@multiplatform.one/web3 7.23.2 → 7.25.0

package/types/keycloak/keycloakWallet.d.ts

@@ -0,0 +1,120 @@
+import type { SIWEConfig } from "../connectkit/siwe/SIWEContext";
+import { type BrowserFlowOptions } from "./browserFlow";
+import { type DirectGrant, type DirectGrantOptions } from "./directGrant";
+import { type RegisterWalletOptions, type WalletRegistration } from "./registerWallet";
+import { type KeycloakWalletResource, type OnSign } from "./types";
+export interface KeycloakWalletOptions {
+    /** Keycloak base URL, e.g. `https://account.example.com` or `http://localhost:8080/auth`. */
+    baseUrl: string;
+    realm: string;
+    /** Defaults to `siww` (SHC Keycloak); mpo's own SPI mounts `wallet`. */
+    resource?: KeycloakWalletResource;
+    /**
+     * Domain written into every sign-in message. Defaults to the page host. A
+     * WebView or native caller passes the hosted page's host the realm allows.
+     */
+    domain?: string;
+    /** URI written into every sign-in message. Defaults to the page origin or `https://<domain>`. */
+    uri?: string;
+    fetch?: typeof fetch;
+}
+export interface BrowserLoginUrlOptions {
+    /**
+     * A public client with `standardFlowEnabled` and `redirectUri` registered
+     * exactly, no wildcard. A direct-grant client such as mpo's `siwe-public`
+     * or `siws-public` (`standardFlowEnabled: false`) is refused; mpo's realm
+     * carries `wallet-onboarding` for this.
+     */
+    clientId: string;
+    /** Where Keycloak sends the browser back: the app's deep link or page. */
+    redirectUri: string;
+    /** Default `openid`. */
+    scope?: string | string[];
+}
+export interface BrowserLogin {
+    url: string;
+    /** Keep it, and accept the redirect back only when its `state` matches. */
+    state: string;
+    /** The PKCE S256 verifier behind the URL's `code_challenge`, for the code exchange. */
+    codeVerifier: string;
+}
+export interface KeycloakWallet {
+    readonly baseUrl: string;
+    readonly realm: string;
+    readonly resource: KeycloakWalletResource;
+    readonly realmUrl: string;
+    readonly resourceUrl: string;
+    readonly tokenUrl: string;
+    /**
+     * A server nonce, shared by every caller until `resetNonce()`. Each `/nonce`
+     * call replaces the previous nonce server side (and rotates its cookie), so
+     * two flows fetching their own would leave one signing a dead nonce.
+     */
+    getNonce(): Promise<string>;
+    /** Drop the shared nonce (the server consumed or rotated it) and tell every subscriber. */
+    resetNonce(): void;
+    /**
+     * Call `listener` on every `resetNonce()`. SIWEProvider and GpgProvider
+     * subscribe through the configs below and refetch their cached copy, so a
+     * second sign-in never signs a nonce the server has already dropped.
+     */
+    subscribeNonceReset(listener: () => void): () => void;
+    /** `SIWEConfig.createMessage`, with this wallet's domain and uri. */
+    createMessage(args: {
+        nonce: string;
+        address: string;
+        chainId: number;
+    }): string;
+    /** `GpgConfig.buildMessage`, with this wallet's domain and uri. */
+    gpgMessage(args: {
+        nonce: string;
+    }): string;
+    /** Props for `<SIWEProvider>` that sign through `onSign` (a browser flow, direct grant or registration). */
+    siweConfig(onSign: OnSign): SIWEConfig;
+    /** Props for `<GpgProvider>` that sign through `onSign`. */
+    gpgConfig(onSign: OnSign): {
+        getNonce: () => Promise<string>;
+        buildMessage: (args: {
+            nonce: string;
+        }) => string;
+        onSign: OnSign;
+        subscribeNonceReset: (listener: () => void) => () => void;
+    };
+    browserFlow(opts?: BrowserFlowOptions): OnSign;
+    directGrant(opts: DirectGrantOptions): DirectGrant;
+    /**
+     * The realm's authorization-code login, with a fresh `state` and PKCE S256
+     * pair. Open `url` in the system browser or a WebView when a direct grant
+     * rejects with `ProfileIncompleteError`: Keycloak's own login runs the
+     * pending required actions (the profile form), and the next direct grant
+     * succeeds.
+     */
+    browserLoginUrl(opts: BrowserLoginUrlOptions): BrowserLogin;
+    registerWallet(opts: RegisterWalletOptions): WalletRegistration;
+    /** `fetch` against Keycloak carrying the nonce session cookie. */
+    request(url: string, init?: RequestInit): Promise<Response>;
+}
+/** RFC 7636 S256: base64url(SHA-256(ASCII(verifier))). */
+export declare function pkceChallenge(codeVerifier: string): string;
+/** `username`/`password` for a signature over `message`, base64 done without btoa so it runs on Hermes. */
+export declare function toCredentials(args: {
+    signature: string;
+    message: string;
+}): {
+    username: string;
+    password: string;
+    message: string;
+};
+export declare function keycloakWallet(options: KeycloakWalletOptions): KeycloakWallet;
+/**
+ * Keycloak base URL and realm of a page Keycloak serves (`<base>/realms/<realm>/...`),
+ * or undefined off such a page.
+ */
+export declare function deriveKeycloakFromLocation(location?: {
+    origin: string;
+    pathname: string;
+} | undefined): {
+    baseUrl: string;
+    realm: string;
+} | undefined;
+//# sourceMappingURL=keycloakWallet.d.ts.map

package/types/keycloak/keycloakWallet.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keycloakWallet.d.ts","sourceRoot":"","sources":["../../src/keycloak/keycloakWallet.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAEjE,OAAO,EAAe,KAAK,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAqB,KAAK,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC7F,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAuB,KAAK,sBAAsB,EAAE,KAAK,MAAM,EAAE,MAAM,SAAS,CAAC;AAExF,MAAM,WAAW,qBAAqB;IACpC,6FAA6F;IAC7F,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,QAAQ,CAAC,EAAE,sBAAsB,CAAC;IAClC;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iGAAiG;IACjG,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB;IACrC;;;;;OAKG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC;IACpB,wBAAwB;IACxB,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,2EAA2E;IAC3E,KAAK,EAAE,MAAM,CAAC;IACd,uFAAuF;IACvF,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,2FAA2F;IAC3F,UAAU,IAAI,IAAI,CAAC;IACnB;;;;OAIG;IACH,mBAAmB,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;IACtD,qEAAqE;IACrE,aAAa,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC;IACjF,mEAAmE;IACnE,UAAU,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC;IAC5C,4GAA4G;IAC5G,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC;IACvC,4DAA4D;IAC5D,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG;QACzB,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;QAChC,YAAY,EAAE,CAAC,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,KAAK,MAAM,CAAC;QAClD,MAAM,EAAE,MAAM,CAAC;QACf,mBAAmB,EAAE,CAAC,QAAQ,EAAE,MAAM,IAAI,KAAK,MAAM,IAAI,CAAC;KAC3D,CAAC;IACF,WAAW,CAAC,IAAI,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC;IAC/C,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,WAAW,CAAC;IACnD;;;;;;OAMG;IACH,eAAe,CAAC,IAAI,EAAE,sBAAsB,GAAG,YAAY,CAAC;IAC5D,cAAc,CAAC,IAAI,EAAE,qBAAqB,GAAG,kBAAkB,CAAC;IAChE,kEAAkE;IAClE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7D;AA2BD,0DAA0D;AAC1D,wBAAgB,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,2GAA2G;AAC3G,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;;;;EAMzE;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,cAAc,CAwH7E;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,GAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,SAEvC,GACT;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAIhD"}

package/types/keycloak/mount.d.ts

@@ -0,0 +1,16 @@
+import type { Config } from "wagmi";
+import { type KeycloakWalletLoginProps } from "./KeycloakWalletLogin";
+export interface MountedKeycloakWalletLogin {
+    /** The wagmi config the login signs with. */
+    readonly config: Config;
+    unmount(): void;
+}
+/**
+ * Render `<KeycloakWalletLogin>` into `target` under its own React root, so a
+ * Keycloak theme on another React (or none) can host it. Mounting an element
+ * that already holds one returns that one: a second root would fetch a second
+ * nonce and rotate the session cookie under the first. `unmount()` frees the
+ * element for a fresh mount.
+ */
+export declare function mount(target: string | Element, opts?: KeycloakWalletLoginProps): MountedKeycloakWalletLogin;
+//# sourceMappingURL=mount.d.ts.map

package/types/keycloak/mount.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mount.d.ts","sourceRoot":"","sources":["../../src/keycloak/mount.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AACpC,OAAO,EAEL,KAAK,wBAAwB,EAE9B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,0BAA0B;IACzC,6CAA6C;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,OAAO,IAAI,IAAI,CAAC;CACjB;AAID;;;;;;GAMG;AACH,wBAAgB,KAAK,CACnB,MAAM,EAAE,MAAM,GAAG,OAAO,EACxB,IAAI,GAAE,wBAA6B,GAClC,0BAA0B,CAkB5B"}

package/types/keycloak/mount.native.d.ts

@@ -0,0 +1,5 @@
+import type { KeycloakWalletLoginProps } from "./KeycloakWalletLogin";
+import type { MountedKeycloakWalletLogin } from "./mount";
+export type { MountedKeycloakWalletLogin };
+export declare function mount(_target: string | Element, _opts?: KeycloakWalletLoginProps): MountedKeycloakWalletLogin;
+//# sourceMappingURL=mount.native.d.ts.map

package/types/keycloak/mount.native.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mount.native.d.ts","sourceRoot":"","sources":["../../src/keycloak/mount.native.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,SAAS,CAAC;AAE1D,YAAY,EAAE,0BAA0B,EAAE,CAAC;AAE3C,wBAAgB,KAAK,CACnB,OAAO,EAAE,MAAM,GAAG,OAAO,EACzB,KAAK,CAAC,EAAE,wBAAwB,GAC/B,0BAA0B,CAE5B"}

package/types/keycloak/registerWallet.d.ts

@@ -0,0 +1,22 @@
+import type { KeycloakWallet } from "./keycloakWallet";
+import { type OnSign } from "./types";
+export interface RegisterWalletOptions {
+    /** The signed-in user's access token, or a getter such as `directGrant(...).getAccessToken`. */
+    accessToken: string | (() => string | null | Promise<string | null>);
+}
+export interface WalletRegistration {
+    /** `onSign` for `<SIWEProvider>`: proves the connected wallet and binds it to the signed-in user. */
+    onSign: OnSign;
+    /**
+     * POST `<resource>/register`. `registered` is false when the wallet was
+     * already this user's; another user's wallet is a 409.
+     */
+    register(args: {
+        message: string;
+        signature: string;
+    }): Promise<{
+        registered: boolean;
+    }>;
+}
+export declare function createWalletRegistration(kc: KeycloakWallet, opts: RegisterWalletOptions): WalletRegistration;
+//# sourceMappingURL=registerWallet.d.ts.map

package/types/keycloak/registerWallet.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registerWallet.d.ts","sourceRoot":"","sources":["../../src/keycloak/registerWallet.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAuB,KAAK,MAAM,EAAE,MAAM,SAAS,CAAC;AAE3D,MAAM,WAAW,qBAAqB;IACpC,gGAAgG;IAChG,WAAW,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;CACtE;AAED,MAAM,WAAW,kBAAkB;IACjC,qGAAqG;IACrG,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAC1F;AAED,wBAAgB,wBAAwB,CACtC,EAAE,EAAE,cAAc,EAClB,IAAI,EAAE,qBAAqB,GAC1B,kBAAkB,CAqCpB"}

package/types/keycloak/types.d.ts

@@ -0,0 +1,50 @@
+/**
+ * The REST resource the Keycloak wallet SPI mounts under `/realms/<realm>/`:
+ * `siww` on the SHC Keycloak, `wallet` on mpo's own SPI.
+ */
+export type KeycloakWalletResource = "siww" | "wallet";
+/**
+ * What SIWEProvider and GpgProvider hand their `onSign`: `username` is the raw
+ * signature (or the GPG blob), `password` is base64(message).
+ */
+export interface WalletSignIn {
+    username: string;
+    password: string;
+    message: string;
+}
+export type OnSign = (credentials: WalletSignIn) => Promise<boolean>;
+export interface KeycloakTokens {
+    accessToken: string;
+    refreshToken?: string;
+    idToken?: string;
+    tokenType: string;
+    scope?: string;
+    /** Epoch ms after which the access token is expired. */
+    expiresAt: number;
+    /** Epoch ms after which the refresh token is expired; absent for offline or non-expiring tokens. */
+    refreshExpiresAt?: number;
+}
+export declare class KeycloakWalletError extends Error {
+    readonly status: number;
+    readonly error?: string;
+    readonly errorDescription?: string;
+    constructor(message: string, status: number, details?: {
+        error?: string;
+        errorDescription?: string;
+    });
+}
+/**
+ * Keycloak accepted the wallet but the account has required actions left (a
+ * new user's profile form, terms, a verified email), which a direct grant
+ * cannot run: Keycloak answers 400 invalid_grant "Account is not fully set
+ * up". Send the user through the browser login once
+ * (`kc.browserLoginUrl(...)` in the system browser or a WebView) so Keycloak
+ * shows its own forms; the direct grant succeeds after that.
+ */
+export declare class ProfileIncompleteError extends KeycloakWalletError {
+    constructor(message: string, status: number, details?: {
+        error?: string;
+        errorDescription?: string;
+    });
+}
+//# sourceMappingURL=types.d.ts.map

package/types/keycloak/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/keycloak/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEvD;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,MAAM,GAAG,CAAC,WAAW,EAAE,YAAY,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAErE,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,oGAAoG;IACpG,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;gBAGjC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAO;CAQ9D;AAED;;;;;;;GAOG;AACH,qBAAa,sBAAuB,SAAQ,mBAAmB;gBAE3D,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAO;CAK9D"}

package/types/keycloak/useDirectLogin.d.ts

@@ -0,0 +1,29 @@
+import type { DirectGrant } from "./directGrant";
+import { type KeycloakTokens } from "./types";
+export type DirectLoginStatus = "idle" | "signing" | "signed-in" | "profile-incomplete" | "error";
+export interface UseDirectLoginResult {
+    /**
+     * `profile-incomplete`: Keycloak took the wallet but the account has
+     * required actions left, and `error` is the `ProfileIncompleteError`. Open
+     * `kc.browserLoginUrl(...)` (system browser or WebView) so Keycloak's own
+     * forms run, then `signIn()` again.
+     */
+    status: DirectLoginStatus;
+    tokens: KeycloakTokens | null;
+    error: Error | null;
+    /**
+     * Sign in with the connected wallet through SIWEProvider and exchange the
+     * signature for tokens. Resolves null when the wallet or Keycloak refused.
+     */
+    signIn(): Promise<KeycloakTokens | null>;
+    refresh(): Promise<KeycloakTokens>;
+    signOut(): Promise<void>;
+}
+/**
+ * Direct (browserless) wallet login: SIWEProvider signs, the grant trades the
+ * signature for Keycloak tokens. Mount it under
+ * `<SIWEProvider {...kc.siweConfig(grant.onSign)}>`; every login attempt resets
+ * the kc nonce, which refetches it in SIWEProvider and GpgProvider alike.
+ */
+export declare function useDirectLogin(grant: DirectGrant): UseDirectLoginResult;
+//# sourceMappingURL=useDirectLogin.d.ts.map

package/types/keycloak/useDirectLogin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useDirectLogin.d.ts","sourceRoot":"","sources":["../../src/keycloak/useDirectLogin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAA0B,KAAK,cAAc,EAAE,MAAM,SAAS,CAAC;AAEtE,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,SAAS,GAAG,WAAW,GAAG,oBAAoB,GAAG,OAAO,CAAC;AAElG,MAAM,WAAW,oBAAoB;IACnC;;;;;OAKG;IACH,MAAM,EAAE,iBAAiB,CAAC;IAC1B,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC;IAC9B,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB;;;OAGG;IACH,MAAM,IAAI,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACzC,OAAO,IAAI,OAAO,CAAC,cAAc,CAAC,CAAC;IACnC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,oBAAoB,CAyCvE"}

package/types/keycloak/useWalletLogin.d.ts

@@ -0,0 +1,26 @@
+import { StatusState } from "../connectkit/siwe/SIWEContext";
+export interface UseWalletLoginOptions {
+    /** sessionStorage key of the pending-login mark. One per button on a page. */
+    intentKey?: string;
+    /** How long a connect started by `login()` may still drive the signature. Default 90 s. */
+    intentTtlMs?: number;
+}
+export interface UseWalletLoginResult {
+    /** Connect if needed, then sign through SIWEProvider. One press, no Continue step. */
+    login(): Promise<void>;
+    status: StatusState;
+    isConnected: boolean;
+    address?: string;
+}
+/**
+ * A wallet login button's behaviour. Pressing it while disconnected opens the
+ * connect modal, or on a phone with ConnectKit's `mobile.preferredConnector`
+ * that wallet straight away, so call `login()` synchronously in the click
+ * handler. The press is marked in sessionStorage (the wallet bounce can reload
+ * the page); once the wallet connects the signature starts by itself.
+ * Only a fresh mark drives it, so a wallet that reconnects on a later visit
+ * never signs unasked. A phone browser opens the wallet for a signature only
+ * from a tap, so without one the user presses again.
+ */
+export declare function useWalletLogin(opts?: UseWalletLoginOptions): UseWalletLoginResult;
+//# sourceMappingURL=useWalletLogin.d.ts.map

package/types/keycloak/useWalletLogin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useWalletLogin.d.ts","sourceRoot":"","sources":["../../src/keycloak/useWalletLogin.ts"],"names":[],"mappings":"AAIA,OAAO,EAAe,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAG1E,MAAM,WAAW,qBAAqB;IACpC,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2FAA2F;IAC3F,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC,sFAAsF;IACtF,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,MAAM,EAAE,WAAW,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAuBD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,IAAI,GAAE,qBAA0B,GAAG,oBAAoB,CA6CrF"}

package/types/keycloak/useWalletLogin.native.d.ts

@@ -0,0 +1,4 @@
+import type { UseWalletLoginOptions, UseWalletLoginResult } from "./useWalletLogin";
+export type { UseWalletLoginOptions, UseWalletLoginResult };
+export declare function useWalletLogin(_opts?: UseWalletLoginOptions): UseWalletLoginResult;
+//# sourceMappingURL=useWalletLogin.native.d.ts.map

package/types/keycloak/useWalletLogin.native.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useWalletLogin.native.d.ts","sourceRoot":"","sources":["../../src/keycloak/useWalletLogin.native.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAEpF,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;AAE5D,wBAAgB,cAAc,CAAC,KAAK,CAAC,EAAE,qBAAqB,GAAG,oBAAoB,CAElF"}

package/types/message/buildWalletMessage.d.ts

@@ -0,0 +1,46 @@
+/**
+ * The signer families a wallet sign-in message can be built for. The Keycloak
+ * SPIs (SHC `siww`, mpo `wallet`) content-sniff exactly these headers.
+ */
+export type WalletMessageFamily = "eth" | "sol" | "sui" | "btc" | "gpg";
+/** Ecosystem names the connectors use; accepted as aliases of the short family. */
+export type WalletMessageEcosystem = "evm" | "solana" | "sui" | "bitcoin";
+export type SignerFamily = WalletMessageFamily | WalletMessageEcosystem;
+export interface WalletMessageOptions {
+    nonce: string;
+    /** Signer address. Required for every family except `gpg`, whose identity comes from the key. */
+    address?: string;
+    /**
+     * Host the user signs in to, checked against the realm's frontend host and
+     * `siww.allowedDomains` / `wallet.allowedDomains`. Defaults to
+     * `window.location.host`; pass it explicitly from a WebView or native page,
+     * where that host is empty or not the one the realm allows.
+     */
+    domain?: string;
+    /** Defaults to `window.location.origin`, or `https://<domain>` when the page has no origin. */
+    uri?: string;
+    /**
+     * Defaults to the family's statement; `null` or `""` omits it. `eth` then
+     * keeps the empty line EIP-4361 puts in its place.
+     */
+    statement?: string | null;
+    /** Defaults to now. */
+    issuedAt?: string;
+    /**
+     * `eth`: the chain id (default 1). Other families keep their fixed `Chain ID:`
+     * value (`solana:mainnet`, ...) unless given a string; a number there is a
+     * connector's synthetic chain id and is ignored.
+     */
+    chainId?: number | string;
+    version?: string;
+}
+/** Map an ecosystem name (`evm`, `solana`, `bitcoin`) or a short family to the short family. */
+export declare function toWalletMessageFamily(family: SignerFamily): WalletMessageFamily;
+/**
+ * Build the sign-in message for one signer family. This is the only builder in
+ * mpo web3: EIP-4361 for `eth` (EIP-55 address, no optional fields), SIWS for
+ * `sol`, and the same envelope for `sui`, `btc` and `gpg`, in the exact bytes
+ * the Keycloak verifiers parse.
+ */
+export declare function buildWalletMessage(family: SignerFamily, opts: WalletMessageOptions): string;
+//# sourceMappingURL=buildWalletMessage.d.ts.map

package/types/message/buildWalletMessage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildWalletMessage.d.ts","sourceRoot":"","sources":["../../src/message/buildWalletMessage.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AAExE,mFAAmF;AACnF,MAAM,MAAM,sBAAsB,GAAG,KAAK,GAAG,QAAQ,GAAG,KAAK,GAAG,SAAS,CAAC;AAE1E,MAAM,MAAM,YAAY,GAAG,mBAAmB,GAAG,sBAAsB,CAAC;AAExE,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,iGAAiG;IACjG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,uBAAuB;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAiDD,gGAAgG;AAChG,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,YAAY,GAAG,mBAAmB,CAI/E;AAaD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,oBAAoB,GAAG,MAAM,CAoC3F"}

package/types/message/index.d.ts

@@ -0,0 +1,2 @@
+export { buildWalletMessage, toWalletMessageFamily, type SignerFamily, type WalletMessageEcosystem, type WalletMessageFamily, type WalletMessageOptions, } from "./buildWalletMessage";
+//# sourceMappingURL=index.d.ts.map

package/types/message/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/message/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,KAAK,YAAY,EACjB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,sBAAsB,CAAC"}

package/types/providers/WalletProvider.d.ts

@@ -1,11 +1,19 @@
 import { QueryClient } from "@tanstack/react-query";
+import { type SIWEConfig } from "../connectkit";
 import type { PropsWithChildren } from "react";
 import { type Web3Config } from "./walletConfig";
 export interface WalletProviderProps extends PropsWithChildren {
     config: Web3Config;
     queryClient?: QueryClient;
+    /**
+     * Mounts a SIWEProvider around the ConnectKit modal, e.g.
+     * `kc.siweConfig(grant.onSign)` for `useDirectLogin`. It has to sit outside
+     * ConnectKitProvider, so a child cannot add its own.
+     */
+    siwe?: SIWEConfig;
 }
-export declare function WalletProvider({ children, config: web3Config, queryClient, }: WalletProviderProps): import("react/jsx-runtime").JSX.Element;
+export declare function WalletProvider({ children, config: web3Config, queryClient, siwe, }: WalletProviderProps): import("react/jsx-runtime").JSX.Element;
+export { useWalletBridge, type WalletBridgeContextValue } from "./walletBridge";
 export { defaultChains } from "./walletConfig";
 export { useWeb3Config, type Web3Config } from "./walletConfig";
 //# sourceMappingURL=WalletProvider.d.ts.map

package/types/providers/WalletProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"WalletProvider.d.ts","sourceRoot":"","sources":["../../src/providers/WalletProvider.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAuB,MAAM,uBAAuB,CAAC;AAGzE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,OAAO,CAAC;AAK/C,OAAO,EAAE,KAAK,UAAU,EAAoC,MAAM,gBAAgB,CAAC;AAEnF,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;IAC5D,MAAM,EAAE,UAAU,CAAC;IACnB,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAWD,wBAAgB,cAAc,CAAC,EAC7B,QAAQ,EACR,MAAM,EAAE,UAAU,EAClB,WAAgC,GACjC,EAAE,mBAAmB,2CAmErB;AAED,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"WalletProvider.d.ts","sourceRoot":"","sources":["../../src/providers/WalletProvider.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAuB,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAAoC,KAAK,UAAU,EAAoB,MAAM,eAAe,CAAC;AAEpG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,OAAO,CAAC;AAI/C,OAAO,EAAE,KAAK,UAAU,EAAoC,MAAM,gBAAgB,CAAC;AAEnF,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;IAC5D,MAAM,EAAE,UAAU,CAAC;IACnB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;OAIG;IACH,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAWD,wBAAgB,cAAc,CAAC,EAC7B,QAAQ,EACR,MAAM,EAAE,UAAU,EAClB,WAAgC,EAChC,IAAI,GACL,EAAE,mBAAmB,2CAyErB;AAED,OAAO,EAAE,eAAe,EAAE,KAAK,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC"}

package/types/providers/WalletProvider.native.d.ts

@@ -7,7 +7,7 @@ type WebViewSource = NonNullable<WebViewProps["source"]>;
 export interface WalletProviderProps extends PropsWithChildren {
     config: Web3Config;
     queryClient?: QueryClient;
-    /** Override the WebView content (defaults to `config.webViewUrl`). */
+    /** Override the WebView content (defaults to `config.webViewUrl`); must be a hosted `{ uri }`. */
     webViewSource?: WebViewSource;
 }
 /** Native Solana surface, mirroring the operations web's wallet-adapter exposes. */
@@ -18,6 +18,7 @@ export interface SolanaWalletContextValue {
 }
 export declare function useSolanaWallet(): SolanaWalletContextValue;
 export declare function WalletProvider({ children, config: web3Config, queryClient, webViewSource, }: WalletProviderProps): import("react/jsx-runtime").JSX.Element;
+export { useWalletBridge, type WalletBridgeContextValue } from "./walletBridge";
 export { defaultChains } from "./walletConfig";
 export { useWeb3Config, type Web3Config } from "./walletConfig";
 //# sourceMappingURL=WalletProvider.native.d.ts.map

package/types/providers/WalletProvider.native.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"WalletProvider.native.d.ts","sourceRoot":"","sources":["../../src/providers/WalletProvider.native.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAuB,MAAM,uBAAuB,CAAC;AACzE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,OAAO,CAAC;AAG/C,OAAO,EAAqC,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAG5F,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAMtD,OAAO,EAAE,KAAK,UAAU,EAAoC,MAAM,gBAAgB,CAAC;AAEnF,KAAK,aAAa,GAAG,WAAW,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;AAMzD,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;IAC5D,MAAM,EAAE,UAAU,CAAC;IACnB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,sEAAsE;IACtE,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAED,oFAAoF;AACpF,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,YAAY,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;CACpB;AAID,wBAAgB,eAAe,IAAI,wBAAwB,CAI1D;AAID,wBAAgB,cAAc,CAAC,EAC7B,QAAQ,EACR,MAAM,EAAE,UAAU,EAClB,WAAgC,EAChC,aAAa,GACd,EAAE,mBAAmB,2CA+IrB;AAUD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"WalletProvider.native.d.ts","sourceRoot":"","sources":["../../src/providers/WalletProvider.native.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAuB,MAAM,uBAAuB,CAAC;AACzE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,OAAO,CAAC;AAG/C,OAAO,EAAqC,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAK5F,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAetD,OAAO,EAAE,KAAK,UAAU,EAAoC,MAAM,gBAAgB,CAAC;AAEnF,KAAK,aAAa,GAAG,WAAW,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;AAMzD,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;IAC5D,MAAM,EAAE,UAAU,CAAC;IACnB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,kGAAkG;IAClG,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAED,oFAAoF;AACpF,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,YAAY,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;CACpB;AAID,wBAAgB,eAAe,IAAI,wBAAwB,CAI1D;AAeD,wBAAgB,cAAc,CAAC,EAC7B,QAAQ,EACR,MAAM,EAAE,UAAU,EAClB,WAAgC,EAChC,aAAa,GACd,EAAE,mBAAmB,2CA8KrB;AAUD,OAAO,EAAE,eAAe,EAAE,KAAK,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC"}

package/types/providers/index.d.ts

@@ -1,2 +1,2 @@
-export { WalletProvider, useWeb3Config, defaultChains, type WalletProviderProps, type Web3Config, } from "./WalletProvider";
+export { WalletProvider, useWeb3Config, defaultChains, useWalletBridge, type WalletBridgeContextValue, type WalletProviderProps, type Web3Config, } from "./WalletProvider";
 //# sourceMappingURL=index.d.ts.map

package/types/providers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/providers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,aAAa,EACb,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,UAAU,GAChB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/providers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,aAAa,EACb,aAAa,EACb,eAAe,EACf,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,UAAU,GAChB,MAAM,kBAAkB,CAAC"}

package/types/providers/native/deepLink.d.ts

@@ -1,11 +1,36 @@
 /**
- * Wallet hand-off URL classification for the native WebView. The WebView loads
- * trusted local content (file://); when its ConnectKit flow tries to
- * open a wallet app it navigates to a wallet custom-scheme or universal link —
- * those must be handed to the OS via Linking.openURL, not loaded in the WebView.
+ * Wallet hand-off for the native WebView. The WebView shows the hosted wallet
+ * page; when its flow opens a wallet app it navigates to a wallet custom
+ * scheme or universal link, or opens one in a new window. Those go to the OS
+ * through Linking.openURL and are never loaded in the WebView.
  */
+/** Custom schemes that open a wallet app. docs/bridge-protocol.md lists the same. */
+export declare const WALLET_SCHEMES: readonly string[];
+/** Hosts (and subdomains) of wallet universal links. docs/bridge-protocol.md lists the same. */
+export declare const WALLET_UNIVERSAL_HOSTS: readonly string[];
 /** True when a WebView navigation should be opened in an external wallet app. */
 export declare function shouldOpenExternally(url: string): boolean;
+/** `load` in the WebView, hand to the OS (`external`), or drop (`block`). */
+export type NavigationDecision = "load" | "external" | "block";
+/**
+ * Decide a navigation in the wallet WebView (`onShouldStartLoadWithRequest`).
+ * The top frame never leaves the hosted page's origin: the bridge would
+ * otherwise hand its messages, tokens included, to whatever page loaded next.
+ * Other http(s) pages open in the system browser; frames are the page's own
+ * business.
+ */
+export declare function decideNavigation(url: string, pageOrigin: string, isTopFrame?: boolean): NavigationDecision;
+/**
+ * Decide a `window.open` / `target=_blank` navigation (`onOpenWindow`). A new
+ * window never opens inside the app: wallet links and web pages go to the OS.
+ */
+export declare function decideNewWindow(url: string): NavigationDecision;
 /** Parse the query params of an inbound app-link return (e.g. from a wallet redirect). */
 export declare function parseWalletReturn(url: string): Record<string, string> | null;
+/**
+ * True when `url` is `base` or below it: `myapp://wallet-return?x=1` and
+ * `myapp://wallet-return/done` are under `myapp://wallet-return`,
+ * `myapp://wallet-returned` is not.
+ */
+export declare function isUnderUrl(url: string, base: string): boolean;
 //# sourceMappingURL=deepLink.d.ts.map

package/types/providers/native/deepLink.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deepLink.d.ts","sourceRoot":"","sources":["../../../src/providers/native/deepLink.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA2BH,iFAAiF;AACjF,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAazD;AAED,0FAA0F;AAC1F,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAW5E"}
+{"version":3,"file":"deepLink.d.ts","sourceRoot":"","sources":["../../../src/providers/native/deepLink.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH,qFAAqF;AACrF,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAgB3C,CAAC;AAEF,gGAAgG;AAChG,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EASnD,CAAC;AAIF,iFAAiF;AACjF,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAQzD;AAED,6EAA6E;AAC7E,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC;AAE/D;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,MAAM,EAClB,UAAU,UAAO,GAChB,kBAAkB,CAWpB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,CAQ/D;AAED,0FAA0F;AAC1F,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAE5E;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAI7D"}

package/types/providers/native/inject.d.ts

@@ -1,11 +1,5 @@
 import type { Web3Config } from "../walletConfig";
-/**
- * Build the JS the native side runs inside the WebView (via `injectJavaScript`)
- * to deliver one inbound bridge message. The raw string is embedded with
- * JSON.stringify so quotes/newlines/backslashes survive intact. The trailing
- * `true;` is required by react-native-webview's injectJavaScript contract.
- */
-export declare function buildInjectScript(raw: string): string;
+export { buildInjectScript } from "../../bridge/nativeHost";
 /**
  * Build the JS injected *before* the WebView content loads
  * (`injectedJavaScriptBeforeContentLoaded`) to publish the host config as

package/types/providers/native/inject.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inject.d.ts","sourceRoot":"","sources":["../../../src/providers/native/inject.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,GAAG;IAAE,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAE1F"}
+{"version":3,"file":"inject.d.ts","sourceRoot":"","sources":["../../../src/providers/native/inject.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,GAAG;IAAE,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAE1F"}

package/types/providers/walletBridge.d.ts

@@ -0,0 +1,17 @@
+import type { AuthBridge } from "../bridge/AuthBridge";
+import type { BridgeClient } from "../bridge/BridgeClient";
+import type { GpgBridge } from "../bridge/GpgBridge";
+import type { SolanaBridge } from "../bridge/SolanaBridge";
+import type { SuiBridge } from "../bridge/SuiBridge";
+/** Every bridge namespace of the native WalletProvider's hosted wallet page. */
+export interface WalletBridgeContextValue {
+    client: BridgeClient;
+    solana: SolanaBridge;
+    sui: SuiBridge;
+    gpg: GpgBridge;
+    auth: AuthBridge;
+}
+export declare const WalletBridgeContext: import("react").Context<WalletBridgeContextValue | null>;
+/** Native only: on web the wallet runs in the page itself and there is no bridge. */
+export declare function useWalletBridge(): WalletBridgeContextValue;
+//# sourceMappingURL=walletBridge.d.ts.map

package/types/providers/walletBridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"walletBridge.d.ts","sourceRoot":"","sources":["../../src/providers/walletBridge.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,gFAAgF;AAChF,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,YAAY,CAAC;IACrB,GAAG,EAAE,SAAS,CAAC;IACf,GAAG,EAAE,SAAS,CAAC;IACf,IAAI,EAAE,UAAU,CAAC;CAClB;AAED,eAAO,MAAM,mBAAmB,0DAAuD,CAAC;AAExF,qFAAqF;AACrF,wBAAgB,eAAe,IAAI,wBAAwB,CAI1D"}

package/types/providers/walletConfig.d.ts

@@ -1,4 +1,5 @@
 import type { Chain } from "viem";
+import type { AuthKeycloakConfig, AuthOnboardingConfig } from "../bridge/authTypes";
 /**
  * Shared config seam for both platform variants of WalletProvider. Keeping the
  * type + context here (rather than in either variant) means web and native share
@@ -32,8 +33,24 @@ export interface Web3Config {
     suiRpcUrl?: string;
     /** E2E only (native): route connect through the in-WebView mock wallet. */
     mockWallet?: boolean;
-    /** Native: URL serving the wallet WebView HTML (preferred over the inline string). */
+    /**
+     * Native: https URL serving `assets/webview.html`. Its host is the sign-in
+     * message's domain, so it must be in the realm's `siww.allowedDomains` /
+     * `wallet.allowedDomains` and in the client's web origins. Plain http is
+     * accepted only on loopback and 10.0.2.2, in development builds.
+     */
     webViewUrl?: string;
+    /**
+     * Native: the app link wallets send the user back to, e.g.
+     * `myapp://wallet-return`. Returns under it reach the page as
+     * `sys.deepLinkReturn`; no other app link does.
+     */
+    walletReturnUrl?: string;
+    /** Native: the Keycloak client `useWalletBridge().auth` signs in with when a call names none. */
+    auth?: {
+        keycloak?: AuthKeycloakConfig;
+        onboarding?: AuthOnboardingConfig;
+    };
 }
 /**
  * Resolve the active chain list for a Web3Config: apply the testnet filter,

package/types/providers/walletConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"walletConfig.d.ts","sourceRoot":"","sources":["../../src/providers/walletConfig.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAGlC;;;;;GAKG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,CAAC,KAAK,EAAE,GAAG,KAAK,EAAE,CAOtD,CAAC;AAEF,MAAM,WAAW,UAAU;IACzB,uFAAuF;IACvF,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,SAAS,CAAC,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IACtC,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC,CAgB9E;AAED,eAAO,MAAM,iBAAiB,4CAAyC,CAAC;AAExE,wBAAgB,aAAa,IAAI,UAAU,CAM1C"}
+{"version":3,"file":"walletConfig.d.ts","sourceRoot":"","sources":["../../src/providers/walletConfig.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAElC,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEpF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,CAAC,KAAK,EAAE,GAAG,KAAK,EAAE,CAOtD,CAAC;AAEF,MAAM,WAAW,UAAU;IACzB,uFAAuF;IACvF,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,SAAS,CAAC,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IACtC,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iGAAiG;IACjG,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,kBAAkB,CAAC;QAAC,UAAU,CAAC,EAAE,oBAAoB,CAAA;KAAE,CAAC;CAC7E;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC,CAgB9E;AAED,eAAO,MAAM,iBAAiB,4CAAyC,CAAC;AAExE,wBAAgB,aAAa,IAAI,UAAU,CAM1C"}

package/types/siws/message.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"message.d.ts","sourceRoot":"","sources":["../../src/siws/message.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAuBnE"}
+{"version":3,"file":"message.d.ts","sourceRoot":"","sources":["../../src/siws/message.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAEnE"}

package/types/solana.d.ts

@@ -1,4 +1,4 @@
-export { connectSolanaWallet, findSolanaSigner, injectedSolanaSigner, solanaChainFromRpcUrl, solanaClient, solanaRpcUrls, standardSolanaSigner, transferSolInstruction, SolanaConfirmationError, type SolanaChain, type SolanaClient, type SolanaClientConfig, type SolanaCluster, type SolanaConfirmationFailure, type SolanaConfirmOptions, type SolanaSigner, type SolanaSubmission, } from "./clients/solana";
+export { connectSolanaWallet, findSolanaSigner, injectedSolanaSigner, solanaChainFromRpcUrl, solanaClient, solanaRpcUrls, standardSolanaSigner, transferSolInstruction, SolanaConfirmationError, type SolanaChain, type SolanaClient, type SolanaClientConfig, type SolanaCluster, type SolanaCommitmentStatus, type SolanaConfirmationFailure, type SolanaConfirmOptions, type SolanaSigner, type SolanaSubmission, } from "./clients/solana";
 export { useSolanaClient } from "./clients/useSolanaClient";
 export { getSolanaWallets, getStandardWallets, type StandardWallet, type StandardWalletAccount, } from "./clients/walletStandard";
 //# sourceMappingURL=solana.d.ts.map

package/types/solana.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"solana.d.ts","sourceRoot":"","sources":["../src/solana.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,EACrB,YAAY,EACZ,aAAa,EACb,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EACzB,KAAK,YAAY,EACjB,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,cAAc,EACnB,KAAK,qBAAqB,GAC3B,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"solana.d.ts","sourceRoot":"","sources":["../src/solana.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,EACrB,YAAY,EACZ,aAAa,EACb,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EACzB,KAAK,YAAY,EACjB,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,cAAc,EACnB,KAAK,qBAAqB,GAC3B,MAAM,0BAA0B,CAAC"}