@absolutejs/absolute 0.20.0-beta.109 → 0.20.0-beta.110

package/dist/mobile/index.js

@@ -20092,7 +20092,7 @@ import {
   verify as verify2,
   X509Certificate as X509Certificate3
 } from "crypto";
-import { readFile as readFile28, stat as stat7 } from "fs/promises";
+import { readFile as readFile29, stat as stat8 } from "fs/promises";
 import path from "path";
 var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updates", MAX_FILE_BYTES, MAX_TOTAL_BYTES, DAY_MS, DEFAULT_MIN_AGE_MS, DEFAULT_GRACE_PERIOD_MS, DEFAULT_RETAIN_RECENT = 5, HASH, RELEASE, APP_ID, NAME, EXPO_DESCRIPTOR = "_absolute/expo-update.json", EXPO_CODE_SIGNING_ALGORITHM = "rsa-v1_5-sha256", HEALTH_TOKEN_VERSION = 1, HEALTH_KINDS, FAILURE_HEALTH_KINDS, MobileUpdateRegistryError, object6 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), text2 = (value, field2) => {
   if (typeof value !== "string" || value.length === 0)
@@ -21125,7 +21125,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
       verifyManifestSignature(manifest, options.publicKeys);
       await assertNotMarked(manifest.appId, manifest.releaseId);
       const localRoot = path.resolve(input.releaseDirectory);
-      const localManifest = parseMobileUpdateManifest(JSON.parse(await readFile28(path.join(localRoot, "update.json"), "utf8")));
+      const localManifest = parseMobileUpdateManifest(JSON.parse(await readFile29(path.join(localRoot, "update.json"), "utf8")));
       if (JSON.stringify(localManifest) !== JSON.stringify(manifest))
         throw new MobileUpdateRegistryError("Local mobile update manifest changed");
       const existing = await readManifest(manifest.appId, manifest.releaseId);
@@ -21143,7 +21143,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
       if (!existing) {
         for (const file of manifest.files) {
           const local = path.join(localRoot, "files", file.path);
-          const metadata = await stat7(local).catch(() => null);
+          const metadata = await stat8(local).catch(() => null);
           if (!metadata?.isFile() || metadata.size !== file.bytes)
             throw new MobileUpdateRegistryError(`Mobile update file ${file.path} size changed`);
           if (await fileDigest(Bun.file(local)) !== file.sha256)
@@ -21411,8 +21411,8 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
       });
     }
     const pathname = new URL(request.url).pathname.replace(/^\/+/, "");
-    const relative21 = pathname.startsWith(`${route}/`) ? pathname.slice(route.length + 1) : "";
-    if (request.method === "POST" && relative21 === "health") {
+    const relative22 = pathname.startsWith(`${route}/`) ? pathname.slice(route.length + 1) : "";
+    if (request.method === "POST" && relative22 === "health") {
       if (!options.registry.recordUpdateHealth)
         return new Response(null, { status: 404 });
       const appId = request.headers.get("x-absolute-mobile-app");
@@ -21455,7 +21455,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
     }
     if (request.method !== "GET")
       return new Response(null, { status: 405 });
-    if (relative21 === "update.json") {
+    if (relative22 === "update.json") {
       const expoProtocolVersion = request.headers.get("expo-protocol-version");
       const expoProtocol = expoProtocolVersion !== null;
       if (expoProtocol && expoProtocolVersion !== "1")
@@ -21573,7 +21573,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
         }
       });
     }
-    const match = /^(amu_[a-f0-9]{64})\/files\/(.+)$/.exec(relative21);
+    const match = /^(amu_[a-f0-9]{64})\/files\/(.+)$/.exec(relative22);
     if (!match?.[1] || !match[2])
       return new Response(null, { status: 404 });
     const file = await options.registry.readUpdateFile({
@@ -21666,15 +21666,15 @@ import {
   createPublicKey as createPublicKey3,
   X509Certificate as X509Certificate4
 } from "crypto";
-import { access as access20, mkdir as mkdir22 } from "fs/promises";
-import { dirname as dirname22, isAbsolute as isAbsolute12, relative as relative21, resolve as resolve23, sep as sep14 } from "path";
+import { access as access21, mkdir as mkdir23 } from "fs/promises";
+import { dirname as dirname23, isAbsolute as isAbsolute13, relative as relative22, resolve as resolve24, sep as sep15 } from "path";
 import { pathToFileURL as pathToFileURL5 } from "url";
 import { Elysia as Elysia4 } from "elysia";
 var ABSOLUTE_MOBILE_UPDATE_SERVER_FORMAT = 1, DEFAULT_MOBILE_UPDATE_REGISTRY_MODULE = "mobile.update.ts", object7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), projectPath3 = (projectRoot, requested) => {
-  const root = resolve23(projectRoot);
-  const path2 = resolve23(root, requested);
-  const projectRelative = relative21(root, path2);
-  if (projectRelative === ".." || projectRelative.startsWith(`..${sep14}`) || isAbsolute12(projectRelative))
+  const root = resolve24(projectRoot);
+  const path2 = resolve24(root, requested);
+  const projectRelative = relative22(root, path2);
+  if (projectRelative === ".." || projectRelative.startsWith(`..${sep15}`) || isAbsolute13(projectRelative))
     throw new TypeError("mobile.updates.server.registry must remain inside the project.");
   return path2;
 }, isRegistry4 = (value) => object7(value) && [
@@ -21697,7 +21697,7 @@ var ABSOLUTE_MOBILE_UPDATE_SERVER_FORMAT = 1, DEFAULT_MOBILE_UPDATE_REGISTRY_MOD
   return metadata;
 }, loadAbsoluteMobileUpdateServerModule = async (projectRoot, requestedModulePath = DEFAULT_MOBILE_UPDATE_REGISTRY_MODULE) => {
   const modulePath = projectPath3(projectRoot, requestedModulePath);
-  await access20(modulePath).catch(() => {
+  await access21(modulePath).catch(() => {
     throw new TypeError(`Mobile update server registry does not exist: ${modulePath}. Run \`absolute mobile update provision\`.`);
   });
   const loaded = await import(pathToFileURL5(modulePath).href);
@@ -21886,13 +21886,13 @@ ${generated}`);
 }, writeAbsoluteMobileUpdateRegistry = async (options) => {
   const path2 = projectPath3(options.projectRoot, options.modulePath ?? DEFAULT_MOBILE_UPDATE_REGISTRY_MODULE);
   if (!options.force) {
-    await access20(path2).then(() => {
+    await access21(path2).then(() => {
       throw new TypeError(`Mobile update registry already exists: ${path2}. Pass --force to replace it.`);
     }, () => {
       return;
     });
   }
-  await mkdir22(dirname22(path2), { recursive: true });
+  await mkdir23(dirname23(path2), { recursive: true });
   await Bun.write(path2, renderAbsoluteMobileUpdateRegistry({
     ...options.health ? { health: options.health } : {},
     ...options.rollout ? { rollout: options.rollout } : {},
@@ -33033,7 +33033,7 @@ init_config();
 import { existsSync as existsSync4 } from "fs";
 import { access as access16, mkdir as mkdir16, readFile as readFile20, writeFile as writeFile16 } from "fs/promises";
 import { dirname as dirname15, extname as extname5, relative as relative15, resolve as resolve17, sep as sep10 } from "path";
-var ABSOLUTE_MOBILE_CI_WORKFLOW_FORMAT = 1;
+var ABSOLUTE_MOBILE_CI_WORKFLOW_FORMAT = 2;
 var SECRET_NAME_PATTERN = /^[A-Z][A-Z0-9_]*$/u;
 var CI_ENV_INDENTATION = 6;
 var RESERVED_SECRET_NAMES = new Set([
@@ -33171,6 +33171,14 @@ var publishingInputs = (platforms, includePublishing) => {
   if (!includePublishing)
     return "";
   const fields = [
+    `      operation:
+        description: Build a release or promote an exact artifact from an earlier run
+        required: true
+        type: choice
+        default: build
+        options:
+          - build
+          - promote`,
     `      publish:
         description: Publish through mobile.release.ts after the signed build
         required: true
@@ -33179,6 +33187,14 @@ var publishingInputs = (platforms, includePublishing) => {
     `      channel:
         description: Optional AbsoluteJS immutable release channel
         required: false
+        type: string`,
+    `      source_run_id:
+        description: Source workflow run ID for promotion without rebuilding
+        required: false
+        type: string`,
+    `      certification_base64:
+        description: AbsoluteJS certification supplied by the promotion CLI
+        required: false
         type: string`
   ];
   if (platforms.includes("android"))
@@ -33208,7 +33224,7 @@ var publishingInputs = (platforms, includePublishing) => {
 ${fields.join(`
 `)}`;
 };
-var jobCondition = (platform3) => `github.event_name == 'workflow_dispatch' && (inputs.platform == 'all' || inputs.platform == '${platform3}')`;
+var jobCondition = (platform3, includePublishing) => `github.event_name == 'workflow_dispatch' && ${includePublishing ? "inputs.operation == 'build' && " : ""}(inputs.platform == 'all' || inputs.platform == '${platform3}')`;
 var androidJob = (options) => {
   const custom = customSecretEnvironment(options.customSecrets);
   const publishEnvironment = options.includePublishing ? `
@@ -33235,6 +33251,11 @@ var androidJob = (options) => {
             chmod 600 "$GOOGLE_APPLICATION_CREDENTIALS"
           fi` : "";
   const certificationSteps = options.includePublishing ? `
+      - name: Install pinned Cosign for Android certification
+        if: inputs.publish
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6
+        with:
+          cosign-release: v3.1.2
       - name: Install-test and certify exact Android release
         if: inputs.publish
         shell: bash
@@ -33254,6 +33275,12 @@ var androidJob = (options) => {
           "\${args[@]}"
           args=(bunx absolute mobile certify "$RELEASE_DIRECTORY" --evidence .absolutejs/mobile-ci/acceptance/android --require installed --outdir .absolutejs/mobile-ci/certifications/android --json)
           "\${args[@]}" > .absolutejs/mobile-ci/android-certification.json
+          shopt -s nullglob
+          certifications=(.absolutejs/mobile-ci/certifications/android/*)
+          if [[ "\${#certifications[@]}" -ne 1 ]]; then echo "Expected exactly one Android certification." >&2; exit 1; fi
+          CERTIFICATION_PATH="\${certifications[0]}/certification.json"
+          bunx @absolutejs/attest@0.2.0 sign-blobs "$CERTIFICATION_PATH"
+          bunx absolute mobile ci verification --bundle "$CERTIFICATION_PATH.sigstore.json" --out "\${certifications[0]}/verification.json"
       - name: Publish certified Android release
         if: inputs.publish
         shell: bash
@@ -33265,7 +33292,7 @@ var androidJob = (options) => {
             echo "Expected exactly one Android release and certification." >&2
             exit 1
           fi
-          args=(bunx absolute mobile publish android --release "\${releases[0]}" --certification "\${certifications[0]}" --registry "$ABSOLUTE_REGISTRY_MODULE")
+          args=(bunx absolute mobile publish android --release "\${releases[0]}" --certification "\${certifications[0]}" --certification-attestation "\${certifications[0]}/verification.json" --registry "$ABSOLUTE_REGISTRY_MODULE")
           if [[ -n "$ABSOLUTE_RELEASE_CHANNEL" ]]; then
             args+=(--channel "$ABSOLUTE_RELEASE_CHANNEL")
           fi
@@ -33290,7 +33317,7 @@ var androidJob = (options) => {
   android:
     name: Signed Android release
     needs: validate
-    if: \${{ ${jobCondition("android")} }}
+    if: \${{ ${jobCondition("android", options.includePublishing)} }}
     runs-on: ubuntu-latest
     environment: absolute-mobile-release
     permissions:
@@ -33381,6 +33408,11 @@ var iosJob = (options) => {
             chmod 600 "$APP_STORE_CONNECT_PRIVATE_KEY_PATH"
           fi` : "";
   const certificationSteps = options.includePublishing ? `
+      - name: Install pinned Cosign for iOS certification
+        if: inputs.publish
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6
+        with:
+          cosign-release: v3.1.2
       - name: Simulator-test and certify exact iOS release
         if: inputs.publish
         shell: bash
@@ -33397,6 +33429,12 @@ var iosJob = (options) => {
           "\${args[@]}"
           args=(bunx absolute mobile certify "$RELEASE_DIRECTORY" --evidence .absolutejs/mobile-ci/acceptance/ios --require simulator --outdir .absolutejs/mobile-ci/certifications/ios --json)
           "\${args[@]}" > .absolutejs/mobile-ci/ios-certification.json
+          shopt -s nullglob
+          certifications=(.absolutejs/mobile-ci/certifications/ios/*)
+          if [[ "\${#certifications[@]}" -ne 1 ]]; then echo "Expected exactly one iOS certification." >&2; exit 1; fi
+          CERTIFICATION_PATH="\${certifications[0]}/certification.json"
+          bunx @absolutejs/attest@0.2.0 sign-blobs "$CERTIFICATION_PATH"
+          bunx absolute mobile ci verification --bundle "$CERTIFICATION_PATH.sigstore.json" --out "\${certifications[0]}/verification.json"
       - name: Publish certified iOS release
         if: inputs.publish
         shell: bash
@@ -33408,7 +33446,7 @@ var iosJob = (options) => {
             echo "Expected exactly one iOS release and certification." >&2
             exit 1
           fi
-          args=(bunx absolute mobile publish ios --release "\${releases[0]}" --certification "\${certifications[0]}" --registry "$ABSOLUTE_REGISTRY_MODULE")
+          args=(bunx absolute mobile publish ios --release "\${releases[0]}" --certification "\${certifications[0]}" --certification-attestation "\${certifications[0]}/verification.json" --registry "$ABSOLUTE_REGISTRY_MODULE")
           if [[ -n "$ABSOLUTE_RELEASE_CHANNEL" ]]; then
             args+=(--channel "$ABSOLUTE_RELEASE_CHANNEL")
           fi
@@ -33436,7 +33474,7 @@ var iosJob = (options) => {
   ios:
     name: Signed iOS release
     needs: validate
-    if: \${{ ${jobCondition("ios")} }}
+    if: \${{ ${jobCondition("ios", options.includePublishing)} }}
     runs-on: macos-latest
     environment: absolute-mobile-release
     permissions:
@@ -33514,6 +33552,179 @@ ${certificationSteps}
           rm -f "\${{ runner.temp }}/absolute.mobileprovision"
           rm -f "\${{ runner.temp }}/AuthKey_AbsoluteJS.p8"`;
 };
+var promotionValidationSteps = `      - name: Validate promotion handoff
+        if: github.event_name == 'workflow_dispatch' && inputs.operation == 'promote'
+        shell: bash
+        run: |
+          if [[ "$ABSOLUTE_PROMOTION_PLATFORM" == "all" ]]; then
+            echo "Promotion requires one exact platform." >&2
+            exit 1
+          fi
+          if [[ ! "$ABSOLUTE_SOURCE_RUN_ID" =~ ^[1-9][0-9]*$ ]]; then
+            echo "Promotion requires a numeric source workflow run ID." >&2
+            exit 1
+          fi
+          if [[ -z "$ABSOLUTE_CERTIFICATION_BASE64" ]]; then
+            echo "Promotion requires certification supplied by absolute mobile ci promote." >&2
+            exit 1
+          fi`;
+var promotionSharedSteps = (platform3) => `      - name: Restore exact ${platform3 === "android" ? "Android" : "iOS"} release from source run
+        uses: actions/download-artifact@v8
+        with:
+          name: absolute-mobile-${platform3}
+          path: .absolutejs/mobile/releases/${platform3}
+          run-id: \${{ inputs.source_run_id }}
+          github-token: \${{ github.token }}
+      - name: Import and verify exact certification
+        shell: bash
+        run: |
+          mkdir -p .absolutejs/mobile-ci/imported-certification
+          printf '%s' "$ABSOLUTE_CERTIFICATION_BASE64" | base64 --decode > .absolutejs/mobile-ci/imported-certification/certification.json
+          shopt -s nullglob
+          releases=(.absolutejs/mobile/releases/${platform3}/*)
+          if [[ "\${#releases[@]}" -ne 1 || ! -d "\${releases[0]}" ]]; then
+            echo "Expected exactly one immutable ${platform3} release directory from the source run." >&2
+            exit 1
+          fi
+          args=(bunx absolute mobile certify "\${releases[0]}" --verify .absolutejs/mobile-ci/imported-certification/certification.json --json)
+          "\${args[@]}" > .absolutejs/mobile-ci/imported-certification/verified.json
+      - name: Install pinned Cosign
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6
+        with:
+          cosign-release: v3.1.2
+      - name: Sign certification with GitHub OIDC
+        shell: bash
+        run: |
+          bunx @absolutejs/attest@0.2.0 sign-blobs .absolutejs/mobile-ci/imported-certification/certification.json
+          bunx absolute mobile ci verification             --bundle .absolutejs/mobile-ci/imported-certification/certification.json.sigstore.json             --out .absolutejs/mobile-ci/imported-certification/verification.json`;
+var androidPromotionJob = (options) => {
+  const custom = customSecretEnvironment(options.customSecrets);
+  return `
+  promote_android:
+    name: Promote exact certified Android release
+    needs: validate
+    if: \${{ github.event_name == 'workflow_dispatch' && inputs.operation == 'promote' && inputs.platform == 'android' }}
+    runs-on: ubuntu-latest
+    environment: absolute-mobile-release
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
+    env:
+      ABSOLUTE_CERTIFICATION_BASE64: \${{ inputs.certification_base64 }}
+      ABSOLUTE_RELEASE_CHANNEL: \${{ inputs.channel }}
+      ABSOLUTE_PLAY_TRACK: \${{ inputs.play_track }}
+      ABSOLUTE_GOOGLE_CREDENTIALS_BASE64: \${{ secrets.ABSOLUTE_GOOGLE_CREDENTIALS_BASE64 }}
+      GOOGLE_APPLICATION_CREDENTIALS: \${{ runner.temp }}/absolute-google-credentials.json${custom ? `
+${custom}` : ""}
+${commandEnvironment2({ configPath: undefined, registryModule: "", serverEntry: "" })}
+    steps:
+${installSteps}
+${promotionSharedSteps("android")}
+      - name: Publish restored Android release
+        shell: bash
+        run: |
+          if [[ -n "$ABSOLUTE_RELEASE_CHANNEL" || "$ABSOLUTE_PLAY_TRACK" != "registry-only" ]]; then
+            true
+          else
+            echo "Promotion requires a release channel or Google Play track." >&2
+            exit 1
+          fi
+          if [[ "$ABSOLUTE_PLAY_TRACK" != "registry-only" ]]; then
+            if [[ -z "$ABSOLUTE_GOOGLE_CREDENTIALS_BASE64" ]]; then
+              echo "ABSOLUTE_GOOGLE_CREDENTIALS_BASE64 is required for Google Play publication." >&2
+              exit 1
+            fi
+            printf '%s' "$ABSOLUTE_GOOGLE_CREDENTIALS_BASE64" | base64 --decode > "$GOOGLE_APPLICATION_CREDENTIALS"
+            chmod 600 "$GOOGLE_APPLICATION_CREDENTIALS"
+          fi
+          shopt -s nullglob
+          releases=(.absolutejs/mobile/releases/android/*)
+          args=(bunx absolute mobile publish android --release "\${releases[0]}" --certification .absolutejs/mobile-ci/imported-certification/certification.json --certification-attestation .absolutejs/mobile-ci/imported-certification/verification.json --registry "$ABSOLUTE_REGISTRY_MODULE" --json)
+          if [[ -n "$ABSOLUTE_RELEASE_CHANNEL" ]]; then args+=(--channel "$ABSOLUTE_RELEASE_CHANNEL"); fi
+          if [[ "$ABSOLUTE_PLAY_TRACK" != "registry-only" ]]; then args+=(--play-track "$ABSOLUTE_PLAY_TRACK"); fi
+          ${appendConfigArgument}
+          "\${args[@]}" > .absolutejs/mobile-ci/promotion-receipt.json
+      - name: Upload Android promotion audit
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: absolute-mobile-android-promotion-\${{ github.run_id }}
+          path: |
+            .absolutejs/mobile-ci/imported-certification/
+            .absolutejs/mobile-ci/promotion-receipt.json
+          if-no-files-found: error
+          retention-days: 90
+          include-hidden-files: true
+      - name: Remove Google credentials
+        if: always()
+        run: rm -f "\${{ runner.temp }}/absolute-google-credentials.json"`;
+};
+var iosPromotionJob = (options) => {
+  const custom = customSecretEnvironment(options.customSecrets);
+  return `
+  promote_ios:
+    name: Promote exact certified iOS release
+    needs: validate
+    if: \${{ github.event_name == 'workflow_dispatch' && inputs.operation == 'promote' && inputs.platform == 'ios' }}
+    runs-on: ubuntu-latest
+    environment: absolute-mobile-release
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
+    env:
+      ABSOLUTE_CERTIFICATION_BASE64: \${{ inputs.certification_base64 }}
+      ABSOLUTE_RELEASE_CHANNEL: \${{ inputs.channel }}
+      ABSOLUTE_TESTFLIGHT_GROUP: \${{ inputs.testflight_group }}
+      ABSOLUTE_TESTFLIGHT_SUBMIT_REVIEW: \${{ inputs.submit_testflight_review }}
+      APP_STORE_CONNECT_ISSUER_ID: \${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
+      APP_STORE_CONNECT_KEY_ID: \${{ secrets.APP_STORE_CONNECT_KEY_ID }}
+      APP_STORE_CONNECT_PRIVATE_KEY_BASE64: \${{ secrets.APP_STORE_CONNECT_PRIVATE_KEY_BASE64 }}
+      APP_STORE_CONNECT_PRIVATE_KEY_PATH: \${{ runner.temp }}/AuthKey_AbsoluteJS.p8${custom ? `
+${custom}` : ""}
+${commandEnvironment2({ configPath: undefined, registryModule: "", serverEntry: "" })}
+    steps:
+${installSteps}
+${promotionSharedSteps("ios")}
+      - name: Publish restored iOS release
+        shell: bash
+        run: |
+          if [[ -z "$ABSOLUTE_RELEASE_CHANNEL" && -z "$ABSOLUTE_TESTFLIGHT_GROUP" ]]; then
+            echo "Promotion requires a release channel or TestFlight group." >&2
+            exit 1
+          fi
+          if [[ -n "$ABSOLUTE_TESTFLIGHT_GROUP" ]]; then
+            required=(APP_STORE_CONNECT_ISSUER_ID APP_STORE_CONNECT_KEY_ID APP_STORE_CONNECT_PRIVATE_KEY_BASE64)
+            for name in "\${required[@]}"; do
+              if [[ -z "\${!name}" ]]; then echo "$name is required for TestFlight publication." >&2; exit 1; fi
+            done
+            printf '%s' "$APP_STORE_CONNECT_PRIVATE_KEY_BASE64" | base64 --decode > "$APP_STORE_CONNECT_PRIVATE_KEY_PATH"
+            chmod 600 "$APP_STORE_CONNECT_PRIVATE_KEY_PATH"
+          fi
+          shopt -s nullglob
+          releases=(.absolutejs/mobile/releases/ios/*)
+          args=(bunx absolute mobile publish ios --release "\${releases[0]}" --certification .absolutejs/mobile-ci/imported-certification/certification.json --certification-attestation .absolutejs/mobile-ci/imported-certification/verification.json --registry "$ABSOLUTE_REGISTRY_MODULE" --json)
+          if [[ -n "$ABSOLUTE_RELEASE_CHANNEL" ]]; then args+=(--channel "$ABSOLUTE_RELEASE_CHANNEL"); fi
+          if [[ -n "$ABSOLUTE_TESTFLIGHT_GROUP" ]]; then args+=(--testflight-group "$ABSOLUTE_TESTFLIGHT_GROUP"); fi
+          if [[ "$ABSOLUTE_TESTFLIGHT_SUBMIT_REVIEW" == "true" ]]; then args+=(--testflight-submit-review); fi
+          ${appendConfigArgument}
+          "\${args[@]}" > .absolutejs/mobile-ci/promotion-receipt.json
+      - name: Upload iOS promotion audit
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: absolute-mobile-ios-promotion-\${{ github.run_id }}
+          path: |
+            .absolutejs/mobile-ci/imported-certification/
+            .absolutejs/mobile-ci/promotion-receipt.json
+          if-no-files-found: error
+          retention-days: 90
+          include-hidden-files: true
+      - name: Remove App Store Connect credentials
+        if: always()
+        run: rm -f "\${{ runner.temp }}/AuthKey_AbsoluteJS.p8"`;
+};
 var requiredSecrets = (platforms, includePublishing, custom) => [
   ...platforms.includes("android") ? [
     "ABSOLUTE_ANDROID_KEYSTORE_BASE64",
@@ -33575,10 +33786,14 @@ jobs:
     permissions:
       contents: read
     env:
-${environment}
+${environment}${includePublishing ? `
+      ABSOLUTE_PROMOTION_PLATFORM: \${{ inputs.platform }}
+      ABSOLUTE_SOURCE_RUN_ID: \${{ inputs.source_run_id }}
+      ABSOLUTE_CERTIFICATION_BASE64: \${{ inputs.certification_base64 }}` : ""}
     steps:
-${installSteps}
-${bundleAuditSteps}${platforms.includes("android") ? androidJob({ customSecrets, includePublishing }) : ""}${platforms.includes("ios") ? iosJob({ customSecrets, includePublishing }) : ""}
+${installSteps}${includePublishing ? `
+${promotionValidationSteps}` : ""}
+${bundleAuditSteps}${platforms.includes("android") ? androidJob({ customSecrets, includePublishing }) : ""}${platforms.includes("ios") ? iosJob({ customSecrets, includePublishing }) : ""}${includePublishing && platforms.includes("android") ? androidPromotionJob({ customSecrets, includePublishing }) : ""}${includePublishing && platforms.includes("ios") ? iosPromotionJob({ customSecrets, includePublishing }) : ""}
 `;
   const replacements = new Map([
     [
@@ -35745,6 +35960,8 @@ This certification is local and contains no signing credentials, device identifi
 ${evidence}
 `;
 };
+var serializeAbsoluteMobileReleaseCertification = (certification) => `${JSON.stringify(certification, null, 2)}
+`;
 var verifyAbsoluteMobileReleaseCertification = (certification, release, requirement) => {
   const parsed = parseCertification(certification);
   const expected = releaseIdentity(release);
@@ -35769,8 +35986,7 @@ var writeAbsoluteMobileReleaseCertification = async (projectRoot, certification,
     jsonPath: join30(destination, "certification.json"),
     markdownPath: join30(destination, "certification.md")
   };
-  const json = `${JSON.stringify(certification, null, 2)}
-`;
+  const json = serializeAbsoluteMobileReleaseCertification(certification);
   const markdown = renderAbsoluteMobileReleaseCertification(certification);
   const verifyExisting = async () => {
     const [existingJson, existingMarkdown] = await Promise.all([
@@ -35805,9 +36021,110 @@ var writeAbsoluteMobileReleaseCertification = async (projectRoot, certification,
   await verifyExisting();
   return paths;
 };
+// src/mobile/certificationVerification.ts
+import { access as access18, mkdir as mkdir21, readFile as readFile27, stat as stat6, writeFile as writeFile23 } from "fs/promises";
+import { dirname as dirname20, isAbsolute as isAbsolute10, relative as relative17, resolve as resolve19, sep as sep12 } from "path";
+var ABSOLUTE_MOBILE_CERTIFICATION_VERIFICATION_FORMAT = 1;
+var MAX_VERIFICATION_BYTES = 1048576;
+var SHA_PATTERN = /^[a-f0-9]{40}$/u;
+var REPOSITORY_PATTERN = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/u;
+var REF_PATTERN = /^refs\/(?:heads|tags)\/[^@\s]+$/u;
+var WORKFLOW_PATTERN = /^\.github\/workflows\/[^/@]+\.ya?ml$/u;
+var isRecord15 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var required = (value, name) => {
+  if (typeof value !== "string" || value.trim() === "")
+    throw new TypeError(`${name} is required.`);
+  return value.trim();
+};
+var requireMatch = (value, pattern, name) => {
+  if (!pattern.test(value))
+    throw new TypeError(`${name} is invalid.`);
+  return value;
+};
+var createAbsoluteMobileCertificationVerification = (bundle, environment) => {
+  const repository = required(environment.GITHUB_REPOSITORY, "GITHUB_REPOSITORY");
+  const workflowReference = required(environment.GITHUB_WORKFLOW_REF, "GITHUB_WORKFLOW_REF");
+  const prefix = `${repository}/`;
+  const separator = workflowReference.lastIndexOf("@");
+  if (!workflowReference.startsWith(prefix) || separator <= prefix.length)
+    throw new TypeError("GITHUB_WORKFLOW_REF is invalid.");
+  return parseAbsoluteMobileCertificationVerification({
+    bundle,
+    format: ABSOLUTE_MOBILE_CERTIFICATION_VERIFICATION_FORMAT,
+    identity: {
+      issuer: "https://token.actions.githubusercontent.com",
+      ref: environment.GITHUB_REF,
+      repository,
+      sha: environment.GITHUB_SHA,
+      workflowPath: workflowReference.slice(prefix.length, separator)
+    },
+    kind: "sigstore-bundle"
+  });
+};
+var parseAbsoluteMobileCertificationVerification = (value) => {
+  if (!isRecord15(value) || value.format !== ABSOLUTE_MOBILE_CERTIFICATION_VERIFICATION_FORMAT || value.kind !== "sigstore-bundle" || !isRecord15(value.bundle) || !isRecord15(value.identity))
+    throw new TypeError("Mobile certification verification contract is invalid.");
+  const issuer = required(value.identity.issuer, "verification issuer");
+  if (issuer !== "https://token.actions.githubusercontent.com")
+    throw new TypeError("verification issuer is invalid.");
+  const verification = {
+    bundle: value.bundle,
+    format: ABSOLUTE_MOBILE_CERTIFICATION_VERIFICATION_FORMAT,
+    identity: {
+      issuer,
+      ref: requireMatch(required(value.identity.ref, "verification ref"), REF_PATTERN, "verification ref"),
+      repository: requireMatch(required(value.identity.repository, "verification repository"), REPOSITORY_PATTERN, "verification repository"),
+      sha: requireMatch(required(value.identity.sha, "verification sha"), SHA_PATTERN, "verification sha"),
+      workflowPath: requireMatch(required(value.identity.workflowPath, "verification workflowPath"), WORKFLOW_PATTERN, "verification workflowPath")
+    },
+    kind: "sigstore-bundle"
+  };
+  const bytes = new TextEncoder().encode(JSON.stringify(verification));
+  if (bytes.byteLength > MAX_VERIFICATION_BYTES)
+    throw new TypeError("Mobile certification verification exceeds the 1 MiB limit.");
+  return verification;
+};
+var projectFile = (projectRoot, requested) => {
+  const root = resolve19(projectRoot);
+  const path = resolve19(root, requested);
+  const portable = relative17(root, path);
+  if (portable === ".." || portable.startsWith(`..${sep12}`) || isAbsolute10(portable))
+    throw new TypeError("Mobile certification verification path must remain inside the project.");
+  return path;
+};
+var readAbsoluteMobileCertificationVerification = async (projectRoot, requested) => {
+  const path = projectFile(projectRoot, requested);
+  await access18(path).catch(() => {
+    throw new TypeError(`Mobile certification verification does not exist: ${path}`);
+  });
+  const metadata = await stat6(path);
+  if (!metadata.isFile() || metadata.size > MAX_VERIFICATION_BYTES)
+    throw new TypeError("Mobile certification verification file is invalid.");
+  return parseAbsoluteMobileCertificationVerification(JSON.parse(await readFile27(path, "utf8")));
+};
+var readAbsoluteSigstoreBundle = async (projectRoot, requested) => {
+  const path = projectFile(projectRoot, requested);
+  const metadata = await stat6(path).catch(() => null);
+  if (!metadata?.isFile() || metadata.size > MAX_VERIFICATION_BYTES)
+    throw new TypeError("Sigstore bundle file is invalid.");
+  const value = JSON.parse(await readFile27(path, "utf8"));
+  if (!isRecord15(value))
+    throw new TypeError("Sigstore bundle is invalid.");
+  return value;
+};
+var writeAbsoluteMobileCertificationVerification = async (projectRoot, requested, verification) => {
+  const path = projectFile(projectRoot, requested);
+  const parsed = parseAbsoluteMobileCertificationVerification(verification);
+  await mkdir21(dirname20(path), { recursive: true });
+  await writeFile23(path, `${JSON.stringify(parsed, null, 2)}
+`, {
+    mode: 384
+  });
+  return path;
+};
 // src/mobile/releasePublisher.ts
-import { access as access18 } from "fs/promises";
-import { isAbsolute as isAbsolute10, relative as relative17, resolve as resolve19, sep as sep12 } from "path";
+import { access as access19 } from "fs/promises";
+import { isAbsolute as isAbsolute11, relative as relative18, resolve as resolve20, sep as sep13 } from "path";
 import { pathToFileURL as pathToFileURL3 } from "url";
 var prepareAbsoluteIosRelease = async (publisher, options) => {
   if (typeof publisher.prepareIosRelease !== "function") {
@@ -35830,33 +36147,35 @@ var prepareAbsoluteAndroidRelease = async (publisher, options) => {
   }
   return versionCode;
 };
-var requireCertificationReceipt = (publication, certification, requirement, releaseId) => {
-  if (!certification && !requirement)
+var requireCertificationReceipt = (publication, certification, requirement, releaseId, verification) => {
+  if (!certification && !requirement && !verification)
     return;
   if (!certification || !requirement)
     throw new TypeError("Native release publication certification contract is incomplete.");
   const receipt = publication.certification;
   if (!receipt || receipt.certificationId !== certification.certificationId || receipt.releaseId !== releaseId || receipt.requirement !== requirement || receipt.strength !== certification.strength)
     throw new TypeError("Native release registry did not retain the required release certification.");
+  if (verification && (!receipt.provenance || receipt.provenance.subject !== releaseId))
+    throw new TypeError("Native release registry did not retain trusted certification provenance.");
 };
-var isRecord15 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var isPublisher = (value) => isRecord15(value) && typeof value.publish === "function";
+var isRecord16 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isPublisher = (value) => isRecord16(value) && typeof value.publish === "function";
 var publisherModulePath = (projectRoot, requested) => {
-  const root = resolve19(projectRoot);
-  const path = resolve19(root, requested);
-  const projectRelative = relative17(root, path);
-  if (projectRelative === ".." || projectRelative.startsWith(`..${sep12}`) || isAbsolute10(projectRelative)) {
+  const root = resolve20(projectRoot);
+  const path = resolve20(root, requested);
+  const projectRelative = relative18(root, path);
+  if (projectRelative === ".." || projectRelative.startsWith(`..${sep13}`) || isAbsolute11(projectRelative)) {
     throw new TypeError("mobile publish --registry must remain inside the project.");
   }
   return path;
 };
 var loadAbsoluteNativeReleasePublisher = async (projectRoot, requestedModulePath) => {
   const modulePath = publisherModulePath(projectRoot, requestedModulePath);
-  await access18(modulePath).catch(() => {
+  await access19(modulePath).catch(() => {
     throw new TypeError(`Native release registry module does not exist: ${modulePath}`);
   });
   const loaded = await import(pathToFileURL3(modulePath).href);
-  const publisher = isRecord15(loaded) ? loaded.default ?? loaded.registry : undefined;
+  const publisher = isRecord16(loaded) ? loaded.default ?? loaded.registry : undefined;
   if (!isPublisher(publisher)) {
     throw new TypeError("Native release registry module must default-export a registry with publish(options).");
   }
@@ -35864,6 +36183,8 @@ var loadAbsoluteNativeReleasePublisher = async (projectRoot, requestedModulePath
 };
 var publishAbsoluteAndroidRelease = async (options) => {
   const certificationRequirement = options.certificationRequirement ?? options.certification?.requirement;
+  if (options.certificationVerification && !options.certification)
+    throw new TypeError("Android certification verification requires certification.");
   if (options.certification)
     verifyAbsoluteMobileReleaseCertification(options.certification, options.release, certificationRequirement);
   else if (certificationRequirement)
@@ -35873,6 +36194,7 @@ var publishAbsoluteAndroidRelease = async (options) => {
     allowUnsigned: options.allowUnsigned,
     certification: options.certification,
     certificationRequirement,
+    certificationVerification: options.certificationVerification,
     channel: options.channel,
     googlePlay: options.googlePlay,
     releaseRoot: options.release.releaseRoot,
@@ -35883,7 +36205,7 @@ var publishAbsoluteAndroidRelease = async (options) => {
   if (!actual || actual.appId !== expected.appId || actual.platform !== "android" || actual.releaseId !== expected.releaseId || actual.sha256 !== expected.sha256 || actual.signed !== expected.signed || actual.versionCode !== expected.versionCode || typeof publication.reused !== "boolean") {
     throw new TypeError("Native release registry returned a different Android release identity.");
   }
-  requireCertificationReceipt(publication, options.certification, certificationRequirement, expected.releaseId);
+  requireCertificationReceipt(publication, options.certification, certificationRequirement, expected.releaseId, options.certificationVerification);
   if (options.channel !== undefined && (publication.channel?.channel !== options.channel || publication.channel.releaseId !== expected.releaseId)) {
     throw new TypeError("Native release registry did not promote the requested channel.");
   }
@@ -35897,6 +36219,8 @@ var publishAbsoluteAndroidRelease = async (options) => {
 };
 var publishAbsoluteIosRelease = async (options) => {
   const certificationRequirement = options.certificationRequirement ?? options.certification?.requirement;
+  if (options.certificationVerification && !options.certification)
+    throw new TypeError("iOS certification verification requires certification.");
   if (options.certification)
     verifyAbsoluteMobileReleaseCertification(options.certification, options.release, certificationRequirement);
   else if (certificationRequirement)
@@ -35907,6 +36231,7 @@ var publishAbsoluteIosRelease = async (options) => {
     appStoreConnect: options.appStoreConnect,
     certification: options.certification,
     certificationRequirement,
+    certificationVerification: options.certificationVerification,
     channel: options.channel,
     releaseRoot: options.release.releaseRoot,
     signal: options.signal
@@ -35916,7 +36241,7 @@ var publishAbsoluteIosRelease = async (options) => {
   if (!actual || actual.appId !== expected.appId || actual.platform !== "ios" || actual.releaseId !== expected.releaseId || actual.sha256 !== expected.sha256 || actual.signed !== expected.signed || actual.buildNumber !== expected.buildNumber || actual.marketingVersion !== expected.marketingVersion || typeof publication.reused !== "boolean") {
     throw new TypeError("Native release registry returned a different iOS release identity.");
   }
-  requireCertificationReceipt(publication, options.certification, certificationRequirement, expected.releaseId);
+  requireCertificationReceipt(publication, options.certification, certificationRequirement, expected.releaseId, options.certificationVerification);
   if (options.channel !== undefined && (publication.channel?.channel !== options.channel || publication.channel.releaseId !== expected.releaseId)) {
     throw new TypeError("Native release registry did not promote the requested channel.");
   }
@@ -35932,7 +36257,7 @@ var publishAbsoluteIosRelease = async (options) => {
 init_pageProtocol();
 init_releaseArtifact();
 import { existsSync as existsSync7, readFileSync as readFileSync8 } from "fs";
-import { dirname as dirname20, extname as extname6, relative as relative18, resolve as resolve20 } from "path";
+import { dirname as dirname21, extname as extname6, relative as relative19, resolve as resolve21 } from "path";
 import ts2 from "typescript";
 var ROUTE_METHODS = new Set(["get", "head"]);
 var SOURCE_FILTER = /\.[cm]?[jt]sx?$/;
@@ -35983,7 +36308,7 @@ var PAGE_HANDLERS = new Map([
   ]
 ]);
 var posixPath = (value) => value.replace(/\\/g, "/");
-var findTsconfig = (entry, projectRoot) => ts2.findConfigFile(dirname20(entry), existsSync7, "tsconfig.json") ?? ts2.findConfigFile(projectRoot, existsSync7, "tsconfig.json");
+var findTsconfig = (entry, projectRoot) => ts2.findConfigFile(dirname21(entry), existsSync7, "tsconfig.json") ?? ts2.findConfigFile(projectRoot, existsSync7, "tsconfig.json");
 var createProgram = (entry, projectRoot) => {
   const configPath2 = findTsconfig(entry, projectRoot);
   if (!configPath2) {
@@ -35995,7 +36320,7 @@ var createProgram = (entry, projectRoot) => {
       target: ts2.ScriptTarget.ESNext
     });
   }
-  const parsed = ts2.parseJsonConfigFileContent(ts2.readConfigFile(configPath2, (path) => readFileSync8(path, "utf8")).config, ts2.sys, dirname20(configPath2));
+  const parsed = ts2.parseJsonConfigFileContent(ts2.readConfigFile(configPath2, (path) => readFileSync8(path, "utf8")).config, ts2.sys, dirname21(configPath2));
   if (!parsed.fileNames.includes(entry))
     parsed.fileNames.push(entry);
   return ts2.createProgram(parsed.fileNames, parsed.options);
@@ -36101,7 +36426,7 @@ var resolvePageIdentity = (expression, sourceFile, checker, projectRoot) => {
   const declaration = symbol?.declarations?.[0];
   const file = declaration?.getSourceFile().fileName ?? sourceFile.fileName;
   const exportedName = symbol?.name ?? expression.getText(sourceFile);
-  const source = posixPath(relative18(projectRoot, file));
+  const source = posixPath(relative19(projectRoot, file));
   return `${source}#${exportedName}`;
 };
 var resolveAlias = (symbol, checker) => {
@@ -36340,7 +36665,7 @@ var analyzeProgram = (program, projectRoot) => {
   const checker = program.getTypeChecker();
   const analyzed = new Map;
   for (const sourceFile of program.getSourceFiles()) {
-    const resolvedFile = resolve20(sourceFile.fileName);
+    const resolvedFile = resolve21(sourceFile.fileName);
     if (!isProjectSource(sourceFile, resolvedFile, projectRoot))
       continue;
     const analysis = analyzeSourceFile(sourceFile, checker, projectRoot);
@@ -36433,14 +36758,14 @@ var transformFile = (source, fileName, analysis) => {
 };
 var ABSOLUTE_MOBILE_TRANSFORM_PROTOCOL = ABSOLUTE_MOBILE_PAGE_PROTOCOL_VERSION;
 var createAbsoluteMobileRouteMetadataPlugin = (options) => {
-  const projectRoot = resolve20(options.projectRoot ?? process.cwd());
-  const entry = resolve20(options.entry);
+  const projectRoot = resolve21(options.projectRoot ?? process.cwd());
+  const entry = resolve21(options.entry);
   const analyzed = analyzeProgram(createProgram(entry, projectRoot), projectRoot);
   return {
     name: "absolute-mobile-route-metadata",
     setup(build) {
       build.onLoad({ filter: SOURCE_FILTER }, async ({ path }) => {
-        const analysis = analyzed.get(resolve20(path));
+        const analysis = analyzed.get(resolve21(path));
         if (!analysis)
           return;
         const source = await Bun.file(path).text();
@@ -36453,11 +36778,11 @@ var createAbsoluteMobileRouteMetadataPlugin = (options) => {
   };
 };
 var inspectAbsoluteMobileRouteMetadata = (options) => {
-  const projectRoot = resolve20(options.projectRoot ?? process.cwd());
-  const entry = resolve20(options.entry);
+  const projectRoot = resolve21(options.projectRoot ?? process.cwd());
+  const entry = resolve21(options.entry);
   const analyzed = analyzeProgram(createProgram(entry, projectRoot), projectRoot);
   return [...analyzed.entries()].flatMap(([file, analysis]) => [...analysis.byRouteCall.values()].map(({ metadata }) => ({
-    file: posixPath(relative18(projectRoot, file)),
+    file: posixPath(relative19(projectRoot, file)),
     metadata
   })));
 };
@@ -36791,7 +37116,7 @@ var createCapacitor = (win) => {
           callbackId
         }, callback);
       };
-      const p = new Promise((resolve21) => call.then(() => resolve21({ remove })));
+      const p = new Promise((resolve22) => call.then(() => resolve22({ remove })));
       p.remove = async () => {
         console.warn(`Using addListener() without 'await' is deprecated.`);
         await remove();
@@ -36996,11 +37321,11 @@ class CapacitorCookiesPluginWeb extends WebPlugin {
 var CapacitorCookies = registerPlugin("CapacitorCookies", {
   web: () => new CapacitorCookiesPluginWeb
 });
-var readBlobAsBase64 = async (blob) => new Promise((resolve21, reject) => {
+var readBlobAsBase64 = async (blob) => new Promise((resolve22, reject) => {
   const reader = new FileReader;
   reader.onload = () => {
     const base64String = reader.result;
-    resolve21(base64String.indexOf(",") >= 0 ? base64String.split(",")[1] : base64String);
+    resolve22(base64String.indexOf(",") >= 0 ? base64String.split(",")[1] : base64String);
   };
   reader.onerror = (error) => reject(error);
   reader.readAsDataURL(blob);
@@ -37176,7 +37501,7 @@ var REPORT_KINDS = new Set([
   "signal"
 ]);
 var nativeObservability = registerPlugin("AbsoluteMobileObservability");
-var isRecord16 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isRecord17 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var redactText = (value) => value.slice(0, MAX_STRING_LENGTH).replace(/\b(Bearer)\s+[A-Za-z0-9._~+/-]+=*/giu, "$1 [REDACTED]").replace(/([?&](?:access_token|api_?key|authorization|code|id_token|password|refresh_token|secret|token)=)[^&#\s]*/giu, "$1[REDACTED]").replace(/\b((?:access_?token|api_?key|authorization|client_?secret|cookie|id_?token|password|passwd|refresh_?token|secret|token)\s*[:=]\s*)[^,\s;]+/giu, "$1[REDACTED]").replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, "[REDACTED]");
 var redactValue = (value, depth = 0) => {
   if (depth >= MAX_REDACTION_DEPTH)
@@ -37187,7 +37512,7 @@ var redactValue = (value, depth = 0) => {
     return value;
   if (Array.isArray(value))
     return value.slice(0, 64).map((entry) => redactValue(entry, depth + 1));
-  if (!isRecord16(value))
+  if (!isRecord17(value))
     return String(value).slice(0, MAX_STRING_LENGTH);
   return Object.fromEntries(Object.entries(value).slice(0, 128).map(([key, entry]) => [
     key,
@@ -37195,7 +37520,7 @@ var redactValue = (value, depth = 0) => {
   ]));
 };
 var parseReport = (value) => {
-  if (!isRecord16(value) || !isRecord16(value.details))
+  if (!isRecord17(value) || !isRecord17(value.details))
     return;
   if (typeof value.id !== "string" || !REPORT_ID.test(value.id))
     return;
@@ -37206,7 +37531,7 @@ var parseReport = (value) => {
   if (value.platform !== "android" && value.platform !== "ios")
     return;
   const details = redactValue(value.details);
-  if (!isRecord16(details))
+  if (!isRecord17(details))
     return;
   if (new TextEncoder().encode(JSON.stringify(details)).byteLength > MAX_DETAIL_BYTES)
     return;
@@ -41660,8 +41985,8 @@ var createBeacon = (options) => {
         if (await fontAvailable(element))
           return;
         if (confirmationMs > 0) {
-          await new Promise((resolve21) => {
-            const timer2 = window.setTimeout(resolve21, confirmationMs);
+          await new Promise((resolve22) => {
+            const timer2 = window.setTimeout(resolve22, confirmationMs);
             cleanups.push(() => window.clearTimeout(timer2));
           });
           if (document.visibilityState === "hidden")
@@ -42649,24 +42974,24 @@ var createAbsoluteMobileUpdateClient = (options) => {
   };
 };
 // src/mobile/updatePublisher.ts
-import { access as access19 } from "fs/promises";
-import { isAbsolute as isAbsolute11, relative as relative20, resolve as resolve22, sep as sep13 } from "path";
+import { access as access20 } from "fs/promises";
+import { isAbsolute as isAbsolute12, relative as relative21, resolve as resolve23, sep as sep14 } from "path";
 import { pathToFileURL as pathToFileURL4 } from "url";
 
 // src/mobile/updateSigning.ts
 import { createHash as createHash17, sign, verify } from "crypto";
 import {
   cp as cp2,
-  mkdir as mkdir21,
+  mkdir as mkdir22,
   mkdtemp as mkdtemp11,
   readdir as readdir10,
-  readFile as readFile27,
+  readFile as readFile28,
   rename as rename19,
   rm as rm16,
-  stat as stat6,
-  writeFile as writeFile23
+  stat as stat7,
+  writeFile as writeFile24
 } from "fs/promises";
-import { dirname as dirname21, join as join31, relative as relative19, resolve as resolve21 } from "path";
+import { dirname as dirname22, join as join31, relative as relative20, resolve as resolve22 } from "path";
 var UPDATE_MANIFEST_FILE = "update.json";
 var UPDATE_FILES_DIRECTORY = "files";
 var sha2565 = (value) => createHash17("sha256").update(value).digest("hex");
@@ -42678,22 +43003,22 @@ var listFiles = async (root, directory = root) => {
       return listFiles(root, path);
     if (!entry.isFile())
       throw new TypeError("Mobile updates cannot contain links or special files.");
-    return [relative19(root, path).replaceAll("\\", "/")];
+    return [relative20(root, path).replaceAll("\\", "/")];
   }));
   return paths.flat().sort((left, right) => left.localeCompare(right));
 };
 var inspectFiles = async (root, paths) => Promise.all(paths.map(async (path) => {
   const source = join31(root, path);
   const [metadata, contents] = await Promise.all([
-    stat6(source),
-    readFile27(source)
+    stat7(source),
+    readFile28(source)
   ]);
   return { bytes: metadata.size, path, sha256: sha2565(contents) };
 }));
 var releaseIdFor = (value) => `amu_${sha2565(canonicalizeAbsoluteMobileUpdate(value))}`;
 var buildAbsoluteMobileUpdate = async (options) => {
-  const bundleDirectory = resolve21(options.bundleDirectory);
-  const outputRoot = resolve21(options.outputDirectory);
+  const bundleDirectory = resolve22(options.bundleDirectory);
+  const outputRoot = resolve22(options.outputDirectory);
   if (outputRoot === bundleDirectory || outputRoot.startsWith(`${bundleDirectory}/`))
     throw new TypeError("Mobile update output must be outside the embedded bundle.");
   const paths = await listFiles(bundleDirectory);
@@ -42721,7 +43046,7 @@ var buildAbsoluteMobileUpdate = async (options) => {
       value: signature.toString("base64")
     }
   });
-  await mkdir21(outputRoot, { recursive: true });
+  await mkdir22(outputRoot, { recursive: true });
   const outputDirectory = join31(outputRoot, manifest.releaseId);
   const staging = await mkdtemp11(join31(outputRoot, ".stage-"));
   try {
@@ -42729,7 +43054,7 @@ var buildAbsoluteMobileUpdate = async (options) => {
       force: true,
       recursive: true
     });
-    await writeFile23(join31(staging, UPDATE_MANIFEST_FILE), `${JSON.stringify(manifest, null, "\t")}
+    await writeFile24(join31(staging, UPDATE_MANIFEST_FILE), `${JSON.stringify(manifest, null, "\t")}
 `);
     await rename19(staging, outputDirectory);
   } catch (error) {
@@ -42745,14 +43070,14 @@ var buildAbsoluteMobileUpdate = async (options) => {
   };
 };
 var copyAbsoluteMobileUpdateFile = async (updateDirectory, path, destination) => {
-  const source = resolve21(updateDirectory, UPDATE_FILES_DIRECTORY, path);
-  const root = resolve21(updateDirectory, UPDATE_FILES_DIRECTORY);
+  const source = resolve22(updateDirectory, UPDATE_FILES_DIRECTORY, path);
+  const root = resolve22(updateDirectory, UPDATE_FILES_DIRECTORY);
   if (!source.startsWith(`${root}/`))
     throw new TypeError("Update file escaped its release.");
-  await mkdir21(dirname21(destination), { recursive: true });
+  await mkdir22(dirname22(destination), { recursive: true });
   await cp2(source, destination, { force: true });
 };
-var readAbsoluteMobileUpdate = async (directory) => parseAbsoluteMobileUpdateManifest(JSON.parse(await readFile27(join31(resolve21(directory), UPDATE_MANIFEST_FILE), "utf8")));
+var readAbsoluteMobileUpdate = async (directory) => parseAbsoluteMobileUpdateManifest(JSON.parse(await readFile28(join31(resolve22(directory), UPDATE_MANIFEST_FILE), "utf8")));
 var verifyAbsoluteMobileUpdateSignature = (manifestValue, publicKey) => {
   const manifest = parseAbsoluteMobileUpdateManifest(manifestValue);
   const valid = verify("sha256", absoluteMobileUpdateSigningPayload(unsignedAbsoluteMobileUpdate(manifest)), { dsaEncoding: "ieee-p1363", key: publicKey }, Buffer.from(manifest.signature.value, "base64"));
@@ -42869,16 +43194,16 @@ var pruneAbsoluteMobileUpdates = async (options) => {
 var object5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var isPublisher2 = (value) => object5(value) && typeof value.publishUpdate === "function" && typeof value.promoteUpdate === "function" && typeof value.rollbackUpdate === "function";
 var projectPath2 = (projectRoot, requested, label) => {
-  const root = resolve22(projectRoot);
-  const path = resolve22(root, requested);
-  const projectRelative = relative20(root, path);
-  if (projectRelative === ".." || projectRelative.startsWith(`..${sep13}`) || isAbsolute11(projectRelative))
+  const root = resolve23(projectRoot);
+  const path = resolve23(root, requested);
+  const projectRelative = relative21(root, path);
+  if (projectRelative === ".." || projectRelative.startsWith(`..${sep14}`) || isAbsolute12(projectRelative))
     throw new TypeError(`${label} must remain inside the project.`);
   return path;
 };
 var loadAbsoluteMobileUpdatePublisher = async (projectRoot, requestedModulePath) => {
   const modulePath = projectPath2(projectRoot, requestedModulePath, "mobile update registry");
-  await access19(modulePath).catch(() => {
+  await access20(modulePath).catch(() => {
     throw new TypeError(`Mobile update registry does not exist: ${modulePath}`);
   });
   const loaded = await import(pathToFileURL4(modulePath).href);
@@ -42984,6 +43309,7 @@ export {
   ABSOLUTE_EXPO_UPDATE_FORMAT,
   ABSOLUTE_IOS_RELEASE_FORMAT,
   ABSOLUTE_IOS_SIMULATOR_NAME,
+  ABSOLUTE_MOBILE_CERTIFICATION_VERIFICATION_FORMAT,
   ABSOLUTE_MOBILE_CI_WORKFLOW_FORMAT,
   ABSOLUTE_MOBILE_CLIENT_MANIFEST_FORMAT,
   ABSOLUTE_MOBILE_COMPATIBILITY_FORMAT,
@@ -43069,6 +43395,7 @@ export {
   createAbsoluteMobileAssociationPlugin,
   createAbsoluteMobileAuthManifest,
   createAbsoluteMobileBlobArtifactStore,
+  createAbsoluteMobileCertificationVerification,
   createAbsoluteMobileCompatibilityArtifact,
   createAbsoluteMobileCompatibilityDispatcher,
   createAbsoluteMobileFileArtifactStore,
@@ -43160,6 +43487,7 @@ export {
   parseAbsoluteIosInstalledAppInfo,
   parseAbsoluteIosLogLine,
   parseAbsoluteMobileBuildPageMetadata,
+  parseAbsoluteMobileCertificationVerification,
   parseAbsoluteMobileCompatibilityArtifact,
   parseAbsoluteMobilePageEnvelope,
   parseAbsoluteMobilePageRequest,
@@ -43185,10 +43513,12 @@ export {
   publishAbsoluteMobileUpdate,
   readAbsoluteAndroidRelease,
   readAbsoluteIosRelease,
+  readAbsoluteMobileCertificationVerification,
   readAbsoluteMobileLinkIntent,
   readAbsoluteMobileMaterializedReleases,
   readAbsoluteMobileReleaseCertification,
   readAbsoluteMobileUpdate,
+  readAbsoluteSigstoreBundle,
   reconcileAbsoluteMobileUpdateRollout,
   redactAbsoluteIosLog,
   removeAbsoluteRemoteMacProfile,
@@ -43217,6 +43547,7 @@ export {
   runAbsoluteRemoteIosReleaseAcceptance,
   runWithAbsoluteMobileProducer,
   serializeAbsoluteMobileAuthEnvironment,
+  serializeAbsoluteMobileReleaseCertification,
   startAbsoluteExpoDevSession,
   startAbsoluteIosCaEnrollmentServer,
   startAbsoluteIosDevSession,
@@ -43238,10 +43569,11 @@ export {
   waitForAbsoluteIosHmrLog,
   writeAbsoluteCapacitorConfig,
   writeAbsoluteExpoProject,
+  writeAbsoluteMobileCertificationVerification,
   writeAbsoluteMobileGithubWorkflow,
   writeAbsoluteMobileReleaseCertification,
   writeAbsoluteMobileUpdateRegistry
 };
 
-//# debugId=F8C3D6BAA9852D3F64756E2164756E21
+//# debugId=F05777F8BA048C6164756E2164756E21
 //# sourceMappingURL=index.js.map