feat(web): add account workspaces and signed content flows

web/src/core-bridge/worker/resourceMetadata.test.ts

@@ -0,0 +1,29 @@
+import { describe, expect, it } from 'vitest';
+import { isOfflineFailure } from './resourceMetadata';
+import { toPublishedFile } from './fileCatalog';
+import { exportResource } from './accountVault';
+import type { FileItem } from '../types';
+import type { SavedResource } from '../database';
+
+describe('resource and rendering boundaries', () => {
+  it('does not treat authorization, tampering or contract errors as offline cache hits', () => {
+    expect(isOfflineFailure(new Error('网络连接失败'))).toBe(true);
+    expect(isOfflineFailure(Object.assign(new Error('forbidden'), { status: 403 }))).toBe(false);
+    expect(isOfflineFailure(new Error('api_contract_mismatch'))).toBe(false);
+    expect(isOfflineFailure(new Error('bad_meta'))).toBe(false);
+  });
+  it('publishes only resource metadata, excluding UI state and download counters', () => {
+    const item: FileItem = { id: 'a', threadId: 'channel', kind: 'file', name: 'secret.txt', mime: 'text/plain', size: 10, ts: 1, deviceId: 'device',
+      gated: true, remaining: 5, preview: 'text', state: { kind: 'receiving', progress: 0.2 }, unseen: true, versions: [] };
+    const wire = toPublishedFile(item);
+    expect(wire.name).toBe('secret.txt');
+    for (const field of ['state', 'preview', 'remaining', 'versions', 'unseen']) expect(wire).not.toHaveProperty(field);
+  });
+  it('never synchronizes draft content or server structure snapshots inside the key vault', () => {
+    const resource: SavedResource = { id: 'a', kind: 'share', mode: 'enc', role: 'owner', link: 'key', createdAt: 1, expiresAt: 2,
+      endpointSecret: new Uint8Array(32), seats: 0, draftItems: [], manifestEntries: [],
+      workspaceMetadata: { structure: { revision: 1, channels: [], groups: [], folders: [], locations: [] }, people: [] } };
+    const exported = exportResource(resource);
+    for (const field of ['draftItems', 'manifestEntries', 'workspaceMetadata', 'endpointSecret']) expect(exported).not.toHaveProperty(field);
+  });
+});