@onekeyfe/hwk-adapter-core 1.2.8-alpha.12 → 1.2.8-alpha.121

package/dist/index.js

@@ -1,28 +1,58 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 
+var _chunkYLCHSNXOjs = require('./chunk-YLCHSNXO.js');
 
 
 
-var _chunkSZZF623Rjs = require('./chunk-SZZF623R.js');
 
 
 
 
 
 
+var _chunkPY5FNLTSjs = require('./chunk-PY5FNLTS.js');
 
 
 
-var _chunkBAGEFFFYjs = require('./chunk-BAGEFFFY.js');
+
+
+
+
+
+var _chunkUFNTICCXjs = require('./chunk-UFNTICCX.js');
 
 // src/types/response.ts
 function success(payload) {
   return { success: true, payload };
 }
-function failure(code, error, params) {
+function failure(code, error, params, origin, recovery) {
   return {
     success: false,
-    payload: { error, code, ...params ? { params } : {} }
+    payload: {
+      error,
+      code,
+      ...origin !== void 0 ? { origin } : {},
+      recovery: _nullishCoalesce(recovery, () => ( _chunkUFNTICCXjs.defaultRecoveryForCode.call(void 0, code))),
+      ...params ? { params } : {}
+    }
+  };
+}
+
+// src/types/device.ts
+function resolveSearchTargetReusePolicy(device) {
+  return _optionalChain([device, 'access', _ => _.capabilities, 'optionalAccess', _2 => _2.persistentDeviceIdentity]) ? "reconnectable" : "current-discovery";
+}
+function toPhysicalDeviceSearchTarget(vendor, device) {
+  return {
+    searchTargetId: device.connectId,
+    searchTargetReusePolicy: resolveSearchTargetReusePolicy(device),
+    vendor,
+    connectionType: device.connectionType,
+    kind: "physical",
+    label: device.label,
+    model: device.model,
+    modelName: device.modelName,
+    serialNumber: device.serialNumber
   };
 }
 
@@ -35,8 +65,20 @@ var CHAIN_FINGERPRINT_PATHS = {
   // Cointype 1 (testnet) is rejected by some Ledger BTC App configurations.
   btc: "m/44'/0'/0'",
   sol: "m/44'/501'/0'",
-  tron: "m/44'/195'/0'/0/0"
+  tron: "m/44'/195'/0'/0/0",
+  // Shielded UA (single Orchard receiver) derived from the transparent path.
+  zcash: "m/44'/133'/0'/0/0"
 };
+function parseBip32MasterFingerprint(value) {
+  if (typeof value !== "string") return void 0;
+  const normalized = value.trim().toLowerCase();
+  return /^[0-9a-f]{8}$/.test(normalized) ? normalized : void 0;
+}
+var MISSING_BIP32_MASTER_FINGERPRINT = "00000000";
+function parseWalletMasterFingerprint(value) {
+  const fingerprint = parseBip32MasterFingerprint(value);
+  return fingerprint === MISSING_BIP32_MASTER_FINGERPRINT ? void 0 : fingerprint;
+}
 function deriveDeviceFingerprint(value) {
   return _utils.bytesToHex.call(void 0, _sha256.sha256.call(void 0, _utils.utf8ToBytes.call(void 0, value))).slice(0, 16);
 }
@@ -66,7 +108,8 @@ var SDK = {
   DEVICE_STUCK: "device-stuck",
   DEVICE_UNRESPONSIVE: "device-unresponsive",
   DEVICE_RECOVERED: "device-recovered",
-  DEVICE_INTERACTION: "device-interaction"
+  DEVICE_INTERACTION: "device-interaction",
+  OPERATION_ENDED: "operation-ended"
 };
 
 // src/utils/DeviceJobQueue.ts
@@ -75,6 +118,7 @@ var DeviceJobQueue = class {
     this._tail = Promise.resolve();
     this._active = null;
     this._jobs = /* @__PURE__ */ new Map();
+    this._cancelScopes = /* @__PURE__ */ new Map();
     /** Incremented on clear() so queued-but-not-yet-running jobs detect invalidation. */
     this._generation = 0;
     this._generationCancelReasons = /* @__PURE__ */ new Map();
@@ -97,12 +141,13 @@ var DeviceJobQueue = class {
       abortController: ac,
       startedAt: Date.now()
     };
-    this._jobs.set(jobToken, { deviceId });
+    this._jobs.set(jobToken, activeJob);
     const next = prev.catch(() => {
     }).then(async () => {
       if (this._generation !== gen) {
         throw _nullishCoalesce(this._generationCancelReasons.get(gen), () => ( new Error("Job cancelled: queue was cleared")));
       }
+      if (ac.signal.aborted) throw ac.signal.reason;
       this._active = activeJob;
       try {
         return await job(ac.signal);
@@ -118,32 +163,52 @@ var DeviceJobQueue = class {
     });
     return next;
   }
-  /** Cancel the active job. If `deviceId` is given, only cancels when it matches. */
-  cancelActive(deviceId) {
-    if (!this._active) return false;
-    if (deviceId && this._active.deviceId !== deviceId) return false;
-    this._active.abortController.abort(new Error("Manually cancelled"));
-    return true;
+  /**
+   * Holds a cancel across the gaps between a bundle's per-item jobs, when the queue is empty.
+   * Callers must `release()` when the bundle ends.
+   */
+  createCancelScope(deviceId) {
+    const scopeToken = {};
+    const abortController = new AbortController();
+    this._cancelScopes.set(scopeToken, { deviceId, abortController });
+    return {
+      signal: abortController.signal,
+      release: () => {
+        this._cancelScopes.delete(scopeToken);
+      }
+    };
   }
-  /** Force cancel the active job. `reason` becomes signal.reason. */
-  forceCancelActive(deviceId, reason) {
+  /**
+   * Cancels the running job only; `reason` becomes signal.reason. Adapters use
+   * `cancelActiveAndPending`; this stays for a connector layer that stops only what is on the wire.
+   */
+  cancelActive(deviceId, reason) {
     if (!this._active) return false;
     if (deviceId && this._active.deviceId !== deviceId) return false;
-    this._active.abortController.abort(_nullishCoalesce(reason, () => ( new Error("Force cancelled for recovery"))));
+    this._active.abortController.abort(_nullishCoalesce(reason, () => ( new Error("Cancelled"))));
     return true;
   }
-  /** Cancel the active job (alias for callers that previously needed multi-device cancel). */
-  cancelAllActive(reason) {
-    if (!this._active) return;
-    this._active.abortController.abort(_nullishCoalesce(reason, () => ( new Error("Cancelled by cancelAllActive"))));
-  }
-  /** Cancel the active job and invalidate queued jobs that have not started. */
+  /**
+   * Cancels the active job and unstarted queued jobs; returns whether anything was reached. Only
+   * `undefined` means everything: an empty key matches nothing instead of tearing the queue down.
+   */
   cancelActiveAndPending(deviceId, reason) {
-    if (deviceId && this._active && this._active.deviceId !== deviceId) {
-      return false;
+    const cancelReason = _nullishCoalesce(reason, () => ( new Error("Cancelled by cancelActiveAndPending")));
+    if (deviceId !== void 0) {
+      let cancelled = false;
+      const targets = [this._jobs, this._cancelScopes];
+      for (const map of targets) {
+        for (const target of map.values()) {
+          if (target.deviceId !== deviceId) continue;
+          target.abortController.abort(cancelReason);
+          cancelled = true;
+        }
+      }
+      return cancelled;
     }
-    this.clear(_nullishCoalesce(reason, () => ( new Error("Cancelled by cancelActiveAndPending"))));
-    return true;
+    const reached = this._active !== null || this._jobs.size > 0 || this._cancelScopes.size > 0;
+    this.clear(cancelReason);
+    return reached;
   }
   /** Get info about the currently active job, or null if idle. */
   getActiveJob(deviceId) {
@@ -155,10 +220,6 @@ var DeviceJobQueue = class {
       startedAt: this._active.startedAt
     };
   }
-  /** True if any job is currently running. */
-  isBusy() {
-    return this._jobs.size > 0;
-  }
   clear(reason) {
     const cancelledGeneration = this._generation;
     this._generation++;
@@ -172,9 +233,232 @@ var DeviceJobQueue = class {
     if (this._active) {
       this._active.abortController.abort(cancelReason);
     }
+    for (const scope of this._cancelScopes.values()) {
+      scope.abortController.abort(cancelReason);
+    }
   }
 };
 
+// src/utils/hardwareRuntimeId.ts
+
+var HARDWARE_RUNTIME_ID_PREFIX = "hwk:runtime";
+var RANDOM_ID_BYTES = 16;
+var RANDOM_ID_PATTERN = /^[0-9a-f]{32}$/;
+var KINDS = /* @__PURE__ */ new Set([
+  "operation",
+  "search-target",
+  "link"
+]);
+var VENDORS = /* @__PURE__ */ new Set(["trezor", "ledger", "keystone"]);
+function create(kind, vendor) {
+  return `${HARDWARE_RUNTIME_ID_PREFIX}:${kind}:${vendor}:${_utils.bytesToHex.call(void 0, 
+    _utils.randomBytes.call(void 0, RANDOM_ID_BYTES)
+  )}`;
+}
+function createHardwareOperationId(vendor) {
+  return create("operation", vendor);
+}
+function createHardwareSearchTargetId(vendor) {
+  return create("search-target", vendor);
+}
+function createHardwareLinkId(vendor) {
+  return create("link", vendor);
+}
+function hasHardwareRuntimeIdPrefix(value) {
+  return typeof value === "string" && value.startsWith(`${HARDWARE_RUNTIME_ID_PREFIX}:`);
+}
+function parseHardwareRuntimeId(value) {
+  if (!hasHardwareRuntimeIdPrefix(value)) return void 0;
+  const parts = value.split(":");
+  if (parts.length !== 5) return void 0;
+  const [, , kind, vendor, nonce] = parts;
+  if (!KINDS.has(kind) || !VENDORS.has(vendor) || !RANDOM_ID_PATTERN.test(nonce)) {
+    return void 0;
+  }
+  return { kind, vendor };
+}
+function isHardwareOperationId(value) {
+  return _optionalChain([parseHardwareRuntimeId, 'call', _3 => _3(value), 'optionalAccess', _4 => _4.kind]) === "operation";
+}
+
+// src/utils/OperationRegistry.ts
+var OPERATION_DEFAULT_TTL_MS = 6e5;
+var uniqueKeys = (keys) => Array.from(new Set(keys.filter(Boolean)));
+var OperationRegistry = class {
+  constructor(options) {
+    this._active = /* @__PURE__ */ new Map();
+    this._ended = /* @__PURE__ */ new Map();
+    this._vendor = options.vendor;
+    this._ttlMs = _nullishCoalesce(options.ttlMs, () => ( OPERATION_DEFAULT_TTL_MS));
+    this._onEnded = options.onEnded;
+  }
+  create(params) {
+    const operationId = createHardwareOperationId(this._vendor);
+    const operation = {
+      operationId,
+      connectId: params.connectId,
+      device: params.device,
+      connectionType: params.connectionType,
+      connectionKeys: uniqueKeys([
+        params.searchTargetId,
+        params.connectId,
+        ..._nullishCoalesce(params.connectionKeys, () => ( []))
+      ])
+    };
+    const timer = this._createTimer(operationId);
+    this._active.set(operationId, { ...operation, timer, retainCount: 0 });
+    return operation;
+  }
+  resolve(operationId) {
+    const active = this._active.get(operationId);
+    if (!active) {
+      const ended = this._ended.get(operationId);
+      if (ended) {
+        throw _chunkUFNTICCXjs.createHwkError.call(void 0, {
+          code: 10113 /* OperationEnded */,
+          message: `Hardware operation has ended (${ended.reason})`,
+          params: { operationId, reason: ended.reason }
+        });
+      }
+      throw _chunkUFNTICCXjs.createHwkError.call(void 0, {
+        code: 10112 /* OperationNotFound */,
+        message: "Hardware operation was not found",
+        params: { operationId }
+      });
+    }
+    this._touch(active);
+    return active;
+  }
+  /** Keep an operation alive while one device job is actively using it. */
+  retain(operationId) {
+    const active = this.resolve(operationId);
+    active.retainCount += 1;
+    this._touch(active);
+    let released = false;
+    return () => {
+      if (released) return;
+      released = true;
+      const current = this._active.get(operationId);
+      if (!current) return;
+      current.retainCount = Math.max(0, current.retainCount - 1);
+      this._touch(current);
+    };
+  }
+  /** Return a live operation without refreshing its TTL; ended and unknown ids give undefined. */
+  findActive(operationId) {
+    return this._active.get(operationId);
+  }
+  /** Return active or tombstoned binding data without refreshing its TTL. */
+  find(operationId) {
+    return _nullishCoalesce(this._active.get(operationId), () => ( _optionalChain([this, 'access', _5 => _5._ended, 'access', _6 => _6.get, 'call', _7 => _7(operationId), 'optionalAccess', _8 => _8.operation])));
+  }
+  findActiveByConnectionKey(connectionKey) {
+    if (!connectionKey) return void 0;
+    return [...this._active.values()].find(
+      (operation) => operation.connectionKeys.includes(connectionKey)
+    );
+  }
+  /** Only an explicitly supplied operation job key owns the call's UI requests. */
+  findOperationIdByJobKey(jobKey) {
+    return isHardwareOperationId(jobKey) ? jobKey : void 0;
+  }
+  /**
+   * End an operation on the caller's explicit release. Throws for an unknown id; returns undefined
+   * when it had already ended.
+   */
+  release(operationId) {
+    if (!this.find(operationId)) {
+      this.resolve(operationId);
+      return void 0;
+    }
+    return this.end(operationId, "explicit");
+  }
+  end(operationId, reason) {
+    const active = this._active.get(operationId);
+    if (!active) return void 0;
+    if (active.timer) clearTimeout(active.timer);
+    this._active.delete(operationId);
+    this._rememberEnded(active, reason);
+    _optionalChain([this, 'access', _9 => _9._onEnded, 'optionalCall', _10 => _10(active, reason)]);
+    return active;
+  }
+  endByConnectionKey(connectionKey, reason, exceptOperationId) {
+    if (!connectionKey) return;
+    for (const operation of [...this._active.values()]) {
+      if (operation.operationId === exceptOperationId) continue;
+      if (operation.connectionKeys.includes(connectionKey)) {
+        this.end(operation.operationId, reason);
+      }
+    }
+  }
+  endAll(reason, exceptOperationId) {
+    for (const operationId of [...this._active.keys()]) {
+      if (operationId === exceptOperationId) continue;
+      this.end(operationId, reason);
+    }
+  }
+  _touch(active) {
+    if (active.timer) clearTimeout(active.timer);
+    active.timer = active.retainCount === 0 ? this._createTimer(active.operationId) : void 0;
+  }
+  _createTimer(operationId) {
+    const timer = setTimeout(() => {
+      this.end(operationId, "timeout");
+    }, this._ttlMs);
+    _optionalChain([timer, 'access', _11 => _11.unref, 'optionalCall', _12 => _12()]);
+    return timer;
+  }
+  _rememberEnded(operation, reason) {
+    this._ended.set(operation.operationId, { reason, operation });
+    if (this._ended.size <= 100) return;
+    const oldest = this._ended.keys().next().value;
+    if (oldest) this._ended.delete(oldest);
+  }
+};
+
+// src/utils/hardwareOperationTarget.ts
+function resolveHardwareOperationTarget(positionalTargetId, commonOperationId, expectedVendor) {
+  const targetId = _nullishCoalesce(positionalTargetId, () => ( void 0));
+  const commonId = commonOperationId || void 0;
+  const parsedTarget = parseHardwareRuntimeId(targetId);
+  const parsedCommon = parseHardwareRuntimeId(commonId);
+  const positionalOperationId = _optionalChain([parsedTarget, 'optionalAccess', _13 => _13.kind]) === "operation" ? targetId : void 0;
+  if (hasHardwareRuntimeIdPrefix(targetId) && !parsedTarget) {
+    return failure(10002 /* InvalidParams */, "Invalid hardware operation target id");
+  }
+  if (_optionalChain([parsedTarget, 'optionalAccess', _14 => _14.kind]) === "link") {
+    return failure(
+      10002 /* InvalidParams */,
+      "Hardware transport link id cannot be used as an operation target"
+    );
+  }
+  if (commonId && _optionalChain([parsedCommon, 'optionalAccess', _15 => _15.kind]) !== "operation") {
+    return failure(10002 /* InvalidParams */, "Invalid hardware operation id");
+  }
+  if (expectedVendor && [parsedTarget, parsedCommon].some((parsed) => parsed && parsed.vendor !== expectedVendor)) {
+    return failure(
+      10002 /* InvalidParams */,
+      `Hardware operation does not belong to ${expectedVendor}`
+    );
+  }
+  if (positionalOperationId && commonId && positionalOperationId !== commonId) {
+    return failure(10002 /* InvalidParams */, "Conflicting hardware operation ids", {
+      positionalOperationId,
+      commonOperationId: commonId
+    });
+  }
+  const operationId = _nullishCoalesce(commonId, () => ( positionalOperationId));
+  return success({ operationId, targetId: _nullishCoalesce(operationId, () => ( targetId)) });
+}
+function pickConnectionContext(params) {
+  return {
+    knownConnections: params.knownConnections,
+    extra: params.extra,
+    allowDeviceSelection: typeof params.allowDeviceSelection === "boolean" ? params.allowDeviceSelection : void 0,
+    supportedTransports: params.supportedTransports
+  };
+}
+
 // src/types/connector.ts
 var EConnectorInteraction = /* @__PURE__ */ ((EConnectorInteraction2) => {
   EConnectorInteraction2["Searching"] = "searching";
@@ -190,7 +474,7 @@ function createBridgedConnector(vendor, connectionType, bridge) {
   return {
     connectionType,
     searchDevices: (options) => bridge.searchDevices({ vendor, options }),
-    connect: (deviceId) => bridge.connect({ vendor, deviceId }),
+    connect: (deviceId, options) => bridge.connect({ vendor, deviceId, ...options ? { options } : {} }),
     disconnect: (sessionId) => bridge.disconnect({ vendor, sessionId }),
     call: (sessionId, method, callParams) => bridge.call({ vendor, sessionId, method, callParams }),
     cancel: (sessionId) => bridge.cancel({ vendor, sessionId }),
@@ -211,14 +495,14 @@ function createBridgedConnector(vendor, connectionType, bridge) {
     },
     off: (event, handler) => {
       const inner = handlerMap.get(event);
-      const bridgeHandler = _optionalChain([inner, 'optionalAccess', _ => _.get, 'call', _2 => _2(handler)]);
+      const bridgeHandler = _optionalChain([inner, 'optionalAccess', _16 => _16.get, 'call', _17 => _17(handler)]);
       if (!bridgeHandler || !inner) return;
       bridge.offEvent({ vendor }, bridgeHandler);
       inner.delete(handler);
       if (inner.size === 0) handlerMap.delete(event);
     },
     reset: () => bridge.reset({ vendor }),
-    configure: bridge.configure ? (config) => _optionalChain([bridge, 'access', _3 => _3.configure, 'optionalCall', _4 => _4({ vendor, config })]) : void 0,
+    configure: bridge.configure ? (config) => _optionalChain([bridge, 'access', _18 => _18.configure, 'optionalCall', _19 => _19({ vendor, config })]) : void 0,
     setKnownCredentials: bridge.setKnownCredentials ? (credentials) => bridge.setKnownCredentials({ vendor, credentials }) : void 0
   };
 }
@@ -279,6 +563,15 @@ function rehydrateConnectorError(error) {
     ..._nullishCoalesce(params, () => ( {}))
   });
 }
+function withChildConnectionType(event, data, connectionType) {
+  if (event !== "device-connect" && event !== "features") return data;
+  const { device } = data;
+  if (device.connectionType) return data;
+  return {
+    ...data,
+    device: { ...device, connectionType }
+  };
+}
 function isDeviceUnavailableError(error) {
   const typed = error;
   if (typed.code === 10100 /* DeviceNotFound */ || typed.code === 10101 /* DeviceDisconnected */) {
@@ -287,13 +580,13 @@ function isDeviceUnavailableError(error) {
   return false;
 }
 function combinedDeviceNotFoundError(message) {
-  return _chunkSZZF623Rjs.createHwkError.call(void 0, {
+  return _chunkUFNTICCXjs.createHwkError.call(void 0, {
     code: 10100 /* DeviceNotFound */,
     message
   });
 }
 function combinedSessionNotFoundError(message) {
-  return _chunkSZZF623Rjs.createHwkError.call(void 0, {
+  return _chunkUFNTICCXjs.createHwkError.call(void 0, {
     code: 10101 /* DeviceDisconnected */,
     message
   });
@@ -322,19 +615,26 @@ function createCombinedConnector(connectors) {
   };
   const broadcastCredentials = async () => {
     await Promise.all(
-      connectors.map((child) => Promise.resolve(_optionalChain([child, 'access', _5 => _5.setKnownCredentials, 'optionalCall', _6 => _6(sharedCredentials)])))
+      connectors.map((child) => Promise.resolve(_optionalChain([child, 'access', _20 => _20.setKnownCredentials, 'optionalCall', _21 => _21(sharedCredentials)])))
     );
   };
   for (const child of connectors) {
     child.on("device-trezor-thp-credentials-changed", (data) => {
-      if (mergeShared(data.credentials)) void broadcastCredentials();
+      const removed = new Set((_nullishCoalesce(data.removed, () => ( []))).map(credentialKey));
+      const kept = sharedCredentials.filter((cred) => !removed.has(credentialKey(cred)));
+      const dropped = kept.length !== sharedCredentials.length;
+      sharedCredentials.splice(0, sharedCredentials.length, ...kept);
+      if (mergeShared(data.credentials) || dropped) void broadcastCredentials();
     });
   }
+  const onTransport = (child, transportType) => !transportType || child.connectionType === transportType;
   const searchDevices = async (options = {}) => {
+    const selectedConnectors = connectors.map((child, index) => ({ child, index })).filter(({ child }) => onTransport(child, options.transportType));
+    if (!selectedConnectors.length) return [];
     const perConnector = [];
-    await new Promise((resolve) => {
+    await new Promise((resolve, reject) => {
       let finished = false;
-      let remaining = connectors.length;
+      let remaining = selectedConnectors.length;
       let settleTimer;
       const finish = () => {
         if (finished) return;
@@ -342,19 +642,20 @@ function createCombinedConnector(connectors) {
         if (settleTimer) clearTimeout(settleTimer);
         resolve();
       };
-      connectors.forEach((child, index) => {
-        void child.searchDevices().then(
+      selectedConnectors.forEach(({ child, index }) => {
+        void child.searchDevices(options.purpose ? { purpose: options.purpose } : void 0).then(
           (devices) => devices.map((device) => ({
             ...device,
             connectionType: _nullishCoalesce(device.connectionType, () => ( child.connectionType))
           }))
-        ).catch(
-          () => (
-            // A transport that can't scan (powered off, unauthorized, absent)
-            // must not fail the whole fused search.
-            []
-          )
-        ).then((devices) => {
+        ).catch((error) => {
+          if (options.transportType) {
+            finished = true;
+            if (settleTimer) clearTimeout(settleTimer);
+            reject(error);
+          }
+          return [];
+        }).then((devices) => {
           remaining -= 1;
           if (!finished) {
             perConnector.push({ index, devices });
@@ -371,7 +672,9 @@ function createCombinedConnector(connectors) {
       });
     });
     perConnector.sort((a, b) => a.index - b.index);
-    deviceOwner.clear();
+    for (const [id, owner] of deviceOwner) {
+      if (onTransport(owner, options.transportType)) deviceOwner.delete(id);
+    }
     const merged = [];
     perConnector.forEach(({ index, devices }) => {
       for (const device of devices) {
@@ -381,11 +684,12 @@ function createCombinedConnector(connectors) {
     });
     return merged.sort((a, b) => rank(a) - rank(b));
   };
-  const resolveOwner = async (deviceId) => {
-    if (deviceId && deviceOwner.has(deviceId)) {
-      return { owner: deviceOwner.get(deviceId), deviceId };
+  const resolveOwner = async (deviceId, transportType) => {
+    const cachedOwner = deviceId ? deviceOwner.get(deviceId) : void 0;
+    if (cachedOwner && onTransport(cachedOwner, transportType)) {
+      return { owner: cachedOwner, deviceId };
     }
-    const devices = await searchDevices({ waitForAll: Boolean(deviceId) });
+    const devices = await searchDevices({ waitForAll: Boolean(deviceId), transportType });
     if (deviceId) {
       const owner = deviceOwner.get(deviceId);
       if (!owner)
@@ -396,13 +700,14 @@ function createCombinedConnector(connectors) {
     if (!first) throw combinedDeviceNotFoundError("Combined connector: no devices found");
     return { owner: deviceOwner.get(first.connectId), deviceId: first.connectId };
   };
-  const connectByExplicitId = async (deviceId) => {
+  const connectByExplicitId = async (deviceId, transportType) => {
     const cachedOwner = deviceOwner.get(deviceId);
-    if (cachedOwner) {
+    if (cachedOwner && onTransport(cachedOwner, transportType)) {
       return { session: await cachedOwner.connect(deviceId), owner: cachedOwner };
     }
     let lastError;
     for (const child of connectors) {
+      if (!onTransport(child, transportType)) continue;
       try {
         const session = await child.connect(deviceId);
         deviceOwner.set(deviceId, child);
@@ -415,7 +720,7 @@ function createCombinedConnector(connectors) {
       }
     }
     const message = lastError instanceof Error ? lastError.message : `Combined connector: device not found: ${deviceId}`;
-    throw _chunkSZZF623Rjs.createHwkError.call(void 0, {
+    throw _chunkUFNTICCXjs.createHwkError.call(void 0, {
       code: 10100 /* DeviceNotFound */,
       message
     });
@@ -424,14 +729,15 @@ function createCombinedConnector(connectors) {
     // Nominal value only — the per-device `connectionType` is authoritative
     // for a fused connector.
     connectionType: connectors[0].connectionType,
-    searchDevices: (options) => searchDevices({ waitForAll: _optionalChain([options, 'optionalAccess', _7 => _7.waitForAll]) }),
-    connect: async (deviceId) => {
+    availableTransports: [...new Set(connectors.map((child) => child.connectionType))],
+    searchDevices: (options) => searchDevices(options),
+    connect: async (deviceId, options) => {
       let owner;
       let session;
       if (deviceId) {
-        ({ session, owner } = await connectByExplicitId(deviceId));
+        ({ session, owner } = await connectByExplicitId(deviceId, _optionalChain([options, 'optionalAccess', _22 => _22.transportType])));
       } else {
-        const resolved = await resolveOwner();
+        const resolved = await resolveOwner(void 0, _optionalChain([options, 'optionalAccess', _23 => _23.transportType]));
         owner = resolved.owner;
         session = await owner.connect(resolved.deviceId);
       }
@@ -453,15 +759,18 @@ function createCombinedConnector(connectors) {
     },
     cancel: async (sessionId) => {
       const owner = sessionOwner.get(sessionId);
-      if (!owner) return;
-      await owner.cancel(sessionId);
+      if (owner) {
+        await owner.cancel(sessionId);
+        return;
+      }
+      await Promise.all(connectors.map((child) => child.cancel(sessionId)));
     },
     uiResponse: (response) => {
       for (const child of connectors) child.uiResponse(response);
     },
     on: (event, handler) => {
       const attached = connectors.map((child) => {
-        const forward = (data) => handler(data);
+        const forward = (data) => handler(withChildConnectionType(event, data, child.connectionType));
         child.on(event, forward);
         return { child, handler: forward };
       });
@@ -474,7 +783,7 @@ function createCombinedConnector(connectors) {
     },
     off: (event, handler) => {
       const inner = forwarders.get(event);
-      const attached = _optionalChain([inner, 'optionalAccess', _8 => _8.get, 'call', _9 => _9(handler)]);
+      const attached = _optionalChain([inner, 'optionalAccess', _24 => _24.get, 'call', _25 => _25(handler)]);
       if (!attached || !inner) return;
       for (const { child, handler: forward } of attached) {
         child.off(event, forward);
@@ -489,7 +798,7 @@ function createCombinedConnector(connectors) {
       forwarders.clear();
     },
     configure: connectors.some((c) => c.configure) ? async (config) => {
-      await Promise.all(connectors.map((child) => Promise.resolve(_optionalChain([child, 'access', _10 => _10.configure, 'optionalCall', _11 => _11(config)]))));
+      await Promise.all(connectors.map((child) => Promise.resolve(_optionalChain([child, 'access', _26 => _26.configure, 'optionalCall', _27 => _27(config)]))));
       deviceOwner.clear();
       sessionOwner.clear();
     } : void 0,
@@ -533,10 +842,148 @@ var TypedEventEmitter = class {
   }
   /** Number of listeners registered for `event`. 0 if none. */
   listenerCount(event) {
-    return _nullishCoalesce(_optionalChain([this, 'access', _12 => _12._listeners, 'access', _13 => _13.get, 'call', _14 => _14(event), 'optionalAccess', _15 => _15.size]), () => ( 0));
+    return _nullishCoalesce(_optionalChain([this, 'access', _28 => _28._listeners, 'access', _29 => _29.get, 'call', _30 => _30(event), 'optionalAccess', _31 => _31.size]), () => ( 0));
   }
 };
 
+// src/utils/requestSaveDeviceBinding.ts
+function emitDeviceBindingStatus(emitter, selectionRequestId, status) {
+  emitter.emit(_chunkPY5FNLTSjs.UI_REQUEST.DEVICE_BINDING_STATUS, {
+    type: _chunkPY5FNLTSjs.UI_REQUEST.DEVICE_BINDING_STATUS,
+    payload: { selectionRequestId, status }
+  });
+}
+async function requestSaveDeviceBinding(emitter, registry, binding, signal) {
+  const type = _chunkPY5FNLTSjs.UI_REQUEST.REQUEST_SAVE_DEVICE_BINDING;
+  const emitStatus = (status) => emitDeviceBindingStatus(emitter, binding.selectionRequestId, status);
+  const declined = (reason) => {
+    emitStatus("failed");
+    return { saved: false, reason };
+  };
+  if (!emitter.listenerCount(type)) {
+    return declined("skipped");
+  }
+  if (_optionalChain([signal, 'optionalAccess', _32 => _32.aborted])) throw signal.reason;
+  const requestId = registry.createRequestId();
+  const pending = registry.wait(type, { requestId, operationId: binding.operationId });
+  void pending.catch(() => void 0);
+  const cancel = () => registry.cancel(type, requestId);
+  _optionalChain([signal, 'optionalAccess', _33 => _33.addEventListener, 'call', _34 => _34("abort", cancel, { once: true })]);
+  try {
+    emitter.emit(type, { type, payload: { ...binding, requestId } });
+    const response = await pending;
+    if (_optionalChain([signal, 'optionalAccess', _35 => _35.aborted])) throw signal.reason;
+    if (_optionalChain([response, 'optionalAccess', _36 => _36.saved]) !== true) {
+      return declined(_nullishCoalesce(_optionalChain([response, 'optionalAccess', _37 => _37.reason]), () => ( "skipped")));
+    }
+    emitStatus("saved");
+    return { saved: true };
+  } catch (error) {
+    if (_optionalChain([signal, 'optionalAccess', _38 => _38.aborted])) {
+      emitStatus("cancelled");
+      throw error;
+    }
+    return declined("skipped");
+  } finally {
+    _optionalChain([signal, 'optionalAccess', _39 => _39.removeEventListener, 'call', _40 => _40("abort", cancel)]);
+    registry.cancel(type, requestId);
+  }
+}
+
+// src/utils/requestBleDeviceSelection.ts
+async function requestBleDeviceSelection({
+  emitter,
+  registry,
+  request,
+  scan,
+  signal,
+  allowUsbFallback = false,
+  pollIntervalMs = 1500
+}) {
+  const type = _chunkPY5FNLTSjs.UI_REQUEST.REQUEST_SELECT_DEVICE;
+  if (signal.aborted) throw signal.reason;
+  if (!emitter.listenerCount(type)) {
+    throw _chunkUFNTICCXjs.createHwkError.call(void 0, {
+      code: 10100 /* DeviceNotFound */,
+      message: "Select a Bluetooth device before continuing"
+    });
+  }
+  const requestId = registry.createRequestId();
+  const { operationId } = request;
+  let devices = allowUsbFallback ? request.devices.filter((device) => device.connectionType === "ble") : request.devices;
+  const publishedDevices = /* @__PURE__ */ new Map();
+  let stopped = false;
+  let timer;
+  let wake;
+  const stop = () => {
+    stopped = true;
+    if (timer !== void 0) clearTimeout(timer);
+    _optionalChain([wake, 'optionalCall', _41 => _41()]);
+  };
+  const waitForNextScan = () => new Promise((resolve) => {
+    wake = resolve;
+    timer = setTimeout(resolve, pollIntervalMs);
+    if (stopped) resolve();
+  });
+  const cancel = () => registry.cancel(type, requestId);
+  const reply = registry.wait(type, { requestId, operationId }).finally(stop);
+  void reply.catch(() => void 0);
+  const publish = () => {
+    for (const device of devices) publishedDevices.set(device.connectId, device);
+    emitter.emit(type, {
+      type,
+      payload: { ...request, devices, requestId, scanning: true }
+    });
+  };
+  signal.addEventListener("abort", cancel, { once: true });
+  const rescan = () => scan().catch((error) => {
+    if (stopped || signal.aborted || devices.length) return void 0;
+    throw error;
+  });
+  let polling;
+  try {
+    publish();
+    polling = (async () => {
+      await Promise.resolve();
+      while (!stopped) {
+        const snapshot = await rescan();
+        if (stopped || signal.aborted) return;
+        const usbFallback = allowUsbFallback ? _optionalChain([snapshot, 'optionalAccess', _42 => _42.find, 'call', _43 => _43((device2) => device2.connectionType === "usb")]) : void 0;
+        if (usbFallback) return usbFallback;
+        if (snapshot) {
+          devices = snapshot;
+          publish();
+        }
+        await waitForNextScan();
+      }
+    })();
+    const userSelection = reply.then((selected) => publishedDevices.get(selected.sdkConnectId));
+    const device = await Promise.race([
+      userSelection,
+      polling.then((usbFallback) => _nullishCoalesce(usbFallback, () => ( userSelection)))
+    ]);
+    stop();
+    await polling;
+    if (signal.aborted) throw signal.reason;
+    if (!device) {
+      throw _chunkUFNTICCXjs.createHwkError.call(void 0, {
+        code: 10100 /* DeviceNotFound */,
+        message: "Selected Bluetooth device is no longer available"
+      });
+    }
+    emitDeviceBindingStatus(emitter, requestId, "verifying");
+    return { device, requestId };
+  } catch (error) {
+    emitDeviceBindingStatus(emitter, requestId, signal.aborted ? "cancelled" : "failed");
+    throw error;
+  } finally {
+    stop();
+    signal.removeEventListener("abort", cancel);
+    registry.cancel(type, requestId);
+    await _optionalChain([polling, 'optionalAccess', _44 => _44.catch, 'call', _45 => _45(() => void 0)]);
+  }
+}
+
 // src/utils/semver.ts
 function compareSemver(a, b) {
   const pa = a.split(".").map(Number);
@@ -564,15 +1011,481 @@ function padHex64(hex) {
 function hexToBytes(hex) {
   return _utils.hexToBytes.call(void 0, stripHex(hex));
 }
-function bytesToHex2(bytes) {
+function bytesToHex3(bytes) {
   return _utils.bytesToHex.call(void 0, bytes);
 }
 
+// src/utils/boundedCbor.ts
+var MAX_CBOR_DEPTH = 64;
+var DEFAULT_MAX_CBOR_BYTES = 8 * 1024 * 1024;
+var ARGUMENT_BYTES = [1, 2, 4, 8];
+function malformed(reason) {
+  return _chunkUFNTICCXjs.createHwkError.call(void 0, {
+    code: 10002 /* InvalidParams */,
+    message: `Malformed CBOR payload: ${reason}`
+  });
+}
+function assertBoundedCbor(input, maxBytes = DEFAULT_MAX_CBOR_BYTES) {
+  if (input.length === 0) throw malformed("empty");
+  if (input.length > maxBytes) throw malformed(`larger than ${maxBytes} bytes`);
+  let offset = 0;
+  const readArgument = (info) => {
+    if (info < 24) return info;
+    const size = ARGUMENT_BYTES[info - 24];
+    if (offset + size > input.length) throw malformed("truncated length");
+    let value = 0;
+    for (let i = 0; i < size; i += 1) value = value * 256 + input[offset + i];
+    offset += size;
+    return value;
+  };
+  const walkItem = (depth) => {
+    if (depth > MAX_CBOR_DEPTH) throw malformed("nested too deeply");
+    if (offset >= input.length) throw malformed("truncated item");
+    const initial = input[offset];
+    offset += 1;
+    const major = Math.floor(initial / 32);
+    const info = initial % 32;
+    if (info >= 28) throw malformed("indefinite or reserved length");
+    const argument = readArgument(info);
+    const remaining = input.length - offset;
+    if (major === 2 || major === 3) {
+      if (argument > remaining) throw malformed("string longer than the payload");
+      offset += argument;
+    } else if (major === 4 || major === 5) {
+      const items = major === 5 ? argument * 2 : argument;
+      if (items > remaining) throw malformed("container longer than the payload");
+      for (let i = 0; i < items; i += 1) walkItem(depth + 1);
+    } else if (major === 6) {
+      walkItem(depth + 1);
+    }
+  };
+  walkItem(0);
+  if (offset !== input.length) throw malformed("trailing bytes");
+}
+function boundedCborFromHex(hex, maxBytes) {
+  if (!/^(?:[0-9a-f]{2})+$/i.test(hex)) throw malformed("not an even-length hex string");
+  const bytes = Buffer.from(hex, "hex");
+  assertBoundedCbor(bytes, maxBytes);
+  return bytes;
+}
+
+// src/utils/solanaOffchainMessage.ts
+var SOLANA_OFFCHAIN_SIGNING_DOMAIN = Uint8Array.of(
+  255,
+  ...Array.from("solana offchain", (character) => character.charCodeAt(0))
+);
+var SOLANA_PUBLIC_KEY_LENGTH = 32;
+var MAX_SOLANA_OFFCHAIN_SIGNERS = 255;
+function compareBytes(a, b) {
+  for (let index = 0; index < a.length; index += 1) {
+    const difference = (_nullishCoalesce(a[index], () => ( 0))) - (_nullishCoalesce(b[index], () => ( 0)));
+    if (difference !== 0) return difference;
+  }
+  return a.length - b.length;
+}
+function bytesEqual(a, b) {
+  return a.length === b.length && a.every((value, index) => value === b[index]);
+}
+function decodeUtf8Strict(bytes) {
+  return decodeURIComponent(
+    Array.from(bytes, (value) => `%${value.toString(16).padStart(2, "0")}`).join("")
+  );
+}
+function prepareSolanaOffchainMessageV1({
+  message,
+  requiredSigners
+}) {
+  if (message.length === 0) {
+    throw new Error("Solana off-chain message cannot be empty");
+  }
+  if (requiredSigners.length === 0 || requiredSigners.length > MAX_SOLANA_OFFCHAIN_SIGNERS) {
+    throw new Error("Solana off-chain message requires between 1 and 255 signers");
+  }
+  let messageText;
+  try {
+    messageText = decodeUtf8Strict(message);
+  } catch (e3) {
+    throw new Error("Solana off-chain message must contain valid UTF-8");
+  }
+  const signerBytes = requiredSigners.map((signer, index) => {
+    let bytes;
+    try {
+      bytes = hexToBytes(signer);
+    } catch (e4) {
+      throw new Error(`Solana off-chain signer ${index} must be a hex public key`);
+    }
+    if (bytes.length !== SOLANA_PUBLIC_KEY_LENGTH) {
+      throw new Error(`Solana off-chain signer ${index} must be 32 bytes`);
+    }
+    return bytes;
+  });
+  signerBytes.sort(compareBytes);
+  if (signerBytes.some((bytes, index) => index > 0 && bytesEqual(signerBytes[index - 1], bytes))) {
+    throw new Error("Solana off-chain signers must be unique");
+  }
+  const signersOffset = SOLANA_OFFCHAIN_SIGNING_DOMAIN.length + 2;
+  const messageOffset = signersOffset + signerBytes.length * SOLANA_PUBLIC_KEY_LENGTH;
+  const serializedMessage = new Uint8Array(messageOffset + message.length);
+  serializedMessage.set(SOLANA_OFFCHAIN_SIGNING_DOMAIN);
+  serializedMessage.set([1, signerBytes.length], SOLANA_OFFCHAIN_SIGNING_DOMAIN.length);
+  signerBytes.forEach(
+    (signer, index) => serializedMessage.set(signer, signersOffset + index * SOLANA_PUBLIC_KEY_LENGTH)
+  );
+  serializedMessage.set(message, messageOffset);
+  return {
+    messageText,
+    requiredSigners: signerBytes.map(bytesToHex3),
+    serializedMessage
+  };
+}
+
+// src/utils/logSummary.ts
+
+
+var MAX_DEPTH = 6;
+var MAX_ARRAY_ITEMS = 20;
+var MAX_PLAIN_STRING = 64;
+var MAX_ERROR_STRING = 500;
+var normalizeKey = (key) => key.replace(/[_-]/g, "").toLowerCase();
+var keySet = (keys) => new Set(keys.map(normalizeKey));
+var KEEP_KEYS = keySet([
+  "path",
+  "paths",
+  "derivationPath",
+  "fullPath",
+  "basePath",
+  "method",
+  "methodName",
+  "chainId",
+  "coin",
+  "network",
+  "networkName",
+  "scriptType",
+  "template",
+  "appName",
+  "_tag",
+  "code",
+  "errorCode",
+  "statusCode"
+]);
+var ERROR_TEXT_KEYS = keySet(["message", "error", "errorMessage", "originalMessage"]);
+var ERROR_CONTEXT_KEYS = keySet(["error", "err", "originalError", "cause"]);
+var SECRET_KEYS = keySet([
+  "ufvk",
+  "orchardFvk",
+  "fvk",
+  "viewingKey",
+  "passphraseState",
+  "passphrase",
+  "password",
+  "pin",
+  "mnemonic",
+  "mnemonics",
+  "word",
+  "words",
+  "seed",
+  "entropy",
+  "privateKey",
+  "xprv",
+  "mac",
+  // THP pairing and channel material.
+  "credential",
+  "credentials",
+  "hostStaticKey",
+  "trezorStaticPublicKey",
+  // Wallet sessions and host connection records.
+  "session",
+  "sessionId",
+  "knownConnections",
+  "extra"
+]);
+var KEY_MATERIAL_KEYS = keySet([
+  "xpub",
+  "ypub",
+  "zpub",
+  "tpub",
+  "extendedPublicKey",
+  "publicKey",
+  "pubkey",
+  "pub",
+  "chainCode",
+  "tapInternalKey"
+]);
+var SIGNATURE_KEYS = keySet(["signature", "signatures", "sig", "r", "s", "v", "partialSig"]);
+var SIGNED_TX_KEYS = keySet(["signedTx", "signedTransaction", "signedTxHex"]);
+var SIGNED_PSBT_KEYS = keySet(["signedPsbt"]);
+var PAYLOAD_KEYS = keySet([
+  "serializedTx",
+  "rawTx",
+  "rawTxHex",
+  "txHex",
+  "tx",
+  "transaction",
+  "psbt",
+  "message",
+  "messageHex",
+  "data",
+  "dataJson",
+  "typedData",
+  "hex",
+  "bytes",
+  "apdu",
+  "domainSeparatorHash",
+  "messageHash",
+  "encodedNetwork",
+  "encodedToken",
+  "refBlockBytes",
+  "refBlockHash",
+  "opReturnData",
+  "scriptSig",
+  "witness",
+  "extraData",
+  // Structured transaction contents (Trezor-style and Tron params).
+  "contract",
+  "inputs",
+  "outputs",
+  "refTxs",
+  "paymentRequest",
+  "paymentRequests",
+  "additionalInfo",
+  "accessList",
+  "memos"
+]);
+var ADDRESS_KEYS = keySet([
+  "to",
+  "from",
+  "recipient",
+  "verifyingContract",
+  "requiredSigners",
+  "tokenMint",
+  "tokenAccount",
+  "tokenProgram"
+]);
+var TX_IN_RESULT_KEYS = keySet(["serializedTx", "rawTx", "rawTxHex", "txHex", "tx"]);
+var AMOUNT_KEYS = keySet(["value", "amount", "amounts", "fee", "fees", "tokenAmount"]);
+var ERROR_FIELDS = ["_tag", "code", "errorCode", "statusCode", "originalError"];
+var XPUB_RE = /^[a-zA-Z]pub[1-9A-HJ-NP-Za-km-z]{90,}$/;
+var HEX_RE = /^(0x)?[0-9a-fA-F]*$/;
+var EVM_TX_TYPES = {
+  1: "eip2930",
+  2: "eip1559",
+  3: "eip4844",
+  4: "eip7702"
+};
+function sha256Short(input) {
+  return _utils.bytesToHex.call(void 0, _sha256.sha256.call(void 0, typeof input === "string" ? _utils.utf8ToBytes.call(void 0, input) : input)).slice(0, 16);
+}
+function toBytes(value) {
+  if (value instanceof Uint8Array) return value;
+  if (value instanceof ArrayBuffer) return new Uint8Array(value);
+  if (ArrayBuffer.isView(value)) {
+    return new Uint8Array(value.buffer, value.byteOffset, value.byteLength);
+  }
+  if (value && typeof value === "object" && value.type === "Buffer" && Array.isArray(value.data)) {
+    return Uint8Array.from(value.data);
+  }
+  return void 0;
+}
+function isPlainHex(value) {
+  return value.length > 0 && HEX_RE.test(value) && value !== "0x";
+}
+function stripHexPrefix(value) {
+  return value.startsWith("0x") || value.startsWith("0X") ? value.slice(2) : value;
+}
+function maskAddress(value) {
+  if (value.length <= 12) return `<addr len=${value.length}>`;
+  return `${value.slice(0, 6)}\u2026${value.slice(-4)}`;
+}
+function summarizeKeyMaterial(value) {
+  const bytes = toBytes(value);
+  if (bytes) return `\u2026 len=${bytes.length}`;
+  const text = String(value);
+  return XPUB_RE.test(text) ? `${text.slice(0, 4)}\u2026 len=${text.length}` : `\u2026 len=${text.length}`;
+}
+function lengthOf(value) {
+  const bytes = toBytes(value);
+  if (bytes) return bytes.length;
+  if (typeof value === "string") return value.length;
+  const json = safeJson(value);
+  return json === void 0 ? 0 : json.length;
+}
+function safeJson(value) {
+  try {
+    return JSON.stringify(value, (_k, v) => typeof v === "bigint" ? `${v}n` : v);
+  } catch (e5) {
+    return void 0;
+  }
+}
+function evmTxType(hex) {
+  const body = stripHexPrefix(hex);
+  if (body.length < 2) return void 0;
+  const first = parseInt(body.slice(0, 2), 16);
+  if (first >= 192) return "legacy";
+  return EVM_TX_TYPES[first];
+}
+function describe(key, value, ctx) {
+  if (!ctx.describePayload) return void 0;
+  try {
+    const hint = ctx.describePayload(key, value, { method: ctx.method, role: ctx.role });
+    return typeof hint === "string" && hint.length > 0 ? hint : void 0;
+  } catch (e6) {
+    return void 0;
+  }
+}
+function jsonSummary(json, parsed) {
+  const primaryType = parsed && typeof parsed === "object" ? parsed.primaryType : void 0;
+  const hint = typeof primaryType === "string" && primaryType.length <= MAX_PLAIN_STRING ? ` primaryType=${primaryType}` : "";
+  return `<json len=${json.length} sha256=${sha256Short(json)}${hint}>`;
+}
+function summarizePayload(key, value, ctx) {
+  if (value === null || value === void 0 || typeof value === "boolean") return value;
+  if (typeof value === "number") return value;
+  const bytes = toBytes(value);
+  if (bytes) {
+    const hint = describe(key, bytes, ctx);
+    return `<hex len=${bytes.length} sha256=${sha256Short(bytes)}${hint ? ` ${hint}` : ""}>`;
+  }
+  if (typeof value === "string") {
+    const trimmed = value.trim();
+    if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
+      try {
+        return jsonSummary(value, JSON.parse(value));
+      } catch (e7) {
+      }
+    }
+    const hints = [];
+    if (key === "serializedtx" && ctx.method.startsWith("evm") && isPlainHex(value)) {
+      const type = evmTxType(value);
+      if (type) hints.push(`type=${type}`);
+    }
+    const extra = describe(key, value, ctx);
+    if (extra) hints.push(extra);
+    const kind = isPlainHex(value) ? "hex" : "str";
+    const suffix = hints.length ? ` ${hints.join(" ")}` : "";
+    return `<${kind} len=${value.length} sha256=${sha256Short(value)}${suffix}>`;
+  }
+  const json = safeJson(value);
+  if (json === void 0) return "<object unhashable>";
+  return jsonSummary(json, value);
+}
+function summarizeString(value, key, ctx) {
+  if (key && KEEP_KEYS.has(key)) return value;
+  if (key && ctx.inError && ERROR_TEXT_KEYS.has(key)) {
+    return value.length > MAX_ERROR_STRING ? `${value.slice(0, MAX_ERROR_STRING)}\u2026` : value;
+  }
+  if (XPUB_RE.test(value)) return summarizeKeyMaterial(value);
+  if (value.length <= MAX_PLAIN_STRING) return value;
+  const kind = isPlainHex(value) ? "hex" : "str";
+  return `<${kind} len=${value.length} sha256=${sha256Short(value)}>`;
+}
+function summarizeError(err, depth, ctx) {
+  const e = err;
+  const out = {
+    name: err.name,
+    message: summarizeString(err.message, "message", ctx)
+  };
+  for (const field of ERROR_FIELDS) {
+    if (e[field] !== void 0) {
+      out[field] = summarizeValue(e[field], normalizeKey(field), depth + 1, ctx);
+    }
+  }
+  return out;
+}
+function summarizeByKey(rawKey, value, depth, ctx) {
+  const k = normalizeKey(rawKey);
+  if (value === void 0 || value === null) return value;
+  if (SECRET_KEYS.has(k)) return `<redacted len=${lengthOf(value)}>`;
+  if (KEY_MATERIAL_KEYS.has(k)) {
+    if (typeof value === "string" || toBytes(value)) return summarizeKeyMaterial(value);
+  }
+  if (SIGNATURE_KEYS.has(k)) {
+    if (Array.isArray(value)) return `<signatures count=${value.length}>`;
+    return `<signature len=${lengthOf(value)}>`;
+  }
+  if (SIGNED_PSBT_KEYS.has(k)) return `<psbt len=${lengthOf(value)}>`;
+  if (SIGNED_TX_KEYS.has(k) || ctx.role === "result" && TX_IN_RESULT_KEYS.has(k)) {
+    return `<signedTx len=${lengthOf(value)}>`;
+  }
+  if (AMOUNT_KEYS.has(k)) return "<amount>";
+  if (ctx.inError && ERROR_TEXT_KEYS.has(k) && typeof value === "string") {
+    return summarizeString(value, k, ctx);
+  }
+  if (PAYLOAD_KEYS.has(k)) return summarizePayload(k, value, ctx);
+  if (ADDRESS_KEYS.has(k) || k.endsWith("address") || k.endsWith("addresses")) {
+    if (typeof value === "string") return maskAddress(value);
+    if (Array.isArray(value)) {
+      return capArray(value, (item) => typeof item === "string" ? maskAddress(item) : "<addr>");
+    }
+  }
+  const inError = ERROR_CONTEXT_KEYS.has(k);
+  const childCtx = inError === ctx.inError ? ctx : { ...ctx, inError };
+  return summarizeValue(value, k, depth, childCtx);
+}
+function capArray(items, map) {
+  const out = items.slice(0, MAX_ARRAY_ITEMS).map(map);
+  if (items.length > MAX_ARRAY_ITEMS) out.push(`\u2026+${items.length - MAX_ARRAY_ITEMS} more`);
+  return out;
+}
+function summarizeValue(value, key, depth, ctx) {
+  switch (typeof value) {
+    case "undefined":
+    case "boolean":
+      return value;
+    case "number":
+      return Number.isFinite(value) ? value : String(value);
+    case "bigint":
+      return `${value}n`;
+    case "string":
+      return summarizeString(value, key, ctx);
+    case "function":
+      return "<function>";
+    case "symbol":
+      return "<symbol>";
+    default:
+      break;
+  }
+  if (value === null) return null;
+  const bytes = toBytes(value);
+  if (bytes) return `<hex len=${bytes.length} sha256=${sha256Short(bytes)}>`;
+  const obj = value;
+  if (ctx.ancestors.has(obj)) return "<circular>";
+  if (depth >= MAX_DEPTH) return "<depth>";
+  ctx.ancestors.add(obj);
+  try {
+    if (value instanceof Error) return summarizeError(value, depth, { ...ctx, inError: true });
+    if (Array.isArray(value)) {
+      return capArray(value, (item) => summarizeValue(item, key, depth + 1, ctx));
+    }
+    const out = {};
+    for (const [childKey, child] of Object.entries(value)) {
+      out[childKey] = summarizeByKey(childKey, child, depth + 1, ctx);
+    }
+    return out;
+  } finally {
+    ctx.ancestors.delete(obj);
+  }
+}
+function summarizeForLog(value, options = {}) {
+  try {
+    return summarizeValue(value, void 0, 0, {
+      method: _nullishCoalesce(options.method, () => ( "")),
+      role: _nullishCoalesce(options.role, () => ( "params")),
+      describePayload: options.describePayload,
+      inError: false,
+      ancestors: /* @__PURE__ */ new Set()
+    });
+  } catch (e8) {
+    return "<unloggable>";
+  }
+}
+
 // src/utils/deviceIdentity.ts
 var ONEKEY_BLE_SERVICE_UUID = "00000001-0000-1000-8000-00805f9b34fb";
 var TREZOR_BLE_SERVICE_UUID = "8c000001-a59b-4d58-a9ad-073df69fa1b1";
 var LEDGER_USB_VENDOR_ID = 11415;
-var lower = (value) => _nullishCoalesce(_optionalChain([value, 'optionalAccess', _16 => _16.trim, 'call', _17 => _17(), 'access', _18 => _18.toLowerCase, 'call', _19 => _19()]), () => ( ""));
+var KEYSTONE_USB_VENDOR_ID = 4617;
+var KEYSTONE_USB_PRODUCT_ID = 12289;
+var lower = (value) => _nullishCoalesce(_optionalChain([value, 'optionalAccess', _46 => _46.trim, 'call', _47 => _47(), 'access', _48 => _48.toLowerCase, 'call', _49 => _49()]), () => ( ""));
 var hasServiceUuid = (input, uuid) => {
   const expected = uuid.toLowerCase();
   const values = [
@@ -594,6 +1507,11 @@ function detectHardwareVendorFromDescriptor(input) {
   if (typeof input.vendor === "number" && input.vendor === LEDGER_USB_VENDOR_ID || input.vendorId === LEDGER_USB_VENDOR_ID || manufacturerName.includes("ledger")) {
     return "ledger";
   }
+  const usbVendorId = typeof input.vendor === "number" ? input.vendor : input.vendorId;
+  const usbProductId = typeof input.product === "number" ? input.product : input.productId;
+  if (usbVendorId === KEYSTONE_USB_VENDOR_ID && usbProductId === KEYSTONE_USB_PRODUCT_ID || manufacturerName.includes("keystone")) {
+    return "keystone";
+  }
   return void 0;
 }
 function isKnownNonTargetHardwareVendor(input, targetVendor) {
@@ -610,35 +1528,69 @@ async function batchCall(params, callFn, onProgress) {
       return result;
     }
     results.push(result.payload);
-    _optionalChain([onProgress, 'optionalCall', _20 => _20({ index: i, total: params.length })]);
+    _optionalChain([onProgress, 'optionalCall', _50 => _50({ index: i, total: params.length })]);
   }
   return { success: true, payload: results };
 }
 
 // src/utils/methodCatalog.ts
 var HARDWARE_METHOD_CATALOG = {
-  evmGetAddress: { chain: "evm", allNetwork: true },
-  evmSignTransaction: { chain: "evm", allNetwork: false },
-  evmSignMessage: { chain: "evm", allNetwork: false },
-  evmSignTypedData: { chain: "evm", allNetwork: false },
-  btcGetAddress: { chain: "btc", allNetwork: true },
-  btcGetPublicKey: { chain: "btc", allNetwork: true },
-  btcSignTransaction: { chain: "btc", allNetwork: false },
-  btcSignPsbt: { chain: "btc", allNetwork: false },
-  btcSignMessage: { chain: "btc", allNetwork: false },
-  btcGetMasterFingerprint: { chain: "btc", allNetwork: false },
-  solGetAddress: { chain: "sol", allNetwork: true },
-  solSignTransaction: { chain: "sol", allNetwork: false },
-  solSignMessage: { chain: "sol", allNetwork: false },
-  tronGetAddress: { chain: "tron", allNetwork: true },
-  tronSignTransaction: { chain: "tron", allNetwork: false },
-  tronSignMessage: { chain: "tron", allNetwork: false }
+  evmGetAddress: { chain: "evm", allNetwork: true, replayAfterTransportFailure: "safe" },
+  evmSignTransaction: {
+    chain: "evm",
+    allNetwork: false,
+    replayAfterTransportFailure: "unsafe"
+  },
+  evmSignMessage: { chain: "evm", allNetwork: false, replayAfterTransportFailure: "unsafe" },
+  evmSignTypedData: { chain: "evm", allNetwork: false, replayAfterTransportFailure: "unsafe" },
+  btcGetAddress: { chain: "btc", allNetwork: true, replayAfterTransportFailure: "safe" },
+  btcGetPublicKey: { chain: "btc", allNetwork: true, replayAfterTransportFailure: "safe" },
+  btcSignTransaction: {
+    chain: "btc",
+    allNetwork: false,
+    replayAfterTransportFailure: "unsafe"
+  },
+  btcSignPsbt: { chain: "btc", allNetwork: false, replayAfterTransportFailure: "unsafe" },
+  btcSignMessage: { chain: "btc", allNetwork: false, replayAfterTransportFailure: "unsafe" },
+  btcGetMasterFingerprint: {
+    chain: "btc",
+    allNetwork: false,
+    replayAfterTransportFailure: "safe"
+  },
+  solGetAddress: { chain: "sol", allNetwork: true, replayAfterTransportFailure: "safe" },
+  solSignTransaction: {
+    chain: "sol",
+    allNetwork: false,
+    replayAfterTransportFailure: "unsafe"
+  },
+  solSignMessage: { chain: "sol", allNetwork: false, replayAfterTransportFailure: "unsafe" },
+  tronGetAddress: { chain: "tron", allNetwork: true, replayAfterTransportFailure: "safe" },
+  tronSignTransaction: {
+    chain: "tron",
+    allNetwork: false,
+    replayAfterTransportFailure: "unsafe"
+  },
+  tronSignMessage: { chain: "tron", allNetwork: false, replayAfterTransportFailure: "unsafe" },
+  zcashGetFullViewingKey: {
+    chain: "zcash",
+    allNetwork: false,
+    replayAfterTransportFailure: "safe"
+  },
+  zcashGetShieldedAddress: {
+    chain: "zcash",
+    allNetwork: false,
+    replayAfterTransportFailure: "safe"
+  }
 };
 var ALL_NETWORK_METHOD_NAMES = Object.entries(HARDWARE_METHOD_CATALOG).filter(([, metadata]) => metadata.allNetwork).map(([method]) => method);
 var ALL_NETWORK_METHOD_SET = new Set(ALL_NETWORK_METHOD_NAMES);
 function getHardwareMethodMetadata(method) {
   return HARDWARE_METHOD_CATALOG[method];
 }
+var SAFE_NON_CHAIN_METHODS = /* @__PURE__ */ new Set(["getFeatures", "authenticateDevice"]);
+function canReplayHardwareMethodAfterTransportFailure(method) {
+  return _optionalChain([getHardwareMethodMetadata, 'call', _51 => _51(method), 'optionalAccess', _52 => _52.replayAfterTransportFailure]) === "safe" || SAFE_NON_CHAIN_METHODS.has(method);
+}
 function isAllNetworkMethodName(method) {
   return ALL_NETWORK_METHOD_SET.has(method);
 }
@@ -666,7 +1618,7 @@ async function runAllNetworkGetAddress({
       continue;
     }
     const method = item.methodName;
-    const unsupportedNetwork = _optionalChain([buildUnsupportedNetworkResponse, 'optionalCall', _21 => _21(item, method)]);
+    const unsupportedNetwork = _optionalChain([buildUnsupportedNetworkResponse, 'optionalCall', _53 => _53(item, method)]);
     if (unsupportedNetwork) {
       responses.push(unsupportedNetwork);
       continue;
@@ -698,6 +1650,38 @@ async function runAllNetworkGetAddress({
   }
   return success(responses);
 }
+function isUserRefusal(code) {
+  return code === 10005 /* UserAborted */ || code === 10001 /* UserRejected */ || code === 10401 /* PinCancelled */;
+}
+function isWalletSafetyFailure(code) {
+  const codes = [
+    10106 /* DeviceMismatch */,
+    10114 /* DeviceSearchMismatch */,
+    10103 /* DeviceLocked */,
+    10400 /* PinInvalid */,
+    10404 /* PinMismatch */,
+    10402 /* PassphraseRejected */,
+    10403 /* PassphraseStateMismatch */,
+    10405 /* PassphraseAlwaysOnDevice */
+  ];
+  return code !== void 0 && codes.includes(code);
+}
+function isConnectionLost(code) {
+  const codes = [
+    10101 /* DeviceDisconnected */,
+    10003 /* OperationTimeout */,
+    10300 /* TransportError */,
+    10113 /* OperationEnded */,
+    10112 /* OperationNotFound */
+  ];
+  return code !== void 0 && codes.includes(code);
+}
+function buildAllNetworkCancelledFailure(signal) {
+  const reason = signal.reason;
+  const code = typeof _optionalChain([reason, 'optionalAccess', _54 => _54.code]) === "number" ? reason.code : 10005 /* UserAborted */;
+  const message = typeof _optionalChain([reason, 'optionalAccess', _55 => _55.message]) === "string" ? reason.message : "";
+  return failure(code, message || "All-network get-address cancelled");
+}
 function buildUnsupportedMethodResponse(item) {
   return {
     ...item,
@@ -766,5 +1750,37 @@ var DEVICE_CONNECT_RETRY_DELAY_MS = 1e3;
 
 
 
-exports.ALL_NETWORK_METHOD_NAMES = ALL_NETWORK_METHOD_NAMES; exports.CHAIN_FINGERPRINT_PATHS = CHAIN_FINGERPRINT_PATHS; exports.DEVICE = DEVICE; exports.DEVICE_CONNECT_RETRY_DELAY_MS = DEVICE_CONNECT_RETRY_DELAY_MS; exports.DEVICE_EVENT = DEVICE_EVENT; exports.DeviceJobQueue = DeviceJobQueue; exports.EConnectorInteraction = EConnectorInteraction; exports.HARDWARE_METHOD_CATALOG = HARDWARE_METHOD_CATALOG; exports.HardwareErrorCode = _chunkSZZF623Rjs.HardwareErrorCode; exports.ORPHAN_ELIGIBLE_ERROR_CODES = _chunkSZZF623Rjs.ORPHAN_ELIGIBLE_ERROR_CODES; exports.SDK = SDK; exports.TypedEventEmitter = TypedEventEmitter; exports.UI_EVENT = _chunkBAGEFFFYjs.UI_EVENT; exports.UI_REQUEST = _chunkBAGEFFFYjs.UI_REQUEST; exports.UI_REQUEST_CANCELLED_TAG = _chunkBAGEFFFYjs.UI_REQUEST_CANCELLED_TAG; exports.UI_REQUEST_DEFAULT_TIMEOUT_MS = _chunkBAGEFFFYjs.UI_REQUEST_DEFAULT_TIMEOUT_MS; exports.UI_REQUEST_PREEMPTED_TAG = _chunkBAGEFFFYjs.UI_REQUEST_PREEMPTED_TAG; exports.UI_REQUEST_TIMEOUT_TAG = _chunkBAGEFFFYjs.UI_REQUEST_TIMEOUT_TAG; exports.UI_RESPONSE = _chunkBAGEFFFYjs.UI_RESPONSE; exports.UiRequestRegistry = _chunkBAGEFFFYjs.UiRequestRegistry; exports.batchCall = batchCall; exports.buildUnsupportedMethodResponse = buildUnsupportedMethodResponse; exports.bytesToHex = bytesToHex2; exports.compareSemver = compareSemver; exports.createBridgedConnector = createBridgedConnector; exports.createCombinedConnector = createCombinedConnector; exports.createHwkError = _chunkSZZF623Rjs.createHwkError; exports.deriveDeviceFingerprint = deriveDeviceFingerprint; exports.detectHardwareVendorFromDescriptor = detectHardwareVendorFromDescriptor; exports.enrichErrorMessage = _chunkSZZF623Rjs.enrichErrorMessage; exports.ensure0x = ensure0x; exports.failure = failure; exports.getAllNetworkMethodChain = getAllNetworkMethodChain; exports.getHardwareMethodMetadata = getHardwareMethodMetadata; exports.hexToBytes = hexToBytes; exports.isAllNetworkMethodName = isAllNetworkMethodName; exports.isKnownNonTargetHardwareVendor = isKnownNonTargetHardwareVendor; exports.padHex64 = padHex64; exports.rehydrateConnectorError = rehydrateConnectorError; exports.runAllNetworkGetAddress = runAllNetworkGetAddress; exports.serializeConnectorError = serializeConnectorError; exports.stripHex = stripHex; exports.success = success;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+exports.ALL_NETWORK_METHOD_NAMES = ALL_NETWORK_METHOD_NAMES; exports.CHAIN_FINGERPRINT_PATHS = CHAIN_FINGERPRINT_PATHS; exports.DEVICE = DEVICE; exports.DEVICE_CONNECT_RETRY_DELAY_MS = DEVICE_CONNECT_RETRY_DELAY_MS; exports.DEVICE_EVENT = DEVICE_EVENT; exports.DeviceJobQueue = DeviceJobQueue; exports.EConnectorInteraction = EConnectorInteraction; exports.HARDWARE_METHOD_CATALOG = HARDWARE_METHOD_CATALOG; exports.HARDWARE_RUNTIME_ID_PREFIX = HARDWARE_RUNTIME_ID_PREFIX; exports.HardwareErrorCode = _chunkUFNTICCXjs.HardwareErrorCode; exports.MISSING_BIP32_MASTER_FINGERPRINT = MISSING_BIP32_MASTER_FINGERPRINT; exports.OPERATION_DEFAULT_TTL_MS = OPERATION_DEFAULT_TTL_MS; exports.ORPHAN_ELIGIBLE_ERROR_CODES = _chunkUFNTICCXjs.ORPHAN_ELIGIBLE_ERROR_CODES; exports.OperationRegistry = OperationRegistry; exports.SDK = SDK; exports.TypedEventEmitter = TypedEventEmitter; exports.UI_EVENT = _chunkPY5FNLTSjs.UI_EVENT; exports.UI_REQUEST = _chunkPY5FNLTSjs.UI_REQUEST; exports.UI_REQUEST_CANCELLED_TAG = _chunkPY5FNLTSjs.UI_REQUEST_CANCELLED_TAG; exports.UI_REQUEST_DEFAULT_TIMEOUT_MS = _chunkPY5FNLTSjs.UI_REQUEST_DEFAULT_TIMEOUT_MS; exports.UI_REQUEST_PREEMPTED_TAG = _chunkPY5FNLTSjs.UI_REQUEST_PREEMPTED_TAG; exports.UI_REQUEST_TIMEOUT_TAG = _chunkPY5FNLTSjs.UI_REQUEST_TIMEOUT_TAG; exports.UI_RESPONSE = _chunkPY5FNLTSjs.UI_RESPONSE; exports.UiRequestRegistry = _chunkPY5FNLTSjs.UiRequestRegistry; exports.assertBoundedCbor = assertBoundedCbor; exports.batchCall = batchCall; exports.boundedCborFromHex = boundedCborFromHex; exports.buildAllNetworkCancelledFailure = buildAllNetworkCancelledFailure; exports.buildUnsupportedMethodResponse = buildUnsupportedMethodResponse; exports.bytesToHex = bytesToHex3; exports.canReplayHardwareMethodAfterTransportFailure = canReplayHardwareMethodAfterTransportFailure; exports.compareSemver = compareSemver; exports.createBridgedConnector = createBridgedConnector; exports.createCombinedConnector = createCombinedConnector; exports.createHardwareLinkId = createHardwareLinkId; exports.createHardwareOperationId = createHardwareOperationId; exports.createHardwareSearchTargetId = createHardwareSearchTargetId; exports.createHwkError = _chunkUFNTICCXjs.createHwkError; exports.defaultOriginForCode = _chunkUFNTICCXjs.defaultOriginForCode; exports.defaultRecoveryForCode = _chunkUFNTICCXjs.defaultRecoveryForCode; exports.deriveDeviceFingerprint = deriveDeviceFingerprint; exports.detectHardwareVendorFromDescriptor = detectHardwareVendorFromDescriptor; exports.emitDeviceBindingStatus = emitDeviceBindingStatus; exports.enrichErrorMessage = _chunkYLCHSNXOjs.enrichErrorMessage; exports.ensure0x = ensure0x; exports.failure = failure; exports.getAllNetworkMethodChain = getAllNetworkMethodChain; exports.getHardwareMethodMetadata = getHardwareMethodMetadata; exports.hasHardwareRuntimeIdPrefix = hasHardwareRuntimeIdPrefix; exports.hexToBytes = hexToBytes; exports.isAllNetworkMethodName = isAllNetworkMethodName; exports.isConnectionLost = isConnectionLost; exports.isHardwareOperationId = isHardwareOperationId; exports.isHwkRecoveryHint = _chunkUFNTICCXjs.isHwkRecoveryHint; exports.isKnownNonTargetHardwareVendor = isKnownNonTargetHardwareVendor; exports.isUserRefusal = isUserRefusal; exports.isWalletSafetyFailure = isWalletSafetyFailure; exports.operationMayHaveCompletedParams = _chunkUFNTICCXjs.operationMayHaveCompletedParams; exports.padHex64 = padHex64; exports.parseBip32MasterFingerprint = parseBip32MasterFingerprint; exports.parseHardwareRuntimeId = parseHardwareRuntimeId; exports.parseWalletMasterFingerprint = parseWalletMasterFingerprint; exports.pickConnectionContext = pickConnectionContext; exports.prepareSolanaOffchainMessageV1 = prepareSolanaOffchainMessageV1; exports.rehydrateConnectorError = rehydrateConnectorError; exports.requestBleDeviceSelection = requestBleDeviceSelection; exports.requestSaveDeviceBinding = requestSaveDeviceBinding; exports.resolveHardwareOperationTarget = resolveHardwareOperationTarget; exports.resolveSearchTargetReusePolicy = resolveSearchTargetReusePolicy; exports.runAllNetworkGetAddress = runAllNetworkGetAddress; exports.serializeConnectorError = serializeConnectorError; exports.stripHex = stripHex; exports.success = success; exports.summarizeForLog = summarizeForLog; exports.toPhysicalDeviceSearchTarget = toPhysicalDeviceSearchTarget;
 //# sourceMappingURL=index.js.map