npm - @absolutejs/absolute - Versions diffs - 0.20.0-beta.37 → 0.20.0-beta.38 - Mend

@absolutejs/absolute 0.20.0-beta.37 → 0.20.0-beta.38

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (10) hide show

package/README.md +9 -0
package/dist/angular/components/core/streamingSlotRegistrar.js +1 -1
package/dist/angular/components/core/streamingSlotRegistry.js +2 -2
package/dist/cli/index.js +603 -187
package/dist/mobile/index.js +17 -3
package/dist/mobile/index.js.map +3 -3
package/dist/src/mobile/mobileBundleInspection.d.ts +55 -0
package/dist/src/mobile/mobileInspect.d.ts +1 -1
package/dist/src/mobile/releaseDoctor.d.ts +23 -1
package/package.json +1 -1

package/dist/cli/index.js CHANGED Viewed

@@ -6411,12 +6411,25 @@ var MANIFEST_FILE = "absolute-mobile-manifest.json", BOOTSTRAP_FILE = "absolute-
   if (candidate)
     return candidate;
   throw new TypeError("AbsoluteJS mobile push shell module is missing.");
-}, escapeHtml = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;"), indexHtml = (appName) => `<!doctype html>
+}, escapeHtml = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;"), contentSecurityPolicy = (productionOrigin) => {
+  const backend = new URL(productionOrigin);
+  const socketOrigin = `${backend.protocol === "https:" ? "wss:" : "ws:"}//${backend.host}`;
+  return [
+    "default-src 'self' data: blob: https:",
+    "base-uri 'none'",
+    "object-src 'none'",
+    "script-src 'self'",
+    "style-src 'self' 'unsafe-inline'",
+    `connect-src 'self' ${backend.origin} ${socketOrigin}`,
+    "form-action 'none'"
+  ].join("; ");
+}, indexHtml = (appName, productionOrigin) => `<!doctype html>
 <html>
 	<head>
 		<meta charset="utf-8">
 		<meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover">
 		<meta name="color-scheme" content="light dark">
+		<meta http-equiv="Content-Security-Policy" content="${escapeHtml(contentSecurityPolicy(productionOrigin))}">
 		<title>${escapeHtml(appName)}</title>
 	</head>
 	<body>
@@ -6635,7 +6648,7 @@ void startAbsoluteMobileShell(${push ? `{ createAuth: (config, options) => creat
     await Promise.all([
       writeFile7(join17(staging, MANIFEST_FILE), `${JSON.stringify(manifest, null, "\t")}
 `),
-      writeFile7(join17(staging, INDEX_FILE), indexHtml(options.config.appName)),
+      writeFile7(join17(staging, INDEX_FILE), indexHtml(options.config.appName, options.config.productionOrigin)),
       buildShellBootstrap(staging, options.auth !== undefined, options.auth !== undefined && options.sync === true, `absolutejs.${options.auth?.clientId ?? options.config.appId}.`, options.deviceCapabilities, options.projectRoot)
     ]);
     await installBundle(staging, destination);
@@ -18048,28 +18061,173 @@ var DEFAULT_ROUTE_TIMEOUT_MS = 30000, DEFAULT_HMR_TIMEOUT_MS = 30000, routeExpre
   return apply;
 };
-// src/mobile/releaseDoctor.ts
-import { access as access8, readFile as readFile16, readdir as readdir4 } from "fs/promises";
-import { dirname as dirname29, extname as extname8, join as join49, relative as relative24 } from "path";
-var HMR_ASSET_PATTERN, RELEASE_ASSET_EXTENSIONS, pathExists5 = async (path) => {
+// src/mobile/mobileBundleInspection.ts
+import { createHash as createHash12 } from "crypto";
+import { access as access8, readFile as readFile16, stat as stat2 } from "fs/promises";
+import { join as join49, relative as relative24, resolve as resolve39 } from "path";
+var MOBILE_FRAMEWORKS, SHA256_PATTERN, isObject2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), portablePath = (projectRoot, path) => {
+  const value = relative24(resolve39(projectRoot), resolve39(path)).replaceAll("\\", "/");
+  return value || ".";
+}, pathExists5 = async (path) => {
   try {
     await access8(path);
     return true;
   } catch {
     return false;
   }
+}, readObject = async (path) => {
+  const value = JSON.parse(await readFile16(path, "utf8"));
+  if (!isObject2(value))
+    throw new TypeError("JSON root must be an object.");
+  return value;
+}, requireString = (value, field) => {
+  if (typeof value !== "string" || value.length === 0)
+    throw new TypeError(`${field} must be a non-empty string.`);
+  return value;
+}, requireStringArray = (value, field) => {
+  if (!Array.isArray(value) || !value.every((item) => typeof item === "string"))
+    throw new TypeError(`${field} must be a string array.`);
+  return value;
+}, requireBundleFile = async (root, value, field, expectedHash) => {
+  const portable = requireString(value, field);
+  const path = resolve39(root, portable);
+  const normalizedRoot = resolve39(root);
+  if (path === normalizedRoot || !path.startsWith(`${normalizedRoot}/`))
+    throw new TypeError(`${field} must remain inside the mobile bundle.`);
+  if (!(await stat2(path).catch(() => {
+    return;
+  }))?.isFile())
+    throw new TypeError(`${field} does not exist in the mobile bundle.`);
+  if (expectedHash !== undefined) {
+    if (!SHA256_PATTERN.test(expectedHash))
+      throw new TypeError(`${field} has an invalid SHA-256 digest.`);
+    const actual = createHash12("sha256").update(await readFile16(path)).digest("hex");
+    if (actual !== expectedHash)
+      throw new TypeError(`${field} failed its SHA-256 integrity check.`);
+  }
+  return portable;
+}, inspectAbsoluteMobileBundle = async (config, projectRoot) => {
+  const manifestPath = join49(config.bundleDirectory, "absolute-mobile-manifest.json");
+  const manifest = portablePath(projectRoot, manifestPath);
+  if (!await pathExists5(manifestPath))
+    return { manifest, status: "missing" };
+  try {
+    const value = await readObject(manifestPath);
+    if (value.format !== ABSOLUTE_MOBILE_CLIENT_MANIFEST_FORMAT)
+      throw new TypeError("format is not supported by this runtime.");
+    if (requireString(value.appId, "appId") !== config.appId)
+      throw new TypeError("appId does not match the effective mobile config.");
+    if (requireString(value.productionOrigin, "productionOrigin") !== config.productionOrigin)
+      throw new TypeError("productionOrigin does not match the effective mobile config.");
+    const appBuild = requireString(value.appBuild, "appBuild");
+    const runtime = requireString(value.runtime, "runtime");
+    if (runtime !== String(ABSOLUTE_MOBILE_PAGE_PROTOCOL_VERSION))
+      throw new TypeError("runtime is not supported by this AbsoluteJS build.");
+    const capabilities = requireStringArray(value.deviceCapabilities, "deviceCapabilities").sort();
+    if (!Array.isArray(value.pages) || !Array.isArray(value.routes))
+      throw new TypeError("pages and routes must be arrays.");
+    const pageIds = new Set;
+    const frameworks7 = new Set;
+    await Promise.all(value.pages.map(async (candidate) => {
+      if (!isObject2(candidate))
+        throw new TypeError("pages contains an invalid entry.");
+      const pageId = requireString(candidate.pageId, "page.pageId");
+      if (pageIds.has(pageId))
+        throw new TypeError("page.pageId values must be unique.");
+      pageIds.add(pageId);
+      const framework = requireString(candidate.framework, "page.framework");
+      if (!MOBILE_FRAMEWORKS.has(framework))
+        throw new TypeError("page.framework is unsupported.");
+      frameworks7.add(framework);
+      const bundleHash = requireString(candidate.bundleHash, "page.bundleHash");
+      requireString(candidate.contract, "page.contract");
+      requireString(candidate.propsSchemaHash, "page.propsSchemaHash");
+      await requireBundleFile(config.bundleDirectory, candidate.localBundlePath, "page.localBundlePath", bundleHash);
+      if (candidate.localStylePath !== undefined) {
+        const styleHash = requireString(candidate.styleBundleHash, "page.styleBundleHash");
+        await requireBundleFile(config.bundleDirectory, candidate.localStylePath, "page.localStylePath", styleHash);
+      } else if (candidate.styleBundleHash !== undefined)
+        throw new TypeError("page.styleBundleHash requires page.localStylePath.");
+    }));
+    const routes = value.routes.map((candidate) => {
+      if (!isObject2(candidate))
+        throw new TypeError("routes contains an invalid entry.");
+      const { method } = candidate;
+      if (method !== "GET" && method !== "HEAD")
+        throw new TypeError("route.method must be GET or HEAD.");
+      const pageId = requireString(candidate.pageId, "route.pageId");
+      if (!pageIds.has(pageId))
+        throw new TypeError("route.pageId references a missing page.");
+      return {
+        method,
+        pageId,
+        pattern: requireString(candidate.pattern, "route.pattern")
+      };
+    });
+    await Promise.all(["index.html", "absolute-mobile-bootstrap.js"].map((file) => requireBundleFile(config.bundleDirectory, file, file)));
+    const entryPath = new URL(config.entry, "https://absolute.invalid").pathname;
+    const entryResolved = resolveAbsoluteMobileRoute(routes, entryPath) !== undefined;
+    if (!entryResolved)
+      throw new TypeError("entry is not owned by an embedded route.");
+    return {
+      appBuild,
+      auth: isObject2(value.auth),
+      capabilities,
+      entryResolved,
+      frameworks: [...frameworks7].sort(),
+      manifest,
+      pageCount: value.pages.length,
+      routeCount: value.routes.length,
+      runtime,
+      status: "valid",
+      sync: isObject2(value.sync)
+    };
+  } catch (error) {
+    return {
+      issue: error instanceof Error ? error.message : "The embedded mobile manifest is invalid.",
+      manifest,
+      status: "invalid"
+    };
+  }
+};
+var init_mobileBundleInspection = __esm(() => {
+  init_pageProtocol();
+  init_routeMatcher();
+  init_transport();
+  MOBILE_FRAMEWORKS = new Set([
+    "angular",
+    "ember",
+    "html",
+    "htmx",
+    "react",
+    "svelte",
+    "vue"
+  ]);
+  SHA256_PATTERN = /^[a-f0-9]{64}$/u;
+});
+// src/mobile/releaseDoctor.ts
+import { access as access9, readFile as readFile17, readdir as readdir4 } from "fs/promises";
+import { dirname as dirname29, extname as extname8, join as join50, relative as relative25 } from "path";
+var ABSOLUTE_MOBILE_COMPLIANCE_REPORT_FORMAT = 1, HMR_ASSET_PATTERN, RELEASE_ASSET_EXTENSIONS, EXACT_VERSION_PATTERN, NOT_FOUND3 = -1, LOCK_FILES, MANUAL_REVIEW, pathExists6 = async (path) => {
+  try {
+    await access9(path);
+    return true;
+  } catch {
+    return false;
+  }
 }, inspectReleaseAsset = async (path, isDirectory, isFile2) => {
   if (isDirectory)
     return findHmrAsset(path);
   if (!isFile2 || !RELEASE_ASSET_EXTENSIONS.has(extname8(path)))
     return;
-  const source = await readFile16(path, "utf8");
+  const source = await readFile17(path, "utf8");
   return HMR_ASSET_PATTERN.test(source) ? path : undefined;
 }, findHmrAsset = async (root) => {
-  if (!await pathExists5(root))
+  if (!await pathExists6(root))
     return;
   const entries = await readdir4(root, { withFileTypes: true });
-  const matches = await Promise.all(entries.map((entry) => inspectReleaseAsset(join49(root, entry.name), entry.isDirectory(), entry.isFile())));
+  const matches = await Promise.all(entries.map((entry) => inspectReleaseAsset(join50(root, entry.name), entry.isDirectory(), entry.isFile())));
   return matches.find((match) => match !== undefined);
 }, pass = (id, detail, path) => ({ detail, id, path, status: "pass" }), fail5 = (id, detail, path, remediation) => ({
   detail,
@@ -18077,7 +18235,70 @@ var HMR_ASSET_PATTERN, RELEASE_ASSET_EXTENSIONS, pathExists5 = async (path) => {
   path,
   remediation,
   status: "fail"
-}), journalReleaseCheck = async (journalPath, platform6) => await pathExists5(journalPath) ? fail5(`${platform6}.dev-journal`, "A live-reload recovery journal is still active.", journalPath, "Close the development session or run mobile doctor again after stale-session repair.") : pass(`${platform6}.dev-journal`, "No live-reload recovery journal is active.", journalPath), parsedJson = (source) => {
+}), warn = (id, detail, path, remediation) => ({
+  detail,
+  id,
+  path,
+  remediation,
+  status: "warn"
+}), readJsonObject = async (path) => {
+  const value = JSON.parse(await readFile17(path, "utf8"));
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    throw new TypeError("JSON root must be an object.");
+  return Object.fromEntries(Object.entries(value));
+}, packageDeclarations = (manifest) => {
+  const declarations = new Map;
+  for (const field of ["dependencies", "devDependencies"]) {
+    const value = manifest[field];
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+      continue;
+    for (const [name, version2] of Object.entries(value))
+      if (typeof version2 === "string")
+        declarations.set(name, version2);
+  }
+  return declarations;
+}, versionCore = (version2) => version2.split("-")[0]?.split(".").slice(0, 2).join("."), capacitorVersionCheck = async (config, projectRoot) => {
+  const manifestPath = join50(projectRoot, "package.json");
+  try {
+    const manifest = await readJsonObject(manifestPath);
+    const declarations = packageDeclarations(manifest);
+    const names = [
+      "@capacitor/core",
+      "@capacitor/cli",
+      ...config.platforms.map((platform6) => `@capacitor/${platform6}`)
+    ];
+    const versions = await Promise.all(names.map(async (name) => {
+      const declared = declarations.get(name);
+      if (!declared || !EXACT_VERSION_PATTERN.test(declared))
+        throw new TypeError(`${name} must be a direct exact dependency.`);
+      const installed = await readJsonObject(join50(projectRoot, "node_modules", name, "package.json"));
+      if (installed.version !== declared)
+        throw new TypeError(`${name} does not match its installed version.`);
+      return declared;
+    }));
+    const lines = new Set(versions.map(versionCore));
+    if (lines.size !== 1)
+      throw new TypeError("Capacitor core, CLI, and platform packages must use one major/minor line.");
+    return pass("mobile.capacitor-versions", `Capacitor core, CLI, and configured platforms are pinned and aligned on ${versions[0]}.`, manifestPath);
+  } catch (error) {
+    return fail5("mobile.capacitor-versions", error instanceof Error ? error.message : "Capacitor package versions could not be validated.", manifestPath, "Pin @capacitor/core, @capacitor/cli, and each configured platform to exact versions on the same major/minor line, then reinstall.");
+  }
+}, dependencyLockCheck = async (projectRoot) => {
+  const present = (await Promise.all(LOCK_FILES.map(async (name) => ({
+    exists: await pathExists6(join50(projectRoot, name)),
+    name
+  })))).find(({ exists: exists3 }) => exists3);
+  return present ? pass("mobile.dependency-lock", `Dependency graph is locked by ${present.name}.`, join50(projectRoot, present.name)) : fail5("mobile.dependency-lock", "No supported dependency lockfile is present.", projectRoot, "Install dependencies with the project package manager and commit its lockfile before release.");
+}, productionOriginCheck = (config, projectRoot) => {
+  const origin = new URL(config.productionOrigin);
+  return origin.protocol === "https:" ? pass("mobile.production-origin", "Production transport uses an HTTPS origin.") : fail5("mobile.production-origin", "A loopback development origin cannot be used for a signed release.", projectRoot, "Configure mobile.server.productionOrigin with the deployed HTTPS origin.");
+}, associationIdentityCheck = (config, projectRoot) => {
+  const missing = [
+    ...config.platforms.includes("ios") && !config.appleAppIdPrefix ? ["mobile.deepLinks.apple.appIdPrefix"] : [],
+    ...config.platforms.includes("android") && config.androidCertificateFingerprints.length === 0 ? ["mobile.deepLinks.android.sha256CertificateFingerprints"] : []
+  ];
+  return missing.length === 0 ? pass("mobile.association-identities", "Deep-link association identities are configured for every release platform.") : fail5("mobile.association-identities", `Release association identity is missing: ${missing.join(", ")}.`, projectRoot, "Configure the Apple application prefix and every Android signing-certificate SHA-256 fingerprint used for release.");
+}, journalReleaseCheck = async (journalPath, platform6) => await pathExists6(journalPath) ? fail5(`${platform6}.dev-journal`, "A live-reload recovery journal is still active.", journalPath, "Close the development session or run mobile doctor again after stale-session repair.") : pass(`${platform6}.dev-journal`, "No live-reload recovery journal is active.", journalPath), parsedJson = (source) => {
   try {
     const parsed = JSON.parse(source);
     return parsed;
@@ -18099,30 +18320,138 @@ var HMR_ASSET_PATTERN, RELEASE_ASSET_EXTENSIONS, pathExists5 = async (path) => {
   const allowNavigation = Reflect.get(server, "allowNavigation");
   return typeof Reflect.get(server, "url") === "string" || Reflect.get(server, "cleartext") === true || Array.isArray(allowNavigation) && allowNavigation.length > 0;
 }, capacitorConfigReleaseCheck = async (nativeConfigPath) => {
-  if (!await pathExists5(nativeConfigPath)) {
+  if (!await pathExists6(nativeConfigPath)) {
     return fail5("android.capacitor-config", "The generated Android Capacitor config is missing.", nativeConfigPath, "Run `absolute mobile sync android` before release validation.");
   }
-  const unsafe = isUnsafeCapacitorConfig(await readFile16(nativeConfigPath, "utf8"));
+  const unsafe = isUnsafeCapacitorConfig(await readFile17(nativeConfigPath, "utf8"));
   return unsafe ? fail5("android.capacitor-config", "Android Capacitor config contains a development server URL, cleartext transport, navigation allowlist, or invalid JSON.", nativeConfigPath, "Run `absolute mobile sync android`; do not ship development transport overrides.") : pass("android.capacitor-config", "Android Capacitor config contains no development transport overrides.", nativeConfigPath);
+}, capacitorIdentityCheck = async (config, platform6, nativeConfigPath) => {
+  try {
+    const parsed = await readJsonObject(nativeConfigPath);
+    if (parsed.appId !== config.appId || parsed.appName !== config.appName)
+      throw new TypeError(`${platform6} packaged application identity does not match mobile config.`);
+    return pass(`${platform6}.app-identity`, `Packaged ${platform6} application identity matches mobile config.`, nativeConfigPath);
+  } catch (error) {
+    return fail5(`${platform6}.app-identity`, error instanceof Error ? error.message : `${platform6} application identity could not be validated.`, nativeConfigPath, `Run \`absolute mobile sync ${platform6}\` and review the generated Capacitor config.`);
+  }
 }, manifestReleaseCheck = async (manifestPath) => {
-  if (!await pathExists5(manifestPath)) {
+  if (!await pathExists6(manifestPath)) {
     return fail5("android.cleartext", "The Android manifest is missing.", manifestPath, "Run `absolute mobile sync android` before release validation.");
   }
-  const source = await readFile16(manifestPath, "utf8");
+  const source = await readFile17(manifestPath, "utf8");
   const cleartext = /android:usesCleartextTraffic=["']true["']/u.test(source);
   const networkConfigName = source.match(/android:networkSecurityConfig=["']@xml\/([a-z0-9_]+)["']/u)?.[1];
-  const networkConfigPath = networkConfigName ? join49(dirname29(manifestPath), "res", "xml", `${networkConfigName}.xml`) : undefined;
+  const networkConfigPath = networkConfigName ? join50(dirname29(manifestPath), "res", "xml", `${networkConfigName}.xml`) : undefined;
   const developmentTrustReference = /android:networkSecurityConfig=["']@xml\/absolutejs_dev_network_security["']/u.test(source);
-  const developmentTrustContents = networkConfigPath ? await readFile16(networkConfigPath, "utf8").then((value) => value.includes("@raw/absolutejs_dev_ca")).catch(() => false) : false;
+  const developmentTrustContents = networkConfigPath ? await readFile17(networkConfigPath, "utf8").then((value) => value.includes("@raw/absolutejs_dev_ca")).catch(() => false) : false;
   const developmentTrust = developmentTrustReference || developmentTrustContents;
   return cleartext || developmentTrust ? fail5("android.cleartext", developmentTrust ? "Android still references the AbsoluteJS development certificate authority." : "Android explicitly permits cleartext traffic.", manifestPath, "Run `absolute mobile sync android`; do not ship development transport or trust overrides.") : pass("android.cleartext", "Android does not explicitly permit cleartext traffic.", manifestPath);
 }, hmrAssetsReleaseCheck = async (publicRoot) => {
   const hmrAsset = await findHmrAsset(publicRoot);
   return hmrAsset ? fail5("android.hmr-assets", "A packaged Android asset contains the development HMR client.", hmrAsset, "Rebuild the production mobile bundle and run Capacitor sync again.") : pass("android.hmr-assets", "Packaged Android assets contain no development HMR markers.", publicRoot);
+}, embeddedBundleReleaseCheck = async (config, projectRoot, platform6, publicRoot) => {
+  const inspection = await inspectAbsoluteMobileBundle({ ...config, bundleDirectory: publicRoot }, projectRoot);
+  if (inspection.status === "valid")
+    return pass(`${platform6}.bundle-integrity`, `Packaged mobile manifest, runtime, routes, and ${inspection.pageCount ?? 0} page asset(s) passed structural and SHA-256 validation.`, join50(publicRoot, "absolute-mobile-manifest.json"));
+  return fail5(`${platform6}.bundle-integrity`, inspection.status === "missing" ? "The packaged mobile manifest is missing." : `The packaged mobile bundle is invalid: ${inspection.issue ?? "unknown validation error"}`, join50(publicRoot, "absolute-mobile-manifest.json"), "Rebuild the production mobile bundle and run Capacitor sync for this platform.");
+}, contentSecurityPolicyCheck = async (config, platform6, publicRoot) => {
+  const path = join50(publicRoot, "index.html");
+  try {
+    const source = await readFile17(path, "utf8");
+    const requirements = [
+      "Content-Security-Policy",
+      "default-src 'self'",
+      "base-uri 'none'",
+      "object-src 'none'",
+      "script-src 'self'",
+      "form-action 'none'",
+      config.productionOrigin
+    ];
+    const missing = requirements.filter((value) => !source.includes(value));
+    if (missing.length > 0)
+      throw new TypeError("Packaged shell CSP is missing a required AbsoluteJS directive or backend origin.");
+    return pass(`${platform6}.content-security-policy`, "Packaged shell CSP restricts scripts, objects, base URLs, forms, and backend connections.", path);
+  } catch (error) {
+    return fail5(`${platform6}.content-security-policy`, error instanceof Error ? error.message : "Packaged shell CSP could not be validated.", path, "Rebuild the production mobile bundle with the AbsoluteJS-generated shell.");
+  }
+}, sourceFiles = async (root, extensions) => {
+  if (!await pathExists6(root))
+    return [];
+  const files = await Array.fromAsync(new Bun.Glob("**/*").scan({ cwd: root, onlyFiles: true }));
+  return files.filter((file) => extensions.has(extname8(file))).map((file) => join50(root, file));
+}, containsPattern = async (paths, pattern) => {
+  const sources = await Promise.all(paths.map((path) => readFile17(path, "utf8")));
+  const index = sources.findIndex((source) => pattern.test(source));
+  return index === NOT_FOUND3 ? undefined : paths[index];
+}, androidNativeSecurityCheck = async (androidRoot) => {
+  const manifestPath = join50(androidRoot, "app/src/main/AndroidManifest.xml");
+  try {
+    const manifest = await readFile17(manifestPath, "utf8");
+    if (/android:debuggable=["']true["']/u.test(manifest))
+      throw new TypeError("Android release manifest explicitly enables application debugging.");
+    const sources = await sourceFiles(join50(androidRoot, "app/src/main"), new Set([".java", ".kt"]));
+    const debugSource = await containsPattern(sources, /setWebContentsDebuggingEnabled\s*\(\s*true\s*\)/u);
+    if (debugSource)
+      return fail5("android.native-debugging", "Android application source unconditionally enables WebView debugging.", debugSource, "Remove the unconditional WebView debugging call; use the platform debug-build behavior during development.");
+    return pass("android.native-debugging", "Android does not explicitly enable app or WebView debugging in release source.", manifestPath);
+  } catch (error) {
+    return fail5("android.native-debugging", error instanceof Error ? error.message : "Android native debugging configuration could not be validated.", manifestPath, "Remove explicit release debugging settings and rerun mobile sync.");
+  }
+}, androidExportedComponentsCheck = async (manifestPath) => {
+  const source = await readFile17(manifestPath, "utf8").catch(() => "");
+  const exported = [
+    ...source.matchAll(/<(?:activity|activity-alias|provider|receiver|service)\b[^>]*>/giu)
+  ].map(([tag]) => tag).filter((tag) => /android:exported=["']true["']/iu.test(tag)).map((tag) => tag.match(/android:name=["']([^"']+)["']/iu)?.[1]).filter((name) => Boolean(name) && name !== ".MainActivity");
+  return exported.length === 0 ? pass("android.exported-components", "No non-launcher Android component is explicitly exported.", manifestPath) : warn("android.exported-components", `${exported.length} non-launcher Android component(s) are exported and require manual authorization review.`, manifestPath, "Confirm each exported component is intentional, permission-protected where appropriate, and documented in the mobile threat model review.");
+}, androidDeepLinkProjectionCheck = async (config, manifestPath) => {
+  try {
+    const source = await readFile17(manifestPath, "utf8");
+    const required = [
+      'android:autoVerify="true"',
+      "android.intent.category.BROWSABLE",
+      ...config.deepLinkHosts.map((host2) => `android:scheme="https" android:host="${host2}"`),
+      ...config.deepLinkScheme ? [`android:scheme="${config.deepLinkScheme}"`] : []
+    ];
+    if (required.some((value) => !source.includes(value)))
+      throw new TypeError("Android App Link or custom-scheme projection does not match mobile config.");
+    return pass("android.deep-links", "Android verified links and custom scheme match the effective mobile config.", manifestPath);
+  } catch (error) {
+    return fail5("android.deep-links", error instanceof Error ? error.message : "Android deep-link projection could not be validated.", manifestPath, "Run `absolute mobile sync android` and review the AbsoluteJS-owned deep-link region.");
+  }
+}, iosNativeSecurityCheck = async (iosRoot) => {
+  const entitlementsPath = join50(iosRoot, "App/AbsoluteJS.entitlements");
+  const entitlements = await readFile17(entitlementsPath, "utf8").catch(() => "");
+  if (/<key>get-task-allow<\/key>\s*<true\s*\/>/u.test(entitlements) || /<key>com\.apple\.security\.get-task-allow<\/key>\s*<true\s*\/>/u.test(entitlements))
+    return fail5("ios.native-debugging", "iOS source entitlements explicitly permit debugger attachment.", entitlementsPath, "Remove get-task-allow from source entitlements; Xcode supplies development entitlements only to debug builds.");
+  const sources = await sourceFiles(join50(iosRoot, "App"), new Set([".m", ".mm", ".swift"]));
+  const debugSource = await containsPattern(sources, /\.isInspectable\s*=\s*true|setInspectable\s*\(\s*true\s*\)/u);
+  if (debugSource)
+    return fail5("ios.native-debugging", "iOS application source unconditionally enables WebView inspection.", debugSource, "Remove unconditional WebView inspection from release source.");
+  return pass("ios.native-debugging", "iOS source does not enable release debugger attachment or WebView inspection.", entitlementsPath);
+}, iosDeepLinkProjectionCheck = async (config, iosRoot) => {
+  const infoPath = join50(iosRoot, "App/App/Info.plist");
+  const entitlementsPath = join50(iosRoot, "App/AbsoluteJS.entitlements");
+  const projectPath = join50(iosRoot, "App/App.xcodeproj/project.pbxproj");
+  try {
+    const [info2, entitlements, project] = await Promise.all([
+      readFile17(infoPath, "utf8"),
+      readFile17(entitlementsPath, "utf8"),
+      readFile17(projectPath, "utf8")
+    ]);
+    if (config.deepLinkScheme && (!info2.includes("<key>CFBundleURLTypes</key>") || !info2.includes(`<string>${config.deepLinkScheme}</string>`)))
+      throw new TypeError("iOS custom URL scheme does not match mobile config.");
+    if (config.deepLinkHosts.some((host2) => !entitlements.includes(`<string>applinks:${host2}</string>`)))
+      throw new TypeError("iOS associated domains do not match mobile config.");
+    if (!project.includes("CODE_SIGN_ENTITLEMENTS = App/AbsoluteJS.entitlements;"))
+      throw new TypeError("iOS target does not sign the AbsoluteJS entitlements file.");
+    return pass("ios.deep-links", "iOS universal links, custom scheme, and signed entitlements match mobile config.", entitlementsPath);
+  } catch (error) {
+    return fail5("ios.deep-links", error instanceof Error ? error.message : "iOS deep-link projection could not be validated.", entitlementsPath, "Run `absolute mobile sync ios` and review the AbsoluteJS-owned deep-link and entitlement projection.");
+  }
 }, syncSchemaReleaseCheck = (projectRoot) => {
   if (!projectUsesAbsoluteSync(projectRoot))
     return;
-  const manifestPath = join49(projectRoot, "package.json");
+  const manifestPath = join50(projectRoot, "package.json");
   try {
     const schema = discoverAbsoluteSyncSchema(projectRoot);
     const versions = schema.components.map((component2) => `${component2.id}@${component2.version}`).join(", ");
@@ -18144,8 +18473,8 @@ var HMR_ASSET_PATTERN, RELEASE_ASSET_EXTENSIONS, pathExists5 = async (path) => {
 }, IOS_USAGE_KEYS, androidDevicePermissionCheck = async (config, permissions) => {
   if (!config.platforms.includes("android") || permissions.length === 0)
     return;
-  const path = join49(config.nativeProjectDirectory, "android/app/src/main/AndroidManifest.xml");
-  const source = await readFile16(path, "utf8");
+  const path = join50(config.nativeProjectDirectory, "android/app/src/main/AndroidManifest.xml");
+  const source = await readFile17(path, "utf8");
   const missing = permissions.filter((permission) => !source.includes(`android:name="${permission}"`) && !source.includes(`android:name='${permission}'`));
   if (missing.length === 0)
     return;
@@ -18153,14 +18482,44 @@ var HMR_ASSET_PATTERN, RELEASE_ASSET_EXTENSIONS, pathExists5 = async (path) => {
 }, iosDevicePermissionCheck = async (config, purposes) => {
   if (!config.platforms.includes("ios") || purposes.length === 0)
     return;
-  const path = join49(config.nativeProjectDirectory, "ios/App/App/Info.plist");
-  const source = await readFile16(path, "utf8");
+  const path = join50(config.nativeProjectDirectory, "ios/App/App/Info.plist");
+  const source = await readFile17(path, "utf8");
   const missing = purposes.filter((purpose) => !source.includes(`<key>${IOS_USAGE_KEYS[purpose]}</key>`));
   if (missing.length === 0)
     return;
   return fail5("mobile.device-capabilities", `iOS is missing usage descriptions for: ${missing.join(", ")}.`, path, "Run `absolute mobile sync ios` to regenerate detected device usage descriptions.");
+}, iosCapabilityProjectionCheck = async (config, requirements) => {
+  if (!config.platforms.includes("ios"))
+    return;
+  const appRoot = join50(config.nativeProjectDirectory, "ios/App/App");
+  const infoPath = join50(appRoot, "Info.plist");
+  const info2 = await readFile17(infoPath, "utf8").catch(() => "");
+  if (requirements.iosSystemBars && !/<key>UIViewControllerBasedStatusBarAppearance<\/key>\s*<true\s*\/>/u.test(info2))
+    return fail5("mobile.device-capabilities", "iOS system-bar capability is missing its required view-controller setting.", infoPath, "Run `absolute mobile sync ios` to regenerate native capability settings.");
+  if (requirements.iosPrivacyAccessedApis.length > 0) {
+    const privacyPath = join50(appRoot, "PrivacyInfo.xcprivacy");
+    const projectPath = join50(config.nativeProjectDirectory, "ios/App/App.xcodeproj/project.pbxproj");
+    const [privacy, project] = await Promise.all([
+      readFile17(privacyPath, "utf8").catch(() => ""),
+      readFile17(projectPath, "utf8").catch(() => "")
+    ]);
+    const missing = requirements.iosPrivacyAccessedApis.some(({ api, reasons }) => !privacy.includes(`<string>${api}</string>`) || reasons.some((reason) => !privacy.includes(`<string>${reason}</string>`)));
+    if (missing || !project.includes("PrivacyInfo.xcprivacy in Resources"))
+      return fail5("mobile.device-capabilities", "iOS privacy manifest or target membership does not match detected native capabilities.", privacyPath, "Run `absolute mobile sync ios` to regenerate and target PrivacyInfo.xcprivacy.");
+  }
+  if (requirements.iosPushNotifications) {
+    const entitlementsPath = join50(config.nativeProjectDirectory, "ios/App/AbsoluteJS.entitlements");
+    const delegatePath = join50(appRoot, "AppDelegate.swift");
+    const [entitlements, delegate] = await Promise.all([
+      readFile17(entitlementsPath, "utf8").catch(() => ""),
+      readFile17(delegatePath, "utf8").catch(() => "")
+    ]);
+    if (!entitlements.includes("<key>aps-environment</key>") || !delegate.includes("capacitorDidRegisterForRemoteNotifications") || !delegate.includes("capacitorDidFailToRegisterForRemoteNotifications"))
+      return fail5("mobile.device-capabilities", "iOS push entitlement or AppDelegate forwarding does not match detected capabilities.", entitlementsPath, "Run `absolute mobile sync ios` to regenerate native push integration.");
+  }
+  return;
 }, deviceCapabilityReleaseCheck = async (config, projectRoot) => {
-  const manifestPath = join49(projectRoot, "package.json");
+  const manifestPath = join50(projectRoot, "package.json");
   try {
     const plan = resolveAbsoluteDeviceCapabilityPlan(projectRoot);
     assertAbsoluteDeviceCapabilityPackages(projectRoot, plan);
@@ -18171,32 +18530,41 @@ var HMR_ASSET_PATTERN, RELEASE_ASSET_EXTENSIONS, pathExists5 = async (path) => {
     const iosCheck = await iosDevicePermissionCheck(config, requirements.iosUsageDescriptions);
     if (iosCheck)
       return iosCheck;
+    const iosProjectionCheck = await iosCapabilityProjectionCheck(config, requirements);
+    if (iosProjectionCheck)
+      return iosProjectionCheck;
     return pass("mobile.device-capabilities", plan.capabilities.length > 0 ? `Native provider packages and permission declarations match detected capabilities: ${plan.capabilities.join(", ")}.` : "No optional native device capabilities are used.", manifestPath);
   } catch (error) {
     return fail5("mobile.device-capabilities", error instanceof Error ? error.message : "Native device capability provisioning is invalid.", manifestPath, "Run `absolute mobile sync` and approve the exact capability plugins before releasing.");
   }
 }, inspectAndroidRelease = async (config, projectRoot) => {
-  const androidRoot = join49(config.nativeProjectDirectory, "android");
-  const nativeConfigPath = join49(androidRoot, "app", "src", "main", "assets", "capacitor.config.json");
-  const manifestPath = join49(androidRoot, "app", "src", "main", "AndroidManifest.xml");
-  const publicRoot = join49(androidRoot, "app", "src", "main", "assets", "public");
-  const journalPath = join49(projectRoot, ".absolutejs", "mobile", "dev-session", "journal.json");
+  const androidRoot = join50(config.nativeProjectDirectory, "android");
+  const nativeConfigPath = join50(androidRoot, "app", "src", "main", "assets", "capacitor.config.json");
+  const manifestPath = join50(androidRoot, "app", "src", "main", "AndroidManifest.xml");
+  const publicRoot = join50(androidRoot, "app", "src", "main", "assets", "public");
+  const journalPath = join50(projectRoot, ".absolutejs", "mobile", "dev-session", "journal.json");
   const checks = await Promise.all([
     journalReleaseCheck(journalPath, "android"),
     capacitorConfigReleaseCheck(nativeConfigPath),
+    capacitorIdentityCheck(config, "android", nativeConfigPath),
     manifestReleaseCheck(manifestPath),
-    hmrAssetsReleaseCheck(publicRoot)
+    hmrAssetsReleaseCheck(publicRoot),
+    embeddedBundleReleaseCheck(config, projectRoot, "android", publicRoot),
+    contentSecurityPolicyCheck(config, "android", publicRoot),
+    androidNativeSecurityCheck(androidRoot),
+    androidExportedComponentsCheck(manifestPath),
+    androidDeepLinkProjectionCheck(config, manifestPath)
   ]);
   return checks.map((check2) => ({
     ...check2,
-    path: check2.path ? relative24(projectRoot, check2.path).replaceAll("\\", "/") || "." : undefined
+    path: check2.path ? relative25(projectRoot, check2.path).replaceAll("\\", "/") || "." : undefined
   }));
 }, inspectIosRelease = async (config, projectRoot) => {
-  const iosAppRoot = join49(config.nativeProjectDirectory, "ios", "App", "App");
-  const nativeConfigPath = join49(iosAppRoot, "capacitor.config.json");
-  const infoPath = join49(iosAppRoot, "Info.plist");
-  const publicRoot = join49(iosAppRoot, "public");
-  const journalPath = join49(projectRoot, ".absolutejs", "mobile", "ios-dev-session", "journal.json");
+  const iosAppRoot = join50(config.nativeProjectDirectory, "ios", "App", "App");
+  const nativeConfigPath = join50(iosAppRoot, "capacitor.config.json");
+  const infoPath = join50(iosAppRoot, "Info.plist");
+  const publicRoot = join50(iosAppRoot, "public");
+  const journalPath = join50(projectRoot, ".absolutejs", "mobile", "ios-dev-session", "journal.json");
   const checks = [
     await journalReleaseCheck(journalPath, "ios")
   ];
@@ -18205,27 +18573,59 @@ var HMR_ASSET_PATTERN, RELEASE_ASSET_EXTENSIONS, pathExists5 = async (path) => {
   } else {
     checks.push(pass("ios.marketing-version", `The iOS marketing version is ${config.iosVersion}.`));
   }
-  if (!await pathExists5(nativeConfigPath)) {
+  if (!await pathExists6(nativeConfigPath)) {
     checks.push(fail5("ios.capacitor-config", "The generated iOS Capacitor config is missing.", nativeConfigPath, "Run `absolute mobile sync ios` before release validation."));
-  } else if (isUnsafeCapacitorConfig(await readFile16(nativeConfigPath, "utf8"))) {
+  } else if (isUnsafeCapacitorConfig(await readFile17(nativeConfigPath, "utf8"))) {
     checks.push(fail5("ios.capacitor-config", "iOS Capacitor config contains a development server URL, cleartext transport, navigation allowlist, or invalid JSON.", nativeConfigPath, "Run `absolute mobile sync ios`; do not ship development transport overrides."));
   } else {
     checks.push(pass("ios.capacitor-config", "iOS Capacitor config contains no development transport overrides.", nativeConfigPath));
   }
-  if (!await pathExists5(infoPath)) {
+  checks.push(await capacitorIdentityCheck(config, "ios", nativeConfigPath));
+  if (!await pathExists6(infoPath)) {
     checks.push(fail5("ios.transport-security", "The iOS Info.plist is missing.", infoPath, "Run `absolute mobile sync ios` before release validation."));
   } else {
-    const info2 = await readFile16(infoPath, "utf8");
+    const info2 = await readFile17(infoPath, "utf8");
     checks.push(/<key>NSAllowsArbitraryLoads<\/key>\s*<true\s*\/>/u.test(info2) ? fail5("ios.transport-security", "iOS App Transport Security permits arbitrary network loads.", infoPath, "Remove NSAllowsArbitraryLoads from the release Info.plist.") : pass("ios.transport-security", "iOS App Transport Security does not permit arbitrary loads.", infoPath));
   }
   const hmrAsset = await findHmrAsset(publicRoot);
   checks.push(hmrAsset ? fail5("ios.hmr-assets", "A packaged iOS asset contains the development HMR client.", hmrAsset, "Rebuild the production mobile bundle and run Capacitor sync again.") : pass("ios.hmr-assets", "Packaged iOS assets contain no development HMR markers.", publicRoot));
+  checks.push(await embeddedBundleReleaseCheck(config, projectRoot, "ios", publicRoot), await contentSecurityPolicyCheck(config, "ios", publicRoot), await iosNativeSecurityCheck(join50(config.nativeProjectDirectory, "ios")), await iosDeepLinkProjectionCheck(config, join50(config.nativeProjectDirectory, "ios")));
   return checks.map((check2) => ({
     ...check2,
-    path: check2.path ? relative24(projectRoot, check2.path).replaceAll("\\", "/") || "." : undefined
+    path: check2.path ? relative25(projectRoot, check2.path).replaceAll("\\", "/") || "." : undefined
   }));
+}, createAbsoluteMobileComplianceReport = (config, result) => {
+  const summary = {
+    failed: result.checks.filter(({ status: status2 }) => status2 === "fail").length,
+    passed: result.checks.filter(({ status: status2 }) => status2 === "pass").length,
+    warnings: result.checks.filter(({ status: status2 }) => status2 === "warn").length
+  };
+  return {
+    app: {
+      appId: config.appId,
+      engine: config.engine,
+      platforms: [...config.platforms],
+      productionOrigin: config.productionOrigin
+    },
+    checks: result.checks.map(({ id, status: status2 }) => ({ id, status: status2 })),
+    format: ABSOLUTE_MOBILE_COMPLIANCE_REPORT_FORMAT,
+    manualReview: [...MANUAL_REVIEW],
+    ready: result.ready,
+    summary
+  };
 }, inspectAbsoluteMobileRelease = async (config, projectRoot) => {
-  const checks = config.platforms.includes("android") ? await inspectAndroidRelease(config, projectRoot) : [];
+  const globalChecks = await Promise.all([
+    Promise.resolve(productionOriginCheck(config, projectRoot)),
+    Promise.resolve(associationIdentityCheck(config, projectRoot)),
+    dependencyLockCheck(projectRoot),
+    capacitorVersionCheck(config, projectRoot)
+  ]);
+  const checks = globalChecks.map((check2) => ({
+    ...check2,
+    path: check2.path ? relative25(projectRoot, check2.path).replaceAll("\\", "/") || "." : undefined
+  }));
+  if (config.platforms.includes("android"))
+    checks.push(...await inspectAndroidRelease(config, projectRoot));
   if (config.platforms.includes("ios")) {
     checks.push(...await inspectIosRelease(config, projectRoot));
   }
@@ -18233,25 +18633,41 @@ var HMR_ASSET_PATTERN, RELEASE_ASSET_EXTENSIONS, pathExists5 = async (path) => {
   if (syncSchema) {
     checks.push({
       ...syncSchema,
-      path: syncSchema.path ? relative24(projectRoot, syncSchema.path).replaceAll("\\", "/") || "." : undefined
+      path: syncSchema.path ? relative25(projectRoot, syncSchema.path).replaceAll("\\", "/") || "." : undefined
     });
   }
   const deviceCapabilities = await deviceCapabilityReleaseCheck(config, projectRoot);
   checks.push({
     ...deviceCapabilities,
-    path: deviceCapabilities.path ? relative24(projectRoot, deviceCapabilities.path).replaceAll("\\", "/") || "." : undefined
+    path: deviceCapabilities.path ? relative25(projectRoot, deviceCapabilities.path).replaceAll("\\", "/") || "." : undefined
   });
   return {
     checks,
-    ready: checks.length > 0 && checks.every((check2) => check2.status === "pass")
+    ready: checks.length > 0 && checks.every((check2) => check2.status !== "fail")
   };
 };
 var init_releaseDoctor = __esm(() => {
+  init_mobileBundleInspection();
   init_nativeAuth();
   init_syncSchema();
   init_deviceCapabilities();
   HMR_ASSET_PATTERN = /(?:__HMR_WS__|hmr-timing|__absolute_target|absolutejs-error-overlay)/u;
   RELEASE_ASSET_EXTENSIONS = new Set([".html", ".js", ".mjs"]);
+  EXACT_VERSION_PATTERN = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u;
+  LOCK_FILES = [
+    "bun.lock",
+    "bun.lockb",
+    "package-lock.json",
+    "pnpm-lock.yaml",
+    "yarn.lock"
+  ];
+  MANUAL_REVIEW = [
+    "physical-device",
+    "store-privacy-questionnaire",
+    "privacy-policy",
+    "signing-key-custody",
+    "native-sdk-data-practices"
+  ];
   IOS_USAGE_KEYS = {
     camera: "NSCameraUsageDescription",
     "location-always": "NSLocationAlwaysAndWhenInUseUsageDescription",
@@ -18262,19 +18678,19 @@ var init_releaseDoctor = __esm(() => {
 });
 // src/mobile/androidRelease.ts
-import { createHash as createHash12 } from "crypto";
+import { createHash as createHash13 } from "crypto";
 import {
-  access as access9,
+  access as access10,
   copyFile as copyFile5,
   mkdir as mkdir12,
   mkdtemp as mkdtemp5,
-  readFile as readFile17,
+  readFile as readFile18,
   rename as rename12,
   rm as rm8,
-  stat as stat2,
+  stat as stat3,
   writeFile as writeFile14
 } from "fs/promises";
-import { dirname as dirname30, isAbsolute as isAbsolute7, join as join50, relative as relative25, resolve as resolve39, sep as sep6 } from "path";
+import { dirname as dirname30, isAbsolute as isAbsolute7, join as join51, relative as relative26, resolve as resolve40, sep as sep6 } from "path";
 var ABSOLUTE_ANDROID_RELEASE_FORMAT = 1, isRecord13 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), requireManifest2 = (value) => {
   if (!isRecord13(value) || typeof value.appBuild !== "string" || typeof value.appId !== "string" || typeof value.runtime !== "string") {
     throw new TypeError("Invalid embedded AbsoluteJS mobile manifest.");
@@ -18284,9 +18700,9 @@ var ABSOLUTE_ANDROID_RELEASE_FORMAT = 1, isRecord13 = (value) => typeof value ==
     appId: value.appId,
     runtime: value.runtime
   };
-}, pathExists6 = async (path) => {
+}, pathExists7 = async (path) => {
   try {
-    await access9(path);
+    await access10(path);
     return true;
   } catch {
     return false;
@@ -18324,22 +18740,22 @@ var ABSOLUTE_ANDROID_RELEASE_FORMAT = 1, isRecord13 = (value) => typeof value ==
     artifactPath
   ]);
   return result.exitCode === 0 && /jar verified/iu.test(result.stdout);
-}, sha256File2 = async (path) => createHash12("sha256").update(await readFile17(path)).digest("hex"), safeOutputDirectory2 = (projectRoot, requested) => {
-  const root = resolve39(projectRoot);
-  const output = resolve39(root, requested ?? ".absolutejs/mobile/releases/android");
-  const projectRelative = relative25(root, output);
+}, sha256File2 = async (path) => createHash13("sha256").update(await readFile18(path)).digest("hex"), safeOutputDirectory2 = (projectRoot, requested) => {
+  const root = resolve40(projectRoot);
+  const output = resolve40(root, requested ?? ".absolutejs/mobile/releases/android");
+  const projectRelative = relative26(root, output);
   if (projectRelative === ".." || projectRelative.startsWith(`..${sep6}`) || isAbsolute7(projectRelative)) {
     throw new TypeError("mobile build --outdir must remain inside the project.");
   }
   return output;
 }, installRelease2 = async (artifactPath, metadata, outputRoot) => {
-  const releaseRoot = join50(outputRoot, metadata.releaseId);
+  const releaseRoot = join51(outputRoot, metadata.releaseId);
   const artifactName = "app-release.aab";
-  const destination = join50(releaseRoot, artifactName);
-  if (await pathExists6(releaseRoot)) {
-    const existing = requireManifestIdentity(JSON.parse(await readFile17(join50(releaseRoot, "release.json"), "utf8")), metadata);
+  const destination = join51(releaseRoot, artifactName);
+  if (await pathExists7(releaseRoot)) {
+    const existing = requireManifestIdentity(JSON.parse(await readFile18(join51(releaseRoot, "release.json"), "utf8")), metadata);
     const [installedBytes, installedSha256] = await Promise.all([
-      stat2(destination).then(({ size }) => size),
+      stat3(destination).then(({ size }) => size),
       sha256File2(destination)
     ]);
     if (installedBytes !== metadata.bytes || installedSha256 !== metadata.sha256) {
@@ -18348,14 +18764,14 @@ var ABSOLUTE_ANDROID_RELEASE_FORMAT = 1, isRecord13 = (value) => typeof value ==
     return { artifactPath: destination, metadata: existing, releaseRoot };
   }
   await mkdir12(dirname30(releaseRoot), { recursive: true });
-  const staging = await mkdtemp5(join50(dirname30(releaseRoot), ".android-stage-"));
+  const staging = await mkdtemp5(join51(dirname30(releaseRoot), ".android-stage-"));
   try {
-    await copyFile5(artifactPath, join50(staging, artifactName));
+    await copyFile5(artifactPath, join51(staging, artifactName));
     const complete = {
       ...metadata,
       artifact: artifactName
     };
-    await writeFile14(join50(staging, "release.json"), `${JSON.stringify(complete, null, "\t")}
+    await writeFile14(join51(staging, "release.json"), `${JSON.stringify(complete, null, "\t")}
 `, { flag: "wx" });
     await rename12(staging, releaseRoot);
     return { artifactPath: destination, metadata: complete, releaseRoot };
@@ -18380,18 +18796,18 @@ var ABSOLUTE_ANDROID_RELEASE_FORMAT = 1, isRecord13 = (value) => typeof value ==
   if (options.versionCode !== undefined && (!Number.isSafeInteger(options.versionCode) || options.versionCode < 1 || options.versionCode > 2100000000)) {
     throw new TypeError("Android versionCode must be an integer from 1 through 2100000000.");
   }
-  const projectRoot = resolve39(options.projectRoot);
+  const projectRoot = resolve40(options.projectRoot);
   const host2 = options.host ?? detectAbsoluteMobileHost();
   const androidRoot = options.androidRoot ?? process.env.ANDROID_HOME ?? process.env.ANDROID_SDK_ROOT ?? absoluteManagedAndroidSdkRoot(host2);
-  const nativeDirectory = join50(options.config.nativeProjectDirectory, "android");
-  const manifest = requireManifest2(JSON.parse(await readFile17(join50(options.config.bundleDirectory, "absolute-mobile-manifest.json"), "utf8")));
+  const nativeDirectory = join51(options.config.nativeProjectDirectory, "android");
+  const manifest = requireManifest2(JSON.parse(await readFile18(join51(options.config.bundleDirectory, "absolute-mobile-manifest.json"), "utf8")));
   if (manifest.appId !== options.config.appId) {
     throw new TypeError("Embedded mobile manifest appId does not match mobile.appId.");
   }
   let { versionCode } = options;
   if (options.prepareVersionCode) {
     const nativeFingerprint = await fingerprintAbsoluteAndroidNativeProject({ nativeDirectory });
-    const buildIdentity = createHash12("sha256").update(`${manifest.appBuild}\x00${nativeFingerprint}`).digest("hex");
+    const buildIdentity = createHash13("sha256").update(`${manifest.appBuild}\x00${nativeFingerprint}`).digest("hex");
     versionCode = await options.prepareVersionCode(buildIdentity);
   }
   if (versionCode !== undefined && (!Number.isSafeInteger(versionCode) || versionCode < 1 || versionCode > 2100000000)) {
@@ -18410,7 +18826,7 @@ var ABSOLUTE_ANDROID_RELEASE_FORMAT = 1, isRecord13 = (value) => typeof value ==
     run: options.run,
     task: "bundleRelease"
   });
-  if (!await pathExists6(artifactPath)) {
+  if (!await pathExists7(artifactPath)) {
     throw new TypeError(`Android Gradle did not produce the expected App Bundle: ${artifactPath}`);
   }
   const capture = options.capture ?? defaultCapture4;
@@ -18422,7 +18838,7 @@ var ABSOLUTE_ANDROID_RELEASE_FORMAT = 1, isRecord13 = (value) => typeof value ==
     throw new TypeError("Android Gradle produced an unsigned App Bundle. Configure the release signingConfig in the source-owned Android project (prefer external Gradle properties), or pass --unsigned only for a non-publishable build.");
   }
   const [bytes, sha2562] = await Promise.all([
-    stat2(artifactPath).then(({ size }) => size),
+    stat3(artifactPath).then(({ size }) => size),
     sha256File2(artifactPath)
   ]);
   const releaseId = `amobile_android_${sha2562}`;
@@ -18486,7 +18902,7 @@ var absoluteIosDeviceAcceptanceCommands = (options) => {
 };
 // src/mobile/iosConformance.ts
-import { readFile as readFile18, stat as stat3 } from "fs/promises";
+import { readFile as readFile19, stat as stat4 } from "fs/promises";
 var HMR_LINE, parseAbsoluteIosHmrLog = (line) => {
   const match = HMR_LINE.exec(line);
   if (!match)
@@ -18515,13 +18931,13 @@ var HMR_LINE, parseAbsoluteIosHmrLog = (line) => {
   const sleep2 = options.sleep ?? Bun.sleep;
   const timeoutMs = options.timeoutMs ?? 30000;
   const deadline = Date.now() + timeoutMs;
-  let offset = options.startOffset ?? await stat3(options.logPath).then(({ size }) => size).catch(() => 0);
+  let offset = options.startOffset ?? await stat4(options.logPath).then(({ size }) => size).catch(() => 0);
   let buffered = "";
   const poll = async () => {
     if (Date.now() > deadline)
       throw new Error(`No iOS native HMR acknowledgement was observed within ${timeoutMs}ms.`);
     options.signal?.throwIfAborted();
-    const contents = await readFile18(options.logPath).catch(() => Buffer.alloc(0));
+    const contents = await readFile19(options.logPath).catch(() => Buffer.alloc(0));
     if (contents.byteLength < offset) {
       offset = 0;
       buffered = "";
@@ -18545,8 +18961,8 @@ var init_iosConformance = __esm(() => {
 });
 // src/mobile/nativeTestReport.ts
-import { mkdir as mkdir13, readFile as readFile19, writeFile as writeFile15 } from "fs/promises";
-import { join as join51 } from "path";
+import { mkdir as mkdir13, readFile as readFile20, writeFile as writeFile15 } from "fs/promises";
+import { join as join52 } from "path";
 var secretPattern, bearerPattern, coordinatePattern, nativeCredentialPattern, sanitizeNativeReportText = (value) => value.replace(nativeCredentialPattern, "[REDACTED]").replace(bearerPattern, "Bearer [REDACTED]").replace(secretPattern, "$1$2[REDACTED]").replace(coordinatePattern, "$1$2[REDACTED]").replace(/(https?:\/\/[^\s?#]+)[?#][^\s]*/giu, "$1?[REDACTED]"), markdownCell = (value) => sanitizeNativeReportText(value).replaceAll("|", "\\|").replaceAll(`
 `, "<br>"), createAbsoluteNativeAutomatedChecks = (run) => {
   const target = `${run.targetKind} ${run.targetId}`;
@@ -18648,7 +19064,7 @@ var secretPattern, bearerPattern, coordinatePattern, nativeCredentialPattern, sa
   reportVersion: 1,
   run: options.run
 }), readPackageVersionForNativeReport = async (packageJsonPath) => {
-  const manifest = JSON.parse(await readFile19(packageJsonPath, "utf8"));
+  const manifest = JSON.parse(await readFile20(packageJsonPath, "utf8"));
   if (typeof manifest !== "object" || manifest === null)
     return "unknown";
   const version2 = Reflect.get(manifest, "version");
@@ -18685,8 +19101,8 @@ ${table(report.manualChecks)}
 `;
 }, writeAbsoluteNativeTestReport = async (directory, report) => {
   await mkdir13(directory, { recursive: true });
-  const jsonPath = join51(directory, "report.json");
-  const markdownPath = join51(directory, "report.md");
+  const jsonPath = join52(directory, "report.json");
+  const markdownPath = join52(directory, "report.md");
   await Promise.all([
     writeFile15(jsonPath, `${JSON.stringify(report, null, 2)}
 `),
@@ -18904,8 +19320,8 @@ var init_androidTestReport = __esm(() => {
 });
 // src/mobile/releasePublisher.ts
-import { access as access10 } from "fs/promises";
-import { isAbsolute as isAbsolute8, relative as relative26, resolve as resolve40, sep as sep7 } from "path";
+import { access as access11 } from "fs/promises";
+import { isAbsolute as isAbsolute8, relative as relative27, resolve as resolve41, sep as sep7 } from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
 var prepareAbsoluteIosRelease = async (publisher, options) => {
   if (typeof publisher.prepareIosRelease !== "function") {
@@ -18927,16 +19343,16 @@ var prepareAbsoluteIosRelease = async (publisher, options) => {
   }
   return versionCode;
 }, isRecord14 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), isPublisher = (value) => isRecord14(value) && typeof value.publish === "function", publisherModulePath = (projectRoot, requested) => {
-  const root = resolve40(projectRoot);
-  const path = resolve40(root, requested);
-  const projectRelative = relative26(root, path);
+  const root = resolve41(projectRoot);
+  const path = resolve41(root, requested);
+  const projectRelative = relative27(root, path);
   if (projectRelative === ".." || projectRelative.startsWith(`..${sep7}`) || isAbsolute8(projectRelative)) {
     throw new TypeError("mobile publish --registry must remain inside the project.");
   }
   return path;
 }, loadAbsoluteNativeReleasePublisher = async (projectRoot, requestedModulePath) => {
   const modulePath = publisherModulePath(projectRoot, requestedModulePath);
-  await access10(modulePath).catch(() => {
+  await access11(modulePath).catch(() => {
     throw new TypeError(`Native release registry module does not exist: ${modulePath}`);
   });
   const loaded = await import(pathToFileURL2(modulePath).href);
@@ -18997,103 +19413,103 @@ var prepareAbsoluteIosRelease = async (publisher, options) => {
 var init_releasePublisher = () => {};
 // src/mobile/mobileInspect.ts
-import { access as access11, readFile as readFile20, stat as stat4 } from "fs/promises";
-import { join as join52, relative as relative27, resolve as resolve41 } from "path";
-var ABSOLUTE_MOBILE_INSPECTION_FORMAT = 1, MOBILE_PACKAGE_NAMES, MOBILE_FRAMEWORKS, isObject2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), portablePath = (projectRoot, path) => {
-  const value = relative27(resolve41(projectRoot), resolve41(path)).replaceAll("\\", "/");
+import { access as access12, readFile as readFile21, stat as stat5 } from "fs/promises";
+import { join as join53, relative as relative28, resolve as resolve42 } from "path";
+var ABSOLUTE_MOBILE_INSPECTION_FORMAT = 1, MOBILE_PACKAGE_NAMES, MOBILE_FRAMEWORKS2, isObject3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), portablePath2 = (projectRoot, path) => {
+  const value = relative28(resolve42(projectRoot), resolve42(path)).replaceAll("\\", "/");
   return value || ".";
-}, pathExists7 = async (path) => {
+}, pathExists8 = async (path) => {
   try {
-    await access11(path);
+    await access12(path);
     return true;
   } catch {
     return false;
   }
-}, readObject = async (path) => {
-  const value = JSON.parse(await readFile20(path, "utf8"));
-  if (!isObject2(value))
+}, readObject2 = async (path) => {
+  const value = JSON.parse(await readFile21(path, "utf8"));
+  if (!isObject3(value))
     throw new TypeError("JSON root must be an object.");
   return value;
-}, requireString = (value, field) => {
+}, requireString2 = (value, field) => {
   if (typeof value !== "string" || value.length === 0)
     throw new TypeError(`${field} must be a non-empty string.`);
   return value;
-}, requireStringArray = (value, field) => {
+}, requireStringArray2 = (value, field) => {
   if (!Array.isArray(value) || !value.every((item) => typeof item === "string"))
     throw new TypeError(`${field} must be a string array.`);
   return value;
-}, requireBundleFile = async (root, value, field) => {
-  const portable = requireString(value, field);
-  const path = resolve41(root, portable);
-  const normalizedRoot = resolve41(root);
+}, requireBundleFile2 = async (root, value, field) => {
+  const portable = requireString2(value, field);
+  const path = resolve42(root, portable);
+  const normalizedRoot = resolve42(root);
   if (path === normalizedRoot || !path.startsWith(`${normalizedRoot}/`))
     throw new TypeError(`${field} must remain inside the mobile bundle.`);
-  if (!(await stat4(path).catch(() => {
+  if (!(await stat5(path).catch(() => {
     return;
   }))?.isFile())
     throw new TypeError(`${field} does not exist in the mobile bundle.`);
   return portable;
 }, inspectBundle = async (config, projectRoot) => {
-  const manifestPath = join52(config.bundleDirectory, "absolute-mobile-manifest.json");
-  const manifest = portablePath(projectRoot, manifestPath);
-  if (!await pathExists7(manifestPath))
+  const manifestPath = join53(config.bundleDirectory, "absolute-mobile-manifest.json");
+  const manifest = portablePath2(projectRoot, manifestPath);
+  if (!await pathExists8(manifestPath))
     return { manifest, status: "missing" };
   try {
-    const value = await readObject(manifestPath);
+    const value = await readObject2(manifestPath);
     if (value.format !== 1)
       throw new TypeError("format is not supported by this runtime.");
-    if (requireString(value.appId, "appId") !== config.appId)
+    if (requireString2(value.appId, "appId") !== config.appId)
       throw new TypeError("appId does not match the effective mobile config.");
-    if (requireString(value.productionOrigin, "productionOrigin") !== config.productionOrigin)
+    if (requireString2(value.productionOrigin, "productionOrigin") !== config.productionOrigin)
       throw new TypeError("productionOrigin does not match the effective mobile config.");
-    const appBuild = requireString(value.appBuild, "appBuild");
-    const runtime = requireString(value.runtime, "runtime");
-    const capabilities = requireStringArray(value.deviceCapabilities, "deviceCapabilities").sort();
+    const appBuild = requireString2(value.appBuild, "appBuild");
+    const runtime = requireString2(value.runtime, "runtime");
+    const capabilities = requireStringArray2(value.deviceCapabilities, "deviceCapabilities").sort();
     if (!Array.isArray(value.pages) || !Array.isArray(value.routes))
       throw new TypeError("pages and routes must be arrays.");
     const pageIds = new Set;
     const frameworks7 = new Set;
     await Promise.all(value.pages.map(async (candidate) => {
-      if (!isObject2(candidate))
+      if (!isObject3(candidate))
         throw new TypeError("pages contains an invalid entry.");
-      const pageId = requireString(candidate.pageId, "page.pageId");
+      const pageId = requireString2(candidate.pageId, "page.pageId");
       if (pageIds.has(pageId))
         throw new TypeError("page.pageId values must be unique.");
       pageIds.add(pageId);
-      const framework = requireString(candidate.framework, "page.framework");
-      if (!MOBILE_FRAMEWORKS.has(framework))
+      const framework = requireString2(candidate.framework, "page.framework");
+      if (!MOBILE_FRAMEWORKS2.has(framework))
         throw new TypeError("page.framework is unsupported.");
       frameworks7.add(framework);
-      requireString(candidate.bundleHash, "page.bundleHash");
-      requireString(candidate.contract, "page.contract");
-      requireString(candidate.propsSchemaHash, "page.propsSchemaHash");
-      await requireBundleFile(config.bundleDirectory, candidate.localBundlePath, "page.localBundlePath");
+      requireString2(candidate.bundleHash, "page.bundleHash");
+      requireString2(candidate.contract, "page.contract");
+      requireString2(candidate.propsSchemaHash, "page.propsSchemaHash");
+      await requireBundleFile2(config.bundleDirectory, candidate.localBundlePath, "page.localBundlePath");
       if (candidate.localStylePath !== undefined)
-        await requireBundleFile(config.bundleDirectory, candidate.localStylePath, "page.localStylePath");
+        await requireBundleFile2(config.bundleDirectory, candidate.localStylePath, "page.localStylePath");
     }));
     const routes = value.routes.map((candidate) => {
-      if (!isObject2(candidate))
+      if (!isObject3(candidate))
         throw new TypeError("routes contains an invalid entry.");
       const { method } = candidate;
       if (method !== "GET" && method !== "HEAD")
         throw new TypeError("route.method must be GET or HEAD.");
-      const pageId = requireString(candidate.pageId, "route.pageId");
+      const pageId = requireString2(candidate.pageId, "route.pageId");
       if (!pageIds.has(pageId))
         throw new TypeError("route.pageId references a missing page.");
       return {
         method,
         pageId,
-        pattern: requireString(candidate.pattern, "route.pattern")
+        pattern: requireString2(candidate.pattern, "route.pattern")
       };
     });
-    await Promise.all(["index.html", "absolute-mobile-bootstrap.js"].map((file) => requireBundleFile(config.bundleDirectory, file, file)));
+    await Promise.all(["index.html", "absolute-mobile-bootstrap.js"].map((file) => requireBundleFile2(config.bundleDirectory, file, file)));
     const entryPath = new URL(config.entry, "https://absolute.invalid").pathname;
     const entryResolved = resolveAbsoluteMobileRoute(routes, entryPath) !== undefined;
     if (!entryResolved)
       throw new TypeError("entry is not owned by an embedded route.");
     return {
       appBuild,
-      auth: isObject2(value.auth),
+      auth: isObject3(value.auth),
       capabilities,
       entryResolved,
       frameworks: [...frameworks7].sort(),
@@ -19102,7 +19518,7 @@ var ABSOLUTE_MOBILE_INSPECTION_FORMAT = 1, MOBILE_PACKAGE_NAMES, MOBILE_FRAMEWOR
       routeCount: value.routes.length,
       runtime,
       status: "valid",
-      sync: isObject2(value.sync)
+      sync: isObject3(value.sync)
     };
   } catch (error) {
     return {
@@ -19112,18 +19528,18 @@ var ABSOLUTE_MOBILE_INSPECTION_FORMAT = 1, MOBILE_PACKAGE_NAMES, MOBILE_FRAMEWOR
     };
   }
 }, addPackageDeclarations = (declarations, value) => {
-  if (!isObject2(value))
+  if (!isObject3(value))
     return;
   for (const [name, declared] of Object.entries(value).filter((entry) => typeof entry[1] === "string"))
     declarations.set(name, declared);
 }, packageInspections = async (projectRoot, additionalNames) => {
-  const project = await readObject(join52(projectRoot, "package.json"));
+  const project = await readObject2(join53(projectRoot, "package.json"));
   const declarations = new Map;
   for (const field of ["dependencies", "devDependencies"])
     addPackageDeclarations(declarations, project[field]);
   const names = [...new Set([...declarations.keys(), ...additionalNames])].filter((name) => MOBILE_PACKAGE_NAMES.has(name) || name.startsWith("@capacitor/") || additionalNames.includes(name)).sort();
   return Promise.all(names.map(async (name) => {
-    const installedManifest = await readObject(join52(projectRoot, "node_modules", name, "package.json")).catch(() => {
+    const installedManifest = await readObject2(join53(projectRoot, "node_modules", name, "package.json")).catch(() => {
       return;
     });
     const installed = installedManifest?.version;
@@ -19160,22 +19576,22 @@ var ABSOLUTE_MOBILE_INSPECTION_FORMAT = 1, MOBILE_PACKAGE_NAMES, MOBILE_FRAMEWOR
     config: {
       appId: config.appId,
       appName: config.appName,
-      bundleDirectory: portablePath(projectRoot, config.bundleDirectory),
+      bundleDirectory: portablePath2(projectRoot, config.bundleDirectory),
       deepLinkHosts: config.deepLinkHosts,
       deepLinkScheme: config.deepLinkScheme,
       engine: config.engine,
       entry: config.entry,
       iosVersion: config.iosVersion,
-      nativeProjectDirectory: portablePath(projectRoot, config.nativeProjectDirectory),
+      nativeProjectDirectory: portablePath2(projectRoot, config.nativeProjectDirectory),
       platforms: config.platforms,
       productionOrigin: config.productionOrigin
     },
     format: ABSOLUTE_MOBILE_INSPECTION_FORMAT,
     nativeProjects: await Promise.all(config.platforms.map(async (platform6) => {
-      const path = join52(config.nativeProjectDirectory, platform6);
+      const path = join53(config.nativeProjectDirectory, platform6);
       return {
-        initialized: await pathExists7(path),
-        path: portablePath(projectRoot, path),
+        initialized: await pathExists8(path),
+        path: portablePath2(projectRoot, path),
         platform: platform6
       };
     })),
@@ -19239,7 +19655,7 @@ var init_mobileInspect = __esm(() => {
     "@absolutejs/sync-capacitor",
     "@capacitor-community/sqlite"
   ]);
-  MOBILE_FRAMEWORKS = new Set([
+  MOBILE_FRAMEWORKS2 = new Set([
     "angular",
     "ember",
     "html",
@@ -19255,11 +19671,11 @@ var exports_mobile = {};
 __export(exports_mobile, {
   runMobile: () => runMobile
 });
-import { access as access12, mkdir as mkdir14, readFile as readFile21, writeFile as writeFile16 } from "fs/promises";
-import { join as join53, resolve as resolve42 } from "path";
+import { access as access13, mkdir as mkdir14, readFile as readFile22, writeFile as writeFile16 } from "fs/promises";
+import { join as join54, resolve as resolve43 } from "path";
 import { createInterface } from "readline/promises";
-var NOT_FOUND3 = -1, isRecord15 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), CAPACITOR_PACKAGES, CAPACITOR_PACKAGE_SPECS, CAPACITOR_SYNC_PACKAGE_SPECS, packageNameFromSpec = (spec) => spec.slice(0, spec.lastIndexOf("@")), directProjectPackages = async (projectRoot) => {
-  const manifest = JSON.parse(await readFile21(join53(projectRoot, "package.json"), "utf8"));
+var NOT_FOUND4 = -1, isRecord15 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), CAPACITOR_PACKAGES, CAPACITOR_PACKAGE_SPECS, CAPACITOR_SYNC_PACKAGE_SPECS, packageNameFromSpec = (spec) => spec.slice(0, spec.lastIndexOf("@")), directProjectPackages = async (projectRoot) => {
+  const manifest = JSON.parse(await readFile22(join54(projectRoot, "package.json"), "utf8"));
   if (!isRecord15(manifest))
     throw new TypeError("Application package.json must contain an object.");
   const names = new Set;
@@ -19272,7 +19688,7 @@ var NOT_FOUND3 = -1, isRecord15 = (value) => typeof value === "object" && value
   return names;
 }, resolvedPackageVersion = async (projectRoot, packageName) => {
   try {
-    const manifest = JSON.parse(await readFile21(join53(projectRoot, "node_modules", packageName, "package.json"), "utf8"));
+    const manifest = JSON.parse(await readFile22(join54(projectRoot, "node_modules", packageName, "package.json"), "utf8"));
     return isRecord15(manifest) && typeof manifest.version === "string" ? manifest.version : undefined;
   } catch {
     return;
@@ -19303,7 +19719,7 @@ var NOT_FOUND3 = -1, isRecord15 = (value) => typeof value === "object" && value
   await installApprovedPackages(projectRoot, args, `AbsoluteJS detected native device capabilities (${capabilityPlan.capabilities.join(", ")}). Install only their required Capacitor plugins now?`, capabilityPackages);
 }, valueAfter = (args, flag) => {
   const index = args.indexOf(flag);
-  return index === NOT_FOUND3 ? undefined : args[index + 1];
+  return index === NOT_FOUND4 ? undefined : args[index + 1];
 }, valuesAfter = (args, flag) => args.flatMap((value, index) => {
   const next = args[index + 1];
   return value === flag && next !== undefined ? [next] : [];
@@ -19313,9 +19729,9 @@ var NOT_FOUND3 = -1, isRecord15 = (value) => typeof value === "object" && value
   }
   return value;
 }, capacitorExecutable = async (projectRoot) => {
-  const executable = join53(projectRoot, "node_modules", ".bin", "cap");
+  const executable = join54(projectRoot, "node_modules", ".bin", "cap");
   try {
-    await access12(executable);
+    await access13(executable);
     return executable;
   } catch {
     throw new TypeError(`Capacitor is not installed in this app. Run: bun add ${CAPACITOR_PACKAGES.join(" ")}`);
@@ -19412,7 +19828,7 @@ var NOT_FOUND3 = -1, isRecord15 = (value) => typeof value === "object" && value
   await applyAbsoluteNativeBackgroundSync(projectRoot, mobile, platforms);
 }, associations = async (args) => {
   const { mobile, projectRoot } = await loadMobile(valueAfter(args, "--config"));
-  const outputDirectory = resolve42(projectRoot, valueAfter(args, "--outdir") ?? ".absolutejs/mobile/associations");
+  const outputDirectory = resolve43(projectRoot, valueAfter(args, "--outdir") ?? ".absolutejs/mobile/associations");
   if (args.includes("--verify")) {
     const result2 = await verifyAbsoluteMobileAssociationFiles(mobile);
     console.log(`Verified ${result2.results.length} hosted association files`);
@@ -19457,7 +19873,7 @@ var NOT_FOUND3 = -1, isRecord15 = (value) => typeof value === "object" && value
   const { mobile, projectRoot } = await loadMobile(valueAfter(args, "--config"));
   const result = await inspectAbsoluteMobileRelease(mobile, projectRoot);
   if (args.includes("--json")) {
-    console.log(JSON.stringify(result, null, 2));
+    console.log(JSON.stringify(createAbsoluteMobileComplianceReport(mobile, result), null, 2));
   } else {
     result.checks.forEach((check2) => {
       console.log(`${doctorMark(check2.status)} ${check2.detail}${check2.path ? ` (${check2.path})` : ""}`);
@@ -19465,8 +19881,8 @@ var NOT_FOUND3 = -1, isRecord15 = (value) => typeof value === "object" && value
         console.log(`  ${check2.remediation}`);
     });
     console.log(result.ready ? `
-Mobile release transport checks passed.` : `
-Mobile release transport checks failed.`);
+Mobile release security and compliance checks passed.` : `
+Mobile release security and compliance checks failed.`);
   }
   if (!result.ready) {
     throw new TypeError("Mobile release validation failed. Resolve every failed check before signing or publishing the app.");
@@ -19645,7 +20061,7 @@ Mobile release transport checks failed.`);
     const durationMs = Math.round(performance.now() - startedAt);
     console.log(`Built ${release.metadata.signed ? "signed" : "unsigned"} Android App Bundle in ${getDurationString(durationMs)}.`);
     console.log(`Artifact: ${release.artifactPath}`);
-    console.log(`Metadata: ${join53(release.releaseRoot, "release.json")}`);
+    console.log(`Metadata: ${join54(release.releaseRoot, "release.json")}`);
     return release;
   } finally {
     sendTelemetryEvent("mobile:android-release-build", {
@@ -19748,7 +20164,7 @@ Mobile release transport checks failed.`);
     const durationMs = Math.round(performance.now() - startedAt);
     console.log(`Built ${release.metadata.signed ? "signed" : "unsigned"} iOS IPA ${release.metadata.marketingVersion}${release.metadata.buildNumber ? ` (${release.metadata.buildNumber})` : ""} in ${getDurationString(durationMs)}.`);
     console.log(`Artifact: ${release.artifactPath}`);
-    console.log(`Metadata: ${join53(release.releaseRoot, "release.json")}`);
+    console.log(`Metadata: ${join54(release.releaseRoot, "release.json")}`);
     return release;
   } finally {
     sendTelemetryEvent("mobile:ios-release-build", {
@@ -19855,7 +20271,7 @@ Mobile release transport checks failed.`);
     checks.push({
       id: "sync.storage-schema",
       label: `Offline schema ${schema.components.map((component2) => `${component2.id}@${component2.version}`).join(", ")}`,
-      path: join53(projectRoot, "package.json"),
+      path: join54(projectRoot, "package.json"),
       platform: "host",
       status: "pass"
     });
@@ -19863,7 +20279,7 @@ Mobile release transport checks failed.`);
     checks.push({
       id: "sync.storage-schema",
       label: "Offline schema metadata is invalid",
-      path: join53(projectRoot, "package.json"),
+      path: join54(projectRoot, "package.json"),
       platform: "host",
       remediation: error instanceof Error ? error.message : String(error),
       status: "fail"
@@ -19948,7 +20364,7 @@ Emulator setup verification:`);
     }
     return { https: args.includes("--https"), port };
   }
-  const instances = listLiveInstances().filter((instance2) => resolve42(instance2.cwd) === resolve42(projectRoot) && instance2.source === "dev" && instance2.port !== null);
+  const instances = listLiveInstances().filter((instance2) => resolve43(instance2.cwd) === resolve43(projectRoot) && instance2.source === "dev" && instance2.port !== null);
   if (instances.length !== 1) {
     throw new TypeError(instances.length === 0 ? "No running AbsoluteJS dev server was found for this project. Start `bun dev`, wait for Android to report ready, then run `absolute mobile test android`." : "Multiple dev servers are running for this project. Select one with mobile test android --port <port>.");
   }
@@ -19991,8 +20407,8 @@ Emulator setup verification:`);
   }
   return selected;
 }, safeArtifactRoot = (projectRoot, value) => {
-  const root = resolve42(projectRoot, value ?? ".absolutejs/mobile/test-artifacts");
-  if (root !== projectRoot && !root.startsWith(`${resolve42(projectRoot)}/`)) {
+  const root = resolve43(projectRoot, value ?? ".absolutejs/mobile/test-artifacts");
+  if (root !== projectRoot && !root.startsWith(`${resolve43(projectRoot)}/`)) {
     throw new TypeError("mobile test --artifacts must remain inside the project.");
   }
   return root;
@@ -20017,10 +20433,10 @@ Emulator setup verification:`);
   });
 }, writeAndroidFailureArtifacts = async (options) => {
   await mkdir14(options.artifactRoot, { recursive: true });
-  const screenshot = options.session ? await options.session.screenshot(join53(options.artifactRoot, "android-failure.png")).catch(() => {
+  const screenshot = options.session ? await options.session.screenshot(join54(options.artifactRoot, "android-failure.png")).catch(() => {
     return;
   }) : undefined;
-  const diagnosticPath = join53(options.artifactRoot, "android-failure.json");
+  const diagnosticPath = join54(options.artifactRoot, "android-failure.json");
   await writeFile16(diagnosticPath, `${JSON.stringify({
     diagnostics: options.session?.diagnostics ?? [],
     error: options.error instanceof Error ? options.error.message : String(options.error),
@@ -20084,7 +20500,7 @@ Emulator setup verification:`);
       console.log(JSON.stringify(report, null, 2));
     else
       printAndroidTestReport(report);
-    const screenshot = reportRoot ? await session.screenshot(join53(artifactRoot, "android-emulator.png")) : undefined;
+    const screenshot = reportRoot ? await session.screenshot(join54(artifactRoot, "android-emulator.png")) : undefined;
     await writeRequestedAndroidReport({
       adb,
       args,
@@ -20152,14 +20568,14 @@ Emulator setup verification:`);
     const port = Number(explicit);
     if (!Number.isInteger(port) || port < 1 || port > 65535)
       throw new TypeError("mobile test --port must be a valid TCP port.");
-    const instance2 = listLiveInstances().find((candidate) => resolve42(candidate.cwd) === resolve42(projectRoot) && candidate.source === "dev" && candidate.port === port);
+    const instance2 = listLiveInstances().find((candidate) => resolve43(candidate.cwd) === resolve43(projectRoot) && candidate.source === "dev" && candidate.port === port);
     return {
       https: instance2?.https ?? args.includes("--https"),
       instance: instance2,
       port
     };
   }
-  const instances = listLiveInstances().filter((instance2) => resolve42(instance2.cwd) === resolve42(projectRoot) && instance2.source === "dev" && instance2.port !== null);
+  const instances = listLiveInstances().filter((instance2) => resolve43(instance2.cwd) === resolve43(projectRoot) && instance2.source === "dev" && instance2.port !== null);
   if (instances.length !== 1)
     throw new TypeError(instances.length === 0 ? "No running AbsoluteJS dev server was found for this project. Start `bun dev`, wait for iOS to report ready, then run `absolute mobile test ios`." : "Multiple dev servers are running for this project. Select one with mobile test ios --port <port>.");
   const [instance] = instances;
@@ -20214,7 +20630,7 @@ Emulator setup verification:`);
   if (!instance)
     return;
   const index = instance.command.indexOf("--ios-device");
-  return index === NOT_FOUND3 ? undefined : instance.command[index + 1];
+  return index === NOT_FOUND4 ? undefined : instance.command[index + 1];
 }, physicalIosCapture = async (options) => {
   const remoteName = valueAfter(options.args, "--remote");
   if (remoteName && options.instance.iosRemoteMac && remoteName !== options.instance.iosRemoteMac)
@@ -20274,7 +20690,7 @@ Emulator setup verification:`);
   return result;
 }, writeIosFailureArtifacts = async (options) => {
   await mkdir14(options.artifactRoot, { recursive: true });
-  const screenshot = join53(options.artifactRoot, "ios-failure.png");
+  const screenshot = join54(options.artifactRoot, "ios-failure.png");
   const screenshotResult = captureCommand4([
     options.xcrun,
     "simctl",
@@ -20283,7 +20699,7 @@ Emulator setup verification:`);
     "screenshot",
     screenshot
   ]);
-  const diagnosticPath = join53(options.artifactRoot, "ios-failure.json");
+  const diagnosticPath = join54(options.artifactRoot, "ios-failure.json");
   await writeFile16(diagnosticPath, `${JSON.stringify({
     appId: options.appId,
     error: options.error instanceof Error ? options.error.message : String(options.error),
@@ -20300,7 +20716,7 @@ Emulator setup verification:`);
   };
 }, nativeReportRoot = (args, projectRoot, platform6) => {
   const index = args.indexOf("--report");
-  if (index === NOT_FOUND3)
+  if (index === NOT_FOUND4)
     return;
   const candidate = args[index + 1];
   const explicit = candidate?.startsWith("--") ? undefined : candidate;
@@ -20309,8 +20725,8 @@ Emulator setup verification:`);
 }, absolutejsVersionForReport = async () => {
   let absolutejsVersion = process.env.ABSOLUTE_VERSION ?? "unknown";
   const versions = await Promise.all([
-    resolve42(import.meta.dir, "..", "..", "package.json"),
-    resolve42(import.meta.dir, "..", "..", "..", "package.json")
+    resolve43(import.meta.dir, "..", "..", "package.json"),
+    resolve43(import.meta.dir, "..", "..", "..", "package.json")
   ].map((candidate) => readPackageVersionForIosReport(candidate).catch(() => "unknown")));
   for (const version2 of versions) {
     if (version2 === "unknown")
@@ -20529,7 +20945,7 @@ Emulator setup verification:`);
     ], "iOS app launch");
     await waitForIosHmrClient({ https, port, timeoutMs });
     await mkdir14(artifactRoot, { recursive: true });
-    const screenshot = join53(artifactRoot, "ios-simulator.png");
+    const screenshot = join54(artifactRoot, "ios-simulator.png");
     requireCapturedCommand([xcrun, "simctl", "io", simulator.udid, "screenshot", screenshot], "iOS simulator screenshot");
     const hmrApply = await waitForRequestedIosHmr(args, instance, timeoutMs);
     const report = {
@@ -20740,10 +21156,10 @@ var exports_typecheck = {};
 __export(exports_typecheck, {
   typecheck: () => typecheck
 });
-import { resolve as resolve43, join as join54 } from "path";
+import { resolve as resolve44, join as join55 } from "path";
 import { existsSync as existsSync42, readFileSync as readFileSync40 } from "fs";
 import { mkdir as mkdir15, writeFile as writeFile17 } from "fs/promises";
-var isCommandService3 = (service) => service.kind === "command" || Array.isArray(service.command), resolveConfigPath = (configPath2) => resolve43(configPath2 ?? process.env.ABSOLUTE_CONFIG ?? "absolute.config.ts"), getTypecheckTargets = async (configPath2) => {
+var isCommandService3 = (service) => service.kind === "command" || Array.isArray(service.command), resolveConfigPath = (configPath2) => resolve44(configPath2 ?? process.env.ABSOLUTE_CONFIG ?? "absolute.config.ts"), getTypecheckTargets = async (configPath2) => {
   if (!existsSync42(resolveConfigPath(configPath2))) {
     const defaultService = {};
     return [defaultService];
@@ -20765,7 +21181,7 @@ var isCommandService3 = (service) => service.kind === "command" || Array.isArray
   const exitCode = await proc.exited;
   return { exitCode, name, output: (stdout + stderr).trim() };
 }, shellEscape = (value) => `'${value.replaceAll("'", "'\\''")}'`, runShell = async (name, command) => run(name, ["/bin/bash", "-lc", command]), findBin = (name) => {
-  const local = resolve43("node_modules", ".bin", name);
+  const local = resolve44("node_modules", ".bin", name);
   return existsSync42(local) ? local : null;
 }, ANSI_COLOR_REGEX, ANSI_PURPLE_REGEX, ANSI_CYAN_REGEX, ANSI_TOKEN_END_REGEX, stripAnsi4 = (str) => str.replace(ANSI_COLOR_REGEX, ""), formatSvelteOutput = (output) => {
   const cwd = `${process.cwd()}/`;
@@ -20813,15 +21229,15 @@ Found ${errorCount} error${suffix}.`;
   return formatted;
 }, ABSOLUTE_INTERNAL_EXCLUDES, resolveAbsoluteTypeFile = (fileName) => {
   const candidates = [
-    resolve43("node_modules/@absolutejs/absolute/dist/types", fileName),
-    resolve43(import.meta.dir, "../types", fileName),
-    resolve43(import.meta.dir, "../../types", fileName),
-    resolve43(import.meta.dir, "../../../types", fileName)
+    resolve44("node_modules/@absolutejs/absolute/dist/types", fileName),
+    resolve44(import.meta.dir, "../types", fileName),
+    resolve44(import.meta.dir, "../../types", fileName),
+    resolve44(import.meta.dir, "../../../types", fileName)
   ];
   return candidates.find((candidate) => existsSync42(candidate)) ?? candidates[0];
 }, ABSOLUTE_TYPECHECK_FILES, readProjectTsconfig = () => {
   try {
-    return JSON.parse(readFileSync40(resolve43("tsconfig.json"), "utf-8"));
+    return JSON.parse(readFileSync40(resolve44("tsconfig.json"), "utf-8"));
   } catch {
     return {};
   }
@@ -20849,27 +21265,27 @@ Found ${errorCount} error${suffix}.`;
     console.error("\x1B[31m\u2717\x1B[0m vue-tsc is required for Vue type checking. Install it: bun add -d vue-tsc");
     process.exit(1);
   }
-  const vueTsconfigPath = join54(cacheDir, "tsconfig.vue-check.json");
+  const vueTsconfigPath = join55(cacheDir, "tsconfig.vue-check.json");
   await writeFile17(vueTsconfigPath, JSON.stringify({
     compilerOptions: {
       rootDir: ".."
     },
     exclude: getProjectTypecheckExcludes(),
-    extends: resolve43("tsconfig.json"),
+    extends: resolve44("tsconfig.json"),
     include: getProjectTypecheckIncludes()
   }, null, "\t"));
   const base = [
     vueTscBin,
     "--noEmit",
     "--project",
-    resolve43(vueTsconfigPath),
+    resolve44(vueTsconfigPath),
     "--pretty"
   ];
   const cached = await run("vue-tsc", [
     ...base,
     "--incremental",
     "--tsBuildInfoFile",
-    join54(cacheDir, "vue-tsc.tsbuildinfo")
+    join55(cacheDir, "vue-tsc.tsbuildinfo")
   ]);
   if (cached.exitCode === 0 || cached.output.length > 0)
     return cached;
@@ -20880,7 +21296,7 @@ Found ${errorCount} error${suffix}.`;
     console.error("\x1B[31m\u2717\x1B[0m @angular/compiler-cli is required for Angular type checking. Install it: bun add -d @angular/compiler-cli");
     process.exit(1);
   }
-  const angularTsconfigPath = join54(cacheDir, "tsconfig.angular-check.json");
+  const angularTsconfigPath = join55(cacheDir, "tsconfig.angular-check.json");
   await writeFile17(angularTsconfigPath, JSON.stringify({
     angularCompilerOptions: {
       strictTemplates: true
@@ -20890,32 +21306,32 @@ Found ${errorCount} error${suffix}.`;
       rootDir: ".."
     },
     exclude: ABSOLUTE_INTERNAL_EXCLUDES.map(toGeneratedConfigPath),
-    extends: resolve43("tsconfig.json"),
+    extends: resolve44("tsconfig.json"),
     include: [`../${angularDir}/**/*`]
   }, null, "\t"));
-  return runShell("ngc", `${shellEscape(ngcBin)} -p ${shellEscape(resolve43(angularTsconfigPath))}`);
+  return runShell("ngc", `${shellEscape(ngcBin)} -p ${shellEscape(resolve44(angularTsconfigPath))}`);
 }, buildTscCheck = (cacheDir) => {
   const tscBin = findBin("tsc");
   if (!tscBin) {
     console.error("\x1B[31m\u2717\x1B[0m typescript is required for type checking. Install it: bun add -d typescript");
     process.exit(1);
   }
-  const tscConfigPath = join54(cacheDir, "tsconfig.typecheck.json");
+  const tscConfigPath = join55(cacheDir, "tsconfig.typecheck.json");
   return writeFile17(tscConfigPath, JSON.stringify({
     compilerOptions: {
       rootDir: ".."
     },
     exclude: getProjectTypecheckExcludes(),
-    extends: resolve43("tsconfig.json"),
+    extends: resolve44("tsconfig.json"),
     include: getProjectTypecheckIncludes()
   }, null, "\t")).then(() => run("tsc", [
     tscBin,
     "--noEmit",
     "--project",
-    resolve43(tscConfigPath),
+    resolve44(tscConfigPath),
     "--incremental",
     "--tsBuildInfoFile",
-    join54(cacheDir, "tsc.tsbuildinfo"),
+    join55(cacheDir, "tsc.tsbuildinfo"),
     "--pretty"
   ]));
 }, buildSvelteCheck = async (cacheDir, svelteDir) => {
@@ -20924,16 +21340,16 @@ Found ${errorCount} error${suffix}.`;
     console.error("\x1B[31m\u2717\x1B[0m svelte-check is required for Svelte type checking. Install it: bun add -d svelte-check");
     process.exit(1);
   }
-  const svelteTsconfigPath = join54(cacheDir, "tsconfig.svelte-check.json");
+  const svelteTsconfigPath = join55(cacheDir, "tsconfig.svelte-check.json");
   await writeFile17(svelteTsconfigPath, JSON.stringify({
-    extends: resolve43("tsconfig.json"),
+    extends: resolve44("tsconfig.json"),
     files: ABSOLUTE_TYPECHECK_FILES,
     include: [`../${svelteDir}/**/*`]
   }, null, "\t"));
   return run("svelte-check", [
     svelteBin,
     "--tsconfig",
-    resolve43(svelteTsconfigPath),
+    resolve44(svelteTsconfigPath),
     "--threshold",
     "error",
     "--compiler-warnings",
@@ -21127,11 +21543,11 @@ var DEFAULT_RELAY_PORT = 8787, DEFAULT_REQUEST_TIMEOUT_MS = 30000, headersToObje
         url: url.pathname + url.search,
         ...bodyBytes && bodyBytes.length > 0 ? { bodyBase64: Buffer.from(bodyBytes).toString("base64") } : {}
       };
-      const responsePromise = new Promise((resolve44) => {
-        pending.set(id, resolve44);
+      const responsePromise = new Promise((resolve45) => {
+        pending.set(id, resolve45);
       });
       client.send(encodeTunnelMessage(message));
-      const timeout = new Promise((resolve44) => setTimeout(() => resolve44({ id, message: "timeout", type: "error" }), requestTimeoutMs));
+      const timeout = new Promise((resolve45) => setTimeout(() => resolve45({ id, message: "timeout", type: "error" }), requestTimeoutMs));
       const result = await Promise.race([responsePromise, timeout]);
       pending.delete(id);
       if (result.type === "error") {