@absolutejs/absolute 0.20.0-beta.112 → 0.20.0-beta.113

package/dist/cli/{mobile-d5wbqynh.js → mobile-v11nwcj9.js}

@@ -16283,9 +16283,9 @@ var require_pkcs7 = __commonJS(function(exports, module) {
       var jan_1_2050 = new Date("2050-01-01T00:00:00Z");
       var date = attr.value;
       if (typeof date === "string") {
-        var timestamp = Date.parse(date);
-        if (!isNaN(timestamp)) {
-          date = new Date(timestamp);
+        var timestamp2 = Date.parse(date);
+        if (!isNaN(timestamp2)) {
+          date = new Date(timestamp2);
         } else if (date.length === 13) {
           date = asn1.utcTimeToDate(date);
         } else {
@@ -16779,15 +16779,15 @@ var require_main = __commonJS(function(exports) {
 
 // src/cli/scripts/mobile.ts
 import {
-  access as access17,
-  mkdir as mkdir18,
+  access as access18,
+  mkdir as mkdir19,
   mkdtemp as mkdtemp7,
-  readFile as readFile22,
-  rm as rm10,
+  readFile as readFile23,
+  rm as rm11,
   writeFile as writeFile19
 } from "fs/promises";
-import { createPublicKey as createPublicKey2, randomUUID } from "crypto";
-import { join as join18, relative as relative16, resolve as resolve17 } from "path";
+import { createHash as createHash7, createPublicKey as createPublicKey2, randomUUID as randomUUID2 } from "crypto";
+import { join as join19, relative as relative17, resolve as resolve18 } from "path";
 import { createInterface } from "readline/promises";
 
 // src/mobile/nativeDeepLinks.ts
@@ -24279,47 +24279,266 @@ var auditAbsoluteMobileCiPromotion = async (options) => {
   }
 };
 
+// src/mobile/ciPromotionLedger.ts
+import {
+  access as access14,
+  link,
+  lstat,
+  mkdir as mkdir15,
+  open,
+  readFile as readFile20,
+  readdir as readdir7,
+  rename as rename12,
+  rm as rm9
+} from "fs/promises";
+import { dirname as dirname13, isAbsolute as isAbsolute9, join as join16, relative as relative13, resolve as resolve14, sep as sep10 } from "path";
+import { randomUUID } from "crypto";
+var ABSOLUTE_MOBILE_CI_PROMOTION_OPERATION_FORMAT = 1;
+var MAX_OPERATION_BYTES = 65536;
+var MAX_OPERATIONS = 1000;
+var DISPATCH_ID_PATTERN2 = /^amp_[a-f0-9]{32}$/u;
+var RUN_ID_PATTERN2 = /^[1-9][0-9]*$/u;
+var SHA256_PATTERN2 = /^[a-f0-9]{64}$/u;
+var CERTIFICATION_ID_PATTERN = /^amobile_cert_[a-f0-9]{64}$/u;
+var RELEASE_ID_PATTERN = /^amobile_(?:android|ios)_[a-f0-9]{64}$/u;
+var REPOSITORY_PATTERN3 = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/u;
+var LAST_ASCII_CONTROL = 31;
+var DELETE_CHARACTER = 127;
+var PHASES = [
+  "dispatching",
+  "dispatched",
+  "discovered",
+  "completed",
+  "audited"
+];
+var isRecord10 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var requiredString2 = (value, label, max = 512) => {
+  const hasControlCharacter = typeof value === "string" && Array.from(value).some((character) => {
+    const code = character.codePointAt(0);
+    return code !== undefined && (code <= LAST_ASCII_CONTROL || code === DELETE_CHARACTER);
+  });
+  if (typeof value !== "string" || value.trim() === "" || value !== value.trim() || value.length > max || hasControlCharacter)
+    throw new TypeError(`${label} is invalid.`);
+  return value;
+};
+var optionalString2 = (value, label, max = 512) => {
+  if (value === null)
+    return null;
+  return requiredString2(value, label, max);
+};
+var boolean = (value, label) => {
+  if (typeof value !== "boolean")
+    throw new TypeError(`${label} is invalid.`);
+  return value;
+};
+var timestamp = (value, label) => {
+  const parsed = requiredString2(value, label, 64);
+  if (!Number.isFinite(Date.parse(parsed)))
+    throw new TypeError(`${label} is invalid.`);
+  return parsed;
+};
+var projectRelativePath = (value, label) => {
+  const parsed = requiredString2(value, label, 512);
+  if (isAbsolute9(parsed) || parsed === ".." || parsed.startsWith(`..${sep10}`) || parsed.split(/[\\/]/u).includes(".."))
+    throw new TypeError(`${label} must be project-relative.`);
+  return parsed.replaceAll("\\", "/");
+};
+var nullableProjectRelativePath = (value, label) => value === null ? null : projectRelativePath(value, label);
+var dispatchId2 = (value) => {
+  const parsed = requiredString2(value, "Promotion dispatch ID", 36);
+  if (!DISPATCH_ID_PATTERN2.test(parsed))
+    throw new TypeError("Promotion dispatch ID is invalid.");
+  return parsed;
+};
+var runId2 = (value, label) => {
+  const parsed = requiredString2(value, label, 32);
+  if (!RUN_ID_PATTERN2.test(parsed))
+    throw new TypeError(`${label} is invalid.`);
+  return parsed;
+};
+var nullableRunId = (value, label) => value === null ? null : runId2(value, label);
+var operationRoot = (projectRoot) => join16(resolve14(projectRoot), ".absolutejs", "mobile-ci", "promotions");
+var absoluteMobilePromotionOperationPath = (projectRoot, requestedDispatchId) => join16(operationRoot(projectRoot), dispatchId2(requestedDispatchId), "operation.json");
+var operationPhase = (value) => {
+  const phase = PHASES.find((candidate) => candidate === value);
+  if (!phase)
+    throw new TypeError("Mobile promotion operation phase is invalid.");
+  return phase;
+};
+var parseAbsoluteMobilePromotionOperation = (value) => {
+  if (!isRecord10(value) || value.format !== ABSOLUTE_MOBILE_CI_PROMOTION_OPERATION_FORMAT || value.platform !== "android" && value.platform !== "ios")
+    throw new TypeError("Mobile promotion operation is invalid.");
+  const parsed = {
+    auditDirectory: nullableProjectRelativePath(value.auditDirectory, "Promotion audit directory"),
+    auditOutputDirectory: nullableProjectRelativePath(value.auditOutputDirectory, "Promotion requested audit directory"),
+    auditRequested: boolean(value.auditRequested, "Promotion audit request"),
+    certificationId: requiredString2(value.certificationId, "Promotion certification ID", 256),
+    certificationSha256: requiredString2(value.certificationSha256, "Promotion certification digest", 64),
+    channel: optionalString2(value.channel, "Promotion channel", 128),
+    conclusion: optionalString2(value.conclusion, "Promotion conclusion", 64),
+    createdAt: timestamp(value.createdAt, "Promotion creation time"),
+    dispatchId: dispatchId2(value.dispatchId),
+    format: ABSOLUTE_MOBILE_CI_PROMOTION_OPERATION_FORMAT,
+    githubStatus: optionalString2(value.githubStatus, "Promotion GitHub status", 64),
+    phase: operationPhase(value.phase),
+    platform: value.platform,
+    playTrack: optionalString2(value.playTrack, "Promotion Play track", 128),
+    ref: optionalString2(value.ref, "Promotion ref", 256),
+    releaseId: requiredString2(value.releaseId, "Promotion release ID", 256),
+    repository: optionalString2(value.repository, "Promotion repository", 256),
+    runId: nullableRunId(value.runId, "Promotion run ID"),
+    sourceRunId: runId2(value.sourceRunId, "Promotion source run ID"),
+    testflightGroup: optionalString2(value.testflightGroup, "Promotion TestFlight group", 128),
+    testflightSubmitReview: boolean(value.testflightSubmitReview, "Promotion TestFlight review setting"),
+    updatedAt: timestamp(value.updatedAt, "Promotion update time"),
+    url: optionalString2(value.url, "Promotion run URL", 1024),
+    watchRequested: boolean(value.watchRequested, "Promotion watch request"),
+    workflow: projectRelativePath(value.workflow, "Promotion workflow")
+  };
+  if (!SHA256_PATTERN2.test(parsed.certificationSha256))
+    throw new TypeError("Promotion certification digest is invalid.");
+  if (!CERTIFICATION_ID_PATTERN.test(parsed.certificationId))
+    throw new TypeError("Promotion certification ID is invalid.");
+  if (!RELEASE_ID_PATTERN.test(parsed.releaseId))
+    throw new TypeError("Promotion release ID is invalid.");
+  if (parsed.repository !== null && !REPOSITORY_PATTERN3.test(parsed.repository))
+    throw new TypeError("Promotion repository is invalid.");
+  const discovered = PHASES.indexOf(parsed.phase) >= PHASES.indexOf("discovered");
+  const completed = PHASES.indexOf(parsed.phase) >= PHASES.indexOf("completed");
+  if (discovered && (!parsed.runId || !parsed.url) || !discovered && (parsed.runId || parsed.url) || completed && (parsed.githubStatus !== "completed" || !parsed.conclusion) || !completed && (parsed.githubStatus || parsed.conclusion) || parsed.phase === "audited" && !parsed.auditDirectory || parsed.phase !== "audited" && parsed.auditDirectory)
+    throw new TypeError("Mobile promotion operation phase is incomplete.");
+  if (parsed.url && parsed.runId) {
+    const url = new URL(parsed.url);
+    if (url.protocol !== "https:" || url.username !== "" || url.password !== "" || url.search !== "" || url.hash !== "" || !url.pathname.endsWith(`/actions/runs/${parsed.runId}`))
+      throw new TypeError("Promotion run URL is invalid.");
+  }
+  if (Date.parse(parsed.updatedAt) < Date.parse(parsed.createdAt))
+    throw new TypeError("Promotion operation time moved backwards.");
+  return parsed;
+};
+var serialize = (operation) => `${JSON.stringify(parseAbsoluteMobilePromotionOperation(operation), null, 2)}
+`;
+var writeSynced = async (path, source) => {
+  const handle = await open(path, "wx", 384);
+  try {
+    await handle.writeFile(source);
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+};
+var atomicWrite = async (path, source, exclusive) => {
+  await mkdir15(dirname13(path), { recursive: true });
+  const temporary = join16(dirname13(path), `.operation-${randomUUID()}.tmp`);
+  try {
+    await writeSynced(temporary, source);
+    if (exclusive)
+      await link(temporary, path);
+    else
+      await rename12(temporary, path);
+  } finally {
+    await rm9(temporary, { force: true });
+  }
+};
+var advanceAbsoluteMobilePromotionOperation = async (projectRoot, requestedDispatchId, options, now = () => new Date) => {
+  const current = await readAbsoluteMobilePromotionOperation(projectRoot, requestedDispatchId);
+  if (PHASES.indexOf(options.phase) < PHASES.indexOf(current.phase))
+    throw new TypeError("Mobile promotion operation cannot move backwards.");
+  if (current.runId && options.runId && current.runId !== options.runId || current.url && options.url && current.url !== options.url || current.auditDirectory && options.auditDirectory && current.auditDirectory !== options.auditDirectory)
+    throw new TypeError("Mobile promotion operation identity is immutable.");
+  const next = parseAbsoluteMobilePromotionOperation({
+    ...current,
+    auditDirectory: options.auditDirectory === undefined ? current.auditDirectory : options.auditDirectory,
+    conclusion: options.conclusion === undefined ? current.conclusion : options.conclusion,
+    githubStatus: options.githubStatus === undefined ? current.githubStatus : options.githubStatus,
+    phase: options.phase,
+    runId: options.runId === undefined ? current.runId : options.runId,
+    updatedAt: now().toISOString(),
+    url: options.url === undefined ? current.url : options.url
+  });
+  await atomicWrite(absoluteMobilePromotionOperationPath(projectRoot, requestedDispatchId), serialize(next), false);
+  return next;
+};
+var createAbsoluteMobilePromotionOperation = async (projectRoot, options) => {
+  const now = (options.now ?? (() => new Date))().toISOString();
+  const operation = parseAbsoluteMobilePromotionOperation({
+    ...options,
+    auditDirectory: null,
+    conclusion: null,
+    createdAt: now,
+    format: ABSOLUTE_MOBILE_CI_PROMOTION_OPERATION_FORMAT,
+    githubStatus: null,
+    phase: "dispatching",
+    runId: null,
+    updatedAt: now,
+    url: null
+  });
+  await atomicWrite(absoluteMobilePromotionOperationPath(projectRoot, operation.dispatchId), serialize(operation), true);
+  return operation;
+};
+var listAbsoluteMobilePromotionOperations = async (projectRoot) => {
+  const root = operationRoot(projectRoot);
+  if (!await access14(root).then(() => true).catch(() => false))
+    return [];
+  const entries = await readdir7(root, { withFileTypes: true });
+  if (entries.length > MAX_OPERATIONS)
+    throw new TypeError("Mobile promotion operation count exceeds the limit.");
+  const operations = await Promise.all(entries.filter((entry) => entry.isDirectory() && DISPATCH_ID_PATTERN2.test(entry.name)).map((entry) => readAbsoluteMobilePromotionOperation(projectRoot, entry.name)));
+  return operations.sort((left, right) => right.updatedAt.localeCompare(left.updatedAt));
+};
+var readAbsoluteMobilePromotionOperation = async (projectRoot, requestedDispatchId) => {
+  const path = absoluteMobilePromotionOperationPath(projectRoot, requestedDispatchId);
+  const metadata = await lstat(path).catch(() => null);
+  if (!metadata?.isFile() || metadata.size > MAX_OPERATION_BYTES)
+    throw new TypeError(`Mobile promotion operation ${requestedDispatchId} was not found or is invalid.`);
+  const operation = parseAbsoluteMobilePromotionOperation(JSON.parse(await readFile20(path, "utf8")));
+  if (operation.dispatchId !== requestedDispatchId)
+    throw new TypeError("Mobile promotion operation identity does not match.");
+  return operation;
+};
+var relativeAbsoluteMobilePromotionOperationPath = (projectRoot, dispatchIdValue) => relative13(resolve14(projectRoot), absoluteMobilePromotionOperationPath(projectRoot, dispatchIdValue)).replaceAll("\\", "/");
+
 // src/mobile/updateSigning.ts
 import { createHash as createHash6, sign, verify } from "crypto";
 import {
   cp,
-  mkdir as mkdir15,
+  mkdir as mkdir16,
   mkdtemp as mkdtemp6,
-  readdir as readdir7,
-  readFile as readFile20,
-  rename as rename12,
-  rm as rm9,
+  readdir as readdir8,
+  readFile as readFile21,
+  rename as rename13,
+  rm as rm10,
   stat as stat8,
   writeFile as writeFile16
 } from "fs/promises";
-import { dirname as dirname13, join as join16, relative as relative13, resolve as resolve14 } from "path";
+import { dirname as dirname14, join as join17, relative as relative14, resolve as resolve15 } from "path";
 var UPDATE_MANIFEST_FILE = "update.json";
 var UPDATE_FILES_DIRECTORY = "files";
 var sha2564 = (value) => createHash6("sha256").update(value).digest("hex");
 var listFiles = async (root, directory = root) => {
-  const entries = await readdir7(directory, { withFileTypes: true });
+  const entries = await readdir8(directory, { withFileTypes: true });
   const paths = await Promise.all(entries.map(async (entry) => {
-    const path = join16(directory, entry.name);
+    const path = join17(directory, entry.name);
     if (entry.isDirectory())
       return listFiles(root, path);
     if (!entry.isFile())
       throw new TypeError("Mobile updates cannot contain links or special files.");
-    return [relative13(root, path).replaceAll("\\", "/")];
+    return [relative14(root, path).replaceAll("\\", "/")];
   }));
   return paths.flat().sort((left, right) => left.localeCompare(right));
 };
 var inspectFiles = async (root, paths) => Promise.all(paths.map(async (path) => {
-  const source = join16(root, path);
+  const source = join17(root, path);
   const [metadata, contents] = await Promise.all([
     stat8(source),
-    readFile20(source)
+    readFile21(source)
   ]);
   return { bytes: metadata.size, path, sha256: sha2564(contents) };
 }));
 var releaseIdFor = (value) => `amu_${sha2564(canonicalizeAbsoluteMobileUpdate(value))}`;
 var buildAbsoluteMobileUpdate = async (options) => {
-  const bundleDirectory = resolve14(options.bundleDirectory);
-  const outputRoot = resolve14(options.outputDirectory);
+  const bundleDirectory = resolve15(options.bundleDirectory);
+  const outputRoot = resolve15(options.outputDirectory);
   if (outputRoot === bundleDirectory || outputRoot.startsWith(`${bundleDirectory}/`))
     throw new TypeError("Mobile update output must be outside the embedded bundle.");
   const paths = await listFiles(bundleDirectory);
@@ -24347,30 +24566,30 @@ var buildAbsoluteMobileUpdate = async (options) => {
       value: signature.toString("base64")
     }
   });
-  await mkdir15(outputRoot, { recursive: true });
-  const outputDirectory = join16(outputRoot, manifest.releaseId);
-  const staging = await mkdtemp6(join16(outputRoot, ".stage-"));
+  await mkdir16(outputRoot, { recursive: true });
+  const outputDirectory = join17(outputRoot, manifest.releaseId);
+  const staging = await mkdtemp6(join17(outputRoot, ".stage-"));
   try {
-    await cp(bundleDirectory, join16(staging, UPDATE_FILES_DIRECTORY), {
+    await cp(bundleDirectory, join17(staging, UPDATE_FILES_DIRECTORY), {
       force: true,
       recursive: true
     });
-    await writeFile16(join16(staging, UPDATE_MANIFEST_FILE), `${JSON.stringify(manifest, null, "\t")}
+    await writeFile16(join17(staging, UPDATE_MANIFEST_FILE), `${JSON.stringify(manifest, null, "\t")}
 `);
-    await rename12(staging, outputDirectory);
+    await rename13(staging, outputDirectory);
   } catch (error) {
-    await rm9(staging, { force: true, recursive: true });
+    await rm10(staging, { force: true, recursive: true });
     if (typeof error === "object" && error !== null && Reflect.get(error, "code") === "EEXIST")
       throw new TypeError(`Mobile update ${manifest.releaseId} already exists.`, { cause: error });
     throw error;
   }
   return {
     manifest,
-    manifestPath: join16(outputDirectory, UPDATE_MANIFEST_FILE),
+    manifestPath: join17(outputDirectory, UPDATE_MANIFEST_FILE),
     outputDirectory
   };
 };
-var readAbsoluteMobileUpdate = async (directory) => parseAbsoluteMobileUpdateManifest(JSON.parse(await readFile20(join16(resolve14(directory), UPDATE_MANIFEST_FILE), "utf8")));
+var readAbsoluteMobileUpdate = async (directory) => parseAbsoluteMobileUpdateManifest(JSON.parse(await readFile21(join17(resolve15(directory), UPDATE_MANIFEST_FILE), "utf8")));
 var verifyAbsoluteMobileUpdateSignature = (manifestValue, publicKey) => {
   const manifest = parseAbsoluteMobileUpdateManifest(manifestValue);
   const valid = verify("sha256", absoluteMobileUpdateSigningPayload(unsignedAbsoluteMobileUpdate(manifest)), { dsaEncoding: "ieee-p1363", key: publicKey }, Buffer.from(manifest.signature.value, "base64"));
@@ -24380,8 +24599,8 @@ var verifyAbsoluteMobileUpdateSignature = (manifestValue, publicKey) => {
 };
 
 // src/mobile/expoUpdate.ts
-import { access as access14, mkdir as mkdir16, readFile as readFile21, writeFile as writeFile17 } from "fs/promises";
-import { dirname as dirname14, extname as extname3, join as join17 } from "path";
+import { access as access15, mkdir as mkdir17, readFile as readFile22, writeFile as writeFile17 } from "fs/promises";
+import { dirname as dirname15, extname as extname3, join as join18 } from "path";
 var ABSOLUTE_EXPO_UPDATE_DESCRIPTOR = "_absolute/expo-update.json";
 var ABSOLUTE_EXPO_UPDATE_FORMAT = 1;
 var object2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
@@ -24447,7 +24666,7 @@ var parseAbsoluteExpoUpdateDescriptor = (value) => {
   };
 };
 var finalizeAbsoluteExpoUpdateExport = async (options) => {
-  const metadata = JSON.parse(await readFile21(join17(options.exportDirectory, "metadata.json"), "utf8"));
+  const metadata = JSON.parse(await readFile22(join18(options.exportDirectory, "metadata.json"), "utf8"));
   if (!object2(metadata) || !object2(metadata.fileMetadata))
     throw new TypeError("Expo export metadata.json is invalid.");
   const descriptor = parseAbsoluteExpoUpdateDescriptor({
@@ -24458,11 +24677,11 @@ var finalizeAbsoluteExpoUpdateExport = async (options) => {
     runtimeVersion: options.runtimeVersion
   });
   const referenced = Object.values(descriptor.platforms).flatMap((entry) => entry ? [entry.launchAsset, ...entry.assets] : []);
-  await Promise.all(referenced.map(({ path }) => access14(join17(options.exportDirectory, path)).catch(() => {
+  await Promise.all(referenced.map(({ path }) => access15(join18(options.exportDirectory, path)).catch(() => {
     throw new TypeError(`Expo export metadata references missing asset ${path}.`);
   })));
-  const destination = join17(options.exportDirectory, ABSOLUTE_EXPO_UPDATE_DESCRIPTOR);
-  await mkdir16(dirname14(destination), { recursive: true });
+  const destination = join18(options.exportDirectory, ABSOLUTE_EXPO_UPDATE_DESCRIPTOR);
+  await mkdir17(dirname15(destination), { recursive: true });
   await writeFile17(destination, `${JSON.stringify(descriptor, null, "\t")}
 `);
   return { descriptor, path: destination };
@@ -24470,18 +24689,18 @@ var finalizeAbsoluteExpoUpdateExport = async (options) => {
 
 // src/mobile/expoCodeSigning.ts
 var import_code_signing_certificates = __toESM(require_main(), 1);
-import { access as access15, mkdir as mkdir17, writeFile as writeFile18 } from "fs/promises";
-import { dirname as dirname15, isAbsolute as isAbsolute9, relative as relative14, resolve as resolve15, sep as sep10 } from "path";
-var exists6 = async (path) => access15(path).then(() => true).catch(() => false);
+import { access as access16, mkdir as mkdir18, writeFile as writeFile18 } from "fs/promises";
+import { dirname as dirname16, isAbsolute as isAbsolute10, relative as relative15, resolve as resolve16, sep as sep11 } from "path";
+var exists6 = async (path) => access16(path).then(() => true).catch(() => false);
 var inside4 = (root, path) => {
-  const location = relative14(root, path);
-  return location === "" || location !== ".." && !location.startsWith(`..${sep10}`) && !isAbsolute9(location);
+  const location = relative15(root, path);
+  return location === "" || location !== ".." && !location.startsWith(`..${sep11}`) && !isAbsolute10(location);
 };
 var generateAbsoluteExpoCodeSigning = async (options) => {
-  const root = resolve15(options.projectRoot);
-  const certificatePath = resolve15(root, options.certificatePath);
-  const privateKeyPath = resolve15(root, options.privateKeyPath);
-  const publicKeyPath = resolve15(root, options.publicKeyPath ?? resolve15(dirname15(privateKeyPath), "public-key.pem"));
+  const root = resolve16(options.projectRoot);
+  const certificatePath = resolve16(root, options.certificatePath);
+  const privateKeyPath = resolve16(root, options.privateKeyPath);
+  const publicKeyPath = resolve16(root, options.publicKeyPath ?? resolve16(dirname16(privateKeyPath), "public-key.pem"));
   if (!inside4(root, certificatePath))
     throw new TypeError("Expo code-signing certificate must be written inside the project so store builds can embed it.");
   if (inside4(root, privateKeyPath) || inside4(root, publicKeyPath))
@@ -24511,7 +24730,7 @@ var generateAbsoluteExpoCodeSigning = async (options) => {
   import_code_signing_certificates.validateSelfSignedCertificate(certificate, keyPair);
   const { privateKeyPEM, publicKeyPEM } = import_code_signing_certificates.convertKeyPairToPEM(keyPair);
   const certificatePem = import_code_signing_certificates.convertCertificateToCertificatePEM(certificate);
-  await Promise.all([certificatePath, privateKeyPath, publicKeyPath].map((path) => mkdir17(dirname15(path), { recursive: true })));
+  await Promise.all([certificatePath, privateKeyPath, publicKeyPath].map((path) => mkdir18(dirname16(path), { recursive: true })));
   await Promise.all([
     writeFile18(certificatePath, certificatePem, { flag: "wx", mode: 420 }),
     writeFile18(privateKeyPath, privateKeyPEM, { flag: "wx", mode: 384 }),
@@ -24526,8 +24745,8 @@ var generateAbsoluteExpoCodeSigning = async (options) => {
 };
 
 // src/mobile/updatePublisher.ts
-import { access as access16 } from "fs/promises";
-import { isAbsolute as isAbsolute10, relative as relative15, resolve as resolve16, sep as sep11 } from "path";
+import { access as access17 } from "fs/promises";
+import { isAbsolute as isAbsolute11, relative as relative16, resolve as resolve17, sep as sep12 } from "path";
 import { pathToFileURL as pathToFileURL3 } from "url";
 var lifecycleMethod = (publisher, name) => {
   const method = publisher[name];
@@ -24636,16 +24855,16 @@ var pruneAbsoluteMobileUpdates = async (options) => {
 var object3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var isPublisher2 = (value) => object3(value) && typeof value.publishUpdate === "function" && typeof value.promoteUpdate === "function" && typeof value.rollbackUpdate === "function";
 var projectPath4 = (projectRoot, requested, label) => {
-  const root = resolve16(projectRoot);
-  const path = resolve16(root, requested);
-  const projectRelative = relative15(root, path);
-  if (projectRelative === ".." || projectRelative.startsWith(`..${sep11}`) || isAbsolute10(projectRelative))
+  const root = resolve17(projectRoot);
+  const path = resolve17(root, requested);
+  const projectRelative = relative16(root, path);
+  if (projectRelative === ".." || projectRelative.startsWith(`..${sep12}`) || isAbsolute11(projectRelative))
     throw new TypeError(`${label} must remain inside the project.`);
   return path;
 };
 var loadAbsoluteMobileUpdatePublisher = async (projectRoot, requestedModulePath) => {
   const modulePath = projectPath4(projectRoot, requestedModulePath, "mobile update registry");
-  await access16(modulePath).catch(() => {
+  await access17(modulePath).catch(() => {
     throw new TypeError(`Mobile update registry does not exist: ${modulePath}`);
   });
   const loaded = await import(pathToFileURL3(modulePath).href);
@@ -24700,10 +24919,10 @@ var rollbackAbsoluteMobileUpdate = async (options) => {
 var NOT_FOUND4 = -1;
 var ANDROID_EMULATOR_BOOT_POLL_MS = 500;
 var ANDROID_EMULATOR_BOOT_TIMEOUT_MS = 180000;
-var isRecord10 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isRecord11 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var expoPublicConfig = (config) => {
   const result = { ...config };
-  if (!isRecord10(result.updates))
+  if (!isRecord11(result.updates))
     return result;
   const {
     codeSigningCertificate: _codeSigningCertificate,
@@ -24743,13 +24962,13 @@ var CAPACITOR_SYNC_PACKAGE_SPECS = [
 ];
 var packageNameFromSpec = (spec) => spec.slice(0, spec.lastIndexOf("@"));
 var directProjectPackages = async (projectRoot) => {
-  const manifest = JSON.parse(await readFile22(join18(projectRoot, "package.json"), "utf8"));
-  if (!isRecord10(manifest))
+  const manifest = JSON.parse(await readFile23(join19(projectRoot, "package.json"), "utf8"));
+  if (!isRecord11(manifest))
     throw new TypeError("Application package.json must contain an object.");
   const names = new Set;
   for (const field2 of ["dependencies", "devDependencies"]) {
     const dependencies = Reflect.get(manifest, field2);
-    if (isRecord10(dependencies))
+    if (isRecord11(dependencies))
       for (const name of Object.keys(dependencies))
         names.add(name);
   }
@@ -24757,8 +24976,8 @@ var directProjectPackages = async (projectRoot) => {
 };
 var resolvedPackageVersion = async (projectRoot, packageName) => {
   try {
-    const manifest = JSON.parse(await readFile22(join18(projectRoot, "node_modules", packageName, "package.json"), "utf8"));
-    return isRecord10(manifest) && typeof manifest.version === "string" ? manifest.version : undefined;
+    const manifest = JSON.parse(await readFile23(join19(projectRoot, "node_modules", packageName, "package.json"), "utf8"));
+    return isRecord11(manifest) && typeof manifest.version === "string" ? manifest.version : undefined;
   } catch {
     return;
   }
@@ -24821,9 +25040,9 @@ var runCapacitor = async (projectRoot, args) => {
 };
 var runCapacitorForPlatforms = (projectRoot, command, platforms) => platforms.reduce((pending, platform2) => pending.then(() => runCapacitor(projectRoot, [command, platform2])), Promise.resolve());
 var expoExecutable = async (project) => {
-  const executable = join18(project, "node_modules", ".bin", "expo");
+  const executable = join19(project, "node_modules", ".bin", "expo");
   try {
-    await access17(executable);
+    await access18(executable);
     return executable;
   } catch {
     throw new TypeError("Expo dependencies are not installed in the generated shell. Run `absolute mobile init --yes`.");
@@ -24855,14 +25074,14 @@ var runExpo = async (project, args, options = {}) => {
 };
 var ensureExpoPackages = async (project, args) => {
   try {
-    const manifest = JSON.parse(await readFile22(join18(project, "package.json"), "utf8"));
+    const manifest = JSON.parse(await readFile23(join19(project, "package.json"), "utf8"));
     const dependencies = typeof manifest === "object" && manifest !== null ? Reflect.get(manifest, "dependencies") : undefined;
     if (typeof dependencies !== "object" || dependencies === null || Array.isArray(dependencies))
       throw new TypeError("Generated Expo dependencies are invalid.");
     await Promise.all(Object.entries(dependencies).map(async ([name, expected]) => {
       if (typeof expected !== "string")
         throw new TypeError("Generated Expo dependency version is invalid.");
-      const installed = JSON.parse(await readFile22(join18(project, "node_modules", name, "package.json"), "utf8"));
+      const installed = JSON.parse(await readFile23(join19(project, "node_modules", name, "package.json"), "utf8"));
       const actual = typeof installed === "object" && installed !== null ? Reflect.get(installed, "version") : undefined;
       if (typeof actual !== "string")
         throw new TypeError("Installed Expo dependency version is invalid.");
@@ -25060,7 +25279,7 @@ var sync = async (args) => {
 };
 var associations = async (args) => {
   const { mobile, projectRoot } = await loadMobile(valueAfter(args, "--config"));
-  const outputDirectory = resolve17(projectRoot, valueAfter(args, "--outdir") ?? ".absolutejs/mobile/associations");
+  const outputDirectory = resolve18(projectRoot, valueAfter(args, "--outdir") ?? ".absolutejs/mobile/associations");
   if (args.includes("--verify")) {
     const result2 = await verifyAbsoluteMobileAssociationFiles(mobile);
     console.log(`Verified ${result2.results.length} hosted association files`);
@@ -25112,7 +25331,7 @@ var generateGithubCi = async (args) => {
   const publicResult = {
     changed: result.changed,
     format: result.format,
-    path: relative16(projectRoot, result.path).replaceAll("\\", "/"),
+    path: relative17(projectRoot, result.path).replaceAll("\\", "/"),
     platforms: result.platforms,
     publishing: result.publishing,
     requiredSecrets: result.requiredSecrets
@@ -25143,14 +25362,14 @@ var createGithubCertificationVerification = async (args) => {
     GITHUB_WORKFLOW_REF: process.env.GITHUB_WORKFLOW_REF
   });
   const path = await writeAbsoluteMobileCertificationVerification(projectRoot, outputPath, verification);
-  console.log(relative16(projectRoot, path).replaceAll("\\", "/"));
+  console.log(relative17(projectRoot, path).replaceAll("\\", "/"));
   return verification;
 };
 var auditDispatchedGithubMobilePromotion = async (options) => {
   const startedAt = performance.now();
   try {
     const audited = await auditAbsoluteMobileCiPromotion({
-      outputDirectory: valueAfter(options.args, "--outdir"),
+      outputDirectory: options.outputDirectory,
       projectRoot: options.projectRoot,
       ...options.repository ? { repository: options.repository } : {},
       runId: options.runId
@@ -25172,7 +25391,125 @@ var auditDispatchedGithubMobilePromotion = async (options) => {
     throw error;
   }
 };
+var promotionPhaseRank = (phase) => ["dispatching", "dispatched", "discovered", "completed", "audited"].indexOf(phase);
+var promotionRecoveryCommand = (dispatchId3) => `absolute mobile ci promote --resume ${dispatchId3}`;
+var promotionRecoveryError = (error, dispatchId3) => {
+  const message = error instanceof Error ? error.message : String(error);
+  return new TypeError(`${message}
+Promotion ${dispatchId3} is recorded. Resume without redispatching: ${promotionRecoveryCommand(dispatchId3)}
+If immutable audit output already exists, add --outdir with a new project-local directory.`, { cause: error });
+};
+var watchAndPersistGithubMobilePromotion = async (options) => {
+  let status;
+  try {
+    status = await watchAbsoluteMobileCiRun({
+      projectRoot: options.projectRoot,
+      ...options.operation.repository ? { repository: options.operation.repository } : {},
+      runId: options.runId
+    });
+  } catch (error) {
+    const inspected = await inspectAbsoluteMobileCiRun({
+      projectRoot: options.projectRoot,
+      ...options.operation.repository ? { repository: options.operation.repository } : {},
+      runId: options.runId
+    }).catch(() => null);
+    if (inspected?.status === "completed")
+      await advanceAbsoluteMobilePromotionOperation(options.projectRoot, options.operation.dispatchId, {
+        conclusion: inspected.conclusion,
+        githubStatus: inspected.status,
+        phase: "completed"
+      });
+    throw error;
+  }
+  const operation = await advanceAbsoluteMobilePromotionOperation(options.projectRoot, options.operation.dispatchId, {
+    conclusion: status.conclusion,
+    githubStatus: status.status,
+    phase: "completed"
+  });
+  return { operation, status };
+};
+var completeGithubMobilePromotion = async (options) => {
+  let { operation } = options;
+  if (!operation.runId || !operation.url) {
+    const promotion = await discoverAbsoluteMobilePromotionRun({
+      dispatchId: operation.dispatchId,
+      projectRoot: options.projectRoot,
+      ...operation.repository ? { repository: operation.repository } : {},
+      workflow: operation.workflow
+    });
+    operation = await advanceAbsoluteMobilePromotionOperation(options.projectRoot, operation.dispatchId, {
+      phase: "discovered",
+      runId: promotion.runId,
+      url: promotion.url
+    });
+  }
+  if (!operation.runId || !operation.url)
+    throw new TypeError("Promotion run discovery did not produce an identity.");
+  const promotionRunId = operation.runId;
+  const promotionUrl = operation.url;
+  if (!options.json) {
+    console.log(`Promotion ${operation.dispatchId} is GitHub run ${promotionRunId}.`);
+    console.log(promotionUrl);
+  }
+  let status = null;
+  if (options.watch && promotionPhaseRank(operation.phase) < promotionPhaseRank("completed")) {
+    if (!options.json)
+      console.log(`Watching GitHub run ${promotionRunId} until completion\u2026`);
+    ({ operation, status } = await watchAndPersistGithubMobilePromotion({
+      operation,
+      projectRoot: options.projectRoot,
+      runId: promotionRunId
+    }));
+  } else if (options.watch) {
+    status = await inspectAbsoluteMobileCiRun({
+      projectRoot: options.projectRoot,
+      ...operation.repository ? { repository: operation.repository } : {},
+      runId: promotionRunId
+    });
+  }
+  if (options.audit && operation.conclusion !== "success")
+    throw new TypeError("Promotion audit requires a successfully completed workflow run.");
+  let audited = null;
+  if (options.audit && operation.phase !== "audited") {
+    audited = await auditDispatchedGithubMobilePromotion({
+      outputDirectory: options.auditOutputDirectory ?? operation.auditOutputDirectory ?? undefined,
+      platform: operation.platform,
+      projectRoot: options.projectRoot,
+      ...operation.repository ? { repository: operation.repository } : {},
+      runId: promotionRunId
+    });
+    operation = await advanceAbsoluteMobilePromotionOperation(options.projectRoot, operation.dispatchId, {
+      auditDirectory: relative17(options.projectRoot, audited.directory).replaceAll("\\", "/"),
+      phase: "audited"
+    });
+  }
+  const result = {
+    auditDirectory: operation.auditDirectory,
+    dispatchId: operation.dispatchId,
+    platform: operation.platform,
+    releaseId: operation.releaseId,
+    runId: promotionRunId,
+    sourceRunId: operation.sourceRunId,
+    status: operation.githubStatus ?? operation.phase,
+    url: promotionUrl
+  };
+  if (options.json)
+    console.log(JSON.stringify(result, null, 2));
+  else {
+    if (status)
+      renderGithubMobileRunStatus(status);
+    if (audited)
+      renderGithubMobilePromotionAudit(audited, options.projectRoot);
+    else if (operation.auditDirectory)
+      console.log(`Audit: ${operation.auditDirectory}`);
+    console.log(`Promotion record: ${relativeAbsoluteMobilePromotionOperationPath(options.projectRoot, operation.dispatchId)}`);
+  }
+  return result;
+};
 var dispatchGithubMobilePromotion = async (args) => {
+  const resumeDispatchId = valueAfter(args, "--resume");
+  if (resumeDispatchId)
+    return resumeGithubMobilePromotion(args, resumeDispatchId);
   const [platform2] = args;
   if (platform2 !== "android" && platform2 !== "ios")
     throw new TypeError("Usage: absolute mobile ci promote <android|ios> --run-id id --certification directory-or-json [--channel name] [store options] [--watch] [--audit]");
@@ -25196,8 +25533,31 @@ var dispatchGithubMobilePromotion = async (args) => {
   if (certificationBase64.length > 48000)
     throw new TypeError("Mobile certification is too large for protected GitHub dispatch.");
   const workflow = valueAfter(args, "--workflow") ?? ".github/workflows/absolute-mobile.yml";
-  const dispatchId2 = `amp_${randomUUID().replaceAll("-", "")}`;
+  const dispatchId3 = `amp_${randomUUID2().replaceAll("-", "")}`;
   const repository = valueAfter(args, "--repo");
+  const ref = valueAfter(args, "--ref");
+  const auditRequested = args.includes("--audit");
+  const watchRequested = args.includes("--watch") || auditRequested;
+  const requestedAuditOutputDirectory = valueAfter(args, "--outdir");
+  const auditOutputDirectory = requestedAuditOutputDirectory ? relative17(projectRoot, resolve18(projectRoot, requestedAuditOutputDirectory)).replaceAll("\\", "/") : null;
+  await createAbsoluteMobilePromotionOperation(projectRoot, {
+    auditOutputDirectory,
+    auditRequested,
+    certificationId: certification.certificationId,
+    certificationSha256: createHash7("sha256").update(serializeAbsoluteMobileReleaseCertification(certification)).digest("hex"),
+    channel: channel || null,
+    dispatchId: dispatchId3,
+    platform: platform2,
+    playTrack: platform2 === "android" ? playTrack : null,
+    ref: ref ?? null,
+    releaseId: certification.release.releaseId,
+    repository: repository ?? null,
+    sourceRunId,
+    testflightGroup: platform2 === "ios" ? testflightGroup || null : null,
+    testflightSubmitReview: platform2 === "ios" && args.includes("--testflight-submit-review"),
+    watchRequested,
+    workflow
+  });
   const command = [
     "workflow",
     "run",
@@ -25209,7 +25569,7 @@ var dispatchGithubMobilePromotion = async (args) => {
     "-f",
     `source_run_id=${sourceRunId}`,
     "-f",
-    `dispatch_id=${dispatchId2}`,
+    `dispatch_id=${dispatchId3}`,
     "-f",
     `certification_base64=${certificationBase64}`,
     "-f",
@@ -25221,74 +25581,98 @@ var dispatchGithubMobilePromotion = async (args) => {
     command.push("-f", `testflight_group=${testflightGroup}`);
     command.push("-f", `submit_testflight_review=${args.includes("--testflight-submit-review")}`);
   }
-  const ref = valueAfter(args, "--ref");
   if (ref)
     command.push("--ref", ref);
   if (repository)
     command.push("--repo", repository);
-  const child = Bun.spawn(["gh", ...command], {
-    cwd: projectRoot,
-    stderr: "pipe",
-    stdin: "inherit",
-    stdout: "pipe"
-  });
-  const [exitCode, stderr] = await Promise.all([
-    child.exited,
-    new Response(child.stderr).text(),
-    new Response(child.stdout).text()
-  ]);
-  if (exitCode !== 0)
-    throw new TypeError(`GitHub promotion dispatch exited with status ${exitCode}: ${stderr.trim() || "unknown GitHub CLI error"}`);
-  const promotion = await discoverAbsoluteMobilePromotionRun({
-    dispatchId: dispatchId2,
-    projectRoot,
-    ...repository ? { repository } : {},
-    workflow
-  });
-  sendTelemetryEvent("mobile:ci-promotion-dispatched", {
-    discovery: "correlated",
-    platform: platform2,
-    provider: "github-actions",
-    storeTarget: platform2 === "android" ? playTrack !== "registry-only" : testflightGroup !== ""
-  });
-  if (!args.includes("--json")) {
-    console.log(`Dispatched protected ${platform2} promotion ${promotion.runId} for ${certification.release.releaseId} from workflow run ${sourceRunId}.`);
-    console.log(promotion.url);
-  }
-  const shouldWatch = args.includes("--watch") || args.includes("--audit");
-  if (shouldWatch && !args.includes("--json"))
-    console.log(`Watching GitHub run ${promotion.runId} until completion\u2026`);
-  const status = shouldWatch ? await watchAbsoluteMobileCiRun({
-    projectRoot,
-    ...repository ? { repository } : {},
-    runId: promotion.runId
-  }) : null;
-  const audited = args.includes("--audit") ? await auditDispatchedGithubMobilePromotion({
-    args,
-    platform: platform2,
-    projectRoot,
-    ...repository ? { repository } : {},
-    runId: promotion.runId
-  }) : null;
-  const result = {
-    auditDirectory: audited ? relative16(projectRoot, audited.directory).replaceAll("\\", "/") : null,
-    dispatchId: dispatchId2,
-    platform: platform2,
-    releaseId: certification.release.releaseId,
-    runId: promotion.runId,
-    sourceRunId,
-    status: status?.status ?? "dispatched",
-    url: promotion.url
-  };
-  if (args.includes("--json"))
-    console.log(JSON.stringify(result, null, 2));
-  if (args.includes("--json"))
+  try {
+    const child = Bun.spawn(["gh", ...command], {
+      cwd: projectRoot,
+      stderr: "pipe",
+      stdin: "inherit",
+      stdout: "pipe"
+    });
+    const [exitCode, stderr] = await Promise.all([
+      child.exited,
+      new Response(child.stderr).text(),
+      new Response(child.stdout).text()
+    ]);
+    if (exitCode !== 0)
+      throw new TypeError(`GitHub promotion dispatch exited with status ${exitCode}: ${stderr.trim() || "unknown GitHub CLI error"}`);
+    const operation = await advanceAbsoluteMobilePromotionOperation(projectRoot, dispatchId3, { phase: "dispatched" });
+    sendTelemetryEvent("mobile:ci-promotion-dispatched", {
+      discovery: "correlated",
+      platform: platform2,
+      provider: "github-actions",
+      storeTarget: platform2 === "android" ? playTrack !== "registry-only" : testflightGroup !== ""
+    });
+    return await completeGithubMobilePromotion({
+      audit: operation.auditRequested,
+      json: args.includes("--json"),
+      operation,
+      projectRoot,
+      watch: operation.watchRequested
+    });
+  } catch (error) {
+    throw promotionRecoveryError(error, dispatchId3);
+  }
+};
+var resumeGithubMobilePromotion = async (args, dispatchId3) => {
+  const projectRoot = process.cwd();
+  const startedAt = performance.now();
+  let resumedPhase = "unread";
+  try {
+    const operation = await readAbsoluteMobilePromotionOperation(projectRoot, dispatchId3);
+    resumedPhase = operation.phase;
+    const audit = args.includes("--audit") || operation.auditRequested;
+    const watch = args.includes("--watch") || audit || operation.watchRequested;
+    if (!args.includes("--json"))
+      console.log(`Resuming ${operation.platform} promotion ${operation.dispatchId} from ${operation.phase}.`);
+    const result = await completeGithubMobilePromotion({
+      audit,
+      auditOutputDirectory: valueAfter(args, "--outdir"),
+      json: args.includes("--json"),
+      operation,
+      projectRoot,
+      watch
+    });
+    sendTelemetryEvent("mobile:ci-promotion-resumed", {
+      durationMs: Math.round(performance.now() - startedAt),
+      phase: resumedPhase,
+      provider: "github-actions",
+      success: true
+    });
     return result;
-  if (status)
-    renderGithubMobileRunStatus(status);
-  if (audited)
-    renderGithubMobilePromotionAudit(audited, projectRoot);
-  return result;
+  } catch (error) {
+    sendTelemetryEvent("mobile:ci-promotion-resumed", {
+      durationMs: Math.round(performance.now() - startedAt),
+      phase: resumedPhase,
+      provider: "github-actions",
+      success: false
+    });
+    throw promotionRecoveryError(error, dispatchId3);
+  }
+};
+var listGithubMobilePromotions = async (args) => {
+  const projectRoot = process.cwd();
+  const operations = await listAbsoluteMobilePromotionOperations(projectRoot);
+  if (args.includes("--json")) {
+    console.log(JSON.stringify(operations, null, 2));
+    return operations;
+  }
+  if (operations.length === 0) {
+    console.log("No local mobile promotion operations were found.");
+    return operations;
+  }
+  operations.forEach((operation) => {
+    console.log(`${operation.dispatchId}  ${operation.platform}  ${operation.phase}  ${operation.releaseId}`);
+    console.log(`  source ${operation.sourceRunId}${operation.runId ? ` \u2192 promotion ${operation.runId}` : ""}`);
+    if (operation.url)
+      console.log(`  ${operation.url}`);
+    if (operation.phase !== "audited")
+      console.log(`  Resume: ${promotionRecoveryCommand(operation.dispatchId)}`);
+  });
+  return operations;
 };
 var githubMobileRunId = (args) => {
   const value = valueAfter(args, "--run-id");
@@ -25332,7 +25716,7 @@ var inspectGithubMobileRun = async (args) => {
 };
 var renderGithubMobilePromotionAudit = (result, projectRoot) => {
   console.log(`\u2713 Verified ${result.audit.platform} promotion ${result.audit.github.promotionRunId} for ${result.audit.release.releaseId}.`);
-  console.log(`Audit: ${relative16(projectRoot, result.directory)}`);
+  console.log(`Audit: ${relative17(projectRoot, result.directory)}`);
 };
 var auditGithubMobilePromotion = async (args) => {
   const projectRoot = process.cwd();
@@ -25464,9 +25848,9 @@ var prepareExpoMobileUpdateExport = async (options) => {
       temporaryDirectory: undefined
     };
   await ensureExpoPackages(mobile.nativeProjectDirectory, options.args);
-  const temporaryParent = join18(options.projectRoot, ".absolutejs", "mobile", "expo-update-exports");
-  await mkdir18(temporaryParent, { recursive: true });
-  const temporaryDirectory = await mkdtemp7(join18(temporaryParent, ".stage-"));
+  const temporaryParent = join19(options.projectRoot, ".absolutejs", "mobile", "expo-update-exports");
+  await mkdir19(temporaryParent, { recursive: true });
+  const temporaryDirectory = await mkdtemp7(join19(temporaryParent, ".stage-"));
   try {
     await runExpo(mobile.nativeProjectDirectory, [
       "export",
@@ -25478,9 +25862,9 @@ var prepareExpoMobileUpdateExport = async (options) => {
       temporaryDirectory,
       "--clear"
     ], { production: true });
-    const generatedApp = JSON.parse(await readFile22(join18(mobile.nativeProjectDirectory, "app.json"), "utf8"));
-    const expoConfig = isRecord10(generatedApp) ? generatedApp.expo : undefined;
-    if (!isRecord10(expoConfig))
+    const generatedApp = JSON.parse(await readFile23(join19(mobile.nativeProjectDirectory, "app.json"), "utf8"));
+    const expoConfig = isRecord11(generatedApp) ? generatedApp.expo : undefined;
+    if (!isRecord11(expoConfig))
       throw new TypeError("Generated Expo app configuration is invalid.");
     const publicExpoConfig = expoPublicConfig(expoConfig);
     const computedRuntime = resolveAbsoluteMobileUpdateRuntime(mobile, options.projectRoot).fingerprint;
@@ -25496,7 +25880,7 @@ var prepareExpoMobileUpdateExport = async (options) => {
       temporaryDirectory
     };
   } catch (error) {
-    await rm10(temporaryDirectory, { force: true, recursive: true });
+    await rm11(temporaryDirectory, { force: true, recursive: true });
     throw error;
   }
 };
@@ -25521,11 +25905,11 @@ var buildMobileUpdate = async (args) => {
   let expoExportDirectory;
   try {
     await start(mobileBuildServerEntry(args), valueAfter(args, "--web-outdir"), configPath, { prepareOnly: true });
-    const embedded = JSON.parse(await readFile22(join18(mobile.bundleDirectory, "absolute-mobile-manifest.json"), "utf8"));
-    const runtimeFingerprint = isRecord10(embedded) ? embedded.nativeRuntime : undefined;
+    const embedded = JSON.parse(await readFile23(join19(mobile.bundleDirectory, "absolute-mobile-manifest.json"), "utf8"));
+    const runtimeFingerprint = isRecord11(embedded) ? embedded.nativeRuntime : undefined;
     if (typeof runtimeFingerprint !== "string" || !/^[a-f0-9]{64}$/u.test(runtimeFingerprint))
       throw new TypeError("Prepared mobile bundle is missing its native runtime fingerprint.");
-    const privateKey = await readFile22(resolve17(projectRoot, signingKeyPath));
+    const privateKey = await readFile23(resolve18(projectRoot, signingKeyPath));
     const configuredPublicKey = Buffer.from(mobile.updates.publicKeys[keyId], "base64");
     const derivedPublicKey = createPublicKey2(privateKey).export({
       format: "der",
@@ -25546,7 +25930,7 @@ var buildMobileUpdate = async (args) => {
       channel: mobile.updates.channel,
       classification,
       keyId,
-      outputDirectory: valueAfter(args, "--outdir") ?? join18(projectRoot, ".absolutejs", "mobile", "updates"),
+      outputDirectory: valueAfter(args, "--outdir") ?? join19(projectRoot, ".absolutejs", "mobile", "updates"),
       privateKey,
       runtimeFingerprint
     });
@@ -25558,7 +25942,7 @@ var buildMobileUpdate = async (args) => {
     return result;
   } finally {
     if (expoExportDirectory)
-      await rm10(expoExportDirectory, { force: true, recursive: true });
+      await rm11(expoExportDirectory, { force: true, recursive: true });
     sendTelemetryEvent("mobile:update-build", {
       classification: classification ?? "invalid",
       durationMs: Math.round(performance.now() - startedAt),
@@ -25588,7 +25972,7 @@ var generateExpoUpdateSigning = async (args) => {
     ...valueAfter(args, "--public-key") ? { publicKeyPath: valueAfter(args, "--public-key") } : {},
     ...validityYears === undefined ? {} : { validityYears }
   });
-  const certificatePath = relative16(projectRoot, result.certificatePath).replaceAll("\\", "/");
+  const certificatePath = relative17(projectRoot, result.certificatePath).replaceAll("\\", "/");
   sendTelemetryEvent("mobile:update-code-signing-generated", {
     engine: "expo",
     validityYears: validityYears ?? 10
@@ -25650,7 +26034,7 @@ var provisionMobileUpdate = async (args) => {
     publicKeys: mobile.updates.publicKeys,
     storage: requestedStorage
   });
-  console.log(`Provisioned ${requestedStorage === "local" ? "local development" : "durable S3-compatible"} mobile update storage in ${relative16(projectRoot, path).replaceAll("\\", "/")}.`);
+  console.log(`Provisioned ${requestedStorage === "local" ? "local development" : "durable S3-compatible"} mobile update storage in ${relative17(projectRoot, path).replaceAll("\\", "/")}.`);
   if (requestedStorage === "local")
     console.log("Production release checks will require durable storage. Re-run with --storage s3 --force before deploying.");
   else
@@ -26127,7 +26511,7 @@ var buildAndroid = async (args, prepareVersionCode) => {
     const durationMs = Math.round(performance.now() - startedAt);
     console.log(`Built ${release.metadata.signed ? "signed" : "unsigned"} Android App Bundle in ${getDurationString(durationMs)}.`);
     console.log(`Artifact: ${release.artifactPath}`);
-    console.log(`Metadata: ${join18(release.releaseRoot, "release.json")}`);
+    console.log(`Metadata: ${join19(release.releaseRoot, "release.json")}`);
     return release;
   } finally {
     sendTelemetryEvent("mobile:android-release-build", {
@@ -26350,7 +26734,7 @@ var buildIos = async (args, prepareBuildNumber) => {
     console.log(`Artifact: ${release.artifactPath}`);
     if (release.registeredArtifactPath)
       console.log(`Registered-device artifact: ${release.registeredArtifactPath}`);
-    console.log(`Metadata: ${join18(release.releaseRoot, "release.json")}`);
+    console.log(`Metadata: ${join19(release.releaseRoot, "release.json")}`);
     return release;
   } finally {
     stopListeningForCancellation();
@@ -26501,7 +26885,7 @@ var appendSyncSchemaDoctorCheck = (checks, projectRoot) => {
     checks.push({
       id: "sync.storage-schema",
       label: `Offline schema ${schema.components.map((component) => `${component.id}@${component.version}`).join(", ")}`,
-      path: join18(projectRoot, "package.json"),
+      path: join19(projectRoot, "package.json"),
       platform: "host",
       status: "pass"
     });
@@ -26509,7 +26893,7 @@ var appendSyncSchemaDoctorCheck = (checks, projectRoot) => {
     checks.push({
       id: "sync.storage-schema",
       label: "Offline schema metadata is invalid",
-      path: join18(projectRoot, "package.json"),
+      path: join19(projectRoot, "package.json"),
       platform: "host",
       remediation: error instanceof Error ? error.message : String(error),
       status: "fail"
@@ -26597,7 +26981,7 @@ var requireAndroidTestPort = (args, projectRoot) => {
     }
     return { https: args.includes("--https"), port };
   }
-  const instances = listLiveInstances().filter((instance2) => resolve17(instance2.cwd) === resolve17(projectRoot) && instance2.source === "dev" && instance2.port !== null);
+  const instances = listLiveInstances().filter((instance2) => resolve18(instance2.cwd) === resolve18(projectRoot) && instance2.source === "dev" && instance2.port !== null);
   if (instances.length !== 1) {
     throw new TypeError(instances.length === 0 ? "No running AbsoluteJS dev server was found for this project. Start `bun dev`, wait for Android to report ready, then run `absolute mobile test android`." : "Multiple dev servers are running for this project. Select one with mobile test android --port <port>.");
   }
@@ -26691,8 +27075,8 @@ var selectOrStartAndroidReleaseEmulator = async (adb2, emulator, explicitSerial,
   return waitForBoot();
 };
 var safeArtifactRoot = (projectRoot, value) => {
-  const root = resolve17(projectRoot, value ?? ".absolutejs/mobile/test-artifacts");
-  if (root !== projectRoot && !root.startsWith(`${resolve17(projectRoot)}/`)) {
+  const root = resolve18(projectRoot, value ?? ".absolutejs/mobile/test-artifacts");
+  if (root !== projectRoot && !root.startsWith(`${resolve18(projectRoot)}/`)) {
     throw new TypeError("mobile test --artifacts must remain inside the project.");
   }
   return root;
@@ -26720,11 +27104,11 @@ var waitForRequestedAndroidHmr = async (args, session, checks, timeoutMs) => {
   });
 };
 var writeAndroidFailureArtifacts = async (options) => {
-  await mkdir18(options.artifactRoot, { recursive: true });
-  const screenshot = options.session ? await options.session.screenshot(join18(options.artifactRoot, "android-failure.png")).catch(() => {
+  await mkdir19(options.artifactRoot, { recursive: true });
+  const screenshot = options.session ? await options.session.screenshot(join19(options.artifactRoot, "android-failure.png")).catch(() => {
     return;
   }) : undefined;
-  const diagnosticPath = join18(options.artifactRoot, "android-failure.json");
+  const diagnosticPath = join19(options.artifactRoot, "android-failure.json");
   await writeFile19(diagnosticPath, `${JSON.stringify({
     diagnostics: options.session?.diagnostics ?? [],
     error: options.error instanceof Error ? options.error.message : String(options.error),
@@ -26800,7 +27184,7 @@ var testAndroidRelease = async (args, mobile, projectRoot) => {
       release,
       serial
     });
-    const screenshot = reportRoot ? await captureAndroidReleaseScreenshot(adb2, serial, join18(reportRoot, "android-release.png")) : undefined;
+    const screenshot = reportRoot ? await captureAndroidReleaseScreenshot(adb2, serial, join19(reportRoot, "android-release.png")) : undefined;
     sendTelemetryEvent("mobile:android-release-conformance", {
       durationMs: result.durationMs,
       engine: result.engine,
@@ -26847,8 +27231,8 @@ var testAndroidRelease = async (args, mobile, projectRoot) => {
       platform: "android",
       success: false
     });
-    await mkdir18(artifactRoot, { recursive: true });
-    const diagnosticPath = join18(artifactRoot, "android-release-failure.json");
+    await mkdir19(artifactRoot, { recursive: true });
+    const diagnosticPath = join19(artifactRoot, "android-release-failure.json");
     await writeFile19(diagnosticPath, `${JSON.stringify({
       error: sanitizeNativeReportText(error instanceof Error ? error.message : String(error)),
       platform: "android",
@@ -26943,7 +27327,7 @@ var testAndroid = async (args) => {
       console.log(JSON.stringify(report, null, 2));
     else
       printAndroidTestReport(report);
-    const screenshot = reportRoot ? await session.screenshot(join18(artifactRoot, "android-emulator.png")) : undefined;
+    const screenshot = reportRoot ? await session.screenshot(join19(artifactRoot, "android-emulator.png")) : undefined;
     await writeRequestedAndroidReport({
       adb: adb2,
       args,
@@ -27012,14 +27396,14 @@ var requireIosTestContext = (args, projectRoot) => {
     const port = Number(explicit);
     if (!Number.isInteger(port) || port < 1 || port > 65535)
       throw new TypeError("mobile test --port must be a valid TCP port.");
-    const instance2 = listLiveInstances().find((candidate) => resolve17(candidate.cwd) === resolve17(projectRoot) && candidate.source === "dev" && candidate.port === port);
+    const instance2 = listLiveInstances().find((candidate) => resolve18(candidate.cwd) === resolve18(projectRoot) && candidate.source === "dev" && candidate.port === port);
     return {
       https: instance2?.https ?? args.includes("--https"),
       instance: instance2,
       port
     };
   }
-  const instances = listLiveInstances().filter((instance2) => resolve17(instance2.cwd) === resolve17(projectRoot) && instance2.source === "dev" && instance2.port !== null);
+  const instances = listLiveInstances().filter((instance2) => resolve18(instance2.cwd) === resolve18(projectRoot) && instance2.source === "dev" && instance2.port !== null);
   if (instances.length !== 1)
     throw new TypeError(instances.length === 0 ? "No running AbsoluteJS dev server was found for this project. Start `bun dev`, wait for iOS to report ready, then run `absolute mobile test ios`." : "Multiple dev servers are running for this project. Select one with mobile test ios --port <port>.");
   const [instance] = instances;
@@ -27037,7 +27421,7 @@ var waitForIosHmrClient = async (options) => {
       return;
     });
     const status = response?.ok ? await response.json().catch(() => null) : null;
-    const targets = isRecord10(status) && isRecord10(status.connectedTargets) ? status.connectedTargets : undefined;
+    const targets = isRecord11(status) && isRecord11(status.connectedTargets) ? status.connectedTargets : undefined;
     if (targets && typeof targets["capacitor-ios"] === "number" && targets["capacitor-ios"] > 0)
       return;
     await Bun.sleep(100);
@@ -27163,8 +27547,8 @@ var requireCapturedCommand = (command, label) => {
   return result;
 };
 var writeIosFailureArtifacts = async (options) => {
-  await mkdir18(options.artifactRoot, { recursive: true });
-  const screenshot = join18(options.artifactRoot, "ios-failure.png");
+  await mkdir19(options.artifactRoot, { recursive: true });
+  const screenshot = join19(options.artifactRoot, "ios-failure.png");
   const screenshotResult = captureCommand4([
     options.xcrun,
     "simctl",
@@ -27173,7 +27557,7 @@ var writeIosFailureArtifacts = async (options) => {
     "screenshot",
     screenshot
   ]);
-  const diagnosticPath = join18(options.artifactRoot, "ios-failure.json");
+  const diagnosticPath = join19(options.artifactRoot, "ios-failure.json");
   await writeFile19(diagnosticPath, `${JSON.stringify({
     appId: options.appId,
     error: options.error instanceof Error ? options.error.message : String(options.error),
@@ -27195,14 +27579,14 @@ var nativeReportRoot = (args, projectRoot, platform2) => {
     return;
   const candidate = args[index + 1];
   const explicit = candidate?.startsWith("--") ? undefined : candidate;
-  const timestamp = new Date().toISOString().replaceAll(":", "-");
-  return safeArtifactRoot(projectRoot, explicit ?? `.absolutejs/mobile/test-reports/${platform2}-${timestamp}`);
+  const timestamp2 = new Date().toISOString().replaceAll(":", "-");
+  return safeArtifactRoot(projectRoot, explicit ?? `.absolutejs/mobile/test-reports/${platform2}-${timestamp2}`);
 };
 var absolutejsVersionForReport = async () => {
   let absolutejsVersion = process.env.ABSOLUTE_VERSION ?? "unknown";
   const versions = await Promise.all([
-    resolve17(import.meta.dir, "..", "..", "package.json"),
-    resolve17(import.meta.dir, "..", "..", "..", "package.json")
+    resolve18(import.meta.dir, "..", "..", "package.json"),
+    resolve18(import.meta.dir, "..", "..", "..", "package.json")
   ].map((candidate) => readPackageVersionForIosReport(candidate).catch(() => "unknown")));
   for (const version of versions) {
     if (version === "unknown")
@@ -27579,8 +27963,8 @@ var testIosRelease = async (args, mobile, projectRoot) => {
       remote: remoteProfile !== undefined,
       success: false
     });
-    await mkdir18(artifactRoot, { recursive: true });
-    const diagnosticPath = join18(artifactRoot, "ios-release-failure.json");
+    await mkdir19(artifactRoot, { recursive: true });
+    const diagnosticPath = join19(artifactRoot, "ios-release-failure.json");
     await writeFile19(diagnosticPath, `${JSON.stringify({
       error: sanitizeIosReportText(error instanceof Error ? error.message : String(error)),
       platform: "ios",
@@ -27674,8 +28058,8 @@ var testIos = async (args) => {
       mobile.appId
     ], "iOS app launch");
     await waitForIosHmrClient({ https, port, timeoutMs });
-    await mkdir18(artifactRoot, { recursive: true });
-    const screenshot = join18(artifactRoot, "ios-simulator.png");
+    await mkdir19(artifactRoot, { recursive: true });
+    const screenshot = join19(artifactRoot, "ios-simulator.png");
     requireCapturedCommand([xcrun, "simctl", "io", simulator.udid, "screenshot", screenshot], "iOS simulator screenshot");
     const hmrApply = await waitForRequestedIosHmr(args, instance, timeoutMs);
     const report = {
@@ -27892,6 +28276,8 @@ var runMobile = async (args) => {
   if (command === "ci") {
     if (args[1] === "promote")
       await dispatchGithubMobilePromotion(args.slice(2));
+    else if (args[1] === "promotions")
+      await listGithubMobilePromotions(args.slice(2));
     else if (args[1] === "status")
       await inspectGithubMobileRun(args.slice(2));
     else if (args[1] === "audit")
@@ -27978,7 +28364,7 @@ var runMobile = async (args) => {
     await publishIos(args.slice(2));
     return;
   }
-  throw new TypeError("Usage: absolute mobile <pair mac <name> <user@host> [--port n] [--workspace path] | remotes [inspect [name] [--json] | clean [name] --yes | --json] | unpair mac <name> | init [--no-native] [--force] | sync [ios|android] | inspect [--json] [--require-bundle] | certify <release-dir> [--evidence report-dir]... [--require installed|simulator|device|store] [--outdir dir] [--json] | certify <release-dir> --verify certification-dir [--require installed|simulator|device|store] [--json] | associations [--outdir dir] [--verify] | ci github [server-entry] [--publish] [--registry module] [--secret-env NAME] [--output path] [--force] [--json] | ci promote <android|ios> --run-id id --certification path [--channel name] [--play-track track|--testflight-group group] [--ref branch] [--repo owner/name] [--watch] [--audit] [--outdir path] [--json] | ci status --run-id id [--watch] [--repo owner/name] [--json] | ci audit --run-id id [--source-run-id id] [--repo owner/name] [--outdir path] [--json] | doctor [ios|android|release [ios|android]] [--remote name] [--json|--fix [--yes]] | build <android|ios> [server-entry] [--remote name] [--registered-device-artifact] [--outdir dir] [--web-outdir dir] [--unsigned] | update provision [--storage local|s3] [--registry module] [--force] [--yes] | update signing generate --private-key path [--certificate path] [--public-key path] [--key-id id] [--common-name name] [--validity-years n] | update build [server-entry] --classification bug-fix|content|security --key-id id --signing-key path --within-submitted-purpose [--outdir dir] [--web-outdir dir] | update publish <release-directory> [--rollout fraction] [--registry module] | update promote --release id --rollout fraction [--registry module] | update rollback [--release id] [--registry module] | update status [--registry module] [--json] | update advance [--rollout fraction] [--registry module] [--json] | update pause|resume|cancel|reconcile [--registry module] [--json] | update storage [--retain count] [--min-age-days days] [--registry module] [--json] | update gc [--retain count] [--min-age-days days] [--grace-days days] [--apply] [--registry module] [--json] | publish android [server-entry] [--release release-dir] [--certification certification-dir] [--certification-attestation verification-json] [--registry module] [--channel name] [--play-track track] [--play-status completed|draft|halted|in-progress] [--play-rollout fraction] [--play-name name] [--play-notes language=text] [--play-update-priority 0..5] [--play-hold-review] [--play-cancel-existing-review] [--outdir dir] [--web-outdir dir] [--unsigned] | publish ios [server-entry] [--release release-dir] [--certification certification-dir] [--certification-attestation verification-json] [--remote name] [--registry module] [--channel name] [--testflight-group name-or-id] [--testflight-notes locale=text] [--testflight-submit-review] [--outdir dir] [--web-outdir dir] [--unsigned] | test android [--release release-dir [--yes] | --route path [--wait-for-hmr] [--port n]] [--report [dir]] [--serial id] [--artifacts dir] [--json] [--config path] | test ios [--release release-dir [--remote name] [--device id [--testflight] --yes] | --wait-for-hmr] [--report [dir]] [--udid id] [--artifacts dir] [--json] [--config path]");
+  throw new TypeError("Usage: absolute mobile <pair mac <name> <user@host> [--port n] [--workspace path] | remotes [inspect [name] [--json] | clean [name] --yes | --json] | unpair mac <name> | init [--no-native] [--force] | sync [ios|android] | inspect [--json] [--require-bundle] | certify <release-dir> [--evidence report-dir]... [--require installed|simulator|device|store] [--outdir dir] [--json] | certify <release-dir> --verify certification-dir [--require installed|simulator|device|store] [--json] | associations [--outdir dir] [--verify] | ci github [server-entry] [--publish] [--registry module] [--secret-env NAME] [--output path] [--force] [--json] | ci promote <android|ios> --run-id id --certification path [--channel name] [--play-track track|--testflight-group group] [--ref branch] [--repo owner/name] [--watch] [--audit] [--outdir path] [--json] | ci promote --resume dispatch-id [--watch] [--audit] [--outdir path] [--json] | ci promotions [--json] | ci status --run-id id [--watch] [--repo owner/name] [--json] | ci audit --run-id id [--source-run-id id] [--repo owner/name] [--outdir path] [--json] | doctor [ios|android|release [ios|android]] [--remote name] [--json|--fix [--yes]] | build <android|ios> [server-entry] [--remote name] [--registered-device-artifact] [--outdir dir] [--web-outdir dir] [--unsigned] | update provision [--storage local|s3] [--registry module] [--force] [--yes] | update signing generate --private-key path [--certificate path] [--public-key path] [--key-id id] [--common-name name] [--validity-years n] | update build [server-entry] --classification bug-fix|content|security --key-id id --signing-key path --within-submitted-purpose [--outdir dir] [--web-outdir dir] | update publish <release-directory> [--rollout fraction] [--registry module] | update promote --release id --rollout fraction [--registry module] | update rollback [--release id] [--registry module] | update status [--registry module] [--json] | update advance [--rollout fraction] [--registry module] [--json] | update pause|resume|cancel|reconcile [--registry module] [--json] | update storage [--retain count] [--min-age-days days] [--registry module] [--json] | update gc [--retain count] [--min-age-days days] [--grace-days days] [--apply] [--registry module] [--json] | publish android [server-entry] [--release release-dir] [--certification certification-dir] [--certification-attestation verification-json] [--registry module] [--channel name] [--play-track track] [--play-status completed|draft|halted|in-progress] [--play-rollout fraction] [--play-name name] [--play-notes language=text] [--play-update-priority 0..5] [--play-hold-review] [--play-cancel-existing-review] [--outdir dir] [--web-outdir dir] [--unsigned] | publish ios [server-entry] [--release release-dir] [--certification certification-dir] [--certification-attestation verification-json] [--remote name] [--registry module] [--channel name] [--testflight-group name-or-id] [--testflight-notes locale=text] [--testflight-submit-review] [--outdir dir] [--web-outdir dir] [--unsigned] | test android [--release release-dir [--yes] | --route path [--wait-for-hmr] [--port n]] [--report [dir]] [--serial id] [--artifacts dir] [--json] [--config path] | test ios [--release release-dir [--remote name] [--device id [--testflight] --yes] | --wait-for-hmr] [--report [dir]] [--udid id] [--artifacts dir] [--json] [--config path]");
 };
 export {
   runMobile