@onekeyfe/hd-core 1.2.0-alpha.84 → 1.2.0-alpha.86

package/dist/index.js

@@ -798,7 +798,7 @@ const getExecutor = (features) => {
     }
     return 'v2';
 };
-const buildProtocolV2Artifacts = (release, { includeComponents = true, includeResources = true, componentTargets: selectedComponentTargets, } = {}) => {
+const buildProtocolV2Artifacts = (release, { includeComponents = true, componentTargets: selectedComponentTargets, } = {}) => {
     var _a;
     const components = asRecord(release.components);
     if (includeComponents && !components) {
@@ -842,26 +842,6 @@ const buildProtocolV2Artifacts = (release, { includeComponents = true, includeRe
         })), (asVersion(component.version) ? { targetVersion: asVersion(component.version) } : {})));
         targets.push(target);
     }
-    const bundles = includeResources && Array.isArray(release.resourceBundles) ? release.resourceBundles : [];
-    const resourceBundleNames = new Set();
-    for (const value of bundles) {
-        const bundle = asRecord(value);
-        const name = asString(bundle === null || bundle === void 0 ? void 0 : bundle.name);
-        if (!bundle || !name) {
-            throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 resource bundle is invalid', { firmwareUpdateCode: 'FirmwarePlanInvalid' });
-        }
-        if (resourceBundleNames.has(name)) {
-            throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Protocol V2 resource bundle duplicates name ${name}`, { firmwareUpdateCode: 'FirmwarePlanInvalid' });
-        }
-        resourceBundleNames.add(name);
-        artifacts.push(Object.assign({ artifactId: `resourceBundle:${name}`, role: 'resourceBundle', target: 'resource', url: assertArtifactUrl(bundle.url, `Protocol V2 resource bundle ${name}`), container: 'raw', logicalName: name }, asIntegrity({
-            size: bundle.expectedSize,
-            sha256: bundle.fingerprint,
-        })));
-    }
-    if (bundles.length > 0) {
-        targets.push('resource');
-    }
     return { artifacts, targets: [...new Set(targets)] };
 };
 const isForcedTargetRepresented = ({ executor, forcedTarget, artifacts, targetsToUpdate, }) => {
@@ -913,7 +893,7 @@ const finalizeFirmwareUpdatePlan = ({ features, firmwareType, platform, artifact
     };
     return assertFirmwareUpdatePlan(Object.assign(Object.assign({}, planWithoutDigest), { planDigest: digestFirmwareUpdatePlan(planWithoutDigest) }));
 };
-const buildProtocolV2FirmwareUpdatePlan = ({ features, firmwareType, platform, release, targetsToUpdate, forceUpdateTargets, resourceArchiveAvailable, }) => {
+const buildProtocolV2FirmwareUpdatePlan = ({ features, firmwareType, platform, release, targetsToUpdate, forceUpdateTargets, resourceArchive, }) => {
     const validatedForceTargets = validateFirmwareUpdatePlanForceTargets(forceUpdateTargets);
     if (validatedForceTargets.some(target => target === 'ble' || target === 'bootloader')) {
         planError('Protocol V2 does not support forced BLE or legacy bootloader targets');
@@ -925,9 +905,24 @@ const buildProtocolV2FirmwareUpdatePlan = ({ features, firmwareType, platform, r
     }
     const protocolV2 = buildProtocolV2Artifacts(release !== null && release !== void 0 ? release : {}, {
         includeComponents: requestedComponentTargets.size > 0,
-        includeResources: false,
         componentTargets: requestedComponentTargets,
     });
+    const resourceRequested = targetsToUpdate.includes('resource');
+    if (resourceRequested) {
+        const archive = resourceArchive;
+        if (!archive) {
+            return planError('Protocol V2 resource target has no resource archive');
+        }
+        const integrity = asIntegrity({
+            size: archive.archiveSize,
+            sha256: archive.archiveSha256,
+        });
+        if (integrity.expectedSize === undefined || integrity.expectedSha256 === undefined) {
+            planError('Protocol V2 resource archive integrity metadata is invalid');
+        }
+        protocolV2.artifacts.push(Object.assign({ artifactId: 'resource:archive', role: 'resourceBundle', target: 'resource', url: assertArtifactUrl(archive.archiveUrl, 'Protocol V2 resource archive'), container: 'zip', logicalName: 'protocol-v2-resource-archive' }, integrity));
+        protocolV2.targets.push('resource');
+    }
     const representedTargets = new Set(protocolV2.targets);
     const missingTarget = Array.from(requestedComponentTargets).find(target => !representedTargets.has(target));
     if (missingTarget) {
@@ -936,7 +931,7 @@ const buildProtocolV2FirmwareUpdatePlan = ({ features, firmwareType, platform, r
     if (validatedForceTargets.includes('firmware') && protocolV2.targets.length === 0) {
         planError('Forced firmware update target firmware is not represented by the plan');
     }
-    if (validatedForceTargets.includes('resource') && !resourceArchiveAvailable) {
+    if (validatedForceTargets.includes('resource') && !resourceArchive) {
         planError('Forced firmware update target resource has no Protocol V2 resource archive');
     }
     return finalizeFirmwareUpdatePlan({
@@ -968,7 +963,6 @@ const buildFirmwareUpdatePlan = ({ features, firmwareType, platform, firmware, b
     if (executor === 'v4' && (shouldUpdateFirmware || shouldUpdateResource)) {
         const protocolV2 = buildProtocolV2Artifacts(firmwareRelease !== null && firmwareRelease !== void 0 ? firmwareRelease : {}, {
             includeComponents: shouldUpdateFirmware,
-            includeResources: shouldUpdateResource,
         });
         artifacts = protocolV2.artifacts;
         targetsToUpdate = protocolV2.targets;
@@ -1160,7 +1154,7 @@ const prepareFirmwareUpdatePlan = ({ plan: value, leaseRef, artifacts, }) => {
     return Object.assign(Object.assign({}, planWithoutDigest), { preparedPlanDigest: digestPreparedPlan(planWithoutDigest) });
 };
 const validateFirmwareUpdatePreparedPlan = (value) => {
-    var _a, _b, _c;
+    var _a, _b, _c, _d;
     if (!value || typeof value !== 'object' || Array.isArray(value)) {
         return preparedPlanError('Firmware prepared plan must be an object');
     }
@@ -1240,7 +1234,13 @@ const validateFirmwareUpdatePreparedPlan = (value) => {
         artifactIds.add(artifact.artifactId);
         artifactTargets.add(artifact.target);
         assertFirmwareArtifactReference(artifact.artifact);
-        (_c = artifact.materializedEntries) === null || _c === void 0 ? void 0 : _c.forEach(assertPreparedEntry);
+        const materializedEntryNames = (_d = (_c = artifact.materializedEntries) === null || _c === void 0 ? void 0 : _c.map(entry => {
+            assertPreparedEntry(entry);
+            return getFirmwareUpdateResourceName(entry.entryName).toLowerCase();
+        })) !== null && _d !== void 0 ? _d : [];
+        if (new Set(materializedEntryNames).size !== materializedEntryNames.length) {
+            return preparedPlanError('Firmware prepared plan contains duplicate entry names');
+        }
     }
     if (preparedPlan.targetsToUpdate.some(target => !FIRMWARE_UPDATE_PLAN_TARGETS.has(target)) ||
         new Set(preparedPlan.targetsToUpdate).size !== preparedPlan.targetsToUpdate.length ||
@@ -1335,201 +1335,6 @@ const assertFirmwareUpdatePreparedPlanBinding = ({ preparedPlan: value, executor
     return preparedPlan;
 };
 
-const PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_PATH$1 = 'vol0:/loaders/bootloader/boot_resource.okpkg';
-const SHA256_HEX_LENGTH = 64;
-function normalizeHex$1(value, expectedLength, field) {
-    if (typeof value !== 'string') {
-        throw new Error(`Invalid Pro2 resource ${field}: expected a hexadecimal string`);
-    }
-    const normalized = value.replace(/^0x/i, '').toLowerCase();
-    if (normalized.length !== expectedLength || !/^[0-9a-f]+$/.test(normalized)) {
-        throw new Error(`Invalid Pro2 resource ${field}: expected ${expectedLength} hexadecimal characters`);
-    }
-    return normalized;
-}
-function parseProtocolV2Resources(value) {
-    if (value === undefined)
-        return undefined;
-    if (!value || typeof value !== 'object') {
-        throw new Error('Invalid Pro2 resources config');
-    }
-    const { source } = value;
-    if (!source || typeof source !== 'object') {
-        throw new Error('Invalid Pro2 resources config: source is required');
-    }
-    const { archiveUrl, archiveSha256, archiveSize } = source;
-    if (typeof archiveUrl !== 'string' || !archiveUrl.startsWith('https://')) {
-        throw new Error('Invalid Pro2 resources config: source.archiveUrl must use HTTPS');
-    }
-    if (typeof archiveSha256 !== 'string' || !/^[0-9a-fA-F]{64}$/.test(archiveSha256)) {
-        throw new Error('Invalid Pro2 resources config: source.archiveSha256 must be a SHA-256 digest');
-    }
-    if (!Number.isSafeInteger(archiveSize) || archiveSize <= 0) {
-        throw new Error('Invalid Pro2 resources config: source.archiveSize must be a positive integer');
-    }
-    return {
-        source: {
-            archiveUrl,
-            archiveSha256: archiveSha256.toLowerCase(),
-            archiveSize: archiveSize,
-        },
-    };
-}
-const PROTOCOL_V2_RESOURCE_MANIFEST_DEVICE_ROOTS = [
-    'vol0:/bundles/',
-    'vol0:/loaders/rom/',
-];
-function isAllowedManifestDevicePath(path) {
-    if (!path.endsWith('.okpkg') ||
-        path.includes('\\') ||
-        path.includes('//') ||
-        path.split('/').some(part => part === '.' || part === '..')) {
-        return false;
-    }
-    if (path === PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_PATH$1) {
-        return true;
-    }
-    return PROTOCOL_V2_RESOURCE_MANIFEST_DEVICE_ROOTS.some(root => path.startsWith(root));
-}
-function assertManifestString(value, field) {
-    if (typeof value !== 'string' || value.length === 0) {
-        throw new Error(`Invalid Pro2 resource manifest ${field}`);
-    }
-    return value;
-}
-function assertManifestRelativePath(value, field) {
-    const path = assertManifestString(value, field);
-    if (path.startsWith('/') ||
-        path.includes('\\') ||
-        path.includes(':') ||
-        path.split('/').some(part => !part || part === '.' || part === '..')) {
-        throw new Error(`Invalid Pro2 resource manifest ${field}`);
-    }
-    return path;
-}
-function parseProtocolV2ResourceManifestFile(value, index) {
-    var _a;
-    if (!value || typeof value !== 'object' || Array.isArray(value)) {
-        throw new Error(`Invalid Pro2 resource manifest files[${index}]`);
-    }
-    const file = value;
-    const archivePath = assertManifestRelativePath(file.archive_path, `files[${index}].archive_path`);
-    const originalName = assertManifestRelativePath(file.original_name, `files[${index}].original_name`);
-    if (originalName.includes('/')) {
-        throw new Error(`Invalid Pro2 resource manifest files[${index}].original_name`);
-    }
-    const devicePath = assertManifestString(file.device_path, `files[${index}].device_path`);
-    if (!isAllowedManifestDevicePath(devicePath)) {
-        throw new Error(`Invalid Pro2 resource manifest files[${index}].device_path`);
-    }
-    if (!Number.isSafeInteger(file.size) || Number(file.size) <= 0) {
-        throw new Error(`Invalid Pro2 resource manifest files[${index}].size`);
-    }
-    const digest = normalizeHex$1(file.sha256, SHA256_HEX_LENGTH, `files[${index}].sha256`);
-    if (file.signed !== true) {
-        throw new Error(`Invalid Pro2 resource manifest files[${index}].signed`);
-    }
-    if (file.sig_algo !== 'ed25519' && file.sig_algo !== 'mldsa65') {
-        throw new Error(`Invalid Pro2 resource manifest files[${index}].sig_algo`);
-    }
-    if (file.payload_version !== null && typeof file.payload_version !== 'string') {
-        throw new Error(`Invalid Pro2 resource manifest files[${index}].payload_version`);
-    }
-    if (!archivePath.endsWith('.okpkg') || !originalName.endsWith('.okpkg')) {
-        throw new Error(`Invalid Pro2 resource manifest files[${index}] package extension`);
-    }
-    return {
-        archive_path: archivePath,
-        original_name: originalName,
-        device_path: devicePath,
-        size: Number(file.size),
-        sha256: digest,
-        signed: true,
-        sig_algo: file.sig_algo,
-        payload_version: (_a = file.payload_version) !== null && _a !== void 0 ? _a : null,
-    };
-}
-function parseProtocolV2ResourceManifest(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value)) {
-        throw new Error('Invalid Pro2 resource manifest');
-    }
-    const manifest = value;
-    if (manifest.schema !== 1 ||
-        manifest.variant !== 'resource' ||
-        manifest.device_root !== 'vol0:' ||
-        manifest.restore_mode !== 'bootloader_update' ||
-        !Array.isArray(manifest.trees) ||
-        !Array.isArray(manifest.files)) {
-        throw new Error('Invalid Pro2 resource manifest contract');
-    }
-    const files = manifest.files.map(parseProtocolV2ResourceManifestFile);
-    const devicePaths = new Set(files.map(file => file.device_path));
-    const archivePaths = new Set(files.map(file => file.archive_path));
-    if (files.length === 0 ||
-        devicePaths.size !== files.length ||
-        archivePaths.size !== files.length ||
-        !devicePaths.has(PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_PATH$1) ||
-        !files.some(file => file.device_path.startsWith('vol0:/bundles/'))) {
-        throw new Error('Invalid Pro2 resource manifest file set');
-    }
-    return {
-        schema: 1,
-        artifact_name: assertManifestString(manifest.artifact_name, 'artifact_name'),
-        release_name: assertManifestString(manifest.release_name, 'release_name'),
-        variant: 'resource',
-        commit: assertManifestString(manifest.commit, 'commit'),
-        short_sha: assertManifestString(manifest.short_sha, 'short_sha'),
-        timestamp_utc: assertManifestString(manifest.timestamp_utc, 'timestamp_utc'),
-        core_version: assertManifestString(manifest.core_version, 'core_version'),
-        key_set: assertManifestString(manifest.key_set, 'key_set'),
-        device_root: 'vol0:',
-        restore_mode: 'bootloader_update',
-        trees: manifest.trees.map((tree, index) => {
-            if (!tree || typeof tree !== 'object') {
-                throw new Error(`Invalid Pro2 resource manifest trees[${index}]`);
-            }
-            const item = tree;
-            return {
-                path: assertManifestRelativePath(item.path, `trees[${index}].path`),
-                device: assertManifestString(item.device, `trees[${index}].device`),
-            };
-        }),
-        files,
-    };
-}
-function selectProtocolV2ResourceManifestFiles({ manifest, targetsToUpdate, }) {
-    return targetsToUpdate.includes('resource') ? [...manifest.files] : [];
-}
-function prepareProtocolV2ResourceFiles({ manifest: value, files, targetsToUpdate, }) {
-    const manifest = parseProtocolV2ResourceManifest(value);
-    const selected = selectProtocolV2ResourceManifestFiles({ manifest, targetsToUpdate });
-    const binaries = new Map(files.map(file => [file.archivePath, file.binary]));
-    return selected.map(file => {
-        const binary = binaries.get(file.archive_path);
-        if (!binary ||
-            !isProtocolV2ResourceFileValid(binary, {
-                size: file.size,
-                fileHash: file.sha256,
-            })) {
-            throw new Error(`Pro2 resource manifest file verification failed: ${file.archive_path}`);
-        }
-        return {
-            binary,
-            devicePath: file.device_path,
-            size: file.size,
-            fileHash: file.sha256,
-        };
-    });
-}
-function bytesToHex$3(bytes) {
-    return Array.from(bytes, byte => byte.toString(16).padStart(2, '0')).join('');
-}
-function isProtocolV2ResourceFileValid(binary, resource) {
-    if (binary.byteLength !== resource.size)
-        return false;
-    return bytesToHex$3(sha256.sha256(new Uint8Array(binary))) === resource.fileHash.toLowerCase();
-}
-
 const bindingError = (message) => {
     throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, message, {
         firmwareUpdateCode: 'FirmwareArtifactReaderInvalid',
@@ -1542,6 +1347,8 @@ class FirmwareHostBindingRegistry {
     register(binding) {
         var _a;
         if (!binding ||
+            typeof binding.preparedPlanDigest !== 'string' ||
+            !/^[0-9a-f]{64}$/i.test(binding.preparedPlanDigest) ||
             typeof ((_a = binding.artifactReader) === null || _a === void 0 ? void 0 : _a.open) !== 'function' ||
             typeof binding.artifactReader.read !== 'function' ||
             typeof binding.artifactReader.close !== 'function') {
@@ -1562,7 +1369,7 @@ class FirmwareHostBindingRegistry {
     getGeneration() {
         return this.generation;
     }
-    resolve(generation) {
+    resolve(generation, preparedPlanDigest) {
         if (!Number.isSafeInteger(generation) ||
             generation <= 0 ||
             generation !== this.generation ||
@@ -1570,12 +1377,17 @@ class FirmwareHostBindingRegistry {
             return bindingError(`Firmware host binding generation ${generation} is stale`);
         }
         const { binding } = this;
+        if (preparedPlanDigest !== undefined &&
+            binding.preparedPlanDigest.toLowerCase() !== preparedPlanDigest.toLowerCase()) {
+            return bindingError(`Firmware host binding generation ${generation} does not match the prepared plan`);
+        }
         const assertCurrent = () => {
             if (generation !== this.generation || binding !== this.binding) {
                 bindingError(`Firmware host binding generation ${generation} is stale`);
             }
         };
         return {
+            preparedPlanDigest: binding.preparedPlanDigest,
             artifactReader: {
                 open: (input) => __awaiter(this, void 0, void 0, function* () {
                     assertCurrent();
@@ -1608,7 +1420,7 @@ const firmwareHostBindingRegistry = new FirmwareHostBindingRegistry();
 const registerFirmwareUpdateHostBinding = (binding) => firmwareHostBindingRegistry.register(binding);
 const unregisterFirmwareUpdateHostBinding = (generation) => firmwareHostBindingRegistry.unregister(generation);
 const getFirmwareUpdateHostBindingGeneration = () => firmwareHostBindingRegistry.getGeneration();
-const resolveFirmwareUpdateHostBinding = (generation) => firmwareHostBindingRegistry.resolve(generation !== null && generation !== void 0 ? generation : Number.NaN);
+const resolveFirmwareUpdateHostBinding = (generation, preparedPlanDigest) => firmwareHostBindingRegistry.resolve(generation !== null && generation !== void 0 ? generation : Number.NaN, preparedPlanDigest);
 
 const callbackManager = new Map();
 const generateCallbackId = () => `callback_${Date.now()}_${Math.random().toString(36).substring(2, 11)}`;
@@ -1679,7 +1491,6 @@ const createCoreApi = (call) => ({
     getFirmwareUpdateHostBindingGeneration,
     prepareFirmwareUpdatePlan,
     validateFirmwareUpdatePreparedPlan,
-    prepareProtocolV2ResourceFiles,
     getLogs: () => call({ method: 'getLogs' }),
     clearSessionCache: params => call(Object.assign(Object.assign({}, params), { method: 'clearSessionCache' })),
     searchDevices: params => call(Object.assign(Object.assign({}, params), { method: 'searchDevices' })),
@@ -40770,6 +40581,172 @@ const findLatestRelease = (releases) => {
     return leastRelease;
 };
 
+const PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_PATH$1 = 'vol0:/loaders/bootloader/boot_resource.okpkg';
+const SHA256_HEX_LENGTH = 64;
+function normalizeHex$1(value, expectedLength, field) {
+    if (typeof value !== 'string') {
+        throw new Error(`Invalid Pro2 resource ${field}: expected a hexadecimal string`);
+    }
+    const normalized = value.replace(/^0x/i, '').toLowerCase();
+    if (normalized.length !== expectedLength || !/^[0-9a-f]+$/.test(normalized)) {
+        throw new Error(`Invalid Pro2 resource ${field}: expected ${expectedLength} hexadecimal characters`);
+    }
+    return normalized;
+}
+function parseProtocolV2Resources(value) {
+    if (value === undefined)
+        return undefined;
+    if (!value || typeof value !== 'object') {
+        throw new Error('Invalid Pro2 resources config');
+    }
+    const { source } = value;
+    if (!source || typeof source !== 'object') {
+        throw new Error('Invalid Pro2 resources config: source is required');
+    }
+    const { archiveUrl, archiveSha256, archiveSize } = source;
+    if (typeof archiveUrl !== 'string' || !archiveUrl.startsWith('https://')) {
+        throw new Error('Invalid Pro2 resources config: source.archiveUrl must use HTTPS');
+    }
+    if (typeof archiveSha256 !== 'string' || !/^[0-9a-fA-F]{64}$/.test(archiveSha256)) {
+        throw new Error('Invalid Pro2 resources config: source.archiveSha256 must be a SHA-256 digest');
+    }
+    if (!Number.isSafeInteger(archiveSize) || archiveSize <= 0) {
+        throw new Error('Invalid Pro2 resources config: source.archiveSize must be a positive integer');
+    }
+    return {
+        source: {
+            archiveUrl,
+            archiveSha256: archiveSha256.toLowerCase(),
+            archiveSize: archiveSize,
+        },
+    };
+}
+const PROTOCOL_V2_RESOURCE_MANIFEST_DEVICE_ROOTS = [
+    'vol0:/bundles/',
+    'vol0:/loaders/rom/',
+];
+function isAllowedManifestDevicePath(path) {
+    if (!path.endsWith('.okpkg') ||
+        path.includes('\\') ||
+        path.includes('//') ||
+        path.split('/').some(part => part === '.' || part === '..')) {
+        return false;
+    }
+    if (path === PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_PATH$1) {
+        return true;
+    }
+    return PROTOCOL_V2_RESOURCE_MANIFEST_DEVICE_ROOTS.some(root => path.startsWith(root));
+}
+function assertManifestString(value, field) {
+    if (typeof value !== 'string' || value.length === 0) {
+        throw new Error(`Invalid Pro2 resource manifest ${field}`);
+    }
+    return value;
+}
+function assertManifestRelativePath(value, field) {
+    const path = assertManifestString(value, field);
+    if (path.startsWith('/') ||
+        path.includes('\\') ||
+        path.includes(':') ||
+        path.split('/').some(part => !part || part === '.' || part === '..')) {
+        throw new Error(`Invalid Pro2 resource manifest ${field}`);
+    }
+    return path;
+}
+function parseProtocolV2ResourceManifestFile(value, index) {
+    var _a;
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error(`Invalid Pro2 resource manifest files[${index}]`);
+    }
+    const file = value;
+    const archivePath = assertManifestRelativePath(file.archive_path, `files[${index}].archive_path`);
+    const originalName = assertManifestRelativePath(file.original_name, `files[${index}].original_name`);
+    if (originalName.includes('/')) {
+        throw new Error(`Invalid Pro2 resource manifest files[${index}].original_name`);
+    }
+    const devicePath = assertManifestString(file.device_path, `files[${index}].device_path`);
+    if (!isAllowedManifestDevicePath(devicePath)) {
+        throw new Error(`Invalid Pro2 resource manifest files[${index}].device_path`);
+    }
+    if (!Number.isSafeInteger(file.size) || Number(file.size) <= 0) {
+        throw new Error(`Invalid Pro2 resource manifest files[${index}].size`);
+    }
+    const digest = normalizeHex$1(file.sha256, SHA256_HEX_LENGTH, `files[${index}].sha256`);
+    if (file.signed !== true) {
+        throw new Error(`Invalid Pro2 resource manifest files[${index}].signed`);
+    }
+    if (file.sig_algo !== 'ed25519' && file.sig_algo !== 'mldsa65') {
+        throw new Error(`Invalid Pro2 resource manifest files[${index}].sig_algo`);
+    }
+    if (file.payload_version !== null && typeof file.payload_version !== 'string') {
+        throw new Error(`Invalid Pro2 resource manifest files[${index}].payload_version`);
+    }
+    if (!archivePath.endsWith('.okpkg') || !originalName.endsWith('.okpkg')) {
+        throw new Error(`Invalid Pro2 resource manifest files[${index}] package extension`);
+    }
+    return {
+        archive_path: archivePath,
+        original_name: originalName,
+        device_path: devicePath,
+        size: Number(file.size),
+        sha256: digest,
+        signed: true,
+        sig_algo: file.sig_algo,
+        payload_version: (_a = file.payload_version) !== null && _a !== void 0 ? _a : null,
+    };
+}
+function parseProtocolV2ResourceManifest(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error('Invalid Pro2 resource manifest');
+    }
+    const manifest = value;
+    if (manifest.schema !== 1 ||
+        manifest.variant !== 'resource' ||
+        manifest.device_root !== 'vol0:' ||
+        manifest.restore_mode !== 'bootloader_update' ||
+        !Array.isArray(manifest.trees) ||
+        !Array.isArray(manifest.files)) {
+        throw new Error('Invalid Pro2 resource manifest contract');
+    }
+    const files = manifest.files.map(parseProtocolV2ResourceManifestFile);
+    const devicePaths = new Set(files.map(file => file.device_path));
+    const archivePaths = new Set(files.map(file => file.archive_path));
+    if (files.length === 0 ||
+        devicePaths.size !== files.length ||
+        archivePaths.size !== files.length ||
+        !devicePaths.has(PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_PATH$1) ||
+        !files.some(file => file.device_path.startsWith('vol0:/bundles/'))) {
+        throw new Error('Invalid Pro2 resource manifest file set');
+    }
+    return {
+        schema: 1,
+        artifact_name: assertManifestString(manifest.artifact_name, 'artifact_name'),
+        release_name: assertManifestString(manifest.release_name, 'release_name'),
+        variant: 'resource',
+        commit: assertManifestString(manifest.commit, 'commit'),
+        short_sha: assertManifestString(manifest.short_sha, 'short_sha'),
+        timestamp_utc: assertManifestString(manifest.timestamp_utc, 'timestamp_utc'),
+        core_version: assertManifestString(manifest.core_version, 'core_version'),
+        key_set: assertManifestString(manifest.key_set, 'key_set'),
+        device_root: 'vol0:',
+        restore_mode: 'bootloader_update',
+        trees: manifest.trees.map((tree, index) => {
+            if (!tree || typeof tree !== 'object') {
+                throw new Error(`Invalid Pro2 resource manifest trees[${index}]`);
+            }
+            const item = tree;
+            return {
+                path: assertManifestRelativePath(item.path, `trees[${index}].path`),
+                device: assertManifestString(item.device, `trees[${index}].device`),
+            };
+        }),
+        files,
+    };
+}
+function selectProtocolV2ResourceManifestFiles({ manifest, targetsToUpdate, }) {
+    return targetsToUpdate.includes('resource') ? [...manifest.files] : [];
+}
+
 var _a$1;
 const FIRMWARE_UPDATE_CONFIG_FRESHNESS_MS = 5 * 60 * 1000;
 const Log$k = getLogger(exports.LoggerNames.Core);
@@ -40828,6 +40805,7 @@ class DataManager {
         return __awaiter(this, void 0, void 0, function* () {
             this.settings = settings;
             this.protocolV2ResourcesConfigError = undefined;
+            this.protocolV2NeoResourcesConfigError = undefined;
             const manifestMode = (_b = settings.firmwareManifestMode) !== null && _b !== void 0 ? _b : (settings.fetchConfig ? 'sdk-managed' : undefined);
             if (settings.preloadedConfig) {
                 this.applyRemoteConfig(settings.preloadedConfig);
@@ -40888,12 +40866,19 @@ class DataManager {
         let neoResources;
         try {
             pro2Resources = parseProtocolV2Resources((_b = data.pro2) === null || _b === void 0 ? void 0 : _b.resources);
-            neoResources = parseProtocolV2Resources((_c = data.neo) === null || _c === void 0 ? void 0 : _c.resources);
         }
         catch (error) {
             this.protocolV2ResourcesConfigError =
                 error instanceof Error ? error : new Error(String(error));
-            Log$k.warn('[DataConfig] Ignoring invalid Protocol V2 resources config:', error);
+            Log$k.warn('[DataConfig] Ignoring invalid Pro2 resources config:', error);
+        }
+        try {
+            neoResources = parseProtocolV2Resources((_c = data.neo) === null || _c === void 0 ? void 0 : _c.resources);
+        }
+        catch (error) {
+            this.protocolV2NeoResourcesConfigError =
+                error instanceof Error ? error : new Error(String(error));
+            Log$k.warn('[DataConfig] Ignoring invalid Neo resources config:', error);
         }
         const enrichedPro2Config = this.enrichFirmwareReleaseInfo(data.pro2);
         const enrichedNeoConfig = this.enrichFirmwareReleaseInfo(data.neo);
@@ -40931,16 +40916,20 @@ class DataManager {
             }
         });
     }
-    static forceReloadData({ requireResources = false, } = {}) {
+    static forceReloadData({ requireResources = false, resourceDeviceType = hdShared.EDeviceType.Pro2, } = {}) {
         return __awaiter(this, void 0, void 0, function* () {
+            const resourceDeviceName = resourceDeviceType === hdShared.EDeviceType.Pro2 ? 'Pro2' : 'Neo';
             if (!this.settings) {
                 throw new Error('Remote config settings are not initialized');
             }
             const hasFreshConfig = this.lastCheckTimestamp > 0 &&
                 getTimeStamp() - this.lastCheckTimestamp <= FIRMWARE_UPDATE_CONFIG_FRESHNESS_MS;
             if (hasFreshConfig) {
-                if (requireResources && this.protocolV2ResourcesConfigError) {
-                    throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.FirmwareUpdateDownloadFailed, `Invalid Pro2 resources config: ${this.protocolV2ResourcesConfigError.message}`);
+                const resourcesConfigError = resourceDeviceType === hdShared.EDeviceType.Pro2
+                    ? this.protocolV2ResourcesConfigError
+                    : this.protocolV2NeoResourcesConfigError;
+                if (requireResources && resourcesConfigError) {
+                    throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.FirmwareUpdateDownloadFailed, `Invalid ${resourceDeviceName} resources config: ${resourcesConfigError.message}`);
                 }
                 return;
             }
@@ -40948,8 +40937,11 @@ class DataManager {
             if (!loaded) {
                 throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.NetworkError, 'Unable to refresh the latest remote config');
             }
-            if (requireResources && this.protocolV2ResourcesConfigError) {
-                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.FirmwareUpdateDownloadFailed, `Invalid Pro2 resources config: ${this.protocolV2ResourcesConfigError.message}`);
+            const resourcesConfigError = resourceDeviceType === hdShared.EDeviceType.Pro2
+                ? this.protocolV2ResourcesConfigError
+                : this.protocolV2NeoResourcesConfigError;
+            if (requireResources && resourcesConfigError) {
+                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.FirmwareUpdateDownloadFailed, `Invalid ${resourceDeviceName} resources config: ${resourcesConfigError.message}`);
             }
             this.lastCheckTimestamp = getTimeStamp();
         });
@@ -40993,12 +40985,10 @@ DataManager.deviceMap = {
         ble: [],
     },
     [hdShared.EDeviceType.Pro2]: {
-        firmware: [],
-        ble: [],
+        'firmware-v1': [],
     },
     [hdShared.EDeviceType.Neo]: {
-        firmware: [],
-        ble: [],
+        'firmware-v1': [],
     },
     [hdShared.EDeviceType.ClassicPure]: {
         firmware: [],
@@ -47780,7 +47770,6 @@ class CheckAllFirmwareRelease extends BaseMethod {
             const resourceDeviceType = state.identity.deviceType === 'neo' ? hdShared.EDeviceType.Neo : hdShared.EDeviceType.Pro2;
             const resourceSource = DataManager.getProtocolV2ResourceSource(resourceDeviceType);
             const resourceStatus = 'unknown';
-            const resourcePreparationRequired = !!resourceSource;
             const detectedComponentTargets = validatedForceUpdateTargets.includes('firmware')
                 ? plan.components.flatMap(component => component.updateTarget ? [component.updateTarget] : [])
                 : plan.targetsToUpdate;
@@ -47792,14 +47781,11 @@ class CheckAllFirmwareRelease extends BaseMethod {
                 validatedProtocolV2ForceUpdateTargets.includes('resource');
             const targetsToUpdate = Array.from(new Set([
                 ...componentTargetsToUpdate,
-                ...(resourcePreparationRequired || forceResourceUpdate ? ['resource'] : []),
+                ...(forceResourceUpdate ? ['resource'] : []),
             ]));
             let firmwareUpdatePlan;
             try {
-                const shouldBuildFirmwareUpdatePlan = componentTargetsToUpdate.length > 0 ||
-                    validatedForceUpdateTargets.some(target => target !== 'resource') ||
-                    validatedProtocolV2ForceUpdateTargets.some(target => target !== 'resource') ||
-                    (forceResourceUpdate && !resourcePreparationRequired);
+                const shouldBuildFirmwareUpdatePlan = targetsToUpdate.length > 0;
                 const requestedPlatform = platform !== null && platform !== void 0 ? platform : 'web';
                 const requiresDeviceIdentity = requestedPlatform === 'native' || requestedPlatform === 'desktop';
                 const canBindPreparedPlan = !requiresDeviceIdentity || !!getDeviceSerialNo(features);
@@ -47811,7 +47797,7 @@ class CheckAllFirmwareRelease extends BaseMethod {
                         release,
                         targetsToUpdate,
                         forceUpdateTargets: validatedForceUpdateTargets,
-                        resourceArchiveAvailable: resourcePreparationRequired,
+                        resourceArchive: resourceSource,
                     });
                     firmwareUpdatePlan = canBindPreparedPlan ? validatedPlan : undefined;
                     if (!canBindPreparedPlan) {
@@ -47835,9 +47821,7 @@ class CheckAllFirmwareRelease extends BaseMethod {
             const firmwarePlan = summarizeProtocolV2FirmwareRelease(plan, PROTOCOL_V2_MAIN_FIRMWARE_TARGETS);
             const blePlan = summarizeProtocolV2FirmwareRelease(plan, PROTOCOL_V2_BLE_TARGETS);
             const bootloaderPlan = summarizeProtocolV2FirmwareRelease(plan, PROTOCOL_V2_BOOTLOADER_TARGETS);
-            const status = resourcePreparationRequired && (plan.status === 'valid' || plan.status === 'unavailable')
-                ? 'unknown'
-                : plan.status;
+            const { status } = plan;
             return Object.assign(Object.assign({ firmware: toProtocolV2FirmwareReleaseInfo({ plan: firmwarePlan, state, release }), ble: toProtocolV2FirmwareReleaseInfo({
                     plan: blePlan,
                     state,
@@ -47847,7 +47831,7 @@ class CheckAllFirmwareRelease extends BaseMethod {
                     state,
                     release: getProtocolV2ComponentReleaseInfo(plan, 'BOOTLOADER'),
                 }), features, protocol: 'V2', deviceType: state.identity.deviceType }, plan), { status,
-                resourceStatus, resourceArchive: resourceSource, resourcePreparationRequired, hasUpgrade: targetsToUpdate.length > 0, targetsToUpdate,
+                resourceStatus, resourceArchive: resourceSource, hasUpgrade: targetsToUpdate.length > 0, targetsToUpdate,
                 firmwareUpdatePlan });
         });
     }
@@ -51271,6 +51255,9 @@ const PROTOCOL_V2_OKPP_HEADER_SIZE = 0x52a0;
 const PROTOCOL_V2_OKPP_PAYLOAD_HASH_OFFSET = 0x200;
 const PROTOCOL_V2_OKPP_HEADER_HASH_OFFSET = 0x240;
 const PROTOCOL_V2_OKPP_HASH_SIZE = 64;
+const PROTOCOL_V2_RESOURCE_MANIFEST_MAX_BYTES = 1024 * 1024;
+const PROTOCOL_V2_RESOURCE_FILE_MAX_COUNT = 512;
+const PROTOCOL_V2_RESOURCE_TOTAL_MAX_BYTES = 256 * 1024 * 1024;
 const PROTOCOL_V2_NEO_UNSUPPORTED_TARGETS = new Set(['se03', 'se04']);
 function assertProtocolV2FirmwareTargetsSupported(deviceType, params) {
     var _a;
@@ -51524,7 +51511,7 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
         return ['V2'];
     }
     init() {
-        var _a, _b, _c;
+        var _a, _b;
         this.allowDeviceMode = [UI_REQUEST.BOOTLOADER, UI_REQUEST.NOT_INITIALIZE];
         this.requireDeviceMode = [];
         this.unlockPolicy = 'unlock-before-run';
@@ -51559,33 +51546,26 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
             { name: 'targetsToUpdate', type: 'array', allowEmpty: true },
             { name: 'platform', type: 'string' },
             { name: 'expectedDeviceId', type: 'string' },
-            { name: 'resourceFiles', type: 'array', allowEmpty: true },
         ]);
         if (payload.expectedDeviceId !== undefined &&
             (payload.expectedDeviceId.length === 0 || payload.expectedDeviceId.length > 160)) {
             throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.CallMethodInvalidParameter, 'Protocol V2 expected device identity is invalid');
         }
-        const hostBinding = payload.preparedPlan || payload.componentArtifacts || payload.resourceBundleArtifacts
-            ? resolveFirmwareUpdateHostBinding(payload.hostBindingGeneration)
+        const preparedPlan = payload.preparedPlan
+            ? validateFirmwareUpdatePreparedPlan(payload.preparedPlan)
+            : undefined;
+        const hostBinding = preparedPlan || payload.componentArtifacts
+            ? resolveFirmwareUpdateHostBinding(payload.hostBindingGeneration, preparedPlan === null || preparedPlan === void 0 ? void 0 : preparedPlan.preparedPlanDigest)
             : undefined;
         if (hostBinding) {
+            const componentArtifacts = ((_a = payload.componentArtifacts) !== null && _a !== void 0 ? _a : {});
             assertFirmwareUpdatePreparedPlanBinding({
-                preparedPlan: payload.preparedPlan,
+                preparedPlan: preparedPlan !== null && preparedPlan !== void 0 ? preparedPlan : payload.preparedPlan,
                 executor: 'v4',
                 platform: payload.platform,
-                scopeTargets: [
-                    'boot',
-                    'app_v1',
-                    'app_v2',
-                    'coprocessor',
-                    'resource',
-                    'se01',
-                    'se02',
-                    'se03',
-                    'se04',
-                ],
+                scopeTargets: ['boot', 'app_v1', 'app_v2', 'coprocessor', 'se01', 'se02', 'se03', 'se04'],
                 bindings: [
-                    ...Object.entries((_a = payload.componentArtifacts) !== null && _a !== void 0 ? _a : {}).flatMap(([target, artifact]) => artifact
+                    ...Object.entries(componentArtifacts).flatMap(([target, artifact]) => artifact
                         ? [
                             {
                                 target: target,
@@ -51593,16 +51573,11 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
                             },
                         ]
                         : []),
-                    ...((_b = payload.resourceBundleArtifacts) !== null && _b !== void 0 ? _b : []).map((entry) => ({
-                        target: 'resource',
-                        logicalName: entry.name,
-                        artifact: entry.artifact,
-                    })),
                 ],
             });
         }
         this.params = {
-            preparedPlan: payload.preparedPlan,
+            preparedPlan,
             chunkSize: payload.chunkSize,
             forcedUpdateRes: payload.forcedUpdateRes,
             bootloaderBinary: payload.bootloaderBinary,
@@ -51614,15 +51589,13 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
             se02Binary: payload.se02Binary,
             se03Binary: payload.se03Binary,
             se04Binary: payload.se04Binary,
-            resourceFiles: payload.resourceFiles,
             firmwareType: payload.firmwareType,
             targetsToUpdate: payload.targetsToUpdate,
             expectedTargetVersions: payload.expectedTargetVersions,
             platform: payload.platform,
             expectedDeviceId: payload.expectedDeviceId,
-            artifactReader: (_c = hostBinding === null || hostBinding === void 0 ? void 0 : hostBinding.artifactReader) !== null && _c !== void 0 ? _c : payload.artifactReader,
+            artifactReader: (_b = hostBinding === null || hostBinding === void 0 ? void 0 : hostBinding.artifactReader) !== null && _b !== void 0 ? _b : payload.artifactReader,
             componentArtifacts: payload.componentArtifacts,
-            resourceBundleArtifacts: payload.resourceBundleArtifacts,
         };
     }
     getProtocolV2FirmwareChunkSize(direction, filePath) {
@@ -51653,7 +51626,7 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
         });
     }
     runProtocolV2() {
-        var _a, _b, _c, _d, _e, _f;
+        var _a, _b, _c, _d;
         return __awaiter(this, void 0, void 0, function* () {
             yield this.captureProtocolV2PhysicalIdentity();
             const deviceFeatures = yield this.getProtocolV2DeviceFeatures();
@@ -51665,20 +51638,15 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
             const deviceFirmwareType = getFirmwareType(deviceFeatures);
             const firmwareType = (_a = this.params.firmwareType) !== null && _a !== void 0 ? _a : deviceFirmwareType;
             this.validateExpectedTargetVersions();
-            if ((this.params.componentArtifacts && Object.keys(this.params.componentArtifacts).length > 0) ||
-                ((_b = this.params.resourceBundleArtifacts) === null || _b === void 0 ? void 0 : _b.length)) {
+            if (this.params.preparedPlan) {
                 return this.runProtocolV2PreparedArtifacts(deviceFeatures, firmwareType);
             }
-            const hasExplicitResourceFiles = !!((_c = this.params.resourceFiles) === null || _c === void 0 ? void 0 : _c.length);
-            const wantsResources = !!((_d = this.params.targetsToUpdate) === null || _d === void 0 ? void 0 : _d.includes('resource'));
-            const needsPreparedResources = !hasExplicitResourceFiles && wantsResources;
+            const wantsResources = !!((_b = this.params.targetsToUpdate) === null || _b === void 0 ? void 0 : _b.includes('resource'));
             let fwBinaryMap = [];
             let bootloaderBinary = null;
             let installItems;
-            let resourceBundles;
             try {
                 this.postTipMessage(exports.FirmwareUpdateTipMessage.StartDownloadFirmware);
-                resourceBundles = this.prepareExplicitProtocolV2ResourceFiles();
                 fwBinaryMap = this.collectExplicitTargetBinaries();
                 bootloaderBinary = this.prepareBootloaderBinary();
                 const explicitInstallItems = this.buildProtocolV2InstallItems({
@@ -51686,10 +51654,10 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
                     fwBinaryMap,
                 });
                 const missingFirmwareTargets = this.getMissingProtocolV2FirmwareTargets(explicitInstallItems);
-                const needsRemoteFirmware = ((_e = this.params.targetsToUpdate) === null || _e === void 0 ? void 0 : _e.length)
+                const needsRemoteFirmware = ((_c = this.params.targetsToUpdate) === null || _c === void 0 ? void 0 : _c.length)
                     ? missingFirmwareTargets.length > 0
-                    : !this.hasExplicitProtocolV2Payload(explicitInstallItems);
-                if (needsPreparedResources) {
+                    : explicitInstallItems.length === 0;
+                if (wantsResources) {
                     throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 resource manifest must be prepared by the external firmware host', {
                         firmwareUpdateCode: 'FirmwareArtifactsNotPrepared',
                     });
@@ -51716,7 +51684,7 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
                 if (typeof err === 'object' &&
                     err !== null &&
                     'params' in err &&
-                    ((_f = err.params) === null || _f === void 0 ? void 0 : _f.firmwareUpdateCode) === 'FirmwareArtifactsNotPrepared') {
+                    ((_d = err.params) === null || _d === void 0 ? void 0 : _d.firmwareUpdateCode) === 'FirmwareArtifactsNotPrepared') {
                     throw err;
                 }
                 if (err instanceof hdShared.HardwareError && err.errorCode === hdShared.HardwareErrorCode.NetworkError) {
@@ -51724,14 +51692,11 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
                 }
                 throw normalizeFirmwarePreparationError(err);
             }
-            if (!bootloaderBinary &&
-                fwBinaryMap.length === 0 &&
-                !(installItems === null || installItems === void 0 ? void 0 : installItems.length) &&
-                !(resourceBundles === null || resourceBundles === void 0 ? void 0 : resourceBundles.length)) {
+            if (!bootloaderBinary && fwBinaryMap.length === 0 && !(installItems === null || installItems === void 0 ? void 0 : installItems.length)) {
                 throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.FirmwareUpdateDownloadFailed, 'No firmware to update');
             }
-            return this.executeProtocolV2Update(Object.assign(Object.assign({ fwBinaryMap,
-                bootloaderBinary }, (installItems ? { installItems } : undefined)), ((resourceBundles === null || resourceBundles === void 0 ? void 0 : resourceBundles.length) ? { resourceBundles } : undefined)));
+            return this.executeProtocolV2Update(Object.assign({ fwBinaryMap,
+                bootloaderBinary }, (installItems ? { installItems } : undefined)));
         });
     }
     openProtocolV2PreparedSource(artifact) {
@@ -51798,39 +51763,87 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
             return installSources;
         });
     }
-    prepareProtocolV2ResourceSources(firmwareType, features) {
-        var _a, _b, _c;
+    prepareProtocolV2ResourceSources() {
+        var _a, _b;
         return __awaiter(this, void 0, void 0, function* () {
-            const preparedArtifacts = (_a = this.params.resourceBundleArtifacts) !== null && _a !== void 0 ? _a : [];
-            const resourceRequested = ((_b = this.params.targetsToUpdate) === null || _b === void 0 ? void 0 : _b.includes('resource')) || preparedArtifacts.length > 0;
+            const resourceRequested = (_b = (_a = this.params.targetsToUpdate) === null || _a === void 0 ? void 0 : _a.includes('resource')) !== null && _b !== void 0 ? _b : false;
             if (!resourceRequested) {
                 return [];
             }
-            const release = DataManager.getFirmwareLatestRelease(features, firmwareType);
-            const descriptors = (_c = release === null || release === void 0 ? void 0 : release.resourceBundles) !== null && _c !== void 0 ? _c : [];
-            const artifactByName = new Map(preparedArtifacts.map(item => [item.name, item.artifact]));
-            const sources = [];
-            for (const descriptor of descriptors) {
-                const artifact = artifactByName.get(descriptor.name);
-                if (!artifact) {
-                    throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Protocol V2 resource bundle ${descriptor.name} is not prepared`, {
-                        firmwareUpdateCode: 'FirmwareArtifactsNotPrepared',
-                        artifactName: descriptor.name,
-                    });
-                }
-                const devicePath = validateProtocolV2FilesystemPath(descriptor.devicePath, 'resourceBundles[].devicePath');
-                sources.push({
-                    name: descriptor.name,
-                    source: yield this.openProtocolV2PreparedSource(artifact),
-                    devicePath,
-                    version: descriptor.version,
-                    payloadHash: descriptor.payloadHash,
-                    headerHash: descriptor.headerHash,
-                });
-                artifactByName.delete(descriptor.name);
+            const archiveSources = yield this.prepareProtocolV2ResourceArchiveSources();
+            if (archiveSources) {
+                return archiveSources;
             }
-            if (artifactByName.size > 0) {
-                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Protocol V2 release does not contain resource bundle ${artifactByName.keys().next().value}`);
+            throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 resource archive is not prepared', { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
+        });
+    }
+    prepareProtocolV2ResourceArchiveSources() {
+        var _a, _b, _c, _d;
+        return __awaiter(this, void 0, void 0, function* () {
+            const archiveArtifacts = (_b = (_a = this.params.preparedPlan) === null || _a === void 0 ? void 0 : _a.artifacts.filter(artifact => artifact.role === 'resourceBundle' &&
+                artifact.target === 'resource' &&
+                artifact.container === 'zip')) !== null && _b !== void 0 ? _b : [];
+            if (archiveArtifacts.length === 0) {
+                return undefined;
+            }
+            if (archiveArtifacts.length !== 1) {
+                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 prepared plan must contain exactly one resource archive', { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
+            }
+            const entries = (_c = archiveArtifacts[0].materializedEntries) !== null && _c !== void 0 ? _c : [];
+            const manifestEntry = entries.find(entry => entry.entryName === 'manifest.json');
+            if (!manifestEntry ||
+                manifestEntry.artifact.size <= 0 ||
+                manifestEntry.artifact.size > PROTOCOL_V2_RESOURCE_MANIFEST_MAX_BYTES) {
+                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 prepared resource archive has no valid manifest.json', { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
+            }
+            const manifestSource = yield this.openProtocolV2PreparedSource(manifestEntry.artifact);
+            let manifestValue;
+            try {
+                manifestValue = JSON.parse(new TextDecoder().decode(yield readFirmwareByteSourceFully(manifestSource)));
+            }
+            catch (error) {
+                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Protocol V2 prepared resource manifest is invalid: ${String(error)}`, { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
+            }
+            const manifest = parseProtocolV2ResourceManifest(manifestValue);
+            const selectedFiles = selectProtocolV2ResourceManifestFiles({
+                manifest,
+                targetsToUpdate: (_d = this.params.targetsToUpdate) !== null && _d !== void 0 ? _d : [],
+            });
+            if (selectedFiles.length > PROTOCOL_V2_RESOURCE_FILE_MAX_COUNT) {
+                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 prepared resource archive contains too many files', { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
+            }
+            const entriesByName = new Map(entries.map(entry => [entry.entryName, entry]));
+            const expectedEntryNames = new Set([
+                'manifest.json',
+                ...selectedFiles.map(file => file.archive_path),
+            ]);
+            if (entries.some(entry => !expectedEntryNames.has(entry.entryName))) {
+                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 prepared resource archive contains an unexpected entry', { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
+            }
+            let totalSize = 0;
+            const sources = [];
+            for (const [index, file] of selectedFiles.entries()) {
+                const entry = entriesByName.get(file.archive_path);
+                if (!entry ||
+                    entry.artifact.size !== file.size ||
+                    entry.artifact.sha256.toLowerCase() !== file.sha256.toLowerCase()) {
+                    throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Protocol V2 prepared resource file does not match manifest: ${file.archive_path}`, { firmwareUpdateCode: 'FirmwareArtifactReceiptMismatch' });
+                }
+                totalSize += entry.artifact.size;
+                if (totalSize > PROTOCOL_V2_RESOURCE_TOTAL_MAX_BYTES) {
+                    throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 prepared resource archive exceeds the total size limit', { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
+                }
+                const source = yield this.openProtocolV2PreparedSource(entry.artifact);
+                const header = source.size >= PROTOCOL_V2_OKPP_HEADER_SIZE
+                    ? parseProtocolV2OkppHeader(new Uint8Array(yield source.readAt(0, PROTOCOL_V2_OKPP_HEADER_SIZE)))
+                    : null;
+                sources.push(Object.assign({ name: file.original_name || `resource-${index}`, source, devicePath: file.device_path }, (header
+                    ? {
+                        version: header.version,
+                        payloadHash: header.payloadHash,
+                        headerHash: header.headerHash,
+                    }
+                    : {})));
             }
             return sources;
         });
@@ -51840,19 +51853,7 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
             try {
                 this.postTipMessage(exports.FirmwareUpdateTipMessage.StartDownloadFirmware);
                 const installSources = yield this.prepareProtocolV2InstallSources(firmwareType, features);
-                const explicitResourceBundles = this.prepareExplicitProtocolV2ResourceFiles();
-                const resourceSources = (explicitResourceBundles === null || explicitResourceBundles === void 0 ? void 0 : explicitResourceBundles.length)
-                    ? yield Promise.all(explicitResourceBundles.map((bundle) => __awaiter(this, void 0, void 0, function* () {
-                        return ({
-                            name: bundle.name,
-                            source: yield this.openProtocolV2MemorySource(bundle.binary),
-                            devicePath: bundle.devicePath,
-                            version: bundle.version,
-                            payloadHash: bundle.payloadHash,
-                            headerHash: bundle.headerHash,
-                        });
-                    })))
-                    : yield this.prepareProtocolV2ResourceSources(firmwareType, features);
+                const resourceSources = yield this.prepareProtocolV2ResourceSources();
                 if (installSources.length === 0 && resourceSources.length === 0) {
                     throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.FirmwareUpdateDownloadFailed, 'No firmware to update');
                 }
@@ -51936,15 +51937,15 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
         }
     }
     getProtocolV2RequestedTargets() {
-        var _a, _b, _c, _d;
+        var _a, _b, _c;
         if ((_a = this.params.targetsToUpdate) === null || _a === void 0 ? void 0 : _a.length) {
             return [...new Set(this.params.targetsToUpdate)];
         }
-        const targets = new Set();
-        Object.keys((_b = this.params.componentArtifacts) !== null && _b !== void 0 ? _b : {}).forEach(target => targets.add(target));
-        if (((_c = this.params.resourceBundleArtifacts) === null || _c === void 0 ? void 0 : _c.length) || ((_d = this.params.resourceFiles) === null || _d === void 0 ? void 0 : _d.length)) {
-            targets.add('resource');
+        if ((_b = this.params.preparedPlan) === null || _b === void 0 ? void 0 : _b.targetsToUpdate.length) {
+            return [...new Set(this.params.preparedPlan.targetsToUpdate)];
         }
+        const targets = new Set();
+        Object.keys((_c = this.params.componentArtifacts) !== null && _c !== void 0 ? _c : {}).forEach(target => targets.add(target));
         if (this.params.bootloaderBinary)
             targets.add('boot');
         if (this.params.applicationP1Binary)
@@ -52031,10 +52032,6 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
         var _a;
         return (_a = this.params.bootloaderBinary) !== null && _a !== void 0 ? _a : null;
     }
-    hasExplicitProtocolV2Payload(installItems) {
-        var _a;
-        return !!((_a = this.params.resourceFiles) === null || _a === void 0 ? void 0 : _a.length) || installItems.length > 0;
-    }
     getMissingProtocolV2FirmwareTargets(installItems) {
         var _a;
         const preparedTargets = new Set(installItems.flatMap(item => {
@@ -52161,39 +52158,6 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
             };
         });
     }
-    prepareExplicitProtocolV2ResourceFiles() {
-        var _a;
-        const files = (_a = this.params.resourceFiles) !== null && _a !== void 0 ? _a : [];
-        if (!(files === null || files === void 0 ? void 0 : files.length))
-            return undefined;
-        const prepared = files.map((file, index) => {
-            var _a;
-            const devicePath = validateProtocolV2FilesystemPath(file.devicePath, `resourceFiles[${index}].devicePath`);
-            const descriptor = file;
-            if (descriptor.size !== undefined && descriptor.size !== file.binary.byteLength) {
-                throw new Error(`resourceFiles[${index}] size mismatch`);
-            }
-            if (descriptor.fileHash &&
-                !isProtocolV2ResourceFileValid(file.binary, {
-                    size: file.binary.byteLength,
-                    fileHash: descriptor.fileHash,
-                })) {
-                throw new Error(`resourceFiles[${index}] SHA-256 mismatch`);
-            }
-            const header = parseProtocolV2OkppHeader(toProtocolV2Bytes(file.binary));
-            return Object.assign({ name: (_a = devicePath.split('/').pop()) !== null && _a !== void 0 ? _a : devicePath, binary: file.binary, devicePath }, (header
-                ? {
-                    version: header.version,
-                    payloadHash: header.payloadHash,
-                    headerHash: header.headerHash,
-                }
-                : {}));
-        });
-        if (new Set(prepared.map(file => file.devicePath)).size !== prepared.length) {
-            throw new Error('resourceFiles contain duplicate devicePath values');
-        }
-        return prepared;
-    }
     getProtocolV2ResourceFilePath(path) {
         if (path.startsWith('vol'))
             return path;
@@ -52201,7 +52165,7 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
             return `vol0:${path}`;
         return `vol0:/${path}`;
     }
-    readProtocolV2DeviceFileHeader(path) {
+    readProtocolV2DeviceFileHeader(path, expectedSize) {
         var _a, _b, _c, _d;
         return __awaiter(this, void 0, void 0, function* () {
             const typedCall = this.device.getCommands().typedCall.bind(this.device.getCommands());
@@ -52213,7 +52177,8 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
             if (!((_b = pathInfoRes.message) === null || _b === void 0 ? void 0 : _b.exist) ||
                 ((_c = pathInfoRes.message) === null || _c === void 0 ? void 0 : _c.directory) ||
                 fileSize === undefined ||
-                fileSize < PROTOCOL_V2_OKPP_HEADER_SIZE) {
+                fileSize < PROTOCOL_V2_OKPP_HEADER_SIZE ||
+                (expectedSize !== undefined && fileSize !== expectedSize)) {
                 return null;
             }
             const chunkSize = this.getProtocolV2FirmwareChunkSize('read');
@@ -52253,7 +52218,7 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
             if (!bundle.payloadHash || !bundle.headerHash)
                 return false;
             try {
-                const header = yield this.readProtocolV2DeviceFileHeader(bundle.devicePath);
+                const header = yield this.readProtocolV2DeviceFileHeader(bundle.devicePath, bundle.source.size);
                 if (!header)
                     return false;
                 if (bundle.version) {
@@ -52450,7 +52415,7 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
             });
         });
     }
-    executeProtocolV2Update({ fwBinaryMap, bootloaderBinary, installItems, resourceBundles, }) {
+    executeProtocolV2Update({ fwBinaryMap, bootloaderBinary, installItems, }) {
         return __awaiter(this, void 0, void 0, function* () {
             const memoryInstallItems = installItems !== null && installItems !== void 0 ? installItems : this.buildProtocolV2InstallItems({
                 fwBinaryMap: fwBinaryMap !== null && fwBinaryMap !== void 0 ? fwBinaryMap : [],
@@ -52465,19 +52430,9 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
                         kind: item.kind,
                     });
                 })));
-                const resourceSources = yield Promise.all((resourceBundles !== null && resourceBundles !== void 0 ? resourceBundles : []).map((bundle) => __awaiter(this, void 0, void 0, function* () {
-                    return ({
-                        name: bundle.name,
-                        source: yield this.openProtocolV2MemorySource(bundle.binary),
-                        devicePath: bundle.devicePath,
-                        version: bundle.version,
-                        payloadHash: bundle.payloadHash,
-                        headerHash: bundle.headerHash,
-                    });
-                })));
                 return yield this.executeProtocolV2Phases({
                     installSources,
-                    resourceSources,
+                    resourceSources: [],
                 });
             }
             finally {
@@ -65090,6 +65045,111 @@ const switchTransport = ({ env, Transport, plugin, }) => {
     initConnector();
 };
 
+let memoryHostSequence = 0;
+const FIRMWARE_UPDATE_V4_COMPONENT_TARGETS = new Set([
+    'boot',
+    'app_v1',
+    'app_v2',
+    'coprocessor',
+    'se01',
+    'se02',
+    'se03',
+    'se04',
+]);
+const isFirmwareUpdateV4ComponentTarget = (target) => FIRMWARE_UPDATE_V4_COMPONENT_TARGETS.has(target);
+const createReference = (binary, prefix) => {
+    const digest = utils.bytesToHex(sha256.sha256(new Uint8Array(binary)));
+    return {
+        artifactRef: `fwmem:${prefix}:${digest.slice(0, 32)}`,
+        size: binary.byteLength,
+        sha256: digest,
+    };
+};
+function prepareFirmwareUpdateV4MemoryHost({ sdk, plan, artifacts, }) {
+    if (plan.executor !== 'v4') {
+        throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Firmware memory host only supports V4 plans');
+    }
+    memoryHostSequence += 1;
+    const hostId = `${Date.now()}:${memoryHostSequence}`;
+    const binaries = new Map();
+    const inputs = artifacts.map((input, artifactIndex) => {
+        var _a;
+        const artifact = createReference(input.binary, `${hostId}:artifact:${artifactIndex}`);
+        binaries.set(artifact.artifactRef, new Uint8Array(input.binary));
+        const materializedEntries = (_a = input.materializedEntries) === null || _a === void 0 ? void 0 : _a.map((entry, entryIndex) => {
+            const entryArtifact = createReference(entry.binary, `${hostId}:entry:${artifactIndex}:${entryIndex}`);
+            binaries.set(entryArtifact.artifactRef, new Uint8Array(entry.binary));
+            return {
+                entryName: entry.entryName,
+                artifact: entryArtifact,
+            };
+        });
+        return Object.assign({ artifactId: input.artifactId, artifact }, ((materializedEntries === null || materializedEntries === void 0 ? void 0 : materializedEntries.length) ? { materializedEntries } : {}));
+    });
+    const preparedPlan = sdk.prepareFirmwareUpdatePlan({
+        plan,
+        leaseRef: `fwmemlease:${hostId}`,
+        artifacts: inputs,
+    });
+    const readers = new Map();
+    let readerSequence = 0;
+    const artifactReader = {
+        open({ artifactRef }) {
+            const binary = binaries.get(artifactRef);
+            if (!binary) {
+                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Firmware memory artifact is unavailable');
+            }
+            readerSequence += 1;
+            const readerId = `fwmemreader:${hostId}:${readerSequence}`;
+            readers.set(readerId, binary);
+            return Promise.resolve({ readerId, size: binary.byteLength });
+        },
+        read({ readerId, offset, length }) {
+            const binary = readers.get(readerId);
+            if (!binary || offset < 0 || length <= 0 || offset + length > binary.byteLength) {
+                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Firmware memory artifact read is invalid');
+            }
+            const data = binary.slice(offset, offset + length).buffer;
+            return Promise.resolve({
+                data,
+                bytesRead: data.byteLength,
+                eof: offset + length === binary.byteLength,
+            });
+        },
+        close({ readerId }) {
+            readers.delete(readerId);
+            return Promise.resolve();
+        },
+    };
+    const hostBindingGeneration = sdk.registerFirmwareUpdateHostBinding({
+        artifactReader,
+        preparedPlanDigest: preparedPlan.preparedPlanDigest,
+    });
+    const componentArtifacts = {};
+    const expectedTargetVersions = {};
+    for (const artifact of preparedPlan.artifacts) {
+        if (artifact.role === 'component' && isFirmwareUpdateV4ComponentTarget(artifact.target)) {
+            componentArtifacts[artifact.target] = artifact.artifact;
+        }
+        if (artifact.targetVersion) {
+            expectedTargetVersions[artifact.target] = artifact.targetVersion;
+        }
+    }
+    return {
+        preparedPlan,
+        hostBindingGeneration,
+        targetsToUpdate: [...preparedPlan.targetsToUpdate],
+        expectedDeviceId: preparedPlan.deviceIdentity,
+        expectedTargetVersions,
+        componentArtifacts,
+        release: () => {
+            sdk.unregisterFirmwareUpdateHostBinding(hostBindingGeneration);
+            readers.clear();
+            binaries.clear();
+        },
+    };
+}
+
 const HardwareSdk = ({ init, call, dispose, eventEmitter, uiResponse, cancel, updateSettings, switchTransport, }) => inject({
     init,
     call,
@@ -65227,7 +65287,7 @@ exports.parseMessage = parseMessage;
 exports.parseProtocolV2ResourceManifest = parseProtocolV2ResourceManifest;
 exports.patchFeatures = patchFeatures;
 exports.preloadSessionCache = preloadSessionCache;
-exports.prepareProtocolV2ResourceFiles = prepareProtocolV2ResourceFiles;
+exports.prepareFirmwareUpdateV4MemoryHost = prepareFirmwareUpdateV4MemoryHost;
 exports.projectDeviceStateFeatures = projectFeatures;
 exports.registerFirmwareUpdateHostBinding = registerFirmwareUpdateHostBinding;
 exports.safeThrowError = safeThrowError;