otx-btc-wallet-connectors 0.1.0

package/src/trezor/TrezorConnector.ts

@@ -0,0 +1,824 @@
+import type {
+  WalletAccount,
+  BitcoinNetwork,
+  SignPsbtOptions,
+  AddressType,
+} from 'otx-btc-wallet-core';
+import { BaseConnector } from '../base';
+import { BtcService } from '../utils';
+import {
+  getAddressType,
+  getInputVBytes,
+  getOutputVBytes,
+  getDustThreshold,
+  deriveAddressFromPublicKey,
+} from '../utils';
+
+// Trezor wallet icon
+const TREZOR_ICON =
+  'data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMjAwIiBoZWlnaHQ9IjIwMCIgdmlld0JveD0iMCAwIDIwMCAyMDAiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxnIGNsaXAtcGF0aD0idXJsKCNjbGlwMF83MDM3XzExNSkiPgo8cGF0aCBkPSJNMjAwIDBIMFYyMDBIMjAwVjBaIiBmaWxsPSIjMDYyRDE2Ii8+CjxwYXRoIGQ9Ik0xMzMuMjYgNjMuMDUzNkMxMzMuMjYgNDUuNTM0IDExOC4wNjIgMzEgOTkuNTYyNyAzMUM4MS4wNjMxIDMxIDY1Ljg2NTYgNDUuNTQxMyA2NS44NjU2IDYzLjA1MzZWNzMuMjk5SDUyVjE0Ni45OTFMOTkuNTYyNyAxNjkuMTE3TDE0Ny4xMzYgMTQ2Ljk3NlY3My42MTI5SDEzMy4yNzFMMTMzLjI2IDYzLjA1MzZaTTgzLjA0NDQgNjMuMDUzNkM4My4wNDQ0IDU0Ljc5MzggOTAuMzEyOSA0OC4xODM4IDk5LjU2MjcgNDguMTgzOEMxMDguODEzIDQ4LjE4MzggMTE2LjA4MSA1NC43OTM4IDExNi4wODEgNjMuMDUzNlY3My4yOTlIODMuMDQ0NFY2My4wNTM2Wk0xMjcuOTczIDEzNS4wOTJMOTkuNTYyNyAxNDguMzEyTDcxLjE1MjggMTM1LjA5MlY5MC44MTEzSDEyNy45NzNWMTM1LjA5MloiIGZpbGw9IndoaXRlIi8+CjwvZz4KPGRlZnM+CjxjbGlwUGF0aCBpZD0iY2xpcDBfNzAzN18xMTUiPgo8cmVjdCB3aWR0aD0iMjAwIiBoZWlnaHQ9IjIwMCIgcng9IjM1LjU1NTYiIGZpbGw9IndoaXRlIi8+CjwvY2xpcFBhdGg+CjwvZGVmcz4KPC9zdmc+Cg==';
+
+/**
+ * Trezor address type configuration
+ */
+export type TrezorAddressType = 'legacy' | 'nested-segwit' | 'segwit' | 'taproot';
+
+/**
+ * Trezor connector options
+ */
+export interface TrezorConnectorOptions {
+  /** Address type for derivation (default: 'segwit') */
+  addressType?: TrezorAddressType;
+  /** Account index (default: 0) */
+  accountIndex?: number;
+  /** Address index (default: 0) */
+  addressIndex?: number;
+  /** Manifest email for Trezor Connect */
+  manifestEmail?: string;
+  /** Manifest app URL for Trezor Connect */
+  manifestAppUrl?: string;
+}
+
+/**
+ * Options for sendBitcoin method
+ */
+export interface TrezorSendBitcoinOptions {
+  /** Fee rate in sat/vB (optional, defaults to "hour" priority) */
+  feeRate?: number;
+}
+
+/**
+ * Address type to BIP path mapping
+ */
+const ADDRESS_TYPE_TO_PATH: Record<TrezorAddressType, number> = {
+  legacy: 44,
+  'nested-segwit': 49,
+  segwit: 84,
+  taproot: 86,
+};
+
+/**
+ * Address type to Trezor script type mapping
+ */
+const ADDRESS_TYPE_TO_SCRIPT_TYPE: Record<TrezorAddressType, string> = {
+  legacy: 'SPENDADDRESS',
+  'nested-segwit': 'SPENDP2SHWITNESS',
+  segwit: 'SPENDWITNESS',
+  taproot: 'SPENDTAPROOT',
+};
+
+/**
+ * Address type to output script type mapping
+ */
+const ADDRESS_TYPE_TO_OUTPUT_SCRIPT_TYPE: Record<TrezorAddressType, string> = {
+  legacy: 'PAYTOADDRESS',
+  'nested-segwit': 'PAYTOP2SHWITNESS',
+  segwit: 'PAYTOWITNESS',
+  taproot: 'PAYTOTAPROOT',
+};
+
+// Common params for Trezor Connect methods
+interface TrezorCommonParams {
+  keepSession?: boolean;
+}
+
+// Trezor Connect types (minimal interface to avoid importing full types)
+interface TrezorConnect {
+  init(settings: {
+    manifest: { email: string; appUrl: string };
+    popup?: boolean;
+    lazyLoad?: boolean;
+    transports?: string[];
+    coreMode?: 'auto' | 'iframe' | 'popup';
+    debug?: boolean;
+  }): Promise<void>;
+  getAddress(params: TrezorCommonParams & {
+    path: string;
+    coin: string;
+    showOnTrezor?: boolean;
+  }): Promise<TrezorResponse<{ address: string; path: number[] }>>;
+  signMessage(params: TrezorCommonParams & {
+    path: string;
+    message: string;
+    coin: string;
+  }): Promise<TrezorResponse<{ signature: string; address: string }>>;
+  signTransaction(params: TrezorCommonParams & {
+    inputs: TrezorInput[];
+    outputs: TrezorOutput[];
+    coin: string;
+    push?: boolean;
+    refTxs?: RefTransaction[];
+  }): Promise<TrezorResponse<{ serializedTx: string; signatures: string[] }>>;
+  pushTransaction(params: TrezorCommonParams & {
+    tx: string;
+    coin: string;
+  }): Promise<TrezorResponse<{ txid: string }>>;
+  getPublicKey(params: TrezorCommonParams & {
+    path: string;
+    coin: string;
+    suppressBackupWarning?: boolean;
+  }): Promise<TrezorResponse<{ publicKey: string; chainCode: string; xpub: string }>>;
+  dispose(): void;
+}
+
+/**
+ * Reference transaction for Trezor (needed for testnet)
+ */
+interface RefTransaction {
+  hash: string;
+  version: number;
+  inputs: Array<{
+    prev_hash: string;
+    prev_index: number;
+    sequence: number;
+    script_sig: string;
+  }>;
+  bin_outputs: Array<{
+    amount: number;
+    script_pubkey: string;
+  }>;
+  lock_time: number;
+}
+
+interface TrezorResponse<T> {
+  success: boolean;
+  payload: T | { error: string; code?: string };
+}
+
+interface TrezorInput {
+  address_n: number[];
+  prev_hash: string;
+  prev_index: number;
+  amount: string;
+  script_type?: string;
+}
+
+interface TrezorOutput {
+  address?: string;
+  address_n?: number[];
+  amount: string;
+  script_type?: string;
+}
+
+/**
+ * Trezor Hardware Wallet Connector
+ *
+ * @see https://docs.trezor.io/trezor-suite/packages/connect/index.html
+ * @see https://github.com/trezor/trezor-suite/tree/develop/packages/connect
+ */
+export class TrezorConnector extends BaseConnector {
+  readonly id = 'trezor';
+  readonly name = 'Trezor';
+  readonly icon = TREZOR_ICON;
+
+  private _trezorConnect: TrezorConnect | null = null;
+  private _account: WalletAccount | null = null;
+  private _network: BitcoinNetwork = 'mainnet';
+  private _options: Required<TrezorConnectorOptions>;
+  private _derivationPath: string = '';
+  private _initialized: boolean = false;
+
+  constructor(options: TrezorConnectorOptions = {}) {
+    super();
+    this._options = {
+      addressType: options.addressType ?? 'segwit',
+      accountIndex: options.accountIndex ?? 0,
+      addressIndex: options.addressIndex ?? 0,
+      manifestEmail: options.manifestEmail ?? 'support@optimex.com',
+      manifestAppUrl:
+        options.manifestAppUrl ??
+        (typeof window !== 'undefined' ? window.location.origin : 'https://optimex.com'),
+    };
+  }
+
+  /**
+   * Override checkReady - Trezor is always "ready" since it doesn't require browser extension
+   * The actual device connection happens when connect() is called
+   */
+  protected checkReady(): void {
+    this.ready = true;
+  }
+
+  /**
+   * Get the provider - Trezor doesn't use window injection
+   */
+  protected getProvider(): null {
+    return null;
+  }
+
+  /**
+   * Get current address type
+   */
+  getAddressType(): TrezorAddressType {
+    return this._options.addressType;
+  }
+
+  /**
+   * Set address type options before connecting
+   * Call this before connect() to change the address derivation path
+   */
+  setOptions(options: Omit<TrezorConnectorOptions, 'manifestEmail' | 'manifestAppUrl'>): void {
+    this._options = {
+      ...this._options,
+      addressType: options.addressType ?? this._options.addressType,
+      accountIndex: options.accountIndex ?? this._options.accountIndex,
+      addressIndex: options.addressIndex ?? this._options.addressIndex,
+    };
+  }
+
+  /**
+   * Get available address types for UI selection
+   */
+  static getAvailableAddressTypes(): Array<{ type: TrezorAddressType; label: string; description: string }> {
+    return [
+      { type: 'legacy', label: 'Legacy (P2PKH)', description: "Starts with '1' or 'm/n'" },
+      { type: 'nested-segwit', label: 'Nested SegWit (P2SH-P2WPKH)', description: "Starts with '3' or '2'" },
+      { type: 'segwit', label: 'Native SegWit (P2WPKH)', description: "Starts with 'bc1q' or 'tb1q'" },
+      { type: 'taproot', label: 'Taproot (P2TR)', description: "Starts with 'bc1p' or 'tb1p'" },
+    ];
+  }
+
+  /**
+   * Initialize Trezor Connect
+   */
+  private async initTrezorConnect(): Promise<TrezorConnect> {
+    if (this._trezorConnect && this._initialized) {
+      return this._trezorConnect;
+    }
+
+    try {
+      const TrezorConnectModule = await import('@trezor/connect-web');
+      const TrezorConnect = TrezorConnectModule.default;
+
+      // Initialize with proper v9 settings
+      // coreMode: 'popup' forces popup mode which works without Trezor Suite
+      // transports: specify which transports to use
+      await TrezorConnect.init({
+        manifest: {
+          email: this._options.manifestEmail,
+          appUrl: this._options.manifestAppUrl,
+        },
+        popup: true,
+        lazyLoad: false, // Don't lazy load - init immediately
+        coreMode: 'popup', // Force popup mode for better compatibility
+        transports: ['BridgeTransport', 'WebUsbTransport'], // Try both Bridge and WebUSB
+        debug: false,
+      });
+
+      this._trezorConnect = TrezorConnect as unknown as TrezorConnect;
+      this._initialized = true;
+
+      return this._trezorConnect;
+    } catch (error) {
+      console.error('Trezor Connect init error:', error);
+      throw new Error(
+        'Failed to initialize Trezor Connect. Make sure @trezor/connect-web is installed and Trezor Bridge or Trezor Suite is running.'
+      );
+    }
+  }
+
+  /**
+   * Build BIP32 derivation path
+   */
+  private buildDerivationPath(
+    addressType: TrezorAddressType,
+    network: BitcoinNetwork,
+    accountIndex: number,
+    addressIndex: number,
+    isChange: boolean = false
+  ): string {
+    const coinType = network === 'mainnet' ? 0 : 1;
+    const purpose = ADDRESS_TYPE_TO_PATH[addressType];
+    const change = isChange ? 1 : 0;
+    return `m/${purpose}'/${coinType}'/${accountIndex}'/${change}/${addressIndex}`;
+  }
+
+  /**
+   * Parse derivation path string to array of numbers
+   */
+  private parseDerivationPath(path: string): number[] {
+    return path
+      .split('/')
+      .slice(1) // Remove 'm'
+      .map((segment) => {
+        const isHardened = segment.endsWith("'");
+        const num = parseInt(segment, 10);
+        return isHardened ? num + 0x80000000 : num;
+      });
+  }
+
+  /**
+   * Connect to Trezor device
+   * IMPORTANT: This must be called within a user gesture (click event)
+   *
+   * This method only calls getPublicKey() once and derives the address locally
+   * to avoid opening the Trezor popup twice.
+   */
+  async connect(network: BitcoinNetwork = 'mainnet'): Promise<WalletAccount> {
+    try {
+      const trezor = await this.initTrezorConnect();
+
+      this._network = network;
+      const coin = network === 'mainnet' ? 'btc' : 'test';
+
+      // Build derivation path
+      this._derivationPath = this.buildDerivationPath(
+        this._options.addressType,
+        network,
+        this._options.accountIndex,
+        this._options.addressIndex
+      );
+
+      // Only call getPublicKey() - address will be derived locally from the public key
+      // This avoids opening the Trezor popup twice
+      const pubKeyResult = await trezor.getPublicKey({
+        path: this._derivationPath,
+        coin,
+        suppressBackupWarning: true,
+      });
+
+      if (!pubKeyResult.success) {
+        const error = pubKeyResult.payload as { error: string };
+        throw new Error(error.error);
+      }
+
+      const pubKeyPayload = pubKeyResult.payload as { publicKey: string };
+
+      // Derive address from public key locally
+      const address = deriveAddressFromPublicKey(
+        pubKeyPayload.publicKey,
+        this.mapTrezorAddressType(this._options.addressType),
+        network
+      );
+
+      this._account = {
+        address,
+        publicKey: pubKeyPayload.publicKey,
+        type: this.mapTrezorAddressType(this._options.addressType),
+      };
+
+      return this._account;
+    } catch (error) {
+      this.handleTrezorError(error);
+    }
+  }
+
+  /**
+   * Get address with verification on device
+   *
+   * Note: This method calls getAddress() with showOnTrezor=true to display
+   * the address on the Trezor device for user verification. The public key
+   * is already available from the initial connect() call.
+   */
+  async getAddressWithVerification(): Promise<WalletAccount> {
+    if (!this._account) {
+      throw new Error('Not connected to Trezor device. Call connect() first.');
+    }
+
+    try {
+      const trezor = await this.initTrezorConnect();
+      const coin = this._network === 'mainnet' ? 'btc' : 'test';
+
+      // Show address on Trezor for verification
+      const addressResult = await trezor.getAddress({
+        path: this._derivationPath,
+        coin,
+        showOnTrezor: true,
+      });
+
+      if (!addressResult.success) {
+        const error = addressResult.payload as { error: string };
+        throw new Error(error.error);
+      }
+
+      // Return the existing account (publicKey already available from connect())
+      return this._account;
+    } catch (error) {
+      this.handleTrezorError(error);
+    }
+  }
+
+  async disconnect(): Promise<void> {
+    if (this._trezorConnect) {
+      try {
+        this._trezorConnect.dispose();
+      } catch {
+        // Ignore dispose errors
+      }
+      this._trezorConnect = null;
+      this._initialized = false;
+    }
+    this._account = null;
+    this.cleanup();
+  }
+
+  async getAccounts(): Promise<WalletAccount[]> {
+    if (!this._account) {
+      return [];
+    }
+    return [this._account];
+  }
+
+  async signMessage(message: string): Promise<string> {
+    try {
+      const trezor = await this.initTrezorConnect();
+
+      const result = await trezor.signMessage({
+        path: this._derivationPath,
+        message,
+        coin: this._network === 'mainnet' ? 'btc' : 'test',
+      });
+
+      if (!result.success) {
+        const error = result.payload as { error: string };
+        throw new Error(error.error);
+      }
+
+      const payload = result.payload as { signature: string };
+      return payload.signature;
+    } catch (error) {
+      this.handleTrezorError(error);
+    }
+  }
+
+  /**
+   * Sign a PSBT with Trezor
+   *
+   * Note: Trezor Connect doesn't directly support PSBT format.
+   * Use signTransaction method or sendBitcoin instead.
+   */
+  async signPsbt(_psbtHex: string, _options?: SignPsbtOptions): Promise<string> {
+    void _psbtHex;
+    void _options;
+
+    throw new Error(
+      'Direct PSBT signing is not supported by Trezor Connect. ' +
+        'Please use sendBitcoin() method or manually parse the PSBT and use signTransaction().'
+    );
+  }
+
+  /**
+   * Sign multiple PSBTs
+   */
+  async signPsbts(psbtHexs: string[], options?: SignPsbtOptions): Promise<string[]> {
+    const results: string[] = [];
+    for (const psbtHex of psbtHexs) {
+      const signed = await this.signPsbt(psbtHex, options);
+      results.push(signed);
+    }
+    return results;
+  }
+
+  /**
+   * Send a Bitcoin transaction
+   *
+   * @param to - Recipient address
+   * @param satoshis - Amount to send in satoshis
+   * @param options - Send options (feeRate, etc.)
+   * @returns Transaction ID after broadcast
+   *
+   * @example
+   * ```typescript
+   * const txid = await trezor.sendTransaction('bc1q...', 50000);
+   * // With custom fee rate
+   * const txid = await trezor.sendTransaction('bc1q...', 50000, { feeRate: 10 });
+   * ```
+   */
+  async sendTransaction(
+    to: string,
+    satoshis: number,
+    options?: TrezorSendBitcoinOptions
+  ): Promise<string> {
+    if (!this._account) {
+      throw new Error('Not connected to Trezor device');
+    }
+
+    const trezor = await this.initTrezorConnect();
+    const btcService = new BtcService(this._network);
+
+    // 1. Get UTXOs with tx hex (needed for testnet refTxs)
+    const utxos = await btcService.getUtxosWithTxHex(this._account.address);
+    if (utxos.length === 0) {
+      throw new Error('No UTXOs available for spending');
+    }
+
+    // 2. Get fee rate if not provided
+    let feeRate = options?.feeRate;
+    if (!feeRate) {
+      const feeRates = await btcService.getFeeRates();
+      feeRate = feeRates.hour;
+    }
+
+    // 3. Get address types using utility functions
+    const fromAddressType = getAddressType(this._account.address);
+    const toAddressType = getAddressType(to);
+
+    // 4. Get vBytes estimates using utility functions
+    const inputVBytes = getInputVBytes(fromAddressType);
+    const outputVBytes = getOutputVBytes(toAddressType);
+    const changeOutputVBytes = getOutputVBytes(fromAddressType);
+    const baseVBytes = 10.5; // Base transaction overhead
+
+    // 5. Select UTXOs using greedy algorithm (sorted by value descending)
+    const sortedUtxos = [...utxos].sort((a, b) => b.value - a.value);
+    const selectedUtxos: typeof utxos = [];
+    let totalInputValue = 0;
+
+    for (const utxo of sortedUtxos) {
+      selectedUtxos.push(utxo);
+      totalInputValue += utxo.value;
+
+      // Calculate fee with 2 outputs (recipient + change)
+      const estimatedVBytes = baseVBytes + selectedUtxos.length * inputVBytes + outputVBytes + changeOutputVBytes;
+      const estimatedFee = Math.ceil(estimatedVBytes * feeRate);
+
+      if (totalInputValue >= satoshis + estimatedFee) {
+        break;
+      }
+    }
+
+    // 6. Calculate final fee
+    let estimatedVBytes = baseVBytes + selectedUtxos.length * inputVBytes + outputVBytes + changeOutputVBytes;
+    let estimatedFee = Math.ceil(estimatedVBytes * feeRate);
+
+    // Check if we have enough funds
+    if (totalInputValue < satoshis + estimatedFee) {
+      throw new Error(
+        `Insufficient funds. Available: ${totalInputValue} sats, Required: ${satoshis + estimatedFee} sats (including fee)`
+      );
+    }
+
+    // 7. Calculate change
+    let changeAmount = totalInputValue - satoshis - estimatedFee;
+
+    // 8. Build Trezor inputs
+    const trezorInputs: TrezorInput[] = selectedUtxos.map((utxo) => ({
+      address_n: this.parseDerivationPath(this._derivationPath),
+      prev_hash: utxo.txid,
+      prev_index: utxo.vout,
+      amount: utxo.value.toString(),
+      script_type: ADDRESS_TYPE_TO_SCRIPT_TYPE[this._options.addressType],
+    }));
+
+    // 9. Build Trezor outputs
+    const trezorOutputs: TrezorOutput[] = [
+      {
+        address: to,
+        amount: satoshis.toString(),
+        script_type: 'PAYTOADDRESS',
+      },
+    ];
+
+    // Add change output if above dust threshold
+    const dustThreshold = getDustThreshold(fromAddressType);
+
+    if (changeAmount > dustThreshold) {
+      // Build change path
+      const changePath = this.buildDerivationPath(
+        this._options.addressType,
+        this._network,
+        this._options.accountIndex,
+        0,
+        true // isChange = true
+      );
+
+      trezorOutputs.push({
+        address_n: this.parseDerivationPath(changePath),
+        amount: changeAmount.toString(),
+        script_type: ADDRESS_TYPE_TO_OUTPUT_SCRIPT_TYPE[this._options.addressType],
+      });
+    } else {
+      // No change output - recalculate fee without change output
+      estimatedVBytes = baseVBytes + selectedUtxos.length * inputVBytes + outputVBytes;
+      estimatedFee = Math.ceil(estimatedVBytes * feeRate);
+      changeAmount = 0;
+
+      // Verify we still have enough
+      if (totalInputValue < satoshis + estimatedFee) {
+        throw new Error(
+          `Insufficient funds after fee adjustment. Available: ${totalInputValue} sats, Required: ${satoshis + estimatedFee} sats`
+        );
+      }
+    }
+
+    // 10. Sign and broadcast transaction
+    const coin = this._network === 'mainnet' ? 'Bitcoin' : 'Testnet';
+
+    if (this._network === 'mainnet') {
+      // Mainnet: use Trezor's default blockbook backend
+      const result = await trezor.signTransaction({
+        inputs: trezorInputs,
+        outputs: trezorOutputs,
+        coin,
+        push: false,
+      });
+
+      if (!result.success) {
+        const error = result.payload as { error: string };
+        throw new Error(error.error);
+      }
+
+      const payload = result.payload as { serializedTx: string };
+
+      // Broadcast via our service
+      const txid = await btcService.broadcastTransaction(payload.serializedTx);
+      return txid;
+    } else {
+      // Testnet: build refTxs manually because Trezor's default blockbook API
+      // may not work properly with testnet
+      const refTxs: RefTransaction[] = [];
+
+      for (const utxo of selectedUtxos) {
+        try {
+          // Fetch full transaction data using BtcService
+          const rawTx = await btcService.getFullTransaction(utxo.txid);
+
+          // Build reference transaction
+          const inputRef = rawTx.vin.map((vin) => ({
+            prev_hash: vin.txid,
+            prev_index: vin.vout,
+            sequence: vin.sequence,
+            script_sig: vin.scriptsig || '',
+          }));
+
+          const binOutputs = rawTx.vout.map((vout) => ({
+            amount: vout.value,
+            script_pubkey: vout.scriptpubkey,
+          }));
+
+          refTxs.push({
+            hash: utxo.txid,
+            version: rawTx.version,
+            inputs: inputRef,
+            bin_outputs: binOutputs,
+            lock_time: rawTx.locktime,
+          });
+        } catch (error) {
+          console.error(`Failed to fetch ref tx for ${utxo.txid}:`, error);
+          throw new Error(`Failed to fetch reference transaction: ${utxo.txid}`);
+        }
+      }
+
+      // Sign with refTxs
+      const result = await trezor.signTransaction({
+        inputs: trezorInputs,
+        outputs: trezorOutputs,
+        coin,
+        refTxs,
+      });
+
+      if (!result.success) {
+        const error = result.payload as { error: string };
+        throw new Error(error.error);
+      }
+
+      const payload = result.payload as { serializedTx: string };
+
+      // Broadcast via our service
+      const txid = await btcService.broadcastTransaction(payload.serializedTx);
+      return txid;
+    }
+  }
+
+  async getNetwork(): Promise<BitcoinNetwork> {
+    return this._network;
+  }
+
+  /**
+   * Get extended public key (xpub/ypub/zpub) for account
+   */
+  async getExtendedPublicKey(): Promise<string> {
+    try {
+      const trezor = await this.initTrezorConnect();
+
+      const coinType = this._network === 'mainnet' ? 0 : 1;
+      const purpose = ADDRESS_TYPE_TO_PATH[this._options.addressType];
+      const accountPath = `m/${purpose}'/${coinType}'/${this._options.accountIndex}'`;
+
+      const result = await trezor.getPublicKey({
+        path: accountPath,
+        coin: this._network === 'mainnet' ? 'btc' : 'test',
+      });
+
+      if (!result.success) {
+        const error = result.payload as { error: string };
+        throw new Error(error.error);
+      }
+
+      const payload = result.payload as { xpub: string };
+      return payload.xpub;
+    } catch (error) {
+      this.handleTrezorError(error);
+    }
+  }
+
+  /**
+   * Get multiple addresses for the account
+   *
+   * This method only calls getPublicKey() for each address and derives
+   * addresses locally to minimize Trezor popup interactions.
+   */
+  async getAddresses(startIndex: number, count: number): Promise<WalletAccount[]> {
+    const trezor = await this.initTrezorConnect();
+    const accounts: WalletAccount[] = [];
+    const coin = this._network === 'mainnet' ? 'btc' : 'test';
+    const addressType = this.mapTrezorAddressType(this._options.addressType);
+
+    for (let i = startIndex; i < startIndex + count; i++) {
+      const path = this.buildDerivationPath(
+        this._options.addressType,
+        this._network,
+        this._options.accountIndex,
+        i
+      );
+
+      const isLast = i === startIndex + count - 1;
+
+      // Only get public key - address will be derived locally
+      const pubKeyResult = await trezor.getPublicKey({
+        path,
+        coin,
+        suppressBackupWarning: true,
+        keepSession: !isLast, // Close session on last iteration
+      });
+
+      if (!pubKeyResult.success) {
+        continue;
+      }
+
+      const pubKeyPayload = pubKeyResult.payload as { publicKey: string };
+
+      // Derive address from public key locally
+      const address = deriveAddressFromPublicKey(
+        pubKeyPayload.publicKey,
+        addressType,
+        this._network
+      );
+
+      accounts.push({
+        address,
+        publicKey: pubKeyPayload.publicKey,
+        type: addressType,
+      });
+    }
+
+    return accounts;
+  }
+
+  /**
+   * Get current derivation path
+   */
+  getDerivationPath(): string {
+    return this._derivationPath;
+  }
+
+  /**
+   * Check if device is connected
+   */
+  isConnected(): boolean {
+    return this._account !== null && this._initialized;
+  }
+
+  private mapTrezorAddressType(addressType: TrezorAddressType): AddressType {
+    switch (addressType) {
+      case 'legacy':
+        return 'legacy';
+      case 'nested-segwit':
+        return 'nested-segwit';
+      case 'segwit':
+        return 'segwit';
+      case 'taproot':
+        return 'taproot';
+      default:
+        return 'segwit';
+    }
+  }
+
+  private handleTrezorError(error: unknown): never {
+    if (error instanceof Error) {
+      const message = error.message.toLowerCase();
+
+      if (message.includes('cancelled') || message.includes('canceled')) {
+        throw new Error('User cancelled the operation on Trezor device.');
+      }
+
+      if (message.includes('device disconnected')) {
+        throw new Error('Trezor device disconnected. Please reconnect and try again.');
+      }
+
+      if (message.includes('permissions')) {
+        throw new Error('Permission denied. Please allow access to your Trezor device.');
+      }
+
+      if (message.includes('popup')) {
+        throw new Error('Trezor popup was closed. Please try again.');
+      }
+
+      if (message.includes('device not found')) {
+        throw new Error('No Trezor device found. Please connect your device and try again.');
+      }
+    }
+
+    this.handleError(error);
+  }
+}