@onekeyfe/hwk-ledger-adapter 1.2.3-alpha.6 → 1.2.3-alpha.8

package/dist/index.d.mts

@@ -1,10 +1,11 @@
 import * as _onekeyfe_hwk_adapter_core from '@onekeyfe/hwk-adapter-core';
-import { IHardwareWallet, IConnector, TransportType, UiResponseEvent, SearchDevicesOptions, DeviceInfo, Response, ChainCapability, NullableCallArg, IHardwareCallParams, EvmGetAddressParams, EvmAddress, EvmSignTxLedgerParams, EvmSignedTx, EvmSignMsgParams, EvmSignature, EvmSignTypedDataParams, BtcGetAddressParams, BtcAddress, BtcGetPublicKeyParams, BtcPublicKey, BtcSignTxParams, BtcSignedTx, BtcSignPsbtParams, BtcSignedPsbt, BtcSignMsgParams, BtcSignature, IHardwareCommonCallParams, SolGetAddressParams, SolAddress, SolSignTxParams, SolSignedTx, SolSignMsgParams, SolSignature, TronGetAddressParams, TronAddress, TronSignTxParams, TronSignedTx, TronSignMsgParams, TronSignature, DeviceAuthenticityParams, DeviceAuthenticityResult, HardwareEventMap, DeviceEventListener, ChainForFingerprint, DeviceDescriptor, DeviceChangeEvent, ConnectionType, ConnectorDevice, ConnectorSession, ConnectorCallResult, ConnectorEventType, ConnectorEventMap, ConnectorConfig, Failure, HardwareErrorCode } from '@onekeyfe/hwk-adapter-core';
+import { IHardwareWallet, IConnector, TransportType, UiResponseEvent, SearchDevicesOptions, DeviceInfo, DeviceSearchTarget, ConnectionTarget, Response, BindBleDeviceParams, IHardwareConnectionContext, NullableCallArg, IHardwareCallParams, EvmGetAddressParams, EvmAddress, EvmSignTxLedgerParams, EvmSignedTx, EvmSignMsgParams, EvmSignature, EvmSignTypedDataParams, BtcGetAddressParams, BtcAddress, BtcGetPublicKeyParams, BtcPublicKey, BtcSignTxParams, BtcSignedTx, BtcSignPsbtParams, BtcSignedPsbt, BtcSignMsgParams, BtcSignature, IHardwareCommonCallParams, SolGetAddressParams, SolAddress, SolSignTxParams, SolSignedTx, SolSignMsgParams, SolSignature, TronGetAddressParams, TronAddress, TronSignTxParams, TronSignedTx, TronSignMsgParams, TronSignature, ZcashGetFullViewingKeyParams, ZcashFullViewingKey, ZcashGetShieldedAddressParams, ZcashShieldedAddress, DeviceAuthenticityParams, DeviceAuthenticityResult, HardwareEventMap, DeviceEventListener, ChainForFingerprint, DeviceDescriptor, DeviceChangeEvent, ConnectionType, ConnectorDevice, ConnectorSession, ConnectorCallResult, ConnectorEventType, ConnectorEventMap, ConnectorConfig, Failure, HardwareErrorCode, HwkErrorOrigin, HwkRecoveryHint } from '@onekeyfe/hwk-adapter-core';
 import { DeviceActionState as DeviceActionState$1, DiscoveredDevice, ExecuteDeviceActionReturnType, DeviceManagementKit } from '@ledgerhq/device-management-kit';
 import { Address, Signature, SignerEth as SignerEth$1, TypedData } from '@ledgerhq/device-signer-kit-ethereum';
 import { ContextModule } from '@ledgerhq/context-module';
 import { SignerBtc as SignerBtc$1 } from '@ledgerhq/device-signer-kit-bitcoin';
 import { SignerSolana } from '@ledgerhq/device-signer-kit-solana';
+import { SignerZcash as SignerZcash$1, FullViewingKeyOptions, GetFullViewingKeyDAOutput, GetShieldedAddressDAOutput } from '@ledgerhq/device-signer-kit-zcash';
 import Transport from '@ledgerhq/hw-transport';
 
 /**
@@ -95,16 +96,30 @@ type LedgerCallParams<T> = NullableCallArg<IHardwareCallParams<T>>;
 type LedgerCommonParams = NullableCallArg<IHardwareCommonCallParams>;
 declare class LedgerAdapter implements IHardwareWallet {
     readonly vendor: "ledger";
+    readonly cancelCapability: "stops-waiting";
     private readonly connector;
     private readonly emitter;
+    private readonly _operations;
     private _discoveredDevices;
     private _sessions;
+    private readonly _pendingOperationBindings;
+    private readonly _verifiedBleReconnectTargets;
     private readonly _uiRegistry;
     private _btcHighIndexConfirmedThisSession;
     private readonly _jobQueue;
     private _deviceAuthenticityQueueTail;
     private _doConnectAbortController;
     private readonly _defaultAutoInstallApp;
+    private readonly _unsettledConnectorOperations;
+    private readonly _connectorIdleWaiters;
+    private _resetPromise;
+    private _stateGeneration;
+    private _connectorTeardownTail;
+    private _pendingConnectorTeardowns;
+    private _activeConnectionType;
+    private _bindingSelectionRequestId;
+    private _finishBleBinding;
+    private _isBleConnection;
     constructor(connector: IConnector, options?: {
         autoInstallApp?: boolean;
     });
@@ -118,22 +133,33 @@ declare class LedgerAdapter implements IHardwareWallet {
      * The next operation will re-discover and re-connect automatically.
      */
     resetState(): void;
+    private _resetStateAndDisconnectSessions;
     dispose(): Promise<void>;
     uiResponse(response: UiResponseEvent): void;
     searchDevices(options?: SearchDevicesOptions): Promise<DeviceInfo[]>;
+    private _searchDevices;
+    searchDeviceTargets(options?: SearchDevicesOptions): Promise<DeviceSearchTarget[]>;
+    listConnectionTargets(options?: SearchDevicesOptions): Promise<ConnectionTarget[]>;
     private _evictAllSessions;
     private static readonly MAX_BUSINESS_RETRY_BUDGET;
     private static readonly STUCK_APP_RETRY_DELAY_MS;
     private static readonly MAX_DOCONNECT_CONFIRMS;
     private _lastCancelReason;
+    private readonly _activeOperationJobs;
+    private readonly _pendingOperationDisconnects;
     private static readonly APP_INSTALL_PROGRESS_MIN_DELTA;
     private _installProgressLastEmittedValue;
     private _installProgressLastKey;
     private static _createDeviceBusyError;
-    connectDevice(connectId: string): Promise<Response<string>>;
-    disconnectDevice(connectId: string): Promise<void>;
-    getDeviceInfo(connectId: string, deviceId: string): Promise<Response<DeviceInfo>>;
-    getSupportedChains(): ChainCapability[];
+    connectDevice(searchTargetId: string): Promise<Response<string>>;
+    bindBleDevice(params: BindBleDeviceParams): Promise<Response<string>>;
+    acquireOperation(connectId: string, context: IHardwareConnectionContext): Promise<Response<string>>;
+    private _createOperation;
+    private _connectTarget;
+    releaseOperation(operationId: string): Promise<void>;
+    private _releaseOperationConnection;
+    private _releaseLostOperationConnection;
+    getDeviceInfo(connectIdOrOperationId: string, deviceId: string): Promise<Response<DeviceInfo>>;
     allNetworkGetAddress: (connectId: string, _deviceId: string, params: _onekeyfe_hwk_adapter_core.AllNetworkGetAddressParams) => Promise<Response<_onekeyfe_hwk_adapter_core.AllNetworkAddressResponse[]>>;
     private callChain;
     private static normalizeCallArgs;
@@ -157,6 +183,8 @@ declare class LedgerAdapter implements IHardwareWallet {
     tronGetAddress(connectId?: string | null, deviceId?: string | null, params?: LedgerCallParams<TronGetAddressParams>): Promise<Response<TronAddress>>;
     tronSignTransaction(connectId?: string | null, deviceId?: string | null, params?: LedgerCallParams<TronSignTxParams>): Promise<Response<TronSignedTx>>;
     tronSignMessage(connectId?: string | null, deviceId?: string | null, params?: LedgerCallParams<TronSignMsgParams>): Promise<Response<TronSignature>>;
+    zcashGetFullViewingKey(connectId?: string | null, deviceId?: string | null, params?: LedgerCallParams<ZcashGetFullViewingKeyParams>): Promise<Response<ZcashFullViewingKey>>;
+    zcashGetShieldedAddress(connectId?: string | null, deviceId?: string | null, params?: LedgerCallParams<ZcashGetShieldedAddressParams>): Promise<Response<ZcashShieldedAddress>>;
     installApp(connectId: string, appName: string): Promise<Response<void>>;
     listInstalledApps(connectId: string): Promise<Response<AppMetadata[]>>;
     listInstalledNames(connectId: string): Promise<Response<string[]>>;
@@ -181,11 +209,11 @@ declare class LedgerAdapter implements IHardwareWallet {
     off<K extends keyof HardwareEventMap>(event: K, listener: (event: HardwareEventMap[K]) => void): void;
     off(event: string, listener: DeviceEventListener): void;
     cancel(connectId?: string): void;
+    /** A non-empty deviceId is an expected chain fingerprint, not a transport identifier. */
     getChainFingerprint(connectId: string, deviceId: string, chain: ChainForFingerprint): Promise<Response<string>>;
-    /**
-     * Verify fingerprint using an existing sessionId directly.
-     * Safe to call inside connectorCall without causing queue deadlock.
-     */
+    /** Discovery may select a BLE target before a later call verifies its wallet. */
+    private _publishVerifiedBleBinding;
+    /** Verify on the acquired session without re-entering the job queue. */
     private _verifyDeviceFingerprintWithSession;
     /**
      * Compute the chain fingerprint via a caller-supplied call strategy.
@@ -207,9 +235,17 @@ declare class LedgerAdapter implements IHardwareWallet {
      *
      * - If a session already exists for the given connectId, reuse it.
      * - If ANY session exists (Ledger IDs are ephemeral), reuse it.
-     * - Otherwise: search → exactly 1 USB device auto-connects; multiple or none throws.
+     * - Otherwise: search → one USB device auto-connects; multiple asks the host to choose.
      */
     private _connectingPromise;
+    /**
+     * The operation the running device job belongs to, so a UI request raised
+     * mid-call can name it. A call pinned to an operation queues under its id
+     * (`ledgerQueueKey`); a call without one queues under the connectId, and the
+     * live operation on that connection is still the owner. Only work with no
+     * operation at all (cold start) comes back undefined.
+     */
+    private _activeOperationId;
     private _waitForDeviceConnect;
     /**
      * Decide whether a BTC pubkey call needs `showOnDevice=true` because of
@@ -250,34 +286,23 @@ declare class LedgerAdapter implements IHardwareWallet {
      * lives in one place.
      */
     private _callConnector;
+    private _assertConnectorReady;
+    private _runConnectorTeardown;
+    private _waitForConnectorOperationsToDrain;
+    private _retainConnectorOperation;
     private connectorCall;
     /**
      * Race a promise against an abort signal. On abort, rejects with
      * signal.reason → instance _lastCancelReason → generic Error('Aborted').
      */
+    /** Hermes/RN polyfills don't always populate signal.reason; fall back. */
+    private _abortReason;
     private _abortable;
     /** Throw an AbortError if signal is already aborted. */
     private static _throwIfAborted;
     /** Actual work done under the job queue — connection, fingerprint, call, and recovery. */
     private _runConnectorCall;
-    /**
-     * Stuck-app recovery: pause for the device's UI transition, then retry once.
-     *
-     * Caller has already cleared the session + reset connector. We wait so Stax
-     * finishes its post-CloseApp animation, then go through ensureConnected +
-     * fingerprint check + call exactly once. Caller decides what to do on a
-     * second stuck-app hit.
-     */
-    private _retryAfterStuckApp;
     private _sleepAbortable;
-    /**
-     * Clear stale session, reconnect, and retry the call.
-     *
-     * Timeout recovery starts with a full connector reset. After an APDU
-     * timeout, DMK/transport state may still emit malformed responses; retrying
-     * on the same DMK can poison the next chain switch.
-     */
-    private _retryWithFreshConnection;
     /**
      * Ensure OS-level device permission (Bluetooth / USB) before proceeding.
      *
@@ -498,6 +523,18 @@ declare class LedgerConnectorBase implements IConnector {
     private _getSignerManager;
     private _getDeviceAppsManager;
     private _invalidateSession;
+    /**
+     * Teardown for the OS-level actions that open a manager-api secure channel
+     * (install, uninstall, genuine check). Cancelling the device action is what
+     * stops DMK's xstate actor, which unsubscribes the secure-channel observable
+     * and closes its WebSocket; dropping the canceller without firing it leaves
+     * that teardown to run only if the action settled on its own.
+     *
+     * The DMK device session is deliberately kept: the secure channel is a
+     * separate WebSocket per call, and disconnecting here would break the bounded
+     * unlock/retry recovery the adapter runs on the original session.
+     */
+    private _teardownSecureChannelSession;
     /**
      * Replace an old session with a new one after app switch.
      * Emits device-connect so the adapter updates its _sessions Map.
@@ -654,6 +691,25 @@ declare class SignerSol {
     }>;
 }
 
+/**
+ * Wraps Ledger's Zcash SDK signer (Observable-based DeviceActions) into a
+ * simple async interface. Only the viewing-key and shielded-address reads are
+ * exposed; PCZT signing goes through a different host-side pipeline.
+ */
+declare class SignerZcash {
+    private readonly _sdk;
+    onInteraction?: (interaction: string) => void;
+    onRegisterCanceller?: (cancel: (reason?: CancelReason) => void) => void;
+    constructor(_sdk: SignerZcash$1);
+    /** GET_VK: UFVK string (default) or raw 96-byte Orchard FVK. */
+    getFullViewingKey(derivationPath: string, options?: FullViewingKeyOptions): Promise<GetFullViewingKeyDAOutput>;
+    /** GET_SHIELDED_ADDRESS: single-Orchard-receiver UA for a 5-level transparent path. */
+    getShieldedAddress(derivationPath: string, options?: {
+        checkOnDevice?: boolean;
+        skipOpenApp?: boolean;
+    }): Promise<GetShieldedAddressDAOutput>;
+}
+
 /**
  * Transport adapter that bridges Ledger's legacy hw-app-* SDKs to DMK's sendApdu.
  *
@@ -737,7 +793,7 @@ interface WrapErrorOptions {
     /** Fallback when err has no `appName` (DMK signer errors don't carry it). */
     defaultAppName?: string;
 }
-declare function ledgerFailure(code: HardwareErrorCode, error: string, appName?: string, tag?: string, params?: Record<string, unknown>): LedgerFailure;
+declare function ledgerFailure(code: HardwareErrorCode, error: string, appName?: string, tag?: string, params?: Record<string, unknown>, origin?: HwkErrorOrigin, recovery?: HwkRecoveryHint): LedgerFailure;
 declare function isDeviceLockedError(err: unknown): boolean;
 /**
  * Map a Ledger DMK error to a HardwareErrorCode and human-readable message.
@@ -747,6 +803,7 @@ declare function isDeviceLockedError(err: unknown): boolean;
 declare function mapLedgerError(err: unknown, opts?: WrapErrorOptions): {
     code: HardwareErrorCode;
     message: string;
+    origin?: HwkErrorOrigin;
     appName?: string;
 };
 
@@ -782,4 +839,4 @@ declare function isLedgerDmkBleTransport(transport?: string): boolean;
 declare function isLedgerBleConnectionType(connectionType?: ConnectionType): boolean;
 declare function isLedgerBleDescriptor(connectionType: ConnectionType, descriptor: DeviceDescriptor): boolean;
 
-export { AppManager, type DeviceActionState, type DmkDiscoveredDevice, DmkTransport, LedgerAdapter, LedgerConnectorBase, type LedgerConnectorBaseOptions, LedgerDeviceManager, type LedgerFailure, type SdkEvent, type SdkEventListener, type SdkLogEvent, SignerBtc, type SignerBtcAddress, SignerEth, type SignerEvmAddress, type SignerEvmSignature, SignerManager, SignerSol, type TransportFactory, debugLog, deviceActionToPromise, isDeviceLockedError, isLedgerBleConnectionType, isLedgerBleDescriptor, isLedgerDmkBleTransport, ledgerFailure, mapLedgerError, offSdkEvent, onSdkEvent };
+export { AppManager, type DeviceActionState, type DmkDiscoveredDevice, DmkTransport, LedgerAdapter, LedgerConnectorBase, type LedgerConnectorBaseOptions, LedgerDeviceManager, type LedgerFailure, type SdkEvent, type SdkEventListener, type SdkLogEvent, SignerBtc, type SignerBtcAddress, SignerEth, type SignerEvmAddress, type SignerEvmSignature, SignerManager, SignerSol, SignerZcash, type TransportFactory, debugLog, deviceActionToPromise, isDeviceLockedError, isLedgerBleConnectionType, isLedgerBleDescriptor, isLedgerDmkBleTransport, ledgerFailure, mapLedgerError, offSdkEvent, onSdkEvent };

package/dist/index.d.ts

@@ -1,10 +1,11 @@
 import * as _onekeyfe_hwk_adapter_core from '@onekeyfe/hwk-adapter-core';
-import { IHardwareWallet, IConnector, TransportType, UiResponseEvent, SearchDevicesOptions, DeviceInfo, Response, ChainCapability, NullableCallArg, IHardwareCallParams, EvmGetAddressParams, EvmAddress, EvmSignTxLedgerParams, EvmSignedTx, EvmSignMsgParams, EvmSignature, EvmSignTypedDataParams, BtcGetAddressParams, BtcAddress, BtcGetPublicKeyParams, BtcPublicKey, BtcSignTxParams, BtcSignedTx, BtcSignPsbtParams, BtcSignedPsbt, BtcSignMsgParams, BtcSignature, IHardwareCommonCallParams, SolGetAddressParams, SolAddress, SolSignTxParams, SolSignedTx, SolSignMsgParams, SolSignature, TronGetAddressParams, TronAddress, TronSignTxParams, TronSignedTx, TronSignMsgParams, TronSignature, DeviceAuthenticityParams, DeviceAuthenticityResult, HardwareEventMap, DeviceEventListener, ChainForFingerprint, DeviceDescriptor, DeviceChangeEvent, ConnectionType, ConnectorDevice, ConnectorSession, ConnectorCallResult, ConnectorEventType, ConnectorEventMap, ConnectorConfig, Failure, HardwareErrorCode } from '@onekeyfe/hwk-adapter-core';
+import { IHardwareWallet, IConnector, TransportType, UiResponseEvent, SearchDevicesOptions, DeviceInfo, DeviceSearchTarget, ConnectionTarget, Response, BindBleDeviceParams, IHardwareConnectionContext, NullableCallArg, IHardwareCallParams, EvmGetAddressParams, EvmAddress, EvmSignTxLedgerParams, EvmSignedTx, EvmSignMsgParams, EvmSignature, EvmSignTypedDataParams, BtcGetAddressParams, BtcAddress, BtcGetPublicKeyParams, BtcPublicKey, BtcSignTxParams, BtcSignedTx, BtcSignPsbtParams, BtcSignedPsbt, BtcSignMsgParams, BtcSignature, IHardwareCommonCallParams, SolGetAddressParams, SolAddress, SolSignTxParams, SolSignedTx, SolSignMsgParams, SolSignature, TronGetAddressParams, TronAddress, TronSignTxParams, TronSignedTx, TronSignMsgParams, TronSignature, ZcashGetFullViewingKeyParams, ZcashFullViewingKey, ZcashGetShieldedAddressParams, ZcashShieldedAddress, DeviceAuthenticityParams, DeviceAuthenticityResult, HardwareEventMap, DeviceEventListener, ChainForFingerprint, DeviceDescriptor, DeviceChangeEvent, ConnectionType, ConnectorDevice, ConnectorSession, ConnectorCallResult, ConnectorEventType, ConnectorEventMap, ConnectorConfig, Failure, HardwareErrorCode, HwkErrorOrigin, HwkRecoveryHint } from '@onekeyfe/hwk-adapter-core';
 import { DeviceActionState as DeviceActionState$1, DiscoveredDevice, ExecuteDeviceActionReturnType, DeviceManagementKit } from '@ledgerhq/device-management-kit';
 import { Address, Signature, SignerEth as SignerEth$1, TypedData } from '@ledgerhq/device-signer-kit-ethereum';
 import { ContextModule } from '@ledgerhq/context-module';
 import { SignerBtc as SignerBtc$1 } from '@ledgerhq/device-signer-kit-bitcoin';
 import { SignerSolana } from '@ledgerhq/device-signer-kit-solana';
+import { SignerZcash as SignerZcash$1, FullViewingKeyOptions, GetFullViewingKeyDAOutput, GetShieldedAddressDAOutput } from '@ledgerhq/device-signer-kit-zcash';
 import Transport from '@ledgerhq/hw-transport';
 
 /**
@@ -95,16 +96,30 @@ type LedgerCallParams<T> = NullableCallArg<IHardwareCallParams<T>>;
 type LedgerCommonParams = NullableCallArg<IHardwareCommonCallParams>;
 declare class LedgerAdapter implements IHardwareWallet {
     readonly vendor: "ledger";
+    readonly cancelCapability: "stops-waiting";
     private readonly connector;
     private readonly emitter;
+    private readonly _operations;
     private _discoveredDevices;
     private _sessions;
+    private readonly _pendingOperationBindings;
+    private readonly _verifiedBleReconnectTargets;
     private readonly _uiRegistry;
     private _btcHighIndexConfirmedThisSession;
     private readonly _jobQueue;
     private _deviceAuthenticityQueueTail;
     private _doConnectAbortController;
     private readonly _defaultAutoInstallApp;
+    private readonly _unsettledConnectorOperations;
+    private readonly _connectorIdleWaiters;
+    private _resetPromise;
+    private _stateGeneration;
+    private _connectorTeardownTail;
+    private _pendingConnectorTeardowns;
+    private _activeConnectionType;
+    private _bindingSelectionRequestId;
+    private _finishBleBinding;
+    private _isBleConnection;
     constructor(connector: IConnector, options?: {
         autoInstallApp?: boolean;
     });
@@ -118,22 +133,33 @@ declare class LedgerAdapter implements IHardwareWallet {
      * The next operation will re-discover and re-connect automatically.
      */
     resetState(): void;
+    private _resetStateAndDisconnectSessions;
     dispose(): Promise<void>;
     uiResponse(response: UiResponseEvent): void;
     searchDevices(options?: SearchDevicesOptions): Promise<DeviceInfo[]>;
+    private _searchDevices;
+    searchDeviceTargets(options?: SearchDevicesOptions): Promise<DeviceSearchTarget[]>;
+    listConnectionTargets(options?: SearchDevicesOptions): Promise<ConnectionTarget[]>;
     private _evictAllSessions;
     private static readonly MAX_BUSINESS_RETRY_BUDGET;
     private static readonly STUCK_APP_RETRY_DELAY_MS;
     private static readonly MAX_DOCONNECT_CONFIRMS;
     private _lastCancelReason;
+    private readonly _activeOperationJobs;
+    private readonly _pendingOperationDisconnects;
     private static readonly APP_INSTALL_PROGRESS_MIN_DELTA;
     private _installProgressLastEmittedValue;
     private _installProgressLastKey;
     private static _createDeviceBusyError;
-    connectDevice(connectId: string): Promise<Response<string>>;
-    disconnectDevice(connectId: string): Promise<void>;
-    getDeviceInfo(connectId: string, deviceId: string): Promise<Response<DeviceInfo>>;
-    getSupportedChains(): ChainCapability[];
+    connectDevice(searchTargetId: string): Promise<Response<string>>;
+    bindBleDevice(params: BindBleDeviceParams): Promise<Response<string>>;
+    acquireOperation(connectId: string, context: IHardwareConnectionContext): Promise<Response<string>>;
+    private _createOperation;
+    private _connectTarget;
+    releaseOperation(operationId: string): Promise<void>;
+    private _releaseOperationConnection;
+    private _releaseLostOperationConnection;
+    getDeviceInfo(connectIdOrOperationId: string, deviceId: string): Promise<Response<DeviceInfo>>;
     allNetworkGetAddress: (connectId: string, _deviceId: string, params: _onekeyfe_hwk_adapter_core.AllNetworkGetAddressParams) => Promise<Response<_onekeyfe_hwk_adapter_core.AllNetworkAddressResponse[]>>;
     private callChain;
     private static normalizeCallArgs;
@@ -157,6 +183,8 @@ declare class LedgerAdapter implements IHardwareWallet {
     tronGetAddress(connectId?: string | null, deviceId?: string | null, params?: LedgerCallParams<TronGetAddressParams>): Promise<Response<TronAddress>>;
     tronSignTransaction(connectId?: string | null, deviceId?: string | null, params?: LedgerCallParams<TronSignTxParams>): Promise<Response<TronSignedTx>>;
     tronSignMessage(connectId?: string | null, deviceId?: string | null, params?: LedgerCallParams<TronSignMsgParams>): Promise<Response<TronSignature>>;
+    zcashGetFullViewingKey(connectId?: string | null, deviceId?: string | null, params?: LedgerCallParams<ZcashGetFullViewingKeyParams>): Promise<Response<ZcashFullViewingKey>>;
+    zcashGetShieldedAddress(connectId?: string | null, deviceId?: string | null, params?: LedgerCallParams<ZcashGetShieldedAddressParams>): Promise<Response<ZcashShieldedAddress>>;
     installApp(connectId: string, appName: string): Promise<Response<void>>;
     listInstalledApps(connectId: string): Promise<Response<AppMetadata[]>>;
     listInstalledNames(connectId: string): Promise<Response<string[]>>;
@@ -181,11 +209,11 @@ declare class LedgerAdapter implements IHardwareWallet {
     off<K extends keyof HardwareEventMap>(event: K, listener: (event: HardwareEventMap[K]) => void): void;
     off(event: string, listener: DeviceEventListener): void;
     cancel(connectId?: string): void;
+    /** A non-empty deviceId is an expected chain fingerprint, not a transport identifier. */
     getChainFingerprint(connectId: string, deviceId: string, chain: ChainForFingerprint): Promise<Response<string>>;
-    /**
-     * Verify fingerprint using an existing sessionId directly.
-     * Safe to call inside connectorCall without causing queue deadlock.
-     */
+    /** Discovery may select a BLE target before a later call verifies its wallet. */
+    private _publishVerifiedBleBinding;
+    /** Verify on the acquired session without re-entering the job queue. */
     private _verifyDeviceFingerprintWithSession;
     /**
      * Compute the chain fingerprint via a caller-supplied call strategy.
@@ -207,9 +235,17 @@ declare class LedgerAdapter implements IHardwareWallet {
      *
      * - If a session already exists for the given connectId, reuse it.
      * - If ANY session exists (Ledger IDs are ephemeral), reuse it.
-     * - Otherwise: search → exactly 1 USB device auto-connects; multiple or none throws.
+     * - Otherwise: search → one USB device auto-connects; multiple asks the host to choose.
      */
     private _connectingPromise;
+    /**
+     * The operation the running device job belongs to, so a UI request raised
+     * mid-call can name it. A call pinned to an operation queues under its id
+     * (`ledgerQueueKey`); a call without one queues under the connectId, and the
+     * live operation on that connection is still the owner. Only work with no
+     * operation at all (cold start) comes back undefined.
+     */
+    private _activeOperationId;
     private _waitForDeviceConnect;
     /**
      * Decide whether a BTC pubkey call needs `showOnDevice=true` because of
@@ -250,34 +286,23 @@ declare class LedgerAdapter implements IHardwareWallet {
      * lives in one place.
      */
     private _callConnector;
+    private _assertConnectorReady;
+    private _runConnectorTeardown;
+    private _waitForConnectorOperationsToDrain;
+    private _retainConnectorOperation;
     private connectorCall;
     /**
      * Race a promise against an abort signal. On abort, rejects with
      * signal.reason → instance _lastCancelReason → generic Error('Aborted').
      */
+    /** Hermes/RN polyfills don't always populate signal.reason; fall back. */
+    private _abortReason;
     private _abortable;
     /** Throw an AbortError if signal is already aborted. */
     private static _throwIfAborted;
     /** Actual work done under the job queue — connection, fingerprint, call, and recovery. */
     private _runConnectorCall;
-    /**
-     * Stuck-app recovery: pause for the device's UI transition, then retry once.
-     *
-     * Caller has already cleared the session + reset connector. We wait so Stax
-     * finishes its post-CloseApp animation, then go through ensureConnected +
-     * fingerprint check + call exactly once. Caller decides what to do on a
-     * second stuck-app hit.
-     */
-    private _retryAfterStuckApp;
     private _sleepAbortable;
-    /**
-     * Clear stale session, reconnect, and retry the call.
-     *
-     * Timeout recovery starts with a full connector reset. After an APDU
-     * timeout, DMK/transport state may still emit malformed responses; retrying
-     * on the same DMK can poison the next chain switch.
-     */
-    private _retryWithFreshConnection;
     /**
      * Ensure OS-level device permission (Bluetooth / USB) before proceeding.
      *
@@ -498,6 +523,18 @@ declare class LedgerConnectorBase implements IConnector {
     private _getSignerManager;
     private _getDeviceAppsManager;
     private _invalidateSession;
+    /**
+     * Teardown for the OS-level actions that open a manager-api secure channel
+     * (install, uninstall, genuine check). Cancelling the device action is what
+     * stops DMK's xstate actor, which unsubscribes the secure-channel observable
+     * and closes its WebSocket; dropping the canceller without firing it leaves
+     * that teardown to run only if the action settled on its own.
+     *
+     * The DMK device session is deliberately kept: the secure channel is a
+     * separate WebSocket per call, and disconnecting here would break the bounded
+     * unlock/retry recovery the adapter runs on the original session.
+     */
+    private _teardownSecureChannelSession;
     /**
      * Replace an old session with a new one after app switch.
      * Emits device-connect so the adapter updates its _sessions Map.
@@ -654,6 +691,25 @@ declare class SignerSol {
     }>;
 }
 
+/**
+ * Wraps Ledger's Zcash SDK signer (Observable-based DeviceActions) into a
+ * simple async interface. Only the viewing-key and shielded-address reads are
+ * exposed; PCZT signing goes through a different host-side pipeline.
+ */
+declare class SignerZcash {
+    private readonly _sdk;
+    onInteraction?: (interaction: string) => void;
+    onRegisterCanceller?: (cancel: (reason?: CancelReason) => void) => void;
+    constructor(_sdk: SignerZcash$1);
+    /** GET_VK: UFVK string (default) or raw 96-byte Orchard FVK. */
+    getFullViewingKey(derivationPath: string, options?: FullViewingKeyOptions): Promise<GetFullViewingKeyDAOutput>;
+    /** GET_SHIELDED_ADDRESS: single-Orchard-receiver UA for a 5-level transparent path. */
+    getShieldedAddress(derivationPath: string, options?: {
+        checkOnDevice?: boolean;
+        skipOpenApp?: boolean;
+    }): Promise<GetShieldedAddressDAOutput>;
+}
+
 /**
  * Transport adapter that bridges Ledger's legacy hw-app-* SDKs to DMK's sendApdu.
  *
@@ -737,7 +793,7 @@ interface WrapErrorOptions {
     /** Fallback when err has no `appName` (DMK signer errors don't carry it). */
     defaultAppName?: string;
 }
-declare function ledgerFailure(code: HardwareErrorCode, error: string, appName?: string, tag?: string, params?: Record<string, unknown>): LedgerFailure;
+declare function ledgerFailure(code: HardwareErrorCode, error: string, appName?: string, tag?: string, params?: Record<string, unknown>, origin?: HwkErrorOrigin, recovery?: HwkRecoveryHint): LedgerFailure;
 declare function isDeviceLockedError(err: unknown): boolean;
 /**
  * Map a Ledger DMK error to a HardwareErrorCode and human-readable message.
@@ -747,6 +803,7 @@ declare function isDeviceLockedError(err: unknown): boolean;
 declare function mapLedgerError(err: unknown, opts?: WrapErrorOptions): {
     code: HardwareErrorCode;
     message: string;
+    origin?: HwkErrorOrigin;
     appName?: string;
 };
 
@@ -782,4 +839,4 @@ declare function isLedgerDmkBleTransport(transport?: string): boolean;
 declare function isLedgerBleConnectionType(connectionType?: ConnectionType): boolean;
 declare function isLedgerBleDescriptor(connectionType: ConnectionType, descriptor: DeviceDescriptor): boolean;
 
-export { AppManager, type DeviceActionState, type DmkDiscoveredDevice, DmkTransport, LedgerAdapter, LedgerConnectorBase, type LedgerConnectorBaseOptions, LedgerDeviceManager, type LedgerFailure, type SdkEvent, type SdkEventListener, type SdkLogEvent, SignerBtc, type SignerBtcAddress, SignerEth, type SignerEvmAddress, type SignerEvmSignature, SignerManager, SignerSol, type TransportFactory, debugLog, deviceActionToPromise, isDeviceLockedError, isLedgerBleConnectionType, isLedgerBleDescriptor, isLedgerDmkBleTransport, ledgerFailure, mapLedgerError, offSdkEvent, onSdkEvent };
+export { AppManager, type DeviceActionState, type DmkDiscoveredDevice, DmkTransport, LedgerAdapter, LedgerConnectorBase, type LedgerConnectorBaseOptions, LedgerDeviceManager, type LedgerFailure, type SdkEvent, type SdkEventListener, type SdkLogEvent, SignerBtc, type SignerBtcAddress, SignerEth, type SignerEvmAddress, type SignerEvmSignature, SignerManager, SignerSol, SignerZcash, type TransportFactory, debugLog, deviceActionToPromise, isDeviceLockedError, isLedgerBleConnectionType, isLedgerBleDescriptor, isLedgerDmkBleTransport, ledgerFailure, mapLedgerError, offSdkEvent, onSdkEvent };