@onekeyfe/hwk-trezor-adapter 1.2.1 → 1.2.2-alpha.1

package/dist/index.mjs

@@ -12,6 +12,713 @@ import {
   runAllNetworkGetAddress,
   success
 } from "@onekeyfe/hwk-adapter-core";
+import { randomBytes } from "@noble/hashes/utils";
+
+// src/deviceAuthenticity/index.ts
+import { sha3_256 as sha3Hash } from "@noble/hashes/sha3";
+
+// src/deviceAuthenticity/config.ts
+var deviceAuthenticityConfig = {
+  version: 2,
+  T2B1: {
+    rootPubKeysOptiga: [
+      // upstream: DEV_AUTH_ROOT_PROD_P256
+      "04ca97480ac0d7b1e6efafe518cd433cec2bf8ab9822d76eafd34363b55d63e60380bff20acc75cde03cffcb50ab6f8ce70c878e37ebc58ff7cca0a83b16b15fa5"
+    ],
+    debug: {
+      rootPubKeysOptiga: [
+        // upstream: DEV_AUTH_ROOT_DEBUG_P256 shared with T3B1
+        "047f77368dea2d4d61e989f474a56723c3212dacf8a808d8795595ef38441427c4389bc454f02089d7f08b873005e4c28d432468997871c0bf286fd3861e21e96a"
+      ]
+    }
+  },
+  T3B1: {
+    rootPubKeysOptiga: [
+      // upstream: DEV_AUTH_ROOT_PROD_P256
+      "045b5c3fdd01f3602092834209b86df0ca86a9faf25cac35c73bf6237d66eb21eafcec3706f1ccd5eb4cc7f2fa1751213eccb1c78389afba89a5788ff31ee46a5d"
+    ],
+    debug: {
+      rootPubKeysOptiga: [
+        // upstream: DEV_AUTH_ROOT_DEBUG_P256 shared with T2B1
+        "047f77368dea2d4d61e989f474a56723c3212dacf8a808d8795595ef38441427c4389bc454f02089d7f08b873005e4c28d432468997871c0bf286fd3861e21e96a"
+      ]
+    }
+  },
+  T3T1: {
+    rootPubKeysOptiga: [
+      // upstream: DEV_AUTH_ROOT_PROD_P256
+      "041854b27fb1d9f65abb66828e78c9dc0ca301e66081ab0c6a4d104f9df1cd0ad5a7c75f77a8c092f55cf825d2abaf734f934c9394d5e75f75a5a06a5ee9be93ae"
+    ],
+    debug: {
+      rootPubKeysOptiga: [
+        // upstream: DEV_AUTH_ROOT_DEBUG_P256
+        "04e48b69cd7962068d3cca3bcc6b1747ef496c1e28b5529e34ad7295215ea161dbe8fb08ae0479568f9d2cb07630cb3e52f4af0692102da5873559e45e9fa72959"
+      ]
+    }
+  },
+  T3W1: {
+    rootPubKeysOptiga: [
+      // upstream: DEV_AUTH_ROOT_PROD_P256
+      "040dde0d3e0d4da593fac6fd02a461d0e7eef238aca55c7c50b4e9ec37f3873303b6429ef1c9b78b4411a7dcbbc5dde5225979c1c2da3b073e82b1ed3f5f9825bb",
+      // upstream: DEV_AUTH_ROOT_PROD_BACKUP_P256
+      "04c6a673af4ec44b10441b1d78676e15173ad0e36df9f7f2fa1cd819955f20fe32917b60da5fed3b3aa54a9ab8b3ed27d198b3768cad26eef5935cd87af0af065e"
+    ],
+    rootPubKeysTropic: [
+      // upstream: DEV_AUTH_ROOT_PROD_ED25519
+      "59237acd17134061d655b3f8d624573ca06ce8d862f38ba4e05140ce1d3d609d",
+      // upstream: DEV_AUTH_ROOT_PROD_BACKUP_ED25519
+      "5612606584ee7e0bc313b13f7ac94156bb4cb75bd77585ddbe579301306e85f1"
+    ],
+    debug: {
+      rootPubKeysOptiga: [
+        // upstream: DEV_AUTH_ROOT_DEBUG_P256
+        "04521192e173a9da4e3023f747d836563725372681eba3079c56ff11b2fc137ab189eb4155f371127651b5594f8c332fc1e9c0f3b80d4212822668b63189706578",
+        // upstream: DEV_AUTH_ROOT_STAGING_P256
+        "0465e88f9b2cea67e8364f0cfcfacd500af24e9040b357beee629ccc4fce1704d1a7ef7284f387708f92ef14600e2caad6894016fee819d623b95d66210c3e7519"
+      ],
+      rootPubKeysTropic: [
+        // upstream: DEV_AUTH_ROOT_STAGING_ED25519
+        "cd318dc8405ae4f4144e3284dcb7b0cb0f0c2195c2ca14a0f6fccd9104e32a4b"
+      ]
+    }
+  }
+};
+
+// src/deviceAuthenticity/findSubjectContentByOid.ts
+var findSubjectContentByOid = (deviceCert, oid) => {
+  const subjectItems = deviceCert.tbsCertificate.subject;
+  const matchedItem = subjectItems.find(({ algorithmOid }) => algorithmOid === oid);
+  if (!matchedItem || !matchedItem.parameters) return null;
+  return matchedItem.parameters.asn1.contents;
+};
+
+// src/deviceAuthenticity/validateCaCertExtensions.ts
+var validateCaCertExtensions = (cert, pathLen) => {
+  let hasKeyUsage = false;
+  let hasBasicConstraints = false;
+  cert.tbsCertificate.extensions.forEach((ext) => {
+    if (ext.key === "keyUsage") {
+      if (ext.keyCertSign !== "1") {
+        throw new Error(`CA keyCertSign not set`);
+      }
+      hasKeyUsage = true;
+    } else if (ext.key === "basicConstraints") {
+      if (!ext.cA) {
+        throw new Error(`CA basicConstraints.cA not set`);
+      }
+      if (typeof ext.pathLenConstraint !== "number") {
+        throw new Error("CA basicConstraints.pathLenConstraint not set");
+      }
+      if (ext.pathLenConstraint < pathLen) {
+        throw new Error("Issuer was not permitted to issue certificate");
+      }
+      hasBasicConstraints = true;
+    } else if (ext.critical) {
+      throw new Error(`Unknown critical extension ${ext.key} in CA certificate`);
+    }
+  });
+  if (!hasKeyUsage || !hasBasicConstraints) {
+    throw new Error(
+      `CA missing extensions keyUsage: ${hasKeyUsage}, basicConstraints: ${hasBasicConstraints}`
+    );
+  }
+};
+
+// src/deviceAuthenticity/verifySignatures.ts
+import { ed25519 } from "@noble/curves/ed25519";
+import { p256 } from "@noble/curves/p256";
+import { sha256 } from "@noble/hashes/sha256";
+
+// src/deviceAuthenticity/x509certificate.ts
+var parseOidToAlgorithmName = (oid) => {
+  if (oid === "1.2.840.10045.4.3.2") return "P-256";
+  if (oid === "1.3.101.112") return "Ed25519";
+  if (oid === "2.16.840.1.101.3.4.3.17") return "MLDSA44";
+  return "unknown";
+};
+var derToAsn1 = (byteArray) => {
+  let position = 0;
+  function getTag() {
+    let tag2 = byteArray[0] & 31;
+    position += 1;
+    if (tag2 === 31) {
+      tag2 = 0;
+      while (byteArray[position] >= 128) {
+        tag2 = tag2 * 128 + byteArray[position] - 128;
+        position += 1;
+      }
+      tag2 = tag2 * 128 + byteArray[position] - 128;
+      position += 1;
+    }
+    return tag2;
+  }
+  function getLength() {
+    let length2 = 0;
+    if (byteArray[position] < 128) {
+      length2 = byteArray[position];
+      position += 1;
+    } else {
+      const numberOfDigits = byteArray[position] & 127;
+      position += 1;
+      length2 = 0;
+      for (let i = 0; i < numberOfDigits; i++) {
+        length2 = length2 * 256 + byteArray[position];
+        position += 1;
+      }
+    }
+    return length2;
+  }
+  const cls = (byteArray[0] & 192) / 64;
+  const structured = (byteArray[0] & 32) === 32;
+  const tag = getTag();
+  if (byteArray[position] === 128) {
+    throw new Error("Unsupported length encoding");
+  }
+  const length = getLength();
+  const byteLength = position + length;
+  const contents = byteArray.subarray(position, byteLength);
+  const raw = byteArray.subarray(0, byteLength);
+  return {
+    cls,
+    tag,
+    structured,
+    byteLength,
+    contents,
+    raw
+  };
+};
+var derToAsn1List = (byteArray) => {
+  const result = [];
+  let nextPosition = 0;
+  while (nextPosition < byteArray.length) {
+    const nextPiece = derToAsn1(byteArray.subarray(nextPosition));
+    result.push(nextPiece);
+    nextPosition += nextPiece.byteLength;
+  }
+  return result;
+};
+var derBitStringValue = (byteArray) => ({
+  unusedBits: byteArray[0],
+  bytes: byteArray.subarray(1)
+});
+var parseSignatureValue = (asn1) => {
+  if (asn1.cls !== 0 || asn1.tag !== 3 || asn1.structured) {
+    throw new Error("Bad signature value. Not a BIT STRING.");
+  }
+  return {
+    asn1,
+    bits: derBitStringValue(asn1.contents)
+  };
+};
+var fixSignature = (byteArray) => {
+  const asn1 = derToAsn1(byteArray);
+  if (asn1.cls !== 0 || asn1.tag !== 16 || !asn1.structured) {
+    throw new Error("Bad signature. Not a SEQUENCE.");
+  }
+  const items = derToAsn1List(asn1.contents);
+  let newLength = 0;
+  const fixedItems = items.map((chunk) => {
+    const index = chunk.contents.findIndex((value) => value > 0);
+    const data = chunk.contents.subarray(index);
+    const offset = data[0] >= 128 ? 1 : 0;
+    const chunkLength = data.length + offset;
+    const newChunk = new Uint8Array(chunkLength + 2);
+    newChunk.set([chunk.raw[0], chunkLength]);
+    if (offset > 0) {
+      newChunk.set([0], 2);
+    }
+    newChunk.set(data, 2 + offset);
+    newLength += newChunk.length;
+    return newChunk;
+  });
+  const signature = new Uint8Array(newLength + 2);
+  signature.set([byteArray[0], newLength]);
+  let signatureOffset = 2;
+  fixedItems.forEach((item) => {
+    signature.set(item, signatureOffset);
+    signatureOffset += item.length;
+  });
+  return signature;
+};
+var derObjectIdentifierValue = (byteArray) => {
+  let oid = `${Math.floor(byteArray[0] / 40)}.${byteArray[0] % 40}`;
+  let position = 1;
+  while (position < byteArray.length) {
+    let nextInteger = 0;
+    while (byteArray[position] >= 128) {
+      nextInteger = nextInteger * 128 + (byteArray[position] & 127);
+      position += 1;
+    }
+    nextInteger = nextInteger * 128 + byteArray[position];
+    position += 1;
+    oid += `.${nextInteger}`;
+  }
+  return oid;
+};
+var parseAlgorithmIdentifier = (asn1) => {
+  if (asn1.cls !== 0 || asn1.tag !== 16 || !asn1.structured) {
+    throw new Error("Bad algorithm identifier. Not a SEQUENCE.");
+  }
+  const pieces = derToAsn1List(asn1.contents);
+  if (pieces.length > 2) {
+    throw new Error("Bad algorithm identifier. Contains too many child objects.");
+  }
+  const encodedAlgorithm = pieces[0];
+  if (encodedAlgorithm.cls !== 0 || encodedAlgorithm.tag !== 6 || encodedAlgorithm.structured) {
+    throw new Error("Bad algorithm identifier. Does not begin with an OBJECT IDENTIFIER.");
+  }
+  const algorithmOid = derObjectIdentifierValue(encodedAlgorithm.contents);
+  const algorithmName = parseOidToAlgorithmName(algorithmOid);
+  return {
+    asn1,
+    algorithmOid,
+    algorithmName,
+    parameters: pieces.length === 2 ? { asn1: pieces[1] } : null
+  };
+};
+var parseName = (asn1) => (
+  // SEQUENCE > SET > SEQUENCE
+  derToAsn1List(asn1.contents).map((item) => {
+    const attrSet = derToAsn1(item.contents);
+    return parseAlgorithmIdentifier(attrSet);
+  })
+);
+var parseSubjectPublicKeyInfo = (asn1) => {
+  if (asn1.cls !== 0 || asn1.tag !== 16 || !asn1.structured) {
+    throw new Error("Bad SPKI. Not a SEQUENCE.");
+  }
+  const pieces = derToAsn1List(asn1.contents);
+  if (pieces.length !== 2) {
+    throw new Error("Bad SubjectPublicKeyInfo. Wrong number of child objects.");
+  }
+  return {
+    asn1,
+    algorithm: parseAlgorithmIdentifier(pieces[0]),
+    bits: derBitStringValue(pieces[1].contents)
+  };
+};
+var parseUtcTime = (time) => {
+  let offset = 4;
+  let yearOffset = 0;
+  if (time.tag === 23) {
+    offset = 2;
+    yearOffset = 2e3;
+  }
+  const utc = Buffer.from(time.contents).toString();
+  const year = yearOffset + Number(utc.substring(0, offset));
+  const month = Number(utc.substring(offset, offset + 2)) - 1;
+  const day = Number(utc.substring(offset + 2, offset + 4));
+  const hour = Number(utc.substring(offset + 4, offset + 6));
+  const minute = Number(utc.substring(offset + 6, offset + 8));
+  const date = /* @__PURE__ */ new Date();
+  date.setUTCFullYear(year, month, day);
+  date.setUTCHours(hour, minute, 0);
+  return date;
+};
+var parseValidity = (asn1) => {
+  const [from, to] = derToAsn1List(asn1.contents);
+  return {
+    from: parseUtcTime(from),
+    to: parseUtcTime(to)
+  };
+};
+var parseExtensions = (data) => {
+  const asn1 = derToAsn1(data.contents);
+  if (asn1.cls !== 0 || asn1.tag !== 16 || !asn1.structured) {
+    throw new Error("This can't be a Extension. Wrong data type.");
+  }
+  const readBoolean = (value) => {
+    if (!value) return false;
+    if (value.cls !== 0 || value.tag !== 1 || value.contents.length !== 1 || value.structured) {
+      throw new Error("This can't be a boolean. Wrong data type.");
+    }
+    if (![0, 255].includes(value.contents[0])) {
+      throw new Error("Invalid boolean value.");
+    }
+    return value.contents[0] === 255;
+  };
+  const readBitString = (uint8Array) => {
+    const buffer = Buffer.from(uint8Array);
+    const tag = buffer.readUInt8(0);
+    if (tag !== 3) {
+      throw new Error("This can't be a bit string. Wrong data type.");
+    }
+    const length = buffer.readUInt8(1);
+    const unusedBits = buffer.readUInt8(2);
+    const bitStringBytes = buffer.subarray(3, 3 + length - 1);
+    const bitString = bitStringBytes.reduce(
+      (str, byte) => str + byte.toString(2).padStart(8, "0"),
+      ""
+    );
+    return bitString.slice(0, bitString.length - unusedBits);
+  };
+  const readInteger = (value) => {
+    if (!value) return void 0;
+    if (value.cls !== 0 || value.tag !== 2 || value.contents.length !== 1 || value.structured) {
+      throw new Error("This can't be a integer. Wrong data type.");
+    }
+    return Buffer.from(value.contents).readInt8();
+  };
+  const extensions = [];
+  derToAsn1List(asn1.contents).forEach((item) => {
+    const [id, ...pieces] = derToAsn1List(item.contents);
+    if (id.cls !== 0 || id.tag !== 6 || id.structured) {
+      throw new Error("Bad extension. Does not begin with an OBJECT IDENTIFIER.");
+    }
+    const algorithm = derObjectIdentifierValue(id.contents);
+    const critical = pieces.length > 1 ? readBoolean(pieces[0]) : false;
+    const extnValue = pieces.length > 1 ? pieces[1] : pieces[0];
+    if (extnValue.cls !== 0 || extnValue.tag !== 4 || extnValue.structured) {
+      throw new Error("This can't be a octet string. Wrong data type.");
+    }
+    if (algorithm === "2.5.29.15") {
+      extensions.push({
+        key: "keyUsage",
+        critical,
+        keyCertSign: readBitString(extnValue.contents)[5]
+      });
+    } else if (algorithm === "2.5.29.19") {
+      const fields = derToAsn1List(derToAsn1(extnValue.contents).contents);
+      const ca = fields.length > 0 && fields[0].tag === 1 ? fields[0] : void 0;
+      const len = fields.length > 0 && fields[0].tag === 2 ? fields[0] : fields[1];
+      extensions.push({
+        key: "basicConstraints",
+        critical,
+        cA: readBoolean(ca),
+        pathLenConstraint: readInteger(len)
+      });
+    } else {
+      extensions.push({
+        key: algorithm,
+        critical,
+        ...item
+      });
+    }
+  });
+  return extensions;
+};
+var parseTBSCertificate = (asn1) => {
+  if (asn1.cls !== 0 || asn1.tag !== 16 || !asn1.structured) {
+    throw new Error("This can't be a TBSCertificate. Wrong data type.");
+  }
+  const pieces = derToAsn1List(asn1.contents);
+  if (pieces.length < 7) {
+    throw new Error("Bad TBS Certificate. There are fewer than the seven required children.");
+  }
+  return {
+    asn1,
+    version: pieces[0],
+    serialNumber: pieces[1],
+    signature: parseAlgorithmIdentifier(pieces[2]),
+    issuer: pieces[3],
+    validity: parseValidity(pieces[4]),
+    subject: parseName(pieces[5]),
+    subjectPublicKeyInfo: parseSubjectPublicKeyInfo(pieces[6]),
+    extensions: parseExtensions(pieces[7])
+  };
+};
+var parseCertificate = (byteArray) => {
+  const asn1 = derToAsn1(byteArray);
+  if (asn1.cls !== 0 || asn1.tag !== 16 || !asn1.structured) {
+    throw new Error("This can't be an X.509 certificate. Wrong data type.");
+  }
+  const pieces = derToAsn1List(asn1.contents);
+  if (pieces.length !== 3) {
+    throw new Error("Certificate contains more than the three specified children.");
+  }
+  return {
+    asn1,
+    tbsCertificate: parseTBSCertificate(pieces[0]),
+    signatureAlgorithm: parseAlgorithmIdentifier(pieces[1]),
+    signatureValue: parseSignatureValue(pieces[2])
+  };
+};
+
+// src/deviceAuthenticity/verifySignatures.ts
+var verifySignatureP256 = (rawKey, data, signature) => {
+  try {
+    const sig = p256.Signature.fromDER(Buffer.from(fixSignature(signature)).toString("hex"));
+    return p256.verify(sig.toBytes("compact"), sha256(data), rawKey, { lowS: false });
+  } catch {
+    return false;
+  }
+};
+var verifySignatureEd25519 = (rawKey, data, signature) => {
+  try {
+    return ed25519.verify(signature, data, rawKey);
+  } catch {
+    return false;
+  }
+};
+var getVerifyFn = (algorithmName) => {
+  if (algorithmName === "P-256") return verifySignatureP256;
+  if (algorithmName === "Ed25519") return verifySignatureEd25519;
+  throw new Error(`Unsupported signature algorithm: ${algorithmName}`);
+};
+
+// src/deviceAuthenticity/verifyAuthenticityProof.ts
+var getChunkSize = (byteLength) => {
+  if (byteLength < 253) return Uint8Array.from([byteLength]);
+  if (byteLength <= 65535) {
+    const b2 = Buffer.alloc(3);
+    b2[0] = 253;
+    b2.writeUInt16LE(byteLength, 1);
+    return Uint8Array.from(b2);
+  }
+  const b = Buffer.alloc(5);
+  b[0] = 254;
+  b.writeUInt32LE(byteLength, 1);
+  return Uint8Array.from(b);
+};
+var prepareDeviceAuthenticityData = ({
+  payload,
+  prefix = "AuthenticateDevice:"
+}) => {
+  const chunks = [
+    Uint8Array.from(Buffer.from(prefix)),
+    ...(Array.isArray(payload) ? payload : [payload]).map((chunk) => Uint8Array.from(chunk))
+  ];
+  const framed = chunks.flatMap((chunk) => [getChunkSize(chunk.byteLength), chunk]);
+  const result = new Uint8Array(framed.reduce((total, chunk) => total + chunk.byteLength, 0));
+  let offset = 0;
+  for (const chunk of framed) {
+    result.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return result;
+};
+var getRootPubKeys = ({
+  config,
+  deviceModel,
+  proofType,
+  allowDebugKeys
+}) => {
+  const modelConfig = config[deviceModel];
+  if (!modelConfig || typeof modelConfig === "number") {
+    throw new Error(`Pubkeys for ${deviceModel} not found in config`);
+  }
+  const prod = proofType === "optiga" ? modelConfig.rootPubKeysOptiga ?? [] : modelConfig.rootPubKeysTropic ?? [];
+  if (!allowDebugKeys) return prod;
+  return [
+    ...prod,
+    ...proofType === "optiga" ? modelConfig.debug?.rootPubKeysOptiga ?? [] : modelConfig.debug?.rootPubKeysTropic ?? []
+  ];
+};
+var matchRootPubKeyToCertificate = ({
+  cert,
+  allRootPubKeys
+}) => {
+  const verifySignatureFn = getVerifyFn(cert.signatureAlgorithm.algorithmName);
+  return allRootPubKeys.find(
+    (rootPubKey) => verifySignatureFn(
+      Uint8Array.from(Buffer.from(rootPubKey, "hex")),
+      cert.tbsCertificate.asn1.raw,
+      cert.signatureValue.bits.bytes
+    )
+  );
+};
+var parseModelFromDeviceCertSubject = (deviceCert) => {
+  const modelDescriptionBytes = findSubjectContentByOid(deviceCert, "2.5.4.3");
+  if (modelDescriptionBytes === null) return null;
+  return Buffer.from(modelDescriptionBytes.subarray(0, 4)).toString();
+};
+var parseSerialNumberFromDeviceCert = (deviceCert) => {
+  const serialNumber = findSubjectContentByOid(deviceCert, "2.5.4.5");
+  if (serialNumber === null) return void 0;
+  return Buffer.from(serialNumber).toString("hex");
+};
+var verifyAuthenticityProof = ({
+  proofType,
+  certificates,
+  signature,
+  signedData,
+  deviceModel,
+  config,
+  allowDebugKeys,
+  caPubKeyBlacklist: caPubKeyBlacklist2 = []
+}) => {
+  const allRootPubKeys = getRootPubKeys({
+    config,
+    deviceModel,
+    proofType,
+    allowDebugKeys
+  });
+  const parsedCertificates = certificates.map(
+    (c) => parseCertificate(new Uint8Array(Buffer.from(c, "hex")))
+  );
+  const firstCertAlgName = parsedCertificates[0]?.signatureAlgorithm.algorithmName;
+  const expectedAlgorithmName = proofType === "optiga" ? "P-256" : "Ed25519";
+  if (firstCertAlgName !== expectedAlgorithmName) {
+    return { valid: false, error: "RESPONSE_MALFORMED" };
+  }
+  if (parsedCertificates.length !== 2) {
+    return { valid: false, error: "RESPONSE_MALFORMED" };
+  }
+  const [deviceCert, caCert] = parsedCertificates;
+  const deviceCertPubKey = Buffer.from(
+    deviceCert.tbsCertificate.subjectPublicKeyInfo.bits.bytes
+  ).toString("hex");
+  const deviceCertAlgName = deviceCert.signatureAlgorithm.algorithmName;
+  const caCertAlgName = caCert.signatureAlgorithm.algorithmName;
+  if (deviceCertAlgName !== caCertAlgName) {
+    return { valid: false, deviceCertPubKey, error: "RESPONSE_MALFORMED" };
+  }
+  validateCaCertExtensions(caCert, 0);
+  const verifySignatureFn = getVerifyFn(deviceCertAlgName);
+  const caPubKeyBytes = caCert.tbsCertificate.subjectPublicKeyInfo.bits.bytes;
+  const caPubKey = Buffer.from(caPubKeyBytes).toString("hex");
+  const rootPubKeyMatch = matchRootPubKeyToCertificate({ allRootPubKeys, cert: caCert });
+  if (rootPubKeyMatch === void 0) {
+    return { valid: false, caPubKey, deviceCertPubKey, error: "ROOT_PUBKEY_NOT_FOUND" };
+  }
+  if (caPubKeyBlacklist2.includes(caPubKey)) {
+    return {
+      valid: false,
+      caPubKey,
+      rootPubKey: rootPubKeyMatch,
+      deviceCertPubKey,
+      error: "CA_PUBKEY_BLACKLISTED"
+    };
+  }
+  const now = Date.now();
+  const isWithinValidity = (validity) => validity.from.getTime() <= now && now <= validity.to.getTime();
+  if (!isWithinValidity(caCert.tbsCertificate.validity) || !isWithinValidity(deviceCert.tbsCertificate.validity)) {
+    return {
+      valid: false,
+      caPubKey,
+      rootPubKey: rootPubKeyMatch,
+      deviceCertPubKey,
+      error: "CERTIFICATE_EXPIRED"
+    };
+  }
+  const modelFromSubject = parseModelFromDeviceCertSubject(deviceCert);
+  if (modelFromSubject !== deviceModel) {
+    return {
+      valid: false,
+      caPubKey,
+      rootPubKey: rootPubKeyMatch,
+      deviceCertPubKey,
+      error: "INVALID_DEVICE_MODEL"
+    };
+  }
+  const isDeviceCertValid = verifySignatureFn(
+    Uint8Array.from(caPubKeyBytes),
+    deviceCert.tbsCertificate.asn1.raw,
+    deviceCert.signatureValue.bits.bytes
+  );
+  if (!isDeviceCertValid) {
+    return {
+      valid: false,
+      caPubKey,
+      rootPubKey: rootPubKeyMatch,
+      deviceCertPubKey,
+      error: "INVALID_DEVICE_CERTIFICATE"
+    };
+  }
+  const isSignatureValid = verifySignatureFn(
+    Uint8Array.from(deviceCert.tbsCertificate.subjectPublicKeyInfo.bits.bytes),
+    signedData,
+    Uint8Array.from(Buffer.from(signature, "hex"))
+  );
+  if (!isSignatureValid) {
+    return {
+      valid: false,
+      caPubKey,
+      rootPubKey: rootPubKeyMatch,
+      deviceCertPubKey,
+      error: "INVALID_DEVICE_SIGNATURE"
+    };
+  }
+  return {
+    valid: true,
+    caPubKey,
+    rootPubKey: rootPubKeyMatch,
+    deviceCertPubKey,
+    serialNumber: parseSerialNumberFromDeviceCert(deviceCert)
+  };
+};
+
+// src/deviceAuthenticity/index.ts
+var caPubKeyBlacklist = [];
+var modelConfigOf = (config, deviceModel) => {
+  const modelConfig = config[deviceModel];
+  return modelConfig && typeof modelConfig !== "number" ? modelConfig : void 0;
+};
+var getRequiredDeviceAuthenticityLayers = (deviceModel) => deviceModel === "T3W1" ? ["optiga", "tropic"] : ["optiga"];
+var isTropicExpected = (deviceModel) => getRequiredDeviceAuthenticityLayers(deviceModel).includes("tropic");
+var matchedDebugKey = (config, deviceModel, rootPubKey) => {
+  if (!rootPubKey) return false;
+  const m = modelConfigOf(config, deviceModel);
+  if (!m?.debug) return false;
+  return [...m.debug.rootPubKeysOptiga ?? [], ...m.debug.rootPubKeysTropic ?? []].includes(
+    rootPubKey
+  );
+};
+var authenticateDeviceFromProof = ({
+  proof,
+  challenge,
+  deviceModel,
+  config = deviceAuthenticityConfig,
+  allowDebugKeys
+}) => {
+  try {
+    const signedData = prepareDeviceAuthenticityData({ payload: challenge });
+    const common = { signedData, deviceModel, config, allowDebugKeys, caPubKeyBlacklist };
+    const { optiga_certificates: optigaCertificates, optiga_signature: optigaSignature } = proof;
+    if (!optigaSignature || !optigaCertificates?.length) {
+      return { verified: false, error: "RESPONSE_PAYLOAD_MISSING" };
+    }
+    const optiga = verifyAuthenticityProof({
+      ...common,
+      proofType: "optiga",
+      certificates: optigaCertificates,
+      signature: optigaSignature
+    });
+    if (!optiga.valid) {
+      return {
+        verified: false,
+        deviceCertPubKey: optiga.deviceCertPubKey,
+        caPubKey: optiga.caPubKey,
+        rootPubKey: optiga.rootPubKey,
+        error: optiga.error
+      };
+    }
+    let usedDebugKey = matchedDebugKey(config, deviceModel, optiga.rootPubKey);
+    if (isTropicExpected(deviceModel)) {
+      const { tropic_certificates: tropicCertificates, tropic_signature: tropicSignature } = proof;
+      if (!tropicSignature || !tropicCertificates?.length) {
+        return { verified: false, error: "RESPONSE_PAYLOAD_MISSING" };
+      }
+      const tropic = verifyAuthenticityProof({
+        ...common,
+        proofType: "tropic",
+        certificates: tropicCertificates,
+        signature: tropicSignature
+      });
+      if (!tropic.valid) {
+        return { verified: false, error: tropic.error };
+      }
+      usedDebugKey = usedDebugKey || matchedDebugKey(config, deviceModel, tropic.rootPubKey);
+    }
+    const deviceId = Buffer.from(
+      sha3Hash(Uint8Array.from(Buffer.from(optiga.deviceCertPubKey, "hex")))
+    ).toString("hex");
+    return {
+      verified: true,
+      deviceId,
+      deviceCertPubKey: optiga.deviceCertPubKey,
+      serialNumber: optiga.serialNumber,
+      rootPubKey: optiga.rootPubKey,
+      caPubKey: optiga.caPubKey,
+      usedDebugKey
+    };
+  } catch (error) {
+    return {
+      verified: false,
+      error: `RESPONSE_MALFORMED: ${error?.message ?? "parse error"}`
+    };
+  }
+};
 
 // src/utils/sdkEventBus.ts
 var listeners = /* @__PURE__ */ new Set();
@@ -323,6 +1030,10 @@ var _TrezorAdapter = class _TrezorAdapter {
     const { code } = error;
     return code === HardwareErrorCode.DeviceNotFound || code === HardwareErrorCode.DeviceDisconnected;
   }
+  static _isRecoverableProtocolResidueError(error) {
+    const protocolError = error;
+    return protocolError.name === "TrezorProtocolError" && protocolError.code === "Malformed protocol format" && protocolError.message === "Malformed protocol format";
+  }
   /**
    * Race a promise against an abort signal. Copied from LedgerAdapter:
    * IConnector.call() can't actually be cancelled at the protocol level, but
@@ -353,8 +1064,8 @@ var _TrezorAdapter = class _TrezorAdapter {
     });
   }
   async _connectSession(connectId, signal) {
-    const connectPromise = this._connector.connect(connectId);
-    const session = await (async () => {
+    const connectOnce = async () => {
+      const connectPromise = this._connector.connect(connectId);
       if (!signal) return connectPromise;
       try {
         return await _TrezorAdapter._abortable(signal, connectPromise);
@@ -365,7 +1076,19 @@ var _TrezorAdapter = class _TrezorAdapter {
         );
         throw error;
       }
-    })();
+    };
+    let session;
+    try {
+      session = await connectOnce();
+    } catch (error) {
+      if (signal?.aborted || !_TrezorAdapter._isRecoverableProtocolResidueError(error)) {
+        throw error;
+      }
+      debugLog("[TrezorAdapter] retrying connect after draining a stale THP frame", {
+        connectId
+      });
+      session = await connectOnce();
+    }
     if (this._disconnectRequested.delete(connectId)) {
       await this._connector.disconnect(session.sessionId).catch(() => void 0);
       throw Object.assign(new Error("Trezor connection aborted"), {
@@ -529,6 +1252,64 @@ var _TrezorAdapter = class _TrezorAdapter {
   getFeatures(connectId) {
     return this._callDeviceManagerMethod("getFeatures", connectId, {});
   }
+  /**
+   * Device authenticity attestation. Sends a host-generated challenge, has the
+   * device sign it with its secure-element key, then verifies the returned
+   * certificate chain up to a trusted Trezor root CA. On success returns a
+   * `deviceId` that uniquely identifies the physical device, survives wipe, and
+   * cannot be forged from a seed. Only trust the result when `verified` is true
+   * (and `usedDebugKey` is false in production).
+   *
+   * Requires a secure-element model (Safe 3 = T2B1/T3B1, Safe 5 = T3T1, T3W1)
+   * and an on-device confirmation. Older models (T1B1, T2T1) will fail.
+   *
+   * `dangerouslyAllowDebugKeys` accepts simulator / development root keys — NEVER
+   * enable it in a production accounting flow, it lets an emulator mint any id.
+   */
+  async verifyDeviceAuthenticity(connectId, params = {}) {
+    if (params.challenge && params.dangerouslyAllowDebugKeys) {
+      return failure(
+        HardwareErrorCode.InvalidParams,
+        "Debug attestation roots cannot be used with a server challenge"
+      );
+    }
+    if (params.challenge && !/^[0-9a-fA-F]{64}$/.test(params.challenge)) {
+      return failure(
+        HardwareErrorCode.InvalidParams,
+        "Device authenticity challenge must be exactly 32 bytes encoded as hex"
+      );
+    }
+    const featuresRes = await this.getFeatures(connectId);
+    if (!featuresRes.success) return featuresRes;
+    const internalModel = featuresRes.payload.internal_model;
+    if (!internalModel) {
+      return failure(HardwareErrorCode.UnknownError, "Device internal_model unavailable");
+    }
+    const challengeHex = params.challenge?.toLowerCase() ?? Buffer.from(randomBytes(32)).toString("hex");
+    const challenge = Buffer.from(challengeHex, "hex");
+    const proofRes = await this._callDeviceManagerMethod(
+      "authenticateDevice",
+      connectId,
+      { challenge: challengeHex }
+    );
+    if (!proofRes.success) return proofRes;
+    const proof = proofRes.payload;
+    const verification = authenticateDeviceFromProof({
+      proof,
+      challenge,
+      deviceModel: internalModel,
+      allowDebugKeys: params.dangerouslyAllowDebugKeys
+    });
+    return success({
+      ...verification,
+      vendor: "trezor",
+      trezorProof: {
+        challenge: challengeHex,
+        deviceModel: internalModel,
+        proof
+      }
+    });
+  }
   deviceSettings(connectId, params) {
     return this._callDeviceManagerMethod(
       "deviceSettings",
@@ -1313,10 +2094,12 @@ export {
   TREZOR_BLE_UUIDS,
   TREZOR_SAFE_7_MODEL,
   TrezorAdapter,
+  authenticateDeviceFromProof,
   buildEthereumDefinitionsForPath,
   buildEthereumDefinitionsForSignTx,
   fetchEthereumDefinitions,
   fetchSolanaTokenDefinition,
+  getRequiredDeviceAuthenticityLayers,
   getSlip44FromPath,
   isTrezorBleDescriptor,
   isTrezorBleServiceUuid,