feat(deps): remove WalletConnect from the app config and install tree

.pnpmfile.cjs

@@ -277,7 +277,48 @@ function stripTrezorDependencies(pkg, context) {
   }
 }
 
+// --- License compliance: strip the WalletConnect / Reown stack ---------------
+// We no longer register a WalletConnect connector in any ecosystem, so these
+// dependencies are dead weight -- and the EVM one drags in @reown/appkit.
+//
+// Reown moved AppKit to the Reown Community License at 1.8.3 (commercial fees
+// above 500 monthly active users, a mandatory-gateway clause and a
+// confidentiality clause). The wagmi team have themselves deprecated their
+// walletConnect connector over that relicence, noting they cannot patch a known
+// downstream vulnerability (pino@7.11.0) because of it.
+//
+// Both host packages reach WalletConnect through a single isolated module that
+// nothing else imports:
+//   - @wagmi/connectors                -> walletConnect.js (dynamic import, unused)
+//   - @creit.tech/stellar-wallets-kit   -> modules/walletconnect.module (not in the
+//     barrel, not in allowAllModules())
+// @wagmi/connectors@8+ makes its WalletConnect dependency an optional peer; until
+// we move to wagmi 3 this hook achieves the same on the version we pin.
+const WALLETCONNECT_STRIP = {
+  '@wagmi/connectors': ['@walletconnect/ethereum-provider'],
+  '@creit.tech/stellar-wallets-kit': ['@walletconnect/modal', '@walletconnect/sign-client'],
+};
+const WALLETCONNECT_DEP_FIELDS = ['dependencies', 'optionalDependencies', 'peerDependencies'];
+
+function stripWalletConnectDependencies(pkg, context) {
+  const deps = WALLETCONNECT_STRIP[pkg.name];
+  if (!deps) {
+    return;
+  }
+
+  for (const field of WALLETCONNECT_DEP_FIELDS) {
+    for (const dep of deps) {
+      if (pkg[field] && dep in pkg[field]) {
+        delete pkg[field][dep];
+        context.log(`[license] stripped ${dep} from ${pkg.name}@${pkg.version} (WalletConnect)`);
+      }
+    }
+  }
+}
+
 function readPackage(pkg, context) {
+  stripWalletConnectDependencies(pkg, context);
+
   stripTrezorDependencies(pkg, context);
 
   if (isAnyLocalFamilyEnabled()) {

apps/role-manager/public/app.config.json

@@ -9,9 +9,6 @@
   "rpcEndpoints": {},
   "indexerEndpoints": {},
   "globalServiceConfigs": {
-    "walletconnect": {
-      "projectId": "9f7100fc84f2327968f7bb11d38a4c2b"
-    },
     "walletui": {
       "stellar": {
         "kitName": "custom",

apps/role-manager/src/shims/walletconnect-removed.ts

@@ -0,0 +1,26 @@
+/**
+ * Stub for the WalletConnect provider that `@wagmi/connectors` dynamically imports.
+ *
+ * WalletConnect support was removed (its provider pulls in `@reown/appkit`, which
+ * moved to the Reown Community License at 1.8.3), and `.pnpmfile.cjs` strips
+ * `@walletconnect/ethereum-provider` from the install tree. `@wagmi/connectors`
+ * still re-exports its `walletConnect` connector, whose module contains
+ * `await import('@walletconnect/ethereum-provider')`. Rollup resolves dynamic
+ * imports at build time even when the call site is unreachable, so without this
+ * alias the production build fails with "failed to resolve import".
+ *
+ * Nothing registers that connector, so this module is never evaluated. It throws
+ * rather than returning a fake provider so that any future accidental use is loud.
+ */
+
+function walletConnectRemoved(): never {
+  throw new Error(
+    'WalletConnect support was removed from this application. Use an injected wallet, MetaMask or Safe.'
+  );
+}
+
+export const EthereumProvider = {
+  init: walletConnectRemoved,
+};
+
+export default EthereumProvider;

apps/role-manager/vite.config.ts

@@ -36,6 +36,14 @@ export default defineOpenZeppelinAdapterViteConfig({
     resolve: {
       alias: {
         '@': path.resolve(__dirname, './src'),
+        // WalletConnect was removed and its provider is stripped from the
+        // install tree, but @wagmi/connectors still ships an unreachable
+        // walletConnect module that dynamically imports it. Rollup resolves
+        // dynamic imports even when unreachable, so point it at a stub.
+        '@walletconnect/ethereum-provider': path.resolve(
+          __dirname,
+          './src/shims/walletconnect-removed.ts'
+        ),
         eventemitter3: eventemitter3CjsEntry,
       },
     },