@onekeyfe/hd-core 1.2.0-alpha.82 → 1.2.0-alpha.85

package/dist/index.js

@@ -522,6 +522,10 @@ const PROTOCOL_V2_TARGETS = {
     SE03: 'se03',
     SE04: 'se04',
 };
+const PROTOCOL_V2_FIRMWARE_UPDATE_TARGETS = new Set([
+    ...Object.values(PROTOCOL_V2_TARGETS),
+    'resource',
+]);
 const asRecord = (value) => value && typeof value === 'object' && !Array.isArray(value)
     ? value
     : undefined;
@@ -609,6 +613,18 @@ const validateFirmwareUpdatePlanForceTargets = (value) => {
     }
     return [...value];
 };
+const validateProtocolV2FirmwareUpdateTargets = (value) => {
+    if (value === undefined) {
+        return [];
+    }
+    if (!Array.isArray(value) ||
+        value.length > PROTOCOL_V2_FIRMWARE_UPDATE_TARGETS.size ||
+        value.some(target => !PROTOCOL_V2_FIRMWARE_UPDATE_TARGETS.has(target)) ||
+        new Set(value).size !== value.length) {
+        return planError('Protocol V2 firmware update targets are invalid');
+    }
+    return [...value];
+};
 const assertExactKeys = (value, required, optional = []) => {
     const allowed = new Set([...required, ...optional]);
     if (required.some(key => !Object.prototype.hasOwnProperty.call(value, key)) ||
@@ -773,7 +789,7 @@ const selectResourceUrl = ({ release, features, platform, }) => {
 };
 const getExecutor = (features) => {
     const deviceType = getDeviceType(features);
-    if (deviceType === hdShared.EDeviceType.Pro2) {
+    if (deviceType === hdShared.EDeviceType.Pro2 || deviceType === hdShared.EDeviceType.Neo) {
         return 'v4';
     }
     if (deviceType === hdShared.EDeviceType.Pro &&
@@ -782,7 +798,7 @@ const getExecutor = (features) => {
     }
     return 'v2';
 };
-const buildProtocolV2Artifacts = (release, { includeComponents = true, includeResources = true, } = {}) => {
+const buildProtocolV2Artifacts = (release, { includeComponents = true, componentTargets: selectedComponentTargets, } = {}) => {
     var _a;
     const components = asRecord(release.components);
     if (includeComponents && !components) {
@@ -794,49 +810,38 @@ const buildProtocolV2Artifacts = (release, { includeComponents = true, includeRe
     const componentKeys = includeComponents && components
         ? [...installOrder, ...Object.keys(components).filter(key => !installOrder.includes(key))]
         : [];
+    const selectedComponentKeys = selectedComponentTargets
+        ? componentKeys.filter(key => {
+            var _a;
+            const component = asRecord(components === null || components === void 0 ? void 0 : components[key]);
+            const targetName = (_a = asString(component === null || component === void 0 ? void 0 : component.target)) === null || _a === void 0 ? void 0 : _a.toUpperCase();
+            const target = targetName ? PROTOCOL_V2_TARGETS[targetName] : undefined;
+            return !!target && selectedComponentTargets.has(target);
+        })
+        : componentKeys;
     const artifacts = [];
     const targets = [];
-    const componentTargets = new Set();
-    for (const key of componentKeys) {
+    const componentTargetSet = new Set();
+    for (const key of selectedComponentKeys) {
         const component = asRecord(components === null || components === void 0 ? void 0 : components[key]);
         const targetName = (_a = asString(component === null || component === void 0 ? void 0 : component.target)) === null || _a === void 0 ? void 0 : _a.toUpperCase();
+        const target = targetName ? PROTOCOL_V2_TARGETS[targetName] : undefined;
         if (targetName === 'ROMLOADER') {
             throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 ROMLOADER requires its dedicated loader flow', { firmwareUpdateCode: 'FirmwarePlanInvalid' });
         }
-        const target = targetName ? PROTOCOL_V2_TARGETS[targetName] : undefined;
         if (!component || !target) {
             throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Protocol V2 component ${key} has an unsupported target`, { firmwareUpdateCode: 'FirmwarePlanInvalid' });
         }
-        if (componentTargets.has(target)) {
+        if (componentTargetSet.has(target)) {
             throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Protocol V2 component ${key} duplicates target ${target}`, { firmwareUpdateCode: 'FirmwarePlanInvalid' });
         }
-        componentTargets.add(target);
+        componentTargetSet.add(target);
         artifacts.push(Object.assign(Object.assign({ artifactId: `component:${target}`, role: 'component', target, url: assertArtifactUrl(component.url, `Protocol V2 component ${key}`), container: 'raw', logicalName: key }, asIntegrity({
             size: component.expectedSize,
             sha256: component.fingerprint,
         })), (asVersion(component.version) ? { targetVersion: asVersion(component.version) } : {})));
         targets.push(target);
     }
-    const bundles = includeResources && Array.isArray(release.resourceBundles) ? release.resourceBundles : [];
-    const resourceBundleNames = new Set();
-    for (const value of bundles) {
-        const bundle = asRecord(value);
-        const name = asString(bundle === null || bundle === void 0 ? void 0 : bundle.name);
-        if (!bundle || !name) {
-            throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 resource bundle is invalid', { firmwareUpdateCode: 'FirmwarePlanInvalid' });
-        }
-        if (resourceBundleNames.has(name)) {
-            throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Protocol V2 resource bundle duplicates name ${name}`, { firmwareUpdateCode: 'FirmwarePlanInvalid' });
-        }
-        resourceBundleNames.add(name);
-        artifacts.push(Object.assign({ artifactId: `resourceBundle:${name}`, role: 'resourceBundle', target: 'resource', url: assertArtifactUrl(bundle.url, `Protocol V2 resource bundle ${name}`), container: 'raw', logicalName: name }, asIntegrity({
-            size: bundle.expectedSize,
-            sha256: bundle.fingerprint,
-        })));
-    }
-    if (bundles.length > 0) {
-        targets.push('resource');
-    }
     return { artifacts, targets: [...new Set(targets)] };
 };
 const isForcedTargetRepresented = ({ executor, forcedTarget, artifacts, targetsToUpdate, }) => {
@@ -865,6 +870,78 @@ const assertForcedTargetsRepresented = ({ executor, forcedTargets, artifacts, ta
         }
     }
 };
+const finalizeFirmwareUpdatePlan = ({ features, firmwareType, platform, artifacts, targetsToUpdate, }) => {
+    const executor = getExecutor(features);
+    const bootloaderMode = resolveDeviceBootloaderMode(features);
+    const reportedIdentity = getDeviceUUID(features);
+    const deviceIdentity = reportedIdentity === 'unavailable' ? '' : reportedIdentity;
+    if (artifacts.length > 0 &&
+        (platform === 'native' || platform === 'desktop') &&
+        !deviceIdentity &&
+        !(bootloaderMode && executor === 'v2')) {
+        throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Prepared firmware update requires a stable device identity', { firmwareUpdateCode: 'FirmwarePlanInvalid' });
+    }
+    const planWithoutDigest = {
+        schemaVersion: 2,
+        executor,
+        deviceIdentity: deviceIdentity || 'unavailable',
+        deviceModel: String(getDeviceType(features)),
+        firmwareType,
+        platform,
+        artifacts,
+        targetsToUpdate,
+    };
+    return assertFirmwareUpdatePlan(Object.assign(Object.assign({}, planWithoutDigest), { planDigest: digestFirmwareUpdatePlan(planWithoutDigest) }));
+};
+const buildProtocolV2FirmwareUpdatePlan = ({ features, firmwareType, platform, release, targetsToUpdate, forceUpdateTargets, resourceArchive, }) => {
+    const validatedForceTargets = validateFirmwareUpdatePlanForceTargets(forceUpdateTargets);
+    if (validatedForceTargets.some(target => target === 'ble' || target === 'bootloader')) {
+        planError('Protocol V2 does not support forced BLE or legacy bootloader targets');
+    }
+    const requestedComponentTargets = new Set(targetsToUpdate.filter(target => target !== 'resource'));
+    if (getDeviceType(features) === hdShared.EDeviceType.Neo &&
+        (requestedComponentTargets.has('se03') || requestedComponentTargets.has('se04'))) {
+        planError('Neo does not support Protocol V2 targets se03 or se04');
+    }
+    const protocolV2 = buildProtocolV2Artifacts(release !== null && release !== void 0 ? release : {}, {
+        includeComponents: requestedComponentTargets.size > 0,
+        componentTargets: requestedComponentTargets,
+    });
+    const resourceRequested = targetsToUpdate.includes('resource');
+    if (resourceRequested) {
+        const archive = resourceArchive;
+        if (!archive) {
+            return planError('Protocol V2 resource target has no resource archive');
+        }
+        const integrity = asIntegrity({
+            size: archive.archiveSize,
+            sha256: archive.archiveSha256,
+        });
+        if (integrity.expectedSize === undefined || integrity.expectedSha256 === undefined) {
+            planError('Protocol V2 resource archive integrity metadata is invalid');
+        }
+        protocolV2.artifacts.push(Object.assign({ artifactId: 'resource:archive', role: 'resourceBundle', target: 'resource', url: assertArtifactUrl(archive.archiveUrl, 'Protocol V2 resource archive'), container: 'zip', logicalName: 'protocol-v2-resource-archive' }, integrity));
+        protocolV2.targets.push('resource');
+    }
+    const representedTargets = new Set(protocolV2.targets);
+    const missingTarget = Array.from(requestedComponentTargets).find(target => !representedTargets.has(target));
+    if (missingTarget) {
+        planError(`Protocol V2 release does not contain requested target ${missingTarget}`);
+    }
+    if (validatedForceTargets.includes('firmware') && protocolV2.targets.length === 0) {
+        planError('Forced firmware update target firmware is not represented by the plan');
+    }
+    if (validatedForceTargets.includes('resource') && !resourceArchive) {
+        planError('Forced firmware update target resource has no Protocol V2 resource archive');
+    }
+    return finalizeFirmwareUpdatePlan({
+        features,
+        firmwareType,
+        platform,
+        artifacts: protocolV2.artifacts,
+        targetsToUpdate: protocolV2.targets,
+    });
+};
 const buildFirmwareUpdatePlan = ({ features, firmwareType, platform, firmware, ble, bootloader, forceUpdateTargets, }) => {
     var _a, _b, _c, _d, _e, _f, _g;
     const executor = getExecutor(features);
@@ -886,7 +963,6 @@ const buildFirmwareUpdatePlan = ({ features, firmwareType, platform, firmware, b
     if (executor === 'v4' && (shouldUpdateFirmware || shouldUpdateResource)) {
         const protocolV2 = buildProtocolV2Artifacts(firmwareRelease !== null && firmwareRelease !== void 0 ? firmwareRelease : {}, {
             includeComponents: shouldUpdateFirmware,
-            includeResources: shouldUpdateResource,
         });
         artifacts = protocolV2.artifacts;
         targetsToUpdate = protocolV2.targets;
@@ -951,25 +1027,13 @@ const buildFirmwareUpdatePlan = ({ features, firmwareType, platform, firmware, b
         artifacts,
         targetsToUpdate,
     });
-    const reportedIdentity = getDeviceUUID(features);
-    const deviceIdentity = reportedIdentity === 'unavailable' ? '' : reportedIdentity;
-    if (artifacts.length > 0 &&
-        (platform === 'native' || platform === 'desktop') &&
-        !deviceIdentity &&
-        !(bootloaderMode && executor === 'v2')) {
-        throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Prepared firmware update requires a stable device identity', { firmwareUpdateCode: 'FirmwarePlanInvalid' });
-    }
-    const planWithoutDigest = {
-        schemaVersion: 2,
-        executor,
-        deviceIdentity: deviceIdentity || 'unavailable',
-        deviceModel: String(getDeviceType(features)),
+    return finalizeFirmwareUpdatePlan({
+        features,
         firmwareType,
         platform,
         artifacts,
         targetsToUpdate,
-    };
-    return assertFirmwareUpdatePlan(Object.assign(Object.assign({}, planWithoutDigest), { planDigest: digestFirmwareUpdatePlan(planWithoutDigest) }));
+    });
 };
 
 const preparedPlanError = (message) => {
@@ -1090,7 +1154,7 @@ const prepareFirmwareUpdatePlan = ({ plan: value, leaseRef, artifacts, }) => {
     return Object.assign(Object.assign({}, planWithoutDigest), { preparedPlanDigest: digestPreparedPlan(planWithoutDigest) });
 };
 const validateFirmwareUpdatePreparedPlan = (value) => {
-    var _a, _b, _c;
+    var _a, _b, _c, _d;
     if (!value || typeof value !== 'object' || Array.isArray(value)) {
         return preparedPlanError('Firmware prepared plan must be an object');
     }
@@ -1170,7 +1234,13 @@ const validateFirmwareUpdatePreparedPlan = (value) => {
         artifactIds.add(artifact.artifactId);
         artifactTargets.add(artifact.target);
         assertFirmwareArtifactReference(artifact.artifact);
-        (_c = artifact.materializedEntries) === null || _c === void 0 ? void 0 : _c.forEach(assertPreparedEntry);
+        const materializedEntryNames = (_d = (_c = artifact.materializedEntries) === null || _c === void 0 ? void 0 : _c.map(entry => {
+            assertPreparedEntry(entry);
+            return getFirmwareUpdateResourceName(entry.entryName).toLowerCase();
+        })) !== null && _d !== void 0 ? _d : [];
+        if (new Set(materializedEntryNames).size !== materializedEntryNames.length) {
+            return preparedPlanError('Firmware prepared plan contains duplicate entry names');
+        }
     }
     if (preparedPlan.targetsToUpdate.some(target => !FIRMWARE_UPDATE_PLAN_TARGETS.has(target)) ||
         new Set(preparedPlan.targetsToUpdate).size !== preparedPlan.targetsToUpdate.length ||
@@ -1265,201 +1335,6 @@ const assertFirmwareUpdatePreparedPlanBinding = ({ preparedPlan: value, executor
     return preparedPlan;
 };
 
-const PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_PATH$1 = 'vol0:/loaders/bootloader/boot_resource.okpkg';
-const SHA256_HEX_LENGTH = 64;
-function normalizeHex$1(value, expectedLength, field) {
-    if (typeof value !== 'string') {
-        throw new Error(`Invalid Pro2 resource ${field}: expected a hexadecimal string`);
-    }
-    const normalized = value.replace(/^0x/i, '').toLowerCase();
-    if (normalized.length !== expectedLength || !/^[0-9a-f]+$/.test(normalized)) {
-        throw new Error(`Invalid Pro2 resource ${field}: expected ${expectedLength} hexadecimal characters`);
-    }
-    return normalized;
-}
-function parseProtocolV2Resources(value) {
-    if (value === undefined)
-        return undefined;
-    if (!value || typeof value !== 'object') {
-        throw new Error('Invalid Pro2 resources config');
-    }
-    const { source } = value;
-    if (!source || typeof source !== 'object') {
-        throw new Error('Invalid Pro2 resources config: source is required');
-    }
-    const { archiveUrl, archiveSha256, archiveSize } = source;
-    if (typeof archiveUrl !== 'string' || !archiveUrl.startsWith('https://')) {
-        throw new Error('Invalid Pro2 resources config: source.archiveUrl must use HTTPS');
-    }
-    if (typeof archiveSha256 !== 'string' || !/^[0-9a-fA-F]{64}$/.test(archiveSha256)) {
-        throw new Error('Invalid Pro2 resources config: source.archiveSha256 must be a SHA-256 digest');
-    }
-    if (!Number.isSafeInteger(archiveSize) || archiveSize <= 0) {
-        throw new Error('Invalid Pro2 resources config: source.archiveSize must be a positive integer');
-    }
-    return {
-        source: {
-            archiveUrl,
-            archiveSha256: archiveSha256.toLowerCase(),
-            archiveSize: archiveSize,
-        },
-    };
-}
-const PROTOCOL_V2_RESOURCE_MANIFEST_DEVICE_ROOTS = [
-    'vol0:/bundles/',
-    'vol0:/loaders/rom/',
-];
-function isAllowedManifestDevicePath(path) {
-    if (!path.endsWith('.okpkg') ||
-        path.includes('\\') ||
-        path.includes('//') ||
-        path.split('/').some(part => part === '.' || part === '..')) {
-        return false;
-    }
-    if (path === PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_PATH$1) {
-        return true;
-    }
-    return PROTOCOL_V2_RESOURCE_MANIFEST_DEVICE_ROOTS.some(root => path.startsWith(root));
-}
-function assertManifestString(value, field) {
-    if (typeof value !== 'string' || value.length === 0) {
-        throw new Error(`Invalid Pro2 resource manifest ${field}`);
-    }
-    return value;
-}
-function assertManifestRelativePath(value, field) {
-    const path = assertManifestString(value, field);
-    if (path.startsWith('/') ||
-        path.includes('\\') ||
-        path.includes(':') ||
-        path.split('/').some(part => !part || part === '.' || part === '..')) {
-        throw new Error(`Invalid Pro2 resource manifest ${field}`);
-    }
-    return path;
-}
-function parseProtocolV2ResourceManifestFile(value, index) {
-    var _a;
-    if (!value || typeof value !== 'object' || Array.isArray(value)) {
-        throw new Error(`Invalid Pro2 resource manifest files[${index}]`);
-    }
-    const file = value;
-    const archivePath = assertManifestRelativePath(file.archive_path, `files[${index}].archive_path`);
-    const originalName = assertManifestRelativePath(file.original_name, `files[${index}].original_name`);
-    if (originalName.includes('/')) {
-        throw new Error(`Invalid Pro2 resource manifest files[${index}].original_name`);
-    }
-    const devicePath = assertManifestString(file.device_path, `files[${index}].device_path`);
-    if (!isAllowedManifestDevicePath(devicePath)) {
-        throw new Error(`Invalid Pro2 resource manifest files[${index}].device_path`);
-    }
-    if (!Number.isSafeInteger(file.size) || Number(file.size) <= 0) {
-        throw new Error(`Invalid Pro2 resource manifest files[${index}].size`);
-    }
-    const digest = normalizeHex$1(file.sha256, SHA256_HEX_LENGTH, `files[${index}].sha256`);
-    if (file.signed !== true) {
-        throw new Error(`Invalid Pro2 resource manifest files[${index}].signed`);
-    }
-    if (file.sig_algo !== 'ed25519' && file.sig_algo !== 'mldsa65') {
-        throw new Error(`Invalid Pro2 resource manifest files[${index}].sig_algo`);
-    }
-    if (file.payload_version !== null && typeof file.payload_version !== 'string') {
-        throw new Error(`Invalid Pro2 resource manifest files[${index}].payload_version`);
-    }
-    if (!archivePath.endsWith('.okpkg') || !originalName.endsWith('.okpkg')) {
-        throw new Error(`Invalid Pro2 resource manifest files[${index}] package extension`);
-    }
-    return {
-        archive_path: archivePath,
-        original_name: originalName,
-        device_path: devicePath,
-        size: Number(file.size),
-        sha256: digest,
-        signed: true,
-        sig_algo: file.sig_algo,
-        payload_version: (_a = file.payload_version) !== null && _a !== void 0 ? _a : null,
-    };
-}
-function parseProtocolV2ResourceManifest(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value)) {
-        throw new Error('Invalid Pro2 resource manifest');
-    }
-    const manifest = value;
-    if (manifest.schema !== 1 ||
-        manifest.variant !== 'resource' ||
-        manifest.device_root !== 'vol0:' ||
-        manifest.restore_mode !== 'bootloader_update' ||
-        !Array.isArray(manifest.trees) ||
-        !Array.isArray(manifest.files)) {
-        throw new Error('Invalid Pro2 resource manifest contract');
-    }
-    const files = manifest.files.map(parseProtocolV2ResourceManifestFile);
-    const devicePaths = new Set(files.map(file => file.device_path));
-    const archivePaths = new Set(files.map(file => file.archive_path));
-    if (files.length === 0 ||
-        devicePaths.size !== files.length ||
-        archivePaths.size !== files.length ||
-        !devicePaths.has(PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_PATH$1) ||
-        !files.some(file => file.device_path.startsWith('vol0:/bundles/'))) {
-        throw new Error('Invalid Pro2 resource manifest file set');
-    }
-    return {
-        schema: 1,
-        artifact_name: assertManifestString(manifest.artifact_name, 'artifact_name'),
-        release_name: assertManifestString(manifest.release_name, 'release_name'),
-        variant: 'resource',
-        commit: assertManifestString(manifest.commit, 'commit'),
-        short_sha: assertManifestString(manifest.short_sha, 'short_sha'),
-        timestamp_utc: assertManifestString(manifest.timestamp_utc, 'timestamp_utc'),
-        core_version: assertManifestString(manifest.core_version, 'core_version'),
-        key_set: assertManifestString(manifest.key_set, 'key_set'),
-        device_root: 'vol0:',
-        restore_mode: 'bootloader_update',
-        trees: manifest.trees.map((tree, index) => {
-            if (!tree || typeof tree !== 'object') {
-                throw new Error(`Invalid Pro2 resource manifest trees[${index}]`);
-            }
-            const item = tree;
-            return {
-                path: assertManifestRelativePath(item.path, `trees[${index}].path`),
-                device: assertManifestString(item.device, `trees[${index}].device`),
-            };
-        }),
-        files,
-    };
-}
-function selectProtocolV2ResourceManifestFiles({ manifest, targetsToUpdate, }) {
-    return targetsToUpdate.includes('resource') ? [...manifest.files] : [];
-}
-function prepareProtocolV2ResourceFiles({ manifest: value, files, targetsToUpdate, }) {
-    const manifest = parseProtocolV2ResourceManifest(value);
-    const selected = selectProtocolV2ResourceManifestFiles({ manifest, targetsToUpdate });
-    const binaries = new Map(files.map(file => [file.archivePath, file.binary]));
-    return selected.map(file => {
-        const binary = binaries.get(file.archive_path);
-        if (!binary ||
-            !isProtocolV2ResourceFileValid(binary, {
-                size: file.size,
-                fileHash: file.sha256,
-            })) {
-            throw new Error(`Pro2 resource manifest file verification failed: ${file.archive_path}`);
-        }
-        return {
-            binary,
-            devicePath: file.device_path,
-            size: file.size,
-            fileHash: file.sha256,
-        };
-    });
-}
-function bytesToHex$3(bytes) {
-    return Array.from(bytes, byte => byte.toString(16).padStart(2, '0')).join('');
-}
-function isProtocolV2ResourceFileValid(binary, resource) {
-    if (binary.byteLength !== resource.size)
-        return false;
-    return bytesToHex$3(sha256.sha256(new Uint8Array(binary))) === resource.fileHash.toLowerCase();
-}
-
 const bindingError = (message) => {
     throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, message, {
         firmwareUpdateCode: 'FirmwareArtifactReaderInvalid',
@@ -1609,7 +1484,6 @@ const createCoreApi = (call) => ({
     getFirmwareUpdateHostBindingGeneration,
     prepareFirmwareUpdatePlan,
     validateFirmwareUpdatePreparedPlan,
-    prepareProtocolV2ResourceFiles,
     getLogs: () => call({ method: 'getLogs' }),
     clearSessionCache: params => call(Object.assign(Object.assign({}, params), { method: 'clearSessionCache' })),
     searchDevices: params => call(Object.assign(Object.assign({}, params), { method: 'searchDevices' })),
@@ -40700,6 +40574,172 @@ const findLatestRelease = (releases) => {
     return leastRelease;
 };
 
+const PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_PATH$1 = 'vol0:/loaders/bootloader/boot_resource.okpkg';
+const SHA256_HEX_LENGTH = 64;
+function normalizeHex$1(value, expectedLength, field) {
+    if (typeof value !== 'string') {
+        throw new Error(`Invalid Pro2 resource ${field}: expected a hexadecimal string`);
+    }
+    const normalized = value.replace(/^0x/i, '').toLowerCase();
+    if (normalized.length !== expectedLength || !/^[0-9a-f]+$/.test(normalized)) {
+        throw new Error(`Invalid Pro2 resource ${field}: expected ${expectedLength} hexadecimal characters`);
+    }
+    return normalized;
+}
+function parseProtocolV2Resources(value) {
+    if (value === undefined)
+        return undefined;
+    if (!value || typeof value !== 'object') {
+        throw new Error('Invalid Pro2 resources config');
+    }
+    const { source } = value;
+    if (!source || typeof source !== 'object') {
+        throw new Error('Invalid Pro2 resources config: source is required');
+    }
+    const { archiveUrl, archiveSha256, archiveSize } = source;
+    if (typeof archiveUrl !== 'string' || !archiveUrl.startsWith('https://')) {
+        throw new Error('Invalid Pro2 resources config: source.archiveUrl must use HTTPS');
+    }
+    if (typeof archiveSha256 !== 'string' || !/^[0-9a-fA-F]{64}$/.test(archiveSha256)) {
+        throw new Error('Invalid Pro2 resources config: source.archiveSha256 must be a SHA-256 digest');
+    }
+    if (!Number.isSafeInteger(archiveSize) || archiveSize <= 0) {
+        throw new Error('Invalid Pro2 resources config: source.archiveSize must be a positive integer');
+    }
+    return {
+        source: {
+            archiveUrl,
+            archiveSha256: archiveSha256.toLowerCase(),
+            archiveSize: archiveSize,
+        },
+    };
+}
+const PROTOCOL_V2_RESOURCE_MANIFEST_DEVICE_ROOTS = [
+    'vol0:/bundles/',
+    'vol0:/loaders/rom/',
+];
+function isAllowedManifestDevicePath(path) {
+    if (!path.endsWith('.okpkg') ||
+        path.includes('\\') ||
+        path.includes('//') ||
+        path.split('/').some(part => part === '.' || part === '..')) {
+        return false;
+    }
+    if (path === PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_PATH$1) {
+        return true;
+    }
+    return PROTOCOL_V2_RESOURCE_MANIFEST_DEVICE_ROOTS.some(root => path.startsWith(root));
+}
+function assertManifestString(value, field) {
+    if (typeof value !== 'string' || value.length === 0) {
+        throw new Error(`Invalid Pro2 resource manifest ${field}`);
+    }
+    return value;
+}
+function assertManifestRelativePath(value, field) {
+    const path = assertManifestString(value, field);
+    if (path.startsWith('/') ||
+        path.includes('\\') ||
+        path.includes(':') ||
+        path.split('/').some(part => !part || part === '.' || part === '..')) {
+        throw new Error(`Invalid Pro2 resource manifest ${field}`);
+    }
+    return path;
+}
+function parseProtocolV2ResourceManifestFile(value, index) {
+    var _a;
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error(`Invalid Pro2 resource manifest files[${index}]`);
+    }
+    const file = value;
+    const archivePath = assertManifestRelativePath(file.archive_path, `files[${index}].archive_path`);
+    const originalName = assertManifestRelativePath(file.original_name, `files[${index}].original_name`);
+    if (originalName.includes('/')) {
+        throw new Error(`Invalid Pro2 resource manifest files[${index}].original_name`);
+    }
+    const devicePath = assertManifestString(file.device_path, `files[${index}].device_path`);
+    if (!isAllowedManifestDevicePath(devicePath)) {
+        throw new Error(`Invalid Pro2 resource manifest files[${index}].device_path`);
+    }
+    if (!Number.isSafeInteger(file.size) || Number(file.size) <= 0) {
+        throw new Error(`Invalid Pro2 resource manifest files[${index}].size`);
+    }
+    const digest = normalizeHex$1(file.sha256, SHA256_HEX_LENGTH, `files[${index}].sha256`);
+    if (file.signed !== true) {
+        throw new Error(`Invalid Pro2 resource manifest files[${index}].signed`);
+    }
+    if (file.sig_algo !== 'ed25519' && file.sig_algo !== 'mldsa65') {
+        throw new Error(`Invalid Pro2 resource manifest files[${index}].sig_algo`);
+    }
+    if (file.payload_version !== null && typeof file.payload_version !== 'string') {
+        throw new Error(`Invalid Pro2 resource manifest files[${index}].payload_version`);
+    }
+    if (!archivePath.endsWith('.okpkg') || !originalName.endsWith('.okpkg')) {
+        throw new Error(`Invalid Pro2 resource manifest files[${index}] package extension`);
+    }
+    return {
+        archive_path: archivePath,
+        original_name: originalName,
+        device_path: devicePath,
+        size: Number(file.size),
+        sha256: digest,
+        signed: true,
+        sig_algo: file.sig_algo,
+        payload_version: (_a = file.payload_version) !== null && _a !== void 0 ? _a : null,
+    };
+}
+function parseProtocolV2ResourceManifest(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error('Invalid Pro2 resource manifest');
+    }
+    const manifest = value;
+    if (manifest.schema !== 1 ||
+        manifest.variant !== 'resource' ||
+        manifest.device_root !== 'vol0:' ||
+        manifest.restore_mode !== 'bootloader_update' ||
+        !Array.isArray(manifest.trees) ||
+        !Array.isArray(manifest.files)) {
+        throw new Error('Invalid Pro2 resource manifest contract');
+    }
+    const files = manifest.files.map(parseProtocolV2ResourceManifestFile);
+    const devicePaths = new Set(files.map(file => file.device_path));
+    const archivePaths = new Set(files.map(file => file.archive_path));
+    if (files.length === 0 ||
+        devicePaths.size !== files.length ||
+        archivePaths.size !== files.length ||
+        !devicePaths.has(PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_PATH$1) ||
+        !files.some(file => file.device_path.startsWith('vol0:/bundles/'))) {
+        throw new Error('Invalid Pro2 resource manifest file set');
+    }
+    return {
+        schema: 1,
+        artifact_name: assertManifestString(manifest.artifact_name, 'artifact_name'),
+        release_name: assertManifestString(manifest.release_name, 'release_name'),
+        variant: 'resource',
+        commit: assertManifestString(manifest.commit, 'commit'),
+        short_sha: assertManifestString(manifest.short_sha, 'short_sha'),
+        timestamp_utc: assertManifestString(manifest.timestamp_utc, 'timestamp_utc'),
+        core_version: assertManifestString(manifest.core_version, 'core_version'),
+        key_set: assertManifestString(manifest.key_set, 'key_set'),
+        device_root: 'vol0:',
+        restore_mode: 'bootloader_update',
+        trees: manifest.trees.map((tree, index) => {
+            if (!tree || typeof tree !== 'object') {
+                throw new Error(`Invalid Pro2 resource manifest trees[${index}]`);
+            }
+            const item = tree;
+            return {
+                path: assertManifestRelativePath(item.path, `trees[${index}].path`),
+                device: assertManifestString(item.device, `trees[${index}].device`),
+            };
+        }),
+        files,
+    };
+}
+function selectProtocolV2ResourceManifestFiles({ manifest, targetsToUpdate, }) {
+    return targetsToUpdate.includes('resource') ? [...manifest.files] : [];
+}
+
 var _a$1;
 const FIRMWARE_UPDATE_CONFIG_FRESHNESS_MS = 5 * 60 * 1000;
 const Log$k = getLogger(exports.LoggerNames.Core);
@@ -41925,7 +41965,7 @@ const getFirmwareUpdateField = ({ features, updateType, targetVersion, firmwareT
     if (deviceType === hdShared.EDeviceType.Pro) {
         return latestFirmwareField;
     }
-    if (deviceType === hdShared.EDeviceType.Pro2) {
+    if (deviceType === hdShared.EDeviceType.Pro2 || deviceType === hdShared.EDeviceType.Neo) {
         return 'firmware-v1';
     }
     return 'firmware';
@@ -41957,7 +41997,7 @@ const getFirmwareUpdateFieldArray = (features, updateType) => {
     if (deviceType === 'pro') {
         return ['firmware-v8'];
     }
-    if (deviceType === 'pro2') {
+    if (deviceType === 'pro2' || deviceType === 'neo') {
         return ['firmware-v1'];
     }
     return ['firmware'];
@@ -47688,9 +47728,11 @@ class CheckAllFirmwareRelease extends BaseMethod {
         });
     }
     runProtocolV2() {
+        var _a;
         return __awaiter(this, void 0, void 0, function* () {
-            const { checkFirmwareHash = false, firmwareType: firmwareTypeParam } = this
-                .payload;
+            const { checkFirmwareHash = false, firmwareType: firmwareTypeParam, platform, forceUpdateTargets, protocolV2ForceUpdateTargets, } = this.payload;
+            const validatedForceUpdateTargets = validateFirmwareUpdatePlanForceTargets(forceUpdateTargets);
+            const validatedProtocolV2ForceUpdateTargets = validateProtocolV2FirmwareUpdateTargets(protocolV2ForceUpdateTargets);
             const { state, features, firmwareType, release } = yield loadProtocolV2FirmwareReleaseContext({
                 device: this.device,
                 firmwareType: firmwareTypeParam,
@@ -47709,10 +47751,54 @@ class CheckAllFirmwareRelease extends BaseMethod {
             const resourceSource = DataManager.getProtocolV2ResourceSource(resourceDeviceType);
             const resourceStatus = 'unknown';
             const resourcePreparationRequired = !!resourceSource;
+            const detectedComponentTargets = validatedForceUpdateTargets.includes('firmware')
+                ? plan.components.flatMap(component => component.updateTarget ? [component.updateTarget] : [])
+                : plan.targetsToUpdate;
+            const componentTargetsToUpdate = Array.from(new Set([
+                ...detectedComponentTargets,
+                ...validatedProtocolV2ForceUpdateTargets.filter(target => target !== 'resource'),
+            ]));
+            const forceResourceUpdate = validatedForceUpdateTargets.includes('resource') ||
+                validatedProtocolV2ForceUpdateTargets.includes('resource');
             const targetsToUpdate = Array.from(new Set([
-                ...plan.targetsToUpdate,
-                ...(resourcePreparationRequired ? ['resource'] : []),
+                ...componentTargetsToUpdate,
+                ...(resourcePreparationRequired || forceResourceUpdate ? ['resource'] : []),
             ]));
+            let firmwareUpdatePlan;
+            try {
+                const shouldBuildFirmwareUpdatePlan = targetsToUpdate.length > 0;
+                const requestedPlatform = platform !== null && platform !== void 0 ? platform : 'web';
+                const requiresDeviceIdentity = requestedPlatform === 'native' || requestedPlatform === 'desktop';
+                const canBindPreparedPlan = !requiresDeviceIdentity || !!getDeviceSerialNo(features);
+                if (shouldBuildFirmwareUpdatePlan) {
+                    const validatedPlan = buildProtocolV2FirmwareUpdatePlan({
+                        features,
+                        firmwareType,
+                        platform: canBindPreparedPlan ? requestedPlatform : 'web',
+                        release,
+                        targetsToUpdate,
+                        forceUpdateTargets: validatedForceUpdateTargets,
+                        resourceArchive: resourceSource,
+                    });
+                    firmwareUpdatePlan = canBindPreparedPlan ? validatedPlan : undefined;
+                    if (!canBindPreparedPlan) {
+                        Log$c.warn('[CheckAllFirmwareRelease] Protocol V2 device identity is unavailable; using the release result without a prepared Plan');
+                    }
+                }
+                else {
+                    firmwareUpdatePlan = undefined;
+                }
+            }
+            catch (error) {
+                if (validatedForceUpdateTargets.length > 0 ||
+                    validatedProtocolV2ForceUpdateTargets.length > 0 ||
+                    !(error instanceof hdShared.HardwareError) ||
+                    ((_a = error.params) === null || _a === void 0 ? void 0 : _a.firmwareUpdateCode) !== 'FirmwarePlanInvalid') {
+                    throw error;
+                }
+                Log$c.warn('[CheckAllFirmwareRelease] Optional Protocol V2 firmware Plan is unavailable; using the release result');
+                firmwareUpdatePlan = undefined;
+            }
             const firmwarePlan = summarizeProtocolV2FirmwareRelease(plan, PROTOCOL_V2_MAIN_FIRMWARE_TARGETS);
             const blePlan = summarizeProtocolV2FirmwareRelease(plan, PROTOCOL_V2_BLE_TARGETS);
             const bootloaderPlan = summarizeProtocolV2FirmwareRelease(plan, PROTOCOL_V2_BOOTLOADER_TARGETS);
@@ -47728,7 +47814,8 @@ class CheckAllFirmwareRelease extends BaseMethod {
                     state,
                     release: getProtocolV2ComponentReleaseInfo(plan, 'BOOTLOADER'),
                 }), features, protocol: 'V2', deviceType: state.identity.deviceType }, plan), { status,
-                resourceStatus, resourceArchive: resourceSource, resourcePreparationRequired, hasUpgrade: plan.hasUpgrade || resourcePreparationRequired, targetsToUpdate });
+                resourceStatus, resourceArchive: resourceSource, resourcePreparationRequired, hasUpgrade: targetsToUpdate.length > 0, targetsToUpdate,
+                firmwareUpdatePlan });
         });
     }
 }
@@ -51151,6 +51238,9 @@ const PROTOCOL_V2_OKPP_HEADER_SIZE = 0x52a0;
 const PROTOCOL_V2_OKPP_PAYLOAD_HASH_OFFSET = 0x200;
 const PROTOCOL_V2_OKPP_HEADER_HASH_OFFSET = 0x240;
 const PROTOCOL_V2_OKPP_HASH_SIZE = 64;
+const PROTOCOL_V2_RESOURCE_MANIFEST_MAX_BYTES = 1024 * 1024;
+const PROTOCOL_V2_RESOURCE_FILE_MAX_COUNT = 512;
+const PROTOCOL_V2_RESOURCE_TOTAL_MAX_BYTES = 256 * 1024 * 1024;
 const PROTOCOL_V2_NEO_UNSUPPORTED_TARGETS = new Set(['se03', 'se04']);
 function assertProtocolV2FirmwareTargetsSupported(deviceType, params) {
     var _a;
@@ -51404,7 +51494,7 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
         return ['V2'];
     }
     init() {
-        var _a, _b, _c;
+        var _a, _b;
         this.allowDeviceMode = [UI_REQUEST.BOOTLOADER, UI_REQUEST.NOT_INITIALIZE];
         this.requireDeviceMode = [];
         this.unlockPolicy = 'unlock-before-run';
@@ -51439,33 +51529,24 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
             { name: 'targetsToUpdate', type: 'array', allowEmpty: true },
             { name: 'platform', type: 'string' },
             { name: 'expectedDeviceId', type: 'string' },
-            { name: 'resourceFiles', type: 'array', allowEmpty: true },
         ]);
         if (payload.expectedDeviceId !== undefined &&
             (payload.expectedDeviceId.length === 0 || payload.expectedDeviceId.length > 160)) {
             throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.CallMethodInvalidParameter, 'Protocol V2 expected device identity is invalid');
         }
-        const hostBinding = payload.preparedPlan || payload.componentArtifacts || payload.resourceBundleArtifacts
+        const hostBinding = payload.preparedPlan || payload.componentArtifacts
             ? resolveFirmwareUpdateHostBinding(payload.hostBindingGeneration)
             : undefined;
         if (hostBinding) {
+            const componentArtifacts = ((_a = payload.componentArtifacts) !== null && _a !== void 0 ? _a : {});
+            const preparedPlan = validateFirmwareUpdatePreparedPlan(payload.preparedPlan);
             assertFirmwareUpdatePreparedPlanBinding({
-                preparedPlan: payload.preparedPlan,
+                preparedPlan,
                 executor: 'v4',
                 platform: payload.platform,
-                scopeTargets: [
-                    'boot',
-                    'app_v1',
-                    'app_v2',
-                    'coprocessor',
-                    'resource',
-                    'se01',
-                    'se02',
-                    'se03',
-                    'se04',
-                ],
+                scopeTargets: ['boot', 'app_v1', 'app_v2', 'coprocessor', 'se01', 'se02', 'se03', 'se04'],
                 bindings: [
-                    ...Object.entries((_a = payload.componentArtifacts) !== null && _a !== void 0 ? _a : {}).flatMap(([target, artifact]) => artifact
+                    ...Object.entries(componentArtifacts).flatMap(([target, artifact]) => artifact
                         ? [
                             {
                                 target: target,
@@ -51473,16 +51554,13 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
                             },
                         ]
                         : []),
-                    ...((_b = payload.resourceBundleArtifacts) !== null && _b !== void 0 ? _b : []).map((entry) => ({
-                        target: 'resource',
-                        logicalName: entry.name,
-                        artifact: entry.artifact,
-                    })),
                 ],
             });
         }
         this.params = {
-            preparedPlan: payload.preparedPlan,
+            preparedPlan: payload.preparedPlan
+                ? validateFirmwareUpdatePreparedPlan(payload.preparedPlan)
+                : undefined,
             chunkSize: payload.chunkSize,
             forcedUpdateRes: payload.forcedUpdateRes,
             bootloaderBinary: payload.bootloaderBinary,
@@ -51494,15 +51572,13 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
             se02Binary: payload.se02Binary,
             se03Binary: payload.se03Binary,
             se04Binary: payload.se04Binary,
-            resourceFiles: payload.resourceFiles,
             firmwareType: payload.firmwareType,
             targetsToUpdate: payload.targetsToUpdate,
             expectedTargetVersions: payload.expectedTargetVersions,
             platform: payload.platform,
             expectedDeviceId: payload.expectedDeviceId,
-            artifactReader: (_c = hostBinding === null || hostBinding === void 0 ? void 0 : hostBinding.artifactReader) !== null && _c !== void 0 ? _c : payload.artifactReader,
+            artifactReader: (_b = hostBinding === null || hostBinding === void 0 ? void 0 : hostBinding.artifactReader) !== null && _b !== void 0 ? _b : payload.artifactReader,
             componentArtifacts: payload.componentArtifacts,
-            resourceBundleArtifacts: payload.resourceBundleArtifacts,
         };
     }
     getProtocolV2FirmwareChunkSize(direction, filePath) {
@@ -51533,7 +51609,7 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
         });
     }
     runProtocolV2() {
-        var _a, _b, _c, _d, _e, _f;
+        var _a, _b, _c, _d;
         return __awaiter(this, void 0, void 0, function* () {
             yield this.captureProtocolV2PhysicalIdentity();
             const deviceFeatures = yield this.getProtocolV2DeviceFeatures();
@@ -51545,20 +51621,15 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
             const deviceFirmwareType = getFirmwareType(deviceFeatures);
             const firmwareType = (_a = this.params.firmwareType) !== null && _a !== void 0 ? _a : deviceFirmwareType;
             this.validateExpectedTargetVersions();
-            if ((this.params.componentArtifacts && Object.keys(this.params.componentArtifacts).length > 0) ||
-                ((_b = this.params.resourceBundleArtifacts) === null || _b === void 0 ? void 0 : _b.length)) {
+            if (this.params.preparedPlan) {
                 return this.runProtocolV2PreparedArtifacts(deviceFeatures, firmwareType);
             }
-            const hasExplicitResourceFiles = !!((_c = this.params.resourceFiles) === null || _c === void 0 ? void 0 : _c.length);
-            const wantsResources = !!((_d = this.params.targetsToUpdate) === null || _d === void 0 ? void 0 : _d.includes('resource'));
-            const needsPreparedResources = !hasExplicitResourceFiles && wantsResources;
+            const wantsResources = !!((_b = this.params.targetsToUpdate) === null || _b === void 0 ? void 0 : _b.includes('resource'));
             let fwBinaryMap = [];
             let bootloaderBinary = null;
             let installItems;
-            let resourceBundles;
             try {
                 this.postTipMessage(exports.FirmwareUpdateTipMessage.StartDownloadFirmware);
-                resourceBundles = this.prepareExplicitProtocolV2ResourceFiles();
                 fwBinaryMap = this.collectExplicitTargetBinaries();
                 bootloaderBinary = this.prepareBootloaderBinary();
                 const explicitInstallItems = this.buildProtocolV2InstallItems({
@@ -51566,10 +51637,10 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
                     fwBinaryMap,
                 });
                 const missingFirmwareTargets = this.getMissingProtocolV2FirmwareTargets(explicitInstallItems);
-                const needsRemoteFirmware = ((_e = this.params.targetsToUpdate) === null || _e === void 0 ? void 0 : _e.length)
+                const needsRemoteFirmware = ((_c = this.params.targetsToUpdate) === null || _c === void 0 ? void 0 : _c.length)
                     ? missingFirmwareTargets.length > 0
-                    : !this.hasExplicitProtocolV2Payload(explicitInstallItems);
-                if (needsPreparedResources) {
+                    : explicitInstallItems.length === 0;
+                if (wantsResources) {
                     throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 resource manifest must be prepared by the external firmware host', {
                         firmwareUpdateCode: 'FirmwareArtifactsNotPrepared',
                     });
@@ -51596,7 +51667,7 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
                 if (typeof err === 'object' &&
                     err !== null &&
                     'params' in err &&
-                    ((_f = err.params) === null || _f === void 0 ? void 0 : _f.firmwareUpdateCode) === 'FirmwareArtifactsNotPrepared') {
+                    ((_d = err.params) === null || _d === void 0 ? void 0 : _d.firmwareUpdateCode) === 'FirmwareArtifactsNotPrepared') {
                     throw err;
                 }
                 if (err instanceof hdShared.HardwareError && err.errorCode === hdShared.HardwareErrorCode.NetworkError) {
@@ -51604,14 +51675,11 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
                 }
                 throw normalizeFirmwarePreparationError(err);
             }
-            if (!bootloaderBinary &&
-                fwBinaryMap.length === 0 &&
-                !(installItems === null || installItems === void 0 ? void 0 : installItems.length) &&
-                !(resourceBundles === null || resourceBundles === void 0 ? void 0 : resourceBundles.length)) {
+            if (!bootloaderBinary && fwBinaryMap.length === 0 && !(installItems === null || installItems === void 0 ? void 0 : installItems.length)) {
                 throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.FirmwareUpdateDownloadFailed, 'No firmware to update');
             }
-            return this.executeProtocolV2Update(Object.assign(Object.assign({ fwBinaryMap,
-                bootloaderBinary }, (installItems ? { installItems } : undefined)), ((resourceBundles === null || resourceBundles === void 0 ? void 0 : resourceBundles.length) ? { resourceBundles } : undefined)));
+            return this.executeProtocolV2Update(Object.assign({ fwBinaryMap,
+                bootloaderBinary }, (installItems ? { installItems } : undefined)));
         });
     }
     openProtocolV2PreparedSource(artifact) {
@@ -51678,39 +51746,87 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
             return installSources;
         });
     }
-    prepareProtocolV2ResourceSources(firmwareType, features) {
-        var _a, _b, _c;
+    prepareProtocolV2ResourceSources() {
+        var _a, _b;
         return __awaiter(this, void 0, void 0, function* () {
-            const preparedArtifacts = (_a = this.params.resourceBundleArtifacts) !== null && _a !== void 0 ? _a : [];
-            const resourceRequested = ((_b = this.params.targetsToUpdate) === null || _b === void 0 ? void 0 : _b.includes('resource')) || preparedArtifacts.length > 0;
+            const resourceRequested = (_b = (_a = this.params.targetsToUpdate) === null || _a === void 0 ? void 0 : _a.includes('resource')) !== null && _b !== void 0 ? _b : false;
             if (!resourceRequested) {
                 return [];
             }
-            const release = DataManager.getFirmwareLatestRelease(features, firmwareType);
-            const descriptors = (_c = release === null || release === void 0 ? void 0 : release.resourceBundles) !== null && _c !== void 0 ? _c : [];
-            const artifactByName = new Map(preparedArtifacts.map(item => [item.name, item.artifact]));
-            const sources = [];
-            for (const descriptor of descriptors) {
-                const artifact = artifactByName.get(descriptor.name);
-                if (!artifact) {
-                    throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Protocol V2 resource bundle ${descriptor.name} is not prepared`, {
-                        firmwareUpdateCode: 'FirmwareArtifactsNotPrepared',
-                        artifactName: descriptor.name,
-                    });
-                }
-                const devicePath = validateProtocolV2FilesystemPath(descriptor.devicePath, 'resourceBundles[].devicePath');
-                sources.push({
-                    name: descriptor.name,
-                    source: yield this.openProtocolV2PreparedSource(artifact),
-                    devicePath,
-                    version: descriptor.version,
-                    payloadHash: descriptor.payloadHash,
-                    headerHash: descriptor.headerHash,
-                });
-                artifactByName.delete(descriptor.name);
+            const archiveSources = yield this.prepareProtocolV2ResourceArchiveSources();
+            if (archiveSources) {
+                return archiveSources;
+            }
+            throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 resource archive is not prepared', { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
+        });
+    }
+    prepareProtocolV2ResourceArchiveSources() {
+        var _a, _b, _c, _d;
+        return __awaiter(this, void 0, void 0, function* () {
+            const archiveArtifacts = (_b = (_a = this.params.preparedPlan) === null || _a === void 0 ? void 0 : _a.artifacts.filter(artifact => artifact.role === 'resourceBundle' &&
+                artifact.target === 'resource' &&
+                artifact.container === 'zip')) !== null && _b !== void 0 ? _b : [];
+            if (archiveArtifacts.length === 0) {
+                return undefined;
+            }
+            if (archiveArtifacts.length !== 1) {
+                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 prepared plan must contain exactly one resource archive', { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
             }
-            if (artifactByName.size > 0) {
-                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Protocol V2 release does not contain resource bundle ${artifactByName.keys().next().value}`);
+            const entries = (_c = archiveArtifacts[0].materializedEntries) !== null && _c !== void 0 ? _c : [];
+            const manifestEntry = entries.find(entry => entry.entryName === 'manifest.json');
+            if (!manifestEntry ||
+                manifestEntry.artifact.size <= 0 ||
+                manifestEntry.artifact.size > PROTOCOL_V2_RESOURCE_MANIFEST_MAX_BYTES) {
+                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 prepared resource archive has no valid manifest.json', { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
+            }
+            const manifestSource = yield this.openProtocolV2PreparedSource(manifestEntry.artifact);
+            let manifestValue;
+            try {
+                manifestValue = JSON.parse(new TextDecoder().decode(yield readFirmwareByteSourceFully(manifestSource)));
+            }
+            catch (error) {
+                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Protocol V2 prepared resource manifest is invalid: ${String(error)}`, { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
+            }
+            const manifest = parseProtocolV2ResourceManifest(manifestValue);
+            const selectedFiles = selectProtocolV2ResourceManifestFiles({
+                manifest,
+                targetsToUpdate: (_d = this.params.targetsToUpdate) !== null && _d !== void 0 ? _d : [],
+            });
+            if (selectedFiles.length > PROTOCOL_V2_RESOURCE_FILE_MAX_COUNT) {
+                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 prepared resource archive contains too many files', { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
+            }
+            const entriesByName = new Map(entries.map(entry => [entry.entryName, entry]));
+            const expectedEntryNames = new Set([
+                'manifest.json',
+                ...selectedFiles.map(file => file.archive_path),
+            ]);
+            if (entries.some(entry => !expectedEntryNames.has(entry.entryName))) {
+                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 prepared resource archive contains an unexpected entry', { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
+            }
+            let totalSize = 0;
+            const sources = [];
+            for (const [index, file] of selectedFiles.entries()) {
+                const entry = entriesByName.get(file.archive_path);
+                if (!entry ||
+                    entry.artifact.size !== file.size ||
+                    entry.artifact.sha256.toLowerCase() !== file.sha256.toLowerCase()) {
+                    throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Protocol V2 prepared resource file does not match manifest: ${file.archive_path}`, { firmwareUpdateCode: 'FirmwareArtifactReceiptMismatch' });
+                }
+                totalSize += entry.artifact.size;
+                if (totalSize > PROTOCOL_V2_RESOURCE_TOTAL_MAX_BYTES) {
+                    throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 prepared resource archive exceeds the total size limit', { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
+                }
+                const source = yield this.openProtocolV2PreparedSource(entry.artifact);
+                const header = source.size >= PROTOCOL_V2_OKPP_HEADER_SIZE
+                    ? parseProtocolV2OkppHeader(new Uint8Array(yield source.readAt(0, PROTOCOL_V2_OKPP_HEADER_SIZE)))
+                    : null;
+                sources.push(Object.assign({ name: file.original_name || `resource-${index}`, source, devicePath: file.device_path }, (header
+                    ? {
+                        version: header.version,
+                        payloadHash: header.payloadHash,
+                        headerHash: header.headerHash,
+                    }
+                    : {})));
             }
             return sources;
         });
@@ -51720,19 +51836,7 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
             try {
                 this.postTipMessage(exports.FirmwareUpdateTipMessage.StartDownloadFirmware);
                 const installSources = yield this.prepareProtocolV2InstallSources(firmwareType, features);
-                const explicitResourceBundles = this.prepareExplicitProtocolV2ResourceFiles();
-                const resourceSources = (explicitResourceBundles === null || explicitResourceBundles === void 0 ? void 0 : explicitResourceBundles.length)
-                    ? yield Promise.all(explicitResourceBundles.map((bundle) => __awaiter(this, void 0, void 0, function* () {
-                        return ({
-                            name: bundle.name,
-                            source: yield this.openProtocolV2MemorySource(bundle.binary),
-                            devicePath: bundle.devicePath,
-                            version: bundle.version,
-                            payloadHash: bundle.payloadHash,
-                            headerHash: bundle.headerHash,
-                        });
-                    })))
-                    : yield this.prepareProtocolV2ResourceSources(firmwareType, features);
+                const resourceSources = yield this.prepareProtocolV2ResourceSources();
                 if (installSources.length === 0 && resourceSources.length === 0) {
                     throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.FirmwareUpdateDownloadFailed, 'No firmware to update');
                 }
@@ -51816,15 +51920,15 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
         }
     }
     getProtocolV2RequestedTargets() {
-        var _a, _b, _c, _d;
+        var _a, _b, _c;
         if ((_a = this.params.targetsToUpdate) === null || _a === void 0 ? void 0 : _a.length) {
             return [...new Set(this.params.targetsToUpdate)];
         }
-        const targets = new Set();
-        Object.keys((_b = this.params.componentArtifacts) !== null && _b !== void 0 ? _b : {}).forEach(target => targets.add(target));
-        if (((_c = this.params.resourceBundleArtifacts) === null || _c === void 0 ? void 0 : _c.length) || ((_d = this.params.resourceFiles) === null || _d === void 0 ? void 0 : _d.length)) {
-            targets.add('resource');
+        if ((_b = this.params.preparedPlan) === null || _b === void 0 ? void 0 : _b.targetsToUpdate.length) {
+            return [...new Set(this.params.preparedPlan.targetsToUpdate)];
         }
+        const targets = new Set();
+        Object.keys((_c = this.params.componentArtifacts) !== null && _c !== void 0 ? _c : {}).forEach(target => targets.add(target));
         if (this.params.bootloaderBinary)
             targets.add('boot');
         if (this.params.applicationP1Binary)
@@ -51911,10 +52015,6 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
         var _a;
         return (_a = this.params.bootloaderBinary) !== null && _a !== void 0 ? _a : null;
     }
-    hasExplicitProtocolV2Payload(installItems) {
-        var _a;
-        return !!((_a = this.params.resourceFiles) === null || _a === void 0 ? void 0 : _a.length) || installItems.length > 0;
-    }
     getMissingProtocolV2FirmwareTargets(installItems) {
         var _a;
         const preparedTargets = new Set(installItems.flatMap(item => {
@@ -52041,39 +52141,6 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
             };
         });
     }
-    prepareExplicitProtocolV2ResourceFiles() {
-        var _a;
-        const files = (_a = this.params.resourceFiles) !== null && _a !== void 0 ? _a : [];
-        if (!(files === null || files === void 0 ? void 0 : files.length))
-            return undefined;
-        const prepared = files.map((file, index) => {
-            var _a;
-            const devicePath = validateProtocolV2FilesystemPath(file.devicePath, `resourceFiles[${index}].devicePath`);
-            const descriptor = file;
-            if (descriptor.size !== undefined && descriptor.size !== file.binary.byteLength) {
-                throw new Error(`resourceFiles[${index}] size mismatch`);
-            }
-            if (descriptor.fileHash &&
-                !isProtocolV2ResourceFileValid(file.binary, {
-                    size: file.binary.byteLength,
-                    fileHash: descriptor.fileHash,
-                })) {
-                throw new Error(`resourceFiles[${index}] SHA-256 mismatch`);
-            }
-            const header = parseProtocolV2OkppHeader(toProtocolV2Bytes(file.binary));
-            return Object.assign({ name: (_a = devicePath.split('/').pop()) !== null && _a !== void 0 ? _a : devicePath, binary: file.binary, devicePath }, (header
-                ? {
-                    version: header.version,
-                    payloadHash: header.payloadHash,
-                    headerHash: header.headerHash,
-                }
-                : {}));
-        });
-        if (new Set(prepared.map(file => file.devicePath)).size !== prepared.length) {
-            throw new Error('resourceFiles contain duplicate devicePath values');
-        }
-        return prepared;
-    }
     getProtocolV2ResourceFilePath(path) {
         if (path.startsWith('vol'))
             return path;
@@ -52330,7 +52397,7 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
             });
         });
     }
-    executeProtocolV2Update({ fwBinaryMap, bootloaderBinary, installItems, resourceBundles, }) {
+    executeProtocolV2Update({ fwBinaryMap, bootloaderBinary, installItems, }) {
         return __awaiter(this, void 0, void 0, function* () {
             const memoryInstallItems = installItems !== null && installItems !== void 0 ? installItems : this.buildProtocolV2InstallItems({
                 fwBinaryMap: fwBinaryMap !== null && fwBinaryMap !== void 0 ? fwBinaryMap : [],
@@ -52345,19 +52412,9 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
                         kind: item.kind,
                     });
                 })));
-                const resourceSources = yield Promise.all((resourceBundles !== null && resourceBundles !== void 0 ? resourceBundles : []).map((bundle) => __awaiter(this, void 0, void 0, function* () {
-                    return ({
-                        name: bundle.name,
-                        source: yield this.openProtocolV2MemorySource(bundle.binary),
-                        devicePath: bundle.devicePath,
-                        version: bundle.version,
-                        payloadHash: bundle.payloadHash,
-                        headerHash: bundle.headerHash,
-                    });
-                })));
                 return yield this.executeProtocolV2Phases({
                     installSources,
-                    resourceSources,
+                    resourceSources: [],
                 });
             }
             finally {
@@ -64970,6 +65027,108 @@ const switchTransport = ({ env, Transport, plugin, }) => {
     initConnector();
 };
 
+let memoryHostSequence = 0;
+const FIRMWARE_UPDATE_V4_COMPONENT_TARGETS = new Set([
+    'boot',
+    'app_v1',
+    'app_v2',
+    'coprocessor',
+    'se01',
+    'se02',
+    'se03',
+    'se04',
+]);
+const isFirmwareUpdateV4ComponentTarget = (target) => FIRMWARE_UPDATE_V4_COMPONENT_TARGETS.has(target);
+const createReference = (binary, prefix) => {
+    const digest = utils.bytesToHex(sha256.sha256(new Uint8Array(binary)));
+    return {
+        artifactRef: `fwmem:${prefix}:${digest.slice(0, 32)}`,
+        size: binary.byteLength,
+        sha256: digest,
+    };
+};
+function prepareFirmwareUpdateV4MemoryHost({ sdk, plan, artifacts, }) {
+    if (plan.executor !== 'v4') {
+        throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Firmware memory host only supports V4 plans');
+    }
+    memoryHostSequence += 1;
+    const hostId = `${Date.now()}:${memoryHostSequence}`;
+    const binaries = new Map();
+    const inputs = artifacts.map((input, artifactIndex) => {
+        var _a;
+        const artifact = createReference(input.binary, `${hostId}:artifact:${artifactIndex}`);
+        binaries.set(artifact.artifactRef, new Uint8Array(input.binary));
+        const materializedEntries = (_a = input.materializedEntries) === null || _a === void 0 ? void 0 : _a.map((entry, entryIndex) => {
+            const entryArtifact = createReference(entry.binary, `${hostId}:entry:${artifactIndex}:${entryIndex}`);
+            binaries.set(entryArtifact.artifactRef, new Uint8Array(entry.binary));
+            return {
+                entryName: entry.entryName,
+                artifact: entryArtifact,
+            };
+        });
+        return Object.assign({ artifactId: input.artifactId, artifact }, ((materializedEntries === null || materializedEntries === void 0 ? void 0 : materializedEntries.length) ? { materializedEntries } : {}));
+    });
+    const preparedPlan = sdk.prepareFirmwareUpdatePlan({
+        plan,
+        leaseRef: `fwmemlease:${hostId}`,
+        artifacts: inputs,
+    });
+    const readers = new Map();
+    let readerSequence = 0;
+    const artifactReader = {
+        open({ artifactRef }) {
+            const binary = binaries.get(artifactRef);
+            if (!binary) {
+                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Firmware memory artifact is unavailable');
+            }
+            readerSequence += 1;
+            const readerId = `fwmemreader:${hostId}:${readerSequence}`;
+            readers.set(readerId, binary);
+            return Promise.resolve({ readerId, size: binary.byteLength });
+        },
+        read({ readerId, offset, length }) {
+            const binary = readers.get(readerId);
+            if (!binary || offset < 0 || length <= 0 || offset + length > binary.byteLength) {
+                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Firmware memory artifact read is invalid');
+            }
+            const data = binary.slice(offset, offset + length).buffer;
+            return Promise.resolve({
+                data,
+                bytesRead: data.byteLength,
+                eof: offset + length === binary.byteLength,
+            });
+        },
+        close({ readerId }) {
+            readers.delete(readerId);
+            return Promise.resolve();
+        },
+    };
+    const hostBindingGeneration = sdk.registerFirmwareUpdateHostBinding({ artifactReader });
+    const componentArtifacts = {};
+    const expectedTargetVersions = {};
+    for (const artifact of preparedPlan.artifacts) {
+        if (artifact.role === 'component' && isFirmwareUpdateV4ComponentTarget(artifact.target)) {
+            componentArtifacts[artifact.target] = artifact.artifact;
+        }
+        if (artifact.targetVersion) {
+            expectedTargetVersions[artifact.target] = artifact.targetVersion;
+        }
+    }
+    return {
+        preparedPlan,
+        hostBindingGeneration,
+        targetsToUpdate: [...preparedPlan.targetsToUpdate],
+        expectedDeviceId: preparedPlan.deviceIdentity,
+        expectedTargetVersions,
+        componentArtifacts,
+        release: () => {
+            sdk.unregisterFirmwareUpdateHostBinding(hostBindingGeneration);
+            readers.clear();
+            binaries.clear();
+        },
+    };
+}
+
 const HardwareSdk = ({ init, call, dispose, eventEmitter, uiResponse, cancel, updateSettings, switchTransport, }) => inject({
     init,
     call,
@@ -65107,7 +65266,7 @@ exports.parseMessage = parseMessage;
 exports.parseProtocolV2ResourceManifest = parseProtocolV2ResourceManifest;
 exports.patchFeatures = patchFeatures;
 exports.preloadSessionCache = preloadSessionCache;
-exports.prepareProtocolV2ResourceFiles = prepareProtocolV2ResourceFiles;
+exports.prepareFirmwareUpdateV4MemoryHost = prepareFirmwareUpdateV4MemoryHost;
 exports.projectDeviceStateFeatures = projectFeatures;
 exports.registerFirmwareUpdateHostBinding = registerFirmwareUpdateHostBinding;
 exports.safeThrowError = safeThrowError;