@absolutejs/absolute 0.20.0-beta.80 → 0.20.0-beta.82

package/dist/cli/{mobile-mfp26v2d.js → mobile-hkxh2ab5.js}

@@ -4,12 +4,12 @@ import {
 } from "./index-zh6hhrwy.js";
 import {
   start
-} from "./index-d4ar3mwd.js";
+} from "./index-q78x1k9q.js";
 import {
   ABSOLUTE_MOBILE_CLIENT_MANIFEST_FORMAT,
   ABSOLUTE_MOBILE_PAGE_PROTOCOL_VERSION,
   resolveAbsoluteMobileRoute
-} from "./index-w5y7wxn9.js";
+} from "./index-8gksmws3.js";
 import"./index-bzs19w3r.js";
 import"./index-s2tazax7.js";
 import {
@@ -49,7 +49,7 @@ import {
 import"./index-w5vswatm.js";
 import {
   normalizeAbsoluteMobileConfig
-} from "./index-6fb7k6dg.js";
+} from "./index-czw3jd8f.js";
 import {
   ABSOLUTE_MOBILE_UPDATE_FORMAT,
   absoluteDeviceNativeRequirements,
@@ -16768,15 +16768,15 @@ var require_main = __commonJS(function(exports) {
 
 // src/cli/scripts/mobile.ts
 import {
-  access as access11,
-  mkdir as mkdir11,
+  access as access12,
+  mkdir as mkdir12,
   mkdtemp as mkdtemp3,
   readFile as readFile16,
   rm as rm6,
   writeFile as writeFile14
 } from "fs/promises";
-import { createPublicKey } from "crypto";
-import { join as join13, relative as relative10, resolve as resolve11 } from "path";
+import { createPublicKey as createPublicKey2 } from "crypto";
+import { join as join13, relative as relative11, resolve as resolve12 } from "path";
 import { createInterface } from "readline/promises";
 
 // src/mobile/nativeDeepLinks.ts
@@ -19083,8 +19083,8 @@ var waitForAbsoluteAndroidHmrApply = async (session, options) => {
 };
 
 // src/mobile/releaseDoctor.ts
-import { access as access3, readFile as readFile8, readdir as readdir3 } from "fs/promises";
-import { dirname as dirname4, extname, join as join7, relative as relative2 } from "path";
+import { access as access4, readFile as readFile8, readdir as readdir3 } from "fs/promises";
+import { dirname as dirname5, extname, join as join7, relative as relative3 } from "path";
 
 // src/mobile/mobileBundleInspection.ts
 import { createHash } from "crypto";
@@ -19240,6 +19240,202 @@ var inspectAbsoluteMobileBundle = async (config, projectRoot) => {
   }
 };
 
+// src/mobile/updateServer.ts
+import {
+  createPrivateKey,
+  createPublicKey,
+  X509Certificate
+} from "crypto";
+import { access as access3, mkdir as mkdir5 } from "fs/promises";
+import { dirname as dirname4, isAbsolute, relative as relative2, resolve as resolve4, sep } from "path";
+import { pathToFileURL } from "url";
+import { Elysia as Elysia2 } from "elysia";
+var ABSOLUTE_MOBILE_UPDATE_SERVER_FORMAT = 1;
+var DEFAULT_MOBILE_UPDATE_REGISTRY_MODULE = "mobile.update.ts";
+var object = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var projectPath = (projectRoot, requested) => {
+  const root = resolve4(projectRoot);
+  const path = resolve4(root, requested);
+  const projectRelative = relative2(root, path);
+  if (projectRelative === ".." || projectRelative.startsWith(`..${sep}`) || isAbsolute(projectRelative))
+    throw new TypeError("mobile.updates.server.registry must remain inside the project.");
+  return path;
+};
+var isRegistry = (value) => object(value) && [
+  "publishUpdate",
+  "promoteUpdate",
+  "rollbackUpdate",
+  "resolveUpdate",
+  "readUpdateFile"
+].every((method) => typeof value[method] === "function");
+var serverMetadata = (value) => {
+  if (!object(value))
+    throw new TypeError("Mobile update registry must export valid absoluteMobileUpdateServer metadata. Run `absolute mobile update provision`.");
+  const { format, provider, storage } = value;
+  if (format !== ABSOLUTE_MOBILE_UPDATE_SERVER_FORMAT || storage !== "local" && storage !== "durable" || typeof provider !== "string" || !provider)
+    throw new TypeError("Mobile update registry must export valid absoluteMobileUpdateServer metadata. Run `absolute mobile update provision`.");
+  const metadata = {
+    format: ABSOLUTE_MOBILE_UPDATE_SERVER_FORMAT,
+    provider,
+    storage
+  };
+  return metadata;
+};
+var loadAbsoluteMobileUpdateServerModule = async (projectRoot, requestedModulePath = DEFAULT_MOBILE_UPDATE_REGISTRY_MODULE) => {
+  const modulePath = projectPath(projectRoot, requestedModulePath);
+  await access3(modulePath).catch(() => {
+    throw new TypeError(`Mobile update server registry does not exist: ${modulePath}. Run \`absolute mobile update provision\`.`);
+  });
+  const loaded = await import(pathToFileURL(modulePath).href);
+  if (!object(loaded))
+    throw new TypeError("Mobile update registry module has no exports.");
+  const registry = loaded.default ?? loaded.registry;
+  if (!isRegistry(registry))
+    throw new TypeError("Mobile update registry must implement publication, promotion, rollback, resolution, and file reads.");
+  const metadata = serverMetadata(loaded.absoluteMobileUpdateServer);
+  const verifier = loaded.verifyAbsoluteMobileUpdateServer;
+  if (metadata.storage === "durable" && typeof verifier !== "function")
+    throw new TypeError("Mobile update registries marked durable must export verifyAbsoluteMobileUpdateServer(). Re-run `absolute mobile update provision --storage s3 --force` or provide an active durability check.");
+  return {
+    metadata,
+    registry,
+    ...typeof verifier === "function" ? {
+      verifyDurability: async () => {
+        await verifier();
+      }
+    } : {}
+  };
+};
+var verifyDurableModule = async (module) => {
+  if (module.metadata.storage !== "durable")
+    throw new TypeError("Mobile production updates require durable object storage. Re-run `absolute mobile update provision --storage s3 --force` or configure a durable adapter.");
+  try {
+    await module.verifyDurability?.();
+  } catch (error) {
+    throw new TypeError(`Durable mobile update storage verification failed for ${module.metadata.provider}. Check the bucket, endpoint, credentials, and read/write/delete permissions.`, { cause: error });
+  }
+};
+var expoSigningOptions = (config) => {
+  if (!config.updates?.expoCodeSigning)
+    return;
+  const entries = Object.entries(config.updateServer?.expoCodeSigningKeys ?? {});
+  const keys = Object.fromEntries(entries.map(([keyId, key]) => {
+    const privateKey = process.env[key.privateKeyEnv];
+    if (!privateKey)
+      throw new TypeError(`Expo update serving requires ${key.privateKeyEnv} on the trusted server.`);
+    try {
+      const certificate = new X509Certificate(key.certificatePem);
+      const expected = certificate.publicKey.export({
+        format: "der",
+        type: "spki"
+      });
+      const actual = createPublicKey(createPrivateKey(privateKey)).export({
+        format: "der",
+        type: "spki"
+      });
+      if (!expected.equals(actual))
+        throw new Error("key mismatch");
+    } catch (error) {
+      throw new TypeError(`${key.privateKeyEnv} must contain the RSA private key matching Expo update key ${keyId}.`, { cause: error });
+    }
+    return [keyId, { certificate: key.certificatePem, privateKey }];
+  }));
+  return { keys };
+};
+var inspectAbsoluteMobileUpdateServer = async (config, projectRoot) => {
+  if (!config.updates)
+    return;
+  const module = await loadAbsoluteMobileUpdateServerModule(projectRoot, config.updateServer?.registryModule);
+  await verifyDurableModule(module);
+  if (config.engine === "expo")
+    expoSigningOptions(config);
+  return module.metadata;
+};
+var publicKeysSource = (publicKeys) => JSON.stringify(publicKeys, null, "\t");
+var renderAbsoluteMobileUpdateRegistry = (options) => {
+  const metadata = `export const absoluteMobileUpdateServer = {
+	format: 1,
+	provider: '${options.storage}',
+	storage: '${options.storage === "local" ? "local" : "durable"}'
+} as const;`;
+  if (options.storage === "local")
+    return `import { fileURLToPath } from 'node:url';
+import { localBlobStore } from '@absolutejs/blob/local';
+import { createMobileUpdateRegistry } from '@absolutejs/deploy/mobile-update';
+
+${metadata}
+
+const store = localBlobStore({
+	root: process.env.ABSOLUTE_MOBILE_UPDATE_LOCAL_ROOT ??
+		fileURLToPath(new URL('./.absolutejs/mobile/update-registry/', import.meta.url))
+});
+
+export default createMobileUpdateRegistry({
+	publicKeys: ${publicKeysSource(options.publicKeys)},
+	store
+});
+`;
+  return `import { randomUUID } from 'node:crypto';
+import { DeleteObjectCommand, GetObjectCommand, PutObjectCommand, S3Client } from '@aws-sdk/client-s3';
+import { awsS3BlobStore } from '@absolutejs/blob/aws-s3';
+import { createMobileUpdateRegistry } from '@absolutejs/deploy/mobile-update';
+
+${metadata}
+
+const required = (name: string) => {
+	const value = process.env[name];
+	if (!value) throw new Error(\`Missing \${name}\`);
+	return value;
+};
+
+const bucket = required('ABSOLUTE_MOBILE_UPDATE_S3_BUCKET');
+const client = new S3Client({
+	region: process.env.ABSOLUTE_MOBILE_UPDATE_S3_REGION ?? 'auto',
+	forcePathStyle: process.env.ABSOLUTE_MOBILE_UPDATE_S3_FORCE_PATH_STYLE === '1',
+	...(process.env.ABSOLUTE_MOBILE_UPDATE_S3_ENDPOINT
+		? { endpoint: process.env.ABSOLUTE_MOBILE_UPDATE_S3_ENDPOINT }
+		: {})
+});
+const store = awsS3BlobStore({ bucket, client });
+
+export const verifyAbsoluteMobileUpdateServer = async () => {
+	const key = \`absolutejs/mobile-updates/_health/\${randomUUID()}\`;
+	const expected = randomUUID();
+	let stored = false;
+	try {
+		await client.send(new PutObjectCommand({ Bucket: bucket, Key: key, Body: expected }));
+		stored = true;
+		const response = await client.send(new GetObjectCommand({ Bucket: bucket, Key: key }));
+		if ((await response.Body?.transformToString()) !== expected)
+			throw new Error('Durability probe read did not match its write.');
+	} finally {
+		if (stored) await client.send(new DeleteObjectCommand({ Bucket: bucket, Key: key }));
+	}
+};
+
+export default createMobileUpdateRegistry({
+	publicKeys: ${publicKeysSource(options.publicKeys)},
+	store
+});
+`;
+};
+var writeAbsoluteMobileUpdateRegistry = async (options) => {
+  const path = projectPath(options.projectRoot, options.modulePath ?? DEFAULT_MOBILE_UPDATE_REGISTRY_MODULE);
+  if (!options.force) {
+    await access3(path).then(() => {
+      throw new TypeError(`Mobile update registry already exists: ${path}. Pass --force to replace it.`);
+    }, () => {
+      return;
+    });
+  }
+  await mkdir5(dirname4(path), { recursive: true });
+  await Bun.write(path, renderAbsoluteMobileUpdateRegistry({
+    publicKeys: options.publicKeys,
+    storage: options.storage
+  }));
+  return path;
+};
+
 // src/mobile/releaseDoctor.ts
 var ABSOLUTE_MOBILE_COMPLIANCE_REPORT_FORMAT = 1;
 var HMR_ASSET_PATTERN = /(?:__HMR_WS__|hmr-timing|__absolute_target|absolutejs-error-overlay)/u;
@@ -19262,7 +19458,7 @@ var MANUAL_REVIEW = [
 ];
 var pathExists2 = async (path) => {
   try {
-    await access3(path);
+    await access4(path);
     return true;
   } catch {
     return false;
@@ -19298,6 +19494,16 @@ var warn = (id, detail, path, remediation) => ({
   remediation,
   status: "warn"
 });
+var mobileUpdateServerCheck = async (config, projectRoot) => {
+  if (!config.updates)
+    return;
+  try {
+    const metadata = await inspectAbsoluteMobileUpdateServer(config, projectRoot);
+    return pass("updates.trusted-server", `The trusted update server proved durable ${metadata?.provider ?? "object"} storage read/write/delete access, supports publish/promote/rollback, and has valid server-only signing material.`, config.updateServer?.registryModule);
+  } catch (error) {
+    return fail("updates.trusted-server", error instanceof Error ? error.message : "The trusted mobile update server is not release-ready.", config.updateServer?.registryModule ?? "mobile.update.ts", "Run `absolute mobile update provision --storage s3 --force`, provision its environment variables on the trusted server, and rerun the release doctor.");
+  }
+};
 var isRecord3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var readJsonObject = async (path) => {
   const value = JSON.parse(await readFile8(path, "utf8"));
@@ -19445,7 +19651,7 @@ var manifestReleaseCheck = async (manifestPath) => {
   const source = await readFile8(manifestPath, "utf8");
   const cleartext = /android:usesCleartextTraffic=["']true["']/u.test(source);
   const networkConfigName = source.match(/android:networkSecurityConfig=["']@xml\/([a-z0-9_]+)["']/u)?.[1];
-  const networkConfigPath = networkConfigName ? join7(dirname4(manifestPath), "res", "xml", `${networkConfigName}.xml`) : undefined;
+  const networkConfigPath = networkConfigName ? join7(dirname5(manifestPath), "res", "xml", `${networkConfigName}.xml`) : undefined;
   const developmentTrustReference = /android:networkSecurityConfig=["']@xml\/absolutejs_dev_network_security["']/u.test(source);
   const developmentTrustContents = networkConfigPath ? await readFile8(networkConfigPath, "utf8").then((value) => value.includes("@raw/absolutejs_dev_ca")).catch(() => false) : false;
   const developmentTrust = developmentTrustReference || developmentTrustContents;
@@ -19657,7 +19863,7 @@ var nativeObservabilityProjectionCheck = async (config, platform) => {
   return registration && plugin ? pass("android.native-observability", "The Android process-exit collector is projected and registered.", plugin) : fail("android.native-observability", "The Android process-exit collector is missing or unregistered.", plugin ?? sourceRoot, "Run `absolute mobile sync android` before building the release.");
 };
 var iosNativeSecurityCheck = async (iosRoot) => {
-  const applicationFiles = async (extensions) => (await sourceFiles(iosRoot, extensions)).filter((path) => !relative2(iosRoot, path).split(/[\\/]/u).some((part) => ["Pods", "DerivedData", "build"].includes(part)));
+  const applicationFiles = async (extensions) => (await sourceFiles(iosRoot, extensions)).filter((path) => !relative3(iosRoot, path).split(/[\\/]/u).some((part) => ["Pods", "DerivedData", "build"].includes(part)));
   const entitlementPaths = await applicationFiles(new Set([".entitlements"]));
   const unsafeEntitlements = await containsPattern(entitlementPaths, /<key>(?:com\.apple\.security\.)?get-task-allow<\/key>\s*<true\s*\/>/u);
   if (unsafeEntitlements)
@@ -19671,12 +19877,12 @@ var iosNativeSecurityCheck = async (iosRoot) => {
 var iosDeepLinkProjectionCheck = async (config, iosRoot) => {
   const infoPath = join7(iosRoot, "App/App/Info.plist");
   const entitlementsPath = join7(iosRoot, "App/AbsoluteJS.entitlements");
-  const projectPath = join7(iosRoot, "App/App.xcodeproj/project.pbxproj");
+  const projectPath2 = join7(iosRoot, "App/App.xcodeproj/project.pbxproj");
   try {
     const [info, entitlements, project] = await Promise.all([
       readFile8(infoPath, "utf8"),
       readFile8(entitlementsPath, "utf8"),
-      readFile8(projectPath, "utf8")
+      readFile8(projectPath2, "utf8")
     ]);
     if (config.deepLinkScheme && (!info.includes("<key>CFBundleURLTypes</key>") || !info.includes(`<string>${config.deepLinkScheme}</string>`)))
       throw new TypeError("iOS custom URL scheme does not match mobile config.");
@@ -19761,8 +19967,8 @@ var expoIosPushCapabilityCheck = async (iosRoot, requirements) => {
 };
 var expoIosCapabilityProjectionCheck = async (config, requirements) => {
   const iosRoot = join7(config.nativeProjectDirectory, "ios");
-  const projectPath = await uniqueExpoIosFile(iosRoot, "**/*.xcodeproj/project.pbxproj", "Xcode project");
-  const project = await readFile8(projectPath, "utf8");
+  const projectPath2 = await uniqueExpoIosFile(iosRoot, "**/*.xcodeproj/project.pbxproj", "Xcode project");
+  const project = await readFile8(projectPath2, "utf8");
   const privacy = await expoIosPrivacyCapabilityCheck(iosRoot, project, requirements);
   if (privacy)
     return privacy;
@@ -19780,10 +19986,10 @@ var iosCapabilityProjectionCheck = async (config, requirements) => {
     return fail("mobile.device-capabilities", "iOS system-bar capability is missing its required view-controller setting.", infoPath, "Run `absolute mobile sync ios` to regenerate native capability settings.");
   if (requirements.iosPrivacyAccessedApis.length > 0) {
     const privacyPath = join7(appRoot, "PrivacyInfo.xcprivacy");
-    const projectPath = join7(config.nativeProjectDirectory, "ios/App/App.xcodeproj/project.pbxproj");
+    const projectPath2 = join7(config.nativeProjectDirectory, "ios/App/App.xcodeproj/project.pbxproj");
     const [privacy, project] = await Promise.all([
       readFile8(privacyPath, "utf8").catch(() => ""),
-      readFile8(projectPath, "utf8").catch(() => "")
+      readFile8(projectPath2, "utf8").catch(() => "")
     ]);
     const missing = requirements.iosPrivacyAccessedApis.some(({ api, reasons }) => !privacy.includes(`<string>${api}</string>`) || reasons.some((reason) => !privacy.includes(`<string>${reason}</string>`)));
     if (missing || !project.includes("PrivacyInfo.xcprivacy in Resources"))
@@ -19856,7 +20062,7 @@ var inspectAndroidRelease = async (config, projectRoot) => {
   ]);
   return checks.filter((check) => check !== undefined).map((check) => ({
     ...check,
-    path: check.path ? relative2(projectRoot, check.path).replaceAll("\\", "/") || "." : undefined
+    path: check.path ? relative3(projectRoot, check.path).replaceAll("\\", "/") || "." : undefined
   }));
 };
 var inspectExpoAndroidRelease = async (config, projectRoot) => {
@@ -19878,7 +20084,7 @@ var inspectExpoAndroidRelease = async (config, projectRoot) => {
   ]);
   return checks.filter((check) => check !== undefined).map((check) => ({
     ...check,
-    path: check.path ? relative2(projectRoot, check.path).replaceAll("\\", "/") || "." : undefined
+    path: check.path ? relative3(projectRoot, check.path).replaceAll("\\", "/") || "." : undefined
   }));
 };
 var uniqueExpoIosFile = async (iosRoot, pattern, label) => {
@@ -19892,7 +20098,7 @@ var uniqueExpoIosFile = async (iosRoot, pattern, label) => {
 };
 var expoIosNativeProjectionCheck = async (config, iosRoot) => {
   try {
-    const [infoPath, entitlementsPath, projectPath] = await Promise.all([
+    const [infoPath, entitlementsPath, projectPath2] = await Promise.all([
       uniqueExpoIosFile(iosRoot, "**/Info.plist", "Info.plist"),
       uniqueExpoIosFile(iosRoot, "**/*.entitlements", "entitlements"),
       uniqueExpoIosFile(iosRoot, "**/*.xcodeproj/project.pbxproj", "Xcode project")
@@ -19900,7 +20106,7 @@ var expoIosNativeProjectionCheck = async (config, iosRoot) => {
     const [info, entitlements, project] = await Promise.all([
       readFile8(infoPath, "utf8"),
       readFile8(entitlementsPath, "utf8"),
-      readFile8(projectPath, "utf8")
+      readFile8(projectPath2, "utf8")
     ]);
     if (/<key>NSAllowsArbitraryLoads<\/key>\s*<true\s*\/>/u.test(info))
       throw new TypeError("Expo iOS App Transport Security permits arbitrary network loads.");
@@ -19936,7 +20142,7 @@ var inspectExpoIosRelease = async (config, projectRoot) => {
     checks.push(nativeObservability);
   return checks.map((check) => ({
     ...check,
-    path: check.path ? relative2(projectRoot, check.path).replaceAll("\\", "/") || "." : undefined
+    path: check.path ? relative3(projectRoot, check.path).replaceAll("\\", "/") || "." : undefined
   }));
 };
 var inspectIosRelease = async (config, projectRoot) => {
@@ -19978,7 +20184,7 @@ var inspectIosRelease = async (config, projectRoot) => {
     checks.push(updateWatchdog);
   return checks.map((check) => ({
     ...check,
-    path: check.path ? relative2(projectRoot, check.path).replaceAll("\\", "/") || "." : undefined
+    path: check.path ? relative3(projectRoot, check.path).replaceAll("\\", "/") || "." : undefined
   }));
 };
 var createAbsoluteMobileComplianceReport = (config, result) => {
@@ -20006,11 +20212,12 @@ var inspectAbsoluteMobileRelease = async (config, projectRoot) => {
     Promise.resolve(productionOriginCheck(config, projectRoot)),
     Promise.resolve(associationIdentityCheck(config, projectRoot)),
     dependencyLockCheck(projectRoot),
-    config.engine === "expo" ? expoVersionCheck(config) : capacitorVersionCheck(config, projectRoot)
+    config.engine === "expo" ? expoVersionCheck(config) : capacitorVersionCheck(config, projectRoot),
+    mobileUpdateServerCheck(config, projectRoot)
   ]);
-  const checks = globalChecks.map((check) => ({
+  const checks = globalChecks.filter((check) => check !== undefined).map((check) => ({
     ...check,
-    path: check.path ? relative2(projectRoot, check.path).replaceAll("\\", "/") || "." : undefined
+    path: check.path ? relative3(projectRoot, check.path).replaceAll("\\", "/") || "." : undefined
   }));
   if (config.platforms.includes("android"))
     checks.push(...config.engine === "expo" ? await inspectExpoAndroidRelease(config, projectRoot) : await inspectAndroidRelease(config, projectRoot));
@@ -20020,13 +20227,13 @@ var inspectAbsoluteMobileRelease = async (config, projectRoot) => {
   if (syncSchema) {
     checks.push({
       ...syncSchema,
-      path: syncSchema.path ? relative2(projectRoot, syncSchema.path).replaceAll("\\", "/") || "." : undefined
+      path: syncSchema.path ? relative3(projectRoot, syncSchema.path).replaceAll("\\", "/") || "." : undefined
     });
   }
   const deviceCapabilities = await deviceCapabilityReleaseCheck(config, projectRoot);
   checks.push({
     ...deviceCapabilities,
-    path: deviceCapabilities.path ? relative2(projectRoot, deviceCapabilities.path).replaceAll("\\", "/") || "." : undefined
+    path: deviceCapabilities.path ? relative3(projectRoot, deviceCapabilities.path).replaceAll("\\", "/") || "." : undefined
   });
   return {
     checks,
@@ -20037,9 +20244,9 @@ var inspectAbsoluteMobileRelease = async (config, projectRoot) => {
 // src/mobile/androidRelease.ts
 import { createHash as createHash2 } from "crypto";
 import {
-  access as access4,
+  access as access5,
   copyFile,
-  mkdir as mkdir5,
+  mkdir as mkdir6,
   mkdtemp,
   readFile as readFile9,
   realpath,
@@ -20048,7 +20255,7 @@ import {
   stat as stat2,
   writeFile as writeFile8
 } from "fs/promises";
-import { dirname as dirname5, isAbsolute, join as join8, relative as relative3, resolve as resolve4, sep } from "path";
+import { dirname as dirname6, isAbsolute as isAbsolute2, join as join8, relative as relative4, resolve as resolve5, sep as sep2 } from "path";
 var ABSOLUTE_ANDROID_RELEASE_FORMAT = 1;
 var isRecord4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var requireManifest = (value) => {
@@ -20063,7 +20270,7 @@ var requireManifest = (value) => {
 };
 var pathExists3 = async (path) => {
   try {
-    await access4(path);
+    await access5(path);
     return true;
   } catch {
     return false;
@@ -20133,10 +20340,10 @@ var fingerprintExpoAndroidProject = async (nativeDirectory) => {
   return createHash2("sha256").update(records.join("")).digest("hex");
 };
 var safeOutputDirectory = (projectRoot, requested) => {
-  const root = resolve4(projectRoot);
-  const output = resolve4(root, requested ?? ".absolutejs/mobile/releases/android");
-  const projectRelative = relative3(root, output);
-  if (projectRelative === ".." || projectRelative.startsWith(`..${sep}`) || isAbsolute(projectRelative)) {
+  const root = resolve5(projectRoot);
+  const output = resolve5(root, requested ?? ".absolutejs/mobile/releases/android");
+  const projectRelative = relative4(root, output);
+  if (projectRelative === ".." || projectRelative.startsWith(`..${sep2}`) || isAbsolute2(projectRelative)) {
     throw new TypeError("mobile build --outdir must remain inside the project.");
   }
   return output;
@@ -20156,8 +20363,8 @@ var installRelease = async (artifactPath, metadata, outputRoot) => {
     }
     return { artifactPath: destination, metadata: existing, releaseRoot };
   }
-  await mkdir5(dirname5(releaseRoot), { recursive: true });
-  const staging = await mkdtemp(join8(dirname5(releaseRoot), ".android-stage-"));
+  await mkdir6(dirname6(releaseRoot), { recursive: true });
+  const staging = await mkdtemp(join8(dirname6(releaseRoot), ".android-stage-"));
   try {
     await copyFile(artifactPath, join8(staging, artifactName));
     const complete = {
@@ -20191,7 +20398,7 @@ var buildAbsoluteAndroidRelease = async (options) => {
   if (options.versionCode !== undefined && (!Number.isSafeInteger(options.versionCode) || options.versionCode < 1 || options.versionCode > 2100000000)) {
     throw new TypeError("Android versionCode must be an integer from 1 through 2100000000.");
   }
-  const projectRoot = resolve4(options.projectRoot);
+  const projectRoot = resolve5(options.projectRoot);
   const host = options.host ?? detectAbsoluteMobileHost();
   if (options.config.engine === "expo" && host === "wsl") {
     throw new TypeError("Expo Android production builds from WSL are not available yet. Run the generated CI workflow on Linux or build from native Windows while the WSL projection is completed.");
@@ -20369,7 +20576,7 @@ var waitForAbsoluteIosHmrLog = async (options) => {
 };
 
 // src/mobile/nativeTestReport.ts
-import { mkdir as mkdir6, readFile as readFile11, writeFile as writeFile9 } from "fs/promises";
+import { mkdir as mkdir7, readFile as readFile11, writeFile as writeFile9 } from "fs/promises";
 import { join as join9 } from "path";
 var secretPattern = /(authorization|access[_ -]?token|refresh[_ -]?token|socket[_ -]?ticket|password|cookie)(\s*[=:]\s*)([^\s,;]+)/giu;
 var bearerPattern = /bearer\s+[^\s,;]+/giu;
@@ -20518,7 +20725,7 @@ ${table(report.manualChecks)}
 `;
 };
 var writeAbsoluteNativeTestReport = async (directory, report) => {
-  await mkdir6(directory, { recursive: true });
+  await mkdir7(directory, { recursive: true });
   const jsonPath = join9(directory, "report.json");
   const markdownPath = join9(directory, "report.md");
   await Promise.all([
@@ -20774,9 +20981,9 @@ var createAbsoluteAndroidTestReport = (options) => {
 };
 
 // src/mobile/releasePublisher.ts
-import { access as access5 } from "fs/promises";
-import { isAbsolute as isAbsolute2, relative as relative4, resolve as resolve5, sep as sep2 } from "path";
-import { pathToFileURL } from "url";
+import { access as access6 } from "fs/promises";
+import { isAbsolute as isAbsolute3, relative as relative5, resolve as resolve6, sep as sep3 } from "path";
+import { pathToFileURL as pathToFileURL2 } from "url";
 var prepareAbsoluteIosRelease = async (publisher, options) => {
   if (typeof publisher.prepareIosRelease !== "function") {
     throw new TypeError("App Store Connect publishing requires a registry module created with @absolutejs/deploy/app-store-connect.");
@@ -20801,20 +21008,20 @@ var prepareAbsoluteAndroidRelease = async (publisher, options) => {
 var isRecord5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var isPublisher = (value) => isRecord5(value) && typeof value.publish === "function";
 var publisherModulePath = (projectRoot, requested) => {
-  const root = resolve5(projectRoot);
-  const path = resolve5(root, requested);
-  const projectRelative = relative4(root, path);
-  if (projectRelative === ".." || projectRelative.startsWith(`..${sep2}`) || isAbsolute2(projectRelative)) {
+  const root = resolve6(projectRoot);
+  const path = resolve6(root, requested);
+  const projectRelative = relative5(root, path);
+  if (projectRelative === ".." || projectRelative.startsWith(`..${sep3}`) || isAbsolute3(projectRelative)) {
     throw new TypeError("mobile publish --registry must remain inside the project.");
   }
   return path;
 };
 var loadAbsoluteNativeReleasePublisher = async (projectRoot, requestedModulePath) => {
   const modulePath = publisherModulePath(projectRoot, requestedModulePath);
-  await access5(modulePath).catch(() => {
+  await access6(modulePath).catch(() => {
     throw new TypeError(`Native release registry module does not exist: ${modulePath}`);
   });
-  const loaded = await import(pathToFileURL(modulePath).href);
+  const loaded = await import(pathToFileURL2(modulePath).href);
   const publisher = isRecord5(loaded) ? loaded.default ?? loaded.registry : undefined;
   if (!isPublisher(publisher)) {
     throw new TypeError("Native release registry module must default-export a registry with publish(options).");
@@ -20873,8 +21080,8 @@ var publishAbsoluteIosRelease = async (options) => {
 };
 
 // src/mobile/mobileInspect.ts
-import { access as access6, readFile as readFile12 } from "fs/promises";
-import { join as join10, relative as relative5, resolve as resolve6 } from "path";
+import { access as access7, readFile as readFile12 } from "fs/promises";
+import { join as join10, relative as relative6, resolve as resolve7 } from "path";
 var ABSOLUTE_MOBILE_INSPECTION_FORMAT = 1;
 var MOBILE_PACKAGE_NAMES = new Set([
   "@absolutejs/absolute",
@@ -20889,12 +21096,12 @@ var MOBILE_PACKAGE_NAMES = new Set([
 ]);
 var isObject2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var portablePath2 = (projectRoot, path) => {
-  const value = relative5(resolve6(projectRoot), resolve6(path)).replaceAll("\\", "/");
+  const value = relative6(resolve7(projectRoot), resolve7(path)).replaceAll("\\", "/");
   return value || ".";
 };
 var pathExists4 = async (path) => {
   try {
-    await access6(path);
+    await access7(path);
     return true;
   } catch {
     return false;
@@ -21035,8 +21242,8 @@ var renderAbsoluteMobileProjectInspection = (report) => {
 
 // src/mobile/ciWorkflow.ts
 import { existsSync } from "fs";
-import { access as access7, mkdir as mkdir7, readFile as readFile13, writeFile as writeFile10 } from "fs/promises";
-import { dirname as dirname6, extname as extname2, relative as relative6, resolve as resolve7, sep as sep3 } from "path";
+import { access as access8, mkdir as mkdir8, readFile as readFile13, writeFile as writeFile10 } from "fs/promises";
+import { dirname as dirname7, extname as extname2, relative as relative7, resolve as resolve8, sep as sep4 } from "path";
 var ABSOLUTE_MOBILE_CI_WORKFLOW_FORMAT = 1;
 var SECRET_NAME_PATTERN = /^[A-Z][A-Z0-9_]*$/u;
 var CI_ENV_INDENTATION = 6;
@@ -21057,18 +21264,18 @@ var RESERVED_SECRET_NAMES = new Set([
 ]);
 var exists2 = async (path) => {
   try {
-    await access7(path);
+    await access8(path);
     return true;
   } catch {
     return false;
   }
 };
 var yamlString = (value) => `'${value.replaceAll("'", "''")}'`;
-var projectPath = (projectRoot, value, field, options = {}) => {
-  const root = resolve7(projectRoot);
-  const path = resolve7(root, value);
-  const portable = relative6(root, path).replaceAll("\\", "/");
-  if (portable === ".." || portable.startsWith(`..${sep3}`) || portable.startsWith("../") || portable === "") {
+var projectPath2 = (projectRoot, value, field, options = {}) => {
+  const root = resolve8(projectRoot);
+  const path = resolve8(root, value);
+  const portable = relative7(root, path).replaceAll("\\", "/");
+  if (portable === ".." || portable.startsWith(`..${sep4}`) || portable.startsWith("../") || portable === "") {
     throw new TypeError(`${field} must remain inside the project root.`);
   }
   if (/\r|\n/u.test(portable) || portable.startsWith("-"))
@@ -21078,11 +21285,11 @@ var projectPath = (projectRoot, value, field, options = {}) => {
   return portable;
 };
 var workflowOutputPath = (projectRoot, value) => {
-  const root = resolve7(projectRoot);
-  const workflows = resolve7(root, ".github/workflows");
-  const path = resolve7(root, value ?? ".github/workflows/absolute-mobile.yml");
-  const portable = relative6(workflows, path);
-  if (portable === ".." || portable.startsWith(`..${sep3}`) || extname2(path) !== ".yml" && extname2(path) !== ".yaml") {
+  const root = resolve8(projectRoot);
+  const workflows = resolve8(root, ".github/workflows");
+  const path = resolve8(root, value ?? ".github/workflows/absolute-mobile.yml");
+  const portable = relative7(workflows, path);
+  if (portable === ".." || portable.startsWith(`..${sep4}`) || extname2(path) !== ".yml" && extname2(path) !== ".yaml") {
     throw new TypeError("mobile ci github --output must be a .yml or .yaml file inside .github/workflows.");
   }
   return path;
@@ -21449,9 +21656,9 @@ var createAbsoluteMobileGithubWorkflow = (options) => {
   ].sort();
   const includePublishing = options.includePublishing === true;
   const customSecrets = normalizeSecretEnvironment(options.secretEnvironment);
-  const serverEntry = projectPath(options.projectRoot, options.serverEntry ?? "server.ts", "mobile ci github server entry");
-  const configPath = options.configPath ? projectPath(options.projectRoot, options.configPath, "mobile ci github --config") : undefined;
-  const registryModule = projectPath(options.projectRoot, options.registryModule ?? "mobile.release.ts", "mobile ci github --registry", { allowMissing: !includePublishing });
+  const serverEntry = projectPath2(options.projectRoot, options.serverEntry ?? "server.ts", "mobile ci github server entry");
+  const configPath = options.configPath ? projectPath2(options.projectRoot, options.configPath, "mobile ci github --config") : undefined;
+  const registryModule = projectPath2(options.projectRoot, options.registryModule ?? "mobile.release.ts", "mobile ci github --registry", { allowMissing: !includePublishing });
   const environment = commandEnvironment({
     configPath,
     registryModule,
@@ -21513,9 +21720,9 @@ var writeAbsoluteMobileGithubWorkflow = async (options) => {
   const generated = createAbsoluteMobileGithubWorkflow(options);
   const previous = await exists2(path) ? await readFile13(path, "utf8") : undefined;
   if (previous !== undefined && previous !== generated.workflow && !options.force)
-    throw new TypeError(`${relative6(options.projectRoot, path)} already exists and differs. Rerun with --force to replace the generated workflow.`);
+    throw new TypeError(`${relative7(options.projectRoot, path)} already exists and differs. Rerun with --force to replace the generated workflow.`);
   if (previous !== generated.workflow) {
-    await mkdir7(dirname6(path), { recursive: true });
+    await mkdir8(dirname7(path), { recursive: true });
     await writeFile10(path, generated.workflow);
   }
   return {
@@ -21532,7 +21739,7 @@ var writeAbsoluteMobileGithubWorkflow = async (options) => {
 import { createHash as createHash3, sign, verify } from "crypto";
 import {
   cp,
-  mkdir as mkdir8,
+  mkdir as mkdir9,
   mkdtemp as mkdtemp2,
   readdir as readdir4,
   readFile as readFile14,
@@ -21541,7 +21748,7 @@ import {
   stat as stat4,
   writeFile as writeFile11
 } from "fs/promises";
-import { dirname as dirname7, join as join11, relative as relative7, resolve as resolve8 } from "path";
+import { dirname as dirname8, join as join11, relative as relative8, resolve as resolve9 } from "path";
 var UPDATE_MANIFEST_FILE = "update.json";
 var UPDATE_FILES_DIRECTORY = "files";
 var sha256 = (value) => createHash3("sha256").update(value).digest("hex");
@@ -21553,7 +21760,7 @@ var listFiles = async (root, directory = root) => {
       return listFiles(root, path);
     if (!entry.isFile())
       throw new TypeError("Mobile updates cannot contain links or special files.");
-    return [relative7(root, path).replaceAll("\\", "/")];
+    return [relative8(root, path).replaceAll("\\", "/")];
   }));
   return paths.flat().sort((left, right) => left.localeCompare(right));
 };
@@ -21567,8 +21774,8 @@ var inspectFiles = async (root, paths) => Promise.all(paths.map(async (path) =>
 }));
 var releaseIdFor = (value) => `amu_${sha256(canonicalizeAbsoluteMobileUpdate(value))}`;
 var buildAbsoluteMobileUpdate = async (options) => {
-  const bundleDirectory = resolve8(options.bundleDirectory);
-  const outputRoot = resolve8(options.outputDirectory);
+  const bundleDirectory = resolve9(options.bundleDirectory);
+  const outputRoot = resolve9(options.outputDirectory);
   if (outputRoot === bundleDirectory || outputRoot.startsWith(`${bundleDirectory}/`))
     throw new TypeError("Mobile update output must be outside the embedded bundle.");
   const paths = await listFiles(bundleDirectory);
@@ -21596,7 +21803,7 @@ var buildAbsoluteMobileUpdate = async (options) => {
       value: signature.toString("base64")
     }
   });
-  await mkdir8(outputRoot, { recursive: true });
+  await mkdir9(outputRoot, { recursive: true });
   const outputDirectory = join11(outputRoot, manifest.releaseId);
   const staging = await mkdtemp2(join11(outputRoot, ".stage-"));
   try {
@@ -21619,7 +21826,7 @@ var buildAbsoluteMobileUpdate = async (options) => {
     outputDirectory
   };
 };
-var readAbsoluteMobileUpdate = async (directory) => parseAbsoluteMobileUpdateManifest(JSON.parse(await readFile14(join11(resolve8(directory), UPDATE_MANIFEST_FILE), "utf8")));
+var readAbsoluteMobileUpdate = async (directory) => parseAbsoluteMobileUpdateManifest(JSON.parse(await readFile14(join11(resolve9(directory), UPDATE_MANIFEST_FILE), "utf8")));
 var verifyAbsoluteMobileUpdateSignature = (manifestValue, publicKey) => {
   const manifest = parseAbsoluteMobileUpdateManifest(manifestValue);
   const valid = verify("sha256", absoluteMobileUpdateSigningPayload(unsignedAbsoluteMobileUpdate(manifest)), { dsaEncoding: "ieee-p1363", key: publicKey }, Buffer.from(manifest.signature.value, "base64"));
@@ -21629,11 +21836,11 @@ var verifyAbsoluteMobileUpdateSignature = (manifestValue, publicKey) => {
 };
 
 // src/mobile/expoUpdate.ts
-import { access as access8, mkdir as mkdir9, readFile as readFile15, writeFile as writeFile12 } from "fs/promises";
-import { dirname as dirname8, extname as extname3, join as join12 } from "path";
+import { access as access9, mkdir as mkdir10, readFile as readFile15, writeFile as writeFile12 } from "fs/promises";
+import { dirname as dirname9, extname as extname3, join as join12 } from "path";
 var ABSOLUTE_EXPO_UPDATE_DESCRIPTOR = "_absolute/expo-update.json";
 var ABSOLUTE_EXPO_UPDATE_FORMAT = 1;
-var object = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var object2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var safePath = (value, field) => {
   if (typeof value !== "string" || value.length === 0)
     throw new TypeError(`Expo update ${field} is invalid.`);
@@ -21652,7 +21859,7 @@ var extension = (value, path) => {
   return value;
 };
 var asset = (value) => {
-  if (!object(value))
+  if (!object2(value))
     throw new TypeError("Expo update asset is invalid.");
   const path = safePath(value.path, "asset path");
   const normalizedExtension = extension(value.extension ?? value.ext, path);
@@ -21662,9 +21869,9 @@ var asset = (value) => {
   };
 };
 var platform = (value) => {
-  if (!object(value) || !Array.isArray(value.assets))
+  if (!object2(value) || !Array.isArray(value.assets))
     throw new TypeError("Expo update platform metadata is invalid.");
-  const launchValue = object(value.launchAsset) ? value.launchAsset : { path: value.bundle };
+  const launchValue = object2(value.launchAsset) ? value.launchAsset : { path: value.bundle };
   const launchPath = safePath(launchValue.path, "launch bundle");
   const launchExtension = extension(launchValue.extension ?? null, launchPath);
   const assets = value.assets.map(asset);
@@ -21677,7 +21884,7 @@ var platform = (value) => {
   };
 };
 var parseAbsoluteExpoUpdateDescriptor = (value) => {
-  if (!object(value) || value.engine !== "expo" || value.format !== ABSOLUTE_EXPO_UPDATE_FORMAT || !object(value.expoConfig) || !object(value.platforms) || typeof value.runtimeVersion !== "string" || !/^[a-f0-9]{64}$/u.test(value.runtimeVersion))
+  if (!object2(value) || value.engine !== "expo" || value.format !== ABSOLUTE_EXPO_UPDATE_FORMAT || !object2(value.expoConfig) || !object2(value.platforms) || typeof value.runtimeVersion !== "string" || !/^[a-f0-9]{64}$/u.test(value.runtimeVersion))
     throw new TypeError("AbsoluteJS Expo update descriptor is invalid.");
   const platforms = {};
   for (const name of ["android", "ios"]) {
@@ -21697,7 +21904,7 @@ var parseAbsoluteExpoUpdateDescriptor = (value) => {
 };
 var finalizeAbsoluteExpoUpdateExport = async (options) => {
   const metadata = JSON.parse(await readFile15(join12(options.exportDirectory, "metadata.json"), "utf8"));
-  if (!object(metadata) || !object(metadata.fileMetadata))
+  if (!object2(metadata) || !object2(metadata.fileMetadata))
     throw new TypeError("Expo export metadata.json is invalid.");
   const descriptor = parseAbsoluteExpoUpdateDescriptor({
     engine: "expo",
@@ -21707,11 +21914,11 @@ var finalizeAbsoluteExpoUpdateExport = async (options) => {
     runtimeVersion: options.runtimeVersion
   });
   const referenced = Object.values(descriptor.platforms).flatMap((entry) => entry ? [entry.launchAsset, ...entry.assets] : []);
-  await Promise.all(referenced.map(({ path }) => access8(join12(options.exportDirectory, path)).catch(() => {
+  await Promise.all(referenced.map(({ path }) => access9(join12(options.exportDirectory, path)).catch(() => {
     throw new TypeError(`Expo export metadata references missing asset ${path}.`);
   })));
   const destination = join12(options.exportDirectory, ABSOLUTE_EXPO_UPDATE_DESCRIPTOR);
-  await mkdir9(dirname8(destination), { recursive: true });
+  await mkdir10(dirname9(destination), { recursive: true });
   await writeFile12(destination, `${JSON.stringify(descriptor, null, "\t")}
 `);
   return { descriptor, path: destination };
@@ -21719,18 +21926,18 @@ var finalizeAbsoluteExpoUpdateExport = async (options) => {
 
 // src/mobile/expoCodeSigning.ts
 var import_code_signing_certificates = __toESM(require_main(), 1);
-import { access as access9, mkdir as mkdir10, writeFile as writeFile13 } from "fs/promises";
-import { dirname as dirname9, isAbsolute as isAbsolute3, relative as relative8, resolve as resolve9, sep as sep4 } from "path";
-var exists3 = async (path) => access9(path).then(() => true).catch(() => false);
+import { access as access10, mkdir as mkdir11, writeFile as writeFile13 } from "fs/promises";
+import { dirname as dirname10, isAbsolute as isAbsolute4, relative as relative9, resolve as resolve10, sep as sep5 } from "path";
+var exists3 = async (path) => access10(path).then(() => true).catch(() => false);
 var inside = (root, path) => {
-  const location = relative8(root, path);
-  return location === "" || location !== ".." && !location.startsWith(`..${sep4}`) && !isAbsolute3(location);
+  const location = relative9(root, path);
+  return location === "" || location !== ".." && !location.startsWith(`..${sep5}`) && !isAbsolute4(location);
 };
 var generateAbsoluteExpoCodeSigning = async (options) => {
-  const root = resolve9(options.projectRoot);
-  const certificatePath = resolve9(root, options.certificatePath);
-  const privateKeyPath = resolve9(root, options.privateKeyPath);
-  const publicKeyPath = resolve9(root, options.publicKeyPath ?? resolve9(dirname9(privateKeyPath), "public-key.pem"));
+  const root = resolve10(options.projectRoot);
+  const certificatePath = resolve10(root, options.certificatePath);
+  const privateKeyPath = resolve10(root, options.privateKeyPath);
+  const publicKeyPath = resolve10(root, options.publicKeyPath ?? resolve10(dirname10(privateKeyPath), "public-key.pem"));
   if (!inside(root, certificatePath))
     throw new TypeError("Expo code-signing certificate must be written inside the project so store builds can embed it.");
   if (inside(root, privateKeyPath) || inside(root, publicKeyPath))
@@ -21760,7 +21967,7 @@ var generateAbsoluteExpoCodeSigning = async (options) => {
   import_code_signing_certificates.validateSelfSignedCertificate(certificate, keyPair);
   const { privateKeyPEM, publicKeyPEM } = import_code_signing_certificates.convertKeyPairToPEM(keyPair);
   const certificatePem = import_code_signing_certificates.convertCertificateToCertificatePEM(certificate);
-  await Promise.all([certificatePath, privateKeyPath, publicKeyPath].map((path) => mkdir10(dirname9(path), { recursive: true })));
+  await Promise.all([certificatePath, privateKeyPath, publicKeyPath].map((path) => mkdir11(dirname10(path), { recursive: true })));
   await Promise.all([
     writeFile13(certificatePath, certificatePem, { flag: "wx", mode: 420 }),
     writeFile13(privateKeyPath, privateKeyPEM, { flag: "wx", mode: 384 }),
@@ -21775,26 +21982,26 @@ var generateAbsoluteExpoCodeSigning = async (options) => {
 };
 
 // src/mobile/updatePublisher.ts
-import { access as access10 } from "fs/promises";
-import { isAbsolute as isAbsolute4, relative as relative9, resolve as resolve10, sep as sep5 } from "path";
-import { pathToFileURL as pathToFileURL2 } from "url";
-var object2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var isPublisher2 = (value) => object2(value) && typeof value.publishUpdate === "function" && typeof value.promoteUpdate === "function" && typeof value.rollbackUpdate === "function";
-var projectPath2 = (projectRoot, requested, label) => {
-  const root = resolve10(projectRoot);
-  const path = resolve10(root, requested);
-  const projectRelative = relative9(root, path);
-  if (projectRelative === ".." || projectRelative.startsWith(`..${sep5}`) || isAbsolute4(projectRelative))
+import { access as access11 } from "fs/promises";
+import { isAbsolute as isAbsolute5, relative as relative10, resolve as resolve11, sep as sep6 } from "path";
+import { pathToFileURL as pathToFileURL3 } from "url";
+var object3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isPublisher2 = (value) => object3(value) && typeof value.publishUpdate === "function" && typeof value.promoteUpdate === "function" && typeof value.rollbackUpdate === "function";
+var projectPath3 = (projectRoot, requested, label) => {
+  const root = resolve11(projectRoot);
+  const path = resolve11(root, requested);
+  const projectRelative = relative10(root, path);
+  if (projectRelative === ".." || projectRelative.startsWith(`..${sep6}`) || isAbsolute5(projectRelative))
     throw new TypeError(`${label} must remain inside the project.`);
   return path;
 };
 var loadAbsoluteMobileUpdatePublisher = async (projectRoot, requestedModulePath) => {
-  const modulePath = projectPath2(projectRoot, requestedModulePath, "mobile update registry");
-  await access10(modulePath).catch(() => {
+  const modulePath = projectPath3(projectRoot, requestedModulePath, "mobile update registry");
+  await access11(modulePath).catch(() => {
     throw new TypeError(`Mobile update registry does not exist: ${modulePath}`);
   });
-  const loaded = await import(pathToFileURL2(modulePath).href);
-  const publisher = object2(loaded) ? loaded.default ?? loaded.registry : undefined;
+  const loaded = await import(pathToFileURL3(modulePath).href);
+  const publisher = object3(loaded) ? loaded.default ?? loaded.registry : undefined;
   if (!isPublisher2(publisher))
     throw new TypeError("Mobile update registry must implement publishUpdate, promoteUpdate, and rollbackUpdate.");
   return publisher;
@@ -21812,7 +22019,7 @@ var promoteAbsoluteMobileUpdate = async (options) => {
   return result;
 };
 var publishAbsoluteMobileUpdate = async (options) => {
-  const releaseDirectory = projectPath2(options.projectRoot, options.releaseDirectory, "mobile update release directory");
+  const releaseDirectory = projectPath3(options.projectRoot, options.releaseDirectory, "mobile update release directory");
   const manifest = await readAbsoluteMobileUpdate(releaseDirectory);
   const result = await options.publisher.publishUpdate({
     manifest,
@@ -21948,7 +22155,7 @@ var requireMobileConfig = (value) => {
 var capacitorExecutable = async (projectRoot) => {
   const executable = join13(projectRoot, "node_modules", ".bin", "cap");
   try {
-    await access11(executable);
+    await access12(executable);
     return executable;
   } catch {
     throw new TypeError(`Capacitor is not installed in this app. Run: bun add ${CAPACITOR_PACKAGES.join(" ")}`);
@@ -21971,7 +22178,7 @@ var runCapacitorForPlatforms = (projectRoot, command, platforms) => platforms.re
 var expoExecutable = async (project) => {
   const executable = join13(project, "node_modules", ".bin", "expo");
   try {
-    await access11(executable);
+    await access12(executable);
     return executable;
   } catch {
     throw new TypeError("Expo dependencies are not installed in the generated shell. Run `absolute mobile init --yes`.");
@@ -22206,7 +22413,7 @@ var sync = async (args) => {
 };
 var associations = async (args) => {
   const { mobile, projectRoot } = await loadMobile(valueAfter(args, "--config"));
-  const outputDirectory = resolve11(projectRoot, valueAfter(args, "--outdir") ?? ".absolutejs/mobile/associations");
+  const outputDirectory = resolve12(projectRoot, valueAfter(args, "--outdir") ?? ".absolutejs/mobile/associations");
   if (args.includes("--verify")) {
     const result2 = await verifyAbsoluteMobileAssociationFiles(mobile);
     console.log(`Verified ${result2.results.length} hosted association files`);
@@ -22258,7 +22465,7 @@ var generateGithubCi = async (args) => {
   const publicResult = {
     changed: result.changed,
     format: result.format,
-    path: relative10(projectRoot, result.path).replaceAll("\\", "/"),
+    path: relative11(projectRoot, result.path).replaceAll("\\", "/"),
     platforms: result.platforms,
     publishing: result.publishing,
     requiredSecrets: result.requiredSecrets
@@ -22370,7 +22577,7 @@ var prepareExpoMobileUpdateExport = async (options) => {
     };
   await ensureExpoPackages(mobile.nativeProjectDirectory, options.args);
   const temporaryParent = join13(options.projectRoot, ".absolutejs", "mobile", "expo-update-exports");
-  await mkdir11(temporaryParent, { recursive: true });
+  await mkdir12(temporaryParent, { recursive: true });
   const temporaryDirectory = await mkdtemp3(join13(temporaryParent, ".stage-"));
   try {
     await runExpo(mobile.nativeProjectDirectory, [
@@ -22430,9 +22637,9 @@ var buildMobileUpdate = async (args) => {
     const runtimeFingerprint = isRecord6(embedded) ? embedded.nativeRuntime : undefined;
     if (typeof runtimeFingerprint !== "string" || !/^[a-f0-9]{64}$/u.test(runtimeFingerprint))
       throw new TypeError("Prepared mobile bundle is missing its native runtime fingerprint.");
-    const privateKey = await readFile16(resolve11(projectRoot, signingKeyPath));
+    const privateKey = await readFile16(resolve12(projectRoot, signingKeyPath));
     const configuredPublicKey = Buffer.from(mobile.updates.publicKeys[keyId], "base64");
-    const derivedPublicKey = createPublicKey(privateKey).export({
+    const derivedPublicKey = createPublicKey2(privateKey).export({
       format: "der",
       type: "spki"
     });
@@ -22493,7 +22700,7 @@ var generateExpoUpdateSigning = async (args) => {
     ...valueAfter(args, "--public-key") ? { publicKeyPath: valueAfter(args, "--public-key") } : {},
     ...validityYears === undefined ? {} : { validityYears }
   });
-  const certificatePath = relative10(projectRoot, result.certificatePath).replaceAll("\\", "/");
+  const certificatePath = relative11(projectRoot, result.certificatePath).replaceAll("\\", "/");
   sendTelemetryEvent("mobile:update-code-signing-generated", {
     engine: "expo",
     validityYears: validityYears ?? 10
@@ -22516,13 +22723,56 @@ var updateRollout = (args, fallback) => {
   return rollout;
 };
 var mobileUpdatePublisher = async (args) => {
-  const { projectRoot } = await loadMobile(valueAfter(args, "--config"));
-  const modulePath = valueAfter(args, "--registry") ?? "mobile.release.ts";
+  const { mobile, projectRoot } = await loadMobile(valueAfter(args, "--config"));
+  if (!mobile.updates || !mobile.updateServer)
+    throw new TypeError("Mobile updates are not configured.");
+  const modulePath = valueAfter(args, "--registry") ?? mobile.updateServer.registryModule;
   return {
     projectRoot,
     publisher: await loadAbsoluteMobileUpdatePublisher(projectRoot, modulePath)
   };
 };
+var provisionMobileUpdate = async (args) => {
+  const { mobile, projectRoot } = await loadMobile(valueAfter(args, "--config"));
+  if (!mobile.updates || !mobile.updateServer)
+    throw new TypeError("mobile update provision requires mobile.updates.publicKeys in absolute.config.ts.");
+  const requestedStorage = valueAfter(args, "--storage") ?? "local";
+  if (requestedStorage !== "local" && requestedStorage !== "s3")
+    throw new TypeError("--storage must be local or s3.");
+  const modulePath = valueAfter(args, "--registry") ?? mobile.updateServer.registryModule;
+  const packages = [
+    "@absolutejs/deploy@0.25.6",
+    "@absolutejs/blob@0.5.2",
+    ...requestedStorage === "s3" ? [
+      "@aws-sdk/client-s3@3.1095.0",
+      "@aws-sdk/lib-storage@3.1095.0",
+      "@aws-sdk/s3-request-presigner@3.1095.0"
+    ] : []
+  ];
+  const installed = await directProjectPackages(projectRoot);
+  const missing = packages.filter((spec) => !installed.has(packageNameFromSpec(spec)));
+  await installApprovedPackages(projectRoot, args, `Mobile update serving needs ${missing.map(packageNameFromSpec).join(", ")}. Install them now?`, missing);
+  const path = await writeAbsoluteMobileUpdateRegistry({
+    force: args.includes("--force"),
+    modulePath,
+    projectRoot,
+    publicKeys: mobile.updates.publicKeys,
+    storage: requestedStorage
+  });
+  console.log(`Provisioned ${requestedStorage === "local" ? "local development" : "durable S3-compatible"} mobile update storage in ${relative11(projectRoot, path).replaceAll("\\", "/")}.`);
+  if (requestedStorage === "local")
+    console.log("Production release checks will require durable storage. Re-run with --storage s3 --force before deploying.");
+  else
+    console.log("Set ABSOLUTE_MOBILE_UPDATE_S3_BUCKET and standard AWS credentials on the trusted server; endpoint and region overrides are optional.");
+  const expoSigning = mobile.updates.expoCodeSigning;
+  if (expoSigning) {
+    const signingKey = mobile.updateServer.expoCodeSigningKeys[expoSigning.keyId];
+    if (!signingKey)
+      throw new TypeError("The active Expo server signing key is missing.");
+    console.log(`Set ${signingKey.privateKeyEnv} only on the trusted server.`);
+  }
+  return path;
+};
 var publishMobileUpdate = async (args) => {
   const releaseDirectory = args.find((value, index) => {
     if (value.startsWith("-"))
@@ -23144,7 +23394,7 @@ var requireAndroidTestPort = (args, projectRoot) => {
     }
     return { https: args.includes("--https"), port };
   }
-  const instances = listLiveInstances().filter((instance2) => resolve11(instance2.cwd) === resolve11(projectRoot) && instance2.source === "dev" && instance2.port !== null);
+  const instances = listLiveInstances().filter((instance2) => resolve12(instance2.cwd) === resolve12(projectRoot) && instance2.source === "dev" && instance2.port !== null);
   if (instances.length !== 1) {
     throw new TypeError(instances.length === 0 ? "No running AbsoluteJS dev server was found for this project. Start `bun dev`, wait for Android to report ready, then run `absolute mobile test android`." : "Multiple dev servers are running for this project. Select one with mobile test android --port <port>.");
   }
@@ -23191,8 +23441,8 @@ var selectAndroidSerial = (adb, explicitSerial) => {
   return selected;
 };
 var safeArtifactRoot = (projectRoot, value) => {
-  const root = resolve11(projectRoot, value ?? ".absolutejs/mobile/test-artifacts");
-  if (root !== projectRoot && !root.startsWith(`${resolve11(projectRoot)}/`)) {
+  const root = resolve12(projectRoot, value ?? ".absolutejs/mobile/test-artifacts");
+  if (root !== projectRoot && !root.startsWith(`${resolve12(projectRoot)}/`)) {
     throw new TypeError("mobile test --artifacts must remain inside the project.");
   }
   return root;
@@ -23220,7 +23470,7 @@ var waitForRequestedAndroidHmr = async (args, session, checks, timeoutMs) => {
   });
 };
 var writeAndroidFailureArtifacts = async (options) => {
-  await mkdir11(options.artifactRoot, { recursive: true });
+  await mkdir12(options.artifactRoot, { recursive: true });
   const screenshot = options.session ? await options.session.screenshot(join13(options.artifactRoot, "android-failure.png")).catch(() => {
     return;
   }) : undefined;
@@ -23359,14 +23609,14 @@ var requireIosTestContext = (args, projectRoot) => {
     const port = Number(explicit);
     if (!Number.isInteger(port) || port < 1 || port > 65535)
       throw new TypeError("mobile test --port must be a valid TCP port.");
-    const instance2 = listLiveInstances().find((candidate) => resolve11(candidate.cwd) === resolve11(projectRoot) && candidate.source === "dev" && candidate.port === port);
+    const instance2 = listLiveInstances().find((candidate) => resolve12(candidate.cwd) === resolve12(projectRoot) && candidate.source === "dev" && candidate.port === port);
     return {
       https: instance2?.https ?? args.includes("--https"),
       instance: instance2,
       port
     };
   }
-  const instances = listLiveInstances().filter((instance2) => resolve11(instance2.cwd) === resolve11(projectRoot) && instance2.source === "dev" && instance2.port !== null);
+  const instances = listLiveInstances().filter((instance2) => resolve12(instance2.cwd) === resolve12(projectRoot) && instance2.source === "dev" && instance2.port !== null);
   if (instances.length !== 1)
     throw new TypeError(instances.length === 0 ? "No running AbsoluteJS dev server was found for this project. Start `bun dev`, wait for iOS to report ready, then run `absolute mobile test ios`." : "Multiple dev servers are running for this project. Select one with mobile test ios --port <port>.");
   const [instance] = instances;
@@ -23489,7 +23739,7 @@ var requireCapturedCommand = (command, label) => {
   return result;
 };
 var writeIosFailureArtifacts = async (options) => {
-  await mkdir11(options.artifactRoot, { recursive: true });
+  await mkdir12(options.artifactRoot, { recursive: true });
   const screenshot = join13(options.artifactRoot, "ios-failure.png");
   const screenshotResult = captureCommand2([
     options.xcrun,
@@ -23527,8 +23777,8 @@ var nativeReportRoot = (args, projectRoot, platform2) => {
 var absolutejsVersionForReport = async () => {
   let absolutejsVersion = process.env.ABSOLUTE_VERSION ?? "unknown";
   const versions = await Promise.all([
-    resolve11(import.meta.dir, "..", "..", "package.json"),
-    resolve11(import.meta.dir, "..", "..", "..", "package.json")
+    resolve12(import.meta.dir, "..", "..", "package.json"),
+    resolve12(import.meta.dir, "..", "..", "..", "package.json")
   ].map((candidate) => readPackageVersionForIosReport(candidate).catch(() => "unknown")));
   for (const version of versions) {
     if (version === "unknown")
@@ -23752,7 +24002,7 @@ var testIos = async (args) => {
       mobile.appId
     ], "iOS app launch");
     await waitForIosHmrClient({ https, port, timeoutMs });
-    await mkdir11(artifactRoot, { recursive: true });
+    await mkdir12(artifactRoot, { recursive: true });
     const screenshot = join13(artifactRoot, "ios-simulator.png");
     requireCapturedCommand([xcrun, "simctl", "io", simulator.udid, "screenshot", screenshot], "iOS simulator screenshot");
     const hmrApply = await waitForRequestedIosHmr(args, instance, timeoutMs);
@@ -23895,6 +24145,10 @@ var runMobile = async (args) => {
     await buildMobileUpdate(args.slice(2));
     return;
   }
+  if (command === "update" && args[1] === "provision") {
+    await provisionMobileUpdate(args.slice(2));
+    return;
+  }
   if (command === "update" && args[1] === "signing" && args[2] === "generate") {
     await generateExpoUpdateSigning(args.slice(3));
     return;
@@ -23919,7 +24173,7 @@ var runMobile = async (args) => {
     await publishIos(args.slice(2));
     return;
   }
-  throw new TypeError("Usage: absolute mobile <pair mac <name> <user@host> [--port n] [--workspace path] | remotes [inspect [name] [--json] | clean [name] --yes | --json] | unpair mac <name> | init [--no-native] [--force] | sync [ios|android] | inspect [--json] [--require-bundle] | associations [--outdir dir] [--verify] | ci github [server-entry] [--publish] [--registry module] [--secret-env NAME] [--output path] [--force] [--json] | doctor [ios|android|release [ios|android]] [--remote name] [--json|--fix [--yes]] | build <android|ios> [server-entry] [--remote name] [--outdir dir] [--web-outdir dir] [--unsigned] | update signing generate --private-key path [--certificate path] [--public-key path] [--key-id id] [--common-name name] [--validity-years n] | update build [server-entry] --classification bug-fix|content|security --key-id id --signing-key path --within-submitted-purpose [--outdir dir] [--web-outdir dir] | update publish <release-directory> [--rollout fraction] [--registry module] | update promote --release id --rollout fraction [--registry module] | update rollback [--release id] [--registry module] | publish android [server-entry] [--registry module] [--channel name] [--play-track track] [--play-status completed|draft|halted|in-progress] [--play-rollout fraction] [--play-name name] [--play-notes language=text] [--play-update-priority 0..5] [--play-hold-review] [--play-cancel-existing-review] [--outdir dir] [--web-outdir dir] [--unsigned] | publish ios [server-entry] [--remote name] [--registry module] [--channel name] [--testflight-group name-or-id] [--testflight-notes locale=text] [--testflight-submit-review] [--outdir dir] [--web-outdir dir] [--unsigned] | test android [--route path] [--wait-for-hmr] [--report [dir]] [--timeout ms] [--port n] [--serial id] [--artifacts dir] [--json] | test ios [--device identifier [--remote name] | --udid id] [--wait-for-hmr] [--report [dir]] [--timeout ms] [--port n] [--artifacts dir] [--json]> [--config path]");
+  throw new TypeError("Usage: absolute mobile <pair mac <name> <user@host> [--port n] [--workspace path] | remotes [inspect [name] [--json] | clean [name] --yes | --json] | unpair mac <name> | init [--no-native] [--force] | sync [ios|android] | inspect [--json] [--require-bundle] | associations [--outdir dir] [--verify] | ci github [server-entry] [--publish] [--registry module] [--secret-env NAME] [--output path] [--force] [--json] | doctor [ios|android|release [ios|android]] [--remote name] [--json|--fix [--yes]] | build <android|ios> [server-entry] [--remote name] [--outdir dir] [--web-outdir dir] [--unsigned] | update provision [--storage local|s3] [--registry module] [--force] [--yes] | update signing generate --private-key path [--certificate path] [--public-key path] [--key-id id] [--common-name name] [--validity-years n] | update build [server-entry] --classification bug-fix|content|security --key-id id --signing-key path --within-submitted-purpose [--outdir dir] [--web-outdir dir] | update publish <release-directory> [--rollout fraction] [--registry module] | update promote --release id --rollout fraction [--registry module] | update rollback [--release id] [--registry module] | publish android [server-entry] [--registry module] [--channel name] [--play-track track] [--play-status completed|draft|halted|in-progress] [--play-rollout fraction] [--play-name name] [--play-notes language=text] [--play-update-priority 0..5] [--play-hold-review] [--play-cancel-existing-review] [--outdir dir] [--web-outdir dir] [--unsigned] | publish ios [server-entry] [--remote name] [--registry module] [--channel name] [--testflight-group name-or-id] [--testflight-notes locale=text] [--testflight-submit-review] [--outdir dir] [--web-outdir dir] [--unsigned] | test android [--route path] [--wait-for-hmr] [--report [dir]] [--timeout ms] [--port n] [--serial id] [--artifacts dir] [--json] | test ios [--device identifier [--remote name] | --udid id] [--wait-for-hmr] [--report [dir]] [--timeout ms] [--port n] [--artifacts dir] [--json]> [--config path]");
 };
 export {
   runMobile