@onekeyfe/hwk-trezor-adapter 1.2.1 → 1.2.2-alpha.1

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { IHardwareWallet, IConnector, TransportType, DeviceInfo, Response, ChainCapability, AllNetworkGetAddressParams, AllNetworkAddressResponse, TrezorDeviceSettingsParams, TrezorBrightnessParams, TrezorChangePinParams, UiResponseEvent, ChainForFingerprint, ICommonCallParams, EvmGetAddressParams, EvmAddress, EvmSignTxTrezorParams, EvmSignedTx, EvmSignMsgParams, EvmSignature, EvmSignTypedDataParams, BtcGetAddressParams, BtcAddress, BtcGetPublicKeyParams, BtcPublicKey, BtcSignTxParams, BtcSignedTx, BtcSignPsbtParams, BtcSignedPsbt, BtcSignMsgParams, BtcSignature, SolGetAddressParams, SolAddress, SolSignTxParams, SolSignedTx, SolSignMsgParams, SolSignature, TronGetAddressParams, TronAddress, TronSignTxParams, TronSignedTx, TronSignMsgParams, TronSignature, HardwareEventMap, DeviceEventListener, EvmEthereumDefinitions, ConnectorDevice } from '@onekeyfe/hwk-adapter-core';
+import { IHardwareWallet, IConnector, TransportType, DeviceInfo, Response, ChainCapability, AllNetworkGetAddressParams, AllNetworkAddressResponse, DeviceAuthenticityParams, DeviceAuthenticityResult, TrezorDeviceSettingsParams, TrezorBrightnessParams, TrezorChangePinParams, UiResponseEvent, ChainForFingerprint, ICommonCallParams, EvmGetAddressParams, EvmAddress, EvmSignTxTrezorParams, EvmSignedTx, EvmSignMsgParams, EvmSignature, EvmSignTypedDataParams, BtcGetAddressParams, BtcAddress, BtcGetPublicKeyParams, BtcPublicKey, BtcSignTxParams, BtcSignedTx, BtcSignPsbtParams, BtcSignedPsbt, BtcSignMsgParams, BtcSignature, SolGetAddressParams, SolAddress, SolSignTxParams, SolSignedTx, SolSignMsgParams, SolSignature, TronGetAddressParams, TronAddress, TronSignTxParams, TronSignedTx, TronSignMsgParams, TronSignature, HardwareEventMap, DeviceEventListener, EvmEthereumDefinitions, ConnectorDevice } from '@onekeyfe/hwk-adapter-core';
 
 type TrezorPassphraseCallParams = {
     passphraseState?: string;
@@ -48,6 +48,7 @@ declare class TrezorAdapter implements IHardwareWallet {
     private static _isStaleSessionError;
     private static _errorCode;
     private static _isConnectionUnavailableError;
+    private static _isRecoverableProtocolResidueError;
     /**
      * Race a promise against an abort signal. Copied from LedgerAdapter:
      * IConnector.call() can't actually be cancelled at the protocol level, but
@@ -76,6 +77,21 @@ declare class TrezorAdapter implements IHardwareWallet {
     getSupportedChains(): ChainCapability[];
     allNetworkGetAddress(connectId: string, deviceId: string, params: AllNetworkGetAddressParams): Promise<Response<AllNetworkAddressResponse[]>>;
     getFeatures(connectId: string): Promise<Response<Record<string, unknown>>>;
+    /**
+     * Device authenticity attestation. Sends a host-generated challenge, has the
+     * device sign it with its secure-element key, then verifies the returned
+     * certificate chain up to a trusted Trezor root CA. On success returns a
+     * `deviceId` that uniquely identifies the physical device, survives wipe, and
+     * cannot be forged from a seed. Only trust the result when `verified` is true
+     * (and `usedDebugKey` is false in production).
+     *
+     * Requires a secure-element model (Safe 3 = T2B1/T3B1, Safe 5 = T3T1, T3W1)
+     * and an on-device confirmation. Older models (T1B1, T2T1) will fail.
+     *
+     * `dangerouslyAllowDebugKeys` accepts simulator / development root keys — NEVER
+     * enable it in a production accounting flow, it lets an emulator mint any id.
+     */
+    verifyDeviceAuthenticity(connectId: string, params?: DeviceAuthenticityParams): Promise<Response<DeviceAuthenticityResult>>;
     deviceSettings(connectId: string, params: TrezorDeviceSettingsParams): Promise<Response<Record<string, unknown>>>;
     setBrightness(connectId: string, params?: TrezorBrightnessParams): Promise<Response<Record<string, unknown>>>;
     changePin(connectId: string, params?: TrezorChangePinParams): Promise<Response<Record<string, unknown>>>;
@@ -192,6 +208,77 @@ declare class TrezorAdapter implements IHardwareWallet {
     private _ensureDevicePermission;
 }
 
+type CertPubKeys = {
+    rootPubKeysOptiga: string[];
+    rootPubKeysTropic?: string[];
+};
+type ModelPubKeys = CertPubKeys & {
+    debug?: CertPubKeys;
+};
+interface DeviceAuthenticityConfig {
+    version: number;
+    [model: string]: ModelPubKeys | number | undefined;
+}
+
+/** Raw fields taken from a Trezor `AuthenticityProof` message. */
+type AuthenticityProof = {
+    optiga_certificates: string[];
+    optiga_signature: string;
+    tropic_certificates?: string[];
+    tropic_signature?: string;
+    mcu_certificates?: string[];
+    mcu_signature?: string;
+};
+type AuthenticateDeviceResult = {
+    /**
+     * True only when every layer implemented by this verifier and required by
+     * the explicit model policy verified up to a trusted Trezor root CA AND the
+     * device signed our challenge:
+     *  - Optiga (all secure-element models), and
+     *  - Tropic (T3W1 / Safe 7).
+     * This is the currently implemented client policy, not full parity with the
+     * latest capability-based Trezor Connect policy. Raw MCU fields remain in the
+     * returned proof but are not yet a client-side pass/fail condition.
+     * The reward backend must independently verify the same raw proof under its
+     * own versioned policy; this client result is only a UX preview.
+     */
+    verified: boolean;
+    /**
+     * SHA3-256 of the verified Optiga device-attestation public key. It survives
+     * wipe/recovery and has one representation across supported models. Do NOT
+     * trust it when `verified` is false — it is then attacker-controlled.
+     */
+    deviceId?: string;
+    /** Raw device attestation public key (hex) from the Optiga device certificate. */
+    deviceCertPubKey?: string;
+    /** X.509 subject serial number (hex), only present on T3W1 and above. */
+    serialNumber?: string;
+    rootPubKey?: string;
+    caPubKey?: string;
+    /**
+     * True when the chain matched a DEBUG/staging root key (simulator / dev
+     * device). A production accounting flow must reject verified results that
+     * have `usedDebugKey === true`.
+     */
+    usedDebugKey?: boolean;
+    /** Failure reason when `verified` is false. */
+    error?: string;
+};
+declare const getRequiredDeviceAuthenticityLayers: (deviceModel: string) => readonly ('optiga' | 'tropic')[];
+/**
+ * Verify a Trezor `AuthenticityProof` against a challenge and derive a stable
+ * per-device id. `challenge` must be the exact random bytes sent in the
+ * `AuthenticateDevice` request. Never throws — malformed input from a malicious
+ * device is folded into `{ verified: false }`.
+ */
+declare const authenticateDeviceFromProof: ({ proof, challenge, deviceModel, config, allowDebugKeys, }: {
+    proof: AuthenticityProof;
+    challenge: Buffer;
+    deviceModel: string;
+    config?: DeviceAuthenticityConfig | undefined;
+    allowDebugKeys?: boolean | undefined;
+}) => AuthenticateDeviceResult;
+
 /**
  * Opt-in helpers for fetching Trezor Ethereum "definitions" — the SatoshiLabs-
  * signed network/token metadata a Trezor device uses to render friendly names
@@ -326,4 +413,4 @@ declare function isTrezorBleServiceUuid(uuid: string): boolean;
 declare function isTrezorBleDescriptor(descriptor: TrezorBleDescriptor): boolean;
 declare function resolveTrezorBleConnectId(descriptor: TrezorBleDescriptor): string;
 
-export { type BuildEthereumDefinitionsForPathParams, type BuildEthereumDefinitionsForSignTxParams, DEFAULT_ETHEREUM_DEFINITIONS_BASE_URL, DEFAULT_SOLANA_TOKEN_DEFINITION_BASE_URL, type FetchEthereumDefinitionsParams, type FetchLike, type FetchSolanaTokenDefinitionParams, type SdkEvent, type SdkEventListener, type SdkLogEvent, TREZOR_BLE_PACKET_SIZE, TREZOR_BLE_SUPPORTED_MODELS, TREZOR_BLE_UUIDS, TREZOR_SAFE_7_MODEL, TrezorAdapter, type TrezorBleDescriptor, type TrezorBleTransport, type TrezorBleTransportFactory, type TrezorConnectedDevice, type TrezorConnectorDevice, buildEthereumDefinitionsForPath, buildEthereumDefinitionsForSignTx, fetchEthereumDefinitions, fetchSolanaTokenDefinition, getSlip44FromPath, isTrezorBleDescriptor, isTrezorBleServiceUuid, isTrezorBleSupportedModel, isTrezorSafe7BleDescriptor, isTrezorSafe7BleName, normalizeTrezorBleUuid, offSdkEvent, onSdkEvent, resolveTrezorBleConnectId };
+export { type AuthenticateDeviceResult, type AuthenticityProof, type BuildEthereumDefinitionsForPathParams, type BuildEthereumDefinitionsForSignTxParams, DEFAULT_ETHEREUM_DEFINITIONS_BASE_URL, DEFAULT_SOLANA_TOKEN_DEFINITION_BASE_URL, type FetchEthereumDefinitionsParams, type FetchLike, type FetchSolanaTokenDefinitionParams, type SdkEvent, type SdkEventListener, type SdkLogEvent, TREZOR_BLE_PACKET_SIZE, TREZOR_BLE_SUPPORTED_MODELS, TREZOR_BLE_UUIDS, TREZOR_SAFE_7_MODEL, TrezorAdapter, type TrezorBleDescriptor, type TrezorBleTransport, type TrezorBleTransportFactory, type TrezorConnectedDevice, type TrezorConnectorDevice, authenticateDeviceFromProof, buildEthereumDefinitionsForPath, buildEthereumDefinitionsForSignTx, fetchEthereumDefinitions, fetchSolanaTokenDefinition, getRequiredDeviceAuthenticityLayers, getSlip44FromPath, isTrezorBleDescriptor, isTrezorBleServiceUuid, isTrezorBleSupportedModel, isTrezorSafe7BleDescriptor, isTrezorSafe7BleName, normalizeTrezorBleUuid, offSdkEvent, onSdkEvent, resolveTrezorBleConnectId };

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { IHardwareWallet, IConnector, TransportType, DeviceInfo, Response, ChainCapability, AllNetworkGetAddressParams, AllNetworkAddressResponse, TrezorDeviceSettingsParams, TrezorBrightnessParams, TrezorChangePinParams, UiResponseEvent, ChainForFingerprint, ICommonCallParams, EvmGetAddressParams, EvmAddress, EvmSignTxTrezorParams, EvmSignedTx, EvmSignMsgParams, EvmSignature, EvmSignTypedDataParams, BtcGetAddressParams, BtcAddress, BtcGetPublicKeyParams, BtcPublicKey, BtcSignTxParams, BtcSignedTx, BtcSignPsbtParams, BtcSignedPsbt, BtcSignMsgParams, BtcSignature, SolGetAddressParams, SolAddress, SolSignTxParams, SolSignedTx, SolSignMsgParams, SolSignature, TronGetAddressParams, TronAddress, TronSignTxParams, TronSignedTx, TronSignMsgParams, TronSignature, HardwareEventMap, DeviceEventListener, EvmEthereumDefinitions, ConnectorDevice } from '@onekeyfe/hwk-adapter-core';
+import { IHardwareWallet, IConnector, TransportType, DeviceInfo, Response, ChainCapability, AllNetworkGetAddressParams, AllNetworkAddressResponse, DeviceAuthenticityParams, DeviceAuthenticityResult, TrezorDeviceSettingsParams, TrezorBrightnessParams, TrezorChangePinParams, UiResponseEvent, ChainForFingerprint, ICommonCallParams, EvmGetAddressParams, EvmAddress, EvmSignTxTrezorParams, EvmSignedTx, EvmSignMsgParams, EvmSignature, EvmSignTypedDataParams, BtcGetAddressParams, BtcAddress, BtcGetPublicKeyParams, BtcPublicKey, BtcSignTxParams, BtcSignedTx, BtcSignPsbtParams, BtcSignedPsbt, BtcSignMsgParams, BtcSignature, SolGetAddressParams, SolAddress, SolSignTxParams, SolSignedTx, SolSignMsgParams, SolSignature, TronGetAddressParams, TronAddress, TronSignTxParams, TronSignedTx, TronSignMsgParams, TronSignature, HardwareEventMap, DeviceEventListener, EvmEthereumDefinitions, ConnectorDevice } from '@onekeyfe/hwk-adapter-core';
 
 type TrezorPassphraseCallParams = {
     passphraseState?: string;
@@ -48,6 +48,7 @@ declare class TrezorAdapter implements IHardwareWallet {
     private static _isStaleSessionError;
     private static _errorCode;
     private static _isConnectionUnavailableError;
+    private static _isRecoverableProtocolResidueError;
     /**
      * Race a promise against an abort signal. Copied from LedgerAdapter:
      * IConnector.call() can't actually be cancelled at the protocol level, but
@@ -76,6 +77,21 @@ declare class TrezorAdapter implements IHardwareWallet {
     getSupportedChains(): ChainCapability[];
     allNetworkGetAddress(connectId: string, deviceId: string, params: AllNetworkGetAddressParams): Promise<Response<AllNetworkAddressResponse[]>>;
     getFeatures(connectId: string): Promise<Response<Record<string, unknown>>>;
+    /**
+     * Device authenticity attestation. Sends a host-generated challenge, has the
+     * device sign it with its secure-element key, then verifies the returned
+     * certificate chain up to a trusted Trezor root CA. On success returns a
+     * `deviceId` that uniquely identifies the physical device, survives wipe, and
+     * cannot be forged from a seed. Only trust the result when `verified` is true
+     * (and `usedDebugKey` is false in production).
+     *
+     * Requires a secure-element model (Safe 3 = T2B1/T3B1, Safe 5 = T3T1, T3W1)
+     * and an on-device confirmation. Older models (T1B1, T2T1) will fail.
+     *
+     * `dangerouslyAllowDebugKeys` accepts simulator / development root keys — NEVER
+     * enable it in a production accounting flow, it lets an emulator mint any id.
+     */
+    verifyDeviceAuthenticity(connectId: string, params?: DeviceAuthenticityParams): Promise<Response<DeviceAuthenticityResult>>;
     deviceSettings(connectId: string, params: TrezorDeviceSettingsParams): Promise<Response<Record<string, unknown>>>;
     setBrightness(connectId: string, params?: TrezorBrightnessParams): Promise<Response<Record<string, unknown>>>;
     changePin(connectId: string, params?: TrezorChangePinParams): Promise<Response<Record<string, unknown>>>;
@@ -192,6 +208,77 @@ declare class TrezorAdapter implements IHardwareWallet {
     private _ensureDevicePermission;
 }
 
+type CertPubKeys = {
+    rootPubKeysOptiga: string[];
+    rootPubKeysTropic?: string[];
+};
+type ModelPubKeys = CertPubKeys & {
+    debug?: CertPubKeys;
+};
+interface DeviceAuthenticityConfig {
+    version: number;
+    [model: string]: ModelPubKeys | number | undefined;
+}
+
+/** Raw fields taken from a Trezor `AuthenticityProof` message. */
+type AuthenticityProof = {
+    optiga_certificates: string[];
+    optiga_signature: string;
+    tropic_certificates?: string[];
+    tropic_signature?: string;
+    mcu_certificates?: string[];
+    mcu_signature?: string;
+};
+type AuthenticateDeviceResult = {
+    /**
+     * True only when every layer implemented by this verifier and required by
+     * the explicit model policy verified up to a trusted Trezor root CA AND the
+     * device signed our challenge:
+     *  - Optiga (all secure-element models), and
+     *  - Tropic (T3W1 / Safe 7).
+     * This is the currently implemented client policy, not full parity with the
+     * latest capability-based Trezor Connect policy. Raw MCU fields remain in the
+     * returned proof but are not yet a client-side pass/fail condition.
+     * The reward backend must independently verify the same raw proof under its
+     * own versioned policy; this client result is only a UX preview.
+     */
+    verified: boolean;
+    /**
+     * SHA3-256 of the verified Optiga device-attestation public key. It survives
+     * wipe/recovery and has one representation across supported models. Do NOT
+     * trust it when `verified` is false — it is then attacker-controlled.
+     */
+    deviceId?: string;
+    /** Raw device attestation public key (hex) from the Optiga device certificate. */
+    deviceCertPubKey?: string;
+    /** X.509 subject serial number (hex), only present on T3W1 and above. */
+    serialNumber?: string;
+    rootPubKey?: string;
+    caPubKey?: string;
+    /**
+     * True when the chain matched a DEBUG/staging root key (simulator / dev
+     * device). A production accounting flow must reject verified results that
+     * have `usedDebugKey === true`.
+     */
+    usedDebugKey?: boolean;
+    /** Failure reason when `verified` is false. */
+    error?: string;
+};
+declare const getRequiredDeviceAuthenticityLayers: (deviceModel: string) => readonly ('optiga' | 'tropic')[];
+/**
+ * Verify a Trezor `AuthenticityProof` against a challenge and derive a stable
+ * per-device id. `challenge` must be the exact random bytes sent in the
+ * `AuthenticateDevice` request. Never throws — malformed input from a malicious
+ * device is folded into `{ verified: false }`.
+ */
+declare const authenticateDeviceFromProof: ({ proof, challenge, deviceModel, config, allowDebugKeys, }: {
+    proof: AuthenticityProof;
+    challenge: Buffer;
+    deviceModel: string;
+    config?: DeviceAuthenticityConfig | undefined;
+    allowDebugKeys?: boolean | undefined;
+}) => AuthenticateDeviceResult;
+
 /**
  * Opt-in helpers for fetching Trezor Ethereum "definitions" — the SatoshiLabs-
  * signed network/token metadata a Trezor device uses to render friendly names
@@ -326,4 +413,4 @@ declare function isTrezorBleServiceUuid(uuid: string): boolean;
 declare function isTrezorBleDescriptor(descriptor: TrezorBleDescriptor): boolean;
 declare function resolveTrezorBleConnectId(descriptor: TrezorBleDescriptor): string;
 
-export { type BuildEthereumDefinitionsForPathParams, type BuildEthereumDefinitionsForSignTxParams, DEFAULT_ETHEREUM_DEFINITIONS_BASE_URL, DEFAULT_SOLANA_TOKEN_DEFINITION_BASE_URL, type FetchEthereumDefinitionsParams, type FetchLike, type FetchSolanaTokenDefinitionParams, type SdkEvent, type SdkEventListener, type SdkLogEvent, TREZOR_BLE_PACKET_SIZE, TREZOR_BLE_SUPPORTED_MODELS, TREZOR_BLE_UUIDS, TREZOR_SAFE_7_MODEL, TrezorAdapter, type TrezorBleDescriptor, type TrezorBleTransport, type TrezorBleTransportFactory, type TrezorConnectedDevice, type TrezorConnectorDevice, buildEthereumDefinitionsForPath, buildEthereumDefinitionsForSignTx, fetchEthereumDefinitions, fetchSolanaTokenDefinition, getSlip44FromPath, isTrezorBleDescriptor, isTrezorBleServiceUuid, isTrezorBleSupportedModel, isTrezorSafe7BleDescriptor, isTrezorSafe7BleName, normalizeTrezorBleUuid, offSdkEvent, onSdkEvent, resolveTrezorBleConnectId };
+export { type AuthenticateDeviceResult, type AuthenticityProof, type BuildEthereumDefinitionsForPathParams, type BuildEthereumDefinitionsForSignTxParams, DEFAULT_ETHEREUM_DEFINITIONS_BASE_URL, DEFAULT_SOLANA_TOKEN_DEFINITION_BASE_URL, type FetchEthereumDefinitionsParams, type FetchLike, type FetchSolanaTokenDefinitionParams, type SdkEvent, type SdkEventListener, type SdkLogEvent, TREZOR_BLE_PACKET_SIZE, TREZOR_BLE_SUPPORTED_MODELS, TREZOR_BLE_UUIDS, TREZOR_SAFE_7_MODEL, TrezorAdapter, type TrezorBleDescriptor, type TrezorBleTransport, type TrezorBleTransportFactory, type TrezorConnectedDevice, type TrezorConnectorDevice, authenticateDeviceFromProof, buildEthereumDefinitionsForPath, buildEthereumDefinitionsForSignTx, fetchEthereumDefinitions, fetchSolanaTokenDefinition, getRequiredDeviceAuthenticityLayers, getSlip44FromPath, isTrezorBleDescriptor, isTrezorBleServiceUuid, isTrezorBleSupportedModel, isTrezorSafe7BleDescriptor, isTrezorSafe7BleName, normalizeTrezorBleUuid, offSdkEvent, onSdkEvent, resolveTrezorBleConnectId };