@absolutejs/absolute 0.20.0-beta.110 → 0.20.0-beta.112

package/dist/mobile/index.js

@@ -19401,7 +19401,7 @@ var init_compatibilityDispatcher = __esm(() => {
 // src/cli/scripts/telemetry.ts
 import { existsSync as existsSync5, mkdirSync, readFileSync as readFileSync6, writeFileSync } from "fs";
 import { homedir as homedir4 } from "os";
-import { join as join23 } from "path";
+import { join as join25 } from "path";
 var configDir, configPath, getTelemetryConfig = () => {
   try {
     if (!existsSync5(configPath))
@@ -19414,14 +19414,14 @@ var configDir, configPath, getTelemetryConfig = () => {
   }
 };
 var init_telemetry = __esm(() => {
-  configDir = join23(homedir4(), ".absolutejs");
-  configPath = join23(configDir, "telemetry.json");
+  configDir = join25(homedir4(), ".absolutejs");
+  configPath = join25(configDir, "telemetry.json");
 });
 
 // src/cli/telemetryEvent.ts
 import { existsSync as existsSync6, readFileSync as readFileSync7 } from "fs";
 import { arch, platform as platform3 } from "os";
-import { dirname as dirname16, join as join24, parse } from "path";
+import { dirname as dirname18, join as join26, parse } from "path";
 var checkCandidate = (candidate) => {
   if (!existsSync6(candidate)) {
     return null;
@@ -19441,12 +19441,12 @@ var checkCandidate = (candidate) => {
 }, findPackageVersion = () => {
   let { dir } = import.meta;
   while (dir !== parse(dir).root) {
-    const candidate = join24(dir, "package.json");
+    const candidate = join26(dir, "package.json");
     const version = checkCandidate(candidate);
     if (version) {
       return version;
     }
-    dir = dirname16(dir);
+    dir = dirname18(dir);
   }
   return "unknown";
 }, sendTelemetryEvent = (event, payload) => {
@@ -19487,7 +19487,7 @@ __export(exports_mobilePreview, {
   createAbsoluteMobilePreviewPlugin: () => createAbsoluteMobilePreviewPlugin
 });
 import { Elysia as Elysia3 } from "elysia";
-var ABSOLUTE_MOBILE_PREVIEW_PATH = "/__absolute/mobile-preview", escapeHtml2 = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;"), isRecord11 = (value) => typeof value === "object" && value !== null, normalizeEntry2 = (entry) => {
+var ABSOLUTE_MOBILE_PREVIEW_PATH = "/__absolute/mobile-preview", escapeHtml2 = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;"), isRecord14 = (value) => typeof value === "object" && value !== null, normalizeEntry2 = (entry) => {
   const parsed = new URL(entry ?? "/", "https://absolute.invalid");
   return `${parsed.pathname}${parsed.search}${parsed.hash}`;
 }, absoluteMobilePreviewDocument = (mobile) => {
@@ -19535,7 +19535,7 @@ var ABSOLUTE_MOBILE_PREVIEW_PATH = "/__absolute/mobile-preview", escapeHtml2 = (
       "X-Robots-Tag": "noindex, nofollow"
     }
   })).post("/__absolute/mobile-preview-telemetry", ({ body, status }) => {
-    const value = isRecord11(body) ? body : undefined;
+    const value = isRecord14(body) ? body : undefined;
     const durationMs = value?.durationMs;
     const platform4 = value?.platform;
     if (typeof durationMs !== "number" || !Number.isFinite(durationMs) || durationMs < 0 || durationMs > 300000 || platform4 !== "android" && platform4 !== "ios") {
@@ -20092,7 +20092,7 @@ import {
   verify as verify2,
   X509Certificate as X509Certificate3
 } from "crypto";
-import { readFile as readFile29, stat as stat8 } from "fs/promises";
+import { readFile as readFile30, stat as stat9 } from "fs/promises";
 import path from "path";
 var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updates", MAX_FILE_BYTES, MAX_TOTAL_BYTES, DAY_MS, DEFAULT_MIN_AGE_MS, DEFAULT_GRACE_PERIOD_MS, DEFAULT_RETAIN_RECENT = 5, HASH, RELEASE, APP_ID, NAME, EXPO_DESCRIPTOR = "_absolute/expo-update.json", EXPO_CODE_SIGNING_ALGORITHM = "rsa-v1_5-sha256", HEALTH_TOKEN_VERSION = 1, HEALTH_KINDS, FAILURE_HEALTH_KINDS, MobileUpdateRegistryError, object6 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), text2 = (value, field2) => {
   if (typeof value !== "string" || value.length === 0)
@@ -21125,7 +21125,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
       verifyManifestSignature(manifest, options.publicKeys);
       await assertNotMarked(manifest.appId, manifest.releaseId);
       const localRoot = path.resolve(input.releaseDirectory);
-      const localManifest = parseMobileUpdateManifest(JSON.parse(await readFile29(path.join(localRoot, "update.json"), "utf8")));
+      const localManifest = parseMobileUpdateManifest(JSON.parse(await readFile30(path.join(localRoot, "update.json"), "utf8")));
       if (JSON.stringify(localManifest) !== JSON.stringify(manifest))
         throw new MobileUpdateRegistryError("Local mobile update manifest changed");
       const existing = await readManifest(manifest.appId, manifest.releaseId);
@@ -21143,7 +21143,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
       if (!existing) {
         for (const file of manifest.files) {
           const local = path.join(localRoot, "files", file.path);
-          const metadata = await stat8(local).catch(() => null);
+          const metadata = await stat9(local).catch(() => null);
           if (!metadata?.isFile() || metadata.size !== file.bytes)
             throw new MobileUpdateRegistryError(`Mobile update file ${file.path} size changed`);
           if (await fileDigest(Bun.file(local)) !== file.sha256)
@@ -21411,8 +21411,8 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
       });
     }
     const pathname = new URL(request.url).pathname.replace(/^\/+/, "");
-    const relative22 = pathname.startsWith(`${route}/`) ? pathname.slice(route.length + 1) : "";
-    if (request.method === "POST" && relative22 === "health") {
+    const relative23 = pathname.startsWith(`${route}/`) ? pathname.slice(route.length + 1) : "";
+    if (request.method === "POST" && relative23 === "health") {
       if (!options.registry.recordUpdateHealth)
         return new Response(null, { status: 404 });
       const appId = request.headers.get("x-absolute-mobile-app");
@@ -21455,7 +21455,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
     }
     if (request.method !== "GET")
       return new Response(null, { status: 405 });
-    if (relative22 === "update.json") {
+    if (relative23 === "update.json") {
       const expoProtocolVersion = request.headers.get("expo-protocol-version");
       const expoProtocol = expoProtocolVersion !== null;
       if (expoProtocol && expoProtocolVersion !== "1")
@@ -21573,7 +21573,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
         }
       });
     }
-    const match = /^(amu_[a-f0-9]{64})\/files\/(.+)$/.exec(relative22);
+    const match = /^(amu_[a-f0-9]{64})\/files\/(.+)$/.exec(relative23);
     if (!match?.[1] || !match[2])
       return new Response(null, { status: 404 });
     const file = await options.registry.readUpdateFile({
@@ -21666,15 +21666,15 @@ import {
   createPublicKey as createPublicKey3,
   X509Certificate as X509Certificate4
 } from "crypto";
-import { access as access21, mkdir as mkdir23 } from "fs/promises";
-import { dirname as dirname23, isAbsolute as isAbsolute13, relative as relative22, resolve as resolve24, sep as sep15 } from "path";
+import { access as access22, mkdir as mkdir24 } from "fs/promises";
+import { dirname as dirname24, isAbsolute as isAbsolute14, relative as relative23, resolve as resolve25, sep as sep16 } from "path";
 import { pathToFileURL as pathToFileURL5 } from "url";
 import { Elysia as Elysia4 } from "elysia";
-var ABSOLUTE_MOBILE_UPDATE_SERVER_FORMAT = 1, DEFAULT_MOBILE_UPDATE_REGISTRY_MODULE = "mobile.update.ts", object7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), projectPath3 = (projectRoot, requested) => {
-  const root = resolve24(projectRoot);
-  const path2 = resolve24(root, requested);
-  const projectRelative = relative22(root, path2);
-  if (projectRelative === ".." || projectRelative.startsWith(`..${sep15}`) || isAbsolute13(projectRelative))
+var ABSOLUTE_MOBILE_UPDATE_SERVER_FORMAT = 1, DEFAULT_MOBILE_UPDATE_REGISTRY_MODULE = "mobile.update.ts", object7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), projectPath4 = (projectRoot, requested) => {
+  const root = resolve25(projectRoot);
+  const path2 = resolve25(root, requested);
+  const projectRelative = relative23(root, path2);
+  if (projectRelative === ".." || projectRelative.startsWith(`..${sep16}`) || isAbsolute14(projectRelative))
     throw new TypeError("mobile.updates.server.registry must remain inside the project.");
   return path2;
 }, isRegistry4 = (value) => object7(value) && [
@@ -21696,8 +21696,8 @@ var ABSOLUTE_MOBILE_UPDATE_SERVER_FORMAT = 1, DEFAULT_MOBILE_UPDATE_REGISTRY_MOD
   };
   return metadata;
 }, loadAbsoluteMobileUpdateServerModule = async (projectRoot, requestedModulePath = DEFAULT_MOBILE_UPDATE_REGISTRY_MODULE) => {
-  const modulePath = projectPath3(projectRoot, requestedModulePath);
-  await access21(modulePath).catch(() => {
+  const modulePath = projectPath4(projectRoot, requestedModulePath);
+  await access22(modulePath).catch(() => {
     throw new TypeError(`Mobile update server registry does not exist: ${modulePath}. Run \`absolute mobile update provision\`.`);
   });
   const loaded = await import(pathToFileURL5(modulePath).href);
@@ -21884,15 +21884,15 @@ export default createMobileUpdateRegistry({
 `, `export default createMobileUpdateRegistry({
 ${generated}`);
 }, writeAbsoluteMobileUpdateRegistry = async (options) => {
-  const path2 = projectPath3(options.projectRoot, options.modulePath ?? DEFAULT_MOBILE_UPDATE_REGISTRY_MODULE);
+  const path2 = projectPath4(options.projectRoot, options.modulePath ?? DEFAULT_MOBILE_UPDATE_REGISTRY_MODULE);
   if (!options.force) {
-    await access21(path2).then(() => {
+    await access22(path2).then(() => {
       throw new TypeError(`Mobile update registry already exists: ${path2}. Pass --force to replace it.`);
     }, () => {
       return;
     });
   }
-  await mkdir23(dirname23(path2), { recursive: true });
+  await mkdir24(dirname24(path2), { recursive: true });
   await Bun.write(path2, renderAbsoluteMobileUpdateRegistry({
     ...options.health ? { health: options.health } : {},
     ...options.rollout ? { rollout: options.rollout } : {},
@@ -33029,140 +33029,1130 @@ var finalizeAbsoluteExpoUpdateExport = async (options) => {
 // src/mobile/index.ts
 init_config();
 
-// src/mobile/ciWorkflow.ts
-import { existsSync as existsSync4 } from "fs";
-import { access as access16, mkdir as mkdir16, readFile as readFile20, writeFile as writeFile16 } from "fs/promises";
-import { dirname as dirname15, extname as extname5, relative as relative15, resolve as resolve17, sep as sep10 } from "path";
-var ABSOLUTE_MOBILE_CI_WORKFLOW_FORMAT = 2;
-var SECRET_NAME_PATTERN = /^[A-Z][A-Z0-9_]*$/u;
-var CI_ENV_INDENTATION = 6;
-var RESERVED_SECRET_NAMES = new Set([
-  "ABSOLUTE_ANDROID_KEYSTORE_BASE64",
-  "ABSOLUTE_ANDROID_KEYSTORE_PASSWORD",
-  "ABSOLUTE_ANDROID_KEY_ALIAS",
-  "ABSOLUTE_ANDROID_KEY_PASSWORD",
-  "ABSOLUTE_GOOGLE_CREDENTIALS_BASE64",
-  "ABSOLUTE_IOS_CERTIFICATE_BASE64",
-  "ABSOLUTE_IOS_CERTIFICATE_PASSWORD",
-  "ABSOLUTE_IOS_PROVISIONING_PROFILE_BASE64",
-  "ABSOLUTE_IOS_KEYCHAIN_PASSWORD",
-  "ABSOLUTE_IOS_DEVELOPMENT_TEAM",
-  "APP_STORE_CONNECT_ISSUER_ID",
-  "APP_STORE_CONNECT_KEY_ID",
-  "APP_STORE_CONNECT_PRIVATE_KEY_BASE64"
-]);
+// src/mobile/ciPromotionAudit.ts
+import {
+  access as access18,
+  mkdir as mkdir18,
+  mkdtemp as mkdtemp11,
+  readFile as readFile22,
+  readdir as readdir7,
+  rename as rename14,
+  rm as rm14,
+  stat as stat7,
+  writeFile as writeFile18
+} from "fs/promises";
+import { dirname as dirname16, isAbsolute as isAbsolute11, join as join24, relative as relative17, resolve as resolve19, sep as sep12 } from "path";
+
+// src/mobile/certificationVerification.ts
+import { access as access16, mkdir as mkdir16, readFile as readFile20, stat as stat6, writeFile as writeFile16 } from "fs/promises";
+import { dirname as dirname15, isAbsolute as isAbsolute9, relative as relative15, resolve as resolve17, sep as sep10 } from "path";
+var ABSOLUTE_MOBILE_CERTIFICATION_VERIFICATION_FORMAT = 1;
+var MAX_VERIFICATION_BYTES = 1048576;
+var SHA_PATTERN = /^[a-f0-9]{40}$/u;
+var REPOSITORY_PATTERN = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/u;
+var REF_PATTERN = /^refs\/(?:heads|tags)\/[^@\s]+$/u;
+var WORKFLOW_PATTERN = /^\.github\/workflows\/[^/@]+\.ya?ml$/u;
+var isRecord11 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var required = (value, name) => {
+  if (typeof value !== "string" || value.trim() === "")
+    throw new TypeError(`${name} is required.`);
+  return value.trim();
+};
+var requireMatch = (value, pattern, name) => {
+  if (!pattern.test(value))
+    throw new TypeError(`${name} is invalid.`);
+  return value;
+};
+var createAbsoluteMobileCertificationVerification = (bundle, environment) => {
+  const repository = required(environment.GITHUB_REPOSITORY, "GITHUB_REPOSITORY");
+  const workflowReference = required(environment.GITHUB_WORKFLOW_REF, "GITHUB_WORKFLOW_REF");
+  const prefix = `${repository}/`;
+  const separator = workflowReference.lastIndexOf("@");
+  if (!workflowReference.startsWith(prefix) || separator <= prefix.length)
+    throw new TypeError("GITHUB_WORKFLOW_REF is invalid.");
+  return parseAbsoluteMobileCertificationVerification({
+    bundle,
+    format: ABSOLUTE_MOBILE_CERTIFICATION_VERIFICATION_FORMAT,
+    identity: {
+      issuer: "https://token.actions.githubusercontent.com",
+      ref: environment.GITHUB_REF,
+      repository,
+      sha: environment.GITHUB_SHA,
+      workflowPath: workflowReference.slice(prefix.length, separator)
+    },
+    kind: "sigstore-bundle"
+  });
+};
+var parseAbsoluteMobileCertificationVerification = (value) => {
+  if (!isRecord11(value) || value.format !== ABSOLUTE_MOBILE_CERTIFICATION_VERIFICATION_FORMAT || value.kind !== "sigstore-bundle" || !isRecord11(value.bundle) || !isRecord11(value.identity))
+    throw new TypeError("Mobile certification verification contract is invalid.");
+  const issuer = required(value.identity.issuer, "verification issuer");
+  if (issuer !== "https://token.actions.githubusercontent.com")
+    throw new TypeError("verification issuer is invalid.");
+  const verification = {
+    bundle: value.bundle,
+    format: ABSOLUTE_MOBILE_CERTIFICATION_VERIFICATION_FORMAT,
+    identity: {
+      issuer,
+      ref: requireMatch(required(value.identity.ref, "verification ref"), REF_PATTERN, "verification ref"),
+      repository: requireMatch(required(value.identity.repository, "verification repository"), REPOSITORY_PATTERN, "verification repository"),
+      sha: requireMatch(required(value.identity.sha, "verification sha"), SHA_PATTERN, "verification sha"),
+      workflowPath: requireMatch(required(value.identity.workflowPath, "verification workflowPath"), WORKFLOW_PATTERN, "verification workflowPath")
+    },
+    kind: "sigstore-bundle"
+  };
+  const bytes = new TextEncoder().encode(JSON.stringify(verification));
+  if (bytes.byteLength > MAX_VERIFICATION_BYTES)
+    throw new TypeError("Mobile certification verification exceeds the 1 MiB limit.");
+  return verification;
+};
+var projectFile = (projectRoot, requested) => {
+  const root = resolve17(projectRoot);
+  const path = resolve17(root, requested);
+  const portable = relative15(root, path);
+  if (portable === ".." || portable.startsWith(`..${sep10}`) || isAbsolute9(portable))
+    throw new TypeError("Mobile certification verification path must remain inside the project.");
+  return path;
+};
+var readAbsoluteMobileCertificationVerification = async (projectRoot, requested) => {
+  const path = projectFile(projectRoot, requested);
+  await access16(path).catch(() => {
+    throw new TypeError(`Mobile certification verification does not exist: ${path}`);
+  });
+  const metadata = await stat6(path);
+  if (!metadata.isFile() || metadata.size > MAX_VERIFICATION_BYTES)
+    throw new TypeError("Mobile certification verification file is invalid.");
+  return parseAbsoluteMobileCertificationVerification(JSON.parse(await readFile20(path, "utf8")));
+};
+var readAbsoluteSigstoreBundle = async (projectRoot, requested) => {
+  const path = projectFile(projectRoot, requested);
+  const metadata = await stat6(path).catch(() => null);
+  if (!metadata?.isFile() || metadata.size > MAX_VERIFICATION_BYTES)
+    throw new TypeError("Sigstore bundle file is invalid.");
+  const value = JSON.parse(await readFile20(path, "utf8"));
+  if (!isRecord11(value))
+    throw new TypeError("Sigstore bundle is invalid.");
+  return value;
+};
+var writeAbsoluteMobileCertificationVerification = async (projectRoot, requested, verification) => {
+  const path = projectFile(projectRoot, requested);
+  const parsed = parseAbsoluteMobileCertificationVerification(verification);
+  await mkdir16(dirname15(path), { recursive: true });
+  await writeFile16(path, `${JSON.stringify(parsed, null, 2)}
+`, {
+    mode: 384
+  });
+  return path;
+};
+
+// src/mobile/releaseCertification.ts
+import { createHash as createHash16 } from "crypto";
+import {
+  access as access17,
+  mkdir as mkdir17,
+  mkdtemp as mkdtemp10,
+  readFile as readFile21,
+  rename as rename13,
+  rm as rm13,
+  writeFile as writeFile17
+} from "fs/promises";
+import { basename as basename8, isAbsolute as isAbsolute10, join as join23, relative as relative16, resolve as resolve18, sep as sep11 } from "path";
+var ABSOLUTE_MOBILE_RELEASE_CERTIFICATION_FORMAT = 1;
+var CERTIFICATION_PREFIX = "amobile_cert_";
+var SHA256 = /^[a-f0-9]{64}$/u;
+var STRENGTH_RANK = {
+  device: 1,
+  installed: 0,
+  simulator: 0,
+  store: 2
+};
+var isRequirement = (value) => value === "installed" || value === "simulator" || value === "device" || value === "store";
+var isStrength = (value) => value === "installed" || value === "simulator" || value === "device" || value === "store";
+var isArtifactExactness = (value) => value === "archive-equivalent" || value === "source-equivalent" || value === "store-delivered";
+var isDistribution = (value) => value === "apple-processed" || value === "registered-device" || value === "simulator-release";
+var isRecord12 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var inside4 = (root, candidate) => {
+  const path = relative16(resolve18(root), resolve18(candidate));
+  return path === "" || !isAbsolute10(path) && path !== ".." && !path.startsWith(`..${sep11}`);
+};
 var exists8 = async (path) => {
   try {
-    await access16(path);
+    await access17(path);
     return true;
   } catch {
     return false;
   }
 };
-var yamlString = (value) => `'${value.replaceAll("'", "''")}'`;
-var projectPath = (projectRoot, value, field2, options = {}) => {
-  const root = resolve17(projectRoot);
-  const path = resolve17(root, value);
-  const portable = relative15(root, path).replaceAll("\\", "/");
-  if (portable === ".." || portable.startsWith(`..${sep10}`) || portable.startsWith("../") || portable === "") {
-    throw new TypeError(`${field2} must remain inside the project root.`);
-  }
-  if (/\r|\n/u.test(portable) || portable.startsWith("-"))
-    throw new TypeError(`${field2} contains an unsafe path.`);
-  if (!options.allowMissing && !existsSync4(path))
-    throw new TypeError(`${field2} does not exist inside the project.`);
-  return portable;
+var sha2564 = (bytes) => createHash16("sha256").update(bytes).digest("hex");
+var requireString2 = (value, name) => {
+  if (typeof value !== "string" || !value)
+    throw new TypeError(`Mobile certification ${name} is invalid.`);
+  return value;
 };
-var workflowOutputPath = (projectRoot, value) => {
-  const root = resolve17(projectRoot);
-  const workflows = resolve17(root, ".github/workflows");
-  const path = resolve17(root, value ?? ".github/workflows/absolute-mobile.yml");
-  const portable = relative15(workflows, path);
-  if (portable === ".." || portable.startsWith(`..${sep10}`) || extname5(path) !== ".yml" && extname5(path) !== ".yaml") {
-    throw new TypeError("mobile ci github --output must be a .yml or .yaml file inside .github/workflows.");
-  }
-  return path;
+var requirePositiveInteger = (value, name) => {
+  if (!Number.isSafeInteger(value) || Number(value) < 1)
+    throw new TypeError(`Mobile certification ${name} is invalid.`);
+  return Number(value);
 };
-var normalizeSecretEnvironment = (values = []) => {
-  const names = [...new Set(values)].sort();
-  for (const name of names) {
-    if (!SECRET_NAME_PATTERN.test(name))
-      throw new TypeError("mobile ci github --secret-env values must be uppercase environment variable names.");
-    if (name.startsWith("GITHUB_") || name.startsWith("RUNNER_") || name.startsWith("ACTIONS_") || RESERVED_SECRET_NAMES.has(name)) {
-      throw new TypeError(`mobile ci github --secret-env cannot replace reserved variable ${name}.`);
-    }
-  }
-  return names;
+var resolveEvidencePath = async (projectRoot, requested) => {
+  const selected = resolve18(projectRoot, requested);
+  if (!inside4(projectRoot, selected))
+    throw new TypeError("Mobile certification evidence must remain inside the project.");
+  if (basename8(selected) === "report.json")
+    return selected;
+  const report = join23(selected, "report.json");
+  if (!await exists8(report))
+    throw new TypeError(`Mobile certification evidence does not contain report.json: ${requested}`);
+  return report;
 };
-var customSecretEnvironment = (names, indentation = CI_ENV_INDENTATION) => names.map((name) => `${" ".repeat(indentation)}${name}: \${{ secrets.${name} }}`).join(`
-`);
-var commandEnvironment2 = (options) => `      ABSOLUTE_CONFIG_PATH: ${yamlString(options.configPath ?? "")}
-      ABSOLUTE_REGISTRY_MODULE: ${yamlString(options.registryModule)}
-      ABSOLUTE_SERVER_ENTRY: ${yamlString(options.serverEntry)}`;
-var appendConfigArgument = `if [[ -n "$ABSOLUTE_CONFIG_PATH" ]]; then
-            args+=(--config "$ABSOLUTE_CONFIG_PATH")
-          fi`;
-var installSteps = `      - name: Check out source
-        uses: actions/checkout@v6
-      - name: Install Bun
-        uses: oven-sh/setup-bun@v2
-      - name: Install exact dependencies
-        run: bun ci`;
-var bundleAuditSteps = `      - name: Prepare production mobile bundle
-        shell: bash
-        run: |
-          args=(bunx absolute prepare "$ABSOLUTE_SERVER_ENTRY" --outdir .absolutejs/mobile-ci/server)
-          ${appendConfigArgument}
-          "\${args[@]}"
-      - name: Run cryptographic mobile bundle audit
-        id: mobile-bundle-audit
-        continue-on-error: true
-        shell: bash
-        run: |
-          mkdir -p .absolutejs/mobile-ci
-          args=(bunx absolute mobile inspect --json --require-bundle)
-          ${appendConfigArgument}
-          "\${args[@]}" > .absolutejs/mobile-ci/inspection.json
-      - name: Upload mobile inspection report
-        if: always()
-        uses: actions/upload-artifact@v7
-        with:
-          name: absolute-mobile-inspection
-          path: .absolutejs/mobile-ci/inspection.json
-          if-no-files-found: error
-          retention-days: 30
-          include-hidden-files: true
-      - name: Enforce mobile bundle audit
-        if: steps.mobile-bundle-audit.outcome != 'success'
-        run: exit 1`;
-var releaseAuditSteps = (platform3) => `      - name: Run redacted mobile release audit
-        id: mobile-release-audit
-        continue-on-error: true
-        shell: bash
-        run: |
-          mkdir -p .absolutejs/mobile-ci
-          args=(bunx absolute mobile doctor release ${platform3} --json)
-          ${appendConfigArgument}
-          "\${args[@]}" > .absolutejs/mobile-ci/compliance.json
-      - name: Upload mobile compliance report
-        if: always()
-        uses: actions/upload-artifact@v7
-        with:
-          name: absolute-mobile-compliance-\${{ github.job }}
-          path: .absolutejs/mobile-ci/compliance.json
-          if-no-files-found: error
-          retention-days: 30
-          include-hidden-files: true
-      - name: Enforce mobile release audit
-        if: steps.mobile-release-audit.outcome != 'success'
-        run: exit 1`;
-var platformInput = (platforms) => {
-  const choices = platforms.length === 2 ? ["all", ...platforms] : platforms;
-  return `      platform:
-        description: Native platform to build
-        required: true
-        type: choice
-        default: ${choices[0]}
+var releaseIdentity = (release) => {
+  const { metadata } = release;
+  if (!metadata.signed)
+    throw new TypeError("Mobile release certification requires a signed native release.");
+  const common = {
+    appBuild: metadata.appBuild,
+    appId: metadata.appId,
+    artifactBytes: metadata.bytes,
+    artifactSha256: metadata.sha256,
+    engine: metadata.engine,
+    platform: metadata.platform,
+    releaseId: metadata.releaseId,
+    runtime: metadata.runtime,
+    signed: true
+  };
+  if (metadata.platform === "android")
+    return {
+      ...common,
+      ...metadata.versionCode === undefined ? {} : { versionCode: metadata.versionCode }
+    };
+  return {
+    ...common,
+    ...metadata.buildNumber === undefined ? {} : { buildNumber: metadata.buildNumber },
+    marketingVersion: metadata.marketingVersion
+  };
+};
+var requireCheck = (report, id, accepted = ["PASS"]) => {
+  const checks = report.automatedChecks;
+  if (!Array.isArray(checks))
+    throw new TypeError("Mobile certification evidence has invalid automated checks.");
+  const check = checks.find((candidate) => isRecord12(candidate) && candidate.id === id);
+  if (!isRecord12(check) || !accepted.includes(String(check.result)))
+    throw new TypeError(`Mobile certification evidence does not satisfy ${id}.`);
+};
+var validateCommonReport = (report, release) => {
+  if (report.reportVersion !== 1 || report.platform !== release.platform || !isRecord12(report.metadata) || report.metadata.provider !== release.engine || !isRecord12(report.run) || report.run.status !== "pass" || report.run.appId !== release.appId)
+    throw new TypeError("Mobile certification evidence does not match the release platform, provider, application, or successful-run contract.");
+  requireCheck(report, "AUTO-DEV-01");
+  return {
+    generatedAt: requireString2(report.generatedAt, "evidence generatedAt"),
+    run: report.run
+  };
+};
+var validateReleaseFields = (value, release) => {
+  if (value.releaseId !== release.releaseId || value.artifactSha256 !== release.artifactSha256 || value.artifactBytes !== release.artifactBytes || value.engine !== release.engine || value.signed !== true)
+    throw new TypeError("Mobile certification evidence does not match the immutable release identity.");
+};
+var validateAndroidEvidence = (report, run, release, reportSha256, generatedAt) => {
+  if (!isRecord12(run.release))
+    throw new TypeError("Android certification evidence has no installed release result.");
+  validateReleaseFields(run.release, release);
+  if (run.release.embeddedOffline !== true)
+    throw new TypeError("Android certification evidence did not prove embedded offline relaunch.");
+  requireCheck(report, "AUTO-RELEASE-01");
+  requireCheck(report, "AUTO-RELEASE-OFFLINE-01");
+  return {
+    generatedAt,
+    networkUnavailable: "proven",
+    remote: false,
+    reportSha256,
+    strength: "installed"
+  };
+};
+var validateIosEvidence = (report, run, release, reportSha256, generatedAt) => {
+  if (!isRecord12(run.iosRelease))
+    throw new TypeError("iOS certification evidence has no installed release result.");
+  const ios = run.iosRelease;
+  validateReleaseFields(ios, release);
+  if (ios.embeddedLocal !== true)
+    throw new TypeError("iOS certification evidence did not prove embedded local rendering.");
+  requireCheck(report, "AUTO-IOS-RELEASE-01");
+  let strength;
+  if (ios.distribution === "simulator-release" && ios.artifactExactness === "source-equivalent" && run.targetKind === "simulator" && ios.networkUnavailable === "not-proven")
+    strength = "simulator";
+  else if (ios.distribution === "registered-device" && ios.artifactExactness === "archive-equivalent" && run.targetKind === "device" && ios.networkUnavailable === "user-confirmed")
+    strength = "device";
+  else if (ios.distribution === "apple-processed" && ios.artifactExactness === "store-delivered" && run.targetKind === "device" && ios.networkUnavailable === "user-confirmed")
+    strength = "store";
+  else
+    throw new TypeError("iOS certification evidence contains an invalid target, distribution, exactness, or offline-strength combination.");
+  if (strength === "simulator")
+    requireCheck(report, "AUTO-IOS-RELEASE-OFFLINE-01", ["SKIPPED"]);
+  else
+    requireCheck(report, "AUTO-IOS-RELEASE-OFFLINE-01");
+  return {
+    artifactExactness: ios.artifactExactness,
+    distribution: ios.distribution,
+    generatedAt,
+    networkUnavailable: ios.networkUnavailable === "user-confirmed" ? "proven" : "not-proven",
+    remote: ios.remote === true,
+    reportSha256,
+    strength
+  };
+};
+var validateEvidence = async (projectRoot, requested, release) => {
+  const path = await resolveEvidencePath(projectRoot, requested);
+  const bytes = await readFile21(path);
+  let value;
+  try {
+    value = JSON.parse(bytes.toString("utf8"));
+  } catch {
+    throw new TypeError("Mobile certification evidence report is not valid JSON.");
+  }
+  if (!isRecord12(value))
+    throw new TypeError("Mobile certification evidence report must contain an object.");
+  const { generatedAt, run } = validateCommonReport(value, release);
+  const digest = sha2564(bytes);
+  return release.platform === "android" ? validateAndroidEvidence(value, run, release, digest, generatedAt) : validateIosEvidence(value, run, release, digest, generatedAt);
+};
+var defaultRequirement = (platform3) => platform3 === "android" ? "installed" : "simulator";
+var validateRequirement = (platform3, requirement) => {
+  if (platform3 === "android" && requirement !== "installed")
+    throw new TypeError("Android certification currently uses its fixed installed/offline requirement; --require simulator, device, and store are iOS policies.");
+  if (platform3 === "ios" && requirement === "installed")
+    throw new TypeError("iOS certification requires simulator, device, or store evidence.");
+};
+var satisfiesRequirement = (strength, requirement) => {
+  if (requirement === "installed")
+    return strength === "installed";
+  if (strength === "installed")
+    return false;
+  return STRENGTH_RANK[strength] >= STRENGTH_RANK[requirement];
+};
+var resolveAbsoluteMobileCertificationRequirement = (config, target) => {
+  const channelRequirement = target.channel ? config.releaseCertification.channels[target.channel]?.[target.platform] : undefined;
+  const playRequirement = target.googlePlayTrack ? config.releaseCertification.googlePlayTracks[target.googlePlayTrack] : undefined;
+  const requirements = [channelRequirement, playRequirement].filter((value) => value !== undefined);
+  if (requirements.length === 0)
+    return;
+  return requirements.reduce((strongest, candidate) => STRENGTH_RANK[candidate] > STRENGTH_RANK[strongest] ? candidate : strongest);
+};
+var validateCertifiedEvidence = (platform3, evidence) => {
+  if (platform3 === "android") {
+    if (evidence.strength !== "installed" || evidence.networkUnavailable !== "proven" || evidence.artifactExactness !== undefined || evidence.distribution !== undefined || evidence.remote)
+      throw new TypeError("Android release certification contains invalid evidence strength.");
+    return;
+  }
+  const simulator = evidence.strength === "simulator" && evidence.artifactExactness === "source-equivalent" && evidence.distribution === "simulator-release" && evidence.networkUnavailable === "not-proven";
+  const device = evidence.strength === "device" && evidence.artifactExactness === "archive-equivalent" && evidence.distribution === "registered-device" && evidence.networkUnavailable === "proven";
+  const store = evidence.strength === "store" && evidence.artifactExactness === "store-delivered" && evidence.distribution === "apple-processed" && evidence.networkUnavailable === "proven";
+  if (!simulator && !device && !store)
+    throw new TypeError("iOS release certification contains invalid evidence strength.");
+};
+var canonicalJsonValue = (value) => {
+  if (Array.isArray(value))
+    return value.map(canonicalJsonValue);
+  if (!isRecord12(value))
+    return value;
+  const sorted = {};
+  for (const key of Object.keys(value).sort())
+    sorted[key] = canonicalJsonValue(value[key]);
+  return sorted;
+};
+var certificationBody = (certification) => JSON.stringify(canonicalJsonValue(certification));
+var createAbsoluteMobileReleaseCertification = async (options) => {
+  if (options.evidencePaths.length === 0)
+    throw new TypeError("Mobile release certification requires at least one --evidence report.");
+  const release = releaseIdentity(options.release);
+  const requirement = options.requirement ?? defaultRequirement(release.platform);
+  validateRequirement(release.platform, requirement);
+  const evidence = await Promise.all(options.evidencePaths.map((path) => validateEvidence(options.projectRoot, path, release)));
+  evidence.sort((left, right) => left.reportSha256.localeCompare(right.reportSha256));
+  const [firstEvidence] = evidence;
+  if (!firstEvidence)
+    throw new TypeError("Mobile release certification requires valid evidence.");
+  const strength = evidence.reduce((strongest, candidate) => STRENGTH_RANK[candidate.strength] > STRENGTH_RANK[strongest] ? candidate.strength : strongest, firstEvidence.strength);
+  if (!satisfiesRequirement(strength, requirement))
+    throw new TypeError(`Mobile release evidence strength ${strength} does not satisfy required ${requirement} certification.`);
+  const body = {
+    evidence,
+    format: ABSOLUTE_MOBILE_RELEASE_CERTIFICATION_FORMAT,
+    generatedAt: options.generatedAt ?? evidence.reduce((latest, candidate) => candidate.generatedAt > latest ? candidate.generatedAt : latest, firstEvidence.generatedAt),
+    release,
+    requirement,
+    status: "certified",
+    strength
+  };
+  return {
+    certificationId: `${CERTIFICATION_PREFIX}${sha2564(certificationBody(body))}`,
+    ...body
+  };
+};
+var parseCertification = (value) => {
+  if (!isRecord12(value) || value.format !== ABSOLUTE_MOBILE_RELEASE_CERTIFICATION_FORMAT || value.status !== "certified" || !isRecord12(value.release) || !Array.isArray(value.evidence))
+    throw new TypeError("Mobile release certification contract is invalid.");
+  const { release } = value;
+  const { platform: platform3 } = release;
+  const { engine } = release;
+  if (platform3 !== "android" && platform3 !== "ios" || engine !== "capacitor" && engine !== "expo" || release.signed !== true)
+    throw new TypeError("Mobile release certification identity is invalid.");
+  const { requirement } = value;
+  const { strength } = value;
+  if (!isRequirement(requirement) || !isStrength(strength))
+    throw new TypeError("Mobile release certification policy is invalid.");
+  validateRequirement(platform3, requirement);
+  if (!satisfiesRequirement(strength, requirement))
+    throw new TypeError("Mobile release certification does not satisfy its declared policy.");
+  const artifactBytes = requirePositiveInteger(release.artifactBytes, "release artifactBytes");
+  const artifactSha256 = requireString2(release.artifactSha256, "release artifactSha256");
+  if (!SHA256.test(artifactSha256))
+    throw new TypeError("Mobile release certification artifact digest is invalid.");
+  const parsedRelease = {
+    appBuild: requireString2(release.appBuild, "release appBuild"),
+    appId: requireString2(release.appId, "release appId"),
+    artifactBytes,
+    artifactSha256,
+    engine,
+    platform: platform3,
+    releaseId: requireString2(release.releaseId, "release releaseId"),
+    runtime: requireString2(release.runtime, "release runtime"),
+    signed: true,
+    ...release.buildNumber === undefined ? {} : {
+      buildNumber: requirePositiveInteger(release.buildNumber, "release buildNumber")
+    },
+    ...release.marketingVersion === undefined ? {} : {
+      marketingVersion: requireString2(release.marketingVersion, "release marketingVersion")
+    },
+    ...release.versionCode === undefined ? {} : {
+      versionCode: requirePositiveInteger(release.versionCode, "release versionCode")
+    }
+  };
+  const evidence = value.evidence.map((candidate) => {
+    if (!isRecord12(candidate) || !SHA256.test(String(candidate.reportSha256)) || !isStrength(candidate.strength) || candidate.networkUnavailable !== "not-proven" && candidate.networkUnavailable !== "proven" || typeof candidate.remote !== "boolean" || typeof candidate.generatedAt !== "string" || candidate.artifactExactness !== undefined && !isArtifactExactness(candidate.artifactExactness) || candidate.distribution !== undefined && !isDistribution(candidate.distribution))
+      throw new TypeError("Mobile release certification evidence is invalid.");
+    const parsedEvidence = {
+      generatedAt: candidate.generatedAt,
+      networkUnavailable: candidate.networkUnavailable,
+      remote: candidate.remote,
+      reportSha256: String(candidate.reportSha256),
+      strength: candidate.strength,
+      ...candidate.artifactExactness === undefined ? {} : {
+        artifactExactness: candidate.artifactExactness
+      },
+      ...candidate.distribution === undefined ? {} : { distribution: candidate.distribution }
+    };
+    validateCertifiedEvidence(platform3, parsedEvidence);
+    return parsedEvidence;
+  });
+  const strongestEvidence = evidence.reduce((strongest, candidate) => STRENGTH_RANK[candidate.strength] > STRENGTH_RANK[strongest] ? candidate.strength : strongest, evidence[0]?.strength ?? "installed");
+  if (evidence.length === 0 || strongestEvidence !== strength)
+    throw new TypeError("Mobile release certification evidence does not support its declared strength.");
+  const parsed = {
+    certificationId: requireString2(value.certificationId, "certificationId"),
+    evidence,
+    format: ABSOLUTE_MOBILE_RELEASE_CERTIFICATION_FORMAT,
+    generatedAt: requireString2(value.generatedAt, "generatedAt"),
+    release: parsedRelease,
+    requirement,
+    status: "certified",
+    strength
+  };
+  const { certificationId, ...body } = parsed;
+  if (certificationId !== `${CERTIFICATION_PREFIX}${sha2564(certificationBody(body))}`)
+    throw new TypeError("Mobile release certification content digest is invalid.");
+  return parsed;
+};
+var readAbsoluteMobileReleaseCertification = async (projectRoot, requested) => {
+  const selected = resolve18(projectRoot, requested);
+  if (!inside4(projectRoot, selected))
+    throw new TypeError("Mobile release certification must remain inside the project.");
+  const path = basename8(selected) === "certification.json" ? selected : join23(selected, "certification.json");
+  const value = JSON.parse(await readFile21(path, "utf8"));
+  return { certification: parseCertification(value), path };
+};
+var renderAbsoluteMobileReleaseCertification = (certification) => {
+  const { release } = certification;
+  const version = release.platform === "ios" ? `${release.marketingVersion ?? "unknown"} (${release.buildNumber ?? "unallocated"})` : String(release.versionCode ?? "unallocated");
+  const evidence = certification.evidence.map((item) => `| ${item.strength} | ${item.networkUnavailable} | ${item.remote ? "paired Mac" : "local host"} | ${item.reportSha256} |`).join(`
+`);
+  return `# AbsoluteJS mobile release certification
+
+- Status: CERTIFIED
+- Certification: ${certification.certificationId}
+- Generated: ${certification.generatedAt}
+- Platform: ${release.platform}
+- Engine: ${release.engine}
+- Requirement: ${certification.requirement}
+- Evidence strength: ${certification.strength}
+- Release: ${release.releaseId}
+- Artifact SHA-256: ${release.artifactSha256}
+- Runtime fingerprint: ${release.runtime}
+- Embedded app build: ${release.appBuild}
+- Version/build: ${version}
+
+This certification is local and contains no signing credentials, device identifiers, SSH destinations, report paths, application data, or page contents. Re-run verification against the immutable release before using it as a CI or promotion gate.
+
+| Strength | Network unavailable | Execution | Report SHA-256 |
+| --- | --- | --- | --- |
+${evidence}
+`;
+};
+var serializeAbsoluteMobileReleaseCertification = (certification) => `${JSON.stringify(certification, null, 2)}
+`;
+var verifyAbsoluteMobileReleaseCertification = (certification, release, requirement) => {
+  const parsed = parseCertification(certification);
+  const expected = releaseIdentity(release);
+  if (JSON.stringify(parsed.release) !== JSON.stringify(expected))
+    throw new TypeError("Mobile release certification was invalidated by a release identity, artifact, runtime, signing, version, build, or embedded-bundle change.");
+  if (requirement) {
+    validateRequirement(expected.platform, requirement);
+    if (!satisfiesRequirement(parsed.strength, requirement))
+      throw new TypeError(`Mobile release certification strength ${parsed.strength} does not satisfy required ${requirement} policy.`);
+  }
+  return parsed;
+};
+var writeAbsoluteMobileReleaseCertification = async (projectRoot, certification, outputDirectory) => {
+  const root = resolve18(projectRoot);
+  const parent = resolve18(root, outputDirectory ?? join23(".absolutejs", "mobile", "certifications", certification.release.platform, certification.release.releaseId));
+  if (!inside4(root, parent))
+    throw new TypeError("Mobile certification output must remain inside the project.");
+  await mkdir17(parent, { recursive: true });
+  const destination = join23(parent, certification.certificationId);
+  const paths = {
+    directory: destination,
+    jsonPath: join23(destination, "certification.json"),
+    markdownPath: join23(destination, "certification.md")
+  };
+  const json = serializeAbsoluteMobileReleaseCertification(certification);
+  const markdown = renderAbsoluteMobileReleaseCertification(certification);
+  const verifyExisting = async () => {
+    const [existingJson, existingMarkdown] = await Promise.all([
+      readFile21(paths.jsonPath, "utf8"),
+      readFile21(paths.markdownPath, "utf8")
+    ]);
+    if (existingJson !== json || existingMarkdown !== markdown)
+      throw new TypeError(`Immutable mobile certification ${certification.certificationId} already exists with different content.`);
+  };
+  if (await exists8(destination)) {
+    await verifyExisting();
+    return paths;
+  }
+  const staging = await mkdtemp10(join23(parent, ".certification-"));
+  try {
+    await Promise.all([
+      writeFile17(join23(staging, "certification.json"), json, {
+        flag: "wx"
+      }),
+      writeFile17(join23(staging, "certification.md"), markdown, {
+        flag: "wx"
+      })
+    ]);
+    await rename13(staging, destination).catch(async (error) => {
+      if (await exists8(destination))
+        return;
+      throw error;
+    });
+  } finally {
+    await rm13(staging, { force: true, recursive: true });
+  }
+  await verifyExisting();
+  return paths;
+};
+
+// src/mobile/ciPromotionAudit.ts
+var ABSOLUTE_MOBILE_CI_PROMOTION_AUDIT_FORMAT = 1;
+var ABSOLUTE_MOBILE_CI_PROMOTION_CONTEXT_FORMAT = 2;
+var MAX_GITHUB_OUTPUT_BYTES = 1048576;
+var MAX_AUDIT_JSON_BYTES = 1048576;
+var MAX_SEARCH_FILES = 20000;
+var RUN_ID_PATTERN = /^[1-9][0-9]*$/u;
+var REPOSITORY_PATTERN2 = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/u;
+var DISPATCH_ID_PATTERN = /^amp_[a-f0-9]{32}$/u;
+var PROMOTION_DISCOVERY_ATTEMPTS = 60;
+var PROMOTION_DISCOVERY_INTERVAL_MS = 1000;
+var isRecord13 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var requiredString = (value, name) => {
+  if (typeof value !== "string" || value.trim() === "")
+    throw new TypeError(`${name} is invalid.`);
+  return value.trim();
+};
+var optionalString = (value, name) => {
+  if (value === null || value === undefined)
+    return null;
+  return requiredString(value, name);
+};
+var runId = (value, name) => {
+  if (!RUN_ID_PATTERN.test(value))
+    throw new TypeError(`${name} is invalid.`);
+  return value;
+};
+var dispatchId = (value) => {
+  if (!DISPATCH_ID_PATTERN.test(value))
+    throw new TypeError("Mobile promotion dispatch ID is invalid.");
+  return value;
+};
+var promotionRunTitle = (value) => `AbsoluteJS mobile promotion [${dispatchId(value)}]`;
+var promotionDiscoveryCommand = (workflow, repository) => [
+  "gh",
+  "run",
+  "list",
+  "--workflow",
+  workflow,
+  "--event",
+  "workflow_dispatch",
+  "--limit",
+  "50",
+  ...repositoryArgs(repository),
+  "--json",
+  "databaseId,displayTitle,event,url"
+];
+var repositoryArgs = (repository) => {
+  if (repository === undefined)
+    return [];
+  if (!REPOSITORY_PATTERN2.test(repository))
+    throw new TypeError("GitHub repository must be owner/name.");
+  return ["--repo", repository];
+};
+var projectPath = (projectRoot, requested) => {
+  const root = resolve19(projectRoot);
+  const path = resolve19(root, requested);
+  const portable = relative17(root, path);
+  if (portable === ".." || portable.startsWith(`..${sep12}`) || isAbsolute11(portable))
+    throw new TypeError("Mobile CI audit output must remain inside the project.");
+  return path;
+};
+var defaultRunner = async (command, options) => {
+  const child = Bun.spawn(command, {
+    cwd: options.cwd,
+    env: options.env,
+    stderr: "pipe",
+    stdin: "ignore",
+    stdout: "pipe"
+  });
+  const [exitCode, stderr, stdout] = await Promise.all([
+    child.exited,
+    new Response(child.stderr).text(),
+    new Response(child.stdout).text()
+  ]);
+  return { exitCode, stderr, stdout };
+};
+var requireCommand = async (run, command, options, label) => {
+  const result = await run(command, options);
+  if (result.exitCode !== 0)
+    throw new TypeError(`${label} failed: ${result.stderr.trim() || result.stdout.trim() || `exit ${result.exitCode}`}`);
+  if (result.stdout.length > MAX_GITHUB_OUTPUT_BYTES || result.stderr.length > MAX_GITHUB_OUTPUT_BYTES)
+    throw new TypeError(`${label} output exceeded the 1 MiB limit.`);
+  return result;
+};
+var parseJob = (value) => {
+  if (!isRecord13(value))
+    throw new TypeError("GitHub run job is invalid.");
+  return {
+    conclusion: optionalString(value.conclusion, "GitHub job conclusion"),
+    name: requiredString(value.name, "GitHub job name"),
+    status: requiredString(value.status, "GitHub job status")
+  };
+};
+var discoverAbsoluteMobilePromotionRun = async (options) => {
+  const requestedDispatchId = dispatchId(options.dispatchId);
+  const attempts = options.attempts ?? PROMOTION_DISCOVERY_ATTEMPTS;
+  if (!Number.isSafeInteger(attempts) || attempts < 1 || attempts > 300)
+    throw new TypeError("Mobile promotion discovery attempts are invalid.");
+  const pollIntervalMs = options.pollIntervalMs ?? PROMOTION_DISCOVERY_INTERVAL_MS;
+  if (!Number.isSafeInteger(pollIntervalMs) || pollIntervalMs < 0 || pollIntervalMs > 1e4)
+    throw new TypeError("Mobile promotion discovery interval is invalid.");
+  const sleep = options.sleep ?? Bun.sleep;
+  const discover = async (attempt) => {
+    const result = await requireCommand(options.run ?? defaultRunner, promotionDiscoveryCommand(options.workflow, options.repository), { cwd: options.projectRoot }, "GitHub promotion run discovery");
+    const discovered = parseAbsoluteMobilePromotionRunList(JSON.parse(result.stdout), requestedDispatchId);
+    if (discovered)
+      return discovered;
+    if (attempt >= attempts)
+      throw new TypeError(`GitHub did not expose promotion dispatch ${requestedDispatchId} within ${attempts} attempts.`);
+    await sleep(pollIntervalMs);
+    return discover(attempt + 1);
+  };
+  return discover(1);
+};
+var inspectAbsoluteMobileCiRun = async (options) => {
+  const requestedRunId = runId(options.runId, "GitHub run ID");
+  const result = await requireCommand(options.run ?? defaultRunner, [
+    "gh",
+    "run",
+    "view",
+    requestedRunId,
+    ...repositoryArgs(options.repository),
+    "--json",
+    "conclusion,createdAt,databaseId,displayTitle,headBranch,headSha,jobs,startedAt,status,updatedAt,url,workflowName"
+  ], { cwd: options.projectRoot }, "GitHub workflow inspection");
+  return parseAbsoluteMobileCiRunStatus(JSON.parse(result.stdout), requestedRunId);
+};
+var parseAbsoluteMobileCiRunStatus = (value, requestedRunId) => {
+  if (!isRecord13(value) || !Array.isArray(value.jobs))
+    throw new TypeError("GitHub workflow run response is invalid.");
+  const { databaseId } = value;
+  if (typeof databaseId !== "number" && typeof databaseId !== "string" || String(databaseId) !== requestedRunId)
+    throw new TypeError("GitHub workflow run identity does not match.");
+  return {
+    conclusion: optionalString(value.conclusion, "GitHub run conclusion"),
+    createdAt: requiredString(value.createdAt, "GitHub run createdAt"),
+    displayTitle: requiredString(value.displayTitle, "GitHub run displayTitle"),
+    headBranch: requiredString(value.headBranch, "GitHub run headBranch"),
+    headSha: requiredString(value.headSha, "GitHub run headSha"),
+    jobs: value.jobs.map(parseJob),
+    runId: requestedRunId,
+    startedAt: optionalString(value.startedAt, "GitHub run startedAt"),
+    status: requiredString(value.status, "GitHub run status"),
+    updatedAt: requiredString(value.updatedAt, "GitHub run updatedAt"),
+    url: requiredString(value.url, "GitHub run URL"),
+    workflowName: requiredString(value.workflowName, "GitHub workflow name")
+  };
+};
+var parseAbsoluteMobilePromotionContext = (value) => {
+  if (!isRecord13(value) || value.format !== 1 && value.format !== ABSOLUTE_MOBILE_CI_PROMOTION_CONTEXT_FORMAT || value.platform !== "android" && value.platform !== "ios")
+    throw new TypeError("Mobile promotion context is invalid.");
+  const { platform: platform3 } = value;
+  const sourceArtifact = requiredString(value.sourceArtifact, "promotion source artifact");
+  if (sourceArtifact !== `absolute-mobile-${platform3}`)
+    throw new TypeError("Mobile promotion source artifact is invalid.");
+  return {
+    dispatchId: value.format === 1 ? null : dispatchId(requiredString(value.dispatchId, "promotion dispatch ID")),
+    format: value.format,
+    platform: platform3,
+    promotionRunId: runId(requiredString(value.promotionRunId, "promotion run ID"), "promotion run ID"),
+    sourceArtifact,
+    sourceRunId: runId(requiredString(value.sourceRunId, "source run ID"), "source run ID")
+  };
+};
+var parseAbsoluteMobilePromotionRunList = (value, requestedDispatchId) => {
+  if (!Array.isArray(value))
+    throw new TypeError("GitHub workflow run list response is invalid.");
+  const expectedTitle = promotionRunTitle(requestedDispatchId);
+  const matches2 = value.filter((candidate) => isRecord13(candidate) && candidate.displayTitle === expectedTitle);
+  if (matches2.length === 0)
+    return null;
+  if (matches2.length !== 1)
+    throw new TypeError("GitHub returned multiple runs for one promotion dispatch identity.");
+  const [match] = matches2;
+  if (!isRecord13(match) || match.event !== "workflow_dispatch")
+    throw new TypeError("GitHub promotion run identity is invalid.");
+  const databaseId = typeof match.databaseId === "number" || typeof match.databaseId === "string" ? String(match.databaseId) : "";
+  const requestedRunId = runId(databaseId, "GitHub promotion run ID");
+  const url = requiredString(match.url, "GitHub promotion run URL");
+  if (!url.endsWith(`/actions/runs/${requestedRunId}`))
+    throw new TypeError("GitHub promotion run URL does not match its ID.");
+  return {
+    dispatchId: requestedDispatchId,
+    runId: requestedRunId,
+    url
+  };
+};
+var watchAbsoluteMobileCiRun = async (options) => {
+  const requestedRunId = runId(options.runId, "GitHub run ID");
+  await requireCommand(options.run ?? defaultRunner, [
+    "gh",
+    "run",
+    "watch",
+    requestedRunId,
+    ...repositoryArgs(options.repository),
+    "--exit-status"
+  ], { cwd: options.projectRoot }, "GitHub workflow watch");
+  return inspectAbsoluteMobileCiRun({ ...options, runId: requestedRunId });
+};
+var readBoundedJson = async (path, label) => {
+  const metadata = await stat7(path).catch(() => null);
+  if (!metadata?.isFile() || metadata.size > MAX_AUDIT_JSON_BYTES)
+    throw new TypeError(`${label} is missing or exceeds the 1 MiB limit.`);
+  const value = JSON.parse(await readFile22(path, "utf8"));
+  return value;
+};
+var findFiles = async (root, name) => {
+  const found = [];
+  let visited = 0;
+  const walk = async (directory) => {
+    const entries = await readdir7(directory, { withFileTypes: true });
+    await Promise.all(entries.map(async (entry) => {
+      visited += 1;
+      if (visited > MAX_SEARCH_FILES)
+        throw new TypeError("Downloaded GitHub artifact contains too many files.");
+      const path = join24(directory, entry.name);
+      if (entry.isDirectory()) {
+        await walk(path);
+        return;
+      }
+      if (entry.isFile() && entry.name === name)
+        found.push(path);
+    }));
+  };
+  await walk(root);
+  return found;
+};
+var inferPromotionPlatform = (status) => {
+  const matched = status.jobs.flatMap((job) => {
+    if (job.name === "Promote exact certified Android release")
+      return ["android"];
+    if (job.name === "Promote exact certified iOS release")
+      return ["ios"];
+    return [];
+  });
+  if (matched.length !== 1)
+    throw new TypeError("GitHub run does not contain exactly one mobile promotion job.");
+  const [platform3] = matched;
+  if (!platform3)
+    throw new TypeError("Mobile promotion platform is missing.");
+  return platform3;
+};
+var onlyPath = (paths, label) => {
+  const [path] = paths;
+  if (paths.length !== 1 || !path)
+    throw new TypeError(`${label} must contain exactly one matching file.`);
+  return path;
+};
+var canonicalJson2 = (value) => {
+  if (Array.isArray(value))
+    return `[${value.map((entry) => canonicalJson2(entry)).join(",")}]`;
+  if (isRecord13(value))
+    return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson2(value[key])}`).join(",")}}`;
+  return JSON.stringify(value);
+};
+var publicationSummary = (value, platform3, release, certification) => {
+  if (!isRecord13(value) || !isRecord13(value.record) || !isRecord13(value.record.metadata))
+    throw new TypeError("Mobile promotion receipt is invalid.");
+  const { metadata } = value.record;
+  if (metadata.appId !== release.metadata.appId || metadata.releaseId !== release.metadata.releaseId || metadata.sha256 !== release.metadata.sha256)
+    throw new TypeError("Mobile promotion receipt release identity does not match.");
+  if (!isRecord13(value.certification) || !isRecord13(value.certification.provenance))
+    throw new TypeError("Mobile promotion receipt lacks trusted certification provenance.");
+  if (value.certification.certificationId !== certification.certificationId || value.certification.releaseId !== release.metadata.releaseId || value.certification.requirement !== certification.requirement || value.certification.strength !== certification.strength || value.certification.provenance.subject !== release.metadata.releaseId)
+    throw new TypeError("Mobile promotion certification receipt does not match.");
+  requiredString(value.certification.provenance.issuer, "promotion provenance issuer");
+  requiredString(value.certification.provenance.verificationId, "promotion provenance verification ID");
+  const provenanceTime = requiredString(value.certification.provenance.verifiedAt, "promotion provenance verification time");
+  if (Number.isNaN(Date.parse(provenanceTime)))
+    throw new TypeError("Mobile promotion provenance time is invalid.");
+  if (typeof value.reused !== "boolean")
+    throw new TypeError("Mobile promotion reuse status is invalid.");
+  const channel = isRecord13(value.channel) ? optionalString(value.channel.channel, "promotion channel") : null;
+  if (isRecord13(value.channel) && value.channel.releaseId !== release.metadata.releaseId)
+    throw new TypeError("Mobile promotion channel receipt does not match.");
+  const providerReceipt = platform3 === "android" ? value.googlePlay : value.appStoreConnect;
+  if (providerReceipt === undefined)
+    return {
+      channel,
+      provider: "registry",
+      reused: value.reused,
+      stage: null
+    };
+  if (!isRecord13(providerReceipt) || !isRecord13(providerReceipt.receipt))
+    throw new TypeError("Mobile store promotion receipt is invalid.");
+  if (typeof providerReceipt.reused !== "boolean")
+    throw new TypeError("Mobile store promotion reuse status is invalid.");
+  const expectedProvider = platform3 === "android" ? "google-play" : "app-store-connect";
+  if (providerReceipt.receipt.provider !== expectedProvider || providerReceipt.receipt.releaseId !== release.metadata.releaseId || providerReceipt.receipt.sha256 !== release.metadata.sha256)
+    throw new TypeError("Mobile store promotion receipt does not match.");
+  return {
+    channel,
+    provider: expectedProvider,
+    reused: providerReceipt.reused,
+    stage: requiredString(providerReceipt.receipt.stage, "Mobile store promotion stage")
+  };
+};
+var renderAuditMarkdown = (audit) => `# AbsoluteJS mobile promotion audit
+
+- Status: **VERIFIED**
+- Platform: ${audit.platform}
+- Release: \`${audit.release.releaseId}\`
+- Artifact SHA-256: \`${audit.release.sha256}\`
+- Source workflow run: ${audit.github.sourceRunId}
+- Promotion workflow run: ${audit.github.promotionRunId}
+- Dispatch correlation: ${audit.github.dispatchId ?? "legacy workflow (not recorded)"}
+- Workflow: ${audit.github.workflowName}
+- GitHub identity: \`${audit.provenance.repository}/${audit.provenance.workflowPath}@${audit.provenance.ref}\`
+- Certification: \`${audit.certification.certificationId}\` (${audit.certification.strength})
+- Publication: ${audit.publication.provider}${audit.publication.stage ? ` / ${audit.publication.stage}` : ""}
+- Verified at: ${audit.verifiedAt}
+
+This report contains no credentials, device identifiers, local absolute paths, application data, or GitHub token.
+`;
+var auditAbsoluteMobileCiPromotion = async (options) => {
+  const runner = options.run ?? defaultRunner;
+  const promotionRunId = runId(options.runId, "GitHub promotion run ID");
+  const status = await inspectAbsoluteMobileCiRun({
+    projectRoot: options.projectRoot,
+    ...options.repository ? { repository: options.repository } : {},
+    run: runner,
+    runId: promotionRunId
+  });
+  if (status.status !== "completed" || status.conclusion !== "success")
+    throw new TypeError("Mobile promotion run has not completed successfully.");
+  const platform3 = inferPromotionPlatform(status);
+  const output = projectPath(options.projectRoot, options.outputDirectory ?? `.absolutejs/mobile-ci/audits/${promotionRunId}`);
+  if (await access18(output).then(() => true).catch(() => false))
+    throw new TypeError(`Mobile CI audit output already exists: ${output}`);
+  await mkdir18(dirname16(output), { recursive: true });
+  const staging = await mkdtemp11(join24(dirname16(output), ".promotion-audit-"));
+  try {
+    const evidenceRoot = join24(staging, "promotion-evidence");
+    await mkdir18(evidenceRoot);
+    await requireCommand(runner, [
+      "gh",
+      "run",
+      "download",
+      promotionRunId,
+      ...repositoryArgs(options.repository),
+      "--name",
+      `absolute-mobile-${platform3}-promotion-${promotionRunId}`,
+      "--dir",
+      evidenceRoot
+    ], { cwd: options.projectRoot }, "GitHub promotion artifact download");
+    const contextPaths = await findFiles(evidenceRoot, "promotion-context.json");
+    let context;
+    if (contextPaths.length === 1)
+      context = parseAbsoluteMobilePromotionContext(await readBoundedJson(onlyPath(contextPaths, "Promotion context"), "Promotion context"));
+    else if (contextPaths.length > 1)
+      throw new TypeError("Promotion artifact contains duplicate contexts.");
+    if (context && context.promotionRunId !== promotionRunId)
+      throw new TypeError("Promotion context run identity does not match.");
+    if (context && context.platform !== platform3)
+      throw new TypeError("Promotion context platform does not match.");
+    if (context?.dispatchId && status.displayTitle !== promotionRunTitle(context.dispatchId))
+      throw new TypeError("Promotion dispatch identity does not match the GitHub run.");
+    const sourceRunId = options.sourceRunId ? runId(options.sourceRunId, "GitHub source run ID") : context?.sourceRunId;
+    if (!sourceRunId)
+      throw new TypeError("Promotion artifact predates source-run context; pass --source-run-id.");
+    if (context && options.sourceRunId && context.sourceRunId !== sourceRunId)
+      throw new TypeError("Requested source run does not match promotion context.");
+    const sourceArtifact = context?.sourceArtifact ?? `absolute-mobile-${platform3}`;
+    const sourceRoot = join24(staging, "source-release");
+    await mkdir18(sourceRoot);
+    await requireCommand(runner, [
+      "gh",
+      "run",
+      "download",
+      sourceRunId,
+      ...repositoryArgs(options.repository),
+      "--name",
+      sourceArtifact,
+      "--dir",
+      sourceRoot
+    ], { cwd: options.projectRoot }, "GitHub source release download");
+    const releaseMetadata = await findFiles(sourceRoot, "release.json");
+    if (releaseMetadata.length !== 1)
+      throw new TypeError("Source artifact must contain exactly one immutable mobile release.");
+    const releaseMetadataPath = onlyPath(releaseMetadata, "Source artifact");
+    const release = platform3 === "android" ? await readAbsoluteAndroidRelease(options.projectRoot, releaseMetadataPath) : await readAbsoluteIosRelease(options.projectRoot, releaseMetadataPath);
+    const certificationPaths = await findFiles(evidenceRoot, "certification.json");
+    const verificationPaths = await findFiles(evidenceRoot, "verification.json");
+    const receiptPaths = await findFiles(evidenceRoot, "promotion-receipt.json");
+    if (certificationPaths.length !== 1 || verificationPaths.length !== 1 || receiptPaths.length !== 1)
+      throw new TypeError("Promotion audit artifact is incomplete or ambiguous.");
+    const certificationPath = onlyPath(certificationPaths, "Promotion certification");
+    const verificationPath = onlyPath(verificationPaths, "Promotion verification");
+    const receiptPath = onlyPath(receiptPaths, "Promotion receipt");
+    const loadedCertification = await readAbsoluteMobileReleaseCertification(options.projectRoot, certificationPath);
+    const certification = verifyAbsoluteMobileReleaseCertification(loadedCertification.certification, release);
+    const verification = await readAbsoluteMobileCertificationVerification(options.projectRoot, verificationPath);
+    if (verification.identity.sha !== status.headSha)
+      throw new TypeError("Sigstore workflow commit does not match the promotion run.");
+    if (options.repository && verification.identity.repository !== options.repository)
+      throw new TypeError("Sigstore repository does not match the requested repository.");
+    const bundlePath = `${certificationPath}.sigstore.json`;
+    const bundle = await readAbsoluteSigstoreBundle(options.projectRoot, bundlePath);
+    if (canonicalJson2(bundle) !== canonicalJson2(verification.bundle))
+      throw new TypeError("Sigstore bundle does not match verification envelope.");
+    await requireCommand(runner, [
+      "bunx",
+      "@absolutejs/attest@0.2.0",
+      "verify-blobs",
+      certificationPath
+    ], {
+      cwd: options.projectRoot,
+      env: {
+        ...process.env,
+        GITHUB_REF: verification.identity.ref,
+        GITHUB_REPOSITORY: verification.identity.repository,
+        GITHUB_SHA: verification.identity.sha,
+        GITHUB_WORKFLOW_REF: `${verification.identity.repository}/${verification.identity.workflowPath}@${verification.identity.ref}`
+      }
+    }, "Sigstore certification verification");
+    const publication = publicationSummary(await readBoundedJson(receiptPath, "Mobile promotion receipt"), platform3, release, certification);
+    const audit = {
+      certification: {
+        certificationId: certification.certificationId,
+        requirement: certification.requirement,
+        strength: certification.strength
+      },
+      format: ABSOLUTE_MOBILE_CI_PROMOTION_AUDIT_FORMAT,
+      github: {
+        conclusion: status.conclusion,
+        dispatchId: context?.dispatchId ?? null,
+        promotionRunId,
+        repository: verification.identity.repository,
+        sourceRunId,
+        url: status.url,
+        workflowName: status.workflowName
+      },
+      platform: platform3,
+      provenance: verification.identity,
+      publication,
+      release: {
+        appId: release.metadata.appId,
+        bytes: release.metadata.bytes,
+        engine: release.metadata.engine,
+        releaseId: release.metadata.releaseId,
+        runtime: release.metadata.runtime,
+        sha256: release.metadata.sha256
+      },
+      status: "verified",
+      verifiedAt: new Date().toISOString()
+    };
+    await Promise.all([
+      writeFile18(join24(staging, "audit.json"), `${JSON.stringify(audit, null, 2)}
+`, { mode: 384 }),
+      writeFile18(join24(staging, "audit.md"), renderAuditMarkdown(audit), {
+        mode: 384
+      })
+    ]);
+    await rename14(staging, output);
+    return { audit, directory: output };
+  } catch (error) {
+    await rm14(staging, { force: true, recursive: true });
+    throw error;
+  }
+};
+// src/mobile/ciWorkflow.ts
+import { existsSync as existsSync4 } from "fs";
+import { access as access19, mkdir as mkdir19, readFile as readFile23, writeFile as writeFile19 } from "fs/promises";
+import { dirname as dirname17, extname as extname5, relative as relative18, resolve as resolve20, sep as sep13 } from "path";
+var ABSOLUTE_MOBILE_CI_WORKFLOW_FORMAT = 4;
+var SECRET_NAME_PATTERN = /^[A-Z][A-Z0-9_]*$/u;
+var CI_ENV_INDENTATION = 6;
+var RESERVED_SECRET_NAMES = new Set([
+  "ABSOLUTE_ANDROID_KEYSTORE_BASE64",
+  "ABSOLUTE_ANDROID_KEYSTORE_PASSWORD",
+  "ABSOLUTE_ANDROID_KEY_ALIAS",
+  "ABSOLUTE_ANDROID_KEY_PASSWORD",
+  "ABSOLUTE_GOOGLE_CREDENTIALS_BASE64",
+  "ABSOLUTE_IOS_CERTIFICATE_BASE64",
+  "ABSOLUTE_IOS_CERTIFICATE_PASSWORD",
+  "ABSOLUTE_IOS_PROVISIONING_PROFILE_BASE64",
+  "ABSOLUTE_IOS_KEYCHAIN_PASSWORD",
+  "ABSOLUTE_IOS_DEVELOPMENT_TEAM",
+  "APP_STORE_CONNECT_ISSUER_ID",
+  "APP_STORE_CONNECT_KEY_ID",
+  "APP_STORE_CONNECT_PRIVATE_KEY_BASE64"
+]);
+var exists9 = async (path) => {
+  try {
+    await access19(path);
+    return true;
+  } catch {
+    return false;
+  }
+};
+var yamlString = (value) => `'${value.replaceAll("'", "''")}'`;
+var projectPath2 = (projectRoot, value, field2, options = {}) => {
+  const root = resolve20(projectRoot);
+  const path = resolve20(root, value);
+  const portable = relative18(root, path).replaceAll("\\", "/");
+  if (portable === ".." || portable.startsWith(`..${sep13}`) || portable.startsWith("../") || portable === "") {
+    throw new TypeError(`${field2} must remain inside the project root.`);
+  }
+  if (/\r|\n/u.test(portable) || portable.startsWith("-"))
+    throw new TypeError(`${field2} contains an unsafe path.`);
+  if (!options.allowMissing && !existsSync4(path))
+    throw new TypeError(`${field2} does not exist inside the project.`);
+  return portable;
+};
+var workflowOutputPath = (projectRoot, value) => {
+  const root = resolve20(projectRoot);
+  const workflows = resolve20(root, ".github/workflows");
+  const path = resolve20(root, value ?? ".github/workflows/absolute-mobile.yml");
+  const portable = relative18(workflows, path);
+  if (portable === ".." || portable.startsWith(`..${sep13}`) || extname5(path) !== ".yml" && extname5(path) !== ".yaml") {
+    throw new TypeError("mobile ci github --output must be a .yml or .yaml file inside .github/workflows.");
+  }
+  return path;
+};
+var normalizeSecretEnvironment = (values = []) => {
+  const names = [...new Set(values)].sort();
+  for (const name of names) {
+    if (!SECRET_NAME_PATTERN.test(name))
+      throw new TypeError("mobile ci github --secret-env values must be uppercase environment variable names.");
+    if (name.startsWith("GITHUB_") || name.startsWith("RUNNER_") || name.startsWith("ACTIONS_") || RESERVED_SECRET_NAMES.has(name)) {
+      throw new TypeError(`mobile ci github --secret-env cannot replace reserved variable ${name}.`);
+    }
+  }
+  return names;
+};
+var customSecretEnvironment = (names, indentation = CI_ENV_INDENTATION) => names.map((name) => `${" ".repeat(indentation)}${name}: \${{ secrets.${name} }}`).join(`
+`);
+var commandEnvironment2 = (options) => `      ABSOLUTE_CONFIG_PATH: ${yamlString(options.configPath ?? "")}
+      ABSOLUTE_REGISTRY_MODULE: ${yamlString(options.registryModule)}
+      ABSOLUTE_SERVER_ENTRY: ${yamlString(options.serverEntry)}`;
+var appendConfigArgument = `if [[ -n "$ABSOLUTE_CONFIG_PATH" ]]; then
+            args+=(--config "$ABSOLUTE_CONFIG_PATH")
+          fi`;
+var installSteps = `      - name: Check out source
+        uses: actions/checkout@v6
+      - name: Install Bun
+        uses: oven-sh/setup-bun@v2
+      - name: Install exact dependencies
+        run: bun ci`;
+var bundleAuditSteps = `      - name: Prepare production mobile bundle
+        shell: bash
+        run: |
+          args=(bunx absolute prepare "$ABSOLUTE_SERVER_ENTRY" --outdir .absolutejs/mobile-ci/server)
+          ${appendConfigArgument}
+          "\${args[@]}"
+      - name: Run cryptographic mobile bundle audit
+        id: mobile-bundle-audit
+        continue-on-error: true
+        shell: bash
+        run: |
+          mkdir -p .absolutejs/mobile-ci
+          args=(bunx absolute mobile inspect --json --require-bundle)
+          ${appendConfigArgument}
+          "\${args[@]}" > .absolutejs/mobile-ci/inspection.json
+      - name: Upload mobile inspection report
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: absolute-mobile-inspection
+          path: .absolutejs/mobile-ci/inspection.json
+          if-no-files-found: error
+          retention-days: 30
+          include-hidden-files: true
+      - name: Enforce mobile bundle audit
+        if: steps.mobile-bundle-audit.outcome != 'success'
+        run: exit 1`;
+var releaseAuditSteps = (platform3) => `      - name: Run redacted mobile release audit
+        id: mobile-release-audit
+        continue-on-error: true
+        shell: bash
+        run: |
+          mkdir -p .absolutejs/mobile-ci
+          args=(bunx absolute mobile doctor release ${platform3} --json)
+          ${appendConfigArgument}
+          "\${args[@]}" > .absolutejs/mobile-ci/compliance.json
+      - name: Upload mobile compliance report
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: absolute-mobile-compliance-\${{ github.job }}
+          path: .absolutejs/mobile-ci/compliance.json
+          if-no-files-found: error
+          retention-days: 30
+          include-hidden-files: true
+      - name: Enforce mobile release audit
+        if: steps.mobile-release-audit.outcome != 'success'
+        run: exit 1`;
+var platformInput = (platforms) => {
+  const choices = platforms.length === 2 ? ["all", ...platforms] : platforms;
+  return `      platform:
+        description: Native platform to build
+        required: true
+        type: choice
+        default: ${choices[0]}
         options:
 ${choices.map((value) => `          - ${value}`).join(`
 `)}`;
@@ -33192,6 +34182,10 @@ var publishingInputs = (platforms, includePublishing) => {
         description: Source workflow run ID for promotion without rebuilding
         required: false
         type: string`,
+    `      dispatch_id:
+        description: Unique promotion correlation ID supplied by the AbsoluteJS CLI
+        required: false
+        type: string`,
     `      certification_base64:
         description: AbsoluteJS certification supplied by the promotion CLI
         required: false
@@ -33564,6 +34558,10 @@ var promotionValidationSteps = `      - name: Validate promotion handoff
             echo "Promotion requires a numeric source workflow run ID." >&2
             exit 1
           fi
+          if [[ ! "$ABSOLUTE_PROMOTION_DISPATCH_ID" =~ ^amp_[a-f0-9]{32}$ ]]; then
+            echo "Promotion requires a valid AbsoluteJS dispatch correlation ID." >&2
+            exit 1
+          fi
           if [[ -z "$ABSOLUTE_CERTIFICATION_BASE64" ]]; then
             echo "Promotion requires certification supplied by absolute mobile ci promote." >&2
             exit 1
@@ -33575,6 +34573,10 @@ var promotionSharedSteps = (platform3) => `      - name: Restore exact ${platfor
           path: .absolutejs/mobile/releases/${platform3}
           run-id: \${{ inputs.source_run_id }}
           github-token: \${{ github.token }}
+      - name: Record bounded promotion context
+        shell: bash
+        run: |
+          bun -e 'const dispatchId = process.env.ABSOLUTE_PROMOTION_DISPATCH_ID; const sourceRunId = process.env.ABSOLUTE_SOURCE_RUN_ID; const promotionRunId = process.env.GITHUB_RUN_ID; if (!dispatchId?.match(/^amp_[a-f0-9]{32}$/) || !sourceRunId?.match(/^[1-9][0-9]*$/) || !promotionRunId?.match(/^[1-9][0-9]*$/)) throw new Error("Invalid promotion run identity"); await Bun.write(".absolutejs/mobile-ci/promotion-context.json", JSON.stringify({ dispatchId, format: 2, platform: ${JSON.stringify(platform3)}, promotionRunId, sourceArtifact: ${JSON.stringify(`absolute-mobile-${platform3}`)}, sourceRunId }, null, 2) + "\\n");'
       - name: Import and verify exact certification
         shell: bash
         run: |
@@ -33612,7 +34614,9 @@ var androidPromotionJob = (options) => {
       id-token: write
     env:
       ABSOLUTE_CERTIFICATION_BASE64: \${{ inputs.certification_base64 }}
+      ABSOLUTE_PROMOTION_DISPATCH_ID: \${{ inputs.dispatch_id }}
       ABSOLUTE_RELEASE_CHANNEL: \${{ inputs.channel }}
+      ABSOLUTE_SOURCE_RUN_ID: \${{ inputs.source_run_id }}
       ABSOLUTE_PLAY_TRACK: \${{ inputs.play_track }}
       ABSOLUTE_GOOGLE_CREDENTIALS_BASE64: \${{ secrets.ABSOLUTE_GOOGLE_CREDENTIALS_BASE64 }}
       GOOGLE_APPLICATION_CREDENTIALS: \${{ runner.temp }}/absolute-google-credentials.json${custom ? `
@@ -33652,6 +34656,7 @@ ${promotionSharedSteps("android")}
           name: absolute-mobile-android-promotion-\${{ github.run_id }}
           path: |
             .absolutejs/mobile-ci/imported-certification/
+            .absolutejs/mobile-ci/promotion-context.json
             .absolutejs/mobile-ci/promotion-receipt.json
           if-no-files-found: error
           retention-days: 90
@@ -33675,7 +34680,9 @@ var iosPromotionJob = (options) => {
       id-token: write
     env:
       ABSOLUTE_CERTIFICATION_BASE64: \${{ inputs.certification_base64 }}
+      ABSOLUTE_PROMOTION_DISPATCH_ID: \${{ inputs.dispatch_id }}
       ABSOLUTE_RELEASE_CHANNEL: \${{ inputs.channel }}
+      ABSOLUTE_SOURCE_RUN_ID: \${{ inputs.source_run_id }}
       ABSOLUTE_TESTFLIGHT_GROUP: \${{ inputs.testflight_group }}
       ABSOLUTE_TESTFLIGHT_SUBMIT_REVIEW: \${{ inputs.submit_testflight_review }}
       APP_STORE_CONNECT_ISSUER_ID: \${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
@@ -33717,6 +34724,7 @@ ${promotionSharedSteps("ios")}
           name: absolute-mobile-ios-promotion-\${{ github.run_id }}
           path: |
             .absolutejs/mobile-ci/imported-certification/
+            .absolutejs/mobile-ci/promotion-context.json
             .absolutejs/mobile-ci/promotion-receipt.json
           if-no-files-found: error
           retention-days: 90
@@ -33753,9 +34761,9 @@ var createAbsoluteMobileGithubWorkflow = (options) => {
   ].sort();
   const includePublishing = options.includePublishing === true;
   const customSecrets = normalizeSecretEnvironment(options.secretEnvironment);
-  const serverEntry = projectPath(options.projectRoot, options.serverEntry ?? "server.ts", "mobile ci github server entry");
-  const configPath = options.configPath ? projectPath(options.projectRoot, options.configPath, "mobile ci github --config") : undefined;
-  const registryModule = projectPath(options.projectRoot, options.registryModule ?? "mobile.release.ts", "mobile ci github --registry", { allowMissing: !includePublishing });
+  const serverEntry = projectPath2(options.projectRoot, options.serverEntry ?? "server.ts", "mobile ci github server entry");
+  const configPath = options.configPath ? projectPath2(options.projectRoot, options.configPath, "mobile ci github --config") : undefined;
+  const registryModule = projectPath2(options.projectRoot, options.registryModule ?? "mobile.release.ts", "mobile ci github --registry", { allowMissing: !includePublishing });
   const environment = commandEnvironment2({
     configPath,
     registryModule,
@@ -33763,6 +34771,7 @@ var createAbsoluteMobileGithubWorkflow = (options) => {
   });
   let workflow = `# Generated by AbsoluteJS. Regenerate with: absolute mobile ci github${includePublishing ? " --publish" : ""}
 name: AbsoluteJS Mobile
+run-name: \${{ inputs.operation == 'promote' && format('AbsoluteJS mobile promotion [{0}]', inputs.dispatch_id) || format('AbsoluteJS mobile {0}', github.event_name) }}
 
 on:
   pull_request:
@@ -33788,6 +34797,7 @@ jobs:
     env:
 ${environment}${includePublishing ? `
       ABSOLUTE_PROMOTION_PLATFORM: \${{ inputs.platform }}
+      ABSOLUTE_PROMOTION_DISPATCH_ID: \${{ inputs.dispatch_id }}
       ABSOLUTE_SOURCE_RUN_ID: \${{ inputs.source_run_id }}
       ABSOLUTE_CERTIFICATION_BASE64: \${{ inputs.certification_base64 }}` : ""}
     steps:
@@ -33819,12 +34829,12 @@ ${bundleAuditSteps}${platforms.includes("android") ? androidJob({ customSecrets,
 var writeAbsoluteMobileGithubWorkflow = async (options) => {
   const path = workflowOutputPath(options.projectRoot, options.outputPath);
   const generated = createAbsoluteMobileGithubWorkflow(options);
-  const previous = await exists8(path) ? await readFile20(path, "utf8") : undefined;
+  const previous = await exists9(path) ? await readFile23(path, "utf8") : undefined;
   if (previous !== undefined && previous !== generated.workflow && !options.force)
-    throw new TypeError(`${relative15(options.projectRoot, path)} already exists and differs. Rerun with --force to replace the generated workflow.`);
+    throw new TypeError(`${relative18(options.projectRoot, path)} already exists and differs. Rerun with --force to replace the generated workflow.`);
   if (previous !== generated.workflow) {
-    await mkdir16(dirname15(path), { recursive: true });
-    await writeFile16(path, generated.workflow);
+    await mkdir19(dirname17(path), { recursive: true });
+    await writeFile19(path, generated.workflow);
   }
   return {
     changed: previous !== generated.workflow,
@@ -33842,20 +34852,20 @@ init_materializedBundle();
 init_mobilePreview();
 
 // src/mobile/nativeDeepLinks.ts
-import { readFile as readFile21, rename as rename13, writeFile as writeFile17 } from "fs/promises";
-import { join as join25 } from "path";
+import { readFile as readFile24, rename as rename15, writeFile as writeFile20 } from "fs/promises";
+import { join as join27 } from "path";
 var START_MARKER = "<!-- absolutejs:deep-links:start -->";
 var END_MARKER = "<!-- absolutejs:deep-links:end -->";
 var IOS_ENTITLEMENTS = "App/AbsoluteJS.entitlements";
 var NOT_FOUND = -1;
 var escapeXml = (value) => value.replaceAll("&", "&amp;").replaceAll('"', "&quot;").replaceAll("'", "&apos;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
 var writeChangedFile = async (path, source) => {
-  const current = await readFile21(path, "utf8");
+  const current = await readFile24(path, "utf8");
   if (current === source)
     return false;
   const temporary = `${path}.${crypto.randomUUID()}.tmp`;
-  await writeFile17(temporary, source, { flag: "wx" });
-  await rename13(temporary, path);
+  await writeFile20(temporary, source, { flag: "wx" });
+  await rename15(temporary, path);
   return true;
 };
 var replaceManagedRegion = (source, region, insertAt) => {
@@ -33900,8 +34910,8 @@ ${hosts}
 `;
 };
 var configureAndroid = async (config) => {
-  const path = join25(config.nativeProjectDirectory, "android/app/src/main/AndroidManifest.xml");
-  const source = await readFile21(path, "utf8");
+  const path = join27(config.nativeProjectDirectory, "android/app/src/main/AndroidManifest.xml");
+  const source = await readFile24(path, "utf8");
   const mainActivity = source.indexOf('android:name=".MainActivity"');
   if (mainActivity === NOT_FOUND) {
     throw new TypeError("Android MainActivity was not found.");
@@ -33926,8 +34936,8 @@ var iosSchemeRegion = (scheme) => `	${START_MARKER}
 	${END_MARKER}
 `;
 var configureIosInfo = async (config) => {
-  const path = join25(config.nativeProjectDirectory, "ios/App/App/Info.plist");
-  const source = await readFile21(path, "utf8");
+  const path = join27(config.nativeProjectDirectory, "ios/App/App/Info.plist");
+  const source = await readFile24(path, "utf8");
   const region = config.deepLinkScheme ? iosSchemeRegion(config.deepLinkScheme) : `	${START_MARKER}
 	${END_MARKER}
 `;
@@ -33950,10 +34960,10 @@ ${domains}
 `;
 };
 var configureIosEntitlements = async (config) => {
-  const path = join25(config.nativeProjectDirectory, "ios/App/AbsoluteJS.entitlements");
+  const path = join27(config.nativeProjectDirectory, "ios/App/AbsoluteJS.entitlements");
   let current = "";
   try {
-    current = await readFile21(path, "utf8");
+    current = await readFile24(path, "utf8");
   } catch (error) {
     if (!(error instanceof Error) || !("code" in error) || error.code !== "ENOENT") {
       throw error;
@@ -33963,13 +34973,13 @@ var configureIosEntitlements = async (config) => {
   if (current === source)
     return false;
   const temporary = `${path}.${crypto.randomUUID()}.tmp`;
-  await writeFile17(temporary, source, { flag: "wx" });
-  await rename13(temporary, path);
+  await writeFile20(temporary, source, { flag: "wx" });
+  await rename15(temporary, path);
   return true;
 };
 var configureIosProject = async (config) => {
-  const path = join25(config.nativeProjectDirectory, "ios/App/App.xcodeproj/project.pbxproj");
-  const source = await readFile21(path, "utf8");
+  const path = join27(config.nativeProjectDirectory, "ios/App/App.xcodeproj/project.pbxproj");
+  const source = await readFile24(path, "utf8");
   const declarations = [
     ...source.matchAll(/CODE_SIGN_ENTITLEMENTS = ([^;]+);/g)
   ].map((match) => match[1]);
@@ -34008,8 +35018,8 @@ var applyAbsoluteNativeDeepLinks = async (config, platforms = config.platforms)
 };
 // src/mobile/nativeDeviceCapabilities.ts
 init_deviceCapabilities();
-import { readFile as readFile22, rename as rename14, writeFile as writeFile18 } from "fs/promises";
-import { join as join26 } from "path";
+import { readFile as readFile25, rename as rename16, writeFile as writeFile21 } from "fs/promises";
+import { join as join28 } from "path";
 var START_MARKER2 = "<!-- absolutejs:device-capabilities:start -->";
 var END_MARKER2 = "<!-- absolutejs:device-capabilities:end -->";
 var NOT_FOUND2 = -1;
@@ -34019,12 +35029,12 @@ var PUSH_START_MARKER = "absolutejs:push-notifications:start";
 var PUSH_END_MARKER = "absolutejs:push-notifications:end";
 var escapeXml2 = (value) => value.replaceAll("&", "&amp;").replaceAll('"', "&quot;").replaceAll("'", "&apos;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
 var writeChangedFile2 = async (path, source) => {
-  const current = await readFile22(path, "utf8");
+  const current = await readFile25(path, "utf8");
   if (current === source)
     return false;
   const temporary = `${path}.${crypto.randomUUID()}.tmp`;
-  await writeFile18(temporary, source, { flag: "wx" });
-  await rename14(temporary, path);
+  await writeFile21(temporary, source, { flag: "wx" });
+  await rename16(temporary, path);
   return true;
 };
 var writeOptionalChangedFile = async (path, source) => {
@@ -34032,14 +35042,14 @@ var writeOptionalChangedFile = async (path, source) => {
   if (current === source)
     return false;
   if (current === null) {
-    await writeFile18(path, source, { flag: "wx" });
+    await writeFile21(path, source, { flag: "wx" });
     return true;
   }
   return writeChangedFile2(path, source);
 };
 var optionalSource = async (path) => {
   try {
-    return await readFile22(path, "utf8");
+    return await readFile25(path, "utf8");
   } catch (error) {
     if (typeof error === "object" && error !== null && Reflect.get(error, "code") === "ENOENT")
       return null;
@@ -34153,15 +35163,15 @@ var writeIosPrivacyManifest = async (path, current, source) => {
     return false;
   if (current !== null)
     return writeChangedFile2(path, source);
-  await writeFile18(path, source, { flag: "wx" });
+  await writeFile21(path, source, { flag: "wx" });
   return true;
 };
 var configureIosPrivacyProject = async (config, requirements) => {
   if (requirements.iosPrivacyAccessedApis.length === 0)
     return false;
-  const projectPath2 = join26(config.nativeProjectDirectory, "ios/App/App.xcodeproj/project.pbxproj");
-  const project = await readFile22(projectPath2, "utf8");
-  return writeChangedFile2(projectPath2, addIosPrivacyProjectReference(project));
+  const projectPath3 = join28(config.nativeProjectDirectory, "ios/App/App.xcodeproj/project.pbxproj");
+  const project = await readFile25(projectPath3, "utf8");
+  return writeChangedFile2(projectPath3, addIosPrivacyProjectReference(project));
 };
 var addIosPrivacyProjectReference = (source) => {
   const fileMatch = source.match(/([A-F0-9]{24}) \/\* PrivacyInfo\.xcprivacy \*\/ = \{isa = PBXFileReference;/u);
@@ -34212,8 +35222,8 @@ ${next.slice(index)}`;
   return next;
 };
 var configureIos2 = async (config, plan) => {
-  const path = join26(config.nativeProjectDirectory, "ios/App/App/Info.plist");
-  const source = await readFile22(path, "utf8");
+  const path = join28(config.nativeProjectDirectory, "ios/App/App/Info.plist");
+  const source = await readFile25(path, "utf8");
   const requirements = absoluteDeviceNativeRequirements(plan);
   const existingSystemBars = source.match(/<key>UIViewControllerBasedStatusBarAppearance<\/key>\s*<(true|false)\s*\/>/u);
   const ownedStart = source.indexOf(START_MARKER2);
@@ -34233,7 +35243,7 @@ ${content}
 	${END_MARKER2}
 ` : "";
   const infoChanged = await writeChangedFile2(path, managed(source, region, source.lastIndexOf("</dict>")));
-  const privacyPath = join26(config.nativeProjectDirectory, "ios/App/App/PrivacyInfo.xcprivacy");
+  const privacyPath = join28(config.nativeProjectDirectory, "ios/App/App/PrivacyInfo.xcprivacy");
   const privacyCurrent = await optionalSource(privacyPath);
   const privacySource = privacyManifestSource(privacyCurrent, requirements);
   const [privacyChanged, projectChanged, pushChanged] = await Promise.all([
@@ -34244,7 +35254,7 @@ ${content}
   return infoChanged || privacyChanged || projectChanged || pushChanged;
 };
 var configureIosPushNotifications = async (config, enabled) => {
-  const entitlementsPath = join26(config.nativeProjectDirectory, "ios/App/AbsoluteJS.entitlements");
+  const entitlementsPath = join28(config.nativeProjectDirectory, "ios/App/AbsoluteJS.entitlements");
   const entitlements = await optionalSource(entitlementsPath);
   if (entitlements === null && !enabled)
     return false;
@@ -34256,7 +35266,7 @@ var configureIosPushNotifications = async (config, enabled) => {
 	<!-- ${PUSH_END_MARKER} -->
 ` : "";
   const nextEntitlements = replacePushRegion(entitlements, entitlementRegion, entitlements.lastIndexOf("</dict>"));
-  const delegatePath = join26(config.nativeProjectDirectory, "ios/App/App/AppDelegate.swift");
+  const delegatePath = join28(config.nativeProjectDirectory, "ios/App/App/AppDelegate.swift");
   const delegate = await optionalSource(delegatePath);
   if (delegate === null && !enabled)
     return false;
@@ -34305,8 +35315,8 @@ var replacePushRegion = (source, region, insertion) => {
   return `${source.slice(0, insertion)}${region}${source.slice(insertion)}`;
 };
 var configureAndroid2 = async (config, plan) => {
-  const path = join26(config.nativeProjectDirectory, "android/app/src/main/AndroidManifest.xml");
-  const source = await readFile22(path, "utf8");
+  const path = join28(config.nativeProjectDirectory, "android/app/src/main/AndroidManifest.xml");
+  const source = await readFile25(path, "utf8");
   const permissions = absoluteDeviceNativeRequirements(plan).androidPermissions;
   const content = permissions.map((permission) => `    <uses-permission android:name="${escapeXml2(permission)}" />`).join(`
 `);
@@ -34341,7 +35351,7 @@ ${content}
     throw new TypeError(`Android google-services.json does not contain package ${config.appId}.`);
   const [manifestChanged, firebaseChanged] = await Promise.all([
     writeChangedFile2(path, nextManifest),
-    writeOptionalChangedFile(join26(config.nativeProjectDirectory, "android/app/google-services.json"), firebaseSource)
+    writeOptionalChangedFile(join28(config.nativeProjectDirectory, "android/app/google-services.json"), firebaseSource)
   ]);
   return manifestChanged || firebaseChanged;
 };
@@ -34360,14 +35370,14 @@ init_nativeAuth();
 
 // src/mobile/nativeUpdates.ts
 import {
-  mkdir as mkdir17,
-  readFile as readFile23,
-  readdir as readdir7,
-  rename as rename15,
-  rm as rm13,
-  writeFile as writeFile19
+  mkdir as mkdir20,
+  readFile as readFile26,
+  readdir as readdir8,
+  rename as rename17,
+  rm as rm15,
+  writeFile as writeFile22
 } from "fs/promises";
-import { dirname as dirname17, join as join27 } from "path";
+import { dirname as dirname19, join as join29 } from "path";
 var START = "// absolutejs:mobile-updates:start";
 var END = "// absolutejs:mobile-updates:end";
 var PLUGIN_START = "// absolutejs:mobile-update-plugin:start";
@@ -34375,32 +35385,32 @@ var PLUGIN_END = "// absolutejs:mobile-update-plugin:end";
 var ANDROID_PLUGIN = "AbsoluteMobileUpdateWatchdogPlugin.java";
 var optionalSource2 = async (path) => {
   try {
-    return await readFile23(path, "utf8");
+    return await readFile26(path, "utf8");
   } catch (error) {
     if (typeof error === "object" && error !== null && Reflect.get(error, "code") === "ENOENT")
       return null;
     throw error;
   }
 };
-var isRecord12 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isRecord15 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var writeChanged = async (path, source) => {
   const current = await optionalSource2(path);
   if (current === source)
     return false;
-  await mkdir17(dirname17(path), { recursive: true });
+  await mkdir20(dirname19(path), { recursive: true });
   if (current === null) {
-    await writeFile19(path, source, { flag: "wx" });
+    await writeFile22(path, source, { flag: "wx" });
     return true;
   }
   const temporary = `${path}.${crypto.randomUUID()}.tmp`;
-  await writeFile19(temporary, source, { flag: "wx" });
-  await rename15(temporary, path);
+  await writeFile22(temporary, source, { flag: "wx" });
+  await rename17(temporary, path);
   return true;
 };
 var removeOwnedFile = async (path) => {
   if (await optionalSource2(path) === null)
     return false;
-  await rm13(path);
+  await rm15(path);
   return true;
 };
 var replaceMarkedRegion = (source, start, end, region, insertion, error) => {
@@ -34537,9 +35547,9 @@ public final class AbsoluteMobileUpdateWatchdogPlugin: CAPPlugin, CAPBridgedPlug
 ${PLUGIN_END}
 `;
 var configureIos3 = async (config, enabled) => {
-  const path = join27(config.nativeProjectDirectory, "ios/App/App/AppDelegate.swift");
-  const capacitorConfigPath = join27(config.nativeProjectDirectory, "ios/App/App/capacitor.config.json");
-  let source = await readFile23(path, "utf8");
+  const path = join29(config.nativeProjectDirectory, "ios/App/App/AppDelegate.swift");
+  const capacitorConfigPath = join29(config.nativeProjectDirectory, "ios/App/App/capacitor.config.json");
+  let source = await readFile26(path, "utf8");
   const launch2 = source.indexOf("didFinishLaunchingWithOptions");
   const brace = launch2 < 0 ? -1 : source.indexOf("{", launch2);
   const launchRegion = enabled ? `        ${START}
@@ -34550,11 +35560,11 @@ var configureIos3 = async (config, enabled) => {
 `, brace) + 1, "Could not find a safe iOS location for mobile update recovery.");
   const plugin = enabled ? iosPluginRegion(config.updates?.bootTimeoutMs ?? 20000) : "";
   source = replaceMarkedRegion(source, PLUGIN_START, PLUGIN_END, plugin, source.length, "Could not find a safe iOS location for the mobile update watchdog.");
-  const capacitorConfigSource2 = await readFile23(capacitorConfigPath, "utf8");
+  const capacitorConfigSource2 = await readFile26(capacitorConfigPath, "utf8");
   let capacitorConfig;
   try {
     const value = JSON.parse(capacitorConfigSource2);
-    if (!isRecord12(value))
+    if (!isRecord15(value))
       throw new TypeError;
     capacitorConfig = value;
   } catch {
@@ -34723,19 +35733,19 @@ public final class AbsoluteMobileUpdateWatchdogPlugin extends Plugin {
 var androidActivityInRoot = async (root) => {
   let entries;
   try {
-    entries = await readdir7(root, { recursive: true });
+    entries = await readdir8(root, { recursive: true });
   } catch (error) {
     if (typeof error === "object" && error !== null && Reflect.get(error, "code") === "ENOENT")
       return;
     throw error;
   }
   const candidate = entries.find((entry) => entry.endsWith("/MainActivity.java") || entry.endsWith("/MainActivity.kt") || entry === "MainActivity.java" || entry === "MainActivity.kt");
-  return candidate ? join27(root, candidate) : undefined;
+  return candidate ? join29(root, candidate) : undefined;
 };
 var androidActivity = async (config) => {
   const roots = [
-    join27(config.nativeProjectDirectory, "android/app/src/main/java"),
-    join27(config.nativeProjectDirectory, "android/app/src/main/kotlin")
+    join29(config.nativeProjectDirectory, "android/app/src/main/java"),
+    join29(config.nativeProjectDirectory, "android/app/src/main/kotlin")
   ];
   const candidates = await Promise.all(roots.map(androidActivityInRoot));
   const candidate = candidates.find((value) => value !== undefined);
@@ -34834,12 +35844,12 @@ var injectAndroidActivity = (source, enabled) => {
 };
 var configureAndroid3 = async (config, enabled) => {
   const activityPath = await androidActivity(config);
-  const activity = await readFile23(activityPath, "utf8");
+  const activity = await readFile26(activityPath, "utf8");
   const packageName = activity.match(/^\s*package\s+([A-Za-z0-9_.]+)\s*[;\n]/mu)?.[1];
   if (!packageName)
     throw new TypeError("Android MainActivity package declaration was not found.");
   const packagePath = packageName.replaceAll(".", "/");
-  const pluginPath = join27(config.nativeProjectDirectory, "android/app/src/main/java", packagePath, ANDROID_PLUGIN);
+  const pluginPath = join29(config.nativeProjectDirectory, "android/app/src/main/java", packagePath, ANDROID_PLUGIN);
   const changed = await Promise.all([
     writeChanged(activityPath, injectAndroidActivity(activity, enabled)),
     enabled ? writeChanged(pluginPath, androidPluginSource(packageName, config.updates?.bootTimeoutMs ?? 20000)) : removeOwnedFile(pluginPath)
@@ -34859,14 +35869,14 @@ var applyAbsoluteNativeUpdates = async (config, platforms = config.platforms) =>
 };
 // src/mobile/nativeObservability.ts
 import {
-  mkdir as mkdir18,
-  readFile as readFile24,
-  readdir as readdir8,
-  rename as rename16,
-  rm as rm14,
-  writeFile as writeFile20
+  mkdir as mkdir21,
+  readFile as readFile27,
+  readdir as readdir9,
+  rename as rename18,
+  rm as rm16,
+  writeFile as writeFile23
 } from "fs/promises";
-import { dirname as dirname18, join as join28 } from "path";
+import { dirname as dirname20, join as join30 } from "path";
 var START2 = "// absolutejs:native-observability:start";
 var END2 = "// absolutejs:native-observability:end";
 var PLUGIN_START2 = "// absolutejs:native-observability-plugin:start";
@@ -34874,7 +35884,7 @@ var PLUGIN_END2 = "// absolutejs:native-observability-plugin:end";
 var ANDROID_PLUGIN2 = "AbsoluteMobileObservabilityPlugin.java";
 var optionalSource3 = async (path) => {
   try {
-    return await readFile24(path, "utf8");
+    return await readFile27(path, "utf8");
   } catch (error) {
     if (typeof error === "object" && error !== null && Reflect.get(error, "code") === "ENOENT")
       return null;
@@ -34885,23 +35895,23 @@ var writeChanged2 = async (path, source) => {
   const current = await optionalSource3(path);
   if (current === source)
     return false;
-  await mkdir18(dirname18(path), { recursive: true });
+  await mkdir21(dirname20(path), { recursive: true });
   if (current === null) {
-    await writeFile20(path, source, { flag: "wx" });
+    await writeFile23(path, source, { flag: "wx" });
     return true;
   }
   const temporary = `${path}.${crypto.randomUUID()}.tmp`;
-  await writeFile20(temporary, source, { flag: "wx" });
-  await rename16(temporary, path);
+  await writeFile23(temporary, source, { flag: "wx" });
+  await rename18(temporary, path);
   return true;
 };
 var removeOwnedFile2 = async (path) => {
   if (await optionalSource3(path) === null)
     return false;
-  await rm14(path);
+  await rm16(path);
   return true;
 };
-var isRecord13 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isRecord16 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var replaceMarkedRegion2 = (source, start, end, region, insertion, error) => {
   const existingStart = source.indexOf(start);
   const existingEnd = source.indexOf(end);
@@ -35034,9 +36044,9 @@ public final class AbsoluteMobileObservabilityPlugin: CAPPlugin, CAPBridgedPlugi
 ${PLUGIN_END2}
 `;
 var configureIos4 = async (config, enabled) => {
-  const path = join28(config.nativeProjectDirectory, "ios/App/App/AppDelegate.swift");
-  const capacitorConfigPath = join28(config.nativeProjectDirectory, "ios/App/App/capacitor.config.json");
-  let source = await readFile24(path, "utf8");
+  const path = join30(config.nativeProjectDirectory, "ios/App/App/AppDelegate.swift");
+  const capacitorConfigPath = join30(config.nativeProjectDirectory, "ios/App/App/capacitor.config.json");
+  let source = await readFile27(path, "utf8");
   if (enabled && !source.includes("import MetricKit")) {
     const capacitorImport = source.lastIndexOf("import Capacitor");
     if (capacitorImport < 0)
@@ -35050,11 +36060,11 @@ ${source.slice(newline + 1)}`;
     source = source.replace(`import MetricKit
 `, "");
   source = replaceMarkedRegion2(source, PLUGIN_START2, PLUGIN_END2, enabled ? iosPluginRegion2 : "", source.length, "Could not find a safe iOS location for native observability.");
-  const capacitorConfigSource2 = await readFile24(capacitorConfigPath, "utf8");
+  const capacitorConfigSource2 = await readFile27(capacitorConfigPath, "utf8");
   let capacitorConfig;
   try {
     const value = JSON.parse(capacitorConfigSource2);
-    if (!isRecord13(value))
+    if (!isRecord16(value))
       throw new TypeError;
     capacitorConfig = value;
   } catch {
@@ -35288,19 +36298,19 @@ public final class AbsoluteMobileObservabilityPlugin extends Plugin {
 var androidActivityInRoot2 = async (root) => {
   let entries;
   try {
-    entries = await readdir8(root, { recursive: true });
+    entries = await readdir9(root, { recursive: true });
   } catch (error) {
     if (typeof error === "object" && error !== null && Reflect.get(error, "code") === "ENOENT")
       return;
     throw error;
   }
   const candidate = entries.find((entry) => entry.endsWith("/MainActivity.java") || entry.endsWith("/MainActivity.kt") || entry === "MainActivity.java" || entry === "MainActivity.kt");
-  return candidate ? join28(root, candidate) : undefined;
+  return candidate ? join30(root, candidate) : undefined;
 };
 var androidActivity2 = async (config) => {
   const roots = [
-    join28(config.nativeProjectDirectory, "android/app/src/main/java"),
-    join28(config.nativeProjectDirectory, "android/app/src/main/kotlin")
+    join30(config.nativeProjectDirectory, "android/app/src/main/java"),
+    join30(config.nativeProjectDirectory, "android/app/src/main/kotlin")
   ];
   const candidates = await Promise.all(roots.map(androidActivityInRoot2));
   const candidate = candidates.find((value) => value !== undefined);
@@ -35349,148 +36359,14 @@ var injectAndroidActivity2 = (source, enabled) => {
       return `${source.slice(0, from)}${source.slice(through)}`;
     return `${source.slice(0, from)}${androidRegion2(kotlin, generatedMethod)}${source.slice(through)}`;
   }
-  if (!enabled)
-    return source;
-  const onCreate = kotlin ? source.search(/\boverride\s+fun\s+onCreate\s*\([^)]*\)\s*\{/u) : source.search(/\b(?:public|protected)\s+void\s+onCreate\s*\([^)]*\)\s*\{/u);
-  if (onCreate >= 0) {
-    const brace = source.indexOf("{", onCreate);
-    const insert = source.indexOf(`
-`, brace) + 1;
-    return `${source.slice(0, insert)}${androidRegion2(kotlin, false)}${source.slice(insert)}`;
-  }
-  const close = source.lastIndexOf("}");
-  if (close < 0)
-    throw new TypeError("Could not find the Android MainActivity class body.");
-  const separator = source[close - 1] === `
-` ? "" : `
-`;
-  return `${source.slice(0, close)}${separator}${androidRegion2(kotlin, true)}${source.slice(close)}`;
-};
-var configureAndroid4 = async (config, enabled) => {
-  const activityPath = await androidActivity2(config);
-  const activity = await readFile24(activityPath, "utf8");
-  const packageName = activity.match(/^\s*package\s+([A-Za-z0-9_.]+)\s*[;\n]/mu)?.[1];
-  if (!packageName)
-    throw new TypeError("Android MainActivity package declaration was not found.");
-  const pluginPath = join28(config.nativeProjectDirectory, "android/app/src/main/java", packageName.replaceAll(".", "/"), ANDROID_PLUGIN2);
-  const changed = await Promise.all([
-    writeChanged2(activityPath, injectAndroidActivity2(activity, enabled)),
-    enabled ? writeChanged2(pluginPath, androidPluginSource2(packageName)) : removeOwnedFile2(pluginPath)
-  ]);
-  return changed.some(Boolean);
-};
-var applyAbsoluteNativeObservability = async (config, platforms = config.platforms) => {
-  if (config.engine !== "capacitor")
-    return { changed: false };
-  const enabled = config.observability !== undefined;
-  const changed = [];
-  if (platforms.includes("ios"))
-    changed.push(await configureIos4(config, enabled));
-  if (platforms.includes("android"))
-    changed.push(await configureAndroid4(config, enabled));
-  return { changed: changed.some(Boolean) };
-};
-// src/mobile/nativeReleaseReadiness.ts
-import { mkdir as mkdir19, readFile as readFile25, readdir as readdir9, rename as rename17, writeFile as writeFile21 } from "fs/promises";
-import { dirname as dirname19, join as join29 } from "path";
-var START3 = "// absolutejs:release-readiness:start";
-var END3 = "// absolutejs:release-readiness:end";
-var IOS_PLUGIN_START = "// absolutejs:release-readiness-plugin:start";
-var IOS_PLUGIN_END = "// absolutejs:release-readiness-plugin:end";
-var ANDROID_PLUGIN3 = "AbsoluteReleaseReadinessPlugin.java";
-var optionalSource4 = async (path) => {
-  try {
-    return await readFile25(path, "utf8");
-  } catch (error) {
-    if (typeof error === "object" && error !== null && Reflect.get(error, "code") === "ENOENT")
-      return null;
-    throw error;
-  }
-};
-var writeChanged3 = async (path, source) => {
-  const current = await optionalSource4(path);
-  if (current === source)
-    return false;
-  await mkdir19(dirname19(path), { recursive: true });
-  if (current === null) {
-    await writeFile21(path, source, { flag: "wx" });
-    return true;
-  }
-  const temporary = `${path}.${crypto.randomUUID()}.tmp`;
-  await writeFile21(temporary, source, { flag: "wx" });
-  await rename17(temporary, path);
-  return true;
-};
-var activityInRoot = async (root) => {
-  let entries;
-  try {
-    entries = await readdir9(root, { recursive: true });
-  } catch (error) {
-    if (typeof error === "object" && error !== null && Reflect.get(error, "code") === "ENOENT")
-      return;
-    throw error;
-  }
-  const candidate = entries.find((entry) => entry.endsWith("/MainActivity.java") || entry.endsWith("/MainActivity.kt") || entry === "MainActivity.java" || entry === "MainActivity.kt");
-  return candidate ? join29(root, candidate) : undefined;
-};
-var activityPath = async (config) => {
-  const roots = [
-    join29(config.nativeProjectDirectory, "android/app/src/main/java"),
-    join29(config.nativeProjectDirectory, "android/app/src/main/kotlin")
-  ];
-  const candidates = await Promise.all(roots.map(activityInRoot));
-  const candidate = candidates.find((value) => value !== undefined);
-  if (candidate)
-    return candidate;
-  throw new TypeError("Android MainActivity.java or MainActivity.kt was not found.");
-};
-var registrationRegion = (kotlin, generatedMethod) => {
-  if (generatedMethod)
-    return kotlin ? `    ${START3}
-    override fun onCreate(savedInstanceState: android.os.Bundle?) {
-        registerPlugin(AbsoluteReleaseReadinessPlugin::class.java)
-        super.onCreate(savedInstanceState)
-    }
-    ${END3}
-` : `    ${START3}
-    @Override
-    public void onCreate(android.os.Bundle savedInstanceState) {
-        registerPlugin(AbsoluteReleaseReadinessPlugin.class);
-        super.onCreate(savedInstanceState);
-    }
-    ${END3}
-`;
-  return kotlin ? `        ${START3}
-        registerPlugin(AbsoluteReleaseReadinessPlugin::class.java)
-        ${END3}
-` : `        ${START3}
-        registerPlugin(AbsoluteReleaseReadinessPlugin.class);
-        ${END3}
-`;
-};
-var injectRegistration = (source) => {
-  const kotlin = /\bfun\s+onCreate\s*\(/u.test(source) || source.includes("BridgeActivity()");
-  const existingStart = source.indexOf(START3);
-  const existingEnd = source.indexOf(END3);
-  if (existingStart < 0 !== existingEnd < 0 || existingStart >= 0 && existingEnd < existingStart)
-    throw new TypeError("AbsoluteJS release-readiness markers are malformed.");
-  if (existingStart >= 0) {
-    const from = source.lastIndexOf(`
-`, existingStart) + 1;
-    const newline = source.indexOf(`
-`, existingEnd + END3.length);
-    const through = newline < 0 ? source.length : newline + 1;
-    const generatedMethod = source.slice(from, through).includes("onCreate(");
-    return `${source.slice(0, from)}${registrationRegion(kotlin, generatedMethod)}${source.slice(through)}`;
-  }
+  if (!enabled)
+    return source;
   const onCreate = kotlin ? source.search(/\boverride\s+fun\s+onCreate\s*\([^)]*\)\s*\{/u) : source.search(/\b(?:public|protected)\s+void\s+onCreate\s*\([^)]*\)\s*\{/u);
   if (onCreate >= 0) {
     const brace = source.indexOf("{", onCreate);
     const insert = source.indexOf(`
 `, brace) + 1;
-    if (insert <= 0)
-      throw new TypeError("Could not inject Android release readiness into MainActivity.");
-    return `${source.slice(0, insert)}${registrationRegion(kotlin, false)}${source.slice(insert)}`;
+    return `${source.slice(0, insert)}${androidRegion2(kotlin, false)}${source.slice(insert)}`;
   }
   const close = source.lastIndexOf("}");
   if (close < 0)
@@ -35498,633 +36374,254 @@ var injectRegistration = (source) => {
   const separator = source[close - 1] === `
 ` ? "" : `
 `;
-  return `${source.slice(0, close)}${separator}${registrationRegion(kotlin, true)}${source.slice(close)}`;
-};
-var pluginSource = (packageName) => `package ${packageName};
-
-import android.util.Log;
-import com.getcapacitor.JSObject;
-import com.getcapacitor.Plugin;
-import com.getcapacitor.PluginCall;
-import com.getcapacitor.PluginMethod;
-import com.getcapacitor.annotation.CapacitorPlugin;
-
-@CapacitorPlugin(name = "AbsoluteReleaseReadiness")
-public final class AbsoluteReleaseReadinessPlugin extends Plugin {
-    @PluginMethod
-    public void ready(PluginCall call) {
-        Log.i("AbsoluteJS", "Capacitor embedded web content ready");
-        call.resolve(new JSObject().put("ready", true));
-    }
-}
-`;
-var iosPluginRegion3 = `${IOS_PLUGIN_START}
-@objc(AbsoluteReleaseReadinessPlugin)
-public final class AbsoluteReleaseReadinessPlugin: CAPPlugin, CAPBridgedPlugin {
-    public let identifier = "AbsoluteReleaseReadinessPlugin"
-    public let jsName = "AbsoluteReleaseReadiness"
-    public let pluginMethods: [CAPPluginMethod] = [
-        CAPPluginMethod(name: "ready", returnType: CAPPluginReturnPromise)
-    ]
-
-    @objc public func ready(_ call: CAPPluginCall) {
-		let info = Bundle.main.infoDictionary ?? [:]
-		let version = info["CFBundleShortVersionString"] as? String ?? "unknown"
-		let build = info["CFBundleVersion"] as? String ?? "unknown"
-		NSLog("AbsoluteJS: Capacitor embedded web content ready; version=%@; build=%@", version, build)
-        call.resolve(["ready": true])
-    }
-}
-${IOS_PLUGIN_END}
-`;
-var replaceIosPluginRegion = (appDelegate, existingStart, existingEnd) => {
-  const from = appDelegate.lastIndexOf(`
-`, existingStart) + 1;
-  const newline = appDelegate.indexOf(`
-`, existingEnd + IOS_PLUGIN_END.length);
-  const through = newline < 0 ? appDelegate.length : newline + 1;
-  return `${appDelegate.slice(0, from)}${iosPluginRegion3}${appDelegate.slice(through)}`;
-};
-var configureIos5 = async (config) => {
-  const appDelegatePath = join29(config.nativeProjectDirectory, "ios/App/App/AppDelegate.swift");
-  const capacitorConfigPath = join29(config.nativeProjectDirectory, "ios/App/App/capacitor.config.json");
-  const appDelegate = await readFile25(appDelegatePath, "utf8");
-  const existingStart = appDelegate.indexOf(IOS_PLUGIN_START);
-  const existingEnd = appDelegate.indexOf(IOS_PLUGIN_END);
-  if (existingStart < 0 !== existingEnd < 0 || existingStart >= 0 && existingEnd < existingStart)
-    throw new TypeError("AbsoluteJS iOS release-readiness markers are malformed.");
-  const source = existingStart < 0 ? `${appDelegate.trimEnd()}
-
-${iosPluginRegion3}` : replaceIosPluginRegion(appDelegate, existingStart, existingEnd);
-  let capacitorConfig;
-  try {
-    capacitorConfig = JSON.parse(await readFile25(capacitorConfigPath, "utf8"));
-  } catch {
-    throw new TypeError("iOS capacitor.config.json is invalid; run Capacitor sync before projecting release readiness.");
-  }
-  if (typeof capacitorConfig !== "object" || capacitorConfig === null)
-    throw new TypeError("iOS capacitor.config.json must contain an object.");
-  const packageClassList = Reflect.get(capacitorConfig, "packageClassList");
-  if (!Array.isArray(packageClassList))
-    throw new TypeError("iOS capacitor.config.json has no packageClassList; run Capacitor sync before projecting release readiness.");
-  const classes = packageClassList.filter((value) => typeof value === "string");
-  const nextConfig = `${JSON.stringify({
-    ...capacitorConfig,
-    packageClassList: [
-      ...new Set([...classes, "AbsoluteReleaseReadinessPlugin"])
-    ]
-  }, null, "\t")}
-`;
-  const changed = await Promise.all([
-    writeChanged3(appDelegatePath, source),
-    writeChanged3(capacitorConfigPath, nextConfig)
-  ]);
-  return changed.some(Boolean);
+  return `${source.slice(0, close)}${separator}${androidRegion2(kotlin, true)}${source.slice(close)}`;
 };
-var configureAndroid5 = async (config) => {
-  const mainActivityPath = await activityPath(config);
-  const activity = await readFile25(mainActivityPath, "utf8");
+var configureAndroid4 = async (config, enabled) => {
+  const activityPath = await androidActivity2(config);
+  const activity = await readFile27(activityPath, "utf8");
   const packageName = activity.match(/^\s*package\s+([A-Za-z0-9_.]+)\s*[;\n]/mu)?.[1];
-  if (!packageName)
-    throw new TypeError("Android MainActivity package declaration was not found.");
-  const pluginPath = join29(config.nativeProjectDirectory, "android/app/src/main/java", packageName.replaceAll(".", "/"), ANDROID_PLUGIN3);
-  const changed = await Promise.all([
-    writeChanged3(mainActivityPath, injectRegistration(activity)),
-    writeChanged3(pluginPath, pluginSource(packageName))
-  ]);
-  return changed.some(Boolean);
-};
-var applyAbsoluteNativeReleaseReadiness = async (config, platforms = config.platforms) => {
-  if (config.engine !== "capacitor")
-    return { changed: false };
-  const changed = await Promise.all([
-    platforms.includes("android") ? configureAndroid5(config) : false,
-    platforms.includes("ios") ? configureIos5(config) : false
-  ]);
-  return { changed: changed.some(Boolean) };
-};
-
-// src/mobile/index.ts
-init_pageProtocol();
-init_producerContext();
-init_releaseArtifact();
-
-// src/mobile/releaseCertification.ts
-import { createHash as createHash16 } from "crypto";
-import {
-  access as access17,
-  mkdir as mkdir20,
-  mkdtemp as mkdtemp10,
-  readFile as readFile26,
-  rename as rename18,
-  rm as rm15,
-  writeFile as writeFile22
-} from "fs/promises";
-import { basename as basename8, isAbsolute as isAbsolute9, join as join30, relative as relative16, resolve as resolve18, sep as sep11 } from "path";
-var ABSOLUTE_MOBILE_RELEASE_CERTIFICATION_FORMAT = 1;
-var CERTIFICATION_PREFIX = "amobile_cert_";
-var SHA256 = /^[a-f0-9]{64}$/u;
-var STRENGTH_RANK = {
-  device: 1,
-  installed: 0,
-  simulator: 0,
-  store: 2
-};
-var isRequirement = (value) => value === "installed" || value === "simulator" || value === "device" || value === "store";
-var isStrength = (value) => value === "installed" || value === "simulator" || value === "device" || value === "store";
-var isArtifactExactness = (value) => value === "archive-equivalent" || value === "source-equivalent" || value === "store-delivered";
-var isDistribution = (value) => value === "apple-processed" || value === "registered-device" || value === "simulator-release";
-var isRecord14 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var inside4 = (root, candidate) => {
-  const path = relative16(resolve18(root), resolve18(candidate));
-  return path === "" || !isAbsolute9(path) && path !== ".." && !path.startsWith(`..${sep11}`);
-};
-var exists9 = async (path) => {
-  try {
-    await access17(path);
-    return true;
-  } catch {
-    return false;
-  }
-};
-var sha2564 = (bytes) => createHash16("sha256").update(bytes).digest("hex");
-var requireString2 = (value, name) => {
-  if (typeof value !== "string" || !value)
-    throw new TypeError(`Mobile certification ${name} is invalid.`);
-  return value;
-};
-var requirePositiveInteger = (value, name) => {
-  if (!Number.isSafeInteger(value) || Number(value) < 1)
-    throw new TypeError(`Mobile certification ${name} is invalid.`);
-  return Number(value);
-};
-var resolveEvidencePath = async (projectRoot, requested) => {
-  const selected = resolve18(projectRoot, requested);
-  if (!inside4(projectRoot, selected))
-    throw new TypeError("Mobile certification evidence must remain inside the project.");
-  if (basename8(selected) === "report.json")
-    return selected;
-  const report = join30(selected, "report.json");
-  if (!await exists9(report))
-    throw new TypeError(`Mobile certification evidence does not contain report.json: ${requested}`);
-  return report;
-};
-var releaseIdentity = (release) => {
-  const { metadata } = release;
-  if (!metadata.signed)
-    throw new TypeError("Mobile release certification requires a signed native release.");
-  const common = {
-    appBuild: metadata.appBuild,
-    appId: metadata.appId,
-    artifactBytes: metadata.bytes,
-    artifactSha256: metadata.sha256,
-    engine: metadata.engine,
-    platform: metadata.platform,
-    releaseId: metadata.releaseId,
-    runtime: metadata.runtime,
-    signed: true
-  };
-  if (metadata.platform === "android")
-    return {
-      ...common,
-      ...metadata.versionCode === undefined ? {} : { versionCode: metadata.versionCode }
-    };
-  return {
-    ...common,
-    ...metadata.buildNumber === undefined ? {} : { buildNumber: metadata.buildNumber },
-    marketingVersion: metadata.marketingVersion
-  };
-};
-var requireCheck = (report, id, accepted = ["PASS"]) => {
-  const checks = report.automatedChecks;
-  if (!Array.isArray(checks))
-    throw new TypeError("Mobile certification evidence has invalid automated checks.");
-  const check = checks.find((candidate) => isRecord14(candidate) && candidate.id === id);
-  if (!isRecord14(check) || !accepted.includes(String(check.result)))
-    throw new TypeError(`Mobile certification evidence does not satisfy ${id}.`);
-};
-var validateCommonReport = (report, release) => {
-  if (report.reportVersion !== 1 || report.platform !== release.platform || !isRecord14(report.metadata) || report.metadata.provider !== release.engine || !isRecord14(report.run) || report.run.status !== "pass" || report.run.appId !== release.appId)
-    throw new TypeError("Mobile certification evidence does not match the release platform, provider, application, or successful-run contract.");
-  requireCheck(report, "AUTO-DEV-01");
-  return {
-    generatedAt: requireString2(report.generatedAt, "evidence generatedAt"),
-    run: report.run
-  };
-};
-var validateReleaseFields = (value, release) => {
-  if (value.releaseId !== release.releaseId || value.artifactSha256 !== release.artifactSha256 || value.artifactBytes !== release.artifactBytes || value.engine !== release.engine || value.signed !== true)
-    throw new TypeError("Mobile certification evidence does not match the immutable release identity.");
-};
-var validateAndroidEvidence = (report, run, release, reportSha256, generatedAt) => {
-  if (!isRecord14(run.release))
-    throw new TypeError("Android certification evidence has no installed release result.");
-  validateReleaseFields(run.release, release);
-  if (run.release.embeddedOffline !== true)
-    throw new TypeError("Android certification evidence did not prove embedded offline relaunch.");
-  requireCheck(report, "AUTO-RELEASE-01");
-  requireCheck(report, "AUTO-RELEASE-OFFLINE-01");
-  return {
-    generatedAt,
-    networkUnavailable: "proven",
-    remote: false,
-    reportSha256,
-    strength: "installed"
-  };
-};
-var validateIosEvidence = (report, run, release, reportSha256, generatedAt) => {
-  if (!isRecord14(run.iosRelease))
-    throw new TypeError("iOS certification evidence has no installed release result.");
-  const ios = run.iosRelease;
-  validateReleaseFields(ios, release);
-  if (ios.embeddedLocal !== true)
-    throw new TypeError("iOS certification evidence did not prove embedded local rendering.");
-  requireCheck(report, "AUTO-IOS-RELEASE-01");
-  let strength;
-  if (ios.distribution === "simulator-release" && ios.artifactExactness === "source-equivalent" && run.targetKind === "simulator" && ios.networkUnavailable === "not-proven")
-    strength = "simulator";
-  else if (ios.distribution === "registered-device" && ios.artifactExactness === "archive-equivalent" && run.targetKind === "device" && ios.networkUnavailable === "user-confirmed")
-    strength = "device";
-  else if (ios.distribution === "apple-processed" && ios.artifactExactness === "store-delivered" && run.targetKind === "device" && ios.networkUnavailable === "user-confirmed")
-    strength = "store";
-  else
-    throw new TypeError("iOS certification evidence contains an invalid target, distribution, exactness, or offline-strength combination.");
-  if (strength === "simulator")
-    requireCheck(report, "AUTO-IOS-RELEASE-OFFLINE-01", ["SKIPPED"]);
-  else
-    requireCheck(report, "AUTO-IOS-RELEASE-OFFLINE-01");
-  return {
-    artifactExactness: ios.artifactExactness,
-    distribution: ios.distribution,
-    generatedAt,
-    networkUnavailable: ios.networkUnavailable === "user-confirmed" ? "proven" : "not-proven",
-    remote: ios.remote === true,
-    reportSha256,
-    strength
-  };
+  if (!packageName)
+    throw new TypeError("Android MainActivity package declaration was not found.");
+  const pluginPath = join30(config.nativeProjectDirectory, "android/app/src/main/java", packageName.replaceAll(".", "/"), ANDROID_PLUGIN2);
+  const changed = await Promise.all([
+    writeChanged2(activityPath, injectAndroidActivity2(activity, enabled)),
+    enabled ? writeChanged2(pluginPath, androidPluginSource2(packageName)) : removeOwnedFile2(pluginPath)
+  ]);
+  return changed.some(Boolean);
 };
-var validateEvidence = async (projectRoot, requested, release) => {
-  const path = await resolveEvidencePath(projectRoot, requested);
-  const bytes = await readFile26(path);
-  let value;
+var applyAbsoluteNativeObservability = async (config, platforms = config.platforms) => {
+  if (config.engine !== "capacitor")
+    return { changed: false };
+  const enabled = config.observability !== undefined;
+  const changed = [];
+  if (platforms.includes("ios"))
+    changed.push(await configureIos4(config, enabled));
+  if (platforms.includes("android"))
+    changed.push(await configureAndroid4(config, enabled));
+  return { changed: changed.some(Boolean) };
+};
+// src/mobile/nativeReleaseReadiness.ts
+import { mkdir as mkdir22, readFile as readFile28, readdir as readdir10, rename as rename19, writeFile as writeFile24 } from "fs/promises";
+import { dirname as dirname21, join as join31 } from "path";
+var START3 = "// absolutejs:release-readiness:start";
+var END3 = "// absolutejs:release-readiness:end";
+var IOS_PLUGIN_START = "// absolutejs:release-readiness-plugin:start";
+var IOS_PLUGIN_END = "// absolutejs:release-readiness-plugin:end";
+var ANDROID_PLUGIN3 = "AbsoluteReleaseReadinessPlugin.java";
+var optionalSource4 = async (path) => {
   try {
-    value = JSON.parse(bytes.toString("utf8"));
-  } catch {
-    throw new TypeError("Mobile certification evidence report is not valid JSON.");
+    return await readFile28(path, "utf8");
+  } catch (error) {
+    if (typeof error === "object" && error !== null && Reflect.get(error, "code") === "ENOENT")
+      return null;
+    throw error;
   }
-  if (!isRecord14(value))
-    throw new TypeError("Mobile certification evidence report must contain an object.");
-  const { generatedAt, run } = validateCommonReport(value, release);
-  const digest = sha2564(bytes);
-  return release.platform === "android" ? validateAndroidEvidence(value, run, release, digest, generatedAt) : validateIosEvidence(value, run, release, digest, generatedAt);
-};
-var defaultRequirement = (platform4) => platform4 === "android" ? "installed" : "simulator";
-var validateRequirement = (platform4, requirement) => {
-  if (platform4 === "android" && requirement !== "installed")
-    throw new TypeError("Android certification currently uses its fixed installed/offline requirement; --require simulator, device, and store are iOS policies.");
-  if (platform4 === "ios" && requirement === "installed")
-    throw new TypeError("iOS certification requires simulator, device, or store evidence.");
 };
-var satisfiesRequirement = (strength, requirement) => {
-  if (requirement === "installed")
-    return strength === "installed";
-  if (strength === "installed")
+var writeChanged3 = async (path, source) => {
+  const current = await optionalSource4(path);
+  if (current === source)
     return false;
-  return STRENGTH_RANK[strength] >= STRENGTH_RANK[requirement];
-};
-var resolveAbsoluteMobileCertificationRequirement = (config, target) => {
-  const channelRequirement = target.channel ? config.releaseCertification.channels[target.channel]?.[target.platform] : undefined;
-  const playRequirement = target.googlePlayTrack ? config.releaseCertification.googlePlayTracks[target.googlePlayTrack] : undefined;
-  const requirements = [channelRequirement, playRequirement].filter((value) => value !== undefined);
-  if (requirements.length === 0)
-    return;
-  return requirements.reduce((strongest, candidate) => STRENGTH_RANK[candidate] > STRENGTH_RANK[strongest] ? candidate : strongest);
-};
-var validateCertifiedEvidence = (platform4, evidence) => {
-  if (platform4 === "android") {
-    if (evidence.strength !== "installed" || evidence.networkUnavailable !== "proven" || evidence.artifactExactness !== undefined || evidence.distribution !== undefined || evidence.remote)
-      throw new TypeError("Android release certification contains invalid evidence strength.");
-    return;
+  await mkdir22(dirname21(path), { recursive: true });
+  if (current === null) {
+    await writeFile24(path, source, { flag: "wx" });
+    return true;
   }
-  const simulator = evidence.strength === "simulator" && evidence.artifactExactness === "source-equivalent" && evidence.distribution === "simulator-release" && evidence.networkUnavailable === "not-proven";
-  const device = evidence.strength === "device" && evidence.artifactExactness === "archive-equivalent" && evidence.distribution === "registered-device" && evidence.networkUnavailable === "proven";
-  const store = evidence.strength === "store" && evidence.artifactExactness === "store-delivered" && evidence.distribution === "apple-processed" && evidence.networkUnavailable === "proven";
-  if (!simulator && !device && !store)
-    throw new TypeError("iOS release certification contains invalid evidence strength.");
+  const temporary = `${path}.${crypto.randomUUID()}.tmp`;
+  await writeFile24(temporary, source, { flag: "wx" });
+  await rename19(temporary, path);
+  return true;
 };
-var canonicalJsonValue = (value) => {
-  if (Array.isArray(value))
-    return value.map(canonicalJsonValue);
-  if (!isRecord14(value))
-    return value;
-  const sorted = {};
-  for (const key of Object.keys(value).sort())
-    sorted[key] = canonicalJsonValue(value[key]);
-  return sorted;
+var activityInRoot = async (root) => {
+  let entries;
+  try {
+    entries = await readdir10(root, { recursive: true });
+  } catch (error) {
+    if (typeof error === "object" && error !== null && Reflect.get(error, "code") === "ENOENT")
+      return;
+    throw error;
+  }
+  const candidate = entries.find((entry) => entry.endsWith("/MainActivity.java") || entry.endsWith("/MainActivity.kt") || entry === "MainActivity.java" || entry === "MainActivity.kt");
+  return candidate ? join31(root, candidate) : undefined;
 };
-var certificationBody = (certification) => JSON.stringify(canonicalJsonValue(certification));
-var createAbsoluteMobileReleaseCertification = async (options) => {
-  if (options.evidencePaths.length === 0)
-    throw new TypeError("Mobile release certification requires at least one --evidence report.");
-  const release = releaseIdentity(options.release);
-  const requirement = options.requirement ?? defaultRequirement(release.platform);
-  validateRequirement(release.platform, requirement);
-  const evidence = await Promise.all(options.evidencePaths.map((path) => validateEvidence(options.projectRoot, path, release)));
-  evidence.sort((left, right) => left.reportSha256.localeCompare(right.reportSha256));
-  const [firstEvidence] = evidence;
-  if (!firstEvidence)
-    throw new TypeError("Mobile release certification requires valid evidence.");
-  const strength = evidence.reduce((strongest, candidate) => STRENGTH_RANK[candidate.strength] > STRENGTH_RANK[strongest] ? candidate.strength : strongest, firstEvidence.strength);
-  if (!satisfiesRequirement(strength, requirement))
-    throw new TypeError(`Mobile release evidence strength ${strength} does not satisfy required ${requirement} certification.`);
-  const body = {
-    evidence,
-    format: ABSOLUTE_MOBILE_RELEASE_CERTIFICATION_FORMAT,
-    generatedAt: options.generatedAt ?? evidence.reduce((latest, candidate) => candidate.generatedAt > latest ? candidate.generatedAt : latest, firstEvidence.generatedAt),
-    release,
-    requirement,
-    status: "certified",
-    strength
-  };
-  return {
-    certificationId: `${CERTIFICATION_PREFIX}${sha2564(certificationBody(body))}`,
-    ...body
-  };
+var activityPath = async (config) => {
+  const roots = [
+    join31(config.nativeProjectDirectory, "android/app/src/main/java"),
+    join31(config.nativeProjectDirectory, "android/app/src/main/kotlin")
+  ];
+  const candidates = await Promise.all(roots.map(activityInRoot));
+  const candidate = candidates.find((value) => value !== undefined);
+  if (candidate)
+    return candidate;
+  throw new TypeError("Android MainActivity.java or MainActivity.kt was not found.");
 };
-var parseCertification = (value) => {
-  if (!isRecord14(value) || value.format !== ABSOLUTE_MOBILE_RELEASE_CERTIFICATION_FORMAT || value.status !== "certified" || !isRecord14(value.release) || !Array.isArray(value.evidence))
-    throw new TypeError("Mobile release certification contract is invalid.");
-  const { release } = value;
-  const { platform: platform4 } = release;
-  const { engine } = release;
-  if (platform4 !== "android" && platform4 !== "ios" || engine !== "capacitor" && engine !== "expo" || release.signed !== true)
-    throw new TypeError("Mobile release certification identity is invalid.");
-  const { requirement } = value;
-  const { strength } = value;
-  if (!isRequirement(requirement) || !isStrength(strength))
-    throw new TypeError("Mobile release certification policy is invalid.");
-  validateRequirement(platform4, requirement);
-  if (!satisfiesRequirement(strength, requirement))
-    throw new TypeError("Mobile release certification does not satisfy its declared policy.");
-  const artifactBytes = requirePositiveInteger(release.artifactBytes, "release artifactBytes");
-  const artifactSha256 = requireString2(release.artifactSha256, "release artifactSha256");
-  if (!SHA256.test(artifactSha256))
-    throw new TypeError("Mobile release certification artifact digest is invalid.");
-  const parsedRelease = {
-    appBuild: requireString2(release.appBuild, "release appBuild"),
-    appId: requireString2(release.appId, "release appId"),
-    artifactBytes,
-    artifactSha256,
-    engine,
-    platform: platform4,
-    releaseId: requireString2(release.releaseId, "release releaseId"),
-    runtime: requireString2(release.runtime, "release runtime"),
-    signed: true,
-    ...release.buildNumber === undefined ? {} : {
-      buildNumber: requirePositiveInteger(release.buildNumber, "release buildNumber")
-    },
-    ...release.marketingVersion === undefined ? {} : {
-      marketingVersion: requireString2(release.marketingVersion, "release marketingVersion")
-    },
-    ...release.versionCode === undefined ? {} : {
-      versionCode: requirePositiveInteger(release.versionCode, "release versionCode")
+var registrationRegion = (kotlin, generatedMethod) => {
+  if (generatedMethod)
+    return kotlin ? `    ${START3}
+    override fun onCreate(savedInstanceState: android.os.Bundle?) {
+        registerPlugin(AbsoluteReleaseReadinessPlugin::class.java)
+        super.onCreate(savedInstanceState)
     }
-  };
-  const evidence = value.evidence.map((candidate) => {
-    if (!isRecord14(candidate) || !SHA256.test(String(candidate.reportSha256)) || !isStrength(candidate.strength) || candidate.networkUnavailable !== "not-proven" && candidate.networkUnavailable !== "proven" || typeof candidate.remote !== "boolean" || typeof candidate.generatedAt !== "string" || candidate.artifactExactness !== undefined && !isArtifactExactness(candidate.artifactExactness) || candidate.distribution !== undefined && !isDistribution(candidate.distribution))
-      throw new TypeError("Mobile release certification evidence is invalid.");
-    const parsedEvidence = {
-      generatedAt: candidate.generatedAt,
-      networkUnavailable: candidate.networkUnavailable,
-      remote: candidate.remote,
-      reportSha256: String(candidate.reportSha256),
-      strength: candidate.strength,
-      ...candidate.artifactExactness === undefined ? {} : {
-        artifactExactness: candidate.artifactExactness
-      },
-      ...candidate.distribution === undefined ? {} : { distribution: candidate.distribution }
-    };
-    validateCertifiedEvidence(platform4, parsedEvidence);
-    return parsedEvidence;
-  });
-  const strongestEvidence = evidence.reduce((strongest, candidate) => STRENGTH_RANK[candidate.strength] > STRENGTH_RANK[strongest] ? candidate.strength : strongest, evidence[0]?.strength ?? "installed");
-  if (evidence.length === 0 || strongestEvidence !== strength)
-    throw new TypeError("Mobile release certification evidence does not support its declared strength.");
-  const parsed = {
-    certificationId: requireString2(value.certificationId, "certificationId"),
-    evidence,
-    format: ABSOLUTE_MOBILE_RELEASE_CERTIFICATION_FORMAT,
-    generatedAt: requireString2(value.generatedAt, "generatedAt"),
-    release: parsedRelease,
-    requirement,
-    status: "certified",
-    strength
-  };
-  const { certificationId, ...body } = parsed;
-  if (certificationId !== `${CERTIFICATION_PREFIX}${sha2564(certificationBody(body))}`)
-    throw new TypeError("Mobile release certification content digest is invalid.");
-  return parsed;
-};
-var readAbsoluteMobileReleaseCertification = async (projectRoot, requested) => {
-  const selected = resolve18(projectRoot, requested);
-  if (!inside4(projectRoot, selected))
-    throw new TypeError("Mobile release certification must remain inside the project.");
-  const path = basename8(selected) === "certification.json" ? selected : join30(selected, "certification.json");
-  const value = JSON.parse(await readFile26(path, "utf8"));
-  return { certification: parseCertification(value), path };
+    ${END3}
+` : `    ${START3}
+    @Override
+    public void onCreate(android.os.Bundle savedInstanceState) {
+        registerPlugin(AbsoluteReleaseReadinessPlugin.class);
+        super.onCreate(savedInstanceState);
+    }
+    ${END3}
+`;
+  return kotlin ? `        ${START3}
+        registerPlugin(AbsoluteReleaseReadinessPlugin::class.java)
+        ${END3}
+` : `        ${START3}
+        registerPlugin(AbsoluteReleaseReadinessPlugin.class);
+        ${END3}
+`;
 };
-var renderAbsoluteMobileReleaseCertification = (certification) => {
-  const { release } = certification;
-  const version = release.platform === "ios" ? `${release.marketingVersion ?? "unknown"} (${release.buildNumber ?? "unallocated"})` : String(release.versionCode ?? "unallocated");
-  const evidence = certification.evidence.map((item) => `| ${item.strength} | ${item.networkUnavailable} | ${item.remote ? "paired Mac" : "local host"} | ${item.reportSha256} |`).join(`
-`);
-  return `# AbsoluteJS mobile release certification
-
-- Status: CERTIFIED
-- Certification: ${certification.certificationId}
-- Generated: ${certification.generatedAt}
-- Platform: ${release.platform}
-- Engine: ${release.engine}
-- Requirement: ${certification.requirement}
-- Evidence strength: ${certification.strength}
-- Release: ${release.releaseId}
-- Artifact SHA-256: ${release.artifactSha256}
-- Runtime fingerprint: ${release.runtime}
-- Embedded app build: ${release.appBuild}
-- Version/build: ${version}
+var injectRegistration = (source) => {
+  const kotlin = /\bfun\s+onCreate\s*\(/u.test(source) || source.includes("BridgeActivity()");
+  const existingStart = source.indexOf(START3);
+  const existingEnd = source.indexOf(END3);
+  if (existingStart < 0 !== existingEnd < 0 || existingStart >= 0 && existingEnd < existingStart)
+    throw new TypeError("AbsoluteJS release-readiness markers are malformed.");
+  if (existingStart >= 0) {
+    const from = source.lastIndexOf(`
+`, existingStart) + 1;
+    const newline = source.indexOf(`
+`, existingEnd + END3.length);
+    const through = newline < 0 ? source.length : newline + 1;
+    const generatedMethod = source.slice(from, through).includes("onCreate(");
+    return `${source.slice(0, from)}${registrationRegion(kotlin, generatedMethod)}${source.slice(through)}`;
+  }
+  const onCreate = kotlin ? source.search(/\boverride\s+fun\s+onCreate\s*\([^)]*\)\s*\{/u) : source.search(/\b(?:public|protected)\s+void\s+onCreate\s*\([^)]*\)\s*\{/u);
+  if (onCreate >= 0) {
+    const brace = source.indexOf("{", onCreate);
+    const insert = source.indexOf(`
+`, brace) + 1;
+    if (insert <= 0)
+      throw new TypeError("Could not inject Android release readiness into MainActivity.");
+    return `${source.slice(0, insert)}${registrationRegion(kotlin, false)}${source.slice(insert)}`;
+  }
+  const close = source.lastIndexOf("}");
+  if (close < 0)
+    throw new TypeError("Could not find the Android MainActivity class body.");
+  const separator = source[close - 1] === `
+` ? "" : `
+`;
+  return `${source.slice(0, close)}${separator}${registrationRegion(kotlin, true)}${source.slice(close)}`;
+};
+var pluginSource = (packageName) => `package ${packageName};
 
-This certification is local and contains no signing credentials, device identifiers, SSH destinations, report paths, application data, or page contents. Re-run verification against the immutable release before using it as a CI or promotion gate.
+import android.util.Log;
+import com.getcapacitor.JSObject;
+import com.getcapacitor.Plugin;
+import com.getcapacitor.PluginCall;
+import com.getcapacitor.PluginMethod;
+import com.getcapacitor.annotation.CapacitorPlugin;
 
-| Strength | Network unavailable | Execution | Report SHA-256 |
-| --- | --- | --- | --- |
-${evidence}
+@CapacitorPlugin(name = "AbsoluteReleaseReadiness")
+public final class AbsoluteReleaseReadinessPlugin extends Plugin {
+    @PluginMethod
+    public void ready(PluginCall call) {
+        Log.i("AbsoluteJS", "Capacitor embedded web content ready");
+        call.resolve(new JSObject().put("ready", true));
+    }
+}
 `;
-};
-var serializeAbsoluteMobileReleaseCertification = (certification) => `${JSON.stringify(certification, null, 2)}
+var iosPluginRegion3 = `${IOS_PLUGIN_START}
+@objc(AbsoluteReleaseReadinessPlugin)
+public final class AbsoluteReleaseReadinessPlugin: CAPPlugin, CAPBridgedPlugin {
+    public let identifier = "AbsoluteReleaseReadinessPlugin"
+    public let jsName = "AbsoluteReleaseReadiness"
+    public let pluginMethods: [CAPPluginMethod] = [
+        CAPPluginMethod(name: "ready", returnType: CAPPluginReturnPromise)
+    ]
+
+    @objc public func ready(_ call: CAPPluginCall) {
+		let info = Bundle.main.infoDictionary ?? [:]
+		let version = info["CFBundleShortVersionString"] as? String ?? "unknown"
+		let build = info["CFBundleVersion"] as? String ?? "unknown"
+		NSLog("AbsoluteJS: Capacitor embedded web content ready; version=%@; build=%@", version, build)
+        call.resolve(["ready": true])
+    }
+}
+${IOS_PLUGIN_END}
 `;
-var verifyAbsoluteMobileReleaseCertification = (certification, release, requirement) => {
-  const parsed = parseCertification(certification);
-  const expected = releaseIdentity(release);
-  if (JSON.stringify(parsed.release) !== JSON.stringify(expected))
-    throw new TypeError("Mobile release certification was invalidated by a release identity, artifact, runtime, signing, version, build, or embedded-bundle change.");
-  if (requirement) {
-    validateRequirement(expected.platform, requirement);
-    if (!satisfiesRequirement(parsed.strength, requirement))
-      throw new TypeError(`Mobile release certification strength ${parsed.strength} does not satisfy required ${requirement} policy.`);
-  }
-  return parsed;
+var replaceIosPluginRegion = (appDelegate, existingStart, existingEnd) => {
+  const from = appDelegate.lastIndexOf(`
+`, existingStart) + 1;
+  const newline = appDelegate.indexOf(`
+`, existingEnd + IOS_PLUGIN_END.length);
+  const through = newline < 0 ? appDelegate.length : newline + 1;
+  return `${appDelegate.slice(0, from)}${iosPluginRegion3}${appDelegate.slice(through)}`;
 };
-var writeAbsoluteMobileReleaseCertification = async (projectRoot, certification, outputDirectory) => {
-  const root = resolve18(projectRoot);
-  const parent = resolve18(root, outputDirectory ?? join30(".absolutejs", "mobile", "certifications", certification.release.platform, certification.release.releaseId));
-  if (!inside4(root, parent))
-    throw new TypeError("Mobile certification output must remain inside the project.");
-  await mkdir20(parent, { recursive: true });
-  const destination = join30(parent, certification.certificationId);
-  const paths = {
-    directory: destination,
-    jsonPath: join30(destination, "certification.json"),
-    markdownPath: join30(destination, "certification.md")
-  };
-  const json = serializeAbsoluteMobileReleaseCertification(certification);
-  const markdown = renderAbsoluteMobileReleaseCertification(certification);
-  const verifyExisting = async () => {
-    const [existingJson, existingMarkdown] = await Promise.all([
-      readFile26(paths.jsonPath, "utf8"),
-      readFile26(paths.markdownPath, "utf8")
-    ]);
-    if (existingJson !== json || existingMarkdown !== markdown)
-      throw new TypeError(`Immutable mobile certification ${certification.certificationId} already exists with different content.`);
-  };
-  if (await exists9(destination)) {
-    await verifyExisting();
-    return paths;
-  }
-  const staging = await mkdtemp10(join30(parent, ".certification-"));
+var configureIos5 = async (config) => {
+  const appDelegatePath = join31(config.nativeProjectDirectory, "ios/App/App/AppDelegate.swift");
+  const capacitorConfigPath = join31(config.nativeProjectDirectory, "ios/App/App/capacitor.config.json");
+  const appDelegate = await readFile28(appDelegatePath, "utf8");
+  const existingStart = appDelegate.indexOf(IOS_PLUGIN_START);
+  const existingEnd = appDelegate.indexOf(IOS_PLUGIN_END);
+  if (existingStart < 0 !== existingEnd < 0 || existingStart >= 0 && existingEnd < existingStart)
+    throw new TypeError("AbsoluteJS iOS release-readiness markers are malformed.");
+  const source = existingStart < 0 ? `${appDelegate.trimEnd()}
+
+${iosPluginRegion3}` : replaceIosPluginRegion(appDelegate, existingStart, existingEnd);
+  let capacitorConfig;
   try {
-    await Promise.all([
-      writeFile22(join30(staging, "certification.json"), json, {
-        flag: "wx"
-      }),
-      writeFile22(join30(staging, "certification.md"), markdown, {
-        flag: "wx"
-      })
-    ]);
-    await rename18(staging, destination).catch(async (error) => {
-      if (await exists9(destination))
-        return;
-      throw error;
-    });
-  } finally {
-    await rm15(staging, { force: true, recursive: true });
+    capacitorConfig = JSON.parse(await readFile28(capacitorConfigPath, "utf8"));
+  } catch {
+    throw new TypeError("iOS capacitor.config.json is invalid; run Capacitor sync before projecting release readiness.");
   }
-  await verifyExisting();
-  return paths;
-};
-// src/mobile/certificationVerification.ts
-import { access as access18, mkdir as mkdir21, readFile as readFile27, stat as stat6, writeFile as writeFile23 } from "fs/promises";
-import { dirname as dirname20, isAbsolute as isAbsolute10, relative as relative17, resolve as resolve19, sep as sep12 } from "path";
-var ABSOLUTE_MOBILE_CERTIFICATION_VERIFICATION_FORMAT = 1;
-var MAX_VERIFICATION_BYTES = 1048576;
-var SHA_PATTERN = /^[a-f0-9]{40}$/u;
-var REPOSITORY_PATTERN = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/u;
-var REF_PATTERN = /^refs\/(?:heads|tags)\/[^@\s]+$/u;
-var WORKFLOW_PATTERN = /^\.github\/workflows\/[^/@]+\.ya?ml$/u;
-var isRecord15 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var required = (value, name) => {
-  if (typeof value !== "string" || value.trim() === "")
-    throw new TypeError(`${name} is required.`);
-  return value.trim();
-};
-var requireMatch = (value, pattern, name) => {
-  if (!pattern.test(value))
-    throw new TypeError(`${name} is invalid.`);
-  return value;
-};
-var createAbsoluteMobileCertificationVerification = (bundle, environment) => {
-  const repository = required(environment.GITHUB_REPOSITORY, "GITHUB_REPOSITORY");
-  const workflowReference = required(environment.GITHUB_WORKFLOW_REF, "GITHUB_WORKFLOW_REF");
-  const prefix = `${repository}/`;
-  const separator = workflowReference.lastIndexOf("@");
-  if (!workflowReference.startsWith(prefix) || separator <= prefix.length)
-    throw new TypeError("GITHUB_WORKFLOW_REF is invalid.");
-  return parseAbsoluteMobileCertificationVerification({
-    bundle,
-    format: ABSOLUTE_MOBILE_CERTIFICATION_VERIFICATION_FORMAT,
-    identity: {
-      issuer: "https://token.actions.githubusercontent.com",
-      ref: environment.GITHUB_REF,
-      repository,
-      sha: environment.GITHUB_SHA,
-      workflowPath: workflowReference.slice(prefix.length, separator)
-    },
-    kind: "sigstore-bundle"
-  });
-};
-var parseAbsoluteMobileCertificationVerification = (value) => {
-  if (!isRecord15(value) || value.format !== ABSOLUTE_MOBILE_CERTIFICATION_VERIFICATION_FORMAT || value.kind !== "sigstore-bundle" || !isRecord15(value.bundle) || !isRecord15(value.identity))
-    throw new TypeError("Mobile certification verification contract is invalid.");
-  const issuer = required(value.identity.issuer, "verification issuer");
-  if (issuer !== "https://token.actions.githubusercontent.com")
-    throw new TypeError("verification issuer is invalid.");
-  const verification = {
-    bundle: value.bundle,
-    format: ABSOLUTE_MOBILE_CERTIFICATION_VERIFICATION_FORMAT,
-    identity: {
-      issuer,
-      ref: requireMatch(required(value.identity.ref, "verification ref"), REF_PATTERN, "verification ref"),
-      repository: requireMatch(required(value.identity.repository, "verification repository"), REPOSITORY_PATTERN, "verification repository"),
-      sha: requireMatch(required(value.identity.sha, "verification sha"), SHA_PATTERN, "verification sha"),
-      workflowPath: requireMatch(required(value.identity.workflowPath, "verification workflowPath"), WORKFLOW_PATTERN, "verification workflowPath")
-    },
-    kind: "sigstore-bundle"
-  };
-  const bytes = new TextEncoder().encode(JSON.stringify(verification));
-  if (bytes.byteLength > MAX_VERIFICATION_BYTES)
-    throw new TypeError("Mobile certification verification exceeds the 1 MiB limit.");
-  return verification;
-};
-var projectFile = (projectRoot, requested) => {
-  const root = resolve19(projectRoot);
-  const path = resolve19(root, requested);
-  const portable = relative17(root, path);
-  if (portable === ".." || portable.startsWith(`..${sep12}`) || isAbsolute10(portable))
-    throw new TypeError("Mobile certification verification path must remain inside the project.");
-  return path;
-};
-var readAbsoluteMobileCertificationVerification = async (projectRoot, requested) => {
-  const path = projectFile(projectRoot, requested);
-  await access18(path).catch(() => {
-    throw new TypeError(`Mobile certification verification does not exist: ${path}`);
-  });
-  const metadata = await stat6(path);
-  if (!metadata.isFile() || metadata.size > MAX_VERIFICATION_BYTES)
-    throw new TypeError("Mobile certification verification file is invalid.");
-  return parseAbsoluteMobileCertificationVerification(JSON.parse(await readFile27(path, "utf8")));
+  if (typeof capacitorConfig !== "object" || capacitorConfig === null)
+    throw new TypeError("iOS capacitor.config.json must contain an object.");
+  const packageClassList = Reflect.get(capacitorConfig, "packageClassList");
+  if (!Array.isArray(packageClassList))
+    throw new TypeError("iOS capacitor.config.json has no packageClassList; run Capacitor sync before projecting release readiness.");
+  const classes = packageClassList.filter((value) => typeof value === "string");
+  const nextConfig = `${JSON.stringify({
+    ...capacitorConfig,
+    packageClassList: [
+      ...new Set([...classes, "AbsoluteReleaseReadinessPlugin"])
+    ]
+  }, null, "\t")}
+`;
+  const changed = await Promise.all([
+    writeChanged3(appDelegatePath, source),
+    writeChanged3(capacitorConfigPath, nextConfig)
+  ]);
+  return changed.some(Boolean);
 };
-var readAbsoluteSigstoreBundle = async (projectRoot, requested) => {
-  const path = projectFile(projectRoot, requested);
-  const metadata = await stat6(path).catch(() => null);
-  if (!metadata?.isFile() || metadata.size > MAX_VERIFICATION_BYTES)
-    throw new TypeError("Sigstore bundle file is invalid.");
-  const value = JSON.parse(await readFile27(path, "utf8"));
-  if (!isRecord15(value))
-    throw new TypeError("Sigstore bundle is invalid.");
-  return value;
+var configureAndroid5 = async (config) => {
+  const mainActivityPath = await activityPath(config);
+  const activity = await readFile28(mainActivityPath, "utf8");
+  const packageName = activity.match(/^\s*package\s+([A-Za-z0-9_.]+)\s*[;\n]/mu)?.[1];
+  if (!packageName)
+    throw new TypeError("Android MainActivity package declaration was not found.");
+  const pluginPath = join31(config.nativeProjectDirectory, "android/app/src/main/java", packageName.replaceAll(".", "/"), ANDROID_PLUGIN3);
+  const changed = await Promise.all([
+    writeChanged3(mainActivityPath, injectRegistration(activity)),
+    writeChanged3(pluginPath, pluginSource(packageName))
+  ]);
+  return changed.some(Boolean);
 };
-var writeAbsoluteMobileCertificationVerification = async (projectRoot, requested, verification) => {
-  const path = projectFile(projectRoot, requested);
-  const parsed = parseAbsoluteMobileCertificationVerification(verification);
-  await mkdir21(dirname20(path), { recursive: true });
-  await writeFile23(path, `${JSON.stringify(parsed, null, 2)}
-`, {
-    mode: 384
-  });
-  return path;
+var applyAbsoluteNativeReleaseReadiness = async (config, platforms = config.platforms) => {
+  if (config.engine !== "capacitor")
+    return { changed: false };
+  const changed = await Promise.all([
+    platforms.includes("android") ? configureAndroid5(config) : false,
+    platforms.includes("ios") ? configureIos5(config) : false
+  ]);
+  return { changed: changed.some(Boolean) };
 };
+
+// src/mobile/index.ts
+init_pageProtocol();
+init_producerContext();
+init_releaseArtifact();
+
 // src/mobile/releasePublisher.ts
-import { access as access19 } from "fs/promises";
-import { isAbsolute as isAbsolute11, relative as relative18, resolve as resolve20, sep as sep13 } from "path";
+import { access as access20 } from "fs/promises";
+import { isAbsolute as isAbsolute12, relative as relative19, resolve as resolve21, sep as sep14 } from "path";
 import { pathToFileURL as pathToFileURL3 } from "url";
 var prepareAbsoluteIosRelease = async (publisher, options) => {
   if (typeof publisher.prepareIosRelease !== "function") {
@@ -36158,24 +36655,24 @@ var requireCertificationReceipt = (publication, certification, requirement, rele
   if (verification && (!receipt.provenance || receipt.provenance.subject !== releaseId))
     throw new TypeError("Native release registry did not retain trusted certification provenance.");
 };
-var isRecord16 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var isPublisher = (value) => isRecord16(value) && typeof value.publish === "function";
+var isRecord17 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isPublisher = (value) => isRecord17(value) && typeof value.publish === "function";
 var publisherModulePath = (projectRoot, requested) => {
-  const root = resolve20(projectRoot);
-  const path = resolve20(root, requested);
-  const projectRelative = relative18(root, path);
-  if (projectRelative === ".." || projectRelative.startsWith(`..${sep13}`) || isAbsolute11(projectRelative)) {
+  const root = resolve21(projectRoot);
+  const path = resolve21(root, requested);
+  const projectRelative = relative19(root, path);
+  if (projectRelative === ".." || projectRelative.startsWith(`..${sep14}`) || isAbsolute12(projectRelative)) {
     throw new TypeError("mobile publish --registry must remain inside the project.");
   }
   return path;
 };
 var loadAbsoluteNativeReleasePublisher = async (projectRoot, requestedModulePath) => {
   const modulePath = publisherModulePath(projectRoot, requestedModulePath);
-  await access19(modulePath).catch(() => {
+  await access20(modulePath).catch(() => {
     throw new TypeError(`Native release registry module does not exist: ${modulePath}`);
   });
   const loaded = await import(pathToFileURL3(modulePath).href);
-  const publisher = isRecord16(loaded) ? loaded.default ?? loaded.registry : undefined;
+  const publisher = isRecord17(loaded) ? loaded.default ?? loaded.registry : undefined;
   if (!isPublisher(publisher)) {
     throw new TypeError("Native release registry module must default-export a registry with publish(options).");
   }
@@ -36257,7 +36754,7 @@ var publishAbsoluteIosRelease = async (options) => {
 init_pageProtocol();
 init_releaseArtifact();
 import { existsSync as existsSync7, readFileSync as readFileSync8 } from "fs";
-import { dirname as dirname21, extname as extname6, relative as relative19, resolve as resolve21 } from "path";
+import { dirname as dirname22, extname as extname6, relative as relative20, resolve as resolve22 } from "path";
 import ts2 from "typescript";
 var ROUTE_METHODS = new Set(["get", "head"]);
 var SOURCE_FILTER = /\.[cm]?[jt]sx?$/;
@@ -36308,7 +36805,7 @@ var PAGE_HANDLERS = new Map([
   ]
 ]);
 var posixPath = (value) => value.replace(/\\/g, "/");
-var findTsconfig = (entry, projectRoot) => ts2.findConfigFile(dirname21(entry), existsSync7, "tsconfig.json") ?? ts2.findConfigFile(projectRoot, existsSync7, "tsconfig.json");
+var findTsconfig = (entry, projectRoot) => ts2.findConfigFile(dirname22(entry), existsSync7, "tsconfig.json") ?? ts2.findConfigFile(projectRoot, existsSync7, "tsconfig.json");
 var createProgram = (entry, projectRoot) => {
   const configPath2 = findTsconfig(entry, projectRoot);
   if (!configPath2) {
@@ -36320,7 +36817,7 @@ var createProgram = (entry, projectRoot) => {
       target: ts2.ScriptTarget.ESNext
     });
   }
-  const parsed = ts2.parseJsonConfigFileContent(ts2.readConfigFile(configPath2, (path) => readFileSync8(path, "utf8")).config, ts2.sys, dirname21(configPath2));
+  const parsed = ts2.parseJsonConfigFileContent(ts2.readConfigFile(configPath2, (path) => readFileSync8(path, "utf8")).config, ts2.sys, dirname22(configPath2));
   if (!parsed.fileNames.includes(entry))
     parsed.fileNames.push(entry);
   return ts2.createProgram(parsed.fileNames, parsed.options);
@@ -36426,7 +36923,7 @@ var resolvePageIdentity = (expression, sourceFile, checker, projectRoot) => {
   const declaration = symbol?.declarations?.[0];
   const file = declaration?.getSourceFile().fileName ?? sourceFile.fileName;
   const exportedName = symbol?.name ?? expression.getText(sourceFile);
-  const source = posixPath(relative19(projectRoot, file));
+  const source = posixPath(relative20(projectRoot, file));
   return `${source}#${exportedName}`;
 };
 var resolveAlias = (symbol, checker) => {
@@ -36665,7 +37162,7 @@ var analyzeProgram = (program, projectRoot) => {
   const checker = program.getTypeChecker();
   const analyzed = new Map;
   for (const sourceFile of program.getSourceFiles()) {
-    const resolvedFile = resolve21(sourceFile.fileName);
+    const resolvedFile = resolve22(sourceFile.fileName);
     if (!isProjectSource(sourceFile, resolvedFile, projectRoot))
       continue;
     const analysis = analyzeSourceFile(sourceFile, checker, projectRoot);
@@ -36758,14 +37255,14 @@ var transformFile = (source, fileName, analysis) => {
 };
 var ABSOLUTE_MOBILE_TRANSFORM_PROTOCOL = ABSOLUTE_MOBILE_PAGE_PROTOCOL_VERSION;
 var createAbsoluteMobileRouteMetadataPlugin = (options) => {
-  const projectRoot = resolve21(options.projectRoot ?? process.cwd());
-  const entry = resolve21(options.entry);
+  const projectRoot = resolve22(options.projectRoot ?? process.cwd());
+  const entry = resolve22(options.entry);
   const analyzed = analyzeProgram(createProgram(entry, projectRoot), projectRoot);
   return {
     name: "absolute-mobile-route-metadata",
     setup(build) {
       build.onLoad({ filter: SOURCE_FILTER }, async ({ path }) => {
-        const analysis = analyzed.get(resolve21(path));
+        const analysis = analyzed.get(resolve22(path));
         if (!analysis)
           return;
         const source = await Bun.file(path).text();
@@ -36778,11 +37275,11 @@ var createAbsoluteMobileRouteMetadataPlugin = (options) => {
   };
 };
 var inspectAbsoluteMobileRouteMetadata = (options) => {
-  const projectRoot = resolve21(options.projectRoot ?? process.cwd());
-  const entry = resolve21(options.entry);
+  const projectRoot = resolve22(options.projectRoot ?? process.cwd());
+  const entry = resolve22(options.entry);
   const analyzed = analyzeProgram(createProgram(entry, projectRoot), projectRoot);
   return [...analyzed.entries()].flatMap(([file, analysis]) => [...analysis.byRouteCall.values()].map(({ metadata }) => ({
-    file: posixPath(relative19(projectRoot, file)),
+    file: posixPath(relative20(projectRoot, file)),
     metadata
   })));
 };
@@ -37116,7 +37613,7 @@ var createCapacitor = (win) => {
           callbackId
         }, callback);
       };
-      const p = new Promise((resolve22) => call.then(() => resolve22({ remove })));
+      const p = new Promise((resolve23) => call.then(() => resolve23({ remove })));
       p.remove = async () => {
         console.warn(`Using addListener() without 'await' is deprecated.`);
         await remove();
@@ -37321,11 +37818,11 @@ class CapacitorCookiesPluginWeb extends WebPlugin {
 var CapacitorCookies = registerPlugin("CapacitorCookies", {
   web: () => new CapacitorCookiesPluginWeb
 });
-var readBlobAsBase64 = async (blob) => new Promise((resolve22, reject) => {
+var readBlobAsBase64 = async (blob) => new Promise((resolve23, reject) => {
   const reader = new FileReader;
   reader.onload = () => {
     const base64String = reader.result;
-    resolve22(base64String.indexOf(",") >= 0 ? base64String.split(",")[1] : base64String);
+    resolve23(base64String.indexOf(",") >= 0 ? base64String.split(",")[1] : base64String);
   };
   reader.onerror = (error) => reject(error);
   reader.readAsDataURL(blob);
@@ -37501,7 +37998,7 @@ var REPORT_KINDS = new Set([
   "signal"
 ]);
 var nativeObservability = registerPlugin("AbsoluteMobileObservability");
-var isRecord17 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isRecord18 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var redactText = (value) => value.slice(0, MAX_STRING_LENGTH).replace(/\b(Bearer)\s+[A-Za-z0-9._~+/-]+=*/giu, "$1 [REDACTED]").replace(/([?&](?:access_token|api_?key|authorization|code|id_token|password|refresh_token|secret|token)=)[^&#\s]*/giu, "$1[REDACTED]").replace(/\b((?:access_?token|api_?key|authorization|client_?secret|cookie|id_?token|password|passwd|refresh_?token|secret|token)\s*[:=]\s*)[^,\s;]+/giu, "$1[REDACTED]").replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, "[REDACTED]");
 var redactValue = (value, depth = 0) => {
   if (depth >= MAX_REDACTION_DEPTH)
@@ -37512,7 +38009,7 @@ var redactValue = (value, depth = 0) => {
     return value;
   if (Array.isArray(value))
     return value.slice(0, 64).map((entry) => redactValue(entry, depth + 1));
-  if (!isRecord17(value))
+  if (!isRecord18(value))
     return String(value).slice(0, MAX_STRING_LENGTH);
   return Object.fromEntries(Object.entries(value).slice(0, 128).map(([key, entry]) => [
     key,
@@ -37520,7 +38017,7 @@ var redactValue = (value, depth = 0) => {
   ]));
 };
 var parseReport = (value) => {
-  if (!isRecord17(value) || !isRecord17(value.details))
+  if (!isRecord18(value) || !isRecord18(value.details))
     return;
   if (typeof value.id !== "string" || !REPORT_ID.test(value.id))
     return;
@@ -37531,7 +38028,7 @@ var parseReport = (value) => {
   if (value.platform !== "android" && value.platform !== "ios")
     return;
   const details = redactValue(value.details);
-  if (!isRecord17(details))
+  if (!isRecord18(details))
     return;
   if (new TextEncoder().encode(JSON.stringify(details)).byteLength > MAX_DETAIL_BYTES)
     return;
@@ -41985,8 +42482,8 @@ var createBeacon = (options) => {
         if (await fontAvailable(element))
           return;
         if (confirmationMs > 0) {
-          await new Promise((resolve22) => {
-            const timer2 = window.setTimeout(resolve22, confirmationMs);
+          await new Promise((resolve23) => {
+            const timer2 = window.setTimeout(resolve23, confirmationMs);
             cleanups.push(() => window.clearTimeout(timer2));
           });
           if (document.visibilityState === "hidden")
@@ -42974,51 +43471,51 @@ var createAbsoluteMobileUpdateClient = (options) => {
   };
 };
 // src/mobile/updatePublisher.ts
-import { access as access20 } from "fs/promises";
-import { isAbsolute as isAbsolute12, relative as relative21, resolve as resolve23, sep as sep14 } from "path";
+import { access as access21 } from "fs/promises";
+import { isAbsolute as isAbsolute13, relative as relative22, resolve as resolve24, sep as sep15 } from "path";
 import { pathToFileURL as pathToFileURL4 } from "url";
 
 // src/mobile/updateSigning.ts
 import { createHash as createHash17, sign, verify } from "crypto";
 import {
   cp as cp2,
-  mkdir as mkdir22,
-  mkdtemp as mkdtemp11,
-  readdir as readdir10,
-  readFile as readFile28,
-  rename as rename19,
-  rm as rm16,
-  stat as stat7,
-  writeFile as writeFile24
+  mkdir as mkdir23,
+  mkdtemp as mkdtemp12,
+  readdir as readdir11,
+  readFile as readFile29,
+  rename as rename20,
+  rm as rm17,
+  stat as stat8,
+  writeFile as writeFile25
 } from "fs/promises";
-import { dirname as dirname22, join as join31, relative as relative20, resolve as resolve22 } from "path";
+import { dirname as dirname23, join as join32, relative as relative21, resolve as resolve23 } from "path";
 var UPDATE_MANIFEST_FILE = "update.json";
 var UPDATE_FILES_DIRECTORY = "files";
 var sha2565 = (value) => createHash17("sha256").update(value).digest("hex");
 var listFiles = async (root, directory = root) => {
-  const entries = await readdir10(directory, { withFileTypes: true });
+  const entries = await readdir11(directory, { withFileTypes: true });
   const paths = await Promise.all(entries.map(async (entry) => {
-    const path = join31(directory, entry.name);
+    const path = join32(directory, entry.name);
     if (entry.isDirectory())
       return listFiles(root, path);
     if (!entry.isFile())
       throw new TypeError("Mobile updates cannot contain links or special files.");
-    return [relative20(root, path).replaceAll("\\", "/")];
+    return [relative21(root, path).replaceAll("\\", "/")];
   }));
   return paths.flat().sort((left, right) => left.localeCompare(right));
 };
 var inspectFiles = async (root, paths) => Promise.all(paths.map(async (path) => {
-  const source = join31(root, path);
+  const source = join32(root, path);
   const [metadata, contents] = await Promise.all([
-    stat7(source),
-    readFile28(source)
+    stat8(source),
+    readFile29(source)
   ]);
   return { bytes: metadata.size, path, sha256: sha2565(contents) };
 }));
 var releaseIdFor = (value) => `amu_${sha2565(canonicalizeAbsoluteMobileUpdate(value))}`;
 var buildAbsoluteMobileUpdate = async (options) => {
-  const bundleDirectory = resolve22(options.bundleDirectory);
-  const outputRoot = resolve22(options.outputDirectory);
+  const bundleDirectory = resolve23(options.bundleDirectory);
+  const outputRoot = resolve23(options.outputDirectory);
   if (outputRoot === bundleDirectory || outputRoot.startsWith(`${bundleDirectory}/`))
     throw new TypeError("Mobile update output must be outside the embedded bundle.");
   const paths = await listFiles(bundleDirectory);
@@ -43046,38 +43543,38 @@ var buildAbsoluteMobileUpdate = async (options) => {
       value: signature.toString("base64")
     }
   });
-  await mkdir22(outputRoot, { recursive: true });
-  const outputDirectory = join31(outputRoot, manifest.releaseId);
-  const staging = await mkdtemp11(join31(outputRoot, ".stage-"));
+  await mkdir23(outputRoot, { recursive: true });
+  const outputDirectory = join32(outputRoot, manifest.releaseId);
+  const staging = await mkdtemp12(join32(outputRoot, ".stage-"));
   try {
-    await cp2(bundleDirectory, join31(staging, UPDATE_FILES_DIRECTORY), {
+    await cp2(bundleDirectory, join32(staging, UPDATE_FILES_DIRECTORY), {
       force: true,
       recursive: true
     });
-    await writeFile24(join31(staging, UPDATE_MANIFEST_FILE), `${JSON.stringify(manifest, null, "\t")}
+    await writeFile25(join32(staging, UPDATE_MANIFEST_FILE), `${JSON.stringify(manifest, null, "\t")}
 `);
-    await rename19(staging, outputDirectory);
+    await rename20(staging, outputDirectory);
   } catch (error) {
-    await rm16(staging, { force: true, recursive: true });
+    await rm17(staging, { force: true, recursive: true });
     if (typeof error === "object" && error !== null && Reflect.get(error, "code") === "EEXIST")
       throw new TypeError(`Mobile update ${manifest.releaseId} already exists.`, { cause: error });
     throw error;
   }
   return {
     manifest,
-    manifestPath: join31(outputDirectory, UPDATE_MANIFEST_FILE),
+    manifestPath: join32(outputDirectory, UPDATE_MANIFEST_FILE),
     outputDirectory
   };
 };
 var copyAbsoluteMobileUpdateFile = async (updateDirectory, path, destination) => {
-  const source = resolve22(updateDirectory, UPDATE_FILES_DIRECTORY, path);
-  const root = resolve22(updateDirectory, UPDATE_FILES_DIRECTORY);
+  const source = resolve23(updateDirectory, UPDATE_FILES_DIRECTORY, path);
+  const root = resolve23(updateDirectory, UPDATE_FILES_DIRECTORY);
   if (!source.startsWith(`${root}/`))
     throw new TypeError("Update file escaped its release.");
-  await mkdir22(dirname22(destination), { recursive: true });
+  await mkdir23(dirname23(destination), { recursive: true });
   await cp2(source, destination, { force: true });
 };
-var readAbsoluteMobileUpdate = async (directory) => parseAbsoluteMobileUpdateManifest(JSON.parse(await readFile28(join31(resolve22(directory), UPDATE_MANIFEST_FILE), "utf8")));
+var readAbsoluteMobileUpdate = async (directory) => parseAbsoluteMobileUpdateManifest(JSON.parse(await readFile29(join32(resolve23(directory), UPDATE_MANIFEST_FILE), "utf8")));
 var verifyAbsoluteMobileUpdateSignature = (manifestValue, publicKey) => {
   const manifest = parseAbsoluteMobileUpdateManifest(manifestValue);
   const valid = verify("sha256", absoluteMobileUpdateSigningPayload(unsignedAbsoluteMobileUpdate(manifest)), { dsaEncoding: "ieee-p1363", key: publicKey }, Buffer.from(manifest.signature.value, "base64"));
@@ -43193,17 +43690,17 @@ var pruneAbsoluteMobileUpdates = async (options) => {
 };
 var object5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var isPublisher2 = (value) => object5(value) && typeof value.publishUpdate === "function" && typeof value.promoteUpdate === "function" && typeof value.rollbackUpdate === "function";
-var projectPath2 = (projectRoot, requested, label) => {
-  const root = resolve23(projectRoot);
-  const path = resolve23(root, requested);
-  const projectRelative = relative21(root, path);
-  if (projectRelative === ".." || projectRelative.startsWith(`..${sep14}`) || isAbsolute12(projectRelative))
+var projectPath3 = (projectRoot, requested, label) => {
+  const root = resolve24(projectRoot);
+  const path = resolve24(root, requested);
+  const projectRelative = relative22(root, path);
+  if (projectRelative === ".." || projectRelative.startsWith(`..${sep15}`) || isAbsolute13(projectRelative))
     throw new TypeError(`${label} must remain inside the project.`);
   return path;
 };
 var loadAbsoluteMobileUpdatePublisher = async (projectRoot, requestedModulePath) => {
-  const modulePath = projectPath2(projectRoot, requestedModulePath, "mobile update registry");
-  await access20(modulePath).catch(() => {
+  const modulePath = projectPath3(projectRoot, requestedModulePath, "mobile update registry");
+  await access21(modulePath).catch(() => {
     throw new TypeError(`Mobile update registry does not exist: ${modulePath}`);
   });
   const loaded = await import(pathToFileURL4(modulePath).href);
@@ -43225,7 +43722,7 @@ var promoteAbsoluteMobileUpdate = async (options) => {
   return result;
 };
 var publishAbsoluteMobileUpdate = async (options) => {
-  const releaseDirectory = projectPath2(options.projectRoot, options.releaseDirectory, "mobile update release directory");
+  const releaseDirectory = projectPath3(options.projectRoot, options.releaseDirectory, "mobile update release directory");
   const manifest = await readAbsoluteMobileUpdate(releaseDirectory);
   const result = await options.publisher.publishUpdate({
     manifest,
@@ -43310,6 +43807,8 @@ export {
   ABSOLUTE_IOS_RELEASE_FORMAT,
   ABSOLUTE_IOS_SIMULATOR_NAME,
   ABSOLUTE_MOBILE_CERTIFICATION_VERIFICATION_FORMAT,
+  ABSOLUTE_MOBILE_CI_PROMOTION_AUDIT_FORMAT,
+  ABSOLUTE_MOBILE_CI_PROMOTION_CONTEXT_FORMAT,
   ABSOLUTE_MOBILE_CI_WORKFLOW_FORMAT,
   ABSOLUTE_MOBILE_CLIENT_MANIFEST_FORMAT,
   ABSOLUTE_MOBILE_COMPATIBILITY_FORMAT,
@@ -43373,6 +43872,7 @@ export {
   assertAbsoluteAndroidInstalledAppUpgrade,
   assertAbsoluteDeviceCapabilityPackages,
   assertAbsoluteIosInstalledAppUpgrade,
+  auditAbsoluteMobileCiPromotion,
   buildAbsoluteAndroidRelease,
   buildAbsoluteExpoAndroidWslBundle,
   buildAbsoluteIosRelease,
@@ -43414,6 +43914,7 @@ export {
   createAbsoluteRemoteIosDevProject,
   directAbsoluteProjectPackages,
   discoverAbsoluteDeviceCapabilities,
+  discoverAbsoluteMobilePromotionRun,
   discoverAbsoluteSyncSchema,
   disposeAbsoluteMobilePage,
   drainAbsoluteMobileNativeObservability,
@@ -43436,6 +43937,7 @@ export {
   inspectAbsoluteAndroidInstalledApp,
   inspectAbsoluteBundletool,
   inspectAbsoluteIosInstalledApp,
+  inspectAbsoluteMobileCiRun,
   inspectAbsoluteMobileRouteMetadata,
   inspectAbsoluteMobileUpdateHealth,
   inspectAbsoluteMobileUpdateRollout,
@@ -43488,9 +43990,12 @@ export {
   parseAbsoluteIosLogLine,
   parseAbsoluteMobileBuildPageMetadata,
   parseAbsoluteMobileCertificationVerification,
+  parseAbsoluteMobileCiRunStatus,
   parseAbsoluteMobileCompatibilityArtifact,
   parseAbsoluteMobilePageEnvelope,
   parseAbsoluteMobilePageRequest,
+  parseAbsoluteMobilePromotionContext,
+  parseAbsoluteMobilePromotionRunList,
   parseAbsoluteMobileUnsignedUpdateManifest,
   parseAbsoluteMobileUpdateManifest,
   parseAbsoluteMobileUpdateRequest,
@@ -43567,6 +44072,7 @@ export {
   verifyAbsoluteMobileReleaseCertification,
   verifyAbsoluteMobileUpdateSignature,
   waitForAbsoluteIosHmrLog,
+  watchAbsoluteMobileCiRun,
   writeAbsoluteCapacitorConfig,
   writeAbsoluteExpoProject,
   writeAbsoluteMobileCertificationVerification,
@@ -43575,5 +44081,5 @@ export {
   writeAbsoluteMobileUpdateRegistry
 };
 
-//# debugId=F05777F8BA048C6164756E2164756E21
+//# debugId=199363435B745D2564756E2164756E21
 //# sourceMappingURL=index.js.map