@swapkit/wallet-hardware 5.0.0 → 6.0.0

package/src/ledger/clients/sui.ts

@@ -1,3 +1,4 @@
+import type { UserInteractionRequired } from "@ledgerhq/device-management-kit";
 import type Sui from "@ledgerhq/hw-app-sui";
 import type Transport from "@ledgerhq/hw-transport";
 import {
@@ -8,55 +9,57 @@ import {
   SwapKitError,
 } from "@swapkit/helpers";
 
-import { getLedgerTransport } from "../helpers/getLedgerTransport";
+import {
+  LEDGER_USER_INTERACTION_REQUIRED,
+  type LedgerJsClientParams,
+  normalizeLedgerJsClientParams,
+  runLedgerJsOperation,
+} from "../helpers/ledgerJsDmkBridge";
+
+type SuiLedgerParams = LedgerJsClientParams<DerivationPathArray | string>;
 
 export class SuiLedgerInterface {
-  derivationPath: string;
-  ledgerApp: InstanceType<typeof Sui> | null = null;
+  readonly derivationPath: string;
   address: string | null = null;
   publicKey: Uint8Array | null = null;
-  private readonly injectedTransport?: Transport;
+  private readonly connection: Omit<SuiLedgerParams, "derivationPath">;
 
-  constructor(derivationPath?: DerivationPathArray | string, transport?: Transport) {
+  constructor(paramsOrPath?: SuiLedgerParams | DerivationPathArray | string, transport?: Transport) {
+    const { derivationPath, ...connection } = normalizeLedgerJsClientParams({ paramsOrPath, transport });
     this.derivationPath =
       typeof derivationPath === "string"
         ? derivationPath
         : derivationPathToString(derivationPath || NetworkDerivationPath[Chain.Sui]);
-    this.injectedTransport = transport;
+    this.connection = connection;
   }
 
-  /**
-   * Transform derivation path for SUI Ledger format.
-   * SUI Ledger expects: 44'/784'/0'/0'/0' (all hardened, no 'm/' prefix)
-   * Standard format is: m/44'/784'/0'/0/0 (only first 3 hardened, has 'm/' prefix)
-   */
-  private getLedgerPath(): string {
-    return this.derivationPath
-      .replace(/^m\//, "") // Remove 'm/' prefix
-      .replace(/\/(\d+)\/(\d+)$/, "/$1'/$2'"); // Make last two components hardened
+  // The Sui app wants every level hardened and no `m/`: m/44'/784'/0'/0/0 becomes 44'/784'/0'/0'/0'.
+  private getLedgerPath() {
+    return this.derivationPath.replace(/^m\//, "").replace(/\/(\d+)\/(\d+)$/, "/$1'/$2'");
   }
 
-  private async createTransportAndLedger() {
-    if (this.ledgerApp) return;
-
-    const transport = this.injectedTransport ?? (await getLedgerTransport());
+  private async runSuiOperation<Output>({
+    operation,
+    requiredUserInteraction,
+  }: {
+    operation: (app: InstanceType<typeof Sui>) => Promise<Output>;
+    requiredUserInteraction?: UserInteractionRequired;
+  }) {
     const SuiApp = (await import("@ledgerhq/hw-app-sui")).default;
-    this.ledgerApp = new SuiApp(transport);
+    return runLedgerJsOperation({
+      appName: "Sui",
+      connection: this.connection,
+      createApp: (ledgerTransport) => new SuiApp(ledgerTransport),
+      operation,
+      requiredUserInteraction,
+    });
   }
 
-  async connect(): Promise<string> {
-    await this.createTransportAndLedger();
-
-    if (!this.ledgerApp) {
-      throw new SwapKitError("wallet_ledger_transport_error");
-    }
-
+  async connect() {
     const ledgerPath = this.getLedgerPath();
-    const result = await this.ledgerApp.getPublicKey(ledgerPath);
+    const result = await this.runSuiOperation({ operation: (app) => app.getPublicKey(ledgerPath) });
 
-    if (!result?.publicKey) {
-      throw new SwapKitError("wallet_ledger_failed_to_get_address");
-    }
+    if (!result?.publicKey) throw new SwapKitError("wallet_ledger_failed_to_get_address");
 
     this.publicKey = result.publicKey;
     this.address = `0x${Buffer.from(result.address).toString("hex")}`;
@@ -64,71 +67,55 @@ export class SuiLedgerInterface {
     return this.address;
   }
 
-  toSuiAddress(): string {
-    if (!this.address) {
-      throw new SwapKitError("wallet_ledger_failed_to_get_address");
-    }
+  toSuiAddress() {
+    if (!this.address) throw new SwapKitError("wallet_ledger_failed_to_get_address");
     return this.address;
   }
 
-  async getAddress(): Promise<string> {
+  async getAddress() {
     if (this.address) return this.address;
     return await this.connect();
   }
 
-  async signTransaction(
-    input: Uint8Array | { transaction: Uint8Array },
-  ): Promise<{ bytes: string; signature: string }> {
+  async signTransaction(input: Uint8Array | { transaction: Uint8Array }) {
     const txBytes = input instanceof Uint8Array ? input : input.transaction;
-    await this.createTransportAndLedger();
-
-    if (!this.ledgerApp) {
-      throw new SwapKitError("wallet_ledger_transport_error");
-    }
-
-    if (!this.publicKey) {
-      throw new SwapKitError("wallet_ledger_failed_to_get_address");
-    }
+    if (!this.publicKey) throw new SwapKitError("wallet_ledger_failed_to_get_address");
 
     try {
       const ledgerPath = this.getLedgerPath();
-
-      // SUI intent message format for TransactionData:
-      // [intent_scope=0 (TransactionData), intent_version=0, app_id=0] + transaction_bytes
-      // The Ledger SUI app expects the INTENT MESSAGE, not raw transaction bytes
+      // The app signs the intent message, not the raw bytes. Its three-byte prefix (scope TransactionData,
+      // version V0, app Sui) is all zeros, which the fresh buffer already holds.
       const intentMessage = new Uint8Array(3 + txBytes.length);
-      intentMessage[0] = 0; // IntentScope: TransactionData
-      intentMessage[1] = 0; // IntentVersion: V0
-      intentMessage[2] = 0; // AppId: Sui
       intentMessage.set(txBytes, 3);
 
-      const result = await this.ledgerApp.signTransaction(ledgerPath, intentMessage);
+      const result = await this.runSuiOperation({
+        operation: (app) => app.signTransaction(ledgerPath, intentMessage),
+        requiredUserInteraction: LEDGER_USER_INTERACTION_REQUIRED.SignTransaction,
+      });
 
-      if (!result?.signature) {
-        throw new SwapKitError("wallet_ledger_signing_error");
-      }
+      if (!result?.signature) throw new SwapKitError("wallet_ledger_signing_error");
 
-      // SUI signature format: [scheme_flag (1 byte)] + [signature (64 bytes)] + [public_key (32 bytes)]
-      // Scheme flag 0x00 = Ed25519
       const pubKey = this.publicKey.length === 33 ? this.publicKey.slice(1) : this.publicKey;
       if (pubKey.length !== 32) {
         throw new SwapKitError("wallet_ledger_signing_error", { error: "Invalid public key length" });
       }
 
+      // Sui serialised signature: Ed25519 flag (0x00), 64-byte signature, 32-byte public key.
       const serializedSignature = new Uint8Array(1 + 64 + 32);
-      serializedSignature[0] = 0x00; // Ed25519 scheme flag
       serializedSignature.set(result.signature, 1);
       serializedSignature.set(pubKey, 65);
 
-      const signatureBase64 = Buffer.from(serializedSignature).toString("base64");
-      const bytesBase64 = Buffer.from(txBytes).toString("base64");
-
-      return { bytes: bytesBase64, signature: signatureBase64 };
+      return {
+        bytes: Buffer.from(txBytes).toString("base64"),
+        signature: Buffer.from(serializedSignature).toString("base64"),
+      };
     } catch (error) {
+      if (error instanceof SwapKitError) throw error;
       throw new SwapKitError("wallet_ledger_signing_error", { error });
     }
   }
 }
 
-export const SuiLedger = (derivationPath?: DerivationPathArray, transport?: Transport) =>
-  new SuiLedgerInterface(derivationPath, transport);
+export function SuiLedger(paramsOrPath?: SuiLedgerParams | DerivationPathArray, transport?: Transport) {
+  return new SuiLedgerInterface(paramsOrPath, transport);
+}

package/src/ledger/clients/thorchain/index.ts

@@ -1,11 +1,36 @@
 import type { AccountData, AminoSignResponse, StdSignDoc } from "@cosmjs/amino";
+import type { Command, DmkError, UserInteractionRequired } from "@ledgerhq/device-management-kit";
 import type Transport from "@ledgerhq/hw-transport";
-import { base64 } from "@scure/base";
+import { base64, hex } from "@scure/base";
 import { type DerivationPathArray, NetworkDerivationPath, SwapKitError } from "@swapkit/helpers";
 
-import { CosmosLedgerInterface } from "../../interfaces/CosmosLedgerInterface";
-import type { GetAddressAndPubKeyResponse } from "../../types";
-import { getSignature } from "./utils";
+import { getLedgerDMKSession, type LedgerDMKSession } from "../../helpers/dmk";
+import {
+  executeLedgerDeviceAction,
+  LEDGER_USER_INTERACTION_REQUIRED,
+  type LedgerDeviceActionStateHandler,
+  toLedgerDeviceError,
+  ZONDAX_USER_REFUSED_STATUS_WORDS,
+} from "../../helpers/executeDeviceAction";
+import { toLowSSignature } from "../../helpers/lowS";
+import {
+  getThorAddressCommand,
+  getThorLegacyVersion,
+  getThorSignCommands,
+  invalidThorAppVersionMessage,
+  parseThorAddressResponse,
+  sendThorLegacyCommand,
+  type ThorCommand,
+} from "./protocol";
+
+const THOR_APP_NAME = "THORChain";
+
+interface THORChainLedgerParams {
+  derivationPath?: DerivationPathArray;
+  dmkSession?: LedgerDMKSession;
+  onDeviceActionState?: LedgerDeviceActionStateHandler;
+  transport?: Transport;
+}
 
 type ThorchainAssetObject = { chain?: string; symbol?: string; synth?: boolean; ticker?: string };
 
@@ -18,9 +43,7 @@ function getAminoAssetDenom(asset: string | ThorchainAssetObject) {
   const symbol = (asset.symbol || asset.ticker || "").toUpperCase();
 
   if (!(chain && symbol)) return symbol || chain || "";
-  if (asset.synth) return `${chain}/${symbol}`;
-
-  return `${chain}.${symbol}`;
+  return `${chain}${asset.synth ? "/" : "."}${symbol}`;
 }
 
 export function normalizeThorchainLedgerSignDoc(signDoc: StdSignDoc): StdSignDoc {
@@ -43,123 +66,224 @@ export function normalizeThorchainLedgerSignDoc(signDoc: StdSignDoc): StdSignDoc
   };
 }
 
-export class THORChainLedger extends CosmosLedgerInterface {
-  private pubKey: string | null = null;
+// cosmjs is loaded lazily: Bun rejects its CJS `require("@scure/base")` next to the ESM-only `@swapkit/*` graph.
+async function getFixedSignature({ signature }: { signature: Uint8Array }) {
+  const { Secp256k1Signature } = await import("@cosmjs/crypto");
+  try {
+    return toLowSSignature(Secp256k1Signature.fromDer(signature).toFixedLength());
+  } catch (error) {
+    throw new SwapKitError("wallet_ledger_invalid_signature", error);
+  }
+}
 
-  derivationPath: DerivationPathArray;
+async function executeThorLegacyCommands({ commands, transport }: { commands: ThorCommand[]; transport: Transport }) {
+  const version = await getThorLegacyVersion({ transport });
+  if (!version.startsWith("2.")) {
+    const { InvalidResponseFormatError } = await import("@ledgerhq/device-management-kit");
+    throw new InvalidResponseFormatError(invalidThorAppVersionMessage({ version }));
+  }
+
+  let response = new Uint8Array();
+  for (const command of commands) {
+    response = await sendThorLegacyCommand({ command, transport });
+  }
+  return response;
+}
+
+export class THORChainLedger {
+  readonly derivationPath: DerivationPathArray;
+  private readonly dmkSession?: LedgerDMKSession;
+  private readonly onDeviceActionState?: LedgerDeviceActionStateHandler;
+  private pubKey: Uint8Array | undefined;
+  private readonly transport?: Transport;
+
+  constructor({
+    derivationPath = NetworkDerivationPath.THOR,
+    dmkSession,
+    onDeviceActionState,
+    transport,
+  }: THORChainLedgerParams = {}) {
+    if (dmkSession && transport) {
+      throw new SwapKitError("wallet_ledger_invalid_params", {
+        message: "Provide either a Ledger DMK session or a LedgerJS transport, not both",
+      });
+    }
 
-  constructor(derivationPath: DerivationPathArray = NetworkDerivationPath.THOR, transport?: Transport) {
-    super(transport);
-    this.chain = "thor";
     this.derivationPath = derivationPath;
+    this.dmkSession = dmkSession;
+    this.onDeviceActionState = onDeviceActionState;
+    this.transport = transport;
   }
 
   get pubkey() {
-    return this.pubKey;
+    return this.pubKey ? base64.encode(this.pubKey) : null;
   }
 
-  connect = async () => {
-    await this.checkOrCreateTransportAndLedger();
-    const { compressed_pk, bech32_address }: GetAddressAndPubKeyResponse = await this.getAddressAndPubKey();
+  private executeCommands = async ({
+    commands,
+    requiredUserInteraction,
+  }: {
+    commands: ThorCommand[];
+    requiredUserInteraction: UserInteractionRequired;
+  }) => {
+    if (this.transport) {
+      try {
+        return await executeThorLegacyCommands({ commands, transport: this.transport });
+      } catch (error) {
+        // hw-transport rejects with status errors; map them as the DMK action below does.
+        throw toLedgerDeviceError(error, { userRefusedStatusWords: ZONDAX_USER_REFUSED_STATUS_WORDS });
+      }
+    }
 
-    this.pubKey = base64.encode(compressed_pk);
+    const dmkSession = this.dmkSession ?? (await getLedgerDMKSession());
+
+    const {
+      Apdu,
+      CallTaskInAppDeviceAction,
+      CommandResultFactory,
+      DmkResultFactory,
+      InvalidResponseFormatError,
+      InvalidStatusWordError,
+      isSuccessCommandResult,
+      UnknownDeviceExchangeError,
+    } = await import("@ledgerhq/device-management-kit");
+    const toDmkCommand = (command: ThorCommand): Command<Uint8Array> => {
+      const apdu = command.getApdu();
 
-    return bech32_address;
-  };
+      return {
+        getApdu: () => new Apdu(apdu.cla, apdu.ins, apdu.p1, apdu.p2, apdu.data),
+        name: command.name,
+        parseResponse: (response) => {
+          try {
+            return CommandResultFactory<Uint8Array>({ data: command.parseResponse(response) });
+          } catch (error) {
+            // Keep the status word so rejections and wrong-app errors map to typed SwapKit errors.
+            const errorCode = hex.encode(response.statusCode);
+            return CommandResultFactory<Uint8Array>({
+              error: Object.assign(new InvalidStatusWordError(error instanceof Error ? error.message : String(error)), {
+                errorCode,
+              }),
+            });
+          }
+        },
+      };
+    };
 
-  getAddressAndPubKey = async () => {
-    await this.checkOrCreateTransportAndLedger(true);
+    const deviceAction = new CallTaskInAppDeviceAction<{ response: Uint8Array }, DmkError, UserInteractionRequired>({
+      input: {
+        appName: THOR_APP_NAME,
+        requiredUserInteraction,
+        skipOpenApp: false,
+        task: async (internalApi) => {
+          try {
+            const sessionState = internalApi.getDeviceSessionState();
+            const version = "currentApp" in sessionState ? sessionState.currentApp.version : undefined;
+            if (!version?.startsWith("2.")) {
+              return DmkResultFactory<{ response: Uint8Array }, DmkError>({
+                error: new InvalidResponseFormatError(invalidThorAppVersionMessage({ version })),
+              });
+            }
+
+            let response: Uint8Array<ArrayBufferLike> = new Uint8Array();
+            for (const command of commands) {
+              const result = await internalApi.sendCommand(toDmkCommand(command));
+              if (!isSuccessCommandResult(result)) {
+                return DmkResultFactory<{ response: Uint8Array }, DmkError>({ error: result.error });
+              }
+              response = result.data;
+            }
+
+            return DmkResultFactory<{ response: Uint8Array }, DmkError>({ data: { response } });
+          } catch (error) {
+            return DmkResultFactory<{ response: Uint8Array }, DmkError>({
+              error: new UnknownDeviceExchangeError(error),
+            });
+          }
+        },
+      },
+    });
 
-    const response: GetAddressAndPubKeyResponse = await this.ledgerApp.getAddressAndPubKey(
-      this.derivationPath,
-      this.chain,
-    );
+    const result = await executeLedgerDeviceAction({
+      action: () => dmkSession.dmk.executeDeviceAction({ deviceAction, sessionId: dmkSession.sessionId }),
+      onDeviceActionState: this.onDeviceActionState,
+      userRefusedStatusWords: ZONDAX_USER_REFUSED_STATUS_WORDS,
+    });
 
-    this.validateResponse(response.return_code, response.error_message);
+    return result.response;
+  };
 
-    return response;
+  private getAddressData = async ({ checkOnDevice }: { checkOnDevice: boolean }) => {
+    const response = await this.executeCommands({
+      commands: [getThorAddressCommand({ checkOnDevice, hrp: "thor", path: this.derivationPath })],
+      requiredUserInteraction: checkOnDevice
+        ? LEDGER_USER_INTERACTION_REQUIRED.VerifyAddress
+        : LEDGER_USER_INTERACTION_REQUIRED.None,
+    });
+
+    return parseThorAddressResponse({ response });
   };
 
-  showAddressAndPubKey = async () => {
-    await this.checkOrCreateTransportAndLedger(true);
+  private signBytes = async ({ message }: { message: Uint8Array }) => {
+    const response = await this.executeCommands({
+      commands: getThorSignCommands({ message, path: this.derivationPath }),
+      requiredUserInteraction: LEDGER_USER_INTERACTION_REQUIRED.SignTransaction,
+    });
 
-    const response: GetAddressAndPubKeyResponse = await this.ledgerApp.showAddressAndPubKey(
-      this.derivationPath,
-      this.chain,
-    );
+    return getFixedSignature({ signature: response });
+  };
+
+  connect = async () => {
+    const { address, publicKey } = await this.getAddressData({ checkOnDevice: false });
+    this.pubKey = publicKey;
+    return address;
+  };
 
-    this.validateResponse(response.return_code, response.error_message);
+  getAddressAndPubKey = async () => {
+    const { address, publicKey } = await this.getAddressData({ checkOnDevice: false });
+    this.pubKey = publicKey;
 
-    return response;
+    return { bech32_address: address, compressed_pk: publicKey, error_message: "No errors", return_code: 0x9000 };
   };
 
-  signTransaction = async (rawTx: string, sequence = "0") => {
-    await this.checkOrCreateTransportAndLedger(true);
+  showAddressAndPubKey = async () => {
+    const { address, publicKey } = await this.getAddressData({ checkOnDevice: true });
+    this.pubKey = publicKey;
 
-    const { return_code, error_message, signature } = await this.ledgerApp.sign(this.derivationPath, rawTx);
+    return { bech32_address: address, compressed_pk: publicKey, error_message: "No errors", return_code: 0x9000 };
+  };
 
-    if (!this.pubKey) throw new SwapKitError("wallet_ledger_pubkey_not_found");
+  signTransaction = async ({ rawTx, sequence = "0" }: { rawTx: string; sequence?: string }) => {
+    if (!this.pubKey) await this.connect();
+    const pubKey = this.pubKey;
+    if (!pubKey) throw new SwapKitError("wallet_ledger_pubkey_not_found");
 
-    this.validateResponse(return_code, error_message);
+    const signature = await this.signBytes({ message: new TextEncoder().encode(rawTx) });
 
     return [
       {
-        pub_key: { type: "tendermint/PubKeySecp256k1", value: this.pubKey },
+        pub_key: { type: "tendermint/PubKeySecp256k1", value: base64.encode(pubKey) },
         sequence,
-        signature: getSignature(signature),
+        signature: base64.encode(signature),
       },
     ];
   };
 
   signAmino = async (signerAddress: string, signDoc: StdSignDoc): Promise<AminoSignResponse> => {
-    await this.checkOrCreateTransportAndLedger(true);
+    const account = (await this.getAccounts()).find(({ address }) => address === signerAddress);
+    if (!account) throw new SwapKitError("wallet_ledger_address_not_found", { address: signerAddress });
 
-    const account = (await this.getAccounts()).find((item) => item.address === signerAddress);
-    if (!account) {
-      throw new SwapKitError("wallet_ledger_address_not_found", { address: signerAddress });
-    }
+    const { encodeSecp256k1Signature, serializeSignDoc } = await import("@cosmjs/amino");
 
-    const importedAmino = await import("@cosmjs/amino");
-    const encodeSecp256k1Signature =
-      importedAmino.encodeSecp256k1Signature ?? importedAmino.default?.encodeSecp256k1Signature;
-    const serializeSignDoc = importedAmino.serializeSignDoc ?? importedAmino.default?.serializeSignDoc;
-    const normalizedSignDoc = normalizeThorchainLedgerSignDoc(signDoc);
-
-    const { return_code, error_message, signature } = await this.ledgerApp.sign(
-      this.derivationPath,
-      serializeSignDoc(normalizedSignDoc),
-    );
-
-    this.validateResponse(return_code, error_message);
-
-    return {
-      signature: encodeSecp256k1Signature(account.pubkey, base64.decode(getSignature(signature))),
-      // CosmJS rebuilds bodyBytes from the returned `signed` doc. Keep the
-      // original direct-shaped doc there so MsgDeposit protobuf assets do not
-      // get round-tripped through the incomplete Amino converter.
-      signed: signDoc,
-    };
+    const signature = await this.signBytes({ message: serializeSignDoc(normalizeThorchainLedgerSignDoc(signDoc)) });
+
+    return { signature: encodeSecp256k1Signature(account.pubkey, signature), signed: signDoc };
   };
 
   getAccounts = async (): Promise<readonly AccountData[]> => {
-    await this.checkOrCreateTransportAndLedger(true);
-
-    const { bech32_address, compressed_pk }: GetAddressAndPubKeyResponse = await this.getAddressAndPubKey();
-
-    this.pubKey = base64.encode(compressed_pk);
-
-    return [{ address: bech32_address, algo: "secp256k1", pubkey: compressed_pk }];
+    const { address, publicKey } = await this.getAddressData({ checkOnDevice: false });
+    this.pubKey = publicKey;
+    return [{ address, algo: "secp256k1", pubkey: publicKey }];
   };
 
-  sign = async (message: string) => {
-    await this.checkOrCreateTransportAndLedger(true);
-
-    const { return_code, error_message, signature } = await this.ledgerApp.sign(this.derivationPath, message);
-
-    if (!this.pubKey) throw new SwapKitError("wallet_ledger_pubkey_not_found");
-
-    this.validateResponse(return_code, error_message);
-
-    return getSignature(signature);
-  };
+  sign = async (message: string) => base64.encode(await this.signBytes({ message: new TextEncoder().encode(message) }));
 }