@absolutejs/absolute 0.20.0-beta.43 → 0.20.0-beta.44

package/dist/cli/index.js

@@ -847,6 +847,50 @@ var init_config = __esm(() => {
   HOSTNAME_PATTERN = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(?:\.(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?))*$/;
 });
 
+// src/mobile/nativeAuth.ts
+import { readFileSync as readFileSync5 } from "fs";
+import { join as join5 } from "path";
+var ABSOLUTE_AUTH_PACKAGE = "@absolutejs/auth", ABSOLUTE_EXPO_AUTH_CORE_VERSION = "0.75.6", ABSOLUTE_EXPO_AUTH_PACKAGE = "@absolutejs/auth-expo", ABSOLUTE_EXPO_AUTH_VERSION = "0.0.2", ABSOLUTE_NATIVE_AUTH_CLIENTS_ENV = "ABSOLUTE_AUTH_NATIVE_CLIENTS", ABSOLUTE_NATIVE_AUTH_SCOPES, ABSOLUTE_SYNC_PACKAGE = "@absolutejs/sync", readPackageManifest = (projectRoot) => {
+  try {
+    return JSON.parse(readFileSync5(join5(projectRoot, "package.json"), "utf8"));
+  } catch {
+    return;
+  }
+}, packageManifestHas = (manifest, packageName) => {
+  if (typeof manifest !== "object" || manifest === null)
+    return false;
+  return [
+    Reflect.get(manifest, "dependencies"),
+    Reflect.get(manifest, "devDependencies"),
+    Reflect.get(manifest, "optionalDependencies"),
+    Reflect.get(manifest, "peerDependencies")
+  ].some((dependencies) => typeof dependencies === "object" && dependencies !== null && Object.hasOwn(dependencies, packageName));
+}, createAbsoluteMobileAuthManifest = (config) => {
+  const scheme = config.deepLinkScheme ?? config.appId.toLowerCase();
+  return {
+    clientId: `absolutejs-native:${config.appId}`,
+    issuer: config.productionOrigin,
+    redirectUri: `${scheme}://auth/callback`,
+    scopes: [...ABSOLUTE_NATIVE_AUTH_SCOPES]
+  };
+}, installAbsoluteMobileAuthEnvironment = (projectRoot, config) => {
+  const auth = resolveAbsoluteMobileAuthManifest(projectRoot, config);
+  const serialized = serializeAbsoluteMobileAuthEnvironment(config, auth);
+  if (serialized === undefined)
+    delete process.env[ABSOLUTE_NATIVE_AUTH_CLIENTS_ENV];
+  else
+    process.env[ABSOLUTE_NATIVE_AUTH_CLIENTS_ENV] = serialized;
+  return auth;
+}, projectUsesAbsoluteAuth = (projectRoot) => packageManifestHas(readPackageManifest(projectRoot), ABSOLUTE_AUTH_PACKAGE), projectUsesAbsoluteSync = (projectRoot) => packageManifestHas(readPackageManifest(projectRoot), ABSOLUTE_SYNC_PACKAGE), resolveAbsoluteMobileAuthManifest = (projectRoot, config) => projectUsesAbsoluteAuth(projectRoot) ? createAbsoluteMobileAuthManifest(config) : undefined, serializeAbsoluteMobileAuthEnvironment = (config, auth) => auth === undefined ? undefined : JSON.stringify([
+  {
+    ...auth,
+    name: `${config.appName} native app`
+  }
+]);
+var init_nativeAuth = __esm(() => {
+  ABSOLUTE_NATIVE_AUTH_SCOPES = ["openid", "profile"];
+});
+
 // src/mobile/expoProject.ts
 import {
   access,
@@ -860,7 +904,7 @@ import {
   writeFile
 } from "fs/promises";
 import { createHash } from "crypto";
-import { basename as basename2, dirname as dirname3, join as join5, relative, resolve as resolve3 } from "path";
+import { basename as basename2, dirname as dirname3, join as join6, relative, resolve as resolve3 } from "path";
 var EXPO_GENERATED_HEADER = `// Generated by AbsoluteJS. Edit absolute.config.ts, then run absolute mobile sync.
 `, EXPO_ASSET_EXTENSION = ".absasset", EXPO_PROJECT_MARKER = ".absolutejs-expo-project", exists = async (path) => {
   try {
@@ -879,8 +923,12 @@ var EXPO_GENERATED_HEADER = `// Generated by AbsoluteJS. Edit absolute.config.ts
     throw new TypeError(`Expo native route ${route} contains an unsupported segment ${segment}.`);
   }
   return segment;
-}), routeFile = (project, route) => join5(project, "app", ...routeSegments(route), "index.tsx"), expoPackage = () => ({
+}), routeFile = (project, route) => join6(project, "app", ...routeSegments(route), "index.tsx"), expoPackage = (auth) => ({
   dependencies: {
+    ...auth ? {
+      "@absolutejs/auth": ABSOLUTE_EXPO_AUTH_CORE_VERSION,
+      [ABSOLUTE_EXPO_AUTH_PACKAGE]: ABSOLUTE_EXPO_AUTH_VERSION
+    } : {},
     expo: "~57.0.9",
     "expo-asset": "~57.0.15",
     "expo-constants": "~57.0.16",
@@ -889,6 +937,10 @@ var EXPO_GENERATED_HEADER = `// Generated by AbsoluteJS. Edit absolute.config.ts
     "expo-haptics": "~57.0.2",
     "expo-linking": "~57.0.8",
     "expo-router": "~57.0.17",
+    ...auth ? {
+      "expo-secure-store": "~57.0.2",
+      "expo-web-browser": "~57.0.2"
+    } : {},
     react: "19.2.3",
     "react-native": "0.86.3",
     "react-native-safe-area-context": "~5.7.0",
@@ -908,7 +960,7 @@ var EXPO_GENERATED_HEADER = `// Generated by AbsoluteJS. Edit absolute.config.ts
     start: "expo start --dev-client"
   },
   version: "0.0.0"
-}), expoAppConfig = (config) => ({
+}), expoAppConfig = (config, auth) => ({
   expo: {
     android: {
       intentFilters: config.deepLinkHosts.map((host) => ({
@@ -928,7 +980,8 @@ var EXPO_GENERATED_HEADER = `// Generated by AbsoluteJS. Edit absolute.config.ts
     name: config.appName,
     plugins: [
       "expo-router",
-      ["expo-dev-client", { launchMode: "most-recent" }]
+      ["expo-dev-client", { launchMode: "most-recent" }],
+      ...auth ? ["expo-secure-store"] : []
     ],
     runtimeVersion: { policy: "appVersion" },
     scheme: config.deepLinkScheme,
@@ -949,7 +1002,48 @@ config.resolver.nodeModulesPaths = [
 config.watchFolders = [appRoot];
 
 module.exports = config;
-`, layoutSource, nativeDiagnosticSource, webHostSource = (config) => {
+`, layoutSource = (auth) => `${EXPO_GENERATED_HEADER}import { Stack } from 'expo-router';
+${auth ? `import { useEffect } from 'react';
+import { startAbsoluteExpoAuth } from '../src/generated/AbsoluteAuth';` : ""}
+
+export default function AbsoluteLayout() {
+	${auth ? `useEffect(() => {
+		void startAbsoluteExpoAuth();
+	}, []);` : ""}
+	return <Stack screenOptions={{ headerShown: false }} />;
+}
+`, nativeDiagnosticSource, authRuntimeSource = (auth, appId) => {
+  const storageIdentity = createHash("sha256").update(appId).digest("hex").slice(0, 24);
+  return `${EXPO_GENERATED_HEADER}import { createAbsoluteExpoAuthClient } from '@absolutejs/auth-expo';
+import { createMobileAuthTransport, installAuthClientRuntimeTransport } from '@absolutejs/auth/client/mobile';
+
+export const absoluteExpoAuth = createAbsoluteExpoAuthClient({
+	allowedOrigins: [${JSON.stringify(auth.issuer)}],
+	clientId: ${JSON.stringify(auth.clientId)},
+	issuer: ${JSON.stringify(auth.issuer)},
+	redirectUri: ${JSON.stringify(auth.redirectUri)},
+	resource: ${JSON.stringify(auth.issuer)},
+	scopes: ${JSON.stringify(auth.scopes)},
+	storagePrefix: ${JSON.stringify(`absolutejs.auth.${storageIdentity}`)}
+});
+installAuthClientRuntimeTransport(createMobileAuthTransport(absoluteExpoAuth, { baseUrl: ${JSON.stringify(auth.issuer)} }));
+
+let currentPrincipal: Awaited<ReturnType<typeof absoluteExpoAuth.principal>> = null;
+absoluteExpoAuth.onPrincipalChange(principal => {
+	currentPrincipal = principal;
+});
+export const getAbsoluteExpoAuthPrincipal = () => currentPrincipal;
+
+let startPromise: Promise<void> | undefined;
+export const startAbsoluteExpoAuth = () => {
+	startPromise ??= absoluteExpoAuth.start().then(async () => {
+		await absoluteExpoAuth.principal();
+	});
+
+	return startPromise;
+};
+`;
+}, webHostSource = (config, auth) => {
   const nativeRoutes = [
     "/__absolute/native",
     ...Object.keys(config.expoNativeRoutes)
@@ -961,8 +1055,9 @@ import { useEffect, useRef, useState } from 'react';
 import { ActivityIndicator, BackHandler, Platform, StyleSheet, View } from 'react-native';
 import { WebView, type WebViewMessageEvent } from 'react-native-webview';
 import { materializeAbsoluteWebBundle } from './webAssets';
+${auth ? "import { absoluteExpoAuth, getAbsoluteExpoAuthPrincipal, startAbsoluteExpoAuth } from './AbsoluteAuth';" : ""}
 
-const BRIDGE_FORMAT = 1;
+const BRIDGE_FORMAT = 2;
 const MAX_MESSAGE_BYTES = 64 * 1024;
 const MAX_HTTP_BODY_BYTES = 48 * 1024;
 const NATIVE_ROUTES = new Set(${JSON.stringify(nativeRoutes)});
@@ -971,6 +1066,7 @@ const DEV_ORIGIN = Platform.OS === 'android'
 	? process.env.EXPO_PUBLIC_ABSOLUTE_DEV_ANDROID_ORIGIN
 	: process.env.EXPO_PUBLIC_ABSOLUTE_DEV_IOS_ORIGIN;
 const HMR_TARGET = Platform.OS === 'android' ? 'expo-android' : 'expo-ios';
+const AUTH_ENABLED = ${auth ? "true" : "false"};
 
 const bridgeBootstrap = (path: string) => {
 	const initialPath = DEV_ORIGIN
@@ -978,6 +1074,7 @@ const bridgeBootstrap = (path: string) => {
 		: JSON.stringify(path);
 	return \`(() => {
 	const pending = new Map();
+	const listeners = new Map();
 	let sequence = 0;
 	let currentPath = \${initialPath};
 	const send = value => {
@@ -987,6 +1084,10 @@ const bridgeBootstrap = (path: string) => {
 	};
 	globalThis.__absoluteExpoReceive = source => {
 		const message = JSON.parse(source);
+		if (message.kind === 'event') {
+			for (const listener of listeners.get(message.event) || []) listener(message.payload || {});
+			return;
+		}
 		const operation = pending.get(message.id);
 		if (!operation) return;
 		pending.delete(message.id);
@@ -994,9 +1095,18 @@ const bridgeBootstrap = (path: string) => {
 		message.error ? operation.reject(new Error(message.error.message)) : operation.resolve(message.result);
 	};
 	globalThis.__absoluteExpoBridge = {
+		on(event, listener) {
+			const values = listeners.get(event) || new Set();
+			values.add(listener);
+			listeners.set(event, values);
+			return () => {
+				values.delete(listener);
+				if (values.size === 0) listeners.delete(event);
+			};
+		},
 		request(method, params) {
 			const id = 'web_' + Date.now().toString(36) + '_' + (++sequence).toString(36);
-			send({ format: 1, id, kind: 'request', method, params, path: currentPath });
+			send({ format: 2, id, kind: 'request', method, params, path: currentPath });
 			return new Promise((resolve, reject) => {
 				const timer = setTimeout(() => {
 					pending.delete(id);
@@ -1007,7 +1117,7 @@ const bridgeBootstrap = (path: string) => {
 		},
 		setPath(path) {
 			currentPath = path;
-			send({ format: 1, kind: 'event', event: 'navigation', path });
+			send({ format: 2, kind: 'event', event: 'navigation', path });
 		}
 	};
 	if (\${DEV_ORIGIN ? 'true' : 'false'}) {
@@ -1015,7 +1125,7 @@ const bridgeBootstrap = (path: string) => {
 			const path = location.pathname + location.search + location.hash;
 			if (path === currentPath) return;
 			currentPath = path;
-			send({ format: 1, kind: 'event', event: 'navigation', path });
+			send({ format: 2, kind: 'event', event: 'navigation', path });
 		};
 		for (const method of ['pushState', 'replaceState']) {
 			const original = history[method];
@@ -1034,9 +1144,9 @@ const bridgeBootstrap = (path: string) => {
 		const url = new URL(anchor.href, location.href);
 		if (!${JSON.stringify(nativeRoutes)}.includes(url.pathname)) return;
 		event.preventDefault();
-		send({ format: 1, kind: 'event', event: 'navigation', path: url.pathname + url.search + url.hash });
+		send({ format: 2, kind: 'event', event: 'navigation', path: url.pathname + url.search + url.hash });
 	}, true);
-	send({ format: 1, kind: 'event', event: 'ready', path: currentPath });
+	send({ format: 2, kind: 'event', event: 'ready', path: currentPath });
 })(); true;\`;
 };
 
@@ -1052,16 +1162,16 @@ const impact = async (params: Record<string, unknown>) => {
 };
 
 const bridgeFetch = async (params: Record<string, unknown>) => {
-	if (params.method !== 'GET' || typeof params.url !== 'string' || typeof params.headers !== 'object' || params.headers === null || Array.isArray(params.headers)) throw new Error('Expo bridge HTTP request is invalid.');
+	if (typeof params.method !== 'string' || !['DELETE', 'GET', 'PATCH', 'POST', 'PUT'].includes(params.method) || typeof params.url !== 'string' || typeof params.headers !== 'object' || params.headers === null || Array.isArray(params.headers) || params.body !== undefined && typeof params.body !== 'string') throw new Error('Expo bridge HTTP request is invalid.');
 	const url = new URL(params.url);
 	if (url.origin !== PRODUCTION_ORIGIN || url.username || url.password) throw new Error('Expo bridge HTTP request left productionOrigin.');
 	const headers = new Headers();
 	for (const [name, value] of Object.entries(params.headers as Record<string, unknown>)) {
 		const normalized = name.toLowerCase();
-		if (typeof value !== 'string' || (normalized !== 'accept' && !normalized.startsWith('x-absolute-mobile-'))) throw new Error('Expo bridge HTTP header is not allowed.');
+		if (typeof value !== 'string' || (normalized !== 'accept' && normalized !== 'content-type' && !normalized.startsWith('x-absolute-mobile-'))) throw new Error('Expo bridge HTTP header is not allowed.');
 		headers.set(normalized, value);
 	}
-	const response = await fetch(url, { headers, method: 'GET', redirect: 'manual' });
+	const response = await ${auth ? "absoluteExpoAuth.fetchOptional" : "fetch"}(url, { ...(typeof params.body === 'string' ? { body: params.body } : {}), headers, method: params.method, redirect: 'manual' });
 	if (new URL(response.url || url.href).origin !== PRODUCTION_ORIGIN || response.status >= 300 && response.status < 400) throw new Error('Expo bridge HTTP redirects are not allowed.');
 	const body = await response.text();
 	if (new TextEncoder().encode(body).byteLength > MAX_HTTP_BODY_BYTES) throw new Error('Expo bridge HTTP response exceeds 48 KiB.');
@@ -1073,13 +1183,32 @@ const bridgeFetch = async (params: Record<string, unknown>) => {
 	return { body, headers: responseHeaders, status: response.status };
 };
 
+const authStatus = async () => {
+	${auth ? `const user = await absoluteExpoAuth.status();
+	const principal = getAbsoluteExpoAuthPrincipal();
+	return { principal: principal ? { namespace: principal.namespace } : null, user };` : "throw new Error('Expo Auth is not configured.');"}
+};
+
 export function AbsoluteWebHost() {
 	const pathname = usePathname() || '/';
 	const webView = useRef<WebView>(null);
 	const [indexUri, setIndexUri] = useState<string>();
 	const [canGoBack, setCanGoBack] = useState(false);
+	const [authReady, setAuthReady] = useState(!AUTH_ENABLED);
 	const activeWebPath = useRef(pathname);
 
+	useEffect(() => {
+		if (!AUTH_ENABLED) return;
+		let active = true;
+		${auth ? `const stop = absoluteExpoAuth.onPrincipalChange(principal => {
+			if (!active) return;
+			const source = JSON.stringify({ event: 'auth.principal', format: BRIDGE_FORMAT, kind: 'event', path: activeWebPath.current, payload: { principal: principal ? { namespace: principal.namespace } : null } });
+			webView.current?.injectJavaScript(\`globalThis.__absoluteExpoReceive(\${JSON.stringify(source)}); true;\`);
+		});
+		void startAbsoluteExpoAuth().then(() => { if (active) setAuthReady(true); });
+		return () => { active = false; stop(); };` : ""}
+	}, []);
+
 	useEffect(() => {
 		if (DEV_ORIGIN) {
 			const target = new URL(pathname, DEV_ORIGIN);
@@ -1129,6 +1258,16 @@ export function AbsoluteWebHost() {
 				respond({ format: BRIDGE_FORMAT, id: message.id, kind: 'response', result: null });
 			} else if (message.method === 'http.fetch') {
 				respond({ format: BRIDGE_FORMAT, id: message.id, kind: 'response', result: await bridgeFetch(message.params as Record<string, unknown>) });
+			} else if (message.method === 'auth.signIn') {
+				${auth ? `const params = message.params as Record<string, unknown>;
+				if (typeof params.email !== 'string' || typeof params.signup !== 'boolean') throw new Error('Expo Auth sign-in params are invalid.');
+				await absoluteExpoAuth.signIn({ authorizationParameters: { login_hint: params.email, ...(params.signup ? { screen_hint: 'signup' } : {}) } });
+				respond({ format: BRIDGE_FORMAT, id: message.id, kind: 'response', result: await authStatus() });` : "throw new Error('Expo Auth is not configured.');"}
+			} else if (message.method === 'auth.signOut') {
+				${auth ? `await absoluteExpoAuth.signOut();
+				respond({ format: BRIDGE_FORMAT, id: message.id, kind: 'response', result: null });` : "throw new Error('Expo Auth is not configured.');"}
+			} else if (message.method === 'auth.status') {
+				respond({ format: BRIDGE_FORMAT, id: message.id, kind: 'response', result: await authStatus() });
 			} else {
 				throw new Error('Expo bridge method is not allowed.');
 			}
@@ -1137,7 +1276,7 @@ export function AbsoluteWebHost() {
 		}
 	};
 
-	if (!indexUri) return <View style={styles.loading}><ActivityIndicator /></View>;
+	if (!indexUri || !authReady) return <View style={styles.loading}><ActivityIndicator /></View>;
 	return <WebView
 		allowFileAccess
 		allowFileAccessFromFileURLs
@@ -1160,9 +1299,17 @@ export function AbsoluteWebHost() {
 const styles = StyleSheet.create({ loading: { alignItems: 'center', flex: 1, justifyContent: 'center' }, web: { flex: 1 } });
 `;
 }, webRouteSource, catchAllRouteSource, nativeWrapperSource = (wrapper, module) => `${EXPO_GENERATED_HEADER}export { default } from ${JSON.stringify(portableRelative(dirname3(wrapper), module).replace(/\.(?:[cm]?[jt]sx?)$/u, ""))};
-`, expoTsConfig = (projectRoot, project) => ({
+`, expoTsConfig = (projectRoot, project, auth) => ({
   compilerOptions: {
     paths: {
+      ...auth ? {
+        "@absolutejs/auth": [
+          "./node_modules/@absolutejs/auth/dist/index.d.ts"
+        ],
+        "@absolutejs/auth/*": [
+          "./node_modules/@absolutejs/auth/dist/*"
+        ]
+      } : {},
       "*": [
         "./node_modules/*",
         `${portableRelative(project, projectRoot)}/node_modules/*`
@@ -1193,6 +1340,7 @@ const styles = StyleSheet.create({ loading: { alignItems: 'center', flex: 1, jus
     throw new TypeError("Expo project generation requires mobile.engine: expo.");
   const projectRoot = resolve3(options.projectRoot);
   const project = config.nativeProjectDirectory;
+  const auth = resolveAbsoluteMobileAuthManifest(projectRoot, config);
   const routeModules = Object.entries(config.expoNativeRoutes);
   const moduleChecks = await Promise.all(routeModules.map(async ([route, module]) => ({
     exists: await exists(module),
@@ -1203,7 +1351,7 @@ const styles = StyleSheet.create({ loading: { alignItems: 'center', flex: 1, jus
   if (missing) {
     throw new TypeError(`Expo native route ${missing.route} references missing module ${missing.module}.`);
   }
-  const marker = join5(project, EXPO_PROJECT_MARKER);
+  const marker = join6(project, EXPO_PROJECT_MARKER);
   if (await exists(project) && !await exists(marker)) {
     const entries = await readdir(project);
     if (entries.length > 0 && !options.force) {
@@ -1213,47 +1361,54 @@ const styles = StyleSheet.create({ loading: { alignItems: 'center', flex: 1, jus
   await mkdir(project, { recursive: true });
   await writeFile(marker, `format=1
 `);
+  const authEnabled = Boolean(auth);
   const files = new Map([
     [
-      join5(project, ".gitignore"),
+      join6(project, ".gitignore"),
       `.expo/
 android/
 ios/
 node_modules/
 `
     ],
-    [join5(project, "app.json"), jsonSource(expoAppConfig(config))],
-    [join5(project, "app.config.js"), expoDynamicAppConfig],
-    [join5(project, "package.json"), jsonSource(expoPackage())],
-    [join5(project, "metro.config.js"), metroConfig(projectRoot)],
     [
-      join5(project, "plugins", "withAbsoluteDevelopmentCa.js"),
+      join6(project, "app.json"),
+      jsonSource(expoAppConfig(config, authEnabled))
+    ],
+    [join6(project, "app.config.js"), expoDynamicAppConfig],
+    [join6(project, "package.json"), jsonSource(expoPackage(authEnabled))],
+    [join6(project, "metro.config.js"), metroConfig(projectRoot)],
+    [
+      join6(project, "plugins", "withAbsoluteDevelopmentCa.js"),
       expoDevelopmentCaPlugin
     ],
     [
-      join5(project, "tsconfig.json"),
-      jsonSource(expoTsConfig(projectRoot, project))
+      join6(project, "tsconfig.json"),
+      jsonSource(expoTsConfig(projectRoot, project, authEnabled))
     ],
-    [join5(project, "app", "_layout.tsx"), layoutSource],
+    [join6(project, "app", "_layout.tsx"), layoutSource(authEnabled)],
     [
-      join5(project, "app", "__absolute", "native", "index.tsx"),
+      join6(project, "app", "__absolute", "native", "index.tsx"),
       nativeDiagnosticSource
     ],
     [
-      join5(project, "src", "generated", "AbsoluteWebHost.tsx"),
-      webHostSource(config)
+      join6(project, "src", "generated", "AbsoluteWebHost.tsx"),
+      webHostSource(config, auth)
     ]
   ]);
-  const webAssetsPath = join5(project, "src", "generated", "webAssets.ts");
+  if (auth) {
+    files.set(join6(project, "src", "generated", "AbsoluteAuth.ts"), authRuntimeSource(auth, config.appId));
+  }
+  const webAssetsPath = join6(project, "src", "generated", "webAssets.ts");
   if (!await exists(webAssetsPath)) {
     files.set(webAssetsPath, emptyWebAssetsSource);
   }
   if (!config.expoNativeRoutes["/"]) {
-    files.set(join5(project, "app", "index.tsx"), webRouteSource);
+    files.set(join6(project, "app", "index.tsx"), webRouteSource);
   }
-  files.set(join5(project, "app", "[...absolute].tsx"), catchAllRouteSource);
+  files.set(join6(project, "app", "[...absolute].tsx"), catchAllRouteSource);
   for (const [route, module] of routeModules) {
-    const wrapper = route === "/" ? join5(project, "app", "index.tsx") : routeFile(project, route);
+    const wrapper = route === "/" ? join6(project, "app", "index.tsx") : routeFile(project, route);
     files.set(wrapper, nativeWrapperSource(wrapper, module));
   }
   const changes = await Promise.all([...files].map(([path, source]) => writeManagedFile(path, source, true)));
@@ -1262,7 +1417,7 @@ node_modules/
 }, walkFiles = async (root, directory = root) => {
   const entries = await readdir(directory, { withFileTypes: true });
   const nested = await Promise.all(entries.map((entry) => {
-    const path = join5(directory, entry.name);
+    const path = join6(directory, entry.name);
     if (entry.isDirectory())
       return walkFiles(root, path);
     if (entry.isFile())
@@ -1323,11 +1478,11 @@ export const materializeAbsoluteWebBundle = async () => {
 `, syncAbsoluteExpoWebAssets = async (config) => {
   if (config.engine !== "expo")
     throw new TypeError("Expo asset sync requires mobile.engine: expo.");
-  const marker = join5(config.nativeProjectDirectory, EXPO_PROJECT_MARKER);
+  const marker = join6(config.nativeProjectDirectory, EXPO_PROJECT_MARKER);
   if (!await exists(marker)) {
     throw new TypeError("Expo asset sync requires an AbsoluteJS-managed Expo project. Run mobile init first.");
   }
-  const manifestPath = join5(config.bundleDirectory, "absolute-mobile-manifest.json");
+  const manifestPath = join6(config.bundleDirectory, "absolute-mobile-manifest.json");
   const manifest = JSON.parse(await readFile(manifestPath, "utf8"));
   const appBuild = typeof manifest === "object" && manifest !== null && typeof Reflect.get(manifest, "appBuild") === "string" ? String(Reflect.get(manifest, "appBuild")) : undefined;
   if (!appBuild)
@@ -1342,16 +1497,16 @@ export const materializeAbsoluteWebBundle = async () => {
     bundleHash.update("\x00");
   });
   const bundleId = `amexpo_${bundleHash.digest("hex")}`;
-  const destination = join5(config.nativeProjectDirectory, "assets", "absolute");
+  const destination = join6(config.nativeProjectDirectory, "assets", "absolute");
   await mkdir(dirname3(destination), { recursive: true });
-  const staging = await mkdtemp(join5(dirname3(destination), `.${basename2(destination)}.stage-`));
+  const staging = await mkdtemp(join6(dirname3(destination), `.${basename2(destination)}.stage-`));
   let assets;
   try {
     assets = await Promise.all(files.map(async (source, index) => {
       const name = `${String(index).padStart(6, "0")}${EXPO_ASSET_EXTENSION}`;
-      await cp(source, join5(staging, name));
+      await cp(source, join6(staging, name));
       return {
-        asset: portableRelative(join5(config.nativeProjectDirectory, "src", "generated"), join5(destination, name)),
+        asset: portableRelative(join6(config.nativeProjectDirectory, "src", "generated"), join6(destination, name)),
         path: relative(config.bundleDirectory, source).replaceAll("\\", "/")
       };
     }));
@@ -1360,11 +1515,12 @@ export const materializeAbsoluteWebBundle = async () => {
     await rm(staging, { force: true, recursive: true });
     throw error;
   }
-  const generated = join5(config.nativeProjectDirectory, "src", "generated", "webAssets.ts");
+  const generated = join6(config.nativeProjectDirectory, "src", "generated", "webAssets.ts");
   await writeManagedFile(generated, assetModuleSource(assets, bundleId), true);
   return { appBuild, assets: assets.length, bundleId, path: destination };
 };
 var init_expoProject = __esm(() => {
+  init_nativeAuth();
   expoDynamicAppConfig = `${EXPO_GENERATED_HEADER}const config = require('./app.json');
 
 if (process.env.ABSOLUTE_EXPO_DEVELOPMENT === '1' && process.env.ABSOLUTE_EXPO_DEVELOPMENT_CA_PATH) {
@@ -1415,12 +1571,6 @@ const withAbsoluteDevelopmentCa = config => {
 };
 
 module.exports = withAbsoluteDevelopmentCa;
-`;
-  layoutSource = `${EXPO_GENERATED_HEADER}import { Stack } from 'expo-router';
-
-export default function AbsoluteLayout() {
-	return <Stack screenOptions={{ headerShown: false }} />;
-}
 `;
   nativeDiagnosticSource = `${EXPO_GENERATED_HEADER}import * as Haptics from 'expo-haptics';
 import { Link } from 'expo-router';
@@ -1558,50 +1708,6 @@ var closeServer = (server) => new Promise((resolve4, reject) => {
 };
 var init_iosPhysicalDeviceTransport = () => {};
 
-// src/mobile/nativeAuth.ts
-import { readFileSync as readFileSync5 } from "fs";
-import { join as join7 } from "path";
-var ABSOLUTE_AUTH_PACKAGE = "@absolutejs/auth", ABSOLUTE_NATIVE_AUTH_CLIENTS_ENV = "ABSOLUTE_AUTH_NATIVE_CLIENTS", ABSOLUTE_NATIVE_AUTH_SCOPES, ABSOLUTE_SYNC_PACKAGE = "@absolutejs/sync", readPackageManifest = (projectRoot) => {
-  try {
-    return JSON.parse(readFileSync5(join7(projectRoot, "package.json"), "utf8"));
-  } catch {
-    return;
-  }
-}, packageManifestHas = (manifest, packageName) => {
-  if (typeof manifest !== "object" || manifest === null)
-    return false;
-  return [
-    Reflect.get(manifest, "dependencies"),
-    Reflect.get(manifest, "devDependencies"),
-    Reflect.get(manifest, "optionalDependencies"),
-    Reflect.get(manifest, "peerDependencies")
-  ].some((dependencies) => typeof dependencies === "object" && dependencies !== null && Object.hasOwn(dependencies, packageName));
-}, createAbsoluteMobileAuthManifest = (config) => {
-  const scheme = config.deepLinkScheme ?? config.appId.toLowerCase();
-  return {
-    clientId: `absolutejs-native:${config.appId}`,
-    issuer: config.productionOrigin,
-    redirectUri: `${scheme}://auth/callback`,
-    scopes: [...ABSOLUTE_NATIVE_AUTH_SCOPES]
-  };
-}, installAbsoluteMobileAuthEnvironment = (projectRoot, config) => {
-  const auth = resolveAbsoluteMobileAuthManifest(projectRoot, config);
-  const serialized = serializeAbsoluteMobileAuthEnvironment(config, auth);
-  if (serialized === undefined)
-    delete process.env[ABSOLUTE_NATIVE_AUTH_CLIENTS_ENV];
-  else
-    process.env[ABSOLUTE_NATIVE_AUTH_CLIENTS_ENV] = serialized;
-  return auth;
-}, projectUsesAbsoluteAuth = (projectRoot) => packageManifestHas(readPackageManifest(projectRoot), ABSOLUTE_AUTH_PACKAGE), projectUsesAbsoluteSync = (projectRoot) => packageManifestHas(readPackageManifest(projectRoot), ABSOLUTE_SYNC_PACKAGE), resolveAbsoluteMobileAuthManifest = (projectRoot, config) => projectUsesAbsoluteAuth(projectRoot) ? createAbsoluteMobileAuthManifest(config) : undefined, serializeAbsoluteMobileAuthEnvironment = (config, auth) => auth === undefined ? undefined : JSON.stringify([
-  {
-    ...auth,
-    name: `${config.appName} native app`
-  }
-]);
-var init_nativeAuth = __esm(() => {
-  ABSOLUTE_NATIVE_AUTH_SCOPES = ["openid", "profile"];
-});
-
 // src/cli/utils.ts
 var {$: $2 } = globalThis.Bun;
 import { execSync } from "child_process";
@@ -5178,13 +5284,13 @@ var init_remoteMacProtocol = __esm(() => {
 // src/dev/devCert.ts
 var exports_devCert = {};
 __export(exports_devCert, {
-  setupMkcert: () => setupMkcert,
-  normalizeDevCertificateHosts: () => normalizeDevCertificateHosts,
-  loadDevCert: () => loadDevCert,
-  hasMkcert: () => hasMkcert,
-  hasCert: () => hasCert,
+  ensureDevCert: () => ensureDevCert,
   getDevCertificateAuthorityPath: () => getDevCertificateAuthorityPath,
-  ensureDevCert: () => ensureDevCert
+  hasCert: () => hasCert,
+  hasMkcert: () => hasMkcert,
+  loadDevCert: () => loadDevCert,
+  normalizeDevCertificateHosts: () => normalizeDevCertificateHosts,
+  setupMkcert: () => setupMkcert
 });
 import {
   copyFileSync,
@@ -5492,13 +5598,13 @@ var init_devCert = __esm(() => {
 // src/cli/scripts/eslintChunked.ts
 var exports_eslintChunked = {};
 __export(exports_eslintChunked, {
-  upstreamRef: () => upstreamRef,
-  ruleSummary: () => ruleSummary,
-  resolveLintTargets: () => resolveLintTargets,
-  parseChunkedArgs: () => parseChunkedArgs,
-  gitVisibleFiles: () => gitVisibleFiles,
+  eslintChunked: () => eslintChunked,
   gitChangedFiles: () => gitChangedFiles,
-  eslintChunked: () => eslintChunked
+  gitVisibleFiles: () => gitVisibleFiles,
+  parseChunkedArgs: () => parseChunkedArgs,
+  resolveLintTargets: () => resolveLintTargets,
+  ruleSummary: () => ruleSummary,
+  upstreamRef: () => upstreamRef
 });
 import { existsSync as existsSync6 } from "fs";
 import { relative as relative7, resolve as resolve9 } from "path";
@@ -7144,6 +7250,11 @@ var MANIFEST_FILE = "absolute-mobile-manifest.json", BOOTSTRAP_FILE = "absolute-
   if (candidate)
     return candidate;
   throw new TypeError("AbsoluteJS mobile auth shell module is missing.");
+}, shellExpoAuthModule = () => {
+  const candidate = ["js", "ts"].map((extension) => join19(import.meta.dir, `shellExpoAuth.${extension}`)).find(existsSync9);
+  if (candidate)
+    return candidate;
+  throw new TypeError("AbsoluteJS Expo auth bridge module is missing.");
 }, shellSyncModule = () => {
   const candidate = ["js", "ts"].map((extension) => join19(import.meta.dir, `shellSync.${extension}`)).find(existsSync9);
   if (candidate)
@@ -7217,9 +7328,10 @@ var MANIFEST_FILE = "absolute-mobile-manifest.json", BOOTSTRAP_FILE = "absolute-
   const capacitor = engine !== "expo";
   const shellCapabilities = capacitor ? deviceCapabilities.capabilities : [];
   const modulePath = shellBootstrapModule();
-  const authImport = auth ? `import { createAbsoluteMobileShellAuth } from ${JSON.stringify(shellAuthModule())};
+  const authFactory = capacitor ? "createAbsoluteMobileShellAuth" : "createAbsoluteExpoShellAuth";
+  const authImport = auth ? `import { ${authFactory} } from ${JSON.stringify(capacitor ? shellAuthModule() : shellExpoAuthModule())};
 ` : "";
-  const options = auth ? `{ createAuth: createAbsoluteMobileShellAuth${sync ? ", installSync: installAbsoluteMobileShellSync" : ""} }` : "";
+  const options = auth ? `{ createAuth: ${authFactory}${sync ? ", installSync: installAbsoluteMobileShellSync" : ""} }` : "";
   const syncImport = sync ? `import { installAbsoluteMobileShellSync } from ${JSON.stringify(shellSyncModule())};
 ` : "";
   const pushIndex = shellCapabilities.indexOf("pushNotifications");
@@ -7241,7 +7353,7 @@ const absoluteMobilePushCapability = absoluteDeviceCapability${pushIndex}(absolu
   const baseAdapterModule = capacitor ? await resolveProjectImport(projectRoot, "@absolutejs/devices-capacitor") : shellExpoDevicesModule();
   const adapterImport = capacitor ? `import { installCapacitorDeviceAdapterIfNative } from ${JSON.stringify(baseAdapterModule)};` : `import { createAbsoluteExpoBridgeFetch, installAbsoluteExpoWebDeviceAdapter } from ${JSON.stringify(baseAdapterModule)};`;
   const adapterInstall = capacitor ? `installCapacitorDeviceAdapterIfNative({ storagePrefix: ${JSON.stringify(storagePrefix)}${capabilityOptions ? `, ${capabilityOptions}` : ""} });` : "installAbsoluteExpoWebDeviceAdapter();";
-  let shellOptions = "{ createFetch: createAbsoluteExpoBridgeFetch }";
+  let shellOptions = auth ? options : "{ createFetch: createAbsoluteExpoBridgeFetch }";
   if (capacitor)
     shellOptions = options;
   if (push) {
@@ -8327,10 +8439,10 @@ var isElysiaApp = (value) => typeof value === "object" && value !== null && type
     runtime: String(ABSOLUTE_MOBILE_PAGE_PROTOCOL_VERSION)
   });
   const auth = resolveAbsoluteMobileAuthManifest(options.projectRoot, mobile);
-  if (mobile.engine === "expo" && auth) {
-    throw new TypeError("Expo mobile Auth is not released yet. The experimental Expo shell cannot safely substitute Capacitor credentials; remove engine: 'expo' or wait for @absolutejs/auth-expo.");
-  }
   const sync = auth !== undefined && projectUsesAbsoluteSync(options.projectRoot);
+  if (mobile.engine === "expo" && sync) {
+    throw new TypeError("Expo mobile Sync is not released yet. Auth and authenticated HTTP are available, but @absolutejs/sync requires @absolutejs/sync-expo for shared durable state.");
+  }
   const syncSchema = sync ? discoverAbsoluteSyncSchema(options.projectRoot) : undefined;
   const deviceCapabilities = resolveAbsoluteDeviceCapabilityPlan(options.projectRoot);
   const usesPush = deviceCapabilities.capabilities.includes("pushNotifications");
@@ -8956,12 +9068,12 @@ var init_serverBundleExternals = __esm(() => {
 // src/core/prerender.ts
 var exports_prerender = {};
 __export(exports_prerender, {
-  routeToFilename: () => routeToFilename,
-  rerenderRoute: () => rerenderRoute,
-  readTimestamp: () => readTimestamp,
-  prerenderWithServer: () => prerenderWithServer,
+  PRERENDER_BYPASS_HEADER: () => PRERENDER_BYPASS_HEADER,
   prerender: () => prerender,
-  PRERENDER_BYPASS_HEADER: () => PRERENDER_BYPASS_HEADER
+  prerenderWithServer: () => prerenderWithServer,
+  readTimestamp: () => readTimestamp,
+  rerenderRoute: () => rerenderRoute,
+  routeToFilename: () => routeToFilename
 });
 import { mkdirSync as mkdirSync6, readFileSync as readFileSync14 } from "fs";
 import { join as join24 } from "path";
@@ -9621,8 +9733,8 @@ var init_rewriteImportsPlugin = __esm(() => {
 // src/build/rewriteImports.ts
 var exports_rewriteImports = {};
 __export(exports_rewriteImports, {
-  rewriteVendorDirectories: () => rewriteVendorDirectories2,
-  rewriteImports: () => rewriteImports
+  rewriteImports: () => rewriteImports,
+  rewriteVendorDirectories: () => rewriteVendorDirectories2
 });
 var rewriteImports = async (outputPaths, vendorPaths) => {
   const jsFiles = outputPaths.filter((path) => path.endsWith(".js"));
@@ -10285,11 +10397,11 @@ var init_build = __esm(() => {
 // src/cli/scripts/lintProof.ts
 var exports_lintProof = {};
 __export(exports_lintProof, {
-  writeLintProof: () => writeLintProof,
-  verifyLintProof: () => verifyLintProof,
-  runLintProof: () => runLintProof,
+  createLintProof: () => createLintProof,
   createLintSourceTree: () => createLintSourceTree,
-  createLintProof: () => createLintProof
+  runLintProof: () => runLintProof,
+  verifyLintProof: () => verifyLintProof,
+  writeLintProof: () => writeLintProof
 });
 import {
   createHash as createHash12,
@@ -15063,9 +15175,9 @@ var init_htmx = __esm(() => {
 // src/cli/scripts/env.ts
 var exports_env = {};
 __export(exports_env, {
-  scanEnvUsage: () => scanEnvUsage,
+  collectEnvVars: () => collectEnvVars,
   runEnv: () => runEnv,
-  collectEnvVars: () => collectEnvVars
+  scanEnvUsage: () => scanEnvUsage
 });
 import { existsSync as existsSync33, readFileSync as readFileSync33 } from "fs";
 import { join as join41 } from "path";
@@ -15129,12 +15241,12 @@ var init_env = __esm(() => {
 // src/cli/scripts/db.ts
 var exports_db = {};
 __export(exports_db, {
-  runDb: () => runDb,
-  quoteIdent: () => quoteIdent,
-  encodeValue: () => encodeValue,
-  dependencyOrder: () => dependencyOrder,
+  chunkRows: () => chunkRows,
   conflictClause: () => conflictClause,
-  chunkRows: () => chunkRows
+  dependencyOrder: () => dependencyOrder,
+  encodeValue: () => encodeValue,
+  quoteIdent: () => quoteIdent,
+  runDb: () => runDb
 });
 import { existsSync as existsSync34, mkdirSync as mkdirSync15, readFileSync as readFileSync34, writeFileSync as writeFileSync18 } from "fs";
 import { join as join42 } from "path";
@@ -16474,8 +16586,8 @@ var init_externalAssetPlugin = () => {};
 // src/cli/scripts/compile.ts
 var exports_compile = {};
 __export(exports_compile, {
-  shouldEmbedCompiledAsset: () => shouldEmbedCompiledAsset,
-  compile: () => compile
+  compile: () => compile,
+  shouldEmbedCompiledAsset: () => shouldEmbedCompiledAsset
 });
 var {env: env5 } = globalThis.Bun;
 import {
@@ -18434,12 +18546,38 @@ import { mkdir as mkdir12, writeFile as writeFile14 } from "fs/promises";
 import { dirname as dirname29, resolve as resolve38 } from "path";
 
 class CdpConnection {
-  diagnostics = [];
-  socket;
-  #closed = false;
-  #nextId = 1;
-  #pending = new Map;
+  #closed;
+  #nextId;
+  #pending;
   constructor(socket) {
+    this.diagnostics = [];
+    this.#closed = false;
+    this.#nextId = 1;
+    this.#pending = new Map;
+    this.command = (method, params = {}, timeoutMs = CDP_COMMAND_TIMEOUT_MS) => {
+      if (this.#closed) {
+        return Promise.reject(new Error("Android WebView debugger is closed."));
+      }
+      const id = this.#nextId++;
+      return new Promise((_resolve, reject) => {
+        const timer = setTimeout(() => {
+          this.#pending.delete(id);
+          reject(new Error(`CDP ${method} timed out after ${timeoutMs}ms.`));
+        }, timeoutMs);
+        this.#pending.set(id, {
+          reject,
+          resolve: _resolve,
+          timer
+        });
+        this.socket.send(JSON.stringify({ id, method, params }));
+      });
+    };
+    this.close = async () => {
+      if (this.#closed)
+        return;
+      this.#closed = true;
+      this.socket.close();
+    };
     this.socket = socket;
     socket.addEventListener("message", (event) => {
       this.onMessage(event.data);
@@ -18518,30 +18656,6 @@ class CdpConnection {
     }
     pending.resolve(message.result);
   }
-  command = (method, params = {}, timeoutMs = CDP_COMMAND_TIMEOUT_MS) => {
-    if (this.#closed) {
-      return Promise.reject(new Error("Android WebView debugger is closed."));
-    }
-    const id = this.#nextId++;
-    return new Promise((_resolve, reject) => {
-      const timer = setTimeout(() => {
-        this.#pending.delete(id);
-        reject(new Error(`CDP ${method} timed out after ${timeoutMs}ms.`));
-      }, timeoutMs);
-      this.#pending.set(id, {
-        reject,
-        resolve: _resolve,
-        timer
-      });
-      this.socket.send(JSON.stringify({ id, method, params }));
-    });
-  };
-  close = async () => {
-    if (this.#closed)
-      return;
-    this.#closed = true;
-    this.socket.close();
-  };
 }
 var CDP_COMMAND_TIMEOUT_MS = 1e4, WEBVIEW_ATTACH_TIMEOUT_MS = 30000, WEBVIEW_POLL_MS = 200, captureCommand3 = (command) => {
   const result = Bun.spawnSync(command, {
@@ -21019,7 +21133,7 @@ var NOT_FOUND4 = -1, isRecord15 = (value) => typeof value === "object" && value
 }, initialize = async (args) => {
   const { mobile, projectRoot } = await loadMobile(valueAfter(args, "--config"));
   if (mobile.engine === "expo") {
-    console.warn("Experimental: Expo Auth, Sync, release publishing, and physical-device acceptance are not complete.");
+    console.warn("Experimental: Expo Auth and authenticated HTTP are available; Sync, release publishing, and physical-device acceptance are not complete.");
     const generated2 = await writeAbsoluteExpoProject(mobile, {
       force: args.includes("--force"),
       projectRoot
@@ -23455,7 +23569,7 @@ init_expoProject();
 init_iosPhysicalDeviceTransport();
 import { spawn } from "child_process";
 import { access as access2 } from "fs/promises";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 var METRO_READY_TIMEOUT_MS = 60000;
 var PROCESS_CLOSE_TIMEOUT_MS = 2000;
 var commandEnvironment = (options) => ({
@@ -23468,7 +23582,7 @@ var commandEnvironment = (options) => ({
   ...options.metroHost ? { REACT_NATIVE_PACKAGER_HOSTNAME: options.metroHost } : {}
 });
 var absoluteExpoExecutable = async (project) => {
-  const executable = join6(project, "node_modules", ".bin", "expo");
+  const executable = join7(project, "node_modules", ".bin", "expo");
   try {
     await access2(executable);
     return executable;