@onekeyfe/hd-core 1.2.0-alpha.136 → 1.2.0-alpha.140

package/__tests__/DeviceCommands.test.ts

@@ -485,7 +485,7 @@ describe('DeviceCommands failure mapping', () => {
     });
   });
 
-  it.each(['Cancelled on device', 'Confirm dismissed'])(
+  it.each(['Cancelled on device', 'Confirm dismissed', 'Update cancelled'])(
     'maps legacy Protocol V2 cancellation message "%s" without a subcode',
     async message => {
       const commands = createCommands();

package/__tests__/check-all-firmware-release-protocol-v2.test.ts

@@ -620,6 +620,54 @@ describe('checkAllFirmwareRelease Protocol V2 support', () => {
     });
   });
 
+  test('selects the Protocol V2 resource archive using the DeviceState identity', async () => {
+    const releaseWithResources: IFirmwareReleaseInfo = {
+      ...release,
+      resources: { source: resourceSource },
+    };
+    const method = new CheckAllFirmwareRelease({
+      id: 1,
+      payload: {
+        method: 'checkAllFirmwareRelease',
+        platform: 'desktop',
+        protocolV2ForceUpdateTargets: ['resource'],
+      },
+    });
+    method.init();
+    method.device = {
+      isProtocolV2: () => true,
+      features: {
+        firmwareVersion: '1.0.0',
+        serialNo: 'device-without-model-prefix',
+      },
+      getDeviceState: jest.fn().mockResolvedValue({
+        identity: { deviceType: 'pro2', firmwareType: EFirmwareType.Universal },
+        status: { mode: 'normal' },
+        versions: currentVersions,
+      }),
+    } as unknown as CheckAllFirmwareRelease['device'];
+    const getLatestReleaseSpy = jest
+      .spyOn(DataManager, 'getFirmwareLatestRelease')
+      .mockImplementation(features =>
+        features.deviceType === 'pro2' ? releaseWithResources : undefined
+      );
+
+    await expect(method.run()).resolves.toMatchObject({
+      deviceType: 'pro2',
+      resourceArchive: resourceSource,
+      targetsToUpdate: expect.arrayContaining(['resource']),
+      firmwareUpdatePlan: {
+        executor: 'v4',
+        deviceModel: 'pro2',
+        targetsToUpdate: expect.arrayContaining(['resource']),
+      },
+    });
+    expect(getLatestReleaseSpy).toHaveBeenCalledWith(
+      expect.objectContaining({ deviceType: 'pro2' }),
+      EFirmwareType.Universal
+    );
+  });
+
   test.each(['resource', 'boot_resources'] as const)(
     'allows an explicitly forced Protocol V2 resource-only target through %s',
     async forceTarget => {

package/__tests__/device-lifecycle-events.test.ts

@@ -343,25 +343,29 @@ describe('public device lifecycle events', () => {
     }
   );
 
-  test('sends a fallback Cancel for an acquired Protocol V2 BLE call without a prompt callback', async () => {
-    jest.spyOn(DataManager, 'getSettings').mockReturnValue('react-native' as never);
-    const device = createInitializedDevice('V2');
-    const post = jest.fn().mockResolvedValue(undefined);
-    const cancelDevice = jest.fn(() => cancelDeviceInPrompt(device, false));
-    const cancel = jest.fn().mockResolvedValue(undefined);
-    (device as unknown as { deviceAcquired: boolean }).deviceAcquired = true;
-    device.commands = {
-      transport: { post },
-      cancelDevice,
-      cancel,
-    } as never;
+  test.each(['react-native', 'webusb', 'desktop-webusb'] as const)(
+    'sends a fallback Cancel for an acquired Protocol V2 %s call without a prompt callback',
+    async env => {
+      jest.spyOn(DataManager, 'getSettings').mockReturnValue(env as never);
+      const device = createInitializedDevice('V2');
+      const post = jest.fn().mockResolvedValue(undefined);
+      const cancelDevice = jest.fn(() => cancelDeviceInPrompt(device, false));
+      const cancel = jest.fn().mockResolvedValue(undefined);
+      device.originalDescriptor.session = device.mainId;
+      (device as unknown as { deviceAcquired: boolean }).deviceAcquired = true;
+      device.commands = {
+        transport: { post },
+        cancelDevice,
+        cancel,
+      } as never;
 
-    await device.interruptionFromUser();
+      await device.interruptionFromUser();
 
-    expect(cancelDevice).toHaveBeenCalledTimes(1);
-    expect(post).toHaveBeenCalledWith(device.mainId, 'Cancel', {});
-    expect(cancel).toHaveBeenCalledTimes(1);
-  });
+      expect(cancelDevice).toHaveBeenCalledTimes(1);
+      expect(post).toHaveBeenCalledWith(device.mainId, 'Cancel', {});
+      expect(cancel).toHaveBeenCalledTimes(1);
+    }
+  );
 
   test('waits for the canceled run to finish releasing before cancellation completes', async () => {
     jest.spyOn(DataManager, 'getSettings').mockReturnValue('react-native' as never);

package/__tests__/device-settings.test.ts

@@ -361,7 +361,7 @@ describe('DeviceSettings protocol routing', () => {
     expect(getDeviceState).toHaveBeenCalledWith({ refreshSections: ['settings'] });
   });
 
-  it('does not overwrite Pro2 passphrase state when refreshed state does not match', async () => {
+  it('persists a confirmed Pro2 passphrase enable when the refreshed state is unavailable', async () => {
     const { device, getDeviceState, updateState } = createDevice({ protocol: 'V2' });
     getDeviceState.mockResolvedValue({
       status: { passphraseProtection: false },
@@ -377,10 +377,13 @@ describe('DeviceSettings protocol routing', () => {
     (method as any).device = device;
 
     await expect(method.run()).resolves.toEqual({ message: 'Success' });
-    expect(updateState).not.toHaveBeenCalled();
+    expect(updateState).toHaveBeenCalledWith(
+      { status: { passphraseProtection: true } },
+      'settings-write'
+    );
   });
 
-  it('keeps the previous Pro2 passphrase state when refreshed state is unavailable after locking', async () => {
+  it('persists a confirmed Pro2 passphrase disable when refreshed state is unavailable after locking', async () => {
     const { device, getDeviceState, updateState } = createDevice({ protocol: 'V2' });
     getDeviceState
       .mockResolvedValueOnce({
@@ -400,10 +403,18 @@ describe('DeviceSettings protocol routing', () => {
     (method as any).device = device;
 
     await expect(method.run()).resolves.toEqual({ message: 'Success' });
-    expect(updateState).not.toHaveBeenCalled();
+    expect(updateState).toHaveBeenCalledWith(
+      {
+        status: {
+          passphraseProtection: false,
+          unlockedAttachPin: false,
+        },
+      },
+      'settings-write'
+    );
   });
 
-  it('preserves confirmed Pro2 passphrase state when the post-toggle status is locked', async () => {
+  it('persists a confirmed Pro2 passphrase disable when the Attach PIN session locks', async () => {
     let statusReadCount = 0;
     const typedCall = jest.fn().mockImplementation((requestType: string) => {
       if (requestType === 'DeviceStatusGet') {
@@ -411,8 +422,13 @@ describe('DeviceSettings protocol routing', () => {
         return {
           message:
             statusReadCount === 1
-              ? { init_states: true, unlocked: true, passphrase_enabled: true }
-              : { init_states: true, unlocked: false, passphrase_enabled: false },
+              ? {
+                  init_states: true,
+                  unlocked: true,
+                  passphrase_enabled: true,
+                  unlocked_by_attach_to_pin: true,
+                }
+              : { init_states: true, unlocked: false },
         };
       }
       if (requestType === 'DeviceSettingsPageShow') {
@@ -437,6 +453,7 @@ describe('DeviceSettings protocol routing', () => {
           mode: 'normal',
           unlocked: true,
           passphraseProtection: true,
+          unlockedAttachPin: true,
         },
         raw: {
           protocolV2ProtocolInfo: {
@@ -456,12 +473,31 @@ describe('DeviceSettings protocol routing', () => {
     });
     method.init();
     (method as any).device = device;
+    const onState = jest.fn();
+    device.on(DEVICE.STATE, onState);
 
     await expect(method.run()).resolves.toEqual({ message: 'Success' });
     expect(device.state?.status).toMatchObject({
       unlocked: false,
-      passphraseProtection: true,
+      passphraseProtection: false,
+      unlockedAttachPin: false,
     });
+    expect(onState).toHaveBeenCalledWith(
+      device,
+      expect.objectContaining({
+        source: 'settings-write',
+        changedKeys: expect.arrayContaining([
+          'status.passphraseProtection',
+          'status.unlockedAttachPin',
+        ]),
+        state: expect.objectContaining({
+          status: expect.objectContaining({
+            passphraseProtection: false,
+            unlockedAttachPin: false,
+          }),
+        }),
+      })
+    );
   });
 
   it('keeps Protocol V1 passphrase settings on ApplySettings', async () => {

package/__tests__/device-state-mapper.test.ts

@@ -250,6 +250,8 @@ describe('DeviceStateMapper', () => {
       init_states: true,
       unlocked: false,
       passphrase_enabled: true,
+      attach_to_pin_enabled: true,
+      unlocked_by_attach_to_pin: true,
       backup_required: true,
     } as DeviceStatus);
 
@@ -261,6 +263,26 @@ describe('DeviceStateMapper', () => {
       backupRequired: true,
     });
     expect(locked.status).not.toHaveProperty('passphraseProtection');
+    expect(locked.status).not.toHaveProperty('attachToPinEnabled');
+    expect(locked.status).not.toHaveProperty('unlockedAttachPin');
+  });
+
+  test('omits an unavailable attach-to-PIN status after an unlocked query failure', () => {
+    const status = mapProtocolV2DeviceStatusToState({
+      init_states: true,
+      unlocked: true,
+      passphrase_enabled: true,
+      attach_to_pin_enabled: null,
+      unlocked_by_attach_to_pin: false,
+      backup_required: false,
+    } as DeviceStatus);
+
+    expect(status.status).toMatchObject({
+      unlocked: true,
+      passphraseProtection: true,
+      unlockedAttachPin: false,
+    });
+    expect(status.status).not.toHaveProperty('attachToPinEnabled');
   });
 
   test('maps common settings into identity, status and settings sections', () => {
@@ -288,10 +310,26 @@ describe('DeviceStateMapper', () => {
         language: 'en-Latn-US',
         brightness: 80,
         autolock_delay_ms: 30_000,
+        passphrase_enable: null,
       } as DeviceSettings)
     ).toEqual({
       identity: { label: 'Pro2' },
       settings: { language: 'en', brightness: 80, autoLockDelayMs: 30_000 },
     });
   });
+
+  test('omits private Protocol V2 settings that are unavailable while locked', () => {
+    expect(
+      mapDeviceSettingsToState({
+        brightness: 80,
+        passphrase_enable: null,
+        fido_enabled: null,
+        autolock_delay_ms: null,
+        autoshutdown_delay_ms: null,
+        label: null,
+      } as DeviceSettings)
+    ).toEqual({
+      settings: { brightness: 80 },
+    });
+  });
 });

package/__tests__/device-wallet-session-store.test.ts

@@ -352,7 +352,7 @@ describe('Protocol V1 wallet identity initialization', () => {
     jest.restoreAllMocks();
   });
 
-  test('purges cached sessions and rejects when the live device identity changes', async () => {
+  test('verifies the live device id without resetting the cached wallet session', async () => {
     const device = Device.fromDescriptor({ id: 'connect-b', path: 'connect-b' } as never);
     device.features = {
       protocol: 'V1',
@@ -363,7 +363,7 @@ describe('Protocol V1 wallet identity initialization', () => {
     deviceWalletSessionStore.set('cached-device-a', 'hidden-a', 'session-a');
     const typedCall = jest.fn().mockResolvedValue({
       type: 'Features',
-      message: { device_id: 'live-device-b', session_id: 'wrong-device-session' },
+      message: { device_id: 'live-device-b' },
     });
     device.commands = { typedCall } as never;
     jest.spyOn(TransportManager, 'reconfigure').mockResolvedValue(undefined);
@@ -371,76 +371,11 @@ describe('Protocol V1 wallet identity initialization', () => {
     await expect(
       device.initialize({ deviceId: 'cached-device-a', passphraseState: 'hidden-a' })
     ).rejects.toMatchObject({ errorCode: HardwareErrorCode.DeviceCheckDeviceIdError });
-    // Identity is validated from the single Initialize round trip; no separate
-    // GetFeatures preflight.
     expect(typedCall).toHaveBeenCalledTimes(1);
-    expect(typedCall).toHaveBeenCalledWith(
-      'Initialize',
-      'Features',
-      expect.objectContaining({ passphrase_state: 'hidden-a' }),
-      expect.any(Object)
-    );
-    // Identity change purges the previous device's cached sessions (pre-existing
-    // reconcileDeviceIdentity behavior — never carry sessions across devices)…
-    expect(deviceWalletSessionStore.get('cached-device-a', 'hidden-a')).toBeUndefined();
-    // …and the session the mismatched Initialize cached under the wrong
-    // device's identity is dropped as well.
-    expect(deviceWalletSessionStore.get('live-device-b', 'hidden-a')).toBeUndefined();
+    expect(typedCall).toHaveBeenCalledWith('GetFeatures', 'Features', {});
   });
 
-  test('drops the wrong-device session even when reconfigure fails after Initialize', async () => {
-    const device = Device.fromDescriptor({ id: 'connect-b', path: 'connect-b' } as never);
-    device.features = {
-      protocol: 'V1',
-      deviceId: 'cached-device-a',
-      unlocked: true,
-      passphraseProtection: true,
-    } as never;
-    deviceWalletSessionStore.set('cached-device-a', 'hidden-a', 'session-a');
-    const typedCall = jest.fn().mockResolvedValue({
-      type: 'Features',
-      message: { device_id: 'live-device-b', session_id: 'wrong-device-session' },
-    });
-    device.commands = { typedCall } as never;
-    // Pre-encode resync succeeds; the post-response reconfigure inside
-    // callInitialize rejects — the session write has already happened by then.
-    jest
-      .spyOn(TransportManager, 'reconfigure')
-      .mockResolvedValueOnce(undefined)
-      .mockRejectedValueOnce(new Error('configure failed'));
-
-    await expect(
-      device.initialize({ deviceId: 'cached-device-a', passphraseState: 'hidden-a' })
-    ).rejects.toMatchObject({ errorCode: HardwareErrorCode.DeviceCheckDeviceIdError });
-    // The wrong-device session must not survive the error path either.
-    expect(deviceWalletSessionStore.get('live-device-b', 'hidden-a')).toBeUndefined();
-  });
-
-  test('re-syncs the V1 message schema for this device before encoding Initialize', async () => {
-    const device = Device.fromDescriptor({ id: 'connect-a', path: 'connect-a' } as never);
-    device.features = {
-      protocol: 'V1',
-      deviceId: 'device-a',
-      unlocked: true,
-      passphraseProtection: true,
-    } as never;
-    const typedCall = jest.fn().mockResolvedValue({
-      type: 'Features',
-      message: { device_id: 'device-a' },
-    });
-    device.commands = { typedCall } as never;
-    const reconfigure = jest.spyOn(TransportManager, 'reconfigure').mockResolvedValue(undefined);
-
-    await device.initialize({ deviceId: 'device-a', passphraseState: 'hidden-a' });
-
-    // A stale process-global schema (from another device) would silently strip
-    // passphrase_state from the wire message, so the resync must come first.
-    expect(reconfigure.mock.invocationCallOrder[0]).toBeLessThan(
-      typedCall.mock.invocationCallOrder[0]
-    );
-  });
-
-  test('resumes a cached V1 wallet with a single identity-validated Initialize', async () => {
+  test('resumes a cached V1 wallet after a non-destructive live identity read', async () => {
     const device = Device.fromDescriptor({ id: 'connect-a', path: 'connect-a' } as never);
     device.features = {
       protocol: 'V1',
@@ -449,17 +384,22 @@ describe('Protocol V1 wallet identity initialization', () => {
       passphraseProtection: true,
     } as never;
     deviceWalletSessionStore.set('device-a', 'hidden-a', 'session-a');
-    const typedCall = jest.fn().mockResolvedValueOnce({
-      type: 'Features',
-      message: { device_id: 'device-a', session_id: 'session-a' },
-    });
+    const typedCall = jest
+      .fn()
+      .mockResolvedValueOnce({ type: 'Features', message: { device_id: 'device-a' } })
+      .mockResolvedValueOnce({
+        type: 'Features',
+        message: { device_id: 'device-a', session_id: 'session-a' },
+      });
     device.commands = { typedCall } as never;
     jest.spyOn(TransportManager, 'reconfigure').mockResolvedValue(undefined);
 
     await device.initialize({ deviceId: 'device-a', passphraseState: 'hidden-a' });
 
-    expect(typedCall).toHaveBeenCalledTimes(1);
-    expect(typedCall).toHaveBeenCalledWith(
+    expect(typedCall).toHaveBeenCalledTimes(2);
+    expect(typedCall).toHaveBeenNthCalledWith(1, 'GetFeatures', 'Features', {});
+    expect(typedCall).toHaveBeenNthCalledWith(
+      2,
       'Initialize',
       'Features',
       expect.objectContaining({
@@ -468,10 +408,9 @@ describe('Protocol V1 wallet identity initialization', () => {
       }),
       expect.any(Object)
     );
-    expect(deviceWalletSessionStore.get('device-a', 'hidden-a')).toBe('session-a');
   });
 
-  test('selects the standard V1 wallet with a single identity-validated Initialize', async () => {
+  test('selects the standard V1 wallet after a non-destructive live identity read', async () => {
     const device = Device.fromDescriptor({ id: 'connect-a', path: 'connect-a' } as never);
     device.features = {
       protocol: 'V1',
@@ -481,14 +420,17 @@ describe('Protocol V1 wallet identity initialization', () => {
     } as never;
     const typedCall = jest
       .fn()
+      .mockResolvedValueOnce({ type: 'Features', message: { device_id: 'device-a' } })
       .mockResolvedValueOnce({ type: 'Features', message: { device_id: 'device-a' } });
     device.commands = { typedCall } as never;
     jest.spyOn(TransportManager, 'reconfigure').mockResolvedValue(undefined);
 
     await device.initialize({ deviceId: 'device-a' });
 
-    expect(typedCall).toHaveBeenCalledTimes(1);
-    expect(typedCall).toHaveBeenCalledWith(
+    expect(typedCall).toHaveBeenCalledTimes(2);
+    expect(typedCall).toHaveBeenNthCalledWith(1, 'GetFeatures', 'Features', {});
+    expect(typedCall).toHaveBeenNthCalledWith(
+      2,
       'Initialize',
       'Features',
       {

package/__tests__/firmware-update/firmware-update-v4-install-poll.test.ts

@@ -1,4 +1,4 @@
-import { HardwareErrorCode } from '@onekeyfe/hd-shared';
+import { ERRORS, HardwareErrorCode } from '@onekeyfe/hd-shared';
 
 import FirmwareUpdateV4 from '../../src/api/FirmwareUpdateV4';
 
@@ -127,4 +127,40 @@ describe('FirmwareUpdateV4 install polling', () => {
       errorCode: HardwareErrorCode.CallQueueActionCancelled,
     });
   });
+
+  test('stops polling when the device cancels firmware installation', async () => {
+    const method = new FirmwareUpdateV4({
+      id: 1,
+      payload: {
+        method: 'firmwareUpdateV4',
+        connectId: 'pro2-ble',
+      },
+    });
+    const typedCall = jest
+      .fn()
+      .mockRejectedValue(ERRORS.TypedError(HardwareErrorCode.ActionCancelled));
+    const reconnectProtocolV2Device = jest.fn().mockResolvedValue(undefined);
+
+    method.device = {
+      getCommands: () => ({ typedCall }),
+    } as unknown as Device;
+    const firmwareUpdate = method as unknown as {
+      waitForProtocolV2FirmwareUpdateComplete: (
+        targets: Array<{ target_id: number; path: string }>
+      ) => Promise<void>;
+      reconnectProtocolV2Device: () => Promise<void>;
+    };
+    firmwareUpdate.reconnectProtocolV2Device = reconnectProtocolV2Device;
+
+    await expect(
+      firmwareUpdate.waitForProtocolV2FirmwareUpdateComplete([
+        { target_id: 4, path: 'vol0:/application_p1.bin' },
+      ])
+    ).rejects.toMatchObject({
+      errorCode: HardwareErrorCode.ActionCancelled,
+    });
+
+    expect(typedCall).toHaveBeenCalledTimes(1);
+    expect(reconnectProtocolV2Device).not.toHaveBeenCalled();
+  });
 });

package/__tests__/protocol-v2-unlock-policy.test.ts

@@ -1,9 +1,14 @@
-import { DeviceSessionPinType } from '@onekeyfe/hd-transport';
+import TransportUtils, { DeviceSessionPinType } from '@onekeyfe/hd-transport';
 
 import ConfluxSignMessageCIP23 from '../src/api/conflux/ConfluxSignMessageCIP23';
+import DeviceChangePin from '../src/api/device/DeviceChangePin';
 import DeviceLock from '../src/api/device/DeviceLock';
 import DeviceSettings from '../src/api/device/DeviceSettings';
+import DeviceVerify from '../src/api/device/DeviceVerify';
+import DeviceWipe from '../src/api/device/DeviceWipe';
+import FirmwareUpdateV4 from '../src/api/FirmwareUpdateV4';
 import OpenWalletSession from '../src/api/OpenWalletSession';
+import DataManager from '../src/data-manager/DataManager';
 import { runMethodWithUnlockPolicy } from '../src/protocols/protocol-v2/unlockPolicyRunner';
 
 jest.mock('../src/data/config', () => ({
@@ -12,6 +17,42 @@ jest.mock('../src/data/config', () => ({
 }));
 
 describe('Protocol V2 unlock semantics', () => {
+  test('serializes genuine-device verification with Protocol V2 certificate messages', async () => {
+    const method = new DeviceVerify({
+      id: 1,
+      payload: { method: 'deviceVerify', dataHex: 'aabb' },
+    });
+    method.init();
+    const protocolV2Messages = TransportUtils.parseConfigure(
+      DataManager.getProtobufMessages('v2Schema')
+    );
+    const typedCall = jest.fn(
+      (requestType: string, responseType: string, payload: Record<string, unknown> = {}) => {
+        const request = TransportUtils.createMessageFromName(protocolV2Messages, requestType);
+        request.Message.encode(request.Message.create(payload)).finish();
+        TransportUtils.createMessageFromName(protocolV2Messages, responseType);
+        if (requestType === 'DeviceCertificateSign') {
+          return Promise.resolve({ message: { data: 'signature' } });
+        }
+        return Promise.resolve({ message: { cert_and_pubkey: 'certificate' } });
+      }
+    );
+    method.device = {
+      getCurrentDeviceType: () => 'pro2',
+      isProtocolV2: () => true,
+      commands: { typedCall },
+    } as any;
+
+    await expect(method.run()).resolves.toEqual({
+      cert: 'certificate',
+      signature: 'signature',
+    });
+    expect(typedCall.mock.calls.map(call => call.slice(0, 2))).toEqual([
+      ['DeviceCertificateSign', 'DeviceCertificateSignature'],
+      ['DeviceCertificateRead', 'DeviceCertificate'],
+    ]);
+  });
+
   test('wallet business methods inherit the wallet-session unlock requirement', () => {
     const method = new ConfluxSignMessageCIP23({
       id: 1,
@@ -191,6 +232,61 @@ describe('Protocol V2 unlock semantics', () => {
     expect(device.unlockDevice).toHaveBeenCalledWith(DeviceSessionPinType.Any, expect.any(Object));
   });
 
+  test.each([
+    [
+      'PIN changes',
+      () =>
+        new DeviceChangePin({
+          id: 1,
+          payload: { method: 'deviceChangePin', remove: false },
+        }),
+    ],
+    ['device wipe', () => new DeviceWipe({ id: 1, payload: { method: 'deviceWipe' } })],
+    [
+      'firmware updates',
+      () =>
+        new FirmwareUpdateV4({
+          id: 1,
+          payload: { method: 'firmwareUpdateV4', platform: 'desktop' } as any,
+        }),
+    ],
+    [
+      'genuine-device verification',
+      () =>
+        new DeviceVerify({
+          id: 1,
+          payload: { method: 'deviceVerify', dataHex: '00' },
+        }),
+    ],
+  ])('allows either PIN type when pre-unlocking %s', async (_name, createMethod) => {
+    const method = createMethod();
+    method.init();
+    const features = { unlocked: false };
+    const device = {
+      features,
+      commands: {
+        typedCall: jest.fn().mockResolvedValue({ message: { unlocked: false } }),
+      },
+      isProtocolV2: () => true,
+      isBootloader: () => false,
+      isRomloader: () => false,
+      updateProtocolV2Status: jest.fn(() => features),
+      unlockDevice: jest.fn().mockImplementation(() => {
+        features.unlocked = true;
+        return Promise.resolve(features);
+      }),
+    };
+    method.run = jest.fn().mockResolvedValue({ message: 'ok' });
+
+    await expect(runMethodWithUnlockPolicy(method, device as any)).resolves.toEqual({
+      message: 'ok',
+    });
+
+    expect(method.unlockPolicy).toBe('unlock-before-run');
+    expect(method.getSupportedProtocols()).toContain('V2');
+    expect(device.unlockDevice).toHaveBeenCalledWith(DeviceSessionPinType.Any, expect.any(Object));
+  });
+
   test('pre-unlocks a locked standard wallet before wallet-session preparation', async () => {
     const calls: string[] = [];
     const features = {