@absolutejs/absolute 0.20.0-beta.106 → 0.20.0-beta.108

package/dist/mobile/index.js

@@ -20032,7 +20032,7 @@ __export(exports_mobileUpdate, {
   parseMobileUpdateManifest: () => parseMobileUpdateManifest
 });
 import {
-  createHash as createHash18,
+  createHash as createHash19,
   createHmac,
   createPrivateKey,
   createPublicKey as createPublicKey2,
@@ -20042,7 +20042,7 @@ import {
   verify as verify2,
   X509Certificate as X509Certificate3
 } from "crypto";
-import { readFile as readFile27, stat as stat7 } from "fs/promises";
+import { readFile as readFile28, stat as stat7 } from "fs/promises";
 import path from "path";
 var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updates", MAX_FILE_BYTES, MAX_TOTAL_BYTES, DAY_MS, DEFAULT_MIN_AGE_MS, DEFAULT_GRACE_PERIOD_MS, DEFAULT_RETAIN_RECENT = 5, HASH, RELEASE, APP_ID, NAME, EXPO_DESCRIPTOR = "_absolute/expo-update.json", EXPO_CODE_SIGNING_ALGORITHM = "rsa-v1_5-sha256", HEALTH_TOKEN_VERSION = 1, HEALTH_KINDS, FAILURE_HEALTH_KINDS, MobileUpdateRegistryError, object6 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), text2 = (value, field2) => {
   if (typeof value !== "string" || value.length === 0)
@@ -20192,7 +20192,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
   if (!prefix || prefix.split("/").some((segment) => segment === "." || segment === ".."))
     throw new MobileUpdateRegistryError("Mobile update prefix is invalid");
   return prefix;
-}, appHash = (appId) => createHash18("sha256").update(appId).digest("hex"), digest = (bytes) => createHash18("sha256").update(bytes).digest("hex"), json = (value) => new TextEncoder().encode(`${JSON.stringify(value, null, 2)}
+}, appHash = (appId) => createHash19("sha256").update(appId).digest("hex"), digest = (bytes) => createHash19("sha256").update(bytes).digest("hex"), json = (value) => new TextEncoder().encode(`${JSON.stringify(value, null, 2)}
 `), decode2 = (value) => JSON.parse(new TextDecoder().decode(value)), fileDigest = async (file) => {
   const hasher = new Bun.CryptoHasher("sha256");
   for await (const chunk of file.stream())
@@ -20203,7 +20203,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
     return false;
   if (input.rollout === 1)
     return true;
-  const value = createHash18("sha256").update(`${input.appId}\x00${input.channel}\x00${input.releaseId}\x00${input.installationId}`).digest().readUInt32BE(0);
+  const value = createHash19("sha256").update(`${input.appId}\x00${input.channel}\x00${input.releaseId}\x00${input.installationId}`).digest().readUInt32BE(0);
   return value / 4294967296 < input.rollout;
 }, base64Url = (value) => Buffer.from(value).toString("base64url"), healthPromotionId = (channel) => channel.promotionId ?? digest(new TextEncoder().encode(`${channel.appId}\x00${channel.channel}\x00${channel.releaseId ?? "embedded"}\x00${channel.promotedAt}`)), finiteMetric = (value, field2) => {
   if (typeof value !== "number" || !Number.isFinite(value) || value < 0)
@@ -20243,7 +20243,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
   const releaseRoot = (manifest) => `${root(manifest.appId)}/releases/${manifest.releaseId}`;
   const manifestKey = (manifest) => `${releaseRoot(manifest)}/update.json`;
   const fileKey = (manifest, file) => `${releaseRoot(manifest)}/files/${file.path}`;
-  const contentBlobKey = (appId, sha2565) => `${root(appId)}/blobs/${sha2565}`;
+  const contentBlobKey = (appId, sha2566) => `${root(appId)}/blobs/${sha2566}`;
   const tombstoneKey = (appId, releaseId) => `${root(appId)}/gc/${releaseId}.json`;
   const healthRoot = (appId, promotionId, releaseId) => `${root(appId)}/health/${promotionId}/${releaseId}`;
   const pauseKey = (appId, promotionId, releaseId) => `${healthRoot(appId, promotionId, releaseId)}/paused.json`;
@@ -20864,10 +20864,10 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
     const objectBytesByDigest = new Map;
     for (const blobObject of objects) {
       if (blobObject.key.startsWith(blobPrefix)) {
-        const sha2565 = blobObject.key.slice(blobPrefix.length);
-        if (HASH.test(sha2565)) {
-          objectKeysByDigest.set(sha2565, blobObject.key);
-          objectBytesByDigest.set(sha2565, blobObject.size);
+        const sha2566 = blobObject.key.slice(blobPrefix.length);
+        if (HASH.test(sha2566)) {
+          objectKeysByDigest.set(sha2566, blobObject.key);
+          objectBytesByDigest.set(sha2566, blobObject.size);
         }
       }
       if (!blobObject.key.startsWith(releasePrefix))
@@ -20950,7 +20950,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
     }).toSorted((left, right) => right.createdAt.localeCompare(left.createdAt));
     const protectedReleaseIds = new Set(releases.filter((release) => release.protectedBy.length > 0).map((release) => release.releaseId));
     const protectedDigests = new Set(manifests.filter((manifest) => protectedReleaseIds.has(manifest.releaseId)).flatMap((manifest) => manifest.files.map((file) => file.sha256)));
-    const reclaimableContentBytes = [...objectBytesByDigest].filter(([sha2565]) => !protectedDigests.has(sha2565)).reduce((total, [, bytes]) => total + bytes, 0);
+    const reclaimableContentBytes = [...objectBytesByDigest].filter(([sha2566]) => !protectedDigests.has(sha2566)).reduce((total, [, bytes]) => total + bytes, 0);
     const contentBlobBytes = [...objectBytesByDigest.values()].reduce((total, bytes) => total + bytes, 0);
     const releaseBytes = releases.reduce((total, release) => total + release.bytes, 0);
     const totalBytes = objects.reduce((total, object22) => total + object22.size, 0);
@@ -21047,13 +21047,13 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
       for (const file of manifest?.manifest.files ?? [])
         referencedDigests.add(file.sha256);
     }
-    for (const [sha2565, key] of afterReleaseSweep.objectKeysByDigest) {
-      if (referencedDigests.has(sha2565))
+    for (const [sha2566, key] of afterReleaseSweep.objectKeysByDigest) {
+      if (referencedDigests.has(sha2566))
         continue;
       const head = await options.store.head(key);
       await remove(key);
       result.reclaimedBytes += head?.size ?? 0;
-      result.sweptContentBlobs.push(sha2565);
+      result.sweptContentBlobs.push(sha2566);
     }
     return result;
   };
@@ -21075,7 +21075,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
       verifyManifestSignature(manifest, options.publicKeys);
       await assertNotMarked(manifest.appId, manifest.releaseId);
       const localRoot = path.resolve(input.releaseDirectory);
-      const localManifest = parseMobileUpdateManifest(JSON.parse(await readFile27(path.join(localRoot, "update.json"), "utf8")));
+      const localManifest = parseMobileUpdateManifest(JSON.parse(await readFile28(path.join(localRoot, "update.json"), "utf8")));
       if (JSON.stringify(localManifest) !== JSON.stringify(manifest))
         throw new MobileUpdateRegistryError("Local mobile update manifest changed");
       const existing = await readManifest(manifest.appId, manifest.releaseId);
@@ -21208,7 +21208,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
     }
   };
 }, expoUpdateId = (releaseId) => {
-  const hash = RELEASE.test(releaseId) ? releaseId.slice("amu_".length, "amu_".length + 32) : createHash18("sha256").update(releaseId).digest("hex").slice(0, 32);
+  const hash = RELEASE.test(releaseId) ? releaseId.slice("amu_".length, "amu_".length + 32) : createHash19("sha256").update(releaseId).digest("hex").slice(0, 32);
   return `${hash.slice(0, 8)}-${hash.slice(8, 12)}-${hash.slice(12, 16)}-${hash.slice(16, 20)}-${hash.slice(20)}`;
 }, expoContentType = (extension2, launch2) => {
   if (launch2)
@@ -21361,8 +21361,8 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
       });
     }
     const pathname = new URL(request.url).pathname.replace(/^\/+/, "");
-    const relative20 = pathname.startsWith(`${route}/`) ? pathname.slice(route.length + 1) : "";
-    if (request.method === "POST" && relative20 === "health") {
+    const relative21 = pathname.startsWith(`${route}/`) ? pathname.slice(route.length + 1) : "";
+    if (request.method === "POST" && relative21 === "health") {
       if (!options.registry.recordUpdateHealth)
         return new Response(null, { status: 404 });
       const appId = request.headers.get("x-absolute-mobile-app");
@@ -21405,7 +21405,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
     }
     if (request.method !== "GET")
       return new Response(null, { status: 405 });
-    if (relative20 === "update.json") {
+    if (relative21 === "update.json") {
       const expoProtocolVersion = request.headers.get("expo-protocol-version");
       const expoProtocol = expoProtocolVersion !== null;
       if (expoProtocol && expoProtocolVersion !== "1")
@@ -21523,7 +21523,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
         }
       });
     }
-    const match = /^(amu_[a-f0-9]{64})\/files\/(.+)$/.exec(relative20);
+    const match = /^(amu_[a-f0-9]{64})\/files\/(.+)$/.exec(relative21);
     if (!match?.[1] || !match[2])
       return new Response(null, { status: 404 });
     const file = await options.registry.readUpdateFile({
@@ -21616,15 +21616,15 @@ import {
   createPublicKey as createPublicKey3,
   X509Certificate as X509Certificate4
 } from "crypto";
-import { access as access19, mkdir as mkdir21 } from "fs/promises";
-import { dirname as dirname22, isAbsolute as isAbsolute11, relative as relative20, resolve as resolve22, sep as sep13 } from "path";
+import { access as access20, mkdir as mkdir22 } from "fs/promises";
+import { dirname as dirname22, isAbsolute as isAbsolute12, relative as relative21, resolve as resolve23, sep as sep14 } from "path";
 import { pathToFileURL as pathToFileURL5 } from "url";
 import { Elysia as Elysia4 } from "elysia";
 var ABSOLUTE_MOBILE_UPDATE_SERVER_FORMAT = 1, DEFAULT_MOBILE_UPDATE_REGISTRY_MODULE = "mobile.update.ts", object7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), projectPath3 = (projectRoot, requested) => {
-  const root = resolve22(projectRoot);
-  const path2 = resolve22(root, requested);
-  const projectRelative = relative20(root, path2);
-  if (projectRelative === ".." || projectRelative.startsWith(`..${sep13}`) || isAbsolute11(projectRelative))
+  const root = resolve23(projectRoot);
+  const path2 = resolve23(root, requested);
+  const projectRelative = relative21(root, path2);
+  if (projectRelative === ".." || projectRelative.startsWith(`..${sep14}`) || isAbsolute12(projectRelative))
     throw new TypeError("mobile.updates.server.registry must remain inside the project.");
   return path2;
 }, isRegistry4 = (value) => object7(value) && [
@@ -21647,7 +21647,7 @@ var ABSOLUTE_MOBILE_UPDATE_SERVER_FORMAT = 1, DEFAULT_MOBILE_UPDATE_REGISTRY_MOD
   return metadata;
 }, loadAbsoluteMobileUpdateServerModule = async (projectRoot, requestedModulePath = DEFAULT_MOBILE_UPDATE_REGISTRY_MODULE) => {
   const modulePath = projectPath3(projectRoot, requestedModulePath);
-  await access19(modulePath).catch(() => {
+  await access20(modulePath).catch(() => {
     throw new TypeError(`Mobile update server registry does not exist: ${modulePath}. Run \`absolute mobile update provision\`.`);
   });
   const loaded = await import(pathToFileURL5(modulePath).href);
@@ -21836,13 +21836,13 @@ ${generated}`);
 }, writeAbsoluteMobileUpdateRegistry = async (options) => {
   const path2 = projectPath3(options.projectRoot, options.modulePath ?? DEFAULT_MOBILE_UPDATE_REGISTRY_MODULE);
   if (!options.force) {
-    await access19(path2).then(() => {
+    await access20(path2).then(() => {
       throw new TypeError(`Mobile update registry already exists: ${path2}. Pass --force to replace it.`);
     }, () => {
       return;
     });
   }
-  await mkdir21(dirname22(path2), { recursive: true });
+  await mkdir22(dirname22(path2), { recursive: true });
   await Bun.write(path2, renderAbsoluteMobileUpdateRegistry({
     ...options.health ? { health: options.health } : {},
     ...options.rollout ? { rollout: options.rollout } : {},
@@ -35247,9 +35247,412 @@ init_pageProtocol();
 init_producerContext();
 init_releaseArtifact();
 
+// src/mobile/releaseCertification.ts
+import { createHash as createHash16 } from "crypto";
+import {
+  access as access17,
+  mkdir as mkdir20,
+  mkdtemp as mkdtemp10,
+  readFile as readFile26,
+  rename as rename18,
+  rm as rm15,
+  writeFile as writeFile22
+} from "fs/promises";
+import { basename as basename8, isAbsolute as isAbsolute9, join as join30, relative as relative16, resolve as resolve18, sep as sep11 } from "path";
+var ABSOLUTE_MOBILE_RELEASE_CERTIFICATION_FORMAT = 1;
+var CERTIFICATION_PREFIX = "amobile_cert_";
+var SHA256 = /^[a-f0-9]{64}$/u;
+var STRENGTH_RANK = {
+  device: 1,
+  installed: 0,
+  simulator: 0,
+  store: 2
+};
+var isRequirement = (value) => value === "installed" || value === "simulator" || value === "device" || value === "store";
+var isStrength = (value) => value === "installed" || value === "simulator" || value === "device" || value === "store";
+var isArtifactExactness = (value) => value === "archive-equivalent" || value === "source-equivalent" || value === "store-delivered";
+var isDistribution = (value) => value === "apple-processed" || value === "registered-device" || value === "simulator-release";
+var isRecord14 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var inside4 = (root, candidate) => {
+  const path = relative16(resolve18(root), resolve18(candidate));
+  return path === "" || !isAbsolute9(path) && path !== ".." && !path.startsWith(`..${sep11}`);
+};
+var exists9 = async (path) => {
+  try {
+    await access17(path);
+    return true;
+  } catch {
+    return false;
+  }
+};
+var sha2564 = (bytes) => createHash16("sha256").update(bytes).digest("hex");
+var requireString2 = (value, name) => {
+  if (typeof value !== "string" || !value)
+    throw new TypeError(`Mobile certification ${name} is invalid.`);
+  return value;
+};
+var requirePositiveInteger = (value, name) => {
+  if (!Number.isSafeInteger(value) || Number(value) < 1)
+    throw new TypeError(`Mobile certification ${name} is invalid.`);
+  return Number(value);
+};
+var resolveEvidencePath = async (projectRoot, requested) => {
+  const selected = resolve18(projectRoot, requested);
+  if (!inside4(projectRoot, selected))
+    throw new TypeError("Mobile certification evidence must remain inside the project.");
+  if (basename8(selected) === "report.json")
+    return selected;
+  const report = join30(selected, "report.json");
+  if (!await exists9(report))
+    throw new TypeError(`Mobile certification evidence does not contain report.json: ${requested}`);
+  return report;
+};
+var releaseIdentity = (release) => {
+  const { metadata } = release;
+  if (!metadata.signed)
+    throw new TypeError("Mobile release certification requires a signed native release.");
+  const common = {
+    appBuild: metadata.appBuild,
+    appId: metadata.appId,
+    artifactBytes: metadata.bytes,
+    artifactSha256: metadata.sha256,
+    engine: metadata.engine,
+    platform: metadata.platform,
+    releaseId: metadata.releaseId,
+    runtime: metadata.runtime,
+    signed: true
+  };
+  if (metadata.platform === "android")
+    return {
+      ...common,
+      ...metadata.versionCode === undefined ? {} : { versionCode: metadata.versionCode }
+    };
+  return {
+    ...common,
+    ...metadata.buildNumber === undefined ? {} : { buildNumber: metadata.buildNumber },
+    marketingVersion: metadata.marketingVersion
+  };
+};
+var requireCheck = (report, id, accepted = ["PASS"]) => {
+  const checks = report.automatedChecks;
+  if (!Array.isArray(checks))
+    throw new TypeError("Mobile certification evidence has invalid automated checks.");
+  const check = checks.find((candidate) => isRecord14(candidate) && candidate.id === id);
+  if (!isRecord14(check) || !accepted.includes(String(check.result)))
+    throw new TypeError(`Mobile certification evidence does not satisfy ${id}.`);
+};
+var validateCommonReport = (report, release) => {
+  if (report.reportVersion !== 1 || report.platform !== release.platform || !isRecord14(report.metadata) || report.metadata.provider !== release.engine || !isRecord14(report.run) || report.run.status !== "pass" || report.run.appId !== release.appId)
+    throw new TypeError("Mobile certification evidence does not match the release platform, provider, application, or successful-run contract.");
+  requireCheck(report, "AUTO-DEV-01");
+  return {
+    generatedAt: requireString2(report.generatedAt, "evidence generatedAt"),
+    run: report.run
+  };
+};
+var validateReleaseFields = (value, release) => {
+  if (value.releaseId !== release.releaseId || value.artifactSha256 !== release.artifactSha256 || value.artifactBytes !== release.artifactBytes || value.engine !== release.engine || value.signed !== true)
+    throw new TypeError("Mobile certification evidence does not match the immutable release identity.");
+};
+var validateAndroidEvidence = (report, run, release, reportSha256, generatedAt) => {
+  if (!isRecord14(run.release))
+    throw new TypeError("Android certification evidence has no installed release result.");
+  validateReleaseFields(run.release, release);
+  if (run.release.embeddedOffline !== true)
+    throw new TypeError("Android certification evidence did not prove embedded offline relaunch.");
+  requireCheck(report, "AUTO-RELEASE-01");
+  requireCheck(report, "AUTO-RELEASE-OFFLINE-01");
+  return {
+    generatedAt,
+    networkUnavailable: "proven",
+    remote: false,
+    reportSha256,
+    strength: "installed"
+  };
+};
+var validateIosEvidence = (report, run, release, reportSha256, generatedAt) => {
+  if (!isRecord14(run.iosRelease))
+    throw new TypeError("iOS certification evidence has no installed release result.");
+  const ios = run.iosRelease;
+  validateReleaseFields(ios, release);
+  if (ios.embeddedLocal !== true)
+    throw new TypeError("iOS certification evidence did not prove embedded local rendering.");
+  requireCheck(report, "AUTO-IOS-RELEASE-01");
+  let strength;
+  if (ios.distribution === "simulator-release" && ios.artifactExactness === "source-equivalent" && run.targetKind === "simulator" && ios.networkUnavailable === "not-proven")
+    strength = "simulator";
+  else if (ios.distribution === "registered-device" && ios.artifactExactness === "archive-equivalent" && run.targetKind === "device" && ios.networkUnavailable === "user-confirmed")
+    strength = "device";
+  else if (ios.distribution === "apple-processed" && ios.artifactExactness === "store-delivered" && run.targetKind === "device" && ios.networkUnavailable === "user-confirmed")
+    strength = "store";
+  else
+    throw new TypeError("iOS certification evidence contains an invalid target, distribution, exactness, or offline-strength combination.");
+  if (strength === "simulator")
+    requireCheck(report, "AUTO-IOS-RELEASE-OFFLINE-01", ["SKIPPED"]);
+  else
+    requireCheck(report, "AUTO-IOS-RELEASE-OFFLINE-01");
+  return {
+    artifactExactness: ios.artifactExactness,
+    distribution: ios.distribution,
+    generatedAt,
+    networkUnavailable: ios.networkUnavailable === "user-confirmed" ? "proven" : "not-proven",
+    remote: ios.remote === true,
+    reportSha256,
+    strength
+  };
+};
+var validateEvidence = async (projectRoot, requested, release) => {
+  const path = await resolveEvidencePath(projectRoot, requested);
+  const bytes = await readFile26(path);
+  let value;
+  try {
+    value = JSON.parse(bytes.toString("utf8"));
+  } catch {
+    throw new TypeError("Mobile certification evidence report is not valid JSON.");
+  }
+  if (!isRecord14(value))
+    throw new TypeError("Mobile certification evidence report must contain an object.");
+  const { generatedAt, run } = validateCommonReport(value, release);
+  const digest = sha2564(bytes);
+  return release.platform === "android" ? validateAndroidEvidence(value, run, release, digest, generatedAt) : validateIosEvidence(value, run, release, digest, generatedAt);
+};
+var defaultRequirement = (platform4) => platform4 === "android" ? "installed" : "simulator";
+var validateRequirement = (platform4, requirement) => {
+  if (platform4 === "android" && requirement !== "installed")
+    throw new TypeError("Android certification currently uses its fixed installed/offline requirement; --require simulator, device, and store are iOS policies.");
+  if (platform4 === "ios" && requirement === "installed")
+    throw new TypeError("iOS certification requires simulator, device, or store evidence.");
+};
+var satisfiesRequirement = (strength, requirement) => {
+  if (requirement === "installed")
+    return strength === "installed";
+  if (strength === "installed")
+    return false;
+  return STRENGTH_RANK[strength] >= STRENGTH_RANK[requirement];
+};
+var validateCertifiedEvidence = (platform4, evidence) => {
+  if (platform4 === "android") {
+    if (evidence.strength !== "installed" || evidence.networkUnavailable !== "proven" || evidence.artifactExactness !== undefined || evidence.distribution !== undefined || evidence.remote)
+      throw new TypeError("Android release certification contains invalid evidence strength.");
+    return;
+  }
+  const simulator = evidence.strength === "simulator" && evidence.artifactExactness === "source-equivalent" && evidence.distribution === "simulator-release" && evidence.networkUnavailable === "not-proven";
+  const device = evidence.strength === "device" && evidence.artifactExactness === "archive-equivalent" && evidence.distribution === "registered-device" && evidence.networkUnavailable === "proven";
+  const store = evidence.strength === "store" && evidence.artifactExactness === "store-delivered" && evidence.distribution === "apple-processed" && evidence.networkUnavailable === "proven";
+  if (!simulator && !device && !store)
+    throw new TypeError("iOS release certification contains invalid evidence strength.");
+};
+var canonicalJsonValue = (value) => {
+  if (Array.isArray(value))
+    return value.map(canonicalJsonValue);
+  if (!isRecord14(value))
+    return value;
+  const sorted = {};
+  for (const key of Object.keys(value).sort())
+    sorted[key] = canonicalJsonValue(value[key]);
+  return sorted;
+};
+var certificationBody = (certification) => JSON.stringify(canonicalJsonValue(certification));
+var createAbsoluteMobileReleaseCertification = async (options) => {
+  if (options.evidencePaths.length === 0)
+    throw new TypeError("Mobile release certification requires at least one --evidence report.");
+  const release = releaseIdentity(options.release);
+  const requirement = options.requirement ?? defaultRequirement(release.platform);
+  validateRequirement(release.platform, requirement);
+  const evidence = await Promise.all(options.evidencePaths.map((path) => validateEvidence(options.projectRoot, path, release)));
+  evidence.sort((left, right) => left.reportSha256.localeCompare(right.reportSha256));
+  const [firstEvidence] = evidence;
+  if (!firstEvidence)
+    throw new TypeError("Mobile release certification requires valid evidence.");
+  const strength = evidence.reduce((strongest, candidate) => STRENGTH_RANK[candidate.strength] > STRENGTH_RANK[strongest] ? candidate.strength : strongest, firstEvidence.strength);
+  if (!satisfiesRequirement(strength, requirement))
+    throw new TypeError(`Mobile release evidence strength ${strength} does not satisfy required ${requirement} certification.`);
+  const body = {
+    evidence,
+    format: ABSOLUTE_MOBILE_RELEASE_CERTIFICATION_FORMAT,
+    generatedAt: options.generatedAt ?? evidence.reduce((latest, candidate) => candidate.generatedAt > latest ? candidate.generatedAt : latest, firstEvidence.generatedAt),
+    release,
+    requirement,
+    status: "certified",
+    strength
+  };
+  return {
+    certificationId: `${CERTIFICATION_PREFIX}${sha2564(certificationBody(body))}`,
+    ...body
+  };
+};
+var parseCertification = (value) => {
+  if (!isRecord14(value) || value.format !== ABSOLUTE_MOBILE_RELEASE_CERTIFICATION_FORMAT || value.status !== "certified" || !isRecord14(value.release) || !Array.isArray(value.evidence))
+    throw new TypeError("Mobile release certification contract is invalid.");
+  const { release } = value;
+  const { platform: platform4 } = release;
+  const { engine } = release;
+  if (platform4 !== "android" && platform4 !== "ios" || engine !== "capacitor" && engine !== "expo" || release.signed !== true)
+    throw new TypeError("Mobile release certification identity is invalid.");
+  const { requirement } = value;
+  const { strength } = value;
+  if (!isRequirement(requirement) || !isStrength(strength))
+    throw new TypeError("Mobile release certification policy is invalid.");
+  validateRequirement(platform4, requirement);
+  if (!satisfiesRequirement(strength, requirement))
+    throw new TypeError("Mobile release certification does not satisfy its declared policy.");
+  const artifactBytes = requirePositiveInteger(release.artifactBytes, "release artifactBytes");
+  const artifactSha256 = requireString2(release.artifactSha256, "release artifactSha256");
+  if (!SHA256.test(artifactSha256))
+    throw new TypeError("Mobile release certification artifact digest is invalid.");
+  const parsedRelease = {
+    appBuild: requireString2(release.appBuild, "release appBuild"),
+    appId: requireString2(release.appId, "release appId"),
+    artifactBytes,
+    artifactSha256,
+    engine,
+    platform: platform4,
+    releaseId: requireString2(release.releaseId, "release releaseId"),
+    runtime: requireString2(release.runtime, "release runtime"),
+    signed: true,
+    ...release.buildNumber === undefined ? {} : {
+      buildNumber: requirePositiveInteger(release.buildNumber, "release buildNumber")
+    },
+    ...release.marketingVersion === undefined ? {} : {
+      marketingVersion: requireString2(release.marketingVersion, "release marketingVersion")
+    },
+    ...release.versionCode === undefined ? {} : {
+      versionCode: requirePositiveInteger(release.versionCode, "release versionCode")
+    }
+  };
+  const evidence = value.evidence.map((candidate) => {
+    if (!isRecord14(candidate) || !SHA256.test(String(candidate.reportSha256)) || !isStrength(candidate.strength) || candidate.networkUnavailable !== "not-proven" && candidate.networkUnavailable !== "proven" || typeof candidate.remote !== "boolean" || typeof candidate.generatedAt !== "string" || candidate.artifactExactness !== undefined && !isArtifactExactness(candidate.artifactExactness) || candidate.distribution !== undefined && !isDistribution(candidate.distribution))
+      throw new TypeError("Mobile release certification evidence is invalid.");
+    const parsedEvidence = {
+      generatedAt: candidate.generatedAt,
+      networkUnavailable: candidate.networkUnavailable,
+      remote: candidate.remote,
+      reportSha256: String(candidate.reportSha256),
+      strength: candidate.strength,
+      ...candidate.artifactExactness === undefined ? {} : {
+        artifactExactness: candidate.artifactExactness
+      },
+      ...candidate.distribution === undefined ? {} : { distribution: candidate.distribution }
+    };
+    validateCertifiedEvidence(platform4, parsedEvidence);
+    return parsedEvidence;
+  });
+  const strongestEvidence = evidence.reduce((strongest, candidate) => STRENGTH_RANK[candidate.strength] > STRENGTH_RANK[strongest] ? candidate.strength : strongest, evidence[0]?.strength ?? "installed");
+  if (evidence.length === 0 || strongestEvidence !== strength)
+    throw new TypeError("Mobile release certification evidence does not support its declared strength.");
+  const parsed = {
+    certificationId: requireString2(value.certificationId, "certificationId"),
+    evidence,
+    format: ABSOLUTE_MOBILE_RELEASE_CERTIFICATION_FORMAT,
+    generatedAt: requireString2(value.generatedAt, "generatedAt"),
+    release: parsedRelease,
+    requirement,
+    status: "certified",
+    strength
+  };
+  const { certificationId, ...body } = parsed;
+  if (certificationId !== `${CERTIFICATION_PREFIX}${sha2564(certificationBody(body))}`)
+    throw new TypeError("Mobile release certification content digest is invalid.");
+  return parsed;
+};
+var readAbsoluteMobileReleaseCertification = async (projectRoot, requested) => {
+  const selected = resolve18(projectRoot, requested);
+  if (!inside4(projectRoot, selected))
+    throw new TypeError("Mobile release certification must remain inside the project.");
+  const path = basename8(selected) === "certification.json" ? selected : join30(selected, "certification.json");
+  const value = JSON.parse(await readFile26(path, "utf8"));
+  return { certification: parseCertification(value), path };
+};
+var renderAbsoluteMobileReleaseCertification = (certification) => {
+  const { release } = certification;
+  const version = release.platform === "ios" ? `${release.marketingVersion ?? "unknown"} (${release.buildNumber ?? "unallocated"})` : String(release.versionCode ?? "unallocated");
+  const evidence = certification.evidence.map((item) => `| ${item.strength} | ${item.networkUnavailable} | ${item.remote ? "paired Mac" : "local host"} | ${item.reportSha256} |`).join(`
+`);
+  return `# AbsoluteJS mobile release certification
+
+- Status: CERTIFIED
+- Certification: ${certification.certificationId}
+- Generated: ${certification.generatedAt}
+- Platform: ${release.platform}
+- Engine: ${release.engine}
+- Requirement: ${certification.requirement}
+- Evidence strength: ${certification.strength}
+- Release: ${release.releaseId}
+- Artifact SHA-256: ${release.artifactSha256}
+- Runtime fingerprint: ${release.runtime}
+- Embedded app build: ${release.appBuild}
+- Version/build: ${version}
+
+This certification is local and contains no signing credentials, device identifiers, SSH destinations, report paths, application data, or page contents. Re-run verification against the immutable release before using it as a CI or promotion gate.
+
+| Strength | Network unavailable | Execution | Report SHA-256 |
+| --- | --- | --- | --- |
+${evidence}
+`;
+};
+var verifyAbsoluteMobileReleaseCertification = (certification, release, requirement) => {
+  const parsed = parseCertification(certification);
+  const expected = releaseIdentity(release);
+  if (JSON.stringify(parsed.release) !== JSON.stringify(expected))
+    throw new TypeError("Mobile release certification was invalidated by a release identity, artifact, runtime, signing, version, build, or embedded-bundle change.");
+  if (requirement) {
+    validateRequirement(expected.platform, requirement);
+    if (!satisfiesRequirement(parsed.strength, requirement))
+      throw new TypeError(`Mobile release certification strength ${parsed.strength} does not satisfy required ${requirement} policy.`);
+  }
+  return parsed;
+};
+var writeAbsoluteMobileReleaseCertification = async (projectRoot, certification, outputDirectory) => {
+  const root = resolve18(projectRoot);
+  const parent = resolve18(root, outputDirectory ?? join30(".absolutejs", "mobile", "certifications", certification.release.platform, certification.release.releaseId));
+  if (!inside4(root, parent))
+    throw new TypeError("Mobile certification output must remain inside the project.");
+  await mkdir20(parent, { recursive: true });
+  const destination = join30(parent, certification.certificationId);
+  const paths = {
+    directory: destination,
+    jsonPath: join30(destination, "certification.json"),
+    markdownPath: join30(destination, "certification.md")
+  };
+  const json = `${JSON.stringify(certification, null, 2)}
+`;
+  const markdown = renderAbsoluteMobileReleaseCertification(certification);
+  const verifyExisting = async () => {
+    const [existingJson, existingMarkdown] = await Promise.all([
+      readFile26(paths.jsonPath, "utf8"),
+      readFile26(paths.markdownPath, "utf8")
+    ]);
+    if (existingJson !== json || existingMarkdown !== markdown)
+      throw new TypeError(`Immutable mobile certification ${certification.certificationId} already exists with different content.`);
+  };
+  if (await exists9(destination)) {
+    await verifyExisting();
+    return paths;
+  }
+  const staging = await mkdtemp10(join30(parent, ".certification-"));
+  try {
+    await Promise.all([
+      writeFile22(join30(staging, "certification.json"), json, {
+        flag: "wx"
+      }),
+      writeFile22(join30(staging, "certification.md"), markdown, {
+        flag: "wx"
+      })
+    ]);
+    await rename18(staging, destination).catch(async (error) => {
+      if (await exists9(destination))
+        return;
+      throw error;
+    });
+  } finally {
+    await rm15(staging, { force: true, recursive: true });
+  }
+  await verifyExisting();
+  return paths;
+};
 // src/mobile/releasePublisher.ts
-import { access as access17 } from "fs/promises";
-import { isAbsolute as isAbsolute9, relative as relative16, resolve as resolve18, sep as sep11 } from "path";
+import { access as access18 } from "fs/promises";
+import { isAbsolute as isAbsolute10, relative as relative17, resolve as resolve19, sep as sep12 } from "path";
 import { pathToFileURL as pathToFileURL3 } from "url";
 var prepareAbsoluteIosRelease = async (publisher, options) => {
   if (typeof publisher.prepareIosRelease !== "function") {
@@ -35272,24 +35675,24 @@ var prepareAbsoluteAndroidRelease = async (publisher, options) => {
   }
   return versionCode;
 };
-var isRecord14 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var isPublisher = (value) => isRecord14(value) && typeof value.publish === "function";
+var isRecord15 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isPublisher = (value) => isRecord15(value) && typeof value.publish === "function";
 var publisherModulePath = (projectRoot, requested) => {
-  const root = resolve18(projectRoot);
-  const path = resolve18(root, requested);
-  const projectRelative = relative16(root, path);
-  if (projectRelative === ".." || projectRelative.startsWith(`..${sep11}`) || isAbsolute9(projectRelative)) {
+  const root = resolve19(projectRoot);
+  const path = resolve19(root, requested);
+  const projectRelative = relative17(root, path);
+  if (projectRelative === ".." || projectRelative.startsWith(`..${sep12}`) || isAbsolute10(projectRelative)) {
     throw new TypeError("mobile publish --registry must remain inside the project.");
   }
   return path;
 };
 var loadAbsoluteNativeReleasePublisher = async (projectRoot, requestedModulePath) => {
   const modulePath = publisherModulePath(projectRoot, requestedModulePath);
-  await access17(modulePath).catch(() => {
+  await access18(modulePath).catch(() => {
     throw new TypeError(`Native release registry module does not exist: ${modulePath}`);
   });
   const loaded = await import(pathToFileURL3(modulePath).href);
-  const publisher = isRecord14(loaded) ? loaded.default ?? loaded.registry : undefined;
+  const publisher = isRecord15(loaded) ? loaded.default ?? loaded.registry : undefined;
   if (!isPublisher(publisher)) {
     throw new TypeError("Native release registry module must default-export a registry with publish(options).");
   }
@@ -35349,7 +35752,7 @@ var publishAbsoluteIosRelease = async (options) => {
 init_pageProtocol();
 init_releaseArtifact();
 import { existsSync as existsSync7, readFileSync as readFileSync8 } from "fs";
-import { dirname as dirname20, extname as extname6, relative as relative17, resolve as resolve19 } from "path";
+import { dirname as dirname20, extname as extname6, relative as relative18, resolve as resolve20 } from "path";
 import ts2 from "typescript";
 var ROUTE_METHODS = new Set(["get", "head"]);
 var SOURCE_FILTER = /\.[cm]?[jt]sx?$/;
@@ -35518,7 +35921,7 @@ var resolvePageIdentity = (expression, sourceFile, checker, projectRoot) => {
   const declaration = symbol?.declarations?.[0];
   const file = declaration?.getSourceFile().fileName ?? sourceFile.fileName;
   const exportedName = symbol?.name ?? expression.getText(sourceFile);
-  const source = posixPath(relative17(projectRoot, file));
+  const source = posixPath(relative18(projectRoot, file));
   return `${source}#${exportedName}`;
 };
 var resolveAlias = (symbol, checker) => {
@@ -35757,7 +36160,7 @@ var analyzeProgram = (program, projectRoot) => {
   const checker = program.getTypeChecker();
   const analyzed = new Map;
   for (const sourceFile of program.getSourceFiles()) {
-    const resolvedFile = resolve19(sourceFile.fileName);
+    const resolvedFile = resolve20(sourceFile.fileName);
     if (!isProjectSource(sourceFile, resolvedFile, projectRoot))
       continue;
     const analysis = analyzeSourceFile(sourceFile, checker, projectRoot);
@@ -35850,14 +36253,14 @@ var transformFile = (source, fileName, analysis) => {
 };
 var ABSOLUTE_MOBILE_TRANSFORM_PROTOCOL = ABSOLUTE_MOBILE_PAGE_PROTOCOL_VERSION;
 var createAbsoluteMobileRouteMetadataPlugin = (options) => {
-  const projectRoot = resolve19(options.projectRoot ?? process.cwd());
-  const entry = resolve19(options.entry);
+  const projectRoot = resolve20(options.projectRoot ?? process.cwd());
+  const entry = resolve20(options.entry);
   const analyzed = analyzeProgram(createProgram(entry, projectRoot), projectRoot);
   return {
     name: "absolute-mobile-route-metadata",
     setup(build) {
       build.onLoad({ filter: SOURCE_FILTER }, async ({ path }) => {
-        const analysis = analyzed.get(resolve19(path));
+        const analysis = analyzed.get(resolve20(path));
         if (!analysis)
           return;
         const source = await Bun.file(path).text();
@@ -35870,11 +36273,11 @@ var createAbsoluteMobileRouteMetadataPlugin = (options) => {
   };
 };
 var inspectAbsoluteMobileRouteMetadata = (options) => {
-  const projectRoot = resolve19(options.projectRoot ?? process.cwd());
-  const entry = resolve19(options.entry);
+  const projectRoot = resolve20(options.projectRoot ?? process.cwd());
+  const entry = resolve20(options.entry);
   const analyzed = analyzeProgram(createProgram(entry, projectRoot), projectRoot);
   return [...analyzed.entries()].flatMap(([file, analysis]) => [...analysis.byRouteCall.values()].map(({ metadata }) => ({
-    file: posixPath(relative17(projectRoot, file)),
+    file: posixPath(relative18(projectRoot, file)),
     metadata
   })));
 };
@@ -36208,7 +36611,7 @@ var createCapacitor = (win) => {
           callbackId
         }, callback);
       };
-      const p = new Promise((resolve20) => call.then(() => resolve20({ remove })));
+      const p = new Promise((resolve21) => call.then(() => resolve21({ remove })));
       p.remove = async () => {
         console.warn(`Using addListener() without 'await' is deprecated.`);
         await remove();
@@ -36413,11 +36816,11 @@ class CapacitorCookiesPluginWeb extends WebPlugin {
 var CapacitorCookies = registerPlugin("CapacitorCookies", {
   web: () => new CapacitorCookiesPluginWeb
 });
-var readBlobAsBase64 = async (blob) => new Promise((resolve20, reject) => {
+var readBlobAsBase64 = async (blob) => new Promise((resolve21, reject) => {
   const reader = new FileReader;
   reader.onload = () => {
     const base64String = reader.result;
-    resolve20(base64String.indexOf(",") >= 0 ? base64String.split(",")[1] : base64String);
+    resolve21(base64String.indexOf(",") >= 0 ? base64String.split(",")[1] : base64String);
   };
   reader.onerror = (error) => reject(error);
   reader.readAsDataURL(blob);
@@ -36593,7 +36996,7 @@ var REPORT_KINDS = new Set([
   "signal"
 ]);
 var nativeObservability = registerPlugin("AbsoluteMobileObservability");
-var isRecord15 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isRecord16 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var redactText = (value) => value.slice(0, MAX_STRING_LENGTH).replace(/\b(Bearer)\s+[A-Za-z0-9._~+/-]+=*/giu, "$1 [REDACTED]").replace(/([?&](?:access_token|api_?key|authorization|code|id_token|password|refresh_token|secret|token)=)[^&#\s]*/giu, "$1[REDACTED]").replace(/\b((?:access_?token|api_?key|authorization|client_?secret|cookie|id_?token|password|passwd|refresh_?token|secret|token)\s*[:=]\s*)[^,\s;]+/giu, "$1[REDACTED]").replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, "[REDACTED]");
 var redactValue = (value, depth = 0) => {
   if (depth >= MAX_REDACTION_DEPTH)
@@ -36604,7 +37007,7 @@ var redactValue = (value, depth = 0) => {
     return value;
   if (Array.isArray(value))
     return value.slice(0, 64).map((entry) => redactValue(entry, depth + 1));
-  if (!isRecord15(value))
+  if (!isRecord16(value))
     return String(value).slice(0, MAX_STRING_LENGTH);
   return Object.fromEntries(Object.entries(value).slice(0, 128).map(([key, entry]) => [
     key,
@@ -36612,7 +37015,7 @@ var redactValue = (value, depth = 0) => {
   ]));
 };
 var parseReport = (value) => {
-  if (!isRecord15(value) || !isRecord15(value.details))
+  if (!isRecord16(value) || !isRecord16(value.details))
     return;
   if (typeof value.id !== "string" || !REPORT_ID.test(value.id))
     return;
@@ -36623,7 +37026,7 @@ var parseReport = (value) => {
   if (value.platform !== "android" && value.platform !== "ios")
     return;
   const details = redactValue(value.details);
-  if (!isRecord15(details))
+  if (!isRecord16(details))
     return;
   if (new TextEncoder().encode(JSON.stringify(details)).byteLength > MAX_DETAIL_BYTES)
     return;
@@ -41077,8 +41480,8 @@ var createBeacon = (options) => {
         if (await fontAvailable(element))
           return;
         if (confirmationMs > 0) {
-          await new Promise((resolve20) => {
-            const timer2 = window.setTimeout(resolve20, confirmationMs);
+          await new Promise((resolve21) => {
+            const timer2 = window.setTimeout(resolve21, confirmationMs);
             cleanups.push(() => window.clearTimeout(timer2));
           });
           if (document.visibilityState === "hidden")
@@ -42066,51 +42469,51 @@ var createAbsoluteMobileUpdateClient = (options) => {
   };
 };
 // src/mobile/updatePublisher.ts
-import { access as access18 } from "fs/promises";
-import { isAbsolute as isAbsolute10, relative as relative19, resolve as resolve21, sep as sep12 } from "path";
+import { access as access19 } from "fs/promises";
+import { isAbsolute as isAbsolute11, relative as relative20, resolve as resolve22, sep as sep13 } from "path";
 import { pathToFileURL as pathToFileURL4 } from "url";
 
 // src/mobile/updateSigning.ts
-import { createHash as createHash16, sign, verify } from "crypto";
+import { createHash as createHash17, sign, verify } from "crypto";
 import {
   cp as cp2,
-  mkdir as mkdir20,
-  mkdtemp as mkdtemp10,
+  mkdir as mkdir21,
+  mkdtemp as mkdtemp11,
   readdir as readdir10,
-  readFile as readFile26,
-  rename as rename18,
-  rm as rm15,
+  readFile as readFile27,
+  rename as rename19,
+  rm as rm16,
   stat as stat6,
-  writeFile as writeFile22
+  writeFile as writeFile23
 } from "fs/promises";
-import { dirname as dirname21, join as join30, relative as relative18, resolve as resolve20 } from "path";
+import { dirname as dirname21, join as join31, relative as relative19, resolve as resolve21 } from "path";
 var UPDATE_MANIFEST_FILE = "update.json";
 var UPDATE_FILES_DIRECTORY = "files";
-var sha2564 = (value) => createHash16("sha256").update(value).digest("hex");
+var sha2565 = (value) => createHash17("sha256").update(value).digest("hex");
 var listFiles = async (root, directory = root) => {
   const entries = await readdir10(directory, { withFileTypes: true });
   const paths = await Promise.all(entries.map(async (entry) => {
-    const path = join30(directory, entry.name);
+    const path = join31(directory, entry.name);
     if (entry.isDirectory())
       return listFiles(root, path);
     if (!entry.isFile())
       throw new TypeError("Mobile updates cannot contain links or special files.");
-    return [relative18(root, path).replaceAll("\\", "/")];
+    return [relative19(root, path).replaceAll("\\", "/")];
   }));
   return paths.flat().sort((left, right) => left.localeCompare(right));
 };
 var inspectFiles = async (root, paths) => Promise.all(paths.map(async (path) => {
-  const source = join30(root, path);
+  const source = join31(root, path);
   const [metadata, contents] = await Promise.all([
     stat6(source),
-    readFile26(source)
+    readFile27(source)
   ]);
-  return { bytes: metadata.size, path, sha256: sha2564(contents) };
+  return { bytes: metadata.size, path, sha256: sha2565(contents) };
 }));
-var releaseIdFor = (value) => `amu_${sha2564(canonicalizeAbsoluteMobileUpdate(value))}`;
+var releaseIdFor = (value) => `amu_${sha2565(canonicalizeAbsoluteMobileUpdate(value))}`;
 var buildAbsoluteMobileUpdate = async (options) => {
-  const bundleDirectory = resolve20(options.bundleDirectory);
-  const outputRoot = resolve20(options.outputDirectory);
+  const bundleDirectory = resolve21(options.bundleDirectory);
+  const outputRoot = resolve21(options.outputDirectory);
   if (outputRoot === bundleDirectory || outputRoot.startsWith(`${bundleDirectory}/`))
     throw new TypeError("Mobile update output must be outside the embedded bundle.");
   const paths = await listFiles(bundleDirectory);
@@ -42138,38 +42541,38 @@ var buildAbsoluteMobileUpdate = async (options) => {
       value: signature.toString("base64")
     }
   });
-  await mkdir20(outputRoot, { recursive: true });
-  const outputDirectory = join30(outputRoot, manifest.releaseId);
-  const staging = await mkdtemp10(join30(outputRoot, ".stage-"));
+  await mkdir21(outputRoot, { recursive: true });
+  const outputDirectory = join31(outputRoot, manifest.releaseId);
+  const staging = await mkdtemp11(join31(outputRoot, ".stage-"));
   try {
-    await cp2(bundleDirectory, join30(staging, UPDATE_FILES_DIRECTORY), {
+    await cp2(bundleDirectory, join31(staging, UPDATE_FILES_DIRECTORY), {
       force: true,
       recursive: true
     });
-    await writeFile22(join30(staging, UPDATE_MANIFEST_FILE), `${JSON.stringify(manifest, null, "\t")}
+    await writeFile23(join31(staging, UPDATE_MANIFEST_FILE), `${JSON.stringify(manifest, null, "\t")}
 `);
-    await rename18(staging, outputDirectory);
+    await rename19(staging, outputDirectory);
   } catch (error) {
-    await rm15(staging, { force: true, recursive: true });
+    await rm16(staging, { force: true, recursive: true });
     if (typeof error === "object" && error !== null && Reflect.get(error, "code") === "EEXIST")
       throw new TypeError(`Mobile update ${manifest.releaseId} already exists.`, { cause: error });
     throw error;
   }
   return {
     manifest,
-    manifestPath: join30(outputDirectory, UPDATE_MANIFEST_FILE),
+    manifestPath: join31(outputDirectory, UPDATE_MANIFEST_FILE),
     outputDirectory
   };
 };
 var copyAbsoluteMobileUpdateFile = async (updateDirectory, path, destination) => {
-  const source = resolve20(updateDirectory, UPDATE_FILES_DIRECTORY, path);
-  const root = resolve20(updateDirectory, UPDATE_FILES_DIRECTORY);
+  const source = resolve21(updateDirectory, UPDATE_FILES_DIRECTORY, path);
+  const root = resolve21(updateDirectory, UPDATE_FILES_DIRECTORY);
   if (!source.startsWith(`${root}/`))
     throw new TypeError("Update file escaped its release.");
-  await mkdir20(dirname21(destination), { recursive: true });
+  await mkdir21(dirname21(destination), { recursive: true });
   await cp2(source, destination, { force: true });
 };
-var readAbsoluteMobileUpdate = async (directory) => parseAbsoluteMobileUpdateManifest(JSON.parse(await readFile26(join30(resolve20(directory), UPDATE_MANIFEST_FILE), "utf8")));
+var readAbsoluteMobileUpdate = async (directory) => parseAbsoluteMobileUpdateManifest(JSON.parse(await readFile27(join31(resolve21(directory), UPDATE_MANIFEST_FILE), "utf8")));
 var verifyAbsoluteMobileUpdateSignature = (manifestValue, publicKey) => {
   const manifest = parseAbsoluteMobileUpdateManifest(manifestValue);
   const valid = verify("sha256", absoluteMobileUpdateSigningPayload(unsignedAbsoluteMobileUpdate(manifest)), { dsaEncoding: "ieee-p1363", key: publicKey }, Buffer.from(manifest.signature.value, "base64"));
@@ -42286,16 +42689,16 @@ var pruneAbsoluteMobileUpdates = async (options) => {
 var object5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var isPublisher2 = (value) => object5(value) && typeof value.publishUpdate === "function" && typeof value.promoteUpdate === "function" && typeof value.rollbackUpdate === "function";
 var projectPath2 = (projectRoot, requested, label) => {
-  const root = resolve21(projectRoot);
-  const path = resolve21(root, requested);
-  const projectRelative = relative19(root, path);
-  if (projectRelative === ".." || projectRelative.startsWith(`..${sep12}`) || isAbsolute10(projectRelative))
+  const root = resolve22(projectRoot);
+  const path = resolve22(root, requested);
+  const projectRelative = relative20(root, path);
+  if (projectRelative === ".." || projectRelative.startsWith(`..${sep13}`) || isAbsolute11(projectRelative))
     throw new TypeError(`${label} must remain inside the project.`);
   return path;
 };
 var loadAbsoluteMobileUpdatePublisher = async (projectRoot, requestedModulePath) => {
   const modulePath = projectPath2(projectRoot, requestedModulePath, "mobile update registry");
-  await access18(modulePath).catch(() => {
+  await access19(modulePath).catch(() => {
     throw new TypeError(`Mobile update registry does not exist: ${modulePath}`);
   });
   const loaded = await import(pathToFileURL4(modulePath).href);
@@ -42346,7 +42749,7 @@ var rollbackAbsoluteMobileUpdate = async (options) => {
   return result;
 };
 // src/mobile/updateRollout.ts
-import { createHash as createHash17 } from "crypto";
+import { createHash as createHash18 } from "crypto";
 var UUID_PATTERN = /^[a-f0-9]{8}-[a-f0-9]{4}-[1-8][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/u;
 var requireHeader = (headers, name) => {
   const value = headers.get(name);
@@ -42361,7 +42764,7 @@ var isAbsoluteMobileUpdateRolloutMember = (options) => {
     return false;
   if (options.rollout === 1)
     return true;
-  const digest = createHash17("sha256").update(`${options.appId}\x00${options.channel}\x00${options.releaseId}\x00${options.installationId}`).digest();
+  const digest = createHash18("sha256").update(`${options.appId}\x00${options.channel}\x00${options.releaseId}\x00${options.installationId}`).digest();
   const bucket = digest.readUInt32BE(0) / 4294967296;
   return bucket < options.rollout;
 };
@@ -42408,6 +42811,7 @@ export {
   ABSOLUTE_MOBILE_PAGE_MEDIA_TYPE,
   ABSOLUTE_MOBILE_PAGE_PROTOCOL_VERSION,
   ABSOLUTE_MOBILE_PREVIEW_PATH,
+  ABSOLUTE_MOBILE_RELEASE_CERTIFICATION_FORMAT,
   ABSOLUTE_MOBILE_RETAINED_GENERATIONS,
   ABSOLUTE_MOBILE_ROUTE_DETAIL,
   ABSOLUTE_MOBILE_SHELL_ABI,
@@ -42493,6 +42897,7 @@ export {
   createAbsoluteMobilePageErrorResponse,
   createAbsoluteMobilePageRequest,
   createAbsoluteMobilePreviewPlugin,
+  createAbsoluteMobileReleaseCertification,
   createAbsoluteMobileRouteMetadataPlugin,
   createAbsoluteMobileUpdateClient,
   createAbsoluteMobileUpdateRuntimeDescriptor,
@@ -42602,10 +43007,12 @@ export {
   readAbsoluteIosRelease,
   readAbsoluteMobileLinkIntent,
   readAbsoluteMobileMaterializedReleases,
+  readAbsoluteMobileReleaseCertification,
   readAbsoluteMobileUpdate,
   reconcileAbsoluteMobileUpdateRollout,
   redactAbsoluteIosLog,
   removeAbsoluteRemoteMacProfile,
+  renderAbsoluteMobileReleaseCertification,
   renderAbsoluteMobileUpdateRegistry,
   repairAbsoluteIosDevSession,
   reportAbsoluteMobileUpdateHealth,
@@ -42645,13 +43052,15 @@ export {
   validateAbsoluteSshDestination,
   verifyAbsoluteMobileAssociationFiles,
   verifyAbsoluteMobileCompatibilityProducer,
+  verifyAbsoluteMobileReleaseCertification,
   verifyAbsoluteMobileUpdateSignature,
   waitForAbsoluteIosHmrLog,
   writeAbsoluteCapacitorConfig,
   writeAbsoluteExpoProject,
   writeAbsoluteMobileGithubWorkflow,
+  writeAbsoluteMobileReleaseCertification,
   writeAbsoluteMobileUpdateRegistry
 };
 
-//# debugId=45962AF96688DC1364756E2164756E21
+//# debugId=DB53CC7C8DF0442B64756E2164756E21
 //# sourceMappingURL=index.js.map