@onekeyfe/hwk-adapter-core 1.2.3-alpha.6 → 1.2.3-alpha.8

package/dist/index.d.ts

@@ -1,7 +1,7 @@
-import { HardwareErrorCode } from './errors.js';
-export { HwkError, IHwkErrorPayload, ORPHAN_ELIGIBLE_ERROR_CODES, createHwkError, enrichErrorMessage } from './errors.js';
-import { U as UiResponseEvent, a as UI_REQUEST, Q as QrDisplayData } from './ui-events-Cb7haAeE.js';
-export { D as DevicePermissionDeniedReason, b as DevicePermissionResponse, c as QrResponseData, d as UI_EVENT, e as UI_REQUEST_CANCELLED_TAG, f as UI_REQUEST_DEFAULT_TIMEOUT_MS, g as UI_REQUEST_PREEMPTED_TAG, h as UI_REQUEST_TIMEOUT_TAG, i as UI_RESPONSE, j as UiRequestRegistry } from './ui-events-Cb7haAeE.js';
+import { H as HardwareErrorCode, a as HwkErrorOrigin, b as HwkRecoveryHint } from './errors-Cm8XpjmX.js';
+export { c as HwkError, d as HwkRecoveryScope, I as IHwkErrorPayload, e as IOperationMayHaveCompletedParams, O as ORPHAN_ELIGIBLE_ERROR_CODES, f as createHwkError, g as defaultOriginForCode, h as defaultRecoveryForCode, i as enrichErrorMessage, j as isHwkRecoveryHint, o as operationMayHaveCompletedParams } from './errors-Cm8XpjmX.js';
+import { U as UiResponseEvent, a as UiRequestOperationAttribution, b as UI_REQUEST, Q as QrDisplayData, c as UiRequestRegistry, S as SaveDeviceBindingDeclineReason } from './ui-events-BGUpXxvP.js';
+export { D as DevicePermissionDeniedReason, d as DevicePermissionResponse, e as QrResponseData, f as UI_EVENT, g as UI_REQUEST_CANCELLED_TAG, h as UI_REQUEST_DEFAULT_TIMEOUT_MS, i as UI_REQUEST_PREEMPTED_TAG, j as UI_REQUEST_TIMEOUT_TAG, k as UI_RESPONSE } from './ui-events-BGUpXxvP.js';
 
 interface Success<T> {
     success: true;
@@ -12,16 +12,57 @@ interface Failure {
     payload: {
         error: string;
         code: HardwareErrorCode;
+        /** See HwkErrorOrigin — who the failure came from. Optional so an
+         *  unclassified failure degrades to code-based handling, never a guess. */
+        origin?: HwkErrorOrigin;
+        /** Connection-lifecycle recovery semantics. Optional for wire compatibility
+         *  with SDK versions that predate this field. SDK failure helpers populate it. */
+        recovery?: HwkRecoveryHint;
         params?: Record<string, unknown>;
     };
 }
 type Response<T> = Success<T> | Failure;
 declare function success<T>(payload: T): Success<T>;
-declare function failure(code: HardwareErrorCode, error: string, params?: Record<string, unknown>): Failure;
+declare function failure(code: HardwareErrorCode, error: string, params?: Record<string, unknown>, origin?: HwkErrorOrigin, recovery?: HwkRecoveryHint): Failure;
 
-type VendorType = 'trezor' | 'ledger';
-type ConnectionType = 'usb' | 'ble';
-type TransportType = 'usb' | 'ble' | 'hid' | 'bridge';
+/**
+ * Fixed derivation paths used to generate chain fingerprints.
+ * Uses standard index 0 — Ledger firmware shows device confirmation for
+ * non-standard paths (e.g., index=100), which would interrupt wallet creation.
+ * The address is hashed into a 16-char fingerprint, not exposed directly.
+ * - EVM: cointype 60 (Ledger ETH App only supports 60)
+ * - BTC: cointype 1 (testnet)
+ * - SOL: cointype 501, standard 3-level hardened
+ */
+declare const CHAIN_FINGERPRINT_PATHS: Record<ChainForFingerprint, string>;
+type ChainForFingerprint = 'evm' | 'btc' | 'sol' | 'tron' | 'zcash';
+/**
+ * Parses the complete BIP32 master fingerprint wire value: 4 bytes encoded
+ * as exactly 8 hexadecimal characters. This is protocol metadata, not a
+ * collision-resistant wallet identity.
+ */
+declare function parseBip32MasterFingerprint(value: unknown): string | undefined;
+/**
+ * 16-char SHA-256 fingerprint for device-identity verification.
+ * Callers must canonicalize input (e.g. EVM address → lowercase) —
+ * encoding variations otherwise cause false DeviceMismatch.
+ */
+declare function deriveDeviceFingerprint(value: string): string;
+/**
+ * Stable 256-bit wallet identity derived from canonical public wallet
+ * material. The domain separator prevents the same input from being confused
+ * with hashes used by other SDK features.
+ *
+ * Callers must provide one fixed, vendor-defined identity source. Do not hash
+ * a variable subset of exported accounts: the same wallet would then receive
+ * different ids depending on which accounts happened to be returned.
+ */
+declare function deriveWalletId(canonicalPublicMaterial: string): string;
+
+type VendorType = 'trezor' | 'ledger' | 'keystone';
+/** 'qr' is a virtual channel: UR payloads travel via app-rendered/scanned QR codes. */
+type ConnectionType = 'usb' | 'ble' | 'qr';
+type TransportType = 'usb' | 'ble' | 'hid' | 'bridge' | 'qr';
 /**
  * Device capabilities — describes what a specific device/connection
  * combination can or cannot do. Varies by vendor, model, and connection type.
@@ -73,6 +114,56 @@ interface DeviceTarget {
     connectId: string;
     deviceId: string;
 }
+/**
+ * How long a discovery handle remains safe to use for a new connection.
+ * This is deliberately separate from post-connect device identity.
+ */
+type SearchTargetReusePolicy = 'current-discovery' | 'reconnectable' | 'rediscover';
+declare function resolveSearchTargetReusePolicy(device: Pick<DeviceInfo, 'connectionType' | 'capabilities'>): SearchTargetReusePolicy;
+/**
+ * A selectable result from hardware discovery. It may represent a physical
+ * transport endpoint or an interactive entry such as Keystone QR; it is not a
+ * physical-device or wallet identity.
+ */
+interface DeviceSearchTarget {
+    /** Opaque handle scoped to the adapter's current discovery state. */
+    searchTargetId: string;
+    /**
+     * Whether the handle itself may be retried. This says nothing about the
+     * identity learned after connect and must not be inferred from a stored
+     * connectId.
+     */
+    searchTargetReusePolicy?: SearchTargetReusePolicy;
+    vendor: VendorType;
+    connectionType: ConnectionType;
+    kind: 'physical' | 'interactive';
+    label?: string;
+    model?: string;
+    modelName?: string;
+    serialNumber?: string;
+}
+/**
+ * @deprecated Use DeviceSearchTarget. Kept for consumers of the pre-release
+ * connection-target API.
+ */
+type ConnectionTarget = Omit<DeviceSearchTarget, 'searchTargetId'> & {
+    targetId: string;
+    searchTargetId?: string;
+};
+type WalletIdentity = {
+    vendor: 'ledger';
+    type: 'chainFingerprint';
+    chain: ChainForFingerprint;
+    value: string;
+} | {
+    vendor: 'trezor';
+    type: 'deviceId';
+    value: string;
+} | {
+    vendor: 'keystone';
+    type: 'walletId';
+    value: string;
+};
 
 /**
  * Mixin for chain-operation params that can be pinned to a specific passphrase
@@ -133,6 +224,15 @@ interface ConnectorSession {
     sessionId: string;
     deviceInfo: DeviceInfo;
 }
+type ConnectorConnectTarget = {
+    type: 'default';
+} | {
+    type: 'search-target';
+    searchTargetId: string;
+} | {
+    type: 'expected-device-identity';
+    deviceIdentity: string;
+};
 /**
  * Vendor-agnostic bag of extra error fields. Known keys are documented for
  * discoverability; the index signature keeps it open so any connector can
@@ -253,12 +353,16 @@ interface ConnectorEventMap {
     'ui-event': ConnectorUiEvent;
 }
 interface ConnectorSearchDevicesOptions {
+    /** Select a child transport without waking/scanning the others. */
+    transportType?: ConnectionType;
     /**
      * Wait for every child transport in a fused connector. Default discovery can
      * return shortly after USB appears so BLE does not slow down USB flows;
      * binding pickers can opt in when they need BLE candidates too.
      */
     waitForAll?: boolean;
+    /** Availability probes must not invalidate user-selectable discovery targets. */
+    purpose?: 'selection' | 'availability';
 }
 interface ConnectorConfig {
     /**
@@ -273,8 +377,17 @@ interface ConnectorConfig {
 interface IConnector {
     /** Physical connection type this connector uses. Fixed at construction. */
     readonly connectionType: ConnectionType;
+    readonly availableTransports?: readonly ConnectionType[];
     searchDevices(options?: ConnectorSearchDevicesOptions): Promise<ConnectorDevice[]>;
-    connect(deviceId?: string): Promise<ConnectorSession>;
+    connect(deviceId?: string, options?: {
+        transportType: ConnectionType;
+    }): Promise<ConnectorSession>;
+    /**
+     * Structured form for connectors where a discovery handle and a stable
+     * device identity are different concepts. The string form remains for
+     * bridge and legacy compatibility.
+     */
+    connectTarget?(target: ConnectorConnectTarget): Promise<ConnectorSession>;
     disconnect(sessionId: string): Promise<void>;
     call(sessionId: string, method: string, params: unknown): Promise<ConnectorCallResult>;
     cancel(sessionId: string): Promise<void>;
@@ -299,6 +412,9 @@ interface IHardwareBridge {
     connect(params: {
         vendor: VendorType;
         deviceId?: string;
+        options?: {
+            transportType: ConnectionType;
+        };
     }): Promise<ConnectorSession>;
     disconnect(params: {
         vendor: VendorType;
@@ -581,11 +697,21 @@ interface SolSignedTx {
     /** Hex-encoded Ed25519 signature (no 0x prefix) */
     signature: string;
 }
-interface SolSignMsgParams extends PassphraseStateAware {
+interface SolSignMessageBaseParams extends PassphraseStateAware {
     path: string;
     /** Message bytes as hex string (no 0x prefix) */
     message: string;
 }
+interface SolOffchainMessageV1Params {
+    /** Finalized Solana off-chain message format. */
+    messageVersion: 1;
+    /** Complete signer set as 32-byte hex public keys. */
+    requiredSigners: string[];
+}
+type SolSignMsgParams = SolSignMessageBaseParams & ({
+    messageVersion?: undefined;
+    requiredSigners?: undefined;
+} | SolOffchainMessageV1Params);
 interface SolSignature {
     /** Hex-encoded Ed25519 signature (no 0x prefix) */
     signature: string;
@@ -712,6 +838,12 @@ interface TronSignMsgParams extends PassphraseStateAware {
     path: string;
     /** Message hex (no 0x prefix) */
     messageHex: string;
+    /**
+     * TRON message scheme: 'V1' = legacy signMessage (prefix + 32-byte hash),
+     * 'V2' = TIP-191 signMessageV2 (prefix + byte length + message). Adapters
+     * that only implement one scheme reject the other with MethodNotSupported.
+     */
+    messageType?: 'V1' | 'V2';
 }
 interface TronSignature {
     /** 65-byte hex-encoded signature (no 0x prefix) */
@@ -723,100 +855,168 @@ interface ITronMethods {
     tronSignMessage(connectId?: NullableCallArg<string>, deviceId?: NullableCallArg<string>, params?: NullableCallArg<IHardwareCallParams<TronSignMsgParams>>): Promise<Response<TronSignature>>;
 }
 
-/**
- * Fixed derivation paths used to generate chain fingerprints.
- * Uses standard index 0 — Ledger firmware shows device confirmation for
- * non-standard paths (e.g., index=100), which would interrupt wallet creation.
- * The address is hashed into a 16-char fingerprint, not exposed directly.
- * - EVM: cointype 60 (Ledger ETH App only supports 60)
- * - BTC: cointype 1 (testnet)
- * - SOL: cointype 501, standard 3-level hardened
- */
-declare const CHAIN_FINGERPRINT_PATHS: Record<ChainForFingerprint, string>;
-type ChainForFingerprint = 'evm' | 'btc' | 'sol' | 'tron';
-/**
- * 16-char SHA-256 fingerprint for device-identity verification.
- * Callers must canonicalize input (e.g. EVM address → lowercase) —
- * encoding variations otherwise cause false DeviceMismatch.
- */
-declare function deriveDeviceFingerprint(value: string): string;
-
 /** Events generated by SDK internal detection (not from hardware directly). */
 declare const SDK: {
     readonly DEVICE_STUCK: "device-stuck";
     readonly DEVICE_UNRESPONSIVE: "device-unresponsive";
     readonly DEVICE_RECOVERED: "device-recovered";
     readonly DEVICE_INTERACTION: "device-interaction";
+    readonly OPERATION_ENDED: "operation-ended";
+};
+
+declare const OPERATION_DEFAULT_TTL_MS = 600000;
+type OperationEndReason = 'explicit' | 'disconnect' | 'timeout' | 'runtime-reset';
+type HardwareOperation = {
+    operationId: string;
+    connectId: string;
+    device: DeviceInfo;
+    /**
+     * The channel this operation actually runs on. Required on `create` and
+     * `rebind` so it comes from whichever adapter picked the channel, rather
+     * than being read back off `device`, whose snapshot a combined connector
+     * fills with a nominal value.
+     */
+    connectionType: ConnectionType;
+    connectionKeys: string[];
+    createdAt: number;
+    lastActiveAt: number;
+};
+type OperationRegistryOptions = {
+    vendor: VendorType;
+    ttlMs?: number;
+    onEnded?: (operation: HardwareOperation, reason: OperationEndReason) => void;
 };
+/** Runtime-only association between a public operation id and one live target. */
+declare class OperationRegistry {
+    private readonly _vendor;
+    private readonly _ttlMs;
+    private readonly _onEnded?;
+    private readonly _active;
+    private readonly _ended;
+    constructor(options: OperationRegistryOptions);
+    create(params: {
+        searchTargetId: string;
+        connectId: string;
+        device: DeviceInfo;
+        connectionType: ConnectionType;
+        connectionKeys?: string[];
+    }): HardwareOperation;
+    resolve(operationId: string): HardwareOperation;
+    /** Keep an operation alive while one device job is actively using it. */
+    retain(operationId: string): () => void;
+    /** Return active or tombstoned binding data without refreshing its TTL. */
+    find(operationId: string): HardwareOperation | undefined;
+    findActiveByConnectionKey(connectionKey: string): HardwareOperation | undefined;
+    /** Replace the live transport binding after the same target was reconnected. */
+    rebind(operationId: string, params: {
+        connectId: string;
+        device: DeviceInfo;
+        connectionType: ConnectionType;
+        connectionKeys?: string[];
+    }): HardwareOperation;
+    end(operationId: string, reason: OperationEndReason): HardwareOperation | undefined;
+    endByConnectionKey(connectionKey: string, reason: OperationEndReason, exceptOperationId?: string): void;
+    endAll(reason: OperationEndReason, exceptOperationId?: string): void;
+    private _createTimer;
+    private _rememberEnded;
+}
 
 type HardwareMethodMetadata = {
     chain: ChainForFingerprint;
     allNetwork: boolean;
+    /** Whether repeating the method after an ambiguous transport failure is safe. */
+    replayAfterTransportFailure: 'safe' | 'unsafe';
 };
 declare const HARDWARE_METHOD_CATALOG: {
     readonly evmGetAddress: {
         readonly chain: "evm";
         readonly allNetwork: true;
+        readonly replayAfterTransportFailure: "safe";
     };
     readonly evmSignTransaction: {
         readonly chain: "evm";
         readonly allNetwork: false;
+        readonly replayAfterTransportFailure: "unsafe";
     };
     readonly evmSignMessage: {
         readonly chain: "evm";
         readonly allNetwork: false;
+        readonly replayAfterTransportFailure: "unsafe";
     };
     readonly evmSignTypedData: {
         readonly chain: "evm";
         readonly allNetwork: false;
+        readonly replayAfterTransportFailure: "unsafe";
     };
     readonly btcGetAddress: {
         readonly chain: "btc";
         readonly allNetwork: true;
+        readonly replayAfterTransportFailure: "safe";
     };
     readonly btcGetPublicKey: {
         readonly chain: "btc";
         readonly allNetwork: true;
+        readonly replayAfterTransportFailure: "safe";
     };
     readonly btcSignTransaction: {
         readonly chain: "btc";
         readonly allNetwork: false;
+        readonly replayAfterTransportFailure: "unsafe";
     };
     readonly btcSignPsbt: {
         readonly chain: "btc";
         readonly allNetwork: false;
+        readonly replayAfterTransportFailure: "unsafe";
     };
     readonly btcSignMessage: {
         readonly chain: "btc";
         readonly allNetwork: false;
+        readonly replayAfterTransportFailure: "unsafe";
     };
     readonly btcGetMasterFingerprint: {
         readonly chain: "btc";
         readonly allNetwork: false;
+        readonly replayAfterTransportFailure: "safe";
     };
     readonly solGetAddress: {
         readonly chain: "sol";
         readonly allNetwork: true;
+        readonly replayAfterTransportFailure: "safe";
     };
     readonly solSignTransaction: {
         readonly chain: "sol";
         readonly allNetwork: false;
+        readonly replayAfterTransportFailure: "unsafe";
     };
     readonly solSignMessage: {
         readonly chain: "sol";
         readonly allNetwork: false;
+        readonly replayAfterTransportFailure: "unsafe";
     };
     readonly tronGetAddress: {
         readonly chain: "tron";
         readonly allNetwork: true;
+        readonly replayAfterTransportFailure: "safe";
     };
     readonly tronSignTransaction: {
         readonly chain: "tron";
         readonly allNetwork: false;
+        readonly replayAfterTransportFailure: "unsafe";
     };
     readonly tronSignMessage: {
         readonly chain: "tron";
         readonly allNetwork: false;
+        readonly replayAfterTransportFailure: "unsafe";
+    };
+    readonly zcashGetFullViewingKey: {
+        readonly chain: "zcash";
+        readonly allNetwork: false;
+        readonly replayAfterTransportFailure: "safe";
+    };
+    readonly zcashGetShieldedAddress: {
+        readonly chain: "zcash";
+        readonly allNetwork: false;
+        readonly replayAfterTransportFailure: "safe";
     };
 };
 type HardwareMethodName = keyof typeof HARDWARE_METHOD_CATALOG;
@@ -825,6 +1025,11 @@ type AllNetworkMethodName = {
 }[HardwareMethodName];
 declare const ALL_NETWORK_METHOD_NAMES: AllNetworkMethodName[];
 declare function getHardwareMethodMetadata(method: string): HardwareMethodMetadata | undefined;
+/**
+ * Conservative replay gate used only after a call may have reached hardware.
+ * Unknown methods and device mutations are unsafe by default.
+ */
+declare function canReplayHardwareMethodAfterTransportFailure(method: string): boolean;
 declare function isAllNetworkMethodName(method: string): method is AllNetworkMethodName;
 declare function getAllNetworkMethodChain(method: AllNetworkMethodName): ChainForFingerprint;
 
@@ -843,7 +1048,7 @@ type HardwareUiEvent = Exclude<ConnectorUiEvent, {
         progress: number;
     };
 };
-type ChainCapability = 'evm' | 'btc' | 'sol' | 'tron';
+type ChainCapability = 'evm' | 'btc' | 'sol' | 'tron' | 'zcash';
 type TrezorDisplayRotation = 'North' | 'East' | 'South' | 'West';
 type TrezorSafetyCheckLevel = 'Strict' | 'PromptAlways' | 'PromptTemporarily';
 type TrezorDeviceSettingsParams = {
@@ -920,13 +1125,68 @@ type DeviceAuthenticityResult = {
  * that aren't specific to one chain. Vendor-specific options can be added
  * as typed sub-fields here when a vendor actually needs them.
  */
-interface ICommonCallParams {
+/** Persisted connection hints, never proof of device or wallet identity. */
+type KnownDeviceConnection = {
+    transport: 'usb' | 'ble';
+    connectId: string;
+} | {
+    transport: 'qr';
+};
+/** Opaque host lookup identifiers. Never forward these to firmware or logs. */
+type HardwareCallExtra = Readonly<Record<string, string>>;
+interface IHardwareConnectionContext {
+    knownConnections?: readonly KnownDeviceConnection[];
+    extra?: HardwareCallExtra;
+    /** False makes discovery fail instead of asking the user to select a new endpoint. */
+    allowDeviceSelection?: boolean;
+}
+type DeviceSelectionContext = {
+    kind: 'select-device';
+    transport: 'usb';
+    reason: 'multiple-candidates';
+} | {
+    kind: 'bind-connection';
+    transport: 'ble';
+    reason: 'missing-binding' | 'known-connection-unavailable' | 'manual-rebind';
+};
+interface DeviceSelectionRequest extends UiRequestOperationAttribution {
+    devices: DeviceInfo[];
+    requestId: string;
+    context: DeviceSelectionContext;
+    extra?: HardwareCallExtra;
+    /** Repeated snapshots with this requestId update one SDK-owned binding scan. */
+    scanning?: boolean;
+    bindingSessionId?: string;
+    /** A candidate rejected by SDK identity verification in this binding session. */
+    rejectedConnectId?: string;
+}
+/** The SDK has verified this endpoint; the host must persist it before acknowledging. */
+interface SaveDeviceBindingRequest extends UiRequestOperationAttribution {
+    requestId: string;
+    selectionRequestId: string;
+    connection: {
+        transport: 'ble';
+        connectId: string;
+    };
+    identity: Extract<WalletIdentity, {
+        vendor: 'ledger' | 'trezor';
+    }>;
+    extra?: HardwareCallExtra;
+}
+type BindBleDeviceParams = Pick<SaveDeviceBindingRequest, 'identity' | 'extra'>;
+interface DeviceBindingStatus {
+    selectionRequestId: string;
+    status: 'verifying' | 'saved' | 'failed' | 'cancelled';
+}
+interface ICommonCallParams extends IHardwareConnectionContext {
     /**
      * When the required device app is missing, prompt the user (UI request)
      * to install it, stream install progress, then retry the operation once.
      * Off by default — preserves the plain "app not installed" failure.
      */
     autoInstallApp?: boolean;
+    /** Runtime-only id returned by connectDevice(). When present, discovery and fallback are disabled. */
+    operationId?: string;
 }
 type NullableCallArg<T> = T | null | undefined;
 interface IPassphraseCallParams {
@@ -935,6 +1195,15 @@ interface IPassphraseCallParams {
 }
 type IHardwareCommonCallParams = ICommonCallParams & IPassphraseCallParams;
 type IHardwareCallParams<T> = T & IHardwareCommonCallParams;
+/**
+ * Runtime-only context for device-manager operations. The expected identity
+ * lets an adapter fail closed before a read or mutation is replayed after a
+ * reconnect. It must never be forwarded to vendor firmware.
+ */
+interface IDeviceManagerOperationContext extends IHardwareConnectionContext {
+    operationId?: string;
+    expectedDeviceIdentity?: WalletIdentity;
+}
 interface AllNetworkAddressParams {
     network: string;
     path: string;
@@ -945,16 +1214,7 @@ interface AllNetworkAddressParams {
 interface AllNetworkGetAddressParams extends IHardwareCommonCallParams {
     bundle: AllNetworkAddressParams[];
 }
-type AllNetworkDeviceIdentity = {
-    vendor: 'ledger';
-    type: 'chainFingerprint';
-    chain: ChainForFingerprint;
-    value: string;
-} | {
-    vendor: 'trezor';
-    type: 'deviceId';
-    value: string;
-};
+type AllNetworkDeviceIdentity = WalletIdentity;
 type AllNetworkAddressResponsePayload = Record<string, unknown> & {
     error?: string;
     code?: HardwareErrorCode | number;
@@ -962,6 +1222,7 @@ type AllNetworkAddressResponsePayload = Record<string, unknown> & {
     connectId?: string;
     deviceId?: string;
     deviceIdentity?: AllNetworkDeviceIdentity;
+    rootFingerprint?: number;
     chainFingerprint?: string;
     chainFingerprintChain?: ChainForFingerprint;
     params?: Record<string, unknown>;
@@ -1010,46 +1271,50 @@ type UiRequestEvent = {
         device?: DeviceInfo;
         connectId?: string;
         type?: string;
-    };
+    } & UiRequestOperationAttribution;
 } | {
     type: typeof UI_REQUEST.REQUEST_PASSPHRASE;
     payload: {
         device: DeviceInfo;
-    };
+    } & UiRequestOperationAttribution;
 } | {
     type: typeof UI_REQUEST.REQUEST_PASSPHRASE_ON_DEVICE;
     payload: {
         device: DeviceInfo;
-    };
+    } & UiRequestOperationAttribution;
 } | {
     type: typeof UI_REQUEST.REQUEST_BUTTON;
     payload: {
         device: DeviceInfo;
         code?: string;
-    };
+    } & UiRequestOperationAttribution;
 } | {
     type: typeof UI_REQUEST.REQUEST_QR_DISPLAY;
     payload: {
         device: DeviceInfo;
         data: QrDisplayData;
-    };
+    } & UiRequestOperationAttribution;
 } | {
     type: typeof UI_REQUEST.REQUEST_QR_SCAN;
     payload: {
         device: DeviceInfo;
-    };
+    } & UiRequestOperationAttribution;
 } | {
     type: typeof UI_REQUEST.REQUEST_DEVICE_PERMISSION;
     payload: {
         transportType: TransportType;
         connectId?: string;
         deviceId?: string;
-    };
+    } & UiRequestOperationAttribution;
 } | {
     type: typeof UI_REQUEST.REQUEST_SELECT_DEVICE;
-    payload: {
-        devices: DeviceInfo[];
-    };
+    payload: DeviceSelectionRequest;
+} | {
+    type: typeof UI_REQUEST.REQUEST_SAVE_DEVICE_BINDING;
+    payload: SaveDeviceBindingRequest;
+} | {
+    type: typeof UI_REQUEST.DEVICE_BINDING_STATUS;
+    payload: DeviceBindingStatus;
 } | {
     type: typeof UI_REQUEST.REQUEST_DEVICE_CONNECT;
     payload: {
@@ -1069,13 +1334,13 @@ type UiRequestEvent = {
          * isn't recognized.
          */
         message: string;
-    };
+    } & UiRequestOperationAttribution;
 } | {
     type: typeof UI_REQUEST.REQUEST_INSTALL_APP;
     payload: {
         vendor: string;
         appName: string;
-    };
+    } & UiRequestOperationAttribution;
 } | {
     type: typeof UI_REQUEST.REQUEST_TREZOR_THP_PAIRING;
     payload: {
@@ -1083,10 +1348,10 @@ type UiRequestEvent = {
         availableMethods: number[];
         selectedMethod: number;
         nfcData?: string;
-    };
+    } & UiRequestOperationAttribution;
 } | {
     type: typeof UI_REQUEST.CLOSE_UI_WINDOW;
-    payload: Record<string, never>;
+    payload: UiRequestOperationAttribution;
 };
 type SdkEvent = {
     type: typeof SDK.DEVICE_INTERACTION;
@@ -1109,6 +1374,12 @@ type SdkEvent = {
     payload: {
         connectId: string;
     };
+} | {
+    type: typeof SDK.OPERATION_ENDED;
+    payload: {
+        operationId: string;
+        reason: OperationEndReason;
+    };
 };
 type HardwareEvent = DeviceEvent | UiRequestEvent | SdkEvent | HardwareUiEvent;
 type DeviceEventListener = (event: HardwareEvent) => void;
@@ -1119,6 +1390,14 @@ type DeviceEventListener = (event: HardwareEvent) => void;
  * and the value is the narrowed event object the listener will receive.
  */
 interface HardwareEventMap {
+    [UI_REQUEST.DEVICE_BINDING_STATUS]: {
+        type: typeof UI_REQUEST.DEVICE_BINDING_STATUS;
+        payload: DeviceBindingStatus;
+    };
+    [UI_REQUEST.REQUEST_SAVE_DEVICE_BINDING]: {
+        type: typeof UI_REQUEST.REQUEST_SAVE_DEVICE_BINDING;
+        payload: SaveDeviceBindingRequest;
+    };
     'ui-event': HardwareUiEvent;
     [DEVICE.CONNECT]: {
         type: typeof DEVICE.CONNECT;
@@ -1159,7 +1438,7 @@ interface HardwareEventMap {
             device?: DeviceInfo;
             connectId?: string;
             type?: string;
-        };
+        } & UiRequestOperationAttribution;
     };
     [UI_REQUEST.REQUEST_PASSPHRASE]: {
         type: typeof UI_REQUEST.REQUEST_PASSPHRASE;
@@ -1168,33 +1447,33 @@ interface HardwareEventMap {
             connectId?: string;
             passphraseState?: string;
             useEmptyPassphrase?: boolean;
-        };
+        } & UiRequestOperationAttribution;
     };
     [UI_REQUEST.REQUEST_PASSPHRASE_ON_DEVICE]: {
         type: typeof UI_REQUEST.REQUEST_PASSPHRASE_ON_DEVICE;
         payload: {
             device: DeviceInfo;
-        };
+        } & UiRequestOperationAttribution;
     };
     [UI_REQUEST.REQUEST_BUTTON]: {
         type: typeof UI_REQUEST.REQUEST_BUTTON;
         payload: {
             device: DeviceInfo;
             code?: string;
-        };
+        } & UiRequestOperationAttribution;
     };
     [UI_REQUEST.REQUEST_QR_DISPLAY]: {
         type: typeof UI_REQUEST.REQUEST_QR_DISPLAY;
         payload: {
             device: DeviceInfo;
             data: QrDisplayData;
-        };
+        } & UiRequestOperationAttribution;
     };
     [UI_REQUEST.REQUEST_QR_SCAN]: {
         type: typeof UI_REQUEST.REQUEST_QR_SCAN;
         payload: {
             device: DeviceInfo;
-        };
+        } & UiRequestOperationAttribution;
     };
     [UI_REQUEST.REQUEST_DEVICE_PERMISSION]: {
         type: typeof UI_REQUEST.REQUEST_DEVICE_PERMISSION;
@@ -1202,13 +1481,11 @@ interface HardwareEventMap {
             transportType: TransportType;
             connectId?: string;
             deviceId?: string;
-        };
+        } & UiRequestOperationAttribution;
     };
     [UI_REQUEST.REQUEST_SELECT_DEVICE]: {
         type: typeof UI_REQUEST.REQUEST_SELECT_DEVICE;
-        payload: {
-            devices: DeviceInfo[];
-        };
+        payload: DeviceSelectionRequest;
     };
     [UI_REQUEST.REQUEST_DEVICE_CONNECT]: {
         type: typeof UI_REQUEST.REQUEST_DEVICE_CONNECT;
@@ -1216,7 +1493,7 @@ interface HardwareEventMap {
             vendor: string;
             reason: string;
             message: string;
-        };
+        } & UiRequestOperationAttribution;
     };
     [UI_REQUEST.REQUEST_BTC_HIGH_INDEX_CONFIRM]: {
         type: typeof UI_REQUEST.REQUEST_BTC_HIGH_INDEX_CONFIRM;
@@ -1224,14 +1501,14 @@ interface HardwareEventMap {
             vendor: string;
             path: string;
             accountIndex: number;
-        };
+        } & UiRequestOperationAttribution;
     };
     [UI_REQUEST.REQUEST_INSTALL_APP]: {
         type: typeof UI_REQUEST.REQUEST_INSTALL_APP;
         payload: {
             vendor: string;
             appName: string;
-        };
+        } & UiRequestOperationAttribution;
     };
     [UI_REQUEST.REQUEST_TREZOR_THP_PAIRING]: {
         type: typeof UI_REQUEST.REQUEST_TREZOR_THP_PAIRING;
@@ -1240,11 +1517,11 @@ interface HardwareEventMap {
             availableMethods: number[];
             selectedMethod: number;
             nfcData?: string;
-        };
+        } & UiRequestOperationAttribution;
     };
     [UI_REQUEST.CLOSE_UI_WINDOW]: {
         type: typeof UI_REQUEST.CLOSE_UI_WINDOW;
-        payload: Record<string, never>;
+        payload: UiRequestOperationAttribution;
     };
     [SDK.DEVICE_INTERACTION]: {
         type: typeof SDK.DEVICE_INTERACTION;
@@ -1271,16 +1548,23 @@ interface HardwareEventMap {
             connectId: string;
         };
     };
+    [SDK.OPERATION_ENDED]: {
+        type: typeof SDK.OPERATION_ENDED;
+        payload: {
+            operationId: string;
+            reason: OperationEndReason;
+        };
+    };
 }
 interface IDeviceManagerMethods {
-    getFeatures?(connectId: string): Promise<Response<Record<string, unknown>>>;
-    deviceSettings?(connectId: string, params: TrezorDeviceSettingsParams): Promise<Response<Record<string, unknown>>>;
-    setBrightness?(connectId: string, params?: TrezorBrightnessParams): Promise<Response<Record<string, unknown>>>;
-    changePin?(connectId: string, params?: TrezorChangePinParams): Promise<Response<Record<string, unknown>>>;
-    wipeDevice?(connectId: string): Promise<Response<Record<string, unknown>>>;
+    getFeatures?(connectId: string, operationContext?: IDeviceManagerOperationContext): Promise<Response<Record<string, unknown>>>;
+    deviceSettings?(connectId: string, params: TrezorDeviceSettingsParams, operationContext?: IDeviceManagerOperationContext): Promise<Response<Record<string, unknown>>>;
+    setBrightness?(connectId: string, params?: TrezorBrightnessParams, operationContext?: IDeviceManagerOperationContext): Promise<Response<Record<string, unknown>>>;
+    changePin?(connectId: string, params?: TrezorChangePinParams, operationContext?: IDeviceManagerOperationContext): Promise<Response<Record<string, unknown>>>;
+    wipeDevice?(connectId: string, operationContext?: IDeviceManagerOperationContext): Promise<Response<Record<string, unknown>>>;
     authenticateDevice?(connectId: string, params: {
         challenge: string;
-    }): Promise<Response<Record<string, unknown>>>;
+    }, operationContext?: IDeviceManagerOperationContext): Promise<Response<Record<string, unknown>>>;
 }
 interface IWalletStateMethods {
     /**
@@ -1307,20 +1591,45 @@ interface IWalletStateMethods {
      * Optional: vendors without host-managed passphrase sessions (Ledger) omit
      * it. Implemented by `TrezorAdapter`.
      */
-    getPassphraseState?(connectId: string, passphraseState?: string): Promise<Response<string | null>>;
+    getPassphraseState?(connectId: string, passphraseState?: string, operationContext?: IDeviceManagerOperationContext): Promise<Response<string | null>>;
 }
+/**
+ * What a `cancel()` actually reaches on this vendor.
+ *
+ * - `stops-waiting`: the caller stops waiting and the adapter drops the
+ *   response, but a confirmation screen already on the device stays up until
+ *   the user answers it or the device times out.
+ * - `interrupts-device`: the command on the wire is genuinely withdrawn.
+ *
+ * No vendor here reports `interrupts-device`: none of the three can retract a
+ * prompt the device is already showing. The distinction exists so a host can
+ * say "we stopped waiting, answer or reject on the device" instead of claiming
+ * the operation was cancelled.
+ */
+type CancelCapability = 'interrupts-device' | 'stops-waiting';
 interface IHardwareWallet<TConfig = unknown> extends IEvmMethods, IBtcMethods, ISolMethods, ITronMethods, IDeviceManagerMethods, IWalletStateMethods {
     readonly vendor: string;
     readonly activeTransport: TransportType | null;
+    /** What `cancel()` reaches on this vendor. Declared, never inferred. */
+    readonly cancelCapability: CancelCapability;
     init(config: TConfig): Promise<void>;
     dispose(): Promise<void>;
     getAvailableTransports(): TransportType[];
     switchTransport(type: TransportType): Promise<void>;
     searchDevices(options?: SearchDevicesOptions): Promise<DeviceInfo[]>;
-    connectDevice(connectId: string): Promise<Response<string>>;
-    disconnectDevice(connectId: string): Promise<void>;
+    /** Discover selectable hardware entries without claiming identified devices or wallets. */
+    searchDeviceTargets(options?: SearchDevicesOptions): Promise<DeviceSearchTarget[]>;
+    /** @deprecated Use searchDeviceTargets(). */
+    listConnectionTargets(options?: SearchDevicesOptions): Promise<ConnectionTarget[]>;
+    /** Connect or logically bind a selected search result and return a runtime-only operation id. */
+    connectDevice(searchTargetId: string): Promise<Response<string>>;
+    /** Explicit Device Manager binding: verify the existing identity before replacing its BLE locator. */
+    bindBleDevice?(params: BindBleDeviceParams): Promise<Response<string>>;
+    /** Resolve operation-first routing/selection and pin it. The caller must verify wallet identity before business calls. */
+    acquireOperation?(connectId: string, context: IHardwareConnectionContext): Promise<Response<string>>;
+    /** Release an operation owned by the caller. Disconnect events end matching operations automatically. */
+    releaseOperation(operationId: string): Promise<void>;
     getDeviceInfo(connectId: string, deviceId: string): Promise<Response<DeviceInfo>>;
-    getSupportedChains(): ChainCapability[];
     /** Abort the in-flight call. Omit connectId to cancel whatever is active. */
     cancel(connectId?: string): void;
     allNetworkGetAddress(connectId: string, deviceId: string, params: AllNetworkGetAddressParams): Promise<Response<AllNetworkAddressResponse[]>>;
@@ -1357,6 +1666,14 @@ interface SearchDevicesOptions {
      * was discovered first.
      */
     waitForAllTransports?: boolean;
+    /**
+     * Restrict discovery to one transport. A non-enumerable channel may return
+     * a virtual connection target (for example Keystone QR), but discovery must
+     * not start a wallet protocol or account-export interaction. The target is
+     * resolved by the following `connectDevice()` call. Omit to scan everything
+     * available.
+     */
+    transportType?: ConnectionType;
 }
 
 interface EvmGetAddressParams extends PassphraseStateAware {
@@ -1480,6 +1797,14 @@ interface EvmSignTypedDataFull extends PassphraseStateAware {
         primaryType: string;
         message: Record<string, unknown>;
     };
+    /**
+     * The dApp's original EIP-712 JSON, byte for byte. Vendors that hand the
+     * device a serialized payload (Keystone) must prefer this over
+     * re-stringifying `data`: a JSON round trip rewrites integer literals wider
+     * than 2^53 and exponent forms, so the device would display and sign
+     * something the dApp never sent.
+     */
+    dataJson?: string;
     metamaskV4Compat?: boolean;
     showMessageHash?: boolean;
     /**
@@ -1518,6 +1843,33 @@ interface IEvmMethods {
     evmSignTypedData(connectId?: NullableCallArg<string>, deviceId?: NullableCallArg<string>, params?: NullableCallArg<IHardwareCallParams<EvmSignTypedDataParams>>): Promise<Response<EvmSignature>>;
 }
 
+/** Which `GET_VK` encoding the Ledger Zcash app should return. */
+type ZcashFullViewingKeyMode = 'ufvk' | 'orchardFvk';
+interface ZcashGetFullViewingKeyParams extends PassphraseStateAware {
+    /** BIP44 account path `m/44'/133'/a'` (any deeper transparent path is accepted; only the account level is used). */
+    path: string;
+    /** Default `ufvk`. */
+    mode?: ZcashFullViewingKeyMode;
+}
+interface ZcashFullViewingKey {
+    path: string;
+    mode: ZcashFullViewingKeyMode;
+    /** ZIP-316 bech32m UFVK string (mode `ufvk`). */
+    ufvk?: string;
+    /** 96-byte raw Orchard FVK as hex (mode `orchardFvk`). */
+    orchardFvk?: string;
+}
+interface ZcashGetShieldedAddressParams extends PassphraseStateAware {
+    /** Full 5-level transparent path `m/44'/133'/a'/0/i`; the Orchard path is derived from it. */
+    path: string;
+    showOnDevice?: boolean;
+}
+interface ZcashShieldedAddress {
+    /** Unified address with a single Orchard receiver. */
+    address: string;
+    path: string;
+}
+
 /**
  * Low-level device descriptor from Transport layer.
  * Represents a physical device detected by USB/BLE scanning.
@@ -1563,14 +1915,18 @@ interface DeviceDisconnectEvent {
 type DeviceChangeEvent = DeviceConnectEvent | DeviceDisconnectEvent;
 
 /**
- * Pure FIFO job queue. Every enqueue chains onto the tail; jobs run one at
- * a time across all devices. The queue is intentionally passive — it does
- * NOT decide whether to interrupt or ask the user. Those are application-
- * layer concerns owned by the caller (e.g. a UI button handler that wants
- * to ask "device is busy, interrupt current?" before submitting). The
- * queue exposes inspection (`getActiveJob`) and explicit cancellation
- * (`cancelActive` / `cancelAll`) so callers can implement those policies
- * synchronously, without racing against in-flight enqueues.
+ * Serializes every device call and gives callers one handle to cancel them.
+ *
+ * Ordering is the lesser half of the job: calls already await each other, and
+ * nothing in the app issues two device operations at once. What this buys is
+ * the rest — an AbortController per job so a cancel has something to pull, a
+ * busy check so a double-submit is refused rather than queued, and generation
+ * tracking so a job that was queued before a teardown does not start after it.
+ * Those races exist in a perfectly sequential caller, because cleanup is async.
+ *
+ * The queue never decides whether to interrupt or ask the user; the caller owns
+ * that. `getActiveJob()` reads synchronously so a UI handler can look, decide,
+ * and submit in one turn without racing an in-flight enqueue.
  */
 interface JobOptions {
     label?: string;
@@ -1582,10 +1938,15 @@ interface ActiveJobInfo {
     label?: string;
     startedAt: number;
 }
+interface CancelScopeHandle {
+    signal: AbortSignal;
+    release: () => void;
+}
 declare class DeviceJobQueue {
     private _tail;
     private _active;
     private readonly _jobs;
+    private readonly _cancelScopes;
     /** Incremented on clear() so queued-but-not-yet-running jobs detect invalidation. */
     private _generation;
     private readonly _generationCancelReasons;
@@ -1594,21 +1955,77 @@ declare class DeviceJobQueue {
      * `deviceId` is a label only — used by inspection / cancellation routing.
      */
     enqueue<T>(deviceId: string, job: (signal: AbortSignal) => Promise<T>, options?: JobOptions): Promise<T>;
-    /** Cancel the active job. If `deviceId` is given, only cancels when it matches. */
-    cancelActive(deviceId?: string): boolean;
-    /** Force cancel the active job. `reason` becomes signal.reason. */
-    forceCancelActive(deviceId?: string, reason?: Error): boolean;
-    /** Cancel the active job (alias for callers that previously needed multi-device cancel). */
-    cancelAllActive(reason?: Error): void;
-    /** Cancel the active job and invalidate queued jobs that have not started. */
+    /**
+     * Open a cancellation scope that outlives the individual jobs under it.
+     *
+     * A bundle (all-network) does not enqueue itself — it enqueues one job per
+     * item. Between two items the queue is empty, so a cancel landing in that
+     * gap finds nothing to abort and the next item goes to the device anyway.
+     * The scope holds the cancel across those gaps; the bundle checks its
+     * signal before each item. Callers must `release()` when the bundle ends.
+     */
+    createCancelScope(deviceId: string): CancelScopeHandle;
+    /**
+     * Cancel the running job. `reason` becomes signal.reason.
+     *
+     * No caller today: every adapter cancel wants the queued work invalidated
+     * too and uses `cancelActiveAndPending`. Kept for a connector layer that
+     * needs to stop only what is on the wire and leave the queue behind it.
+     */
+    cancelActive(deviceId?: string, reason?: Error): boolean;
+    /**
+     * Cancel the active job and invalidate queued jobs that have not started.
+     *
+     * Only `undefined` means "everything". An empty string is a queue key that
+     * derived to nothing, so it matches nothing and reports `false` rather than
+     * silently tearing the whole queue down.
+     *
+     * Returns what the cancel actually reached, not whether it was accepted.
+     */
     cancelActiveAndPending(deviceId?: string, reason?: Error): boolean;
     /** Get info about the currently active job, or null if idle. */
     getActiveJob(deviceId?: string): ActiveJobInfo | null;
-    /** True if any job is currently running. */
-    isBusy(): boolean;
     clear(reason?: Error): void;
 }
 
+declare const HARDWARE_RUNTIME_ID_PREFIX = "hwk:runtime";
+/**
+ * Scopes a runtime id can name. Each is a different lifetime, and none of them
+ * nests cleanly inside another:
+ *
+ * - `search-target` — one device in one discovery snapshot. Dies on the next
+ *   search of the same kind, so a stale pick is refused rather than silently
+ *   resolved against a different unit.
+ * - `link` — one open transport. Outlives the snapshot that produced it.
+ * - `operation` — one business operation. Outlives the link: `rebind()` swaps
+ *   the transport underneath while the id stays the same.
+ */
+type HardwareRuntimeIdKind = 'operation' | 'search-target' | 'link';
+type HardwareRuntimeId = {
+    kind: HardwareRuntimeIdKind;
+    vendor: VendorType;
+};
+/** Runtime ids are opaque and must never be persisted as device identity. */
+declare function createHardwareOperationId(vendor: VendorType): string;
+/** Search targets are valid only for the adapter's current discovery snapshot. */
+declare function createHardwareSearchTargetId(vendor: VendorType): string;
+declare function createHardwareLinkId(vendor: VendorType): string;
+declare function hasHardwareRuntimeIdPrefix(value: unknown): value is string;
+declare function parseHardwareRuntimeId(value: unknown): HardwareRuntimeId | undefined;
+declare function isHardwareOperationId(value: unknown): value is string;
+
+interface HardwareOperationTarget {
+    /** Effective target accepted by existing adapter/connector call paths. */
+    targetId: string | undefined;
+    /** Present when this operation is pinned to a live operation. */
+    operationId: string | undefined;
+}
+/**
+ * Normalizes the transitional positional operation id and the canonical
+ * common-params field. All vendors must reject conflicting bindings.
+ */
+declare function resolveHardwareOperationTarget(positionalTargetId: string | null | undefined, commonOperationId: string | null | undefined, expectedVendor?: VendorType): Response<HardwareOperationTarget>;
+
 /**
  * Minimal typed event emitter using Map<string, Set<listener>>.
  * Each adapter uses this for device events (connect, disconnect, pin, etc.).
@@ -1635,6 +2052,104 @@ declare class TypedEventEmitter<TMap extends Record<string, any> = Record<string
     listenerCount(event: string): number;
 }
 
+/** Serializable BLE transport data shared by Electron main and renderer runtimes. */
+interface ElectronBleDeviceInfo {
+    id: string;
+    name?: string;
+    rssi?: number;
+    advertisedServiceUuids?: string[];
+}
+/**
+ * How the main process recognizes one vendor's peripherals. Everything here
+ * crosses IPC, so it is data rather than predicates: the handler owns no
+ * vendor knowledge of its own. A peripheral matches when it advertises one of
+ * `serviceUuids`, or when its local name matches every entry in
+ * `namePatterns` (each is a case-insensitive regular expression source, so a
+ * single entry can carry alternations).
+ */
+interface ElectronBleMatch {
+    serviceUuids?: string[];
+    namePatterns?: string[];
+}
+interface ElectronBleScanOptions {
+    /** Opaque partition key: results and connected devices never mix across it. */
+    vendor?: string;
+    match?: ElectronBleMatch;
+    /** @deprecated Superseded by `match.serviceUuids`. */
+    serviceUuids?: string[];
+    durationMs?: number;
+}
+/** GATT profile plus the write framing this vendor's firmware expects. */
+interface ElectronBleConnectOptions {
+    vendor: string;
+    serviceUuid: string;
+    writeUuid: string;
+    notifyUuid: string;
+    /**
+     * `padded` splits into fixed `chunkSize` packets, zero-filling the last one
+     * — Trezor firmware silently drops a short packet. `raw` writes the buffer
+     * as given, for framing that carries its own length (Ledger).
+     */
+    write?: {
+        mode: 'padded' | 'raw';
+        chunkSize?: number;
+        chunkDelayMs?: number;
+        maxLength?: number;
+    };
+}
+/** Native code handles GATT only; framing, identity checks and wallet operations stay in the SDK. */
+interface ElectronBleApi {
+    scan(options?: ElectronBleScanOptions): Promise<ElectronBleDeviceInfo[]>;
+    stopScan(): Promise<void>;
+    connect(id: string, options?: ElectronBleConnectOptions): Promise<{
+        id: string;
+        name?: string;
+    }>;
+    disconnect(id: string): Promise<void>;
+    subscribe(id: string): Promise<void>;
+    unsubscribe(id: string): Promise<void>;
+    write(id: string, hexData: string): Promise<void>;
+    checkAvailability(): Promise<{
+        available: boolean;
+        state: string;
+        initialized: boolean;
+    }>;
+    getDevice(id: string): Promise<ElectronBleDeviceInfo | null>;
+    onNotification(handler: (id: string, hexData: string) => void): () => void;
+    onDeviceDisconnected(handler: (id: string) => void): () => void;
+}
+
+/**
+ * The outcome of asking the host to persist a verified binding. A refusal is
+ * reported, never thrown: by this point the SDK has already verified that the
+ * connected wallet is the one the operation expects, so anything the host says
+ * back is about the host's own records. Losing the binding is worth a warning
+ * and a retry next time; it is not a reason to fail work the user asked for.
+ */
+type SaveDeviceBindingOutcome = {
+    saved: true;
+} | {
+    saved: false;
+    reason: SaveDeviceBindingDeclineReason;
+};
+/** Persist a verified binding through the host. Only a user abort throws. */
+declare function requestSaveDeviceBinding(emitter: TypedEventEmitter<HardwareEventMap>, registry: UiRequestRegistry, binding: Omit<SaveDeviceBindingRequest, 'requestId'>, signal?: AbortSignal): Promise<SaveDeviceBindingOutcome>;
+
+/** Discovery and selection share one owner; never connect until the last scan has drained. */
+declare function requestBleDeviceSelection({ emitter, registry, request, scan, signal, allowUsbFallback, pollIntervalMs, }: {
+    emitter: TypedEventEmitter<HardwareEventMap>;
+    registry: UiRequestRegistry;
+    request: Omit<DeviceSelectionRequest, 'requestId' | 'scanning'>;
+    scan: () => Promise<DeviceInfo[]>;
+    signal: AbortSignal;
+    /** The adapter must verify a returned USB candidate before dispatching any business call. */
+    allowUsbFallback?: boolean;
+    pollIntervalMs?: number;
+}): Promise<{
+    device: DeviceInfo;
+    requestId: string;
+}>;
+
 /**
  * Compare two semver strings (e.g. "2.1.0" vs "2.3.1").
  * Returns -1 if a < b, 0 if equal, 1 if a > b.
@@ -1655,7 +2170,18 @@ declare function hexToBytes(hex: string): Uint8Array;
 /** Convert a Uint8Array to a hex string (no 0x prefix). */
 declare function bytesToHex(bytes: Uint8Array): string;
 
-type DetectableHardwareVendor = 'onekey' | 'trezor' | 'ledger';
+interface PrepareSolanaOffchainMessageV1Params {
+    message: Uint8Array;
+    requiredSigners: readonly string[];
+}
+interface PreparedSolanaOffchainMessageV1 {
+    messageText: string;
+    requiredSigners: string[];
+    serializedMessage: Uint8Array;
+}
+declare function prepareSolanaOffchainMessageV1({ message, requiredSigners, }: PrepareSolanaOffchainMessageV1Params): PreparedSolanaOffchainMessageV1;
+
+type DetectableHardwareVendor = 'onekey' | 'trezor' | 'ledger' | 'keystone';
 type HardwareDeviceIdentityInput = {
     name?: string | null;
     localName?: string | null;
@@ -1718,8 +2244,19 @@ type RunAllNetworkGetAddressOptions = {
     buildTopLevelFailure?: (response: AllNetworkAddressResponse, context: AllNetworkResponseContext) => Response<AllNetworkAddressResponse[]>;
 };
 declare function runAllNetworkGetAddress({ connectId, deviceId, params, getMethodChain, normalizeItem, buildUnsupportedNetworkResponse, callItem, attachIdentity, shouldAbortBundle, buildTopLevelFailure, }: RunAllNetworkGetAddressOptions): Promise<Response<AllNetworkAddressResponse[]>>;
+/**
+ * User said "no": an SDK-dialog cancel and an on-device reject both end the
+ * bundle. Asking the device for the next chain after a refusal is a prompt the
+ * user already answered.
+ */
+declare function isUserRefusal(code: HardwareErrorCode | number | undefined): boolean;
+/**
+ * The session the bundle runs on is gone, so the remaining items have nothing
+ * to run against.
+ */
+declare function isConnectionLost(code: HardwareErrorCode | number | undefined): boolean;
 declare function buildUnsupportedMethodResponse(item: AllNetworkAddressParams): AllNetworkAddressResponse;
 
 declare const DEVICE_CONNECT_RETRY_DELAY_MS = 1000;
 
-export { ALL_NETWORK_METHOD_NAMES, type ActiveJobInfo, type AllNetworkAddressParams, type AllNetworkAddressResponse, type AllNetworkAddressResponsePayload, type AllNetworkAttachIdentityContext, type AllNetworkCallItemContext, type AllNetworkGetAddressParams, type AllNetworkMethodName, type AllNetworkResponseContext, type BtcAddress, type BtcGetAddressParams, type BtcGetPublicKeyParams, type BtcPaymentRequest, type BtcPaymentRequestMemo, type BtcPublicKey, type BtcRefTransaction, type BtcSignMsgParams, type BtcSignPsbtParams, type BtcSignTxParams, type BtcSignature, type BtcSignedPsbt, type BtcSignedTx, type BtcTxInput, type BtcTxOutput, CHAIN_FINGERPRINT_PATHS, type ChainCapability, type ChainForFingerprint, type ConnectionType, type ConnectorCallResult, type ConnectorConfig, type ConnectorDevice, type ConnectorErrorParams, type ConnectorEventMap, type ConnectorEventType, type ConnectorSerializedError, type ConnectorSession, type ConnectorUiEvent, DEVICE, DEVICE_CONNECT_RETRY_DELAY_MS, DEVICE_EVENT, type DetectableHardwareVendor, type DeviceAuthenticityParams, type DeviceAuthenticityResult, type DeviceCapabilities, type DeviceChangeEvent, type DeviceConnectEvent, type DeviceDescriptor, type DeviceDisconnectEvent, type DeviceEvent, type DeviceEventListener, type DeviceInfo, DeviceJobQueue, type DeviceTarget, EConnectorInteraction, type EIP712Domain, type EvmAddress, type EvmEthereumDefinitions, type EvmGetAddressParams, type EvmPaymentRequest, type EvmPaymentRequestMemo, type EvmSignMsgParams, type EvmSignTxLedgerParams, type EvmSignTxParams, type EvmSignTxTrezorParams, type EvmSignTypedDataFull, type EvmSignTypedDataHash, type EvmSignTypedDataParams, type EvmSignature, type EvmSignedTx, type Failure, HARDWARE_METHOD_CATALOG, type HardwareDeviceIdentityInput, HardwareErrorCode, type HardwareEvent, type HardwareEventMap, type HardwareMethodMetadata, type HardwareMethodName, type HardwareUiEvent, type IBtcMethods, type ICommonCallParams, type IConnector, type IDeviceManagerMethods, type IEvmMethods, type IHardwareBridge, type IHardwareCallParams, type IHardwareCommonCallParams, type IHardwareWallet, type IPassphraseCallParams, type ISolMethods, type ITronMethods, type IWalletStateMethods, type JobOptions, type NullableCallArg, type PassphraseResponse, type PassphraseStateAware, QrDisplayData, type Response, type RunAllNetworkGetAddressOptions, SDK, type SdkEvent, type SearchDevicesOptions, type SolAddress, type SolGetAddressParams, type SolSignMsgParams, type SolSignTxParams, type SolSignature, type SolSignedTx, type Success, type TransportType, type TrezorBrightnessParams, type TrezorChangePinParams, type TrezorDeviceSettingsParams, type TrezorDisplayRotation, type TrezorSafetyCheckLevel, type TronAddress, type TronContract, type TronFreezeBalanceV2Contract, type TronGetAddressParams, type TronResource, type TronSignMsgParams, type TronSignTxParams, type TronSignature, type TronSignedTx, type TronTransferContract, type TronTriggerSmartContract, type TronUnfreezeBalanceV2Contract, type TronVote, type TronVoteWitnessContract, type TronWithdrawExpireUnfreezeContract, TypedEventEmitter, UI_REQUEST, type UiRequestEvent, UiResponseEvent, type VendorType, batchCall, buildUnsupportedMethodResponse, bytesToHex, compareSemver, createBridgedConnector, createCombinedConnector, deriveDeviceFingerprint, detectHardwareVendorFromDescriptor, ensure0x, failure, getAllNetworkMethodChain, getHardwareMethodMetadata, hexToBytes, isAllNetworkMethodName, isKnownNonTargetHardwareVendor, padHex64, rehydrateConnectorError, runAllNetworkGetAddress, serializeConnectorError, stripHex, success };
+export { ALL_NETWORK_METHOD_NAMES, type ActiveJobInfo, type AllNetworkAddressParams, type AllNetworkAddressResponse, type AllNetworkAddressResponsePayload, type AllNetworkAttachIdentityContext, type AllNetworkCallItemContext, type AllNetworkDeviceIdentity, type AllNetworkGetAddressParams, type AllNetworkMethodName, type AllNetworkResponseContext, type BindBleDeviceParams, type BtcAddress, type BtcGetAddressParams, type BtcGetPublicKeyParams, type BtcPaymentRequest, type BtcPaymentRequestMemo, type BtcPublicKey, type BtcRefTransaction, type BtcSignMsgParams, type BtcSignPsbtParams, type BtcSignTxParams, type BtcSignature, type BtcSignedPsbt, type BtcSignedTx, type BtcTxInput, type BtcTxOutput, CHAIN_FINGERPRINT_PATHS, type CancelCapability, type CancelScopeHandle, type ChainCapability, type ChainForFingerprint, type ConnectionTarget, type ConnectionType, type ConnectorCallResult, type ConnectorConfig, type ConnectorConnectTarget, type ConnectorDevice, type ConnectorErrorParams, type ConnectorEventMap, type ConnectorEventType, type ConnectorSearchDevicesOptions, type ConnectorSerializedError, type ConnectorSession, type ConnectorUiEvent, DEVICE, DEVICE_CONNECT_RETRY_DELAY_MS, DEVICE_EVENT, type DetectableHardwareVendor, type DeviceAuthenticityParams, type DeviceAuthenticityResult, type DeviceBindingStatus, type DeviceCapabilities, type DeviceChangeEvent, type DeviceConnectEvent, type DeviceDescriptor, type DeviceDisconnectEvent, type DeviceEvent, type DeviceEventListener, type DeviceInfo, DeviceJobQueue, type DeviceSearchTarget, type DeviceSelectionContext, type DeviceSelectionRequest, type DeviceTarget, EConnectorInteraction, type EIP712Domain, type ElectronBleApi, type ElectronBleConnectOptions, type ElectronBleDeviceInfo, type ElectronBleMatch, type ElectronBleScanOptions, type EvmAddress, type EvmEthereumDefinitions, type EvmGetAddressParams, type EvmPaymentRequest, type EvmPaymentRequestMemo, type EvmSignMsgParams, type EvmSignTxLedgerParams, type EvmSignTxParams, type EvmSignTxTrezorParams, type EvmSignTypedDataFull, type EvmSignTypedDataHash, type EvmSignTypedDataParams, type EvmSignature, type EvmSignedTx, type Failure, HARDWARE_METHOD_CATALOG, HARDWARE_RUNTIME_ID_PREFIX, type HardwareCallExtra, type HardwareDeviceIdentityInput, HardwareErrorCode, type HardwareEvent, type HardwareEventMap, type HardwareMethodMetadata, type HardwareMethodName, type HardwareOperation, type HardwareOperationTarget, type HardwareRuntimeId, type HardwareRuntimeIdKind, type HardwareUiEvent, HwkErrorOrigin, HwkRecoveryHint, type IBtcMethods, type ICommonCallParams, type IConnector, type IDeviceManagerMethods, type IDeviceManagerOperationContext, type IEvmMethods, type IHardwareBridge, type IHardwareCallParams, type IHardwareCommonCallParams, type IHardwareConnectionContext, type IHardwareWallet, type IPassphraseCallParams, type ISolMethods, type ITronMethods, type IWalletStateMethods, type JobOptions, type KnownDeviceConnection, type NullableCallArg, OPERATION_DEFAULT_TTL_MS, type OperationEndReason, OperationRegistry, type PassphraseResponse, type PassphraseStateAware, type PrepareSolanaOffchainMessageV1Params, type PreparedSolanaOffchainMessageV1, QrDisplayData, type Response, type RunAllNetworkGetAddressOptions, SDK, SaveDeviceBindingDeclineReason, type SaveDeviceBindingRequest, type SdkEvent, type SearchDevicesOptions, type SearchTargetReusePolicy, type SolAddress, type SolGetAddressParams, type SolOffchainMessageV1Params, type SolSignMsgParams, type SolSignTxParams, type SolSignature, type SolSignedTx, type Success, type TransportType, type TrezorBrightnessParams, type TrezorChangePinParams, type TrezorDeviceSettingsParams, type TrezorDisplayRotation, type TrezorSafetyCheckLevel, type TronAddress, type TronContract, type TronFreezeBalanceV2Contract, type TronGetAddressParams, type TronResource, type TronSignMsgParams, type TronSignTxParams, type TronSignature, type TronSignedTx, type TronTransferContract, type TronTriggerSmartContract, type TronUnfreezeBalanceV2Contract, type TronVote, type TronVoteWitnessContract, type TronWithdrawExpireUnfreezeContract, TypedEventEmitter, UI_REQUEST, type UiRequestEvent, UiRequestOperationAttribution, UiRequestRegistry, UiResponseEvent, type VendorType, type WalletIdentity, type ZcashFullViewingKey, type ZcashFullViewingKeyMode, type ZcashGetFullViewingKeyParams, type ZcashGetShieldedAddressParams, type ZcashShieldedAddress, batchCall, buildUnsupportedMethodResponse, bytesToHex, canReplayHardwareMethodAfterTransportFailure, compareSemver, createBridgedConnector, createCombinedConnector, createHardwareLinkId, createHardwareOperationId, createHardwareSearchTargetId, deriveDeviceFingerprint, deriveWalletId, detectHardwareVendorFromDescriptor, ensure0x, failure, getAllNetworkMethodChain, getHardwareMethodMetadata, hasHardwareRuntimeIdPrefix, hexToBytes, isAllNetworkMethodName, isConnectionLost, isHardwareOperationId, isKnownNonTargetHardwareVendor, isUserRefusal, padHex64, parseBip32MasterFingerprint, parseHardwareRuntimeId, prepareSolanaOffchainMessageV1, rehydrateConnectorError, requestBleDeviceSelection, requestSaveDeviceBinding, resolveHardwareOperationTarget, resolveSearchTargetReusePolicy, runAllNetworkGetAddress, serializeConnectorError, stripHex, success };