@onekeyfe/hd-core 1.2.0-alpha.96 → 1.2.0-alpha.98

package/dist/index.js

@@ -595,6 +595,16 @@ const planError = (message) => {
         firmwareUpdateCode: 'FirmwarePlanInvalid',
     });
 };
+const requireArtifactIntegrity = (input, label) => {
+    const integrity = asIntegrity(input);
+    if (integrity.expectedSize === undefined || integrity.expectedSha256 === undefined) {
+        return planError(`${label} integrity metadata is invalid`);
+    }
+    return {
+        expectedSize: integrity.expectedSize,
+        expectedSha256: integrity.expectedSha256,
+    };
+};
 const FIRMWARE_UPDATE_PLAN_FORCE_TARGETS = new Set([
     'firmware',
     'ble',
@@ -705,7 +715,7 @@ const assertFirmwareUpdatePlan = (value) => {
         if (!artifact) {
             return planError('Firmware update plan artifact is invalid');
         }
-        assertExactKeys(artifact, ['artifactId', 'role', 'target', 'url', 'container'], ['logicalName', 'expectedSize', 'expectedSha256', 'targetVersion']);
+        assertExactKeys(artifact, ['artifactId', 'role', 'target', 'url', 'container', 'expectedSize', 'expectedSha256'], ['logicalName', 'targetVersion']);
         const artifactId = assertBoundedString(artifact.artifactId, 'artifact id', 160);
         if (artifactIds.has(artifactId)) {
             return planError('Firmware update plan contains duplicate artifact ids');
@@ -721,13 +731,11 @@ const assertFirmwareUpdatePlan = (value) => {
         if (artifact.logicalName !== undefined) {
             assertBoundedString(artifact.logicalName, 'logical name', 256);
         }
-        if (artifact.expectedSize !== undefined &&
-            (!Number.isSafeInteger(artifact.expectedSize) || artifact.expectedSize <= 0)) {
+        if (!Number.isSafeInteger(artifact.expectedSize) || artifact.expectedSize <= 0) {
             return planError('Firmware update plan artifact size is invalid');
         }
-        if (artifact.expectedSha256 !== undefined &&
-            (typeof artifact.expectedSha256 !== 'string' ||
-                !/^[a-f0-9]{64}$/u.test(artifact.expectedSha256))) {
+        if (typeof artifact.expectedSha256 !== 'string' ||
+            !/^[a-f0-9]{64}$/u.test(artifact.expectedSha256)) {
             return planError('Firmware update plan artifact digest is invalid');
         }
         if (artifact.targetVersion !== undefined) {
@@ -836,13 +844,7 @@ const buildProtocolV2Artifacts = (release, { includeComponents = true, component
             throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Protocol V2 component ${key} duplicates target ${target}`, { firmwareUpdateCode: 'FirmwarePlanInvalid' });
         }
         componentTargetSet.add(target);
-        const integrity = asIntegrity({
-            size: component.expectedSize,
-            sha256: component.fingerprint,
-        });
-        if (integrity.expectedSize === undefined || integrity.expectedSha256 === undefined) {
-            planError(`Protocol V2 component ${key} integrity metadata is invalid`);
-        }
+        const integrity = requireArtifactIntegrity({ size: component.expectedSize, sha256: component.fingerprint }, `Protocol V2 component ${key}`);
         artifacts.push(Object.assign(Object.assign({ artifactId: `component:${target}`, role: 'component', target, url: assertArtifactUrl(component.url, `Protocol V2 component ${key}`), container: 'raw', logicalName: key }, integrity), (asVersion(component.version) ? { targetVersion: asVersion(component.version) } : {})));
         targets.push(target);
     }
@@ -934,13 +936,7 @@ const buildProtocolV2FirmwareUpdatePlan = ({ features, firmwareType, platform, r
         if (!archive) {
             return planError('Protocol V2 resource target has no resource archive');
         }
-        const integrity = asIntegrity({
-            size: archive.archiveSize,
-            sha256: archive.archiveSha256,
-        });
-        if (integrity.expectedSize === undefined || integrity.expectedSha256 === undefined) {
-            planError('Protocol V2 resource archive integrity metadata is invalid');
-        }
+        const integrity = requireArtifactIntegrity({ size: archive.archiveSize, sha256: archive.archiveSha256 }, 'Protocol V2 resource archive');
         protocolV2.artifacts.push(Object.assign({ artifactId: 'resource:archive', role: 'resourceBundle', target: 'resource', url: assertArtifactUrl(archive.archiveUrl, 'Protocol V2 resource archive'), container: 'zip', logicalName: 'protocol-v2-resource-archive' }, integrity));
         protocolV2.targets.push('resource');
     }
@@ -964,7 +960,7 @@ const buildProtocolV2FirmwareUpdatePlan = ({ features, firmwareType, platform, r
     });
 };
 const buildFirmwareUpdatePlan = ({ features, firmwareType, platform, firmware, ble, bootloader, forceUpdateTargets, }) => {
-    var _a, _b, _c, _d, _e, _f, _g;
+    var _a, _b;
     const executor = getExecutor(features);
     let artifacts = [];
     let targetsToUpdate = [];
@@ -976,7 +972,8 @@ const buildFirmwareUpdatePlan = ({ features, firmwareType, platform, firmware, b
         ((release === null || release === void 0 ? void 0 : release.status) === 'none' || (release === null || release === void 0 ? void 0 : release.status) === 'unknown') &&
         !!asRelease(release);
     const shouldUpdateFirmware = isUpgrade(firmware) || isRecoveryInstall(firmware) || forcedTargets.has('firmware');
-    const shouldUpdateResource = isUpgrade(firmware) || forcedTargets.has('resource');
+    const shouldUpdateResource = !(executor === 'v2' && bootloaderMode) &&
+        (isUpgrade(firmware) || forcedTargets.has('resource'));
     if (executor === 'v4' &&
         validatedForceTargets.some(target => target === 'ble' || target === 'bootloader')) {
         planError('Protocol V2 does not support forced BLE or legacy bootloader targets');
@@ -990,12 +987,14 @@ const buildFirmwareUpdatePlan = ({ features, firmwareType, platform, firmware, b
     }
     else {
         if (isUpgrade(bootloader) || forcedTargets.has('bootloader')) {
-            artifacts.push(Object.assign(Object.assign({ artifactId: 'bootloader', role: 'bootloader', target: 'bootloader', url: assertArtifactUrl((_a = asRelease(bootloader)) === null || _a === void 0 ? void 0 : _a.bootloaderResource, 'Bootloader release'), container: 'raw' }, asIntegrity({
-                size: (_b = asRelease(bootloader)) === null || _b === void 0 ? void 0 : _b.bootloaderExpectedSize,
-                sha256: (_c = asRelease(bootloader)) === null || _c === void 0 ? void 0 : _c.bootloaderFingerprint,
-            })), (asVersion((_d = asRelease(bootloader)) === null || _d === void 0 ? void 0 : _d.bootloaderVersion)
+            const bootloaderRelease = asRelease(bootloader);
+            const integrity = requireArtifactIntegrity({
+                size: bootloaderRelease === null || bootloaderRelease === void 0 ? void 0 : bootloaderRelease.bootloaderExpectedSize,
+                sha256: bootloaderRelease === null || bootloaderRelease === void 0 ? void 0 : bootloaderRelease.bootloaderFingerprint,
+            }, 'Bootloader release');
+            artifacts.push(Object.assign(Object.assign({ artifactId: 'bootloader', role: 'bootloader', target: 'bootloader', url: assertArtifactUrl(bootloaderRelease === null || bootloaderRelease === void 0 ? void 0 : bootloaderRelease.bootloaderResource, 'Bootloader release'), container: 'raw' }, integrity), (asVersion(bootloaderRelease === null || bootloaderRelease === void 0 ? void 0 : bootloaderRelease.bootloaderVersion)
                 ? {
-                    targetVersion: asVersion((_e = asRelease(bootloader)) === null || _e === void 0 ? void 0 : _e.bootloaderVersion),
+                    targetVersion: asVersion(bootloaderRelease === null || bootloaderRelease === void 0 ? void 0 : bootloaderRelease.bootloaderVersion),
                 }
                 : {})));
         }
@@ -1006,10 +1005,8 @@ const buildFirmwareUpdatePlan = ({ features, firmwareType, platform, firmware, b
                 });
             }
             if (shouldUpdateFirmware) {
-                artifacts.push(Object.assign(Object.assign({ artifactId: 'firmware', role: 'firmware', target: 'firmware', url: assertArtifactUrl(firmwareRelease.url, 'Firmware release'), container: 'raw' }, asIntegrity({
-                    size: firmwareRelease.expectedSize,
-                    sha256: firmwareRelease.fingerprint,
-                })), (asVersion(firmwareRelease.version)
+                const integrity = requireArtifactIntegrity({ size: firmwareRelease.expectedSize, sha256: firmwareRelease.fingerprint }, 'Firmware release');
+                artifacts.push(Object.assign(Object.assign({ artifactId: 'firmware', role: 'firmware', target: 'firmware', url: assertArtifactUrl(firmwareRelease.url, 'Firmware release'), container: 'raw' }, integrity), (asVersion(firmwareRelease.version)
                     ? { targetVersion: asVersion(firmwareRelease.version) }
                     : {})));
             }
@@ -1020,23 +1017,25 @@ const buildFirmwareUpdatePlan = ({ features, firmwareType, platform, firmware, b
                     platform,
                 });
                 if (resourceUrl) {
-                    artifacts.push(Object.assign({ artifactId: 'resource', role: 'resource', target: 'resource', url: assertArtifactUrl(resourceUrl, 'Firmware resource release'), container: 'zip' }, asIntegrity({
+                    const integrity = requireArtifactIntegrity({
                         size: resourceUrl === asString(firmwareRelease.fullResource)
                             ? firmwareRelease.fullResourceExpectedSize
                             : firmwareRelease.resourceExpectedSize,
                         sha256: resourceUrl === asString(firmwareRelease.fullResource)
                             ? firmwareRelease.fullResourceFingerprint
                             : firmwareRelease.resourceFingerprint,
-                    })));
+                    }, 'Legacy resource archive');
+                    artifacts.push(Object.assign({ artifactId: 'resource', role: 'resource', target: 'resource', url: assertArtifactUrl(resourceUrl, 'Firmware resource release'), container: 'zip' }, integrity));
                 }
             }
         }
         if (isUpgrade(ble) || isRecoveryInstall(ble) || forcedTargets.has('ble')) {
             const bleRelease = asRelease(ble);
-            artifacts.push(Object.assign(Object.assign({ artifactId: 'ble', role: 'ble', target: 'ble', url: assertArtifactUrl((_f = bleRelease === null || bleRelease === void 0 ? void 0 : bleRelease.webUpdate) !== null && _f !== void 0 ? _f : bleRelease === null || bleRelease === void 0 ? void 0 : bleRelease.url, 'BLE release'), container: 'raw' }, asIntegrity({
+            const integrity = requireArtifactIntegrity({
                 size: bleRelease === null || bleRelease === void 0 ? void 0 : bleRelease.expectedSize,
-                sha256: (_g = bleRelease === null || bleRelease === void 0 ? void 0 : bleRelease.fingerprintWeb) !== null && _g !== void 0 ? _g : bleRelease === null || bleRelease === void 0 ? void 0 : bleRelease.fingerprint,
-            })), (asVersion(bleRelease === null || bleRelease === void 0 ? void 0 : bleRelease.version)
+                sha256: (_a = bleRelease === null || bleRelease === void 0 ? void 0 : bleRelease.fingerprintWeb) !== null && _a !== void 0 ? _a : bleRelease === null || bleRelease === void 0 ? void 0 : bleRelease.fingerprint,
+            }, 'BLE release');
+            artifacts.push(Object.assign(Object.assign({ artifactId: 'ble', role: 'ble', target: 'ble', url: assertArtifactUrl((_b = bleRelease === null || bleRelease === void 0 ? void 0 : bleRelease.webUpdate) !== null && _b !== void 0 ? _b : bleRelease === null || bleRelease === void 0 ? void 0 : bleRelease.url, 'BLE release'), container: 'raw' }, integrity), (asVersion(bleRelease === null || bleRelease === void 0 ? void 0 : bleRelease.version)
                 ? { targetVersion: asVersion(bleRelease === null || bleRelease === void 0 ? void 0 : bleRelease.version) }
                 : {})));
         }
@@ -1275,6 +1274,14 @@ const validateFirmwareUpdatePreparedPlan = (value) => {
     }
     return preparedPlan;
 };
+const getFirmwareUpdatePreparedRawArtifact = ({ preparedPlan: value, target, role, }) => {
+    const preparedPlan = validateFirmwareUpdatePreparedPlan(value);
+    const artifacts = preparedPlan.artifacts.filter(artifact => artifact.target === target);
+    if (artifacts.length !== 1 || artifacts[0].role !== role || artifacts[0].container !== 'raw') {
+        return preparedPlanError(`Firmware prepared plan ${target} artifact is invalid`);
+    }
+    return artifacts[0];
+};
 const degradedPlanIdentityPins = new Map();
 const DEGRADED_PLAN_IDENTITY_PIN_LIMIT = 32;
 const pinDegradedPlanIdentity = (leaseRef, deviceIdentity) => {
@@ -49404,6 +49411,8 @@ class FirmwareUpdateBaseMethod extends BaseMethod {
                 !this.payload.skipWebDevicePrompt &&
                 !hasPromptedWebDevice &&
                 !isPromptingWebDevice) {
+                clearInterval(intervalTimer);
+                clearTimeout(timeoutTimer);
                 isPromptingWebDevice = true;
                 try {
                     this.postTipMessage(exports.FirmwareUpdateTipMessage.SelectDeviceInBootloaderForWebDevice);
@@ -49783,21 +49792,27 @@ class DeviceUpdateBootloader extends FirmwareUpdateBaseMethod {
             const { features } = device;
             const payload = this.payload;
             const hasPreparedPlan = payload.preparedPlan !== undefined;
-            const hasPreparedArtifact = payload.artifact !== undefined;
-            if (hasPreparedPlan !== hasPreparedArtifact) {
-                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.CallMethodInvalidParameter, 'Prepared bootloader plans require exactly one prepared artifact');
+            if (hasPreparedPlan && payload.binary !== undefined) {
+                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.CallMethodInvalidParameter, 'Prepared bootloader plans cannot be combined with a legacy binary');
             }
-            if (payload.binary !== undefined && hasPreparedArtifact) {
-                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.CallMethodInvalidParameter, 'Bootloader binary and prepared artifact are mutually exclusive');
+            if (!hasPreparedPlan && payload.artifact !== undefined) {
+                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.CallMethodInvalidParameter, 'Bootloader artifacts require a prepared plan');
             }
-            const preparedPlan = hasPreparedArtifact
+            const preparedPlan = hasPreparedPlan
                 ? validateFirmwareUpdatePreparedPlan(payload.preparedPlan)
                 : undefined;
+            const plannedArtifact = preparedPlan
+                ? getFirmwareUpdatePreparedRawArtifact({
+                    preparedPlan,
+                    target: 'bootloader',
+                    role: 'bootloader',
+                }).artifact
+                : undefined;
             const artifactReader = preparedPlan
                 ? resolveFirmwareUpdateHostBinding(payload.hostBindingGeneration, preparedPlan.preparedPlanDigest).artifactReader
                 : payload.artifactReader;
             const executionParams = Object.assign(Object.assign({}, payload), { artifactReader });
-            if (payload.artifact) {
+            if (preparedPlan && plannedArtifact) {
                 assertFirmwareUpdatePreparedPlanDeviceIdentity({
                     preparedPlan,
                     deviceIdentity: getDeviceUUID(features) || undefined,
@@ -49811,12 +49826,12 @@ class DeviceUpdateBootloader extends FirmwareUpdateBaseMethod {
                     bindings: [
                         {
                             target: 'bootloader',
-                            artifact: payload.artifact,
+                            artifact: (_a = payload.artifact) !== null && _a !== void 0 ? _a : plannedArtifact,
                         },
                     ],
                 });
                 const source = yield openFirmwareByteSource({
-                    artifact: payload.artifact,
+                    artifact: plannedArtifact,
                     reader: executionParams.artifactReader,
                 });
                 if (!source) {
@@ -49824,13 +49839,11 @@ class DeviceUpdateBootloader extends FirmwareUpdateBaseMethod {
                 }
                 try {
                     const deviceType = device.getCurrentDeviceType();
-                    const deviceFirmwareType = device.getCurrentFirmwareType();
-                    const firmwareType = (_a = payload.firmwareType) !== null && _a !== void 0 ? _a : deviceFirmwareType;
                     if (DeviceModelToTypes.model_touch.includes(deviceType)) {
                         return yield this.updateTouchBootloader({
                             device,
                             features,
-                            firmwareType,
+                            firmwareType: preparedPlan.firmwareType,
                             source,
                         });
                     }
@@ -50104,6 +50117,119 @@ const normalizeFirmwarePreparationError = (error) => {
     return hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.FirmwareUpdateDownloadFailed, error instanceof Error ? error.message : String(error));
 };
 
+const PREPARED_RESOURCE_ARCHIVE_MAX_BYTES = 256 * 1024 * 1024;
+const PREPARED_RESOURCE_ENTRY_MAX_COUNT = 512;
+const resourceArchiveError = (message, firmwareUpdateCode) => {
+    throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, message, { firmwareUpdateCode });
+};
+const getZipEntrySizes = (entry) => {
+    var _a;
+    const { compressedSize, uncompressedSize } = (_a = entry._data) !== null && _a !== void 0 ? _a : {};
+    if (!Number.isSafeInteger(compressedSize) ||
+        Number(compressedSize) < 0 ||
+        !Number.isSafeInteger(uncompressedSize) ||
+        Number(uncompressedSize) <= 0) {
+        return resourceArchiveError(`Firmware prepared resource ZIP entry size is invalid: ${entry.name}`, 'FirmwareArtifactsNotPrepared');
+    }
+    return {
+        compressedSize: Number(compressedSize),
+        uncompressedSize: Number(uncompressedSize),
+    };
+};
+const readVerifiedPreparedResourceArchive = ({ preparedPlan, reader, }) => __awaiter(void 0, void 0, void 0, function* () {
+    const resourceArtifacts = preparedPlan.artifacts.filter(artifact => artifact.target === 'resource');
+    if (!preparedPlan.targetsToUpdate.includes('resource')) {
+        if (resourceArtifacts.length > 0) {
+            return resourceArchiveError('Firmware prepared resource artifact is outside the approved targets', 'FirmwareArtifactsNotPrepared');
+        }
+        return [];
+    }
+    if (resourceArtifacts.length !== 1) {
+        return resourceArchiveError('Firmware prepared plan must contain exactly one materialized resource ZIP', 'FirmwareArtifactsNotPrepared');
+    }
+    const archiveArtifact = resourceArtifacts[0];
+    const preparedEntries = archiveArtifact.materializedEntries;
+    if (archiveArtifact.role !== 'resource' ||
+        archiveArtifact.container !== 'zip' ||
+        !(preparedEntries === null || preparedEntries === void 0 ? void 0 : preparedEntries.length)) {
+        return resourceArchiveError('Firmware prepared plan must contain exactly one materialized resource ZIP', 'FirmwareArtifactsNotPrepared');
+    }
+    const archiveSource = yield openFirmwareByteSource({
+        artifact: archiveArtifact.artifact,
+        reader,
+    });
+    if (!archiveSource) {
+        return resourceArchiveError('Firmware prepared resource ZIP is unavailable', 'FirmwareArtifactsNotPrepared');
+    }
+    if (archiveSource.size > PREPARED_RESOURCE_ARCHIVE_MAX_BYTES) {
+        yield archiveSource.close().catch(() => undefined);
+        return resourceArchiveError('Firmware prepared resource ZIP exceeds the archive size limit', 'FirmwareArtifactsNotPrepared');
+    }
+    let archiveBinary;
+    try {
+        archiveBinary = yield readFirmwareByteSourceFully(archiveSource);
+    }
+    finally {
+        yield archiveSource.close().catch(() => undefined);
+    }
+    const archiveDigest = utils.bytesToHex(sha256.sha256(new Uint8Array(archiveBinary)));
+    if (archiveDigest !== archiveArtifact.artifact.sha256.toLowerCase()) {
+        return resourceArchiveError('Firmware prepared resource ZIP does not match its approved receipt', 'FirmwareArtifactReceiptMismatch');
+    }
+    let zip;
+    try {
+        zip = yield JSZip__default["default"].loadAsync(archiveBinary);
+    }
+    catch (_a) {
+        return resourceArchiveError('Firmware prepared resource ZIP cannot be parsed', 'FirmwareArtifactsNotPrepared');
+    }
+    const zipEntries = Object.values(zip.files);
+    if (zipEntries.some(entry => entry.unsafeOriginalName && entry.unsafeOriginalName !== entry.name)) {
+        return resourceArchiveError('Firmware prepared resource ZIP contains an unsafe entry path', 'FirmwareArtifactsNotPrepared');
+    }
+    const files = zipEntries.filter(entry => !entry.dir);
+    if (files.length === 0 || files.length > PREPARED_RESOURCE_ENTRY_MAX_COUNT) {
+        return resourceArchiveError('Firmware prepared resource ZIP entry set is invalid', 'FirmwareArtifactsNotPrepared');
+    }
+    let totalSize = 0;
+    const canonicalNames = new Set();
+    for (const entry of files) {
+        const { compressedSize, uncompressedSize } = getZipEntrySizes(entry);
+        const resourceName = getFirmwareUpdateResourceName(entry.name);
+        const canonicalName = resourceName.toLowerCase();
+        totalSize += uncompressedSize;
+        if (compressedSize > archiveBinary.byteLength ||
+            uncompressedSize > PREPARED_RESOURCE_ARCHIVE_MAX_BYTES ||
+            totalSize > PREPARED_RESOURCE_ARCHIVE_MAX_BYTES ||
+            canonicalNames.has(canonicalName)) {
+            return resourceArchiveError(`Firmware prepared resource ZIP entry bounds are invalid: ${entry.name}`, 'FirmwareArtifactsNotPrepared');
+        }
+        canonicalNames.add(canonicalName);
+    }
+    const preparedEntriesByName = new Map(preparedEntries.map(entry => [entry.entryName, entry]));
+    if (preparedEntriesByName.size !== files.length || preparedEntries.length !== files.length) {
+        return resourceArchiveError('Firmware prepared resource entries do not match the approved ZIP', 'FirmwareArtifactReceiptMismatch');
+    }
+    const verifiedEntries = [];
+    for (const entry of files) {
+        const { uncompressedSize } = getZipEntrySizes(entry);
+        const binary = yield entry.async('arraybuffer');
+        const preparedEntry = preparedEntriesByName.get(entry.name);
+        const digest = utils.bytesToHex(sha256.sha256(new Uint8Array(binary)));
+        if (binary.byteLength !== uncompressedSize ||
+            !preparedEntry ||
+            preparedEntry.artifact.size !== binary.byteLength ||
+            preparedEntry.artifact.sha256.toLowerCase() !== digest) {
+            return resourceArchiveError(`Firmware prepared resource entry does not match the approved ZIP: ${entry.name}`, 'FirmwareArtifactReceiptMismatch');
+        }
+        verifiedEntries.push({
+            entryName: getFirmwareUpdateResourceName(entry.name),
+            binary,
+        });
+    }
+    return verifiedEntries;
+});
+
 const Log$8 = getLogger(exports.LoggerNames.Method);
 const FIRMWARE_DOWNLOAD_REQUEST_OPTIONS = {
     connectTimeoutMs: 60000,
@@ -50178,7 +50304,7 @@ class FirmwareUpdateV2 extends BaseMethod {
         };
     }
     init() {
-        var _a;
+        var _a, _b;
         this.allowDeviceMode = [UI_REQUEST.BOOTLOADER, UI_REQUEST.NOT_INITIALIZE];
         this.requireDeviceMode = [];
         this.useDevicePassphraseState = false;
@@ -50191,14 +50317,12 @@ class FirmwareUpdateV2 extends BaseMethod {
             { name: 'platform', type: 'string', required: true },
             { name: 'firmwareType', type: 'string' },
         ]);
-        if ('binary' in payload &&
-            payload.binary !== undefined &&
-            'artifact' in payload &&
-            payload.artifact !== undefined) {
-            throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.CallMethodInvalidParameter, 'Firmware update binary and artifact are mutually exclusive');
+        const hasPreparedPlan = payload.preparedPlan !== undefined;
+        if (hasPreparedPlan && (payload.binary !== undefined || payload.version !== undefined)) {
+            throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.CallMethodInvalidParameter, 'Prepared firmware plans cannot be combined with legacy firmware inputs');
         }
-        if (payload.preparedPlan !== undefined && payload.artifact === undefined) {
-            throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.CallMethodInvalidParameter, 'Prepared firmware plans require a prepared artifact');
+        if (!hasPreparedPlan && payload.artifact !== undefined) {
+            throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.CallMethodInvalidParameter, 'Firmware artifacts require a prepared plan');
         }
         if (!payload.updateType) {
             throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.CallMethodInvalidParameter, 'updateType is required');
@@ -50208,16 +50332,21 @@ class FirmwareUpdateV2 extends BaseMethod {
             forcedUpdateRes: payload.forcedUpdateRes,
             isUpdateBootloader: payload.isUpdateBootloader,
         };
-        if ('version' in payload) {
+        if (!hasPreparedPlan && 'version' in payload) {
             this.params = Object.assign(Object.assign({}, this.params), { version: payload.version, firmwareType: payload.firmwareType });
         }
-        if ('binary' in payload) {
+        if (!hasPreparedPlan && 'binary' in payload) {
             this.params = Object.assign(Object.assign({}, this.params), { binary: payload.binary });
         }
-        if ('artifact' in payload) {
+        if (hasPreparedPlan) {
             const preparedPlan = validateFirmwareUpdatePreparedPlan(payload.preparedPlan);
             const hostBinding = resolveFirmwareUpdateHostBinding(payload.hostBindingGeneration, preparedPlan.preparedPlanDigest);
             const target = payload.isUpdateBootloader ? 'bootloader' : payload.updateType;
+            const plannedArtifact = getFirmwareUpdatePreparedRawArtifact({
+                preparedPlan,
+                target,
+                role: target,
+            }).artifact;
             const resourceBindings = ((_a = payload.resourceEntries) !== null && _a !== void 0 ? _a : []).map((entry) => ({
                 target: 'resource',
                 entryName: entry.entryName,
@@ -50227,10 +50356,13 @@ class FirmwareUpdateV2 extends BaseMethod {
                 preparedPlan,
                 executor: 'v2',
                 platform: payload.platform,
-                scopeTargets: [target, ...(target === 'firmware' ? ['resource'] : [])],
-                bindings: [{ target, artifact: payload.artifact }, ...resourceBindings],
+                scopeTargets: [
+                    target,
+                    ...(target === 'firmware' && resourceBindings.length ? ['resource'] : []),
+                ],
+                bindings: [{ target, artifact: (_b = payload.artifact) !== null && _b !== void 0 ? _b : plannedArtifact }, ...resourceBindings],
             });
-            this.params = Object.assign(Object.assign({}, this.params), { preparedPlan, artifact: payload.artifact, resourceEntries: payload.resourceEntries, artifactReader: hostBinding.artifactReader });
+            this.params = Object.assign(Object.assign({}, this.params), { preparedPlan, artifact: plannedArtifact, artifactReader: hostBinding.artifactReader, firmwareType: preparedPlan.firmwareType });
         }
     }
     _promptDeviceInBootloaderForWebDevice() {
@@ -50380,7 +50512,7 @@ class FirmwareUpdateV2 extends BaseMethod {
         }
     }
     run() {
-        var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k;
         return __awaiter(this, void 0, void 0, function* () {
             const { device, params } = this;
             const { features, commands } = device;
@@ -50468,13 +50600,48 @@ class FirmwareUpdateV2 extends BaseMethod {
                         throw normalizeFirmwarePreparationError(err);
                     }
                 });
+                const preparedResourceRequested = !params.isUpdateBootloader &&
+                    params.updateType === 'firmware' &&
+                    ((_c = (_b = params.preparedPlan) === null || _b === void 0 ? void 0 : _b.targetsToUpdate.includes('resource')) !== null && _c !== void 0 ? _c : false);
+                if (preparedResourceRequested && device.isBootloader()) {
+                    throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Prepared firmware resources require the device application mode', { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared', artifactName: 'resource' });
+                }
                 if (!device.isBootloader() && features) {
                     const serialNo = device.getCurrentSerialNo();
                     if (this.isEnteredManuallyBoot()) {
                         throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.FirmwareUpdateManuallyEnterBoot);
                     }
                     yield acquireFirmwareSource();
-                    if (this.isSupportResourceUpdate(params.updateType)) {
+                    if (preparedResourceRequested) {
+                        if (!this.isSupportResourceUpdate(params.updateType)) {
+                            throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Prepared firmware resources are not supported by this device', { firmwareUpdateCode: 'FirmwareArtifactsNotPrepared', artifactName: 'resource' });
+                        }
+                        this.postTipMessage('CheckLatestUiResource');
+                        this.postTipMessage('DownloadLatestUiResource');
+                        const verifiedEntries = yield readVerifiedPreparedResourceArchive({
+                            preparedPlan: params.preparedPlan,
+                            reader: params.artifactReader,
+                        });
+                        const sources = [];
+                        try {
+                            for (const entry of verifiedEntries) {
+                                const source = yield openFirmwareByteSource({ binary: entry.binary });
+                                if (!source) {
+                                    throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Firmware resource entry ${entry.entryName} is empty`, {
+                                        firmwareUpdateCode: 'FirmwareArtifactReceiptMismatch',
+                                        artifactName: 'resource',
+                                    });
+                                }
+                                sources.push({ entryName: entry.entryName, source });
+                            }
+                            yield updateResourcesFromSources(this.device.getCommands().typedCall.bind(this.device.getCommands()), this.postMessage, device, sources);
+                        }
+                        finally {
+                            yield Promise.all(sources.map(entry => entry.source.close().catch(() => undefined)));
+                        }
+                        this.postTipMessage('DownloadLatestUiResourceSuccess');
+                    }
+                    else if (this.isSupportResourceUpdate(params.updateType)) {
                         this.postTipMessage('CheckLatestUiResource');
                         const resourceUrl = DataManager.getSysResourcesLatestRelease({
                             features,
@@ -50483,46 +50650,20 @@ class FirmwareUpdateV2 extends BaseMethod {
                         });
                         if (resourceUrl) {
                             this.postTipMessage('DownloadLatestUiResource');
-                            if ((_b = params.resourceEntries) === null || _b === void 0 ? void 0 : _b.length) {
-                                const sources = [];
-                                try {
-                                    for (const entry of params.resourceEntries) {
-                                        const resourceName = getFirmwareUpdateResourceName(entry.entryName);
-                                        const source = yield openFirmwareByteSource({
-                                            artifact: entry.artifact,
-                                            reader: params.artifactReader,
-                                        });
-                                        if (!source) {
-                                            throw new Error('Firmware resource entry is not prepared');
-                                        }
-                                        sources.push({ entryName: resourceName, source });
-                                    }
-                                    yield updateResourcesFromSources(this.device.getCommands().typedCall.bind(this.device.getCommands()), this.postMessage, device, sources.map(entry => ({
-                                        entryName: entry.entryName,
-                                        source: entry.source,
-                                    })));
-                                }
-                                finally {
-                                    yield Promise.all(sources.map(entry => entry.source.close().catch(() => undefined)));
-                                }
-                                this.postTipMessage('DownloadLatestUiResourceSuccess');
-                            }
-                            else {
-                                if (params.artifactReader ||
-                                    DataManager.getSettings('firmwareManifestMode') === 'external-only') {
-                                    throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Firmware resource must be prepared by the external firmware host', {
-                                        firmwareUpdateCode: 'FirmwareArtifactsNotPrepared',
-                                        artifactName: 'resource',
-                                    });
-                                }
-                                const resourceBinary = (yield getSysResourceBinary(resourceUrl))
-                                    .binary;
-                                this.postTipMessage('DownloadLatestUiResourceSuccess');
-                                yield updateResources(this.device.getCommands().typedCall.bind(this.device.getCommands()), this.postMessage, device, resourceBinary);
+                            if (params.artifactReader ||
+                                DataManager.getSettings('firmwareManifestMode') === 'external-only') {
+                                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Firmware resource must be prepared by the external firmware host', {
+                                    firmwareUpdateCode: 'FirmwareArtifactsNotPrepared',
+                                    artifactName: 'resource',
+                                });
                             }
+                            const resourceBinary = (yield getSysResourceBinary(resourceUrl))
+                                .binary;
+                            this.postTipMessage('DownloadLatestUiResourceSuccess');
+                            yield updateResources(this.device.getCommands().typedCall.bind(this.device.getCommands()), this.postMessage, device, resourceBinary);
                         }
                     }
-                    (_d = (_c = this.device) === null || _c === void 0 ? void 0 : _c.commands) === null || _d === void 0 ? void 0 : _d.checkDisposed();
+                    (_e = (_d = this.device) === null || _d === void 0 ? void 0 : _d.commands) === null || _e === void 0 ? void 0 : _e.checkDisposed();
                     try {
                         this.postTipMessage('AutoRebootToBootloader');
                         const bootRes = yield commands.typedCall('DeviceBackToBoot', 'Success');
@@ -50535,9 +50676,9 @@ class FirmwareUpdateV2 extends BaseMethod {
                             DevicePool.clearDeviceCache(serialNo);
                         }
                         delete DevicePool.devicesCache[''];
-                        yield ((_e = this.checkPromise) === null || _e === void 0 ? void 0 : _e.promise);
+                        yield ((_f = this.checkPromise) === null || _f === void 0 ? void 0 : _f.promise);
                         this.checkPromise = null;
-                        (_g = (_f = this.device) === null || _f === void 0 ? void 0 : _f.commands) === null || _g === void 0 ? void 0 : _g.checkDisposed();
+                        (_h = (_g = this.device) === null || _g === void 0 ? void 0 : _g.commands) === null || _h === void 0 ? void 0 : _h.checkDisposed();
                         const isTouch = DeviceModelToTypes.model_touch.includes(deviceType);
                         yield wait(isTouch ? 3000 : 1500);
                     }
@@ -50550,7 +50691,7 @@ class FirmwareUpdateV2 extends BaseMethod {
                     }
                 }
                 const source = yield acquireFirmwareSource();
-                (_j = (_h = this.device) === null || _h === void 0 ? void 0 : _h.commands) === null || _j === void 0 ? void 0 : _j.checkDisposed();
+                (_k = (_j = this.device) === null || _j === void 0 ? void 0 : _j.commands) === null || _k === void 0 ? void 0 : _k.checkDisposed();
                 yield this.device.acquire();
                 const response = yield uploadFirmwareFromSource(params.updateType, this.device.getCommands().typedCall.bind(this.device.getCommands()), this.postMessage, device, source, true, params.isUpdateBootloader);
                 if (this.connectId) {
@@ -50575,7 +50716,7 @@ class FirmwareUpdateV3 extends FirmwareUpdateBaseMethod {
         this.artifactSources = [];
     }
     init() {
-        var _a, _b, _c, _d, _e, _f;
+        var _a, _b, _c;
         this.allowDeviceMode = [UI_REQUEST.BOOTLOADER, UI_REQUEST.NOT_INITIALIZE];
         this.requireDeviceMode = [];
         this.useDevicePassphraseState = false;
@@ -50593,7 +50734,11 @@ class FirmwareUpdateV3 extends FirmwareUpdateBaseMethod {
             { name: 'firmwareType', type: 'string' },
             { name: 'platform', type: 'string' },
         ]);
-        const preparedPlan = payload.artifacts || payload.preparedPlan
+        const hasPreparedPlan = payload.preparedPlan !== undefined;
+        if (!hasPreparedPlan && payload.artifacts !== undefined) {
+            throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.CallMethodInvalidParameter, 'Firmware artifacts require a prepared plan');
+        }
+        const preparedPlan = hasPreparedPlan
             ? validateFirmwareUpdatePreparedPlan(payload.preparedPlan)
             : undefined;
         const hasLegacyInputs = [
@@ -50611,42 +50756,53 @@ class FirmwareUpdateV3 extends FirmwareUpdateBaseMethod {
         const artifactReader = preparedPlan
             ? resolveFirmwareUpdateHostBinding(payload.hostBindingGeneration, preparedPlan.preparedPlanDigest).artifactReader
             : payload.artifactReader;
+        const preparedArtifacts = {};
         if (preparedPlan) {
+            const componentTargets = ['bootloader', 'firmware', 'ble'];
+            const supportedTargets = new Set([...componentTargets, 'resource']);
+            const unsupportedTarget = preparedPlan.targetsToUpdate.find(target => !supportedTargets.has(target));
+            if (unsupportedTarget) {
+                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Firmware prepared plan target ${unsupportedTarget} is not supported by V3`, { firmwareUpdateCode: 'FirmwarePreparedPlanInvalid' });
+            }
+            for (const target of componentTargets) {
+                if (preparedPlan.targetsToUpdate.includes(target)) {
+                    preparedArtifacts[target] = getFirmwareUpdatePreparedRawArtifact({
+                        preparedPlan,
+                        target,
+                        role: target,
+                    }).artifact;
+                }
+            }
+            const resourceBindings = ((_b = (_a = payload.artifacts) === null || _a === void 0 ? void 0 : _a.resourceEntries) !== null && _b !== void 0 ? _b : []).map((entry) => ({
+                target: 'resource',
+                entryName: entry.entryName,
+                artifact: entry.artifact,
+            }));
             assertFirmwareUpdatePreparedPlanBinding({
                 preparedPlan,
                 executor: 'v3',
                 platform: payload.platform,
-                scopeTargets: ['bootloader', 'firmware', 'resource', 'ble'],
+                scopeTargets: [
+                    'bootloader',
+                    'firmware',
+                    'ble',
+                    ...(resourceBindings.length ? ['resource'] : []),
+                ],
                 bindings: [
-                    ...(((_a = payload.artifacts) === null || _a === void 0 ? void 0 : _a.bootloader)
-                        ? [
-                            {
-                                target: 'bootloader',
-                                artifact: payload.artifacts.bootloader,
-                            },
-                        ]
-                        : []),
-                    ...(((_b = payload.artifacts) === null || _b === void 0 ? void 0 : _b.firmware)
-                        ? [
-                            {
-                                target: 'firmware',
-                                artifact: payload.artifacts.firmware,
-                            },
-                        ]
-                        : []),
-                    ...(((_c = payload.artifacts) === null || _c === void 0 ? void 0 : _c.ble)
-                        ? [
-                            {
-                                target: 'ble',
-                                artifact: payload.artifacts.ble,
-                            },
-                        ]
-                        : []),
-                    ...((_e = (_d = payload.artifacts) === null || _d === void 0 ? void 0 : _d.resourceEntries) !== null && _e !== void 0 ? _e : []).map((entry) => ({
-                        target: 'resource',
-                        entryName: entry.entryName,
-                        artifact: entry.artifact,
-                    })),
+                    ...componentTargets.flatMap(target => {
+                        var _a;
+                        const plannedArtifact = preparedArtifacts[target];
+                        const suppliedArtifact = (_a = payload.artifacts) === null || _a === void 0 ? void 0 : _a[target];
+                        return plannedArtifact || suppliedArtifact
+                            ? [
+                                {
+                                    target,
+                                    artifact: suppliedArtifact !== null && suppliedArtifact !== void 0 ? suppliedArtifact : plannedArtifact,
+                                },
+                            ]
+                            : [];
+                    }),
+                    ...resourceBindings,
                 ],
             });
         }
@@ -50660,10 +50816,10 @@ class FirmwareUpdateV3 extends FirmwareUpdateBaseMethod {
             bootloaderBinary: payload.bootloaderBinary,
             firmwareVersion: payload.firmwareVersion,
             resourceBinary: payload.resourceBinary,
-            firmwareType: (_f = preparedPlan === null || preparedPlan === void 0 ? void 0 : preparedPlan.firmwareType) !== null && _f !== void 0 ? _f : payload.firmwareType,
+            firmwareType: (_c = preparedPlan === null || preparedPlan === void 0 ? void 0 : preparedPlan.firmwareType) !== null && _c !== void 0 ? _c : payload.firmwareType,
             platform: payload.platform,
             artifactReader,
-            artifacts: payload.artifacts,
+            artifacts: preparedPlan ? preparedArtifacts : undefined,
         };
     }
     run() {
@@ -50769,19 +50925,21 @@ class FirmwareUpdateV3 extends FirmwareUpdateBaseMethod {
     prepareResourceInput(firmwareType) {
         var _a;
         return __awaiter(this, void 0, void 0, function* () {
-            const preparedEntries = (_a = this.params.artifacts) === null || _a === void 0 ? void 0 : _a.resourceEntries;
-            if ((preparedEntries === null || preparedEntries === void 0 ? void 0 : preparedEntries.length) && this.params.resourceBinary) {
-                throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Firmware resource input must not contain both archive binary and prepared entries');
-            }
-            if (preparedEntries === null || preparedEntries === void 0 ? void 0 : preparedEntries.length) {
+            if ((_a = this.params.preparedPlan) === null || _a === void 0 ? void 0 : _a.targetsToUpdate.includes('resource')) {
+                const verifiedEntries = yield readVerifiedPreparedResourceArchive({
+                    preparedPlan: this.params.preparedPlan,
+                    reader: this.params.artifactReader,
+                });
                 const resourceEntries = [];
-                for (const entry of preparedEntries) {
-                    const resourceName = getFirmwareUpdateResourceName(entry.entryName);
-                    const source = yield this.openArtifactSource(undefined, entry.artifact);
+                for (const entry of verifiedEntries) {
+                    const source = yield this.openArtifactSource(entry.binary, undefined);
                     if (!source) {
-                        throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Firmware resource entry ${entry.entryName} is not prepared`);
+                        throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, `Firmware resource entry ${entry.entryName} is empty`, {
+                            firmwareUpdateCode: 'FirmwareArtifactReceiptMismatch',
+                            artifactName: 'resource',
+                        });
                     }
-                    resourceEntries.push({ entryName: resourceName, source });
+                    resourceEntries.push({ entryName: entry.entryName, source });
                 }
                 return {
                     resourceBinary: null,
@@ -51476,12 +51634,12 @@ const PROTOCOL_V2_REMOTE_COMPONENT_TARGETS = {
 const PROTOCOL_V2_FIRMWARE_STAGING_PATHS = new Set(Object.values(PROTOCOL_V2_REMOTE_COMPONENT_TARGETS).map(target => `${PROTOCOL_V2_FIRMWARE_STAGING_VOLUME}${target.fileName}`));
 const PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_PATH = 'vol0:/loaders/bootloader/boot_resource.okpkg';
 const PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_STAGING_PATH = `${PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_PATH}.staging`;
-const resolveProtocolV2ResourceWritePath = (devicePath) => {
-    const normalizedPath = devicePath.replace(/^vol0:(?!\/)/i, 'vol0:/').toLowerCase();
-    return normalizedPath === PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_PATH
-        ? PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_STAGING_PATH
-        : devicePath;
-};
+const isProtocolV2BootResourcePackagePath = (devicePath) => typeof devicePath === 'string' &&
+    devicePath.replace(/^vol0:(?!\/)/i, 'vol0:/').toLowerCase() ===
+        PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_PATH;
+const resolveProtocolV2ResourceWritePath = (devicePath) => isProtocolV2BootResourcePackagePath(devicePath)
+    ? PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_STAGING_PATH
+    : devicePath;
 const PROTOCOL_V2_UPDATE_TARGET_BY_TARGET_ID = new Map([
     [ProtocolV2FirmwareTargetType.FW_MGMT_TARGET_BOOTLOADER, 'boot'],
     [ProtocolV2FirmwareTargetType.FW_MGMT_TARGET_APPLICATION_P1, 'app_v1'],
@@ -51653,6 +51811,7 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
         super(...arguments);
         this.protocolV2PreparedSources = [];
         this.protocolV2ExecutionInLoader = false;
+        this.protocolV2BootResourceStagingSafe = false;
         this.protocolV2CompletedTargetVersions = new Map();
         this.protocolV2FinalStatusVerified = false;
     }
@@ -52808,6 +52967,15 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
     }
     buildProtocolV2ExecutionPhases({ installSources, resourceSources, }) {
         const phases = [];
+        const bootResourceSources = resourceSources.filter(source => isProtocolV2BootResourcePackagePath(source.devicePath));
+        const remainingResourceSources = resourceSources.filter(source => !isProtocolV2BootResourcePackagePath(source.devicePath));
+        if (bootResourceSources.length > 0) {
+            phases.push({
+                kind: 'resource-sync',
+                installSources: [],
+                resourceSources: bootResourceSources,
+            });
+        }
         const bootloaderSources = installSources.filter(source => source.kind === 'bootloader');
         if (bootloaderSources.length > 0) {
             phases.push({
@@ -52820,11 +52988,11 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
                 resourceSources: [],
             });
         }
-        if (resourceSources.length > 0) {
+        if (remainingResourceSources.length > 0) {
             phases.push({
                 kind: 'resource-sync',
                 installSources: [],
-                resourceSources,
+                resourceSources: remainingResourceSources,
             });
         }
         const componentSources = installSources.filter(source => source.kind !== 'bootloader');
@@ -52844,6 +53012,7 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
     }
     executeProtocolV2Phases({ installSources, resourceSources, }) {
         return __awaiter(this, void 0, void 0, function* () {
+            this.protocolV2BootResourceStagingSafe = false;
             const phases = this.buildProtocolV2ExecutionPhases({
                 installSources,
                 resourceSources,
@@ -52854,10 +53023,14 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
                 }
                 if (phase.kind === 'resource-sync') {
                     yield this.enterProtocolV2BootloaderMode();
+                    if (!phase.resourceSources.some(source => isProtocolV2BootResourcePackagePath(source.devicePath))) {
+                        yield this.ensureProtocolV2BootResourceStagingIsEmpty();
+                    }
                     yield this.executeProtocolV2TransferPhase(phase);
                 }
                 else if (phase.kind === 'bootloader-install' || phase.kind === 'component-install') {
                     yield this.enterProtocolV2BootloaderMode();
+                    yield this.ensureProtocolV2BootResourceStagingIsEmpty();
                     yield this.executeProtocolV2TransferPhase(phase);
                     yield this.exitProtocolV2BootloaderToNormal();
                 }
@@ -52869,6 +53042,31 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
             throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.RuntimeError, 'Protocol V2 execution has no final verification phase');
         });
     }
+    ensureProtocolV2BootResourceStagingIsEmpty() {
+        var _a, _b;
+        return __awaiter(this, void 0, void 0, function* () {
+            if (this.protocolV2BootResourceStagingSafe)
+                return;
+            const typedCall = this.device.getCommands().typedCall.bind(this.device.getCommands());
+            const query = () => typedCall('FilesystemPathInfoQuery', 'FilesystemPathInfo', {
+                path: PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_STAGING_PATH,
+            });
+            const current = yield query();
+            if ((_a = current.message) === null || _a === void 0 ? void 0 : _a.exist) {
+                if (current.message.directory) {
+                    throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.EmmcFileWriteFirmwareError, 'Protocol V2 boot resource staging path is not a file');
+                }
+                yield typedCall('FilesystemFileDelete', 'Success', {
+                    path: PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_STAGING_PATH,
+                });
+                const remaining = yield query();
+                if ((_b = remaining.message) === null || _b === void 0 ? void 0 : _b.exist) {
+                    throw hdShared.ERRORS.TypedError(hdShared.HardwareErrorCode.EmmcFileWriteFirmwareError, 'Protocol V2 stale boot resource staging file could not be removed');
+                }
+            }
+            this.protocolV2BootResourceStagingSafe = true;
+        });
+    }
     executeProtocolV2SourceUpdate({ installSources, resourceSources, }) {
         return __awaiter(this, void 0, void 0, function* () {
             return this.executeProtocolV2Phases({
@@ -52907,7 +53105,8 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
             let totalSize = installSources.reduce((total, item) => total + item.source.size, 0);
             const resourcesToSync = [];
             for (const resource of resourceSources) {
-                if (yield this.isProtocolV2ResourceBundleUpToDate(resource)) {
+                const requiresFreshStaging = isProtocolV2BootResourcePackagePath(resource.devicePath);
+                if (!requiresFreshStaging && (yield this.isProtocolV2ResourceBundleUpToDate(resource))) {
                     Log$6.log(`[FirmwareUpdateV4] skip RESC bundle ${resource.name}; already up to date`);
                 }
                 else {
@@ -52926,6 +53125,9 @@ class FirmwareUpdateV4 extends FirmwareUpdateBaseMethod {
                     totalSize,
                 });
                 yield this.verifyProtocolV2StagedFile(writePath, resource.source.size);
+                if (isProtocolV2BootResourcePackagePath(resource.devicePath)) {
+                    this.protocolV2BootResourceStagingSafe = true;
+                }
             }
             const stagedInstallTargets = [];
             for (const item of installSources) {