@onekeyfe/hd-core 1.2.0-alpha.99 → 1.2.1-alpha.0

package/__tests__/protocol-v2-resources.test.ts

@@ -1,14 +1,14 @@
 import axios from 'axios';
-import { sha256 } from '@noble/hashes/sha256';
-import { EDeviceType, HardwareErrorCode } from '@onekeyfe/hd-shared';
+import { EDeviceType, EFirmwareType, HardwareErrorCode } from '@onekeyfe/hd-shared';
 
 import { DataManager } from '../src/data-manager';
 import {
-  parseProtocolV2ResourceManifest,
+  isProtocolV2ResourceArchiveEntryName,
+  parseProtocolV2ResourcePackage,
   parseProtocolV2Resources,
 } from '../src/protocols/protocol-v2/resources';
 
-import type { ConnectSettings, RemoteConfigResponse } from '../src/types';
+import type { ConnectSettings, Features, RemoteConfigResponse } from '../src/types';
 
 jest.mock('axios');
 jest.mock('../src/data/config', () => ({
@@ -16,9 +16,6 @@ jest.mock('../src/data/config', () => ({
   DEFAULT_DOMAIN: 'https://jssdk.onekey.so/1.0.0-test/',
 }));
 
-const bytesToHex = (bytes: Uint8Array) =>
-  Array.from(bytes, byte => byte.toString(16).padStart(2, '0')).join('');
-
 const resourceSource = {
   archiveUrl: 'https://example.com/resource/pro2-resource.zip',
   archiveSha256: 'a'.repeat(64),
@@ -31,65 +28,21 @@ const neoResourceSource = {
   archiveSize: 12_345_678,
 };
 
-const manifestFiles = [
-  ['bundles/firmware_logo-build.okpkg', 'firmware_logo.okpkg', 'vol0:/bundles/firmware_logo.okpkg'],
-  ['bundles/font/noto-build.okpkg', 'noto.okpkg', 'vol0:/bundles/font/noto.okpkg'],
-  ['bundles/font/roobert-build.okpkg', 'roobert.okpkg', 'vol0:/bundles/font/roobert.okpkg'],
-  [
-    'bundles/images/animation-build.okpkg',
-    'animation.okpkg',
-    'vol0:/bundles/images/animation.okpkg',
-  ],
-  ['bundles/images/images-build.okpkg', 'images.okpkg', 'vol0:/bundles/images/images.okpkg'],
-  [
-    'bundles/images/wallpaper-build.okpkg',
-    'wallpaper.okpkg',
-    'vol0:/bundles/images/wallpaper.okpkg',
-  ],
-  [
-    'bundles/translations/translations-build.okpkg',
-    'translations.okpkg',
-    'vol0:/bundles/translations/translations.okpkg',
-  ],
-  [
-    'loaders/bootloader/boot_resource-build.okpkg',
-    'boot_resource.okpkg',
-    'vol0:/loaders/bootloader/boot_resource.okpkg',
-  ],
-  ['loaders/rom/params-build.okpkg', 'params.okpkg', 'vol0:/loaders/rom/params.okpkg'],
-].map(([archive_path, original_name, device_path], index) => {
-  const binary = new Uint8Array([index + 1]).buffer;
-  return {
-    archive_path,
-    original_name,
-    device_path,
-    size: 1,
-    sha256: bytesToHex(sha256(new Uint8Array(binary))),
-    signed: true,
-    sig_algo: device_path.startsWith('vol0:/bundles/') ? 'ed25519' : 'mldsa65',
-    payload_version: '1.0.0',
-    binary,
-  };
-});
-
-const resourceManifest = {
-  schema: 1,
-  artifact_name: 'pro2-resource-build',
-  release_name: 'resource-build',
-  variant: 'resource',
-  commit: 'a'.repeat(40),
-  short_sha: 'aaaaaaa',
-  timestamp_utc: '20260807_091424',
-  core_version: '1.0.0',
-  key_set: 'dev',
-  device_root: 'vol0:',
-  restore_mode: 'bootloader_update',
-  trees: [
-    { path: 'bundles', device: 'vol0:/bundles' },
-    { path: 'loaders/bootloader', device: 'vol0:/loaders/bootloader' },
-    { path: 'loaders/rom', device: 'vol0:/loaders/rom' },
-  ],
-  files: manifestFiles.map(({ binary: _binary, ...file }) => file),
+const createResourcePackage = (devicePath: string) => {
+  const headerSize = 0x5f90;
+  const bytes = new Uint8Array(headerSize + 1);
+  bytes.set(new TextEncoder().encode('OKPP'), 0);
+  bytes.set(new TextEncoder().encode('RESC'), 0x08);
+  bytes.set(new TextEncoder().encode(devicePath), 0x6c);
+  const view = new DataView(bytes.buffer);
+  view.setUint32(0x04, 1, true);
+  view.setUint32(0x0c, headerSize, true);
+  view.setUint32(0x10, 0x010203, true);
+  view.setUint32(0x14, 1, true);
+  bytes.fill(0x11, 0x200, 0x240);
+  bytes.fill(0x22, 0x240, 0x280);
+  bytes[headerSize] = 0xaa;
+  return bytes;
 };
 
 const createSettings = (configFetcher: ConnectSettings['configFetcher']): ConnectSettings =>
@@ -108,25 +61,109 @@ const createRemoteConfig = (): RemoteConfigResponse =>
     mini: { firmware: [], ble: [] },
     touch: { firmware: [], ble: [] },
     pro: { firmware: [], ble: [] },
-    pro2: { firmware: [], ble: [], resources: { source: resourceSource } },
-    neo: { firmware: [], ble: [], resources: { source: neoResourceSource } },
+    pro2: {
+      'firmware-v1': [
+        {
+          required: false,
+          version: [1, 0, 0],
+          changelog: { 'zh-CN': 'Pro2', 'en-US': 'Pro2' },
+          resources: { source: resourceSource },
+        },
+      ],
+      ble: [],
+    },
+    neo: {
+      'firmware-v1': [
+        {
+          required: false,
+          version: [1, 0, 0],
+          changelog: { 'zh-CN': 'Neo', 'en-US': 'Neo' },
+          resources: { source: neoResourceSource },
+        },
+      ],
+      ble: [],
+    },
     bridge: {},
   } as unknown as RemoteConfigResponse);
 
+const getProtocolV2Release = (deviceType: EDeviceType.Pro2 | EDeviceType.Neo) =>
+  DataManager.deviceMap[deviceType]?.['firmware-v1']?.[0];
+
 describe('Pro2 resource configuration', () => {
   beforeEach(() => {
     jest.clearAllMocks();
     DataManager.lastCheckTimestamp = 0;
   });
 
-  test('accepts the manifest source and the CI schema 1 file set', () => {
+  test('accepts the release archive source', () => {
     expect(parseProtocolV2Resources({ source: resourceSource })).toEqual({
       source: resourceSource,
     });
-    expect(parseProtocolV2ResourceManifest(resourceManifest).files).toHaveLength(9);
   });
 
-  test('rejects missing source and malformed manifest paths', () => {
+  test('ignores macOS ZIP metadata that only looks like a resource package', () => {
+    expect(
+      isProtocolV2ResourceArchiveEntryName('bundles/firmware_logo-pro2-prod_resource-signed.okpkg')
+    ).toBe(true);
+    expect(
+      isProtocolV2ResourceArchiveEntryName(
+        'pro2-prod_resource/bundles/firmware_logo-pro2-prod_resource-signed.okpkg'
+      )
+    ).toBe(true);
+    expect(
+      isProtocolV2ResourceArchiveEntryName(
+        '__MACOSX/pro2-prod_resource 2/bundles/._firmware_logo-pro2-prod_resource-signed.okpkg'
+      )
+    ).toBe(false);
+    expect(
+      isProtocolV2ResourceArchiveEntryName(
+        'bundles/._firmware_logo-pro2-prod_resource-signed.okpkg'
+      )
+    ).toBe(false);
+    expect(isProtocolV2ResourceArchiveEntryName('pro2-prod_resource/manifest.json')).toBe(false);
+    expect(isProtocolV2ResourceArchiveEntryName('pro2-prod_resource/.DS_Store')).toBe(false);
+  });
+
+  test('reads the version, hashes, and direct device path from a RESC package', () => {
+    expect(
+      parseProtocolV2ResourcePackage(createResourcePackage('vol0:/bundles/images.okpkg'))
+    ).toEqual({
+      version: [1, 2, 3],
+      payloadLength: 1,
+      devicePath: 'vol0:/bundles/images.okpkg',
+      payloadHash: '11'.repeat(64),
+      headerHash: '22'.repeat(64),
+    });
+  });
+
+  test('uses the RESC header device path and only rejects malformed paths', () => {
+    expect(
+      parseProtocolV2ResourcePackage(
+        createResourcePackage('vol0:/loaders/bootloader/boot_resource.okpkg.staging')
+      ).devicePath
+    ).toBe('vol0:/loaders/bootloader/boot_resource.okpkg.staging');
+    expect(
+      parseProtocolV2ResourcePackage(
+        createResourcePackage('vol0:/loaders/bootloader/params.okpkg.staging')
+      ).devicePath
+    ).toBe('vol0:/loaders/bootloader/params.okpkg.staging');
+    expect(
+      parseProtocolV2ResourcePackage(createResourcePackage('vol0:/loaders/rom/params.okpkg'))
+        .devicePath
+    ).toBe('vol0:/loaders/rom/params.okpkg');
+    expect(
+      parseProtocolV2ResourcePackage(createResourcePackage('vol0:/unexpected/images.okpkg'))
+        .devicePath
+    ).toBe('vol0:/unexpected/images.okpkg');
+    expect(() =>
+      parseProtocolV2ResourcePackage(createResourcePackage('vol0:/bundles/../images.okpkg'))
+    ).toThrow('device path');
+    expect(() =>
+      parseProtocolV2ResourcePackage(createResourcePackage('vol0://bundles/images.okpkg'))
+    ).toThrow('device path');
+  });
+
+  test('rejects missing or malformed release sources', () => {
     expect(() => parseProtocolV2Resources({})).toThrow('source is required');
     expect(() =>
       parseProtocolV2Resources({
@@ -146,14 +183,6 @@ describe('Pro2 resource configuration', () => {
         source: { ...resourceSource, archiveSize: 0 },
       })
     ).toThrow('positive integer');
-    expect(() =>
-      parseProtocolV2ResourceManifest({
-        ...resourceManifest,
-        files: resourceManifest.files.map((file, index) =>
-          index === 0 ? { ...file, archive_path: '../outside.okpkg' } : file
-        ),
-      })
-    ).toThrow('archive_path');
   });
 
   test('applies a validated pre-release config and exposes its archive source', async () => {
@@ -164,10 +193,70 @@ describe('Pro2 resource configuration', () => {
     expect(configFetcher).toHaveBeenCalledWith(
       expect.stringMatching(/^https:\/\/data\.onekey\.so\/pre-config\.json\?noCache=/)
     );
-    expect(DataManager.getProtocolV2ResourceSource()).toEqual(resourceSource);
+    expect(DataManager.getProtocolV2ResourceSource(getProtocolV2Release(EDeviceType.Pro2))).toEqual(
+      resourceSource
+    );
     expect(DataManager.lastCheckTimestamp).toBeGreaterThan(0);
   });
 
+  test('uses the resource archive bound to the selected firmware release', async () => {
+    const newerResourceSource = {
+      archiveUrl: 'https://example.com/resource/pro2-resource-v2.zip',
+      archiveSha256: 'c'.repeat(64),
+      archiveSize: 20_000_000,
+    };
+    const remoteConfig = createRemoteConfig();
+    remoteConfig.pro2['firmware-v1']?.push({
+      ...remoteConfig.pro2['firmware-v1'][0],
+      version: [2, 0, 0],
+      resources: { source: newerResourceSource },
+    });
+
+    await expect(
+      DataManager.load(createSettings(jest.fn().mockResolvedValue(remoteConfig)))
+    ).resolves.toBe(true);
+
+    const selectedRelease = DataManager.getFirmwareLatestRelease(
+      { deviceType: 'pro2', firmwareVersion: '1.0.0' } as Features,
+      EFirmwareType.Universal
+    );
+    expect(selectedRelease?.version).toEqual([2, 0, 0]);
+    expect(DataManager.getProtocolV2ResourceSource(selectedRelease)).toEqual(newerResourceSource);
+  });
+
+  test('does not use a device-level Protocol V2 resource archive', async () => {
+    const remoteConfig = createRemoteConfig();
+    delete remoteConfig.pro2['firmware-v1']?.[0].resources;
+    (remoteConfig.pro2 as unknown as { resources: unknown }).resources = {
+      source: resourceSource,
+    };
+
+    await expect(
+      DataManager.load(createSettings(jest.fn().mockResolvedValue(remoteConfig)))
+    ).resolves.toBe(true);
+
+    expect(
+      DataManager.getProtocolV2ResourceSource(getProtocolV2Release(EDeviceType.Pro2))
+    ).toBeUndefined();
+  });
+
+  test('does not block the latest release when an older release has invalid resources', async () => {
+    const remoteConfig = createRemoteConfig();
+    (remoteConfig.pro2['firmware-v1']?.[0] as { resources?: unknown }).resources = { source: {} };
+    remoteConfig.pro2['firmware-v1']?.push({
+      ...remoteConfig.pro2['firmware-v1'][0],
+      version: [2, 0, 0],
+      resources: { source: resourceSource },
+    });
+    const configFetcher = jest.fn().mockResolvedValue(remoteConfig);
+
+    await expect(DataManager.load(createSettings(configFetcher))).resolves.toBe(true);
+    await expect(DataManager.forceReloadData({ requireResources: true })).resolves.toBeUndefined();
+
+    const latestRelease = DataManager.deviceMap[EDeviceType.Pro2]?.['firmware-v1']?.[1];
+    expect(DataManager.getProtocolV2ResourceSource(latestRelease)).toEqual(resourceSource);
+  });
+
   test('reuses the configuration fetched during SDK initialization for an immediate update', async () => {
     const configFetcher = jest.fn().mockResolvedValue(createRemoteConfig());
     const settings = createSettings(configFetcher);
@@ -180,25 +269,33 @@ describe('Pro2 resource configuration', () => {
 
   test('keeps base SDK initialization available when remote Pro2 resources are invalid', async () => {
     const remoteConfig = createRemoteConfig();
-    (remoteConfig.pro2 as { resources?: unknown }).resources = { source: {} };
+    (remoteConfig.pro2['firmware-v1']?.[0] as { resources?: unknown }).resources = { source: {} };
     const configFetcher = jest.fn().mockResolvedValue(remoteConfig);
 
     await expect(DataManager.load(createSettings(configFetcher))).resolves.toBe(true);
 
-    expect(DataManager.getProtocolV2ResourceSource()).toBeUndefined();
+    expect(
+      DataManager.getProtocolV2ResourceSource(getProtocolV2Release(EDeviceType.Pro2))
+    ).toBeUndefined();
     expect(DataManager.protocolV2ResourcesConfigError).toBeInstanceOf(Error);
-    expect(DataManager.getProtocolV2ResourceSource(EDeviceType.Neo)).toEqual(neoResourceSource);
+    expect(DataManager.getProtocolV2ResourceSource(getProtocolV2Release(EDeviceType.Neo))).toEqual(
+      neoResourceSource
+    );
   });
 
   test('keeps Pro2 resources available when remote Neo resources are invalid', async () => {
     const remoteConfig = createRemoteConfig();
-    (remoteConfig.neo as { resources?: unknown }).resources = { source: {} };
+    (remoteConfig.neo?.['firmware-v1']?.[0] as { resources?: unknown }).resources = { source: {} };
     const configFetcher = jest.fn().mockResolvedValue(remoteConfig);
 
     await expect(DataManager.load(createSettings(configFetcher))).resolves.toBe(true);
 
-    expect(DataManager.getProtocolV2ResourceSource(EDeviceType.Pro2)).toEqual(resourceSource);
-    expect(DataManager.getProtocolV2ResourceSource(EDeviceType.Neo)).toBeUndefined();
+    expect(DataManager.getProtocolV2ResourceSource(getProtocolV2Release(EDeviceType.Pro2))).toEqual(
+      resourceSource
+    );
+    expect(
+      DataManager.getProtocolV2ResourceSource(getProtocolV2Release(EDeviceType.Neo))
+    ).toBeUndefined();
     await expect(
       DataManager.forceReloadData({
         requireResources: true,
@@ -218,7 +315,7 @@ describe('Pro2 resource configuration', () => {
 
   test('only blocks resource mutation when the refreshed Pro2 resources are invalid', async () => {
     const remoteConfig = createRemoteConfig();
-    (remoteConfig.pro2 as { resources?: unknown }).resources = { source: {} };
+    (remoteConfig.pro2['firmware-v1']?.[0] as { resources?: unknown }).resources = { source: {} };
     const settings = createSettings(jest.fn().mockResolvedValue(remoteConfig));
     DataManager.settings = settings;
 
@@ -232,7 +329,7 @@ describe('Pro2 resource configuration', () => {
 
   test('checks resource configuration errors for the requested device only', async () => {
     const remoteConfig = createRemoteConfig();
-    (remoteConfig.pro2 as { resources?: unknown }).resources = { source: {} };
+    (remoteConfig.pro2['firmware-v1']?.[0] as { resources?: unknown }).resources = { source: {} };
     const settings = createSettings(jest.fn().mockResolvedValue(remoteConfig));
     DataManager.settings = settings;
 

package/__tests__/protocol-v2-unlock-policy.test.ts

@@ -1,8 +1,20 @@
-import { DeviceSessionPinType } from '@onekeyfe/hd-transport';
+import TransportUtils, { DeviceSessionPinType } from '@onekeyfe/hd-transport';
+import { encode as encodeJpeg } from 'jpeg-js';
 
 import ConfluxSignMessageCIP23 from '../src/api/conflux/ConfluxSignMessageCIP23';
+import DeviceChangePin from '../src/api/device/DeviceChangePin';
 import DeviceLock from '../src/api/device/DeviceLock';
+import DeviceRebootToBoardloader from '../src/api/device/DeviceRebootToBoardloader';
+import DeviceRebootToBootloader from '../src/api/device/DeviceRebootToBootloader';
+import DeviceSettings from '../src/api/device/DeviceSettings';
+import DeviceVerify from '../src/api/device/DeviceVerify';
+import DeviceWipe from '../src/api/device/DeviceWipe';
+import DeviceReboot from '../src/api/protocol-v2/DeviceReboot';
+import DeviceUploadNft from '../src/api/protocol-v2/DeviceUploadNft';
+import DeviceUploadWallpaper from '../src/api/protocol-v2/DeviceUploadWallpaper';
+import FirmwareUpdateV4 from '../src/api/FirmwareUpdateV4';
 import OpenWalletSession from '../src/api/OpenWalletSession';
+import DataManager from '../src/data-manager/DataManager';
 import { runMethodWithUnlockPolicy } from '../src/protocols/protocol-v2/unlockPolicyRunner';
 
 jest.mock('../src/data/config', () => ({
@@ -10,7 +22,49 @@ jest.mock('../src/data/config', () => ({
   getSDKVersion: () => '0.0.0-test',
 }));
 
+const createJpegBase64 = (width: number, height: number) => {
+  const data = new Uint8Array(width * height * 4);
+  for (let index = 3; index < data.length; index += 4) data[index] = 0xff;
+  return encodeJpeg({ width, height, data }, 80).data.toString('base64');
+};
+
 describe('Protocol V2 unlock semantics', () => {
+  test('serializes genuine-device verification with Protocol V2 certificate messages', async () => {
+    const method = new DeviceVerify({
+      id: 1,
+      payload: { method: 'deviceVerify', dataHex: 'aabb' },
+    });
+    method.init();
+    const protocolV2Messages = TransportUtils.parseConfigure(
+      DataManager.getProtobufMessages('v2Schema')
+    );
+    const typedCall = jest.fn(
+      (requestType: string, responseType: string, payload: Record<string, unknown> = {}) => {
+        const request = TransportUtils.createMessageFromName(protocolV2Messages, requestType);
+        request.Message.encode(request.Message.create(payload)).finish();
+        TransportUtils.createMessageFromName(protocolV2Messages, responseType);
+        if (requestType === 'DeviceCertificateSign') {
+          return Promise.resolve({ message: { data: 'signature' } });
+        }
+        return Promise.resolve({ message: { cert_and_pubkey: 'certificate' } });
+      }
+    );
+    method.device = {
+      getCurrentDeviceType: () => 'pro2',
+      isProtocolV2: () => true,
+      commands: { typedCall },
+    } as any;
+
+    await expect(method.run()).resolves.toEqual({
+      cert: 'certificate',
+      signature: 'signature',
+    });
+    expect(typedCall.mock.calls.map(call => call.slice(0, 2))).toEqual([
+      ['DeviceCertificateSign', 'DeviceCertificateSignature'],
+      ['DeviceCertificateRead', 'DeviceCertificate'],
+    ]);
+  });
+
   test('wallet business methods inherit the wallet-session unlock requirement', () => {
     const method = new ConfluxSignMessageCIP23({
       id: 1,
@@ -22,6 +76,40 @@ describe('Protocol V2 unlock semantics', () => {
     expect(method.getSupportedProtocols()).toContain('V2');
   });
 
+  test.each([
+    [
+      'deviceReboot',
+      () =>
+        new DeviceReboot({
+          id: 1,
+          payload: { method: 'deviceReboot', rebootType: 2 },
+        }),
+    ],
+    [
+      'deviceRebootToBootloader',
+      () =>
+        new DeviceRebootToBootloader({
+          id: 1,
+          payload: { method: 'deviceRebootToBootloader' },
+        }),
+    ],
+    [
+      'deviceRebootToBoardloader',
+      () =>
+        new DeviceRebootToBoardloader({
+          id: 1,
+          payload: { method: 'deviceRebootToBoardloader' },
+        }),
+    ],
+  ])('pre-unlocks %s before sending DeviceReboot', (_name, createMethod) => {
+    const method = createMethod();
+    method.init();
+
+    expect(method.unlockPolicy).toBe('unlock-before-run');
+    expect(method.protocolV2PreUnlockPinType).toBe(DeviceSessionPinType.Any);
+    expect(method.useDevicePassphraseState).toBe(false);
+  });
+
   test('lock-free Protocol V2 controls explicitly opt out of wallet-session handling', () => {
     const method = new DeviceLock({
       id: 1,
@@ -63,8 +151,42 @@ describe('Protocol V2 unlock semantics', () => {
     });
 
     expect(method.unlockPolicy).toBe('unlock-before-run');
-    expect(device.unlockDevice).toHaveBeenCalledTimes(1);
+    expect(device.unlockDevice).toHaveBeenCalledWith(DeviceSessionPinType.Main, expect.any(Object));
     expect(run).toHaveBeenCalledTimes(1);
+    expect(method.protocolV2UnlockContext).toMatchObject({
+      preflightCompleted: true,
+      preflightStatusRefreshed: true,
+      preflightMainPinSelected: true,
+    });
+  });
+
+  test('allows either PIN type when pre-unlocking hidden-wallet selection', async () => {
+    const method = new OpenWalletSession({
+      id: 1,
+      payload: { method: 'openWalletSession', mode: 'select-hidden' },
+    });
+    method.init();
+    method.run = jest.fn().mockResolvedValue({ walletType: 'hidden' }) as any;
+    const features = { unlocked: false };
+    const device = {
+      features,
+      commands: {
+        typedCall: jest.fn().mockResolvedValue({ message: { unlocked: false } }),
+      },
+      isProtocolV2: () => true,
+      isBootloader: () => false,
+      isRomloader: () => false,
+      updateProtocolV2Status: jest.fn(() => features),
+      unlockDevice: jest.fn().mockImplementation(() => {
+        features.unlocked = true;
+        return Promise.resolve(features);
+      }),
+    };
+
+    await runMethodWithUnlockPolicy(method, device as any);
+
+    expect(device.unlockDevice).toHaveBeenCalledWith(DeviceSessionPinType.Any, expect.any(Object));
+    expect(method.protocolV2UnlockContext?.preflightMainPinSelected).toBe(false);
   });
 
   test('pre-unlocks an unregistered wallet business method', async () => {
@@ -160,6 +282,117 @@ describe('Protocol V2 unlock semantics', () => {
     expect(device.unlockDevice).toHaveBeenCalledWith(DeviceSessionPinType.Main, expect.any(Object));
   });
 
+  test('allows either PIN type when pre-unlocking device settings', async () => {
+    const method = new DeviceSettings({
+      id: 1,
+      payload: { method: 'deviceSettings', autoLockDelayMs: 60_000 },
+    });
+    method.init();
+    const features = { unlocked: false };
+    const device = {
+      features,
+      commands: {
+        typedCall: jest.fn().mockResolvedValue({ message: { unlocked: false } }),
+      },
+      isProtocolV2: () => true,
+      isBootloader: () => false,
+      isRomloader: () => false,
+      updateProtocolV2Status: jest.fn(() => features),
+      unlockDevice: jest.fn().mockImplementation(() => {
+        features.unlocked = true;
+        return Promise.resolve(features);
+      }),
+    };
+    method.run = jest.fn().mockResolvedValue({ message: 'ok' });
+
+    await expect(runMethodWithUnlockPolicy(method, device as any)).resolves.toEqual({
+      message: 'ok',
+    });
+
+    expect(device.unlockDevice).toHaveBeenCalledWith(DeviceSessionPinType.Any, expect.any(Object));
+  });
+
+  test.each([
+    [
+      'PIN changes',
+      () =>
+        new DeviceChangePin({
+          id: 1,
+          payload: { method: 'deviceChangePin', remove: false },
+        }),
+    ],
+    ['device wipe', () => new DeviceWipe({ id: 1, payload: { method: 'deviceWipe' } })],
+    [
+      'firmware updates',
+      () =>
+        new FirmwareUpdateV4({
+          id: 1,
+          payload: { method: 'firmwareUpdateV4', platform: 'desktop' } as any,
+        }),
+    ],
+    [
+      'genuine-device verification',
+      () =>
+        new DeviceVerify({
+          id: 1,
+          payload: { method: 'deviceVerify', dataHex: '00' },
+        }),
+    ],
+    [
+      'wallpaper uploads',
+      () =>
+        new DeviceUploadWallpaper({
+          id: 1,
+          payload: {
+            method: 'deviceUploadWallpaper',
+            jpegBase64: createJpegBase64(604, 1024),
+          },
+        }),
+    ],
+    [
+      'NFT uploads',
+      () =>
+        new DeviceUploadNft({
+          id: 1,
+          payload: {
+            method: 'deviceUploadNft',
+            imageJpegBase64: createJpegBase64(540, 540),
+            thumbnailJpegBase64: createJpegBase64(263, 263),
+            title: 'NFT',
+            subtitle: '',
+            timestampMs: 1,
+          },
+        }),
+    ],
+  ])('allows either PIN type when pre-unlocking %s', async (_name, createMethod) => {
+    const method = createMethod();
+    method.init();
+    const features = { unlocked: false };
+    const device = {
+      features,
+      commands: {
+        typedCall: jest.fn().mockResolvedValue({ message: { unlocked: false } }),
+      },
+      isProtocolV2: () => true,
+      isBootloader: () => false,
+      isRomloader: () => false,
+      updateProtocolV2Status: jest.fn(() => features),
+      unlockDevice: jest.fn().mockImplementation(() => {
+        features.unlocked = true;
+        return Promise.resolve(features);
+      }),
+    };
+    method.run = jest.fn().mockResolvedValue({ message: 'ok' });
+
+    await expect(runMethodWithUnlockPolicy(method, device as any)).resolves.toEqual({
+      message: 'ok',
+    });
+
+    expect(method.unlockPolicy).toBe('unlock-before-run');
+    expect(method.getSupportedProtocols()).toContain('V2');
+    expect(device.unlockDevice).toHaveBeenCalledWith(DeviceSessionPinType.Any, expect.any(Object));
+  });
+
   test('pre-unlocks a locked standard wallet before wallet-session preparation', async () => {
     const calls: string[] = [];
     const features = {