@onekeyfe/hd-core 1.2.0-alpha.87 → 1.2.0-alpha.89

package/dist/index.js

@@ -836,10 +836,14 @@ const buildProtocolV2Artifacts = (release, { includeComponents = true, component
             throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Protocol V2 component ${key} duplicates target ${target}`, { firmwareUpdateCode: 'FirmwarePlanInvalid' });
         }
         componentTargetSet.add(target);
-        artifacts.push(Object.assign(Object.assign({ artifactId: `component:${target}`, role: 'component', target, url: assertArtifactUrl(component.url, `Protocol V2 component ${key}`), container: 'raw', logicalName: key }, asIntegrity({
+        const integrity = asIntegrity({
             size: component.expectedSize,
             sha256: component.fingerprint,
-        })), (asVersion(component.version) ? { targetVersion: asVersion(component.version) } : {})));
+        });
+        if (integrity.expectedSize === undefined || integrity.expectedSha256 === undefined) {
+            planError(`Protocol V2 component ${key} integrity metadata is invalid`);
+        }
+        artifacts.push(Object.assign(Object.assign({ artifactId: `component:${target}`, role: 'component', target, url: assertArtifactUrl(component.url, `Protocol V2 component ${key}`), container: 'raw', logicalName: key }, integrity), (asVersion(component.version) ? { targetVersion: asVersion(component.version) } : {})));
         targets.push(target);
     }
     return { artifacts, targets: [...new Set(targets)] };
@@ -893,6 +897,22 @@ const finalizeFirmwareUpdatePlan = ({ features, firmwareType, platform, artifact
     };
     return assertFirmwareUpdatePlan(Object.assign(Object.assign({}, planWithoutDigest), { planDigest: digestFirmwareUpdatePlan(planWithoutDigest) }));
 };
+const buildProtocolV2LocalFirmwareUpdatePlan = ({ features, firmwareType, platform, artifacts, }) => {
+    if (artifacts.length === 0) {
+        return planError('Protocol V2 local firmware plan has no artifacts');
+    }
+    const plan = finalizeFirmwareUpdatePlan({
+        features,
+        firmwareType,
+        platform,
+        artifacts: artifacts.map(artifact => (Object.assign(Object.assign({}, artifact), { role: artifact.target === 'resource' ? 'resourceBundle' : 'component', url: `https://local-firmware.invalid/${encodeURIComponent(artifact.artifactId)}` }))),
+        targetsToUpdate: artifacts.map(artifact => artifact.target),
+    });
+    if (plan.executor !== 'v4') {
+        return planError('Protocol V2 local firmware plan requires executor v4');
+    }
+    return plan;
+};
 const buildProtocolV2FirmwareUpdatePlan = ({ features, firmwareType, platform, release, targetsToUpdate, forceUpdateTargets, resourceArchive, }) => {
     const validatedForceTargets = validateFirmwareUpdatePlanForceTargets(forceUpdateTargets);
     if (validatedForceTargets.some(target => target === 'ble' || target === 'bootloader')) {
@@ -51229,6 +51249,88 @@ const INSTALLABLE_FIRMWARE_TARGET_IDS = new Set([
 ]);
 new Map(Object.entries(ProtocolV2FirmwareTargetType).flatMap(([key, value]) => INSTALLABLE_FIRMWARE_TARGET_IDS.has(value) ? [[key, value]] : []));
 
+let memoryHostSequence = 0;
+const createReference = (binary, prefix) => {
+    const digest = utils.bytesToHex(sha256.sha256(new Uint8Array(binary)));
+    return {
+        artifactRef: `fwmem:${prefix}:${digest.slice(0, 32)}`,
+        size: binary.byteLength,
+        sha256: digest,
+    };
+};
+function prepareFirmwareUpdateV4MemoryHost({ sdk, plan, artifacts, }) {
+    if (plan.executor !== 'v4') {
+        throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Firmware memory host only supports V4 plans');
+    }
+    memoryHostSequence += 1;
+    const hostId = `${Date.now()}:${memoryHostSequence}`;
+    const binaries = new Map();
+    const inputs = artifacts.map((input, artifactIndex) => {
+        var _a;
+        const artifactBinary = new Uint8Array(input.binary).slice();
+        const artifact = createReference(artifactBinary.buffer, `${hostId}:artifact:${artifactIndex}`);
+        binaries.set(artifact.artifactRef, artifactBinary);
+        const materializedEntries = (_a = input.materializedEntries) === null || _a === void 0 ? void 0 : _a.map((entry, entryIndex) => {
+            const entryBinary = new Uint8Array(entry.binary).slice();
+            const entryArtifact = createReference(entryBinary.buffer, `${hostId}:entry:${artifactIndex}:${entryIndex}`);
+            binaries.set(entryArtifact.artifactRef, entryBinary);
+            return {
+                entryName: entry.entryName,
+                artifact: entryArtifact,
+            };
+        });
+        return Object.assign({ artifactId: input.artifactId, artifact }, ((materializedEntries === null || materializedEntries === void 0 ? void 0 : materializedEntries.length) ? { materializedEntries } : {}));
+    });
+    const preparedPlan = sdk.prepareFirmwareUpdatePlan({
+        plan,
+        leaseRef: `fwmemlease:${hostId}`,
+        artifacts: inputs,
+    });
+    const readers = new Map();
+    let readerSequence = 0;
+    const artifactReader = {
+        open({ artifactRef }) {
+            const binary = binaries.get(artifactRef);
+            if (!binary) {
+                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Firmware memory artifact is unavailable');
+            }
+            readerSequence += 1;
+            const readerId = `fwmemreader:${hostId}:${readerSequence}`;
+            readers.set(readerId, binary);
+            return Promise.resolve({ readerId, size: binary.byteLength });
+        },
+        read({ readerId, offset, length }) {
+            const binary = readers.get(readerId);
+            if (!binary || offset < 0 || length <= 0 || offset + length > binary.byteLength) {
+                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Firmware memory artifact read is invalid');
+            }
+            const data = binary.slice(offset, offset + length).buffer;
+            return Promise.resolve({
+                data,
+                bytesRead: data.byteLength,
+                eof: offset + length === binary.byteLength,
+            });
+        },
+        close({ readerId }) {
+            readers.delete(readerId);
+            return Promise.resolve();
+        },
+    };
+    const hostBindingGeneration = sdk.registerFirmwareUpdateHostBinding({
+        artifactReader,
+        preparedPlanDigest: preparedPlan.preparedPlanDigest,
+    });
+    return {
+        preparedPlan,
+        hostBindingGeneration,
+        release: () => {
+            sdk.unregisterFirmwareUpdateHostBinding(hostBindingGeneration);
+            readers.clear();
+            binaries.clear();
+        },
+    };
+}
+
 const Log$6 = getLogger(exports.LoggerNames.Method);
 const SESSION_ERROR$1 = 'session not found';
 const PROTOCOL_V2_BOOTLOADER_RECONNECT_TIMEOUT = 90 * 1000;
@@ -51259,6 +51361,20 @@ const PROTOCOL_V2_RESOURCE_MANIFEST_MAX_BYTES = 1024 * 1024;
 const PROTOCOL_V2_RESOURCE_FILE_MAX_COUNT = 512;
 const PROTOCOL_V2_RESOURCE_TOTAL_MAX_BYTES = 256 * 1024 * 1024;
 const PROTOCOL_V2_NEO_UNSUPPORTED_TARGETS = new Set(['se03', 'se04']);
+const getProtocolV2ZipEntrySizes = (entry) => {
+    var _a;
+    const { compressedSize, uncompressedSize } = (_a = entry._data) !== null && _a !== void 0 ? _a : {};
+    if (!Number.isSafeInteger(compressedSize) ||
+        Number(compressedSize) < 0 ||
+        !Number.isSafeInteger(uncompressedSize) ||
+        Number(uncompressedSize) <= 0) {
+        throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Protocol V2 local resource ZIP entry size is invalid: ${entry.name}`, { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
+    }
+    return {
+        compressedSize: Number(compressedSize),
+        uncompressedSize: Number(uncompressedSize),
+    };
+};
 function assertProtocolV2FirmwareTargetsSupported(deviceType, params) {
     var _a;
     const unsupportedTargets = new Set(((_a = params.targetsToUpdate) !== null && _a !== void 0 ? _a : []).filter(target => PROTOCOL_V2_NEO_UNSUPPORTED_TARGETS.has(target)));
@@ -51347,6 +51463,10 @@ const PROTOCOL_V2_UPDATE_TARGET_BY_TARGET_ID = new Map([
     [ProtocolV2FirmwareTargetType.FW_MGMT_TARGET_SE03, 'se03'],
     [ProtocolV2FirmwareTargetType.FW_MGMT_TARGET_SE04, 'se04'],
 ]);
+const PROTOCOL_V2_INSTALL_TARGET_BY_UPDATE_TARGET = new Map(Object.values(PROTOCOL_V2_REMOTE_COMPONENT_TARGETS).map(target => [
+    PROTOCOL_V2_UPDATE_TARGET_BY_TARGET_ID.get(target.targetId),
+    target,
+]));
 const PROTOCOL_V2_ROMLOADER_UNSUPPORTED_MESSAGE = 'FW_MGMT_TARGET_ROMLOADER is not accepted by the current Pro2 bootloader update request. Flash romloader with the loader-specific flow instead of firmwareUpdateV4.';
 const PROTOCOL_V2_TARGET_ID_BY_DECODED_NAME = new Map(Object.entries(ProtocolV2FirmwareTargetType).map(([key, value]) => [key, value]));
 const PROTOCOL_V2_TARGET_STATUS_BY_DECODED_NAME = new Map([
@@ -51511,7 +51631,7 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
         return ['V2'];
     }
     init() {
-        var _a, _b;
+        var _a, _b, _c, _d, _e;
         this.allowDeviceMode = [UI_REQUEST.BOOTLOADER, UI_REQUEST.NOT_INITIALIZE];
         this.requireDeviceMode = [];
         this.unlockPolicy = 'unlock-before-run';
@@ -51542,6 +51662,9 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
             { name: 'se02Binary', type: 'buffer' },
             { name: 'se03Binary', type: 'buffer' },
             { name: 'se04Binary', type: 'buffer' },
+            { name: 'resourceArchiveBinary', type: 'buffer' },
+            { name: 'resourceFiles', type: 'array', allowEmpty: true },
+            { name: 'resourceBundleArtifacts', type: 'array', allowEmpty: true },
             { name: 'firmwareType', type: 'string' },
             { name: 'targetsToUpdate', type: 'array', allowEmpty: true },
             { name: 'platform', type: 'string' },
@@ -51551,31 +51674,65 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
             (payload.expectedDeviceId.length === 0 || payload.expectedDeviceId.length > 160)) {
             throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.CallMethodInvalidParameter, 'Protocol V2 expected device identity is invalid');
         }
+        if (((_a = payload.resourceFiles) === null || _a === void 0 ? void 0 : _a.length) || ((_b = payload.resourceBundleArtifacts) === null || _b === void 0 ? void 0 : _b.length)) {
+            throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.CallMethodInvalidParameter, 'Protocol V2 resourceFiles and resourceBundleArtifacts are deprecated; provide a complete signed resource ZIP through resourceArchiveBinary or preparedPlan');
+        }
         const preparedPlan = payload.preparedPlan
             ? validateFirmwareUpdatePreparedPlan(payload.preparedPlan)
             : undefined;
+        const hasLocalArtifacts = [
+            payload.bootloaderBinary,
+            payload.romloaderBinary,
+            payload.applicationP1Binary,
+            payload.applicationP2Binary,
+            payload.coprocessorBinary,
+            payload.se01Binary,
+            payload.se02Binary,
+            payload.se03Binary,
+            payload.se04Binary,
+            payload.resourceArchiveBinary,
+        ].some(Boolean);
+        if (preparedPlan && hasLocalArtifacts) {
+            throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.CallMethodInvalidParameter, 'Prepared firmware plans cannot be combined with local firmware or resource binaries');
+        }
         const hostBinding = payload.hostBindingGeneration !== undefined
             ? resolveFirmwareUpdateHostBinding(payload.hostBindingGeneration, preparedPlan === null || preparedPlan === void 0 ? void 0 : preparedPlan.preparedPlanDigest)
             : undefined;
         if (preparedPlan) {
-            const componentArtifacts = ((_a = payload.componentArtifacts) !== null && _a !== void 0 ? _a : {});
             assertFirmwareUpdatePreparedPlanBinding({
                 preparedPlan,
                 executor: 'v4',
                 platform: payload.platform,
-                scopeTargets: ['boot', 'app_v1', 'app_v2', 'coprocessor', 'se01', 'se02', 'se03', 'se04'],
-                bindings: [
-                    ...Object.entries(componentArtifacts).flatMap(([target, artifact]) => artifact
-                        ? [
-                            {
-                                target: target,
-                                artifact,
-                            },
-                        ]
-                        : []),
-                ],
+                scopeTargets: [],
+                bindings: [],
             });
+            if (payload.componentArtifacts) {
+                const componentBindings = Object.entries(payload.componentArtifacts).flatMap(([target, artifact]) => artifact
+                    ? [
+                        {
+                            target: target,
+                            artifact: artifact,
+                        },
+                    ]
+                    : []);
+                assertFirmwareUpdatePreparedPlanBinding({
+                    preparedPlan,
+                    executor: 'v4',
+                    platform: payload.platform,
+                    scopeTargets: componentBindings.map(binding => binding.target),
+                    bindings: componentBindings,
+                });
+            }
         }
+        const preparedExpectedTargetVersions = preparedPlan === null || preparedPlan === void 0 ? void 0 : preparedPlan.artifacts.reduce((result, artifact) => {
+            if (artifact.role === 'component' &&
+                artifact.target !== 'resource' &&
+                artifact.targetVersion &&
+                PROTOCOL_V2_INSTALL_TARGET_BY_UPDATE_TARGET.has(artifact.target)) {
+                result[artifact.target] = artifact.targetVersion;
+            }
+            return result;
+        }, {});
         this.params = {
             preparedPlan,
             chunkSize: payload.chunkSize,
@@ -51589,13 +51746,18 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
             se02Binary: payload.se02Binary,
             se03Binary: payload.se03Binary,
             se04Binary: payload.se04Binary,
-            firmwareType: payload.firmwareType,
-            targetsToUpdate: payload.targetsToUpdate,
-            expectedTargetVersions: payload.expectedTargetVersions,
+            resourceArchiveBinary: payload.resourceArchiveBinary,
+            firmwareType: (_c = preparedPlan === null || preparedPlan === void 0 ? void 0 : preparedPlan.firmwareType) !== null && _c !== void 0 ? _c : payload.firmwareType,
+            targetsToUpdate: preparedPlan
+                ? [...preparedPlan.targetsToUpdate]
+                : (_d = payload.targetsToUpdate) === null || _d === void 0 ? void 0 : _d.map((target) => target === 'boot_resources' ? 'resource' : target),
+            expectedTargetVersions: preparedPlan
+                ? preparedExpectedTargetVersions
+                : payload.expectedTargetVersions,
             platform: payload.platform,
             expectedDeviceId: payload.expectedDeviceId,
-            artifactReader: (_b = hostBinding === null || hostBinding === void 0 ? void 0 : hostBinding.artifactReader) !== null && _b !== void 0 ? _b : payload.artifactReader,
-            componentArtifacts: payload.componentArtifacts,
+            artifactReader: (_e = hostBinding === null || hostBinding === void 0 ? void 0 : hostBinding.artifactReader) !== null && _e !== void 0 ? _e : payload.artifactReader,
+            componentArtifacts: preparedPlan ? undefined : payload.componentArtifacts,
         };
     }
     getProtocolV2FirmwareChunkSize(direction, filePath) {
@@ -51626,7 +51788,7 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
         });
     }
     runProtocolV2() {
-        var _a, _b, _c, _d, _e;
+        var _a, _b, _c, _d, _e, _f;
         return __awaiter(this, void 0, void 0, function* () {
             yield this.captureProtocolV2PhysicalIdentity();
             const deviceFeatures = yield this.getProtocolV2DeviceFeatures();
@@ -51638,11 +51800,25 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
             const deviceFirmwareType = getFirmwareType(deviceFeatures);
             const firmwareType = (_a = this.params.firmwareType) !== null && _a !== void 0 ? _a : deviceFirmwareType;
             this.validateExpectedTargetVersions();
-            const hasPreparedComponentArtifacts = Object.values((_b = this.params.componentArtifacts) !== null && _b !== void 0 ? _b : {}).some(Boolean);
+            if (!this.params.preparedPlan &&
+                this.params.resourceArchiveBinary &&
+                ((_b = this.params.targetsToUpdate) === null || _b === void 0 ? void 0 : _b.includes('resource'))) {
+                const localMemoryHost = yield this.prepareProtocolV2LocalMemoryHost({
+                    features: deviceFeatures,
+                    firmwareType,
+                });
+                try {
+                    return yield this.runProtocolV2PreparedArtifacts(deviceFeatures, firmwareType);
+                }
+                finally {
+                    localMemoryHost.release();
+                }
+            }
+            const hasPreparedComponentArtifacts = Object.values((_c = this.params.componentArtifacts) !== null && _c !== void 0 ? _c : {}).some(Boolean);
             if (this.params.preparedPlan || hasPreparedComponentArtifacts) {
                 return this.runProtocolV2PreparedArtifacts(deviceFeatures, firmwareType);
             }
-            const wantsResources = !!((_c = this.params.targetsToUpdate) === null || _c === void 0 ? void 0 : _c.includes('resource'));
+            const wantsResources = !!((_d = this.params.targetsToUpdate) === null || _d === void 0 ? void 0 : _d.includes('resource'));
             let fwBinaryMap = [];
             let bootloaderBinary = null;
             let installItems;
@@ -51655,11 +51831,11 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
                     fwBinaryMap,
                 });
                 const missingFirmwareTargets = this.getMissingProtocolV2FirmwareTargets(explicitInstallItems);
-                const needsRemoteFirmware = ((_d = this.params.targetsToUpdate) === null || _d === void 0 ? void 0 : _d.length)
+                const needsRemoteFirmware = ((_e = this.params.targetsToUpdate) === null || _e === void 0 ? void 0 : _e.length)
                     ? missingFirmwareTargets.length > 0
                     : explicitInstallItems.length === 0;
                 if (wantsResources) {
-                    throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 resource manifest must be prepared by the external firmware host', {
+                    throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 resource archive must be provided through a local or external PreparedPlan', {
                         firmwareUpdateCode: 'FirmwareArtifactsNotPrepared',
                     });
                 }
@@ -51685,7 +51861,7 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
                 if (typeof err === 'object' &&
                     err !== null &&
                     'params' in err &&
-                    ((_e = err.params) === null || _e === void 0 ? void 0 : _e.firmwareUpdateCode) === 'FirmwareArtifactsNotPrepared') {
+                    ((_f = err.params) === null || _f === void 0 ? void 0 : _f.firmwareUpdateCode) === 'FirmwareArtifactsNotPrepared') {
                     throw err;
                 }
                 if (err instanceof hdShared.HardwareError && err.errorCode === hdShared.HardwareErrorCode.NetworkError) {
@@ -51734,6 +51910,34 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
     prepareProtocolV2InstallSources(firmwareType, features) {
         var _a, _b;
         return __awaiter(this, void 0, void 0, function* () {
+            if (this.params.preparedPlan) {
+                const requestedTargets = new Set(this.params.preparedPlan.targetsToUpdate.filter((target) => target !== 'resource'));
+                const installSources = [];
+                const preparedTargets = new Set();
+                for (const artifact of this.params.preparedPlan.artifacts) {
+                    if (artifact.target !== 'resource') {
+                        const target = artifact.target;
+                        const installTarget = PROTOCOL_V2_INSTALL_TARGET_BY_UPDATE_TARGET.get(target);
+                        if (!requestedTargets.has(target) ||
+                            artifact.role !== 'component' ||
+                            artifact.container !== 'raw' ||
+                            !installTarget ||
+                            preparedTargets.has(target)) {
+                            throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Protocol V2 prepared component artifact is invalid: ${artifact.artifactId}`, { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
+                        }
+                        installSources.push(Object.assign(Object.assign({}, installTarget), { source: yield this.openProtocolV2PreparedSource(artifact.artifact) }));
+                        preparedTargets.add(target);
+                    }
+                }
+                const missingTarget = Array.from(requestedTargets).find(target => !preparedTargets.has(target));
+                if (missingTarget) {
+                    throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Protocol V2 ${missingTarget} artifact is not prepared`, {
+                        firmwareUpdateCode: 'FirmwareArtifactsNotPrepared',
+                        artifactName: missingTarget,
+                    });
+                }
+                return installSources;
+            }
             const release = DataManager.getFirmwareLatestRelease(features, firmwareType);
             if (!release) {
                 throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 firmware release is unavailable');
@@ -51764,6 +51968,180 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
             return installSources;
         });
     }
+    prepareProtocolV2LocalMemoryHost({ features, firmwareType, }) {
+        var _a, _b;
+        return __awaiter(this, void 0, void 0, function* () {
+            const installItems = this.buildProtocolV2InstallItems({
+                bootloaderBinary: this.prepareBootloaderBinary(),
+                fwBinaryMap: this.collectExplicitTargetBinaries(),
+            });
+            const requestedComponentTargets = new Set(((_a = this.params.targetsToUpdate) !== null && _a !== void 0 ? _a : []).filter((target) => target !== 'resource' && target !== 'boot_resources'));
+            const localComponentTargets = new Set(installItems.flatMap(item => {
+                const target = PROTOCOL_V2_UPDATE_TARGET_BY_TARGET_ID.get(item.targetId);
+                return target ? [target] : [];
+            }));
+            const missingTarget = Array.from(requestedComponentTargets).find(target => !localComponentTargets.has(target));
+            if (missingTarget) {
+                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Protocol V2 local update has no binary for requested target ${missingTarget}`, {
+                    firmwareUpdateCode: 'FirmwareArtifactsNotPrepared',
+                    artifactName: missingTarget,
+                });
+            }
+            const planArtifacts = [];
+            const memoryArtifacts = [];
+            for (const item of installItems) {
+                const target = PROTOCOL_V2_UPDATE_TARGET_BY_TARGET_ID.get(item.targetId);
+                if (!target || item.binary.byteLength <= 0) {
+                    throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Protocol V2 local firmware artifact is invalid: ${item.fileName}`, { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
+                }
+                const artifactId = `component:${target}`;
+                planArtifacts.push(Object.assign({ artifactId,
+                    target, container: 'raw', logicalName: item.fileName, expectedSize: item.binary.byteLength, expectedSha256: bytesToHex(sha256.sha256(new Uint8Array(item.binary))) }, (((_b = this.params.expectedTargetVersions) === null || _b === void 0 ? void 0 : _b[target])
+                    ? { targetVersion: this.params.expectedTargetVersions[target] }
+                    : {})));
+                memoryArtifacts.push({ artifactId, binary: item.binary });
+            }
+            const resourceArchive = yield this.prepareProtocolV2LocalResourceArchive(this.params.resourceArchiveBinary);
+            const resourceArtifactId = 'resource:archive';
+            planArtifacts.push({
+                artifactId: resourceArtifactId,
+                target: 'resource',
+                container: 'zip',
+                logicalName: 'protocol-v2-local-resource-archive',
+                expectedSize: resourceArchive.binary.byteLength,
+                expectedSha256: bytesToHex(sha256.sha256(new Uint8Array(resourceArchive.binary))),
+            });
+            memoryArtifacts.push({
+                artifactId: resourceArtifactId,
+                binary: resourceArchive.binary,
+                materializedEntries: resourceArchive.materializedEntries,
+            });
+            const plan = buildProtocolV2LocalFirmwareUpdatePlan({
+                features,
+                firmwareType,
+                platform: this.params.platform,
+                artifacts: planArtifacts,
+            });
+            let memoryHost;
+            try {
+                memoryHost = prepareFirmwareUpdateV4MemoryHost({
+                    sdk: {
+                        prepareFirmwareUpdatePlan,
+                        registerFirmwareUpdateHostBinding,
+                        unregisterFirmwareUpdateHostBinding,
+                    },
+                    plan,
+                    artifacts: memoryArtifacts,
+                });
+                const preparedPlan = validateFirmwareUpdatePreparedPlan(memoryHost.preparedPlan);
+                assertFirmwareUpdatePreparedPlanBinding({
+                    preparedPlan,
+                    executor: 'v4',
+                    platform: this.params.platform,
+                    scopeTargets: [],
+                    bindings: [],
+                });
+                assertFirmwareUpdatePreparedPlanDeviceIdentity({
+                    preparedPlan,
+                    deviceIdentity: this.protocolV2ExpectedSerialNumber,
+                });
+                const hostBinding = resolveFirmwareUpdateHostBinding(memoryHost.hostBindingGeneration, preparedPlan.preparedPlanDigest);
+                this.params.preparedPlan = preparedPlan;
+                this.params.targetsToUpdate = [...preparedPlan.targetsToUpdate];
+                this.params.artifactReader = hostBinding.artifactReader;
+                this.params.componentArtifacts = undefined;
+                return memoryHost;
+            }
+            catch (error) {
+                memoryHost === null || memoryHost === void 0 ? void 0 : memoryHost.release();
+                throw error;
+            }
+        });
+    }
+    prepareProtocolV2LocalResourceArchive(binary) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            if (binary.byteLength <= 0 || binary.byteLength > PROTOCOL_V2_RESOURCE_TOTAL_MAX_BYTES) {
+                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 local resource ZIP archive size is invalid', { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
+            }
+            const zip = yield JSZip__default["default"].loadAsync(binary);
+            const zipEntries = Object.values(zip.files);
+            if (zipEntries.some(entry => entry.unsafeOriginalName && entry.unsafeOriginalName !== entry.name)) {
+                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 local resource ZIP contains an unsafe entry path', { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
+            }
+            const entries = zipEntries.filter(entry => !entry.dir);
+            if (entries.length === 0 || entries.length > PROTOCOL_V2_RESOURCE_FILE_MAX_COUNT + 1) {
+                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 local resource ZIP entry set is invalid', { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
+            }
+            let declaredUncompressedSize = 0;
+            let declaredCompressedSize = 0;
+            for (const entry of entries) {
+                const sizes = getProtocolV2ZipEntrySizes(entry);
+                declaredCompressedSize += sizes.compressedSize;
+                declaredUncompressedSize += sizes.uncompressedSize;
+                const entryLimit = entry.name === 'manifest.json'
+                    ? PROTOCOL_V2_RESOURCE_MANIFEST_MAX_BYTES
+                    : PROTOCOL_V2_RESOURCE_TOTAL_MAX_BYTES;
+                if (sizes.uncompressedSize > entryLimit ||
+                    declaredCompressedSize > binary.byteLength ||
+                    declaredUncompressedSize >
+                        PROTOCOL_V2_RESOURCE_TOTAL_MAX_BYTES + PROTOCOL_V2_RESOURCE_MANIFEST_MAX_BYTES) {
+                    throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 local resource ZIP declared size exceeds the allowed limit', { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
+                }
+            }
+            const manifestEntry = zip.file('manifest.json');
+            if (!manifestEntry) {
+                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 local resource ZIP has no manifest.json', { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
+            }
+            const manifestBinary = yield manifestEntry.async('arraybuffer');
+            if (manifestBinary.byteLength <= 0 ||
+                manifestBinary.byteLength > PROTOCOL_V2_RESOURCE_MANIFEST_MAX_BYTES) {
+                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 local resource manifest size is invalid', { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
+            }
+            let manifestValue;
+            try {
+                manifestValue = JSON.parse(new TextDecoder().decode(manifestBinary));
+            }
+            catch (error) {
+                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Protocol V2 local resource manifest is invalid: ${String(error)}`, { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
+            }
+            const manifest = parseProtocolV2ResourceManifest(manifestValue);
+            const selectedFiles = selectProtocolV2ResourceManifestFiles({
+                manifest,
+                targetsToUpdate: (_a = this.params.targetsToUpdate) !== null && _a !== void 0 ? _a : [],
+            });
+            const expectedEntryNames = new Set([
+                'manifest.json',
+                ...selectedFiles.map(file => file.archive_path),
+            ]);
+            if (entries.length !== expectedEntryNames.size ||
+                entries.some(entry => !expectedEntryNames.has(entry.name))) {
+                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 local resource ZIP contains an unexpected entry', { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
+            }
+            let totalSize = 0;
+            const materializedEntries = [
+                { entryName: 'manifest.json', binary: manifestBinary },
+            ];
+            for (const file of selectedFiles) {
+                const entry = zip.file(file.archive_path);
+                if (!entry) {
+                    throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Protocol V2 local resource ZIP is missing ${file.archive_path}`, { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
+                }
+                const { uncompressedSize } = getProtocolV2ZipEntrySizes(entry);
+                totalSize += uncompressedSize;
+                if (uncompressedSize !== file.size || totalSize > PROTOCOL_V2_RESOURCE_TOTAL_MAX_BYTES) {
+                    throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Protocol V2 local resource file declared size is invalid: ${file.archive_path}`, { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' });
+                }
+                const fileBinary = yield entry.async('arraybuffer');
+                const digest = bytesToHex(sha256.sha256(new Uint8Array(fileBinary)));
+                if (fileBinary.byteLength !== file.size || digest !== file.sha256.toLowerCase()) {
+                    throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Protocol V2 local resource file does not match manifest: ${file.archive_path}`, { firmwareUpdateCode: 'FirmwareArtifactReceiptMismatch' });
+                }
+                materializedEntries.push({ entryName: file.archive_path, binary: fileBinary });
+            }
+            return { binary, materializedEntries };
+        });
+    }
     prepareProtocolV2ResourceSources() {
         var _a, _b;
         return __awaiter(this, void 0, void 0, function* () {
@@ -52039,7 +52417,9 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
             const target = PROTOCOL_V2_UPDATE_TARGET_BY_TARGET_ID.get(item.targetId);
             return target ? [target] : [];
         }));
-        return ((_a = this.params.targetsToUpdate) !== null && _a !== void 0 ? _a : []).filter(target => target !== 'resource' && !preparedTargets.has(target));
+        return ((_a = this.params.targetsToUpdate) !== null && _a !== void 0 ? _a : [])
+            .filter((target) => target !== 'resource' && target !== 'boot_resources')
+            .filter(target => !preparedTargets.has(target));
     }
     buildProtocolV2InstallItems({ bootloaderBinary, fwBinaryMap, }) {
         const installItems = [];
@@ -52088,7 +52468,17 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
             if (!component.url) {
                 throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Missing Protocol V2 firmware component url: ${key}/${component.target}`);
             }
+            const expectedFingerprint = normalizeProtocolV2Hex(component.fingerprint);
+            if (!Number.isSafeInteger(component.expectedSize) ||
+                Number(component.expectedSize) <= 0 ||
+                !expectedFingerprint ||
+                !/^[0-9a-f]{64}$/u.test(expectedFingerprint)) {
+                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Protocol V2 firmware component integrity metadata is invalid: ${key}/${component.target}`, { firmwareUpdateCode: 'FirmwarePlanInvalid' });
+            }
             const { binary } = yield getSysResourceBinary(component.url);
+            if (binary.byteLength !== component.expectedSize) {
+                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Protocol V2 firmware size mismatch: ${key}/${component.target}`, { firmwareUpdateCode: 'FirmwareArtifactReceiptMismatch' });
+            }
             if (!isProtocolV2FirmwareFingerprintValid(binary, component.fingerprint)) {
                 throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Protocol V2 firmware fingerprint mismatch: ${key}/${component.target}`);
             }
@@ -52416,7 +52806,7 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
             });
         });
     }
-    executeProtocolV2Update({ fwBinaryMap, bootloaderBinary, installItems, }) {
+    executeProtocolV2Update({ fwBinaryMap, bootloaderBinary, installItems, resourceBundles = [], }) {
         return __awaiter(this, void 0, void 0, function* () {
             const memoryInstallItems = installItems !== null && installItems !== void 0 ? installItems : this.buildProtocolV2InstallItems({
                 fwBinaryMap: fwBinaryMap !== null && fwBinaryMap !== void 0 ? fwBinaryMap : [],
@@ -52431,9 +52821,12 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
                         kind: item.kind,
                     });
                 })));
+                const resourceSources = yield Promise.all(resourceBundles.map((resource) => __awaiter(this, void 0, void 0, function* () {
+                    return (Object.assign(Object.assign(Object.assign({ name: resource.name, source: yield this.openProtocolV2MemorySource(resource.binary), devicePath: resource.devicePath }, (resource.version ? { version: resource.version } : {})), (resource.payloadHash ? { payloadHash: resource.payloadHash } : {})), (resource.headerHash ? { headerHash: resource.headerHash } : {})));
+                })));
                 return yield this.executeProtocolV2Phases({
                     installSources,
-                    resourceSources: [],
+                    resourceSources,
                 });
             }
             finally {
@@ -65046,111 +65439,6 @@ const switchTransport = ({ env, Transport, plugin, }) => {
     initConnector();
 };
 
-let memoryHostSequence = 0;
-const FIRMWARE_UPDATE_V4_COMPONENT_TARGETS = new Set([
-    'boot',
-    'app_v1',
-    'app_v2',
-    'coprocessor',
-    'se01',
-    'se02',
-    'se03',
-    'se04',
-]);
-const isFirmwareUpdateV4ComponentTarget = (target) => FIRMWARE_UPDATE_V4_COMPONENT_TARGETS.has(target);
-const createReference = (binary, prefix) => {
-    const digest = utils.bytesToHex(sha256.sha256(new Uint8Array(binary)));
-    return {
-        artifactRef: `fwmem:${prefix}:${digest.slice(0, 32)}`,
-        size: binary.byteLength,
-        sha256: digest,
-    };
-};
-function prepareFirmwareUpdateV4MemoryHost({ sdk, plan, artifacts, }) {
-    if (plan.executor !== 'v4') {
-        throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Firmware memory host only supports V4 plans');
-    }
-    memoryHostSequence += 1;
-    const hostId = `${Date.now()}:${memoryHostSequence}`;
-    const binaries = new Map();
-    const inputs = artifacts.map((input, artifactIndex) => {
-        var _a;
-        const artifact = createReference(input.binary, `${hostId}:artifact:${artifactIndex}`);
-        binaries.set(artifact.artifactRef, new Uint8Array(input.binary));
-        const materializedEntries = (_a = input.materializedEntries) === null || _a === void 0 ? void 0 : _a.map((entry, entryIndex) => {
-            const entryArtifact = createReference(entry.binary, `${hostId}:entry:${artifactIndex}:${entryIndex}`);
-            binaries.set(entryArtifact.artifactRef, new Uint8Array(entry.binary));
-            return {
-                entryName: entry.entryName,
-                artifact: entryArtifact,
-            };
-        });
-        return Object.assign({ artifactId: input.artifactId, artifact }, ((materializedEntries === null || materializedEntries === void 0 ? void 0 : materializedEntries.length) ? { materializedEntries } : {}));
-    });
-    const preparedPlan = sdk.prepareFirmwareUpdatePlan({
-        plan,
-        leaseRef: `fwmemlease:${hostId}`,
-        artifacts: inputs,
-    });
-    const readers = new Map();
-    let readerSequence = 0;
-    const artifactReader = {
-        open({ artifactRef }) {
-            const binary = binaries.get(artifactRef);
-            if (!binary) {
-                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Firmware memory artifact is unavailable');
-            }
-            readerSequence += 1;
-            const readerId = `fwmemreader:${hostId}:${readerSequence}`;
-            readers.set(readerId, binary);
-            return Promise.resolve({ readerId, size: binary.byteLength });
-        },
-        read({ readerId, offset, length }) {
-            const binary = readers.get(readerId);
-            if (!binary || offset < 0 || length <= 0 || offset + length > binary.byteLength) {
-                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Firmware memory artifact read is invalid');
-            }
-            const data = binary.slice(offset, offset + length).buffer;
-            return Promise.resolve({
-                data,
-                bytesRead: data.byteLength,
-                eof: offset + length === binary.byteLength,
-            });
-        },
-        close({ readerId }) {
-            readers.delete(readerId);
-            return Promise.resolve();
-        },
-    };
-    const hostBindingGeneration = sdk.registerFirmwareUpdateHostBinding({
-        artifactReader,
-        preparedPlanDigest: preparedPlan.preparedPlanDigest,
-    });
-    const componentArtifacts = {};
-    const expectedTargetVersions = {};
-    for (const artifact of preparedPlan.artifacts) {
-        if (artifact.role === 'component' && isFirmwareUpdateV4ComponentTarget(artifact.target)) {
-            componentArtifacts[artifact.target] = artifact.artifact;
-        }
-        if (artifact.targetVersion) {
-            expectedTargetVersions[artifact.target] = artifact.targetVersion;
-        }
-    }
-    return {
-        preparedPlan,
-        hostBindingGeneration,
-        targetsToUpdate: [...preparedPlan.targetsToUpdate],
-        expectedDeviceId: preparedPlan.deviceIdentity,
-        expectedTargetVersions,
-        componentArtifacts,
-        release: () => {
-            sdk.unregisterFirmwareUpdateHostBinding(hostBindingGeneration);
-            readers.clear();
-            binaries.clear();
-        },
-    };
-}
-
 const HardwareSdk = ({ init, call, dispose, eventEmitter, uiResponse, cancel, updateSettings, switchTransport, }) => inject({
     init,
     call,