@multiplatform.one/gpg 7.17.0 → 7.19.0

package/dist/esm/signature.mjs

@@ -0,0 +1,88 @@
+import { ripemd160, sha1 } from "@noble/hashes/legacy.js";
+import { sha224, sha256, sha384, sha512 } from "@noble/hashes/sha2.js";
+const BEGIN = "-----BEGIN PGP SIGNATURE-----";
+const END = "-----END PGP SIGNATURE-----";
+const hashes = {
+  2: sha1,
+  3: ripemd160,
+  8: sha256,
+  9: sha384,
+  10: sha512,
+  11: sha224
+};
+function dearmor(text) {
+  const start = text.indexOf(BEGIN);
+  const end = text.indexOf(END, start);
+  if (start < 0 || end < 0) throw new Error("No PGP SIGNATURE block in the paste");
+  const lines = text.slice(start + BEGIN.length, end).split(/\r?\n/).map(line => line.trim());
+  const blank = lines.indexOf("", 1);
+  const hasHeaders = lines.slice(1, blank < 0 ? 0 : blank).some(line => line.includes(": "));
+  const body = (hasHeaders ? lines.slice(blank) : lines).filter(line => line && !/^=[A-Za-z0-9+/]{4}$/.test(line));
+  const binary = atob(body.join(""));
+  return Uint8Array.from(binary, c => c.charCodeAt(0));
+}
+function signaturePackets(bytes) {
+  const packets = [];
+  let at = 0;
+  while (at < bytes.length) {
+    const ctb = bytes[at++];
+    if (!(ctb & 128)) throw new Error("The PGP SIGNATURE block is not OpenPGP data");
+    let tag;
+    let length;
+    if (ctb & 64) {
+      tag = ctb & 63;
+      const first = bytes[at++];
+      if (first < 192) length = first;else if (first < 224) length = (first - 192 << 8) + bytes[at++] + 192;else if (first === 255) {
+        length = new DataView(bytes.buffer, bytes.byteOffset + at, 4).getUint32(0);
+        at += 4;
+      } else throw new Error("Partial-length PGP packets are not a detached signature");
+    } else {
+      tag = ctb >> 2 & 15;
+      const size = [1, 2, 4][ctb & 3];
+      if (size === void 0) throw new Error("Indeterminate-length PGP packets are not supported");
+      length = 0;
+      for (let i = 0; i < size; i++) length = length * 256 + bytes[at++];
+    }
+    if (at + length > bytes.length) throw new Error("The PGP SIGNATURE block is truncated");
+    if (tag === 2) packets.push(bytes.subarray(at, at + length));
+    at += length;
+  }
+  return packets;
+}
+function quickCheck(packet, message) {
+  if (packet[0] !== 4) {
+    throw new Error(`A version ${packet[0]} PGP signature cannot be checked here; sign with a v4 key`);
+  }
+  const sigType = packet[1];
+  if (sigType !== 0 && sigType !== 1) {
+    throw new Error(`PGP signature type 0x${sigType.toString(16)} is not a document signature`);
+  }
+  const hash = hashes[packet[3]];
+  if (!hash) throw new Error(`PGP hash algorithm ${packet[3]} is not supported`);
+  const hashedEnd = 6 + (packet[4] << 8 | packet[5]);
+  const unhashedLength = packet[hashedEnd] << 8 | packet[hashedEnd + 1];
+  const left16 = hashedEnd + 2 + unhashedLength;
+  if (left16 + 2 > packet.length) throw new Error("The PGP signature packet is truncated");
+  const data = sigType === 1 ? new TextEncoder().encode(new TextDecoder().decode(message).replace(/\r?\n/g, "\n").replace(/\n/g, "\r\n")) : message;
+  const trailer = new Uint8Array(6);
+  trailer[0] = 4;
+  trailer[1] = 255;
+  new DataView(trailer.buffer).setUint32(2, hashedEnd);
+  const input = new Uint8Array(data.length + hashedEnd + trailer.length);
+  input.set(data, 0);
+  input.set(packet.subarray(0, hashedEnd), data.length);
+  input.set(trailer, data.length + hashedEnd);
+  const digest = hash(input);
+  return [packet[left16] << 8 | packet[left16 + 1], digest[0] << 8 | digest[1]];
+}
+function gpgSignatureCovers(blob, message) {
+  const packets = signaturePackets(dearmor(blob));
+  if (!packets.length) throw new Error("The PGP SIGNATURE block holds no signature");
+  const bytes = new TextEncoder().encode(message);
+  return packets.every(packet => {
+    const [expected, actual] = quickCheck(packet, bytes);
+    return expected === actual;
+  });
+}
+export { gpgSignatureCovers };
+//# sourceMappingURL=signature.mjs.map

package/dist/esm/signature.mjs.map

@@ -0,0 +1 @@
+{"version":3,"names":["ripemd160","sha1","sha224","sha256","sha384","sha512","BEGIN","END","hashes","dearmor","text","start","indexOf","end","Error","lines","slice","length","split","map","line","trim","blank","hasHeaders","some","includes","body","filter","test","binary","atob","join","Uint8Array","from","c","charCodeAt","signaturePackets","bytes","packets","at","ctb","tag","first","DataView","buffer","byteOffset","getUint32","size","i","push","subarray","quickCheck","packet","message","sigType","toString","hash","hashedEnd","unhashedLength","left16","data","TextEncoder","encode","TextDecoder","decode","replace","trailer","setUint32","input","set","digest","gpgSignatureCovers","blob","every","expected","actual"],"sources":["../../src/signature.ts"],"sourcesContent":[null],"mappings":"AAAA,SAASA,SAAA,EAAWC,IAAA,QAAY;AAChC,SAASC,MAAA,EAAQC,MAAA,EAAQC,MAAA,EAAQC,MAAA,QAAc;AAQ/C,MAAMC,KAAA,GAAQ;AACd,MAAMC,GAAA,GAAM;AAEZ,MAAMC,MAAA,GAA2D;EAC/D,GAAGP,IAAA;EACH,GAAGD,SAAA;EACH,GAAGG,MAAA;EACH,GAAGC,MAAA;EACH,IAAIC,MAAA;EACJ,IAAIH;AACN;AAGA,SAASO,QAAQC,IAAA,EAA0B;EACzC,MAAMC,KAAA,GAAQD,IAAA,CAAKE,OAAA,CAAQN,KAAK;EAChC,MAAMO,GAAA,GAAMH,IAAA,CAAKE,OAAA,CAAQL,GAAA,EAAKI,KAAK;EACnC,IAAIA,KAAA,GAAQ,KAAKE,GAAA,GAAM,GAAG,MAAM,IAAIC,KAAA,CAAM,qCAAqC;EAC/E,MAAMC,KAAA,GAAQL,IAAA,CACXM,KAAA,CAAML,KAAA,GAAQL,KAAA,CAAMW,MAAA,EAAQJ,GAAG,EAC/BK,KAAA,CAAM,OAAO,EACbC,GAAA,CAAKC,IAAA,IAASA,IAAA,CAAKC,IAAA,CAAK,CAAC;EAC5B,MAAMC,KAAA,GAAQP,KAAA,CAAMH,OAAA,CAAQ,IAAI,CAAC;EACjC,MAAMW,UAAA,GAAaR,KAAA,CAAMC,KAAA,CAAM,GAAGM,KAAA,GAAQ,IAAI,IAAIA,KAAK,EAAEE,IAAA,CAAMJ,IAAA,IAASA,IAAA,CAAKK,QAAA,CAAS,IAAI,CAAC;EAC3F,MAAMC,IAAA,IAAQH,UAAA,GAAaR,KAAA,CAAMC,KAAA,CAAMM,KAAK,IAAIP,KAAA,EAAOY,MAAA,CACpDP,IAAA,IAASA,IAAA,IAAQ,CAAC,sBAAsBQ,IAAA,CAAKR,IAAI,CACpD;EACA,MAAMS,MAAA,GAASC,IAAA,CAAKJ,IAAA,CAAKK,IAAA,CAAK,EAAE,CAAC;EACjC,OAAOC,UAAA,CAAWC,IAAA,CAAKJ,MAAA,EAASK,CAAA,IAAMA,CAAA,CAAEC,UAAA,CAAW,CAAC,CAAC;AACvD;AAGA,SAASC,iBAAiBC,KAAA,EAAiC;EACzD,MAAMC,OAAA,GAAwB,EAAC;EAC/B,IAAIC,EAAA,GAAK;EACT,OAAOA,EAAA,GAAKF,KAAA,CAAMpB,MAAA,EAAQ;IACxB,MAAMuB,GAAA,GAAMH,KAAA,CAAME,EAAA,EAAI;IACtB,IAAI,EAAEC,GAAA,GAAM,MAAO,MAAM,IAAI1B,KAAA,CAAM,6CAA6C;IAChF,IAAI2B,GAAA;IACJ,IAAIxB,MAAA;IACJ,IAAIuB,GAAA,GAAM,IAAM;MACdC,GAAA,GAAMD,GAAA,GAAM;MACZ,MAAME,KAAA,GAAQL,KAAA,CAAME,EAAA,EAAI;MACxB,IAAIG,KAAA,GAAQ,KAAKzB,MAAA,GAASyB,KAAA,UACjBA,KAAA,GAAQ,KAAKzB,MAAA,IAAWyB,KAAA,GAAQ,OAAQ,KAAKL,KAAA,CAAME,EAAA,EAAI,IAAI,aAC3DG,KAAA,KAAU,KAAK;QACtBzB,MAAA,GAAS,IAAI0B,QAAA,CAASN,KAAA,CAAMO,MAAA,EAAQP,KAAA,CAAMQ,UAAA,GAAaN,EAAA,EAAI,CAAC,EAAEO,SAAA,CAAU,CAAC;QACzEP,EAAA,IAAM;MACR,OAAO,MAAM,IAAIzB,KAAA,CAAM,yDAAyD;IAClF,OAAO;MACL2B,GAAA,GAAOD,GAAA,IAAO,IAAK;MACnB,MAAMO,IAAA,GAAO,CAAC,GAAG,GAAG,CAAC,EAAEP,GAAA,GAAM,CAAI;MACjC,IAAIO,IAAA,KAAS,QAAW,MAAM,IAAIjC,KAAA,CAAM,oDAAoD;MAC5FG,MAAA,GAAS;MACT,SAAS+B,CAAA,GAAI,GAAGA,CAAA,GAAID,IAAA,EAAMC,CAAA,IAAK/B,MAAA,GAASA,MAAA,GAAS,MAAMoB,KAAA,CAAME,EAAA,EAAI;IACnE;IACA,IAAIA,EAAA,GAAKtB,MAAA,GAASoB,KAAA,CAAMpB,MAAA,EAAQ,MAAM,IAAIH,KAAA,CAAM,sCAAsC;IACtF,IAAI2B,GAAA,KAAQ,GAAGH,OAAA,CAAQW,IAAA,CAAKZ,KAAA,CAAMa,QAAA,CAASX,EAAA,EAAIA,EAAA,GAAKtB,MAAM,CAAC;IAC3DsB,EAAA,IAAMtB,MAAA;EACR;EACA,OAAOqB,OAAA;AACT;AAGA,SAASa,WAAWC,MAAA,EAAoBC,OAAA,EAAyD;EAC/F,IAAID,MAAA,CAAO,CAAC,MAAM,GAAG;IACnB,MAAM,IAAItC,KAAA,CACR,aAAasC,MAAA,CAAO,CAAC,CAAC,2DACxB;EACF;EACA,MAAME,OAAA,GAAUF,MAAA,CAAO,CAAC;EACxB,IAAIE,OAAA,KAAY,KAAQA,OAAA,KAAY,GAAM;IACxC,MAAM,IAAIxC,KAAA,CAAM,wBAAwBwC,OAAA,CAAQC,QAAA,CAAS,EAAE,CAAC,8BAA8B;EAC5F;EACA,MAAMC,IAAA,GAAOhD,MAAA,CAAO4C,MAAA,CAAO,CAAC,CAAC;EAC7B,IAAI,CAACI,IAAA,EAAM,MAAM,IAAI1C,KAAA,CAAM,sBAAsBsC,MAAA,CAAO,CAAC,CAAC,mBAAmB;EAC7E,MAAMK,SAAA,GAAY,KAAML,MAAA,CAAO,CAAC,KAAK,IAAKA,MAAA,CAAO,CAAC;EAClD,MAAMM,cAAA,GAAkBN,MAAA,CAAOK,SAAS,KAAK,IAAKL,MAAA,CAAOK,SAAA,GAAY,CAAC;EACtE,MAAME,MAAA,GAASF,SAAA,GAAY,IAAIC,cAAA;EAC/B,IAAIC,MAAA,GAAS,IAAIP,MAAA,CAAOnC,MAAA,EAAQ,MAAM,IAAIH,KAAA,CAAM,uCAAuC;EAEvF,MAAM8C,IAAA,GACJN,OAAA,KAAY,IACR,IAAIO,WAAA,CAAY,EAAEC,MAAA,CAChB,IAAIC,WAAA,CAAY,EAAEC,MAAA,CAAOX,OAAO,EAAEY,OAAA,CAAQ,UAAU,IAAI,EAAEA,OAAA,CAAQ,OAAO,MAAM,CACjF,IACAZ,OAAA;EACN,MAAMa,OAAA,GAAU,IAAIlC,UAAA,CAAW,CAAC;EAChCkC,OAAA,CAAQ,CAAC,IAAI;EACbA,OAAA,CAAQ,CAAC,IAAI;EACb,IAAIvB,QAAA,CAASuB,OAAA,CAAQtB,MAAM,EAAEuB,SAAA,CAAU,GAAGV,SAAS;EACnD,MAAMW,KAAA,GAAQ,IAAIpC,UAAA,CAAW4B,IAAA,CAAK3C,MAAA,GAASwC,SAAA,GAAYS,OAAA,CAAQjD,MAAM;EACrEmD,KAAA,CAAMC,GAAA,CAAIT,IAAA,EAAM,CAAC;EACjBQ,KAAA,CAAMC,GAAA,CAAIjB,MAAA,CAAOF,QAAA,CAAS,GAAGO,SAAS,GAAGG,IAAA,CAAK3C,MAAM;EACpDmD,KAAA,CAAMC,GAAA,CAAIH,OAAA,EAASN,IAAA,CAAK3C,MAAA,GAASwC,SAAS;EAC1C,MAAMa,MAAA,GAASd,IAAA,CAAKY,KAAK;EACzB,OAAO,CAAEhB,MAAA,CAAOO,MAAM,KAAK,IAAKP,MAAA,CAAOO,MAAA,GAAS,CAAC,GAAIW,MAAA,CAAO,CAAC,KAAK,IAAKA,MAAA,CAAO,CAAC,CAAC;AAClF;AAMO,SAASC,mBAAmBC,IAAA,EAAcnB,OAAA,EAA0B;EACzE,MAAMf,OAAA,GAAUF,gBAAA,CAAiB3B,OAAA,CAAQ+D,IAAI,CAAC;EAC9C,IAAI,CAAClC,OAAA,CAAQrB,MAAA,EAAQ,MAAM,IAAIH,KAAA,CAAM,4CAA4C;EACjF,MAAMuB,KAAA,GAAQ,IAAIwB,WAAA,CAAY,EAAEC,MAAA,CAAOT,OAAO;EAC9C,OAAOf,OAAA,CAAQmC,KAAA,CAAOrB,MAAA,IAAW;IAC/B,MAAM,CAACsB,QAAA,EAAUC,MAAM,IAAIxB,UAAA,CAAWC,MAAA,EAAQf,KAAK;IACnD,OAAOqC,QAAA,KAAaC,MAAA;EACtB,CAAC;AACH","ignoreList":[]}

package/dist/esm/signature.native.js

@@ -0,0 +1,96 @@
+import { ripemd160, sha1 } from "@noble/hashes/legacy.js";
+import { sha224, sha256, sha384, sha512 } from "@noble/hashes/sha2.js";
+var BEGIN = "-----BEGIN PGP SIGNATURE-----";
+var END = "-----END PGP SIGNATURE-----";
+var hashes = {
+  2: sha1,
+  3: ripemd160,
+  8: sha256,
+  9: sha384,
+  10: sha512,
+  11: sha224
+};
+function dearmor(text) {
+  var start = text.indexOf(BEGIN);
+  var end = text.indexOf(END, start);
+  if (start < 0 || end < 0) throw new Error("No PGP SIGNATURE block in the paste");
+  var lines = text.slice(start + BEGIN.length, end).split(/\r?\n/).map(function (line) {
+    return line.trim();
+  });
+  var blank = lines.indexOf("", 1);
+  var hasHeaders = lines.slice(1, blank < 0 ? 0 : blank).some(function (line) {
+    return line.includes(": ");
+  });
+  var body = (hasHeaders ? lines.slice(blank) : lines).filter(function (line) {
+    return line && !/^=[A-Za-z0-9+/]{4}$/.test(line);
+  });
+  var binary = atob(body.join(""));
+  return Uint8Array.from(binary, function (c) {
+    return c.charCodeAt(0);
+  });
+}
+function signaturePackets(bytes) {
+  var packets = [];
+  var at = 0;
+  while (at < bytes.length) {
+    var ctb = bytes[at++];
+    if (!(ctb & 128)) throw new Error("The PGP SIGNATURE block is not OpenPGP data");
+    var tag = void 0;
+    var length = void 0;
+    if (ctb & 64) {
+      tag = ctb & 63;
+      var first = bytes[at++];
+      if (first < 192) length = first;else if (first < 224) length = (first - 192 << 8) + bytes[at++] + 192;else if (first === 255) {
+        length = new DataView(bytes.buffer, bytes.byteOffset + at, 4).getUint32(0);
+        at += 4;
+      } else throw new Error("Partial-length PGP packets are not a detached signature");
+    } else {
+      tag = ctb >> 2 & 15;
+      var size = [1, 2, 4][ctb & 3];
+      if (size === void 0) throw new Error("Indeterminate-length PGP packets are not supported");
+      length = 0;
+      for (var i = 0; i < size; i++) length = length * 256 + bytes[at++];
+    }
+    if (at + length > bytes.length) throw new Error("The PGP SIGNATURE block is truncated");
+    if (tag === 2) packets.push(bytes.subarray(at, at + length));
+    at += length;
+  }
+  return packets;
+}
+function quickCheck(packet, message) {
+  if (packet[0] !== 4) {
+    throw new Error(`A version ${packet[0]} PGP signature cannot be checked here; sign with a v4 key`);
+  }
+  var sigType = packet[1];
+  if (sigType !== 0 && sigType !== 1) {
+    throw new Error(`PGP signature type 0x${sigType.toString(16)} is not a document signature`);
+  }
+  var hash = hashes[packet[3]];
+  if (!hash) throw new Error(`PGP hash algorithm ${packet[3]} is not supported`);
+  var hashedEnd = 6 + (packet[4] << 8 | packet[5]);
+  var unhashedLength = packet[hashedEnd] << 8 | packet[hashedEnd + 1];
+  var left16 = hashedEnd + 2 + unhashedLength;
+  if (left16 + 2 > packet.length) throw new Error("The PGP signature packet is truncated");
+  var data = sigType === 1 ? new TextEncoder().encode(new TextDecoder().decode(message).replace(/\r?\n/g, "\n").replace(/\n/g, "\r\n")) : message;
+  var trailer = new Uint8Array(6);
+  trailer[0] = 4;
+  trailer[1] = 255;
+  new DataView(trailer.buffer).setUint32(2, hashedEnd);
+  var input = new Uint8Array(data.length + hashedEnd + trailer.length);
+  input.set(data, 0);
+  input.set(packet.subarray(0, hashedEnd), data.length);
+  input.set(trailer, data.length + hashedEnd);
+  var digest = hash(input);
+  return [packet[left16] << 8 | packet[left16 + 1], digest[0] << 8 | digest[1]];
+}
+function gpgSignatureCovers(blob, message) {
+  var packets = signaturePackets(dearmor(blob));
+  if (!packets.length) throw new Error("The PGP SIGNATURE block holds no signature");
+  var bytes = new TextEncoder().encode(message);
+  return packets.every(function (packet) {
+    var [expected, actual] = quickCheck(packet, bytes);
+    return expected === actual;
+  });
+}
+export { gpgSignatureCovers };
+//# sourceMappingURL=signature.native.js.map

package/dist/esm/signature.native.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["ripemd160","sha1","sha224","sha256","sha384","sha512","BEGIN","END","hashes","dearmor","text","start","indexOf","end","Error","lines","slice","length","split","map","line","trim","blank","hasHeaders","some","includes","body","filter","test","binary","atob","join","Uint8Array","from","c","charCodeAt","signaturePackets","bytes","packets","at","ctb","tag","first","DataView","buffer","byteOffset","getUint32","size","i","push","subarray","quickCheck","packet","message","sigType","toString","hash","hashedEnd","unhashedLength","left16","data","TextEncoder","encode","TextDecoder","decode","replace","trailer","setUint32","input","set","digest"],"sources":["../../src/signature.ts"],"sourcesContent":[null],"mappings":"AAAA,SAASA,SAAA,EAAWC,IAAA,QAAY;AAChC,SAASC,MAAA,EAAQC,MAAA,EAAQC,MAAA,EAAQC,MAAA,QAAc;AAQ/C,IAAAC,KAAM,kCAAQ;AACd,IAAAC,GAAM,gCAAM;AAEZ,IAAAC,MAAM;EACJ,GAAGP,IAAA;EACH,GAAGD,SAAA;EACH,GAAGG,MAAA;EACH,GAAGC,MAAA;EACH,IAAIC,MAAA;EACJ,IAAIH;AACN;AAGA,SAASO,QAAQC,IAAA,EAA0B;EACzC,IAAAC,KAAM,GAAAD,IAAQ,CAAAE,OAAK,CAAAN,KAAQ;EAC3B,IAAAO,GAAM,GAAAH,IAAM,CAAAE,OAAK,CAAAL,GAAQ,EAAAI,KAAK;EAC9B,IAAIA,KAAA,GAAQ,KAAKE,GAAA,GAAM,GAAG,MAAM,IAAIC,KAAA,CAAM,qCAAqC;EAC/E,IAAAC,KAAM,GAAAL,IAAQ,CAAAM,KACX,CAAAL,KAAM,GAAAL,KAAQ,CAAAW,MAAM,EAAAJ,GAAQ,EAAGK,KAC/B,QAAM,EAAOC,GACb,WAAKC,IAAS;IACjB,OAAMA,IAAA,CAAQC,IAAA,EAAM;EACpB;EACA,IAAAC,KAAM,GAAAP,KAAQ,CAAAH,OAAA,GAAa;EAA4B,IACpDW,UAAS,GAAAR,KAAS,CAAAC,KAAA,IAAAM,KAAA,OAAsB,IAAKA,KAAI,EAAAE,IAAA,WAAAJ,IAAA;IACpD,OAAAA,IAAA,CAAAK,QAAA;EACA;EACA,IAAAC,IAAO,IAAAH,UAAW,GAAKR,KAAA,CAAQC,KAAC,CAAAM,KAAQ,IAAAP,KAAW,EAAEY,MAAA,WAAAP,IAAA;IACvD,OAAAA,IAAA,2BAAAQ,IAAA,CAAAR,IAAA;EAGA;EACE,IAAAS,MAAM,GAAAC,IAAyB,CAAAJ,IAAA,CAAAK,IAAA;EAC/B,OAAIC,UAAK,CAAAC,IAAA,CAAAJ,MAAA,YAAAK,CAAA;IACT,OAAOA,CAAA,CAAAC,UAAW;EAChB;AACA;AACA,SAAIC,iBAAAC,KAAA;EACJ,IAAAC,OAAI;EACJ,IAAAC,EAAI;EACF,OAAAA,EAAA,GAAMF,KAAM,CAAApB,MAAA;IACZ,IAAAuB,GAAA,GAAMH,KAAA,CAAQE,EAAA;IACd,MAAIC,GAAA,MAAQ,GAAK,UAAS1B,KAAA;IAAA,IAAA2B,GAAA,QACjB;IAA2D,IAAAxB,MAAA,GAC3D;IACP,IAAAuB,GAAA,OAAS;MACTC,GAAA,GAAAD,GAAM;MACR,IAAAE,KAAO,GAAAL,KAAU,CAAAE,EAAA,GAAM;MACzB,IAAAG,KAAO,QAAAzB,MAAA,GAAAyB,KAAA,MACL,IAAOA,KAAO,GAAK,KAAAzB,MAAA,IAAAyB,KAAA,eAAAL,KAAA,CAAAE,EAAA,eACnB,IAAMG,KAAQ,KAAG,GAAI,EAAE;QACvBzB,MAAI,OAAS0B,QAAW,CAAAN,KAAM,CAAAO,MAAI,EAAMP,KAAA,CAAAQ,UAAA,GAAAN,EAAA,KAAAO,SAAA;QACxCP,EAAA,KAAS;MACT,aAAa,IAAGzB,KAAI,0DAA6C;IACnE;MACA2B,GAAI,GAAAD,GAAK,QAAS;MAClB,IAAIO,IAAA,GAAQ,CACZ,GACF,GACA,CAAO,CACT,CAAAP,GAAA;MAGA,IAASO,IAAA,UAAW,SAAoB,IAAyDjC,KAAA;MAC3FG,MAAA,GAAQ;MACV,KAAM,IAAI+B,CAAA,MAAAA,CAAA,GAAAD,IAAA,EAAAC,CAAA,IAAA/B,MAAA,GAAAA,MAAA,SAAAoB,KAAA,CAAAE,EAAA;IAAA;IAEV,IAAAA,EAAA,GAAAtB,MAAA,GAAAoB,KAAA,CAAApB,MAAA,YAAAH,KAAA;IACF,IAAA2B,GAAA,QAAAH,OAAA,CAAAW,IAAA,CAAAZ,KAAA,CAAAa,QAAA,CAAAX,EAAA,EAAAA,EAAA,GAAAtB,MAAA;IACAsB,EAAA,IAAMtB,MAAA;EACN;EACE,OAAAqB,OAAU;AAAgF;AAE5F,SAAMa,UAAOA,CAAAC,MAAO,EAAAC,OAAS;EAC7B,IAAID,MAAO,QAAM,GAAI;IACrB,MAAM,IAAAtC,KAAA,CAAY,aAAcsC,MAAK,GAAK,2DAAQ;EAClD;EACA,IAAAE,OAAM,GAAAF,MAAS;EACf,IAAIE,OAAA,KAAS,CAAI,IAAAA,OAAO,KAAQ;IAEhC,MAAM,IAAAxC,KACJ,yBACQwC,OAAc,CAAAC,QAAA;EAAA;EAElB,IACAC,IAAA,GAAAhD,MAAA,CAAA4C,MAAA;EACN,KAAAI,IAAM,QAAU,IAAI1C,KAAA,uBAAYsC,MAAA;EAChC,IAAAK,SAAa,QAAAL,MAAA,WAAAA,MAAA;EACb,IAAAM,cAAa,GAAAN,MAAA,CAAAK,SAAA,SAAAL,MAAA,CAAAK,SAAA;EACb,IAAIE,MAAA,GAASF,SAAQ,OAAQC,cAAa;EAC1C,IAAAC,MAAM,IAAQ,GAAAP,MAAI,CAAAnC,MAAW,QAAK,IAAAH,KAAS,wCAA0B;EACrE,IAAA8C,IAAM,GAAIN,OAAO,aAAAO,WAAA,GAAAC,MAAA,KAAAC,WAAA,GAAAC,MAAA,CAAAX,OAAA,EAAAY,OAAA,iBAAAA,OAAA,mBAAAZ,OAAA;EACjB,IAAAa,OAAU,OAAOlC,UAAS,CAAG;EAC7BkC,OAAM,GAAI;EACVA,OAAM,SAAS;EACf,IAAAvB,QAAS,CAAAuB,OAAO,CAAMtB,MAAK,EAAAuB,SAAY,IAAAV,SAAc;EACvD,IAAAW,KAAA,OAAApC,UAAA,CAAA4B,IAAA,CAAA3C,MAAA,GAAAwC,SAAA,GAAAS,OAAA,CAAAjD,MAAA;EAMOmD,KAAA,CAAAC,GAAS,CAAAT,IAAA;EACdQ,KAAA,CAAMC,GAAA,CAAAjB,MAAU,CAAAF,QAAA,IAAAO,SAAiB,GAAQG,IAAI,CAAC3C,MAAA;EAC9CmD,KAAK,CAAAC,GAAA,CAAAH,OAAQ,EAAAN,IAAQ,CAAA3C,MAAM,GAAIwC,SAAM;EACrC,IAAAa,MAAM,GAAAd,IAAQ,CAAIY,KAAA;EAClB,OAAO,CACLhB,MAAM,CAACO,MAAA,KAAU,IAAAP,MAAU,CAAAO,MAAA,GAAW,IACtCW,MAAA,CAAO,UAAAA,MAAa,IACrB;AACH","ignoreList":[]}

package/dist/esm/signer.mjs

@@ -0,0 +1,88 @@
+import { useSyncExternalStore } from "react";
+import { gpgSignatureCovers } from "./signature.mjs";
+import { gpgSignatureCovers as gpgSignatureCovers2 } from "./signature.mjs";
+const GPG_SIGNATURE_BEGIN = "-----BEGIN PGP SIGNATURE-----";
+const GPG_PUBLIC_KEY_BEGIN = "-----BEGIN PGP PUBLIC KEY BLOCK-----";
+function gpgSignCommand(message) {
+  return `{ printf %s '${message.replace(/'/g, "'\\''")}' | gpg --detach-sign --armor; gpg --armor --export; }`;
+}
+function assertGpgSignature(blob) {
+  const trimmed = blob.trim();
+  if (!trimmed.includes(GPG_SIGNATURE_BEGIN) || !trimmed.includes(GPG_PUBLIC_KEY_BEGIN)) {
+    throw new Error("Paste the FULL output \u2014 it must contain both a PGP SIGNATURE and a PUBLIC KEY block.");
+  }
+  return trimmed;
+}
+function createGpgSigner() {
+  let pending = null;
+  let settle = null;
+  const listeners = /* @__PURE__ */new Set();
+  const emit = () => {
+    for (const listener of listeners) listener();
+  };
+  const signer = {
+    family: "gpg",
+    address: null,
+    capabilities: ["signMessage"],
+    get pending() {
+      return pending;
+    },
+    signMessage(message) {
+      settle?.reject(new Error("GPG signing was superseded by a newer request"));
+      return new Promise((resolve, reject) => {
+        settle = {
+          resolve,
+          reject
+        };
+        pending = {
+          message,
+          command: gpgSignCommand(message)
+        };
+        emit();
+      });
+    },
+    submit(blob, request) {
+      if (!settle || !pending) throw new Error("No GPG signature was requested");
+      if (request !== pending) {
+        throw new Error("That GPG request was superseded; run the current command and paste its output");
+      }
+      const signature = assertGpgSignature(blob);
+      if (!gpgSignatureCovers(signature, pending.message)) {
+        throw new Error("That signature is over a different message; run the current command and paste its output");
+      }
+      const {
+        resolve
+      } = settle;
+      settle = null;
+      pending = null;
+      emit();
+      resolve(signature);
+    },
+    cancel(reason) {
+      if (!settle) return;
+      const {
+        reject
+      } = settle;
+      settle = null;
+      pending = null;
+      emit();
+      reject(reason ?? new Error("GPG signing was cancelled"));
+    },
+    subscribe(listener) {
+      listeners.add(listener);
+      return () => listeners.delete(listener);
+    }
+  };
+  return signer;
+}
+function useGpgSigner(signer = defaultSigner()) {
+  useSyncExternalStore(signer.subscribe, () => signer.pending, () => signer.pending);
+  return signer;
+}
+let sharedSigner = null;
+function defaultSigner() {
+  sharedSigner ??= createGpgSigner();
+  return sharedSigner;
+}
+export { GPG_PUBLIC_KEY_BEGIN, GPG_SIGNATURE_BEGIN, assertGpgSignature, createGpgSigner, gpgSignCommand, gpgSignatureCovers2 as gpgSignatureCovers, useGpgSigner };
+//# sourceMappingURL=signer.mjs.map

package/dist/esm/signer.mjs.map

@@ -0,0 +1 @@
+{"version":3,"names":["useSyncExternalStore","gpgSignatureCovers","gpgSignatureCovers2","GPG_SIGNATURE_BEGIN","GPG_PUBLIC_KEY_BEGIN","gpgSignCommand","message","replace","assertGpgSignature","blob","trimmed","trim","includes","Error","createGpgSigner","pending","settle","listeners","Set","emit","listener","signer","family","address","capabilities","signMessage","reject","Promise","resolve","command","submit","request","signature","cancel","reason","subscribe","add","delete","useGpgSigner","defaultSigner","sharedSigner"],"sources":["../../src/signer.ts"],"sourcesContent":[null],"mappings":"AAAA,SAASA,oBAAA,QAA4B;AACrC,SAASC,kBAAA,QAA0B;AAEnC,SAASA,kBAAA,IAAAC,mBAAA,QAA0B;AAS5B,MAAMC,mBAAA,GAAsB;AAC5B,MAAMC,oBAAA,GAAuB;AAQ7B,SAASC,eAAeC,OAAA,EAAyB;EACtD,OAAO,gBAAgBA,OAAA,CAAQC,OAAA,CAAQ,MAAM,OAAO,CAAC;AACvD;AAGO,SAASC,mBAAmBC,IAAA,EAAsB;EACvD,MAAMC,OAAA,GAAUD,IAAA,CAAKE,IAAA,CAAK;EAC1B,IAAI,CAACD,OAAA,CAAQE,QAAA,CAAST,mBAAmB,KAAK,CAACO,OAAA,CAAQE,QAAA,CAASR,oBAAoB,GAAG;IACrF,MAAM,IAAIS,KAAA,CACR,2FACF;EACF;EACA,OAAOH,OAAA;AACT;AA+BO,SAASI,gBAAA,EAA6B;EAC3C,IAAIC,OAAA,GAAiC;EACrC,IAAIC,MAAA,GAAqF;EACzF,MAAMC,SAAA,GAAY,mBAAIC,GAAA,CAAgB;EACtC,MAAMC,IAAA,GAAOA,CAAA,KAAM;IACjB,WAAWC,QAAA,IAAYH,SAAA,EAAWG,QAAA,CAAS;EAC7C;EAEA,MAAMC,MAAA,GAAoB;IACxBC,MAAA,EAAQ;IACRC,OAAA,EAAS;IACTC,YAAA,EAAc,CAAC,aAAa;IAC5B,IAAIT,QAAA,EAAU;MACZ,OAAOA,OAAA;IACT;IACAU,YAAYnB,OAAA,EAAS;MACnBU,MAAA,EAAQU,MAAA,CAAO,IAAIb,KAAA,CAAM,+CAA+C,CAAC;MACzE,OAAO,IAAIc,OAAA,CAAgB,CAACC,OAAA,EAASF,MAAA,KAAW;QAC9CV,MAAA,GAAS;UAAEY,OAAA;UAASF;QAAO;QAC3BX,OAAA,GAAU;UAAET,OAAA;UAASuB,OAAA,EAASxB,cAAA,CAAeC,OAAO;QAAE;QACtDa,IAAA,CAAK;MACP,CAAC;IACH;IACAW,OAAOrB,IAAA,EAAMsB,OAAA,EAAS;MACpB,IAAI,CAACf,MAAA,IAAU,CAACD,OAAA,EAAS,MAAM,IAAIF,KAAA,CAAM,gCAAgC;MACzE,IAAIkB,OAAA,KAAYhB,OAAA,EAAS;QACvB,MAAM,IAAIF,KAAA,CACR,+EACF;MACF;MACA,MAAMmB,SAAA,GAAYxB,kBAAA,CAAmBC,IAAI;MACzC,IAAI,CAACR,kBAAA,CAAmB+B,SAAA,EAAWjB,OAAA,CAAQT,OAAO,GAAG;QACnD,MAAM,IAAIO,KAAA,CACR,0FACF;MACF;MACA,MAAM;QAAEe;MAAQ,IAAIZ,MAAA;MACpBA,MAAA,GAAS;MACTD,OAAA,GAAU;MACVI,IAAA,CAAK;MACLS,OAAA,CAAQI,SAAS;IACnB;IACAC,OAAOC,MAAA,EAAQ;MACb,IAAI,CAAClB,MAAA,EAAQ;MACb,MAAM;QAAEU;MAAO,IAAIV,MAAA;MACnBA,MAAA,GAAS;MACTD,OAAA,GAAU;MACVI,IAAA,CAAK;MACLO,MAAA,CAAOQ,MAAA,IAAU,IAAIrB,KAAA,CAAM,2BAA2B,CAAC;IACzD;IACAsB,UAAUf,QAAA,EAAU;MAClBH,SAAA,CAAUmB,GAAA,CAAIhB,QAAQ;MACtB,OAAO,MAAMH,SAAA,CAAUoB,MAAA,CAAOjB,QAAQ;IACxC;EACF;EACA,OAAOC,MAAA;AACT;AAOO,SAASiB,aAAajB,MAAA,GAAoBkB,aAAA,CAAc,GAAc;EAC3EvC,oBAAA,CACEqB,MAAA,CAAOc,SAAA,EACP,MAAMd,MAAA,CAAON,OAAA,EACb,MAAMM,MAAA,CAAON,OACf;EACA,OAAOM,MAAA;AACT;AAEA,IAAImB,YAAA,GAAiC;AACrC,SAASD,cAAA,EAA2B;EAClCC,YAAA,KAAiB1B,eAAA,CAAgB;EACjC,OAAO0B,YAAA;AACT","ignoreList":[]}

package/dist/esm/signer.native.js

@@ -0,0 +1,116 @@
+import { useSyncExternalStore } from "react";
+import { gpgSignatureCovers } from "./signature.native.js";
+import { gpgSignatureCovers as gpgSignatureCovers2 } from "./signature.native.js";
+var GPG_SIGNATURE_BEGIN = "-----BEGIN PGP SIGNATURE-----";
+var GPG_PUBLIC_KEY_BEGIN = "-----BEGIN PGP PUBLIC KEY BLOCK-----";
+function gpgSignCommand(message) {
+  return `{ printf %s '${message.replace(/'/g, "'\\''")}' | gpg --detach-sign --armor; gpg --armor --export; }`;
+}
+function assertGpgSignature(blob) {
+  var trimmed = blob.trim();
+  if (!trimmed.includes(GPG_SIGNATURE_BEGIN) || !trimmed.includes(GPG_PUBLIC_KEY_BEGIN)) {
+    throw new Error("Paste the FULL output \u2014 it must contain both a PGP SIGNATURE and a PUBLIC KEY block.");
+  }
+  return trimmed;
+}
+function createGpgSigner() {
+  var pending = null;
+  var settle = null;
+  var listeners = /* @__PURE__ */new Set();
+  var emit = function emit2() {
+    var _iteratorNormalCompletion = true,
+      _didIteratorError = false,
+      _iteratorError = void 0;
+    try {
+      for (var _iterator = listeners[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true) {
+        var listener = _step.value;
+        listener();
+      }
+    } catch (err) {
+      _didIteratorError = true;
+      _iteratorError = err;
+    } finally {
+      try {
+        if (!_iteratorNormalCompletion && _iterator.return != null) {
+          _iterator.return();
+        }
+      } finally {
+        if (_didIteratorError) {
+          throw _iteratorError;
+        }
+      }
+    }
+  };
+  var signer = {
+    family: "gpg",
+    address: null,
+    capabilities: ["signMessage"],
+    get pending() {
+      return pending;
+    },
+    signMessage(message) {
+      settle === null || settle === void 0 ? void 0 : settle.reject(new Error("GPG signing was superseded by a newer request"));
+      return new Promise(function (resolve, reject) {
+        settle = {
+          resolve,
+          reject
+        };
+        pending = {
+          message,
+          command: gpgSignCommand(message)
+        };
+        emit();
+      });
+    },
+    submit(blob, request) {
+      if (!settle || !pending) throw new Error("No GPG signature was requested");
+      if (request !== pending) {
+        throw new Error("That GPG request was superseded; run the current command and paste its output");
+      }
+      var signature = assertGpgSignature(blob);
+      if (!gpgSignatureCovers(signature, pending.message)) {
+        throw new Error("That signature is over a different message; run the current command and paste its output");
+      }
+      var {
+        resolve
+      } = settle;
+      settle = null;
+      pending = null;
+      emit();
+      resolve(signature);
+    },
+    cancel(reason) {
+      if (!settle) return;
+      var {
+        reject
+      } = settle;
+      settle = null;
+      pending = null;
+      emit();
+      reject(reason !== null && reason !== void 0 ? reason : new Error("GPG signing was cancelled"));
+    },
+    subscribe(listener) {
+      listeners.add(listener);
+      return function () {
+        return listeners.delete(listener);
+      };
+    }
+  };
+  return signer;
+}
+function useGpgSigner() {
+  var signer = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : defaultSigner();
+  useSyncExternalStore(signer.subscribe, function () {
+    return signer.pending;
+  }, function () {
+    return signer.pending;
+  });
+  return signer;
+}
+var sharedSigner = null;
+function defaultSigner() {
+  sharedSigner !== null && sharedSigner !== void 0 ? sharedSigner : sharedSigner = createGpgSigner();
+  return sharedSigner;
+}
+export { GPG_PUBLIC_KEY_BEGIN, GPG_SIGNATURE_BEGIN, assertGpgSignature, createGpgSigner, gpgSignCommand, gpgSignatureCovers2 as gpgSignatureCovers, useGpgSigner };
+//# sourceMappingURL=signer.native.js.map

package/dist/esm/signer.native.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["useSyncExternalStore","gpgSignatureCovers","gpgSignatureCovers2","GPG_SIGNATURE_BEGIN","GPG_PUBLIC_KEY_BEGIN","gpgSignCommand","message","replace","assertGpgSignature","blob","trimmed","trim","includes","Error","createGpgSigner","pending","settle","listeners","Set","emit","emit2","_iteratorNormalCompletion","_didIteratorError","_iteratorError","_iterator","Symbol","iterator","_step","next","done","listener","value","err","return","signer","family","address","capabilities","signMessage","reject","Promise","resolve","command","submit","request","signature","cancel","reason"],"sources":["../../src/signer.ts"],"sourcesContent":[null],"mappings":"AAAA,SAASA,oBAAA,QAA4B;AACrC,SAASC,kBAAA,QAA0B;AAEnC,SAASA,kBAAA,IAAAC,mBAAA,QAA0B;AAS5B,IAAAC,mBAAM,kCAAsB;AAC5B,IAAAC,oBAAM,yCAAuB;AAQ7B,SAASC,eAAeC,OAAA,EAAyB;EACtD,OAAO,gBAAgBA,OAAA,CAAQC,OAAA,CAAQ,MAAM,OAAO,CAAC;AACvD;AAGO,SAASC,mBAAmBC,IAAA,EAAsB;EACvD,IAAAC,OAAM,GAAAD,IAAU,CAAAE,IAAK;EACrB,IAAI,CAACD,OAAA,CAAQE,QAAA,CAAST,mBAAmB,KAAK,CAACO,OAAA,CAAQE,QAAA,CAASR,oBAAoB,GAAG;IACrF,MAAM,IAAIS,KAAA;EAAA;EACR,OACFH,OAAA;AAAA;AAEF,SAAOI,gBAAA;EACT,IAAAC,OAAA;EA+BO,IAAAC,MAAS;EACd,IAAIC,SAAA,GAAiC,mBAAAC,GAAA;EACrC,IAAIC,IAAA,YAAqFC,MAAA;IACzF,IAAMC,yBAAY,OAAI;MAAAC,iBAAgB;MAAAC,cAAA;IACtC,IAAM;MACJ,SAAWC,SAAA,GAAYP,SAAA,CAAWQ,MAAA,CAAAC,QAAS,KAAAC,KAAA,IAAAN,yBAAA,IAAAM,KAAA,GAAAH,SAAA,CAAAI,IAAA,IAAAC,IAAA,GAAAR,yBAAA;QAC7C,IAAAS,QAAA,GAAAH,KAAA,CAAAI,KAAA;QAEMD,QAAA,CAAoB;MACxB;IACA,SAASE,GAAA;MACTV,iBAAe;MACfC,cAAc,GAAAS,GAAA;IACZ,UAAO;MACT;QACA,KAAAX,yBAAqB,IAAAG,SAAA,CAAAS,MAAA;UACnBT,SAAQ,CAAAS,MAAW;QACnB;MACE;QACA,IAAAX,iBAAqB;UACrB,MAAKC,cAAA;QACN;MACH;IACA;EACE;EACA,IAAAW,MAAI;IACFC,MAAA,OAAM;IAAIC,OACR;IAAAC,YACF,GACF,cACA;IACA,IAAAtB,OAAKA,CAAA;MACH,OAAAA,OAAU;IAAA;IACRuB,WACFA,CAAAhC,OAAA;MACFU,MAAA,aAAAA,MAAA,uBAAAA,MAAA,CAAAuB,MAAA,KAAA1B,KAAA;MACA,OAAM,IAAE2B,OAAQ,WAAIC,OAAA,EAAAF,MAAA;QACpBvB,MAAA,GAAS;UACTyB,OAAU;UACVF;QACA;QACFxB,OAAA;UACAT,OAAO;UACDoC,OAAC,EAAQrC,cAAA,CAAAC,OAAA;QACb;QACAa,IAAA;MACA;IACA;IACAwB,OAAAlC,IAAO,EAAAmC,OAAU;MACnB,KAAA5B,MAAA,KAAAD,OAAA,YAAAF,KAAA;MACA,IAAA+B,OAAU,KAAA7B,OAAU;QAClB,UAAUF,KAAI,gFAAQ;MACtB;MACF,IAAAgC,SAAA,GAAArC,kBAAA,CAAAC,IAAA;MACF,KAAAR,kBAAA,CAAA4C,SAAA,EAAA9B,OAAA,CAAAT,OAAA;QACA,MAAO,IAAAO,KAAA;MACT;MAOO,IAAS;QAAA4B;MAAA,IAAazB,MAAA;MAC3BA,MAAA;MACED,OAAO;MACPI,IAAM;MACNsB,OAAM,CAAAI,SAAO;IACf;IACAC,MAAOA,CAAAC,MAAA;MACT,KAAA/B,MAAA;MAEI;QAAAuB;MAAiC,IAAAvB,MAAA;MACrCA,MAAS;MACPD,OAAA,OAAiB;MACjBI,IAAO;MACToB,MAAA,CAAAQ,MAAA,aAAAA,MAAA,cAAAA,MAAA,OAAAlC,KAAA","ignoreList":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@multiplatform.one/gpg",
-  "version": "7.17.0",
+  "version": "7.19.0",
   "description": "Sign-In With GPG (SIWG) screen + GpgProvider for the connectkit modal — no viem",
   "keywords": [
     "connectkit",
@@ -49,16 +49,29 @@
       "types": "./types/index.d.ts",
       "import": "./dist/esm/index.mjs",
       "require": "./dist/cjs/index.cjs"
+    },
+    "./signer": {
+      "source": "./src/signer.ts",
+      "react-native": {
+        "types": "./types/signer.d.ts",
+        "import": "./src/signer.ts",
+        "require": "./src/signer.ts",
+        "default": "./src/signer.ts"
+      },
+      "types": "./types/signer.d.ts",
+      "import": "./dist/esm/signer.mjs",
+      "require": "./dist/cjs/signer.cjs"
     }
   },
   "publishConfig": {
     "access": "public"
   },
   "dependencies": {
-    "@multiplatform.one/connectkit": "7.17.0"
+    "@multiplatform.one/connectkit": "7.19.0",
+    "@noble/hashes": "^1.8.0"
   },
   "devDependencies": {
-    "@multiplatform.one/config": "7.17.0",
+    "@multiplatform.one/config": "7.19.0",
     "@tamagui/build": "2.7.6",
     "react": "19.2.5",
     "typescript": "~5.9.3"

package/src/GpgIcon.tsx

@@ -0,0 +1,20 @@
+import React from "react";
+
+// The GPG row's icon in the wallet list: a key on GnuPG blue, filling the row's
+// icon box like the wallet logos beside it.
+export const GpgIcon: React.FC = () => (
+  <svg
+    xmlns="http://www.w3.org/2000/svg"
+    width="100%"
+    height="100%"
+    viewBox="0 0 32 32"
+    aria-hidden="true"
+  >
+    <rect width="32" height="32" fill="#0093DD" />
+    <g fill="none" stroke="#FFFFFF" strokeWidth="2.2" strokeLinecap="round" strokeLinejoin="round">
+      <circle cx="11.5" cy="19.5" r="4.5" />
+      <path d="m14.7 16.3 9.3-9.3" />
+      <path d="m20 11 3 3 2.5-2.5-3-3" />
+    </g>
+  </svg>
+);

package/src/GpgProvider.tsx

@@ -3,6 +3,7 @@ import { useQuery } from "@tanstack/react-query";
 
 import { Context as ConnectKitContext } from "@multiplatform.one/connectkit";
 import { GpgContext, GpgConfig, GpgStatusState } from "./GpgContext";
+import { assertGpgSignature, gpgSignCommand } from "./signer";
 
 type Props = GpgConfig & {
   children: ReactNode;
@@ -71,28 +72,15 @@ export const GpgProvider = ({
       nonce.data ? (buildMessageRef.current ?? defaultBuildMessage)({ nonce: nonce.data }) : null,
     [nonce.data],
   );
-  // The ready-to-run terminal command: detached armored signature + the exported public
-  // key, concatenated — exactly the blob the user pastes back. printf %s (no newline) so
-  // the signed bytes are byte-identical to `message`. Single quotes in the message are
-  // POSIX-escaped ('\'' ) so a custom buildMessage can't break out of the quoting.
-  const command = useMemo(
-    () =>
-      message
-        ? `{ printf %s '${message.replace(/'/g, "'\\''")}' | gpg --detach-sign --armor; gpg --armor --export; }`
-        : null,
-    [message],
-  );
+  const command = useMemo(() => (message ? gpgSignCommand(message) : null), [message]);
 
   const signIn = async (pastedBlob: string): Promise<boolean> => {
-    const blob = pastedBlob.trim();
-    if (
-      !blob.includes("-----BEGIN PGP SIGNATURE-----") ||
-      !blob.includes("-----BEGIN PGP PUBLIC KEY BLOCK-----")
-    ) {
+    let blob: string;
+    try {
+      blob = assertGpgSignature(pastedBlob);
+    } catch (error) {
       setStatus(GpgStatusState.ERROR);
-      throw new Error(
-        "Paste the FULL output — it must contain both a PGP SIGNATURE and a PUBLIC KEY block.",
-      );
+      throw error;
     }
     if (!message) {
       setStatus(GpgStatusState.ERROR);

package/src/index.ts

@@ -2,8 +2,17 @@
 //
 // A connection-free signer: the user signs a challenge in their terminal and pastes
 // the result back. Pulls in NO wagmi/viem — depends only on @multiplatform.one/connectkit
-// — so a GPG-only app can install it without the wallet stack.
+// and @noble/hashes — so a GPG-only app can install it without the wallet stack.
 export { useGpg } from "./useGpg";
+export {
+  createGpgSigner,
+  useGpgSigner,
+  gpgSignCommand,
+  assertGpgSignature,
+  gpgSignatureCovers,
+  type GpgSigner,
+  type GpgSignRequest,
+} from "./signer";
 export { GpgProvider, GPG_NONCE_QUERY_KEY } from "./GpgProvider";
 export { GpgContext, GpgStatusState } from "./GpgContext";
 export type { GpgConfig, GpgContextValue } from "./GpgContext";

package/src/screens.tsx

@@ -9,16 +9,26 @@ import {
 import { useContext as useReactContext } from "react";
 import SignInWithGpg from "./SignInWithGpg";
 import { GpgContext } from "./GpgContext";
+import { GpgIcon } from "./GpgIcon";
 
 // The GPG screen contributed to connectkit's signer-agnostic modal. GPG has no
 // connect step, so it's available in both connected and disconnected states.
+// With a wallet bridge it is also a row in the wallet list, next to MetaMask and
+// Phantom, and while disconnected its back chevron returns to that list. A
+// gpg-only host has no list (no `connected` in its state), so no back there.
 export const gpgScreen: ScreenDef = {
   id: routes.SIGNINWITHGPG,
   component: SignInWithGpg,
   heading: "Sign in with GPG",
   availableWhen: () => true,
-  showBack: false,
+  showBack: (state) => state.connected === false,
+  onBack: (api) => api.setRoute(routes.CONNECTORS),
   showInfo: false,
+  listEntry: {
+    name: "GPG",
+    icon: <GpgIcon />,
+    visibleWhen: (state) => !!state.signInWithGpg,
+  },
 };
 
 /**