Rust-core port follow-ups

package.json

@@ -41,6 +41,8 @@
     "@parity/truapi": "0.5.1",
     "fast-uri": "3.1.4",
     "smoldot": "3.3.1",
-    "esbuild": "^0.28.1"
+    "esbuild": "^0.28.1",
+    "brace-expansion": "^5.0.8",
+    "postcss": "^8.5.24"
   }
 }

packages/protocol/src/auth-storage.ts

@@ -76,7 +76,13 @@ export function buildSharedAuthStorageKey(siteId: SiteId, key: string): string {
 }
 
 /** Storage key used by the removed Nova host runtime. Its session encoding is
- * incompatible with TrUAPI, so the protocol host deletes this key at boot. */
+ * incompatible with TrUAPI, so the protocol host deletes this key at boot.
+ *
+ * TODO(remove-legacy-nova): unlike the product-facing shim sites sharing this
+ * tag, this cleanup is gated on returning browsers, not on product migration:
+ * delete it (with `LEGACY_SHARED_AUTH_SESSION_KEY` above and
+ * `clearLegacySharedAuthSession` in `apps/protocol/src/main.ts`) once stale
+ * `PAPP_*` keys in long-lived browser profiles are no longer a concern. */
 export function buildLegacySharedAuthSessionStorageKey(siteId: SiteId): string {
   return `PAPP_${siteId}_${LEGACY_SHARED_AUTH_SESSION_KEY}`;
 }