빌드 포함 전체 삭제 + APPROTECT 잠금 배치 파일 생성(양산용)

- 배치 내부에서 cmake --build로 merged.hex 갱신
- chiperase + program + verify 후 nrfjprog --rbp ALL로 SWD 디버그 포트 잠금

.vscode/tasks.json

@@ -24,6 +24,18 @@
                 "${workspaceFolder}\\tools\\flash_preserve_settings.ps1"
             ],
             "problemMatcher": []
+        },
+        {
+            "label": "Flash + Lock (full erase + APPROTECT)",
+            "type": "shell",
+            "command": "powershell",
+            "args": [
+                "-ExecutionPolicy",
+                "Bypass",
+                "-File",
+                "${workspaceFolder}\\tools\\flash_full_erase_lock.ps1"
+            ],
+            "problemMatcher": []
         }
     ]
 }

tools/build_flash_erase_lock.bat

@@ -0,0 +1,61 @@
+@echo off
+setlocal enabledelayedexpansion
+
+REM ==============================================================
+REM  Build + Flash + APPROTECT lock  (PRODUCTION ONLY)
+REM  - Rebuilds so build\merged.hex is up to date, then flashes.
+REM  - Do NOT run on development boards (locking needs --recover).
+REM ==============================================================
+
+set "REPO=%~dp0.."
+set "BUILDDIR=%REPO%\build"
+set "HEX=%BUILDDIR%\merged.hex"
+
+REM cmake from the nRF Connect toolchain, fallback to PATH
+set "CMAKE=C:\ncs\toolchains\fd21892d0f\opt\bin\cmake.exe"
+if not exist "%CMAKE%" set "CMAKE=cmake"
+
+echo [FLASH] FULL ERASE + APPROTECT LOCK mode (production)
+echo [FLASH] This wipes application flash, NVS/settings, and BLE bonds.
+echo [FLASH] After locking, SWD debug read/write is disabled.
+echo [FLASH] To unlock later: nrfjprog --recover (mass-erases the chip).
+echo [FLASH] DFU(SMP) over BLE still works after locking.
+echo.
+
+REM --- Step 1: build (updates merged.hex) ---
+echo [FLASH] Step 1/4: build (update merged.hex)
+"%CMAKE%" --build "%BUILDDIR%"
+if errorlevel 1 (
+    echo [FLASH] Build FAILED. Aborting.
+    exit /b 1
+)
+
+if not exist "%HEX%" (
+    echo [FLASH] merged.hex not found: %HEX%
+    echo [FLASH] Build the project first.
+    exit /b 1
+)
+echo [FLASH] Using: %HEX%
+echo.
+
+REM --- Step 2: chip erase + program + verify ---
+echo [FLASH] Step 2/4: chip erase + program + verify
+nrfjprog --program "%HEX%" --chiperase --verify --reset
+if errorlevel 1 (
+    echo [FLASH] Program FAILED. Aborting before lock.
+    exit /b 1
+)
+
+REM --- Step 3: enable APPROTECT ---
+echo [FLASH] Step 3/4: enabling APPROTECT (readback protection)
+nrfjprog --rbp ALL
+
+REM --- Step 4: pin reset to apply protection ---
+echo [FLASH] Step 4/4: pin reset
+nrfjprog --pinreset
+
+echo.
+echo [FLASH] Done. POWER-CYCLE the device to fully latch APPROTECT.
+echo [FLASH] Verify lock: nrfjprog --memrd 0x0  should now FAIL.
+endlocal
+pause

tools/flash_full_erase_lock.ps1

@@ -0,0 +1,35 @@
+param(
+    [string]$Hex = "build\merged.hex"
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = "Stop"
+
+$RepoRoot = Split-Path -Parent $PSScriptRoot
+$HexPath = Join-Path $RepoRoot $Hex
+
+if (-not (Test-Path -LiteralPath $HexPath)) {
+    throw "Hex file not found: $HexPath. Build the project first."
+}
+
+Write-Host "[FLASH] FULL ERASE + APPROTECT LOCK mode (production)"
+Write-Host "[FLASH] This wipes application flash, NVS/settings, and BLE bonds."
+Write-Host "[FLASH] After locking, SWD debug read/write is disabled permanently."
+Write-Host "[FLASH] To unlock later you MUST run 'nrfjprog --recover', which mass-erases the chip."
+Write-Host "[FLASH] DFU(SMP) over BLE still works after locking."
+Write-Host "[FLASH] Programming: $HexPath"
+
+# 1) 전체 지우고 서명된 펌웨어 프로그램
+Write-Host "[FLASH] Step 1/3: chip erase + program + verify"
+nrfjprog --program $HexPath --chiperase --verify --reset
+
+# 2) UICR.APPROTECT 잠금 (SWD 디버그 포트 차단)
+Write-Host "[FLASH] Step 2/3: enabling APPROTECT (readback protection)"
+nrfjprog --rbp ALL
+
+# 3) APPROTECT는 파워사이클/핀리셋 후 실제 적용됨
+Write-Host "[FLASH] Step 3/3: pin reset to apply protection"
+nrfjprog --pinreset
+
+Write-Host "[FLASH] Done. POWER-CYCLE the device to fully latch APPROTECT."
+Write-Host "[FLASH] Verify lock: 'nrfjprog --memrd 0x0' should now FAIL."