@trezor/connect 9.6.2-beta.3 → 9.6.3-beta.1

package/lib/device/DeviceCurrentSession.js

@@ -7,7 +7,6 @@ const transport_1 = require("@trezor/transport");
 const errors_groups_1 = require("@trezor/transport/lib/errors-groups");
 const utils_1 = require("@trezor/utils");
 const constants_1 = require("../constants");
-const DataManager_1 = require("../data/DataManager");
 const events_1 = require("../events");
 const debug_1 = require("../utils/debug");
 const blacklist = {
@@ -28,6 +27,7 @@ const allowedCallsBeforeInitialize = [
     'RebootToBootloader',
     'FirmwareErase',
     'FirmwareUpload',
+    'RecoveryDevice',
 ];
 const filterForLog = (type, msg) => blacklist[type] === true
     ? '(redacted...)'
@@ -36,8 +36,8 @@ const logger = (0, debug_1.initLog)('DeviceCommands');
 const isExpectedResponse = (response, expected) => (Array.isArray(expected) ? expected : expected.split('|')).includes(response.type);
 const success = (payload) => ({ success: true, payload });
 const error = (error) => ({ success: false, error });
-const fail = (msg) => error(new Error(msg, (0, errors_groups_1.isErrorWithoutDeviceInteraction)(msg) ? { cause: 'transport-error' } : undefined));
-const getFeaturesTimeout = () => DataManager_1.DataManager.getSettings('env') === 'react-native' ? 20_000 : 3_000;
+const nestedError = (cause) => error(constants_1.ERRORS.nestError(cause));
+const fail = (msg) => error((0, errors_groups_1.isErrorWithoutDeviceInteraction)(msg) ? new constants_1.ERRORS.TransportError(msg) : new Error(msg));
 class DeviceCurrentSession {
     device;
     transport;
@@ -62,13 +62,14 @@ class DeviceCurrentSession {
         return !!this.disposed;
     }
     async typedCall(type, expectedType, msg = {}) {
-        if (!allowedCallsBeforeInitialize.includes(type) && !this.device?.features?.session_id) {
+        const deviceSessionId = this.device.getThpState()?.sessionId || this.device?.features?.session_id;
+        if (!allowedCallsBeforeInitialize.includes(type) && !deviceSessionId) {
             console.error('Runtime', `typedCall: Device not initialized when calling ${type}. call Initialize first`);
         }
         (0, schema_utils_1.Assert)(protobuf_1.MessagesSchema.MessageType.properties[type], msg);
         this.abortController = new AbortController();
         const { signal } = this.abortController;
-        const abortPromise = new Promise(resolve => signal.addEventListener('abort', () => resolve(error(signal.reason))));
+        const abortPromise = new Promise(resolve => signal.addEventListener('abort', () => resolve(signal.reason)));
         const callPromise = this.callLoop(type, msg, abortPromise);
         this.callPromise = callPromise;
         const response = await callPromise;
@@ -99,11 +100,11 @@ class DeviceCurrentSession {
         let [name, data] = [type, msg];
         let pinUnlocked = false;
         while (true) {
-            const timeout = name === 'GetFeatures' ? getFeaturesTimeout() : undefined;
+            const timeout = name === 'GetFeatures' ? 3_000 : undefined;
             const callPromise = this.call(name, data, { timeout });
             const [abortedDuringCall, response] = await Promise.race([
                 callPromise.then(res => [false, res]),
-                abortPromise.then(res => [true, res]),
+                abortPromise.then(res => [true, nestedError(res)]),
             ]);
             if (name === 'ButtonAck' && abortedDuringCall && !this.disposed) {
                 if (this.needCancelWorkaround()) {
@@ -117,18 +118,13 @@ class DeviceCurrentSession {
                     }
                 }
                 else {
-                    await this.transport.send({
-                        name: 'Cancel',
-                        data: {},
-                        session: this.session,
-                        protocol: this.device.protocol,
-                        thpState: this.device.getThpState(),
-                    });
+                    this.device.getThpState()?.sync('send', 'Cancel');
+                    await this.send('Cancel', {});
                 }
             }
             await callPromise;
             if (this.disposed)
-                return error(this.disposed);
+                return nestedError(this.disposed);
             if (!response.success)
                 return response;
             const res = response.payload;
@@ -161,7 +157,7 @@ class DeviceCurrentSession {
                 case 'PinMatrixRequest': {
                     const promptRes = await Promise.race([
                         this.device.prompt(events_1.DEVICE.PIN, { type: res.message.type }),
-                        abortPromise,
+                        abortPromise.then(nestedError),
                     ]);
                     if (!promptRes.success) {
                         const cancelRes = await this.call('Cancel', {});
@@ -174,7 +170,7 @@ class DeviceCurrentSession {
                 case 'PassphraseRequest': {
                     const promptRes = await Promise.race([
                         this.device.prompt(events_1.DEVICE.PASSPHRASE, {}),
-                        abortPromise,
+                        abortPromise.then(nestedError),
                     ]);
                     if (!promptRes.success) {
                         const cancelRes = await this.call('Cancel', {});
@@ -189,7 +185,7 @@ class DeviceCurrentSession {
                 case 'WordRequest': {
                     const promptRes = await Promise.race([
                         this.device.prompt(events_1.DEVICE.WORD, { type: res.message.type }),
-                        abortPromise,
+                        abortPromise.then(nestedError),
                     ]);
                     if (!promptRes.success) {
                         const cancelRes = await this.call('Cancel', {});
@@ -200,7 +196,7 @@ class DeviceCurrentSession {
                 }
                 default: {
                     if (!this.disposed && pinUnlocked && !this.device.features.unlocked) {
-                        await this.device.getFeatures();
+                        await this.device.getFeatures().catch(() => { });
                     }
                     return success(res);
                 }
@@ -209,7 +205,7 @@ class DeviceCurrentSession {
     }
     async call(name, data, options = {}) {
         if (this.disposed)
-            return Promise.resolve(error(this.disposed));
+            return Promise.resolve(nestedError(this.disposed));
         logger.debug('Sending', name, filterForLog(name, data));
         const result = await this.transport.call({
             name,
@@ -230,7 +226,7 @@ class DeviceCurrentSession {
     }
     async send(name, data, options = {}) {
         if (this.disposed)
-            return Promise.resolve(error(this.disposed));
+            return Promise.resolve(nestedError(this.disposed));
         const result = await this.transport.send({
             name,
             data,
@@ -243,7 +239,7 @@ class DeviceCurrentSession {
     }
     async receive(options = {}) {
         if (this.disposed)
-            return Promise.resolve(error(this.disposed));
+            return Promise.resolve(nestedError(this.disposed));
         const result = await this.transport.receive({
             session: this.session,
             protocol: this.device.protocol,

package/lib/device/TransportList.js

@@ -5,6 +5,12 @@ const transport_1 = require("@trezor/transport");
 const constants_1 = require("../constants");
 const tryGetTransport = (transports, name) => transports.find(t => t.name === name);
 const getOrCreateTransport = (transports, transportType, params) => {
+    if (transportType === 'BridgeTransport') {
+        const existing = transports.filter(t => t.name === transportType);
+        return existing.length
+            ? existing
+            : [new transport_1.BridgeTransport({ ...params, port: 21328 }), new transport_1.BridgeTransport(params)];
+    }
     if (typeof transportType === 'string') {
         const existing = tryGetTransport(transports, transportType);
         if (existing)
@@ -14,8 +20,6 @@ const getOrCreateTransport = (transports, transportType, params) => {
                 return new transport_1.WebUsbTransport(params);
             case 'NodeUsbTransport':
                 return new transport_1.NodeUsbTransport(params);
-            case 'BridgeTransport':
-                return new transport_1.BridgeTransport(params);
             case 'UdpTransport':
                 return new transport_1.UdpTransport(params);
         }
@@ -27,8 +31,9 @@ const getOrCreateTransport = (transports, transportType, params) => {
         }
     }
     else if ((0, transport_1.isTransportInstance)(transportType)) {
-        if (tryGetTransport(transports, transportType.name)) {
-            return transportType;
+        const existing = tryGetTransport(transports, transportType.name);
+        if (existing) {
+            return existing;
         }
         if (!transportType.getMessage()) {
             transportType.updateMessages(params.messages);
@@ -39,7 +44,7 @@ const getOrCreateTransport = (transports, transportType, params) => {
 };
 const createTransports = (existing, transports = [], params) => {
     const transportTypes = transports?.length ? transports : ['BridgeTransport'];
-    return transportTypes.map(type => getOrCreateTransport(existing, type, params));
+    return transportTypes.flatMap(type => getOrCreateTransport(existing, type, params));
 };
 const createTransportList = (params) => (existing, transports) => createTransports(existing, transports, params);
 exports.createTransportList = createTransportList;

package/lib/device/checkFirmwareRevision.d.ts

@@ -1,4 +1,4 @@
-import type { VersionArray } from '@trezor/device-utils';
+import type { FirmwareType, VersionArray } from '@trezor/device-utils';
 import { PROTO } from '../constants';
 import { FirmwareRevisionCheckResult } from '../types/device';
 export type CheckFirmwareRevisionParams = {
@@ -6,6 +6,7 @@ export type CheckFirmwareRevisionParams = {
     internalModel: PROTO.DeviceModelInternal;
     deviceRevision: string | null;
     expectedRevision: string | undefined;
+    firmwareType: FirmwareType;
 };
-export declare const checkFirmwareRevision: ({ firmwareVersion, internalModel, deviceRevision, expectedRevision, }: CheckFirmwareRevisionParams) => Promise<FirmwareRevisionCheckResult>;
+export declare const checkFirmwareRevision: ({ firmwareVersion, internalModel, deviceRevision, expectedRevision, firmwareType, }: CheckFirmwareRevisionParams) => Promise<FirmwareRevisionCheckResult>;
 //# sourceMappingURL=checkFirmwareRevision.d.ts.map

package/lib/device/checkFirmwareRevision.js

@@ -8,14 +8,12 @@ const assets_browser_1 = require("../utils/assets-browser");
 const isNotFoundError = (e) => e instanceof assets_browser_1.HttpRequestError && e.response.status === 404;
 const isNodeJSOfflineError = (e) => ['FetchError', 'AbortError'].includes(e.name);
 const isReactNativeOfflineError = (e) => e.name === 'TypeError' && e.message.includes('Network request failed');
+const isAbortControllerTimeout = (e) => e.name === 'AbortError' ||
+    (e.name === 'TimeoutError' && e.message.includes('signal timed out'));
 const isOfflineError = (e) => {
     if (!(e instanceof Error))
         return false;
-    return isNodeJSOfflineError(e) || isReactNativeOfflineError(e);
-};
-const getOnlineReleaseMetadata = async ({ firmwareVersion, internalModel, }) => {
-    const onlineReleases = await (0, firmwareInfo_1.getOnlineReleases)(internalModel);
-    return onlineReleases.find(onlineRelease => utils_1.versionUtils.isEqual(onlineRelease.version, firmwareVersion));
+    return isNodeJSOfflineError(e) || isReactNativeOfflineError(e) || isAbortControllerTimeout(e);
 };
 const failFirmwareRevisionCheck = (error, errorPayload) => ({
     success: false,
@@ -32,16 +30,13 @@ const doRevisionsMatch = ({ deviceRevision, expectedCommitRevision, firmwareVers
     });
     return adjustedExpected === deviceRevision;
 };
-const checkFirmwareRevision = async ({ firmwareVersion, internalModel, deviceRevision, expectedRevision, }) => {
+const checkFirmwareRevision = async ({ firmwareVersion, internalModel, deviceRevision, expectedRevision, firmwareType, }) => {
     if (expectedRevision === undefined) {
-        if (firmwareVersion.length !== 3) {
+        if (!utils_1.versionUtils.isVersionArray(firmwareVersion)) {
             return failFirmwareRevisionCheck('firmware-version-unknown');
         }
         try {
-            const onlineRelease = await getOnlineReleaseMetadata({
-                firmwareVersion,
-                internalModel,
-            });
+            const onlineRelease = await (0, firmwareInfo_1.getOnlineReleaseByVersion)(internalModel, firmwareVersion, firmwareType);
             if (onlineRelease?.firmware_revision === undefined) {
                 return failFirmwareRevisionCheck('firmware-version-unknown');
             }

package/lib/device/thp/handshake.d.ts

@@ -0,0 +1,4 @@
+import type { Device } from '../Device';
+export declare const createThpChannel: (device: Device) => Promise<void>;
+export declare const thpHandshake: (device: Device) => Promise<void>;
+//# sourceMappingURL=handshake.d.ts.map

package/lib/device/thp/handshake.js

@@ -0,0 +1,88 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.thpHandshake = exports.createThpChannel = void 0;
+const crypto_1 = require("crypto");
+const protobuf_1 = require("@trezor/protobuf");
+const protocol_1 = require("@trezor/protocol");
+const thpCall_1 = require("./thpCall");
+const constants_1 = require("../../constants");
+const DataManager_1 = require("../../data/DataManager");
+const enumFromString = (dm) => typeof dm === 'string' ? protocol_1.thp.ThpPairingMethod[dm] : dm;
+const getPairingMethods = (deviceMethods, settingsMethods) => deviceMethods?.flatMap(dm => {
+    const value = enumFromString(dm);
+    const isRequested = settingsMethods && settingsMethods.find(sm => value === enumFromString(sm));
+    return isRequested ? value : [];
+});
+const createThpChannel = async (device) => {
+    const thpState = device.getThpState();
+    if (!thpState) {
+        throw constants_1.ERRORS.TypedError('Device_ThpStateMissing');
+    }
+    thpState.setChannel(protocol_1.thp.constants.THP_DEFAULT_CHANNEL);
+    const nonce = (0, crypto_1.randomBytes)(8);
+    const createChannel = await (0, thpCall_1.thpCall)(device, 'ThpCreateChannelRequest', { nonce });
+    const { properties, ...resp } = createChannel.message;
+    if (nonce.compare(resp.nonce) !== 0) {
+        throw new Error('Nonce not meet' + nonce.toString('hex') + ' ' + resp.nonce.toString('hex'));
+    }
+    const settings = DataManager_1.DataManager.getSettings('thp');
+    const pairingMethods = getPairingMethods(properties.pairing_methods, settings?.pairingMethods);
+    if (!pairingMethods?.length) {
+        throw constants_1.ERRORS.TypedError('Device_ThpPairingMethodsException');
+    }
+    thpState.setThpProperties(properties);
+    thpState.setChannel(resp.channel);
+    thpState.updateHandshakeCredentials({
+        pairingMethods,
+        handshakeHash: resp.handshakeHash,
+    });
+};
+exports.createThpChannel = createThpChannel;
+const thpHandshake = async (device) => {
+    const thpState = device.getThpState();
+    if (!thpState?.handshakeCredentials) {
+        throw constants_1.ERRORS.TypedError('Device_ThpStateMissing');
+    }
+    const settings = DataManager_1.DataManager.getSettings('thp');
+    const staticKey = settings?.staticKey
+        ? Buffer.from(settings.staticKey, 'hex')
+        : (0, crypto_1.randomBytes)(32);
+    const hostStaticKeys = protocol_1.thp.getCurve25519KeyPair(staticKey);
+    const knownCredentials = (settings?.knownCredentials || []).sort(cre => cre.autoconnect ? -1 : 1);
+    const hostEphemeralKeys = protocol_1.thp.getCurve25519KeyPair((0, crypto_1.randomBytes)(32));
+    const handshakeInit = await (0, thpCall_1.thpCall)(device, 'ThpHandshakeInitRequest', {
+        key: hostEphemeralKeys.publicKey,
+    });
+    const { trezorEncryptedStaticPubkey } = handshakeInit.message;
+    const handshakeCredentials = protocol_1.thp.handleHandshakeInit({
+        handshakeInitResponse: handshakeInit.message,
+        thpState,
+        hostStaticKeys,
+        hostEphemeralKeys,
+        knownCredentials,
+        protobufEncoder: (name, data) => (0, protobuf_1.encodeMessage)(device.transport.getMessages(), name, data),
+    });
+    const { hostKey, trezorKey, hostEncryptedStaticPubkey } = handshakeCredentials;
+    thpState.updateHandshakeCredentials({
+        trezorEncryptedStaticPubkey,
+        hostEncryptedStaticPubkey,
+        handshakeHash: handshakeCredentials.handshakeHash,
+        trezorKey,
+        hostKey,
+        staticKey,
+        hostStaticPublicKey: hostStaticKeys.publicKey,
+    });
+    thpState.setPairingCredentials(handshakeCredentials.allCredentials);
+    const handshakeCompletion = await (0, thpCall_1.thpCall)(device, 'ThpHandshakeCompletionRequest', {
+        hostPubkey: hostEncryptedStaticPubkey,
+        encryptedPayload: handshakeCredentials.encryptedPayload,
+    });
+    thpState.setIsPaired(!!handshakeCompletion.message.state);
+    thpState.setPhase('pairing');
+    if (thpState.isPaired && thpState.isAutoconnectPaired) {
+        await (0, thpCall_1.thpCall)(device, 'ThpEndRequest', {});
+        thpState.setPhase('paired');
+    }
+};
+exports.thpHandshake = thpHandshake;
+//# sourceMappingURL=handshake.js.map

package/lib/device/thp/index.d.ts

@@ -1,3 +1,6 @@
 import type { Device } from '../Device';
-export declare const getThpChannel: (_device: Device, _withInteraction?: boolean) => Promise<void>;
+export { abortThpWorkflow } from './thpCall';
+export { getThpCredentials } from './pairing';
+export { createThpSession } from './session';
+export declare const getThpChannel: (device: Device, withInteraction?: boolean) => Promise<void>;
 //# sourceMappingURL=index.d.ts.map

package/lib/device/thp/index.js

@@ -1,11 +1,29 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getThpChannel = void 0;
-const constants_1 = require("../../constants");
-const getThpChannel = async (_device, _withInteraction) => {
-    await new Promise((_, reject) => {
-        reject(constants_1.ERRORS.TypedError('Device_ThpStateMissing'));
-    });
+exports.getThpChannel = exports.createThpSession = exports.getThpCredentials = exports.abortThpWorkflow = void 0;
+const handshake_1 = require("./handshake");
+const pairing_1 = require("./pairing");
+var thpCall_1 = require("./thpCall");
+Object.defineProperty(exports, "abortThpWorkflow", { enumerable: true, get: function () { return thpCall_1.abortThpWorkflow; } });
+var pairing_2 = require("./pairing");
+Object.defineProperty(exports, "getThpCredentials", { enumerable: true, get: function () { return pairing_2.getThpCredentials; } });
+var session_1 = require("./session");
+Object.defineProperty(exports, "createThpSession", { enumerable: true, get: function () { return session_1.createThpSession; } });
+const getThpChannel = async (device, withInteraction) => {
+    const thpState = device.getThpState();
+    try {
+        if (thpState?.phase === 'handshake') {
+            await (0, handshake_1.createThpChannel)(device);
+            await (0, handshake_1.thpHandshake)(device);
+        }
+        if (thpState?.phase === 'pairing' && withInteraction) {
+            await (0, pairing_1.thpPairing)(device);
+        }
+    }
+    catch (error) {
+        thpState?.resetState();
+        throw error;
+    }
 };
 exports.getThpChannel = getThpChannel;
 //# sourceMappingURL=index.js.map

package/lib/device/thp/pairing.d.ts

@@ -0,0 +1,16 @@
+import { thp as protocolThp } from '@trezor/protocol';
+import type { Device } from '../Device';
+export declare const getThpCredentials: (device: Device, autoconnect?: boolean) => Promise<{
+    autoconnect: boolean;
+    trezor_static_public_key: string;
+    credential: string;
+}>;
+export declare const thpPairingEnd: (device: Device) => Promise<{
+    type: "ThpEndResponse";
+    message: protocolThp.ThpEndResponse;
+}>;
+export declare const thpPairing: (device: Device) => Promise<{
+    type: "ThpEndResponse";
+    message: protocolThp.ThpEndResponse;
+} | undefined>;
+//# sourceMappingURL=pairing.d.ts.map

package/lib/device/thp/pairing.js

@@ -0,0 +1,230 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.thpPairing = exports.thpPairingEnd = exports.getThpCredentials = void 0;
+const crypto_1 = require("crypto");
+const protocol_1 = require("@trezor/protocol");
+const utils_1 = require("@trezor/utils");
+const constants_1 = require("../../constants");
+const DataManager_1 = require("../../data/DataManager");
+const events_1 = require("../../events");
+const thpCall_1 = require("./thpCall");
+const processQrCodeTag = async (device, value) => {
+    const thpState = device.getThpState();
+    if (!thpState?.handshakeCredentials) {
+        throw constants_1.ERRORS.TypedError('Device_ThpStateMissing');
+    }
+    const tagSha = (0, crypto_1.createHash)('sha256')
+        .update(thpState.handshakeCredentials.handshakeHash)
+        .update(Buffer.from(value, 'hex'))
+        .digest('hex');
+    const qrCodeSecret = await (0, thpCall_1.thpCall)(device, 'ThpQrCodeTag', {
+        tag: tagSha,
+    });
+    protocol_1.thp.validateQrCodeTag(thpState.handshakeCredentials, value, qrCodeSecret.message.secret);
+    return qrCodeSecret;
+};
+const processNfcTag = async (device, value) => {
+    const thpState = device.getThpState();
+    if (!thpState?.handshakeCredentials) {
+        throw constants_1.ERRORS.TypedError('Device_ThpStateMissing');
+    }
+    if (!thpState?.nfcSecret) {
+        throw new Error('missing nfcSecret');
+    }
+    const tagSha = (0, crypto_1.createHash)('sha256')
+        .update(Buffer.from([protocol_1.thp.ThpPairingMethod.NFC]))
+        .update(thpState.handshakeCredentials.handshakeHash)
+        .update(Buffer.from(value, 'hex'))
+        .digest('hex');
+    const nfcTagTrezor = await (0, thpCall_1.thpCall)(device, 'ThpNfcTagHost', {
+        tag: tagSha,
+    });
+    protocol_1.thp.validateNfcTag(thpState.handshakeCredentials, nfcTagTrezor.message.tag, thpState.nfcSecret);
+    return nfcTagTrezor;
+};
+const processCodeEntry = async (device, value) => {
+    if (value.length !== 6) {
+        throw constants_1.ERRORS.TypedError('Device_ThpPairingTagInvalid');
+    }
+    const codeValue = Buffer.from(value, 'ascii');
+    const thpState = device.getThpState();
+    if (!thpState?.handshakeCredentials) {
+        throw constants_1.ERRORS.TypedError('Device_ThpStateMissing');
+    }
+    const hostKeys = protocol_1.thp.getCpaceHostKeys(codeValue, thpState.handshakeCredentials.handshakeHash);
+    const tag = protocol_1.thp
+        .getSharedSecret(thpState.handshakeCredentials.trezorCpacePublicKey, hostKeys.privateKey)
+        .toString('hex');
+    const codeEntrySecret = await (0, thpCall_1.thpCall)(device, 'ThpCodeEntryCpaceHostTag', {
+        tag,
+        cpace_host_public_key: hostKeys.publicKey.toString('hex'),
+    });
+    protocol_1.thp.validateCodeEntryTag(thpState.handshakeCredentials, value, codeEntrySecret.message.secret);
+    return codeEntrySecret;
+};
+const processThpPairingResponse = (device, payload) => {
+    if ('selectedMethod' in payload) {
+        device.getThpState()?.setPairingMethod(payload.selectedMethod);
+        return (0, thpCall_1.thpCall)(device, 'ThpSelectMethod', {
+            selected_pairing_method: payload.selectedMethod,
+        });
+    }
+    if (payload.source === 'qr-code') {
+        return processQrCodeTag(device, payload.tag);
+    }
+    if (payload.source === 'nfc') {
+        return processNfcTag(device, payload.tag);
+    }
+    if (payload.source === 'code-entry') {
+        return processCodeEntry(device, payload.tag);
+    }
+    throw new Error(`Unknown THP pairing source ${payload.source}`);
+};
+const waitForPairingCancel = (device) => {
+    const readAbort = new AbortController();
+    device.getThpState()?.setExpectedResponses([0x04]);
+    const readCancel = device.getCurrentSession().receive({
+        signal: readAbort.signal,
+    });
+    return {
+        readAbort,
+        readCancel,
+    };
+};
+const waitForPairingTag = async (device) => {
+    const thpState = device.getThpState();
+    if (!thpState?.handshakeCredentials) {
+        throw constants_1.ERRORS.TypedError('Device_ThpStateMissing');
+    }
+    const dfd = (0, utils_1.createDeferred)();
+    const { readAbort, readCancel } = waitForPairingCancel(device);
+    const cancelResult = readCancel
+        .then(readResult => {
+        if (readResult.success) {
+            let error;
+            if (readResult.payload.type === 'Failure' && readResult.payload.message.message) {
+                error = readResult.payload.message.message;
+            }
+            else {
+                error = `Pairing tag cancelled (${readResult.payload.type})`;
+            }
+            dfd.resolve({ error });
+        }
+    })
+        .catch(() => {
+    });
+    thpState.setPairingTagPromise({
+        abort: async () => {
+            readAbort.abort();
+            await cancelResult;
+        },
+    });
+    const payload = {
+        availableMethods: thpState.handshakeCredentials.pairingMethods,
+        selectedMethod: thpState.pairingMethod,
+        nfcData: thpState.nfcData?.toString('hex'),
+    };
+    device.prompt('thp_pairing', { payload }).then(response => {
+        if (response.success) {
+            dfd.resolve(response.payload);
+        }
+        else {
+            (0, thpCall_1.abortThpWorkflow)(device).then(() => {
+                dfd.resolve({ error: response.error.message });
+            });
+        }
+    });
+    const pairingResponse = await dfd.promise;
+    readAbort.abort();
+    await readCancel;
+    thpState.setPairingTagPromise(undefined);
+    if ('error' in pairingResponse) {
+        throw new Error(pairingResponse.error);
+    }
+    await new Promise(resolve => setTimeout(resolve, 500));
+    return processThpPairingResponse(device, pairingResponse).catch(e => {
+        if (e.code === 'Failure_FirmwareError') {
+            throw constants_1.ERRORS.TypedError('Device_ThpPairingTagInvalid', e.message);
+        }
+        throw constants_1.ERRORS.TypedError(e.code, e.message);
+    });
+};
+const getThpCredentials = async (device, autoconnect = false) => {
+    const thpState = device.getThpState();
+    if (!thpState?.handshakeCredentials) {
+        throw constants_1.ERRORS.TypedError('Device_ThpStateMissing');
+    }
+    const credentials = await (0, thpCall_1.thpCall)(device, 'ThpCredentialRequest', {
+        autoconnect,
+        host_static_public_key: thpState.handshakeCredentials.hostStaticPublicKey.toString('hex'),
+        credential: thpState.pairingCredentials[0]?.credential,
+    });
+    return { ...credentials.message, autoconnect };
+};
+exports.getThpCredentials = getThpCredentials;
+const thpPairingEnd = (device) => {
+    device.getThpState()?.setPhase('paired');
+    return (0, thpCall_1.thpCall)(device, 'ThpEndRequest', {});
+};
+exports.thpPairingEnd = thpPairingEnd;
+const thpPairing = async (device) => {
+    const thpState = device.getThpState();
+    if (!thpState?.handshakeCredentials) {
+        throw constants_1.ERRORS.TypedError('Device_ThpStateMissing');
+    }
+    if (thpState.isPaired && thpState.pairingMethod !== protocol_1.thp.ThpPairingMethod.SkipPairing) {
+        if (!thpState.isAutoconnectPaired) {
+            await (0, exports.getThpCredentials)(device, false);
+        }
+        return (0, exports.thpPairingEnd)(device);
+    }
+    const [selected_pairing_method] = thpState.handshakeCredentials.pairingMethods;
+    thpState.setPairingMethod(selected_pairing_method);
+    const settings = DataManager_1.DataManager.getSettings('thp');
+    await (0, thpCall_1.thpCall)(device, 'ThpPairingRequest', {
+        host_name: settings?.hostName || 'Unknown hostName',
+        app_name: settings?.appName || 'Unknown appName',
+    });
+    const selectMethod = await (0, thpCall_1.thpCall)(device, 'ThpSelectMethod', { selected_pairing_method });
+    if (selectMethod.type === 'ThpEndResponse') {
+        thpState.setIsPaired(true);
+        device.getThpState()?.setPhase('paired');
+        return;
+    }
+    if (selectMethod.type === 'ThpCodeEntryCommitment') {
+        const codeEntryChallenge = (0, crypto_1.randomBytes)(32);
+        const handshakeCommitment = Buffer.from(selectMethod.message.commitment, 'hex');
+        thpState.updateHandshakeCredentials({
+            handshakeCommitment,
+            codeEntryChallenge,
+        });
+        const codeEntryCpace = await (0, thpCall_1.thpCall)(device, 'ThpCodeEntryChallenge', {
+            challenge: codeEntryChallenge.toString('hex'),
+        });
+        thpState.updateHandshakeCredentials({
+            trezorCpacePublicKey: Buffer.from(codeEntryCpace.message.cpace_trezor_public_key, 'hex'),
+        });
+        await waitForPairingTag(device);
+    }
+    if (selectMethod.type === 'ThpPairingPreparationsFinished') {
+        if (thpState.pairingMethod === protocol_1.thp.ThpPairingMethod.NFC) {
+            thpState.setNfcSecret((0, crypto_1.randomBytes)(16));
+        }
+        await waitForPairingTag(device);
+    }
+    const credentials = await (0, exports.getThpCredentials)(device, false);
+    device.emit(events_1.DEVICE.THP_CREDENTIALS_CHANGED, {
+        credentials,
+        staticKey: thpState.handshakeCredentials.staticKey.toString('hex'),
+    });
+    const settings1 = DataManager_1.DataManager.getSettings('thp');
+    if (settings1) {
+        settings1.knownCredentials?.push(credentials);
+        settings1.staticKey = thpState.handshakeCredentials.staticKey.toString('hex');
+    }
+    thpState.setPairingCredentials([credentials]);
+    thpState.setIsPaired(true);
+    await (0, exports.thpPairingEnd)(device);
+};
+exports.thpPairing = thpPairing;
+//# sourceMappingURL=pairing.js.map

package/lib/device/thp/session.d.ts

@@ -0,0 +1,3 @@
+import type { Device } from '../Device';
+export declare const createThpSession: (device: Device, deriveCardano: boolean) => Promise<number>;
+//# sourceMappingURL=session.d.ts.map

package/lib/device/thp/session.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createThpSession = void 0;
+const thpCall_1 = require("./thpCall");
+const createThpSession = async (device, deriveCardano) => {
+    let passphrase;
+    if (!device.features.passphrase_protection) {
+        passphrase = { passphrase: '' };
+    }
+    else {
+        passphrase = await device.prompt('passphrase', {}).then(promptRes => {
+            if (!promptRes.success) {
+                return { passphrase: '' };
+            }
+            return promptRes.payload.passphraseOnDevice
+                ? { on_device: true }
+                : { passphrase: promptRes.payload.value };
+        });
+    }
+    await (0, thpCall_1.thpCall)(device, 'ThpCreateNewSession', {
+        ...passphrase,
+        derive_cardano: deriveCardano,
+    });
+    return 0;
+};
+exports.createThpSession = createThpSession;
+//# sourceMappingURL=session.js.map