@trezor/connect 10.0.0-alpha.1 → 10.0.0-beta.1

package/CHANGELOG.md

@@ -1,63 +1,112 @@
-|             Package              | Stable |     Canary     |
-| :------------------------------: | :----: | :------------: |
-|       npm @trezor/connect        |   -    | 10.0.0-alpha.1 |
-|     npm @trezor/connect-web      |   -    | 10.0.0-alpha.1 |
-| npm @trezor/connect-webextension |   -    | 10.0.0-alpha.1 |
-|    npm @trezor/connect-mobile    |   -    | 10.0.0-alpha.1 |
-
-|     Deployment     | Stable |     Canary     |
-| :----------------: | :----: | :------------: |
-| connect.trezor.io/ |   -    | 10.0.0-alpha.1 |
-
-Use the persistent link [connect.trezor.io/10](https://connect.trezor.io/10/) to access the latest stable version of Connect Explorer.
-
-# 10.0.0-alpha.1
-
-First beta release of version 10.
-This version removes support for legacy iframe and popup integration methods and replaces them with new Suite-based integration.
-
-Features:
-
-- Tron support (`tronGetAddress`, `tronSignTransaction`)
-- `ethereumSignTypedData` now computes `domain_separator_hash` / `message_hash` internally for T1B1 firmware. Callers no longer need to pre-compute hashes via `@trezor/connect-plugin-ethereum`; passing only `data` works for all supported Trezor models. Caller-provided hashes still take precedence for backwards compatibility. Implementation is powered by `viem` and lives in the lazy-loaded ethereum chunk, so non-Ethereum consumers do not pay any bundle cost.
-
-Breaking changes:
-
-- `getAccountDescriptor` has been removed. The per-coin `*GetPublicKey` methods (`getPublicKey`, `ethereumGetPublicKey`, `cardanoGetPublicKey`, `solanaGetPublicKey`, `tezosGetPublicKey`) now return the same fields after the response-shape unification, so the dedicated descriptor entry point is no longer needed. Consumers that previously called `getAccountDescriptor` should call the appropriate `*GetPublicKey` for the target coin. TODO: exact field mapping (e.g. previous `payload.descriptor`) will be documented as part of the `*GetPublicKey` response-shape unification PR.
-- **`@trezor/connect` and every package in its dependency closure now ship ESM only.** Several transitive dependencies (`@noble/curves`, `@noble/hashes`, `@scure/base`, `@scure/bip39`, `@solana/kit`, `@solana-program/*`, `viem`, `node-fetch@3+`) are already ESM-only, so a CJS consumer of `@trezor/connect` cannot statically import them in any case. To keep the build pipeline consistent, the entire connect ecosystem follows suit: `@trezor/connect`, `@trezor/connect-web`, `@trezor/connect-webextension`, `@trezor/connect-mobile`, `@trezor/connect-common`, `@trezor/connect-data`, `@trezor/connect-plugin-ethereum`, `@trezor/connect-plugin-stellar`, `@trezor/blockchain-link`, `@trezor/blockchain-link-utils`, `@trezor/blockchain-link-types`, `@trezor/utxo-lib`, `@trezor/device-authenticity`, `@trezor/address-validator`, `@trezor/utils`, `@trezor/transport`, `@trezor/protobuf`, `@trezor/protocol`, `@trezor/schema-utils`, `@trezor/crypto-utils`, `@trezor/device-utils`, `@trezor/env-utils`, `@trezor/type-utils`, `@trezor/websocket-client`. Migration:
-    - ESM consumer: replace `const TrezorConnect = require('@trezor/connect').default` with `import TrezorConnect from '@trezor/connect'`. Set `"type": "module"` in your `package.json` or use the `.mjs` extension.
-    - CJS consumer that cannot migrate: use a dynamic import — `const TrezorConnect = (await import('@trezor/connect')).default;` — or stay on v9.
-
-Deprecations:
-
-- Remove connect-iframe and connect-popup integration
-- Remove EOS support
-- Remove NEM support
-- `@trezor/connect-plugin-ethereum` is deprecated. Its logic was inlined into `@trezor/connect`. When upgrading to Connect 10, drop your direct dependency on the plugin and remove manual `transformTypedData` calls. The 10.x release of the plugin is a stub that throws a deprecation error pointing at the migration.
-
-Commits:
-
-- chore: remove connect-iframe (372d11f819)
-- feat(connect): tronSignTransaction (57eec2f1a2)
-- feat(connect): tronGetAddress (f5a2bfb6cb)
-- chore(suite-native): remove deprecated node-libs-browser (5ff326e491)
-- test(connect): don't set up emu repeatedly if not necessary (55b93ac8e7)
-- chore: bump webpack-related deps (3f73273dba)
-- chore(connect): remove unsupported fixture (5acfbb81d5)
-- feat(connect): core-in-popup and iframe with popup modes are now removed (a902e2d3cb)
-- fix: use AccountDescriptor as branded type (47f2cc48d5)
-- feat(connect): remove EOS support (16da7214cc)
-- feat(connect): validation for sign message size for T1B1 (d1fb78727e)
-- feat(connect): remove NEM support (b9e7b55832)
-- refactor(connect): use CoreInModule directly (e9a5c47c7d)
-- refactor(connect): flatten TrezorConnectDynamic with CoreInModule (a8038c6a70)
-- chore(connect): move web module into main package (815158241a)
-- chore(connect): remove unsuppoted fixtures from txcache in tests (e5214e5706)
-- chore: bump prettier (3e33cbeee4)
-- ci(connect): expand npm install check to cover both ESM & CJS (c15485ed96)
-- chore(npm): start publishing source maps (36f6e9692d)
-- fix(connect): change THP phase after successful ThpEndResponse (66b6b03416)
-- chore(connect): move thp staticKey from ThpSettings to DeviceThpCredentials (6aa0bc6a06)
-- chore(device-authenticity): extract prepareDeviceAuthenticityData (2e061e4cc2)
-- chore(connect, blockchain-link): validate custom RPCs chainIds (8977871032)
-- feat(suite): implement evm-rpc worker into suite (cdf207e01f)
+> **Upgrading from Connect 9?**
+>
+> - [Migration guide: Connect 9 → 10](https://connect.trezor.io/10.0.0-beta.1/guides/migrating-to-connect-10) — what you need to change in your code, as a checklist.
+> - [New Connect flow in Trezor Suite](https://connect.trezor.io/10.0.0-beta.1/guides/new-connect-flow-in-trezor-suite) — how the Suite-hosted flow works and why.
+
+|             Package              | Stable |    Canary     |
+| :------------------------------: | :----: | :-----------: |
+|       npm @trezor/connect        |   -    | 10.0.0-beta.1 |
+|     npm @trezor/connect-web      |   -    | 10.0.0-beta.1 |
+| npm @trezor/connect-webextension |   -    | 10.0.0-beta.1 |
+|    npm @trezor/connect-mobile    |   -    | 10.0.0-beta.1 |
+
+|     Deployment     | Stable |    Canary     |
+| :----------------: | :----: | :-----------: |
+| connect.trezor.io/ |   -    | 10.0.0-beta.1 |
+
+Connect 10 has no stable release yet — use [connect.trezor.io/10.0.0-beta.1](https://connect.trezor.io/10.0.0-beta.1/) to access the beta version of Connect Explorer. Once Connect 10 is released, the persistent link [connect.trezor.io/10](https://connect.trezor.io/10/) will point to the latest stable version.
+
+# 10.0.0-beta.1
+
+Connect 10 moves the Connect core out of the self-hosted iframe + popup and into **Trezor Suite**, which now hosts the core and renders every approval, PIN, passphrase and confirmation screen. Your app stays a thin client calling the same `TrezorConnect` methods — nothing to install, and it works whether or not Suite desktop is running. Alongside the move, the SDK gains a privacy-friendly account picker (`selectAccount`), granular per-coin permissions, and much smaller ESM-only client packages.
+
+## Highlights
+
+### 1. New Connect flow, powered by Trezor Suite
+
+The legacy web popup/iframe integration has been **removed** and replaced by a flow that runs inside Trezor Suite. Connect is now a thin client that routes each call to Suite; Suite owns the core and the entire user-facing experience. It works on both desktop and web:
+
+- **Desktop** — when Trezor Suite (desktop) is running, Connect talks to it automatically over a local (loopback) WebSocket connection — no popup window, no iframe. Suite identifies the calling application (name, origin, icon) in a single permission-approval prompt, then handles the request against the currently active, already-unlocked device.
+- **Web** — when Suite desktop is not running, Connect opens Suite Web as the approval surface (production: `https://suite.trezor.io/web/connect-popup`), giving the same flow with nothing to install. This is a first-class path, not a degraded mode; in the default `'auto'` mode Connect prefers desktop and switches back to it automatically as soon as it becomes available.
+- **Mobile** — `@trezor/connect-mobile` routes calls to the Trezor Suite mobile app via a deep link.
+
+We strongly recommend keeping the default **`coreMode: 'auto'`**: users who have Trezor Suite desktop installed get the fastest, most convenient experience (a direct local connection), while everyone else falls back to Suite Web seamlessly. You can pin `coreMode` to `'suite-desktop'` or `'suite-web'` if you have a specific reason to.
+
+The web flow relies on a bootstrap iframe + popup to exchange messages with Suite Web, so integrator pages must ship the right headers for that channel to work: a Content-Security-Policy that permits embedding the Suite Web origin (`frame-src`/`child-src` for `https://suite.trezor.io`), and a `Cross-Origin-Opener-Policy` that does not sever the popup's `window.opener` (avoid `same-origin` on the hosting page — use `same-origin-allow-popups` or `unsafe-none`). Missing or over-strict headers surface as a handshake timeout when the popup opens.
+
+Because the active device is chosen and unlocked **in Suite**, users no longer pick a device or re-enter a passphrase per request as they did in the old popup — passphrase handling is centralized in Suite's device management (see the [passphrases & hidden wallets guide](https://trezor.io/guides/backups-recovery/advanced-wallets/passphrases-and-hidden-wallets) and the [New Connect flow in Trezor Suite guide](https://connect.trezor.io/10.0.0-beta.1/guides/new-connect-flow-in-trezor-suite)).
+
+**Required manifest change:** `manifest.appName` is now **required**, and an optional `manifest.appIcon` (URL, sized for a 64px circle) is shown in Suite's permission prompt.
+
+```javascript
+TrezorConnect.init({
+    manifest: {
+        email: 'developer@xyz.com',
+        appName: 'Your Application',
+        appUrl: 'https://your.application.com',
+        appIcon: 'https://your.application.com/icon-64.png',
+    },
+});
+```
+
+### 2. `selectAccount` — private, friendlier account selection
+
+New method for asking the user to choose one or more accounts, replacing the old "call `getAccountInfo` with no path to trigger on-device discovery" pattern. The picker, derivation and on-device verification run entirely inside Suite.
+
+- **More private:** for UTXO coins you can request only what you need. `addressSelection: 'firstFresh' | 'manual'` exports a single **address** (with an optional SLIP-0019 `mac` to later re-prove device ownership) and never reveals the account xpub — requiring only the narrow `read_address` permission. The full-account/watch-only flow (`addressSelection: 'fullAccount'`, the default) shares the xpub and requires `read_xpub`. Account-based networks (EVM, Solana, …) always return an individual address.
+- **Better UX:** `selectionType` supports `'single'` (default), `'multi'`, or bounded multi-select (`{ minCount, maxCount }`); `accountType` filters/tabs the allowed derivation types (including custom `bip43Path` templates); `requireOnDeviceVerification` (default `true`) controls device confirmation.
+- Always returns an array of `{ symbol, path, address? | xpub?, accountType?, mac? }`, even for a single selection.
+
+### 3. Granular, per-coin permissions
+
+Permissions are no longer coarse read/write grants. Each method requires narrow scopes (such as `read_address`, `read_xpub`, `sign`, `sign_message`), scoped to a specific coin where relevant, and Suite groups them by coin in the approval prompt. Scopes are intentionally non-overlapping — e.g. granting `read_address` does **not** also grant `read_xpub` — so an app only ever gets access to what it actually uses.
+
+### 4. Much lighter client packages
+
+Because the Connect core now lives in Trezor Suite, the packages that third-party apps install (`@trezor/connect-web`, `-webextension`, `-mobile`) are thin clients that just route calls to Suite. They no longer bundle the core's heavy dependencies (transports, crypto, coin logic), so installs and bundles are dramatically smaller. As part of this, coin-family code has been reorganized into per-network packages (the former `@trezor/coins-*` are renamed to `@trezor/network-*`) that load their heavier dependencies on demand.
+
+### New coins & method improvements
+
+- **Tron** support (`tronGetAddress`, `tronSignTransaction`), backed by the new `@trezor/network-tron` package.
+- `solanaSignTransaction` accepts a `chunkify` flag that renders addresses on the device in 4-character chunks, matching `solanaGetAddress` and other coins' sign flows (requires firmware with chunked-address support in the Solana `SignTx` flow).
+- `ethereumSignTypedData` now computes the required hashes internally for T1B1 firmware, so callers no longer need `@trezor/connect-plugin-ethereum` to pre-compute them — passing only `data` works on all models (caller-provided hashes still take precedence).
+- The `*GetPublicKey` methods (`getPublicKey`, `ethereumGetPublicKey`, `cardanoGetPublicKey`, …) now share a **unified response shape** across coins, including a canonical `displayablePublicKey` string that any consumer can render without per-coin branching. This unification is also why the dedicated `getAccountDescriptor` method could be removed (see Breaking changes).
+
+## Breaking changes
+
+The [migration guide](https://connect.trezor.io/10.0.0-beta.1/guides/migrating-to-connect-10) turns the changes below into a step-by-step checklist with before/after code.
+
+### Integration & packaging
+
+- **Legacy iframe + popup integration removed.** `core-in-popup` and iframe-with-popup modes no longer exist; use the Suite-based flow above. `connect-iframe` has been removed.
+- **`manifest.appName` is now required** (see Highlights).
+- **ESM-only.** `@trezor/connect` and its dependency closure now ship ESM only. ESM consumers just `import TrezorConnect from '@trezor/connect'`; a CJS consumer that cannot migrate can use a dynamic `import()` or stay on v9.
+- **Public vs privileged API split.** The client packages now expose a public API (`TrezorConnectPublicAPI`) while `@trezor/connect` exposes the full privileged one (`TrezorConnectPrivilegedAPI`) used by Suite. The public tier drops everything that is Suite's responsibility — device-management methods (`applyFlags`, `applySettings`, `authenticateDevice`, `backupDevice`, `bleUnpair`, `changeLanguage`, `changePin`, `changeWipeCode`, `getFirmwareHash`, `getNonce`, `getSettings`, `loadDevice`, `pingDevice`, `recoveryDevice`, `resetDevice`, `setBrightness`, `setBusy`, `telemetryGet`, `thpGetCredentials`, `thpRemoveCredentials`, `wipeDevice`) are no longer callable from third-party integrations. Public `TrezorConnect` objects are now class instances, so `Object.keys(...)` enumeration and monkeypatching no longer work.
+- **Thin packages lost their event/settings API.** `on`/`off`/`removeAllListeners`, `uiResponse` and `updateConnectSettings` are removed from the public tier (they were already non-functional in v10, since the host Core does not forward them); calling them now throws `TypeError`.
+- **Type/factory renames.** The exported `TrezorConnect` type is replaced by `TrezorConnectPublicAPI` / `TrezorConnectPrivilegedAPI`, and the `factory` function by `factoryPublic` / `factoryPrivileged`. The API-schema values (`TrezorConnectCallable`, `TrezorConnectBitcoin`, …) are no longer exported as runtime values — the names remain as types only.
+
+### Methods & parameters
+
+- **`coin` accepts the coin shortcut only** (the `CoinSymbol` set — e.g. `btc`, `bch`, `ada`), narrowed from `string`. Network **names** and **labels** (e.g. `'Bitcoin'`, `'Bitcoin Cash'`) are no longer accepted and now fail both at compile time and at runtime. The shortcut itself is still matched case-insensitively at runtime, so `coin: 'BTC'` works — but the `CoinSymbol` type lists the canonical lowercase forms, so TypeScript users should pass lowercase to type-check. Resolution is uniform across all coin families. Migrate names/labels to the shortcut: `'Bitcoin' → 'btc'`, `'Bitcoin Cash' → 'bch'`, `'cardano' → 'ada'`, etc. Path-taking methods (`getAddress`, `getPublicKey`, …) derive the network from `path` when given a former name/label; methods without a path fallback (`getAccountInfo`, `selectAccount`, `verifyMessage`, `composeTransaction`, `signTransaction`, `signMessage`, `getOwnershipId`, `getOwnershipProof`, the `blockchain*` family) throw `Method_UnknownCoin`. Full list: [supported coins](https://connect.trezor.io/10.0.0-beta.1/details/coins).
+- **`getPublicKey` is restricted to bitcoin-like coins.** In v9, a non-bitcoin `coin` (e.g. `'eth'`) silently fell back to Bitcoin and returned a btc xpub. Now the network must resolve to a bitcoin-like coin — from `coin`, or failing that from the derivation `path` — otherwise the call throws `Method_UnknownCoin`. Use the per-coin methods (`ethereumGetPublicKey`, `cardanoGetPublicKey`, …) for other networks.
+- **`getAccountDescriptor` removed.** The per-coin `*GetPublicKey` methods now return the same fields. Field mapping: `payload.descriptor` → Bitcoin `result.descriptor` (non-Bitcoin coins: use `result.displayablePublicKey`); `payload.path` → `result.serializedPath` on every `*GetPublicKey`; generic consumers should read `result.displayablePublicKey`.
+- **`getAccountInfo` no longer performs on-device discovery.** Calling it without `path` or `descriptor` now throws `Method_InvalidParameter` (`path or descriptor is required`) instead of opening a device-driven selection popup. Provide `path` (derive on device, then query backend) or `descriptor` (backend-only). For the old discovery behavior, use `discoverAccounts` — or `selectAccount` for user-facing selection.
+- **`cardanoGetPublicKey`:** `publicKey` is now the raw 32-byte key in hex (consistent with other coins); the Cardano extended public key moved to the new explicit `xpub` field (also available via `displayablePublicKey`).
+- **`useCardanoDerivation` removed.** Cardano session derivation is now driven by an app-level `enabledNetworks` declaration passed to `TrezorConnect.init({ enabledNetworks: [{ coin: 'ada' }] })` (or `updateConnectSettings` for in-process Core hosts). Note: `enabledNetworks` is honored only by the in-process `@trezor/connect`; on the thin packages, Cardano availability follows the host Suite wallet's enabled coins.
+
+### Transports
+
+These mostly affect apps that run their own Connect core (`@trezor/connect`); most integrations use the client packages and can skip this.
+
+- **Transports must be passed as instances.** `transports` no longer accepts string identifiers (`'BridgeTransport'`, …) or classes — pass fully constructed `Transport` instances, e.g. `import { BridgeTransport } from '@trezor/transport-common'; init({ transports: [new BridgeTransport({ id: 'my-app' })] })`. For WebUSB use `@trezor/transport-web`; avoid the Node-only `@trezor/transport` barrel in web/React Native bundles.
+- **`disableWebUSB()` removed** — use `updateConnectSettings({ transports })` with a filtered list instead.
+- **Legacy `trezord-go` Bridge (port `21325`) is no longer supported** and `TransportInfo.outdated` is removed; detecting an outdated Bridge is now the consumer app's job.
+
+## Removed & deprecated
+
+- **Removed coin support.** Coins that no current device supports have been dropped from the coin definitions. [Supported coins](https://connect.trezor.io/10.0.0-beta.1/details/coins) is the current list — if your integration names a coin that is not on it, remove that support.
+- **`@trezor/connect-plugin-ethereum` deprecated.** Its logic is inlined into `@trezor/connect`. Drop the direct dependency and remove manual `transformTypedData` calls. The 10.x plugin is a stub that throws a deprecation error pointing at the migration.
+
+## Previous versions
+
+Changelogs for Connect 9 and earlier are available at [connect.trezor.io/9](https://connect.trezor.io/9/).

package/README.md

@@ -1,6 +1,6 @@
 # @trezor/connect
 
-API version 10.0.0-alpha.1
+API version 10.0.0-beta.1
 
 [![NPM](https://img.shields.io/npm/v/@trezor/connect.svg)](https://www.npmjs.org/package/@trezor/connect)
 
@@ -40,7 +40,7 @@ For more instructions [refer to this document](https://github.com/trezor/trezor-
 
 ## Versioning
 
-Version 10 is the current major version and is currently in alpha. New major versions are released when there are breaking API changes. Information about legacy versions can be found in [README_LEGACY.md](./README_LEGACY.md).
+Version 10 is the current major version and is currently in beta. New major versions are released when there are breaking API changes.
 
 ## Docs
 

package/lib/api/applyFlags.d.ts

@@ -0,0 +1,20 @@
+import { type PermissionRequest } from '@trezor/connect-common';
+import { MessagesSchema as PROTO } from '@trezor/protobuf';
+import type { MethodMessage } from "../core/AbstractMethod.js";
+import { AbstractMethod } from "../core/AbstractMethod.js";
+export default class ApplyFlags extends AbstractMethod<'applyFlags', PROTO.ApplyFlags> {
+  constructor(message: MethodMessage<'applyFlags'>);
+  get requiredPermissions(): PermissionRequest[];
+  init(): void;
+  get confirmation(): {
+    view: "device-management";
+    customConfirmButton: {
+      className: string;
+      label: string;
+    };
+    label: string;
+  };
+  run(): Promise<{
+    message: string;
+  }>;
+}

package/lib/api/applyFlags.js

@@ -0,0 +1,38 @@
+import { MessagesSchema as PROTO } from "@trezor/protobuf";
+import { Assert } from "@trezor/schema-utils";
+import { AbstractMethod } from "../core/AbstractMethod.js";
+export default class ApplyFlags extends AbstractMethod {
+  constructor(message) {
+    const {
+      payload
+    } = message;
+    Assert(PROTO.ApplyFlags, payload);
+    const params = {
+      flags: payload.flags
+    };
+    super(message, params);
+    this.useDeviceState = false;
+    this.skipFinalReload = false;
+  }
+  get requiredPermissions() {
+    return [{
+      permission: 'management'
+    }];
+  }
+  init() {}
+  get confirmation() {
+    return {
+      view: 'device-management',
+      customConfirmButton: {
+        className: 'confirm',
+        label: 'Proceed'
+      },
+      label: 'Do you really want to apply flags?'
+    };
+  }
+  async run() {
+    const cmd = this.getDevice().getCommands();
+    const response = await cmd.typedCall('ApplyFlags', 'Success', this.params);
+    return response.message;
+  }
+}

package/lib/api/applySettings.d.ts

@@ -0,0 +1,20 @@
+import { type PermissionRequest } from '@trezor/connect-common';
+import type { MessagesSchema as PROTO } from '@trezor/protobuf';
+import type { MethodMessage } from "../core/AbstractMethod.js";
+import { AbstractMethod } from "../core/AbstractMethod.js";
+export default class ApplySettings extends AbstractMethod<'applySettings', PROTO.ApplySettings> {
+  constructor(message: MethodMessage<'applySettings'>);
+  get requiredPermissions(): PermissionRequest[];
+  init(): void;
+  get confirmation(): {
+    view: "device-management";
+    customConfirmButton: {
+      className: string;
+      label: string;
+    };
+    label: string;
+  };
+  run(): Promise<{
+    message: string;
+  }>;
+}

package/lib/api/applySettings.js

@@ -0,0 +1,57 @@
+import { ApplySettings as ApplySettingsSchema } from "@trezor/connect-common";
+import { Assert } from "@trezor/schema-utils";
+import { AbstractMethod } from "../core/AbstractMethod.js";
+export default class ApplySettings extends AbstractMethod {
+  constructor(message) {
+    const {
+      payload
+    } = message;
+    Assert(ApplySettingsSchema, payload);
+    const params = {
+      ...payload,
+      _passphrase_source: payload.passphrase_source
+    };
+    super(message, params);
+    this.useDeviceState = false;
+    this.skipFinalReload = false;
+  }
+  get requiredPermissions() {
+    return [{
+      permission: 'management'
+    }];
+  }
+  init() {}
+  get confirmation() {
+    return {
+      view: 'device-management',
+      customConfirmButton: {
+        className: 'confirm',
+        label: 'Proceed'
+      },
+      label: 'Do you really want to change device settings?'
+    };
+  }
+  async run() {
+    const device = this.getDevice();
+    const cmd = device.getCommands();
+    const homescreenBytes = this.params.homescreen ? Buffer.from(this.params.homescreen, 'hex') : undefined;
+    if (device.atLeast('2.9.0') && homescreenBytes) {
+      this.params.homescreen = undefined;
+      this.params.homescreen_length = homescreenBytes.length;
+    }
+    if (homescreenBytes !== undefined) {
+      device.startPiggybackAck();
+    }
+    let response = await cmd.typedCall('ApplySettings', ['DataChunkRequest', 'Success'], this.params);
+    while (response.type !== 'Success') {
+      const start = response.message.data_offset;
+      const end = start + response.message.data_length;
+      const data_chunk = homescreenBytes?.subarray(start, end).toString('hex') || '';
+      response = await cmd.typedCall('DataChunkAck', ['DataChunkRequest', 'Success'], {
+        data_chunk
+      });
+    }
+    await device.stopPiggybackAck();
+    return response.message;
+  }
+}

package/lib/api/authenticateDevice.d.ts

@@ -0,0 +1,25 @@
+import type { PermissionRequest } from '@trezor/connect-common';
+import { AuthenticateDeviceParams } from '@trezor/device-authenticity';
+import type { MethodMessage } from "../core/AbstractMethod.js";
+import { AbstractMethod } from "../core/AbstractMethod.js";
+export default class AuthenticateDevice extends AbstractMethod<'authenticateDevice', AuthenticateDeviceParams> {
+  constructor(message: MethodMessage<'authenticateDevice'>);
+  get requiredPermissions(): PermissionRequest[];
+  streamAuthenticityProofs(challenge: Buffer): Promise<{
+    tropic_signature?: string | undefined;
+    mcu_signature?: string | undefined;
+    optiga_certificates: string[];
+    optiga_signature: string;
+    tropic_certificates: string[];
+    mcu_certificates: string[];
+  }>;
+  getAuthenticityProofs(challenge: Buffer): Promise<{
+    tropic_signature?: string | undefined;
+    mcu_signature?: string | undefined;
+    optiga_certificates: string[];
+    optiga_signature: string;
+    tropic_certificates: string[];
+    mcu_certificates: string[];
+  }>;
+  run(): Promise<import("@trezor/device-authenticity/lib/types").ResultsToValidate>;
+}

package/lib/api/authenticateDevice.js

@@ -0,0 +1,195 @@
+import { UI_REQUEST } from "@trezor/connect-common";
+import { AuthenticateDeviceParams, deviceAuthenticityBlacklistConfig, deviceAuthenticityConfig, getRandomChallenge, prepareDeviceAuthenticityData, validateSerialNumbers, verifyAuthenticityProof } from "@trezor/device-authenticity";
+import { MessagesSchema as PROTO } from "@trezor/protobuf";
+import { Assert } from "@trezor/schema-utils";
+import { AbstractMethod } from "../core/AbstractMethod.js";
+export default class AuthenticateDevice extends AbstractMethod {
+  constructor(message) {
+    const {
+      payload
+    } = message;
+    Assert(AuthenticateDeviceParams, payload);
+    const params = {
+      config: payload.config,
+      blacklistConfig: payload.blacklistConfig,
+      allowDebugKeys: payload.allowDebugKeys
+    };
+    super(message, params);
+    this.useEmptyPassphrase = true;
+    this.allowDeviceMode = [UI_REQUEST.INITIALIZE, UI_REQUEST.SEEDLESS];
+    this.skipFinalReload = false;
+    this.useDeviceState = false;
+  }
+  get requiredPermissions() {
+    return [{
+      permission: 'management'
+    }];
+  }
+  async streamAuthenticityProofs(challenge) {
+    const cmd = this.getDevice().getCommands();
+    const MAX_CHUNK_SIZE = 500;
+    this.getDevice().startPiggybackAck();
+    const {
+      message: proofSizes
+    } = await cmd.typedCall('AuthenticateDevice', 'AuthenticityProofSizes', {
+      challenge: challenge.toString('hex'),
+      stream: true
+    });
+    const proofTypes = [{
+      name: 'optiga',
+      type: PROTO.AuthenticityProofType.OPTIGA,
+      certSizes: proofSizes.optiga_certificates,
+      sigSize: proofSizes.optiga_signature
+    }, {
+      name: 'tropic',
+      type: PROTO.AuthenticityProofType.TROPIC,
+      certSizes: proofSizes.tropic_certificates,
+      sigSize: proofSizes.tropic_signature
+    }, {
+      name: 'mcu',
+      type: PROTO.AuthenticityProofType.MCU,
+      certSizes: proofSizes.mcu_certificates,
+      sigSize: proofSizes.mcu_signature
+    }];
+    const authenticityProof = {
+      optiga_certificates: [],
+      optiga_signature: '',
+      tropic_certificates: [],
+      tropic_signature: undefined,
+      mcu_certificates: [],
+      mcu_signature: undefined
+    };
+    const getChunk = async (params, chunkSize) => {
+      const chunks = [];
+      let offset = 0;
+      while (offset < chunkSize) {
+        const size = Math.min(MAX_CHUNK_SIZE, chunkSize - offset);
+        const {
+          message
+        } = await cmd.typedCall('GetAuthenticityProofChunk', 'AuthenticityProofChunk', {
+          ...params,
+          offset,
+          size
+        });
+        chunks.push(message.chunk);
+        offset += size;
+      }
+      return chunks.join('');
+    };
+    for (const {
+      name,
+      type,
+      certSizes,
+      sigSize
+    } of proofTypes) {
+      for (const [i, certSize] of certSizes.entries()) {
+        const cert = await getChunk({
+          proof_type: type,
+          index: i
+        }, certSize);
+        authenticityProof[`${name}_certificates`].push(cert);
+      }
+      if (sigSize) {
+        authenticityProof[`${name}_signature`] = await getChunk({
+          proof_type: type
+        }, sigSize);
+      }
+    }
+    await cmd.typedCall('GetAuthenticityProofChunk', 'Success', {
+      offset: 0,
+      size: 0
+    });
+    await this.getDevice().stopPiggybackAck();
+    return authenticityProof;
+  }
+  async getAuthenticityProofs(challenge) {
+    const {
+      message
+    } = await this.getDevice().getCommands().typedCall('AuthenticateDevice', 'AuthenticityProof', {
+      challenge: challenge.toString('hex')
+    });
+    return message;
+  }
+  async run() {
+    const challenge = getRandomChallenge();
+    const {
+      unavailableCapabilities
+    } = this.getDevice();
+    const authenticityProof = !unavailableCapabilities['authenticityProofChunk'] ? await this.streamAuthenticityProofs(challenge) : await this.getAuthenticityProofs(challenge);
+    const config = this.params.config || deviceAuthenticityConfig;
+    const blacklistConfig = this.params.blacklistConfig || deviceAuthenticityBlacklistConfig;
+    const commonParams = {
+      signedData: prepareDeviceAuthenticityData({
+        payload: challenge
+      }),
+      deviceModel: this.getDevice().features.internal_model,
+      allowDebugKeys: this.params.allowDebugKeys,
+      config,
+      blacklistConfig
+    };
+    const getOptigaResult = async () => {
+      const {
+        optiga_signature: signature,
+        optiga_certificates: certificates
+      } = authenticityProof;
+      const isAvailable = signature && certificates.length > 0;
+      if (isAvailable) {
+        return await verifyAuthenticityProof({
+          ...commonParams,
+          certificates,
+          signature
+        });
+      }
+      return {
+        valid: false,
+        error: 'RESPONSE_PAYLOAD_MISSING'
+      };
+    };
+    const hasTropicAbility = !unavailableCapabilities['tropicDeviceAuthentication'];
+    const getTropicResult = async () => {
+      const {
+        tropic_signature: signature,
+        tropic_certificates: certificates
+      } = authenticityProof;
+      const isAvailable = signature && certificates.length > 0;
+      const isRequired = hasTropicAbility;
+      if (isAvailable) {
+        return await verifyAuthenticityProof({
+          ...commonParams,
+          certificates,
+          signature
+        });
+      }
+      return isRequired ? {
+        valid: false,
+        error: 'RESPONSE_PAYLOAD_MISSING'
+      } : null;
+    };
+    const getMCUResult = async () => {
+      const {
+        mcu_signature: signature,
+        mcu_certificates: certificates
+      } = authenticityProof;
+      const isAvailable = signature && certificates.length > 0;
+      const isRequired = !unavailableCapabilities['mcuDeviceAuthentication'];
+      if (isAvailable) {
+        return await verifyAuthenticityProof({
+          ...commonParams,
+          certificates,
+          signature
+        });
+      }
+      return isRequired ? {
+        valid: false,
+        error: 'RESPONSE_PAYLOAD_MISSING'
+      } : null;
+    };
+    const [optigaResult, tropicResult, mcuResult] = await Promise.all([getOptigaResult(), getTropicResult(), getMCUResult()]);
+    const results = {
+      optigaResult,
+      tropicResult,
+      mcuResult
+    };
+    return hasTropicAbility ? validateSerialNumbers(results) : results;
+  }
+}

package/lib/api/authorizeCoinjoin.d.ts

@@ -0,0 +1,11 @@
+import { type PermissionRequest } from '@trezor/connect-common';
+import type { MessagesSchema as PROTO } from '@trezor/protobuf';
+import type { MethodMessage } from "../core/AbstractMethod.js";
+import { AbstractMethod } from "../core/AbstractMethod.js";
+export default class AuthorizeCoinjoin extends AbstractMethod<'authorizeCoinjoin', PROTO.AuthorizeCoinJoin> {
+  constructor(message: MethodMessage<'authorizeCoinjoin'>);
+  get requiredPermissions(): PermissionRequest[];
+  run(): Promise<{
+    message: string;
+  }>;
+}

package/lib/api/authorizeCoinjoin.js

@@ -0,0 +1,44 @@
+import { AuthorizeCoinjoin as AuthorizeCoinjoinSchema } from "@trezor/connect-common";
+import { Assert } from "@trezor/schema-utils";
+import { AbstractMethod } from "../core/AbstractMethod.js";
+import { getBitcoinNetwork } from "../data/coinInfo.js";
+import { getScriptType, validatePath } from "../utils/pathUtils.js";
+export default class AuthorizeCoinjoin extends AbstractMethod {
+  constructor(message) {
+    const {
+      payload
+    } = message;
+    Assert(AuthorizeCoinjoinSchema, payload);
+    const address_n = validatePath(payload.path, 3);
+    const script_type = payload.scriptType || getScriptType(address_n);
+    const coinInfo = getBitcoinNetwork(payload.coin || address_n);
+    const params = {
+      coordinator: payload.coordinator,
+      max_rounds: payload.maxRounds,
+      max_coordinator_fee_rate: payload.maxCoordinatorFeeRate,
+      max_fee_per_kvbyte: payload.maxFeePerKvbyte,
+      address_n,
+      coin_name: coinInfo?.name,
+      script_type,
+      amount_unit: payload.amountUnit
+    };
+    super(message, params);
+    this.requiredFirmwareCoins = [coinInfo];
+    this.preauthorized = payload.preauthorized;
+  }
+  get requiredPermissions() {
+    return [this.coinPerm('internal', this.requiredFirmwareCoins[0])];
+  }
+  async run() {
+    const cmd = this.getDevice().getCommands();
+    if (this.preauthorized) {
+      if (await cmd.preauthorize(false)) {
+        return {
+          message: 'Success'
+        };
+      }
+    }
+    const response = await cmd.typedCall('AuthorizeCoinJoin', 'Success', this.params);
+    return response.message;
+  }
+}

package/lib/api/backupDevice.d.ts

@@ -0,0 +1,19 @@
+import { type PermissionRequest } from '@trezor/connect-common';
+import { MessagesSchema as PROTO } from '@trezor/protobuf';
+import type { MethodMessage } from "../core/AbstractMethod.js";
+import { AbstractMethod } from "../core/AbstractMethod.js";
+export default class BackupDevice extends AbstractMethod<'backupDevice', PROTO.BackupDevice> {
+  constructor(message: MethodMessage<'backupDevice'>);
+  get requiredPermissions(): PermissionRequest[];
+  get confirmation(): {
+    view: "device-management";
+    customConfirmButton: {
+      className: string;
+      label: string;
+    };
+    label: string;
+  };
+  run(): Promise<{
+    message: string;
+  }>;
+}