@onekeyfe/hd-core 1.2.8 → 1.2.10-alpha.1

package/src/data/messages/messages.json

@@ -12485,6 +12485,8 @@
         "(has_bitcoin_only_values)": true
       },
       "values": {
+        "MessageType_BabylonDeriveContextHash": 10054,
+        "MessageType_BabylonDerivedContextHash": 10055,
         "MessageType_Initialize": 0,
         "MessageType_Ping": 1,
         "MessageType_Success": 2,
@@ -12949,6 +12951,55 @@
         "MessageType_UpgradeFileHeader": 10050
       }
     },
+    "CanonicalBitcoinNetwork": {
+      "values": {
+        "BITCOIN_MAINNET": 0,
+        "BITCOIN_TESTNET": 1,
+        "BITCOIN_SIGNET": 2,
+        "BITCOIN_REGTEST": 3
+      }
+    },
+    "BabylonDeriveContextHash": {
+      "fields": {
+        "address_n": {
+          "rule": "repeated",
+          "type": "uint32",
+          "id": 1,
+          "options": {
+            "packed": false
+          }
+        },
+        "script_type": {
+          "rule": "required",
+          "type": "InputScriptType",
+          "id": 2
+        },
+        "app_name": {
+          "rule": "required",
+          "type": "bytes",
+          "id": 3
+        },
+        "context": {
+          "rule": "required",
+          "type": "bytes",
+          "id": 4
+        },
+        "network": {
+          "rule": "required",
+          "type": "CanonicalBitcoinNetwork",
+          "id": 5
+        }
+      }
+    },
+    "BabylonDerivedContextHash": {
+      "fields": {
+        "secret": {
+          "rule": "required",
+          "type": "bytes",
+          "id": 1
+        }
+      }
+    },
     "google": {
       "nested": {
         "protobuf": {

package/src/device/Device.ts

@@ -236,6 +236,9 @@ export class Device extends EventEmitter {
    */
   private deviceAcquired = false;
 
+  /** A completed BLE release left the physical link available for the next call. */
+  private releasedBleConnection = false;
+
   /**
    * Connection-attempt generation. interruptionFromUser() pins the current
    * attempt so a late acquire cannot finish, while the next public connect
@@ -248,6 +251,9 @@ export class Device extends EventEmitter {
   /** Canonical device-state cache; legacy Features is a compatibility projection. */
   private stateStore = new DeviceStateStore();
 
+  /** Retain the old public identity only for disconnect notifications after wipe. */
+  private deviceBeforeWipe: DeviceTyped | null = null;
+
   /** Force the next initialization to reload DeviceInfo after reconnect or reboot. */
   private protocolV2StateNeedsReload = false;
 
@@ -351,6 +357,8 @@ export class Device extends EventEmitter {
   toMessageObject(): DeviceTyped | null {
     if (this.isUnacquired() || !this.features) return null;
 
+    this.deviceBeforeWipe = null;
+
     const env = DataManager.getSettings('env');
     const deviceType = this.getCurrentDeviceType();
 
@@ -395,6 +403,10 @@ export class Device extends EventEmitter {
     };
   }
 
+  toDisconnectMessageObject(): DeviceTyped | null {
+    return this.toMessageObject() ?? this.deviceBeforeWipe;
+  }
+
   /**
    * Device connect
    * @returns {Promise<boolean>}
@@ -443,6 +455,7 @@ export class Device extends EventEmitter {
   ) {
     const attempt = this.connectionAttempt;
     this.throwIfInterruptedByUser();
+    this.releasedBleConnection = false;
     const env = DataManager.getSettings('env');
     const mainIdKey = DataManager.isBleConnect(env) ? 'id' : 'session';
     const previousProtocol = this.originalDescriptor.protocolType;
@@ -553,6 +566,7 @@ export class Device extends EventEmitter {
       (this.isUsedHere() && !this.keepSession && this.mainId) ||
       (this.mainId && DataManager.isBleConnect(env))
     ) {
+      this.releasedBleConnection = false;
       // wait for callback tasks to complete before releasing device
       if (this.pendingCallbackPromise) {
         try {
@@ -576,12 +590,24 @@ export class Device extends EventEmitter {
         }
       }
       try {
+        const deviceType = this.getCurrentDeviceType();
+        const keepBleConnection =
+          (env === 'react-native' || env === 'desktop-web-ble') &&
+          this.isProtocolV2() &&
+          (deviceType === EDeviceType.Pro2 || deviceType === EDeviceType.Neo);
         // BLE releases even when keepSession is set, so forward the intent.
-        await this.deviceConnector?.release(this.mainId, false, this.keepSession);
-        this.updateDescriptor({ session: null } as DeviceDescriptor);
+        await this.deviceConnector?.release(
+          this.mainId,
+          false,
+          this.keepSession || keepBleConnection
+        );
+        this.releasedBleConnection = keepBleConnection;
       } catch (err) {
         Log.error('[Device] release error: ', err);
       } finally {
+        // Core no longer owns a logical transport session after release starts,
+        // even if native cleanup must be retried by the transport.
+        this.updateDescriptor({ session: null } as DeviceDescriptor);
         this.needReloadDevice = true;
       }
     }
@@ -1360,10 +1386,12 @@ export class Device extends EventEmitter {
 
   markTransportDisconnected() {
     this.deviceAcquired = false;
+    this.releasedBleConnection = false;
     this.invalidateProtocolV2RuntimeState();
   }
 
   invalidateAfterWipe() {
+    this.deviceBeforeWipe = this.toMessageObject() ?? this.deviceBeforeWipe;
     const deviceId = this.getCurrentDeviceId();
     if (deviceId) {
       deviceWalletSessionStore.deleteDevice(deviceId);
@@ -1621,7 +1649,7 @@ export class Device extends EventEmitter {
           await commands?.cancelDevice?.().catch(cancelError => {
             Log.debug('Protocol V2 fallback cancel error', cancelError);
           });
-        } else if (!acquired) {
+        } else if (!acquired && !this.releasedBleConnection) {
           // Abort setup without acquiring a session just to send Cancel.
           if (mainId && deviceConnector?.disconnect) {
             // The connector drops the link silently, so without this line a
@@ -1801,7 +1829,7 @@ export class Device extends EventEmitter {
     // both allow and require cases might generate single unexpected mode
     if (!this.isUnacquired()) {
       // allow cases
-      if (this.isBootloader() && !this.isProtocolV2() && !allow.includes(UI_REQUEST.BOOTLOADER)) {
+      if ((this.isBootloader() || this.isRomloader()) && !allow.includes(UI_REQUEST.BOOTLOADER)) {
         return UI_REQUEST.BOOTLOADER;
       }
       if (!this.isInitialized() && !allow.includes(UI_REQUEST.NOT_INITIALIZE)) {

package/src/device/DeviceCommands.ts

@@ -549,6 +549,16 @@ export class DeviceCommands {
           this.device.isProtocolV2() &&
           DEVICE_CONTROL_CALLS.has(callType) &&
           subcode === DeviceErrorCode.DeviceError_Busy;
+        const isProtocolV2PinCancelledBusyFailure =
+          this.device.isProtocolV2() &&
+          !DEVICE_SESSION_CALLS.has(callType) &&
+          subcode === DeviceSessionErrorCode.DeviceSessionError_UserCancelled &&
+          /^pin cancelled$/i.test(normalizedMessage);
+        const isProtocolV2FirmwareUpdateBusyFailure =
+          this.device.isProtocolV2() &&
+          /^requested command not allowed while a firmware update is in progress$/i.test(
+            normalizedMessage
+          );
         const isLegacyProtocolV2LockedFailure =
           this.device.isProtocolV2() && /^device (?:is )?locked$/i.test(normalizedMessage);
         if (
@@ -606,7 +616,11 @@ export class DeviceCommands {
             subcode,
             firmwareMessage: message,
           });
-        } else if (isProtocolV2DeviceBusyFailure) {
+        } else if (
+          isProtocolV2DeviceBusyFailure ||
+          isProtocolV2PinCancelledBusyFailure ||
+          isProtocolV2FirmwareUpdateBusyFailure
+        ) {
           error = ERRORS.TypedError(HardwareErrorCode.DeviceBusy, message, {
             failureCode: code,
             subcode,

package/src/device/DeviceConnector.ts

@@ -133,10 +133,10 @@ export default class DeviceConnector {
             : undefined;
         const detectedProtocol = acquiredProtocol ?? transport.getProtocolType(path);
         if (detectedProtocol !== expectedProtocol) {
-          throw ERRORS.TypedError(
-            HardwareErrorCode.RuntimeError,
-            `Device protocol mismatch: expected ${expectedProtocol}, detected ${detectedProtocol}`
-          );
+          throw ERRORS.TypedError(HardwareErrorCode.TransportProtocolMismatch, undefined, {
+            expectedProtocol,
+            detectedProtocol,
+          });
         }
       }
       return res;

package/src/device/DevicePool.ts

@@ -114,7 +114,11 @@ export class DevicePool extends EventEmitter {
         const exist = canPathIdentifyDevice(cachedPath)
           ? descriptorList.find(d => d.path === cachedPath)
           : undefined;
-        if (exist && !initOptions?.forceProtocolDetection) {
+        if (
+          exist &&
+          !initOptions?.forceProtocolDetection &&
+          !(device.needReloadDevice && device.isUnacquired())
+        ) {
           // Log.debug('find existed Device: ', connectId);
           device.updateDescriptor(exist, true);
           await this._refreshRuntimeState(device, initOptions);
@@ -170,7 +174,13 @@ export class DevicePool extends EventEmitter {
     const forceProtocolDetection = initOptions?.forceProtocolDetection === true;
     const isNewDevice = !cachedDevice;
     const device = cachedDevice ?? Device.fromDescriptor(descriptor);
-    if (isNewDevice || forceProtocolDetection) {
+    if (
+      isNewDevice ||
+      forceProtocolDetection ||
+      (device.needReloadDevice && device.isUnacquired())
+    ) {
+      // Wipe invalidates state while the same USB path can remain discoverable.
+      if (cachedDevice) device.updateDescriptor(descriptor, true);
       device.deviceConnector = this.connector;
       // Search/discovery acquires outside Device.run(). Start a new attempt so
       // a previous user cancel does not hide this device from later searches.

package/src/events/core.ts

@@ -54,9 +54,9 @@ export const parseMessage = (messageData: any): CoreMessage => {
 };
 
 export const createErrorMessage = (error: Error & { code?: string | number }): Unsuccessful => {
-  let payload = { error: error.message, code: error.code };
+  let payload: Unsuccessful['payload'] = { error: error.message, code: error.code };
   if (error instanceof HardwareError) {
-    payload = { error: error.message, code: error.errorCode };
+    payload = { error: error.message, code: error.errorCode, params: error.params };
   }
   return {
     success: false,

package/src/events/logBlockEvent.ts

@@ -8,14 +8,22 @@ export const LogBlockEvent: Set<string> = new Set([
   UI_RESPONSE.RECEIVE_PASSPHRASE,
 ]);
 
-// These resource/file APIs did not exist in 1.1.32. Skip the payload so
-// the log layer does not copy huge Base64 or binary data.
+// Drop sensitive wallet payloads and large resource data before logger caches
+// or log events can retain them, regardless of whether debug output is enabled.
 const LogPayloadBlockMethod: Set<string> = new Set([
+  'btcDeriveContextHash',
+  'btcSignMessage',
   'deviceUploadNft',
   'deviceUploadWallpaper',
   'uploadPortfolio',
   'fileWrite',
   'fileRead',
+  'zcashGetAddress',
+  'zcashSignPczt',
+  'moneroGetAddress',
+  'moneroGetWatchKey',
+  'moneroKeyImageSync',
+  'moneroSignTransaction',
 ]);
 
 export function getLogBlockLabel(message: unknown): string | undefined {
@@ -39,11 +47,57 @@ export function getLogBlockLabel(message: unknown): string | undefined {
   return undefined;
 }
 
+// All-network results of these networks carry what their own address methods
+// keep out of logs (viewing keys, private addresses).
+const LogPayloadBlockNetwork: Set<string> = new Set(['zcash', 'xmr']);
+
+type AllNetworkLogItem = { network?: string; success?: boolean; payload?: object | string } | null;
+
+// A call response lists the results in `payload`; a loop callback carries one
+// result, or all of them when finished, in `payload.data`.
+type AllNetworkLogMessage = {
+  payload?: AllNetworkLogItem[] | { data?: AllNetworkLogItem | AllNetworkLogItem[] };
+};
+
+function redactAllNetworkItem(item: AllNetworkLogItem): AllNetworkLogItem {
+  if (!item || item.success === false || item.payload === undefined) return item;
+  return item.network && LogPayloadBlockNetwork.has(item.network)
+    ? { ...item, payload: '[REDACTED]' }
+    : item;
+}
+
+function redactAllNetworkItems(items: AllNetworkLogItem[]) {
+  const redacted = items.map(redactAllNetworkItem);
+  return redacted.some((item, index) => item !== items[index]) ? redacted : items;
+}
+
+// Returns `message` itself when nothing needs redacting.
+function redactAllNetworkResults(message: AllNetworkLogMessage): AllNetworkLogMessage {
+  const { payload } = message;
+  if (Array.isArray(payload)) {
+    const items = redactAllNetworkItems(payload);
+    return items === payload ? message : { ...message, payload: items };
+  }
+  const data = payload?.data;
+  if (!data) return message;
+  const redacted = Array.isArray(data) ? redactAllNetworkItems(data) : redactAllNetworkItem(data);
+  return redacted === data ? message : { ...message, payload: { ...payload, data: redacted } };
+}
+
 export function getSafeLogPayload(value: unknown, blockLabel?: string): unknown {
   if (blockLabel) {
     return { method: blockLabel, payload: '[REDACTED]' };
   }
-  return value;
+  if (!value || typeof value !== 'object') return value;
+  return redactAllNetworkResults(value as AllNetworkLogMessage);
+}
+
+// A queued task holds its method's raw payload; redact it like the call.
+export function getSafeLogTask<T extends { id?: number; method?: { payload?: unknown } }>(
+  task: T | undefined
+): T | { id?: number; method: string; payload: string } | undefined {
+  const blockLabel = getLogBlockLabel(task?.method?.payload);
+  return blockLabel ? { id: task?.id, method: blockLabel, payload: '[REDACTED]' } : task;
 }
 
 export function formatLogMethodLabel(label: string, methodName?: string): string {

package/src/events/ui-request.ts

@@ -211,6 +211,7 @@ export interface DeviceProgress {
     totalBytes?: number;
     rateBytesPerSecond?: number;
     elapsedMs?: number;
+    retryCount?: number;
   };
 }
 
@@ -218,6 +219,7 @@ export interface PreviousAddressResult {
   type: typeof UI_REQUEST.PREVIOUS_ADDRESS_RESULT;
   payload: {
     device: Device;
+    method: string;
     data: {
       address?: string;
       path?: string;

package/src/index.ts

@@ -21,6 +21,7 @@ export { executeCallback, cleanupCallback };
 export { preloadSessionCache } from './device/Device';
 export { projectFeatures as projectDeviceStateFeatures } from './device/DeviceStateProjector';
 export { getMethodSupportedProtocols } from './api/utils';
+export { probeUsbDeviceIdentitiesWithTransport } from './api/SearchDevices';
 export {
   getFirmwareUpdateHostBindingGeneration,
   registerFirmwareUpdateHostBinding,

package/src/inject.ts

@@ -309,6 +309,8 @@ export const createCoreApi = (
     call({ ...params, connectId, deviceId, method: 'btcGetAddress' }),
   btcGetPublicKey: (connectId, deviceId, params) =>
     call({ ...params, connectId, deviceId, method: 'btcGetPublicKey' }),
+  btcDeriveContextHash: (connectId, deviceId, params) =>
+    call({ ...params, connectId, deviceId, method: 'btcDeriveContextHash' }),
   btcSignMessage: (connectId, deviceId, params) =>
     call({ ...params, connectId, deviceId, method: 'btcSignMessage' }),
   btcSignPsbt: (connectId, deviceId, params) =>
@@ -502,4 +504,17 @@ export const createCoreApi = (
     call({ ...params, connectId, deviceId, method: 'neoGetAddress' }),
   neoSignTransaction: (connectId, deviceId, params) =>
     call({ ...params, connectId, deviceId, method: 'neoSignTransaction' }),
+  zcashGetAddress: (connectId, deviceId, params) =>
+    call({ ...params, connectId, deviceId, method: 'zcashGetAddress' }),
+  zcashSignPczt: (connectId, deviceId, params) =>
+    call({ ...params, connectId, deviceId, method: 'zcashSignPczt' }),
+
+  moneroGetAddress: (connectId, deviceId, params) =>
+    call({ ...params, connectId, deviceId, method: 'moneroGetAddress' }),
+  moneroGetWatchKey: (connectId, deviceId, params) =>
+    call({ ...params, connectId, deviceId, method: 'moneroGetWatchKey' }),
+  moneroKeyImageSync: (connectId, deviceId, params) =>
+    call({ ...params, connectId, deviceId, method: 'moneroKeyImageSync' }),
+  moneroSignTransaction: (connectId, deviceId, params) =>
+    call({ ...params, connectId, deviceId, method: 'moneroSignTransaction' }),
 });

package/src/protocols/protocol-v2/resources.ts

@@ -7,6 +7,8 @@ export const PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_PATH =
 export const PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_STAGING_PATH = `${PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_PATH}.staging`;
 export const PROTOCOL_V2_ROM_PARAMS_PACKAGE_PATH = 'vol0:/loaders/rom/params.okpkg';
 export const PROTOCOL_V2_RESOURCE_PACKAGE_HEADER_SIZE = 0x5f90;
+// Installed-package comparison only needs the prefix through the header hash.
+export const PROTOCOL_V2_RESOURCE_PACKAGE_COMPARE_SIZE = 0x280;
 
 const PROTOCOL_V2_RESOURCE_PACKAGE_HEADER_VERSION = 1;
 const PROTOCOL_V2_RESOURCE_PACKAGE_FLEXIBLE_OFFSET = 0x6c;
@@ -123,7 +125,7 @@ export function parseProtocolV2ResourcePackageHeader(
   bytes: Uint8Array,
   packageSize: number
 ): ProtocolV2ResourcePackageHeader {
-  if (bytes.byteLength < PROTOCOL_V2_RESOURCE_PACKAGE_HEADER_SIZE) {
+  if (bytes.byteLength < PROTOCOL_V2_RESOURCE_PACKAGE_COMPARE_SIZE) {
     throw new Error('Pro2 RESOURCE package is shorter than its header');
   }
   const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
@@ -169,5 +171,8 @@ export function parseProtocolV2ResourcePackage(
   binary: ArrayBuffer | Uint8Array
 ): ProtocolV2ResourcePackageHeader {
   const bytes = binary instanceof Uint8Array ? binary : new Uint8Array(binary);
+  if (bytes.byteLength < PROTOCOL_V2_RESOURCE_PACKAGE_HEADER_SIZE) {
+    throw new Error('Pro2 RESOURCE package is shorter than its header');
+  }
   return parseProtocolV2ResourcePackageHeader(bytes, bytes.byteLength);
 }

package/src/types/api/allNetworkGetAddress.ts

@@ -34,7 +34,9 @@ export type INetwork =
   | 'nostr'
   | 'benfen'
   | 'neo'
-  | 'stellar';
+  | 'stellar'
+  | 'xmr'
+  | 'zcash';
 
 export type CommonResponseParams = {
   path: string;
@@ -66,6 +68,12 @@ type AllNetworkAddressPayload =
       // Nostr public key (bech32)
       npub?: string;
     }
+  | {
+      // Zcash
+      address: string;
+      ufvk?: string;
+      seedFingerprint?: string;
+    }
   | {
       // Cardano
       addressParameters: CardanoAddressParameters;

package/src/types/api/btcDeriveContextHash.ts

@@ -0,0 +1,15 @@
+import type { BabylonDerivedContextHash } from '@onekeyfe/hd-transport';
+import type { CommonParams, Response } from '../params';
+
+export type BTCDeriveContextHashParams = {
+  path: string | number[];
+  appName: string;
+  context: string;
+  network: 'bitcoin-mainnet' | 'bitcoin-testnet' | 'bitcoin-signet' | 'bitcoin-regtest';
+};
+
+export declare function btcDeriveContextHash(
+  connectId: string,
+  deviceId: string,
+  params: CommonParams & BTCDeriveContextHashParams
+): Response<BabylonDerivedContextHash>;

package/src/types/api/export.ts

@@ -1,5 +1,6 @@
 export type { BTCAddress, BTCGetAddressParams } from './btcGetAddress';
 export type { BTCPublicKey, BTCGetPublicKeyParams } from './btcGetPublicKey';
+export type { BTCDeriveContextHashParams } from './btcDeriveContextHash';
 export type { BTCSignMessageParams } from './btcSignMessage';
 export type { BTCVerifyMessageParams } from './btcVerifyMessage';
 export type {
@@ -226,3 +227,18 @@ export type { BenfenAddress, BenfenGetAddressParams } from './benfenGetAddress';
 export type { BenfenPublicKey, BenfenGetPublicKeyParams } from './benfenGetPublicKey';
 export type { BenfenSignMessageParams } from './benfenSignMessage';
 export type { BenfenSignedTx, BenfenSignTransactionParams } from './benfenSignTransaction';
+export type { ZcashAddress, ZcashGetAddressParams } from './zcashGetAddress';
+export type { ZcashSignedPczt, ZcashSignPcztParams } from './zcashSignPczt';
+
+export type { MoneroAddress, MoneroGetAddressParams } from './moneroGetAddress';
+export type { MoneroGetWatchKeyParams, MoneroWatchKey } from './moneroGetWatchKey';
+export type {
+  MoneroEncryptedKeyImage,
+  MoneroKeyImageSyncParams,
+  MoneroKeyImageSyncResult,
+  MoneroKeyImageTransfer,
+} from './moneroKeyImageSync';
+export type {
+  MoneroSignTransactionParams,
+  MoneroSignTransactionResult,
+} from './moneroSignTransaction';

package/src/types/api/index.ts

@@ -73,6 +73,7 @@ import type { evmSignTypedData } from './evmSignTypedData';
 import type { evmVerifyMessage } from './evmVerifyMessage';
 import type { btcGetAddress } from './btcGetAddress';
 import type { btcGetPublicKey } from './btcGetPublicKey';
+import type { btcDeriveContextHash } from './btcDeriveContextHash';
 import type { btcSignMessage } from './btcSignMessage';
 import type { btcSignPsbt } from './btcSignPsbt';
 import type { btcSignTransaction } from './btcSignTransaction';
@@ -153,6 +154,12 @@ import type { benfenSignTransaction } from './benfenSignTransaction';
 import type { benfenSignMessage } from './benfenSignMessage';
 import type { neoGetAddress } from './neoGetAddress';
 import type { neoSignTransaction } from './neoSignTransaction';
+import type { zcashGetAddress } from './zcashGetAddress';
+import type { zcashSignPczt } from './zcashSignPczt';
+import type { moneroGetAddress } from './moneroGetAddress';
+import type { moneroGetWatchKey } from './moneroGetWatchKey';
+import type { moneroKeyImageSync } from './moneroKeyImageSync';
+import type { moneroSignTransaction } from './moneroSignTransaction';
 import type { ConnectSettings } from '../settings';
 import type { HardwareConnectProtocol } from '@onekeyfe/hd-shared';
 
@@ -286,6 +293,7 @@ export type CoreApi = {
    */
   btcGetAddress: typeof btcGetAddress;
   btcGetPublicKey: typeof btcGetPublicKey;
+  btcDeriveContextHash: typeof btcDeriveContextHash;
   btcSignMessage: typeof btcSignMessage;
   btcSignPsbt: typeof btcSignPsbt;
   btcSignTransaction: typeof btcSignTransaction;
@@ -470,4 +478,18 @@ export type CoreApi = {
    */
   neoGetAddress: typeof neoGetAddress;
   neoSignTransaction: typeof neoSignTransaction;
+
+  /**
+   * Zcash
+   */
+  zcashGetAddress: typeof zcashGetAddress;
+  zcashSignPczt: typeof zcashSignPczt;
+
+  /**
+   * Monero
+   */
+  moneroGetAddress: typeof moneroGetAddress;
+  moneroGetWatchKey: typeof moneroGetWatchKey;
+  moneroKeyImageSync: typeof moneroKeyImageSync;
+  moneroSignTransaction: typeof moneroSignTransaction;
 };

package/src/types/api/moneroGetAddress.ts

@@ -0,0 +1,27 @@
+import type { CommonParams, Response } from '../params';
+
+export type MoneroAddress = {
+  path: string;
+  // Primary address of the account, base58
+  address: string;
+};
+
+export type MoneroGetAddressParams = {
+  // Account path, m/44'/128'/account'
+  path: string | number[];
+  showOnOneKey?: boolean;
+  // 0 mainnet, 1 testnet, 2 stagenet
+  networkType?: number;
+};
+
+export declare function moneroGetAddress(
+  connectId: string,
+  deviceId: string,
+  params: CommonParams & MoneroGetAddressParams
+): Response<MoneroAddress>;
+
+export declare function moneroGetAddress(
+  connectId: string,
+  deviceId: string,
+  params: CommonParams & { bundle?: MoneroGetAddressParams[] }
+): Response<Array<MoneroAddress>>;

package/src/types/api/moneroGetWatchKey.ts

@@ -0,0 +1,28 @@
+import type { CommonParams, Response } from '../params';
+
+export type MoneroWatchKey = {
+  path: string;
+  // Private view key, hex
+  watchKey: string;
+  // Primary address of the account, base58
+  address: string;
+};
+
+export type MoneroGetWatchKeyParams = {
+  // Account path, m/44'/128'/account'
+  path: string | number[];
+  // 0 mainnet, 1 testnet, 2 stagenet
+  networkType?: number;
+};
+
+export declare function moneroGetWatchKey(
+  connectId: string,
+  deviceId: string,
+  params: CommonParams & MoneroGetWatchKeyParams
+): Response<MoneroWatchKey>;
+
+export declare function moneroGetWatchKey(
+  connectId: string,
+  deviceId: string,
+  params: CommonParams & { bundle?: MoneroGetWatchKeyParams[] }
+): Response<Array<MoneroWatchKey>>;

package/src/types/api/moneroKeyImageSync.ts

@@ -0,0 +1,45 @@
+import type { CommonParams, Response } from '../params';
+
+// One owned output, as wallet2 describes it to the device. Keys are 32-byte hex.
+export type MoneroKeyImageTransfer = {
+  // Output public key
+  outKey: string;
+  // Transaction public key R
+  txPubKey: string;
+  // Additional tx public keys: the one for this output, or the whole list
+  additionalTxPubKeys?: string[];
+  // Index of the output within its transaction
+  internalOutputIndex: number;
+  // Receiving subaddress index; omitted means 0 (primary address)
+  subAddrMajor?: number;
+  subAddrMinor?: number;
+};
+
+// ChaCha20-Poly1305 under encKey, hex.
+export type MoneroEncryptedKeyImage = {
+  // 12-byte nonce
+  iv: string;
+  // Ciphertext of key image || signature c || signature r, then the 16-byte tag
+  blob: string;
+};
+
+export type MoneroKeyImageSyncResult = {
+  // Key that decrypts every blob, hex
+  encKey: string;
+  // One entry per transfer, in request order
+  keyImages: MoneroEncryptedKeyImage[];
+};
+
+export type MoneroKeyImageSyncParams = {
+  // Account path, m/44'/128'/account'
+  path: string | number[];
+  // 0 mainnet, 1 testnet, 2 stagenet
+  networkType?: number;
+  transfers: MoneroKeyImageTransfer[];
+};
+
+export declare function moneroKeyImageSync(
+  connectId: string,
+  deviceId: string,
+  params: CommonParams & MoneroKeyImageSyncParams
+): Response<MoneroKeyImageSyncResult>;