@onekeyfe/hwk-ledger-adapter 1.1.34-alpha.2 → 1.1.34-alpha.4

package/dist/index.d.mts

@@ -1,5 +1,5 @@
 import * as _onekeyfe_hwk_adapter_core from '@onekeyfe/hwk-adapter-core';
-import { IHardwareWallet, IConnector, TransportType, UiResponseEvent, SearchDevicesOptions, DeviceInfo, Response, ChainCapability, NullableCallArg, IHardwareCallParams, EvmGetAddressParams, EvmAddress, EvmSignTxLedgerParams, EvmSignedTx, EvmSignMsgParams, EvmSignature, EvmSignTypedDataParams, BtcGetAddressParams, BtcAddress, BtcGetPublicKeyParams, BtcPublicKey, BtcSignTxParams, BtcSignedTx, BtcSignPsbtParams, BtcSignedPsbt, BtcSignMsgParams, BtcSignature, IHardwareCommonCallParams, SolGetAddressParams, SolAddress, SolSignTxParams, SolSignedTx, SolSignMsgParams, SolSignature, TronGetAddressParams, TronAddress, TronSignTxParams, TronSignedTx, TronSignMsgParams, TronSignature, HardwareEventMap, DeviceEventListener, ChainForFingerprint, DeviceDescriptor, DeviceChangeEvent, ConnectionType, ConnectorDevice, ConnectorSession, ConnectorCallResult, ConnectorEventType, ConnectorEventMap, Failure, HardwareErrorCode } from '@onekeyfe/hwk-adapter-core';
+import { IHardwareWallet, IConnector, TransportType, UiResponseEvent, SearchDevicesOptions, DeviceInfo, Response, ChainCapability, NullableCallArg, IHardwareCallParams, EvmGetAddressParams, EvmAddress, EvmSignTxLedgerParams, EvmSignedTx, EvmSignMsgParams, EvmSignature, EvmSignTypedDataParams, BtcGetAddressParams, BtcAddress, BtcGetPublicKeyParams, BtcPublicKey, BtcSignTxParams, BtcSignedTx, BtcSignPsbtParams, BtcSignedPsbt, BtcSignMsgParams, BtcSignature, IHardwareCommonCallParams, SolGetAddressParams, SolAddress, SolSignTxParams, SolSignedTx, SolSignMsgParams, SolSignature, TronGetAddressParams, TronAddress, TronSignTxParams, TronSignedTx, TronSignMsgParams, TronSignature, DeviceAuthenticityParams, DeviceAuthenticityResult, HardwareEventMap, DeviceEventListener, ChainForFingerprint, DeviceDescriptor, DeviceChangeEvent, ConnectionType, ConnectorDevice, ConnectorSession, ConnectorCallResult, ConnectorEventType, ConnectorEventMap, ConnectorConfig, Failure, HardwareErrorCode } from '@onekeyfe/hwk-adapter-core';
 import { DeviceActionState as DeviceActionState$1, DiscoveredDevice, ExecuteDeviceActionReturnType, DeviceManagementKit } from '@ledgerhq/device-management-kit';
 import { Address, Signature, SignerEth as SignerEth$1, TypedData } from '@ledgerhq/device-signer-kit-ethereum';
 import { ContextModule } from '@ledgerhq/context-module';
@@ -93,6 +93,19 @@ interface LedgerDeviceInfo extends FirmwareVersion {
 
 type LedgerCallParams<T> = NullableCallArg<IHardwareCallParams<T>>;
 type LedgerCommonParams = NullableCallArg<IHardwareCommonCallParams>;
+type LedgerAttestationBridgeDevice = {
+    id: string;
+    modelId: 'nanoS' | 'nanoSP' | 'nanoX' | 'stax' | 'flex' | 'apexp';
+    name?: string;
+    connectionType?: 'USB' | 'BLE';
+};
+type LedgerAttestationApduBridge = {
+    device: LedgerAttestationBridgeDevice;
+    exchangeApdu: (apduHex: string, timeoutMs?: number) => Promise<{
+        dataHex: string;
+        statusCodeHex: string;
+    }>;
+};
 declare class LedgerAdapter implements IHardwareWallet {
     readonly vendor: "ledger";
     private readonly connector;
@@ -102,6 +115,7 @@ declare class LedgerAdapter implements IHardwareWallet {
     private readonly _uiRegistry;
     private _btcHighIndexConfirmedThisSession;
     private readonly _jobQueue;
+    private _deviceAuthenticityQueueTail;
     private _doConnectAbortController;
     private readonly _defaultAutoInstallApp;
     constructor(connector: IConnector, options?: {
@@ -162,6 +176,25 @@ declare class LedgerAdapter implements IHardwareWallet {
     listAvailableApps(connectId: string): Promise<Response<AppMetadata[]>>;
     getLedgerFirmwareVersion(connectId: string): Promise<Response<FirmwareVersion>>;
     getLedgerDeviceInfo(connectId: string): Promise<Response<LedgerDeviceInfo>>;
+    /**
+     * Reserves the existing physical Ledger session while a server-owned DMK
+     * Genuine Check drives it. The callback can only exchange raw APDUs; the
+     * authoritative verdict remains in the server state machine.
+     */
+    runDeviceAttestationApduBridge<T>(connectId: string, run: (bridge: LedgerAttestationApduBridge) => Promise<T>): Promise<Response<T>>;
+    /**
+     * Runs Ledger's official genuine check (DMK GenuineCheckDeviceAction) over the
+     * SAME secure-channel backend as app install
+     * (wss://scriptrunner.api.live.ledger.com/update/genuine). It returns Ledger's
+     * HSM verdict (`verified`) and a stable per-device id = sha3-256 of the device
+     * attestation public key, which DMK reads inside that session. The id survives
+     * wipe/recovery and cannot be forged from a seed.
+     *
+     * Requires network access to Ledger's backend and an on-device
+     * "Allow secure connection" confirmation the first time.
+     */
+    verifyDeviceAuthenticity(connectId: string, params?: DeviceAuthenticityParams): Promise<Response<DeviceAuthenticityResult>>;
+    private _verifyDeviceAuthenticityExclusive;
     on<K extends keyof HardwareEventMap>(event: K, listener: (event: HardwareEventMap[K]) => void): void;
     on(event: string, listener: DeviceEventListener): void;
     off<K extends keyof HardwareEventMap>(event: K, listener: (event: HardwareEventMap[K]) => void): void;
@@ -410,8 +443,14 @@ declare class LedgerConnectorBase implements IConnector {
     private readonly _eventHandlers;
     private readonly _providedDmk;
     private readonly _createTransport;
+    private _ledgerGenuineCheckWebSocketUrl;
     readonly connectionType: ConnectionType;
     private readonly _cancellers;
+    /**
+     * A server-owned attestation relay temporarily owns the raw APDU stream.
+     * The stored function re-enables DMK's session refresher when ownership ends.
+     */
+    private readonly _attestationBridgeReleasers;
     private readonly _sessionStateSubs;
     /**
      * Resolves a Ledger signer kit module by package name.
@@ -471,11 +510,15 @@ declare class LedgerConnectorBase implements IConnector {
     on<K extends ConnectorEventType>(event: K, handler: (data: ConnectorEventMap[K]) => void): void;
     off<K extends ConnectorEventType>(event: K, handler: (data: ConnectorEventMap[K]) => void): void;
     reset(): void;
+    configure(config: ConnectorConfig): Promise<void>;
     /**
      * Lazily create or return the DMK instance.
      * If a DMK was provided via constructor, it is used directly.
      * Otherwise, one is created via the transport factory.
      */
+    private _capturedGenuineCertPubKeys;
+    private _tapTransportForCert;
+    private _tapConnectedDevice;
     protected _getOrCreateDmk(): Promise<DeviceManagementKit>;
     private _initManagers;
     private _getDeviceManager;
@@ -497,6 +540,8 @@ declare class LedgerConnectorBase implements IConnector {
      */
     private _resetSignersAndSessions;
     private _resetAll;
+    private _releaseAttestationBridge;
+    private _releaseAllAttestationBridges;
     protected _emit<K extends ConnectorEventType>(event: K, data: ConnectorEventMap[K]): void;
     /**
      * Return a per-call ctx with the chain's Ledger app name pre-bound to

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import * as _onekeyfe_hwk_adapter_core from '@onekeyfe/hwk-adapter-core';
-import { IHardwareWallet, IConnector, TransportType, UiResponseEvent, SearchDevicesOptions, DeviceInfo, Response, ChainCapability, NullableCallArg, IHardwareCallParams, EvmGetAddressParams, EvmAddress, EvmSignTxLedgerParams, EvmSignedTx, EvmSignMsgParams, EvmSignature, EvmSignTypedDataParams, BtcGetAddressParams, BtcAddress, BtcGetPublicKeyParams, BtcPublicKey, BtcSignTxParams, BtcSignedTx, BtcSignPsbtParams, BtcSignedPsbt, BtcSignMsgParams, BtcSignature, IHardwareCommonCallParams, SolGetAddressParams, SolAddress, SolSignTxParams, SolSignedTx, SolSignMsgParams, SolSignature, TronGetAddressParams, TronAddress, TronSignTxParams, TronSignedTx, TronSignMsgParams, TronSignature, HardwareEventMap, DeviceEventListener, ChainForFingerprint, DeviceDescriptor, DeviceChangeEvent, ConnectionType, ConnectorDevice, ConnectorSession, ConnectorCallResult, ConnectorEventType, ConnectorEventMap, Failure, HardwareErrorCode } from '@onekeyfe/hwk-adapter-core';
+import { IHardwareWallet, IConnector, TransportType, UiResponseEvent, SearchDevicesOptions, DeviceInfo, Response, ChainCapability, NullableCallArg, IHardwareCallParams, EvmGetAddressParams, EvmAddress, EvmSignTxLedgerParams, EvmSignedTx, EvmSignMsgParams, EvmSignature, EvmSignTypedDataParams, BtcGetAddressParams, BtcAddress, BtcGetPublicKeyParams, BtcPublicKey, BtcSignTxParams, BtcSignedTx, BtcSignPsbtParams, BtcSignedPsbt, BtcSignMsgParams, BtcSignature, IHardwareCommonCallParams, SolGetAddressParams, SolAddress, SolSignTxParams, SolSignedTx, SolSignMsgParams, SolSignature, TronGetAddressParams, TronAddress, TronSignTxParams, TronSignedTx, TronSignMsgParams, TronSignature, DeviceAuthenticityParams, DeviceAuthenticityResult, HardwareEventMap, DeviceEventListener, ChainForFingerprint, DeviceDescriptor, DeviceChangeEvent, ConnectionType, ConnectorDevice, ConnectorSession, ConnectorCallResult, ConnectorEventType, ConnectorEventMap, ConnectorConfig, Failure, HardwareErrorCode } from '@onekeyfe/hwk-adapter-core';
 import { DeviceActionState as DeviceActionState$1, DiscoveredDevice, ExecuteDeviceActionReturnType, DeviceManagementKit } from '@ledgerhq/device-management-kit';
 import { Address, Signature, SignerEth as SignerEth$1, TypedData } from '@ledgerhq/device-signer-kit-ethereum';
 import { ContextModule } from '@ledgerhq/context-module';
@@ -93,6 +93,19 @@ interface LedgerDeviceInfo extends FirmwareVersion {
 
 type LedgerCallParams<T> = NullableCallArg<IHardwareCallParams<T>>;
 type LedgerCommonParams = NullableCallArg<IHardwareCommonCallParams>;
+type LedgerAttestationBridgeDevice = {
+    id: string;
+    modelId: 'nanoS' | 'nanoSP' | 'nanoX' | 'stax' | 'flex' | 'apexp';
+    name?: string;
+    connectionType?: 'USB' | 'BLE';
+};
+type LedgerAttestationApduBridge = {
+    device: LedgerAttestationBridgeDevice;
+    exchangeApdu: (apduHex: string, timeoutMs?: number) => Promise<{
+        dataHex: string;
+        statusCodeHex: string;
+    }>;
+};
 declare class LedgerAdapter implements IHardwareWallet {
     readonly vendor: "ledger";
     private readonly connector;
@@ -102,6 +115,7 @@ declare class LedgerAdapter implements IHardwareWallet {
     private readonly _uiRegistry;
     private _btcHighIndexConfirmedThisSession;
     private readonly _jobQueue;
+    private _deviceAuthenticityQueueTail;
     private _doConnectAbortController;
     private readonly _defaultAutoInstallApp;
     constructor(connector: IConnector, options?: {
@@ -162,6 +176,25 @@ declare class LedgerAdapter implements IHardwareWallet {
     listAvailableApps(connectId: string): Promise<Response<AppMetadata[]>>;
     getLedgerFirmwareVersion(connectId: string): Promise<Response<FirmwareVersion>>;
     getLedgerDeviceInfo(connectId: string): Promise<Response<LedgerDeviceInfo>>;
+    /**
+     * Reserves the existing physical Ledger session while a server-owned DMK
+     * Genuine Check drives it. The callback can only exchange raw APDUs; the
+     * authoritative verdict remains in the server state machine.
+     */
+    runDeviceAttestationApduBridge<T>(connectId: string, run: (bridge: LedgerAttestationApduBridge) => Promise<T>): Promise<Response<T>>;
+    /**
+     * Runs Ledger's official genuine check (DMK GenuineCheckDeviceAction) over the
+     * SAME secure-channel backend as app install
+     * (wss://scriptrunner.api.live.ledger.com/update/genuine). It returns Ledger's
+     * HSM verdict (`verified`) and a stable per-device id = sha3-256 of the device
+     * attestation public key, which DMK reads inside that session. The id survives
+     * wipe/recovery and cannot be forged from a seed.
+     *
+     * Requires network access to Ledger's backend and an on-device
+     * "Allow secure connection" confirmation the first time.
+     */
+    verifyDeviceAuthenticity(connectId: string, params?: DeviceAuthenticityParams): Promise<Response<DeviceAuthenticityResult>>;
+    private _verifyDeviceAuthenticityExclusive;
     on<K extends keyof HardwareEventMap>(event: K, listener: (event: HardwareEventMap[K]) => void): void;
     on(event: string, listener: DeviceEventListener): void;
     off<K extends keyof HardwareEventMap>(event: K, listener: (event: HardwareEventMap[K]) => void): void;
@@ -410,8 +443,14 @@ declare class LedgerConnectorBase implements IConnector {
     private readonly _eventHandlers;
     private readonly _providedDmk;
     private readonly _createTransport;
+    private _ledgerGenuineCheckWebSocketUrl;
     readonly connectionType: ConnectionType;
     private readonly _cancellers;
+    /**
+     * A server-owned attestation relay temporarily owns the raw APDU stream.
+     * The stored function re-enables DMK's session refresher when ownership ends.
+     */
+    private readonly _attestationBridgeReleasers;
     private readonly _sessionStateSubs;
     /**
      * Resolves a Ledger signer kit module by package name.
@@ -471,11 +510,15 @@ declare class LedgerConnectorBase implements IConnector {
     on<K extends ConnectorEventType>(event: K, handler: (data: ConnectorEventMap[K]) => void): void;
     off<K extends ConnectorEventType>(event: K, handler: (data: ConnectorEventMap[K]) => void): void;
     reset(): void;
+    configure(config: ConnectorConfig): Promise<void>;
     /**
      * Lazily create or return the DMK instance.
      * If a DMK was provided via constructor, it is used directly.
      * Otherwise, one is created via the transport factory.
      */
+    private _capturedGenuineCertPubKeys;
+    private _tapTransportForCert;
+    private _tapConnectedDevice;
     protected _getOrCreateDmk(): Promise<DeviceManagementKit>;
     private _initManagers;
     private _getDeviceManager;
@@ -497,6 +540,8 @@ declare class LedgerConnectorBase implements IConnector {
      */
     private _resetSignersAndSessions;
     private _resetAll;
+    private _releaseAttestationBridge;
+    private _releaseAllAttestationBridges;
     protected _emit<K extends ConnectorEventType>(event: K, data: ConnectorEventMap[K]): void;
     /**
      * Return a per-call ctx with the chain's Ledger app name pre-bound to

package/dist/index.js

@@ -772,6 +772,10 @@ var _LedgerAdapter = class _LedgerAdapter {
     // The Ledger device itself still requires a per-call confirmation — that's
     // the Ledger app's safety boundary, not ours to bypass.
     this._btcHighIndexConfirmedThisSession = false;
+    // Runtime relay configuration mutates connector-wide DMK state. Serialize
+    // the complete configure → genuine check → clear lifecycle so concurrent
+    // callers cannot reset or overwrite each other's one-shot relay.
+    this._deviceAuthenticityQueueTail = Promise.resolve();
     // Shared across concurrent callers — only `cancel()` aborts.
     this._doConnectAbortController = null;
     this._installProgressLastEmittedValue = -Infinity;
@@ -1322,6 +1326,137 @@ var _LedgerAdapter = class _LedgerAdapter {
       return this.errorToFailure(err);
     }
   }
+  /**
+   * Reserves the existing physical Ledger session while a server-owned DMK
+   * Genuine Check drives it. The callback can only exchange raw APDUs; the
+   * authoritative verdict remains in the server state machine.
+   */
+  async runDeviceAttestationApduBridge(connectId, run) {
+    const queueKey = connectId || "__ledger_default__";
+    try {
+      const payload = await this._jobQueue.enqueue(
+        queueKey,
+        async (signal) => {
+          const device = await this._runConnectorCall(
+            connectId,
+            "startDeviceAttestationApduBridge",
+            {},
+            signal
+          );
+          const sessionId = this._sessions.get(connectId) ?? (this._sessions.size === 1 ? this._sessions.values().next().value : void 0);
+          if (!sessionId) {
+            throw new Error(
+              "Ledger attestation bridge started without an active device session"
+            );
+          }
+          try {
+            return await run({
+              device,
+              exchangeApdu: async (apduHex, timeoutMs) => await this._callConnector(
+                sessionId,
+                "exchangeDeviceAttestationApdu",
+                { apduHex, timeoutMs },
+                signal
+              )
+            });
+          } finally {
+            try {
+              await this._callConnector(
+                sessionId,
+                "stopDeviceAttestationApduBridge",
+                {}
+              );
+            } catch {
+              this.connector.reset();
+              this.resetState();
+            }
+          }
+        },
+        {
+          label: "ledgerDeviceAttestationApduBridge",
+          rejectIfBusy: true,
+          busyError: _LedgerAdapter._createDeviceBusyError(
+            "ledgerDeviceAttestationApduBridge"
+          )
+        }
+      );
+      return (0, import_hwk_adapter_core3.success)(payload);
+    } catch (error) {
+      return this.errorToFailure(error);
+    }
+  }
+  /**
+   * Runs Ledger's official genuine check (DMK GenuineCheckDeviceAction) over the
+   * SAME secure-channel backend as app install
+   * (wss://scriptrunner.api.live.ledger.com/update/genuine). It returns Ledger's
+   * HSM verdict (`verified`) and a stable per-device id = sha3-256 of the device
+   * attestation public key, which DMK reads inside that session. The id survives
+   * wipe/recovery and cannot be forged from a seed.
+   *
+   * Requires network access to Ledger's backend and an on-device
+   * "Allow secure connection" confirmation the first time.
+   */
+  async verifyDeviceAuthenticity(connectId, params = {}) {
+    const waitForPrevious = this._deviceAuthenticityQueueTail;
+    let releaseQueue = () => void 0;
+    this._deviceAuthenticityQueueTail = new Promise((resolve) => {
+      releaseQueue = resolve;
+    });
+    await waitForPrevious;
+    try {
+      return await this._verifyDeviceAuthenticityExclusive(connectId, params);
+    } finally {
+      releaseQueue();
+    }
+  }
+  async _verifyDeviceAuthenticityExclusive(connectId, params) {
+    const relayUrl = params.ledgerGenuineCheckWebSocketUrl;
+    try {
+      if (relayUrl) {
+        if (!this.connector.configure) {
+          return (0, import_hwk_adapter_core3.failure)(
+            import_hwk_adapter_core3.HardwareErrorCode.MethodNotSupported,
+            "This Ledger connector does not support genuine-check relay configuration"
+          );
+        }
+        await this.connector.configure({ ledgerGenuineCheckWebSocketUrl: relayUrl });
+        this.resetState();
+      }
+      const result = await this.connectorCall(connectId, "getDeviceGenuineCheck", {});
+      if (!result.isGenuine) {
+        return (0, import_hwk_adapter_core3.success)({
+          vendor: "ledger",
+          verified: false,
+          note: "Ledger genuine-check returned NOT genuine."
+        });
+      }
+      if (!result.deviceId) {
+        return (0, import_hwk_adapter_core3.failure)(
+          import_hwk_adapter_core3.HardwareErrorCode.UnknownError,
+          `Genuine check completed (isGenuine=${result.isGenuine}) but no deviceId was captured`
+        );
+      }
+      return (0, import_hwk_adapter_core3.success)({
+        vendor: "ledger",
+        verified: result.isGenuine,
+        deviceId: result.deviceId,
+        attestationPubKey: result.attestationPubKey,
+        note: "Verified by Ledger genuine-check backend; deviceId = sha3_256(attestation pubkey)."
+      });
+    } catch (err) {
+      return this.errorToFailure(err);
+    } finally {
+      if (relayUrl) {
+        try {
+          await this.connector.configure?.({ ledgerGenuineCheckWebSocketUrl: void 0 });
+          this.resetState();
+        } catch {
+          this.connector.reset();
+          this.resetState();
+        }
+      }
+    }
+  }
   on(event, listener) {
     this.emitter.on(event, listener);
   }
@@ -2294,6 +2429,7 @@ var LedgerAdapter = _LedgerAdapter;
 
 // src/connector/LedgerConnectorBase.ts
 var import_hwk_adapter_core13 = require("@onekeyfe/hwk-adapter-core");
+var sha3 = __toESM(require("@noble/hashes/sha3"));
 
 // src/device/LedgerDeviceManager.ts
 var LedgerDeviceManager = class {
@@ -4053,6 +4189,25 @@ var DeviceAppsManager = class {
 };
 
 // src/connector/LedgerConnectorBase.ts
+function extractCertPubKey(data) {
+  try {
+    const buf = Buffer.from(data);
+    let offset = 0;
+    if (offset >= buf.length) return null;
+    const headerLen = buf[offset];
+    offset += 1 + headerLen;
+    if (offset >= buf.length) return null;
+    const keyLen = buf[offset];
+    offset += 1;
+    if (keyLen === 0 || offset + keyLen > buf.length) return null;
+    return buf.subarray(offset, offset + keyLen).toString("hex");
+  } catch {
+    return null;
+  }
+}
+function sha3HexOf(pubKeyHex) {
+  return Buffer.from(sha3.sha3_256(Uint8Array.from(Buffer.from(pubKeyHex, "hex")))).toString("hex");
+}
 var METHOD_PREFIX_TO_APP_NAME = {
   evm: "Ethereum",
   btc: "Bitcoin",
@@ -4109,6 +4264,11 @@ var LedgerConnectorBase = class {
     // unsubscribes the observable and releases DMK's IntentQueue slot.
     // ---------------------------------------------------------------------------
     this._cancellers = /* @__PURE__ */ new Map();
+    /**
+     * A server-owned attestation relay temporarily owns the raw APDU stream.
+     * The stored function re-enables DMK's session refresher when ownership ends.
+     */
+    this._attestationBridgeReleasers = /* @__PURE__ */ new Map();
     // ---------------------------------------------------------------------------
     // Per-session DMK state subscriptions
     //
@@ -4121,6 +4281,17 @@ var LedgerConnectorBase = class {
     // reset / observable completion to avoid leaks.
     // ---------------------------------------------------------------------------
     this._sessionStateSubs = /* @__PURE__ */ new Map();
+    // ---------------------------------------------------------------------------
+    // Private -- DMK / Manager lifecycle
+    // ---------------------------------------------------------------------------
+    /**
+     * Lazily create or return the DMK instance.
+     * If a DMK was provided via constructor, it is used directly.
+     * Otherwise, one is created via the transport factory.
+     */
+    // Attestation public keys (hex) seen in GET CERTIFICATE (E0 52) responses on
+    // the transport. Only populated during a genuine check; cleared per call.
+    this._capturedGenuineCertPubKeys = [];
     this._createTransport = createTransport;
     this.connectionType = options?.connectionType ?? "usb";
     this._providedDmk = options?.dmk;
@@ -4343,6 +4514,7 @@ var LedgerConnectorBase = class {
     }
   }
   async disconnect(sessionId) {
+    this._releaseAttestationBridge(sessionId);
     if (!this._deviceManager) return;
     const deviceId = this._deviceManager.getDeviceId(sessionId);
     this._signerManager?.invalidate(sessionId);
@@ -4404,6 +4576,7 @@ var LedgerConnectorBase = class {
       externalConnectId
     );
     this._unwatchSessionState(sessionId);
+    this._releaseAttestationBridge(sessionId);
     this._signerManager?.invalidate(sessionId);
     this._cancellers.get(sessionId)?.({
       code: import_hwk_adapter_core13.HardwareErrorCode.DeviceDisconnected,
@@ -4584,6 +4757,92 @@ var LedgerConnectorBase = class {
           ctx.clearCanceller(sessionId);
         }
       }
+      case "getDeviceGenuineCheck": {
+        try {
+          this._capturedGenuineCertPubKeys = [];
+          const dmk = await ctx.getOrCreateDmk();
+          const kit = await ctx.importLedgerKit("@ledgerhq/device-management-kit");
+          const action = dmk.executeDeviceAction({
+            sessionId,
+            deviceAction: new kit.GenuineCheckDeviceAction({ input: {} })
+          });
+          let deviceId;
+          const output = await deviceActionToPromise(
+            action,
+            (interaction) => ctx.emit("ui-event", {
+              type: collapseSignerInteraction(interaction),
+              payload: { sessionId }
+            }),
+            // Generous timeout: covers websocket round-trips + the on-device
+            // "Allow secure connection" tap (the idle watchdog does not pause
+            // for it, only for unlock-device).
+            5 * 6e4,
+            (cancel) => ctx.registerCanceller(sessionId, cancel),
+            (intermediateValue) => {
+              const iv = intermediateValue;
+              if (iv?.deviceId instanceof Uint8Array && !deviceId) {
+                deviceId = Buffer.from(iv.deviceId).toString("hex");
+              }
+            }
+          );
+          const attestationPubKey = deviceId && this._capturedGenuineCertPubKeys.length > 0 ? this._capturedGenuineCertPubKeys.find((pk) => sha3HexOf(pk) === deviceId) : void 0;
+          this._capturedGenuineCertPubKeys = [];
+          return { isGenuine: output.isGenuine, deviceId, attestationPubKey };
+        } catch (err) {
+          ctx.invalidateSession(sessionId);
+          throw ctx.wrapError(err);
+        } finally {
+          ctx.clearCanceller(sessionId);
+        }
+      }
+      case "startDeviceAttestationApduBridge": {
+        if (this._attestationBridgeReleasers.has(sessionId)) {
+          throw new Error("Ledger device attestation APDU bridge is already active");
+        }
+        const dmk = await ctx.getOrCreateDmk();
+        const release = dmk.disableDeviceSessionRefresher({
+          sessionId,
+          blockerId: "onekey-ledger-attestation-relay"
+        });
+        try {
+          const device = dmk.getConnectedDevice({ sessionId });
+          this._attestationBridgeReleasers.set(sessionId, release);
+          return {
+            id: device.id,
+            modelId: device.modelId,
+            name: device.name,
+            connectionType: device.type
+          };
+        } catch (error) {
+          release();
+          throw error;
+        }
+      }
+      case "exchangeDeviceAttestationApdu": {
+        if (!this._attestationBridgeReleasers.has(sessionId)) {
+          throw new Error("Ledger device attestation APDU bridge is not active");
+        }
+        const p = params;
+        if (typeof p.apduHex !== "string" || p.apduHex.length < 8 || p.apduHex.length % 2 !== 0 || !/^[0-9a-f]+$/i.test(p.apduHex) || p.apduHex.length / 2 > 8 * 1024) {
+          throw new Error("Invalid Ledger device attestation APDU");
+        }
+        const requestedTimeout = typeof p.timeoutMs === "number" && Number.isFinite(p.timeoutMs) ? p.timeoutMs : 3e4;
+        const timeoutMs = Math.max(1e3, Math.min(requestedTimeout, 6e4));
+        const dmk = await ctx.getOrCreateDmk();
+        const response = await dmk.sendApdu({
+          sessionId,
+          apdu: Uint8Array.from(Buffer.from(p.apduHex, "hex")),
+          abortTimeout: timeoutMs,
+          triggersDisconnection: false
+        });
+        return {
+          dataHex: Buffer.from(response.data).toString("hex"),
+          statusCodeHex: Buffer.from(response.statusCode).toString("hex")
+        };
+      }
+      case "stopDeviceAttestationApduBridge":
+        this._releaseAttestationBridge(sessionId);
+        return void 0;
       default:
         throw new Error(`LedgerConnector: unknown method "${method}"`);
     }
@@ -4616,16 +4875,80 @@ var LedgerConnectorBase = class {
   // IConnector -- Reset
   // ---------------------------------------------------------------------------
   reset() {
+    this._ledgerGenuineCheckWebSocketUrl = void 0;
     this._resetAll();
   }
-  // ---------------------------------------------------------------------------
-  // Private -- DMK / Manager lifecycle
-  // ---------------------------------------------------------------------------
-  /**
-   * Lazily create or return the DMK instance.
-   * If a DMK was provided via constructor, it is used directly.
-   * Otherwise, one is created via the transport factory.
-   */
+  async configure(config) {
+    const nextUrl = config.ledgerGenuineCheckWebSocketUrl;
+    if (nextUrl) {
+      let parsed;
+      try {
+        parsed = new URL(nextUrl);
+      } catch {
+        throw new Error("Ledger genuine-check relay URL is invalid");
+      }
+      if (parsed.protocol !== "wss:") {
+        throw new Error("Ledger genuine-check relay URL must use wss");
+      }
+      if (this._providedDmk) {
+        throw new Error("Cannot change Ledger genuine-check relay on a pre-built DMK");
+      }
+    }
+    if (nextUrl === this._ledgerGenuineCheckWebSocketUrl) {
+      return;
+    }
+    this._resetAll();
+    this._ledgerGenuineCheckWebSocketUrl = nextUrl;
+  }
+  // Wrap a TransportFactory so every connected device's `sendApdu` is tapped:
+  // when DMK's genuine-check secure channel reads the device attestation
+  // certificate (E0 52), we capture the raw public key from the response. The
+  // tap is best-effort and can NEVER disturb the real APDU flow (it always
+  // returns the original result, all capture logic is in try/catch).
+  _tapTransportForCert(factory) {
+    return (args) => {
+      const transport = factory(args);
+      const originalConnect = transport?.connect;
+      if (typeof originalConnect === "function") {
+        transport.connect = async (params) => {
+          const either = await originalConnect.call(transport, params);
+          try {
+            if (either && typeof either.map === "function") {
+              return either.map((device) => this._tapConnectedDevice(device));
+            }
+          } catch {
+          }
+          return either;
+        };
+      }
+      return transport;
+    };
+  }
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  _tapConnectedDevice(device) {
+    const originalSendApdu = device?.sendApdu;
+    if (typeof originalSendApdu !== "function") return device;
+    const wrapped = async (apdu, ...rest) => {
+      const result = await originalSendApdu.call(device, apdu, ...rest);
+      try {
+        if (apdu?.[0] === 224 && apdu?.[1] === 82 && result && typeof result.isRight === "function" && result.isRight()) {
+          const resp = result.extract();
+          if (resp && Buffer.from(resp.statusCode).toString("hex") === "9000") {
+            const pubKey = extractCertPubKey(resp.data);
+            if (pubKey) this._capturedGenuineCertPubKeys.push(pubKey);
+          }
+        }
+      } catch {
+      }
+      return result;
+    };
+    return new Proxy(device, {
+      get(target, prop, receiver) {
+        if (prop === "sendApdu") return wrapped;
+        return Reflect.get(target, prop, receiver);
+      }
+    });
+  }
   async _getOrCreateDmk() {
     debugLog(
       "[DMK] _getOrCreateDmk called, _dmk exists:",
@@ -4641,9 +4964,13 @@ var LedgerConnectorBase = class {
     const { DeviceManagementKitBuilder } = await this._importLedgerKit(
       "@ledgerhq/device-management-kit"
     );
-    const transportFactory = await this._createTransport();
+    const transportFactory = this._tapTransportForCert(await this._createTransport());
     debugLog("[DMK] _getOrCreateDmk: transportFactory type:", typeof transportFactory);
-    const dmk = new DeviceManagementKitBuilder().addTransport(transportFactory).build();
+    const builder = new DeviceManagementKitBuilder().addTransport(transportFactory);
+    if (this._ledgerGenuineCheckWebSocketUrl) {
+      builder.addConfig({ webSocketUrl: this._ledgerGenuineCheckWebSocketUrl });
+    }
+    const dmk = builder.build();
     this._dmk = dmk;
     debugLog("[DMK] _getOrCreateDmk: DMK created");
     return dmk;
@@ -4711,6 +5038,7 @@ var LedgerConnectorBase = class {
    */
   _resetSignersAndSessions() {
     debugLog("[DMK] _resetSignersAndSessions called");
+    this._releaseAllAttestationBridges();
     this._signerManager?.clearAll();
     this._signerManager = null;
     this._deviceAppsManager?.clearAll();
@@ -4720,6 +5048,7 @@ var LedgerConnectorBase = class {
   }
   _resetAll() {
     debugLog("[DMK] _resetAll called");
+    this._releaseAllAttestationBridges();
     for (const cancel of this._cancellers.values()) {
       try {
         cancel();
@@ -4742,6 +5071,20 @@ var LedgerConnectorBase = class {
     this._deviceAppsManager = null;
     this._dmk = null;
   }
+  _releaseAttestationBridge(sessionId) {
+    const release = this._attestationBridgeReleasers.get(sessionId);
+    if (!release) return;
+    this._attestationBridgeReleasers.delete(sessionId);
+    try {
+      release();
+    } catch {
+    }
+  }
+  _releaseAllAttestationBridges() {
+    for (const sessionId of [...this._attestationBridgeReleasers.keys()]) {
+      this._releaseAttestationBridge(sessionId);
+    }
+  }
   // ---------------------------------------------------------------------------
   // Private -- Events
   // ---------------------------------------------------------------------------