From 235b68e55cea6c66d5c502a27e8e1af3de7f231b Mon Sep 17 00:00:00 2001
From: James Brink <brink.james@gmail.com>
Date: Sun, 11 Oct 2026 12:46:12 -0700
Subject: [PATCH] fix(mold): associate secure pairing links with all mobile
 apps

---
 README.md                                     | 10 ++++++++++
 public/.well-known/apple-app-site-association |  7 +++++--
 public/.well-known/assetlinks.json            | 14 ++++++++++++++
 3 files changed, 29 insertions(+), 2 deletions(-)
 create mode 100644 public/.well-known/assetlinks.json

diff --git a/README.md b/README.md
index 2adeb59..2edaa1d 100644
--- a/README.md
+++ b/README.md
@@ -167,3 +167,13 @@ yarn lint:fix
 - [Remark](https://github.com/remarkjs/remark) - Markdown processor
 - [ESLint](https://eslint.org/) - JavaScript linter
 - [Prettier](https://prettier.io/) - Code formatter
+
+## Mold app links
+
+`public/.well-known/apple-app-site-association` authorizes the native Companion
+and Tauri iOS bundle IDs for `/mold/pair`. `assetlinks.json` authorizes Android
+package `com.utensils.mold` using the release signing certificate (SHA-256
+extracted from the published Mold v0.34.0 APK signing block and checked with
+OpenSSL). Update the association when the release signing key rotates; do not
+include development certificates. Pairing secrets remain in URL fragments.
+The deployment artifact must include hidden files to publish these records.
diff --git a/public/.well-known/apple-app-site-association b/public/.well-known/apple-app-site-association
index d979261..1c62144 100644
--- a/public/.well-known/apple-app-site-association
+++ b/public/.well-known/apple-app-site-association
@@ -2,11 +2,14 @@
   "applinks": {
     "details": [
       {
-        "appIDs": ["28X9H69QGE.io.utensils.mold.companion"],
+        "appIDs": [
+          "28X9H69QGE.io.utensils.mold.companion",
+          "28X9H69QGE.com.utensils.mold"
+        ],
         "components": [
           {
             "/": "/mold/pair",
-            "comment": "Mold Studio Companion pairing codes; the code rides in the fragment"
+            "comment": "Mold native and Tauri secure pairing; private invitation stays in the fragment"
           },
           {
             "/": "/mold/pair/",
diff --git a/public/.well-known/assetlinks.json b/public/.well-known/assetlinks.json
new file mode 100644
index 0000000..ddf6667
--- /dev/null
+++ b/public/.well-known/assetlinks.json
@@ -0,0 +1,14 @@
+[
+  {
+    "relation": [
+      "delegate_permission/common.handle_all_urls"
+    ],
+    "target": {
+      "namespace": "android_app",
+      "package_name": "com.utensils.mold",
+      "sha256_cert_fingerprints": [
+        "B9:50:01:B1:70:A0:1E:12:01:3A:DD:E9:65:E8:3D:A5:1C:1F:54:D3:71:A2:32:B9:DA:49:44:50:E1:CA:BE:2E"
+      ]
+    }
+  }
+]