@absolutejs/absolute 0.20.0-beta.43 → 0.20.0-beta.44

package/dist/mobile/index.js

@@ -19,12 +19,14 @@ var __toESM = (mod, isNodeMode, target) => {
   }
   target = mod != null ? __create(__getProtoOf(mod)) : {};
   const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
-  for (let key of __getOwnPropNames(mod))
-    if (!__hasOwnProp.call(to, key))
-      __defProp(to, key, {
-        get: __accessProp.bind(mod, key),
-        enumerable: true
-      });
+  if (mod && typeof mod === "object" || typeof mod === "function") {
+    for (let key of __getOwnPropNames(mod))
+      if (!__hasOwnProp.call(to, key))
+        __defProp(to, key, {
+          get: __accessProp.bind(mod, key),
+          enumerable: true
+        });
+  }
   if (canCache)
     cache.set(mod, to);
   return to;
@@ -163,6 +165,137 @@ var init_startupBanner = __esm(() => {
   ];
 });
 
+// src/mobile/config.ts
+import { resolve as resolve6 } from "path";
+var APP_ID_PATTERN, SCHEME_PATTERN, APPLE_APP_ID_PREFIX_PATTERN, CERTIFICATE_FINGERPRINT_PATTERN, HOSTNAME_PATTERN, resolveProjectPath = (projectRoot, value, field2) => {
+  const root = resolve6(projectRoot);
+  const path = resolve6(root, value);
+  if (path !== root && !path.startsWith(`${root}/`)) {
+    throw new TypeError(`${field2} must remain inside the project root.`);
+  }
+  return path;
+}, requireText = (value, field2) => {
+  const normalized = value.trim();
+  if (!normalized)
+    throw new TypeError(`${field2} must not be empty.`);
+  return normalized;
+}, normalizeEntry = (entry) => {
+  const normalized = requireText(entry ?? "/", "mobile.entry");
+  if (!normalized.startsWith("/") || normalized.startsWith("//")) {
+    throw new TypeError("mobile.entry must be an absolute application path.");
+  }
+  return normalized;
+}, normalizeProductionOrigin = (value) => {
+  const parsed = new URL(requireText(value, "mobile.server.productionOrigin"));
+  const isLoopbackHttp = parsed.protocol === "http:" && (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1" || parsed.hostname === "[::1]");
+  if (parsed.protocol !== "https:" && !isLoopbackHttp) {
+    throw new TypeError("mobile.server.productionOrigin must use HTTPS, except for a loopback development origin.");
+  }
+  if (parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash) {
+    throw new TypeError("mobile.server.productionOrigin must be an origin without credentials, path, query, or hash.");
+  }
+  return parsed.origin;
+}, normalizePlatforms = (platforms) => {
+  const normalized = [
+    ...new Set(platforms ?? ["ios", "android"])
+  ];
+  if (normalized.length === 0) {
+    throw new TypeError("mobile.platforms must contain at least one platform.");
+  }
+  return normalized;
+}, normalizeHosts = (hosts, productionOrigin) => {
+  const normalizeHostname = (host) => {
+    const value = requireText(host, "mobile.deepLinks.hosts").toLowerCase();
+    if (!HOSTNAME_PATTERN.test(value)) {
+      throw new TypeError("mobile.deepLinks.hosts entries must be valid hostnames without ports, wildcards, or paths.");
+    }
+    return value;
+  };
+  const productionHostname = new URL(productionOrigin).hostname;
+  const normalized = new Set(productionHostname === "[::1]" ? [] : [normalizeHostname(productionHostname)]);
+  for (const host of hosts ?? []) {
+    normalized.add(normalizeHostname(host));
+  }
+  return [...normalized].sort();
+}, normalizeAppleAppIdPrefix = (value) => {
+  if (value === undefined)
+    return;
+  const normalized = requireText(value, "mobile.deepLinks.apple.appIdPrefix").toUpperCase();
+  if (!APPLE_APP_ID_PREFIX_PATTERN.test(normalized)) {
+    throw new TypeError("mobile.deepLinks.apple.appIdPrefix must contain ten letters or digits.");
+  }
+  return normalized;
+}, normalizeIosVersion = (value) => {
+  if (value === undefined)
+    return;
+  const normalized = requireText(value, "mobile.ios.version");
+  if (!/^\d+(?:\.\d+){0,2}$/u.test(normalized)) {
+    throw new TypeError("mobile.ios.version must contain one to three dot-separated integer components, for example 1.4.0.");
+  }
+  return normalized;
+}, normalizeCertificateFingerprints = (values) => [
+  ...new Set((values ?? []).map((value) => requireText(value, "mobile.deepLinks.android.sha256CertificateFingerprints").replaceAll(":", "").toUpperCase()).map((value) => {
+    if (!CERTIFICATE_FINGERPRINT_PATTERN.test(value)) {
+      throw new TypeError("mobile.deepLinks.android.sha256CertificateFingerprints entries must be SHA-256 certificate fingerprints.");
+    }
+    return value.match(/.{2}/g)?.join(":") ?? value;
+  }))
+].sort(), normalizeExpoNativeRoutes = (config, projectRoot) => {
+  if (config.engine !== "expo")
+    return {};
+  const routes = config.routes?.native ?? {};
+  const normalized = {};
+  for (const [route, module] of Object.entries(routes)) {
+    const path = normalizeEntry(route);
+    if (path.includes("?") || path.includes("#") || path !== "/" && path.endsWith("/")) {
+      throw new TypeError(`mobile.routes.native route ${path} must be a canonical path without a query, fragment, or trailing slash.`);
+    }
+    if (path === "/__absolute/native") {
+      throw new TypeError("mobile.routes.native reserves /__absolute/native for the Expo diagnostic screen.");
+    }
+    if (path.includes("*") || path.includes(":")) {
+      throw new TypeError(`mobile.routes.native route ${path} must be static during the Expo experiment; parameters and wildcards are not supported yet.`);
+    }
+    normalized[path] = resolveProjectPath(projectRoot, requireText(module, `mobile.routes.native[${path}]`), `mobile.routes.native[${path}]`);
+  }
+  return Object.fromEntries(Object.entries(normalized).sort(([left], [right]) => left.localeCompare(right)));
+}, normalizeAbsoluteMobileConfig = (config, projectRoot) => {
+  const appId = requireText(config.appId, "mobile.appId");
+  if (!APP_ID_PATTERN.test(appId)) {
+    throw new TypeError("mobile.appId must use reverse-domain notation, for example com.example.app.");
+  }
+  const productionOrigin = normalizeProductionOrigin(config.server.productionOrigin);
+  const deepLinkScheme = (config.deepLinks?.scheme ?? appId).trim().toLowerCase();
+  if (deepLinkScheme && !SCHEME_PATTERN.test(deepLinkScheme)) {
+    throw new TypeError("mobile.deepLinks.scheme is not a valid URL scheme.");
+  }
+  return {
+    androidCertificateFingerprints: normalizeCertificateFingerprints(config.deepLinks?.android?.sha256CertificateFingerprints),
+    appId,
+    appleAppIdPrefix: normalizeAppleAppIdPrefix(config.deepLinks?.apple?.appIdPrefix),
+    appName: requireText(config.appName, "mobile.appName"),
+    bundleDirectory: resolveProjectPath(projectRoot, config.bundleDirectory ?? ".absolutejs/mobile/web", "mobile.bundleDirectory"),
+    deepLinkHosts: normalizeHosts(config.deepLinks?.hosts, productionOrigin),
+    deepLinkScheme,
+    engine: config.engine ?? "capacitor",
+    entry: normalizeEntry(config.entry),
+    expoNativeRoutes: normalizeExpoNativeRoutes(config, projectRoot),
+    ...config.engine === "expo" ? { expoSdkVersion: config.expo?.sdkVersion ?? 57 } : {},
+    iosVersion: normalizeIosVersion(config.ios?.version),
+    nativeProjectDirectory: resolveProjectPath(projectRoot, config.nativeProject?.directory ?? (config.engine === "expo" ? ".absolutejs/mobile/expo" : "mobile"), "mobile.nativeProject.directory"),
+    platforms: normalizePlatforms(config.platforms),
+    productionOrigin,
+    pushAndroidGoogleServicesFile: resolveProjectPath(projectRoot, config.pushNotifications?.android?.googleServicesFile ?? "google-services.json", "mobile.pushNotifications.android.googleServicesFile")
+  };
+};
+var init_config = __esm(() => {
+  APP_ID_PATTERN = /^[A-Za-z][\w]*(?:\.[A-Za-z][\w]*)+$/;
+  SCHEME_PATTERN = /^[a-z][a-z0-9+.-]*$/;
+  APPLE_APP_ID_PREFIX_PATTERN = /^[A-Z0-9]{10}$/;
+  CERTIFICATE_FINGERPRINT_PATTERN = /^[0-9A-F]{64}$/;
+  HOSTNAME_PATTERN = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(?:\.(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?))*$/;
+});
+
 // src/utils/stringModifiers.ts
 var normalizeSlug = (str) => str.trim().replace(/\s+/g, "-").replace(/[^A-Za-z0-9\-_]+/g, "").replace(/[-_]{2,}/g, "-"), toKebab = (str) => normalizeSlug(str).replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase(), toPascal = (str) => {
   if (!str.includes("-") && !str.includes("_")) {
@@ -171,6 +304,50 @@ var normalizeSlug = (str) => str.trim().replace(/\s+/g, "-").replace(/[^A-Za-z0-
   return normalizeSlug(str).split(/[-_]/).filter(Boolean).map((segment) => segment.charAt(0).toUpperCase() + segment.slice(1).toLowerCase()).join("");
 };
 
+// src/mobile/nativeAuth.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { join as join11 } from "path";
+var ABSOLUTE_AUTH_PACKAGE = "@absolutejs/auth", ABSOLUTE_EXPO_AUTH_CORE_VERSION = "0.75.6", ABSOLUTE_EXPO_AUTH_PACKAGE = "@absolutejs/auth-expo", ABSOLUTE_EXPO_AUTH_VERSION = "0.0.2", ABSOLUTE_NATIVE_AUTH_CLIENTS_ENV = "ABSOLUTE_AUTH_NATIVE_CLIENTS", ABSOLUTE_NATIVE_AUTH_SCOPES, ABSOLUTE_SYNC_PACKAGE = "@absolutejs/sync", readPackageManifest = (projectRoot) => {
+  try {
+    return JSON.parse(readFileSync2(join11(projectRoot, "package.json"), "utf8"));
+  } catch {
+    return;
+  }
+}, packageManifestHas = (manifest, packageName) => {
+  if (typeof manifest !== "object" || manifest === null)
+    return false;
+  return [
+    Reflect.get(manifest, "dependencies"),
+    Reflect.get(manifest, "devDependencies"),
+    Reflect.get(manifest, "optionalDependencies"),
+    Reflect.get(manifest, "peerDependencies")
+  ].some((dependencies) => typeof dependencies === "object" && dependencies !== null && Object.hasOwn(dependencies, packageName));
+}, createAbsoluteMobileAuthManifest = (config) => {
+  const scheme = config.deepLinkScheme ?? config.appId.toLowerCase();
+  return {
+    clientId: `absolutejs-native:${config.appId}`,
+    issuer: config.productionOrigin,
+    redirectUri: `${scheme}://auth/callback`,
+    scopes: [...ABSOLUTE_NATIVE_AUTH_SCOPES]
+  };
+}, installAbsoluteMobileAuthEnvironment = (projectRoot, config) => {
+  const auth = resolveAbsoluteMobileAuthManifest(projectRoot, config);
+  const serialized = serializeAbsoluteMobileAuthEnvironment(config, auth);
+  if (serialized === undefined)
+    delete process.env[ABSOLUTE_NATIVE_AUTH_CLIENTS_ENV];
+  else
+    process.env[ABSOLUTE_NATIVE_AUTH_CLIENTS_ENV] = serialized;
+  return auth;
+}, projectUsesAbsoluteAuth = (projectRoot) => packageManifestHas(readPackageManifest(projectRoot), ABSOLUTE_AUTH_PACKAGE), projectUsesAbsoluteSync = (projectRoot) => packageManifestHas(readPackageManifest(projectRoot), ABSOLUTE_SYNC_PACKAGE), resolveAbsoluteMobileAuthManifest = (projectRoot, config) => projectUsesAbsoluteAuth(projectRoot) ? createAbsoluteMobileAuthManifest(config) : undefined, serializeAbsoluteMobileAuthEnvironment = (config, auth) => auth === undefined ? undefined : JSON.stringify([
+  {
+    ...auth,
+    name: `${config.appName} native app`
+  }
+]);
+var init_nativeAuth = __esm(() => {
+  ABSOLUTE_NATIVE_AUTH_SCOPES = ["openid", "profile"];
+});
+
 // node_modules/@absolutejs/sync/dist/client/index.js
 var RUNTIME_TRANSPORT, host, isRegistry = (value) => typeof value === "object" && value !== null && Array.isArray(Reflect.get(value, "installations")) && Array.isArray(Reflect.get(value, "clients")), registry, SyncLocalDataPolicyError, SyncLocalStoreSchemaError, positiveVersion = (value, label) => {
   if (!Number.isSafeInteger(value) || value < 1)
@@ -4532,6 +4709,7 @@ var testAbsoluteIosPhysicalDevice = async (options) => {
   };
 };
 // src/mobile/associationFiles.ts
+init_config();
 import {
   access as access7,
   mkdir as mkdir7,
@@ -4542,196 +4720,55 @@ import {
 } from "fs/promises";
 import { resolve as resolve7 } from "path";
 import { Elysia } from "elysia";
-
-// src/mobile/config.ts
-import { resolve as resolve6 } from "path";
-var APP_ID_PATTERN = /^[A-Za-z][\w]*(?:\.[A-Za-z][\w]*)+$/;
-var SCHEME_PATTERN = /^[a-z][a-z0-9+.-]*$/;
-var APPLE_APP_ID_PREFIX_PATTERN = /^[A-Z0-9]{10}$/;
-var CERTIFICATE_FINGERPRINT_PATTERN = /^[0-9A-F]{64}$/;
-var HOSTNAME_PATTERN = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(?:\.(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?))*$/;
-var resolveProjectPath = (projectRoot, value, field2) => {
-  const root = resolve6(projectRoot);
-  const path = resolve6(root, value);
-  if (path !== root && !path.startsWith(`${root}/`)) {
-    throw new TypeError(`${field2} must remain inside the project root.`);
-  }
-  return path;
-};
-var requireText = (value, field2) => {
-  const normalized = value.trim();
-  if (!normalized)
-    throw new TypeError(`${field2} must not be empty.`);
-  return normalized;
-};
-var normalizeEntry = (entry) => {
-  const normalized = requireText(entry ?? "/", "mobile.entry");
-  if (!normalized.startsWith("/") || normalized.startsWith("//")) {
-    throw new TypeError("mobile.entry must be an absolute application path.");
-  }
-  return normalized;
-};
-var normalizeProductionOrigin = (value) => {
-  const parsed = new URL(requireText(value, "mobile.server.productionOrigin"));
-  const isLoopbackHttp = parsed.protocol === "http:" && (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1" || parsed.hostname === "[::1]");
-  if (parsed.protocol !== "https:" && !isLoopbackHttp) {
-    throw new TypeError("mobile.server.productionOrigin must use HTTPS, except for a loopback development origin.");
-  }
-  if (parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash) {
-    throw new TypeError("mobile.server.productionOrigin must be an origin without credentials, path, query, or hash.");
-  }
-  return parsed.origin;
+var JSON_HEADERS = {
+  "cache-control": "public, max-age=300, must-revalidate",
+  "content-type": "application/json; charset=utf-8"
 };
-var normalizePlatforms = (platforms) => {
-  const normalized = [
-    ...new Set(platforms ?? ["ios", "android"])
-  ];
-  if (normalized.length === 0) {
-    throw new TypeError("mobile.platforms must contain at least one platform.");
+var OWNERSHIP_FILE = ".absolutejs-mobile-associations.json";
+var HTTP_OK = 200;
+var VERIFY_TIMEOUT_MS = 1e4;
+var ANDROID_ASSOCIATION_PATH = "/.well-known/assetlinks.json";
+var APPLE_ASSOCIATION_PATH = "/.well-known/apple-app-site-association";
+var missingIdentity = (field2, platform) => new TypeError(`${field2} is required to publish ${platform} deep-link association files.`);
+var createAppleDocument = (config, requireAll) => {
+  if (!config.platforms.includes("ios"))
+    return;
+  if (!config.appleAppIdPrefix && requireAll) {
+    throw missingIdentity("mobile.deepLinks.apple.appIdPrefix", "iOS");
   }
-  return normalized;
-};
-var normalizeHosts = (hosts, productionOrigin) => {
-  const normalizeHostname = (host) => {
-    const value = requireText(host, "mobile.deepLinks.hosts").toLowerCase();
-    if (!HOSTNAME_PATTERN.test(value)) {
-      throw new TypeError("mobile.deepLinks.hosts entries must be valid hostnames without ports, wildcards, or paths.");
+  if (!config.appleAppIdPrefix)
+    return;
+  return {
+    applinks: {
+      details: [
+        {
+          appIDs: [
+            `${config.appleAppIdPrefix}.${config.appId}`
+          ],
+          components: [{ "/": "/*" }]
+        }
+      ]
     }
-    return value;
   };
-  const productionHostname = new URL(productionOrigin).hostname;
-  const normalized = new Set(productionHostname === "[::1]" ? [] : [normalizeHostname(productionHostname)]);
-  for (const host of hosts ?? []) {
-    normalized.add(normalizeHostname(host));
-  }
-  return [...normalized].sort();
 };
-var normalizeAppleAppIdPrefix = (value) => {
-  if (value === undefined)
+var createAndroidDocument = (config, requireAll) => {
+  if (!config.platforms.includes("android"))
     return;
-  const normalized = requireText(value, "mobile.deepLinks.apple.appIdPrefix").toUpperCase();
-  if (!APPLE_APP_ID_PREFIX_PATTERN.test(normalized)) {
-    throw new TypeError("mobile.deepLinks.apple.appIdPrefix must contain ten letters or digits.");
+  if (config.androidCertificateFingerprints.length === 0 && requireAll) {
+    throw missingIdentity("mobile.deepLinks.android.sha256CertificateFingerprints", "Android");
   }
-  return normalized;
-};
-var normalizeIosVersion = (value) => {
-  if (value === undefined)
+  if (config.androidCertificateFingerprints.length === 0)
     return;
-  const normalized = requireText(value, "mobile.ios.version");
-  if (!/^\d+(?:\.\d+){0,2}$/u.test(normalized)) {
-    throw new TypeError("mobile.ios.version must contain one to three dot-separated integer components, for example 1.4.0.");
-  }
-  return normalized;
-};
-var normalizeCertificateFingerprints = (values) => [
-  ...new Set((values ?? []).map((value) => requireText(value, "mobile.deepLinks.android.sha256CertificateFingerprints").replaceAll(":", "").toUpperCase()).map((value) => {
-    if (!CERTIFICATE_FINGERPRINT_PATTERN.test(value)) {
-      throw new TypeError("mobile.deepLinks.android.sha256CertificateFingerprints entries must be SHA-256 certificate fingerprints.");
-    }
-    return value.match(/.{2}/g)?.join(":") ?? value;
-  }))
-].sort();
-var normalizeExpoNativeRoutes = (config, projectRoot) => {
-  if (config.engine !== "expo")
-    return {};
-  const routes = config.routes?.native ?? {};
-  const normalized = {};
-  for (const [route, module] of Object.entries(routes)) {
-    const path = normalizeEntry(route);
-    if (path.includes("?") || path.includes("#") || path !== "/" && path.endsWith("/")) {
-      throw new TypeError(`mobile.routes.native route ${path} must be a canonical path without a query, fragment, or trailing slash.`);
-    }
-    if (path === "/__absolute/native") {
-      throw new TypeError("mobile.routes.native reserves /__absolute/native for the Expo diagnostic screen.");
-    }
-    if (path.includes("*") || path.includes(":")) {
-      throw new TypeError(`mobile.routes.native route ${path} must be static during the Expo experiment; parameters and wildcards are not supported yet.`);
-    }
-    normalized[path] = resolveProjectPath(projectRoot, requireText(module, `mobile.routes.native[${path}]`), `mobile.routes.native[${path}]`);
-  }
-  return Object.fromEntries(Object.entries(normalized).sort(([left], [right]) => left.localeCompare(right)));
-};
-var normalizeAbsoluteMobileConfig = (config, projectRoot) => {
-  const appId = requireText(config.appId, "mobile.appId");
-  if (!APP_ID_PATTERN.test(appId)) {
-    throw new TypeError("mobile.appId must use reverse-domain notation, for example com.example.app.");
-  }
-  const productionOrigin = normalizeProductionOrigin(config.server.productionOrigin);
-  const deepLinkScheme = (config.deepLinks?.scheme ?? appId).trim().toLowerCase();
-  if (deepLinkScheme && !SCHEME_PATTERN.test(deepLinkScheme)) {
-    throw new TypeError("mobile.deepLinks.scheme is not a valid URL scheme.");
-  }
-  return {
-    androidCertificateFingerprints: normalizeCertificateFingerprints(config.deepLinks?.android?.sha256CertificateFingerprints),
-    appId,
-    appleAppIdPrefix: normalizeAppleAppIdPrefix(config.deepLinks?.apple?.appIdPrefix),
-    appName: requireText(config.appName, "mobile.appName"),
-    bundleDirectory: resolveProjectPath(projectRoot, config.bundleDirectory ?? ".absolutejs/mobile/web", "mobile.bundleDirectory"),
-    deepLinkHosts: normalizeHosts(config.deepLinks?.hosts, productionOrigin),
-    deepLinkScheme,
-    engine: config.engine ?? "capacitor",
-    entry: normalizeEntry(config.entry),
-    expoNativeRoutes: normalizeExpoNativeRoutes(config, projectRoot),
-    ...config.engine === "expo" ? { expoSdkVersion: config.expo?.sdkVersion ?? 57 } : {},
-    iosVersion: normalizeIosVersion(config.ios?.version),
-    nativeProjectDirectory: resolveProjectPath(projectRoot, config.nativeProject?.directory ?? (config.engine === "expo" ? ".absolutejs/mobile/expo" : "mobile"), "mobile.nativeProject.directory"),
-    platforms: normalizePlatforms(config.platforms),
-    productionOrigin,
-    pushAndroidGoogleServicesFile: resolveProjectPath(projectRoot, config.pushNotifications?.android?.googleServicesFile ?? "google-services.json", "mobile.pushNotifications.android.googleServicesFile")
-  };
-};
-
-// src/mobile/associationFiles.ts
-var JSON_HEADERS = {
-  "cache-control": "public, max-age=300, must-revalidate",
-  "content-type": "application/json; charset=utf-8"
-};
-var OWNERSHIP_FILE = ".absolutejs-mobile-associations.json";
-var HTTP_OK = 200;
-var VERIFY_TIMEOUT_MS = 1e4;
-var ANDROID_ASSOCIATION_PATH = "/.well-known/assetlinks.json";
-var APPLE_ASSOCIATION_PATH = "/.well-known/apple-app-site-association";
-var missingIdentity = (field2, platform) => new TypeError(`${field2} is required to publish ${platform} deep-link association files.`);
-var createAppleDocument = (config, requireAll) => {
-  if (!config.platforms.includes("ios"))
-    return;
-  if (!config.appleAppIdPrefix && requireAll) {
-    throw missingIdentity("mobile.deepLinks.apple.appIdPrefix", "iOS");
-  }
-  if (!config.appleAppIdPrefix)
-    return;
-  return {
-    applinks: {
-      details: [
-        {
-          appIDs: [
-            `${config.appleAppIdPrefix}.${config.appId}`
-          ],
-          components: [{ "/": "/*" }]
-        }
-      ]
-    }
-  };
-};
-var createAndroidDocument = (config, requireAll) => {
-  if (!config.platforms.includes("android"))
-    return;
-  if (config.androidCertificateFingerprints.length === 0 && requireAll) {
-    throw missingIdentity("mobile.deepLinks.android.sha256CertificateFingerprints", "Android");
-  }
-  if (config.androidCertificateFingerprints.length === 0)
-    return;
-  return [
-    {
-      relation: ["delegate_permission/common.handle_all_urls"],
-      target: {
-        namespace: "android_app",
-        package_name: config.appId,
-        sha256_cert_fingerprints: config.androidCertificateFingerprints
-      }
-    }
-  ];
+  return [
+    {
+      relation: ["delegate_permission/common.handle_all_urls"],
+      target: {
+        namespace: "android_app",
+        package_name: config.appId,
+        sha256_cert_fingerprints: config.androidCertificateFingerprints
+      }
+    }
+  ];
 };
 var createAbsoluteMobileAssociationDocuments = (config, options = {}) => {
   const documents = {};
@@ -5356,7 +5393,6 @@ var finalizeAbsoluteMobilePage = (input) => {
 
 // src/mobile/client.ts
 class AbsoluteMobilePageProtocolError extends Error {
-  code;
   constructor(code, message) {
     super(message);
     this.name = "AbsoluteMobilePageProtocolError";
@@ -5567,6 +5603,12 @@ var shellAuthModule = () => {
     return candidate;
   throw new TypeError("AbsoluteJS mobile auth shell module is missing.");
 };
+var shellExpoAuthModule = () => {
+  const candidate = ["js", "ts"].map((extension) => join9(import.meta.dir, `shellExpoAuth.${extension}`)).find(existsSync2);
+  if (candidate)
+    return candidate;
+  throw new TypeError("AbsoluteJS Expo auth bridge module is missing.");
+};
 var shellSyncModule = () => {
   const candidate = ["js", "ts"].map((extension) => join9(import.meta.dir, `shellSync.${extension}`)).find(existsSync2);
   if (candidate)
@@ -5649,9 +5691,10 @@ var buildShellBootstrap = async (staging, auth, sync, storagePrefix, engine, dev
   const capacitor = engine !== "expo";
   const shellCapabilities = capacitor ? deviceCapabilities.capabilities : [];
   const modulePath = shellBootstrapModule();
-  const authImport = auth ? `import { createAbsoluteMobileShellAuth } from ${JSON.stringify(shellAuthModule())};
+  const authFactory = capacitor ? "createAbsoluteMobileShellAuth" : "createAbsoluteExpoShellAuth";
+  const authImport = auth ? `import { ${authFactory} } from ${JSON.stringify(capacitor ? shellAuthModule() : shellExpoAuthModule())};
 ` : "";
-  const options = auth ? `{ createAuth: createAbsoluteMobileShellAuth${sync ? ", installSync: installAbsoluteMobileShellSync" : ""} }` : "";
+  const options = auth ? `{ createAuth: ${authFactory}${sync ? ", installSync: installAbsoluteMobileShellSync" : ""} }` : "";
   const syncImport = sync ? `import { installAbsoluteMobileShellSync } from ${JSON.stringify(shellSyncModule())};
 ` : "";
   const pushIndex = shellCapabilities.indexOf("pushNotifications");
@@ -5673,7 +5716,7 @@ const absoluteMobilePushCapability = absoluteDeviceCapability${pushIndex}(absolu
   const baseAdapterModule = capacitor ? await resolveProjectImport(projectRoot, "@absolutejs/devices-capacitor") : shellExpoDevicesModule();
   const adapterImport = capacitor ? `import { installCapacitorDeviceAdapterIfNative } from ${JSON.stringify(baseAdapterModule)};` : `import { createAbsoluteExpoBridgeFetch, installAbsoluteExpoWebDeviceAdapter } from ${JSON.stringify(baseAdapterModule)};`;
   const adapterInstall = capacitor ? `installCapacitorDeviceAdapterIfNative({ storagePrefix: ${JSON.stringify(storagePrefix)}${capabilityOptions ? `, ${capabilityOptions}` : ""} });` : "installAbsoluteExpoWebDeviceAdapter();";
-  let shellOptions = "{ createFetch: createAbsoluteExpoBridgeFetch }";
+  let shellOptions = auth ? options : "{ createFetch: createAbsoluteExpoBridgeFetch }";
   if (capacitor)
     shellOptions = options;
   if (push) {
@@ -5857,6 +5900,9 @@ var materializeAbsoluteCapacitorWebBundle = async (options) => {
   }
 };
 
+// src/mobile/buildPipeline.ts
+init_config();
+
 // src/mobile/materializedBundle.ts
 import { createHash as createHash9 } from "crypto";
 import {
@@ -6034,63 +6080,13 @@ var readAbsoluteMobileMaterializedReleases = async (root) => {
   }
 };
 
-// src/mobile/nativeAuth.ts
-import { readFileSync as readFileSync2 } from "fs";
-import { join as join11 } from "path";
-var ABSOLUTE_AUTH_PACKAGE = "@absolutejs/auth";
-var ABSOLUTE_NATIVE_AUTH_CLIENTS_ENV = "ABSOLUTE_AUTH_NATIVE_CLIENTS";
-var ABSOLUTE_NATIVE_AUTH_SCOPES = ["openid", "profile"];
-var ABSOLUTE_SYNC_PACKAGE = "@absolutejs/sync";
-var readPackageManifest = (projectRoot) => {
-  try {
-    return JSON.parse(readFileSync2(join11(projectRoot, "package.json"), "utf8"));
-  } catch {
-    return;
-  }
-};
-var packageManifestHas = (manifest, packageName) => {
-  if (typeof manifest !== "object" || manifest === null)
-    return false;
-  return [
-    Reflect.get(manifest, "dependencies"),
-    Reflect.get(manifest, "devDependencies"),
-    Reflect.get(manifest, "optionalDependencies"),
-    Reflect.get(manifest, "peerDependencies")
-  ].some((dependencies) => typeof dependencies === "object" && dependencies !== null && Object.hasOwn(dependencies, packageName));
-};
-var createAbsoluteMobileAuthManifest = (config) => {
-  const scheme = config.deepLinkScheme ?? config.appId.toLowerCase();
-  return {
-    clientId: `absolutejs-native:${config.appId}`,
-    issuer: config.productionOrigin,
-    redirectUri: `${scheme}://auth/callback`,
-    scopes: [...ABSOLUTE_NATIVE_AUTH_SCOPES]
-  };
-};
-var installAbsoluteMobileAuthEnvironment = (projectRoot, config) => {
-  const auth = resolveAbsoluteMobileAuthManifest(projectRoot, config);
-  const serialized = serializeAbsoluteMobileAuthEnvironment(config, auth);
-  if (serialized === undefined)
-    delete process.env[ABSOLUTE_NATIVE_AUTH_CLIENTS_ENV];
-  else
-    process.env[ABSOLUTE_NATIVE_AUTH_CLIENTS_ENV] = serialized;
-  return auth;
-};
-var projectUsesAbsoluteAuth = (projectRoot) => packageManifestHas(readPackageManifest(projectRoot), ABSOLUTE_AUTH_PACKAGE);
-var projectUsesAbsoluteSync = (projectRoot) => packageManifestHas(readPackageManifest(projectRoot), ABSOLUTE_SYNC_PACKAGE);
-var resolveAbsoluteMobileAuthManifest = (projectRoot, config) => projectUsesAbsoluteAuth(projectRoot) ? createAbsoluteMobileAuthManifest(config) : undefined;
-var serializeAbsoluteMobileAuthEnvironment = (config, auth) => auth === undefined ? undefined : JSON.stringify([
-  {
-    ...auth,
-    name: `${config.appName} native app`
-  }
-]);
-
 // src/mobile/buildPipeline.ts
+init_nativeAuth();
 init_syncSchema();
 init_deviceCapabilities();
 
 // src/mobile/expoProject.ts
+init_nativeAuth();
 import {
   access as access9,
   cp as cp2,
@@ -6129,8 +6125,12 @@ var routeSegments = (route) => route.split("/").filter(Boolean).map((segment) =>
   return segment;
 });
 var routeFile = (project, route) => join14(project, "app", ...routeSegments(route), "index.tsx");
-var expoPackage = () => ({
+var expoPackage = (auth) => ({
   dependencies: {
+    ...auth ? {
+      "@absolutejs/auth": ABSOLUTE_EXPO_AUTH_CORE_VERSION,
+      [ABSOLUTE_EXPO_AUTH_PACKAGE]: ABSOLUTE_EXPO_AUTH_VERSION
+    } : {},
     expo: "~57.0.9",
     "expo-asset": "~57.0.15",
     "expo-constants": "~57.0.16",
@@ -6139,6 +6139,10 @@ var expoPackage = () => ({
     "expo-haptics": "~57.0.2",
     "expo-linking": "~57.0.8",
     "expo-router": "~57.0.17",
+    ...auth ? {
+      "expo-secure-store": "~57.0.2",
+      "expo-web-browser": "~57.0.2"
+    } : {},
     react: "19.2.3",
     "react-native": "0.86.3",
     "react-native-safe-area-context": "~5.7.0",
@@ -6159,7 +6163,7 @@ var expoPackage = () => ({
   },
   version: "0.0.0"
 });
-var expoAppConfig = (config) => ({
+var expoAppConfig = (config, auth) => ({
   expo: {
     android: {
       intentFilters: config.deepLinkHosts.map((host2) => ({
@@ -6179,7 +6183,8 @@ var expoAppConfig = (config) => ({
     name: config.appName,
     plugins: [
       "expo-router",
-      ["expo-dev-client", { launchMode: "most-recent" }]
+      ["expo-dev-client", { launchMode: "most-recent" }],
+      ...auth ? ["expo-secure-store"] : []
     ],
     runtimeVersion: { policy: "appVersion" },
     scheme: config.deepLinkScheme,
@@ -6253,9 +6258,14 @@ config.watchFolders = [appRoot];
 
 module.exports = config;
 `;
-var layoutSource = `${EXPO_GENERATED_HEADER}import { Stack } from 'expo-router';
+var layoutSource = (auth) => `${EXPO_GENERATED_HEADER}import { Stack } from 'expo-router';
+${auth ? `import { useEffect } from 'react';
+import { startAbsoluteExpoAuth } from '../src/generated/AbsoluteAuth';` : ""}
 
 export default function AbsoluteLayout() {
+	${auth ? `useEffect(() => {
+		void startAbsoluteExpoAuth();
+	}, []);` : ""}
 	return <Stack screenOptions={{ headerShown: false }} />;
 }
 `;
@@ -6290,7 +6300,39 @@ const styles = StyleSheet.create({
 	title: { color: '#f8fafc', fontSize: 32, fontWeight: '800' }
 });
 `;
-var webHostSource = (config) => {
+var authRuntimeSource = (auth, appId) => {
+  const storageIdentity = createHash10("sha256").update(appId).digest("hex").slice(0, 24);
+  return `${EXPO_GENERATED_HEADER}import { createAbsoluteExpoAuthClient } from '@absolutejs/auth-expo';
+import { createMobileAuthTransport, installAuthClientRuntimeTransport } from '@absolutejs/auth/client/mobile';
+
+export const absoluteExpoAuth = createAbsoluteExpoAuthClient({
+	allowedOrigins: [${JSON.stringify(auth.issuer)}],
+	clientId: ${JSON.stringify(auth.clientId)},
+	issuer: ${JSON.stringify(auth.issuer)},
+	redirectUri: ${JSON.stringify(auth.redirectUri)},
+	resource: ${JSON.stringify(auth.issuer)},
+	scopes: ${JSON.stringify(auth.scopes)},
+	storagePrefix: ${JSON.stringify(`absolutejs.auth.${storageIdentity}`)}
+});
+installAuthClientRuntimeTransport(createMobileAuthTransport(absoluteExpoAuth, { baseUrl: ${JSON.stringify(auth.issuer)} }));
+
+let currentPrincipal: Awaited<ReturnType<typeof absoluteExpoAuth.principal>> = null;
+absoluteExpoAuth.onPrincipalChange(principal => {
+	currentPrincipal = principal;
+});
+export const getAbsoluteExpoAuthPrincipal = () => currentPrincipal;
+
+let startPromise: Promise<void> | undefined;
+export const startAbsoluteExpoAuth = () => {
+	startPromise ??= absoluteExpoAuth.start().then(async () => {
+		await absoluteExpoAuth.principal();
+	});
+
+	return startPromise;
+};
+`;
+};
+var webHostSource = (config, auth) => {
   const nativeRoutes = [
     "/__absolute/native",
     ...Object.keys(config.expoNativeRoutes)
@@ -6302,8 +6344,9 @@ import { useEffect, useRef, useState } from 'react';
 import { ActivityIndicator, BackHandler, Platform, StyleSheet, View } from 'react-native';
 import { WebView, type WebViewMessageEvent } from 'react-native-webview';
 import { materializeAbsoluteWebBundle } from './webAssets';
+${auth ? "import { absoluteExpoAuth, getAbsoluteExpoAuthPrincipal, startAbsoluteExpoAuth } from './AbsoluteAuth';" : ""}
 
-const BRIDGE_FORMAT = 1;
+const BRIDGE_FORMAT = 2;
 const MAX_MESSAGE_BYTES = 64 * 1024;
 const MAX_HTTP_BODY_BYTES = 48 * 1024;
 const NATIVE_ROUTES = new Set(${JSON.stringify(nativeRoutes)});
@@ -6312,6 +6355,7 @@ const DEV_ORIGIN = Platform.OS === 'android'
 	? process.env.EXPO_PUBLIC_ABSOLUTE_DEV_ANDROID_ORIGIN
 	: process.env.EXPO_PUBLIC_ABSOLUTE_DEV_IOS_ORIGIN;
 const HMR_TARGET = Platform.OS === 'android' ? 'expo-android' : 'expo-ios';
+const AUTH_ENABLED = ${auth ? "true" : "false"};
 
 const bridgeBootstrap = (path: string) => {
 	const initialPath = DEV_ORIGIN
@@ -6319,6 +6363,7 @@ const bridgeBootstrap = (path: string) => {
 		: JSON.stringify(path);
 	return \`(() => {
 	const pending = new Map();
+	const listeners = new Map();
 	let sequence = 0;
 	let currentPath = \${initialPath};
 	const send = value => {
@@ -6328,6 +6373,10 @@ const bridgeBootstrap = (path: string) => {
 	};
 	globalThis.__absoluteExpoReceive = source => {
 		const message = JSON.parse(source);
+		if (message.kind === 'event') {
+			for (const listener of listeners.get(message.event) || []) listener(message.payload || {});
+			return;
+		}
 		const operation = pending.get(message.id);
 		if (!operation) return;
 		pending.delete(message.id);
@@ -6335,9 +6384,18 @@ const bridgeBootstrap = (path: string) => {
 		message.error ? operation.reject(new Error(message.error.message)) : operation.resolve(message.result);
 	};
 	globalThis.__absoluteExpoBridge = {
+		on(event, listener) {
+			const values = listeners.get(event) || new Set();
+			values.add(listener);
+			listeners.set(event, values);
+			return () => {
+				values.delete(listener);
+				if (values.size === 0) listeners.delete(event);
+			};
+		},
 		request(method, params) {
 			const id = 'web_' + Date.now().toString(36) + '_' + (++sequence).toString(36);
-			send({ format: 1, id, kind: 'request', method, params, path: currentPath });
+			send({ format: 2, id, kind: 'request', method, params, path: currentPath });
 			return new Promise((resolve, reject) => {
 				const timer = setTimeout(() => {
 					pending.delete(id);
@@ -6348,7 +6406,7 @@ const bridgeBootstrap = (path: string) => {
 		},
 		setPath(path) {
 			currentPath = path;
-			send({ format: 1, kind: 'event', event: 'navigation', path });
+			send({ format: 2, kind: 'event', event: 'navigation', path });
 		}
 	};
 	if (\${DEV_ORIGIN ? 'true' : 'false'}) {
@@ -6356,7 +6414,7 @@ const bridgeBootstrap = (path: string) => {
 			const path = location.pathname + location.search + location.hash;
 			if (path === currentPath) return;
 			currentPath = path;
-			send({ format: 1, kind: 'event', event: 'navigation', path });
+			send({ format: 2, kind: 'event', event: 'navigation', path });
 		};
 		for (const method of ['pushState', 'replaceState']) {
 			const original = history[method];
@@ -6375,9 +6433,9 @@ const bridgeBootstrap = (path: string) => {
 		const url = new URL(anchor.href, location.href);
 		if (!${JSON.stringify(nativeRoutes)}.includes(url.pathname)) return;
 		event.preventDefault();
-		send({ format: 1, kind: 'event', event: 'navigation', path: url.pathname + url.search + url.hash });
+		send({ format: 2, kind: 'event', event: 'navigation', path: url.pathname + url.search + url.hash });
 	}, true);
-	send({ format: 1, kind: 'event', event: 'ready', path: currentPath });
+	send({ format: 2, kind: 'event', event: 'ready', path: currentPath });
 })(); true;\`;
 };
 
@@ -6393,16 +6451,16 @@ const impact = async (params: Record<string, unknown>) => {
 };
 
 const bridgeFetch = async (params: Record<string, unknown>) => {
-	if (params.method !== 'GET' || typeof params.url !== 'string' || typeof params.headers !== 'object' || params.headers === null || Array.isArray(params.headers)) throw new Error('Expo bridge HTTP request is invalid.');
+	if (typeof params.method !== 'string' || !['DELETE', 'GET', 'PATCH', 'POST', 'PUT'].includes(params.method) || typeof params.url !== 'string' || typeof params.headers !== 'object' || params.headers === null || Array.isArray(params.headers) || params.body !== undefined && typeof params.body !== 'string') throw new Error('Expo bridge HTTP request is invalid.');
 	const url = new URL(params.url);
 	if (url.origin !== PRODUCTION_ORIGIN || url.username || url.password) throw new Error('Expo bridge HTTP request left productionOrigin.');
 	const headers = new Headers();
 	for (const [name, value] of Object.entries(params.headers as Record<string, unknown>)) {
 		const normalized = name.toLowerCase();
-		if (typeof value !== 'string' || (normalized !== 'accept' && !normalized.startsWith('x-absolute-mobile-'))) throw new Error('Expo bridge HTTP header is not allowed.');
+		if (typeof value !== 'string' || (normalized !== 'accept' && normalized !== 'content-type' && !normalized.startsWith('x-absolute-mobile-'))) throw new Error('Expo bridge HTTP header is not allowed.');
 		headers.set(normalized, value);
 	}
-	const response = await fetch(url, { headers, method: 'GET', redirect: 'manual' });
+	const response = await ${auth ? "absoluteExpoAuth.fetchOptional" : "fetch"}(url, { ...(typeof params.body === 'string' ? { body: params.body } : {}), headers, method: params.method, redirect: 'manual' });
 	if (new URL(response.url || url.href).origin !== PRODUCTION_ORIGIN || response.status >= 300 && response.status < 400) throw new Error('Expo bridge HTTP redirects are not allowed.');
 	const body = await response.text();
 	if (new TextEncoder().encode(body).byteLength > MAX_HTTP_BODY_BYTES) throw new Error('Expo bridge HTTP response exceeds 48 KiB.');
@@ -6414,13 +6472,32 @@ const bridgeFetch = async (params: Record<string, unknown>) => {
 	return { body, headers: responseHeaders, status: response.status };
 };
 
+const authStatus = async () => {
+	${auth ? `const user = await absoluteExpoAuth.status();
+	const principal = getAbsoluteExpoAuthPrincipal();
+	return { principal: principal ? { namespace: principal.namespace } : null, user };` : "throw new Error('Expo Auth is not configured.');"}
+};
+
 export function AbsoluteWebHost() {
 	const pathname = usePathname() || '/';
 	const webView = useRef<WebView>(null);
 	const [indexUri, setIndexUri] = useState<string>();
 	const [canGoBack, setCanGoBack] = useState(false);
+	const [authReady, setAuthReady] = useState(!AUTH_ENABLED);
 	const activeWebPath = useRef(pathname);
 
+	useEffect(() => {
+		if (!AUTH_ENABLED) return;
+		let active = true;
+		${auth ? `const stop = absoluteExpoAuth.onPrincipalChange(principal => {
+			if (!active) return;
+			const source = JSON.stringify({ event: 'auth.principal', format: BRIDGE_FORMAT, kind: 'event', path: activeWebPath.current, payload: { principal: principal ? { namespace: principal.namespace } : null } });
+			webView.current?.injectJavaScript(\`globalThis.__absoluteExpoReceive(\${JSON.stringify(source)}); true;\`);
+		});
+		void startAbsoluteExpoAuth().then(() => { if (active) setAuthReady(true); });
+		return () => { active = false; stop(); };` : ""}
+	}, []);
+
 	useEffect(() => {
 		if (DEV_ORIGIN) {
 			const target = new URL(pathname, DEV_ORIGIN);
@@ -6470,6 +6547,16 @@ export function AbsoluteWebHost() {
 				respond({ format: BRIDGE_FORMAT, id: message.id, kind: 'response', result: null });
 			} else if (message.method === 'http.fetch') {
 				respond({ format: BRIDGE_FORMAT, id: message.id, kind: 'response', result: await bridgeFetch(message.params as Record<string, unknown>) });
+			} else if (message.method === 'auth.signIn') {
+				${auth ? `const params = message.params as Record<string, unknown>;
+				if (typeof params.email !== 'string' || typeof params.signup !== 'boolean') throw new Error('Expo Auth sign-in params are invalid.');
+				await absoluteExpoAuth.signIn({ authorizationParameters: { login_hint: params.email, ...(params.signup ? { screen_hint: 'signup' } : {}) } });
+				respond({ format: BRIDGE_FORMAT, id: message.id, kind: 'response', result: await authStatus() });` : "throw new Error('Expo Auth is not configured.');"}
+			} else if (message.method === 'auth.signOut') {
+				${auth ? `await absoluteExpoAuth.signOut();
+				respond({ format: BRIDGE_FORMAT, id: message.id, kind: 'response', result: null });` : "throw new Error('Expo Auth is not configured.');"}
+			} else if (message.method === 'auth.status') {
+				respond({ format: BRIDGE_FORMAT, id: message.id, kind: 'response', result: await authStatus() });
 			} else {
 				throw new Error('Expo bridge method is not allowed.');
 			}
@@ -6478,7 +6565,7 @@ export function AbsoluteWebHost() {
 		}
 	};
 
-	if (!indexUri) return <View style={styles.loading}><ActivityIndicator /></View>;
+	if (!indexUri || !authReady) return <View style={styles.loading}><ActivityIndicator /></View>;
 	return <WebView
 		allowFileAccess
 		allowFileAccessFromFileURLs
@@ -6511,9 +6598,17 @@ export default AbsoluteWebHost;
 `;
 var nativeWrapperSource = (wrapper, module) => `${EXPO_GENERATED_HEADER}export { default } from ${JSON.stringify(portableRelative2(dirname10(wrapper), module).replace(/\.(?:[cm]?[jt]sx?)$/u, ""))};
 `;
-var expoTsConfig = (projectRoot, project) => ({
+var expoTsConfig = (projectRoot, project, auth) => ({
   compilerOptions: {
     paths: {
+      ...auth ? {
+        "@absolutejs/auth": [
+          "./node_modules/@absolutejs/auth/dist/index.d.ts"
+        ],
+        "@absolutejs/auth/*": [
+          "./node_modules/@absolutejs/auth/dist/*"
+        ]
+      } : {},
       "*": [
         "./node_modules/*",
         `${portableRelative2(project, projectRoot)}/node_modules/*`
@@ -6551,6 +6646,7 @@ var writeAbsoluteExpoProject = async (config, options) => {
     throw new TypeError("Expo project generation requires mobile.engine: expo.");
   const projectRoot = resolve12(options.projectRoot);
   const project = config.nativeProjectDirectory;
+  const auth = resolveAbsoluteMobileAuthManifest(projectRoot, config);
   const routeModules = Object.entries(config.expoNativeRoutes);
   const moduleChecks = await Promise.all(routeModules.map(async ([route, module]) => ({
     exists: await exists3(module),
@@ -6571,6 +6667,7 @@ var writeAbsoluteExpoProject = async (config, options) => {
   await mkdir11(project, { recursive: true });
   await writeFile12(marker, `format=1
 `);
+  const authEnabled = Boolean(auth);
   const files = new Map([
     [
       join14(project, ".gitignore"),
@@ -6580,9 +6677,12 @@ ios/
 node_modules/
 `
     ],
-    [join14(project, "app.json"), jsonSource(expoAppConfig(config))],
+    [
+      join14(project, "app.json"),
+      jsonSource(expoAppConfig(config, authEnabled))
+    ],
     [join14(project, "app.config.js"), expoDynamicAppConfig],
-    [join14(project, "package.json"), jsonSource(expoPackage())],
+    [join14(project, "package.json"), jsonSource(expoPackage(authEnabled))],
     [join14(project, "metro.config.js"), metroConfig(projectRoot)],
     [
       join14(project, "plugins", "withAbsoluteDevelopmentCa.js"),
@@ -6590,18 +6690,21 @@ node_modules/
     ],
     [
       join14(project, "tsconfig.json"),
-      jsonSource(expoTsConfig(projectRoot, project))
+      jsonSource(expoTsConfig(projectRoot, project, authEnabled))
     ],
-    [join14(project, "app", "_layout.tsx"), layoutSource],
+    [join14(project, "app", "_layout.tsx"), layoutSource(authEnabled)],
     [
       join14(project, "app", "__absolute", "native", "index.tsx"),
       nativeDiagnosticSource
     ],
     [
       join14(project, "src", "generated", "AbsoluteWebHost.tsx"),
-      webHostSource(config)
+      webHostSource(config, auth)
     ]
   ]);
+  if (auth) {
+    files.set(join14(project, "src", "generated", "AbsoluteAuth.ts"), authRuntimeSource(auth, config.appId));
+  }
   const webAssetsPath = join14(project, "src", "generated", "webAssets.ts");
   if (!await exists3(webAssetsPath)) {
     files.set(webAssetsPath, emptyWebAssetsSource);
@@ -6800,10 +6903,10 @@ var finalizeAbsoluteMobileCompatibilityBuild = async (options) => {
     runtime: String(ABSOLUTE_MOBILE_PAGE_PROTOCOL_VERSION)
   });
   const auth = resolveAbsoluteMobileAuthManifest(options.projectRoot, mobile);
-  if (mobile.engine === "expo" && auth) {
-    throw new TypeError("Expo mobile Auth is not released yet. The experimental Expo shell cannot safely substitute Capacitor credentials; remove engine: 'expo' or wait for @absolutejs/auth-expo.");
-  }
   const sync = auth !== undefined && projectUsesAbsoluteSync(options.projectRoot);
+  if (mobile.engine === "expo" && sync) {
+    throw new TypeError("Expo mobile Sync is not released yet. Auth and authenticated HTTP are available, but @absolutejs/sync requires @absolutejs/sync-expo for shared durable state.");
+  }
   const syncSchema = sync ? discoverAbsoluteSyncSchema(options.projectRoot) : undefined;
   const deviceCapabilities = resolveAbsoluteDeviceCapabilityPlan(options.projectRoot);
   const usesPush = deviceCapabilities.capabilities.includes("pushNotifications");
@@ -6964,11 +7067,14 @@ var installAbsoluteMobileSyncRemediation = (bridge = {
 init_deviceCapabilities();
 
 // src/mobile/expoBridge.ts
-var ABSOLUTE_EXPO_BRIDGE_FORMAT = 1;
+var ABSOLUTE_EXPO_BRIDGE_FORMAT = 2;
 var ABSOLUTE_EXPO_BRIDGE_MAX_BYTES = 64 * 1024;
 var ABSOLUTE_EXPO_BRIDGE_METHODS = [
   "devices.haptics.impact",
-  "http.fetch"
+  "http.fetch",
+  "auth.signIn",
+  "auth.signOut",
+  "auth.status"
 ];
 var isRecord8 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
 var validId = (value) => typeof value === "string" && /^[A-Za-z0-9_-]{1,80}$/u.test(value);
@@ -7008,15 +7114,27 @@ var parseRequest = (value) => {
     const loopbackHttp = url.protocol === "http:" && (url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]");
     if (url.protocol !== "https:" && !loopbackHttp)
       throw new TypeError("Expo bridge HTTP URL must use HTTPS.");
-    if (value.params.method !== "GET")
+    if (typeof value.params.method !== "string" || !["DELETE", "GET", "PATCH", "POST", "PUT"].includes(value.params.method))
       throw new TypeError("Expo bridge HTTP method is not allowed.");
+    if (value.params.body !== undefined && typeof value.params.body !== "string")
+      throw new TypeError("Expo bridge HTTP body is invalid.");
+    if (typeof value.params.body === "string" && new TextEncoder().encode(value.params.body).byteLength > 48 * 1024)
+      throw new TypeError("Expo bridge HTTP body exceeds 48 KiB.");
+    if ((value.params.method === "GET" || value.params.method === "DELETE") && value.params.body !== undefined)
+      throw new TypeError("Expo bridge HTTP method cannot contain a body.");
     if (!isRecord8(value.params.headers))
       throw new TypeError("Expo bridge HTTP headers must be an object.");
-    const headersAllowed = Object.entries(value.params.headers).every(([name, header]) => typeof header === "string" && (name.toLowerCase() === "accept" || name.toLowerCase().startsWith("x-absolute-mobile-")));
+    const headersAllowed = Object.entries(value.params.headers).every(([name, header]) => typeof header === "string" && (name.toLowerCase() === "accept" || name.toLowerCase() === "content-type" || name.toLowerCase().startsWith("x-absolute-mobile-")));
     if (!headersAllowed) {
       throw new TypeError("Expo bridge HTTP header is not allowed.");
     }
   }
+  if (method === "auth.signIn") {
+    if (typeof value.params.email !== "string" || value.params.email.length > 320 || typeof value.params.signup !== "boolean")
+      throw new TypeError("Expo bridge Auth sign-in params are invalid.");
+  }
+  if ((method === "auth.signOut" || method === "auth.status") && Object.keys(value.params).length !== 0)
+    throw new TypeError("Expo bridge Auth params must be empty.");
   return {
     format: ABSOLUTE_EXPO_BRIDGE_FORMAT,
     id: value.id,
@@ -7055,7 +7173,7 @@ var parseResponse = (value) => {
   };
 };
 var parseEvent = (value) => {
-  if (value.event !== "ready" && value.event !== "navigation") {
+  if (value.event !== "ready" && value.event !== "navigation" && value.event !== "auth.principal") {
     throw new TypeError("Expo bridge event is not allowed.");
   }
   if (typeof value.path !== "string" || !validPath(value.path))
@@ -7445,6 +7563,10 @@ var startAbsoluteExpoDevSession = async (options) => {
     throw error;
   }
 };
+
+// src/mobile/index.ts
+init_config();
+
 // src/mobile/ciWorkflow.ts
 import { existsSync as existsSync3 } from "fs";
 import { access as access11, mkdir as mkdir12, readFile as readFile16, writeFile as writeFile13 } from "fs/promises";
@@ -8667,6 +8789,10 @@ var applyAbsoluteNativeDeviceCapabilities = async (projectRoot, config, platform
     changed: results.filter(({ didChange }) => didChange).map(({ platform: platform2 }) => platform2)
   };
 };
+
+// src/mobile/index.ts
+init_nativeAuth();
+
 // src/mobile/releasePublisher.ts
 import { access as access12 } from "fs/promises";
 import { isAbsolute as isAbsolute6, relative as relative12, resolve as resolve15, sep as sep7 } from "path";
@@ -9500,157 +9626,160 @@ var http = createAbsoluteHttpClient();
 // src/mobile/shellHttp.ts
 var installAbsoluteMobileShellHttp = (origin, fetch2 = globalThis.fetch) => installAbsoluteHttpTransport(createAbsoluteHttpTransport({ fetch: fetch2, origin, runtime: "native" }));
 export {
-  writeAbsoluteMobileGithubWorkflow,
-  writeAbsoluteExpoProject,
-  writeAbsoluteCapacitorConfig,
-  waitForAbsoluteIosHmrLog,
-  verifyAbsoluteMobileCompatibilityProducer,
-  verifyAbsoluteMobileAssociationFiles,
-  validateAbsoluteSshDestination,
-  validateAbsoluteRemoteMacProfileName,
-  testAbsoluteIosPhysicalDevice,
-  syncAbsoluteRemoteMacProject,
-  syncAbsoluteExpoWebAssets,
-  startAbsoluteRemoteIosDevSession,
-  startAbsoluteRemoteExpoIosDevSession,
-  startAbsoluteIosTcpRelay,
-  startAbsoluteIosDevSession,
-  startAbsoluteIosCaEnrollmentServer,
-  startAbsoluteExpoDevSession,
-  serializeAbsoluteMobileAuthEnvironment,
-  runWithAbsoluteMobileProducer,
-  runAbsoluteAndroidUpgradeConformance,
-  retainAbsoluteMobileCompatibilityArtifacts,
-  resolveAbsoluteMobileRoute,
-  resolveAbsoluteMobileNavigation,
-  resolveAbsoluteMobileDeepLink,
-  resolveAbsoluteMobileCompatibilityRelease,
-  resolveAbsoluteMobileAuthManifest,
-  resolveAbsoluteDeviceCapabilityPlan,
-  repairAbsoluteIosDevSession,
-  removeAbsoluteRemoteMacProfile,
-  redactAbsoluteIosLog,
-  readAbsoluteMobileMaterializedReleases,
-  publishAbsoluteIosRelease,
-  publishAbsoluteAndroidRelease,
-  projectUsesAbsoluteSync,
-  projectUsesAbsoluteAuth,
-  projectImportsAbsoluteDeviceCapability,
-  prepareAbsoluteIosRelease,
-  prepareAbsoluteIosDevProject,
-  prepareAbsoluteAndroidRelease,
-  planAbsoluteExpoDevSession,
-  parseIosSimulators,
-  parseIosRuntimes,
-  parseIosDeviceTypes,
-  parseAbsoluteMobilePageRequest,
-  parseAbsoluteMobilePageEnvelope,
-  parseAbsoluteMobileCompatibilityArtifact,
-  parseAbsoluteMobileBuildPageMetadata,
-  parseAbsoluteIosLogLine,
-  parseAbsoluteIosHmrLog,
-  parseAbsoluteExpoBridgeMessage,
-  parseAbsoluteAndroidInstalledApp,
-  pairAbsoluteRemoteMac,
-  normalizeAbsoluteMobileConfig,
-  normalizeAbsoluteIosDeviceIdentifier,
-  normalizeAbsoluteIosDeviceHost,
-  navigateAbsoluteMobilePage,
-  missingAbsoluteDeviceCapabilityPackages,
-  materializeAbsoluteRemoteMacAgent,
-  materializeAbsoluteMobileCompatibilityBundle,
-  materializeAbsoluteMobileAssociationFiles,
-  materializeAbsoluteCapacitorWebBundle,
-  matchesAbsoluteMobileRoutePattern,
-  loadAbsoluteNativeReleasePublisher,
-  loadAbsoluteMobileMaterializedBundle,
-  loadAbsoluteDeviceCapabilityProviders,
-  listAbsoluteRemoteMacProfiles,
-  isAbsoluteIosNativeRootInput,
-  installAbsoluteRemoteMacAgent,
-  installAbsoluteMobileSyncRemediation,
-  installAbsoluteMobileShellHttp,
-  installAbsoluteMobileAuthEnvironment,
-  inspectAbsoluteRemoteMacLanHost,
-  inspectAbsoluteRemoteMac,
-  inspectAbsoluteMobileRouteMetadata,
-  inspectAbsoluteAndroidInstalledApp,
-  hashAbsoluteMobilePropsSchema,
-  getCurrentAbsoluteMobileProducerContext,
-  getAbsoluteRemoteMacProfile,
-  getAbsoluteMobileSyncRemediation,
-  fingerprintAbsoluteIosNativeProject,
-  fingerprintAbsoluteIosDevProject,
-  finalizeAbsoluteMobilePage,
-  finalizeAbsoluteMobileCompatibilityBuild,
-  fetchAbsoluteMobilePage,
-  disposeAbsoluteMobilePage,
-  discoverAbsoluteSyncSchema,
-  discoverAbsoluteDeviceCapabilities,
-  directAbsoluteProjectPackages,
-  createAbsoluteRemoteIosDevProject,
-  createAbsoluteRemoteExpoIosDevProject,
-  createAbsoluteMobileUpgradeResponse,
-  createAbsoluteMobileRouteMetadataPlugin,
-  createAbsoluteMobilePreviewPlugin,
-  createAbsoluteMobilePageRequest,
-  createAbsoluteMobilePageErrorResponse,
-  createAbsoluteMobileInvalidRequestResponse,
-  createAbsoluteMobileGithubWorkflow,
-  createAbsoluteMobileFileArtifactStore,
-  createAbsoluteMobileCompatibilityDispatcher,
-  createAbsoluteMobileCompatibilityArtifact,
-  createAbsoluteMobileBlobArtifactStore,
-  createAbsoluteMobileAuthManifest,
-  createAbsoluteMobileAssociationPlugin,
-  createAbsoluteMobileAssociationDocuments,
-  createAbsoluteIosNativeWatcher,
-  createAbsoluteExpoBridgeResponse,
-  createAbsoluteExpoBridgeError,
-  carryForwardAbsoluteMobileCompatibilityReleases,
-  captureAbsoluteRemoteMacCommand,
-  captureAbsoluteMobileRouteGraph,
-  buildAbsoluteMobileCompatibilityRelease,
-  buildAbsoluteIosRelease,
-  buildAbsoluteAndroidRelease,
-  assertAbsoluteDeviceCapabilityPackages,
-  applyAbsoluteNativeDeviceCapabilities,
-  applyAbsoluteNativeDeepLinks,
-  activateAbsoluteMobilePage,
-  acceptsAbsoluteMobilePage,
-  absoluteRemoteProjectSyncCommands,
-  absoluteRemoteMacSshBase,
-  absoluteMobilePreviewDocument,
-  absoluteIosDeviceAcceptanceCommands,
-  absoluteExpoExecutable,
-  absoluteDeviceNativeRequirements,
-  MOBILE_PAGE_REQUEST_HEADERS,
-  AbsoluteMobilePageProtocolError,
-  APPLE_ASSOCIATION_PATH,
-  ANDROID_ASSOCIATION_PATH,
-  ABSOLUTE_SYNC_PACKAGE,
-  ABSOLUTE_REMOTE_MAC_PROTOCOL_VERSION,
-  ABSOLUTE_REMOTE_MAC_EVENT_PREFIX,
-  ABSOLUTE_NATIVE_AUTH_SCOPES,
-  ABSOLUTE_NATIVE_AUTH_CLIENTS_ENV,
-  ABSOLUTE_MOBILE_TRANSFORM_PROTOCOL,
-  ABSOLUTE_MOBILE_ROUTE_DETAIL,
-  ABSOLUTE_MOBILE_RETAINED_GENERATIONS,
-  ABSOLUTE_MOBILE_PREVIEW_PATH,
-  ABSOLUTE_MOBILE_PAGE_PROTOCOL_VERSION,
-  ABSOLUTE_MOBILE_PAGE_MEDIA_TYPE,
-  ABSOLUTE_MOBILE_MATERIALIZED_BUNDLE_FORMAT,
-  ABSOLUTE_MOBILE_COMPATIBILITY_FORMAT,
-  ABSOLUTE_MOBILE_CLIENT_MANIFEST_FORMAT,
-  ABSOLUTE_MOBILE_CI_WORKFLOW_FORMAT,
-  ABSOLUTE_IOS_SIMULATOR_NAME,
-  ABSOLUTE_IOS_RELEASE_FORMAT,
-  ABSOLUTE_EXPO_BRIDGE_METHODS,
-  ABSOLUTE_EXPO_BRIDGE_MAX_BYTES,
-  ABSOLUTE_EXPO_BRIDGE_FORMAT,
+  ABSOLUTE_ANDROID_RELEASE_FORMAT,
   ABSOLUTE_AUTH_PACKAGE,
-  ABSOLUTE_ANDROID_RELEASE_FORMAT
+  ABSOLUTE_EXPO_AUTH_CORE_VERSION,
+  ABSOLUTE_EXPO_AUTH_PACKAGE,
+  ABSOLUTE_EXPO_AUTH_VERSION,
+  ABSOLUTE_EXPO_BRIDGE_FORMAT,
+  ABSOLUTE_EXPO_BRIDGE_MAX_BYTES,
+  ABSOLUTE_EXPO_BRIDGE_METHODS,
+  ABSOLUTE_IOS_RELEASE_FORMAT,
+  ABSOLUTE_IOS_SIMULATOR_NAME,
+  ABSOLUTE_MOBILE_CI_WORKFLOW_FORMAT,
+  ABSOLUTE_MOBILE_CLIENT_MANIFEST_FORMAT,
+  ABSOLUTE_MOBILE_COMPATIBILITY_FORMAT,
+  ABSOLUTE_MOBILE_MATERIALIZED_BUNDLE_FORMAT,
+  ABSOLUTE_MOBILE_PAGE_MEDIA_TYPE,
+  ABSOLUTE_MOBILE_PAGE_PROTOCOL_VERSION,
+  ABSOLUTE_MOBILE_PREVIEW_PATH,
+  ABSOLUTE_MOBILE_RETAINED_GENERATIONS,
+  ABSOLUTE_MOBILE_ROUTE_DETAIL,
+  ABSOLUTE_MOBILE_TRANSFORM_PROTOCOL,
+  ABSOLUTE_NATIVE_AUTH_CLIENTS_ENV,
+  ABSOLUTE_NATIVE_AUTH_SCOPES,
+  ABSOLUTE_REMOTE_MAC_EVENT_PREFIX,
+  ABSOLUTE_REMOTE_MAC_PROTOCOL_VERSION,
+  ABSOLUTE_SYNC_PACKAGE,
+  ANDROID_ASSOCIATION_PATH,
+  APPLE_ASSOCIATION_PATH,
+  AbsoluteMobilePageProtocolError,
+  MOBILE_PAGE_REQUEST_HEADERS,
+  absoluteDeviceNativeRequirements,
+  absoluteExpoExecutable,
+  absoluteIosDeviceAcceptanceCommands,
+  absoluteMobilePreviewDocument,
+  absoluteRemoteMacSshBase,
+  absoluteRemoteProjectSyncCommands,
+  acceptsAbsoluteMobilePage,
+  activateAbsoluteMobilePage,
+  applyAbsoluteNativeDeepLinks,
+  applyAbsoluteNativeDeviceCapabilities,
+  assertAbsoluteDeviceCapabilityPackages,
+  buildAbsoluteAndroidRelease,
+  buildAbsoluteIosRelease,
+  buildAbsoluteMobileCompatibilityRelease,
+  captureAbsoluteMobileRouteGraph,
+  captureAbsoluteRemoteMacCommand,
+  carryForwardAbsoluteMobileCompatibilityReleases,
+  createAbsoluteExpoBridgeError,
+  createAbsoluteExpoBridgeResponse,
+  createAbsoluteIosNativeWatcher,
+  createAbsoluteMobileAssociationDocuments,
+  createAbsoluteMobileAssociationPlugin,
+  createAbsoluteMobileAuthManifest,
+  createAbsoluteMobileBlobArtifactStore,
+  createAbsoluteMobileCompatibilityArtifact,
+  createAbsoluteMobileCompatibilityDispatcher,
+  createAbsoluteMobileFileArtifactStore,
+  createAbsoluteMobileGithubWorkflow,
+  createAbsoluteMobileInvalidRequestResponse,
+  createAbsoluteMobilePageErrorResponse,
+  createAbsoluteMobilePageRequest,
+  createAbsoluteMobilePreviewPlugin,
+  createAbsoluteMobileRouteMetadataPlugin,
+  createAbsoluteMobileUpgradeResponse,
+  createAbsoluteRemoteExpoIosDevProject,
+  createAbsoluteRemoteIosDevProject,
+  directAbsoluteProjectPackages,
+  discoverAbsoluteDeviceCapabilities,
+  discoverAbsoluteSyncSchema,
+  disposeAbsoluteMobilePage,
+  fetchAbsoluteMobilePage,
+  finalizeAbsoluteMobileCompatibilityBuild,
+  finalizeAbsoluteMobilePage,
+  fingerprintAbsoluteIosDevProject,
+  fingerprintAbsoluteIosNativeProject,
+  getAbsoluteMobileSyncRemediation,
+  getAbsoluteRemoteMacProfile,
+  getCurrentAbsoluteMobileProducerContext,
+  hashAbsoluteMobilePropsSchema,
+  inspectAbsoluteAndroidInstalledApp,
+  inspectAbsoluteMobileRouteMetadata,
+  inspectAbsoluteRemoteMac,
+  inspectAbsoluteRemoteMacLanHost,
+  installAbsoluteMobileAuthEnvironment,
+  installAbsoluteMobileShellHttp,
+  installAbsoluteMobileSyncRemediation,
+  installAbsoluteRemoteMacAgent,
+  isAbsoluteIosNativeRootInput,
+  listAbsoluteRemoteMacProfiles,
+  loadAbsoluteDeviceCapabilityProviders,
+  loadAbsoluteMobileMaterializedBundle,
+  loadAbsoluteNativeReleasePublisher,
+  matchesAbsoluteMobileRoutePattern,
+  materializeAbsoluteCapacitorWebBundle,
+  materializeAbsoluteMobileAssociationFiles,
+  materializeAbsoluteMobileCompatibilityBundle,
+  materializeAbsoluteRemoteMacAgent,
+  missingAbsoluteDeviceCapabilityPackages,
+  navigateAbsoluteMobilePage,
+  normalizeAbsoluteIosDeviceHost,
+  normalizeAbsoluteIosDeviceIdentifier,
+  normalizeAbsoluteMobileConfig,
+  pairAbsoluteRemoteMac,
+  parseAbsoluteAndroidInstalledApp,
+  parseAbsoluteExpoBridgeMessage,
+  parseAbsoluteIosHmrLog,
+  parseAbsoluteIosLogLine,
+  parseAbsoluteMobileBuildPageMetadata,
+  parseAbsoluteMobileCompatibilityArtifact,
+  parseAbsoluteMobilePageEnvelope,
+  parseAbsoluteMobilePageRequest,
+  parseIosDeviceTypes,
+  parseIosRuntimes,
+  parseIosSimulators,
+  planAbsoluteExpoDevSession,
+  prepareAbsoluteAndroidRelease,
+  prepareAbsoluteIosDevProject,
+  prepareAbsoluteIosRelease,
+  projectImportsAbsoluteDeviceCapability,
+  projectUsesAbsoluteAuth,
+  projectUsesAbsoluteSync,
+  publishAbsoluteAndroidRelease,
+  publishAbsoluteIosRelease,
+  readAbsoluteMobileMaterializedReleases,
+  redactAbsoluteIosLog,
+  removeAbsoluteRemoteMacProfile,
+  repairAbsoluteIosDevSession,
+  resolveAbsoluteDeviceCapabilityPlan,
+  resolveAbsoluteMobileAuthManifest,
+  resolveAbsoluteMobileCompatibilityRelease,
+  resolveAbsoluteMobileDeepLink,
+  resolveAbsoluteMobileNavigation,
+  resolveAbsoluteMobileRoute,
+  retainAbsoluteMobileCompatibilityArtifacts,
+  runAbsoluteAndroidUpgradeConformance,
+  runWithAbsoluteMobileProducer,
+  serializeAbsoluteMobileAuthEnvironment,
+  startAbsoluteExpoDevSession,
+  startAbsoluteIosCaEnrollmentServer,
+  startAbsoluteIosDevSession,
+  startAbsoluteIosTcpRelay,
+  startAbsoluteRemoteExpoIosDevSession,
+  startAbsoluteRemoteIosDevSession,
+  syncAbsoluteExpoWebAssets,
+  syncAbsoluteRemoteMacProject,
+  testAbsoluteIosPhysicalDevice,
+  validateAbsoluteRemoteMacProfileName,
+  validateAbsoluteSshDestination,
+  verifyAbsoluteMobileAssociationFiles,
+  verifyAbsoluteMobileCompatibilityProducer,
+  waitForAbsoluteIosHmrLog,
+  writeAbsoluteCapacitorConfig,
+  writeAbsoluteExpoProject,
+  writeAbsoluteMobileGithubWorkflow
 };
 
-//# debugId=97C358B153ACDA7B64756E2164756E21
+//# debugId=609EFE7CD27840A164756E2164756E21
 //# sourceMappingURL=index.js.map