@sidhujag/sysweb3-keyring 1.0.627 → 2.0.0

package/types/hardware-wallet-manager.d.ts

@@ -1,5 +1,5 @@
-import Transport from '@ledgerhq/hw-transport';
 import { EventEmitter } from 'events';
+import type { LedgerHost } from './ledger/host-types';
 export declare enum HardwareWalletType {
     LEDGER = "ledger",
     TREZOR = "trezor"
@@ -31,25 +31,22 @@ export interface HardwareWalletStatus {
  * Hardware Wallet Manager with connection pooling, status monitoring, and error recovery
  */
 export declare class HardwareWalletManager extends EventEmitter {
+    private readonly ledgerHost?;
     private connectionPool;
     private statusMonitorInterval;
-    private readonly CONNECTION_TIMEOUT;
+    private unsubscribeTrezor?;
+    private lifecycleGeneration;
+    private trezorInitialization?;
+    private destruction?;
+    private ledgerInitialization?;
     private readonly IDLE_TIMEOUT;
     private readonly STATUS_CHECK_INTERVAL;
     private readonly retryConfig;
-    constructor();
-    /**
-     * Get or create a Ledger connection with retry logic
-     */
-    getLedgerConnection(): Promise<Transport>;
-    /**
-     * Create Ledger connection with exponential backoff retry
-     */
-    private createLedgerConnectionWithRetry;
-    /**
-     * Create Ledger transport with timeout
-     */
-    private createLedgerTransport;
+    constructor(ledgerHost?: LedgerHost | undefined);
+    private observeTrezor;
+    /** Raw transports are deliberately unavailable through the semantic host boundary. */
+    getLedgerConnection(): Promise<never>;
+    private initializeLedger;
     /**
      * Initialize Trezor with retry logic
      */
@@ -94,10 +91,6 @@ export declare class HardwareWalletManager extends EventEmitter {
      * Calculate exponential backoff delay
      */
     private calculateBackoffDelay;
-    /**
-     * Create a timeout promise
-     */
-    private createTimeoutPromise;
     /**
      * Delay helper
      */

package/types/keyring-core.d.ts

@@ -0,0 +1,263 @@
+import { INetwork, INetworkType } from '@sidhujag/sysweb3-network';
+import { IDecryptPrivateRecordParams, IEncryptedPrivateRecord, IEncryptPrivateRecordParams } from './private-records';
+import { SyscoinHDSigner } from './signers';
+import { type ISyscoinHardwareSigners } from './transactions/syscoin-core';
+import { IKeyringAccountState, ICreateSmartAccountParams, ISyscoinTransactions, KeyringAccountType, IEthereumTransactions } from './types';
+import type { LedgerKeyring } from './ledger';
+import type { EncryptedEvmHdRuntimeAccount, EvmHdRuntimeAccountOptions, EvmHdRuntimeAccountRequest } from './software-hd-account';
+import type { VaultPersistence, VaultStoragePort } from './storage-core';
+import type { PreparedEvmSigningOptions, PreparedSoftwareEvmSigningRequest, SignedPreparedEvmTransaction } from './transactions/prepared-evm';
+import type { TrezorKeyring } from './trezor';
+/** Explicit asynchronous host storage; no browser or global DI fallback. */
+export interface KeyringStoragePort extends VaultStoragePort {
+    get(key: string): Promise<any>;
+    deleteItem(key: string): Promise<void>;
+    /** Legacy adapter capability; fixed native hosts can omit it. */
+    setClient?(client: any): void;
+}
+/** Only the device capabilities consumed by the wallet authority. */
+export interface KeyringLedgerSigner {
+    destroy: LedgerKeyring['destroy'];
+    evm: Pick<LedgerKeyring['evm'], 'getEvmAddressAndPubKey' | 'signTypedData' | 'signPersonalMessage' | 'signEVMTransaction'>;
+    utxo: Pick<LedgerKeyring['utxo'], 'getXpub'>;
+    verifyUtxoAddress: LedgerKeyring['verifyUtxoAddress'];
+}
+export type KeyringTrezorSigner = Pick<TrezorKeyring, 'destroy' | 'getAccountInfo' | 'getPublicKey' | 'signTypedData' | 'signMessage' | 'signEthTransaction' | 'verifyUtxoAddress'>;
+export interface KeyringCoreDependencies<TLedger extends KeyringLedgerSigner | undefined, TTrezor extends KeyringTrezorSigner | undefined> {
+    /** Immutable identity shared only by keyrings in the same wallet authority. */
+    authority: object;
+    storage: KeyringStoragePort;
+    /** Must be bound to this authority's storage and shared across its keyrings. */
+    vaultPersistence: VaultPersistence;
+    ledgerSigner: TLedger;
+    trezorSigner: TTrezor;
+    /** Trusted host adapters; absent device capabilities fail closed. */
+    syscoinHardwareSigners?: ISyscoinHardwareSigners;
+}
+export interface ISysAccount {
+    address: string;
+    label?: string;
+    xprv?: string;
+    xpub: string;
+}
+/**
+ * Secure Buffer implementation for sensitive data
+ * Provides explicit memory clearing capability
+ */
+declare class SecureBuffer {
+    private buffer;
+    private _isCleared;
+    constructor(data: string | Buffer);
+    get(): Buffer;
+    toString(): string;
+    clear(): void;
+    isCleared(): boolean;
+}
+export declare class KeyringCore<TLedger extends KeyringLedgerSigner | undefined = KeyringLedgerSigner | undefined, TTrezor extends KeyringTrezorSigner | undefined = KeyringTrezorSigner | undefined> {
+    trezorSigner: TTrezor;
+    ledgerSigner: TLedger;
+    initialTrezorAccountState: IKeyringAccountState;
+    initialLedgerAccountState: IKeyringAccountState;
+    utf8Error: boolean;
+    ethereumTransaction: IEthereumTransactions;
+    syscoinTransaction: ISyscoinTransactions;
+    private readonly authority;
+    private readonly storage;
+    private readonly vaultPersistence;
+    private readonly syscoinHardwareSigners;
+    private getVaultState;
+    setVaultStateGetter: (getter: () => any) => void;
+    private getVault;
+    private getActiveChain;
+    private accountAddressExists;
+    private sessionPassword;
+    private sessionMnemonic;
+    private privateRecordSessionRevision;
+    constructor(dependencies: KeyringCoreDependencies<TLedger, TTrezor>);
+    private createSyscoinTransactions;
+    private requireLedgerSigner;
+    private requireTrezorSigner;
+    initialize(seed: string, password: string, network?: INetwork): Promise<IKeyringAccountState>;
+    setStorage: (client: any) => void;
+    validateAccountType: (account: IKeyringAccountState) => KeyringAccountType.HDAccount | KeyringAccountType.Imported;
+    isUnlocked: () => boolean;
+    lockWallet: () => Promise<void>;
+    transferSessionTo: (targetKeyring: Pick<KeyringCore, "receiveSessionOwnership">) => void;
+    private acceptSessionFrom;
+    receiveSessionOwnership: (sessionPassword: SecureBuffer, sessionMnemonic: SecureBuffer) => void;
+    private replaceSessionBuffers;
+    addNewAccount: (label?: string) => Promise<IKeyringAccountState>;
+    createSmartAccount: ({ address, deriveAccount, label, metadata, }: ICreateSmartAccountParams) => Promise<IKeyringAccountState>;
+    /**
+     * Returns canLogin:false only when the first vault authentication fails.
+     * Storage, platform and session restoration failures reject so callers do
+     * not charge a failed password attempt for an operational error.
+     */
+    unlock(password: string): Promise<{
+        canLogin: boolean;
+        needsAccountCreation?: boolean;
+    }>;
+    getNewChangeAddress: () => Promise<string>;
+    getChangeAddress: (id: number) => Promise<string>;
+    getPubkey: (id: number, isChangeAddress: boolean) => Promise<string>;
+    getBip32Path: (id: number, isChangeAddress: boolean) => Promise<string>;
+    updateReceivingAddress: () => Promise<string>;
+    getAccountById: (id: number, accountType: KeyringAccountType) => Omit<IKeyringAccountState, "xprv">;
+    getPrivateKeyByAccountId: (id: number, accountType: KeyringAccountType, pwd: string) => Promise<string>;
+    getActiveAccount: () => {
+        activeAccount: Omit<IKeyringAccountState, "xprv">;
+        activeAccountType: KeyringAccountType;
+    };
+    private isDescriptor;
+    private isXpubLike;
+    private isWatchOnlyAccount;
+    getEncryptedXprv: (hd: SyscoinHDSigner) => string;
+    getSeed: (pwd: string) => Promise<any>;
+    deriveSLHDSASetupSecretForAccount: ({ accountIndex, }: {
+        accountIndex: number;
+    }) => Promise<{
+        derivationLabel: string;
+        setupSecretHex: string;
+    }>;
+    encryptSLHDSASessionState: (plainText: string) => string;
+    decryptSLHDSASessionState: (cipherText: string) => string;
+    private privateRecordSession;
+    /** Stable local profile identifier; never an account address or a key. */
+    getPrivateRecordProfileId(): Promise<string>;
+    /** Encrypt caller-owned bytes; persistence and encrypted backup belong to the caller. */
+    encryptPrivateRecord(params: IEncryptPrivateRecordParams): Promise<IEncryptedPrivateRecord>;
+    decryptPrivateRecord(params: IDecryptPrivateRecordParams): Promise<Uint8Array>;
+    setSignerNetwork: (network: INetwork) => Promise<{
+        activeChain?: INetworkType;
+        success: boolean;
+    }>;
+    forgetMainWallet: (pwd: string) => Promise<void>;
+    importWeb3Account: (mnemonicOrPrivKey: string) => import("./transactions/evm-local-signer").EvmLocalAccount;
+    getAccountXpub: () => string;
+    isSeedValid: (seedPhrase: string) => any;
+    createNewSeed: (wordCount?: number) => any;
+    getUTXOState: () => any;
+    importTrezorAccount(label?: string): Promise<IKeyringAccountState<any>>;
+    importLedgerAccount(label?: string): Promise<IKeyringAccountState<any>>;
+    getActiveUTXOAccountState: () => any;
+    getNetwork: () => any;
+    createEthAccount: (privateKey: string) => import("./transactions/evm-local-signer").EvmLocalAccount;
+    private fetchCurrentAccountData;
+    getAddress: (xpub: string, isChangeAddress: boolean, options?: {
+        forceIndex0?: boolean;
+    }) => Promise<string>;
+    getCurrentAddressPubkey: (xpub: string, isChangeAddress: boolean) => Promise<string>;
+    getCurrentAddressBip32Path: (xpub: string, isChangeAddress: boolean) => Promise<string>;
+    logout: () => void;
+    importAccount(privKey: string, label?: string, options?: {
+        utxoAddressType?: 'p2wpkh' | 'p2pkh' | 'p2tr';
+    }): Promise<IKeyringAccountState<any>>;
+    importWatchOnly(identifier: string, label?: string): Promise<IKeyringAccountState<any>>;
+    validateZprv(zprv: string, targetNetwork?: INetwork): {
+        isValid: boolean;
+        node: any;
+        network: {
+            bip32: {
+                public: number;
+                private: number;
+            };
+            messagePrefix: string;
+            bech32: string;
+            pubKeyHash: any;
+            scriptHash: any;
+            slip44: any;
+            wif: any;
+        };
+        message: string;
+    } | {
+        isValid: boolean;
+        message: any;
+        node?: undefined;
+        network?: undefined;
+    };
+    validateWif(wif: string, targetNetwork?: INetwork): {
+        isValid: boolean;
+        message?: undefined;
+    } | {
+        isValid: boolean;
+        message: any;
+    };
+    /**
+     * PRIVATE METHODS
+     */
+    private getDecryptedPrivateKey;
+    private capturePsbtSigningContext;
+    /** Fixed-path derivation for an authenticated software host; no persistence. */
+    protected deriveSoftwareEvmHdRuntimeAccount(input: EvmHdRuntimeAccountRequest, options: EvmHdRuntimeAccountOptions): Promise<EncryptedEvmHdRuntimeAccount>;
+    /** The software facade owns this public capability; no device fallback. */
+    protected signPreparedSoftwareEvmTransaction(input: PreparedSoftwareEvmSigningRequest, options: PreparedEvmSigningOptions): SignedPreparedEvmTransaction;
+    private getSigner;
+    private getReadOnlySigner;
+    private writeUtf8Diagnostic;
+    private validateAndHandleErrorByMessage;
+    private getAccountsState;
+    /**
+     *
+     * @param password
+     * @param salt
+     * @returns derived key: hex string
+     */
+    private encryptSHA512;
+    private hasWebCrypto;
+    private hexToBytes;
+    private bytesToHex;
+    private getEncIterations;
+    private pbkdf2WebCryptoHex;
+    private encryptSHA512Async;
+    private deriveLegacySessionKey;
+    private deriveStoredSessionKey;
+    private getSysActivePrivateKey;
+    private getInitialAccountData;
+    private _createTrezorAccount;
+    private _createLedgerAccount;
+    private getFormattedBackendAccount;
+    private setLatestIndexesFromXPubTokens;
+    private createUTXOAccountAtIndex;
+    private addNewAccountToSyscoinChain;
+    private addNewAccountToEth;
+    private getNextAccountId;
+    private getBasicWeb3AccountInfo;
+    private setDerivedWeb3Accounts;
+    private setSignerEVM;
+    private clearTemporaryLocalKeys;
+    private recreateSessionFromVault;
+    private _getPrivateKeyAccountInfos;
+    /**
+     * Common method to decrypt mnemonic from session
+     * Eliminates code duplication across multiple methods
+     */
+    private getDecryptedMnemonic;
+    /**
+     * Creates network RPC config from current active network without making RPC calls
+     * Common utility for all on-demand signer creation
+     */
+    private createNetworkRpcConfig;
+    /**
+     * Common signer creation logic - takes decrypted mnemonic/zprv and creates fresh signer
+     * OPTIMIZED: No RPC call needed - uses network config directly
+     */
+    private createFreshUTXOSigner;
+    /**
+     * Creates a fresh UTXO signer for HD accounts derived from the main seed
+     * OPTIMIZED: No RPC call needed - uses network config directly
+     */
+    private createOnDemandUTXOSigner;
+    private isZprv;
+    initializeSession: (seedPhrase: string, password: string) => Promise<void>;
+    createFirstAccount: (label?: string) => Promise<IKeyringAccountState>;
+    initializeWalletSecurely: (seedPhrase: string, password: string) => Promise<IKeyringAccountState>;
+    private getSessionPasswordString;
+    private getSessionMnemonicString;
+    private withSecureData;
+    private generateNetworkAwareLabel;
+    /**
+     * Clean up all resources
+     */
+    destroy(): Promise<void>;
+}
+export {};

package/types/keyring-manager.d.ts

@@ -1,229 +1,12 @@
-import { INetwork, INetworkType } from '@sidhujag/sysweb3-network';
 import { HardwareWalletManager } from './hardware-wallet-manager';
+import { KeyringCore } from './keyring-core';
 import { LedgerKeyring } from './ledger';
-import { IDecryptPrivateRecordParams, IEncryptedPrivateRecord, IEncryptPrivateRecordParams } from './private-records';
-import { SyscoinHDSigner } from './signers';
 import { TrezorKeyring } from './trezor';
-import { IKeyringAccountState, ICreateSmartAccountParams, ISyscoinTransactions, KeyringAccountType, IEthereumTransactions, IKeyringManager } from './types';
-export interface ISysAccount {
-    address: string;
-    label?: string;
-    xprv?: string;
-    xpub: string;
-}
-/**
- * Secure Buffer implementation for sensitive data
- * Provides explicit memory clearing capability
- */
-declare class SecureBuffer {
-    private buffer;
-    private _isCleared;
-    constructor(data: string | Buffer);
-    get(): Buffer;
-    toString(): string;
-    clear(): void;
-    isCleared(): boolean;
-}
-export declare class KeyringManager implements IKeyringManager {
-    trezorSigner: TrezorKeyring;
-    ledgerSigner: LedgerKeyring;
-    initialTrezorAccountState: IKeyringAccountState;
-    initialLedgerAccountState: IKeyringAccountState;
-    utf8Error: boolean;
-    ethereumTransaction: IEthereumTransactions;
-    syscoinTransaction: ISyscoinTransactions;
-    private storage;
-    private getVaultState;
-    setVaultStateGetter: (getter: () => any) => void;
-    private getVault;
-    private getActiveChain;
-    private accountAddressExists;
-    private sessionPassword;
-    private sessionMnemonic;
-    private privateRecordSessionRevision;
-    /**
-     * @param sharedHardwareWalletManager Optional shared HardwareWalletManager instance.
-     *                                     If not provided, the singleton instance will be used.
-     *                                     This allows multiple KeyringManagers to share the same
-     *                                     hardware wallet connections, preventing "device already open" errors.
-     */
-    constructor(sharedHardwareWalletManager?: HardwareWalletManager);
+import type { IKeyringManager } from './types';
+import type { LedgerHost } from './ledger/host-types';
+export type { ISysAccount } from './keyring-core';
+/** Existing browser entry. Native/software hosts must use the software entry. */
+export declare class KeyringManager extends KeyringCore<LedgerKeyring, TrezorKeyring> implements IKeyringManager {
+    constructor(sharedHardwareWalletManager?: HardwareWalletManager, ledgerHost?: LedgerHost);
     static createInitialized(seed: string, password: string, vaultStateGetter: () => any): Promise<KeyringManager>;
-    initialize(seed: string, password: string, network?: INetwork): Promise<IKeyringAccountState>;
-    setStorage: (client: any) => any;
-    validateAccountType: (account: IKeyringAccountState) => KeyringAccountType.HDAccount | KeyringAccountType.Imported;
-    isUnlocked: () => boolean;
-    lockWallet: () => Promise<void>;
-    transferSessionTo: (targetKeyring: IKeyringManager) => void;
-    receiveSessionOwnership: (sessionPassword: SecureBuffer, sessionMnemonic: SecureBuffer) => void;
-    addNewAccount: (label?: string) => Promise<IKeyringAccountState>;
-    createSmartAccount: ({ address, deriveAccount, label, metadata, }: ICreateSmartAccountParams) => Promise<IKeyringAccountState>;
-    /**
-     * Returns canLogin:false only when the first vault authentication fails.
-     * Storage, platform and session restoration failures reject so callers do
-     * not charge a failed password attempt for an operational error.
-     */
-    unlock(password: string): Promise<{
-        canLogin: boolean;
-        needsAccountCreation?: boolean;
-    }>;
-    getNewChangeAddress: () => Promise<string>;
-    getChangeAddress: (id: number) => Promise<string>;
-    getPubkey: (id: number, isChangeAddress: boolean) => Promise<string>;
-    getBip32Path: (id: number, isChangeAddress: boolean) => Promise<string>;
-    updateReceivingAddress: () => Promise<string>;
-    getAccountById: (id: number, accountType: KeyringAccountType) => Omit<IKeyringAccountState, "xprv">;
-    getPrivateKeyByAccountId: (id: number, accountType: KeyringAccountType, pwd: string) => Promise<string>;
-    getActiveAccount: () => {
-        activeAccount: Omit<IKeyringAccountState, "xprv">;
-        activeAccountType: KeyringAccountType;
-    };
-    private isDescriptor;
-    private isXpubLike;
-    private isWatchOnlyAccount;
-    getEncryptedXprv: (hd: SyscoinHDSigner) => string;
-    getSeed: (pwd: string) => Promise<any>;
-    deriveSLHDSASetupSecretForAccount: ({ accountIndex, }: {
-        accountIndex: number;
-    }) => Promise<{
-        derivationLabel: string;
-        setupSecretHex: string;
-    }>;
-    encryptSLHDSASessionState: (plainText: string) => string;
-    decryptSLHDSASessionState: (cipherText: string) => string;
-    private privateRecordSession;
-    /** Stable local profile identifier; never an account address or a key. */
-    getPrivateRecordProfileId(): Promise<string>;
-    /** Encrypt caller-owned bytes; persistence and encrypted backup belong to the caller. */
-    encryptPrivateRecord(params: IEncryptPrivateRecordParams): Promise<IEncryptedPrivateRecord>;
-    decryptPrivateRecord(params: IDecryptPrivateRecordParams): Promise<Uint8Array>;
-    setSignerNetwork: (network: INetwork) => Promise<{
-        activeChain?: INetworkType;
-        success: boolean;
-    }>;
-    forgetMainWallet: (pwd: string) => Promise<void>;
-    importWeb3Account: (mnemonicOrPrivKey: string) => import("./transactions/evm-local-signer").EvmLocalAccount;
-    getAccountXpub: () => string;
-    isSeedValid: (seedPhrase: string) => any;
-    createNewSeed: (wordCount?: number) => any;
-    getUTXOState: () => any;
-    importTrezorAccount(label?: string): Promise<IKeyringAccountState<any>>;
-    importLedgerAccount(label?: string): Promise<IKeyringAccountState<any>>;
-    getActiveUTXOAccountState: () => any;
-    getNetwork: () => any;
-    createEthAccount: (privateKey: string) => import("./transactions/evm-local-signer").EvmLocalAccount;
-    private fetchCurrentAccountData;
-    getAddress: (xpub: string, isChangeAddress: boolean, options?: {
-        forceIndex0?: boolean;
-    }) => Promise<string>;
-    getCurrentAddressPubkey: (xpub: string, isChangeAddress: boolean) => Promise<string>;
-    getCurrentAddressBip32Path: (xpub: string, isChangeAddress: boolean) => Promise<string>;
-    logout: () => void;
-    importAccount(privKey: string, label?: string, options?: {
-        utxoAddressType?: 'p2wpkh' | 'p2pkh' | 'p2tr';
-    }): Promise<IKeyringAccountState<any>>;
-    importWatchOnly(identifier: string, label?: string): Promise<IKeyringAccountState<any>>;
-    validateZprv(zprv: string, targetNetwork?: INetwork): {
-        isValid: boolean;
-        node: any;
-        network: {
-            bip32: {
-                public: number;
-                private: number;
-            };
-            messagePrefix: string;
-            bech32: string;
-            pubKeyHash: any;
-            scriptHash: any;
-            slip44: any;
-            wif: any;
-        };
-        message: string;
-    } | {
-        isValid: boolean;
-        message: any;
-        node?: undefined;
-        network?: undefined;
-    };
-    validateWif(wif: string, targetNetwork?: INetwork): {
-        isValid: boolean;
-        message?: undefined;
-    } | {
-        isValid: boolean;
-        message: any;
-    };
-    /**
-     * PRIVATE METHODS
-     */
-    private getDecryptedPrivateKey;
-    private capturePsbtSigningContext;
-    private getSigner;
-    private getReadOnlySigner;
-    private writeUtf8Diagnostic;
-    private validateAndHandleErrorByMessage;
-    private getAccountsState;
-    /**
-     *
-     * @param password
-     * @param salt
-     * @returns derived key: hex string
-     */
-    private encryptSHA512;
-    private hasWebCrypto;
-    private hexToBytes;
-    private bytesToHex;
-    private getEncIterations;
-    private pbkdf2WebCryptoHex;
-    private encryptSHA512Async;
-    private deriveLegacySessionKey;
-    private deriveStoredSessionKey;
-    private getSysActivePrivateKey;
-    private getInitialAccountData;
-    private _createTrezorAccount;
-    private _createLedgerAccount;
-    private getFormattedBackendAccount;
-    private setLatestIndexesFromXPubTokens;
-    private createUTXOAccountAtIndex;
-    private addNewAccountToSyscoinChain;
-    private addNewAccountToEth;
-    private getNextAccountId;
-    private getBasicWeb3AccountInfo;
-    private setDerivedWeb3Accounts;
-    private setSignerEVM;
-    private clearTemporaryLocalKeys;
-    private recreateSessionFromVault;
-    private _getPrivateKeyAccountInfos;
-    /**
-     * Common method to decrypt mnemonic from session
-     * Eliminates code duplication across multiple methods
-     */
-    private getDecryptedMnemonic;
-    /**
-     * Creates network RPC config from current active network without making RPC calls
-     * Common utility for all on-demand signer creation
-     */
-    private createNetworkRpcConfig;
-    /**
-     * Common signer creation logic - takes decrypted mnemonic/zprv and creates fresh signer
-     * OPTIMIZED: No RPC call needed - uses network config directly
-     */
-    private createFreshUTXOSigner;
-    /**
-     * Creates a fresh UTXO signer for HD accounts derived from the main seed
-     * OPTIMIZED: No RPC call needed - uses network config directly
-     */
-    private createOnDemandUTXOSigner;
-    private isZprv;
-    initializeSession: (seedPhrase: string, password: string) => Promise<void>;
-    createFirstAccount: (label?: string) => Promise<IKeyringAccountState>;
-    initializeWalletSecurely: (seedPhrase: string, password: string) => Promise<IKeyringAccountState>;
-    private getSessionPasswordString;
-    private getSessionMnemonicString;
-    private withSecureData;
-    private generateNetworkAwareLabel;
-    /**
-     * Clean up all resources
-     */
-    destroy(): Promise<void>;
 }
-export {};

package/types/ledger/bitcoin_client/lib/appClient.d.ts

@@ -1,6 +1,9 @@
-import Transport from '@ledgerhq/hw-transport';
 import { WalletPolicy } from './policy';
 import { PsbtV2 } from './psbtv2';
+/** The Bitcoin protocol needs APDU exchange only, not a vendor transport class. */
+export interface BitcoinAppTransport {
+    send(cla: number, ins: number, p1: number, p2: number, data?: Buffer, acceptedStatusCodes?: number[]): Promise<Buffer>;
+}
 /**
  * This class represents a partial signature produced by the app during signing.
  * It always contains the `signature` and the corresponding `pubkey` whose private key
@@ -18,8 +21,8 @@ export declare class PartialSignature {
  * https://github.com/LedgerHQ/app-bitcoin-new/blob/master/doc/bitcoin.md
  */
 export declare class AppClient {
-    readonly transport: Transport;
-    constructor(transport: Transport);
+    readonly transport: BitcoinAppTransport;
+    constructor(transport: BitcoinAppTransport);
     private makeRequest;
     /**
      * Returns an object containing the currently running app's name, version and the device status flags.

package/types/ledger/dmk-evm.d.ts

@@ -0,0 +1,8 @@
+import { type ContextModule } from '@ledgerhq/context-module';
+import { type LedgerEvmHost, type LedgerEvmConfig } from './host-types';
+import type { LedgerDmkSession } from './dmk-session';
+export type { LedgerBlindSigningIntent, LedgerEvmConfig } from './host-types';
+/** No remote metadata, transaction checks, or signing telemetry by default. */
+export declare const offlineLedgerContext: ContextModule;
+/** EVM facade preserves existing SDK signature formats and performs no broadcast. */
+export declare function createLedgerEvmAdapter(session: LedgerDmkSession, config?: LedgerEvmConfig): LedgerEvmHost;

package/types/ledger/dmk-session.d.ts

@@ -0,0 +1,60 @@
+import { type LedgerOperationOptions } from './host-types';
+import type { DeviceManagementKit } from '@ledgerhq/device-management-kit';
+import type { Observable } from 'rxjs';
+type Action<Output> = {
+    observable: Observable<{
+        status: 'not-started' | 'stopped';
+    } | {
+        status: 'pending';
+        intermediateValue: {
+            requiredUserInteraction: string;
+            step?: string;
+        };
+    } | {
+        status: 'completed';
+        output: Output;
+    } | {
+        status: 'error';
+        error: unknown;
+    }>;
+    cancel(): void;
+};
+export interface LedgerDmkOperation {
+    readonly dmk: DeviceManagementKit;
+    readonly sessionId: string;
+    readonly generation: number;
+    readonly signal: AbortSignal;
+    assertCurrent(): void;
+    runAction<Output>(createAction: () => Action<Output>): Promise<Output>;
+}
+/** One owner and one semantic operation at a time, across EVM and UTXO apps. */
+export declare class LedgerDmkSession {
+    readonly dmk: DeviceManagementKit;
+    private generation;
+    private sessionId;
+    private queue;
+    private activeCancel;
+    private activeAbort;
+    private closing;
+    private stateSubscription;
+    private connectionAttempt;
+    private connectionAbort;
+    private readonly invalidationListeners;
+    constructor(dmk: DeviceManagementKit);
+    getStatus(): {
+        connected: boolean;
+    };
+    onInvalidated(listener: () => void): () => void;
+    private invalidate;
+    /** Device selection belongs to the visible host, never to a dapp request. */
+    connect(request?: {
+        useGrantedDevices?: boolean;
+    }, options?: LedgerOperationOptions): Promise<void>;
+    private connectDevice;
+    /** Cancel revokes the result and closes I/O; it cannot undo on-device approval. */
+    disconnect(): Promise<void>;
+    runExclusive<Output>(operation: (session: LedgerDmkOperation) => Promise<Output>, options?: LedgerOperationOptions): Promise<Output>;
+    runAction<Output>(createAction: (session: LedgerDmkOperation) => Action<Output>, options?: LedgerOperationOptions): Promise<Output>;
+    private awaitAction;
+}
+export {};

package/types/ledger/dmk-utxo.d.ts

@@ -0,0 +1,26 @@
+import { DeviceExchangeError, type ApduResponse, type Command, type InternalApi } from '@ledgerhq/device-management-kit';
+import { type BitcoinAppTransport } from './bitcoin_client/lib/appClient';
+import { LedgerDmkSession } from './dmk-session';
+import { type LedgerUtxoAccount, type LedgerUtxoHost } from './host-types';
+export declare class LedgerProtocolError extends DeviceExchangeError<number> {
+    readonly statusCode: number;
+    readonly code: string;
+    constructor(statusCode: number);
+}
+/** Preserves the existing Bitcoin/Syscoin APDU contract, including 0xe000. */
+export declare class LedgerBitcoinCommand implements Command<Buffer, void, number> {
+    private readonly cla;
+    private readonly ins;
+    private readonly p1;
+    private readonly p2;
+    private readonly data;
+    private readonly acceptedStatusCodes;
+    readonly name = "PaliBitcoinProtocol";
+    constructor(cla: number, ins: number, p1: number, p2: number, data?: Uint8Array, acceptedStatusCodes?: number[]);
+    getApdu(): import("@ledgerhq/device-management-kit").Apdu;
+    parseResponse(response: ApduResponse): import("@ledgerhq/device-management-kit").CommandResult<Buffer<ArrayBufferLike>, number>;
+}
+/** Must be used inside a single DeviceAction; public dmk.sendCommand would requeue. */
+export declare function createBitcoinAppTransport(internalApi: InternalApi, assertCurrent: () => void): BitcoinAppTransport;
+export declare function ledgerUtxoApp(request: LedgerUtxoAccount): string;
+export declare function createLedgerUtxoAdapter(session: LedgerDmkSession): LedgerUtxoHost;