@solarpunkltd/swarm-id 0.8.2 → 0.10.0

package/dist/schemas.d.ts

@@ -59,6 +59,34 @@ export declare const ChatBindingSchema: z.ZodObject<{
     message: z.ZodString;
     signature: z.ZodString;
 }, z.core.$strip>;
+/**
+ * Longer than any wallet link message can be: five lines, 258 characters,
+ * around two addresses and a date. A bound on what is stored and carried, not
+ * a check of the format, which `verifyWalletLink` does.
+ */
+export declare const WALLET_LINK_MAX_LENGTH = 320;
+/**
+ * The account's and its wallet's statement that they belong together
+ * (`utils/wallet-link.ts`, docs/Wallet-Link.md). Kept in the account's synced
+ * settings while the person has "Show my ENS name on sites" on, and shared
+ * with sites in the connection identity.
+ */
+export declare const WalletLinkSchema: z.ZodObject<{
+    message: z.ZodString;
+    walletSignature: z.ZodString;
+    accountSignature: z.ZodString;
+}, z.core.$strip>;
+/**
+ * The account's synced settings, one shape for the account record, the state
+ * snapshot and the device feed, so a setting one of them does not name is
+ * never stripped on the way to another device. The whole object is one
+ * last-writer-wins field (`settingsAt`). The wallet link is not in it: it
+ * has a clock of its own (`walletLinkAt`), so another device's settings edit
+ * can never bring back a link that was turned off.
+ */
+export declare const AccountSettingsSchema: z.ZodObject<{
+    appSessionDuration: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
 /** The stamp choice of an app the person set to use no stamp at all */
 export declare const NO_POSTAGE_STAMP = "none";
 /**
@@ -236,9 +264,15 @@ export declare const SyncedAccountSchemaV1: z.ZodObject<{
     settings: z.ZodOptional<z.ZodObject<{
         appSessionDuration: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strip>>;
+    walletLink: z.ZodOptional<z.ZodObject<{
+        message: z.ZodString;
+        walletSignature: z.ZodString;
+        accountSignature: z.ZodString;
+    }, z.core.$strip>>;
     accountNameAt: z.ZodOptional<z.ZodNumber>;
     defaultStampAt: z.ZodOptional<z.ZodNumber>;
     settingsAt: z.ZodOptional<z.ZodNumber>;
+    walletLinkAt: z.ZodOptional<z.ZodNumber>;
     lastModified: z.ZodOptional<z.ZodNumber>;
     partitionCount: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>;
@@ -303,9 +337,15 @@ declare const SignedInAccountSchemaV1: z.ZodObject<{
     settings: z.ZodOptional<z.ZodObject<{
         appSessionDuration: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strip>>;
+    walletLink: z.ZodOptional<z.ZodObject<{
+        message: z.ZodString;
+        walletSignature: z.ZodString;
+        accountSignature: z.ZodString;
+    }, z.core.$strip>>;
     accountNameAt: z.ZodOptional<z.ZodNumber>;
     defaultStampAt: z.ZodOptional<z.ZodNumber>;
     settingsAt: z.ZodOptional<z.ZodNumber>;
+    walletLinkAt: z.ZodOptional<z.ZodNumber>;
     lastModified: z.ZodOptional<z.ZodNumber>;
     partitionCount: z.ZodOptional<z.ZodNumber>;
     signedOutAt: z.ZodOptional<z.ZodUndefined>;
@@ -428,9 +468,15 @@ export declare const LocalAccountSchemaV1: z.ZodUnion<readonly [z.ZodObject<{
     settings: z.ZodOptional<z.ZodObject<{
         appSessionDuration: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strip>>;
+    walletLink: z.ZodOptional<z.ZodObject<{
+        message: z.ZodString;
+        walletSignature: z.ZodString;
+        accountSignature: z.ZodString;
+    }, z.core.$strip>>;
     accountNameAt: z.ZodOptional<z.ZodNumber>;
     defaultStampAt: z.ZodOptional<z.ZodNumber>;
     settingsAt: z.ZodOptional<z.ZodNumber>;
+    walletLinkAt: z.ZodOptional<z.ZodNumber>;
     lastModified: z.ZodOptional<z.ZodNumber>;
     partitionCount: z.ZodOptional<z.ZodNumber>;
     signedOutAt: z.ZodOptional<z.ZodUndefined>;
@@ -477,9 +523,15 @@ export declare const AccountMetadataSchemaV1: z.ZodObject<{
     settings: z.ZodOptional<z.ZodObject<{
         appSessionDuration: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strip>>;
+    walletLink: z.ZodOptional<z.ZodObject<{
+        message: z.ZodString;
+        walletSignature: z.ZodString;
+        accountSignature: z.ZodString;
+    }, z.core.$strip>>;
     accountNameAt: z.ZodOptional<z.ZodNumber>;
     defaultStampAt: z.ZodOptional<z.ZodNumber>;
     settingsAt: z.ZodOptional<z.ZodNumber>;
+    walletLinkAt: z.ZodOptional<z.ZodNumber>;
     createdAt: z.ZodNumber;
     lastModified: z.ZodNumber;
     devices: z.ZodDefault<z.ZodArray<z.ZodObject<{
@@ -511,9 +563,15 @@ export declare const AccountStateSnapshotSchemaV1: z.ZodObject<{
         settings: z.ZodOptional<z.ZodObject<{
             appSessionDuration: z.ZodOptional<z.ZodNumber>;
         }, z.core.$strip>>;
+        walletLink: z.ZodOptional<z.ZodObject<{
+            message: z.ZodString;
+            walletSignature: z.ZodString;
+            accountSignature: z.ZodString;
+        }, z.core.$strip>>;
         accountNameAt: z.ZodOptional<z.ZodNumber>;
         defaultStampAt: z.ZodOptional<z.ZodNumber>;
         settingsAt: z.ZodOptional<z.ZodNumber>;
+        walletLinkAt: z.ZodOptional<z.ZodNumber>;
         createdAt: z.ZodNumber;
         lastModified: z.ZodNumber;
         devices: z.ZodDefault<z.ZodArray<z.ZodObject<{
@@ -572,6 +630,7 @@ export type SignedOutAccount = z.infer<typeof SignedOutAccountSchemaV1>;
 /** The local (on-device) account record: `SignedInAccount | SignedOutAccount`. */
 export type Account = z.infer<typeof LocalAccountSchemaV1>;
 export type ConnectedApp = z.infer<typeof ConnectedAppSchemaV1>;
+export type AccountSettings = z.infer<typeof AccountSettingsSchema>;
 export type PostageStamp = z.infer<typeof PostageStampSchemaV1>;
 export type AccountMetadata = z.infer<typeof AccountMetadataSchemaV1>;
 export type AccountStateSnapshot = z.infer<typeof AccountStateSnapshotSchemaV1>;

package/dist/swarm-id-button-frame.d.ts

@@ -0,0 +1,77 @@
+import type { SiteAllowList } from "./utils/site-allow-list";
+export interface ButtonFrameConfig {
+    /**
+     * The sites this frame serves (docs/Site-Allow-List.md), the same list the
+     * session frame asks. A site it refuses gets no button.
+     */
+    siteAllowList: SiteAllowList;
+    /** Take font files over http on localhost, which only a development build does */
+    allowLocalHttp?: boolean;
+}
+/**
+ * The visible Swarm ID button a site mounts with `SwarmIdClient.mountButton`.
+ *
+ * It exists because a frame may open a window only from a click inside it.
+ * A site on another site than Swarm ID gets a session frame whose storage is
+ * partitioned from the connect window's, so the only way in is a handover the
+ * window posts to Swarm ID's frames on the page that opened it, and a window
+ * the site's page opens has no such page to post to. The click therefore
+ * happens here: this frame opens the window and is its opener, and tells the
+ * session frame beside it the window's challenge, so it takes the handover
+ * that comes back under it (the window side is `ui/src/lib/handover-targets.ts`).
+ * Both frames are Swarm ID's origin under the same top-level site, so they
+ * share the partition, and nothing passes the site's page. Every check on the
+ * handover stays in the session frame (`SwarmIdProxy.handlePopupMessage`).
+ */
+export declare class SwarmIdButtonFrame {
+    private readonly options;
+    private readonly container;
+    private parentOrigin;
+    private identifyReceived;
+    private action;
+    private config;
+    private metadata;
+    private popupMode;
+    private storageShared;
+    private connectWindow;
+    private watchStart;
+    private watchInterval;
+    private button;
+    /** Font files asked for, so each is fetched, and reported, once */
+    private readonly requestedFonts;
+    private readonly onMessage;
+    constructor(options: ButtonFrameConfig, container: HTMLElement);
+    destroy(): void;
+    private handleMessage;
+    private handleIdentify;
+    private handleUpdate;
+    /**
+     * Loads the site's font files into this frame. The label already names the
+     * family, so it changes once a file arrives, and keeps the fallback family
+     * when one does not. The fetch is cross-origin, so the site serves the file
+     * with an `Access-Control-Allow-Origin` naming Swarm ID's origin.
+     */
+    private loadFontFaces;
+    private render;
+    /**
+     * Opens the connect window from the person's click, which is what lets the
+     * browser open it at all. The window looks for the challenge in its own
+     * storage to learn whether the session frame reads that storage, so it goes
+     * there first only when this frame can open what the first-party pages
+     * sealed (`isStorageShared`). Otherwise the window hands the session over,
+     * and the session frames are told the challenge once the window is open, so
+     * they take the handover that comes back under it.
+     */
+    private openConnectWindow;
+    private watchWindow;
+    private stopWatchingWindow;
+    /**
+     * Every other frame of the parent page, on Swarm ID's own origin only, so
+     * the browser delivers it to Swarm ID's frames and drops it for the site's.
+     */
+    private tellSessionFrames;
+    private tellWindowState;
+    private tellParent;
+}
+/** Starts the button frame, as `initProxy` starts the session frame */
+export declare function initButtonFrame(config: ButtonFrameConfig, container: HTMLElement): SwarmIdButtonFrame;

package/dist/swarm-id-client.d.ts

@@ -1,4 +1,4 @@
-import type { ClientOptions, ConnectOptions, AuthStatus, Avatar, ConnectionInfo, UploadResult, FileData, UploadOptions, UploadFilesOptions, CollectionFileInput, CollectionEntry, ActUploadOptions, DownloadOptions, RequestOptions, Reference, SOCReader, SOCWriter, FeedReaderOptions, FeedWriterOptions, FeedReader, FeedWriter, SequentialFeedReaderOptions, SequentialFeedWriterOptions, SequentialFeedReader, SequentialFeedWriter, StampChunkInput, StampedChunk, PostageBatch } from "./types";
+import type { ClientOptions, ConnectOptions, AuthStatus, Avatar, ConnectionInfo, UploadResult, FileData, UploadOptions, UploadFilesOptions, CollectionFileInput, CollectionEntry, ActUploadOptions, DownloadOptions, RequestOptions, Reference, SOCReader, SOCWriter, FeedReaderOptions, FeedWriterOptions, FeedReader, FeedWriter, SequentialFeedReaderOptions, SequentialFeedWriterOptions, SequentialFeedReader, SequentialFeedWriter, StampChunkInput, StampedChunk, MountButtonOptions, MountedButton, PostageBatch } from "./types";
 import { EthAddress, PrivateKey } from "@ethersphere/bee-js";
 /**
  * Main client library for integrating Swarm ID authentication and storage capabilities
@@ -45,8 +45,8 @@ export declare class SwarmIdClient {
     private iframeLoadReject?;
     private popupMode;
     private metadata;
-    private buttonConfig?;
-    private containerId?;
+    /** Each mounted button, with what removes its frame at once */
+    private mountedButtons;
     private subsidisedGatewayUrl?;
     private beeApiUrl?;
     private ready;
@@ -80,22 +80,11 @@ export declare class SwarmIdClient {
      * @param options.iframePath - The path to the proxy iframe (defaults to "/proxy")
      * @param options.timeout - Request timeout in milliseconds (defaults to 30000). Bounds each call's whole round trip through the iframe; a call's own `requestOptions.timeout` replaces it for that call
      * @param options.onConnectionChange - Callback invoked when the dApp-visible ConnectionInfo changes (identity, stamp, account type, auth)
-     * @param options.popupMode - How to display the authentication popup: "popup" or "window" (defaults to "window")
+     * @param options.popupMode - How the connect window opens, from {@link connect} or a mounted button: "popup" or "window" (defaults to "window")
      * @param options.metadata - Application metadata shown to users during authentication
      * @param options.metadata.name - Application name (1-100 characters)
      * @param options.metadata.description - Optional application description (max 500 characters)
      * @param options.metadata.icon - Optional application icon as a data URL (SVG or PNG, max 4KB)
-     * @param options.buttonConfig - Button configuration for the authentication UI (optional)
-     * @param options.buttonConfig.connectText - Text for the connect button (optional)
-     * @param options.buttonConfig.disconnectText - Text for the disconnect button (optional)
-     * @param options.buttonConfig.loadingText - Text shown during loading (optional)
-     * @param options.buttonConfig.backgroundColor - Background color for buttons (optional)
-     * @param options.buttonConfig.color - Text color for buttons (optional)
-     * @param options.buttonConfig.borderRadius - Border radius for buttons and iframe (optional)
-     * @param options.buttonConfig.fontFamily - CSS font-family for the button, so it can match the embedding page; a font stack falls back as usual (optional)
-     * @param options.buttonConfig.fontSize - CSS font-size for the button; the default floating iframe is a fixed 300x50 px and hides its overflow, so a size that does not fit is clipped — pass `containerId` to own the box (optional)
-     * @param options.buttonConfig.fontWeight - CSS font-weight for the button, as a keyword or a number (optional)
-     * @param options.containerId - ID of container element to place iframe in (optional)
      * @param options.subsidisedGatewayUrl - A gateway that stamps uploads for a person with no drive of their own (optional)
      * @param options.beeApiUrl - The Bee node this site's content reads and stamped uploads go through, in place of the person's own setting. Their account and device coordination stay on their own node. Change it later with {@link setBeeApiUrl} (optional)
      * @throws {Error} If constructed where there is no `window` (a server render)
@@ -112,7 +101,6 @@ export declare class SwarmIdClient {
      *
      * @returns A promise that resolves when the client is fully initialized
      * @throws {SwarmIdError} `invalid-state` if the client is already initialized, or `destroy()` runs before it resolves
-     * @throws {SwarmIdError} `invalid-request` if `containerId` names no element
      * @throws {SwarmIdError} `init-failed` if the iframe fails to load, origin validation fails on the proxy side, or the proxy does not respond within `initializationTimeout` (30 seconds by default)
      *
      * @example
@@ -172,25 +160,6 @@ export declare class SwarmIdClient {
      * Ensure client is initialized
      */
     private ensureReady;
-    /**
-     * Returns the authentication iframe element.
-     *
-     * The iframe displays authentication UI based on the current auth status:
-     * - If not authenticated: shows a "Connect" button
-     * - If authenticated: shows identity info and a "Disconnect" button
-     *
-     * The iframe is positioned fixed in the bottom-right corner of the viewport.
-     *
-     * @returns The iframe element displaying the authentication UI
-     * @throws {SwarmIdError} `invalid-state` if the client is not initialized, or the iframe is not available
-     *
-     * @example
-     * ```typescript
-     * const iframe = client.getAuthIframe()
-     * // The iframe is already displayed; this returns a reference to it
-     * ```
-     */
-    getAuthIframe(): HTMLIFrameElement;
     /**
      * Checks the current authentication status with the Swarm ID proxy.
      *
@@ -280,52 +249,78 @@ export declare class SwarmIdClient {
      */
     disconnect(): Promise<void>;
     /**
-     * Opens the Swarm ID authentication page in a new window.
-     *
-     * This method creates the same authentication URL as used by the iframe
-     * proxy and opens it in a new browser window. The user can authenticate
-     * with their Swarm ID, and the resulting authentication will be available
-     * to the client when they return.
-     *
-     * **Which window opens it** is decided by the iframe's STORAGE, not by the
-     * user agent (#613):
-     * - Shared storage: opened here, from the parent, so the click's activation is
-     *   still unspent. The popup writes the connection to the first-party store
-     *   the iframe reads, and a `storage` event carries it across.
-     * - Partitioned, or not proven shared: the proxy opens it, so the popup's
-     *   `window.opener` points back at the iframe and the session can be handed
-     *   over directly — the only channel into a partitioned frame. The session
-     *   is then kept in that partition's own store until it is disconnected or
-     *   its 7 days are up (#635), so a reload does not re-run this; a handover
-     *   that arrives without the account view is refused outright rather than
-     *   producing a session that cannot upload and cannot hear a revoke. A popup
-     *   blocked on this path falls back to opening from the parent.
-     *
-     * Safari private mode sessions are ephemeral (lost when the private window
-     * closes). The whole partitioned path — handover, stamper, upload — is
-     * confirmed on real Safari; see
-     * https://github.com/snaha/swarm-id/issues/584
+     * Opens the Swarm ID connect window from the site's own control, where the
+     * session frame shares Swarm ID's storage: a site on the same site as Swarm
+     * ID, such as a self-hosted copy on the site's own domain. The window
+     * writes the connection to that storage and the session frame picks it up.
+     *
+     * Anywhere else the browser partitions the session frame's storage, and the
+     * session can reach it only through a window a Swarm ID frame opened from a
+     * click inside it. A window opened from here would end on "Connected" with
+     * the site still signed out, so this refuses instead and the site shows
+     * {@link mountButton}'s button. `connectionInfo.storagePartitioned` and the
+     * error's code tell the two apart. The button works in both cases, so a
+     * site that always mounts it never needs this.
      *
      * @param options - Configuration options for the connect flow
      * @throws {SwarmIdError} `invalid-state` if the client is not initialized
-     * @throws {SwarmIdError} `popup-blocked` if the browser blocks the popup
+     * @throws {SwarmIdError} `button-required` if the session frame's storage is partitioned, or not proven shared
+     * @throws {SwarmIdError} `popup-blocked` if the browser blocks the window
      *
      * @example
      * ```typescript
-     * const client = new SwarmIdClient({ ... })
-     * await client.initialize()
-     *
-     * // Open authentication page
-     * await client.connect()
+     * try {
+     *   await client.connect()
+     * } catch (error) {
+     *   if (error instanceof SwarmIdError && error.code === 'button-required') {
+     *     client.mountButton(container, { action: 'sign-in' })
+     *   }
+     * }
      * ```
      */
     connect(options?: ConnectOptions): Promise<void>;
     /**
-     * Open the auth popup from the dApp page.
+     * Shows a Swarm ID button in `container`: a small frame of Swarm ID's own,
+     * apart from the hidden session frame, that fills the container. Its click
+     * opens the connect window, which hands the session to the site's Swarm ID
+     * frames, and the site hears of it on {@link ClientOptions.onConnectionChange} as from
+     * any sign-in. This is how a person signs in, or changes the stamp the
+     * site uses, wherever the site and Swarm ID are on different sites.
+     *
+     * Unmounting removes only the button, at any time. The session stays, and
+     * signing out stays {@link disconnect}. A button unmounted while its window
+     * is open stays hidden until the window closes, because the window reads
+     * from it, as it opens, where to hand the session. Unmounting it, or
+     * removing its container, in the moment between the click and the window
+     * opening loses that sign-in, and the person signs in again.
+     *
+     * @param container - The element the button fills. Give it the size the button should have
+     * @param options.action - `sign-in`, or `change-stamp` for a person signed in
+     * @param options.config - The label, its busy and disabled states, colours and typography
+     * @param options.onWindowChange - Called with `open`, `closed` or `blocked` for the button's connect window
+     * @returns The button: `ready`, `update()` and `unmount()`, where `update()` refuses a bad value the same way
+     * @throws {SwarmIdError} `invalid-state` if the client is not initialized
+     * @throws {SwarmIdError} `invalid-request` if `action` or a `config` value is not one the button takes, naming the field
+     *
+     * @example
+     * ```typescript
+     * const button = client.mountButton(document.getElementById('sign-in')!, {
+     *   action: 'sign-in',
+     *   config: { text: 'Sign in', backgroundColor: '#000', borderRadius: '6px' },
+     * })
+     * await button.ready
+     * // later, closing the panel it sits in
+     * button.unmount()
+     * ```
+     */
+    mountButton(container: HTMLElement, options: MountButtonOptions): MountedButton;
+    /**
+     * Open the connect window from the site's page, for a session frame that
+     * shares Swarm ID's storage.
      *
-     * Carries no challenge: a popup opened here has the dApp page as its
+     * Carries no challenge: a window opened here has the site's page as its
      * `window.opener`, so there is nothing for a handover to attach to, and the
-     * popup falls back to the storage write it does anyway.
+     * window writes the connection to the storage the session frame reads.
      *
      * @returns whether the popup opened — a blocked one returns null, which the
      *   caller must not report as a connect in progress.

package/dist/swarm-id-proxy.d.ts

@@ -8,7 +8,8 @@ export declare const PUBLISH_DEBOUNCE_MS = 1500;
  * Swarm ID Proxy - Runs inside the iframe
  *
  * Responsibilities:
- * - Receive app-specific secrets from auth popup
+ * - Receive app-specific secrets from the connect popup the button frame beside
+ *   it opened, under the challenge that frame told it
  * - Keep a partitioned session in this partition's own localStorage (#635)
  * - Proxy Bee API calls from parent dApp
  * - Augment requests with authentication
@@ -25,7 +26,6 @@ export declare class SwarmIdProxy {
     private parentIdentifyReceived;
     private siteAllowList;
     private authenticated;
-    private authLoading;
     private appSecret;
     /**
      * The chat binding the popup handed over with this session, already checked
@@ -65,6 +65,12 @@ export declare class SwarmIdProxy {
      * first-class writer despite the partition (docs/Account-Bus.md, phase 3).
      */
     private partitionAccount;
+    /**
+     * Set while a restored session's saved wallet link is unconfirmed, and kept
+     * out of the identity until then (docs/Wallet-Link.md). Cleared by the
+     * account's published state, a peer's `account-delta` or a new handover.
+     */
+    private walletLinkUnconfirmed;
     /** Account-derived topic the attached bus transports share; undefined when
      *  none are attached. */
     private busTopic;
@@ -127,9 +133,6 @@ export declare class SwarmIdProxy {
     private gnosisRpcUrl;
     private postageStampContractAddress;
     private signalingUrl;
-    private authButtonContainer;
-    private buttonConfig;
-    private popupMode;
     private appMetadata;
     /**
      * Bee clients by the URL they were asked for. Keyed on that input URL, not
@@ -139,7 +142,6 @@ export declare class SwarmIdProxy {
     private unsubscribeStorageListeners;
     private storageWorkQueue;
     private lastConnectionInfo;
-    private isConnecting;
     private parentWindow;
     private bus;
     /** Who else is live in the account's room, from their `presence` beats. */
@@ -258,7 +260,8 @@ export declare class SwarmIdProxy {
      * Note: We always set up these listeners, even when storage might be partitioned.
      * In some browsers/configurations (like localhost development), storage events
      * work between same-origin windows even in iframes. If storage IS partitioned,
-     * the listeners simply won't fire, and we fall back to postMessage from the popup.
+     * the listeners simply won't fire, and the connect popup the button frame
+     * opened hands the session over by postMessage instead.
      */
     private setupStorageListeners;
     /**
@@ -338,10 +341,22 @@ export declare class SwarmIdProxy {
      */
     private authenticateFromStorage;
     /**
-     * Handle messages from the auth popup (same-origin postMessage).
-     * Used as storage partitioning fallback when storage events don't fire due to partitioning.
+     * A handover from a connect window the button frame beside this one opened.
+     * The only way into a session whose storage is partitioned from the
+     * window's, where no storage event arrives.
      */
     private handlePopupMessage;
+    /**
+     * Whether a message came from another frame of the page this one is in,
+     * which is where the button frame sits. A top-level window is not one.
+     */
+    private isSiblingFrame;
+    /**
+     * The button frame beside this one opened a connect window under
+     * `challenge`, so the handover that comes back under it is this session's
+     * to take. A window opened before it can no longer hand over a stamp.
+     */
+    private awaitHandover;
     /**
      * A second handover from the window this session was handed over by,
      * carrying the stamp the person picked there after the first one. Accepted
@@ -354,24 +369,6 @@ export declare class SwarmIdProxy {
     private isStampHandover;
     /** Authenticate in storage-partitioned mode from a checked handover */
     private adoptHandover;
-    /**
-     * End the connect attempt a refused handover belonged to.
-     *
-     * The popup cannot be told it was refused — there is no channel back — so it
-     * shows "Connected!" while the button here spins on, and the only other
-     * thing that ever cleared the flag was the user closing that popup
-     * (`checkPopupClosed`), which nothing gave them a reason to do.
-     *
-     * `isConnecting` first: `showAuthButton` early-returns while it is set, so
-     * clearing the flag is what lets the button come back. `authLoading` is
-     * already false on every path that reaches here — belt-and-braces, not a
-     * second fix.
-     *
-     * The challenge is deliberately kept. The popup is still open and may yet
-     * send a payload this bundle can read; refusing one message ends the
-     * attempt's spinner, not the ceremony behind it.
-     */
-    private endRefusedConnect;
     /**
      * The handed-over chat binding, if it names exactly this parent origin, the
      * address of the chat key of the secret it came with and the account it came
@@ -404,7 +401,7 @@ export declare class SwarmIdProxy {
      * Re-persist the stored session's account view after a live fold moved it.
      *
      * Without this the record is frozen at the handover: a rotated signer key or
-     * a moved default stamp arrives over the bus, updates `partitionAccount`, and
+     * a moved pick for this site arrives over the bus, updates `partitionAccount`, and
      * then a reload resurrects the pre-fold copy and uploads with it until the
      * next live overlap.
      *
@@ -693,6 +690,20 @@ export declare class SwarmIdProxy {
      * restored from shared storage does.
      */
     private restorePartitionSession;
+    /**
+     * Take the wallet link the account published when it is newer than the
+     * restored copy, and tell the site (docs/Wallet-Link.md).
+     *
+     * The bus carries a change of "Show my ENS name on sites" to a frame that is
+     * open, and keeps no mailbox. Turned off while no page of the site was open,
+     * the restored copy would go on handing the site the withdrawn wallet, so
+     * the published state decides on the link's own clock. Only the link: the
+     * rest of the published account still arrives over the bus.
+     *
+     * Nothing published, or nothing read, confirms nothing, so the restored link
+     * stays held back.
+     */
+    private foldPublishedWalletLink;
     /**
      * Ask the account's published state whether this restored session was ended
      * while no page of the site was open. Ended means what it means
@@ -763,10 +774,11 @@ export declare class SwarmIdProxy {
      * `buildAccountStateSnapshotForPublish` below — reusing that one would cost
      * two key derivations to send a bus message.
      *
-     * `requireDefaultStamp` is the FEED path's precondition, not the snapshot's:
-     * that write is paid for by the default stamp, while a bus message costs
-     * nothing to send and `metadata.defaultPostageStampBatchID` is optional on
-     * the wire. An account with no drives is a supported connected state, and
+     * `requireDefaultStamp` is the FEED path's precondition, not the snapshot's.
+     * That write is paid from the drive the person picked for this site, through
+     * the coordinator built on the site's resolved stamp, and not from the
+     * account default this flag checks. A bus message costs nothing to send and
+     * `metadata.defaultPostageStampBatchID` is optional on the wire. An account with no drives is a supported connected state, and
      * gating the delta on a stamp is how such an account's revokes never reach
      * its partitioned sessions at all.
      */
@@ -804,7 +816,9 @@ export declare class SwarmIdProxy {
      * and to the shared feed via the coordinator (same write lock + held
      * partition). The feed write needs a partition; the bus message does not, so
      * it goes out first and a read-only session still relays to peers that
-     * cannot see storage at all. Single-device accounts' feeds are published by
+     * cannot see storage at all. The feed write is paid from the site's picked
+     * drive, through the coordinator, and a site with no pick has no coordinator
+     * and writes none. Single-device accounts' feeds are published by
      * the SwarmID UI. Re-arms if a publish is already in flight so the latest
      * state still lands.
      */
@@ -923,28 +937,6 @@ export declare class SwarmIdProxy {
     private handleIsConnected;
     private handleGetNodeInfo;
     private handleDisconnect;
-    /**
-     * Show authentication button in the UI
-     */
-    private showAuthButton;
-    private handleConnect;
-    /**
-     * Open the authentication popup window.
-     * Returns true if popup was opened, false if parent origin is not set.
-     */
-    private openAuthPopup;
-    /**
-     * Handle login button click
-     */
-    private handleLoginClick;
-    /**
-     * Handle disconnect button click
-     */
-    private handleDisconnectClick;
-    /**
-     * Set container element for auth button
-     */
-    setAuthButtonContainer(container: HTMLElement): void;
     private handleUploadData;
     private handleDownloadData;
     private handleUploadFile;