@absolutejs/absolute 0.20.0-beta.32 → 0.20.0-beta.34

package/dist/cli/index.js

@@ -1290,11 +1290,16 @@ import {
   sep,
   win32
 } from "path";
-var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_FORMAT = 1, NATIVE_CACHE_FORMAT = 1, HASH_RADIX = 16, EXECUTABLE_MODE_MASK = 73, NATIVE_PUBLIC_PATH_SEGMENTS = 5, CAPACITOR_PROJECT_DIRECTORY_PATTERN, ANDROID_TIMING_PHASES, androidTimingSummary = (timings) => ANDROID_TIMING_PHASES.map(([phase, label]) => {
+var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_FORMAT = 1, NATIVE_CACHE_FORMAT = 1, HASH_RADIX = 16, EXECUTABLE_MODE_MASK = 73, NATIVE_PUBLIC_PATH_SEGMENTS = 5, CAPACITOR_PROJECT_DIRECTORY_PATTERN, ANDROID_TIMING_PHASES, androidTimingSummary = (timings, physicalDevice = false) => ANDROID_TIMING_PHASES.map(([phase, label]) => {
   const duration = timings[phase];
   if (duration === undefined || label === undefined)
     return null;
-  return `${label} ${getDurationString(duration)}`;
+  let phaseLabel = label;
+  if (physicalDevice && phase === "booting")
+    phaseLabel = "device selection";
+  if (physicalDevice && phase === "forwarding")
+    phaseLabel = "LAN transport";
+  return `${phaseLabel} ${getDurationString(duration)}`;
 }).filter((value) => value !== null).join(", "), pathExists2 = async (path) => {
   try {
     await access3(path);
@@ -1454,8 +1459,10 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
   const root = join7(projectRoot, ".absolutejs", "mobile", "dev-session");
   return {
     backup: join7(root, "capacitor.config.backup.json"),
+    caBackup: join7(root, "absolutejs_dev_ca.backup.pem"),
     journal: join7(root, "journal.json"),
     manifestBackup: join7(root, "AndroidManifest.backup.xml"),
+    networkConfigBackup: join7(root, "absolutejs_dev_network_security.backup.xml"),
     root
   };
 }, isInside = (root, path) => {
@@ -1565,19 +1572,31 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
   const manifestBackupPath = Reflect.get(value, "manifestBackupPath");
   const nativeConfigPath = Reflect.get(value, "nativeConfigPath");
   const nativeManifestPath = Reflect.get(value, "nativeManifestPath");
+  const projectedFiles = Reflect.get(value, "projectedFiles");
   if (typeof backupPath !== "string" || format !== DEV_JOURNAL_FORMAT || typeof nativeConfigPath !== "string") {
     return null;
   }
   if ((manifestBackupPath !== undefined || nativeManifestPath !== undefined) && (typeof manifestBackupPath !== "string" || typeof nativeManifestPath !== "string")) {
     return null;
   }
+  if (projectedFiles !== undefined && (!Array.isArray(projectedFiles) || !projectedFiles.every((file) => isRecord(file) && typeof file.path === "string" && (file.backupPath === undefined || typeof file.backupPath === "string")))) {
+    return null;
+  }
   return {
     backupPath,
     format,
     manifestBackupPath,
     nativeConfigPath,
-    nativeManifestPath
+    nativeManifestPath,
+    projectedFiles
   };
+}, restoreAndroidProjectedFile = async (file) => {
+  if (!file.backupPath || !await pathExists2(file.backupPath)) {
+    await rm(file.path, { force: true });
+    return;
+  }
+  await mkdir(dirname3(file.path), { recursive: true });
+  await copyFile(file.backupPath, file.path);
 }, repairAbsoluteAndroidDevSession = async (projectRoot) => {
   const paths = journalPaths(projectRoot);
   if (!await pathExists2(paths.journal)) {
@@ -1585,7 +1604,7 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
     return false;
   }
   const journal = await readFile2(paths.journal, "utf8").then((source) => parseJournal(JSON.parse(source))).catch(() => null);
-  if (!journal || !isInside(projectRoot, journal.nativeConfigPath) || !isInside(paths.root, journal.backupPath) || journal.nativeManifestPath !== undefined && !isInside(projectRoot, journal.nativeManifestPath) || journal.manifestBackupPath !== undefined && !isInside(paths.root, journal.manifestBackupPath)) {
+  if (!journal || !isInside(projectRoot, journal.nativeConfigPath) || !isInside(paths.root, journal.backupPath) || journal.nativeManifestPath !== undefined && !isInside(projectRoot, journal.nativeManifestPath) || journal.manifestBackupPath !== undefined && !isInside(paths.root, journal.manifestBackupPath) || journal.projectedFiles?.some((file) => !isInside(projectRoot, file.path) || file.backupPath !== undefined && !isInside(paths.root, file.backupPath))) {
     throw new Error(`Refusing unsafe or invalid mobile dev journal at ${paths.journal}.`);
   }
   if (await pathExists2(journal.backupPath)) {
@@ -1596,17 +1615,51 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
     await mkdir(dirname3(journal.nativeManifestPath), { recursive: true });
     await copyFile(journal.manifestBackupPath, journal.nativeManifestPath);
   }
+  await Promise.all((journal.projectedFiles ?? []).map(restoreAndroidProjectedFile));
   await rm(paths.root, { force: true, recursive: true });
   return true;
-}, androidDevelopmentManifest = (source, cleartext) => {
+}, setAndroidApplicationAttribute = (source, attribute, value) => {
+  const pattern = new RegExp(`android:${attribute}=["'][^"']*["']`, "u");
+  if (pattern.test(source))
+    return source.replace(pattern, `android:${attribute}="${value}"`);
+  return source.replace("<application", `<application
+        android:${attribute}="${value}"`);
+}, androidDevelopmentManifest = (source, cleartext, developmentNetworkConfig) => {
+  let projected = source;
+  if (developmentNetworkConfig) {
+    projected = setAndroidApplicationAttribute(projected, "networkSecurityConfig", `@xml/${developmentNetworkConfig}`);
+  }
   if (!cleartext)
-    return source;
+    return projected;
   if (/android:usesCleartextTraffic=["'][^"']*["']/u.test(source)) {
-    return source.replace(/android:usesCleartextTraffic=["'][^"']*["']/u, 'android:usesCleartextTraffic="true"');
+    return projected.replace(/android:usesCleartextTraffic=["'][^"']*["']/u, 'android:usesCleartextTraffic="true"');
   }
-  return source.replace("<application", `<application
-        android:usesCleartextTraffic="true"`);
-}, writeDevConfig = async (projectRoot, nativeConfigPath, nativeManifestPath, port, https, entry, embeddedBundle) => {
+  return setAndroidApplicationAttribute(projected, "usesCleartextTraffic", "true");
+}, withAndroidDebugCertificateAuthority = (source) => {
+  if (source.includes("@raw/absolutejs_dev_ca"))
+    return source;
+  const debugOverrides = /<debug-overrides(?:\s[^>]*)?>([\s\S]*?)<\/debug-overrides>/u;
+  const match = source.match(debugOverrides);
+  if (match) {
+    const [block] = match;
+    const trustAnchors = /<trust-anchors(?:\s[^>]*)?>/u;
+    const projectedBlock = trustAnchors.test(block) ? block.replace(trustAnchors, `$&
+			<certificates src="@raw/absolutejs_dev_ca" />`) : block.replace("</debug-overrides>", `	<trust-anchors>
+			<certificates src="@raw/absolutejs_dev_ca" />
+		</trust-anchors>
+	</debug-overrides>`);
+    return source.replace(block, projectedBlock);
+  }
+  if (!source.includes("</network-security-config>")) {
+    throw new Error("Android Network Security Configuration is invalid.");
+  }
+  return source.replace("</network-security-config>", `	<debug-overrides>
+		<trust-anchors>
+			<certificates src="@raw/absolutejs_dev_ca" />
+		</trust-anchors>
+	</debug-overrides>
+</network-security-config>`);
+}, writeDevConfig = async (projectRoot, nativeConfigPath, nativeManifestPath, port, https, entry, embeddedBundle, serverHost, certificateAuthorityPath) => {
   const paths = journalPaths(projectRoot);
   await repairAbsoluteAndroidDevSession(projectRoot);
   const source = await readFile2(nativeConfigPath, "utf8");
@@ -1618,12 +1671,28 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
   await mkdir(paths.root, { recursive: true });
   await writeFile2(paths.backup, source, { flag: "wx" });
   await writeFile2(paths.manifestBackup, manifestSource, { flag: "wx" });
+  const resourceRoot = join7(dirname3(nativeManifestPath), "res");
+  const caPath = join7(resourceRoot, "raw", "absolutejs_dev_ca.pem");
+  const existingNetworkConfig = manifestSource.match(/android:networkSecurityConfig=["']@xml\/([a-z0-9_]+)["']/u)?.[1];
+  const networkConfigName = existingNetworkConfig ?? "absolutejs_dev_network_security";
+  const networkConfigPath = join7(resourceRoot, "xml", `${networkConfigName}.xml`);
+  const backupProjectedFile = async ([path, backupPath]) => {
+    if (!await pathExists2(path))
+      return { path };
+    await copyFile(path, backupPath);
+    return { backupPath, path };
+  };
+  const projectedFiles = https && certificateAuthorityPath ? await Promise.all([
+    [caPath, paths.caBackup],
+    [networkConfigPath, paths.networkConfigBackup]
+  ].map(backupProjectedFile)) : [];
   const journal = {
     backupPath: paths.backup,
     format: DEV_JOURNAL_FORMAT,
     manifestBackupPath: paths.manifestBackup,
     nativeConfigPath,
-    nativeManifestPath
+    nativeManifestPath,
+    projectedFiles
   };
   await writeFile2(paths.journal, `${JSON.stringify(journal, null, "\t")}
 `, {
@@ -1631,7 +1700,7 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
   });
   if (!embeddedBundle) {
     const currentServer = parsed.server;
-    const developmentUrl = new URL(`${https ? "https" : "http"}://localhost:${port}${entry}`);
+    const developmentUrl = new URL(`${https ? "https" : "http"}://${serverHost}:${port}${entry}`);
     developmentUrl.searchParams.set("__absolute_target", "capacitor-android");
     parsed.server = {
       ...typeof currentServer === "object" && currentServer !== null ? currentServer : {},
@@ -1641,7 +1710,19 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
   }
   await writeFile2(nativeConfigPath, `${JSON.stringify(parsed, null, "\t")}
 `);
-  await writeFile2(nativeManifestPath, androidDevelopmentManifest(manifestSource, !https));
+  if (https && certificateAuthorityPath) {
+    await Promise.all([
+      mkdir(dirname3(caPath), { recursive: true }),
+      mkdir(dirname3(networkConfigPath), { recursive: true })
+    ]);
+    await copyFile(certificateAuthorityPath, caPath);
+    const existingNetworkConfigSource = existingNetworkConfig ? await readFile2(networkConfigPath, "utf8") : `<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+</network-security-config>
+`;
+    await writeFile2(networkConfigPath, withAndroidDebugCertificateAuthority(existingNetworkConfigSource));
+  }
+  await writeFile2(nativeManifestPath, androidDevelopmentManifest(manifestSource, !https, https && certificateAuthorityPath !== undefined ? networkConfigName : undefined));
 }, parseAdbDevices = (output) => output.split(/\r?\n/).slice(1).map((line) => line.trim().split(/\s+/, 2)).filter((parts) => parts.length === 2 && parts[1] === "device").map(([serial]) => serial), isManagedEmulatorSerial = (serial, adb, capture, env) => {
   if (!serial.startsWith("emulator-"))
     return false;
@@ -1652,6 +1733,11 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
   if (devices.exitCode !== 0)
     return;
   return parseAdbDevices(devices.stdout).find((serial) => isManagedEmulatorSerial(serial, adb, capture, env));
+}, requireConnectedAndroidDevice = (adb, serial, capture, env) => {
+  const devices = capture([adb, "devices"], { env });
+  if (devices.exitCode !== 0 || !parseAdbDevices(devices.stdout).includes(serial)) {
+    throw new Error(`Android device ${serial} is not connected and authorized. Confirm the USB debugging prompt, then retry.`);
+  }
 }, completedBootSerial = (project, capture, env) => {
   const serial = managedEmulatorSerial(project.adb, capture, env);
   if (!serial)
@@ -1663,15 +1749,13 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
   return booted.exitCode === 0 && booted.stdout.trim() === "1" ? serial : undefined;
 }, waitForManagedEmulator = async (project, capture, sleep, env, signal, preferredSerial) => {
   const deadline = Date.now() + ANDROID_BOOT_TIMEOUT_MS;
-  let firstSerial = preferredSerial;
   const poll = async () => {
     throwIfAborted(signal);
-    const serial = firstSerial ? preferredCompletedBootSerial(project, firstSerial, capture, env) : completedBootSerial(project, capture, env);
-    firstSerial = undefined;
+    const serial = preferredSerial ? preferredCompletedBootSerial(project, preferredSerial, capture, env) : completedBootSerial(project, capture, env);
     if (serial)
       return serial;
     if (Date.now() >= deadline) {
-      throw new Error(`Android emulator ${ABSOLUTE_ANDROID_AVD_NAME} did not finish booting within ${ANDROID_BOOT_TIMEOUT_MS / ANDROID_BOOT_POLL_MS}s.`);
+      throw new Error(`Android ${preferredSerial ? `target ${preferredSerial}` : `emulator ${ABSOLUTE_ANDROID_AVD_NAME}`} did not finish booting within ${ANDROID_BOOT_TIMEOUT_MS / ANDROID_BOOT_POLL_MS}s.`);
     }
     await sleep(ANDROID_BOOT_POLL_MS);
     return poll();
@@ -1821,6 +1905,9 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
   await persistInstalledAndroidNativeCache(options, updated);
   return { nativeCacheHit: false, uid: updated?.uid };
 }, startManagedEmulatorIfNeeded = (project, capture, spawn, log, env) => {
+  if (!project.emulator) {
+    throw new Error("Android Emulator is unavailable. Select a physical device or run `absolute mobile doctor android --fix`.");
+  }
   const serial = managedEmulatorSerial(project.adb, capture, env);
   if (serial)
     return { serial, started: false };
@@ -1838,7 +1925,7 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
 }, logHttpsCertificateRequirement = (https, log) => {
   if (https !== true)
     return;
-  log("Android HMR is using HTTPS; the emulator must trust the local development certificate authority.");
+  log("Android HMR is using HTTPS; AbsoluteJS is projecting the local development CA into this debug app only.");
 }, removeAdbReverse = async (project, serial, port, run, env) => {
   if (!serial)
     return;
@@ -1937,13 +2024,19 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
   const host = detectAbsoluteMobileHost();
   const androidRoot = process.env.ANDROID_HOME ?? process.env.ANDROID_SDK_ROOT ?? absoluteManagedAndroidSdkRoot(host);
   const checks = await inspectAbsoluteMobileToolchain({ androidRoot, host });
-  const failed = checks.filter((check) => check.platform === "android" && (check.status === "fail" || check.status === "warn"));
+  const deviceOnlyChecks = new Set([
+    "android.avd",
+    "android.avdmanager",
+    "android.emulator",
+    "android.virtualization"
+  ]);
+  const failed = checks.filter((check) => check.platform === "android" && (check.status === "fail" || check.status === "warn") && (options.target !== "device" || !deviceOnlyChecks.has(check.id)));
   if (failed.length > 0) {
-    throw new Error(`Android emulation is not ready: ${failed.map(({ label }) => label).join(", ")}.`);
+    throw new Error(`Android ${options.target === "device" ? "device development" : "emulation"} is not ready: ${failed.map(({ label }) => label).join(", ")}.`);
   }
   const adb = checks.find((check) => check.id === "android.adb")?.path;
   const emulator = checks.find((check) => check.id === "android.emulator")?.path;
-  if (!adb || !emulator) {
+  if (!adb || options.target !== "device" && !emulator) {
     throw new Error("Android SDK tools disappeared after readiness checks.");
   }
   const cap = join7(projectRoot, "node_modules", ".bin", host === "windows" ? "cap.cmd" : "cap");
@@ -1974,7 +2067,7 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
     androidRoot,
     cap,
     config,
-    emulator,
+    ...emulator ? { emulator } : {},
     host,
     nativeDirectory,
     projectRoot
@@ -2030,7 +2123,11 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
     });
   };
   try {
-    await writeDevConfig(project.projectRoot, nativeConfigPath, nativeManifestPath, options.port, options.https === true, project.config.entry, options.embeddedBundle === true);
+    const physicalDevice = options.deviceSerial !== undefined;
+    if (options.https && !options.certificateAuthorityPath) {
+      throw new Error("Android HTTPS development requires the AbsoluteJS development CA certificate.");
+    }
+    await writeDevConfig(project.projectRoot, nativeConfigPath, nativeManifestPath, options.port, options.https === true, project.config.entry, options.embeddedBundle === true, options.serverHost ?? "localhost", options.certificateAuthorityPath);
     throwIfAborted(options.signal);
     logHttpsCertificateRequirement(options.https, log);
     const fingerprintStartedAt = performance.now();
@@ -2041,20 +2138,23 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
       return fingerprint;
     });
     transition("booting");
-    const emulator = startManagedEmulatorIfNeeded(project, capture, spawn, log, env);
+    if (options.deviceSerial)
+      requireConnectedAndroidDevice(project.adb, options.deviceSerial, capture, env);
+    const emulator = options.deviceSerial ? { serial: options.deviceSerial, started: false } : startManagedEmulatorIfNeeded(project, capture, spawn, log, env);
     const { started: startedEmulator } = emulator;
     transition("connecting");
     const serial = await waitForManagedEmulator(project, capture, sleep, env, options.signal, emulator.serial);
     connectedSerial = serial;
     transition("forwarding");
-    await requireSuccess([
-      project.adb,
-      "-s",
-      serial,
-      "reverse",
-      `tcp:${options.port}`,
-      `tcp:${options.port}`
-    ], "ADB reverse port forwarding", run, { env, signal: options.signal });
+    if (!physicalDevice)
+      await requireSuccess([
+        project.adb,
+        "-s",
+        serial,
+        "reverse",
+        `tcp:${options.port}`,
+        `tcp:${options.port}`
+      ], "ADB reverse port forwarding", run, { env, signal: options.signal });
     throwIfAborted(options.signal);
     const nativeFingerprint = await nativeFingerprintPromise;
     throwIfAborted(options.signal);
@@ -2085,8 +2185,8 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
     nativeLogs = attachAndroidNativeLogs(project, serial, capture, env, options, uid);
     transition("ready");
     phaseDurations.total = performance.now() - startupStartedAt;
-    log(options.embeddedBundle === true ? `Android emulator connected (${serial}) with the embedded bundle and backend on port ${options.port} in ${getDurationString(phaseDurations.total)} (${nativeCacheHit ? "native cache hit" : "native build installed"}).` : `Android emulator connected (${serial}) with HMR on port ${options.port} in ${getDurationString(phaseDurations.total)} (${nativeCacheHit ? "native cache hit" : "native build installed"}).`);
-    log(`Android startup: ${androidTimingSummary(phaseDurations)}.`);
+    log(options.embeddedBundle === true ? `Android ${physicalDevice ? "device" : "emulator"} connected (${serial}) with the embedded bundle and backend on port ${options.port} in ${getDurationString(phaseDurations.total)} (${nativeCacheHit ? "native cache hit" : "native build installed"}).` : `Android ${physicalDevice ? "device" : "emulator"} connected (${serial}) with HMR on port ${options.port} in ${getDurationString(phaseDurations.total)} (${nativeCacheHit ? "native cache hit" : "native build installed"}).`);
+    log(`Android startup: ${androidTimingSummary(phaseDurations, physicalDevice)}.`);
     let closed = false;
     const close = async () => {
       if (closed)
@@ -2094,7 +2194,8 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
       closed = true;
       transition("closing");
       await closeNativeLogs();
-      await removeAdbReverse(project, serial, options.port, run, env);
+      if (!physicalDevice)
+        await removeAdbReverse(project, serial, options.port, run, env);
       await repairAbsoluteAndroidDevSession(project.projectRoot);
       transition("closed");
     };
@@ -2133,7 +2234,8 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
   } catch (error) {
     transition("failed");
     await closeNativeLogs();
-    await removeAdbReverse(project, connectedSerial, options.port, run, env);
+    if (!options.deviceSerial)
+      await removeAdbReverse(project, connectedSerial, options.port, run, env);
     await repairAbsoluteAndroidDevSession(project.projectRoot);
     throw error;
   }
@@ -2742,17 +2844,109 @@ var init_iosRelease = __esm(() => {
   ]);
 });
 
+// src/mobile/iosPhysicalDeviceTransport.ts
+import { randomUUID as randomUUID2, X509Certificate } from "crypto";
+import { createServer as createServer3 } from "http";
+import {
+  connect as connectTcp,
+  createServer as createTcpServer,
+  isIP
+} from "net";
+import { readFile as readFile5 } from "fs/promises";
+var closeServer = (server) => new Promise((resolve7, reject) => {
+  server.close((error) => {
+    if (error)
+      reject(error);
+    else
+      resolve7();
+  });
+}), listen = (server, port) => new Promise((resolve7, reject) => {
+  server.once("error", reject);
+  server.listen(port, "0.0.0.0", () => {
+    server.off("error", reject);
+    const address = server.address();
+    if (!address || typeof address === "string") {
+      reject(new Error("Could not determine the iOS device helper port."));
+      return;
+    }
+    resolve7(address.port);
+  });
+}), findEphemeralPort = async () => {
+  const probe = createTcpServer();
+  const port = await new Promise((resolve7, reject) => {
+    probe.once("error", reject);
+    probe.listen(0, "127.0.0.1", () => {
+      const address = probe.address();
+      if (!address || typeof address === "string") {
+        reject(new Error("Could not allocate the iOS CA enrollment port."));
+        return;
+      }
+      resolve7(address.port);
+    });
+  });
+  await closeServer(probe);
+  return port;
+}, normalizeAbsoluteIosDeviceHost = (value) => {
+  const normalized = value.trim();
+  if (!normalized || normalized.length > 253 || /[\0\s/?#]/u.test(normalized))
+    throw new TypeError("Physical iOS development requires a valid LAN host.");
+  return normalized;
+}, normalizeAbsoluteIosDeviceIdentifier = (value) => {
+  const normalized = value.trim();
+  if (!normalized || normalized.length > 256 || /[\0\r\n]/u.test(normalized))
+    throw new TypeError("--ios-device requires a valid Xcode device identifier or name.");
+  return normalized;
+}, urlForHost = (protocol, host, port) => {
+  const url = new URL(`${protocol}://localhost:${port}`);
+  const normalizedHost = normalizeAbsoluteIosDeviceHost(host);
+  url.hostname = isIP(normalizedHost) === 6 ? `[${normalizedHost}]` : normalizedHost;
+  return url;
+}, startAbsoluteIosCaEnrollmentServer = async (options) => {
+  const certificate = new X509Certificate(await readFile5(options.certificateAuthorityPath));
+  const certificateBytes = certificate.raw;
+  const token = randomUUID2().replaceAll("-", "");
+  const certificatePath = `/${token}/absolutejs-development-ca.cer`;
+  const server = createServer3((request, response) => {
+    if (request.method !== "GET" || request.url !== certificatePath) {
+      response.writeHead(404, {
+        "Cache-Control": "no-store",
+        "Content-Type": "text/plain; charset=utf-8"
+      });
+      response.end("Not found.");
+      return;
+    }
+    response.writeHead(200, {
+      "Cache-Control": "no-store",
+      "Content-Disposition": 'attachment; filename="absolutejs-development-ca.cer"',
+      "Content-Length": String(certificateBytes.byteLength),
+      "Content-Type": "application/x-x509-ca-cert",
+      "X-Content-Type-Options": "nosniff"
+    });
+    response.end(certificateBytes);
+  });
+  const port = await findEphemeralPort();
+  await listen(server, port);
+  const url = urlForHost("http", options.displayHost, port);
+  url.pathname = certificatePath;
+  return {
+    url: url.href,
+    close: () => closeServer(server)
+  };
+};
+var init_iosPhysicalDeviceTransport = () => {};
+
 // src/mobile/iosSimulatorController.ts
-import { createHash as createHash4, randomUUID as randomUUID2 } from "crypto";
+import { createHash as createHash4, randomUUID as randomUUID3 } from "crypto";
 import {
   access as access5,
   copyFile as copyFile3,
   mkdir as mkdir4,
-  readFile as readFile5,
+  readFile as readFile6,
   rename as rename4,
   rm as rm4,
   writeFile as writeFile4
 } from "fs/promises";
+import { isIP as isIP2 } from "net";
 import { dirname as dirname5, isAbsolute as isAbsolute3, join as join10, relative as relative4, resolve as resolve7, sep as sep3 } from "path";
 var ABSOLUTE_IOS_SIMULATOR_NAME = "AbsoluteJS iPhone", BOOT_TIMEOUT_MS = 180000, BOOT_POLL_MS = 1000, DEV_JOURNAL_FORMAT2 = 1, NATIVE_CACHE_FORMAT2 = 1, isRecord3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), pathExists4 = async (path) => {
   try {
@@ -2848,7 +3042,39 @@ var ABSOLUTE_IOS_SIMULATOR_NAME = "AbsoluteJS iPhone", BOOT_TIMEOUT_MS = 180000,
   const exitCode = await run(command, options);
   if (exitCode !== 0)
     throw new Error(`${label} failed with status ${exitCode}.`);
-}, requireCapturedSuccess = (result, label) => {
+}, trustIosSimulatorDevelopmentCa = async (options, udid, run, log) => {
+  if (!options.https)
+    return;
+  if (!options.certificateAuthorityPath) {
+    throw new Error("iOS Simulator HTTPS requires the AbsoluteJS development CA certificate.");
+  }
+  await requireSuccess2([
+    options.project.xcrun,
+    "simctl",
+    "keychain",
+    udid,
+    "add-root-cert",
+    options.certificateAuthorityPath
+  ], "iOS Simulator development CA trust", run, { signal: options.signal });
+  log("Installed the AbsoluteJS development CA into this iOS Simulator trust store.");
+}, iosLaunchCommand = (project, udid, physical) => physical ? [
+  project.xcrun,
+  "devicectl",
+  "device",
+  "process",
+  "launch",
+  "--terminate-existing",
+  "--device",
+  udid,
+  project.config.appId
+] : [
+  project.xcrun,
+  "simctl",
+  "launch",
+  "--terminate-running-process",
+  udid,
+  project.config.appId
+], requireCapturedSuccess = (result, label) => {
   if (result.exitCode !== 0) {
     throw new Error(`${label} failed: ${result.stderr.trim() || result.stdout.trim() || `status ${result.exitCode}`}`);
   }
@@ -2971,7 +3197,7 @@ var ABSOLUTE_IOS_SIMULATOR_NAME = "AbsoluteJS iPhone", BOOT_TIMEOUT_MS = 180000,
     await rm4(paths.root, { force: true, recursive: true });
     return false;
   }
-  const journal = await readFile5(paths.journal, "utf8").then((source) => parseJournal2(JSON.parse(source))).catch(() => null);
+  const journal = await readFile6(paths.journal, "utf8").then((source) => parseJournal2(JSON.parse(source))).catch(() => null);
   if (!journal || !isInside2(projectRoot, journal.nativeConfigPath) || !isInside2(projectRoot, journal.infoPath) || !isInside2(paths.root, journal.configBackupPath) || !isInside2(paths.root, journal.infoBackupPath)) {
     throw new Error(`Refusing unsafe or invalid iOS dev journal at ${paths.journal}.`);
   }
@@ -3000,14 +3226,14 @@ var ABSOLUTE_IOS_SIMULATOR_NAME = "AbsoluteJS iPhone", BOOT_TIMEOUT_MS = 180000,
 		<key>NSAllowsArbitraryLoads</key>
 		<true/>
 	</dict>`);
-}, writeDevProjection = async (project, port, https) => {
+}, writeDevProjection = async (project, port, https, serverHost = "localhost") => {
   const paths = journalPaths2(project.projectRoot);
   await repairAbsoluteIosDevSession(project.projectRoot);
   const nativeConfigPath = join10(project.nativeDirectory, "App", "App", "capacitor.config.json");
   const infoPath = join10(project.nativeDirectory, "App", "App", "Info.plist");
   const [configSource, infoSource] = await Promise.all([
-    readFile5(nativeConfigPath, "utf8"),
-    readFile5(infoPath, "utf8")
+    readFile6(nativeConfigPath, "utf8"),
+    readFile6(infoPath, "utf8")
   ]);
   const parsed = JSON.parse(configSource);
   if (!isRecord3(parsed))
@@ -3029,6 +3255,7 @@ var ABSOLUTE_IOS_SIMULATOR_NAME = "AbsoluteJS iPhone", BOOT_TIMEOUT_MS = 180000,
     flag: "wx"
   });
   const developmentUrl = new URL(`${https ? "https" : "http"}://localhost:${port}${project.config.entry}`);
+  developmentUrl.hostname = isIP2(serverHost) === 6 ? `[${serverHost}]` : serverHost;
   developmentUrl.searchParams.set("__absolute_target", "capacitor-ios");
   const existingServer = parsed.server;
   parsed.server = {
@@ -3056,9 +3283,9 @@ var ABSOLUTE_IOS_SIMULATOR_NAME = "AbsoluteJS iPhone", BOOT_TIMEOUT_MS = 180000,
       String(identity)
     ]))
   };
-}, readNativeCache2 = (projectRoot) => readFile5(nativeCachePath2(projectRoot), "utf8").then((source) => parseNativeCache2(JSON.parse(source))).catch(() => null), writeNativeCache2 = async (projectRoot, cache) => {
+}, readNativeCache2 = (projectRoot) => readFile6(nativeCachePath2(projectRoot), "utf8").then((source) => parseNativeCache2(JSON.parse(source))).catch(() => null), writeNativeCache2 = async (projectRoot, cache) => {
   const destination = nativeCachePath2(projectRoot);
-  const temporary = `${destination}.${process.pid}.${randomUUID2()}.tmp`;
+  const temporary = `${destination}.${process.pid}.${randomUUID3()}.tmp`;
   await mkdir4(dirname5(destination), { recursive: true });
   try {
     await writeFile4(temporary, `${JSON.stringify(cache, null, "\t")}
@@ -3140,6 +3367,29 @@ var ABSOLUTE_IOS_SIMULATOR_NAME = "AbsoluteJS iPhone", BOOT_TIMEOUT_MS = 180000,
     "app"
   ]);
   return result.exitCode === 0 && result.stdout.trim() ? result.stdout.trim() : undefined;
+}, validatePhysicalIosDevice = (project, identifier, capture) => {
+  const result = capture([
+    project.xcrun,
+    "devicectl",
+    "device",
+    "info",
+    "details",
+    "--device",
+    identifier
+  ]);
+  if (result.exitCode !== 0)
+    throw new Error(`Physical iOS device ${JSON.stringify(identifier)} is unavailable: ${result.stderr.trim() || result.stdout.trim() || "pair it in Xcode Device Hub, trust this Mac, unlock it, and enable Developer Mode."}`);
+}, physicalIosAppIsInstalled = (project, identifier, capture) => {
+  const result = capture([
+    project.xcrun,
+    "devicectl",
+    "device",
+    "info",
+    "apps",
+    "--device",
+    identifier
+  ]);
+  return result.exitCode === 0 && result.stdout.includes(project.config.appId);
 }, buildIosDebugApp = async (project, udid, fingerprint, run, signal) => {
   const derivedDataPath = join10(project.projectRoot, ".absolutejs", "mobile", "ios-derived-data", createHash4("sha256").update(project.config.appId).digest("hex").slice(0, 16));
   await mkdir4(derivedDataPath, { recursive: true });
@@ -3161,6 +3411,59 @@ var ABSOLUTE_IOS_SIMULATOR_NAME = "AbsoluteJS iPhone", BOOT_TIMEOUT_MS = 180000,
   if (!await pathExists4(appPath))
     throw new Error(`Xcode did not produce the simulator app at ${appPath}.`);
   return appPath;
+}, buildPhysicalIosDebugApp = async (project, identifier, run, signal) => {
+  const derivedDataPath = join10(project.projectRoot, ".absolutejs", "mobile", "ios-derived-data", createHash4("sha256").update(project.config.appId).digest("hex").slice(0, 16));
+  await mkdir4(derivedDataPath, { recursive: true });
+  await requireSuccess2([
+    project.xcodebuild,
+    "-workspace",
+    join10(project.nativeDirectory, "App", "App.xcworkspace"),
+    "-scheme",
+    "App",
+    "-configuration",
+    "Debug",
+    "-destination",
+    `platform=iOS,id=${identifier}`,
+    "-derivedDataPath",
+    derivedDataPath,
+    "-allowProvisioningUpdates",
+    "build"
+  ], "iOS physical-device build (configure automatic signing and a Development Team in Xcode if this is the first run)", run, { cwd: project.nativeDirectory, signal });
+  const appPath = join10(derivedDataPath, "Build", "Products", "Debug-iphoneos", "App.app");
+  if (!await pathExists4(appPath))
+    throw new Error(`Xcode did not produce the physical-device app at ${appPath}.`);
+  return appPath;
+}, ensurePhysicalIosDebugApp = async (options) => {
+  const cacheHit = options.cache?.appId === options.project.config.appId && options.cache.fingerprint === options.fingerprint && options.cache.installations[options.identifier] === options.fingerprint && physicalIosAppIsInstalled(options.project, options.identifier, options.capture);
+  if (cacheHit) {
+    options.log(`iOS native app is unchanged on the selected physical device; skipped Xcode build and install.`);
+    return true;
+  }
+  options.log("iOS native inputs changed or the physical-device install is stale; rebuilding.");
+  options.transition("building");
+  const appPath = await buildPhysicalIosDebugApp(options.project, options.identifier, options.run, options.signal);
+  throwIfAborted2(options.signal);
+  options.transition("installing");
+  await requireSuccess2([
+    options.project.xcrun,
+    "devicectl",
+    "device",
+    "install",
+    "app",
+    "--device",
+    options.identifier,
+    appPath
+  ], "iOS physical-device app installation", options.run, { signal: options.signal });
+  await writeNativeCache2(options.project.projectRoot, {
+    appId: options.project.config.appId,
+    fingerprint: options.fingerprint,
+    format: NATIVE_CACHE_FORMAT2,
+    installations: {
+      ...options.cache?.appId === options.project.config.appId ? options.cache.installations : {},
+      [options.identifier]: options.fingerprint
+    }
+  }).catch((error) => options.log(`iOS native cache could not be saved: ${error instanceof Error ? error.message : String(error)}`));
+  return false;
 }, ensureIosDebugApp = async (options) => {
   const installed = installedAppIdentity(options.project, options.udid, options.capture);
   const cacheHit = options.cache?.appId === options.project.config.appId && options.cache.fingerprint === options.fingerprint && installed !== undefined && options.cache.installations[options.udid] === installed;
@@ -3200,7 +3503,18 @@ var ABSOLUTE_IOS_SIMULATOR_NAME = "AbsoluteJS iPhone", BOOT_TIMEOUT_MS = 180000,
   if (!options.nativeLog)
     return null;
   const start = options.startNativeLogs ?? defaultStartNativeLogs;
-  return start([
+  const command = options.deviceIdentifier ? [
+    project.xcrun,
+    "devicectl",
+    "device",
+    "process",
+    "launch",
+    "--console",
+    "--terminate-existing",
+    "--device",
+    udid,
+    project.config.appId
+  ] : [
     project.xcrun,
     "simctl",
     "spawn",
@@ -3213,7 +3527,8 @@ var ABSOLUTE_IOS_SIMULATOR_NAME = "AbsoluteJS iPhone", BOOT_TIMEOUT_MS = 180000,
     "debug",
     "--predicate",
     'process == "App"'
-  ], { signal: options.signal }, (line) => {
+  ];
+  return start(command, { signal: options.signal }, (line) => {
     const entry = parseAbsoluteIosLogLine(line);
     if (entry)
       options.nativeLog?.(entry);
@@ -3223,12 +3538,13 @@ var ABSOLUTE_IOS_SIMULATOR_NAME = "AbsoluteJS iPhone", BOOT_TIMEOUT_MS = 180000,
   return duration === undefined ? null : `${label} ${getDurationString(duration)}`;
 }).filter((value) => value !== null).join(", "), prepareAbsoluteIosDevProject = async (config, options) => {
   if (detectAbsoluteMobileHost() !== "macos")
-    throw new Error("iOS simulation requires macOS and Xcode.");
+    throw new Error("iOS development requires macOS and Xcode.");
+  const target = options.target ?? "simulator";
   const projectRoot = resolve7(options.projectRoot);
   const checks = await inspectAbsoluteMobileToolchain({ host: "macos" });
-  const failed = checks.filter((check) => check.platform === "ios" && (check.status === "fail" || check.status === "warn"));
+  const failed = checks.filter((check) => check.platform === "ios" && !(target === "device" && check.id === "ios.runtime") && (check.status === "fail" || check.status === "warn"));
   if (failed.length > 0)
-    throw new Error(`iOS simulation is not ready: ${failed.map(({ label }) => label).join(", ")}.`);
+    throw new Error(`iOS ${target} development is not ready: ${failed.map(({ label }) => label).join(", ")}.`);
   const xcrun = checks.find((check) => check.id === "ios.xcrun")?.path;
   const xcodebuild = checks.find((check) => check.id === "ios.xcodebuild")?.path;
   if (!xcrun || !xcodebuild)
@@ -3258,8 +3574,53 @@ var ABSOLUTE_IOS_SIMULATOR_NAME = "AbsoluteJS iPhone", BOOT_TIMEOUT_MS = 180000,
     xcodebuild,
     xcrun
   };
+}, preparePhysicalIosTarget = async (options) => {
+  options.transition("connecting");
+  validatePhysicalIosDevice(options.project, options.deviceIdentifier, options.capture);
+  if (!options.startOptions.https)
+    return {
+      caEnrollmentServer: null,
+      startedSimulator: false,
+      udid: options.deviceIdentifier
+    };
+  if (!options.startOptions.certificateAuthorityPath)
+    throw new Error("Physical iOS HTTPS development requires the AbsoluteJS development CA certificate.");
+  options.transition("enrolling-trust");
+  const startEnrollment = options.startOptions.startCaEnrollmentServer ?? startAbsoluteIosCaEnrollmentServer;
+  const caEnrollmentServer = await startEnrollment({
+    certificateAuthorityPath: options.startOptions.certificateAuthorityPath,
+    displayHost: options.serverHost
+  });
+  options.log(`On the iOS device, open ${caEnrollmentServer.url}, install the AbsoluteJS development CA profile, then enable it under Settings > General > About > Certificate Trust Settings. This public CA endpoint exists only for this dev session.`);
+  return {
+    caEnrollmentServer,
+    startedSimulator: false,
+    udid: options.deviceIdentifier
+  };
+}, prepareIosSimulatorTarget = async (options) => {
+  options.transition("booting");
+  const managed = await ensureManagedSimulator(options.project, options.capture);
+  const { device } = managed;
+  const startedSimulator = managed.created || device.state !== "Booted";
+  bootSimulator(options.project, device, options.capture);
+  options.spawn([
+    "open",
+    "-a",
+    "Simulator",
+    "--args",
+    "-CurrentDeviceUDID",
+    device.udid
+  ]);
+  options.transition("connecting");
+  await waitForBootedSimulator(options.project, device.udid, options.capture, options.sleep, options.startOptions.signal);
+  await requireSuccess2([options.project.xcrun, "simctl", "bootstatus", device.udid, "-b"], "iOS simulator boot readiness", options.run, { signal: options.startOptions.signal });
+  await trustIosSimulatorDevelopmentCa(options.startOptions, device.udid, options.run, options.log);
+  return { caEnrollmentServer: null, startedSimulator, udid: device.udid };
 }, startAbsoluteIosDevSession = async (options) => {
   const { project } = options;
+  const deviceIdentifier = options.deviceIdentifier ? normalizeAbsoluteIosDeviceIdentifier(options.deviceIdentifier) : undefined;
+  const targetKind = deviceIdentifier ? "device" : "simulator";
+  const serverHost = deviceIdentifier ? normalizeAbsoluteIosDeviceHost(options.serverHost ?? "") : "localhost";
   const capture = options.capture ?? defaultCapture3;
   const run = options.run ?? defaultRun3;
   const sleep = options.sleep ?? Bun.sleep;
@@ -3287,6 +3648,7 @@ var ABSOLUTE_IOS_SIMULATOR_NAME = "AbsoluteJS iPhone", BOOT_TIMEOUT_MS = 180000,
     options.onStateChange?.(next);
   };
   let nativeLogs = null;
+  let caEnrollmentServer = null;
   const closeLogs = async () => {
     const stream = nativeLogs;
     nativeLogs = null;
@@ -3294,38 +3656,66 @@ var ABSOLUTE_IOS_SIMULATOR_NAME = "AbsoluteJS iPhone", BOOT_TIMEOUT_MS = 180000,
       return;
     });
   };
+  const relaunchTarget = async (udid) => {
+    if (deviceIdentifier && options.nativeLog) {
+      await closeLogs();
+      nativeLogs = attachNativeLogs(project, udid, options);
+      return;
+    }
+    await requireSuccess2(iosLaunchCommand(project, udid, deviceIdentifier !== undefined), "iOS app relaunch", run, { signal: options.signal });
+  };
   try {
     await repairAbsoluteIosDevSession(project.projectRoot);
     throwIfAborted2(options.signal);
     transition("syncing");
     await requireSuccess2([project.cap, "sync", "ios"], "Capacitor iOS synchronization", run, { cwd: project.projectRoot, signal: options.signal });
     transition("configuring");
-    await writeDevProjection(project, options.port, options.https === true);
+    await writeDevProjection(project, options.port, options.https === true, serverHost);
     throwIfAborted2(options.signal);
     const fingerprintStartedAt = performance.now();
     const fingerprintPromise = fingerprintAbsoluteIosDevProject(project).then((fingerprint2) => {
       timings.fingerprinting = performance.now() - fingerprintStartedAt;
       return fingerprint2;
     });
-    transition("booting");
-    const { created, device } = await ensureManagedSimulator(project, capture);
-    const startedSimulator = created || device.state !== "Booted";
-    bootSimulator(project, device, capture);
-    spawn([
-      "open",
-      "-a",
-      "Simulator",
-      "--args",
-      "-CurrentDeviceUDID",
-      device.udid
-    ]);
-    transition("connecting");
-    await waitForBootedSimulator(project, device.udid, capture, sleep, options.signal);
-    await requireSuccess2([project.xcrun, "simctl", "bootstatus", device.udid, "-b"], "iOS simulator boot readiness", run, { signal: options.signal });
+    const target = deviceIdentifier ? await preparePhysicalIosTarget({
+      capture,
+      deviceIdentifier,
+      log,
+      project,
+      serverHost,
+      startOptions: options,
+      transition
+    }) : await prepareIosSimulatorTarget({
+      capture,
+      log,
+      project,
+      run,
+      sleep,
+      spawn,
+      startOptions: options,
+      transition
+    });
+    const {
+      caEnrollmentServer: targetCaEnrollmentServer,
+      startedSimulator,
+      udid
+    } = target;
+    caEnrollmentServer = targetCaEnrollmentServer;
     const fingerprint = await fingerprintPromise;
     transition("checking-native");
-    const nativeCacheHit = await ensureIosDebugApp({
-      cache: await readNativeCache2(project.projectRoot),
+    const cache = await readNativeCache2(project.projectRoot);
+    const nativeCacheHit = deviceIdentifier ? await ensurePhysicalIosDebugApp({
+      cache,
+      capture,
+      fingerprint,
+      identifier: deviceIdentifier,
+      log,
+      project,
+      run,
+      signal: options.signal,
+      transition
+    }) : await ensureIosDebugApp({
+      cache,
       capture,
       fingerprint,
       log,
@@ -3333,24 +3723,18 @@ var ABSOLUTE_IOS_SIMULATOR_NAME = "AbsoluteJS iPhone", BOOT_TIMEOUT_MS = 180000,
       run,
       signal: options.signal,
       transition,
-      udid: device.udid
+      udid
     });
     throwIfAborted2(options.signal);
     if (options.nativeLog)
       transition("streaming-logs");
-    nativeLogs = attachNativeLogs(project, device.udid, options);
+    nativeLogs = attachNativeLogs(project, udid, options);
     transition("launching");
-    await requireSuccess2([
-      project.xcrun,
-      "simctl",
-      "launch",
-      "--terminate-running-process",
-      device.udid,
-      project.config.appId
-    ], "iOS app launch", run, { signal: options.signal });
+    if (!deviceIdentifier || !nativeLogs)
+      await requireSuccess2(iosLaunchCommand(project, udid, deviceIdentifier !== undefined), "iOS app launch", run, { signal: options.signal });
     transition("ready");
     timings.total = performance.now() - startedAt;
-    log(`iOS simulator connected (${device.udid}) with HMR on port ${options.port} in ${getDurationString(timings.total)} (${nativeCacheHit ? "native cache hit" : "native build installed"}).`);
+    log(`iOS ${targetKind} connected with HMR on port ${options.port} in ${getDurationString(timings.total)} (${nativeCacheHit ? "native cache hit" : "native build installed"}).`);
     log(`iOS startup: ${timingSummary(timings)}.`);
     let closed = false;
     const close = async () => {
@@ -3359,6 +3743,10 @@ var ABSOLUTE_IOS_SIMULATOR_NAME = "AbsoluteJS iPhone", BOOT_TIMEOUT_MS = 180000,
       closed = true;
       transition("closing");
       await closeLogs();
+      await caEnrollmentServer?.close().catch(() => {
+        return;
+      });
+      caEnrollmentServer = null;
       await repairAbsoluteIosDevSession(project.projectRoot);
       transition("closed");
     };
@@ -3366,8 +3754,9 @@ var ABSOLUTE_IOS_SIMULATOR_NAME = "AbsoluteJS iPhone", BOOT_TIMEOUT_MS = 180000,
       close,
       nativeCacheHit,
       startedSimulator,
+      targetKind,
       timings: { ...timings },
-      udid: device.udid,
+      udid,
       rebuild: async () => {
         if (closed)
           throw new Error("iOS development session is closed.");
@@ -3380,22 +3769,17 @@ var ABSOLUTE_IOS_SIMULATOR_NAME = "AbsoluteJS iPhone", BOOT_TIMEOUT_MS = 180000,
           throw new Error("iOS development session is closed.");
         transition("launching");
         try {
-          await requireSuccess2([
-            project.xcrun,
-            "simctl",
-            "launch",
-            "--terminate-running-process",
-            device.udid,
-            project.config.appId
-          ], "iOS app relaunch", run, { signal: options.signal });
+          await relaunchTarget(udid);
           transition("ready");
-          log(`iOS app relaunched on ${device.udid}.`);
+          log(`iOS app relaunched on the selected ${targetKind}.`);
         } catch (error) {
           transition("failed");
           throw error;
         }
       },
       screenshot: async (destination) => {
+        if (deviceIdentifier)
+          throw new Error("Physical iOS screenshots are captured in Xcode Device Hub; the CLI never records a device screen automatically.");
         const resolved = resolve7(project.projectRoot, destination);
         if (!isInside2(project.projectRoot, resolved))
           throw new Error("iOS screenshot destination must remain inside the project.");
@@ -3404,7 +3788,7 @@ var ABSOLUTE_IOS_SIMULATOR_NAME = "AbsoluteJS iPhone", BOOT_TIMEOUT_MS = 180000,
           project.xcrun,
           "simctl",
           "io",
-          device.udid,
+          udid,
           "screenshot",
           resolved
         ], "iOS simulator screenshot", run, { signal: options.signal });
@@ -3417,6 +3801,9 @@ var ABSOLUTE_IOS_SIMULATOR_NAME = "AbsoluteJS iPhone", BOOT_TIMEOUT_MS = 180000,
   } catch (error) {
     transition("failed");
     await closeLogs();
+    await caEnrollmentServer?.close().catch(() => {
+      return;
+    });
     await repairAbsoluteIosDevSession(project.projectRoot);
     throw error;
   }
@@ -3425,6 +3812,7 @@ var init_iosSimulatorController = __esm(() => {
   init_emulatorDoctor();
   init_capacitorProject();
   init_iosRelease();
+  init_iosPhysicalDeviceTransport();
   init_getDurationString();
   SECRET_VALUE = /((?:authorization|cookie|password|secret|token|oauth[_-]?code)\s*[:=]\s*)([^\s,;]+)/giu;
   BEARER_VALUE = new RegExp(String.raw`\bBearer\s+[A-Za-z0-9._~+/-]+=*`, "giu");
@@ -3436,6 +3824,7 @@ var init_iosSimulatorController = __esm(() => {
     ["fingerprinting", "fingerprint"],
     ["booting", "simulator"],
     ["connecting", "device ready"],
+    ["enrolling-trust", "HTTPS trust"],
     ["checking-native", "app check"],
     ["building", "Xcode"],
     ["installing", "install"],
@@ -3448,9 +3837,10 @@ var init_iosSimulatorController = __esm(() => {
 var ABSOLUTE_REMOTE_MAC_EVENT_PREFIX = "ABSOLUTE_REMOTE_MAC\t", ABSOLUTE_REMOTE_MAC_PROTOCOL_VERSION = 1;
 
 // src/mobile/remoteMacProtocol.ts
-import { createHash as createHash5, randomUUID as randomUUID3 } from "crypto";
-import { chmod, mkdir as mkdir5, readFile as readFile6, rename as rename5, writeFile as writeFile5 } from "fs/promises";
+import { createHash as createHash5, randomUUID as randomUUID4 } from "crypto";
+import { chmod, mkdir as mkdir5, readFile as readFile7, rename as rename5, writeFile as writeFile5 } from "fs/promises";
 import { homedir as homedir4 } from "os";
+import { isIP as isIP3 } from "net";
 import {
   dirname as dirname6,
   isAbsolute as isAbsolute4,
@@ -3465,7 +3855,7 @@ var PROFILE_FORMAT = 1, REMOTE_STDIN_FLUSH_ATTEMPTS = 3, PROFILE_NAME, SSH_DESTI
   profiles: {}
 }), loadStore = async (path = defaultProfilePath()) => {
   try {
-    const parsed = JSON.parse(await readFile6(path, "utf8"));
+    const parsed = JSON.parse(await readFile7(path, "utf8"));
     if (parsed.format !== PROFILE_FORMAT || typeof parsed.profiles !== "object" || parsed.profiles === null || Array.isArray(parsed.profiles))
       throw new Error("Unsupported remote Mac profile format.");
     for (const [key, profile] of Object.entries(parsed.profiles)) {
@@ -3482,7 +3872,7 @@ var PROFILE_FORMAT = 1, REMOTE_STDIN_FLUSH_ATTEMPTS = 3, PROFILE_NAME, SSH_DESTI
   }
 }, saveStore = async (store, path = defaultProfilePath()) => {
   await mkdir5(dirname6(path), { recursive: true });
-  const temporary = `${path}.${randomUUID3()}.tmp`;
+  const temporary = `${path}.${randomUUID4()}.tmp`;
   await writeFile5(temporary, `${JSON.stringify(store, null, 2)}
 `, {
     mode: 384
@@ -3564,6 +3954,18 @@ var PROFILE_FORMAT = 1, REMOTE_STDIN_FLUSH_ATTEMPTS = 3, PROFILE_NAME, SSH_DESTI
   if (!xcodeVersion?.startsWith("Xcode "))
     throw new Error("The remote Mac must have full Xcode installed and selected.");
   return { bunPath, home, os: operatingSystem, xcodeVersion };
+}, inspectAbsoluteRemoteMacLanHost = async (profile, transport) => {
+  const capture = transport?.capture ?? defaultTransport.capture;
+  const script = `default_interface="$(/sbin/route -n get default 2>/dev/null | /usr/bin/awk '/interface:/{print $2; exit}')"; for interface in "$default_interface" en0 en1; do [ -n "$interface" ] || continue; address="$(/usr/sbin/ipconfig getifaddr "$interface" 2>/dev/null || true)"; if [ -n "$address" ]; then printf '%s\\n' "$address"; exit 0; fi; done; exit 1`;
+  const result = await capture([
+    ...absoluteRemoteMacSshBase(profile),
+    "/bin/sh -lc",
+    shellQuote(script)
+  ]);
+  const host = requireRemoteSuccess(result, "Remote Mac LAN address discovery").trim();
+  if (isIP3(host) === 0)
+    throw new Error("The Remote Mac did not report a device-reachable LAN address.");
+  return host;
 }, listAbsoluteRemoteMacProfiles = async (profilePath) => {
   const store = await loadStore(profilePath);
   return {
@@ -3630,7 +4032,7 @@ var PROFILE_FORMAT = 1, REMOTE_STDIN_FLUSH_ATTEMPTS = 3, PROFILE_NAME, SSH_DESTI
   ]);
   if (verified.exitCode === 0)
     return { ...artifact, remotePath, uploaded: false };
-  const temporary = posix.join(directory, `.agent-${randomUUID3()}.tmp`);
+  const temporary = posix.join(directory, `.agent-${randomUUID4()}.tmp`);
   const installScript = [
     "set -eu",
     "umask 077",
@@ -3717,7 +4119,7 @@ var PROFILE_FORMAT = 1, REMOTE_STDIN_FLUSH_ATTEMPTS = 3, PROFILE_NAME, SSH_DESTI
 }), absoluteRemoteProjectSyncCommands = (project) => {
   const current = project.remoteProjectRoot;
   const parent = posix.dirname(current);
-  const staging = posix.join(parent, `.incoming-${randomUUID3()}`);
+  const staging = posix.join(parent, `.incoming-${randomUUID4()}`);
   const previous = posix.join(parent, ".previous");
   const script = [
     "set -eu",
@@ -3806,6 +4208,13 @@ var PROFILE_FORMAT = 1, REMOTE_STDIN_FLUSH_ATTEMPTS = 3, PROFILE_NAME, SSH_DESTI
   await syncProject(options.project);
   const syncDuration = performance.now() - syncStartedAt;
   const encodedConfig = Buffer.from(JSON.stringify(portableMobileConfig(options.project))).toString("base64url");
+  const encodedCertificateAuthority = options.certificateAuthorityPath ? (await readFile7(options.certificateAuthorityPath)).toString("base64url") : undefined;
+  const physicalDevice = options.deviceIdentifier !== undefined;
+  let relayPort;
+  if (physicalDevice)
+    relayPort = options.port <= 49151 ? options.port + 16384 : options.port - 16384;
+  if (physicalDevice && !options.serverHost)
+    throw new Error("Remote physical iOS development requires the Remote Mac LAN host.");
   const remoteCommand = [
     `cd ${shellQuote(options.project.remoteProjectRoot)}`,
     "&&",
@@ -3816,14 +4225,26 @@ var PROFILE_FORMAT = 1, REMOTE_STDIN_FLUSH_ATTEMPTS = 3, PROFILE_NAME, SSH_DESTI
     String(options.port),
     "--mobile-config",
     shellQuote(encodedConfig),
-    ...options.https ? ["--https"] : []
+    ...encodedCertificateAuthority ? [
+      "--certificate-authority",
+      shellQuote(encodedCertificateAuthority)
+    ] : [],
+    ...options.https ? ["--https"] : [],
+    ...options.deviceIdentifier ? [
+      "--ios-device",
+      shellQuote(options.deviceIdentifier),
+      "--server-host",
+      shellQuote(options.serverHost ?? ""),
+      "--relay-port",
+      String(relayPort)
+    ] : []
   ].join(" ");
   const command = [
     ...absoluteRemoteMacSshBase(options.project.profile),
     "-o",
     "ExitOnForwardFailure=yes",
     "-R",
-    `${options.port}:127.0.0.1:${options.port}`,
+    physicalDevice ? `127.0.0.1:${relayPort}:127.0.0.1:${options.port}` : `${options.port}:127.0.0.1:${options.port}`,
     "/bin/sh -lc",
     shellQuote(remoteCommand)
   ];
@@ -3911,7 +4332,7 @@ var PROFILE_FORMAT = 1, REMOTE_STDIN_FLUSH_ATTEMPTS = 3, PROFILE_NAME, SSH_DESTI
   };
   options.log?.(`Remote Mac connected (${options.project.profile.name}); agent ${agent.uploaded ? "uploaded" : "cache hit"}, project synced, and iOS ready in ${totalDuration.toFixed(2)}ms.`);
   const request = (commandName) => {
-    const id = randomUUID3();
+    const id = randomUUID4();
     const response = new Promise((resolve8, reject) => pending.set(id, { reject, resolve: resolve8 }));
     process2.stdin.write(`${JSON.stringify({ command: commandName, id, v: 1 })}
 `);
@@ -3944,6 +4365,7 @@ var PROFILE_FORMAT = 1, REMOTE_STDIN_FLUSH_ATTEMPTS = 3, PROFILE_NAME, SSH_DESTI
     close,
     nativeCacheHit: currentReady.nativeCacheHit,
     startedSimulator: currentReady.startedSimulator,
+    targetKind: currentReady.targetKind,
     timings: currentReady.timings,
     udid: currentReady.udid,
     rebuild: async () => {
@@ -3999,9 +4421,11 @@ var init_remoteMacProtocol = __esm(() => {
 var exports_devCert = {};
 __export(exports_devCert, {
   setupMkcert: () => setupMkcert,
+  normalizeDevCertificateHosts: () => normalizeDevCertificateHosts,
   loadDevCert: () => loadDevCert,
   hasMkcert: () => hasMkcert,
   hasCert: () => hasCert,
+  getDevCertificateAuthorityPath: () => getDevCertificateAuthorityPath,
   ensureDevCert: () => ensureDevCert
 });
 import {
@@ -4011,20 +4435,31 @@ import {
   readFileSync as readFileSync7,
   rmSync
 } from "fs";
+import { X509Certificate as X509Certificate2 } from "crypto";
+import { isIP as isIP4 } from "net";
 import { platform as platform2 } from "os";
 import { join as join12 } from "path";
-var CERT_DIR, CERT_PATH, KEY_PATH, CERT_VALIDITY_DAYS = 365, devLog = (msg) => console.log(`\x1B[2m${new Date().toLocaleTimeString()}\x1B[0m \x1B[36m[dev]\x1B[0m ${msg}`), devWarn = (msg) => console.log(`\x1B[2m${new Date().toLocaleTimeString()}\x1B[0m \x1B[33m[dev]\x1B[0m \x1B[33m${msg}\x1B[0m`), certFilesExist = () => existsSync4(CERT_PATH) && existsSync4(KEY_PATH), isCertExpired = () => {
+var CERT_DIR, CERT_PATH, KEY_PATH, CERT_VALIDITY_DAYS = 365, DEFAULT_CERTIFICATE_HOSTS, CERTIFICATE_HOSTNAME_PATTERN, devLog = (msg) => console.log(`\x1B[2m${new Date().toLocaleTimeString()}\x1B[0m \x1B[36m[dev]\x1B[0m ${msg}`), devWarn = (msg) => console.log(`\x1B[2m${new Date().toLocaleTimeString()}\x1B[0m \x1B[33m[dev]\x1B[0m \x1B[33m${msg}\x1B[0m`), certFilesExist = () => existsSync4(CERT_PATH) && existsSync4(KEY_PATH), normalizeDevCertificateHosts = (hosts = []) => {
+  const normalized = new Set(DEFAULT_CERTIFICATE_HOSTS);
+  for (const host of hosts) {
+    const value = host.trim().toLowerCase();
+    if (!value || value === "0.0.0.0" || value === "::")
+      continue;
+    if (isIP4(value) === 0 && !CERTIFICATE_HOSTNAME_PATTERN.test(value)) {
+      throw new TypeError(`Invalid development certificate host: ${host}`);
+    }
+    normalized.add(value);
+  }
+  return [...normalized];
+}, certificateIsUsable = (hosts) => {
   try {
     const certPem = readFileSync7(CERT_PATH, "utf-8");
-    const proc = Bun.spawnSync(["openssl", "x509", "-enddate", "-noout"], {
-      stdin: new TextEncoder().encode(certPem)
-    });
-    const output = new TextDecoder().decode(proc.stdout).trim();
-    const dateStr = output.replace("notAfter=", "");
-    const expiryDate = new Date(dateStr);
-    return expiryDate.getTime() < Date.now();
+    const certificate = new X509Certificate2(certPem);
+    if (new Date(certificate.validTo).getTime() <= Date.now())
+      return false;
+    return normalizeDevCertificateHosts(hosts).every((host) => isIP4(host) ? certificate.checkIP(host) !== undefined : certificate.checkHost(host) !== undefined);
   } catch {
-    return true;
+    return false;
   }
 }, hasMkcert = () => {
   try {
@@ -4036,22 +4471,21 @@ var CERT_DIR, CERT_PATH, KEY_PATH, CERT_VALIDITY_DAYS = 365, devLog = (msg) => c
   } catch {
     return false;
   }
-}, generateWithMkcert = () => {
+}, generateWithMkcert = (hosts = []) => {
   const result = Bun.spawnSync([
     "mkcert",
     "-cert-file",
     CERT_PATH,
     "-key-file",
     KEY_PATH,
-    "localhost",
-    "127.0.0.1",
-    "::1"
+    ...normalizeDevCertificateHosts(hosts)
   ], { stderr: "pipe", stdout: "pipe" });
   if (result.exitCode !== 0) {
     const err = new TextDecoder().decode(result.stderr);
     throw new Error(`mkcert failed: ${err}`);
   }
-}, generateSelfSigned = () => {
+}, generateSelfSigned = (hosts = []) => {
+  const subjectAlternativeNames = normalizeDevCertificateHosts(hosts).map((host) => `${isIP4(host) ? "IP" : "DNS"}:${host}`).join(",");
   const proc = Bun.spawnSync([
     "openssl",
     "req",
@@ -4070,36 +4504,36 @@ var CERT_DIR, CERT_PATH, KEY_PATH, CERT_VALIDITY_DAYS = 365, devLog = (msg) => c
     "-subj",
     "/CN=localhost",
     "-addext",
-    "subjectAltName=DNS:localhost,IP:127.0.0.1,IP:::1"
+    `subjectAltName=${subjectAlternativeNames}`
   ], { stderr: "pipe", stdout: "pipe" });
   if (proc.exitCode !== 0) {
     const err = new TextDecoder().decode(proc.stderr);
     throw new Error(`openssl failed: ${err}`);
   }
   devLog("Using self-signed certificate \u2014 browser will show a one-time warning");
-}, generateCert = () => {
+}, generateCert = (hosts = []) => {
   if (hasMkcert()) {
-    generateWithMkcert();
+    generateWithMkcert(hosts);
   } else {
-    generateSelfSigned();
+    generateSelfSigned(hosts);
   }
-}, ensureDevCert = () => {
+}, ensureDevCert = (hosts = []) => {
   mkdirSync4(CERT_DIR, { recursive: true });
-  if (hasCert()) {
+  if (hasCert(hosts)) {
     return { cert: CERT_PATH, key: KEY_PATH };
   }
   if (certFilesExist()) {
-    devLog("Certificate expired, regenerating...");
+    devLog("Certificate is expired or missing a required host, regenerating...");
   }
   try {
-    generateCert();
+    generateCert(hosts);
   } catch (err) {
     devWarn(`Failed to generate certificate: ${err instanceof Error ? err.message : err}`);
     return null;
   }
   return { cert: CERT_PATH, key: KEY_PATH };
-}, hasCert = () => certFilesExist() && !isCertExpired(), loadDevCert = () => {
-  const paths = ensureDevCert();
+}, hasCert = (hosts = []) => certFilesExist() && certificateIsUsable(hosts), loadDevCert = (hosts = []) => {
+  const paths = ensureDevCert(hosts);
   if (!paths)
     return null;
   try {
@@ -4215,7 +4649,15 @@ var CERT_DIR, CERT_PATH, KEY_PATH, CERT_VALIDITY_DAYS = 365, devLog = (msg) => c
   } catch {
     return null;
   }
-}, mkcertCaRoot = () => runCapture(["mkcert", "-CAROOT"]), toWindowsPath = (linuxPath) => runCapture(["wslpath", "-w", linuxPath]), windowsTempDir = () => {
+}, mkcertCaRoot = () => runCapture(["mkcert", "-CAROOT"]), getDevCertificateAuthorityPath = () => {
+  const caRoot = hasMkcert() ? mkcertCaRoot() : null;
+  const rootCertificate = caRoot ? join12(caRoot, "rootCA.pem") : null;
+  if (rootCertificate && existsSync4(rootCertificate))
+    return rootCertificate;
+  if (certFilesExist())
+    return CERT_PATH;
+  return null;
+}, toWindowsPath = (linuxPath) => runCapture(["wslpath", "-w", linuxPath]), windowsTempDir = () => {
   const winTemp = runCapture(["cmd.exe", "/c", "echo %TEMP%"]);
   if (!winTemp)
     return null;
@@ -4249,7 +4691,7 @@ var CERT_DIR, CERT_PATH, KEY_PATH, CERT_VALIDITY_DAYS = 365, devLog = (msg) => c
   ], { stderr: "pipe", stdout: "pipe" });
   rmSync(staged, { force: true });
   return result.exitCode === 0;
-}, setupMkcert = () => {
+}, setupMkcert = (hosts = []) => {
   if (!ensureMkcert())
     return false;
   const installResult = Bun.spawnSync(["mkcert", "-install"], {
@@ -4276,7 +4718,7 @@ var CERT_DIR, CERT_PATH, KEY_PATH, CERT_VALIDITY_DAYS = 365, devLog = (msg) => c
   rmSync(CERT_PATH, { force: true });
   rmSync(KEY_PATH, { force: true });
   mkdirSync4(CERT_DIR, { recursive: true });
-  generateWithMkcert();
+  generateWithMkcert(hosts);
   console.log("");
   devLog("mkcert installed \u2014 HTTPS certificates are now locally trusted");
   return true;
@@ -4285,6 +4727,8 @@ var init_devCert = __esm(() => {
   CERT_DIR = join12(process.cwd(), ".absolutejs");
   CERT_PATH = join12(CERT_DIR, "cert.pem");
   KEY_PATH = join12(CERT_DIR, "key.pem");
+  DEFAULT_CERTIFICATE_HOSTS = ["localhost", "127.0.0.1", "::1"];
+  CERTIFICATE_HOSTNAME_PATTERN = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(?:\.(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?))*$/u;
 });
 
 // src/cli/scripts/eslintChunked.ts
@@ -5689,7 +6133,7 @@ var normalizeSlug = (str) => str.trim().replace(/\s+/g, "-").replace(/[^A-Za-z0-
 
 // src/mobile/buildRelease.ts
 import { createHash as createHash8 } from "crypto";
-import { mkdir as mkdir7, readFile as readFile7, writeFile as writeFile6 } from "fs/promises";
+import { mkdir as mkdir7, readFile as readFile8, writeFile as writeFile6 } from "fs/promises";
 import { basename as basename6, dirname as dirname9, extname as extname3, join as join16, relative as relative9, resolve as resolve13 } from "path";
 var sha256 = (bytes) => createHash8("sha256").update(bytes).digest("hex"), STATIC_SCRIPT_PATTERN, rewriteStaticScriptPaths = (source, manifest) => source.replace(STATIC_SCRIPT_PATTERN, (match, prefix, path, suffix) => {
   if (path.endsWith("/htmx.min.js"))
@@ -5711,7 +6155,7 @@ var sha256 = (bytes) => createHash8("sha256").update(bytes).digest("hex"), STATI
   }
   let resolvedAssetPath = resolveAssetPath(buildDirectory, assetPath);
   if (metadata.framework === "html" || metadata.framework === "htmx") {
-    const source = await readFile7(resolvedAssetPath, "utf8");
+    const source = await readFile8(resolvedAssetPath, "utf8");
     const rewritten = rewriteStaticScriptPaths(source, manifest);
     const documentHash = sha256(new TextEncoder().encode(rewritten));
     resolvedAssetPath = join16(buildDirectory, ".absolutejs", "mobile-pages", `${documentHash}.html`);
@@ -5725,8 +6169,8 @@ var sha256 = (bytes) => createHash8("sha256").update(bytes).digest("hex"), STATI
   ].map((key) => manifest[key]).find((path) => typeof path === "string");
   const resolvedStylePath = styleAssetPath ? resolveAssetPath(buildDirectory, styleAssetPath) : undefined;
   const [bytes, styleBytes] = await Promise.all([
-    readFile7(resolvedAssetPath),
-    resolvedStylePath ? readFile7(resolvedStylePath) : undefined
+    readFile8(resolvedAssetPath),
+    resolvedStylePath ? readFile8(resolvedStylePath) : undefined
   ]);
   const bundlePath = `/${relative9(resolve13(buildDirectory), resolvedAssetPath).replaceAll("\\", "/")}`;
   const styleBundlePath = resolvedStylePath ? `/${relative9(resolve13(buildDirectory), resolvedStylePath).replaceAll("\\", "/")}` : undefined;
@@ -5745,7 +6189,7 @@ var sha256 = (bytes) => createHash8("sha256").update(bytes).digest("hex"), STATI
 }, buildAbsoluteMobileCompatibilityRelease = async (options) => {
   const [captured, producerBytes] = await Promise.all([
     captureAbsoluteMobileRouteGraph(options.app),
-    readFile7(options.producerPath)
+    readFile8(options.producerPath)
   ]);
   if (captured.length === 0) {
     throw new TypeError("No instrumented AbsoluteJS mobile page routes were found in the finalized Elysia route graph.");
@@ -5925,7 +6369,7 @@ import {
   copyFile as copyFile4,
   mkdir as mkdir8,
   mkdtemp as mkdtemp3,
-  readFile as readFile8,
+  readFile as readFile9,
   rename as rename6,
   rm as rm5,
   writeFile as writeFile7
@@ -5983,7 +6427,7 @@ var MANIFEST_FILE = "absolute-mobile-manifest.json", BOOTSTRAP_FILE = "absolute-
   const packageName = specifier.startsWith("@") ? segments.slice(0, 2).join("/") : segments[0] ?? "";
   const subpath = specifier.slice(packageName.length);
   const packageDirectory = join17(resolve14(projectRoot), "node_modules", packageName);
-  const manifest = JSON.parse(await readFile8(join17(packageDirectory, "package.json"), "utf8"));
+  const manifest = JSON.parse(await readFile9(join17(packageDirectory, "package.json"), "utf8"));
   const exports = typeof manifest === "object" && manifest !== null ? Reflect.get(manifest, "exports") : undefined;
   const entry = typeof exports === "object" && exports !== null ? Reflect.get(exports, subpath ? `.${subpath}` : ".") : undefined;
   const target = importEntryTarget(entry);
@@ -6085,7 +6529,7 @@ void startAbsoluteMobileShell(${push ? `{ createAuth: (config, options) => creat
     ...localStylePath ? { localStylePath } : {}
   };
 }, absoluteClientImports = async (sourcePath, buildDirectory) => {
-  const source = await readFile8(sourcePath, "utf8");
+  const source = await readFile9(sourcePath, "utf8");
   const extension = extname4(sourcePath).toLowerCase();
   let scriptLoader;
   if (extension === ".tsx")
@@ -6227,7 +6671,7 @@ import {
   access as access6,
   mkdir as mkdir9,
   mkdtemp as mkdtemp4,
-  readFile as readFile9,
+  readFile as readFile10,
   rename as rename7,
   rm as rm6,
   writeFile as writeFile8
@@ -6327,7 +6771,7 @@ var ABSOLUTE_MOBILE_MATERIALIZED_BUNDLE_FORMAT = 1, CURRENT_BUNDLE_FILE = "curre
 }, readAbsoluteMobileMaterializedReleases = async (root) => {
   const resolvedRoot = resolvePath2(root);
   try {
-    const serialized = await readFile9(join18(resolvedRoot, CURRENT_BUNDLE_FILE), "utf8");
+    const serialized = await readFile10(join18(resolvedRoot, CURRENT_BUNDLE_FILE), "utf8");
     const parsed = JSON.parse(serialized);
     const index = parseBundleIndex(parsed);
     const bundleRoot = join18(resolvedRoot, BUNDLES_DIRECTORY, index.bundleId);
@@ -7029,7 +7473,7 @@ var init_deviceCapabilities = __esm(() => {
 });
 
 // src/mobile/buildPipeline.ts
-import { readFile as readFile10 } from "fs/promises";
+import { readFile as readFile11 } from "fs/promises";
 import { join as join21, resolve as resolve17 } from "path";
 import { pathToFileURL } from "url";
 var isElysiaApp = (value) => typeof value === "object" && value !== null && typeof Reflect.get(value, "compile") === "function" && Array.isArray(Reflect.get(value, "routes")), isStringRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && Object.values(value).every((entry) => typeof entry === "string"), serverExportName = (loaded, app) => {
@@ -7063,7 +7507,7 @@ var isElysiaApp = (value) => typeof value === "object" && value !== null && type
   const mobile = normalizeAbsoluteMobileConfig(options.mobile, options.projectRoot);
   const root = join21(buildDirectory, ".absolutejs", "mobile-compatibility");
   const [manifestSource, previous] = await Promise.all([
-    readFile10(join21(buildDirectory, "manifest.json"), "utf8"),
+    readFile11(join21(buildDirectory, "manifest.json"), "utf8"),
     readAbsoluteMobileMaterializedReleases(root)
   ]);
   const manifest = JSON.parse(manifestSource);
@@ -10769,8 +11213,8 @@ export { value };
   host2.getSourceFile = (fileName, languageVersion, onError, shouldCreate) => fileName === virtualPath ? ts6.createSourceFile(fileName, source, languageVersion, true) : getSourceFile(fileName, languageVersion, onError, shouldCreate);
   const fileExists = host2.fileExists.bind(host2);
   host2.fileExists = (fileName) => fileName === virtualPath ? true : fileExists(fileName);
-  const readFile11 = host2.readFile.bind(host2);
-  host2.readFile = (fileName) => fileName === virtualPath ? source : readFile11(fileName);
+  const readFile12 = host2.readFile.bind(host2);
+  host2.readFile = (fileName) => fileName === virtualPath ? source : readFile12(fileName);
   const program = ts6.createProgram([virtualPath], options, host2);
   const checker = program.getTypeChecker();
   const sourceFile = program.getSourceFile(virtualPath);
@@ -16393,10 +16837,10 @@ var init_compile = __esm(() => {
 });
 
 // src/mobile/nativeDeepLinks.ts
-import { readFile as readFile11, rename as rename8, writeFile as writeFile9 } from "fs/promises";
+import { readFile as readFile12, rename as rename8, writeFile as writeFile9 } from "fs/promises";
 import { join as join46 } from "path";
 var START_MARKER = "<!-- absolutejs:deep-links:start -->", END_MARKER = "<!-- absolutejs:deep-links:end -->", IOS_ENTITLEMENTS = "App/AbsoluteJS.entitlements", NOT_FOUND = -1, escapeXml = (value) => value.replaceAll("&", "&amp;").replaceAll('"', "&quot;").replaceAll("'", "&apos;").replaceAll("<", "&lt;").replaceAll(">", "&gt;"), writeChangedFile = async (path, source) => {
-  const current = await readFile11(path, "utf8");
+  const current = await readFile12(path, "utf8");
   if (current === source)
     return false;
   const temporary = `${path}.${crypto.randomUUID()}.tmp`;
@@ -16444,7 +16888,7 @@ ${hosts}
 `;
 }, configureAndroid = async (config) => {
   const path = join46(config.nativeProjectDirectory, "android/app/src/main/AndroidManifest.xml");
-  const source = await readFile11(path, "utf8");
+  const source = await readFile12(path, "utf8");
   const mainActivity = source.indexOf('android:name=".MainActivity"');
   if (mainActivity === NOT_FOUND) {
     throw new TypeError("Android MainActivity was not found.");
@@ -16468,7 +16912,7 @@ ${hosts}
 	${END_MARKER}
 `, configureIosInfo = async (config) => {
   const path = join46(config.nativeProjectDirectory, "ios/App/App/Info.plist");
-  const source = await readFile11(path, "utf8");
+  const source = await readFile12(path, "utf8");
   const region = config.deepLinkScheme ? iosSchemeRegion(config.deepLinkScheme) : `	${START_MARKER}
 	${END_MARKER}
 `;
@@ -16492,7 +16936,7 @@ ${domains}
   const path = join46(config.nativeProjectDirectory, "ios/App/AbsoluteJS.entitlements");
   let current = "";
   try {
-    current = await readFile11(path, "utf8");
+    current = await readFile12(path, "utf8");
   } catch (error) {
     if (!(error instanceof Error) || !("code" in error) || error.code !== "ENOENT") {
       throw error;
@@ -16507,7 +16951,7 @@ ${domains}
   return true;
 }, configureIosProject = async (config) => {
   const path = join46(config.nativeProjectDirectory, "ios/App/App.xcodeproj/project.pbxproj");
-  const source = await readFile11(path, "utf8");
+  const source = await readFile12(path, "utf8");
   const declarations = [
     ...source.matchAll(/CODE_SIGN_ENTITLEMENTS = ([^;]+);/g)
   ].map((match) => match[1]);
@@ -16545,10 +16989,10 @@ ${domains}
 var init_nativeDeepLinks = () => {};
 
 // src/mobile/nativeDeviceCapabilities.ts
-import { readFile as readFile12, rename as rename9, writeFile as writeFile10 } from "fs/promises";
+import { readFile as readFile13, rename as rename9, writeFile as writeFile10 } from "fs/promises";
 import { join as join47 } from "path";
 var START_MARKER2 = "<!-- absolutejs:device-capabilities:start -->", END_MARKER2 = "<!-- absolutejs:device-capabilities:end -->", NOT_FOUND2 = -1, IOS_PRIVACY_FILE_REFERENCE = "A85D0C000000000000000001", IOS_PRIVACY_BUILD_FILE = "A85D0C000000000000000002", PUSH_START_MARKER = "absolutejs:push-notifications:start", PUSH_END_MARKER = "absolutejs:push-notifications:end", escapeXml2 = (value) => value.replaceAll("&", "&amp;").replaceAll('"', "&quot;").replaceAll("'", "&apos;").replaceAll("<", "&lt;").replaceAll(">", "&gt;"), writeChangedFile2 = async (path, source) => {
-  const current = await readFile12(path, "utf8");
+  const current = await readFile13(path, "utf8");
   if (current === source)
     return false;
   const temporary = `${path}.${crypto.randomUUID()}.tmp`;
@@ -16566,7 +17010,7 @@ var START_MARKER2 = "<!-- absolutejs:device-capabilities:start -->", END_MARKER2
   return writeChangedFile2(path, source);
 }, optionalSource = async (path) => {
   try {
-    return await readFile12(path, "utf8");
+    return await readFile13(path, "utf8");
   } catch (error) {
     if (typeof error === "object" && error !== null && Reflect.get(error, "code") === "ENOENT")
       return null;
@@ -16674,7 +17118,7 @@ ${entries}
   if (requirements.iosPrivacyAccessedApis.length === 0)
     return false;
   const projectPath = join47(config.nativeProjectDirectory, "ios/App/App.xcodeproj/project.pbxproj");
-  const project = await readFile12(projectPath, "utf8");
+  const project = await readFile13(projectPath, "utf8");
   return writeChangedFile2(projectPath, addIosPrivacyProjectReference(project));
 }, addIosPrivacyProjectReference = (source) => {
   const fileMatch = source.match(/([A-F0-9]{24}) \/\* PrivacyInfo\.xcprivacy \*\/ = \{isa = PBXFileReference;/u);
@@ -16725,7 +17169,7 @@ ${next.slice(index)}`;
   return next;
 }, configureIos2 = async (config, plan) => {
   const path = join47(config.nativeProjectDirectory, "ios/App/App/Info.plist");
-  const source = await readFile12(path, "utf8");
+  const source = await readFile13(path, "utf8");
   const requirements = absoluteDeviceNativeRequirements(plan);
   const existingSystemBars = source.match(/<key>UIViewControllerBasedStatusBarAppearance<\/key>\s*<(true|false)\s*\/>/u);
   const ownedStart = source.indexOf(START_MARKER2);
@@ -16815,7 +17259,7 @@ ${content}
   return `${source.slice(0, insertion)}${region}${source.slice(insertion)}`;
 }, configureAndroid2 = async (config, plan) => {
   const path = join47(config.nativeProjectDirectory, "android/app/src/main/AndroidManifest.xml");
-  const source = await readFile12(path, "utf8");
+  const source = await readFile13(path, "utf8");
   const permissions = absoluteDeviceNativeRequirements(plan).androidPermissions;
   const content = permissions.map((permission) => `    <uses-permission android:name="${escapeXml2(permission)}" />`).join(`
 `);
@@ -16874,10 +17318,10 @@ var init_nativeDeviceCapabilities = __esm(() => {
 });
 
 // src/mobile/nativeBackgroundSync.ts
-import { readFile as readFile13, rename as rename10, writeFile as writeFile11 } from "fs/promises";
+import { readFile as readFile14, rename as rename10, writeFile as writeFile11 } from "fs/promises";
 import { join as join48 } from "path";
 var writeChanged = async (path, source) => {
-  const current = await readFile13(path, "utf8");
+  const current = await readFile14(path, "utf8");
   if (current === source)
     return false;
   const temporary = `${path}.${crypto.randomUUID()}.tmp`;
@@ -16959,10 +17403,10 @@ ${makeRegion(values)}	</array>
     return { changed: false };
   const identifier = `${config.appId}.absolutejs.background-sync`;
   const infoPath = join48(config.nativeProjectDirectory, "ios/App/App/Info.plist");
-  const info2 = await readFile13(infoPath, "utf8");
+  const info2 = await readFile14(infoPath, "utf8");
   const nextInfo = ensurePlistArrayValues(ensurePlistArrayValues(info2, "BGTaskSchedulerPermittedIdentifiers", [identifier], "background-sync-identifiers"), "UIBackgroundModes", ["fetch", "processing"], "background-sync-modes");
   const delegatePath = join48(config.nativeProjectDirectory, "ios/App/App/AppDelegate.swift");
-  let delegate = await readFile13(delegatePath, "utf8");
+  let delegate = await readFile14(delegatePath, "utf8");
   if (!delegate.includes("import AbsoluteSyncCapacitor")) {
     const importIndex = delegate.lastIndexOf("import Capacitor");
     if (importIndex < 0)
@@ -16996,7 +17440,7 @@ var init_nativeBackgroundSync = __esm(() => {
 import {
   access as access7,
   mkdir as mkdir10,
-  readFile as readFile14,
+  readFile as readFile15,
   rename as rename11,
   rm as rm7,
   writeFile as writeFile12
@@ -17054,7 +17498,7 @@ var OWNERSHIP_FILE = ".absolutejs-mobile-associations.json", HTTP_OK = 200, VERI
 }, writeAtomic = async (path, source) => {
   let current;
   try {
-    current = await readFile14(path, "utf8");
+    current = await readFile15(path, "utf8");
   } catch (error) {
     if (!(error instanceof Error) || !("code" in error) || error.code !== "ENOENT") {
       throw error;
@@ -17077,7 +17521,7 @@ var OWNERSHIP_FILE = ".absolutejs-mobile-associations.json", HTTP_OK = 200, VERI
   const path = resolve37(root, OWNERSHIP_FILE);
   let ownership;
   try {
-    ownership = JSON.parse(await readFile14(path, "utf8"));
+    ownership = JSON.parse(await readFile15(path, "utf8"));
   } catch {
     throw new TypeError(`Association output ${root} already exists and is not owned by AbsoluteJS.`);
   }
@@ -17590,8 +18034,8 @@ var DEFAULT_ROUTE_TIMEOUT_MS = 30000, DEFAULT_HMR_TIMEOUT_MS = 30000, routeExpre
 };
 
 // src/mobile/releaseDoctor.ts
-import { access as access8, readFile as readFile15, readdir as readdir4 } from "fs/promises";
-import { extname as extname8, join as join49, relative as relative24 } from "path";
+import { access as access8, readFile as readFile16, readdir as readdir4 } from "fs/promises";
+import { dirname as dirname29, extname as extname8, join as join49, relative as relative24 } from "path";
 var HMR_ASSET_PATTERN, RELEASE_ASSET_EXTENSIONS, pathExists5 = async (path) => {
   try {
     await access8(path);
@@ -17604,7 +18048,7 @@ var HMR_ASSET_PATTERN, RELEASE_ASSET_EXTENSIONS, pathExists5 = async (path) => {
     return findHmrAsset(path);
   if (!isFile2 || !RELEASE_ASSET_EXTENSIONS.has(extname8(path)))
     return;
-  const source = await readFile15(path, "utf8");
+  const source = await readFile16(path, "utf8");
   return HMR_ASSET_PATTERN.test(source) ? path : undefined;
 }, findHmrAsset = async (root) => {
   if (!await pathExists5(root))
@@ -17643,14 +18087,20 @@ var HMR_ASSET_PATTERN, RELEASE_ASSET_EXTENSIONS, pathExists5 = async (path) => {
   if (!await pathExists5(nativeConfigPath)) {
     return fail5("android.capacitor-config", "The generated Android Capacitor config is missing.", nativeConfigPath, "Run `absolute mobile sync android` before release validation.");
   }
-  const unsafe = isUnsafeCapacitorConfig(await readFile15(nativeConfigPath, "utf8"));
+  const unsafe = isUnsafeCapacitorConfig(await readFile16(nativeConfigPath, "utf8"));
   return unsafe ? fail5("android.capacitor-config", "Android Capacitor config contains a development server URL, cleartext transport, navigation allowlist, or invalid JSON.", nativeConfigPath, "Run `absolute mobile sync android`; do not ship development transport overrides.") : pass("android.capacitor-config", "Android Capacitor config contains no development transport overrides.", nativeConfigPath);
 }, manifestReleaseCheck = async (manifestPath) => {
   if (!await pathExists5(manifestPath)) {
     return fail5("android.cleartext", "The Android manifest is missing.", manifestPath, "Run `absolute mobile sync android` before release validation.");
   }
-  const source = await readFile15(manifestPath, "utf8");
-  return /android:usesCleartextTraffic=["']true["']/u.test(source) ? fail5("android.cleartext", "Android explicitly permits cleartext traffic.", manifestPath, 'Remove usesCleartextTraffic="true" from the release manifest.') : pass("android.cleartext", "Android does not explicitly permit cleartext traffic.", manifestPath);
+  const source = await readFile16(manifestPath, "utf8");
+  const cleartext = /android:usesCleartextTraffic=["']true["']/u.test(source);
+  const networkConfigName = source.match(/android:networkSecurityConfig=["']@xml\/([a-z0-9_]+)["']/u)?.[1];
+  const networkConfigPath = networkConfigName ? join49(dirname29(manifestPath), "res", "xml", `${networkConfigName}.xml`) : undefined;
+  const developmentTrustReference = /android:networkSecurityConfig=["']@xml\/absolutejs_dev_network_security["']/u.test(source);
+  const developmentTrustContents = networkConfigPath ? await readFile16(networkConfigPath, "utf8").then((value) => value.includes("@raw/absolutejs_dev_ca")).catch(() => false) : false;
+  const developmentTrust = developmentTrustReference || developmentTrustContents;
+  return cleartext || developmentTrust ? fail5("android.cleartext", developmentTrust ? "Android still references the AbsoluteJS development certificate authority." : "Android explicitly permits cleartext traffic.", manifestPath, "Run `absolute mobile sync android`; do not ship development transport or trust overrides.") : pass("android.cleartext", "Android does not explicitly permit cleartext traffic.", manifestPath);
 }, hmrAssetsReleaseCheck = async (publicRoot) => {
   const hmrAsset = await findHmrAsset(publicRoot);
   return hmrAsset ? fail5("android.hmr-assets", "A packaged Android asset contains the development HMR client.", hmrAsset, "Rebuild the production mobile bundle and run Capacitor sync again.") : pass("android.hmr-assets", "Packaged Android assets contain no development HMR markers.", publicRoot);
@@ -17680,7 +18130,7 @@ var HMR_ASSET_PATTERN, RELEASE_ASSET_EXTENSIONS, pathExists5 = async (path) => {
   if (!config.platforms.includes("android") || permissions.length === 0)
     return;
   const path = join49(config.nativeProjectDirectory, "android/app/src/main/AndroidManifest.xml");
-  const source = await readFile15(path, "utf8");
+  const source = await readFile16(path, "utf8");
   const missing = permissions.filter((permission) => !source.includes(`android:name="${permission}"`) && !source.includes(`android:name='${permission}'`));
   if (missing.length === 0)
     return;
@@ -17689,7 +18139,7 @@ var HMR_ASSET_PATTERN, RELEASE_ASSET_EXTENSIONS, pathExists5 = async (path) => {
   if (!config.platforms.includes("ios") || purposes.length === 0)
     return;
   const path = join49(config.nativeProjectDirectory, "ios/App/App/Info.plist");
-  const source = await readFile15(path, "utf8");
+  const source = await readFile16(path, "utf8");
   const missing = purposes.filter((purpose) => !source.includes(`<key>${IOS_USAGE_KEYS[purpose]}</key>`));
   if (missing.length === 0)
     return;
@@ -17742,7 +18192,7 @@ var HMR_ASSET_PATTERN, RELEASE_ASSET_EXTENSIONS, pathExists5 = async (path) => {
   }
   if (!await pathExists5(nativeConfigPath)) {
     checks.push(fail5("ios.capacitor-config", "The generated iOS Capacitor config is missing.", nativeConfigPath, "Run `absolute mobile sync ios` before release validation."));
-  } else if (isUnsafeCapacitorConfig(await readFile15(nativeConfigPath, "utf8"))) {
+  } else if (isUnsafeCapacitorConfig(await readFile16(nativeConfigPath, "utf8"))) {
     checks.push(fail5("ios.capacitor-config", "iOS Capacitor config contains a development server URL, cleartext transport, navigation allowlist, or invalid JSON.", nativeConfigPath, "Run `absolute mobile sync ios`; do not ship development transport overrides."));
   } else {
     checks.push(pass("ios.capacitor-config", "iOS Capacitor config contains no development transport overrides.", nativeConfigPath));
@@ -17750,7 +18200,7 @@ var HMR_ASSET_PATTERN, RELEASE_ASSET_EXTENSIONS, pathExists5 = async (path) => {
   if (!await pathExists5(infoPath)) {
     checks.push(fail5("ios.transport-security", "The iOS Info.plist is missing.", infoPath, "Run `absolute mobile sync ios` before release validation."));
   } else {
-    const info2 = await readFile15(infoPath, "utf8");
+    const info2 = await readFile16(infoPath, "utf8");
     checks.push(/<key>NSAllowsArbitraryLoads<\/key>\s*<true\s*\/>/u.test(info2) ? fail5("ios.transport-security", "iOS App Transport Security permits arbitrary network loads.", infoPath, "Remove NSAllowsArbitraryLoads from the release Info.plist.") : pass("ios.transport-security", "iOS App Transport Security does not permit arbitrary loads.", infoPath));
   }
   const hmrAsset = await findHmrAsset(publicRoot);
@@ -17803,13 +18253,13 @@ import {
   copyFile as copyFile5,
   mkdir as mkdir12,
   mkdtemp as mkdtemp5,
-  readFile as readFile16,
+  readFile as readFile17,
   rename as rename12,
   rm as rm8,
   stat as stat2,
   writeFile as writeFile14
 } from "fs/promises";
-import { dirname as dirname29, isAbsolute as isAbsolute7, join as join50, relative as relative25, resolve as resolve39, sep as sep6 } from "path";
+import { dirname as dirname30, isAbsolute as isAbsolute7, join as join50, relative as relative25, resolve as resolve39, sep as sep6 } from "path";
 var ABSOLUTE_ANDROID_RELEASE_FORMAT = 1, isRecord13 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), requireManifest2 = (value) => {
   if (!isRecord13(value) || typeof value.appBuild !== "string" || typeof value.appId !== "string" || typeof value.runtime !== "string") {
     throw new TypeError("Invalid embedded AbsoluteJS mobile manifest.");
@@ -17859,7 +18309,7 @@ var ABSOLUTE_ANDROID_RELEASE_FORMAT = 1, isRecord13 = (value) => typeof value ==
     artifactPath
   ]);
   return result.exitCode === 0 && /jar verified/iu.test(result.stdout);
-}, sha256File2 = async (path) => createHash12("sha256").update(await readFile16(path)).digest("hex"), safeOutputDirectory2 = (projectRoot, requested) => {
+}, sha256File2 = async (path) => createHash12("sha256").update(await readFile17(path)).digest("hex"), safeOutputDirectory2 = (projectRoot, requested) => {
   const root = resolve39(projectRoot);
   const output = resolve39(root, requested ?? ".absolutejs/mobile/releases/android");
   const projectRelative = relative25(root, output);
@@ -17872,7 +18322,7 @@ var ABSOLUTE_ANDROID_RELEASE_FORMAT = 1, isRecord13 = (value) => typeof value ==
   const artifactName = "app-release.aab";
   const destination = join50(releaseRoot, artifactName);
   if (await pathExists6(releaseRoot)) {
-    const existing = requireManifestIdentity(JSON.parse(await readFile16(join50(releaseRoot, "release.json"), "utf8")), metadata);
+    const existing = requireManifestIdentity(JSON.parse(await readFile17(join50(releaseRoot, "release.json"), "utf8")), metadata);
     const [installedBytes, installedSha256] = await Promise.all([
       stat2(destination).then(({ size }) => size),
       sha256File2(destination)
@@ -17882,8 +18332,8 @@ var ABSOLUTE_ANDROID_RELEASE_FORMAT = 1, isRecord13 = (value) => typeof value ==
     }
     return { artifactPath: destination, metadata: existing, releaseRoot };
   }
-  await mkdir12(dirname29(releaseRoot), { recursive: true });
-  const staging = await mkdtemp5(join50(dirname29(releaseRoot), ".android-stage-"));
+  await mkdir12(dirname30(releaseRoot), { recursive: true });
+  const staging = await mkdtemp5(join50(dirname30(releaseRoot), ".android-stage-"));
   try {
     await copyFile5(artifactPath, join50(staging, artifactName));
     const complete = {
@@ -17919,7 +18369,7 @@ var ABSOLUTE_ANDROID_RELEASE_FORMAT = 1, isRecord13 = (value) => typeof value ==
   const host2 = options.host ?? detectAbsoluteMobileHost();
   const androidRoot = options.androidRoot ?? process.env.ANDROID_HOME ?? process.env.ANDROID_SDK_ROOT ?? absoluteManagedAndroidSdkRoot(host2);
   const nativeDirectory = join50(options.config.nativeProjectDirectory, "android");
-  const manifest = requireManifest2(JSON.parse(await readFile16(join50(options.config.bundleDirectory, "absolute-mobile-manifest.json"), "utf8")));
+  const manifest = requireManifest2(JSON.parse(await readFile17(join50(options.config.bundleDirectory, "absolute-mobile-manifest.json"), "utf8")));
   if (manifest.appId !== options.config.appId) {
     throw new TypeError("Embedded mobile manifest appId does not match mobile.appId.");
   }
@@ -17983,7 +18433,7 @@ var init_androidRelease = __esm(() => {
 });
 
 // src/mobile/iosConformance.ts
-import { readFile as readFile17, stat as stat3 } from "fs/promises";
+import { readFile as readFile18, stat as stat3 } from "fs/promises";
 var HMR_LINE, parseAbsoluteIosHmrLog = (line) => {
   const match = HMR_LINE.exec(line);
   if (!match)
@@ -18018,7 +18468,7 @@ var HMR_LINE, parseAbsoluteIosHmrLog = (line) => {
     if (Date.now() > deadline)
       throw new Error(`No iOS native HMR acknowledgement was observed within ${timeoutMs}ms.`);
     options.signal?.throwIfAborted();
-    const contents = await readFile17(options.logPath).catch(() => Buffer.alloc(0));
+    const contents = await readFile18(options.logPath).catch(() => Buffer.alloc(0));
     if (contents.byteLength < offset) {
       offset = 0;
       buffered = "";
@@ -18042,7 +18492,7 @@ var init_iosConformance = __esm(() => {
 });
 
 // src/mobile/nativeTestReport.ts
-import { mkdir as mkdir13, readFile as readFile18, writeFile as writeFile15 } from "fs/promises";
+import { mkdir as mkdir13, readFile as readFile19, writeFile as writeFile15 } from "fs/promises";
 import { join as join51 } from "path";
 var secretPattern, bearerPattern, coordinatePattern, nativeCredentialPattern, sanitizeNativeReportText = (value) => value.replace(nativeCredentialPattern, "[REDACTED]").replace(bearerPattern, "Bearer [REDACTED]").replace(secretPattern, "$1$2[REDACTED]").replace(coordinatePattern, "$1$2[REDACTED]").replace(/(https?:\/\/[^\s?#]+)[?#][^\s]*/giu, "$1?[REDACTED]"), markdownCell = (value) => sanitizeNativeReportText(value).replaceAll("|", "\\|").replaceAll(`
 `, "<br>"), createAbsoluteNativeAutomatedChecks = (run) => {
@@ -18121,7 +18571,7 @@ var secretPattern, bearerPattern, coordinatePattern, nativeCredentialPattern, sa
   reportVersion: 1,
   run: options.run
 }), readPackageVersionForNativeReport = async (packageJsonPath) => {
-  const manifest = JSON.parse(await readFile18(packageJsonPath, "utf8"));
+  const manifest = JSON.parse(await readFile19(packageJsonPath, "utf8"));
   if (typeof manifest !== "object" || manifest === null)
     return "unknown";
   const version2 = Reflect.get(manifest, "version");
@@ -18462,11 +18912,11 @@ var exports_mobile = {};
 __export(exports_mobile, {
   runMobile: () => runMobile
 });
-import { access as access11, mkdir as mkdir14, readFile as readFile19, writeFile as writeFile16 } from "fs/promises";
+import { access as access11, mkdir as mkdir14, readFile as readFile20, writeFile as writeFile16 } from "fs/promises";
 import { join as join52, resolve as resolve41 } from "path";
 import { createInterface } from "readline/promises";
 var NOT_FOUND3 = -1, isRecord15 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), CAPACITOR_PACKAGES, CAPACITOR_PACKAGE_SPECS, CAPACITOR_SYNC_PACKAGE_SPECS, packageNameFromSpec = (spec) => spec.slice(0, spec.lastIndexOf("@")), directProjectPackages = async (projectRoot) => {
-  const manifest = JSON.parse(await readFile19(join52(projectRoot, "package.json"), "utf8"));
+  const manifest = JSON.parse(await readFile20(join52(projectRoot, "package.json"), "utf8"));
   if (!isRecord15(manifest))
     throw new TypeError("Application package.json must contain an object.");
   const names = new Set;
@@ -18479,7 +18929,7 @@ var NOT_FOUND3 = -1, isRecord15 = (value) => typeof value === "object" && value
   return names;
 }, resolvedPackageVersion = async (projectRoot, packageName) => {
   try {
-    const manifest = JSON.parse(await readFile19(join52(projectRoot, "node_modules", packageName, "package.json"), "utf8"));
+    const manifest = JSON.parse(await readFile20(join52(projectRoot, "node_modules", packageName, "package.json"), "utf8"));
     return isRecord15(manifest) && typeof manifest.version === "string" ? manifest.version : undefined;
   } catch {
     return;
@@ -20678,6 +21128,24 @@ var resolveDevPort = async (requestedPort, options = {}) => {
 ` + `Set \`dev.port\` to a different value in absolute.config.ts (or via the ABSOLUTE_PORT env var), or extend \`dev.portRange\`.`);
 };
 
+// src/utils/networking.ts
+import os from "os";
+var getAllNetworkIPs = () => {
+  const interfaces = os.networkInterfaces();
+  const addresses = Object.values(interfaces).flat().filter((iface) => iface !== undefined);
+  const ipv4Addresses = [];
+  addresses.filter((addr) => !addr.internal && addr.family === "IPv4").forEach((addr) => ipv4Addresses.push(addr.address));
+  return ipv4Addresses;
+};
+var getLocalIPAddress = () => {
+  const allIPs = getAllNetworkIPs();
+  if (allIPs.length > 0 && allIPs[0]) {
+    return allIPs[0];
+  }
+  console.warn("No IP address found, falling back to localhost");
+  return "localhost";
+};
+
 // src/cli/scripts/dev.ts
 init_config();
 init_nativeAuth();
@@ -20982,25 +21450,41 @@ var confirmPrompt = (message, defaultYes = true) => {
   process.stdin.on("data", onData);
   return promise;
 };
-var setupCertWithPrompt = async (ensureDevCert2, setupMkcert2) => {
+var setupCertWithPrompt = async (ensureDevCert2, setupMkcert2, hosts) => {
   const install = await confirmPrompt("Install mkcert for trusted HTTPS? (no browser warning)");
   if (install) {
-    setupMkcert2();
+    setupMkcert2(hosts);
   } else {
-    ensureDevCert2();
+    ensureDevCert2(hosts);
   }
 };
-var setupHttpsCert = async () => {
-  const { hasCert: hasCert2, hasMkcert: hasMkcert2, ensureDevCert: ensureDevCert2, setupMkcert: setupMkcert2 } = await Promise.resolve().then(() => (init_devCert(), exports_devCert));
-  if (hasCert2()) {
-    ensureDevCert2();
-    return;
+var setupHttpsCert = async (hosts = []) => {
+  const {
+    getDevCertificateAuthorityPath: getDevCertificateAuthorityPath2,
+    hasCert: hasCert2,
+    hasMkcert: hasMkcert2,
+    ensureDevCert: ensureDevCert2,
+    setupMkcert: setupMkcert2
+  } = await Promise.resolve().then(() => (init_devCert(), exports_devCert));
+  if (hasCert2(hosts)) {
+    ensureDevCert2(hosts);
+    return getDevCertificateAuthorityPath2();
   }
   if (hasMkcert2()) {
-    ensureDevCert2();
-    return;
+    ensureDevCert2(hosts);
+    return getDevCertificateAuthorityPath2();
   }
-  await setupCertWithPrompt(ensureDevCert2, setupMkcert2);
+  await setupCertWithPrompt(ensureDevCert2, setupMkcert2, hosts);
+  return getDevCertificateAuthorityPath2();
+};
+var mobileReachableHost = (host) => {
+  if (host !== "0.0.0.0" && host !== "::")
+    return host;
+  const address = getLocalIPAddress();
+  if (address === "localhost") {
+    throw new Error("No LAN address is available for the selected physical device. Connect this computer to the device network or set dev.host explicitly.");
+  }
+  return address;
 };
 var resolveDevConfig = (configDev) => {
   const relay = env.ABSOLUTE_TUNNEL_RELAY ?? configDev?.tunnel?.relay;
@@ -21014,13 +21498,24 @@ var resolveDevConfig = (configDev) => {
     ...relay && token ? { tunnel: { relay, token } } : {}
   };
 };
-var androidToolchainReady = (checks) => checks.every((check) => check.platform !== "android" || check.status !== "fail" && check.status !== "warn");
-var iosToolchainReady = (checks) => checks.every((check) => check.platform !== "ios" || check.status !== "fail" && check.status !== "warn");
+var androidToolchainReady = (checks, target = "emulator") => {
+  const deviceOnlyChecks = new Set([
+    "android.avd",
+    "android.avdmanager",
+    "android.emulator",
+    "android.virtualization"
+  ]);
+  return checks.every((check) => check.platform !== "android" || target === "device" && deviceOnlyChecks.has(check.id) || check.status !== "fail" && check.status !== "warn");
+};
+var iosToolchainReady = (checks, target = "simulator") => checks.every((check) => check.platform !== "ios" || target === "device" && check.id === "ios.runtime" || check.status !== "fail" && check.status !== "warn");
 var dev = async (serverEntry, configPath2, options = {}) => {
   let httpsEnabled = false;
+  let devCertificateAuthorityPath = null;
   let resolvedDev;
   let buildDirectory = resolve8(process.cwd(), "build");
   let mobileConfig;
+  let iosPhysicalServerHost;
+  let selectedRemoteMacProfile;
   try {
     const config = await loadConfig(configPath2);
     mobileConfig = config?.mobile;
@@ -21031,12 +21526,39 @@ var dev = async (serverEntry, configPath2, options = {}) => {
     if (config?.buildDirectory) {
       buildDirectory = resolve8(process.cwd(), config.buildDirectory);
     }
-    if (httpsEnabled)
-      await setupHttpsCert();
   } catch {
     resolvedDev = resolveDevConfig(undefined);
     httpsEnabled = resolvedDev.https;
   }
+  if ((options.androidDevice || options.iosDevice && detectAbsoluteMobileHost() === "macos") && ["localhost", "127.0.0.1", "::1"].includes(resolvedDev.host)) {
+    resolvedDev.host = "0.0.0.0";
+  }
+  if ((options.androidDevice || options.iosDevice) && !mobileConfig) {
+    throw new TypeError("Physical-device development requires an absolute.config.ts mobile configuration.");
+  }
+  if (options.androidDevice && mobileConfig?.platforms && !mobileConfig.platforms.includes("android")) {
+    throw new TypeError("--android-device requires android in mobile.platforms.");
+  }
+  if (options.iosDevice && mobileConfig?.platforms && !mobileConfig.platforms.includes("ios")) {
+    throw new TypeError("--ios-device requires ios in mobile.platforms.");
+  }
+  if (options.iosDevice) {
+    if (detectAbsoluteMobileHost() === "macos")
+      iosPhysicalServerHost = mobileReachableHost(resolvedDev.host);
+    else {
+      selectedRemoteMacProfile = await getAbsoluteRemoteMacProfile();
+      if (!selectedRemoteMacProfile)
+        throw new Error("--ios-device requires macOS or a paired Remote Mac.");
+      iosPhysicalServerHost = await inspectAbsoluteRemoteMacLanHost(selectedRemoteMacProfile);
+    }
+  }
+  if (httpsEnabled) {
+    const certificateHosts = [
+      ...options.androidDevice ? [mobileReachableHost(resolvedDev.host)] : [],
+      ...iosPhysicalServerHost ? [iosPhysicalServerHost] : []
+    ];
+    devCertificateAuthorityPath = await setupHttpsCert(certificateHosts.length > 0 ? certificateHosts : [resolvedDev.host]);
+  }
   let androidDevProject = null;
   let iosDevProject = null;
   const mobileInteractive = options.mobile !== false && process.env.ABSOLUTE_NO_MOBILE !== "1" && process.stdin.isTTY === true && process.stdout.isTTY === true;
@@ -21044,14 +21566,15 @@ var dev = async (serverEntry, configPath2, options = {}) => {
     try {
       const normalized = normalizeAbsoluteMobileConfig(mobileConfig, process.cwd());
       if (normalized.platforms.includes("android")) {
-        let ready = androidToolchainReady(await inspectAbsoluteMobileToolchain());
+        const androidTarget = options.androidDevice ? "device" : "emulator";
+        let ready = androidToolchainReady(await inspectAbsoluteMobileToolchain(), androidTarget);
         if (!ready) {
-          const install = await confirmPrompt("Android emulation is not configured. Install it now?");
+          const install = await confirmPrompt("Android development is not configured. Install the tested toolchain now?");
           if (install) {
             await fixAbsoluteMobileEmulatorToolchain("android");
-            ready = androidToolchainReady(await inspectAbsoluteMobileToolchain());
+            ready = androidToolchainReady(await inspectAbsoluteMobileToolchain(), androidTarget);
           } else {
-            console.log(cliTag("\x1B[33m", "Mobile emulator skipped. Run `absolute mobile doctor android --fix` when ready."));
+            console.log(cliTag("\x1B[33m", "Android target skipped. Run `absolute mobile doctor android --fix` when ready."));
           }
         }
         if (ready) {
@@ -21063,16 +21586,17 @@ var dev = async (serverEntry, configPath2, options = {}) => {
           if (existsSync5(nativeDirectory) || createNativeProject) {
             androidDevProject = await prepareAbsoluteAndroidDevProject(normalized, {
               createNativeProject,
-              projectRoot: process.cwd()
+              projectRoot: process.cwd(),
+              target: androidTarget
             });
           }
         }
       }
       if (normalized.platforms.includes("ios")) {
         if (detectAbsoluteMobileHost() !== "macos") {
-          const remote = await getAbsoluteRemoteMacProfile();
+          const remote = selectedRemoteMacProfile ?? await getAbsoluteRemoteMacProfile();
           if (!remote) {
-            console.log(cliTag("\x1B[33m", "iOS simulator skipped. Pair a Mac with `absolute mobile pair mac <name> <user@host>`."));
+            console.log(cliTag("\x1B[33m", "iOS target skipped. Pair a Mac with `absolute mobile pair mac <name> <user@host>`."));
           } else {
             const nativeDirectory = join13(normalized.nativeProjectDirectory, "ios");
             if (!existsSync5(nativeDirectory)) {
@@ -21083,12 +21607,13 @@ var dev = async (serverEntry, configPath2, options = {}) => {
             }
           }
         } else {
-          let ready = iosToolchainReady(await inspectAbsoluteMobileToolchain());
+          const iosTarget = options.iosDevice ? "device" : "simulator";
+          let ready = iosToolchainReady(await inspectAbsoluteMobileToolchain(), iosTarget);
           if (!ready) {
-            const install = await confirmPrompt("iOS simulation is not configured. Install the missing simulator runtime now?");
+            const install = await confirmPrompt(options.iosDevice ? "Physical iOS development is not configured. Open the guided Xcode setup now?" : "iOS simulation is not configured. Install the missing simulator runtime now?");
             if (install) {
               await fixAbsoluteMobileEmulatorToolchain("ios");
-              ready = iosToolchainReady(await inspectAbsoluteMobileToolchain());
+              ready = iosToolchainReady(await inspectAbsoluteMobileToolchain(), iosTarget);
             } else {
               console.log(cliTag("\x1B[33m", "Mobile simulator skipped. Run `absolute mobile doctor ios --fix` when ready."));
             }
@@ -21102,7 +21627,8 @@ var dev = async (serverEntry, configPath2, options = {}) => {
             if (existsSync5(nativeDirectory) || createNativeProject) {
               iosDevProject = await prepareAbsoluteIosDevProject(normalized, {
                 createNativeProject,
-                projectRoot: process.cwd()
+                projectRoot: process.cwd(),
+                target: iosTarget
               });
             }
           }
@@ -21145,7 +21671,9 @@ var dev = async (serverEntry, configPath2, options = {}) => {
     "dev",
     serverEntry,
     ...configPath2 ? ["--config", configPath2] : [],
-    ...options.mobile === false ? ["--no-mobile"] : []
+    ...options.mobile === false ? ["--no-mobile"] : [],
+    ...options.androidDevice ? ["--android-device", options.androidDevice] : [],
+    ...options.iosDevice ? ["--ios-device", options.iosDevice] : []
   ].filter((part) => part.length > 0);
   registerInstance({
     command: relaunchCommand,
@@ -21201,6 +21729,7 @@ var dev = async (serverEntry, configPath2, options = {}) => {
       platform: "android",
       provider: "capacitor",
       startedEmulator: session.startedEmulator,
+      target: options.androidDevice ? "device" : "emulator",
       timings: session.timings
     });
     if (session.timings.building === undefined)
@@ -21215,9 +21744,12 @@ var dev = async (serverEntry, configPath2, options = {}) => {
     });
   };
   const openAndroidDevSession = (androidProject) => startAbsoluteAndroidDevSession({
+    certificateAuthorityPath: devCertificateAuthorityPath ?? undefined,
+    deviceSerial: options.androidDevice,
     https: httpsEnabled,
     port,
     project: androidProject,
+    serverHost: options.androidDevice ? mobileReachableHost(resolvedDev.host) : "localhost",
     signal: androidDevAbort.signal,
     log: (message) => printNativeOutput(cliTag("\x1B[36m", message)),
     nativeLog: (entry) => printNativeOutput(androidLogTag(entry)),
@@ -21313,6 +21845,7 @@ var dev = async (serverEntry, configPath2, options = {}) => {
       platform: "ios",
       provider: "capacitor",
       startedSimulator: session.startedSimulator,
+      target: session.targetKind,
       timings: session.timings
     });
     if (session.timings.building === undefined)
@@ -21323,13 +21856,17 @@ var dev = async (serverEntry, configPath2, options = {}) => {
       installMs: session.timings.installing,
       platform: "ios",
       provider: "capacitor",
-      success: true
+      success: true,
+      target: session.targetKind
     });
   };
   const openIosDevSession = (iosProject) => {
     const sessionOptions = {
+      certificateAuthorityPath: devCertificateAuthorityPath ?? undefined,
+      deviceIdentifier: options.iosDevice,
       https: httpsEnabled,
       port,
+      serverHost: iosPhysicalServerHost,
       signal: iosDevAbort.signal,
       log: (message) => printNativeOutput(cliTag("\x1B[35m", message)),
       nativeLog: (entry) => printNativeOutput(iosLogTag(entry)),
@@ -21343,7 +21880,7 @@ var dev = async (serverEntry, configPath2, options = {}) => {
         iosDevState = state;
         if (state === "ready" || state === "closed")
           return;
-        printNativeOutput(cliTag("\x1B[35m", `iOS simulator: ${state}.`));
+        printNativeOutput(cliTag("\x1B[35m", `iOS ${options.iosDevice ? "device" : "simulator"}: ${state}.`));
       }
     };
     if (iosProject.remote)
@@ -21382,6 +21919,7 @@ var dev = async (serverEntry, configPath2, options = {}) => {
           provider: "capacitor",
           rootInputChanged: change.rootInputChanged,
           success: true,
+          target: replacement.targetKind,
           timings: replacement.timings
         });
       },
@@ -21392,7 +21930,8 @@ var dev = async (serverEntry, configPath2, options = {}) => {
           host: iosTelemetryHost(iosProject),
           platform: "ios",
           provider: "capacitor",
-          success: false
+          success: false,
+          target: options.iosDevice ? "device" : "simulator"
         });
       }
     });
@@ -21419,9 +21958,10 @@ var dev = async (serverEntry, configPath2, options = {}) => {
         phase: iosDevState,
         platform: "ios",
         provider: "capacitor",
+        target: options.iosDevice ? "device" : "simulator",
         timings: iosPhaseTimings
       });
-      console.error(cliTag("\x1B[31m", `iOS simulator failed: ${error instanceof Error ? error.message : String(error)}`));
+      console.error(cliTag("\x1B[31m", `iOS ${options.iosDevice ? "device" : "simulator"} failed: ${error instanceof Error ? error.message : String(error)}`));
     }).finally(() => {
       iosDevStart = null;
     });
@@ -21488,6 +22028,9 @@ var dev = async (serverEntry, configPath2, options = {}) => {
       return;
     }
     const refreshedDevConfig = resolveDevConfig(cfg?.dev);
+    if (options.androidDevice && ["localhost", "127.0.0.1", "::1"].includes(refreshedDevConfig.host)) {
+      refreshedDevConfig.host = "0.0.0.0";
+    }
     const desiredBuildDir = cfg?.buildDirectory ? resolve8(process.cwd(), cfg.buildDirectory) : resolve8(process.cwd(), "build");
     if (desiredBuildDir !== buildDirectory && desiredBuildDir !== lastBuildDirectoryWarned) {
       lastBuildDirectoryWarned = desiredBuildDir;
@@ -21570,6 +22113,7 @@ var dev = async (serverEntry, configPath2, options = {}) => {
       env: {
         ...process.env,
         ...readDotenvFiles(),
+        ABSOLUTE_HOST: resolvedDev.host,
         ABSOLUTE_INSTANCE_MANAGED: "1",
         ABSOLUTE_PORT: String(port),
         ABSOLUTE_SERVER_ENTRY: resolve8(serverEntry),
@@ -23766,9 +24310,25 @@ var stripNamedArgs = (...flags) => args.filter((_, idx) => flags.every((flag) =>
 if (command === "dev") {
   sendTelemetryEvent("cli:command", { command });
   const configPath2 = parseNamedArg("--config");
-  const positionalArgs2 = stripNamedArgs("--config").filter((arg) => arg !== "--no-mobile");
+  const androidDevice = parseNamedArg("--android-device");
+  const iosDevice = parseNamedArg("--ios-device");
+  if (args.includes("--android-device") && !androidDevice) {
+    throw new TypeError("--android-device requires an ADB device serial.");
+  }
+  if (androidDevice && args.includes("--no-mobile")) {
+    throw new TypeError("--android-device cannot be combined with --no-mobile.");
+  }
+  if (args.includes("--ios-device") && !iosDevice) {
+    throw new TypeError("--ios-device requires an Xcode device identifier or name.");
+  }
+  if (iosDevice && args.includes("--no-mobile")) {
+    throw new TypeError("--ios-device cannot be combined with --no-mobile.");
+  }
+  const positionalArgs2 = stripNamedArgs("--config", "--android-device", "--ios-device").filter((arg) => arg !== "--no-mobile");
   const serverEntry = positionalArgs2[0] ?? DEFAULT_SERVER_ENTRY;
   await dev(serverEntry, configPath2, {
+    androidDevice,
+    iosDevice,
     mobile: !args.includes("--no-mobile")
   });
 } else if (command === "start") {
@@ -23927,13 +24487,13 @@ if (command === "dev") {
   console.error(message);
   console.error("Usage: absolute <command>");
   console.error("Commands:");
-  console.error("  dev [entry] [--no-mobile] Start web and configured mobile development");
+  console.error("  dev [entry] [--no-mobile] [--android-device serial] [--ios-device identifier] Start web and configured mobile development");
   console.error("  workspace dev [--no-tui] Start multi-service workspace dev");
   console.error("  build [--outdir dir] [--profile] Build production assets");
   console.error("  prepare [entry] [--outdir dir] Build production assets and server without launching");
   console.error("  start [entry] [--outdir dir] [--prebuilt] Start production server");
   console.error("  compile [entry] [--outdir dir] [--outfile path] Compile standalone executable");
-  console.error("  mobile <init|sync|pair|remotes|doctor|test> Manage Capacitor projects, local or remote simulators, guided setup, and deep links");
+  console.error("  mobile <init|sync|pair|remotes|doctor|test> Manage Capacitor projects, simulators, physical devices, Remote Macs, guided setup, and deep links");
   console.error("  config [--port n] Open the unified config UI (ESLint, tsconfig, Prettier)");
   console.error("  db <backup|restore|seed> Backup/restore any Postgres DB (ORM-agnostic, upsert by PK) or run the seed script");
   console.error("  doctor [--fix] [--json] Diagnose the project (bun, type graph, config, framework dirs, env, port)");