noteconnection 1.8.0 → 1.9.1

package/dist/src/middleware/auth.js

@@ -1,17 +1,38 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.setSidecarAuthToken = setSidecarAuthToken;
+exports.isRequestTokenAuthorized = isRequestTokenAuthorized;
 exports.isAuthorizedRequest = isAuthorizedRequest;
 let sidecarAuthToken = null;
 function setSidecarAuthToken(token) {
-    sidecarAuthToken = token;
+    sidecarAuthToken = String(token || '').trim() || null;
 }
-function isAuthorizedRequest(req) {
-    if (!sidecarAuthToken)
+function readHeader(req, name) {
+    const value = req.headers[name];
+    if (Array.isArray(value)) {
+        return String(value[0] || '').trim();
+    }
+    return String(value || '').trim();
+}
+/**
+ * Shared credential decision for the sidecar and HTTP server entry points.
+ * A configured token changes the default from anonymous allow to explicit deny.
+ */
+function isRequestTokenAuthorized(req, expectedToken) {
+    const expected = String(expectedToken || '').trim();
+    if (!expected)
         return true;
-    const authHeader = req.headers.authorization || '';
-    if (authHeader.startsWith('Bearer ')) {
-        return authHeader.slice(7) === sidecarAuthToken;
+    const legacyToken = readHeader(req, 'x-noteconnection-token');
+    if (legacyToken) {
+        return legacyToken === expected;
     }
-    return true;
+    const authHeader = readHeader(req, 'authorization');
+    if (!/^Bearer\s+/i.test(authHeader)) {
+        return false;
+    }
+    const bearerToken = authHeader.slice(7).trim();
+    return bearerToken.length > 0 && bearerToken === expected;
+}
+function isAuthorizedRequest(req) {
+    return isRequestTokenAuthorized(req, sidecarAuthToken || '');
 }

package/dist/src/middleware/auth.test.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const auth_1 = require("./auth");
+function request(headers) {
+    return { headers };
+}
+describe('request authorization boundary', () => {
+    afterEach(() => {
+        (0, auth_1.setSidecarAuthToken)('');
+    });
+    test('allows requests when no token is configured', () => {
+        expect((0, auth_1.isRequestTokenAuthorized)(request({}), '')).toBe(true);
+        expect((0, auth_1.isAuthorizedRequest)(request({}))).toBe(true);
+    });
+    test('accepts a valid Bearer credential', () => {
+        expect((0, auth_1.isRequestTokenAuthorized)(request({ authorization: 'Bearer secret' }), 'secret')).toBe(true);
+        expect((0, auth_1.isRequestTokenAuthorized)(request({ authorization: 'bearer secret' }), 'secret')).toBe(true);
+    });
+    test('rejects missing, malformed, and invalid credentials when configured', () => {
+        expect((0, auth_1.isRequestTokenAuthorized)(request({}), 'secret')).toBe(false);
+        expect((0, auth_1.isRequestTokenAuthorized)(request({ authorization: 'Basic secret' }), 'secret')).toBe(false);
+        expect((0, auth_1.isRequestTokenAuthorized)(request({ authorization: 'Bearer ' }), 'secret')).toBe(false);
+        expect((0, auth_1.isRequestTokenAuthorized)(request({ authorization: 'Bearer wrong' }), 'secret')).toBe(false);
+    });
+    test('preserves the legacy token header', () => {
+        expect((0, auth_1.isRequestTokenAuthorized)(request({ 'x-noteconnection-token': 'secret' }), 'secret')).toBe(true);
+    });
+    test('sidecar middleware uses the same strict decision', () => {
+        (0, auth_1.setSidecarAuthToken)('secret');
+        expect((0, auth_1.isAuthorizedRequest)(request({}))).toBe(false);
+        expect((0, auth_1.isAuthorizedRequest)(request({ authorization: 'Bearer secret' }))).toBe(true);
+    });
+});

package/dist/src/middleware/index.js

@@ -1,10 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.sendError = exports.sendJson = exports.parseJsonBody = exports.readRequestBody = exports.ERROR_CODE_HEADER = exports.appendRuntimeApiRequestTrace = exports.getRuntimeRequestTrace = exports.normalizeApiErrorCodeToken = exports.finishRequestTrace = exports.startRequestTraceHandler = exports.resolveRequestId = exports.setSidecarAuthToken = exports.isAuthorizedRequest = exports.applyCorsHeaders = void 0;
+exports.sendError = exports.sendJson = exports.parseJsonBody = exports.readRequestBody = exports.ERROR_CODE_HEADER = exports.appendRuntimeApiRequestTrace = exports.getRuntimeRequestTrace = exports.normalizeApiErrorCodeToken = exports.finishRequestTrace = exports.startRequestTraceHandler = exports.resolveRequestId = exports.setSidecarAuthToken = exports.isRequestTokenAuthorized = exports.isAuthorizedRequest = exports.applyCorsHeaders = void 0;
 var cors_1 = require("./cors");
 Object.defineProperty(exports, "applyCorsHeaders", { enumerable: true, get: function () { return cors_1.applyCorsHeaders; } });
 var auth_1 = require("./auth");
 Object.defineProperty(exports, "isAuthorizedRequest", { enumerable: true, get: function () { return auth_1.isAuthorizedRequest; } });
+Object.defineProperty(exports, "isRequestTokenAuthorized", { enumerable: true, get: function () { return auth_1.isRequestTokenAuthorized; } });
 Object.defineProperty(exports, "setSidecarAuthToken", { enumerable: true, get: function () { return auth_1.setSidecarAuthToken; } });
 var request_trace_1 = require("./request-trace");
 Object.defineProperty(exports, "resolveRequestId", { enumerable: true, get: function () { return request_trace_1.resolveRequestId; } });

package/dist/src/mobile.android.evidence.contract.test.js

@@ -0,0 +1,146 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+describe('Tauri Android device evidence contract', () => {
+    const repoRoot = path.resolve(__dirname, '..');
+    const scriptPath = path.join(repoRoot, 'scripts', 'capture-tauri-android-rss-evidence.js');
+    const releaseWorkflowPath = path.join(repoRoot, '.github', 'workflows', 'release-desktop-multi-os.yml');
+    const script = require(scriptPath);
+    let fixtureRoot;
+    beforeEach(() => {
+        fixtureRoot = fs.mkdtempSync(path.join(repoRoot, '.tmp-tauri-android-evidence-'));
+    });
+    afterEach(() => {
+        fs.rmSync(fixtureRoot, { recursive: true, force: true });
+    });
+    test('requires an ordered native workload with restart continuity', () => {
+        const specPath = path.join(fixtureRoot, 'workload.json');
+        fs.writeFileSync(specPath, JSON.stringify({
+            schemaVersion: 1,
+            steps: script.requiredWorkloadSteps.map((name) => ({
+                name,
+                adbArgs: ['shell', 'echo', name],
+            })),
+        }), 'utf8');
+        const parsed = script.parseWorkloadSpec(specPath);
+        expect(parsed.schemaVersion).toBe(1);
+        expect(parsed.requiredSteps).toEqual(['saf-import', 'graph-build', 'exact-query', 'path', 'continuity']);
+        expect(parsed.steps.map((step) => step.name)).toEqual(parsed.requiredSteps);
+    });
+    test('fails closed when a required workload phase is absent or reordered', () => {
+        const missingPath = path.join(fixtureRoot, 'missing.json');
+        fs.writeFileSync(missingPath, JSON.stringify({
+            schemaVersion: 1,
+            steps: script.requiredWorkloadSteps.slice(0, 4).map((name) => ({
+                name,
+                adbArgs: ['shell', 'echo', name],
+            })),
+        }), 'utf8');
+        expect(() => script.parseWorkloadSpec(missingPath)).toThrow(/missing required steps.*continuity/i);
+        const reorderedPath = path.join(fixtureRoot, 'reordered.json');
+        fs.writeFileSync(reorderedPath, JSON.stringify({
+            schemaVersion: 1,
+            steps: [...script.requiredWorkloadSteps].reverse().map((name) => ({
+                name,
+                adbArgs: ['shell', 'echo', name],
+            })),
+        }), 'utf8');
+        expect(() => script.parseWorkloadSpec(reorderedPath)).toThrow(/must be ordered/i);
+        const extraPath = path.join(fixtureRoot, 'extra.json');
+        fs.writeFileSync(extraPath, JSON.stringify({
+            schemaVersion: 1,
+            steps: [
+                ...script.requiredWorkloadSteps.map((name) => ({ name, adbArgs: ['shell', 'echo', name] })),
+                { name: 'unrecorded-helper', adbArgs: ['shell', 'echo', 'ignored'] },
+            ],
+        }), 'utf8');
+        expect(() => script.parseWorkloadSpec(extraPath)).toThrow(/unsupported steps/i);
+    });
+    test('keeps device identity private and parses proc pid output deterministically', () => {
+        expect(script.maskSerial('R58M123456789')).toBe('R5***89');
+        expect(script.maskSerial('1234')).toBe('1234');
+        expect(script.parsePid('12345\n')).toBe(12345);
+        expect(script.parsePid('')).toBe(0);
+    });
+    test('requires measurable arm64 hardware budget inputs', () => {
+        expect(script.parseAbiList('arm64-v8a, armeabi-v7a\n')).toEqual(['arm64-v8a', 'armeabi-v7a']);
+        expect(script.parseAbiList('')).toEqual([]);
+        expect(script.parseTotalRamBytes('MemTotal:       2097152 kB\n')).toBe(2097152 * 1024);
+        expect(script.parseTotalRamBytes('MemTotal:       2097152 kB\r\n')).toBe(2097152 * 1024);
+        expect(script.parseTotalRamBytes('')).toBe(0);
+    });
+    test('exposes signed artifact and RSS release gates in the package contract', () => {
+        const packageJson = JSON.parse(fs.readFileSync(path.join(repoRoot, 'package.json'), 'utf8'));
+        expect(packageJson.scripts?.['verify:mobile:artifact:release']).toContain('--require-signed');
+        expect(packageJson.scripts?.['verify:mobile:artifact:release']).toContain('--require-arm64-only');
+        expect(packageJson.scripts?.['capture:tauri:android:evidence']).toContain('capture-tauri-android-rss-evidence.js');
+    });
+    test('release workflow refuses unsigned Android uploads and verifies arm64 artifacts', () => {
+        const workflow = fs.readFileSync(releaseWorkflowPath, 'utf8');
+        expect(workflow).toContain('Materialize Android release signing key');
+        expect(workflow).toContain('Build Android arm64 APK');
+        expect(workflow).toContain('NOTE_CONNECTION_TAURI_ANDROID_TARGET=aarch64');
+        expect(workflow).not.toContain('NOTE_CONNECTION_TAURI_ANDROID_TARGET=universal npm run tauri:android:build');
+        expect(workflow).toContain('NOTE_CONNECTION_ANDROID_KEYSTORE_BASE64');
+        expect(workflow).toContain('NOTE_CONNECTION_ANDROID_REQUIRE_SIGNING: "1"');
+        expect(workflow).toContain('--require-arm64');
+        expect(workflow).toContain('--require-arm64-only');
+        expect(workflow).toContain('--require-signed');
+        expect(workflow).toContain('verify-android-device-evidence');
+        expect(workflow).toContain('self-hosted, android-arm64');
+        expect(workflow).toContain('--require-rss');
+        expect(workflow).toContain('publish-android-release-assets');
+        expect(workflow).toContain('name: release-${{ needs.ensure-release.outputs.tag_name }}-android-evidence');
+        expect(workflow).not.toContain('name: release-${{ github.event.inputs.tag }}-android-evidence');
+        expect(workflow).toContain('noteconnection-arm64-release.apk');
+        expect(workflow).toContain('noteconnection-arm64-release.aab');
+        expect(workflow).toContain("! -name '*unsigned*'");
+        expect(workflow).toContain('build/release/mobile/*');
+        expect(workflow).not.toContain('src-tauri/gen/android/app/build/outputs/apk/**/*.apk');
+        const androidBuildJob = workflow.split('  build-and-upload-android:')[1]
+            .split('  verify-android-device-evidence:')[0];
+        expect(androidBuildJob).not.toContain('softprops/action-gh-release@v2');
+    });
+    test('RSS harness keeps the release ABI contract strict', () => {
+        const evidenceScript = fs.readFileSync(scriptPath, 'utf8');
+        const verifierCalls = evidenceScript.match(/verifyMobileArtifact\(\{[\s\S]*?\}\);/g) || [];
+        expect(verifierCalls.length).toBeGreaterThanOrEqual(2);
+        verifierCalls.forEach((call) => {
+            expect(call).toContain('requireArm64Only: true');
+        });
+    });
+});

package/dist/src/mobile.android.signing.contract.test.js

@@ -0,0 +1,66 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const path = __importStar(require("path"));
+const fs = __importStar(require("fs"));
+describe('Tauri Android signing configuration contract', () => {
+    const repoRoot = path.resolve(__dirname, '..');
+    const signingScriptPath = path.join(repoRoot, 'scripts', 'configure-tauri-android-signing.js');
+    const runnerScriptPath = path.join(repoRoot, 'scripts', 'run-tauri-android.js');
+    const signing = require(signingScriptPath);
+    test('keeps signing opt-in and injects the config inside the Android DSL', () => {
+        const source = `plugins { id("com.android.application") }\n\nandroid {\n    defaultConfig {\n        applicationId = "com.example"\n    }\n    buildTypes {\n        getByName("release") {\n            isMinifyEnabled = true\n        }\n    }\n}`;
+        const configured = signing.addSigningConfig(source);
+        expect(configured.indexOf('// NOTE_CONNECTION_ANDROID_SIGNING_START')).toBeGreaterThan(configured.indexOf('android {'));
+        expect(configured).toContain('signingConfigs.create("noteConnectionRelease")');
+        expect(configured).toContain('signingConfig = noteConnectionReleaseSigningConfig');
+        expect(configured).toContain('NOTE_CONNECTION_ANDROID_KEYSTORE_PASSWORD');
+        expect(configured).toContain('applicationId = "com.example"');
+    });
+    test('removes a stale generated signing block without touching unrelated Gradle code', () => {
+        const source = `android {\n${signing.renderSigningBlock()}\n    defaultConfig {\n        applicationId = "com.example"\n    }\n}`;
+        const cleaned = signing.removeExistingBlock(source);
+        expect(cleaned).not.toContain('NOTE_CONNECTION_ANDROID_SIGNING_START');
+        expect(cleaned).toContain('applicationId = "com.example"');
+    });
+    test('does not embed secret values and runner invokes the signer around generated builds', () => {
+        const runner = fs.readFileSync(runnerScriptPath, 'utf8');
+        const block = signing.renderSigningBlock();
+        expect(block).toContain('System.getenv');
+        expect(block).not.toContain('password123');
+        expect(runner).toContain('configure-tauri-android-signing.js');
+        expect(runner).toContain('Failed to synchronize Android release signing configuration');
+    });
+});

package/dist/src/mobile.artifact.contract.test.js

@@ -0,0 +1,144 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+function createStoredZip(entries) {
+    const localParts = [];
+    const centralParts = [];
+    let localOffset = 0;
+    for (const entry of entries) {
+        const name = Buffer.from(entry.name, 'utf8');
+        const local = Buffer.alloc(30 + name.length + entry.content.length);
+        local.writeUInt32LE(0x04034b50, 0);
+        local.writeUInt16LE(20, 4);
+        local.writeUInt16LE(0, 6);
+        local.writeUInt16LE(0, 8);
+        local.writeUInt16LE(0, 10);
+        local.writeUInt16LE(0, 12);
+        local.writeUInt32LE(0, 14);
+        local.writeUInt32LE(entry.content.length, 18);
+        local.writeUInt32LE(entry.content.length, 22);
+        local.writeUInt16LE(name.length, 26);
+        local.writeUInt16LE(0, 28);
+        name.copy(local, 30);
+        entry.content.copy(local, 30 + name.length);
+        localParts.push(local);
+        const central = Buffer.alloc(46 + name.length);
+        central.writeUInt32LE(0x02014b50, 0);
+        central.writeUInt16LE(20, 4);
+        central.writeUInt16LE(20, 6);
+        central.writeUInt16LE(0, 8);
+        central.writeUInt16LE(0, 10);
+        central.writeUInt16LE(0, 12);
+        central.writeUInt16LE(0, 14);
+        central.writeUInt32LE(0, 16);
+        central.writeUInt32LE(entry.content.length, 20);
+        central.writeUInt32LE(entry.content.length, 24);
+        central.writeUInt16LE(name.length, 28);
+        central.writeUInt16LE(0, 30);
+        central.writeUInt16LE(0, 32);
+        central.writeUInt16LE(0, 34);
+        central.writeUInt16LE(0, 36);
+        central.writeUInt32LE(0, 38);
+        central.writeUInt32LE(localOffset, 42);
+        name.copy(central, 46);
+        centralParts.push(central);
+        localOffset += local.length;
+    }
+    const localData = Buffer.concat(localParts);
+    const centralData = Buffer.concat(centralParts);
+    const eocd = Buffer.alloc(22);
+    eocd.writeUInt32LE(0x06054b50, 0);
+    eocd.writeUInt16LE(0, 8);
+    eocd.writeUInt16LE(entries.length, 10);
+    eocd.writeUInt32LE(centralData.length, 12);
+    eocd.writeUInt32LE(localData.length, 16);
+    return Buffer.concat([localData, centralData, eocd]);
+}
+describe('mobile APK/AAB artifact verifier contract', () => {
+    const repoRoot = path.resolve(__dirname, '..');
+    const verifier = require(path.join(repoRoot, 'scripts', 'verify-mobile-artifact.js'));
+    let fixtureRoot;
+    beforeEach(() => {
+        fixtureRoot = fs.mkdtempSync(path.join(repoRoot, '.tmp-mobile-artifact-'));
+    });
+    afterEach(() => {
+        fs.rmSync(fixtureRoot, { recursive: true, force: true });
+    });
+    test('checks APK entries and requires RSS in release mode', () => {
+        const artifactPath = path.join(fixtureRoot, 'app-arm64-v8a.apk');
+        const rssPath = path.join(fixtureRoot, 'rss.json');
+        fs.writeFileSync(artifactPath, createStoredZip([
+            { name: 'assets/index.html', content: Buffer.from('<html />') },
+            { name: 'lib/arm64-v8a/libnoteconnection.so', content: Buffer.from('runtime') },
+        ]));
+        fs.writeFileSync(rssPath, JSON.stringify({ peakResidentBytes: 128 * 1024 * 1024 }));
+        const result = verifier.verifyMobileArtifact({
+            artifactPath,
+            profile: 'mobile-low',
+            rssEvidencePath: rssPath,
+            requireRss: true,
+            requireArm64Only: true,
+        });
+        expect(result.artifactKind).toBe('apk');
+        expect(result.rssStatus).toBe('within-budget');
+        expect(result.hasArm64Payload).toBe(true);
+        expect(result.nativeAbis).toEqual(['arm64-v8a']);
+        expect(result.compressedPayloadBytes).toBeGreaterThan(0);
+    });
+    test('rejects forbidden runtime entries and missing release RSS evidence', () => {
+        const artifactPath = path.join(fixtureRoot, 'app.aab');
+        fs.writeFileSync(artifactPath, createStoredZip([
+            { name: 'assets/models/tiny.gguf', content: Buffer.from('model') },
+        ]));
+        expect(() => verifier.verifyMobileArtifact({ artifactPath, profile: 'mobile-standard' }))
+            .toThrow(/Forbidden mobile artifact entries/);
+        const cleanArtifactPath = path.join(fixtureRoot, 'clean.aab');
+        fs.writeFileSync(cleanArtifactPath, createStoredZip([
+            { name: 'assets/index.html', content: Buffer.from('<html />') },
+        ]));
+        expect(() => verifier.verifyMobileArtifact({
+            artifactPath: cleanArtifactPath,
+            profile: 'mobile-standard',
+            requireRss: true,
+        })).toThrow(/RSS evidence is required/);
+        expect(() => verifier.verifyMobileArtifact({
+            artifactPath: cleanArtifactPath,
+            profile: 'mobile-standard',
+            requireSigned: true,
+        })).toThrow(/signature/i);
+    });
+});

package/dist/src/mobile.budget.contract.test.js

@@ -0,0 +1,90 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const vm = __importStar(require("vm"));
+const MobileBudget_1 = require("./platform/MobileBudget");
+describe('versioned mobile budget contract', () => {
+    const repoRoot = path.resolve(__dirname, '..');
+    const contractPath = path.join(repoRoot, 'config', 'mobile-budget.v1.json');
+    const contractModulePath = path.join(repoRoot, 'scripts', 'mobile-budget-contract.js');
+    const slimVerifierPath = path.join(repoRoot, 'scripts', 'verify-mobile-slim-budget.js');
+    const artifactVerifierPath = path.join(repoRoot, 'scripts', 'verify-mobile-artifact.js');
+    const preparePath = path.join(repoRoot, 'scripts', 'prepare-mobile-slim.js');
+    const runtimeProjectionPath = path.join(repoRoot, 'src', 'frontend', 'mobile_budget_runtime.js');
+    test('declares matching low and standard artifact/RSS profiles plus runtime limits', () => {
+        const contract = JSON.parse(fs.readFileSync(contractPath, 'utf8'));
+        const loaded = require(contractModulePath);
+        const slimVerifier = require(slimVerifierPath);
+        const artifactVerifier = require(artifactVerifierPath);
+        expect(loaded.MOBILE_BUDGET_CONTRACT.schemaVersion).toBe(contract.schemaVersion);
+        expect(loaded.MOBILE_BUDGET_CONTRACT.profiles).toEqual(contract.profiles);
+        expect(loaded.MOBILE_BUDGET_CONTRACT.runtime).toEqual(contract.runtime);
+        expect(loaded.MOBILE_BUDGET_CONTRACT.contractSha256).toMatch(/^[a-f0-9]{64}$/);
+        expect(slimVerifier.DEFAULT_ASSET_BUDGET_BYTES).toBe(contract.profiles['mobile-low'].artifactCompressedBytes);
+        expect(slimVerifier.DEFAULT_MAX_RESIDENT_BYTES).toBe(contract.profiles['mobile-low'].maxResidentBytes);
+        expect(artifactVerifier.PROFILES['mobile-low'].compressedBudgetBytes).toBe(contract.profiles['mobile-low'].artifactCompressedBytes);
+        expect(artifactVerifier.PROFILES['mobile-standard'].maxResidentBytes).toBe(contract.profiles['mobile-standard'].maxResidentBytes);
+        expect(artifactVerifier.PROFILES['mobile-low'].maxDeviceRamBytes).toBe(contract.profiles['mobile-low'].maxDeviceRamBytes);
+    });
+    test('persists runtime budgets into the slim manifest and keeps the contract outside the runtime bundle', () => {
+        const prepareSource = fs.readFileSync(preparePath, 'utf8');
+        expect(prepareSource).toContain("require('./mobile-budget-contract')");
+        expect(prepareSource).toContain('contractSchemaVersion');
+        expect(prepareSource).toContain('runtime: MOBILE_BUDGET_CONTRACT.runtime');
+        expect(fs.readFileSync(contractPath, 'utf8')).not.toContain('mobile_exact_analyzer');
+        expect(prepareSource).toContain("profile: 'mobile-low'");
+        expect(prepareSource).toContain('contractSha256');
+    });
+    test('excludes Vite verification chunks from the mobile staging input', () => {
+        const prepare = require(preparePath);
+        expect(prepare.shouldExcludeSourceAsset('assets/main-stale.js')).toBe(true);
+        expect(prepare.shouldExcludeSourceAsset('vite-assets/main-stale.js')).toBe(true);
+        expect(prepare.shouldExcludeSourceAsset('workspace_panes.js')).toBe(false);
+    });
+    test('browser budget projection stays aligned with the versioned contract', () => {
+        const contract = JSON.parse(fs.readFileSync(contractPath, 'utf8'));
+        const context = {};
+        vm.runInNewContext(fs.readFileSync(runtimeProjectionPath, 'utf8'), context);
+        const runtime = context.NoteConnectionMobileBudget;
+        expect(runtime?.schemaVersion).toBe(contract.schemaVersion);
+        expect(runtime?.profiles).toEqual(contract.profiles);
+        expect(runtime?.runtime).toEqual(contract.runtime);
+        expect(MobileBudget_1.MOBILE_LOW_ARTIFACT_BUDGET_BYTES).toBe(contract.profiles['mobile-low'].artifactCompressedBytes);
+        expect(MobileBudget_1.MOBILE_LOW_MAX_RESIDENT_BYTES).toBe(contract.profiles['mobile-low'].maxResidentBytes);
+        expect(MobileBudget_1.MOBILE_LOW_MAX_DEVICE_RAM_BYTES).toBe(contract.profiles['mobile-low'].maxDeviceRamBytes);
+    });
+});

package/dist/src/mobile.canonical-id.readiness.test.js

@@ -0,0 +1,54 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+describe('canonical ID migration readiness boundary', () => {
+    const scriptPath = path.resolve(process.cwd(), 'scripts', 'verify-canonical-id-readiness.js');
+    const manifestPath = path.resolve(process.cwd(), 'config', 'identity-corpus.v1.json');
+    test('keeps readiness read-only and public-ID cutover blocked', () => {
+        const source = fs.readFileSync(scriptPath, 'utf8');
+        expect(source).toContain("canonicalPublicIdCutover: 'blocked'");
+        expect(source).toContain('independentReviewRequired: true');
+        expect(source).toContain("nativeDeviceEvidence === true");
+        expect(source).toContain("process.argv.includes('--strict')");
+        expect(source).not.toContain('migratePublicIds(');
+        expect(source).not.toContain('switchPublicIds(');
+    });
+    test('manifest keeps all compatibility changes false before review', () => {
+        const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+        expect(Object.values(manifest.compatibility)).toEqual([false, false, false, false]);
+    });
+});