@onekeyfe/hd-core 1.2.0-alpha.145 → 1.2.0-alpha.147

package/dist/index.js

@@ -466,13 +466,10 @@ const getDeviceTypeByBleName = (name) => {
         return hdShared.EDeviceType.Touch;
     if (/^Touch/i.test(name))
         return hdShared.EDeviceType.Touch;
-    const compactName = name.replace(/[\s-]/g, '');
-    if (/\bPro\s*2\b/i.test(name) || /^Pro2/i.test(name) || /^(?:OneKey)?Pro2/i.test(compactName)) {
+    if (/\bPro\s*2\b/i.test(name) || /^Pro2/i.test(name))
         return hdShared.EDeviceType.Pro2;
-    }
-    if (/\bNeo\b/i.test(name) || /^Neo/i.test(name) || /^(?:OneKey)?Neo/i.test(compactName)) {
+    if (/\bNeo\b/i.test(name) || /^Neo/i.test(name))
         return hdShared.EDeviceType.Neo;
-    }
     if (/\bPro\b/i.test(name) || /^Pro/i.test(name))
         return hdShared.EDeviceType.Pro;
     return hdShared.EDeviceType.Unknown;
@@ -40678,16 +40675,18 @@ const findLatestRelease = (releases) => {
     return leastRelease;
 };
 
-const PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_PATH = 'vol0:/loaders/bootloader/boot_resource.okpkg';
-const PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_STAGING_PATH = `${PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_PATH}.staging`;
-const PROTOCOL_V2_RESOURCE_PACKAGE_HEADER_SIZE = 0x5f90;
-const PROTOCOL_V2_RESOURCE_PACKAGE_HEADER_VERSION = 1;
-const PROTOCOL_V2_RESOURCE_PACKAGE_FLEXIBLE_OFFSET = 0x6c;
-const PROTOCOL_V2_RESOURCE_PACKAGE_FLEXIBLE_SIZE = 64;
-const PROTOCOL_V2_RESOURCE_PACKAGE_PAYLOAD_HASH_OFFSET = 0x200;
-const PROTOCOL_V2_RESOURCE_PACKAGE_HEADER_HASH_OFFSET = 0x240;
-const PROTOCOL_V2_RESOURCE_PACKAGE_HASH_SIZE = 64;
-const PROTOCOL_V2_RESOURCE_PACKAGE_TYPE = 'RESC';
+const PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_PATH$1 = 'vol0:/loaders/bootloader/boot_resource.okpkg';
+const SHA256_HEX_LENGTH = 64;
+function normalizeHex$1(value, expectedLength, field) {
+    if (typeof value !== 'string') {
+        throw new Error(`Invalid Pro2 resource ${field}: expected a hexadecimal string`);
+    }
+    const normalized = value.replace(/^0x/i, '').toLowerCase();
+    if (normalized.length !== expectedLength || !/^[0-9a-f]+$/.test(normalized)) {
+        throw new Error(`Invalid Pro2 resource ${field}: expected ${expectedLength} hexadecimal characters`);
+    }
+    return normalized;
+}
 function parseProtocolV2Resources(value) {
     if (value === undefined)
         return undefined;
@@ -40716,75 +40715,86 @@ function parseProtocolV2Resources(value) {
         },
     };
 }
-const PROTOCOL_V2_RESOURCE_DEVICE_ROOTS = ['vol0:/bundles/', 'vol0:/loaders/rom/'];
-function isAllowedResourceDevicePath(path) {
-    if (path.includes('\\') ||
+const PROTOCOL_V2_RESOURCE_MANIFEST_DEVICE_ROOTS = [
+    'vol0:/bundles/',
+    'vol0:/loaders/rom/',
+];
+function isAllowedManifestDevicePath(path) {
+    if (!path.endsWith('.okpkg') ||
+        path.includes('\\') ||
         path.includes('//') ||
-        [...path].some(char => {
-            const code = char.charCodeAt(0);
-            return code <= 0x1f || code === 0x7f;
-        }) ||
         path.split('/').some(part => part === '.' || part === '..')) {
         return false;
     }
-    if (path === PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_STAGING_PATH) {
+    if (path === PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_PATH$1) {
         return true;
     }
-    return (path.endsWith('.okpkg') && PROTOCOL_V2_RESOURCE_DEVICE_ROOTS.some(root => path.startsWith(root)));
+    return PROTOCOL_V2_RESOURCE_MANIFEST_DEVICE_ROOTS.some(root => path.startsWith(root));
 }
-function readAscii(bytes, offset, length) {
-    return Array.from(bytes.slice(offset, offset + length))
-        .map(byte => String.fromCharCode(byte))
-        .join('');
+function assertManifestString(value, field) {
+    if (typeof value !== 'string' || value.length === 0) {
+        throw new Error(`Invalid Pro2 resource manifest ${field}`);
+    }
+    return value;
 }
-function readResourceDevicePath(bytes) {
-    const metadata = bytes.slice(PROTOCOL_V2_RESOURCE_PACKAGE_FLEXIBLE_OFFSET, PROTOCOL_V2_RESOURCE_PACKAGE_FLEXIBLE_OFFSET + PROTOCOL_V2_RESOURCE_PACKAGE_FLEXIBLE_SIZE);
-    const terminator = metadata.indexOf(0);
-    const pathBytes = terminator === -1 ? metadata : metadata.slice(0, terminator);
-    const padding = terminator === -1 ? new Uint8Array(0) : metadata.slice(terminator);
-    if (pathBytes.byteLength === 0 ||
-        Array.from(pathBytes).some(byte => byte < 0x20 || byte > 0x7e) ||
-        Array.from(padding).some(byte => byte !== 0)) {
-        throw new Error('Invalid Pro2 RESOURCE package device path metadata');
-    }
-    const path = readAscii(pathBytes, 0, pathBytes.byteLength);
-    if (!isAllowedResourceDevicePath(path)) {
-        throw new Error(`Invalid Pro2 RESOURCE package device path: ${path}`);
+function assertManifestRelativePath(value, field) {
+    const path = assertManifestString(value, field);
+    if (path.startsWith('/') ||
+        path.includes('\\') ||
+        path.includes(':') ||
+        path.split('/').some(part => !part || part === '.' || part === '..')) {
+        throw new Error(`Invalid Pro2 resource manifest ${field}`);
     }
     return path;
 }
-function parseProtocolV2ResourcePackageHeader(bytes, packageSize) {
-    if (bytes.byteLength < PROTOCOL_V2_RESOURCE_PACKAGE_HEADER_SIZE) {
-        throw new Error('Pro2 RESOURCE package is shorter than its header');
+function parseProtocolV2ResourceManifestFile(value, index) {
+    var _a;
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error(`Invalid Pro2 resource manifest files[${index}]`);
+    }
+    const file = value;
+    const archivePath = assertManifestRelativePath(file.archive_path, `files[${index}].archive_path`);
+    const originalName = file.original_name === undefined
+        ? (_a = archivePath.split('/').pop()) !== null && _a !== void 0 ? _a : archivePath
+        : assertManifestRelativePath(file.original_name, `files[${index}].original_name`);
+    if (originalName.includes('/')) {
+        throw new Error(`Invalid Pro2 resource manifest files[${index}].original_name`);
+    }
+    const devicePath = assertManifestString(file.device_path, `files[${index}].device_path`);
+    if (!isAllowedManifestDevicePath(devicePath)) {
+        throw new Error(`Invalid Pro2 resource manifest files[${index}].device_path`);
+    }
+    if (!Number.isSafeInteger(file.size) || Number(file.size) <= 0) {
+        throw new Error(`Invalid Pro2 resource manifest files[${index}].size`);
+    }
+    const digest = normalizeHex$1(file.sha256, SHA256_HEX_LENGTH, `files[${index}].sha256`);
+    if (!archivePath.endsWith('.okpkg') || !originalName.endsWith('.okpkg')) {
+        throw new Error(`Invalid Pro2 resource manifest files[${index}] package extension`);
+    }
+    return Object.assign(Object.assign(Object.assign({ archive_path: archivePath, original_name: originalName, device_path: devicePath, size: Number(file.size), sha256: digest }, (file.signed === undefined ? {} : { signed: file.signed })), (file.sig_algo === undefined ? {} : { sig_algo: file.sig_algo })), (file.payload_version === undefined ? {} : { payload_version: file.payload_version }));
+}
+function parseProtocolV2ResourceManifest(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error('Invalid Pro2 resource manifest');
     }
-    const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
-    const headerVersion = view.getUint32(0x04, true);
-    const headerLength = view.getUint32(0x0c, true);
-    const payloadLength = view.getUint32(0x14, true);
-    if (readAscii(bytes, 0, 4) !== 'OKPP' ||
-        readAscii(bytes, 0x08, 4) !== PROTOCOL_V2_RESOURCE_PACKAGE_TYPE ||
-        headerVersion !== PROTOCOL_V2_RESOURCE_PACKAGE_HEADER_VERSION ||
-        headerLength !== PROTOCOL_V2_RESOURCE_PACKAGE_HEADER_SIZE ||
-        payloadLength <= 0 ||
-        headerLength + payloadLength !== packageSize) {
-        throw new Error('Invalid Pro2 RESOURCE package header');
+    const manifest = value;
+    if (!Array.isArray(manifest.files)) {
+        throw new Error('Invalid Pro2 resource manifest files');
+    }
+    const files = manifest.files.map(parseProtocolV2ResourceManifestFile);
+    const devicePaths = new Set(files.map(file => file.device_path));
+    const archivePaths = new Set(files.map(file => file.archive_path));
+    if (files.length === 0 ||
+        devicePaths.size !== files.length ||
+        archivePaths.size !== files.length) {
+        throw new Error('Invalid Pro2 resource manifest file set');
     }
-    const packedVersion = view.getUint32(0x10, true);
     return {
-        version: [
-            Math.floor(packedVersion / 0x10000) % 0x100,
-            Math.floor(packedVersion / 0x100) % 0x100,
-            packedVersion % 0x100,
-        ],
-        payloadLength,
-        devicePath: readResourceDevicePath(bytes),
-        payloadHash: utils.bytesToHex(bytes.slice(PROTOCOL_V2_RESOURCE_PACKAGE_PAYLOAD_HASH_OFFSET, PROTOCOL_V2_RESOURCE_PACKAGE_PAYLOAD_HASH_OFFSET + PROTOCOL_V2_RESOURCE_PACKAGE_HASH_SIZE)),
-        headerHash: utils.bytesToHex(bytes.slice(PROTOCOL_V2_RESOURCE_PACKAGE_HEADER_HASH_OFFSET, PROTOCOL_V2_RESOURCE_PACKAGE_HEADER_HASH_OFFSET + PROTOCOL_V2_RESOURCE_PACKAGE_HASH_SIZE)),
+        files,
     };
 }
-function parseProtocolV2ResourcePackage(binary) {
-    const bytes = binary instanceof Uint8Array ? binary : new Uint8Array(binary);
-    return parseProtocolV2ResourcePackageHeader(bytes, bytes.byteLength);
+function selectProtocolV2ResourceManifestFiles({ manifest, targetsToUpdate, }) {
+    return targetsToUpdate.includes('resource') ? [...manifest.files] : [];
 }
 
 var _a$1;
@@ -51761,8 +51771,17 @@ const PROTOCOL_V2_TRANSFER_PROGRESS_HEARTBEAT_MS = 1000;
 const PROTOCOL_V2_INSTALL_STATUS_CONFLICT_CODE = 'FirmwareInstallStatusConflict';
 const PROTOCOL_V2_INSTALL_FAILED_CODE = 'FirmwareInstallFailed';
 const PROTOCOL_V2_INSTALL_TIMEOUT_CODE = 'FirmwareInstallTimeout';
+const PROTOCOL_V2_OKPP_HEADER_SIZE = 0x52a0;
+const PROTOCOL_V2_OKPP_PAYLOAD_HASH_OFFSET = 0x200;
+const PROTOCOL_V2_OKPP_HEADER_HASH_OFFSET = 0x240;
+const PROTOCOL_V2_OKPP_HASH_SIZE = 64;
+const PROTOCOL_V2_RESOURCE_MANIFEST_MAX_BYTES = 1024 * 1024;
 const PROTOCOL_V2_RESOURCE_FILE_MAX_COUNT = 512;
 const PROTOCOL_V2_RESOURCE_TOTAL_MAX_BYTES = 256 * 1024 * 1024;
+const getProtocolV2LocalResourceArchivePath = (entryName) => {
+    const match = entryName.match(/(?:^|\/)((?:bundles\/|loaders\/(?:bootloader|rom)\/).+\.okpkg)$/iu);
+    return match === null || match === void 0 ? void 0 : match[1];
+};
 const PROTOCOL_V2_NEO_UNSUPPORTED_TARGETS = new Set(['se03', 'se04']);
 const getProtocolV2ZipEntrySizes = (entry) => {
     var _a;
@@ -51856,8 +51875,14 @@ const PROTOCOL_V2_REMOTE_COMPONENT_TARGETS = {
     },
 };
 const PROTOCOL_V2_FIRMWARE_STAGING_PATHS = new Set(Object.values(PROTOCOL_V2_REMOTE_COMPONENT_TARGETS).map(target => `${PROTOCOL_V2_FIRMWARE_STAGING_VOLUME}${target.fileName}`));
+const PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_PATH = 'vol0:/loaders/bootloader/boot_resource.okpkg';
+const PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_STAGING_PATH = `${PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_PATH}.staging`;
 const isProtocolV2BootResourcePackagePath = (devicePath) => typeof devicePath === 'string' &&
-    devicePath.toLowerCase() === PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_STAGING_PATH;
+    devicePath.replace(/^vol0:(?!\/)/i, 'vol0:/').toLowerCase() ===
+        PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_PATH;
+const resolveProtocolV2ResourceWritePath = (devicePath) => isProtocolV2BootResourcePackagePath(devicePath)
+    ? PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_STAGING_PATH
+    : devicePath;
 const PROTOCOL_V2_UPDATE_TARGET_BY_TARGET_ID = new Map([
     [ProtocolV2FirmwareTargetType.FW_MGMT_TARGET_BOOTLOADER, 'boot'],
     [ProtocolV2FirmwareTargetType.FW_MGMT_TARGET_APPLICATION_P1, 'app_v1'],
@@ -51983,6 +52008,30 @@ const toProtocolV2FiniteNumber = (value) => {
     }
     return undefined;
 };
+const readProtocolV2Ascii = (bytes, offset, length) => Array.from(bytes.slice(offset, offset + length))
+    .map(byte => String.fromCharCode(byte))
+    .join('');
+const parseProtocolV2OkppHeader = (bytes) => {
+    if (bytes.byteLength < PROTOCOL_V2_OKPP_HEADER_SIZE)
+        return null;
+    if (readProtocolV2Ascii(bytes, 0, 4) !== 'OKPP')
+        return null;
+    const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    const headerLen = view.getUint32(0x0c, true);
+    if (headerLen !== PROTOCOL_V2_OKPP_HEADER_SIZE)
+        return null;
+    const packedVersion = view.getUint32(0x10, true);
+    return {
+        type: readProtocolV2Ascii(bytes, 0x08, 4),
+        version: [
+            Math.floor(packedVersion / 0x10000) % 0x100,
+            Math.floor(packedVersion / 0x100) % 0x100,
+            packedVersion % 0x100,
+        ],
+        payloadHash: bytesToHex(bytes.slice(PROTOCOL_V2_OKPP_PAYLOAD_HASH_OFFSET, PROTOCOL_V2_OKPP_PAYLOAD_HASH_OFFSET + PROTOCOL_V2_OKPP_HASH_SIZE)),
+        headerHash: bytesToHex(bytes.slice(PROTOCOL_V2_OKPP_HEADER_HASH_OFFSET, PROTOCOL_V2_OKPP_HEADER_HASH_OFFSET + PROTOCOL_V2_OKPP_HASH_SIZE)),
+    };
+};
 const isProtocolV2FirmwareFingerprintValid = (binary, fingerprint) => {
     const expectedFingerprint = normalizeProtocolV2Hex(fingerprint);
     if (!expectedFingerprint)
@@ -52490,6 +52539,7 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
         });
     }
     prepareProtocolV2LocalResourceArchive(binary) {
+        var _a;
         return __awaiter(this, void 0, void 0, function* () {
             if (binary.byteLength <= 0 || binary.byteLength > PROTOCOL_V2_RESOURCE_TOTAL_MAX_BYTES) {
                 throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 local resource ZIP archive size is invalid', { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
@@ -52498,47 +52548,91 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
             try {
                 zip = yield JSZip__default["default"].loadAsync(binary);
             }
-            catch (_a) {
+            catch (_b) {
                 throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 resource ZIP cannot be parsed', { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
             }
             const zipEntries = Object.values(zip.files);
-            const resourceEntries = zipEntries.filter(entry => !entry.dir && entry.name.toLowerCase().endsWith('.okpkg'));
-            if (resourceEntries.length === 0 ||
-                resourceEntries.length > PROTOCOL_V2_RESOURCE_FILE_MAX_COUNT) {
-                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 resource ZIP has no valid resource package set', { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
-            }
-            let totalSize = 0;
-            const materializedEntries = [];
-            const resources = [];
-            const devicePaths = new Set();
-            for (const entry of resourceEntries) {
-                const { compressedSize, uncompressedSize } = getProtocolV2ZipEntrySizes(entry);
-                totalSize += uncompressedSize;
-                if (compressedSize > binary.byteLength ||
-                    uncompressedSize > PROTOCOL_V2_RESOURCE_TOTAL_MAX_BYTES ||
-                    totalSize > PROTOCOL_V2_RESOURCE_TOTAL_MAX_BYTES) {
-                    throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Protocol V2 resource package size is invalid: ${entry.name}`, { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
+            if (zipEntries.some(entry => entry.unsafeOriginalName && entry.unsafeOriginalName !== entry.name)) {
+                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 local resource ZIP contains an unsafe entry path', { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
+            }
+            const entries = zipEntries.filter(entry => !entry.dir);
+            if (entries.length === 0) {
+                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 local resource ZIP entry set is invalid', { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
+            }
+            const manifestEntry = entries.find(entry => entry.name.split('/').pop() === 'manifest.json');
+            let manifestBinary;
+            let manifestDirectory = '';
+            let selectedFiles;
+            if (manifestEntry) {
+                if (getProtocolV2ZipEntrySizes(manifestEntry).uncompressedSize >
+                    PROTOCOL_V2_RESOURCE_MANIFEST_MAX_BYTES) {
+                    throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 local resource manifest size is invalid', { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
                 }
-                const fileBinary = yield entry.async('arraybuffer');
-                if (fileBinary.byteLength !== uncompressedSize) {
-                    throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Protocol V2 resource package is incomplete: ${entry.name}`, { firmwareUpdateCode: 'FirmwareArtifactReceiptMismatch' });
+                manifestBinary = yield manifestEntry.async('arraybuffer');
+                if (manifestBinary.byteLength <= 0 ||
+                    manifestBinary.byteLength > PROTOCOL_V2_RESOURCE_MANIFEST_MAX_BYTES) {
+                    throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 local resource manifest size is invalid', { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
                 }
-                let header;
+                let manifestValue;
                 try {
-                    header = parseProtocolV2ResourcePackage(fileBinary);
+                    manifestValue = JSON.parse(new TextDecoder().decode(manifestBinary));
                 }
                 catch (error) {
-                    throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Protocol V2 resource package is invalid: ${entry.name}: ${String(error)}`, { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
+                    throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Protocol V2 local resource manifest is invalid: ${String(error)}`, { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
+                }
+                selectedFiles = selectProtocolV2ResourceManifestFiles({
+                    manifest: parseProtocolV2ResourceManifest(manifestValue),
+                    targetsToUpdate: (_a = this.params.targetsToUpdate) !== null && _a !== void 0 ? _a : [],
+                });
+                manifestDirectory = manifestEntry.name.slice(0, -'manifest.json'.length);
+            }
+            else {
+                selectedFiles = entries.flatMap(entry => {
+                    var _a;
+                    const archivePath = getProtocolV2LocalResourceArchivePath(entry.name);
+                    if (!archivePath)
+                        return [];
+                    return [
+                        {
+                            archive_path: archivePath,
+                            original_name: (_a = archivePath.split('/').pop()) !== null && _a !== void 0 ? _a : archivePath,
+                            device_path: `vol0:/${archivePath}`,
+                            size: getProtocolV2ZipEntrySizes(entry).uncompressedSize,
+                            sha256: '',
+                        },
+                    ];
+                });
+            }
+            if (selectedFiles.length === 0 || selectedFiles.length > PROTOCOL_V2_RESOURCE_FILE_MAX_COUNT) {
+                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 local resource ZIP has no resource packages', { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
+            }
+            let totalSize = 0;
+            const materializedEntries = [];
+            const normalizedFiles = [];
+            for (const file of selectedFiles) {
+                const entry = manifestEntry
+                    ? zip.file(`${manifestDirectory}${file.archive_path}`)
+                    : entries.find(candidate => getProtocolV2LocalResourceArchivePath(candidate.name) === file.archive_path);
+                if (!entry) {
+                    throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Protocol V2 local resource ZIP is missing ${file.archive_path}`, { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
+                }
+                const { uncompressedSize } = getProtocolV2ZipEntrySizes(entry);
+                totalSize += uncompressedSize;
+                if (uncompressedSize !== file.size || totalSize > PROTOCOL_V2_RESOURCE_TOTAL_MAX_BYTES) {
+                    throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Protocol V2 local resource file declared size is invalid: ${file.archive_path}`, { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
                 }
-                const canonicalDevicePath = header.devicePath.toLowerCase();
-                if (devicePaths.has(canonicalDevicePath)) {
-                    throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Protocol V2 resource ZIP contains duplicate device path: ${header.devicePath}`, { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
+                const fileBinary = yield entry.async('arraybuffer');
+                const digest = bytesToHex(sha256.sha256(new Uint8Array(fileBinary)));
+                if (fileBinary.byteLength !== file.size ||
+                    (file.sha256 && digest !== file.sha256.toLowerCase())) {
+                    throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Protocol V2 local resource file does not match manifest: ${file.archive_path}`, { firmwareUpdateCode: 'FirmwareArtifactReceiptMismatch' });
                 }
-                devicePaths.add(canonicalDevicePath);
-                materializedEntries.push({ entryName: entry.name, binary: fileBinary });
-                resources.push({ entryName: entry.name, binary: fileBinary, header });
+                normalizedFiles.push(Object.assign(Object.assign({}, file), { sha256: digest }));
+                materializedEntries.push({ entryName: file.archive_path, binary: fileBinary });
             }
-            return { binary, materializedEntries, resources };
+            manifestBinary !== null && manifestBinary !== void 0 ? manifestBinary : (manifestBinary = new TextEncoder().encode(JSON.stringify({ files: normalizedFiles })).buffer);
+            materializedEntries.unshift({ entryName: 'manifest.json', binary: manifestBinary });
+            return { binary, materializedEntries };
         });
     }
     prepareProtocolV2ResourceSources() {
@@ -52584,17 +52678,48 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
                 throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 prepared resource archive does not match its approved receipt', { firmwareUpdateCode: 'FirmwareArtifactReceiptMismatch' });
             }
             const verifiedArchive = yield this.prepareProtocolV2LocalResourceArchive(archiveBinary);
+            const verifiedEntriesByName = new Map(verifiedArchive.materializedEntries.map(entry => [entry.entryName, entry.binary]));
+            const manifestBinary = verifiedEntriesByName.get('manifest.json');
+            if (!manifestBinary) {
+                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 prepared resource archive has no valid manifest.json', { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
+            }
+            let manifestValue;
+            try {
+                manifestValue = JSON.parse(new TextDecoder().decode(manifestBinary));
+            }
+            catch (error) {
+                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Protocol V2 prepared resource manifest is invalid: ${String(error)}`, { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
+            }
+            const manifest = parseProtocolV2ResourceManifest(manifestValue);
+            const selectedFiles = selectProtocolV2ResourceManifestFiles({
+                manifest,
+                targetsToUpdate: (_c = this.params.targetsToUpdate) !== null && _c !== void 0 ? _c : [],
+            });
+            if (selectedFiles.length > PROTOCOL_V2_RESOURCE_FILE_MAX_COUNT) {
+                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 prepared resource archive contains too many files', { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
+            }
+            let totalSize = 0;
             const sources = [];
-            for (const resource of verifiedArchive.resources) {
-                const source = yield this.openProtocolV2MemorySource(resource.binary);
-                sources.push({
-                    name: (_c = resource.entryName.split('/').pop()) !== null && _c !== void 0 ? _c : resource.entryName,
-                    source,
-                    devicePath: resource.header.devicePath,
-                    version: resource.header.version,
-                    payloadHash: resource.header.payloadHash,
-                    headerHash: resource.header.headerHash,
-                });
+            for (const [index, file] of selectedFiles.entries()) {
+                const binary = verifiedEntriesByName.get(file.archive_path);
+                if (!binary || binary.byteLength !== file.size) {
+                    throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Protocol V2 prepared resource file does not match manifest: ${file.archive_path}`, { firmwareUpdateCode: 'FirmwareArtifactReceiptMismatch' });
+                }
+                totalSize += binary.byteLength;
+                if (totalSize > PROTOCOL_V2_RESOURCE_TOTAL_MAX_BYTES) {
+                    throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 prepared resource archive exceeds the total size limit', { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
+                }
+                const source = yield this.openProtocolV2MemorySource(binary);
+                const header = source.size >= PROTOCOL_V2_OKPP_HEADER_SIZE
+                    ? parseProtocolV2OkppHeader(new Uint8Array(yield source.readAt(0, PROTOCOL_V2_OKPP_HEADER_SIZE)))
+                    : null;
+                sources.push(Object.assign({ name: file.original_name || `resource-${index}`, source, devicePath: file.device_path }, (header
+                    ? {
+                        version: header.version,
+                        payloadHash: header.payloadHash,
+                        headerHash: header.headerHash,
+                    }
+                    : {})));
             }
             return sources;
         });
@@ -52976,15 +53101,15 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
             if (!((_b = pathInfoRes.message) === null || _b === void 0 ? void 0 : _b.exist) ||
                 ((_c = pathInfoRes.message) === null || _c === void 0 ? void 0 : _c.directory) ||
                 fileSize === undefined ||
-                fileSize < PROTOCOL_V2_RESOURCE_PACKAGE_HEADER_SIZE ||
+                fileSize < PROTOCOL_V2_OKPP_HEADER_SIZE ||
                 (expectedSize !== undefined && fileSize !== expectedSize)) {
                 return null;
             }
             const chunkSize = this.getProtocolV2FirmwareChunkSize('read');
             const chunks = [];
             let offset = 0;
-            while (offset < PROTOCOL_V2_RESOURCE_PACKAGE_HEADER_SIZE) {
-                const readLen = Math.min(chunkSize, PROTOCOL_V2_RESOURCE_PACKAGE_HEADER_SIZE - offset);
+            while (offset < PROTOCOL_V2_OKPP_HEADER_SIZE) {
+                const readLen = Math.min(chunkSize, PROTOCOL_V2_OKPP_HEADER_SIZE - offset);
                 const res = yield typedCall('FilesystemFileRead', 'FilesystemFile', {
                     file: {
                         path: filePath,
@@ -53006,12 +53131,7 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
                 headerBytes.set(chunk, cursor);
                 cursor += chunk.byteLength;
             });
-            try {
-                return parseProtocolV2ResourcePackageHeader(headerBytes, fileSize);
-            }
-            catch (_e) {
-                return null;
-            }
+            return parseProtocolV2OkppHeader(headerBytes);
         });
     }
     isProtocolV2ResourceBundleUpToDate(bundle) {
@@ -53237,7 +53357,7 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
             this.protocolV2LastTransferProgressAt = 0;
             let processedSize = 0;
             for (const resource of resourcesToSync) {
-                const writePath = resource.devicePath;
+                const writePath = resolveProtocolV2ResourceWritePath(resource.devicePath);
                 processedSize = yield this.protocolV2SourceUpdateProcess({
                     source: resource.source,
                     filePath: writePath,
@@ -53888,7 +54008,7 @@ class PromptWebDeviceAccess extends BaseMethod {
                     }
                     if (isWebUsbEnv) {
                         const usbDevice = device;
-                        const path = hdShared.resolveOneKeyUsbDevicePath(usbDevice);
+                        const path = usbDevice.serialNumber;
                         if (!path) {
                             throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.WebDevicePromptAccessError);
                         }
@@ -54326,8 +54446,7 @@ class DeviceUploadWallpaper extends BaseMethod {
         });
         this.path = `${WALLPAPER_DIRECTORY}/${normalizeFileName(fileName, this.encoded.data)}`;
         this.params = { jpegBase64, fileName, chunkSize };
-        this.unlockPolicy = 'unlock-before-run';
-        this.protocolV2PreUnlockPinType = hdTransport.DeviceSessionPinType.Any;
+        this.unlockPolicy = 'none';
         this.skipForceUpdateCheck = true;
         this.useDevicePassphraseState = false;
     }
@@ -54483,8 +54602,7 @@ class DeviceUploadNft extends BaseMethod {
             paceMs,
             timeoutMs,
         };
-        this.unlockPolicy = 'unlock-before-run';
-        this.protocolV2PreUnlockPinType = hdTransport.DeviceSessionPinType.Any;
+        this.unlockPolicy = 'none';
         this.skipForceUpdateCheck = true;
         this.useDevicePassphraseState = false;
     }
@@ -65164,6 +65282,7 @@ const onCallDevice = (context, message, method) => __awaiter(void 0, void 0, voi
     if ((_g = method.payload) === null || _g === void 0 ? void 0 : _g.onlyConnectBleDevice) {
         preWarmCallbackTask === null || preWarmCallbackTask === void 0 ? void 0 : preWarmCallbackTask.resolve();
         Log.debug('Call API - only connect ble device: ', device === null || device === void 0 ? void 0 : device.mainId);
+        requestQueue.releaseTask(method.responseID);
         return createResponseMessage(method.responseID, true, null);
     }
     Log.debug('Call API - setDevice: ', device.mainId);
@@ -65513,10 +65632,8 @@ function canSkipInitialize(method, device) {
     return true;
 }
 function isRetryableBleProtocolV2ProbeError(method, error) {
-    const typedError = error;
-    const message = typeof (typedError === null || typedError === void 0 ? void 0 : typedError.message) === 'string' ? typedError.message : String(error !== null && error !== void 0 ? error : '');
+    const message = error instanceof Error ? error.message : String(error !== null && error !== void 0 ? error : '');
     return (method.payload.connectProtocol === 'V2' &&
-        (typedError === null || typedError === void 0 ? void 0 : typedError.errorCode) === hdShared.HardwareErrorCode.RuntimeError &&
         message.includes('Device protocol mismatch') &&
         message.includes('expected V2') &&
         message.includes('did not respond to expected protocol'));
@@ -65528,7 +65645,31 @@ function isMissingDetectedProtocolV2Error(method, error) {
         typeof typedError.message === 'string' &&
         typedError.message.includes('Device protocol has not been detected'));
 }
-function connectDeviceForBle(method, device, retryCount = 0) {
+const BLE_ACQUIRE_DEADLINE_MS = 60 * 1000;
+function raceBleAcquire(acquirePromise, abortSignal) {
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const settle = (fn) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(deadline);
+            abortSignal === null || abortSignal === void 0 ? void 0 : abortSignal.removeEventListener('abort', onAbort);
+            fn();
+        };
+        const onAbort = () => settle(() => reject(hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.CallQueueActionCancelled)));
+        const deadline = setTimeout(() => settle(() => reject(hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.BleTimeoutError, `BLE acquire exceeded ${BLE_ACQUIRE_DEADLINE_MS}ms deadline`))), BLE_ACQUIRE_DEADLINE_MS);
+        acquirePromise.then(value => settle(() => resolve(value)), error => settle(() => reject(error)));
+        if (abortSignal) {
+            if (abortSignal.aborted) {
+                onAbort();
+                return;
+            }
+            abortSignal.addEventListener('abort', onAbort);
+        }
+    });
+}
+function connectDeviceForBle(method, device, abortSignal, retryCount = 0) {
     var _a;
     return __awaiter(this, void 0, void 0, function* () {
         try {
@@ -65540,9 +65681,31 @@ function connectDeviceForBle(method, device, retryCount = 0) {
                 !device.commands ||
                 device.commands.disposed;
             if (shouldAcquire) {
-                yield device.acquire(method.payload.connectProtocol, {
-                    forceProtocolDetection: method.payload.forceProtocolDetection,
-                });
+                const useAcquireGuards = DataManager.getSettings('env') === 'desktop-web-ble';
+                if (useAcquireGuards && (abortSignal === null || abortSignal === void 0 ? void 0 : abortSignal.aborted)) {
+                    throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.CallQueueActionCancelled);
+                }
+                if (!useAcquireGuards) {
+                    yield device.acquire(method.payload.connectProtocol, {
+                        forceProtocolDetection: method.payload.forceProtocolDetection,
+                    });
+                }
+                else {
+                    try {
+                        yield raceBleAcquire(device.acquire(method.payload.connectProtocol, {
+                            forceProtocolDetection: method.payload.forceProtocolDetection,
+                        }), abortSignal);
+                    }
+                    catch (err) {
+                        if (err.errorCode === hdShared.HardwareErrorCode.BleTimeoutError &&
+                            device.mainId &&
+                            device.deviceConnector) {
+                            yield device.deviceConnector.disconnect(device.mainId).catch(() => undefined);
+                            device.markTransportDisconnected();
+                        }
+                        throw err;
+                    }
+                }
             }
             if ((_a = method.payload) === null || _a === void 0 ? void 0 : _a.onlyConnectBleDevice) {
                 if (shouldAcquire) {
@@ -65577,7 +65740,7 @@ function connectDeviceForBle(method, device, retryCount = 0) {
                 const nextRetry = retryCount + 1;
                 Log.debug(`Bluetooth connection will retry, retry count: ${nextRetry}`);
                 yield wait(3000);
-                yield connectDeviceForBle(method, device, nextRetry);
+                yield connectDeviceForBle(method, device, abortSignal, nextRetry);
             }
             else {
                 throw err;
@@ -65659,7 +65822,7 @@ const ensureConnected = (_context, method, connectId, pollingId, abortSignal) =>
                         if (abort()) {
                             return;
                         }
-                        yield connectDeviceForBle(method, device);
+                        yield connectDeviceForBle(method, device, abortSignal);
                     }
                     resolve(device);
                     return;
@@ -66255,12 +66418,14 @@ exports.normalizeSafetyCheckLevel = normalizeSafetyCheckLevel;
 exports.normalizeVersionArray = normalizeVersionArray;
 exports.parseConnectSettings = parseConnectSettings;
 exports.parseMessage = parseMessage;
+exports.parseProtocolV2ResourceManifest = parseProtocolV2ResourceManifest;
 exports.patchFeatures = patchFeatures;
 exports.preloadSessionCache = preloadSessionCache;
 exports.prepareFirmwareUpdateV4MemoryHost = prepareFirmwareUpdateV4MemoryHost;
 exports.projectDeviceStateFeatures = projectFeatures;
 exports.registerFirmwareUpdateHostBinding = registerFirmwareUpdateHostBinding;
 exports.safeThrowError = safeThrowError;
+exports.selectProtocolV2ResourceManifestFiles = selectProtocolV2ResourceManifestFiles;
 exports.setLoggerPostMessage = setLoggerPostMessage;
 exports.supportInputPinOnSoftware = supportInputPinOnSoftware;
 exports.switchTransport = switchTransport;