@absolutejs/absolute 0.20.0-beta.38 → 0.20.0-beta.39

package/dist/cli/index.js

@@ -2589,7 +2589,14 @@ import {
   writeFile as writeFile3
 } from "fs/promises";
 import { dirname as dirname4, isAbsolute as isAbsolute2, join as join9, relative as relative3, resolve as resolve6, sep as sep2 } from "path";
-var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), requireManifest = (value) => {
+var developmentTeamArgument = (value) => {
+  if (value === undefined)
+    return;
+  const team = value.trim().toUpperCase();
+  if (!/^[A-Z0-9]{10}$/u.test(team))
+    throw new TypeError("iOS development team must contain ten letters or digits.");
+  return `DEVELOPMENT_TEAM=${team}`;
+}, isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), requireManifest = (value) => {
   if (!isRecord2(value) || typeof value.appBuild !== "string" || typeof value.appId !== "string" || typeof value.runtime !== "string") {
     throw new TypeError("Invalid embedded AbsoluteJS mobile manifest.");
   }
@@ -2762,8 +2769,10 @@ var isRecord2 = (value) => typeof value === "object" && value !== null && !Array
   await writeFile3(exportPlist, exportOptions());
   const run = options.run ?? defaultRun2;
   try {
+    const developmentTeam = developmentTeamArgument(options.developmentTeam);
     const versionArguments = [
       `MARKETING_VERSION=${marketingVersion}`,
+      ...developmentTeam ? [developmentTeam] : [],
       ...buildNumber === undefined ? [] : [`CURRENT_PROJECT_VERSION=${buildNumber}`]
     ];
     const archiveExit = await run([
@@ -18740,6 +18749,20 @@ var ABSOLUTE_ANDROID_RELEASE_FORMAT = 1, isRecord13 = (value) => typeof value ==
     artifactPath
   ]);
   return result.exitCode === 0 && /jar verified/iu.test(result.stdout);
+}, signAab = (artifactPath, capture, jarsigner, signing) => {
+  const result = capture([
+    jarsigner,
+    "-keystore",
+    signing.keystorePath,
+    "-storepass:env",
+    signing.storePasswordEnvironment,
+    "-keypass:env",
+    signing.keyPasswordEnvironment,
+    artifactPath,
+    signing.keyAlias
+  ]);
+  if (result.exitCode !== 0)
+    throw new TypeError("jarsigner could not sign the Android App Bundle with the configured CI identity.");
 }, sha256File2 = async (path) => createHash13("sha256").update(await readFile18(path)).digest("hex"), safeOutputDirectory2 = (projectRoot, requested) => {
   const root = resolve40(projectRoot);
   const output = resolve40(root, requested ?? ".absolutejs/mobile/releases/android");
@@ -18830,7 +18853,16 @@ var ABSOLUTE_ANDROID_RELEASE_FORMAT = 1, isRecord13 = (value) => typeof value ==
     throw new TypeError(`Android Gradle did not produce the expected App Bundle: ${artifactPath}`);
   }
   const capture = options.capture ?? defaultCapture4;
-  const signed2 = verifyAabSignature(artifactPath, capture, options.jarsigner);
+  const jarsigner = options.jarsigner === undefined ? Bun.which("jarsigner") : options.jarsigner;
+  let signed2 = verifyAabSignature(artifactPath, capture, jarsigner);
+  if (signed2 === false && options.signing) {
+    if (!jarsigner)
+      throw new TypeError("Could not sign the Android App Bundle because jarsigner is unavailable.");
+    signAab(artifactPath, capture, jarsigner, options.signing);
+    signed2 = verifyAabSignature(artifactPath, capture, jarsigner);
+    if (!signed2)
+      throw new TypeError("Android App Bundle signature verification failed after CI signing.");
+  }
   if (signed2 === null && !options.allowUnsigned) {
     throw new TypeError("Could not verify the Android App Bundle signature because jarsigner is unavailable. Install a JDK, or use --unsigned only for a non-publishable build.");
   }
@@ -19413,9 +19445,9 @@ var prepareAbsoluteIosRelease = async (publisher, options) => {
 var init_releasePublisher = () => {};
 
 // src/mobile/mobileInspect.ts
-import { access as access12, readFile as readFile21, stat as stat5 } from "fs/promises";
+import { access as access12, readFile as readFile21 } from "fs/promises";
 import { join as join53, relative as relative28, resolve as resolve42 } from "path";
-var ABSOLUTE_MOBILE_INSPECTION_FORMAT = 1, MOBILE_PACKAGE_NAMES, MOBILE_FRAMEWORKS2, isObject3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), portablePath2 = (projectRoot, path) => {
+var ABSOLUTE_MOBILE_INSPECTION_FORMAT = 1, MOBILE_PACKAGE_NAMES, isObject3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), portablePath2 = (projectRoot, path) => {
   const value = relative28(resolve42(projectRoot), resolve42(path)).replaceAll("\\", "/");
   return value || ".";
 }, pathExists8 = async (path) => {
@@ -19430,103 +19462,6 @@ var ABSOLUTE_MOBILE_INSPECTION_FORMAT = 1, MOBILE_PACKAGE_NAMES, MOBILE_FRAMEWOR
   if (!isObject3(value))
     throw new TypeError("JSON root must be an object.");
   return value;
-}, requireString2 = (value, field) => {
-  if (typeof value !== "string" || value.length === 0)
-    throw new TypeError(`${field} must be a non-empty string.`);
-  return value;
-}, requireStringArray2 = (value, field) => {
-  if (!Array.isArray(value) || !value.every((item) => typeof item === "string"))
-    throw new TypeError(`${field} must be a string array.`);
-  return value;
-}, requireBundleFile2 = async (root, value, field) => {
-  const portable = requireString2(value, field);
-  const path = resolve42(root, portable);
-  const normalizedRoot = resolve42(root);
-  if (path === normalizedRoot || !path.startsWith(`${normalizedRoot}/`))
-    throw new TypeError(`${field} must remain inside the mobile bundle.`);
-  if (!(await stat5(path).catch(() => {
-    return;
-  }))?.isFile())
-    throw new TypeError(`${field} does not exist in the mobile bundle.`);
-  return portable;
-}, inspectBundle = async (config, projectRoot) => {
-  const manifestPath = join53(config.bundleDirectory, "absolute-mobile-manifest.json");
-  const manifest = portablePath2(projectRoot, manifestPath);
-  if (!await pathExists8(manifestPath))
-    return { manifest, status: "missing" };
-  try {
-    const value = await readObject2(manifestPath);
-    if (value.format !== 1)
-      throw new TypeError("format is not supported by this runtime.");
-    if (requireString2(value.appId, "appId") !== config.appId)
-      throw new TypeError("appId does not match the effective mobile config.");
-    if (requireString2(value.productionOrigin, "productionOrigin") !== config.productionOrigin)
-      throw new TypeError("productionOrigin does not match the effective mobile config.");
-    const appBuild = requireString2(value.appBuild, "appBuild");
-    const runtime = requireString2(value.runtime, "runtime");
-    const capabilities = requireStringArray2(value.deviceCapabilities, "deviceCapabilities").sort();
-    if (!Array.isArray(value.pages) || !Array.isArray(value.routes))
-      throw new TypeError("pages and routes must be arrays.");
-    const pageIds = new Set;
-    const frameworks7 = new Set;
-    await Promise.all(value.pages.map(async (candidate) => {
-      if (!isObject3(candidate))
-        throw new TypeError("pages contains an invalid entry.");
-      const pageId = requireString2(candidate.pageId, "page.pageId");
-      if (pageIds.has(pageId))
-        throw new TypeError("page.pageId values must be unique.");
-      pageIds.add(pageId);
-      const framework = requireString2(candidate.framework, "page.framework");
-      if (!MOBILE_FRAMEWORKS2.has(framework))
-        throw new TypeError("page.framework is unsupported.");
-      frameworks7.add(framework);
-      requireString2(candidate.bundleHash, "page.bundleHash");
-      requireString2(candidate.contract, "page.contract");
-      requireString2(candidate.propsSchemaHash, "page.propsSchemaHash");
-      await requireBundleFile2(config.bundleDirectory, candidate.localBundlePath, "page.localBundlePath");
-      if (candidate.localStylePath !== undefined)
-        await requireBundleFile2(config.bundleDirectory, candidate.localStylePath, "page.localStylePath");
-    }));
-    const routes = value.routes.map((candidate) => {
-      if (!isObject3(candidate))
-        throw new TypeError("routes contains an invalid entry.");
-      const { method } = candidate;
-      if (method !== "GET" && method !== "HEAD")
-        throw new TypeError("route.method must be GET or HEAD.");
-      const pageId = requireString2(candidate.pageId, "route.pageId");
-      if (!pageIds.has(pageId))
-        throw new TypeError("route.pageId references a missing page.");
-      return {
-        method,
-        pageId,
-        pattern: requireString2(candidate.pattern, "route.pattern")
-      };
-    });
-    await Promise.all(["index.html", "absolute-mobile-bootstrap.js"].map((file) => requireBundleFile2(config.bundleDirectory, file, file)));
-    const entryPath = new URL(config.entry, "https://absolute.invalid").pathname;
-    const entryResolved = resolveAbsoluteMobileRoute(routes, entryPath) !== undefined;
-    if (!entryResolved)
-      throw new TypeError("entry is not owned by an embedded route.");
-    return {
-      appBuild,
-      auth: isObject3(value.auth),
-      capabilities,
-      entryResolved,
-      frameworks: [...frameworks7].sort(),
-      manifest,
-      pageCount: value.pages.length,
-      routeCount: value.routes.length,
-      runtime,
-      status: "valid",
-      sync: isObject3(value.sync)
-    };
-  } catch (error) {
-    return {
-      issue: error instanceof Error ? error.message : "The embedded mobile manifest is invalid.",
-      manifest,
-      status: "invalid"
-    };
-  }
 }, addPackageDeclarations = (declarations, value) => {
   if (!isObject3(value))
     return;
@@ -19550,7 +19485,7 @@ var ABSOLUTE_MOBILE_INSPECTION_FORMAT = 1, MOBILE_PACKAGE_NAMES, MOBILE_FRAMEWOR
     };
   }));
 }, inspectAbsoluteMobileProject = async (config, projectRoot, options = {}) => {
-  const bundle = await inspectBundle(config, projectRoot);
+  const bundle = await inspectAbsoluteMobileBundle(config, projectRoot);
   let currentCapabilities = [];
   let capabilityIssue;
   let plugins = [];
@@ -19643,7 +19578,7 @@ var ABSOLUTE_MOBILE_INSPECTION_FORMAT = 1, MOBILE_PACKAGE_NAMES, MOBILE_FRAMEWOR
 var init_mobileInspect = __esm(() => {
   init_deviceCapabilities();
   init_releaseDoctor();
-  init_routeMatcher();
+  init_mobileBundleInspection();
   MOBILE_PACKAGE_NAMES = new Set([
     "@absolutejs/absolute",
     "@absolutejs/auth",
@@ -19655,15 +19590,484 @@ var init_mobileInspect = __esm(() => {
     "@absolutejs/sync-capacitor",
     "@capacitor-community/sqlite"
   ]);
-  MOBILE_FRAMEWORKS2 = new Set([
-    "angular",
-    "ember",
-    "html",
-    "htmx",
-    "react",
-    "svelte",
-    "vue"
+});
+
+// src/mobile/ciWorkflow.ts
+import { existsSync as existsSync42 } from "fs";
+import { access as access13, mkdir as mkdir14, readFile as readFile22, writeFile as writeFile16 } from "fs/promises";
+import { dirname as dirname31, extname as extname9, relative as relative29, resolve as resolve43, sep as sep8 } from "path";
+var ABSOLUTE_MOBILE_CI_WORKFLOW_FORMAT = 1, SECRET_NAME_PATTERN, CI_ENV_INDENTATION = 6, RESERVED_SECRET_NAMES, exists3 = async (path) => {
+  try {
+    await access13(path);
+    return true;
+  } catch {
+    return false;
+  }
+}, yamlString = (value) => `'${value.replaceAll("'", "''")}'`, projectPath = (projectRoot, value, field, options = {}) => {
+  const root = resolve43(projectRoot);
+  const path = resolve43(root, value);
+  const portable = relative29(root, path).replaceAll("\\", "/");
+  if (portable === ".." || portable.startsWith(`..${sep8}`) || portable.startsWith("../") || portable === "") {
+    throw new TypeError(`${field} must remain inside the project root.`);
+  }
+  if (/\r|\n/u.test(portable) || portable.startsWith("-"))
+    throw new TypeError(`${field} contains an unsafe path.`);
+  if (!options.allowMissing && !existsSync42(path))
+    throw new TypeError(`${field} does not exist inside the project.`);
+  return portable;
+}, workflowOutputPath = (projectRoot, value) => {
+  const root = resolve43(projectRoot);
+  const workflows = resolve43(root, ".github/workflows");
+  const path = resolve43(root, value ?? ".github/workflows/absolute-mobile.yml");
+  const portable = relative29(workflows, path);
+  if (portable === ".." || portable.startsWith(`..${sep8}`) || extname9(path) !== ".yml" && extname9(path) !== ".yaml") {
+    throw new TypeError("mobile ci github --output must be a .yml or .yaml file inside .github/workflows.");
+  }
+  return path;
+}, normalizeSecretEnvironment = (values = []) => {
+  const names = [...new Set(values)].sort();
+  for (const name of names) {
+    if (!SECRET_NAME_PATTERN.test(name))
+      throw new TypeError("mobile ci github --secret-env values must be uppercase environment variable names.");
+    if (name.startsWith("GITHUB_") || name.startsWith("RUNNER_") || name.startsWith("ACTIONS_") || RESERVED_SECRET_NAMES.has(name)) {
+      throw new TypeError(`mobile ci github --secret-env cannot replace reserved variable ${name}.`);
+    }
+  }
+  return names;
+}, customSecretEnvironment = (names, indentation = CI_ENV_INDENTATION) => names.map((name) => `${" ".repeat(indentation)}${name}: \${{ secrets.${name} }}`).join(`
+`), commandEnvironment = (options) => `      ABSOLUTE_CONFIG_PATH: ${yamlString(options.configPath ?? "")}
+      ABSOLUTE_REGISTRY_MODULE: ${yamlString(options.registryModule)}
+      ABSOLUTE_SERVER_ENTRY: ${yamlString(options.serverEntry)}`, appendConfigArgument = `if [[ -n "$ABSOLUTE_CONFIG_PATH" ]]; then
+            args+=(--config "$ABSOLUTE_CONFIG_PATH")
+          fi`, installSteps = `      - name: Check out source
+        uses: actions/checkout@v6
+      - name: Install Bun
+        uses: oven-sh/setup-bun@v2
+      - name: Install exact dependencies
+        run: bun ci`, bundleAuditSteps, releaseAuditSteps = (platform6) => `      - name: Run redacted mobile release audit
+        id: mobile-release-audit
+        continue-on-error: true
+        shell: bash
+        run: |
+          mkdir -p .absolutejs/mobile-ci
+          args=(bunx absolute mobile doctor release ${platform6} --json)
+          ${appendConfigArgument}
+          "\${args[@]}" > .absolutejs/mobile-ci/compliance.json
+      - name: Upload mobile compliance report
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: absolute-mobile-compliance-\${{ github.job }}
+          path: .absolutejs/mobile-ci/compliance.json
+          if-no-files-found: error
+          retention-days: 30
+          include-hidden-files: true
+      - name: Enforce mobile release audit
+        if: steps.mobile-release-audit.outcome != 'success'
+        run: exit 1`, platformInput = (platforms) => {
+  const choices = platforms.length === 2 ? ["all", ...platforms] : platforms;
+  return `      platform:
+        description: Native platform to build
+        required: true
+        type: choice
+        default: ${choices[0]}
+        options:
+${choices.map((value) => `          - ${value}`).join(`
+`)}`;
+}, publishingInputs = (platforms, includePublishing) => {
+  if (!includePublishing)
+    return "";
+  const fields = [
+    `      publish:
+        description: Publish through mobile.release.ts after the signed build
+        required: true
+        type: boolean
+        default: false`,
+    `      channel:
+        description: Optional AbsoluteJS immutable release channel
+        required: false
+        type: string`
+  ];
+  if (platforms.includes("android"))
+    fields.push(`      play_track:
+        description: Optional Google Play track
+        required: true
+        type: choice
+        default: registry-only
+        options:
+          - registry-only
+          - internal
+          - alpha
+          - beta
+          - production`);
+  if (platforms.includes("ios")) {
+    fields.push(`      testflight_group:
+        description: Optional internal or external TestFlight group
+        required: false
+        type: string`);
+    fields.push(`      submit_testflight_review:
+        description: Explicitly submit an external TestFlight build for review
+        required: true
+        type: boolean
+        default: false`);
+  }
+  return `
+${fields.join(`
+`)}`;
+}, jobCondition = (platform6) => `github.event_name == 'workflow_dispatch' && (inputs.platform == 'all' || inputs.platform == '${platform6}')`, androidJob = (options) => {
+  const custom = customSecretEnvironment(options.customSecrets);
+  const publishEnvironment = options.includePublishing ? `
+      ABSOLUTE_PUBLISH: \${{ inputs.publish }}
+      ABSOLUTE_RELEASE_CHANNEL: \${{ inputs.channel }}
+      ABSOLUTE_PLAY_TRACK: \${{ inputs.play_track }}
+      ABSOLUTE_GOOGLE_CREDENTIALS_BASE64: \${{ secrets.ABSOLUTE_GOOGLE_CREDENTIALS_BASE64 }}
+      GOOGLE_APPLICATION_CREDENTIALS: \${{ runner.temp }}/absolute-google-credentials.json` : "";
+  const publishCommand = options.includePublishing ? `if [[ "$ABSOLUTE_PUBLISH" == "true" ]]; then
+            args=(bunx absolute mobile publish android "$ABSOLUTE_SERVER_ENTRY" --registry "$ABSOLUTE_REGISTRY_MODULE")
+            if [[ -n "$ABSOLUTE_RELEASE_CHANNEL" ]]; then
+              args+=(--channel "$ABSOLUTE_RELEASE_CHANNEL")
+            fi
+            if [[ "$ABSOLUTE_PLAY_TRACK" != "registry-only" ]]; then
+              args+=(--play-track "$ABSOLUTE_PLAY_TRACK")
+            fi
+          else
+            args=(bunx absolute mobile build android "$ABSOLUTE_SERVER_ENTRY")
+          fi` : `args=(bunx absolute mobile build android "$ABSOLUTE_SERVER_ENTRY")`;
+  const googleSetup = options.includePublishing ? `
+          if [[ "$ABSOLUTE_PUBLISH" == "true" && "$ABSOLUTE_PLAY_TRACK" != "registry-only" ]]; then
+            if [[ -z "$ABSOLUTE_GOOGLE_CREDENTIALS_BASE64" ]]; then
+              echo "ABSOLUTE_GOOGLE_CREDENTIALS_BASE64 is required for Google Play publication." >&2
+              exit 1
+            fi
+            printf '%s' "$ABSOLUTE_GOOGLE_CREDENTIALS_BASE64" | base64 --decode > "$GOOGLE_APPLICATION_CREDENTIALS"
+            chmod 600 "$GOOGLE_APPLICATION_CREDENTIALS"
+          fi` : "";
+  return `
+  android:
+    name: Signed Android release
+    needs: validate
+    if: \${{ ${jobCondition("android")} }}
+    runs-on: ubuntu-latest
+    environment: absolute-mobile-release
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
+    env:
+      ABSOLUTE_ANDROID_KEYSTORE_BASE64: \${{ secrets.ABSOLUTE_ANDROID_KEYSTORE_BASE64 }}
+      ABSOLUTE_ANDROID_KEYSTORE_PASSWORD: \${{ secrets.ABSOLUTE_ANDROID_KEYSTORE_PASSWORD }}
+      ABSOLUTE_ANDROID_KEY_ALIAS: \${{ secrets.ABSOLUTE_ANDROID_KEY_ALIAS }}
+      ABSOLUTE_ANDROID_KEY_PASSWORD: \${{ secrets.ABSOLUTE_ANDROID_KEY_PASSWORD }}
+      ABSOLUTE_ANDROID_KEYSTORE_PATH: \${{ runner.temp }}/absolute-release.jks${publishEnvironment}${custom ? `
+${custom}` : ""}
+${commandEnvironment({ configPath: undefined, registryModule: "", serverEntry: "" })}
+    steps:
+${installSteps}
+      - name: Provision Android signing
+        shell: bash
+        run: |
+          required=(
+            ABSOLUTE_ANDROID_KEYSTORE_BASE64
+            ABSOLUTE_ANDROID_KEYSTORE_PASSWORD
+            ABSOLUTE_ANDROID_KEY_ALIAS
+            ABSOLUTE_ANDROID_KEY_PASSWORD
+          )
+          for name in "\${required[@]}"; do
+            if [[ -z "\${!name}" ]]; then
+              echo "$name is required in the absolute-mobile-release environment." >&2
+              exit 1
+            fi
+          done
+          printf '%s' "$ABSOLUTE_ANDROID_KEYSTORE_BASE64" | base64 --decode > "\${{ runner.temp }}/absolute-release.jks"
+          chmod 600 "\${{ runner.temp }}/absolute-release.jks"${googleSetup}
+      - name: Build or publish Android
+        shell: bash
+        run: |
+          ${publishCommand}
+          ${appendConfigArgument}
+          "\${args[@]}"
+${releaseAuditSteps("android")}
+      - name: Attest Android App Bundle
+        if: inputs.attest
+        uses: actions/attest@v4
+        with:
+          subject-path: .absolutejs/mobile/releases/android/**/app-release.aab
+      - name: Upload Android release
+        uses: actions/upload-artifact@v7
+        with:
+          name: absolute-mobile-android
+          path: .absolutejs/mobile/releases/android/
+          if-no-files-found: error
+          retention-days: 14
+          include-hidden-files: true
+      - name: Remove Android credentials
+        if: always()
+        shell: bash
+        run: |
+          rm -f "\${{ runner.temp }}/absolute-release.jks"
+          rm -f "\${{ runner.temp }}/absolute-google-credentials.json"`;
+}, iosJob = (options) => {
+  const custom = customSecretEnvironment(options.customSecrets);
+  const publishEnvironment = options.includePublishing ? `
+      ABSOLUTE_PUBLISH: \${{ inputs.publish }}
+      ABSOLUTE_RELEASE_CHANNEL: \${{ inputs.channel }}
+      ABSOLUTE_TESTFLIGHT_GROUP: \${{ inputs.testflight_group }}
+      ABSOLUTE_TESTFLIGHT_SUBMIT_REVIEW: \${{ inputs.submit_testflight_review }}
+      APP_STORE_CONNECT_ISSUER_ID: \${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
+      APP_STORE_CONNECT_KEY_ID: \${{ secrets.APP_STORE_CONNECT_KEY_ID }}
+      APP_STORE_CONNECT_PRIVATE_KEY_BASE64: \${{ secrets.APP_STORE_CONNECT_PRIVATE_KEY_BASE64 }}
+      APP_STORE_CONNECT_PRIVATE_KEY_PATH: \${{ runner.temp }}/AuthKey_AbsoluteJS.p8` : "";
+  const publishCommand = options.includePublishing ? `if [[ "$ABSOLUTE_PUBLISH" == "true" ]]; then
+            args=(bunx absolute mobile publish ios "$ABSOLUTE_SERVER_ENTRY" --registry "$ABSOLUTE_REGISTRY_MODULE")
+            if [[ -n "$ABSOLUTE_RELEASE_CHANNEL" ]]; then
+              args+=(--channel "$ABSOLUTE_RELEASE_CHANNEL")
+            fi
+            if [[ -n "$ABSOLUTE_TESTFLIGHT_GROUP" ]]; then
+              args+=(--testflight-group "$ABSOLUTE_TESTFLIGHT_GROUP")
+            fi
+            if [[ "$ABSOLUTE_TESTFLIGHT_SUBMIT_REVIEW" == "true" ]]; then
+              args+=(--testflight-submit-review)
+            fi
+          else
+            args=(bunx absolute mobile build ios "$ABSOLUTE_SERVER_ENTRY")
+          fi` : `args=(bunx absolute mobile build ios "$ABSOLUTE_SERVER_ENTRY")`;
+  const appStoreSetup = options.includePublishing ? `
+          if [[ "$ABSOLUTE_PUBLISH" == "true" && -n "$ABSOLUTE_TESTFLIGHT_GROUP" ]]; then
+            required+=(APP_STORE_CONNECT_ISSUER_ID APP_STORE_CONNECT_KEY_ID APP_STORE_CONNECT_PRIVATE_KEY_BASE64)
+          fi` : "";
+  const appStoreDecode = options.includePublishing ? `
+          if [[ "$ABSOLUTE_PUBLISH" == "true" && -n "$ABSOLUTE_TESTFLIGHT_GROUP" ]]; then
+            printf '%s' "$APP_STORE_CONNECT_PRIVATE_KEY_BASE64" | base64 --decode > "$APP_STORE_CONNECT_PRIVATE_KEY_PATH"
+            chmod 600 "$APP_STORE_CONNECT_PRIVATE_KEY_PATH"
+          fi` : "";
+  return `
+  ios:
+    name: Signed iOS release
+    needs: validate
+    if: \${{ ${jobCondition("ios")} }}
+    runs-on: macos-latest
+    environment: absolute-mobile-release
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
+    env:
+      ABSOLUTE_IOS_CERTIFICATE_BASE64: \${{ secrets.ABSOLUTE_IOS_CERTIFICATE_BASE64 }}
+      ABSOLUTE_IOS_CERTIFICATE_PASSWORD: \${{ secrets.ABSOLUTE_IOS_CERTIFICATE_PASSWORD }}
+      ABSOLUTE_IOS_PROVISIONING_PROFILE_BASE64: \${{ secrets.ABSOLUTE_IOS_PROVISIONING_PROFILE_BASE64 }}
+      ABSOLUTE_IOS_KEYCHAIN_PASSWORD: \${{ secrets.ABSOLUTE_IOS_KEYCHAIN_PASSWORD }}${publishEnvironment}${custom ? `
+${custom}` : ""}
+      ABSOLUTE_IOS_DEVELOPMENT_TEAM: \${{ secrets.ABSOLUTE_IOS_DEVELOPMENT_TEAM }}
+${commandEnvironment({ configPath: undefined, registryModule: "", serverEntry: "" })}
+    steps:
+${installSteps}
+      - name: Provision iOS signing
+        shell: bash
+        run: |
+          required=(
+            ABSOLUTE_IOS_CERTIFICATE_BASE64
+            ABSOLUTE_IOS_CERTIFICATE_PASSWORD
+            ABSOLUTE_IOS_PROVISIONING_PROFILE_BASE64
+            ABSOLUTE_IOS_KEYCHAIN_PASSWORD
+            ABSOLUTE_IOS_DEVELOPMENT_TEAM
+          )${appStoreSetup}
+          for name in "\${required[@]}"; do
+            if [[ -z "\${!name}" ]]; then
+              echo "$name is required in the absolute-mobile-release environment." >&2
+              exit 1
+            fi
+          done
+          CERTIFICATE_PATH="\${{ runner.temp }}/absolute-signing.p12"
+          PROFILE_PATH="\${{ runner.temp }}/absolute.mobileprovision"
+          KEYCHAIN_PATH="\${{ runner.temp }}/absolute-signing.keychain-db"
+          PROFILE_DESTINATION="$HOME/Library/MobileDevice/Provisioning Profiles/absolute.mobileprovision"
+          printf '%s' "$ABSOLUTE_IOS_CERTIFICATE_BASE64" | base64 --decode > "$CERTIFICATE_PATH"
+          printf '%s' "$ABSOLUTE_IOS_PROVISIONING_PROFILE_BASE64" | base64 --decode > "$PROFILE_PATH"
+          security create-keychain -p "$ABSOLUTE_IOS_KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
+          security unlock-keychain -p "$ABSOLUTE_IOS_KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          security import "$CERTIFICATE_PATH" -P "$ABSOLUTE_IOS_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
+          security set-key-partition-list -S apple-tool:,apple: -k "$ABSOLUTE_IOS_KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          security list-keychain -d user -s "$KEYCHAIN_PATH"
+          mkdir -p "$(dirname "$PROFILE_DESTINATION")"
+          cp "$PROFILE_PATH" "$PROFILE_DESTINATION"${appStoreDecode}
+      - name: Build or publish iOS
+        shell: bash
+        run: |
+          ${publishCommand}
+          ${appendConfigArgument}
+          "\${args[@]}"
+${releaseAuditSteps("ios")}
+      - name: Attest iOS IPA
+        if: inputs.attest
+        uses: actions/attest@v4
+        with:
+          subject-path: .absolutejs/mobile/releases/ios/**/App.ipa
+      - name: Upload iOS release
+        uses: actions/upload-artifact@v7
+        with:
+          name: absolute-mobile-ios
+          path: .absolutejs/mobile/releases/ios/
+          if-no-files-found: error
+          retention-days: 14
+          include-hidden-files: true
+      - name: Remove iOS credentials
+        if: always()
+        shell: bash
+        run: |
+          security delete-keychain "\${{ runner.temp }}/absolute-signing.keychain-db" 2>/dev/null || true
+          rm -f "$HOME/Library/MobileDevice/Provisioning Profiles/absolute.mobileprovision"
+          rm -f "\${{ runner.temp }}/absolute-signing.p12"
+          rm -f "\${{ runner.temp }}/absolute.mobileprovision"
+          rm -f "\${{ runner.temp }}/AuthKey_AbsoluteJS.p8"`;
+}, requiredSecrets = (platforms, includePublishing, custom) => [
+  ...platforms.includes("android") ? [
+    "ABSOLUTE_ANDROID_KEYSTORE_BASE64",
+    "ABSOLUTE_ANDROID_KEYSTORE_PASSWORD",
+    "ABSOLUTE_ANDROID_KEY_ALIAS",
+    "ABSOLUTE_ANDROID_KEY_PASSWORD",
+    ...includePublishing ? ["ABSOLUTE_GOOGLE_CREDENTIALS_BASE64"] : []
+  ] : [],
+  ...platforms.includes("ios") ? [
+    "ABSOLUTE_IOS_CERTIFICATE_BASE64",
+    "ABSOLUTE_IOS_CERTIFICATE_PASSWORD",
+    "ABSOLUTE_IOS_PROVISIONING_PROFILE_BASE64",
+    "ABSOLUTE_IOS_KEYCHAIN_PASSWORD",
+    "ABSOLUTE_IOS_DEVELOPMENT_TEAM",
+    ...includePublishing ? [
+      "APP_STORE_CONNECT_ISSUER_ID",
+      "APP_STORE_CONNECT_KEY_ID",
+      "APP_STORE_CONNECT_PRIVATE_KEY_BASE64"
+    ] : []
+  ] : [],
+  ...custom
+], createAbsoluteMobileGithubWorkflow = (options) => {
+  const platforms = [
+    ...options.config.platforms
+  ].sort();
+  const includePublishing = options.includePublishing === true;
+  const customSecrets = normalizeSecretEnvironment(options.secretEnvironment);
+  const serverEntry = projectPath(options.projectRoot, options.serverEntry ?? "server.ts", "mobile ci github server entry");
+  const configPath2 = options.configPath ? projectPath(options.projectRoot, options.configPath, "mobile ci github --config") : undefined;
+  const registryModule = projectPath(options.projectRoot, options.registryModule ?? "mobile.release.ts", "mobile ci github --registry", { allowMissing: !includePublishing });
+  const environment = commandEnvironment({
+    configPath: configPath2,
+    registryModule,
+    serverEntry
+  });
+  let workflow = `# Generated by AbsoluteJS. Regenerate with: absolute mobile ci github${includePublishing ? " --publish" : ""}
+name: AbsoluteJS Mobile
+
+on:
+  pull_request:
+  workflow_dispatch:
+    inputs:
+${platformInput(platforms)}
+      attest:
+        description: Generate GitHub artifact provenance attestations
+        required: true
+        type: boolean
+        default: false${publishingInputs(platforms, includePublishing)}
+
+concurrency:
+  group: absolute-mobile-\${{ github.repository }}
+  cancel-in-progress: false
+
+jobs:
+  validate:
+    name: Validate mobile release inputs
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    env:
+${environment}
+    steps:
+${installSteps}
+${bundleAuditSteps}${platforms.includes("android") ? androidJob({ customSecrets, includePublishing }) : ""}${platforms.includes("ios") ? iosJob({ customSecrets, includePublishing }) : ""}
+`;
+  const replacements = new Map([
+    [
+      "ABSOLUTE_CONFIG_PATH: ''",
+      `ABSOLUTE_CONFIG_PATH: ${yamlString(configPath2 ?? "")}`
+    ],
+    [
+      "ABSOLUTE_REGISTRY_MODULE: ''",
+      `ABSOLUTE_REGISTRY_MODULE: ${yamlString(registryModule)}`
+    ],
+    [
+      "ABSOLUTE_SERVER_ENTRY: ''",
+      `ABSOLUTE_SERVER_ENTRY: ${yamlString(serverEntry)}`
+    ]
+  ]);
+  for (const [placeholder, replacement] of replacements)
+    workflow = workflow.replaceAll(placeholder, replacement);
+  return {
+    requiredSecrets: requiredSecrets(platforms, includePublishing, customSecrets),
+    workflow
+  };
+}, writeAbsoluteMobileGithubWorkflow = async (options) => {
+  const path = workflowOutputPath(options.projectRoot, options.outputPath);
+  const generated = createAbsoluteMobileGithubWorkflow(options);
+  const previous = await exists3(path) ? await readFile22(path, "utf8") : undefined;
+  if (previous !== undefined && previous !== generated.workflow && !options.force)
+    throw new TypeError(`${relative29(options.projectRoot, path)} already exists and differs. Rerun with --force to replace the generated workflow.`);
+  if (previous !== generated.workflow) {
+    await mkdir14(dirname31(path), { recursive: true });
+    await writeFile16(path, generated.workflow);
+  }
+  return {
+    changed: previous !== generated.workflow,
+    format: ABSOLUTE_MOBILE_CI_WORKFLOW_FORMAT,
+    path,
+    platforms: [...options.config.platforms].sort(),
+    publishing: options.includePublishing === true,
+    requiredSecrets: generated.requiredSecrets
+  };
+};
+var init_ciWorkflow = __esm(() => {
+  SECRET_NAME_PATTERN = /^[A-Z][A-Z0-9_]*$/u;
+  RESERVED_SECRET_NAMES = new Set([
+    "ABSOLUTE_ANDROID_KEYSTORE_BASE64",
+    "ABSOLUTE_ANDROID_KEYSTORE_PASSWORD",
+    "ABSOLUTE_ANDROID_KEY_ALIAS",
+    "ABSOLUTE_ANDROID_KEY_PASSWORD",
+    "ABSOLUTE_GOOGLE_CREDENTIALS_BASE64",
+    "ABSOLUTE_IOS_CERTIFICATE_BASE64",
+    "ABSOLUTE_IOS_CERTIFICATE_PASSWORD",
+    "ABSOLUTE_IOS_PROVISIONING_PROFILE_BASE64",
+    "ABSOLUTE_IOS_KEYCHAIN_PASSWORD",
+    "ABSOLUTE_IOS_DEVELOPMENT_TEAM",
+    "APP_STORE_CONNECT_ISSUER_ID",
+    "APP_STORE_CONNECT_KEY_ID",
+    "APP_STORE_CONNECT_PRIVATE_KEY_BASE64"
   ]);
+  bundleAuditSteps = `      - name: Prepare production mobile bundle
+        shell: bash
+        run: |
+          args=(bunx absolute prepare "$ABSOLUTE_SERVER_ENTRY" --outdir .absolutejs/mobile-ci/server)
+          ${appendConfigArgument}
+          "\${args[@]}"
+      - name: Run cryptographic mobile bundle audit
+        id: mobile-bundle-audit
+        continue-on-error: true
+        shell: bash
+        run: |
+          mkdir -p .absolutejs/mobile-ci
+          args=(bunx absolute mobile inspect --json --require-bundle)
+          ${appendConfigArgument}
+          "\${args[@]}" > .absolutejs/mobile-ci/inspection.json
+      - name: Upload mobile inspection report
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: absolute-mobile-inspection
+          path: .absolutejs/mobile-ci/inspection.json
+          if-no-files-found: error
+          retention-days: 30
+          include-hidden-files: true
+      - name: Enforce mobile bundle audit
+        if: steps.mobile-bundle-audit.outcome != 'success'
+        run: exit 1`;
 });
 
 // src/cli/scripts/mobile.ts
@@ -19671,11 +20075,11 @@ var exports_mobile = {};
 __export(exports_mobile, {
   runMobile: () => runMobile
 });
-import { access as access13, mkdir as mkdir14, readFile as readFile22, writeFile as writeFile16 } from "fs/promises";
-import { join as join54, resolve as resolve43 } from "path";
+import { access as access14, mkdir as mkdir15, readFile as readFile23, writeFile as writeFile17 } from "fs/promises";
+import { join as join54, relative as relative30, resolve as resolve44 } from "path";
 import { createInterface } from "readline/promises";
 var NOT_FOUND4 = -1, isRecord15 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), CAPACITOR_PACKAGES, CAPACITOR_PACKAGE_SPECS, CAPACITOR_SYNC_PACKAGE_SPECS, packageNameFromSpec = (spec) => spec.slice(0, spec.lastIndexOf("@")), directProjectPackages = async (projectRoot) => {
-  const manifest = JSON.parse(await readFile22(join54(projectRoot, "package.json"), "utf8"));
+  const manifest = JSON.parse(await readFile23(join54(projectRoot, "package.json"), "utf8"));
   if (!isRecord15(manifest))
     throw new TypeError("Application package.json must contain an object.");
   const names = new Set;
@@ -19688,7 +20092,7 @@ var NOT_FOUND4 = -1, isRecord15 = (value) => typeof value === "object" && value
   return names;
 }, resolvedPackageVersion = async (projectRoot, packageName) => {
   try {
-    const manifest = JSON.parse(await readFile22(join54(projectRoot, "node_modules", packageName, "package.json"), "utf8"));
+    const manifest = JSON.parse(await readFile23(join54(projectRoot, "node_modules", packageName, "package.json"), "utf8"));
     return isRecord15(manifest) && typeof manifest.version === "string" ? manifest.version : undefined;
   } catch {
     return;
@@ -19731,7 +20135,7 @@ var NOT_FOUND4 = -1, isRecord15 = (value) => typeof value === "object" && value
 }, capacitorExecutable = async (projectRoot) => {
   const executable = join54(projectRoot, "node_modules", ".bin", "cap");
   try {
-    await access13(executable);
+    await access14(executable);
     return executable;
   } catch {
     throw new TypeError(`Capacitor is not installed in this app. Run: bun add ${CAPACITOR_PACKAGES.join(" ")}`);
@@ -19758,11 +20162,19 @@ var NOT_FOUND4 = -1, isRecord15 = (value) => typeof value === "object" && value
   const report = await inspectAbsoluteMobileProject(mobile, projectRoot, {
     absolutejsVersion: await absolutejsVersionForReport()
   });
+  const requireBundle = () => {
+    if (!args.includes("--require-bundle"))
+      return;
+    if (report.bundle.status !== "valid" || report.capabilities.issue || report.capabilities.embeddedMatchesCurrent !== true)
+      throw new TypeError("Mobile bundle validation failed. Regenerate the production bundle and resolve capability drift.");
+  };
   if (args.includes("--json")) {
     console.log(JSON.stringify(report, null, 2));
+    requireBundle();
     return report;
   }
   console.log(renderAbsoluteMobileProjectInspection(report).trimEnd());
+  requireBundle();
   return report;
 }, remoteProfilePath = () => process.env.ABSOLUTE_REMOTE_MAC_PROFILE_PATH || undefined, pairRemoteMac = async (args) => {
   if (args[0] !== "mac" || !args[1] || !args[2])
@@ -19828,7 +20240,7 @@ var NOT_FOUND4 = -1, isRecord15 = (value) => typeof value === "object" && value
   await applyAbsoluteNativeBackgroundSync(projectRoot, mobile, platforms);
 }, associations = async (args) => {
   const { mobile, projectRoot } = await loadMobile(valueAfter(args, "--config"));
-  const outputDirectory = resolve43(projectRoot, valueAfter(args, "--outdir") ?? ".absolutejs/mobile/associations");
+  const outputDirectory = resolve44(projectRoot, valueAfter(args, "--outdir") ?? ".absolutejs/mobile/associations");
   if (args.includes("--verify")) {
     const result2 = await verifyAbsoluteMobileAssociationFiles(mobile);
     console.log(`Verified ${result2.results.length} hosted association files`);
@@ -19839,6 +20251,59 @@ var NOT_FOUND4 = -1, isRecord15 = (value) => typeof value === "object" && value
   }
   const result = await materializeAbsoluteMobileAssociationFiles(mobile, outputDirectory);
   console.log(`Generated ${result.written.length} association files in ${result.root}`);
+}, mobileCiServerEntry = (args) => {
+  const valueFlags = new Set([
+    "--config",
+    "--output",
+    "--registry",
+    "--secret-env"
+  ]);
+  const skipped = new Set;
+  args.forEach((value, index) => {
+    if (!valueFlags.has(value))
+      return;
+    skipped.add(index);
+    skipped.add(index + 1);
+  });
+  return args.find((value, index) => !skipped.has(index) && value !== "github" && !value.startsWith("-")) ?? DEFAULT_SERVER_ENTRY;
+}, generateGithubCi = async (args) => {
+  if (args[0] !== "github")
+    throw new TypeError("Usage: absolute mobile ci github [server-entry] [--publish] [--registry module] [--secret-env NAME] [--output path] [--force] [--json] [--config path]");
+  const configPath2 = valueAfter(args, "--config");
+  const { mobile, projectRoot } = await loadMobile(configPath2);
+  const result = await writeAbsoluteMobileGithubWorkflow({
+    config: mobile,
+    configPath: configPath2,
+    force: args.includes("--force"),
+    includePublishing: args.includes("--publish"),
+    outputPath: valueAfter(args, "--output"),
+    projectRoot,
+    registryModule: valueAfter(args, "--registry"),
+    secretEnvironment: valuesAfter(args, "--secret-env"),
+    serverEntry: mobileCiServerEntry(args)
+  });
+  sendTelemetryEvent("mobile:ci-generated", {
+    platformCount: result.platforms.length,
+    provider: "github-actions",
+    publishing: result.publishing
+  });
+  const publicResult = {
+    changed: result.changed,
+    format: result.format,
+    path: relative30(projectRoot, result.path).replaceAll("\\", "/"),
+    platforms: result.platforms,
+    publishing: result.publishing,
+    requiredSecrets: result.requiredSecrets
+  };
+  if (args.includes("--json")) {
+    console.log(JSON.stringify(publicResult, null, 2));
+    return publicResult;
+  }
+  console.log(`${result.changed ? "Generated" : "Verified"} ${publicResult.path} for ${result.platforms.join(" and ")}.`);
+  console.log("Create a protected GitHub environment named absolute-mobile-release, then add these secrets:");
+  result.requiredSecrets.forEach((name) => console.log(`  ${name}`));
+  console.log("Pull requests run the secret-free release audit. Signed builds and optional publishing run only through manual workflow dispatch.");
+  return publicResult;
 }, doctorMark = (status2) => {
   if (status2 === "pass")
     return "\x1B[32m\u2713\x1B[0m";
@@ -19871,9 +20336,11 @@ var NOT_FOUND4 = -1, isRecord15 = (value) => typeof value === "object" && value
   }
 }, runReleaseDoctor = async (args) => {
   const { mobile, projectRoot } = await loadMobile(valueAfter(args, "--config"));
-  const result = await inspectAbsoluteMobileRelease(mobile, projectRoot);
+  const platform6 = args.find((value) => value === "android" || value === "ios");
+  const effectiveMobile = platform6 ? { ...mobile, platforms: [platform6] } : mobile;
+  const result = await inspectAbsoluteMobileRelease(effectiveMobile, projectRoot);
   if (args.includes("--json")) {
-    console.log(JSON.stringify(createAbsoluteMobileComplianceReport(mobile, result), null, 2));
+    console.log(JSON.stringify(createAbsoluteMobileComplianceReport(effectiveMobile, result), null, 2));
   } else {
     result.checks.forEach((check2) => {
       console.log(`${doctorMark(check2.status)} ${check2.detail}${check2.path ? ` (${check2.path})` : ""}`);
@@ -20029,6 +20496,27 @@ Mobile release security and compliance checks failed.`);
     status: check2.status
   })));
   throw new TypeError("Android release validation failed before Gradle signing.");
+}, androidCiSigning = () => {
+  const keyAlias = process.env.ABSOLUTE_ANDROID_KEY_ALIAS;
+  const keyPassword = process.env.ABSOLUTE_ANDROID_KEY_PASSWORD;
+  const keystorePath = process.env.ABSOLUTE_ANDROID_KEYSTORE_PATH;
+  const storePassword = process.env.ABSOLUTE_ANDROID_KEYSTORE_PASSWORD;
+  const supplied = [
+    keyAlias,
+    keyPassword,
+    keystorePath,
+    storePassword
+  ].filter((value) => value !== undefined && value !== "").length;
+  if (supplied === 0)
+    return;
+  if (!keyAlias || !keyPassword || !keystorePath || !storePassword)
+    throw new TypeError("AbsoluteJS CI signing requires ABSOLUTE_ANDROID_KEYSTORE_PATH, ABSOLUTE_ANDROID_KEYSTORE_PASSWORD, ABSOLUTE_ANDROID_KEY_ALIAS, and ABSOLUTE_ANDROID_KEY_PASSWORD together.");
+  return {
+    keyAlias,
+    keyPasswordEnvironment: "ABSOLUTE_ANDROID_KEY_PASSWORD",
+    keystorePath,
+    storePasswordEnvironment: "ABSOLUTE_ANDROID_KEYSTORE_PASSWORD"
+  };
 }, buildAndroid = async (args, prepareVersionCode) => {
   const configPath2 = valueAfter(args, "--config");
   const { mobile, projectRoot } = await loadMobile(configPath2);
@@ -20055,6 +20543,7 @@ Mobile release security and compliance checks failed.`);
       config: mobile,
       outputDirectory: valueAfter(args, "--outdir"),
       projectRoot,
+      signing: androidCiSigning(),
       ...prepareVersionCode === undefined ? {} : { prepareVersionCode }
     });
     success = true;
@@ -20156,6 +20645,7 @@ Mobile release security and compliance checks failed.`);
     const release = await buildAbsoluteIosRelease({
       allowUnsigned: args.includes("--unsigned"),
       config: mobile,
+      developmentTeam: process.env.ABSOLUTE_IOS_DEVELOPMENT_TEAM,
       outputDirectory: valueAfter(args, "--outdir"),
       ...prepareBuildNumber === undefined ? {} : { prepareBuildNumber },
       projectRoot
@@ -20364,7 +20854,7 @@ Emulator setup verification:`);
     }
     return { https: args.includes("--https"), port };
   }
-  const instances = listLiveInstances().filter((instance2) => resolve43(instance2.cwd) === resolve43(projectRoot) && instance2.source === "dev" && instance2.port !== null);
+  const instances = listLiveInstances().filter((instance2) => resolve44(instance2.cwd) === resolve44(projectRoot) && instance2.source === "dev" && instance2.port !== null);
   if (instances.length !== 1) {
     throw new TypeError(instances.length === 0 ? "No running AbsoluteJS dev server was found for this project. Start `bun dev`, wait for Android to report ready, then run `absolute mobile test android`." : "Multiple dev servers are running for this project. Select one with mobile test android --port <port>.");
   }
@@ -20407,8 +20897,8 @@ Emulator setup verification:`);
   }
   return selected;
 }, safeArtifactRoot = (projectRoot, value) => {
-  const root = resolve43(projectRoot, value ?? ".absolutejs/mobile/test-artifacts");
-  if (root !== projectRoot && !root.startsWith(`${resolve43(projectRoot)}/`)) {
+  const root = resolve44(projectRoot, value ?? ".absolutejs/mobile/test-artifacts");
+  if (root !== projectRoot && !root.startsWith(`${resolve44(projectRoot)}/`)) {
     throw new TypeError("mobile test --artifacts must remain inside the project.");
   }
   return root;
@@ -20432,12 +20922,12 @@ Emulator setup verification:`);
     timeoutMs
   });
 }, writeAndroidFailureArtifacts = async (options) => {
-  await mkdir14(options.artifactRoot, { recursive: true });
+  await mkdir15(options.artifactRoot, { recursive: true });
   const screenshot = options.session ? await options.session.screenshot(join54(options.artifactRoot, "android-failure.png")).catch(() => {
     return;
   }) : undefined;
   const diagnosticPath = join54(options.artifactRoot, "android-failure.json");
-  await writeFile16(diagnosticPath, `${JSON.stringify({
+  await writeFile17(diagnosticPath, `${JSON.stringify({
     diagnostics: options.session?.diagnostics ?? [],
     error: options.error instanceof Error ? options.error.message : String(options.error),
     platform: "android",
@@ -20568,14 +21058,14 @@ Emulator setup verification:`);
     const port = Number(explicit);
     if (!Number.isInteger(port) || port < 1 || port > 65535)
       throw new TypeError("mobile test --port must be a valid TCP port.");
-    const instance2 = listLiveInstances().find((candidate) => resolve43(candidate.cwd) === resolve43(projectRoot) && candidate.source === "dev" && candidate.port === port);
+    const instance2 = listLiveInstances().find((candidate) => resolve44(candidate.cwd) === resolve44(projectRoot) && candidate.source === "dev" && candidate.port === port);
     return {
       https: instance2?.https ?? args.includes("--https"),
       instance: instance2,
       port
     };
   }
-  const instances = listLiveInstances().filter((instance2) => resolve43(instance2.cwd) === resolve43(projectRoot) && instance2.source === "dev" && instance2.port !== null);
+  const instances = listLiveInstances().filter((instance2) => resolve44(instance2.cwd) === resolve44(projectRoot) && instance2.source === "dev" && instance2.port !== null);
   if (instances.length !== 1)
     throw new TypeError(instances.length === 0 ? "No running AbsoluteJS dev server was found for this project. Start `bun dev`, wait for iOS to report ready, then run `absolute mobile test ios`." : "Multiple dev servers are running for this project. Select one with mobile test ios --port <port>.");
   const [instance] = instances;
@@ -20689,7 +21179,7 @@ Emulator setup verification:`);
     throw new Error(`${label} failed: ${result.stderr.trim() || result.stdout.trim() || `status ${result.exitCode}`}`);
   return result;
 }, writeIosFailureArtifacts = async (options) => {
-  await mkdir14(options.artifactRoot, { recursive: true });
+  await mkdir15(options.artifactRoot, { recursive: true });
   const screenshot = join54(options.artifactRoot, "ios-failure.png");
   const screenshotResult = captureCommand4([
     options.xcrun,
@@ -20700,7 +21190,7 @@ Emulator setup verification:`);
     screenshot
   ]);
   const diagnosticPath = join54(options.artifactRoot, "ios-failure.json");
-  await writeFile16(diagnosticPath, `${JSON.stringify({
+  await writeFile17(diagnosticPath, `${JSON.stringify({
     appId: options.appId,
     error: options.error instanceof Error ? options.error.message : String(options.error),
     platform: "ios",
@@ -20725,8 +21215,8 @@ Emulator setup verification:`);
 }, absolutejsVersionForReport = async () => {
   let absolutejsVersion = process.env.ABSOLUTE_VERSION ?? "unknown";
   const versions = await Promise.all([
-    resolve43(import.meta.dir, "..", "..", "package.json"),
-    resolve43(import.meta.dir, "..", "..", "..", "package.json")
+    resolve44(import.meta.dir, "..", "..", "package.json"),
+    resolve44(import.meta.dir, "..", "..", "..", "package.json")
   ].map((candidate) => readPackageVersionForIosReport(candidate).catch(() => "unknown")));
   for (const version2 of versions) {
     if (version2 === "unknown")
@@ -20944,7 +21434,7 @@ Emulator setup verification:`);
       mobile.appId
     ], "iOS app launch");
     await waitForIosHmrClient({ https, port, timeoutMs });
-    await mkdir14(artifactRoot, { recursive: true });
+    await mkdir15(artifactRoot, { recursive: true });
     const screenshot = join54(artifactRoot, "ios-simulator.png");
     requireCapturedCommand([xcrun, "simctl", "io", simulator.udid, "screenshot", screenshot], "iOS simulator screenshot");
     const hmrApply = await waitForRequestedIosHmr(args, instance, timeoutMs);
@@ -21054,6 +21544,10 @@ Emulator setup verification:`);
     await associations(args.slice(1));
     return;
   }
+  if (command === "ci") {
+    await generateGithubCi(args.slice(1));
+    return;
+  }
   if (command === "doctor") {
     await doctor(args.slice(1));
     return;
@@ -21086,7 +21580,7 @@ Emulator setup verification:`);
     await publishIos(args.slice(2));
     return;
   }
-  throw new TypeError("Usage: absolute mobile <pair mac <name> <user@host> [--port n] [--workspace path] | remotes [--json] | unpair mac <name> | init [--no-native] [--force] | sync [ios|android] | inspect [--json] | associations [--outdir dir] [--verify] | doctor [ios|android|release] [--remote name] [--json|--fix [--yes]] | build <android|ios> [server-entry] [--outdir dir] [--web-outdir dir] [--unsigned] | publish android [server-entry] [--registry module] [--channel name] [--play-track track] [--play-status completed|draft|halted|in-progress] [--play-rollout fraction] [--play-name name] [--play-notes language=text] [--play-update-priority 0..5] [--play-hold-review] [--play-cancel-existing-review] [--outdir dir] [--web-outdir dir] [--unsigned] | publish ios [server-entry] [--registry module] [--channel name] [--testflight-group name-or-id] [--testflight-notes locale=text] [--testflight-submit-review] [--outdir dir] [--web-outdir dir] [--unsigned] | test android [--route path] [--wait-for-hmr] [--report [dir]] [--timeout ms] [--port n] [--serial id] [--artifacts dir] [--json] | test ios [--device identifier [--remote name] | --udid id] [--wait-for-hmr] [--report [dir]] [--timeout ms] [--port n] [--artifacts dir] [--json]> [--config path]");
+  throw new TypeError("Usage: absolute mobile <pair mac <name> <user@host> [--port n] [--workspace path] | remotes [--json] | unpair mac <name> | init [--no-native] [--force] | sync [ios|android] | inspect [--json] [--require-bundle] | associations [--outdir dir] [--verify] | ci github [server-entry] [--publish] [--registry module] [--secret-env NAME] [--output path] [--force] [--json] | doctor [ios|android|release [ios|android]] [--remote name] [--json|--fix [--yes]] | build <android|ios> [server-entry] [--outdir dir] [--web-outdir dir] [--unsigned] | publish android [server-entry] [--registry module] [--channel name] [--play-track track] [--play-status completed|draft|halted|in-progress] [--play-rollout fraction] [--play-name name] [--play-notes language=text] [--play-update-priority 0..5] [--play-hold-review] [--play-cancel-existing-review] [--outdir dir] [--web-outdir dir] [--unsigned] | publish ios [server-entry] [--registry module] [--channel name] [--testflight-group name-or-id] [--testflight-notes locale=text] [--testflight-submit-review] [--outdir dir] [--web-outdir dir] [--unsigned] | test android [--route path] [--wait-for-hmr] [--report [dir]] [--timeout ms] [--port n] [--serial id] [--artifacts dir] [--json] | test ios [--device identifier [--remote name] | --udid id] [--wait-for-hmr] [--report [dir]] [--timeout ms] [--port n] [--artifacts dir] [--json]> [--config path]");
 };
 var init_mobile = __esm(() => {
   init_dependencies();
@@ -21121,6 +21615,7 @@ var init_mobile = __esm(() => {
   init_syncSchema();
   init_deviceCapabilities();
   init_mobileInspect();
+  init_ciWorkflow();
   CAPACITOR_PACKAGES = [
     "@capacitor/core",
     "@capacitor/app",
@@ -21156,11 +21651,11 @@ var exports_typecheck = {};
 __export(exports_typecheck, {
   typecheck: () => typecheck
 });
-import { resolve as resolve44, join as join55 } from "path";
-import { existsSync as existsSync42, readFileSync as readFileSync40 } from "fs";
-import { mkdir as mkdir15, writeFile as writeFile17 } from "fs/promises";
-var isCommandService3 = (service) => service.kind === "command" || Array.isArray(service.command), resolveConfigPath = (configPath2) => resolve44(configPath2 ?? process.env.ABSOLUTE_CONFIG ?? "absolute.config.ts"), getTypecheckTargets = async (configPath2) => {
-  if (!existsSync42(resolveConfigPath(configPath2))) {
+import { resolve as resolve45, join as join55 } from "path";
+import { existsSync as existsSync43, readFileSync as readFileSync40 } from "fs";
+import { mkdir as mkdir16, writeFile as writeFile18 } from "fs/promises";
+var isCommandService3 = (service) => service.kind === "command" || Array.isArray(service.command), resolveConfigPath = (configPath2) => resolve45(configPath2 ?? process.env.ABSOLUTE_CONFIG ?? "absolute.config.ts"), getTypecheckTargets = async (configPath2) => {
+  if (!existsSync43(resolveConfigPath(configPath2))) {
     const defaultService = {};
     return [defaultService];
   }
@@ -21181,8 +21676,8 @@ var isCommandService3 = (service) => service.kind === "command" || Array.isArray
   const exitCode = await proc.exited;
   return { exitCode, name, output: (stdout + stderr).trim() };
 }, shellEscape = (value) => `'${value.replaceAll("'", "'\\''")}'`, runShell = async (name, command) => run(name, ["/bin/bash", "-lc", command]), findBin = (name) => {
-  const local = resolve44("node_modules", ".bin", name);
-  return existsSync42(local) ? local : null;
+  const local = resolve45("node_modules", ".bin", name);
+  return existsSync43(local) ? local : null;
 }, ANSI_COLOR_REGEX, ANSI_PURPLE_REGEX, ANSI_CYAN_REGEX, ANSI_TOKEN_END_REGEX, stripAnsi4 = (str) => str.replace(ANSI_COLOR_REGEX, ""), formatSvelteOutput = (output) => {
   const cwd = `${process.cwd()}/`;
   const summaryMatch = stripAnsi4(output).match(/svelte-check found (\d+) error/);
@@ -21229,15 +21724,15 @@ Found ${errorCount} error${suffix}.`;
   return formatted;
 }, ABSOLUTE_INTERNAL_EXCLUDES, resolveAbsoluteTypeFile = (fileName) => {
   const candidates = [
-    resolve44("node_modules/@absolutejs/absolute/dist/types", fileName),
-    resolve44(import.meta.dir, "../types", fileName),
-    resolve44(import.meta.dir, "../../types", fileName),
-    resolve44(import.meta.dir, "../../../types", fileName)
+    resolve45("node_modules/@absolutejs/absolute/dist/types", fileName),
+    resolve45(import.meta.dir, "../types", fileName),
+    resolve45(import.meta.dir, "../../types", fileName),
+    resolve45(import.meta.dir, "../../../types", fileName)
   ];
-  return candidates.find((candidate) => existsSync42(candidate)) ?? candidates[0];
+  return candidates.find((candidate) => existsSync43(candidate)) ?? candidates[0];
 }, ABSOLUTE_TYPECHECK_FILES, readProjectTsconfig = () => {
   try {
-    return JSON.parse(readFileSync40(resolve44("tsconfig.json"), "utf-8"));
+    return JSON.parse(readFileSync40(resolve45("tsconfig.json"), "utf-8"));
   } catch {
     return {};
   }
@@ -21266,19 +21761,19 @@ Found ${errorCount} error${suffix}.`;
     process.exit(1);
   }
   const vueTsconfigPath = join55(cacheDir, "tsconfig.vue-check.json");
-  await writeFile17(vueTsconfigPath, JSON.stringify({
+  await writeFile18(vueTsconfigPath, JSON.stringify({
     compilerOptions: {
       rootDir: ".."
     },
     exclude: getProjectTypecheckExcludes(),
-    extends: resolve44("tsconfig.json"),
+    extends: resolve45("tsconfig.json"),
     include: getProjectTypecheckIncludes()
   }, null, "\t"));
   const base = [
     vueTscBin,
     "--noEmit",
     "--project",
-    resolve44(vueTsconfigPath),
+    resolve45(vueTsconfigPath),
     "--pretty"
   ];
   const cached = await run("vue-tsc", [
@@ -21297,7 +21792,7 @@ Found ${errorCount} error${suffix}.`;
     process.exit(1);
   }
   const angularTsconfigPath = join55(cacheDir, "tsconfig.angular-check.json");
-  await writeFile17(angularTsconfigPath, JSON.stringify({
+  await writeFile18(angularTsconfigPath, JSON.stringify({
     angularCompilerOptions: {
       strictTemplates: true
     },
@@ -21306,10 +21801,10 @@ Found ${errorCount} error${suffix}.`;
       rootDir: ".."
     },
     exclude: ABSOLUTE_INTERNAL_EXCLUDES.map(toGeneratedConfigPath),
-    extends: resolve44("tsconfig.json"),
+    extends: resolve45("tsconfig.json"),
     include: [`../${angularDir}/**/*`]
   }, null, "\t"));
-  return runShell("ngc", `${shellEscape(ngcBin)} -p ${shellEscape(resolve44(angularTsconfigPath))}`);
+  return runShell("ngc", `${shellEscape(ngcBin)} -p ${shellEscape(resolve45(angularTsconfigPath))}`);
 }, buildTscCheck = (cacheDir) => {
   const tscBin = findBin("tsc");
   if (!tscBin) {
@@ -21317,18 +21812,18 @@ Found ${errorCount} error${suffix}.`;
     process.exit(1);
   }
   const tscConfigPath = join55(cacheDir, "tsconfig.typecheck.json");
-  return writeFile17(tscConfigPath, JSON.stringify({
+  return writeFile18(tscConfigPath, JSON.stringify({
     compilerOptions: {
       rootDir: ".."
     },
     exclude: getProjectTypecheckExcludes(),
-    extends: resolve44("tsconfig.json"),
+    extends: resolve45("tsconfig.json"),
     include: getProjectTypecheckIncludes()
   }, null, "\t")).then(() => run("tsc", [
     tscBin,
     "--noEmit",
     "--project",
-    resolve44(tscConfigPath),
+    resolve45(tscConfigPath),
     "--incremental",
     "--tsBuildInfoFile",
     join55(cacheDir, "tsc.tsbuildinfo"),
@@ -21341,15 +21836,15 @@ Found ${errorCount} error${suffix}.`;
     process.exit(1);
   }
   const svelteTsconfigPath = join55(cacheDir, "tsconfig.svelte-check.json");
-  await writeFile17(svelteTsconfigPath, JSON.stringify({
-    extends: resolve44("tsconfig.json"),
+  await writeFile18(svelteTsconfigPath, JSON.stringify({
+    extends: resolve45("tsconfig.json"),
     files: ABSOLUTE_TYPECHECK_FILES,
     include: [`../${svelteDir}/**/*`]
   }, null, "\t"));
   return run("svelte-check", [
     svelteBin,
     "--tsconfig",
-    resolve44(svelteTsconfigPath),
+    resolve45(svelteTsconfigPath),
     "--threshold",
     "error",
     "--compiler-warnings",
@@ -21370,7 +21865,7 @@ Found ${errorCount} error${suffix}.`;
     ...new Set(targets.map((config) => config.angularDirectory).filter((dir) => typeof dir === "string" && dir.length > 0))
   ];
   const cacheDir = ".absolutejs";
-  await mkdir15(cacheDir, { recursive: true });
+  await mkdir16(cacheDir, { recursive: true });
   const checks = [];
   checks.push(hasVue ? buildVueTscCheck(cacheDir) : buildTscCheck(cacheDir));
   for (const svelteDir of hasSvelte ? svelteDirs : []) {
@@ -21543,11 +22038,11 @@ var DEFAULT_RELAY_PORT = 8787, DEFAULT_REQUEST_TIMEOUT_MS = 30000, headersToObje
         url: url.pathname + url.search,
         ...bodyBytes && bodyBytes.length > 0 ? { bodyBase64: Buffer.from(bodyBytes).toString("base64") } : {}
       };
-      const responsePromise = new Promise((resolve45) => {
-        pending.set(id, resolve45);
+      const responsePromise = new Promise((resolve46) => {
+        pending.set(id, resolve46);
       });
       client.send(encodeTunnelMessage(message));
-      const timeout = new Promise((resolve45) => setTimeout(() => resolve45({ id, message: "timeout", type: "error" }), requestTimeoutMs));
+      const timeout = new Promise((resolve46) => setTimeout(() => resolve46({ id, message: "timeout", type: "error" }), requestTimeoutMs));
       const result = await Promise.race([responsePromise, timeout]);
       pending.delete(id);
       if (result.type === "error") {
@@ -25460,7 +25955,7 @@ if (command === "dev") {
   console.error("  prepare [entry] [--outdir dir] Build production assets and server without launching");
   console.error("  start [entry] [--outdir dir] [--prebuilt] Start production server");
   console.error("  compile [entry] [--outdir dir] [--outfile path] Compile standalone executable");
-  console.error("  mobile <init|sync|inspect|pair|remotes|doctor|test> Manage Capacitor projects, simulators, physical devices, Remote Macs, guided setup, and deep links");
+  console.error("  mobile <init|sync|inspect|ci|pair|remotes|doctor|test> Manage Capacitor projects, CI, simulators, physical devices, Remote Macs, guided setup, and deep links");
   console.error("  config [--port n] Open the unified config UI (ESLint, tsconfig, Prettier)");
   console.error("  db <backup|restore|seed> Backup/restore any Postgres DB (ORM-agnostic, upsert by PK) or run the seed script");
   console.error("  doctor [--fix] [--json] Diagnose the project (bun, type graph, config, framework dirs, env, port)");