@onekeyfe/hwk-adapter-core 1.2.8-alpha.12 → 1.2.8-alpha.121

package/dist/index.d.ts

@@ -1,7 +1,7 @@
-import { HardwareErrorCode } from './errors.js';
-export { HwkError, IHwkErrorPayload, ORPHAN_ELIGIBLE_ERROR_CODES, createHwkError, enrichErrorMessage } from './errors.js';
-import { U as UiResponseEvent, a as UI_REQUEST, Q as QrDisplayData } from './ui-events-Cb7haAeE.js';
-export { D as DevicePermissionDeniedReason, b as DevicePermissionResponse, c as QrResponseData, d as UI_EVENT, e as UI_REQUEST_CANCELLED_TAG, f as UI_REQUEST_DEFAULT_TIMEOUT_MS, g as UI_REQUEST_PREEMPTED_TAG, h as UI_REQUEST_TIMEOUT_TAG, i as UI_RESPONSE, j as UiRequestRegistry } from './ui-events-Cb7haAeE.js';
+import { H as HardwareErrorCode, a as HwkErrorOrigin, b as HwkRecoveryHint } from './errors-DednD9bG.js';
+export { c as HwkError, d as HwkRecoveryScope, I as IHwkErrorPayload, e as IOperationMayHaveCompletedParams, O as ORPHAN_ELIGIBLE_ERROR_CODES, f as createHwkError, g as defaultOriginForCode, h as defaultRecoveryForCode, i as enrichErrorMessage, j as isHwkRecoveryHint, o as operationMayHaveCompletedParams } from './errors-DednD9bG.js';
+import { U as UiResponseEvent, E as ExportedAccountKey, a as UiRequestOperationAttribution, b as UI_REQUEST, Q as QrDisplayData, c as UiRequestRegistry, S as SaveDeviceBindingDeclineReason } from './ui-events-D_lCGgCk.js';
+export { D as DevicePermissionDeniedReason, d as DevicePermissionResponse, e as QrResponseData, f as UI_EVENT, g as UI_REQUEST_CANCELLED_TAG, h as UI_REQUEST_DEFAULT_TIMEOUT_MS, i as UI_REQUEST_PREEMPTED_TAG, j as UI_REQUEST_TIMEOUT_TAG, k as UI_RESPONSE } from './ui-events-D_lCGgCk.js';
 
 interface Success<T> {
     success: true;
@@ -12,85 +12,46 @@ interface Failure {
     payload: {
         error: string;
         code: HardwareErrorCode;
+        /** See HwkErrorOrigin, who the failure came from. Optional so an
+         *  unclassified failure degrades to code-based handling, never a guess. */
+        origin?: HwkErrorOrigin;
+        /** Connection-lifecycle recovery semantics. Optional for wire compatibility
+         *  with SDK versions that predate this field. SDK failure helpers populate it. */
+        recovery?: HwkRecoveryHint;
         params?: Record<string, unknown>;
     };
 }
 type Response<T> = Success<T> | Failure;
 declare function success<T>(payload: T): Success<T>;
-declare function failure(code: HardwareErrorCode, error: string, params?: Record<string, unknown>): Failure;
+declare function failure(code: HardwareErrorCode, error: string, params?: Record<string, unknown>, origin?: HwkErrorOrigin, recovery?: HwkRecoveryHint): Failure;
 
-type VendorType = 'trezor' | 'ledger';
-type ConnectionType = 'usb' | 'ble';
-type TransportType = 'usb' | 'ble' | 'hid' | 'bridge';
 /**
- * Device capabilities — describes what a specific device/connection
- * combination can or cannot do. Varies by vendor, model, and connection type.
- *
- * This enables business logic to check capabilities instead of hard-coding
- * vendor-specific conditions (e.g., `if (vendor === 'ledger')`).
+ * Fixed derivation paths used to generate chain fingerprints.
+ * Uses standard index 0 — Ledger firmware shows device confirmation for
+ * non-standard paths (e.g., index=100), which would interrupt wallet creation.
+ * The address is hashed into a 16-char fingerprint, not exposed directly.
+ * - EVM: cointype 60 (Ledger ETH App only supports 60)
+ * - BTC: cointype 1 (testnet)
+ * - SOL: cointype 501, standard 3-level hardened
  */
-interface DeviceCapabilities {
-    /**
-     * Whether connectId/deviceId persist across sessions.
-     *
-     * - `true`: IDs are stable (e.g., OneKey USB, Trezor USB).
-     *   Business logic can match devices by stored connectId/deviceId.
-     * - `false`: IDs are ephemeral, regenerated each session (e.g., Ledger WebHID).
-     *   Business logic should NOT rely on stored connectId/deviceId for matching.
-     */
-    persistentDeviceIdentity: boolean;
-}
-interface DeviceInfo {
-    vendor: VendorType;
-    /** Machine model id (e.g. "nanoX"). */
-    model: string;
-    /** Human-readable model name (e.g. "Ledger Nano X"). */
-    modelName?: string;
-    firmwareVersion: string;
-    deviceId: string;
-    connectId: string;
-    label?: string;
-    connectionType: ConnectionType;
-    battery?: number;
-    /** BLE signal strength (BLE only). */
-    rssi?: number | null;
-    /** BLE connectable flag (BLE only). */
-    isConnectable?: boolean | null;
-    /** USB serial number (USB only). */
-    serialNumber?: string;
-    /** Device capabilities — varies by vendor, model, and connection type */
-    capabilities?: DeviceCapabilities;
-    /**
-     * Vendor-specific raw payload from the post-handshake `Features` (Trezor)
-     * or device-info call. Populated by the connector with `{ transport,
-     * descriptor, features }` so the app layer can read fields we haven't
-     * promoted to the typed surface yet. Treat as informational — promote
-     * any consumed field above.
-     */
-    raw?: Record<string, unknown>;
-}
-interface DeviceTarget {
-    connectId: string;
-    deviceId: string;
-}
-
+declare const CHAIN_FINGERPRINT_PATHS: Record<ChainForFingerprint, string>;
+type ChainForFingerprint = 'evm' | 'btc' | 'sol' | 'tron' | 'zcash';
 /**
- * Mixin for chain-operation params that can be pinned to a specific passphrase
- * wallet.
- *
- * Trezor-only. `passphraseState` is the wallet identity returned by
- * `getPassphraseState`: today this is the compressed public key derived at
- * `m/44'/0'/0'`, not the 4-byte master fingerprint. When present, the adapter
- * creates a fresh wallet session (THP application session, or v1 device
- * session) and verifies the derived state before issuing the call, so the
- * address/signature comes from the intended passphrase wallet.
- *
- * Ledger has no equivalent and ignores the field — it never reaches the
- * protobuf layer (the adapter strips it before forwarding to the connector).
+ * Parses the complete BIP32 master fingerprint wire value: 4 bytes encoded
+ * as exactly 8 hexadecimal characters. This is protocol metadata, not a
+ * collision-resistant wallet identity.
  */
-interface PassphraseStateAware {
-    passphraseState?: string;
-}
+declare function parseBip32MasterFingerprint(value: unknown): string | undefined;
+/** Four zero bytes is how a missing master fingerprint is encoded; never a wallet identity. */
+declare const MISSING_BIP32_MASTER_FINGERPRINT = "00000000";
+/** A master fingerprint usable as a wallet identity: well-formed and not the missing marker. */
+declare function parseWalletMasterFingerprint(value: unknown): string | undefined;
+/**
+ * 16-char SHA-256 fingerprint for device-identity verification.
+ * Callers must canonicalize input (e.g. EVM address → lowercase) —
+ * encoding variations otherwise cause false DeviceMismatch.
+ */
+declare function deriveDeviceFingerprint(value: string): string;
 
 /**
  * Minimal device info returned during discovery (searchDevices).
@@ -133,6 +94,15 @@ interface ConnectorSession {
     sessionId: string;
     deviceInfo: DeviceInfo;
 }
+type ConnectorConnectTarget = {
+    type: 'default';
+} | {
+    type: 'search-target';
+    searchTargetId: string;
+} | {
+    type: 'expected-device-identity';
+    deviceIdentity: string;
+};
 /**
  * Vendor-agnostic bag of extra error fields. Known keys are documented for
  * discoverability; the index signature keeps it open so any connector can
@@ -197,6 +167,8 @@ declare enum EConnectorInteraction {
     AppInstallProgress = "app-install-progress"
 }
 type ConnectorUiEvent = {
+    operationId?: string;
+} & ({
     type: EConnectorInteraction.Searching;
     payload: {
         sessionId: string;
@@ -205,6 +177,7 @@ type ConnectorUiEvent = {
     type: EConnectorInteraction.ConfirmOpenApp;
     payload: {
         sessionId: string;
+        appName?: string;
     };
 } | {
     type: EConnectorInteraction.UnlockDevice;
@@ -228,7 +201,7 @@ type ConnectorUiEvent = {
         appName: string;
         progress: number;
     };
-};
+});
 interface ConnectorEventMap {
     'device-connect': {
         device: ConnectorDevice;
@@ -245,6 +218,8 @@ interface ConnectorEventMap {
         connectId: string;
         deviceId?: string;
         credentials: Record<string, unknown>[];
+        /** Credentials the device rejected; a list kept for several devices drops these. */
+        removed?: Record<string, unknown>[];
     };
     'ui-request': {
         type: string;
@@ -253,12 +228,16 @@ interface ConnectorEventMap {
     'ui-event': ConnectorUiEvent;
 }
 interface ConnectorSearchDevicesOptions {
+    /** Select a child transport without waking/scanning the others. */
+    transportType?: ConnectionType;
     /**
      * Wait for every child transport in a fused connector. Default discovery can
      * return shortly after USB appears so BLE does not slow down USB flows;
      * binding pickers can opt in when they need BLE candidates too.
      */
     waitForAll?: boolean;
+    /** Availability probes must not invalidate user-selectable discovery targets. */
+    purpose?: 'selection' | 'availability';
 }
 interface ConnectorConfig {
     /**
@@ -273,8 +252,16 @@ interface ConnectorConfig {
 interface IConnector {
     /** Physical connection type this connector uses. Fixed at construction. */
     readonly connectionType: ConnectionType;
+    readonly availableTransports?: readonly ConnectionType[];
     searchDevices(options?: ConnectorSearchDevicesOptions): Promise<ConnectorDevice[]>;
-    connect(deviceId?: string): Promise<ConnectorSession>;
+    connect(deviceId?: string, options?: {
+        transportType: ConnectionType;
+    }): Promise<ConnectorSession>;
+    /**
+     * Structured form for connectors where a discovery handle and a stable device identity are
+     * different concepts. The string form remains for bridge and legacy compatibility.
+     */
+    connectTarget?(target: ConnectorConnectTarget): Promise<ConnectorSession>;
     disconnect(sessionId: string): Promise<void>;
     call(sessionId: string, method: string, params: unknown): Promise<ConnectorCallResult>;
     cancel(sessionId: string): Promise<void>;
@@ -299,6 +286,9 @@ interface IHardwareBridge {
     connect(params: {
         vendor: VendorType;
         deviceId?: string;
+        options?: {
+            transportType: ConnectionType;
+        };
     }): Promise<ConnectorSession>;
     disconnect(params: {
         vendor: VendorType;
@@ -396,73 +386,87 @@ declare const DEVICE: {
     readonly TREZOR_THP_CREDENTIALS_CHANGED: "device-trezor-thp-credentials-changed";
 };
 
-interface BtcGetAddressParams extends PassphraseStateAware {
+/**
+ * Mixin for chain-operation params that can be pinned to a specific passphrase
+ * wallet.
+ *
+ * Trezor-only. `passphraseState` is the wallet identity returned by
+ * `getPassphraseState`: today this is the compressed public key derived at
+ * `m/44'/0'/0'`, not the 4-byte master fingerprint. When present, the adapter
+ * creates a fresh wallet session (THP application session, or v1 device
+ * session) and verifies the derived state before issuing the call, so the
+ * address/signature comes from the intended passphrase wallet.
+ *
+ * Ledger has no equivalent and ignores the field — it never reaches the
+ * protobuf layer (the adapter strips it before forwarding to the connector).
+ */
+interface PassphraseStateAware {
+    passphraseState?: string;
+}
+
+interface EvmGetAddressParams extends PassphraseStateAware {
     path: string;
-    coin?: string;
     showOnDevice?: boolean;
-    scriptType?: 'p2pkh' | 'p2sh' | 'p2wpkh' | 'p2wsh' | 'p2tr';
-    addressIndex?: number;
-    change?: boolean;
+    chainId?: number;
+    ethereumDefinitions?: EvmEthereumDefinitions;
 }
-interface BtcAddress {
+interface EvmAddress {
     address: string;
     path: string;
+    /** Device-reported secp256k1 public key; populated when the transport exposes it. */
+    publicKey?: string;
+    /** Set by air-gapped wallets (Keystone): the exported key this address derives from. */
+    accountKey?: ExportedAccountKey;
 }
-interface BtcGetPublicKeyParams extends PassphraseStateAware {
-    path: string;
-    coin?: string;
-    showOnDevice?: boolean;
-}
-interface BtcPublicKey {
-    xpub: string;
-    publicKey: string;
-    /** Parent key fingerprint (BIP-32), not the master fingerprint. */
-    fingerprint: number;
-    chainCode: string;
+interface EvmSignTxBaseParams extends PassphraseStateAware {
     path: string;
-    depth: number;
+    chainId?: number;
 }
-interface BtcSignTxParams extends PassphraseStateAware {
-    psbt?: string;
-    inputs?: BtcTxInput[];
-    outputs?: BtcTxOutput[];
-    paymentRequests?: BtcPaymentRequest[];
-    refTxs?: BtcRefTransaction[];
-    coin: string;
-    locktime?: number;
-    version?: number;
-    timestamp?: number;
-    expiry?: number;
-    versionGroupId?: number;
-    branchId?: number;
-    /** Account-level derivation path (e.g. "84'/0'/0'") for wallet template. */
-    path?: string;
+/** Ledger shape: the whole RLP-serialized tx (0x-prefixed or plain hex); structured fields forbidden. */
+interface EvmSignTxLedgerParams extends EvmSignTxBaseParams {
+    serializedTx: string;
+    to?: never;
+    value?: never;
+    nonce?: never;
+    gasLimit?: never;
+    gasPrice?: never;
+    txType?: never;
+    maxFeePerGas?: never;
+    maxPriorityFeePerGas?: never;
+    accessList?: never;
+    data?: never;
+    paymentRequest?: never;
+    ethereumDefinitions?: never;
 }
-interface BtcTxInput {
-    path: string;
-    prevHash: string;
-    prevIndex: number;
-    amount: string;
-    scriptType?: 'p2pkh' | 'p2sh' | 'p2wpkh' | 'p2wsh' | 'p2tr';
-    sequence?: number;
-    origHash?: string;
-    origIndex?: number;
-    scriptSig?: string;
-    witness?: string;
-    ownershipProof?: string;
-    commitmentData?: string;
+/** Trezor shape: structured EthereumSignTx protobuf fields; serializedTx forbidden. */
+interface EvmSignTxTrezorParams extends EvmSignTxBaseParams {
+    serializedTx?: never;
+    /** Contract address or recipient. Optional for contract deployment transactions. */
+    to?: string;
+    value?: string;
+    nonce?: string;
+    gasLimit?: string;
+    gasPrice?: string;
+    txType?: number;
+    maxFeePerGas?: string;
+    maxPriorityFeePerGas?: string;
+    accessList?: Array<{
+        address: string;
+        storageKeys: string[];
+    }>;
+    data?: string;
+    paymentRequest?: EvmPaymentRequest;
+    ethereumDefinitions?: EvmEthereumDefinitions;
 }
-interface BtcTxOutput {
-    address?: string;
-    path?: string;
-    opReturnData?: string;
-    amount: string;
-    scriptType?: 'p2pkh' | 'p2sh' | 'p2wpkh' | 'p2wsh' | 'p2tr';
-    paymentReqIndex?: number;
-    origHash?: string;
-    origIndex?: number;
+/** Mutually exclusive vendor shapes; each adapter narrows to its own. */
+type EvmSignTxParams = EvmSignTxLedgerParams | EvmSignTxTrezorParams;
+interface EvmEthereumDefinitions {
+    /** Trezor Ethereum network definition bytes as a hex string. */
+    encodedNetwork?: string;
+    /** Trezor Ethereum token definition bytes as a hex string. */
+    encodedToken?: string;
 }
-interface BtcPaymentRequestMemo {
+interface EvmPaymentRequestMemo {
     textMemo?: {
         text: string;
     };
@@ -483,46 +487,224 @@ interface BtcPaymentRequestMemo {
         mac: string;
     };
 }
-interface BtcPaymentRequest {
+interface EvmPaymentRequest {
     nonce?: string;
     recipientName: string;
-    memos?: BtcPaymentRequestMemo[];
-    /** Decimal string in satoshis/subunits; SDK encodes it as SLIP-24 uint64 LE hex. */
+    memos?: EvmPaymentRequestMemo[];
+    /** Decimal string in subunits; SDK encodes it as SLIP-24 uint256 LE hex. */
     amount?: string;
     signature: string;
 }
-interface BtcRefTransaction {
-    hash: string;
-    version: number;
-    inputs: Array<{
-        prevHash: string;
-        prevIndex: number;
-        script: string;
-        sequence: number;
-    }>;
-    outputs: Array<{
-        amount: string;
-        scriptPubKey: string;
-    }>;
-    locktime: number;
-    /** Original transaction inputs used by Trezor RBF verification (TXORIGINPUT). */
-    origInputs?: BtcTxInput[];
-    /** Original transaction outputs used by Trezor RBF verification (TXORIGOUTPUT). */
-    origOutputs?: BtcTxOutput[];
-    extraData?: string;
-    timestamp?: number;
-    expiry?: number;
-    versionGroupId?: number;
-    branchId?: number;
+interface EvmSignedTx {
+    /** Recovery id as `0x`-prefixed hex string. */
+    v: string;
+    /** ECDSA `r` value as `0x`-prefixed, zero-padded 64-char hex string (32 bytes). */
+    r: string;
+    /** ECDSA `s` value as `0x`-prefixed, zero-padded 64-char hex string (32 bytes). */
+    s: string;
+    serializedTx?: string;
 }
-interface BtcSignedTx {
-    serializedTx: string;
-    /** Present when the wallet returns per-input sigs separately (e.g. Trezor). */
-    signatures?: string[];
-    txid?: string;
+interface EvmSignMsgParams extends PassphraseStateAware {
+    path: string;
+    message: string;
+    chainId?: number;
+    hex?: boolean;
+    ethereumDefinitions?: EvmEthereumDefinitions;
 }
-interface BtcSignPsbtParams extends PassphraseStateAware {
-    psbt: string;
+type EvmSignTypedDataParams = EvmSignTypedDataFull | EvmSignTypedDataHash;
+interface EvmSignTypedDataFull extends PassphraseStateAware {
+    path: string;
+    chainId?: number;
+    /** Defaults to `'full'` when omitted. */
+    mode?: 'full';
+    ethereumDefinitions?: EvmEthereumDefinitions;
+    data: {
+        domain: EIP712Domain;
+        types: Record<string, Array<{
+            name: string;
+            type: string;
+        }>>;
+        primaryType: string;
+        message: Record<string, unknown>;
+    };
+    /**
+     * The dApp's original EIP-712 JSON, byte for byte. Serializing vendors (Keystone) must prefer it:
+     * re-stringifying `data` rewrites integers wider than 2^53 and exponent forms.
+     */
+    dataJson?: string;
+    metamaskV4Compat?: boolean;
+    showMessageHash?: boolean;
+    /**
+     * Optional host-computed hashes. Core Trezor models still use full typed-data
+     * signing for display, while Trezor One can fall back to typed-hash signing
+     * when firmware cannot compute the hashes itself.
+     */
+    domainSeparatorHash?: string;
+    messageHash?: string;
+}
+interface EvmSignTypedDataHash extends PassphraseStateAware {
+    path: string;
+    chainId?: number;
+    mode: 'hash';
+    domainSeparatorHash: string;
+    messageHash: string;
+    ethereumDefinitions?: EvmEthereumDefinitions;
+}
+interface EIP712Domain {
+    name?: string;
+    version?: string;
+    chainId?: number;
+    verifyingContract?: string;
+    salt?: string;
+    [key: string]: unknown;
+}
+interface EvmSignature {
+    /** `0x`-prefixed hex string (r + s + v). */
+    signature: string;
+    address?: string;
+}
+interface IEvmMethods {
+    evmGetAddress(connectId?: NullableCallArg<string>, deviceId?: NullableCallArg<string>, params?: NullableCallArg<IHardwareCallParams<EvmGetAddressParams>>): Promise<Response<EvmAddress>>;
+    evmSignTransaction(connectId?: NullableCallArg<string>, deviceId?: NullableCallArg<string>, params?: NullableCallArg<IHardwareCallParams<EvmSignTxParams>>): Promise<Response<EvmSignedTx>>;
+    evmSignMessage(connectId?: NullableCallArg<string>, deviceId?: NullableCallArg<string>, params?: NullableCallArg<IHardwareCallParams<EvmSignMsgParams>>): Promise<Response<EvmSignature>>;
+    evmSignTypedData(connectId?: NullableCallArg<string>, deviceId?: NullableCallArg<string>, params?: NullableCallArg<IHardwareCallParams<EvmSignTypedDataParams>>): Promise<Response<EvmSignature>>;
+}
+
+interface BtcGetAddressParams extends PassphraseStateAware {
+    path: string;
+    coin?: string;
+    showOnDevice?: boolean;
+    /**
+     * Trezor only. Ledger and Keystone ignore it and derive the script of the path's purpose
+     * (44' P2PKH, 49' P2SH-P2WPKH, 84' P2WPKH, 86' P2TR; Keystone does not support 86' yet).
+     */
+    scriptType?: 'p2pkh' | 'p2sh' | 'p2wpkh' | 'p2wsh' | 'p2tr';
+    addressIndex?: number;
+    change?: boolean;
+}
+interface BtcAddress {
+    address: string;
+    path: string;
+    /** Set by air-gapped wallets (Keystone): the exported key this address derives from. */
+    accountKey?: ExportedAccountKey;
+}
+interface BtcGetPublicKeyParams extends PassphraseStateAware {
+    path: string;
+    coin?: string;
+    showOnDevice?: boolean;
+}
+interface BtcPublicKey {
+    xpub: string;
+    publicKey: string;
+    /** Parent key fingerprint (BIP-32), not the master fingerprint. */
+    fingerprint: number;
+    chainCode: string;
+    path: string;
+    depth: number;
+    /** Set by air-gapped wallets (Keystone): the exported key, for pinning by the host. */
+    accountKey?: ExportedAccountKey;
+}
+interface BtcSignTxParams extends PassphraseStateAware {
+    psbt?: string;
+    inputs?: BtcTxInput[];
+    outputs?: BtcTxOutput[];
+    paymentRequests?: BtcPaymentRequest[];
+    refTxs?: BtcRefTransaction[];
+    coin: string;
+    locktime?: number;
+    version?: number;
+    timestamp?: number;
+    expiry?: number;
+    versionGroupId?: number;
+    branchId?: number;
+    /** Account-level derivation path (e.g. "84'/0'/0'") for wallet template. */
+    path?: string;
+}
+interface BtcTxInput {
+    path: string;
+    prevHash: string;
+    prevIndex: number;
+    amount: string;
+    scriptType?: 'p2pkh' | 'p2sh' | 'p2wpkh' | 'p2wsh' | 'p2tr';
+    sequence?: number;
+    origHash?: string;
+    origIndex?: number;
+    scriptSig?: string;
+    witness?: string;
+    ownershipProof?: string;
+    commitmentData?: string;
+}
+interface BtcTxOutput {
+    address?: string;
+    path?: string;
+    opReturnData?: string;
+    amount: string;
+    scriptType?: 'p2pkh' | 'p2sh' | 'p2wpkh' | 'p2wsh' | 'p2tr';
+    paymentReqIndex?: number;
+    origHash?: string;
+    origIndex?: number;
+}
+interface BtcPaymentRequestMemo {
+    textMemo?: {
+        text: string;
+    };
+    textDetailsMemo?: {
+        title: string;
+        text: string;
+    };
+    refundMemo?: {
+        address: string;
+        addressN?: number[];
+        mac: string;
+    };
+    coinPurchaseMemo?: {
+        coinType: number;
+        amount: string;
+        address: string;
+        addressN?: number[];
+        mac: string;
+    };
+}
+interface BtcPaymentRequest {
+    nonce?: string;
+    recipientName: string;
+    memos?: BtcPaymentRequestMemo[];
+    /** Decimal string in satoshis/subunits; SDK encodes it as SLIP-24 uint64 LE hex. */
+    amount?: string;
+    signature: string;
+}
+interface BtcRefTransaction {
+    hash: string;
+    version: number;
+    inputs: Array<{
+        prevHash: string;
+        prevIndex: number;
+        script: string;
+        sequence: number;
+    }>;
+    outputs: Array<{
+        amount: string;
+        scriptPubKey: string;
+    }>;
+    locktime: number;
+    /** Original transaction inputs used by Trezor RBF verification (TXORIGINPUT). */
+    origInputs?: BtcTxInput[];
+    /** Original transaction outputs used by Trezor RBF verification (TXORIGOUTPUT). */
+    origOutputs?: BtcTxOutput[];
+    extraData?: string;
+    timestamp?: number;
+    expiry?: number;
+    versionGroupId?: number;
+    branchId?: number;
+}
+interface BtcSignedTx {
+    serializedTx: string;
+    /** Present when the wallet returns per-input sigs separately (e.g. Trezor). */
+    signatures?: string[];
+    txid?: string;
+}
+interface BtcSignPsbtParams extends PassphraseStateAware {
+    psbt: string;
     coin?: string;
     /** Account-level derivation path (e.g. "84'/0'/0'") for wallet template. */
     path?: string;
@@ -561,6 +743,8 @@ interface SolAddress {
     /** Base58-encoded Solana address — this is also the Ed25519 public key. */
     address: string;
     path: string;
+    /** Set by air-gapped wallets (Keystone): the exported key this address derives from. */
+    accountKey?: ExportedAccountKey;
 }
 interface SolSignTxParams extends PassphraseStateAware {
     path: string;
@@ -581,11 +765,21 @@ interface SolSignedTx {
     /** Hex-encoded Ed25519 signature (no 0x prefix) */
     signature: string;
 }
-interface SolSignMsgParams extends PassphraseStateAware {
+interface SolSignMessageBaseParams extends PassphraseStateAware {
     path: string;
     /** Message bytes as hex string (no 0x prefix) */
     message: string;
 }
+interface SolOffchainMessageV1Params {
+    /** Finalized Solana off-chain message format. */
+    messageVersion: 1;
+    /** Complete signer set as 32-byte hex public keys. */
+    requiredSigners: string[];
+}
+type SolSignMsgParams = SolSignMessageBaseParams & ({
+    messageVersion?: undefined;
+    requiredSigners?: undefined;
+} | SolOffchainMessageV1Params);
 interface SolSignature {
     /** Hex-encoded Ed25519 signature (no 0x prefix) */
     signature: string;
@@ -604,6 +798,8 @@ interface TronAddress {
     /** Base58check-encoded TRON address (starts with 'T') */
     address: string;
     path: string;
+    /** Set by air-gapped wallets (Keystone): the exported key this address derives from. */
+    accountKey?: ExportedAccountKey;
 }
 /** TRON network resource, used by freeze/unfreeze contracts. */
 type TronResource = 'BANDWIDTH' | 'ENERGY';
@@ -712,6 +908,12 @@ interface TronSignMsgParams extends PassphraseStateAware {
     path: string;
     /** Message hex (no 0x prefix) */
     messageHex: string;
+    /**
+     * TRON message scheme: 'V1' = legacy signMessage (prefix + 32-byte hash),
+     * 'V2' = TIP-191 signMessageV2 (prefix + byte length + message). Adapters
+     * that only implement one scheme reject the other with MethodNotSupported.
+     */
+    messageType?: 'V1' | 'V2';
 }
 interface TronSignature {
     /** 65-byte hex-encoded signature (no 0x prefix) */
@@ -723,100 +925,167 @@ interface ITronMethods {
     tronSignMessage(connectId?: NullableCallArg<string>, deviceId?: NullableCallArg<string>, params?: NullableCallArg<IHardwareCallParams<TronSignMsgParams>>): Promise<Response<TronSignature>>;
 }
 
-/**
- * Fixed derivation paths used to generate chain fingerprints.
- * Uses standard index 0 — Ledger firmware shows device confirmation for
- * non-standard paths (e.g., index=100), which would interrupt wallet creation.
- * The address is hashed into a 16-char fingerprint, not exposed directly.
- * - EVM: cointype 60 (Ledger ETH App only supports 60)
- * - BTC: cointype 1 (testnet)
- * - SOL: cointype 501, standard 3-level hardened
- */
-declare const CHAIN_FINGERPRINT_PATHS: Record<ChainForFingerprint, string>;
-type ChainForFingerprint = 'evm' | 'btc' | 'sol' | 'tron';
-/**
- * 16-char SHA-256 fingerprint for device-identity verification.
- * Callers must canonicalize input (e.g. EVM address → lowercase) —
- * encoding variations otherwise cause false DeviceMismatch.
- */
-declare function deriveDeviceFingerprint(value: string): string;
-
 /** Events generated by SDK internal detection (not from hardware directly). */
 declare const SDK: {
     readonly DEVICE_STUCK: "device-stuck";
     readonly DEVICE_UNRESPONSIVE: "device-unresponsive";
     readonly DEVICE_RECOVERED: "device-recovered";
     readonly DEVICE_INTERACTION: "device-interaction";
+    readonly OPERATION_ENDED: "operation-ended";
+};
+
+declare const OPERATION_DEFAULT_TTL_MS = 600000;
+type OperationEndReason = 'explicit' | 'disconnect' | 'timeout' | 'runtime-reset';
+type HardwareOperation = {
+    operationId: string;
+    connectId: string;
+    device: DeviceInfo;
+    /**
+     * The channel this operation runs on, set by the adapter that picked it. Never read it off
+     * `device`: a combined connector fills that snapshot with a nominal value.
+     */
+    connectionType: ConnectionType;
+    connectionKeys: string[];
+};
+type OperationRegistryOptions = {
+    vendor: VendorType;
+    ttlMs?: number;
+    onEnded?: (operation: HardwareOperation, reason: OperationEndReason) => void;
 };
+/** Runtime-only association between a public operation id and one live target. */
+declare class OperationRegistry {
+    private readonly _vendor;
+    private readonly _ttlMs;
+    private readonly _onEnded?;
+    private readonly _active;
+    private readonly _ended;
+    constructor(options: OperationRegistryOptions);
+    create(params: {
+        searchTargetId: string;
+        connectId: string;
+        device: DeviceInfo;
+        connectionType: ConnectionType;
+        connectionKeys?: string[];
+    }): HardwareOperation;
+    resolve(operationId: string): HardwareOperation;
+    /** Keep an operation alive while one device job is actively using it. */
+    retain(operationId: string): () => void;
+    /** Return a live operation without refreshing its TTL; ended and unknown ids give undefined. */
+    findActive(operationId: string): HardwareOperation | undefined;
+    /** Return active or tombstoned binding data without refreshing its TTL. */
+    find(operationId: string): HardwareOperation | undefined;
+    findActiveByConnectionKey(connectionKey: string): HardwareOperation | undefined;
+    /** Only an explicitly supplied operation job key owns the call's UI requests. */
+    findOperationIdByJobKey(jobKey: string | undefined): string | undefined;
+    /**
+     * End an operation on the caller's explicit release. Throws for an unknown id; returns undefined
+     * when it had already ended.
+     */
+    release(operationId: string): HardwareOperation | undefined;
+    end(operationId: string, reason: OperationEndReason): HardwareOperation | undefined;
+    endByConnectionKey(connectionKey: string, reason: OperationEndReason, exceptOperationId?: string): void;
+    endAll(reason: OperationEndReason, exceptOperationId?: string): void;
+    private _touch;
+    private _createTimer;
+    private _rememberEnded;
+}
 
 type HardwareMethodMetadata = {
     chain: ChainForFingerprint;
     allNetwork: boolean;
+    /** Whether repeating the method after an ambiguous transport failure is safe. */
+    replayAfterTransportFailure: 'safe' | 'unsafe';
 };
 declare const HARDWARE_METHOD_CATALOG: {
     readonly evmGetAddress: {
         readonly chain: "evm";
         readonly allNetwork: true;
+        readonly replayAfterTransportFailure: "safe";
     };
     readonly evmSignTransaction: {
         readonly chain: "evm";
         readonly allNetwork: false;
+        readonly replayAfterTransportFailure: "unsafe";
     };
     readonly evmSignMessage: {
         readonly chain: "evm";
         readonly allNetwork: false;
+        readonly replayAfterTransportFailure: "unsafe";
     };
     readonly evmSignTypedData: {
         readonly chain: "evm";
         readonly allNetwork: false;
+        readonly replayAfterTransportFailure: "unsafe";
     };
     readonly btcGetAddress: {
         readonly chain: "btc";
         readonly allNetwork: true;
+        readonly replayAfterTransportFailure: "safe";
     };
     readonly btcGetPublicKey: {
         readonly chain: "btc";
         readonly allNetwork: true;
+        readonly replayAfterTransportFailure: "safe";
     };
     readonly btcSignTransaction: {
         readonly chain: "btc";
         readonly allNetwork: false;
+        readonly replayAfterTransportFailure: "unsafe";
     };
     readonly btcSignPsbt: {
         readonly chain: "btc";
         readonly allNetwork: false;
+        readonly replayAfterTransportFailure: "unsafe";
     };
     readonly btcSignMessage: {
         readonly chain: "btc";
         readonly allNetwork: false;
+        readonly replayAfterTransportFailure: "unsafe";
     };
     readonly btcGetMasterFingerprint: {
         readonly chain: "btc";
         readonly allNetwork: false;
+        readonly replayAfterTransportFailure: "safe";
     };
     readonly solGetAddress: {
         readonly chain: "sol";
         readonly allNetwork: true;
+        readonly replayAfterTransportFailure: "safe";
     };
     readonly solSignTransaction: {
         readonly chain: "sol";
         readonly allNetwork: false;
+        readonly replayAfterTransportFailure: "unsafe";
     };
     readonly solSignMessage: {
         readonly chain: "sol";
         readonly allNetwork: false;
+        readonly replayAfterTransportFailure: "unsafe";
     };
     readonly tronGetAddress: {
         readonly chain: "tron";
         readonly allNetwork: true;
+        readonly replayAfterTransportFailure: "safe";
     };
     readonly tronSignTransaction: {
         readonly chain: "tron";
         readonly allNetwork: false;
+        readonly replayAfterTransportFailure: "unsafe";
     };
     readonly tronSignMessage: {
         readonly chain: "tron";
         readonly allNetwork: false;
+        readonly replayAfterTransportFailure: "unsafe";
+    };
+    readonly zcashGetFullViewingKey: {
+        readonly chain: "zcash";
+        readonly allNetwork: false;
+        readonly replayAfterTransportFailure: "safe";
+    };
+    readonly zcashGetShieldedAddress: {
+        readonly chain: "zcash";
+        readonly allNetwork: false;
+        readonly replayAfterTransportFailure: "safe";
     };
 };
 type HardwareMethodName = keyof typeof HARDWARE_METHOD_CATALOG;
@@ -825,6 +1094,11 @@ type AllNetworkMethodName = {
 }[HardwareMethodName];
 declare const ALL_NETWORK_METHOD_NAMES: AllNetworkMethodName[];
 declare function getHardwareMethodMetadata(method: string): HardwareMethodMetadata | undefined;
+/**
+ * Conservative replay gate used only after a call may have reached hardware.
+ * Unknown methods and device mutations are unsafe by default.
+ */
+declare function canReplayHardwareMethodAfterTransportFailure(method: string): boolean;
 declare function isAllNetworkMethodName(method: string): method is AllNetworkMethodName;
 declare function getAllNetworkMethodChain(method: AllNetworkMethodName): ChainForFingerprint;
 
@@ -837,13 +1111,14 @@ type HardwareUiEvent = Exclude<ConnectorUiEvent, {
     type: EConnectorInteraction.AppInstallProgress;
 }> | {
     type: EConnectorInteraction.AppInstallProgress;
+    operationId?: string;
     payload: {
         connectId: string;
         appName: string;
         progress: number;
     };
 };
-type ChainCapability = 'evm' | 'btc' | 'sol' | 'tron';
+type ChainCapability = 'evm' | 'btc' | 'sol' | 'tron' | 'zcash';
 type TrezorDisplayRotation = 'North' | 'East' | 'South' | 'West';
 type TrezorSafetyCheckLevel = 'Strict' | 'PromptAlways' | 'PromptTemporarily';
 type TrezorDeviceSettingsParams = {
@@ -914,19 +1189,83 @@ type DeviceAuthenticityResult = {
         };
     };
 };
+/** Persisted connection hints, never proof of device or wallet identity. */
+type KnownDeviceConnection = {
+    transport: 'usb' | 'ble';
+    connectId: string;
+} | {
+    transport: 'qr';
+};
+/** Opaque host lookup identifiers. Never forward these to firmware or logs. */
+type HardwareCallExtra = Readonly<Record<string, string>>;
+interface IHardwareConnectionContext {
+    knownConnections?: readonly KnownDeviceConnection[];
+    extra?: HardwareCallExtra;
+    /** False makes discovery fail instead of asking the user to select a new endpoint. */
+    allowDeviceSelection?: boolean;
+    /** Transports the host's model table allows; discovery never opens others. Omitted = any. */
+    supportedTransports?: readonly ('usb' | 'ble')[];
+}
+type DeviceSelectionContext = {
+    kind: 'select-device';
+    transport: 'usb';
+    reason: 'multiple-candidates';
+} | {
+    kind: 'bind-connection';
+    transport: 'ble';
+    reason: 'missing-binding' | 'known-connection-unavailable' | 'manual-rebind';
+};
+interface DeviceSelectionRequest extends UiRequestOperationAttribution {
+    devices: DeviceInfo[];
+    /** Echo this in the `RECEIVE_SELECT_DEVICE` answer; an answer without it is ignored. */
+    requestId: string;
+    context: DeviceSelectionContext;
+    extra?: HardwareCallExtra;
+    /** Repeated snapshots with this requestId update one SDK-owned binding scan. */
+    scanning?: boolean;
+    bindingSessionId?: string;
+    /** A candidate rejected by SDK identity verification in this binding session. */
+    rejectedConnectId?: string;
+}
+/** The host must persist this endpoint before acknowledging. */
+interface SaveDeviceBindingRequest extends UiRequestOperationAttribution {
+    requestId: string;
+    selectionRequestId: string;
+    connection: {
+        transport: 'ble';
+        connectId: string;
+    };
+    /** Omitted when the vendor binds the selected BLE endpoint without checking its wallet (Ledger). */
+    identity?: Extract<WalletIdentity, {
+        vendor: 'ledger' | 'trezor';
+    }>;
+    extra?: HardwareCallExtra;
+}
+type BindBleDeviceParams = Pick<SaveDeviceBindingRequest, 'identity' | 'extra'> & {
+    /** Ledger: other recorded chains, tried in order only when the previous chain's app is missing. */
+    fallbackIdentities?: Extract<WalletIdentity, {
+        vendor: 'ledger';
+    }>[];
+};
+interface DeviceBindingStatus {
+    selectionRequestId: string;
+    status: 'verifying' | 'saved' | 'failed' | 'cancelled';
+}
 /**
  * Cross-chain / cross-vendor options passed alongside any chain method's
  * own params (the optional last argument). Holds operation-level switches
  * that aren't specific to one chain. Vendor-specific options can be added
  * as typed sub-fields here when a vendor actually needs them.
  */
-interface ICommonCallParams {
+interface ICommonCallParams extends IHardwareConnectionContext {
     /**
      * When the required device app is missing, prompt the user (UI request)
      * to install it, stream install progress, then retry the operation once.
      * Off by default — preserves the plain "app not installed" failure.
      */
     autoInstallApp?: boolean;
+    /** Runtime-only id from connectDevice(); when present, discovery and fallback are disabled. */
+    operationId?: string;
 }
 type NullableCallArg<T> = T | null | undefined;
 interface IPassphraseCallParams {
@@ -935,6 +1274,14 @@ interface IPassphraseCallParams {
 }
 type IHardwareCommonCallParams = ICommonCallParams & IPassphraseCallParams;
 type IHardwareCallParams<T> = T & IHardwareCommonCallParams;
+/**
+ * Runtime-only device-manager context, never forwarded to firmware. The expected identity lets an
+ * adapter fail closed before replaying a read or mutation after a reconnect.
+ */
+interface IDeviceManagerOperationContext extends IHardwareConnectionContext {
+    operationId?: string;
+    expectedDeviceIdentity?: WalletIdentity;
+}
 interface AllNetworkAddressParams {
     network: string;
     path: string;
@@ -945,23 +1292,17 @@ interface AllNetworkAddressParams {
 interface AllNetworkGetAddressParams extends IHardwareCommonCallParams {
     bundle: AllNetworkAddressParams[];
 }
-type AllNetworkDeviceIdentity = {
-    vendor: 'ledger';
-    type: 'chainFingerprint';
-    chain: ChainForFingerprint;
-    value: string;
-} | {
-    vendor: 'trezor';
-    type: 'deviceId';
-    value: string;
-};
+type AllNetworkDeviceIdentity = WalletIdentity;
 type AllNetworkAddressResponsePayload = Record<string, unknown> & {
+    /** This account came from the user's explicit device-export scan. */
+    accountExport?: boolean;
     error?: string;
     code?: HardwareErrorCode | number;
     errorCode?: string | number;
     connectId?: string;
     deviceId?: string;
     deviceIdentity?: AllNetworkDeviceIdentity;
+    rootFingerprint?: number;
     chainFingerprint?: string;
     chainFingerprintChain?: ChainForFingerprint;
     params?: Record<string, unknown>;
@@ -1002,6 +1343,7 @@ type DeviceEvent = {
         connectId: string;
         deviceId?: string;
         credentials: Record<string, unknown>[];
+        removed?: Record<string, unknown>[];
     };
 };
 type UiRequestEvent = {
@@ -1010,46 +1352,50 @@ type UiRequestEvent = {
         device?: DeviceInfo;
         connectId?: string;
         type?: string;
-    };
+    } & UiRequestOperationAttribution;
 } | {
     type: typeof UI_REQUEST.REQUEST_PASSPHRASE;
     payload: {
         device: DeviceInfo;
-    };
+    } & UiRequestOperationAttribution;
 } | {
     type: typeof UI_REQUEST.REQUEST_PASSPHRASE_ON_DEVICE;
     payload: {
         device: DeviceInfo;
-    };
+    } & UiRequestOperationAttribution;
 } | {
     type: typeof UI_REQUEST.REQUEST_BUTTON;
     payload: {
         device: DeviceInfo;
         code?: string;
-    };
+    } & UiRequestOperationAttribution;
 } | {
     type: typeof UI_REQUEST.REQUEST_QR_DISPLAY;
     payload: {
         device: DeviceInfo;
         data: QrDisplayData;
-    };
+    } & UiRequestOperationAttribution;
 } | {
     type: typeof UI_REQUEST.REQUEST_QR_SCAN;
     payload: {
         device: DeviceInfo;
-    };
+    } & UiRequestOperationAttribution;
 } | {
     type: typeof UI_REQUEST.REQUEST_DEVICE_PERMISSION;
     payload: {
         transportType: TransportType;
         connectId?: string;
         deviceId?: string;
-    };
+    } & UiRequestOperationAttribution;
 } | {
     type: typeof UI_REQUEST.REQUEST_SELECT_DEVICE;
-    payload: {
-        devices: DeviceInfo[];
-    };
+    payload: DeviceSelectionRequest;
+} | {
+    type: typeof UI_REQUEST.REQUEST_SAVE_DEVICE_BINDING;
+    payload: SaveDeviceBindingRequest;
+} | {
+    type: typeof UI_REQUEST.DEVICE_BINDING_STATUS;
+    payload: DeviceBindingStatus;
 } | {
     type: typeof UI_REQUEST.REQUEST_DEVICE_CONNECT;
     payload: {
@@ -1069,13 +1415,19 @@ type UiRequestEvent = {
          * isn't recognized.
          */
         message: string;
-    };
+    } & UiRequestOperationAttribution;
 } | {
     type: typeof UI_REQUEST.REQUEST_INSTALL_APP;
     payload: {
         vendor: string;
         appName: string;
-    };
+    } & UiRequestOperationAttribution;
+} | {
+    type: typeof UI_REQUEST.REQUEST_QR_FALLBACK_CONFIRM;
+    payload: {
+        vendor: string;
+        requestId: string;
+    } & UiRequestOperationAttribution;
 } | {
     type: typeof UI_REQUEST.REQUEST_TREZOR_THP_PAIRING;
     payload: {
@@ -1083,10 +1435,10 @@ type UiRequestEvent = {
         availableMethods: number[];
         selectedMethod: number;
         nfcData?: string;
-    };
+    } & UiRequestOperationAttribution;
 } | {
     type: typeof UI_REQUEST.CLOSE_UI_WINDOW;
-    payload: Record<string, never>;
+    payload: UiRequestOperationAttribution;
 };
 type SdkEvent = {
     type: typeof SDK.DEVICE_INTERACTION;
@@ -1109,6 +1461,12 @@ type SdkEvent = {
     payload: {
         connectId: string;
     };
+} | {
+    type: typeof SDK.OPERATION_ENDED;
+    payload: {
+        operationId: string;
+        reason: OperationEndReason;
+    };
 };
 type HardwareEvent = DeviceEvent | UiRequestEvent | SdkEvent | HardwareUiEvent;
 type DeviceEventListener = (event: HardwareEvent) => void;
@@ -1119,6 +1477,14 @@ type DeviceEventListener = (event: HardwareEvent) => void;
  * and the value is the narrowed event object the listener will receive.
  */
 interface HardwareEventMap {
+    [UI_REQUEST.DEVICE_BINDING_STATUS]: {
+        type: typeof UI_REQUEST.DEVICE_BINDING_STATUS;
+        payload: DeviceBindingStatus;
+    };
+    [UI_REQUEST.REQUEST_SAVE_DEVICE_BINDING]: {
+        type: typeof UI_REQUEST.REQUEST_SAVE_DEVICE_BINDING;
+        payload: SaveDeviceBindingRequest;
+    };
     'ui-event': HardwareUiEvent;
     [DEVICE.CONNECT]: {
         type: typeof DEVICE.CONNECT;
@@ -1151,6 +1517,8 @@ interface HardwareEventMap {
             connectId: string;
             deviceId?: string;
             credentials: Record<string, unknown>[];
+            /** Credentials the device rejected; a list kept for several devices drops these. */
+            removed?: Record<string, unknown>[];
         };
     };
     [UI_REQUEST.REQUEST_PIN]: {
@@ -1159,7 +1527,7 @@ interface HardwareEventMap {
             device?: DeviceInfo;
             connectId?: string;
             type?: string;
-        };
+        } & UiRequestOperationAttribution;
     };
     [UI_REQUEST.REQUEST_PASSPHRASE]: {
         type: typeof UI_REQUEST.REQUEST_PASSPHRASE;
@@ -1168,33 +1536,33 @@ interface HardwareEventMap {
             connectId?: string;
             passphraseState?: string;
             useEmptyPassphrase?: boolean;
-        };
+        } & UiRequestOperationAttribution;
     };
     [UI_REQUEST.REQUEST_PASSPHRASE_ON_DEVICE]: {
         type: typeof UI_REQUEST.REQUEST_PASSPHRASE_ON_DEVICE;
         payload: {
             device: DeviceInfo;
-        };
+        } & UiRequestOperationAttribution;
     };
     [UI_REQUEST.REQUEST_BUTTON]: {
         type: typeof UI_REQUEST.REQUEST_BUTTON;
         payload: {
             device: DeviceInfo;
             code?: string;
-        };
+        } & UiRequestOperationAttribution;
     };
     [UI_REQUEST.REQUEST_QR_DISPLAY]: {
         type: typeof UI_REQUEST.REQUEST_QR_DISPLAY;
         payload: {
             device: DeviceInfo;
             data: QrDisplayData;
-        };
+        } & UiRequestOperationAttribution;
     };
     [UI_REQUEST.REQUEST_QR_SCAN]: {
         type: typeof UI_REQUEST.REQUEST_QR_SCAN;
         payload: {
             device: DeviceInfo;
-        };
+        } & UiRequestOperationAttribution;
     };
     [UI_REQUEST.REQUEST_DEVICE_PERMISSION]: {
         type: typeof UI_REQUEST.REQUEST_DEVICE_PERMISSION;
@@ -1202,13 +1570,11 @@ interface HardwareEventMap {
             transportType: TransportType;
             connectId?: string;
             deviceId?: string;
-        };
+        } & UiRequestOperationAttribution;
     };
     [UI_REQUEST.REQUEST_SELECT_DEVICE]: {
         type: typeof UI_REQUEST.REQUEST_SELECT_DEVICE;
-        payload: {
-            devices: DeviceInfo[];
-        };
+        payload: DeviceSelectionRequest;
     };
     [UI_REQUEST.REQUEST_DEVICE_CONNECT]: {
         type: typeof UI_REQUEST.REQUEST_DEVICE_CONNECT;
@@ -1216,7 +1582,7 @@ interface HardwareEventMap {
             vendor: string;
             reason: string;
             message: string;
-        };
+        } & UiRequestOperationAttribution;
     };
     [UI_REQUEST.REQUEST_BTC_HIGH_INDEX_CONFIRM]: {
         type: typeof UI_REQUEST.REQUEST_BTC_HIGH_INDEX_CONFIRM;
@@ -1224,14 +1590,21 @@ interface HardwareEventMap {
             vendor: string;
             path: string;
             accountIndex: number;
-        };
+        } & UiRequestOperationAttribution;
     };
     [UI_REQUEST.REQUEST_INSTALL_APP]: {
         type: typeof UI_REQUEST.REQUEST_INSTALL_APP;
         payload: {
             vendor: string;
             appName: string;
-        };
+        } & UiRequestOperationAttribution;
+    };
+    [UI_REQUEST.REQUEST_QR_FALLBACK_CONFIRM]: {
+        type: typeof UI_REQUEST.REQUEST_QR_FALLBACK_CONFIRM;
+        payload: {
+            vendor: string;
+            requestId: string;
+        } & UiRequestOperationAttribution;
     };
     [UI_REQUEST.REQUEST_TREZOR_THP_PAIRING]: {
         type: typeof UI_REQUEST.REQUEST_TREZOR_THP_PAIRING;
@@ -1240,11 +1613,11 @@ interface HardwareEventMap {
             availableMethods: number[];
             selectedMethod: number;
             nfcData?: string;
-        };
+        } & UiRequestOperationAttribution;
     };
     [UI_REQUEST.CLOSE_UI_WINDOW]: {
         type: typeof UI_REQUEST.CLOSE_UI_WINDOW;
-        payload: Record<string, never>;
+        payload: UiRequestOperationAttribution;
     };
     [SDK.DEVICE_INTERACTION]: {
         type: typeof SDK.DEVICE_INTERACTION;
@@ -1271,16 +1644,23 @@ interface HardwareEventMap {
             connectId: string;
         };
     };
+    [SDK.OPERATION_ENDED]: {
+        type: typeof SDK.OPERATION_ENDED;
+        payload: {
+            operationId: string;
+            reason: OperationEndReason;
+        };
+    };
 }
 interface IDeviceManagerMethods {
-    getFeatures?(connectId: string): Promise<Response<Record<string, unknown>>>;
-    deviceSettings?(connectId: string, params: TrezorDeviceSettingsParams): Promise<Response<Record<string, unknown>>>;
-    setBrightness?(connectId: string, params?: TrezorBrightnessParams): Promise<Response<Record<string, unknown>>>;
-    changePin?(connectId: string, params?: TrezorChangePinParams): Promise<Response<Record<string, unknown>>>;
-    wipeDevice?(connectId: string): Promise<Response<Record<string, unknown>>>;
+    getFeatures?(connectId: string, operationContext?: IDeviceManagerOperationContext): Promise<Response<Record<string, unknown>>>;
+    deviceSettings?(connectId: string, params: TrezorDeviceSettingsParams, operationContext?: IDeviceManagerOperationContext): Promise<Response<Record<string, unknown>>>;
+    setBrightness?(connectId: string, params?: TrezorBrightnessParams, operationContext?: IDeviceManagerOperationContext): Promise<Response<Record<string, unknown>>>;
+    changePin?(connectId: string, params?: TrezorChangePinParams, operationContext?: IDeviceManagerOperationContext): Promise<Response<Record<string, unknown>>>;
+    wipeDevice?(connectId: string, operationContext?: IDeviceManagerOperationContext): Promise<Response<Record<string, unknown>>>;
     authenticateDevice?(connectId: string, params: {
         challenge: string;
-    }): Promise<Response<Record<string, unknown>>>;
+    }, operationContext?: IDeviceManagerOperationContext): Promise<Response<Record<string, unknown>>>;
 }
 interface IWalletStateMethods {
     /**
@@ -1307,20 +1687,35 @@ interface IWalletStateMethods {
      * Optional: vendors without host-managed passphrase sessions (Ledger) omit
      * it. Implemented by `TrezorAdapter`.
      */
-    getPassphraseState?(connectId: string, passphraseState?: string): Promise<Response<string | null>>;
+    getPassphraseState?(connectId: string, passphraseState?: string, operationContext?: IDeviceManagerOperationContext): Promise<Response<string | null>>;
 }
+/**
+ * `stops-waiting`: an on-device confirmation stays up until answered or timed out.
+ * `interrupts-device`: the command on the wire is withdrawn. No vendor reports it, so hosts
+ * should say "stopped waiting, answer on the device", not "cancelled".
+ */
+type CancelCapability = 'interrupts-device' | 'stops-waiting';
 interface IHardwareWallet<TConfig = unknown> extends IEvmMethods, IBtcMethods, ISolMethods, ITronMethods, IDeviceManagerMethods, IWalletStateMethods {
     readonly vendor: string;
     readonly activeTransport: TransportType | null;
+    /** What `cancel()` reaches on this vendor. Declared, never inferred. */
+    readonly cancelCapability: CancelCapability;
     init(config: TConfig): Promise<void>;
     dispose(): Promise<void>;
     getAvailableTransports(): TransportType[];
     switchTransport(type: TransportType): Promise<void>;
     searchDevices(options?: SearchDevicesOptions): Promise<DeviceInfo[]>;
-    connectDevice(connectId: string): Promise<Response<string>>;
-    disconnectDevice(connectId: string): Promise<void>;
+    /** Discover selectable hardware entries without claiming identified devices or wallets. */
+    searchDeviceTargets(options?: SearchDevicesOptions): Promise<DeviceSearchTarget[]>;
+    /** Connect or logically bind a selected search result and return a runtime-only operation id. */
+    connectDevice(searchTargetId: string): Promise<Response<string>>;
+    /** Device Manager rebind: verify the existing identity before replacing its BLE locator. */
+    bindBleDevice?(params: BindBleDeviceParams): Promise<Response<string>>;
+    /** Resolve and pin operation routing; the caller verifies wallet identity before business calls. */
+    acquireOperation?(connectId: string, context: IHardwareConnectionContext): Promise<Response<string>>;
+    /** Release a caller-owned operation. Disconnect events end matching operations automatically. */
+    releaseOperation(operationId: string): Promise<void>;
     getDeviceInfo(connectId: string, deviceId: string): Promise<Response<DeviceInfo>>;
-    getSupportedChains(): ChainCapability[];
     /** Abort the in-flight call. Omit connectId to cancel whatever is active. */
     cancel(connectId?: string): void;
     allNetworkGetAddress(connectId: string, deviceId: string, params: AllNetworkGetAddressParams): Promise<Response<AllNetworkAddressResponse[]>>;
@@ -1357,165 +1752,132 @@ interface SearchDevicesOptions {
      * was discovered first.
      */
     waitForAllTransports?: boolean;
+    /**
+     * Restrict discovery to one transport. A virtual target (Keystone QR) must not start any wallet
+     * interaction during discovery; `connectDevice()` resolves it.
+     */
+    transportType?: ConnectionType;
 }
 
-interface EvmGetAddressParams extends PassphraseStateAware {
-    path: string;
-    showOnDevice?: boolean;
-    chainId?: number;
-    ethereumDefinitions?: EvmEthereumDefinitions;
-}
-interface EvmAddress {
-    address: string;
-    path: string;
-    /** Device-reported secp256k1 public key; populated when the transport exposes it. */
-    publicKey?: string;
-}
-interface EvmSignTxBaseParams extends PassphraseStateAware {
-    path: string;
-    chainId?: number;
-}
-/** Ledger shape: the whole RLP-serialized tx (0x-prefixed or plain hex); structured fields forbidden. */
-interface EvmSignTxLedgerParams extends EvmSignTxBaseParams {
-    serializedTx: string;
-    to?: never;
-    value?: never;
-    nonce?: never;
-    gasLimit?: never;
-    gasPrice?: never;
-    txType?: never;
-    maxFeePerGas?: never;
-    maxPriorityFeePerGas?: never;
-    accessList?: never;
-    data?: never;
-    paymentRequest?: never;
-    ethereumDefinitions?: never;
-}
-/** Trezor shape: structured EthereumSignTx protobuf fields; serializedTx forbidden. */
-interface EvmSignTxTrezorParams extends EvmSignTxBaseParams {
-    serializedTx?: never;
-    /** Contract address or recipient. Optional for contract deployment transactions. */
-    to?: string;
-    value?: string;
-    nonce?: string;
-    gasLimit?: string;
-    gasPrice?: string;
-    txType?: number;
-    maxFeePerGas?: string;
-    maxPriorityFeePerGas?: string;
-    accessList?: Array<{
-        address: string;
-        storageKeys: string[];
-    }>;
-    data?: string;
-    paymentRequest?: EvmPaymentRequest;
-    ethereumDefinitions?: EvmEthereumDefinitions;
-}
-/** Mutually exclusive vendor shapes; each adapter narrows to its own. */
-type EvmSignTxParams = EvmSignTxLedgerParams | EvmSignTxTrezorParams;
-interface EvmEthereumDefinitions {
-    /** Trezor Ethereum network definition bytes as a hex string. */
-    encodedNetwork?: string;
-    /** Trezor Ethereum token definition bytes as a hex string. */
-    encodedToken?: string;
+type VendorType = 'trezor' | 'ledger' | 'keystone';
+/** 'qr' is a virtual channel: UR payloads travel via app-rendered/scanned QR codes. */
+type ConnectionType = 'usb' | 'ble' | 'qr';
+type TransportType = 'usb' | 'ble' | 'hid' | 'bridge' | 'qr';
+/**
+ * Device capabilities — describes what a specific device/connection
+ * combination can or cannot do. Varies by vendor, model, and connection type.
+ *
+ * This enables business logic to check capabilities instead of hard-coding
+ * vendor-specific conditions (e.g., `if (vendor === 'ledger')`).
+ */
+interface DeviceCapabilities {
+    /** Chains usable through this adapter on the connected firmware; absent means not advertised. */
+    supportedChains?: ChainCapability[];
+    /**
+     * Whether the discovery handle can be reused to reconnect; `false` requires rediscovery. Says
+     * nothing about identity (Trezor BLE is false yet its device_id is stable); verify it separately.
+     */
+    persistentDeviceIdentity: boolean;
 }
-interface EvmPaymentRequestMemo {
-    textMemo?: {
-        text: string;
-    };
-    textDetailsMemo?: {
-        title: string;
-        text: string;
-    };
-    refundMemo?: {
-        address: string;
-        addressN?: number[];
-        mac: string;
-    };
-    coinPurchaseMemo?: {
-        coinType: number;
-        amount: string;
-        address: string;
-        addressN?: number[];
-        mac: string;
-    };
+interface DeviceInfo {
+    vendor: VendorType;
+    /** Machine model id (e.g. "nanoX"). */
+    model: string;
+    /** Human-readable model name (e.g. "Ledger Nano X"). */
+    modelName?: string;
+    firmwareVersion: string;
+    deviceId: string;
+    connectId: string;
+    label?: string;
+    connectionType: ConnectionType;
+    battery?: number;
+    /** BLE signal strength (BLE only). */
+    rssi?: number | null;
+    /** BLE connectable flag (BLE only). */
+    isConnectable?: boolean | null;
+    /** USB serial number (USB only). */
+    serialNumber?: string;
+    /** Device capabilities — varies by vendor, model, and connection type */
+    capabilities?: DeviceCapabilities;
+    /**
+     * Vendor-specific raw payload from the post-handshake `Features` (Trezor)
+     * or device-info call. Populated by the connector with `{ transport,
+     * descriptor, features }` so the app layer can read fields we haven't
+     * promoted to the typed surface yet. Treat as informational — promote
+     * any consumed field above.
+     */
+    raw?: Record<string, unknown>;
 }
-interface EvmPaymentRequest {
-    nonce?: string;
-    recipientName: string;
-    memos?: EvmPaymentRequestMemo[];
-    /** Decimal string in subunits; SDK encodes it as SLIP-24 uint256 LE hex. */
-    amount?: string;
-    signature: string;
+interface DeviceTarget {
+    connectId: string;
+    deviceId: string;
 }
-interface EvmSignedTx {
-    /** Recovery id as `0x`-prefixed hex string. */
-    v: string;
-    /** ECDSA `r` value as `0x`-prefixed, zero-padded 64-char hex string (32 bytes). */
-    r: string;
-    /** ECDSA `s` value as `0x`-prefixed, zero-padded 64-char hex string (32 bytes). */
-    s: string;
-    serializedTx?: string;
+/**
+ * How long a discovery handle remains safe to use for a new connection.
+ * This is deliberately separate from post-connect device identity.
+ */
+type SearchTargetReusePolicy = 'current-discovery' | 'reconnectable' | 'rediscover';
+declare function resolveSearchTargetReusePolicy(device: Pick<DeviceInfo, 'connectionType' | 'capabilities'>): SearchTargetReusePolicy;
+/** Search target for a physical device whose connectId is the discovery handle. */
+declare function toPhysicalDeviceSearchTarget(vendor: VendorType, device: DeviceInfo): DeviceSearchTarget;
+/**
+ * A selectable result from hardware discovery. It may represent a physical
+ * transport endpoint or an interactive entry such as Keystone QR; it is not a
+ * physical-device or wallet identity.
+ */
+interface DeviceSearchTarget {
+    /** Opaque handle scoped to the adapter's current discovery state. */
+    searchTargetId: string;
+    /** Whether the handle itself may be retried; never inferred from a stored connectId. */
+    searchTargetReusePolicy?: SearchTargetReusePolicy;
+    vendor: VendorType;
+    connectionType: ConnectionType;
+    kind: 'physical' | 'interactive';
+    label?: string;
+    model?: string;
+    modelName?: string;
+    serialNumber?: string;
 }
-interface EvmSignMsgParams extends PassphraseStateAware {
+type WalletIdentity = {
+    vendor: 'ledger';
+    type: 'chainFingerprint';
+    chain: ChainForFingerprint;
+    value: string;
+} | {
+    vendor: 'trezor';
+    type: 'deviceId';
+    value: string;
+} | {
+    vendor: 'keystone';
+    type: 'walletId';
+    value: string;
+};
+
+/** Which `GET_VK` encoding the Ledger Zcash app should return. */
+type ZcashFullViewingKeyMode = 'ufvk' | 'orchardFvk';
+interface ZcashGetFullViewingKeyParams extends PassphraseStateAware {
+    /** BIP44 account path `m/44'/133'/a'`; a deeper transparent path is accepted, only `a'` is used. */
     path: string;
-    message: string;
-    chainId?: number;
-    hex?: boolean;
-    ethereumDefinitions?: EvmEthereumDefinitions;
+    /** Default `ufvk`. */
+    mode?: ZcashFullViewingKeyMode;
 }
-type EvmSignTypedDataParams = EvmSignTypedDataFull | EvmSignTypedDataHash;
-interface EvmSignTypedDataFull extends PassphraseStateAware {
+interface ZcashFullViewingKey {
     path: string;
-    chainId?: number;
-    /** Defaults to `'full'` when omitted. */
-    mode?: 'full';
-    ethereumDefinitions?: EvmEthereumDefinitions;
-    data: {
-        domain: EIP712Domain;
-        types: Record<string, Array<{
-            name: string;
-            type: string;
-        }>>;
-        primaryType: string;
-        message: Record<string, unknown>;
-    };
-    metamaskV4Compat?: boolean;
-    showMessageHash?: boolean;
-    /**
-     * Optional host-computed hashes. Core Trezor models still use full typed-data
-     * signing for display, while Trezor One can fall back to typed-hash signing
-     * when firmware cannot compute the hashes itself.
-     */
-    domainSeparatorHash?: string;
-    messageHash?: string;
-}
-interface EvmSignTypedDataHash extends PassphraseStateAware {
+    mode: ZcashFullViewingKeyMode;
+    /** ZIP-316 bech32m UFVK string (mode `ufvk`). */
+    ufvk?: string;
+    /** 96-byte raw Orchard FVK as hex (mode `orchardFvk`). */
+    orchardFvk?: string;
+}
+interface ZcashGetShieldedAddressParams extends PassphraseStateAware {
+    /** Full 5-level transparent path `m/44'/133'/a'/0/i`; the Orchard path is derived from it. */
     path: string;
-    chainId?: number;
-    mode: 'hash';
-    domainSeparatorHash: string;
-    messageHash: string;
-    ethereumDefinitions?: EvmEthereumDefinitions;
-}
-interface EIP712Domain {
-    name?: string;
-    version?: string;
-    chainId?: number;
-    verifyingContract?: string;
-    salt?: string;
-    [key: string]: unknown;
-}
-interface EvmSignature {
-    /** `0x`-prefixed hex string (r + s + v). */
-    signature: string;
-    address?: string;
+    showOnDevice?: boolean;
 }
-interface IEvmMethods {
-    evmGetAddress(connectId?: NullableCallArg<string>, deviceId?: NullableCallArg<string>, params?: NullableCallArg<IHardwareCallParams<EvmGetAddressParams>>): Promise<Response<EvmAddress>>;
-    evmSignTransaction(connectId?: NullableCallArg<string>, deviceId?: NullableCallArg<string>, params?: NullableCallArg<IHardwareCallParams<EvmSignTxParams>>): Promise<Response<EvmSignedTx>>;
-    evmSignMessage(connectId?: NullableCallArg<string>, deviceId?: NullableCallArg<string>, params?: NullableCallArg<IHardwareCallParams<EvmSignMsgParams>>): Promise<Response<EvmSignature>>;
-    evmSignTypedData(connectId?: NullableCallArg<string>, deviceId?: NullableCallArg<string>, params?: NullableCallArg<IHardwareCallParams<EvmSignTypedDataParams>>): Promise<Response<EvmSignature>>;
+interface ZcashShieldedAddress {
+    /** Unified address with a single Orchard receiver. */
+    address: string;
+    path: string;
 }
 
 /**
@@ -1563,14 +1925,13 @@ interface DeviceDisconnectEvent {
 type DeviceChangeEvent = DeviceConnectEvent | DeviceDisconnectEvent;
 
 /**
- * Pure FIFO job queue. Every enqueue chains onto the tail; jobs run one at
- * a time across all devices. The queue is intentionally passive — it does
- * NOT decide whether to interrupt or ask the user. Those are application-
- * layer concerns owned by the caller (e.g. a UI button handler that wants
- * to ask "device is busy, interrupt current?" before submitting). The
- * queue exposes inspection (`getActiveJob`) and explicit cancellation
- * (`cancelActive` / `cancelAll`) so callers can implement those policies
- * synchronously, without racing against in-flight enqueues.
+ * Serializes every device call and gives callers one handle to cancel them. Ordering is already
+ * guaranteed by awaiting callers, so what this adds is an AbortController per job, a busy check
+ * that rejects double-submits, and generation tracking so a job queued before a teardown doesn't
+ * start after it; these races exist even for a sequential caller because cleanup is async.
+ *
+ * Interrupt-or-ask policy belongs to the caller; `getActiveJob()` is synchronous so a UI handler
+ * can look, decide, and submit in one turn without racing an in-flight enqueue.
  */
 interface JobOptions {
     label?: string;
@@ -1582,10 +1943,15 @@ interface ActiveJobInfo {
     label?: string;
     startedAt: number;
 }
+interface CancelScopeHandle {
+    signal: AbortSignal;
+    release: () => void;
+}
 declare class DeviceJobQueue {
     private _tail;
     private _active;
     private readonly _jobs;
+    private readonly _cancelScopes;
     /** Incremented on clear() so queued-but-not-yet-running jobs detect invalidation. */
     private _generation;
     private readonly _generationCancelReasons;
@@ -1594,21 +1960,64 @@ declare class DeviceJobQueue {
      * `deviceId` is a label only — used by inspection / cancellation routing.
      */
     enqueue<T>(deviceId: string, job: (signal: AbortSignal) => Promise<T>, options?: JobOptions): Promise<T>;
-    /** Cancel the active job. If `deviceId` is given, only cancels when it matches. */
-    cancelActive(deviceId?: string): boolean;
-    /** Force cancel the active job. `reason` becomes signal.reason. */
-    forceCancelActive(deviceId?: string, reason?: Error): boolean;
-    /** Cancel the active job (alias for callers that previously needed multi-device cancel). */
-    cancelAllActive(reason?: Error): void;
-    /** Cancel the active job and invalidate queued jobs that have not started. */
+    /**
+     * Holds a cancel across the gaps between a bundle's per-item jobs, when the queue is empty.
+     * Callers must `release()` when the bundle ends.
+     */
+    createCancelScope(deviceId: string): CancelScopeHandle;
+    /**
+     * Cancels the running job only; `reason` becomes signal.reason. Adapters use
+     * `cancelActiveAndPending`; this stays for a connector layer that stops only what is on the wire.
+     */
+    cancelActive(deviceId?: string, reason?: Error): boolean;
+    /**
+     * Cancels the active job and unstarted queued jobs; returns whether anything was reached. Only
+     * `undefined` means everything: an empty key matches nothing instead of tearing the queue down.
+     */
     cancelActiveAndPending(deviceId?: string, reason?: Error): boolean;
     /** Get info about the currently active job, or null if idle. */
     getActiveJob(deviceId?: string): ActiveJobInfo | null;
-    /** True if any job is currently running. */
-    isBusy(): boolean;
     clear(reason?: Error): void;
 }
 
+declare const HARDWARE_RUNTIME_ID_PREFIX = "hwk:runtime";
+/**
+ * `search-target`: one device in one discovery snapshot, dead on the next search of that kind.
+ * `link`: one open transport. `operation`: one business operation.
+ */
+type HardwareRuntimeIdKind = 'operation' | 'search-target' | 'link';
+type HardwareRuntimeId = {
+    kind: HardwareRuntimeIdKind;
+    vendor: VendorType;
+};
+/** Runtime ids are opaque and must never be persisted as device identity. */
+declare function createHardwareOperationId(vendor: VendorType): string;
+/** Search targets are valid only for the adapter's current discovery snapshot. */
+declare function createHardwareSearchTargetId(vendor: VendorType): string;
+declare function createHardwareLinkId(vendor: VendorType): string;
+declare function hasHardwareRuntimeIdPrefix(value: unknown): value is string;
+declare function parseHardwareRuntimeId(value: unknown): HardwareRuntimeId | undefined;
+declare function isHardwareOperationId(value: unknown): value is string;
+
+interface HardwareOperationTarget {
+    /** Effective target accepted by existing adapter/connector call paths. */
+    targetId: string | undefined;
+    /** Present when this operation is pinned to a live operation. */
+    operationId: string | undefined;
+}
+/**
+ * Normalizes the transitional positional operation id and the canonical
+ * common-params field. All vendors must reject conflicting bindings.
+ */
+declare function resolveHardwareOperationTarget(positionalTargetId: string | null | undefined, commonOperationId: string | null | undefined, expectedVendor?: VendorType): Response<HardwareOperationTarget>;
+/** Narrow the connection-context fields of untyped call params. */
+declare function pickConnectionContext(params: {
+    knownConnections?: unknown;
+    extra?: unknown;
+    allowDeviceSelection?: unknown;
+    supportedTransports?: unknown;
+}): IHardwareConnectionContext;
+
 /**
  * Minimal typed event emitter using Map<string, Set<listener>>.
  * Each adapter uses this for device events (connect, disconnect, pin, etc.).
@@ -1635,6 +2044,104 @@ declare class TypedEventEmitter<TMap extends Record<string, any> = Record<string
     listenerCount(event: string): number;
 }
 
+/** Serializable BLE transport data shared by Electron main and renderer runtimes. */
+interface ElectronBleDeviceInfo {
+    id: string;
+    name?: string;
+    rssi?: number;
+    advertisedServiceUuids?: string[];
+}
+/**
+ * IPC-safe peripheral match: advertises one of `serviceUuids`, or its local name matches every
+ * `namePatterns` entry (case-insensitive regex sources). The desktop noble-ble host treats this
+ * as a hint only: its vendor allowlist decides, `serviceUuids` can only narrow it, and
+ * `namePatterns` are never compiled.
+ */
+interface ElectronBleMatch {
+    serviceUuids?: string[];
+    namePatterns?: string[];
+}
+interface ElectronBleScanOptions {
+    /** Opaque partition key: results and connected devices never mix across it. */
+    vendor?: string;
+    match?: ElectronBleMatch;
+    /** @deprecated Superseded by `match.serviceUuids`. */
+    serviceUuids?: string[];
+    durationMs?: number;
+}
+/** GATT profile plus the write framing this vendor's firmware expects. */
+interface ElectronBleConnectOptions {
+    vendor: string;
+    serviceUuid: string;
+    writeUuid: string;
+    notifyUuid: string;
+    /**
+     * `padded`: fixed `chunkSize` packets, last zero-filled (Trezor firmware drops short packets).
+     * `raw`: the buffer as given, for self-length-framed protocols (Ledger).
+     */
+    write?: {
+        mode: 'padded' | 'raw';
+        chunkSize?: number;
+        chunkDelayMs?: number;
+        maxLength?: number;
+    };
+}
+/** Native code handles GATT only; framing, identity checks and wallet calls stay in the SDK. */
+interface ElectronBleApi {
+    scan(options?: ElectronBleScanOptions): Promise<ElectronBleDeviceInfo[]>;
+    stopScan(vendor?: string): Promise<void>;
+    connect(id: string, options?: ElectronBleConnectOptions): Promise<{
+        id: string;
+        name?: string;
+    }>;
+    disconnect(id: string): Promise<void>;
+    subscribe(id: string): Promise<void>;
+    unsubscribe(id: string): Promise<void>;
+    write(id: string, hexData: string): Promise<void>;
+    checkAvailability(): Promise<{
+        available: boolean;
+        state: string;
+        initialized: boolean;
+    }>;
+    getDevice(id: string): Promise<ElectronBleDeviceInfo | null>;
+    onNotification(handler: (id: string, hexData: string) => void): () => void;
+    onDeviceDisconnected(handler: (id: string) => void): () => void;
+    /** Abandon an in-flight connect in the main process. Optional for hosts that cannot cancel. */
+    cancelPairing?(options?: {
+        vendor: string;
+        id?: string;
+    }): Promise<void>;
+}
+
+declare function emitDeviceBindingStatus(emitter: TypedEventEmitter<HardwareEventMap>, selectionRequestId: string, status: DeviceBindingStatus['status']): void;
+/**
+ * A host refusal is reported, never thrown: the device is already connected, so a lost binding
+ * is worth a warning and a retry, not failing the user's work.
+ */
+type SaveDeviceBindingOutcome = {
+    saved: true;
+} | {
+    saved: false;
+    reason: SaveDeviceBindingDeclineReason;
+};
+/** Persist a binding through the host. Only a user abort throws. */
+declare function requestSaveDeviceBinding(emitter: TypedEventEmitter<HardwareEventMap>, registry: UiRequestRegistry, binding: Omit<SaveDeviceBindingRequest, 'requestId'>, signal?: AbortSignal): Promise<SaveDeviceBindingOutcome>;
+
+/** Discovery and selection share one owner; never connect until the last scan has drained. */
+declare function requestBleDeviceSelection({ emitter, registry, request, scan, signal, allowUsbFallback, pollIntervalMs, }: {
+    emitter: TypedEventEmitter<HardwareEventMap>;
+    registry: UiRequestRegistry;
+    request: Omit<DeviceSelectionRequest, 'requestId' | 'scanning'>;
+    scan: () => Promise<DeviceInfo[]>;
+    signal: AbortSignal;
+    /** The adapter must verify a returned USB candidate before dispatching any business call. */
+    allowUsbFallback?: boolean;
+    pollIntervalMs?: number;
+}): Promise<{
+    device: DeviceInfo;
+    requestId: string;
+}>;
+
 /**
  * Compare two semver strings (e.g. "2.1.0" vs "2.3.1").
  * Returns -1 if a < b, 0 if equal, 1 if a > b.
@@ -1655,7 +2162,57 @@ declare function hexToBytes(hex: string): Uint8Array;
 /** Convert a Uint8Array to a hex string (no 0x prefix). */
 declare function bytesToHex(bytes: Uint8Array): string;
 
-type DetectableHardwareVendor = 'onekey' | 'trezor' | 'ledger';
+/**
+ * Walks CBOR from an untrusted source (a scanned QR code, a device reply) before a third-party
+ * decoder sees it. Those decoders read past the end as zero and trust declared lengths, so one
+ * indefinite-length header or a huge declared count exhausts memory. This walk accepts only
+ * definite lengths that fit in the bytes actually present, bounded nesting, and no trailing bytes.
+ */
+declare function assertBoundedCbor(input: Uint8Array, maxBytes?: number): void;
+/** Hex from an untrusted source, checked as such and then as bounded CBOR. */
+declare function boundedCborFromHex(hex: string, maxBytes?: number): Buffer;
+
+interface PrepareSolanaOffchainMessageV1Params {
+    message: Uint8Array;
+    requiredSigners: readonly string[];
+}
+interface PreparedSolanaOffchainMessageV1 {
+    messageText: string;
+    requiredSigners: string[];
+    serializedMessage: Uint8Array;
+}
+declare function prepareSolanaOffchainMessageV1({ message, requiredSigners, }: PrepareSolanaOffchainMessageV1Params): PreparedSolanaOffchainMessageV1;
+
+type LogSummaryContext = {
+    /** Method name from the options, or '' when none was given. */
+    method: string;
+    role: 'params' | 'result';
+};
+/**
+ * Returns extra space-separated hints for a payload field (e.g. PSBT input/output counts), or
+ * undefined to add nothing. `key` is normalized: lower-case with `_` and `-` removed. Hints are
+ * appended verbatim, so they must not contain payload contents. A throwing describer is ignored.
+ */
+type LogPayloadDescriber = (key: string, value: string | Uint8Array, context: LogSummaryContext) => string | undefined;
+type LogSummaryOptions = {
+    /** Public or connector method name; enables chain-specific hints (EVM tx type). */
+    method?: string;
+    /** In results, transaction fields hold signed transactions rather than requests. */
+    role?: 'params' | 'result';
+    /** Chain-specific payload hints that need a decoder adapter-core does not ship. */
+    describePayload?: LogPayloadDescriber;
+};
+/**
+ * JSON-safe, log-safe summary of `value`. Never throws.
+ *
+ * Paths, chain ids, flags and error fields stay readable; payloads become
+ * `<hex|str|json len=N sha256=16hex [hints]>`, addresses `first6…last4`, xpubs `xpub… len=N`,
+ * public keys and chain codes `… len=N`, signatures `<signature len=N>` and secrets
+ * `<redacted len=N>`.
+ */
+declare function summarizeForLog(value: unknown, options?: LogSummaryOptions): unknown;
+
+type DetectableHardwareVendor = 'onekey' | 'trezor' | 'ledger' | 'keystone';
 type HardwareDeviceIdentityInput = {
     name?: string | null;
     localName?: string | null;
@@ -1718,8 +2275,19 @@ type RunAllNetworkGetAddressOptions = {
     buildTopLevelFailure?: (response: AllNetworkAddressResponse, context: AllNetworkResponseContext) => Response<AllNetworkAddressResponse[]>;
 };
 declare function runAllNetworkGetAddress({ connectId, deviceId, params, getMethodChain, normalizeItem, buildUnsupportedNetworkResponse, callItem, attachIdentity, shouldAbortBundle, buildTopLevelFailure, }: RunAllNetworkGetAddressOptions): Promise<Response<AllNetworkAddressResponse[]>>;
+/** An SDK-dialog cancel or on-device reject ends the bundle; the user already answered "no". */
+declare function isUserRefusal(code: HardwareErrorCode | number | undefined): boolean;
+/**
+ * The device or wallet could not be shown to be the one asked for: another wallet, a locked
+ * device, a wrong PIN or passphrase. No later item may derive on it, and a PIN is not retried.
+ */
+declare function isWalletSafetyFailure(code: HardwareErrorCode | number | undefined): boolean;
+/** The bundle's session is gone, so the remaining items have nothing to run against. */
+declare function isConnectionLost(code: HardwareErrorCode | number | undefined): boolean;
+/** UserAborted is a top-level abort code, so this ends the bundle. */
+declare function buildAllNetworkCancelledFailure<T>(signal: AbortSignal): Response<T>;
 declare function buildUnsupportedMethodResponse(item: AllNetworkAddressParams): AllNetworkAddressResponse;
 
 declare const DEVICE_CONNECT_RETRY_DELAY_MS = 1000;
 
-export { ALL_NETWORK_METHOD_NAMES, type ActiveJobInfo, type AllNetworkAddressParams, type AllNetworkAddressResponse, type AllNetworkAddressResponsePayload, type AllNetworkAttachIdentityContext, type AllNetworkCallItemContext, type AllNetworkGetAddressParams, type AllNetworkMethodName, type AllNetworkResponseContext, type BtcAddress, type BtcGetAddressParams, type BtcGetPublicKeyParams, type BtcPaymentRequest, type BtcPaymentRequestMemo, type BtcPublicKey, type BtcRefTransaction, type BtcSignMsgParams, type BtcSignPsbtParams, type BtcSignTxParams, type BtcSignature, type BtcSignedPsbt, type BtcSignedTx, type BtcTxInput, type BtcTxOutput, CHAIN_FINGERPRINT_PATHS, type ChainCapability, type ChainForFingerprint, type ConnectionType, type ConnectorCallResult, type ConnectorConfig, type ConnectorDevice, type ConnectorErrorParams, type ConnectorEventMap, type ConnectorEventType, type ConnectorSerializedError, type ConnectorSession, type ConnectorUiEvent, DEVICE, DEVICE_CONNECT_RETRY_DELAY_MS, DEVICE_EVENT, type DetectableHardwareVendor, type DeviceAuthenticityParams, type DeviceAuthenticityResult, type DeviceCapabilities, type DeviceChangeEvent, type DeviceConnectEvent, type DeviceDescriptor, type DeviceDisconnectEvent, type DeviceEvent, type DeviceEventListener, type DeviceInfo, DeviceJobQueue, type DeviceTarget, EConnectorInteraction, type EIP712Domain, type EvmAddress, type EvmEthereumDefinitions, type EvmGetAddressParams, type EvmPaymentRequest, type EvmPaymentRequestMemo, type EvmSignMsgParams, type EvmSignTxLedgerParams, type EvmSignTxParams, type EvmSignTxTrezorParams, type EvmSignTypedDataFull, type EvmSignTypedDataHash, type EvmSignTypedDataParams, type EvmSignature, type EvmSignedTx, type Failure, HARDWARE_METHOD_CATALOG, type HardwareDeviceIdentityInput, HardwareErrorCode, type HardwareEvent, type HardwareEventMap, type HardwareMethodMetadata, type HardwareMethodName, type HardwareUiEvent, type IBtcMethods, type ICommonCallParams, type IConnector, type IDeviceManagerMethods, type IEvmMethods, type IHardwareBridge, type IHardwareCallParams, type IHardwareCommonCallParams, type IHardwareWallet, type IPassphraseCallParams, type ISolMethods, type ITronMethods, type IWalletStateMethods, type JobOptions, type NullableCallArg, type PassphraseResponse, type PassphraseStateAware, QrDisplayData, type Response, type RunAllNetworkGetAddressOptions, SDK, type SdkEvent, type SearchDevicesOptions, type SolAddress, type SolGetAddressParams, type SolSignMsgParams, type SolSignTxParams, type SolSignature, type SolSignedTx, type Success, type TransportType, type TrezorBrightnessParams, type TrezorChangePinParams, type TrezorDeviceSettingsParams, type TrezorDisplayRotation, type TrezorSafetyCheckLevel, type TronAddress, type TronContract, type TronFreezeBalanceV2Contract, type TronGetAddressParams, type TronResource, type TronSignMsgParams, type TronSignTxParams, type TronSignature, type TronSignedTx, type TronTransferContract, type TronTriggerSmartContract, type TronUnfreezeBalanceV2Contract, type TronVote, type TronVoteWitnessContract, type TronWithdrawExpireUnfreezeContract, TypedEventEmitter, UI_REQUEST, type UiRequestEvent, UiResponseEvent, type VendorType, batchCall, buildUnsupportedMethodResponse, bytesToHex, compareSemver, createBridgedConnector, createCombinedConnector, deriveDeviceFingerprint, detectHardwareVendorFromDescriptor, ensure0x, failure, getAllNetworkMethodChain, getHardwareMethodMetadata, hexToBytes, isAllNetworkMethodName, isKnownNonTargetHardwareVendor, padHex64, rehydrateConnectorError, runAllNetworkGetAddress, serializeConnectorError, stripHex, success };
+export { ALL_NETWORK_METHOD_NAMES, type ActiveJobInfo, type AllNetworkAddressParams, type AllNetworkAddressResponse, type AllNetworkAddressResponsePayload, type AllNetworkAttachIdentityContext, type AllNetworkCallItemContext, type AllNetworkDeviceIdentity, type AllNetworkGetAddressParams, type AllNetworkMethodName, type AllNetworkResponseContext, type BindBleDeviceParams, type BtcAddress, type BtcGetAddressParams, type BtcGetPublicKeyParams, type BtcPaymentRequest, type BtcPaymentRequestMemo, type BtcPublicKey, type BtcRefTransaction, type BtcSignMsgParams, type BtcSignPsbtParams, type BtcSignTxParams, type BtcSignature, type BtcSignedPsbt, type BtcSignedTx, type BtcTxInput, type BtcTxOutput, CHAIN_FINGERPRINT_PATHS, type CancelCapability, type CancelScopeHandle, type ChainCapability, type ChainForFingerprint, type ConnectionType, type ConnectorCallResult, type ConnectorConfig, type ConnectorConnectTarget, type ConnectorDevice, type ConnectorErrorParams, type ConnectorEventMap, type ConnectorEventType, type ConnectorSearchDevicesOptions, type ConnectorSerializedError, type ConnectorSession, type ConnectorUiEvent, DEVICE, DEVICE_CONNECT_RETRY_DELAY_MS, DEVICE_EVENT, type DetectableHardwareVendor, type DeviceAuthenticityParams, type DeviceAuthenticityResult, type DeviceBindingStatus, type DeviceCapabilities, type DeviceChangeEvent, type DeviceConnectEvent, type DeviceDescriptor, type DeviceDisconnectEvent, type DeviceEvent, type DeviceEventListener, type DeviceInfo, DeviceJobQueue, type DeviceSearchTarget, type DeviceSelectionContext, type DeviceSelectionRequest, type DeviceTarget, EConnectorInteraction, type EIP712Domain, type ElectronBleApi, type ElectronBleConnectOptions, type ElectronBleDeviceInfo, type ElectronBleMatch, type ElectronBleScanOptions, type EvmAddress, type EvmEthereumDefinitions, type EvmGetAddressParams, type EvmPaymentRequest, type EvmPaymentRequestMemo, type EvmSignMsgParams, type EvmSignTxLedgerParams, type EvmSignTxParams, type EvmSignTxTrezorParams, type EvmSignTypedDataFull, type EvmSignTypedDataHash, type EvmSignTypedDataParams, type EvmSignature, type EvmSignedTx, ExportedAccountKey, type Failure, HARDWARE_METHOD_CATALOG, HARDWARE_RUNTIME_ID_PREFIX, type HardwareCallExtra, type HardwareDeviceIdentityInput, HardwareErrorCode, type HardwareEvent, type HardwareEventMap, type HardwareMethodMetadata, type HardwareMethodName, type HardwareOperation, type HardwareOperationTarget, type HardwareRuntimeId, type HardwareRuntimeIdKind, type HardwareUiEvent, HwkErrorOrigin, HwkRecoveryHint, type IBtcMethods, type ICommonCallParams, type IConnector, type IDeviceManagerMethods, type IDeviceManagerOperationContext, type IEvmMethods, type IHardwareBridge, type IHardwareCallParams, type IHardwareCommonCallParams, type IHardwareConnectionContext, type IHardwareWallet, type IPassphraseCallParams, type ISolMethods, type ITronMethods, type IWalletStateMethods, type JobOptions, type KnownDeviceConnection, type LogPayloadDescriber, type LogSummaryContext, type LogSummaryOptions, MISSING_BIP32_MASTER_FINGERPRINT, type NullableCallArg, OPERATION_DEFAULT_TTL_MS, type OperationEndReason, OperationRegistry, type PassphraseResponse, type PassphraseStateAware, type PrepareSolanaOffchainMessageV1Params, type PreparedSolanaOffchainMessageV1, QrDisplayData, type Response, type RunAllNetworkGetAddressOptions, SDK, SaveDeviceBindingDeclineReason, type SaveDeviceBindingRequest, type SdkEvent, type SearchDevicesOptions, type SearchTargetReusePolicy, type SolAddress, type SolGetAddressParams, type SolOffchainMessageV1Params, type SolSignMsgParams, type SolSignTxParams, type SolSignature, type SolSignedTx, type Success, type TransportType, type TrezorBrightnessParams, type TrezorChangePinParams, type TrezorDeviceSettingsParams, type TrezorDisplayRotation, type TrezorSafetyCheckLevel, type TronAddress, type TronContract, type TronFreezeBalanceV2Contract, type TronGetAddressParams, type TronResource, type TronSignMsgParams, type TronSignTxParams, type TronSignature, type TronSignedTx, type TronTransferContract, type TronTriggerSmartContract, type TronUnfreezeBalanceV2Contract, type TronVote, type TronVoteWitnessContract, type TronWithdrawExpireUnfreezeContract, TypedEventEmitter, UI_REQUEST, type UiRequestEvent, UiRequestOperationAttribution, UiRequestRegistry, UiResponseEvent, type VendorType, type WalletIdentity, type ZcashFullViewingKey, type ZcashFullViewingKeyMode, type ZcashGetFullViewingKeyParams, type ZcashGetShieldedAddressParams, type ZcashShieldedAddress, assertBoundedCbor, batchCall, boundedCborFromHex, buildAllNetworkCancelledFailure, buildUnsupportedMethodResponse, bytesToHex, canReplayHardwareMethodAfterTransportFailure, compareSemver, createBridgedConnector, createCombinedConnector, createHardwareLinkId, createHardwareOperationId, createHardwareSearchTargetId, deriveDeviceFingerprint, detectHardwareVendorFromDescriptor, emitDeviceBindingStatus, ensure0x, failure, getAllNetworkMethodChain, getHardwareMethodMetadata, hasHardwareRuntimeIdPrefix, hexToBytes, isAllNetworkMethodName, isConnectionLost, isHardwareOperationId, isKnownNonTargetHardwareVendor, isUserRefusal, isWalletSafetyFailure, padHex64, parseBip32MasterFingerprint, parseHardwareRuntimeId, parseWalletMasterFingerprint, pickConnectionContext, prepareSolanaOffchainMessageV1, rehydrateConnectorError, requestBleDeviceSelection, requestSaveDeviceBinding, resolveHardwareOperationTarget, resolveSearchTargetReusePolicy, runAllNetworkGetAddress, serializeConnectorError, stripHex, success, summarizeForLog, toPhysicalDeviceSearchTarget };