@onekeyfe/hwk-keystone-adapter 1.2.3-alpha.3 → 1.2.3-alpha.8

package/dist/index.mjs

@@ -27,6 +27,7 @@ var TronSignRequest = class _TronSignRequest extends RegistryItem {
     this.getSignData = () => this.signData;
     this.getSignType = () => this.signType;
     this.getDerivationPath = () => this.derivationPath.getPath();
+    this.getOrigin = () => this.origin;
     this.toDataItem = () => {
       const map = {};
       if (this.requestId) {
@@ -461,8 +462,10 @@ import {
   getAllNetworkMethodChain,
   hasHardwareRuntimeIdPrefix,
   isAllNetworkMethodName,
-  isHardwareOperationId,
+  isConnectionLost,
+  isHardwareOperationId as isHardwareOperationId2,
   isHwkRecoveryHint,
+  isUserRefusal,
   operationMayHaveCompletedParams,
   parseBip32MasterFingerprint as parseBip32MasterFingerprint2,
   rehydrateConnectorError,
@@ -581,8 +584,29 @@ function placeholderDeviceInfo() {
   };
 }
 
+// src/utils/queueKey.ts
+import { isHardwareOperationId } from "@onekeyfe/hwk-adapter-core";
+var KEYSTONE_COLD_START_JOB_LABEL = "keystone-cold-start";
+function keystoneQueueKey(connectId, deviceId) {
+  return isHardwareOperationId(connectId) ? connectId : deviceId || connectId || KEYSTONE_COLD_START_JOB_LABEL;
+}
+function keystoneWalletIdFromIdentifier(identifier) {
+  const value = identifier.startsWith(KEYSTONE_WALLET_CONNECT_ID_PREFIX) ? identifier.slice(KEYSTONE_WALLET_CONNECT_ID_PREFIX.length) : identifier;
+  return /^[0-9a-f]{64}$/i.test(value) ? value.toLowerCase() : void 0;
+}
+function keystoneCancelQueueKeys(identifiers) {
+  const keys = /* @__PURE__ */ new Set();
+  for (const identifier of identifiers) {
+    if (identifier) {
+      keys.add(identifier);
+      const walletId = keystoneWalletIdFromIdentifier(identifier);
+      if (walletId) keys.add(walletId);
+    }
+  }
+  return keys;
+}
+
 // src/adapter/KeystoneAdapter.ts
-var COLD_START_JOB_LABEL = "keystone-cold-start";
 var KEYSTONE_USB_REATTACH_PROBE_ATTEMPTS = 4;
 var KEYSTONE_USB_REATTACH_PROBE_INTERVAL_MS = 500;
 function resolveHardwareOperationTarget(positionalTargetId, operationId) {
@@ -594,8 +618,11 @@ function waitForKeystoneUsbReattachProbe() {
     setTimeout(resolve, KEYSTONE_USB_REATTACH_PROBE_INTERVAL_MS);
   });
 }
-function getKeystoneJobId(connectId, deviceId) {
-  return isHardwareOperationId(connectId) ? connectId : deviceId || connectId || COLD_START_JOB_LABEL;
+function buildCancelledFailure(signal) {
+  const reason = signal.reason;
+  const code = typeof reason?.code === "number" ? reason.code : HardwareErrorCode.UserAborted;
+  const message = typeof reason?.message === "string" ? reason.message : "";
+  return failure(code, message || "All-network get-address cancelled");
 }
 var BIP44_COIN_TYPE_TO_CHAIN = {
   60: "evm",
@@ -610,6 +637,9 @@ function inferHwkChainFromPath(path) {
 var KeystoneAdapter = class _KeystoneAdapter {
   constructor(options) {
     this.vendor = "keystone";
+    // No protocol-level cancel exists over Keystone USB, and QR has no transport
+    // to interrupt at all. Cancelling ends the wait, not the device's prompt.
+    this.cancelCapability = "stops-waiting";
     this.emitter = new TypedEventEmitter();
     this._operationRoutes = /* @__PURE__ */ new Map();
     this._operations = new OperationRegistry({
@@ -663,6 +693,7 @@ var KeystoneAdapter = class _KeystoneAdapter {
       if (!operationTarget.success) return operationTarget;
       const effectiveConnectId = operationTarget.payload.targetId ?? "";
       const { operationId } = operationTarget.payload;
+      let cancelScope;
       try {
         const prefetched = await this._prefetchAllNetworkAccounts(
           effectiveConnectId,
@@ -671,11 +702,20 @@ var KeystoneAdapter = class _KeystoneAdapter {
         );
         const { book } = prefetched;
         const itemDeviceId = deviceId || prefetched.walletId || "";
+        const scope = this._jobQueue.createCancelScope(
+          keystoneQueueKey(effectiveConnectId, itemDeviceId)
+        );
+        cancelScope = scope;
+        const cancelledIndexes = /* @__PURE__ */ new Set();
         return await runAllNetworkGetAddress({
           connectId: effectiveConnectId,
           deviceId: itemDeviceId,
           params,
-          callItem: async ({ method, item }) => {
+          callItem: async ({ method, item, index }) => {
+            if (scope.signal.aborted) {
+              cancelledIndexes.add(index);
+              return buildCancelledFailure(scope.signal);
+            }
             const commonArgs = {
               path: item.path,
               showOnDevice: item.showOnDevice,
@@ -714,10 +754,19 @@ var KeystoneAdapter = class _KeystoneAdapter {
                 } : void 0
               }
             });
+          },
+          // The gap check plus the shared top-level table: a refusal or a lost
+          // session ends the batch, every other per-item failure keeps its
+          // existing "carry on with the next chain" behaviour.
+          shouldAbortBundle: (response, { index }) => {
+            const { code } = response.payload ?? {};
+            return cancelledIndexes.has(index) || isUserRefusal(code) || isConnectionLost(code);
           }
         });
       } catch (err) {
         return this._errorToFailure(err);
+      } finally {
+        cancelScope?.release();
       }
     };
     this._origin = options?.origin ?? "OneKey";
@@ -915,6 +964,7 @@ var KeystoneAdapter = class _KeystoneAdapter {
         searchTargetId,
         connectId: connected.payload.connectId,
         device: connected.payload,
+        connectionType: selectedConnectionType,
         connectionKeys: selectedConnectionType === "usb" && record?.usbSessionId ? [record.usbSessionId] : []
       });
       this._operationRoutes.set(connected.payload.connectId, {
@@ -967,7 +1017,7 @@ var KeystoneAdapter = class _KeystoneAdapter {
   }
   getDeviceInfo(connectIdOrOperationId, deviceId) {
     try {
-      const connectId = isHardwareOperationId(connectIdOrOperationId) ? this._operations.resolve(connectIdOrOperationId).connectId : connectIdOrOperationId;
+      const connectId = isHardwareOperationId2(connectIdOrOperationId) ? this._operations.resolve(connectIdOrOperationId).connectId : connectIdOrOperationId;
       const { record } = this._resolveTarget(connectId, deviceId);
       if (!record) {
         return Promise.resolve(
@@ -983,25 +1033,35 @@ var KeystoneAdapter = class _KeystoneAdapter {
     }
   }
   cancel(connectId) {
+    let namedOperationConnectId;
+    if (isHardwareOperationId2(connectId)) {
+      try {
+        namedOperationConnectId = this._operations.resolve(connectId).connectId;
+      } catch {
+        return;
+      }
+    }
     const reason = createHwkError({
       code: HardwareErrorCode.UserAborted,
       message: "User aborted operation"
     });
-    const activeJobId = this._jobQueue.getActiveJob()?.deviceId;
     if (connectId) {
-      if (!activeJobId || activeJobId !== connectId && activeJobId !== this._walletIdFromIdentifier(connectId)) {
-        this._jobQueue.cancelActiveAndPending(connectId, reason);
-        const walletId = this._walletIdFromIdentifier(connectId);
-        if (walletId && walletId !== connectId) {
-          this._jobQueue.cancelActiveAndPending(walletId, reason);
-        }
-        return;
+      const queueKeys = keystoneCancelQueueKeys([
+        connectId,
+        this._operationRoutes.get(connectId)?.operationId,
+        namedOperationConnectId
+      ]);
+      for (const key of queueKeys) {
+        this._jobQueue.cancelActiveAndPending(key, reason);
+      }
+      const scopedOperationId = isHardwareOperationId2(connectId) ? connectId : this._operationRouteForIdentifier(connectId)?.operationId;
+      if (scopedOperationId) {
+        this._uiRegistry.cancel(void 0, void 0, scopedOperationId);
       }
-      this._jobQueue.cancelActiveAndPending(activeJobId, reason);
     } else {
       this._jobQueue.cancelActiveAndPending(void 0, reason);
+      this._uiRegistry.cancel();
     }
-    this._uiRegistry.cancel();
   }
   getChainFingerprint(connectId, deviceId, chain) {
     try {
@@ -1036,20 +1096,21 @@ var KeystoneAdapter = class _KeystoneAdapter {
   // ---------------------------------------------------------------------------
   async importFromQr(options = {}) {
     try {
-      return await this._jobQueue.enqueue(COLD_START_JOB_LABEL, async (signal) => {
+      return await this._jobQueue.enqueue(KEYSTONE_COLD_START_JOB_LABEL, async (signal) => {
         const displayDevice = placeholderDeviceInfo();
         let responseUr;
         if (options.mode === "scan") {
-          responseUr = await this._requestQrScanAndAwaitResponse(displayDevice);
+          responseUr = await this._requestQrScanAndAwaitResponse(displayDevice, signal);
         } else {
           const requestUr = this.urEngine.buildKeyDerivationRequest({
             schemas: [{ path: KEYSTONE_WALLET_ID_PATH, curve: "secp256k1" }],
             origin: this._origin
           });
-          responseUr = await this._requestQrDisplayAndAwaitResponse(displayDevice, {
-            ...requestUr,
-            animated: false
-          });
+          responseUr = await this._requestQrDisplayAndAwaitResponse(
+            displayDevice,
+            { ...requestUr, animated: false },
+            signal
+          );
         }
         _KeystoneAdapter._throwIfAborted(signal);
         const parsed = this.urEngine.parseAccountResponse(responseUr);
@@ -1080,7 +1141,7 @@ var KeystoneAdapter = class _KeystoneAdapter {
       );
     }
     try {
-      return await this._jobQueue.enqueue(getKeystoneJobId(connectId, deviceId), async (signal) => {
+      return await this._jobQueue.enqueue(keystoneQueueKey(connectId, deviceId), async (signal) => {
         const { account } = await this._fetchAccount(
           connectId,
           deviceId,
@@ -1126,7 +1187,7 @@ var KeystoneAdapter = class _KeystoneAdapter {
     const rawTxHex = stripHex(params.serializedTx);
     const path = normalizePath(params.path);
     try {
-      return await this._jobQueue.enqueue(getKeystoneJobId(connectId, deviceId), async (signal) => {
+      return await this._jobQueue.enqueue(keystoneQueueKey(connectId, deviceId), async (signal) => {
         const { record } = await this._ensureWalletKnown(connectId, deviceId, "evm", signal);
         _KeystoneAdapter._throwIfAborted(signal);
         const requestId = uuidv4();
@@ -1137,7 +1198,8 @@ var KeystoneAdapter = class _KeystoneAdapter {
           dataType,
           path,
           xfp: record.masterFingerprint,
-          chainId: params.chainId
+          chainId: params.chainId,
+          origin: this._origin
         });
         const responseUr = await this._resolveUr(
           record,
@@ -1176,7 +1238,7 @@ var KeystoneAdapter = class _KeystoneAdapter {
     const messageHex = params.hex ? stripHex(params.message) : Buffer.from(params.message, "utf8").toString("hex");
     const path = normalizePath(params.path);
     try {
-      return await this._jobQueue.enqueue(getKeystoneJobId(connectId, deviceId), async (signal) => {
+      return await this._jobQueue.enqueue(keystoneQueueKey(connectId, deviceId), async (signal) => {
         const { record } = await this._ensureWalletKnown(connectId, deviceId, "evm", signal);
         _KeystoneAdapter._throwIfAborted(signal);
         const requestId = uuidv4();
@@ -1186,7 +1248,8 @@ var KeystoneAdapter = class _KeystoneAdapter {
           dataType: "personalMessage",
           path,
           xfp: record.masterFingerprint,
-          chainId: params.chainId
+          chainId: params.chainId,
+          origin: this._origin
         });
         const responseUr = await this._resolveUr(
           record,
@@ -1228,7 +1291,7 @@ var KeystoneAdapter = class _KeystoneAdapter {
     ).toString("hex");
     const path = normalizePath(params.path);
     try {
-      return await this._jobQueue.enqueue(getKeystoneJobId(connectId, deviceId), async (signal) => {
+      return await this._jobQueue.enqueue(keystoneQueueKey(connectId, deviceId), async (signal) => {
         const { record } = await this._ensureWalletKnown(connectId, deviceId, "evm", signal);
         _KeystoneAdapter._throwIfAborted(signal);
         const requestId = uuidv4();
@@ -1238,7 +1301,8 @@ var KeystoneAdapter = class _KeystoneAdapter {
           dataType: "typedData",
           path,
           xfp: record.masterFingerprint,
-          chainId: params.chainId
+          chainId: params.chainId,
+          origin: this._origin
         });
         const responseUr = await this._resolveUr(
           record,
@@ -1297,7 +1361,7 @@ var KeystoneAdapter = class _KeystoneAdapter {
       return failure(HardwareErrorCode.DevicePathForbidden, KEYSTONE_BTC_ACCOUNT_FORBIDDEN_MESSAGE);
     }
     try {
-      return await this._jobQueue.enqueue(getKeystoneJobId(connectId, deviceId), async (signal) => {
+      return await this._jobQueue.enqueue(keystoneQueueKey(connectId, deviceId), async (signal) => {
         const { account } = await this._fetchAccount(
           connectId,
           deviceId,
@@ -1353,7 +1417,7 @@ var KeystoneAdapter = class _KeystoneAdapter {
       return failure(HardwareErrorCode.DevicePathForbidden, KEYSTONE_BTC_ACCOUNT_FORBIDDEN_MESSAGE);
     }
     try {
-      return await this._jobQueue.enqueue(getKeystoneJobId(connectId, deviceId), async (signal) => {
+      return await this._jobQueue.enqueue(keystoneQueueKey(connectId, deviceId), async (signal) => {
         const { account } = await this._fetchAccount(
           connectId,
           deviceId,
@@ -1398,11 +1462,13 @@ var KeystoneAdapter = class _KeystoneAdapter {
     if (!params) return failure(HardwareErrorCode.InvalidParams, "btcSignPsbt requires params");
     if (!params.psbt)
       return failure(HardwareErrorCode.InvalidParams, "btcSignPsbt requires params.psbt");
-    if (params.path && !isKeystoneSignableBtcAccountPath(splitAccountPath(params.path).accountPath)) {
+    if (!params.path)
+      return failure(HardwareErrorCode.InvalidParams, "btcSignPsbt requires params.path");
+    if (!isKeystoneSignableBtcAccountPath(splitAccountPath(params.path).accountPath)) {
       return failure(HardwareErrorCode.DevicePathForbidden, KEYSTONE_BTC_ACCOUNT_FORBIDDEN_MESSAGE);
     }
     try {
-      return await this._jobQueue.enqueue(getKeystoneJobId(connectId, deviceId), async (signal) => {
+      return await this._jobQueue.enqueue(keystoneQueueKey(connectId, deviceId), async (signal) => {
         const { record } = await this._ensureWalletKnown(connectId, deviceId, "btc", signal);
         _KeystoneAdapter._throwIfAborted(signal);
         const requestUr = this.urEngine.buildBtcPsbtRequest(stripHex(params.psbt));
@@ -1441,14 +1507,15 @@ var KeystoneAdapter = class _KeystoneAdapter {
       return failure(HardwareErrorCode.DevicePathForbidden, KEYSTONE_BTC_ACCOUNT_FORBIDDEN_MESSAGE);
     }
     try {
-      return await this._jobQueue.enqueue(getKeystoneJobId(connectId, deviceId), async (signal) => {
+      return await this._jobQueue.enqueue(keystoneQueueKey(connectId, deviceId), async (signal) => {
         const { record } = await this._ensureWalletKnown(connectId, deviceId, "btc", signal);
         _KeystoneAdapter._throwIfAborted(signal);
         const requestId = uuidv4();
         const requestUr = this.urEngine.buildBtcMessageSignRequest({
           requestId,
           messageHex,
-          accounts: [{ path, xfp: record.masterFingerprint }]
+          accounts: [{ path, xfp: record.masterFingerprint }],
+          origin: this._origin
         });
         const responseUr = await this._resolveUr(
           record,
@@ -1473,7 +1540,7 @@ var KeystoneAdapter = class _KeystoneAdapter {
     const connectId = operationTarget.payload.targetId;
     const deviceId = deviceIdArg ?? void 0;
     try {
-      return await this._jobQueue.enqueue(getKeystoneJobId(connectId, deviceId), async (signal) => {
+      return await this._jobQueue.enqueue(keystoneQueueKey(connectId, deviceId), async (signal) => {
         const { record } = await this._ensureWalletKnown(connectId, deviceId, "btc", signal);
         return success({ masterFingerprint: record.masterFingerprint });
       });
@@ -1495,7 +1562,7 @@ var KeystoneAdapter = class _KeystoneAdapter {
       return failure(HardwareErrorCode.InvalidParams, "solGetAddress requires params.path");
     const path = normalizePath(params.path);
     try {
-      return await this._jobQueue.enqueue(getKeystoneJobId(connectId, deviceId), async (signal) => {
+      return await this._jobQueue.enqueue(keystoneQueueKey(connectId, deviceId), async (signal) => {
         const { account } = await this._fetchAccount(connectId, deviceId, "sol", path, signal, {
           book
         });
@@ -1523,7 +1590,7 @@ var KeystoneAdapter = class _KeystoneAdapter {
     }
     const path = normalizePath(params.path);
     try {
-      return await this._jobQueue.enqueue(getKeystoneJobId(connectId, deviceId), async (signal) => {
+      return await this._jobQueue.enqueue(keystoneQueueKey(connectId, deviceId), async (signal) => {
         const { record } = await this._ensureWalletKnown(connectId, deviceId, "sol", signal);
         _KeystoneAdapter._throwIfAborted(signal);
         const requestId = uuidv4();
@@ -1532,7 +1599,8 @@ var KeystoneAdapter = class _KeystoneAdapter {
           unsignedPayloadHex: stripHex(params.serializedTx),
           dataType: "transaction",
           path,
-          xfp: record.masterFingerprint
+          xfp: record.masterFingerprint,
+          origin: this._origin
         });
         const responseUr = await this._resolveUr(
           record,
@@ -1566,7 +1634,7 @@ var KeystoneAdapter = class _KeystoneAdapter {
     }
     const path = normalizePath(params.path);
     try {
-      return await this._jobQueue.enqueue(getKeystoneJobId(connectId, deviceId), async (signal) => {
+      return await this._jobQueue.enqueue(keystoneQueueKey(connectId, deviceId), async (signal) => {
         const { record } = await this._ensureWalletKnown(connectId, deviceId, "sol", signal);
         _KeystoneAdapter._throwIfAborted(signal);
         const requestId = uuidv4();
@@ -1575,7 +1643,8 @@ var KeystoneAdapter = class _KeystoneAdapter {
           unsignedPayloadHex: stripHex(params.message),
           dataType: "message",
           path,
-          xfp: record.masterFingerprint
+          xfp: record.masterFingerprint,
+          origin: this._origin
         });
         const responseUr = await this._resolveUr(
           record,
@@ -1596,10 +1665,11 @@ var KeystoneAdapter = class _KeystoneAdapter {
   }
   // ---------------------------------------------------------------------------
   // TRON — routed through `TronSignRequest`/`TronSignature` (see
-  // urEngine/TronSignRequest.ts), a port of OneKey's own already-proven
-  // production TRON QR-wallet implementation — NOT keystone-sdk's own
-  // bundled `sdk.tron` module (different, protobuf-based protocol with
-  // unverified response semantics).
+  // urEngine/TronSignRequest.ts), whose key layout follows keystone-sdk-rust
+  // (tags 5201/5202, firmware >= 2.5.0). The OneKey Pro air-gap encoding under
+  // the same tag is a different layout the firmware rejects. Not keystone-sdk's
+  // bundled `sdk.tron` module either (protobuf-based, unverified response
+  // semantics).
   // ---------------------------------------------------------------------------
   async tronGetAddress(connectIdArg, deviceIdArg, paramsArg, book) {
     const operationTarget = resolveHardwareOperationTarget(connectIdArg, paramsArg?.operationId);
@@ -1618,7 +1688,7 @@ var KeystoneAdapter = class _KeystoneAdapter {
       );
     }
     try {
-      return await this._jobQueue.enqueue(getKeystoneJobId(connectId, deviceId), async (signal) => {
+      return await this._jobQueue.enqueue(keystoneQueueKey(connectId, deviceId), async (signal) => {
         const { account } = await this._fetchAccount(
           connectId,
           deviceId,
@@ -1664,7 +1734,7 @@ var KeystoneAdapter = class _KeystoneAdapter {
     const rawTxHex = stripHex(params.rawTxHex);
     const path = normalizePath(params.path);
     try {
-      return await this._jobQueue.enqueue(getKeystoneJobId(connectId, deviceId), async (signal) => {
+      return await this._jobQueue.enqueue(keystoneQueueKey(connectId, deviceId), async (signal) => {
         const { record } = await this._ensureWalletKnown(connectId, deviceId, "tron", signal);
         _KeystoneAdapter._throwIfAborted(signal);
         const requestId = uuidv4();
@@ -1672,7 +1742,8 @@ var KeystoneAdapter = class _KeystoneAdapter {
           requestId,
           rawTxHex,
           path,
-          xfp: record.masterFingerprint
+          xfp: record.masterFingerprint,
+          origin: this._origin
         });
         const responseUr = await this._resolveUr(
           record,
@@ -1713,7 +1784,7 @@ var KeystoneAdapter = class _KeystoneAdapter {
     const messageHex = stripHex(params.messageHex);
     const path = normalizePath(params.path);
     try {
-      return await this._jobQueue.enqueue(getKeystoneJobId(connectId, deviceId), async (signal) => {
+      return await this._jobQueue.enqueue(keystoneQueueKey(connectId, deviceId), async (signal) => {
         const { record } = await this._ensureWalletKnown(connectId, deviceId, "tron", signal);
         _KeystoneAdapter._throwIfAborted(signal);
         const requestId = uuidv4();
@@ -1722,7 +1793,8 @@ var KeystoneAdapter = class _KeystoneAdapter {
           rawTxHex: messageHex,
           path,
           xfp: record.masterFingerprint,
-          signType: 2 /* PersonalMessage */
+          signType: 2 /* PersonalMessage */,
+          origin: this._origin
         });
         const responseUr = await this._resolveUr(
           record,
@@ -1745,8 +1817,7 @@ var KeystoneAdapter = class _KeystoneAdapter {
   // Internals
   // ---------------------------------------------------------------------------
   _walletIdFromIdentifier(identifier) {
-    const value = identifier.startsWith(KEYSTONE_WALLET_CONNECT_ID_PREFIX) ? identifier.slice(KEYSTONE_WALLET_CONNECT_ID_PREFIX.length) : identifier;
-    return /^[0-9a-f]{64}$/i.test(value) ? value.toLowerCase() : void 0;
+    return keystoneWalletIdFromIdentifier(identifier);
   }
   _allNetworkSyncSchema(item) {
     if (!isAllNetworkMethodName(String(item.methodName)) || !item.path) return void 0;
@@ -1775,7 +1846,7 @@ var KeystoneAdapter = class _KeystoneAdapter {
    * one-path-at-a-time export flow because the device limits that channel.
    */
   async _prefetchAllNetworkAccounts(connectId, deviceId, params) {
-    return this._jobQueue.enqueue(getKeystoneJobId(connectId, deviceId), async (signal) => {
+    return this._jobQueue.enqueue(keystoneQueueKey(connectId, deviceId), async (signal) => {
       const target = this._resolveTarget(connectId, deviceId);
       const { record: targetRecord } = target;
       let record = targetRecord;
@@ -1788,14 +1859,17 @@ var KeystoneAdapter = class _KeystoneAdapter {
       if (!requestedByKey.size) {
         return { book };
       }
-      if (this._forcedTransport !== "qr" && !record?.usbSessionId && this._usbConnector && target.expectedWalletId) {
+      const operation = isHardwareOperationId2(params.operationId) ? this._operations.find(params.operationId) : void 0;
+      const operationRoute = operation ? this._operationRoutes.get(operation.connectId) : void 0;
+      const routedToQr = operationRoute?.operationId === operation?.operationId && operationRoute?.connectionType === "qr";
+      if (this._forcedTransport !== "qr" && !routedToQr && !record?.usbSessionId && this._usbConnector && target.expectedWalletId) {
         record = await this._tryUsbAttach(
           target.expectedWalletId,
           record?.masterFingerprint ?? target.expectedMasterFingerprint
         ) ?? record;
         _KeystoneAdapter._throwIfAborted(signal);
       }
-      if (this._forcedTransport !== "qr" && record?.usbSessionId) {
+      if (this._forcedTransport !== "qr" && !routedToQr && record?.usbSessionId) {
         const bundleSessionId = record.usbSessionId;
         const assertBundleSession = () => {
           if (record?.usbSessionId !== bundleSessionId) {
@@ -1851,7 +1925,8 @@ var KeystoneAdapter = class _KeystoneAdapter {
       });
       const responseUr = await this._requestQrDisplayAndAwaitResponse(
         record ? toDeviceInfo(record) : placeholderDeviceInfo(),
-        { ...requestUr, animated: false }
+        { ...requestUr, animated: false },
+        signal
       );
       _KeystoneAdapter._throwIfAborted(signal);
       const parsed = this.urEngine.parseAccountResponse(responseUr);
@@ -1887,7 +1962,7 @@ var KeystoneAdapter = class _KeystoneAdapter {
    */
   _resolveTarget(connectId, deviceId) {
     let resolvedConnectId = connectId;
-    if (isHardwareOperationId(connectId)) {
+    if (isHardwareOperationId2(connectId)) {
       resolvedConnectId = this._operations.resolve(connectId).connectId;
     }
     const identifiers = [deviceId, resolvedConnectId].filter(
@@ -2137,7 +2212,7 @@ var KeystoneAdapter = class _KeystoneAdapter {
    * closed rather than silently falling back to QR.
    */
   async _resolveUr(record, requestUr, animated, operationId, signal, operationName) {
-    const releaseOperationRetention = isHardwareOperationId(operationId) ? this._operations.retain(operationId) : void 0;
+    const releaseOperationRetention = isHardwareOperationId2(operationId) ? this._operations.retain(operationId) : void 0;
     try {
       return await this._resolveUrWithRoute(
         record,
@@ -2153,7 +2228,7 @@ var KeystoneAdapter = class _KeystoneAdapter {
   }
   async _resolveUrWithRoute(record, requestUr, animated, operationId, signal, operationName) {
     let interactionRoute;
-    if (isHardwareOperationId(operationId)) {
+    if (isHardwareOperationId2(operationId)) {
       const operation = this._operations.resolve(operationId);
       const route = this._operationRoutes.get(operation.connectId);
       if (!route || route.operationId !== operationId) {
@@ -2202,10 +2277,11 @@ var KeystoneAdapter = class _KeystoneAdapter {
       const usbErrorCode = usbError.code;
       if (!interactionRoute && !this._forcedTransport && usbErrorCode === HardwareErrorCode.PayloadTooLarge && usbErrorOrigin !== "device") {
         const displayDevice2 = toDeviceInfo(record);
-        return this._requestQrDisplayAndAwaitResponse(displayDevice2, {
-          ...requestUr,
-          animated
-        });
+        return this._requestQrDisplayAndAwaitResponse(
+          displayDevice2,
+          { ...requestUr, animated },
+          signal
+        );
       }
       const deviceAnswered = usbErrorOrigin !== void 0 ? usbErrorOrigin === "device" : usbErrorCode === HardwareErrorCode.UserRejected || usbErrorCode === HardwareErrorCode.UserAborted || usbErrorCode === HardwareErrorCode.DeviceLocked || usbErrorCode === HardwareErrorCode.DeviceMismatch;
       if (!deviceAnswered) {
@@ -2243,10 +2319,11 @@ var KeystoneAdapter = class _KeystoneAdapter {
     }
     const displayDevice = record ? toDeviceInfo(record) : placeholderDeviceInfo();
     try {
-      return await this._requestQrDisplayAndAwaitResponse(displayDevice, {
-        ...requestUr,
-        animated
-      });
+      return await this._requestQrDisplayAndAwaitResponse(
+        displayDevice,
+        { ...requestUr, animated },
+        signal
+      );
     } catch (error) {
       const { code, _tag: tag } = error;
       if (operationName && (code === HardwareErrorCode.OperationTimeout || tag === UI_REQUEST_TIMEOUT_TAG)) {
@@ -2381,28 +2458,76 @@ var KeystoneAdapter = class _KeystoneAdapter {
     const record = this._upsertDeviceRecord(parsed);
     return { record };
   }
-  async _requestQrDisplayAndAwaitResponse(device, data) {
+  /**
+   * The operation the running device job belongs to, so a UI request raised
+   * mid-call can name it. A call pinned to an operation queues under its id
+   * (`keystoneQueueKey`); a call without one queues under the wallet id or the
+   * wallet connectId, and the live operation routed to that connection is still
+   * the owner. Only a cold start comes back undefined.
+   */
+  _activeOperationId() {
+    const activeJobId = this._jobQueue.getActiveJob()?.deviceId;
+    if (!activeJobId) return void 0;
+    if (isHardwareOperationId2(activeJobId)) return activeJobId;
+    return this._operationRouteForIdentifier(activeJobId)?.operationId;
+  }
+  /** Routes are keyed by connectId; a job key may be the bare wallet id. */
+  _operationRouteForIdentifier(identifier) {
+    for (const key of keystoneCancelQueueKeys([identifier])) {
+      const route = this._operationRoutes.get(key);
+      if (route) return route;
+    }
+    const walletId = keystoneWalletIdFromIdentifier(identifier);
+    return walletId ? this._operationRoutes.get(walletConnectId(walletId)) : void 0;
+  }
+  /**
+   * A QR prompt has no transport to interrupt, so an aborted job would sit here
+   * until the QR timeout. Releasing the registry slot on abort is what lets a
+   * cancel reach the wait at all.
+   */
+  async _awaitQrResponse(requestType, pending, signal) {
+    if (!signal) return pending;
+    let settled = false;
+    const onAbort = () => {
+      if (!settled) this._uiRegistry.cancel(requestType);
+    };
+    if (signal.aborted) onAbort();
+    else signal.addEventListener("abort", onAbort, { once: true });
+    try {
+      return await pending;
+    } finally {
+      settled = true;
+      signal.removeEventListener("abort", onAbort);
+    }
+  }
+  async _requestQrDisplayAndAwaitResponse(device, data, signal) {
+    const operationId = this._activeOperationId();
     const waitPromise = this._uiRegistry.wait(
       UI_REQUEST.REQUEST_QR_DISPLAY,
-      { timeoutMs: this._qrTimeoutMs }
+      { timeoutMs: this._qrTimeoutMs, operationId }
     );
     this.emitter.emit(UI_REQUEST.REQUEST_QR_DISPLAY, {
       type: UI_REQUEST.REQUEST_QR_DISPLAY,
-      payload: { device, data }
+      payload: { device, data, operationId }
     });
-    const response = await waitPromise;
+    const response = await this._awaitQrResponse(
+      UI_REQUEST.REQUEST_QR_DISPLAY,
+      waitPromise,
+      signal
+    );
     return { urType: response.urType, urData: response.urData };
   }
-  async _requestQrScanAndAwaitResponse(device) {
+  async _requestQrScanAndAwaitResponse(device, signal) {
+    const operationId = this._activeOperationId();
     const waitPromise = this._uiRegistry.wait(
       UI_REQUEST.REQUEST_QR_SCAN,
-      { timeoutMs: this._qrTimeoutMs }
+      { timeoutMs: this._qrTimeoutMs, operationId }
     );
     this.emitter.emit(UI_REQUEST.REQUEST_QR_SCAN, {
       type: UI_REQUEST.REQUEST_QR_SCAN,
-      payload: { device }
+      payload: { device, operationId }
     });
-    const response = await waitPromise;
+    const response = await this._awaitQrResponse(UI_REQUEST.REQUEST_QR_SCAN, waitPromise, signal);
     return { urType: response.urType, urData: response.urData };
   }
   async _callUsbConnector(sessionId, method, params, signal) {
@@ -2418,6 +2543,12 @@ var KeystoneAdapter = class _KeystoneAdapter {
         message: `Keystone USB is busy while calling ${method}`
       });
     }
+    if (signal?.aborted) {
+      throw signal.reason instanceof Error ? signal.reason : createHwkError({
+        code: HardwareErrorCode.UserAborted,
+        message: "User aborted operation"
+      });
+    }
     const releaseOperation = this._retainUsbOperation(`call:${sessionId}`);
     let rawCall;
     try {
@@ -2516,7 +2647,7 @@ var KeystoneAdapter = class _KeystoneAdapter {
   _errorToFailure(err) {
     if (err && typeof err === "object") {
       const e = err;
-      if (typeof e.code === "number") {
+      if (typeof e.code === "number" && e.code >= 1e4 && e.code <= 99999) {
         const { origin } = e;
         return failure(
           e.code,