp); recomputing
+  // on every render would desync the displayed/copied message from the one base64'd into
+  // `password`, breaking the signature (which is verified over the exact message bytes).
+  const message = useMemo(
+    () => (nonce.data ? (buildMessage ?? defaultBuildMessage)({ nonce: nonce.data }) : null),
+    [nonce.data, buildMessage],
+  );
+  // The ready-to-run terminal command: detached armored signature + the exported public
+  // key, concatenated — exactly the blob the user pastes back. printf %s (no newline) so
+  // the signed bytes are byte-identical to `message`.
+  const command = useMemo(
+    () =>
+      message
+        ? `{ printf %s '${message}' | gpg --detach-sign --armor; gpg --armor --export; }`
+        : null,
+    [message],
+  );
+
+  const signIn = async (pastedBlob: string): Promise<boolean> => {
+    const blob = pastedBlob.trim();
+    if (
+      !blob.includes("-----BEGIN PGP SIGNATURE-----") ||
+      !blob.includes("-----BEGIN PGP PUBLIC KEY BLOCK-----")
+    ) {
+      setStatus(GpgStatusState.ERROR);
+      throw new Error(
+        "Paste the FULL output — it must contain both a PGP SIGNATURE and a PUBLIC KEY block.",
+      );
+    }
+    if (!message) {
+      setStatus(GpgStatusState.ERROR);
+      throw new Error("Could not fetch nonce");
+    }
+    try {
+      setStatus(GpgStatusState.LOADING);
+      // username = base64(signature + public key), password = base64(message).
+      const result = await gpgConfig.onSign({
+        username: b64(blob),
+        password: b64(message),
+        message,
+      });
+      // A keycloak browser login navigates away here; an API consumer returns a boolean.
+      if (result === false) throw new Error("GPG sign-in was rejected");
+      setStatus(GpgStatusState.SUCCESS);
+      onSignIn?.();
+      return true;
+    } catch (error) {
+      setStatus(GpgStatusState.ERROR);
+      throw error;
+    }
+  };
+
+  return (
+    <GpgContext.Provider
+      value={{
+        enabled,
+        nonceRefetchInterval,
+        buildMessage,
+        ...gpgConfig,
+        nonce,
+        message,
+        command,
+        status,
+        signIn,
+        resetStatus,
+      }}
+    >
+      {children}
+    </GpgContext.Provider>
+  );
+};

package/src/SignInWithGpg.tsx

@@ -0,0 +1,101 @@
+import React, { CSSProperties, useState } from "react";
+
+import {
+  useContext,
+  PageContent,
+  ModalBody,
+  ModalContent,
+  Button,
+  CopyToClipboard,
+} from "@multiplatform.one/connectkit";
+import { useGpg } from "./useGpg";
+
+// Sign-In With GPG screen: a connection-free, copy/paste flow rendered inside the SAME
+// ConnectKit modal as the wallet screens. Reads everything from useGpg() (the consumer's
+// GpgProvider supplies the backend-specific getNonce/onSign) — no keycloak knowledge here.
+const textarea: CSSProperties = {
+  width: "100%",
+  boxSizing: "border-box",
+  fontFamily: "var(--ck-font-family, monospace)",
+  fontSize: 11,
+  lineHeight: 1.4,
+  padding: 8,
+  borderRadius: "var(--ck-primary-button-border-radius, 12px)",
+  border: "1px solid var(--ck-body-divider, #d3d3d3)",
+  background: "var(--ck-body-background-secondary, #f6f7f9)",
+  color: "var(--ck-body-color, inherit)",
+  resize: "vertical",
+};
+const label: CSSProperties = {
+  textAlign: "left",
+  fontSize: 14,
+  fontWeight: 500,
+  margin: "4px 0",
+};
+
+const SignInWithGpg: React.FC = () => {
+  const context = useContext();
+  const { message, command, signIn, isLoading, isReady } = useGpg();
+  const [pasted, setPasted] = useState("");
+  const [error, setError] = useState<string | null>(null);
+  const [busy, setBusy] = useState(false);
+
+  const onSubmit = async () => {
+    setError(null);
+    setBusy(true);
+    try {
+      await signIn(pasted);
+      // A keycloak browser login navigates away; for API consumers, close the modal.
+      setTimeout(() => context.setOpen(false), 1000);
+    } catch (e) {
+      setError(e instanceof Error ? e.message : "GPG sign-in failed");
+      setBusy(false);
+    }
+  };
+
+  return (
+    <PageContent style={{ width: 320 }}>
+      <ModalContent style={{ paddingBottom: 8, gap: 6 }}>
+        <ModalBody style={label}>1. Sign the challenge in your terminal:</ModalBody>
+        <div style={{ display: "flex", flexDirection: "column", gap: 6 }}>
+          <CopyToClipboard variant="button" string={command ?? ""}>
+            Copy gpg command
+          </CopyToClipboard>
+          <CopyToClipboard variant="button" string={message ?? ""}>
+            Copy message only
+          </CopyToClipboard>
+        </div>
+        <textarea
+          readOnly
+          rows={4}
+          value={message ?? (isLoading ? "Loading challenge…" : "")}
+          style={textarea}
+        />
+        <ModalBody style={label}>2. Paste the full output below:</ModalBody>
+        <textarea
+          rows={6}
+          value={pasted}
+          onChange={(e) => setPasted(e.target.value)}
+          placeholder="-----BEGIN PGP SIGNATURE----- … and your -----BEGIN PGP PUBLIC KEY BLOCK-----"
+          style={textarea}
+        />
+        <Button onClick={onSubmit} disabled={!isReady || !pasted || busy} waiting={busy} arrow>
+          Sign in
+        </Button>
+        {error && (
+          <ModalBody
+            style={{
+              color: "var(--ck-body-color-danger, #c9190b)",
+              fontSize: 13,
+              textAlign: "left",
+            }}
+          >
+            {error}
+          </ModalBody>
+        )}
+      </ModalContent>
+    </PageContent>
+  );
+};
+
+export default SignInWithGpg;

package/src/index.ts

@@ -0,0 +1,14 @@
+// @multiplatform.one/gpg — Sign-In With GPG (SIWG) for the connectkit modal.
+//
+// A connection-free signer: the user signs a challenge in their terminal and pastes
+// the result back. Pulls in NO wagmi/viem — depends only on @multiplatform.one/connectkit
+// — so a GPG-only app can install it without the wallet stack.
+export { useGpg } from "./useGpg";
+export { GpgProvider, GPG_NONCE_QUERY_KEY } from "./GpgProvider";
+export { GpgContext, GpgStatusState } from "./GpgContext";
+export type { GpgConfig, GpgContextValue } from "./GpgContext";
+
+export { default as SignInWithGpg } from "./SignInWithGpg";
+export { default as SignInWithGpgButton, GPGButton } from "./GpgButton";
+
+export { gpgScreen, GpgScreenRegistrar, GpgBridge } from "./screens";

package/src/screens.tsx

@@ -0,0 +1,50 @@
+import React from "react";
+import {
+  ModalStateProvider,
+  routes,
+  useRegisterScreens,
+  type ConnectCallbackProps,
+  type ScreenDef,
+} from "@multiplatform.one/connectkit";
+import { useContext as useReactContext } from "react";
+import SignInWithGpg from "./SignInWithGpg";
+import { GpgContext } from "./GpgContext";
+
+// The GPG screen contributed to connectkit's signer-agnostic modal. GPG has no
+// connect step, so it's available in both connected and disconnected states.
+export const gpgScreen: ScreenDef = {
+  id: routes.SIGNINWITHGPG,
+  component: SignInWithGpg,
+  heading: "Sign in with GPG",
+  availableWhen: () => true,
+  showBack: false,
+  showInfo: false,
+};
+
+/**
+ * Mount inside ConnectKitProvider (under ScreenRegistryProvider) to publish the GPG
+ * screen to the modal. Renders nothing. web3 mounts this alongside its wallet
+ * screens; a gpg-only app uses {@link GpgBridge}.
+ */
+export const GpgScreenRegistrar: React.FC = () => {
+  useRegisterScreens([gpgScreen]);
+  return null;
+};
+
+/**
+ * The signer bridge for a GPG-only app (no wagmi/web3). Pass to ConnectKitProvider's
+ * `bridge` prop: it registers the GPG screen and injects a ModalState advertising
+ * GPG sign-in is available. Open the screen via the SignInWithGpgButton (which calls
+ * `openScreen('signInWithGpg')`).
+ */
+export const GpgBridge: React.FC<{ children?: React.ReactNode } & ConnectCallbackProps> = ({
+  children,
+}) => {
+  const signInWithGpg = useReactContext(GpgContext)?.enabled ?? true;
+  return (
+    <>
+      <GpgScreenRegistrar />
+      <ModalStateProvider value={{ signInWithGpg }}>{children}</ModalStateProvider>
+    </>
+  );
+};