@absolutejs/absolute 0.20.0-beta.41 → 0.20.0-beta.42

package/dist/angular/components/core/streamingSlotRegistrar.js

@@ -1,7 +1,7 @@
 // @bun
 var __require = import.meta.require;
 
-// .angular-partial-tmp-DRGeXr/src/core/streamingSlotRegistrar.ts
+// .angular-partial-tmp-vdpOlu/src/core/streamingSlotRegistrar.ts
 var STREAMING_SLOT_REGISTRAR_KEY = Symbol.for("absolutejs.streamingSlotRegistrar");
 var STREAMING_SLOT_WARNING_STORAGE_KEY = Symbol.for("absolutejs.streamingSlotWarningController");
 var STREAMING_SLOT_COLLECTION_STORAGE_KEY = Symbol.for("absolutejs.streamingSlotCollectionController");

package/dist/angular/components/core/streamingSlotRegistry.js

@@ -1,7 +1,7 @@
 // @bun
 var __require = import.meta.require;
 
-// .angular-partial-tmp-DRGeXr/src/core/streamingSlotRegistrar.ts
+// .angular-partial-tmp-vdpOlu/src/core/streamingSlotRegistrar.ts
 var STREAMING_SLOT_REGISTRAR_KEY = Symbol.for("absolutejs.streamingSlotRegistrar");
 var STREAMING_SLOT_WARNING_STORAGE_KEY = Symbol.for("absolutejs.streamingSlotWarningController");
 var STREAMING_SLOT_COLLECTION_STORAGE_KEY = Symbol.for("absolutejs.streamingSlotCollectionController");
@@ -48,7 +48,7 @@ var warnMissingStreamingSlotCollector = (primitiveName) => {
   getWarningController()?.maybeWarn(primitiveName);
 };
 
-// .angular-partial-tmp-DRGeXr/src/core/streamingSlotRegistry.ts
+// .angular-partial-tmp-vdpOlu/src/core/streamingSlotRegistry.ts
 var STREAMING_SLOT_STORAGE_KEY = Symbol.for("absolutejs.streamingSlotAsyncLocalStorage");
 var isObjectRecord2 = (value) => Boolean(value) && typeof value === "object";
 var isAsyncLocalStorage = (value) => isObjectRecord2(value) && ("getStore" in value) && typeof value.getStore === "function" && ("run" in value) && typeof value.run === "function";

package/dist/cli/index.js

@@ -935,7 +935,7 @@ var EXPO_GENERATED_HEADER = `// Generated by AbsoluteJS. Edit absolute.config.ts
     slug: config.appId.toLowerCase().replaceAll(".", "-"),
     version: config.iosVersion ?? "0.1.0"
   }
-}), metroConfig = (projectRoot) => `${EXPO_GENERATED_HEADER}const { getDefaultConfig } = require('expo/metro-config');
+}), expoDynamicAppConfig, expoDevelopmentCaPlugin, metroConfig = (projectRoot) => `${EXPO_GENERATED_HEADER}const { getDefaultConfig } = require('expo/metro-config');
 const path = require('node:path');
 
 const projectRoot = __dirname;
@@ -1223,8 +1223,13 @@ node_modules/
 `
     ],
     [join5(project, "app.json"), jsonSource(expoAppConfig(config))],
+    [join5(project, "app.config.js"), expoDynamicAppConfig],
     [join5(project, "package.json"), jsonSource(expoPackage())],
     [join5(project, "metro.config.js"), metroConfig(projectRoot)],
+    [
+      join5(project, "plugins", "withAbsoluteDevelopmentCa.js"),
+      expoDevelopmentCaPlugin
+    ],
     [
       join5(project, "tsconfig.json"),
       jsonSource(expoTsConfig(projectRoot, project))
@@ -1360,6 +1365,57 @@ export const materializeAbsoluteWebBundle = async () => {
   return { appBuild, assets: assets.length, bundleId, path: destination };
 };
 var init_expoProject = __esm(() => {
+  expoDynamicAppConfig = `${EXPO_GENERATED_HEADER}const config = require('./app.json');
+
+if (process.env.ABSOLUTE_EXPO_DEVELOPMENT === '1' && process.env.ABSOLUTE_EXPO_DEVELOPMENT_CA_PATH) {
+	config.expo.plugins = [
+		...config.expo.plugins,
+		'./plugins/withAbsoluteDevelopmentCa'
+	];
+}
+
+module.exports = config;
+`;
+  expoDevelopmentCaPlugin = `${EXPO_GENERATED_HEADER}const { AndroidConfig, withAndroidManifest, withDangerousMod } = require('expo/config-plugins');
+const { copyFile, mkdir } = require('node:fs/promises');
+const path = require('node:path');
+
+const NETWORK_CONFIG = [
+	'<?xml version="1.0" encoding="utf-8"?>',
+	'<network-security-config>',
+	'	<debug-overrides>',
+	'		<trust-anchors>',
+	'			<certificates src="@raw/absolutejs_dev_ca" />',
+	'		</trust-anchors>',
+	'	</debug-overrides>',
+	'</network-security-config>',
+	''
+].join('\\n');
+
+const withAbsoluteDevelopmentCa = config => {
+	config = withAndroidManifest(config, value => {
+		const application = AndroidConfig.Manifest.getMainApplicationOrThrow(value.modResults);
+		application.$['android:networkSecurityConfig'] = '@xml/absolutejs_dev_network_security';
+		return value;
+	});
+	return withDangerousMod(config, ['android', async value => {
+		const certificate = process.env.ABSOLUTE_EXPO_DEVELOPMENT_CA_PATH;
+		if (!certificate) throw new Error('AbsoluteJS Expo HTTPS development requires its development CA path.');
+		const resources = path.join(value.modRequest.platformProjectRoot, 'app', 'src', 'main', 'res');
+		await Promise.all([
+			mkdir(path.join(resources, 'raw'), { recursive: true }),
+			mkdir(path.join(resources, 'xml'), { recursive: true })
+		]);
+		await Promise.all([
+			copyFile(certificate, path.join(resources, 'raw', 'absolutejs_dev_ca.pem')),
+			require('node:fs/promises').writeFile(path.join(resources, 'xml', 'absolutejs_dev_network_security.xml'), NETWORK_CONFIG)
+		]);
+		return value;
+	}]);
+};
+
+module.exports = withAbsoluteDevelopmentCa;
+`;
   layoutSource = `${EXPO_GENERATED_HEADER}import { Stack } from 'expo-router';
 
 export default function AbsoluteLayout() {
@@ -1411,6 +1467,97 @@ export default AbsoluteWebHost;
 `;
 });
 
+// src/mobile/iosPhysicalDeviceTransport.ts
+import { randomUUID, X509Certificate } from "crypto";
+import { createServer as createServer2 } from "http";
+import {
+  connect as connectTcp,
+  createServer as createTcpServer,
+  isIP
+} from "net";
+import { readFile as readFile2 } from "fs/promises";
+var closeServer = (server) => new Promise((resolve4, reject) => {
+  server.close((error) => {
+    if (error)
+      reject(error);
+    else
+      resolve4();
+  });
+}), listen = (server, port) => new Promise((resolve4, reject) => {
+  server.once("error", reject);
+  server.listen(port, "0.0.0.0", () => {
+    server.off("error", reject);
+    const address = server.address();
+    if (!address || typeof address === "string") {
+      reject(new Error("Could not determine the iOS device helper port."));
+      return;
+    }
+    resolve4(address.port);
+  });
+}), findEphemeralPort = async () => {
+  const probe = createTcpServer();
+  const port = await new Promise((resolve4, reject) => {
+    probe.once("error", reject);
+    probe.listen(0, "127.0.0.1", () => {
+      const address = probe.address();
+      if (!address || typeof address === "string") {
+        reject(new Error("Could not allocate the iOS CA enrollment port."));
+        return;
+      }
+      resolve4(address.port);
+    });
+  });
+  await closeServer(probe);
+  return port;
+}, normalizeAbsoluteIosDeviceHost = (value) => {
+  const normalized = value.trim();
+  if (!normalized || normalized.length > 253 || /[\0\s/?#]/u.test(normalized))
+    throw new TypeError("Physical iOS development requires a valid LAN host.");
+  return normalized;
+}, normalizeAbsoluteIosDeviceIdentifier = (value) => {
+  const normalized = value.trim();
+  if (!normalized || normalized.length > 256 || /[\0\r\n]/u.test(normalized))
+    throw new TypeError("--ios-device requires a valid Xcode device identifier or name.");
+  return normalized;
+}, urlForHost = (protocol, host, port) => {
+  const url = new URL(`${protocol}://localhost:${port}`);
+  const normalizedHost = normalizeAbsoluteIosDeviceHost(host);
+  url.hostname = isIP(normalizedHost) === 6 ? `[${normalizedHost}]` : normalizedHost;
+  return url;
+}, startAbsoluteIosCaEnrollmentServer = async (options) => {
+  const certificate = new X509Certificate(await readFile2(options.certificateAuthorityPath));
+  const certificateBytes = certificate.raw;
+  const token = randomUUID().replaceAll("-", "");
+  const certificatePath = `/${token}/absolutejs-development-ca.cer`;
+  const server = createServer2((request, response) => {
+    if (request.method !== "GET" || request.url !== certificatePath) {
+      response.writeHead(404, {
+        "Cache-Control": "no-store",
+        "Content-Type": "text/plain; charset=utf-8"
+      });
+      response.end("Not found.");
+      return;
+    }
+    response.writeHead(200, {
+      "Cache-Control": "no-store",
+      "Content-Disposition": 'attachment; filename="absolutejs-development-ca.cer"',
+      "Content-Length": String(certificateBytes.byteLength),
+      "Content-Type": "application/x-x509-ca-cert",
+      "X-Content-Type-Options": "nosniff"
+    });
+    response.end(certificateBytes);
+  });
+  const port = await findEphemeralPort();
+  await listen(server, port);
+  const url = urlForHost("http", options.displayHost, port);
+  url.pathname = certificatePath;
+  return {
+    url: url.href,
+    close: () => closeServer(server)
+  };
+};
+var init_iosPhysicalDeviceTransport = () => {};
+
 // src/mobile/nativeAuth.ts
 import { readFileSync as readFileSync5 } from "fs";
 import { join as join7 } from "path";
@@ -1459,7 +1606,7 @@ var init_nativeAuth = __esm(() => {
 var {$: $2 } = globalThis.Bun;
 import { execSync } from "child_process";
 import { existsSync as existsSync3, readFileSync as readFileSync6 } from "fs";
-import { createServer as createServer2 } from "net";
+import { createServer as createServer3 } from "net";
 import { resolve as resolve4 } from "path";
 var COMPOSE_PATH = "db/docker-compose.db.yml", DEFAULT_SERVER_ENTRY = "src/backend/server.ts", isWSLEnvironment = () => {
   try {
@@ -1473,7 +1620,7 @@ var COMPOSE_PATH = "db/docker-compose.db.yml", DEFAULT_SERVER_ENTRY = "src/backe
     process.kill(pid, "SIGTERM");
   } catch {}
 }, findFreePort = () => new Promise((_resolve, reject) => {
-  const server = createServer2();
+  const server = createServer3();
   server.unref();
   server.once("error", reject);
   server.listen(0, "127.0.0.1", () => {
@@ -1809,7 +1956,7 @@ var init_emulatorDoctor = __esm(() => {
 });
 
 // src/mobile/capacitorProject.ts
-import { access as access4, readFile as readFile2, rename as rename2, writeFile as writeFile2 } from "fs/promises";
+import { access as access4, readFile as readFile3, rename as rename2, writeFile as writeFile2 } from "fs/promises";
 import { relative as relative2, resolve as resolve5 } from "path";
 var CONFIG_FILE = "capacitor.config.ts", portableRelative2 = (root, path) => relative2(root, path).replaceAll("\\", "/"), capacitorConfigSource = (config, projectRoot) => `import type { CapacitorConfig } from '@capacitor/cli';
 
@@ -1838,7 +1985,7 @@ export default config;
   const destination = resolve5(projectRoot, CONFIG_FILE);
   const source = capacitorConfigSource(config, projectRoot);
   if (await exists2(destination)) {
-    const current = await readFile2(destination, "utf8");
+    const current = await readFile3(destination, "utf8");
     if (current === source)
       return { changed: false, path: destination };
     if (!options.force) {
@@ -1858,7 +2005,7 @@ import {
   copyFile,
   lstat,
   mkdir as mkdir2,
-  readFile as readFile3,
+  readFile as readFile4,
   readdir as readdir2,
   readlink,
   realpath,
@@ -1866,7 +2013,7 @@ import {
   rm as rm2,
   writeFile as writeFile3
 } from "fs/promises";
-import { createHash as createHash2, randomUUID } from "crypto";
+import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
 import {
   dirname as dirname4,
   isAbsolute,
@@ -2072,9 +2219,9 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
       String(identity)
     ]))
   };
-}, readNativeCache = async (projectRoot) => readFile3(nativeCachePath(projectRoot), "utf8").then((source) => parseNativeCache(JSON.parse(source))).catch(() => null), writeNativeCache = async (projectRoot, cache) => {
+}, readNativeCache = async (projectRoot) => readFile4(nativeCachePath(projectRoot), "utf8").then((source) => parseNativeCache(JSON.parse(source))).catch(() => null), writeNativeCache = async (projectRoot, cache) => {
   const destination = nativeCachePath(projectRoot);
-  const temporary = `${destination}.${process.pid}.${randomUUID()}.tmp`;
+  const temporary = `${destination}.${process.pid}.${randomUUID2()}.tmp`;
   await mkdir2(dirname4(destination), { recursive: true });
   try {
     await writeFile3(temporary, `${JSON.stringify(cache, null, "\t")}
@@ -2088,7 +2235,7 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
     });
   }
 }, nativeDependencySources = async (nativeDirectory) => {
-  const settings = await readFile3(join9(nativeDirectory, "capacitor.settings.gradle"), "utf8");
+  const settings = await readFile4(join9(nativeDirectory, "capacitor.settings.gradle"), "utf8");
   const pattern = new RegExp(CAPACITOR_PROJECT_DIRECTORY_PATTERN.source, CAPACITOR_PROJECT_DIRECTORY_PATTERN.flags);
   const dependencies = [...settings.matchAll(pattern)].map((match) => ({
     name: (match[1] ?? "").slice(1).replaceAll(/[^a-zA-Z0-9_.-]/gu, "_"),
@@ -2119,7 +2266,7 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
     return [];
   const [metadata, contents] = await Promise.all([
     lstat(path),
-    readFile3(path)
+    readFile4(path)
   ]);
   const contentDigest = createHash2("sha256").update(contents).digest("hex");
   return [
@@ -2189,7 +2336,7 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
     await rm2(paths.root, { force: true, recursive: true });
     return false;
   }
-  const journal = await readFile3(paths.journal, "utf8").then((source) => parseJournal(JSON.parse(source))).catch(() => null);
+  const journal = await readFile4(paths.journal, "utf8").then((source) => parseJournal(JSON.parse(source))).catch(() => null);
   if (!journal || !isInside(projectRoot, journal.nativeConfigPath) || !isInside(paths.root, journal.backupPath) || journal.nativeManifestPath !== undefined && !isInside(projectRoot, journal.nativeManifestPath) || journal.manifestBackupPath !== undefined && !isInside(paths.root, journal.manifestBackupPath) || journal.projectedFiles?.some((file) => !isInside(projectRoot, file.path) || file.backupPath !== undefined && !isInside(paths.root, file.backupPath))) {
     throw new Error(`Refusing unsafe or invalid mobile dev journal at ${paths.journal}.`);
   }
@@ -2248,8 +2395,8 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
 }, writeDevConfig = async (projectRoot, nativeConfigPath, nativeManifestPath, port, https, entry, embeddedBundle, serverHost, certificateAuthorityPath) => {
   const paths = journalPaths(projectRoot);
   await repairAbsoluteAndroidDevSession(projectRoot);
-  const source = await readFile3(nativeConfigPath, "utf8");
-  const manifestSource = await readFile3(nativeManifestPath, "utf8");
+  const source = await readFile4(nativeConfigPath, "utf8");
+  const manifestSource = await readFile4(nativeManifestPath, "utf8");
   const parsed = JSON.parse(source);
   if (!isRecord(parsed)) {
     throw new Error(`Invalid Capacitor native config at ${nativeConfigPath}.`);
@@ -2302,7 +2449,7 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
       mkdir2(dirname4(networkConfigPath), { recursive: true })
     ]);
     await copyFile(certificateAuthorityPath, caPath);
-    const existingNetworkConfigSource = existingNetworkConfig ? await readFile3(networkConfigPath, "utf8") : `<?xml version="1.0" encoding="utf-8"?>
+    const existingNetworkConfigSource = existingNetworkConfig ? await readFile4(networkConfigPath, "utf8") : `<?xml version="1.0" encoding="utf-8"?>
 <network-security-config>
 </network-security-config>
 `;
@@ -2355,7 +2502,7 @@ var ANDROID_BOOT_TIMEOUT_MS = 180000, ANDROID_BOOT_POLL_MS = 1000, DEV_JOURNAL_F
   return result.stdout.trim();
 }, mirroredCapacitorDependencies = async (project, capture) => {
   const settingsPath = join9(project.nativeDirectory, "capacitor.settings.gradle");
-  const settings = await readFile3(settingsPath, "utf8");
+  const settings = await readFile4(settingsPath, "utf8");
   const dependencies = [];
   const rewrittenSettings = settings.replace(CAPACITOR_PROJECT_DIRECTORY_PATTERN, (_statement, projectName, sourcePath) => {
     const name = projectName.slice(1).replaceAll(/[^a-zA-Z0-9_.-]/gu, "_");
@@ -2855,7 +3002,7 @@ var init_androidEmulatorController = __esm(() => {
 
 // src/mobile/emulatorInstaller.ts
 import { createHash as createHash3 } from "crypto";
-import { cp as cp2, mkdir as mkdir3, mkdtemp as mkdtemp2, readFile as readFile4, rm as rm3 } from "fs/promises";
+import { cp as cp2, mkdir as mkdir3, mkdtemp as mkdtemp2, readFile as readFile5, rm as rm3 } from "fs/promises";
 import { tmpdir } from "os";
 import { basename as basename3, join as join10 } from "path";
 var ANDROID_API = 36, ANDROID_BUILD_TOOLS = "36.0.0", COMMAND_LINE_TOOLS_VERSION = "15859902", LICENSE_ACCEPTANCE_RESPONSES = 100, COMMAND_LINE_TOOLS, defaultRun = async (command, options = {}) => {
@@ -3064,7 +3211,7 @@ var ANDROID_API = 36, ANDROID_BUILD_TOOLS = "36.0.0", COMMAND_LINE_TOOLS_VERSION
   const arch2 = options.arch ?? process.arch;
   const exists3 = options.exists ?? (async (path) => {
     try {
-      await readFile4(path);
+      await readFile5(path);
       return true;
     } catch {
       return false;
@@ -3167,7 +3314,7 @@ import {
   mkdir as mkdir4,
   mkdtemp as mkdtemp3,
   readdir as readdir3,
-  readFile as readFile5,
+  readFile as readFile6,
   rename as rename4,
   rm as rm4,
   stat,
@@ -3243,7 +3390,7 @@ var developmentTeamArgument = (value) => {
 }, fingerprintAbsoluteIosNativeProject = async (nativeDirectory, options = {}) => {
   const hasher = createHash4("sha256");
   const files = await fingerprintFiles(nativeDirectory, nativeDirectory, options);
-  const contents = await Promise.all(files.map((file) => readFile5(file)));
+  const contents = await Promise.all(files.map((file) => readFile6(file)));
   files.forEach((file, index) => {
     hasher.update(relative4(nativeDirectory, file).replaceAll("\\", "/"));
     hasher.update("\x00");
@@ -3259,7 +3406,7 @@ var developmentTeamArgument = (value) => {
     throw new TypeError("mobile build --outdir must remain inside the project.");
   }
   return output;
-}, sha256File = async (path) => createHash4("sha256").update(await readFile5(path)).digest("hex"), findByExtension = async (root, extension) => {
+}, sha256File = async (path) => createHash4("sha256").update(await readFile6(path)).digest("hex"), findByExtension = async (root, extension) => {
   if (!await pathExists3(root))
     return;
   const entries = await readdir3(root, { withFileTypes: true });
@@ -3290,7 +3437,7 @@ var developmentTeamArgument = (value) => {
   const releaseRoot = join11(outputRoot, metadata.releaseId);
   const destination = join11(releaseRoot, "App.ipa");
   if (await pathExists3(releaseRoot)) {
-    const value = JSON.parse(await readFile5(join11(releaseRoot, "release.json"), "utf8"));
+    const value = JSON.parse(await readFile6(join11(releaseRoot, "release.json"), "utf8"));
     if (!isRecord2(value) || value.artifact !== "App.ipa" || Object.entries(metadata).some(([key, expected]) => Reflect.get(value, key) !== expected)) {
       throw new TypeError(`Immutable iOS release ${metadata.releaseId} does not match its content.`);
     }
@@ -3334,7 +3481,7 @@ var developmentTeamArgument = (value) => {
   const marketingVersion = options.config.iosVersion;
   if (!marketingVersion)
     throw new TypeError("iOS release builds require mobile.ios.version in absolutejs.config.ts.");
-  const manifest = requireManifest(JSON.parse(await readFile5(join11(options.config.bundleDirectory, "absolute-mobile-manifest.json"), "utf8")));
+  const manifest = requireManifest(JSON.parse(await readFile6(join11(options.config.bundleDirectory, "absolute-mobile-manifest.json"), "utf8")));
   if (manifest.appId !== options.config.appId)
     throw new TypeError("Embedded mobile manifest appId does not match mobile.appId.");
   const nativeDirectory = join11(options.config.nativeProjectDirectory, "ios");
@@ -3439,97 +3586,6 @@ var init_iosRelease = __esm(() => {
   ]);
 });
 
-// src/mobile/iosPhysicalDeviceTransport.ts
-import { randomUUID as randomUUID2, X509Certificate } from "crypto";
-import { createServer as createServer3 } from "http";
-import {
-  connect as connectTcp,
-  createServer as createTcpServer,
-  isIP
-} from "net";
-import { readFile as readFile6 } from "fs/promises";
-var closeServer = (server) => new Promise((resolve8, reject) => {
-  server.close((error) => {
-    if (error)
-      reject(error);
-    else
-      resolve8();
-  });
-}), listen = (server, port) => new Promise((resolve8, reject) => {
-  server.once("error", reject);
-  server.listen(port, "0.0.0.0", () => {
-    server.off("error", reject);
-    const address = server.address();
-    if (!address || typeof address === "string") {
-      reject(new Error("Could not determine the iOS device helper port."));
-      return;
-    }
-    resolve8(address.port);
-  });
-}), findEphemeralPort = async () => {
-  const probe = createTcpServer();
-  const port = await new Promise((resolve8, reject) => {
-    probe.once("error", reject);
-    probe.listen(0, "127.0.0.1", () => {
-      const address = probe.address();
-      if (!address || typeof address === "string") {
-        reject(new Error("Could not allocate the iOS CA enrollment port."));
-        return;
-      }
-      resolve8(address.port);
-    });
-  });
-  await closeServer(probe);
-  return port;
-}, normalizeAbsoluteIosDeviceHost = (value) => {
-  const normalized = value.trim();
-  if (!normalized || normalized.length > 253 || /[\0\s/?#]/u.test(normalized))
-    throw new TypeError("Physical iOS development requires a valid LAN host.");
-  return normalized;
-}, normalizeAbsoluteIosDeviceIdentifier = (value) => {
-  const normalized = value.trim();
-  if (!normalized || normalized.length > 256 || /[\0\r\n]/u.test(normalized))
-    throw new TypeError("--ios-device requires a valid Xcode device identifier or name.");
-  return normalized;
-}, urlForHost = (protocol, host, port) => {
-  const url = new URL(`${protocol}://localhost:${port}`);
-  const normalizedHost = normalizeAbsoluteIosDeviceHost(host);
-  url.hostname = isIP(normalizedHost) === 6 ? `[${normalizedHost}]` : normalizedHost;
-  return url;
-}, startAbsoluteIosCaEnrollmentServer = async (options) => {
-  const certificate = new X509Certificate(await readFile6(options.certificateAuthorityPath));
-  const certificateBytes = certificate.raw;
-  const token = randomUUID2().replaceAll("-", "");
-  const certificatePath = `/${token}/absolutejs-development-ca.cer`;
-  const server = createServer3((request, response) => {
-    if (request.method !== "GET" || request.url !== certificatePath) {
-      response.writeHead(404, {
-        "Cache-Control": "no-store",
-        "Content-Type": "text/plain; charset=utf-8"
-      });
-      response.end("Not found.");
-      return;
-    }
-    response.writeHead(200, {
-      "Cache-Control": "no-store",
-      "Content-Disposition": 'attachment; filename="absolutejs-development-ca.cer"',
-      "Content-Length": String(certificateBytes.byteLength),
-      "Content-Type": "application/x-x509-ca-cert",
-      "X-Content-Type-Options": "nosniff"
-    });
-    response.end(certificateBytes);
-  });
-  const port = await findEphemeralPort();
-  await listen(server, port);
-  const url = urlForHost("http", options.displayHost, port);
-  url.pathname = certificatePath;
-  return {
-    url: url.href,
-    close: () => closeServer(server)
-  };
-};
-var init_iosPhysicalDeviceTransport = () => {};
-
 // src/mobile/iosSimulatorController.ts
 import { createHash as createHash5, randomUUID as randomUUID3 } from "crypto";
 import {
@@ -23303,6 +23359,7 @@ init_config();
 init_expoProject();
 
 // src/mobile/expoDevController.ts
+init_iosPhysicalDeviceTransport();
 import { spawn } from "child_process";
 import { access as access2 } from "fs/promises";
 import { join as join6 } from "path";
@@ -23310,6 +23367,9 @@ var METRO_READY_TIMEOUT_MS = 60000;
 var PROCESS_CLOSE_TIMEOUT_MS = 2000;
 var commandEnvironment = (options) => ({
   ABSOLUTE_EXPO_DEVELOPMENT: "1",
+  ...options.certificateAuthorityPath ? {
+    ABSOLUTE_EXPO_DEVELOPMENT_CA_PATH: options.certificateAuthorityPath
+  } : {},
   ...options.androidOrigin ? { EXPO_PUBLIC_ABSOLUTE_DEV_ANDROID_ORIGIN: options.androidOrigin } : {},
   ...options.iosOrigin ? { EXPO_PUBLIC_ABSOLUTE_DEV_IOS_ORIGIN: options.iosOrigin } : {}
 });
@@ -23327,6 +23387,9 @@ var planAbsoluteExpoDevSession = (config, options) => {
     throw new TypeError("The Expo development controller requires Expo.");
   if (options.platforms.length === 0)
     throw new TypeError("Expo development requires a local target platform.");
+  const secureOrigin = [options.androidOrigin, options.iosOrigin].some((origin) => origin && new URL(origin).protocol === "https:");
+  if (secureOrigin && !options.certificateAuthorityPath)
+    throw new TypeError("Expo HTTPS development requires the AbsoluteJS development CA certificate.");
   const env = commandEnvironment(options);
   const metro = {
     args: [
@@ -23416,6 +23479,21 @@ var waitForExit = (process2) => new Promise((resolve4) => {
   }
   process2.once("exit", (code) => resolve4(code ?? 1));
 });
+var runUtilityCommand = async (run, command, args, options) => {
+  const child = run(command, args, {
+    cwd: options.cwd,
+    env: process.env,
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  forwardLines(child, options.log);
+  const abort = () => void stopProcess(child);
+  options.signal?.addEventListener("abort", abort, { once: true });
+  const exitCode = await waitForExit(child);
+  options.signal?.removeEventListener("abort", abort);
+  if (options.signal?.aborted)
+    throw abortError();
+  return exitCode;
+};
 var startAbsoluteExpoDevSession = async (options) => {
   const plan = planAbsoluteExpoDevSession(options.config, options);
   const executable = options.executable ?? await absoluteExpoExecutable(plan.project);
@@ -23424,6 +23502,16 @@ var startAbsoluteExpoDevSession = async (options) => {
     return;
   });
   const timings = {};
+  let caEnrollmentServer = null;
+  const closeEnrollmentServer = async () => {
+    const server = caEnrollmentServer;
+    caEnrollmentServer = null;
+    await server?.close();
+  };
+  const publishTiming = (phase, durationMs) => {
+    timings[phase] = (timings[phase] ?? 0) + durationMs;
+    options.onPhaseTiming?.({ durationMs, phase });
+  };
   const setState = (state) => {
     options.onStateChange?.(state);
   };
@@ -23524,6 +23612,30 @@ var startAbsoluteExpoDevSession = async (options) => {
     if (exitCode !== 0) {
       throw new Error(`Expo ${platform2} development build exited with status ${exitCode}.`);
     }
+    if (platform2 === "ios" && options.certificateAuthorityPath && options.iosOrigin && new URL(options.iosOrigin).protocol === "https:" && !options.iosDevice) {
+      setState("enrolling-trust");
+      const trustStarted = performance.now();
+      const utilityOptions = {
+        cwd: plan.project,
+        signal: options.signal,
+        log: (line) => line && log(`[ios-trust] ${line}`)
+      };
+      const trustExit = await runUtilityCommand(run, "xcrun", [
+        "simctl",
+        "keychain",
+        "booted",
+        "add-root-cert",
+        options.certificateAuthorityPath
+      ], utilityOptions);
+      if (trustExit !== 0)
+        throw new Error(`Expo iOS Simulator development CA trust exited with status ${trustExit}.`);
+      await runUtilityCommand(run, "xcrun", ["simctl", "terminate", "booted", options.config.appId], utilityOptions);
+      const launchExit = await runUtilityCommand(run, "xcrun", ["simctl", "launch", "booted", options.config.appId], utilityOptions);
+      if (launchExit !== 0)
+        throw new Error(`Expo iOS Simulator relaunch exited with status ${launchExit}.`);
+      log("Installed the AbsoluteJS development CA into the Expo iOS Simulator and relaunched the app.");
+      publishTiming("enrolling-trust", performance.now() - trustStarted);
+    }
     const durationMs = performance.now() - started;
     timings[state] = durationMs;
     options.onPhaseTiming?.({ durationMs, phase: state });
@@ -23535,7 +23647,22 @@ var startAbsoluteExpoDevSession = async (options) => {
     await runNativeCommand(command);
     await runNativeCommands(remaining);
   };
+  const startPhysicalIosEnrollment = async () => {
+    if (!options.iosDevice || !options.certificateAuthorityPath || !options.iosOrigin || new URL(options.iosOrigin).protocol !== "https:") {
+      return;
+    }
+    setState("enrolling-trust");
+    const trustStarted = performance.now();
+    const startEnrollment = options.startCaEnrollmentServer ?? startAbsoluteIosCaEnrollmentServer;
+    caEnrollmentServer = await startEnrollment({
+      certificateAuthorityPath: options.certificateAuthorityPath,
+      displayHost: new URL(options.iosOrigin).hostname
+    });
+    log(`On the iOS device, open ${caEnrollmentServer.url}, install the AbsoluteJS development CA profile, then enable it under Settings > General > About > Certificate Trust Settings. This public CA endpoint exists only for this dev session.`);
+    publishTiming("enrolling-trust", performance.now() - trustStarted);
+  };
   try {
+    await startPhysicalIosEnrollment();
     await metroPromise;
     const metroMs = performance.now() - metroStarted;
     timings["starting-metro"] = metroMs;
@@ -23552,12 +23679,14 @@ var startAbsoluteExpoDevSession = async (options) => {
       close: async () => {
         options.signal?.removeEventListener("abort", abort);
         await stopProcess(metro);
+        await closeEnrollmentServer();
         setState("closed");
       }
     };
   } catch (error) {
     options.signal?.removeEventListener("abort", abort);
     await stopProcess(metro);
+    await closeEnrollmentServer();
     setState("failed");
     throw error;
   }
@@ -23930,14 +24059,17 @@ var dev = async (serverEntry, configPath2, options = {}) => {
   let resolvedDev;
   let buildDirectory = resolvePath2(process.cwd(), "build");
   let mobileConfig;
+  let normalizedMobileConfig;
   let iosPhysicalServerHost;
   let selectedRemoteMacProfile;
   let expoDevProject;
   try {
     const config = await loadConfig(configPath2);
     mobileConfig = config?.mobile;
-    if (mobileConfig)
-      installAbsoluteMobileAuthEnvironment(process.cwd(), normalizeAbsoluteMobileConfig(mobileConfig, process.cwd()));
+    if (mobileConfig) {
+      normalizedMobileConfig = normalizeAbsoluteMobileConfig(mobileConfig, process.cwd());
+      installAbsoluteMobileAuthEnvironment(process.cwd(), normalizedMobileConfig);
+    }
     resolvedDev = resolveDevConfig(config?.dev);
     httpsEnabled = resolvedDev.https;
     if (config?.buildDirectory) {
@@ -23974,6 +24106,7 @@ var dev = async (serverEntry, configPath2, options = {}) => {
   }
   if (httpsEnabled) {
     const certificateHosts = [
+      ...normalizedMobileConfig?.engine === "expo" && !options.androidDevice && normalizedMobileConfig.platforms.includes("android") ? ["10.0.2.2"] : [],
       ...options.androidDevice ? [mobileReachableHost(resolvedDev.host)] : [],
       ...iosPhysicalServerHost ? [iosPhysicalServerHost] : []
     ];
@@ -23982,13 +24115,10 @@ var dev = async (serverEntry, configPath2, options = {}) => {
   let androidDevProject = null;
   let iosDevProject = null;
   const mobileInteractive = options.mobile !== false && process.env.ABSOLUTE_NO_MOBILE !== "1" && process.stdin.isTTY === true && process.stdout.isTTY === true;
-  if (mobileConfig && mobileInteractive) {
+  if (normalizedMobileConfig && mobileInteractive) {
     try {
-      const normalized = normalizeAbsoluteMobileConfig(mobileConfig, process.cwd());
+      const normalized = normalizedMobileConfig;
       if (normalized.engine === "expo") {
-        if (httpsEnabled) {
-          throw new TypeError("Combined Expo development currently requires dev.https: false while debug-only CA projection is completed; productionOrigin remains HTTPS.");
-        }
         const generated = await writeAbsoluteExpoProject(normalized, {
           projectRoot: process.cwd()
         });
@@ -24461,7 +24591,7 @@ var dev = async (serverEntry, configPath2, options = {}) => {
   const expoTelemetryPlatform = (phase) => {
     if (phase.endsWith("android"))
       return "android";
-    if (phase.endsWith("ios"))
+    if (phase.endsWith("ios") || phase === "enrolling-trust")
       return "ios";
     return "shared";
   };
@@ -24475,6 +24605,7 @@ var dev = async (serverEntry, configPath2, options = {}) => {
     expoDevStart = startAbsoluteExpoDevSession({
       androidDevice: options.androidDevice,
       androidOrigin: project.platforms.includes("android") ? absoluteDevOrigin(androidHost) : undefined,
+      certificateAuthorityPath: devCertificateAuthorityPath ?? undefined,
       config: project.mobile,
       executable: project.executable,
       iosDevice: options.iosDevice,