npm - @absolutejs/absolute - Versions diffs - 0.20.0-beta.37 → 0.20.0-beta.39 - Mend

@absolutejs/absolute 0.20.0-beta.37 → 0.20.0-beta.39

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (15) hide show

package/README.md +20 -0
package/dist/angular/components/core/streamingSlotRegistrar.js +1 -1
package/dist/angular/components/core/streamingSlotRegistry.js +2 -2
package/dist/cli/index.js +1193 -282
package/dist/mobile/index.js +594 -49
package/dist/mobile/index.js.map +8 -7
package/dist/mobile/remoteMacAgentEntry.js +6 -6
package/dist/src/mobile/androidRelease.d.ts +6 -0
package/dist/src/mobile/ciWorkflow.d.ts +26 -0
package/dist/src/mobile/index.d.ts +1 -0
package/dist/src/mobile/iosRelease.d.ts +1 -0
package/dist/src/mobile/mobileBundleInspection.d.ts +55 -0
package/dist/src/mobile/mobileInspect.d.ts +42 -16
package/dist/src/mobile/releaseDoctor.d.ts +23 -1
package/package.json +1 -1

package/dist/cli/index.js CHANGED Viewed

@@ -2589,7 +2589,14 @@ import {
   writeFile as writeFile3
 } from "fs/promises";
 import { dirname as dirname4, isAbsolute as isAbsolute2, join as join9, relative as relative3, resolve as resolve6, sep as sep2 } from "path";
-var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), requireManifest = (value) => {
+var developmentTeamArgument = (value) => {
+  if (value === undefined)
+    return;
+  const team = value.trim().toUpperCase();
+  if (!/^[A-Z0-9]{10}$/u.test(team))
+    throw new TypeError("iOS development team must contain ten letters or digits.");
+  return `DEVELOPMENT_TEAM=${team}`;
+}, isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), requireManifest = (value) => {
   if (!isRecord2(value) || typeof value.appBuild !== "string" || typeof value.appId !== "string" || typeof value.runtime !== "string") {
     throw new TypeError("Invalid embedded AbsoluteJS mobile manifest.");
   }
@@ -2762,8 +2769,10 @@ var isRecord2 = (value) => typeof value === "object" && value !== null && !Array
   await writeFile3(exportPlist, exportOptions());
   const run = options.run ?? defaultRun2;
   try {
+    const developmentTeam = developmentTeamArgument(options.developmentTeam);
     const versionArguments = [
       `MARKETING_VERSION=${marketingVersion}`,
+      ...developmentTeam ? [developmentTeam] : [],
       ...buildNumber === undefined ? [] : [`CURRENT_PROJECT_VERSION=${buildNumber}`]
     ];
     const archiveExit = await run([
@@ -6411,12 +6420,25 @@ var MANIFEST_FILE = "absolute-mobile-manifest.json", BOOTSTRAP_FILE = "absolute-
   if (candidate)
     return candidate;
   throw new TypeError("AbsoluteJS mobile push shell module is missing.");
-}, escapeHtml = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;"), indexHtml = (appName) => `<!doctype html>
+}, escapeHtml = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;"), contentSecurityPolicy = (productionOrigin) => {
+  const backend = new URL(productionOrigin);
+  const socketOrigin = `${backend.protocol === "https:" ? "wss:" : "ws:"}//${backend.host}`;
+  return [
+    "default-src 'self' data: blob: https:",
+    "base-uri 'none'",
+    "object-src 'none'",
+    "script-src 'self'",
+    "style-src 'self' 'unsafe-inline'",
+    `connect-src 'self' ${backend.origin} ${socketOrigin}`,
+    "form-action 'none'"
+  ].join("; ");
+}, indexHtml = (appName, productionOrigin) => `<!doctype html>
 <html>
 	<head>
 		<meta charset="utf-8">
 		<meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover">
 		<meta name="color-scheme" content="light dark">
+		<meta http-equiv="Content-Security-Policy" content="${escapeHtml(contentSecurityPolicy(productionOrigin))}">
 		<title>${escapeHtml(appName)}</title>
 	</head>
 	<body>
@@ -6635,7 +6657,7 @@ void startAbsoluteMobileShell(${push ? `{ createAuth: (config, options) => creat
     await Promise.all([
       writeFile7(join17(staging, MANIFEST_FILE), `${JSON.stringify(manifest, null, "\t")}
 `),
-      writeFile7(join17(staging, INDEX_FILE), indexHtml(options.config.appName)),
+      writeFile7(join17(staging, INDEX_FILE), indexHtml(options.config.appName, options.config.productionOrigin)),
       buildShellBootstrap(staging, options.auth !== undefined, options.auth !== undefined && options.sync === true, `absolutejs.${options.auth?.clientId ?? options.config.appId}.`, options.deviceCapabilities, options.projectRoot)
     ]);
     await installBundle(staging, destination);
@@ -18048,28 +18070,173 @@ var DEFAULT_ROUTE_TIMEOUT_MS = 30000, DEFAULT_HMR_TIMEOUT_MS = 30000, routeExpre
   return apply;
 };
-// src/mobile/releaseDoctor.ts
-import { access as access8, readFile as readFile16, readdir as readdir4 } from "fs/promises";
-import { dirname as dirname29, extname as extname8, join as join49, relative as relative24 } from "path";
-var HMR_ASSET_PATTERN, RELEASE_ASSET_EXTENSIONS, pathExists5 = async (path) => {
+// src/mobile/mobileBundleInspection.ts
+import { createHash as createHash12 } from "crypto";
+import { access as access8, readFile as readFile16, stat as stat2 } from "fs/promises";
+import { join as join49, relative as relative24, resolve as resolve39 } from "path";
+var MOBILE_FRAMEWORKS, SHA256_PATTERN, isObject2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), portablePath = (projectRoot, path) => {
+  const value = relative24(resolve39(projectRoot), resolve39(path)).replaceAll("\\", "/");
+  return value || ".";
+}, pathExists5 = async (path) => {
   try {
     await access8(path);
     return true;
   } catch {
     return false;
   }
+}, readObject = async (path) => {
+  const value = JSON.parse(await readFile16(path, "utf8"));
+  if (!isObject2(value))
+    throw new TypeError("JSON root must be an object.");
+  return value;
+}, requireString = (value, field) => {
+  if (typeof value !== "string" || value.length === 0)
+    throw new TypeError(`${field} must be a non-empty string.`);
+  return value;
+}, requireStringArray = (value, field) => {
+  if (!Array.isArray(value) || !value.every((item) => typeof item === "string"))
+    throw new TypeError(`${field} must be a string array.`);
+  return value;
+}, requireBundleFile = async (root, value, field, expectedHash) => {
+  const portable = requireString(value, field);
+  const path = resolve39(root, portable);
+  const normalizedRoot = resolve39(root);
+  if (path === normalizedRoot || !path.startsWith(`${normalizedRoot}/`))
+    throw new TypeError(`${field} must remain inside the mobile bundle.`);
+  if (!(await stat2(path).catch(() => {
+    return;
+  }))?.isFile())
+    throw new TypeError(`${field} does not exist in the mobile bundle.`);
+  if (expectedHash !== undefined) {
+    if (!SHA256_PATTERN.test(expectedHash))
+      throw new TypeError(`${field} has an invalid SHA-256 digest.`);
+    const actual = createHash12("sha256").update(await readFile16(path)).digest("hex");
+    if (actual !== expectedHash)
+      throw new TypeError(`${field} failed its SHA-256 integrity check.`);
+  }
+  return portable;
+}, inspectAbsoluteMobileBundle = async (config, projectRoot) => {
+  const manifestPath = join49(config.bundleDirectory, "absolute-mobile-manifest.json");
+  const manifest = portablePath(projectRoot, manifestPath);
+  if (!await pathExists5(manifestPath))
+    return { manifest, status: "missing" };
+  try {
+    const value = await readObject(manifestPath);
+    if (value.format !== ABSOLUTE_MOBILE_CLIENT_MANIFEST_FORMAT)
+      throw new TypeError("format is not supported by this runtime.");
+    if (requireString(value.appId, "appId") !== config.appId)
+      throw new TypeError("appId does not match the effective mobile config.");
+    if (requireString(value.productionOrigin, "productionOrigin") !== config.productionOrigin)
+      throw new TypeError("productionOrigin does not match the effective mobile config.");
+    const appBuild = requireString(value.appBuild, "appBuild");
+    const runtime = requireString(value.runtime, "runtime");
+    if (runtime !== String(ABSOLUTE_MOBILE_PAGE_PROTOCOL_VERSION))
+      throw new TypeError("runtime is not supported by this AbsoluteJS build.");
+    const capabilities = requireStringArray(value.deviceCapabilities, "deviceCapabilities").sort();
+    if (!Array.isArray(value.pages) || !Array.isArray(value.routes))
+      throw new TypeError("pages and routes must be arrays.");
+    const pageIds = new Set;
+    const frameworks7 = new Set;
+    await Promise.all(value.pages.map(async (candidate) => {
+      if (!isObject2(candidate))
+        throw new TypeError("pages contains an invalid entry.");
+      const pageId = requireString(candidate.pageId, "page.pageId");
+      if (pageIds.has(pageId))
+        throw new TypeError("page.pageId values must be unique.");
+      pageIds.add(pageId);
+      const framework = requireString(candidate.framework, "page.framework");
+      if (!MOBILE_FRAMEWORKS.has(framework))
+        throw new TypeError("page.framework is unsupported.");
+      frameworks7.add(framework);
+      const bundleHash = requireString(candidate.bundleHash, "page.bundleHash");
+      requireString(candidate.contract, "page.contract");
+      requireString(candidate.propsSchemaHash, "page.propsSchemaHash");
+      await requireBundleFile(config.bundleDirectory, candidate.localBundlePath, "page.localBundlePath", bundleHash);
+      if (candidate.localStylePath !== undefined) {
+        const styleHash = requireString(candidate.styleBundleHash, "page.styleBundleHash");
+        await requireBundleFile(config.bundleDirectory, candidate.localStylePath, "page.localStylePath", styleHash);
+      } else if (candidate.styleBundleHash !== undefined)
+        throw new TypeError("page.styleBundleHash requires page.localStylePath.");
+    }));
+    const routes = value.routes.map((candidate) => {
+      if (!isObject2(candidate))
+        throw new TypeError("routes contains an invalid entry.");
+      const { method } = candidate;
+      if (method !== "GET" && method !== "HEAD")
+        throw new TypeError("route.method must be GET or HEAD.");
+      const pageId = requireString(candidate.pageId, "route.pageId");
+      if (!pageIds.has(pageId))
+        throw new TypeError("route.pageId references a missing page.");
+      return {
+        method,
+        pageId,
+        pattern: requireString(candidate.pattern, "route.pattern")
+      };
+    });
+    await Promise.all(["index.html", "absolute-mobile-bootstrap.js"].map((file) => requireBundleFile(config.bundleDirectory, file, file)));
+    const entryPath = new URL(config.entry, "https://absolute.invalid").pathname;
+    const entryResolved = resolveAbsoluteMobileRoute(routes, entryPath) !== undefined;
+    if (!entryResolved)
+      throw new TypeError("entry is not owned by an embedded route.");
+    return {
+      appBuild,
+      auth: isObject2(value.auth),
+      capabilities,
+      entryResolved,
+      frameworks: [...frameworks7].sort(),
+      manifest,
+      pageCount: value.pages.length,
+      routeCount: value.routes.length,
+      runtime,
+      status: "valid",
+      sync: isObject2(value.sync)
+    };
+  } catch (error) {
+    return {
+      issue: error instanceof Error ? error.message : "The embedded mobile manifest is invalid.",
+      manifest,
+      status: "invalid"
+    };
+  }
+};
+var init_mobileBundleInspection = __esm(() => {
+  init_pageProtocol();
+  init_routeMatcher();
+  init_transport();
+  MOBILE_FRAMEWORKS = new Set([
+    "angular",
+    "ember",
+    "html",
+    "htmx",
+    "react",
+    "svelte",
+    "vue"
+  ]);
+  SHA256_PATTERN = /^[a-f0-9]{64}$/u;
+});
+// src/mobile/releaseDoctor.ts
+import { access as access9, readFile as readFile17, readdir as readdir4 } from "fs/promises";
+import { dirname as dirname29, extname as extname8, join as join50, relative as relative25 } from "path";
+var ABSOLUTE_MOBILE_COMPLIANCE_REPORT_FORMAT = 1, HMR_ASSET_PATTERN, RELEASE_ASSET_EXTENSIONS, EXACT_VERSION_PATTERN, NOT_FOUND3 = -1, LOCK_FILES, MANUAL_REVIEW, pathExists6 = async (path) => {
+  try {
+    await access9(path);
+    return true;
+  } catch {
+    return false;
+  }
 }, inspectReleaseAsset = async (path, isDirectory, isFile2) => {
   if (isDirectory)
     return findHmrAsset(path);
   if (!isFile2 || !RELEASE_ASSET_EXTENSIONS.has(extname8(path)))
     return;
-  const source = await readFile16(path, "utf8");
+  const source = await readFile17(path, "utf8");
   return HMR_ASSET_PATTERN.test(source) ? path : undefined;
 }, findHmrAsset = async (root) => {
-  if (!await pathExists5(root))
+  if (!await pathExists6(root))
     return;
   const entries = await readdir4(root, { withFileTypes: true });
-  const matches = await Promise.all(entries.map((entry) => inspectReleaseAsset(join49(root, entry.name), entry.isDirectory(), entry.isFile())));
+  const matches = await Promise.all(entries.map((entry) => inspectReleaseAsset(join50(root, entry.name), entry.isDirectory(), entry.isFile())));
   return matches.find((match) => match !== undefined);
 }, pass = (id, detail, path) => ({ detail, id, path, status: "pass" }), fail5 = (id, detail, path, remediation) => ({
   detail,
@@ -18077,7 +18244,70 @@ var HMR_ASSET_PATTERN, RELEASE_ASSET_EXTENSIONS, pathExists5 = async (path) => {
   path,
   remediation,
   status: "fail"
-}), journalReleaseCheck = async (journalPath, platform6) => await pathExists5(journalPath) ? fail5(`${platform6}.dev-journal`, "A live-reload recovery journal is still active.", journalPath, "Close the development session or run mobile doctor again after stale-session repair.") : pass(`${platform6}.dev-journal`, "No live-reload recovery journal is active.", journalPath), parsedJson = (source) => {
+}), warn = (id, detail, path, remediation) => ({
+  detail,
+  id,
+  path,
+  remediation,
+  status: "warn"
+}), readJsonObject = async (path) => {
+  const value = JSON.parse(await readFile17(path, "utf8"));
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    throw new TypeError("JSON root must be an object.");
+  return Object.fromEntries(Object.entries(value));
+}, packageDeclarations = (manifest) => {
+  const declarations = new Map;
+  for (const field of ["dependencies", "devDependencies"]) {
+    const value = manifest[field];
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+      continue;
+    for (const [name, version2] of Object.entries(value))
+      if (typeof version2 === "string")
+        declarations.set(name, version2);
+  }
+  return declarations;
+}, versionCore = (version2) => version2.split("-")[0]?.split(".").slice(0, 2).join("."), capacitorVersionCheck = async (config, projectRoot) => {
+  const manifestPath = join50(projectRoot, "package.json");
+  try {
+    const manifest = await readJsonObject(manifestPath);
+    const declarations = packageDeclarations(manifest);
+    const names = [
+      "@capacitor/core",
+      "@capacitor/cli",
+      ...config.platforms.map((platform6) => `@capacitor/${platform6}`)
+    ];
+    const versions = await Promise.all(names.map(async (name) => {
+      const declared = declarations.get(name);
+      if (!declared || !EXACT_VERSION_PATTERN.test(declared))
+        throw new TypeError(`${name} must be a direct exact dependency.`);
+      const installed = await readJsonObject(join50(projectRoot, "node_modules", name, "package.json"));
+      if (installed.version !== declared)
+        throw new TypeError(`${name} does not match its installed version.`);
+      return declared;
+    }));
+    const lines = new Set(versions.map(versionCore));
+    if (lines.size !== 1)
+      throw new TypeError("Capacitor core, CLI, and platform packages must use one major/minor line.");
+    return pass("mobile.capacitor-versions", `Capacitor core, CLI, and configured platforms are pinned and aligned on ${versions[0]}.`, manifestPath);
+  } catch (error) {
+    return fail5("mobile.capacitor-versions", error instanceof Error ? error.message : "Capacitor package versions could not be validated.", manifestPath, "Pin @capacitor/core, @capacitor/cli, and each configured platform to exact versions on the same major/minor line, then reinstall.");
+  }
+}, dependencyLockCheck = async (projectRoot) => {
+  const present = (await Promise.all(LOCK_FILES.map(async (name) => ({
+    exists: await pathExists6(join50(projectRoot, name)),
+    name
+  })))).find(({ exists: exists3 }) => exists3);
+  return present ? pass("mobile.dependency-lock", `Dependency graph is locked by ${present.name}.`, join50(projectRoot, present.name)) : fail5("mobile.dependency-lock", "No supported dependency lockfile is present.", projectRoot, "Install dependencies with the project package manager and commit its lockfile before release.");
+}, productionOriginCheck = (config, projectRoot) => {
+  const origin = new URL(config.productionOrigin);
+  return origin.protocol === "https:" ? pass("mobile.production-origin", "Production transport uses an HTTPS origin.") : fail5("mobile.production-origin", "A loopback development origin cannot be used for a signed release.", projectRoot, "Configure mobile.server.productionOrigin with the deployed HTTPS origin.");
+}, associationIdentityCheck = (config, projectRoot) => {
+  const missing = [
+    ...config.platforms.includes("ios") && !config.appleAppIdPrefix ? ["mobile.deepLinks.apple.appIdPrefix"] : [],
+    ...config.platforms.includes("android") && config.androidCertificateFingerprints.length === 0 ? ["mobile.deepLinks.android.sha256CertificateFingerprints"] : []
+  ];
+  return missing.length === 0 ? pass("mobile.association-identities", "Deep-link association identities are configured for every release platform.") : fail5("mobile.association-identities", `Release association identity is missing: ${missing.join(", ")}.`, projectRoot, "Configure the Apple application prefix and every Android signing-certificate SHA-256 fingerprint used for release.");
+}, journalReleaseCheck = async (journalPath, platform6) => await pathExists6(journalPath) ? fail5(`${platform6}.dev-journal`, "A live-reload recovery journal is still active.", journalPath, "Close the development session or run mobile doctor again after stale-session repair.") : pass(`${platform6}.dev-journal`, "No live-reload recovery journal is active.", journalPath), parsedJson = (source) => {
   try {
     const parsed = JSON.parse(source);
     return parsed;
@@ -18099,30 +18329,138 @@ var HMR_ASSET_PATTERN, RELEASE_ASSET_EXTENSIONS, pathExists5 = async (path) => {
   const allowNavigation = Reflect.get(server, "allowNavigation");
   return typeof Reflect.get(server, "url") === "string" || Reflect.get(server, "cleartext") === true || Array.isArray(allowNavigation) && allowNavigation.length > 0;
 }, capacitorConfigReleaseCheck = async (nativeConfigPath) => {
-  if (!await pathExists5(nativeConfigPath)) {
+  if (!await pathExists6(nativeConfigPath)) {
     return fail5("android.capacitor-config", "The generated Android Capacitor config is missing.", nativeConfigPath, "Run `absolute mobile sync android` before release validation.");
   }
-  const unsafe = isUnsafeCapacitorConfig(await readFile16(nativeConfigPath, "utf8"));
+  const unsafe = isUnsafeCapacitorConfig(await readFile17(nativeConfigPath, "utf8"));
   return unsafe ? fail5("android.capacitor-config", "Android Capacitor config contains a development server URL, cleartext transport, navigation allowlist, or invalid JSON.", nativeConfigPath, "Run `absolute mobile sync android`; do not ship development transport overrides.") : pass("android.capacitor-config", "Android Capacitor config contains no development transport overrides.", nativeConfigPath);
+}, capacitorIdentityCheck = async (config, platform6, nativeConfigPath) => {
+  try {
+    const parsed = await readJsonObject(nativeConfigPath);
+    if (parsed.appId !== config.appId || parsed.appName !== config.appName)
+      throw new TypeError(`${platform6} packaged application identity does not match mobile config.`);
+    return pass(`${platform6}.app-identity`, `Packaged ${platform6} application identity matches mobile config.`, nativeConfigPath);
+  } catch (error) {
+    return fail5(`${platform6}.app-identity`, error instanceof Error ? error.message : `${platform6} application identity could not be validated.`, nativeConfigPath, `Run \`absolute mobile sync ${platform6}\` and review the generated Capacitor config.`);
+  }
 }, manifestReleaseCheck = async (manifestPath) => {
-  if (!await pathExists5(manifestPath)) {
+  if (!await pathExists6(manifestPath)) {
     return fail5("android.cleartext", "The Android manifest is missing.", manifestPath, "Run `absolute mobile sync android` before release validation.");
   }
-  const source = await readFile16(manifestPath, "utf8");
+  const source = await readFile17(manifestPath, "utf8");
   const cleartext = /android:usesCleartextTraffic=["']true["']/u.test(source);
   const networkConfigName = source.match(/android:networkSecurityConfig=["']@xml\/([a-z0-9_]+)["']/u)?.[1];
-  const networkConfigPath = networkConfigName ? join49(dirname29(manifestPath), "res", "xml", `${networkConfigName}.xml`) : undefined;
+  const networkConfigPath = networkConfigName ? join50(dirname29(manifestPath), "res", "xml", `${networkConfigName}.xml`) : undefined;
   const developmentTrustReference = /android:networkSecurityConfig=["']@xml\/absolutejs_dev_network_security["']/u.test(source);
-  const developmentTrustContents = networkConfigPath ? await readFile16(networkConfigPath, "utf8").then((value) => value.includes("@raw/absolutejs_dev_ca")).catch(() => false) : false;
+  const developmentTrustContents = networkConfigPath ? await readFile17(networkConfigPath, "utf8").then((value) => value.includes("@raw/absolutejs_dev_ca")).catch(() => false) : false;
   const developmentTrust = developmentTrustReference || developmentTrustContents;
   return cleartext || developmentTrust ? fail5("android.cleartext", developmentTrust ? "Android still references the AbsoluteJS development certificate authority." : "Android explicitly permits cleartext traffic.", manifestPath, "Run `absolute mobile sync android`; do not ship development transport or trust overrides.") : pass("android.cleartext", "Android does not explicitly permit cleartext traffic.", manifestPath);
 }, hmrAssetsReleaseCheck = async (publicRoot) => {
   const hmrAsset = await findHmrAsset(publicRoot);
   return hmrAsset ? fail5("android.hmr-assets", "A packaged Android asset contains the development HMR client.", hmrAsset, "Rebuild the production mobile bundle and run Capacitor sync again.") : pass("android.hmr-assets", "Packaged Android assets contain no development HMR markers.", publicRoot);
+}, embeddedBundleReleaseCheck = async (config, projectRoot, platform6, publicRoot) => {
+  const inspection = await inspectAbsoluteMobileBundle({ ...config, bundleDirectory: publicRoot }, projectRoot);
+  if (inspection.status === "valid")
+    return pass(`${platform6}.bundle-integrity`, `Packaged mobile manifest, runtime, routes, and ${inspection.pageCount ?? 0} page asset(s) passed structural and SHA-256 validation.`, join50(publicRoot, "absolute-mobile-manifest.json"));
+  return fail5(`${platform6}.bundle-integrity`, inspection.status === "missing" ? "The packaged mobile manifest is missing." : `The packaged mobile bundle is invalid: ${inspection.issue ?? "unknown validation error"}`, join50(publicRoot, "absolute-mobile-manifest.json"), "Rebuild the production mobile bundle and run Capacitor sync for this platform.");
+}, contentSecurityPolicyCheck = async (config, platform6, publicRoot) => {
+  const path = join50(publicRoot, "index.html");
+  try {
+    const source = await readFile17(path, "utf8");
+    const requirements = [
+      "Content-Security-Policy",
+      "default-src 'self'",
+      "base-uri 'none'",
+      "object-src 'none'",
+      "script-src 'self'",
+      "form-action 'none'",
+      config.productionOrigin
+    ];
+    const missing = requirements.filter((value) => !source.includes(value));
+    if (missing.length > 0)
+      throw new TypeError("Packaged shell CSP is missing a required AbsoluteJS directive or backend origin.");
+    return pass(`${platform6}.content-security-policy`, "Packaged shell CSP restricts scripts, objects, base URLs, forms, and backend connections.", path);
+  } catch (error) {
+    return fail5(`${platform6}.content-security-policy`, error instanceof Error ? error.message : "Packaged shell CSP could not be validated.", path, "Rebuild the production mobile bundle with the AbsoluteJS-generated shell.");
+  }
+}, sourceFiles = async (root, extensions) => {
+  if (!await pathExists6(root))
+    return [];
+  const files = await Array.fromAsync(new Bun.Glob("**/*").scan({ cwd: root, onlyFiles: true }));
+  return files.filter((file) => extensions.has(extname8(file))).map((file) => join50(root, file));
+}, containsPattern = async (paths, pattern) => {
+  const sources = await Promise.all(paths.map((path) => readFile17(path, "utf8")));
+  const index = sources.findIndex((source) => pattern.test(source));
+  return index === NOT_FOUND3 ? undefined : paths[index];
+}, androidNativeSecurityCheck = async (androidRoot) => {
+  const manifestPath = join50(androidRoot, "app/src/main/AndroidManifest.xml");
+  try {
+    const manifest = await readFile17(manifestPath, "utf8");
+    if (/android:debuggable=["']true["']/u.test(manifest))
+      throw new TypeError("Android release manifest explicitly enables application debugging.");
+    const sources = await sourceFiles(join50(androidRoot, "app/src/main"), new Set([".java", ".kt"]));
+    const debugSource = await containsPattern(sources, /setWebContentsDebuggingEnabled\s*\(\s*true\s*\)/u);
+    if (debugSource)
+      return fail5("android.native-debugging", "Android application source unconditionally enables WebView debugging.", debugSource, "Remove the unconditional WebView debugging call; use the platform debug-build behavior during development.");
+    return pass("android.native-debugging", "Android does not explicitly enable app or WebView debugging in release source.", manifestPath);
+  } catch (error) {
+    return fail5("android.native-debugging", error instanceof Error ? error.message : "Android native debugging configuration could not be validated.", manifestPath, "Remove explicit release debugging settings and rerun mobile sync.");
+  }
+}, androidExportedComponentsCheck = async (manifestPath) => {
+  const source = await readFile17(manifestPath, "utf8").catch(() => "");
+  const exported = [
+    ...source.matchAll(/<(?:activity|activity-alias|provider|receiver|service)\b[^>]*>/giu)
+  ].map(([tag]) => tag).filter((tag) => /android:exported=["']true["']/iu.test(tag)).map((tag) => tag.match(/android:name=["']([^"']+)["']/iu)?.[1]).filter((name) => Boolean(name) && name !== ".MainActivity");
+  return exported.length === 0 ? pass("android.exported-components", "No non-launcher Android component is explicitly exported.", manifestPath) : warn("android.exported-components", `${exported.length} non-launcher Android component(s) are exported and require manual authorization review.`, manifestPath, "Confirm each exported component is intentional, permission-protected where appropriate, and documented in the mobile threat model review.");
+}, androidDeepLinkProjectionCheck = async (config, manifestPath) => {
+  try {
+    const source = await readFile17(manifestPath, "utf8");
+    const required = [
+      'android:autoVerify="true"',
+      "android.intent.category.BROWSABLE",
+      ...config.deepLinkHosts.map((host2) => `android:scheme="https" android:host="${host2}"`),
+      ...config.deepLinkScheme ? [`android:scheme="${config.deepLinkScheme}"`] : []
+    ];
+    if (required.some((value) => !source.includes(value)))
+      throw new TypeError("Android App Link or custom-scheme projection does not match mobile config.");
+    return pass("android.deep-links", "Android verified links and custom scheme match the effective mobile config.", manifestPath);
+  } catch (error) {
+    return fail5("android.deep-links", error instanceof Error ? error.message : "Android deep-link projection could not be validated.", manifestPath, "Run `absolute mobile sync android` and review the AbsoluteJS-owned deep-link region.");
+  }
+}, iosNativeSecurityCheck = async (iosRoot) => {
+  const entitlementsPath = join50(iosRoot, "App/AbsoluteJS.entitlements");
+  const entitlements = await readFile17(entitlementsPath, "utf8").catch(() => "");
+  if (/<key>get-task-allow<\/key>\s*<true\s*\/>/u.test(entitlements) || /<key>com\.apple\.security\.get-task-allow<\/key>\s*<true\s*\/>/u.test(entitlements))
+    return fail5("ios.native-debugging", "iOS source entitlements explicitly permit debugger attachment.", entitlementsPath, "Remove get-task-allow from source entitlements; Xcode supplies development entitlements only to debug builds.");
+  const sources = await sourceFiles(join50(iosRoot, "App"), new Set([".m", ".mm", ".swift"]));
+  const debugSource = await containsPattern(sources, /\.isInspectable\s*=\s*true|setInspectable\s*\(\s*true\s*\)/u);
+  if (debugSource)
+    return fail5("ios.native-debugging", "iOS application source unconditionally enables WebView inspection.", debugSource, "Remove unconditional WebView inspection from release source.");
+  return pass("ios.native-debugging", "iOS source does not enable release debugger attachment or WebView inspection.", entitlementsPath);
+}, iosDeepLinkProjectionCheck = async (config, iosRoot) => {
+  const infoPath = join50(iosRoot, "App/App/Info.plist");
+  const entitlementsPath = join50(iosRoot, "App/AbsoluteJS.entitlements");
+  const projectPath = join50(iosRoot, "App/App.xcodeproj/project.pbxproj");
+  try {
+    const [info2, entitlements, project] = await Promise.all([
+      readFile17(infoPath, "utf8"),
+      readFile17(entitlementsPath, "utf8"),
+      readFile17(projectPath, "utf8")
+    ]);
+    if (config.deepLinkScheme && (!info2.includes("<key>CFBundleURLTypes</key>") || !info2.includes(`<string>${config.deepLinkScheme}</string>`)))
+      throw new TypeError("iOS custom URL scheme does not match mobile config.");
+    if (config.deepLinkHosts.some((host2) => !entitlements.includes(`<string>applinks:${host2}</string>`)))
+      throw new TypeError("iOS associated domains do not match mobile config.");
+    if (!project.includes("CODE_SIGN_ENTITLEMENTS = App/AbsoluteJS.entitlements;"))
+      throw new TypeError("iOS target does not sign the AbsoluteJS entitlements file.");
+    return pass("ios.deep-links", "iOS universal links, custom scheme, and signed entitlements match mobile config.", entitlementsPath);
+  } catch (error) {
+    return fail5("ios.deep-links", error instanceof Error ? error.message : "iOS deep-link projection could not be validated.", entitlementsPath, "Run `absolute mobile sync ios` and review the AbsoluteJS-owned deep-link and entitlement projection.");
+  }
 }, syncSchemaReleaseCheck = (projectRoot) => {
   if (!projectUsesAbsoluteSync(projectRoot))
     return;
-  const manifestPath = join49(projectRoot, "package.json");
+  const manifestPath = join50(projectRoot, "package.json");
   try {
     const schema = discoverAbsoluteSyncSchema(projectRoot);
     const versions = schema.components.map((component2) => `${component2.id}@${component2.version}`).join(", ");
@@ -18144,8 +18482,8 @@ var HMR_ASSET_PATTERN, RELEASE_ASSET_EXTENSIONS, pathExists5 = async (path) => {
 }, IOS_USAGE_KEYS, androidDevicePermissionCheck = async (config, permissions) => {
   if (!config.platforms.includes("android") || permissions.length === 0)
     return;
-  const path = join49(config.nativeProjectDirectory, "android/app/src/main/AndroidManifest.xml");
-  const source = await readFile16(path, "utf8");
+  const path = join50(config.nativeProjectDirectory, "android/app/src/main/AndroidManifest.xml");
+  const source = await readFile17(path, "utf8");
   const missing = permissions.filter((permission) => !source.includes(`android:name="${permission}"`) && !source.includes(`android:name='${permission}'`));
   if (missing.length === 0)
     return;
@@ -18153,14 +18491,44 @@ var HMR_ASSET_PATTERN, RELEASE_ASSET_EXTENSIONS, pathExists5 = async (path) => {
 }, iosDevicePermissionCheck = async (config, purposes) => {
   if (!config.platforms.includes("ios") || purposes.length === 0)
     return;
-  const path = join49(config.nativeProjectDirectory, "ios/App/App/Info.plist");
-  const source = await readFile16(path, "utf8");
+  const path = join50(config.nativeProjectDirectory, "ios/App/App/Info.plist");
+  const source = await readFile17(path, "utf8");
   const missing = purposes.filter((purpose) => !source.includes(`<key>${IOS_USAGE_KEYS[purpose]}</key>`));
   if (missing.length === 0)
     return;
   return fail5("mobile.device-capabilities", `iOS is missing usage descriptions for: ${missing.join(", ")}.`, path, "Run `absolute mobile sync ios` to regenerate detected device usage descriptions.");
+}, iosCapabilityProjectionCheck = async (config, requirements) => {
+  if (!config.platforms.includes("ios"))
+    return;
+  const appRoot = join50(config.nativeProjectDirectory, "ios/App/App");
+  const infoPath = join50(appRoot, "Info.plist");
+  const info2 = await readFile17(infoPath, "utf8").catch(() => "");
+  if (requirements.iosSystemBars && !/<key>UIViewControllerBasedStatusBarAppearance<\/key>\s*<true\s*\/>/u.test(info2))
+    return fail5("mobile.device-capabilities", "iOS system-bar capability is missing its required view-controller setting.", infoPath, "Run `absolute mobile sync ios` to regenerate native capability settings.");
+  if (requirements.iosPrivacyAccessedApis.length > 0) {
+    const privacyPath = join50(appRoot, "PrivacyInfo.xcprivacy");
+    const projectPath = join50(config.nativeProjectDirectory, "ios/App/App.xcodeproj/project.pbxproj");
+    const [privacy, project] = await Promise.all([
+      readFile17(privacyPath, "utf8").catch(() => ""),
+      readFile17(projectPath, "utf8").catch(() => "")
+    ]);
+    const missing = requirements.iosPrivacyAccessedApis.some(({ api, reasons }) => !privacy.includes(`<string>${api}</string>`) || reasons.some((reason) => !privacy.includes(`<string>${reason}</string>`)));
+    if (missing || !project.includes("PrivacyInfo.xcprivacy in Resources"))
+      return fail5("mobile.device-capabilities", "iOS privacy manifest or target membership does not match detected native capabilities.", privacyPath, "Run `absolute mobile sync ios` to regenerate and target PrivacyInfo.xcprivacy.");
+  }
+  if (requirements.iosPushNotifications) {
+    const entitlementsPath = join50(config.nativeProjectDirectory, "ios/App/AbsoluteJS.entitlements");
+    const delegatePath = join50(appRoot, "AppDelegate.swift");
+    const [entitlements, delegate] = await Promise.all([
+      readFile17(entitlementsPath, "utf8").catch(() => ""),
+      readFile17(delegatePath, "utf8").catch(() => "")
+    ]);
+    if (!entitlements.includes("<key>aps-environment</key>") || !delegate.includes("capacitorDidRegisterForRemoteNotifications") || !delegate.includes("capacitorDidFailToRegisterForRemoteNotifications"))
+      return fail5("mobile.device-capabilities", "iOS push entitlement or AppDelegate forwarding does not match detected capabilities.", entitlementsPath, "Run `absolute mobile sync ios` to regenerate native push integration.");
+  }
+  return;
 }, deviceCapabilityReleaseCheck = async (config, projectRoot) => {
-  const manifestPath = join49(projectRoot, "package.json");
+  const manifestPath = join50(projectRoot, "package.json");
   try {
     const plan = resolveAbsoluteDeviceCapabilityPlan(projectRoot);
     assertAbsoluteDeviceCapabilityPackages(projectRoot, plan);
@@ -18171,32 +18539,41 @@ var HMR_ASSET_PATTERN, RELEASE_ASSET_EXTENSIONS, pathExists5 = async (path) => {
     const iosCheck = await iosDevicePermissionCheck(config, requirements.iosUsageDescriptions);
     if (iosCheck)
       return iosCheck;
+    const iosProjectionCheck = await iosCapabilityProjectionCheck(config, requirements);
+    if (iosProjectionCheck)
+      return iosProjectionCheck;
     return pass("mobile.device-capabilities", plan.capabilities.length > 0 ? `Native provider packages and permission declarations match detected capabilities: ${plan.capabilities.join(", ")}.` : "No optional native device capabilities are used.", manifestPath);
   } catch (error) {
     return fail5("mobile.device-capabilities", error instanceof Error ? error.message : "Native device capability provisioning is invalid.", manifestPath, "Run `absolute mobile sync` and approve the exact capability plugins before releasing.");
   }
 }, inspectAndroidRelease = async (config, projectRoot) => {
-  const androidRoot = join49(config.nativeProjectDirectory, "android");
-  const nativeConfigPath = join49(androidRoot, "app", "src", "main", "assets", "capacitor.config.json");
-  const manifestPath = join49(androidRoot, "app", "src", "main", "AndroidManifest.xml");
-  const publicRoot = join49(androidRoot, "app", "src", "main", "assets", "public");
-  const journalPath = join49(projectRoot, ".absolutejs", "mobile", "dev-session", "journal.json");
+  const androidRoot = join50(config.nativeProjectDirectory, "android");
+  const nativeConfigPath = join50(androidRoot, "app", "src", "main", "assets", "capacitor.config.json");
+  const manifestPath = join50(androidRoot, "app", "src", "main", "AndroidManifest.xml");
+  const publicRoot = join50(androidRoot, "app", "src", "main", "assets", "public");
+  const journalPath = join50(projectRoot, ".absolutejs", "mobile", "dev-session", "journal.json");
   const checks = await Promise.all([
     journalReleaseCheck(journalPath, "android"),
     capacitorConfigReleaseCheck(nativeConfigPath),
+    capacitorIdentityCheck(config, "android", nativeConfigPath),
     manifestReleaseCheck(manifestPath),
-    hmrAssetsReleaseCheck(publicRoot)
+    hmrAssetsReleaseCheck(publicRoot),
+    embeddedBundleReleaseCheck(config, projectRoot, "android", publicRoot),
+    contentSecurityPolicyCheck(config, "android", publicRoot),
+    androidNativeSecurityCheck(androidRoot),
+    androidExportedComponentsCheck(manifestPath),
+    androidDeepLinkProjectionCheck(config, manifestPath)
   ]);
   return checks.map((check2) => ({
     ...check2,
-    path: check2.path ? relative24(projectRoot, check2.path).replaceAll("\\", "/") || "." : undefined
+    path: check2.path ? relative25(projectRoot, check2.path).replaceAll("\\", "/") || "." : undefined
   }));
 }, inspectIosRelease = async (config, projectRoot) => {
-  const iosAppRoot = join49(config.nativeProjectDirectory, "ios", "App", "App");
-  const nativeConfigPath = join49(iosAppRoot, "capacitor.config.json");
-  const infoPath = join49(iosAppRoot, "Info.plist");
-  const publicRoot = join49(iosAppRoot, "public");
-  const journalPath = join49(projectRoot, ".absolutejs", "mobile", "ios-dev-session", "journal.json");
+  const iosAppRoot = join50(config.nativeProjectDirectory, "ios", "App", "App");
+  const nativeConfigPath = join50(iosAppRoot, "capacitor.config.json");
+  const infoPath = join50(iosAppRoot, "Info.plist");
+  const publicRoot = join50(iosAppRoot, "public");
+  const journalPath = join50(projectRoot, ".absolutejs", "mobile", "ios-dev-session", "journal.json");
   const checks = [
     await journalReleaseCheck(journalPath, "ios")
   ];
@@ -18205,27 +18582,59 @@ var HMR_ASSET_PATTERN, RELEASE_ASSET_EXTENSIONS, pathExists5 = async (path) => {
   } else {
     checks.push(pass("ios.marketing-version", `The iOS marketing version is ${config.iosVersion}.`));
   }
-  if (!await pathExists5(nativeConfigPath)) {
+  if (!await pathExists6(nativeConfigPath)) {
     checks.push(fail5("ios.capacitor-config", "The generated iOS Capacitor config is missing.", nativeConfigPath, "Run `absolute mobile sync ios` before release validation."));
-  } else if (isUnsafeCapacitorConfig(await readFile16(nativeConfigPath, "utf8"))) {
+  } else if (isUnsafeCapacitorConfig(await readFile17(nativeConfigPath, "utf8"))) {
     checks.push(fail5("ios.capacitor-config", "iOS Capacitor config contains a development server URL, cleartext transport, navigation allowlist, or invalid JSON.", nativeConfigPath, "Run `absolute mobile sync ios`; do not ship development transport overrides."));
   } else {
     checks.push(pass("ios.capacitor-config", "iOS Capacitor config contains no development transport overrides.", nativeConfigPath));
   }
-  if (!await pathExists5(infoPath)) {
+  checks.push(await capacitorIdentityCheck(config, "ios", nativeConfigPath));
+  if (!await pathExists6(infoPath)) {
     checks.push(fail5("ios.transport-security", "The iOS Info.plist is missing.", infoPath, "Run `absolute mobile sync ios` before release validation."));
   } else {
-    const info2 = await readFile16(infoPath, "utf8");
+    const info2 = await readFile17(infoPath, "utf8");
     checks.push(/<key>NSAllowsArbitraryLoads<\/key>\s*<true\s*\/>/u.test(info2) ? fail5("ios.transport-security", "iOS App Transport Security permits arbitrary network loads.", infoPath, "Remove NSAllowsArbitraryLoads from the release Info.plist.") : pass("ios.transport-security", "iOS App Transport Security does not permit arbitrary loads.", infoPath));
   }
   const hmrAsset = await findHmrAsset(publicRoot);
   checks.push(hmrAsset ? fail5("ios.hmr-assets", "A packaged iOS asset contains the development HMR client.", hmrAsset, "Rebuild the production mobile bundle and run Capacitor sync again.") : pass("ios.hmr-assets", "Packaged iOS assets contain no development HMR markers.", publicRoot));
+  checks.push(await embeddedBundleReleaseCheck(config, projectRoot, "ios", publicRoot), await contentSecurityPolicyCheck(config, "ios", publicRoot), await iosNativeSecurityCheck(join50(config.nativeProjectDirectory, "ios")), await iosDeepLinkProjectionCheck(config, join50(config.nativeProjectDirectory, "ios")));
   return checks.map((check2) => ({
     ...check2,
-    path: check2.path ? relative24(projectRoot, check2.path).replaceAll("\\", "/") || "." : undefined
+    path: check2.path ? relative25(projectRoot, check2.path).replaceAll("\\", "/") || "." : undefined
   }));
+}, createAbsoluteMobileComplianceReport = (config, result) => {
+  const summary = {
+    failed: result.checks.filter(({ status: status2 }) => status2 === "fail").length,
+    passed: result.checks.filter(({ status: status2 }) => status2 === "pass").length,
+    warnings: result.checks.filter(({ status: status2 }) => status2 === "warn").length
+  };
+  return {
+    app: {
+      appId: config.appId,
+      engine: config.engine,
+      platforms: [...config.platforms],
+      productionOrigin: config.productionOrigin
+    },
+    checks: result.checks.map(({ id, status: status2 }) => ({ id, status: status2 })),
+    format: ABSOLUTE_MOBILE_COMPLIANCE_REPORT_FORMAT,
+    manualReview: [...MANUAL_REVIEW],
+    ready: result.ready,
+    summary
+  };
 }, inspectAbsoluteMobileRelease = async (config, projectRoot) => {
-  const checks = config.platforms.includes("android") ? await inspectAndroidRelease(config, projectRoot) : [];
+  const globalChecks = await Promise.all([
+    Promise.resolve(productionOriginCheck(config, projectRoot)),
+    Promise.resolve(associationIdentityCheck(config, projectRoot)),
+    dependencyLockCheck(projectRoot),
+    capacitorVersionCheck(config, projectRoot)
+  ]);
+  const checks = globalChecks.map((check2) => ({
+    ...check2,
+    path: check2.path ? relative25(projectRoot, check2.path).replaceAll("\\", "/") || "." : undefined
+  }));
+  if (config.platforms.includes("android"))
+    checks.push(...await inspectAndroidRelease(config, projectRoot));
   if (config.platforms.includes("ios")) {
     checks.push(...await inspectIosRelease(config, projectRoot));
   }
@@ -18233,25 +18642,41 @@ var HMR_ASSET_PATTERN, RELEASE_ASSET_EXTENSIONS, pathExists5 = async (path) => {
   if (syncSchema) {
     checks.push({
       ...syncSchema,
-      path: syncSchema.path ? relative24(projectRoot, syncSchema.path).replaceAll("\\", "/") || "." : undefined
+      path: syncSchema.path ? relative25(projectRoot, syncSchema.path).replaceAll("\\", "/") || "." : undefined
     });
   }
   const deviceCapabilities = await deviceCapabilityReleaseCheck(config, projectRoot);
   checks.push({
     ...deviceCapabilities,
-    path: deviceCapabilities.path ? relative24(projectRoot, deviceCapabilities.path).replaceAll("\\", "/") || "." : undefined
+    path: deviceCapabilities.path ? relative25(projectRoot, deviceCapabilities.path).replaceAll("\\", "/") || "." : undefined
   });
   return {
     checks,
-    ready: checks.length > 0 && checks.every((check2) => check2.status === "pass")
+    ready: checks.length > 0 && checks.every((check2) => check2.status !== "fail")
   };
 };
 var init_releaseDoctor = __esm(() => {
+  init_mobileBundleInspection();
   init_nativeAuth();
   init_syncSchema();
   init_deviceCapabilities();
   HMR_ASSET_PATTERN = /(?:__HMR_WS__|hmr-timing|__absolute_target|absolutejs-error-overlay)/u;
   RELEASE_ASSET_EXTENSIONS = new Set([".html", ".js", ".mjs"]);
+  EXACT_VERSION_PATTERN = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u;
+  LOCK_FILES = [
+    "bun.lock",
+    "bun.lockb",
+    "package-lock.json",
+    "pnpm-lock.yaml",
+    "yarn.lock"
+  ];
+  MANUAL_REVIEW = [
+    "physical-device",
+    "store-privacy-questionnaire",
+    "privacy-policy",
+    "signing-key-custody",
+    "native-sdk-data-practices"
+  ];
   IOS_USAGE_KEYS = {
     camera: "NSCameraUsageDescription",
     "location-always": "NSLocationAlwaysAndWhenInUseUsageDescription",
@@ -18262,19 +18687,19 @@ var init_releaseDoctor = __esm(() => {
 });
 // src/mobile/androidRelease.ts
-import { createHash as createHash12 } from "crypto";
+import { createHash as createHash13 } from "crypto";
 import {
-  access as access9,
+  access as access10,
   copyFile as copyFile5,
   mkdir as mkdir12,
   mkdtemp as mkdtemp5,
-  readFile as readFile17,
+  readFile as readFile18,
   rename as rename12,
   rm as rm8,
-  stat as stat2,
+  stat as stat3,
   writeFile as writeFile14
 } from "fs/promises";
-import { dirname as dirname30, isAbsolute as isAbsolute7, join as join50, relative as relative25, resolve as resolve39, sep as sep6 } from "path";
+import { dirname as dirname30, isAbsolute as isAbsolute7, join as join51, relative as relative26, resolve as resolve40, sep as sep6 } from "path";
 var ABSOLUTE_ANDROID_RELEASE_FORMAT = 1, isRecord13 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), requireManifest2 = (value) => {
   if (!isRecord13(value) || typeof value.appBuild !== "string" || typeof value.appId !== "string" || typeof value.runtime !== "string") {
     throw new TypeError("Invalid embedded AbsoluteJS mobile manifest.");
@@ -18284,9 +18709,9 @@ var ABSOLUTE_ANDROID_RELEASE_FORMAT = 1, isRecord13 = (value) => typeof value ==
     appId: value.appId,
     runtime: value.runtime
   };
-}, pathExists6 = async (path) => {
+}, pathExists7 = async (path) => {
   try {
-    await access9(path);
+    await access10(path);
     return true;
   } catch {
     return false;
@@ -18324,22 +18749,36 @@ var ABSOLUTE_ANDROID_RELEASE_FORMAT = 1, isRecord13 = (value) => typeof value ==
     artifactPath
   ]);
   return result.exitCode === 0 && /jar verified/iu.test(result.stdout);
-}, sha256File2 = async (path) => createHash12("sha256").update(await readFile17(path)).digest("hex"), safeOutputDirectory2 = (projectRoot, requested) => {
-  const root = resolve39(projectRoot);
-  const output = resolve39(root, requested ?? ".absolutejs/mobile/releases/android");
-  const projectRelative = relative25(root, output);
+}, signAab = (artifactPath, capture, jarsigner, signing) => {
+  const result = capture([
+    jarsigner,
+    "-keystore",
+    signing.keystorePath,
+    "-storepass:env",
+    signing.storePasswordEnvironment,
+    "-keypass:env",
+    signing.keyPasswordEnvironment,
+    artifactPath,
+    signing.keyAlias
+  ]);
+  if (result.exitCode !== 0)
+    throw new TypeError("jarsigner could not sign the Android App Bundle with the configured CI identity.");
+}, sha256File2 = async (path) => createHash13("sha256").update(await readFile18(path)).digest("hex"), safeOutputDirectory2 = (projectRoot, requested) => {
+  const root = resolve40(projectRoot);
+  const output = resolve40(root, requested ?? ".absolutejs/mobile/releases/android");
+  const projectRelative = relative26(root, output);
   if (projectRelative === ".." || projectRelative.startsWith(`..${sep6}`) || isAbsolute7(projectRelative)) {
     throw new TypeError("mobile build --outdir must remain inside the project.");
   }
   return output;
 }, installRelease2 = async (artifactPath, metadata, outputRoot) => {
-  const releaseRoot = join50(outputRoot, metadata.releaseId);
+  const releaseRoot = join51(outputRoot, metadata.releaseId);
   const artifactName = "app-release.aab";
-  const destination = join50(releaseRoot, artifactName);
-  if (await pathExists6(releaseRoot)) {
-    const existing = requireManifestIdentity(JSON.parse(await readFile17(join50(releaseRoot, "release.json"), "utf8")), metadata);
+  const destination = join51(releaseRoot, artifactName);
+  if (await pathExists7(releaseRoot)) {
+    const existing = requireManifestIdentity(JSON.parse(await readFile18(join51(releaseRoot, "release.json"), "utf8")), metadata);
     const [installedBytes, installedSha256] = await Promise.all([
-      stat2(destination).then(({ size }) => size),
+      stat3(destination).then(({ size }) => size),
       sha256File2(destination)
     ]);
     if (installedBytes !== metadata.bytes || installedSha256 !== metadata.sha256) {
@@ -18348,14 +18787,14 @@ var ABSOLUTE_ANDROID_RELEASE_FORMAT = 1, isRecord13 = (value) => typeof value ==
     return { artifactPath: destination, metadata: existing, releaseRoot };
   }
   await mkdir12(dirname30(releaseRoot), { recursive: true });
-  const staging = await mkdtemp5(join50(dirname30(releaseRoot), ".android-stage-"));
+  const staging = await mkdtemp5(join51(dirname30(releaseRoot), ".android-stage-"));
   try {
-    await copyFile5(artifactPath, join50(staging, artifactName));
+    await copyFile5(artifactPath, join51(staging, artifactName));
     const complete = {
       ...metadata,
       artifact: artifactName
     };
-    await writeFile14(join50(staging, "release.json"), `${JSON.stringify(complete, null, "\t")}
+    await writeFile14(join51(staging, "release.json"), `${JSON.stringify(complete, null, "\t")}
 `, { flag: "wx" });
     await rename12(staging, releaseRoot);
     return { artifactPath: destination, metadata: complete, releaseRoot };
@@ -18380,18 +18819,18 @@ var ABSOLUTE_ANDROID_RELEASE_FORMAT = 1, isRecord13 = (value) => typeof value ==
   if (options.versionCode !== undefined && (!Number.isSafeInteger(options.versionCode) || options.versionCode < 1 || options.versionCode > 2100000000)) {
     throw new TypeError("Android versionCode must be an integer from 1 through 2100000000.");
   }
-  const projectRoot = resolve39(options.projectRoot);
+  const projectRoot = resolve40(options.projectRoot);
   const host2 = options.host ?? detectAbsoluteMobileHost();
   const androidRoot = options.androidRoot ?? process.env.ANDROID_HOME ?? process.env.ANDROID_SDK_ROOT ?? absoluteManagedAndroidSdkRoot(host2);
-  const nativeDirectory = join50(options.config.nativeProjectDirectory, "android");
-  const manifest = requireManifest2(JSON.parse(await readFile17(join50(options.config.bundleDirectory, "absolute-mobile-manifest.json"), "utf8")));
+  const nativeDirectory = join51(options.config.nativeProjectDirectory, "android");
+  const manifest = requireManifest2(JSON.parse(await readFile18(join51(options.config.bundleDirectory, "absolute-mobile-manifest.json"), "utf8")));
   if (manifest.appId !== options.config.appId) {
     throw new TypeError("Embedded mobile manifest appId does not match mobile.appId.");
   }
   let { versionCode } = options;
   if (options.prepareVersionCode) {
     const nativeFingerprint = await fingerprintAbsoluteAndroidNativeProject({ nativeDirectory });
-    const buildIdentity = createHash12("sha256").update(`${manifest.appBuild}\x00${nativeFingerprint}`).digest("hex");
+    const buildIdentity = createHash13("sha256").update(`${manifest.appBuild}\x00${nativeFingerprint}`).digest("hex");
     versionCode = await options.prepareVersionCode(buildIdentity);
   }
   if (versionCode !== undefined && (!Number.isSafeInteger(versionCode) || versionCode < 1 || versionCode > 2100000000)) {
@@ -18410,11 +18849,20 @@ var ABSOLUTE_ANDROID_RELEASE_FORMAT = 1, isRecord13 = (value) => typeof value ==
     run: options.run,
     task: "bundleRelease"
   });
-  if (!await pathExists6(artifactPath)) {
+  if (!await pathExists7(artifactPath)) {
     throw new TypeError(`Android Gradle did not produce the expected App Bundle: ${artifactPath}`);
   }
   const capture = options.capture ?? defaultCapture4;
-  const signed2 = verifyAabSignature(artifactPath, capture, options.jarsigner);
+  const jarsigner = options.jarsigner === undefined ? Bun.which("jarsigner") : options.jarsigner;
+  let signed2 = verifyAabSignature(artifactPath, capture, jarsigner);
+  if (signed2 === false && options.signing) {
+    if (!jarsigner)
+      throw new TypeError("Could not sign the Android App Bundle because jarsigner is unavailable.");
+    signAab(artifactPath, capture, jarsigner, options.signing);
+    signed2 = verifyAabSignature(artifactPath, capture, jarsigner);
+    if (!signed2)
+      throw new TypeError("Android App Bundle signature verification failed after CI signing.");
+  }
   if (signed2 === null && !options.allowUnsigned) {
     throw new TypeError("Could not verify the Android App Bundle signature because jarsigner is unavailable. Install a JDK, or use --unsigned only for a non-publishable build.");
   }
@@ -18422,7 +18870,7 @@ var ABSOLUTE_ANDROID_RELEASE_FORMAT = 1, isRecord13 = (value) => typeof value ==
     throw new TypeError("Android Gradle produced an unsigned App Bundle. Configure the release signingConfig in the source-owned Android project (prefer external Gradle properties), or pass --unsigned only for a non-publishable build.");
   }
   const [bytes, sha2562] = await Promise.all([
-    stat2(artifactPath).then(({ size }) => size),
+    stat3(artifactPath).then(({ size }) => size),
     sha256File2(artifactPath)
   ]);
   const releaseId = `amobile_android_${sha2562}`;
@@ -18486,7 +18934,7 @@ var absoluteIosDeviceAcceptanceCommands = (options) => {
 };
 // src/mobile/iosConformance.ts
-import { readFile as readFile18, stat as stat3 } from "fs/promises";
+import { readFile as readFile19, stat as stat4 } from "fs/promises";
 var HMR_LINE, parseAbsoluteIosHmrLog = (line) => {
   const match = HMR_LINE.exec(line);
   if (!match)
@@ -18515,13 +18963,13 @@ var HMR_LINE, parseAbsoluteIosHmrLog = (line) => {
   const sleep2 = options.sleep ?? Bun.sleep;
   const timeoutMs = options.timeoutMs ?? 30000;
   const deadline = Date.now() + timeoutMs;
-  let offset = options.startOffset ?? await stat3(options.logPath).then(({ size }) => size).catch(() => 0);
+  let offset = options.startOffset ?? await stat4(options.logPath).then(({ size }) => size).catch(() => 0);
   let buffered = "";
   const poll = async () => {
     if (Date.now() > deadline)
       throw new Error(`No iOS native HMR acknowledgement was observed within ${timeoutMs}ms.`);
     options.signal?.throwIfAborted();
-    const contents = await readFile18(options.logPath).catch(() => Buffer.alloc(0));
+    const contents = await readFile19(options.logPath).catch(() => Buffer.alloc(0));
     if (contents.byteLength < offset) {
       offset = 0;
       buffered = "";
@@ -18545,8 +18993,8 @@ var init_iosConformance = __esm(() => {
 });
 // src/mobile/nativeTestReport.ts
-import { mkdir as mkdir13, readFile as readFile19, writeFile as writeFile15 } from "fs/promises";
-import { join as join51 } from "path";
+import { mkdir as mkdir13, readFile as readFile20, writeFile as writeFile15 } from "fs/promises";
+import { join as join52 } from "path";
 var secretPattern, bearerPattern, coordinatePattern, nativeCredentialPattern, sanitizeNativeReportText = (value) => value.replace(nativeCredentialPattern, "[REDACTED]").replace(bearerPattern, "Bearer [REDACTED]").replace(secretPattern, "$1$2[REDACTED]").replace(coordinatePattern, "$1$2[REDACTED]").replace(/(https?:\/\/[^\s?#]+)[?#][^\s]*/giu, "$1?[REDACTED]"), markdownCell = (value) => sanitizeNativeReportText(value).replaceAll("|", "\\|").replaceAll(`
 `, "<br>"), createAbsoluteNativeAutomatedChecks = (run) => {
   const target = `${run.targetKind} ${run.targetId}`;
@@ -18648,7 +19096,7 @@ var secretPattern, bearerPattern, coordinatePattern, nativeCredentialPattern, sa
   reportVersion: 1,
   run: options.run
 }), readPackageVersionForNativeReport = async (packageJsonPath) => {
-  const manifest = JSON.parse(await readFile19(packageJsonPath, "utf8"));
+  const manifest = JSON.parse(await readFile20(packageJsonPath, "utf8"));
   if (typeof manifest !== "object" || manifest === null)
     return "unknown";
   const version2 = Reflect.get(manifest, "version");
@@ -18685,8 +19133,8 @@ ${table(report.manualChecks)}
 `;
 }, writeAbsoluteNativeTestReport = async (directory, report) => {
   await mkdir13(directory, { recursive: true });
-  const jsonPath = join51(directory, "report.json");
-  const markdownPath = join51(directory, "report.md");
+  const jsonPath = join52(directory, "report.json");
+  const markdownPath = join52(directory, "report.md");
   await Promise.all([
     writeFile15(jsonPath, `${JSON.stringify(report, null, 2)}
 `),
@@ -18904,8 +19352,8 @@ var init_androidTestReport = __esm(() => {
 });
 // src/mobile/releasePublisher.ts
-import { access as access10 } from "fs/promises";
-import { isAbsolute as isAbsolute8, relative as relative26, resolve as resolve40, sep as sep7 } from "path";
+import { access as access11 } from "fs/promises";
+import { isAbsolute as isAbsolute8, relative as relative27, resolve as resolve41, sep as sep7 } from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
 var prepareAbsoluteIosRelease = async (publisher, options) => {
   if (typeof publisher.prepareIosRelease !== "function") {
@@ -18927,16 +19375,16 @@ var prepareAbsoluteIosRelease = async (publisher, options) => {
   }
   return versionCode;
 }, isRecord14 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), isPublisher = (value) => isRecord14(value) && typeof value.publish === "function", publisherModulePath = (projectRoot, requested) => {
-  const root = resolve40(projectRoot);
-  const path = resolve40(root, requested);
-  const projectRelative = relative26(root, path);
+  const root = resolve41(projectRoot);
+  const path = resolve41(root, requested);
+  const projectRelative = relative27(root, path);
   if (projectRelative === ".." || projectRelative.startsWith(`..${sep7}`) || isAbsolute8(projectRelative)) {
     throw new TypeError("mobile publish --registry must remain inside the project.");
   }
   return path;
 }, loadAbsoluteNativeReleasePublisher = async (projectRoot, requestedModulePath) => {
   const modulePath = publisherModulePath(projectRoot, requestedModulePath);
-  await access10(modulePath).catch(() => {
+  await access11(modulePath).catch(() => {
     throw new TypeError(`Native release registry module does not exist: ${modulePath}`);
   });
   const loaded = await import(pathToFileURL2(modulePath).href);
@@ -18997,133 +19445,36 @@ var prepareAbsoluteIosRelease = async (publisher, options) => {
 var init_releasePublisher = () => {};
 // src/mobile/mobileInspect.ts
-import { access as access11, readFile as readFile20, stat as stat4 } from "fs/promises";
-import { join as join52, relative as relative27, resolve as resolve41 } from "path";
-var ABSOLUTE_MOBILE_INSPECTION_FORMAT = 1, MOBILE_PACKAGE_NAMES, MOBILE_FRAMEWORKS, isObject2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), portablePath = (projectRoot, path) => {
-  const value = relative27(resolve41(projectRoot), resolve41(path)).replaceAll("\\", "/");
+import { access as access12, readFile as readFile21 } from "fs/promises";
+import { join as join53, relative as relative28, resolve as resolve42 } from "path";
+var ABSOLUTE_MOBILE_INSPECTION_FORMAT = 1, MOBILE_PACKAGE_NAMES, isObject3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), portablePath2 = (projectRoot, path) => {
+  const value = relative28(resolve42(projectRoot), resolve42(path)).replaceAll("\\", "/");
   return value || ".";
-}, pathExists7 = async (path) => {
+}, pathExists8 = async (path) => {
   try {
-    await access11(path);
+    await access12(path);
     return true;
   } catch {
     return false;
   }
-}, readObject = async (path) => {
-  const value = JSON.parse(await readFile20(path, "utf8"));
-  if (!isObject2(value))
+}, readObject2 = async (path) => {
+  const value = JSON.parse(await readFile21(path, "utf8"));
+  if (!isObject3(value))
     throw new TypeError("JSON root must be an object.");
   return value;
-}, requireString = (value, field) => {
-  if (typeof value !== "string" || value.length === 0)
-    throw new TypeError(`${field} must be a non-empty string.`);
-  return value;
-}, requireStringArray = (value, field) => {
-  if (!Array.isArray(value) || !value.every((item) => typeof item === "string"))
-    throw new TypeError(`${field} must be a string array.`);
-  return value;
-}, requireBundleFile = async (root, value, field) => {
-  const portable = requireString(value, field);
-  const path = resolve41(root, portable);
-  const normalizedRoot = resolve41(root);
-  if (path === normalizedRoot || !path.startsWith(`${normalizedRoot}/`))
-    throw new TypeError(`${field} must remain inside the mobile bundle.`);
-  if (!(await stat4(path).catch(() => {
-    return;
-  }))?.isFile())
-    throw new TypeError(`${field} does not exist in the mobile bundle.`);
-  return portable;
-}, inspectBundle = async (config, projectRoot) => {
-  const manifestPath = join52(config.bundleDirectory, "absolute-mobile-manifest.json");
-  const manifest = portablePath(projectRoot, manifestPath);
-  if (!await pathExists7(manifestPath))
-    return { manifest, status: "missing" };
-  try {
-    const value = await readObject(manifestPath);
-    if (value.format !== 1)
-      throw new TypeError("format is not supported by this runtime.");
-    if (requireString(value.appId, "appId") !== config.appId)
-      throw new TypeError("appId does not match the effective mobile config.");
-    if (requireString(value.productionOrigin, "productionOrigin") !== config.productionOrigin)
-      throw new TypeError("productionOrigin does not match the effective mobile config.");
-    const appBuild = requireString(value.appBuild, "appBuild");
-    const runtime = requireString(value.runtime, "runtime");
-    const capabilities = requireStringArray(value.deviceCapabilities, "deviceCapabilities").sort();
-    if (!Array.isArray(value.pages) || !Array.isArray(value.routes))
-      throw new TypeError("pages and routes must be arrays.");
-    const pageIds = new Set;
-    const frameworks7 = new Set;
-    await Promise.all(value.pages.map(async (candidate) => {
-      if (!isObject2(candidate))
-        throw new TypeError("pages contains an invalid entry.");
-      const pageId = requireString(candidate.pageId, "page.pageId");
-      if (pageIds.has(pageId))
-        throw new TypeError("page.pageId values must be unique.");
-      pageIds.add(pageId);
-      const framework = requireString(candidate.framework, "page.framework");
-      if (!MOBILE_FRAMEWORKS.has(framework))
-        throw new TypeError("page.framework is unsupported.");
-      frameworks7.add(framework);
-      requireString(candidate.bundleHash, "page.bundleHash");
-      requireString(candidate.contract, "page.contract");
-      requireString(candidate.propsSchemaHash, "page.propsSchemaHash");
-      await requireBundleFile(config.bundleDirectory, candidate.localBundlePath, "page.localBundlePath");
-      if (candidate.localStylePath !== undefined)
-        await requireBundleFile(config.bundleDirectory, candidate.localStylePath, "page.localStylePath");
-    }));
-    const routes = value.routes.map((candidate) => {
-      if (!isObject2(candidate))
-        throw new TypeError("routes contains an invalid entry.");
-      const { method } = candidate;
-      if (method !== "GET" && method !== "HEAD")
-        throw new TypeError("route.method must be GET or HEAD.");
-      const pageId = requireString(candidate.pageId, "route.pageId");
-      if (!pageIds.has(pageId))
-        throw new TypeError("route.pageId references a missing page.");
-      return {
-        method,
-        pageId,
-        pattern: requireString(candidate.pattern, "route.pattern")
-      };
-    });
-    await Promise.all(["index.html", "absolute-mobile-bootstrap.js"].map((file) => requireBundleFile(config.bundleDirectory, file, file)));
-    const entryPath = new URL(config.entry, "https://absolute.invalid").pathname;
-    const entryResolved = resolveAbsoluteMobileRoute(routes, entryPath) !== undefined;
-    if (!entryResolved)
-      throw new TypeError("entry is not owned by an embedded route.");
-    return {
-      appBuild,
-      auth: isObject2(value.auth),
-      capabilities,
-      entryResolved,
-      frameworks: [...frameworks7].sort(),
-      manifest,
-      pageCount: value.pages.length,
-      routeCount: value.routes.length,
-      runtime,
-      status: "valid",
-      sync: isObject2(value.sync)
-    };
-  } catch (error) {
-    return {
-      issue: error instanceof Error ? error.message : "The embedded mobile manifest is invalid.",
-      manifest,
-      status: "invalid"
-    };
-  }
 }, addPackageDeclarations = (declarations, value) => {
-  if (!isObject2(value))
+  if (!isObject3(value))
     return;
   for (const [name, declared] of Object.entries(value).filter((entry) => typeof entry[1] === "string"))
     declarations.set(name, declared);
 }, packageInspections = async (projectRoot, additionalNames) => {
-  const project = await readObject(join52(projectRoot, "package.json"));
+  const project = await readObject2(join53(projectRoot, "package.json"));
   const declarations = new Map;
   for (const field of ["dependencies", "devDependencies"])
     addPackageDeclarations(declarations, project[field]);
   const names = [...new Set([...declarations.keys(), ...additionalNames])].filter((name) => MOBILE_PACKAGE_NAMES.has(name) || name.startsWith("@capacitor/") || additionalNames.includes(name)).sort();
   return Promise.all(names.map(async (name) => {
-    const installedManifest = await readObject(join52(projectRoot, "node_modules", name, "package.json")).catch(() => {
+    const installedManifest = await readObject2(join53(projectRoot, "node_modules", name, "package.json")).catch(() => {
       return;
     });
     const installed = installedManifest?.version;
@@ -19134,7 +19485,7 @@ var ABSOLUTE_MOBILE_INSPECTION_FORMAT = 1, MOBILE_PACKAGE_NAMES, MOBILE_FRAMEWOR
     };
   }));
 }, inspectAbsoluteMobileProject = async (config, projectRoot, options = {}) => {
-  const bundle = await inspectBundle(config, projectRoot);
+  const bundle = await inspectAbsoluteMobileBundle(config, projectRoot);
   let currentCapabilities = [];
   let capabilityIssue;
   let plugins = [];
@@ -19160,22 +19511,22 @@ var ABSOLUTE_MOBILE_INSPECTION_FORMAT = 1, MOBILE_PACKAGE_NAMES, MOBILE_FRAMEWOR
     config: {
       appId: config.appId,
       appName: config.appName,
-      bundleDirectory: portablePath(projectRoot, config.bundleDirectory),
+      bundleDirectory: portablePath2(projectRoot, config.bundleDirectory),
       deepLinkHosts: config.deepLinkHosts,
       deepLinkScheme: config.deepLinkScheme,
       engine: config.engine,
       entry: config.entry,
       iosVersion: config.iosVersion,
-      nativeProjectDirectory: portablePath(projectRoot, config.nativeProjectDirectory),
+      nativeProjectDirectory: portablePath2(projectRoot, config.nativeProjectDirectory),
       platforms: config.platforms,
       productionOrigin: config.productionOrigin
     },
     format: ABSOLUTE_MOBILE_INSPECTION_FORMAT,
     nativeProjects: await Promise.all(config.platforms.map(async (platform6) => {
-      const path = join52(config.nativeProjectDirectory, platform6);
+      const path = join53(config.nativeProjectDirectory, platform6);
       return {
-        initialized: await pathExists7(path),
-        path: portablePath(projectRoot, path),
+        initialized: await pathExists8(path),
+        path: portablePath2(projectRoot, path),
         platform: platform6
       };
     })),
@@ -19227,7 +19578,7 @@ var ABSOLUTE_MOBILE_INSPECTION_FORMAT = 1, MOBILE_PACKAGE_NAMES, MOBILE_FRAMEWOR
 var init_mobileInspect = __esm(() => {
   init_deviceCapabilities();
   init_releaseDoctor();
-  init_routeMatcher();
+  init_mobileBundleInspection();
   MOBILE_PACKAGE_NAMES = new Set([
     "@absolutejs/absolute",
     "@absolutejs/auth",
@@ -19239,15 +19590,484 @@ var init_mobileInspect = __esm(() => {
     "@absolutejs/sync-capacitor",
     "@capacitor-community/sqlite"
   ]);
-  MOBILE_FRAMEWORKS = new Set([
-    "angular",
-    "ember",
-    "html",
-    "htmx",
-    "react",
-    "svelte",
-    "vue"
+});
+// src/mobile/ciWorkflow.ts
+import { existsSync as existsSync42 } from "fs";
+import { access as access13, mkdir as mkdir14, readFile as readFile22, writeFile as writeFile16 } from "fs/promises";
+import { dirname as dirname31, extname as extname9, relative as relative29, resolve as resolve43, sep as sep8 } from "path";
+var ABSOLUTE_MOBILE_CI_WORKFLOW_FORMAT = 1, SECRET_NAME_PATTERN, CI_ENV_INDENTATION = 6, RESERVED_SECRET_NAMES, exists3 = async (path) => {
+  try {
+    await access13(path);
+    return true;
+  } catch {
+    return false;
+  }
+}, yamlString = (value) => `'${value.replaceAll("'", "''")}'`, projectPath = (projectRoot, value, field, options = {}) => {
+  const root = resolve43(projectRoot);
+  const path = resolve43(root, value);
+  const portable = relative29(root, path).replaceAll("\\", "/");
+  if (portable === ".." || portable.startsWith(`..${sep8}`) || portable.startsWith("../") || portable === "") {
+    throw new TypeError(`${field} must remain inside the project root.`);
+  }
+  if (/\r|\n/u.test(portable) || portable.startsWith("-"))
+    throw new TypeError(`${field} contains an unsafe path.`);
+  if (!options.allowMissing && !existsSync42(path))
+    throw new TypeError(`${field} does not exist inside the project.`);
+  return portable;
+}, workflowOutputPath = (projectRoot, value) => {
+  const root = resolve43(projectRoot);
+  const workflows = resolve43(root, ".github/workflows");
+  const path = resolve43(root, value ?? ".github/workflows/absolute-mobile.yml");
+  const portable = relative29(workflows, path);
+  if (portable === ".." || portable.startsWith(`..${sep8}`) || extname9(path) !== ".yml" && extname9(path) !== ".yaml") {
+    throw new TypeError("mobile ci github --output must be a .yml or .yaml file inside .github/workflows.");
+  }
+  return path;
+}, normalizeSecretEnvironment = (values = []) => {
+  const names = [...new Set(values)].sort();
+  for (const name of names) {
+    if (!SECRET_NAME_PATTERN.test(name))
+      throw new TypeError("mobile ci github --secret-env values must be uppercase environment variable names.");
+    if (name.startsWith("GITHUB_") || name.startsWith("RUNNER_") || name.startsWith("ACTIONS_") || RESERVED_SECRET_NAMES.has(name)) {
+      throw new TypeError(`mobile ci github --secret-env cannot replace reserved variable ${name}.`);
+    }
+  }
+  return names;
+}, customSecretEnvironment = (names, indentation = CI_ENV_INDENTATION) => names.map((name) => `${" ".repeat(indentation)}${name}: \${{ secrets.${name} }}`).join(`
+`), commandEnvironment = (options) => `      ABSOLUTE_CONFIG_PATH: ${yamlString(options.configPath ?? "")}
+      ABSOLUTE_REGISTRY_MODULE: ${yamlString(options.registryModule)}
+      ABSOLUTE_SERVER_ENTRY: ${yamlString(options.serverEntry)}`, appendConfigArgument = `if [[ -n "$ABSOLUTE_CONFIG_PATH" ]]; then
+            args+=(--config "$ABSOLUTE_CONFIG_PATH")
+          fi`, installSteps = `      - name: Check out source
+        uses: actions/checkout@v6
+      - name: Install Bun
+        uses: oven-sh/setup-bun@v2
+      - name: Install exact dependencies
+        run: bun ci`, bundleAuditSteps, releaseAuditSteps = (platform6) => `      - name: Run redacted mobile release audit
+        id: mobile-release-audit
+        continue-on-error: true
+        shell: bash
+        run: |
+          mkdir -p .absolutejs/mobile-ci
+          args=(bunx absolute mobile doctor release ${platform6} --json)
+          ${appendConfigArgument}
+          "\${args[@]}" > .absolutejs/mobile-ci/compliance.json
+      - name: Upload mobile compliance report
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: absolute-mobile-compliance-\${{ github.job }}
+          path: .absolutejs/mobile-ci/compliance.json
+          if-no-files-found: error
+          retention-days: 30
+          include-hidden-files: true
+      - name: Enforce mobile release audit
+        if: steps.mobile-release-audit.outcome != 'success'
+        run: exit 1`, platformInput = (platforms) => {
+  const choices = platforms.length === 2 ? ["all", ...platforms] : platforms;
+  return `      platform:
+        description: Native platform to build
+        required: true
+        type: choice
+        default: ${choices[0]}
+        options:
+${choices.map((value) => `          - ${value}`).join(`
+`)}`;
+}, publishingInputs = (platforms, includePublishing) => {
+  if (!includePublishing)
+    return "";
+  const fields = [
+    `      publish:
+        description: Publish through mobile.release.ts after the signed build
+        required: true
+        type: boolean
+        default: false`,
+    `      channel:
+        description: Optional AbsoluteJS immutable release channel
+        required: false
+        type: string`
+  ];
+  if (platforms.includes("android"))
+    fields.push(`      play_track:
+        description: Optional Google Play track
+        required: true
+        type: choice
+        default: registry-only
+        options:
+          - registry-only
+          - internal
+          - alpha
+          - beta
+          - production`);
+  if (platforms.includes("ios")) {
+    fields.push(`      testflight_group:
+        description: Optional internal or external TestFlight group
+        required: false
+        type: string`);
+    fields.push(`      submit_testflight_review:
+        description: Explicitly submit an external TestFlight build for review
+        required: true
+        type: boolean
+        default: false`);
+  }
+  return `
+${fields.join(`
+`)}`;
+}, jobCondition = (platform6) => `github.event_name == 'workflow_dispatch' && (inputs.platform == 'all' || inputs.platform == '${platform6}')`, androidJob = (options) => {
+  const custom = customSecretEnvironment(options.customSecrets);
+  const publishEnvironment = options.includePublishing ? `
+      ABSOLUTE_PUBLISH: \${{ inputs.publish }}
+      ABSOLUTE_RELEASE_CHANNEL: \${{ inputs.channel }}
+      ABSOLUTE_PLAY_TRACK: \${{ inputs.play_track }}
+      ABSOLUTE_GOOGLE_CREDENTIALS_BASE64: \${{ secrets.ABSOLUTE_GOOGLE_CREDENTIALS_BASE64 }}
+      GOOGLE_APPLICATION_CREDENTIALS: \${{ runner.temp }}/absolute-google-credentials.json` : "";
+  const publishCommand = options.includePublishing ? `if [[ "$ABSOLUTE_PUBLISH" == "true" ]]; then
+            args=(bunx absolute mobile publish android "$ABSOLUTE_SERVER_ENTRY" --registry "$ABSOLUTE_REGISTRY_MODULE")
+            if [[ -n "$ABSOLUTE_RELEASE_CHANNEL" ]]; then
+              args+=(--channel "$ABSOLUTE_RELEASE_CHANNEL")
+            fi
+            if [[ "$ABSOLUTE_PLAY_TRACK" != "registry-only" ]]; then
+              args+=(--play-track "$ABSOLUTE_PLAY_TRACK")
+            fi
+          else
+            args=(bunx absolute mobile build android "$ABSOLUTE_SERVER_ENTRY")
+          fi` : `args=(bunx absolute mobile build android "$ABSOLUTE_SERVER_ENTRY")`;
+  const googleSetup = options.includePublishing ? `
+          if [[ "$ABSOLUTE_PUBLISH" == "true" && "$ABSOLUTE_PLAY_TRACK" != "registry-only" ]]; then
+            if [[ -z "$ABSOLUTE_GOOGLE_CREDENTIALS_BASE64" ]]; then
+              echo "ABSOLUTE_GOOGLE_CREDENTIALS_BASE64 is required for Google Play publication." >&2
+              exit 1
+            fi
+            printf '%s' "$ABSOLUTE_GOOGLE_CREDENTIALS_BASE64" | base64 --decode > "$GOOGLE_APPLICATION_CREDENTIALS"
+            chmod 600 "$GOOGLE_APPLICATION_CREDENTIALS"
+          fi` : "";
+  return `
+  android:
+    name: Signed Android release
+    needs: validate
+    if: \${{ ${jobCondition("android")} }}
+    runs-on: ubuntu-latest
+    environment: absolute-mobile-release
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
+    env:
+      ABSOLUTE_ANDROID_KEYSTORE_BASE64: \${{ secrets.ABSOLUTE_ANDROID_KEYSTORE_BASE64 }}
+      ABSOLUTE_ANDROID_KEYSTORE_PASSWORD: \${{ secrets.ABSOLUTE_ANDROID_KEYSTORE_PASSWORD }}
+      ABSOLUTE_ANDROID_KEY_ALIAS: \${{ secrets.ABSOLUTE_ANDROID_KEY_ALIAS }}
+      ABSOLUTE_ANDROID_KEY_PASSWORD: \${{ secrets.ABSOLUTE_ANDROID_KEY_PASSWORD }}
+      ABSOLUTE_ANDROID_KEYSTORE_PATH: \${{ runner.temp }}/absolute-release.jks${publishEnvironment}${custom ? `
+${custom}` : ""}
+${commandEnvironment({ configPath: undefined, registryModule: "", serverEntry: "" })}
+    steps:
+${installSteps}
+      - name: Provision Android signing
+        shell: bash
+        run: |
+          required=(
+            ABSOLUTE_ANDROID_KEYSTORE_BASE64
+            ABSOLUTE_ANDROID_KEYSTORE_PASSWORD
+            ABSOLUTE_ANDROID_KEY_ALIAS
+            ABSOLUTE_ANDROID_KEY_PASSWORD
+          )
+          for name in "\${required[@]}"; do
+            if [[ -z "\${!name}" ]]; then
+              echo "$name is required in the absolute-mobile-release environment." >&2
+              exit 1
+            fi
+          done
+          printf '%s' "$ABSOLUTE_ANDROID_KEYSTORE_BASE64" | base64 --decode > "\${{ runner.temp }}/absolute-release.jks"
+          chmod 600 "\${{ runner.temp }}/absolute-release.jks"${googleSetup}
+      - name: Build or publish Android
+        shell: bash
+        run: |
+          ${publishCommand}
+          ${appendConfigArgument}
+          "\${args[@]}"
+${releaseAuditSteps("android")}
+      - name: Attest Android App Bundle
+        if: inputs.attest
+        uses: actions/attest@v4
+        with:
+          subject-path: .absolutejs/mobile/releases/android/**/app-release.aab
+      - name: Upload Android release
+        uses: actions/upload-artifact@v7
+        with:
+          name: absolute-mobile-android
+          path: .absolutejs/mobile/releases/android/
+          if-no-files-found: error
+          retention-days: 14
+          include-hidden-files: true
+      - name: Remove Android credentials
+        if: always()
+        shell: bash
+        run: |
+          rm -f "\${{ runner.temp }}/absolute-release.jks"
+          rm -f "\${{ runner.temp }}/absolute-google-credentials.json"`;
+}, iosJob = (options) => {
+  const custom = customSecretEnvironment(options.customSecrets);
+  const publishEnvironment = options.includePublishing ? `
+      ABSOLUTE_PUBLISH: \${{ inputs.publish }}
+      ABSOLUTE_RELEASE_CHANNEL: \${{ inputs.channel }}
+      ABSOLUTE_TESTFLIGHT_GROUP: \${{ inputs.testflight_group }}
+      ABSOLUTE_TESTFLIGHT_SUBMIT_REVIEW: \${{ inputs.submit_testflight_review }}
+      APP_STORE_CONNECT_ISSUER_ID: \${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
+      APP_STORE_CONNECT_KEY_ID: \${{ secrets.APP_STORE_CONNECT_KEY_ID }}
+      APP_STORE_CONNECT_PRIVATE_KEY_BASE64: \${{ secrets.APP_STORE_CONNECT_PRIVATE_KEY_BASE64 }}
+      APP_STORE_CONNECT_PRIVATE_KEY_PATH: \${{ runner.temp }}/AuthKey_AbsoluteJS.p8` : "";
+  const publishCommand = options.includePublishing ? `if [[ "$ABSOLUTE_PUBLISH" == "true" ]]; then
+            args=(bunx absolute mobile publish ios "$ABSOLUTE_SERVER_ENTRY" --registry "$ABSOLUTE_REGISTRY_MODULE")
+            if [[ -n "$ABSOLUTE_RELEASE_CHANNEL" ]]; then
+              args+=(--channel "$ABSOLUTE_RELEASE_CHANNEL")
+            fi
+            if [[ -n "$ABSOLUTE_TESTFLIGHT_GROUP" ]]; then
+              args+=(--testflight-group "$ABSOLUTE_TESTFLIGHT_GROUP")
+            fi
+            if [[ "$ABSOLUTE_TESTFLIGHT_SUBMIT_REVIEW" == "true" ]]; then
+              args+=(--testflight-submit-review)
+            fi
+          else
+            args=(bunx absolute mobile build ios "$ABSOLUTE_SERVER_ENTRY")
+          fi` : `args=(bunx absolute mobile build ios "$ABSOLUTE_SERVER_ENTRY")`;
+  const appStoreSetup = options.includePublishing ? `
+          if [[ "$ABSOLUTE_PUBLISH" == "true" && -n "$ABSOLUTE_TESTFLIGHT_GROUP" ]]; then
+            required+=(APP_STORE_CONNECT_ISSUER_ID APP_STORE_CONNECT_KEY_ID APP_STORE_CONNECT_PRIVATE_KEY_BASE64)
+          fi` : "";
+  const appStoreDecode = options.includePublishing ? `
+          if [[ "$ABSOLUTE_PUBLISH" == "true" && -n "$ABSOLUTE_TESTFLIGHT_GROUP" ]]; then
+            printf '%s' "$APP_STORE_CONNECT_PRIVATE_KEY_BASE64" | base64 --decode > "$APP_STORE_CONNECT_PRIVATE_KEY_PATH"
+            chmod 600 "$APP_STORE_CONNECT_PRIVATE_KEY_PATH"
+          fi` : "";
+  return `
+  ios:
+    name: Signed iOS release
+    needs: validate
+    if: \${{ ${jobCondition("ios")} }}
+    runs-on: macos-latest
+    environment: absolute-mobile-release
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
+    env:
+      ABSOLUTE_IOS_CERTIFICATE_BASE64: \${{ secrets.ABSOLUTE_IOS_CERTIFICATE_BASE64 }}
+      ABSOLUTE_IOS_CERTIFICATE_PASSWORD: \${{ secrets.ABSOLUTE_IOS_CERTIFICATE_PASSWORD }}
+      ABSOLUTE_IOS_PROVISIONING_PROFILE_BASE64: \${{ secrets.ABSOLUTE_IOS_PROVISIONING_PROFILE_BASE64 }}
+      ABSOLUTE_IOS_KEYCHAIN_PASSWORD: \${{ secrets.ABSOLUTE_IOS_KEYCHAIN_PASSWORD }}${publishEnvironment}${custom ? `
+${custom}` : ""}
+      ABSOLUTE_IOS_DEVELOPMENT_TEAM: \${{ secrets.ABSOLUTE_IOS_DEVELOPMENT_TEAM }}
+${commandEnvironment({ configPath: undefined, registryModule: "", serverEntry: "" })}
+    steps:
+${installSteps}
+      - name: Provision iOS signing
+        shell: bash
+        run: |
+          required=(
+            ABSOLUTE_IOS_CERTIFICATE_BASE64
+            ABSOLUTE_IOS_CERTIFICATE_PASSWORD
+            ABSOLUTE_IOS_PROVISIONING_PROFILE_BASE64
+            ABSOLUTE_IOS_KEYCHAIN_PASSWORD
+            ABSOLUTE_IOS_DEVELOPMENT_TEAM
+          )${appStoreSetup}
+          for name in "\${required[@]}"; do
+            if [[ -z "\${!name}" ]]; then
+              echo "$name is required in the absolute-mobile-release environment." >&2
+              exit 1
+            fi
+          done
+          CERTIFICATE_PATH="\${{ runner.temp }}/absolute-signing.p12"
+          PROFILE_PATH="\${{ runner.temp }}/absolute.mobileprovision"
+          KEYCHAIN_PATH="\${{ runner.temp }}/absolute-signing.keychain-db"
+          PROFILE_DESTINATION="$HOME/Library/MobileDevice/Provisioning Profiles/absolute.mobileprovision"
+          printf '%s' "$ABSOLUTE_IOS_CERTIFICATE_BASE64" | base64 --decode > "$CERTIFICATE_PATH"
+          printf '%s' "$ABSOLUTE_IOS_PROVISIONING_PROFILE_BASE64" | base64 --decode > "$PROFILE_PATH"
+          security create-keychain -p "$ABSOLUTE_IOS_KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
+          security unlock-keychain -p "$ABSOLUTE_IOS_KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          security import "$CERTIFICATE_PATH" -P "$ABSOLUTE_IOS_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
+          security set-key-partition-list -S apple-tool:,apple: -k "$ABSOLUTE_IOS_KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          security list-keychain -d user -s "$KEYCHAIN_PATH"
+          mkdir -p "$(dirname "$PROFILE_DESTINATION")"
+          cp "$PROFILE_PATH" "$PROFILE_DESTINATION"${appStoreDecode}
+      - name: Build or publish iOS
+        shell: bash
+        run: |
+          ${publishCommand}
+          ${appendConfigArgument}
+          "\${args[@]}"
+${releaseAuditSteps("ios")}
+      - name: Attest iOS IPA
+        if: inputs.attest
+        uses: actions/attest@v4
+        with:
+          subject-path: .absolutejs/mobile/releases/ios/**/App.ipa
+      - name: Upload iOS release
+        uses: actions/upload-artifact@v7
+        with:
+          name: absolute-mobile-ios
+          path: .absolutejs/mobile/releases/ios/
+          if-no-files-found: error
+          retention-days: 14
+          include-hidden-files: true
+      - name: Remove iOS credentials
+        if: always()
+        shell: bash
+        run: |
+          security delete-keychain "\${{ runner.temp }}/absolute-signing.keychain-db" 2>/dev/null || true
+          rm -f "$HOME/Library/MobileDevice/Provisioning Profiles/absolute.mobileprovision"
+          rm -f "\${{ runner.temp }}/absolute-signing.p12"
+          rm -f "\${{ runner.temp }}/absolute.mobileprovision"
+          rm -f "\${{ runner.temp }}/AuthKey_AbsoluteJS.p8"`;
+}, requiredSecrets = (platforms, includePublishing, custom) => [
+  ...platforms.includes("android") ? [
+    "ABSOLUTE_ANDROID_KEYSTORE_BASE64",
+    "ABSOLUTE_ANDROID_KEYSTORE_PASSWORD",
+    "ABSOLUTE_ANDROID_KEY_ALIAS",
+    "ABSOLUTE_ANDROID_KEY_PASSWORD",
+    ...includePublishing ? ["ABSOLUTE_GOOGLE_CREDENTIALS_BASE64"] : []
+  ] : [],
+  ...platforms.includes("ios") ? [
+    "ABSOLUTE_IOS_CERTIFICATE_BASE64",
+    "ABSOLUTE_IOS_CERTIFICATE_PASSWORD",
+    "ABSOLUTE_IOS_PROVISIONING_PROFILE_BASE64",
+    "ABSOLUTE_IOS_KEYCHAIN_PASSWORD",
+    "ABSOLUTE_IOS_DEVELOPMENT_TEAM",
+    ...includePublishing ? [
+      "APP_STORE_CONNECT_ISSUER_ID",
+      "APP_STORE_CONNECT_KEY_ID",
+      "APP_STORE_CONNECT_PRIVATE_KEY_BASE64"
+    ] : []
+  ] : [],
+  ...custom
+], createAbsoluteMobileGithubWorkflow = (options) => {
+  const platforms = [
+    ...options.config.platforms
+  ].sort();
+  const includePublishing = options.includePublishing === true;
+  const customSecrets = normalizeSecretEnvironment(options.secretEnvironment);
+  const serverEntry = projectPath(options.projectRoot, options.serverEntry ?? "server.ts", "mobile ci github server entry");
+  const configPath2 = options.configPath ? projectPath(options.projectRoot, options.configPath, "mobile ci github --config") : undefined;
+  const registryModule = projectPath(options.projectRoot, options.registryModule ?? "mobile.release.ts", "mobile ci github --registry", { allowMissing: !includePublishing });
+  const environment = commandEnvironment({
+    configPath: configPath2,
+    registryModule,
+    serverEntry
+  });
+  let workflow = `# Generated by AbsoluteJS. Regenerate with: absolute mobile ci github${includePublishing ? " --publish" : ""}
+name: AbsoluteJS Mobile
+on:
+  pull_request:
+  workflow_dispatch:
+    inputs:
+${platformInput(platforms)}
+      attest:
+        description: Generate GitHub artifact provenance attestations
+        required: true
+        type: boolean
+        default: false${publishingInputs(platforms, includePublishing)}
+concurrency:
+  group: absolute-mobile-\${{ github.repository }}
+  cancel-in-progress: false
+jobs:
+  validate:
+    name: Validate mobile release inputs
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    env:
+${environment}
+    steps:
+${installSteps}
+${bundleAuditSteps}${platforms.includes("android") ? androidJob({ customSecrets, includePublishing }) : ""}${platforms.includes("ios") ? iosJob({ customSecrets, includePublishing }) : ""}
+`;
+  const replacements = new Map([
+    [
+      "ABSOLUTE_CONFIG_PATH: ''",
+      `ABSOLUTE_CONFIG_PATH: ${yamlString(configPath2 ?? "")}`
+    ],
+    [
+      "ABSOLUTE_REGISTRY_MODULE: ''",
+      `ABSOLUTE_REGISTRY_MODULE: ${yamlString(registryModule)}`
+    ],
+    [
+      "ABSOLUTE_SERVER_ENTRY: ''",
+      `ABSOLUTE_SERVER_ENTRY: ${yamlString(serverEntry)}`
+    ]
+  ]);
+  for (const [placeholder, replacement] of replacements)
+    workflow = workflow.replaceAll(placeholder, replacement);
+  return {
+    requiredSecrets: requiredSecrets(platforms, includePublishing, customSecrets),
+    workflow
+  };
+}, writeAbsoluteMobileGithubWorkflow = async (options) => {
+  const path = workflowOutputPath(options.projectRoot, options.outputPath);
+  const generated = createAbsoluteMobileGithubWorkflow(options);
+  const previous = await exists3(path) ? await readFile22(path, "utf8") : undefined;
+  if (previous !== undefined && previous !== generated.workflow && !options.force)
+    throw new TypeError(`${relative29(options.projectRoot, path)} already exists and differs. Rerun with --force to replace the generated workflow.`);
+  if (previous !== generated.workflow) {
+    await mkdir14(dirname31(path), { recursive: true });
+    await writeFile16(path, generated.workflow);
+  }
+  return {
+    changed: previous !== generated.workflow,
+    format: ABSOLUTE_MOBILE_CI_WORKFLOW_FORMAT,
+    path,
+    platforms: [...options.config.platforms].sort(),
+    publishing: options.includePublishing === true,
+    requiredSecrets: generated.requiredSecrets
+  };
+};
+var init_ciWorkflow = __esm(() => {
+  SECRET_NAME_PATTERN = /^[A-Z][A-Z0-9_]*$/u;
+  RESERVED_SECRET_NAMES = new Set([
+    "ABSOLUTE_ANDROID_KEYSTORE_BASE64",
+    "ABSOLUTE_ANDROID_KEYSTORE_PASSWORD",
+    "ABSOLUTE_ANDROID_KEY_ALIAS",
+    "ABSOLUTE_ANDROID_KEY_PASSWORD",
+    "ABSOLUTE_GOOGLE_CREDENTIALS_BASE64",
+    "ABSOLUTE_IOS_CERTIFICATE_BASE64",
+    "ABSOLUTE_IOS_CERTIFICATE_PASSWORD",
+    "ABSOLUTE_IOS_PROVISIONING_PROFILE_BASE64",
+    "ABSOLUTE_IOS_KEYCHAIN_PASSWORD",
+    "ABSOLUTE_IOS_DEVELOPMENT_TEAM",
+    "APP_STORE_CONNECT_ISSUER_ID",
+    "APP_STORE_CONNECT_KEY_ID",
+    "APP_STORE_CONNECT_PRIVATE_KEY_BASE64"
   ]);
+  bundleAuditSteps = `      - name: Prepare production mobile bundle
+        shell: bash
+        run: |
+          args=(bunx absolute prepare "$ABSOLUTE_SERVER_ENTRY" --outdir .absolutejs/mobile-ci/server)
+          ${appendConfigArgument}
+          "\${args[@]}"
+      - name: Run cryptographic mobile bundle audit
+        id: mobile-bundle-audit
+        continue-on-error: true
+        shell: bash
+        run: |
+          mkdir -p .absolutejs/mobile-ci
+          args=(bunx absolute mobile inspect --json --require-bundle)
+          ${appendConfigArgument}
+          "\${args[@]}" > .absolutejs/mobile-ci/inspection.json
+      - name: Upload mobile inspection report
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: absolute-mobile-inspection
+          path: .absolutejs/mobile-ci/inspection.json
+          if-no-files-found: error
+          retention-days: 30
+          include-hidden-files: true
+      - name: Enforce mobile bundle audit
+        if: steps.mobile-bundle-audit.outcome != 'success'
+        run: exit 1`;
 });
 // src/cli/scripts/mobile.ts
@@ -19255,11 +20075,11 @@ var exports_mobile = {};
 __export(exports_mobile, {
   runMobile: () => runMobile
 });
-import { access as access12, mkdir as mkdir14, readFile as readFile21, writeFile as writeFile16 } from "fs/promises";
-import { join as join53, resolve as resolve42 } from "path";
+import { access as access14, mkdir as mkdir15, readFile as readFile23, writeFile as writeFile17 } from "fs/promises";
+import { join as join54, relative as relative30, resolve as resolve44 } from "path";
 import { createInterface } from "readline/promises";
-var NOT_FOUND3 = -1, isRecord15 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), CAPACITOR_PACKAGES, CAPACITOR_PACKAGE_SPECS, CAPACITOR_SYNC_PACKAGE_SPECS, packageNameFromSpec = (spec) => spec.slice(0, spec.lastIndexOf("@")), directProjectPackages = async (projectRoot) => {
-  const manifest = JSON.parse(await readFile21(join53(projectRoot, "package.json"), "utf8"));
+var NOT_FOUND4 = -1, isRecord15 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), CAPACITOR_PACKAGES, CAPACITOR_PACKAGE_SPECS, CAPACITOR_SYNC_PACKAGE_SPECS, packageNameFromSpec = (spec) => spec.slice(0, spec.lastIndexOf("@")), directProjectPackages = async (projectRoot) => {
+  const manifest = JSON.parse(await readFile23(join54(projectRoot, "package.json"), "utf8"));
   if (!isRecord15(manifest))
     throw new TypeError("Application package.json must contain an object.");
   const names = new Set;
@@ -19272,7 +20092,7 @@ var NOT_FOUND3 = -1, isRecord15 = (value) => typeof value === "object" && value
   return names;
 }, resolvedPackageVersion = async (projectRoot, packageName) => {
   try {
-    const manifest = JSON.parse(await readFile21(join53(projectRoot, "node_modules", packageName, "package.json"), "utf8"));
+    const manifest = JSON.parse(await readFile23(join54(projectRoot, "node_modules", packageName, "package.json"), "utf8"));
     return isRecord15(manifest) && typeof manifest.version === "string" ? manifest.version : undefined;
   } catch {
     return;
@@ -19303,7 +20123,7 @@ var NOT_FOUND3 = -1, isRecord15 = (value) => typeof value === "object" && value
   await installApprovedPackages(projectRoot, args, `AbsoluteJS detected native device capabilities (${capabilityPlan.capabilities.join(", ")}). Install only their required Capacitor plugins now?`, capabilityPackages);
 }, valueAfter = (args, flag) => {
   const index = args.indexOf(flag);
-  return index === NOT_FOUND3 ? undefined : args[index + 1];
+  return index === NOT_FOUND4 ? undefined : args[index + 1];
 }, valuesAfter = (args, flag) => args.flatMap((value, index) => {
   const next = args[index + 1];
   return value === flag && next !== undefined ? [next] : [];
@@ -19313,9 +20133,9 @@ var NOT_FOUND3 = -1, isRecord15 = (value) => typeof value === "object" && value
   }
   return value;
 }, capacitorExecutable = async (projectRoot) => {
-  const executable = join53(projectRoot, "node_modules", ".bin", "cap");
+  const executable = join54(projectRoot, "node_modules", ".bin", "cap");
   try {
-    await access12(executable);
+    await access14(executable);
     return executable;
   } catch {
     throw new TypeError(`Capacitor is not installed in this app. Run: bun add ${CAPACITOR_PACKAGES.join(" ")}`);
@@ -19342,11 +20162,19 @@ var NOT_FOUND3 = -1, isRecord15 = (value) => typeof value === "object" && value
   const report = await inspectAbsoluteMobileProject(mobile, projectRoot, {
     absolutejsVersion: await absolutejsVersionForReport()
   });
+  const requireBundle = () => {
+    if (!args.includes("--require-bundle"))
+      return;
+    if (report.bundle.status !== "valid" || report.capabilities.issue || report.capabilities.embeddedMatchesCurrent !== true)
+      throw new TypeError("Mobile bundle validation failed. Regenerate the production bundle and resolve capability drift.");
+  };
   if (args.includes("--json")) {
     console.log(JSON.stringify(report, null, 2));
+    requireBundle();
     return report;
   }
   console.log(renderAbsoluteMobileProjectInspection(report).trimEnd());
+  requireBundle();
   return report;
 }, remoteProfilePath = () => process.env.ABSOLUTE_REMOTE_MAC_PROFILE_PATH || undefined, pairRemoteMac = async (args) => {
   if (args[0] !== "mac" || !args[1] || !args[2])
@@ -19412,7 +20240,7 @@ var NOT_FOUND3 = -1, isRecord15 = (value) => typeof value === "object" && value
   await applyAbsoluteNativeBackgroundSync(projectRoot, mobile, platforms);
 }, associations = async (args) => {
   const { mobile, projectRoot } = await loadMobile(valueAfter(args, "--config"));
-  const outputDirectory = resolve42(projectRoot, valueAfter(args, "--outdir") ?? ".absolutejs/mobile/associations");
+  const outputDirectory = resolve44(projectRoot, valueAfter(args, "--outdir") ?? ".absolutejs/mobile/associations");
   if (args.includes("--verify")) {
     const result2 = await verifyAbsoluteMobileAssociationFiles(mobile);
     console.log(`Verified ${result2.results.length} hosted association files`);
@@ -19423,6 +20251,59 @@ var NOT_FOUND3 = -1, isRecord15 = (value) => typeof value === "object" && value
   }
   const result = await materializeAbsoluteMobileAssociationFiles(mobile, outputDirectory);
   console.log(`Generated ${result.written.length} association files in ${result.root}`);
+}, mobileCiServerEntry = (args) => {
+  const valueFlags = new Set([
+    "--config",
+    "--output",
+    "--registry",
+    "--secret-env"
+  ]);
+  const skipped = new Set;
+  args.forEach((value, index) => {
+    if (!valueFlags.has(value))
+      return;
+    skipped.add(index);
+    skipped.add(index + 1);
+  });
+  return args.find((value, index) => !skipped.has(index) && value !== "github" && !value.startsWith("-")) ?? DEFAULT_SERVER_ENTRY;
+}, generateGithubCi = async (args) => {
+  if (args[0] !== "github")
+    throw new TypeError("Usage: absolute mobile ci github [server-entry] [--publish] [--registry module] [--secret-env NAME] [--output path] [--force] [--json] [--config path]");
+  const configPath2 = valueAfter(args, "--config");
+  const { mobile, projectRoot } = await loadMobile(configPath2);
+  const result = await writeAbsoluteMobileGithubWorkflow({
+    config: mobile,
+    configPath: configPath2,
+    force: args.includes("--force"),
+    includePublishing: args.includes("--publish"),
+    outputPath: valueAfter(args, "--output"),
+    projectRoot,
+    registryModule: valueAfter(args, "--registry"),
+    secretEnvironment: valuesAfter(args, "--secret-env"),
+    serverEntry: mobileCiServerEntry(args)
+  });
+  sendTelemetryEvent("mobile:ci-generated", {
+    platformCount: result.platforms.length,
+    provider: "github-actions",
+    publishing: result.publishing
+  });
+  const publicResult = {
+    changed: result.changed,
+    format: result.format,
+    path: relative30(projectRoot, result.path).replaceAll("\\", "/"),
+    platforms: result.platforms,
+    publishing: result.publishing,
+    requiredSecrets: result.requiredSecrets
+  };
+  if (args.includes("--json")) {
+    console.log(JSON.stringify(publicResult, null, 2));
+    return publicResult;
+  }
+  console.log(`${result.changed ? "Generated" : "Verified"} ${publicResult.path} for ${result.platforms.join(" and ")}.`);
+  console.log("Create a protected GitHub environment named absolute-mobile-release, then add these secrets:");
+  result.requiredSecrets.forEach((name) => console.log(`  ${name}`));
+  console.log("Pull requests run the secret-free release audit. Signed builds and optional publishing run only through manual workflow dispatch.");
+  return publicResult;
 }, doctorMark = (status2) => {
   if (status2 === "pass")
     return "\x1B[32m\u2713\x1B[0m";
@@ -19455,9 +20336,11 @@ var NOT_FOUND3 = -1, isRecord15 = (value) => typeof value === "object" && value
   }
 }, runReleaseDoctor = async (args) => {
   const { mobile, projectRoot } = await loadMobile(valueAfter(args, "--config"));
-  const result = await inspectAbsoluteMobileRelease(mobile, projectRoot);
+  const platform6 = args.find((value) => value === "android" || value === "ios");
+  const effectiveMobile = platform6 ? { ...mobile, platforms: [platform6] } : mobile;
+  const result = await inspectAbsoluteMobileRelease(effectiveMobile, projectRoot);
   if (args.includes("--json")) {
-    console.log(JSON.stringify(result, null, 2));
+    console.log(JSON.stringify(createAbsoluteMobileComplianceReport(effectiveMobile, result), null, 2));
   } else {
     result.checks.forEach((check2) => {
       console.log(`${doctorMark(check2.status)} ${check2.detail}${check2.path ? ` (${check2.path})` : ""}`);
@@ -19465,8 +20348,8 @@ var NOT_FOUND3 = -1, isRecord15 = (value) => typeof value === "object" && value
         console.log(`  ${check2.remediation}`);
     });
     console.log(result.ready ? `
-Mobile release transport checks passed.` : `
-Mobile release transport checks failed.`);
+Mobile release security and compliance checks passed.` : `
+Mobile release security and compliance checks failed.`);
   }
   if (!result.ready) {
     throw new TypeError("Mobile release validation failed. Resolve every failed check before signing or publishing the app.");
@@ -19613,6 +20496,27 @@ Mobile release transport checks failed.`);
     status: check2.status
   })));
   throw new TypeError("Android release validation failed before Gradle signing.");
+}, androidCiSigning = () => {
+  const keyAlias = process.env.ABSOLUTE_ANDROID_KEY_ALIAS;
+  const keyPassword = process.env.ABSOLUTE_ANDROID_KEY_PASSWORD;
+  const keystorePath = process.env.ABSOLUTE_ANDROID_KEYSTORE_PATH;
+  const storePassword = process.env.ABSOLUTE_ANDROID_KEYSTORE_PASSWORD;
+  const supplied = [
+    keyAlias,
+    keyPassword,
+    keystorePath,
+    storePassword
+  ].filter((value) => value !== undefined && value !== "").length;
+  if (supplied === 0)
+    return;
+  if (!keyAlias || !keyPassword || !keystorePath || !storePassword)
+    throw new TypeError("AbsoluteJS CI signing requires ABSOLUTE_ANDROID_KEYSTORE_PATH, ABSOLUTE_ANDROID_KEYSTORE_PASSWORD, ABSOLUTE_ANDROID_KEY_ALIAS, and ABSOLUTE_ANDROID_KEY_PASSWORD together.");
+  return {
+    keyAlias,
+    keyPasswordEnvironment: "ABSOLUTE_ANDROID_KEY_PASSWORD",
+    keystorePath,
+    storePasswordEnvironment: "ABSOLUTE_ANDROID_KEYSTORE_PASSWORD"
+  };
 }, buildAndroid = async (args, prepareVersionCode) => {
   const configPath2 = valueAfter(args, "--config");
   const { mobile, projectRoot } = await loadMobile(configPath2);
@@ -19639,13 +20543,14 @@ Mobile release transport checks failed.`);
       config: mobile,
       outputDirectory: valueAfter(args, "--outdir"),
       projectRoot,
+      signing: androidCiSigning(),
       ...prepareVersionCode === undefined ? {} : { prepareVersionCode }
     });
     success = true;
     const durationMs = Math.round(performance.now() - startedAt);
     console.log(`Built ${release.metadata.signed ? "signed" : "unsigned"} Android App Bundle in ${getDurationString(durationMs)}.`);
     console.log(`Artifact: ${release.artifactPath}`);
-    console.log(`Metadata: ${join53(release.releaseRoot, "release.json")}`);
+    console.log(`Metadata: ${join54(release.releaseRoot, "release.json")}`);
     return release;
   } finally {
     sendTelemetryEvent("mobile:android-release-build", {
@@ -19740,6 +20645,7 @@ Mobile release transport checks failed.`);
     const release = await buildAbsoluteIosRelease({
       allowUnsigned: args.includes("--unsigned"),
       config: mobile,
+      developmentTeam: process.env.ABSOLUTE_IOS_DEVELOPMENT_TEAM,
       outputDirectory: valueAfter(args, "--outdir"),
       ...prepareBuildNumber === undefined ? {} : { prepareBuildNumber },
       projectRoot
@@ -19748,7 +20654,7 @@ Mobile release transport checks failed.`);
     const durationMs = Math.round(performance.now() - startedAt);
     console.log(`Built ${release.metadata.signed ? "signed" : "unsigned"} iOS IPA ${release.metadata.marketingVersion}${release.metadata.buildNumber ? ` (${release.metadata.buildNumber})` : ""} in ${getDurationString(durationMs)}.`);
     console.log(`Artifact: ${release.artifactPath}`);
-    console.log(`Metadata: ${join53(release.releaseRoot, "release.json")}`);
+    console.log(`Metadata: ${join54(release.releaseRoot, "release.json")}`);
     return release;
   } finally {
     sendTelemetryEvent("mobile:ios-release-build", {
@@ -19855,7 +20761,7 @@ Mobile release transport checks failed.`);
     checks.push({
       id: "sync.storage-schema",
       label: `Offline schema ${schema.components.map((component2) => `${component2.id}@${component2.version}`).join(", ")}`,
-      path: join53(projectRoot, "package.json"),
+      path: join54(projectRoot, "package.json"),
       platform: "host",
       status: "pass"
     });
@@ -19863,7 +20769,7 @@ Mobile release transport checks failed.`);
     checks.push({
       id: "sync.storage-schema",
       label: "Offline schema metadata is invalid",
-      path: join53(projectRoot, "package.json"),
+      path: join54(projectRoot, "package.json"),
       platform: "host",
       remediation: error instanceof Error ? error.message : String(error),
       status: "fail"
@@ -19948,7 +20854,7 @@ Emulator setup verification:`);
     }
     return { https: args.includes("--https"), port };
   }
-  const instances = listLiveInstances().filter((instance2) => resolve42(instance2.cwd) === resolve42(projectRoot) && instance2.source === "dev" && instance2.port !== null);
+  const instances = listLiveInstances().filter((instance2) => resolve44(instance2.cwd) === resolve44(projectRoot) && instance2.source === "dev" && instance2.port !== null);
   if (instances.length !== 1) {
     throw new TypeError(instances.length === 0 ? "No running AbsoluteJS dev server was found for this project. Start `bun dev`, wait for Android to report ready, then run `absolute mobile test android`." : "Multiple dev servers are running for this project. Select one with mobile test android --port <port>.");
   }
@@ -19991,8 +20897,8 @@ Emulator setup verification:`);
   }
   return selected;
 }, safeArtifactRoot = (projectRoot, value) => {
-  const root = resolve42(projectRoot, value ?? ".absolutejs/mobile/test-artifacts");
-  if (root !== projectRoot && !root.startsWith(`${resolve42(projectRoot)}/`)) {
+  const root = resolve44(projectRoot, value ?? ".absolutejs/mobile/test-artifacts");
+  if (root !== projectRoot && !root.startsWith(`${resolve44(projectRoot)}/`)) {
     throw new TypeError("mobile test --artifacts must remain inside the project.");
   }
   return root;
@@ -20016,12 +20922,12 @@ Emulator setup verification:`);
     timeoutMs
   });
 }, writeAndroidFailureArtifacts = async (options) => {
-  await mkdir14(options.artifactRoot, { recursive: true });
-  const screenshot = options.session ? await options.session.screenshot(join53(options.artifactRoot, "android-failure.png")).catch(() => {
+  await mkdir15(options.artifactRoot, { recursive: true });
+  const screenshot = options.session ? await options.session.screenshot(join54(options.artifactRoot, "android-failure.png")).catch(() => {
     return;
   }) : undefined;
-  const diagnosticPath = join53(options.artifactRoot, "android-failure.json");
-  await writeFile16(diagnosticPath, `${JSON.stringify({
+  const diagnosticPath = join54(options.artifactRoot, "android-failure.json");
+  await writeFile17(diagnosticPath, `${JSON.stringify({
     diagnostics: options.session?.diagnostics ?? [],
     error: options.error instanceof Error ? options.error.message : String(options.error),
     platform: "android",
@@ -20084,7 +20990,7 @@ Emulator setup verification:`);
       console.log(JSON.stringify(report, null, 2));
     else
       printAndroidTestReport(report);
-    const screenshot = reportRoot ? await session.screenshot(join53(artifactRoot, "android-emulator.png")) : undefined;
+    const screenshot = reportRoot ? await session.screenshot(join54(artifactRoot, "android-emulator.png")) : undefined;
     await writeRequestedAndroidReport({
       adb,
       args,
@@ -20152,14 +21058,14 @@ Emulator setup verification:`);
     const port = Number(explicit);
     if (!Number.isInteger(port) || port < 1 || port > 65535)
       throw new TypeError("mobile test --port must be a valid TCP port.");
-    const instance2 = listLiveInstances().find((candidate) => resolve42(candidate.cwd) === resolve42(projectRoot) && candidate.source === "dev" && candidate.port === port);
+    const instance2 = listLiveInstances().find((candidate) => resolve44(candidate.cwd) === resolve44(projectRoot) && candidate.source === "dev" && candidate.port === port);
     return {
       https: instance2?.https ?? args.includes("--https"),
       instance: instance2,
       port
     };
   }
-  const instances = listLiveInstances().filter((instance2) => resolve42(instance2.cwd) === resolve42(projectRoot) && instance2.source === "dev" && instance2.port !== null);
+  const instances = listLiveInstances().filter((instance2) => resolve44(instance2.cwd) === resolve44(projectRoot) && instance2.source === "dev" && instance2.port !== null);
   if (instances.length !== 1)
     throw new TypeError(instances.length === 0 ? "No running AbsoluteJS dev server was found for this project. Start `bun dev`, wait for iOS to report ready, then run `absolute mobile test ios`." : "Multiple dev servers are running for this project. Select one with mobile test ios --port <port>.");
   const [instance] = instances;
@@ -20214,7 +21120,7 @@ Emulator setup verification:`);
   if (!instance)
     return;
   const index = instance.command.indexOf("--ios-device");
-  return index === NOT_FOUND3 ? undefined : instance.command[index + 1];
+  return index === NOT_FOUND4 ? undefined : instance.command[index + 1];
 }, physicalIosCapture = async (options) => {
   const remoteName = valueAfter(options.args, "--remote");
   if (remoteName && options.instance.iosRemoteMac && remoteName !== options.instance.iosRemoteMac)
@@ -20273,8 +21179,8 @@ Emulator setup verification:`);
     throw new Error(`${label} failed: ${result.stderr.trim() || result.stdout.trim() || `status ${result.exitCode}`}`);
   return result;
 }, writeIosFailureArtifacts = async (options) => {
-  await mkdir14(options.artifactRoot, { recursive: true });
-  const screenshot = join53(options.artifactRoot, "ios-failure.png");
+  await mkdir15(options.artifactRoot, { recursive: true });
+  const screenshot = join54(options.artifactRoot, "ios-failure.png");
   const screenshotResult = captureCommand4([
     options.xcrun,
     "simctl",
@@ -20283,8 +21189,8 @@ Emulator setup verification:`);
     "screenshot",
     screenshot
   ]);
-  const diagnosticPath = join53(options.artifactRoot, "ios-failure.json");
-  await writeFile16(diagnosticPath, `${JSON.stringify({
+  const diagnosticPath = join54(options.artifactRoot, "ios-failure.json");
+  await writeFile17(diagnosticPath, `${JSON.stringify({
     appId: options.appId,
     error: options.error instanceof Error ? options.error.message : String(options.error),
     platform: "ios",
@@ -20300,7 +21206,7 @@ Emulator setup verification:`);
   };
 }, nativeReportRoot = (args, projectRoot, platform6) => {
   const index = args.indexOf("--report");
-  if (index === NOT_FOUND3)
+  if (index === NOT_FOUND4)
     return;
   const candidate = args[index + 1];
   const explicit = candidate?.startsWith("--") ? undefined : candidate;
@@ -20309,8 +21215,8 @@ Emulator setup verification:`);
 }, absolutejsVersionForReport = async () => {
   let absolutejsVersion = process.env.ABSOLUTE_VERSION ?? "unknown";
   const versions = await Promise.all([
-    resolve42(import.meta.dir, "..", "..", "package.json"),
-    resolve42(import.meta.dir, "..", "..", "..", "package.json")
+    resolve44(import.meta.dir, "..", "..", "package.json"),
+    resolve44(import.meta.dir, "..", "..", "..", "package.json")
   ].map((candidate) => readPackageVersionForIosReport(candidate).catch(() => "unknown")));
   for (const version2 of versions) {
     if (version2 === "unknown")
@@ -20528,8 +21434,8 @@ Emulator setup verification:`);
       mobile.appId
     ], "iOS app launch");
     await waitForIosHmrClient({ https, port, timeoutMs });
-    await mkdir14(artifactRoot, { recursive: true });
-    const screenshot = join53(artifactRoot, "ios-simulator.png");
+    await mkdir15(artifactRoot, { recursive: true });
+    const screenshot = join54(artifactRoot, "ios-simulator.png");
     requireCapturedCommand([xcrun, "simctl", "io", simulator.udid, "screenshot", screenshot], "iOS simulator screenshot");
     const hmrApply = await waitForRequestedIosHmr(args, instance, timeoutMs);
     const report = {
@@ -20638,6 +21544,10 @@ Emulator setup verification:`);
     await associations(args.slice(1));
     return;
   }
+  if (command === "ci") {
+    await generateGithubCi(args.slice(1));
+    return;
+  }
   if (command === "doctor") {
     await doctor(args.slice(1));
     return;
@@ -20670,7 +21580,7 @@ Emulator setup verification:`);
     await publishIos(args.slice(2));
     return;
   }
-  throw new TypeError("Usage: absolute mobile <pair mac <name> <user@host> [--port n] [--workspace path] | remotes [--json] | unpair mac <name> | init [--no-native] [--force] | sync [ios|android] | inspect [--json] | associations [--outdir dir] [--verify] | doctor [ios|android|release] [--remote name] [--json|--fix [--yes]] | build <android|ios> [server-entry] [--outdir dir] [--web-outdir dir] [--unsigned] | publish android [server-entry] [--registry module] [--channel name] [--play-track track] [--play-status completed|draft|halted|in-progress] [--play-rollout fraction] [--play-name name] [--play-notes language=text] [--play-update-priority 0..5] [--play-hold-review] [--play-cancel-existing-review] [--outdir dir] [--web-outdir dir] [--unsigned] | publish ios [server-entry] [--registry module] [--channel name] [--testflight-group name-or-id] [--testflight-notes locale=text] [--testflight-submit-review] [--outdir dir] [--web-outdir dir] [--unsigned] | test android [--route path] [--wait-for-hmr] [--report [dir]] [--timeout ms] [--port n] [--serial id] [--artifacts dir] [--json] | test ios [--device identifier [--remote name] | --udid id] [--wait-for-hmr] [--report [dir]] [--timeout ms] [--port n] [--artifacts dir] [--json]> [--config path]");
+  throw new TypeError("Usage: absolute mobile <pair mac <name> <user@host> [--port n] [--workspace path] | remotes [--json] | unpair mac <name> | init [--no-native] [--force] | sync [ios|android] | inspect [--json] [--require-bundle] | associations [--outdir dir] [--verify] | ci github [server-entry] [--publish] [--registry module] [--secret-env NAME] [--output path] [--force] [--json] | doctor [ios|android|release [ios|android]] [--remote name] [--json|--fix [--yes]] | build <android|ios> [server-entry] [--outdir dir] [--web-outdir dir] [--unsigned] | publish android [server-entry] [--registry module] [--channel name] [--play-track track] [--play-status completed|draft|halted|in-progress] [--play-rollout fraction] [--play-name name] [--play-notes language=text] [--play-update-priority 0..5] [--play-hold-review] [--play-cancel-existing-review] [--outdir dir] [--web-outdir dir] [--unsigned] | publish ios [server-entry] [--registry module] [--channel name] [--testflight-group name-or-id] [--testflight-notes locale=text] [--testflight-submit-review] [--outdir dir] [--web-outdir dir] [--unsigned] | test android [--route path] [--wait-for-hmr] [--report [dir]] [--timeout ms] [--port n] [--serial id] [--artifacts dir] [--json] | test ios [--device identifier [--remote name] | --udid id] [--wait-for-hmr] [--report [dir]] [--timeout ms] [--port n] [--artifacts dir] [--json]> [--config path]");
 };
 var init_mobile = __esm(() => {
   init_dependencies();
@@ -20705,6 +21615,7 @@ var init_mobile = __esm(() => {
   init_syncSchema();
   init_deviceCapabilities();
   init_mobileInspect();
+  init_ciWorkflow();
   CAPACITOR_PACKAGES = [
     "@capacitor/core",
     "@capacitor/app",
@@ -20740,11 +21651,11 @@ var exports_typecheck = {};
 __export(exports_typecheck, {
   typecheck: () => typecheck
 });
-import { resolve as resolve43, join as join54 } from "path";
-import { existsSync as existsSync42, readFileSync as readFileSync40 } from "fs";
-import { mkdir as mkdir15, writeFile as writeFile17 } from "fs/promises";
-var isCommandService3 = (service) => service.kind === "command" || Array.isArray(service.command), resolveConfigPath = (configPath2) => resolve43(configPath2 ?? process.env.ABSOLUTE_CONFIG ?? "absolute.config.ts"), getTypecheckTargets = async (configPath2) => {
-  if (!existsSync42(resolveConfigPath(configPath2))) {
+import { resolve as resolve45, join as join55 } from "path";
+import { existsSync as existsSync43, readFileSync as readFileSync40 } from "fs";
+import { mkdir as mkdir16, writeFile as writeFile18 } from "fs/promises";
+var isCommandService3 = (service) => service.kind === "command" || Array.isArray(service.command), resolveConfigPath = (configPath2) => resolve45(configPath2 ?? process.env.ABSOLUTE_CONFIG ?? "absolute.config.ts"), getTypecheckTargets = async (configPath2) => {
+  if (!existsSync43(resolveConfigPath(configPath2))) {
     const defaultService = {};
     return [defaultService];
   }
@@ -20765,8 +21676,8 @@ var isCommandService3 = (service) => service.kind === "command" || Array.isArray
   const exitCode = await proc.exited;
   return { exitCode, name, output: (stdout + stderr).trim() };
 }, shellEscape = (value) => `'${value.replaceAll("'", "'\\''")}'`, runShell = async (name, command) => run(name, ["/bin/bash", "-lc", command]), findBin = (name) => {
-  const local = resolve43("node_modules", ".bin", name);
-  return existsSync42(local) ? local : null;
+  const local = resolve45("node_modules", ".bin", name);
+  return existsSync43(local) ? local : null;
 }, ANSI_COLOR_REGEX, ANSI_PURPLE_REGEX, ANSI_CYAN_REGEX, ANSI_TOKEN_END_REGEX, stripAnsi4 = (str) => str.replace(ANSI_COLOR_REGEX, ""), formatSvelteOutput = (output) => {
   const cwd = `${process.cwd()}/`;
   const summaryMatch = stripAnsi4(output).match(/svelte-check found (\d+) error/);
@@ -20813,15 +21724,15 @@ Found ${errorCount} error${suffix}.`;
   return formatted;
 }, ABSOLUTE_INTERNAL_EXCLUDES, resolveAbsoluteTypeFile = (fileName) => {
   const candidates = [
-    resolve43("node_modules/@absolutejs/absolute/dist/types", fileName),
-    resolve43(import.meta.dir, "../types", fileName),
-    resolve43(import.meta.dir, "../../types", fileName),
-    resolve43(import.meta.dir, "../../../types", fileName)
+    resolve45("node_modules/@absolutejs/absolute/dist/types", fileName),
+    resolve45(import.meta.dir, "../types", fileName),
+    resolve45(import.meta.dir, "../../types", fileName),
+    resolve45(import.meta.dir, "../../../types", fileName)
   ];
-  return candidates.find((candidate) => existsSync42(candidate)) ?? candidates[0];
+  return candidates.find((candidate) => existsSync43(candidate)) ?? candidates[0];
 }, ABSOLUTE_TYPECHECK_FILES, readProjectTsconfig = () => {
   try {
-    return JSON.parse(readFileSync40(resolve43("tsconfig.json"), "utf-8"));
+    return JSON.parse(readFileSync40(resolve45("tsconfig.json"), "utf-8"));
   } catch {
     return {};
   }
@@ -20849,27 +21760,27 @@ Found ${errorCount} error${suffix}.`;
     console.error("\x1B[31m\u2717\x1B[0m vue-tsc is required for Vue type checking. Install it: bun add -d vue-tsc");
     process.exit(1);
   }
-  const vueTsconfigPath = join54(cacheDir, "tsconfig.vue-check.json");
-  await writeFile17(vueTsconfigPath, JSON.stringify({
+  const vueTsconfigPath = join55(cacheDir, "tsconfig.vue-check.json");
+  await writeFile18(vueTsconfigPath, JSON.stringify({
     compilerOptions: {
       rootDir: ".."
     },
     exclude: getProjectTypecheckExcludes(),
-    extends: resolve43("tsconfig.json"),
+    extends: resolve45("tsconfig.json"),
     include: getProjectTypecheckIncludes()
   }, null, "\t"));
   const base = [
     vueTscBin,
     "--noEmit",
     "--project",
-    resolve43(vueTsconfigPath),
+    resolve45(vueTsconfigPath),
     "--pretty"
   ];
   const cached = await run("vue-tsc", [
     ...base,
     "--incremental",
     "--tsBuildInfoFile",
-    join54(cacheDir, "vue-tsc.tsbuildinfo")
+    join55(cacheDir, "vue-tsc.tsbuildinfo")
   ]);
   if (cached.exitCode === 0 || cached.output.length > 0)
     return cached;
@@ -20880,8 +21791,8 @@ Found ${errorCount} error${suffix}.`;
     console.error("\x1B[31m\u2717\x1B[0m @angular/compiler-cli is required for Angular type checking. Install it: bun add -d @angular/compiler-cli");
     process.exit(1);
   }
-  const angularTsconfigPath = join54(cacheDir, "tsconfig.angular-check.json");
-  await writeFile17(angularTsconfigPath, JSON.stringify({
+  const angularTsconfigPath = join55(cacheDir, "tsconfig.angular-check.json");
+  await writeFile18(angularTsconfigPath, JSON.stringify({
     angularCompilerOptions: {
       strictTemplates: true
     },
@@ -20890,32 +21801,32 @@ Found ${errorCount} error${suffix}.`;
       rootDir: ".."
     },
     exclude: ABSOLUTE_INTERNAL_EXCLUDES.map(toGeneratedConfigPath),
-    extends: resolve43("tsconfig.json"),
+    extends: resolve45("tsconfig.json"),
     include: [`../${angularDir}/**/*`]
   }, null, "\t"));
-  return runShell("ngc", `${shellEscape(ngcBin)} -p ${shellEscape(resolve43(angularTsconfigPath))}`);
+  return runShell("ngc", `${shellEscape(ngcBin)} -p ${shellEscape(resolve45(angularTsconfigPath))}`);
 }, buildTscCheck = (cacheDir) => {
   const tscBin = findBin("tsc");
   if (!tscBin) {
     console.error("\x1B[31m\u2717\x1B[0m typescript is required for type checking. Install it: bun add -d typescript");
     process.exit(1);
   }
-  const tscConfigPath = join54(cacheDir, "tsconfig.typecheck.json");
-  return writeFile17(tscConfigPath, JSON.stringify({
+  const tscConfigPath = join55(cacheDir, "tsconfig.typecheck.json");
+  return writeFile18(tscConfigPath, JSON.stringify({
     compilerOptions: {
       rootDir: ".."
     },
     exclude: getProjectTypecheckExcludes(),
-    extends: resolve43("tsconfig.json"),
+    extends: resolve45("tsconfig.json"),
     include: getProjectTypecheckIncludes()
   }, null, "\t")).then(() => run("tsc", [
     tscBin,
     "--noEmit",
     "--project",
-    resolve43(tscConfigPath),
+    resolve45(tscConfigPath),
     "--incremental",
     "--tsBuildInfoFile",
-    join54(cacheDir, "tsc.tsbuildinfo"),
+    join55(cacheDir, "tsc.tsbuildinfo"),
     "--pretty"
   ]));
 }, buildSvelteCheck = async (cacheDir, svelteDir) => {
@@ -20924,16 +21835,16 @@ Found ${errorCount} error${suffix}.`;
     console.error("\x1B[31m\u2717\x1B[0m svelte-check is required for Svelte type checking. Install it: bun add -d svelte-check");
     process.exit(1);
   }
-  const svelteTsconfigPath = join54(cacheDir, "tsconfig.svelte-check.json");
-  await writeFile17(svelteTsconfigPath, JSON.stringify({
-    extends: resolve43("tsconfig.json"),
+  const svelteTsconfigPath = join55(cacheDir, "tsconfig.svelte-check.json");
+  await writeFile18(svelteTsconfigPath, JSON.stringify({
+    extends: resolve45("tsconfig.json"),
     files: ABSOLUTE_TYPECHECK_FILES,
     include: [`../${svelteDir}/**/*`]
   }, null, "\t"));
   return run("svelte-check", [
     svelteBin,
     "--tsconfig",
-    resolve43(svelteTsconfigPath),
+    resolve45(svelteTsconfigPath),
     "--threshold",
     "error",
     "--compiler-warnings",
@@ -20954,7 +21865,7 @@ Found ${errorCount} error${suffix}.`;
     ...new Set(targets.map((config) => config.angularDirectory).filter((dir) => typeof dir === "string" && dir.length > 0))
   ];
   const cacheDir = ".absolutejs";
-  await mkdir15(cacheDir, { recursive: true });
+  await mkdir16(cacheDir, { recursive: true });
   const checks = [];
   checks.push(hasVue ? buildVueTscCheck(cacheDir) : buildTscCheck(cacheDir));
   for (const svelteDir of hasSvelte ? svelteDirs : []) {
@@ -21127,11 +22038,11 @@ var DEFAULT_RELAY_PORT = 8787, DEFAULT_REQUEST_TIMEOUT_MS = 30000, headersToObje
         url: url.pathname + url.search,
         ...bodyBytes && bodyBytes.length > 0 ? { bodyBase64: Buffer.from(bodyBytes).toString("base64") } : {}
       };
-      const responsePromise = new Promise((resolve44) => {
-        pending.set(id, resolve44);
+      const responsePromise = new Promise((resolve46) => {
+        pending.set(id, resolve46);
       });
       client.send(encodeTunnelMessage(message));
-      const timeout = new Promise((resolve44) => setTimeout(() => resolve44({ id, message: "timeout", type: "error" }), requestTimeoutMs));
+      const timeout = new Promise((resolve46) => setTimeout(() => resolve46({ id, message: "timeout", type: "error" }), requestTimeoutMs));
       const result = await Promise.race([responsePromise, timeout]);
       pending.delete(id);
       if (result.type === "error") {
@@ -25044,7 +25955,7 @@ if (command === "dev") {
   console.error("  prepare [entry] [--outdir dir] Build production assets and server without launching");
   console.error("  start [entry] [--outdir dir] [--prebuilt] Start production server");
   console.error("  compile [entry] [--outdir dir] [--outfile path] Compile standalone executable");
-  console.error("  mobile <init|sync|inspect|pair|remotes|doctor|test> Manage Capacitor projects, simulators, physical devices, Remote Macs, guided setup, and deep links");
+  console.error("  mobile <init|sync|inspect|ci|pair|remotes|doctor|test> Manage Capacitor projects, CI, simulators, physical devices, Remote Macs, guided setup, and deep links");
   console.error("  config [--port n] Open the unified config UI (ESLint, tsconfig, Prettier)");
   console.error("  db <backup|restore|seed> Backup/restore any Postgres DB (ORM-agnostic, upsert by PK) or run the seed script");
   console.error("  doctor [--fix] [--json] Diagnose the project (bun, type graph, config, framework dirs, env, port)");