@onekeyfe/hd-core 1.2.0-alpha.87 → 1.2.0-alpha.89

package/src/api/FirmwareUpdateV4.ts

@@ -1,4 +1,5 @@
 import { EDeviceType, ERRORS, HardwareError, HardwareErrorCode, wait } from '@onekeyfe/hd-shared';
+import JSZip from 'jszip';
 import {
   DeviceRebootType,
   PROTOCOL_V2_BLE_FILE_CHUNK_SIZE,
@@ -42,12 +43,19 @@ import {
   readFirmwareByteSourceFully,
   writeFirmwareByteSource,
 } from './firmware/FirmwareArtifactSource';
-import { resolveFirmwareUpdateHostBinding } from './firmware/FirmwareHostBinding';
+import {
+  registerFirmwareUpdateHostBinding,
+  resolveFirmwareUpdateHostBinding,
+  unregisterFirmwareUpdateHostBinding,
+} from './firmware/FirmwareHostBinding';
 import {
   assertFirmwareUpdatePreparedPlanBinding,
   assertFirmwareUpdatePreparedPlanDeviceIdentity,
+  prepareFirmwareUpdatePlan,
   validateFirmwareUpdatePreparedPlan,
 } from './firmware/FirmwareUpdatePreparedPlan';
+import { prepareFirmwareUpdateV4MemoryHost } from './firmware/FirmwareMemoryHost';
+import { buildProtocolV2LocalFirmwareUpdatePlan } from './firmware/FirmwareUpdatePlan';
 
 import type {
   FirmwareArtifactReference,
@@ -64,6 +72,11 @@ import type {
   IVersionArray,
 } from '../types';
 import type { FirmwareByteSource } from './firmware/FirmwareArtifactSource';
+import type {
+  FirmwareMemoryArtifact,
+  FirmwareMemoryArtifactEntry,
+  FirmwareUpdateV4MemoryHost,
+} from './firmware/FirmwareMemoryHost';
 
 const Log = getLogger(LoggerNames.Method);
 
@@ -101,6 +114,28 @@ const PROTOCOL_V2_RESOURCE_TOTAL_MAX_BYTES = 256 * 1024 * 1024;
 
 const PROTOCOL_V2_NEO_UNSUPPORTED_TARGETS = new Set<FirmwareUpdateV4Target>(['se03', 'se04']);
 
+const getProtocolV2ZipEntrySizes = (entry: JSZip.JSZipObject) => {
+  // loadAsync records central-directory sizes on JSZip's documented private data object.
+  // Validate those bounds before calling async(), which allocates the decompressed entry.
+  const { compressedSize, uncompressedSize } = (entry as JSZipSizedEntry)._data ?? {};
+  if (
+    !Number.isSafeInteger(compressedSize) ||
+    Number(compressedSize) < 0 ||
+    !Number.isSafeInteger(uncompressedSize) ||
+    Number(uncompressedSize) <= 0
+  ) {
+    throw ERRORS.TypedError(
+      HardwareErrorCode.RuntimeError,
+      `Protocol V2 local resource ZIP entry size is invalid: ${entry.name}`,
+      { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' }
+    );
+  }
+  return {
+    compressedSize: Number(compressedSize),
+    uncompressedSize: Number(uncompressedSize),
+  };
+};
+
 export function assertProtocolV2FirmwareTargetsSupported(
   deviceType: EDeviceType | string | undefined,
   params: FirmwareUpdateV4Params
@@ -178,6 +213,22 @@ type ProtocolV2ResourceBundleSource = {
   headerHash?: string;
 };
 
+type ProtocolV2ResourceBundleBinary = Omit<ProtocolV2ResourceBundleSource, 'source'> & {
+  binary: ArrayBuffer;
+};
+
+type ProtocolV2LocalResourceArchive = {
+  binary: ArrayBuffer;
+  materializedEntries: FirmwareMemoryArtifactEntry[];
+};
+
+type JSZipSizedEntry = JSZip.JSZipObject & {
+  _data?: {
+    compressedSize?: unknown;
+    uncompressedSize?: unknown;
+  };
+};
+
 type ProtocolV2ExecutionPhaseKind =
   | 'resource-sync'
   | 'bootloader-install'
@@ -259,7 +310,10 @@ const resolveProtocolV2ResourceWritePath = (devicePath: string) => {
     : devicePath;
 };
 
-const PROTOCOL_V2_UPDATE_TARGET_BY_TARGET_ID = new Map<number, FirmwareUpdateV4Target>([
+const PROTOCOL_V2_UPDATE_TARGET_BY_TARGET_ID = new Map<
+  number,
+  Exclude<FirmwareUpdateV4Target, 'boot_resources'>
+>([
   [ProtocolV2FirmwareTargetType.FW_MGMT_TARGET_BOOTLOADER, 'boot'],
   [ProtocolV2FirmwareTargetType.FW_MGMT_TARGET_APPLICATION_P1, 'app_v1'],
   [ProtocolV2FirmwareTargetType.FW_MGMT_TARGET_APPLICATION_P2, 'app_v2'],
@@ -270,6 +324,19 @@ const PROTOCOL_V2_UPDATE_TARGET_BY_TARGET_ID = new Map<number, FirmwareUpdateV4T
   [ProtocolV2FirmwareTargetType.FW_MGMT_TARGET_SE04, 'se04'],
 ]);
 
+const PROTOCOL_V2_INSTALL_TARGET_BY_UPDATE_TARGET = new Map<
+  Exclude<FirmwareUpdateV4Target, 'resource'>,
+  ProtocolV2RemoteComponentTarget
+>(
+  Object.values(PROTOCOL_V2_REMOTE_COMPONENT_TARGETS).map(target => [
+    PROTOCOL_V2_UPDATE_TARGET_BY_TARGET_ID.get(target.targetId) as Exclude<
+      FirmwareUpdateV4Target,
+      'resource'
+    >,
+    target,
+  ])
+);
+
 const PROTOCOL_V2_ROMLOADER_UNSUPPORTED_MESSAGE =
   'FW_MGMT_TARGET_ROMLOADER is not accepted by the current Pro2 bootloader update request. Flash romloader with the loader-specific flow instead of firmwareUpdateV4.';
 
@@ -541,6 +608,9 @@ export default class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod<FirmwareU
       { name: 'se02Binary', type: 'buffer' },
       { name: 'se03Binary', type: 'buffer' },
       { name: 'se04Binary', type: 'buffer' },
+      { name: 'resourceArchiveBinary', type: 'buffer' },
+      { name: 'resourceFiles', type: 'array', allowEmpty: true },
+      { name: 'resourceBundleArtifacts', type: 'array', allowEmpty: true },
       { name: 'firmwareType', type: 'string' },
       { name: 'targetsToUpdate', type: 'array', allowEmpty: true },
       { name: 'platform', type: 'string' },
@@ -555,9 +625,33 @@ export default class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod<FirmwareU
         'Protocol V2 expected device identity is invalid'
       );
     }
+    if (payload.resourceFiles?.length || payload.resourceBundleArtifacts?.length) {
+      throw ERRORS.TypedError(
+        HardwareErrorCode.CallMethodInvalidParameter,
+        'Protocol V2 resourceFiles and resourceBundleArtifacts are deprecated; provide a complete signed resource ZIP through resourceArchiveBinary or preparedPlan'
+      );
+    }
     const preparedPlan = payload.preparedPlan
       ? validateFirmwareUpdatePreparedPlan(payload.preparedPlan)
       : undefined;
+    const hasLocalArtifacts = [
+      payload.bootloaderBinary,
+      payload.romloaderBinary,
+      payload.applicationP1Binary,
+      payload.applicationP2Binary,
+      payload.coprocessorBinary,
+      payload.se01Binary,
+      payload.se02Binary,
+      payload.se03Binary,
+      payload.se04Binary,
+      payload.resourceArchiveBinary,
+    ].some(Boolean);
+    if (preparedPlan && hasLocalArtifacts) {
+      throw ERRORS.TypedError(
+        HardwareErrorCode.CallMethodInvalidParameter,
+        'Prepared firmware plans cannot be combined with local firmware or resource binaries'
+      );
+    }
     const hostBinding =
       payload.hostBindingGeneration !== undefined
         ? resolveFirmwareUpdateHostBinding(
@@ -566,29 +660,53 @@ export default class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod<FirmwareU
           )
         : undefined;
     if (preparedPlan) {
-      const componentArtifacts = (payload.componentArtifacts ?? {}) as NonNullable<
-        FirmwareUpdateV4Params['componentArtifacts']
-      >;
       assertFirmwareUpdatePreparedPlanBinding({
         preparedPlan,
         executor: 'v4',
         platform: payload.platform,
-        scopeTargets: ['boot', 'app_v1', 'app_v2', 'coprocessor', 'se01', 'se02', 'se03', 'se04'],
-        bindings: [
-          ...Object.entries(componentArtifacts).flatMap(([target, artifact]) =>
-            artifact
-              ? [
-                  {
-                    target: target as Exclude<FirmwareUpdateV4Target, 'resource'>,
-                    artifact,
-                  },
-                ]
-              : []
-          ),
-        ],
+        scopeTargets: [],
+        bindings: [],
       });
+      if (payload.componentArtifacts) {
+        const componentBindings: Array<{
+          target: Exclude<FirmwareUpdateV4Target, 'resource'>;
+          artifact: FirmwareArtifactReference;
+        }> = Object.entries(payload.componentArtifacts).flatMap(([target, artifact]) =>
+          artifact
+            ? [
+                {
+                  target: target as Exclude<FirmwareUpdateV4Target, 'resource'>,
+                  artifact: artifact as FirmwareArtifactReference,
+                },
+              ]
+            : []
+        );
+        assertFirmwareUpdatePreparedPlanBinding({
+          preparedPlan,
+          executor: 'v4',
+          platform: payload.platform,
+          scopeTargets: componentBindings.map(binding => binding.target),
+          bindings: componentBindings,
+        });
+      }
     }
 
+    const preparedExpectedTargetVersions = preparedPlan?.artifacts.reduce<
+      NonNullable<FirmwareUpdateV4Params['expectedTargetVersions']>
+    >((result, artifact) => {
+      if (
+        artifact.role === 'component' &&
+        artifact.target !== 'resource' &&
+        artifact.targetVersion &&
+        PROTOCOL_V2_INSTALL_TARGET_BY_UPDATE_TARGET.has(
+          artifact.target as Exclude<FirmwareUpdateV4Target, 'resource'>
+        )
+      ) {
+        result[artifact.target as FirmwareUpdateV4Target] = artifact.targetVersion;
+      }
+      return result;
+    }, {});
+
     this.params = {
       preparedPlan,
       chunkSize: payload.chunkSize,
@@ -602,13 +720,20 @@ export default class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod<FirmwareU
       se02Binary: payload.se02Binary,
       se03Binary: payload.se03Binary,
       se04Binary: payload.se04Binary,
-      firmwareType: payload.firmwareType,
-      targetsToUpdate: payload.targetsToUpdate,
-      expectedTargetVersions: payload.expectedTargetVersions,
+      resourceArchiveBinary: payload.resourceArchiveBinary,
+      firmwareType: preparedPlan?.firmwareType ?? payload.firmwareType,
+      targetsToUpdate: preparedPlan
+        ? ([...preparedPlan.targetsToUpdate] as FirmwareUpdateV4Target[])
+        : payload.targetsToUpdate?.map((target: FirmwareUpdateV4Target) =>
+            target === 'boot_resources' ? 'resource' : target
+          ),
+      expectedTargetVersions: preparedPlan
+        ? preparedExpectedTargetVersions
+        : payload.expectedTargetVersions,
       platform: payload.platform,
       expectedDeviceId: payload.expectedDeviceId,
       artifactReader: hostBinding?.artifactReader ?? payload.artifactReader,
-      componentArtifacts: payload.componentArtifacts,
+      componentArtifacts: preparedPlan ? undefined : payload.componentArtifacts,
     };
   }
 
@@ -654,6 +779,22 @@ export default class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod<FirmwareU
     const firmwareType = this.params.firmwareType ?? deviceFirmwareType;
     this.validateExpectedTargetVersions();
 
+    if (
+      !this.params.preparedPlan &&
+      this.params.resourceArchiveBinary &&
+      this.params.targetsToUpdate?.includes('resource')
+    ) {
+      const localMemoryHost = await this.prepareProtocolV2LocalMemoryHost({
+        features: deviceFeatures,
+        firmwareType,
+      });
+      try {
+        return await this.runProtocolV2PreparedArtifacts(deviceFeatures, firmwareType);
+      } finally {
+        localMemoryHost.release();
+      }
+    }
+
     const hasPreparedComponentArtifacts = Object.values(this.params.componentArtifacts ?? {}).some(
       Boolean
     );
@@ -680,7 +821,7 @@ export default class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod<FirmwareU
       if (wantsResources) {
         throw ERRORS.TypedError(
           HardwareErrorCode.RuntimeError,
-          'Protocol V2 resource manifest must be prepared by the external firmware host',
+          'Protocol V2 resource archive must be provided through a local or external PreparedPlan',
           {
             firmwareUpdateCode: 'FirmwareArtifactsNotPrepared',
           }
@@ -782,6 +923,54 @@ export default class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod<FirmwareU
     firmwareType: EFirmwareType,
     features: Features
   ): Promise<ProtocolV2InstallSource[]> {
+    if (this.params.preparedPlan) {
+      const requestedTargets = new Set(
+        this.params.preparedPlan.targetsToUpdate.filter(
+          (target): target is Exclude<FirmwareUpdateV4Target, 'resource'> => target !== 'resource'
+        )
+      );
+      const installSources: ProtocolV2InstallSource[] = [];
+      const preparedTargets = new Set<Exclude<FirmwareUpdateV4Target, 'resource'>>();
+      for (const artifact of this.params.preparedPlan.artifacts) {
+        if (artifact.target !== 'resource') {
+          const target = artifact.target as Exclude<FirmwareUpdateV4Target, 'resource'>;
+          const installTarget = PROTOCOL_V2_INSTALL_TARGET_BY_UPDATE_TARGET.get(target);
+          if (
+            !requestedTargets.has(target) ||
+            artifact.role !== 'component' ||
+            artifact.container !== 'raw' ||
+            !installTarget ||
+            preparedTargets.has(target)
+          ) {
+            throw ERRORS.TypedError(
+              HardwareErrorCode.RuntimeError,
+              `Protocol V2 prepared component artifact is invalid: ${artifact.artifactId}`,
+              { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' }
+            );
+          }
+          installSources.push({
+            ...installTarget,
+            source: await this.openProtocolV2PreparedSource(artifact.artifact),
+          });
+          preparedTargets.add(target);
+        }
+      }
+      const missingTarget = Array.from(requestedTargets).find(
+        target => !preparedTargets.has(target)
+      );
+      if (missingTarget) {
+        throw ERRORS.TypedError(
+          HardwareErrorCode.RuntimeError,
+          `Protocol V2 ${missingTarget} artifact is not prepared`,
+          {
+            firmwareUpdateCode: 'FirmwareArtifactsNotPrepared',
+            artifactName: missingTarget,
+          }
+        );
+      }
+      return installSources;
+    }
+
     const release = DataManager.getFirmwareLatestRelease(features, firmwareType);
     if (!release) {
       throw ERRORS.TypedError(
@@ -831,6 +1020,270 @@ export default class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod<FirmwareU
     return installSources;
   }
 
+  private async prepareProtocolV2LocalMemoryHost({
+    features,
+    firmwareType,
+  }: {
+    features: Features;
+    firmwareType: EFirmwareType;
+  }): Promise<FirmwareUpdateV4MemoryHost> {
+    const installItems = this.buildProtocolV2InstallItems({
+      bootloaderBinary: this.prepareBootloaderBinary(),
+      fwBinaryMap: this.collectExplicitTargetBinaries(),
+    });
+    const requestedComponentTargets = new Set(
+      (this.params.targetsToUpdate ?? []).filter(
+        (target): target is Exclude<FirmwareUpdateV4Target, 'resource' | 'boot_resources'> =>
+          target !== 'resource' && target !== 'boot_resources'
+      )
+    );
+    const localComponentTargets = new Set(
+      installItems.flatMap(item => {
+        const target = PROTOCOL_V2_UPDATE_TARGET_BY_TARGET_ID.get(item.targetId);
+        return target ? [target] : [];
+      })
+    );
+    const missingTarget = Array.from(requestedComponentTargets).find(
+      target => !localComponentTargets.has(target)
+    );
+    if (missingTarget) {
+      throw ERRORS.TypedError(
+        HardwareErrorCode.RuntimeError,
+        `Protocol V2 local update has no binary for requested target ${missingTarget}`,
+        {
+          firmwareUpdateCode: 'FirmwareArtifactsNotPrepared',
+          artifactName: missingTarget,
+        }
+      );
+    }
+
+    const planArtifacts: Parameters<typeof buildProtocolV2LocalFirmwareUpdatePlan>[0]['artifacts'] =
+      [];
+    const memoryArtifacts: FirmwareMemoryArtifact[] = [];
+    for (const item of installItems) {
+      const target = PROTOCOL_V2_UPDATE_TARGET_BY_TARGET_ID.get(item.targetId);
+      if (!target || item.binary.byteLength <= 0) {
+        throw ERRORS.TypedError(
+          HardwareErrorCode.RuntimeError,
+          `Protocol V2 local firmware artifact is invalid: ${item.fileName}`,
+          { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' }
+        );
+      }
+      const artifactId = `component:${target}`;
+      planArtifacts.push({
+        artifactId,
+        target,
+        container: 'raw',
+        logicalName: item.fileName,
+        expectedSize: item.binary.byteLength,
+        expectedSha256: bytesToHex(sha256(new Uint8Array(item.binary))),
+        ...(this.params.expectedTargetVersions?.[target]
+          ? { targetVersion: this.params.expectedTargetVersions[target] }
+          : {}),
+      });
+      memoryArtifacts.push({ artifactId, binary: item.binary });
+    }
+
+    const resourceArchive = await this.prepareProtocolV2LocalResourceArchive(
+      this.params.resourceArchiveBinary as ArrayBuffer
+    );
+    const resourceArtifactId = 'resource:archive';
+    planArtifacts.push({
+      artifactId: resourceArtifactId,
+      target: 'resource',
+      container: 'zip',
+      logicalName: 'protocol-v2-local-resource-archive',
+      expectedSize: resourceArchive.binary.byteLength,
+      expectedSha256: bytesToHex(sha256(new Uint8Array(resourceArchive.binary))),
+    });
+    memoryArtifacts.push({
+      artifactId: resourceArtifactId,
+      binary: resourceArchive.binary,
+      materializedEntries: resourceArchive.materializedEntries,
+    });
+
+    const plan = buildProtocolV2LocalFirmwareUpdatePlan({
+      features,
+      firmwareType,
+      platform: this.params.platform,
+      artifacts: planArtifacts,
+    });
+    let memoryHost: FirmwareUpdateV4MemoryHost | undefined;
+    try {
+      memoryHost = prepareFirmwareUpdateV4MemoryHost({
+        sdk: {
+          prepareFirmwareUpdatePlan,
+          registerFirmwareUpdateHostBinding,
+          unregisterFirmwareUpdateHostBinding,
+        },
+        plan,
+        artifacts: memoryArtifacts,
+      });
+      const preparedPlan = validateFirmwareUpdatePreparedPlan(memoryHost.preparedPlan);
+      assertFirmwareUpdatePreparedPlanBinding({
+        preparedPlan,
+        executor: 'v4',
+        platform: this.params.platform,
+        scopeTargets: [],
+        bindings: [],
+      });
+      assertFirmwareUpdatePreparedPlanDeviceIdentity({
+        preparedPlan,
+        deviceIdentity: this.protocolV2ExpectedSerialNumber,
+      });
+      const hostBinding = resolveFirmwareUpdateHostBinding(
+        memoryHost.hostBindingGeneration,
+        preparedPlan.preparedPlanDigest
+      );
+      this.params.preparedPlan = preparedPlan;
+      this.params.targetsToUpdate = [...preparedPlan.targetsToUpdate] as FirmwareUpdateV4Target[];
+      this.params.artifactReader = hostBinding.artifactReader;
+      this.params.componentArtifacts = undefined;
+      return memoryHost;
+    } catch (error) {
+      memoryHost?.release();
+      throw error;
+    }
+  }
+
+  private async prepareProtocolV2LocalResourceArchive(
+    binary: ArrayBuffer
+  ): Promise<ProtocolV2LocalResourceArchive> {
+    if (binary.byteLength <= 0 || binary.byteLength > PROTOCOL_V2_RESOURCE_TOTAL_MAX_BYTES) {
+      throw ERRORS.TypedError(
+        HardwareErrorCode.RuntimeError,
+        'Protocol V2 local resource ZIP archive size is invalid',
+        { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' }
+      );
+    }
+    const zip = await JSZip.loadAsync(binary);
+    const zipEntries = Object.values(zip.files);
+    if (
+      zipEntries.some(entry => entry.unsafeOriginalName && entry.unsafeOriginalName !== entry.name)
+    ) {
+      throw ERRORS.TypedError(
+        HardwareErrorCode.RuntimeError,
+        'Protocol V2 local resource ZIP contains an unsafe entry path',
+        { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' }
+      );
+    }
+    const entries = zipEntries.filter(entry => !entry.dir);
+    if (entries.length === 0 || entries.length > PROTOCOL_V2_RESOURCE_FILE_MAX_COUNT + 1) {
+      throw ERRORS.TypedError(
+        HardwareErrorCode.RuntimeError,
+        'Protocol V2 local resource ZIP entry set is invalid',
+        { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' }
+      );
+    }
+    let declaredUncompressedSize = 0;
+    let declaredCompressedSize = 0;
+    for (const entry of entries) {
+      const sizes = getProtocolV2ZipEntrySizes(entry);
+      declaredCompressedSize += sizes.compressedSize;
+      declaredUncompressedSize += sizes.uncompressedSize;
+      const entryLimit =
+        entry.name === 'manifest.json'
+          ? PROTOCOL_V2_RESOURCE_MANIFEST_MAX_BYTES
+          : PROTOCOL_V2_RESOURCE_TOTAL_MAX_BYTES;
+      if (
+        sizes.uncompressedSize > entryLimit ||
+        declaredCompressedSize > binary.byteLength ||
+        declaredUncompressedSize >
+          PROTOCOL_V2_RESOURCE_TOTAL_MAX_BYTES + PROTOCOL_V2_RESOURCE_MANIFEST_MAX_BYTES
+      ) {
+        throw ERRORS.TypedError(
+          HardwareErrorCode.RuntimeError,
+          'Protocol V2 local resource ZIP declared size exceeds the allowed limit',
+          { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' }
+        );
+      }
+    }
+    const manifestEntry = zip.file('manifest.json');
+    if (!manifestEntry) {
+      throw ERRORS.TypedError(
+        HardwareErrorCode.RuntimeError,
+        'Protocol V2 local resource ZIP has no manifest.json',
+        { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' }
+      );
+    }
+    const manifestBinary = await manifestEntry.async('arraybuffer');
+    if (
+      manifestBinary.byteLength <= 0 ||
+      manifestBinary.byteLength > PROTOCOL_V2_RESOURCE_MANIFEST_MAX_BYTES
+    ) {
+      throw ERRORS.TypedError(
+        HardwareErrorCode.RuntimeError,
+        'Protocol V2 local resource manifest size is invalid',
+        { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' }
+      );
+    }
+
+    let manifestValue: unknown;
+    try {
+      manifestValue = JSON.parse(new TextDecoder().decode(manifestBinary));
+    } catch (error) {
+      throw ERRORS.TypedError(
+        HardwareErrorCode.RuntimeError,
+        `Protocol V2 local resource manifest is invalid: ${String(error)}`,
+        { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' }
+      );
+    }
+    const manifest = parseProtocolV2ResourceManifest(manifestValue);
+    const selectedFiles = selectProtocolV2ResourceManifestFiles({
+      manifest,
+      targetsToUpdate: this.params.targetsToUpdate ?? [],
+    });
+    const expectedEntryNames = new Set([
+      'manifest.json',
+      ...selectedFiles.map(file => file.archive_path),
+    ]);
+    if (
+      entries.length !== expectedEntryNames.size ||
+      entries.some(entry => !expectedEntryNames.has(entry.name))
+    ) {
+      throw ERRORS.TypedError(
+        HardwareErrorCode.RuntimeError,
+        'Protocol V2 local resource ZIP contains an unexpected entry',
+        { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' }
+      );
+    }
+
+    let totalSize = 0;
+    const materializedEntries: FirmwareMemoryArtifactEntry[] = [
+      { entryName: 'manifest.json', binary: manifestBinary },
+    ];
+    for (const file of selectedFiles) {
+      const entry = zip.file(file.archive_path);
+      if (!entry) {
+        throw ERRORS.TypedError(
+          HardwareErrorCode.RuntimeError,
+          `Protocol V2 local resource ZIP is missing ${file.archive_path}`,
+          { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' }
+        );
+      }
+      const { uncompressedSize } = getProtocolV2ZipEntrySizes(entry);
+      totalSize += uncompressedSize;
+      if (uncompressedSize !== file.size || totalSize > PROTOCOL_V2_RESOURCE_TOTAL_MAX_BYTES) {
+        throw ERRORS.TypedError(
+          HardwareErrorCode.RuntimeError,
+          `Protocol V2 local resource file declared size is invalid: ${file.archive_path}`,
+          { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' }
+        );
+      }
+      const fileBinary = await entry.async('arraybuffer');
+      const digest = bytesToHex(sha256(new Uint8Array(fileBinary)));
+      if (fileBinary.byteLength !== file.size || digest !== file.sha256.toLowerCase()) {
+        throw ERRORS.TypedError(
+          HardwareErrorCode.RuntimeError,
+          `Protocol V2 local resource file does not match manifest: ${file.archive_path}`,
+          { firmwareUpdateCode: 'FirmwareArtifactReceiptMismatch' }
+        );
+      }
+      materializedEntries.push({ entryName: file.archive_path, binary: fileBinary });
+    }
+    return { binary, materializedEntries };
+  }
+
   private async prepareProtocolV2ResourceSources(): Promise<ProtocolV2ResourceBundleSource[]> {
     const resourceRequested = this.params.targetsToUpdate?.includes('resource') ?? false;
     if (!resourceRequested) {
@@ -1001,7 +1454,7 @@ export default class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod<FirmwareU
     for (const [target, version] of Object.entries(expected)) {
       if (
         !Array.from(PROTOCOL_V2_UPDATE_TARGET_BY_TARGET_ID.values()).includes(
-          target as FirmwareUpdateV4Target
+          target as Exclude<FirmwareUpdateV4Target, 'boot_resources'>
         ) ||
         typeof version !== 'string' ||
         !/^\d+\.\d+\.\d+(?:[-+][A-Za-z0-9.-]+)?$/u.test(version) ||
@@ -1178,9 +1631,12 @@ export default class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod<FirmwareU
         return target ? [target] : [];
       })
     );
-    return (this.params.targetsToUpdate ?? []).filter(
-      target => target !== 'resource' && !preparedTargets.has(target)
-    );
+    return (this.params.targetsToUpdate ?? [])
+      .filter(
+        (target): target is Exclude<FirmwareUpdateV4Target, 'resource' | 'boot_resources'> =>
+          target !== 'resource' && target !== 'boot_resources'
+      )
+      .filter(target => !preparedTargets.has(target));
   }
 
   private buildProtocolV2InstallItems({
@@ -1251,8 +1707,28 @@ export default class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod<FirmwareU
         `Missing Protocol V2 firmware component url: ${key}/${component.target}`
       );
     }
+    const expectedFingerprint = normalizeProtocolV2Hex(component.fingerprint);
+    if (
+      !Number.isSafeInteger(component.expectedSize) ||
+      Number(component.expectedSize) <= 0 ||
+      !expectedFingerprint ||
+      !/^[0-9a-f]{64}$/u.test(expectedFingerprint)
+    ) {
+      throw ERRORS.TypedError(
+        HardwareErrorCode.RuntimeError,
+        `Protocol V2 firmware component integrity metadata is invalid: ${key}/${component.target}`,
+        { firmwareUpdateCode: 'FirmwarePlanInvalid' }
+      );
+    }
 
     const { binary } = await getSysResourceBinary(component.url);
+    if (binary.byteLength !== component.expectedSize) {
+      throw ERRORS.TypedError(
+        HardwareErrorCode.RuntimeError,
+        `Protocol V2 firmware size mismatch: ${key}/${component.target}`,
+        { firmwareUpdateCode: 'FirmwareArtifactReceiptMismatch' }
+      );
+    }
     if (!isProtocolV2FirmwareFingerprintValid(binary, component.fingerprint)) {
       throw ERRORS.TypedError(
         HardwareErrorCode.RuntimeError,
@@ -1672,10 +2148,12 @@ export default class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod<FirmwareU
     fwBinaryMap,
     bootloaderBinary,
     installItems,
+    resourceBundles = [],
   }: {
     fwBinaryMap?: ProtocolV2TargetBinary[];
     bootloaderBinary?: ArrayBuffer | null;
     installItems?: ProtocolV2InstallItem[];
+    resourceBundles?: ProtocolV2ResourceBundleBinary[];
   }) {
     const memoryInstallItems =
       installItems ??
@@ -1692,9 +2170,19 @@ export default class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod<FirmwareU
           kind: item.kind,
         }))
       );
+      const resourceSources = await Promise.all(
+        resourceBundles.map(async resource => ({
+          name: resource.name,
+          source: await this.openProtocolV2MemorySource(resource.binary),
+          devicePath: resource.devicePath,
+          ...(resource.version ? { version: resource.version } : {}),
+          ...(resource.payloadHash ? { payloadHash: resource.payloadHash } : {}),
+          ...(resource.headerHash ? { headerHash: resource.headerHash } : {}),
+        }))
+      );
       return await this.executeProtocolV2Phases({
         installSources,
-        resourceSources: [],
+        resourceSources,
       });
     } finally {
       await this.closeProtocolV2PreparedSources();