@absolutejs/absolute 0.20.0-beta.105 → 0.20.0-beta.107

package/dist/cli/{mobile-fbtq3s5x.js → mobile-7v8hfmdq.js}

@@ -29,8 +29,9 @@ import {
   inspectAbsoluteRemoteMacWorkspace,
   listAbsoluteRemoteMacProfiles,
   pairAbsoluteRemoteMac,
-  removeAbsoluteRemoteMacProfile
-} from "./index-7fxrgx5q.js";
+  removeAbsoluteRemoteMacProfile,
+  runAbsoluteRemoteIosReleaseAcceptance
+} from "./index-jf1f6npt.js";
 import {
   ABSOLUTE_IOS_SIMULATOR_NAME,
   parseIosSimulators,
@@ -4414,9 +4415,9 @@ var require_sha256 = __commonJS(function(exports, module) {
   var forge = require_forge();
   require_md();
   require_util();
-  var sha2564 = module.exports = forge.sha256 = forge.sha256 || {};
-  forge.md.sha256 = forge.md.algorithms.sha256 = sha2564;
-  sha2564.create = function() {
+  var sha2565 = module.exports = forge.sha256 = forge.sha256 || {};
+  forge.md.sha256 = forge.md.algorithms.sha256 = sha2565;
+  sha2565.create = function() {
     if (!_initialized) {
       _init();
     }
@@ -16778,15 +16779,15 @@ var require_main = __commonJS(function(exports) {
 
 // src/cli/scripts/mobile.ts
 import {
-  access as access14,
-  mkdir as mkdir15,
-  mkdtemp as mkdtemp5,
-  readFile as readFile19,
-  rm as rm8,
-  writeFile as writeFile16
+  access as access15,
+  mkdir as mkdir16,
+  mkdtemp as mkdtemp6,
+  readFile as readFile20,
+  rm as rm9,
+  writeFile as writeFile17
 } from "fs/promises";
 import { createPublicKey as createPublicKey2 } from "crypto";
-import { join as join16, relative as relative13, resolve as resolve14 } from "path";
+import { join as join17, relative as relative14, resolve as resolve15 } from "path";
 import { createInterface } from "readline/promises";
 
 // src/mobile/nativeDeepLinks.ts
@@ -21241,6 +21242,7 @@ var defaultRun2 = async (command, options = {}) => {
   const process2 = Bun.spawn(command, {
     cwd: options.cwd,
     env: options.env,
+    signal: options.signal,
     stderr: "pipe",
     stdin: "ignore",
     stdout: "pipe"
@@ -21328,6 +21330,7 @@ var releaseMarker = (release) => {
 var waitForSimulatorMarker = async (options) => {
   const startedAt = performance.now();
   const poll = async () => {
+    options.signal?.throwIfAborted();
     if (performance.now() - startedAt >= READY_TIMEOUT_MS)
       throw new Error("The installed iOS Release app launched but its embedded content did not become ready.");
     const logs = await options.run([
@@ -21366,7 +21369,12 @@ var launchSimulator = async (options) => {
   return Math.round(performance.now() - startedAt);
 };
 var runAbsoluteIosSimulatorReleaseAcceptance = async (options) => {
-  const run = options.run ?? defaultRun2;
+  const baseRun = options.run ?? defaultRun2;
+  const run = (command, commandOptions = {}) => baseRun(command, {
+    ...commandOptions,
+    ...options.signal ? { signal: options.signal } : {}
+  });
+  options.signal?.throwIfAborted();
   const xcodebuild = options.xcodebuild ?? "/usr/bin/xcodebuild";
   const xcrun = options.xcrun ?? "/usr/bin/xcrun";
   const startedAt = performance.now();
@@ -21464,7 +21472,12 @@ var observeDeviceLaunch = async (options) => {
     "--device",
     options.device,
     options.appId
-  ], { stderr: "pipe", stdin: "ignore", stdout: "pipe" });
+  ], {
+    signal: options.signal,
+    stderr: "pipe",
+    stdin: "ignore",
+    stdout: "pipe"
+  });
   const stdoutReader = process2.stdout.getReader();
   const stderrReader = process2.stderr.getReader();
   const requireMarker = async (reader) => {
@@ -21551,7 +21564,12 @@ var inspectTestFlightInstallation = async (options) => {
 var runAbsoluteIosDeviceReleaseAcceptance = async (options) => {
   if (!options.networkUnavailableConfirmed)
     throw new TypeError("Physical iOS offline acceptance requires explicit confirmation that Airplane Mode is enabled and Wi-Fi is disabled in Settings.");
-  const run = options.run ?? defaultRun2;
+  const baseRun = options.run ?? defaultRun2;
+  const run = (command, commandOptions = {}) => baseRun(command, {
+    ...commandOptions,
+    ...options.signal ? { signal: options.signal } : {}
+  });
+  options.signal?.throwIfAborted();
   const xcrun = options.xcrun ?? "/usr/bin/xcrun";
   const startedAt = performance.now();
   await requireSuccess2(run, [
@@ -21570,7 +21588,11 @@ var runAbsoluteIosDeviceReleaseAcceptance = async (options) => {
     xcrun
   };
   const installMs = options.distribution === "registered-device" ? await installRegisteredDeviceRelease(installation) : await inspectTestFlightInstallation(installation);
-  const observe = options.observeLaunch ?? ((launch2) => observeDeviceLaunch({ ...launch2, xcrun }));
+  const observe = options.observeLaunch ?? ((launch2) => observeDeviceLaunch({
+    ...launch2,
+    ...options.signal ? { signal: options.signal } : {},
+    xcrun
+  }));
   const marker = releaseMarker(options.release);
   const launchMs = await observe({
     appId: options.release.metadata.appId,
@@ -21776,7 +21798,7 @@ var createAbsoluteNativeAutomatedChecks = (run) => {
   if (run.iosRelease) {
     const release = run.iosRelease;
     checks.push({
-      details: `Validated immutable release ${release.releaseId} (${release.artifactBytes} bytes, SHA-256 ${release.artifactSha256}); ${release.distribution} evidence is ${release.artifactExactness}, installed in ${release.installMs}ms.`,
+      details: `Validated immutable release ${release.releaseId} (${release.artifactBytes} bytes, SHA-256 ${release.artifactSha256}); ${release.distribution} evidence is ${release.artifactExactness}, executed on the ${release.remote ? "paired Remote Mac" : "local Mac"}, and installed in ${release.installMs}ms.`,
       id: "AUTO-IOS-RELEASE-01",
       result: run.status === "pass" ? "PASS" : "FAIL"
     }, {
@@ -21784,6 +21806,12 @@ var createAbsoluteNativeAutomatedChecks = (run) => {
       id: "AUTO-IOS-RELEASE-OFFLINE-01",
       result: release.networkUnavailable === "user-confirmed" ? "PASS" : "SKIPPED"
     });
+    if (release.remote)
+      checks.push({
+        details: "The installed-release lane executed through the paired Remote Mac protocol; immutable inputs and returned evidence were verified on the initiating host.",
+        id: "AUTO-IOS-REMOTE-01",
+        result: run.status === "pass" ? "PASS" : "FAIL"
+      });
   }
   if (run.upgrade) {
     const { upgrade } = run;
@@ -22142,9 +22170,413 @@ var createAbsoluteAndroidTestReport = (options) => {
   });
 };
 
+// src/mobile/releaseCertification.ts
+import { createHash as createHash5 } from "crypto";
+import {
+  access as access8,
+  mkdir as mkdir11,
+  mkdtemp as mkdtemp4,
+  readFile as readFile15,
+  rename as rename10,
+  rm as rm7,
+  writeFile as writeFile12
+} from "fs/promises";
+import { basename as basename3, isAbsolute as isAbsolute5, join as join13, relative as relative7, resolve as resolve8, sep as sep5 } from "path";
+var ABSOLUTE_MOBILE_RELEASE_CERTIFICATION_FORMAT = 1;
+var CERTIFICATION_PREFIX = "amobile_cert_";
+var SHA256 = /^[a-f0-9]{64}$/u;
+var STRENGTH_RANK = {
+  device: 1,
+  installed: 0,
+  simulator: 0,
+  store: 2
+};
+var isRequirement = (value) => value === "installed" || value === "simulator" || value === "device" || value === "store";
+var isStrength = (value) => value === "installed" || value === "simulator" || value === "device" || value === "store";
+var isArtifactExactness = (value) => value === "archive-equivalent" || value === "source-equivalent" || value === "store-delivered";
+var isDistribution = (value) => value === "apple-processed" || value === "registered-device" || value === "simulator-release";
+var isRecord6 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var inside3 = (root, candidate) => {
+  const path = relative7(resolve8(root), resolve8(candidate));
+  return path === "" || !isAbsolute5(path) && path !== ".." && !path.startsWith(`..${sep5}`);
+};
+var exists4 = async (path) => {
+  try {
+    await access8(path);
+    return true;
+  } catch {
+    return false;
+  }
+};
+var sha2563 = (bytes) => createHash5("sha256").update(bytes).digest("hex");
+var requireString3 = (value, name) => {
+  if (typeof value !== "string" || !value)
+    throw new TypeError(`Mobile certification ${name} is invalid.`);
+  return value;
+};
+var requirePositiveInteger = (value, name) => {
+  if (!Number.isSafeInteger(value) || Number(value) < 1)
+    throw new TypeError(`Mobile certification ${name} is invalid.`);
+  return Number(value);
+};
+var resolveEvidencePath = async (projectRoot, requested) => {
+  const selected = resolve8(projectRoot, requested);
+  if (!inside3(projectRoot, selected))
+    throw new TypeError("Mobile certification evidence must remain inside the project.");
+  if (basename3(selected) === "report.json")
+    return selected;
+  const report = join13(selected, "report.json");
+  if (!await exists4(report))
+    throw new TypeError(`Mobile certification evidence does not contain report.json: ${requested}`);
+  return report;
+};
+var releaseIdentity = (release) => {
+  const { metadata } = release;
+  if (!metadata.signed)
+    throw new TypeError("Mobile release certification requires a signed native release.");
+  const common = {
+    appBuild: metadata.appBuild,
+    appId: metadata.appId,
+    artifactBytes: metadata.bytes,
+    artifactSha256: metadata.sha256,
+    engine: metadata.engine,
+    platform: metadata.platform,
+    releaseId: metadata.releaseId,
+    runtime: metadata.runtime,
+    signed: true
+  };
+  if (metadata.platform === "android")
+    return {
+      ...common,
+      ...metadata.versionCode === undefined ? {} : { versionCode: metadata.versionCode }
+    };
+  return {
+    ...common,
+    ...metadata.buildNumber === undefined ? {} : { buildNumber: metadata.buildNumber },
+    marketingVersion: metadata.marketingVersion
+  };
+};
+var requireCheck = (report, id, accepted = ["PASS"]) => {
+  const checks = report.automatedChecks;
+  if (!Array.isArray(checks))
+    throw new TypeError("Mobile certification evidence has invalid automated checks.");
+  const check = checks.find((candidate) => isRecord6(candidate) && candidate.id === id);
+  if (!isRecord6(check) || !accepted.includes(String(check.result)))
+    throw new TypeError(`Mobile certification evidence does not satisfy ${id}.`);
+};
+var validateCommonReport = (report, release) => {
+  if (report.reportVersion !== 1 || report.platform !== release.platform || !isRecord6(report.metadata) || report.metadata.provider !== release.engine || !isRecord6(report.run) || report.run.status !== "pass" || report.run.appId !== release.appId)
+    throw new TypeError("Mobile certification evidence does not match the release platform, provider, application, or successful-run contract.");
+  requireCheck(report, "AUTO-DEV-01");
+  return {
+    generatedAt: requireString3(report.generatedAt, "evidence generatedAt"),
+    run: report.run
+  };
+};
+var validateReleaseFields = (value, release) => {
+  if (value.releaseId !== release.releaseId || value.artifactSha256 !== release.artifactSha256 || value.artifactBytes !== release.artifactBytes || value.engine !== release.engine || value.signed !== true)
+    throw new TypeError("Mobile certification evidence does not match the immutable release identity.");
+};
+var validateAndroidEvidence = (report, run, release, reportSha256, generatedAt) => {
+  if (!isRecord6(run.release))
+    throw new TypeError("Android certification evidence has no installed release result.");
+  validateReleaseFields(run.release, release);
+  if (run.release.embeddedOffline !== true)
+    throw new TypeError("Android certification evidence did not prove embedded offline relaunch.");
+  requireCheck(report, "AUTO-RELEASE-01");
+  requireCheck(report, "AUTO-RELEASE-OFFLINE-01");
+  return {
+    generatedAt,
+    networkUnavailable: "proven",
+    remote: false,
+    reportSha256,
+    strength: "installed"
+  };
+};
+var validateIosEvidence = (report, run, release, reportSha256, generatedAt) => {
+  if (!isRecord6(run.iosRelease))
+    throw new TypeError("iOS certification evidence has no installed release result.");
+  const ios = run.iosRelease;
+  validateReleaseFields(ios, release);
+  if (ios.embeddedLocal !== true)
+    throw new TypeError("iOS certification evidence did not prove embedded local rendering.");
+  requireCheck(report, "AUTO-IOS-RELEASE-01");
+  let strength;
+  if (ios.distribution === "simulator-release" && ios.artifactExactness === "source-equivalent" && run.targetKind === "simulator" && ios.networkUnavailable === "not-proven")
+    strength = "simulator";
+  else if (ios.distribution === "registered-device" && ios.artifactExactness === "archive-equivalent" && run.targetKind === "device" && ios.networkUnavailable === "user-confirmed")
+    strength = "device";
+  else if (ios.distribution === "apple-processed" && ios.artifactExactness === "store-delivered" && run.targetKind === "device" && ios.networkUnavailable === "user-confirmed")
+    strength = "store";
+  else
+    throw new TypeError("iOS certification evidence contains an invalid target, distribution, exactness, or offline-strength combination.");
+  if (strength === "simulator")
+    requireCheck(report, "AUTO-IOS-RELEASE-OFFLINE-01", ["SKIPPED"]);
+  else
+    requireCheck(report, "AUTO-IOS-RELEASE-OFFLINE-01");
+  return {
+    artifactExactness: ios.artifactExactness,
+    distribution: ios.distribution,
+    generatedAt,
+    networkUnavailable: ios.networkUnavailable === "user-confirmed" ? "proven" : "not-proven",
+    remote: ios.remote === true,
+    reportSha256,
+    strength
+  };
+};
+var validateEvidence = async (projectRoot, requested, release) => {
+  const path = await resolveEvidencePath(projectRoot, requested);
+  const bytes = await readFile15(path);
+  let value;
+  try {
+    value = JSON.parse(bytes.toString("utf8"));
+  } catch {
+    throw new TypeError("Mobile certification evidence report is not valid JSON.");
+  }
+  if (!isRecord6(value))
+    throw new TypeError("Mobile certification evidence report must contain an object.");
+  const { generatedAt, run } = validateCommonReport(value, release);
+  const digest = sha2563(bytes);
+  return release.platform === "android" ? validateAndroidEvidence(value, run, release, digest, generatedAt) : validateIosEvidence(value, run, release, digest, generatedAt);
+};
+var defaultRequirement = (platform) => platform === "android" ? "installed" : "simulator";
+var validateRequirement = (platform, requirement) => {
+  if (platform === "android" && requirement !== "installed")
+    throw new TypeError("Android certification currently uses its fixed installed/offline requirement; --require simulator, device, and store are iOS policies.");
+  if (platform === "ios" && requirement === "installed")
+    throw new TypeError("iOS certification requires simulator, device, or store evidence.");
+};
+var satisfiesRequirement = (strength, requirement) => {
+  if (requirement === "installed")
+    return strength === "installed";
+  if (strength === "installed")
+    return false;
+  return STRENGTH_RANK[strength] >= STRENGTH_RANK[requirement];
+};
+var validateCertifiedEvidence = (platform, evidence) => {
+  if (platform === "android") {
+    if (evidence.strength !== "installed" || evidence.networkUnavailable !== "proven" || evidence.artifactExactness !== undefined || evidence.distribution !== undefined || evidence.remote)
+      throw new TypeError("Android release certification contains invalid evidence strength.");
+    return;
+  }
+  const simulator = evidence.strength === "simulator" && evidence.artifactExactness === "source-equivalent" && evidence.distribution === "simulator-release" && evidence.networkUnavailable === "not-proven";
+  const device = evidence.strength === "device" && evidence.artifactExactness === "archive-equivalent" && evidence.distribution === "registered-device" && evidence.networkUnavailable === "proven";
+  const store = evidence.strength === "store" && evidence.artifactExactness === "store-delivered" && evidence.distribution === "apple-processed" && evidence.networkUnavailable === "proven";
+  if (!simulator && !device && !store)
+    throw new TypeError("iOS release certification contains invalid evidence strength.");
+};
+var canonicalJsonValue = (value) => {
+  if (Array.isArray(value))
+    return value.map(canonicalJsonValue);
+  if (!isRecord6(value))
+    return value;
+  const sorted = {};
+  for (const key of Object.keys(value).sort())
+    sorted[key] = canonicalJsonValue(value[key]);
+  return sorted;
+};
+var certificationBody = (certification) => JSON.stringify(canonicalJsonValue(certification));
+var createAbsoluteMobileReleaseCertification = async (options) => {
+  if (options.evidencePaths.length === 0)
+    throw new TypeError("Mobile release certification requires at least one --evidence report.");
+  const release = releaseIdentity(options.release);
+  const requirement = options.requirement ?? defaultRequirement(release.platform);
+  validateRequirement(release.platform, requirement);
+  const evidence = await Promise.all(options.evidencePaths.map((path) => validateEvidence(options.projectRoot, path, release)));
+  evidence.sort((left, right) => left.reportSha256.localeCompare(right.reportSha256));
+  const [firstEvidence] = evidence;
+  if (!firstEvidence)
+    throw new TypeError("Mobile release certification requires valid evidence.");
+  const strength = evidence.reduce((strongest, candidate) => STRENGTH_RANK[candidate.strength] > STRENGTH_RANK[strongest] ? candidate.strength : strongest, firstEvidence.strength);
+  if (!satisfiesRequirement(strength, requirement))
+    throw new TypeError(`Mobile release evidence strength ${strength} does not satisfy required ${requirement} certification.`);
+  const body = {
+    evidence,
+    format: ABSOLUTE_MOBILE_RELEASE_CERTIFICATION_FORMAT,
+    generatedAt: options.generatedAt ?? evidence.reduce((latest, candidate) => candidate.generatedAt > latest ? candidate.generatedAt : latest, firstEvidence.generatedAt),
+    release,
+    requirement,
+    status: "certified",
+    strength
+  };
+  return {
+    certificationId: `${CERTIFICATION_PREFIX}${sha2563(certificationBody(body))}`,
+    ...body
+  };
+};
+var parseCertification = (value) => {
+  if (!isRecord6(value) || value.format !== ABSOLUTE_MOBILE_RELEASE_CERTIFICATION_FORMAT || value.status !== "certified" || !isRecord6(value.release) || !Array.isArray(value.evidence))
+    throw new TypeError("Mobile release certification contract is invalid.");
+  const { release } = value;
+  const { platform } = release;
+  const { engine } = release;
+  if (platform !== "android" && platform !== "ios" || engine !== "capacitor" && engine !== "expo" || release.signed !== true)
+    throw new TypeError("Mobile release certification identity is invalid.");
+  const { requirement } = value;
+  const { strength } = value;
+  if (!isRequirement(requirement) || !isStrength(strength))
+    throw new TypeError("Mobile release certification policy is invalid.");
+  validateRequirement(platform, requirement);
+  if (!satisfiesRequirement(strength, requirement))
+    throw new TypeError("Mobile release certification does not satisfy its declared policy.");
+  const artifactBytes = requirePositiveInteger(release.artifactBytes, "release artifactBytes");
+  const artifactSha256 = requireString3(release.artifactSha256, "release artifactSha256");
+  if (!SHA256.test(artifactSha256))
+    throw new TypeError("Mobile release certification artifact digest is invalid.");
+  const parsedRelease = {
+    appBuild: requireString3(release.appBuild, "release appBuild"),
+    appId: requireString3(release.appId, "release appId"),
+    artifactBytes,
+    artifactSha256,
+    engine,
+    platform,
+    releaseId: requireString3(release.releaseId, "release releaseId"),
+    runtime: requireString3(release.runtime, "release runtime"),
+    signed: true,
+    ...release.buildNumber === undefined ? {} : {
+      buildNumber: requirePositiveInteger(release.buildNumber, "release buildNumber")
+    },
+    ...release.marketingVersion === undefined ? {} : {
+      marketingVersion: requireString3(release.marketingVersion, "release marketingVersion")
+    },
+    ...release.versionCode === undefined ? {} : {
+      versionCode: requirePositiveInteger(release.versionCode, "release versionCode")
+    }
+  };
+  const evidence = value.evidence.map((candidate) => {
+    if (!isRecord6(candidate) || !SHA256.test(String(candidate.reportSha256)) || !isStrength(candidate.strength) || candidate.networkUnavailable !== "not-proven" && candidate.networkUnavailable !== "proven" || typeof candidate.remote !== "boolean" || typeof candidate.generatedAt !== "string" || candidate.artifactExactness !== undefined && !isArtifactExactness(candidate.artifactExactness) || candidate.distribution !== undefined && !isDistribution(candidate.distribution))
+      throw new TypeError("Mobile release certification evidence is invalid.");
+    const parsedEvidence = {
+      generatedAt: candidate.generatedAt,
+      networkUnavailable: candidate.networkUnavailable,
+      remote: candidate.remote,
+      reportSha256: String(candidate.reportSha256),
+      strength: candidate.strength,
+      ...candidate.artifactExactness === undefined ? {} : {
+        artifactExactness: candidate.artifactExactness
+      },
+      ...candidate.distribution === undefined ? {} : { distribution: candidate.distribution }
+    };
+    validateCertifiedEvidence(platform, parsedEvidence);
+    return parsedEvidence;
+  });
+  const strongestEvidence = evidence.reduce((strongest, candidate) => STRENGTH_RANK[candidate.strength] > STRENGTH_RANK[strongest] ? candidate.strength : strongest, evidence[0]?.strength ?? "installed");
+  if (evidence.length === 0 || strongestEvidence !== strength)
+    throw new TypeError("Mobile release certification evidence does not support its declared strength.");
+  const parsed = {
+    certificationId: requireString3(value.certificationId, "certificationId"),
+    evidence,
+    format: ABSOLUTE_MOBILE_RELEASE_CERTIFICATION_FORMAT,
+    generatedAt: requireString3(value.generatedAt, "generatedAt"),
+    release: parsedRelease,
+    requirement,
+    status: "certified",
+    strength
+  };
+  const { certificationId, ...body } = parsed;
+  if (certificationId !== `${CERTIFICATION_PREFIX}${sha2563(certificationBody(body))}`)
+    throw new TypeError("Mobile release certification content digest is invalid.");
+  return parsed;
+};
+var readAbsoluteMobileReleaseCertification = async (projectRoot, requested) => {
+  const selected = resolve8(projectRoot, requested);
+  if (!inside3(projectRoot, selected))
+    throw new TypeError("Mobile release certification must remain inside the project.");
+  const path = basename3(selected) === "certification.json" ? selected : join13(selected, "certification.json");
+  const value = JSON.parse(await readFile15(path, "utf8"));
+  return { certification: parseCertification(value), path };
+};
+var renderAbsoluteMobileReleaseCertification = (certification) => {
+  const { release } = certification;
+  const version = release.platform === "ios" ? `${release.marketingVersion ?? "unknown"} (${release.buildNumber ?? "unallocated"})` : String(release.versionCode ?? "unallocated");
+  const evidence = certification.evidence.map((item) => `| ${item.strength} | ${item.networkUnavailable} | ${item.remote ? "paired Mac" : "local host"} | ${item.reportSha256} |`).join(`
+`);
+  return `# AbsoluteJS mobile release certification
+
+- Status: CERTIFIED
+- Certification: ${certification.certificationId}
+- Generated: ${certification.generatedAt}
+- Platform: ${release.platform}
+- Engine: ${release.engine}
+- Requirement: ${certification.requirement}
+- Evidence strength: ${certification.strength}
+- Release: ${release.releaseId}
+- Artifact SHA-256: ${release.artifactSha256}
+- Runtime fingerprint: ${release.runtime}
+- Embedded app build: ${release.appBuild}
+- Version/build: ${version}
+
+This certification is local and contains no signing credentials, device identifiers, SSH destinations, report paths, application data, or page contents. Re-run verification against the immutable release before using it as a CI or promotion gate.
+
+| Strength | Network unavailable | Execution | Report SHA-256 |
+| --- | --- | --- | --- |
+${evidence}
+`;
+};
+var verifyAbsoluteMobileReleaseCertification = (certification, release, requirement) => {
+  const parsed = parseCertification(certification);
+  const expected = releaseIdentity(release);
+  if (JSON.stringify(parsed.release) !== JSON.stringify(expected))
+    throw new TypeError("Mobile release certification was invalidated by a release identity, artifact, runtime, signing, version, build, or embedded-bundle change.");
+  if (requirement) {
+    validateRequirement(expected.platform, requirement);
+    if (!satisfiesRequirement(parsed.strength, requirement))
+      throw new TypeError(`Mobile release certification strength ${parsed.strength} does not satisfy required ${requirement} policy.`);
+  }
+  return parsed;
+};
+var writeAbsoluteMobileReleaseCertification = async (projectRoot, certification, outputDirectory) => {
+  const root = resolve8(projectRoot);
+  const parent = resolve8(root, outputDirectory ?? join13(".absolutejs", "mobile", "certifications", certification.release.platform, certification.release.releaseId));
+  if (!inside3(root, parent))
+    throw new TypeError("Mobile certification output must remain inside the project.");
+  await mkdir11(parent, { recursive: true });
+  const destination = join13(parent, certification.certificationId);
+  const paths = {
+    directory: destination,
+    jsonPath: join13(destination, "certification.json"),
+    markdownPath: join13(destination, "certification.md")
+  };
+  const json = `${JSON.stringify(certification, null, 2)}
+`;
+  const markdown = renderAbsoluteMobileReleaseCertification(certification);
+  const verifyExisting = async () => {
+    const [existingJson, existingMarkdown] = await Promise.all([
+      readFile15(paths.jsonPath, "utf8"),
+      readFile15(paths.markdownPath, "utf8")
+    ]);
+    if (existingJson !== json || existingMarkdown !== markdown)
+      throw new TypeError(`Immutable mobile certification ${certification.certificationId} already exists with different content.`);
+  };
+  if (await exists4(destination)) {
+    await verifyExisting();
+    return paths;
+  }
+  const staging = await mkdtemp4(join13(parent, ".certification-"));
+  try {
+    await Promise.all([
+      writeFile12(join13(staging, "certification.json"), json, {
+        flag: "wx"
+      }),
+      writeFile12(join13(staging, "certification.md"), markdown, {
+        flag: "wx"
+      })
+    ]);
+    await rename10(staging, destination).catch(async (error) => {
+      if (await exists4(destination))
+        return;
+      throw error;
+    });
+  } finally {
+    await rm7(staging, { force: true, recursive: true });
+  }
+  await verifyExisting();
+  return paths;
+};
+
 // src/mobile/releasePublisher.ts
-import { access as access8 } from "fs/promises";
-import { isAbsolute as isAbsolute5, relative as relative7, resolve as resolve8, sep as sep5 } from "path";
+import { access as access9 } from "fs/promises";
+import { isAbsolute as isAbsolute6, relative as relative8, resolve as resolve9, sep as sep6 } from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
 var prepareAbsoluteIosRelease = async (publisher, options) => {
   if (typeof publisher.prepareIosRelease !== "function") {
@@ -22167,24 +22599,24 @@ var prepareAbsoluteAndroidRelease = async (publisher, options) => {
   }
   return versionCode;
 };
-var isRecord6 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var isPublisher = (value) => isRecord6(value) && typeof value.publish === "function";
+var isRecord7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isPublisher = (value) => isRecord7(value) && typeof value.publish === "function";
 var publisherModulePath = (projectRoot, requested) => {
-  const root = resolve8(projectRoot);
-  const path = resolve8(root, requested);
-  const projectRelative = relative7(root, path);
-  if (projectRelative === ".." || projectRelative.startsWith(`..${sep5}`) || isAbsolute5(projectRelative)) {
+  const root = resolve9(projectRoot);
+  const path = resolve9(root, requested);
+  const projectRelative = relative8(root, path);
+  if (projectRelative === ".." || projectRelative.startsWith(`..${sep6}`) || isAbsolute6(projectRelative)) {
     throw new TypeError("mobile publish --registry must remain inside the project.");
   }
   return path;
 };
 var loadAbsoluteNativeReleasePublisher = async (projectRoot, requestedModulePath) => {
   const modulePath = publisherModulePath(projectRoot, requestedModulePath);
-  await access8(modulePath).catch(() => {
+  await access9(modulePath).catch(() => {
     throw new TypeError(`Native release registry module does not exist: ${modulePath}`);
   });
   const loaded = await import(pathToFileURL2(modulePath).href);
-  const publisher = isRecord6(loaded) ? loaded.default ?? loaded.registry : undefined;
+  const publisher = isRecord7(loaded) ? loaded.default ?? loaded.registry : undefined;
   if (!isPublisher(publisher)) {
     throw new TypeError("Native release registry module must default-export a registry with publish(options).");
   }
@@ -22242,8 +22674,8 @@ var publishAbsoluteIosRelease = async (options) => {
 };
 
 // src/mobile/mobileInspect.ts
-import { access as access9, readFile as readFile15 } from "fs/promises";
-import { join as join13, relative as relative8, resolve as resolve9 } from "path";
+import { access as access10, readFile as readFile16 } from "fs/promises";
+import { join as join14, relative as relative9, resolve as resolve10 } from "path";
 var ABSOLUTE_MOBILE_INSPECTION_FORMAT = 1;
 var MOBILE_PACKAGE_NAMES = new Set([
   "@absolutejs/absolute",
@@ -22258,19 +22690,19 @@ var MOBILE_PACKAGE_NAMES = new Set([
 ]);
 var isObject2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var portablePath2 = (projectRoot, path) => {
-  const value = relative8(resolve9(projectRoot), resolve9(path)).replaceAll("\\", "/");
+  const value = relative9(resolve10(projectRoot), resolve10(path)).replaceAll("\\", "/");
   return value || ".";
 };
 var pathExists4 = async (path) => {
   try {
-    await access9(path);
+    await access10(path);
     return true;
   } catch {
     return false;
   }
 };
 var readObject2 = async (path) => {
-  const value = JSON.parse(await readFile15(path, "utf8"));
+  const value = JSON.parse(await readFile16(path, "utf8"));
   if (!isObject2(value))
     throw new TypeError("JSON root must be an object.");
   return value;
@@ -22282,13 +22714,13 @@ var addPackageDeclarations = (declarations, value) => {
     declarations.set(name, declared);
 };
 var packageInspections = async (projectRoot, additionalNames) => {
-  const project = await readObject2(join13(projectRoot, "package.json"));
+  const project = await readObject2(join14(projectRoot, "package.json"));
   const declarations = new Map;
   for (const field2 of ["dependencies", "devDependencies"])
     addPackageDeclarations(declarations, project[field2]);
   const names = [...new Set([...declarations.keys(), ...additionalNames])].filter((name) => MOBILE_PACKAGE_NAMES.has(name) || name.startsWith("@capacitor/") || additionalNames.includes(name)).sort();
   return Promise.all(names.map(async (name) => {
-    const installedManifest = await readObject2(join13(projectRoot, "node_modules", name, "package.json")).catch(() => {
+    const installedManifest = await readObject2(join14(projectRoot, "node_modules", name, "package.json")).catch(() => {
       return;
     });
     const installed = installedManifest?.version;
@@ -22347,7 +22779,7 @@ var inspectAbsoluteMobileProject = async (config, projectRoot, options = {}) =>
     },
     format: ABSOLUTE_MOBILE_INSPECTION_FORMAT,
     nativeProjects: await Promise.all(config.platforms.map(async (platform) => {
-      const path = join13(config.nativeProjectDirectory, platform);
+      const path = join14(config.nativeProjectDirectory, platform);
       return {
         initialized: await pathExists4(path),
         path: portablePath2(projectRoot, path),
@@ -22404,8 +22836,8 @@ var renderAbsoluteMobileProjectInspection = (report) => {
 
 // src/mobile/ciWorkflow.ts
 import { existsSync } from "fs";
-import { access as access10, mkdir as mkdir11, readFile as readFile16, writeFile as writeFile12 } from "fs/promises";
-import { dirname as dirname10, extname as extname2, relative as relative9, resolve as resolve10, sep as sep6 } from "path";
+import { access as access11, mkdir as mkdir12, readFile as readFile17, writeFile as writeFile13 } from "fs/promises";
+import { dirname as dirname10, extname as extname2, relative as relative10, resolve as resolve11, sep as sep7 } from "path";
 var ABSOLUTE_MOBILE_CI_WORKFLOW_FORMAT = 1;
 var SECRET_NAME_PATTERN = /^[A-Z][A-Z0-9_]*$/u;
 var CI_ENV_INDENTATION = 6;
@@ -22424,9 +22856,9 @@ var RESERVED_SECRET_NAMES = new Set([
   "APP_STORE_CONNECT_KEY_ID",
   "APP_STORE_CONNECT_PRIVATE_KEY_BASE64"
 ]);
-var exists4 = async (path) => {
+var exists5 = async (path) => {
   try {
-    await access10(path);
+    await access11(path);
     return true;
   } catch {
     return false;
@@ -22434,10 +22866,10 @@ var exists4 = async (path) => {
 };
 var yamlString = (value) => `'${value.replaceAll("'", "''")}'`;
 var projectPath2 = (projectRoot, value, field2, options = {}) => {
-  const root = resolve10(projectRoot);
-  const path = resolve10(root, value);
-  const portable = relative9(root, path).replaceAll("\\", "/");
-  if (portable === ".." || portable.startsWith(`..${sep6}`) || portable.startsWith("../") || portable === "") {
+  const root = resolve11(projectRoot);
+  const path = resolve11(root, value);
+  const portable = relative10(root, path).replaceAll("\\", "/");
+  if (portable === ".." || portable.startsWith(`..${sep7}`) || portable.startsWith("../") || portable === "") {
     throw new TypeError(`${field2} must remain inside the project root.`);
   }
   if (/\r|\n/u.test(portable) || portable.startsWith("-"))
@@ -22447,11 +22879,11 @@ var projectPath2 = (projectRoot, value, field2, options = {}) => {
   return portable;
 };
 var workflowOutputPath = (projectRoot, value) => {
-  const root = resolve10(projectRoot);
-  const workflows = resolve10(root, ".github/workflows");
-  const path = resolve10(root, value ?? ".github/workflows/absolute-mobile.yml");
-  const portable = relative9(workflows, path);
-  if (portable === ".." || portable.startsWith(`..${sep6}`) || extname2(path) !== ".yml" && extname2(path) !== ".yaml") {
+  const root = resolve11(projectRoot);
+  const workflows = resolve11(root, ".github/workflows");
+  const path = resolve11(root, value ?? ".github/workflows/absolute-mobile.yml");
+  const portable = relative10(workflows, path);
+  if (portable === ".." || portable.startsWith(`..${sep7}`) || extname2(path) !== ".yml" && extname2(path) !== ".yaml") {
     throw new TypeError("mobile ci github --output must be a .yml or .yaml file inside .github/workflows.");
   }
   return path;
@@ -22880,12 +23312,12 @@ ${bundleAuditSteps}${platforms.includes("android") ? androidJob({ customSecrets,
 var writeAbsoluteMobileGithubWorkflow = async (options) => {
   const path = workflowOutputPath(options.projectRoot, options.outputPath);
   const generated = createAbsoluteMobileGithubWorkflow(options);
-  const previous = await exists4(path) ? await readFile16(path, "utf8") : undefined;
+  const previous = await exists5(path) ? await readFile17(path, "utf8") : undefined;
   if (previous !== undefined && previous !== generated.workflow && !options.force)
-    throw new TypeError(`${relative9(options.projectRoot, path)} already exists and differs. Rerun with --force to replace the generated workflow.`);
+    throw new TypeError(`${relative10(options.projectRoot, path)} already exists and differs. Rerun with --force to replace the generated workflow.`);
   if (previous !== generated.workflow) {
-    await mkdir11(dirname10(path), { recursive: true });
-    await writeFile12(path, generated.workflow);
+    await mkdir12(dirname10(path), { recursive: true });
+    await writeFile13(path, generated.workflow);
   }
   return {
     changed: previous !== generated.workflow,
@@ -22898,46 +23330,46 @@ var writeAbsoluteMobileGithubWorkflow = async (options) => {
 };
 
 // src/mobile/updateSigning.ts
-import { createHash as createHash5, sign, verify } from "crypto";
+import { createHash as createHash6, sign, verify } from "crypto";
 import {
   cp,
-  mkdir as mkdir12,
-  mkdtemp as mkdtemp4,
+  mkdir as mkdir13,
+  mkdtemp as mkdtemp5,
   readdir as readdir6,
-  readFile as readFile17,
-  rename as rename10,
-  rm as rm7,
+  readFile as readFile18,
+  rename as rename11,
+  rm as rm8,
   stat as stat6,
-  writeFile as writeFile13
+  writeFile as writeFile14
 } from "fs/promises";
-import { dirname as dirname11, join as join14, relative as relative10, resolve as resolve11 } from "path";
+import { dirname as dirname11, join as join15, relative as relative11, resolve as resolve12 } from "path";
 var UPDATE_MANIFEST_FILE = "update.json";
 var UPDATE_FILES_DIRECTORY = "files";
-var sha2563 = (value) => createHash5("sha256").update(value).digest("hex");
+var sha2564 = (value) => createHash6("sha256").update(value).digest("hex");
 var listFiles = async (root, directory = root) => {
   const entries = await readdir6(directory, { withFileTypes: true });
   const paths = await Promise.all(entries.map(async (entry) => {
-    const path = join14(directory, entry.name);
+    const path = join15(directory, entry.name);
     if (entry.isDirectory())
       return listFiles(root, path);
     if (!entry.isFile())
       throw new TypeError("Mobile updates cannot contain links or special files.");
-    return [relative10(root, path).replaceAll("\\", "/")];
+    return [relative11(root, path).replaceAll("\\", "/")];
   }));
   return paths.flat().sort((left, right) => left.localeCompare(right));
 };
 var inspectFiles = async (root, paths) => Promise.all(paths.map(async (path) => {
-  const source = join14(root, path);
+  const source = join15(root, path);
   const [metadata, contents] = await Promise.all([
     stat6(source),
-    readFile17(source)
+    readFile18(source)
   ]);
-  return { bytes: metadata.size, path, sha256: sha2563(contents) };
+  return { bytes: metadata.size, path, sha256: sha2564(contents) };
 }));
-var releaseIdFor = (value) => `amu_${sha2563(canonicalizeAbsoluteMobileUpdate(value))}`;
+var releaseIdFor = (value) => `amu_${sha2564(canonicalizeAbsoluteMobileUpdate(value))}`;
 var buildAbsoluteMobileUpdate = async (options) => {
-  const bundleDirectory = resolve11(options.bundleDirectory);
-  const outputRoot = resolve11(options.outputDirectory);
+  const bundleDirectory = resolve12(options.bundleDirectory);
+  const outputRoot = resolve12(options.outputDirectory);
   if (outputRoot === bundleDirectory || outputRoot.startsWith(`${bundleDirectory}/`))
     throw new TypeError("Mobile update output must be outside the embedded bundle.");
   const paths = await listFiles(bundleDirectory);
@@ -22965,30 +23397,30 @@ var buildAbsoluteMobileUpdate = async (options) => {
       value: signature.toString("base64")
     }
   });
-  await mkdir12(outputRoot, { recursive: true });
-  const outputDirectory = join14(outputRoot, manifest.releaseId);
-  const staging = await mkdtemp4(join14(outputRoot, ".stage-"));
+  await mkdir13(outputRoot, { recursive: true });
+  const outputDirectory = join15(outputRoot, manifest.releaseId);
+  const staging = await mkdtemp5(join15(outputRoot, ".stage-"));
   try {
-    await cp(bundleDirectory, join14(staging, UPDATE_FILES_DIRECTORY), {
+    await cp(bundleDirectory, join15(staging, UPDATE_FILES_DIRECTORY), {
       force: true,
       recursive: true
     });
-    await writeFile13(join14(staging, UPDATE_MANIFEST_FILE), `${JSON.stringify(manifest, null, "\t")}
+    await writeFile14(join15(staging, UPDATE_MANIFEST_FILE), `${JSON.stringify(manifest, null, "\t")}
 `);
-    await rename10(staging, outputDirectory);
+    await rename11(staging, outputDirectory);
   } catch (error) {
-    await rm7(staging, { force: true, recursive: true });
+    await rm8(staging, { force: true, recursive: true });
     if (typeof error === "object" && error !== null && Reflect.get(error, "code") === "EEXIST")
       throw new TypeError(`Mobile update ${manifest.releaseId} already exists.`, { cause: error });
     throw error;
   }
   return {
     manifest,
-    manifestPath: join14(outputDirectory, UPDATE_MANIFEST_FILE),
+    manifestPath: join15(outputDirectory, UPDATE_MANIFEST_FILE),
     outputDirectory
   };
 };
-var readAbsoluteMobileUpdate = async (directory) => parseAbsoluteMobileUpdateManifest(JSON.parse(await readFile17(join14(resolve11(directory), UPDATE_MANIFEST_FILE), "utf8")));
+var readAbsoluteMobileUpdate = async (directory) => parseAbsoluteMobileUpdateManifest(JSON.parse(await readFile18(join15(resolve12(directory), UPDATE_MANIFEST_FILE), "utf8")));
 var verifyAbsoluteMobileUpdateSignature = (manifestValue, publicKey) => {
   const manifest = parseAbsoluteMobileUpdateManifest(manifestValue);
   const valid = verify("sha256", absoluteMobileUpdateSigningPayload(unsignedAbsoluteMobileUpdate(manifest)), { dsaEncoding: "ieee-p1363", key: publicKey }, Buffer.from(manifest.signature.value, "base64"));
@@ -22998,8 +23430,8 @@ var verifyAbsoluteMobileUpdateSignature = (manifestValue, publicKey) => {
 };
 
 // src/mobile/expoUpdate.ts
-import { access as access11, mkdir as mkdir13, readFile as readFile18, writeFile as writeFile14 } from "fs/promises";
-import { dirname as dirname12, extname as extname3, join as join15 } from "path";
+import { access as access12, mkdir as mkdir14, readFile as readFile19, writeFile as writeFile15 } from "fs/promises";
+import { dirname as dirname12, extname as extname3, join as join16 } from "path";
 var ABSOLUTE_EXPO_UPDATE_DESCRIPTOR = "_absolute/expo-update.json";
 var ABSOLUTE_EXPO_UPDATE_FORMAT = 1;
 var object2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
@@ -23065,7 +23497,7 @@ var parseAbsoluteExpoUpdateDescriptor = (value) => {
   };
 };
 var finalizeAbsoluteExpoUpdateExport = async (options) => {
-  const metadata = JSON.parse(await readFile18(join15(options.exportDirectory, "metadata.json"), "utf8"));
+  const metadata = JSON.parse(await readFile19(join16(options.exportDirectory, "metadata.json"), "utf8"));
   if (!object2(metadata) || !object2(metadata.fileMetadata))
     throw new TypeError("Expo export metadata.json is invalid.");
   const descriptor = parseAbsoluteExpoUpdateDescriptor({
@@ -23076,33 +23508,33 @@ var finalizeAbsoluteExpoUpdateExport = async (options) => {
     runtimeVersion: options.runtimeVersion
   });
   const referenced = Object.values(descriptor.platforms).flatMap((entry) => entry ? [entry.launchAsset, ...entry.assets] : []);
-  await Promise.all(referenced.map(({ path }) => access11(join15(options.exportDirectory, path)).catch(() => {
+  await Promise.all(referenced.map(({ path }) => access12(join16(options.exportDirectory, path)).catch(() => {
     throw new TypeError(`Expo export metadata references missing asset ${path}.`);
   })));
-  const destination = join15(options.exportDirectory, ABSOLUTE_EXPO_UPDATE_DESCRIPTOR);
-  await mkdir13(dirname12(destination), { recursive: true });
-  await writeFile14(destination, `${JSON.stringify(descriptor, null, "\t")}
+  const destination = join16(options.exportDirectory, ABSOLUTE_EXPO_UPDATE_DESCRIPTOR);
+  await mkdir14(dirname12(destination), { recursive: true });
+  await writeFile15(destination, `${JSON.stringify(descriptor, null, "\t")}
 `);
   return { descriptor, path: destination };
 };
 
 // src/mobile/expoCodeSigning.ts
 var import_code_signing_certificates = __toESM(require_main(), 1);
-import { access as access12, mkdir as mkdir14, writeFile as writeFile15 } from "fs/promises";
-import { dirname as dirname13, isAbsolute as isAbsolute6, relative as relative11, resolve as resolve12, sep as sep7 } from "path";
-var exists5 = async (path) => access12(path).then(() => true).catch(() => false);
-var inside3 = (root, path) => {
-  const location = relative11(root, path);
-  return location === "" || location !== ".." && !location.startsWith(`..${sep7}`) && !isAbsolute6(location);
+import { access as access13, mkdir as mkdir15, writeFile as writeFile16 } from "fs/promises";
+import { dirname as dirname13, isAbsolute as isAbsolute7, relative as relative12, resolve as resolve13, sep as sep8 } from "path";
+var exists6 = async (path) => access13(path).then(() => true).catch(() => false);
+var inside4 = (root, path) => {
+  const location = relative12(root, path);
+  return location === "" || location !== ".." && !location.startsWith(`..${sep8}`) && !isAbsolute7(location);
 };
 var generateAbsoluteExpoCodeSigning = async (options) => {
-  const root = resolve12(options.projectRoot);
-  const certificatePath = resolve12(root, options.certificatePath);
-  const privateKeyPath = resolve12(root, options.privateKeyPath);
-  const publicKeyPath = resolve12(root, options.publicKeyPath ?? resolve12(dirname13(privateKeyPath), "public-key.pem"));
-  if (!inside3(root, certificatePath))
+  const root = resolve13(options.projectRoot);
+  const certificatePath = resolve13(root, options.certificatePath);
+  const privateKeyPath = resolve13(root, options.privateKeyPath);
+  const publicKeyPath = resolve13(root, options.publicKeyPath ?? resolve13(dirname13(privateKeyPath), "public-key.pem"));
+  if (!inside4(root, certificatePath))
     throw new TypeError("Expo code-signing certificate must be written inside the project so store builds can embed it.");
-  if (inside3(root, privateKeyPath) || inside3(root, publicKeyPath))
+  if (inside4(root, privateKeyPath) || inside4(root, publicKeyPath))
     throw new TypeError("Expo code-signing private/public key output must remain outside the project and source control.");
   const commonName = options.commonName.trim();
   if (!commonName || commonName.length > 64)
@@ -23111,7 +23543,7 @@ var generateAbsoluteExpoCodeSigning = async (options) => {
   if (!Number.isSafeInteger(validityYears) || validityYears < 1 || validityYears > 20)
     throw new TypeError("Expo code-signing validity must be an integer from 1 through 20 years.");
   const collisions = (await Promise.all([certificatePath, privateKeyPath, publicKeyPath].map(async (path) => ({
-    exists: await exists5(path),
+    exists: await exists6(path),
     path
   })))).filter((entry) => entry.exists);
   if (collisions.length > 0)
@@ -23129,11 +23561,11 @@ var generateAbsoluteExpoCodeSigning = async (options) => {
   import_code_signing_certificates.validateSelfSignedCertificate(certificate, keyPair);
   const { privateKeyPEM, publicKeyPEM } = import_code_signing_certificates.convertKeyPairToPEM(keyPair);
   const certificatePem = import_code_signing_certificates.convertCertificateToCertificatePEM(certificate);
-  await Promise.all([certificatePath, privateKeyPath, publicKeyPath].map((path) => mkdir14(dirname13(path), { recursive: true })));
+  await Promise.all([certificatePath, privateKeyPath, publicKeyPath].map((path) => mkdir15(dirname13(path), { recursive: true })));
   await Promise.all([
-    writeFile15(certificatePath, certificatePem, { flag: "wx", mode: 420 }),
-    writeFile15(privateKeyPath, privateKeyPEM, { flag: "wx", mode: 384 }),
-    writeFile15(publicKeyPath, publicKeyPEM, { flag: "wx", mode: 420 })
+    writeFile16(certificatePath, certificatePem, { flag: "wx", mode: 420 }),
+    writeFile16(privateKeyPath, privateKeyPEM, { flag: "wx", mode: 384 }),
+    writeFile16(publicKeyPath, publicKeyPEM, { flag: "wx", mode: 420 })
   ]);
   return {
     certificatePath,
@@ -23144,8 +23576,8 @@ var generateAbsoluteExpoCodeSigning = async (options) => {
 };
 
 // src/mobile/updatePublisher.ts
-import { access as access13 } from "fs/promises";
-import { isAbsolute as isAbsolute7, relative as relative12, resolve as resolve13, sep as sep8 } from "path";
+import { access as access14 } from "fs/promises";
+import { isAbsolute as isAbsolute8, relative as relative13, resolve as resolve14, sep as sep9 } from "path";
 import { pathToFileURL as pathToFileURL3 } from "url";
 var lifecycleMethod = (publisher, name) => {
   const method = publisher[name];
@@ -23254,16 +23686,16 @@ var pruneAbsoluteMobileUpdates = async (options) => {
 var object3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var isPublisher2 = (value) => object3(value) && typeof value.publishUpdate === "function" && typeof value.promoteUpdate === "function" && typeof value.rollbackUpdate === "function";
 var projectPath3 = (projectRoot, requested, label) => {
-  const root = resolve13(projectRoot);
-  const path = resolve13(root, requested);
-  const projectRelative = relative12(root, path);
-  if (projectRelative === ".." || projectRelative.startsWith(`..${sep8}`) || isAbsolute7(projectRelative))
+  const root = resolve14(projectRoot);
+  const path = resolve14(root, requested);
+  const projectRelative = relative13(root, path);
+  if (projectRelative === ".." || projectRelative.startsWith(`..${sep9}`) || isAbsolute8(projectRelative))
     throw new TypeError(`${label} must remain inside the project.`);
   return path;
 };
 var loadAbsoluteMobileUpdatePublisher = async (projectRoot, requestedModulePath) => {
   const modulePath = projectPath3(projectRoot, requestedModulePath, "mobile update registry");
-  await access13(modulePath).catch(() => {
+  await access14(modulePath).catch(() => {
     throw new TypeError(`Mobile update registry does not exist: ${modulePath}`);
   });
   const loaded = await import(pathToFileURL3(modulePath).href);
@@ -23318,10 +23750,10 @@ var rollbackAbsoluteMobileUpdate = async (options) => {
 var NOT_FOUND4 = -1;
 var ANDROID_EMULATOR_BOOT_POLL_MS = 500;
 var ANDROID_EMULATOR_BOOT_TIMEOUT_MS = 180000;
-var isRecord7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isRecord8 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var expoPublicConfig = (config) => {
   const result = { ...config };
-  if (!isRecord7(result.updates))
+  if (!isRecord8(result.updates))
     return result;
   const {
     codeSigningCertificate: _codeSigningCertificate,
@@ -23361,13 +23793,13 @@ var CAPACITOR_SYNC_PACKAGE_SPECS = [
 ];
 var packageNameFromSpec = (spec) => spec.slice(0, spec.lastIndexOf("@"));
 var directProjectPackages = async (projectRoot) => {
-  const manifest = JSON.parse(await readFile19(join16(projectRoot, "package.json"), "utf8"));
-  if (!isRecord7(manifest))
+  const manifest = JSON.parse(await readFile20(join17(projectRoot, "package.json"), "utf8"));
+  if (!isRecord8(manifest))
     throw new TypeError("Application package.json must contain an object.");
   const names = new Set;
   for (const field2 of ["dependencies", "devDependencies"]) {
     const dependencies = Reflect.get(manifest, field2);
-    if (isRecord7(dependencies))
+    if (isRecord8(dependencies))
       for (const name of Object.keys(dependencies))
         names.add(name);
   }
@@ -23375,8 +23807,8 @@ var directProjectPackages = async (projectRoot) => {
 };
 var resolvedPackageVersion = async (projectRoot, packageName) => {
   try {
-    const manifest = JSON.parse(await readFile19(join16(projectRoot, "node_modules", packageName, "package.json"), "utf8"));
-    return isRecord7(manifest) && typeof manifest.version === "string" ? manifest.version : undefined;
+    const manifest = JSON.parse(await readFile20(join17(projectRoot, "node_modules", packageName, "package.json"), "utf8"));
+    return isRecord8(manifest) && typeof manifest.version === "string" ? manifest.version : undefined;
   } catch {
     return;
   }
@@ -23439,9 +23871,9 @@ var runCapacitor = async (projectRoot, args) => {
 };
 var runCapacitorForPlatforms = (projectRoot, command, platforms) => platforms.reduce((pending, platform2) => pending.then(() => runCapacitor(projectRoot, [command, platform2])), Promise.resolve());
 var expoExecutable = async (project) => {
-  const executable = join16(project, "node_modules", ".bin", "expo");
+  const executable = join17(project, "node_modules", ".bin", "expo");
   try {
-    await access14(executable);
+    await access15(executable);
     return executable;
   } catch {
     throw new TypeError("Expo dependencies are not installed in the generated shell. Run `absolute mobile init --yes`.");
@@ -23473,14 +23905,14 @@ var runExpo = async (project, args, options = {}) => {
 };
 var ensureExpoPackages = async (project, args) => {
   try {
-    const manifest = JSON.parse(await readFile19(join16(project, "package.json"), "utf8"));
+    const manifest = JSON.parse(await readFile20(join17(project, "package.json"), "utf8"));
     const dependencies = typeof manifest === "object" && manifest !== null ? Reflect.get(manifest, "dependencies") : undefined;
     if (typeof dependencies !== "object" || dependencies === null || Array.isArray(dependencies))
       throw new TypeError("Generated Expo dependencies are invalid.");
     await Promise.all(Object.entries(dependencies).map(async ([name, expected]) => {
       if (typeof expected !== "string")
         throw new TypeError("Generated Expo dependency version is invalid.");
-      const installed = JSON.parse(await readFile19(join16(project, "node_modules", name, "package.json"), "utf8"));
+      const installed = JSON.parse(await readFile20(join17(project, "node_modules", name, "package.json"), "utf8"));
       const actual = typeof installed === "object" && installed !== null ? Reflect.get(installed, "version") : undefined;
       if (typeof actual !== "string")
         throw new TypeError("Installed Expo dependency version is invalid.");
@@ -23678,7 +24110,7 @@ var sync = async (args) => {
 };
 var associations = async (args) => {
   const { mobile, projectRoot } = await loadMobile(valueAfter(args, "--config"));
-  const outputDirectory = resolve14(projectRoot, valueAfter(args, "--outdir") ?? ".absolutejs/mobile/associations");
+  const outputDirectory = resolve15(projectRoot, valueAfter(args, "--outdir") ?? ".absolutejs/mobile/associations");
   if (args.includes("--verify")) {
     const result2 = await verifyAbsoluteMobileAssociationFiles(mobile);
     console.log(`Verified ${result2.results.length} hosted association files`);
@@ -23730,7 +24162,7 @@ var generateGithubCi = async (args) => {
   const publicResult = {
     changed: result.changed,
     format: result.format,
-    path: relative13(projectRoot, result.path).replaceAll("\\", "/"),
+    path: relative14(projectRoot, result.path).replaceAll("\\", "/"),
     platforms: result.platforms,
     publishing: result.publishing,
     requiredSecrets: result.requiredSecrets
@@ -23841,9 +24273,9 @@ var prepareExpoMobileUpdateExport = async (options) => {
       temporaryDirectory: undefined
     };
   await ensureExpoPackages(mobile.nativeProjectDirectory, options.args);
-  const temporaryParent = join16(options.projectRoot, ".absolutejs", "mobile", "expo-update-exports");
-  await mkdir15(temporaryParent, { recursive: true });
-  const temporaryDirectory = await mkdtemp5(join16(temporaryParent, ".stage-"));
+  const temporaryParent = join17(options.projectRoot, ".absolutejs", "mobile", "expo-update-exports");
+  await mkdir16(temporaryParent, { recursive: true });
+  const temporaryDirectory = await mkdtemp6(join17(temporaryParent, ".stage-"));
   try {
     await runExpo(mobile.nativeProjectDirectory, [
       "export",
@@ -23855,9 +24287,9 @@ var prepareExpoMobileUpdateExport = async (options) => {
       temporaryDirectory,
       "--clear"
     ], { production: true });
-    const generatedApp = JSON.parse(await readFile19(join16(mobile.nativeProjectDirectory, "app.json"), "utf8"));
-    const expoConfig = isRecord7(generatedApp) ? generatedApp.expo : undefined;
-    if (!isRecord7(expoConfig))
+    const generatedApp = JSON.parse(await readFile20(join17(mobile.nativeProjectDirectory, "app.json"), "utf8"));
+    const expoConfig = isRecord8(generatedApp) ? generatedApp.expo : undefined;
+    if (!isRecord8(expoConfig))
       throw new TypeError("Generated Expo app configuration is invalid.");
     const publicExpoConfig = expoPublicConfig(expoConfig);
     const computedRuntime = resolveAbsoluteMobileUpdateRuntime(mobile, options.projectRoot).fingerprint;
@@ -23873,7 +24305,7 @@ var prepareExpoMobileUpdateExport = async (options) => {
       temporaryDirectory
     };
   } catch (error) {
-    await rm8(temporaryDirectory, { force: true, recursive: true });
+    await rm9(temporaryDirectory, { force: true, recursive: true });
     throw error;
   }
 };
@@ -23898,11 +24330,11 @@ var buildMobileUpdate = async (args) => {
   let expoExportDirectory;
   try {
     await start(mobileBuildServerEntry(args), valueAfter(args, "--web-outdir"), configPath, { prepareOnly: true });
-    const embedded = JSON.parse(await readFile19(join16(mobile.bundleDirectory, "absolute-mobile-manifest.json"), "utf8"));
-    const runtimeFingerprint = isRecord7(embedded) ? embedded.nativeRuntime : undefined;
+    const embedded = JSON.parse(await readFile20(join17(mobile.bundleDirectory, "absolute-mobile-manifest.json"), "utf8"));
+    const runtimeFingerprint = isRecord8(embedded) ? embedded.nativeRuntime : undefined;
     if (typeof runtimeFingerprint !== "string" || !/^[a-f0-9]{64}$/u.test(runtimeFingerprint))
       throw new TypeError("Prepared mobile bundle is missing its native runtime fingerprint.");
-    const privateKey = await readFile19(resolve14(projectRoot, signingKeyPath));
+    const privateKey = await readFile20(resolve15(projectRoot, signingKeyPath));
     const configuredPublicKey = Buffer.from(mobile.updates.publicKeys[keyId], "base64");
     const derivedPublicKey = createPublicKey2(privateKey).export({
       format: "der",
@@ -23923,7 +24355,7 @@ var buildMobileUpdate = async (args) => {
       channel: mobile.updates.channel,
       classification,
       keyId,
-      outputDirectory: valueAfter(args, "--outdir") ?? join16(projectRoot, ".absolutejs", "mobile", "updates"),
+      outputDirectory: valueAfter(args, "--outdir") ?? join17(projectRoot, ".absolutejs", "mobile", "updates"),
       privateKey,
       runtimeFingerprint
     });
@@ -23935,7 +24367,7 @@ var buildMobileUpdate = async (args) => {
     return result;
   } finally {
     if (expoExportDirectory)
-      await rm8(expoExportDirectory, { force: true, recursive: true });
+      await rm9(expoExportDirectory, { force: true, recursive: true });
     sendTelemetryEvent("mobile:update-build", {
       classification: classification ?? "invalid",
       durationMs: Math.round(performance.now() - startedAt),
@@ -23965,7 +24397,7 @@ var generateExpoUpdateSigning = async (args) => {
     ...valueAfter(args, "--public-key") ? { publicKeyPath: valueAfter(args, "--public-key") } : {},
     ...validityYears === undefined ? {} : { validityYears }
   });
-  const certificatePath = relative13(projectRoot, result.certificatePath).replaceAll("\\", "/");
+  const certificatePath = relative14(projectRoot, result.certificatePath).replaceAll("\\", "/");
   sendTelemetryEvent("mobile:update-code-signing-generated", {
     engine: "expo",
     validityYears: validityYears ?? 10
@@ -24027,7 +24459,7 @@ var provisionMobileUpdate = async (args) => {
     publicKeys: mobile.updates.publicKeys,
     storage: requestedStorage
   });
-  console.log(`Provisioned ${requestedStorage === "local" ? "local development" : "durable S3-compatible"} mobile update storage in ${relative13(projectRoot, path).replaceAll("\\", "/")}.`);
+  console.log(`Provisioned ${requestedStorage === "local" ? "local development" : "durable S3-compatible"} mobile update storage in ${relative14(projectRoot, path).replaceAll("\\", "/")}.`);
   if (requestedStorage === "local")
     console.log("Production release checks will require durable storage. Re-run with --storage s3 --force before deploying.");
   else
@@ -24504,7 +24936,7 @@ var buildAndroid = async (args, prepareVersionCode) => {
     const durationMs = Math.round(performance.now() - startedAt);
     console.log(`Built ${release.metadata.signed ? "signed" : "unsigned"} Android App Bundle in ${getDurationString(durationMs)}.`);
     console.log(`Artifact: ${release.artifactPath}`);
-    console.log(`Metadata: ${join16(release.releaseRoot, "release.json")}`);
+    console.log(`Metadata: ${join17(release.releaseRoot, "release.json")}`);
     return release;
   } finally {
     sendTelemetryEvent("mobile:android-release-build", {
@@ -24623,8 +25055,6 @@ var buildIos = async (args, prepareBuildNumber) => {
   const remoteProfile = requestedRemote !== undefined || process.platform !== "darwin" ? await getAbsoluteRemoteMacProfile(requestedRemote, remoteProfilePath()) : undefined;
   if (process.platform !== "darwin" && !remoteProfile)
     throw new TypeError("iOS release builds require macOS or a paired Remote Mac. Run `absolute mobile pair mac <name> <user@host>`.");
-  if (remoteProfile && args.includes("--registered-device-artifact"))
-    throw new TypeError("--registered-device-artifact currently requires a local Mac; paired Remote Mac transfer support is not yet available.");
   let success = false;
   const cancellation = remoteProfile ? new AbortController : undefined;
   let stopListeningForCancellation = () => {
@@ -24652,6 +25082,7 @@ var buildIos = async (args, prepareBuildNumber) => {
       },
       ...prepareBuildNumber === undefined ? {} : { prepareBuildNumber },
       project: createAbsoluteRemoteIosDevProject(mobile, projectRoot, remoteProfile),
+      registeredDeviceArtifact: args.includes("--registered-device-artifact"),
       signal: cancellation?.signal
     }) : await buildLocalIosRelease({
       args,
@@ -24665,7 +25096,7 @@ var buildIos = async (args, prepareBuildNumber) => {
     console.log(`Artifact: ${release.artifactPath}`);
     if (release.registeredArtifactPath)
       console.log(`Registered-device artifact: ${release.registeredArtifactPath}`);
-    console.log(`Metadata: ${join16(release.releaseRoot, "release.json")}`);
+    console.log(`Metadata: ${join17(release.releaseRoot, "release.json")}`);
     return release;
   } finally {
     stopListeningForCancellation();
@@ -24777,7 +25208,7 @@ var appendSyncSchemaDoctorCheck = (checks, projectRoot) => {
     checks.push({
       id: "sync.storage-schema",
       label: `Offline schema ${schema.components.map((component) => `${component.id}@${component.version}`).join(", ")}`,
-      path: join16(projectRoot, "package.json"),
+      path: join17(projectRoot, "package.json"),
       platform: "host",
       status: "pass"
     });
@@ -24785,7 +25216,7 @@ var appendSyncSchemaDoctorCheck = (checks, projectRoot) => {
     checks.push({
       id: "sync.storage-schema",
       label: "Offline schema metadata is invalid",
-      path: join16(projectRoot, "package.json"),
+      path: join17(projectRoot, "package.json"),
       platform: "host",
       remediation: error instanceof Error ? error.message : String(error),
       status: "fail"
@@ -24873,7 +25304,7 @@ var requireAndroidTestPort = (args, projectRoot) => {
     }
     return { https: args.includes("--https"), port };
   }
-  const instances = listLiveInstances().filter((instance2) => resolve14(instance2.cwd) === resolve14(projectRoot) && instance2.source === "dev" && instance2.port !== null);
+  const instances = listLiveInstances().filter((instance2) => resolve15(instance2.cwd) === resolve15(projectRoot) && instance2.source === "dev" && instance2.port !== null);
   if (instances.length !== 1) {
     throw new TypeError(instances.length === 0 ? "No running AbsoluteJS dev server was found for this project. Start `bun dev`, wait for Android to report ready, then run `absolute mobile test android`." : "Multiple dev servers are running for this project. Select one with mobile test android --port <port>.");
   }
@@ -24967,8 +25398,8 @@ var selectOrStartAndroidReleaseEmulator = async (adb2, emulator, explicitSerial,
   return waitForBoot();
 };
 var safeArtifactRoot = (projectRoot, value) => {
-  const root = resolve14(projectRoot, value ?? ".absolutejs/mobile/test-artifacts");
-  if (root !== projectRoot && !root.startsWith(`${resolve14(projectRoot)}/`)) {
+  const root = resolve15(projectRoot, value ?? ".absolutejs/mobile/test-artifacts");
+  if (root !== projectRoot && !root.startsWith(`${resolve15(projectRoot)}/`)) {
     throw new TypeError("mobile test --artifacts must remain inside the project.");
   }
   return root;
@@ -24996,12 +25427,12 @@ var waitForRequestedAndroidHmr = async (args, session, checks, timeoutMs) => {
   });
 };
 var writeAndroidFailureArtifacts = async (options) => {
-  await mkdir15(options.artifactRoot, { recursive: true });
-  const screenshot = options.session ? await options.session.screenshot(join16(options.artifactRoot, "android-failure.png")).catch(() => {
+  await mkdir16(options.artifactRoot, { recursive: true });
+  const screenshot = options.session ? await options.session.screenshot(join17(options.artifactRoot, "android-failure.png")).catch(() => {
     return;
   }) : undefined;
-  const diagnosticPath = join16(options.artifactRoot, "android-failure.json");
-  await writeFile16(diagnosticPath, `${JSON.stringify({
+  const diagnosticPath = join17(options.artifactRoot, "android-failure.json");
+  await writeFile17(diagnosticPath, `${JSON.stringify({
     diagnostics: options.session?.diagnostics ?? [],
     error: options.error instanceof Error ? options.error.message : String(options.error),
     platform: "android",
@@ -25022,7 +25453,7 @@ var captureAndroidReleaseScreenshot = async (adb2, serial, destination) => {
   ]);
   if (exitCode !== 0)
     throw new Error(`Android release screenshot failed: ${stderr.trim() || `status ${exitCode}`}`);
-  await writeFile16(destination, bytes);
+  await writeFile17(destination, bytes);
   return destination;
 };
 var printAndroidReleaseAcceptance = (result, json) => {
@@ -25076,7 +25507,7 @@ var testAndroidRelease = async (args, mobile, projectRoot) => {
       release,
       serial
     });
-    const screenshot = reportRoot ? await captureAndroidReleaseScreenshot(adb2, serial, join16(reportRoot, "android-release.png")) : undefined;
+    const screenshot = reportRoot ? await captureAndroidReleaseScreenshot(adb2, serial, join17(reportRoot, "android-release.png")) : undefined;
     sendTelemetryEvent("mobile:android-release-conformance", {
       durationMs: result.durationMs,
       engine: result.engine,
@@ -25123,9 +25554,9 @@ var testAndroidRelease = async (args, mobile, projectRoot) => {
       platform: "android",
       success: false
     });
-    await mkdir15(artifactRoot, { recursive: true });
-    const diagnosticPath = join16(artifactRoot, "android-release-failure.json");
-    await writeFile16(diagnosticPath, `${JSON.stringify({
+    await mkdir16(artifactRoot, { recursive: true });
+    const diagnosticPath = join17(artifactRoot, "android-release-failure.json");
+    await writeFile17(diagnosticPath, `${JSON.stringify({
       error: sanitizeNativeReportText(error instanceof Error ? error.message : String(error)),
       platform: "android",
       provider: mobile.engine,
@@ -25219,7 +25650,7 @@ var testAndroid = async (args) => {
       console.log(JSON.stringify(report, null, 2));
     else
       printAndroidTestReport(report);
-    const screenshot = reportRoot ? await session.screenshot(join16(artifactRoot, "android-emulator.png")) : undefined;
+    const screenshot = reportRoot ? await session.screenshot(join17(artifactRoot, "android-emulator.png")) : undefined;
     await writeRequestedAndroidReport({
       adb: adb2,
       args,
@@ -25288,14 +25719,14 @@ var requireIosTestContext = (args, projectRoot) => {
     const port = Number(explicit);
     if (!Number.isInteger(port) || port < 1 || port > 65535)
       throw new TypeError("mobile test --port must be a valid TCP port.");
-    const instance2 = listLiveInstances().find((candidate) => resolve14(candidate.cwd) === resolve14(projectRoot) && candidate.source === "dev" && candidate.port === port);
+    const instance2 = listLiveInstances().find((candidate) => resolve15(candidate.cwd) === resolve15(projectRoot) && candidate.source === "dev" && candidate.port === port);
     return {
       https: instance2?.https ?? args.includes("--https"),
       instance: instance2,
       port
     };
   }
-  const instances = listLiveInstances().filter((instance2) => resolve14(instance2.cwd) === resolve14(projectRoot) && instance2.source === "dev" && instance2.port !== null);
+  const instances = listLiveInstances().filter((instance2) => resolve15(instance2.cwd) === resolve15(projectRoot) && instance2.source === "dev" && instance2.port !== null);
   if (instances.length !== 1)
     throw new TypeError(instances.length === 0 ? "No running AbsoluteJS dev server was found for this project. Start `bun dev`, wait for iOS to report ready, then run `absolute mobile test ios`." : "Multiple dev servers are running for this project. Select one with mobile test ios --port <port>.");
   const [instance] = instances;
@@ -25313,7 +25744,7 @@ var waitForIosHmrClient = async (options) => {
       return;
     });
     const status = response?.ok ? await response.json().catch(() => null) : null;
-    const targets = isRecord7(status) && isRecord7(status.connectedTargets) ? status.connectedTargets : undefined;
+    const targets = isRecord8(status) && isRecord8(status.connectedTargets) ? status.connectedTargets : undefined;
     if (targets && typeof targets["capacitor-ios"] === "number" && targets["capacitor-ios"] > 0)
       return;
     await Bun.sleep(100);
@@ -25439,8 +25870,8 @@ var requireCapturedCommand = (command, label) => {
   return result;
 };
 var writeIosFailureArtifacts = async (options) => {
-  await mkdir15(options.artifactRoot, { recursive: true });
-  const screenshot = join16(options.artifactRoot, "ios-failure.png");
+  await mkdir16(options.artifactRoot, { recursive: true });
+  const screenshot = join17(options.artifactRoot, "ios-failure.png");
   const screenshotResult = captureCommand4([
     options.xcrun,
     "simctl",
@@ -25449,8 +25880,8 @@ var writeIosFailureArtifacts = async (options) => {
     "screenshot",
     screenshot
   ]);
-  const diagnosticPath = join16(options.artifactRoot, "ios-failure.json");
-  await writeFile16(diagnosticPath, `${JSON.stringify({
+  const diagnosticPath = join17(options.artifactRoot, "ios-failure.json");
+  await writeFile17(diagnosticPath, `${JSON.stringify({
     appId: options.appId,
     error: options.error instanceof Error ? options.error.message : String(options.error),
     platform: "ios",
@@ -25477,8 +25908,8 @@ var nativeReportRoot = (args, projectRoot, platform2) => {
 var absolutejsVersionForReport = async () => {
   let absolutejsVersion = process.env.ABSOLUTE_VERSION ?? "unknown";
   const versions = await Promise.all([
-    resolve14(import.meta.dir, "..", "..", "package.json"),
-    resolve14(import.meta.dir, "..", "..", "..", "package.json")
+    resolve15(import.meta.dir, "..", "..", "package.json"),
+    resolve15(import.meta.dir, "..", "..", "..", "package.json")
   ].map((candidate) => readPackageVersionForIosReport(candidate).catch(() => "unknown")));
   for (const version of versions) {
     if (version === "unknown")
@@ -25655,7 +26086,7 @@ var printIosReleaseAcceptance = (result, json) => {
   console.log(`\u2713 Embedded local content launched in ${getDurationString(result.launchMs)} and relaunched in ${getDurationString(result.relaunchMs)}.`);
   console.log(result.networkUnavailable === "user-confirmed" ? "\u2713 Physical-device network-unavailable state was explicitly confirmed." : "\u2139 Simulator evidence does not claim physical-device offline behavior.");
 };
-var iosReleaseRun = (result, appId, targetId) => ({
+var iosReleaseRun = (result, appId, targetId, remote) => ({
   appId,
   durationMs: result.durationMs,
   hmrConnected: false,
@@ -25671,6 +26102,7 @@ var iosReleaseRun = (result, appId, targetId) => ({
     networkUnavailable: result.networkUnavailable,
     relaunchMs: result.relaunchMs,
     releaseId: result.releaseId,
+    remote,
     signed: result.signed
   },
   status: "pass",
@@ -25704,14 +26136,56 @@ var runIosSimulatorReleaseTarget = async (options) => {
   });
   return { result, targetId: simulator.udid };
 };
+var runRemoteIosReleaseTarget = async (options) => {
+  const physical = options.requestedDevice !== undefined;
+  const confirmed = !physical || options.args.includes("--yes") || await confirmInstall("On the selected iPhone, enable Airplane Mode and then disable Wi-Fi in Settings. Confirm both are still disabled and continue with two release launches on the Remote Mac?");
+  if (!confirmed)
+    throw new TypeError("Physical iOS offline acceptance was cancelled because network-unavailable state was not confirmed.");
+  let distribution = "simulator-release";
+  if (options.requestedDevice)
+    distribution = "registered-device";
+  if (options.args.includes("--testflight"))
+    distribution = "testflight";
+  const simulatorUdid = valueAfter(options.args, "--udid") ?? valueAfter(options.args, "--serial");
+  const remoteAcceptance = await runAbsoluteRemoteIosReleaseAcceptance({
+    ...options.requestedDevice ? {
+      deviceIdentifier: normalizeAbsoluteIosDeviceIdentifier(options.requestedDevice),
+      networkUnavailableConfirmed: true
+    } : {},
+    distribution,
+    project: createAbsoluteRemoteIosDevProject(options.mobile, options.projectRoot, options.profile),
+    release: options.release,
+    signal: options.cancellation?.signal,
+    log: (message) => console.log(`[remote] ${message}`),
+    onPhaseTiming: ({ durationMs, phase }) => {
+      console.log(`[mobile:ios-release-test] ${phase} ${getDurationString(durationMs)}`);
+      sendTelemetryEvent("mobile:ios-release-test-phase", {
+        durationMs: Math.round(durationMs),
+        engine: options.mobile.engine,
+        phase,
+        platform: "ios",
+        provider: "remote-mac"
+      });
+    },
+    ...simulatorUdid ? { simulatorUdid } : {}
+  });
+  return {
+    result: remoteAcceptance.result,
+    targetId: remoteAcceptance.targetId
+  };
+};
 var testIosRelease = async (args, mobile, projectRoot) => {
   const requested = valueAfter(args, "--release");
   if (!requested || requested.startsWith("--"))
     throw new TypeError("mobile test ios --release requires a release directory or release.json path.");
   if (!mobile.platforms.includes("ios"))
     throw new TypeError("mobile test ios requires ios in mobile.platforms.");
-  if (args.includes("--remote"))
-    throw new TypeError("Installed iOS release acceptance currently runs on a local Mac. Remote Mac acceptance will be added to the paired-host protocol.");
+  const requestedRemote = valueAfter(args, "--remote");
+  if (args.includes("--remote") && (!requestedRemote || requestedRemote.startsWith("-")))
+    throw new TypeError("mobile test ios --release requires --remote <name>.");
+  const remoteProfile = requestedRemote !== undefined || process.platform !== "darwin" ? await getAbsoluteRemoteMacProfile(requestedRemote, remoteProfilePath()) : undefined;
+  if (process.platform !== "darwin" && !remoteProfile)
+    throw new TypeError("iOS release acceptance requires macOS or a paired Remote Mac. Run `absolute mobile pair mac <name> <user@host>`.");
   const release = await readAbsoluteIosRelease(projectRoot, requested);
   if (release.metadata.appId !== mobile.appId)
     throw new TypeError(`iOS release app ID ${release.metadata.appId} does not match mobile.appId ${mobile.appId}.`);
@@ -25726,24 +26200,59 @@ var testIosRelease = async (args, mobile, projectRoot) => {
     throw new TypeError("mobile test ios --release --testflight requires --device.");
   if (requestedDevice && (valueAfter(args, "--udid") || valueAfter(args, "--serial")))
     throw new TypeError("mobile test ios --release --device cannot be combined with a simulator selector.");
-  const xcrun = await requireIosXcrun();
+  const xcrun = remoteProfile ? undefined : await requireIosXcrun();
   const reportRoot = nativeReportRoot(args, projectRoot, "ios");
   const artifactRoot = reportRoot ?? safeArtifactRoot(projectRoot, valueAfter(args, "--artifacts") ?? `.absolutejs/mobile/test-artifacts/${release.metadata.releaseId}`);
   const startedAt = performance.now();
   let targetId = requestedDevice ?? "ios-simulator";
+  let remoteReportMetadata;
+  if (remoteProfile && reportRoot) {
+    const macos = await captureAbsoluteRemoteMacCommand(remoteProfile, [
+      "/usr/bin/sw_vers",
+      "-productVersion"
+    ]);
+    if (macos.exitCode !== 0)
+      throw new Error("Remote Mac version inspection failed.");
+    remoteReportMetadata = {
+      absolutejsVersion: await absolutejsVersionForReport(),
+      bunVersion: Bun.version,
+      macosVersion: macos.stdout.trim(),
+      xcodeVersion: remoteProfile.xcodeVersion
+    };
+  }
+  const cancellation = remoteProfile ? new AbortController : undefined;
+  const stopListeningForCancellation = remoteProfile ? listenForRemoteReleaseCancellation(cancellation) : () => {
+    return;
+  };
   try {
-    const acceptance = requestedDevice ? await runIosPhysicalReleaseTarget({
-      args,
-      device: requestedDevice,
-      release,
-      xcrun
-    }) : await runIosSimulatorReleaseTarget({
-      args,
-      artifactRoot,
-      mobile,
-      release,
-      xcrun
-    });
+    let acceptance;
+    if (remoteProfile)
+      acceptance = await runRemoteIosReleaseTarget({
+        args,
+        ...cancellation ? { cancellation } : {},
+        mobile,
+        profile: remoteProfile,
+        projectRoot,
+        release,
+        ...requestedDevice ? { requestedDevice } : {}
+      });
+    else if (!xcrun)
+      throw new Error("Local iOS release acceptance requires xcrun.");
+    else if (requestedDevice)
+      acceptance = await runIosPhysicalReleaseTarget({
+        args,
+        device: requestedDevice,
+        release,
+        xcrun
+      });
+    else
+      acceptance = await runIosSimulatorReleaseTarget({
+        args,
+        artifactRoot,
+        mobile,
+        release,
+        xcrun
+      });
     const { result, targetId: acceptedTargetId } = acceptance;
     targetId = acceptedTargetId;
     sendTelemetryEvent("mobile:ios-release-conformance", {
@@ -25755,14 +26264,16 @@ var testIosRelease = async (args, mobile, projectRoot) => {
       launchMs: result.launchMs,
       platform: "ios",
       relaunchMs: result.relaunchMs,
+      remote: remoteProfile !== undefined,
       success: true
     });
     await writeRequestedIosReport({
       args,
+      ...remoteReportMetadata ? { metadata: remoteReportMetadata } : {},
       projectRoot,
       provider: mobile.engine,
-      run: iosReleaseRun(result, mobile.appId, targetId),
-      xcrun
+      run: iosReleaseRun(result, mobile.appId, targetId, remoteProfile !== undefined),
+      ...xcrun ? { xcrun } : {}
     });
     printIosReleaseAcceptance(result, args.includes("--json"));
     return result;
@@ -25772,11 +26283,12 @@ var testIosRelease = async (args, mobile, projectRoot) => {
       durationMs,
       engine: mobile.engine,
       platform: "ios",
+      remote: remoteProfile !== undefined,
       success: false
     });
-    await mkdir15(artifactRoot, { recursive: true });
-    const diagnosticPath = join16(artifactRoot, "ios-release-failure.json");
-    await writeFile16(diagnosticPath, `${JSON.stringify({
+    await mkdir16(artifactRoot, { recursive: true });
+    const diagnosticPath = join17(artifactRoot, "ios-release-failure.json");
+    await writeFile17(diagnosticPath, `${JSON.stringify({
       error: sanitizeIosReportText(error instanceof Error ? error.message : String(error)),
       platform: "ios",
       provider: mobile.engine,
@@ -25787,6 +26299,7 @@ var testIosRelease = async (args, mobile, projectRoot) => {
     if (reportRoot)
       await writeRequestedIosReport({
         args,
+        ...remoteReportMetadata ? { metadata: remoteReportMetadata } : {},
         projectRoot,
         provider: mobile.engine,
         run: {
@@ -25798,9 +26311,11 @@ var testIosRelease = async (args, mobile, projectRoot) => {
           targetId,
           targetKind: requestedDevice ? "device" : "simulator"
         },
-        xcrun
+        ...xcrun ? { xcrun } : {}
       });
     throw new Error(`${error instanceof Error ? error.message : String(error)} Failure diagnostics: ${diagnosticPath}`, { cause: error });
+  } finally {
+    stopListeningForCancellation();
   }
 };
 var testIos = async (args) => {
@@ -25866,8 +26381,8 @@ var testIos = async (args) => {
       mobile.appId
     ], "iOS app launch");
     await waitForIosHmrClient({ https, port, timeoutMs });
-    await mkdir15(artifactRoot, { recursive: true });
-    const screenshot = join16(artifactRoot, "ios-simulator.png");
+    await mkdir16(artifactRoot, { recursive: true });
+    const screenshot = join17(artifactRoot, "ios-simulator.png");
     requireCapturedCommand([xcrun, "simctl", "io", simulator.udid, "screenshot", screenshot], "iOS simulator screenshot");
     const hmrApply = await waitForRequestedIosHmr(args, instance, timeoutMs);
     const report = {
@@ -25951,6 +26466,110 @@ var testIos = async (args) => {
     throw new Error(`${error instanceof Error ? error.message : String(error)} Failure diagnostics: ${diagnosticPath}${screenshot ? `; screenshot: ${screenshot}` : ""}`, { cause: error });
   }
 };
+var readCertifiableMobileRelease = async (projectRoot, requested) => {
+  let androidError;
+  try {
+    return await readAbsoluteAndroidRelease(projectRoot, requested);
+  } catch (error) {
+    androidError = error;
+  }
+  try {
+    return await readAbsoluteIosRelease(projectRoot, requested);
+  } catch (iosError) {
+    throw new TypeError(`Unable to read an immutable Android or iOS release from ${requested}. Android: ${androidError instanceof Error ? androidError.message : String(androidError)} iOS: ${iosError instanceof Error ? iosError.message : String(iosError)}`, { cause: iosError });
+  }
+};
+var mobileCertificationRequirement = (value) => {
+  if (value === undefined)
+    return;
+  if (value !== "installed" && value !== "simulator" && value !== "device" && value !== "store")
+    throw new TypeError("mobile certify --require must be installed, simulator, device, or store.");
+  return value;
+};
+var mobileCertificationValue = (args, flag) => {
+  const value = valueAfter(args, flag);
+  if (args.includes(flag) && (!value || value.startsWith("--")))
+    throw new TypeError(`mobile certify ${flag} requires a value.`);
+  return value;
+};
+var verifyMobileCertification = async (options) => {
+  if (valuesAfter(options.args, "--evidence").length > 0)
+    throw new TypeError("mobile certify --verify cannot be combined with --evidence.");
+  const loaded = await readAbsoluteMobileReleaseCertification(options.projectRoot, options.verifyPath);
+  const certification = verifyAbsoluteMobileReleaseCertification(loaded.certification, options.release, options.requirement);
+  sendTelemetryEvent("mobile:release-certification", {
+    durationMs: Math.round(performance.now() - options.startedAt),
+    engine: options.release.metadata.engine,
+    mode: "verify",
+    platform: options.release.metadata.platform,
+    requirement: options.requirement ?? certification.requirement,
+    strength: certification.strength,
+    success: true
+  });
+  if (options.args.includes("--json"))
+    console.log(JSON.stringify(certification, null, 2));
+  else
+    console.log(`\u2713 ${certification.strength} certification ${certification.certificationId} still matches ${certification.release.releaseId}.`);
+  return certification;
+};
+var createMobileCertification = async (options) => {
+  const evidencePaths = valuesAfter(options.args, "--evidence");
+  const certification = await createAbsoluteMobileReleaseCertification({
+    evidencePaths,
+    projectRoot: options.projectRoot,
+    release: options.release,
+    ...options.requirement ? { requirement: options.requirement } : {}
+  });
+  const output = await writeAbsoluteMobileReleaseCertification(options.projectRoot, certification, mobileCertificationValue(options.args, "--outdir"));
+  sendTelemetryEvent("mobile:release-certification", {
+    durationMs: Math.round(performance.now() - options.startedAt),
+    engine: options.release.metadata.engine,
+    evidenceCount: certification.evidence.length,
+    mode: "create",
+    platform: options.release.metadata.platform,
+    requirement: certification.requirement,
+    strength: certification.strength,
+    success: true
+  });
+  if (options.args.includes("--json"))
+    console.log(JSON.stringify(certification, null, 2));
+  else {
+    console.log(`\u2713 Certified immutable ${certification.release.platform} release ${certification.release.releaseId} at ${certification.strength} strength.`);
+    console.log(`Certification: ${output.jsonPath}`);
+    console.log(`Summary: ${output.markdownPath}`);
+  }
+  return certification;
+};
+var certifyMobileRelease = async (args) => {
+  const [requested] = args;
+  if (!requested || requested.startsWith("--"))
+    throw new TypeError("mobile certify requires a release directory or release.json path.");
+  const projectRoot = process.cwd();
+  const release = await readCertifiableMobileRelease(projectRoot, requested);
+  const requirement = mobileCertificationRequirement(mobileCertificationValue(args, "--require"));
+  const verifyPath = mobileCertificationValue(args, "--verify");
+  const startedAt = performance.now();
+  try {
+    const options = {
+      args,
+      projectRoot,
+      release,
+      ...requirement ? { requirement } : {},
+      startedAt
+    };
+    return verifyPath ? await verifyMobileCertification({ ...options, verifyPath }) : await createMobileCertification(options);
+  } catch (error) {
+    sendTelemetryEvent("mobile:release-certification", {
+      durationMs: Math.round(performance.now() - startedAt),
+      engine: release.metadata.engine,
+      mode: verifyPath ? "verify" : "create",
+      platform: release.metadata.platform,
+      ...requirement ? { requirement } : {},
+      success: false
+    });
+    throw error;
+  }
+};
 var runMobile = async (args) => {
   const [command] = args;
   if (command === "pair") {
@@ -25989,6 +26608,10 @@ var runMobile = async (args) => {
     await inspectMobile(args.slice(1));
     return;
   }
+  if (command === "certify") {
+    await certifyMobileRelease(args.slice(1));
+    return;
+  }
   if (command === "test" && args[1] === "android") {
     await testAndroid(args.slice(2));
     return;
@@ -26053,7 +26676,7 @@ var runMobile = async (args) => {
     await publishIos(args.slice(2));
     return;
   }
-  throw new TypeError("Usage: absolute mobile <pair mac <name> <user@host> [--port n] [--workspace path] | remotes [inspect [name] [--json] | clean [name] --yes | --json] | unpair mac <name> | init [--no-native] [--force] | sync [ios|android] | inspect [--json] [--require-bundle] | associations [--outdir dir] [--verify] | ci github [server-entry] [--publish] [--registry module] [--secret-env NAME] [--output path] [--force] [--json] | doctor [ios|android|release [ios|android]] [--remote name] [--json|--fix [--yes]] | build <android|ios> [server-entry] [--remote name] [--registered-device-artifact] [--outdir dir] [--web-outdir dir] [--unsigned] | update provision [--storage local|s3] [--registry module] [--force] [--yes] | update signing generate --private-key path [--certificate path] [--public-key path] [--key-id id] [--common-name name] [--validity-years n] | update build [server-entry] --classification bug-fix|content|security --key-id id --signing-key path --within-submitted-purpose [--outdir dir] [--web-outdir dir] | update publish <release-directory> [--rollout fraction] [--registry module] | update promote --release id --rollout fraction [--registry module] | update rollback [--release id] [--registry module] | update status [--registry module] [--json] | update advance [--rollout fraction] [--registry module] [--json] | update pause|resume|cancel|reconcile [--registry module] [--json] | update storage [--retain count] [--min-age-days days] [--registry module] [--json] | update gc [--retain count] [--min-age-days days] [--grace-days days] [--apply] [--registry module] [--json] | publish android [server-entry] [--registry module] [--channel name] [--play-track track] [--play-status completed|draft|halted|in-progress] [--play-rollout fraction] [--play-name name] [--play-notes language=text] [--play-update-priority 0..5] [--play-hold-review] [--play-cancel-existing-review] [--outdir dir] [--web-outdir dir] [--unsigned] | publish ios [server-entry] [--remote name] [--registry module] [--channel name] [--testflight-group name-or-id] [--testflight-notes locale=text] [--testflight-submit-review] [--outdir dir] [--web-outdir dir] [--unsigned] | test android [--release release-dir [--yes] | --route path [--wait-for-hmr] [--port n]] [--report [dir]] [--serial id] [--artifacts dir] [--json] [--config path] | test ios [--release release-dir [--device id [--testflight] --yes] | --wait-for-hmr] [--report [dir]] [--udid id] [--artifacts dir] [--json] [--config path]");
+  throw new TypeError("Usage: absolute mobile <pair mac <name> <user@host> [--port n] [--workspace path] | remotes [inspect [name] [--json] | clean [name] --yes | --json] | unpair mac <name> | init [--no-native] [--force] | sync [ios|android] | inspect [--json] [--require-bundle] | certify <release-dir> [--evidence report-dir]... [--require installed|simulator|device|store] [--outdir dir] [--json] | certify <release-dir> --verify certification-dir [--require installed|simulator|device|store] [--json] | associations [--outdir dir] [--verify] | ci github [server-entry] [--publish] [--registry module] [--secret-env NAME] [--output path] [--force] [--json] | doctor [ios|android|release [ios|android]] [--remote name] [--json|--fix [--yes]] | build <android|ios> [server-entry] [--remote name] [--registered-device-artifact] [--outdir dir] [--web-outdir dir] [--unsigned] | update provision [--storage local|s3] [--registry module] [--force] [--yes] | update signing generate --private-key path [--certificate path] [--public-key path] [--key-id id] [--common-name name] [--validity-years n] | update build [server-entry] --classification bug-fix|content|security --key-id id --signing-key path --within-submitted-purpose [--outdir dir] [--web-outdir dir] | update publish <release-directory> [--rollout fraction] [--registry module] | update promote --release id --rollout fraction [--registry module] | update rollback [--release id] [--registry module] | update status [--registry module] [--json] | update advance [--rollout fraction] [--registry module] [--json] | update pause|resume|cancel|reconcile [--registry module] [--json] | update storage [--retain count] [--min-age-days days] [--registry module] [--json] | update gc [--retain count] [--min-age-days days] [--grace-days days] [--apply] [--registry module] [--json] | publish android [server-entry] [--registry module] [--channel name] [--play-track track] [--play-status completed|draft|halted|in-progress] [--play-rollout fraction] [--play-name name] [--play-notes language=text] [--play-update-priority 0..5] [--play-hold-review] [--play-cancel-existing-review] [--outdir dir] [--web-outdir dir] [--unsigned] | publish ios [server-entry] [--remote name] [--registry module] [--channel name] [--testflight-group name-or-id] [--testflight-notes locale=text] [--testflight-submit-review] [--outdir dir] [--web-outdir dir] [--unsigned] | test android [--release release-dir [--yes] | --route path [--wait-for-hmr] [--port n]] [--report [dir]] [--serial id] [--artifacts dir] [--json] [--config path] | test ios [--release release-dir [--remote name] [--device id [--testflight] --yes] | --wait-for-hmr] [--report [dir]] [--udid id] [--artifacts dir] [--json] [--config path]");
 };
 export {
   runMobile