@onekeyfe/hd-core 1.2.0-alpha.98 → 1.2.0

package/src/api/OpenWalletSession.ts

@@ -29,6 +29,12 @@ const wasResumed = (session: unknown) =>
   'resumed' in session &&
   (session as { resumed?: unknown }).resumed === true;
 
+const wasWalletStatusRefreshed = (session: unknown) =>
+  !!session &&
+  typeof session === 'object' &&
+  'walletStatusRefreshed' in session &&
+  (session as { walletStatusRefreshed?: unknown }).walletStatusRefreshed === true;
+
 const requireHiddenWalletResponse = (session: { passphraseState?: string }) => {
   if (!session.passphraseState) {
     throw ERRORS.TypedError(
@@ -87,12 +93,20 @@ export default class OpenWalletSession extends BaseMethod<OpenWalletSessionParam
     this.unlockPolicy = 'unlock-before-run';
     this.skipForceUpdateCheck = true;
     this.params = normalizeParams(this.payload as unknown as Record<string, unknown>);
+    this.protocolV2PreUnlockPinType =
+      this.params.mode === OpenWalletSessionMode.SelectHidden
+        ? DeviceSessionPinType.Any
+        : DeviceSessionPinType.Main;
     this.payload.useEmptyPassphrase = this.params.mode === OpenWalletSessionMode.Standard;
   }
 
   async run(): Promise<OpenWalletSessionPayload> {
     const isProtocolV2 = this.device.isProtocolV2();
-    let state = await this.device.getDeviceState({ refreshSections: ['status'] });
+    const reusePreflightStatus =
+      isProtocolV2 && this.protocolV2UnlockContext?.preflightStatusRefreshed === true;
+    let state = reusePreflightStatus
+      ? await this.device.getDeviceState()
+      : await this.device.getDeviceState({ refreshSections: ['status'] });
     let currentDeviceId = state.identity.deviceId;
     const hasAuthoritativeProtocolV2WalletStatus = (candidate: typeof state) =>
       candidate.status.unlocked === true &&
@@ -115,14 +129,25 @@ export default class OpenWalletSession extends BaseMethod<OpenWalletSessionParam
       currentDeviceId = state.identity.deviceId;
       return state;
     };
+    const resolveProtocolV2DeviceStateAfterSession = async (session: unknown) => {
+      if (!wasWalletStatusRefreshed(session)) {
+        return refreshProtocolV2DeviceState();
+      }
+      state = await this.device.getDeviceState();
+      currentDeviceId = state.identity.deviceId;
+      return state;
+    };
     const ensureProtocolV2WalletStatus = async () => {
       if (isProtocolV2 && !hasAuthoritativeProtocolV2WalletStatus(state)) {
-        await this.device.unlockDevice(DeviceSessionPinType.Main, {
-          source: 'unlock-coordinator',
-          reason: 'device-locked',
-          deviceOnly: true,
-          method: 'openWalletSession',
-        });
+        await this.device.unlockDevice(
+          this.protocolV2PreUnlockPinType ?? DeviceSessionPinType.Main,
+          {
+            source: 'unlock-coordinator',
+            reason: 'device-locked',
+            deviceOnly: true,
+            method: 'openWalletSession',
+          }
+        );
         requireAuthoritativeProtocolV2WalletStatus(await refreshProtocolV2DeviceState());
       }
       return state;
@@ -139,13 +164,16 @@ export default class OpenWalletSession extends BaseMethod<OpenWalletSessionParam
             selectMainWalletBeforeRestore:
               !hasAuthoritativeProtocolV2WalletStatus(state) ||
               state.status.unlockedAttachPin === true,
+            mainPinSelected: this.protocolV2UnlockContext?.preflightMainPinSelected,
           })
         : await getPassphraseStateWithRefreshDeviceInfo(this.device, {
             onlyMainPin: true,
             initSession: this.payload.initSession,
           });
       const refreshedState = isProtocolV2
-        ? requireAuthoritativeProtocolV2WalletStatus(await refreshProtocolV2DeviceState())
+        ? requireAuthoritativeProtocolV2WalletStatus(
+            await resolveProtocolV2DeviceStateAfterSession(session)
+          )
         : state;
       const deviceId = requireDeviceId();
       if (
@@ -233,7 +261,9 @@ export default class OpenWalletSession extends BaseMethod<OpenWalletSessionParam
         })
       : await getPassphraseStateWithRefreshDeviceInfo(this.device, { initSession: true });
     const refreshedState = isProtocolV2
-      ? requireAuthoritativeProtocolV2WalletStatus(await refreshProtocolV2DeviceState())
+      ? requireAuthoritativeProtocolV2WalletStatus(
+          await resolveProtocolV2DeviceStateAfterSession(session)
+        )
       : state;
     const deviceId = requireDeviceId();
     if (isProtocolV2 && refreshedState.status.passphraseProtection !== true) {

package/src/api/PromptWebDeviceAccess.ts

@@ -1,4 +1,4 @@
-import { ERRORS, HardwareErrorCode } from '@onekeyfe/hd-shared';
+import { ERRORS, HardwareErrorCode, resolveOneKeyUsbDevicePath } from '@onekeyfe/hd-shared';
 
 import { BaseMethod } from './BaseMethod';
 import TransportManager from '../data-manager/TransportManager';
@@ -52,7 +52,7 @@ export default class PromptWebDeviceAccess extends BaseMethod {
 
         if (isWebUsbEnv) {
           const usbDevice = device as USBDevice;
-          const path = usbDevice.serialNumber;
+          const path = resolveOneKeyUsbDevicePath(usbDevice);
           if (!path) {
             throw ERRORS.TypedError(HardwareErrorCode.WebDevicePromptAccessError);
           }

package/src/api/SearchDevices.ts

@@ -1,3 +1,5 @@
+import { canonicalizePro2BleAdvertisementName } from '@onekeyfe/hd-shared';
+
 import { BaseMethod } from './BaseMethod';
 import TransportManager from '../data-manager/TransportManager';
 import { DataManager } from '../data-manager';
@@ -36,14 +38,15 @@ export default class SearchDevices extends BaseMethod {
         const lowerId = device.id?.toLowerCase();
         if (!seenIds.has(lowerId)) {
           seenIds.add(lowerId);
-          const bleName =
+          const rawBleName =
             device.name ?? (device as unknown as { localName?: string }).localName ?? '';
+          const bleName = canonicalizePro2BleAdvertisementName(rawBleName);
           devices.push({
             ...device,
             connectId: device.id,
             serialNo: null,
-            // Legacy BLE discovery identifier. The physical serial number is unavailable here.
-            uuid: device.id,
+            // BLE discovery cannot provide a physical-device identity before initialization.
+            uuid: '',
             deviceId: null,
             name: bleName || device.name,
             deviceType: getDeviceTypeByBleName(bleName),

package/src/api/UploadPortfolio.ts

@@ -1,21 +1,28 @@
 import { createDeviceNotSupportMethodError } from '@onekeyfe/hd-shared';
 
 import { supportsProtocolV2Message } from '../protocols/protocol-v2/features';
+import { decodeCanonicalBase64 } from './helpers/base64Data';
 import FileWrite from './FileWrite';
 
 export type UploadPortfolioParams = {
-  packageBytes: ArrayBuffer | Uint8Array | Blob;
+  packageBase64: string;
   timeoutMs?: number | string;
 };
 
 const PORTFOLIO_PENDING_PATH = 'vol1:/portfolio/portfolio.okpkg.pending';
 const PORTFOLIO_CHUNK_SIZE = 2048;
+const PORTFOLIO_PACKAGE_MAX_BYTES = 128 * 1024;
 const FILESYSTEM_FILE_WRITE_MESSAGE_TYPE = 60805;
 const PORTFOLIO_UPDATE_MESSAGE_TYPE = 61400;
 
 export default class UploadPortfolio extends FileWrite {
   init() {
-    const { packageBytes, timeoutMs } = this.payload as UploadPortfolioParams;
+    const { packageBase64, timeoutMs } = this.payload as UploadPortfolioParams;
+    const packageBytes = decodeCanonicalBase64({
+      value: packageBase64,
+      parameterName: 'packageBase64',
+      maxBytes: PORTFOLIO_PACKAGE_MAX_BYTES,
+    });
     this.payload = {
       ...this.payload,
       path: PORTFOLIO_PENDING_PATH,

package/src/api/allnetwork/AllNetworkGetAddressBase.ts

@@ -400,7 +400,8 @@ export default abstract class AllNetworkGetAddressBase extends BaseMethod<
               this.payload.passphraseState,
               useEmptyPassphrase,
               this.payload.skipPassphraseCheck,
-              deriveCardano
+              deriveCardano,
+              this.protocolV2UnlockContext?.preflightMainPinSelected
             );
             if (!passphraseStateSafety) {
               throw ERRORS.TypedError(HardwareErrorCode.DeviceCheckPassphraseStateError);

package/src/api/device/DeviceChangePin.ts

@@ -1,4 +1,4 @@
-import { DeviceSettingsPage } from '@onekeyfe/hd-transport';
+import { DeviceSessionPinType, DeviceSettingsPage } from '@onekeyfe/hd-transport';
 
 import { BaseMethod } from '../BaseMethod';
 import { validateParams } from '../helpers/paramsValidator';
@@ -13,6 +13,9 @@ export default class DeviceChangePin extends BaseMethod<ChangePin> {
 
   init() {
     this.unlockPolicy = 'unlock-before-run';
+    // Protocol V2 device-management actions are not wallet-scoped, so either
+    // the main PIN or an Attach PIN may authorize them.
+    this.protocolV2PreUnlockPinType = DeviceSessionPinType.Any;
     this.useDevicePassphraseState = false;
 
     // check payload

package/src/api/device/DeviceRebootToBoardloader.ts

@@ -1,4 +1,4 @@
-import { DeviceRebootType } from '@onekeyfe/hd-transport';
+import { DeviceRebootType, DeviceSessionPinType } from '@onekeyfe/hd-transport';
 
 import { BaseMethod } from '../BaseMethod';
 
@@ -13,6 +13,8 @@ export default class DeviceRebootToBoardloader extends BaseMethod<RebootToBoardl
   init() {
     this.useDevicePassphraseState = false;
     this.skipForceUpdateCheck = true;
+    this.unlockPolicy = 'unlock-before-run';
+    this.protocolV2PreUnlockPinType = DeviceSessionPinType.Any;
   }
 
   getVersionRange() {

package/src/api/device/DeviceRebootToBootloader.ts

@@ -1,4 +1,4 @@
-import { DeviceRebootType } from '@onekeyfe/hd-transport';
+import { DeviceRebootType, DeviceSessionPinType } from '@onekeyfe/hd-transport';
 
 import { BaseMethod } from '../BaseMethod';
 
@@ -13,6 +13,8 @@ export default class DeviceRebootToBootloader extends BaseMethod<RebootToBootloa
   init() {
     this.useDevicePassphraseState = false;
     this.skipForceUpdateCheck = true;
+    this.unlockPolicy = 'unlock-before-run';
+    this.protocolV2PreUnlockPinType = DeviceSessionPinType.Any;
   }
 
   getVersionRange() {

package/src/api/device/DeviceSettings.ts

@@ -1,5 +1,5 @@
 import { HardwareErrorCode, TypedError } from '@onekeyfe/hd-shared';
-import { DeviceSettingsPage } from '@onekeyfe/hd-transport';
+import { DeviceSessionPinType, DeviceSettingsPage } from '@onekeyfe/hd-transport';
 
 import { BaseMethod } from '../BaseMethod';
 import { invalidParameter } from '../helpers/filesystemValidation';
@@ -10,6 +10,7 @@ import {
 } from '../../device/DeviceStateMapper';
 import { getProtocolV2SettingsBehavior } from '../../protocols/protocol-v2/settingsUnlockPolicy';
 import {
+  DEVICE_SETTINGS_NEVER_TIMEOUT_MS,
   DEVICE_SETTINGS_V1_ONLY_FIELDS,
   DEVICE_SETTINGS_V2_ONLY_FIELDS,
   LANGUAGE_LABELS,
@@ -30,6 +31,9 @@ const assertSettingsSupported = (
   }
 };
 
+const normalizeProtocolV1DelayMs = (value: number | undefined) =>
+  value === 0 ? DEVICE_SETTINGS_NEVER_TIMEOUT_MS : value;
+
 const assertProtocolV2SettingValues = (
   payload: DeviceSettingsParams,
   capabilities: ReturnType<typeof getDeviceSettingsCapabilities>
@@ -145,6 +149,8 @@ export default class DeviceSettings extends BaseMethod<ApplySettings> {
           })
         : getProtocolV2SettingsBehavior({ kind: 'page', page });
     this.unlockPolicy = behavior.unlockPolicy;
+    this.protocolV2PreUnlockPinType =
+      behavior.unlockPolicy === 'unlock-before-run' ? DeviceSessionPinType.Any : undefined;
     this.protocolV2UiInteraction = behavior.uiInteraction;
   }
 
@@ -162,8 +168,7 @@ export default class DeviceSettings extends BaseMethod<ApplySettings> {
   async run() {
     try {
       if (this.device.isProtocolV2()) {
-        const refreshStatusAndSettings = () =>
-          this.device.getDeviceState({ refreshSections: ['status', 'settings'] });
+        const refreshStatusAndSettings = () => this.device.refreshProtocolV2SettingsAfterMutation();
         assertSettingsSupported(this.payload, DEVICE_SETTINGS_V1_ONLY_FIELDS, 'Protocol V2');
         const capabilities = getDeviceSettingsCapabilities(
           this.device.getCurrentDeviceType(),
@@ -195,20 +200,20 @@ export default class DeviceSettings extends BaseMethod<ApplySettings> {
           const res = await this.device.commands.typedCall('DeviceSettingsPageShow', 'Success', {
             page: DeviceSettingsPage.DevicePassphrase,
           });
-          const updated = await refreshStatusAndSettings();
-          const lockedAfterDisabling =
-            requestedPassphrase === false &&
-            current.status.unlocked === true &&
-            updated.status.unlocked === false;
-          if (
-            updated.status.passphraseProtection !== requestedPassphrase &&
-            !lockedAfterDisabling
-          ) {
-            throw TypedError(
-              HardwareErrorCode.RuntimeError,
-              'Protocol V2 passphrase setting did not reach the requested value.'
-            );
-          }
+          // A successful page response confirms the device-side toggle. When an Attach PIN
+          // session disables passphrase protection, the firmware locks immediately and omits
+          // private passphrase fields from subsequent reads, so persist the confirmed value
+          // before refreshing the remaining device state.
+          this.device.updateState(
+            {
+              status: {
+                passphraseProtection: requestedPassphrase,
+                ...(requestedPassphrase === false ? { unlockedAttachPin: false } : undefined),
+              },
+            },
+            'settings-write'
+          );
+          await refreshStatusAndSettings();
           return res.message;
         }
         if (requestedAirgap !== undefined) {
@@ -253,10 +258,19 @@ export default class DeviceSettings extends BaseMethod<ApplySettings> {
         );
       }
 
-      const res = await this.device.commands.typedCall('ApplySettings', 'Success', {
+      // Early SDK 1.2 alphas exposed 0 as Protocol V1 "Never". Normalize at the
+      // protocol boundary so existing consumers send the firmware-supported value.
+      const protocolV1Params = {
         ...this.params,
-      });
-      this.device.updateState(mapApplySettingsToState(this.params), 'settings-write');
+        auto_lock_delay_ms: normalizeProtocolV1DelayMs(this.params.auto_lock_delay_ms),
+        auto_shutdown_delay_ms: normalizeProtocolV1DelayMs(this.params.auto_shutdown_delay_ms),
+      };
+      const res = await this.device.commands.typedCall(
+        'ApplySettings',
+        'Success',
+        protocolV1Params
+      );
+      this.device.updateState(mapApplySettingsToState(protocolV1Params), 'settings-write');
       return res.message;
     } catch (error) {
       if (error.message?.toLowerCase().includes('no setting provided')) {

package/src/api/device/DeviceVerify.ts

@@ -1,5 +1,6 @@
 import { sha256 } from '@noble/hashes/sha256';
 import { ERRORS, HardwareErrorCode } from '@onekeyfe/hd-shared';
+import { DeviceSessionPinType } from '@onekeyfe/hd-transport';
 import { bytesToHex } from '@noble/hashes/utils';
 
 import { formatAnyHex } from '../helpers/hexUtils';
@@ -11,7 +12,15 @@ import type { BixinVerifyDeviceRequest } from '@onekeyfe/hd-transport';
 import type { DeviceVerifySignature } from '../../types';
 
 export default class DeviceVerify extends BaseMethod<BixinVerifyDeviceRequest> {
+  getSupportedProtocols() {
+    return ['V1', 'V2'] as const;
+  }
+
   init() {
+    this.unlockPolicy = 'unlock-before-run';
+    // Protocol V2 device-management actions are not wallet-scoped, so either
+    // the main PIN or an Attach PIN may authorize them.
+    this.protocolV2PreUnlockPinType = DeviceSessionPinType.Any;
     this.useDevicePassphraseState = false;
 
     // check payload
@@ -38,6 +47,22 @@ export default class DeviceVerify extends BaseMethod<BixinVerifyDeviceRequest> {
         }
       );
       response = res.message;
+    } else if (this.device.isProtocolV2()) {
+      const signatureRes = await this.device.commands.typedCall(
+        'DeviceCertificateSign',
+        'DeviceCertificateSignature',
+        {
+          data: this.params.data,
+        }
+      );
+      const certRes = await this.device.commands.typedCall(
+        'DeviceCertificateRead',
+        'DeviceCertificate'
+      );
+      response = {
+        cert: certRes.message.cert_and_pubkey,
+        signature: signatureRes.message.data,
+      };
     } else {
       const signatureRes = await this.device.commands.typedCall(
         'SESignMessage',

package/src/api/device/DeviceWipe.ts

@@ -1,4 +1,4 @@
-import { DeviceSettingsPage } from '@onekeyfe/hd-transport';
+import { DeviceSessionPinType, DeviceSettingsPage } from '@onekeyfe/hd-transport';
 
 import { BaseMethod } from '../BaseMethod';
 
@@ -11,6 +11,9 @@ export default class DeviceWipe extends BaseMethod<WipeDevice> {
 
   init() {
     this.unlockPolicy = 'unlock-before-run';
+    // Protocol V2 device-management actions are not wallet-scoped, so either
+    // the main PIN or an Attach PIN may authorize them.
+    this.protocolV2PreUnlockPinType = DeviceSessionPinType.Any;
     this.useDevicePassphraseState = false;
     this.protocolV2UiInteraction = {
       request: 'button',

package/src/api/firmware/FirmwareArtifactSource.ts

@@ -1,4 +1,6 @@
 import { ERRORS, HardwareErrorCode } from '@onekeyfe/hd-shared';
+import { sha256 } from '@noble/hashes/sha256';
+import { bytesToHex } from '@noble/hashes/utils';
 
 import type {
   FirmwareArtifactReader,
@@ -188,6 +190,43 @@ class ReaderFirmwareByteSource implements FirmwareByteSource {
   }
 }
 
+export const readFirmwareByteSourceFully = async (
+  source: FirmwareByteSource
+): Promise<ArrayBuffer> => {
+  const output = new Uint8Array(source.size);
+  let offset = 0;
+  while (offset < source.size) {
+    const length = Math.min(MAX_FIRMWARE_ARTIFACT_READ_BYTES, source.size - offset);
+    output.set(new Uint8Array(await source.readAt(offset, length)), offset);
+    offset += length;
+  }
+  return output.buffer;
+};
+
+export const readVerifiedFirmwareArtifact = async ({
+  artifact,
+  reader,
+}: {
+  artifact: FirmwareArtifactReference;
+  reader: FirmwareArtifactReader;
+}): Promise<ArrayBuffer> => {
+  assertFirmwareArtifactReference(artifact);
+  const source = await ReaderFirmwareByteSource.open(artifact, reader);
+  try {
+    const binary = await readFirmwareByteSourceFully(source);
+    const actualSha256 = bytesToHex(sha256(new Uint8Array(binary)));
+    if (actualSha256 !== artifact.sha256.toLowerCase()) {
+      return artifactError(
+        'FirmwareArtifactReceiptMismatch',
+        'Firmware artifact bytes do not match the approved SHA-256 receipt'
+      );
+    }
+    return binary;
+  } finally {
+    await source.close().catch(() => undefined);
+  }
+};
+
 export const openFirmwareByteSource = async ({
   binary,
   artifact,
@@ -216,20 +255,8 @@ export const openFirmwareByteSource = async ({
       'Firmware artifact reader is required for artifactRef input'
     );
   }
-  return ReaderFirmwareByteSource.open(artifact, reader);
-};
-
-export const readFirmwareByteSourceFully = async (
-  source: FirmwareByteSource
-): Promise<ArrayBuffer> => {
-  const output = new Uint8Array(source.size);
-  let offset = 0;
-  while (offset < source.size) {
-    const length = Math.min(MAX_FIRMWARE_ARTIFACT_READ_BYTES, source.size - offset);
-    output.set(new Uint8Array(await source.readAt(offset, length)), offset);
-    offset += length;
-  }
-  return output.buffer;
+  const verifiedBinary = await readVerifiedFirmwareArtifact({ artifact, reader });
+  return createMemoryFirmwareByteSource(verifiedBinary);
 };
 
 export const writeFirmwareByteSource = async ({

package/src/api/firmware/FirmwareHostBinding.ts

@@ -1,5 +1,7 @@
 import { ERRORS, HardwareErrorCode } from '@onekeyfe/hd-shared';
 
+import { clearFirmwareUpdatePreparedPlanDeviceIdentityPin } from './FirmwareUpdatePreparedPlan';
+
 import type { FirmwareUpdateHostBinding } from '../../types/api/firmwareUpdate';
 
 const bindingError = (message: string): never => {
@@ -24,8 +26,12 @@ class FirmwareHostBindingRegistry {
     ) {
       return bindingError('Firmware host binding is invalid');
     }
+    const replacedPreparedPlanDigest = this.binding?.preparedPlanDigest;
     this.generation += 1;
     this.binding = binding;
+    if (replacedPreparedPlanDigest) {
+      clearFirmwareUpdatePreparedPlanDeviceIdentityPin(replacedPreparedPlanDigest);
+    }
     return this.generation;
   }
 
@@ -33,8 +39,12 @@ class FirmwareHostBindingRegistry {
     if (generation !== undefined && generation !== this.generation) {
       return false;
     }
+    const releasedPreparedPlanDigest = this.binding?.preparedPlanDigest;
     this.generation += 1;
     this.binding = undefined;
+    if (releasedPreparedPlanDigest) {
+      clearFirmwareUpdatePreparedPlanDeviceIdentityPin(releasedPreparedPlanDigest);
+    }
     return true;
   }
 

package/src/api/firmware/FirmwarePreparedResourceArchive.ts

@@ -3,7 +3,7 @@ import { bytesToHex } from '@noble/hashes/utils';
 import { ERRORS, HardwareErrorCode } from '@onekeyfe/hd-shared';
 import JSZip from 'jszip';
 
-import { openFirmwareByteSource, readFirmwareByteSourceFully } from './FirmwareArtifactSource';
+import { readVerifiedFirmwareArtifact } from './FirmwareArtifactSource';
 import { getFirmwareUpdateResourceName } from './FirmwareUpdatePreparedPlan';
 
 import type { FirmwareArtifactReader } from '../../types/api/firmwareUpdate';
@@ -26,7 +26,10 @@ export type VerifiedPreparedResourceEntry = {
 
 const resourceArchiveError = (
   message: string,
-  firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' | 'FirmwareArtifactReceiptMismatch'
+  firmwareUpdateCode:
+    | 'FirmwareArtifactsNotPrepared'
+    | 'FirmwareArtifactReceiptMismatch'
+    | 'FirmwareArtifactReaderInvalid'
 ): never => {
   throw ERRORS.TypedError(HardwareErrorCode.RuntimeError, message, { firmwareUpdateCode });
 };
@@ -73,6 +76,12 @@ export const readVerifiedPreparedResourceArchive = async ({
     }
     return [];
   }
+  if (!reader) {
+    return resourceArchiveError(
+      'Firmware artifact reader is required for prepared resource archives',
+      'FirmwareArtifactReaderInvalid'
+    );
+  }
   if (resourceArtifacts.length !== 1) {
     return resourceArchiveError(
       'Firmware prepared plan must contain exactly one materialized resource ZIP',
@@ -92,37 +101,17 @@ export const readVerifiedPreparedResourceArchive = async ({
       'FirmwareArtifactsNotPrepared'
     );
   }
-  const archiveSource = await openFirmwareByteSource({
-    artifact: archiveArtifact.artifact,
-    reader,
-  });
-  if (!archiveSource) {
-    return resourceArchiveError(
-      'Firmware prepared resource ZIP is unavailable',
-      'FirmwareArtifactsNotPrepared'
-    );
-  }
-  if (archiveSource.size > PREPARED_RESOURCE_ARCHIVE_MAX_BYTES) {
-    await archiveSource.close().catch(() => undefined);
+  if (archiveArtifact.artifact.size > PREPARED_RESOURCE_ARCHIVE_MAX_BYTES) {
     return resourceArchiveError(
       'Firmware prepared resource ZIP exceeds the archive size limit',
       'FirmwareArtifactsNotPrepared'
     );
   }
 
-  let archiveBinary: ArrayBuffer;
-  try {
-    archiveBinary = await readFirmwareByteSourceFully(archiveSource);
-  } finally {
-    await archiveSource.close().catch(() => undefined);
-  }
-  const archiveDigest = bytesToHex(sha256(new Uint8Array(archiveBinary)));
-  if (archiveDigest !== archiveArtifact.artifact.sha256.toLowerCase()) {
-    return resourceArchiveError(
-      'Firmware prepared resource ZIP does not match its approved receipt',
-      'FirmwareArtifactReceiptMismatch'
-    );
-  }
+  const archiveBinary = await readVerifiedFirmwareArtifact({
+    artifact: archiveArtifact.artifact,
+    reader,
+  });
 
   let zip: JSZip;
   try {