@swapkit/wallet-hardware 5.0.1 → 6.0.0

package/src/ledger/clients/evm.ts

@@ -1,5 +1,5 @@
-import type EthereumApp from "@ledgerhq/hw-app-eth";
-import type Transport from "@ledgerhq/hw-transport";
+import type { BlindSigningReporter } from "@ledgerhq/context-module";
+import type { TypedDataDomain as LedgerTypedDataDomain, SignerEth } from "@ledgerhq/device-signer-kit-ethereum";
 import {
   ChainId,
   type DerivationPathArray,
@@ -10,66 +10,107 @@ import {
 import {
   AbstractSigner,
   type Provider,
+  type TransactionLike,
   type TransactionRequest,
   type TypedDataDomain,
   type TypedDataField,
 } from "ethers";
 
-import { getLedgerTransport } from "../helpers/getLedgerTransport";
-import {
-  fetchLedgerNetworkCertificate,
-  fetchLedgerNetworkDescriptor,
-  provideLedgerCertificate,
-  provideLedgerNetworkInformation,
-} from "../helpers/ledgerNetworkInfo";
-
-const LEDGER_INCORRECT_DATA = 0x6a80;
-
-const ARC_CHAIN_ID = Number(ChainId.Arc);
-
-type LedgerTransactionResolution = Awaited<
-  ReturnType<typeof import("@ledgerhq/hw-app-eth")["ledgerService"]["resolveTransaction"]>
->;
-
-function isLedgerIncorrectDataError(error: unknown) {
-  return (
-    error instanceof Error &&
-    "statusCode" in error &&
-    (error as { statusCode: number }).statusCode === LEDGER_INCORRECT_DATA
-  );
-}
+import { createLedgerSessionSigner, type LedgerDMKSession } from "../helpers/dmk";
+import { executeLedgerDeviceAction, type LedgerDeviceActionStateHandler } from "../helpers/executeDeviceAction";
 
-function hasClearSigningPayload(resolution: LedgerTransactionResolution | null) {
-  return Object.values(resolution ?? {}).some((entries) => Array.isArray(entries) && entries.length);
+interface EVMLedgerParams {
+  dmkSession?: LedgerDMKSession;
+  provider: Provider;
+  derivationPath?: DerivationPathArray | string;
+  chainId?: ChainId;
+  onDeviceActionState?: LedgerDeviceActionStateHandler;
+  originToken?: string;
 }
 
-function parseLedgerSignatureV(v: number | string) {
-  if (typeof v === "number") return v;
+function selectTypedDataTypes({
+  primaryType,
+  types,
+}: {
+  primaryType: string;
+  types: Record<string, TypedDataField[]>;
+}) {
+  const selectedTypes: Record<string, TypedDataField[]> = {};
+
+  function addType(typeName: string) {
+    if (Object.hasOwn(selectedTypes, typeName) || !Object.hasOwn(types, typeName)) return;
+    const fields = types[typeName];
+    if (!fields) return;
+
+    selectedTypes[typeName] = fields;
+    for (const field of fields) addType(field.type.replace(/\[[0-9]*\]/g, ""));
+  }
+
+  addType(primaryType);
 
-  const hex = v.startsWith("0x") ? v.slice(2) : v;
-  return Number.parseInt(hex || "0", 16);
+  if (!Object.hasOwn(selectedTypes, primaryType)) {
+    throw new SwapKitError("wallet_ledger_invalid_params", {
+      primaryType,
+      reason: "The EIP-712 primary type is not defined",
+    });
+  }
+
+  return selectedTypes;
 }
 
+const disabledBlindSigningReporter: BlindSigningReporter = {
+  // The context module ignores the result; the cast avoids depending on purify-ts for an unused Either.
+  report: () => Promise.resolve(undefined as unknown as Awaited<ReturnType<BlindSigningReporter["report"]>>),
+};
+
 class EVMLedgerInterface extends AbstractSigner {
   chainId: ChainId = ChainId.Ethereum;
   derivationPath = "";
-  ledgerApp: InstanceType<typeof EthereumApp> | null = null;
-  ledgerTimeout = 50000;
-  private transport?: Transport;
-  private readonly injectedTransport?: Transport;
-  private arcNetworkRegistered = false;
+  private readonly dmkSession?: LedgerDMKSession;
+  private readonly getLedgerSigner: () => Promise<SignerEth>;
+  private readonly onDeviceActionState?: LedgerDeviceActionStateHandler;
+  private readonly originToken?: string;
 
   constructor({
     provider,
+    dmkSession,
     derivationPath = NetworkDerivationPath.OP,
     chainId = ChainId.Optimism,
-    transport,
-  }: { provider: Provider; derivationPath?: DerivationPathArray | string; chainId?: ChainId; transport?: Transport }) {
+    onDeviceActionState,
+    originToken,
+  }: EVMLedgerParams) {
     super(provider);
 
     this.chainId = chainId || ChainId.Ethereum;
-    this.derivationPath = typeof derivationPath === "string" ? derivationPath : derivationPathToString(derivationPath);
-    this.injectedTransport = transport;
+    this.derivationPath = (
+      typeof derivationPath === "string" ? derivationPath : derivationPathToString(derivationPath)
+    ).replace(/^m\//, "");
+    this.dmkSession = dmkSession;
+    this.onDeviceActionState = onDeviceActionState;
+    this.originToken = originToken;
+    this.getLedgerSigner = createLedgerSessionSigner({
+      build: async (session) => {
+        const [{ ContextModuleBuilder, ContextModuleChainID }, { SignerEthBuilder }] = await Promise.all([
+          import("@ledgerhq/context-module"),
+          import("@ledgerhq/device-signer-kit-ethereum"),
+        ]);
+        // Same context module the signer kit builds by default, minus the blind-signing reporter that
+        // would post chain, target address and device model to Ledger on every signature.
+        const contextModule = new ContextModuleBuilder({
+          loggerFactory: (tag) => session.dmk.getLoggerFactory()(["ContextModule", tag]),
+          originToken,
+        })
+          .setChain(ContextModuleChainID.Ethereum)
+          .setBlindSigningReporter(disabledBlindSigningReporter)
+          .build();
+        // The signer kit also calls the optional sign reporter after every signature. 2.6.0 leaves it unset
+        // and offers no builder setter, so keep it inert in case a later 2.x release wires it up.
+        contextModule.signReport = () => Promise.resolve();
+
+        return new SignerEthBuilder({ ...session, originToken }).withContextModule(contextModule).build();
+      },
+      dmkSession,
+    });
 
     Object.defineProperty(this, "provider", { enumerable: true, value: provider || null, writable: false });
   }
@@ -78,58 +119,47 @@ class EVMLedgerInterface extends AbstractSigner {
     new EVMLedgerInterface({
       chainId: this.chainId,
       derivationPath: this.derivationPath,
+      dmkSession: this.dmkSession,
+      onDeviceActionState: this.onDeviceActionState,
+      originToken: this.originToken,
       provider,
-      transport: this.transport ?? this.injectedTransport,
     });
 
-  checkOrCreateTransportAndLedger = async () => {
-    await this.createTransportAndLedger();
-  };
-
-  createTransportAndLedger = async () => {
-    if (this.ledgerApp) return;
-
-    this.transport ||= this.injectedTransport ?? (await getLedgerTransport());
-    const EthereumApp = (await import("@ledgerhq/hw-app-eth")).default;
-
-    this.ledgerApp = new EthereumApp(this.transport);
-  };
-
   getAddress = async () => {
-    const response = await this.getAddressAndPubKey();
-    if (!response) throw new SwapKitError("wallet_ledger_failed_to_get_address");
-    return response.address;
+    const { address } = await this.getAddressAndPubKey();
+    if (!address) throw new SwapKitError("wallet_ledger_failed_to_get_address");
+    return address;
   };
 
   getAddressAndPubKey = async () => {
-    await this.createTransportAndLedger();
-    return this.ledgerApp?.getAddress(this.derivationPath);
-  };
+    const ledgerSigner = await this.getLedgerSigner();
 
-  showAddressAndPubKey = async () => {
-    await this.createTransportAndLedger();
-    return this.ledgerApp?.getAddress(this.derivationPath, true);
+    return executeLedgerDeviceAction({
+      action: () => ledgerSigner.getAddress(this.derivationPath, { chainId: Number(this.chainId) }),
+      onDeviceActionState: this.onDeviceActionState,
+    });
   };
 
-  signMessage = async (messageHex: string) => {
-    const { Signature } = await import("ethers");
-    await this.createTransportAndLedger();
-
-    const sig = await this.ledgerApp?.signPersonalMessage(this.derivationPath, messageHex);
-
-    if (!sig) throw new SwapKitError("wallet_ledger_signing_error");
+  showAddressAndPubKey = async () => {
+    const ledgerSigner = await this.getLedgerSigner();
 
-    sig.r = `0x${sig.r}`;
-    sig.s = `0x${sig.s}`;
-    return Signature.from(sig).serialized;
+    return executeLedgerDeviceAction({
+      action: () =>
+        ledgerSigner.getAddress(this.derivationPath, { chainId: Number(this.chainId), checkOnDevice: true }),
+      onDeviceActionState: this.onDeviceActionState,
+    });
   };
 
-  sendTransaction = async (tx: TransactionRequest): Promise<any> => {
-    if (!this.provider) throw new SwapKitError("wallet_ledger_no_provider");
-
-    const signedTxHex = await this.signTransaction(tx);
+  signMessage = async (message: string | Uint8Array) => {
+    const { Signature, toUtf8Bytes } = await import("ethers");
+    const messageBytes = typeof message === "string" ? toUtf8Bytes(message) : message;
+    const ledgerSigner = await this.getLedgerSigner();
+    const signature = await executeLedgerDeviceAction({
+      action: () => ledgerSigner.signMessage(this.derivationPath, messageBytes),
+      onDeviceActionState: this.onDeviceActionState,
+    });
 
-    return await this.provider.broadcastTransaction(signedTxHex);
+    return Signature.from(signature).serialized;
   };
 
   signTypedData = async (
@@ -139,152 +169,165 @@ class EVMLedgerInterface extends AbstractSigner {
     explicitPrimaryType?: string,
   ) => {
     const { buildEIP712DomainType } = await import("@swapkit/toolboxes/evm");
-    const { Signature, TypedDataEncoder } = await import("ethers");
-    await this.createTransportAndLedger();
-
+    const { hexlify, Signature, TypedDataEncoder } = await import("ethers");
     const { EIP712Domain: _, ...filteredTypes } = types;
     const primaryType = explicitPrimaryType ?? TypedDataEncoder.from(filteredTypes).primaryType;
+    const resolutionTypes = selectTypedDataTypes({ primaryType, types: filteredTypes });
+    const populated = await TypedDataEncoder.resolveNames(domain, resolutionTypes, value, async (name) => {
+      const resolvedAddress = await this.resolveName(name);
+      if (!resolvedAddress) throw new SwapKitError("wallet_ledger_invalid_params", { name });
+      return resolvedAddress;
+    });
+    const chainId = populated.domain.chainId == null ? undefined : Number(populated.domain.chainId);
 
-    let sig: { v: number; s: string; r: string } | undefined;
-
-    try {
-      sig = await this.ledgerApp?.signEIP712Message(this.derivationPath, {
-        domain: domain as Record<string, unknown>,
-        message: value,
-        primaryType,
-        types: { EIP712Domain: buildEIP712DomainType(domain), ...filteredTypes },
-      });
-    } catch (error) {
-      const isLedgerDeviceError = error instanceof Error && "statusCode" in error;
-      if (!isLedgerDeviceError || (isLedgerDeviceError && (error as { statusCode: number }).statusCode === 0x6985)) {
-        throw error;
-      }
-
-      const domainSeparator = TypedDataEncoder.hashDomain(domain).slice(2);
-      const messageHash = TypedDataEncoder.from(filteredTypes).hash(value).slice(2);
-
-      sig = await this.ledgerApp?.signEIP712HashedMessage(this.derivationPath, domainSeparator, messageHash);
+    if (chainId !== undefined && !Number.isSafeInteger(chainId)) {
+      throw new SwapKitError("wallet_ledger_invalid_params", { chainId: populated.domain.chainId });
     }
 
-    if (!sig) throw new SwapKitError("wallet_ledger_signing_error");
+    const ledgerDomain = {
+      ...(populated.domain.chainId != null && { chainId }),
+      ...(populated.domain.name != null && { name: populated.domain.name }),
+      ...(populated.domain.salt != null && { salt: hexlify(populated.domain.salt) }),
+      ...(populated.domain.verifyingContract != null && { verifyingContract: populated.domain.verifyingContract }),
+      ...(populated.domain.version != null && { version: populated.domain.version }),
+    } satisfies LedgerTypedDataDomain;
+
+    const typedData = {
+      domain: ledgerDomain,
+      message: populated.value,
+      primaryType,
+      // Only the primary type and its dependencies: the signer kit's legacy fallback hashes with ethers,
+      // which rejects unused types.
+      types: { EIP712Domain: buildEIP712DomainType(populated.domain), ...resolutionTypes },
+    };
+
+    const ledgerSigner = await this.getLedgerSigner();
+    const signature = await executeLedgerDeviceAction({
+      action: () => ledgerSigner.signTypedData(this.derivationPath, typedData),
+      onDeviceActionState: this.onDeviceActionState,
+    });
 
-    sig.r = `0x${sig.r}`;
-    sig.s = `0x${sig.s}`;
-    return Signature.from(sig).serialized;
+    return Signature.from(signature).serialized;
   };
 
   signTransaction = async (tx: TransactionRequest) => {
-    const { Transaction } = await import("ethers");
-    await this.createTransportAndLedger();
-
-    const nonce = tx.nonce ?? undefined;
-    const transactionCount =
-      nonce === undefined ? await this.provider?.getTransactionCount(tx.from || (await this.getAddress())) : undefined;
-
-    const baseTx = {
-      chainId: tx.chainId || this.chainId,
-      data: tx.data,
-      gasLimit: tx.gasLimit,
-      ...(tx.gasPrice && { gasPrice: tx.gasPrice }),
-      ...(!tx.gasPrice &&
-        tx.maxFeePerGas && { maxFeePerGas: tx.maxFeePerGas, maxPriorityFeePerGas: tx.maxPriorityFeePerGas }),
-      nonce: nonce !== undefined ? Number(nonce.toString()) : transactionCount,
-      to: tx.to?.toString(),
-      type: tx.type && !Number.isNaN(tx.type) ? tx.type : tx.maxFeePerGas ? 2 : 0,
-      value: tx.value,
-    };
-
-    // ledger expects the tx to be serialized without the 0x prefix
-    const unsignedTx = Transaction.from(baseTx).unsignedSerialized.slice(2);
-
-    const { ledgerService } = await import("@ledgerhq/hw-app-eth");
+    const { copyRequest, getAddress, getBytes, resolveAddress, resolveProperties, Transaction } = await import(
+      "ethers"
+    );
+    const request = copyRequest(tx);
+
+    if (request.type === 4 || request.authorizationList?.length) {
+      throw new SwapKitError("wallet_ledger_invalid_params", {
+        message: "Ledger Ethereum DSK does not support EIP-7702 transactions",
+      });
+    }
 
-    const chainId = Number(baseTx.chainId);
-    const isArc = chainId === ARC_CHAIN_ID;
+    const expectedChainId = BigInt(this.chainId);
 
-    const resolution = await ledgerService
-      .resolveTransaction(unsignedTx, {}, { erc20: true, externalPlugins: true })
-      .catch((error) => {
-        if (!isArc) throw error;
+    if (request.chainId != null && request.chainId !== expectedChainId) {
+      throw new SwapKitError("wallet_ledger_invalid_params", {
+        chainId: request.chainId,
+        expectedChainId,
+        message: "Transaction chainId does not match the Ledger client chain",
+      });
+    }
 
-        console.warn("Ledger: could not fetch clear-signing metadata for Arc, signing blind");
+    const { from, to } = await resolveProperties({
+      from: request.from ? resolveAddress(request.from, this) : undefined,
+      to: request.to ? resolveAddress(request.to, this) : undefined,
+    });
+    const signerAddress = from || request.nonce == null ? await this.getAddress() : undefined;
 
-        return null;
+    if (from && signerAddress && getAddress(from) !== getAddress(signerAddress)) {
+      throw new SwapKitError("wallet_ledger_invalid_params", {
+        message: "Transaction from address does not match the Ledger account",
       });
+    }
 
-    if (isArc && !this.arcNetworkRegistered) await this.registerNetworkOnDevice(chainId);
+    if (to) request.to = to;
+    delete request.from;
+    delete request.authorizationList;
+    request.chainId = expectedChainId;
+    // ethers infers EIP-2930 for an untyped gasPrice-only request; sign it as legacy, as before the signer kit.
+    const isUntypedLegacyRequest =
+      request.type == null &&
+      request.gasPrice != null &&
+      request.accessList == null &&
+      request.maxFeePerGas == null &&
+      request.maxPriorityFeePerGas == null;
+    if (isUntypedLegacyRequest) request.type = 0;
+    request.nonce ??= await this.provider?.getTransactionCount(signerAddress ?? (await this.getAddress()));
+
+    const baseTx = Transaction.from(request as TransactionLike<string>);
+    const unsignedTransaction = getBytes(baseTx.unsignedSerialized);
+    const ledgerSigner = await this.getLedgerSigner();
+    const signature = await executeLedgerDeviceAction({
+      action: () => ledgerSigner.signTransaction(this.derivationPath, unsignedTransaction),
+      onDeviceActionState: this.onDeviceActionState,
+    });
 
-    const signature = await this.signWithLedgerApp(unsignedTx, resolution, chainId);
+    baseTx.signature = signature;
 
-    if (!signature) throw new SwapKitError("wallet_ledger_signing_error");
+    return baseTx.serialized;
+  };
+}
 
-    const { r, s, v } = signature;
+interface LedgerParams {
+  dmkSession?: LedgerDMKSession;
+  provider: Provider;
+  derivationPath?: DerivationPathArray;
+  onDeviceActionState?: LedgerDeviceActionStateHandler;
+  originToken?: string;
+}
 
-    return Transaction.from({ ...baseTx, signature: { r: `0x${r}`, s: `0x${s}`, v: parseLedgerSignatureV(v) } })
-      .serialized;
-  };
+export function ArbitrumLedger(params: LedgerParams) {
+  return new EVMLedgerInterface({ ...params, chainId: ChainId.Arbitrum });
+}
 
-  private signWithLedgerApp = async (
-    unsignedTx: string,
-    resolution: LedgerTransactionResolution | null,
-    chainId: number,
-  ) => {
-    try {
-      return await this.ledgerApp?.signTransaction(this.derivationPath, unsignedTx, resolution);
-    } catch (error) {
-      const canSignBlind =
-        chainId === ARC_CHAIN_ID && isLedgerIncorrectDataError(error) && hasClearSigningPayload(resolution);
+export function ArcLedger(params: LedgerParams) {
+  return new EVMLedgerInterface({ ...params, chainId: ChainId.Arc });
+}
 
-      if (!canSignBlind) throw error;
+export function AuroraLedger(params: LedgerParams) {
+  return new EVMLedgerInterface({ ...params, chainId: ChainId.Aurora });
+}
 
-      console.warn("Ledger: the app rejected the Arc metadata, signing blind");
+export function AvalancheLedger(params: LedgerParams) {
+  return new EVMLedgerInterface({ ...params, chainId: ChainId.Avalanche });
+}
 
-      return await this.ledgerApp?.signTransaction(this.derivationPath, unsignedTx, null);
-    }
-  };
+export function BaseLedger(params: LedgerParams) {
+  return new EVMLedgerInterface({ ...params, chainId: ChainId.Base });
+}
 
-  private registerNetworkOnDevice = async (chainId: number) => {
-    const deviceModelId = this.transport?.deviceModel?.id;
+export function EthereumLedger(params: LedgerParams) {
+  return new EVMLedgerInterface({ ...params, chainId: ChainId.Ethereum });
+}
 
-    if (!(this.transport && deviceModelId)) return;
+export function GnosisLedger(params: LedgerParams) {
+  return new EVMLedgerInterface({ ...params, chainId: ChainId.Gnosis });
+}
 
-    try {
-      const [descriptor, certificate] = await Promise.all([
-        fetchLedgerNetworkDescriptor(chainId, deviceModelId),
-        fetchLedgerNetworkCertificate(deviceModelId),
-      ]);
+export function OptimismLedger(params: LedgerParams) {
+  return new EVMLedgerInterface({ ...params, chainId: ChainId.Optimism });
+}
 
-      if (!descriptor) return;
+export function PolygonLedger(params: LedgerParams) {
+  return new EVMLedgerInterface({ ...params, chainId: ChainId.Polygon });
+}
 
-      if (certificate) await provideLedgerCertificate(this.transport, certificate);
+export function BinanceSmartChainLedger(params: LedgerParams) {
+  return new EVMLedgerInterface({ ...params, chainId: ChainId.BinanceSmartChain });
+}
 
-      await provideLedgerNetworkInformation(this.transport, descriptor);
+export function MonadLedger(params: LedgerParams) {
+  return new EVMLedgerInterface({ ...params, chainId: ChainId.Monad });
+}
 
-      this.arcNetworkRegistered = true;
-    } catch {
-      // the app will reject the metadata and signWithLedgerApp falls back to blind signing
-    }
-  };
+export function XLayerLedger(params: LedgerParams) {
+  return new EVMLedgerInterface({ ...params, chainId: ChainId.XLayer });
 }
 
-type LedgerParams = { provider: Provider; derivationPath?: DerivationPathArray; transport?: Transport };
-
-export const ArbitrumLedger = (params: LedgerParams) =>
-  new EVMLedgerInterface({ ...params, chainId: ChainId.Arbitrum });
-export const ArcLedger = (params: LedgerParams) => new EVMLedgerInterface({ ...params, chainId: ChainId.Arc });
-export const AuroraLedger = (params: LedgerParams) => new EVMLedgerInterface({ ...params, chainId: ChainId.Aurora });
-export const AvalancheLedger = (params: LedgerParams) =>
-  new EVMLedgerInterface({ ...params, chainId: ChainId.Avalanche });
-export const BaseLedger = (params: LedgerParams) => new EVMLedgerInterface({ ...params, chainId: ChainId.Base });
-export const EthereumLedger = (params: LedgerParams) =>
-  new EVMLedgerInterface({ ...params, chainId: ChainId.Ethereum });
-export const GnosisLedger = (params: LedgerParams) => new EVMLedgerInterface({ ...params, chainId: ChainId.Gnosis });
-export const OptimismLedger = (params: LedgerParams) =>
-  new EVMLedgerInterface({ ...params, chainId: ChainId.Optimism });
-export const PolygonLedger = (params: LedgerParams) => new EVMLedgerInterface({ ...params, chainId: ChainId.Polygon });
-export const BinanceSmartChainLedger = (params: LedgerParams) =>
-  new EVMLedgerInterface({ ...params, chainId: ChainId.BinanceSmartChain });
-export const MonadLedger = (params: LedgerParams) => new EVMLedgerInterface({ ...params, chainId: ChainId.Monad });
-export const XLayerLedger = (params: LedgerParams) => new EVMLedgerInterface({ ...params, chainId: ChainId.XLayer });
-export const BerachainLedger = (params: LedgerParams) =>
-  new EVMLedgerInterface({ ...params, chainId: ChainId.Berachain });
+export function BerachainLedger(params: LedgerParams) {
+  return new EVMLedgerInterface({ ...params, chainId: ChainId.Berachain });
+}

package/src/ledger/clients/near.ts

@@ -1,18 +1,44 @@
+import type { UserInteractionRequired } from "@ledgerhq/device-management-kit";
+import type Near from "@ledgerhq/hw-app-near";
 import type Transport from "@ledgerhq/hw-transport";
 import type { SignedTransaction, Transaction } from "@near-js/transactions";
-import type { DerivationPathArray } from "@swapkit/helpers";
+import { Chain, type DerivationPathArray, NetworkDerivationPath, SwapKitError } from "@swapkit/helpers";
 import type { NearSigner } from "@swapkit/toolboxes/near";
-import { getLedgerTransport } from "../helpers/getLedgerTransport";
 
-export async function getNearLedgerClient(derivationPath?: DerivationPathArray, injectedTransport?: Transport) {
-  const Near = (await import("@ledgerhq/hw-app-near")).default;
-  const { Chain, NetworkDerivationPath, SwapKitError } = await import("@swapkit/helpers");
-  const transport = injectedTransport ?? (await getLedgerTransport());
-  const nearApp = new Near(transport);
+import {
+  LEDGER_USER_INTERACTION_REQUIRED,
+  type LedgerJsClientParams,
+  normalizeLedgerJsClientParams,
+  runLedgerJsOperation,
+} from "../helpers/ledgerJsDmkBridge";
 
+type NearLedgerParams = LedgerJsClientParams<DerivationPathArray>;
+
+export async function getNearLedgerClient(
+  paramsOrPath?: NearLedgerParams | DerivationPathArray,
+  transport?: Transport,
+) {
+  const { derivationPath, ...connection } = normalizeLedgerJsClientParams({ paramsOrPath, transport });
   const path = (derivationPath || NetworkDerivationPath[Chain.Near]).join("'/").concat("'");
 
-  const { address, publicKey: pubKeyHex } = await nearApp.getAddress(path);
+  async function runNearOperation<Output>({
+    operation,
+    requiredUserInteraction,
+  }: {
+    operation: (app: Near) => Promise<Output>;
+    requiredUserInteraction?: UserInteractionRequired;
+  }) {
+    const NearApp = (await import("@ledgerhq/hw-app-near")).default;
+    return runLedgerJsOperation({
+      appName: "NEAR",
+      connection,
+      createApp: (ledgerTransport) => new NearApp(ledgerTransport),
+      operation,
+      requiredUserInteraction,
+    });
+  }
+
+  const { address, publicKey } = await runNearOperation({ operation: (app) => app.getAddress(path) });
 
   const signer = {
     getAddress() {
@@ -20,10 +46,11 @@ export async function getNearLedgerClient(derivationPath?: DerivationPathArray,
     },
     async getPublicKey() {
       const { PublicKey } = await import("@near-js/crypto");
-      return PublicKey.fromString(`ed25519:${pubKeyHex}`);
+      const encodedPublicKey = publicKey.startsWith("ed25519:") ? publicKey : `ed25519:${publicKey}`;
+      return PublicKey.fromString(encodedPublicKey);
     },
 
-    signDelegateAction(_delegateAction: any) {
+    signDelegateAction(_delegateAction: unknown) {
       return Promise.reject(
         new SwapKitError("wallet_ledger_method_not_supported", { method: "signDelegateAction", wallet: "Ledger" }),
       );
@@ -44,17 +71,20 @@ export async function getNearLedgerClient(derivationPath?: DerivationPathArray,
     async signTransaction(transaction: Transaction) {
       const { Signature, SignedTransaction } = await import("@near-js/transactions");
       try {
-        const signatureArray = await nearApp.signTransaction(transaction.encode(), path);
+        const signatureArray = await runNearOperation({
+          operation: (app) => app.signTransaction(transaction.encode(), path),
+          requiredUserInteraction: LEDGER_USER_INTERACTION_REQUIRED.SignTransaction,
+        });
         if (!signatureArray) {
-          throw new Error("Signature undefined");
+          throw new SwapKitError("wallet_ledger_signing_error", { reason: "Ledger returned no NEAR signature" });
         }
 
         const signature = new Signature({ data: signatureArray, keyType: 0 });
-
         const signedTransaction = new SignedTransaction({ signature, transaction });
 
         return [signatureArray, signedTransaction] as [Uint8Array<ArrayBufferLike>, SignedTransaction];
       } catch (error) {
+        if (error instanceof SwapKitError) throw error;
         throw new SwapKitError("wallet_ledger_signing_error", { error });
       }
     },