fix(mold): open secure pairing links across mobile apps

README.md

@@ -167,3 +167,13 @@ yarn lint:fix
 - [Remark](https://github.com/remarkjs/remark) - Markdown processor
 - [ESLint](https://eslint.org/) - JavaScript linter
 - [Prettier](https://prettier.io/) - Code formatter
+
+## Mold app links
+
+`public/.well-known/apple-app-site-association` authorizes the native Companion
+and Tauri iOS bundle IDs for `/mold/pair`. `assetlinks.json` authorizes Android
+package `com.utensils.mold` using the release signing certificate (SHA-256
+extracted from the published Mold v0.34.0 APK signing block and checked with
+OpenSSL). Update the association when the release signing key rotates; do not
+include development certificates. Pairing secrets remain in URL fragments.
+The deployment artifact must include hidden files to publish these records.

public/.well-known/apple-app-site-association

@@ -2,11 +2,14 @@
   "applinks": {
     "details": [
       {
-        "appIDs": ["28X9H69QGE.io.utensils.mold.companion"],
+        "appIDs": [
+          "28X9H69QGE.io.utensils.mold.companion",
+          "28X9H69QGE.com.utensils.mold"
+        ],
         "components": [
           {
             "/": "/mold/pair",
-            "comment": "Mold Studio Companion pairing codes; the code rides in the fragment"
+            "comment": "Mold native and Tauri secure pairing; private invitation stays in the fragment"
           },
           {
             "/": "/mold/pair/",

public/.well-known/assetlinks.json

@@ -0,0 +1,14 @@
+[
+  {
+    "relation": [
+      "delegate_permission/common.handle_all_urls"
+    ],
+    "target": {
+      "namespace": "android_app",
+      "package_name": "com.utensils.mold",
+      "sha256_cert_fingerprints": [
+        "B9:50:01:B1:70:A0:1E:12:01:3A:DD:E9:65:E8:3D:A5:1C:1F:54:D3:71:A2:32:B9:DA:49:44:50:E1:CA:BE:2E"
+      ]
+    }
+  }
+]