@multiplatform.one/gpg 7.18.0 → 7.20.0

package/dist/esm/signature.native.js

@@ -0,0 +1,96 @@
+import { ripemd160, sha1 } from "@noble/hashes/legacy.js";
+import { sha224, sha256, sha384, sha512 } from "@noble/hashes/sha2.js";
+var BEGIN = "-----BEGIN PGP SIGNATURE-----";
+var END = "-----END PGP SIGNATURE-----";
+var hashes = {
+  2: sha1,
+  3: ripemd160,
+  8: sha256,
+  9: sha384,
+  10: sha512,
+  11: sha224
+};
+function dearmor(text) {
+  var start = text.indexOf(BEGIN);
+  var end = text.indexOf(END, start);
+  if (start < 0 || end < 0) throw new Error("No PGP SIGNATURE block in the paste");
+  var lines = text.slice(start + BEGIN.length, end).split(/\r?\n/).map(function (line) {
+    return line.trim();
+  });
+  var blank = lines.indexOf("", 1);
+  var hasHeaders = lines.slice(1, blank < 0 ? 0 : blank).some(function (line) {
+    return line.includes(": ");
+  });
+  var body = (hasHeaders ? lines.slice(blank) : lines).filter(function (line) {
+    return line && !/^=[A-Za-z0-9+/]{4}$/.test(line);
+  });
+  var binary = atob(body.join(""));
+  return Uint8Array.from(binary, function (c) {
+    return c.charCodeAt(0);
+  });
+}
+function signaturePackets(bytes) {
+  var packets = [];
+  var at = 0;
+  while (at < bytes.length) {
+    var ctb = bytes[at++];
+    if (!(ctb & 128)) throw new Error("The PGP SIGNATURE block is not OpenPGP data");
+    var tag = void 0;
+    var length = void 0;
+    if (ctb & 64) {
+      tag = ctb & 63;
+      var first = bytes[at++];
+      if (first < 192) length = first;else if (first < 224) length = (first - 192 << 8) + bytes[at++] + 192;else if (first === 255) {
+        length = new DataView(bytes.buffer, bytes.byteOffset + at, 4).getUint32(0);
+        at += 4;
+      } else throw new Error("Partial-length PGP packets are not a detached signature");
+    } else {
+      tag = ctb >> 2 & 15;
+      var size = [1, 2, 4][ctb & 3];
+      if (size === void 0) throw new Error("Indeterminate-length PGP packets are not supported");
+      length = 0;
+      for (var i = 0; i < size; i++) length = length * 256 + bytes[at++];
+    }
+    if (at + length > bytes.length) throw new Error("The PGP SIGNATURE block is truncated");
+    if (tag === 2) packets.push(bytes.subarray(at, at + length));
+    at += length;
+  }
+  return packets;
+}
+function quickCheck(packet, message) {
+  if (packet[0] !== 4) {
+    throw new Error(`A version ${packet[0]} PGP signature cannot be checked here; sign with a v4 key`);
+  }
+  var sigType = packet[1];
+  if (sigType !== 0 && sigType !== 1) {
+    throw new Error(`PGP signature type 0x${sigType.toString(16)} is not a document signature`);
+  }
+  var hash = hashes[packet[3]];
+  if (!hash) throw new Error(`PGP hash algorithm ${packet[3]} is not supported`);
+  var hashedEnd = 6 + (packet[4] << 8 | packet[5]);
+  var unhashedLength = packet[hashedEnd] << 8 | packet[hashedEnd + 1];
+  var left16 = hashedEnd + 2 + unhashedLength;
+  if (left16 + 2 > packet.length) throw new Error("The PGP signature packet is truncated");
+  var data = sigType === 1 ? new TextEncoder().encode(new TextDecoder().decode(message).replace(/\r?\n/g, "\n").replace(/\n/g, "\r\n")) : message;
+  var trailer = new Uint8Array(6);
+  trailer[0] = 4;
+  trailer[1] = 255;
+  new DataView(trailer.buffer).setUint32(2, hashedEnd);
+  var input = new Uint8Array(data.length + hashedEnd + trailer.length);
+  input.set(data, 0);
+  input.set(packet.subarray(0, hashedEnd), data.length);
+  input.set(trailer, data.length + hashedEnd);
+  var digest = hash(input);
+  return [packet[left16] << 8 | packet[left16 + 1], digest[0] << 8 | digest[1]];
+}
+function gpgSignatureCovers(blob, message) {
+  var packets = signaturePackets(dearmor(blob));
+  if (!packets.length) throw new Error("The PGP SIGNATURE block holds no signature");
+  var bytes = new TextEncoder().encode(message);
+  return packets.every(function (packet) {
+    var [expected, actual] = quickCheck(packet, bytes);
+    return expected === actual;
+  });
+}
+export { gpgSignatureCovers };
+//# sourceMappingURL=signature.native.js.map

package/dist/esm/signature.native.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["ripemd160","sha1","sha224","sha256","sha384","sha512","BEGIN","END","hashes","dearmor","text","start","indexOf","end","Error","lines","slice","length","split","map","line","trim","blank","hasHeaders","some","includes","body","filter","test","binary","atob","join","Uint8Array","from","c","charCodeAt","signaturePackets","bytes","packets","at","ctb","tag","first","DataView","buffer","byteOffset","getUint32","size","i","push","subarray","quickCheck","packet","message","sigType","toString","hash","hashedEnd","unhashedLength","left16","data","TextEncoder","encode","TextDecoder","decode","replace","trailer","setUint32","input","set","digest","gpgSignatureCovers","blob","every","expected","actual"],"sources":["signature.native.js"],"sourcesContent":["import { ripemd160, sha1 } from \"@noble/hashes/legacy.js\";\nimport { sha224, sha256, sha384, sha512 } from \"@noble/hashes/sha2.js\";\nvar BEGIN = \"-----BEGIN PGP SIGNATURE-----\";\nvar END = \"-----END PGP SIGNATURE-----\";\nvar hashes = {\n  2: sha1,\n  3: ripemd160,\n  8: sha256,\n  9: sha384,\n  10: sha512,\n  11: sha224\n};\nfunction dearmor(text) {\n  var start = text.indexOf(BEGIN);\n  var end = text.indexOf(END, start);\n  if (start < 0 || end < 0) throw new Error(\"No PGP SIGNATURE block in the paste\");\n  var lines = text.slice(start + BEGIN.length, end).split(/\\r?\\n/).map(function(line) {\n    return line.trim();\n  });\n  var blank = lines.indexOf(\"\", 1);\n  var hasHeaders = lines.slice(1, blank < 0 ? 0 : blank).some(function(line) {\n    return line.includes(\": \");\n  });\n  var body = (hasHeaders ? lines.slice(blank) : lines).filter(function(line) {\n    return line && !/^=[A-Za-z0-9+/]{4}$/.test(line);\n  });\n  var binary = atob(body.join(\"\"));\n  return Uint8Array.from(binary, function(c) {\n    return c.charCodeAt(0);\n  });\n}\nfunction signaturePackets(bytes) {\n  var packets = [];\n  var at = 0;\n  while (at < bytes.length) {\n    var ctb = bytes[at++];\n    if (!(ctb & 128)) throw new Error(\"The PGP SIGNATURE block is not OpenPGP data\");\n    var tag = void 0;\n    var length = void 0;\n    if (ctb & 64) {\n      tag = ctb & 63;\n      var first = bytes[at++];\n      if (first < 192) length = first;\n      else if (first < 224) length = (first - 192 << 8) + bytes[at++] + 192;\n      else if (first === 255) {\n        length = new DataView(bytes.buffer, bytes.byteOffset + at, 4).getUint32(0);\n        at += 4;\n      } else throw new Error(\"Partial-length PGP packets are not a detached signature\");\n    } else {\n      tag = ctb >> 2 & 15;\n      var size = [\n        1,\n        2,\n        4\n      ][ctb & 3];\n      if (size === void 0) throw new Error(\"Indeterminate-length PGP packets are not supported\");\n      length = 0;\n      for (var i = 0; i < size; i++) length = length * 256 + bytes[at++];\n    }\n    if (at + length > bytes.length) throw new Error(\"The PGP SIGNATURE block is truncated\");\n    if (tag === 2) packets.push(bytes.subarray(at, at + length));\n    at += length;\n  }\n  return packets;\n}\nfunction quickCheck(packet, message) {\n  if (packet[0] !== 4) {\n    throw new Error(`A version ${packet[0]} PGP signature cannot be checked here; sign with a v4 key`);\n  }\n  var sigType = packet[1];\n  if (sigType !== 0 && sigType !== 1) {\n    throw new Error(`PGP signature type 0x${sigType.toString(16)} is not a document signature`);\n  }\n  var hash = hashes[packet[3]];\n  if (!hash) throw new Error(`PGP hash algorithm ${packet[3]} is not supported`);\n  var hashedEnd = 6 + (packet[4] << 8 | packet[5]);\n  var unhashedLength = packet[hashedEnd] << 8 | packet[hashedEnd + 1];\n  var left16 = hashedEnd + 2 + unhashedLength;\n  if (left16 + 2 > packet.length) throw new Error(\"The PGP signature packet is truncated\");\n  var data = sigType === 1 ? new TextEncoder().encode(new TextDecoder().decode(message).replace(/\\r?\\n/g, \"\\n\").replace(/\\n/g, \"\\r\\n\")) : message;\n  var trailer = new Uint8Array(6);\n  trailer[0] = 4;\n  trailer[1] = 255;\n  new DataView(trailer.buffer).setUint32(2, hashedEnd);\n  var input = new Uint8Array(data.length + hashedEnd + trailer.length);\n  input.set(data, 0);\n  input.set(packet.subarray(0, hashedEnd), data.length);\n  input.set(trailer, data.length + hashedEnd);\n  var digest = hash(input);\n  return [\n    packet[left16] << 8 | packet[left16 + 1],\n    digest[0] << 8 | digest[1]\n  ];\n}\nfunction gpgSignatureCovers(blob, message) {\n  var packets = signaturePackets(dearmor(blob));\n  if (!packets.length) throw new Error(\"The PGP SIGNATURE block holds no signature\");\n  var bytes = new TextEncoder().encode(message);\n  return packets.every(function(packet) {\n    var [expected, actual] = quickCheck(packet, bytes);\n    return expected === actual;\n  });\n}\nexport {\n  gpgSignatureCovers\n};\n//# sourceMappingURL=signature.js.map\n"],"mappings":"AAAA,SAASA,SAAS,EAAEC,IAAI,QAAQ,yBAAyB;AACzD,SAASC,MAAM,EAAEC,MAAM,EAAEC,MAAM,EAAEC,MAAM,QAAQ,uBAAuB;AACtE,IAAIC,KAAK,GAAG,+BAA+B;AAC3C,IAAIC,GAAG,GAAG,6BAA6B;AACvC,IAAIC,MAAM,GAAG;EACX,CAAC,EAAEP,IAAI;EACP,CAAC,EAAED,SAAS;EACZ,CAAC,EAAEG,MAAM;EACT,CAAC,EAAEC,MAAM;EACT,EAAE,EAAEC,MAAM;EACV,EAAE,EAAEH;AACN,CAAC;AACD,SAASO,OAAOA,CAACC,IAAI,EAAE;EACrB,IAAIC,KAAK,GAAGD,IAAI,CAACE,OAAO,CAACN,KAAK,CAAC;EAC/B,IAAIO,GAAG,GAAGH,IAAI,CAACE,OAAO,CAACL,GAAG,EAAEI,KAAK,CAAC;EAClC,IAAIA,KAAK,GAAG,CAAC,IAAIE,GAAG,GAAG,CAAC,EAAE,MAAM,IAAIC,KAAK,CAAC,qCAAqC,CAAC;EAChF,IAAIC,KAAK,GAAGL,IAAI,CAACM,KAAK,CAACL,KAAK,GAAGL,KAAK,CAACW,MAAM,EAAEJ,GAAG,CAAC,CAACK,KAAK,CAAC,OAAO,CAAC,CAACC,GAAG,CAAC,UAASC,IAAI,EAAE;IAClF,OAAOA,IAAI,CAACC,IAAI,CAAC,CAAC;EACpB,CAAC,CAAC;EACF,IAAIC,KAAK,GAAGP,KAAK,CAACH,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;EAChC,IAAIW,UAAU,GAAGR,KAAK,CAACC,KAAK,CAAC,CAAC,EAAEM,KAAK,GAAG,CAAC,GAAG,CAAC,GAAGA,KAAK,CAAC,CAACE,IAAI,CAAC,UAASJ,IAAI,EAAE;IACzE,OAAOA,IAAI,CAACK,QAAQ,CAAC,IAAI,CAAC;EAC5B,CAAC,CAAC;EACF,IAAIC,IAAI,GAAG,CAACH,UAAU,GAAGR,KAAK,CAACC,KAAK,CAACM,KAAK,CAAC,GAAGP,KAAK,EAAEY,MAAM,CAAC,UAASP,IAAI,EAAE;IACzE,OAAOA,IAAI,IAAI,CAAC,qBAAqB,CAACQ,IAAI,CAACR,IAAI,CAAC;EAClD,CAAC,CAAC;EACF,IAAIS,MAAM,GAAGC,IAAI,CAACJ,IAAI,CAACK,IAAI,CAAC,EAAE,CAAC,CAAC;EAChC,OAAOC,UAAU,CAACC,IAAI,CAACJ,MAAM,EAAE,UAASK,CAAC,EAAE;IACzC,OAAOA,CAAC,CAACC,UAAU,CAAC,CAAC,CAAC;EACxB,CAAC,CAAC;AACJ;AACA,SAASC,gBAAgBA,CAACC,KAAK,EAAE;EAC/B,IAAIC,OAAO,GAAG,EAAE;EAChB,IAAIC,EAAE,GAAG,CAAC;EACV,OAAOA,EAAE,GAAGF,KAAK,CAACpB,MAAM,EAAE;IACxB,IAAIuB,GAAG,GAAGH,KAAK,CAACE,EAAE,EAAE,CAAC;IACrB,IAAI,EAAEC,GAAG,GAAG,GAAG,CAAC,EAAE,MAAM,IAAI1B,KAAK,CAAC,6CAA6C,CAAC;IAChF,IAAI2B,GAAG,GAAG,KAAK,CAAC;IAChB,IAAIxB,MAAM,GAAG,KAAK,CAAC;IACnB,IAAIuB,GAAG,GAAG,EAAE,EAAE;MACZC,GAAG,GAAGD,GAAG,GAAG,EAAE;MACd,IAAIE,KAAK,GAAGL,KAAK,CAACE,EAAE,EAAE,CAAC;MACvB,IAAIG,KAAK,GAAG,GAAG,EAAEzB,MAAM,GAAGyB,KAAK,CAAC,KAC3B,IAAIA,KAAK,GAAG,GAAG,EAAEzB,MAAM,GAAG,CAACyB,KAAK,GAAG,GAAG,IAAI,CAAC,IAAIL,KAAK,CAACE,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,KACjE,IAAIG,KAAK,KAAK,GAAG,EAAE;QACtBzB,MAAM,GAAG,IAAI0B,QAAQ,CAACN,KAAK,CAACO,MAAM,EAAEP,KAAK,CAACQ,UAAU,GAAGN,EAAE,EAAE,CAAC,CAAC,CAACO,SAAS,CAAC,CAAC,CAAC;QAC1EP,EAAE,IAAI,CAAC;MACT,CAAC,MAAM,MAAM,IAAIzB,KAAK,CAAC,yDAAyD,CAAC;IACnF,CAAC,MAAM;MACL2B,GAAG,GAAGD,GAAG,IAAI,CAAC,GAAG,EAAE;MACnB,IAAIO,IAAI,GAAG,CACT,CAAC,EACD,CAAC,EACD,CAAC,CACF,CAACP,GAAG,GAAG,CAAC,CAAC;MACV,IAAIO,IAAI,KAAK,KAAK,CAAC,EAAE,MAAM,IAAIjC,KAAK,CAAC,oDAAoD,CAAC;MAC1FG,MAAM,GAAG,CAAC;MACV,KAAK,IAAI+B,CAAC,GAAG,CAAC,EAAEA,CAAC,GAAGD,IAAI,EAAEC,CAAC,EAAE,EAAE/B,MAAM,GAAGA,MAAM,GAAG,GAAG,GAAGoB,KAAK,CAACE,EAAE,EAAE,CAAC;IACpE;IACA,IAAIA,EAAE,GAAGtB,MAAM,GAAGoB,KAAK,CAACpB,MAAM,EAAE,MAAM,IAAIH,KAAK,CAAC,sCAAsC,CAAC;IACvF,IAAI2B,GAAG,KAAK,CAAC,EAAEH,OAAO,CAACW,IAAI,CAACZ,KAAK,CAACa,QAAQ,CAACX,EAAE,EAAEA,EAAE,GAAGtB,MAAM,CAAC,CAAC;IAC5DsB,EAAE,IAAItB,MAAM;EACd;EACA,OAAOqB,OAAO;AAChB;AACA,SAASa,UAAUA,CAACC,MAAM,EAAEC,OAAO,EAAE;EACnC,IAAID,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE;IACnB,MAAM,IAAItC,KAAK,CAAC,aAAasC,MAAM,CAAC,CAAC,CAAC,2DAA2D,CAAC;EACpG;EACA,IAAIE,OAAO,GAAGF,MAAM,CAAC,CAAC,CAAC;EACvB,IAAIE,OAAO,KAAK,CAAC,IAAIA,OAAO,KAAK,CAAC,EAAE;IAClC,MAAM,IAAIxC,KAAK,CAAC,wBAAwBwC,OAAO,CAACC,QAAQ,CAAC,EAAE,CAAC,8BAA8B,CAAC;EAC7F;EACA,IAAIC,IAAI,GAAGhD,MAAM,CAAC4C,MAAM,CAAC,CAAC,CAAC,CAAC;EAC5B,IAAI,CAACI,IAAI,EAAE,MAAM,IAAI1C,KAAK,CAAC,sBAAsBsC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC;EAC9E,IAAIK,SAAS,GAAG,CAAC,IAAIL,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAGA,MAAM,CAAC,CAAC,CAAC,CAAC;EAChD,IAAIM,cAAc,GAAGN,MAAM,CAACK,SAAS,CAAC,IAAI,CAAC,GAAGL,MAAM,CAACK,SAAS,GAAG,CAAC,CAAC;EACnE,IAAIE,MAAM,GAAGF,SAAS,GAAG,CAAC,GAAGC,cAAc;EAC3C,IAAIC,MAAM,GAAG,CAAC,GAAGP,MAAM,CAACnC,MAAM,EAAE,MAAM,IAAIH,KAAK,CAAC,uCAAuC,CAAC;EACxF,IAAI8C,IAAI,GAAGN,OAAO,KAAK,CAAC,GAAG,IAAIO,WAAW,CAAC,CAAC,CAACC,MAAM,CAAC,IAAIC,WAAW,CAAC,CAAC,CAACC,MAAM,CAACX,OAAO,CAAC,CAACY,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAACA,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,GAAGZ,OAAO;EAC/I,IAAIa,OAAO,GAAG,IAAIlC,UAAU,CAAC,CAAC,CAAC;EAC/BkC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;EACdA,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG;EAChB,IAAIvB,QAAQ,CAACuB,OAAO,CAACtB,MAAM,CAAC,CAACuB,SAAS,CAAC,CAAC,EAAEV,SAAS,CAAC;EACpD,IAAIW,KAAK,GAAG,IAAIpC,UAAU,CAAC4B,IAAI,CAAC3C,MAAM,GAAGwC,SAAS,GAAGS,OAAO,CAACjD,MAAM,CAAC;EACpEmD,KAAK,CAACC,GAAG,CAACT,IAAI,EAAE,CAAC,CAAC;EAClBQ,KAAK,CAACC,GAAG,CAACjB,MAAM,CAACF,QAAQ,CAAC,CAAC,EAAEO,SAAS,CAAC,EAAEG,IAAI,CAAC3C,MAAM,CAAC;EACrDmD,KAAK,CAACC,GAAG,CAACH,OAAO,EAAEN,IAAI,CAAC3C,MAAM,GAAGwC,SAAS,CAAC;EAC3C,IAAIa,MAAM,GAAGd,IAAI,CAACY,KAAK,CAAC;EACxB,OAAO,CACLhB,MAAM,CAACO,MAAM,CAAC,IAAI,CAAC,GAAGP,MAAM,CAACO,MAAM,GAAG,CAAC,CAAC,EACxCW,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAGA,MAAM,CAAC,CAAC,CAAC,CAC3B;AACH;AACA,SAASC,kBAAkBA,CAACC,IAAI,EAAEnB,OAAO,EAAE;EACzC,IAAIf,OAAO,GAAGF,gBAAgB,CAAC3B,OAAO,CAAC+D,IAAI,CAAC,CAAC;EAC7C,IAAI,CAAClC,OAAO,CAACrB,MAAM,EAAE,MAAM,IAAIH,KAAK,CAAC,4CAA4C,CAAC;EAClF,IAAIuB,KAAK,GAAG,IAAIwB,WAAW,CAAC,CAAC,CAACC,MAAM,CAACT,OAAO,CAAC;EAC7C,OAAOf,OAAO,CAACmC,KAAK,CAAC,UAASrB,MAAM,EAAE;IACpC,IAAI,CAACsB,QAAQ,EAAEC,MAAM,CAAC,GAAGxB,UAAU,CAACC,MAAM,EAAEf,KAAK,CAAC;IAClD,OAAOqC,QAAQ,KAAKC,MAAM;EAC5B,CAAC,CAAC;AACJ;AACA,SACEJ,kBAAkB","ignoreList":[]}

package/dist/esm/signer.mjs

@@ -0,0 +1,88 @@
+import { useSyncExternalStore } from "react";
+import { gpgSignatureCovers } from "./signature.mjs";
+import { gpgSignatureCovers as gpgSignatureCovers2 } from "./signature.mjs";
+const GPG_SIGNATURE_BEGIN = "-----BEGIN PGP SIGNATURE-----";
+const GPG_PUBLIC_KEY_BEGIN = "-----BEGIN PGP PUBLIC KEY BLOCK-----";
+function gpgSignCommand(message) {
+  return `{ printf %s '${message.replace(/'/g, "'\\''")}' | gpg --detach-sign --armor; gpg --armor --export; }`;
+}
+function assertGpgSignature(blob) {
+  const trimmed = blob.trim();
+  if (!trimmed.includes(GPG_SIGNATURE_BEGIN) || !trimmed.includes(GPG_PUBLIC_KEY_BEGIN)) {
+    throw new Error("Paste the FULL output \u2014 it must contain both a PGP SIGNATURE and a PUBLIC KEY block.");
+  }
+  return trimmed;
+}
+function createGpgSigner() {
+  let pending = null;
+  let settle = null;
+  const listeners = /* @__PURE__ */new Set();
+  const emit = () => {
+    for (const listener of listeners) listener();
+  };
+  const signer = {
+    family: "gpg",
+    address: null,
+    capabilities: ["signMessage"],
+    get pending() {
+      return pending;
+    },
+    signMessage(message) {
+      settle?.reject(new Error("GPG signing was superseded by a newer request"));
+      return new Promise((resolve, reject) => {
+        settle = {
+          resolve,
+          reject
+        };
+        pending = {
+          message,
+          command: gpgSignCommand(message)
+        };
+        emit();
+      });
+    },
+    submit(blob, request) {
+      if (!settle || !pending) throw new Error("No GPG signature was requested");
+      if (request !== pending) {
+        throw new Error("That GPG request was superseded; run the current command and paste its output");
+      }
+      const signature = assertGpgSignature(blob);
+      if (!gpgSignatureCovers(signature, pending.message)) {
+        throw new Error("That signature is over a different message; run the current command and paste its output");
+      }
+      const {
+        resolve
+      } = settle;
+      settle = null;
+      pending = null;
+      emit();
+      resolve(signature);
+    },
+    cancel(reason) {
+      if (!settle) return;
+      const {
+        reject
+      } = settle;
+      settle = null;
+      pending = null;
+      emit();
+      reject(reason ?? new Error("GPG signing was cancelled"));
+    },
+    subscribe(listener) {
+      listeners.add(listener);
+      return () => listeners.delete(listener);
+    }
+  };
+  return signer;
+}
+function useGpgSigner(signer = defaultSigner()) {
+  useSyncExternalStore(signer.subscribe, () => signer.pending, () => signer.pending);
+  return signer;
+}
+let sharedSigner = null;
+function defaultSigner() {
+  sharedSigner ??= createGpgSigner();
+  return sharedSigner;
+}
+export { GPG_PUBLIC_KEY_BEGIN, GPG_SIGNATURE_BEGIN, assertGpgSignature, createGpgSigner, gpgSignCommand, gpgSignatureCovers2 as gpgSignatureCovers, useGpgSigner };
+//# sourceMappingURL=signer.mjs.map

package/dist/esm/signer.mjs.map

@@ -0,0 +1 @@
+{"version":3,"names":["useSyncExternalStore","gpgSignatureCovers","gpgSignatureCovers2","GPG_SIGNATURE_BEGIN","GPG_PUBLIC_KEY_BEGIN","gpgSignCommand","message","replace","assertGpgSignature","blob","trimmed","trim","includes","Error","createGpgSigner","pending","settle","listeners","Set","emit","listener","signer","family","address","capabilities","signMessage","reject","Promise","resolve","command","submit","request","signature","cancel","reason","subscribe","add","delete","useGpgSigner","defaultSigner","sharedSigner"],"sources":["../../src/signer.ts"],"sourcesContent":[null],"mappings":"AAAA,SAASA,oBAAA,QAA4B;AACrC,SAASC,kBAAA,QAA0B;AAEnC,SAASA,kBAAA,IAAAC,mBAAA,QAA0B;AAS5B,MAAMC,mBAAA,GAAsB;AAC5B,MAAMC,oBAAA,GAAuB;AAQ7B,SAASC,eAAeC,OAAA,EAAyB;EACtD,OAAO,gBAAgBA,OAAA,CAAQC,OAAA,CAAQ,MAAM,OAAO,CAAC;AACvD;AAGO,SAASC,mBAAmBC,IAAA,EAAsB;EACvD,MAAMC,OAAA,GAAUD,IAAA,CAAKE,IAAA,CAAK;EAC1B,IAAI,CAACD,OAAA,CAAQE,QAAA,CAAST,mBAAmB,KAAK,CAACO,OAAA,CAAQE,QAAA,CAASR,oBAAoB,GAAG;IACrF,MAAM,IAAIS,KAAA,CACR,2FACF;EACF;EACA,OAAOH,OAAA;AACT;AA+BO,SAASI,gBAAA,EAA6B;EAC3C,IAAIC,OAAA,GAAiC;EACrC,IAAIC,MAAA,GAAqF;EACzF,MAAMC,SAAA,GAAY,mBAAIC,GAAA,CAAgB;EACtC,MAAMC,IAAA,GAAOA,CAAA,KAAM;IACjB,WAAWC,QAAA,IAAYH,SAAA,EAAWG,QAAA,CAAS;EAC7C;EAEA,MAAMC,MAAA,GAAoB;IACxBC,MAAA,EAAQ;IACRC,OAAA,EAAS;IACTC,YAAA,EAAc,CAAC,aAAa;IAC5B,IAAIT,QAAA,EAAU;MACZ,OAAOA,OAAA;IACT;IACAU,YAAYnB,OAAA,EAAS;MACnBU,MAAA,EAAQU,MAAA,CAAO,IAAIb,KAAA,CAAM,+CAA+C,CAAC;MACzE,OAAO,IAAIc,OAAA,CAAgB,CAACC,OAAA,EAASF,MAAA,KAAW;QAC9CV,MAAA,GAAS;UAAEY,OAAA;UAASF;QAAO;QAC3BX,OAAA,GAAU;UAAET,OAAA;UAASuB,OAAA,EAASxB,cAAA,CAAeC,OAAO;QAAE;QACtDa,IAAA,CAAK;MACP,CAAC;IACH;IACAW,OAAOrB,IAAA,EAAMsB,OAAA,EAAS;MACpB,IAAI,CAACf,MAAA,IAAU,CAACD,OAAA,EAAS,MAAM,IAAIF,KAAA,CAAM,gCAAgC;MACzE,IAAIkB,OAAA,KAAYhB,OAAA,EAAS;QACvB,MAAM,IAAIF,KAAA,CACR,+EACF;MACF;MACA,MAAMmB,SAAA,GAAYxB,kBAAA,CAAmBC,IAAI;MACzC,IAAI,CAACR,kBAAA,CAAmB+B,SAAA,EAAWjB,OAAA,CAAQT,OAAO,GAAG;QACnD,MAAM,IAAIO,KAAA,CACR,0FACF;MACF;MACA,MAAM;QAAEe;MAAQ,IAAIZ,MAAA;MACpBA,MAAA,GAAS;MACTD,OAAA,GAAU;MACVI,IAAA,CAAK;MACLS,OAAA,CAAQI,SAAS;IACnB;IACAC,OAAOC,MAAA,EAAQ;MACb,IAAI,CAAClB,MAAA,EAAQ;MACb,MAAM;QAAEU;MAAO,IAAIV,MAAA;MACnBA,MAAA,GAAS;MACTD,OAAA,GAAU;MACVI,IAAA,CAAK;MACLO,MAAA,CAAOQ,MAAA,IAAU,IAAIrB,KAAA,CAAM,2BAA2B,CAAC;IACzD;IACAsB,UAAUf,QAAA,EAAU;MAClBH,SAAA,CAAUmB,GAAA,CAAIhB,QAAQ;MACtB,OAAO,MAAMH,SAAA,CAAUoB,MAAA,CAAOjB,QAAQ;IACxC;EACF;EACA,OAAOC,MAAA;AACT;AAOO,SAASiB,aAAajB,MAAA,GAAoBkB,aAAA,CAAc,GAAc;EAC3EvC,oBAAA,CACEqB,MAAA,CAAOc,SAAA,EACP,MAAMd,MAAA,CAAON,OAAA,EACb,MAAMM,MAAA,CAAON,OACf;EACA,OAAOM,MAAA;AACT;AAEA,IAAImB,YAAA,GAAiC;AACrC,SAASD,cAAA,EAA2B;EAClCC,YAAA,KAAiB1B,eAAA,CAAgB;EACjC,OAAO0B,YAAA;AACT","ignoreList":[]}

package/dist/esm/signer.native.js

@@ -0,0 +1,116 @@
+import { useSyncExternalStore } from "react";
+import { gpgSignatureCovers } from "./signature.native.js";
+import { gpgSignatureCovers as gpgSignatureCovers2 } from "./signature.native.js";
+var GPG_SIGNATURE_BEGIN = "-----BEGIN PGP SIGNATURE-----";
+var GPG_PUBLIC_KEY_BEGIN = "-----BEGIN PGP PUBLIC KEY BLOCK-----";
+function gpgSignCommand(message) {
+  return `{ printf %s '${message.replace(/'/g, "'\\''")}' | gpg --detach-sign --armor; gpg --armor --export; }`;
+}
+function assertGpgSignature(blob) {
+  var trimmed = blob.trim();
+  if (!trimmed.includes(GPG_SIGNATURE_BEGIN) || !trimmed.includes(GPG_PUBLIC_KEY_BEGIN)) {
+    throw new Error("Paste the FULL output \u2014 it must contain both a PGP SIGNATURE and a PUBLIC KEY block.");
+  }
+  return trimmed;
+}
+function createGpgSigner() {
+  var pending = null;
+  var settle = null;
+  var listeners = /* @__PURE__ */new Set();
+  var emit = function emit2() {
+    var _iteratorNormalCompletion = true,
+      _didIteratorError = false,
+      _iteratorError = void 0;
+    try {
+      for (var _iterator = listeners[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true) {
+        var listener = _step.value;
+        listener();
+      }
+    } catch (err) {
+      _didIteratorError = true;
+      _iteratorError = err;
+    } finally {
+      try {
+        if (!_iteratorNormalCompletion && _iterator.return != null) {
+          _iterator.return();
+        }
+      } finally {
+        if (_didIteratorError) {
+          throw _iteratorError;
+        }
+      }
+    }
+  };
+  var signer = {
+    family: "gpg",
+    address: null,
+    capabilities: ["signMessage"],
+    get pending() {
+      return pending;
+    },
+    signMessage(message) {
+      settle === null || settle === void 0 ? void 0 : settle.reject(new Error("GPG signing was superseded by a newer request"));
+      return new Promise(function (resolve, reject) {
+        settle = {
+          resolve,
+          reject
+        };
+        pending = {
+          message,
+          command: gpgSignCommand(message)
+        };
+        emit();
+      });
+    },
+    submit(blob, request) {
+      if (!settle || !pending) throw new Error("No GPG signature was requested");
+      if (request !== pending) {
+        throw new Error("That GPG request was superseded; run the current command and paste its output");
+      }
+      var signature = assertGpgSignature(blob);
+      if (!gpgSignatureCovers(signature, pending.message)) {
+        throw new Error("That signature is over a different message; run the current command and paste its output");
+      }
+      var {
+        resolve
+      } = settle;
+      settle = null;
+      pending = null;
+      emit();
+      resolve(signature);
+    },
+    cancel(reason) {
+      if (!settle) return;
+      var {
+        reject
+      } = settle;
+      settle = null;
+      pending = null;
+      emit();
+      reject(reason !== null && reason !== void 0 ? reason : new Error("GPG signing was cancelled"));
+    },
+    subscribe(listener) {
+      listeners.add(listener);
+      return function () {
+        return listeners.delete(listener);
+      };
+    }
+  };
+  return signer;
+}
+function useGpgSigner() {
+  var signer = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : defaultSigner();
+  useSyncExternalStore(signer.subscribe, function () {
+    return signer.pending;
+  }, function () {
+    return signer.pending;
+  });
+  return signer;
+}
+var sharedSigner = null;
+function defaultSigner() {
+  sharedSigner !== null && sharedSigner !== void 0 ? sharedSigner : sharedSigner = createGpgSigner();
+  return sharedSigner;
+}
+export { GPG_PUBLIC_KEY_BEGIN, GPG_SIGNATURE_BEGIN, assertGpgSignature, createGpgSigner, gpgSignCommand, gpgSignatureCovers2 as gpgSignatureCovers, useGpgSigner };
+//# sourceMappingURL=signer.native.js.map

package/dist/esm/signer.native.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["useSyncExternalStore","gpgSignatureCovers","gpgSignatureCovers2","GPG_SIGNATURE_BEGIN","GPG_PUBLIC_KEY_BEGIN","gpgSignCommand","message","replace","assertGpgSignature","blob","trimmed","trim","includes","Error","createGpgSigner","pending","settle","listeners","Set","emit","emit2","_iteratorNormalCompletion","_didIteratorError","_iteratorError","_iterator","Symbol","iterator","_step","next","done","listener","value","err","return","signer","family","address","capabilities","signMessage","reject","Promise","resolve","command","submit","request","signature","cancel","reason","subscribe","add","delete","useGpgSigner","arguments","length","defaultSigner","sharedSigner"],"sources":["signer.native.js"],"sourcesContent":["import { useSyncExternalStore } from \"react\";\nimport { gpgSignatureCovers } from \"./signature\";\nimport { gpgSignatureCovers as gpgSignatureCovers2 } from \"./signature\";\nvar GPG_SIGNATURE_BEGIN = \"-----BEGIN PGP SIGNATURE-----\";\nvar GPG_PUBLIC_KEY_BEGIN = \"-----BEGIN PGP PUBLIC KEY BLOCK-----\";\nfunction gpgSignCommand(message) {\n  return `{ printf %s '${message.replace(/'/g, \"'\\\\''\")}' | gpg --detach-sign --armor; gpg --armor --export; }`;\n}\nfunction assertGpgSignature(blob) {\n  var trimmed = blob.trim();\n  if (!trimmed.includes(GPG_SIGNATURE_BEGIN) || !trimmed.includes(GPG_PUBLIC_KEY_BEGIN)) {\n    throw new Error(\"Paste the FULL output \\u2014 it must contain both a PGP SIGNATURE and a PUBLIC KEY block.\");\n  }\n  return trimmed;\n}\nfunction createGpgSigner() {\n  var pending = null;\n  var settle = null;\n  var listeners = /* @__PURE__ */ new Set();\n  var emit = function emit2() {\n    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = void 0;\n    try {\n      for (var _iterator = listeners[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true) {\n        var listener = _step.value;\n        listener();\n      }\n    } catch (err) {\n      _didIteratorError = true;\n      _iteratorError = err;\n    } finally {\n      try {\n        if (!_iteratorNormalCompletion && _iterator.return != null) {\n          _iterator.return();\n        }\n      } finally {\n        if (_didIteratorError) {\n          throw _iteratorError;\n        }\n      }\n    }\n  };\n  var signer = {\n    family: \"gpg\",\n    address: null,\n    capabilities: [\n      \"signMessage\"\n    ],\n    get pending() {\n      return pending;\n    },\n    signMessage(message) {\n      settle === null || settle === void 0 ? void 0 : settle.reject(new Error(\"GPG signing was superseded by a newer request\"));\n      return new Promise(function(resolve, reject) {\n        settle = {\n          resolve,\n          reject\n        };\n        pending = {\n          message,\n          command: gpgSignCommand(message)\n        };\n        emit();\n      });\n    },\n    submit(blob, request) {\n      if (!settle || !pending) throw new Error(\"No GPG signature was requested\");\n      if (request !== pending) {\n        throw new Error(\"That GPG request was superseded; run the current command and paste its output\");\n      }\n      var signature = assertGpgSignature(blob);\n      if (!gpgSignatureCovers(signature, pending.message)) {\n        throw new Error(\"That signature is over a different message; run the current command and paste its output\");\n      }\n      var { resolve } = settle;\n      settle = null;\n      pending = null;\n      emit();\n      resolve(signature);\n    },\n    cancel(reason) {\n      if (!settle) return;\n      var { reject } = settle;\n      settle = null;\n      pending = null;\n      emit();\n      reject(reason !== null && reason !== void 0 ? reason : new Error(\"GPG signing was cancelled\"));\n    },\n    subscribe(listener) {\n      listeners.add(listener);\n      return function() {\n        return listeners.delete(listener);\n      };\n    }\n  };\n  return signer;\n}\nfunction useGpgSigner() {\n  var signer = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : defaultSigner();\n  useSyncExternalStore(signer.subscribe, function() {\n    return signer.pending;\n  }, function() {\n    return signer.pending;\n  });\n  return signer;\n}\nvar sharedSigner = null;\nfunction defaultSigner() {\n  sharedSigner !== null && sharedSigner !== void 0 ? sharedSigner : sharedSigner = createGpgSigner();\n  return sharedSigner;\n}\nexport {\n  GPG_PUBLIC_KEY_BEGIN,\n  GPG_SIGNATURE_BEGIN,\n  assertGpgSignature,\n  createGpgSigner,\n  gpgSignCommand,\n  gpgSignatureCovers2 as gpgSignatureCovers,\n  useGpgSigner\n};\n//# sourceMappingURL=signer.js.map\n"],"mappings":"AAAA,SAASA,oBAAoB,QAAQ,OAAO;AAC5C,SAASC,kBAAkB,QAAQ,uBAAa;AAChD,SAASA,kBAAkB,IAAIC,mBAAmB,QAAQ,uBAAa;AACvE,IAAIC,mBAAmB,GAAG,+BAA+B;AACzD,IAAIC,oBAAoB,GAAG,sCAAsC;AACjE,SAASC,cAAcA,CAACC,OAAO,EAAE;EAC/B,OAAO,gBAAgBA,OAAO,CAACC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,wDAAwD;AAC/G;AACA,SAASC,kBAAkBA,CAACC,IAAI,EAAE;EAChC,IAAIC,OAAO,GAAGD,IAAI,CAACE,IAAI,CAAC,CAAC;EACzB,IAAI,CAACD,OAAO,CAACE,QAAQ,CAACT,mBAAmB,CAAC,IAAI,CAACO,OAAO,CAACE,QAAQ,CAACR,oBAAoB,CAAC,EAAE;IACrF,MAAM,IAAIS,KAAK,CAAC,2FAA2F,CAAC;EAC9G;EACA,OAAOH,OAAO;AAChB;AACA,SAASI,eAAeA,CAAA,EAAG;EACzB,IAAIC,OAAO,GAAG,IAAI;EAClB,IAAIC,MAAM,GAAG,IAAI;EACjB,IAAIC,SAAS,GAAG,eAAgB,IAAIC,GAAG,CAAC,CAAC;EACzC,IAAIC,IAAI,GAAG,SAASC,KAAKA,CAAA,EAAG;IAC1B,IAAIC,yBAAyB,GAAG,IAAI;MAAEC,iBAAiB,GAAG,KAAK;MAAEC,cAAc,GAAG,KAAK,CAAC;IACxF,IAAI;MACF,KAAK,IAAIC,SAAS,GAAGP,SAAS,CAACQ,MAAM,CAACC,QAAQ,CAAC,CAAC,CAAC,EAAEC,KAAK,EAAE,EAAEN,yBAAyB,GAAG,CAACM,KAAK,GAAGH,SAAS,CAACI,IAAI,CAAC,CAAC,EAAEC,IAAI,CAAC,EAAER,yBAAyB,GAAG,IAAI,EAAE;QAC1J,IAAIS,QAAQ,GAAGH,KAAK,CAACI,KAAK;QAC1BD,QAAQ,CAAC,CAAC;MACZ;IACF,CAAC,CAAC,OAAOE,GAAG,EAAE;MACZV,iBAAiB,GAAG,IAAI;MACxBC,cAAc,GAAGS,GAAG;IACtB,CAAC,SAAS;MACR,IAAI;QACF,IAAI,CAACX,yBAAyB,IAAIG,SAAS,CAACS,MAAM,IAAI,IAAI,EAAE;UAC1DT,SAAS,CAACS,MAAM,CAAC,CAAC;QACpB;MACF,CAAC,SAAS;QACR,IAAIX,iBAAiB,EAAE;UACrB,MAAMC,cAAc;QACtB;MACF;IACF;EACF,CAAC;EACD,IAAIW,MAAM,GAAG;IACXC,MAAM,EAAE,KAAK;IACbC,OAAO,EAAE,IAAI;IACbC,YAAY,EAAE,CACZ,aAAa,CACd;IACD,IAAItB,OAAOA,CAAA,EAAG;MACZ,OAAOA,OAAO;IAChB,CAAC;IACDuB,WAAWA,CAAChC,OAAO,EAAE;MACnBU,MAAM,KAAK,IAAI,IAAIA,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,MAAM,CAACuB,MAAM,CAAC,IAAI1B,KAAK,CAAC,+CAA+C,CAAC,CAAC;MACzH,OAAO,IAAI2B,OAAO,CAAC,UAASC,OAAO,EAAEF,MAAM,EAAE;QAC3CvB,MAAM,GAAG;UACPyB,OAAO;UACPF;QACF,CAAC;QACDxB,OAAO,GAAG;UACRT,OAAO;UACPoC,OAAO,EAAErC,cAAc,CAACC,OAAO;QACjC,CAAC;QACDa,IAAI,CAAC,CAAC;MACR,CAAC,CAAC;IACJ,CAAC;IACDwB,MAAMA,CAAClC,IAAI,EAAEmC,OAAO,EAAE;MACpB,IAAI,CAAC5B,MAAM,IAAI,CAACD,OAAO,EAAE,MAAM,IAAIF,KAAK,CAAC,gCAAgC,CAAC;MAC1E,IAAI+B,OAAO,KAAK7B,OAAO,EAAE;QACvB,MAAM,IAAIF,KAAK,CAAC,+EAA+E,CAAC;MAClG;MACA,IAAIgC,SAAS,GAAGrC,kBAAkB,CAACC,IAAI,CAAC;MACxC,IAAI,CAACR,kBAAkB,CAAC4C,SAAS,EAAE9B,OAAO,CAACT,OAAO,CAAC,EAAE;QACnD,MAAM,IAAIO,KAAK,CAAC,0FAA0F,CAAC;MAC7G;MACA,IAAI;QAAE4B;MAAQ,CAAC,GAAGzB,MAAM;MACxBA,MAAM,GAAG,IAAI;MACbD,OAAO,GAAG,IAAI;MACdI,IAAI,CAAC,CAAC;MACNsB,OAAO,CAACI,SAAS,CAAC;IACpB,CAAC;IACDC,MAAMA,CAACC,MAAM,EAAE;MACb,IAAI,CAAC/B,MAAM,EAAE;MACb,IAAI;QAAEuB;MAAO,CAAC,GAAGvB,MAAM;MACvBA,MAAM,GAAG,IAAI;MACbD,OAAO,GAAG,IAAI;MACdI,IAAI,CAAC,CAAC;MACNoB,MAAM,CAACQ,MAAM,KAAK,IAAI,IAAIA,MAAM,KAAK,KAAK,CAAC,GAAGA,MAAM,GAAG,IAAIlC,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAChG,CAAC;IACDmC,SAASA,CAAClB,QAAQ,EAAE;MAClBb,SAAS,CAACgC,GAAG,CAACnB,QAAQ,CAAC;MACvB,OAAO,YAAW;QAChB,OAAOb,SAAS,CAACiC,MAAM,CAACpB,QAAQ,CAAC;MACnC,CAAC;IACH;EACF,CAAC;EACD,OAAOI,MAAM;AACf;AACA,SAASiB,YAAYA,CAAA,EAAG;EACtB,IAAIjB,MAAM,GAAGkB,SAAS,CAACC,MAAM,GAAG,CAAC,IAAID,SAAS,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,GAAGA,SAAS,CAAC,CAAC,CAAC,GAAGE,aAAa,CAAC,CAAC;EAC7FtD,oBAAoB,CAACkC,MAAM,CAACc,SAAS,EAAE,YAAW;IAChD,OAAOd,MAAM,CAACnB,OAAO;EACvB,CAAC,EAAE,YAAW;IACZ,OAAOmB,MAAM,CAACnB,OAAO;EACvB,CAAC,CAAC;EACF,OAAOmB,MAAM;AACf;AACA,IAAIqB,YAAY,GAAG,IAAI;AACvB,SAASD,aAAaA,CAAA,EAAG;EACvBC,YAAY,KAAK,IAAI,IAAIA,YAAY,KAAK,KAAK,CAAC,GAAGA,YAAY,GAAGA,YAAY,GAAGzC,eAAe,CAAC,CAAC;EAClG,OAAOyC,YAAY;AACrB;AACA,SACEnD,oBAAoB,EACpBD,mBAAmB,EACnBK,kBAAkB,EAClBM,eAAe,EACfT,cAAc,EACdH,mBAAmB,IAAID,kBAAkB,EACzCkD,YAAY","ignoreList":[]}

package/dist/esm/useGpg.native.js.map

@@ -1 +1 @@
-{"version":3,"names":["useContext","GpgContext","GpgStatusState","useGpg","useGpg2","gpg","message","command","status","ERROR","error","Error","isLoading","isSuccess","isError","isReady","signIn","signIn2","Promise","reject","reset","nonce","resetStatus","LOADING","SUCCESS"],"sources":["../../src/useGpg.ts"],"sourcesContent":[null],"mappings":"AAAA,SAASA,UAAA,QAAkB;AAC3B,SAASC,UAAA,EAAYC,cAAA,QAAsB;AAoBpC,IAAAC,MAAM,YAAgCC,QAAA;EAC3C,IAAAC,GAAM,GAAAL,UAAM,CAAAC,UAAW;EACvB,IAAI,CAACI,GAAA,EAAK;IACR,OAAO;MACLC,OAAA,EAAS;MACTC,OAAA,EAAS;MACTC,MAAA,EAAQN,cAAA,CAAeO,KAAA;MACvBC,KAAA,EAAO,IAAIC,KAAA,CAAM,2CAA2C;MAC5DC,SAAA,EAAW;MACXC,SAAA,EAAW;MACXC,OAAA,EAAS;MACTC,OAAA,EAAS;MACTC,MAAA,EAAQ,SAAMC,OAAQA,CAAA;QACtB,OAAOC,OAAM,CAAAC,MAAA;MAAC;MAChBC,KAAA,WAAAA,MAAA,GACF;IAEA;EACA;EACA;IAAMC,KAAA;IAAAf,OAAY;IAAAC,OAAW;IAAAC,MAAA;IAAAQ,MAAe;IAAAM;EAAA,IAAAjB,GAAA;EAC5C,IAAAO,SAAM,GAAUJ,MAAA,KAAWN,cAAA,CAAeqB,OAAA,IAAAF,KAAA,CAAAT,SAAA;EAC1C,IAAAC,SAAM,GAAUL,MAAE,KAAAN,cAAY,CAAAsB,OAAA;EAE9B,IAAAV,OAAO,GAAAN,MAAA,KAAAN,cAAA,CAAAO,KAAA;EAAA,IACLM,OAAA,KAAAT,OAAA,KAAAM,SAAA;EAAA,OACA;IACAN,OAAA;IACAC,OAAO;IACPC,MAAA;IACAE,KAAA,EAAAW,KAAA,CAAAX,KAAA;IACAE,SAAA;IACAC,SAAA;IACAC,OAAA;IACAC,OAAO;IACTC,MAAA;IACFI,KAAA,WAAAA,MAAA","ignoreList":[]}
+{"version":3,"names":["useContext","GpgContext","GpgStatusState","useGpg","useGpg2","gpg","message","command","status","ERROR","error","Error","isLoading","isSuccess","isError","isReady","signIn","signIn2","Promise","reject","reset","nonce","resetStatus","LOADING","SUCCESS"],"sources":["useGpg.native.js"],"sourcesContent":["import { useContext } from \"react\";\nimport { GpgContext, GpgStatusState } from \"./GpgContext\";\nvar useGpg = function useGpg2() {\n  var gpg = useContext(GpgContext);\n  if (!gpg) {\n    return {\n      message: null,\n      command: null,\n      status: GpgStatusState.ERROR,\n      error: new Error(\"useGpg hook must be inside a GpgProvider.\"),\n      isLoading: false,\n      isSuccess: false,\n      isError: true,\n      isReady: false,\n      signIn: function signIn2() {\n        return Promise.reject();\n      },\n      reset: function reset() {\n      }\n    };\n  }\n  var { nonce, message, command, status, signIn, resetStatus } = gpg;\n  var isLoading = status === GpgStatusState.LOADING || nonce.isLoading;\n  var isSuccess = status === GpgStatusState.SUCCESS;\n  var isError = status === GpgStatusState.ERROR;\n  var isReady = !!message && !isLoading;\n  return {\n    message,\n    command,\n    status,\n    error: nonce.error,\n    isLoading,\n    isSuccess,\n    isError,\n    isReady,\n    signIn,\n    reset: function reset() {\n      return resetStatus();\n    }\n  };\n};\nexport {\n  useGpg\n};\n//# sourceMappingURL=useGpg.js.map\n"],"mappings":"AAAA,SAASA,UAAU,QAAQ,OAAO;AAClC,SAASC,UAAU,EAAEC,cAAc,QAAQ,wBAAc;AACzD,IAAIC,MAAM,GAAG,SAASC,OAAOA,CAAA,EAAG;EAC9B,IAAIC,GAAG,GAAGL,UAAU,CAACC,UAAU,CAAC;EAChC,IAAI,CAACI,GAAG,EAAE;IACR,OAAO;MACLC,OAAO,EAAE,IAAI;MACbC,OAAO,EAAE,IAAI;MACbC,MAAM,EAAEN,cAAc,CAACO,KAAK;MAC5BC,KAAK,EAAE,IAAIC,KAAK,CAAC,2CAA2C,CAAC;MAC7DC,SAAS,EAAE,KAAK;MAChBC,SAAS,EAAE,KAAK;MAChBC,OAAO,EAAE,IAAI;MACbC,OAAO,EAAE,KAAK;MACdC,MAAM,EAAE,SAASC,OAAOA,CAAA,EAAG;QACzB,OAAOC,OAAO,CAACC,MAAM,CAAC,CAAC;MACzB,CAAC;MACDC,KAAK,EAAE,SAASA,KAAKA,CAAA,EAAG,CACxB;IACF,CAAC;EACH;EACA,IAAI;IAAEC,KAAK;IAAEf,OAAO;IAAEC,OAAO;IAAEC,MAAM;IAAEQ,MAAM;IAAEM;EAAY,CAAC,GAAGjB,GAAG;EAClE,IAAIO,SAAS,GAAGJ,MAAM,KAAKN,cAAc,CAACqB,OAAO,IAAIF,KAAK,CAACT,SAAS;EACpE,IAAIC,SAAS,GAAGL,MAAM,KAAKN,cAAc,CAACsB,OAAO;EACjD,IAAIV,OAAO,GAAGN,MAAM,KAAKN,cAAc,CAACO,KAAK;EAC7C,IAAIM,OAAO,GAAG,CAAC,CAACT,OAAO,IAAI,CAACM,SAAS;EACrC,OAAO;IACLN,OAAO;IACPC,OAAO;IACPC,MAAM;IACNE,KAAK,EAAEW,KAAK,CAACX,KAAK;IAClBE,SAAS;IACTC,SAAS;IACTC,OAAO;IACPC,OAAO;IACPC,MAAM;IACNI,KAAK,EAAE,SAASA,KAAKA,CAAA,EAAG;MACtB,OAAOE,WAAW,CAAC,CAAC;IACtB;EACF,CAAC;AACH,CAAC;AACD,SACEnB,MAAM","ignoreList":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@multiplatform.one/gpg",
-  "version": "7.18.0",
+  "version": "7.20.0",
   "description": "Sign-In With GPG (SIWG) screen + GpgProvider for the connectkit modal — no viem",
   "keywords": [
     "connectkit",
@@ -49,16 +49,29 @@
       "types": "./types/index.d.ts",
       "import": "./dist/esm/index.mjs",
       "require": "./dist/cjs/index.cjs"
+    },
+    "./signer": {
+      "source": "./src/signer.ts",
+      "react-native": {
+        "types": "./types/signer.d.ts",
+        "import": "./src/signer.ts",
+        "require": "./src/signer.ts",
+        "default": "./src/signer.ts"
+      },
+      "types": "./types/signer.d.ts",
+      "import": "./dist/esm/signer.mjs",
+      "require": "./dist/cjs/signer.cjs"
     }
   },
   "publishConfig": {
     "access": "public"
   },
   "dependencies": {
-    "@multiplatform.one/connectkit": "7.18.0"
+    "@multiplatform.one/connectkit": "7.20.0",
+    "@noble/hashes": "^1.8.0"
   },
   "devDependencies": {
-    "@multiplatform.one/config": "7.18.0",
+    "@multiplatform.one/config": "7.20.0",
     "@tamagui/build": "2.7.6",
     "react": "19.2.5",
     "typescript": "~5.9.3"

package/src/GpgProvider.tsx

@@ -3,6 +3,7 @@ import { useQuery } from "@tanstack/react-query";
 
 import { Context as ConnectKitContext } from "@multiplatform.one/connectkit";
 import { GpgContext, GpgConfig, GpgStatusState } from "./GpgContext";
+import { assertGpgSignature, gpgSignCommand } from "./signer";
 
 type Props = GpgConfig & {
   children: ReactNode;
@@ -71,28 +72,15 @@ export const GpgProvider = ({
       nonce.data ? (buildMessageRef.current ?? defaultBuildMessage)({ nonce: nonce.data }) : null,
     [nonce.data],
   );
-  // The ready-to-run terminal command: detached armored signature + the exported public
-  // key, concatenated — exactly the blob the user pastes back. printf %s (no newline) so
-  // the signed bytes are byte-identical to `message`. Single quotes in the message are
-  // POSIX-escaped ('\'' ) so a custom buildMessage can't break out of the quoting.
-  const command = useMemo(
-    () =>
-      message
-        ? `{ printf %s '${message.replace(/'/g, "'\\''")}' | gpg --detach-sign --armor; gpg --armor --export; }`
-        : null,
-    [message],
-  );
+  const command = useMemo(() => (message ? gpgSignCommand(message) : null), [message]);
 
   const signIn = async (pastedBlob: string): Promise<boolean> => {
-    const blob = pastedBlob.trim();
-    if (
-      !blob.includes("-----BEGIN PGP SIGNATURE-----") ||
-      !blob.includes("-----BEGIN PGP PUBLIC KEY BLOCK-----")
-    ) {
+    let blob: string;
+    try {
+      blob = assertGpgSignature(pastedBlob);
+    } catch (error) {
       setStatus(GpgStatusState.ERROR);
-      throw new Error(
-        "Paste the FULL output — it must contain both a PGP SIGNATURE and a PUBLIC KEY block.",
-      );
+      throw error;
     }
     if (!message) {
       setStatus(GpgStatusState.ERROR);

package/src/index.ts

@@ -2,8 +2,17 @@
 //
 // A connection-free signer: the user signs a challenge in their terminal and pastes
 // the result back. Pulls in NO wagmi/viem — depends only on @multiplatform.one/connectkit
-// — so a GPG-only app can install it without the wallet stack.
+// and @noble/hashes — so a GPG-only app can install it without the wallet stack.
 export { useGpg } from "./useGpg";
+export {
+  createGpgSigner,
+  useGpgSigner,
+  gpgSignCommand,
+  assertGpgSignature,
+  gpgSignatureCovers,
+  type GpgSigner,
+  type GpgSignRequest,
+} from "./signer";
 export { GpgProvider, GPG_NONCE_QUERY_KEY } from "./GpgProvider";
 export { GpgContext, GpgStatusState } from "./GpgContext";
 export type { GpgConfig, GpgContextValue } from "./GpgContext";

package/src/signature.ts

@@ -0,0 +1,120 @@
+import { ripemd160, sha1 } from "@noble/hashes/legacy.js";
+import { sha224, sha256, sha384, sha512 } from "@noble/hashes/sha2.js";
+
+// Checks that a pasted detached signature was made over a given message,
+// without verifying it: every OpenPGP signature packet carries the first two
+// bytes of its digest, so recomputing that digest over the message tells a
+// signature for this message from one for another (1 in 65536 slips through).
+// Keycloak's GPG verifier still does the real check.
+
+const BEGIN = "-----BEGIN PGP SIGNATURE-----";
+const END = "-----END PGP SIGNATURE-----";
+
+const hashes: Record<number, (data: Uint8Array) => Uint8Array> = {
+  2: sha1,
+  3: ripemd160,
+  8: sha256,
+  9: sha384,
+  10: sha512,
+  11: sha224,
+};
+
+/** The binary packets inside the first armored PGP SIGNATURE block of `text`. */
+function dearmor(text: string): Uint8Array {
+  const start = text.indexOf(BEGIN);
+  const end = text.indexOf(END, start);
+  if (start < 0 || end < 0) throw new Error("No PGP SIGNATURE block in the paste");
+  const lines = text
+    .slice(start + BEGIN.length, end)
+    .split(/\r?\n/)
+    .map((line) => line.trim());
+  const blank = lines.indexOf("", 1);
+  const hasHeaders = lines.slice(1, blank < 0 ? 0 : blank).some((line) => line.includes(": "));
+  const body = (hasHeaders ? lines.slice(blank) : lines).filter(
+    (line) => line && !/^=[A-Za-z0-9+/]{4}$/.test(line),
+  );
+  const binary = atob(body.join(""));
+  return Uint8Array.from(binary, (c) => c.charCodeAt(0));
+}
+
+/** Signature packet bodies (tag 2), in old or new packet format. */
+function signaturePackets(bytes: Uint8Array): Uint8Array[] {
+  const packets: Uint8Array[] = [];
+  let at = 0;
+  while (at < bytes.length) {
+    const ctb = bytes[at++];
+    if (!(ctb & 0x80)) throw new Error("The PGP SIGNATURE block is not OpenPGP data");
+    let tag: number;
+    let length: number;
+    if (ctb & 0x40) {
+      tag = ctb & 0x3f;
+      const first = bytes[at++];
+      if (first < 192) length = first;
+      else if (first < 224) length = ((first - 192) << 8) + bytes[at++] + 192;
+      else if (first === 255) {
+        length = new DataView(bytes.buffer, bytes.byteOffset + at, 4).getUint32(0);
+        at += 4;
+      } else throw new Error("Partial-length PGP packets are not a detached signature");
+    } else {
+      tag = (ctb >> 2) & 0x0f;
+      const size = [1, 2, 4][ctb & 0x03];
+      if (size === undefined) throw new Error("Indeterminate-length PGP packets are not supported");
+      length = 0;
+      for (let i = 0; i < size; i++) length = length * 256 + bytes[at++];
+    }
+    if (at + length > bytes.length) throw new Error("The PGP SIGNATURE block is truncated");
+    if (tag === 2) packets.push(bytes.subarray(at, at + length));
+    at += length;
+  }
+  return packets;
+}
+
+/** The first two digest bytes of a v4 signature packet recomputed over `message`. */
+function quickCheck(packet: Uint8Array, message: Uint8Array): [expected: number, actual: number] {
+  if (packet[0] !== 4) {
+    throw new Error(
+      `A version ${packet[0]} PGP signature cannot be checked here; sign with a v4 key`,
+    );
+  }
+  const sigType = packet[1];
+  if (sigType !== 0x00 && sigType !== 0x01) {
+    throw new Error(`PGP signature type 0x${sigType.toString(16)} is not a document signature`);
+  }
+  const hash = hashes[packet[3]];
+  if (!hash) throw new Error(`PGP hash algorithm ${packet[3]} is not supported`);
+  const hashedEnd = 6 + ((packet[4] << 8) | packet[5]);
+  const unhashedLength = (packet[hashedEnd] << 8) | packet[hashedEnd + 1];
+  const left16 = hashedEnd + 2 + unhashedLength;
+  if (left16 + 2 > packet.length) throw new Error("The PGP signature packet is truncated");
+
+  const data =
+    sigType === 0x01
+      ? new TextEncoder().encode(
+          new TextDecoder().decode(message).replace(/\r?\n/g, "\n").replace(/\n/g, "\r\n"),
+        )
+      : message;
+  const trailer = new Uint8Array(6);
+  trailer[0] = 0x04;
+  trailer[1] = 0xff;
+  new DataView(trailer.buffer).setUint32(2, hashedEnd);
+  const input = new Uint8Array(data.length + hashedEnd + trailer.length);
+  input.set(data, 0);
+  input.set(packet.subarray(0, hashedEnd), data.length);
+  input.set(trailer, data.length + hashedEnd);
+  const digest = hash(input);
+  return [(packet[left16] << 8) | packet[left16 + 1], (digest[0] << 8) | digest[1]];
+}
+
+/**
+ * True when every signature in the pasted armored PGP SIGNATURE block was made
+ * over `message`'s UTF-8 bytes. Throws on a block it cannot read.
+ */
+export function gpgSignatureCovers(blob: string, message: string): boolean {
+  const packets = signaturePackets(dearmor(blob));
+  if (!packets.length) throw new Error("The PGP SIGNATURE block holds no signature");
+  const bytes = new TextEncoder().encode(message);
+  return packets.every((packet) => {
+    const [expected, actual] = quickCheck(packet, bytes);
+    return expected === actual;
+  });
+}