feat(hololake): prepare signed 1.2.0 update artifacts

product-source/hololake-clean-desktop/scripts/build-update-manifest.test.mjs

@@ -0,0 +1,37 @@
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import test from 'node:test'
+import { buildManifest } from './build-update-manifest.mjs'
+
+function fixture() {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'hololake-update-manifest-'))
+  const artifact = path.join(root, 'HoloLake.app.tar.gz')
+  const signatureFile = `${artifact}.sig`
+  fs.writeFileSync(artifact, 'signed-update-bytes')
+  fs.writeFileSync(signatureFile, 'trusted-signature-material-that-is-long-enough')
+  return { artifact, signatureFile }
+}
+
+test('builds an HTTPS arm64 manifest with immutable evidence', () => {
+  const files = fixture()
+  const manifest = buildManifest({
+    version: '1.2.0', ...files,
+    baseUrl: 'https://guanghulab.com/hololake/releases/1.2.0/',
+    notes: 'Current direct-language baseline',
+    publishedAt: '2026-09-03T00:00:00Z',
+  })
+  assert.equal(manifest.version, '1.2.0')
+  assert.equal(manifest.platforms['darwin-aarch64'].bytes, 19)
+  assert.match(manifest.platforms['darwin-aarch64'].url, /^https:\/\/guanghulab\.com\//)
+  assert.equal(manifest.platforms['darwin-aarch64'].sha256.length, 64)
+})
+
+test('rejects HTTP, missing signatures and malformed versions', () => {
+  const files = fixture()
+  assert.throws(() => buildManifest({ version: '1.2', ...files, baseUrl: 'https://guanghulab.com/' }), /VERSION_INVALID/)
+  assert.throws(() => buildManifest({ version: '1.2.0', ...files, baseUrl: 'http://guanghulab.com/' }), /HTTPS_BASE_URL_REQUIRED/)
+  fs.writeFileSync(files.signatureFile, 'short')
+  assert.throws(() => buildManifest({ version: '1.2.0', ...files, baseUrl: 'https://guanghulab.com/' }), /SIGNATURE_INVALID/)
+})