noteconnection 1.7.0 → 1.9.0

package/dist/src/middleware/SseResponseWriter.test.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const stream_1 = require("stream");
+const SseResponseWriter_1 = require("./SseResponseWriter");
+describe('SSE delivery lifecycle', () => {
+    function slowDestination() {
+        const frames = [];
+        const callbacks = [];
+        const destination = new stream_1.Writable({ highWaterMark: 1, write(chunk, _encoding, callback) {
+                frames.push(chunk.toString());
+                callbacks.push(callback);
+            } });
+        return { destination, frames, callbacks };
+    }
+    test('waits for drain, preserves frame order and completes exactly once', async () => {
+        const { destination, frames, callbacks } = slowDestination();
+        const writer = new SseResponseWriter_1.SseResponseWriter(destination, { maxBufferedBytes: 64, drainTimeoutMs: 1000 });
+        const finish = jest.fn();
+        destination.on('finish', finish);
+        writer.write('first');
+        writer.write('second');
+        const completed = writer.finish();
+        expect(frames).toEqual(['first']);
+        callbacks.shift()();
+        expect(frames).toEqual(['first', 'second']);
+        callbacks.shift()();
+        await completed;
+        await writer.finish();
+        expect(finish).toHaveBeenCalledTimes(1);
+        expect(writer.pendingBytes).toBe(0);
+    });
+    test('bounds pending bytes and destroys an overproducing stream', async () => {
+        const { destination } = slowDestination();
+        const writer = new SseResponseWriter_1.SseResponseWriter(destination, { maxBufferedBytes: 8, drainTimeoutMs: 1000 });
+        writer.write('123456');
+        expect(() => writer.write('789')).toThrow('sse_buffer_limit');
+        expect(destination.destroyed).toBe(true);
+        await expect(writer.finish()).rejects.toThrow('sse_buffer_limit');
+    });
+    test.each(['close', 'error', 'timeout'])('settles %s while waiting for a slow client', async (cause) => {
+        const { destination } = slowDestination();
+        const writer = new SseResponseWriter_1.SseResponseWriter(destination, { maxBufferedBytes: 64, drainTimeoutMs: 10 });
+        writer.write('first');
+        writer.write('second');
+        const completed = writer.finish();
+        if (cause === 'close')
+            destination.destroy();
+        if (cause === 'error')
+            destination.destroy(new Error('socket_failure'));
+        await expect(completed).rejects.toThrow(cause === 'timeout' ? 'sse_drain_timeout' : cause === 'error' ? 'socket_failure' : 'sse_closed');
+        expect(writer.pendingBytes).toBe(0);
+        expect(destination.listenerCount('drain')).toBe(0);
+    });
+});

package/dist/src/middleware/auth.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setSidecarAuthToken = setSidecarAuthToken;
+exports.isRequestTokenAuthorized = isRequestTokenAuthorized;
+exports.isAuthorizedRequest = isAuthorizedRequest;
+let sidecarAuthToken = null;
+function setSidecarAuthToken(token) {
+    sidecarAuthToken = String(token || '').trim() || null;
+}
+function readHeader(req, name) {
+    const value = req.headers[name];
+    if (Array.isArray(value)) {
+        return String(value[0] || '').trim();
+    }
+    return String(value || '').trim();
+}
+/**
+ * Shared credential decision for the sidecar and HTTP server entry points.
+ * A configured token changes the default from anonymous allow to explicit deny.
+ */
+function isRequestTokenAuthorized(req, expectedToken) {
+    const expected = String(expectedToken || '').trim();
+    if (!expected)
+        return true;
+    const legacyToken = readHeader(req, 'x-noteconnection-token');
+    if (legacyToken) {
+        return legacyToken === expected;
+    }
+    const authHeader = readHeader(req, 'authorization');
+    if (!/^Bearer\s+/i.test(authHeader)) {
+        return false;
+    }
+    const bearerToken = authHeader.slice(7).trim();
+    return bearerToken.length > 0 && bearerToken === expected;
+}
+function isAuthorizedRequest(req) {
+    return isRequestTokenAuthorized(req, sidecarAuthToken || '');
+}

package/dist/src/middleware/auth.test.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const auth_1 = require("./auth");
+function request(headers) {
+    return { headers };
+}
+describe('request authorization boundary', () => {
+    afterEach(() => {
+        (0, auth_1.setSidecarAuthToken)('');
+    });
+    test('allows requests when no token is configured', () => {
+        expect((0, auth_1.isRequestTokenAuthorized)(request({}), '')).toBe(true);
+        expect((0, auth_1.isAuthorizedRequest)(request({}))).toBe(true);
+    });
+    test('accepts a valid Bearer credential', () => {
+        expect((0, auth_1.isRequestTokenAuthorized)(request({ authorization: 'Bearer secret' }), 'secret')).toBe(true);
+        expect((0, auth_1.isRequestTokenAuthorized)(request({ authorization: 'bearer secret' }), 'secret')).toBe(true);
+    });
+    test('rejects missing, malformed, and invalid credentials when configured', () => {
+        expect((0, auth_1.isRequestTokenAuthorized)(request({}), 'secret')).toBe(false);
+        expect((0, auth_1.isRequestTokenAuthorized)(request({ authorization: 'Basic secret' }), 'secret')).toBe(false);
+        expect((0, auth_1.isRequestTokenAuthorized)(request({ authorization: 'Bearer ' }), 'secret')).toBe(false);
+        expect((0, auth_1.isRequestTokenAuthorized)(request({ authorization: 'Bearer wrong' }), 'secret')).toBe(false);
+    });
+    test('preserves the legacy token header', () => {
+        expect((0, auth_1.isRequestTokenAuthorized)(request({ 'x-noteconnection-token': 'secret' }), 'secret')).toBe(true);
+    });
+    test('sidecar middleware uses the same strict decision', () => {
+        (0, auth_1.setSidecarAuthToken)('secret');
+        expect((0, auth_1.isAuthorizedRequest)(request({}))).toBe(false);
+        expect((0, auth_1.isAuthorizedRequest)(request({ authorization: 'Bearer secret' }))).toBe(true);
+    });
+});

package/dist/src/middleware/body-parser.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readRequestBody = readRequestBody;
+exports.parseJsonBody = parseJsonBody;
+exports.sendJson = sendJson;
+exports.sendError = sendError;
+const MAX_BODY_SIZE = 50 * 1024 * 1024; // 50MB
+async function readRequestBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let totalSize = 0;
+        req.on('data', (chunk) => {
+            totalSize += chunk.length;
+            if (totalSize > MAX_BODY_SIZE) {
+                req.destroy();
+                reject(new Error('Request body exceeds maximum size'));
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on('end', () => {
+            resolve(Buffer.concat(chunks).toString('utf8'));
+        });
+        req.on('error', reject);
+    });
+}
+async function parseJsonBody(req) {
+    const raw = await readRequestBody(req);
+    if (!raw.trim())
+        return {};
+    return JSON.parse(raw);
+}
+function sendJson(res, statusCode, data) {
+    res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(data));
+}
+function sendError(res, statusCode, error, errorCode) {
+    if (errorCode) {
+        res.setHeader('x-nc-error-code', errorCode);
+    }
+    sendJson(res, statusCode, {
+        success: false,
+        error: error instanceof Error ? error.message : String(error),
+    });
+}

package/dist/src/middleware/cors.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyCorsHeaders = applyCorsHeaders;
+const ALLOWED_ORIGINS = new Set([
+    'http://localhost:3000',
+    'http://127.0.0.1:3000',
+    'http://localhost:5173',
+    'http://127.0.0.1:5173',
+    'tauri://localhost',
+    'https://tauri.localhost',
+]);
+const ALLOWED_HEADER_NAMES = [
+    'Content-Type',
+    'Authorization',
+    'X-Request-Id',
+    'X-NoteConnection-Token',
+    'X-Agent-Conversation-Turn-Id',
+    'X-Agent-Conversation-Resume-Turn-Id',
+];
+const EXPOSED_HEADER_NAMES = [
+    'X-Request-Id',
+    'X-Error-Code',
+    'X-Agent-Conversation-Turn-Id',
+    'X-Agent-Conversation-Replay',
+];
+function applyCorsHeaders(req, res) {
+    const origin = req.headers.origin;
+    if (!origin) {
+        res.setHeader('Access-Control-Allow-Origin', '*');
+        res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
+        res.setHeader('Access-Control-Allow-Headers', ALLOWED_HEADER_NAMES.join(', '));
+        res.setHeader('Access-Control-Expose-Headers', EXPOSED_HEADER_NAMES.join(', '));
+        return true;
+    }
+    if (ALLOWED_ORIGINS.has(origin)) {
+        res.setHeader('Access-Control-Allow-Origin', origin);
+        res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
+        res.setHeader('Access-Control-Allow-Headers', ALLOWED_HEADER_NAMES.join(', '));
+        res.setHeader('Access-Control-Expose-Headers', EXPOSED_HEADER_NAMES.join(', '));
+        res.setHeader('Vary', 'Origin');
+        return true;
+    }
+    return false;
+}

package/dist/src/middleware/index.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sendError = exports.sendJson = exports.parseJsonBody = exports.readRequestBody = exports.ERROR_CODE_HEADER = exports.appendRuntimeApiRequestTrace = exports.getRuntimeRequestTrace = exports.normalizeApiErrorCodeToken = exports.finishRequestTrace = exports.startRequestTraceHandler = exports.resolveRequestId = exports.setSidecarAuthToken = exports.isRequestTokenAuthorized = exports.isAuthorizedRequest = exports.applyCorsHeaders = void 0;
+var cors_1 = require("./cors");
+Object.defineProperty(exports, "applyCorsHeaders", { enumerable: true, get: function () { return cors_1.applyCorsHeaders; } });
+var auth_1 = require("./auth");
+Object.defineProperty(exports, "isAuthorizedRequest", { enumerable: true, get: function () { return auth_1.isAuthorizedRequest; } });
+Object.defineProperty(exports, "isRequestTokenAuthorized", { enumerable: true, get: function () { return auth_1.isRequestTokenAuthorized; } });
+Object.defineProperty(exports, "setSidecarAuthToken", { enumerable: true, get: function () { return auth_1.setSidecarAuthToken; } });
+var request_trace_1 = require("./request-trace");
+Object.defineProperty(exports, "resolveRequestId", { enumerable: true, get: function () { return request_trace_1.resolveRequestId; } });
+Object.defineProperty(exports, "startRequestTraceHandler", { enumerable: true, get: function () { return request_trace_1.startRequestTraceHandler; } });
+Object.defineProperty(exports, "finishRequestTrace", { enumerable: true, get: function () { return request_trace_1.finishRequestTrace; } });
+Object.defineProperty(exports, "normalizeApiErrorCodeToken", { enumerable: true, get: function () { return request_trace_1.normalizeApiErrorCodeToken; } });
+Object.defineProperty(exports, "getRuntimeRequestTrace", { enumerable: true, get: function () { return request_trace_1.getRuntimeRequestTrace; } });
+Object.defineProperty(exports, "appendRuntimeApiRequestTrace", { enumerable: true, get: function () { return request_trace_1.appendRuntimeApiRequestTrace; } });
+Object.defineProperty(exports, "ERROR_CODE_HEADER", { enumerable: true, get: function () { return request_trace_1.ERROR_CODE_HEADER; } });
+var body_parser_1 = require("./body-parser");
+Object.defineProperty(exports, "readRequestBody", { enumerable: true, get: function () { return body_parser_1.readRequestBody; } });
+Object.defineProperty(exports, "parseJsonBody", { enumerable: true, get: function () { return body_parser_1.parseJsonBody; } });
+Object.defineProperty(exports, "sendJson", { enumerable: true, get: function () { return body_parser_1.sendJson; } });
+Object.defineProperty(exports, "sendError", { enumerable: true, get: function () { return body_parser_1.sendError; } });

package/dist/src/middleware/request-trace.js

@@ -0,0 +1,96 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ERROR_CODE_HEADER = void 0;
+exports.resolveRequestId = resolveRequestId;
+exports.normalizeApiErrorCodeToken = normalizeApiErrorCodeToken;
+exports.appendRuntimeApiRequestTrace = appendRuntimeApiRequestTrace;
+exports.getRuntimeRequestTrace = getRuntimeRequestTrace;
+exports.startRequestTraceHandler = startRequestTraceHandler;
+exports.finishRequestTrace = finishRequestTrace;
+const crypto = __importStar(require("crypto"));
+const ERROR_CODE_HEADER = 'x-nc-error-code';
+exports.ERROR_CODE_HEADER = ERROR_CODE_HEADER;
+const MAX_TRACE_RECORDS = 5000;
+const traceRecords = [];
+function resolveRequestId(req) {
+    return req.headers['x-request-id'] || crypto.randomUUID();
+}
+function normalizeApiErrorCodeToken(value, fallback) {
+    if (typeof value === 'string')
+        return value.trim();
+    return fallback;
+}
+function appendRuntimeApiRequestTrace(record) {
+    traceRecords.push(record);
+    while (traceRecords.length > MAX_TRACE_RECORDS) {
+        traceRecords.shift();
+    }
+}
+function getRuntimeRequestTrace(requestId) {
+    if (requestId) {
+        return traceRecords.filter((r) => r.requestId === requestId);
+    }
+    return traceRecords.slice(-100);
+}
+function startRequestTraceHandler(req, res) {
+    const requestId = resolveRequestId(req);
+    const requestStartedAtMs = Date.now();
+    const requestStartedAt = new Date(requestStartedAtMs).toISOString();
+    res.setHeader('X-Request-Id', requestId);
+    return { requestId, requestStartedAtMs, requestStartedAt };
+}
+function finishRequestTrace(req, res, requestId, requestStartedAtMs, requestStartedAt, requestPath, ERROR_CODE_HEADER) {
+    const responseContentLengthHeader = Number(res.getHeader('content-length'));
+    const responseContentLength = Number.isFinite(responseContentLengthHeader)
+        ? Math.max(0, Math.floor(responseContentLengthHeader))
+        : null;
+    const responseErrorCode = normalizeApiErrorCodeToken(res.getHeader(ERROR_CODE_HEADER), '');
+    appendRuntimeApiRequestTrace({
+        requestId,
+        method: String(req.method || 'GET').trim().toUpperCase(),
+        path: requestPath,
+        statusCode: Number(res.statusCode || 0),
+        errorCode: responseErrorCode || undefined,
+        durationMs: Number((Date.now() - requestStartedAtMs).toFixed(4)),
+        startedAt: requestStartedAt,
+        finishedAt: new Date().toISOString(),
+        responseContentType: String(res.getHeader('content-type') || '').trim(),
+        responseContentLength,
+        requestContentLength: null,
+        remoteAddress: String(req.socket?.remoteAddress || '').trim(),
+        userAgent: String(req.headers['user-agent'] || '').trim().slice(0, 180),
+    });
+}

package/dist/src/mobile.android.evidence.contract.test.js

@@ -0,0 +1,146 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+describe('Tauri Android device evidence contract', () => {
+    const repoRoot = path.resolve(__dirname, '..');
+    const scriptPath = path.join(repoRoot, 'scripts', 'capture-tauri-android-rss-evidence.js');
+    const releaseWorkflowPath = path.join(repoRoot, '.github', 'workflows', 'release-desktop-multi-os.yml');
+    const script = require(scriptPath);
+    let fixtureRoot;
+    beforeEach(() => {
+        fixtureRoot = fs.mkdtempSync(path.join(repoRoot, '.tmp-tauri-android-evidence-'));
+    });
+    afterEach(() => {
+        fs.rmSync(fixtureRoot, { recursive: true, force: true });
+    });
+    test('requires an ordered native workload with restart continuity', () => {
+        const specPath = path.join(fixtureRoot, 'workload.json');
+        fs.writeFileSync(specPath, JSON.stringify({
+            schemaVersion: 1,
+            steps: script.requiredWorkloadSteps.map((name) => ({
+                name,
+                adbArgs: ['shell', 'echo', name],
+            })),
+        }), 'utf8');
+        const parsed = script.parseWorkloadSpec(specPath);
+        expect(parsed.schemaVersion).toBe(1);
+        expect(parsed.requiredSteps).toEqual(['saf-import', 'graph-build', 'exact-query', 'path', 'continuity']);
+        expect(parsed.steps.map((step) => step.name)).toEqual(parsed.requiredSteps);
+    });
+    test('fails closed when a required workload phase is absent or reordered', () => {
+        const missingPath = path.join(fixtureRoot, 'missing.json');
+        fs.writeFileSync(missingPath, JSON.stringify({
+            schemaVersion: 1,
+            steps: script.requiredWorkloadSteps.slice(0, 4).map((name) => ({
+                name,
+                adbArgs: ['shell', 'echo', name],
+            })),
+        }), 'utf8');
+        expect(() => script.parseWorkloadSpec(missingPath)).toThrow(/missing required steps.*continuity/i);
+        const reorderedPath = path.join(fixtureRoot, 'reordered.json');
+        fs.writeFileSync(reorderedPath, JSON.stringify({
+            schemaVersion: 1,
+            steps: [...script.requiredWorkloadSteps].reverse().map((name) => ({
+                name,
+                adbArgs: ['shell', 'echo', name],
+            })),
+        }), 'utf8');
+        expect(() => script.parseWorkloadSpec(reorderedPath)).toThrow(/must be ordered/i);
+        const extraPath = path.join(fixtureRoot, 'extra.json');
+        fs.writeFileSync(extraPath, JSON.stringify({
+            schemaVersion: 1,
+            steps: [
+                ...script.requiredWorkloadSteps.map((name) => ({ name, adbArgs: ['shell', 'echo', name] })),
+                { name: 'unrecorded-helper', adbArgs: ['shell', 'echo', 'ignored'] },
+            ],
+        }), 'utf8');
+        expect(() => script.parseWorkloadSpec(extraPath)).toThrow(/unsupported steps/i);
+    });
+    test('keeps device identity private and parses proc pid output deterministically', () => {
+        expect(script.maskSerial('R58M123456789')).toBe('R5***89');
+        expect(script.maskSerial('1234')).toBe('1234');
+        expect(script.parsePid('12345\n')).toBe(12345);
+        expect(script.parsePid('')).toBe(0);
+    });
+    test('requires measurable arm64 hardware budget inputs', () => {
+        expect(script.parseAbiList('arm64-v8a, armeabi-v7a\n')).toEqual(['arm64-v8a', 'armeabi-v7a']);
+        expect(script.parseAbiList('')).toEqual([]);
+        expect(script.parseTotalRamBytes('MemTotal:       2097152 kB\n')).toBe(2097152 * 1024);
+        expect(script.parseTotalRamBytes('MemTotal:       2097152 kB\r\n')).toBe(2097152 * 1024);
+        expect(script.parseTotalRamBytes('')).toBe(0);
+    });
+    test('exposes signed artifact and RSS release gates in the package contract', () => {
+        const packageJson = JSON.parse(fs.readFileSync(path.join(repoRoot, 'package.json'), 'utf8'));
+        expect(packageJson.scripts?.['verify:mobile:artifact:release']).toContain('--require-signed');
+        expect(packageJson.scripts?.['verify:mobile:artifact:release']).toContain('--require-arm64-only');
+        expect(packageJson.scripts?.['capture:tauri:android:evidence']).toContain('capture-tauri-android-rss-evidence.js');
+    });
+    test('release workflow refuses unsigned Android uploads and verifies arm64 artifacts', () => {
+        const workflow = fs.readFileSync(releaseWorkflowPath, 'utf8');
+        expect(workflow).toContain('Materialize Android release signing key');
+        expect(workflow).toContain('Build Android arm64 APK');
+        expect(workflow).toContain('NOTE_CONNECTION_TAURI_ANDROID_TARGET=aarch64');
+        expect(workflow).not.toContain('NOTE_CONNECTION_TAURI_ANDROID_TARGET=universal npm run tauri:android:build');
+        expect(workflow).toContain('NOTE_CONNECTION_ANDROID_KEYSTORE_BASE64');
+        expect(workflow).toContain('NOTE_CONNECTION_ANDROID_REQUIRE_SIGNING: "1"');
+        expect(workflow).toContain('--require-arm64');
+        expect(workflow).toContain('--require-arm64-only');
+        expect(workflow).toContain('--require-signed');
+        expect(workflow).toContain('verify-android-device-evidence');
+        expect(workflow).toContain('self-hosted, android-arm64');
+        expect(workflow).toContain('--require-rss');
+        expect(workflow).toContain('publish-android-release-assets');
+        expect(workflow).toContain('name: release-${{ needs.ensure-release.outputs.tag_name }}-android-evidence');
+        expect(workflow).not.toContain('name: release-${{ github.event.inputs.tag }}-android-evidence');
+        expect(workflow).toContain('noteconnection-arm64-release.apk');
+        expect(workflow).toContain('noteconnection-arm64-release.aab');
+        expect(workflow).toContain("! -name '*unsigned*'");
+        expect(workflow).toContain('build/release/mobile/*');
+        expect(workflow).not.toContain('src-tauri/gen/android/app/build/outputs/apk/**/*.apk');
+        const androidBuildJob = workflow.split('  build-and-upload-android:')[1]
+            .split('  verify-android-device-evidence:')[0];
+        expect(androidBuildJob).not.toContain('softprops/action-gh-release@v2');
+    });
+    test('RSS harness keeps the release ABI contract strict', () => {
+        const evidenceScript = fs.readFileSync(scriptPath, 'utf8');
+        const verifierCalls = evidenceScript.match(/verifyMobileArtifact\(\{[\s\S]*?\}\);/g) || [];
+        expect(verifierCalls.length).toBeGreaterThanOrEqual(2);
+        verifierCalls.forEach((call) => {
+            expect(call).toContain('requireArm64Only: true');
+        });
+    });
+});

package/dist/src/mobile.android.signing.contract.test.js

@@ -0,0 +1,66 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const path = __importStar(require("path"));
+const fs = __importStar(require("fs"));
+describe('Tauri Android signing configuration contract', () => {
+    const repoRoot = path.resolve(__dirname, '..');
+    const signingScriptPath = path.join(repoRoot, 'scripts', 'configure-tauri-android-signing.js');
+    const runnerScriptPath = path.join(repoRoot, 'scripts', 'run-tauri-android.js');
+    const signing = require(signingScriptPath);
+    test('keeps signing opt-in and injects the config inside the Android DSL', () => {
+        const source = `plugins { id("com.android.application") }\n\nandroid {\n    defaultConfig {\n        applicationId = "com.example"\n    }\n    buildTypes {\n        getByName("release") {\n            isMinifyEnabled = true\n        }\n    }\n}`;
+        const configured = signing.addSigningConfig(source);
+        expect(configured.indexOf('// NOTE_CONNECTION_ANDROID_SIGNING_START')).toBeGreaterThan(configured.indexOf('android {'));
+        expect(configured).toContain('signingConfigs.create("noteConnectionRelease")');
+        expect(configured).toContain('signingConfig = noteConnectionReleaseSigningConfig');
+        expect(configured).toContain('NOTE_CONNECTION_ANDROID_KEYSTORE_PASSWORD');
+        expect(configured).toContain('applicationId = "com.example"');
+    });
+    test('removes a stale generated signing block without touching unrelated Gradle code', () => {
+        const source = `android {\n${signing.renderSigningBlock()}\n    defaultConfig {\n        applicationId = "com.example"\n    }\n}`;
+        const cleaned = signing.removeExistingBlock(source);
+        expect(cleaned).not.toContain('NOTE_CONNECTION_ANDROID_SIGNING_START');
+        expect(cleaned).toContain('applicationId = "com.example"');
+    });
+    test('does not embed secret values and runner invokes the signer around generated builds', () => {
+        const runner = fs.readFileSync(runnerScriptPath, 'utf8');
+        const block = signing.renderSigningBlock();
+        expect(block).toContain('System.getenv');
+        expect(block).not.toContain('password123');
+        expect(runner).toContain('configure-tauri-android-signing.js');
+        expect(runner).toContain('Failed to synchronize Android release signing configuration');
+    });
+});