Blockstream Jade

This commit hardens a URL-decoding helper in Blockstream Jade's firmware. It adds validation so malformed percent-encoding, embedded null bytes, control characters, and non-ASCII bytes are rejected instead of being silently decoded. A new 'dry run' validation function is also exposed so callers can check an encoded string before decoding it. The change is defensive: it reduces the chance that an attacker could smuggle dangerous characters into URLs or trick downstream code with truncated or malformed strings.

This change rewrites how a small QR-code scanning library allocates memory. Instead of one big 16 KB block, it now uses two separate 8 KB blocks, and it frees them in the reverse order they were allocated. The stated goal is to avoid memory-allocation failures on a small embedded device when memory is fragmented. The patch itself does not fix a known exploitable bug, but it touches memory allocation and pointer handling in code that processes untrusted QR images, so it has defensive-security relevance.

This commit tightens how Blockstream Jade reads output amounts from a Partially Signed Bitcoin Transaction (PSBT). Before, the code tried to read the amount directly without first confirming it was actually present. Now it checks whether the amount exists before reading it. This is a defensive hardening change that could prevent incorrect handling of missing or malformed PSBT output data during transaction signing.

This commit tightens how Blockstream Jade verifies a Bitcoin transaction file (PSBT) before signing. It now requires that every byte in the file is part of the transaction, with no leftover or trailing data allowed. Previously, extra bytes at the end could have been ignored, which might let a malicious or malformed PSBT hide unexpected content or influence how the device interprets what it is signing.

This commit reorganizes existing hardware design files for the original Jade device into a new subfolder and adds the open-source hardware design files for a new product, the Jade Plus. It does not change any software, firmware, or device behavior. There is no indication of a security fix or vulnerability being addressed.

This commit only moves and reorganizes existing test code. It adds a new helper to check whether the current transport is a specific type, moves a shared wait() function into a common test package file, and migrates a large set of low-level RPC tests into a new file. There are no changes to the actual Jade firmware, wallet logic, or production code, so this cannot introduce a security vulnerability in the shipped product.

This commit adds a new way to restore a Bitcoin wallet on a Blockstream Jade hardware device: instead of typing each recovery word, users can enter each word's one-based BIP39 number (for example, '1' for 'abandon'). The change also refactors the existing word-entry code and adds cleanup of sensitive on-screen state when the user exits. There is no direct evidence in the commit that this fixes an active security vulnerability, but it touches sensitive seed-recovery code and changes how user input is validated and cleared.

This commit refactors the on-screen digit-entry keypad in Blockstream Jade so callers can ask for shorter number fields (for example 4 digits instead of 6) and optionally cap the entered value. The existing 6-digit PIN and index entry behavior is kept unchanged. There is no direct evidence in the commit that this fixes an active security bug; it reads as a feature/generalization to support new UI flows such as entering BIP39 word numbers.

This commit is purely a testing infrastructure cleanup. It removes leftover command-line options and test files related to an older transaction-signing workflow, and makes sure temporary PIN files created during automated tests are cleaned up. There is no change to the actual Jade wallet firmware or its security behavior.