@onekeyfe/hwk-ledger-adapter 1.2.3-alpha.7 → 1.2.3-alpha.8

package/dist/index.mjs

@@ -6,30 +6,41 @@ import {
   DeviceJobQueue,
   EConnectorInteraction,
   HardwareErrorCode as HardwareErrorCode3,
+  OperationRegistry,
+  SDK,
   TypedEventEmitter,
   UI_REQUEST,
   UI_REQUEST_PREEMPTED_TAG,
   UiRequestRegistry,
+  canReplayHardwareMethodAfterTransportFailure,
   createHwkError,
   deriveDeviceFingerprint,
   failure as failure2,
+  isHardwareOperationId,
+  isHwkRecoveryHint,
+  operationMayHaveCompletedParams,
   rehydrateConnectorError,
+  requestBleDeviceSelection,
+  requestSaveDeviceBinding,
+  resolveSearchTargetReusePolicy,
   success
 } from "@onekeyfe/hwk-adapter-core";
 
 // src/errors.ts
-import { HardwareErrorCode, enrichErrorMessage } from "@onekeyfe/hwk-adapter-core";
-var MULTIPLE_USB_LEDGER_DEVICES_ERROR_MESSAGE = "Multiple Ledger USB devices are connected. Please connect only one Ledger device and try again.";
-function createMultipleUsbLedgerDevicesError() {
-  return Object.assign(new Error(MULTIPLE_USB_LEDGER_DEVICES_ERROR_MESSAGE), {
-    code: HardwareErrorCode.DeviceOneDeviceOnly
-  });
-}
-function ledgerFailure(code, error, appName, tag, params) {
+import {
+  HardwareErrorCode,
+  defaultOriginForCode,
+  defaultRecoveryForCode,
+  enrichErrorMessage
+} from "@onekeyfe/hwk-adapter-core";
+function ledgerFailure(code, error, appName, tag, params, origin, recovery) {
   const payload = { error, code };
   if (appName !== void 0) payload.appName = appName;
   if (tag !== void 0) payload._tag = tag;
   if (params !== void 0) payload.params = params;
+  const resolvedOrigin = origin ?? defaultOriginForCode(code);
+  if (resolvedOrigin !== void 0) payload.origin = resolvedOrigin;
+  payload.recovery = recovery ?? defaultRecoveryForCode(code);
   return { success: false, payload };
 }
 var LOCKED_ERROR_CODES = /* @__PURE__ */ new Set(["5515", "21781", "6982", "27010", "5303", "21251"]);
@@ -170,7 +181,12 @@ var ERROR_TAG = {
   UnknownDevice: "UnknownDeviceError",
   DeviceSessionRefresher: "DeviceSessionRefresherError",
   DeviceNotInitialized: "DeviceNotInitializedError",
-  OpeningConnection: "OpeningConnectionError",
+  // DMK's class is named OpeningConnectionError but its `_tag` reads
+  // "ConnectionOpeningError" — and its typings widen `_tag` to `string`, which
+  // is why the class name looked authoritative. Both spellings are kept so a
+  // DMK version that aligns them does not silently drop back to UnknownError.
+  OpeningConnection: "ConnectionOpeningError",
+  OpeningConnectionLegacy: "OpeningConnectionError",
   DeviceDisconnectedBeforeSendingApdu: "DeviceDisconnectedBeforeSendingApdu",
   DeviceDisconnectedWhileSending: "DeviceDisconnectedWhileSendingError",
   Disconnect: "DisconnectError",
@@ -183,7 +199,18 @@ var ERROR_TAG = {
   // DMK remote-network failures (manager-api HTTP / secure-channel WS).
   WebSocketConnection: "WebSocketConnectionError",
   HttpFetch: "FetchError",
-  InvalidFirmwareMetadataResponse: "InvalidGetFirmwareMetadataResponseError"
+  NetworkDA: "NetworkDAError",
+  InvalidFirmwareMetadataResponse: "InvalidGetFirmwareMetadataResponseError",
+  ApplicationsMetadataTask: "GetApplicationsMetadataTaskError",
+  // DMK OS/secure-channel device actions. `SecureChannelError` is the residual
+  // bucket left by SecureChannelError.mapInstallDAErrors() after the locked /
+  // refused / already-installed / OOM cases have been split out, so it means
+  // "the relay itself broke", not "the device answered".
+  SecureChannel: "SecureChannelError",
+  RefusedByUserDA: "RefusedByUserDAError",
+  AppAlreadyInstalledDA: "AppAlreadyInstalledDAError",
+  OutOfMemoryDA: "OutOfMemoryDAError",
+  DeviceNotOnboarded: "DeviceNotOnboardedError"
 };
 function isDeviceLockedError(err) {
   if (!err || typeof err !== "object") return false;
@@ -213,7 +240,6 @@ function isBlePairingFailureError(err) {
   return false;
 }
 var CONNECTION_LEVEL_TAGS = /* @__PURE__ */ new Set([
-  ERROR_TAG.DeviceLocked,
   ERROR_TAG.DeviceNotAdvertising,
   ERROR_TAG.BlePairingTimeout,
   ERROR_TAG.BleGattBondingFailed,
@@ -225,6 +251,7 @@ var CONNECTION_LEVEL_TAGS = /* @__PURE__ */ new Set([
   ERROR_TAG.DeviceSessionRefresher,
   ERROR_TAG.DeviceNotInitialized,
   ERROR_TAG.OpeningConnection,
+  ERROR_TAG.OpeningConnectionLegacy,
   ERROR_TAG.DeviceDisconnectedBeforeSendingApdu,
   ERROR_TAG.DeviceDisconnectedWhileSending,
   ERROR_TAG.Disconnect,
@@ -239,7 +266,10 @@ var DEVICE_NOT_FOUND_TAGS = /* @__PURE__ */ new Set([
   // Map to DeviceNotFound so non-BLE-direct paths get a sensible error code.
   ERROR_TAG.DeviceNotInDiscoveryCache
 ]);
-var DEVICE_BUSY_TAGS = /* @__PURE__ */ new Set([ERROR_TAG.OpeningConnection]);
+var DEVICE_BUSY_TAGS = /* @__PURE__ */ new Set([
+  ERROR_TAG.OpeningConnection,
+  ERROR_TAG.OpeningConnectionLegacy
+]);
 var DEVICE_DISCONNECTED_TAGS = /* @__PURE__ */ new Set([
   ERROR_TAG.DeviceNotRecognized,
   ERROR_TAG.DeviceSessionNotFound,
@@ -262,6 +292,13 @@ function isConnectionLevelError(err) {
 function isKnownConnectionTag(tag) {
   return typeof tag === "string" && CONNECTION_LEVEL_TAGS.has(tag);
 }
+var CONNECTION_OPENING_TAGS = /* @__PURE__ */ new Set([
+  ERROR_TAG.OpeningConnection,
+  ERROR_TAG.OpeningConnectionLegacy
+]);
+function isConnectionOpeningTag(tag) {
+  return typeof tag === "string" && CONNECTION_OPENING_TAGS.has(tag);
+}
 function hasStatusCode(err, codeSet) {
   if (!err || typeof err !== "object") return false;
   const e = err;
@@ -297,6 +334,14 @@ function hasInvalidArgumentCode(err) {
   if (e.error != null && e._tag && hasInvalidArgumentCode(e.error)) return true;
   return false;
 }
+function hasErrorTag(err, tags) {
+  if (!err || typeof err !== "object") return false;
+  const e = err;
+  if (typeof e._tag === "string" && tags.has(e._tag)) return true;
+  if (e.originalError != null && hasErrorTag(e.originalError, tags)) return true;
+  if (e.error != null && e._tag && hasErrorTag(e.error, tags)) return true;
+  return false;
+}
 function isDeviceNotFoundError(err) {
   if (!err || typeof err !== "object") return false;
   const tag = err._tag;
@@ -315,10 +360,14 @@ function isDeviceBusyError(err) {
   if (e.error != null && e._tag && isDeviceBusyError(e.error)) return true;
   return false;
 }
+var USER_REJECTED_TAGS = /* @__PURE__ */ new Set([
+  ERROR_TAG.UserRefusedOnDevice,
+  ERROR_TAG.RefusedByUserDA
+]);
 function isUserRejectedError(err) {
   if (!err || typeof err !== "object") return false;
   const e = err;
-  if (e._tag === ERROR_TAG.UserRefusedOnDevice) return true;
+  if (hasErrorTag(err, USER_REJECTED_TAGS)) return true;
   if (typeof e.message === "string" && /denied|rejected|refused/i.test(e.message)) return true;
   if (hasStatusCode(err, USER_REJECTED_CODES)) return true;
   return false;
@@ -349,15 +398,37 @@ function isAppNotInstalledError(err) {
   if (hasStatusCode(err, APP_NOT_INSTALLED_CODES)) return true;
   return false;
 }
+var OUT_OF_MEMORY_TAGS = /* @__PURE__ */ new Set([ERROR_TAG.OutOfMemoryDA]);
 function isOutOfMemoryError(err) {
-  if (!err || typeof err !== "object") return false;
-  const e = err;
-  return e._tag === "OutOfMemoryDAError";
+  return hasErrorTag(err, OUT_OF_MEMORY_TAGS);
+}
+var APP_ALREADY_INSTALLED_TAGS = /* @__PURE__ */ new Set([
+  ERROR_TAG.AppAlreadyInstalledDA
+]);
+function isAppAlreadyInstalledError(err) {
+  return hasErrorTag(err, APP_ALREADY_INSTALLED_TAGS);
+}
+var DEVICE_NOT_ONBOARDED_TAGS = /* @__PURE__ */ new Set([
+  ERROR_TAG.DeviceNotOnboarded
+]);
+function isDeviceNotOnboardedError(err) {
+  return hasErrorTag(err, DEVICE_NOT_ONBOARDED_TAGS);
+}
+var FIRMWARE_METADATA_TAGS = /* @__PURE__ */ new Set([
+  ERROR_TAG.InvalidFirmwareMetadataResponse,
+  ERROR_TAG.ApplicationsMetadataTask
+]);
+function isFirmwareMetadataError(err) {
+  return hasErrorTag(err, FIRMWARE_METADATA_TAGS);
+}
+var SECURE_CHANNEL_TAGS = /* @__PURE__ */ new Set([ERROR_TAG.SecureChannel]);
+function isSecureChannelError(err) {
+  return hasErrorTag(err, SECURE_CHANNEL_TAGS);
 }
 var NETWORK_ERROR_TAGS = /* @__PURE__ */ new Set([
   ERROR_TAG.WebSocketConnection,
   ERROR_TAG.HttpFetch,
-  ERROR_TAG.InvalidFirmwareMetadataResponse
+  ERROR_TAG.NetworkDA
 ]);
 function isNetworkError(err) {
   if (!err || typeof err !== "object") return false;
@@ -407,23 +478,34 @@ function isTransportStuck(err) {
 function isStuckAppStateError(err) {
   return isAppStuckByApdu(err) || isTransportStuck(err);
 }
+var DMK_PLACEHOLDER_MESSAGE = "Unknown error.";
+function nestedErrorMessage(nested) {
+  if (!nested || typeof nested !== "object") return void 0;
+  const { message } = nested;
+  if (typeof message !== "string") return void 0;
+  const trimmed = message.trim();
+  if (!trimmed || trimmed === DMK_PLACEHOLDER_MESSAGE) return void 0;
+  return message;
+}
 function mapLedgerError(err, opts) {
   let originalMessage = "Unknown Ledger error";
   if (err instanceof Error) {
     originalMessage = err.message;
   } else if (err && typeof err === "object") {
     const e = err;
-    originalMessage = String(e.message ?? e._tag ?? e.type ?? JSON.stringify(err));
+    originalMessage = String(
+      e.message ?? nestedErrorMessage(e.originalError) ?? e._tag ?? e.type ?? JSON.stringify(err)
+    );
   }
   let code;
   if (isDeviceLockedError(err)) {
     code = HardwareErrorCode.DeviceLocked;
   } else if (isDeviceNotAdvertisingError(err) || isDeviceNotFoundError(err)) {
     code = HardwareErrorCode.DeviceNotFound;
-  } else if (isDeviceBusyError(err)) {
-    code = HardwareErrorCode.DeviceBusy;
   } else if (isBlePairingFailureError(err)) {
     code = HardwareErrorCode.BlePairingTimeout;
+  } else if (isDeviceBusyError(err)) {
+    code = HardwareErrorCode.DeviceBusy;
   } else if (isUserAbortedError(err)) {
     code = HardwareErrorCode.UserAborted;
   } else if (isUserRejectedError(err)) {
@@ -432,10 +514,18 @@ function mapLedgerError(err, opts) {
     code = HardwareErrorCode.WrongApp;
   } else if (isAppNotInstalledError(err)) {
     code = HardwareErrorCode.AppNotInstalled;
+  } else if (isAppAlreadyInstalledError(err)) {
+    code = HardwareErrorCode.AppAlreadyInstalled;
   } else if (isOutOfMemoryError(err)) {
     code = HardwareErrorCode.DeviceOutOfMemory;
+  } else if (isDeviceNotOnboardedError(err)) {
+    code = HardwareErrorCode.DeviceNotInitialized;
+  } else if (isFirmwareMetadataError(err)) {
+    code = HardwareErrorCode.LedgerFirmwareMetadataError;
   } else if (isNetworkError(err)) {
     code = HardwareErrorCode.NetworkError;
+  } else if (isSecureChannelError(err)) {
+    code = HardwareErrorCode.LedgerSecureChannelError;
   } else if (isDeviceDisconnectedError(err)) {
     code = HardwareErrorCode.DeviceDisconnected;
   } else if (isTimeoutError(err)) {
@@ -448,11 +538,32 @@ function mapLedgerError(err, opts) {
   }
   const errAppName = err && typeof err === "object" ? err.appName : void 0;
   const appName = errAppName ?? opts?.defaultAppName;
-  return { code, message: enrichErrorMessage(code, originalMessage), appName };
+  return {
+    code,
+    message: enrichErrorMessage(code, originalMessage),
+    origin: defaultOriginForCode(code),
+    appName
+  };
+}
+
+// src/utils/queueKey.ts
+var LEDGER_DEFAULT_QUEUE_KEY = "__ledger_default__";
+function ledgerQueueKey({
+  operationId,
+  connectId
+}) {
+  return (operationId ?? connectId) || LEDGER_DEFAULT_QUEUE_KEY;
 }
 
 // src/adapter/methods/allNetworkGetAddress.ts
-import { HardwareErrorCode as HardwareErrorCode2, failure, runAllNetworkGetAddress } from "@onekeyfe/hwk-adapter-core";
+import {
+  HardwareErrorCode as HardwareErrorCode2,
+  failure,
+  isConnectionLost,
+  isUserRefusal,
+  resolveHardwareOperationTarget,
+  runAllNetworkGetAddress
+} from "@onekeyfe/hwk-adapter-core";
 
 // src/utils/sdkEventBus.ts
 var listeners = /* @__PURE__ */ new Set();
@@ -509,65 +620,102 @@ var LEDGER_BTC_NETWORK_COIN_MAP = {
 var LEDGER_UNSUPPORTED_ALLNETWORK_NETWORKS = /* @__PURE__ */ new Set(["doge", "dogecoin"]);
 function createAllNetworkGetAddress({
   callChain,
-  getChainFingerprint
+  getChainFingerprint,
+  retainOperation,
+  errorToFailure,
+  createCancelScope
 }) {
   return async function allNetworkGetAddress(connectId, _deviceId, params) {
-    debugLog("[LedgerAdapter][REQ]", { method: "allNetworkGetAddress", connectId, params });
+    debugLog("[LedgerAdapter][REQ]", {
+      method: "allNetworkGetAddress",
+      connectId,
+      itemCount: params.bundle.length
+    });
+    const target = resolveHardwareOperationTarget(connectId, params.operationId, "ledger");
+    if (!target.success) return target;
+    const effectiveTargetId = target.payload.targetId ?? "";
+    let releaseOperationRetention;
+    try {
+      releaseOperationRetention = target.payload.operationId ? retainOperation(target.payload.operationId) : void 0;
+    } catch (error) {
+      return errorToFailure(error);
+    }
+    const cancelScope = createCancelScope(
+      ledgerQueueKey({ operationId: target.payload.operationId, connectId: effectiveTargetId })
+    );
     const installContext = {};
     const commonParams = {
-      autoInstallApp: params.autoInstallApp
+      autoInstallApp: params.autoInstallApp,
+      operationId: target.payload.operationId,
+      knownConnections: params.knownConnections,
+      extra: params.extra,
+      allowDeviceSelection: params.allowDeviceSelection
     };
     const chainFingerprints = /* @__PURE__ */ new Map();
-    const result = await runAllNetworkGetAddress({
-      connectId,
-      deviceId: _deviceId,
-      params,
-      normalizeItem: normalizeLedgerAllNetworkItem,
-      buildUnsupportedNetworkResponse: (item) => isUnsupportedLedgerAllNetworkNetwork(item) ? buildUnsupportedNetworkResponse(item) : void 0,
-      callItem: async ({ method, chain, item }) => {
-        const itemDeviceId = getItemDeviceId(item) ?? chainFingerprints.get(chain) ?? "";
-        return callAllNetworkMethod(
-          callChain,
-          connectId,
-          itemDeviceId,
-          method,
+    try {
+      const result = await runAllNetworkGetAddress({
+        connectId: effectiveTargetId,
+        deviceId: _deviceId,
+        params,
+        normalizeItem: normalizeLedgerAllNetworkItem,
+        buildUnsupportedNetworkResponse: (item) => isUnsupportedLedgerAllNetworkNetwork(item) ? buildUnsupportedNetworkResponse(item) : void 0,
+        callItem: async ({ method, chain, item }) => {
+          if (cancelScope.signal.aborted) return buildCancelledFailure(cancelScope.signal);
+          const itemDeviceId = getItemDeviceId(item) ?? chainFingerprints.get(chain) ?? "";
+          return callAllNetworkMethod(
+            callChain,
+            effectiveTargetId,
+            itemDeviceId,
+            method,
+            item,
+            commonParams,
+            installContext
+          );
+        },
+        attachIdentity: async ({ item, chain, payload }) => attachLedgerIdentity(
+          getChainFingerprint,
+          effectiveTargetId,
           item,
-          commonParams,
-          installContext
-        );
-      },
-      attachIdentity: async ({ item, chain, payload }) => attachLedgerIdentity(
-        getChainFingerprint,
-        connectId,
-        item,
-        chain,
-        payload,
-        chainFingerprints
-      ),
-      shouldAbortBundle: isTopLevelAllNetworkFailure,
-      buildTopLevelFailure: (response) => {
-        const code = response.payload?.code ?? HardwareErrorCode2.DeviceMismatch;
-        return failure(
-          code,
-          response.payload?.error ?? "All-network get-address aborted",
-          response.payload?.params
-        );
-      }
-    });
-    debugLog("[LedgerAdapter][RES]", {
-      method: "allNetworkGetAddress",
-      success: result.success,
-      payload: result
-    });
-    return result;
+          chain,
+          payload,
+          chainFingerprints,
+          installContext,
+          cancelScope.signal
+        ),
+        shouldAbortBundle: isTopLevelAllNetworkFailure,
+        buildTopLevelFailure: (response) => {
+          const code = response.payload?.code ?? HardwareErrorCode2.DeviceMismatch;
+          return failure(
+            code,
+            response.payload?.error ?? "All-network get-address aborted",
+            response.payload?.params
+          );
+        }
+      });
+      debugLog("[LedgerAdapter][RES]", {
+        method: "allNetworkGetAddress",
+        success: result.success,
+        payload: result
+      });
+      return result;
+    } finally {
+      cancelScope.release();
+      releaseOperationRetention?.();
+    }
   };
 }
+function buildCancelledFailure(signal) {
+  const reason = signal.reason;
+  const code = typeof reason?.code === "number" ? reason.code : HardwareErrorCode2.UserAborted;
+  const message = typeof reason?.message === "string" ? reason.message : "";
+  return failure(code, message || "All-network get-address cancelled");
+}
 function isTopLevelAllNetworkFailure(response) {
   if (response.success) {
     return false;
   }
   const code = response.payload?.code;
-  return code === HardwareErrorCode2.DeviceMismatch || code === HardwareErrorCode2.UserAborted || code === HardwareErrorCode2.UserRejected;
+  return code === HardwareErrorCode2.DeviceMismatch || isUserRefusal(code) || isConnectionLost(code);
 }
 function getItemDeviceId(item) {
   const { deviceId } = item;
@@ -597,8 +745,18 @@ function normalizeLedgerAllNetworkItem(method, item) {
   const coin = LEDGER_BTC_NETWORK_COIN_MAP[item.network];
   return coin ? { ...item, coin } : item;
 }
-async function attachLedgerIdentity(getChainFingerprint, connectId, item, chain, payload, chainFingerprints) {
-  const fingerprint = getItemDeviceId(item) || chainFingerprints.get(chain) || await bootstrapChainFingerprint(getChainFingerprint, connectId, chain);
+async function attachLedgerIdentity(getChainFingerprint, connectId, item, chain, payload, chainFingerprints, context, cancelSignal) {
+  const knownFingerprint = getItemDeviceId(item) || chainFingerprints.get(chain) || "";
+  if (!knownFingerprint && cancelSignal.aborted) {
+    const cancelled = buildCancelledFailure(cancelSignal);
+    return { ...item, success: false, payload: cancelled.payload };
+  }
+  const fingerprint = knownFingerprint || await bootstrapChainFingerprint(
+    getChainFingerprint,
+    context.connection?.connectId ?? connectId,
+    chain,
+    context
+  );
   if (!fingerprint) {
     return buildFingerprintBootstrapFailure(item, chain);
   }
@@ -619,8 +777,8 @@ async function attachLedgerIdentity(getChainFingerprint, connectId, item, chain,
     }
   };
 }
-async function bootstrapChainFingerprint(getChainFingerprint, connectId, chain) {
-  const response = await getChainFingerprint(connectId, chain);
+async function bootstrapChainFingerprint(getChainFingerprint, connectId, chain, context) {
+  const response = await getChainFingerprint(connectId, chain, context);
   return response.success ? response.payload : "";
 }
 function buildFingerprintBootstrapFailure(item, chain) {
@@ -724,9 +882,32 @@ function btcAccountIndexFromPath(path) {
 var _LedgerAdapter = class _LedgerAdapter {
   constructor(connector, options) {
     this.vendor = "ledger";
+    // A cancel releases the DMK device action and its intent-queue slot, so the
+    // next call is not blocked behind it. It still cannot retract a confirmation
+    // screen the device is already showing.
+    this.cancelCapability = "stops-waiting";
     this.emitter = new TypedEventEmitter();
+    this._operations = new OperationRegistry({
+      vendor: "ledger",
+      onEnded: (operation, reason) => {
+        const binding = this._pendingOperationBindings.get(operation.operationId);
+        if (binding?.selectedConnection?.requestId === this._bindingSelectionRequestId) {
+          this._finishBleBinding("cancelled");
+        }
+        this._pendingOperationBindings.delete(operation.operationId);
+        this.emitter.emit(SDK.OPERATION_ENDED, {
+          type: SDK.OPERATION_ENDED,
+          payload: { operationId: operation.operationId, reason }
+        });
+        if (reason === "timeout") {
+          void this._releaseOperationConnection(operation);
+        }
+      }
+    });
     this._discoveredDevices = /* @__PURE__ */ new Map();
     this._sessions = /* @__PURE__ */ new Map();
+    this._pendingOperationBindings = /* @__PURE__ */ new Map();
+    this._verifiedBleReconnectTargets = /* @__PURE__ */ new Map();
     this._uiRegistry = new UiRequestRegistry();
     // BTC App rejects account index >= 100 unless display=true. Cached per
     // adapter instance: first 100+ path asks the user once via UI request,
@@ -740,10 +921,31 @@ var _LedgerAdapter = class _LedgerAdapter {
     this._deviceAuthenticityQueueTail = Promise.resolve();
     // Shared across concurrent callers — only `cancel()` aborts.
     this._doConnectAbortController = null;
+    this._unsettledConnectorOperations = /* @__PURE__ */ new Map();
+    this._connectorIdleWaiters = /* @__PURE__ */ new Set();
+    this._resetPromise = null;
+    this._stateGeneration = 0;
+    this._connectorTeardownTail = Promise.resolve();
+    this._pendingConnectorTeardowns = 0;
+    this._activeOperationJobs = /* @__PURE__ */ new Set();
+    this._pendingOperationDisconnects = /* @__PURE__ */ new Set();
     this._installProgressLastEmittedValue = -Infinity;
     this.allNetworkGetAddress = createAllNetworkGetAddress({
       callChain: this.callChain.bind(this),
-      getChainFingerprint: (connectId, chain) => this.getChainFingerprint(connectId, "", chain)
+      getChainFingerprint: async (connectId, chain, context) => {
+        try {
+          const fingerprint = await this._computeChainFingerprint(
+            chain,
+            (method, params) => this.connectorCall(connectId, method, params, void 0, void 0, void 0, context)
+          );
+          return success(fingerprint);
+        } catch (error) {
+          return this.errorToFailure(error);
+        }
+      },
+      retainOperation: (operationId) => this._operations.retain(operationId),
+      errorToFailure: (error) => this.errorToFailure(error),
+      createCancelScope: (queueKey) => this._jobQueue.createCancelScope(queueKey)
     });
     // ---------------------------------------------------------------------------
     // Private helpers
@@ -753,7 +955,7 @@ var _LedgerAdapter = class _LedgerAdapter {
      *
      * - If a session already exists for the given connectId, reuse it.
      * - If ANY session exists (Ledger IDs are ephemeral), reuse it.
-     * - Otherwise: search → exactly 1 USB device auto-connects; multiple or none throws.
+     * - Otherwise: search → one USB device auto-connects; multiple asks the host to choose.
      */
     // Mutex for ensureConnected — prevents concurrent calls from establishing duplicate connections
     this._connectingPromise = null;
@@ -770,6 +972,12 @@ var _LedgerAdapter = class _LedgerAdapter {
       });
     };
     this.deviceDisconnectHandler = (data) => {
+      const activeOperation = this._operations.findActiveByConnectionKey(data.connectId);
+      if (activeOperation && this._activeOperationJobs.has(activeOperation.operationId)) {
+        this._pendingOperationDisconnects.add(activeOperation.operationId);
+      } else {
+        this._operations.endByConnectionKey(data.connectId, "disconnect");
+      }
       this._discoveredDevices.delete(data.connectId);
       this._sessions.delete(data.connectId);
       this.emitter.emit(DEVICE.DISCONNECT, {
@@ -826,11 +1034,28 @@ var _LedgerAdapter = class _LedgerAdapter {
     this._jobQueue = new DeviceJobQueue();
     this.registerEventListeners();
   }
+  _finishBleBinding(status) {
+    const selectionRequestId = this._bindingSelectionRequestId;
+    this._bindingSelectionRequestId = void 0;
+    if (selectionRequestId)
+      this.emitter.emit(UI_REQUEST.DEVICE_BINDING_STATUS, {
+        type: UI_REQUEST.DEVICE_BINDING_STATUS,
+        payload: { selectionRequestId, status }
+      });
+  }
+  _isBleConnection() {
+    return isLedgerBleConnectionType(this._activeConnectionType ?? this.connector.connectionType);
+  }
   // Transport
   get activeTransport() {
-    return isLedgerBleConnectionType(this.connector.connectionType) ? "ble" : "hid";
+    return this._isBleConnection() ? "ble" : "hid";
   }
   getAvailableTransports() {
+    if (this.connector.availableTransports) {
+      return this.connector.availableTransports.map(
+        (transport) => transport === "ble" ? "ble" : "hid"
+      );
+    }
     return this.activeTransport ? [this.activeTransport] : [];
   }
   // Connector is bound at construction; switching requires a new adapter.
@@ -847,21 +1072,39 @@ var _LedgerAdapter = class _LedgerAdapter {
    * The next operation will re-discover and re-connect automatically.
    */
   resetState() {
+    void this._resetStateAndDisconnectSessions();
+  }
+  _resetStateAndDisconnectSessions() {
+    if (this._resetPromise) return this._resetPromise;
+    const sessionIds = new Set(this._sessions.values());
+    this._stateGeneration += 1;
+    this._finishBleBinding("cancelled");
+    this._operations.endAll("runtime-reset");
+    this._doConnectAbortController?.abort();
     this._discoveredDevices.clear();
     this._sessions.clear();
+    this._verifiedBleReconnectTargets.clear();
     this._connectingPromise = null;
+    this._doConnectAbortController = null;
     this._uiRegistry.reset();
     this._jobQueue.clear();
     this._btcHighIndexConfirmedThisSession = false;
+    const resetPromise = this._runConnectorTeardown(async () => {
+      for (const sessionId of sessionIds) {
+        await this.connector.disconnect(sessionId).catch(() => void 0);
+      }
+    });
+    this._resetPromise = resetPromise;
+    return resetPromise.finally(() => {
+      if (this._resetPromise === resetPromise) {
+        this._resetPromise = null;
+      }
+    });
   }
   async dispose() {
-    this._uiRegistry.reset();
-    this._jobQueue.clear();
+    await this._resetStateAndDisconnectSessions();
     this.unregisterEventListeners();
     this.connector.reset();
-    this._discoveredDevices.clear();
-    this._sessions.clear();
-    this._btcHighIndexConfirmedThisSession = false;
     this.emitter.removeAllListeners();
   }
   uiResponse(response) {
@@ -871,17 +1114,32 @@ var _LedgerAdapter = class _LedgerAdapter {
   // Device management
   // ---------------------------------------------------------------------------
   async searchDevices(options) {
+    return this._searchDevices(options);
+  }
+  async _searchDevices(options, signal) {
     debugLog("[LedgerAdapter][REQ]", { method: "searchDevices", params: options });
     try {
       if (options?.resetSession) {
-        this._doConnectAbortController?.abort();
-        this._sessions.clear();
-        this._connectingPromise = null;
-        this._doConnectAbortController = null;
-        this._btcHighIndexConfirmedThisSession = false;
+        await this._resetStateAndDisconnectSessions();
+      } else {
+        await this._connectorTeardownTail;
+      }
+      await this._ensureDevicePermission(void 0, void 0, signal);
+      if (signal) _LedgerAdapter._throwIfAborted(signal);
+      const stateGeneration = this._stateGeneration;
+      const devices = await this.connector.searchDevices(
+        options?.transportType ? {
+          transportType: options.transportType,
+          waitForAll: options.waitForAllTransports
+        } : void 0
+      );
+      if (signal) _LedgerAdapter._throwIfAborted(signal);
+      if (stateGeneration !== this._stateGeneration) {
+        throw createHwkError({
+          code: HardwareErrorCode3.UserAborted,
+          message: "Ledger discovery was reset"
+        });
       }
-      await this._ensureDevicePermission();
-      const devices = await this.connector.searchDevices();
       this._discoveredDevices.clear();
       for (const d of devices) {
         if (d.connectId) {
@@ -889,7 +1147,7 @@ var _LedgerAdapter = class _LedgerAdapter {
         }
       }
       if (this._discoveredDevices.size === 0) {
-        await this._ensureDevicePermission();
+        await this._ensureDevicePermission(void 0, void 0, signal);
       }
       const result = Array.from(this._discoveredDevices.values());
       debugLog("[LedgerAdapter][RES]", {
@@ -908,41 +1166,287 @@ var _LedgerAdapter = class _LedgerAdapter {
       throw err;
     }
   }
+  async searchDeviceTargets(options) {
+    const devices = await this.searchDevices(options);
+    return devices.map((device) => ({
+      searchTargetId: device.connectId,
+      searchTargetReusePolicy: resolveSearchTargetReusePolicy(device),
+      vendor: "ledger",
+      connectionType: device.connectionType,
+      kind: "physical",
+      label: device.label,
+      model: device.model,
+      modelName: device.modelName,
+      serialNumber: device.serialNumber
+    }));
+  }
+  async listConnectionTargets(options) {
+    const targets = await this.searchDeviceTargets(options);
+    return targets.map(({ searchTargetId, ...target }) => ({
+      ...target,
+      targetId: searchTargetId
+    }));
+  }
   // USB single-session invariant: evict all sessions, best-effort (see connectDevice).
-  async _evictAllSessions() {
+  async _evictAllSessions(preserveOperationId) {
+    this._operations.endAll("explicit", preserveOperationId);
     if (this._sessions.size === 0) return;
     const stale = [...this._sessions.values()];
     this._sessions.clear();
-    for (const sid of stale) {
-      try {
-        await this.connector.disconnect(sid);
-      } catch {
+    await this._runConnectorTeardown(async () => {
+      for (const sid of stale) {
+        try {
+          await this.connector.disconnect(sid);
+        } catch {
+        }
       }
-    }
+    });
   }
   static _createDeviceBusyError(method) {
     return Object.assign(new Error(`Ledger device is busy while calling ${method}`), {
       code: HardwareErrorCode3.DeviceBusy
     });
   }
-  async connectDevice(connectId) {
+  async connectDevice(searchTargetId) {
+    try {
+      return await this._jobQueue.enqueue(
+        searchTargetId || "__ledger_connect__",
+        async () => {
+          const connected = await this._connectTarget(searchTargetId);
+          if (!connected.success) return connected;
+          return this._createOperation(searchTargetId, connected.payload);
+        },
+        {
+          label: "connectDevice",
+          rejectIfBusy: true,
+          busyError: _LedgerAdapter._createDeviceBusyError("connectDevice")
+        }
+      );
+    } catch (error) {
+      return this.errorToFailure(error);
+    }
+  }
+  async bindBleDevice(params) {
+    if (params.identity.vendor !== "ledger" || !params.identity.value) {
+      return failure2(HardwareErrorCode3.InvalidParams, "Ledger wallet identity is required");
+    }
+    const { chain, value: expectedFingerprint } = params.identity;
+    try {
+      return await this._jobQueue.enqueue(
+        expectedFingerprint,
+        async (signal) => {
+          if (!this.getAvailableTransports().includes("ble")) {
+            throw createHwkError({
+              code: HardwareErrorCode3.TransportNotAvailable,
+              message: "Ledger Bluetooth transport is not available"
+            });
+          }
+          this._activeConnectionType = "ble";
+          await this._ensureDevicePermission(void 0, void 0, signal);
+          const attempt = {
+            extra: params.extra,
+            bindingReason: "manual-rebind"
+          };
+          try {
+            for (; ; ) {
+              const connectId = await this._connectFirstOrSelect(
+                [],
+                void 0,
+                true,
+                void 0,
+                attempt,
+                signal
+              );
+              const sessionId = this._sessions.get(connectId);
+              if (!sessionId) {
+                throw createHwkError({
+                  code: HardwareErrorCode3.DeviceDisconnected,
+                  message: "Selected Ledger connection ended"
+                });
+              }
+              let saved = false;
+              try {
+                const installContext = {
+                  connection: { connectId, sessionId }
+                };
+                const fingerprint = await this._computeChainFingerprint(
+                  chain,
+                  (method, callParams) => this._runConnectorCall(
+                    connectId,
+                    method,
+                    callParams,
+                    signal,
+                    void 0,
+                    void 0,
+                    { autoInstallApp: true },
+                    installContext
+                  )
+                );
+                if (fingerprint !== expectedFingerprint) {
+                  attempt.rejectedConnectIds ?? (attempt.rejectedConnectIds = /* @__PURE__ */ new Set());
+                  attempt.rejectedConnectIds.add(connectId);
+                  attempt.rejectedConnectId = connectId;
+                } else {
+                  const persisted = await this._publishVerifiedBleBinding(
+                    connectId,
+                    chain,
+                    fingerprint,
+                    attempt,
+                    void 0,
+                    signal
+                  );
+                  if (!persisted) {
+                    throw createHwkError({
+                      code: HardwareErrorCode3.UnknownError,
+                      message: "Bluetooth binding could not be saved",
+                      origin: "host"
+                    });
+                  }
+                  saved = true;
+                  return success(connectId);
+                }
+              } finally {
+                if (!saved && this._sessions.get(connectId) === sessionId) {
+                  this._sessions.delete(connectId);
+                  const teardown = this._runConnectorTeardown(
+                    () => this.connector.disconnect(sessionId)
+                  ).catch(() => void 0);
+                  if (!signal.aborted) await teardown;
+                }
+              }
+            }
+          } catch (error) {
+            this._finishBleBinding(signal.aborted ? "cancelled" : "failed");
+            throw error;
+          }
+        },
+        {
+          label: "bindBleDevice",
+          rejectIfBusy: true,
+          busyError: _LedgerAdapter._createDeviceBusyError("bindBleDevice")
+        }
+      );
+    } catch (error) {
+      return this.errorToFailure(error);
+    }
+  }
+  async acquireOperation(connectId, context) {
+    try {
+      return await this._jobQueue.enqueue(
+        connectId || "__ledger_acquire__",
+        async (signal) => {
+          const transport = this._isBleConnection() ? "ble" : "usb";
+          const hint = context.knownConnections?.find(
+            (connection) => connection.transport === transport
+          );
+          const target = hint && hint.transport !== "qr" ? hint.connectId : connectId;
+          await this._ensureDevicePermission(target, void 0, signal);
+          const attempt = {
+            ...context,
+            extra: context.extra ? { ...context.extra } : void 0
+          };
+          try {
+            const resolvedConnectId = await this.ensureConnected(
+              target,
+              signal,
+              true,
+              void 0,
+              attempt
+            );
+            _LedgerAdapter._throwIfAborted(signal);
+            const result = this._createOperation(connectId, resolvedConnectId);
+            if (result.success && attempt.selectedConnection) {
+              this._pendingOperationBindings.set(result.payload, attempt);
+            }
+            return result;
+          } catch (error) {
+            this._finishBleBinding(signal.aborted ? "cancelled" : "failed");
+            throw error;
+          }
+        },
+        {
+          label: "acquireOperation",
+          rejectIfBusy: true,
+          busyError: _LedgerAdapter._createDeviceBusyError("acquireOperation")
+        }
+      );
+    } catch (error) {
+      return this.errorToFailure(error);
+    }
+  }
+  _createOperation(searchTargetId, resolvedConnectId) {
+    this._operations.endByConnectionKey(resolvedConnectId, "explicit");
+    const sessionId = this._sessions.get(resolvedConnectId);
+    if (sessionId) this._operations.endByConnectionKey(sessionId, "explicit");
+    const connectionType = this._isBleConnection() ? "ble" : "usb";
+    const device = this._discoveredDevices.get(resolvedConnectId) ?? {
+      vendor: "ledger",
+      model: "unknown",
+      firmwareVersion: "",
+      deviceId: "",
+      connectId: resolvedConnectId,
+      connectionType
+    };
+    const operation = this._operations.create({
+      searchTargetId,
+      connectId: resolvedConnectId,
+      device,
+      connectionType,
+      connectionKeys: [this._sessions.get(resolvedConnectId) ?? ""]
+    });
+    return success(operation.operationId);
+  }
+  async _connectTarget(connectId, preserveOperationId, signal) {
     debugLog("[LedgerAdapter][REQ]", { method: "connectDevice", connectId, params: { connectId } });
     try {
-      if (isLedgerBleConnectionType(this.connector.connectionType) && !connectId) {
+      this._assertConnectorReady("connectDevice");
+      const discoveredType = this._discoveredDevices.get(connectId)?.connectionType;
+      if (discoveredType === "usb" || discoveredType === "ble") {
+        this._activeConnectionType = discoveredType;
+      }
+      if (this._isBleConnection() && !connectId) {
         throw Object.assign(new Error("Ledger BLE connectId is required."), {
           code: HardwareErrorCode3.DeviceNotFound
         });
       }
-      if (!isLedgerBleConnectionType(this.connector.connectionType)) {
-        await this._evictAllSessions();
+      await this._ensureDevicePermission(connectId, void 0, signal);
+      if (signal) _LedgerAdapter._throwIfAborted(signal);
+      if (this.connector.availableTransports && this.connector.availableTransports.length > 1) {
+        await this._evictAllSessions(preserveOperationId);
+      } else if (this._isBleConnection()) {
+        const previousSessionId = this._sessions.get(connectId);
+        this._operations.endByConnectionKey(connectId, "explicit", preserveOperationId);
+        if (previousSessionId) {
+          this._operations.endByConnectionKey(previousSessionId, "explicit", preserveOperationId);
+          this._sessions.delete(connectId);
+          await this.connector.disconnect(previousSessionId).catch(() => void 0);
+        }
+      } else {
+        await this._evictAllSessions(preserveOperationId);
+      }
+      if (signal) _LedgerAdapter._throwIfAborted(signal);
+      const stateGeneration = this._stateGeneration;
+      const releaseOperation = this._retainConnectorOperation(`connect:${connectId}`);
+      let session;
+      try {
+        session = this.connector.availableTransports?.length ? await this.connector.connect(connectId, {
+          transportType: this._activeConnectionType ?? "usb"
+        }) : await this.connector.connect(connectId);
+        if (signal?.aborted || stateGeneration !== this._stateGeneration) {
+          await this.connector.disconnect(session.sessionId).catch(() => void 0);
+          throw Object.assign(new Error("Ledger connection aborted"), {
+            code: HardwareErrorCode3.UserAborted
+          });
+        }
+      } finally {
+        releaseOperation();
       }
-      await this._ensureDevicePermission(connectId);
-      const session = await this.connector.connect(connectId);
-      this._sessions.set(connectId, session.sessionId);
+      const resolvedConnectId = session.deviceInfo?.connectId || connectId;
+      this._sessions.set(resolvedConnectId, session.sessionId);
       if (session.deviceInfo) {
-        this._discoveredDevices.set(connectId, session.deviceInfo);
+        this._discoveredDevices.set(resolvedConnectId, session.deviceInfo);
       }
-      const result = success(connectId);
+      const result = success(resolvedConnectId);
       debugLog("[LedgerAdapter][RES]", { method: "connectDevice", success: true, payload: result });
       return result;
     } catch (err) {
@@ -955,30 +1459,60 @@ var _LedgerAdapter = class _LedgerAdapter {
       return failureResult;
     }
   }
-  async disconnectDevice(connectId) {
+  async releaseOperation(operationId) {
+    const operation = this._operations.find(operationId);
+    if (!operation) {
+      this._operations.resolve(operationId);
+      return;
+    }
+    const endedOperation = this._operations.end(operationId, "explicit");
+    if (!endedOperation) return;
+    const { connectId } = operation;
     debugLog("[LedgerAdapter][REQ]", {
-      method: "disconnectDevice",
+      method: "releaseOperation",
       connectId,
       params: { connectId }
     });
     try {
-      const sessionId = this._sessions.get(connectId);
-      if (sessionId) {
-        await this.connector.disconnect(sessionId);
-        this._sessions.delete(connectId);
-      }
-      debugLog("[LedgerAdapter][RES]", { method: "disconnectDevice", success: true });
+      await this._releaseOperationConnection(endedOperation);
+      debugLog("[LedgerAdapter][RES]", { method: "releaseOperation", success: true });
     } catch (err) {
       const e = err;
       debugLog("[LedgerAdapter][RES]", {
-        method: "disconnectDevice",
+        method: "releaseOperation",
         success: false,
         error: { message: e?.message, _tag: e?._tag, code: e?.code ?? e?.errorCode }
       });
       throw err;
     }
   }
-  async getDeviceInfo(connectId, deviceId) {
+  async _releaseOperationConnection(operation) {
+    const sessionIds = /* @__PURE__ */ new Set();
+    for (const [connectId, sessionId] of this._sessions) {
+      if (connectId === operation.connectId || operation.connectionKeys.includes(connectId) || operation.connectionKeys.includes(sessionId)) {
+        this._sessions.delete(connectId);
+        sessionIds.add(sessionId);
+      }
+    }
+    for (const sessionId of sessionIds) {
+      await this._runConnectorTeardown(
+        () => this.connector.disconnect(sessionId).catch(() => void 0)
+      );
+    }
+  }
+  async _releaseLostOperationConnection(operationId) {
+    const endedOperation = this._operations.end(operationId, "disconnect");
+    if (!endedOperation) return;
+    this._discoveredDevices.delete(endedOperation.connectId);
+    await this._releaseOperationConnection(endedOperation);
+  }
+  async getDeviceInfo(connectIdOrOperationId, deviceId) {
+    let connectId;
+    try {
+      connectId = isHardwareOperationId(connectIdOrOperationId) ? this._operations.resolve(connectIdOrOperationId).connectId : connectIdOrOperationId;
+    } catch (error) {
+      return this.errorToFailure(error);
+    }
     debugLog("[LedgerAdapter][REQ]", {
       method: "getDeviceInfo",
       connectId,
@@ -1016,9 +1550,6 @@ var _LedgerAdapter = class _LedgerAdapter {
       throw err;
     }
   }
-  getSupportedChains() {
-    return ["evm", "btc", "sol", "tron"];
-  }
   // ---------------------------------------------------------------------------
   // Chain call helper
   // ---------------------------------------------------------------------------
@@ -1053,13 +1584,21 @@ var _LedgerAdapter = class _LedgerAdapter {
     if (params && typeof params === "object") {
       const {
         autoInstallApp,
+        operationId,
         passphraseState: _passphraseState,
         useEmptyPassphrase: _useEmptyPassphrase,
+        knownConnections,
+        extra,
+        allowDeviceSelection,
         ...rest
       } = params;
       return {
         commonParams: {
-          autoInstallApp: typeof autoInstallApp === "boolean" ? autoInstallApp : void 0
+          autoInstallApp: typeof autoInstallApp === "boolean" ? autoInstallApp : void 0,
+          operationId: typeof operationId === "string" ? operationId : void 0,
+          knownConnections,
+          extra,
+          allowDeviceSelection: typeof allowDeviceSelection === "boolean" ? allowDeviceSelection : void 0
         },
         rest
       };
@@ -1235,6 +1774,27 @@ var _LedgerAdapter = class _LedgerAdapter {
     );
   }
   // ---------------------------------------------------------------------------
+  // Zcash chain methods (viewing key + shielded address reads; Zcash app >= 3.8.0)
+  // ---------------------------------------------------------------------------
+  zcashGetFullViewingKey(connectId, deviceId, params) {
+    return this.callChainWithMergedParams(
+      connectId,
+      deviceId,
+      "zcash",
+      "zcashGetFullViewingKey",
+      params
+    );
+  }
+  zcashGetShieldedAddress(connectId, deviceId, params) {
+    return this.callChainWithMergedParams(
+      connectId,
+      deviceId,
+      "zcash",
+      "zcashGetShieldedAddress",
+      params
+    );
+  }
+  // ---------------------------------------------------------------------------
   // App management — OS-level Ledger app install / list. Bypasses fingerprint
   // and chain-handler dispatch; installApp progress is forwarded to the adapter
   // emitter via 'ui-event' AppInstallProgress events.
@@ -1323,7 +1883,7 @@ var _LedgerAdapter = class _LedgerAdapter {
           );
         }
         await this.connector.configure({ ledgerGenuineCheckWebSocketUrl: relayUrl });
-        this.resetState();
+        await this._resetStateAndDisconnectSessions();
       }
       const result = await this.connectorCall(connectId, "getDeviceGenuineCheck", {});
       if (!result.isGenuine) {
@@ -1349,10 +1909,10 @@ var _LedgerAdapter = class _LedgerAdapter {
       if (relayUrl) {
         try {
           await this.connector.configure?.({ ledgerGenuineCheckWebSocketUrl: void 0 });
-          this.resetState();
+          await this._resetStateAndDisconnectSessions();
         } catch {
           this.connector.reset();
-          this.resetState();
+          await this._resetStateAndDisconnectSessions();
         }
       }
     }
@@ -1364,6 +1924,20 @@ var _LedgerAdapter = class _LedgerAdapter {
     this.emitter.off(event, listener);
   }
   cancel(connectId) {
+    const namedOperationIsLive = (id) => {
+      try {
+        this._operations.resolve(id);
+        return true;
+      } catch {
+        return false;
+      }
+    };
+    if (isHardwareOperationId(connectId) && !namedOperationIsLive(connectId)) {
+      debugLog("[LedgerAdapter] cancel target already ended; nothing to cancel", {
+        connectId
+      });
+      return;
+    }
     const userAbortReason = Object.assign(new Error("User aborted operation"), {
       code: HardwareErrorCode3.UserAborted,
       _tag: ERROR_TAG.UserAborted
@@ -1374,14 +1948,50 @@ var _LedgerAdapter = class _LedgerAdapter {
         this._lastCancelReason = void 0;
       }
     }, 2e3);
-    this._uiRegistry.cancel();
-    if (connectId) {
-      this._jobQueue.cancelActiveAndPending(connectId, userAbortReason);
+    const activeJobId = this._jobQueue.getActiveJob()?.deviceId;
+    let operationId;
+    if (isHardwareOperationId(connectId)) {
+      operationId = connectId;
+    } else if (!connectId && isHardwareOperationId(activeJobId)) {
+      operationId = activeJobId;
+    }
+    let resolvedConnectId = connectId;
+    if (operationId) {
+      try {
+        resolvedConnectId = this._operations.resolve(operationId).connectId;
+      } catch {
+        resolvedConnectId = void 0;
+      }
+    }
+    const interactionForPhysicalId = !operationId && connectId ? this._operations.findActiveByConnectionKey(connectId) : void 0;
+    const pendingOperationId = operationId ?? interactionForPhysicalId?.operationId;
+    if (!connectId) {
+      this._uiRegistry.cancel();
+    } else if (pendingOperationId) {
+      this._uiRegistry.cancel(void 0, void 0, pendingOperationId);
+    }
+    this._finishBleBinding("cancelled");
+    if (!connectId) this._pendingOperationBindings.clear();
+    else if (pendingOperationId) {
+      this._pendingOperationBindings.delete(pendingOperationId);
+    }
+    const queueKeys = /* @__PURE__ */ new Set();
+    if (connectId) queueKeys.add(ledgerQueueKey({ connectId }));
+    if (pendingOperationId) queueKeys.add(ledgerQueueKey({ operationId: pendingOperationId }));
+    if (queueKeys.size) {
+      let cancelledAnyJob = false;
+      for (const key of queueKeys) {
+        cancelledAnyJob = this._jobQueue.cancelActiveAndPending(key, userAbortReason) || cancelledAnyJob;
+      }
+      debugLog("[LedgerAdapter] cancel routed to queue keys", {
+        queueKeys: [...queueKeys],
+        cancelledAnyJob
+      });
     } else {
       this._jobQueue.cancelActiveAndPending(void 0, userAbortReason);
     }
-    if (connectId) {
-      const sessionId = this._sessions.get(connectId) ?? connectId;
+    if (resolvedConnectId) {
+      const sessionId = this._sessions.get(resolvedConnectId) ?? resolvedConnectId;
       void this.connector.cancel(sessionId);
     } else {
       for (const sid of this._sessions.values()) void this.connector.cancel(sid);
@@ -1393,44 +2003,102 @@ var _LedgerAdapter = class _LedgerAdapter {
   // ---------------------------------------------------------------------------
   // Chain fingerprint
   // ---------------------------------------------------------------------------
+  /** A non-empty deviceId is an expected chain fingerprint, not a transport identifier. */
   async getChainFingerprint(connectId, deviceId, chain) {
     try {
       const fingerprint = await this._computeChainFingerprint(
         chain,
         (method, params) => this.connectorCall(connectId, method, params, void 0, deviceId)
       );
+      if (deviceId) {
+        if (fingerprint !== deviceId) {
+          return failure2(
+            HardwareErrorCode3.DeviceMismatch,
+            formatDeviceMismatchError(deviceId, fingerprint)
+          );
+        }
+        if (isHardwareOperationId(connectId)) {
+          const operation = this._operations.resolve(connectId);
+          await this._publishVerifiedBleBinding(
+            operation.connectId,
+            chain,
+            fingerprint,
+            void 0,
+            connectId
+          );
+        }
+      }
       return success(fingerprint);
     } catch (err) {
       debugError("[LedgerAdapter] getChainFingerprint error:", chain, err);
       return this.errorToFailure(err);
     }
   }
-  /**
-   * Verify fingerprint using an existing sessionId directly.
-   * Safe to call inside connectorCall without causing queue deadlock.
-   */
-  async _verifyDeviceFingerprintWithSession(sessionId, deviceId, chain) {
-    if (!deviceId) return { success: true };
+  /** Discovery may select a BLE target before a later call verifies its wallet. */
+  async _publishVerifiedBleBinding(connectId, chain, fingerprint, attempt, operationId, signal) {
+    const binding = operationId ? this._pendingOperationBindings.get(operationId) : attempt;
+    if (!this._isBleConnection() || binding?.selectedConnection?.connectId !== connectId) {
+      return false;
+    }
     try {
-      const fingerprint = await this._computeChainFingerprint(
-        chain,
-        (method, params) => this._callConnector(sessionId, method, params)
+      const outcome = await requestSaveDeviceBinding(
+        this.emitter,
+        this._uiRegistry,
+        {
+          selectionRequestId: binding.selectedConnection.requestId,
+          connection: { transport: "ble", connectId },
+          identity: { vendor: "ledger", type: "chainFingerprint", chain, value: fingerprint },
+          extra: binding.extra,
+          operationId
+        },
+        signal
       );
-      if (fingerprint === deviceId) {
-        return { success: true };
+      if (operationId) this._operations.resolve(operationId);
+      if (!outcome.saved) {
+        debugLog("[LedgerAdapter] BLE binding not persisted by host", {
+          connectId,
+          reason: outcome.reason
+        });
       }
-      return { success: false, expected: deviceId, actual: fingerprint };
-    } catch (err) {
-      const mapped = mapLedgerError(err);
-      if (mapped.code === HardwareErrorCode3.WrongApp || mapped.code === HardwareErrorCode3.DeviceLocked) {
-        return { success: true };
+      return outcome.saved;
+    } catch (error) {
+      if (operationId) {
+        this._pendingOperationBindings.delete(operationId);
+        this._operations.end(operationId, "explicit");
       }
-      throw err;
-    }
-  }
-  /**
-   * Compute the chain fingerprint via a caller-supplied call strategy.
-   *
+      const sessionId = this._sessions.get(connectId);
+      this._sessions.delete(connectId);
+      if (sessionId) {
+        const teardown = this._runConnectorTeardown(
+          () => this.connector.disconnect(sessionId)
+        ).catch(() => void 0);
+        if (!signal?.aborted) await teardown;
+      }
+      throw error;
+    } finally {
+      if (this._bindingSelectionRequestId === binding.selectedConnection.requestId) {
+        this._bindingSelectionRequestId = void 0;
+      }
+      if (operationId) {
+        this._pendingOperationBindings.delete(operationId);
+      }
+    }
+  }
+  /** Verify on the acquired session without re-entering the job queue. */
+  async _verifyDeviceFingerprintWithSession(sessionId, deviceId, chain) {
+    if (!deviceId) return { success: true };
+    const fingerprint = await this._computeChainFingerprint(
+      chain,
+      (method, params) => this._callConnector(sessionId, method, params)
+    );
+    if (fingerprint === deviceId) {
+      return { success: true };
+    }
+    return { success: false, expected: deviceId, actual: fingerprint };
+  }
+  /**
+   * Compute the chain fingerprint via a caller-supplied call strategy.
+   *
    * Chains with a native device-side identity primitive (BTC → BIP32 master
    * fingerprint) short-circuit at the top and return it verbatim, so the value
    * stays reusable for higher-level use (BIP380 descriptors, PSBT signing).
@@ -1455,12 +2123,27 @@ var _LedgerAdapter = class _LedgerAdapter {
       address = (await callMethod("solGetAddress", { path, showOnDevice: false })).address;
     } else if (chain === "tron") {
       address = (await callMethod("tronGetAddress", { path, showOnDevice: false })).address;
+    } else if (chain === "zcash") {
+      address = (await callMethod("zcashGetShieldedAddress", { path, showOnDevice: false })).address;
     } else {
       throw new Error(`Unsupported chain for fingerprint: ${chain}`);
     }
     return deriveDeviceFingerprint(address);
   }
   // Ledger WebUSB won't expose a locked device, so we can't auto-detect unlock.
+  /**
+   * The operation the running device job belongs to, so a UI request raised
+   * mid-call can name it. A call pinned to an operation queues under its id
+   * (`ledgerQueueKey`); a call without one queues under the connectId, and the
+   * live operation on that connection is still the owner. Only work with no
+   * operation at all (cold start) comes back undefined.
+   */
+  _activeOperationId() {
+    const activeJobId = this._jobQueue.getActiveJob()?.deviceId;
+    if (!activeJobId) return void 0;
+    if (isHardwareOperationId(activeJobId)) return activeJobId;
+    return this._operations.findActiveByConnectionKey(activeJobId)?.operationId;
+  }
   // The user must press Confirm after unlocking, which triggers a search retry.
   // If `signal` is provided, an abort cancels the pending UI request so the
   // registry slot is released and a stale RECEIVE_DEVICE_CONNECT won't land in
@@ -1469,15 +2152,18 @@ var _LedgerAdapter = class _LedgerAdapter {
     if (signal?.aborted) {
       _LedgerAdapter._throwIfAborted(signal);
     }
+    const operationId = this._activeOperationId();
     const waitPromise = this._uiRegistry.wait(
-      UI_REQUEST.REQUEST_DEVICE_CONNECT
+      UI_REQUEST.REQUEST_DEVICE_CONNECT,
+      { operationId }
     );
     this.emitter.emit(UI_REQUEST.REQUEST_DEVICE_CONNECT, {
       type: UI_REQUEST.REQUEST_DEVICE_CONNECT,
       payload: {
         vendor: "ledger",
         reason: "device-not-found",
-        message: "Please connect and unlock your Ledger device"
+        message: "Please connect and unlock your Ledger device",
+        operationId
       }
     });
     let payload;
@@ -1538,15 +2224,18 @@ var _LedgerAdapter = class _LedgerAdapter {
     return { ...params, showOnDevice: true };
   }
   async _waitForBtcHighIndexConfirm(path, accountIndex) {
+    const operationId = this._activeOperationId();
     const waitPromise = this._uiRegistry.wait(
-      UI_REQUEST.REQUEST_BTC_HIGH_INDEX_CONFIRM
+      UI_REQUEST.REQUEST_BTC_HIGH_INDEX_CONFIRM,
+      { operationId }
     );
     this.emitter.emit(UI_REQUEST.REQUEST_BTC_HIGH_INDEX_CONFIRM, {
       type: UI_REQUEST.REQUEST_BTC_HIGH_INDEX_CONFIRM,
       payload: {
         vendor: "ledger",
         path,
-        accountIndex
+        accountIndex,
+        operationId
       }
     });
     try {
@@ -1563,12 +2252,14 @@ var _LedgerAdapter = class _LedgerAdapter {
   // Ask the user whether to install a missing app (autoInstallApp flow).
   // Same register-then-emit ordering as the BTC high-index gate.
   async _waitForInstallAppConfirm(appName) {
+    const operationId = this._activeOperationId();
     const waitPromise = this._uiRegistry.wait(
-      UI_REQUEST.REQUEST_INSTALL_APP
+      UI_REQUEST.REQUEST_INSTALL_APP,
+      { operationId }
     );
     this.emitter.emit(UI_REQUEST.REQUEST_INSTALL_APP, {
       type: UI_REQUEST.REQUEST_INSTALL_APP,
-      payload: { vendor: "ledger", appName }
+      payload: { vendor: "ledger", appName, operationId }
     });
     try {
       const payload = await waitPromise;
@@ -1584,16 +2275,17 @@ var _LedgerAdapter = class _LedgerAdapter {
   // Layer 1 entry. Caller signal only races the outer awaiter; the shared
   // `_doConnect` runs under its own internal controller so caller A's cancel
   // doesn't kill caller B's await.
-  async ensureConnected(connectId, signal, allowUsbEphemeralFallback = false) {
+  async ensureConnected(connectId, signal, allowUsbEphemeralFallback = false, preserveOperationId, context) {
     if (signal.aborted) _LedgerAdapter._throwIfAborted(signal);
-    if (isLedgerBleConnectionType(this.connector.connectionType) && !connectId) {
+    this._assertConnectorReady("connectDevice");
+    if (this._isBleConnection() && !connectId && !allowUsbEphemeralFallback) {
       throw Object.assign(new Error("Ledger BLE connectId is required."), {
         code: HardwareErrorCode3.DeviceNotFound
       });
     }
     if (connectId && this._sessions.has(connectId)) return connectId;
     if (!connectId && this._sessions.size > 0) {
-      if (!isLedgerBleConnectionType(this.connector.connectionType) && this._sessions.size > 1) {
+      if (!this._isBleConnection() && this._sessions.size > 1) {
         throw Object.assign(
           new Error(
             "Ledger USB session invariant violated: more than one session is active. Please reconnect the device."
@@ -1603,15 +2295,24 @@ var _LedgerAdapter = class _LedgerAdapter {
       }
       return this._sessions.keys().next().value;
     }
-    if (!this._connectingPromise) {
-      this._doConnectAbortController = new AbortController();
-      const innerSignal = this._doConnectAbortController.signal;
+    if (!this._connectingPromise || this._doConnectAbortController?.signal.aborted) {
+      const controller = new AbortController();
+      this._doConnectAbortController = controller;
+      const innerSignal = controller.signal;
       this._connectingPromise = (async () => {
         try {
-          return await this._doConnect(innerSignal, connectId, allowUsbEphemeralFallback);
+          return await this._doConnect(
+            innerSignal,
+            connectId,
+            allowUsbEphemeralFallback,
+            preserveOperationId,
+            context
+          );
         } finally {
-          this._connectingPromise = null;
-          this._doConnectAbortController = null;
+          if (this._doConnectAbortController === controller) {
+            this._connectingPromise = null;
+            this._doConnectAbortController = null;
+          }
         }
       })();
     }
@@ -1620,22 +2321,51 @@ var _LedgerAdapter = class _LedgerAdapter {
   // Layer 1 main loop — the ONLY place in SDK that emits unlock dialog.
   // Bounded by MAX_DOCONNECT_CONFIRMS — after N Confirms with no progress,
   // throw DeviceNotFound so the user is kicked out of the loop.
-  async _doConnect(internalSignal, targetConnectId, allowUsbEphemeralFallback = false) {
-    if (isLedgerBleConnectionType(this.connector.connectionType) && targetConnectId) {
-      try {
-        return await this._connectDeviceOrThrow(targetConnectId);
-      } catch (err) {
-        if (!isDeviceLockedError(err) && !isDeviceNotAdvertisingError(err) && !isDeviceDisconnectedError(err)) {
-          throw err;
-        }
-        this._discoveredDevices.delete(targetConnectId);
-        if (isDeviceDisconnectedError(err)) {
-          try {
-            this.connector.reset?.();
-          } catch {
-          }
-        }
+  async _doConnect(internalSignal, targetConnectId, allowUsbEphemeralFallback = false, preserveOperationId, context) {
+    _LedgerAdapter._throwIfAborted(internalSignal);
+    if (this.connector.availableTransports?.includes("usb") && this.connector.availableTransports.includes("ble")) {
+      this._activeConnectionType = "usb";
+      const usbDevices = await this._searchDevices({ transportType: "usb" }, internalSignal);
+      _LedgerAdapter._throwIfAborted(internalSignal);
+      if (usbDevices.length > 0) {
+        const knownUsb = context?.knownConnections?.find(
+          (connection) => connection.transport === "usb"
+        );
+        const usbTarget = knownUsb?.transport === "usb" ? knownUsb.connectId : usbDevices.find((device) => device.connectId === targetConnectId)?.connectId;
+        return this._connectFirstOrSelect(
+          usbDevices,
+          usbTarget,
+          allowUsbEphemeralFallback,
+          preserveOperationId,
+          context,
+          internalSignal
+        );
+      }
+      this._activeConnectionType = "ble";
+      const knownBle = context?.knownConnections?.find(
+        (connection) => connection.transport === "ble"
+      );
+      if (knownBle?.transport === "ble") {
+        return this._connectDeviceOrThrow(knownBle.connectId, preserveOperationId, internalSignal);
+      }
+      if (targetConnectId && context?.knownConnections === void 0) {
+        throw createHwkError({
+          code: HardwareErrorCode3.DeviceNotFound,
+          message: "Ledger connection metadata is required before starting Bluetooth binding"
+        });
       }
+      const bleDevices = await this._searchDevices({ transportType: "ble" }, internalSignal);
+      return this._connectFirstOrSelect(
+        bleDevices,
+        void 0,
+        allowUsbEphemeralFallback,
+        preserveOperationId,
+        context,
+        internalSignal
+      );
+    }
+    if (this._isBleConnection() && targetConnectId) {
+      return this._connectDeviceOrThrow(targetConnectId, preserveOperationId, internalSignal);
     }
     let confirms = 0;
     while (!internalSignal.aborted) {
@@ -1643,22 +2373,28 @@ var _LedgerAdapter = class _LedgerAdapter {
         type: EConnectorInteraction.Searching,
         payload: { sessionId: "" }
       });
-      let devices = await this.searchDevices();
+      let devices = await this._searchDevices(void 0, internalSignal);
+      _LedgerAdapter._throwIfAborted(internalSignal);
       if (devices.length === 0) {
         for (let i = 0; i < 3 && !internalSignal.aborted; i += 1) {
           await new Promise((resolve) => {
             setTimeout(resolve, DEVICE_CONNECT_RETRY_DELAY_MS);
           });
-          devices = await this.searchDevices();
+          _LedgerAdapter._throwIfAborted(internalSignal);
+          devices = await this._searchDevices(void 0, internalSignal);
+          _LedgerAdapter._throwIfAborted(internalSignal);
           if (devices.length > 0) break;
         }
       }
-      if (devices.length > 0) {
+      if (devices.length > 0 || this._isBleConnection() && allowUsbEphemeralFallback) {
         try {
           return await this._connectFirstOrSelect(
             devices,
             targetConnectId,
-            allowUsbEphemeralFallback
+            allowUsbEphemeralFallback,
+            preserveOperationId,
+            context,
+            internalSignal
           );
         } catch (err) {
           if (!isDeviceLockedError(err) && !isDeviceNotAdvertisingError(err) && !isDeviceDisconnectedError(err)) {
@@ -1687,45 +2423,136 @@ var _LedgerAdapter = class _LedgerAdapter {
     _LedgerAdapter._throwIfAborted(internalSignal);
     throw new Error("_doConnect aborted");
   }
-  async _connectFirstOrSelect(devices, targetConnectId, allowUsbEphemeralFallback = false) {
+  async _connectFirstOrSelect(devices, targetConnectId, allowUsbEphemeralFallback, preserveOperationId, context, signal) {
+    _LedgerAdapter._throwIfAborted(signal);
     if (targetConnectId) {
       const target = devices.find(
         (d) => d.connectId === targetConnectId || d.deviceId === targetConnectId
       );
       if (target) {
-        return this._connectDeviceOrThrow(target.connectId);
+        return this._connectDeviceOrThrow(target.connectId, preserveOperationId, signal);
       }
-      if (!isLedgerBleConnectionType(this.connector.connectionType) && devices.length === 1 && allowUsbEphemeralFallback) {
+      if (!this._isBleConnection() && devices.length === 1 && allowUsbEphemeralFallback) {
         debugLog(
           `[LedgerAdapter] target ${targetConnectId} not in fresh enumeration; accepting sole USB device ${devices[0].connectId} for fingerprint-verified recovery`
         );
-        return this._connectDeviceOrThrow(devices[0].connectId);
+        return this._connectDeviceOrThrow(devices[0].connectId, preserveOperationId, signal);
       }
-      const err = Object.assign(new Error(`Target Ledger unavailable: ${targetConnectId}`), {
-        code: HardwareErrorCode3.DeviceNotFound
-      });
-      if (isLedgerBleConnectionType(this.connector.connectionType)) {
-        err._tag = ERROR_TAG.DeviceNotAdvertising;
+      if (!this._isBleConnection() || !allowUsbEphemeralFallback) {
+        const err = Object.assign(new Error(`Target Ledger unavailable: ${targetConnectId}`), {
+          code: HardwareErrorCode3.DeviceNotFound
+        });
+        if (this._isBleConnection()) {
+          err._tag = ERROR_TAG.DeviceNotAdvertising;
+        }
+        throw err;
       }
-      throw err;
     }
-    if (isLedgerBleConnectionType(this.connector.connectionType)) {
+    const requiresBleSelection = this._isBleConnection();
+    if (requiresBleSelection && !allowUsbEphemeralFallback) {
       throw Object.assign(new Error("Ledger BLE connectId is required."), {
         code: HardwareErrorCode3.DeviceNotFound
       });
     }
-    if (devices.length > 1) {
-      throw createMultipleUsbLedgerDevicesError();
+    if (requiresBleSelection && context?.allowDeviceSelection !== false) {
+      const bindingSessionId = context?.bindingSessionId ?? this._uiRegistry.createRequestId();
+      if (context) context.bindingSessionId = bindingSessionId;
+      const allowUsbFallback = context?.bindingReason !== "manual-rebind" && Boolean(this.connector.availableTransports?.includes("usb"));
+      const knownUsb = context?.knownConnections?.find(
+        (connection) => connection.transport === "usb"
+      );
+      const usbConnectId = knownUsb?.transport === "usb" ? knownUsb.connectId : targetConnectId;
+      const { device, requestId } = await requestBleDeviceSelection({
+        emitter: this.emitter,
+        registry: this._uiRegistry,
+        signal,
+        allowUsbFallback,
+        scan: async () => {
+          if (allowUsbFallback) {
+            const usbDevices = await this._searchDevices({ transportType: "usb" }, signal);
+            const candidate = usbDevices.find(
+              (device2) => device2.connectionType === "usb" && device2.connectId === usbConnectId
+            ) ?? (usbDevices.length === 1 && usbDevices[0].connectionType === "usb" ? usbDevices[0] : void 0);
+            if (candidate) return [candidate];
+          }
+          return (await this._searchDevices({ transportType: "ble", waitForAllTransports: true }, signal)).filter((device2) => !context?.rejectedConnectIds?.has(device2.connectId));
+        },
+        request: {
+          devices: devices.filter((device2) => !context?.rejectedConnectIds?.has(device2.connectId)),
+          bindingSessionId,
+          rejectedConnectId: context?.rejectedConnectId,
+          context: {
+            kind: "bind-connection",
+            transport: "ble",
+            reason: context?.bindingReason ?? (targetConnectId ? "known-connection-unavailable" : "missing-binding")
+          },
+          extra: context?.extra,
+          operationId: preserveOperationId
+        }
+      });
+      if (device.connectionType === "usb") {
+        this._activeConnectionType = "usb";
+        if (context) context.selectedConnection = void 0;
+        if (preserveOperationId) this._pendingOperationBindings.delete(preserveOperationId);
+        this._bindingSelectionRequestId = void 0;
+        this.emitter.emit(UI_REQUEST.DEVICE_BINDING_STATUS, {
+          type: UI_REQUEST.DEVICE_BINDING_STATUS,
+          payload: { selectionRequestId: requestId, status: "cancelled" }
+        });
+        return this._connectDeviceOrThrow(device.connectId, preserveOperationId, signal);
+      }
+      if (context) context.selectedConnection = { connectId: device.connectId, requestId };
+      this._bindingSelectionRequestId = requestId;
+      return this._connectDeviceOrThrow(device.connectId, preserveOperationId, signal);
+    }
+    if (devices.length > 0 && (devices.length > 1 || requiresBleSelection)) {
+      if (context?.allowDeviceSelection === false || !this.emitter.listenerCount(UI_REQUEST.REQUEST_SELECT_DEVICE)) {
+        throw createHwkError({
+          code: HardwareErrorCode3.DeviceNotFound,
+          message: "Select a Ledger device before continuing"
+        });
+      }
+      const requestId = this._uiRegistry.createRequestId();
+      const operationId = this._activeOperationId();
+      const waitPromise = this._uiRegistry.wait(
+        UI_REQUEST.REQUEST_SELECT_DEVICE,
+        { requestId, operationId }
+      );
+      this.emitter.emit(UI_REQUEST.REQUEST_SELECT_DEVICE, {
+        type: UI_REQUEST.REQUEST_SELECT_DEVICE,
+        payload: {
+          devices,
+          requestId,
+          operationId,
+          context: requiresBleSelection ? {
+            kind: "bind-connection",
+            transport: "ble",
+            reason: targetConnectId ? "known-connection-unavailable" : "missing-binding"
+          } : { kind: "select-device", transport: "usb", reason: "multiple-candidates" },
+          extra: context?.extra
+        }
+      });
+      const { sdkConnectId } = await (signal ? this._abortable(signal, waitPromise) : waitPromise);
+      if (signal) _LedgerAdapter._throwIfAborted(signal);
+      const selected = devices.find((device) => device.connectId === sdkConnectId);
+      if (!selected) {
+        throw Object.assign(new Error("Selected Ledger is no longer available"), {
+          code: HardwareErrorCode3.DeviceNotFound
+        });
+      }
+      if (context && requiresBleSelection)
+        context.selectedConnection = { connectId: selected.connectId, requestId };
+      return this._connectDeviceOrThrow(selected.connectId, preserveOperationId, signal);
     }
     if (devices.length !== 1) {
       throw Object.assign(new Error("Ledger device not found."), {
         code: HardwareErrorCode3.DeviceNotFound
       });
     }
-    return this._connectDeviceOrThrow(devices[0].connectId);
+    return this._connectDeviceOrThrow(devices[0].connectId, preserveOperationId, signal);
   }
-  async _connectDeviceOrThrow(chosenConnectId) {
-    const result = await this.connectDevice(chosenConnectId);
+  async _connectDeviceOrThrow(chosenConnectId, preserveOperationId, signal) {
+    const result = await this._connectTarget(chosenConnectId, preserveOperationId, signal);
     if (!result.success) {
       const payload = result.payload;
       const rethrow = Object.assign(new Error(payload.error), {
@@ -1736,7 +2563,7 @@ var _LedgerAdapter = class _LedgerAdapter {
       }
       throw rethrow;
     }
-    return chosenConnectId;
+    return result.payload;
   }
   /**
    * Call the connector with automatic session resolution and disconnect retry.
@@ -1766,26 +2593,122 @@ var _LedgerAdapter = class _LedgerAdapter {
    * lives in one place.
    */
   async _callConnector(sessionId, method, params, signal) {
-    const promise = this.connector.call(sessionId, method, params);
+    this._assertConnectorReady(method);
+    if (signal?.aborted) throw this._abortReason(signal);
+    const releaseOperation = this._retainConnectorOperation(`call:${sessionId}`);
+    let promise;
+    try {
+      promise = this.connector.call(sessionId, method, params).finally(releaseOperation);
+    } catch (error) {
+      releaseOperation();
+      throw error;
+    }
     const result = signal ? await this._abortable(signal, promise) : await promise;
     return this._unwrapConnectorResult(result);
   }
+  _assertConnectorReady(method) {
+    if (this._resetPromise || this._pendingConnectorTeardowns > 0 || this._unsettledConnectorOperations.size > 0) {
+      throw _LedgerAdapter._createDeviceBusyError(method);
+    }
+  }
+  _runConnectorTeardown(task) {
+    const previous = this._connectorTeardownTail;
+    let releaseTail = () => void 0;
+    this._connectorTeardownTail = new Promise((resolve) => {
+      releaseTail = resolve;
+    });
+    this._pendingConnectorTeardowns += 1;
+    return (async () => {
+      try {
+        await previous;
+        await this._waitForConnectorOperationsToDrain();
+        await task();
+      } finally {
+        this._pendingConnectorTeardowns -= 1;
+        releaseTail();
+      }
+    })();
+  }
+  _waitForConnectorOperationsToDrain() {
+    if (this._unsettledConnectorOperations.size === 0) {
+      return Promise.resolve();
+    }
+    return new Promise((resolve) => {
+      this._connectorIdleWaiters.add(resolve);
+    });
+  }
+  _retainConnectorOperation(key) {
+    this._unsettledConnectorOperations.set(
+      key,
+      (this._unsettledConnectorOperations.get(key) ?? 0) + 1
+    );
+    let released = false;
+    return () => {
+      if (released) return;
+      released = true;
+      const remaining = (this._unsettledConnectorOperations.get(key) ?? 1) - 1;
+      if (remaining > 0) {
+        this._unsettledConnectorOperations.set(key, remaining);
+      } else {
+        this._unsettledConnectorOperations.delete(key);
+      }
+      if (this._unsettledConnectorOperations.size === 0) {
+        for (const resolve of this._connectorIdleWaiters) resolve();
+        this._connectorIdleWaiters.clear();
+      }
+    };
+  }
   async connectorCall(connectId, method, params, fingerprint, permissionDeviceId, commonParams, installContext) {
-    debugLog("[LedgerAdapter][REQ]", { method, connectId: connectId || "(empty)", params });
-    const queueKey = connectId || "__ledger_default__";
+    const positionalOperationId = isHardwareOperationId(connectId) ? connectId : void 0;
+    if (positionalOperationId && commonParams?.operationId && positionalOperationId !== commonParams.operationId) {
+      throw createHwkError({
+        code: HardwareErrorCode3.InvalidParams,
+        message: "Conflicting Ledger operation ids",
+        params: {
+          positionalOperationId,
+          commonOperationId: commonParams.operationId
+        }
+      });
+    }
+    const operationId = commonParams?.operationId ?? positionalOperationId;
+    const operation = operationId ? this._operations.resolve(operationId) : void 0;
+    const releaseOperationRetention = operationId ? this._operations.retain(operationId) : void 0;
+    const effectiveConnectId = operation?.connectId ?? connectId;
+    debugLog("[LedgerAdapter][REQ]", {
+      method,
+      connectId: effectiveConnectId || "(empty)",
+      params
+    });
+    const queueKey = ledgerQueueKey({ operationId, connectId: effectiveConnectId });
     try {
       const result = await this._jobQueue.enqueue(
         queueKey,
-        async (signal) => this._runConnectorCall(
-          connectId,
-          method,
-          params,
-          signal,
-          fingerprint,
-          permissionDeviceId,
-          commonParams,
-          installContext
-        ),
+        async (signal) => {
+          if (operationId) this._activeOperationJobs.add(operationId);
+          try {
+            return await this._runConnectorCall(
+              effectiveConnectId,
+              method,
+              params,
+              signal,
+              fingerprint,
+              permissionDeviceId,
+              commonParams,
+              installContext ?? {},
+              operationId
+            );
+          } catch (error) {
+            this._finishBleBinding(signal.aborted ? "cancelled" : "failed");
+            throw error;
+          } finally {
+            if (operationId) {
+              this._activeOperationJobs.delete(operationId);
+              if (this._pendingOperationDisconnects.delete(operationId)) {
+                await this._releaseLostOperationConnection(operationId);
+              }
+            }
+          }
+        },
         {
           label: method,
           rejectIfBusy: true,
@@ -1806,15 +2729,22 @@ var _LedgerAdapter = class _LedgerAdapter {
         }
       });
       throw err;
+    } finally {
+      releaseOperationRetention?.();
     }
   }
   /**
    * Race a promise against an abort signal. On abort, rejects with
    * signal.reason → instance _lastCancelReason → generic Error('Aborted').
    */
+  /** Hermes/RN polyfills don't always populate signal.reason; fall back. */
+  _abortReason(signal) {
+    return signal.reason ?? this._lastCancelReason ?? new Error("Aborted");
+  }
   _abortable(signal, promise) {
-    const getAbortReason = () => signal.reason ?? this._lastCancelReason ?? new Error("Aborted");
+    const getAbortReason = () => this._abortReason(signal);
     if (signal.aborted) {
+      void promise.catch(() => void 0);
       return Promise.reject(getAbortReason());
     }
     return new Promise((resolve, reject) => {
@@ -1841,13 +2771,15 @@ var _LedgerAdapter = class _LedgerAdapter {
     }
   }
   /** Actual work done under the job queue — connection, fingerprint, call, and recovery. */
-  async _runConnectorCall(connectId, method, params, signal, fingerprint, permissionDeviceId, commonParams, installContext) {
+  async _runConnectorCall(connectId, method, params, signal, fingerprint, permissionDeviceId, commonParams, installContext, operationId, lockedRetryBudget = _LedgerAdapter.MAX_BUSINESS_RETRY_BUDGET) {
     _LedgerAdapter._throwIfAborted(signal);
-    await this._ensureDevicePermission(
-      connectId,
-      permissionDeviceId ?? fingerprint?.deviceId,
-      signal
-    );
+    if (!operationId) {
+      await this._ensureDevicePermission(
+        connectId,
+        permissionDeviceId ?? fingerprint?.deviceId,
+        signal
+      );
+    }
     _LedgerAdapter._throwIfAborted(signal);
     let effectiveParams = params;
     if (method === "btcGetPublicKey") {
@@ -1861,36 +2793,135 @@ var _LedgerAdapter = class _LedgerAdapter {
       effectiveParams = gatedParams;
     }
     const allowUsbEphemeralFallback = !!fingerprint?.deviceId && !fingerprint.skipFingerprint;
-    const resolvedConnectId = await this.ensureConnected(
-      connectId,
+    let businessCallStarted = false;
+    const verifiedBleTarget = connectId ? this._verifiedBleReconnectTargets.get(connectId) : void 0;
+    const knownTransport = this._isBleConnection() ? "ble" : "usb";
+    const hintedConnectId = commonParams?.knownConnections?.find(
+      (connection) => connection.transport === knownTransport
+    );
+    const inputConnectId = hintedConnectId && hintedConnectId.transport !== "qr" ? hintedConnectId.connectId : connectId;
+    const preferredConnectId = fingerprint && !fingerprint.skipFingerprint && verifiedBleTarget?.chain === fingerprint.chain && verifiedBleTarget.fingerprint === fingerprint.deviceId ? verifiedBleTarget.connectId : inputConnectId;
+    const connectionAttempt = { ...commonParams };
+    const bundleConnection = installContext?.connection;
+    if (bundleConnection && this._sessions.get(bundleConnection.connectId) !== bundleConnection.sessionId) {
+      throw createHwkError({
+        code: HardwareErrorCode3.DeviceDisconnected,
+        message: "Ledger all-network connection ended"
+      });
+    }
+    let resolvedConnectId = operationId ? this._operations.resolve(operationId).connectId : bundleConnection?.connectId ?? await this.ensureConnected(
+      preferredConnectId,
       signal,
-      allowUsbEphemeralFallback
+      allowUsbEphemeralFallback,
+      void 0,
+      connectionAttempt
     );
-    const sessionId = this._sessions.get(resolvedConnectId);
+    let sessionId = this._sessions.get(resolvedConnectId);
+    if (sessionId && installContext && !installContext.connection) {
+      installContext.connection = { connectId: resolvedConnectId, sessionId };
+    }
     if (!sessionId) {
+      if (operationId) {
+        this._operations.end(operationId, "disconnect");
+        throw createHwkError({
+          code: HardwareErrorCode3.OperationEnded,
+          message: "Ledger operation connection is no longer active",
+          params: { operationId, reason: "disconnect" }
+        });
+      }
       throw Object.assign(new Error("Auto-connect succeeded but no session found"), {
         _tag: ERROR_TAG.DeviceSessionNotFound
       });
     }
     try {
       if (fingerprint && !fingerprint.skipFingerprint && fingerprint.deviceId) {
-        const fp = await this._abortable(
-          signal,
-          this._verifyDeviceFingerprintWithSession(
-            sessionId,
-            fingerprint.deviceId,
-            fingerprint.chain
-          )
+        for (; ; ) {
+          const fp = await this._abortable(
+            signal,
+            this._verifyDeviceFingerprintWithSession(
+              sessionId,
+              fingerprint.deviceId,
+              fingerprint.chain
+            )
+          );
+          if (fp.success) break;
+          const binding = operationId ? this._pendingOperationBindings.get(operationId) : connectionAttempt;
+          if (!this._isBleConnection() || binding?.selectedConnection?.connectId !== resolvedConnectId) {
+            throw Object.assign(new Error(formatDeviceMismatchError(fp.expected, fp.actual)), {
+              code: HardwareErrorCode3.DeviceMismatch
+            });
+          }
+          binding.rejectedConnectIds ?? (binding.rejectedConnectIds = /* @__PURE__ */ new Set());
+          binding.rejectedConnectIds.add(resolvedConnectId);
+          binding.rejectedConnectId = resolvedConnectId;
+          this._sessions.delete(resolvedConnectId);
+          await this.connector.disconnect(sessionId);
+          if (operationId) this._pendingOperationDisconnects.delete(operationId);
+          _LedgerAdapter._throwIfAborted(signal);
+          resolvedConnectId = await this._connectFirstOrSelect(
+            [],
+            void 0,
+            true,
+            operationId,
+            binding,
+            signal
+          );
+          const selectedSession = this._sessions.get(resolvedConnectId);
+          const selectedDevice = this._discoveredDevices.get(resolvedConnectId);
+          if (!selectedSession || !selectedDevice)
+            throw createHwkError({
+              code: HardwareErrorCode3.DeviceDisconnected,
+              message: "Selected Ledger connection ended"
+            });
+          sessionId = selectedSession;
+          if (operationId)
+            this._operations.rebind(operationId, {
+              connectId: resolvedConnectId,
+              device: selectedDevice,
+              // Same source as `_createOperation`: the selected transport, not
+              // the device snapshot a session connect overwrote.
+              connectionType: this._isBleConnection() ? "ble" : "usb",
+              connectionKeys: [sessionId]
+            });
+          if (installContext)
+            installContext.connection = { connectId: resolvedConnectId, sessionId };
+        }
+        await this._publishVerifiedBleBinding(
+          resolvedConnectId,
+          fingerprint.chain,
+          fingerprint.deviceId,
+          connectionAttempt,
+          operationId,
+          signal
         );
-        if (!fp.success) {
-          throw Object.assign(new Error(formatDeviceMismatchError(fp.expected, fp.actual)), {
-            code: HardwareErrorCode3.DeviceMismatch
+        if (!operationId && connectionAttempt.selectedConnection?.connectId === resolvedConnectId && this._isBleConnection()) {
+          this._verifiedBleReconnectTargets.set(connectId, {
+            connectId: resolvedConnectId,
+            chain: fingerprint.chain,
+            fingerprint: fingerprint.deviceId
           });
         }
       }
+      businessCallStarted = true;
       return await this._callConnector(sessionId, method, effectiveParams, signal);
     } catch (err) {
       if (signal.aborted) throw err;
+      if (isDeviceDisconnectedError(err) || isDeviceNotAdvertisingError(err) || isTimeoutError(err) || isConnectionLevelError(err)) {
+        this._discoveredDevices.delete(resolvedConnectId);
+        if (operationId) await this._releaseLostOperationConnection(operationId);
+        else {
+          this._sessions.delete(resolvedConnectId);
+          await this.connector.disconnect(sessionId).catch(() => void 0);
+        }
+        const ambiguous = businessCallStarted && !canReplayHardwareMethodAfterTransportFailure(method);
+        const interactionParams = operationId ? { operationId, reason: "disconnect" } : void 0;
+        throw createHwkError({
+          code: operationId ? HardwareErrorCode3.OperationEnded : mapLedgerError(err).code,
+          message: "Ledger operation connection was lost; start a new operation",
+          params: ambiguous ? operationMayHaveCompletedParams(method, { operationId }) : interactionParams,
+          recovery: ambiguous ? { scope: "unknown" } : void 0
+        });
+      }
       const errObj = err;
       debugLog("[LedgerAdapter] connectorCall error:", method, {
         message: errObj?.message,
@@ -1902,6 +2933,65 @@ var _LedgerAdapter = class _LedgerAdapter {
         isNotAdvertising: isDeviceNotAdvertisingError(err),
         isStuckApp: isStuckAppStateError(err)
       });
+      if ((isDeviceLockedError(err) || errObj?.code === HardwareErrorCode3.DeviceLocked) && lockedRetryBudget > 0) {
+        await this._waitForDeviceConnect(signal);
+        if (this._sessions.get(resolvedConnectId) !== sessionId) {
+          throw createHwkError({
+            code: operationId ? HardwareErrorCode3.OperationEnded : HardwareErrorCode3.DeviceDisconnected,
+            message: "Ledger connection ended while waiting for unlock"
+          });
+        }
+        return this._runConnectorCall(
+          resolvedConnectId,
+          method,
+          effectiveParams,
+          signal,
+          fingerprint,
+          permissionDeviceId,
+          commonParams,
+          installContext,
+          operationId,
+          lockedRetryBudget - 1
+        );
+      }
+      if (businessCallStarted && isStuckAppStateError(err)) {
+        await this._sleepAbortable(_LedgerAdapter.STUCK_APP_RETRY_DELAY_MS, signal);
+        if (this._sessions.get(resolvedConnectId) !== sessionId) {
+          throw createHwkError({
+            code: operationId ? HardwareErrorCode3.OperationEnded : HardwareErrorCode3.DeviceDisconnected,
+            message: "Ledger connection ended during the app transition"
+          });
+        }
+        try {
+          return await this._callConnector(sessionId, method, effectiveParams, signal);
+        } catch (retryErr) {
+          if (isStuckAppStateError(retryErr)) throw err;
+          if (isDeviceDisconnectedError(retryErr) || isDeviceNotAdvertisingError(retryErr) || isTimeoutError(retryErr) || isConnectionLevelError(retryErr)) {
+            if (operationId) await this._releaseLostOperationConnection(operationId);
+            else {
+              this._sessions.delete(resolvedConnectId);
+              this._discoveredDevices.delete(resolvedConnectId);
+              await this.connector.disconnect(sessionId).catch(() => void 0);
+            }
+            throw createHwkError({
+              code: operationId ? HardwareErrorCode3.OperationEnded : mapLedgerError(retryErr).code,
+              message: `Ledger ${method} may have completed before the connection was lost`,
+              params: !canReplayHardwareMethodAfterTransportFailure(method) ? operationMayHaveCompletedParams(method, {
+                operationId,
+                reason: "disconnect"
+              }) : { operationId, reason: "disconnect" },
+              recovery: !canReplayHardwareMethodAfterTransportFailure(method) ? { scope: "unknown" } : void 0
+            });
+          }
+          throw retryErr;
+        }
+      }
+      if (!operationId && err?.code === HardwareErrorCode3.DeviceMismatch) {
+        this._sessions.delete(resolvedConnectId);
+        this._discoveredDevices.delete(resolvedConnectId);
+        await this.connector.disconnect(sessionId).catch(() => void 0);
+        throw err;
+      }
       const autoInstallApp = commonParams?.autoInstallApp ?? this._defaultAutoInstallApp;
       const isAppMissing = isAppNotInstalledError(err) || err?.code === HardwareErrorCode3.AppNotInstalled;
       if (autoInstallApp && isAppMissing) {
@@ -1957,157 +3047,14 @@ var _LedgerAdapter = class _LedgerAdapter {
             fingerprint,
             permissionDeviceId,
             commonParams,
-            installContext
-          );
-        }
-      }
-      if (isStuckAppStateError(err)) {
-        try {
-          this._sessions.delete(resolvedConnectId);
-          this._discoveredDevices.delete(resolvedConnectId);
-          this.connector.reset?.();
-        } catch {
-        }
-        debugLog(
-          "[LedgerAdapter] stuck-app retry: method=",
-          method,
-          "delayMs=",
-          _LedgerAdapter.STUCK_APP_RETRY_DELAY_MS,
-          "_tag=",
-          err?._tag
-        );
-        try {
-          const retryResult = await this._retryAfterStuckApp(
-            resolvedConnectId,
-            method,
-            effectiveParams,
-            signal,
-            err,
-            fingerprint
-          );
-          debugLog("[LedgerAdapter] stuck-app retry succeeded: method=", method);
-          return retryResult;
-        } catch (retryErr) {
-          if (signal.aborted) throw retryErr;
-          if (isStuckAppStateError(retryErr)) {
-            debugLog("[LedgerAdapter] stuck-app retry exhausted (2nd 6901): method=", method);
-            throw err;
-          }
-          debugLog(
-            "[LedgerAdapter] stuck-app retry threw non-stuck error: method=",
-            method,
-            "retryErrTag=",
-            retryErr?._tag
+            installContext,
+            operationId
           );
-          throw retryErr;
         }
       }
-      if (isDeviceLockedError(err) || isDeviceNotAdvertisingError(err) || isDeviceDisconnectedError(err)) {
-        let lastErr = err;
-        for (let attempt = 0; attempt < _LedgerAdapter.MAX_BUSINESS_RETRY_BUDGET; attempt += 1) {
-          if (signal.aborted) throw lastErr;
-          try {
-            this._sessions.delete(resolvedConnectId);
-            this._discoveredDevices.delete(resolvedConnectId);
-            if (isDeviceDisconnectedError(lastErr)) {
-              try {
-                this.connector.reset?.();
-              } catch {
-              }
-            }
-            const reConnectId = await this.ensureConnected(
-              resolvedConnectId,
-              signal,
-              allowUsbEphemeralFallback
-            );
-            const reSessionId = this._sessions.get(reConnectId);
-            if (!reSessionId) throw lastErr;
-            if (fingerprint && !fingerprint.skipFingerprint && fingerprint.deviceId) {
-              const fp = await this._abortable(
-                signal,
-                this._verifyDeviceFingerprintWithSession(
-                  reSessionId,
-                  fingerprint.deviceId,
-                  fingerprint.chain
-                )
-              );
-              if (!fp.success) {
-                throw Object.assign(new Error(formatDeviceMismatchError(fp.expected, fp.actual)), {
-                  code: HardwareErrorCode3.DeviceMismatch
-                });
-              }
-            }
-            return await this._callConnector(reSessionId, method, effectiveParams, signal);
-          } catch (retryErr) {
-            if (signal.aborted) throw retryErr;
-            lastErr = retryErr;
-            const canRetry = attempt < _LedgerAdapter.MAX_BUSINESS_RETRY_BUDGET - 1 && (isDeviceLockedError(retryErr) || isDeviceNotAdvertisingError(retryErr) || isDeviceDisconnectedError(retryErr));
-            if (!canRetry) {
-              throw retryErr;
-            }
-          }
-        }
-        throw lastErr;
-      }
-      if (isTimeoutError(err)) {
-        debugLog("[LedgerAdapter] timeout, retrying with fresh connection...");
-        this._discoveredDevices.delete(resolvedConnectId);
-        return this._retryWithFreshConnection(
-          resolvedConnectId,
-          method,
-          effectiveParams,
-          signal,
-          err,
-          fingerprint
-        );
-      }
-      if (isConnectionLevelError(err)) {
-        debugLog("[LedgerAdapter] connection-level fail-closed reset");
-        this._sessions.delete(resolvedConnectId);
-        this._discoveredDevices.delete(resolvedConnectId);
-        this.connector.reset();
-        const codeNum = err?.code;
-        throw Object.assign(err, {
-          code: codeNum ?? HardwareErrorCode3.DeviceDisconnected
-        });
-      }
       throw err;
     }
   }
-  /**
-   * Stuck-app recovery: pause for the device's UI transition, then retry once.
-   *
-   * Caller has already cleared the session + reset connector. We wait so Stax
-   * finishes its post-CloseApp animation, then go through ensureConnected +
-   * fingerprint check + call exactly once. Caller decides what to do on a
-   * second stuck-app hit.
-   */
-  async _retryAfterStuckApp(resolvedConnectId, method, params, signal, originalErr, fingerprint) {
-    await this._sleepAbortable(_LedgerAdapter.STUCK_APP_RETRY_DELAY_MS, signal);
-    const retryConnectId = await this.ensureConnected(
-      resolvedConnectId,
-      signal,
-      !!fingerprint?.deviceId && !fingerprint.skipFingerprint
-    );
-    const retrySessionId = this._sessions.get(retryConnectId);
-    if (!retrySessionId) throw originalErr;
-    if (fingerprint && !fingerprint.skipFingerprint && fingerprint.deviceId) {
-      const fp = await this._abortable(
-        signal,
-        this._verifyDeviceFingerprintWithSession(
-          retrySessionId,
-          fingerprint.deviceId,
-          fingerprint.chain
-        )
-      );
-      if (!fp.success) {
-        throw Object.assign(new Error(formatDeviceMismatchError(fp.expected, fp.actual)), {
-          code: HardwareErrorCode3.DeviceMismatch
-        });
-      }
-    }
-    return this._callConnector(retrySessionId, method, params, signal);
-  }
   _sleepAbortable(ms, signal) {
     return new Promise((resolve, reject) => {
       if (signal.aborted) {
@@ -2126,111 +3073,30 @@ var _LedgerAdapter = class _LedgerAdapter {
     });
   }
   /**
-   * Clear stale session, reconnect, and retry the call.
+   * Ensure OS-level device permission (Bluetooth / USB) before proceeding.
+   *
+   * Emits `REQUEST_DEVICE_PERMISSION` and awaits the consumer's
+   * `RECEIVE_DEVICE_PERMISSION` reply (60s budget covers "probe → system
+   * prompt → user tap" plus a generous margin). If the consumer never wires
+   * a handler or never replies, the wait times out and the operation fails
+   * fast so scanners/callers don't hang silently.
    *
-   * Timeout recovery starts with a full connector reset. After an APDU
-   * timeout, DMK/transport state may still emit malformed responses; retrying
-   * on the same DMK can poison the next chain switch.
+   * - No connectId (searchDevices): environment-level permission
+   * - With connectId (business methods): device-level permission
    */
-  async _retryWithFreshConnection(targetConnectId, method, params, signal, originalErr, fingerprint) {
-    this.connector.reset();
-    this._sessions.clear();
-    this._discoveredDevices.clear();
-    this._connectingPromise = null;
-    const allowUsbEphemeralFallback = !!fingerprint?.deviceId && !fingerprint.skipFingerprint;
-    const retryConnectId = await this.ensureConnected(
-      targetConnectId,
-      signal,
-      allowUsbEphemeralFallback
-    );
-    const retrySessionId = this._sessions.get(retryConnectId);
-    if (!retrySessionId) {
-      throw originalErr;
-    }
-    try {
-      if (fingerprint && !fingerprint.skipFingerprint && fingerprint.deviceId) {
-        const fp = await this._abortable(
-          signal,
-          this._verifyDeviceFingerprintWithSession(
-            retrySessionId,
-            fingerprint.deviceId,
-            fingerprint.chain
-          )
-        );
-        if (!fp.success) {
-          throw Object.assign(new Error(formatDeviceMismatchError(fp.expected, fp.actual)), {
-            code: HardwareErrorCode3.DeviceMismatch
-          });
-        }
-      }
-      return await this._callConnector(retrySessionId, method, params, signal);
-    } catch (retryErr) {
-      if (signal.aborted) throw retryErr;
-      this.connector.reset();
-      this._sessions.clear();
-      this._discoveredDevices.clear();
-      this._connectingPromise = null;
-      if (!isDeviceDisconnectedError(retryErr) && !isTimeoutError(retryErr)) {
-        throw retryErr;
-      }
-      debugLog(
-        "[LedgerAdapter] fresh-session retry still failed; resetting connector and rebuilding DMK"
-      );
-      this.connector.reset();
-      this._sessions.clear();
-      this._discoveredDevices.clear();
-      this._connectingPromise = null;
-      const finalConnectId = await this.ensureConnected(
-        targetConnectId,
-        signal,
-        allowUsbEphemeralFallback
-      );
-      const finalSessionId = this._sessions.get(finalConnectId);
-      if (!finalSessionId) {
-        throw originalErr;
-      }
-      if (fingerprint && !fingerprint.skipFingerprint && fingerprint.deviceId) {
-        const fp = await this._abortable(
-          signal,
-          this._verifyDeviceFingerprintWithSession(
-            finalSessionId,
-            fingerprint.deviceId,
-            fingerprint.chain
-          )
-        );
-        if (!fp.success) {
-          throw Object.assign(new Error(formatDeviceMismatchError(fp.expected, fp.actual)), {
-            code: HardwareErrorCode3.DeviceMismatch
-          });
-        }
-      }
-      return this._callConnector(finalSessionId, method, params, signal);
-    }
-  }
-  /**
-   * Ensure OS-level device permission (Bluetooth / USB) before proceeding.
-   *
-   * Emits `REQUEST_DEVICE_PERMISSION` and awaits the consumer's
-   * `RECEIVE_DEVICE_PERMISSION` reply (60s budget covers "probe → system
-   * prompt → user tap" plus a generous margin). If the consumer never wires
-   * a handler or never replies, the wait times out and the operation fails
-   * fast so scanners/callers don't hang silently.
-   *
-   * - No connectId (searchDevices): environment-level permission
-   * - With connectId (business methods): device-level permission
-   */
-  async _ensureDevicePermission(connectId, deviceId, signal) {
-    if (signal?.aborted) {
-      _LedgerAdapter._throwIfAborted(signal);
+  async _ensureDevicePermission(connectId, deviceId, signal) {
+    if (signal?.aborted) {
+      _LedgerAdapter._throwIfAborted(signal);
     }
     const transportType = this.activeTransport ?? "hid";
+    const operationId = this._activeOperationId();
     const waitPromise = this._uiRegistry.wait(
       UI_REQUEST.REQUEST_DEVICE_PERMISSION,
-      { timeoutMs: 6e4 }
+      { timeoutMs: 6e4, operationId }
     );
     this.emitter.emit(UI_REQUEST.REQUEST_DEVICE_PERMISSION, {
       type: UI_REQUEST.REQUEST_DEVICE_PERMISSION,
-      payload: { transportType, connectId, deviceId }
+      payload: { transportType, connectId, deviceId, operationId }
     });
     let response;
     const onAbort = () => {
@@ -2276,7 +3142,15 @@ var _LedgerAdapter = class _LedgerAdapter {
     if (err && typeof err === "object" && "code" in err && typeof err.code === "number") {
       const e = err;
       const params = e.code === HardwareErrorCode3.DevicePermissionDenied && e.reason ? { permissionDeniedReason: e.reason } : e.params;
-      return ledgerFailure(e.code, e.message ?? "Unknown error", e.appName, tag, params);
+      return ledgerFailure(
+        e.code,
+        e.message ?? "Unknown error",
+        e.appName,
+        tag,
+        params,
+        void 0,
+        isHwkRecoveryHint(e.recovery) ? e.recovery : void 0
+      );
     }
     const mapped = mapLedgerError(err);
     return ledgerFailure(mapped.code, mapped.message, mapped.appName, tag);
@@ -2303,7 +3177,7 @@ var _LedgerAdapter = class _LedgerAdapter {
       deviceId: device.deviceId,
       connectId: device.connectId,
       label: device.name,
-      connectionType: this.connector.connectionType,
+      connectionType: device.connectionType ?? this.connector.connectionType,
       rssi: device.rssi,
       isConnectable: device.isConnectable,
       serialNumber: device.serialNumber,
@@ -2329,8 +3203,8 @@ var LedgerAdapter = _LedgerAdapter;
 
 // src/connector/LedgerConnectorBase.ts
 import {
-  EConnectorInteraction as EConnectorInteraction4,
-  HardwareErrorCode as HardwareErrorCode8,
+  EConnectorInteraction as EConnectorInteraction3,
+  HardwareErrorCode as HardwareErrorCode7,
   isKnownNonTargetHardwareVendor,
   serializeConnectorError
 } from "@onekeyfe/hwk-adapter-core";
@@ -2603,7 +3477,7 @@ var LedgerDeviceManager = class {
 
 // src/signer/SignerManager.ts
 import { SignerEthBuilder } from "@ledgerhq/device-signer-kit-ethereum";
-import { ContextModuleBuilder } from "@ledgerhq/context-module";
+import { ContextModuleBuilder, ContextModuleChainID } from "@ledgerhq/context-module";
 
 // src/signer/SignerEth.ts
 import { hexToBytes } from "@onekeyfe/hwk-adapter-core";
@@ -2869,7 +3743,7 @@ var SignerManager = class _SignerManager {
     return (args) => new SignerEthBuilder(args);
   }
   static _createContextModule() {
-    const contextModule = new ContextModuleBuilder({}).removeDefaultLoaders().build();
+    const contextModule = new ContextModuleBuilder({}).setChain(ContextModuleChainID.Ethereum).removeDefaultLoaders().build();
     return _SignerManager.wrapBlindSigningReportNonBlocking(contextModule);
   }
   static wrapBlindSigningReportNonBlocking(contextModule) {
@@ -3339,7 +4213,8 @@ function _applySignaturesToPsbt(psbtHex, signatures) {
 }
 
 // src/connector/chains/sol.ts
-import { bytesToHex, hexToBytes as hexToBytes3 } from "@onekeyfe/hwk-adapter-core";
+import { bytesToHex, hexToBytes as hexToBytes3, prepareSolanaOffchainMessageV1 } from "@onekeyfe/hwk-adapter-core";
+import bs58 from "bs58";
 
 // src/signer/SignerSol.ts
 var SignerSol = class {
@@ -3423,8 +4298,21 @@ async function solSignMessage(ctx, sessionId, params) {
   const path = normalizePath(params.path);
   const messageBytes = hexToBytes3(params.message);
   try {
+    if (params.messageVersion === 1) {
+      const preparedMessage = prepareSolanaOffchainMessageV1({
+        message: messageBytes,
+        requiredSigners: params.requiredSigners
+      });
+      const { SignMessageVersion } = await ctx.importLedgerKit(
+        "@ledgerhq/device-signer-kit-solana"
+      );
+      const result2 = await solSigner.signMessage(path, preparedMessage.serializedMessage, {
+        version: SignMessageVersion.Raw
+      });
+      return { signature: decodeBase58Signature(result2.signature) };
+    }
     const result = await solSigner.signMessage(path, messageBytes);
-    return { signature: result.signature };
+    return { signature: decodeBase58EnvelopeSignature(result.signature) };
   } catch (err) {
     ctx.invalidateSession(sessionId);
     throw ctx.wrapError(err);
@@ -3432,11 +4320,27 @@ async function solSignMessage(ctx, sessionId, params) {
     ctx.clearCanceller(sessionId);
   }
 }
+function decodeBase58Signature(signature) {
+  const bytes = bs58.decode(signature);
+  if (bytes.length !== 64) {
+    throw new Error(`Ledger Solana signature must be 64 bytes, received ${bytes.length}`);
+  }
+  return bytesToHex(bytes);
+}
+function decodeBase58EnvelopeSignature(envelope) {
+  const bytes = bs58.decode(envelope);
+  if (bytes.length < 65 || bytes[0] !== 1) {
+    throw new Error("Ledger Solana signature envelope is invalid");
+  }
+  return bytesToHex(bytes.subarray(1, 65));
+}
 async function _createSolSigner(ctx, sessionId) {
   const dmk = await ctx.getOrCreateDmk();
-  const { ContextModuleBuilder: ContextModuleBuilder2 } = await ctx.importLedgerKit("@ledgerhq/context-module");
+  const { ContextModuleBuilder: ContextModuleBuilder2, ContextModuleChainID: ContextModuleChainID2 } = await ctx.importLedgerKit(
+    "@ledgerhq/context-module"
+  );
   const { SignerSolanaBuilder } = await ctx.importLedgerKit("@ledgerhq/device-signer-kit-solana");
-  const contextModule = new ContextModuleBuilder2({}).removeDefaultLoaders().build();
+  const contextModule = new ContextModuleBuilder2({}).setChain(ContextModuleChainID2.Solana).removeDefaultLoaders().build();
   const sdkSigner = new SignerSolanaBuilder({ dmk, sessionId }).withContextModule(contextModule).build();
   const signer = new SignerSol(sdkSigner);
   signer.onInteraction = (interaction) => {
@@ -3452,361 +4356,192 @@ async function _createSolSigner(ctx, sessionId) {
   return signer;
 }
 
-// src/connector/chains/tron.ts
-import { HardwareErrorCode as HardwareErrorCode7 } from "@onekeyfe/hwk-adapter-core";
-import Trx from "@ledgerhq/hw-app-trx";
-
-// src/connector/chains/legacyChainCall.ts
-import { EConnectorInteraction as EConnectorInteraction3 } from "@onekeyfe/hwk-adapter-core";
+// src/connector/chains/zcash.ts
+import { bytesToHex as bytesToHex2 } from "@onekeyfe/hwk-adapter-core";
 
-// src/app/AppManager.ts
-import {
-  CloseAppCommand,
-  GetAppAndVersionCommand,
-  OpenAppCommand,
-  isSuccessCommandResult
-} from "@ledgerhq/device-management-kit";
-import { HardwareErrorCode as HardwareErrorCode6 } from "@onekeyfe/hwk-adapter-core";
-var APP_NAME_MAP = {
-  ETH: "Ethereum",
-  BTC: "Bitcoin",
-  SOL: "Solana",
-  TRX: "Tron",
-  XRP: "XRP",
-  ADA: "Cardano",
-  DOT: "Polkadot",
-  ATOM: "Cosmos"
-};
-var DASHBOARD_APP_NAME = "BOLOS";
-var AppManager = class {
-  constructor(dmk, options) {
-    this._dmk = dmk;
-    this._waitMs = options?.waitMs ?? 1e3;
-    this._maxRetries = options?.maxRetries ?? 10;
-  }
-  /**
-   * Return the Ledger app name for a given chain ticker,
-   * or undefined if the chain is not supported.
-   */
-  static getAppName(chain) {
-    return APP_NAME_MAP[chain];
-  }
-  /**
-   * Ensure the target app is open on the device identified by `sessionId`.
-   *
-   * Flow:
-   * 1. Check the currently running app.
-   * 2. If it is already the target, return immediately.
-   * 3. If a different app is running (not dashboard), close it first.
-   * 4. Open the target app.
-   * 5. Poll until the device confirms the target app is running.
-   */
-  /**
-   * @param onConfirmOnDevice Called BEFORE OpenAppCommand is issued — the
-   *   device is about to display "Open <app>" on screen and wait for the
-   *   user's button press. UI consumers should show their "open app" prompt
-   *   in response. NOT called when the target app is already open (no user
-   *   interaction needed in that case).
-   *
-   * Important: OpenAppCommand is blocking. It does not resolve until the user
-   *   has physically confirmed on the device, so anything that runs AFTER
-   *   `await this._openApp(...)` lands AFTER the prompt is already gone.
-   *   Hence the callback must fire BEFORE that await.
-   */
-  async ensureAppOpen(sessionId, targetAppName, onConfirmOnDevice) {
-    const currentApp = await this._getCurrentApp(sessionId);
-    if (currentApp === targetAppName) {
-      return;
-    }
-    if (!this._isDashboard(currentApp)) {
-      await this._closeCurrentApp(sessionId);
-      await this._waitForApp(sessionId, DASHBOARD_APP_NAME);
-    }
-    onConfirmOnDevice?.();
-    await this._openApp(sessionId, targetAppName);
-    await this._waitForApp(sessionId, targetAppName);
+// src/signer/SignerZcash.ts
+var SignerZcash = class {
+  // eslint-disable-next-line no-useless-constructor, no-empty-function
+  constructor(_sdk) {
+    this._sdk = _sdk;
   }
-  // ---------------------------------------------------------------------------
-  // Private helpers
-  // ---------------------------------------------------------------------------
-  async _getCurrentApp(sessionId) {
-    const result = await this._dmk.sendCommand({
-      sessionId,
-      command: new GetAppAndVersionCommand()
-    });
-    if (isSuccessCommandResult(result)) {
-      debugLog("[AppManager] currentApp:", result.data.name);
-      return result.data.name;
-    }
-    const errResult = result;
-    const dmkErr = errResult.error ?? {};
-    const original = dmkErr.originalError;
-    debugLog(
-      "[AppManager] _getCurrentApp failed sessionId=",
-      sessionId,
-      "tag=",
-      dmkErr._tag,
-      "errorCode=",
-      dmkErr.errorCode,
-      "message=",
-      dmkErr.message,
-      "originalErrorMessage=",
-      original?.message ?? String(original ?? "")
-    );
-    throw Object.assign(
-      new Error(
-        dmkErr.message ?? "Failed to get current app from device"
-      ),
-      {
-        _tag: dmkErr._tag,
-        errorCode: dmkErr.errorCode,
-        originalError: original
-      }
+  /** GET_VK: UFVK string (default) or raw 96-byte Orchard FVK. */
+  async getFullViewingKey(derivationPath, options) {
+    const action = this._sdk.getFullViewingKey(derivationPath, options);
+    return deviceActionToPromise(
+      action,
+      this.onInteraction,
+      void 0,
+      this.onRegisterCanceller
     );
   }
-  async _openApp(sessionId, appName) {
-    const result = await this._dmk.sendCommand({
-      sessionId,
-      command: new OpenAppCommand({ appName })
-    });
-    if (!isSuccessCommandResult(result)) {
-      const dmkErr = result.error;
-      const errorCode = "errorCode" in dmkErr && dmkErr.errorCode != null ? String(dmkErr.errorCode) : "";
-      const message = "message" in dmkErr && typeof dmkErr.message === "string" ? dmkErr.message : "";
-      debugLog(
-        "[AppManager] openApp failed:",
-        appName,
-        "errorCode:",
-        errorCode,
-        "tag:",
-        dmkErr._tag
-      );
-      let code;
-      if (errorCode === "6807" || /unknown application/i.test(message)) {
-        code = HardwareErrorCode6.AppNotInstalled;
-      } else if (errorCode === "5501" || dmkErr._tag === "ActionRefusedError") {
-        code = HardwareErrorCode6.UserRejected;
-      }
-      throw Object.assign(new Error(`Failed to open "${appName}"`), {
-        _tag: ERROR_TAG.OpenAppCommand,
-        code,
-        errorCode,
-        statusCode: errorCode,
-        appName,
-        originalError: dmkErr
-      });
-    }
-  }
-  async _closeCurrentApp(sessionId) {
-    debugLog("[AppManager] closeCurrentApp");
-    await this._dmk.sendCommand({
-      sessionId,
-      command: new CloseAppCommand()
-    });
-  }
-  /**
-   * Poll the device until the expected app is reported as running,
-   * or throw after `_maxRetries` attempts.
-   */
-  async _waitForApp(sessionId, expectedAppName) {
-    let lastSeen = "";
-    for (let i = 0; i < this._maxRetries; i++) {
-      await this._wait();
-      const current = await this._getCurrentApp(sessionId);
-      lastSeen = current;
-      if (current === expectedAppName) {
-        return;
-      }
-    }
-    debugLog(
-      "[AppManager] waitForApp exhausted: expected=",
-      expectedAppName,
-      "lastSeen=",
-      lastSeen
-    );
-    throw new Error(
-      `Ledger: failed to open "${expectedAppName}" after ${this._maxRetries} retries (last seen: ${lastSeen})`
+  /** GET_SHIELDED_ADDRESS: single-Orchard-receiver UA for a 5-level transparent path. */
+  async getShieldedAddress(derivationPath, options) {
+    const action = this._sdk.getShieldedAddress(derivationPath, options);
+    return deviceActionToPromise(
+      action,
+      this.onInteraction,
+      void 0,
+      this.onRegisterCanceller
     );
   }
-  _isDashboard(appName) {
-    return appName === DASHBOARD_APP_NAME;
-  }
-  _wait() {
-    return new Promise((resolve) => setTimeout(resolve, this._waitMs));
-  }
 };
 
-// src/connector/chains/legacyChainCall.ts
-function isLegacyWrongAppError(err, _appName) {
-  return isWrongAppError(err);
-}
-async function withLegacyChainCall(ctx, sessionId, options, action) {
-  const { appName, needsConfirmation } = options;
-  let openAppPromptShown = false;
-  const onAppOpenPrompt = () => {
-    openAppPromptShown = true;
-    ctx.emit("ui-event", {
-      type: EConnectorInteraction3.ConfirmOpenApp,
-      payload: { sessionId }
-    });
-  };
-  const closeOpenAppUiIfShown = () => {
-    if (openAppPromptShown) {
-      ctx.emit("ui-event", {
-        type: EConnectorInteraction3.InteractionComplete,
-        payload: { sessionId }
-      });
-      openAppPromptShown = false;
-    }
-  };
+// src/connector/chains/zcash.ts
+async function zcashGetFullViewingKey(ctx, sessionId, params) {
+  const signer = await _createZcashSigner(ctx, sessionId);
+  const path = normalizePath(params.path);
+  const mode = params.mode ?? "ufvk";
   try {
-    await _ensureAppOpen(ctx, sessionId, appName, onAppOpenPrompt);
-  } catch (err) {
-    debugLog(
-      "[LegacyChainCall] pre-flight ensureAppOpen failed:",
-      appName,
-      err?.message
-    );
-    closeOpenAppUiIfShown();
-    throw ctx.wrapError(err, { defaultAppName: appName });
-  }
-  const runOnce = async () => {
-    let confirmEmitted = false;
-    if (needsConfirmation) {
-      ctx.emit("ui-event", {
-        type: EConnectorInteraction3.ConfirmOnDevice,
-        payload: { sessionId }
-      });
-      confirmEmitted = true;
-    }
-    try {
-      return await action(sessionId);
-    } finally {
-      if (confirmEmitted || openAppPromptShown) {
-        ctx.emit("ui-event", {
-          type: EConnectorInteraction3.InteractionComplete,
-          payload: { sessionId }
-        });
-        openAppPromptShown = false;
-      }
+    const result = await signer.getFullViewingKey(path, { mode });
+    if (result.mode === "ufvk") {
+      return { path: params.path, mode, ufvk: result.fullViewingKey };
     }
-  };
+    return { path: params.path, mode, orchardFvk: bytesToHex2(result.fullViewingKey) };
+  } catch (err) {
+    ctx.invalidateSession(sessionId);
+    throw ctx.wrapError(err);
+  } finally {
+    ctx.clearCanceller(sessionId);
+  }
+}
+async function zcashGetShieldedAddress(ctx, sessionId, params) {
+  const signer = await _createZcashSigner(ctx, sessionId);
+  const path = normalizePath(params.path);
   try {
-    return await runOnce();
+    const result = await signer.getShieldedAddress(path, {
+      checkOnDevice: params.showOnDevice ?? false
+    });
+    return { address: result.address, path: params.path };
   } catch (err) {
-    if (!isLegacyWrongAppError(err, appName)) {
-      debugLog("[LegacyChainCall] non-wrong-app failure:", appName, err?.message);
-      ctx.invalidateSession(sessionId);
-      throw ctx.wrapError(err, { defaultAppName: appName });
-    }
-    debugLog("[LegacyChainCall] wrong-app detected, retrying:", appName);
-    try {
-      await _ensureAppOpen(ctx, sessionId, appName, onAppOpenPrompt);
-    } catch (switchErr) {
-      debugLog(
-        "[LegacyChainCall] retry ensureAppOpen failed:",
-        appName,
-        switchErr?.message
-      );
-      closeOpenAppUiIfShown();
-      throw ctx.wrapError(switchErr, { defaultAppName: appName });
-    }
-    ctx.clearAllSigners();
-    const result = await runOnce();
-    debugLog("[LegacyChainCall] retry succeeded:", appName);
-    return result;
+    ctx.invalidateSession(sessionId);
+    throw ctx.wrapError(err);
+  } finally {
+    ctx.clearCanceller(sessionId);
   }
 }
-async function _ensureAppOpen(ctx, sessionId, appName, onPrompt) {
+async function _createZcashSigner(ctx, sessionId) {
   const dmk = await ctx.getOrCreateDmk();
-  const appManager = new AppManager(dmk);
-  await appManager.ensureAppOpen(sessionId, appName, onPrompt);
+  const { SignerZcashBuilder } = await ctx.importLedgerKit("@ledgerhq/device-signer-kit-zcash");
+  const sdkSigner = new SignerZcashBuilder({ dmk, sessionId }).build();
+  const signer = new SignerZcash(sdkSigner);
+  signer.onInteraction = (interaction) => {
+    debugLog("[LedgerConnector] zcash.onInteraction:", interaction);
+    ctx.emit("ui-event", {
+      type: collapseSignerInteraction(interaction),
+      payload: { sessionId }
+    });
+  };
+  signer.onRegisterCanceller = (cancel) => ctx.registerCanceller(sessionId, cancel);
+  return signer;
 }
 
-// src/transport/DmkTransport.ts
-import Transport from "@ledgerhq/hw-transport";
-var DmkTransport = class extends Transport {
-  constructor(dmk, sessionId) {
-    super();
-    this._dmk = dmk;
-    this._sessionId = sessionId;
+// src/connector/chains/tron.ts
+import { HardwareErrorCode as HardwareErrorCode6, bytesToHex as bytesToHex3, hexToBytes as hexToBytes4 } from "@onekeyfe/hwk-adapter-core";
+
+// src/signer/SignerTron.ts
+var SignerTron = class {
+  // eslint-disable-next-line no-useless-constructor, no-empty-function
+  constructor(_sdk) {
+    this._sdk = _sdk;
   }
-  async exchange(apdu) {
-    const response = await this._dmk.sendApdu({
-      sessionId: this._sessionId,
-      apdu: new Uint8Array(apdu)
-    });
-    const { data, statusCode } = response;
-    const result = Buffer.alloc(data.length + 2);
-    if (data.length > 0) {
-      result.set(data, 0);
-    }
-    result.set(statusCode, data.length);
-    return result;
+  /** Base58 Tron address plus the uncompressed public key at `derivationPath`. */
+  async getAddress(derivationPath, options) {
+    const action = this._sdk.getAddress(derivationPath, options);
+    const result = await deviceActionToPromise(
+      action,
+      this.onInteraction,
+      void 0,
+      this.onRegisterCanceller
+    );
+    return { address: result.address, publicKey: result.publicKey };
   }
-  async close() {
+  /** Sign a protobuf-encoded raw transaction. */
+  async signTransaction(derivationPath, transaction, options) {
+    const action = this._sdk.signTransaction(derivationPath, transaction, options);
+    return deviceActionToPromise(
+      action,
+      this.onInteraction,
+      void 0,
+      this.onRegisterCanceller
+    );
+  }
+  /** Sign a personal message (TIP-191). */
+  async signPersonalMessage(derivationPath, message, options) {
+    const action = this._sdk.signPersonalMessage(derivationPath, message, options);
+    return deviceActionToPromise(
+      action,
+      this.onInteraction,
+      void 0,
+      this.onRegisterCanceller
+    );
   }
 };
 
 // src/connector/chains/tron.ts
 async function tronGetAddress(ctx, sessionId, params) {
+  const tronSigner = await _createTronSigner(ctx, sessionId);
   const path = normalizePath(params.path);
-  const showOnDevice = params.showOnDevice ?? false;
-  return withLegacyChainCall(
-    ctx,
-    sessionId,
-    {
-      appName: "Tron",
-      // Only show "confirm on device" UI when the device is actually going
-      // to display the address for the user to verify.
-      needsConfirmation: showOnDevice
-    },
-    async (sid) => {
-      const trx = await _createTrx(ctx, sid);
-      const result = await trx.getAddress(path, showOnDevice);
-      return { address: result.address, publicKey: result.publicKey, path: params.path };
-    }
-  );
+  try {
+    const result = await tronSigner.getAddress(path, {
+      checkOnDevice: params.showOnDevice ?? false
+    });
+    return { address: result.address, publicKey: result.publicKey, path: params.path };
+  } catch (err) {
+    ctx.invalidateSession(sessionId);
+    throw ctx.wrapError(err);
+  } finally {
+    ctx.clearCanceller(sessionId);
+  }
 }
 async function tronSignTransaction(ctx, sessionId, params) {
   if (!params.rawTxHex) {
     throw Object.assign(
       new Error("TRON signing requires a protobuf-encoded raw transaction hex (rawTxHex)."),
-      { code: HardwareErrorCode7.InvalidParams }
+      { code: HardwareErrorCode6.InvalidParams }
     );
   }
+  const tronSigner = await _createTronSigner(ctx, sessionId);
   const path = normalizePath(params.path);
-  return withLegacyChainCall(
-    ctx,
-    sessionId,
-    { appName: "Tron", needsConfirmation: true },
-    async (sid) => {
-      const trx = await _createTrx(ctx, sid);
-      const signature = await trx.signTransaction(
-        path,
-        params.rawTxHex,
-        params.tokenSignatures ?? []
-      );
-      return { signature };
-    }
-  );
+  try {
+    const signature = await tronSigner.signTransaction(path, hexToBytes4(params.rawTxHex));
+    return { signature: bytesToHex3(signature) };
+  } catch (err) {
+    ctx.invalidateSession(sessionId);
+    throw ctx.wrapError(err);
+  } finally {
+    ctx.clearCanceller(sessionId);
+  }
 }
 async function tronSignMessage(ctx, sessionId, params) {
+  const tronSigner = await _createTronSigner(ctx, sessionId);
   const path = normalizePath(params.path);
-  return withLegacyChainCall(
-    ctx,
-    sessionId,
-    { appName: "Tron", needsConfirmation: true },
-    async (sid) => {
-      const trx = await _createTrx(ctx, sid);
-      const signature = await trx.signPersonalMessage(path, params.messageHex);
-      return { signature };
-    }
-  );
+  try {
+    const signature = await tronSigner.signPersonalMessage(path, hexToBytes4(params.messageHex));
+    return { signature: bytesToHex3(signature) };
+  } catch (err) {
+    ctx.invalidateSession(sessionId);
+    throw ctx.wrapError(err);
+  } finally {
+    ctx.clearCanceller(sessionId);
+  }
 }
-async function _createTrx(ctx, sessionId) {
+async function _createTronSigner(ctx, sessionId) {
   const dmk = await ctx.getOrCreateDmk();
-  return new Trx(new DmkTransport(dmk, sessionId));
+  const { SignerTrxBuilder } = await ctx.importLedgerKit("@ledgerhq/device-signer-kit-tron");
+  const sdkSigner = new SignerTrxBuilder({ dmk, sessionId }).build();
+  const signer = new SignerTron(sdkSigner);
+  signer.onInteraction = (interaction) => {
+    debugLog("[LedgerConnector] tron.onInteraction:", interaction);
+    ctx.emit("ui-event", {
+      type: collapseSignerInteraction(interaction),
+      payload: { sessionId }
+    });
+  };
+  signer.onRegisterCanceller = (cancel) => {
+    ctx.registerCanceller(sessionId, cancel);
+  };
+  return signer;
 }
 
 // src/device-apps/customActions.ts
@@ -3985,7 +4720,7 @@ var DeviceApps = class {
       seTargetId: v.seTargetId,
       mcuTargetId: v.mcuTargetId,
       seVersion: v.seVersion,
-      seFlagsHex: bytesToHex2(v.seFlags),
+      seFlagsHex: bytesToHex4(v.seFlags),
       mcuSephVersion: v.mcuSephVersion,
       mcuBootloaderVersion: v.mcuBootloaderVersion,
       hwVersion: v.hwVersion
@@ -4059,7 +4794,7 @@ var DeviceApps = class {
     }
   }
 };
-function bytesToHex2(bytes) {
+function bytesToHex4(bytes) {
   if (!bytes) return "";
   return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
 }
@@ -4102,10 +4837,11 @@ var METHOD_PREFIX_TO_APP_NAME = {
   evm: "Ethereum",
   btc: "Bitcoin",
   sol: "Solana",
-  tron: "Tron"
+  tron: "Tron",
+  zcash: "Zcash"
 };
 var HARDWARE_ERROR_CODE_VALUES = new Set(
-  Object.values(HardwareErrorCode8).filter((value) => typeof value === "number")
+  Object.values(HardwareErrorCode7).filter((value) => typeof value === "number")
 );
 var BLE_CONNECT_SCAN_TIMEOUT_MS = 1500;
 var LEDGER_RELAY_ALLOWED_ROOT_DOMAINS = ["onekeytest.com", "onekey.com"];
@@ -4142,6 +4878,10 @@ async function defaultLedgerKitImporter(pkg) {
       return import("@ledgerhq/device-signer-kit-bitcoin");
     case "@ledgerhq/device-signer-kit-solana":
       return import("@ledgerhq/device-signer-kit-solana");
+    case "@ledgerhq/device-signer-kit-tron":
+      return import("@ledgerhq/device-signer-kit-tron");
+    case "@ledgerhq/device-signer-kit-zcash":
+      return import("@ledgerhq/device-signer-kit-zcash");
     case "@ledgerhq/context-module":
       return import("@ledgerhq/context-module");
     default:
@@ -4201,6 +4941,7 @@ var LedgerConnectorBase = class {
     this._ctx = {
       emit: (event, data) => this._emit(event, data),
       invalidateSession: (sid) => this._invalidateSession(sid),
+      teardownSecureChannelSession: (sid) => this._teardownSecureChannelSession(sid),
       wrapError: (err, opts) => this._wrapError(err, opts),
       getOrCreateDmk: () => this._getOrCreateDmk(),
       getDeviceManager: () => this._getDeviceManager(),
@@ -4300,7 +5041,7 @@ var LedgerConnectorBase = class {
             `Ledger BLE connect did not return within ${HANG_CEILING_MS / 6e4}min \u2014 DMK hang fallback.`
           );
           err._tag = ERROR_TAG.BlePairingTimeout;
-          err.code = HardwareErrorCode8.BlePairingTimeout;
+          err.code = HardwareErrorCode7.BlePairingTimeout;
           reject(err);
         }, HANG_CEILING_MS);
       });
@@ -4333,7 +5074,7 @@ var LedgerConnectorBase = class {
         "Ledger device is not currently advertising. Wake up and unlock the device, keep it nearby, then try again."
       );
       err._tag = ERROR_TAG.DeviceNotAdvertising;
-      err.code = HardwareErrorCode8.DeviceNotFound;
+      err.code = HardwareErrorCode7.DeviceNotFound;
       throw err;
     };
     const doConnect = async (path) => {
@@ -4390,14 +5131,14 @@ var LedgerConnectorBase = class {
       this._resetSignersAndSessions();
       if (isLedgerBleConnectionType(this.connectionType)) {
         const tag = err?._tag;
-        if (isKnownConnectionTag(tag)) {
+        if (isKnownConnectionTag(tag) && !isConnectionOpeningTag(tag)) {
           throw err;
         }
         const wrapped = new Error(
           "Ledger Bluetooth pairing failed. Make sure the device is unlocked and nearby, then try again."
         );
         wrapped._tag = ERROR_TAG.BleGattBondingFailed;
-        wrapped.code = HardwareErrorCode8.BlePairingTimeout;
+        wrapped.code = HardwareErrorCode7.BlePairingTimeout;
         wrapped.originalError = err;
         throw wrapped;
       }
@@ -4475,7 +5216,7 @@ var LedgerConnectorBase = class {
     this._unwatchSessionState(sessionId);
     this._signerManager?.invalidate(sessionId);
     this._cancellers.get(sessionId)?.({
-      code: HardwareErrorCode8.DeviceDisconnected,
+      code: HardwareErrorCode7.DeviceDisconnected,
       tag: "DeviceDisconnected",
       message: "Device disconnected"
     });
@@ -4501,7 +5242,7 @@ var LedgerConnectorBase = class {
           success: false,
           error: serializeConnectorError(
             Object.assign(new Error("Ledger app is unresponsive"), {
-              code: HardwareErrorCode8.DeviceAppStuck,
+              code: HardwareErrorCode7.DeviceAppStuck,
               _tag: ERROR_TAG.DeviceAppStuck,
               originalError: err
             })
@@ -4513,7 +5254,7 @@ var LedgerConnectorBase = class {
           success: false,
           error: serializeConnectorError(
             Object.assign(new Error("Device communication interrupted, please retry"), {
-              code: HardwareErrorCode8.TransportError,
+              code: HardwareErrorCode7.TransportError,
               _tag: ERROR_TAG.DeviceTransportStuck,
               originalError: err
             })
@@ -4559,6 +5300,11 @@ var LedgerConnectorBase = class {
         return solSignTransaction(ctx, sessionId, params);
       case "solSignMessage":
         return solSignMessage(ctx, sessionId, params);
+      // ZCASH
+      case "zcashGetFullViewingKey":
+        return zcashGetFullViewingKey(ctx, sessionId, params);
+      case "zcashGetShieldedAddress":
+        return zcashGetShieldedAddress(ctx, sessionId, params);
       // TRON
       case "tronGetAddress":
         return tronGetAddress(ctx, sessionId, params);
@@ -4583,7 +5329,7 @@ var LedgerConnectorBase = class {
         try {
           return await apps.install(p.appName, ({ progress }) => {
             ctx.emit("ui-event", {
-              type: EConnectorInteraction4.AppInstallProgress,
+              type: EConnectorInteraction3.AppInstallProgress,
               payload: {
                 sessionId,
                 appName: p.appName,
@@ -4592,7 +5338,7 @@ var LedgerConnectorBase = class {
             });
           });
         } catch (err) {
-          ctx.invalidateSession(sessionId);
+          ctx.teardownSecureChannelSession(sessionId);
           throw ctx.wrapError(err);
         } finally {
           ctx.clearCanceller(sessionId);
@@ -4682,7 +5428,7 @@ var LedgerConnectorBase = class {
           );
           return { isGenuine: output.isGenuine, deviceId };
         } catch (err) {
-          ctx.invalidateSession(sessionId);
+          ctx.teardownSecureChannelSession(sessionId);
           throw ctx.wrapError(err);
         } finally {
           ctx.clearCanceller(sessionId);
@@ -4801,9 +5547,34 @@ var LedgerConnectorBase = class {
     }
     return this._deviceAppsManager;
   }
+  // DeviceAppsManager is intentionally absent here: it is a per-call factory
+  // with no cached session state, so there is nothing to invalidate. Cancelling
+  // the device action is what closes the secure channel.
   _invalidateSession(sessionId) {
     this._signerManager?.invalidate(sessionId);
   }
+  /**
+   * Teardown for the OS-level actions that open a manager-api secure channel
+   * (install, uninstall, genuine check). Cancelling the device action is what
+   * stops DMK's xstate actor, which unsubscribes the secure-channel observable
+   * and closes its WebSocket; dropping the canceller without firing it leaves
+   * that teardown to run only if the action settled on its own.
+   *
+   * The DMK device session is deliberately kept: the secure channel is a
+   * separate WebSocket per call, and disconnecting here would break the bounded
+   * unlock/retry recovery the adapter runs on the original session.
+   */
+  _teardownSecureChannelSession(sessionId) {
+    const cancel = this._cancellers.get(sessionId);
+    this._cancellers.delete(sessionId);
+    if (cancel) {
+      try {
+        cancel();
+      } catch {
+      }
+    }
+    this._invalidateSession(sessionId);
+  }
   /**
    * Replace an old session with a new one after app switch.
    * Emits device-connect so the adapter updates its _sessions Map.
@@ -4888,7 +5659,7 @@ var LedgerConnectorBase = class {
    * at every catch site. Falls through unchanged for unknown methods.
    */
   _ctxForMethod(method) {
-    const prefix = /^(evm|btc|sol|tron)/.exec(method)?.[1];
+    const prefix = /^(evm|btc|sol|tron|zcash)/.exec(method)?.[1];
     const defaultAppName = prefix ? METHOD_PREFIX_TO_APP_NAME[prefix] : void 0;
     if (!defaultAppName) return this._ctx;
     return {
@@ -4922,6 +5693,209 @@ var LedgerConnectorBase = class {
     return error;
   }
 };
+
+// src/transport/DmkTransport.ts
+import Transport from "@ledgerhq/hw-transport";
+var DmkTransport = class extends Transport {
+  constructor(dmk, sessionId) {
+    super();
+    this._dmk = dmk;
+    this._sessionId = sessionId;
+  }
+  async exchange(apdu) {
+    const response = await this._dmk.sendApdu({
+      sessionId: this._sessionId,
+      apdu: new Uint8Array(apdu)
+    });
+    const { data, statusCode } = response;
+    const result = Buffer.alloc(data.length + 2);
+    if (data.length > 0) {
+      result.set(data, 0);
+    }
+    result.set(statusCode, data.length);
+    return result;
+  }
+  async close() {
+  }
+};
+
+// src/app/AppManager.ts
+import {
+  CloseAppCommand,
+  GetAppAndVersionCommand,
+  OpenAppCommand,
+  isSuccessCommandResult
+} from "@ledgerhq/device-management-kit";
+import { HardwareErrorCode as HardwareErrorCode8 } from "@onekeyfe/hwk-adapter-core";
+var APP_NAME_MAP = {
+  ETH: "Ethereum",
+  BTC: "Bitcoin",
+  SOL: "Solana",
+  TRX: "Tron",
+  ZEC: "Zcash",
+  XRP: "XRP",
+  ADA: "Cardano",
+  DOT: "Polkadot",
+  ATOM: "Cosmos"
+};
+var DASHBOARD_APP_NAME = "BOLOS";
+var AppManager = class {
+  constructor(dmk, options) {
+    this._dmk = dmk;
+    this._waitMs = options?.waitMs ?? 1e3;
+    this._maxRetries = options?.maxRetries ?? 10;
+  }
+  /**
+   * Return the Ledger app name for a given chain ticker,
+   * or undefined if the chain is not supported.
+   */
+  static getAppName(chain) {
+    return APP_NAME_MAP[chain];
+  }
+  /**
+   * Ensure the target app is open on the device identified by `sessionId`.
+   *
+   * Flow:
+   * 1. Check the currently running app.
+   * 2. If it is already the target, return immediately.
+   * 3. If a different app is running (not dashboard), close it first.
+   * 4. Open the target app.
+   * 5. Poll until the device confirms the target app is running.
+   */
+  /**
+   * @param onConfirmOnDevice Called BEFORE OpenAppCommand is issued — the
+   *   device is about to display "Open <app>" on screen and wait for the
+   *   user's button press. UI consumers should show their "open app" prompt
+   *   in response. NOT called when the target app is already open (no user
+   *   interaction needed in that case).
+   *
+   * Important: OpenAppCommand is blocking. It does not resolve until the user
+   *   has physically confirmed on the device, so anything that runs AFTER
+   *   `await this._openApp(...)` lands AFTER the prompt is already gone.
+   *   Hence the callback must fire BEFORE that await.
+   */
+  async ensureAppOpen(sessionId, targetAppName, onConfirmOnDevice) {
+    const currentApp = await this._getCurrentApp(sessionId);
+    if (currentApp === targetAppName) {
+      return;
+    }
+    if (!this._isDashboard(currentApp)) {
+      await this._closeCurrentApp(sessionId);
+      await this._waitForApp(sessionId, DASHBOARD_APP_NAME);
+    }
+    onConfirmOnDevice?.();
+    await this._openApp(sessionId, targetAppName);
+    await this._waitForApp(sessionId, targetAppName);
+  }
+  // ---------------------------------------------------------------------------
+  // Private helpers
+  // ---------------------------------------------------------------------------
+  async _getCurrentApp(sessionId) {
+    const result = await this._dmk.sendCommand({
+      sessionId,
+      command: new GetAppAndVersionCommand()
+    });
+    if (isSuccessCommandResult(result)) {
+      debugLog("[AppManager] currentApp:", result.data.name);
+      return result.data.name;
+    }
+    const errResult = result;
+    const dmkErr = errResult.error ?? {};
+    const original = dmkErr.originalError;
+    debugLog(
+      "[AppManager] _getCurrentApp failed sessionId=",
+      sessionId,
+      "tag=",
+      dmkErr._tag,
+      "errorCode=",
+      dmkErr.errorCode,
+      "message=",
+      dmkErr.message,
+      "originalErrorMessage=",
+      original?.message ?? String(original ?? "")
+    );
+    throw Object.assign(
+      new Error(
+        dmkErr.message ?? "Failed to get current app from device"
+      ),
+      {
+        _tag: dmkErr._tag,
+        errorCode: dmkErr.errorCode,
+        originalError: original
+      }
+    );
+  }
+  async _openApp(sessionId, appName) {
+    const result = await this._dmk.sendCommand({
+      sessionId,
+      command: new OpenAppCommand({ appName })
+    });
+    if (!isSuccessCommandResult(result)) {
+      const dmkErr = result.error;
+      const errorCode = "errorCode" in dmkErr && dmkErr.errorCode != null ? String(dmkErr.errorCode) : "";
+      const message = "message" in dmkErr && typeof dmkErr.message === "string" ? dmkErr.message : "";
+      debugLog(
+        "[AppManager] openApp failed:",
+        appName,
+        "errorCode:",
+        errorCode,
+        "tag:",
+        dmkErr._tag
+      );
+      let code;
+      if (errorCode === "6807" || /unknown application/i.test(message)) {
+        code = HardwareErrorCode8.AppNotInstalled;
+      } else if (errorCode === "5501" || dmkErr._tag === "ActionRefusedError") {
+        code = HardwareErrorCode8.UserRejected;
+      }
+      throw Object.assign(new Error(`Failed to open "${appName}"`), {
+        _tag: ERROR_TAG.OpenAppCommand,
+        code,
+        errorCode,
+        statusCode: errorCode,
+        appName,
+        originalError: dmkErr
+      });
+    }
+  }
+  async _closeCurrentApp(sessionId) {
+    debugLog("[AppManager] closeCurrentApp");
+    await this._dmk.sendCommand({
+      sessionId,
+      command: new CloseAppCommand()
+    });
+  }
+  /**
+   * Poll the device until the expected app is reported as running,
+   * or throw after `_maxRetries` attempts.
+   */
+  async _waitForApp(sessionId, expectedAppName) {
+    let lastSeen = "";
+    for (let i = 0; i < this._maxRetries; i++) {
+      await this._wait();
+      const current = await this._getCurrentApp(sessionId);
+      lastSeen = current;
+      if (current === expectedAppName) {
+        return;
+      }
+    }
+    debugLog(
+      "[AppManager] waitForApp exhausted: expected=",
+      expectedAppName,
+      "lastSeen=",
+      lastSeen
+    );
+    throw new Error(
+      `Ledger: failed to open "${expectedAppName}" after ${this._maxRetries} retries (last seen: ${lastSeen})`
+    );
+  }
+  _isDashboard(appName) {
+    return appName === DASHBOARD_APP_NAME;
+  }
+  _wait() {
+    return new Promise((resolve) => setTimeout(resolve, this._waitMs));
+  }
+};
 export {
   AppManager,
   DmkTransport,
@@ -4932,6 +5906,7 @@ export {
   SignerEth,
   SignerManager,
   SignerSol,
+  SignerZcash,
   debugLog,
   deviceActionToPromise,
   isDeviceLockedError,