@absolutejs/absolute 0.20.0-beta.32 → 0.20.0-beta.33

package/dist/cli/index.js

@@ -1290,11 +1290,16 @@ import {
   sep,
   win32
 } from "path";
-var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_FORMAT = 1, NATIVE_CACHE_FORMAT = 1, HASH_RADIX = 16, EXECUTABLE_MODE_MASK = 73, NATIVE_PUBLIC_PATH_SEGMENTS = 5, CAPACITOR_PROJECT_DIRECTORY_PATTERN, ANDROID_TIMING_PHASES, androidTimingSummary = (timings) => ANDROID_TIMING_PHASES.map(([phase, label]) => {
+var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_FORMAT = 1, NATIVE_CACHE_FORMAT = 1, HASH_RADIX = 16, EXECUTABLE_MODE_MASK = 73, NATIVE_PUBLIC_PATH_SEGMENTS = 5, CAPACITOR_PROJECT_DIRECTORY_PATTERN, ANDROID_TIMING_PHASES, androidTimingSummary = (timings, physicalDevice = false) => ANDROID_TIMING_PHASES.map(([phase, label]) => {
   const duration = timings[phase];
   if (duration === undefined || label === undefined)
     return null;
-  return `${label} ${getDurationString(duration)}`;
+  let phaseLabel = label;
+  if (physicalDevice && phase === "booting")
+    phaseLabel = "device selection";
+  if (physicalDevice && phase === "forwarding")
+    phaseLabel = "LAN transport";
+  return `${phaseLabel} ${getDurationString(duration)}`;
 }).filter((value) => value !== null).join(", "), pathExists2 = async (path) => {
   try {
     await access3(path);
@@ -1454,8 +1459,10 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
   const root = join7(projectRoot, ".absolutejs", "mobile", "dev-session");
   return {
     backup: join7(root, "capacitor.config.backup.json"),
+    caBackup: join7(root, "absolutejs_dev_ca.backup.pem"),
     journal: join7(root, "journal.json"),
     manifestBackup: join7(root, "AndroidManifest.backup.xml"),
+    networkConfigBackup: join7(root, "absolutejs_dev_network_security.backup.xml"),
     root
   };
 }, isInside = (root, path) => {
@@ -1565,19 +1572,31 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
   const manifestBackupPath = Reflect.get(value, "manifestBackupPath");
   const nativeConfigPath = Reflect.get(value, "nativeConfigPath");
   const nativeManifestPath = Reflect.get(value, "nativeManifestPath");
+  const projectedFiles = Reflect.get(value, "projectedFiles");
   if (typeof backupPath !== "string" || format !== DEV_JOURNAL_FORMAT || typeof nativeConfigPath !== "string") {
     return null;
   }
   if ((manifestBackupPath !== undefined || nativeManifestPath !== undefined) && (typeof manifestBackupPath !== "string" || typeof nativeManifestPath !== "string")) {
     return null;
   }
+  if (projectedFiles !== undefined && (!Array.isArray(projectedFiles) || !projectedFiles.every((file) => isRecord(file) && typeof file.path === "string" && (file.backupPath === undefined || typeof file.backupPath === "string")))) {
+    return null;
+  }
   return {
     backupPath,
     format,
     manifestBackupPath,
     nativeConfigPath,
-    nativeManifestPath
+    nativeManifestPath,
+    projectedFiles
   };
+}, restoreAndroidProjectedFile = async (file) => {
+  if (!file.backupPath || !await pathExists2(file.backupPath)) {
+    await rm(file.path, { force: true });
+    return;
+  }
+  await mkdir(dirname3(file.path), { recursive: true });
+  await copyFile(file.backupPath, file.path);
 }, repairAbsoluteAndroidDevSession = async (projectRoot) => {
   const paths = journalPaths(projectRoot);
   if (!await pathExists2(paths.journal)) {
@@ -1585,7 +1604,7 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
     return false;
   }
   const journal = await readFile2(paths.journal, "utf8").then((source) => parseJournal(JSON.parse(source))).catch(() => null);
-  if (!journal || !isInside(projectRoot, journal.nativeConfigPath) || !isInside(paths.root, journal.backupPath) || journal.nativeManifestPath !== undefined && !isInside(projectRoot, journal.nativeManifestPath) || journal.manifestBackupPath !== undefined && !isInside(paths.root, journal.manifestBackupPath)) {
+  if (!journal || !isInside(projectRoot, journal.nativeConfigPath) || !isInside(paths.root, journal.backupPath) || journal.nativeManifestPath !== undefined && !isInside(projectRoot, journal.nativeManifestPath) || journal.manifestBackupPath !== undefined && !isInside(paths.root, journal.manifestBackupPath) || journal.projectedFiles?.some((file) => !isInside(projectRoot, file.path) || file.backupPath !== undefined && !isInside(paths.root, file.backupPath))) {
     throw new Error(`Refusing unsafe or invalid mobile dev journal at ${paths.journal}.`);
   }
   if (await pathExists2(journal.backupPath)) {
@@ -1596,17 +1615,51 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
     await mkdir(dirname3(journal.nativeManifestPath), { recursive: true });
     await copyFile(journal.manifestBackupPath, journal.nativeManifestPath);
   }
+  await Promise.all((journal.projectedFiles ?? []).map(restoreAndroidProjectedFile));
   await rm(paths.root, { force: true, recursive: true });
   return true;
-}, androidDevelopmentManifest = (source, cleartext) => {
+}, setAndroidApplicationAttribute = (source, attribute, value) => {
+  const pattern = new RegExp(`android:${attribute}=["'][^"']*["']`, "u");
+  if (pattern.test(source))
+    return source.replace(pattern, `android:${attribute}="${value}"`);
+  return source.replace("<application", `<application
+        android:${attribute}="${value}"`);
+}, androidDevelopmentManifest = (source, cleartext, developmentNetworkConfig) => {
+  let projected = source;
+  if (developmentNetworkConfig) {
+    projected = setAndroidApplicationAttribute(projected, "networkSecurityConfig", `@xml/${developmentNetworkConfig}`);
+  }
   if (!cleartext)
-    return source;
+    return projected;
   if (/android:usesCleartextTraffic=["'][^"']*["']/u.test(source)) {
-    return source.replace(/android:usesCleartextTraffic=["'][^"']*["']/u, 'android:usesCleartextTraffic="true"');
+    return projected.replace(/android:usesCleartextTraffic=["'][^"']*["']/u, 'android:usesCleartextTraffic="true"');
   }
-  return source.replace("<application", `<application
-        android:usesCleartextTraffic="true"`);
-}, writeDevConfig = async (projectRoot, nativeConfigPath, nativeManifestPath, port, https, entry, embeddedBundle) => {
+  return setAndroidApplicationAttribute(projected, "usesCleartextTraffic", "true");
+}, withAndroidDebugCertificateAuthority = (source) => {
+  if (source.includes("@raw/absolutejs_dev_ca"))
+    return source;
+  const debugOverrides = /<debug-overrides(?:\s[^>]*)?>([\s\S]*?)<\/debug-overrides>/u;
+  const match = source.match(debugOverrides);
+  if (match) {
+    const [block] = match;
+    const trustAnchors = /<trust-anchors(?:\s[^>]*)?>/u;
+    const projectedBlock = trustAnchors.test(block) ? block.replace(trustAnchors, `$&
+			<certificates src="@raw/absolutejs_dev_ca" />`) : block.replace("</debug-overrides>", `	<trust-anchors>
+			<certificates src="@raw/absolutejs_dev_ca" />
+		</trust-anchors>
+	</debug-overrides>`);
+    return source.replace(block, projectedBlock);
+  }
+  if (!source.includes("</network-security-config>")) {
+    throw new Error("Android Network Security Configuration is invalid.");
+  }
+  return source.replace("</network-security-config>", `	<debug-overrides>
+		<trust-anchors>
+			<certificates src="@raw/absolutejs_dev_ca" />
+		</trust-anchors>
+	</debug-overrides>
+</network-security-config>`);
+}, writeDevConfig = async (projectRoot, nativeConfigPath, nativeManifestPath, port, https, entry, embeddedBundle, serverHost, certificateAuthorityPath) => {
   const paths = journalPaths(projectRoot);
   await repairAbsoluteAndroidDevSession(projectRoot);
   const source = await readFile2(nativeConfigPath, "utf8");
@@ -1618,12 +1671,28 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
   await mkdir(paths.root, { recursive: true });
   await writeFile2(paths.backup, source, { flag: "wx" });
   await writeFile2(paths.manifestBackup, manifestSource, { flag: "wx" });
+  const resourceRoot = join7(dirname3(nativeManifestPath), "res");
+  const caPath = join7(resourceRoot, "raw", "absolutejs_dev_ca.pem");
+  const existingNetworkConfig = manifestSource.match(/android:networkSecurityConfig=["']@xml\/([a-z0-9_]+)["']/u)?.[1];
+  const networkConfigName = existingNetworkConfig ?? "absolutejs_dev_network_security";
+  const networkConfigPath = join7(resourceRoot, "xml", `${networkConfigName}.xml`);
+  const backupProjectedFile = async ([path, backupPath]) => {
+    if (!await pathExists2(path))
+      return { path };
+    await copyFile(path, backupPath);
+    return { backupPath, path };
+  };
+  const projectedFiles = https && certificateAuthorityPath ? await Promise.all([
+    [caPath, paths.caBackup],
+    [networkConfigPath, paths.networkConfigBackup]
+  ].map(backupProjectedFile)) : [];
   const journal = {
     backupPath: paths.backup,
     format: DEV_JOURNAL_FORMAT,
     manifestBackupPath: paths.manifestBackup,
     nativeConfigPath,
-    nativeManifestPath
+    nativeManifestPath,
+    projectedFiles
   };
   await writeFile2(paths.journal, `${JSON.stringify(journal, null, "\t")}
 `, {
@@ -1631,7 +1700,7 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
   });
   if (!embeddedBundle) {
     const currentServer = parsed.server;
-    const developmentUrl = new URL(`${https ? "https" : "http"}://localhost:${port}${entry}`);
+    const developmentUrl = new URL(`${https ? "https" : "http"}://${serverHost}:${port}${entry}`);
     developmentUrl.searchParams.set("__absolute_target", "capacitor-android");
     parsed.server = {
       ...typeof currentServer === "object" && currentServer !== null ? currentServer : {},
@@ -1641,7 +1710,19 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
   }
   await writeFile2(nativeConfigPath, `${JSON.stringify(parsed, null, "\t")}
 `);
-  await writeFile2(nativeManifestPath, androidDevelopmentManifest(manifestSource, !https));
+  if (https && certificateAuthorityPath) {
+    await Promise.all([
+      mkdir(dirname3(caPath), { recursive: true }),
+      mkdir(dirname3(networkConfigPath), { recursive: true })
+    ]);
+    await copyFile(certificateAuthorityPath, caPath);
+    const existingNetworkConfigSource = existingNetworkConfig ? await readFile2(networkConfigPath, "utf8") : `<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+</network-security-config>
+`;
+    await writeFile2(networkConfigPath, withAndroidDebugCertificateAuthority(existingNetworkConfigSource));
+  }
+  await writeFile2(nativeManifestPath, androidDevelopmentManifest(manifestSource, !https, https && certificateAuthorityPath !== undefined ? networkConfigName : undefined));
 }, parseAdbDevices = (output) => output.split(/\r?\n/).slice(1).map((line) => line.trim().split(/\s+/, 2)).filter((parts) => parts.length === 2 && parts[1] === "device").map(([serial]) => serial), isManagedEmulatorSerial = (serial, adb, capture, env) => {
   if (!serial.startsWith("emulator-"))
     return false;
@@ -1652,6 +1733,11 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
   if (devices.exitCode !== 0)
     return;
   return parseAdbDevices(devices.stdout).find((serial) => isManagedEmulatorSerial(serial, adb, capture, env));
+}, requireConnectedAndroidDevice = (adb, serial, capture, env) => {
+  const devices = capture([adb, "devices"], { env });
+  if (devices.exitCode !== 0 || !parseAdbDevices(devices.stdout).includes(serial)) {
+    throw new Error(`Android device ${serial} is not connected and authorized. Confirm the USB debugging prompt, then retry.`);
+  }
 }, completedBootSerial = (project, capture, env) => {
   const serial = managedEmulatorSerial(project.adb, capture, env);
   if (!serial)
@@ -1663,15 +1749,13 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
   return booted.exitCode === 0 && booted.stdout.trim() === "1" ? serial : undefined;
 }, waitForManagedEmulator = async (project, capture, sleep, env, signal, preferredSerial) => {
   const deadline = Date.now() + ANDROID_BOOT_TIMEOUT_MS;
-  let firstSerial = preferredSerial;
   const poll = async () => {
     throwIfAborted(signal);
-    const serial = firstSerial ? preferredCompletedBootSerial(project, firstSerial, capture, env) : completedBootSerial(project, capture, env);
-    firstSerial = undefined;
+    const serial = preferredSerial ? preferredCompletedBootSerial(project, preferredSerial, capture, env) : completedBootSerial(project, capture, env);
     if (serial)
       return serial;
     if (Date.now() >= deadline) {
-      throw new Error(`Android emulator ${ABSOLUTE_ANDROID_AVD_NAME} did not finish booting within ${ANDROID_BOOT_TIMEOUT_MS / ANDROID_BOOT_POLL_MS}s.`);
+      throw new Error(`Android ${preferredSerial ? `target ${preferredSerial}` : `emulator ${ABSOLUTE_ANDROID_AVD_NAME}`} did not finish booting within ${ANDROID_BOOT_TIMEOUT_MS / ANDROID_BOOT_POLL_MS}s.`);
     }
     await sleep(ANDROID_BOOT_POLL_MS);
     return poll();
@@ -1821,6 +1905,9 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
   await persistInstalledAndroidNativeCache(options, updated);
   return { nativeCacheHit: false, uid: updated?.uid };
 }, startManagedEmulatorIfNeeded = (project, capture, spawn, log, env) => {
+  if (!project.emulator) {
+    throw new Error("Android Emulator is unavailable. Select a physical device or run `absolute mobile doctor android --fix`.");
+  }
   const serial = managedEmulatorSerial(project.adb, capture, env);
   if (serial)
     return { serial, started: false };
@@ -1838,7 +1925,7 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
 }, logHttpsCertificateRequirement = (https, log) => {
   if (https !== true)
     return;
-  log("Android HMR is using HTTPS; the emulator must trust the local development certificate authority.");
+  log("Android HMR is using HTTPS; AbsoluteJS is projecting the local development CA into this debug app only.");
 }, removeAdbReverse = async (project, serial, port, run, env) => {
   if (!serial)
     return;
@@ -1937,13 +2024,19 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
   const host = detectAbsoluteMobileHost();
   const androidRoot = process.env.ANDROID_HOME ?? process.env.ANDROID_SDK_ROOT ?? absoluteManagedAndroidSdkRoot(host);
   const checks = await inspectAbsoluteMobileToolchain({ androidRoot, host });
-  const failed = checks.filter((check) => check.platform === "android" && (check.status === "fail" || check.status === "warn"));
+  const deviceOnlyChecks = new Set([
+    "android.avd",
+    "android.avdmanager",
+    "android.emulator",
+    "android.virtualization"
+  ]);
+  const failed = checks.filter((check) => check.platform === "android" && (check.status === "fail" || check.status === "warn") && (options.target !== "device" || !deviceOnlyChecks.has(check.id)));
   if (failed.length > 0) {
-    throw new Error(`Android emulation is not ready: ${failed.map(({ label }) => label).join(", ")}.`);
+    throw new Error(`Android ${options.target === "device" ? "device development" : "emulation"} is not ready: ${failed.map(({ label }) => label).join(", ")}.`);
   }
   const adb = checks.find((check) => check.id === "android.adb")?.path;
   const emulator = checks.find((check) => check.id === "android.emulator")?.path;
-  if (!adb || !emulator) {
+  if (!adb || options.target !== "device" && !emulator) {
     throw new Error("Android SDK tools disappeared after readiness checks.");
   }
   const cap = join7(projectRoot, "node_modules", ".bin", host === "windows" ? "cap.cmd" : "cap");
@@ -1974,7 +2067,7 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
     androidRoot,
     cap,
     config,
-    emulator,
+    ...emulator ? { emulator } : {},
     host,
     nativeDirectory,
     projectRoot
@@ -2030,7 +2123,11 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
     });
   };
   try {
-    await writeDevConfig(project.projectRoot, nativeConfigPath, nativeManifestPath, options.port, options.https === true, project.config.entry, options.embeddedBundle === true);
+    const physicalDevice = options.deviceSerial !== undefined;
+    if (options.https && !options.certificateAuthorityPath) {
+      throw new Error("Android HTTPS development requires the AbsoluteJS development CA certificate.");
+    }
+    await writeDevConfig(project.projectRoot, nativeConfigPath, nativeManifestPath, options.port, options.https === true, project.config.entry, options.embeddedBundle === true, options.serverHost ?? "localhost", options.certificateAuthorityPath);
     throwIfAborted(options.signal);
     logHttpsCertificateRequirement(options.https, log);
     const fingerprintStartedAt = performance.now();
@@ -2041,20 +2138,23 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
       return fingerprint;
     });
     transition("booting");
-    const emulator = startManagedEmulatorIfNeeded(project, capture, spawn, log, env);
+    if (options.deviceSerial)
+      requireConnectedAndroidDevice(project.adb, options.deviceSerial, capture, env);
+    const emulator = options.deviceSerial ? { serial: options.deviceSerial, started: false } : startManagedEmulatorIfNeeded(project, capture, spawn, log, env);
     const { started: startedEmulator } = emulator;
     transition("connecting");
     const serial = await waitForManagedEmulator(project, capture, sleep, env, options.signal, emulator.serial);
     connectedSerial = serial;
     transition("forwarding");
-    await requireSuccess([
-      project.adb,
-      "-s",
-      serial,
-      "reverse",
-      `tcp:${options.port}`,
-      `tcp:${options.port}`
-    ], "ADB reverse port forwarding", run, { env, signal: options.signal });
+    if (!physicalDevice)
+      await requireSuccess([
+        project.adb,
+        "-s",
+        serial,
+        "reverse",
+        `tcp:${options.port}`,
+        `tcp:${options.port}`
+      ], "ADB reverse port forwarding", run, { env, signal: options.signal });
     throwIfAborted(options.signal);
     const nativeFingerprint = await nativeFingerprintPromise;
     throwIfAborted(options.signal);
@@ -2085,8 +2185,8 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
     nativeLogs = attachAndroidNativeLogs(project, serial, capture, env, options, uid);
     transition("ready");
     phaseDurations.total = performance.now() - startupStartedAt;
-    log(options.embeddedBundle === true ? `Android emulator connected (${serial}) with the embedded bundle and backend on port ${options.port} in ${getDurationString(phaseDurations.total)} (${nativeCacheHit ? "native cache hit" : "native build installed"}).` : `Android emulator connected (${serial}) with HMR on port ${options.port} in ${getDurationString(phaseDurations.total)} (${nativeCacheHit ? "native cache hit" : "native build installed"}).`);
-    log(`Android startup: ${androidTimingSummary(phaseDurations)}.`);
+    log(options.embeddedBundle === true ? `Android ${physicalDevice ? "device" : "emulator"} connected (${serial}) with the embedded bundle and backend on port ${options.port} in ${getDurationString(phaseDurations.total)} (${nativeCacheHit ? "native cache hit" : "native build installed"}).` : `Android ${physicalDevice ? "device" : "emulator"} connected (${serial}) with HMR on port ${options.port} in ${getDurationString(phaseDurations.total)} (${nativeCacheHit ? "native cache hit" : "native build installed"}).`);
+    log(`Android startup: ${androidTimingSummary(phaseDurations, physicalDevice)}.`);
     let closed = false;
     const close = async () => {
       if (closed)
@@ -2094,7 +2194,8 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
       closed = true;
       transition("closing");
       await closeNativeLogs();
-      await removeAdbReverse(project, serial, options.port, run, env);
+      if (!physicalDevice)
+        await removeAdbReverse(project, serial, options.port, run, env);
       await repairAbsoluteAndroidDevSession(project.projectRoot);
       transition("closed");
     };
@@ -2133,7 +2234,8 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
   } catch (error) {
     transition("failed");
     await closeNativeLogs();
-    await removeAdbReverse(project, connectedSerial, options.port, run, env);
+    if (!options.deviceSerial)
+      await removeAdbReverse(project, connectedSerial, options.port, run, env);
     await repairAbsoluteAndroidDevSession(project.projectRoot);
     throw error;
   }
@@ -2848,6 +2950,21 @@ var ABSOLUTE_IOS_SIMULATOR_NAME = "AbsoluteJS iPhone", BOOT_TIMEOUT_MS = 180000,
   const exitCode = await run(command, options);
   if (exitCode !== 0)
     throw new Error(`${label} failed with status ${exitCode}.`);
+}, trustIosSimulatorDevelopmentCa = async (options, udid, run, log) => {
+  if (!options.https)
+    return;
+  if (!options.certificateAuthorityPath) {
+    throw new Error("iOS Simulator HTTPS requires the AbsoluteJS development CA certificate.");
+  }
+  await requireSuccess2([
+    options.project.xcrun,
+    "simctl",
+    "keychain",
+    udid,
+    "add-root-cert",
+    options.certificateAuthorityPath
+  ], "iOS Simulator development CA trust", run, { signal: options.signal });
+  log("Installed the AbsoluteJS development CA into this iOS Simulator trust store.");
 }, requireCapturedSuccess = (result, label) => {
   if (result.exitCode !== 0) {
     throw new Error(`${label} failed: ${result.stderr.trim() || result.stdout.trim() || `status ${result.exitCode}`}`);
@@ -3322,6 +3439,7 @@ var ABSOLUTE_IOS_SIMULATOR_NAME = "AbsoluteJS iPhone", BOOT_TIMEOUT_MS = 180000,
     transition("connecting");
     await waitForBootedSimulator(project, device.udid, capture, sleep, options.signal);
     await requireSuccess2([project.xcrun, "simctl", "bootstatus", device.udid, "-b"], "iOS simulator boot readiness", run, { signal: options.signal });
+    await trustIosSimulatorDevelopmentCa(options, device.udid, run, log);
     const fingerprint = await fingerprintPromise;
     transition("checking-native");
     const nativeCacheHit = await ensureIosDebugApp({
@@ -3806,6 +3924,7 @@ var PROFILE_FORMAT = 1, REMOTE_STDIN_FLUSH_ATTEMPTS = 3, PROFILE_NAME, SSH_DESTI
   await syncProject(options.project);
   const syncDuration = performance.now() - syncStartedAt;
   const encodedConfig = Buffer.from(JSON.stringify(portableMobileConfig(options.project))).toString("base64url");
+  const encodedCertificateAuthority = options.certificateAuthorityPath ? (await readFile6(options.certificateAuthorityPath)).toString("base64url") : undefined;
   const remoteCommand = [
     `cd ${shellQuote(options.project.remoteProjectRoot)}`,
     "&&",
@@ -3816,6 +3935,10 @@ var PROFILE_FORMAT = 1, REMOTE_STDIN_FLUSH_ATTEMPTS = 3, PROFILE_NAME, SSH_DESTI
     String(options.port),
     "--mobile-config",
     shellQuote(encodedConfig),
+    ...encodedCertificateAuthority ? [
+      "--certificate-authority",
+      shellQuote(encodedCertificateAuthority)
+    ] : [],
     ...options.https ? ["--https"] : []
   ].join(" ");
   const command = [
@@ -3999,9 +4122,11 @@ var init_remoteMacProtocol = __esm(() => {
 var exports_devCert = {};
 __export(exports_devCert, {
   setupMkcert: () => setupMkcert,
+  normalizeDevCertificateHosts: () => normalizeDevCertificateHosts,
   loadDevCert: () => loadDevCert,
   hasMkcert: () => hasMkcert,
   hasCert: () => hasCert,
+  getDevCertificateAuthorityPath: () => getDevCertificateAuthorityPath,
   ensureDevCert: () => ensureDevCert
 });
 import {
@@ -4011,20 +4136,31 @@ import {
   readFileSync as readFileSync7,
   rmSync
 } from "fs";
+import { X509Certificate } from "crypto";
+import { isIP } from "net";
 import { platform as platform2 } from "os";
 import { join as join12 } from "path";
-var CERT_DIR, CERT_PATH, KEY_PATH, CERT_VALIDITY_DAYS = 365, devLog = (msg) => console.log(`\x1B[2m${new Date().toLocaleTimeString()}\x1B[0m \x1B[36m[dev]\x1B[0m ${msg}`), devWarn = (msg) => console.log(`\x1B[2m${new Date().toLocaleTimeString()}\x1B[0m \x1B[33m[dev]\x1B[0m \x1B[33m${msg}\x1B[0m`), certFilesExist = () => existsSync4(CERT_PATH) && existsSync4(KEY_PATH), isCertExpired = () => {
+var CERT_DIR, CERT_PATH, KEY_PATH, CERT_VALIDITY_DAYS = 365, DEFAULT_CERTIFICATE_HOSTS, CERTIFICATE_HOSTNAME_PATTERN, devLog = (msg) => console.log(`\x1B[2m${new Date().toLocaleTimeString()}\x1B[0m \x1B[36m[dev]\x1B[0m ${msg}`), devWarn = (msg) => console.log(`\x1B[2m${new Date().toLocaleTimeString()}\x1B[0m \x1B[33m[dev]\x1B[0m \x1B[33m${msg}\x1B[0m`), certFilesExist = () => existsSync4(CERT_PATH) && existsSync4(KEY_PATH), normalizeDevCertificateHosts = (hosts = []) => {
+  const normalized = new Set(DEFAULT_CERTIFICATE_HOSTS);
+  for (const host of hosts) {
+    const value = host.trim().toLowerCase();
+    if (!value || value === "0.0.0.0" || value === "::")
+      continue;
+    if (isIP(value) === 0 && !CERTIFICATE_HOSTNAME_PATTERN.test(value)) {
+      throw new TypeError(`Invalid development certificate host: ${host}`);
+    }
+    normalized.add(value);
+  }
+  return [...normalized];
+}, certificateIsUsable = (hosts) => {
   try {
     const certPem = readFileSync7(CERT_PATH, "utf-8");
-    const proc = Bun.spawnSync(["openssl", "x509", "-enddate", "-noout"], {
-      stdin: new TextEncoder().encode(certPem)
-    });
-    const output = new TextDecoder().decode(proc.stdout).trim();
-    const dateStr = output.replace("notAfter=", "");
-    const expiryDate = new Date(dateStr);
-    return expiryDate.getTime() < Date.now();
+    const certificate = new X509Certificate(certPem);
+    if (new Date(certificate.validTo).getTime() <= Date.now())
+      return false;
+    return normalizeDevCertificateHosts(hosts).every((host) => isIP(host) ? certificate.checkIP(host) !== undefined : certificate.checkHost(host) !== undefined);
   } catch {
-    return true;
+    return false;
   }
 }, hasMkcert = () => {
   try {
@@ -4036,22 +4172,21 @@ var CERT_DIR, CERT_PATH, KEY_PATH, CERT_VALIDITY_DAYS = 365, devLog = (msg) => c
   } catch {
     return false;
   }
-}, generateWithMkcert = () => {
+}, generateWithMkcert = (hosts = []) => {
   const result = Bun.spawnSync([
     "mkcert",
     "-cert-file",
     CERT_PATH,
     "-key-file",
     KEY_PATH,
-    "localhost",
-    "127.0.0.1",
-    "::1"
+    ...normalizeDevCertificateHosts(hosts)
   ], { stderr: "pipe", stdout: "pipe" });
   if (result.exitCode !== 0) {
     const err = new TextDecoder().decode(result.stderr);
     throw new Error(`mkcert failed: ${err}`);
   }
-}, generateSelfSigned = () => {
+}, generateSelfSigned = (hosts = []) => {
+  const subjectAlternativeNames = normalizeDevCertificateHosts(hosts).map((host) => `${isIP(host) ? "IP" : "DNS"}:${host}`).join(",");
   const proc = Bun.spawnSync([
     "openssl",
     "req",
@@ -4070,36 +4205,36 @@ var CERT_DIR, CERT_PATH, KEY_PATH, CERT_VALIDITY_DAYS = 365, devLog = (msg) => c
     "-subj",
     "/CN=localhost",
     "-addext",
-    "subjectAltName=DNS:localhost,IP:127.0.0.1,IP:::1"
+    `subjectAltName=${subjectAlternativeNames}`
   ], { stderr: "pipe", stdout: "pipe" });
   if (proc.exitCode !== 0) {
     const err = new TextDecoder().decode(proc.stderr);
     throw new Error(`openssl failed: ${err}`);
   }
   devLog("Using self-signed certificate \u2014 browser will show a one-time warning");
-}, generateCert = () => {
+}, generateCert = (hosts = []) => {
   if (hasMkcert()) {
-    generateWithMkcert();
+    generateWithMkcert(hosts);
   } else {
-    generateSelfSigned();
+    generateSelfSigned(hosts);
   }
-}, ensureDevCert = () => {
+}, ensureDevCert = (hosts = []) => {
   mkdirSync4(CERT_DIR, { recursive: true });
-  if (hasCert()) {
+  if (hasCert(hosts)) {
     return { cert: CERT_PATH, key: KEY_PATH };
   }
   if (certFilesExist()) {
-    devLog("Certificate expired, regenerating...");
+    devLog("Certificate is expired or missing a required host, regenerating...");
   }
   try {
-    generateCert();
+    generateCert(hosts);
   } catch (err) {
     devWarn(`Failed to generate certificate: ${err instanceof Error ? err.message : err}`);
     return null;
   }
   return { cert: CERT_PATH, key: KEY_PATH };
-}, hasCert = () => certFilesExist() && !isCertExpired(), loadDevCert = () => {
-  const paths = ensureDevCert();
+}, hasCert = (hosts = []) => certFilesExist() && certificateIsUsable(hosts), loadDevCert = (hosts = []) => {
+  const paths = ensureDevCert(hosts);
   if (!paths)
     return null;
   try {
@@ -4215,7 +4350,15 @@ var CERT_DIR, CERT_PATH, KEY_PATH, CERT_VALIDITY_DAYS = 365, devLog = (msg) => c
   } catch {
     return null;
   }
-}, mkcertCaRoot = () => runCapture(["mkcert", "-CAROOT"]), toWindowsPath = (linuxPath) => runCapture(["wslpath", "-w", linuxPath]), windowsTempDir = () => {
+}, mkcertCaRoot = () => runCapture(["mkcert", "-CAROOT"]), getDevCertificateAuthorityPath = () => {
+  const caRoot = hasMkcert() ? mkcertCaRoot() : null;
+  const rootCertificate = caRoot ? join12(caRoot, "rootCA.pem") : null;
+  if (rootCertificate && existsSync4(rootCertificate))
+    return rootCertificate;
+  if (certFilesExist())
+    return CERT_PATH;
+  return null;
+}, toWindowsPath = (linuxPath) => runCapture(["wslpath", "-w", linuxPath]), windowsTempDir = () => {
   const winTemp = runCapture(["cmd.exe", "/c", "echo %TEMP%"]);
   if (!winTemp)
     return null;
@@ -4249,7 +4392,7 @@ var CERT_DIR, CERT_PATH, KEY_PATH, CERT_VALIDITY_DAYS = 365, devLog = (msg) => c
   ], { stderr: "pipe", stdout: "pipe" });
   rmSync(staged, { force: true });
   return result.exitCode === 0;
-}, setupMkcert = () => {
+}, setupMkcert = (hosts = []) => {
   if (!ensureMkcert())
     return false;
   const installResult = Bun.spawnSync(["mkcert", "-install"], {
@@ -4276,7 +4419,7 @@ var CERT_DIR, CERT_PATH, KEY_PATH, CERT_VALIDITY_DAYS = 365, devLog = (msg) => c
   rmSync(CERT_PATH, { force: true });
   rmSync(KEY_PATH, { force: true });
   mkdirSync4(CERT_DIR, { recursive: true });
-  generateWithMkcert();
+  generateWithMkcert(hosts);
   console.log("");
   devLog("mkcert installed \u2014 HTTPS certificates are now locally trusted");
   return true;
@@ -4285,6 +4428,8 @@ var init_devCert = __esm(() => {
   CERT_DIR = join12(process.cwd(), ".absolutejs");
   CERT_PATH = join12(CERT_DIR, "cert.pem");
   KEY_PATH = join12(CERT_DIR, "key.pem");
+  DEFAULT_CERTIFICATE_HOSTS = ["localhost", "127.0.0.1", "::1"];
+  CERTIFICATE_HOSTNAME_PATTERN = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(?:\.(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?))*$/u;
 });
 
 // src/cli/scripts/eslintChunked.ts
@@ -17591,7 +17736,7 @@ var DEFAULT_ROUTE_TIMEOUT_MS = 30000, DEFAULT_HMR_TIMEOUT_MS = 30000, routeExpre
 
 // src/mobile/releaseDoctor.ts
 import { access as access8, readFile as readFile15, readdir as readdir4 } from "fs/promises";
-import { extname as extname8, join as join49, relative as relative24 } from "path";
+import { dirname as dirname29, extname as extname8, join as join49, relative as relative24 } from "path";
 var HMR_ASSET_PATTERN, RELEASE_ASSET_EXTENSIONS, pathExists5 = async (path) => {
   try {
     await access8(path);
@@ -17650,7 +17795,13 @@ var HMR_ASSET_PATTERN, RELEASE_ASSET_EXTENSIONS, pathExists5 = async (path) => {
     return fail5("android.cleartext", "The Android manifest is missing.", manifestPath, "Run `absolute mobile sync android` before release validation.");
   }
   const source = await readFile15(manifestPath, "utf8");
-  return /android:usesCleartextTraffic=["']true["']/u.test(source) ? fail5("android.cleartext", "Android explicitly permits cleartext traffic.", manifestPath, 'Remove usesCleartextTraffic="true" from the release manifest.') : pass("android.cleartext", "Android does not explicitly permit cleartext traffic.", manifestPath);
+  const cleartext = /android:usesCleartextTraffic=["']true["']/u.test(source);
+  const networkConfigName = source.match(/android:networkSecurityConfig=["']@xml\/([a-z0-9_]+)["']/u)?.[1];
+  const networkConfigPath = networkConfigName ? join49(dirname29(manifestPath), "res", "xml", `${networkConfigName}.xml`) : undefined;
+  const developmentTrustReference = /android:networkSecurityConfig=["']@xml\/absolutejs_dev_network_security["']/u.test(source);
+  const developmentTrustContents = networkConfigPath ? await readFile15(networkConfigPath, "utf8").then((value) => value.includes("@raw/absolutejs_dev_ca")).catch(() => false) : false;
+  const developmentTrust = developmentTrustReference || developmentTrustContents;
+  return cleartext || developmentTrust ? fail5("android.cleartext", developmentTrust ? "Android still references the AbsoluteJS development certificate authority." : "Android explicitly permits cleartext traffic.", manifestPath, "Run `absolute mobile sync android`; do not ship development transport or trust overrides.") : pass("android.cleartext", "Android does not explicitly permit cleartext traffic.", manifestPath);
 }, hmrAssetsReleaseCheck = async (publicRoot) => {
   const hmrAsset = await findHmrAsset(publicRoot);
   return hmrAsset ? fail5("android.hmr-assets", "A packaged Android asset contains the development HMR client.", hmrAsset, "Rebuild the production mobile bundle and run Capacitor sync again.") : pass("android.hmr-assets", "Packaged Android assets contain no development HMR markers.", publicRoot);
@@ -17809,7 +17960,7 @@ import {
   stat as stat2,
   writeFile as writeFile14
 } from "fs/promises";
-import { dirname as dirname29, isAbsolute as isAbsolute7, join as join50, relative as relative25, resolve as resolve39, sep as sep6 } from "path";
+import { dirname as dirname30, isAbsolute as isAbsolute7, join as join50, relative as relative25, resolve as resolve39, sep as sep6 } from "path";
 var ABSOLUTE_ANDROID_RELEASE_FORMAT = 1, isRecord13 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), requireManifest2 = (value) => {
   if (!isRecord13(value) || typeof value.appBuild !== "string" || typeof value.appId !== "string" || typeof value.runtime !== "string") {
     throw new TypeError("Invalid embedded AbsoluteJS mobile manifest.");
@@ -17882,8 +18033,8 @@ var ABSOLUTE_ANDROID_RELEASE_FORMAT = 1, isRecord13 = (value) => typeof value ==
     }
     return { artifactPath: destination, metadata: existing, releaseRoot };
   }
-  await mkdir12(dirname29(releaseRoot), { recursive: true });
-  const staging = await mkdtemp5(join50(dirname29(releaseRoot), ".android-stage-"));
+  await mkdir12(dirname30(releaseRoot), { recursive: true });
+  const staging = await mkdtemp5(join50(dirname30(releaseRoot), ".android-stage-"));
   try {
     await copyFile5(artifactPath, join50(staging, artifactName));
     const complete = {
@@ -20678,6 +20829,24 @@ var resolveDevPort = async (requestedPort, options = {}) => {
 ` + `Set \`dev.port\` to a different value in absolute.config.ts (or via the ABSOLUTE_PORT env var), or extend \`dev.portRange\`.`);
 };
 
+// src/utils/networking.ts
+import os from "os";
+var getAllNetworkIPs = () => {
+  const interfaces = os.networkInterfaces();
+  const addresses = Object.values(interfaces).flat().filter((iface) => iface !== undefined);
+  const ipv4Addresses = [];
+  addresses.filter((addr) => !addr.internal && addr.family === "IPv4").forEach((addr) => ipv4Addresses.push(addr.address));
+  return ipv4Addresses;
+};
+var getLocalIPAddress = () => {
+  const allIPs = getAllNetworkIPs();
+  if (allIPs.length > 0 && allIPs[0]) {
+    return allIPs[0];
+  }
+  console.warn("No IP address found, falling back to localhost");
+  return "localhost";
+};
+
 // src/cli/scripts/dev.ts
 init_config();
 init_nativeAuth();
@@ -20982,25 +21151,41 @@ var confirmPrompt = (message, defaultYes = true) => {
   process.stdin.on("data", onData);
   return promise;
 };
-var setupCertWithPrompt = async (ensureDevCert2, setupMkcert2) => {
+var setupCertWithPrompt = async (ensureDevCert2, setupMkcert2, hosts) => {
   const install = await confirmPrompt("Install mkcert for trusted HTTPS? (no browser warning)");
   if (install) {
-    setupMkcert2();
+    setupMkcert2(hosts);
   } else {
-    ensureDevCert2();
+    ensureDevCert2(hosts);
   }
 };
-var setupHttpsCert = async () => {
-  const { hasCert: hasCert2, hasMkcert: hasMkcert2, ensureDevCert: ensureDevCert2, setupMkcert: setupMkcert2 } = await Promise.resolve().then(() => (init_devCert(), exports_devCert));
-  if (hasCert2()) {
-    ensureDevCert2();
-    return;
+var setupHttpsCert = async (hosts = []) => {
+  const {
+    getDevCertificateAuthorityPath: getDevCertificateAuthorityPath2,
+    hasCert: hasCert2,
+    hasMkcert: hasMkcert2,
+    ensureDevCert: ensureDevCert2,
+    setupMkcert: setupMkcert2
+  } = await Promise.resolve().then(() => (init_devCert(), exports_devCert));
+  if (hasCert2(hosts)) {
+    ensureDevCert2(hosts);
+    return getDevCertificateAuthorityPath2();
   }
   if (hasMkcert2()) {
-    ensureDevCert2();
-    return;
+    ensureDevCert2(hosts);
+    return getDevCertificateAuthorityPath2();
   }
-  await setupCertWithPrompt(ensureDevCert2, setupMkcert2);
+  await setupCertWithPrompt(ensureDevCert2, setupMkcert2, hosts);
+  return getDevCertificateAuthorityPath2();
+};
+var mobileReachableHost = (host) => {
+  if (host !== "0.0.0.0" && host !== "::")
+    return host;
+  const address = getLocalIPAddress();
+  if (address === "localhost") {
+    throw new Error("No LAN address is available for the selected physical device. Connect this computer to the device network or set dev.host explicitly.");
+  }
+  return address;
 };
 var resolveDevConfig = (configDev) => {
   const relay = env.ABSOLUTE_TUNNEL_RELAY ?? configDev?.tunnel?.relay;
@@ -21014,10 +21199,19 @@ var resolveDevConfig = (configDev) => {
     ...relay && token ? { tunnel: { relay, token } } : {}
   };
 };
-var androidToolchainReady = (checks) => checks.every((check) => check.platform !== "android" || check.status !== "fail" && check.status !== "warn");
+var androidToolchainReady = (checks, target = "emulator") => {
+  const deviceOnlyChecks = new Set([
+    "android.avd",
+    "android.avdmanager",
+    "android.emulator",
+    "android.virtualization"
+  ]);
+  return checks.every((check) => check.platform !== "android" || target === "device" && deviceOnlyChecks.has(check.id) || check.status !== "fail" && check.status !== "warn");
+};
 var iosToolchainReady = (checks) => checks.every((check) => check.platform !== "ios" || check.status !== "fail" && check.status !== "warn");
 var dev = async (serverEntry, configPath2, options = {}) => {
   let httpsEnabled = false;
+  let devCertificateAuthorityPath = null;
   let resolvedDev;
   let buildDirectory = resolve8(process.cwd(), "build");
   let mobileConfig;
@@ -21031,12 +21225,21 @@ var dev = async (serverEntry, configPath2, options = {}) => {
     if (config?.buildDirectory) {
       buildDirectory = resolve8(process.cwd(), config.buildDirectory);
     }
-    if (httpsEnabled)
-      await setupHttpsCert();
   } catch {
     resolvedDev = resolveDevConfig(undefined);
     httpsEnabled = resolvedDev.https;
   }
+  if (options.androidDevice && ["localhost", "127.0.0.1", "::1"].includes(resolvedDev.host)) {
+    resolvedDev.host = "0.0.0.0";
+  }
+  if (httpsEnabled)
+    devCertificateAuthorityPath = await setupHttpsCert(options.androidDevice ? [mobileReachableHost(resolvedDev.host)] : [resolvedDev.host]);
+  if (options.androidDevice && !mobileConfig) {
+    throw new TypeError("--android-device requires an absolute.config.ts mobile configuration.");
+  }
+  if (options.androidDevice && mobileConfig?.platforms && !mobileConfig.platforms.includes("android")) {
+    throw new TypeError("--android-device requires android in mobile.platforms.");
+  }
   let androidDevProject = null;
   let iosDevProject = null;
   const mobileInteractive = options.mobile !== false && process.env.ABSOLUTE_NO_MOBILE !== "1" && process.stdin.isTTY === true && process.stdout.isTTY === true;
@@ -21044,14 +21247,15 @@ var dev = async (serverEntry, configPath2, options = {}) => {
     try {
       const normalized = normalizeAbsoluteMobileConfig(mobileConfig, process.cwd());
       if (normalized.platforms.includes("android")) {
-        let ready = androidToolchainReady(await inspectAbsoluteMobileToolchain());
+        const androidTarget = options.androidDevice ? "device" : "emulator";
+        let ready = androidToolchainReady(await inspectAbsoluteMobileToolchain(), androidTarget);
         if (!ready) {
-          const install = await confirmPrompt("Android emulation is not configured. Install it now?");
+          const install = await confirmPrompt("Android development is not configured. Install the tested toolchain now?");
           if (install) {
             await fixAbsoluteMobileEmulatorToolchain("android");
-            ready = androidToolchainReady(await inspectAbsoluteMobileToolchain());
+            ready = androidToolchainReady(await inspectAbsoluteMobileToolchain(), androidTarget);
           } else {
-            console.log(cliTag("\x1B[33m", "Mobile emulator skipped. Run `absolute mobile doctor android --fix` when ready."));
+            console.log(cliTag("\x1B[33m", "Android target skipped. Run `absolute mobile doctor android --fix` when ready."));
           }
         }
         if (ready) {
@@ -21063,7 +21267,8 @@ var dev = async (serverEntry, configPath2, options = {}) => {
           if (existsSync5(nativeDirectory) || createNativeProject) {
             androidDevProject = await prepareAbsoluteAndroidDevProject(normalized, {
               createNativeProject,
-              projectRoot: process.cwd()
+              projectRoot: process.cwd(),
+              target: androidTarget
             });
           }
         }
@@ -21145,7 +21350,8 @@ var dev = async (serverEntry, configPath2, options = {}) => {
     "dev",
     serverEntry,
     ...configPath2 ? ["--config", configPath2] : [],
-    ...options.mobile === false ? ["--no-mobile"] : []
+    ...options.mobile === false ? ["--no-mobile"] : [],
+    ...options.androidDevice ? ["--android-device", options.androidDevice] : []
   ].filter((part) => part.length > 0);
   registerInstance({
     command: relaunchCommand,
@@ -21201,6 +21407,7 @@ var dev = async (serverEntry, configPath2, options = {}) => {
       platform: "android",
       provider: "capacitor",
       startedEmulator: session.startedEmulator,
+      target: options.androidDevice ? "device" : "emulator",
       timings: session.timings
     });
     if (session.timings.building === undefined)
@@ -21215,9 +21422,12 @@ var dev = async (serverEntry, configPath2, options = {}) => {
     });
   };
   const openAndroidDevSession = (androidProject) => startAbsoluteAndroidDevSession({
+    certificateAuthorityPath: devCertificateAuthorityPath ?? undefined,
+    deviceSerial: options.androidDevice,
     https: httpsEnabled,
     port,
     project: androidProject,
+    serverHost: options.androidDevice ? mobileReachableHost(resolvedDev.host) : "localhost",
     signal: androidDevAbort.signal,
     log: (message) => printNativeOutput(cliTag("\x1B[36m", message)),
     nativeLog: (entry) => printNativeOutput(androidLogTag(entry)),
@@ -21328,6 +21538,7 @@ var dev = async (serverEntry, configPath2, options = {}) => {
   };
   const openIosDevSession = (iosProject) => {
     const sessionOptions = {
+      certificateAuthorityPath: devCertificateAuthorityPath ?? undefined,
       https: httpsEnabled,
       port,
       signal: iosDevAbort.signal,
@@ -21488,6 +21699,9 @@ var dev = async (serverEntry, configPath2, options = {}) => {
       return;
     }
     const refreshedDevConfig = resolveDevConfig(cfg?.dev);
+    if (options.androidDevice && ["localhost", "127.0.0.1", "::1"].includes(refreshedDevConfig.host)) {
+      refreshedDevConfig.host = "0.0.0.0";
+    }
     const desiredBuildDir = cfg?.buildDirectory ? resolve8(process.cwd(), cfg.buildDirectory) : resolve8(process.cwd(), "build");
     if (desiredBuildDir !== buildDirectory && desiredBuildDir !== lastBuildDirectoryWarned) {
       lastBuildDirectoryWarned = desiredBuildDir;
@@ -21570,6 +21784,7 @@ var dev = async (serverEntry, configPath2, options = {}) => {
       env: {
         ...process.env,
         ...readDotenvFiles(),
+        ABSOLUTE_HOST: resolvedDev.host,
         ABSOLUTE_INSTANCE_MANAGED: "1",
         ABSOLUTE_PORT: String(port),
         ABSOLUTE_SERVER_ENTRY: resolve8(serverEntry),
@@ -23766,9 +23981,17 @@ var stripNamedArgs = (...flags) => args.filter((_, idx) => flags.every((flag) =>
 if (command === "dev") {
   sendTelemetryEvent("cli:command", { command });
   const configPath2 = parseNamedArg("--config");
-  const positionalArgs2 = stripNamedArgs("--config").filter((arg) => arg !== "--no-mobile");
+  const androidDevice = parseNamedArg("--android-device");
+  if (args.includes("--android-device") && !androidDevice) {
+    throw new TypeError("--android-device requires an ADB device serial.");
+  }
+  if (androidDevice && args.includes("--no-mobile")) {
+    throw new TypeError("--android-device cannot be combined with --no-mobile.");
+  }
+  const positionalArgs2 = stripNamedArgs("--config", "--android-device").filter((arg) => arg !== "--no-mobile");
   const serverEntry = positionalArgs2[0] ?? DEFAULT_SERVER_ENTRY;
   await dev(serverEntry, configPath2, {
+    androidDevice,
     mobile: !args.includes("--no-mobile")
   });
 } else if (command === "start") {
@@ -23927,7 +24150,7 @@ if (command === "dev") {
   console.error(message);
   console.error("Usage: absolute <command>");
   console.error("Commands:");
-  console.error("  dev [entry] [--no-mobile] Start web and configured mobile development");
+  console.error("  dev [entry] [--no-mobile] [--android-device serial] Start web and configured mobile development");
   console.error("  workspace dev [--no-tui] Start multi-service workspace dev");
   console.error("  build [--outdir dir] [--profile] Build production assets");
   console.error("  prepare [entry] [--outdir dir] Build production assets and server without launching");