@multiplatform.one/web3 7.29.1 → 7.30.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@multiplatform.one/web3",
-  "version": "7.29.1",
+  "version": "7.30.1",
   "description": "Web3 wallet integration for multiplatform.one ecosystem with ConnectKit and wagmi",
   "keywords": [
     "connectkit",
@@ -112,11 +112,12 @@
   },
   "dependencies": {
     "@aave/account": "^0.2.0",
+    "@coinbase/wallet-sdk": "^4.3.6",
     "@metamask/connect-evm": "^2.1.1",
-    "@multiplatform.one/connectkit": "7.29.1",
-    "@multiplatform.one/gpg": "7.29.1",
-    "@multiplatform.one/platform": "7.29.1",
-    "@multiplatform.one/theme": "7.29.1",
+    "@multiplatform.one/connectkit": "7.30.1",
+    "@multiplatform.one/gpg": "7.30.1",
+    "@multiplatform.one/platform": "7.30.1",
+    "@multiplatform.one/theme": "7.30.1",
     "@noble/curves": "^1.9.7",
     "@solana/kit": "^8.3.0",
     "@solana/wallet-adapter-base": "^0.9.27",
@@ -138,7 +139,7 @@
     "wagmi": "^3.7.1"
   },
   "devDependencies": {
-    "@multiplatform.one/config": "7.29.1",
+    "@multiplatform.one/config": "7.30.1",
     "@tamagui/build": "2.7.6",
     "@tanstack/react-query": "^5.100.7",
     "@testing-library/jest-dom": "^6.9.1",

package/src/connectkit/connectors/coinbaseWalletConnector.spec.ts

@@ -0,0 +1,141 @@
+// @vitest-environment happy-dom
+import { createConfig, createStorage } from "wagmi";
+import { reconnect } from "wagmi/actions";
+import { mainnet } from "viem/chains";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+const { sdkLoaded } = vi.hoisted(() => ({ sdkLoaded: vi.fn() }));
+
+vi.mock("@metamask/connect-evm", () => ({ createEVMClient: vi.fn(() => new Promise(() => {})) }));
+vi.mock("@coinbase/wallet-sdk", async (importOriginal) => {
+  sdkLoaded();
+  return importOriginal();
+});
+
+import getDefaultConfig from "../defaultConfig";
+import { coinbaseWalletConnectorId } from "./coinbaseWalletConnector";
+
+const loginPath = "/realms/main/protocol/openid-connect/auth";
+
+const memory = () => {
+  const store = new Map<string, string>();
+  return {
+    getItem: (key: string) => store.get(key) ?? null,
+    setItem: (key: string, value: string) => void store.set(key, value),
+    removeItem: (key: string) => void store.delete(key),
+  };
+};
+
+// The Coinbase Wallet SDK reads the page's Cross-Origin-Opener-Policy with a HEAD
+// request for the page's own path the moment it is built. Keycloak's auth endpoint
+// answers that 400, since the request carries none of its query.
+const fetchSpy = vi.fn(
+  async (_input: RequestInfo | URL, _init?: RequestInit) => new Response(null, { status: 400 }),
+);
+const pageHeads = () =>
+  fetchSpy.mock.calls.filter(
+    ([url, init]) => String(url).endsWith(loginPath) && init?.method === "HEAD",
+  );
+
+function setup(storage = createStorage({ storage: memory() })) {
+  const config = createConfig({
+    ...getDefaultConfig({ appName: "Sign in", chains: [mainnet], enableWallet: false }),
+    storage,
+  });
+  const coinbase = config.connectors.find((c) => c.id === coinbaseWalletConnectorId)!;
+  return { config, coinbase };
+}
+
+describe("Coinbase Wallet connector", () => {
+  beforeEach(() => {
+    vi.resetModules();
+    sdkLoaded.mockClear();
+    fetchSpy.mockClear();
+    vi.stubGlobal("fetch", fetchSpy);
+    vi.spyOn(window, "open").mockReturnValue(null);
+    window.history.replaceState(null, "", `${loginPath}?client_id=quickcam`);
+  });
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    vi.restoreAllMocks();
+  });
+
+  it("loads the SDK's module as the config is built, without a HEAD", async () => {
+    setup();
+    await vi.waitFor(() => expect(sdkLoaded).toHaveBeenCalledOnce());
+    await new Promise((resolve) => setTimeout(resolve, 0));
+    expect(pageHeads()).toEqual([]);
+  });
+
+  it("sends no HEAD for a Keycloak login page when wagmi reconnects on load", async () => {
+    const { config, coinbase } = setup();
+    expect(coinbase).toBeDefined();
+    await reconnect(config, { connectors: [coinbase] });
+    await new Promise((resolve) => setTimeout(resolve, 0));
+    expect(pageHeads()).toEqual([]);
+    expect(await coinbase.getProvider()).toBeUndefined();
+    expect(await coinbase.isAuthorized()).toBe(false);
+  });
+
+  it("builds the SDK when the user picks Coinbase Wallet", async () => {
+    const { coinbase } = setup();
+    void coinbase.connect().catch(() => undefined);
+    await vi.waitFor(() => expect(pageHeads()).toHaveLength(1));
+    expect(await coinbase.getProvider()).toBeDefined();
+    await vi.waitFor(() => expect(window.open).toHaveBeenCalled());
+  });
+
+  it("keeps a connect the user started while the load's storage read was pending", async () => {
+    let release!: (value: string | null) => void;
+    const recent = new Promise<string | null>((resolve) => (release = resolve));
+    const base = memory();
+    const { coinbase } = setup(
+      createStorage({
+        storage: {
+          ...base,
+          getItem: (key: string) =>
+            key.endsWith("recentConnectorId") ? recent : base.getItem(key),
+        },
+      }),
+    );
+    const onLoad = coinbase.getProvider();
+    void coinbase.connect().catch(() => undefined);
+    await vi.waitFor(() => expect(pageHeads()).toHaveLength(1));
+    release(null);
+    expect(await onLoad).toBeDefined();
+    expect(await coinbase.getProvider()).toBeDefined();
+  });
+
+  it("builds the SDK to restore a Coinbase Wallet connection wagmi still holds", async () => {
+    const storage = createStorage({ storage: memory() });
+    await storage.setItem("recentConnectorId", "metaMaskSDK");
+    // The page before the reload: a Coinbase Wallet connection wagmi persisted, current
+    // again after a later wallet closed, with recentConnectorId still naming that wallet.
+    const before = setup(storage).config;
+    const connector = {
+      id: coinbaseWalletConnectorId,
+      name: "Coinbase Wallet",
+      type: "coinbaseWallet",
+      uid: "cb",
+    };
+    before.setState((state) => ({
+      ...state,
+      connections: new Map([
+        ["cb", { accounts: ["0x0000000000000000000000000000000000000001"], chainId: 1, connector }],
+      ]) as never,
+      current: "cb",
+    }));
+    fetchSpy.mockClear();
+    const { coinbase } = setup(storage);
+    expect(await coinbase.getProvider()).toBeDefined();
+    expect(pageHeads()).toHaveLength(1);
+  });
+
+  it("builds the SDK to reconnect when Coinbase Wallet was the last connector", async () => {
+    const storage = createStorage({ storage: memory() });
+    await storage.setItem("recentConnectorId", coinbaseWalletConnectorId);
+    const { coinbase } = setup(storage);
+    expect(await coinbase.getProvider()).toBeDefined();
+    expect(pageHeads()).toHaveLength(1);
+  });
+});

package/src/connectkit/connectors/coinbaseWalletConnector.ts

@@ -0,0 +1,71 @@
+// wagmi's coinbaseWallet() builds the Coinbase Wallet SDK in getProvider(), and
+// wagmi's reconnect on load asks every connector for its provider. Building the
+// SDK sends a HEAD request for the page's own path to read its
+// Cross-Origin-Opener-Policy. On a Keycloak login page that path is the auth
+// endpoint, which answers 400 without its query, so every load logged two console
+// errors (PROMA-123). This builds the SDK only when the user picks Coinbase
+// Wallet, or when the page restores a Coinbase Wallet connection: the last one
+// wagmi connected, or one wagmi still holds.
+import type { CreateConnectorFn, Storage } from "wagmi";
+import { coinbaseWallet, type CoinbaseWalletParameters } from "wagmi/connectors/coinbaseWallet";
+
+export const coinbaseWalletConnectorId = "coinbaseWalletSDK";
+
+type PersistedConnection = { connector?: { id?: string } };
+
+// wagmi persists its connections under "store" as a Map, which its storage
+// revives on read.
+async function heldConnectorIds(storage: Storage | null | undefined): Promise<string[]> {
+  const persisted = (await storage?.getItem("store" as never)) as
+    | { state?: { connections?: unknown } }
+    | null
+    | undefined;
+  const connections = persisted?.state?.connections;
+  if (!(connections instanceof Map)) return [];
+  return [...(connections as Map<string, PersistedConnection>).values()].flatMap(
+    (connection) => connection?.connector?.id ?? [],
+  );
+}
+
+export function coinbaseWalletConnector(parameters?: CoinbaseWalletParameters): CreateConnectorFn {
+  const base = coinbaseWallet(parameters);
+
+  return (config) => {
+    const connector = base(config);
+    // Read while the connector is built: createConfig then writes its initial state
+    // over the persisted one, which stays empty until wagmi rehydrates.
+    const heldOnLoad = heldConnectorIds(config.storage).catch((): string[] => []);
+    let picked = false;
+    const due = async () => {
+      if (picked) return true;
+      const [recent, held] = await Promise.all([
+        config.storage?.getItem("recentConnectorId"),
+        heldOnLoad,
+      ]);
+      if (recent === coinbaseWalletConnectorId || held.includes(coinbaseWalletConnectorId))
+        picked = true;
+      return picked;
+    };
+    return {
+      ...connector,
+      async setup() {
+        // The SDK opens its popup only inside the tap's user activation, which a cold
+        // chunk load between tap and popup can outlast. Loading the module builds no SDK.
+        if (typeof window !== "undefined")
+          void import("@coinbase/wallet-sdk").catch(() => undefined);
+      },
+      async connect(parameters) {
+        picked = true;
+        return connector.connect.call(this, parameters);
+      },
+      async getProvider(parameters) {
+        if (!(await due())) return undefined;
+        return connector.getProvider.call(this, parameters);
+      },
+      async isAuthorized() {
+        if (!(await due())) return false;
+        return connector.isAuthorized.call(this);
+      },
+    } as ReturnType<typeof base>;
+  };
+}

package/src/connectkit/connectors/metaMaskConnectConnector.spec.ts

@@ -1,10 +1,10 @@
 import type { EventHandlers } from "@metamask/connect-evm";
 import type { Chain } from "viem";
 import { getAddress, SwitchChainError } from "viem";
-import { base, mainnet, polygon } from "viem/chains";
+import { base, baseSepolia, mainnet, polygon, polygonAmoy } from "viem/chains";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { createConfig, http } from "wagmi";
-import { connect, reconnect } from "wagmi/actions";
+import { connect, reconnect, sendTransaction, signMessage, signTypedData } from "wagmi/actions";
 
 import {
   metaMaskConnect,
@@ -122,6 +122,80 @@ describe("metaMaskConnect", () => {
     expect(result.chainId).toBe(base.id);
   });
 
+  it("tells MetaMask about Ethereum mainnet, which it adds to every connect, after the app's chains", async () => {
+    const connector = build([baseSepolia, polygonAmoy]);
+    await connector.setup?.();
+    await connector.connect({ chainId: baseSepolia.id });
+
+    const options = createEVMClient.mock.calls[0]![0] as {
+      api: { supportedNetworks: Record<string, string> };
+    };
+    expect(Object.keys(options.api.supportedNetworks)).toEqual([
+      hex(baseSepolia.id),
+      hex(polygonAmoy.id),
+      hex(mainnet.id),
+    ]);
+    expect(options.api.supportedNetworks[hex(mainnet.id)]).toBe(mainnet.rpcUrls.default.http[0]);
+    expect(client.connect.mock.calls[0]![0].chainIds).toEqual([
+      hex(baseSepolia.id),
+      hex(polygonAmoy.id),
+    ]);
+  });
+
+  it("falls back to mainnet's default URL when the app's mainnet transport has no usable one", async () => {
+    const connector = metaMaskConnect({ dapp: { name: "test", url: "https://example.test" } })({
+      chains: [mainnet, baseSepolia],
+      emitter: { uid: "metaMaskSDK", emit: vi.fn(), on: vi.fn(), once: vi.fn(), off: vi.fn() },
+      transports: { [mainnet.id]: http("/rpc/eth"), [baseSepolia.id]: http() },
+    } as never);
+    await connector.setup?.();
+
+    const options = createEVMClient.mock.calls[0]![0] as {
+      api: { supportedNetworks: Record<string, string> };
+    };
+    expect(options.api.supportedNetworks[hex(mainnet.id)]).toBe(mainnet.rpcUrls.default.http[0]);
+  });
+
+  it("keeps the app's own mainnet URL when the app lists mainnet", async () => {
+    const connector = metaMaskConnect({ dapp: { name: "test", url: "https://example.test" } })({
+      chains: [mainnet, base],
+      emitter: { uid: "metaMaskSDK", emit: vi.fn(), on: vi.fn(), once: vi.fn(), off: vi.fn() },
+      transports: { [mainnet.id]: http("https://mainnet.example.test"), [base.id]: http() },
+    } as never);
+    await connector.setup?.();
+
+    const options = createEVMClient.mock.calls[0]![0] as {
+      api: { supportedNetworks: Record<string, string> };
+    };
+    expect(Object.keys(options.api.supportedNetworks)).toEqual([hex(mainnet.id), hex(base.id)]);
+    expect(options.api.supportedNetworks[hex(mainnet.id)]).toBe("https://mainnet.example.test");
+  });
+
+  it("takes mainnet's URL from a mainnet transport the app gives without listing mainnet", async () => {
+    const connector = metaMaskConnect({ dapp: { name: "test", url: "https://example.test" } })({
+      chains: [baseSepolia],
+      emitter: { uid: "metaMaskSDK", emit: vi.fn(), on: vi.fn(), once: vi.fn(), off: vi.fn() },
+      transports: {
+        [baseSepolia.id]: http(),
+        [mainnet.id]: http("https://mainnet.example.test"),
+      },
+    } as never);
+    await connector.setup?.();
+
+    const options = createEVMClient.mock.calls[0]![0] as {
+      api: { supportedNetworks: Record<string, string> };
+    };
+    expect(options.api.supportedNetworks[hex(mainnet.id)]).toBe("https://mainnet.example.test");
+  });
+
+  it("still refuses to switch to mainnet when the app does not list it", async () => {
+    const connector = build([baseSepolia]);
+    await expect(connector.switchChain!({ chainId: mainnet.id })).rejects.toBeInstanceOf(
+      SwitchChainError,
+    );
+    expect(client.switchChain).not.toHaveBeenCalled();
+  });
+
   it("refuses to switch MetaMask to a synthetic chain", async () => {
     const connector = build([mainnet, ...syntheticChains]);
     await expect(connector.switchChain!({ chainId: SUI_CHAIN_ID })).rejects.toBeInstanceOf(
@@ -147,7 +221,11 @@ describe("metaMaskConnect under wagmi", () => {
     client.accounts = [];
   });
 
-  afterEach(() => resetMetaMaskConnectClient());
+  afterEach(() => {
+    resetMetaMaskConnectClient();
+    client.getChainId.mockImplementation(() => "0x2105");
+    client.getProvider.mockImplementation(() => ({ request: vi.fn() }));
+  });
 
   function wagmiConfig() {
     return createConfig({
@@ -221,6 +299,104 @@ describe("metaMaskConnect under wagmi", () => {
     expect(config.state.connections.get(connector.uid)?.accounts).toEqual([getAddress(second)]);
   });
 
+  it("signs on mainnet for a testnet app when the phone wallet granted only mainnet", async () => {
+    // MetaMask Connect refuses a request on a chain it was not given.
+    const request = vi.fn(async ({ method }: { method: string }) => {
+      const { api } = createEVMClient.mock.calls[0]![0] as {
+        api: { supportedNetworks: Record<string, string> };
+      };
+      const chainId = client.getChainId();
+      if (!api.supportedNetworks[chainId])
+        throw new Error(`Chain eip155:${Number(chainId)} is not configured in supportedNetworks`);
+      return method === "personal_sign" ? "0x5167" : null;
+    });
+    client.getChainId.mockReturnValue("0x1");
+    client.getProvider.mockReturnValue({ request } as never);
+    client.connect.mockImplementationOnce(async () => ({ accounts: [first], chainId: "0x1" }));
+    const config = createConfig({
+      chains: [baseSepolia],
+      connectors: [metaMaskConnect({ dapp: { name: "test", url: "https://example.test" } })],
+      transports: { [baseSepolia.id]: http() },
+      multiInjectedProviderDiscovery: false,
+      storage: null,
+    });
+
+    const connected = await connect(config, { connector: config.connectors[0]! });
+    const signature = await signMessage(config, { message: "prove it" });
+
+    expect(connected.chainId).toBe(mainnet.id);
+    expect(signature).toBe("0x5167");
+    expect(request.mock.calls.map(([call]) => call.method)).toContain("personal_sign");
+  });
+
+  it("sends no transaction or typed signature on mainnet for an app that does not list it", async () => {
+    const request = vi.fn(async ({ method }: { method: string }) =>
+      method === "eth_chainId" ? "0x1" : "0xabc",
+    );
+    client.getChainId.mockReturnValue("0x1");
+    client.getProvider.mockReturnValue({ request } as never);
+    client.connect.mockImplementationOnce(async () => ({ accounts: [first], chainId: "0x1" }));
+    const config = createConfig({
+      chains: [baseSepolia],
+      connectors: [metaMaskConnect({ dapp: { name: "test", url: "https://example.test" } })],
+      transports: { [baseSepolia.id]: http() },
+      multiInjectedProviderDiscovery: false,
+      storage: null,
+    });
+    await connect(config, { connector: config.connectors[0]! });
+
+    await expect(sendTransaction(config, { to: second, value: 1n, gas: 21000n })).rejects.toThrow();
+    await expect(
+      signTypedData(config, {
+        domain: { name: "t", chainId: 1 },
+        types: { Mail: [{ name: "body", type: "string" }] },
+        primaryType: "Mail",
+        message: { body: "x" },
+      }),
+    ).rejects.toThrow();
+
+    const sent = request.mock.calls.map(([call]) => call.method);
+    expect(sent).not.toContain("eth_sendTransaction");
+    expect(sent).not.toContain("eth_signTypedData_v4");
+  });
+
+  it("checks each config's own chains on the page's one provider, whichever wraps it first", async () => {
+    const request = vi.fn(async ({ method }: { method: string }) =>
+      method === "eth_chainId" ? "0x1" : "0xabc",
+    );
+    const provider = { request };
+    client.getChainId.mockReturnValue("0x1");
+    client.getProvider.mockReturnValue(provider as never);
+    const configFor = (chains: readonly [Chain, ...Chain[]]) =>
+      createConfig({
+        chains,
+        connectors: [metaMaskConnect({ dapp: { name: "test", url: "https://example.test" } })],
+        transports: Object.fromEntries(chains.map((chain) => [chain.id, http()])) as never,
+        multiInjectedProviderDiscovery: false,
+        storage: null,
+      });
+    const listsMainnet = configFor([mainnet, base]);
+    const testnetOnly = configFor([baseSepolia]);
+    const send = (config: ReturnType<typeof configFor>) =>
+      sendTransaction(config, { to: second, value: 1n, gas: 21000n });
+
+    client.connect.mockImplementation(async () => ({ accounts: [first], chainId: "0x1" }));
+    await connect(listsMainnet, { connector: listsMainnet.connectors[0]! });
+    await connect(testnetOnly, { connector: testnetOnly.connectors[0]! });
+
+    await expect(send(listsMainnet)).resolves.toBe("0xabc");
+    await expect(send(testnetOnly)).rejects.toThrow();
+    await expect(send(listsMainnet)).resolves.toBe("0xabc");
+    expect(
+      request.mock.calls.filter(([call]) => call.method === "eth_sendTransaction"),
+    ).toHaveLength(2);
+    client.connect.mockReset();
+    client.connect.mockImplementation(async () => ({
+      accounts: ["0x0000000000000000000000000000000000000001"],
+      chainId: "0x2105",
+    }));
+  });
+
   it("ignores a connect that carries no account", async () => {
     const config = wagmiConfig();
     const events = await clientEvents();

package/src/connectkit/connectors/metaMaskConnectConnector.ts

@@ -23,6 +23,7 @@ import {
   SwitchChainError,
   UserRejectedRequestError,
 } from "viem";
+import { mainnet } from "wagmi/chains";
 
 import { isSyntheticChainId } from "./syntheticChains";
 
@@ -59,6 +60,73 @@ export function metaMaskNetworks(
   return networks;
 }
 
+/**
+ * `networks` and Ethereum mainnet, for createEVMClient. MetaMask Connect adds
+ * mainnet to every connect, and a phone wallet with none of the app's chains
+ * enabled grants only mainnet. The session then sits on chain 1, and MetaMask
+ * Connect refuses every request on a chain it was not given, personal_sign
+ * included, so the wallet could never prove itself (PROMA-121).
+ */
+export function metaMaskSupportedNetworks(
+  networks: Record<Hex, string>,
+  transports?: ConnectorConfig["transports"],
+): Record<Hex, string> {
+  const id = numberToHex(mainnet.id);
+  if (networks[id]) return networks;
+  return {
+    ...networks,
+    [id]: metaMaskNetworks([mainnet], transports)[id] ?? mainnet.rpcUrls.default.http[0]!,
+  };
+}
+
+// What a session may still ask for on a chain the app does not list, such as
+// the mainnet a phone wallet grants on its own: the wallet's bookkeeping, a
+// switch to a listed chain, and personal_sign, which no chain scopes. A
+// transaction or a typed signature there would reach a network the app never
+// chose.
+const offListMethods = new Set([
+  "personal_sign",
+  "eth_accounts",
+  "eth_coinbase",
+  "eth_chainId",
+  "eth_requestAccounts",
+  "net_version",
+  "wallet_getPermissions",
+  "wallet_requestPermissions",
+  "wallet_revokePermissions",
+  "wallet_switchEthereumChain",
+  "wallet_addEthereumChain",
+  "metamask_getProviderState",
+  "metamask_sendDomainMetadata",
+  "metamask_logWeb3ShimUsage",
+  "wallet_registerOnboarding",
+]);
+
+function listedChainsOnly(
+  provider: EIP1193Provider,
+  mm: MetamaskConnectEVM,
+  networks: Record<Hex, string>,
+): EIP1193Provider {
+  const request = (async (args: { method: string; params?: unknown }) => {
+    const chainId = mm.getChainId();
+    if (chainId && !networks[numberToHex(Number(chainId))] && !offListMethods.has(args.method))
+      throw Object.assign(
+        new Error(
+          `MetaMask is on chain ${Number(chainId)}, which this app does not list, so ${args.method} was not sent`,
+        ),
+        { code: 4901 },
+      );
+    return provider.request(args as never);
+  }) as EIP1193Provider["request"];
+  return new Proxy(provider, {
+    get(target, property) {
+      if (property === "request") return request;
+      const value = Reflect.get(target, property);
+      return typeof value === "function" ? value.bind(target) : value;
+    },
+  });
+}
+
 /**
  * The URL wagmi's transport for `chain` talks to, the first one of a `fallback`.
  * @wagmi/core's extractRpcUrls does this, and wagmi does not re-export it.
@@ -174,8 +242,10 @@ export function metaMaskConnect(parameters: MetaMaskConnectParameters) {
   return createConnector<EIP1193Provider>((config) => {
     owner ??= config.emitter;
     const networks = metaMaskNetworks(config.chains, config.transports);
+    const supportedNetworks = metaMaskSupportedNetworks(networks, config.transports);
     const fallbackChainId = Number(Object.keys(networks)[0] ?? 1);
-    const instance = () => getClient(parameters, networks);
+    const instance = () => getClient(parameters, supportedNetworks);
+    let guarded: { provider: EIP1193Provider; wrapped: EIP1193Provider } | undefined;
     // Every call wagmi makes on the connector it uses claims the client's events;
     // setup() runs for every built config, so it does not.
     const claim = () => {
@@ -225,7 +295,13 @@ export function metaMaskConnect(parameters: MetaMaskConnectParameters) {
         return chainIdOf(await claim());
       },
       async getProvider() {
-        return (await claim()).getProvider();
+        // The page has one provider but each config its own chains, so each
+        // connector wraps it for itself.
+        const mm = await claim();
+        const provider = mm.getProvider();
+        if (guarded?.provider !== provider)
+          guarded = { provider, wrapped: listedChainsOnly(provider, mm, networks) };
+        return guarded.wrapped;
       },
       async isAuthorized() {
         // createEVMClient has already resumed a stored session, so its cached

package/src/connectkit/defaultConnectors.ts

@@ -1,7 +1,7 @@
 import { CreateConnectorFn } from "wagmi";
 // Per-connector subpaths: the package root re-exports every wagmi connector, and a
 // bundler that doesn't tree-shake (the webview, the login bundles) ships them all.
-import { coinbaseWallet, type CoinbaseWalletParameters } from "wagmi/connectors/coinbaseWallet";
+import type { CoinbaseWalletParameters } from "wagmi/connectors/coinbaseWallet";
 import { safe } from "wagmi/connectors/safe";
 import { metaMaskConnect } from "./connectors/metaMaskConnectConnector";
 import {
@@ -11,6 +11,7 @@ import {
 
 import type { EthereumProviderOptions as AaveAccountOptions } from "@aave/account";
 import { aaveAccountConnector } from "./connectors/aaveAccountConnector";
+import { coinbaseWalletConnector } from "./connectors/coinbaseWalletConnector";
 
 type DefaultConnectorsProps = {
   app: {
@@ -59,7 +60,7 @@ const defaultConnectors = ({
       },
       ...(isEmbeddedDesktopWebview() ? metaMaskOptionsForEmbeddedDesktop() : {}),
     }),
-    coinbaseWallet({
+    coinbaseWalletConnector({
       appName: app.name,
       appLogoUrl: app.icon,
       preference: {

package/src/keycloak/useWalletLogin.spec.tsx

@@ -1,9 +1,13 @@
 // @vitest-environment happy-dom
 import { act, cleanup, render, waitFor } from "@testing-library/react";
-import { verifyMessage, type Address } from "viem";
+import { http, verifyMessage, type Address } from "viem";
+import { mainnet } from "viem/chains";
+import { createConfig } from "wagmi";
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { useConnection } from "../core/react";
 import type { SignInCredential } from "../core/signIn";
+import { eth } from "../families/eth";
+import { createMockConnector } from "../providers/mockConnector";
 import { Web3Provider } from "../providers/WalletProvider";
 import { useWalletLogin, type UseWalletLoginResult } from "./useWalletLogin";
 
@@ -21,9 +25,18 @@ describe("useWalletLogin under a SignInProvider", () => {
       live.address = useConnection().address;
       return null;
     }
+    // Only the mock: wagmi's restore reports connected after every connector's
+    // getProvider settles, and the default ones load wallet SDKs first.
+    const config = createConfig({
+      chains: [mainnet],
+      connectors: [createMockConnector()],
+      multiInjectedProviderDiscovery: false,
+      transports: { [mainnet.id]: http() },
+    });
     render(
       <Web3Provider
-        config={{ appName: "wallet login on the store", families: ["eth"], mockWallet: true }}
+        config={{ appName: "wallet login on the store" }}
+        families={[eth({ config })]}
         signIn={{ getNonce: async () => "nonce-9", onSign, domain: "app.example.com" }}
       >
         <Probe />

package/types/connectkit/connectors/coinbaseWalletConnector.d.ts

@@ -0,0 +1,5 @@
+import type { CreateConnectorFn } from "wagmi";
+import { type CoinbaseWalletParameters } from "wagmi/connectors/coinbaseWallet";
+export declare const coinbaseWalletConnectorId = "coinbaseWalletSDK";
+export declare function coinbaseWalletConnector(parameters?: CoinbaseWalletParameters): CreateConnectorFn;
+//# sourceMappingURL=coinbaseWalletConnector.d.ts.map

package/types/connectkit/connectors/coinbaseWalletConnector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"coinbaseWalletConnector.d.ts","sourceRoot":"","sources":["../../../src/connectkit/connectors/coinbaseWalletConnector.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,iBAAiB,EAAW,MAAM,OAAO,CAAC;AACxD,OAAO,EAAkB,KAAK,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAEhG,eAAO,MAAM,yBAAyB,sBAAsB,CAAC;AAkB7D,wBAAgB,uBAAuB,CAAC,UAAU,CAAC,EAAE,wBAAwB,GAAG,iBAAiB,CAyChG"}

package/types/connectkit/connectors/metaMaskConnectConnector.d.ts

@@ -23,6 +23,14 @@ type ConnectorConfig = Parameters<CreateConnectorFn>[0];
  * kills connect() before it ever emits `display_uri`.
  */
 export declare function metaMaskNetworks(chains: readonly Chain[], transports?: ConnectorConfig["transports"]): Record<Hex, string>;
+/**
+ * `networks` and Ethereum mainnet, for createEVMClient. MetaMask Connect adds
+ * mainnet to every connect, and a phone wallet with none of the app's chains
+ * enabled grants only mainnet. The session then sits on chain 1, and MetaMask
+ * Connect refuses every request on a chain it was not given, personal_sign
+ * included, so the wallet could never prove itself (PROMA-121).
+ */
+export declare function metaMaskSupportedNetworks(networks: Record<Hex, string>, transports?: ConnectorConfig["transports"]): Record<Hex, string>;
 /** The chain ids a connect asks MetaMask for, the requested one first (it becomes the active chain). */
 export declare function metaMaskConnectChainIds(networks: Record<Hex, string>, chainId?: number): Hex[];
 /** Test seam: forget the page's client so the next connector builds a fresh one. */

package/types/connectkit/connectors/metaMaskConnectConnector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"metaMaskConnectConnector.d.ts","sourceRoot":"","sources":["../../../src/connectkit/connectors/metaMaskConnectConnector.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,eAAe,EAAsB,MAAM,uBAAuB,CAAC;AACjF,OAAO,EAA2B,KAAK,iBAAiB,EAAmB,MAAM,OAAO,CAAC;AACzF,OAAO,EAEL,KAAK,KAAK,EAEV,KAAK,GAAG,EAKT,MAAM,MAAM,CAAC;AAId,MAAM,MAAM,yBAAyB,GAAG;IACtC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,6FAA6F;IAC7F,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,mFAAmF;IACnF,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAChE,6EAA6E;IAC7E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,KAAK,eAAe,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;AAGxD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,SAAS,KAAK,EAAE,EACxB,UAAU,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,GACzC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAQrB;AAwBD,wGAAwG;AACxG,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,GAAG,EAAE,CAK9F;AAoED,oFAAoF;AACpF,wBAAgB,0BAA0B,IAAI,IAAI,CAGjD;AAWD,wBAAgB,eAAe,CAAC,UAAU,EAAE,yBAAyB,wFA2GpE;yBA3Ge,eAAe"}
+{"version":3,"file":"metaMaskConnectConnector.d.ts","sourceRoot":"","sources":["../../../src/connectkit/connectors/metaMaskConnectConnector.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,eAAe,EAAsB,MAAM,uBAAuB,CAAC;AACjF,OAAO,EAA2B,KAAK,iBAAiB,EAAmB,MAAM,OAAO,CAAC;AACzF,OAAO,EAEL,KAAK,KAAK,EAEV,KAAK,GAAG,EAKT,MAAM,MAAM,CAAC;AAKd,MAAM,MAAM,yBAAyB,GAAG;IACtC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,6FAA6F;IAC7F,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,mFAAmF;IACnF,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAChE,6EAA6E;IAC7E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,KAAK,eAAe,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;AAGxD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,SAAS,KAAK,EAAE,EACxB,UAAU,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,GACzC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAQrB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,EAC7B,UAAU,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,GACzC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAOrB;AAwED,wGAAwG;AACxG,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,GAAG,EAAE,CAK9F;AAoED,oFAAoF;AACpF,wBAAgB,0BAA0B,IAAI,IAAI,CAGjD;AAWD,wBAAgB,eAAe,CAAC,UAAU,EAAE,yBAAyB,wFAmHpE;yBAnHe,eAAe"}

package/types/connectkit/defaultConnectors.d.ts

@@ -1,5 +1,5 @@
 import { CreateConnectorFn } from "wagmi";
-import { type CoinbaseWalletParameters } from "wagmi/connectors/coinbaseWallet";
+import type { CoinbaseWalletParameters } from "wagmi/connectors/coinbaseWallet";
 import type { EthereumProviderOptions as AaveAccountOptions } from "@aave/account";
 type DefaultConnectorsProps = {
     app: {