@onekeyfe/hwk-ledger-adapter 1.2.5-alpha.3 → 1.2.5-alpha.4

package/dist/index.d.mts

@@ -1,10 +1,11 @@
 import * as _onekeyfe_hwk_adapter_core from '@onekeyfe/hwk-adapter-core';
-import { IHardwareWallet, IConnector, TransportType, UiResponseEvent, SearchDevicesOptions, DeviceInfo, Response, ChainCapability, NullableCallArg, IHardwareCallParams, EvmGetAddressParams, EvmAddress, EvmSignTxLedgerParams, EvmSignedTx, EvmSignMsgParams, EvmSignature, EvmSignTypedDataParams, BtcGetAddressParams, BtcAddress, BtcGetPublicKeyParams, BtcPublicKey, BtcSignTxParams, BtcSignedTx, BtcSignPsbtParams, BtcSignedPsbt, BtcSignMsgParams, BtcSignature, IHardwareCommonCallParams, SolGetAddressParams, SolAddress, SolSignTxParams, SolSignedTx, SolSignMsgParams, SolSignature, TronGetAddressParams, TronAddress, TronSignTxParams, TronSignedTx, TronSignMsgParams, TronSignature, DeviceAuthenticityParams, DeviceAuthenticityResult, HardwareEventMap, DeviceEventListener, ChainForFingerprint, DeviceDescriptor, DeviceChangeEvent, ConnectionType, ConnectorDevice, ConnectorSession, ConnectorCallResult, ConnectorEventType, ConnectorEventMap, ConnectorConfig, Failure, HardwareErrorCode } from '@onekeyfe/hwk-adapter-core';
+import { IHardwareWallet, IConnector, TransportType, UiResponseEvent, SearchDevicesOptions, DeviceInfo, DeviceSearchTarget, ConnectionTarget, Response, BindBleDeviceParams, IHardwareConnectionContext, NullableCallArg, IHardwareCallParams, EvmGetAddressParams, EvmAddress, EvmSignTxLedgerParams, EvmSignedTx, EvmSignMsgParams, EvmSignature, EvmSignTypedDataParams, BtcGetAddressParams, BtcAddress, BtcGetPublicKeyParams, BtcPublicKey, BtcSignTxParams, BtcSignedTx, BtcSignPsbtParams, BtcSignedPsbt, BtcSignMsgParams, BtcSignature, IHardwareCommonCallParams, SolGetAddressParams, SolAddress, SolSignTxParams, SolSignedTx, SolSignMsgParams, SolSignature, TronGetAddressParams, TronAddress, TronSignTxParams, TronSignedTx, TronSignMsgParams, TronSignature, ZcashGetFullViewingKeyParams, ZcashFullViewingKey, ZcashGetShieldedAddressParams, ZcashShieldedAddress, DeviceAuthenticityParams, DeviceAuthenticityResult, HardwareEventMap, DeviceEventListener, ChainForFingerprint, DeviceDescriptor, DeviceChangeEvent, ConnectionType, ConnectorDevice, ConnectorSession, ConnectorCallResult, ConnectorEventType, ConnectorEventMap, ConnectorConfig, Failure, HardwareErrorCode, HwkErrorOrigin, HwkRecoveryHint } from '@onekeyfe/hwk-adapter-core';
 import { DeviceActionState as DeviceActionState$1, DiscoveredDevice, ExecuteDeviceActionReturnType, DeviceManagementKit } from '@ledgerhq/device-management-kit';
 import { Address, Signature, SignerEth as SignerEth$1, TypedData } from '@ledgerhq/device-signer-kit-ethereum';
 import { ContextModule } from '@ledgerhq/context-module';
 import { SignerBtc as SignerBtc$1 } from '@ledgerhq/device-signer-kit-bitcoin';
 import { SignerSolana } from '@ledgerhq/device-signer-kit-solana';
+import { SignerZcash as SignerZcash$1, FullViewingKeyOptions, GetFullViewingKeyDAOutput, GetShieldedAddressDAOutput } from '@ledgerhq/device-signer-kit-zcash';
 import Transport from '@ledgerhq/hw-transport';
 
 /**
@@ -95,16 +96,31 @@ type LedgerCallParams<T> = NullableCallArg<IHardwareCallParams<T>>;
 type LedgerCommonParams = NullableCallArg<IHardwareCommonCallParams>;
 declare class LedgerAdapter implements IHardwareWallet {
     readonly vendor: "ledger";
+    readonly cancelCapability: "stops-waiting";
     private readonly connector;
     private readonly emitter;
+    private readonly _operations;
     private _discoveredDevices;
     private _sessions;
+    private readonly _sessionTransports;
+    private readonly _selectedBleReconnectTargets;
     private readonly _uiRegistry;
     private _btcHighIndexConfirmedThisSession;
     private readonly _jobQueue;
     private _deviceAuthenticityQueueTail;
     private _doConnectAbortController;
+    private _connectingConnectId;
     private readonly _defaultAutoInstallApp;
+    private readonly _unsettledConnectorOperations;
+    private readonly _connectorIdleWaiters;
+    private _resetPromise;
+    private _stateGeneration;
+    private _connectorTeardownTail;
+    private _pendingConnectorTeardowns;
+    private _activeConnectionType;
+    private _bindingSelectionRequestId;
+    private _finishBleBinding;
+    private _isBleConnection;
     constructor(connector: IConnector, options?: {
         autoInstallApp?: boolean;
     });
@@ -118,22 +134,34 @@ declare class LedgerAdapter implements IHardwareWallet {
      * The next operation will re-discover and re-connect automatically.
      */
     resetState(): void;
+    private _resetStateAndDisconnectSessions;
     dispose(): Promise<void>;
     uiResponse(response: UiResponseEvent): void;
     searchDevices(options?: SearchDevicesOptions): Promise<DeviceInfo[]>;
+    private _searchDevices;
+    searchDeviceTargets(options?: SearchDevicesOptions): Promise<DeviceSearchTarget[]>;
+    listConnectionTargets(options?: SearchDevicesOptions): Promise<ConnectionTarget[]>;
     private _evictAllSessions;
     private static readonly MAX_BUSINESS_RETRY_BUDGET;
     private static readonly STUCK_APP_RETRY_DELAY_MS;
     private static readonly MAX_DOCONNECT_CONFIRMS;
     private _lastCancelReason;
+    private readonly _activeOperationJobs;
+    private readonly _pendingOperationDisconnects;
     private static readonly APP_INSTALL_PROGRESS_MIN_DELTA;
     private _installProgressLastEmittedValue;
     private _installProgressLastKey;
     private static _createDeviceBusyError;
-    connectDevice(connectId: string): Promise<Response<string>>;
-    disconnectDevice(connectId: string): Promise<void>;
-    getDeviceInfo(connectId: string, deviceId: string): Promise<Response<DeviceInfo>>;
-    getSupportedChains(): ChainCapability[];
+    connectDevice(searchTargetId: string): Promise<Response<string>>;
+    /** Ledger binds whichever BLE device the user picks; its wallet is not checked. */
+    bindBleDevice(params: BindBleDeviceParams): Promise<Response<string>>;
+    acquireOperation(connectId: string, context: IHardwareConnectionContext): Promise<Response<string>>;
+    private _createOperation;
+    private _connectTarget;
+    releaseOperation(operationId: string): Promise<void>;
+    private _releaseOperationConnection;
+    private _releaseLostOperationConnection;
+    getDeviceInfo(connectIdOrOperationId: string, deviceId: string): Promise<Response<DeviceInfo>>;
     allNetworkGetAddress: (connectId: string, _deviceId: string, params: _onekeyfe_hwk_adapter_core.AllNetworkGetAddressParams) => Promise<Response<_onekeyfe_hwk_adapter_core.AllNetworkAddressResponse[]>>;
     private callChain;
     private static normalizeCallArgs;
@@ -157,6 +185,8 @@ declare class LedgerAdapter implements IHardwareWallet {
     tronGetAddress(connectId?: string | null, deviceId?: string | null, params?: LedgerCallParams<TronGetAddressParams>): Promise<Response<TronAddress>>;
     tronSignTransaction(connectId?: string | null, deviceId?: string | null, params?: LedgerCallParams<TronSignTxParams>): Promise<Response<TronSignedTx>>;
     tronSignMessage(connectId?: string | null, deviceId?: string | null, params?: LedgerCallParams<TronSignMsgParams>): Promise<Response<TronSignature>>;
+    zcashGetFullViewingKey(connectId?: string | null, deviceId?: string | null, params?: LedgerCallParams<ZcashGetFullViewingKeyParams>): Promise<Response<ZcashFullViewingKey>>;
+    zcashGetShieldedAddress(connectId?: string | null, deviceId?: string | null, params?: LedgerCallParams<ZcashGetShieldedAddressParams>): Promise<Response<ZcashShieldedAddress>>;
     installApp(connectId: string, appName: string): Promise<Response<void>>;
     listInstalledApps(connectId: string): Promise<Response<AppMetadata[]>>;
     listInstalledNames(connectId: string): Promise<Response<string[]>>;
@@ -181,11 +211,12 @@ declare class LedgerAdapter implements IHardwareWallet {
     off<K extends keyof HardwareEventMap>(event: K, listener: (event: HardwareEventMap[K]) => void): void;
     off(event: string, listener: DeviceEventListener): void;
     cancel(connectId?: string): void;
+    /** A non-empty deviceId is an expected chain fingerprint, not a transport identifier. */
     getChainFingerprint(connectId: string, deviceId: string, chain: ChainForFingerprint): Promise<Response<string>>;
-    /**
-     * Verify fingerprint using an existing sessionId directly.
-     * Safe to call inside connectorCall without causing queue deadlock.
-     */
+    /** Ledger takes the selected BLE endpoint as the device and binds it right away. */
+    private _saveSelectedBleBinding;
+    private _dropSession;
+    /** Verify on the acquired session without re-entering the job queue. */
     private _verifyDeviceFingerprintWithSession;
     /**
      * Compute the chain fingerprint via a caller-supplied call strategy.
@@ -207,9 +238,14 @@ declare class LedgerAdapter implements IHardwareWallet {
      *
      * - If a session already exists for the given connectId, reuse it.
      * - If ANY session exists (Ledger IDs are ephemeral), reuse it.
-     * - Otherwise: search → exactly 1 USB device auto-connects; multiple or none throws.
+     * - Otherwise: search → one USB device auto-connects; multiple asks the host to choose.
      */
     private _connectingPromise;
+    /**
+     * Operation owning the running job, so a mid-call UI request can name it.
+     * Undefined at cold start when no operation owns the job.
+     */
+    private _activeOperationId;
     private _waitForDeviceConnect;
     /**
      * Decide whether a BTC pubkey call needs `showOnDevice=true` because of
@@ -250,7 +286,13 @@ declare class LedgerAdapter implements IHardwareWallet {
      * lives in one place.
      */
     private _callConnector;
+    private _assertConnectorReady;
+    private _runConnectorTeardown;
+    private _waitForConnectorOperationsToDrain;
+    private _retainConnectorOperation;
     private connectorCall;
+    /** Hermes/RN polyfills don't always populate signal.reason; fall back. */
+    private _abortReason;
     /**
      * Race a promise against an abort signal. On abort, rejects with
      * signal.reason → instance _lastCancelReason → generic Error('Aborted').
@@ -260,35 +302,10 @@ declare class LedgerAdapter implements IHardwareWallet {
     private static _throwIfAborted;
     /** Actual work done under the job queue — connection, fingerprint, call, and recovery. */
     private _runConnectorCall;
-    /**
-     * Stuck-app recovery: pause for the device's UI transition, then retry once.
-     *
-     * Caller has already cleared the session + reset connector. We wait so Stax
-     * finishes its post-CloseApp animation, then go through ensureConnected +
-     * fingerprint check + call exactly once. Caller decides what to do on a
-     * second stuck-app hit.
-     */
-    private _retryAfterStuckApp;
     private _sleepAbortable;
     /**
-     * Clear stale session, reconnect, and retry the call.
-     *
-     * Timeout recovery starts with a full connector reset. After an APDU
-     * timeout, DMK/transport state may still emit malformed responses; retrying
-     * on the same DMK can poison the next chain switch.
-     */
-    private _retryWithFreshConnection;
-    /**
-     * Ensure OS-level device permission (Bluetooth / USB) before proceeding.
-     *
-     * Emits `REQUEST_DEVICE_PERMISSION` and awaits the consumer's
-     * `RECEIVE_DEVICE_PERMISSION` reply (60s budget covers "probe → system
-     * prompt → user tap" plus a generous margin). If the consumer never wires
-     * a handler or never replies, the wait times out and the operation fails
-     * fast so scanners/callers don't hang silently.
-     *
-     * - No connectId (searchDevices): environment-level permission
-     * - With connectId (business methods): device-level permission
+     * Ensure OS-level Bluetooth/USB permission; times out after 60s if the host never
+     * replies. Without connectId the request is environment-level, else device-level.
      */
     private _ensureDevicePermission;
     /**
@@ -498,6 +515,11 @@ declare class LedgerConnectorBase implements IConnector {
     private _getSignerManager;
     private _getDeviceAppsManager;
     private _invalidateSession;
+    /**
+     * Fire the canceller so DMK closes the secure-channel WebSocket. The DMK device
+     * session is kept: unlock/retry recovery reuses it.
+     */
+    private _teardownSecureChannelSession;
     /**
      * Replace an old session with a new one after app switch.
      * Emits device-connect so the adapter updates its _sessions Map.
@@ -654,6 +676,25 @@ declare class SignerSol {
     }>;
 }
 
+/**
+ * Wraps Ledger's Zcash SDK signer (Observable-based DeviceActions) into a
+ * simple async interface. Only the viewing-key and shielded-address reads are
+ * exposed; PCZT signing goes through a different host-side pipeline.
+ */
+declare class SignerZcash {
+    private readonly _sdk;
+    onInteraction?: (interaction: string) => void;
+    onRegisterCanceller?: (cancel: (reason?: CancelReason) => void) => void;
+    constructor(_sdk: SignerZcash$1);
+    /** GET_VK: UFVK string (default) or raw 96-byte Orchard FVK. */
+    getFullViewingKey(derivationPath: string, options?: FullViewingKeyOptions): Promise<GetFullViewingKeyDAOutput>;
+    /** GET_SHIELDED_ADDRESS: single-Orchard-receiver UA for a 5-level transparent path. */
+    getShieldedAddress(derivationPath: string, options?: {
+        checkOnDevice?: boolean;
+        skipOpenApp?: boolean;
+    }): Promise<GetShieldedAddressDAOutput>;
+}
+
 /**
  * Transport adapter that bridges Ledger's legacy hw-app-* SDKs to DMK's sendApdu.
  *
@@ -737,7 +778,7 @@ interface WrapErrorOptions {
     /** Fallback when err has no `appName` (DMK signer errors don't carry it). */
     defaultAppName?: string;
 }
-declare function ledgerFailure(code: HardwareErrorCode, error: string, appName?: string, tag?: string, params?: Record<string, unknown>): LedgerFailure;
+declare function ledgerFailure(code: HardwareErrorCode, error: string, appName?: string, tag?: string, params?: Record<string, unknown>, origin?: HwkErrorOrigin, recovery?: HwkRecoveryHint): LedgerFailure;
 declare function isDeviceLockedError(err: unknown): boolean;
 /**
  * Map a Ledger DMK error to a HardwareErrorCode and human-readable message.
@@ -747,6 +788,7 @@ declare function isDeviceLockedError(err: unknown): boolean;
 declare function mapLedgerError(err: unknown, opts?: WrapErrorOptions): {
     code: HardwareErrorCode;
     message: string;
+    origin?: HwkErrorOrigin;
     appName?: string;
 };
 
@@ -782,4 +824,4 @@ declare function isLedgerDmkBleTransport(transport?: string): boolean;
 declare function isLedgerBleConnectionType(connectionType?: ConnectionType): boolean;
 declare function isLedgerBleDescriptor(connectionType: ConnectionType, descriptor: DeviceDescriptor): boolean;
 
-export { AppManager, type DeviceActionState, type DmkDiscoveredDevice, DmkTransport, LedgerAdapter, LedgerConnectorBase, type LedgerConnectorBaseOptions, LedgerDeviceManager, type LedgerFailure, type SdkEvent, type SdkEventListener, type SdkLogEvent, SignerBtc, type SignerBtcAddress, SignerEth, type SignerEvmAddress, type SignerEvmSignature, SignerManager, SignerSol, type TransportFactory, debugLog, deviceActionToPromise, isDeviceLockedError, isLedgerBleConnectionType, isLedgerBleDescriptor, isLedgerDmkBleTransport, ledgerFailure, mapLedgerError, offSdkEvent, onSdkEvent };
+export { AppManager, type DeviceActionState, type DmkDiscoveredDevice, DmkTransport, LedgerAdapter, LedgerConnectorBase, type LedgerConnectorBaseOptions, LedgerDeviceManager, type LedgerFailure, type SdkEvent, type SdkEventListener, type SdkLogEvent, SignerBtc, type SignerBtcAddress, SignerEth, type SignerEvmAddress, type SignerEvmSignature, SignerManager, SignerSol, SignerZcash, type TransportFactory, debugLog, deviceActionToPromise, isDeviceLockedError, isLedgerBleConnectionType, isLedgerBleDescriptor, isLedgerDmkBleTransport, ledgerFailure, mapLedgerError, offSdkEvent, onSdkEvent };

package/dist/index.d.ts

@@ -1,10 +1,11 @@
 import * as _onekeyfe_hwk_adapter_core from '@onekeyfe/hwk-adapter-core';
-import { IHardwareWallet, IConnector, TransportType, UiResponseEvent, SearchDevicesOptions, DeviceInfo, Response, ChainCapability, NullableCallArg, IHardwareCallParams, EvmGetAddressParams, EvmAddress, EvmSignTxLedgerParams, EvmSignedTx, EvmSignMsgParams, EvmSignature, EvmSignTypedDataParams, BtcGetAddressParams, BtcAddress, BtcGetPublicKeyParams, BtcPublicKey, BtcSignTxParams, BtcSignedTx, BtcSignPsbtParams, BtcSignedPsbt, BtcSignMsgParams, BtcSignature, IHardwareCommonCallParams, SolGetAddressParams, SolAddress, SolSignTxParams, SolSignedTx, SolSignMsgParams, SolSignature, TronGetAddressParams, TronAddress, TronSignTxParams, TronSignedTx, TronSignMsgParams, TronSignature, DeviceAuthenticityParams, DeviceAuthenticityResult, HardwareEventMap, DeviceEventListener, ChainForFingerprint, DeviceDescriptor, DeviceChangeEvent, ConnectionType, ConnectorDevice, ConnectorSession, ConnectorCallResult, ConnectorEventType, ConnectorEventMap, ConnectorConfig, Failure, HardwareErrorCode } from '@onekeyfe/hwk-adapter-core';
+import { IHardwareWallet, IConnector, TransportType, UiResponseEvent, SearchDevicesOptions, DeviceInfo, DeviceSearchTarget, ConnectionTarget, Response, BindBleDeviceParams, IHardwareConnectionContext, NullableCallArg, IHardwareCallParams, EvmGetAddressParams, EvmAddress, EvmSignTxLedgerParams, EvmSignedTx, EvmSignMsgParams, EvmSignature, EvmSignTypedDataParams, BtcGetAddressParams, BtcAddress, BtcGetPublicKeyParams, BtcPublicKey, BtcSignTxParams, BtcSignedTx, BtcSignPsbtParams, BtcSignedPsbt, BtcSignMsgParams, BtcSignature, IHardwareCommonCallParams, SolGetAddressParams, SolAddress, SolSignTxParams, SolSignedTx, SolSignMsgParams, SolSignature, TronGetAddressParams, TronAddress, TronSignTxParams, TronSignedTx, TronSignMsgParams, TronSignature, ZcashGetFullViewingKeyParams, ZcashFullViewingKey, ZcashGetShieldedAddressParams, ZcashShieldedAddress, DeviceAuthenticityParams, DeviceAuthenticityResult, HardwareEventMap, DeviceEventListener, ChainForFingerprint, DeviceDescriptor, DeviceChangeEvent, ConnectionType, ConnectorDevice, ConnectorSession, ConnectorCallResult, ConnectorEventType, ConnectorEventMap, ConnectorConfig, Failure, HardwareErrorCode, HwkErrorOrigin, HwkRecoveryHint } from '@onekeyfe/hwk-adapter-core';
 import { DeviceActionState as DeviceActionState$1, DiscoveredDevice, ExecuteDeviceActionReturnType, DeviceManagementKit } from '@ledgerhq/device-management-kit';
 import { Address, Signature, SignerEth as SignerEth$1, TypedData } from '@ledgerhq/device-signer-kit-ethereum';
 import { ContextModule } from '@ledgerhq/context-module';
 import { SignerBtc as SignerBtc$1 } from '@ledgerhq/device-signer-kit-bitcoin';
 import { SignerSolana } from '@ledgerhq/device-signer-kit-solana';
+import { SignerZcash as SignerZcash$1, FullViewingKeyOptions, GetFullViewingKeyDAOutput, GetShieldedAddressDAOutput } from '@ledgerhq/device-signer-kit-zcash';
 import Transport from '@ledgerhq/hw-transport';
 
 /**
@@ -95,16 +96,31 @@ type LedgerCallParams<T> = NullableCallArg<IHardwareCallParams<T>>;
 type LedgerCommonParams = NullableCallArg<IHardwareCommonCallParams>;
 declare class LedgerAdapter implements IHardwareWallet {
     readonly vendor: "ledger";
+    readonly cancelCapability: "stops-waiting";
     private readonly connector;
     private readonly emitter;
+    private readonly _operations;
     private _discoveredDevices;
     private _sessions;
+    private readonly _sessionTransports;
+    private readonly _selectedBleReconnectTargets;
     private readonly _uiRegistry;
     private _btcHighIndexConfirmedThisSession;
     private readonly _jobQueue;
     private _deviceAuthenticityQueueTail;
     private _doConnectAbortController;
+    private _connectingConnectId;
     private readonly _defaultAutoInstallApp;
+    private readonly _unsettledConnectorOperations;
+    private readonly _connectorIdleWaiters;
+    private _resetPromise;
+    private _stateGeneration;
+    private _connectorTeardownTail;
+    private _pendingConnectorTeardowns;
+    private _activeConnectionType;
+    private _bindingSelectionRequestId;
+    private _finishBleBinding;
+    private _isBleConnection;
     constructor(connector: IConnector, options?: {
         autoInstallApp?: boolean;
     });
@@ -118,22 +134,34 @@ declare class LedgerAdapter implements IHardwareWallet {
      * The next operation will re-discover and re-connect automatically.
      */
     resetState(): void;
+    private _resetStateAndDisconnectSessions;
     dispose(): Promise<void>;
     uiResponse(response: UiResponseEvent): void;
     searchDevices(options?: SearchDevicesOptions): Promise<DeviceInfo[]>;
+    private _searchDevices;
+    searchDeviceTargets(options?: SearchDevicesOptions): Promise<DeviceSearchTarget[]>;
+    listConnectionTargets(options?: SearchDevicesOptions): Promise<ConnectionTarget[]>;
     private _evictAllSessions;
     private static readonly MAX_BUSINESS_RETRY_BUDGET;
     private static readonly STUCK_APP_RETRY_DELAY_MS;
     private static readonly MAX_DOCONNECT_CONFIRMS;
     private _lastCancelReason;
+    private readonly _activeOperationJobs;
+    private readonly _pendingOperationDisconnects;
     private static readonly APP_INSTALL_PROGRESS_MIN_DELTA;
     private _installProgressLastEmittedValue;
     private _installProgressLastKey;
     private static _createDeviceBusyError;
-    connectDevice(connectId: string): Promise<Response<string>>;
-    disconnectDevice(connectId: string): Promise<void>;
-    getDeviceInfo(connectId: string, deviceId: string): Promise<Response<DeviceInfo>>;
-    getSupportedChains(): ChainCapability[];
+    connectDevice(searchTargetId: string): Promise<Response<string>>;
+    /** Ledger binds whichever BLE device the user picks; its wallet is not checked. */
+    bindBleDevice(params: BindBleDeviceParams): Promise<Response<string>>;
+    acquireOperation(connectId: string, context: IHardwareConnectionContext): Promise<Response<string>>;
+    private _createOperation;
+    private _connectTarget;
+    releaseOperation(operationId: string): Promise<void>;
+    private _releaseOperationConnection;
+    private _releaseLostOperationConnection;
+    getDeviceInfo(connectIdOrOperationId: string, deviceId: string): Promise<Response<DeviceInfo>>;
     allNetworkGetAddress: (connectId: string, _deviceId: string, params: _onekeyfe_hwk_adapter_core.AllNetworkGetAddressParams) => Promise<Response<_onekeyfe_hwk_adapter_core.AllNetworkAddressResponse[]>>;
     private callChain;
     private static normalizeCallArgs;
@@ -157,6 +185,8 @@ declare class LedgerAdapter implements IHardwareWallet {
     tronGetAddress(connectId?: string | null, deviceId?: string | null, params?: LedgerCallParams<TronGetAddressParams>): Promise<Response<TronAddress>>;
     tronSignTransaction(connectId?: string | null, deviceId?: string | null, params?: LedgerCallParams<TronSignTxParams>): Promise<Response<TronSignedTx>>;
     tronSignMessage(connectId?: string | null, deviceId?: string | null, params?: LedgerCallParams<TronSignMsgParams>): Promise<Response<TronSignature>>;
+    zcashGetFullViewingKey(connectId?: string | null, deviceId?: string | null, params?: LedgerCallParams<ZcashGetFullViewingKeyParams>): Promise<Response<ZcashFullViewingKey>>;
+    zcashGetShieldedAddress(connectId?: string | null, deviceId?: string | null, params?: LedgerCallParams<ZcashGetShieldedAddressParams>): Promise<Response<ZcashShieldedAddress>>;
     installApp(connectId: string, appName: string): Promise<Response<void>>;
     listInstalledApps(connectId: string): Promise<Response<AppMetadata[]>>;
     listInstalledNames(connectId: string): Promise<Response<string[]>>;
@@ -181,11 +211,12 @@ declare class LedgerAdapter implements IHardwareWallet {
     off<K extends keyof HardwareEventMap>(event: K, listener: (event: HardwareEventMap[K]) => void): void;
     off(event: string, listener: DeviceEventListener): void;
     cancel(connectId?: string): void;
+    /** A non-empty deviceId is an expected chain fingerprint, not a transport identifier. */
     getChainFingerprint(connectId: string, deviceId: string, chain: ChainForFingerprint): Promise<Response<string>>;
-    /**
-     * Verify fingerprint using an existing sessionId directly.
-     * Safe to call inside connectorCall without causing queue deadlock.
-     */
+    /** Ledger takes the selected BLE endpoint as the device and binds it right away. */
+    private _saveSelectedBleBinding;
+    private _dropSession;
+    /** Verify on the acquired session without re-entering the job queue. */
     private _verifyDeviceFingerprintWithSession;
     /**
      * Compute the chain fingerprint via a caller-supplied call strategy.
@@ -207,9 +238,14 @@ declare class LedgerAdapter implements IHardwareWallet {
      *
      * - If a session already exists for the given connectId, reuse it.
      * - If ANY session exists (Ledger IDs are ephemeral), reuse it.
-     * - Otherwise: search → exactly 1 USB device auto-connects; multiple or none throws.
+     * - Otherwise: search → one USB device auto-connects; multiple asks the host to choose.
      */
     private _connectingPromise;
+    /**
+     * Operation owning the running job, so a mid-call UI request can name it.
+     * Undefined at cold start when no operation owns the job.
+     */
+    private _activeOperationId;
     private _waitForDeviceConnect;
     /**
      * Decide whether a BTC pubkey call needs `showOnDevice=true` because of
@@ -250,7 +286,13 @@ declare class LedgerAdapter implements IHardwareWallet {
      * lives in one place.
      */
     private _callConnector;
+    private _assertConnectorReady;
+    private _runConnectorTeardown;
+    private _waitForConnectorOperationsToDrain;
+    private _retainConnectorOperation;
     private connectorCall;
+    /** Hermes/RN polyfills don't always populate signal.reason; fall back. */
+    private _abortReason;
     /**
      * Race a promise against an abort signal. On abort, rejects with
      * signal.reason → instance _lastCancelReason → generic Error('Aborted').
@@ -260,35 +302,10 @@ declare class LedgerAdapter implements IHardwareWallet {
     private static _throwIfAborted;
     /** Actual work done under the job queue — connection, fingerprint, call, and recovery. */
     private _runConnectorCall;
-    /**
-     * Stuck-app recovery: pause for the device's UI transition, then retry once.
-     *
-     * Caller has already cleared the session + reset connector. We wait so Stax
-     * finishes its post-CloseApp animation, then go through ensureConnected +
-     * fingerprint check + call exactly once. Caller decides what to do on a
-     * second stuck-app hit.
-     */
-    private _retryAfterStuckApp;
     private _sleepAbortable;
     /**
-     * Clear stale session, reconnect, and retry the call.
-     *
-     * Timeout recovery starts with a full connector reset. After an APDU
-     * timeout, DMK/transport state may still emit malformed responses; retrying
-     * on the same DMK can poison the next chain switch.
-     */
-    private _retryWithFreshConnection;
-    /**
-     * Ensure OS-level device permission (Bluetooth / USB) before proceeding.
-     *
-     * Emits `REQUEST_DEVICE_PERMISSION` and awaits the consumer's
-     * `RECEIVE_DEVICE_PERMISSION` reply (60s budget covers "probe → system
-     * prompt → user tap" plus a generous margin). If the consumer never wires
-     * a handler or never replies, the wait times out and the operation fails
-     * fast so scanners/callers don't hang silently.
-     *
-     * - No connectId (searchDevices): environment-level permission
-     * - With connectId (business methods): device-level permission
+     * Ensure OS-level Bluetooth/USB permission; times out after 60s if the host never
+     * replies. Without connectId the request is environment-level, else device-level.
      */
     private _ensureDevicePermission;
     /**
@@ -498,6 +515,11 @@ declare class LedgerConnectorBase implements IConnector {
     private _getSignerManager;
     private _getDeviceAppsManager;
     private _invalidateSession;
+    /**
+     * Fire the canceller so DMK closes the secure-channel WebSocket. The DMK device
+     * session is kept: unlock/retry recovery reuses it.
+     */
+    private _teardownSecureChannelSession;
     /**
      * Replace an old session with a new one after app switch.
      * Emits device-connect so the adapter updates its _sessions Map.
@@ -654,6 +676,25 @@ declare class SignerSol {
     }>;
 }
 
+/**
+ * Wraps Ledger's Zcash SDK signer (Observable-based DeviceActions) into a
+ * simple async interface. Only the viewing-key and shielded-address reads are
+ * exposed; PCZT signing goes through a different host-side pipeline.
+ */
+declare class SignerZcash {
+    private readonly _sdk;
+    onInteraction?: (interaction: string) => void;
+    onRegisterCanceller?: (cancel: (reason?: CancelReason) => void) => void;
+    constructor(_sdk: SignerZcash$1);
+    /** GET_VK: UFVK string (default) or raw 96-byte Orchard FVK. */
+    getFullViewingKey(derivationPath: string, options?: FullViewingKeyOptions): Promise<GetFullViewingKeyDAOutput>;
+    /** GET_SHIELDED_ADDRESS: single-Orchard-receiver UA for a 5-level transparent path. */
+    getShieldedAddress(derivationPath: string, options?: {
+        checkOnDevice?: boolean;
+        skipOpenApp?: boolean;
+    }): Promise<GetShieldedAddressDAOutput>;
+}
+
 /**
  * Transport adapter that bridges Ledger's legacy hw-app-* SDKs to DMK's sendApdu.
  *
@@ -737,7 +778,7 @@ interface WrapErrorOptions {
     /** Fallback when err has no `appName` (DMK signer errors don't carry it). */
     defaultAppName?: string;
 }
-declare function ledgerFailure(code: HardwareErrorCode, error: string, appName?: string, tag?: string, params?: Record<string, unknown>): LedgerFailure;
+declare function ledgerFailure(code: HardwareErrorCode, error: string, appName?: string, tag?: string, params?: Record<string, unknown>, origin?: HwkErrorOrigin, recovery?: HwkRecoveryHint): LedgerFailure;
 declare function isDeviceLockedError(err: unknown): boolean;
 /**
  * Map a Ledger DMK error to a HardwareErrorCode and human-readable message.
@@ -747,6 +788,7 @@ declare function isDeviceLockedError(err: unknown): boolean;
 declare function mapLedgerError(err: unknown, opts?: WrapErrorOptions): {
     code: HardwareErrorCode;
     message: string;
+    origin?: HwkErrorOrigin;
     appName?: string;
 };
 
@@ -782,4 +824,4 @@ declare function isLedgerDmkBleTransport(transport?: string): boolean;
 declare function isLedgerBleConnectionType(connectionType?: ConnectionType): boolean;
 declare function isLedgerBleDescriptor(connectionType: ConnectionType, descriptor: DeviceDescriptor): boolean;
 
-export { AppManager, type DeviceActionState, type DmkDiscoveredDevice, DmkTransport, LedgerAdapter, LedgerConnectorBase, type LedgerConnectorBaseOptions, LedgerDeviceManager, type LedgerFailure, type SdkEvent, type SdkEventListener, type SdkLogEvent, SignerBtc, type SignerBtcAddress, SignerEth, type SignerEvmAddress, type SignerEvmSignature, SignerManager, SignerSol, type TransportFactory, debugLog, deviceActionToPromise, isDeviceLockedError, isLedgerBleConnectionType, isLedgerBleDescriptor, isLedgerDmkBleTransport, ledgerFailure, mapLedgerError, offSdkEvent, onSdkEvent };
+export { AppManager, type DeviceActionState, type DmkDiscoveredDevice, DmkTransport, LedgerAdapter, LedgerConnectorBase, type LedgerConnectorBaseOptions, LedgerDeviceManager, type LedgerFailure, type SdkEvent, type SdkEventListener, type SdkLogEvent, SignerBtc, type SignerBtcAddress, SignerEth, type SignerEvmAddress, type SignerEvmSignature, SignerManager, SignerSol, SignerZcash, type TransportFactory, debugLog, deviceActionToPromise, isDeviceLockedError, isLedgerBleConnectionType, isLedgerBleDescriptor, isLedgerDmkBleTransport, ledgerFailure, mapLedgerError, offSdkEvent, onSdkEvent };