@absolutejs/absolute 0.20.0-beta.38 → 0.20.0-beta.39

package/dist/mobile/index.js

@@ -860,12 +860,12 @@ var init_deviceCapabilities = __esm(() => {
 });
 
 // src/cli/scripts/telemetry.ts
-import { existsSync as existsSync3, mkdirSync, readFileSync as readFileSync5, writeFileSync } from "fs";
+import { existsSync as existsSync4, mkdirSync, readFileSync as readFileSync5, writeFileSync } from "fs";
 import { homedir as homedir3 } from "os";
 import { join as join15 } from "path";
 var configDir, configPath, getTelemetryConfig = () => {
   try {
-    if (!existsSync3(configPath))
+    if (!existsSync4(configPath))
       return null;
     const raw = readFileSync5(configPath, "utf-8");
     const config = JSON.parse(raw);
@@ -880,11 +880,11 @@ var init_telemetry = __esm(() => {
 });
 
 // src/cli/telemetryEvent.ts
-import { existsSync as existsSync4, readFileSync as readFileSync6 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync6 } from "fs";
 import { arch, platform } from "os";
-import { dirname as dirname10, join as join16, parse } from "path";
+import { dirname as dirname11, join as join16, parse } from "path";
 var checkCandidate = (candidate) => {
-  if (!existsSync4(candidate)) {
+  if (!existsSync5(candidate)) {
     return null;
   }
   const pkg = JSON.parse(readFileSync6(candidate, "utf-8"));
@@ -907,7 +907,7 @@ var checkCandidate = (candidate) => {
     if (version) {
       return version;
     }
-    dir = dirname10(dir);
+    dir = dirname11(dir);
   }
   return "unknown";
 }, sendTelemetryEvent = (event, payload) => {
@@ -2032,6 +2032,21 @@ var verifyAabSignature = (artifactPath, capture, jarsigner) => {
   ]);
   return result.exitCode === 0 && /jar verified/iu.test(result.stdout);
 };
+var signAab = (artifactPath, capture, jarsigner, signing) => {
+  const result = capture([
+    jarsigner,
+    "-keystore",
+    signing.keystorePath,
+    "-storepass:env",
+    signing.storePasswordEnvironment,
+    "-keypass:env",
+    signing.keyPasswordEnvironment,
+    artifactPath,
+    signing.keyAlias
+  ]);
+  if (result.exitCode !== 0)
+    throw new TypeError("jarsigner could not sign the Android App Bundle with the configured CI identity.");
+};
 var sha256File = async (path) => createHash4("sha256").update(await readFile4(path)).digest("hex");
 var safeOutputDirectory = (projectRoot, requested) => {
   const root = resolve3(projectRoot);
@@ -2126,7 +2141,16 @@ var buildAbsoluteAndroidRelease = async (options) => {
     throw new TypeError(`Android Gradle did not produce the expected App Bundle: ${artifactPath}`);
   }
   const capture = options.capture ?? defaultCapture;
-  const signed = verifyAabSignature(artifactPath, capture, options.jarsigner);
+  const jarsigner = options.jarsigner === undefined ? Bun.which("jarsigner") : options.jarsigner;
+  let signed = verifyAabSignature(artifactPath, capture, jarsigner);
+  if (signed === false && options.signing) {
+    if (!jarsigner)
+      throw new TypeError("Could not sign the Android App Bundle because jarsigner is unavailable.");
+    signAab(artifactPath, capture, jarsigner, options.signing);
+    signed = verifyAabSignature(artifactPath, capture, jarsigner);
+    if (!signed)
+      throw new TypeError("Android App Bundle signature verification failed after CI signing.");
+  }
   if (signed === null && !options.allowUnsigned) {
     throw new TypeError("Could not verify the Android App Bundle signature because jarsigner is unavailable. Install a JDK, or use --unsigned only for a non-publishable build.");
   }
@@ -2256,6 +2280,14 @@ import {
 } from "fs/promises";
 import { dirname as dirname3, isAbsolute as isAbsolute3, join as join5, relative as relative4, resolve as resolve4, sep as sep3 } from "path";
 var ABSOLUTE_IOS_RELEASE_FORMAT = 1;
+var developmentTeamArgument = (value) => {
+  if (value === undefined)
+    return;
+  const team = value.trim().toUpperCase();
+  if (!/^[A-Z0-9]{10}$/u.test(team))
+    throw new TypeError("iOS development team must contain ten letters or digits.");
+  return `DEVELOPMENT_TEAM=${team}`;
+};
 var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var requireManifest2 = (value) => {
   if (!isRecord2(value) || typeof value.appBuild !== "string" || typeof value.appId !== "string" || typeof value.runtime !== "string") {
@@ -2448,8 +2480,10 @@ var buildAbsoluteIosRelease = async (options) => {
   await writeFile5(exportPlist, exportOptions());
   const run = options.run ?? defaultRun;
   try {
+    const developmentTeam = developmentTeamArgument(options.developmentTeam);
     const versionArguments = [
       `MARKETING_VERSION=${marketingVersion}`,
+      ...developmentTeam ? [developmentTeam] : [],
       ...buildNumber === undefined ? [] : [`CURRENT_PROJECT_VERSION=${buildNumber}`]
     ];
     const archiveExit = await run([
@@ -6140,6 +6174,500 @@ var installAbsoluteMobileSyncRemediation = (bridge = {
 // src/mobile/index.ts
 init_deviceCapabilities();
 
+// src/mobile/ciWorkflow.ts
+import { existsSync as existsSync3 } from "fs";
+import { access as access9, mkdir as mkdir11, readFile as readFile15, writeFile as writeFile12 } from "fs/promises";
+import { dirname as dirname10, extname as extname4, relative as relative10, resolve as resolve13, sep as sep6 } from "path";
+var ABSOLUTE_MOBILE_CI_WORKFLOW_FORMAT = 1;
+var SECRET_NAME_PATTERN = /^[A-Z][A-Z0-9_]*$/u;
+var CI_ENV_INDENTATION = 6;
+var RESERVED_SECRET_NAMES = new Set([
+  "ABSOLUTE_ANDROID_KEYSTORE_BASE64",
+  "ABSOLUTE_ANDROID_KEYSTORE_PASSWORD",
+  "ABSOLUTE_ANDROID_KEY_ALIAS",
+  "ABSOLUTE_ANDROID_KEY_PASSWORD",
+  "ABSOLUTE_GOOGLE_CREDENTIALS_BASE64",
+  "ABSOLUTE_IOS_CERTIFICATE_BASE64",
+  "ABSOLUTE_IOS_CERTIFICATE_PASSWORD",
+  "ABSOLUTE_IOS_PROVISIONING_PROFILE_BASE64",
+  "ABSOLUTE_IOS_KEYCHAIN_PASSWORD",
+  "ABSOLUTE_IOS_DEVELOPMENT_TEAM",
+  "APP_STORE_CONNECT_ISSUER_ID",
+  "APP_STORE_CONNECT_KEY_ID",
+  "APP_STORE_CONNECT_PRIVATE_KEY_BASE64"
+]);
+var exists3 = async (path) => {
+  try {
+    await access9(path);
+    return true;
+  } catch {
+    return false;
+  }
+};
+var yamlString = (value) => `'${value.replaceAll("'", "''")}'`;
+var projectPath = (projectRoot, value, field2, options = {}) => {
+  const root = resolve13(projectRoot);
+  const path = resolve13(root, value);
+  const portable = relative10(root, path).replaceAll("\\", "/");
+  if (portable === ".." || portable.startsWith(`..${sep6}`) || portable.startsWith("../") || portable === "") {
+    throw new TypeError(`${field2} must remain inside the project root.`);
+  }
+  if (/\r|\n/u.test(portable) || portable.startsWith("-"))
+    throw new TypeError(`${field2} contains an unsafe path.`);
+  if (!options.allowMissing && !existsSync3(path))
+    throw new TypeError(`${field2} does not exist inside the project.`);
+  return portable;
+};
+var workflowOutputPath = (projectRoot, value) => {
+  const root = resolve13(projectRoot);
+  const workflows = resolve13(root, ".github/workflows");
+  const path = resolve13(root, value ?? ".github/workflows/absolute-mobile.yml");
+  const portable = relative10(workflows, path);
+  if (portable === ".." || portable.startsWith(`..${sep6}`) || extname4(path) !== ".yml" && extname4(path) !== ".yaml") {
+    throw new TypeError("mobile ci github --output must be a .yml or .yaml file inside .github/workflows.");
+  }
+  return path;
+};
+var normalizeSecretEnvironment = (values = []) => {
+  const names = [...new Set(values)].sort();
+  for (const name of names) {
+    if (!SECRET_NAME_PATTERN.test(name))
+      throw new TypeError("mobile ci github --secret-env values must be uppercase environment variable names.");
+    if (name.startsWith("GITHUB_") || name.startsWith("RUNNER_") || name.startsWith("ACTIONS_") || RESERVED_SECRET_NAMES.has(name)) {
+      throw new TypeError(`mobile ci github --secret-env cannot replace reserved variable ${name}.`);
+    }
+  }
+  return names;
+};
+var customSecretEnvironment = (names, indentation = CI_ENV_INDENTATION) => names.map((name) => `${" ".repeat(indentation)}${name}: \${{ secrets.${name} }}`).join(`
+`);
+var commandEnvironment = (options) => `      ABSOLUTE_CONFIG_PATH: ${yamlString(options.configPath ?? "")}
+      ABSOLUTE_REGISTRY_MODULE: ${yamlString(options.registryModule)}
+      ABSOLUTE_SERVER_ENTRY: ${yamlString(options.serverEntry)}`;
+var appendConfigArgument = `if [[ -n "$ABSOLUTE_CONFIG_PATH" ]]; then
+            args+=(--config "$ABSOLUTE_CONFIG_PATH")
+          fi`;
+var installSteps = `      - name: Check out source
+        uses: actions/checkout@v6
+      - name: Install Bun
+        uses: oven-sh/setup-bun@v2
+      - name: Install exact dependencies
+        run: bun ci`;
+var bundleAuditSteps = `      - name: Prepare production mobile bundle
+        shell: bash
+        run: |
+          args=(bunx absolute prepare "$ABSOLUTE_SERVER_ENTRY" --outdir .absolutejs/mobile-ci/server)
+          ${appendConfigArgument}
+          "\${args[@]}"
+      - name: Run cryptographic mobile bundle audit
+        id: mobile-bundle-audit
+        continue-on-error: true
+        shell: bash
+        run: |
+          mkdir -p .absolutejs/mobile-ci
+          args=(bunx absolute mobile inspect --json --require-bundle)
+          ${appendConfigArgument}
+          "\${args[@]}" > .absolutejs/mobile-ci/inspection.json
+      - name: Upload mobile inspection report
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: absolute-mobile-inspection
+          path: .absolutejs/mobile-ci/inspection.json
+          if-no-files-found: error
+          retention-days: 30
+          include-hidden-files: true
+      - name: Enforce mobile bundle audit
+        if: steps.mobile-bundle-audit.outcome != 'success'
+        run: exit 1`;
+var releaseAuditSteps = (platform) => `      - name: Run redacted mobile release audit
+        id: mobile-release-audit
+        continue-on-error: true
+        shell: bash
+        run: |
+          mkdir -p .absolutejs/mobile-ci
+          args=(bunx absolute mobile doctor release ${platform} --json)
+          ${appendConfigArgument}
+          "\${args[@]}" > .absolutejs/mobile-ci/compliance.json
+      - name: Upload mobile compliance report
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: absolute-mobile-compliance-\${{ github.job }}
+          path: .absolutejs/mobile-ci/compliance.json
+          if-no-files-found: error
+          retention-days: 30
+          include-hidden-files: true
+      - name: Enforce mobile release audit
+        if: steps.mobile-release-audit.outcome != 'success'
+        run: exit 1`;
+var platformInput = (platforms) => {
+  const choices = platforms.length === 2 ? ["all", ...platforms] : platforms;
+  return `      platform:
+        description: Native platform to build
+        required: true
+        type: choice
+        default: ${choices[0]}
+        options:
+${choices.map((value) => `          - ${value}`).join(`
+`)}`;
+};
+var publishingInputs = (platforms, includePublishing) => {
+  if (!includePublishing)
+    return "";
+  const fields = [
+    `      publish:
+        description: Publish through mobile.release.ts after the signed build
+        required: true
+        type: boolean
+        default: false`,
+    `      channel:
+        description: Optional AbsoluteJS immutable release channel
+        required: false
+        type: string`
+  ];
+  if (platforms.includes("android"))
+    fields.push(`      play_track:
+        description: Optional Google Play track
+        required: true
+        type: choice
+        default: registry-only
+        options:
+          - registry-only
+          - internal
+          - alpha
+          - beta
+          - production`);
+  if (platforms.includes("ios")) {
+    fields.push(`      testflight_group:
+        description: Optional internal or external TestFlight group
+        required: false
+        type: string`);
+    fields.push(`      submit_testflight_review:
+        description: Explicitly submit an external TestFlight build for review
+        required: true
+        type: boolean
+        default: false`);
+  }
+  return `
+${fields.join(`
+`)}`;
+};
+var jobCondition = (platform) => `github.event_name == 'workflow_dispatch' && (inputs.platform == 'all' || inputs.platform == '${platform}')`;
+var androidJob = (options) => {
+  const custom = customSecretEnvironment(options.customSecrets);
+  const publishEnvironment = options.includePublishing ? `
+      ABSOLUTE_PUBLISH: \${{ inputs.publish }}
+      ABSOLUTE_RELEASE_CHANNEL: \${{ inputs.channel }}
+      ABSOLUTE_PLAY_TRACK: \${{ inputs.play_track }}
+      ABSOLUTE_GOOGLE_CREDENTIALS_BASE64: \${{ secrets.ABSOLUTE_GOOGLE_CREDENTIALS_BASE64 }}
+      GOOGLE_APPLICATION_CREDENTIALS: \${{ runner.temp }}/absolute-google-credentials.json` : "";
+  const publishCommand = options.includePublishing ? `if [[ "$ABSOLUTE_PUBLISH" == "true" ]]; then
+            args=(bunx absolute mobile publish android "$ABSOLUTE_SERVER_ENTRY" --registry "$ABSOLUTE_REGISTRY_MODULE")
+            if [[ -n "$ABSOLUTE_RELEASE_CHANNEL" ]]; then
+              args+=(--channel "$ABSOLUTE_RELEASE_CHANNEL")
+            fi
+            if [[ "$ABSOLUTE_PLAY_TRACK" != "registry-only" ]]; then
+              args+=(--play-track "$ABSOLUTE_PLAY_TRACK")
+            fi
+          else
+            args=(bunx absolute mobile build android "$ABSOLUTE_SERVER_ENTRY")
+          fi` : `args=(bunx absolute mobile build android "$ABSOLUTE_SERVER_ENTRY")`;
+  const googleSetup = options.includePublishing ? `
+          if [[ "$ABSOLUTE_PUBLISH" == "true" && "$ABSOLUTE_PLAY_TRACK" != "registry-only" ]]; then
+            if [[ -z "$ABSOLUTE_GOOGLE_CREDENTIALS_BASE64" ]]; then
+              echo "ABSOLUTE_GOOGLE_CREDENTIALS_BASE64 is required for Google Play publication." >&2
+              exit 1
+            fi
+            printf '%s' "$ABSOLUTE_GOOGLE_CREDENTIALS_BASE64" | base64 --decode > "$GOOGLE_APPLICATION_CREDENTIALS"
+            chmod 600 "$GOOGLE_APPLICATION_CREDENTIALS"
+          fi` : "";
+  return `
+  android:
+    name: Signed Android release
+    needs: validate
+    if: \${{ ${jobCondition("android")} }}
+    runs-on: ubuntu-latest
+    environment: absolute-mobile-release
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
+    env:
+      ABSOLUTE_ANDROID_KEYSTORE_BASE64: \${{ secrets.ABSOLUTE_ANDROID_KEYSTORE_BASE64 }}
+      ABSOLUTE_ANDROID_KEYSTORE_PASSWORD: \${{ secrets.ABSOLUTE_ANDROID_KEYSTORE_PASSWORD }}
+      ABSOLUTE_ANDROID_KEY_ALIAS: \${{ secrets.ABSOLUTE_ANDROID_KEY_ALIAS }}
+      ABSOLUTE_ANDROID_KEY_PASSWORD: \${{ secrets.ABSOLUTE_ANDROID_KEY_PASSWORD }}
+      ABSOLUTE_ANDROID_KEYSTORE_PATH: \${{ runner.temp }}/absolute-release.jks${publishEnvironment}${custom ? `
+${custom}` : ""}
+${commandEnvironment({ configPath: undefined, registryModule: "", serverEntry: "" })}
+    steps:
+${installSteps}
+      - name: Provision Android signing
+        shell: bash
+        run: |
+          required=(
+            ABSOLUTE_ANDROID_KEYSTORE_BASE64
+            ABSOLUTE_ANDROID_KEYSTORE_PASSWORD
+            ABSOLUTE_ANDROID_KEY_ALIAS
+            ABSOLUTE_ANDROID_KEY_PASSWORD
+          )
+          for name in "\${required[@]}"; do
+            if [[ -z "\${!name}" ]]; then
+              echo "$name is required in the absolute-mobile-release environment." >&2
+              exit 1
+            fi
+          done
+          printf '%s' "$ABSOLUTE_ANDROID_KEYSTORE_BASE64" | base64 --decode > "\${{ runner.temp }}/absolute-release.jks"
+          chmod 600 "\${{ runner.temp }}/absolute-release.jks"${googleSetup}
+      - name: Build or publish Android
+        shell: bash
+        run: |
+          ${publishCommand}
+          ${appendConfigArgument}
+          "\${args[@]}"
+${releaseAuditSteps("android")}
+      - name: Attest Android App Bundle
+        if: inputs.attest
+        uses: actions/attest@v4
+        with:
+          subject-path: .absolutejs/mobile/releases/android/**/app-release.aab
+      - name: Upload Android release
+        uses: actions/upload-artifact@v7
+        with:
+          name: absolute-mobile-android
+          path: .absolutejs/mobile/releases/android/
+          if-no-files-found: error
+          retention-days: 14
+          include-hidden-files: true
+      - name: Remove Android credentials
+        if: always()
+        shell: bash
+        run: |
+          rm -f "\${{ runner.temp }}/absolute-release.jks"
+          rm -f "\${{ runner.temp }}/absolute-google-credentials.json"`;
+};
+var iosJob = (options) => {
+  const custom = customSecretEnvironment(options.customSecrets);
+  const publishEnvironment = options.includePublishing ? `
+      ABSOLUTE_PUBLISH: \${{ inputs.publish }}
+      ABSOLUTE_RELEASE_CHANNEL: \${{ inputs.channel }}
+      ABSOLUTE_TESTFLIGHT_GROUP: \${{ inputs.testflight_group }}
+      ABSOLUTE_TESTFLIGHT_SUBMIT_REVIEW: \${{ inputs.submit_testflight_review }}
+      APP_STORE_CONNECT_ISSUER_ID: \${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
+      APP_STORE_CONNECT_KEY_ID: \${{ secrets.APP_STORE_CONNECT_KEY_ID }}
+      APP_STORE_CONNECT_PRIVATE_KEY_BASE64: \${{ secrets.APP_STORE_CONNECT_PRIVATE_KEY_BASE64 }}
+      APP_STORE_CONNECT_PRIVATE_KEY_PATH: \${{ runner.temp }}/AuthKey_AbsoluteJS.p8` : "";
+  const publishCommand = options.includePublishing ? `if [[ "$ABSOLUTE_PUBLISH" == "true" ]]; then
+            args=(bunx absolute mobile publish ios "$ABSOLUTE_SERVER_ENTRY" --registry "$ABSOLUTE_REGISTRY_MODULE")
+            if [[ -n "$ABSOLUTE_RELEASE_CHANNEL" ]]; then
+              args+=(--channel "$ABSOLUTE_RELEASE_CHANNEL")
+            fi
+            if [[ -n "$ABSOLUTE_TESTFLIGHT_GROUP" ]]; then
+              args+=(--testflight-group "$ABSOLUTE_TESTFLIGHT_GROUP")
+            fi
+            if [[ "$ABSOLUTE_TESTFLIGHT_SUBMIT_REVIEW" == "true" ]]; then
+              args+=(--testflight-submit-review)
+            fi
+          else
+            args=(bunx absolute mobile build ios "$ABSOLUTE_SERVER_ENTRY")
+          fi` : `args=(bunx absolute mobile build ios "$ABSOLUTE_SERVER_ENTRY")`;
+  const appStoreSetup = options.includePublishing ? `
+          if [[ "$ABSOLUTE_PUBLISH" == "true" && -n "$ABSOLUTE_TESTFLIGHT_GROUP" ]]; then
+            required+=(APP_STORE_CONNECT_ISSUER_ID APP_STORE_CONNECT_KEY_ID APP_STORE_CONNECT_PRIVATE_KEY_BASE64)
+          fi` : "";
+  const appStoreDecode = options.includePublishing ? `
+          if [[ "$ABSOLUTE_PUBLISH" == "true" && -n "$ABSOLUTE_TESTFLIGHT_GROUP" ]]; then
+            printf '%s' "$APP_STORE_CONNECT_PRIVATE_KEY_BASE64" | base64 --decode > "$APP_STORE_CONNECT_PRIVATE_KEY_PATH"
+            chmod 600 "$APP_STORE_CONNECT_PRIVATE_KEY_PATH"
+          fi` : "";
+  return `
+  ios:
+    name: Signed iOS release
+    needs: validate
+    if: \${{ ${jobCondition("ios")} }}
+    runs-on: macos-latest
+    environment: absolute-mobile-release
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
+    env:
+      ABSOLUTE_IOS_CERTIFICATE_BASE64: \${{ secrets.ABSOLUTE_IOS_CERTIFICATE_BASE64 }}
+      ABSOLUTE_IOS_CERTIFICATE_PASSWORD: \${{ secrets.ABSOLUTE_IOS_CERTIFICATE_PASSWORD }}
+      ABSOLUTE_IOS_PROVISIONING_PROFILE_BASE64: \${{ secrets.ABSOLUTE_IOS_PROVISIONING_PROFILE_BASE64 }}
+      ABSOLUTE_IOS_KEYCHAIN_PASSWORD: \${{ secrets.ABSOLUTE_IOS_KEYCHAIN_PASSWORD }}${publishEnvironment}${custom ? `
+${custom}` : ""}
+      ABSOLUTE_IOS_DEVELOPMENT_TEAM: \${{ secrets.ABSOLUTE_IOS_DEVELOPMENT_TEAM }}
+${commandEnvironment({ configPath: undefined, registryModule: "", serverEntry: "" })}
+    steps:
+${installSteps}
+      - name: Provision iOS signing
+        shell: bash
+        run: |
+          required=(
+            ABSOLUTE_IOS_CERTIFICATE_BASE64
+            ABSOLUTE_IOS_CERTIFICATE_PASSWORD
+            ABSOLUTE_IOS_PROVISIONING_PROFILE_BASE64
+            ABSOLUTE_IOS_KEYCHAIN_PASSWORD
+            ABSOLUTE_IOS_DEVELOPMENT_TEAM
+          )${appStoreSetup}
+          for name in "\${required[@]}"; do
+            if [[ -z "\${!name}" ]]; then
+              echo "$name is required in the absolute-mobile-release environment." >&2
+              exit 1
+            fi
+          done
+          CERTIFICATE_PATH="\${{ runner.temp }}/absolute-signing.p12"
+          PROFILE_PATH="\${{ runner.temp }}/absolute.mobileprovision"
+          KEYCHAIN_PATH="\${{ runner.temp }}/absolute-signing.keychain-db"
+          PROFILE_DESTINATION="$HOME/Library/MobileDevice/Provisioning Profiles/absolute.mobileprovision"
+          printf '%s' "$ABSOLUTE_IOS_CERTIFICATE_BASE64" | base64 --decode > "$CERTIFICATE_PATH"
+          printf '%s' "$ABSOLUTE_IOS_PROVISIONING_PROFILE_BASE64" | base64 --decode > "$PROFILE_PATH"
+          security create-keychain -p "$ABSOLUTE_IOS_KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
+          security unlock-keychain -p "$ABSOLUTE_IOS_KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          security import "$CERTIFICATE_PATH" -P "$ABSOLUTE_IOS_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
+          security set-key-partition-list -S apple-tool:,apple: -k "$ABSOLUTE_IOS_KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          security list-keychain -d user -s "$KEYCHAIN_PATH"
+          mkdir -p "$(dirname "$PROFILE_DESTINATION")"
+          cp "$PROFILE_PATH" "$PROFILE_DESTINATION"${appStoreDecode}
+      - name: Build or publish iOS
+        shell: bash
+        run: |
+          ${publishCommand}
+          ${appendConfigArgument}
+          "\${args[@]}"
+${releaseAuditSteps("ios")}
+      - name: Attest iOS IPA
+        if: inputs.attest
+        uses: actions/attest@v4
+        with:
+          subject-path: .absolutejs/mobile/releases/ios/**/App.ipa
+      - name: Upload iOS release
+        uses: actions/upload-artifact@v7
+        with:
+          name: absolute-mobile-ios
+          path: .absolutejs/mobile/releases/ios/
+          if-no-files-found: error
+          retention-days: 14
+          include-hidden-files: true
+      - name: Remove iOS credentials
+        if: always()
+        shell: bash
+        run: |
+          security delete-keychain "\${{ runner.temp }}/absolute-signing.keychain-db" 2>/dev/null || true
+          rm -f "$HOME/Library/MobileDevice/Provisioning Profiles/absolute.mobileprovision"
+          rm -f "\${{ runner.temp }}/absolute-signing.p12"
+          rm -f "\${{ runner.temp }}/absolute.mobileprovision"
+          rm -f "\${{ runner.temp }}/AuthKey_AbsoluteJS.p8"`;
+};
+var requiredSecrets = (platforms, includePublishing, custom) => [
+  ...platforms.includes("android") ? [
+    "ABSOLUTE_ANDROID_KEYSTORE_BASE64",
+    "ABSOLUTE_ANDROID_KEYSTORE_PASSWORD",
+    "ABSOLUTE_ANDROID_KEY_ALIAS",
+    "ABSOLUTE_ANDROID_KEY_PASSWORD",
+    ...includePublishing ? ["ABSOLUTE_GOOGLE_CREDENTIALS_BASE64"] : []
+  ] : [],
+  ...platforms.includes("ios") ? [
+    "ABSOLUTE_IOS_CERTIFICATE_BASE64",
+    "ABSOLUTE_IOS_CERTIFICATE_PASSWORD",
+    "ABSOLUTE_IOS_PROVISIONING_PROFILE_BASE64",
+    "ABSOLUTE_IOS_KEYCHAIN_PASSWORD",
+    "ABSOLUTE_IOS_DEVELOPMENT_TEAM",
+    ...includePublishing ? [
+      "APP_STORE_CONNECT_ISSUER_ID",
+      "APP_STORE_CONNECT_KEY_ID",
+      "APP_STORE_CONNECT_PRIVATE_KEY_BASE64"
+    ] : []
+  ] : [],
+  ...custom
+];
+var createAbsoluteMobileGithubWorkflow = (options) => {
+  const platforms = [
+    ...options.config.platforms
+  ].sort();
+  const includePublishing = options.includePublishing === true;
+  const customSecrets = normalizeSecretEnvironment(options.secretEnvironment);
+  const serverEntry = projectPath(options.projectRoot, options.serverEntry ?? "server.ts", "mobile ci github server entry");
+  const configPath = options.configPath ? projectPath(options.projectRoot, options.configPath, "mobile ci github --config") : undefined;
+  const registryModule = projectPath(options.projectRoot, options.registryModule ?? "mobile.release.ts", "mobile ci github --registry", { allowMissing: !includePublishing });
+  const environment = commandEnvironment({
+    configPath,
+    registryModule,
+    serverEntry
+  });
+  let workflow = `# Generated by AbsoluteJS. Regenerate with: absolute mobile ci github${includePublishing ? " --publish" : ""}
+name: AbsoluteJS Mobile
+
+on:
+  pull_request:
+  workflow_dispatch:
+    inputs:
+${platformInput(platforms)}
+      attest:
+        description: Generate GitHub artifact provenance attestations
+        required: true
+        type: boolean
+        default: false${publishingInputs(platforms, includePublishing)}
+
+concurrency:
+  group: absolute-mobile-\${{ github.repository }}
+  cancel-in-progress: false
+
+jobs:
+  validate:
+    name: Validate mobile release inputs
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    env:
+${environment}
+    steps:
+${installSteps}
+${bundleAuditSteps}${platforms.includes("android") ? androidJob({ customSecrets, includePublishing }) : ""}${platforms.includes("ios") ? iosJob({ customSecrets, includePublishing }) : ""}
+`;
+  const replacements = new Map([
+    [
+      "ABSOLUTE_CONFIG_PATH: ''",
+      `ABSOLUTE_CONFIG_PATH: ${yamlString(configPath ?? "")}`
+    ],
+    [
+      "ABSOLUTE_REGISTRY_MODULE: ''",
+      `ABSOLUTE_REGISTRY_MODULE: ${yamlString(registryModule)}`
+    ],
+    [
+      "ABSOLUTE_SERVER_ENTRY: ''",
+      `ABSOLUTE_SERVER_ENTRY: ${yamlString(serverEntry)}`
+    ]
+  ]);
+  for (const [placeholder, replacement] of replacements)
+    workflow = workflow.replaceAll(placeholder, replacement);
+  return {
+    requiredSecrets: requiredSecrets(platforms, includePublishing, customSecrets),
+    workflow
+  };
+};
+var writeAbsoluteMobileGithubWorkflow = async (options) => {
+  const path = workflowOutputPath(options.projectRoot, options.outputPath);
+  const generated = createAbsoluteMobileGithubWorkflow(options);
+  const previous = await exists3(path) ? await readFile15(path, "utf8") : undefined;
+  if (previous !== undefined && previous !== generated.workflow && !options.force)
+    throw new TypeError(`${relative10(options.projectRoot, path)} already exists and differs. Rerun with --force to replace the generated workflow.`);
+  if (previous !== generated.workflow) {
+    await mkdir11(dirname10(path), { recursive: true });
+    await writeFile12(path, generated.workflow);
+  }
+  return {
+    changed: previous !== generated.workflow,
+    format: ABSOLUTE_MOBILE_CI_WORKFLOW_FORMAT,
+    path,
+    platforms: [...options.config.platforms].sort(),
+    publishing: options.includePublishing === true,
+    requiredSecrets: generated.requiredSecrets
+  };
+};
 // src/mobile/compatibilityDispatcher.ts
 import { Elysia as Elysia2 } from "elysia";
 
@@ -6356,7 +6884,7 @@ var createAbsoluteMobilePreviewPlugin = (mobile) => {
   });
 };
 // src/mobile/nativeDeepLinks.ts
-import { readFile as readFile15, rename as rename11, writeFile as writeFile12 } from "fs/promises";
+import { readFile as readFile16, rename as rename11, writeFile as writeFile13 } from "fs/promises";
 import { join as join17 } from "path";
 var START_MARKER = "<!-- absolutejs:deep-links:start -->";
 var END_MARKER = "<!-- absolutejs:deep-links:end -->";
@@ -6364,11 +6892,11 @@ var IOS_ENTITLEMENTS = "App/AbsoluteJS.entitlements";
 var NOT_FOUND = -1;
 var escapeXml = (value) => value.replaceAll("&", "&amp;").replaceAll('"', "&quot;").replaceAll("'", "&apos;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
 var writeChangedFile = async (path, source) => {
-  const current = await readFile15(path, "utf8");
+  const current = await readFile16(path, "utf8");
   if (current === source)
     return false;
   const temporary = `${path}.${crypto.randomUUID()}.tmp`;
-  await writeFile12(temporary, source, { flag: "wx" });
+  await writeFile13(temporary, source, { flag: "wx" });
   await rename11(temporary, path);
   return true;
 };
@@ -6415,7 +6943,7 @@ ${hosts}
 };
 var configureAndroid = async (config) => {
   const path = join17(config.nativeProjectDirectory, "android/app/src/main/AndroidManifest.xml");
-  const source = await readFile15(path, "utf8");
+  const source = await readFile16(path, "utf8");
   const mainActivity = source.indexOf('android:name=".MainActivity"');
   if (mainActivity === NOT_FOUND) {
     throw new TypeError("Android MainActivity was not found.");
@@ -6441,7 +6969,7 @@ var iosSchemeRegion = (scheme) => `	${START_MARKER}
 `;
 var configureIosInfo = async (config) => {
   const path = join17(config.nativeProjectDirectory, "ios/App/App/Info.plist");
-  const source = await readFile15(path, "utf8");
+  const source = await readFile16(path, "utf8");
   const region = config.deepLinkScheme ? iosSchemeRegion(config.deepLinkScheme) : `	${START_MARKER}
 	${END_MARKER}
 `;
@@ -6467,7 +6995,7 @@ var configureIosEntitlements = async (config) => {
   const path = join17(config.nativeProjectDirectory, "ios/App/AbsoluteJS.entitlements");
   let current = "";
   try {
-    current = await readFile15(path, "utf8");
+    current = await readFile16(path, "utf8");
   } catch (error) {
     if (!(error instanceof Error) || !("code" in error) || error.code !== "ENOENT") {
       throw error;
@@ -6477,13 +7005,13 @@ var configureIosEntitlements = async (config) => {
   if (current === source)
     return false;
   const temporary = `${path}.${crypto.randomUUID()}.tmp`;
-  await writeFile12(temporary, source, { flag: "wx" });
+  await writeFile13(temporary, source, { flag: "wx" });
   await rename11(temporary, path);
   return true;
 };
 var configureIosProject = async (config) => {
   const path = join17(config.nativeProjectDirectory, "ios/App/App.xcodeproj/project.pbxproj");
-  const source = await readFile15(path, "utf8");
+  const source = await readFile16(path, "utf8");
   const declarations = [
     ...source.matchAll(/CODE_SIGN_ENTITLEMENTS = ([^;]+);/g)
   ].map((match) => match[1]);
@@ -6522,7 +7050,7 @@ var applyAbsoluteNativeDeepLinks = async (config, platforms = config.platforms)
 };
 // src/mobile/nativeDeviceCapabilities.ts
 init_deviceCapabilities();
-import { readFile as readFile16, rename as rename12, writeFile as writeFile13 } from "fs/promises";
+import { readFile as readFile17, rename as rename12, writeFile as writeFile14 } from "fs/promises";
 import { join as join18 } from "path";
 var START_MARKER2 = "<!-- absolutejs:device-capabilities:start -->";
 var END_MARKER2 = "<!-- absolutejs:device-capabilities:end -->";
@@ -6533,11 +7061,11 @@ var PUSH_START_MARKER = "absolutejs:push-notifications:start";
 var PUSH_END_MARKER = "absolutejs:push-notifications:end";
 var escapeXml2 = (value) => value.replaceAll("&", "&amp;").replaceAll('"', "&quot;").replaceAll("'", "&apos;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
 var writeChangedFile2 = async (path, source) => {
-  const current = await readFile16(path, "utf8");
+  const current = await readFile17(path, "utf8");
   if (current === source)
     return false;
   const temporary = `${path}.${crypto.randomUUID()}.tmp`;
-  await writeFile13(temporary, source, { flag: "wx" });
+  await writeFile14(temporary, source, { flag: "wx" });
   await rename12(temporary, path);
   return true;
 };
@@ -6546,14 +7074,14 @@ var writeOptionalChangedFile = async (path, source) => {
   if (current === source)
     return false;
   if (current === null) {
-    await writeFile13(path, source, { flag: "wx" });
+    await writeFile14(path, source, { flag: "wx" });
     return true;
   }
   return writeChangedFile2(path, source);
 };
 var optionalSource = async (path) => {
   try {
-    return await readFile16(path, "utf8");
+    return await readFile17(path, "utf8");
   } catch (error) {
     if (typeof error === "object" && error !== null && Reflect.get(error, "code") === "ENOENT")
       return null;
@@ -6667,15 +7195,15 @@ var writeIosPrivacyManifest = async (path, current, source) => {
     return false;
   if (current !== null)
     return writeChangedFile2(path, source);
-  await writeFile13(path, source, { flag: "wx" });
+  await writeFile14(path, source, { flag: "wx" });
   return true;
 };
 var configureIosPrivacyProject = async (config, requirements) => {
   if (requirements.iosPrivacyAccessedApis.length === 0)
     return false;
-  const projectPath = join18(config.nativeProjectDirectory, "ios/App/App.xcodeproj/project.pbxproj");
-  const project = await readFile16(projectPath, "utf8");
-  return writeChangedFile2(projectPath, addIosPrivacyProjectReference(project));
+  const projectPath2 = join18(config.nativeProjectDirectory, "ios/App/App.xcodeproj/project.pbxproj");
+  const project = await readFile17(projectPath2, "utf8");
+  return writeChangedFile2(projectPath2, addIosPrivacyProjectReference(project));
 };
 var addIosPrivacyProjectReference = (source) => {
   const fileMatch = source.match(/([A-F0-9]{24}) \/\* PrivacyInfo\.xcprivacy \*\/ = \{isa = PBXFileReference;/u);
@@ -6727,7 +7255,7 @@ ${next.slice(index)}`;
 };
 var configureIos2 = async (config, plan) => {
   const path = join18(config.nativeProjectDirectory, "ios/App/App/Info.plist");
-  const source = await readFile16(path, "utf8");
+  const source = await readFile17(path, "utf8");
   const requirements = absoluteDeviceNativeRequirements(plan);
   const existingSystemBars = source.match(/<key>UIViewControllerBasedStatusBarAppearance<\/key>\s*<(true|false)\s*\/>/u);
   const ownedStart = source.indexOf(START_MARKER2);
@@ -6820,7 +7348,7 @@ var replacePushRegion = (source, region, insertion) => {
 };
 var configureAndroid2 = async (config, plan) => {
   const path = join18(config.nativeProjectDirectory, "android/app/src/main/AndroidManifest.xml");
-  const source = await readFile16(path, "utf8");
+  const source = await readFile17(path, "utf8");
   const permissions = absoluteDeviceNativeRequirements(plan).androidPermissions;
   const content = permissions.map((permission) => `    <uses-permission android:name="${escapeXml2(permission)}" />`).join(`
 `);
@@ -6869,8 +7397,8 @@ var applyAbsoluteNativeDeviceCapabilities = async (projectRoot, config, platform
   };
 };
 // src/mobile/releasePublisher.ts
-import { access as access9 } from "fs/promises";
-import { isAbsolute as isAbsolute6, relative as relative10, resolve as resolve13, sep as sep6 } from "path";
+import { access as access10 } from "fs/promises";
+import { isAbsolute as isAbsolute6, relative as relative11, resolve as resolve14, sep as sep7 } from "path";
 import { pathToFileURL as pathToFileURL3 } from "url";
 var prepareAbsoluteIosRelease = async (publisher, options) => {
   if (typeof publisher.prepareIosRelease !== "function") {
@@ -6896,17 +7424,17 @@ var prepareAbsoluteAndroidRelease = async (publisher, options) => {
 var isRecord9 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var isPublisher = (value) => isRecord9(value) && typeof value.publish === "function";
 var publisherModulePath = (projectRoot, requested) => {
-  const root = resolve13(projectRoot);
-  const path = resolve13(root, requested);
-  const projectRelative = relative10(root, path);
-  if (projectRelative === ".." || projectRelative.startsWith(`..${sep6}`) || isAbsolute6(projectRelative)) {
+  const root = resolve14(projectRoot);
+  const path = resolve14(root, requested);
+  const projectRelative = relative11(root, path);
+  if (projectRelative === ".." || projectRelative.startsWith(`..${sep7}`) || isAbsolute6(projectRelative)) {
     throw new TypeError("mobile publish --registry must remain inside the project.");
   }
   return path;
 };
 var loadAbsoluteNativeReleasePublisher = async (projectRoot, requestedModulePath) => {
   const modulePath = publisherModulePath(projectRoot, requestedModulePath);
-  await access9(modulePath).catch(() => {
+  await access10(modulePath).catch(() => {
     throw new TypeError(`Native release registry module does not exist: ${modulePath}`);
   });
   const loaded = await import(pathToFileURL3(modulePath).href);
@@ -6967,8 +7495,8 @@ var publishAbsoluteIosRelease = async (options) => {
   return publication;
 };
 // src/mobile/routeMetadataTransform.ts
-import { existsSync as existsSync5, readFileSync as readFileSync7 } from "fs";
-import { dirname as dirname11, extname as extname4, relative as relative11, resolve as resolve14 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync7 } from "fs";
+import { dirname as dirname12, extname as extname5, relative as relative12, resolve as resolve15 } from "path";
 import ts2 from "typescript";
 var ROUTE_METHODS = new Set(["get", "head"]);
 var SOURCE_FILTER = /\.[cm]?[jt]sx?$/;
@@ -7019,7 +7547,7 @@ var PAGE_HANDLERS = new Map([
   ]
 ]);
 var posixPath = (value) => value.replace(/\\/g, "/");
-var findTsconfig = (entry, projectRoot) => ts2.findConfigFile(dirname11(entry), existsSync5, "tsconfig.json") ?? ts2.findConfigFile(projectRoot, existsSync5, "tsconfig.json");
+var findTsconfig = (entry, projectRoot) => ts2.findConfigFile(dirname12(entry), existsSync6, "tsconfig.json") ?? ts2.findConfigFile(projectRoot, existsSync6, "tsconfig.json");
 var createProgram = (entry, projectRoot) => {
   const configPath2 = findTsconfig(entry, projectRoot);
   if (!configPath2) {
@@ -7031,7 +7559,7 @@ var createProgram = (entry, projectRoot) => {
       target: ts2.ScriptTarget.ESNext
     });
   }
-  const parsed = ts2.parseJsonConfigFileContent(ts2.readConfigFile(configPath2, (path) => readFileSync7(path, "utf8")).config, ts2.sys, dirname11(configPath2));
+  const parsed = ts2.parseJsonConfigFileContent(ts2.readConfigFile(configPath2, (path) => readFileSync7(path, "utf8")).config, ts2.sys, dirname12(configPath2));
   if (!parsed.fileNames.includes(entry))
     parsed.fileNames.push(entry);
   return ts2.createProgram(parsed.fileNames, parsed.options);
@@ -7137,7 +7665,7 @@ var resolvePageIdentity = (expression, sourceFile, checker, projectRoot) => {
   const declaration = symbol?.declarations?.[0];
   const file = declaration?.getSourceFile().fileName ?? sourceFile.fileName;
   const exportedName = symbol?.name ?? expression.getText(sourceFile);
-  const source = posixPath(relative11(projectRoot, file));
+  const source = posixPath(relative12(projectRoot, file));
   return `${source}#${exportedName}`;
 };
 var resolveAlias = (symbol, checker) => {
@@ -7376,7 +7904,7 @@ var analyzeProgram = (program, projectRoot) => {
   const checker = program.getTypeChecker();
   const analyzed = new Map;
   for (const sourceFile of program.getSourceFiles()) {
-    const resolvedFile = resolve14(sourceFile.fileName);
+    const resolvedFile = resolve15(sourceFile.fileName);
     if (!isProjectSource(sourceFile, resolvedFile, projectRoot))
       continue;
     const analysis = analyzeSourceFile(sourceFile, checker, projectRoot);
@@ -7469,31 +7997,31 @@ var transformFile = (source, fileName, analysis) => {
 };
 var ABSOLUTE_MOBILE_TRANSFORM_PROTOCOL = ABSOLUTE_MOBILE_PAGE_PROTOCOL_VERSION;
 var createAbsoluteMobileRouteMetadataPlugin = (options) => {
-  const projectRoot = resolve14(options.projectRoot ?? process.cwd());
-  const entry = resolve14(options.entry);
+  const projectRoot = resolve15(options.projectRoot ?? process.cwd());
+  const entry = resolve15(options.entry);
   const analyzed = analyzeProgram(createProgram(entry, projectRoot), projectRoot);
   return {
     name: "absolute-mobile-route-metadata",
     setup(build) {
       build.onLoad({ filter: SOURCE_FILTER }, async ({ path }) => {
-        const analysis = analyzed.get(resolve14(path));
+        const analysis = analyzed.get(resolve15(path));
         if (!analysis)
           return;
         const source = await Bun.file(path).text();
         return {
           contents: transformFile(source, path, analysis),
-          loader: extname4(path).endsWith("x") ? "tsx" : "ts"
+          loader: extname5(path).endsWith("x") ? "tsx" : "ts"
         };
       });
     }
   };
 };
 var inspectAbsoluteMobileRouteMetadata = (options) => {
-  const projectRoot = resolve14(options.projectRoot ?? process.cwd());
-  const entry = resolve14(options.entry);
+  const projectRoot = resolve15(options.projectRoot ?? process.cwd());
+  const entry = resolve15(options.entry);
   const analyzed = analyzeProgram(createProgram(entry, projectRoot), projectRoot);
   return [...analyzed.entries()].flatMap(([file, analysis]) => [...analysis.byRouteCall.values()].map(({ metadata }) => ({
-    file: posixPath(relative11(projectRoot, file)),
+    file: posixPath(relative12(projectRoot, file)),
     metadata
   })));
 };
@@ -7701,6 +8229,7 @@ var http = createAbsoluteHttpClient();
 // src/mobile/shellHttp.ts
 var installAbsoluteMobileShellHttp = (origin, fetch2 = globalThis.fetch) => installAbsoluteHttpTransport(createAbsoluteHttpTransport({ fetch: fetch2, origin, runtime: "native" }));
 export {
+  writeAbsoluteMobileGithubWorkflow,
   writeAbsoluteCapacitorConfig,
   waitForAbsoluteIosHmrLog,
   verifyAbsoluteMobileCompatibilityProducer,
@@ -7789,6 +8318,7 @@ export {
   createAbsoluteMobilePageRequest,
   createAbsoluteMobilePageErrorResponse,
   createAbsoluteMobileInvalidRequestResponse,
+  createAbsoluteMobileGithubWorkflow,
   createAbsoluteMobileFileArtifactStore,
   createAbsoluteMobileCompatibilityDispatcher,
   createAbsoluteMobileCompatibilityArtifact,
@@ -7831,11 +8361,12 @@ export {
   ABSOLUTE_MOBILE_MATERIALIZED_BUNDLE_FORMAT,
   ABSOLUTE_MOBILE_COMPATIBILITY_FORMAT,
   ABSOLUTE_MOBILE_CLIENT_MANIFEST_FORMAT,
+  ABSOLUTE_MOBILE_CI_WORKFLOW_FORMAT,
   ABSOLUTE_IOS_SIMULATOR_NAME,
   ABSOLUTE_IOS_RELEASE_FORMAT,
   ABSOLUTE_AUTH_PACKAGE,
   ABSOLUTE_ANDROID_RELEASE_FORMAT
 };
 
-//# debugId=2B8EAAF79628B66764756E2164756E21
+//# debugId=1C9BEF9E4B461BFB64756E2164756E21
 //# sourceMappingURL=index.js.map