@onekeyfe/hwk-keystone-adapter 1.2.3-alpha.8 → 1.2.5-alpha.0

package/dist/index.mjs

@@ -106,6 +106,9 @@ var TronSignature = class _TronSignature extends RegistryItem2 {
   static fromDataItem(dataItem) {
     const map = dataItem.getData();
     const signature = map[2 /* signature */];
+    if (!Buffer.isBuffer(signature)) {
+      throw new Error("Keystone tron-signature UR is missing its signature bytes");
+    }
     const requestIdItem = map[1 /* requestId */];
     const requestId = requestIdItem?.getData();
     return new _TronSignature(signature, requestId);
@@ -136,14 +139,22 @@ function toSdkUr(ur) {
 function fromSdkUr(ur) {
   return { urType: ur.type, urData: ur.cbor.toString("hex") };
 }
-function splitSignature65(hex) {
-  if (hex.length !== 130) {
+function splitEvmSignature(hex) {
+  if (hex.length < 130 || hex.length % 2 !== 0) {
     throw new Error(
-      `Keystone returned a ${hex.length / 2}-byte signature; expected 65 bytes (r|s|v)`
+      `Keystone returned a ${hex.length / 2}-byte signature; expected at least 65 bytes (r|s|v)`
     );
   }
   return { r: hex.slice(0, 64), s: hex.slice(64, 128), v: hex.slice(128) };
 }
+function requireSignatureBytes(hex, expectedBytes, chain) {
+  if (hex.length !== expectedBytes * 2) {
+    throw new Error(
+      `Keystone returned a ${hex.length / 2}-byte ${chain} signature; expected ${expectedBytes} bytes`
+    );
+  }
+  return hex;
+}
 function requireBip32MasterFingerprint(value) {
   const fingerprint = parseBip32MasterFingerprint(value);
   if (!fingerprint) {
@@ -151,12 +162,24 @@ function requireBip32MasterFingerprint(value) {
   }
   return fingerprint;
 }
+function toParsedAccount(key) {
+  return {
+    chain: key.chain,
+    path: key.path,
+    publicKey: key.publicKey,
+    extendedPublicKey: key.extendedPublicKey,
+    xfp: key.xfp ? requireBip32MasterFingerprint(key.xfp) : void 0,
+    name: key.name
+  };
+}
+function relativeHdPath(relativeDerivePath) {
+  return `m/${relativeDerivePath.replace(/^m\//i, "")}`;
+}
 var KeystoneUrEngine = class {
   constructor(origin = "OneKey") {
     this.sdk = new KeystoneSDK({ origin });
   }
-  // --- Account sync (works for both a device-initiated QR export and a
-  // wallet-initiated KeyDerivation request/response over either channel) ---
+  // --- Account sync (device-initiated export or KeyDerivation response) ---
   parseMultiAccounts(ur) {
     const parsed = this.sdk.parseMultiAccounts(toSdkUr(ur));
     return {
@@ -164,46 +187,15 @@ var KeystoneUrEngine = class {
       device: parsed.device,
       deviceId: parsed.deviceId,
       deviceVersion: parsed.deviceVersion,
-      accounts: parsed.keys.map(
-        (key) => ({
-          chain: key.chain,
-          path: key.path,
-          publicKey: key.publicKey,
-          extendedPublicKey: key.extendedPublicKey,
-          xfp: key.xfp ? requireBip32MasterFingerprint(key.xfp) : void 0,
-          name: key.name
-        })
-      )
+      accounts: parsed.keys.map(toParsedAccount)
     };
   }
   parseHDKey(ur) {
-    const key = this.sdk.parseHDKey(toSdkUr(ur));
-    return {
-      chain: key.chain,
-      path: key.path,
-      publicKey: key.publicKey,
-      extendedPublicKey: key.extendedPublicKey,
-      xfp: key.xfp ? requireBip32MasterFingerprint(key.xfp) : void 0,
-      name: key.name
-    };
+    return toParsedAccount(this.sdk.parseHDKey(toSdkUr(ur)));
   }
   /**
-   * Build a `qr-hardware-call` (KeyDerivation) request: the host asks for
-   * specific paths instead of waiting for whatever the device happens to be
-   * showing. The device replies with a `crypto-multi-accounts` UR — parse it
-   * with `parseMultiAccounts`. Used for the implicit "sync this wallet's xfp
-   * before the first sign" round trip as well as an explicit account import.
-   *
-   * `version: V1` is required — verified against real Keystone hardware and
-   * `keystone3-firmware`'s `CheckHardwareCallRequestIsLegal` source: an
-   * unversioned/V0 request is validated as a legacy Cardano-only request
-   * (`m/1852'/1815'/...`) and firmware rejects every other chain's path with
-   * `PRS_PARSING_ERROR` (device-shown message: "路径不受支持" / "path not
-   * supported"), regardless of the path's shape. V1 is what actually enables
-   * the general per-chain path whitelist (includes `m/44'/60'` for ETH, the
-   * standard BTC purposes, etc.). The SDK itself defaults to V0 unless a
-   * truthy `version` is passed — omitting this silently produces a request
-   * every non-Cardano device rejects.
+   * Builds a KeyDerivation request. `version: V1` is required: firmware validates V0 (the SDK
+   * default) as Cardano-only and rejects other paths with `PRS_PARSING_ERROR`.
    */
   buildKeyDerivationRequest(input) {
     const ur = this.sdk.generateKeyDerivationCall({
@@ -217,14 +209,8 @@ var KeystoneUrEngine = class {
     return fromSdkUr(ur);
   }
   /**
-   * Parse the response to a KeyDerivation request (or a device-initiated
-   * account export): `crypto-multi-accounts` for a multi-schema request,
-   * `crypto-hdkey` for a single-key response some firmware paths use instead.
-   * Both are normalized to the same `KeystoneParsedMultiAccounts` shape — a
-   * single `crypto-hdkey` becomes a one-entry account list, with its own
-   * `origin.sourceFingerprint` promoted to `masterFingerprint` (correct for a
-   * key derived directly from the seed, which every request this engine
-   * builds asks for).
+   * Normalizes `crypto-multi-accounts` and the single-key `crypto-hdkey` some firmware returns. The
+   * hdkey source fingerprint is the mfp only because every request here derives from the seed.
    */
   parseAccountResponse(ur) {
     if (ur.urType === "crypto-hdkey") {
@@ -255,37 +241,19 @@ var KeystoneUrEngine = class {
   }
   parseEthSignature(ur) {
     const signature = this.sdk.eth.parseSignature(toSdkUr(ur));
-    return { requestId: signature.requestId, ...splitSignature65(signature.signature) };
+    return { requestId: signature.requestId, ...splitEvmSignature(signature.signature) };
   }
-  /**
-   * Derive one EVM address offline from an already-synced account xpub —
-   * verified against the same `@keystonehq/bc-ur-registry-eth` helper the
-   * Keystone-based OneKey air-gap demo uses in production
-   * (`generateAddressFromXpub`), so no unverified assumption about what a
-   * leaf-path KeyDerivation request would return. `relativeDerivePath` is
-   * relative to the xpub's own depth, e.g. `'0/0'` for an account xpub.
-   */
+  /** Derives an EVM address offline; `relativeDerivePath` is relative to the xpub, e.g. `'0/0'`. */
   deriveEvmAddressFromXpub(xpub, relativeDerivePath) {
-    return generateAddressFromXpub(xpub, `m/${relativeDerivePath.replace(/^m\//i, "")}`);
+    return generateAddressFromXpub(xpub, relativeHdPath(relativeDerivePath));
   }
   // --- BTC (PSBT transaction signing + plain message signing) ---
   /**
-   * Derive one BTC address offline from an already-synced account xpub, the
-   * same way `deriveEvmAddressFromXpub` does. Keystone's `CryptoHDKey`
-   * always emits standard mainnet-xpub version bytes (`0488B21E`) regardless
-   * of the account's purpose/script type (verified against
-   * `@keystonehq/bc-ur-registry`'s `CryptoHDKey.getBip32Key`, which hardcodes
-   * that version rather than switching to a SLIP-132 ypub/zpub prefix per
-   * script type) — so `hdkey.fromExtendedKey` parses it correctly for every
-   * `scriptType` without needing custom version bytes configured.
-   *
-   * `p2tr` is deliberately not handled: taproot output-key tweaking (BIP-341)
-   * needs an elliptic-curve library wired via bitcoinjs-lib's `initEccLib`,
-   * which this package doesn't set up yet — every other payment function
-   * here needs no such library.
+   * `CryptoHDKey` always emits mainnet xpub version bytes (`0488B21E`), so `hdkey` parses it as is.
+   * `p2tr` needs an ECC lib for BIP-341 tweaking, not wired here.
    */
   deriveBtcAddressFromXpub(xpub, relativeDerivePath, scriptType) {
-    const node = HDKey.fromExtendedKey(xpub).derive(`m/${relativeDerivePath.replace(/^m\//i, "")}`);
+    const node = HDKey.fromExtendedKey(xpub).derive(relativeHdPath(relativeDerivePath));
     if (!node.publicKey) throw new Error("HDKey derivation did not produce a public key");
     return this.deriveBtcAddressFromPublicKey(
       Buffer.from(node.publicKey).toString("hex"),
@@ -338,7 +306,7 @@ var KeystoneUrEngine = class {
       requestId: params.requestId,
       signData: params.messageHex,
       dataType: 1,
-      // BtcSignRequest.DataType.message — PSBT signing never goes through this path.
+      // BtcSignRequest.DataType.message; PSBT signing never goes through this path.
       accounts: params.accounts,
       origin: params.origin
     });
@@ -367,7 +335,10 @@ var KeystoneUrEngine = class {
   }
   parseSolSignature(ur) {
     const signature = this.sdk.sol.parseSignature(toSdkUr(ur));
-    return { requestId: signature.requestId, signature: signature.signature };
+    return {
+      requestId: signature.requestId,
+      signature: requireSignatureBytes(signature.signature, 64, "SOL")
+    };
   }
   // --- TRON ---
   /**
@@ -392,37 +363,22 @@ var KeystoneUrEngine = class {
     const requestId = signature.getRequestId();
     return {
       requestId: requestId ? uuidStringify(requestId) : void 0,
-      signature: signature.getSignature().toString("hex")
+      signature: requireSignatureBytes(signature.getSignature().toString("hex"), 65, "TRON")
     };
   }
   /**
-   * Derive one TRON address offline from an already-synced account xpub.
-   * TRON reuses EVM's exact secp256k1-pubkey → keccak256 → last-20-bytes
-   * derivation (verified against Keystone's own `formatAddress()` in
-   * `keystone-sdk`'s TRON chain source) — only the final text encoding
-   * differs (base58check with a `0x41` version byte, not checksummed hex).
-   * Reusing `generateAddressFromXpub` here means no new hashing dependency:
-   * strip its "0x" and re-encode the same 20 bytes.
+   * TRON uses the same 20 address bytes as EVM (Keystone's `formatAddress()`), re-encoded as
+   * base58check with the `0x41` version byte.
    */
   deriveTronAddressFromXpub(xpub, relativeDerivePath) {
-    const evmStyleHex = generateAddressFromXpub(
-      xpub,
-      `m/${relativeDerivePath.replace(/^m\//i, "")}`
-    );
+    const evmStyleHex = generateAddressFromXpub(xpub, relativeHdPath(relativeDerivePath));
     const addressBytes = Buffer.concat([
       Buffer.from([TRON_ADDRESS_PREFIX]),
-      Buffer.from(evmStyleHex.replace(/^0x/i, ""), "hex")
+      Buffer.from(stripHexPrefix(evmStyleHex), "hex")
     ]);
     return bs58check.encode(addressBytes);
   }
-  /**
-   * Split an account-level xpub back into the BIP-32 fields a host needs to
-   * treat it as a real extended key (`BtcPublicKey`). Everything here is
-   * carried inside the xpub's own serialization — depth, the PARENT key
-   * fingerprint (not the seed's master fingerprint), the chain code and the
-   * compressed public key — so this is a pure decode with no device round
-   * trip; the xpub itself was already device-verified when it was synced.
-   */
+  /** Decodes an xpub's BIP-32 fields; `parentFingerprint` is the parent key's, not the mfp. */
   parseXpubMeta(xpub) {
     const raw = Buffer.from(bs58check.decode(xpub));
     if (raw.length !== 78) {
@@ -610,8 +566,10 @@ function keystoneCancelQueueKeys(identifiers) {
 var KEYSTONE_USB_REATTACH_PROBE_ATTEMPTS = 4;
 var KEYSTONE_USB_REATTACH_PROBE_INTERVAL_MS = 500;
 function resolveHardwareOperationTarget(positionalTargetId, operationId) {
-  const result = resolveGenericHardwareOperationTarget(positionalTargetId, operationId, "keystone");
-  return result;
+  return resolveGenericHardwareOperationTarget(positionalTargetId, operationId, "keystone");
+}
+function keySchema(chain, path) {
+  return { path, curve: chain === "sol" ? "ed25519" : "secp256k1" };
 }
 function waitForKeystoneUsbReattachProbe() {
   return new Promise((resolve) => {
@@ -665,13 +623,13 @@ var KeystoneAdapter = class _KeystoneAdapter {
     this._usbConnectTail = Promise.resolve();
     this._unsettledUsbOperations = /* @__PURE__ */ new Map();
     this._usbIdleWaiters = /* @__PURE__ */ new Set();
+    this._abandonedUsbConnects = 0;
     this._usbTeardownTail = Promise.resolve();
     this._pendingUsbTeardowns = 0;
     this._handleUsbDisconnect = ({ connectId }) => {
       const record = Array.from(this._devices.values()).find((item) => item.usbSessionId === connectId);
       if (!record) return;
       this._operations.endByConnectionKey(connectId, "disconnect");
-      this._operations.endByConnectionKey(record.connectId, "disconnect");
       record.usbSessionId = void 0;
       const info = toDeviceInfo(record);
       if (record.qrSynced) {
@@ -685,8 +643,7 @@ var KeystoneAdapter = class _KeystoneAdapter {
       this.emitter.emit("ui-event", event);
     };
     // ---------------------------------------------------------------------------
-    // All-network bundle — dispatches to the same per-chain methods below, so
-    // there's exactly one implementation of each chain's address logic.
+    // All-network bundle, dispatched to the per-chain methods below.
     // ---------------------------------------------------------------------------
     this.allNetworkGetAddress = async (connectId, deviceId, params) => {
       const operationTarget = resolveHardwareOperationTarget(connectId, params.operationId);
@@ -695,11 +652,10 @@ var KeystoneAdapter = class _KeystoneAdapter {
       const { operationId } = operationTarget.payload;
       let cancelScope;
       try {
-        const prefetched = await this._prefetchAllNetworkAccounts(
-          effectiveConnectId,
-          deviceId,
-          params
-        );
+        const prefetched = await this._prefetchAllNetworkAccounts(effectiveConnectId, deviceId, {
+          ...params,
+          operationId
+        });
         const { book } = prefetched;
         const itemDeviceId = deviceId || prefetched.walletId || "";
         const scope = this._jobQueue.createCancelScope(
@@ -755,9 +711,8 @@ var KeystoneAdapter = class _KeystoneAdapter {
               }
             });
           },
-          // The gap check plus the shared top-level table: a refusal or a lost
-          // session ends the batch, every other per-item failure keeps its
-          // existing "carry on with the next chain" behaviour.
+          // Cancel, refusal or a lost session ends the batch; other per-item
+          // failures carry on with the next chain.
           shouldAbortBundle: (response, { index }) => {
             const { code } = response.payload ?? {};
             return cancelledIndexes.has(index) || isUserRefusal(code) || isConnectionLost(code);
@@ -788,7 +743,7 @@ var KeystoneAdapter = class _KeystoneAdapter {
   getAvailableTransports() {
     return this._usbConnector ? ["qr", "usb"] : ["qr"];
   }
-  /** Pins subsequent calls to 'qr' or 'usb' (routing otherwise defaults to "USB when the target wallet has a live session, else QR" — see `_resolveUr`). Any other value clears the pin back to auto. */
+  /** Pins calls to 'qr' or 'usb'; any other value clears the pin back to auto routing. */
   switchTransport(type) {
     this._forcedTransport = type === "qr" || type === "usb" ? type : void 0;
     return Promise.resolve();
@@ -801,6 +756,7 @@ var KeystoneAdapter = class _KeystoneAdapter {
     this._uiRegistry.cancel();
     this._jobQueue.clear();
     this._searchDeviceTargets.clear();
+    await this._usbConnectTail;
     await this._resetUsbSessions();
     this._usbConnector?.off("device-disconnect", this._handleUsbDisconnect);
     this._usbConnector?.off("ui-event", this._handleUsbUiEvent);
@@ -812,14 +768,8 @@ var KeystoneAdapter = class _KeystoneAdapter {
   // Device table
   // ---------------------------------------------------------------------------
   /**
-   * Unscoped discovery includes QR-synced wallets already known to this
-   * adapter. Explicit QR discovery returns a virtual connection target because
-   * there is no physical descriptor to enumerate. When a USB connector is
-   * configured, its raw scan results are appended as-is: a USB descriptor has
-   * no mfp until `connectDevice()` actually opens+claims it (see
-   * `KeystoneUsbConnectorBase.searchDevices`), so these entries carry an
-   * empty `deviceId` and exist purely so a host can list "plugged in, click
-   * to connect" candidates.
+   * Returns known wallets plus USB scan results; USB entries have no mfp until `connectDevice()`
+   * claims them. Explicit QR discovery returns one virtual target.
    */
   async searchDevices(options) {
     const searchGeneration = /* @__PURE__ */ Symbol("keystone-device-search");
@@ -855,18 +805,15 @@ var KeystoneAdapter = class _KeystoneAdapter {
     if (this._activeSearchGeneration !== searchGeneration) return [];
     const placeholders = usbDevices.map((d) => ({
       vendor: "keystone",
-      // Empty, not 'unknown': enumeration genuinely cannot tell the model
-      // apart (every Keystone shares one vid/pid), and a literal placeholder
-      // string would beat the host's own default-name fallback and surface as
-      // a device called "unknown".
+      // Empty, not 'unknown': all models share one vid/pid, and a placeholder
+      // string would beat the host's default-name fallback.
       model: d.model ?? "",
       modelName: d.modelName,
-      // Placeholders — neither is knowable until the device is opened.
+      // Unknown until the device is opened.
       firmwareVersion: "0.0.0",
       deviceId: d.deviceId,
       connectId: d.connectId,
       connectionType: "usb",
-      // The USB product name, which IS readable at enumeration time.
       label: d.name,
       serialNumber: d.serialNumber,
       capabilities: d.capabilities ?? { persistentDeviceIdentity: false },
@@ -886,20 +833,25 @@ var KeystoneAdapter = class _KeystoneAdapter {
         Array.from(this._devices.values()).map((record) => record.usbSessionId).filter((sessionId) => Boolean(sessionId))
       );
       for (const sessionId of sessionIds) {
-        try {
-          await this._usbConnector.disconnect(sessionId);
-        } catch {
-        }
-        this._handleUsbDisconnect({ connectId: sessionId });
+        await this._retireUsbSession(sessionId);
       }
     });
   }
+  /** Best-effort disconnect; the session is retired either way so it cannot be selected again. */
+  async _retireUsbSession(sessionId) {
+    if (this._usbConnector) {
+      try {
+        await this._usbConnector.disconnect(sessionId);
+      } catch {
+      }
+    }
+    this._handleUsbDisconnect({ connectId: sessionId });
+  }
   async searchDeviceTargets(options) {
     const devices = await this.searchDevices(options);
     return devices.map((device) => ({
       searchTargetId: device.connectId,
-      // Keystone's wallet id is stable only after the USB/QR handshake. The
-      // selectable handle remains owned by the current discovery snapshot.
+      // The wallet id is stable only after the USB/QR handshake.
       searchTargetReusePolicy: "current-discovery",
       vendor: device.vendor,
       connectionType: device.connectionType,
@@ -918,13 +870,23 @@ var KeystoneAdapter = class _KeystoneAdapter {
     }));
   }
   async connectDevice(searchTargetId) {
+    const scope = this._jobQueue.createCancelScope(searchTargetId);
     try {
       let connected;
       let selectedConnectionType;
       const discoveredConnectionType = this._searchDeviceTargets.get(searchTargetId);
       if (discoveredConnectionType === "qr") {
         selectedConnectionType = "qr";
-        connected = await this.importFromQr();
+        const abortColdStart = () => this._jobQueue.cancelActiveAndPending(
+          KEYSTONE_COLD_START_JOB_LABEL,
+          scope.signal.reason
+        );
+        scope.signal.addEventListener("abort", abortColdStart, { once: true });
+        try {
+          connected = await this.importFromQr();
+        } finally {
+          scope.signal.removeEventListener("abort", abortColdStart);
+        }
       } else if (discoveredConnectionType === "usb") {
         selectedConnectionType = "usb";
         if (!this._usbConnector) {
@@ -933,7 +895,7 @@ var KeystoneAdapter = class _KeystoneAdapter {
             "No USB connector configured for this Keystone adapter"
           );
         }
-        connected = await this._connectUsb({}, searchTargetId);
+        connected = await this._connectUsb({}, searchTargetId, scope.signal);
       } else if (hasHardwareRuntimeIdPrefix(searchTargetId)) {
         return failure(
           HardwareErrorCode.DeviceNotFound,
@@ -954,9 +916,10 @@ var KeystoneAdapter = class _KeystoneAdapter {
           );
         } else {
           selectedConnectionType = "usb";
-          connected = await this._connectUsb(target);
+          connected = await this._connectUsb(target, void 0, scope.signal);
         }
       }
+      _KeystoneAdapter._throwIfAborted(scope.signal);
       if (!connected.success) return connected;
       const record = this._devices.get(connected.payload.deviceId);
       this._operations.endByConnectionKey(connected.payload.connectId, "explicit");
@@ -974,14 +937,13 @@ var KeystoneAdapter = class _KeystoneAdapter {
       return success(operation.operationId);
     } catch (err) {
       return this._errorToFailure(err);
+    } finally {
+      scope.release();
     }
   }
   /**
-   * QR has no persistent connection to tear down — the account cache
-   * survives so a later call resumes without re-syncing. For a USB session,
-   * this closes the connector session and either demotes the record back to
-   * QR-only (if it was ever QR-synced) or removes it entirely (pure-USB
-   * wallet that was never seen over QR) — see §4.2 of the design doc.
+   * QR has nothing to tear down. A USB session is closed, and the record is demoted to QR-only or
+   * removed if it was never QR-synced.
    */
   async releaseOperation(operationId) {
     const operation = this._operations.find(operationId);
@@ -1005,15 +967,7 @@ var KeystoneAdapter = class _KeystoneAdapter {
       return;
     }
     const { usbSessionId } = record;
-    await this._runUsbTeardown(async () => {
-      if (this._usbConnector) {
-        try {
-          await this._usbConnector.disconnect(usbSessionId);
-        } catch {
-        }
-      }
-      this._handleUsbDisconnect({ connectId: usbSessionId });
-    });
+    await this._runUsbTeardown(() => this._retireUsbSession(usbSessionId));
   }
   getDeviceInfo(connectIdOrOperationId, deviceId) {
     try {
@@ -1091,8 +1045,7 @@ var KeystoneAdapter = class _KeystoneAdapter {
     this.emitter.off(event, listener);
   }
   // ---------------------------------------------------------------------------
-  // Explicit account import — the recommended entry point before signing, so
-  // signing calls don't each pay for their own cold-sync round trip.
+  // Explicit account import: call before signing to avoid a cold sync per call.
   // ---------------------------------------------------------------------------
   async importFromQr(options = {}) {
     try {
@@ -1103,7 +1056,7 @@ var KeystoneAdapter = class _KeystoneAdapter {
           responseUr = await this._requestQrScanAndAwaitResponse(displayDevice, signal);
         } else {
           const requestUr = this.urEngine.buildKeyDerivationRequest({
-            schemas: [{ path: KEYSTONE_WALLET_ID_PATH, curve: "secp256k1" }],
+            schemas: [keySchema("evm", KEYSTONE_WALLET_ID_PATH)],
             origin: this._origin
           });
           responseUr = await this._requestQrDisplayAndAwaitResponse(
@@ -1124,12 +1077,11 @@ var KeystoneAdapter = class _KeystoneAdapter {
   // ---------------------------------------------------------------------------
   // EVM
   // ---------------------------------------------------------------------------
-  async evmGetAddress(connectIdArg, deviceIdArg, paramsArg, book) {
-    const operationTarget = resolveHardwareOperationTarget(connectIdArg, paramsArg?.operationId);
+  async evmGetAddress(connectIdArg, deviceIdArg, params, book) {
+    const operationTarget = resolveHardwareOperationTarget(connectIdArg, params?.operationId);
     if (!operationTarget.success) return operationTarget;
     const connectId = operationTarget.payload.targetId;
     const deviceId = deviceIdArg ?? void 0;
-    const params = paramsArg;
     if (!params) return failure(HardwareErrorCode.InvalidParams, "evmGetAddress requires params");
     if (!params.path)
       return failure(HardwareErrorCode.InvalidParams, "evmGetAddress requires params.path");
@@ -1140,39 +1092,24 @@ var KeystoneAdapter = class _KeystoneAdapter {
         "evmGetAddress requires a full leaf path, e.g. m/44'/60'/0'/0/0"
       );
     }
-    try {
-      return await this._jobQueue.enqueue(keystoneQueueKey(connectId, deviceId), async (signal) => {
-        const { account } = await this._fetchAccount(
-          connectId,
-          deviceId,
-          "evm",
-          accountPath,
-          signal,
-          { book }
-        );
-        _KeystoneAdapter._throwIfAborted(signal);
-        if (!account.extendedPublicKey) {
-          throw createHwkError({
-            code: HardwareErrorCode.MethodNotSupported,
-            message: "Keystone did not return an extended public key for this account path"
-          });
-        }
-        const address = this.urEngine.deriveEvmAddressFromXpub(
-          account.extendedPublicKey,
-          relativeDerivePath
-        );
-        return success({ address, path: normalizePath(params.path) });
-      });
-    } catch (err) {
-      return this._errorToFailure(err);
-    }
+    return this._runJob(connectId, deviceId, async (signal) => {
+      const xpub = await this._fetchAccountXpub(
+        connectId,
+        deviceId,
+        "evm",
+        accountPath,
+        signal,
+        book
+      );
+      const address = this.urEngine.deriveEvmAddressFromXpub(xpub, relativeDerivePath);
+      return success({ address, path: normalizePath(params.path) });
+    });
   }
-  async evmSignTransaction(connectIdArg, deviceIdArg, paramsArg) {
-    const operationTarget = resolveHardwareOperationTarget(connectIdArg, paramsArg?.operationId);
+  async evmSignTransaction(connectIdArg, deviceIdArg, params) {
+    const operationTarget = resolveHardwareOperationTarget(connectIdArg, params?.operationId);
     if (!operationTarget.success) return operationTarget;
     const connectId = operationTarget.payload.targetId;
     const deviceId = deviceIdArg ?? void 0;
-    const params = paramsArg;
     if (!params)
       return failure(HardwareErrorCode.InvalidParams, "evmSignTransaction requires params");
     if (!params.path) {
@@ -1186,48 +1123,34 @@ var KeystoneAdapter = class _KeystoneAdapter {
     }
     const rawTxHex = stripHex(params.serializedTx);
     const path = normalizePath(params.path);
-    try {
-      return await this._jobQueue.enqueue(keystoneQueueKey(connectId, deviceId), async (signal) => {
-        const { record } = await this._ensureWalletKnown(connectId, deviceId, "evm", signal);
-        _KeystoneAdapter._throwIfAborted(signal);
-        const requestId = uuidv4();
-        const dataType = parseInt(rawTxHex.slice(0, 2), 16) < 192 ? "typedTransaction" : "transaction";
-        const requestUr = this.urEngine.buildEthSignRequest({
-          requestId,
-          unsignedTxHex: rawTxHex,
-          dataType,
-          path,
-          xfp: record.masterFingerprint,
-          chainId: params.chainId,
-          origin: this._origin
-        });
-        const responseUr = await this._resolveUr(
-          record,
-          requestUr,
-          true,
-          connectId,
-          signal,
-          "evmSignTransaction"
-        );
-        _KeystoneAdapter._throwIfAborted(signal);
-        const sig = this.urEngine.parseEthSignature(responseUr);
-        _KeystoneAdapter._assertRequestIdMatches(requestId, sig.requestId);
-        return success({
-          v: ensure0x(sig.v),
-          r: ensure0x(sig.r),
-          s: ensure0x(sig.s)
-        });
-      });
-    } catch (err) {
-      return this._errorToFailure(err);
-    }
+    const dataType = parseInt(rawTxHex.slice(0, 2), 16) < 192 ? "typedTransaction" : "transaction";
+    return this._signWithWallet({
+      connectId,
+      deviceId,
+      chain: "evm",
+      operationName: "evmSignTransaction",
+      buildRequest: (requestId, xfp) => this.urEngine.buildEthSignRequest({
+        requestId,
+        unsignedTxHex: rawTxHex,
+        dataType,
+        path,
+        xfp,
+        chainId: params.chainId,
+        origin: this._origin
+      }),
+      parseResponse: (ur) => this.urEngine.parseEthSignature(ur),
+      toPayload: (sig) => ({
+        v: ensure0x(sig.v),
+        r: ensure0x(sig.r),
+        s: ensure0x(sig.s)
+      })
+    });
   }
-  async evmSignMessage(connectIdArg, deviceIdArg, paramsArg) {
-    const operationTarget = resolveHardwareOperationTarget(connectIdArg, paramsArg?.operationId);
+  async evmSignMessage(connectIdArg, deviceIdArg, params) {
+    const operationTarget = resolveHardwareOperationTarget(connectIdArg, params?.operationId);
     if (!operationTarget.success) return operationTarget;
     const connectId = operationTarget.payload.targetId;
     const deviceId = deviceIdArg ?? void 0;
-    const params = paramsArg;
     if (!params) return failure(HardwareErrorCode.InvalidParams, "evmSignMessage requires params");
     if (!params.path || params.message === void 0) {
       return failure(
@@ -1237,43 +1160,29 @@ var KeystoneAdapter = class _KeystoneAdapter {
     }
     const messageHex = params.hex ? stripHex(params.message) : Buffer.from(params.message, "utf8").toString("hex");
     const path = normalizePath(params.path);
-    try {
-      return await this._jobQueue.enqueue(keystoneQueueKey(connectId, deviceId), async (signal) => {
-        const { record } = await this._ensureWalletKnown(connectId, deviceId, "evm", signal);
-        _KeystoneAdapter._throwIfAborted(signal);
-        const requestId = uuidv4();
-        const requestUr = this.urEngine.buildEthSignRequest({
-          requestId,
-          unsignedTxHex: messageHex,
-          dataType: "personalMessage",
-          path,
-          xfp: record.masterFingerprint,
-          chainId: params.chainId,
-          origin: this._origin
-        });
-        const responseUr = await this._resolveUr(
-          record,
-          requestUr,
-          true,
-          connectId,
-          signal,
-          "evmSignMessage"
-        );
-        _KeystoneAdapter._throwIfAborted(signal);
-        const sig = this.urEngine.parseEthSignature(responseUr);
-        _KeystoneAdapter._assertRequestIdMatches(requestId, sig.requestId);
-        return success({ signature: ensure0x(sig.r + sig.s + sig.v) });
-      });
-    } catch (err) {
-      return this._errorToFailure(err);
-    }
+    return this._signWithWallet({
+      connectId,
+      deviceId,
+      chain: "evm",
+      operationName: "evmSignMessage",
+      buildRequest: (requestId, xfp) => this.urEngine.buildEthSignRequest({
+        requestId,
+        unsignedTxHex: messageHex,
+        dataType: "personalMessage",
+        path,
+        xfp,
+        chainId: params.chainId,
+        origin: this._origin
+      }),
+      parseResponse: (ur) => this.urEngine.parseEthSignature(ur),
+      toPayload: (sig) => ({ signature: ensure0x(sig.r + sig.s + sig.v) })
+    });
   }
-  async evmSignTypedData(connectIdArg, deviceIdArg, paramsArg) {
-    const operationTarget = resolveHardwareOperationTarget(connectIdArg, paramsArg?.operationId);
+  async evmSignTypedData(connectIdArg, deviceIdArg, params) {
+    const operationTarget = resolveHardwareOperationTarget(connectIdArg, params?.operationId);
     if (!operationTarget.success) return operationTarget;
     const connectId = operationTarget.payload.targetId;
     const deviceId = deviceIdArg ?? void 0;
-    const params = paramsArg;
     if (!params)
       return failure(HardwareErrorCode.InvalidParams, "evmSignTypedData requires params");
     if (!params.path) {
@@ -1290,49 +1199,33 @@ var KeystoneAdapter = class _KeystoneAdapter {
       "utf8"
     ).toString("hex");
     const path = normalizePath(params.path);
-    try {
-      return await this._jobQueue.enqueue(keystoneQueueKey(connectId, deviceId), async (signal) => {
-        const { record } = await this._ensureWalletKnown(connectId, deviceId, "evm", signal);
-        _KeystoneAdapter._throwIfAborted(signal);
-        const requestId = uuidv4();
-        const requestUr = this.urEngine.buildEthSignRequest({
-          requestId,
-          unsignedTxHex: signDataHex,
-          dataType: "typedData",
-          path,
-          xfp: record.masterFingerprint,
-          chainId: params.chainId,
-          origin: this._origin
-        });
-        const responseUr = await this._resolveUr(
-          record,
-          requestUr,
-          true,
-          connectId,
-          signal,
-          "evmSignTypedData"
-        );
-        _KeystoneAdapter._throwIfAborted(signal);
-        const sig = this.urEngine.parseEthSignature(responseUr);
-        _KeystoneAdapter._assertRequestIdMatches(requestId, sig.requestId);
-        return success({ signature: ensure0x(sig.r + sig.s + sig.v) });
-      });
-    } catch (err) {
-      return this._errorToFailure(err);
-    }
+    return this._signWithWallet({
+      connectId,
+      deviceId,
+      chain: "evm",
+      operationName: "evmSignTypedData",
+      buildRequest: (requestId, xfp) => this.urEngine.buildEthSignRequest({
+        requestId,
+        unsignedTxHex: signDataHex,
+        dataType: "typedData",
+        path,
+        xfp,
+        chainId: params.chainId,
+        origin: this._origin
+      }),
+      parseResponse: (ur) => this.urEngine.parseEthSignature(ur),
+      toPayload: (sig) => ({ signature: ensure0x(sig.r + sig.s + sig.v) })
+    });
   }
   // ---------------------------------------------------------------------------
-  // BTC — PSBT signing and message signing only for now. Address/pubkey
-  // derivation needs script-type-aware xpub decoding (P2WPKH/P2TR/…) this
-  // phase doesn't wire in yet; structured-field tx signing needs host-side
-  // PSBT construction. Both are real, bounded follow-ups, not silent gaps.
+  // BTC: 44'/49'/84' addresses derive offline from the account xpub; P2TR addresses
+  // and structured-field tx signing are unsupported (the host builds a PSBT instead).
   // ---------------------------------------------------------------------------
-  async btcGetAddress(connectIdArg, deviceIdArg, paramsArg, book) {
-    const operationTarget = resolveHardwareOperationTarget(connectIdArg, paramsArg?.operationId);
+  async btcGetAddress(connectIdArg, deviceIdArg, params, book) {
+    const operationTarget = resolveHardwareOperationTarget(connectIdArg, params?.operationId);
     if (!operationTarget.success) return operationTarget;
     const connectId = operationTarget.payload.targetId;
     const deviceId = deviceIdArg ?? void 0;
-    const params = paramsArg;
     if (!params) return failure(HardwareErrorCode.InvalidParams, "btcGetAddress requires params");
     if (!params.path)
       return failure(HardwareErrorCode.InvalidParams, "btcGetAddress requires params.path");
@@ -1360,49 +1253,28 @@ var KeystoneAdapter = class _KeystoneAdapter {
     if (!isKeystoneSignableBtcAccountPath(accountPath)) {
       return failure(HardwareErrorCode.DevicePathForbidden, KEYSTONE_BTC_ACCOUNT_FORBIDDEN_MESSAGE);
     }
-    try {
-      return await this._jobQueue.enqueue(keystoneQueueKey(connectId, deviceId), async (signal) => {
-        const { account } = await this._fetchAccount(
-          connectId,
-          deviceId,
-          "btc",
-          accountPath,
-          signal,
-          { book }
-        );
-        _KeystoneAdapter._throwIfAborted(signal);
-        if (!account.extendedPublicKey) {
-          throw createHwkError({
-            code: HardwareErrorCode.MethodNotSupported,
-            message: "Keystone did not return an extended public key for this account path"
-          });
-        }
-        const address = this.urEngine.deriveBtcAddressFromXpub(
-          account.extendedPublicKey,
-          relativeDerivePath,
-          scriptType
-        );
-        return success({ address, path: normalizedPath });
-      });
-    } catch (err) {
-      return this._errorToFailure(err);
-    }
+    return this._runJob(connectId, deviceId, async (signal) => {
+      const xpub = await this._fetchAccountXpub(
+        connectId,
+        deviceId,
+        "btc",
+        accountPath,
+        signal,
+        book
+      );
+      const address = this.urEngine.deriveBtcAddressFromXpub(xpub, relativeDerivePath, scriptType);
+      return success({ address, path: normalizedPath });
+    });
   }
   /**
-   * Returns the account-level extended public key. `params.path` must be an
-   * ACCOUNT path (`m/84'/0'/0'`), not a leaf — that is the level Keystone
-   * actually syncs, and it is what a host needs to derive a whole account's
-   * addresses offline. Unlike `btcGetAddress` this has no script-type
-   * restriction: an xpub is script-type agnostic, so `86'` (taproot) works
-   * here even though deriving a taproot ADDRESS still needs an EC library
-   * this package doesn't wire in.
+   * `params.path` must be an account path (`m/84'/0'/0'`), the level Keystone syncs. An xpub is
+   * script-type agnostic, so `86'` works here even though `btcGetAddress` rejects it.
    */
-  async btcGetPublicKey(connectIdArg, deviceIdArg, paramsArg, book) {
-    const operationTarget = resolveHardwareOperationTarget(connectIdArg, paramsArg?.operationId);
+  async btcGetPublicKey(connectIdArg, deviceIdArg, params, book) {
+    const operationTarget = resolveHardwareOperationTarget(connectIdArg, params?.operationId);
     if (!operationTarget.success) return operationTarget;
     const connectId = operationTarget.payload.targetId;
     const deviceId = deviceIdArg ?? void 0;
-    const params = paramsArg;
     if (!params) return failure(HardwareErrorCode.InvalidParams, "btcGetPublicKey requires params");
     if (!params.path)
       return failure(HardwareErrorCode.InvalidParams, "btcGetPublicKey requires params.path");
@@ -1416,36 +1288,25 @@ var KeystoneAdapter = class _KeystoneAdapter {
     if (!isKeystoneSignableBtcAccountPath(accountPath)) {
       return failure(HardwareErrorCode.DevicePathForbidden, KEYSTONE_BTC_ACCOUNT_FORBIDDEN_MESSAGE);
     }
-    try {
-      return await this._jobQueue.enqueue(keystoneQueueKey(connectId, deviceId), async (signal) => {
-        const { account } = await this._fetchAccount(
-          connectId,
-          deviceId,
-          "btc",
-          accountPath,
-          signal,
-          { book }
-        );
-        _KeystoneAdapter._throwIfAborted(signal);
-        if (!account.extendedPublicKey) {
-          throw createHwkError({
-            code: HardwareErrorCode.MethodNotSupported,
-            message: "Keystone did not return an extended public key for this account path"
-          });
-        }
-        const meta = this.urEngine.parseXpubMeta(account.extendedPublicKey);
-        return success({
-          xpub: account.extendedPublicKey,
-          publicKey: meta.publicKey,
-          chainCode: meta.chainCode,
-          depth: meta.depth,
-          fingerprint: meta.parentFingerprint,
-          path: normalizePath(accountPath)
-        });
+    return this._runJob(connectId, deviceId, async (signal) => {
+      const xpub = await this._fetchAccountXpub(
+        connectId,
+        deviceId,
+        "btc",
+        accountPath,
+        signal,
+        book
+      );
+      const meta = this.urEngine.parseXpubMeta(xpub);
+      return success({
+        xpub,
+        publicKey: meta.publicKey,
+        chainCode: meta.chainCode,
+        depth: meta.depth,
+        fingerprint: meta.parentFingerprint,
+        path: normalizePath(accountPath)
       });
-    } catch (err) {
-      return this._errorToFailure(err);
-    }
+    });
   }
   async btcSignTransaction(_connectId, _deviceId, _params) {
     return this._unsupported(
@@ -1453,12 +1314,11 @@ var KeystoneAdapter = class _KeystoneAdapter {
       "use btcSignPsbt \u2014 structured input/output signing needs host-side PSBT construction, not yet wired in"
     );
   }
-  async btcSignPsbt(connectIdArg, deviceIdArg, paramsArg) {
-    const operationTarget = resolveHardwareOperationTarget(connectIdArg, paramsArg?.operationId);
+  async btcSignPsbt(connectIdArg, deviceIdArg, params) {
+    const operationTarget = resolveHardwareOperationTarget(connectIdArg, params?.operationId);
     if (!operationTarget.success) return operationTarget;
     const connectId = operationTarget.payload.targetId;
     const deviceId = deviceIdArg ?? void 0;
-    const params = paramsArg;
     if (!params) return failure(HardwareErrorCode.InvalidParams, "btcSignPsbt requires params");
     if (!params.psbt)
       return failure(HardwareErrorCode.InvalidParams, "btcSignPsbt requires params.psbt");
@@ -1467,33 +1327,28 @@ var KeystoneAdapter = class _KeystoneAdapter {
     if (!isKeystoneSignableBtcAccountPath(splitAccountPath(params.path).accountPath)) {
       return failure(HardwareErrorCode.DevicePathForbidden, KEYSTONE_BTC_ACCOUNT_FORBIDDEN_MESSAGE);
     }
-    try {
-      return await this._jobQueue.enqueue(keystoneQueueKey(connectId, deviceId), async (signal) => {
-        const { record } = await this._ensureWalletKnown(connectId, deviceId, "btc", signal);
-        _KeystoneAdapter._throwIfAborted(signal);
-        const requestUr = this.urEngine.buildBtcPsbtRequest(stripHex(params.psbt));
-        const responseUr = await this._resolveUr(
-          record,
-          requestUr,
-          true,
-          connectId,
-          signal,
-          "btcSignPsbt"
-        );
-        _KeystoneAdapter._throwIfAborted(signal);
-        const signedPsbt = this.urEngine.parseBtcPsbt(responseUr);
-        return success({ signedPsbt });
-      });
-    } catch (err) {
-      return this._errorToFailure(err);
-    }
+    return this._runJob(connectId, deviceId, async (signal) => {
+      const { record } = await this._ensureWalletKnown(connectId, deviceId, "btc", signal);
+      _KeystoneAdapter._throwIfAborted(signal);
+      const requestUr = this.urEngine.buildBtcPsbtRequest(stripHex(params.psbt));
+      const responseUr = await this._resolveUr(
+        record,
+        requestUr,
+        true,
+        connectId,
+        signal,
+        "btcSignPsbt"
+      );
+      _KeystoneAdapter._throwIfAborted(signal);
+      const signedPsbt = this.urEngine.parseBtcPsbt(responseUr);
+      return success({ signedPsbt });
+    });
   }
-  async btcSignMessage(connectIdArg, deviceIdArg, paramsArg) {
-    const operationTarget = resolveHardwareOperationTarget(connectIdArg, paramsArg?.operationId);
+  async btcSignMessage(connectIdArg, deviceIdArg, params) {
+    const operationTarget = resolveHardwareOperationTarget(connectIdArg, params?.operationId);
     if (!operationTarget.success) return operationTarget;
     const connectId = operationTarget.payload.targetId;
     const deviceId = deviceIdArg ?? void 0;
-    const params = paramsArg;
     if (!params) return failure(HardwareErrorCode.InvalidParams, "btcSignMessage requires params");
     if (!params.path || params.message === void 0) {
       return failure(
@@ -1506,80 +1361,55 @@ var KeystoneAdapter = class _KeystoneAdapter {
     if (!isKeystoneSignableBtcAccountPath(splitAccountPath(path).accountPath)) {
       return failure(HardwareErrorCode.DevicePathForbidden, KEYSTONE_BTC_ACCOUNT_FORBIDDEN_MESSAGE);
     }
-    try {
-      return await this._jobQueue.enqueue(keystoneQueueKey(connectId, deviceId), async (signal) => {
-        const { record } = await this._ensureWalletKnown(connectId, deviceId, "btc", signal);
-        _KeystoneAdapter._throwIfAborted(signal);
-        const requestId = uuidv4();
-        const requestUr = this.urEngine.buildBtcMessageSignRequest({
-          requestId,
-          messageHex,
-          accounts: [{ path, xfp: record.masterFingerprint }],
-          origin: this._origin
-        });
-        const responseUr = await this._resolveUr(
-          record,
-          requestUr,
-          true,
-          connectId,
-          signal,
-          "btcSignMessage"
-        );
-        _KeystoneAdapter._throwIfAborted(signal);
-        const sig = this.urEngine.parseBtcSignature(responseUr);
-        _KeystoneAdapter._assertRequestIdMatches(requestId, sig.requestId);
-        return success({ signature: sig.signature });
-      });
-    } catch (err) {
-      return this._errorToFailure(err);
-    }
+    return this._signWithWallet({
+      connectId,
+      deviceId,
+      chain: "btc",
+      operationName: "btcSignMessage",
+      buildRequest: (requestId, xfp) => this.urEngine.buildBtcMessageSignRequest({
+        requestId,
+        messageHex,
+        accounts: [{ path, xfp }],
+        origin: this._origin
+      }),
+      parseResponse: (ur) => this.urEngine.parseBtcSignature(ur),
+      toPayload: (sig) => ({ signature: sig.signature })
+    });
   }
   async btcGetMasterFingerprint(connectIdArg, deviceIdArg, paramsArg) {
     const operationTarget = resolveHardwareOperationTarget(connectIdArg, paramsArg?.operationId);
     if (!operationTarget.success) return operationTarget;
     const connectId = operationTarget.payload.targetId;
     const deviceId = deviceIdArg ?? void 0;
-    try {
-      return await this._jobQueue.enqueue(keystoneQueueKey(connectId, deviceId), async (signal) => {
-        const { record } = await this._ensureWalletKnown(connectId, deviceId, "btc", signal);
-        return success({ masterFingerprint: record.masterFingerprint });
-      });
-    } catch (err) {
-      return this._errorToFailure(err);
-    }
+    return this._runJob(connectId, deviceId, async (signal) => {
+      const { record } = await this._ensureWalletKnown(connectId, deviceId, "btc", signal);
+      return success({ masterFingerprint: record.masterFingerprint });
+    });
   }
   // ---------------------------------------------------------------------------
   // SOL
   // ---------------------------------------------------------------------------
-  async solGetAddress(connectIdArg, deviceIdArg, paramsArg, book) {
-    const operationTarget = resolveHardwareOperationTarget(connectIdArg, paramsArg?.operationId);
+  async solGetAddress(connectIdArg, deviceIdArg, params, book) {
+    const operationTarget = resolveHardwareOperationTarget(connectIdArg, params?.operationId);
     if (!operationTarget.success) return operationTarget;
     const connectId = operationTarget.payload.targetId;
     const deviceId = deviceIdArg ?? void 0;
-    const params = paramsArg;
     if (!params) return failure(HardwareErrorCode.InvalidParams, "solGetAddress requires params");
     if (!params.path)
       return failure(HardwareErrorCode.InvalidParams, "solGetAddress requires params.path");
     const path = normalizePath(params.path);
-    try {
-      return await this._jobQueue.enqueue(keystoneQueueKey(connectId, deviceId), async (signal) => {
-        const { account } = await this._fetchAccount(connectId, deviceId, "sol", path, signal, {
-          book
-        });
-        _KeystoneAdapter._throwIfAborted(signal);
-        const address = bs58.encode(Buffer.from(account.publicKey, "hex"));
-        return success({ address, path });
-      });
-    } catch (err) {
-      return this._errorToFailure(err);
-    }
+    return this._runJob(connectId, deviceId, async (signal) => {
+      const { account } = await this._fetchAccount(connectId, deviceId, "sol", path, signal, book);
+      _KeystoneAdapter._throwIfAborted(signal);
+      const address = bs58.encode(Buffer.from(account.publicKey, "hex"));
+      return success({ address, path });
+    });
   }
-  async solSignTransaction(connectIdArg, deviceIdArg, paramsArg) {
-    const operationTarget = resolveHardwareOperationTarget(connectIdArg, paramsArg?.operationId);
+  async solSignTransaction(connectIdArg, deviceIdArg, params) {
+    const operationTarget = resolveHardwareOperationTarget(connectIdArg, params?.operationId);
     if (!operationTarget.success) return operationTarget;
     const connectId = operationTarget.payload.targetId;
     const deviceId = deviceIdArg ?? void 0;
-    const params = paramsArg;
     if (!params)
       return failure(HardwareErrorCode.InvalidParams, "solSignTransaction requires params");
     if (!params.path || !params.serializedTx) {
@@ -1589,42 +1419,28 @@ var KeystoneAdapter = class _KeystoneAdapter {
       );
     }
     const path = normalizePath(params.path);
-    try {
-      return await this._jobQueue.enqueue(keystoneQueueKey(connectId, deviceId), async (signal) => {
-        const { record } = await this._ensureWalletKnown(connectId, deviceId, "sol", signal);
-        _KeystoneAdapter._throwIfAborted(signal);
-        const requestId = uuidv4();
-        const requestUr = this.urEngine.buildSolSignRequest({
-          requestId,
-          unsignedPayloadHex: stripHex(params.serializedTx),
-          dataType: "transaction",
-          path,
-          xfp: record.masterFingerprint,
-          origin: this._origin
-        });
-        const responseUr = await this._resolveUr(
-          record,
-          requestUr,
-          true,
-          connectId,
-          signal,
-          "solSignTransaction"
-        );
-        _KeystoneAdapter._throwIfAborted(signal);
-        const sig = this.urEngine.parseSolSignature(responseUr);
-        _KeystoneAdapter._assertRequestIdMatches(requestId, sig.requestId);
-        return success({ signature: sig.signature });
-      });
-    } catch (err) {
-      return this._errorToFailure(err);
-    }
+    return this._signWithWallet({
+      connectId,
+      deviceId,
+      chain: "sol",
+      operationName: "solSignTransaction",
+      buildRequest: (requestId, xfp) => this.urEngine.buildSolSignRequest({
+        requestId,
+        unsignedPayloadHex: stripHex(params.serializedTx),
+        dataType: "transaction",
+        path,
+        xfp,
+        origin: this._origin
+      }),
+      parseResponse: (ur) => this.urEngine.parseSolSignature(ur),
+      toPayload: (sig) => ({ signature: sig.signature })
+    });
   }
-  async solSignMessage(connectIdArg, deviceIdArg, paramsArg) {
-    const operationTarget = resolveHardwareOperationTarget(connectIdArg, paramsArg?.operationId);
+  async solSignMessage(connectIdArg, deviceIdArg, params) {
+    const operationTarget = resolveHardwareOperationTarget(connectIdArg, params?.operationId);
     if (!operationTarget.success) return operationTarget;
     const connectId = operationTarget.payload.targetId;
     const deviceId = deviceIdArg ?? void 0;
-    const params = paramsArg;
     if (!params) return failure(HardwareErrorCode.InvalidParams, "solSignMessage requires params");
     if (!params.path || !params.message) {
       return failure(
@@ -1633,50 +1449,32 @@ var KeystoneAdapter = class _KeystoneAdapter {
       );
     }
     const path = normalizePath(params.path);
-    try {
-      return await this._jobQueue.enqueue(keystoneQueueKey(connectId, deviceId), async (signal) => {
-        const { record } = await this._ensureWalletKnown(connectId, deviceId, "sol", signal);
-        _KeystoneAdapter._throwIfAborted(signal);
-        const requestId = uuidv4();
-        const requestUr = this.urEngine.buildSolSignRequest({
-          requestId,
-          unsignedPayloadHex: stripHex(params.message),
-          dataType: "message",
-          path,
-          xfp: record.masterFingerprint,
-          origin: this._origin
-        });
-        const responseUr = await this._resolveUr(
-          record,
-          requestUr,
-          true,
-          connectId,
-          signal,
-          "solSignMessage"
-        );
-        _KeystoneAdapter._throwIfAborted(signal);
-        const sig = this.urEngine.parseSolSignature(responseUr);
-        _KeystoneAdapter._assertRequestIdMatches(requestId, sig.requestId);
-        return success({ signature: sig.signature });
-      });
-    } catch (err) {
-      return this._errorToFailure(err);
-    }
+    return this._signWithWallet({
+      connectId,
+      deviceId,
+      chain: "sol",
+      operationName: "solSignMessage",
+      buildRequest: (requestId, xfp) => this.urEngine.buildSolSignRequest({
+        requestId,
+        unsignedPayloadHex: stripHex(params.message),
+        dataType: "message",
+        path,
+        xfp,
+        origin: this._origin
+      }),
+      parseResponse: (ur) => this.urEngine.parseSolSignature(ur),
+      toPayload: (sig) => ({ signature: sig.signature })
+    });
   }
   // ---------------------------------------------------------------------------
-  // TRON — routed through `TronSignRequest`/`TronSignature` (see
-  // urEngine/TronSignRequest.ts), whose key layout follows keystone-sdk-rust
-  // (tags 5201/5202, firmware >= 2.5.0). The OneKey Pro air-gap encoding under
-  // the same tag is a different layout the firmware rejects. Not keystone-sdk's
-  // bundled `sdk.tron` module either (protobuf-based, unverified response
-  // semantics).
+  // TRON: keystone-sdk-rust layout (tags 5201/5202, firmware >= 2.5.0), not sdk.tron's
+  // protobuf module; OneKey Pro's encoding under the same tag is rejected by the firmware.
   // ---------------------------------------------------------------------------
-  async tronGetAddress(connectIdArg, deviceIdArg, paramsArg, book) {
-    const operationTarget = resolveHardwareOperationTarget(connectIdArg, paramsArg?.operationId);
+  async tronGetAddress(connectIdArg, deviceIdArg, params, book) {
+    const operationTarget = resolveHardwareOperationTarget(connectIdArg, params?.operationId);
     if (!operationTarget.success) return operationTarget;
     const connectId = operationTarget.payload.targetId;
     const deviceId = deviceIdArg ?? void 0;
-    const params = paramsArg;
     if (!params) return failure(HardwareErrorCode.InvalidParams, "tronGetAddress requires params");
     if (!params.path)
       return failure(HardwareErrorCode.InvalidParams, "tronGetAddress requires params.path");
@@ -1687,39 +1485,24 @@ var KeystoneAdapter = class _KeystoneAdapter {
         "tronGetAddress requires a full leaf path, e.g. m/44'/195'/0'/0/0"
       );
     }
-    try {
-      return await this._jobQueue.enqueue(keystoneQueueKey(connectId, deviceId), async (signal) => {
-        const { account } = await this._fetchAccount(
-          connectId,
-          deviceId,
-          "tron",
-          accountPath,
-          signal,
-          { book }
-        );
-        _KeystoneAdapter._throwIfAborted(signal);
-        if (!account.extendedPublicKey) {
-          throw createHwkError({
-            code: HardwareErrorCode.MethodNotSupported,
-            message: "Keystone did not return an extended public key for this account path"
-          });
-        }
-        const address = this.urEngine.deriveTronAddressFromXpub(
-          account.extendedPublicKey,
-          relativeDerivePath
-        );
-        return success({ address, path: normalizePath(params.path) });
-      });
-    } catch (err) {
-      return this._errorToFailure(err);
-    }
+    return this._runJob(connectId, deviceId, async (signal) => {
+      const xpub = await this._fetchAccountXpub(
+        connectId,
+        deviceId,
+        "tron",
+        accountPath,
+        signal,
+        book
+      );
+      const address = this.urEngine.deriveTronAddressFromXpub(xpub, relativeDerivePath);
+      return success({ address, path: normalizePath(params.path) });
+    });
   }
-  async tronSignTransaction(connectIdArg, deviceIdArg, paramsArg) {
-    const operationTarget = resolveHardwareOperationTarget(connectIdArg, paramsArg?.operationId);
+  async tronSignTransaction(connectIdArg, deviceIdArg, params) {
+    const operationTarget = resolveHardwareOperationTarget(connectIdArg, params?.operationId);
     if (!operationTarget.success) return operationTarget;
     const connectId = operationTarget.payload.targetId;
     const deviceId = deviceIdArg ?? void 0;
-    const params = paramsArg;
     if (!params)
       return failure(HardwareErrorCode.InvalidParams, "tronSignTransaction requires params");
     if (!params.path) {
@@ -1733,41 +1516,28 @@ var KeystoneAdapter = class _KeystoneAdapter {
     }
     const rawTxHex = stripHex(params.rawTxHex);
     const path = normalizePath(params.path);
-    try {
-      return await this._jobQueue.enqueue(keystoneQueueKey(connectId, deviceId), async (signal) => {
-        const { record } = await this._ensureWalletKnown(connectId, deviceId, "tron", signal);
-        _KeystoneAdapter._throwIfAborted(signal);
-        const requestId = uuidv4();
-        const requestUr = this.urEngine.buildTronSignRequest({
-          requestId,
-          rawTxHex,
-          path,
-          xfp: record.masterFingerprint,
-          origin: this._origin
-        });
-        const responseUr = await this._resolveUr(
-          record,
-          requestUr,
-          true,
-          connectId,
-          signal,
-          "tronSignTransaction"
-        );
-        _KeystoneAdapter._throwIfAborted(signal);
-        const sig = this.urEngine.parseTronSignature(responseUr);
-        _KeystoneAdapter._assertRequestIdMatches(requestId, sig.requestId);
-        return success({ signature: sig.signature });
-      });
-    } catch (err) {
-      return this._errorToFailure(err);
-    }
+    return this._signWithWallet({
+      connectId,
+      deviceId,
+      chain: "tron",
+      operationName: "tronSignTransaction",
+      buildRequest: (requestId, xfp) => this.urEngine.buildTronSignRequest({
+        requestId,
+        rawTxHex,
+        path,
+        xfp,
+        origin: this._origin
+      }),
+      parseResponse: (ur) => this.urEngine.parseTronSignature(ur),
+      // Keystone signs rawTxHex as given and returns only the signature, so no serializedTx.
+      toPayload: (sig) => ({ signature: sig.signature })
+    });
   }
-  async tronSignMessage(connectIdArg, deviceIdArg, paramsArg) {
-    const operationTarget = resolveHardwareOperationTarget(connectIdArg, paramsArg?.operationId);
+  async tronSignMessage(connectIdArg, deviceIdArg, params) {
+    const operationTarget = resolveHardwareOperationTarget(connectIdArg, params?.operationId);
     if (!operationTarget.success) return operationTarget;
     const connectId = operationTarget.payload.targetId;
     const deviceId = deviceIdArg ?? void 0;
-    const params = paramsArg;
     if (!params) return failure(HardwareErrorCode.InvalidParams, "tronSignMessage requires params");
     if (!params.path) {
       return failure(HardwareErrorCode.InvalidParams, "tronSignMessage requires params.path");
@@ -1783,41 +1553,75 @@ var KeystoneAdapter = class _KeystoneAdapter {
     }
     const messageHex = stripHex(params.messageHex);
     const path = normalizePath(params.path);
+    return this._signWithWallet({
+      connectId,
+      deviceId,
+      chain: "tron",
+      operationName: "tronSignMessage",
+      buildRequest: (requestId, xfp) => this.urEngine.buildTronSignRequest({
+        requestId,
+        rawTxHex: messageHex,
+        path,
+        xfp,
+        signType: 2 /* PersonalMessage */,
+        origin: this._origin
+      }),
+      parseResponse: (ur) => this.urEngine.parseTronSignature(ur),
+      toPayload: (sig) => ({ signature: sig.signature })
+    });
+  }
+  // ---------------------------------------------------------------------------
+  // Internals
+  // ---------------------------------------------------------------------------
+  async _runJob(connectId, deviceId, job) {
     try {
-      return await this._jobQueue.enqueue(keystoneQueueKey(connectId, deviceId), async (signal) => {
-        const { record } = await this._ensureWalletKnown(connectId, deviceId, "tron", signal);
-        _KeystoneAdapter._throwIfAborted(signal);
-        const requestId = uuidv4();
-        const requestUr = this.urEngine.buildTronSignRequest({
-          requestId,
-          rawTxHex: messageHex,
-          path,
-          xfp: record.masterFingerprint,
-          signType: 2 /* PersonalMessage */,
-          origin: this._origin
-        });
-        const responseUr = await this._resolveUr(
-          record,
-          requestUr,
-          true,
-          connectId,
-          signal,
-          "tronSignMessage"
-        );
-        _KeystoneAdapter._throwIfAborted(signal);
-        const sig = this.urEngine.parseTronSignature(responseUr);
-        _KeystoneAdapter._assertRequestIdMatches(requestId, sig.requestId);
-        return success({ signature: sig.signature });
-      });
+      return await this._jobQueue.enqueue(keystoneQueueKey(connectId, deviceId), job);
     } catch (err) {
       return this._errorToFailure(err);
     }
   }
-  // ---------------------------------------------------------------------------
-  // Internals
-  // ---------------------------------------------------------------------------
-  _walletIdFromIdentifier(identifier) {
-    return keystoneWalletIdFromIdentifier(identifier);
+  async _fetchAccountXpub(connectId, deviceId, hwkChain, accountPath, signal, book) {
+    const { account } = await this._fetchAccount(
+      connectId,
+      deviceId,
+      hwkChain,
+      accountPath,
+      signal,
+      book
+    );
+    _KeystoneAdapter._throwIfAborted(signal);
+    if (!account.extendedPublicKey) {
+      throw createHwkError({
+        code: HardwareErrorCode.MethodNotSupported,
+        message: "Keystone did not return an extended public key for this account path"
+      });
+    }
+    return account.extendedPublicKey;
+  }
+  /**
+   * Signing needs only the wallet's mfp: the device re-derives the key from path+xfp, so no
+   * per-path account lookup happens here.
+   */
+  _signWithWallet(args) {
+    const { connectId, deviceId } = args;
+    return this._runJob(connectId, deviceId, async (signal) => {
+      const { record } = await this._ensureWalletKnown(connectId, deviceId, args.chain, signal);
+      _KeystoneAdapter._throwIfAborted(signal);
+      const requestId = uuidv4();
+      const requestUr = args.buildRequest(requestId, record.masterFingerprint);
+      const responseUr = await this._resolveUr(
+        record,
+        requestUr,
+        true,
+        connectId,
+        signal,
+        args.operationName
+      );
+      _KeystoneAdapter._throwIfAborted(signal);
+      const signature = args.parseResponse(responseUr);
+      _KeystoneAdapter._assertRequestIdMatches(requestId, signature.requestId);
+      return success(args.toPayload(signature));
+    });
   }
   _allNetworkSyncSchema(item) {
     if (!isAllNetworkMethodName(String(item.methodName)) || !item.path) return void 0;
@@ -1840,16 +1644,13 @@ var KeystoneAdapter = class _KeystoneAdapter {
     }
   }
   /**
-   * QR is an interactive batch transport: one account-creation action must
-   * produce one request QR and one response scan, regardless of how many
-   * chains or derivation paths the host bundled. USB keeps its proven
-   * one-path-at-a-time export flow because the device limits that channel.
+   * QR answers the whole bundle with one request QR and one scan. USB exports one path per
+   * request because the device limits that channel.
    */
   async _prefetchAllNetworkAccounts(connectId, deviceId, params) {
     return this._jobQueue.enqueue(keystoneQueueKey(connectId, deviceId), async (signal) => {
       const target = this._resolveTarget(connectId, deviceId);
-      const { record: targetRecord } = target;
-      let record = targetRecord;
+      let { record } = target;
       const requestedByKey = /* @__PURE__ */ new Map();
       for (const item of params.bundle) {
         const schema = this._allNetworkSyncSchema(item);
@@ -1859,11 +1660,23 @@ var KeystoneAdapter = class _KeystoneAdapter {
       if (!requestedByKey.size) {
         return { book };
       }
+      const requestedSchemas = Array.from(requestedByKey.values());
+      const assertAllBooked = () => {
+        for (const schema of requestedSchemas) {
+          if (!book.has(accountKey(schema.hwkChain, schema.path))) {
+            throw createHwkError({
+              code: HardwareErrorCode.DeviceMismatch,
+              message: `Keystone did not return the requested derivation path (${schema.path})`
+            });
+          }
+        }
+      };
       const operation = isHardwareOperationId2(params.operationId) ? this._operations.find(params.operationId) : void 0;
       const operationRoute = operation ? this._operationRoutes.get(operation.connectId) : void 0;
       const routedToQr = operationRoute?.operationId === operation?.operationId && operationRoute?.connectionType === "qr";
       if (this._forcedTransport !== "qr" && !routedToQr && !record?.usbSessionId && this._usbConnector && target.expectedWalletId) {
         record = await this._tryUsbAttach(
+          signal,
           target.expectedWalletId,
           record?.masterFingerprint ?? target.expectedMasterFingerprint
         ) ?? record;
@@ -1879,8 +1692,7 @@ var KeystoneAdapter = class _KeystoneAdapter {
             });
           }
         };
-        const missingSchemas2 = Array.from(requestedByKey.values());
-        for (const schema of missingSchemas2) {
+        for (const schema of requestedSchemas) {
           if (!book.has(accountKey(schema.hwkChain, schema.path))) {
             assertBundleSession();
             const synced = await this._fetchAccount(
@@ -1889,20 +1701,13 @@ var KeystoneAdapter = class _KeystoneAdapter {
               schema.hwkChain,
               schema.path,
               signal,
-              { book }
+              book
             );
             record = synced.record;
             assertBundleSession();
           }
         }
-        for (const schema of missingSchemas2) {
-          if (!book.has(accountKey(schema.hwkChain, schema.path))) {
-            throw createHwkError({
-              code: HardwareErrorCode.DeviceMismatch,
-              message: `Keystone did not return the requested derivation path (${schema.path})`
-            });
-          }
-        }
+        assertAllBooked();
         return { book, walletId: record.walletId };
       }
       if (this._forcedTransport === "usb") {
@@ -1911,16 +1716,14 @@ var KeystoneAdapter = class _KeystoneAdapter {
           message: "USB channel is not connected for this Keystone wallet"
         });
       }
-      const missingSchemas = Array.from(requestedByKey.values());
       const schemas = [
         { hwkChain: "evm", path: KEYSTONE_WALLET_ID_PATH },
-        ...missingSchemas.filter((schema) => normalizePath(schema.path) !== KEYSTONE_WALLET_ID_PATH)
+        ...requestedSchemas.filter(
+          (schema) => normalizePath(schema.path) !== KEYSTONE_WALLET_ID_PATH
+        )
       ];
       const requestUr = this.urEngine.buildKeyDerivationRequest({
-        schemas: schemas.map((schema) => ({
-          path: schema.path,
-          curve: schema.hwkChain === "sol" ? "ed25519" : "secp256k1"
-        })),
+        schemas: schemas.map((schema) => keySchema(schema.hwkChain, schema.path)),
         origin: this._origin
       });
       const responseUr = await this._requestQrDisplayAndAwaitResponse(
@@ -1939,20 +1742,10 @@ var KeystoneAdapter = class _KeystoneAdapter {
         const normalizedPath = normalizePath(account.path);
         const hwkChain = requestedChainByPath.get(normalizedPath) ?? inferHwkChainFromPath(normalizedPath);
         if (hwkChain) {
-          book.set(accountKey(hwkChain, normalizedPath), {
-            ...account,
-            hwkChain
-          });
-        }
-      }
-      for (const schema of missingSchemas) {
-        if (!book.has(accountKey(schema.hwkChain, schema.path))) {
-          throw createHwkError({
-            code: HardwareErrorCode.DeviceMismatch,
-            message: `Keystone did not return the requested derivation path (${schema.path})`
-          });
+          book.set(accountKey(hwkChain, normalizedPath), { ...account, hwkChain });
         }
       }
+      assertAllBooked();
       return { book, walletId: record.walletId };
     });
   }
@@ -1961,15 +1754,12 @@ var KeystoneAdapter = class _KeystoneAdapter {
    * fingerprint is protocol metadata and is never accepted as a lookup key.
    */
   _resolveTarget(connectId, deviceId) {
-    let resolvedConnectId = connectId;
-    if (isHardwareOperationId2(connectId)) {
-      resolvedConnectId = this._operations.resolve(connectId).connectId;
-    }
+    const resolvedConnectId = isHardwareOperationId2(connectId) ? this._operations.resolve(connectId).connectId : connectId;
     const identifiers = [deviceId, resolvedConnectId].filter(
       (identifier) => Boolean(identifier)
     );
     if (!identifiers.length) return {};
-    const walletIds = identifiers.map((identifier) => this._walletIdFromIdentifier(identifier)).filter((walletId) => Boolean(walletId));
+    const walletIds = identifiers.map((identifier) => keystoneWalletIdFromIdentifier(identifier)).filter((walletId) => Boolean(walletId));
     if (!walletIds.length) {
       throw createHwkError({
         code: HardwareErrorCode.DeviceNotFound,
@@ -1983,7 +1773,7 @@ var KeystoneAdapter = class _KeystoneAdapter {
         message: "Keystone connectId and deviceId identify different wallets"
       });
     }
-    if (identifiers.some((identifier) => !this._walletIdFromIdentifier(identifier))) {
+    if (identifiers.some((identifier) => !keystoneWalletIdFromIdentifier(identifier))) {
       throw createHwkError({
         code: HardwareErrorCode.DeviceMismatch,
         message: "Keystone connectId and deviceId are inconsistent"
@@ -2013,13 +1803,8 @@ var KeystoneAdapter = class _KeystoneAdapter {
     return walletId;
   }
   /**
-   * Folds a parsed account-response UR into the device table. `viaUsb`
-   * (defaults false) says which channel actually carried this round trip —
-   * `_resolveUr` routes a KeyDerivation sync over USB when the target record
-   * already has a live session, so this must NOT unconditionally mark
-   * `qrSynced`, or a USB-only wallet would wrongly survive a later USB
-   * disconnect as a "QR-synced, demote to QR-only" entry instead of being
-   * dropped outright (see `releaseOperation`).
+   * Folds a parsed account response into the device table. Only non-USB round trips mark
+   * `qrSynced`, so a USB-only wallet is dropped on disconnect.
    */
   _upsertDeviceRecord(parsed, options) {
     const walletId = deriveKeystoneWalletId(parsed.accounts);
@@ -2045,34 +1830,38 @@ var KeystoneAdapter = class _KeystoneAdapter {
     return record;
   }
   /**
-   * Opens+claims whatever Keystone the USB connector currently has
-   * permission for, learns its protocol mfp via `getAppConfig`, then requests
-   * one fixed account-level xpub and derives the stable wallet id. A
-   * QR-synced entry becomes
-   * `{qr, usb}`-capable in place (one `device-changed`, not a second
-   * `device-connect`); a wallet never seen before becomes a new USB-only
-   * entry. See §4.2 of the design doc.
+   * Opens a permitted USB Keystone, reads its mfp, and derives the wallet id from the identity
+   * xpub. A known wallet gains USB in place (`device-changed`); an unseen one becomes USB-only.
    */
-  async _connectUsb(expected, searchTargetId) {
-    if (this._pendingUsbTeardowns > 0) {
+  async _connectUsb(expected, searchTargetId, signal) {
+    if (this._pendingUsbTeardowns > 0 || this._abandonedUsbConnects > 0) {
       return failure(
         HardwareErrorCode.DeviceBusyInternal,
         "Keystone USB session is being released"
       );
     }
-    const previous = this._usbConnectTail;
-    let release;
-    this._usbConnectTail = new Promise((resolve) => {
-      release = resolve;
+    _KeystoneAdapter._throwIfAborted(signal);
+    let abandoned = false;
+    const onAbort = () => {
+      abandoned = true;
+      this._abandonedUsbConnects += 1;
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+    const pending = this._usbConnectTail.then(async () => {
+      _KeystoneAdapter._throwIfAborted(signal);
+      return this._connectUsbExclusive(expected, searchTargetId, signal);
     });
-    await previous;
-    try {
-      return await this._connectUsbExclusive(expected, searchTargetId);
-    } finally {
-      release?.();
-    }
+    const settled = pending.finally(() => {
+      signal?.removeEventListener("abort", onAbort);
+      if (abandoned) this._abandonedUsbConnects -= 1;
+    });
+    this._usbConnectTail = settled.then(
+      () => void 0,
+      () => void 0
+    );
+    return signal ? _KeystoneAdapter._abortable(signal, settled) : settled;
   }
-  async _connectUsbExclusive(expected, searchTargetId) {
+  async _connectUsbExclusive(expected, searchTargetId, signal) {
     if (!this._usbConnector) {
       return failure(
         HardwareErrorCode.TransportNotAvailable,
@@ -2093,6 +1882,7 @@ var KeystoneAdapter = class _KeystoneAdapter {
       const connector = this._usbConnector;
       const session = await (connector.connectTarget ? connector.connectTarget(connectTarget) : connector.connect(searchTargetId ?? expected.expectedMasterFingerprint));
       sessionId = session.sessionId;
+      _KeystoneAdapter._throwIfAborted(signal);
       const raw = session.deviceInfo.raw;
       const mfpValue = parseBip32MasterFingerprint2(raw?.masterFingerprint);
       if (!mfpValue) {
@@ -2109,7 +1899,7 @@ var KeystoneAdapter = class _KeystoneAdapter {
         });
       }
       const identityRequest = this.urEngine.buildKeyDerivationRequest({
-        schemas: [{ path: KEYSTONE_WALLET_ID_PATH, curve: "secp256k1" }],
+        schemas: [keySchema("evm", KEYSTONE_WALLET_ID_PATH)],
         origin: this._origin
       });
       const identityResult = await this._callUsbConnector(
@@ -2117,6 +1907,7 @@ var KeystoneAdapter = class _KeystoneAdapter {
         "resolveUr",
         identityRequest
       );
+      _KeystoneAdapter._throwIfAborted(signal);
       if (!identityResult.success) {
         throw rehydrateConnectorError(identityResult.error);
       }
@@ -2127,21 +1918,22 @@ var KeystoneAdapter = class _KeystoneAdapter {
       });
       const walletId = deriveKeystoneWalletId(parsed.accounts);
       const previousUsbSessionId = this._devices.get(walletId)?.usbSessionId;
-      const record = this._upsertDeviceRecord(parsed, {
-        viaUsb: true,
-        usbSessionId: session.sessionId
-      });
       if (previousUsbSessionId && previousUsbSessionId !== session.sessionId) {
         try {
           await this._usbConnector.disconnect(previousUsbSessionId);
         } catch {
         }
       }
+      _KeystoneAdapter._throwIfAborted(signal);
+      const record = this._upsertDeviceRecord(parsed, {
+        viaUsb: true,
+        usbSessionId: session.sessionId
+      });
+      _KeystoneAdapter._throwIfAborted(signal);
       record.hadUsbSession = true;
       record.model = session.deviceInfo.modelName ?? session.deviceInfo.model ?? record.model;
       record.deviceVersion = session.deviceInfo.firmwareVersion ?? record.deviceVersion;
-      const info = toDeviceInfo(record);
-      return success(info);
+      return success(toDeviceInfo(record));
     } catch (err) {
       if (sessionId) {
         try {
@@ -2153,13 +1945,11 @@ var KeystoneAdapter = class _KeystoneAdapter {
     }
   }
   /**
-   * Probe already-authorized USB devices without opening a permission picker,
-   * then attach and verify the requested wallet when one is present. This is
-   * used both after an adapter restart and after a QR-only period, so plugging
-   * USB back in affects the next business call without changing an in-flight
-   * QR operation.
+   * Probes already-authorized USB devices without a permission picker, then attaches and verifies
+   * the requested wallet if present.
    */
-  async _tryUsbAttach(expectedWalletId, expectedMasterFingerprint, options) {
+  async _tryUsbAttach(signal, expectedWalletId, expectedMasterFingerprint, options) {
+    _KeystoneAdapter._throwIfAborted(signal);
     if (!expectedWalletId || this._forcedTransport === "qr" || !this._usbConnector) {
       return void 0;
     }
@@ -2167,17 +1957,22 @@ var KeystoneAdapter = class _KeystoneAdapter {
     let availableDevices = [];
     let lastSearchError;
     for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+      _KeystoneAdapter._throwIfAborted(signal);
       try {
-        availableDevices = await this._usbConnector.searchDevices({ purpose: "availability" });
+        availableDevices = await _KeystoneAdapter._abortable(
+          signal,
+          this._usbConnector.searchDevices({ purpose: "availability" })
+        );
         lastSearchError = void 0;
       } catch (error) {
         lastSearchError = error;
       }
+      _KeystoneAdapter._throwIfAborted(signal);
       if (availableDevices.length) {
         break;
       }
       if (attempt < maxAttempts) {
-        await waitForKeystoneUsbReattachProbe();
+        await _KeystoneAdapter._abortable(signal, waitForKeystoneUsbReattachProbe());
       }
     }
     if (!availableDevices.length) {
@@ -2192,8 +1987,16 @@ var KeystoneAdapter = class _KeystoneAdapter {
     for (const device of candidates) {
       attached = await this._connectUsb(
         { expectedWalletId, expectedMasterFingerprint },
-        device?.connectId
+        device?.connectId,
+        signal
       );
+      _KeystoneAdapter._throwIfAborted(signal);
+      if (!attached.success && attached.payload.code === HardwareErrorCode.DeviceBusyInternal) {
+        throw createHwkError({
+          ...attached.payload,
+          message: attached.payload.error
+        });
+      }
       if (attached.success) {
         record = this._devices.get(expectedWalletId);
         if (record) break;
@@ -2202,14 +2005,8 @@ var KeystoneAdapter = class _KeystoneAdapter {
     return record;
   }
   /**
-   * The one place that decides QR vs. USB for a UR round trip and carries it
-   * out. `record` is the (possibly not-yet-existing, for a true cold start)
-   * device row for the target wallet. USB is the preferred channel: a known
-   * wallet record with no live session gets ONE best-effort re-attach here,
-   * and anything that goes wrong just leaves the call on QR. A
-   * `switchTransport('qr')` pin forces QR even for a USB-attached wallet;
-   * `switchTransport('usb')` on a wallet with no live USB session fails
-   * closed rather than silently falling back to QR.
+   * Decides QR vs USB for one UR round trip. A pinned 'usb' with no live session fails closed;
+   * otherwise a failed USB reattach leaves the call on QR.
    */
   async _resolveUr(record, requestUr, animated, operationId, signal, operationName) {
     const releaseOperationRetention = isHardwareOperationId2(operationId) ? this._operations.retain(operationId) : void 0;
@@ -2232,17 +2029,15 @@ var KeystoneAdapter = class _KeystoneAdapter {
       const operation = this._operations.resolve(operationId);
       const route = this._operationRoutes.get(operation.connectId);
       if (!route || route.operationId !== operationId) {
-        this._operations.end(operationId, "disconnect");
-        throw createHwkError({
-          code: HardwareErrorCode.OperationEnded,
-          message: "Keystone hardware operation is no longer connected",
-          params: { operationId, reason: "disconnect" }
-        });
+        throw this._endDisconnectedOperation(
+          operationId,
+          "Keystone hardware operation is no longer connected"
+        );
       }
       interactionRoute = route;
     }
     if (!interactionRoute && !this._forcedTransport && record && !record.usbSessionId && this._usbConnector) {
-      await this._tryUsbAttach(record.walletId, record.masterFingerprint, {
+      await this._tryUsbAttach(signal, record.walletId, record.masterFingerprint, {
         waitForReenumeration: record.hadUsbSession
       });
     }
@@ -2250,15 +2045,10 @@ var KeystoneAdapter = class _KeystoneAdapter {
     if (wantUsb) {
       if (!record?.usbSessionId || !this._usbConnector) {
         if (interactionRoute) {
-          this._operations.end(interactionRoute.operationId, "disconnect");
-          throw createHwkError({
-            code: HardwareErrorCode.OperationEnded,
-            message: "Keystone operation USB connection was lost",
-            params: {
-              operationId: interactionRoute.operationId,
-              reason: "disconnect"
-            }
-          });
+          throw this._endDisconnectedOperation(
+            interactionRoute.operationId,
+            "Keystone operation USB connection was lost"
+          );
         }
         throw createHwkError({
           code: HardwareErrorCode.TransportNotAvailable,
@@ -2273,15 +2063,17 @@ var KeystoneAdapter = class _KeystoneAdapter {
       );
       if (result.success) return result.payload;
       const usbError = rehydrateConnectorError(result.error);
-      const usbErrorOrigin = usbError.origin;
-      const usbErrorCode = usbError.code;
-      if (!interactionRoute && !this._forcedTransport && usbErrorCode === HardwareErrorCode.PayloadTooLarge && usbErrorOrigin !== "device") {
-        const displayDevice2 = toDeviceInfo(record);
-        return this._requestQrDisplayAndAwaitResponse(
-          displayDevice2,
-          { ...requestUr, animated },
-          signal
-        );
+      const { origin: usbErrorOrigin, code: usbErrorCode } = usbError;
+      if (usbErrorCode === HardwareErrorCode.PayloadTooLarge && usbErrorOrigin !== "device") {
+        if (!interactionRoute && !this._forcedTransport) {
+          const displayDevice2 = toDeviceInfo(record);
+          return this._requestQrDisplayAndAwaitResponse(
+            displayDevice2,
+            { ...requestUr, animated },
+            signal
+          );
+        }
+        throw usbError;
       }
       const deviceAnswered = usbErrorOrigin !== void 0 ? usbErrorOrigin === "device" : usbErrorCode === HardwareErrorCode.UserRejected || usbErrorCode === HardwareErrorCode.UserAborted || usbErrorCode === HardwareErrorCode.DeviceLocked || usbErrorCode === HardwareErrorCode.DeviceMismatch;
       if (!deviceAnswered) {
@@ -2291,19 +2083,11 @@ var KeystoneAdapter = class _KeystoneAdapter {
         }
         record.usbSessionId = void 0;
         if (interactionRoute) {
-          this._operations.end(interactionRoute.operationId, "disconnect");
-          throw createHwkError({
-            code: HardwareErrorCode.OperationEnded,
-            message: operationName ? `Keystone ${operationName} may have completed before the USB connection was lost` : "Keystone operation USB connection was lost",
-            recovery: operationName ? { scope: "unknown" } : void 0,
-            params: operationName ? operationMayHaveCompletedParams(operationName, {
-              operationId: interactionRoute.operationId,
-              reason: "disconnect"
-            }) : {
-              operationId: interactionRoute.operationId,
-              reason: "disconnect"
-            }
-          });
+          throw this._endDisconnectedOperation(
+            interactionRoute.operationId,
+            operationName ? `Keystone ${operationName} may have completed before the USB connection was lost` : "Keystone operation USB connection was lost",
+            operationName
+          );
         }
         if (operationName) {
           throw createHwkError({
@@ -2337,51 +2121,49 @@ var KeystoneAdapter = class _KeystoneAdapter {
       throw error;
     }
   }
+  /** Ends the operation as disconnected and returns the error to throw. */
+  _endDisconnectedOperation(operationId, message, operationName) {
+    this._operations.end(operationId, "disconnect");
+    const params = { operationId, reason: "disconnect" };
+    return createHwkError({
+      code: HardwareErrorCode.OperationEnded,
+      message,
+      recovery: operationName ? { scope: "unknown" } : void 0,
+      params: operationName ? operationMayHaveCompletedParams(operationName, params) : params
+    });
+  }
   /**
-   * Fetch one account's key material from the device for this operation only.
-   * `book` lets earlier fetches of the same operation be reused; nothing is
-   * retained on the record. A failed USB export ends this operation without
-   * replaying the request or switching transports.
+   * Fetches one account's key material for this operation only; `book` reuses earlier fetches. A
+   * failed USB export ends the operation without replaying or switching transports.
    */
-  async _fetchAccount(connectId, deviceId, hwkChain, syncPath, signal, options) {
+  async _fetchAccount(connectId, deviceId, hwkChain, syncPath, signal, book) {
     const target = this._resolveTarget(connectId, deviceId);
+    const operationConnectionType = isHardwareOperationId2(connectId) ? this._operations.resolve(connectId).connectionType : void 0;
     const key = accountKey(hwkChain, syncPath);
     let existingRecord = target.record;
     if (!existingRecord) {
-      const attached = await this._tryUsbAttach(target.expectedWalletId);
+      existingRecord = await this._tryUsbAttach(signal, target.expectedWalletId);
       _KeystoneAdapter._throwIfAborted(signal);
-      existingRecord = attached;
     }
-    const book = options?.book;
     const booked = book?.get(key);
     if (existingRecord && booked) {
       return { record: existingRecord, account: booked };
     }
-    if (existingRecord && !existingRecord.usbSessionId && this._forcedTransport === "usb") {
-      await this._tryUsbAttach(existingRecord.walletId, existingRecord.masterFingerprint, {
+    if (!operationConnectionType && existingRecord && !existingRecord.usbSessionId && this._forcedTransport === "usb") {
+      await this._tryUsbAttach(signal, existingRecord.walletId, existingRecord.masterFingerprint, {
         waitForReenumeration: existingRecord.hadUsbSession
       });
       _KeystoneAdapter._throwIfAborted(signal);
       existingRecord = this._devices.get(existingRecord.walletId) ?? existingRecord;
     }
-    const useSinglePathUsbExport = this._forcedTransport !== "qr" && Boolean(existingRecord?.usbSessionId);
-    const requestedSchemaPaths = [
-      { hwkChain, path: syncPath }
-    ];
-    const schemaPaths = useSinglePathUsbExport || requestedSchemaPaths.some((schema) => normalizePath(schema.path) === KEYSTONE_WALLET_ID_PATH) ? requestedSchemaPaths : [{ hwkChain: "evm", path: KEYSTONE_WALLET_ID_PATH }, ...requestedSchemaPaths];
-    const requestUr = this.urEngine.buildKeyDerivationRequest({
-      schemas: schemaPaths.map((s) => ({
-        path: s.path,
-        curve: s.hwkChain === "sol" ? "ed25519" : "secp256k1"
-      })),
-      origin: this._origin
-    });
-    const resolvedViaUsb = useSinglePathUsbExport;
+    const useSinglePathUsbExport = operationConnectionType ? operationConnectionType === "usb" : this._forcedTransport !== "qr" && Boolean(existingRecord?.usbSessionId);
+    const schemas = useSinglePathUsbExport || normalizePath(syncPath) === KEYSTONE_WALLET_ID_PATH ? [keySchema(hwkChain, syncPath)] : [keySchema("evm", KEYSTONE_WALLET_ID_PATH), keySchema(hwkChain, syncPath)];
+    const requestUr = this.urEngine.buildKeyDerivationRequest({ schemas, origin: this._origin });
     const responseUr = await this._resolveUr(existingRecord, requestUr, false, connectId, signal);
     _KeystoneAdapter._throwIfAborted(signal);
     const parsed = this.urEngine.parseAccountResponse(responseUr);
     let record;
-    if (resolvedViaUsb && existingRecord) {
+    if (useSinglePathUsbExport && existingRecord) {
       if (parsed.masterFingerprint !== existingRecord.masterFingerprint) {
         throw createHwkError({
           code: HardwareErrorCode.DeviceMismatch,
@@ -2392,7 +2174,7 @@ var KeystoneAdapter = class _KeystoneAdapter {
     } else {
       this._assertParsedIdentity(parsed, target);
       record = this._upsertDeviceRecord(parsed, {
-        viaUsb: Boolean(existingRecord?.usbSessionId)
+        viaUsb: operationConnectionType !== "qr" && Boolean(existingRecord?.usbSessionId)
       });
     }
     const account = parsed.accounts.find((a) => normalizePath(a.path) === syncPath);
@@ -2418,52 +2200,27 @@ var KeystoneAdapter = class _KeystoneAdapter {
     return { record, account: entry };
   }
   /**
-   * Like `_fetchAccount`, but for operations (PSBT signing, master
-   * fingerprint) that only need to know WHICH wallet is attached, not a
-   * specific cached path. Syncs the account-level path for `chain` as a
-   * throwaway probe when the wallet record isn't already known.
-   *
-   * `CHAIN_FINGERPRINT_PATHS[chain]` is a 5-segment LEAF path for `evm`
-   * (`m/44'/60'/0'/0/0`) — sending that verbatim as a KeyDerivation request
-   * asks Keystone for a non-standard path. Keystone's own docs
-   * (dev.keyst.one's multichain KeyDerivation example) show the ETH
-   * account-level path as `m/44'/60'/0'` (3 segments), same as what
-   * `_fetchAccount` already requests — so
-   * truncate through `splitAccountPath` here too instead of using the raw
-   * fingerprint leaf path. `btc`/`sol` are already 3-segment account paths
-   * and pass through unchanged.
+   * Resolves which wallet is attached, without a per-path account. `CHAIN_FINGERPRINT_PATHS.evm` is
+   * a leaf path, so it is cut to the account path Keystone expects.
    */
   async _ensureWalletKnown(connectId, deviceId, chain, signal) {
     const target = this._resolveTarget(connectId, deviceId);
     if (target.record) return { record: target.record };
-    const attached = await this._tryUsbAttach(target.expectedWalletId);
+    const attached = await this._tryUsbAttach(signal, target.expectedWalletId);
     _KeystoneAdapter._throwIfAborted(signal);
     if (attached) return { record: attached };
     const { accountPath } = splitAccountPath(CHAIN_FINGERPRINT_PATHS[chain]);
-    const schemas = accountPath === KEYSTONE_WALLET_ID_PATH ? [{ path: KEYSTONE_WALLET_ID_PATH, curve: "secp256k1" }] : [
-      { path: KEYSTONE_WALLET_ID_PATH, curve: "secp256k1" },
-      {
-        path: accountPath,
-        curve: chain === "sol" ? "ed25519" : "secp256k1"
-      }
-    ];
-    const requestUr = this.urEngine.buildKeyDerivationRequest({
-      schemas,
-      origin: this._origin
-    });
+    const schemas = accountPath === KEYSTONE_WALLET_ID_PATH ? [keySchema("evm", KEYSTONE_WALLET_ID_PATH)] : [keySchema("evm", KEYSTONE_WALLET_ID_PATH), keySchema(chain, accountPath)];
+    const requestUr = this.urEngine.buildKeyDerivationRequest({ schemas, origin: this._origin });
     const responseUr = await this._resolveUr(void 0, requestUr, false, connectId, signal);
     _KeystoneAdapter._throwIfAborted(signal);
     const parsed = this.urEngine.parseAccountResponse(responseUr);
     this._assertParsedIdentity(parsed, target);
-    const record = this._upsertDeviceRecord(parsed);
-    return { record };
+    return { record: this._upsertDeviceRecord(parsed) };
   }
   /**
-   * The operation the running device job belongs to, so a UI request raised
-   * mid-call can name it. A call pinned to an operation queues under its id
-   * (`keystoneQueueKey`); a call without one queues under the wallet id or the
-   * wallet connectId, and the live operation routed to that connection is still
-   * the owner. Only a cold start comes back undefined.
+   * The operation owning the running job, so a mid-call UI request can name it. Unpinned jobs map
+   * through the operation route; a cold start returns undefined.
    */
   _activeOperationId() {
     const activeJobId = this._jobQueue.getActiveJob()?.deviceId;
@@ -2481,9 +2238,8 @@ var KeystoneAdapter = class _KeystoneAdapter {
     return walletId ? this._operationRoutes.get(walletConnectId(walletId)) : void 0;
   }
   /**
-   * A QR prompt has no transport to interrupt, so an aborted job would sit here
-   * until the QR timeout. Releasing the registry slot on abort is what lets a
-   * cancel reach the wait at all.
+   * A QR prompt has no transport to interrupt; releasing the registry slot on abort is what lets
+   * a cancel reach the wait before the QR timeout.
    */
   async _awaitQrResponse(requestType, pending, signal) {
     if (!signal) return pending;
@@ -2552,8 +2308,7 @@ var KeystoneAdapter = class _KeystoneAdapter {
     const releaseOperation = this._retainUsbOperation(`call:${sessionId}`);
     let rawCall;
     try {
-      const connector = this._usbConnector;
-      rawCall = connector.call(sessionId, method, params).finally(releaseOperation);
+      rawCall = this._usbConnector.call(sessionId, method, params).finally(releaseOperation);
     } catch (error) {
       releaseOperation();
       throw error;
@@ -2603,13 +2358,10 @@ var KeystoneAdapter = class _KeystoneAdapter {
     };
   }
   static _abortable(signal, promise) {
-    if (signal.aborted) {
-      return Promise.reject(signal.reason instanceof Error ? signal.reason : new Error("Aborted"));
-    }
+    const abortReason = () => signal.reason instanceof Error ? signal.reason : new Error("Aborted");
+    if (signal.aborted) return Promise.reject(abortReason());
     return new Promise((resolve, reject) => {
-      const onAbort = () => {
-        reject(signal.reason instanceof Error ? signal.reason : new Error("Aborted"));
-      };
+      const onAbort = () => reject(abortReason());
       signal.addEventListener("abort", onAbort, { once: true });
       promise.then(
         (value) => {
@@ -2624,7 +2376,7 @@ var KeystoneAdapter = class _KeystoneAdapter {
     });
   }
   static _throwIfAborted(signal) {
-    if (signal.aborted) {
+    if (signal?.aborted) {
       throw signal.reason instanceof Error ? signal.reason : new Error("Operation aborted");
     }
   }