@onekeyfe/hwk-trezor-adapter 1.2.1 → 1.2.2-alpha.1

package/dist/index.js

@@ -12,6 +12,713 @@
 
 
 var _hwkadaptercore = require('@onekeyfe/hwk-adapter-core');
+var _utils = require('@noble/hashes/utils');
+
+// src/deviceAuthenticity/index.ts
+var _sha3 = require('@noble/hashes/sha3');
+
+// src/deviceAuthenticity/config.ts
+var deviceAuthenticityConfig = {
+  version: 2,
+  T2B1: {
+    rootPubKeysOptiga: [
+      // upstream: DEV_AUTH_ROOT_PROD_P256
+      "04ca97480ac0d7b1e6efafe518cd433cec2bf8ab9822d76eafd34363b55d63e60380bff20acc75cde03cffcb50ab6f8ce70c878e37ebc58ff7cca0a83b16b15fa5"
+    ],
+    debug: {
+      rootPubKeysOptiga: [
+        // upstream: DEV_AUTH_ROOT_DEBUG_P256 shared with T3B1
+        "047f77368dea2d4d61e989f474a56723c3212dacf8a808d8795595ef38441427c4389bc454f02089d7f08b873005e4c28d432468997871c0bf286fd3861e21e96a"
+      ]
+    }
+  },
+  T3B1: {
+    rootPubKeysOptiga: [
+      // upstream: DEV_AUTH_ROOT_PROD_P256
+      "045b5c3fdd01f3602092834209b86df0ca86a9faf25cac35c73bf6237d66eb21eafcec3706f1ccd5eb4cc7f2fa1751213eccb1c78389afba89a5788ff31ee46a5d"
+    ],
+    debug: {
+      rootPubKeysOptiga: [
+        // upstream: DEV_AUTH_ROOT_DEBUG_P256 shared with T2B1
+        "047f77368dea2d4d61e989f474a56723c3212dacf8a808d8795595ef38441427c4389bc454f02089d7f08b873005e4c28d432468997871c0bf286fd3861e21e96a"
+      ]
+    }
+  },
+  T3T1: {
+    rootPubKeysOptiga: [
+      // upstream: DEV_AUTH_ROOT_PROD_P256
+      "041854b27fb1d9f65abb66828e78c9dc0ca301e66081ab0c6a4d104f9df1cd0ad5a7c75f77a8c092f55cf825d2abaf734f934c9394d5e75f75a5a06a5ee9be93ae"
+    ],
+    debug: {
+      rootPubKeysOptiga: [
+        // upstream: DEV_AUTH_ROOT_DEBUG_P256
+        "04e48b69cd7962068d3cca3bcc6b1747ef496c1e28b5529e34ad7295215ea161dbe8fb08ae0479568f9d2cb07630cb3e52f4af0692102da5873559e45e9fa72959"
+      ]
+    }
+  },
+  T3W1: {
+    rootPubKeysOptiga: [
+      // upstream: DEV_AUTH_ROOT_PROD_P256
+      "040dde0d3e0d4da593fac6fd02a461d0e7eef238aca55c7c50b4e9ec37f3873303b6429ef1c9b78b4411a7dcbbc5dde5225979c1c2da3b073e82b1ed3f5f9825bb",
+      // upstream: DEV_AUTH_ROOT_PROD_BACKUP_P256
+      "04c6a673af4ec44b10441b1d78676e15173ad0e36df9f7f2fa1cd819955f20fe32917b60da5fed3b3aa54a9ab8b3ed27d198b3768cad26eef5935cd87af0af065e"
+    ],
+    rootPubKeysTropic: [
+      // upstream: DEV_AUTH_ROOT_PROD_ED25519
+      "59237acd17134061d655b3f8d624573ca06ce8d862f38ba4e05140ce1d3d609d",
+      // upstream: DEV_AUTH_ROOT_PROD_BACKUP_ED25519
+      "5612606584ee7e0bc313b13f7ac94156bb4cb75bd77585ddbe579301306e85f1"
+    ],
+    debug: {
+      rootPubKeysOptiga: [
+        // upstream: DEV_AUTH_ROOT_DEBUG_P256
+        "04521192e173a9da4e3023f747d836563725372681eba3079c56ff11b2fc137ab189eb4155f371127651b5594f8c332fc1e9c0f3b80d4212822668b63189706578",
+        // upstream: DEV_AUTH_ROOT_STAGING_P256
+        "0465e88f9b2cea67e8364f0cfcfacd500af24e9040b357beee629ccc4fce1704d1a7ef7284f387708f92ef14600e2caad6894016fee819d623b95d66210c3e7519"
+      ],
+      rootPubKeysTropic: [
+        // upstream: DEV_AUTH_ROOT_STAGING_ED25519
+        "cd318dc8405ae4f4144e3284dcb7b0cb0f0c2195c2ca14a0f6fccd9104e32a4b"
+      ]
+    }
+  }
+};
+
+// src/deviceAuthenticity/findSubjectContentByOid.ts
+var findSubjectContentByOid = (deviceCert, oid) => {
+  const subjectItems = deviceCert.tbsCertificate.subject;
+  const matchedItem = subjectItems.find(({ algorithmOid }) => algorithmOid === oid);
+  if (!matchedItem || !matchedItem.parameters) return null;
+  return matchedItem.parameters.asn1.contents;
+};
+
+// src/deviceAuthenticity/validateCaCertExtensions.ts
+var validateCaCertExtensions = (cert, pathLen) => {
+  let hasKeyUsage = false;
+  let hasBasicConstraints = false;
+  cert.tbsCertificate.extensions.forEach((ext) => {
+    if (ext.key === "keyUsage") {
+      if (ext.keyCertSign !== "1") {
+        throw new Error(`CA keyCertSign not set`);
+      }
+      hasKeyUsage = true;
+    } else if (ext.key === "basicConstraints") {
+      if (!ext.cA) {
+        throw new Error(`CA basicConstraints.cA not set`);
+      }
+      if (typeof ext.pathLenConstraint !== "number") {
+        throw new Error("CA basicConstraints.pathLenConstraint not set");
+      }
+      if (ext.pathLenConstraint < pathLen) {
+        throw new Error("Issuer was not permitted to issue certificate");
+      }
+      hasBasicConstraints = true;
+    } else if (ext.critical) {
+      throw new Error(`Unknown critical extension ${ext.key} in CA certificate`);
+    }
+  });
+  if (!hasKeyUsage || !hasBasicConstraints) {
+    throw new Error(
+      `CA missing extensions keyUsage: ${hasKeyUsage}, basicConstraints: ${hasBasicConstraints}`
+    );
+  }
+};
+
+// src/deviceAuthenticity/verifySignatures.ts
+var _ed25519 = require('@noble/curves/ed25519');
+var _p256 = require('@noble/curves/p256');
+var _sha256 = require('@noble/hashes/sha256');
+
+// src/deviceAuthenticity/x509certificate.ts
+var parseOidToAlgorithmName = (oid) => {
+  if (oid === "1.2.840.10045.4.3.2") return "P-256";
+  if (oid === "1.3.101.112") return "Ed25519";
+  if (oid === "2.16.840.1.101.3.4.3.17") return "MLDSA44";
+  return "unknown";
+};
+var derToAsn1 = (byteArray) => {
+  let position = 0;
+  function getTag() {
+    let tag2 = byteArray[0] & 31;
+    position += 1;
+    if (tag2 === 31) {
+      tag2 = 0;
+      while (byteArray[position] >= 128) {
+        tag2 = tag2 * 128 + byteArray[position] - 128;
+        position += 1;
+      }
+      tag2 = tag2 * 128 + byteArray[position] - 128;
+      position += 1;
+    }
+    return tag2;
+  }
+  function getLength() {
+    let length2 = 0;
+    if (byteArray[position] < 128) {
+      length2 = byteArray[position];
+      position += 1;
+    } else {
+      const numberOfDigits = byteArray[position] & 127;
+      position += 1;
+      length2 = 0;
+      for (let i = 0; i < numberOfDigits; i++) {
+        length2 = length2 * 256 + byteArray[position];
+        position += 1;
+      }
+    }
+    return length2;
+  }
+  const cls = (byteArray[0] & 192) / 64;
+  const structured = (byteArray[0] & 32) === 32;
+  const tag = getTag();
+  if (byteArray[position] === 128) {
+    throw new Error("Unsupported length encoding");
+  }
+  const length = getLength();
+  const byteLength = position + length;
+  const contents = byteArray.subarray(position, byteLength);
+  const raw = byteArray.subarray(0, byteLength);
+  return {
+    cls,
+    tag,
+    structured,
+    byteLength,
+    contents,
+    raw
+  };
+};
+var derToAsn1List = (byteArray) => {
+  const result = [];
+  let nextPosition = 0;
+  while (nextPosition < byteArray.length) {
+    const nextPiece = derToAsn1(byteArray.subarray(nextPosition));
+    result.push(nextPiece);
+    nextPosition += nextPiece.byteLength;
+  }
+  return result;
+};
+var derBitStringValue = (byteArray) => ({
+  unusedBits: byteArray[0],
+  bytes: byteArray.subarray(1)
+});
+var parseSignatureValue = (asn1) => {
+  if (asn1.cls !== 0 || asn1.tag !== 3 || asn1.structured) {
+    throw new Error("Bad signature value. Not a BIT STRING.");
+  }
+  return {
+    asn1,
+    bits: derBitStringValue(asn1.contents)
+  };
+};
+var fixSignature = (byteArray) => {
+  const asn1 = derToAsn1(byteArray);
+  if (asn1.cls !== 0 || asn1.tag !== 16 || !asn1.structured) {
+    throw new Error("Bad signature. Not a SEQUENCE.");
+  }
+  const items = derToAsn1List(asn1.contents);
+  let newLength = 0;
+  const fixedItems = items.map((chunk) => {
+    const index = chunk.contents.findIndex((value) => value > 0);
+    const data = chunk.contents.subarray(index);
+    const offset = data[0] >= 128 ? 1 : 0;
+    const chunkLength = data.length + offset;
+    const newChunk = new Uint8Array(chunkLength + 2);
+    newChunk.set([chunk.raw[0], chunkLength]);
+    if (offset > 0) {
+      newChunk.set([0], 2);
+    }
+    newChunk.set(data, 2 + offset);
+    newLength += newChunk.length;
+    return newChunk;
+  });
+  const signature = new Uint8Array(newLength + 2);
+  signature.set([byteArray[0], newLength]);
+  let signatureOffset = 2;
+  fixedItems.forEach((item) => {
+    signature.set(item, signatureOffset);
+    signatureOffset += item.length;
+  });
+  return signature;
+};
+var derObjectIdentifierValue = (byteArray) => {
+  let oid = `${Math.floor(byteArray[0] / 40)}.${byteArray[0] % 40}`;
+  let position = 1;
+  while (position < byteArray.length) {
+    let nextInteger = 0;
+    while (byteArray[position] >= 128) {
+      nextInteger = nextInteger * 128 + (byteArray[position] & 127);
+      position += 1;
+    }
+    nextInteger = nextInteger * 128 + byteArray[position];
+    position += 1;
+    oid += `.${nextInteger}`;
+  }
+  return oid;
+};
+var parseAlgorithmIdentifier = (asn1) => {
+  if (asn1.cls !== 0 || asn1.tag !== 16 || !asn1.structured) {
+    throw new Error("Bad algorithm identifier. Not a SEQUENCE.");
+  }
+  const pieces = derToAsn1List(asn1.contents);
+  if (pieces.length > 2) {
+    throw new Error("Bad algorithm identifier. Contains too many child objects.");
+  }
+  const encodedAlgorithm = pieces[0];
+  if (encodedAlgorithm.cls !== 0 || encodedAlgorithm.tag !== 6 || encodedAlgorithm.structured) {
+    throw new Error("Bad algorithm identifier. Does not begin with an OBJECT IDENTIFIER.");
+  }
+  const algorithmOid = derObjectIdentifierValue(encodedAlgorithm.contents);
+  const algorithmName = parseOidToAlgorithmName(algorithmOid);
+  return {
+    asn1,
+    algorithmOid,
+    algorithmName,
+    parameters: pieces.length === 2 ? { asn1: pieces[1] } : null
+  };
+};
+var parseName = (asn1) => (
+  // SEQUENCE > SET > SEQUENCE
+  derToAsn1List(asn1.contents).map((item) => {
+    const attrSet = derToAsn1(item.contents);
+    return parseAlgorithmIdentifier(attrSet);
+  })
+);
+var parseSubjectPublicKeyInfo = (asn1) => {
+  if (asn1.cls !== 0 || asn1.tag !== 16 || !asn1.structured) {
+    throw new Error("Bad SPKI. Not a SEQUENCE.");
+  }
+  const pieces = derToAsn1List(asn1.contents);
+  if (pieces.length !== 2) {
+    throw new Error("Bad SubjectPublicKeyInfo. Wrong number of child objects.");
+  }
+  return {
+    asn1,
+    algorithm: parseAlgorithmIdentifier(pieces[0]),
+    bits: derBitStringValue(pieces[1].contents)
+  };
+};
+var parseUtcTime = (time) => {
+  let offset = 4;
+  let yearOffset = 0;
+  if (time.tag === 23) {
+    offset = 2;
+    yearOffset = 2e3;
+  }
+  const utc = Buffer.from(time.contents).toString();
+  const year = yearOffset + Number(utc.substring(0, offset));
+  const month = Number(utc.substring(offset, offset + 2)) - 1;
+  const day = Number(utc.substring(offset + 2, offset + 4));
+  const hour = Number(utc.substring(offset + 4, offset + 6));
+  const minute = Number(utc.substring(offset + 6, offset + 8));
+  const date = /* @__PURE__ */ new Date();
+  date.setUTCFullYear(year, month, day);
+  date.setUTCHours(hour, minute, 0);
+  return date;
+};
+var parseValidity = (asn1) => {
+  const [from, to] = derToAsn1List(asn1.contents);
+  return {
+    from: parseUtcTime(from),
+    to: parseUtcTime(to)
+  };
+};
+var parseExtensions = (data) => {
+  const asn1 = derToAsn1(data.contents);
+  if (asn1.cls !== 0 || asn1.tag !== 16 || !asn1.structured) {
+    throw new Error("This can't be a Extension. Wrong data type.");
+  }
+  const readBoolean = (value) => {
+    if (!value) return false;
+    if (value.cls !== 0 || value.tag !== 1 || value.contents.length !== 1 || value.structured) {
+      throw new Error("This can't be a boolean. Wrong data type.");
+    }
+    if (![0, 255].includes(value.contents[0])) {
+      throw new Error("Invalid boolean value.");
+    }
+    return value.contents[0] === 255;
+  };
+  const readBitString = (uint8Array) => {
+    const buffer = Buffer.from(uint8Array);
+    const tag = buffer.readUInt8(0);
+    if (tag !== 3) {
+      throw new Error("This can't be a bit string. Wrong data type.");
+    }
+    const length = buffer.readUInt8(1);
+    const unusedBits = buffer.readUInt8(2);
+    const bitStringBytes = buffer.subarray(3, 3 + length - 1);
+    const bitString = bitStringBytes.reduce(
+      (str, byte) => str + byte.toString(2).padStart(8, "0"),
+      ""
+    );
+    return bitString.slice(0, bitString.length - unusedBits);
+  };
+  const readInteger = (value) => {
+    if (!value) return void 0;
+    if (value.cls !== 0 || value.tag !== 2 || value.contents.length !== 1 || value.structured) {
+      throw new Error("This can't be a integer. Wrong data type.");
+    }
+    return Buffer.from(value.contents).readInt8();
+  };
+  const extensions = [];
+  derToAsn1List(asn1.contents).forEach((item) => {
+    const [id, ...pieces] = derToAsn1List(item.contents);
+    if (id.cls !== 0 || id.tag !== 6 || id.structured) {
+      throw new Error("Bad extension. Does not begin with an OBJECT IDENTIFIER.");
+    }
+    const algorithm = derObjectIdentifierValue(id.contents);
+    const critical = pieces.length > 1 ? readBoolean(pieces[0]) : false;
+    const extnValue = pieces.length > 1 ? pieces[1] : pieces[0];
+    if (extnValue.cls !== 0 || extnValue.tag !== 4 || extnValue.structured) {
+      throw new Error("This can't be a octet string. Wrong data type.");
+    }
+    if (algorithm === "2.5.29.15") {
+      extensions.push({
+        key: "keyUsage",
+        critical,
+        keyCertSign: readBitString(extnValue.contents)[5]
+      });
+    } else if (algorithm === "2.5.29.19") {
+      const fields = derToAsn1List(derToAsn1(extnValue.contents).contents);
+      const ca = fields.length > 0 && fields[0].tag === 1 ? fields[0] : void 0;
+      const len = fields.length > 0 && fields[0].tag === 2 ? fields[0] : fields[1];
+      extensions.push({
+        key: "basicConstraints",
+        critical,
+        cA: readBoolean(ca),
+        pathLenConstraint: readInteger(len)
+      });
+    } else {
+      extensions.push({
+        key: algorithm,
+        critical,
+        ...item
+      });
+    }
+  });
+  return extensions;
+};
+var parseTBSCertificate = (asn1) => {
+  if (asn1.cls !== 0 || asn1.tag !== 16 || !asn1.structured) {
+    throw new Error("This can't be a TBSCertificate. Wrong data type.");
+  }
+  const pieces = derToAsn1List(asn1.contents);
+  if (pieces.length < 7) {
+    throw new Error("Bad TBS Certificate. There are fewer than the seven required children.");
+  }
+  return {
+    asn1,
+    version: pieces[0],
+    serialNumber: pieces[1],
+    signature: parseAlgorithmIdentifier(pieces[2]),
+    issuer: pieces[3],
+    validity: parseValidity(pieces[4]),
+    subject: parseName(pieces[5]),
+    subjectPublicKeyInfo: parseSubjectPublicKeyInfo(pieces[6]),
+    extensions: parseExtensions(pieces[7])
+  };
+};
+var parseCertificate = (byteArray) => {
+  const asn1 = derToAsn1(byteArray);
+  if (asn1.cls !== 0 || asn1.tag !== 16 || !asn1.structured) {
+    throw new Error("This can't be an X.509 certificate. Wrong data type.");
+  }
+  const pieces = derToAsn1List(asn1.contents);
+  if (pieces.length !== 3) {
+    throw new Error("Certificate contains more than the three specified children.");
+  }
+  return {
+    asn1,
+    tbsCertificate: parseTBSCertificate(pieces[0]),
+    signatureAlgorithm: parseAlgorithmIdentifier(pieces[1]),
+    signatureValue: parseSignatureValue(pieces[2])
+  };
+};
+
+// src/deviceAuthenticity/verifySignatures.ts
+var verifySignatureP256 = (rawKey, data, signature) => {
+  try {
+    const sig = _p256.p256.Signature.fromDER(Buffer.from(fixSignature(signature)).toString("hex"));
+    return _p256.p256.verify(sig.toBytes("compact"), _sha256.sha256.call(void 0, data), rawKey, { lowS: false });
+  } catch (e) {
+    return false;
+  }
+};
+var verifySignatureEd25519 = (rawKey, data, signature) => {
+  try {
+    return _ed25519.ed25519.verify(signature, data, rawKey);
+  } catch (e2) {
+    return false;
+  }
+};
+var getVerifyFn = (algorithmName) => {
+  if (algorithmName === "P-256") return verifySignatureP256;
+  if (algorithmName === "Ed25519") return verifySignatureEd25519;
+  throw new Error(`Unsupported signature algorithm: ${algorithmName}`);
+};
+
+// src/deviceAuthenticity/verifyAuthenticityProof.ts
+var getChunkSize = (byteLength) => {
+  if (byteLength < 253) return Uint8Array.from([byteLength]);
+  if (byteLength <= 65535) {
+    const b2 = Buffer.alloc(3);
+    b2[0] = 253;
+    b2.writeUInt16LE(byteLength, 1);
+    return Uint8Array.from(b2);
+  }
+  const b = Buffer.alloc(5);
+  b[0] = 254;
+  b.writeUInt32LE(byteLength, 1);
+  return Uint8Array.from(b);
+};
+var prepareDeviceAuthenticityData = ({
+  payload,
+  prefix = "AuthenticateDevice:"
+}) => {
+  const chunks = [
+    Uint8Array.from(Buffer.from(prefix)),
+    ...(Array.isArray(payload) ? payload : [payload]).map((chunk) => Uint8Array.from(chunk))
+  ];
+  const framed = chunks.flatMap((chunk) => [getChunkSize(chunk.byteLength), chunk]);
+  const result = new Uint8Array(framed.reduce((total, chunk) => total + chunk.byteLength, 0));
+  let offset = 0;
+  for (const chunk of framed) {
+    result.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return result;
+};
+var getRootPubKeys = ({
+  config,
+  deviceModel,
+  proofType,
+  allowDebugKeys
+}) => {
+  const modelConfig = config[deviceModel];
+  if (!modelConfig || typeof modelConfig === "number") {
+    throw new Error(`Pubkeys for ${deviceModel} not found in config`);
+  }
+  const prod = proofType === "optiga" ? _nullishCoalesce(modelConfig.rootPubKeysOptiga, () => ( [])) : _nullishCoalesce(modelConfig.rootPubKeysTropic, () => ( []));
+  if (!allowDebugKeys) return prod;
+  return [
+    ...prod,
+    ...proofType === "optiga" ? _nullishCoalesce(_optionalChain([modelConfig, 'access', _2 => _2.debug, 'optionalAccess', _3 => _3.rootPubKeysOptiga]), () => ( [])) : _nullishCoalesce(_optionalChain([modelConfig, 'access', _4 => _4.debug, 'optionalAccess', _5 => _5.rootPubKeysTropic]), () => ( []))
+  ];
+};
+var matchRootPubKeyToCertificate = ({
+  cert,
+  allRootPubKeys
+}) => {
+  const verifySignatureFn = getVerifyFn(cert.signatureAlgorithm.algorithmName);
+  return allRootPubKeys.find(
+    (rootPubKey) => verifySignatureFn(
+      Uint8Array.from(Buffer.from(rootPubKey, "hex")),
+      cert.tbsCertificate.asn1.raw,
+      cert.signatureValue.bits.bytes
+    )
+  );
+};
+var parseModelFromDeviceCertSubject = (deviceCert) => {
+  const modelDescriptionBytes = findSubjectContentByOid(deviceCert, "2.5.4.3");
+  if (modelDescriptionBytes === null) return null;
+  return Buffer.from(modelDescriptionBytes.subarray(0, 4)).toString();
+};
+var parseSerialNumberFromDeviceCert = (deviceCert) => {
+  const serialNumber = findSubjectContentByOid(deviceCert, "2.5.4.5");
+  if (serialNumber === null) return void 0;
+  return Buffer.from(serialNumber).toString("hex");
+};
+var verifyAuthenticityProof = ({
+  proofType,
+  certificates,
+  signature,
+  signedData,
+  deviceModel,
+  config,
+  allowDebugKeys,
+  caPubKeyBlacklist: caPubKeyBlacklist2 = []
+}) => {
+  const allRootPubKeys = getRootPubKeys({
+    config,
+    deviceModel,
+    proofType,
+    allowDebugKeys
+  });
+  const parsedCertificates = certificates.map(
+    (c) => parseCertificate(new Uint8Array(Buffer.from(c, "hex")))
+  );
+  const firstCertAlgName = _optionalChain([parsedCertificates, 'access', _6 => _6[0], 'optionalAccess', _7 => _7.signatureAlgorithm, 'access', _8 => _8.algorithmName]);
+  const expectedAlgorithmName = proofType === "optiga" ? "P-256" : "Ed25519";
+  if (firstCertAlgName !== expectedAlgorithmName) {
+    return { valid: false, error: "RESPONSE_MALFORMED" };
+  }
+  if (parsedCertificates.length !== 2) {
+    return { valid: false, error: "RESPONSE_MALFORMED" };
+  }
+  const [deviceCert, caCert] = parsedCertificates;
+  const deviceCertPubKey = Buffer.from(
+    deviceCert.tbsCertificate.subjectPublicKeyInfo.bits.bytes
+  ).toString("hex");
+  const deviceCertAlgName = deviceCert.signatureAlgorithm.algorithmName;
+  const caCertAlgName = caCert.signatureAlgorithm.algorithmName;
+  if (deviceCertAlgName !== caCertAlgName) {
+    return { valid: false, deviceCertPubKey, error: "RESPONSE_MALFORMED" };
+  }
+  validateCaCertExtensions(caCert, 0);
+  const verifySignatureFn = getVerifyFn(deviceCertAlgName);
+  const caPubKeyBytes = caCert.tbsCertificate.subjectPublicKeyInfo.bits.bytes;
+  const caPubKey = Buffer.from(caPubKeyBytes).toString("hex");
+  const rootPubKeyMatch = matchRootPubKeyToCertificate({ allRootPubKeys, cert: caCert });
+  if (rootPubKeyMatch === void 0) {
+    return { valid: false, caPubKey, deviceCertPubKey, error: "ROOT_PUBKEY_NOT_FOUND" };
+  }
+  if (caPubKeyBlacklist2.includes(caPubKey)) {
+    return {
+      valid: false,
+      caPubKey,
+      rootPubKey: rootPubKeyMatch,
+      deviceCertPubKey,
+      error: "CA_PUBKEY_BLACKLISTED"
+    };
+  }
+  const now = Date.now();
+  const isWithinValidity = (validity) => validity.from.getTime() <= now && now <= validity.to.getTime();
+  if (!isWithinValidity(caCert.tbsCertificate.validity) || !isWithinValidity(deviceCert.tbsCertificate.validity)) {
+    return {
+      valid: false,
+      caPubKey,
+      rootPubKey: rootPubKeyMatch,
+      deviceCertPubKey,
+      error: "CERTIFICATE_EXPIRED"
+    };
+  }
+  const modelFromSubject = parseModelFromDeviceCertSubject(deviceCert);
+  if (modelFromSubject !== deviceModel) {
+    return {
+      valid: false,
+      caPubKey,
+      rootPubKey: rootPubKeyMatch,
+      deviceCertPubKey,
+      error: "INVALID_DEVICE_MODEL"
+    };
+  }
+  const isDeviceCertValid = verifySignatureFn(
+    Uint8Array.from(caPubKeyBytes),
+    deviceCert.tbsCertificate.asn1.raw,
+    deviceCert.signatureValue.bits.bytes
+  );
+  if (!isDeviceCertValid) {
+    return {
+      valid: false,
+      caPubKey,
+      rootPubKey: rootPubKeyMatch,
+      deviceCertPubKey,
+      error: "INVALID_DEVICE_CERTIFICATE"
+    };
+  }
+  const isSignatureValid = verifySignatureFn(
+    Uint8Array.from(deviceCert.tbsCertificate.subjectPublicKeyInfo.bits.bytes),
+    signedData,
+    Uint8Array.from(Buffer.from(signature, "hex"))
+  );
+  if (!isSignatureValid) {
+    return {
+      valid: false,
+      caPubKey,
+      rootPubKey: rootPubKeyMatch,
+      deviceCertPubKey,
+      error: "INVALID_DEVICE_SIGNATURE"
+    };
+  }
+  return {
+    valid: true,
+    caPubKey,
+    rootPubKey: rootPubKeyMatch,
+    deviceCertPubKey,
+    serialNumber: parseSerialNumberFromDeviceCert(deviceCert)
+  };
+};
+
+// src/deviceAuthenticity/index.ts
+var caPubKeyBlacklist = [];
+var modelConfigOf = (config, deviceModel) => {
+  const modelConfig = config[deviceModel];
+  return modelConfig && typeof modelConfig !== "number" ? modelConfig : void 0;
+};
+var getRequiredDeviceAuthenticityLayers = (deviceModel) => deviceModel === "T3W1" ? ["optiga", "tropic"] : ["optiga"];
+var isTropicExpected = (deviceModel) => getRequiredDeviceAuthenticityLayers(deviceModel).includes("tropic");
+var matchedDebugKey = (config, deviceModel, rootPubKey) => {
+  if (!rootPubKey) return false;
+  const m = modelConfigOf(config, deviceModel);
+  if (!_optionalChain([m, 'optionalAccess', _9 => _9.debug])) return false;
+  return [..._nullishCoalesce(m.debug.rootPubKeysOptiga, () => ( [])), ..._nullishCoalesce(m.debug.rootPubKeysTropic, () => ( []))].includes(
+    rootPubKey
+  );
+};
+var authenticateDeviceFromProof = ({
+  proof,
+  challenge,
+  deviceModel,
+  config = deviceAuthenticityConfig,
+  allowDebugKeys
+}) => {
+  try {
+    const signedData = prepareDeviceAuthenticityData({ payload: challenge });
+    const common = { signedData, deviceModel, config, allowDebugKeys, caPubKeyBlacklist };
+    const { optiga_certificates: optigaCertificates, optiga_signature: optigaSignature } = proof;
+    if (!optigaSignature || !_optionalChain([optigaCertificates, 'optionalAccess', _10 => _10.length])) {
+      return { verified: false, error: "RESPONSE_PAYLOAD_MISSING" };
+    }
+    const optiga = verifyAuthenticityProof({
+      ...common,
+      proofType: "optiga",
+      certificates: optigaCertificates,
+      signature: optigaSignature
+    });
+    if (!optiga.valid) {
+      return {
+        verified: false,
+        deviceCertPubKey: optiga.deviceCertPubKey,
+        caPubKey: optiga.caPubKey,
+        rootPubKey: optiga.rootPubKey,
+        error: optiga.error
+      };
+    }
+    let usedDebugKey = matchedDebugKey(config, deviceModel, optiga.rootPubKey);
+    if (isTropicExpected(deviceModel)) {
+      const { tropic_certificates: tropicCertificates, tropic_signature: tropicSignature } = proof;
+      if (!tropicSignature || !_optionalChain([tropicCertificates, 'optionalAccess', _11 => _11.length])) {
+        return { verified: false, error: "RESPONSE_PAYLOAD_MISSING" };
+      }
+      const tropic = verifyAuthenticityProof({
+        ...common,
+        proofType: "tropic",
+        certificates: tropicCertificates,
+        signature: tropicSignature
+      });
+      if (!tropic.valid) {
+        return { verified: false, error: tropic.error };
+      }
+      usedDebugKey = usedDebugKey || matchedDebugKey(config, deviceModel, tropic.rootPubKey);
+    }
+    const deviceId = Buffer.from(
+      _sha3.sha3_256.call(void 0, Uint8Array.from(Buffer.from(optiga.deviceCertPubKey, "hex")))
+    ).toString("hex");
+    return {
+      verified: true,
+      deviceId,
+      deviceCertPubKey: optiga.deviceCertPubKey,
+      serialNumber: optiga.serialNumber,
+      rootPubKey: optiga.rootPubKey,
+      caPubKey: optiga.caPubKey,
+      usedDebugKey
+    };
+  } catch (error) {
+    return {
+      verified: false,
+      error: `RESPONSE_MALFORMED: ${_nullishCoalesce(_optionalChain([error, 'optionalAccess', _12 => _12.message]), () => ( "parse error"))}`
+    };
+  }
+};
 
 // src/utils/sdkEventBus.ts
 var listeners = /* @__PURE__ */ new Set();
@@ -29,7 +736,7 @@ function emitSdkEvent(event) {
   for (const listener of listeners) {
     try {
       listener(event);
-    } catch (e) {
+    } catch (e3) {
     }
   }
 }
@@ -45,7 +752,7 @@ ${value.stack}` : value.message;
   }
   try {
     return JSON.stringify(value);
-  } catch (e2) {
+  } catch (e4) {
     return String(value);
   }
 }
@@ -122,8 +829,8 @@ var _TrezorAdapter = class _TrezorAdapter {
             ...data,
             payload: {
               ...payload,
-              ..._optionalChain([context, 'optionalAccess', _2 => _2.passphraseState]) !== void 0 ? { passphraseState: context.passphraseState } : {},
-              ..._optionalChain([context, 'optionalAccess', _3 => _3.useEmptyPassphrase]) !== void 0 ? { useEmptyPassphrase: context.useEmptyPassphrase } : {}
+              ..._optionalChain([context, 'optionalAccess', _13 => _13.passphraseState]) !== void 0 ? { passphraseState: context.passphraseState } : {},
+              ..._optionalChain([context, 'optionalAccess', _14 => _14.useEmptyPassphrase]) !== void 0 ? { useEmptyPassphrase: context.useEmptyPassphrase } : {}
             }
           }
         );
@@ -177,9 +884,9 @@ var _TrezorAdapter = class _TrezorAdapter {
     return { rest: _nullishCoalesce(params, () => ( {})) };
   }
   static _withAllNetworkRequestCommonParams(item, commonParams) {
-    const autoInstallApp = _optionalChain([commonParams, 'optionalAccess', _4 => _4.autoInstallApp]);
-    const passphraseState = _optionalChain([commonParams, 'optionalAccess', _5 => _5.passphraseState]);
-    const useEmptyPassphrase = _optionalChain([commonParams, 'optionalAccess', _6 => _6.useEmptyPassphrase]);
+    const autoInstallApp = _optionalChain([commonParams, 'optionalAccess', _15 => _15.autoInstallApp]);
+    const passphraseState = _optionalChain([commonParams, 'optionalAccess', _16 => _16.passphraseState]);
+    const useEmptyPassphrase = _optionalChain([commonParams, 'optionalAccess', _17 => _17.useEmptyPassphrase]);
     if (autoInstallApp === void 0 && passphraseState === void 0 && useEmptyPassphrase === void 0) {
       return item;
     }
@@ -243,8 +950,8 @@ var _TrezorAdapter = class _TrezorAdapter {
     };
   }
   static _trezorFailureMessage(error) {
-    const response = _optionalChain([error, 'optionalAccess', _7 => _7.response]);
-    const message = _optionalChain([response, 'optionalAccess', _8 => _8.message]);
+    const response = _optionalChain([error, 'optionalAccess', _18 => _18.response]);
+    const message = _optionalChain([response, 'optionalAccess', _19 => _19.message]);
     if (!message || typeof message !== "object") return {};
     const failureMessage = message;
     return {
@@ -253,7 +960,7 @@ var _TrezorAdapter = class _TrezorAdapter {
     };
   }
   static _mapTrezorFailureCode(error) {
-    const directCode = _optionalChain([error, 'optionalAccess', _9 => _9.code]);
+    const directCode = _optionalChain([error, 'optionalAccess', _20 => _20.code]);
     if (directCode === "Device_InitializeFailed") {
       return _hwkadaptercore.HardwareErrorCode.PinCancelled;
     }
@@ -266,7 +973,7 @@ var _TrezorAdapter = class _TrezorAdapter {
     if (directCode === "Failure_UnexpectedMessage") {
       return _hwkadaptercore.HardwareErrorCode.MethodNotSupported;
     }
-    const message = _optionalChain([error, 'optionalAccess', _10 => _10.message]);
+    const message = _optionalChain([error, 'optionalAccess', _21 => _21.message]);
     if (typeof message === "string" && message.includes("Failed to execute 'transfer") && message.includes("on 'USBDevice'")) {
       return _hwkadaptercore.HardwareErrorCode.TransportError;
     }
@@ -323,6 +1030,10 @@ var _TrezorAdapter = class _TrezorAdapter {
     const { code } = error;
     return code === _hwkadaptercore.HardwareErrorCode.DeviceNotFound || code === _hwkadaptercore.HardwareErrorCode.DeviceDisconnected;
   }
+  static _isRecoverableProtocolResidueError(error) {
+    const protocolError = error;
+    return protocolError.name === "TrezorProtocolError" && protocolError.code === "Malformed protocol format" && protocolError.message === "Malformed protocol format";
+  }
   /**
    * Race a promise against an abort signal. Copied from LedgerAdapter:
    * IConnector.call() can't actually be cancelled at the protocol level, but
@@ -353,8 +1064,8 @@ var _TrezorAdapter = class _TrezorAdapter {
     });
   }
   async _connectSession(connectId, signal) {
-    const connectPromise = this._connector.connect(connectId);
-    const session = await (async () => {
+    const connectOnce = async () => {
+      const connectPromise = this._connector.connect(connectId);
       if (!signal) return connectPromise;
       try {
         return await _TrezorAdapter._abortable(signal, connectPromise);
@@ -365,7 +1076,19 @@ var _TrezorAdapter = class _TrezorAdapter {
         );
         throw error;
       }
-    })();
+    };
+    let session;
+    try {
+      session = await connectOnce();
+    } catch (error) {
+      if (_optionalChain([signal, 'optionalAccess', _22 => _22.aborted]) || !_TrezorAdapter._isRecoverableProtocolResidueError(error)) {
+        throw error;
+      }
+      debugLog("[TrezorAdapter] retrying connect after draining a stale THP frame", {
+        connectId
+      });
+      session = await connectOnce();
+    }
     if (this._disconnectRequested.delete(connectId)) {
       await this._connector.disconnect(session.sessionId).catch(() => void 0);
       throw Object.assign(new Error("Trezor connection aborted"), {
@@ -414,7 +1137,7 @@ var _TrezorAdapter = class _TrezorAdapter {
   async searchDevices(options) {
     await this._ensureDevicePermission();
     const scanned = await this._connector.searchDevices(
-      _optionalChain([options, 'optionalAccess', _11 => _11.waitForAllTransports]) ? { waitForAll: true } : void 0
+      _optionalChain([options, 'optionalAccess', _23 => _23.waitForAllTransports]) ? { waitForAll: true } : void 0
     );
     const scannedIds = new Set(scanned.map((d) => d.connectId));
     for (const connectId of [...this._devices.keys()]) {
@@ -461,7 +1184,7 @@ var _TrezorAdapter = class _TrezorAdapter {
     let liveDeviceId = "";
     const topLevelFailureIndexes = /* @__PURE__ */ new Set();
     const isSingleNetworkBundle = params.bundle.every(
-      (item) => item.network === _optionalChain([params, 'access', _12 => _12.bundle, 'access', _13 => _13[0], 'optionalAccess', _14 => _14.network])
+      (item) => item.network === _optionalChain([params, 'access', _24 => _24.bundle, 'access', _25 => _25[0], 'optionalAccess', _26 => _26.network])
     );
     const getLiveDeviceId = async () => {
       if (liveDeviceId) return _hwkadaptercore.success.call(void 0, liveDeviceId);
@@ -521,7 +1244,7 @@ var _TrezorAdapter = class _TrezorAdapter {
       // One named boolean per abort reason.
       shouldAbortBundle: (response, { index }) => {
         const isSessionLevelFailure = topLevelFailureIndexes.has(index);
-        const isWholeChainForbidden = isSingleNetworkBundle && _optionalChain([response, 'access', _15 => _15.payload, 'optionalAccess', _16 => _16.code]) === _hwkadaptercore.HardwareErrorCode.DevicePathForbidden;
+        const isWholeChainForbidden = isSingleNetworkBundle && _optionalChain([response, 'access', _27 => _27.payload, 'optionalAccess', _28 => _28.code]) === _hwkadaptercore.HardwareErrorCode.DevicePathForbidden;
         return isSessionLevelFailure || isWholeChainForbidden;
       }
     });
@@ -529,6 +1252,64 @@ var _TrezorAdapter = class _TrezorAdapter {
   getFeatures(connectId) {
     return this._callDeviceManagerMethod("getFeatures", connectId, {});
   }
+  /**
+   * Device authenticity attestation. Sends a host-generated challenge, has the
+   * device sign it with its secure-element key, then verifies the returned
+   * certificate chain up to a trusted Trezor root CA. On success returns a
+   * `deviceId` that uniquely identifies the physical device, survives wipe, and
+   * cannot be forged from a seed. Only trust the result when `verified` is true
+   * (and `usedDebugKey` is false in production).
+   *
+   * Requires a secure-element model (Safe 3 = T2B1/T3B1, Safe 5 = T3T1, T3W1)
+   * and an on-device confirmation. Older models (T1B1, T2T1) will fail.
+   *
+   * `dangerouslyAllowDebugKeys` accepts simulator / development root keys — NEVER
+   * enable it in a production accounting flow, it lets an emulator mint any id.
+   */
+  async verifyDeviceAuthenticity(connectId, params = {}) {
+    if (params.challenge && params.dangerouslyAllowDebugKeys) {
+      return _hwkadaptercore.failure.call(void 0, 
+        _hwkadaptercore.HardwareErrorCode.InvalidParams,
+        "Debug attestation roots cannot be used with a server challenge"
+      );
+    }
+    if (params.challenge && !/^[0-9a-fA-F]{64}$/.test(params.challenge)) {
+      return _hwkadaptercore.failure.call(void 0, 
+        _hwkadaptercore.HardwareErrorCode.InvalidParams,
+        "Device authenticity challenge must be exactly 32 bytes encoded as hex"
+      );
+    }
+    const featuresRes = await this.getFeatures(connectId);
+    if (!featuresRes.success) return featuresRes;
+    const internalModel = featuresRes.payload.internal_model;
+    if (!internalModel) {
+      return _hwkadaptercore.failure.call(void 0, _hwkadaptercore.HardwareErrorCode.UnknownError, "Device internal_model unavailable");
+    }
+    const challengeHex = _nullishCoalesce(_optionalChain([params, 'access', _29 => _29.challenge, 'optionalAccess', _30 => _30.toLowerCase, 'call', _31 => _31()]), () => ( Buffer.from(_utils.randomBytes.call(void 0, 32)).toString("hex")));
+    const challenge = Buffer.from(challengeHex, "hex");
+    const proofRes = await this._callDeviceManagerMethod(
+      "authenticateDevice",
+      connectId,
+      { challenge: challengeHex }
+    );
+    if (!proofRes.success) return proofRes;
+    const proof = proofRes.payload;
+    const verification = authenticateDeviceFromProof({
+      proof,
+      challenge,
+      deviceModel: internalModel,
+      allowDebugKeys: params.dangerouslyAllowDebugKeys
+    });
+    return _hwkadaptercore.success.call(void 0, {
+      ...verification,
+      vendor: "trezor",
+      trezorProof: {
+        challenge: challengeHex,
+        deviceModel: internalModel,
+        proof
+      }
+    });
+  }
   deviceSettings(connectId, params) {
     return this._callDeviceManagerMethod(
       "deviceSettings",
@@ -858,7 +1639,7 @@ var _TrezorAdapter = class _TrezorAdapter {
     if (pending) return pending;
     const promise = (async () => {
       try {
-        if (_optionalChain([signal, 'optionalAccess', _17 => _17.aborted])) {
+        if (_optionalChain([signal, 'optionalAccess', _32 => _32.aborted])) {
           throw Object.assign(new Error("Trezor connection aborted"), {
             code: _hwkadaptercore.HardwareErrorCode.UserAborted
           });
@@ -904,8 +1685,8 @@ var _TrezorAdapter = class _TrezorAdapter {
         passphraseMode: "prompt"
       })
     );
-    if (_optionalChain([created, 'optionalAccess', _18 => _18.protocol]) === "thp" && !created.thpSessionId) return;
-    if (_optionalChain([created, 'optionalAccess', _19 => _19.protocol]) !== "thp" && _optionalChain([created, 'optionalAccess', _20 => _20.protocol]) !== "v1") return;
+    if (_optionalChain([created, 'optionalAccess', _33 => _33.protocol]) === "thp" && !created.thpSessionId) return;
+    if (_optionalChain([created, 'optionalAccess', _34 => _34.protocol]) !== "thp" && _optionalChain([created, 'optionalAccess', _35 => _35.protocol]) !== "v1") return;
     const state = await this._deriveState(sessionId, signal);
     if (state !== passphraseState) {
       throw Object.assign(
@@ -919,13 +1700,13 @@ var _TrezorAdapter = class _TrezorAdapter {
   }
   _rememberVerifiedPassphraseSession(connectId, passphraseState, sessionId, created) {
     let session;
-    if (_optionalChain([created, 'optionalAccess', _21 => _21.protocol]) === "thp" && typeof created.thpSessionId === "string") {
+    if (_optionalChain([created, 'optionalAccess', _36 => _36.protocol]) === "thp" && typeof created.thpSessionId === "string") {
       session = {
         sessionId,
         protocol: "thp",
         thpSessionId: created.thpSessionId
       };
-    } else if (_optionalChain([created, 'optionalAccess', _22 => _22.protocol]) === "v1") {
+    } else if (_optionalChain([created, 'optionalAccess', _37 => _37.protocol]) === "v1") {
       session = {
         sessionId,
         protocol: "v1"
@@ -945,7 +1726,7 @@ var _TrezorAdapter = class _TrezorAdapter {
     }
   }
   async _reuseVerifiedPassphraseSession(connectId, sessionId, passphraseState, signal) {
-    const cached = _optionalChain([this, 'access', _23 => _23._verifiedPassphraseSessionsByConnectId, 'access', _24 => _24.get, 'call', _25 => _25(connectId), 'optionalAccess', _26 => _26.get, 'call', _27 => _27(passphraseState)]);
+    const cached = _optionalChain([this, 'access', _38 => _38._verifiedPassphraseSessionsByConnectId, 'access', _39 => _39.get, 'call', _40 => _40(connectId), 'optionalAccess', _41 => _41.get, 'call', _42 => _42(passphraseState)]);
     if (!cached || cached.sessionId !== sessionId) {
       this._forgetVerifiedPassphraseSession(connectId, passphraseState);
       return false;
@@ -997,7 +1778,7 @@ var _TrezorAdapter = class _TrezorAdapter {
         showOnDevice: false
       })
     );
-    const state = _optionalChain([derived, 'optionalAccess', _28 => _28.publicKey]);
+    const state = _optionalChain([derived, 'optionalAccess', _43 => _43.publicKey]);
     if (!state) {
       throw Object.assign(new Error("Failed to derive passphrase state (wallet public key)"), {
         code: _hwkadaptercore.HardwareErrorCode.UnknownError
@@ -1023,7 +1804,7 @@ var _TrezorAdapter = class _TrezorAdapter {
         signal,
         _TrezorAdapter._callConnector(this._connector, sessionId, "getFeatures", { refresh: true })
       );
-      if (_optionalChain([features, 'optionalAccess', _29 => _29.passphrase_protection]) !== true) {
+      if (_optionalChain([features, 'optionalAccess', _44 => _44.passphrase_protection]) !== true) {
         return _hwkadaptercore.success.call(void 0, null);
       }
       this._rememberVerifiedPassphraseSession(connectId, state, sessionId, created);
@@ -1227,7 +2008,7 @@ async function fetchDefinitionHex(url, fetchImpl) {
       }
       return arrayBufferToHex(await response.arrayBuffer());
     });
-  } catch (e3) {
+  } catch (e5) {
     return void 0;
   }
 }
@@ -1256,7 +2037,7 @@ async function fetchSolanaTokenDefinition({
       }
       return Buffer.from(await response.arrayBuffer()).toString("hex");
     });
-  } catch (e4) {
+  } catch (e6) {
     return void 0;
   }
 }
@@ -1327,5 +2108,7 @@ function resolveTrezorBleConnectId(descriptor) {
 
 
 
-exports.DEFAULT_ETHEREUM_DEFINITIONS_BASE_URL = DEFAULT_ETHEREUM_DEFINITIONS_BASE_URL; exports.DEFAULT_SOLANA_TOKEN_DEFINITION_BASE_URL = DEFAULT_SOLANA_TOKEN_DEFINITION_BASE_URL; exports.TREZOR_BLE_PACKET_SIZE = TREZOR_BLE_PACKET_SIZE; exports.TREZOR_BLE_SUPPORTED_MODELS = TREZOR_BLE_SUPPORTED_MODELS; exports.TREZOR_BLE_UUIDS = TREZOR_BLE_UUIDS; exports.TREZOR_SAFE_7_MODEL = TREZOR_SAFE_7_MODEL; exports.TrezorAdapter = TrezorAdapter; exports.buildEthereumDefinitionsForPath = buildEthereumDefinitionsForPath; exports.buildEthereumDefinitionsForSignTx = buildEthereumDefinitionsForSignTx; exports.fetchEthereumDefinitions = fetchEthereumDefinitions; exports.fetchSolanaTokenDefinition = fetchSolanaTokenDefinition; exports.getSlip44FromPath = getSlip44FromPath; exports.isTrezorBleDescriptor = isTrezorBleDescriptor; exports.isTrezorBleServiceUuid = isTrezorBleServiceUuid; exports.isTrezorBleSupportedModel = isTrezorBleSupportedModel; exports.isTrezorSafe7BleDescriptor = isTrezorSafe7BleDescriptor; exports.isTrezorSafe7BleName = isTrezorSafe7BleName; exports.normalizeTrezorBleUuid = normalizeTrezorBleUuid; exports.offSdkEvent = offSdkEvent; exports.onSdkEvent = onSdkEvent; exports.resolveTrezorBleConnectId = resolveTrezorBleConnectId;
+
+
+exports.DEFAULT_ETHEREUM_DEFINITIONS_BASE_URL = DEFAULT_ETHEREUM_DEFINITIONS_BASE_URL; exports.DEFAULT_SOLANA_TOKEN_DEFINITION_BASE_URL = DEFAULT_SOLANA_TOKEN_DEFINITION_BASE_URL; exports.TREZOR_BLE_PACKET_SIZE = TREZOR_BLE_PACKET_SIZE; exports.TREZOR_BLE_SUPPORTED_MODELS = TREZOR_BLE_SUPPORTED_MODELS; exports.TREZOR_BLE_UUIDS = TREZOR_BLE_UUIDS; exports.TREZOR_SAFE_7_MODEL = TREZOR_SAFE_7_MODEL; exports.TrezorAdapter = TrezorAdapter; exports.authenticateDeviceFromProof = authenticateDeviceFromProof; exports.buildEthereumDefinitionsForPath = buildEthereumDefinitionsForPath; exports.buildEthereumDefinitionsForSignTx = buildEthereumDefinitionsForSignTx; exports.fetchEthereumDefinitions = fetchEthereumDefinitions; exports.fetchSolanaTokenDefinition = fetchSolanaTokenDefinition; exports.getRequiredDeviceAuthenticityLayers = getRequiredDeviceAuthenticityLayers; exports.getSlip44FromPath = getSlip44FromPath; exports.isTrezorBleDescriptor = isTrezorBleDescriptor; exports.isTrezorBleServiceUuid = isTrezorBleServiceUuid; exports.isTrezorBleSupportedModel = isTrezorBleSupportedModel; exports.isTrezorSafe7BleDescriptor = isTrezorSafe7BleDescriptor; exports.isTrezorSafe7BleName = isTrezorSafe7BleName; exports.normalizeTrezorBleUuid = normalizeTrezorBleUuid; exports.offSdkEvent = offSdkEvent; exports.onSdkEvent = onSdkEvent; exports.resolveTrezorBleConnectId = resolveTrezorBleConnectId;
 //# sourceMappingURL=index.js.map