@absolutejs/absolute 0.20.0-beta.109 → 0.20.0-beta.110

package/CHANGELOG.md

@@ -6,6 +6,13 @@ This file is generated by `absolute-changelog` from the entries in
 `changelog/`. Edit an entry, not this file — and add new ones under
 `changelog/unreleased/`.
 
+## 0.20.0-beta.110 — 2026-09-17
+
+### Added
+
+- **Mobile CI resumes and promotes exact certified artifacts with portable Sigstore provenance** (`ABSOLUTE_MOBILE_CI_WORKFLOW_FORMAT`, `ABSOLUTE_MOBILE_CERTIFICATION_VERIFICATION_FORMAT`, `AbsoluteMobileCertificationVerification`, `AbsoluteNativeReleasePublication`, `AbsoluteNativeReleasePublisher`, `PublishAbsoluteAndroidReleaseOptions`, `createAbsoluteMobileCertificationVerification`, `parseAbsoluteMobileCertificationVerification`, `publishAbsoluteIosRelease`, `readAbsoluteMobileCertificationVerification`, `readAbsoluteSigstoreBundle`, `serializeAbsoluteMobileReleaseCertification`, `writeAbsoluteMobileCertificationVerification`)
+  A protected follow-up GitHub workflow restores a selected prior-run AAB or IPA without rebuilding, re-hashes it, verifies imported installed-app certification, signs the exact certification with GitHub OIDC and pinned Cosign, requires trusted registry provenance, publishes the existing artifact, and retains the final audit receipt.
+
 ## 0.20.0-beta.109 — 2026-09-17
 
 ### Added

package/README.md

@@ -284,9 +284,10 @@ The generated workflow keeps signing and provider credentials behind the
 After testing the immutable Android or iOS release, bind its exact artifact and
 runtime identity to the installed, Simulator, device, or store evidence with
 `absolute mobile certify`. The content-addressed result can be checked again in
-CI without credentials or native tooling, then supplied to `mobile publish
---release ... --certification ...` so publication cannot silently rebuild or
-promote different bytes. Production channels require installed Android and
+CI without credentials or native tooling, then supplied to `mobile ci promote
+<platform> --run-id ... --certification ...` so a protected follow-up workflow
+restores the exact prior-run artifact, adds GitHub OIDC/Sigstore provenance, and
+publishes without rebuilding. Production channels require installed Android and
 store-delivered iOS evidence by default; production Google Play requires
 installed evidence. See
 [mobile release certification](docs/MOBILE_RELEASE_CERTIFICATION.md).

package/changelog.json

@@ -2,6 +2,32 @@
 	"contract": 1,
 	"name": "@absolutejs/absolute",
 	"releases": [
+		{
+			"changes": [
+				{
+					"detail": "A protected follow-up GitHub workflow restores a selected prior-run AAB or IPA without rebuilding, re-hashes it, verifies imported installed-app certification, signs the exact certification with GitHub OIDC and pinned Cosign, requires trusted registry provenance, publishes the existing artifact, and retains the final audit receipt.",
+					"kind": "added",
+					"summary": "Mobile CI resumes and promotes exact certified artifacts with portable Sigstore provenance",
+					"symbols": [
+						"ABSOLUTE_MOBILE_CI_WORKFLOW_FORMAT",
+						"ABSOLUTE_MOBILE_CERTIFICATION_VERIFICATION_FORMAT",
+						"AbsoluteMobileCertificationVerification",
+						"AbsoluteNativeReleasePublication",
+						"AbsoluteNativeReleasePublisher",
+						"PublishAbsoluteAndroidReleaseOptions",
+						"createAbsoluteMobileCertificationVerification",
+						"parseAbsoluteMobileCertificationVerification",
+						"publishAbsoluteIosRelease",
+						"readAbsoluteMobileCertificationVerification",
+						"readAbsoluteSigstoreBundle",
+						"serializeAbsoluteMobileReleaseCertification",
+						"writeAbsoluteMobileCertificationVerification"
+					]
+				}
+			],
+			"date": "2026-09-17",
+			"version": "0.20.0-beta.110"
+		},
 		{
 			"changes": [
 				{

package/dist/angular/components/core/streamingSlotRegistrar.js

@@ -1,7 +1,7 @@
 // @bun
 var __require = import.meta.require;
 
-// .angular-partial-tmp-nbi5HT/src/core/streamingSlotRegistrar.ts
+// .angular-partial-tmp-5cmRn0/src/core/streamingSlotRegistrar.ts
 var STREAMING_SLOT_REGISTRAR_KEY = Symbol.for("absolutejs.streamingSlotRegistrar");
 var STREAMING_SLOT_WARNING_STORAGE_KEY = Symbol.for("absolutejs.streamingSlotWarningController");
 var STREAMING_SLOT_COLLECTION_STORAGE_KEY = Symbol.for("absolutejs.streamingSlotCollectionController");

package/dist/angular/components/core/streamingSlotRegistry.js

@@ -1,7 +1,7 @@
 // @bun
 var __require = import.meta.require;
 
-// .angular-partial-tmp-nbi5HT/src/core/streamingSlotRegistrar.ts
+// .angular-partial-tmp-5cmRn0/src/core/streamingSlotRegistrar.ts
 var STREAMING_SLOT_REGISTRAR_KEY = Symbol.for("absolutejs.streamingSlotRegistrar");
 var STREAMING_SLOT_WARNING_STORAGE_KEY = Symbol.for("absolutejs.streamingSlotWarningController");
 var STREAMING_SLOT_COLLECTION_STORAGE_KEY = Symbol.for("absolutejs.streamingSlotCollectionController");
@@ -48,7 +48,7 @@ var warnMissingStreamingSlotCollector = (primitiveName) => {
   getWarningController()?.maybeWarn(primitiveName);
 };
 
-// .angular-partial-tmp-nbi5HT/src/core/streamingSlotRegistry.ts
+// .angular-partial-tmp-5cmRn0/src/core/streamingSlotRegistry.ts
 var STREAMING_SLOT_STORAGE_KEY = Symbol.for("absolutejs.streamingSlotAsyncLocalStorage");
 var isObjectRecord2 = (value) => Boolean(value) && typeof value === "object";
 var isAsyncLocalStorage = (value) => isObjectRecord2(value) && ("getStore" in value) && typeof value.getStore === "function" && ("run" in value) && typeof value.run === "function";

package/dist/cli/index.js

@@ -203,7 +203,7 @@ if (command === "dev") {
   sendTelemetryEvent("cli:command", {
     command: `mobile:${workspaceCommand ?? "unknown"}`
   });
-  const { runMobile } = await import("./mobile-e4ygngfk.js");
+  const { runMobile } = await import("./mobile-12y4gtsq.js");
   try {
     await runMobile(args);
   } catch (error) {