@onekeyfe/hd-core 1.2.0-alpha.98 → 1.2.0

package/src/device/DeviceStateMapper.ts

@@ -1,4 +1,4 @@
-import { EFirmwareType } from '@onekeyfe/hd-shared';
+import { EFirmwareType, canonicalizePro2BleAdvertisementName } from '@onekeyfe/hd-shared';
 
 import { buildProtocolV1FeaturesPayload } from '../deviceProfile/buildDeviceFeatures';
 import { resolveProtocolV2DeviceIdentity } from '../deviceProfile/protocolV2DeviceIdentity';
@@ -247,7 +247,9 @@ export const mapProtocolV2DeviceInfoToState = (
       model: identity.model,
       vendor: 'onekey.so',
       serialNo: info.hw?.serial_no,
-      bleName: info.coprocessor?.bt_adv_name,
+      bleName: info.coprocessor?.bt_adv_name
+        ? canonicalizePro2BleAdvertisementName(info.coprocessor.bt_adv_name)
+        : undefined,
       deviceId: loader ? null : undefined,
     }),
     status: loader
@@ -267,11 +269,11 @@ export const mapProtocolV2DeviceInfoToState = (
         }
       : { mode },
     versions: definedEntries({
-      firmware: imageVersion(info.fw?.application),
-      applicationP1: imageVersion(info.fw?.application),
-      applicationP2: imageVersion(info.fw?.application_data),
-      bootloader: imageVersion(info.fw?.bootloader),
-      board: imageVersion(info.fw?.romloader),
+      firmware: imageVersion(info.main_mcu?.application),
+      applicationP1: imageVersion(info.main_mcu?.application),
+      applicationP2: imageVersion(info.main_mcu?.application_data),
+      bootloader: imageVersion(info.main_mcu?.bootloader),
+      board: imageVersion(info.main_mcu?.romloader),
       ble: imageVersion(info.coprocessor?.application),
       se01: imageVersion(info.se1?.application),
       se02: imageVersion(info.se2?.application),
@@ -283,16 +285,16 @@ export const mapProtocolV2DeviceInfoToState = (
       se04Boot: imageVersion(info.se4?.bootloader),
     }),
     verification: definedEntries({
-      firmwareBuildId: imageBuildId(info.fw?.application),
-      firmwareHash: imageHash(info.fw?.application),
-      applicationP1BuildId: imageBuildId(info.fw?.application),
-      applicationP1Hash: imageHash(info.fw?.application),
-      applicationP2BuildId: imageBuildId(info.fw?.application_data),
-      applicationP2Hash: imageHash(info.fw?.application_data),
-      bootloaderBuildId: imageBuildId(info.fw?.bootloader),
-      bootloaderHash: imageHash(info.fw?.bootloader),
-      boardBuildId: imageBuildId(info.fw?.romloader),
-      boardHash: imageHash(info.fw?.romloader),
+      firmwareBuildId: imageBuildId(info.main_mcu?.application),
+      firmwareHash: imageHash(info.main_mcu?.application),
+      applicationP1BuildId: imageBuildId(info.main_mcu?.application),
+      applicationP1Hash: imageHash(info.main_mcu?.application),
+      applicationP2BuildId: imageBuildId(info.main_mcu?.application_data),
+      applicationP2Hash: imageHash(info.main_mcu?.application_data),
+      bootloaderBuildId: imageBuildId(info.main_mcu?.bootloader),
+      bootloaderHash: imageHash(info.main_mcu?.bootloader),
+      boardBuildId: imageBuildId(info.main_mcu?.romloader),
+      boardHash: imageHash(info.main_mcu?.romloader),
       bleBuildId: imageBuildId(info.coprocessor?.application),
       bleHash: imageHash(info.coprocessor?.application),
       se01BuildId: imageBuildId(info.se1?.application),
@@ -345,8 +347,10 @@ export const mapProtocolV2DeviceStatusToState = (status: DeviceStatus): DeviceSt
     unlocked: status.unlocked,
     passphraseProtection: status.unlocked === true ? status.passphrase_enabled ?? null : undefined,
     backupRequired: status.backup_required,
-    attachToPinEnabled: status.attach_to_pin_enabled,
-    unlockedAttachPin: status.unlocked_by_attach_to_pin,
+    attachToPinEnabled:
+      status.unlocked === true ? status.attach_to_pin_enabled ?? undefined : undefined,
+    unlockedAttachPin:
+      status.unlocked === true ? status.unlocked_by_attach_to_pin ?? null : undefined,
   }),
   raw: { protocolV2DeviceStatus: status },
 });
@@ -373,21 +377,23 @@ export const mapApplySettingsToState = (settings: ApplySettings): DeviceStatePat
 };
 
 export const mapDeviceSettingsToState = (settings: DeviceSettings): DeviceStatePatch => {
-  const identity = definedEntries({ label: settings.label });
-  const status = definedEntries({ passphraseProtection: settings.passphrase_enable });
+  const identity = definedEntries({ label: settings.label ?? undefined });
+  const status = definedEntries({
+    passphraseProtection: settings.passphrase_enable ?? undefined,
+  });
   const stateSettings = definedEntries({
     bleEnabled: settings.bt_enable,
     language: mapLanguageFromProtocolV2(settings.language),
     wallpaperPath: settings.wallpaper_path,
     brightness: settings.brightness,
-    autoLockDelayMs: settings.autolock_delay_ms,
-    autoShutdownDelayMs: settings.autoshutdown_delay_ms,
+    autoLockDelayMs: settings.autolock_delay_ms ?? undefined,
+    autoShutdownDelayMs: settings.autoshutdown_delay_ms ?? undefined,
     animationEnabled: settings.animation_enable,
     tapToWake: settings.tap_to_wake,
     hapticFeedback: settings.haptic_feedback,
     deviceNameDisplayEnabled: settings.device_name_display_enabled,
     airgapMode: settings.airgap_mode,
-    fidoEnabled: settings.fido_enabled,
+    fidoEnabled: settings.fido_enabled ?? undefined,
     usbLockEnabled: settings.usb_lock_enable,
     randomKeypad: settings.random_keypad,
   });

package/src/deviceProfile/buildDeviceFeatures.ts

@@ -1,4 +1,8 @@
-import { EDeviceType, EFirmwareType } from '@onekeyfe/hd-shared';
+import {
+  EDeviceType,
+  EFirmwareType,
+  canonicalizePro2BleAdvertisementName,
+} from '@onekeyfe/hd-shared';
 
 import {
   resolveDeviceBleFirmwareVersion,
@@ -216,9 +220,9 @@ export const buildProtocolV2FeaturesPayload = ({
   runtimeMode?: ProtocolV2RuntimeMode;
 }): Features => {
   const info = deviceInfo;
-  const fwApplication = info?.fw?.application;
-  const fwBootloader = info?.fw?.bootloader;
-  const fwBoard = info?.fw?.romloader;
+  const fwApplication = info?.main_mcu?.application;
+  const fwBootloader = info?.main_mcu?.bootloader;
+  const fwBoard = info?.main_mcu?.romloader;
   const bleApplication = info?.coprocessor?.application;
   const status = deviceStatus;
   const incomingSerialNo = info?.hw?.serial_no;
@@ -245,7 +249,8 @@ export const buildProtocolV2FeaturesPayload = ({
   const deviceId = status?.device_id ?? cached?.deviceId ?? null;
   const serialNo = firstValue(incomingSerialNo, cached?.serialNo) ?? '';
   const label = cached?.label ?? null;
-  const bleName = firstValue(info?.coprocessor?.bt_adv_name, cached?.bleName);
+  const rawBleName = firstValue(info?.coprocessor?.bt_adv_name, cached?.bleName);
+  const bleName = rawBleName ? canonicalizePro2BleAdvertisementName(rawBleName) : rawBleName;
   const initialized = firstValue(status?.init_states, cached?.initialized) ?? null;
   // passphrase_enabled from a locked Pro2 is not authoritative. Only DeviceStatus
   // after PIN unlock can determine the final passphrase setting.

package/src/events/logBlockEvent.ts

@@ -17,6 +17,14 @@ const LogLabelMethod: Set<string> = new Set([
   'fileRead',
 ]);
 
+// 资源上传参数可能包含很大的 Base64 字符串。这里按方法整段跳过，避免日志层
+// 递归复制和序列化这些数据；资源 API 与传输内容本身保持不变。
+const LogPayloadBlockMethod: Set<string> = new Set([
+  'deviceUploadNft',
+  'deviceUploadWallpaper',
+  'uploadPortfolio',
+]);
+
 const SensitiveLogKeys: Set<string> = new Set([
   'devicestate',
   'entropy',
@@ -86,7 +94,12 @@ export function getLogBlockLabel(message: unknown): string | undefined {
 }
 
 export function getSafeLogPayload(value: unknown, blockLabel?: string): unknown {
-  if (blockLabel && (LogBlockEvent.has(blockLabel) || isSigningMethod(blockLabel))) {
+  if (
+    blockLabel &&
+    (LogBlockEvent.has(blockLabel) ||
+      LogPayloadBlockMethod.has(blockLabel) ||
+      isSigningMethod(blockLabel))
+  ) {
     return { method: blockLabel, payload: '[REDACTED]' };
   }
 

package/src/events/ui-request.ts

@@ -189,6 +189,9 @@ export interface FirmwareProgress {
     totalBytes?: number;
     rateBytesPerSecond?: number;
     elapsedMs?: number;
+    installTargetId?: number;
+    installPhase?: 'prepare' | 'install' | 'verify';
+    installPhaseProgress?: number;
   };
 }
 

package/src/index.ts

@@ -21,16 +21,6 @@ export { executeCallback, cleanupCallback };
 export { preloadSessionCache } from './device/Device';
 export { projectFeatures as projectDeviceStateFeatures } from './device/DeviceStateProjector';
 export { getMethodSupportedProtocols } from './api/utils';
-export {
-  parseProtocolV2ResourceManifest,
-  selectProtocolV2ResourceManifestFiles,
-} from './protocols/protocol-v2/resources';
-export { prepareFirmwareUpdateV4MemoryHost } from './api/firmware/FirmwareMemoryHost';
-export type {
-  FirmwareMemoryArtifact,
-  FirmwareMemoryArtifactEntry,
-  FirmwareUpdateV4MemoryHost,
-} from './api/firmware/FirmwareMemoryHost';
 export {
   getFirmwareUpdateHostBindingGeneration,
   registerFirmwareUpdateHostBinding,

package/src/protocols/protocol-v2/features.ts

@@ -56,6 +56,16 @@ export const getProtocolV2SeType = (se?: DeviceSEInfo): string | null =>
 
 export type ProtocolV2RuntimeMode = 'normal' | 'bootloader' | 'romloader';
 
+export type ProtocolV2ProtocolInfo = ProtocolInfo & {
+  /** Present only when hd-transport decoded the pre-build-fingerprint wire layout. */
+  protobuf_definition?: string | null;
+};
+
+export const isLegacyProtocolV2ProtocolInfo = (
+  protocolInfo: ProtocolInfo
+): protocolInfo is ProtocolV2ProtocolInfo & { protobuf_definition: string | null } =>
+  Object.prototype.hasOwnProperty.call(protocolInfo, 'protobuf_definition');
+
 /**
  * Protocol V2 fingerprints use:
  * <binary>__<version>__<commit>__<PROD|DEV>__<DEBUG|RELEASE>
@@ -87,11 +97,18 @@ export const parseProtocolV2BuildFingerprint = (
 };
 
 export const getProtocolV2RuntimeMode = (
-  protocolInfo: ProtocolInfo
+  protocolInfo: ProtocolInfo,
+  deviceInfo?: ProtocolV2DeviceInfo
 ): ProtocolV2RuntimeMode | undefined => {
   const binary = parseProtocolV2BuildFingerprint(protocolInfo.build_fingerprint)?.binary;
   if (binary === 'application') return 'normal';
-  return binary;
+  if (binary) return binary;
+
+  if (isLegacyProtocolV2ProtocolInfo(protocolInfo) && !deviceInfo?.main_mcu?.application) {
+    if (deviceInfo?.main_mcu?.romloader) return 'romloader';
+    if (deviceInfo?.main_mcu?.bootloader) return 'bootloader';
+  }
+  return undefined;
 };
 
 // MessageType_DeviceStatusGet in the Protocol V2 protobuf registry.
@@ -105,7 +122,7 @@ export const supportsProtocolV2Message = (
 export const PROTOCOL_V2_FEATURES_DEVICE_INFO_REQUEST = {
   targets: {
     hw: true,
-    fw: true,
+    main_mcu: true,
     coprocessor: true,
   },
   types: {
@@ -121,7 +138,7 @@ export const PROTOCOL_V2_FEATURES_DEVICE_INFO_REQUEST = {
 export const PROTOCOL_V2_VERSIONS_DEVICE_INFO_REQUEST = {
   targets: {
     hw: true,
-    fw: true,
+    main_mcu: true,
     coprocessor: true,
     se1: true,
     se2: true,
@@ -137,7 +154,7 @@ export const PROTOCOL_V2_VERSIONS_DEVICE_INFO_REQUEST = {
 export const PROTOCOL_V2_FULL_DEVICE_INFO_REQUEST = {
   targets: {
     hw: true,
-    fw: true,
+    main_mcu: true,
     coprocessor: true,
     se1: true,
     se2: true,

package/src/protocols/protocol-v2/index.ts

@@ -7,6 +7,7 @@ export {
   getProtocolV2RuntimeMode,
   getProtocolV2SeState,
   getProtocolV2SeType,
+  isLegacyProtocolV2ProtocolInfo,
   parseProtocolV2BuildFingerprint,
   requestProtocolV2ProtocolInfo,
   supportsProtocolV2Message,
@@ -18,6 +19,7 @@ export type {
   ProtocolV2SEInfo,
   ProtocolV2SeStateLabel,
   ProtocolV2RuntimeMode,
+  ProtocolV2ProtocolInfo,
 } from './features';
 export * from './firmware';
 export * from './walletSession';

package/src/protocols/protocol-v2/resources.ts

@@ -1,29 +1,20 @@
-import type {
-  IProtocolV2ResourceManifest,
-  IProtocolV2ResourceManifestFile,
-  IProtocolV2Resources,
-} from '../../types';
-import type { FirmwareUpdateV4Target } from '../../types/api/firmwareUpdate';
+import { bytesToHex } from '@noble/hashes/utils';
+
+import type { IProtocolV2Resources, IVersionArray } from '../../types';
 
 export const PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_PATH =
   'vol0:/loaders/bootloader/boot_resource.okpkg';
 export const PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_STAGING_PATH = `${PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_PATH}.staging`;
 export const PROTOCOL_V2_ROM_PARAMS_PACKAGE_PATH = 'vol0:/loaders/rom/params.okpkg';
+export const PROTOCOL_V2_RESOURCE_PACKAGE_HEADER_SIZE = 0x5f90;
 
-const SHA256_HEX_LENGTH = 64;
-
-function normalizeHex(value: unknown, expectedLength: number, field: string): string {
-  if (typeof value !== 'string') {
-    throw new Error(`Invalid Pro2 resource ${field}: expected a hexadecimal string`);
-  }
-  const normalized = value.replace(/^0x/i, '').toLowerCase();
-  if (normalized.length !== expectedLength || !/^[0-9a-f]+$/.test(normalized)) {
-    throw new Error(
-      `Invalid Pro2 resource ${field}: expected ${expectedLength} hexadecimal characters`
-    );
-  }
-  return normalized;
-}
+const PROTOCOL_V2_RESOURCE_PACKAGE_HEADER_VERSION = 1;
+const PROTOCOL_V2_RESOURCE_PACKAGE_FLEXIBLE_OFFSET = 0x6c;
+const PROTOCOL_V2_RESOURCE_PACKAGE_FLEXIBLE_SIZE = 64;
+const PROTOCOL_V2_RESOURCE_PACKAGE_PAYLOAD_HASH_OFFSET = 0x200;
+const PROTOCOL_V2_RESOURCE_PACKAGE_HEADER_HASH_OFFSET = 0x240;
+const PROTOCOL_V2_RESOURCE_PACKAGE_HASH_SIZE = 64;
+const PROTOCOL_V2_RESOURCE_PACKAGE_TYPE = 'RESC';
 
 /** Validate a complete Pro2 stable resource set from remote configuration. */
 export function parseProtocolV2Resources(value: unknown): IProtocolV2Resources | undefined {
@@ -58,153 +49,125 @@ export function parseProtocolV2Resources(value: unknown): IProtocolV2Resources |
   };
 }
 
-const PROTOCOL_V2_RESOURCE_MANIFEST_DEVICE_ROOTS = [
-  'vol0:/bundles/',
-  'vol0:/loaders/rom/',
-] as const;
+export function isProtocolV2ResourceArchiveEntryName(entryName: string): boolean {
+  const normalized = entryName.replace(/\\/g, '/');
+  if (!normalized.toLowerCase().endsWith('.okpkg')) {
+    return false;
+  }
+  const parts = normalized.split('/');
+  const fileName = parts[parts.length - 1] ?? '';
+  return (
+    fileName.length > 0 &&
+    !fileName.startsWith('.') &&
+    !parts.some(
+      part =>
+        !part ||
+        part === '.' ||
+        part === '..' ||
+        part === '.DS_Store' ||
+        part.startsWith('._') ||
+        part.toUpperCase() === '__MACOSX'
+    )
+  );
+}
 
-function isAllowedManifestDevicePath(path: string): boolean {
-  if (
-    !path.endsWith('.okpkg') ||
+function isSafeResourceDevicePath(path: string): boolean {
+  return !(
     path.includes('\\') ||
     path.includes('//') ||
+    [...path].some(char => {
+      const code = char.charCodeAt(0);
+      return code <= 0x1f || code === 0x7f;
+    }) ||
     path.split('/').some(part => part === '.' || part === '..')
-  ) {
-    return false;
-  }
-  if (path === PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_PATH) {
-    return true;
-  }
-  return PROTOCOL_V2_RESOURCE_MANIFEST_DEVICE_ROOTS.some(root => path.startsWith(root));
+  );
 }
 
-function assertManifestString(value: unknown, field: string): string {
-  if (typeof value !== 'string' || value.length === 0) {
-    throw new Error(`Invalid Pro2 resource manifest ${field}`);
-  }
-  return value;
+function readAscii(bytes: Uint8Array, offset: number, length: number): string {
+  return Array.from(bytes.slice(offset, offset + length))
+    .map(byte => String.fromCharCode(byte))
+    .join('');
 }
 
-function assertManifestRelativePath(value: unknown, field: string): string {
-  const path = assertManifestString(value, field);
+function readResourceDevicePath(bytes: Uint8Array): string {
+  const metadata = bytes.slice(
+    PROTOCOL_V2_RESOURCE_PACKAGE_FLEXIBLE_OFFSET,
+    PROTOCOL_V2_RESOURCE_PACKAGE_FLEXIBLE_OFFSET + PROTOCOL_V2_RESOURCE_PACKAGE_FLEXIBLE_SIZE
+  );
+  const terminator = metadata.indexOf(0);
+  const pathBytes = terminator === -1 ? metadata : metadata.slice(0, terminator);
+  const padding = terminator === -1 ? new Uint8Array(0) : metadata.slice(terminator);
   if (
-    path.startsWith('/') ||
-    path.includes('\\') ||
-    path.includes(':') ||
-    path.split('/').some(part => !part || part === '.' || part === '..')
+    pathBytes.byteLength === 0 ||
+    Array.from(pathBytes).some(byte => byte < 0x20 || byte > 0x7e) ||
+    Array.from(padding).some(byte => byte !== 0)
   ) {
-    throw new Error(`Invalid Pro2 resource manifest ${field}`);
+    throw new Error('Invalid Pro2 RESOURCE package device path metadata');
+  }
+  const path = readAscii(pathBytes, 0, pathBytes.byteLength);
+  if (!isSafeResourceDevicePath(path)) {
+    throw new Error(`Invalid Pro2 RESOURCE package device path: ${path}`);
   }
   return path;
 }
 
-function parseProtocolV2ResourceManifestFile(
-  value: unknown,
-  index: number
-): IProtocolV2ResourceManifestFile {
-  if (!value || typeof value !== 'object' || Array.isArray(value)) {
-    throw new Error(`Invalid Pro2 resource manifest files[${index}]`);
-  }
-  const file = value as Partial<IProtocolV2ResourceManifestFile>;
-  const archivePath = assertManifestRelativePath(file.archive_path, `files[${index}].archive_path`);
-  const originalName = assertManifestRelativePath(
-    file.original_name,
-    `files[${index}].original_name`
-  );
-  if (originalName.includes('/')) {
-    throw new Error(`Invalid Pro2 resource manifest files[${index}].original_name`);
-  }
-  const devicePath = assertManifestString(file.device_path, `files[${index}].device_path`);
-  if (!isAllowedManifestDevicePath(devicePath)) {
-    throw new Error(`Invalid Pro2 resource manifest files[${index}].device_path`);
-  }
-  if (!Number.isSafeInteger(file.size) || Number(file.size) <= 0) {
-    throw new Error(`Invalid Pro2 resource manifest files[${index}].size`);
-  }
-  const digest = normalizeHex(file.sha256, SHA256_HEX_LENGTH, `files[${index}].sha256`);
-  if (file.signed !== true) {
-    throw new Error(`Invalid Pro2 resource manifest files[${index}].signed`);
-  }
-  if (file.sig_algo !== 'ed25519' && file.sig_algo !== 'mldsa65') {
-    throw new Error(`Invalid Pro2 resource manifest files[${index}].sig_algo`);
-  }
-  if (file.payload_version !== null && typeof file.payload_version !== 'string') {
-    throw new Error(`Invalid Pro2 resource manifest files[${index}].payload_version`);
-  }
-  if (!archivePath.endsWith('.okpkg') || !originalName.endsWith('.okpkg')) {
-    throw new Error(`Invalid Pro2 resource manifest files[${index}] package extension`);
-  }
-  return {
-    archive_path: archivePath,
-    original_name: originalName,
-    device_path: devicePath,
-    size: Number(file.size),
-    sha256: digest,
-    signed: true,
-    sig_algo: file.sig_algo,
-    payload_version: file.payload_version ?? null,
-  };
-}
+export type ProtocolV2ResourcePackageHeader = {
+  version: IVersionArray;
+  payloadLength: number;
+  devicePath: string;
+  payloadHash: string;
+  headerHash: string;
+};
 
-export function parseProtocolV2ResourceManifest(value: unknown): IProtocolV2ResourceManifest {
-  if (!value || typeof value !== 'object' || Array.isArray(value)) {
-    throw new Error('Invalid Pro2 resource manifest');
-  }
-  const manifest = value as Partial<IProtocolV2ResourceManifest>;
+export function parseProtocolV2ResourcePackageHeader(
+  bytes: Uint8Array,
+  packageSize: number
+): ProtocolV2ResourcePackageHeader {
+  if (bytes.byteLength < PROTOCOL_V2_RESOURCE_PACKAGE_HEADER_SIZE) {
+    throw new Error('Pro2 RESOURCE package is shorter than its header');
+  }
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  const headerVersion = view.getUint32(0x04, true);
+  const headerLength = view.getUint32(0x0c, true);
+  const payloadLength = view.getUint32(0x14, true);
   if (
-    manifest.schema !== 1 ||
-    manifest.variant !== 'resource' ||
-    manifest.device_root !== 'vol0:' ||
-    manifest.restore_mode !== 'bootloader_update' ||
-    !Array.isArray(manifest.trees) ||
-    !Array.isArray(manifest.files)
+    readAscii(bytes, 0, 4) !== 'OKPP' ||
+    readAscii(bytes, 0x08, 4) !== PROTOCOL_V2_RESOURCE_PACKAGE_TYPE ||
+    headerVersion !== PROTOCOL_V2_RESOURCE_PACKAGE_HEADER_VERSION ||
+    headerLength !== PROTOCOL_V2_RESOURCE_PACKAGE_HEADER_SIZE ||
+    payloadLength <= 0 ||
+    headerLength + payloadLength !== packageSize
   ) {
-    throw new Error('Invalid Pro2 resource manifest contract');
-  }
-  const files = manifest.files.map(parseProtocolV2ResourceManifestFile);
-  const devicePaths = new Set(files.map(file => file.device_path));
-  const archivePaths = new Set(files.map(file => file.archive_path));
-  if (
-    files.length === 0 ||
-    devicePaths.size !== files.length ||
-    archivePaths.size !== files.length ||
-    !devicePaths.has(PROTOCOL_V2_BOOT_RESOURCE_PACKAGE_PATH) ||
-    !files.some(file => file.device_path.startsWith('vol0:/bundles/'))
-  ) {
-    throw new Error('Invalid Pro2 resource manifest file set');
+    throw new Error('Invalid Pro2 RESOURCE package header');
   }
+
+  const packedVersion = view.getUint32(0x10, true);
   return {
-    schema: 1,
-    artifact_name: assertManifestString(manifest.artifact_name, 'artifact_name'),
-    release_name: assertManifestString(manifest.release_name, 'release_name'),
-    variant: 'resource',
-    commit: assertManifestString(manifest.commit, 'commit'),
-    short_sha: assertManifestString(manifest.short_sha, 'short_sha'),
-    timestamp_utc: assertManifestString(manifest.timestamp_utc, 'timestamp_utc'),
-    core_version: assertManifestString(manifest.core_version, 'core_version'),
-    key_set: assertManifestString(manifest.key_set, 'key_set'),
-    device_root: 'vol0:',
-    restore_mode: 'bootloader_update',
-    trees: manifest.trees.map((tree, index) => {
-      if (!tree || typeof tree !== 'object') {
-        throw new Error(`Invalid Pro2 resource manifest trees[${index}]`);
-      }
-      const item = tree as { path?: unknown; device?: unknown };
-      return {
-        path: assertManifestRelativePath(item.path, `trees[${index}].path`),
-        device: assertManifestString(item.device, `trees[${index}].device`),
-      };
-    }),
-    files,
+    version: [
+      Math.floor(packedVersion / 0x10000) % 0x100,
+      Math.floor(packedVersion / 0x100) % 0x100,
+      packedVersion % 0x100,
+    ],
+    payloadLength,
+    devicePath: readResourceDevicePath(bytes),
+    payloadHash: bytesToHex(
+      bytes.slice(
+        PROTOCOL_V2_RESOURCE_PACKAGE_PAYLOAD_HASH_OFFSET,
+        PROTOCOL_V2_RESOURCE_PACKAGE_PAYLOAD_HASH_OFFSET + PROTOCOL_V2_RESOURCE_PACKAGE_HASH_SIZE
+      )
+    ),
+    headerHash: bytesToHex(
+      bytes.slice(
+        PROTOCOL_V2_RESOURCE_PACKAGE_HEADER_HASH_OFFSET,
+        PROTOCOL_V2_RESOURCE_PACKAGE_HEADER_HASH_OFFSET + PROTOCOL_V2_RESOURCE_PACKAGE_HASH_SIZE
+      )
+    ),
   };
 }
 
-export function selectProtocolV2ResourceManifestFiles({
-  manifest,
-  targetsToUpdate,
-}: {
-  manifest: IProtocolV2ResourceManifest;
-  targetsToUpdate: readonly FirmwareUpdateV4Target[];
-}): IProtocolV2ResourceManifestFile[] {
-  return targetsToUpdate.includes('resource') ? [...manifest.files] : [];
+export function parseProtocolV2ResourcePackage(
+  binary: ArrayBuffer | Uint8Array
+): ProtocolV2ResourcePackageHeader {
+  const bytes = binary instanceof Uint8Array ? binary : new Uint8Array(binary);
+  return parseProtocolV2ResourcePackageHeader(bytes, bytes.byteLength);
 }

package/src/protocols/protocol-v2/unlockPolicyRunner.ts

@@ -14,10 +14,14 @@ const Log = getLogger(LoggerNames.Core);
 
 export type ProtocolV2UnlockContext = {
   preflightCompleted: boolean;
+  preflightStatusRefreshed?: boolean;
+  preflightMainPinSelected?: boolean;
 };
 
 export const createProtocolV2UnlockContext = (): ProtocolV2UnlockContext => ({
   preflightCompleted: false,
+  preflightStatusRefreshed: false,
+  preflightMainPinSelected: false,
 });
 
 type RunnableMethod = Pick<
@@ -27,6 +31,7 @@ type RunnableMethod = Pick<
   | 'useDevicePassphraseState'
   | 'protocolV2UiInteraction'
   | 'protocolV2UiMode'
+  | 'protocolV2PreUnlockPinType'
   | 'params'
   | 'payload'
 > & {
@@ -48,6 +53,9 @@ type RunMethodWithUnlockPolicyOptions<T> = {
 };
 
 const resolvePreUnlockPinType = (method: RunnableMethod) => {
+  if (method.protocolV2PreUnlockPinType !== undefined) {
+    return method.protocolV2PreUnlockPinType;
+  }
   const targetsKnownHiddenWallet =
     method.useDevicePassphraseState &&
     method.payload?.useEmptyPassphrase !== true &&
@@ -80,6 +88,7 @@ export async function runMethodWithUnlockPolicy<T = unknown>(
   const requiresPreUnlock =
     device.isProtocolV2() &&
     (method.useDevicePassphraseState || method.unlockPolicy === 'unlock-before-run') &&
+    device.state?.status.initialized !== false &&
     !device.isBootloader?.() &&
     !device.isRomloader?.();
 
@@ -95,11 +104,12 @@ export async function runMethodWithUnlockPolicy<T = unknown>(
     await afterStatusBeforeUnlock?.();
 
     if (!status.unlocked) {
+      const preUnlockPinType = resolvePreUnlockPinType(method);
       const unlockInteraction: HardwareUiInteractionMeta | undefined = shouldCoordinateUi
         ? uiCoordinator.enterUnlockInteraction(method.name)
         : undefined;
       const unlockedStatus = await device.unlockDevice(
-        resolvePreUnlockPinType(method),
+        preUnlockPinType,
         shouldCoordinateUi
           ? { emitUiEvent: false, interaction: unlockInteraction }
           : {
@@ -115,9 +125,11 @@ export async function runMethodWithUnlockPolicy<T = unknown>(
           'Protocol V2 device remained locked after the unlock flow.'
         );
       }
+      context.preflightMainPinSelected = preUnlockPinType === DeviceSessionPinType.Main;
       Log.debug('Protocol V2 pre-unlock completed', { method: method.name });
     }
 
+    context.preflightStatusRefreshed = true;
     context.preflightCompleted = true;
   }