@onekeyfe/hd-core 1.2.0-alpha.30 → 1.2.0-alpha.32

package/__tests__/check-all-firmware-release-protocol-v2.test.ts

@@ -0,0 +1,251 @@
+import { EFirmwareType } from '@onekeyfe/hd-shared';
+
+import CheckAllFirmwareRelease, {
+  buildProtocolV2FirmwareRelease,
+} from '../src/api/CheckAllFirmwareRelease';
+import { DataManager } from '../src/data-manager';
+import { createCoreApi } from '../src/inject';
+
+import type { CoreApi } from '../src/types/api';
+import type { DeviceStateVersions, IFirmwareReleaseInfo } from '../src/types';
+
+jest.mock('../src/data/config', () => ({
+  DEFAULT_DOMAIN: 'https://example.com/',
+  getSDKVersion: () => '0.0.0-test',
+}));
+
+const currentVersions: DeviceStateVersions = {
+  firmware: '1.0.0',
+  bootloader: '1.0.0',
+  board: '1.0.0',
+  ble: '1.0.0',
+  se01: '1.0.0',
+  se02: '2.0.0',
+  se03: null,
+  se04: '1.0.0',
+};
+
+const release: IFirmwareReleaseInfo = {
+  required: true,
+  version: [2, 0, 0],
+  url: 'https://example.com/application-p1.bin',
+  fingerprint: 'release-fingerprint',
+  changelog: {
+    'zh-CN': '更新',
+    'en-US': 'Update',
+  },
+  installOrder: ['bootloader', 'applicationP1', 'se02', 'se03', 'romloader'],
+  components: {
+    bootloader: {
+      target: 'BOOTLOADER',
+      url: 'https://example.com/bootloader.bin',
+      version: [1, 1, 0],
+    },
+    applicationP1: {
+      target: 'APPLICATION_P1',
+      url: 'https://example.com/application-p1.bin',
+      version: [2, 0, 0],
+    },
+    se02: {
+      target: 'SE02',
+      url: 'https://example.com/se02.bin',
+      version: [2, 0, 0],
+    },
+    se03: {
+      target: 'SE03',
+      url: 'https://example.com/se03.bin',
+      version: [1, 0, 0],
+    },
+    romloader: {
+      target: 'ROMLOADER',
+      url: 'https://example.com/romloader.bin',
+      version: [2, 0, 0],
+    },
+  },
+  resourceBundles: [
+    {
+      name: 'images',
+      url: 'https://example.com/images.okpkg',
+      devicePath: 'vol0:/bundles/images/images.okpkg',
+      version: [1, 0, 0],
+    },
+  ],
+};
+
+describe('checkAllFirmwareRelease Protocol V2 support', () => {
+  test('builds ordered firmwareUpdateV4 targets from recommended component versions', () => {
+    const result = buildProtocolV2FirmwareRelease({
+      currentVersions,
+      firmwareType: EFirmwareType.Universal,
+      release,
+    });
+
+    expect(result).toMatchObject({
+      status: 'required',
+      hasUpgrade: true,
+      required: true,
+      targetsToUpdate: ['boot', 'app_v1', 'resource'],
+      components: [
+        { configKey: 'bootloader', status: 'outdated', updateTarget: 'boot' },
+        { configKey: 'applicationP1', status: 'outdated', updateTarget: 'app_v1' },
+        { configKey: 'se02', status: 'valid', updateTarget: 'se02' },
+        { configKey: 'se03', status: 'unknown', updateTarget: 'se03' },
+        { configKey: 'romloader', status: 'unsupported', updateTarget: null },
+      ],
+    });
+  });
+
+  test('returns an unavailable plan when no Pro2 release is configured', () => {
+    expect(
+      buildProtocolV2FirmwareRelease({
+        currentVersions,
+        firmwareType: EFirmwareType.Universal,
+        release: undefined,
+      })
+    ).toMatchObject({
+      status: 'unavailable',
+      hasUpgrade: false,
+      required: false,
+      components: [],
+      targetsToUpdate: [],
+    });
+  });
+
+  test('detects same-version package hotfixes by P1 and P2 payload hash', () => {
+    const packageSet: IFirmwareReleaseInfo = {
+      ...release,
+      resourceBundles: undefined,
+      installOrder: ['applicationP1', 'applicationP2'],
+      components: {
+        applicationP1: {
+          target: 'APPLICATION_P1',
+          version: [1, 0, 0],
+          url: 'https://example.com/application-p1.okpkg',
+          fingerprint: 'file-sha256-p1',
+        },
+        applicationP2: {
+          target: 'APPLICATION_P2',
+          version: [1, 0, 0],
+          url: 'https://example.com/application-p2.okpkg',
+          fingerprint: 'file-sha256-p2',
+        },
+      },
+    };
+
+    const result = buildProtocolV2FirmwareRelease({
+      currentVersions: {
+        ...currentVersions,
+        applicationP1: '1.0.0',
+        applicationP2: '1.0.0',
+      },
+      currentVerification: {
+        applicationP1Hash: 'aa'.repeat(32),
+        applicationP2Hash: 'bb'.repeat(32),
+      },
+      remotePayloadHashes: {
+        applicationP1: 'aa'.repeat(64),
+        applicationP2: 'cc'.repeat(64),
+      },
+      firmwareType: EFirmwareType.Universal,
+      release: packageSet,
+    });
+
+    expect(result).toMatchObject({
+      status: 'required',
+      targetsToUpdate: ['app_v2'],
+      components: [
+        { configKey: 'applicationP1', status: 'valid' },
+        { configKey: 'applicationP2', status: 'outdated' },
+      ],
+    });
+  });
+
+  test('updates both application packages when normal mode only reports P1', () => {
+    const packageSet: IFirmwareReleaseInfo = {
+      ...release,
+      resourceBundles: undefined,
+      installOrder: ['applicationP1', 'applicationP2'],
+      components: {
+        applicationP1: {
+          target: 'APPLICATION_P1',
+          version: [1, 0, 0],
+          url: 'https://example.com/application-p1.okpkg',
+          fingerprint: 'file-sha256-p1',
+        },
+        applicationP2: {
+          target: 'APPLICATION_P2',
+          version: [1, 0, 0],
+          url: 'https://example.com/application-p2.okpkg',
+          fingerprint: 'file-sha256-p2',
+        },
+      },
+    };
+
+    const result = buildProtocolV2FirmwareRelease({
+      currentVersions,
+      currentVerification: { applicationP1Hash: 'aa'.repeat(32) },
+      remotePayloadHashes: { applicationP1: 'cc'.repeat(64) },
+      firmwareType: EFirmwareType.Universal,
+      release: packageSet,
+    });
+
+    expect(result.targetsToUpdate).toEqual(['app_v1', 'app_v2']);
+  });
+
+  test('uses the existing method on Protocol V2 and keeps its public API name', async () => {
+    const method = new CheckAllFirmwareRelease({
+      id: 1,
+      payload: {
+        method: 'checkAllFirmwareRelease',
+        firmwareType: EFirmwareType.Universal,
+      },
+    });
+    method.init();
+    const getDeviceState = jest.fn().mockResolvedValue({
+      identity: {
+        deviceType: 'pro2',
+        firmwareType: EFirmwareType.Universal,
+      },
+      status: { mode: 'normal' },
+      versions: currentVersions,
+    });
+    method.device = {
+      isProtocolV2: () => true,
+      features: {
+        deviceType: 'pro2',
+        firmwareVersion: '1.0.0',
+      },
+      getDeviceState,
+    } as unknown as CheckAllFirmwareRelease['device'];
+    jest.spyOn(DataManager, 'getFirmwareLatestRelease').mockReturnValue(release);
+
+    await expect(method.run()).resolves.toMatchObject({
+      protocol: 'V2',
+      deviceType: 'pro2',
+      status: 'required',
+      targetsToUpdate: ['boot', 'app_v1', 'resource'],
+      firmware: {
+        status: 'required',
+      },
+    });
+    expect(method.getSupportedProtocols()).toEqual(['V1', 'V2']);
+  });
+
+  test('continues forwarding the existing public method', async () => {
+    const call = jest.fn().mockResolvedValue({ success: true, payload: {} });
+    const api = createCoreApi(call as CoreApi['call']) as CoreApi;
+
+    await api.checkAllFirmwareRelease('pro2-connect-id', {
+      firmwareType: EFirmwareType.Universal,
+      retryCount: 0,
+    });
+
+    expect(call).toHaveBeenCalledWith({
+      connectId: 'pro2-connect-id',
+      firmwareType: EFirmwareType.Universal,
+      retryCount: 0,
+      method: 'checkAllFirmwareRelease',
+    });
+    expect(api).not.toHaveProperty('checkAllFirmwareReleaseV4');
+  });
+});

package/__tests__/connectSettings.test.ts

@@ -1,61 +1,19 @@
-import DataManager from '../src/data-manager/DataManager';
 import { parseConnectSettings } from '../src/data-manager/connectSettings';
 
-import type { RemoteConfigResponse } from '../src/types';
-
-jest.mock('axios', () => ({
-  get: jest.fn(),
-}));
-
 jest.mock('../src/data/config', () => ({
   getSDKVersion: jest.fn(() => '1.0.0'),
   DEFAULT_DOMAIN: 'https://jssdk.onekey.so/1.0.0/',
 }));
 
-const mockAxiosGet: jest.Mock = jest.requireMock('axios').get;
-
 describe('parseConnectSettings', () => {
-  const preloadedConfig = {
-    bridge: {},
-    classic: { firmware: [], ble: [] },
-    classic1s: { firmware: [], ble: [] },
-    classicpure: { firmware: [], ble: [] },
-    mini: { firmware: [], ble: [] },
-    touch: { firmware: [], ble: [] },
-    pro: { firmware: [], ble: [] },
-    pro2: { firmware: [], ble: [] },
-  } as unknown as RemoteConfigResponse;
-
-  it('keeps a serializable preloaded config in parsed settings', () => {
-    const settings = parseConnectSettings({
-      firmwareManifestMode: 'sdk-managed',
-      preloadedConfig,
-    });
-
-    expect(settings.firmwareManifestMode).toBe('sdk-managed');
-    expect(settings.preloadedConfig).toBe(preloadedConfig);
-  });
-
-  it('uses the preloaded config before the SDK network client', async () => {
-    const settings = parseConnectSettings({
-      firmwareManifestMode: 'sdk-managed',
-      preloadedConfig,
-    });
-
-    await DataManager.load(settings);
-
-    expect(mockAxiosGet).not.toHaveBeenCalled();
-    expect(DataManager.deviceMap.classic).toEqual({ firmware: [], ble: [] });
-  });
+  it('keeps custom configFetcher in parsed settings', () => {
+    const configFetcher = jest.fn();
 
-  it('fails closed without a preloaded config in external-only mode', async () => {
     const settings = parseConnectSettings({
-      firmwareManifestMode: 'external-only',
+      fetchConfig: true,
+      configFetcher,
     });
 
-    await expect(DataManager.load(settings)).rejects.toThrow(
-      'External firmware config snapshot is required'
-    );
-    expect(mockAxiosGet).not.toHaveBeenCalled();
+    expect(settings.configFetcher).toBe(configFetcher);
   });
 });

package/__tests__/device-state-mapper.test.ts

@@ -111,7 +111,8 @@ describe('DeviceStateMapper', () => {
         protocol_version: 2,
         hw: { serial_no: 'SERIAL-1' },
         fw: {
-          application: { version: '5.0.0' },
+          application: { version: '5.0.0', build_id: 'p1-build', hash: [0x01, 0x02] },
+          application_data: { version: '5.0.1', build_id: 'p2-build', hash: [0x03, 0x04] },
           bootloader: { version: '2.0.0' },
         },
         coprocessor: {
@@ -129,9 +130,17 @@ describe('DeviceStateMapper', () => {
     });
     expect(patch.versions).toMatchObject({
       firmware: '5.0.0',
+      applicationP1: '5.0.0',
+      applicationP2: '5.0.1',
       bootloader: '2.0.0',
       ble: '1.2.3',
     });
+    expect(patch.verification).toMatchObject({
+      applicationP1BuildId: 'p1-build',
+      applicationP1Hash: '0102',
+      applicationP2BuildId: 'p2-build',
+      applicationP2Hash: '0304',
+    });
     expect(patch).toMatchObject({ protocolVersion: 2 });
     expect(patch.status?.unlocked).toBeUndefined();
   });

package/__tests__/firmware-update/firmware-update-v2-download-before-boot.test.ts

@@ -1,8 +1,8 @@
-import { EDeviceType, EFirmwareType, ERRORS, HardwareErrorCode } from '@onekeyfe/hd-shared';
+import { EDeviceType, EFirmwareType, HardwareErrorCode } from '@onekeyfe/hd-shared';
 
 import FirmwareUpdateV2 from '../../src/api/FirmwareUpdateV2';
 import { getBinary } from '../../src/api/firmware/getBinary';
-import { uploadFirmwareFromSource } from '../../src/api/firmware/uploadFirmware';
+import { uploadFirmware } from '../../src/api/firmware/uploadFirmware';
 import * as utils from '../../src/utils';
 
 jest.mock('../../src/data/config', () => ({
@@ -18,8 +18,7 @@ jest.mock('../../src/api/firmware/getBinary', () => ({
 
 jest.mock('../../src/api/firmware/uploadFirmware', () => ({
   updateResources: jest.fn(),
-  updateResourcesFromSources: jest.fn(),
-  uploadFirmwareFromSource: jest.fn(),
+  uploadFirmware: jest.fn(),
 }));
 
 jest.mock('../../src/device/DevicePool', () => ({
@@ -30,9 +29,7 @@ jest.mock('../../src/device/DevicePool', () => ({
 }));
 
 const mockGetBinary = getBinary as jest.MockedFunction<typeof getBinary>;
-const mockUploadFirmwareFromSource = uploadFirmwareFromSource as jest.MockedFunction<
-  typeof uploadFirmwareFromSource
->;
+const mockUploadFirmware = uploadFirmware as jest.MockedFunction<typeof uploadFirmware>;
 
 type DeviceType = 'CLASSIC1S' | 'PURE';
 
@@ -178,26 +175,7 @@ describe('FirmwareUpdateV2 download-before-reboot safety', () => {
     expect(mockGetBinary).toHaveBeenCalledTimes(1);
     expectNoFirmwareMutationCalls(typedCall);
     expect(acquire).not.toHaveBeenCalled();
-    expect(mockUploadFirmwareFromSource).not.toHaveBeenCalled();
-  });
-
-  it('preserves structured preparation errors before any firmware mutation', async () => {
-    const preparationError = ERRORS.TypedError(
-      HardwareErrorCode.RuntimeError,
-      'Firmware must be prepared by the external firmware host',
-      {
-        firmwareUpdateCode: 'FirmwareArtifactsNotPrepared',
-        artifactName: 'firmware',
-      }
-    );
-    mockGetBinary.mockRejectedValue(preparationError);
-    const { method, typedCall, acquire } = createMethod();
-
-    await expect(method.run()).rejects.toBe(preparationError);
-
-    expectNoFirmwareMutationCalls(typedCall);
-    expect(acquire).not.toHaveBeenCalled();
-    expect(mockUploadFirmwareFromSource).not.toHaveBeenCalled();
+    expect(mockUploadFirmware).not.toHaveBeenCalled();
   });
 
   it.each([
@@ -238,11 +216,9 @@ describe('FirmwareUpdateV2 download-before-reboot safety', () => {
           binary: firmwareBinary,
         } as Awaited<ReturnType<typeof getBinary>>);
       });
-      mockUploadFirmwareFromSource.mockImplementation(() => {
+      mockUploadFirmware.mockImplementation(() => {
         callOrder.push('upload');
-        return Promise.resolve(
-          expectedResponse as Awaited<ReturnType<typeof uploadFirmwareFromSource>>
-        );
+        return Promise.resolve(expectedResponse as Awaited<ReturnType<typeof uploadFirmware>>);
       });
       const { method, typedCall } = createMethod({
         updateType,
@@ -272,15 +248,15 @@ describe('FirmwareUpdateV2 download-before-reboot safety', () => {
           },
         })
       );
-      expect(mockUploadFirmwareFromSource).toHaveBeenCalledWith(
+      expect(mockUploadFirmware).toHaveBeenCalledWith(
         updateType,
         expect.any(Function),
         expect.any(Function),
         method.device,
-        expect.objectContaining({
-          size: firmwareBinary.byteLength,
-        }),
-        true,
+        {
+          payload: firmwareBinary,
+          rebootOnSuccess: true,
+        },
         isUpdateBootloader
       );
     }
@@ -295,11 +271,11 @@ describe('FirmwareUpdateV2 download-before-reboot safety', () => {
         binary: firmwareBinary,
       } as Awaited<ReturnType<typeof getBinary>>);
     });
-    mockUploadFirmwareFromSource.mockImplementation(() => {
+    mockUploadFirmware.mockImplementation(() => {
       callOrder.push('upload');
       return Promise.resolve({
         success: true,
-      } as Awaited<ReturnType<typeof uploadFirmwareFromSource>>);
+      } as Awaited<ReturnType<typeof uploadFirmware>>);
     });
     const { method, typedCall, acquire } = createMethod({
       bootloaderMode: true,
@@ -324,9 +300,9 @@ describe('FirmwareUpdateV2 download-before-reboot safety', () => {
           resolveDownload = resolve;
         })
     );
-    mockUploadFirmwareFromSource.mockResolvedValue({
+    mockUploadFirmware.mockResolvedValue({
       success: true,
-    } as Awaited<ReturnType<typeof uploadFirmwareFromSource>>);
+    } as Awaited<ReturnType<typeof uploadFirmware>>);
     const { method, typedCall } = createMethod();
 
     const runPromise = method.run();
@@ -357,7 +333,7 @@ describe('FirmwareUpdateV2 download-before-reboot safety', () => {
 
     expectNoFirmwareMutationCalls(typedCall);
     expect(acquire).not.toHaveBeenCalled();
-    expect(mockUploadFirmwareFromSource).not.toHaveBeenCalled();
+    expect(mockUploadFirmware).not.toHaveBeenCalled();
   });
 
   it.each([
@@ -366,23 +342,23 @@ describe('FirmwareUpdateV2 download-before-reboot safety', () => {
   ])(
     'keeps the non-empty %s binary overload and never downloads it again',
     async (_kind, binary) => {
-      mockUploadFirmwareFromSource.mockResolvedValue({
+      mockUploadFirmware.mockResolvedValue({
         success: true,
-      } as Awaited<ReturnType<typeof uploadFirmwareFromSource>>);
+      } as Awaited<ReturnType<typeof uploadFirmware>>);
       const { method } = createMethod({ binary });
 
       await method.run();
 
       expect(mockGetBinary).not.toHaveBeenCalled();
-      expect(mockUploadFirmwareFromSource).toHaveBeenCalledWith(
+      expect(mockUploadFirmware).toHaveBeenCalledWith(
         'firmware',
         expect.any(Function),
         expect.any(Function),
         method.device,
-        expect.objectContaining({
-          size: binary.byteLength,
-        }),
-        true,
+        {
+          payload: binary,
+          rebootOnSuccess: true,
+        },
         undefined
       );
     }
@@ -393,21 +369,17 @@ describe('FirmwareUpdateV2 download-before-reboot safety', () => {
     ['DataView', new DataView(new Uint8Array([9, 3, 4, 9]).buffer, 1, 2), [3, 4]],
     ['custom Buffer', createCustomBuffer(4), [1, 2, 3, 4]],
   ])('normalizes a non-empty %s before rebooting', async (_kind, binary, expectedBytes) => {
-    let uploadedBytes: number[] = [];
-    mockUploadFirmwareFromSource.mockImplementation(
-      async (_updateType, _typedCall, _postMessage, _device, source) => {
-        uploadedBytes = Array.from(new Uint8Array(await source.readAt(0, source.size)));
-        return {
-          success: true,
-        } as Awaited<ReturnType<typeof uploadFirmwareFromSource>>;
-      }
-    );
+    mockUploadFirmware.mockResolvedValue({
+      success: true,
+    } as Awaited<ReturnType<typeof uploadFirmware>>);
     const { method } = createMethod({ binary });
 
     await method.run();
 
     expect(mockGetBinary).not.toHaveBeenCalled();
-    expect(uploadedBytes).toEqual(expectedBytes);
+    const normalizedBinary = mockUploadFirmware.mock.calls[0][4].payload;
+    expect(normalizedBinary).toBeInstanceOf(ArrayBuffer);
+    expect(Array.from(new Uint8Array(normalizedBinary))).toEqual(expectedBytes);
   });
 
   it.each([
@@ -425,6 +397,6 @@ describe('FirmwareUpdateV2 download-before-reboot safety', () => {
     expect(mockGetBinary).not.toHaveBeenCalled();
     expectNoFirmwareMutationCalls(typedCall);
     expect(acquire).not.toHaveBeenCalled();
-    expect(mockUploadFirmwareFromSource).not.toHaveBeenCalled();
+    expect(mockUploadFirmware).not.toHaveBeenCalled();
   });
 });

package/__tests__/networkUtils.test.ts

@@ -27,6 +27,26 @@ describe('networkUtils httpRequest retry bounds', () => {
     expect(requestSpy.mock.calls[0][0]).not.toHaveProperty('onDownloadProgress');
   });
 
+  it('accepts partial content and forwards byte-range headers', async () => {
+    const packageHeader = new ArrayBuffer(640);
+    const requestSpy = jest.spyOn(axios, 'request').mockResolvedValue({
+      status: 206,
+      data: packageHeader,
+    });
+
+    await expect(
+      httpRequest('https://example.com/application-p1.okpkg', 'binary', {
+        headers: { Range: 'bytes=0-639' },
+      })
+    ).resolves.toBe(packageHeader);
+
+    expect(requestSpy).toHaveBeenCalledWith(
+      expect.objectContaining({
+        headers: { Range: 'bytes=0-639' },
+      })
+    );
+  });
+
   it('passes the per-attempt timeout and stops after the configured retry count', async () => {
     const timeoutError = Object.assign(new Error('timeout'), {
       code: 'ECONNABORTED',

package/__tests__/open-wallet-session.test.ts

@@ -101,12 +101,15 @@ describe('openWalletSession', () => {
     expect(promptPassphrase).toHaveBeenCalledWith(
       {
         existsAttachPinUser: false,
+        deviceOnly: true,
         source: 'wallet-session-coordinator',
         reason: 'open-wallet',
       },
       { cancelDeviceOnReject: false }
     );
-    expect(typedCall).toHaveBeenNthCalledWith(2, 'DeviceSessionAskPassphrase', 'Success', {});
+    expect(typedCall).toHaveBeenNthCalledWith(2, 'DeviceSessionAskPassphrase', 'Success', {
+      on_device: true,
+    });
     expect(typedCall).toHaveBeenNthCalledWith(3, 'DeviceSessionGet', 'DeviceSession', {});
   });
 
@@ -221,7 +224,9 @@ describe('openWalletSession', () => {
       passphraseState: 'hidden-state',
     });
     expect(promptPassphrase).toHaveBeenCalled();
-    expect(typedCall).toHaveBeenNthCalledWith(2, 'DeviceSessionAskPassphrase', 'Success', {});
+    expect(typedCall).toHaveBeenNthCalledWith(2, 'DeviceSessionAskPassphrase', 'Success', {
+      on_device: true,
+    });
     expect(typedCall).toHaveBeenNthCalledWith(3, 'DeviceSessionGet', 'DeviceSession', {});
   });
 
@@ -298,7 +303,9 @@ describe('openWalletSession', () => {
     expect(typedCall).toHaveBeenCalledWith('ProtocolInfoRequest', 'ProtocolInfo', {
       eventless_wallet_session: true,
     });
-    expect(typedCall).toHaveBeenCalledWith('DeviceSessionAskPassphrase', 'Success', {});
+    expect(typedCall).toHaveBeenCalledWith('DeviceSessionAskPassphrase', 'Success', {
+      on_device: true,
+    });
     expect(typedCall).toHaveBeenCalledWith('DeviceSessionGet', 'DeviceSession', {});
     expect(promptPassphrase).toHaveBeenCalled();
     expect(deviceWalletSessionStore.get('device-1', 'new-hidden-state')).toBe('new-hidden-session');
@@ -590,7 +597,9 @@ describe('openWalletSession', () => {
       passphraseState: 'hidden-state',
       resumed: false,
     });
-    expect(typedCall).toHaveBeenCalledWith('DeviceSessionAskPassphrase', 'Success', {});
+    expect(typedCall).toHaveBeenCalledWith('DeviceSessionAskPassphrase', 'Success', {
+      on_device: true,
+    });
     expect(typedCall).toHaveBeenCalledWith('DeviceSessionGet', 'DeviceSession', {});
     expect(promptPassphrase).toHaveBeenCalled();
     expect(device.passphraseState).toBeUndefined();
@@ -616,7 +625,9 @@ describe('openWalletSession', () => {
       walletType: 'hidden',
       passphraseState: 'device-state',
     });
-    expect(typedCall).toHaveBeenCalledWith('DeviceSessionAskPassphrase', 'Success', {});
+    expect(typedCall).toHaveBeenCalledWith('DeviceSessionAskPassphrase', 'Success', {
+      on_device: true,
+    });
     expect(typedCall).toHaveBeenCalledWith('DeviceSessionGet', 'DeviceSession', {});
   });
 
@@ -649,6 +660,7 @@ describe('openWalletSession', () => {
     expect(promptPassphrase).toHaveBeenCalledWith(
       {
         existsAttachPinUser: false,
+        deviceOnly: true,
         source: 'wallet-session-coordinator',
         reason: 'open-wallet',
       },
@@ -656,6 +668,7 @@ describe('openWalletSession', () => {
     );
     expect(typedCall).toHaveBeenNthCalledWith(2, 'DeviceSessionAskPassphrase', 'Success', {
       passphrase: 'host hidden wallet',
+      on_device: false,
     });
   });
 
@@ -682,6 +695,7 @@ describe('openWalletSession', () => {
     expect(promptPassphrase).toHaveBeenCalledWith(
       {
         existsAttachPinUser: true,
+        deviceOnly: true,
         source: 'wallet-session-coordinator',
         reason: 'open-wallet',
       },

package/__tests__/protocol-v2-firmware-targets.test.ts

@@ -1,4 +1,10 @@
 import { ProtocolV2FirmwareTargetType } from '../src/protocols/protocol-v2/firmware';
+import { isProtocolV2FirmwareFingerprintValid } from '../src/api/FirmwareUpdateV4';
+
+jest.mock('../src/data/config', () => ({
+  DEFAULT_DOMAIN: 'https://example.com/',
+  getSDKVersion: () => '0.0.0-test',
+}));
 
 describe('Protocol V2 firmware target contract', () => {
   test('matches the current firmware-pro2 target ids', () => {
@@ -16,4 +22,16 @@ describe('Protocol V2 firmware target contract', () => {
       FW_MGMT_TARGET_SE04: 10,
     });
   });
+
+  test('validates the full package SHA-256 fingerprint from config', () => {
+    const binary = Uint8Array.from([1, 2, 3]);
+
+    expect(
+      isProtocolV2FirmwareFingerprintValid(
+        binary,
+        '039058c6f2c0cb492c533b0a4d14ef77cc0f78abccced5287d84a1a2011cfb81'
+      )
+    ).toBe(true);
+    expect(isProtocolV2FirmwareFingerprintValid(binary, '00'.repeat(32))).toBe(false);
+  });
 });