@absolutejs/absolute 0.20.0-beta.107 → 0.20.0-beta.109

package/dist/cli/{compile-hsbs1xf6.js → compile-1d5arbqj.js}

@@ -15,7 +15,7 @@ import {
   createIslandRegistryDefinitionPlugin,
   finalizeAbsoluteMobileCompatibilityBuild,
   resolveServerBundleExternals
-} from "./index-hrzd7e5x.js";
+} from "./index-dfqzrznk.js";
 import {
   loadIslandRegistryBuildInfo
 } from "./index-bzs19w3r.js";
@@ -35,7 +35,7 @@ import {
 import"./index-w5vswatm.js";
 import {
   normalizeAbsoluteMobileConfig
-} from "./index-rd2hbttb.js";
+} from "./index-df2mjbdy.js";
 import"./index-0zcebhm4.js";
 import {
   ABSOLUTE_NATIVE_AUTH_CLIENTS_ENV,

package/dist/cli/{config-vy04mqce.js → config-vq2qcc4p.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   normalizeAbsoluteMobileConfig
-} from "./index-rd2hbttb.js";
+} from "./index-df2mjbdy.js";
 import"./index-mywsk201.js";
 export {
   normalizeAbsoluteMobileConfig

package/dist/cli/{dev-f6b6hkke.js → dev-f0safhsr.js}

@@ -1285,7 +1285,7 @@ var loadAbsoluteMobileDevModules = async () => {
     iosNativeWatcher,
     expoNativeWatcher
   ] = await Promise.all([
-    import("./config-vy04mqce.js"),
+    import("./config-vq2qcc4p.js"),
     import("./expoProject-zkprmjjz.js"),
     import("./expoDevController-zz516pdd.js"),
     import("./nativeAuth-zx4tsb1f.js"),

package/dist/cli/{index-rd2hbttb.js → index-df2mjbdy.js}

@@ -8,6 +8,7 @@ var SCHEME_PATTERN = /^[a-z][a-z0-9+.-]*$/;
 var APPLE_APP_ID_PREFIX_PATTERN = /^[A-Z0-9]{10}$/;
 var CERTIFICATE_FINGERPRINT_PATTERN = /^[0-9A-F]{64}$/;
 var UPDATE_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
+var RELEASE_TARGET_PATTERN = /^[a-z0-9][a-z0-9._-]{0,63}$/u;
 var UPDATE_PUBLIC_KEY_PATTERN = /^[A-Za-z0-9+/]+={0,2}$/u;
 var ENVIRONMENT_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/u;
 var DEFAULT_UPDATE_BOOT_TIMEOUT_MS = 20000;
@@ -75,6 +76,57 @@ var normalizePlatforms = (platforms) => {
   }
   return normalized;
 };
+var normalizeAndroidCertificationPolicy = (value) => {
+  if (value === false || value === undefined)
+    return;
+  if (value !== "installed")
+    throw new TypeError("mobile.release.certification channel Android policy must be installed or false.");
+  return value;
+};
+var normalizeIosCertificationPolicy = (value) => {
+  if (value === false || value === undefined)
+    return;
+  if (!["simulator", "device", "store"].includes(value))
+    throw new TypeError("mobile.release.certification channel iOS policy must be simulator, device, store, or false.");
+  return value;
+};
+var normalizeReleaseCertification = (config) => {
+  const configured = config.release?.certification;
+  if (configured === false)
+    return { channels: {}, googlePlayTracks: {} };
+  const channels = {
+    production: { android: "installed", ios: "store" }
+  };
+  const googlePlayTracks = {
+    production: "installed"
+  };
+  for (const [name, policy] of Object.entries(configured?.channels ?? {})) {
+    if (!RELEASE_TARGET_PATTERN.test(name))
+      throw new TypeError("mobile.release.certification.channels contains an invalid channel.");
+    const normalized = {};
+    const android = normalizeAndroidCertificationPolicy(policy.android);
+    const ios = normalizeIosCertificationPolicy(policy.ios);
+    if (android)
+      normalized.android = android;
+    if (ios)
+      normalized.ios = ios;
+    channels[name] = normalized;
+  }
+  for (const [name, requirement] of Object.entries(configured?.googlePlayTracks ?? {})) {
+    if (!RELEASE_TARGET_PATTERN.test(name))
+      throw new TypeError("mobile.release.certification.googlePlayTracks contains an invalid track.");
+    if (requirement === false)
+      delete googlePlayTracks[name];
+    else if (requirement === "installed")
+      googlePlayTracks[name] = requirement;
+    else
+      throw new TypeError("mobile.release.certification Google Play policy must be installed or false.");
+  }
+  return {
+    channels: Object.fromEntries(Object.entries(channels).sort(([left], [right]) => left.localeCompare(right))),
+    googlePlayTracks: Object.fromEntries(Object.entries(googlePlayTracks).sort(([left], [right]) => left.localeCompare(right)))
+  };
+};
 var normalizeHosts = (hosts, productionOrigin) => {
   const normalizeHostname = (host) => {
     const value = requireText(host, "mobile.deepLinks.hosts").toLowerCase();
@@ -411,6 +463,7 @@ var normalizeAbsoluteMobileConfig = (config, projectRoot) => {
     platforms: normalizePlatforms(config.platforms),
     productionOrigin,
     pushAndroidGoogleServicesFile: resolveProjectPath(projectRoot, config.pushNotifications?.android?.googleServicesFile ?? "google-services.json", "mobile.pushNotifications.android.googleServicesFile"),
+    releaseCertification: normalizeReleaseCertification(config),
     ...updates ? { updates } : {},
     ...updateServer ? { updateServer } : {}
   };

package/dist/cli/{index-hrzd7e5x.js → index-dfqzrznk.js}

@@ -4,7 +4,7 @@ import {
 } from "./index-s2tazax7.js";
 import {
   normalizeAbsoluteMobileConfig
-} from "./index-rd2hbttb.js";
+} from "./index-df2mjbdy.js";
 import {
   assertAbsoluteDeviceCapabilityPackages,
   resolveAbsoluteMobileUpdateRuntime,

package/dist/cli/{index-mazxtfh4.js → index-gps0zk0m.js}

@@ -6,7 +6,7 @@ import {
   createIslandRegistryDefinitionPlugin,
   finalizeAbsoluteMobileCompatibilityBuild,
   resolveServerBundleExternals
-} from "./index-hrzd7e5x.js";
+} from "./index-dfqzrznk.js";
 import {
   loadIslandRegistryBuildInfo
 } from "./index-bzs19w3r.js";
@@ -26,7 +26,7 @@ import {
 } from "./index-9kwmb3c0.js";
 import {
   normalizeAbsoluteMobileConfig
-} from "./index-rd2hbttb.js";
+} from "./index-df2mjbdy.js";
 import {
   installAbsoluteMobileAuthEnvironment
 } from "./index-ar4gz15x.js";

package/dist/cli/index.js

@@ -58,7 +58,7 @@ if (command === "dev") {
   }
   const positionalArgs = stripNamedArgs("--config", "--android-device", "--ios-device").filter((arg) => arg !== "--no-mobile" && arg !== "--eager");
   const serverEntry = positionalArgs[0] ?? DEFAULT_SERVER_ENTRY;
-  const { dev } = await import("./dev-f6b6hkke.js");
+  const { dev } = await import("./dev-f0safhsr.js");
   await dev(serverEntry, configPath, {
     androidDevice,
     eager: args.includes("--eager"),
@@ -71,7 +71,7 @@ if (command === "dev") {
   const configPath = parseNamedArg("--config");
   const positionalArgs = stripNamedArgs("--outdir", "--config").filter((arg) => arg !== "--prebuilt");
   const serverEntry = positionalArgs[0] ?? DEFAULT_SERVER_ENTRY;
-  const { start } = await import("./start-5grq7nfr.js");
+  const { start } = await import("./start-8v6g2y31.js");
   await start(serverEntry, outdir, configPath, {
     prebuilt: args.includes("--prebuilt")
   });
@@ -81,7 +81,7 @@ if (command === "dev") {
   const configPath = parseNamedArg("--config");
   const positionalArgs = stripNamedArgs("--outdir", "--config");
   const serverEntry = positionalArgs[0] ?? DEFAULT_SERVER_ENTRY;
-  const { start } = await import("./start-5grq7nfr.js");
+  const { start } = await import("./start-8v6g2y31.js");
   await start(serverEntry, outdir, configPath, { prepareOnly: true });
 } else if (command === "build") {
   sendTelemetryEvent("cli:command", { command });
@@ -197,13 +197,13 @@ if (command === "dev") {
   const configPath = parseNamedArg("--config");
   const positionalArgs = stripNamedArgs("--outdir", "--outfile", "--config");
   const serverEntry = positionalArgs[0] ?? DEFAULT_SERVER_ENTRY;
-  const { compile } = await import("./compile-hsbs1xf6.js");
+  const { compile } = await import("./compile-1d5arbqj.js");
   await compile(serverEntry, outdir, outfile, configPath);
 } else if (command === "mobile") {
   sendTelemetryEvent("cli:command", {
     command: `mobile:${workspaceCommand ?? "unknown"}`
   });
-  const { runMobile } = await import("./mobile-7v8hfmdq.js");
+  const { runMobile } = await import("./mobile-e4ygngfk.js");
   try {
     await runMobile(args);
   } catch (error) {

package/dist/cli/{mobile-7v8hfmdq.js → mobile-e4ygngfk.js}

@@ -7,12 +7,12 @@ import {
 } from "./index-zh6hhrwy.js";
 import {
   start
-} from "./index-mazxtfh4.js";
+} from "./index-gps0zk0m.js";
 import {
   ABSOLUTE_MOBILE_CLIENT_MANIFEST_FORMAT,
   ABSOLUTE_MOBILE_PAGE_PROTOCOL_VERSION,
   resolveAbsoluteMobileRoute
-} from "./index-hrzd7e5x.js";
+} from "./index-dfqzrznk.js";
 import"./index-bzs19w3r.js";
 import"./index-s2tazax7.js";
 import {
@@ -56,7 +56,7 @@ import {
 import"./index-w5vswatm.js";
 import {
   normalizeAbsoluteMobileConfig
-} from "./index-rd2hbttb.js";
+} from "./index-df2mjbdy.js";
 import {
   ABSOLUTE_MOBILE_UPDATE_FORMAT,
   absoluteDeviceNativeRequirements,
@@ -22353,6 +22353,14 @@ var satisfiesRequirement = (strength, requirement) => {
     return false;
   return STRENGTH_RANK[strength] >= STRENGTH_RANK[requirement];
 };
+var resolveAbsoluteMobileCertificationRequirement = (config, target) => {
+  const channelRequirement = target.channel ? config.releaseCertification.channels[target.channel]?.[target.platform] : undefined;
+  const playRequirement = target.googlePlayTrack ? config.releaseCertification.googlePlayTracks[target.googlePlayTrack] : undefined;
+  const requirements = [channelRequirement, playRequirement].filter((value) => value !== undefined);
+  if (requirements.length === 0)
+    return;
+  return requirements.reduce((strongest, candidate) => STRENGTH_RANK[candidate] > STRENGTH_RANK[strongest] ? candidate : strongest);
+};
 var validateCertifiedEvidence = (platform, evidence) => {
   if (platform === "android") {
     if (evidence.strength !== "installed" || evidence.networkUnavailable !== "proven" || evidence.artifactExactness !== undefined || evidence.distribution !== undefined || evidence.remote)
@@ -22599,6 +22607,15 @@ var prepareAbsoluteAndroidRelease = async (publisher, options) => {
   }
   return versionCode;
 };
+var requireCertificationReceipt = (publication, certification, requirement, releaseId) => {
+  if (!certification && !requirement)
+    return;
+  if (!certification || !requirement)
+    throw new TypeError("Native release publication certification contract is incomplete.");
+  const receipt = publication.certification;
+  if (!receipt || receipt.certificationId !== certification.certificationId || receipt.releaseId !== releaseId || receipt.requirement !== requirement || receipt.strength !== certification.strength)
+    throw new TypeError("Native release registry did not retain the required release certification.");
+};
 var isRecord7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var isPublisher = (value) => isRecord7(value) && typeof value.publish === "function";
 var publisherModulePath = (projectRoot, requested) => {
@@ -22623,9 +22640,16 @@ var loadAbsoluteNativeReleasePublisher = async (projectRoot, requestedModulePath
   return publisher;
 };
 var publishAbsoluteAndroidRelease = async (options) => {
+  const certificationRequirement = options.certificationRequirement ?? options.certification?.requirement;
+  if (options.certification)
+    verifyAbsoluteMobileReleaseCertification(options.certification, options.release, certificationRequirement);
+  else if (certificationRequirement)
+    throw new TypeError(`Android release publication requires ${certificationRequirement} certification.`);
   const publisher = await loadAbsoluteNativeReleasePublisher(options.projectRoot, options.modulePath);
   const publication = await publisher.publish({
     allowUnsigned: options.allowUnsigned,
+    certification: options.certification,
+    certificationRequirement,
     channel: options.channel,
     googlePlay: options.googlePlay,
     releaseRoot: options.release.releaseRoot,
@@ -22636,6 +22660,7 @@ var publishAbsoluteAndroidRelease = async (options) => {
   if (!actual || actual.appId !== expected.appId || actual.platform !== "android" || actual.releaseId !== expected.releaseId || actual.sha256 !== expected.sha256 || actual.signed !== expected.signed || actual.versionCode !== expected.versionCode || typeof publication.reused !== "boolean") {
     throw new TypeError("Native release registry returned a different Android release identity.");
   }
+  requireCertificationReceipt(publication, options.certification, certificationRequirement, expected.releaseId);
   if (options.channel !== undefined && (publication.channel?.channel !== options.channel || publication.channel.releaseId !== expected.releaseId)) {
     throw new TypeError("Native release registry did not promote the requested channel.");
   }
@@ -22648,10 +22673,17 @@ var publishAbsoluteAndroidRelease = async (options) => {
   return publication;
 };
 var publishAbsoluteIosRelease = async (options) => {
+  const certificationRequirement = options.certificationRequirement ?? options.certification?.requirement;
+  if (options.certification)
+    verifyAbsoluteMobileReleaseCertification(options.certification, options.release, certificationRequirement);
+  else if (certificationRequirement)
+    throw new TypeError(`iOS release publication requires ${certificationRequirement} certification.`);
   const publisher = await loadAbsoluteNativeReleasePublisher(options.projectRoot, options.modulePath);
   const publication = await publisher.publish({
     allowUnsigned: options.allowUnsigned,
     appStoreConnect: options.appStoreConnect,
+    certification: options.certification,
+    certificationRequirement,
     channel: options.channel,
     releaseRoot: options.release.releaseRoot,
     signal: options.signal
@@ -22661,6 +22693,7 @@ var publishAbsoluteIosRelease = async (options) => {
   if (!actual || actual.appId !== expected.appId || actual.platform !== "ios" || actual.releaseId !== expected.releaseId || actual.sha256 !== expected.sha256 || actual.signed !== expected.signed || actual.buildNumber !== expected.buildNumber || actual.marketingVersion !== expected.marketingVersion || typeof publication.reused !== "boolean") {
     throw new TypeError("Native release registry returned a different iOS release identity.");
   }
+  requireCertificationReceipt(publication, options.certification, certificationRequirement, expected.releaseId);
   if (options.channel !== undefined && (publication.channel?.channel !== options.channel || publication.channel.releaseId !== expected.releaseId)) {
     throw new TypeError("Native release registry did not promote the requested channel.");
   }
@@ -23023,12 +23056,9 @@ var androidJob = (options) => {
       ABSOLUTE_GOOGLE_CREDENTIALS_BASE64: \${{ secrets.ABSOLUTE_GOOGLE_CREDENTIALS_BASE64 }}
       GOOGLE_APPLICATION_CREDENTIALS: \${{ runner.temp }}/absolute-google-credentials.json` : "";
   const publishCommand = options.includePublishing ? `if [[ "$ABSOLUTE_PUBLISH" == "true" ]]; then
-            args=(bunx absolute mobile publish android "$ABSOLUTE_SERVER_ENTRY" --registry "$ABSOLUTE_REGISTRY_MODULE")
-            if [[ -n "$ABSOLUTE_RELEASE_CHANNEL" ]]; then
-              args+=(--channel "$ABSOLUTE_RELEASE_CHANNEL")
-            fi
+            args=(bunx absolute mobile build android "$ABSOLUTE_SERVER_ENTRY")
             if [[ "$ABSOLUTE_PLAY_TRACK" != "registry-only" ]]; then
-              args+=(--play-track "$ABSOLUTE_PLAY_TRACK")
+              args+=(--registry "$ABSOLUTE_REGISTRY_MODULE" --play-track "$ABSOLUTE_PLAY_TRACK")
             fi
           else
             args=(bunx absolute mobile build android "$ABSOLUTE_SERVER_ENTRY")
@@ -23042,6 +23072,58 @@ var androidJob = (options) => {
             printf '%s' "$ABSOLUTE_GOOGLE_CREDENTIALS_BASE64" | base64 --decode > "$GOOGLE_APPLICATION_CREDENTIALS"
             chmod 600 "$GOOGLE_APPLICATION_CREDENTIALS"
           fi` : "";
+  const certificationSteps = options.includePublishing ? `
+      - name: Install-test and certify exact Android release
+        if: inputs.publish
+        shell: bash
+        run: |
+          args=(bunx absolute mobile doctor android --fix --yes)
+          ${appendConfigArgument}
+          "\${args[@]}"
+          shopt -s nullglob
+          releases=(.absolutejs/mobile/releases/android/*)
+          if [[ "\${#releases[@]}" -ne 1 || ! -d "\${releases[0]}" ]]; then
+            echo "Expected exactly one immutable Android release directory." >&2
+            exit 1
+          fi
+          RELEASE_DIRECTORY="\${releases[0]}"
+          args=(bunx absolute mobile test android --release "$RELEASE_DIRECTORY" --report .absolutejs/mobile-ci/acceptance/android --yes)
+          ${appendConfigArgument}
+          "\${args[@]}"
+          args=(bunx absolute mobile certify "$RELEASE_DIRECTORY" --evidence .absolutejs/mobile-ci/acceptance/android --require installed --outdir .absolutejs/mobile-ci/certifications/android --json)
+          "\${args[@]}" > .absolutejs/mobile-ci/android-certification.json
+      - name: Publish certified Android release
+        if: inputs.publish
+        shell: bash
+        run: |
+          shopt -s nullglob
+          releases=(.absolutejs/mobile/releases/android/*)
+          certifications=(.absolutejs/mobile-ci/certifications/android/*)
+          if [[ "\${#releases[@]}" -ne 1 || "\${#certifications[@]}" -ne 1 || ! -d "\${releases[0]}" || ! -d "\${certifications[0]}" ]]; then
+            echo "Expected exactly one Android release and certification." >&2
+            exit 1
+          fi
+          args=(bunx absolute mobile publish android --release "\${releases[0]}" --certification "\${certifications[0]}" --registry "$ABSOLUTE_REGISTRY_MODULE")
+          if [[ -n "$ABSOLUTE_RELEASE_CHANNEL" ]]; then
+            args+=(--channel "$ABSOLUTE_RELEASE_CHANNEL")
+          fi
+          if [[ "$ABSOLUTE_PLAY_TRACK" != "registry-only" ]]; then
+            args+=(--play-track "$ABSOLUTE_PLAY_TRACK")
+          fi
+          ${appendConfigArgument}
+          "\${args[@]}"
+      - name: Upload Android acceptance and certification
+        if: always() && inputs.publish
+        uses: actions/upload-artifact@v7
+        with:
+          name: absolute-mobile-android-certification
+          path: |
+            .absolutejs/mobile-ci/acceptance/android/
+            .absolutejs/mobile-ci/certifications/android/
+            .absolutejs/mobile-ci/android-certification.json
+          if-no-files-found: error
+          retention-days: 30
+          include-hidden-files: true` : "";
   return `
   android:
     name: Signed Android release
@@ -23080,13 +23162,14 @@ ${installSteps}
           done
           printf '%s' "$ABSOLUTE_ANDROID_KEYSTORE_BASE64" | base64 --decode > "\${{ runner.temp }}/absolute-release.jks"
           chmod 600 "\${{ runner.temp }}/absolute-release.jks"${googleSetup}
-      - name: Build or publish Android
+      - name: Build Android
         shell: bash
         run: |
           ${publishCommand}
           ${appendConfigArgument}
           "\${args[@]}"
 ${releaseAuditSteps("android")}
+${certificationSteps}
       - name: Attest Android App Bundle
         if: inputs.attest
         uses: actions/attest@v4
@@ -23119,15 +23202,9 @@ var iosJob = (options) => {
       APP_STORE_CONNECT_PRIVATE_KEY_BASE64: \${{ secrets.APP_STORE_CONNECT_PRIVATE_KEY_BASE64 }}
       APP_STORE_CONNECT_PRIVATE_KEY_PATH: \${{ runner.temp }}/AuthKey_AbsoluteJS.p8` : "";
   const publishCommand = options.includePublishing ? `if [[ "$ABSOLUTE_PUBLISH" == "true" ]]; then
-            args=(bunx absolute mobile publish ios "$ABSOLUTE_SERVER_ENTRY" --registry "$ABSOLUTE_REGISTRY_MODULE")
-            if [[ -n "$ABSOLUTE_RELEASE_CHANNEL" ]]; then
-              args+=(--channel "$ABSOLUTE_RELEASE_CHANNEL")
-            fi
+            args=(bunx absolute mobile build ios "$ABSOLUTE_SERVER_ENTRY")
             if [[ -n "$ABSOLUTE_TESTFLIGHT_GROUP" ]]; then
-              args+=(--testflight-group "$ABSOLUTE_TESTFLIGHT_GROUP")
-            fi
-            if [[ "$ABSOLUTE_TESTFLIGHT_SUBMIT_REVIEW" == "true" ]]; then
-              args+=(--testflight-submit-review)
+              args+=(--registry "$ABSOLUTE_REGISTRY_MODULE" --testflight-group "$ABSOLUTE_TESTFLIGHT_GROUP")
             fi
           else
             args=(bunx absolute mobile build ios "$ABSOLUTE_SERVER_ENTRY")
@@ -23141,6 +23218,58 @@ var iosJob = (options) => {
             printf '%s' "$APP_STORE_CONNECT_PRIVATE_KEY_BASE64" | base64 --decode > "$APP_STORE_CONNECT_PRIVATE_KEY_PATH"
             chmod 600 "$APP_STORE_CONNECT_PRIVATE_KEY_PATH"
           fi` : "";
+  const certificationSteps = options.includePublishing ? `
+      - name: Simulator-test and certify exact iOS release
+        if: inputs.publish
+        shell: bash
+        run: |
+          shopt -s nullglob
+          releases=(.absolutejs/mobile/releases/ios/*)
+          if [[ "\${#releases[@]}" -ne 1 || ! -d "\${releases[0]}" ]]; then
+            echo "Expected exactly one immutable iOS release directory." >&2
+            exit 1
+          fi
+          RELEASE_DIRECTORY="\${releases[0]}"
+          args=(bunx absolute mobile test ios --release "$RELEASE_DIRECTORY" --report .absolutejs/mobile-ci/acceptance/ios --yes)
+          ${appendConfigArgument}
+          "\${args[@]}"
+          args=(bunx absolute mobile certify "$RELEASE_DIRECTORY" --evidence .absolutejs/mobile-ci/acceptance/ios --require simulator --outdir .absolutejs/mobile-ci/certifications/ios --json)
+          "\${args[@]}" > .absolutejs/mobile-ci/ios-certification.json
+      - name: Publish certified iOS release
+        if: inputs.publish
+        shell: bash
+        run: |
+          shopt -s nullglob
+          releases=(.absolutejs/mobile/releases/ios/*)
+          certifications=(.absolutejs/mobile-ci/certifications/ios/*)
+          if [[ "\${#releases[@]}" -ne 1 || "\${#certifications[@]}" -ne 1 || ! -d "\${releases[0]}" || ! -d "\${certifications[0]}" ]]; then
+            echo "Expected exactly one iOS release and certification." >&2
+            exit 1
+          fi
+          args=(bunx absolute mobile publish ios --release "\${releases[0]}" --certification "\${certifications[0]}" --registry "$ABSOLUTE_REGISTRY_MODULE")
+          if [[ -n "$ABSOLUTE_RELEASE_CHANNEL" ]]; then
+            args+=(--channel "$ABSOLUTE_RELEASE_CHANNEL")
+          fi
+          if [[ -n "$ABSOLUTE_TESTFLIGHT_GROUP" ]]; then
+            args+=(--testflight-group "$ABSOLUTE_TESTFLIGHT_GROUP")
+          fi
+          if [[ "$ABSOLUTE_TESTFLIGHT_SUBMIT_REVIEW" == "true" ]]; then
+            args+=(--testflight-submit-review)
+          fi
+          ${appendConfigArgument}
+          "\${args[@]}"
+      - name: Upload iOS acceptance and certification
+        if: always() && inputs.publish
+        uses: actions/upload-artifact@v7
+        with:
+          name: absolute-mobile-ios-certification
+          path: |
+            .absolutejs/mobile-ci/acceptance/ios/
+            .absolutejs/mobile-ci/certifications/ios/
+            .absolutejs/mobile-ci/ios-certification.json
+          if-no-files-found: error
+          retention-days: 30
+          include-hidden-files: true` : "";
   return `
   ios:
     name: Signed iOS release
@@ -23192,13 +23321,14 @@ ${installSteps}
           security list-keychain -d user -s "$KEYCHAIN_PATH"
           mkdir -p "$(dirname "$PROFILE_DESTINATION")"
           cp "$PROFILE_PATH" "$PROFILE_DESTINATION"${appStoreDecode}
-      - name: Build or publish iOS
+      - name: Build iOS
         shell: bash
         run: |
           ${publishCommand}
           ${appendConfigArgument}
           "\${args[@]}"
 ${releaseAuditSteps("ios")}
+${certificationSteps}
       - name: Attest iOS IPA
         if: inputs.attest
         uses: actions/attest@v4
@@ -24439,7 +24569,7 @@ var provisionMobileUpdate = async (args) => {
     throw new TypeError("--storage must be local or s3.");
   const modulePath = valueAfter(args, "--registry") ?? mobile.updateServer.registryModule;
   const packages = [
-    "@absolutejs/deploy@0.25.13",
+    "@absolutejs/deploy@0.26.0",
     "@absolutejs/blob@0.5.2",
     ...requestedStorage === "s3" ? [
       "@aws-sdk/client-s3@3.1095.0",
@@ -24957,25 +25087,70 @@ var printAppStoreConnectPublication = (publication) => {
   const { receipt } = publication;
   console.log(`${publication.reused ? "Reused" : "Uploaded"} App Store Connect build ${receipt.marketingVersion} (${receipt.buildNumber}); ${receipt.stage}.`);
 };
+var buildAndroidCommand = async (args) => {
+  const googlePlay = googlePlayTarget(args);
+  if (!googlePlay)
+    return buildAndroid(args);
+  const registryModule = args.includes("--registry") ? requireValueAfter(args, "--registry") : "mobile.release.ts";
+  const { mobile, projectRoot } = await loadMobile(valueAfter(args, "--config"));
+  const publisher = await loadAbsoluteNativeReleasePublisher(projectRoot, registryModule);
+  return buildAndroid(args, (buildIdentity) => prepareAbsoluteAndroidRelease(publisher, {
+    buildIdentity,
+    googlePlay,
+    packageName: mobile.appId
+  }));
+};
+var requirePublicationReleaseIdentity = (mobile, release, platform2) => {
+  if (release.metadata.platform !== platform2 || release.metadata.appId !== mobile.appId || release.metadata.engine !== mobile.engine)
+    throw new TypeError(`The existing ${platform2} release does not match this application's platform, app ID, or engine.`);
+};
+var loadPublicationCertification = async (options) => {
+  const requested = valueAfter(options.args, "--certification");
+  if (options.args.includes("--certification") && (!requested || requested.startsWith("-")))
+    throw new TypeError(`mobile publish ${options.platform} requires --certification <directory-or-json>.`);
+  if (!requested) {
+    if (options.requirement)
+      throw new TypeError(`mobile publish ${options.platform} requires --certification with ${options.requirement} evidence for this release target.`);
+    return;
+  }
+  const loaded = await readAbsoluteMobileReleaseCertification(options.projectRoot, requested);
+  return verifyAbsoluteMobileReleaseCertification(loaded.certification, options.release, options.requirement);
+};
 var publishAndroid = async (args) => {
   const registryModule = args.includes("--registry") ? requireValueAfter(args, "--registry") : "mobile.release.ts";
   const channel = args.includes("--channel") ? requireValueAfter(args, "--channel") : undefined;
   const configPath = valueAfter(args, "--config");
   const googlePlay = googlePlayTarget(args);
   const { mobile, projectRoot } = await loadMobile(configPath);
+  const certificationRequirement = resolveAbsoluteMobileCertificationRequirement(mobile, {
+    channel,
+    googlePlayTrack: googlePlay?.track,
+    platform: "android"
+  });
   const startedAt = performance.now();
   let reused = false;
   let success = false;
   try {
     const publisher = await loadAbsoluteNativeReleasePublisher(projectRoot, registryModule);
-    const release = await buildAndroid(args, googlePlay ? (buildIdentity) => prepareAbsoluteAndroidRelease(publisher, {
+    const requestedRelease = args.includes("--release") ? requireValueAfter(args, "--release") : undefined;
+    const release = requestedRelease ? await readAbsoluteAndroidRelease(projectRoot, requestedRelease) : await buildAndroid(args, googlePlay ? (buildIdentity) => prepareAbsoluteAndroidRelease(publisher, {
       buildIdentity,
       googlePlay,
       packageName: mobile.appId
     }) : undefined);
+    requirePublicationReleaseIdentity(mobile, release, "android");
+    const certification = await loadPublicationCertification({
+      args,
+      platform: "android",
+      projectRoot,
+      release,
+      ...certificationRequirement ? { requirement: certificationRequirement } : {}
+    });
     const publication = await publishAbsoluteAndroidRelease({
       allowUnsigned: args.includes("--unsigned"),
       channel,
+      ...certification ? { certification } : {},
+      ...certificationRequirement ? { certificationRequirement } : {},
       googlePlay,
       modulePath: registryModule,
       projectRoot,
@@ -25111,18 +25286,39 @@ var buildIos = async (args, prepareBuildNumber) => {
     });
   }
 };
+var buildIosCommand = async (args) => {
+  const appStoreConnect = appStoreConnectTarget(args);
+  if (!appStoreConnect)
+    return buildIos(args);
+  const registryModule = args.includes("--registry") ? requireIosValueAfter(args, "--registry") : "mobile.release.ts";
+  const { mobile, projectRoot } = await loadMobile(valueAfter(args, "--config"));
+  const marketingVersion = mobile.iosVersion;
+  if (!marketingVersion)
+    throw new TypeError("iOS App Store build allocation requires mobile.ios.version.");
+  const publisher = await loadAbsoluteNativeReleasePublisher(projectRoot, registryModule);
+  return buildIos(args, (buildIdentity) => prepareAbsoluteIosRelease(publisher, {
+    buildIdentity,
+    bundleId: mobile.appId,
+    marketingVersion
+  }));
+};
 var publishIos = async (args) => {
   const registryModule = args.includes("--registry") ? requireIosValueAfter(args, "--registry") : "mobile.release.ts";
   const channel = args.includes("--channel") ? requireIosValueAfter(args, "--channel") : undefined;
   const configPath = valueAfter(args, "--config");
   const appStoreConnect = appStoreConnectTarget(args);
   const { mobile, projectRoot } = await loadMobile(configPath);
+  const certificationRequirement = resolveAbsoluteMobileCertificationRequirement(mobile, {
+    channel,
+    platform: "ios"
+  });
   const startedAt = performance.now();
   let reused = false;
   let success = false;
   try {
     const publisher = await loadAbsoluteNativeReleasePublisher(projectRoot, registryModule);
-    const release = await buildIos(args, appStoreConnect ? (buildIdentity) => {
+    const requestedRelease = args.includes("--release") ? requireIosValueAfter(args, "--release") : undefined;
+    const release = requestedRelease ? await readAbsoluteIosRelease(projectRoot, requestedRelease) : await buildIos(args, appStoreConnect ? (buildIdentity) => {
       if (!mobile.iosVersion)
         throw new TypeError("iOS publishing requires mobile.ios.version.");
       return prepareAbsoluteIosRelease(publisher, {
@@ -25131,10 +25327,20 @@ var publishIos = async (args) => {
         marketingVersion: mobile.iosVersion
       });
     } : undefined);
+    requirePublicationReleaseIdentity(mobile, release, "ios");
+    const certification = await loadPublicationCertification({
+      args,
+      platform: "ios",
+      projectRoot,
+      release,
+      ...certificationRequirement ? { requirement: certificationRequirement } : {}
+    });
     const publication = await publishAbsoluteIosRelease({
       allowUnsigned: args.includes("--unsigned"),
       appStoreConnect,
       channel,
+      ...certification ? { certification } : {},
+      ...certificationRequirement ? { certificationRequirement } : {},
       modulePath: registryModule,
       projectRoot,
       release
@@ -26621,11 +26827,11 @@ var runMobile = async (args) => {
     return;
   }
   if (command === "build" && args[1] === "android") {
-    await buildAndroid(args.slice(2));
+    await buildAndroidCommand(args.slice(2));
     return;
   }
   if (command === "build" && args[1] === "ios") {
-    await buildIos(args.slice(2));
+    await buildIosCommand(args.slice(2));
     return;
   }
   if (command === "update" && args[1] === "build") {
@@ -26676,7 +26882,7 @@ var runMobile = async (args) => {
     await publishIos(args.slice(2));
     return;
   }
-  throw new TypeError("Usage: absolute mobile <pair mac <name> <user@host> [--port n] [--workspace path] | remotes [inspect [name] [--json] | clean [name] --yes | --json] | unpair mac <name> | init [--no-native] [--force] | sync [ios|android] | inspect [--json] [--require-bundle] | certify <release-dir> [--evidence report-dir]... [--require installed|simulator|device|store] [--outdir dir] [--json] | certify <release-dir> --verify certification-dir [--require installed|simulator|device|store] [--json] | associations [--outdir dir] [--verify] | ci github [server-entry] [--publish] [--registry module] [--secret-env NAME] [--output path] [--force] [--json] | doctor [ios|android|release [ios|android]] [--remote name] [--json|--fix [--yes]] | build <android|ios> [server-entry] [--remote name] [--registered-device-artifact] [--outdir dir] [--web-outdir dir] [--unsigned] | update provision [--storage local|s3] [--registry module] [--force] [--yes] | update signing generate --private-key path [--certificate path] [--public-key path] [--key-id id] [--common-name name] [--validity-years n] | update build [server-entry] --classification bug-fix|content|security --key-id id --signing-key path --within-submitted-purpose [--outdir dir] [--web-outdir dir] | update publish <release-directory> [--rollout fraction] [--registry module] | update promote --release id --rollout fraction [--registry module] | update rollback [--release id] [--registry module] | update status [--registry module] [--json] | update advance [--rollout fraction] [--registry module] [--json] | update pause|resume|cancel|reconcile [--registry module] [--json] | update storage [--retain count] [--min-age-days days] [--registry module] [--json] | update gc [--retain count] [--min-age-days days] [--grace-days days] [--apply] [--registry module] [--json] | publish android [server-entry] [--registry module] [--channel name] [--play-track track] [--play-status completed|draft|halted|in-progress] [--play-rollout fraction] [--play-name name] [--play-notes language=text] [--play-update-priority 0..5] [--play-hold-review] [--play-cancel-existing-review] [--outdir dir] [--web-outdir dir] [--unsigned] | publish ios [server-entry] [--remote name] [--registry module] [--channel name] [--testflight-group name-or-id] [--testflight-notes locale=text] [--testflight-submit-review] [--outdir dir] [--web-outdir dir] [--unsigned] | test android [--release release-dir [--yes] | --route path [--wait-for-hmr] [--port n]] [--report [dir]] [--serial id] [--artifacts dir] [--json] [--config path] | test ios [--release release-dir [--remote name] [--device id [--testflight] --yes] | --wait-for-hmr] [--report [dir]] [--udid id] [--artifacts dir] [--json] [--config path]");
+  throw new TypeError("Usage: absolute mobile <pair mac <name> <user@host> [--port n] [--workspace path] | remotes [inspect [name] [--json] | clean [name] --yes | --json] | unpair mac <name> | init [--no-native] [--force] | sync [ios|android] | inspect [--json] [--require-bundle] | certify <release-dir> [--evidence report-dir]... [--require installed|simulator|device|store] [--outdir dir] [--json] | certify <release-dir> --verify certification-dir [--require installed|simulator|device|store] [--json] | associations [--outdir dir] [--verify] | ci github [server-entry] [--publish] [--registry module] [--secret-env NAME] [--output path] [--force] [--json] | doctor [ios|android|release [ios|android]] [--remote name] [--json|--fix [--yes]] | build <android|ios> [server-entry] [--remote name] [--registered-device-artifact] [--outdir dir] [--web-outdir dir] [--unsigned] | update provision [--storage local|s3] [--registry module] [--force] [--yes] | update signing generate --private-key path [--certificate path] [--public-key path] [--key-id id] [--common-name name] [--validity-years n] | update build [server-entry] --classification bug-fix|content|security --key-id id --signing-key path --within-submitted-purpose [--outdir dir] [--web-outdir dir] | update publish <release-directory> [--rollout fraction] [--registry module] | update promote --release id --rollout fraction [--registry module] | update rollback [--release id] [--registry module] | update status [--registry module] [--json] | update advance [--rollout fraction] [--registry module] [--json] | update pause|resume|cancel|reconcile [--registry module] [--json] | update storage [--retain count] [--min-age-days days] [--registry module] [--json] | update gc [--retain count] [--min-age-days days] [--grace-days days] [--apply] [--registry module] [--json] | publish android [server-entry] [--release release-dir] [--certification certification-dir] [--registry module] [--channel name] [--play-track track] [--play-status completed|draft|halted|in-progress] [--play-rollout fraction] [--play-name name] [--play-notes language=text] [--play-update-priority 0..5] [--play-hold-review] [--play-cancel-existing-review] [--outdir dir] [--web-outdir dir] [--unsigned] | publish ios [server-entry] [--release release-dir] [--certification certification-dir] [--remote name] [--registry module] [--channel name] [--testflight-group name-or-id] [--testflight-notes locale=text] [--testflight-submit-review] [--outdir dir] [--web-outdir dir] [--unsigned] | test android [--release release-dir [--yes] | --route path [--wait-for-hmr] [--port n]] [--report [dir]] [--serial id] [--artifacts dir] [--json] [--config path] | test ios [--release release-dir [--remote name] [--device id [--testflight] --yes] | --wait-for-hmr] [--report [dir]] [--udid id] [--artifacts dir] [--json] [--config path]");
 };
 export {
   runMobile