@absolutejs/absolute 0.20.0-beta.110 → 0.20.0-beta.111

package/dist/cli/{mobile-12y4gtsq.js → mobile-k7gpwfs8.js}

@@ -16779,15 +16779,15 @@ var require_main = __commonJS(function(exports) {
 
 // src/cli/scripts/mobile.ts
 import {
-  access as access16,
-  mkdir as mkdir17,
-  mkdtemp as mkdtemp6,
-  readFile as readFile21,
-  rm as rm9,
-  writeFile as writeFile18
+  access as access17,
+  mkdir as mkdir18,
+  mkdtemp as mkdtemp7,
+  readFile as readFile22,
+  rm as rm10,
+  writeFile as writeFile19
 } from "fs/promises";
 import { createPublicKey as createPublicKey2 } from "crypto";
-import { join as join17, relative as relative15, resolve as resolve16 } from "path";
+import { join as join18, relative as relative16, resolve as resolve17 } from "path";
 import { createInterface } from "readline/promises";
 
 // src/mobile/nativeDeepLinks.ts
@@ -22982,7 +22982,7 @@ var renderAbsoluteMobileProjectInspection = (report) => {
 import { existsSync } from "fs";
 import { access as access12, mkdir as mkdir13, readFile as readFile18, writeFile as writeFile14 } from "fs/promises";
 import { dirname as dirname11, extname as extname2, relative as relative11, resolve as resolve12, sep as sep8 } from "path";
-var ABSOLUTE_MOBILE_CI_WORKFLOW_FORMAT = 2;
+var ABSOLUTE_MOBILE_CI_WORKFLOW_FORMAT = 3;
 var SECRET_NAME_PATTERN = /^[A-Z][A-Z0-9_]*$/u;
 var CI_ENV_INDENTATION = 6;
 var RESERVED_SECRET_NAMES = new Set([
@@ -23524,6 +23524,10 @@ var promotionSharedSteps = (platform) => `      - name: Restore exact ${platform
           path: .absolutejs/mobile/releases/${platform}
           run-id: \${{ inputs.source_run_id }}
           github-token: \${{ github.token }}
+      - name: Record bounded promotion context
+        shell: bash
+        run: |
+          bun -e 'const sourceRunId = process.env.ABSOLUTE_SOURCE_RUN_ID; const promotionRunId = process.env.GITHUB_RUN_ID; if (!sourceRunId?.match(/^[1-9][0-9]*$/) || !promotionRunId?.match(/^[1-9][0-9]*$/)) throw new Error("Invalid promotion run identity"); await Bun.write(".absolutejs/mobile-ci/promotion-context.json", JSON.stringify({ format: 1, platform: ${JSON.stringify(platform)}, promotionRunId, sourceArtifact: ${JSON.stringify(`absolute-mobile-${platform}`)}, sourceRunId }, null, 2) + "\\n");'
       - name: Import and verify exact certification
         shell: bash
         run: |
@@ -23562,6 +23566,7 @@ var androidPromotionJob = (options) => {
     env:
       ABSOLUTE_CERTIFICATION_BASE64: \${{ inputs.certification_base64 }}
       ABSOLUTE_RELEASE_CHANNEL: \${{ inputs.channel }}
+      ABSOLUTE_SOURCE_RUN_ID: \${{ inputs.source_run_id }}
       ABSOLUTE_PLAY_TRACK: \${{ inputs.play_track }}
       ABSOLUTE_GOOGLE_CREDENTIALS_BASE64: \${{ secrets.ABSOLUTE_GOOGLE_CREDENTIALS_BASE64 }}
       GOOGLE_APPLICATION_CREDENTIALS: \${{ runner.temp }}/absolute-google-credentials.json${custom ? `
@@ -23601,6 +23606,7 @@ ${promotionSharedSteps("android")}
           name: absolute-mobile-android-promotion-\${{ github.run_id }}
           path: |
             .absolutejs/mobile-ci/imported-certification/
+            .absolutejs/mobile-ci/promotion-context.json
             .absolutejs/mobile-ci/promotion-receipt.json
           if-no-files-found: error
           retention-days: 90
@@ -23625,6 +23631,7 @@ var iosPromotionJob = (options) => {
     env:
       ABSOLUTE_CERTIFICATION_BASE64: \${{ inputs.certification_base64 }}
       ABSOLUTE_RELEASE_CHANNEL: \${{ inputs.channel }}
+      ABSOLUTE_SOURCE_RUN_ID: \${{ inputs.source_run_id }}
       ABSOLUTE_TESTFLIGHT_GROUP: \${{ inputs.testflight_group }}
       ABSOLUTE_TESTFLIGHT_SUBMIT_REVIEW: \${{ inputs.submit_testflight_review }}
       APP_STORE_CONNECT_ISSUER_ID: \${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
@@ -23666,6 +23673,7 @@ ${promotionSharedSteps("ios")}
           name: absolute-mobile-ios-promotion-\${{ github.run_id }}
           path: |
             .absolutejs/mobile-ci/imported-certification/
+            .absolutejs/mobile-ci/promotion-context.json
             .absolutejs/mobile-ci/promotion-receipt.json
           if-no-files-found: error
           retention-days: 90
@@ -23785,47 +23793,448 @@ var writeAbsoluteMobileGithubWorkflow = async (options) => {
   };
 };
 
-// src/mobile/updateSigning.ts
-import { createHash as createHash6, sign, verify } from "crypto";
+// src/mobile/ciPromotionAudit.ts
 import {
-  cp,
+  access as access13,
   mkdir as mkdir14,
   mkdtemp as mkdtemp5,
-  readdir as readdir6,
   readFile as readFile19,
+  readdir as readdir6,
   rename as rename11,
   rm as rm8,
   stat as stat7,
   writeFile as writeFile15
 } from "fs/promises";
-import { dirname as dirname12, join as join15, relative as relative12, resolve as resolve13 } from "path";
+import { dirname as dirname12, isAbsolute as isAbsolute8, join as join15, relative as relative12, resolve as resolve13, sep as sep9 } from "path";
+var ABSOLUTE_MOBILE_CI_PROMOTION_AUDIT_FORMAT = 1;
+var ABSOLUTE_MOBILE_CI_PROMOTION_CONTEXT_FORMAT = 1;
+var MAX_GITHUB_OUTPUT_BYTES = 1048576;
+var MAX_AUDIT_JSON_BYTES = 1048576;
+var MAX_SEARCH_FILES = 20000;
+var RUN_ID_PATTERN = /^[1-9][0-9]*$/u;
+var REPOSITORY_PATTERN2 = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/u;
+var isRecord9 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var requiredString = (value, name) => {
+  if (typeof value !== "string" || value.trim() === "")
+    throw new TypeError(`${name} is invalid.`);
+  return value.trim();
+};
+var optionalString = (value, name) => {
+  if (value === null || value === undefined)
+    return null;
+  return requiredString(value, name);
+};
+var runId = (value, name) => {
+  if (!RUN_ID_PATTERN.test(value))
+    throw new TypeError(`${name} is invalid.`);
+  return value;
+};
+var repositoryArgs = (repository) => {
+  if (repository === undefined)
+    return [];
+  if (!REPOSITORY_PATTERN2.test(repository))
+    throw new TypeError("GitHub repository must be owner/name.");
+  return ["--repo", repository];
+};
+var projectPath3 = (projectRoot, requested) => {
+  const root = resolve13(projectRoot);
+  const path = resolve13(root, requested);
+  const portable = relative12(root, path);
+  if (portable === ".." || portable.startsWith(`..${sep9}`) || isAbsolute8(portable))
+    throw new TypeError("Mobile CI audit output must remain inside the project.");
+  return path;
+};
+var defaultRunner = async (command, options) => {
+  const child = Bun.spawn(command, {
+    cwd: options.cwd,
+    env: options.env,
+    stderr: "pipe",
+    stdin: "ignore",
+    stdout: "pipe"
+  });
+  const [exitCode, stderr, stdout] = await Promise.all([
+    child.exited,
+    new Response(child.stderr).text(),
+    new Response(child.stdout).text()
+  ]);
+  return { exitCode, stderr, stdout };
+};
+var requireCommand2 = async (run, command, options, label) => {
+  const result = await run(command, options);
+  if (result.exitCode !== 0)
+    throw new TypeError(`${label} failed: ${result.stderr.trim() || result.stdout.trim() || `exit ${result.exitCode}`}`);
+  if (result.stdout.length > MAX_GITHUB_OUTPUT_BYTES || result.stderr.length > MAX_GITHUB_OUTPUT_BYTES)
+    throw new TypeError(`${label} output exceeded the 1 MiB limit.`);
+  return result;
+};
+var parseJob = (value) => {
+  if (!isRecord9(value))
+    throw new TypeError("GitHub run job is invalid.");
+  return {
+    conclusion: optionalString(value.conclusion, "GitHub job conclusion"),
+    name: requiredString(value.name, "GitHub job name"),
+    status: requiredString(value.status, "GitHub job status")
+  };
+};
+var inspectAbsoluteMobileCiRun = async (options) => {
+  const requestedRunId = runId(options.runId, "GitHub run ID");
+  const result = await requireCommand2(options.run ?? defaultRunner, [
+    "gh",
+    "run",
+    "view",
+    requestedRunId,
+    ...repositoryArgs(options.repository),
+    "--json",
+    "conclusion,createdAt,databaseId,headBranch,headSha,jobs,startedAt,status,updatedAt,url,workflowName"
+  ], { cwd: options.projectRoot }, "GitHub workflow inspection");
+  return parseAbsoluteMobileCiRunStatus(JSON.parse(result.stdout), requestedRunId);
+};
+var parseAbsoluteMobileCiRunStatus = (value, requestedRunId) => {
+  if (!isRecord9(value) || !Array.isArray(value.jobs))
+    throw new TypeError("GitHub workflow run response is invalid.");
+  const { databaseId } = value;
+  if (typeof databaseId !== "number" && typeof databaseId !== "string" || String(databaseId) !== requestedRunId)
+    throw new TypeError("GitHub workflow run identity does not match.");
+  return {
+    conclusion: optionalString(value.conclusion, "GitHub run conclusion"),
+    createdAt: requiredString(value.createdAt, "GitHub run createdAt"),
+    headBranch: requiredString(value.headBranch, "GitHub run headBranch"),
+    headSha: requiredString(value.headSha, "GitHub run headSha"),
+    jobs: value.jobs.map(parseJob),
+    runId: requestedRunId,
+    startedAt: optionalString(value.startedAt, "GitHub run startedAt"),
+    status: requiredString(value.status, "GitHub run status"),
+    updatedAt: requiredString(value.updatedAt, "GitHub run updatedAt"),
+    url: requiredString(value.url, "GitHub run URL"),
+    workflowName: requiredString(value.workflowName, "GitHub workflow name")
+  };
+};
+var parseAbsoluteMobilePromotionContext = (value) => {
+  if (!isRecord9(value) || value.format !== ABSOLUTE_MOBILE_CI_PROMOTION_CONTEXT_FORMAT || value.platform !== "android" && value.platform !== "ios")
+    throw new TypeError("Mobile promotion context is invalid.");
+  const { platform } = value;
+  const sourceArtifact = requiredString(value.sourceArtifact, "promotion source artifact");
+  if (sourceArtifact !== `absolute-mobile-${platform}`)
+    throw new TypeError("Mobile promotion source artifact is invalid.");
+  return {
+    format: ABSOLUTE_MOBILE_CI_PROMOTION_CONTEXT_FORMAT,
+    platform,
+    promotionRunId: runId(requiredString(value.promotionRunId, "promotion run ID"), "promotion run ID"),
+    sourceArtifact,
+    sourceRunId: runId(requiredString(value.sourceRunId, "source run ID"), "source run ID")
+  };
+};
+var watchAbsoluteMobileCiRun = async (options) => {
+  const requestedRunId = runId(options.runId, "GitHub run ID");
+  await requireCommand2(options.run ?? defaultRunner, [
+    "gh",
+    "run",
+    "watch",
+    requestedRunId,
+    ...repositoryArgs(options.repository),
+    "--exit-status"
+  ], { cwd: options.projectRoot }, "GitHub workflow watch");
+  return inspectAbsoluteMobileCiRun({ ...options, runId: requestedRunId });
+};
+var readBoundedJson = async (path, label) => {
+  const metadata = await stat7(path).catch(() => null);
+  if (!metadata?.isFile() || metadata.size > MAX_AUDIT_JSON_BYTES)
+    throw new TypeError(`${label} is missing or exceeds the 1 MiB limit.`);
+  const value = JSON.parse(await readFile19(path, "utf8"));
+  return value;
+};
+var findFiles = async (root, name) => {
+  const found = [];
+  let visited = 0;
+  const walk = async (directory) => {
+    const entries = await readdir6(directory, { withFileTypes: true });
+    await Promise.all(entries.map(async (entry) => {
+      visited += 1;
+      if (visited > MAX_SEARCH_FILES)
+        throw new TypeError("Downloaded GitHub artifact contains too many files.");
+      const path = join15(directory, entry.name);
+      if (entry.isDirectory()) {
+        await walk(path);
+        return;
+      }
+      if (entry.isFile() && entry.name === name)
+        found.push(path);
+    }));
+  };
+  await walk(root);
+  return found;
+};
+var inferPromotionPlatform = (status) => {
+  const matched = status.jobs.flatMap((job) => {
+    if (job.name === "Promote exact certified Android release")
+      return ["android"];
+    if (job.name === "Promote exact certified iOS release")
+      return ["ios"];
+    return [];
+  });
+  if (matched.length !== 1)
+    throw new TypeError("GitHub run does not contain exactly one mobile promotion job.");
+  const [platform] = matched;
+  if (!platform)
+    throw new TypeError("Mobile promotion platform is missing.");
+  return platform;
+};
+var onlyPath = (paths, label) => {
+  const [path] = paths;
+  if (paths.length !== 1 || !path)
+    throw new TypeError(`${label} must contain exactly one matching file.`);
+  return path;
+};
+var canonicalJson = (value) => {
+  if (Array.isArray(value))
+    return `[${value.map((entry) => canonicalJson(entry)).join(",")}]`;
+  if (isRecord9(value))
+    return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(",")}}`;
+  return JSON.stringify(value);
+};
+var publicationSummary = (value, platform, release, certification) => {
+  if (!isRecord9(value) || !isRecord9(value.record) || !isRecord9(value.record.metadata))
+    throw new TypeError("Mobile promotion receipt is invalid.");
+  const { metadata } = value.record;
+  if (metadata.appId !== release.metadata.appId || metadata.releaseId !== release.metadata.releaseId || metadata.sha256 !== release.metadata.sha256)
+    throw new TypeError("Mobile promotion receipt release identity does not match.");
+  if (!isRecord9(value.certification) || !isRecord9(value.certification.provenance))
+    throw new TypeError("Mobile promotion receipt lacks trusted certification provenance.");
+  if (value.certification.certificationId !== certification.certificationId || value.certification.releaseId !== release.metadata.releaseId || value.certification.requirement !== certification.requirement || value.certification.strength !== certification.strength || value.certification.provenance.subject !== release.metadata.releaseId)
+    throw new TypeError("Mobile promotion certification receipt does not match.");
+  requiredString(value.certification.provenance.issuer, "promotion provenance issuer");
+  requiredString(value.certification.provenance.verificationId, "promotion provenance verification ID");
+  const provenanceTime = requiredString(value.certification.provenance.verifiedAt, "promotion provenance verification time");
+  if (Number.isNaN(Date.parse(provenanceTime)))
+    throw new TypeError("Mobile promotion provenance time is invalid.");
+  if (typeof value.reused !== "boolean")
+    throw new TypeError("Mobile promotion reuse status is invalid.");
+  const channel = isRecord9(value.channel) ? optionalString(value.channel.channel, "promotion channel") : null;
+  if (isRecord9(value.channel) && value.channel.releaseId !== release.metadata.releaseId)
+    throw new TypeError("Mobile promotion channel receipt does not match.");
+  const providerReceipt = platform === "android" ? value.googlePlay : value.appStoreConnect;
+  if (providerReceipt === undefined)
+    return {
+      channel,
+      provider: "registry",
+      reused: value.reused,
+      stage: null
+    };
+  if (!isRecord9(providerReceipt) || !isRecord9(providerReceipt.receipt))
+    throw new TypeError("Mobile store promotion receipt is invalid.");
+  if (typeof providerReceipt.reused !== "boolean")
+    throw new TypeError("Mobile store promotion reuse status is invalid.");
+  const expectedProvider = platform === "android" ? "google-play" : "app-store-connect";
+  if (providerReceipt.receipt.provider !== expectedProvider || providerReceipt.receipt.releaseId !== release.metadata.releaseId || providerReceipt.receipt.sha256 !== release.metadata.sha256)
+    throw new TypeError("Mobile store promotion receipt does not match.");
+  return {
+    channel,
+    provider: expectedProvider,
+    reused: providerReceipt.reused,
+    stage: requiredString(providerReceipt.receipt.stage, "Mobile store promotion stage")
+  };
+};
+var renderAuditMarkdown = (audit) => `# AbsoluteJS mobile promotion audit
+
+- Status: **VERIFIED**
+- Platform: ${audit.platform}
+- Release: \`${audit.release.releaseId}\`
+- Artifact SHA-256: \`${audit.release.sha256}\`
+- Source workflow run: ${audit.github.sourceRunId}
+- Promotion workflow run: ${audit.github.promotionRunId}
+- Workflow: ${audit.github.workflowName}
+- GitHub identity: \`${audit.provenance.repository}/${audit.provenance.workflowPath}@${audit.provenance.ref}\`
+- Certification: \`${audit.certification.certificationId}\` (${audit.certification.strength})
+- Publication: ${audit.publication.provider}${audit.publication.stage ? ` / ${audit.publication.stage}` : ""}
+- Verified at: ${audit.verifiedAt}
+
+This report contains no credentials, device identifiers, local absolute paths, application data, or GitHub token.
+`;
+var auditAbsoluteMobileCiPromotion = async (options) => {
+  const runner = options.run ?? defaultRunner;
+  const promotionRunId = runId(options.runId, "GitHub promotion run ID");
+  const status = await inspectAbsoluteMobileCiRun({
+    projectRoot: options.projectRoot,
+    ...options.repository ? { repository: options.repository } : {},
+    run: runner,
+    runId: promotionRunId
+  });
+  if (status.status !== "completed" || status.conclusion !== "success")
+    throw new TypeError("Mobile promotion run has not completed successfully.");
+  const platform = inferPromotionPlatform(status);
+  const output = projectPath3(options.projectRoot, options.outputDirectory ?? `.absolutejs/mobile-ci/audits/${promotionRunId}`);
+  if (await access13(output).then(() => true).catch(() => false))
+    throw new TypeError(`Mobile CI audit output already exists: ${output}`);
+  await mkdir14(dirname12(output), { recursive: true });
+  const staging = await mkdtemp5(join15(dirname12(output), ".promotion-audit-"));
+  try {
+    const evidenceRoot = join15(staging, "promotion-evidence");
+    await mkdir14(evidenceRoot);
+    await requireCommand2(runner, [
+      "gh",
+      "run",
+      "download",
+      promotionRunId,
+      ...repositoryArgs(options.repository),
+      "--name",
+      `absolute-mobile-${platform}-promotion-${promotionRunId}`,
+      "--dir",
+      evidenceRoot
+    ], { cwd: options.projectRoot }, "GitHub promotion artifact download");
+    const contextPaths = await findFiles(evidenceRoot, "promotion-context.json");
+    let context;
+    if (contextPaths.length === 1)
+      context = parseAbsoluteMobilePromotionContext(await readBoundedJson(onlyPath(contextPaths, "Promotion context"), "Promotion context"));
+    else if (contextPaths.length > 1)
+      throw new TypeError("Promotion artifact contains duplicate contexts.");
+    if (context && context.promotionRunId !== promotionRunId)
+      throw new TypeError("Promotion context run identity does not match.");
+    if (context && context.platform !== platform)
+      throw new TypeError("Promotion context platform does not match.");
+    const sourceRunId = options.sourceRunId ? runId(options.sourceRunId, "GitHub source run ID") : context?.sourceRunId;
+    if (!sourceRunId)
+      throw new TypeError("Promotion artifact predates source-run context; pass --source-run-id.");
+    if (context && options.sourceRunId && context.sourceRunId !== sourceRunId)
+      throw new TypeError("Requested source run does not match promotion context.");
+    const sourceArtifact = context?.sourceArtifact ?? `absolute-mobile-${platform}`;
+    const sourceRoot = join15(staging, "source-release");
+    await mkdir14(sourceRoot);
+    await requireCommand2(runner, [
+      "gh",
+      "run",
+      "download",
+      sourceRunId,
+      ...repositoryArgs(options.repository),
+      "--name",
+      sourceArtifact,
+      "--dir",
+      sourceRoot
+    ], { cwd: options.projectRoot }, "GitHub source release download");
+    const releaseMetadata = await findFiles(sourceRoot, "release.json");
+    if (releaseMetadata.length !== 1)
+      throw new TypeError("Source artifact must contain exactly one immutable mobile release.");
+    const releaseMetadataPath = onlyPath(releaseMetadata, "Source artifact");
+    const release = platform === "android" ? await readAbsoluteAndroidRelease(options.projectRoot, releaseMetadataPath) : await readAbsoluteIosRelease(options.projectRoot, releaseMetadataPath);
+    const certificationPaths = await findFiles(evidenceRoot, "certification.json");
+    const verificationPaths = await findFiles(evidenceRoot, "verification.json");
+    const receiptPaths = await findFiles(evidenceRoot, "promotion-receipt.json");
+    if (certificationPaths.length !== 1 || verificationPaths.length !== 1 || receiptPaths.length !== 1)
+      throw new TypeError("Promotion audit artifact is incomplete or ambiguous.");
+    const certificationPath = onlyPath(certificationPaths, "Promotion certification");
+    const verificationPath = onlyPath(verificationPaths, "Promotion verification");
+    const receiptPath = onlyPath(receiptPaths, "Promotion receipt");
+    const loadedCertification = await readAbsoluteMobileReleaseCertification(options.projectRoot, certificationPath);
+    const certification = verifyAbsoluteMobileReleaseCertification(loadedCertification.certification, release);
+    const verification = await readAbsoluteMobileCertificationVerification(options.projectRoot, verificationPath);
+    if (verification.identity.sha !== status.headSha)
+      throw new TypeError("Sigstore workflow commit does not match the promotion run.");
+    if (options.repository && verification.identity.repository !== options.repository)
+      throw new TypeError("Sigstore repository does not match the requested repository.");
+    const bundlePath = `${certificationPath}.sigstore.json`;
+    const bundle = await readAbsoluteSigstoreBundle(options.projectRoot, bundlePath);
+    if (canonicalJson(bundle) !== canonicalJson(verification.bundle))
+      throw new TypeError("Sigstore bundle does not match verification envelope.");
+    await requireCommand2(runner, [
+      "bunx",
+      "@absolutejs/attest@0.2.0",
+      "verify-blobs",
+      certificationPath
+    ], {
+      cwd: options.projectRoot,
+      env: {
+        ...process.env,
+        GITHUB_REF: verification.identity.ref,
+        GITHUB_REPOSITORY: verification.identity.repository,
+        GITHUB_SHA: verification.identity.sha,
+        GITHUB_WORKFLOW_REF: `${verification.identity.repository}/${verification.identity.workflowPath}@${verification.identity.ref}`
+      }
+    }, "Sigstore certification verification");
+    const publication = publicationSummary(await readBoundedJson(receiptPath, "Mobile promotion receipt"), platform, release, certification);
+    const audit = {
+      certification: {
+        certificationId: certification.certificationId,
+        requirement: certification.requirement,
+        strength: certification.strength
+      },
+      format: ABSOLUTE_MOBILE_CI_PROMOTION_AUDIT_FORMAT,
+      github: {
+        conclusion: status.conclusion,
+        promotionRunId,
+        repository: verification.identity.repository,
+        sourceRunId,
+        url: status.url,
+        workflowName: status.workflowName
+      },
+      platform,
+      provenance: verification.identity,
+      publication,
+      release: {
+        appId: release.metadata.appId,
+        bytes: release.metadata.bytes,
+        engine: release.metadata.engine,
+        releaseId: release.metadata.releaseId,
+        runtime: release.metadata.runtime,
+        sha256: release.metadata.sha256
+      },
+      status: "verified",
+      verifiedAt: new Date().toISOString()
+    };
+    await Promise.all([
+      writeFile15(join15(staging, "audit.json"), `${JSON.stringify(audit, null, 2)}
+`, { mode: 384 }),
+      writeFile15(join15(staging, "audit.md"), renderAuditMarkdown(audit), {
+        mode: 384
+      })
+    ]);
+    await rename11(staging, output);
+    return { audit, directory: output };
+  } catch (error) {
+    await rm8(staging, { force: true, recursive: true });
+    throw error;
+  }
+};
+
+// src/mobile/updateSigning.ts
+import { createHash as createHash6, sign, verify } from "crypto";
+import {
+  cp,
+  mkdir as mkdir15,
+  mkdtemp as mkdtemp6,
+  readdir as readdir7,
+  readFile as readFile20,
+  rename as rename12,
+  rm as rm9,
+  stat as stat8,
+  writeFile as writeFile16
+} from "fs/promises";
+import { dirname as dirname13, join as join16, relative as relative13, resolve as resolve14 } from "path";
 var UPDATE_MANIFEST_FILE = "update.json";
 var UPDATE_FILES_DIRECTORY = "files";
 var sha2564 = (value) => createHash6("sha256").update(value).digest("hex");
 var listFiles = async (root, directory = root) => {
-  const entries = await readdir6(directory, { withFileTypes: true });
+  const entries = await readdir7(directory, { withFileTypes: true });
   const paths = await Promise.all(entries.map(async (entry) => {
-    const path = join15(directory, entry.name);
+    const path = join16(directory, entry.name);
     if (entry.isDirectory())
       return listFiles(root, path);
     if (!entry.isFile())
       throw new TypeError("Mobile updates cannot contain links or special files.");
-    return [relative12(root, path).replaceAll("\\", "/")];
+    return [relative13(root, path).replaceAll("\\", "/")];
   }));
   return paths.flat().sort((left, right) => left.localeCompare(right));
 };
 var inspectFiles = async (root, paths) => Promise.all(paths.map(async (path) => {
-  const source = join15(root, path);
+  const source = join16(root, path);
   const [metadata, contents] = await Promise.all([
-    stat7(source),
-    readFile19(source)
+    stat8(source),
+    readFile20(source)
   ]);
   return { bytes: metadata.size, path, sha256: sha2564(contents) };
 }));
 var releaseIdFor = (value) => `amu_${sha2564(canonicalizeAbsoluteMobileUpdate(value))}`;
 var buildAbsoluteMobileUpdate = async (options) => {
-  const bundleDirectory = resolve13(options.bundleDirectory);
-  const outputRoot = resolve13(options.outputDirectory);
+  const bundleDirectory = resolve14(options.bundleDirectory);
+  const outputRoot = resolve14(options.outputDirectory);
   if (outputRoot === bundleDirectory || outputRoot.startsWith(`${bundleDirectory}/`))
     throw new TypeError("Mobile update output must be outside the embedded bundle.");
   const paths = await listFiles(bundleDirectory);
@@ -23853,30 +24262,30 @@ var buildAbsoluteMobileUpdate = async (options) => {
       value: signature.toString("base64")
     }
   });
-  await mkdir14(outputRoot, { recursive: true });
-  const outputDirectory = join15(outputRoot, manifest.releaseId);
-  const staging = await mkdtemp5(join15(outputRoot, ".stage-"));
+  await mkdir15(outputRoot, { recursive: true });
+  const outputDirectory = join16(outputRoot, manifest.releaseId);
+  const staging = await mkdtemp6(join16(outputRoot, ".stage-"));
   try {
-    await cp(bundleDirectory, join15(staging, UPDATE_FILES_DIRECTORY), {
+    await cp(bundleDirectory, join16(staging, UPDATE_FILES_DIRECTORY), {
       force: true,
       recursive: true
     });
-    await writeFile15(join15(staging, UPDATE_MANIFEST_FILE), `${JSON.stringify(manifest, null, "\t")}
+    await writeFile16(join16(staging, UPDATE_MANIFEST_FILE), `${JSON.stringify(manifest, null, "\t")}
 `);
-    await rename11(staging, outputDirectory);
+    await rename12(staging, outputDirectory);
   } catch (error) {
-    await rm8(staging, { force: true, recursive: true });
+    await rm9(staging, { force: true, recursive: true });
     if (typeof error === "object" && error !== null && Reflect.get(error, "code") === "EEXIST")
       throw new TypeError(`Mobile update ${manifest.releaseId} already exists.`, { cause: error });
     throw error;
   }
   return {
     manifest,
-    manifestPath: join15(outputDirectory, UPDATE_MANIFEST_FILE),
+    manifestPath: join16(outputDirectory, UPDATE_MANIFEST_FILE),
     outputDirectory
   };
 };
-var readAbsoluteMobileUpdate = async (directory) => parseAbsoluteMobileUpdateManifest(JSON.parse(await readFile19(join15(resolve13(directory), UPDATE_MANIFEST_FILE), "utf8")));
+var readAbsoluteMobileUpdate = async (directory) => parseAbsoluteMobileUpdateManifest(JSON.parse(await readFile20(join16(resolve14(directory), UPDATE_MANIFEST_FILE), "utf8")));
 var verifyAbsoluteMobileUpdateSignature = (manifestValue, publicKey) => {
   const manifest = parseAbsoluteMobileUpdateManifest(manifestValue);
   const valid = verify("sha256", absoluteMobileUpdateSigningPayload(unsignedAbsoluteMobileUpdate(manifest)), { dsaEncoding: "ieee-p1363", key: publicKey }, Buffer.from(manifest.signature.value, "base64"));
@@ -23886,8 +24295,8 @@ var verifyAbsoluteMobileUpdateSignature = (manifestValue, publicKey) => {
 };
 
 // src/mobile/expoUpdate.ts
-import { access as access13, mkdir as mkdir15, readFile as readFile20, writeFile as writeFile16 } from "fs/promises";
-import { dirname as dirname13, extname as extname3, join as join16 } from "path";
+import { access as access14, mkdir as mkdir16, readFile as readFile21, writeFile as writeFile17 } from "fs/promises";
+import { dirname as dirname14, extname as extname3, join as join17 } from "path";
 var ABSOLUTE_EXPO_UPDATE_DESCRIPTOR = "_absolute/expo-update.json";
 var ABSOLUTE_EXPO_UPDATE_FORMAT = 1;
 var object2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
@@ -23953,7 +24362,7 @@ var parseAbsoluteExpoUpdateDescriptor = (value) => {
   };
 };
 var finalizeAbsoluteExpoUpdateExport = async (options) => {
-  const metadata = JSON.parse(await readFile20(join16(options.exportDirectory, "metadata.json"), "utf8"));
+  const metadata = JSON.parse(await readFile21(join17(options.exportDirectory, "metadata.json"), "utf8"));
   if (!object2(metadata) || !object2(metadata.fileMetadata))
     throw new TypeError("Expo export metadata.json is invalid.");
   const descriptor = parseAbsoluteExpoUpdateDescriptor({
@@ -23964,30 +24373,30 @@ var finalizeAbsoluteExpoUpdateExport = async (options) => {
     runtimeVersion: options.runtimeVersion
   });
   const referenced = Object.values(descriptor.platforms).flatMap((entry) => entry ? [entry.launchAsset, ...entry.assets] : []);
-  await Promise.all(referenced.map(({ path }) => access13(join16(options.exportDirectory, path)).catch(() => {
+  await Promise.all(referenced.map(({ path }) => access14(join17(options.exportDirectory, path)).catch(() => {
     throw new TypeError(`Expo export metadata references missing asset ${path}.`);
   })));
-  const destination = join16(options.exportDirectory, ABSOLUTE_EXPO_UPDATE_DESCRIPTOR);
-  await mkdir15(dirname13(destination), { recursive: true });
-  await writeFile16(destination, `${JSON.stringify(descriptor, null, "\t")}
+  const destination = join17(options.exportDirectory, ABSOLUTE_EXPO_UPDATE_DESCRIPTOR);
+  await mkdir16(dirname14(destination), { recursive: true });
+  await writeFile17(destination, `${JSON.stringify(descriptor, null, "\t")}
 `);
   return { descriptor, path: destination };
 };
 
 // src/mobile/expoCodeSigning.ts
 var import_code_signing_certificates = __toESM(require_main(), 1);
-import { access as access14, mkdir as mkdir16, writeFile as writeFile17 } from "fs/promises";
-import { dirname as dirname14, isAbsolute as isAbsolute8, relative as relative13, resolve as resolve14, sep as sep9 } from "path";
-var exists6 = async (path) => access14(path).then(() => true).catch(() => false);
+import { access as access15, mkdir as mkdir17, writeFile as writeFile18 } from "fs/promises";
+import { dirname as dirname15, isAbsolute as isAbsolute9, relative as relative14, resolve as resolve15, sep as sep10 } from "path";
+var exists6 = async (path) => access15(path).then(() => true).catch(() => false);
 var inside4 = (root, path) => {
-  const location = relative13(root, path);
-  return location === "" || location !== ".." && !location.startsWith(`..${sep9}`) && !isAbsolute8(location);
+  const location = relative14(root, path);
+  return location === "" || location !== ".." && !location.startsWith(`..${sep10}`) && !isAbsolute9(location);
 };
 var generateAbsoluteExpoCodeSigning = async (options) => {
-  const root = resolve14(options.projectRoot);
-  const certificatePath = resolve14(root, options.certificatePath);
-  const privateKeyPath = resolve14(root, options.privateKeyPath);
-  const publicKeyPath = resolve14(root, options.publicKeyPath ?? resolve14(dirname14(privateKeyPath), "public-key.pem"));
+  const root = resolve15(options.projectRoot);
+  const certificatePath = resolve15(root, options.certificatePath);
+  const privateKeyPath = resolve15(root, options.privateKeyPath);
+  const publicKeyPath = resolve15(root, options.publicKeyPath ?? resolve15(dirname15(privateKeyPath), "public-key.pem"));
   if (!inside4(root, certificatePath))
     throw new TypeError("Expo code-signing certificate must be written inside the project so store builds can embed it.");
   if (inside4(root, privateKeyPath) || inside4(root, publicKeyPath))
@@ -24017,11 +24426,11 @@ var generateAbsoluteExpoCodeSigning = async (options) => {
   import_code_signing_certificates.validateSelfSignedCertificate(certificate, keyPair);
   const { privateKeyPEM, publicKeyPEM } = import_code_signing_certificates.convertKeyPairToPEM(keyPair);
   const certificatePem = import_code_signing_certificates.convertCertificateToCertificatePEM(certificate);
-  await Promise.all([certificatePath, privateKeyPath, publicKeyPath].map((path) => mkdir16(dirname14(path), { recursive: true })));
+  await Promise.all([certificatePath, privateKeyPath, publicKeyPath].map((path) => mkdir17(dirname15(path), { recursive: true })));
   await Promise.all([
-    writeFile17(certificatePath, certificatePem, { flag: "wx", mode: 420 }),
-    writeFile17(privateKeyPath, privateKeyPEM, { flag: "wx", mode: 384 }),
-    writeFile17(publicKeyPath, publicKeyPEM, { flag: "wx", mode: 420 })
+    writeFile18(certificatePath, certificatePem, { flag: "wx", mode: 420 }),
+    writeFile18(privateKeyPath, privateKeyPEM, { flag: "wx", mode: 384 }),
+    writeFile18(publicKeyPath, publicKeyPEM, { flag: "wx", mode: 420 })
   ]);
   return {
     certificatePath,
@@ -24032,8 +24441,8 @@ var generateAbsoluteExpoCodeSigning = async (options) => {
 };
 
 // src/mobile/updatePublisher.ts
-import { access as access15 } from "fs/promises";
-import { isAbsolute as isAbsolute9, relative as relative14, resolve as resolve15, sep as sep10 } from "path";
+import { access as access16 } from "fs/promises";
+import { isAbsolute as isAbsolute10, relative as relative15, resolve as resolve16, sep as sep11 } from "path";
 import { pathToFileURL as pathToFileURL3 } from "url";
 var lifecycleMethod = (publisher, name) => {
   const method = publisher[name];
@@ -24141,17 +24550,17 @@ var pruneAbsoluteMobileUpdates = async (options) => {
 };
 var object3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var isPublisher2 = (value) => object3(value) && typeof value.publishUpdate === "function" && typeof value.promoteUpdate === "function" && typeof value.rollbackUpdate === "function";
-var projectPath3 = (projectRoot, requested, label) => {
-  const root = resolve15(projectRoot);
-  const path = resolve15(root, requested);
-  const projectRelative = relative14(root, path);
-  if (projectRelative === ".." || projectRelative.startsWith(`..${sep10}`) || isAbsolute9(projectRelative))
+var projectPath4 = (projectRoot, requested, label) => {
+  const root = resolve16(projectRoot);
+  const path = resolve16(root, requested);
+  const projectRelative = relative15(root, path);
+  if (projectRelative === ".." || projectRelative.startsWith(`..${sep11}`) || isAbsolute10(projectRelative))
     throw new TypeError(`${label} must remain inside the project.`);
   return path;
 };
 var loadAbsoluteMobileUpdatePublisher = async (projectRoot, requestedModulePath) => {
-  const modulePath = projectPath3(projectRoot, requestedModulePath, "mobile update registry");
-  await access15(modulePath).catch(() => {
+  const modulePath = projectPath4(projectRoot, requestedModulePath, "mobile update registry");
+  await access16(modulePath).catch(() => {
     throw new TypeError(`Mobile update registry does not exist: ${modulePath}`);
   });
   const loaded = await import(pathToFileURL3(modulePath).href);
@@ -24173,7 +24582,7 @@ var promoteAbsoluteMobileUpdate = async (options) => {
   return result;
 };
 var publishAbsoluteMobileUpdate = async (options) => {
-  const releaseDirectory = projectPath3(options.projectRoot, options.releaseDirectory, "mobile update release directory");
+  const releaseDirectory = projectPath4(options.projectRoot, options.releaseDirectory, "mobile update release directory");
   const manifest = await readAbsoluteMobileUpdate(releaseDirectory);
   const result = await options.publisher.publishUpdate({
     manifest,
@@ -24206,10 +24615,10 @@ var rollbackAbsoluteMobileUpdate = async (options) => {
 var NOT_FOUND4 = -1;
 var ANDROID_EMULATOR_BOOT_POLL_MS = 500;
 var ANDROID_EMULATOR_BOOT_TIMEOUT_MS = 180000;
-var isRecord9 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isRecord10 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var expoPublicConfig = (config) => {
   const result = { ...config };
-  if (!isRecord9(result.updates))
+  if (!isRecord10(result.updates))
     return result;
   const {
     codeSigningCertificate: _codeSigningCertificate,
@@ -24249,13 +24658,13 @@ var CAPACITOR_SYNC_PACKAGE_SPECS = [
 ];
 var packageNameFromSpec = (spec) => spec.slice(0, spec.lastIndexOf("@"));
 var directProjectPackages = async (projectRoot) => {
-  const manifest = JSON.parse(await readFile21(join17(projectRoot, "package.json"), "utf8"));
-  if (!isRecord9(manifest))
+  const manifest = JSON.parse(await readFile22(join18(projectRoot, "package.json"), "utf8"));
+  if (!isRecord10(manifest))
     throw new TypeError("Application package.json must contain an object.");
   const names = new Set;
   for (const field2 of ["dependencies", "devDependencies"]) {
     const dependencies = Reflect.get(manifest, field2);
-    if (isRecord9(dependencies))
+    if (isRecord10(dependencies))
       for (const name of Object.keys(dependencies))
         names.add(name);
   }
@@ -24263,8 +24672,8 @@ var directProjectPackages = async (projectRoot) => {
 };
 var resolvedPackageVersion = async (projectRoot, packageName) => {
   try {
-    const manifest = JSON.parse(await readFile21(join17(projectRoot, "node_modules", packageName, "package.json"), "utf8"));
-    return isRecord9(manifest) && typeof manifest.version === "string" ? manifest.version : undefined;
+    const manifest = JSON.parse(await readFile22(join18(projectRoot, "node_modules", packageName, "package.json"), "utf8"));
+    return isRecord10(manifest) && typeof manifest.version === "string" ? manifest.version : undefined;
   } catch {
     return;
   }
@@ -24327,9 +24736,9 @@ var runCapacitor = async (projectRoot, args) => {
 };
 var runCapacitorForPlatforms = (projectRoot, command, platforms) => platforms.reduce((pending, platform2) => pending.then(() => runCapacitor(projectRoot, [command, platform2])), Promise.resolve());
 var expoExecutable = async (project) => {
-  const executable = join17(project, "node_modules", ".bin", "expo");
+  const executable = join18(project, "node_modules", ".bin", "expo");
   try {
-    await access16(executable);
+    await access17(executable);
     return executable;
   } catch {
     throw new TypeError("Expo dependencies are not installed in the generated shell. Run `absolute mobile init --yes`.");
@@ -24361,14 +24770,14 @@ var runExpo = async (project, args, options = {}) => {
 };
 var ensureExpoPackages = async (project, args) => {
   try {
-    const manifest = JSON.parse(await readFile21(join17(project, "package.json"), "utf8"));
+    const manifest = JSON.parse(await readFile22(join18(project, "package.json"), "utf8"));
     const dependencies = typeof manifest === "object" && manifest !== null ? Reflect.get(manifest, "dependencies") : undefined;
     if (typeof dependencies !== "object" || dependencies === null || Array.isArray(dependencies))
       throw new TypeError("Generated Expo dependencies are invalid.");
     await Promise.all(Object.entries(dependencies).map(async ([name, expected]) => {
       if (typeof expected !== "string")
         throw new TypeError("Generated Expo dependency version is invalid.");
-      const installed = JSON.parse(await readFile21(join17(project, "node_modules", name, "package.json"), "utf8"));
+      const installed = JSON.parse(await readFile22(join18(project, "node_modules", name, "package.json"), "utf8"));
       const actual = typeof installed === "object" && installed !== null ? Reflect.get(installed, "version") : undefined;
       if (typeof actual !== "string")
         throw new TypeError("Installed Expo dependency version is invalid.");
@@ -24566,7 +24975,7 @@ var sync = async (args) => {
 };
 var associations = async (args) => {
   const { mobile, projectRoot } = await loadMobile(valueAfter(args, "--config"));
-  const outputDirectory = resolve16(projectRoot, valueAfter(args, "--outdir") ?? ".absolutejs/mobile/associations");
+  const outputDirectory = resolve17(projectRoot, valueAfter(args, "--outdir") ?? ".absolutejs/mobile/associations");
   if (args.includes("--verify")) {
     const result2 = await verifyAbsoluteMobileAssociationFiles(mobile);
     console.log(`Verified ${result2.results.length} hosted association files`);
@@ -24618,7 +25027,7 @@ var generateGithubCi = async (args) => {
   const publicResult = {
     changed: result.changed,
     format: result.format,
-    path: relative15(projectRoot, result.path).replaceAll("\\", "/"),
+    path: relative16(projectRoot, result.path).replaceAll("\\", "/"),
     platforms: result.platforms,
     publishing: result.publishing,
     requiredSecrets: result.requiredSecrets
@@ -24649,15 +25058,15 @@ var createGithubCertificationVerification = async (args) => {
     GITHUB_WORKFLOW_REF: process.env.GITHUB_WORKFLOW_REF
   });
   const path = await writeAbsoluteMobileCertificationVerification(projectRoot, outputPath, verification);
-  console.log(relative15(projectRoot, path).replaceAll("\\", "/"));
+  console.log(relative16(projectRoot, path).replaceAll("\\", "/"));
   return verification;
 };
 var dispatchGithubMobilePromotion = async (args) => {
   const [platform2] = args;
   if (platform2 !== "android" && platform2 !== "ios")
     throw new TypeError("Usage: absolute mobile ci promote <android|ios> --run-id id --certification directory-or-json [--channel name] [store options]");
-  const runId = valueAfter(args, "--run-id");
-  if (!runId || !/^[1-9][0-9]*$/u.test(runId))
+  const runId2 = valueAfter(args, "--run-id");
+  if (!runId2 || !/^[1-9][0-9]*$/u.test(runId2))
     throw new TypeError("mobile ci promote requires a numeric --run-id.");
   const requestedCertification = valueAfter(args, "--certification");
   if (!requestedCertification || requestedCertification.startsWith("-"))
@@ -24685,7 +25094,7 @@ var dispatchGithubMobilePromotion = async (args) => {
     "-f",
     `platform=${platform2}`,
     "-f",
-    `source_run_id=${runId}`,
+    `source_run_id=${runId2}`,
     "-f",
     `certification_base64=${certificationBase64}`,
     "-f",
@@ -24714,7 +25123,85 @@ var dispatchGithubMobilePromotion = async (args) => {
     provider: "github-actions",
     storeTarget: platform2 === "android" ? playTrack !== "registry-only" : testflightGroup !== ""
   });
-  console.log(`Dispatched protected ${platform2} promotion for ${certification.release.releaseId} from workflow run ${runId}.`);
+  console.log(`Dispatched protected ${platform2} promotion for ${certification.release.releaseId} from workflow run ${runId2}.`);
+};
+var githubMobileRunId = (args) => {
+  const value = valueAfter(args, "--run-id");
+  if (!value || !/^[1-9][0-9]*$/u.test(value))
+    throw new TypeError("mobile ci command requires a numeric --run-id.");
+  return value;
+};
+var renderGithubMobileRunStatus = (status) => {
+  console.log(`GitHub run ${status.runId}: ${status.status}${status.conclusion ? ` / ${status.conclusion}` : ""}`);
+  console.log(`Workflow: ${status.workflowName}`);
+  console.log(`Commit: ${status.headSha} (${status.headBranch})`);
+  status.jobs.forEach((job) => console.log(`  ${job.name}: ${job.status}${job.conclusion ? ` / ${job.conclusion}` : ""}`));
+  console.log(status.url);
+};
+var inspectGithubMobileRun = async (args) => {
+  const projectRoot = process.cwd();
+  const requestedRunId = githubMobileRunId(args);
+  const repository = valueAfter(args, "--repo");
+  if (args.includes("--watch") && !args.includes("--json"))
+    console.log(`Watching GitHub run ${requestedRunId} until completion\u2026`);
+  const status = args.includes("--watch") ? await watchAbsoluteMobileCiRun({
+    projectRoot,
+    ...repository ? { repository } : {},
+    runId: requestedRunId
+  }) : await inspectAbsoluteMobileCiRun({
+    projectRoot,
+    ...repository ? { repository } : {},
+    runId: requestedRunId
+  });
+  sendTelemetryEvent("mobile:ci-status", {
+    conclusion: status.conclusion ?? "pending",
+    provider: "github-actions",
+    status: status.status,
+    watched: args.includes("--watch")
+  });
+  if (args.includes("--json"))
+    console.log(JSON.stringify(status, null, 2));
+  else
+    renderGithubMobileRunStatus(status);
+  return status;
+};
+var renderGithubMobilePromotionAudit = (result, projectRoot) => {
+  console.log(`\u2713 Verified ${result.audit.platform} promotion ${result.audit.github.promotionRunId} for ${result.audit.release.releaseId}.`);
+  console.log(`Audit: ${relative16(projectRoot, result.directory)}`);
+};
+var auditGithubMobilePromotion = async (args) => {
+  const projectRoot = process.cwd();
+  const requestedRunId = githubMobileRunId(args);
+  const repository = valueAfter(args, "--repo");
+  const sourceRunId = valueAfter(args, "--source-run-id");
+  const startedAt = performance.now();
+  try {
+    const result = await auditAbsoluteMobileCiPromotion({
+      outputDirectory: valueAfter(args, "--outdir"),
+      projectRoot,
+      ...repository ? { repository } : {},
+      runId: requestedRunId,
+      ...sourceRunId ? { sourceRunId } : {}
+    });
+    sendTelemetryEvent("mobile:ci-promotion-audit", {
+      durationMs: Math.round(performance.now() - startedAt),
+      platform: result.audit.platform,
+      provider: "github-actions",
+      success: true
+    });
+    if (args.includes("--json"))
+      console.log(JSON.stringify(result.audit, null, 2));
+    else
+      renderGithubMobilePromotionAudit(result, projectRoot);
+    return result;
+  } catch (error) {
+    sendTelemetryEvent("mobile:ci-promotion-audit", {
+      durationMs: Math.round(performance.now() - startedAt),
+      provider: "github-actions",
+      success: false
+    });
+    throw error;
+  }
 };
 var doctorMark = (status) => {
   if (status === "pass")
@@ -24812,9 +25299,9 @@ var prepareExpoMobileUpdateExport = async (options) => {
       temporaryDirectory: undefined
     };
   await ensureExpoPackages(mobile.nativeProjectDirectory, options.args);
-  const temporaryParent = join17(options.projectRoot, ".absolutejs", "mobile", "expo-update-exports");
-  await mkdir17(temporaryParent, { recursive: true });
-  const temporaryDirectory = await mkdtemp6(join17(temporaryParent, ".stage-"));
+  const temporaryParent = join18(options.projectRoot, ".absolutejs", "mobile", "expo-update-exports");
+  await mkdir18(temporaryParent, { recursive: true });
+  const temporaryDirectory = await mkdtemp7(join18(temporaryParent, ".stage-"));
   try {
     await runExpo(mobile.nativeProjectDirectory, [
       "export",
@@ -24826,9 +25313,9 @@ var prepareExpoMobileUpdateExport = async (options) => {
       temporaryDirectory,
       "--clear"
     ], { production: true });
-    const generatedApp = JSON.parse(await readFile21(join17(mobile.nativeProjectDirectory, "app.json"), "utf8"));
-    const expoConfig = isRecord9(generatedApp) ? generatedApp.expo : undefined;
-    if (!isRecord9(expoConfig))
+    const generatedApp = JSON.parse(await readFile22(join18(mobile.nativeProjectDirectory, "app.json"), "utf8"));
+    const expoConfig = isRecord10(generatedApp) ? generatedApp.expo : undefined;
+    if (!isRecord10(expoConfig))
       throw new TypeError("Generated Expo app configuration is invalid.");
     const publicExpoConfig = expoPublicConfig(expoConfig);
     const computedRuntime = resolveAbsoluteMobileUpdateRuntime(mobile, options.projectRoot).fingerprint;
@@ -24844,7 +25331,7 @@ var prepareExpoMobileUpdateExport = async (options) => {
       temporaryDirectory
     };
   } catch (error) {
-    await rm9(temporaryDirectory, { force: true, recursive: true });
+    await rm10(temporaryDirectory, { force: true, recursive: true });
     throw error;
   }
 };
@@ -24869,11 +25356,11 @@ var buildMobileUpdate = async (args) => {
   let expoExportDirectory;
   try {
     await start(mobileBuildServerEntry(args), valueAfter(args, "--web-outdir"), configPath, { prepareOnly: true });
-    const embedded = JSON.parse(await readFile21(join17(mobile.bundleDirectory, "absolute-mobile-manifest.json"), "utf8"));
-    const runtimeFingerprint = isRecord9(embedded) ? embedded.nativeRuntime : undefined;
+    const embedded = JSON.parse(await readFile22(join18(mobile.bundleDirectory, "absolute-mobile-manifest.json"), "utf8"));
+    const runtimeFingerprint = isRecord10(embedded) ? embedded.nativeRuntime : undefined;
     if (typeof runtimeFingerprint !== "string" || !/^[a-f0-9]{64}$/u.test(runtimeFingerprint))
       throw new TypeError("Prepared mobile bundle is missing its native runtime fingerprint.");
-    const privateKey = await readFile21(resolve16(projectRoot, signingKeyPath));
+    const privateKey = await readFile22(resolve17(projectRoot, signingKeyPath));
     const configuredPublicKey = Buffer.from(mobile.updates.publicKeys[keyId], "base64");
     const derivedPublicKey = createPublicKey2(privateKey).export({
       format: "der",
@@ -24894,7 +25381,7 @@ var buildMobileUpdate = async (args) => {
       channel: mobile.updates.channel,
       classification,
       keyId,
-      outputDirectory: valueAfter(args, "--outdir") ?? join17(projectRoot, ".absolutejs", "mobile", "updates"),
+      outputDirectory: valueAfter(args, "--outdir") ?? join18(projectRoot, ".absolutejs", "mobile", "updates"),
       privateKey,
       runtimeFingerprint
     });
@@ -24906,7 +25393,7 @@ var buildMobileUpdate = async (args) => {
     return result;
   } finally {
     if (expoExportDirectory)
-      await rm9(expoExportDirectory, { force: true, recursive: true });
+      await rm10(expoExportDirectory, { force: true, recursive: true });
     sendTelemetryEvent("mobile:update-build", {
       classification: classification ?? "invalid",
       durationMs: Math.round(performance.now() - startedAt),
@@ -24936,7 +25423,7 @@ var generateExpoUpdateSigning = async (args) => {
     ...valueAfter(args, "--public-key") ? { publicKeyPath: valueAfter(args, "--public-key") } : {},
     ...validityYears === undefined ? {} : { validityYears }
   });
-  const certificatePath = relative15(projectRoot, result.certificatePath).replaceAll("\\", "/");
+  const certificatePath = relative16(projectRoot, result.certificatePath).replaceAll("\\", "/");
   sendTelemetryEvent("mobile:update-code-signing-generated", {
     engine: "expo",
     validityYears: validityYears ?? 10
@@ -24998,7 +25485,7 @@ var provisionMobileUpdate = async (args) => {
     publicKeys: mobile.updates.publicKeys,
     storage: requestedStorage
   });
-  console.log(`Provisioned ${requestedStorage === "local" ? "local development" : "durable S3-compatible"} mobile update storage in ${relative15(projectRoot, path).replaceAll("\\", "/")}.`);
+  console.log(`Provisioned ${requestedStorage === "local" ? "local development" : "durable S3-compatible"} mobile update storage in ${relative16(projectRoot, path).replaceAll("\\", "/")}.`);
   if (requestedStorage === "local")
     console.log("Production release checks will require durable storage. Re-run with --storage s3 --force before deploying.");
   else
@@ -25475,7 +25962,7 @@ var buildAndroid = async (args, prepareVersionCode) => {
     const durationMs = Math.round(performance.now() - startedAt);
     console.log(`Built ${release.metadata.signed ? "signed" : "unsigned"} Android App Bundle in ${getDurationString(durationMs)}.`);
     console.log(`Artifact: ${release.artifactPath}`);
-    console.log(`Metadata: ${join17(release.releaseRoot, "release.json")}`);
+    console.log(`Metadata: ${join18(release.releaseRoot, "release.json")}`);
     return release;
   } finally {
     sendTelemetryEvent("mobile:android-release-build", {
@@ -25698,7 +26185,7 @@ var buildIos = async (args, prepareBuildNumber) => {
     console.log(`Artifact: ${release.artifactPath}`);
     if (release.registeredArtifactPath)
       console.log(`Registered-device artifact: ${release.registeredArtifactPath}`);
-    console.log(`Metadata: ${join17(release.releaseRoot, "release.json")}`);
+    console.log(`Metadata: ${join18(release.releaseRoot, "release.json")}`);
     return release;
   } finally {
     stopListeningForCancellation();
@@ -25849,7 +26336,7 @@ var appendSyncSchemaDoctorCheck = (checks, projectRoot) => {
     checks.push({
       id: "sync.storage-schema",
       label: `Offline schema ${schema.components.map((component) => `${component.id}@${component.version}`).join(", ")}`,
-      path: join17(projectRoot, "package.json"),
+      path: join18(projectRoot, "package.json"),
       platform: "host",
       status: "pass"
     });
@@ -25857,7 +26344,7 @@ var appendSyncSchemaDoctorCheck = (checks, projectRoot) => {
     checks.push({
       id: "sync.storage-schema",
       label: "Offline schema metadata is invalid",
-      path: join17(projectRoot, "package.json"),
+      path: join18(projectRoot, "package.json"),
       platform: "host",
       remediation: error instanceof Error ? error.message : String(error),
       status: "fail"
@@ -25945,7 +26432,7 @@ var requireAndroidTestPort = (args, projectRoot) => {
     }
     return { https: args.includes("--https"), port };
   }
-  const instances = listLiveInstances().filter((instance2) => resolve16(instance2.cwd) === resolve16(projectRoot) && instance2.source === "dev" && instance2.port !== null);
+  const instances = listLiveInstances().filter((instance2) => resolve17(instance2.cwd) === resolve17(projectRoot) && instance2.source === "dev" && instance2.port !== null);
   if (instances.length !== 1) {
     throw new TypeError(instances.length === 0 ? "No running AbsoluteJS dev server was found for this project. Start `bun dev`, wait for Android to report ready, then run `absolute mobile test android`." : "Multiple dev servers are running for this project. Select one with mobile test android --port <port>.");
   }
@@ -26039,8 +26526,8 @@ var selectOrStartAndroidReleaseEmulator = async (adb2, emulator, explicitSerial,
   return waitForBoot();
 };
 var safeArtifactRoot = (projectRoot, value) => {
-  const root = resolve16(projectRoot, value ?? ".absolutejs/mobile/test-artifacts");
-  if (root !== projectRoot && !root.startsWith(`${resolve16(projectRoot)}/`)) {
+  const root = resolve17(projectRoot, value ?? ".absolutejs/mobile/test-artifacts");
+  if (root !== projectRoot && !root.startsWith(`${resolve17(projectRoot)}/`)) {
     throw new TypeError("mobile test --artifacts must remain inside the project.");
   }
   return root;
@@ -26068,12 +26555,12 @@ var waitForRequestedAndroidHmr = async (args, session, checks, timeoutMs) => {
   });
 };
 var writeAndroidFailureArtifacts = async (options) => {
-  await mkdir17(options.artifactRoot, { recursive: true });
-  const screenshot = options.session ? await options.session.screenshot(join17(options.artifactRoot, "android-failure.png")).catch(() => {
+  await mkdir18(options.artifactRoot, { recursive: true });
+  const screenshot = options.session ? await options.session.screenshot(join18(options.artifactRoot, "android-failure.png")).catch(() => {
     return;
   }) : undefined;
-  const diagnosticPath = join17(options.artifactRoot, "android-failure.json");
-  await writeFile18(diagnosticPath, `${JSON.stringify({
+  const diagnosticPath = join18(options.artifactRoot, "android-failure.json");
+  await writeFile19(diagnosticPath, `${JSON.stringify({
     diagnostics: options.session?.diagnostics ?? [],
     error: options.error instanceof Error ? options.error.message : String(options.error),
     platform: "android",
@@ -26094,7 +26581,7 @@ var captureAndroidReleaseScreenshot = async (adb2, serial, destination) => {
   ]);
   if (exitCode !== 0)
     throw new Error(`Android release screenshot failed: ${stderr.trim() || `status ${exitCode}`}`);
-  await writeFile18(destination, bytes);
+  await writeFile19(destination, bytes);
   return destination;
 };
 var printAndroidReleaseAcceptance = (result, json) => {
@@ -26148,7 +26635,7 @@ var testAndroidRelease = async (args, mobile, projectRoot) => {
       release,
       serial
     });
-    const screenshot = reportRoot ? await captureAndroidReleaseScreenshot(adb2, serial, join17(reportRoot, "android-release.png")) : undefined;
+    const screenshot = reportRoot ? await captureAndroidReleaseScreenshot(adb2, serial, join18(reportRoot, "android-release.png")) : undefined;
     sendTelemetryEvent("mobile:android-release-conformance", {
       durationMs: result.durationMs,
       engine: result.engine,
@@ -26195,9 +26682,9 @@ var testAndroidRelease = async (args, mobile, projectRoot) => {
       platform: "android",
       success: false
     });
-    await mkdir17(artifactRoot, { recursive: true });
-    const diagnosticPath = join17(artifactRoot, "android-release-failure.json");
-    await writeFile18(diagnosticPath, `${JSON.stringify({
+    await mkdir18(artifactRoot, { recursive: true });
+    const diagnosticPath = join18(artifactRoot, "android-release-failure.json");
+    await writeFile19(diagnosticPath, `${JSON.stringify({
       error: sanitizeNativeReportText(error instanceof Error ? error.message : String(error)),
       platform: "android",
       provider: mobile.engine,
@@ -26291,7 +26778,7 @@ var testAndroid = async (args) => {
       console.log(JSON.stringify(report, null, 2));
     else
       printAndroidTestReport(report);
-    const screenshot = reportRoot ? await session.screenshot(join17(artifactRoot, "android-emulator.png")) : undefined;
+    const screenshot = reportRoot ? await session.screenshot(join18(artifactRoot, "android-emulator.png")) : undefined;
     await writeRequestedAndroidReport({
       adb: adb2,
       args,
@@ -26360,14 +26847,14 @@ var requireIosTestContext = (args, projectRoot) => {
     const port = Number(explicit);
     if (!Number.isInteger(port) || port < 1 || port > 65535)
       throw new TypeError("mobile test --port must be a valid TCP port.");
-    const instance2 = listLiveInstances().find((candidate) => resolve16(candidate.cwd) === resolve16(projectRoot) && candidate.source === "dev" && candidate.port === port);
+    const instance2 = listLiveInstances().find((candidate) => resolve17(candidate.cwd) === resolve17(projectRoot) && candidate.source === "dev" && candidate.port === port);
     return {
       https: instance2?.https ?? args.includes("--https"),
       instance: instance2,
       port
     };
   }
-  const instances = listLiveInstances().filter((instance2) => resolve16(instance2.cwd) === resolve16(projectRoot) && instance2.source === "dev" && instance2.port !== null);
+  const instances = listLiveInstances().filter((instance2) => resolve17(instance2.cwd) === resolve17(projectRoot) && instance2.source === "dev" && instance2.port !== null);
   if (instances.length !== 1)
     throw new TypeError(instances.length === 0 ? "No running AbsoluteJS dev server was found for this project. Start `bun dev`, wait for iOS to report ready, then run `absolute mobile test ios`." : "Multiple dev servers are running for this project. Select one with mobile test ios --port <port>.");
   const [instance] = instances;
@@ -26385,7 +26872,7 @@ var waitForIosHmrClient = async (options) => {
       return;
     });
     const status = response?.ok ? await response.json().catch(() => null) : null;
-    const targets = isRecord9(status) && isRecord9(status.connectedTargets) ? status.connectedTargets : undefined;
+    const targets = isRecord10(status) && isRecord10(status.connectedTargets) ? status.connectedTargets : undefined;
     if (targets && typeof targets["capacitor-ios"] === "number" && targets["capacitor-ios"] > 0)
       return;
     await Bun.sleep(100);
@@ -26511,8 +26998,8 @@ var requireCapturedCommand = (command, label) => {
   return result;
 };
 var writeIosFailureArtifacts = async (options) => {
-  await mkdir17(options.artifactRoot, { recursive: true });
-  const screenshot = join17(options.artifactRoot, "ios-failure.png");
+  await mkdir18(options.artifactRoot, { recursive: true });
+  const screenshot = join18(options.artifactRoot, "ios-failure.png");
   const screenshotResult = captureCommand4([
     options.xcrun,
     "simctl",
@@ -26521,8 +27008,8 @@ var writeIosFailureArtifacts = async (options) => {
     "screenshot",
     screenshot
   ]);
-  const diagnosticPath = join17(options.artifactRoot, "ios-failure.json");
-  await writeFile18(diagnosticPath, `${JSON.stringify({
+  const diagnosticPath = join18(options.artifactRoot, "ios-failure.json");
+  await writeFile19(diagnosticPath, `${JSON.stringify({
     appId: options.appId,
     error: options.error instanceof Error ? options.error.message : String(options.error),
     platform: "ios",
@@ -26549,8 +27036,8 @@ var nativeReportRoot = (args, projectRoot, platform2) => {
 var absolutejsVersionForReport = async () => {
   let absolutejsVersion = process.env.ABSOLUTE_VERSION ?? "unknown";
   const versions = await Promise.all([
-    resolve16(import.meta.dir, "..", "..", "package.json"),
-    resolve16(import.meta.dir, "..", "..", "..", "package.json")
+    resolve17(import.meta.dir, "..", "..", "package.json"),
+    resolve17(import.meta.dir, "..", "..", "..", "package.json")
   ].map((candidate) => readPackageVersionForIosReport(candidate).catch(() => "unknown")));
   for (const version of versions) {
     if (version === "unknown")
@@ -26927,9 +27414,9 @@ var testIosRelease = async (args, mobile, projectRoot) => {
       remote: remoteProfile !== undefined,
       success: false
     });
-    await mkdir17(artifactRoot, { recursive: true });
-    const diagnosticPath = join17(artifactRoot, "ios-release-failure.json");
-    await writeFile18(diagnosticPath, `${JSON.stringify({
+    await mkdir18(artifactRoot, { recursive: true });
+    const diagnosticPath = join18(artifactRoot, "ios-release-failure.json");
+    await writeFile19(diagnosticPath, `${JSON.stringify({
       error: sanitizeIosReportText(error instanceof Error ? error.message : String(error)),
       platform: "ios",
       provider: mobile.engine,
@@ -27022,8 +27509,8 @@ var testIos = async (args) => {
       mobile.appId
     ], "iOS app launch");
     await waitForIosHmrClient({ https, port, timeoutMs });
-    await mkdir17(artifactRoot, { recursive: true });
-    const screenshot = join17(artifactRoot, "ios-simulator.png");
+    await mkdir18(artifactRoot, { recursive: true });
+    const screenshot = join18(artifactRoot, "ios-simulator.png");
     requireCapturedCommand([xcrun, "simctl", "io", simulator.udid, "screenshot", screenshot], "iOS simulator screenshot");
     const hmrApply = await waitForRequestedIosHmr(args, instance, timeoutMs);
     const report = {
@@ -27240,6 +27727,10 @@ var runMobile = async (args) => {
   if (command === "ci") {
     if (args[1] === "promote")
       await dispatchGithubMobilePromotion(args.slice(2));
+    else if (args[1] === "status")
+      await inspectGithubMobileRun(args.slice(2));
+    else if (args[1] === "audit")
+      await auditGithubMobilePromotion(args.slice(2));
     else if (args[1] === "verification")
       await createGithubCertificationVerification(args.slice(2));
     else
@@ -27322,7 +27813,7 @@ var runMobile = async (args) => {
     await publishIos(args.slice(2));
     return;
   }
-  throw new TypeError("Usage: absolute mobile <pair mac <name> <user@host> [--port n] [--workspace path] | remotes [inspect [name] [--json] | clean [name] --yes | --json] | unpair mac <name> | init [--no-native] [--force] | sync [ios|android] | inspect [--json] [--require-bundle] | certify <release-dir> [--evidence report-dir]... [--require installed|simulator|device|store] [--outdir dir] [--json] | certify <release-dir> --verify certification-dir [--require installed|simulator|device|store] [--json] | associations [--outdir dir] [--verify] | ci github [server-entry] [--publish] [--registry module] [--secret-env NAME] [--output path] [--force] [--json] | ci promote <android|ios> --run-id id --certification path [--channel name] [--play-track track|--testflight-group group] [--ref branch] | doctor [ios|android|release [ios|android]] [--remote name] [--json|--fix [--yes]] | build <android|ios> [server-entry] [--remote name] [--registered-device-artifact] [--outdir dir] [--web-outdir dir] [--unsigned] | update provision [--storage local|s3] [--registry module] [--force] [--yes] | update signing generate --private-key path [--certificate path] [--public-key path] [--key-id id] [--common-name name] [--validity-years n] | update build [server-entry] --classification bug-fix|content|security --key-id id --signing-key path --within-submitted-purpose [--outdir dir] [--web-outdir dir] | update publish <release-directory> [--rollout fraction] [--registry module] | update promote --release id --rollout fraction [--registry module] | update rollback [--release id] [--registry module] | update status [--registry module] [--json] | update advance [--rollout fraction] [--registry module] [--json] | update pause|resume|cancel|reconcile [--registry module] [--json] | update storage [--retain count] [--min-age-days days] [--registry module] [--json] | update gc [--retain count] [--min-age-days days] [--grace-days days] [--apply] [--registry module] [--json] | publish android [server-entry] [--release release-dir] [--certification certification-dir] [--certification-attestation verification-json] [--registry module] [--channel name] [--play-track track] [--play-status completed|draft|halted|in-progress] [--play-rollout fraction] [--play-name name] [--play-notes language=text] [--play-update-priority 0..5] [--play-hold-review] [--play-cancel-existing-review] [--outdir dir] [--web-outdir dir] [--unsigned] | publish ios [server-entry] [--release release-dir] [--certification certification-dir] [--certification-attestation verification-json] [--remote name] [--registry module] [--channel name] [--testflight-group name-or-id] [--testflight-notes locale=text] [--testflight-submit-review] [--outdir dir] [--web-outdir dir] [--unsigned] | test android [--release release-dir [--yes] | --route path [--wait-for-hmr] [--port n]] [--report [dir]] [--serial id] [--artifacts dir] [--json] [--config path] | test ios [--release release-dir [--remote name] [--device id [--testflight] --yes] | --wait-for-hmr] [--report [dir]] [--udid id] [--artifacts dir] [--json] [--config path]");
+  throw new TypeError("Usage: absolute mobile <pair mac <name> <user@host> [--port n] [--workspace path] | remotes [inspect [name] [--json] | clean [name] --yes | --json] | unpair mac <name> | init [--no-native] [--force] | sync [ios|android] | inspect [--json] [--require-bundle] | certify <release-dir> [--evidence report-dir]... [--require installed|simulator|device|store] [--outdir dir] [--json] | certify <release-dir> --verify certification-dir [--require installed|simulator|device|store] [--json] | associations [--outdir dir] [--verify] | ci github [server-entry] [--publish] [--registry module] [--secret-env NAME] [--output path] [--force] [--json] | ci promote <android|ios> --run-id id --certification path [--channel name] [--play-track track|--testflight-group group] [--ref branch] | ci status --run-id id [--watch] [--repo owner/name] [--json] | ci audit --run-id id [--source-run-id id] [--repo owner/name] [--outdir path] [--json] | doctor [ios|android|release [ios|android]] [--remote name] [--json|--fix [--yes]] | build <android|ios> [server-entry] [--remote name] [--registered-device-artifact] [--outdir dir] [--web-outdir dir] [--unsigned] | update provision [--storage local|s3] [--registry module] [--force] [--yes] | update signing generate --private-key path [--certificate path] [--public-key path] [--key-id id] [--common-name name] [--validity-years n] | update build [server-entry] --classification bug-fix|content|security --key-id id --signing-key path --within-submitted-purpose [--outdir dir] [--web-outdir dir] | update publish <release-directory> [--rollout fraction] [--registry module] | update promote --release id --rollout fraction [--registry module] | update rollback [--release id] [--registry module] | update status [--registry module] [--json] | update advance [--rollout fraction] [--registry module] [--json] | update pause|resume|cancel|reconcile [--registry module] [--json] | update storage [--retain count] [--min-age-days days] [--registry module] [--json] | update gc [--retain count] [--min-age-days days] [--grace-days days] [--apply] [--registry module] [--json] | publish android [server-entry] [--release release-dir] [--certification certification-dir] [--certification-attestation verification-json] [--registry module] [--channel name] [--play-track track] [--play-status completed|draft|halted|in-progress] [--play-rollout fraction] [--play-name name] [--play-notes language=text] [--play-update-priority 0..5] [--play-hold-review] [--play-cancel-existing-review] [--outdir dir] [--web-outdir dir] [--unsigned] | publish ios [server-entry] [--release release-dir] [--certification certification-dir] [--certification-attestation verification-json] [--remote name] [--registry module] [--channel name] [--testflight-group name-or-id] [--testflight-notes locale=text] [--testflight-submit-review] [--outdir dir] [--web-outdir dir] [--unsigned] | test android [--release release-dir [--yes] | --route path [--wait-for-hmr] [--port n]] [--report [dir]] [--serial id] [--artifacts dir] [--json] [--config path] | test ios [--release release-dir [--remote name] [--device id [--testflight] --yes] | --wait-for-hmr] [--report [dir]] [--udid id] [--artifacts dir] [--json] [--config path]");
 };
 export {
   runMobile