@absolutejs/absolute 0.20.0-beta.107 → 0.20.0-beta.109

package/dist/mobile/index.js

@@ -613,7 +613,7 @@ __export(exports_config, {
 import { readFileSync as readFileSync2 } from "fs";
 import { resolve as resolve8 } from "path";
 import { createHash as createHash10, createPublicKey, X509Certificate as X509Certificate2 } from "crypto";
-var APP_ID_PATTERN, SCHEME_PATTERN, APPLE_APP_ID_PREFIX_PATTERN, CERTIFICATE_FINGERPRINT_PATTERN, UPDATE_NAME_PATTERN, UPDATE_PUBLIC_KEY_PATTERN, ENVIRONMENT_NAME_PATTERN, DEFAULT_UPDATE_BOOT_TIMEOUT_MS = 20000, DEFAULT_UPDATE_HEALTH_FAILURE_RATE = 0.2, DEFAULT_UPDATE_HEALTH_MINIMUM_REPORTS = 20, DEFAULT_UPDATE_ROLLOUT_FAILURE_RATE = 0.05, DEFAULT_UPDATE_ROLLOUT_OBSERVATION_MINUTES = 60, MINUTE_MS, DEFAULT_UPDATE_ROLLOUT_STAGES, MINIMUM_UPDATE_BOOT_TIMEOUT_MS = 5000, MAXIMUM_UPDATE_BOOT_TIMEOUT_MS = 120000, HOSTNAME_PATTERN, EXPO_RESERVED_ROUTE_PREFIXES, resolveProjectPath = (projectRoot, value, field2) => {
+var APP_ID_PATTERN, SCHEME_PATTERN, APPLE_APP_ID_PREFIX_PATTERN, CERTIFICATE_FINGERPRINT_PATTERN, UPDATE_NAME_PATTERN, RELEASE_TARGET_PATTERN, UPDATE_PUBLIC_KEY_PATTERN, ENVIRONMENT_NAME_PATTERN, DEFAULT_UPDATE_BOOT_TIMEOUT_MS = 20000, DEFAULT_UPDATE_HEALTH_FAILURE_RATE = 0.2, DEFAULT_UPDATE_HEALTH_MINIMUM_REPORTS = 20, DEFAULT_UPDATE_ROLLOUT_FAILURE_RATE = 0.05, DEFAULT_UPDATE_ROLLOUT_OBSERVATION_MINUTES = 60, MINUTE_MS, DEFAULT_UPDATE_ROLLOUT_STAGES, MINIMUM_UPDATE_BOOT_TIMEOUT_MS = 5000, MAXIMUM_UPDATE_BOOT_TIMEOUT_MS = 120000, HOSTNAME_PATTERN, EXPO_RESERVED_ROUTE_PREFIXES, resolveProjectPath = (projectRoot, value, field2) => {
   const root = resolve8(projectRoot);
   const path = resolve8(root, value);
   if (path !== root && !path.startsWith(`${root}/`)) {
@@ -649,6 +649,54 @@ var APP_ID_PATTERN, SCHEME_PATTERN, APPLE_APP_ID_PREFIX_PATTERN, CERTIFICATE_FIN
     throw new TypeError("mobile.platforms must contain at least one platform.");
   }
   return normalized;
+}, normalizeAndroidCertificationPolicy = (value) => {
+  if (value === false || value === undefined)
+    return;
+  if (value !== "installed")
+    throw new TypeError("mobile.release.certification channel Android policy must be installed or false.");
+  return value;
+}, normalizeIosCertificationPolicy = (value) => {
+  if (value === false || value === undefined)
+    return;
+  if (!["simulator", "device", "store"].includes(value))
+    throw new TypeError("mobile.release.certification channel iOS policy must be simulator, device, store, or false.");
+  return value;
+}, normalizeReleaseCertification = (config) => {
+  const configured = config.release?.certification;
+  if (configured === false)
+    return { channels: {}, googlePlayTracks: {} };
+  const channels = {
+    production: { android: "installed", ios: "store" }
+  };
+  const googlePlayTracks = {
+    production: "installed"
+  };
+  for (const [name, policy] of Object.entries(configured?.channels ?? {})) {
+    if (!RELEASE_TARGET_PATTERN.test(name))
+      throw new TypeError("mobile.release.certification.channels contains an invalid channel.");
+    const normalized = {};
+    const android = normalizeAndroidCertificationPolicy(policy.android);
+    const ios = normalizeIosCertificationPolicy(policy.ios);
+    if (android)
+      normalized.android = android;
+    if (ios)
+      normalized.ios = ios;
+    channels[name] = normalized;
+  }
+  for (const [name, requirement] of Object.entries(configured?.googlePlayTracks ?? {})) {
+    if (!RELEASE_TARGET_PATTERN.test(name))
+      throw new TypeError("mobile.release.certification.googlePlayTracks contains an invalid track.");
+    if (requirement === false)
+      delete googlePlayTracks[name];
+    else if (requirement === "installed")
+      googlePlayTracks[name] = requirement;
+    else
+      throw new TypeError("mobile.release.certification Google Play policy must be installed or false.");
+  }
+  return {
+    channels: Object.fromEntries(Object.entries(channels).sort(([left], [right]) => left.localeCompare(right))),
+    googlePlayTracks: Object.fromEntries(Object.entries(googlePlayTracks).sort(([left], [right]) => left.localeCompare(right)))
+  };
 }, normalizeHosts = (hosts, productionOrigin) => {
   const normalizeHostname = (host) => {
     const value = requireText(host, "mobile.deepLinks.hosts").toLowerCase();
@@ -975,6 +1023,7 @@ var APP_ID_PATTERN, SCHEME_PATTERN, APPLE_APP_ID_PREFIX_PATTERN, CERTIFICATE_FIN
     platforms: normalizePlatforms(config.platforms),
     productionOrigin,
     pushAndroidGoogleServicesFile: resolveProjectPath(projectRoot, config.pushNotifications?.android?.googleServicesFile ?? "google-services.json", "mobile.pushNotifications.android.googleServicesFile"),
+    releaseCertification: normalizeReleaseCertification(config),
     ...updates ? { updates } : {},
     ...updateServer ? { updateServer } : {}
   };
@@ -985,6 +1034,7 @@ var init_config = __esm(() => {
   APPLE_APP_ID_PREFIX_PATTERN = /^[A-Z0-9]{10}$/;
   CERTIFICATE_FINGERPRINT_PATTERN = /^[0-9A-F]{64}$/;
   UPDATE_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
+  RELEASE_TARGET_PATTERN = /^[a-z0-9][a-z0-9._-]{0,63}$/u;
   UPDATE_PUBLIC_KEY_PATTERN = /^[A-Za-z0-9+/]+={0,2}$/u;
   ENVIRONMENT_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/u;
   MINUTE_MS = 60 * 1000;
@@ -33168,12 +33218,9 @@ var androidJob = (options) => {
       ABSOLUTE_GOOGLE_CREDENTIALS_BASE64: \${{ secrets.ABSOLUTE_GOOGLE_CREDENTIALS_BASE64 }}
       GOOGLE_APPLICATION_CREDENTIALS: \${{ runner.temp }}/absolute-google-credentials.json` : "";
   const publishCommand = options.includePublishing ? `if [[ "$ABSOLUTE_PUBLISH" == "true" ]]; then
-            args=(bunx absolute mobile publish android "$ABSOLUTE_SERVER_ENTRY" --registry "$ABSOLUTE_REGISTRY_MODULE")
-            if [[ -n "$ABSOLUTE_RELEASE_CHANNEL" ]]; then
-              args+=(--channel "$ABSOLUTE_RELEASE_CHANNEL")
-            fi
+            args=(bunx absolute mobile build android "$ABSOLUTE_SERVER_ENTRY")
             if [[ "$ABSOLUTE_PLAY_TRACK" != "registry-only" ]]; then
-              args+=(--play-track "$ABSOLUTE_PLAY_TRACK")
+              args+=(--registry "$ABSOLUTE_REGISTRY_MODULE" --play-track "$ABSOLUTE_PLAY_TRACK")
             fi
           else
             args=(bunx absolute mobile build android "$ABSOLUTE_SERVER_ENTRY")
@@ -33187,6 +33234,58 @@ var androidJob = (options) => {
             printf '%s' "$ABSOLUTE_GOOGLE_CREDENTIALS_BASE64" | base64 --decode > "$GOOGLE_APPLICATION_CREDENTIALS"
             chmod 600 "$GOOGLE_APPLICATION_CREDENTIALS"
           fi` : "";
+  const certificationSteps = options.includePublishing ? `
+      - name: Install-test and certify exact Android release
+        if: inputs.publish
+        shell: bash
+        run: |
+          args=(bunx absolute mobile doctor android --fix --yes)
+          ${appendConfigArgument}
+          "\${args[@]}"
+          shopt -s nullglob
+          releases=(.absolutejs/mobile/releases/android/*)
+          if [[ "\${#releases[@]}" -ne 1 || ! -d "\${releases[0]}" ]]; then
+            echo "Expected exactly one immutable Android release directory." >&2
+            exit 1
+          fi
+          RELEASE_DIRECTORY="\${releases[0]}"
+          args=(bunx absolute mobile test android --release "$RELEASE_DIRECTORY" --report .absolutejs/mobile-ci/acceptance/android --yes)
+          ${appendConfigArgument}
+          "\${args[@]}"
+          args=(bunx absolute mobile certify "$RELEASE_DIRECTORY" --evidence .absolutejs/mobile-ci/acceptance/android --require installed --outdir .absolutejs/mobile-ci/certifications/android --json)
+          "\${args[@]}" > .absolutejs/mobile-ci/android-certification.json
+      - name: Publish certified Android release
+        if: inputs.publish
+        shell: bash
+        run: |
+          shopt -s nullglob
+          releases=(.absolutejs/mobile/releases/android/*)
+          certifications=(.absolutejs/mobile-ci/certifications/android/*)
+          if [[ "\${#releases[@]}" -ne 1 || "\${#certifications[@]}" -ne 1 || ! -d "\${releases[0]}" || ! -d "\${certifications[0]}" ]]; then
+            echo "Expected exactly one Android release and certification." >&2
+            exit 1
+          fi
+          args=(bunx absolute mobile publish android --release "\${releases[0]}" --certification "\${certifications[0]}" --registry "$ABSOLUTE_REGISTRY_MODULE")
+          if [[ -n "$ABSOLUTE_RELEASE_CHANNEL" ]]; then
+            args+=(--channel "$ABSOLUTE_RELEASE_CHANNEL")
+          fi
+          if [[ "$ABSOLUTE_PLAY_TRACK" != "registry-only" ]]; then
+            args+=(--play-track "$ABSOLUTE_PLAY_TRACK")
+          fi
+          ${appendConfigArgument}
+          "\${args[@]}"
+      - name: Upload Android acceptance and certification
+        if: always() && inputs.publish
+        uses: actions/upload-artifact@v7
+        with:
+          name: absolute-mobile-android-certification
+          path: |
+            .absolutejs/mobile-ci/acceptance/android/
+            .absolutejs/mobile-ci/certifications/android/
+            .absolutejs/mobile-ci/android-certification.json
+          if-no-files-found: error
+          retention-days: 30
+          include-hidden-files: true` : "";
   return `
   android:
     name: Signed Android release
@@ -33225,13 +33324,14 @@ ${installSteps}
           done
           printf '%s' "$ABSOLUTE_ANDROID_KEYSTORE_BASE64" | base64 --decode > "\${{ runner.temp }}/absolute-release.jks"
           chmod 600 "\${{ runner.temp }}/absolute-release.jks"${googleSetup}
-      - name: Build or publish Android
+      - name: Build Android
         shell: bash
         run: |
           ${publishCommand}
           ${appendConfigArgument}
           "\${args[@]}"
 ${releaseAuditSteps("android")}
+${certificationSteps}
       - name: Attest Android App Bundle
         if: inputs.attest
         uses: actions/attest@v4
@@ -33264,15 +33364,9 @@ var iosJob = (options) => {
       APP_STORE_CONNECT_PRIVATE_KEY_BASE64: \${{ secrets.APP_STORE_CONNECT_PRIVATE_KEY_BASE64 }}
       APP_STORE_CONNECT_PRIVATE_KEY_PATH: \${{ runner.temp }}/AuthKey_AbsoluteJS.p8` : "";
   const publishCommand = options.includePublishing ? `if [[ "$ABSOLUTE_PUBLISH" == "true" ]]; then
-            args=(bunx absolute mobile publish ios "$ABSOLUTE_SERVER_ENTRY" --registry "$ABSOLUTE_REGISTRY_MODULE")
-            if [[ -n "$ABSOLUTE_RELEASE_CHANNEL" ]]; then
-              args+=(--channel "$ABSOLUTE_RELEASE_CHANNEL")
-            fi
+            args=(bunx absolute mobile build ios "$ABSOLUTE_SERVER_ENTRY")
             if [[ -n "$ABSOLUTE_TESTFLIGHT_GROUP" ]]; then
-              args+=(--testflight-group "$ABSOLUTE_TESTFLIGHT_GROUP")
-            fi
-            if [[ "$ABSOLUTE_TESTFLIGHT_SUBMIT_REVIEW" == "true" ]]; then
-              args+=(--testflight-submit-review)
+              args+=(--registry "$ABSOLUTE_REGISTRY_MODULE" --testflight-group "$ABSOLUTE_TESTFLIGHT_GROUP")
             fi
           else
             args=(bunx absolute mobile build ios "$ABSOLUTE_SERVER_ENTRY")
@@ -33286,6 +33380,58 @@ var iosJob = (options) => {
             printf '%s' "$APP_STORE_CONNECT_PRIVATE_KEY_BASE64" | base64 --decode > "$APP_STORE_CONNECT_PRIVATE_KEY_PATH"
             chmod 600 "$APP_STORE_CONNECT_PRIVATE_KEY_PATH"
           fi` : "";
+  const certificationSteps = options.includePublishing ? `
+      - name: Simulator-test and certify exact iOS release
+        if: inputs.publish
+        shell: bash
+        run: |
+          shopt -s nullglob
+          releases=(.absolutejs/mobile/releases/ios/*)
+          if [[ "\${#releases[@]}" -ne 1 || ! -d "\${releases[0]}" ]]; then
+            echo "Expected exactly one immutable iOS release directory." >&2
+            exit 1
+          fi
+          RELEASE_DIRECTORY="\${releases[0]}"
+          args=(bunx absolute mobile test ios --release "$RELEASE_DIRECTORY" --report .absolutejs/mobile-ci/acceptance/ios --yes)
+          ${appendConfigArgument}
+          "\${args[@]}"
+          args=(bunx absolute mobile certify "$RELEASE_DIRECTORY" --evidence .absolutejs/mobile-ci/acceptance/ios --require simulator --outdir .absolutejs/mobile-ci/certifications/ios --json)
+          "\${args[@]}" > .absolutejs/mobile-ci/ios-certification.json
+      - name: Publish certified iOS release
+        if: inputs.publish
+        shell: bash
+        run: |
+          shopt -s nullglob
+          releases=(.absolutejs/mobile/releases/ios/*)
+          certifications=(.absolutejs/mobile-ci/certifications/ios/*)
+          if [[ "\${#releases[@]}" -ne 1 || "\${#certifications[@]}" -ne 1 || ! -d "\${releases[0]}" || ! -d "\${certifications[0]}" ]]; then
+            echo "Expected exactly one iOS release and certification." >&2
+            exit 1
+          fi
+          args=(bunx absolute mobile publish ios --release "\${releases[0]}" --certification "\${certifications[0]}" --registry "$ABSOLUTE_REGISTRY_MODULE")
+          if [[ -n "$ABSOLUTE_RELEASE_CHANNEL" ]]; then
+            args+=(--channel "$ABSOLUTE_RELEASE_CHANNEL")
+          fi
+          if [[ -n "$ABSOLUTE_TESTFLIGHT_GROUP" ]]; then
+            args+=(--testflight-group "$ABSOLUTE_TESTFLIGHT_GROUP")
+          fi
+          if [[ "$ABSOLUTE_TESTFLIGHT_SUBMIT_REVIEW" == "true" ]]; then
+            args+=(--testflight-submit-review)
+          fi
+          ${appendConfigArgument}
+          "\${args[@]}"
+      - name: Upload iOS acceptance and certification
+        if: always() && inputs.publish
+        uses: actions/upload-artifact@v7
+        with:
+          name: absolute-mobile-ios-certification
+          path: |
+            .absolutejs/mobile-ci/acceptance/ios/
+            .absolutejs/mobile-ci/certifications/ios/
+            .absolutejs/mobile-ci/ios-certification.json
+          if-no-files-found: error
+          retention-days: 30
+          include-hidden-files: true` : "";
   return `
   ios:
     name: Signed iOS release
@@ -33337,13 +33483,14 @@ ${installSteps}
           security list-keychain -d user -s "$KEYCHAIN_PATH"
           mkdir -p "$(dirname "$PROFILE_DESTINATION")"
           cp "$PROFILE_PATH" "$PROFILE_DESTINATION"${appStoreDecode}
-      - name: Build or publish iOS
+      - name: Build iOS
         shell: bash
         run: |
           ${publishCommand}
           ${appendConfigArgument}
           "\${args[@]}"
 ${releaseAuditSteps("ios")}
+${certificationSteps}
       - name: Attest iOS IPA
         if: inputs.attest
         uses: actions/attest@v4
@@ -35430,6 +35577,14 @@ var satisfiesRequirement = (strength, requirement) => {
     return false;
   return STRENGTH_RANK[strength] >= STRENGTH_RANK[requirement];
 };
+var resolveAbsoluteMobileCertificationRequirement = (config, target) => {
+  const channelRequirement = target.channel ? config.releaseCertification.channels[target.channel]?.[target.platform] : undefined;
+  const playRequirement = target.googlePlayTrack ? config.releaseCertification.googlePlayTracks[target.googlePlayTrack] : undefined;
+  const requirements = [channelRequirement, playRequirement].filter((value) => value !== undefined);
+  if (requirements.length === 0)
+    return;
+  return requirements.reduce((strongest, candidate) => STRENGTH_RANK[candidate] > STRENGTH_RANK[strongest] ? candidate : strongest);
+};
 var validateCertifiedEvidence = (platform4, evidence) => {
   if (platform4 === "android") {
     if (evidence.strength !== "installed" || evidence.networkUnavailable !== "proven" || evidence.artifactExactness !== undefined || evidence.distribution !== undefined || evidence.remote)
@@ -35675,6 +35830,15 @@ var prepareAbsoluteAndroidRelease = async (publisher, options) => {
   }
   return versionCode;
 };
+var requireCertificationReceipt = (publication, certification, requirement, releaseId) => {
+  if (!certification && !requirement)
+    return;
+  if (!certification || !requirement)
+    throw new TypeError("Native release publication certification contract is incomplete.");
+  const receipt = publication.certification;
+  if (!receipt || receipt.certificationId !== certification.certificationId || receipt.releaseId !== releaseId || receipt.requirement !== requirement || receipt.strength !== certification.strength)
+    throw new TypeError("Native release registry did not retain the required release certification.");
+};
 var isRecord15 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var isPublisher = (value) => isRecord15(value) && typeof value.publish === "function";
 var publisherModulePath = (projectRoot, requested) => {
@@ -35699,9 +35863,16 @@ var loadAbsoluteNativeReleasePublisher = async (projectRoot, requestedModulePath
   return publisher;
 };
 var publishAbsoluteAndroidRelease = async (options) => {
+  const certificationRequirement = options.certificationRequirement ?? options.certification?.requirement;
+  if (options.certification)
+    verifyAbsoluteMobileReleaseCertification(options.certification, options.release, certificationRequirement);
+  else if (certificationRequirement)
+    throw new TypeError(`Android release publication requires ${certificationRequirement} certification.`);
   const publisher = await loadAbsoluteNativeReleasePublisher(options.projectRoot, options.modulePath);
   const publication = await publisher.publish({
     allowUnsigned: options.allowUnsigned,
+    certification: options.certification,
+    certificationRequirement,
     channel: options.channel,
     googlePlay: options.googlePlay,
     releaseRoot: options.release.releaseRoot,
@@ -35712,6 +35883,7 @@ var publishAbsoluteAndroidRelease = async (options) => {
   if (!actual || actual.appId !== expected.appId || actual.platform !== "android" || actual.releaseId !== expected.releaseId || actual.sha256 !== expected.sha256 || actual.signed !== expected.signed || actual.versionCode !== expected.versionCode || typeof publication.reused !== "boolean") {
     throw new TypeError("Native release registry returned a different Android release identity.");
   }
+  requireCertificationReceipt(publication, options.certification, certificationRequirement, expected.releaseId);
   if (options.channel !== undefined && (publication.channel?.channel !== options.channel || publication.channel.releaseId !== expected.releaseId)) {
     throw new TypeError("Native release registry did not promote the requested channel.");
   }
@@ -35724,10 +35896,17 @@ var publishAbsoluteAndroidRelease = async (options) => {
   return publication;
 };
 var publishAbsoluteIosRelease = async (options) => {
+  const certificationRequirement = options.certificationRequirement ?? options.certification?.requirement;
+  if (options.certification)
+    verifyAbsoluteMobileReleaseCertification(options.certification, options.release, certificationRequirement);
+  else if (certificationRequirement)
+    throw new TypeError(`iOS release publication requires ${certificationRequirement} certification.`);
   const publisher = await loadAbsoluteNativeReleasePublisher(options.projectRoot, options.modulePath);
   const publication = await publisher.publish({
     allowUnsigned: options.allowUnsigned,
     appStoreConnect: options.appStoreConnect,
+    certification: options.certification,
+    certificationRequirement,
     channel: options.channel,
     releaseRoot: options.release.releaseRoot,
     signal: options.signal
@@ -35737,6 +35916,7 @@ var publishAbsoluteIosRelease = async (options) => {
   if (!actual || actual.appId !== expected.appId || actual.platform !== "ios" || actual.releaseId !== expected.releaseId || actual.sha256 !== expected.sha256 || actual.signed !== expected.signed || actual.buildNumber !== expected.buildNumber || actual.marketingVersion !== expected.marketingVersion || typeof publication.reused !== "boolean") {
     throw new TypeError("Native release registry returned a different iOS release identity.");
   }
+  requireCertificationReceipt(publication, options.certification, certificationRequirement, expected.releaseId);
   if (options.channel !== undefined && (publication.channel?.channel !== options.channel || publication.channel.releaseId !== expected.releaseId)) {
     throw new TypeError("Native release registry did not promote the requested channel.");
   }
@@ -43021,6 +43201,7 @@ export {
   resolveAbsoluteDeviceCapabilityPlan,
   resolveAbsoluteIosXcodeProject,
   resolveAbsoluteMobileAuthManifest,
+  resolveAbsoluteMobileCertificationRequirement,
   resolveAbsoluteMobileCompatibilityRelease,
   resolveAbsoluteMobileDeepLink,
   resolveAbsoluteMobileNavigation,
@@ -43062,5 +43243,5 @@ export {
   writeAbsoluteMobileUpdateRegistry
 };
 
-//# debugId=DB53CC7C8DF0442B64756E2164756E21
+//# debugId=F8C3D6BAA9852D3F64756E2164756E21
 //# sourceMappingURL=index.js.map