ReadonlystateThe current client state (auth + wallet status, claims, address, phase). Always up to date.
Hide the wallet overlay.
Connect the embedded wallet. MUST be called synchronously from a user gesture (it opens the wallet-origin popup for OIDC login + passkey onboarding). Returns the connected accounts.
Layer 1 wallet session; also resolves needs-setup vs needs-recovery for new devices.
The OAuth access token for the issuer's userinfo/management APIs, or null when unavailable.
EIP-1193 provider over the widget (ethers/viem plug in directly). Mounts the widget on first call.
The raw id_token for downstream verification, or null when there is no valid session.
Recovery status (enrollment + masked OTP contact). Layer 1 — works right after connectWallet, no unlock.
The signed-in user's id_token claims, or null when signed out or the token has expired.
Call once on page load: consumes the redirect callback (and cleans the URL) or restores a persisted session.
Persists PKCE state, then navigates to the issuer. Optional hints (connection, loginHint) skip the issuer's provider chooser. Does not resolve into app code.
Optionalhints: AuthorizationHintsWallet session first, then RP-initiated issuer logout redirect. Clears storage; keeps the device factor (B1).
Optionaloptions: { postLogoutRedirectUri?: string }Open the wallet overlay on a view (RP-initiated, e.g. a "wallet" button).
Optionalview: WalletViewNew-device recovery: synced-passkey restore first, recoverian ceremony fallback.
Rotate the recovery factor (Layer 2 required).
First-time onboarding — the first unlock creates the wallet.
EIP-191 personal message signature. Same ceremony semantics as signTransaction.
Signs with the session ceremony; every signature re-gates with a fresh biometric. Call from a user gesture.
Observe state changes; returns an unsubscribe function.
Establishes the session's Layer 2 ceremony (device factor + passkey biometric) and returns the wallet address. Call from a user gesture. One ceremony per session (A2): signatures reuse it, each behind a fresh biometric; logout disposes it.
Re-register the recovery contact from the current session's claims
(recovery change → Layer 2). Requires an unlocked wallet (wallet_locked
otherwise); rebinding an already-bound contact runs an OTP ceremony
against the OLD contact via wallet.recovery.promptOtp.
Optionalopts: { channel?: "email" | "sms" }
The browser client returned by createUpbond — the entire supported
@upbond/sdkruntime surface. It combines the OIDC auth leg (login, session, claims) with the wallet leg (connect, unlock, sign, recovery) in either redirect or embedded mode. Read UpbondClient.state synchronously or observe it via UpbondClient.subscribe.