@absolutejs/absolute 0.20.0-beta.109 → 0.20.0-beta.110

package/dist/cli/{mobile-e4ygngfk.js → mobile-12y4gtsq.js}

@@ -16779,15 +16779,15 @@ var require_main = __commonJS(function(exports) {
 
 // src/cli/scripts/mobile.ts
 import {
-  access as access15,
-  mkdir as mkdir16,
+  access as access16,
+  mkdir as mkdir17,
   mkdtemp as mkdtemp6,
-  readFile as readFile20,
+  readFile as readFile21,
   rm as rm9,
-  writeFile as writeFile17
+  writeFile as writeFile18
 } from "fs/promises";
 import { createPublicKey as createPublicKey2 } from "crypto";
-import { join as join17, relative as relative14, resolve as resolve15 } from "path";
+import { join as join17, relative as relative15, resolve as resolve16 } from "path";
 import { createInterface } from "readline/promises";
 
 // src/mobile/nativeDeepLinks.ts
@@ -22521,6 +22521,8 @@ This certification is local and contains no signing credentials, device identifi
 ${evidence}
 `;
 };
+var serializeAbsoluteMobileReleaseCertification = (certification) => `${JSON.stringify(certification, null, 2)}
+`;
 var verifyAbsoluteMobileReleaseCertification = (certification, release, requirement) => {
   const parsed = parseCertification(certification);
   const expected = releaseIdentity(release);
@@ -22545,8 +22547,7 @@ var writeAbsoluteMobileReleaseCertification = async (projectRoot, certification,
     jsonPath: join13(destination, "certification.json"),
     markdownPath: join13(destination, "certification.md")
   };
-  const json = `${JSON.stringify(certification, null, 2)}
-`;
+  const json = serializeAbsoluteMobileReleaseCertification(certification);
   const markdown = renderAbsoluteMobileReleaseCertification(certification);
   const verifyExisting = async () => {
     const [existingJson, existingMarkdown] = await Promise.all([
@@ -22582,9 +22583,111 @@ var writeAbsoluteMobileReleaseCertification = async (projectRoot, certification,
   return paths;
 };
 
+// src/mobile/certificationVerification.ts
+import { access as access9, mkdir as mkdir12, readFile as readFile16, stat as stat6, writeFile as writeFile13 } from "fs/promises";
+import { dirname as dirname10, isAbsolute as isAbsolute6, relative as relative8, resolve as resolve9, sep as sep6 } from "path";
+var ABSOLUTE_MOBILE_CERTIFICATION_VERIFICATION_FORMAT = 1;
+var MAX_VERIFICATION_BYTES = 1048576;
+var SHA_PATTERN = /^[a-f0-9]{40}$/u;
+var REPOSITORY_PATTERN = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/u;
+var REF_PATTERN = /^refs\/(?:heads|tags)\/[^@\s]+$/u;
+var WORKFLOW_PATTERN = /^\.github\/workflows\/[^/@]+\.ya?ml$/u;
+var isRecord7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var required = (value, name) => {
+  if (typeof value !== "string" || value.trim() === "")
+    throw new TypeError(`${name} is required.`);
+  return value.trim();
+};
+var requireMatch = (value, pattern, name) => {
+  if (!pattern.test(value))
+    throw new TypeError(`${name} is invalid.`);
+  return value;
+};
+var createAbsoluteMobileCertificationVerification = (bundle, environment) => {
+  const repository = required(environment.GITHUB_REPOSITORY, "GITHUB_REPOSITORY");
+  const workflowReference = required(environment.GITHUB_WORKFLOW_REF, "GITHUB_WORKFLOW_REF");
+  const prefix = `${repository}/`;
+  const separator = workflowReference.lastIndexOf("@");
+  if (!workflowReference.startsWith(prefix) || separator <= prefix.length)
+    throw new TypeError("GITHUB_WORKFLOW_REF is invalid.");
+  return parseAbsoluteMobileCertificationVerification({
+    bundle,
+    format: ABSOLUTE_MOBILE_CERTIFICATION_VERIFICATION_FORMAT,
+    identity: {
+      issuer: "https://token.actions.githubusercontent.com",
+      ref: environment.GITHUB_REF,
+      repository,
+      sha: environment.GITHUB_SHA,
+      workflowPath: workflowReference.slice(prefix.length, separator)
+    },
+    kind: "sigstore-bundle"
+  });
+};
+var parseAbsoluteMobileCertificationVerification = (value) => {
+  if (!isRecord7(value) || value.format !== ABSOLUTE_MOBILE_CERTIFICATION_VERIFICATION_FORMAT || value.kind !== "sigstore-bundle" || !isRecord7(value.bundle) || !isRecord7(value.identity))
+    throw new TypeError("Mobile certification verification contract is invalid.");
+  const issuer = required(value.identity.issuer, "verification issuer");
+  if (issuer !== "https://token.actions.githubusercontent.com")
+    throw new TypeError("verification issuer is invalid.");
+  const verification = {
+    bundle: value.bundle,
+    format: ABSOLUTE_MOBILE_CERTIFICATION_VERIFICATION_FORMAT,
+    identity: {
+      issuer,
+      ref: requireMatch(required(value.identity.ref, "verification ref"), REF_PATTERN, "verification ref"),
+      repository: requireMatch(required(value.identity.repository, "verification repository"), REPOSITORY_PATTERN, "verification repository"),
+      sha: requireMatch(required(value.identity.sha, "verification sha"), SHA_PATTERN, "verification sha"),
+      workflowPath: requireMatch(required(value.identity.workflowPath, "verification workflowPath"), WORKFLOW_PATTERN, "verification workflowPath")
+    },
+    kind: "sigstore-bundle"
+  };
+  const bytes = new TextEncoder().encode(JSON.stringify(verification));
+  if (bytes.byteLength > MAX_VERIFICATION_BYTES)
+    throw new TypeError("Mobile certification verification exceeds the 1 MiB limit.");
+  return verification;
+};
+var projectFile = (projectRoot, requested) => {
+  const root = resolve9(projectRoot);
+  const path = resolve9(root, requested);
+  const portable = relative8(root, path);
+  if (portable === ".." || portable.startsWith(`..${sep6}`) || isAbsolute6(portable))
+    throw new TypeError("Mobile certification verification path must remain inside the project.");
+  return path;
+};
+var readAbsoluteMobileCertificationVerification = async (projectRoot, requested) => {
+  const path = projectFile(projectRoot, requested);
+  await access9(path).catch(() => {
+    throw new TypeError(`Mobile certification verification does not exist: ${path}`);
+  });
+  const metadata = await stat6(path);
+  if (!metadata.isFile() || metadata.size > MAX_VERIFICATION_BYTES)
+    throw new TypeError("Mobile certification verification file is invalid.");
+  return parseAbsoluteMobileCertificationVerification(JSON.parse(await readFile16(path, "utf8")));
+};
+var readAbsoluteSigstoreBundle = async (projectRoot, requested) => {
+  const path = projectFile(projectRoot, requested);
+  const metadata = await stat6(path).catch(() => null);
+  if (!metadata?.isFile() || metadata.size > MAX_VERIFICATION_BYTES)
+    throw new TypeError("Sigstore bundle file is invalid.");
+  const value = JSON.parse(await readFile16(path, "utf8"));
+  if (!isRecord7(value))
+    throw new TypeError("Sigstore bundle is invalid.");
+  return value;
+};
+var writeAbsoluteMobileCertificationVerification = async (projectRoot, requested, verification) => {
+  const path = projectFile(projectRoot, requested);
+  const parsed = parseAbsoluteMobileCertificationVerification(verification);
+  await mkdir12(dirname10(path), { recursive: true });
+  await writeFile13(path, `${JSON.stringify(parsed, null, 2)}
+`, {
+    mode: 384
+  });
+  return path;
+};
+
 // src/mobile/releasePublisher.ts
-import { access as access9 } from "fs/promises";
-import { isAbsolute as isAbsolute6, relative as relative8, resolve as resolve9, sep as sep6 } from "path";
+import { access as access10 } from "fs/promises";
+import { isAbsolute as isAbsolute7, relative as relative9, resolve as resolve10, sep as sep7 } from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
 var prepareAbsoluteIosRelease = async (publisher, options) => {
   if (typeof publisher.prepareIosRelease !== "function") {
@@ -22607,33 +22710,35 @@ var prepareAbsoluteAndroidRelease = async (publisher, options) => {
   }
   return versionCode;
 };
-var requireCertificationReceipt = (publication, certification, requirement, releaseId) => {
-  if (!certification && !requirement)
+var requireCertificationReceipt = (publication, certification, requirement, releaseId, verification) => {
+  if (!certification && !requirement && !verification)
     return;
   if (!certification || !requirement)
     throw new TypeError("Native release publication certification contract is incomplete.");
   const receipt = publication.certification;
   if (!receipt || receipt.certificationId !== certification.certificationId || receipt.releaseId !== releaseId || receipt.requirement !== requirement || receipt.strength !== certification.strength)
     throw new TypeError("Native release registry did not retain the required release certification.");
+  if (verification && (!receipt.provenance || receipt.provenance.subject !== releaseId))
+    throw new TypeError("Native release registry did not retain trusted certification provenance.");
 };
-var isRecord7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var isPublisher = (value) => isRecord7(value) && typeof value.publish === "function";
+var isRecord8 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isPublisher = (value) => isRecord8(value) && typeof value.publish === "function";
 var publisherModulePath = (projectRoot, requested) => {
-  const root = resolve9(projectRoot);
-  const path = resolve9(root, requested);
-  const projectRelative = relative8(root, path);
-  if (projectRelative === ".." || projectRelative.startsWith(`..${sep6}`) || isAbsolute6(projectRelative)) {
+  const root = resolve10(projectRoot);
+  const path = resolve10(root, requested);
+  const projectRelative = relative9(root, path);
+  if (projectRelative === ".." || projectRelative.startsWith(`..${sep7}`) || isAbsolute7(projectRelative)) {
     throw new TypeError("mobile publish --registry must remain inside the project.");
   }
   return path;
 };
 var loadAbsoluteNativeReleasePublisher = async (projectRoot, requestedModulePath) => {
   const modulePath = publisherModulePath(projectRoot, requestedModulePath);
-  await access9(modulePath).catch(() => {
+  await access10(modulePath).catch(() => {
     throw new TypeError(`Native release registry module does not exist: ${modulePath}`);
   });
   const loaded = await import(pathToFileURL2(modulePath).href);
-  const publisher = isRecord7(loaded) ? loaded.default ?? loaded.registry : undefined;
+  const publisher = isRecord8(loaded) ? loaded.default ?? loaded.registry : undefined;
   if (!isPublisher(publisher)) {
     throw new TypeError("Native release registry module must default-export a registry with publish(options).");
   }
@@ -22641,6 +22746,8 @@ var loadAbsoluteNativeReleasePublisher = async (projectRoot, requestedModulePath
 };
 var publishAbsoluteAndroidRelease = async (options) => {
   const certificationRequirement = options.certificationRequirement ?? options.certification?.requirement;
+  if (options.certificationVerification && !options.certification)
+    throw new TypeError("Android certification verification requires certification.");
   if (options.certification)
     verifyAbsoluteMobileReleaseCertification(options.certification, options.release, certificationRequirement);
   else if (certificationRequirement)
@@ -22650,6 +22757,7 @@ var publishAbsoluteAndroidRelease = async (options) => {
     allowUnsigned: options.allowUnsigned,
     certification: options.certification,
     certificationRequirement,
+    certificationVerification: options.certificationVerification,
     channel: options.channel,
     googlePlay: options.googlePlay,
     releaseRoot: options.release.releaseRoot,
@@ -22660,7 +22768,7 @@ var publishAbsoluteAndroidRelease = async (options) => {
   if (!actual || actual.appId !== expected.appId || actual.platform !== "android" || actual.releaseId !== expected.releaseId || actual.sha256 !== expected.sha256 || actual.signed !== expected.signed || actual.versionCode !== expected.versionCode || typeof publication.reused !== "boolean") {
     throw new TypeError("Native release registry returned a different Android release identity.");
   }
-  requireCertificationReceipt(publication, options.certification, certificationRequirement, expected.releaseId);
+  requireCertificationReceipt(publication, options.certification, certificationRequirement, expected.releaseId, options.certificationVerification);
   if (options.channel !== undefined && (publication.channel?.channel !== options.channel || publication.channel.releaseId !== expected.releaseId)) {
     throw new TypeError("Native release registry did not promote the requested channel.");
   }
@@ -22674,6 +22782,8 @@ var publishAbsoluteAndroidRelease = async (options) => {
 };
 var publishAbsoluteIosRelease = async (options) => {
   const certificationRequirement = options.certificationRequirement ?? options.certification?.requirement;
+  if (options.certificationVerification && !options.certification)
+    throw new TypeError("iOS certification verification requires certification.");
   if (options.certification)
     verifyAbsoluteMobileReleaseCertification(options.certification, options.release, certificationRequirement);
   else if (certificationRequirement)
@@ -22684,6 +22794,7 @@ var publishAbsoluteIosRelease = async (options) => {
     appStoreConnect: options.appStoreConnect,
     certification: options.certification,
     certificationRequirement,
+    certificationVerification: options.certificationVerification,
     channel: options.channel,
     releaseRoot: options.release.releaseRoot,
     signal: options.signal
@@ -22693,7 +22804,7 @@ var publishAbsoluteIosRelease = async (options) => {
   if (!actual || actual.appId !== expected.appId || actual.platform !== "ios" || actual.releaseId !== expected.releaseId || actual.sha256 !== expected.sha256 || actual.signed !== expected.signed || actual.buildNumber !== expected.buildNumber || actual.marketingVersion !== expected.marketingVersion || typeof publication.reused !== "boolean") {
     throw new TypeError("Native release registry returned a different iOS release identity.");
   }
-  requireCertificationReceipt(publication, options.certification, certificationRequirement, expected.releaseId);
+  requireCertificationReceipt(publication, options.certification, certificationRequirement, expected.releaseId, options.certificationVerification);
   if (options.channel !== undefined && (publication.channel?.channel !== options.channel || publication.channel.releaseId !== expected.releaseId)) {
     throw new TypeError("Native release registry did not promote the requested channel.");
   }
@@ -22707,8 +22818,8 @@ var publishAbsoluteIosRelease = async (options) => {
 };
 
 // src/mobile/mobileInspect.ts
-import { access as access10, readFile as readFile16 } from "fs/promises";
-import { join as join14, relative as relative9, resolve as resolve10 } from "path";
+import { access as access11, readFile as readFile17 } from "fs/promises";
+import { join as join14, relative as relative10, resolve as resolve11 } from "path";
 var ABSOLUTE_MOBILE_INSPECTION_FORMAT = 1;
 var MOBILE_PACKAGE_NAMES = new Set([
   "@absolutejs/absolute",
@@ -22723,19 +22834,19 @@ var MOBILE_PACKAGE_NAMES = new Set([
 ]);
 var isObject2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var portablePath2 = (projectRoot, path) => {
-  const value = relative9(resolve10(projectRoot), resolve10(path)).replaceAll("\\", "/");
+  const value = relative10(resolve11(projectRoot), resolve11(path)).replaceAll("\\", "/");
   return value || ".";
 };
 var pathExists4 = async (path) => {
   try {
-    await access10(path);
+    await access11(path);
     return true;
   } catch {
     return false;
   }
 };
 var readObject2 = async (path) => {
-  const value = JSON.parse(await readFile16(path, "utf8"));
+  const value = JSON.parse(await readFile17(path, "utf8"));
   if (!isObject2(value))
     throw new TypeError("JSON root must be an object.");
   return value;
@@ -22869,9 +22980,9 @@ var renderAbsoluteMobileProjectInspection = (report) => {
 
 // src/mobile/ciWorkflow.ts
 import { existsSync } from "fs";
-import { access as access11, mkdir as mkdir12, readFile as readFile17, writeFile as writeFile13 } from "fs/promises";
-import { dirname as dirname10, extname as extname2, relative as relative10, resolve as resolve11, sep as sep7 } from "path";
-var ABSOLUTE_MOBILE_CI_WORKFLOW_FORMAT = 1;
+import { access as access12, mkdir as mkdir13, readFile as readFile18, writeFile as writeFile14 } from "fs/promises";
+import { dirname as dirname11, extname as extname2, relative as relative11, resolve as resolve12, sep as sep8 } from "path";
+var ABSOLUTE_MOBILE_CI_WORKFLOW_FORMAT = 2;
 var SECRET_NAME_PATTERN = /^[A-Z][A-Z0-9_]*$/u;
 var CI_ENV_INDENTATION = 6;
 var RESERVED_SECRET_NAMES = new Set([
@@ -22891,7 +23002,7 @@ var RESERVED_SECRET_NAMES = new Set([
 ]);
 var exists5 = async (path) => {
   try {
-    await access11(path);
+    await access12(path);
     return true;
   } catch {
     return false;
@@ -22899,10 +23010,10 @@ var exists5 = async (path) => {
 };
 var yamlString = (value) => `'${value.replaceAll("'", "''")}'`;
 var projectPath2 = (projectRoot, value, field2, options = {}) => {
-  const root = resolve11(projectRoot);
-  const path = resolve11(root, value);
-  const portable = relative10(root, path).replaceAll("\\", "/");
-  if (portable === ".." || portable.startsWith(`..${sep7}`) || portable.startsWith("../") || portable === "") {
+  const root = resolve12(projectRoot);
+  const path = resolve12(root, value);
+  const portable = relative11(root, path).replaceAll("\\", "/");
+  if (portable === ".." || portable.startsWith(`..${sep8}`) || portable.startsWith("../") || portable === "") {
     throw new TypeError(`${field2} must remain inside the project root.`);
   }
   if (/\r|\n/u.test(portable) || portable.startsWith("-"))
@@ -22912,11 +23023,11 @@ var projectPath2 = (projectRoot, value, field2, options = {}) => {
   return portable;
 };
 var workflowOutputPath = (projectRoot, value) => {
-  const root = resolve11(projectRoot);
-  const workflows = resolve11(root, ".github/workflows");
-  const path = resolve11(root, value ?? ".github/workflows/absolute-mobile.yml");
-  const portable = relative10(workflows, path);
-  if (portable === ".." || portable.startsWith(`..${sep7}`) || extname2(path) !== ".yml" && extname2(path) !== ".yaml") {
+  const root = resolve12(projectRoot);
+  const workflows = resolve12(root, ".github/workflows");
+  const path = resolve12(root, value ?? ".github/workflows/absolute-mobile.yml");
+  const portable = relative11(workflows, path);
+  if (portable === ".." || portable.startsWith(`..${sep8}`) || extname2(path) !== ".yml" && extname2(path) !== ".yaml") {
     throw new TypeError("mobile ci github --output must be a .yml or .yaml file inside .github/workflows.");
   }
   return path;
@@ -23009,6 +23120,14 @@ var publishingInputs = (platforms, includePublishing) => {
   if (!includePublishing)
     return "";
   const fields = [
+    `      operation:
+        description: Build a release or promote an exact artifact from an earlier run
+        required: true
+        type: choice
+        default: build
+        options:
+          - build
+          - promote`,
     `      publish:
         description: Publish through mobile.release.ts after the signed build
         required: true
@@ -23017,6 +23136,14 @@ var publishingInputs = (platforms, includePublishing) => {
     `      channel:
         description: Optional AbsoluteJS immutable release channel
         required: false
+        type: string`,
+    `      source_run_id:
+        description: Source workflow run ID for promotion without rebuilding
+        required: false
+        type: string`,
+    `      certification_base64:
+        description: AbsoluteJS certification supplied by the promotion CLI
+        required: false
         type: string`
   ];
   if (platforms.includes("android"))
@@ -23046,7 +23173,7 @@ var publishingInputs = (platforms, includePublishing) => {
 ${fields.join(`
 `)}`;
 };
-var jobCondition = (platform) => `github.event_name == 'workflow_dispatch' && (inputs.platform == 'all' || inputs.platform == '${platform}')`;
+var jobCondition = (platform, includePublishing) => `github.event_name == 'workflow_dispatch' && ${includePublishing ? "inputs.operation == 'build' && " : ""}(inputs.platform == 'all' || inputs.platform == '${platform}')`;
 var androidJob = (options) => {
   const custom = customSecretEnvironment(options.customSecrets);
   const publishEnvironment = options.includePublishing ? `
@@ -23073,6 +23200,11 @@ var androidJob = (options) => {
             chmod 600 "$GOOGLE_APPLICATION_CREDENTIALS"
           fi` : "";
   const certificationSteps = options.includePublishing ? `
+      - name: Install pinned Cosign for Android certification
+        if: inputs.publish
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6
+        with:
+          cosign-release: v3.1.2
       - name: Install-test and certify exact Android release
         if: inputs.publish
         shell: bash
@@ -23092,6 +23224,12 @@ var androidJob = (options) => {
           "\${args[@]}"
           args=(bunx absolute mobile certify "$RELEASE_DIRECTORY" --evidence .absolutejs/mobile-ci/acceptance/android --require installed --outdir .absolutejs/mobile-ci/certifications/android --json)
           "\${args[@]}" > .absolutejs/mobile-ci/android-certification.json
+          shopt -s nullglob
+          certifications=(.absolutejs/mobile-ci/certifications/android/*)
+          if [[ "\${#certifications[@]}" -ne 1 ]]; then echo "Expected exactly one Android certification." >&2; exit 1; fi
+          CERTIFICATION_PATH="\${certifications[0]}/certification.json"
+          bunx @absolutejs/attest@0.2.0 sign-blobs "$CERTIFICATION_PATH"
+          bunx absolute mobile ci verification --bundle "$CERTIFICATION_PATH.sigstore.json" --out "\${certifications[0]}/verification.json"
       - name: Publish certified Android release
         if: inputs.publish
         shell: bash
@@ -23103,7 +23241,7 @@ var androidJob = (options) => {
             echo "Expected exactly one Android release and certification." >&2
             exit 1
           fi
-          args=(bunx absolute mobile publish android --release "\${releases[0]}" --certification "\${certifications[0]}" --registry "$ABSOLUTE_REGISTRY_MODULE")
+          args=(bunx absolute mobile publish android --release "\${releases[0]}" --certification "\${certifications[0]}" --certification-attestation "\${certifications[0]}/verification.json" --registry "$ABSOLUTE_REGISTRY_MODULE")
           if [[ -n "$ABSOLUTE_RELEASE_CHANNEL" ]]; then
             args+=(--channel "$ABSOLUTE_RELEASE_CHANNEL")
           fi
@@ -23128,7 +23266,7 @@ var androidJob = (options) => {
   android:
     name: Signed Android release
     needs: validate
-    if: \${{ ${jobCondition("android")} }}
+    if: \${{ ${jobCondition("android", options.includePublishing)} }}
     runs-on: ubuntu-latest
     environment: absolute-mobile-release
     permissions:
@@ -23219,6 +23357,11 @@ var iosJob = (options) => {
             chmod 600 "$APP_STORE_CONNECT_PRIVATE_KEY_PATH"
           fi` : "";
   const certificationSteps = options.includePublishing ? `
+      - name: Install pinned Cosign for iOS certification
+        if: inputs.publish
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6
+        with:
+          cosign-release: v3.1.2
       - name: Simulator-test and certify exact iOS release
         if: inputs.publish
         shell: bash
@@ -23235,6 +23378,12 @@ var iosJob = (options) => {
           "\${args[@]}"
           args=(bunx absolute mobile certify "$RELEASE_DIRECTORY" --evidence .absolutejs/mobile-ci/acceptance/ios --require simulator --outdir .absolutejs/mobile-ci/certifications/ios --json)
           "\${args[@]}" > .absolutejs/mobile-ci/ios-certification.json
+          shopt -s nullglob
+          certifications=(.absolutejs/mobile-ci/certifications/ios/*)
+          if [[ "\${#certifications[@]}" -ne 1 ]]; then echo "Expected exactly one iOS certification." >&2; exit 1; fi
+          CERTIFICATION_PATH="\${certifications[0]}/certification.json"
+          bunx @absolutejs/attest@0.2.0 sign-blobs "$CERTIFICATION_PATH"
+          bunx absolute mobile ci verification --bundle "$CERTIFICATION_PATH.sigstore.json" --out "\${certifications[0]}/verification.json"
       - name: Publish certified iOS release
         if: inputs.publish
         shell: bash
@@ -23246,7 +23395,7 @@ var iosJob = (options) => {
             echo "Expected exactly one iOS release and certification." >&2
             exit 1
           fi
-          args=(bunx absolute mobile publish ios --release "\${releases[0]}" --certification "\${certifications[0]}" --registry "$ABSOLUTE_REGISTRY_MODULE")
+          args=(bunx absolute mobile publish ios --release "\${releases[0]}" --certification "\${certifications[0]}" --certification-attestation "\${certifications[0]}/verification.json" --registry "$ABSOLUTE_REGISTRY_MODULE")
           if [[ -n "$ABSOLUTE_RELEASE_CHANNEL" ]]; then
             args+=(--channel "$ABSOLUTE_RELEASE_CHANNEL")
           fi
@@ -23274,7 +23423,7 @@ var iosJob = (options) => {
   ios:
     name: Signed iOS release
     needs: validate
-    if: \${{ ${jobCondition("ios")} }}
+    if: \${{ ${jobCondition("ios", options.includePublishing)} }}
     runs-on: macos-latest
     environment: absolute-mobile-release
     permissions:
@@ -23352,6 +23501,179 @@ ${certificationSteps}
           rm -f "\${{ runner.temp }}/absolute.mobileprovision"
           rm -f "\${{ runner.temp }}/AuthKey_AbsoluteJS.p8"`;
 };
+var promotionValidationSteps = `      - name: Validate promotion handoff
+        if: github.event_name == 'workflow_dispatch' && inputs.operation == 'promote'
+        shell: bash
+        run: |
+          if [[ "$ABSOLUTE_PROMOTION_PLATFORM" == "all" ]]; then
+            echo "Promotion requires one exact platform." >&2
+            exit 1
+          fi
+          if [[ ! "$ABSOLUTE_SOURCE_RUN_ID" =~ ^[1-9][0-9]*$ ]]; then
+            echo "Promotion requires a numeric source workflow run ID." >&2
+            exit 1
+          fi
+          if [[ -z "$ABSOLUTE_CERTIFICATION_BASE64" ]]; then
+            echo "Promotion requires certification supplied by absolute mobile ci promote." >&2
+            exit 1
+          fi`;
+var promotionSharedSteps = (platform) => `      - name: Restore exact ${platform === "android" ? "Android" : "iOS"} release from source run
+        uses: actions/download-artifact@v8
+        with:
+          name: absolute-mobile-${platform}
+          path: .absolutejs/mobile/releases/${platform}
+          run-id: \${{ inputs.source_run_id }}
+          github-token: \${{ github.token }}
+      - name: Import and verify exact certification
+        shell: bash
+        run: |
+          mkdir -p .absolutejs/mobile-ci/imported-certification
+          printf '%s' "$ABSOLUTE_CERTIFICATION_BASE64" | base64 --decode > .absolutejs/mobile-ci/imported-certification/certification.json
+          shopt -s nullglob
+          releases=(.absolutejs/mobile/releases/${platform}/*)
+          if [[ "\${#releases[@]}" -ne 1 || ! -d "\${releases[0]}" ]]; then
+            echo "Expected exactly one immutable ${platform} release directory from the source run." >&2
+            exit 1
+          fi
+          args=(bunx absolute mobile certify "\${releases[0]}" --verify .absolutejs/mobile-ci/imported-certification/certification.json --json)
+          "\${args[@]}" > .absolutejs/mobile-ci/imported-certification/verified.json
+      - name: Install pinned Cosign
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6
+        with:
+          cosign-release: v3.1.2
+      - name: Sign certification with GitHub OIDC
+        shell: bash
+        run: |
+          bunx @absolutejs/attest@0.2.0 sign-blobs .absolutejs/mobile-ci/imported-certification/certification.json
+          bunx absolute mobile ci verification             --bundle .absolutejs/mobile-ci/imported-certification/certification.json.sigstore.json             --out .absolutejs/mobile-ci/imported-certification/verification.json`;
+var androidPromotionJob = (options) => {
+  const custom = customSecretEnvironment(options.customSecrets);
+  return `
+  promote_android:
+    name: Promote exact certified Android release
+    needs: validate
+    if: \${{ github.event_name == 'workflow_dispatch' && inputs.operation == 'promote' && inputs.platform == 'android' }}
+    runs-on: ubuntu-latest
+    environment: absolute-mobile-release
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
+    env:
+      ABSOLUTE_CERTIFICATION_BASE64: \${{ inputs.certification_base64 }}
+      ABSOLUTE_RELEASE_CHANNEL: \${{ inputs.channel }}
+      ABSOLUTE_PLAY_TRACK: \${{ inputs.play_track }}
+      ABSOLUTE_GOOGLE_CREDENTIALS_BASE64: \${{ secrets.ABSOLUTE_GOOGLE_CREDENTIALS_BASE64 }}
+      GOOGLE_APPLICATION_CREDENTIALS: \${{ runner.temp }}/absolute-google-credentials.json${custom ? `
+${custom}` : ""}
+${commandEnvironment({ configPath: undefined, registryModule: "", serverEntry: "" })}
+    steps:
+${installSteps}
+${promotionSharedSteps("android")}
+      - name: Publish restored Android release
+        shell: bash
+        run: |
+          if [[ -n "$ABSOLUTE_RELEASE_CHANNEL" || "$ABSOLUTE_PLAY_TRACK" != "registry-only" ]]; then
+            true
+          else
+            echo "Promotion requires a release channel or Google Play track." >&2
+            exit 1
+          fi
+          if [[ "$ABSOLUTE_PLAY_TRACK" != "registry-only" ]]; then
+            if [[ -z "$ABSOLUTE_GOOGLE_CREDENTIALS_BASE64" ]]; then
+              echo "ABSOLUTE_GOOGLE_CREDENTIALS_BASE64 is required for Google Play publication." >&2
+              exit 1
+            fi
+            printf '%s' "$ABSOLUTE_GOOGLE_CREDENTIALS_BASE64" | base64 --decode > "$GOOGLE_APPLICATION_CREDENTIALS"
+            chmod 600 "$GOOGLE_APPLICATION_CREDENTIALS"
+          fi
+          shopt -s nullglob
+          releases=(.absolutejs/mobile/releases/android/*)
+          args=(bunx absolute mobile publish android --release "\${releases[0]}" --certification .absolutejs/mobile-ci/imported-certification/certification.json --certification-attestation .absolutejs/mobile-ci/imported-certification/verification.json --registry "$ABSOLUTE_REGISTRY_MODULE" --json)
+          if [[ -n "$ABSOLUTE_RELEASE_CHANNEL" ]]; then args+=(--channel "$ABSOLUTE_RELEASE_CHANNEL"); fi
+          if [[ "$ABSOLUTE_PLAY_TRACK" != "registry-only" ]]; then args+=(--play-track "$ABSOLUTE_PLAY_TRACK"); fi
+          ${appendConfigArgument}
+          "\${args[@]}" > .absolutejs/mobile-ci/promotion-receipt.json
+      - name: Upload Android promotion audit
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: absolute-mobile-android-promotion-\${{ github.run_id }}
+          path: |
+            .absolutejs/mobile-ci/imported-certification/
+            .absolutejs/mobile-ci/promotion-receipt.json
+          if-no-files-found: error
+          retention-days: 90
+          include-hidden-files: true
+      - name: Remove Google credentials
+        if: always()
+        run: rm -f "\${{ runner.temp }}/absolute-google-credentials.json"`;
+};
+var iosPromotionJob = (options) => {
+  const custom = customSecretEnvironment(options.customSecrets);
+  return `
+  promote_ios:
+    name: Promote exact certified iOS release
+    needs: validate
+    if: \${{ github.event_name == 'workflow_dispatch' && inputs.operation == 'promote' && inputs.platform == 'ios' }}
+    runs-on: ubuntu-latest
+    environment: absolute-mobile-release
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
+    env:
+      ABSOLUTE_CERTIFICATION_BASE64: \${{ inputs.certification_base64 }}
+      ABSOLUTE_RELEASE_CHANNEL: \${{ inputs.channel }}
+      ABSOLUTE_TESTFLIGHT_GROUP: \${{ inputs.testflight_group }}
+      ABSOLUTE_TESTFLIGHT_SUBMIT_REVIEW: \${{ inputs.submit_testflight_review }}
+      APP_STORE_CONNECT_ISSUER_ID: \${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
+      APP_STORE_CONNECT_KEY_ID: \${{ secrets.APP_STORE_CONNECT_KEY_ID }}
+      APP_STORE_CONNECT_PRIVATE_KEY_BASE64: \${{ secrets.APP_STORE_CONNECT_PRIVATE_KEY_BASE64 }}
+      APP_STORE_CONNECT_PRIVATE_KEY_PATH: \${{ runner.temp }}/AuthKey_AbsoluteJS.p8${custom ? `
+${custom}` : ""}
+${commandEnvironment({ configPath: undefined, registryModule: "", serverEntry: "" })}
+    steps:
+${installSteps}
+${promotionSharedSteps("ios")}
+      - name: Publish restored iOS release
+        shell: bash
+        run: |
+          if [[ -z "$ABSOLUTE_RELEASE_CHANNEL" && -z "$ABSOLUTE_TESTFLIGHT_GROUP" ]]; then
+            echo "Promotion requires a release channel or TestFlight group." >&2
+            exit 1
+          fi
+          if [[ -n "$ABSOLUTE_TESTFLIGHT_GROUP" ]]; then
+            required=(APP_STORE_CONNECT_ISSUER_ID APP_STORE_CONNECT_KEY_ID APP_STORE_CONNECT_PRIVATE_KEY_BASE64)
+            for name in "\${required[@]}"; do
+              if [[ -z "\${!name}" ]]; then echo "$name is required for TestFlight publication." >&2; exit 1; fi
+            done
+            printf '%s' "$APP_STORE_CONNECT_PRIVATE_KEY_BASE64" | base64 --decode > "$APP_STORE_CONNECT_PRIVATE_KEY_PATH"
+            chmod 600 "$APP_STORE_CONNECT_PRIVATE_KEY_PATH"
+          fi
+          shopt -s nullglob
+          releases=(.absolutejs/mobile/releases/ios/*)
+          args=(bunx absolute mobile publish ios --release "\${releases[0]}" --certification .absolutejs/mobile-ci/imported-certification/certification.json --certification-attestation .absolutejs/mobile-ci/imported-certification/verification.json --registry "$ABSOLUTE_REGISTRY_MODULE" --json)
+          if [[ -n "$ABSOLUTE_RELEASE_CHANNEL" ]]; then args+=(--channel "$ABSOLUTE_RELEASE_CHANNEL"); fi
+          if [[ -n "$ABSOLUTE_TESTFLIGHT_GROUP" ]]; then args+=(--testflight-group "$ABSOLUTE_TESTFLIGHT_GROUP"); fi
+          if [[ "$ABSOLUTE_TESTFLIGHT_SUBMIT_REVIEW" == "true" ]]; then args+=(--testflight-submit-review); fi
+          ${appendConfigArgument}
+          "\${args[@]}" > .absolutejs/mobile-ci/promotion-receipt.json
+      - name: Upload iOS promotion audit
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: absolute-mobile-ios-promotion-\${{ github.run_id }}
+          path: |
+            .absolutejs/mobile-ci/imported-certification/
+            .absolutejs/mobile-ci/promotion-receipt.json
+          if-no-files-found: error
+          retention-days: 90
+          include-hidden-files: true
+      - name: Remove App Store Connect credentials
+        if: always()
+        run: rm -f "\${{ runner.temp }}/AuthKey_AbsoluteJS.p8"`;
+};
 var requiredSecrets = (platforms, includePublishing, custom) => [
   ...platforms.includes("android") ? [
     "ABSOLUTE_ANDROID_KEYSTORE_BASE64",
@@ -23413,10 +23735,14 @@ jobs:
     permissions:
       contents: read
     env:
-${environment}
+${environment}${includePublishing ? `
+      ABSOLUTE_PROMOTION_PLATFORM: \${{ inputs.platform }}
+      ABSOLUTE_SOURCE_RUN_ID: \${{ inputs.source_run_id }}
+      ABSOLUTE_CERTIFICATION_BASE64: \${{ inputs.certification_base64 }}` : ""}
     steps:
-${installSteps}
-${bundleAuditSteps}${platforms.includes("android") ? androidJob({ customSecrets, includePublishing }) : ""}${platforms.includes("ios") ? iosJob({ customSecrets, includePublishing }) : ""}
+${installSteps}${includePublishing ? `
+${promotionValidationSteps}` : ""}
+${bundleAuditSteps}${platforms.includes("android") ? androidJob({ customSecrets, includePublishing }) : ""}${platforms.includes("ios") ? iosJob({ customSecrets, includePublishing }) : ""}${includePublishing && platforms.includes("android") ? androidPromotionJob({ customSecrets, includePublishing }) : ""}${includePublishing && platforms.includes("ios") ? iosPromotionJob({ customSecrets, includePublishing }) : ""}
 `;
   const replacements = new Map([
     [
@@ -23442,12 +23768,12 @@ ${bundleAuditSteps}${platforms.includes("android") ? androidJob({ customSecrets,
 var writeAbsoluteMobileGithubWorkflow = async (options) => {
   const path = workflowOutputPath(options.projectRoot, options.outputPath);
   const generated = createAbsoluteMobileGithubWorkflow(options);
-  const previous = await exists5(path) ? await readFile17(path, "utf8") : undefined;
+  const previous = await exists5(path) ? await readFile18(path, "utf8") : undefined;
   if (previous !== undefined && previous !== generated.workflow && !options.force)
-    throw new TypeError(`${relative10(options.projectRoot, path)} already exists and differs. Rerun with --force to replace the generated workflow.`);
+    throw new TypeError(`${relative11(options.projectRoot, path)} already exists and differs. Rerun with --force to replace the generated workflow.`);
   if (previous !== generated.workflow) {
-    await mkdir12(dirname10(path), { recursive: true });
-    await writeFile13(path, generated.workflow);
+    await mkdir13(dirname11(path), { recursive: true });
+    await writeFile14(path, generated.workflow);
   }
   return {
     changed: previous !== generated.workflow,
@@ -23463,16 +23789,16 @@ var writeAbsoluteMobileGithubWorkflow = async (options) => {
 import { createHash as createHash6, sign, verify } from "crypto";
 import {
   cp,
-  mkdir as mkdir13,
+  mkdir as mkdir14,
   mkdtemp as mkdtemp5,
   readdir as readdir6,
-  readFile as readFile18,
+  readFile as readFile19,
   rename as rename11,
   rm as rm8,
-  stat as stat6,
-  writeFile as writeFile14
+  stat as stat7,
+  writeFile as writeFile15
 } from "fs/promises";
-import { dirname as dirname11, join as join15, relative as relative11, resolve as resolve12 } from "path";
+import { dirname as dirname12, join as join15, relative as relative12, resolve as resolve13 } from "path";
 var UPDATE_MANIFEST_FILE = "update.json";
 var UPDATE_FILES_DIRECTORY = "files";
 var sha2564 = (value) => createHash6("sha256").update(value).digest("hex");
@@ -23484,22 +23810,22 @@ var listFiles = async (root, directory = root) => {
       return listFiles(root, path);
     if (!entry.isFile())
       throw new TypeError("Mobile updates cannot contain links or special files.");
-    return [relative11(root, path).replaceAll("\\", "/")];
+    return [relative12(root, path).replaceAll("\\", "/")];
   }));
   return paths.flat().sort((left, right) => left.localeCompare(right));
 };
 var inspectFiles = async (root, paths) => Promise.all(paths.map(async (path) => {
   const source = join15(root, path);
   const [metadata, contents] = await Promise.all([
-    stat6(source),
-    readFile18(source)
+    stat7(source),
+    readFile19(source)
   ]);
   return { bytes: metadata.size, path, sha256: sha2564(contents) };
 }));
 var releaseIdFor = (value) => `amu_${sha2564(canonicalizeAbsoluteMobileUpdate(value))}`;
 var buildAbsoluteMobileUpdate = async (options) => {
-  const bundleDirectory = resolve12(options.bundleDirectory);
-  const outputRoot = resolve12(options.outputDirectory);
+  const bundleDirectory = resolve13(options.bundleDirectory);
+  const outputRoot = resolve13(options.outputDirectory);
   if (outputRoot === bundleDirectory || outputRoot.startsWith(`${bundleDirectory}/`))
     throw new TypeError("Mobile update output must be outside the embedded bundle.");
   const paths = await listFiles(bundleDirectory);
@@ -23527,7 +23853,7 @@ var buildAbsoluteMobileUpdate = async (options) => {
       value: signature.toString("base64")
     }
   });
-  await mkdir13(outputRoot, { recursive: true });
+  await mkdir14(outputRoot, { recursive: true });
   const outputDirectory = join15(outputRoot, manifest.releaseId);
   const staging = await mkdtemp5(join15(outputRoot, ".stage-"));
   try {
@@ -23535,7 +23861,7 @@ var buildAbsoluteMobileUpdate = async (options) => {
       force: true,
       recursive: true
     });
-    await writeFile14(join15(staging, UPDATE_MANIFEST_FILE), `${JSON.stringify(manifest, null, "\t")}
+    await writeFile15(join15(staging, UPDATE_MANIFEST_FILE), `${JSON.stringify(manifest, null, "\t")}
 `);
     await rename11(staging, outputDirectory);
   } catch (error) {
@@ -23550,7 +23876,7 @@ var buildAbsoluteMobileUpdate = async (options) => {
     outputDirectory
   };
 };
-var readAbsoluteMobileUpdate = async (directory) => parseAbsoluteMobileUpdateManifest(JSON.parse(await readFile18(join15(resolve12(directory), UPDATE_MANIFEST_FILE), "utf8")));
+var readAbsoluteMobileUpdate = async (directory) => parseAbsoluteMobileUpdateManifest(JSON.parse(await readFile19(join15(resolve13(directory), UPDATE_MANIFEST_FILE), "utf8")));
 var verifyAbsoluteMobileUpdateSignature = (manifestValue, publicKey) => {
   const manifest = parseAbsoluteMobileUpdateManifest(manifestValue);
   const valid = verify("sha256", absoluteMobileUpdateSigningPayload(unsignedAbsoluteMobileUpdate(manifest)), { dsaEncoding: "ieee-p1363", key: publicKey }, Buffer.from(manifest.signature.value, "base64"));
@@ -23560,8 +23886,8 @@ var verifyAbsoluteMobileUpdateSignature = (manifestValue, publicKey) => {
 };
 
 // src/mobile/expoUpdate.ts
-import { access as access12, mkdir as mkdir14, readFile as readFile19, writeFile as writeFile15 } from "fs/promises";
-import { dirname as dirname12, extname as extname3, join as join16 } from "path";
+import { access as access13, mkdir as mkdir15, readFile as readFile20, writeFile as writeFile16 } from "fs/promises";
+import { dirname as dirname13, extname as extname3, join as join16 } from "path";
 var ABSOLUTE_EXPO_UPDATE_DESCRIPTOR = "_absolute/expo-update.json";
 var ABSOLUTE_EXPO_UPDATE_FORMAT = 1;
 var object2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
@@ -23627,7 +23953,7 @@ var parseAbsoluteExpoUpdateDescriptor = (value) => {
   };
 };
 var finalizeAbsoluteExpoUpdateExport = async (options) => {
-  const metadata = JSON.parse(await readFile19(join16(options.exportDirectory, "metadata.json"), "utf8"));
+  const metadata = JSON.parse(await readFile20(join16(options.exportDirectory, "metadata.json"), "utf8"));
   if (!object2(metadata) || !object2(metadata.fileMetadata))
     throw new TypeError("Expo export metadata.json is invalid.");
   const descriptor = parseAbsoluteExpoUpdateDescriptor({
@@ -23638,30 +23964,30 @@ var finalizeAbsoluteExpoUpdateExport = async (options) => {
     runtimeVersion: options.runtimeVersion
   });
   const referenced = Object.values(descriptor.platforms).flatMap((entry) => entry ? [entry.launchAsset, ...entry.assets] : []);
-  await Promise.all(referenced.map(({ path }) => access12(join16(options.exportDirectory, path)).catch(() => {
+  await Promise.all(referenced.map(({ path }) => access13(join16(options.exportDirectory, path)).catch(() => {
     throw new TypeError(`Expo export metadata references missing asset ${path}.`);
   })));
   const destination = join16(options.exportDirectory, ABSOLUTE_EXPO_UPDATE_DESCRIPTOR);
-  await mkdir14(dirname12(destination), { recursive: true });
-  await writeFile15(destination, `${JSON.stringify(descriptor, null, "\t")}
+  await mkdir15(dirname13(destination), { recursive: true });
+  await writeFile16(destination, `${JSON.stringify(descriptor, null, "\t")}
 `);
   return { descriptor, path: destination };
 };
 
 // src/mobile/expoCodeSigning.ts
 var import_code_signing_certificates = __toESM(require_main(), 1);
-import { access as access13, mkdir as mkdir15, writeFile as writeFile16 } from "fs/promises";
-import { dirname as dirname13, isAbsolute as isAbsolute7, relative as relative12, resolve as resolve13, sep as sep8 } from "path";
-var exists6 = async (path) => access13(path).then(() => true).catch(() => false);
+import { access as access14, mkdir as mkdir16, writeFile as writeFile17 } from "fs/promises";
+import { dirname as dirname14, isAbsolute as isAbsolute8, relative as relative13, resolve as resolve14, sep as sep9 } from "path";
+var exists6 = async (path) => access14(path).then(() => true).catch(() => false);
 var inside4 = (root, path) => {
-  const location = relative12(root, path);
-  return location === "" || location !== ".." && !location.startsWith(`..${sep8}`) && !isAbsolute7(location);
+  const location = relative13(root, path);
+  return location === "" || location !== ".." && !location.startsWith(`..${sep9}`) && !isAbsolute8(location);
 };
 var generateAbsoluteExpoCodeSigning = async (options) => {
-  const root = resolve13(options.projectRoot);
-  const certificatePath = resolve13(root, options.certificatePath);
-  const privateKeyPath = resolve13(root, options.privateKeyPath);
-  const publicKeyPath = resolve13(root, options.publicKeyPath ?? resolve13(dirname13(privateKeyPath), "public-key.pem"));
+  const root = resolve14(options.projectRoot);
+  const certificatePath = resolve14(root, options.certificatePath);
+  const privateKeyPath = resolve14(root, options.privateKeyPath);
+  const publicKeyPath = resolve14(root, options.publicKeyPath ?? resolve14(dirname14(privateKeyPath), "public-key.pem"));
   if (!inside4(root, certificatePath))
     throw new TypeError("Expo code-signing certificate must be written inside the project so store builds can embed it.");
   if (inside4(root, privateKeyPath) || inside4(root, publicKeyPath))
@@ -23691,11 +24017,11 @@ var generateAbsoluteExpoCodeSigning = async (options) => {
   import_code_signing_certificates.validateSelfSignedCertificate(certificate, keyPair);
   const { privateKeyPEM, publicKeyPEM } = import_code_signing_certificates.convertKeyPairToPEM(keyPair);
   const certificatePem = import_code_signing_certificates.convertCertificateToCertificatePEM(certificate);
-  await Promise.all([certificatePath, privateKeyPath, publicKeyPath].map((path) => mkdir15(dirname13(path), { recursive: true })));
+  await Promise.all([certificatePath, privateKeyPath, publicKeyPath].map((path) => mkdir16(dirname14(path), { recursive: true })));
   await Promise.all([
-    writeFile16(certificatePath, certificatePem, { flag: "wx", mode: 420 }),
-    writeFile16(privateKeyPath, privateKeyPEM, { flag: "wx", mode: 384 }),
-    writeFile16(publicKeyPath, publicKeyPEM, { flag: "wx", mode: 420 })
+    writeFile17(certificatePath, certificatePem, { flag: "wx", mode: 420 }),
+    writeFile17(privateKeyPath, privateKeyPEM, { flag: "wx", mode: 384 }),
+    writeFile17(publicKeyPath, publicKeyPEM, { flag: "wx", mode: 420 })
   ]);
   return {
     certificatePath,
@@ -23706,8 +24032,8 @@ var generateAbsoluteExpoCodeSigning = async (options) => {
 };
 
 // src/mobile/updatePublisher.ts
-import { access as access14 } from "fs/promises";
-import { isAbsolute as isAbsolute8, relative as relative13, resolve as resolve14, sep as sep9 } from "path";
+import { access as access15 } from "fs/promises";
+import { isAbsolute as isAbsolute9, relative as relative14, resolve as resolve15, sep as sep10 } from "path";
 import { pathToFileURL as pathToFileURL3 } from "url";
 var lifecycleMethod = (publisher, name) => {
   const method = publisher[name];
@@ -23816,16 +24142,16 @@ var pruneAbsoluteMobileUpdates = async (options) => {
 var object3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var isPublisher2 = (value) => object3(value) && typeof value.publishUpdate === "function" && typeof value.promoteUpdate === "function" && typeof value.rollbackUpdate === "function";
 var projectPath3 = (projectRoot, requested, label) => {
-  const root = resolve14(projectRoot);
-  const path = resolve14(root, requested);
-  const projectRelative = relative13(root, path);
-  if (projectRelative === ".." || projectRelative.startsWith(`..${sep9}`) || isAbsolute8(projectRelative))
+  const root = resolve15(projectRoot);
+  const path = resolve15(root, requested);
+  const projectRelative = relative14(root, path);
+  if (projectRelative === ".." || projectRelative.startsWith(`..${sep10}`) || isAbsolute9(projectRelative))
     throw new TypeError(`${label} must remain inside the project.`);
   return path;
 };
 var loadAbsoluteMobileUpdatePublisher = async (projectRoot, requestedModulePath) => {
   const modulePath = projectPath3(projectRoot, requestedModulePath, "mobile update registry");
-  await access14(modulePath).catch(() => {
+  await access15(modulePath).catch(() => {
     throw new TypeError(`Mobile update registry does not exist: ${modulePath}`);
   });
   const loaded = await import(pathToFileURL3(modulePath).href);
@@ -23880,10 +24206,10 @@ var rollbackAbsoluteMobileUpdate = async (options) => {
 var NOT_FOUND4 = -1;
 var ANDROID_EMULATOR_BOOT_POLL_MS = 500;
 var ANDROID_EMULATOR_BOOT_TIMEOUT_MS = 180000;
-var isRecord8 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isRecord9 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var expoPublicConfig = (config) => {
   const result = { ...config };
-  if (!isRecord8(result.updates))
+  if (!isRecord9(result.updates))
     return result;
   const {
     codeSigningCertificate: _codeSigningCertificate,
@@ -23923,13 +24249,13 @@ var CAPACITOR_SYNC_PACKAGE_SPECS = [
 ];
 var packageNameFromSpec = (spec) => spec.slice(0, spec.lastIndexOf("@"));
 var directProjectPackages = async (projectRoot) => {
-  const manifest = JSON.parse(await readFile20(join17(projectRoot, "package.json"), "utf8"));
-  if (!isRecord8(manifest))
+  const manifest = JSON.parse(await readFile21(join17(projectRoot, "package.json"), "utf8"));
+  if (!isRecord9(manifest))
     throw new TypeError("Application package.json must contain an object.");
   const names = new Set;
   for (const field2 of ["dependencies", "devDependencies"]) {
     const dependencies = Reflect.get(manifest, field2);
-    if (isRecord8(dependencies))
+    if (isRecord9(dependencies))
       for (const name of Object.keys(dependencies))
         names.add(name);
   }
@@ -23937,8 +24263,8 @@ var directProjectPackages = async (projectRoot) => {
 };
 var resolvedPackageVersion = async (projectRoot, packageName) => {
   try {
-    const manifest = JSON.parse(await readFile20(join17(projectRoot, "node_modules", packageName, "package.json"), "utf8"));
-    return isRecord8(manifest) && typeof manifest.version === "string" ? manifest.version : undefined;
+    const manifest = JSON.parse(await readFile21(join17(projectRoot, "node_modules", packageName, "package.json"), "utf8"));
+    return isRecord9(manifest) && typeof manifest.version === "string" ? manifest.version : undefined;
   } catch {
     return;
   }
@@ -24003,7 +24329,7 @@ var runCapacitorForPlatforms = (projectRoot, command, platforms) => platforms.re
 var expoExecutable = async (project) => {
   const executable = join17(project, "node_modules", ".bin", "expo");
   try {
-    await access15(executable);
+    await access16(executable);
     return executable;
   } catch {
     throw new TypeError("Expo dependencies are not installed in the generated shell. Run `absolute mobile init --yes`.");
@@ -24035,14 +24361,14 @@ var runExpo = async (project, args, options = {}) => {
 };
 var ensureExpoPackages = async (project, args) => {
   try {
-    const manifest = JSON.parse(await readFile20(join17(project, "package.json"), "utf8"));
+    const manifest = JSON.parse(await readFile21(join17(project, "package.json"), "utf8"));
     const dependencies = typeof manifest === "object" && manifest !== null ? Reflect.get(manifest, "dependencies") : undefined;
     if (typeof dependencies !== "object" || dependencies === null || Array.isArray(dependencies))
       throw new TypeError("Generated Expo dependencies are invalid.");
     await Promise.all(Object.entries(dependencies).map(async ([name, expected]) => {
       if (typeof expected !== "string")
         throw new TypeError("Generated Expo dependency version is invalid.");
-      const installed = JSON.parse(await readFile20(join17(project, "node_modules", name, "package.json"), "utf8"));
+      const installed = JSON.parse(await readFile21(join17(project, "node_modules", name, "package.json"), "utf8"));
       const actual = typeof installed === "object" && installed !== null ? Reflect.get(installed, "version") : undefined;
       if (typeof actual !== "string")
         throw new TypeError("Installed Expo dependency version is invalid.");
@@ -24240,7 +24566,7 @@ var sync = async (args) => {
 };
 var associations = async (args) => {
   const { mobile, projectRoot } = await loadMobile(valueAfter(args, "--config"));
-  const outputDirectory = resolve15(projectRoot, valueAfter(args, "--outdir") ?? ".absolutejs/mobile/associations");
+  const outputDirectory = resolve16(projectRoot, valueAfter(args, "--outdir") ?? ".absolutejs/mobile/associations");
   if (args.includes("--verify")) {
     const result2 = await verifyAbsoluteMobileAssociationFiles(mobile);
     console.log(`Verified ${result2.results.length} hosted association files`);
@@ -24292,7 +24618,7 @@ var generateGithubCi = async (args) => {
   const publicResult = {
     changed: result.changed,
     format: result.format,
-    path: relative14(projectRoot, result.path).replaceAll("\\", "/"),
+    path: relative15(projectRoot, result.path).replaceAll("\\", "/"),
     platforms: result.platforms,
     publishing: result.publishing,
     requiredSecrets: result.requiredSecrets
@@ -24305,8 +24631,91 @@ var generateGithubCi = async (args) => {
   console.log("Create a protected GitHub environment named absolute-mobile-release, then add these secrets:");
   result.requiredSecrets.forEach((name) => console.log(`  ${name}`));
   console.log("Pull requests run the secret-free release audit. Signed builds and optional publishing run only through manual workflow dispatch.");
+  if (result.publishing)
+    console.log("After later installed-app certification, run `absolute mobile ci promote <platform> --run-id <source-run> --certification <path> ...` to publish the exact retained artifact without rebuilding.");
   return publicResult;
 };
+var createGithubCertificationVerification = async (args) => {
+  const bundlePath = valueAfter(args, "--bundle");
+  const outputPath = valueAfter(args, "--out");
+  if (!bundlePath || bundlePath.startsWith("-") || !outputPath || outputPath.startsWith("-"))
+    throw new TypeError("Usage: absolute mobile ci verification --bundle bundle.json --out verification.json");
+  const projectRoot = process.cwd();
+  const bundle = await readAbsoluteSigstoreBundle(projectRoot, bundlePath);
+  const verification = createAbsoluteMobileCertificationVerification(bundle, {
+    GITHUB_REF: process.env.GITHUB_REF,
+    GITHUB_REPOSITORY: process.env.GITHUB_REPOSITORY,
+    GITHUB_SHA: process.env.GITHUB_SHA,
+    GITHUB_WORKFLOW_REF: process.env.GITHUB_WORKFLOW_REF
+  });
+  const path = await writeAbsoluteMobileCertificationVerification(projectRoot, outputPath, verification);
+  console.log(relative15(projectRoot, path).replaceAll("\\", "/"));
+  return verification;
+};
+var dispatchGithubMobilePromotion = async (args) => {
+  const [platform2] = args;
+  if (platform2 !== "android" && platform2 !== "ios")
+    throw new TypeError("Usage: absolute mobile ci promote <android|ios> --run-id id --certification directory-or-json [--channel name] [store options]");
+  const runId = valueAfter(args, "--run-id");
+  if (!runId || !/^[1-9][0-9]*$/u.test(runId))
+    throw new TypeError("mobile ci promote requires a numeric --run-id.");
+  const requestedCertification = valueAfter(args, "--certification");
+  if (!requestedCertification || requestedCertification.startsWith("-"))
+    throw new TypeError("mobile ci promote requires --certification <directory-or-json>.");
+  const configPath = valueAfter(args, "--config");
+  const { mobile, projectRoot } = await loadMobile(configPath);
+  const { certification } = await readAbsoluteMobileReleaseCertification(projectRoot, requestedCertification);
+  if (certification.release.platform !== platform2 || certification.release.appId !== mobile.appId || certification.release.engine !== mobile.engine)
+    throw new TypeError("The certification does not match this application platform, app ID, or engine.");
+  const channel = valueAfter(args, "--channel") ?? "";
+  const playTrack = valueAfter(args, "--play-track") ?? "registry-only";
+  const testflightGroup = valueAfter(args, "--testflight-group") ?? "";
+  if (channel === "" && (platform2 === "android" ? playTrack === "registry-only" : testflightGroup === ""))
+    throw new TypeError("mobile ci promote requires --channel or a platform store target.");
+  const certificationBase64 = Buffer.from(serializeAbsoluteMobileReleaseCertification(certification)).toString("base64");
+  if (certificationBase64.length > 48000)
+    throw new TypeError("Mobile certification is too large for protected GitHub dispatch.");
+  const workflow = valueAfter(args, "--workflow") ?? ".github/workflows/absolute-mobile.yml";
+  const command = [
+    "workflow",
+    "run",
+    workflow,
+    "-f",
+    "operation=promote",
+    "-f",
+    `platform=${platform2}`,
+    "-f",
+    `source_run_id=${runId}`,
+    "-f",
+    `certification_base64=${certificationBase64}`,
+    "-f",
+    `channel=${channel}`
+  ];
+  if (platform2 === "android")
+    command.push("-f", `play_track=${playTrack}`);
+  else {
+    command.push("-f", `testflight_group=${testflightGroup}`);
+    command.push("-f", `submit_testflight_review=${args.includes("--testflight-submit-review")}`);
+  }
+  const ref = valueAfter(args, "--ref");
+  if (ref)
+    command.push("--ref", ref);
+  const child = Bun.spawn(["gh", ...command], {
+    cwd: projectRoot,
+    stderr: "inherit",
+    stdin: "inherit",
+    stdout: "inherit"
+  });
+  const exitCode = await child.exited;
+  if (exitCode !== 0)
+    throw new TypeError(`GitHub promotion dispatch exited with status ${exitCode}.`);
+  sendTelemetryEvent("mobile:ci-promotion-dispatched", {
+    platform: platform2,
+    provider: "github-actions",
+    storeTarget: platform2 === "android" ? playTrack !== "registry-only" : testflightGroup !== ""
+  });
+  console.log(`Dispatched protected ${platform2} promotion for ${certification.release.releaseId} from workflow run ${runId}.`);
+};
 var doctorMark = (status) => {
   if (status === "pass")
     return "\x1B[32m\u2713\x1B[0m";
@@ -24404,7 +24813,7 @@ var prepareExpoMobileUpdateExport = async (options) => {
     };
   await ensureExpoPackages(mobile.nativeProjectDirectory, options.args);
   const temporaryParent = join17(options.projectRoot, ".absolutejs", "mobile", "expo-update-exports");
-  await mkdir16(temporaryParent, { recursive: true });
+  await mkdir17(temporaryParent, { recursive: true });
   const temporaryDirectory = await mkdtemp6(join17(temporaryParent, ".stage-"));
   try {
     await runExpo(mobile.nativeProjectDirectory, [
@@ -24417,9 +24826,9 @@ var prepareExpoMobileUpdateExport = async (options) => {
       temporaryDirectory,
       "--clear"
     ], { production: true });
-    const generatedApp = JSON.parse(await readFile20(join17(mobile.nativeProjectDirectory, "app.json"), "utf8"));
-    const expoConfig = isRecord8(generatedApp) ? generatedApp.expo : undefined;
-    if (!isRecord8(expoConfig))
+    const generatedApp = JSON.parse(await readFile21(join17(mobile.nativeProjectDirectory, "app.json"), "utf8"));
+    const expoConfig = isRecord9(generatedApp) ? generatedApp.expo : undefined;
+    if (!isRecord9(expoConfig))
       throw new TypeError("Generated Expo app configuration is invalid.");
     const publicExpoConfig = expoPublicConfig(expoConfig);
     const computedRuntime = resolveAbsoluteMobileUpdateRuntime(mobile, options.projectRoot).fingerprint;
@@ -24460,11 +24869,11 @@ var buildMobileUpdate = async (args) => {
   let expoExportDirectory;
   try {
     await start(mobileBuildServerEntry(args), valueAfter(args, "--web-outdir"), configPath, { prepareOnly: true });
-    const embedded = JSON.parse(await readFile20(join17(mobile.bundleDirectory, "absolute-mobile-manifest.json"), "utf8"));
-    const runtimeFingerprint = isRecord8(embedded) ? embedded.nativeRuntime : undefined;
+    const embedded = JSON.parse(await readFile21(join17(mobile.bundleDirectory, "absolute-mobile-manifest.json"), "utf8"));
+    const runtimeFingerprint = isRecord9(embedded) ? embedded.nativeRuntime : undefined;
     if (typeof runtimeFingerprint !== "string" || !/^[a-f0-9]{64}$/u.test(runtimeFingerprint))
       throw new TypeError("Prepared mobile bundle is missing its native runtime fingerprint.");
-    const privateKey = await readFile20(resolve15(projectRoot, signingKeyPath));
+    const privateKey = await readFile21(resolve16(projectRoot, signingKeyPath));
     const configuredPublicKey = Buffer.from(mobile.updates.publicKeys[keyId], "base64");
     const derivedPublicKey = createPublicKey2(privateKey).export({
       format: "der",
@@ -24527,7 +24936,7 @@ var generateExpoUpdateSigning = async (args) => {
     ...valueAfter(args, "--public-key") ? { publicKeyPath: valueAfter(args, "--public-key") } : {},
     ...validityYears === undefined ? {} : { validityYears }
   });
-  const certificatePath = relative14(projectRoot, result.certificatePath).replaceAll("\\", "/");
+  const certificatePath = relative15(projectRoot, result.certificatePath).replaceAll("\\", "/");
   sendTelemetryEvent("mobile:update-code-signing-generated", {
     engine: "expo",
     validityYears: validityYears ?? 10
@@ -24589,7 +24998,7 @@ var provisionMobileUpdate = async (args) => {
     publicKeys: mobile.updates.publicKeys,
     storage: requestedStorage
   });
-  console.log(`Provisioned ${requestedStorage === "local" ? "local development" : "durable S3-compatible"} mobile update storage in ${relative14(projectRoot, path).replaceAll("\\", "/")}.`);
+  console.log(`Provisioned ${requestedStorage === "local" ? "local development" : "durable S3-compatible"} mobile update storage in ${relative15(projectRoot, path).replaceAll("\\", "/")}.`);
   if (requestedStorage === "local")
     console.log("Production release checks will require durable storage. Re-run with --storage s3 --force before deploying.");
   else
@@ -25116,6 +25525,16 @@ var loadPublicationCertification = async (options) => {
   const loaded = await readAbsoluteMobileReleaseCertification(options.projectRoot, requested);
   return verifyAbsoluteMobileReleaseCertification(loaded.certification, options.release, options.requirement);
 };
+var loadPublicationCertificationVerification = async (options) => {
+  const requested = valueAfter(options.args, "--certification-attestation");
+  if (options.args.includes("--certification-attestation") && (!requested || requested.startsWith("-")))
+    throw new TypeError("mobile publish requires --certification-attestation <verification-json>.");
+  if (!requested)
+    return;
+  if (!options.certificationLoaded)
+    throw new TypeError("mobile publish --certification-attestation requires --certification.");
+  return readAbsoluteMobileCertificationVerification(options.projectRoot, requested);
+};
 var publishAndroid = async (args) => {
   const registryModule = args.includes("--registry") ? requireValueAfter(args, "--registry") : "mobile.release.ts";
   const channel = args.includes("--channel") ? requireValueAfter(args, "--channel") : undefined;
@@ -25146,11 +25565,17 @@ var publishAndroid = async (args) => {
       release,
       ...certificationRequirement ? { requirement: certificationRequirement } : {}
     });
+    const certificationVerification = await loadPublicationCertificationVerification({
+      args,
+      certificationLoaded: certification !== undefined,
+      projectRoot
+    });
     const publication = await publishAbsoluteAndroidRelease({
       allowUnsigned: args.includes("--unsigned"),
       channel,
       ...certification ? { certification } : {},
       ...certificationRequirement ? { certificationRequirement } : {},
+      ...certificationVerification ? { certificationVerification } : {},
       googlePlay,
       modulePath: registryModule,
       projectRoot,
@@ -25159,6 +25584,8 @@ var publishAndroid = async (args) => {
     const { reused: publicationReused } = publication;
     reused = publicationReused;
     success = true;
+    if (args.includes("--json"))
+      return console.log(JSON.stringify(publication, null, 2)), publication;
     console.log(`${publication.reused ? "Reused" : "Published"} Android release ${release.metadata.releaseId}${publication.channel ? ` on ${publication.channel.channel}` : ""}.`);
     if (publication.googlePlay)
       printGooglePlayPublication(publication.googlePlay);
@@ -25335,12 +25762,18 @@ var publishIos = async (args) => {
       release,
       ...certificationRequirement ? { requirement: certificationRequirement } : {}
     });
+    const certificationVerification = await loadPublicationCertificationVerification({
+      args,
+      certificationLoaded: certification !== undefined,
+      projectRoot
+    });
     const publication = await publishAbsoluteIosRelease({
       allowUnsigned: args.includes("--unsigned"),
       appStoreConnect,
       channel,
       ...certification ? { certification } : {},
       ...certificationRequirement ? { certificationRequirement } : {},
+      ...certificationVerification ? { certificationVerification } : {},
       modulePath: registryModule,
       projectRoot,
       release
@@ -25351,6 +25784,8 @@ var publishIos = async (args) => {
     } = publication;
     reused = publicationReused;
     success = true;
+    if (args.includes("--json"))
+      return console.log(JSON.stringify(publication, null, 2)), publication;
     console.log(`${publication.reused ? "Reused" : "Published"} iOS release ${release.metadata.releaseId}${publication.channel ? ` on ${publication.channel.channel}` : ""}.`);
     if (appStoreConnectPublication)
       printAppStoreConnectPublication(appStoreConnectPublication);
@@ -25510,7 +25945,7 @@ var requireAndroidTestPort = (args, projectRoot) => {
     }
     return { https: args.includes("--https"), port };
   }
-  const instances = listLiveInstances().filter((instance2) => resolve15(instance2.cwd) === resolve15(projectRoot) && instance2.source === "dev" && instance2.port !== null);
+  const instances = listLiveInstances().filter((instance2) => resolve16(instance2.cwd) === resolve16(projectRoot) && instance2.source === "dev" && instance2.port !== null);
   if (instances.length !== 1) {
     throw new TypeError(instances.length === 0 ? "No running AbsoluteJS dev server was found for this project. Start `bun dev`, wait for Android to report ready, then run `absolute mobile test android`." : "Multiple dev servers are running for this project. Select one with mobile test android --port <port>.");
   }
@@ -25604,8 +26039,8 @@ var selectOrStartAndroidReleaseEmulator = async (adb2, emulator, explicitSerial,
   return waitForBoot();
 };
 var safeArtifactRoot = (projectRoot, value) => {
-  const root = resolve15(projectRoot, value ?? ".absolutejs/mobile/test-artifacts");
-  if (root !== projectRoot && !root.startsWith(`${resolve15(projectRoot)}/`)) {
+  const root = resolve16(projectRoot, value ?? ".absolutejs/mobile/test-artifacts");
+  if (root !== projectRoot && !root.startsWith(`${resolve16(projectRoot)}/`)) {
     throw new TypeError("mobile test --artifacts must remain inside the project.");
   }
   return root;
@@ -25633,12 +26068,12 @@ var waitForRequestedAndroidHmr = async (args, session, checks, timeoutMs) => {
   });
 };
 var writeAndroidFailureArtifacts = async (options) => {
-  await mkdir16(options.artifactRoot, { recursive: true });
+  await mkdir17(options.artifactRoot, { recursive: true });
   const screenshot = options.session ? await options.session.screenshot(join17(options.artifactRoot, "android-failure.png")).catch(() => {
     return;
   }) : undefined;
   const diagnosticPath = join17(options.artifactRoot, "android-failure.json");
-  await writeFile17(diagnosticPath, `${JSON.stringify({
+  await writeFile18(diagnosticPath, `${JSON.stringify({
     diagnostics: options.session?.diagnostics ?? [],
     error: options.error instanceof Error ? options.error.message : String(options.error),
     platform: "android",
@@ -25659,7 +26094,7 @@ var captureAndroidReleaseScreenshot = async (adb2, serial, destination) => {
   ]);
   if (exitCode !== 0)
     throw new Error(`Android release screenshot failed: ${stderr.trim() || `status ${exitCode}`}`);
-  await writeFile17(destination, bytes);
+  await writeFile18(destination, bytes);
   return destination;
 };
 var printAndroidReleaseAcceptance = (result, json) => {
@@ -25760,9 +26195,9 @@ var testAndroidRelease = async (args, mobile, projectRoot) => {
       platform: "android",
       success: false
     });
-    await mkdir16(artifactRoot, { recursive: true });
+    await mkdir17(artifactRoot, { recursive: true });
     const diagnosticPath = join17(artifactRoot, "android-release-failure.json");
-    await writeFile17(diagnosticPath, `${JSON.stringify({
+    await writeFile18(diagnosticPath, `${JSON.stringify({
       error: sanitizeNativeReportText(error instanceof Error ? error.message : String(error)),
       platform: "android",
       provider: mobile.engine,
@@ -25925,14 +26360,14 @@ var requireIosTestContext = (args, projectRoot) => {
     const port = Number(explicit);
     if (!Number.isInteger(port) || port < 1 || port > 65535)
       throw new TypeError("mobile test --port must be a valid TCP port.");
-    const instance2 = listLiveInstances().find((candidate) => resolve15(candidate.cwd) === resolve15(projectRoot) && candidate.source === "dev" && candidate.port === port);
+    const instance2 = listLiveInstances().find((candidate) => resolve16(candidate.cwd) === resolve16(projectRoot) && candidate.source === "dev" && candidate.port === port);
     return {
       https: instance2?.https ?? args.includes("--https"),
       instance: instance2,
       port
     };
   }
-  const instances = listLiveInstances().filter((instance2) => resolve15(instance2.cwd) === resolve15(projectRoot) && instance2.source === "dev" && instance2.port !== null);
+  const instances = listLiveInstances().filter((instance2) => resolve16(instance2.cwd) === resolve16(projectRoot) && instance2.source === "dev" && instance2.port !== null);
   if (instances.length !== 1)
     throw new TypeError(instances.length === 0 ? "No running AbsoluteJS dev server was found for this project. Start `bun dev`, wait for iOS to report ready, then run `absolute mobile test ios`." : "Multiple dev servers are running for this project. Select one with mobile test ios --port <port>.");
   const [instance] = instances;
@@ -25950,7 +26385,7 @@ var waitForIosHmrClient = async (options) => {
       return;
     });
     const status = response?.ok ? await response.json().catch(() => null) : null;
-    const targets = isRecord8(status) && isRecord8(status.connectedTargets) ? status.connectedTargets : undefined;
+    const targets = isRecord9(status) && isRecord9(status.connectedTargets) ? status.connectedTargets : undefined;
     if (targets && typeof targets["capacitor-ios"] === "number" && targets["capacitor-ios"] > 0)
       return;
     await Bun.sleep(100);
@@ -26076,7 +26511,7 @@ var requireCapturedCommand = (command, label) => {
   return result;
 };
 var writeIosFailureArtifacts = async (options) => {
-  await mkdir16(options.artifactRoot, { recursive: true });
+  await mkdir17(options.artifactRoot, { recursive: true });
   const screenshot = join17(options.artifactRoot, "ios-failure.png");
   const screenshotResult = captureCommand4([
     options.xcrun,
@@ -26087,7 +26522,7 @@ var writeIosFailureArtifacts = async (options) => {
     screenshot
   ]);
   const diagnosticPath = join17(options.artifactRoot, "ios-failure.json");
-  await writeFile17(diagnosticPath, `${JSON.stringify({
+  await writeFile18(diagnosticPath, `${JSON.stringify({
     appId: options.appId,
     error: options.error instanceof Error ? options.error.message : String(options.error),
     platform: "ios",
@@ -26114,8 +26549,8 @@ var nativeReportRoot = (args, projectRoot, platform2) => {
 var absolutejsVersionForReport = async () => {
   let absolutejsVersion = process.env.ABSOLUTE_VERSION ?? "unknown";
   const versions = await Promise.all([
-    resolve15(import.meta.dir, "..", "..", "package.json"),
-    resolve15(import.meta.dir, "..", "..", "..", "package.json")
+    resolve16(import.meta.dir, "..", "..", "package.json"),
+    resolve16(import.meta.dir, "..", "..", "..", "package.json")
   ].map((candidate) => readPackageVersionForIosReport(candidate).catch(() => "unknown")));
   for (const version of versions) {
     if (version === "unknown")
@@ -26492,9 +26927,9 @@ var testIosRelease = async (args, mobile, projectRoot) => {
       remote: remoteProfile !== undefined,
       success: false
     });
-    await mkdir16(artifactRoot, { recursive: true });
+    await mkdir17(artifactRoot, { recursive: true });
     const diagnosticPath = join17(artifactRoot, "ios-release-failure.json");
-    await writeFile17(diagnosticPath, `${JSON.stringify({
+    await writeFile18(diagnosticPath, `${JSON.stringify({
       error: sanitizeIosReportText(error instanceof Error ? error.message : String(error)),
       platform: "ios",
       provider: mobile.engine,
@@ -26587,7 +27022,7 @@ var testIos = async (args) => {
       mobile.appId
     ], "iOS app launch");
     await waitForIosHmrClient({ https, port, timeoutMs });
-    await mkdir16(artifactRoot, { recursive: true });
+    await mkdir17(artifactRoot, { recursive: true });
     const screenshot = join17(artifactRoot, "ios-simulator.png");
     requireCapturedCommand([xcrun, "simctl", "io", simulator.udid, "screenshot", screenshot], "iOS simulator screenshot");
     const hmrApply = await waitForRequestedIosHmr(args, instance, timeoutMs);
@@ -26803,7 +27238,12 @@ var runMobile = async (args) => {
     return;
   }
   if (command === "ci") {
-    await generateGithubCi(args.slice(1));
+    if (args[1] === "promote")
+      await dispatchGithubMobilePromotion(args.slice(2));
+    else if (args[1] === "verification")
+      await createGithubCertificationVerification(args.slice(2));
+    else
+      await generateGithubCi(args.slice(1));
     return;
   }
   if (command === "doctor") {
@@ -26882,7 +27322,7 @@ var runMobile = async (args) => {
     await publishIos(args.slice(2));
     return;
   }
-  throw new TypeError("Usage: absolute mobile <pair mac <name> <user@host> [--port n] [--workspace path] | remotes [inspect [name] [--json] | clean [name] --yes | --json] | unpair mac <name> | init [--no-native] [--force] | sync [ios|android] | inspect [--json] [--require-bundle] | certify <release-dir> [--evidence report-dir]... [--require installed|simulator|device|store] [--outdir dir] [--json] | certify <release-dir> --verify certification-dir [--require installed|simulator|device|store] [--json] | associations [--outdir dir] [--verify] | ci github [server-entry] [--publish] [--registry module] [--secret-env NAME] [--output path] [--force] [--json] | doctor [ios|android|release [ios|android]] [--remote name] [--json|--fix [--yes]] | build <android|ios> [server-entry] [--remote name] [--registered-device-artifact] [--outdir dir] [--web-outdir dir] [--unsigned] | update provision [--storage local|s3] [--registry module] [--force] [--yes] | update signing generate --private-key path [--certificate path] [--public-key path] [--key-id id] [--common-name name] [--validity-years n] | update build [server-entry] --classification bug-fix|content|security --key-id id --signing-key path --within-submitted-purpose [--outdir dir] [--web-outdir dir] | update publish <release-directory> [--rollout fraction] [--registry module] | update promote --release id --rollout fraction [--registry module] | update rollback [--release id] [--registry module] | update status [--registry module] [--json] | update advance [--rollout fraction] [--registry module] [--json] | update pause|resume|cancel|reconcile [--registry module] [--json] | update storage [--retain count] [--min-age-days days] [--registry module] [--json] | update gc [--retain count] [--min-age-days days] [--grace-days days] [--apply] [--registry module] [--json] | publish android [server-entry] [--release release-dir] [--certification certification-dir] [--registry module] [--channel name] [--play-track track] [--play-status completed|draft|halted|in-progress] [--play-rollout fraction] [--play-name name] [--play-notes language=text] [--play-update-priority 0..5] [--play-hold-review] [--play-cancel-existing-review] [--outdir dir] [--web-outdir dir] [--unsigned] | publish ios [server-entry] [--release release-dir] [--certification certification-dir] [--remote name] [--registry module] [--channel name] [--testflight-group name-or-id] [--testflight-notes locale=text] [--testflight-submit-review] [--outdir dir] [--web-outdir dir] [--unsigned] | test android [--release release-dir [--yes] | --route path [--wait-for-hmr] [--port n]] [--report [dir]] [--serial id] [--artifacts dir] [--json] [--config path] | test ios [--release release-dir [--remote name] [--device id [--testflight] --yes] | --wait-for-hmr] [--report [dir]] [--udid id] [--artifacts dir] [--json] [--config path]");
+  throw new TypeError("Usage: absolute mobile <pair mac <name> <user@host> [--port n] [--workspace path] | remotes [inspect [name] [--json] | clean [name] --yes | --json] | unpair mac <name> | init [--no-native] [--force] | sync [ios|android] | inspect [--json] [--require-bundle] | certify <release-dir> [--evidence report-dir]... [--require installed|simulator|device|store] [--outdir dir] [--json] | certify <release-dir> --verify certification-dir [--require installed|simulator|device|store] [--json] | associations [--outdir dir] [--verify] | ci github [server-entry] [--publish] [--registry module] [--secret-env NAME] [--output path] [--force] [--json] | ci promote <android|ios> --run-id id --certification path [--channel name] [--play-track track|--testflight-group group] [--ref branch] | doctor [ios|android|release [ios|android]] [--remote name] [--json|--fix [--yes]] | build <android|ios> [server-entry] [--remote name] [--registered-device-artifact] [--outdir dir] [--web-outdir dir] [--unsigned] | update provision [--storage local|s3] [--registry module] [--force] [--yes] | update signing generate --private-key path [--certificate path] [--public-key path] [--key-id id] [--common-name name] [--validity-years n] | update build [server-entry] --classification bug-fix|content|security --key-id id --signing-key path --within-submitted-purpose [--outdir dir] [--web-outdir dir] | update publish <release-directory> [--rollout fraction] [--registry module] | update promote --release id --rollout fraction [--registry module] | update rollback [--release id] [--registry module] | update status [--registry module] [--json] | update advance [--rollout fraction] [--registry module] [--json] | update pause|resume|cancel|reconcile [--registry module] [--json] | update storage [--retain count] [--min-age-days days] [--registry module] [--json] | update gc [--retain count] [--min-age-days days] [--grace-days days] [--apply] [--registry module] [--json] | publish android [server-entry] [--release release-dir] [--certification certification-dir] [--certification-attestation verification-json] [--registry module] [--channel name] [--play-track track] [--play-status completed|draft|halted|in-progress] [--play-rollout fraction] [--play-name name] [--play-notes language=text] [--play-update-priority 0..5] [--play-hold-review] [--play-cancel-existing-review] [--outdir dir] [--web-outdir dir] [--unsigned] | publish ios [server-entry] [--release release-dir] [--certification certification-dir] [--certification-attestation verification-json] [--remote name] [--registry module] [--channel name] [--testflight-group name-or-id] [--testflight-notes locale=text] [--testflight-submit-review] [--outdir dir] [--web-outdir dir] [--unsigned] | test android [--release release-dir [--yes] | --route path [--wait-for-hmr] [--port n]] [--report [dir]] [--serial id] [--artifacts dir] [--json] [--config path] | test ios [--release release-dir [--remote name] [--device id [--testflight] --yes] | --wait-for-hmr] [--report [dir]] [--udid id] [--artifacts dir] [--json] [--config path]");
 };
 export {
   runMobile