feat(export): remove WalletConnect from exported apps and the install tree

.pnpmfile.cjs

@@ -276,7 +276,48 @@ function stripTrezorDependencies(pkg, context) {
   }
 }
 
+// --- License compliance: strip the WalletConnect / Reown stack ---------------
+// We no longer register a WalletConnect connector in any ecosystem, so these
+// dependencies are dead weight -- and the EVM one drags in @reown/appkit.
+//
+// Reown moved AppKit to the Reown Community License at 1.8.3 (commercial fees
+// above 500 monthly active users, a mandatory-gateway clause and a
+// confidentiality clause). The wagmi team have themselves deprecated their
+// walletConnect connector over that relicence, noting they cannot patch a known
+// downstream vulnerability (pino@7.11.0) because of it.
+//
+// Both host packages reach WalletConnect through a single isolated module that
+// nothing else imports:
+//   - @wagmi/connectors                -> walletConnect.js (dynamic import, unused)
+//   - @creit.tech/stellar-wallets-kit   -> modules/walletconnect.module (not in the
+//     barrel, not in allowAllModules())
+// @wagmi/connectors@8+ makes its WalletConnect dependency an optional peer; until
+// we move to wagmi 3 this hook achieves the same on the version we pin.
+const WALLETCONNECT_STRIP = {
+  '@wagmi/connectors': ['@walletconnect/ethereum-provider'],
+  '@creit.tech/stellar-wallets-kit': ['@walletconnect/modal', '@walletconnect/sign-client'],
+};
+const WALLETCONNECT_DEP_FIELDS = ['dependencies', 'optionalDependencies', 'peerDependencies'];
+
+function stripWalletConnectDependencies(pkg, context) {
+  const deps = WALLETCONNECT_STRIP[pkg.name];
+  if (!deps) {
+    return;
+  }
+
+  for (const field of WALLETCONNECT_DEP_FIELDS) {
+    for (const dep of deps) {
+      if (pkg[field] && dep in pkg[field]) {
+        delete pkg[field][dep];
+        context.log(`[license] stripped ${dep} from ${pkg.name}@${pkg.version} (WalletConnect)`);
+      }
+    }
+  }
+}
+
 function readPackage(pkg, context) {
+  stripWalletConnectDependencies(pkg, context);
+
   stripTrezorDependencies(pkg, context);
 
   if (isAnyLocalFamilyEnabled()) {

apps/builder/src/export/__tests__/TrezorLicenseExclusion.verification.test.ts

@@ -48,12 +48,25 @@ describe('exported app excludes the T-RSL Trezor stack', () => {
     expect(hook).toContain('function readPackage(pkg, context)');
     expect(hook).toContain('stripTrezorDependencies(pkg, context)');
 
+    // The same hook must also strip the WalletConnect provider, which drags in
+    // @reown/appkit (Reown Community License from 1.8.3).
+    expect(hook).toContain("'@wagmi/connectors'");
+    expect(hook).toContain('@walletconnect/ethereum-provider');
+    expect(hook).toContain('stripWalletConnectDependencies(pkg, context)');
+
+    // And the bundler needs the stub, or the generated app cannot build.
+    expect(files['src/shims/walletconnect-removed.ts']).toBeDefined();
+    expect(files['vite.config.ts']).toContain('@walletconnect/ethereum-provider');
+    expect(files['.npmrc']).not.toContain('@walletconnect');
+
     // No Trezor package may ever be a declared dependency of an exported app.
     const packageJson = JSON.parse(files['package.json']);
     const allDeps = {
       ...((packageJson.dependencies ?? {}) as Record<string, string>),
       ...((packageJson.devDependencies ?? {}) as Record<string, string>),
     };
     expect(Object.keys(allDeps).filter((name) => name.startsWith('@trezor/'))).toEqual([]);
+    expect(Object.keys(allDeps).filter((name) => name.startsWith('@walletconnect/'))).toEqual([]);
+    expect(Object.keys(allDeps).filter((name) => name.startsWith('@reown/'))).toEqual([]);
   });
 });

apps/builder/src/export/assemblers/__tests__/generateAndAddAppConfig.test.ts

@@ -255,11 +255,13 @@ describe('generateAndAddAppConfig', () => {
       expect(exampleConfig._readme.length).toBeGreaterThan(0);
       expect(exampleConfig._readme[0]).toContain('example configuration file');
 
-      // Check WalletConnect configuration
-      expect(exampleConfig.globalServiceConfigs.walletconnect).toMatchObject({
-        projectId: 'YOUR_WALLETCONNECT_PROJECT_ID_HERE',
-        _comment: expect.stringContaining('WalletConnect Project ID'),
-      });
+      // WalletConnect support was removed, so nothing should invite the user to
+      // configure it.
+      expect(exampleConfig.globalServiceConfigs.walletconnect).toBeUndefined();
+      expect(projectFiles['public/app.config.json.example']).not.toContain('walletconnect');
+
+      // The wallet UI section is what globalServiceConfigs actually carries now.
+      expect(exampleConfig.globalServiceConfigs).toHaveProperty('walletui');
     });
 
     it('should handle different ecosystem naming in generated configs', async () => {

apps/builder/src/export/assemblers/generateAndAddAppConfig.ts

@@ -117,10 +117,6 @@ function _buildWalletUiServiceConfig(): WalletUiServiceConfig {
 function _generateGlobalServiceConfigPlaceholders(): GlobalServiceConfigs {
   return {
     walletui: _buildWalletUiServiceConfig(),
-    walletconnect: {
-      projectId: 'YOUR_WALLETCONNECT_PROJECT_ID_HERE',
-      _comment: 'WalletConnect Project ID, required if you intend to use WalletConnect.',
-    },
   };
 }
 

apps/builder/src/export/generators/ViteConfigGenerator.ts

@@ -86,6 +86,20 @@ export function generateViteConfig(options: ViteConfigGeneratorOptions): string
     ? '        ...(eventemitter3CjsEntry ? { eventemitter3: eventemitter3CjsEntry } : {}),'
     : '';
 
+  // WalletConnect support was removed and the exported .pnpmfile.cjs strips its
+  // provider from the install tree. @wagmi/connectors still re-exports an
+  // unreachable walletConnect module that dynamically imports it, and Rollup
+  // resolves dynamic imports at build time even when the call site is
+  // unreachable -- so without this alias the exported app cannot build.
+  const walletConnectStubAlias = usesWalletInterop
+    ? [
+        "        '@walletconnect/ethereum-provider': path.resolve(",
+        '          __dirname,',
+        "          './src/shims/walletconnect-removed.ts'",
+        '        ),',
+      ].join('\n')
+    : '';
+
   const optimizeDepsInclude = buildOptimizeDepsInclude(
     usesWalletInterop,
     viteConfig?.optimizeDeps?.include
@@ -109,6 +123,7 @@ ${plugins.join('\n')}
         buffer: 'buffer/',
         events: 'events/',
 ${eventemitter3Alias}
+${walletConnectStubAlias}
       },
 ${dedupeConfig}
     },

apps/builder/src/export/templates/typescript-react-vite/.npmrc

@@ -3,7 +3,6 @@
 # eventemitter3 is also aliased + pre-bundled in vite.config.ts for wallet ecosystems.
 # `debug` is hoisted only — do not alias or add to optimizeDeps.include (browser field).
 public-hoist-pattern[]=@wagmi/connectors
-public-hoist-pattern[]=@walletconnect/*
 public-hoist-pattern[]=@metamask/*
 public-hoist-pattern[]=@stellar/freighter-api
 public-hoist-pattern[]=eventemitter3

apps/builder/src/export/templates/typescript-react-vite/.pnpmfile.cjs

@@ -39,7 +39,48 @@ function stripTrezorDependencies(pkg, context) {
   }
 }
 
+// --- License compliance: strip the WalletConnect / Reown stack ---------------
+// We no longer register a WalletConnect connector in any ecosystem, so these
+// dependencies are dead weight -- and the EVM one drags in @reown/appkit.
+//
+// Reown moved AppKit to the Reown Community License at 1.8.3 (commercial fees
+// above 500 monthly active users, a mandatory-gateway clause and a
+// confidentiality clause). The wagmi team have themselves deprecated their
+// walletConnect connector over that relicence, noting they cannot patch a known
+// downstream vulnerability (pino@7.11.0) because of it.
+//
+// Both host packages reach WalletConnect through a single isolated module that
+// nothing else imports:
+//   - @wagmi/connectors                -> walletConnect.js (dynamic import, unused)
+//   - @creit.tech/stellar-wallets-kit   -> modules/walletconnect.module (not in the
+//     barrel, not in allowAllModules())
+// @wagmi/connectors@8+ makes its WalletConnect dependency an optional peer; until
+// we move to wagmi 3 this hook achieves the same on the version we pin.
+const WALLETCONNECT_STRIP = {
+  '@wagmi/connectors': ['@walletconnect/ethereum-provider'],
+  '@creit.tech/stellar-wallets-kit': ['@walletconnect/modal', '@walletconnect/sign-client'],
+};
+const WALLETCONNECT_DEP_FIELDS = ['dependencies', 'optionalDependencies', 'peerDependencies'];
+
+function stripWalletConnectDependencies(pkg, context) {
+  const deps = WALLETCONNECT_STRIP[pkg.name];
+  if (!deps) {
+    return;
+  }
+
+  for (const field of WALLETCONNECT_DEP_FIELDS) {
+    for (const dep of deps) {
+      if (pkg[field] && dep in pkg[field]) {
+        delete pkg[field][dep];
+        context.log(`[license] stripped ${dep} from ${pkg.name}@${pkg.version} (WalletConnect)`);
+      }
+    }
+  }
+}
+
 function readPackage(pkg, context) {
+  stripWalletConnectDependencies(pkg, context);
+
   stripTrezorDependencies(pkg, context);
 
   return pkg;

apps/builder/src/export/templates/typescript-react-vite/README.md

@@ -114,9 +114,9 @@ To configure your application:
     }
   },
   "globalServiceConfigs": {
-    "walletconnect": {
-      "projectId": "YOUR_WALLETCONNECT_PROJECT_ID_HERE",
-      "_comment": "WalletConnect Project ID, required if WalletConnect is used."
+    "walletui": {
+      "_comment": "Wallet UI config, keyed by ecosystem. Supported kitNames: rainbowkit, stellar-wallets-kit, custom.",
+      "evm": { "kitName": "rainbowkit", "kitConfig": {} }
     }
   },
   "rpcEndpoints": {

apps/builder/src/export/templates/typescript-react-vite/src/shims/walletconnect-removed.ts

@@ -0,0 +1,26 @@
+/**
+ * Stub for the WalletConnect provider that `@wagmi/connectors` dynamically imports.
+ *
+ * WalletConnect support was removed (its provider pulls in `@reown/appkit`, which
+ * moved to the Reown Community License at 1.8.3), and `.pnpmfile.cjs` strips
+ * `@walletconnect/ethereum-provider` from the install tree. `@wagmi/connectors`
+ * still re-exports its `walletConnect` connector, whose module contains
+ * `await import('@walletconnect/ethereum-provider')`. Rollup resolves dynamic
+ * imports at build time even when the call site is unreachable, so without this
+ * alias the production build fails with "failed to resolve import".
+ *
+ * Nothing registers that connector, so this module is never evaluated. It throws
+ * rather than returning a fake provider so that any future accidental use is loud.
+ */
+
+function walletConnectRemoved(): never {
+  throw new Error(
+    'WalletConnect support was removed from this application. Use an injected wallet, MetaMask or Safe.'
+  );
+}
+
+export const EthereumProvider = {
+  init: walletConnectRemoved,
+};
+
+export default EthereumProvider;

apps/builder/src/export/templates/typescript-react-vite/vite.config.ts

@@ -34,6 +34,15 @@ export default defineConfig(({ mode }) => ({
     alias: {
       '@': path.resolve(__dirname, './src'),
       ...(eventemitter3CjsEntry ? { eventemitter3: eventemitter3CjsEntry } : {}),
+      // WalletConnect support was removed and .pnpmfile.cjs strips its provider
+      // from the install tree. @wagmi/connectors still ships an unreachable
+      // walletConnect module that dynamically imports it, and Rollup resolves
+      // dynamic imports at build time even when unreachable, so point it at a
+      // stub. See src/shims/walletconnect-removed.ts.
+      '@walletconnect/ethereum-provider': path.resolve(
+        __dirname,
+        './src/shims/walletconnect-removed.ts'
+      ),
     },
   },
   define: {

apps/builder/src/shims/walletconnect-removed.ts

@@ -0,0 +1,26 @@
+/**
+ * Stub for the WalletConnect provider that `@wagmi/connectors` dynamically imports.
+ *
+ * WalletConnect support was removed (its provider pulls in `@reown/appkit`, which
+ * moved to the Reown Community License at 1.8.3), and `.pnpmfile.cjs` strips
+ * `@walletconnect/ethereum-provider` from the install tree. `@wagmi/connectors`
+ * still re-exports its `walletConnect` connector, whose module contains
+ * `await import('@walletconnect/ethereum-provider')`. Rollup resolves dynamic
+ * imports at build time even when the call site is unreachable, so without this
+ * alias the production build fails with "failed to resolve import".
+ *
+ * Nothing registers that connector, so this module is never evaluated. It throws
+ * rather than returning a fake provider so that any future accidental use is loud.
+ */
+
+function walletConnectRemoved(): never {
+  throw new Error(
+    'WalletConnect support was removed from this application. Use an injected wallet, MetaMask or Safe.'
+  );
+}
+
+export const EthereumProvider = {
+  init: walletConnectRemoved,
+};
+
+export default EthereumProvider;

apps/builder/vite.config.ts

@@ -85,6 +85,14 @@ export default adapters.vite({
       buffer: bufferPolyfillPath,
       'buffer/': bufferPolyfillPath,
       eventemitter3: eventemitter3CjsEntry,
+      // WalletConnect was removed and its provider is stripped from the install
+      // tree, but @wagmi/connectors still ships an unreachable walletConnect
+      // module that dynamically imports it. Rollup resolves dynamic imports even
+      // when unreachable, so point it at a stub.
+      '@walletconnect/ethereum-provider': path.resolve(
+        __dirname,
+        './src/shims/walletconnect-removed.ts'
+      ),
     },
   },
   define: {