@absolutejs/absolute 0.20.0-beta.59 → 0.20.0-beta.60

package/dist/cli/index.js

@@ -718,7 +718,8 @@ var init_portScan = () => {};
 
 // src/mobile/config.ts
 import { resolve as resolve2 } from "path";
-var APP_ID_PATTERN, SCHEME_PATTERN, APPLE_APP_ID_PREFIX_PATTERN, CERTIFICATE_FINGERPRINT_PATTERN, HOSTNAME_PATTERN, EXPO_RESERVED_ROUTE_PREFIXES, resolveProjectPath = (projectRoot, value, field) => {
+import { createPublicKey } from "crypto";
+var APP_ID_PATTERN, SCHEME_PATTERN, APPLE_APP_ID_PREFIX_PATTERN, CERTIFICATE_FINGERPRINT_PATTERN, UPDATE_NAME_PATTERN, UPDATE_PUBLIC_KEY_PATTERN, HOSTNAME_PATTERN, EXPO_RESERVED_ROUTE_PREFIXES, resolveProjectPath = (projectRoot, value, field) => {
   const root = resolve2(projectRoot);
   const path = resolve2(root, value);
   if (path !== root && !path.startsWith(`${root}/`)) {
@@ -791,7 +792,52 @@ var APP_ID_PATTERN, SCHEME_PATTERN, APPLE_APP_ID_PREFIX_PATTERN, CERTIFICATE_FIN
     }
     return value.match(/.{2}/g)?.join(":") ?? value;
   }))
-].sort(), validateExpoNativeRouteSegment = (path, segment, index, count, parameters) => {
+].sort(), normalizeUpdates = (config, productionOrigin) => {
+  if (!config.updates)
+    return;
+  const channel = requireText(config.updates.channel ?? "production", "mobile.updates.channel");
+  if (!UPDATE_NAME_PATTERN.test(channel))
+    throw new TypeError("mobile.updates.channel contains unsupported characters.");
+  const manifestUrl = new URL(config.updates.manifestUrl ?? `/__absolute/mobile/updates/${encodeURIComponent(channel)}/update.json`, `${productionOrigin}/`);
+  const loopback = manifestUrl.hostname === "localhost" || manifestUrl.hostname === "127.0.0.1" || manifestUrl.hostname === "[::1]";
+  if (manifestUrl.protocol !== "https:" && !loopback)
+    throw new TypeError("mobile.updates.manifestUrl must use HTTPS outside loopback development.");
+  if (manifestUrl.username || manifestUrl.password || manifestUrl.hash)
+    throw new TypeError("mobile.updates.manifestUrl cannot contain credentials or a fragment.");
+  const entries = Object.entries(config.updates.publicKeys).sort(([left], [right]) => left.localeCompare(right));
+  if (entries.length === 0)
+    throw new TypeError("mobile.updates.publicKeys must contain at least one key.");
+  const publicKeys = Object.fromEntries(entries.map(([keyId, key]) => {
+    if (!UPDATE_NAME_PATTERN.test(keyId))
+      throw new TypeError("mobile.updates.publicKeys contains an invalid key ID.");
+    const normalized = requireText(key, `mobile.updates.publicKeys.${keyId}`);
+    if (!UPDATE_PUBLIC_KEY_PATTERN.test(normalized))
+      throw new TypeError(`mobile.updates.publicKeys.${keyId} must be base64-encoded ECDSA P-256 SPKI DER.`);
+    let decoded;
+    try {
+      decoded = Buffer.from(normalized, "base64");
+    } catch {
+      throw new TypeError(`mobile.updates.publicKeys.${keyId} must be canonical base64.`);
+    }
+    let keyType;
+    let namedCurve;
+    try {
+      const publicKey = createPublicKey({
+        format: "der",
+        key: decoded,
+        type: "spki"
+      });
+      keyType = publicKey.asymmetricKeyType;
+      namedCurve = publicKey.asymmetricKeyDetails?.namedCurve;
+    } catch {
+      keyType = undefined;
+    }
+    if (decoded.toString("base64") !== normalized || keyType !== "ec" || namedCurve !== "prime256v1")
+      throw new TypeError(`mobile.updates.publicKeys.${keyId} is not an ECDSA P-256 SPKI public key.`);
+    return [keyId, normalized];
+  }));
+  return { channel, manifestUrl: manifestUrl.href, publicKeys };
+}, validateExpoNativeRouteSegment = (path, segment, index, count, parameters) => {
   if (segment === "*" && (index !== count - 1 || count === 1)) {
     throw new TypeError(`mobile.routes.native route ${path} must use * once, as the final segment after a static or parameterized prefix.`);
   }
@@ -849,6 +895,7 @@ var APP_ID_PATTERN, SCHEME_PATTERN, APPLE_APP_ID_PREFIX_PATTERN, CERTIFICATE_FIN
   if (deepLinkScheme && !SCHEME_PATTERN.test(deepLinkScheme)) {
     throw new TypeError("mobile.deepLinks.scheme is not a valid URL scheme.");
   }
+  const updates = normalizeUpdates(config, productionOrigin);
   return {
     androidCertificateFingerprints: normalizeCertificateFingerprints(config.deepLinks?.android?.sha256CertificateFingerprints),
     appId,
@@ -865,7 +912,8 @@ var APP_ID_PATTERN, SCHEME_PATTERN, APPLE_APP_ID_PREFIX_PATTERN, CERTIFICATE_FIN
     nativeProjectDirectory: resolveProjectPath(projectRoot, config.nativeProject?.directory ?? (config.engine === "expo" ? ".absolutejs/mobile/expo" : "mobile"), "mobile.nativeProject.directory"),
     platforms: normalizePlatforms(config.platforms),
     productionOrigin,
-    pushAndroidGoogleServicesFile: resolveProjectPath(projectRoot, config.pushNotifications?.android?.googleServicesFile ?? "google-services.json", "mobile.pushNotifications.android.googleServicesFile")
+    pushAndroidGoogleServicesFile: resolveProjectPath(projectRoot, config.pushNotifications?.android?.googleServicesFile ?? "google-services.json", "mobile.pushNotifications.android.googleServicesFile"),
+    ...updates ? { updates } : {}
   };
 };
 var init_config = __esm(() => {
@@ -873,6 +921,8 @@ var init_config = __esm(() => {
   SCHEME_PATTERN = /^[a-z][a-z0-9+.-]*$/;
   APPLE_APP_ID_PREFIX_PATTERN = /^[A-Z0-9]{10}$/;
   CERTIFICATE_FINGERPRINT_PATTERN = /^[0-9A-F]{64}$/;
+  UPDATE_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
+  UPDATE_PUBLIC_KEY_PATTERN = /^[A-Za-z0-9+/]+={0,2}$/u;
   HOSTNAME_PATTERN = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(?:\.(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?))*$/;
   EXPO_RESERVED_ROUTE_PREFIXES = new Set([
     "_expo",
@@ -9060,6 +9110,11 @@ var MANIFEST_FILE = "absolute-mobile-manifest.json", BOOTSTRAP_FILE = "absolute-
   if (candidate)
     return candidate;
   throw new TypeError("AbsoluteJS Expo device bridge module is missing.");
+}, shellUpdateModule = () => {
+  const candidate = ["js", "ts"].map((extension) => join21(import.meta.dir, `shellUpdate.${extension}`)).find(existsSync10);
+  if (candidate)
+    return candidate;
+  throw new TypeError("AbsoluteJS mobile update shell module is missing.");
 }, escapeHtml = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;"), contentSecurityPolicy = (productionOrigin) => {
   const backend = new URL(productionOrigin);
   const socketOrigin = `${backend.protocol === "https:" ? "wss:" : "ws:"}//${backend.host}`;
@@ -9114,7 +9169,7 @@ var MANIFEST_FILE = "absolute-mobile-manifest.json", BOOTSTRAP_FILE = "absolute-
   if (!resolved.startsWith(`${resolve16(packageDirectory)}/`))
     throw new TypeError(`${specifier} has an unsafe import entry.`);
   return resolved;
-}, buildShellBootstrap = async (staging, auth, sync, storagePrefix, engine, deviceCapabilities, projectRoot) => {
+}, buildShellBootstrap = async (staging, auth, sync, storagePrefix, engine, updates, deviceCapabilities, projectRoot) => {
   const capacitor = engine !== "expo";
   const shellCapabilities = capacitor ? deviceCapabilities.capabilities : [];
   const modulePath = shellBootstrapModule();
@@ -9122,12 +9177,13 @@ var MANIFEST_FILE = "absolute-mobile-manifest.json", BOOTSTRAP_FILE = "absolute-
   const syncFactory = capacitor ? "installAbsoluteMobileShellSync" : "installAbsoluteExpoShellSync";
   const authImport = auth ? `import { ${authFactory} } from ${JSON.stringify(capacitor ? shellAuthModule() : shellExpoAuthModule())};
 ` : "";
-  const options = auth ? `{ createAuth: ${authFactory}${sync ? `, installSync: ${syncFactory}` : ""} }` : "";
   const syncImport = sync ? `import { ${syncFactory} } from ${JSON.stringify(capacitor ? shellSyncModule() : shellExpoSyncModule())};
 ` : "";
   const pushIndex = shellCapabilities.indexOf("pushNotifications");
   const push = pushIndex !== -1;
   const pushImport = push ? `import { createAbsoluteMobileShellPush } from ${JSON.stringify(shellPushModule())};
+` : "";
+  const updateImport = updates ? `import { installAbsoluteMobileShellUpdates } from ${JSON.stringify(shellUpdateModule())};
 ` : "";
   const capabilityImports = (await Promise.all(shellCapabilities.map(async (name, index) => {
     const provider = deviceCapabilities.providers[name];
@@ -9144,15 +9200,21 @@ const absoluteMobilePushCapability = absoluteDeviceCapability${pushIndex}(absolu
   const baseAdapterModule = capacitor ? await resolveProjectImport(projectRoot, "@absolutejs/devices-capacitor") : shellExpoDevicesModule();
   const adapterImport = capacitor ? `import { installCapacitorDeviceAdapterIfNative } from ${JSON.stringify(baseAdapterModule)};` : `import { createAbsoluteExpoBridgeFetch, installAbsoluteExpoWebDeviceAdapter } from ${JSON.stringify(baseAdapterModule)};`;
   const adapterInstall = capacitor ? `installCapacitorDeviceAdapterIfNative({ storagePrefix: ${JSON.stringify(storagePrefix)}${capabilityOptions ? `, ${capabilityOptions}` : ""} });` : `installAbsoluteExpoWebDeviceAdapter(${JSON.stringify(deviceCapabilities.capabilities)});`;
-  let shellOptions = auth ? options : "{ createFetch: createAbsoluteExpoBridgeFetch }";
-  if (capacitor)
-    shellOptions = options;
+  const shellOptionProperties = [];
   if (push) {
-    shellOptions = `{ createAuth: (config, options) => createAbsoluteMobileShellAuth(config, options), beforeSignOut: absoluteMobilePush.beforeSignOut, connectPush: (auth) => absoluteMobilePush.connect(auth, absoluteMobilePushCapability)${sync ? `, installSync: ${syncFactory}` : ""} }`;
-  }
+    shellOptionProperties.push("createAuth: (config, options) => createAbsoluteMobileShellAuth(config, options)", "beforeSignOut: absoluteMobilePush.beforeSignOut", "connectPush: (auth) => absoluteMobilePush.connect(auth, absoluteMobilePushCapability)");
+  } else if (auth)
+    shellOptionProperties.push(`createAuth: ${authFactory}`);
+  else if (!capacitor)
+    shellOptionProperties.push("createFetch: createAbsoluteExpoBridgeFetch");
+  if (sync)
+    shellOptionProperties.push(`installSync: ${syncFactory}`);
+  if (updates)
+    shellOptionProperties.push("installUpdates: installAbsoluteMobileShellUpdates");
+  const shellOptions = `{ ${shellOptionProperties.join(", ")} }`;
   await writeFile8(entryPath, `import { startAbsoluteMobileShell } from ${JSON.stringify(modulePath)};
 ${adapterImport}
-${authImport}${syncImport}${pushImport}${capabilityImports}
+${authImport}${syncImport}${pushImport}${updateImport}${capabilityImports}
 ${pushSetup}${adapterInstall}
 void startAbsoluteMobileShell(${shellOptions});
 `);
@@ -9287,10 +9349,12 @@ void startAbsoluteMobileShell(${shellOptions});
       deviceCapabilities: options.deviceCapabilities.capabilities,
       entry: options.config.entry,
       format: ABSOLUTE_MOBILE_CLIENT_MANIFEST_FORMAT,
+      nativeRuntime: options.runtimeFingerprint,
       pages,
       productionOrigin: options.config.productionOrigin,
       routes: options.artifact.routes,
       runtime: options.artifact.runtime,
+      ...options.config.updates ? { updates: options.config.updates } : {},
       ...options.sync ? {
         sync: {
           background: {
@@ -9310,7 +9374,7 @@ void startAbsoluteMobileShell(${shellOptions});
       writeFile8(join21(staging, MANIFEST_FILE), `${JSON.stringify(manifest, null, "\t")}
 `),
       writeFile8(join21(staging, INDEX_FILE), indexHtml(options.config.appName, options.config.productionOrigin)),
-      buildShellBootstrap(staging, options.auth !== undefined, options.auth !== undefined && options.sync === true, `absolutejs.${options.auth?.clientId ?? options.config.appId}.`, options.config.engine, options.deviceCapabilities, options.projectRoot)
+      buildShellBootstrap(staging, options.auth !== undefined, options.auth !== undefined && options.sync === true, `absolutejs.${options.auth?.clientId ?? options.config.appId}.`, options.config.engine, options.config.engine === "capacitor" && options.config.updates !== undefined, options.deviceCapabilities, options.projectRoot)
     ]);
     await installBundle(staging, destination);
     return manifest;
@@ -9484,6 +9548,136 @@ var init_materializedBundle = __esm(() => {
   BUNDLE_ID_PATTERN = /^amb_[a-f0-9]{64}$/;
 });
 
+// src/mobile/updateProtocol.ts
+var ABSOLUTE_MOBILE_UPDATE_FORMAT = 1, ABSOLUTE_MOBILE_UPDATE_MAX_FILE_BYTES, ABSOLUTE_MOBILE_UPDATE_MAX_FILES = 1e4, ABSOLUTE_MOBILE_UPDATE_MAX_TOTAL_BYTES, ABSOLUTE_MOBILE_UPDATE_SIGNATURE_ALGORITHM = "ecdsa-p256-sha256", HASH_PATTERN, RELEASE_PATTERN, KEY_ID_PATTERN, CHANNEL_PATTERN, isClassification = (value) => value === "bug-fix" || value === "content" || value === "security", object3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), canonicalValue = (value) => {
+  if (Array.isArray(value))
+    return value.map(canonicalValue);
+  if (!object3(value))
+    return value;
+  return Object.fromEntries(Object.keys(value).sort().map((key) => [key, canonicalValue(value[key])]));
+}, absoluteMobileUpdateSigningPayload = (manifest) => new TextEncoder().encode(canonicalizeAbsoluteMobileUpdate(manifest)), canonicalizeAbsoluteMobileUpdate = (value) => JSON.stringify(canonicalValue(value)), requireText2 = (value, field) => {
+  if (typeof value !== "string" || value.length === 0)
+    throw new TypeError(`${field} must be a non-empty string.`);
+  return value;
+}, normalizeAbsoluteMobileUpdatePath = (value) => {
+  const path = requireText2(value, "Update file path").replaceAll("\\", "/");
+  if (path.startsWith("/") || path.includes("\x00") || path.split("/").some((segment) => !segment || segment === "." || segment === "..")) {
+    throw new TypeError("Update file paths must be normalized relative paths.");
+  }
+  return path;
+}, parseFile = (value) => {
+  if (!object3(value))
+    throw new TypeError("Update files must be objects.");
+  const path = normalizeAbsoluteMobileUpdatePath(value.path);
+  if (typeof value.bytes !== "number" || !Number.isSafeInteger(value.bytes) || value.bytes < 0 || value.bytes > ABSOLUTE_MOBILE_UPDATE_MAX_FILE_BYTES) {
+    throw new TypeError(`Update file ${path} has an invalid byte length.`);
+  }
+  if (typeof value.sha256 !== "string" || !HASH_PATTERN.test(value.sha256))
+    throw new TypeError(`Update file ${path} has an invalid SHA-256 digest.`);
+  return { bytes: value.bytes, path, sha256: value.sha256 };
+}, parseAbsoluteMobileUnsignedUpdateManifest = (value) => {
+  if (!object3(value) || value.format !== ABSOLUTE_MOBILE_UPDATE_FORMAT)
+    throw new TypeError("Invalid AbsoluteJS mobile update manifest.");
+  const appId = requireText2(value.appId, "Update appId");
+  const channel = requireText2(value.channel, "Update channel");
+  if (!CHANNEL_PATTERN.test(channel))
+    throw new TypeError("Update channel contains unsupported characters.");
+  if (!isClassification(value.classification))
+    throw new TypeError("Update classification is invalid.");
+  const createdAt = requireText2(value.createdAt, "Update createdAt");
+  if (!Number.isFinite(Date.parse(createdAt)) || new Date(createdAt).toISOString() !== createdAt)
+    throw new TypeError("Update createdAt must be a canonical ISO timestamp.");
+  if (!Array.isArray(value.files) || value.files.length === 0)
+    throw new TypeError("An update must contain at least one file.");
+  if (value.files.length > ABSOLUTE_MOBILE_UPDATE_MAX_FILES)
+    throw new TypeError("Update contains too many files.");
+  const files = value.files.map(parseFile);
+  const sorted = [...files].sort((left, right) => left.path.localeCompare(right.path));
+  if (files.some((file, index) => file.path !== sorted[index]?.path))
+    throw new TypeError("Update files must be sorted by path.");
+  if (new Set(files.map(({ path }) => path)).size !== files.length)
+    throw new TypeError("Update file paths must be unique.");
+  if (files.reduce((total, file) => total + file.bytes, 0) > ABSOLUTE_MOBILE_UPDATE_MAX_TOTAL_BYTES)
+    throw new TypeError("Update exceeds the maximum uncompressed size.");
+  if (typeof value.releaseId !== "string" || !RELEASE_PATTERN.test(value.releaseId))
+    throw new TypeError("Update releaseId is invalid.");
+  if (typeof value.runtimeFingerprint !== "string" || !HASH_PATTERN.test(value.runtimeFingerprint))
+    throw new TypeError("Update runtime fingerprint is invalid.");
+  if (value.withinSubmittedPurpose !== true)
+    throw new TypeError("OTA updates must attest that they remain within the submitted app purpose.");
+  return {
+    appId,
+    channel,
+    classification: value.classification,
+    createdAt,
+    files,
+    format: ABSOLUTE_MOBILE_UPDATE_FORMAT,
+    releaseId: value.releaseId,
+    runtimeFingerprint: value.runtimeFingerprint,
+    withinSubmittedPurpose: true
+  };
+}, parseAbsoluteMobileUpdateManifest = (value) => {
+  if (!object3(value))
+    throw new TypeError("Invalid AbsoluteJS mobile update manifest.");
+  const { signature: signatureValue, ...unsignedValue } = value;
+  const unsigned = parseAbsoluteMobileUnsignedUpdateManifest(unsignedValue);
+  if (!object3(signatureValue))
+    throw new TypeError("Update signature is missing.");
+  if (signatureValue.algorithm !== ABSOLUTE_MOBILE_UPDATE_SIGNATURE_ALGORITHM)
+    throw new TypeError("Update signature algorithm is unsupported.");
+  const keyId = requireText2(signatureValue.keyId, "Update signature keyId");
+  if (!KEY_ID_PATTERN.test(keyId))
+    throw new TypeError("Update signature keyId is invalid.");
+  const signature = requireText2(signatureValue.value, "Update signature value");
+  let signatureBytes;
+  try {
+    signatureBytes = Uint8Array.from(atob(signature), (character) => character.charCodeAt(0));
+  } catch {
+    signatureBytes = new Uint8Array;
+  }
+  if (!/^[A-Za-z0-9+/]+={0,2}$/u.test(signature) || signatureBytes.byteLength !== 64 || btoa(String.fromCharCode(...signatureBytes)) !== signature)
+    throw new TypeError("Update signature is not canonical base64.");
+  return {
+    ...unsigned,
+    signature: {
+      algorithm: ABSOLUTE_MOBILE_UPDATE_SIGNATURE_ALGORITHM,
+      keyId,
+      value: signature
+    }
+  };
+}, unsignedAbsoluteMobileUpdate = (manifest) => {
+  const { signature: _signature, ...unsigned } = manifest;
+  return unsigned;
+};
+var init_updateProtocol = __esm(() => {
+  ABSOLUTE_MOBILE_UPDATE_MAX_FILE_BYTES = 32 * 1024 * 1024;
+  ABSOLUTE_MOBILE_UPDATE_MAX_TOTAL_BYTES = 128 * 1024 * 1024;
+  HASH_PATTERN = /^[a-f0-9]{64}$/u;
+  RELEASE_PATTERN = /^amu_[a-f0-9]{64}$/u;
+  KEY_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
+  CHANNEL_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
+});
+
+// src/mobile/updateRuntime.ts
+import { createHash as createHash12 } from "crypto";
+var ABSOLUTE_MOBILE_SHELL_ABI = 1, ABSOLUTE_MOBILE_UPDATE_RUNTIME_FORMAT = 1, createAbsoluteMobileUpdateRuntimeDescriptor = (options) => ({
+  appId: options.config.appId,
+  auth: options.auth ?? null,
+  deepLinks: {
+    hosts: options.config.deepLinkHosts,
+    ...options.config.deepLinkScheme ? { scheme: options.config.deepLinkScheme } : {}
+  },
+  deviceCapabilities: options.deviceCapabilities,
+  engine: options.config.engine,
+  format: ABSOLUTE_MOBILE_UPDATE_RUNTIME_FORMAT,
+  shellAbi: ABSOLUTE_MOBILE_SHELL_ABI,
+  syncSchema: options.syncSchema ?? null,
+  updates: options.config.updates ?? null
+}), fingerprintAbsoluteMobileUpdateRuntime = (descriptor) => createHash12("sha256").update(canonicalizeAbsoluteMobileUpdate(descriptor)).digest("hex");
+var init_updateRuntime = __esm(() => {
+  init_updateProtocol();
+});
+
 // src/mobile/buildPipeline.ts
 import { readFile as readFile12 } from "fs/promises";
 import { join as join23, resolve as resolve17 } from "path";
@@ -9556,6 +9750,12 @@ var isElysiaApp = (value) => typeof value === "object" && value !== null && type
   const sync = auth !== undefined && projectUsesAbsoluteSync(options.projectRoot);
   const syncSchema = sync ? discoverAbsoluteSyncSchema(options.projectRoot) : undefined;
   const deviceCapabilities = resolveAbsoluteDeviceCapabilityPlan(options.projectRoot, mobile.engine);
+  const runtimeFingerprint = fingerprintAbsoluteMobileUpdateRuntime(createAbsoluteMobileUpdateRuntimeDescriptor({
+    ...auth ? { auth } : {},
+    config: mobile,
+    deviceCapabilities,
+    ...syncSchema ? { syncSchema } : {}
+  }));
   const usesPush = deviceCapabilities.capabilities.includes("pushNotifications");
   if (usesPush && !auth)
     throw new TypeError("Portable push notifications require @absolutejs/auth so provider tokens can be registered without exposing identity controls to page code.");
@@ -9584,6 +9784,7 @@ var isElysiaApp = (value) => typeof value === "object" && value !== null && type
     config: mobile,
     deviceCapabilities,
     projectRoot: options.projectRoot,
+    runtimeFingerprint,
     ...sync ? { sync: true } : {},
     ...syncSchema ? { syncSchema: { components: syncSchema.components } } : {}
   });
@@ -9606,6 +9807,7 @@ var init_buildPipeline = __esm(() => {
   init_syncSchema();
   init_deviceCapabilities();
   init_expoProject();
+  init_updateRuntime();
 });
 
 // src/mobile/routeMetadataTransform.ts
@@ -9635,8 +9837,8 @@ var ROUTE_METHODS, SOURCE_FILTER, PAGE_HANDLERS, posixPath = (value) => value.re
   if (ts5.isStringLiteralLike(property.name))
     return property.name.text;
   return;
-}, objectPropertyExpression = (object3, name) => {
-  const property = object3.properties.find((candidate) => propertyName(candidate) === name);
+}, objectPropertyExpression = (object4, name) => {
+  const property = object4.properties.find((candidate) => propertyName(candidate) === name);
   if (property && ts5.isPropertyAssignment(property)) {
     return property.initializer;
   }
@@ -9822,8 +10024,8 @@ var ROUTE_METHODS, SOURCE_FILTER, PAGE_HANDLERS, posixPath = (value) => value.re
   if (!ts5.isCallExpression(expression))
     return;
   return callableObject(expression, checker);
-}, objectAssetKey = (object3, name, checker, bindings = new Map) => {
-  for (const property of [...object3.properties].reverse()) {
+}, objectAssetKey = (object4, name, checker, bindings = new Map) => {
+  for (const property of [...object4.properties].reverse()) {
     if (propertyName(property) === name && ts5.isShorthandPropertyAssignment(property)) {
       return assetKeyWithBindings(property.name, checker, bindings);
     }
@@ -11512,9 +11714,9 @@ __export(exports_lintProof, {
   writeLintProof: () => writeLintProof
 });
 import {
-  createHash as createHash12,
+  createHash as createHash13,
   createPrivateKey,
-  createPublicKey,
+  createPublicKey as createPublicKey2,
   sign,
   verify
 } from "crypto";
@@ -11555,7 +11757,7 @@ var DEFAULT_PROOF_LOCATION = ".absolutejs/lint-proof.json", PROOF_CONTRACT_VERSI
     lintFingerprint: proof.lintFingerprint,
     sourceTree: proof.sourceTree
   })
-].join("\x00")), publicKeyId = (key) => createHash12("sha256").update(key.export({ format: "der", type: "spki" })).digest("hex"), readEd25519PrivateKey = (cwd, location) => {
+].join("\x00")), publicKeyId = (key) => createHash13("sha256").update(key.export({ format: "der", type: "spki" })).digest("hex"), readEd25519PrivateKey = (cwd, location) => {
   const path = resolve24(cwd, location);
   if (isInside3(realpathSync(gitRoot(cwd)), realpathSync(path))) {
     throw new Error("lint proof signing key must live outside the Git working tree");
@@ -11566,7 +11768,7 @@ var DEFAULT_PROOF_LOCATION = ".absolutejs/lint-proof.json", PROOF_CONTRACT_VERSI
   }
   return key;
 }, readEd25519PublicKey = (cwd, location) => {
-  const key = createPublicKey(readFileSync18(resolve24(cwd, location)));
+  const key = createPublicKey2(readFileSync18(resolve24(cwd, location)));
   if (key.asymmetricKeyType !== "ed25519") {
     throw new Error("trusted lint proof key must be an Ed25519 public key");
   }
@@ -11649,7 +11851,7 @@ var DEFAULT_PROOF_LOCATION = ".absolutejs/lint-proof.json", PROOF_CONTRACT_VERSI
   } finally {
     rmSync5(temporaryDirectory, { force: true, recursive: true });
   }
-}, proofFingerprint = (cwd) => createHash12("sha256").update(`absolute-lint-proof:${PROOF_CONTRACT_VERSION}\x00`).update(createEslintCacheFingerprint(cwd)).update("\x00").update(createEslintConfigDigest(cwd)).digest("hex"), createLintProof = (command, options = {}) => {
+}, proofFingerprint = (cwd) => createHash13("sha256").update(`absolute-lint-proof:${PROOF_CONTRACT_VERSION}\x00`).update(createEslintCacheFingerprint(cwd)).update("\x00").update(createEslintConfigDigest(cwd)).digest("hex"), createLintProof = (command, options = {}) => {
   const cwd = options.cwd ?? process.cwd();
   const proofLocation = options.proofLocation ?? DEFAULT_PROOF_LOCATION;
   return {
@@ -11667,7 +11869,7 @@ var DEFAULT_PROOF_LOCATION = ".absolutejs/lint-proof.json", PROOF_CONTRACT_VERSI
   const proof = createLintProof(command, { cwd, proofLocation });
   if (options.signingKeyLocation) {
     const privateKey = readEd25519PrivateKey(cwd, options.signingKeyLocation);
-    const publicKey = createPublicKey(privateKey);
+    const publicKey = createPublicKey2(privateKey);
     proof.attestation = {
       algorithm: "ed25519",
       keyId: publicKeyId(publicKey),
@@ -13357,7 +13559,7 @@ var CONFIG_CANDIDATES2, RUNTIME_FIELDS, findConfigPath = (cwd, override) => {
     return { opaque: false, value: items };
   }
   if (ts7.isObjectLiteralExpression(node)) {
-    const object3 = {};
+    const object4 = {};
     for (const property of node.properties) {
       if (!ts7.isPropertyAssignment(property) || !(ts7.isIdentifier(property.name) || ts7.isStringLiteral(property.name))) {
         return { opaque: true, value: undefined };
@@ -13365,18 +13567,18 @@ var CONFIG_CANDIDATES2, RUNTIME_FIELDS, findConfigPath = (cwd, override) => {
       const result = evalLiteral(property.initializer);
       if (result.opaque)
         return { opaque: true, value: undefined };
-      object3[property.name.text] = result.value;
+      object4[property.name.text] = result.value;
     }
-    return { opaque: false, value: object3 };
+    return { opaque: false, value: object4 };
   }
   return { opaque: true, value: undefined };
 }, readCurrent = (configPath2) => {
   const current = {};
   const opaqueKeys = [];
-  const { object: object3 } = parseConfigObject(configPath2);
-  if (!object3)
+  const { object: object4 } = parseConfigObject(configPath2);
+  if (!object4)
     return { current, opaqueKeys };
-  for (const property of object3.properties) {
+  for (const property of object4.properties) {
     if (!ts7.isPropertyAssignment(property) || !(ts7.isIdentifier(property.name) || ts7.isStringLiteral(property.name))) {
       continue;
     }
@@ -14094,8 +14296,8 @@ export const navData: NavItem[] = [];
   };
   visit(sourceFile);
   return found;
-}, readStringProperty = (object3, name) => {
-  const property = object3.properties.find((candidate) => ts10.isPropertyAssignment(candidate) && ts10.isIdentifier(candidate.name) && candidate.name.text === name);
+}, readStringProperty = (object4, name) => {
+  const property = object4.properties.find((candidate) => ts10.isPropertyAssignment(candidate) && ts10.isIdentifier(candidate.name) && candidate.name.text === name);
   if (!property || !ts10.isStringLiteralLike(property.initializer)) {
     return null;
   }
@@ -14558,18 +14760,18 @@ var lineStartOffset = (text2, position) => {
 `)
     index -= 1;
   return index;
-}, indentBefore2 = (text2, position) => text2.slice(lineStartOffset(text2, position), position), findProperty = (object3, name) => object3.properties.find((property) => ts11.isPropertyAssignment(property) && (ts11.isIdentifier(property.name) || ts11.isStringLiteral(property.name)) && property.name.text === name), applyAbsoluteConfigEdit = (configPath2, request) => {
+}, indentBefore2 = (text2, position) => text2.slice(lineStartOffset(text2, position), position), findProperty = (object4, name) => object4.properties.find((property) => ts11.isPropertyAssignment(property) && (ts11.isIdentifier(property.name) || ts11.isStringLiteral(property.name)) && property.name.text === name), applyAbsoluteConfigEdit = (configPath2, request) => {
   try {
     const text2 = readFileSync26(configPath2, "utf-8");
     const sourceFile = ts11.createSourceFile(configPath2, text2, ts11.ScriptTarget.Latest, true);
-    const object3 = findConfigObject(sourceFile);
-    if (!object3) {
+    const object4 = findConfigObject(sourceFile);
+    if (!object4) {
       return {
         message: "Could not find defineConfig({ ... }) in the config file.",
         ok: false
       };
     }
-    const existing = findProperty(object3, request.name);
+    const existing = findProperty(object4, request.name);
     if (request.remove) {
       if (!existing)
         return { message: `${request.name} is not set`, ok: true };
@@ -14590,7 +14792,7 @@ var lineStartOffset = (text2, position) => {
       writeFileSync14(configPath2, text2.slice(0, start2) + valueText + text2.slice(end), "utf-8");
       return { message: `Updated ${request.name}`, ok: true };
     }
-    const { properties } = object3;
+    const { properties } = object4;
     const entry = `${request.name}: ${valueText}`;
     if (properties.length > 0) {
       const last = properties[properties.length - 1];
@@ -14609,11 +14811,11 @@ var lineStartOffset = (text2, position) => {
 ${indent}${entry}`;
       writeFileSync14(configPath2, text2.slice(0, insertionIndex) + insertion + text2.slice(insertionIndex), "utf-8");
     } else {
-      const insertionIndex = object3.getStart(sourceFile) + 1;
-      const indent = `${indentBefore2(text2, object3.getStart(sourceFile))}	`;
+      const insertionIndex = object4.getStart(sourceFile) + 1;
+      const indent = `${indentBefore2(text2, object4.getStart(sourceFile))}	`;
       const insertion = `
 ${indent}${entry}
-${indentBefore2(text2, object3.getStart(sourceFile))}`;
+${indentBefore2(text2, object4.getStart(sourceFile))}`;
       writeFileSync14(configPath2, text2.slice(0, insertionIndex) + insertion + text2.slice(insertionIndex), "utf-8");
     }
     return { message: `Updated ${request.name}`, ok: true };
@@ -15309,10 +15511,10 @@ var AUTH_PACKAGE = "@absolutejs/auth", CONFIG_CANDIDATES3, findAuthSettingsPath
 }, readCurrent2 = (configPath2) => {
   const current = {};
   const opaqueKeys = [];
-  const { object: object3 } = parseAuthSettingsObject(configPath2);
-  if (!object3)
+  const { object: object4 } = parseAuthSettingsObject(configPath2);
+  if (!object4)
     return { current, opaqueKeys };
-  for (const property of object3.properties) {
+  for (const property of object4.properties) {
     if (!ts12.isPropertyAssignment(property) || !(ts12.isIdentifier(property.name) || ts12.isStringLiteral(property.name))) {
       continue;
     }
@@ -15425,11 +15627,11 @@ var AUTH_PACKAGE2 = "@absolutejs/auth", REPO_URL = "https://github.com/absolutej
     return null;
   }
   return property.initializer.properties.length;
-}, readConfigKeys = (object3) => {
+}, readConfigKeys = (object4) => {
   const keys = new Set;
   let providerCount = null;
-  const usesSpread = object3.properties.some((property) => ts13.isSpreadAssignment(property));
-  for (const property of object3.properties) {
+  const usesSpread = object4.properties.some((property) => ts13.isSpreadAssignment(property));
+  for (const property of object4.properties) {
     const { name } = property;
     if (name === undefined || !ts13.isIdentifier(name))
       continue;
@@ -19461,14 +19663,72 @@ var init_nativeBackgroundSync = __esm(() => {
   init_nativeAuth();
 });
 
+// src/mobile/nativeUpdates.ts
+import { readFile as readFile16, rename as rename12, writeFile as writeFile13 } from "fs/promises";
+import { join as join51 } from "path";
+var START = "// absolutejs:mobile-updates:start", END = "// absolutejs:mobile-updates:end", writeChanged2 = async (path, source) => {
+  const current = await readFile16(path, "utf8");
+  if (current === source)
+    return false;
+  const temporary = `${path}.${crypto.randomUUID()}.tmp`;
+  await writeFile13(temporary, source, { flag: "wx" });
+  await rename12(temporary, path);
+  return true;
+}, replaceRegion2 = (source, region) => {
+  const start2 = source.indexOf(START);
+  const end = source.indexOf(END);
+  if (start2 < 0 !== end < 0 || end < start2)
+    throw new TypeError("AbsoluteJS mobile update markers are malformed.");
+  if (start2 >= 0) {
+    const from = source.lastIndexOf(`
+`, start2) + 1;
+    const newline = source.indexOf(`
+`, end + END.length);
+    return `${source.slice(0, from)}${region}${source.slice(newline < 0 ? source.length : newline + 1)}`;
+  }
+  if (!region)
+    return source;
+  const launch = source.indexOf("didFinishLaunchingWithOptions");
+  const brace = launch < 0 ? -1 : source.indexOf("{", launch);
+  const insert = brace < 0 ? -1 : source.indexOf(`
+`, brace) + 1;
+  if (insert <= 0)
+    throw new TypeError("Could not find a safe iOS location for mobile update recovery.");
+  return `${source.slice(0, insert)}${region}${source.slice(insert)}`;
+}, iosRecoveryRegion, applyAbsoluteNativeUpdates = async (config, platforms = config.platforms) => {
+  if (config.engine !== "capacitor" || !platforms.includes("ios"))
+    return { changed: false };
+  const path = join51(config.nativeProjectDirectory, "ios/App/App/AppDelegate.swift");
+  const source = await readFile16(path, "utf8");
+  const updated = replaceRegion2(source, config.updates ? iosRecoveryRegion : "");
+  return { changed: await writeChanged2(path, updated) };
+};
+var init_nativeUpdates = __esm(() => {
+  iosRecoveryRegion = `        ${START}
+        // A confirmed Capacitor snapshot lives in Library/NoCloud and is not
+        // restored during device migration. Clear only a dangling pointer so
+        // Capacitor falls back to the store-signed embedded bundle.
+        if let persisted = UserDefaults.standard.string(forKey: "serverBasePath"), !persisted.isEmpty,
+           let library = FileManager.default.urls(for: .libraryDirectory, in: .userDomainMask).first {
+            let snapshot = library
+                .appendingPathComponent("NoCloud/ionic_built_snapshots", isDirectory: true)
+                .appendingPathComponent(URL(fileURLWithPath: persisted).lastPathComponent, isDirectory: true)
+            if !FileManager.default.fileExists(atPath: snapshot.path) {
+                UserDefaults.standard.removeObject(forKey: "serverBasePath")
+            }
+        }
+        ${END}
+`;
+});
+
 // src/mobile/associationFiles.ts
 import {
   access as access9,
   mkdir as mkdir11,
-  readFile as readFile16,
-  rename as rename12,
+  readFile as readFile17,
+  rename as rename13,
   rm as rm9,
-  writeFile as writeFile13
+  writeFile as writeFile14
 } from "fs/promises";
 import { resolve as resolve37 } from "path";
 import { Elysia } from "elysia";
@@ -19523,7 +19783,7 @@ var OWNERSHIP_FILE = ".absolutejs-mobile-associations.json", HTTP_OK = 200, VERI
 }, writeAtomic = async (path, source) => {
   let current;
   try {
-    current = await readFile16(path, "utf8");
+    current = await readFile17(path, "utf8");
   } catch (error) {
     if (!(error instanceof Error) || !("code" in error) || error.code !== "ENOENT") {
       throw error;
@@ -19532,8 +19792,8 @@ var OWNERSHIP_FILE = ".absolutejs-mobile-associations.json", HTTP_OK = 200, VERI
   if (current === source)
     return false;
   const temporary = `${path}.${crypto.randomUUID()}.tmp`;
-  await writeFile13(temporary, source, { flag: "wx" });
-  await rename12(temporary, path);
+  await writeFile14(temporary, source, { flag: "wx" });
+  await rename13(temporary, path);
   return true;
 }, exists3 = async (path) => {
   try {
@@ -19546,7 +19806,7 @@ var OWNERSHIP_FILE = ".absolutejs-mobile-associations.json", HTTP_OK = 200, VERI
   const path = resolve37(root, OWNERSHIP_FILE);
   let ownership;
   try {
-    ownership = JSON.parse(await readFile16(path, "utf8"));
+    ownership = JSON.parse(await readFile17(path, "utf8"));
   } catch {
     throw new TypeError(`Association output ${root} already exists and is not owned by AbsoluteJS.`);
   }
@@ -19559,12 +19819,12 @@ var OWNERSHIP_FILE = ".absolutejs-mobile-associations.json", HTTP_OK = 200, VERI
     await assertOwnedOutput(root);
   const backup = `${root}.${crypto.randomUUID()}.previous`;
   if (hasCurrent)
-    await rename12(root, backup);
+    await rename13(root, backup);
   try {
-    await rename12(temporary, root);
+    await rename13(temporary, root);
   } catch (error) {
     if (hasCurrent)
-      await rename12(backup, root);
+      await rename13(backup, root);
     throw error;
   }
   if (hasCurrent)
@@ -19654,7 +19914,7 @@ var init_associationFiles = __esm(() => {
 });
 
 // src/mobile/androidWebView.ts
-import { mkdir as mkdir12, writeFile as writeFile14 } from "fs/promises";
+import { mkdir as mkdir12, writeFile as writeFile15 } from "fs/promises";
 import { dirname as dirname29, resolve as resolve38 } from "path";
 
 class CdpConnection {
@@ -19930,7 +20190,7 @@ var CDP_COMMAND_TIMEOUT_MS = 1e4, WEBVIEW_ATTACH_TIMEOUT_MS = 30000, WEBVIEW_POL
       }
       const absolutePath = resolve38(path);
       await mkdir12(dirname29(absolutePath), { recursive: true });
-      await writeFile14(absolutePath, Buffer.from(data, "base64"));
+      await writeFile15(absolutePath, Buffer.from(data, "base64"));
       return absolutePath;
     },
     tap: async (coordinateX, coordinateY) => {
@@ -20061,9 +20321,9 @@ var DEFAULT_ROUTE_TIMEOUT_MS = 30000, DEFAULT_HMR_TIMEOUT_MS = 30000, routeExpre
 };
 
 // src/mobile/mobileBundleInspection.ts
-import { createHash as createHash13 } from "crypto";
-import { access as access10, readFile as readFile17, stat as stat2 } from "fs/promises";
-import { join as join51, relative as relative25, resolve as resolve39 } from "path";
+import { createHash as createHash14 } from "crypto";
+import { access as access10, readFile as readFile18, stat as stat2 } from "fs/promises";
+import { join as join52, relative as relative25, resolve as resolve39 } from "path";
 var MOBILE_FRAMEWORKS, SHA256_PATTERN, isObject2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), portablePath = (projectRoot, path) => {
   const value = relative25(resolve39(projectRoot), resolve39(path)).replaceAll("\\", "/");
   return value || ".";
@@ -20075,7 +20335,7 @@ var MOBILE_FRAMEWORKS, SHA256_PATTERN, isObject2 = (value) => typeof value === "
     return false;
   }
 }, readObject = async (path) => {
-  const value = JSON.parse(await readFile17(path, "utf8"));
+  const value = JSON.parse(await readFile18(path, "utf8"));
   if (!isObject2(value))
     throw new TypeError("JSON root must be an object.");
   return value;
@@ -20100,13 +20360,13 @@ var MOBILE_FRAMEWORKS, SHA256_PATTERN, isObject2 = (value) => typeof value === "
   if (expectedHash !== undefined) {
     if (!SHA256_PATTERN.test(expectedHash))
       throw new TypeError(`${field} has an invalid SHA-256 digest.`);
-    const actual = createHash13("sha256").update(await readFile17(path)).digest("hex");
+    const actual = createHash14("sha256").update(await readFile18(path)).digest("hex");
     if (actual !== expectedHash)
       throw new TypeError(`${field} failed its SHA-256 integrity check.`);
   }
   return portable;
 }, inspectAbsoluteMobileBundle = async (config, projectRoot) => {
-  const manifestPath = join51(config.bundleDirectory, "absolute-mobile-manifest.json");
+  const manifestPath = join52(config.bundleDirectory, "absolute-mobile-manifest.json");
   const manifest = portablePath(projectRoot, manifestPath);
   if (!await pathExists5(manifestPath))
     return { manifest, status: "missing" };
@@ -20120,9 +20380,14 @@ var MOBILE_FRAMEWORKS, SHA256_PATTERN, isObject2 = (value) => typeof value === "
       throw new TypeError("productionOrigin does not match the effective mobile config.");
     const appBuild = requireString(value.appBuild, "appBuild");
     const runtime = requireString(value.runtime, "runtime");
+    const nativeRuntime = requireString(value.nativeRuntime, "nativeRuntime");
+    if (!SHA256_PATTERN.test(nativeRuntime))
+      throw new TypeError("nativeRuntime must be a SHA-256 fingerprint.");
     if (runtime !== String(ABSOLUTE_MOBILE_PAGE_PROTOCOL_VERSION))
       throw new TypeError("runtime is not supported by this AbsoluteJS build.");
     const capabilities = requireStringArray(value.deviceCapabilities, "deviceCapabilities").sort();
+    if (JSON.stringify(value.updates ?? null) !== JSON.stringify(config.updates ?? null))
+      throw new TypeError("Embedded update trust configuration does not match mobile config.");
     if (!Array.isArray(value.pages) || !Array.isArray(value.routes))
       throw new TypeError("pages and routes must be arrays.");
     const pageIds = new Set;
@@ -20175,11 +20440,13 @@ var MOBILE_FRAMEWORKS, SHA256_PATTERN, isObject2 = (value) => typeof value === "
       entryResolved,
       frameworks: [...frameworks7].sort(),
       manifest,
+      nativeRuntime,
       pageCount: value.pages.length,
       routeCount: value.routes.length,
       runtime,
       status: "valid",
-      sync: isObject2(value.sync)
+      sync: isObject2(value.sync),
+      updates: isObject2(value.updates)
     };
   } catch (error) {
     return {
@@ -20206,8 +20473,8 @@ var init_mobileBundleInspection = __esm(() => {
 });
 
 // src/mobile/releaseDoctor.ts
-import { access as access11, readFile as readFile18, readdir as readdir5 } from "fs/promises";
-import { dirname as dirname30, extname as extname8, join as join52, relative as relative26 } from "path";
+import { access as access11, readFile as readFile19, readdir as readdir5 } from "fs/promises";
+import { dirname as dirname30, extname as extname8, join as join53, relative as relative26 } from "path";
 var ABSOLUTE_MOBILE_COMPLIANCE_REPORT_FORMAT = 1, HMR_ASSET_PATTERN, RELEASE_ASSET_EXTENSIONS, EXACT_VERSION_PATTERN, NOT_FOUND3 = -1, LOCK_FILES, MANUAL_REVIEW, pathExists6 = async (path) => {
   try {
     await access11(path);
@@ -20220,13 +20487,13 @@ var ABSOLUTE_MOBILE_COMPLIANCE_REPORT_FORMAT = 1, HMR_ASSET_PATTERN, RELEASE_ASS
     return findHmrAsset(path);
   if (!isFile2 || !RELEASE_ASSET_EXTENSIONS.has(extname8(path)))
     return;
-  const source = await readFile18(path, "utf8");
+  const source = await readFile19(path, "utf8");
   return HMR_ASSET_PATTERN.test(source) ? path : undefined;
 }, findHmrAsset = async (root) => {
   if (!await pathExists6(root))
     return;
   const entries = await readdir5(root, { withFileTypes: true });
-  const matches = await Promise.all(entries.map((entry) => inspectReleaseAsset(join52(root, entry.name), entry.isDirectory(), entry.isFile())));
+  const matches = await Promise.all(entries.map((entry) => inspectReleaseAsset(join53(root, entry.name), entry.isDirectory(), entry.isFile())));
   return matches.find((match) => match !== undefined);
 }, pass = (id, detail, path) => ({ detail, id, path, status: "pass" }), fail5 = (id, detail, path, remediation) => ({
   detail,
@@ -20241,7 +20508,7 @@ var ABSOLUTE_MOBILE_COMPLIANCE_REPORT_FORMAT = 1, HMR_ASSET_PATTERN, RELEASE_ASS
   remediation,
   status: "warn"
 }), isRecord14 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), readJsonObject = async (path) => {
-  const value = JSON.parse(await readFile18(path, "utf8"));
+  const value = JSON.parse(await readFile19(path, "utf8"));
   if (typeof value !== "object" || value === null || Array.isArray(value))
     throw new TypeError("JSON root must be an object.");
   return Object.fromEntries(Object.entries(value));
@@ -20257,7 +20524,7 @@ var ABSOLUTE_MOBILE_COMPLIANCE_REPORT_FORMAT = 1, HMR_ASSET_PATTERN, RELEASE_ASS
   }
   return declarations;
 }, versionCore = (version2) => version2.split("-")[0]?.split(".").slice(0, 2).join("."), capacitorVersionCheck = async (config, projectRoot) => {
-  const manifestPath = join52(projectRoot, "package.json");
+  const manifestPath = join53(projectRoot, "package.json");
   try {
     const manifest = await readJsonObject(manifestPath);
     const declarations = packageDeclarations(manifest);
@@ -20270,7 +20537,7 @@ var ABSOLUTE_MOBILE_COMPLIANCE_REPORT_FORMAT = 1, HMR_ASSET_PATTERN, RELEASE_ASS
       const declared = declarations.get(name);
       if (!declared || !EXACT_VERSION_PATTERN.test(declared))
         throw new TypeError(`${name} must be a direct exact dependency.`);
-      const installed = await readJsonObject(join52(projectRoot, "node_modules", name, "package.json"));
+      const installed = await readJsonObject(join53(projectRoot, "node_modules", name, "package.json"));
       if (installed.version !== declared)
         throw new TypeError(`${name} does not match its installed version.`);
       return declared;
@@ -20291,7 +20558,7 @@ var ABSOLUTE_MOBILE_COMPLIANCE_REPORT_FORMAT = 1, HMR_ASSET_PATTERN, RELEASE_ASS
   const actual = installed.split(".").map(Number);
   return actual[0] === expected[0] && actual[1] === expected[1] && (actual[2] ?? NOT_FOUND3) >= (expected[2] ?? 0);
 }, expoVersionCheck = async (config) => {
-  const manifestPath = join52(config.nativeProjectDirectory, "package.json");
+  const manifestPath = join53(config.nativeProjectDirectory, "package.json");
   try {
     const manifest = await readJsonObject(manifestPath);
     const declarations = packageDeclarations(manifest);
@@ -20301,13 +20568,13 @@ var ABSOLUTE_MOBILE_COMPLIANCE_REPORT_FORMAT = 1, HMR_ASSET_PATTERN, RELEASE_ASS
       throw new TypeError(`Generated Expo project is missing ${missingRequired}.`);
     const installedVersions = await Promise.all([...declarations].map(async ([name, declared]) => ({
       declared,
-      installed: await readJsonObject(join52(config.nativeProjectDirectory, "node_modules", name, "package.json")),
+      installed: await readJsonObject(join53(config.nativeProjectDirectory, "node_modules", name, "package.json")),
       name
     })));
     const mismatch = installedVersions.find(({ declared, installed }) => typeof installed.version !== "string" || !satisfiesGeneratedVersion(declared, installed.version));
     if (mismatch)
       throw new TypeError(`Generated Expo dependency ${mismatch.name}@${mismatch.declared} does not match its installed version.`);
-    if (!await pathExists6(join52(config.nativeProjectDirectory, "bun.lock")))
+    if (!await pathExists6(join53(config.nativeProjectDirectory, "bun.lock")))
       throw new TypeError("Generated Expo dependency lockfile is missing.");
     return pass("mobile.expo-versions", `Generated Expo SDK dependencies are pinned, installed, and locked (${declarations.get("expo")}).`, manifestPath);
   } catch (error) {
@@ -20315,10 +20582,10 @@ var ABSOLUTE_MOBILE_COMPLIANCE_REPORT_FORMAT = 1, HMR_ASSET_PATTERN, RELEASE_ASS
   }
 }, dependencyLockCheck = async (projectRoot) => {
   const present = (await Promise.all(LOCK_FILES.map(async (name) => ({
-    exists: await pathExists6(join52(projectRoot, name)),
+    exists: await pathExists6(join53(projectRoot, name)),
     name
   })))).find(({ exists: exists4 }) => exists4);
-  return present ? pass("mobile.dependency-lock", `Dependency graph is locked by ${present.name}.`, join52(projectRoot, present.name)) : fail5("mobile.dependency-lock", "No supported dependency lockfile is present.", projectRoot, "Install dependencies with the project package manager and commit its lockfile before release.");
+  return present ? pass("mobile.dependency-lock", `Dependency graph is locked by ${present.name}.`, join53(projectRoot, present.name)) : fail5("mobile.dependency-lock", "No supported dependency lockfile is present.", projectRoot, "Install dependencies with the project package manager and commit its lockfile before release.");
 }, productionOriginCheck = (config, projectRoot) => {
   const origin = new URL(config.productionOrigin);
   return origin.protocol === "https:" ? pass("mobile.production-origin", "Production transport uses an HTTPS origin.") : fail5("mobile.production-origin", "A loopback development origin cannot be used for a signed release.", projectRoot, "Configure mobile.server.productionOrigin with the deployed HTTPS origin.");
@@ -20353,7 +20620,7 @@ var ABSOLUTE_MOBILE_COMPLIANCE_REPORT_FORMAT = 1, HMR_ASSET_PATTERN, RELEASE_ASS
   if (!await pathExists6(nativeConfigPath)) {
     return fail5("android.capacitor-config", "The generated Android Capacitor config is missing.", nativeConfigPath, "Run `absolute mobile sync android` before release validation.");
   }
-  const unsafe = isUnsafeCapacitorConfig(await readFile18(nativeConfigPath, "utf8"));
+  const unsafe = isUnsafeCapacitorConfig(await readFile19(nativeConfigPath, "utf8"));
   return unsafe ? fail5("android.capacitor-config", "Android Capacitor config contains a development server URL, cleartext transport, navigation allowlist, or invalid JSON.", nativeConfigPath, "Run `absolute mobile sync android`; do not ship development transport overrides.") : pass("android.capacitor-config", "Android Capacitor config contains no development transport overrides.", nativeConfigPath);
 }, capacitorIdentityCheck = async (config, platform6, nativeConfigPath) => {
   try {
@@ -20368,12 +20635,12 @@ var ABSOLUTE_MOBILE_COMPLIANCE_REPORT_FORMAT = 1, HMR_ASSET_PATTERN, RELEASE_ASS
   if (!await pathExists6(manifestPath)) {
     return fail5("android.cleartext", "The Android manifest is missing.", manifestPath, "Run `absolute mobile sync android` before release validation.");
   }
-  const source = await readFile18(manifestPath, "utf8");
+  const source = await readFile19(manifestPath, "utf8");
   const cleartext = /android:usesCleartextTraffic=["']true["']/u.test(source);
   const networkConfigName = source.match(/android:networkSecurityConfig=["']@xml\/([a-z0-9_]+)["']/u)?.[1];
-  const networkConfigPath = networkConfigName ? join52(dirname30(manifestPath), "res", "xml", `${networkConfigName}.xml`) : undefined;
+  const networkConfigPath = networkConfigName ? join53(dirname30(manifestPath), "res", "xml", `${networkConfigName}.xml`) : undefined;
   const developmentTrustReference = /android:networkSecurityConfig=["']@xml\/absolutejs_dev_network_security["']/u.test(source);
-  const developmentTrustContents = networkConfigPath ? await readFile18(networkConfigPath, "utf8").then((value) => value.includes("@raw/absolutejs_dev_ca")).catch(() => false) : false;
+  const developmentTrustContents = networkConfigPath ? await readFile19(networkConfigPath, "utf8").then((value) => value.includes("@raw/absolutejs_dev_ca")).catch(() => false) : false;
   const developmentTrust = developmentTrustReference || developmentTrustContents;
   return cleartext || developmentTrust ? fail5("android.cleartext", developmentTrust ? "Android still references the AbsoluteJS development certificate authority." : "Android explicitly permits cleartext traffic.", manifestPath, "Run `absolute mobile sync android`; do not ship development transport or trust overrides.") : pass("android.cleartext", "Android does not explicitly permit cleartext traffic.", manifestPath);
 }, hmrAssetsReleaseCheck = async (publicRoot) => {
@@ -20382,12 +20649,12 @@ var ABSOLUTE_MOBILE_COMPLIANCE_REPORT_FORMAT = 1, HMR_ASSET_PATTERN, RELEASE_ASS
 }, embeddedBundleReleaseCheck = async (config, projectRoot, platform6, publicRoot) => {
   const inspection = await inspectAbsoluteMobileBundle({ ...config, bundleDirectory: publicRoot }, projectRoot);
   if (inspection.status === "valid")
-    return pass(`${platform6}.bundle-integrity`, `Packaged mobile manifest, runtime, routes, and ${inspection.pageCount ?? 0} page asset(s) passed structural and SHA-256 validation.`, join52(publicRoot, "absolute-mobile-manifest.json"));
-  return fail5(`${platform6}.bundle-integrity`, inspection.status === "missing" ? "The packaged mobile manifest is missing." : `The packaged mobile bundle is invalid: ${inspection.issue ?? "unknown validation error"}`, join52(publicRoot, "absolute-mobile-manifest.json"), "Rebuild the production mobile bundle and run Capacitor sync for this platform.");
+    return pass(`${platform6}.bundle-integrity`, `Packaged mobile manifest, runtime, routes, and ${inspection.pageCount ?? 0} page asset(s) passed structural and SHA-256 validation.`, join53(publicRoot, "absolute-mobile-manifest.json"));
+  return fail5(`${platform6}.bundle-integrity`, inspection.status === "missing" ? "The packaged mobile manifest is missing." : `The packaged mobile bundle is invalid: ${inspection.issue ?? "unknown validation error"}`, join53(publicRoot, "absolute-mobile-manifest.json"), "Rebuild the production mobile bundle and run Capacitor sync for this platform.");
 }, contentSecurityPolicyCheck = async (config, platform6, publicRoot) => {
-  const path = join52(publicRoot, "index.html");
+  const path = join53(publicRoot, "index.html");
   try {
-    const source = await readFile18(path, "utf8");
+    const source = await readFile19(path, "utf8");
     const requirements = [
       "Content-Security-Policy",
       "default-src 'self'",
@@ -20405,7 +20672,7 @@ var ABSOLUTE_MOBILE_COMPLIANCE_REPORT_FORMAT = 1, HMR_ASSET_PATTERN, RELEASE_ASS
     return fail5(`${platform6}.content-security-policy`, error instanceof Error ? error.message : "Packaged shell CSP could not be validated.", path, "Rebuild the production mobile bundle with the AbsoluteJS-generated shell.");
   }
 }, expoApplicationConfigCheck = async (config) => {
-  const path = join52(config.nativeProjectDirectory, "app.json");
+  const path = join53(config.nativeProjectDirectory, "app.json");
   try {
     const root = await readJsonObject(path);
     if (!isRecord14(root.expo))
@@ -20425,12 +20692,12 @@ var ABSOLUTE_MOBILE_COMPLIANCE_REPORT_FORMAT = 1, HMR_ASSET_PATTERN, RELEASE_ASS
     return fail5("expo.app-config", error instanceof Error ? error.message : "Generated Expo application config could not be validated.", path, "Run `absolute mobile build <platform>`; do not edit the generated Expo project.");
   }
 }, expoEmbeddedAssetsCheck = async (config) => {
-  const generated = join52(config.nativeProjectDirectory, "src", "generated", "webAssets.ts");
-  const assetsRoot = join52(config.nativeProjectDirectory, "assets", "absolute");
+  const generated = join53(config.nativeProjectDirectory, "src", "generated", "webAssets.ts");
+  const assetsRoot = join53(config.nativeProjectDirectory, "assets", "absolute");
   try {
     const [source, manifest] = await Promise.all([
-      readFile18(generated, "utf8"),
-      readJsonObject(join52(config.bundleDirectory, "absolute-mobile-manifest.json"))
+      readFile19(generated, "utf8"),
+      readJsonObject(join53(config.bundleDirectory, "absolute-mobile-manifest.json"))
     ]);
     if (source.includes("embedded AbsoluteJS bundle is unavailable") || typeof manifest.appBuild !== "string" || !source.includes(JSON.stringify(manifest.appBuild)) || !source.includes(JSON.stringify(config.productionOrigin))) {
       throw new TypeError("Generated Expo assets do not contain the prepared production release identity.");
@@ -20450,8 +20717,8 @@ var ABSOLUTE_MOBILE_COMPLIANCE_REPORT_FORMAT = 1, HMR_ASSET_PATTERN, RELEASE_ASS
       if (!embedded)
         return false;
       const [left, right] = await Promise.all([
-        readFile18(join52(config.bundleDirectory, path)),
-        readFile18(join52(assetsRoot, embedded))
+        readFile19(join53(config.bundleDirectory, path)),
+        readFile19(join53(assetsRoot, embedded))
       ]);
       return left.equals(right);
     }));
@@ -20465,18 +20732,18 @@ var ABSOLUTE_MOBILE_COMPLIANCE_REPORT_FORMAT = 1, HMR_ASSET_PATTERN, RELEASE_ASS
   if (!await pathExists6(root))
     return [];
   const files = await Array.fromAsync(new Bun.Glob("**/*").scan({ cwd: root, onlyFiles: true }));
-  return files.filter((file) => extensions.has(extname8(file))).map((file) => join52(root, file));
+  return files.filter((file) => extensions.has(extname8(file))).map((file) => join53(root, file));
 }, containsPattern = async (paths, pattern) => {
-  const sources = await Promise.all(paths.map((path) => readFile18(path, "utf8")));
+  const sources = await Promise.all(paths.map((path) => readFile19(path, "utf8")));
   const index = sources.findIndex((source) => pattern.test(source));
   return index === NOT_FOUND3 ? undefined : paths[index];
 }, androidNativeSecurityCheck = async (androidRoot) => {
-  const manifestPath = join52(androidRoot, "app/src/main/AndroidManifest.xml");
+  const manifestPath = join53(androidRoot, "app/src/main/AndroidManifest.xml");
   try {
-    const manifest = await readFile18(manifestPath, "utf8");
+    const manifest = await readFile19(manifestPath, "utf8");
     if (/android:debuggable=["']true["']/u.test(manifest))
       throw new TypeError("Android release manifest explicitly enables application debugging.");
-    const sources = await sourceFiles(join52(androidRoot, "app/src/main"), new Set([".java", ".kt"]));
+    const sources = await sourceFiles(join53(androidRoot, "app/src/main"), new Set([".java", ".kt"]));
     const debugSource = await containsPattern(sources, /setWebContentsDebuggingEnabled\s*\(\s*true\s*\)/u);
     if (debugSource)
       return fail5("android.native-debugging", "Android application source unconditionally enables WebView debugging.", debugSource, "Remove the unconditional WebView debugging call; use the platform debug-build behavior during development.");
@@ -20485,14 +20752,14 @@ var ABSOLUTE_MOBILE_COMPLIANCE_REPORT_FORMAT = 1, HMR_ASSET_PATTERN, RELEASE_ASS
     return fail5("android.native-debugging", error instanceof Error ? error.message : "Android native debugging configuration could not be validated.", manifestPath, "Remove explicit release debugging settings and rerun mobile sync.");
   }
 }, androidExportedComponentsCheck = async (manifestPath) => {
-  const source = await readFile18(manifestPath, "utf8").catch(() => "");
+  const source = await readFile19(manifestPath, "utf8").catch(() => "");
   const exported = [
     ...source.matchAll(/<(?:activity|activity-alias|provider|receiver|service)\b[^>]*>/giu)
   ].map(([tag]) => tag).filter((tag) => /android:exported=["']true["']/iu.test(tag)).map((tag) => tag.match(/android:name=["']([^"']+)["']/iu)?.[1]).filter((name) => Boolean(name) && name !== ".MainActivity");
   return exported.length === 0 ? pass("android.exported-components", "No non-launcher Android component is explicitly exported.", manifestPath) : warn("android.exported-components", `${exported.length} non-launcher Android component(s) are exported and require manual authorization review.`, manifestPath, "Confirm each exported component is intentional, permission-protected where appropriate, and documented in the mobile threat model review.");
 }, androidDeepLinkProjectionCheck = async (config, manifestPath) => {
   try {
-    const source = await readFile18(manifestPath, "utf8");
+    const source = await readFile19(manifestPath, "utf8");
     const hasWebHost = (host2) => [...source.matchAll(/<data\b[^>]*>/giu)].some(([tag]) => tag.includes('android:scheme="https"') && tag.includes(`android:host="${host2}"`));
     if (!source.includes('android:autoVerify="true"') || !source.includes("android.intent.category.BROWSABLE") || config.deepLinkHosts.some((host2) => !hasWebHost(host2)) || config.deepLinkScheme && !source.includes(`android:scheme="${config.deepLinkScheme}"`))
       throw new TypeError("Android App Link or custom-scheme projection does not match mobile config.");
@@ -20512,14 +20779,14 @@ var ABSOLUTE_MOBILE_COMPLIANCE_REPORT_FORMAT = 1, HMR_ASSET_PATTERN, RELEASE_ASS
     return fail5("ios.native-debugging", "iOS application source unconditionally enables WebView inspection.", debugSource, "Remove unconditional WebView inspection from release source.");
   return pass("ios.native-debugging", "iOS source does not enable release debugger attachment or WebView inspection.", entitlementPaths[0] ?? iosRoot);
 }, iosDeepLinkProjectionCheck = async (config, iosRoot) => {
-  const infoPath = join52(iosRoot, "App/App/Info.plist");
-  const entitlementsPath = join52(iosRoot, "App/AbsoluteJS.entitlements");
-  const projectPath = join52(iosRoot, "App/App.xcodeproj/project.pbxproj");
+  const infoPath = join53(iosRoot, "App/App/Info.plist");
+  const entitlementsPath = join53(iosRoot, "App/AbsoluteJS.entitlements");
+  const projectPath = join53(iosRoot, "App/App.xcodeproj/project.pbxproj");
   try {
     const [info2, entitlements, project] = await Promise.all([
-      readFile18(infoPath, "utf8"),
-      readFile18(entitlementsPath, "utf8"),
-      readFile18(projectPath, "utf8")
+      readFile19(infoPath, "utf8"),
+      readFile19(entitlementsPath, "utf8"),
+      readFile19(projectPath, "utf8")
     ]);
     if (config.deepLinkScheme && (!info2.includes("<key>CFBundleURLTypes</key>") || !info2.includes(`<string>${config.deepLinkScheme}</string>`)))
       throw new TypeError("iOS custom URL scheme does not match mobile config.");
@@ -20534,7 +20801,7 @@ var ABSOLUTE_MOBILE_COMPLIANCE_REPORT_FORMAT = 1, HMR_ASSET_PATTERN, RELEASE_ASS
 }, syncSchemaReleaseCheck = (projectRoot) => {
   if (!projectUsesAbsoluteSync(projectRoot))
     return;
-  const manifestPath = join52(projectRoot, "package.json");
+  const manifestPath = join53(projectRoot, "package.json");
   try {
     const schema = discoverAbsoluteSyncSchema(projectRoot);
     const versions = schema.components.map((component2) => `${component2.id}@${component2.version}`).join(", ");
@@ -20556,8 +20823,8 @@ var ABSOLUTE_MOBILE_COMPLIANCE_REPORT_FORMAT = 1, HMR_ASSET_PATTERN, RELEASE_ASS
 }, IOS_USAGE_KEYS, androidDevicePermissionCheck = async (config, permissions) => {
   if (!config.platforms.includes("android") || permissions.length === 0)
     return;
-  const path = join52(config.nativeProjectDirectory, "android/app/src/main/AndroidManifest.xml");
-  const source = await readFile18(path, "utf8");
+  const path = join53(config.nativeProjectDirectory, "android/app/src/main/AndroidManifest.xml");
+  const source = await readFile19(path, "utf8");
   const missing = permissions.filter((permission) => !source.includes(`android:name="${permission}"`) && !source.includes(`android:name='${permission}'`));
   if (missing.length === 0)
     return;
@@ -20565,9 +20832,9 @@ var ABSOLUTE_MOBILE_COMPLIANCE_REPORT_FORMAT = 1, HMR_ASSET_PATTERN, RELEASE_ASS
 }, iosDevicePermissionCheck = async (config, purposes) => {
   if (!config.platforms.includes("ios") || purposes.length === 0)
     return;
-  const iosRoot = join52(config.nativeProjectDirectory, "ios");
-  const path = config.engine === "expo" ? await uniqueExpoIosFile(iosRoot, "**/Info.plist", "Info.plist") : join52(iosRoot, "App/App/Info.plist");
-  const source = await readFile18(path, "utf8");
+  const iosRoot = join53(config.nativeProjectDirectory, "ios");
+  const path = config.engine === "expo" ? await uniqueExpoIosFile(iosRoot, "**/Info.plist", "Info.plist") : join53(iosRoot, "App/App/Info.plist");
+  const source = await readFile19(path, "utf8");
   const missing = purposes.filter((purpose) => !source.includes(`<key>${IOS_USAGE_KEYS[purpose]}</key>`));
   if (missing.length === 0)
     return;
@@ -20576,7 +20843,7 @@ var ABSOLUTE_MOBILE_COMPLIANCE_REPORT_FORMAT = 1, HMR_ASSET_PATTERN, RELEASE_ASS
   if (requirements.iosPrivacyAccessedApis.length === 0)
     return;
   const privacyPath = await uniqueExpoIosFile(iosRoot, "**/PrivacyInfo.xcprivacy", "privacy manifest");
-  const privacy = await readFile18(privacyPath, "utf8");
+  const privacy = await readFile19(privacyPath, "utf8");
   const missing = requirements.iosPrivacyAccessedApis.some(({ api, reasons }) => !privacy.includes(`<string>${api}</string>`) || reasons.some((reason) => !privacy.includes(`<string>${reason}</string>`)));
   if (!missing && project.includes(privacyPath.split(/[\\/]/u).at(-1) ?? ""))
     return;
@@ -20585,14 +20852,14 @@ var ABSOLUTE_MOBILE_COMPLIANCE_REPORT_FORMAT = 1, HMR_ASSET_PATTERN, RELEASE_ASS
   if (!requirements.iosPushNotifications)
     return;
   const entitlementsPath = await uniqueExpoIosFile(iosRoot, "**/*.entitlements", "entitlements");
-  const entitlements = await readFile18(entitlementsPath, "utf8");
+  const entitlements = await readFile19(entitlementsPath, "utf8");
   if (entitlements.includes("<key>aps-environment</key>"))
     return;
   return fail5("mobile.device-capabilities", "Expo iOS push entitlement does not match detected capabilities.", entitlementsPath, "Run `absolute mobile build ios` to regenerate native push integration.");
 }, expoIosCapabilityProjectionCheck = async (config, requirements) => {
-  const iosRoot = join52(config.nativeProjectDirectory, "ios");
+  const iosRoot = join53(config.nativeProjectDirectory, "ios");
   const projectPath = await uniqueExpoIosFile(iosRoot, "**/*.xcodeproj/project.pbxproj", "Xcode project");
-  const project = await readFile18(projectPath, "utf8");
+  const project = await readFile19(projectPath, "utf8");
   const privacy = await expoIosPrivacyCapabilityCheck(iosRoot, project, requirements);
   if (privacy)
     return privacy;
@@ -20602,41 +20869,41 @@ var ABSOLUTE_MOBILE_COMPLIANCE_REPORT_FORMAT = 1, HMR_ASSET_PATTERN, RELEASE_ASS
     return;
   if (config.engine === "expo")
     return expoIosCapabilityProjectionCheck(config, requirements);
-  const appRoot = join52(config.nativeProjectDirectory, "ios/App/App");
-  const infoPath = join52(appRoot, "Info.plist");
-  const info2 = await readFile18(infoPath, "utf8").catch(() => "");
+  const appRoot = join53(config.nativeProjectDirectory, "ios/App/App");
+  const infoPath = join53(appRoot, "Info.plist");
+  const info2 = await readFile19(infoPath, "utf8").catch(() => "");
   if (requirements.iosSystemBars && !/<key>UIViewControllerBasedStatusBarAppearance<\/key>\s*<true\s*\/>/u.test(info2))
     return fail5("mobile.device-capabilities", "iOS system-bar capability is missing its required view-controller setting.", infoPath, "Run `absolute mobile sync ios` to regenerate native capability settings.");
   if (requirements.iosPrivacyAccessedApis.length > 0) {
-    const privacyPath = join52(appRoot, "PrivacyInfo.xcprivacy");
-    const projectPath = join52(config.nativeProjectDirectory, "ios/App/App.xcodeproj/project.pbxproj");
+    const privacyPath = join53(appRoot, "PrivacyInfo.xcprivacy");
+    const projectPath = join53(config.nativeProjectDirectory, "ios/App/App.xcodeproj/project.pbxproj");
     const [privacy, project] = await Promise.all([
-      readFile18(privacyPath, "utf8").catch(() => ""),
-      readFile18(projectPath, "utf8").catch(() => "")
+      readFile19(privacyPath, "utf8").catch(() => ""),
+      readFile19(projectPath, "utf8").catch(() => "")
     ]);
     const missing = requirements.iosPrivacyAccessedApis.some(({ api, reasons }) => !privacy.includes(`<string>${api}</string>`) || reasons.some((reason) => !privacy.includes(`<string>${reason}</string>`)));
     if (missing || !project.includes("PrivacyInfo.xcprivacy in Resources"))
       return fail5("mobile.device-capabilities", "iOS privacy manifest or target membership does not match detected native capabilities.", privacyPath, "Run `absolute mobile sync ios` to regenerate and target PrivacyInfo.xcprivacy.");
   }
   if (requirements.iosPushNotifications) {
-    const entitlementsPath = join52(config.nativeProjectDirectory, "ios/App/AbsoluteJS.entitlements");
-    const delegatePath = join52(appRoot, "AppDelegate.swift");
+    const entitlementsPath = join53(config.nativeProjectDirectory, "ios/App/AbsoluteJS.entitlements");
+    const delegatePath = join53(appRoot, "AppDelegate.swift");
     const [entitlements, delegate] = await Promise.all([
-      readFile18(entitlementsPath, "utf8").catch(() => ""),
-      readFile18(delegatePath, "utf8").catch(() => "")
+      readFile19(entitlementsPath, "utf8").catch(() => ""),
+      readFile19(delegatePath, "utf8").catch(() => "")
     ]);
     if (!entitlements.includes("<key>aps-environment</key>") || !delegate.includes("capacitorDidRegisterForRemoteNotifications") || !delegate.includes("capacitorDidFailToRegisterForRemoteNotifications"))
       return fail5("mobile.device-capabilities", "iOS push entitlement or AppDelegate forwarding does not match detected capabilities.", entitlementsPath, "Run `absolute mobile sync ios` to regenerate native push integration.");
   }
   return;
 }, deviceCapabilityReleaseCheck = async (config, projectRoot) => {
-  const manifestPath = join52(projectRoot, "package.json");
+  const manifestPath = join53(projectRoot, "package.json");
   try {
     const plan = resolveAbsoluteDeviceCapabilityPlan(projectRoot, config.engine);
     const assertPackages = async () => {
       if (config.engine === "capacitor")
         return assertAbsoluteDeviceCapabilityPackages(projectRoot, plan);
-      const generated = await readJsonObject(join52(config.nativeProjectDirectory, "package.json"));
+      const generated = await readJsonObject(join53(config.nativeProjectDirectory, "package.json"));
       const declarations = packageDeclarations(generated);
       const missing = plan.requiredPackages.filter((spec) => {
         const separator = spec.lastIndexOf("@");
@@ -20662,11 +20929,11 @@ var ABSOLUTE_MOBILE_COMPLIANCE_REPORT_FORMAT = 1, HMR_ASSET_PATTERN, RELEASE_ASS
     return fail5("mobile.device-capabilities", error instanceof Error ? error.message : "Native device capability provisioning is invalid.", manifestPath, "Run `absolute mobile sync` and approve the exact capability plugins before releasing.");
   }
 }, inspectAndroidRelease = async (config, projectRoot) => {
-  const androidRoot = join52(config.nativeProjectDirectory, "android");
-  const nativeConfigPath = join52(androidRoot, "app", "src", "main", "assets", "capacitor.config.json");
-  const manifestPath = join52(androidRoot, "app", "src", "main", "AndroidManifest.xml");
-  const publicRoot = join52(androidRoot, "app", "src", "main", "assets", "public");
-  const journalPath = join52(projectRoot, ".absolutejs", "mobile", "dev-session", "journal.json");
+  const androidRoot = join53(config.nativeProjectDirectory, "android");
+  const nativeConfigPath = join53(androidRoot, "app", "src", "main", "assets", "capacitor.config.json");
+  const manifestPath = join53(androidRoot, "app", "src", "main", "AndroidManifest.xml");
+  const publicRoot = join53(androidRoot, "app", "src", "main", "assets", "public");
+  const journalPath = join53(projectRoot, ".absolutejs", "mobile", "dev-session", "journal.json");
   const checks = await Promise.all([
     journalReleaseCheck(journalPath, "android"),
     capacitorConfigReleaseCheck(nativeConfigPath),
@@ -20684,9 +20951,9 @@ var ABSOLUTE_MOBILE_COMPLIANCE_REPORT_FORMAT = 1, HMR_ASSET_PATTERN, RELEASE_ASS
     path: check2.path ? relative26(projectRoot, check2.path).replaceAll("\\", "/") || "." : undefined
   }));
 }, inspectExpoAndroidRelease = async (config, projectRoot) => {
-  const androidRoot = join52(config.nativeProjectDirectory, "android");
-  const manifestPath = join52(androidRoot, "app", "src", "main", "AndroidManifest.xml");
-  const journalPath = join52(projectRoot, ".absolutejs", "mobile", "expo-dev-session", "journal.json");
+  const androidRoot = join53(config.nativeProjectDirectory, "android");
+  const manifestPath = join53(androidRoot, "app", "src", "main", "AndroidManifest.xml");
+  const journalPath = join53(projectRoot, ".absolutejs", "mobile", "expo-dev-session", "journal.json");
   const checks = await Promise.all([
     journalReleaseCheck(journalPath, "android"),
     expoApplicationConfigCheck(config),
@@ -20710,7 +20977,7 @@ var ABSOLUTE_MOBILE_COMPLIANCE_REPORT_FORMAT = 1, HMR_ASSET_PATTERN, RELEASE_ASS
   const [path] = paths;
   if (!path)
     throw new TypeError(`Generated Expo iOS project is missing its ${label}.`);
-  return join52(iosRoot, path);
+  return join53(iosRoot, path);
 }, expoIosNativeProjectionCheck = async (config, iosRoot) => {
   try {
     const [infoPath, entitlementsPath, projectPath] = await Promise.all([
@@ -20719,9 +20986,9 @@ var ABSOLUTE_MOBILE_COMPLIANCE_REPORT_FORMAT = 1, HMR_ASSET_PATTERN, RELEASE_ASS
       uniqueExpoIosFile(iosRoot, "**/*.xcodeproj/project.pbxproj", "Xcode project")
     ]);
     const [info2, entitlements, project] = await Promise.all([
-      readFile18(infoPath, "utf8"),
-      readFile18(entitlementsPath, "utf8"),
-      readFile18(projectPath, "utf8")
+      readFile19(infoPath, "utf8"),
+      readFile19(entitlementsPath, "utf8"),
+      readFile19(projectPath, "utf8")
     ]);
     if (/<key>NSAllowsArbitraryLoads<\/key>\s*<true\s*\/>/u.test(info2))
       throw new TypeError("Expo iOS App Transport Security permits arbitrary network loads.");
@@ -20736,8 +21003,8 @@ var ABSOLUTE_MOBILE_COMPLIANCE_REPORT_FORMAT = 1, HMR_ASSET_PATTERN, RELEASE_ASS
     return fail5("ios.expo-native-projection", error instanceof Error ? error.message : "Expo iOS native projection could not be validated.", iosRoot, "Run `absolute mobile build ios` to regenerate the production Expo CNG project.");
   }
 }, inspectExpoIosRelease = async (config, projectRoot) => {
-  const iosRoot = join52(config.nativeProjectDirectory, "ios");
-  const journalPath = join52(projectRoot, ".absolutejs", "mobile", "expo-dev-session", "journal.json");
+  const iosRoot = join53(config.nativeProjectDirectory, "ios");
+  const journalPath = join53(projectRoot, ".absolutejs", "mobile", "expo-dev-session", "journal.json");
   const checks = [
     await journalReleaseCheck(journalPath, "ios")
   ];
@@ -20756,11 +21023,11 @@ var ABSOLUTE_MOBILE_COMPLIANCE_REPORT_FORMAT = 1, HMR_ASSET_PATTERN, RELEASE_ASS
     path: check2.path ? relative26(projectRoot, check2.path).replaceAll("\\", "/") || "." : undefined
   }));
 }, inspectIosRelease = async (config, projectRoot) => {
-  const iosAppRoot = join52(config.nativeProjectDirectory, "ios", "App", "App");
-  const nativeConfigPath = join52(iosAppRoot, "capacitor.config.json");
-  const infoPath = join52(iosAppRoot, "Info.plist");
-  const publicRoot = join52(iosAppRoot, "public");
-  const journalPath = join52(projectRoot, ".absolutejs", "mobile", "ios-dev-session", "journal.json");
+  const iosAppRoot = join53(config.nativeProjectDirectory, "ios", "App", "App");
+  const nativeConfigPath = join53(iosAppRoot, "capacitor.config.json");
+  const infoPath = join53(iosAppRoot, "Info.plist");
+  const publicRoot = join53(iosAppRoot, "public");
+  const journalPath = join53(projectRoot, ".absolutejs", "mobile", "ios-dev-session", "journal.json");
   const checks = [
     await journalReleaseCheck(journalPath, "ios")
   ];
@@ -20771,7 +21038,7 @@ var ABSOLUTE_MOBILE_COMPLIANCE_REPORT_FORMAT = 1, HMR_ASSET_PATTERN, RELEASE_ASS
   }
   if (!await pathExists6(nativeConfigPath)) {
     checks.push(fail5("ios.capacitor-config", "The generated iOS Capacitor config is missing.", nativeConfigPath, "Run `absolute mobile sync ios` before release validation."));
-  } else if (isUnsafeCapacitorConfig(await readFile18(nativeConfigPath, "utf8"))) {
+  } else if (isUnsafeCapacitorConfig(await readFile19(nativeConfigPath, "utf8"))) {
     checks.push(fail5("ios.capacitor-config", "iOS Capacitor config contains a development server URL, cleartext transport, navigation allowlist, or invalid JSON.", nativeConfigPath, "Run `absolute mobile sync ios`; do not ship development transport overrides."));
   } else {
     checks.push(pass("ios.capacitor-config", "iOS Capacitor config contains no development transport overrides.", nativeConfigPath));
@@ -20780,12 +21047,12 @@ var ABSOLUTE_MOBILE_COMPLIANCE_REPORT_FORMAT = 1, HMR_ASSET_PATTERN, RELEASE_ASS
   if (!await pathExists6(infoPath)) {
     checks.push(fail5("ios.transport-security", "The iOS Info.plist is missing.", infoPath, "Run `absolute mobile sync ios` before release validation."));
   } else {
-    const info2 = await readFile18(infoPath, "utf8");
+    const info2 = await readFile19(infoPath, "utf8");
     checks.push(/<key>NSAllowsArbitraryLoads<\/key>\s*<true\s*\/>/u.test(info2) ? fail5("ios.transport-security", "iOS App Transport Security permits arbitrary network loads.", infoPath, "Remove NSAllowsArbitraryLoads from the release Info.plist.") : pass("ios.transport-security", "iOS App Transport Security does not permit arbitrary loads.", infoPath));
   }
   const hmrAsset = await findHmrAsset(publicRoot);
   checks.push(hmrAsset ? fail5("ios.hmr-assets", "A packaged iOS asset contains the development HMR client.", hmrAsset, "Rebuild the production mobile bundle and run Capacitor sync again.") : pass("ios.hmr-assets", "Packaged iOS assets contain no development HMR markers.", publicRoot));
-  checks.push(await embeddedBundleReleaseCheck(config, projectRoot, "ios", publicRoot), await contentSecurityPolicyCheck(config, "ios", publicRoot), await iosNativeSecurityCheck(join52(config.nativeProjectDirectory, "ios")), await iosDeepLinkProjectionCheck(config, join52(config.nativeProjectDirectory, "ios")));
+  checks.push(await embeddedBundleReleaseCheck(config, projectRoot, "ios", publicRoot), await contentSecurityPolicyCheck(config, "ios", publicRoot), await iosNativeSecurityCheck(join53(config.nativeProjectDirectory, "ios")), await iosDeepLinkProjectionCheck(config, join53(config.nativeProjectDirectory, "ios")));
   return checks.map((check2) => ({
     ...check2,
     path: check2.path ? relative26(projectRoot, check2.path).replaceAll("\\", "/") || "." : undefined
@@ -20873,20 +21140,20 @@ var init_releaseDoctor = __esm(() => {
 });
 
 // src/mobile/androidRelease.ts
-import { createHash as createHash14 } from "crypto";
+import { createHash as createHash15 } from "crypto";
 import {
   access as access12,
   copyFile as copyFile5,
   mkdir as mkdir13,
   mkdtemp as mkdtemp7,
-  readFile as readFile19,
+  readFile as readFile20,
   realpath as realpath2,
-  rename as rename13,
+  rename as rename14,
   rm as rm10,
   stat as stat3,
-  writeFile as writeFile15
+  writeFile as writeFile16
 } from "fs/promises";
-import { dirname as dirname31, isAbsolute as isAbsolute7, join as join53, relative as relative27, resolve as resolve40, sep as sep7 } from "path";
+import { dirname as dirname31, isAbsolute as isAbsolute7, join as join54, relative as relative27, resolve as resolve40, sep as sep7 } from "path";
 var ABSOLUTE_ANDROID_RELEASE_FORMAT = 1, isRecord15 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), requireManifest2 = (value) => {
   if (!isRecord15(value) || typeof value.appBuild !== "string" || typeof value.appId !== "string" || typeof value.runtime !== "string") {
     throw new TypeError("Invalid embedded AbsoluteJS mobile manifest.");
@@ -20950,17 +21217,17 @@ var ABSOLUTE_ANDROID_RELEASE_FORMAT = 1, isRecord15 = (value) => typeof value ==
   ]);
   if (result.exitCode !== 0)
     throw new TypeError("jarsigner could not sign the Android App Bundle with the configured CI identity.");
-}, sha256File2 = async (path) => createHash14("sha256").update(await readFile19(path)).digest("hex"), fingerprintExpoAndroidProject = async (nativeDirectory) => {
+}, sha256File2 = async (path) => createHash15("sha256").update(await readFile20(path)).digest("hex"), fingerprintExpoAndroidProject = async (nativeDirectory) => {
   const root = await realpath2(nativeDirectory);
   const files = await Array.fromAsync(new Bun.Glob("**/*").scan({ cwd: root, onlyFiles: true }));
   const records = await Promise.all(files.filter((path) => {
     const parts = path.replaceAll("\\", "/").split("/");
     return !parts.includes(".gradle") && !parts.includes("build");
   }).sort().map(async (path) => {
-    const contents = await readFile19(join53(root, path));
-    return `${path.replaceAll("\\", "/")}\x00${createHash14("sha256").update(contents).digest("hex")}\x00`;
+    const contents = await readFile20(join54(root, path));
+    return `${path.replaceAll("\\", "/")}\x00${createHash15("sha256").update(contents).digest("hex")}\x00`;
   }));
-  return createHash14("sha256").update(records.join("")).digest("hex");
+  return createHash15("sha256").update(records.join("")).digest("hex");
 }, safeOutputDirectory2 = (projectRoot, requested) => {
   const root = resolve40(projectRoot);
   const output = resolve40(root, requested ?? ".absolutejs/mobile/releases/android");
@@ -20970,11 +21237,11 @@ var ABSOLUTE_ANDROID_RELEASE_FORMAT = 1, isRecord15 = (value) => typeof value ==
   }
   return output;
 }, installRelease2 = async (artifactPath, metadata, outputRoot) => {
-  const releaseRoot = join53(outputRoot, metadata.releaseId);
+  const releaseRoot = join54(outputRoot, metadata.releaseId);
   const artifactName = "app-release.aab";
-  const destination = join53(releaseRoot, artifactName);
+  const destination = join54(releaseRoot, artifactName);
   if (await pathExists7(releaseRoot)) {
-    const existing = requireManifestIdentity(JSON.parse(await readFile19(join53(releaseRoot, "release.json"), "utf8")), metadata);
+    const existing = requireManifestIdentity(JSON.parse(await readFile20(join54(releaseRoot, "release.json"), "utf8")), metadata);
     const [installedBytes, installedSha256] = await Promise.all([
       stat3(destination).then(({ size }) => size),
       sha256File2(destination)
@@ -20985,16 +21252,16 @@ var ABSOLUTE_ANDROID_RELEASE_FORMAT = 1, isRecord15 = (value) => typeof value ==
     return { artifactPath: destination, metadata: existing, releaseRoot };
   }
   await mkdir13(dirname31(releaseRoot), { recursive: true });
-  const staging = await mkdtemp7(join53(dirname31(releaseRoot), ".android-stage-"));
+  const staging = await mkdtemp7(join54(dirname31(releaseRoot), ".android-stage-"));
   try {
-    await copyFile5(artifactPath, join53(staging, artifactName));
+    await copyFile5(artifactPath, join54(staging, artifactName));
     const complete = {
       ...metadata,
       artifact: artifactName
     };
-    await writeFile15(join53(staging, "release.json"), `${JSON.stringify(complete, null, "\t")}
+    await writeFile16(join54(staging, "release.json"), `${JSON.stringify(complete, null, "\t")}
 `, { flag: "wx" });
-    await rename13(staging, releaseRoot);
+    await rename14(staging, releaseRoot);
     return { artifactPath: destination, metadata: complete, releaseRoot };
   } finally {
     await rm10(staging, { force: true, recursive: true }).catch(() => {
@@ -21023,8 +21290,8 @@ var ABSOLUTE_ANDROID_RELEASE_FORMAT = 1, isRecord15 = (value) => typeof value ==
     throw new TypeError("Expo Android production builds from WSL are not available yet. Run the generated CI workflow on Linux or build from native Windows while the WSL projection is completed.");
   }
   const androidRoot = options.androidRoot ?? process.env.ANDROID_HOME ?? process.env.ANDROID_SDK_ROOT ?? absoluteManagedAndroidSdkRoot(host2);
-  const nativeDirectory = join53(options.config.nativeProjectDirectory, "android");
-  const manifest = requireManifest2(JSON.parse(await readFile19(join53(options.config.bundleDirectory, "absolute-mobile-manifest.json"), "utf8")));
+  const nativeDirectory = join54(options.config.nativeProjectDirectory, "android");
+  const manifest = requireManifest2(JSON.parse(await readFile20(join54(options.config.bundleDirectory, "absolute-mobile-manifest.json"), "utf8")));
   if (manifest.appId !== options.config.appId) {
     throw new TypeError("Embedded mobile manifest appId does not match mobile.appId.");
   }
@@ -21033,7 +21300,7 @@ var ABSOLUTE_ANDROID_RELEASE_FORMAT = 1, isRecord15 = (value) => typeof value ==
     const nativeFingerprint = options.config.engine === "expo" ? await fingerprintExpoAndroidProject(nativeDirectory) : await fingerprintAbsoluteAndroidNativeProject({
       nativeDirectory
     });
-    const buildIdentity = createHash14("sha256").update(`${manifest.appBuild}\x00${nativeFingerprint}`).digest("hex");
+    const buildIdentity = createHash15("sha256").update(`${manifest.appBuild}\x00${nativeFingerprint}`).digest("hex");
     versionCode = await options.prepareVersionCode(buildIdentity);
   }
   if (versionCode !== undefined && (!Number.isSafeInteger(versionCode) || versionCode < 1 || versionCode > 2100000000)) {
@@ -21138,7 +21405,7 @@ var absoluteIosDeviceAcceptanceCommands = (options) => {
 };
 
 // src/mobile/iosConformance.ts
-import { readFile as readFile20, stat as stat4 } from "fs/promises";
+import { readFile as readFile21, stat as stat4 } from "fs/promises";
 var HMR_LINE, parseAbsoluteIosHmrLog = (line) => {
   const match = HMR_LINE.exec(line);
   if (!match)
@@ -21173,7 +21440,7 @@ var HMR_LINE, parseAbsoluteIosHmrLog = (line) => {
     if (Date.now() > deadline)
       throw new Error(`No iOS native HMR acknowledgement was observed within ${timeoutMs}ms.`);
     options.signal?.throwIfAborted();
-    const contents = await readFile20(options.logPath).catch(() => Buffer.alloc(0));
+    const contents = await readFile21(options.logPath).catch(() => Buffer.alloc(0));
     if (contents.byteLength < offset) {
       offset = 0;
       buffered = "";
@@ -21197,8 +21464,8 @@ var init_iosConformance = __esm(() => {
 });
 
 // src/mobile/nativeTestReport.ts
-import { mkdir as mkdir14, readFile as readFile21, writeFile as writeFile16 } from "fs/promises";
-import { join as join54 } from "path";
+import { mkdir as mkdir14, readFile as readFile22, writeFile as writeFile17 } from "fs/promises";
+import { join as join55 } from "path";
 var secretPattern, bearerPattern, coordinatePattern, nativeCredentialPattern, sanitizeNativeReportText = (value) => value.replace(nativeCredentialPattern, "[REDACTED]").replace(bearerPattern, "Bearer [REDACTED]").replace(secretPattern, "$1$2[REDACTED]").replace(coordinatePattern, "$1$2[REDACTED]").replace(/(https?:\/\/[^\s?#]+)[?#][^\s]*/giu, "$1?[REDACTED]"), markdownCell = (value) => sanitizeNativeReportText(value).replaceAll("|", "\\|").replaceAll(`
 `, "<br>"), createAbsoluteNativeAutomatedChecks = (run) => {
   const target = `${run.targetKind} ${run.targetId}`;
@@ -21300,7 +21567,7 @@ var secretPattern, bearerPattern, coordinatePattern, nativeCredentialPattern, sa
   reportVersion: 1,
   run: options.run
 }), readPackageVersionForNativeReport = async (packageJsonPath) => {
-  const manifest = JSON.parse(await readFile21(packageJsonPath, "utf8"));
+  const manifest = JSON.parse(await readFile22(packageJsonPath, "utf8"));
   if (typeof manifest !== "object" || manifest === null)
     return "unknown";
   const version2 = Reflect.get(manifest, "version");
@@ -21337,12 +21604,12 @@ ${table(report.manualChecks)}
 `;
 }, writeAbsoluteNativeTestReport = async (directory, report) => {
   await mkdir14(directory, { recursive: true });
-  const jsonPath = join54(directory, "report.json");
-  const markdownPath = join54(directory, "report.md");
+  const jsonPath = join55(directory, "report.json");
+  const markdownPath = join55(directory, "report.md");
   await Promise.all([
-    writeFile16(jsonPath, `${JSON.stringify(report, null, 2)}
+    writeFile17(jsonPath, `${JSON.stringify(report, null, 2)}
 `),
-    writeFile16(markdownPath, renderAbsoluteNativeTestReport(report))
+    writeFile17(markdownPath, renderAbsoluteNativeTestReport(report))
   ]);
   return { directory, jsonPath, markdownPath };
 };
@@ -21697,8 +21964,8 @@ var prepareAbsoluteIosRelease = async (publisher, options) => {
 var init_releasePublisher = () => {};
 
 // src/mobile/mobileInspect.ts
-import { access as access14, readFile as readFile22 } from "fs/promises";
-import { join as join55, relative as relative29, resolve as resolve42 } from "path";
+import { access as access14, readFile as readFile23 } from "fs/promises";
+import { join as join56, relative as relative29, resolve as resolve42 } from "path";
 var ABSOLUTE_MOBILE_INSPECTION_FORMAT = 1, MOBILE_PACKAGE_NAMES, isObject3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), portablePath2 = (projectRoot, path) => {
   const value = relative29(resolve42(projectRoot), resolve42(path)).replaceAll("\\", "/");
   return value || ".";
@@ -21710,7 +21977,7 @@ var ABSOLUTE_MOBILE_INSPECTION_FORMAT = 1, MOBILE_PACKAGE_NAMES, isObject3 = (va
     return false;
   }
 }, readObject2 = async (path) => {
-  const value = JSON.parse(await readFile22(path, "utf8"));
+  const value = JSON.parse(await readFile23(path, "utf8"));
   if (!isObject3(value))
     throw new TypeError("JSON root must be an object.");
   return value;
@@ -21720,13 +21987,13 @@ var ABSOLUTE_MOBILE_INSPECTION_FORMAT = 1, MOBILE_PACKAGE_NAMES, isObject3 = (va
   for (const [name, declared] of Object.entries(value).filter((entry) => typeof entry[1] === "string"))
     declarations.set(name, declared);
 }, packageInspections = async (projectRoot, additionalNames) => {
-  const project = await readObject2(join55(projectRoot, "package.json"));
+  const project = await readObject2(join56(projectRoot, "package.json"));
   const declarations = new Map;
   for (const field of ["dependencies", "devDependencies"])
     addPackageDeclarations(declarations, project[field]);
   const names = [...new Set([...declarations.keys(), ...additionalNames])].filter((name) => MOBILE_PACKAGE_NAMES.has(name) || name.startsWith("@capacitor/") || additionalNames.includes(name)).sort();
   return Promise.all(names.map(async (name) => {
-    const installedManifest = await readObject2(join55(projectRoot, "node_modules", name, "package.json")).catch(() => {
+    const installedManifest = await readObject2(join56(projectRoot, "node_modules", name, "package.json")).catch(() => {
       return;
     });
     const installed = installedManifest?.version;
@@ -21775,7 +22042,7 @@ var ABSOLUTE_MOBILE_INSPECTION_FORMAT = 1, MOBILE_PACKAGE_NAMES, isObject3 = (va
     },
     format: ABSOLUTE_MOBILE_INSPECTION_FORMAT,
     nativeProjects: await Promise.all(config.platforms.map(async (platform6) => {
-      const path = join55(config.nativeProjectDirectory, platform6);
+      const path = join56(config.nativeProjectDirectory, platform6);
       return {
         initialized: await pathExists8(path),
         path: portablePath2(projectRoot, path),
@@ -21846,7 +22113,7 @@ var init_mobileInspect = __esm(() => {
 
 // src/mobile/ciWorkflow.ts
 import { existsSync as existsSync43 } from "fs";
-import { access as access15, mkdir as mkdir15, readFile as readFile23, writeFile as writeFile17 } from "fs/promises";
+import { access as access15, mkdir as mkdir15, readFile as readFile24, writeFile as writeFile18 } from "fs/promises";
 import { dirname as dirname32, extname as extname9, relative as relative30, resolve as resolve43, sep as sep9 } from "path";
 var ABSOLUTE_MOBILE_CI_WORKFLOW_FORMAT = 1, SECRET_NAME_PATTERN, CI_ENV_INDENTATION = 6, RESERVED_SECRET_NAMES, exists4 = async (path) => {
   try {
@@ -22260,12 +22527,12 @@ ${bundleAuditSteps}${platforms.includes("android") ? androidJob({ customSecrets,
 }, writeAbsoluteMobileGithubWorkflow = async (options) => {
   const path = workflowOutputPath(options.projectRoot, options.outputPath);
   const generated = createAbsoluteMobileGithubWorkflow(options);
-  const previous = await exists4(path) ? await readFile23(path, "utf8") : undefined;
+  const previous = await exists4(path) ? await readFile24(path, "utf8") : undefined;
   if (previous !== undefined && previous !== generated.workflow && !options.force)
     throw new TypeError(`${relative30(options.projectRoot, path)} already exists and differs. Rerun with --force to replace the generated workflow.`);
   if (previous !== generated.workflow) {
     await mkdir15(dirname32(path), { recursive: true });
-    await writeFile17(path, generated.workflow);
+    await writeFile18(path, generated.workflow);
   }
   return {
     changed: previous !== generated.workflow,
@@ -22322,16 +22589,171 @@ var init_ciWorkflow = __esm(() => {
         run: exit 1`;
 });
 
+// src/mobile/updateSigning.ts
+import { createHash as createHash16, sign as sign2, verify as verify2 } from "crypto";
+import {
+  cp as cp4,
+  mkdir as mkdir16,
+  mkdtemp as mkdtemp8,
+  readdir as readdir6,
+  readFile as readFile25,
+  rename as rename15,
+  rm as rm11,
+  stat as stat5,
+  writeFile as writeFile19
+} from "fs/promises";
+import { dirname as dirname33, join as join57, relative as relative31, resolve as resolve44 } from "path";
+var UPDATE_MANIFEST_FILE = "update.json", UPDATE_FILES_DIRECTORY = "files", sha2562 = (value) => createHash16("sha256").update(value).digest("hex"), listFiles = async (root, directory = root) => {
+  const entries = await readdir6(directory, { withFileTypes: true });
+  const paths = await Promise.all(entries.map(async (entry) => {
+    const path = join57(directory, entry.name);
+    if (entry.isDirectory())
+      return listFiles(root, path);
+    if (!entry.isFile())
+      throw new TypeError("Mobile updates cannot contain links or special files.");
+    return [relative31(root, path).replaceAll("\\", "/")];
+  }));
+  return paths.flat().sort();
+}, inspectFiles = async (root, paths) => Promise.all(paths.map(async (path) => {
+  const source = join57(root, path);
+  const [metadata, contents] = await Promise.all([
+    stat5(source),
+    readFile25(source)
+  ]);
+  return { bytes: metadata.size, path, sha256: sha2562(contents) };
+})), releaseIdFor = (value) => `amu_${sha2562(canonicalizeAbsoluteMobileUpdate(value))}`, buildAbsoluteMobileUpdate = async (options) => {
+  const bundleDirectory = resolve44(options.bundleDirectory);
+  const outputRoot = resolve44(options.outputDirectory);
+  if (outputRoot === bundleDirectory || outputRoot.startsWith(`${bundleDirectory}/`))
+    throw new TypeError("Mobile update output must be outside the embedded bundle.");
+  const paths = await listFiles(bundleDirectory);
+  const files = await inspectFiles(bundleDirectory, paths);
+  const withoutId = {
+    appId: options.appId,
+    channel: options.channel,
+    classification: options.classification,
+    createdAt: (options.createdAt ?? new Date).toISOString(),
+    files,
+    format: ABSOLUTE_MOBILE_UPDATE_FORMAT,
+    runtimeFingerprint: options.runtimeFingerprint,
+    withinSubmittedPurpose: true
+  };
+  const unsigned = {
+    ...withoutId,
+    releaseId: releaseIdFor(withoutId)
+  };
+  const signature = sign2("sha256", absoluteMobileUpdateSigningPayload(unsigned), { dsaEncoding: "ieee-p1363", key: options.privateKey });
+  const manifest = parseAbsoluteMobileUpdateManifest({
+    ...unsigned,
+    signature: {
+      algorithm: "ecdsa-p256-sha256",
+      keyId: options.keyId,
+      value: signature.toString("base64")
+    }
+  });
+  await mkdir16(outputRoot, { recursive: true });
+  const outputDirectory = join57(outputRoot, manifest.releaseId);
+  const staging = await mkdtemp8(join57(outputRoot, ".stage-"));
+  try {
+    await cp4(bundleDirectory, join57(staging, UPDATE_FILES_DIRECTORY), {
+      force: true,
+      recursive: true
+    });
+    await writeFile19(join57(staging, UPDATE_MANIFEST_FILE), `${JSON.stringify(manifest, null, "\t")}
+`);
+    await rename15(staging, outputDirectory);
+  } catch (error) {
+    await rm11(staging, { force: true, recursive: true });
+    if (typeof error === "object" && error !== null && Reflect.get(error, "code") === "EEXIST")
+      throw new TypeError(`Mobile update ${manifest.releaseId} already exists.`, { cause: error });
+    throw error;
+  }
+  return {
+    manifest,
+    manifestPath: join57(outputDirectory, UPDATE_MANIFEST_FILE),
+    outputDirectory
+  };
+}, readAbsoluteMobileUpdate = async (directory) => parseAbsoluteMobileUpdateManifest(JSON.parse(await readFile25(join57(resolve44(directory), UPDATE_MANIFEST_FILE), "utf8"))), verifyAbsoluteMobileUpdateSignature = (manifestValue, publicKey) => {
+  const manifest = parseAbsoluteMobileUpdateManifest(manifestValue);
+  const valid = verify2("sha256", absoluteMobileUpdateSigningPayload(unsignedAbsoluteMobileUpdate(manifest)), { dsaEncoding: "ieee-p1363", key: publicKey }, Buffer.from(manifest.signature.value, "base64"));
+  if (!valid)
+    throw new TypeError("Mobile update signature verification failed.");
+  return manifest;
+};
+var init_updateSigning = __esm(() => {
+  init_updateProtocol();
+});
+
+// src/mobile/updatePublisher.ts
+import { access as access16 } from "fs/promises";
+import { isAbsolute as isAbsolute9, relative as relative32, resolve as resolve45, sep as sep10 } from "path";
+import { pathToFileURL as pathToFileURL3 } from "url";
+var object4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), isPublisher2 = (value) => object4(value) && typeof value.publishUpdate === "function" && typeof value.promoteUpdate === "function" && typeof value.rollbackUpdate === "function", projectPath2 = (projectRoot, requested, label) => {
+  const root = resolve45(projectRoot);
+  const path = resolve45(root, requested);
+  const projectRelative = relative32(root, path);
+  if (projectRelative === ".." || projectRelative.startsWith(`..${sep10}`) || isAbsolute9(projectRelative))
+    throw new TypeError(`${label} must remain inside the project.`);
+  return path;
+}, loadAbsoluteMobileUpdatePublisher = async (projectRoot, requestedModulePath) => {
+  const modulePath = projectPath2(projectRoot, requestedModulePath, "mobile update registry");
+  await access16(modulePath).catch(() => {
+    throw new TypeError(`Mobile update registry does not exist: ${modulePath}`);
+  });
+  const loaded = await import(pathToFileURL3(modulePath).href);
+  const publisher = object4(loaded) ? loaded.default ?? loaded.registry : undefined;
+  if (!isPublisher2(publisher))
+    throw new TypeError("Mobile update registry must implement publishUpdate, promoteUpdate, and rollbackUpdate.");
+  return publisher;
+}, promoteAbsoluteMobileUpdate = async (options) => {
+  const result = await options.publisher.promoteUpdate({
+    appId: options.appId,
+    channel: options.channel,
+    releaseId: options.releaseId,
+    rollout: options.rollout,
+    signal: options.signal
+  });
+  if (result.appId !== options.appId || result.channel !== options.channel || result.releaseId !== options.releaseId || result.rollout !== options.rollout || result.stage !== "promoted")
+    throw new TypeError("Mobile update registry returned a different promotion identity.");
+  return result;
+}, publishAbsoluteMobileUpdate = async (options) => {
+  const releaseDirectory = projectPath2(options.projectRoot, options.releaseDirectory, "mobile update release directory");
+  const manifest = await readAbsoluteMobileUpdate(releaseDirectory);
+  const result = await options.publisher.publishUpdate({
+    manifest,
+    releaseDirectory,
+    rollout: options.rollout,
+    signal: options.signal
+  });
+  if (result.appId !== manifest.appId || result.channel !== manifest.channel || result.releaseId !== manifest.releaseId || result.rollout !== options.rollout || result.stage !== "published" || typeof result.reused !== "boolean")
+    throw new TypeError("Mobile update registry returned a different publication identity.");
+  return result;
+}, rollbackAbsoluteMobileUpdate = async (options) => {
+  const result = await options.publisher.rollbackUpdate({
+    appId: options.appId,
+    channel: options.channel,
+    ...options.releaseId ? { releaseId: options.releaseId } : {},
+    signal: options.signal
+  });
+  if (result.appId !== options.appId || result.channel !== options.channel || result.releaseId !== options.releaseId || result.stage !== "rolled-back")
+    throw new TypeError("Mobile update registry returned a different rollback identity.");
+  return result;
+};
+var init_updatePublisher = __esm(() => {
+  init_updateSigning();
+});
+
 // src/cli/scripts/mobile.ts
 var exports_mobile = {};
 __export(exports_mobile, {
   runMobile: () => runMobile
 });
-import { access as access16, mkdir as mkdir16, readFile as readFile24, writeFile as writeFile18 } from "fs/promises";
-import { join as join56, relative as relative31, resolve as resolve44 } from "path";
+import { access as access17, mkdir as mkdir17, readFile as readFile26, writeFile as writeFile20 } from "fs/promises";
+import { createPublicKey as createPublicKey3 } from "crypto";
+import { join as join58, relative as relative33, resolve as resolve46 } from "path";
 import { createInterface } from "readline/promises";
 var NOT_FOUND4 = -1, isRecord17 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), CAPACITOR_PACKAGES, CAPACITOR_PACKAGE_SPECS, CAPACITOR_SYNC_PACKAGE_SPECS, packageNameFromSpec = (spec) => spec.slice(0, spec.lastIndexOf("@")), directProjectPackages = async (projectRoot) => {
-  const manifest = JSON.parse(await readFile24(join56(projectRoot, "package.json"), "utf8"));
+  const manifest = JSON.parse(await readFile26(join58(projectRoot, "package.json"), "utf8"));
   if (!isRecord17(manifest))
     throw new TypeError("Application package.json must contain an object.");
   const names = new Set;
@@ -22344,7 +22766,7 @@ var NOT_FOUND4 = -1, isRecord17 = (value) => typeof value === "object" && value
   return names;
 }, resolvedPackageVersion = async (projectRoot, packageName) => {
   try {
-    const manifest = JSON.parse(await readFile24(join56(projectRoot, "node_modules", packageName, "package.json"), "utf8"));
+    const manifest = JSON.parse(await readFile26(join58(projectRoot, "node_modules", packageName, "package.json"), "utf8"));
     return isRecord17(manifest) && typeof manifest.version === "string" ? manifest.version : undefined;
   } catch {
     return;
@@ -22361,9 +22783,10 @@ var NOT_FOUND4 = -1, isRecord17 = (value) => typeof value === "object" && value
   const name = packageNameFromSpec(spec);
   const needsInstall = !installed.has(name) || exactPackages.has(name) && await resolvedPackageVersion(projectRoot, name) !== exactVersionFromSpec(spec);
   return needsInstall ? spec : undefined;
-}))).filter((spec) => spec !== undefined), ensureCapacitorPackages = async (projectRoot, args) => {
+}))).filter((spec) => spec !== undefined), ensureCapacitorPackages = async (projectRoot, args, mobile) => {
   const specs = [
     ...CAPACITOR_PACKAGE_SPECS,
+    ...mobile?.updates ? ["@capacitor/filesystem@8.1.3"] : [],
     ...projectUsesAbsoluteSync(projectRoot) ? CAPACITOR_SYNC_PACKAGE_SPECS : []
   ];
   const installed = await directProjectPackages(projectRoot);
@@ -22385,9 +22808,9 @@ var NOT_FOUND4 = -1, isRecord17 = (value) => typeof value === "object" && value
   }
   return value;
 }, capacitorExecutable = async (projectRoot) => {
-  const executable = join56(projectRoot, "node_modules", ".bin", "cap");
+  const executable = join58(projectRoot, "node_modules", ".bin", "cap");
   try {
-    await access16(executable);
+    await access17(executable);
     return executable;
   } catch {
     throw new TypeError(`Capacitor is not installed in this app. Run: bun add ${CAPACITOR_PACKAGES.join(" ")}`);
@@ -22405,9 +22828,9 @@ var NOT_FOUND4 = -1, isRecord17 = (value) => typeof value === "object" && value
     throw new TypeError(`Capacitor exited with status ${exitCode}.`);
   }
 }, runCapacitorForPlatforms = (projectRoot, command, platforms) => platforms.reduce((pending, platform6) => pending.then(() => runCapacitor(projectRoot, [command, platform6])), Promise.resolve()), expoExecutable = async (project) => {
-  const executable = join56(project, "node_modules", ".bin", "expo");
+  const executable = join58(project, "node_modules", ".bin", "expo");
   try {
-    await access16(executable);
+    await access17(executable);
     return executable;
   } catch {
     throw new TypeError("Expo dependencies are not installed in the generated shell. Run `absolute mobile init --yes`.");
@@ -22436,14 +22859,14 @@ var NOT_FOUND4 = -1, isRecord17 = (value) => typeof value === "object" && value
     throw new TypeError(`Expo exited with status ${exitCode}.`);
 }, ensureExpoPackages = async (project, args) => {
   try {
-    const manifest = JSON.parse(await readFile24(join56(project, "package.json"), "utf8"));
+    const manifest = JSON.parse(await readFile26(join58(project, "package.json"), "utf8"));
     const dependencies = typeof manifest === "object" && manifest !== null ? Reflect.get(manifest, "dependencies") : undefined;
     if (typeof dependencies !== "object" || dependencies === null || Array.isArray(dependencies))
       throw new TypeError("Generated Expo dependencies are invalid.");
     await Promise.all(Object.entries(dependencies).map(async ([name, expected]) => {
       if (typeof expected !== "string")
         throw new TypeError("Generated Expo dependency version is invalid.");
-      const installed = JSON.parse(await readFile24(join56(project, "node_modules", name, "package.json"), "utf8"));
+      const installed = JSON.parse(await readFile26(join58(project, "node_modules", name, "package.json"), "utf8"));
       const actual = typeof installed === "object" && installed !== null ? Reflect.get(installed, "version") : undefined;
       if (typeof actual !== "string")
         throw new TypeError("Installed Expo dependency version is invalid.");
@@ -22579,7 +23002,7 @@ var NOT_FOUND4 = -1, isRecord17 = (value) => typeof value === "object" && value
     ]);
     return;
   }
-  await ensureCapacitorPackages(projectRoot, args);
+  await ensureCapacitorPackages(projectRoot, args, mobile);
   const generated = await writeAbsoluteCapacitorConfig(mobile, {
     force: args.includes("--force"),
     projectRoot
@@ -22591,6 +23014,7 @@ var NOT_FOUND4 = -1, isRecord17 = (value) => typeof value === "object" && value
   await applyAbsoluteNativeDeepLinks(mobile);
   await applyAbsoluteNativeDeviceCapabilities(projectRoot, mobile);
   await applyAbsoluteNativeBackgroundSync(projectRoot, mobile);
+  await applyAbsoluteNativeUpdates(mobile);
 }, sync = async (args) => {
   const { mobile, projectRoot } = await loadMobile(valueAfter(args, "--config"));
   if (mobile.engine === "expo") {
@@ -22612,7 +23036,7 @@ var NOT_FOUND4 = -1, isRecord17 = (value) => typeof value === "object" && value
     ]);
     return;
   }
-  await ensureCapacitorPackages(projectRoot, args);
+  await ensureCapacitorPackages(projectRoot, args, mobile);
   const platform6 = args.find((value) => value === "android" || value === "ios");
   const platforms = platform6 ? [platform6] : mobile.platforms;
   if (platforms.includes("android"))
@@ -22623,9 +23047,10 @@ var NOT_FOUND4 = -1, isRecord17 = (value) => typeof value === "object" && value
   await applyAbsoluteNativeDeepLinks(mobile, platforms);
   await applyAbsoluteNativeDeviceCapabilities(projectRoot, mobile, platforms);
   await applyAbsoluteNativeBackgroundSync(projectRoot, mobile, platforms);
+  await applyAbsoluteNativeUpdates(mobile, platforms);
 }, associations = async (args) => {
   const { mobile, projectRoot } = await loadMobile(valueAfter(args, "--config"));
-  const outputDirectory = resolve44(projectRoot, valueAfter(args, "--outdir") ?? ".absolutejs/mobile/associations");
+  const outputDirectory = resolve46(projectRoot, valueAfter(args, "--outdir") ?? ".absolutejs/mobile/associations");
   if (args.includes("--verify")) {
     const result2 = await verifyAbsoluteMobileAssociationFiles(mobile);
     console.log(`Verified ${result2.results.length} hosted association files`);
@@ -22675,7 +23100,7 @@ var NOT_FOUND4 = -1, isRecord17 = (value) => typeof value === "object" && value
   const publicResult = {
     changed: result.changed,
     format: result.format,
-    path: relative31(projectRoot, result.path).replaceAll("\\", "/"),
+    path: relative33(projectRoot, result.path).replaceAll("\\", "/"),
     platforms: result.platforms,
     publishing: result.publishing,
     requiredSecrets: result.requiredSecrets
@@ -22742,6 +23167,7 @@ Mobile release security and compliance checks failed.`);
 }, mobileBuildServerEntry = (args) => {
   const valueFlags = new Set([
     "--channel",
+    "--classification",
     "--config",
     "--outdir",
     "--play-name",
@@ -22751,6 +23177,8 @@ Mobile release security and compliance checks failed.`);
     "--play-track",
     "--play-update-priority",
     "--registry",
+    "--key-id",
+    "--signing-key",
     "--remote",
     "--testflight-group",
     "--testflight-notes",
@@ -22764,6 +23192,132 @@ Mobile release security and compliance checks failed.`);
     }
   });
   return args.find((value, index) => !skipped.has(index) && value !== "--unsigned" && !value.startsWith("-")) ?? DEFAULT_SERVER_ENTRY;
+}, requireUpdateClassification = (value) => {
+  if (value === "bug-fix" || value === "content" || value === "security")
+    return value;
+  throw new TypeError("mobile update build requires --classification bug-fix|content|security.");
+}, buildMobileUpdate = async (args) => {
+  const configPath2 = valueAfter(args, "--config");
+  const { mobile, projectRoot } = await loadMobile(configPath2);
+  requireCapacitorEngine(mobile, "mobile update build");
+  if (!mobile.updates)
+    throw new TypeError("mobile update build requires mobile.updates.publicKeys in absolute.config.ts.");
+  if (!args.includes("--within-submitted-purpose"))
+    throw new TypeError("mobile update build requires --within-submitted-purpose to attest that the update does not change the submitted app purpose.");
+  const classification = requireUpdateClassification(valueAfter(args, "--classification"));
+  const keyId = valueAfter(args, "--key-id");
+  if (!keyId || !mobile.updates.publicKeys[keyId])
+    throw new TypeError("mobile update build requires --key-id matching mobile.updates.publicKeys.");
+  const signingKeyPath = valueAfter(args, "--signing-key");
+  if (!signingKeyPath)
+    throw new TypeError("mobile update build requires --signing-key <private-key.pem>.");
+  const startedAt = performance.now();
+  let success = false;
+  try {
+    await start(mobileBuildServerEntry(args), valueAfter(args, "--web-outdir"), configPath2, { prepareOnly: true });
+    const embedded = JSON.parse(await readFile26(join58(mobile.bundleDirectory, "absolute-mobile-manifest.json"), "utf8"));
+    const runtimeFingerprint = isRecord17(embedded) ? embedded.nativeRuntime : undefined;
+    if (typeof runtimeFingerprint !== "string" || !/^[a-f0-9]{64}$/u.test(runtimeFingerprint))
+      throw new TypeError("Prepared mobile bundle is missing its native runtime fingerprint.");
+    const privateKey = await readFile26(resolve46(projectRoot, signingKeyPath));
+    const configuredPublicKey = Buffer.from(mobile.updates.publicKeys[keyId], "base64");
+    const derivedPublicKey = createPublicKey3(privateKey).export({
+      format: "der",
+      type: "spki"
+    });
+    if (!configuredPublicKey.equals(derivedPublicKey))
+      throw new TypeError(`The private key does not match mobile.updates.publicKeys.${keyId}.`);
+    const result = await buildAbsoluteMobileUpdate({
+      appId: mobile.appId,
+      bundleDirectory: mobile.bundleDirectory,
+      channel: mobile.updates.channel,
+      classification,
+      keyId,
+      outputDirectory: valueAfter(args, "--outdir") ?? join58(projectRoot, ".absolutejs", "mobile", "updates"),
+      privateKey,
+      runtimeFingerprint
+    });
+    verifyAbsoluteMobileUpdateSignature(result.manifest, derivedPublicKey);
+    success = true;
+    console.log(`Built signed mobile update ${result.manifest.releaseId}.`);
+    console.log(`Release: ${result.outputDirectory}`);
+    console.log(`Manifest: ${result.manifestPath}`);
+    return result;
+  } finally {
+    sendTelemetryEvent("mobile:update-build", {
+      classification: classification ?? "invalid",
+      durationMs: Math.round(performance.now() - startedAt),
+      engine: mobile.engine,
+      success
+    });
+  }
+}, updateRollout = (args, fallback) => {
+  const value = valueAfter(args, "--rollout");
+  if (value === undefined) {
+    if (fallback !== undefined)
+      return fallback;
+    throw new TypeError("This command requires --rollout <fraction>.");
+  }
+  const rollout = Number(value);
+  if (!Number.isFinite(rollout) || rollout <= 0 || rollout > 1)
+    throw new TypeError("--rollout must be greater than 0 and at most 1.");
+  return rollout;
+}, mobileUpdatePublisher = async (args) => {
+  const { projectRoot } = await loadMobile(valueAfter(args, "--config"));
+  const modulePath = valueAfter(args, "--registry") ?? "mobile.release.ts";
+  return {
+    projectRoot,
+    publisher: await loadAbsoluteMobileUpdatePublisher(projectRoot, modulePath)
+  };
+}, publishMobileUpdate = async (args) => {
+  const releaseDirectory = args.find((value, index) => {
+    if (value.startsWith("-"))
+      return false;
+    const previous = args[index - 1];
+    return !["--config", "--registry", "--rollout"].includes(previous ?? "");
+  });
+  if (!releaseDirectory)
+    throw new TypeError("mobile update publish requires a release directory.");
+  const { projectRoot, publisher } = await mobileUpdatePublisher(args);
+  const result = await publishAbsoluteMobileUpdate({
+    projectRoot,
+    publisher,
+    releaseDirectory,
+    rollout: updateRollout(args, 0.05)
+  });
+  console.log(`${result.reused ? "Reused" : "Published"} mobile update ${result.releaseId} to ${result.channel} at ${Math.round(result.rollout * 100)}%.`);
+  return result;
+}, promoteMobileUpdate = async (args) => {
+  const { mobile } = await loadMobile(valueAfter(args, "--config"));
+  if (!mobile.updates)
+    throw new TypeError("mobile update promote requires mobile.updates config.");
+  const releaseId = valueAfter(args, "--release");
+  if (!releaseId)
+    throw new TypeError("mobile update promote requires --release <release-id>.");
+  const { publisher } = await mobileUpdatePublisher(args);
+  const result = await promoteAbsoluteMobileUpdate({
+    appId: mobile.appId,
+    channel: mobile.updates.channel,
+    publisher,
+    releaseId,
+    rollout: updateRollout(args)
+  });
+  console.log(`Promoted mobile update ${result.releaseId} to ${Math.round(result.rollout * 100)}%.`);
+  return result;
+}, rollbackMobileUpdate = async (args) => {
+  const { mobile } = await loadMobile(valueAfter(args, "--config"));
+  if (!mobile.updates)
+    throw new TypeError("mobile update rollback requires mobile.updates config.");
+  const { publisher } = await mobileUpdatePublisher(args);
+  const releaseId = valueAfter(args, "--release");
+  const result = await rollbackAbsoluteMobileUpdate({
+    appId: mobile.appId,
+    channel: mobile.updates.channel,
+    publisher,
+    ...releaseId ? { releaseId } : {}
+  });
+  console.log(result.releaseId ? `Rolled ${result.channel} back to ${result.releaseId}.` : `Rolled ${result.channel} back to the embedded store build.`);
+  return result;
 }, requireValueAfter = (args, flag) => {
   const value = valueAfter(args, flag);
   if (!value || value.startsWith("-")) {
@@ -22919,6 +23473,7 @@ Mobile release security and compliance checks failed.`);
   await applyAbsoluteNativeDeepLinks(mobile, ["ios"]);
   await applyAbsoluteNativeDeviceCapabilities(projectRoot, mobile, ["ios"]);
   await applyAbsoluteNativeBackgroundSync(projectRoot, mobile, ["ios"]);
+  await applyAbsoluteNativeUpdates(mobile, ["ios"]);
 }, prepareIosReleaseProject = (mobile, projectRoot, args) => mobile.engine === "expo" ? prepareExpoIosReleaseProject(mobile, projectRoot, args) : prepareCapacitorIosReleaseProject(mobile, projectRoot), prepareCapacitorAndroidReleaseProject = async (mobile, projectRoot) => {
   await writeAbsoluteCapacitorConfig(mobile, { projectRoot });
   await runCapacitorForPlatforms(projectRoot, "sync", ["android"]);
@@ -22954,7 +23509,7 @@ Mobile release security and compliance checks failed.`);
     const durationMs = Math.round(performance.now() - startedAt);
     console.log(`Built ${release.metadata.signed ? "signed" : "unsigned"} Android App Bundle in ${getDurationString(durationMs)}.`);
     console.log(`Artifact: ${release.artifactPath}`);
-    console.log(`Metadata: ${join56(release.releaseRoot, "release.json")}`);
+    console.log(`Metadata: ${join58(release.releaseRoot, "release.json")}`);
     return release;
   } finally {
     sendTelemetryEvent("mobile:android-release-build", {
@@ -23102,7 +23657,7 @@ Mobile release security and compliance checks failed.`);
     const durationMs = Math.round(performance.now() - startedAt);
     console.log(`Built ${release.metadata.signed ? "signed" : "unsigned"} iOS IPA ${release.metadata.marketingVersion}${release.metadata.buildNumber ? ` (${release.metadata.buildNumber})` : ""} in ${getDurationString(durationMs)}.`);
     console.log(`Artifact: ${release.artifactPath}`);
-    console.log(`Metadata: ${join56(release.releaseRoot, "release.json")}`);
+    console.log(`Metadata: ${join58(release.releaseRoot, "release.json")}`);
     return release;
   } finally {
     stopListeningForCancellation();
@@ -23211,7 +23766,7 @@ Mobile release security and compliance checks failed.`);
     checks.push({
       id: "sync.storage-schema",
       label: `Offline schema ${schema.components.map((component2) => `${component2.id}@${component2.version}`).join(", ")}`,
-      path: join56(projectRoot, "package.json"),
+      path: join58(projectRoot, "package.json"),
       platform: "host",
       status: "pass"
     });
@@ -23219,7 +23774,7 @@ Mobile release security and compliance checks failed.`);
     checks.push({
       id: "sync.storage-schema",
       label: "Offline schema metadata is invalid",
-      path: join56(projectRoot, "package.json"),
+      path: join58(projectRoot, "package.json"),
       platform: "host",
       remediation: error instanceof Error ? error.message : String(error),
       status: "fail"
@@ -23304,7 +23859,7 @@ Emulator setup verification:`);
     }
     return { https: args.includes("--https"), port };
   }
-  const instances = listLiveInstances().filter((instance2) => resolve44(instance2.cwd) === resolve44(projectRoot) && instance2.source === "dev" && instance2.port !== null);
+  const instances = listLiveInstances().filter((instance2) => resolve46(instance2.cwd) === resolve46(projectRoot) && instance2.source === "dev" && instance2.port !== null);
   if (instances.length !== 1) {
     throw new TypeError(instances.length === 0 ? "No running AbsoluteJS dev server was found for this project. Start `bun dev`, wait for Android to report ready, then run `absolute mobile test android`." : "Multiple dev servers are running for this project. Select one with mobile test android --port <port>.");
   }
@@ -23347,8 +23902,8 @@ Emulator setup verification:`);
   }
   return selected;
 }, safeArtifactRoot = (projectRoot, value) => {
-  const root = resolve44(projectRoot, value ?? ".absolutejs/mobile/test-artifacts");
-  if (root !== projectRoot && !root.startsWith(`${resolve44(projectRoot)}/`)) {
+  const root = resolve46(projectRoot, value ?? ".absolutejs/mobile/test-artifacts");
+  if (root !== projectRoot && !root.startsWith(`${resolve46(projectRoot)}/`)) {
     throw new TypeError("mobile test --artifacts must remain inside the project.");
   }
   return root;
@@ -23372,12 +23927,12 @@ Emulator setup verification:`);
     timeoutMs
   });
 }, writeAndroidFailureArtifacts = async (options) => {
-  await mkdir16(options.artifactRoot, { recursive: true });
-  const screenshot = options.session ? await options.session.screenshot(join56(options.artifactRoot, "android-failure.png")).catch(() => {
+  await mkdir17(options.artifactRoot, { recursive: true });
+  const screenshot = options.session ? await options.session.screenshot(join58(options.artifactRoot, "android-failure.png")).catch(() => {
     return;
   }) : undefined;
-  const diagnosticPath = join56(options.artifactRoot, "android-failure.json");
-  await writeFile18(diagnosticPath, `${JSON.stringify({
+  const diagnosticPath = join58(options.artifactRoot, "android-failure.json");
+  await writeFile20(diagnosticPath, `${JSON.stringify({
     diagnostics: options.session?.diagnostics ?? [],
     error: options.error instanceof Error ? options.error.message : String(options.error),
     platform: "android",
@@ -23441,7 +23996,7 @@ Emulator setup verification:`);
       console.log(JSON.stringify(report, null, 2));
     else
       printAndroidTestReport(report);
-    const screenshot = reportRoot ? await session.screenshot(join56(artifactRoot, "android-emulator.png")) : undefined;
+    const screenshot = reportRoot ? await session.screenshot(join58(artifactRoot, "android-emulator.png")) : undefined;
     await writeRequestedAndroidReport({
       adb,
       args,
@@ -23509,14 +24064,14 @@ Emulator setup verification:`);
     const port = Number(explicit);
     if (!Number.isInteger(port) || port < 1 || port > 65535)
       throw new TypeError("mobile test --port must be a valid TCP port.");
-    const instance2 = listLiveInstances().find((candidate) => resolve44(candidate.cwd) === resolve44(projectRoot) && candidate.source === "dev" && candidate.port === port);
+    const instance2 = listLiveInstances().find((candidate) => resolve46(candidate.cwd) === resolve46(projectRoot) && candidate.source === "dev" && candidate.port === port);
     return {
       https: instance2?.https ?? args.includes("--https"),
       instance: instance2,
       port
     };
   }
-  const instances = listLiveInstances().filter((instance2) => resolve44(instance2.cwd) === resolve44(projectRoot) && instance2.source === "dev" && instance2.port !== null);
+  const instances = listLiveInstances().filter((instance2) => resolve46(instance2.cwd) === resolve46(projectRoot) && instance2.source === "dev" && instance2.port !== null);
   if (instances.length !== 1)
     throw new TypeError(instances.length === 0 ? "No running AbsoluteJS dev server was found for this project. Start `bun dev`, wait for iOS to report ready, then run `absolute mobile test ios`." : "Multiple dev servers are running for this project. Select one with mobile test ios --port <port>.");
   const [instance] = instances;
@@ -23630,8 +24185,8 @@ Emulator setup verification:`);
     throw new Error(`${label} failed: ${result.stderr.trim() || result.stdout.trim() || `status ${result.exitCode}`}`);
   return result;
 }, writeIosFailureArtifacts = async (options) => {
-  await mkdir16(options.artifactRoot, { recursive: true });
-  const screenshot = join56(options.artifactRoot, "ios-failure.png");
+  await mkdir17(options.artifactRoot, { recursive: true });
+  const screenshot = join58(options.artifactRoot, "ios-failure.png");
   const screenshotResult = captureCommand4([
     options.xcrun,
     "simctl",
@@ -23640,8 +24195,8 @@ Emulator setup verification:`);
     "screenshot",
     screenshot
   ]);
-  const diagnosticPath = join56(options.artifactRoot, "ios-failure.json");
-  await writeFile18(diagnosticPath, `${JSON.stringify({
+  const diagnosticPath = join58(options.artifactRoot, "ios-failure.json");
+  await writeFile20(diagnosticPath, `${JSON.stringify({
     appId: options.appId,
     error: options.error instanceof Error ? options.error.message : String(options.error),
     platform: "ios",
@@ -23666,8 +24221,8 @@ Emulator setup verification:`);
 }, absolutejsVersionForReport = async () => {
   let absolutejsVersion = process.env.ABSOLUTE_VERSION ?? "unknown";
   const versions = await Promise.all([
-    resolve44(import.meta.dir, "..", "..", "package.json"),
-    resolve44(import.meta.dir, "..", "..", "..", "package.json")
+    resolve46(import.meta.dir, "..", "..", "package.json"),
+    resolve46(import.meta.dir, "..", "..", "..", "package.json")
   ].map((candidate) => readPackageVersionForIosReport(candidate).catch(() => "unknown")));
   for (const version2 of versions) {
     if (version2 === "unknown")
@@ -23886,8 +24441,8 @@ Emulator setup verification:`);
       mobile.appId
     ], "iOS app launch");
     await waitForIosHmrClient({ https, port, timeoutMs });
-    await mkdir16(artifactRoot, { recursive: true });
-    const screenshot = join56(artifactRoot, "ios-simulator.png");
+    await mkdir17(artifactRoot, { recursive: true });
+    const screenshot = join58(artifactRoot, "ios-simulator.png");
     requireCapturedCommand([xcrun, "simctl", "io", simulator.udid, "screenshot", screenshot], "iOS simulator screenshot");
     const hmrApply = await waitForRequestedIosHmr(args, instance, timeoutMs);
     const report = {
@@ -24024,6 +24579,22 @@ Emulator setup verification:`);
     await buildIos(args.slice(2));
     return;
   }
+  if (command === "update" && args[1] === "build") {
+    await buildMobileUpdate(args.slice(2));
+    return;
+  }
+  if (command === "update" && args[1] === "publish") {
+    await publishMobileUpdate(args.slice(2));
+    return;
+  }
+  if (command === "update" && args[1] === "promote") {
+    await promoteMobileUpdate(args.slice(2));
+    return;
+  }
+  if (command === "update" && args[1] === "rollback") {
+    await rollbackMobileUpdate(args.slice(2));
+    return;
+  }
   if (command === "publish" && args[1] === "android") {
     await publishAndroid(args.slice(2));
     return;
@@ -24032,7 +24603,7 @@ Emulator setup verification:`);
     await publishIos(args.slice(2));
     return;
   }
-  throw new TypeError("Usage: absolute mobile <pair mac <name> <user@host> [--port n] [--workspace path] | remotes [inspect [name] [--json] | clean [name] --yes | --json] | unpair mac <name> | init [--no-native] [--force] | sync [ios|android] | inspect [--json] [--require-bundle] | associations [--outdir dir] [--verify] | ci github [server-entry] [--publish] [--registry module] [--secret-env NAME] [--output path] [--force] [--json] | doctor [ios|android|release [ios|android]] [--remote name] [--json|--fix [--yes]] | build <android|ios> [server-entry] [--remote name] [--outdir dir] [--web-outdir dir] [--unsigned] | publish android [server-entry] [--registry module] [--channel name] [--play-track track] [--play-status completed|draft|halted|in-progress] [--play-rollout fraction] [--play-name name] [--play-notes language=text] [--play-update-priority 0..5] [--play-hold-review] [--play-cancel-existing-review] [--outdir dir] [--web-outdir dir] [--unsigned] | publish ios [server-entry] [--remote name] [--registry module] [--channel name] [--testflight-group name-or-id] [--testflight-notes locale=text] [--testflight-submit-review] [--outdir dir] [--web-outdir dir] [--unsigned] | test android [--route path] [--wait-for-hmr] [--report [dir]] [--timeout ms] [--port n] [--serial id] [--artifacts dir] [--json] | test ios [--device identifier [--remote name] | --udid id] [--wait-for-hmr] [--report [dir]] [--timeout ms] [--port n] [--artifacts dir] [--json]> [--config path]");
+  throw new TypeError("Usage: absolute mobile <pair mac <name> <user@host> [--port n] [--workspace path] | remotes [inspect [name] [--json] | clean [name] --yes | --json] | unpair mac <name> | init [--no-native] [--force] | sync [ios|android] | inspect [--json] [--require-bundle] | associations [--outdir dir] [--verify] | ci github [server-entry] [--publish] [--registry module] [--secret-env NAME] [--output path] [--force] [--json] | doctor [ios|android|release [ios|android]] [--remote name] [--json|--fix [--yes]] | build <android|ios> [server-entry] [--remote name] [--outdir dir] [--web-outdir dir] [--unsigned] | update build [server-entry] --classification bug-fix|content|security --key-id id --signing-key path --within-submitted-purpose [--outdir dir] [--web-outdir dir] | update publish <release-directory> [--rollout fraction] [--registry module] | update promote --release id --rollout fraction [--registry module] | update rollback [--release id] [--registry module] | publish android [server-entry] [--registry module] [--channel name] [--play-track track] [--play-status completed|draft|halted|in-progress] [--play-rollout fraction] [--play-name name] [--play-notes language=text] [--play-update-priority 0..5] [--play-hold-review] [--play-cancel-existing-review] [--outdir dir] [--web-outdir dir] [--unsigned] | publish ios [server-entry] [--remote name] [--registry module] [--channel name] [--testflight-group name-or-id] [--testflight-notes locale=text] [--testflight-submit-review] [--outdir dir] [--web-outdir dir] [--unsigned] | test android [--route path] [--wait-for-hmr] [--report [dir]] [--timeout ms] [--port n] [--serial id] [--artifacts dir] [--json] | test ios [--device identifier [--remote name] | --udid id] [--wait-for-hmr] [--report [dir]] [--timeout ms] [--port n] [--artifacts dir] [--json]> [--config path]");
 };
 var init_mobile = __esm(() => {
   init_dependencies();
@@ -24042,6 +24613,7 @@ var init_mobile = __esm(() => {
   init_nativeDeepLinks();
   init_nativeDeviceCapabilities();
   init_nativeBackgroundSync();
+  init_nativeUpdates();
   init_emulatorDoctor();
   init_emulatorInstaller();
   init_associationFiles();
@@ -24069,6 +24641,8 @@ var init_mobile = __esm(() => {
   init_deviceCapabilities();
   init_mobileInspect();
   init_ciWorkflow();
+  init_updateSigning();
+  init_updatePublisher();
   CAPACITOR_PACKAGES = [
     "@capacitor/core",
     "@capacitor/app",
@@ -24104,10 +24678,10 @@ var exports_typecheck = {};
 __export(exports_typecheck, {
   typecheck: () => typecheck
 });
-import { resolve as resolve45, join as join57 } from "path";
+import { resolve as resolve47, join as join59 } from "path";
 import { existsSync as existsSync44, readFileSync as readFileSync40 } from "fs";
-import { mkdir as mkdir17, writeFile as writeFile19 } from "fs/promises";
-var isCommandService3 = (service) => service.kind === "command" || Array.isArray(service.command), resolveConfigPath = (configPath2) => resolve45(configPath2 ?? process.env.ABSOLUTE_CONFIG ?? "absolute.config.ts"), getTypecheckTargets = async (configPath2) => {
+import { mkdir as mkdir18, writeFile as writeFile21 } from "fs/promises";
+var isCommandService3 = (service) => service.kind === "command" || Array.isArray(service.command), resolveConfigPath = (configPath2) => resolve47(configPath2 ?? process.env.ABSOLUTE_CONFIG ?? "absolute.config.ts"), getTypecheckTargets = async (configPath2) => {
   if (!existsSync44(resolveConfigPath(configPath2))) {
     const defaultService = {};
     return [defaultService];
@@ -24129,7 +24703,7 @@ var isCommandService3 = (service) => service.kind === "command" || Array.isArray
   const exitCode = await proc.exited;
   return { exitCode, name, output: (stdout + stderr).trim() };
 }, shellEscape = (value) => `'${value.replaceAll("'", "'\\''")}'`, runShell = async (name, command) => run(name, ["/bin/bash", "-lc", command]), findBin = (name) => {
-  const local = resolve45("node_modules", ".bin", name);
+  const local = resolve47("node_modules", ".bin", name);
   return existsSync44(local) ? local : null;
 }, ANSI_COLOR_REGEX, ANSI_PURPLE_REGEX, ANSI_CYAN_REGEX, ANSI_TOKEN_END_REGEX, stripAnsi4 = (str) => str.replace(ANSI_COLOR_REGEX, ""), formatSvelteOutput = (output) => {
   const cwd = `${process.cwd()}/`;
@@ -24177,15 +24751,15 @@ Found ${errorCount} error${suffix}.`;
   return formatted;
 }, ABSOLUTE_INTERNAL_EXCLUDES, resolveAbsoluteTypeFile = (fileName) => {
   const candidates = [
-    resolve45("node_modules/@absolutejs/absolute/dist/types", fileName),
-    resolve45(import.meta.dir, "../types", fileName),
-    resolve45(import.meta.dir, "../../types", fileName),
-    resolve45(import.meta.dir, "../../../types", fileName)
+    resolve47("node_modules/@absolutejs/absolute/dist/types", fileName),
+    resolve47(import.meta.dir, "../types", fileName),
+    resolve47(import.meta.dir, "../../types", fileName),
+    resolve47(import.meta.dir, "../../../types", fileName)
   ];
   return candidates.find((candidate) => existsSync44(candidate)) ?? candidates[0];
 }, ABSOLUTE_TYPECHECK_FILES, readProjectTsconfig = () => {
   try {
-    return JSON.parse(readFileSync40(resolve45("tsconfig.json"), "utf-8"));
+    return JSON.parse(readFileSync40(resolve47("tsconfig.json"), "utf-8"));
   } catch {
     return {};
   }
@@ -24213,27 +24787,27 @@ Found ${errorCount} error${suffix}.`;
     console.error("\x1B[31m\u2717\x1B[0m vue-tsc is required for Vue type checking. Install it: bun add -d vue-tsc");
     process.exit(1);
   }
-  const vueTsconfigPath = join57(cacheDir, "tsconfig.vue-check.json");
-  await writeFile19(vueTsconfigPath, JSON.stringify({
+  const vueTsconfigPath = join59(cacheDir, "tsconfig.vue-check.json");
+  await writeFile21(vueTsconfigPath, JSON.stringify({
     compilerOptions: {
       rootDir: ".."
     },
     exclude: getProjectTypecheckExcludes(),
-    extends: resolve45("tsconfig.json"),
+    extends: resolve47("tsconfig.json"),
     include: getProjectTypecheckIncludes()
   }, null, "\t"));
   const base = [
     vueTscBin,
     "--noEmit",
     "--project",
-    resolve45(vueTsconfigPath),
+    resolve47(vueTsconfigPath),
     "--pretty"
   ];
   const cached = await run("vue-tsc", [
     ...base,
     "--incremental",
     "--tsBuildInfoFile",
-    join57(cacheDir, "vue-tsc.tsbuildinfo")
+    join59(cacheDir, "vue-tsc.tsbuildinfo")
   ]);
   if (cached.exitCode === 0 || cached.output.length > 0)
     return cached;
@@ -24244,8 +24818,8 @@ Found ${errorCount} error${suffix}.`;
     console.error("\x1B[31m\u2717\x1B[0m @angular/compiler-cli is required for Angular type checking. Install it: bun add -d @angular/compiler-cli");
     process.exit(1);
   }
-  const angularTsconfigPath = join57(cacheDir, "tsconfig.angular-check.json");
-  await writeFile19(angularTsconfigPath, JSON.stringify({
+  const angularTsconfigPath = join59(cacheDir, "tsconfig.angular-check.json");
+  await writeFile21(angularTsconfigPath, JSON.stringify({
     angularCompilerOptions: {
       strictTemplates: true
     },
@@ -24254,32 +24828,32 @@ Found ${errorCount} error${suffix}.`;
       rootDir: ".."
     },
     exclude: ABSOLUTE_INTERNAL_EXCLUDES.map(toGeneratedConfigPath),
-    extends: resolve45("tsconfig.json"),
+    extends: resolve47("tsconfig.json"),
     include: [`../${angularDir}/**/*`]
   }, null, "\t"));
-  return runShell("ngc", `${shellEscape(ngcBin)} -p ${shellEscape(resolve45(angularTsconfigPath))}`);
+  return runShell("ngc", `${shellEscape(ngcBin)} -p ${shellEscape(resolve47(angularTsconfigPath))}`);
 }, buildTscCheck = (cacheDir) => {
   const tscBin = findBin("tsc");
   if (!tscBin) {
     console.error("\x1B[31m\u2717\x1B[0m typescript is required for type checking. Install it: bun add -d typescript");
     process.exit(1);
   }
-  const tscConfigPath = join57(cacheDir, "tsconfig.typecheck.json");
-  return writeFile19(tscConfigPath, JSON.stringify({
+  const tscConfigPath = join59(cacheDir, "tsconfig.typecheck.json");
+  return writeFile21(tscConfigPath, JSON.stringify({
     compilerOptions: {
       rootDir: ".."
     },
     exclude: getProjectTypecheckExcludes(),
-    extends: resolve45("tsconfig.json"),
+    extends: resolve47("tsconfig.json"),
     include: getProjectTypecheckIncludes()
   }, null, "\t")).then(() => run("tsc", [
     tscBin,
     "--noEmit",
     "--project",
-    resolve45(tscConfigPath),
+    resolve47(tscConfigPath),
     "--incremental",
     "--tsBuildInfoFile",
-    join57(cacheDir, "tsc.tsbuildinfo"),
+    join59(cacheDir, "tsc.tsbuildinfo"),
     "--pretty"
   ]));
 }, buildSvelteCheck = async (cacheDir, svelteDir) => {
@@ -24288,16 +24862,16 @@ Found ${errorCount} error${suffix}.`;
     console.error("\x1B[31m\u2717\x1B[0m svelte-check is required for Svelte type checking. Install it: bun add -d svelte-check");
     process.exit(1);
   }
-  const svelteTsconfigPath = join57(cacheDir, "tsconfig.svelte-check.json");
-  await writeFile19(svelteTsconfigPath, JSON.stringify({
-    extends: resolve45("tsconfig.json"),
+  const svelteTsconfigPath = join59(cacheDir, "tsconfig.svelte-check.json");
+  await writeFile21(svelteTsconfigPath, JSON.stringify({
+    extends: resolve47("tsconfig.json"),
     files: ABSOLUTE_TYPECHECK_FILES,
     include: [`../${svelteDir}/**/*`]
   }, null, "\t"));
   return run("svelte-check", [
     svelteBin,
     "--tsconfig",
-    resolve45(svelteTsconfigPath),
+    resolve47(svelteTsconfigPath),
     "--threshold",
     "error",
     "--compiler-warnings",
@@ -24318,7 +24892,7 @@ Found ${errorCount} error${suffix}.`;
     ...new Set(targets.map((config) => config.angularDirectory).filter((dir) => typeof dir === "string" && dir.length > 0))
   ];
   const cacheDir = ".absolutejs";
-  await mkdir17(cacheDir, { recursive: true });
+  await mkdir18(cacheDir, { recursive: true });
   const checks = [];
   checks.push(hasVue ? buildVueTscCheck(cacheDir) : buildTscCheck(cacheDir));
   for (const svelteDir of hasSvelte ? svelteDirs : []) {
@@ -24491,11 +25065,11 @@ var DEFAULT_RELAY_PORT = 8787, DEFAULT_REQUEST_TIMEOUT_MS = 30000, headersToObje
         url: url.pathname + url.search,
         ...bodyBytes && bodyBytes.length > 0 ? { bodyBase64: Buffer.from(bodyBytes).toString("base64") } : {}
       };
-      const responsePromise = new Promise((resolve46) => {
-        pending.set(id, resolve46);
+      const responsePromise = new Promise((resolve48) => {
+        pending.set(id, resolve48);
       });
       client.send(encodeTunnelMessage(message));
-      const timeout = new Promise((resolve46) => setTimeout(() => resolve46({ id, message: "timeout", type: "error" }), requestTimeoutMs));
+      const timeout = new Promise((resolve48) => setTimeout(() => resolve48({ id, message: "timeout", type: "error" }), requestTimeoutMs));
       const result = await Promise.race([responsePromise, timeout]);
       pending.delete(id);
       if (result.type === "error") {