# Factory Flashing Toolkit (Local-Only)

This toolkit now runs in local-only mode.

- Network workflows are not used.
- `flash.bin_encryption` config item is no longer supported.
- Firmware package format is **always** `.bin.enc` + `.sig`.

## Quick Start

### 1) Build firmware

From project root:

```bash
idf.py build
```

The packaging script auto-syncs required plaintext build outputs from `build/flasher_args.json`
into `tools/esptool-factory/bin/`, then encrypts them into `.bin.enc` for distribution.

### 2) Prepare private config

Use plaintext config:

- `tools/esptool-factory/conf/factory_private.json`

Requirements:

- Do not set `flash.bin_encryption`.
- Keep `flash.layout` / `app_bin_name` aligned with current build outputs.
- `flash.app_bin_name` must exist in `flash.layout`, and `flash.app_partition_offset`
  must match that layout entry offset.
- `flash.flash_args` (`flash_mode`/`flash_freq`/`flash_size`/`before`/`after`)
  must use supported enum values.
- `flash.layout` uses original build artifact names (for example `bootloader.bin`);
  the packager converts them to `bootloader.bin.enc` automatically.

### 3) Package

From project root:

```bash
tools/esptool-factory/.venv/bin/python3 tools/esptool-factory/package_factory_tools.py
```

The packager always uses:

- `tools/esptool-factory/keys/firmware/fw_key.bin`

and copies it into the release package under `keys/firmware/fw_key.bin`.

Default output:

- `tools/esptool-factory/dist/factory/`

You can change output folder name:

```bash
tools/esptool-factory/.venv/bin/python3 tools/esptool-factory/package_factory_tools.py \
  --package-name line-a
```

### 4) Factory use

1. Run packaged GUI.
2. Connect device and click start.
3. Tool executes: device check -> flash -> post-flash check.
   - If secure boot is already enabled but flash `0x0` header is blank/invalid,
     GUI will switch to initial full-flash provisioning (with force semantics where needed)
     instead of app-only.
   - `force` is gated to `bootloader@0x0` only. Before writing, GUI re-checks
     bootloader image chip/revision compatibility and blocks plaintext force if
     flash encryption appears enabled.

No environment variable is required for `.enc` decrypt key.
The GUI reads `keys/firmware/fw_key.bin` from the package directory.

No network endpoint is required.