@absolutejs/absolute 0.20.0-beta.80 → 0.20.0-beta.82

package/dist/mobile/index.js

@@ -597,10 +597,14 @@ var init_startupBanner = __esm(() => {
 });
 
 // src/mobile/config.ts
+var exports_config = {};
+__export(exports_config, {
+  normalizeAbsoluteMobileConfig: () => normalizeAbsoluteMobileConfig
+});
 import { readFileSync as readFileSync2 } from "fs";
 import { resolve as resolve6 } from "path";
 import { createHash as createHash8, createPublicKey, X509Certificate as X509Certificate2 } from "crypto";
-var APP_ID_PATTERN, SCHEME_PATTERN, APPLE_APP_ID_PREFIX_PATTERN, CERTIFICATE_FINGERPRINT_PATTERN, UPDATE_NAME_PATTERN, UPDATE_PUBLIC_KEY_PATTERN, DEFAULT_UPDATE_BOOT_TIMEOUT_MS = 20000, MINIMUM_UPDATE_BOOT_TIMEOUT_MS = 5000, MAXIMUM_UPDATE_BOOT_TIMEOUT_MS = 120000, HOSTNAME_PATTERN, EXPO_RESERVED_ROUTE_PREFIXES, resolveProjectPath = (projectRoot, value, field2) => {
+var APP_ID_PATTERN, SCHEME_PATTERN, APPLE_APP_ID_PREFIX_PATTERN, CERTIFICATE_FINGERPRINT_PATTERN, UPDATE_NAME_PATTERN, UPDATE_PUBLIC_KEY_PATTERN, ENVIRONMENT_NAME_PATTERN, DEFAULT_UPDATE_BOOT_TIMEOUT_MS = 20000, MINIMUM_UPDATE_BOOT_TIMEOUT_MS = 5000, MAXIMUM_UPDATE_BOOT_TIMEOUT_MS = 120000, HOSTNAME_PATTERN, EXPO_RESERVED_ROUTE_PREFIXES, resolveProjectPath = (projectRoot, value, field2) => {
   const root = resolve6(projectRoot);
   const path = resolve6(root, value);
   if (path !== root && !path.startsWith(`${root}/`)) {
@@ -785,6 +789,48 @@ var APP_ID_PATTERN, SCHEME_PATTERN, APPLE_APP_ID_PREFIX_PATTERN, CERTIFICATE_FIN
     publicKeys,
     ...expoCodeSigning ? { expoCodeSigning } : {}
   };
+}, normalizeUpdateServer = (config, productionOrigin, projectRoot, updates) => {
+  if (!updates || !config.updates)
+    return;
+  const registryModule = requireText(config.updates.server?.registry ?? "mobile.update.ts", "mobile.updates.server.registry");
+  resolveProjectPath(projectRoot, registryModule, "mobile.updates.server.registry");
+  const expoPrivateKeyEnv = requireText(config.updates.server?.expoPrivateKeyEnv ?? "ABSOLUTE_EXPO_UPDATE_PRIVATE_KEY", "mobile.updates.server.expoPrivateKeyEnv");
+  if (!ENVIRONMENT_NAME_PATTERN.test(expoPrivateKeyEnv))
+    throw new TypeError("mobile.updates.server.expoPrivateKeyEnv must be a valid environment variable name.");
+  const autoMount = config.updates.server?.autoMount ?? true;
+  if (autoMount) {
+    const manifest = new URL(updates.manifestUrl);
+    if (manifest.origin !== productionOrigin)
+      throw new TypeError("mobile.updates.manifestUrl must use mobile.server.productionOrigin while mobile.updates.server.autoMount is enabled.");
+    if (!manifest.pathname.endsWith("/update.json"))
+      throw new TypeError("mobile.updates.manifestUrl must end in /update.json while mobile.updates.server.autoMount is enabled.");
+  }
+  const expoCodeSigningKeys = {};
+  if (updates.expoCodeSigning)
+    expoCodeSigningKeys[updates.expoCodeSigning.keyId] = {
+      certificatePem: updates.expoCodeSigning.certificatePem,
+      privateKeyEnv: expoPrivateKeyEnv
+    };
+  for (const [keyId, key] of Object.entries(config.updates.server?.expoCodeSigningKeys ?? {}).sort(([left], [right]) => left.localeCompare(right))) {
+    if (!updates.expoCodeSigning)
+      throw new TypeError("mobile.updates.server.expoCodeSigningKeys requires the Expo engine and expoCodeSigning.");
+    if (!UPDATE_NAME_PATTERN.test(keyId))
+      throw new TypeError("mobile.updates.server.expoCodeSigningKeys contains an invalid key ID.");
+    if (expoCodeSigningKeys[keyId])
+      throw new TypeError(`mobile.updates.server.expoCodeSigningKeys.${keyId} duplicates the active Expo key.`);
+    const privateKeyEnv = requireText(key.privateKeyEnv, `mobile.updates.server.expoCodeSigningKeys.${keyId}.privateKeyEnv`);
+    if (!ENVIRONMENT_NAME_PATTERN.test(privateKeyEnv))
+      throw new TypeError(`mobile.updates.server.expoCodeSigningKeys.${keyId}.privateKeyEnv must be a valid environment variable name.`);
+    const certificatePath = resolveProjectPath(projectRoot, requireText(key.certificatePath, `mobile.updates.server.expoCodeSigningKeys.${keyId}.certificatePath`), `mobile.updates.server.expoCodeSigningKeys.${keyId}.certificatePath`);
+    const { certificate, certificatePem } = readExpoCodeSigningCertificate(certificatePath);
+    if (certificate.publicKey.asymmetricKeyType !== "rsa" || certificate.issuer !== certificate.subject || !certificate.verify(certificate.publicKey))
+      throw new TypeError(`mobile.updates.server.expoCodeSigningKeys.${keyId} certificate must be a self-signed RSA root.`);
+    const now = Date.now();
+    if (now < Date.parse(certificate.validFrom) || now > Date.parse(certificate.validTo))
+      throw new TypeError(`mobile.updates.server.expoCodeSigningKeys.${keyId} certificate is not currently valid.`);
+    expoCodeSigningKeys[keyId] = { certificatePem, privateKeyEnv };
+  }
+  return { autoMount, expoCodeSigningKeys, registryModule };
 }, validateExpoNativeRouteSegment = (path, segment, index, count, parameters) => {
   if (segment === "*" && (index !== count - 1 || count === 1)) {
     throw new TypeError(`mobile.routes.native route ${path} must use * once, as the final segment after a static or parameterized prefix.`);
@@ -844,6 +890,7 @@ var APP_ID_PATTERN, SCHEME_PATTERN, APPLE_APP_ID_PREFIX_PATTERN, CERTIFICATE_FIN
     throw new TypeError("mobile.deepLinks.scheme is not a valid URL scheme.");
   }
   const updates = normalizeUpdates(config, productionOrigin, projectRoot);
+  const updateServer = normalizeUpdateServer(config, productionOrigin, projectRoot, updates);
   const observability = normalizeObservability(config, productionOrigin);
   return {
     androidCertificateFingerprints: normalizeCertificateFingerprints(config.deepLinks?.android?.sha256CertificateFingerprints),
@@ -863,7 +910,8 @@ var APP_ID_PATTERN, SCHEME_PATTERN, APPLE_APP_ID_PREFIX_PATTERN, CERTIFICATE_FIN
     platforms: normalizePlatforms(config.platforms),
     productionOrigin,
     pushAndroidGoogleServicesFile: resolveProjectPath(projectRoot, config.pushNotifications?.android?.googleServicesFile ?? "google-services.json", "mobile.pushNotifications.android.googleServicesFile"),
-    ...updates ? { updates } : {}
+    ...updates ? { updates } : {},
+    ...updateServer ? { updateServer } : {}
   };
 };
 var init_config = __esm(() => {
@@ -873,6 +921,7 @@ var init_config = __esm(() => {
   CERTIFICATE_FINGERPRINT_PATTERN = /^[0-9A-F]{64}$/;
   UPDATE_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
   UPDATE_PUBLIC_KEY_PATTERN = /^[A-Za-z0-9+/]+={0,2}$/u;
+  ENVIRONMENT_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/u;
   HOSTNAME_PATTERN = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(?:\.(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?))*$/;
   EXPO_RESERVED_ROUTE_PREFIXES = new Set([
     "_expo",
@@ -19902,6 +19951,919 @@ var init_web_vitals_attribution = __esm(() => {
   z = [800, 1800];
 });
 
+// node_modules/@absolutejs/deploy/dist/mobileUpdate.js
+var exports_mobileUpdate = {};
+__export(exports_mobileUpdate, {
+  MOBILE_UPDATE_REGISTRY_FORMAT: () => MOBILE_UPDATE_REGISTRY_FORMAT,
+  MobileUpdateRegistryError: () => MobileUpdateRegistryError,
+  createMobileUpdateHandler: () => createMobileUpdateHandler,
+  createMobileUpdateRegistry: () => createMobileUpdateRegistry,
+  parseMobileUpdateManifest: () => parseMobileUpdateManifest
+});
+import {
+  createHash as createHash15,
+  createPrivateKey,
+  createPublicKey as createPublicKey2,
+  sign as sign2,
+  verify as verify2,
+  X509Certificate as X509Certificate3
+} from "crypto";
+import { readFile as readFile23, stat as stat5 } from "fs/promises";
+import path from "path";
+var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updates", MAX_FILE_BYTES, MAX_TOTAL_BYTES, HASH, RELEASE, APP_ID, NAME, EXPO_DESCRIPTOR = "_absolute/expo-update.json", EXPO_CODE_SIGNING_ALGORITHM = "rsa-v1_5-sha256", MobileUpdateRegistryError, object6 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), text2 = (value, field2) => {
+  if (typeof value !== "string" || value.length === 0)
+    throw new MobileUpdateRegistryError(`Mobile update ${field2} is invalid`);
+  return value;
+}, iso = (value) => typeof value === "string" && Number.isFinite(Date.parse(value)) && new Date(value).toISOString() === value, safePath2 = (value) => {
+  const file = text2(value, "file path").replaceAll("\\", "/");
+  if (file.startsWith("/") || file.split("/").some((segment) => !segment || segment === "." || segment === ".."))
+    throw new MobileUpdateRegistryError("Mobile update file path is invalid");
+  return file;
+}, expoAsset = (value) => {
+  if (!object6(value))
+    throw new MobileUpdateRegistryError("Expo update asset is invalid");
+  const assetPath = safePath2(value.path);
+  if (value.extension !== undefined && (typeof value.extension !== "string" || !/^[A-Za-z0-9]+$/.test(value.extension)))
+    throw new MobileUpdateRegistryError("Expo update asset extension is invalid");
+  return {
+    ...typeof value.extension === "string" ? { extension: value.extension } : {},
+    path: assetPath
+  };
+}, parseExpoUpdateDescriptor = (bytes) => {
+  let value;
+  try {
+    value = JSON.parse(new TextDecoder().decode(bytes));
+  } catch {
+    throw new MobileUpdateRegistryError("Expo update descriptor is invalid");
+  }
+  if (!object6(value) || value.engine !== "expo" || value.format !== 1 || !object6(value.expoConfig) || !object6(value.platforms) || typeof value.runtimeVersion !== "string" || !HASH.test(value.runtimeVersion))
+    throw new MobileUpdateRegistryError("Expo update descriptor is invalid");
+  const platforms = {};
+  for (const name of ["android", "ios"]) {
+    const candidate = value.platforms[name];
+    if (candidate === undefined)
+      continue;
+    if (!object6(candidate) || !Array.isArray(candidate.assets) || !object6(candidate.launchAsset))
+      throw new MobileUpdateRegistryError("Expo update platform descriptor is invalid");
+    platforms[name] = {
+      assets: candidate.assets.map(expoAsset),
+      launchAsset: expoAsset(candidate.launchAsset)
+    };
+  }
+  if (Object.keys(platforms).length === 0)
+    throw new MobileUpdateRegistryError("Expo update descriptor has no native platforms");
+  return {
+    engine: "expo",
+    expoConfig: value.expoConfig,
+    format: 1,
+    platforms,
+    runtimeVersion: value.runtimeVersion
+  };
+}, parseMobileUpdateManifest = (value) => {
+  if (!object6(value) || value.format !== 1)
+    throw new MobileUpdateRegistryError("Mobile update manifest is invalid");
+  const appId = text2(value.appId, "appId");
+  const channel = text2(value.channel, "channel");
+  const releaseId = text2(value.releaseId, "releaseId");
+  const runtimeFingerprint = text2(value.runtimeFingerprint, "runtime");
+  if (!APP_ID.test(appId) || !NAME.test(channel) || !RELEASE.test(releaseId))
+    throw new MobileUpdateRegistryError("Mobile update identity is invalid");
+  if (!HASH.test(runtimeFingerprint) || !iso(value.createdAt))
+    throw new MobileUpdateRegistryError("Mobile update runtime or timestamp is invalid");
+  if (value.classification !== "bug-fix" && value.classification !== "content" && value.classification !== "security")
+    throw new MobileUpdateRegistryError("Mobile update classification is invalid");
+  if (value.withinSubmittedPurpose !== true)
+    throw new MobileUpdateRegistryError("Mobile update policy attestation is missing");
+  if (!Array.isArray(value.files) || value.files.length === 0)
+    throw new MobileUpdateRegistryError("Mobile update file inventory is invalid");
+  const files = value.files.map((candidate) => {
+    if (!object6(candidate))
+      throw new MobileUpdateRegistryError("Mobile update file is invalid");
+    const filePath = safePath2(candidate.path);
+    if (!Number.isSafeInteger(candidate.bytes) || Number(candidate.bytes) < 0 || Number(candidate.bytes) > MAX_FILE_BYTES || typeof candidate.sha256 !== "string" || !HASH.test(candidate.sha256))
+      throw new MobileUpdateRegistryError(`Mobile update file ${filePath} is invalid`);
+    return {
+      bytes: Number(candidate.bytes),
+      path: filePath,
+      sha256: candidate.sha256
+    };
+  });
+  if (files.reduce((total, file) => total + file.bytes, 0) > MAX_TOTAL_BYTES || new Set(files.map((file) => file.path)).size !== files.length || files.some((file, index) => index > 0 ? file.path.localeCompare(files[index - 1]?.path ?? "") <= 0 : false))
+    throw new MobileUpdateRegistryError("Mobile update file inventory is invalid");
+  const signatureKeyId = object6(value.signature) ? text2(value.signature.keyId, "signature key") : "";
+  const signatureValue = object6(value.signature) ? text2(value.signature.value, "signature") : "";
+  if (!object6(value.signature) || value.signature.algorithm !== "ecdsa-p256-sha256" || !NAME.test(signatureKeyId) || !/^[A-Za-z0-9+/]+={0,2}$/.test(signatureValue) || Buffer.from(signatureValue, "base64").byteLength !== 64 || Buffer.from(signatureValue, "base64").toString("base64") !== signatureValue)
+    throw new MobileUpdateRegistryError("Mobile update signature is invalid");
+  return {
+    appId,
+    channel,
+    classification: value.classification,
+    createdAt: value.createdAt,
+    files,
+    format: 1,
+    releaseId,
+    runtimeFingerprint,
+    signature: {
+      algorithm: "ecdsa-p256-sha256",
+      keyId: signatureKeyId,
+      value: signatureValue
+    },
+    withinSubmittedPurpose: true
+  };
+}, canonicalValue2 = (value) => {
+  if (Array.isArray(value))
+    return value.map(canonicalValue2);
+  if (!object6(value))
+    return value;
+  return Object.fromEntries(Object.keys(value).sort().map((key) => [key, canonicalValue2(value[key])]));
+}, verifyManifestSignature = (manifest, publicKeys) => {
+  const encoded = publicKeys[manifest.signature.keyId];
+  if (!encoded)
+    throw new MobileUpdateRegistryError("Mobile update signing key is not trusted");
+  let publicKey;
+  try {
+    const der = Buffer.from(encoded, "base64");
+    if (der.toString("base64") !== encoded)
+      throw new Error("invalid base64");
+    publicKey = createPublicKey2({ format: "der", key: der, type: "spki" });
+  } catch {
+    throw new MobileUpdateRegistryError("Mobile update trusted public key is invalid");
+  }
+  if (publicKey.asymmetricKeyType !== "ec" || publicKey.asymmetricKeyDetails?.namedCurve !== "prime256v1")
+    throw new MobileUpdateRegistryError("Mobile update trusted public key must use ECDSA P-256");
+  const { signature: _signature, ...unsigned } = manifest;
+  if (!verify2("sha256", new TextEncoder().encode(JSON.stringify(canonicalValue2(unsigned))), { dsaEncoding: "ieee-p1363", key: publicKey }, Buffer.from(manifest.signature.value, "base64")))
+    throw new MobileUpdateRegistryError("Mobile update signature verification failed");
+}, parseChannel = (value) => {
+  if (!object6(value) || value.format !== MOBILE_UPDATE_REGISTRY_FORMAT)
+    throw new MobileUpdateRegistryError("Mobile update channel is invalid");
+  const appId = text2(value.appId, "channel appId");
+  const channel = text2(value.channel, "channel");
+  if (!APP_ID.test(appId) || !NAME.test(channel) || !iso(value.promotedAt) || typeof value.rollout !== "number" || value.rollout < 0 || value.rollout > 1 || value.releaseId !== undefined && (typeof value.releaseId !== "string" || !RELEASE.test(value.releaseId)) || value.fallbackReleaseId !== undefined && (typeof value.fallbackReleaseId !== "string" || !RELEASE.test(value.fallbackReleaseId)) || value.activationId !== undefined && (typeof value.activationId !== "string" || !HASH.test(value.activationId)) || value.activatedAt !== undefined && !iso(value.activatedAt) || value.activationId === undefined !== (value.activatedAt === undefined))
+    throw new MobileUpdateRegistryError("Mobile update channel is invalid");
+  return {
+    ...value.activationId ? { activationId: value.activationId } : {},
+    ...value.activatedAt ? { activatedAt: value.activatedAt } : {},
+    appId,
+    channel,
+    ...value.fallbackReleaseId ? { fallbackReleaseId: value.fallbackReleaseId } : {},
+    format: MOBILE_UPDATE_REGISTRY_FORMAT,
+    promotedAt: value.promotedAt,
+    ...value.releaseId ? { releaseId: value.releaseId } : {},
+    rollout: value.rollout
+  };
+}, normalizedPrefix = (value) => {
+  const prefix = value.replace(/^\/+|\/+$/g, "");
+  if (!prefix || prefix.split("/").some((segment) => segment === "." || segment === ".."))
+    throw new MobileUpdateRegistryError("Mobile update prefix is invalid");
+  return prefix;
+}, appHash = (appId) => createHash15("sha256").update(appId).digest("hex"), digest = (bytes) => createHash15("sha256").update(bytes).digest("hex"), json = (value) => new TextEncoder().encode(`${JSON.stringify(value, null, 2)}
+`), decode2 = (value) => JSON.parse(new TextDecoder().decode(value)), fileDigest = async (file) => {
+  const hasher = new Bun.CryptoHasher("sha256");
+  for await (const chunk of file.stream())
+    hasher.update(chunk);
+  return hasher.digest("hex");
+}, rolloutMember = (input) => {
+  if (input.rollout === 0)
+    return false;
+  if (input.rollout === 1)
+    return true;
+  const value = createHash15("sha256").update(`${input.appId}\x00${input.channel}\x00${input.releaseId}\x00${input.installationId}`).digest().readUInt32BE(0);
+  return value / 4294967296 < input.rollout;
+}, createMobileUpdateRegistry = (options) => {
+  const prefix = normalizedPrefix(options.prefix ?? DEFAULT_PREFIX);
+  const clock = options.clock ?? (() => new Date);
+  const root = (appId) => `${prefix}/${appHash(appId)}`;
+  const releaseRoot = (manifest) => `${root(manifest.appId)}/releases/${manifest.releaseId}`;
+  const manifestKey = (manifest) => `${releaseRoot(manifest)}/update.json`;
+  const fileKey = (manifest, file) => `${releaseRoot(manifest)}/files/${file.path}`;
+  const channelKey = (appId, channel) => {
+    if (!APP_ID.test(appId) || !NAME.test(channel))
+      throw new MobileUpdateRegistryError("Mobile update channel identity is invalid");
+    return `${root(appId)}/channels/${channel}.json`;
+  };
+  const readManifest = async (appId, releaseId) => {
+    const key = manifestKey({ appId, releaseId });
+    const bytes = await options.store.get(key);
+    if (!bytes)
+      return null;
+    const head = await options.store.head(key);
+    if (!head || head.size !== bytes.byteLength || head.metadata?.sha256 !== digest(bytes))
+      throw new MobileUpdateRegistryError("Stored mobile update manifest integrity failed");
+    const manifest = parseMobileUpdateManifest(decode2(bytes));
+    verifyManifestSignature(manifest, options.publicKeys);
+    if (manifest.appId !== appId || manifest.releaseId !== releaseId)
+      throw new MobileUpdateRegistryError("Stored mobile update identity changed");
+    return { key, manifest };
+  };
+  const readChannel = async (appId, channel) => {
+    const bytes = await options.store.get(channelKey(appId, channel));
+    if (!bytes)
+      return null;
+    const value = parseChannel(decode2(bytes));
+    if (value.appId !== appId || value.channel !== channel)
+      throw new MobileUpdateRegistryError("Stored mobile update channel identity changed");
+    return value;
+  };
+  const writeChannel = async (input, signal) => {
+    const value = {
+      ...input,
+      format: MOBILE_UPDATE_REGISTRY_FORMAT,
+      promotedAt: clock().toISOString()
+    };
+    const bytes = json(value);
+    await options.store.put(channelKey(value.appId, value.channel), bytes, {
+      cacheControl: "no-cache",
+      contentType: "application/json",
+      maxBytes: bytes.byteLength,
+      metadata: {
+        channel: value.channel,
+        ...value.releaseId ? { releaseId: value.releaseId } : {},
+        sha256: digest(bytes)
+      },
+      signal
+    });
+    return value;
+  };
+  const promoteUpdate = async (input) => {
+    input.signal?.throwIfAborted();
+    if (input.rollout <= 0 || input.rollout > 1)
+      throw new MobileUpdateRegistryError("Mobile update rollout is invalid");
+    const release = await readManifest(input.appId, input.releaseId);
+    if (!release || release.manifest.channel !== input.channel)
+      throw new MobileUpdateRegistryError("Mobile update was not published to this channel");
+    const existing = await readChannel(input.appId, input.channel);
+    await writeChannel({
+      appId: input.appId,
+      channel: input.channel,
+      ...existing?.releaseId && existing.releaseId !== input.releaseId ? { fallbackReleaseId: existing.releaseId } : existing?.fallbackReleaseId ? { fallbackReleaseId: existing.fallbackReleaseId } : {},
+      releaseId: input.releaseId,
+      rollout: input.rollout
+    }, input.signal);
+    return {
+      appId: input.appId,
+      channel: input.channel,
+      releaseId: input.releaseId,
+      rollout: input.rollout,
+      stage: "promoted"
+    };
+  };
+  const resolveUpdateState = async (input) => {
+    const channel = await readChannel(input.appId, input.channel);
+    if (!channel?.releaseId)
+      return { status: "empty" };
+    const selected = rolloutMember({
+      appId: input.appId,
+      channel: input.channel,
+      installationId: input.installationId,
+      releaseId: channel.releaseId,
+      rollout: channel.rollout
+    }) ? channel.releaseId : channel.fallbackReleaseId;
+    if (!selected)
+      return { status: "empty" };
+    const release = await readManifest(input.appId, selected);
+    if (!release || release.manifest.runtimeFingerprint !== input.runtimeFingerprint)
+      return { status: "incompatible" };
+    return {
+      ...selected === channel.releaseId && channel.activationId && channel.activatedAt ? {
+        activationId: channel.activationId,
+        activatedAt: channel.activatedAt
+      } : {},
+      manifest: release.manifest,
+      manifestKey: release.key,
+      status: "selected"
+    };
+  };
+  return {
+    publishUpdate: async (input) => {
+      input.signal?.throwIfAborted();
+      const manifest = parseMobileUpdateManifest(input.manifest);
+      verifyManifestSignature(manifest, options.publicKeys);
+      const localRoot = path.resolve(input.releaseDirectory);
+      const localManifest = parseMobileUpdateManifest(JSON.parse(await readFile23(path.join(localRoot, "update.json"), "utf8")));
+      if (JSON.stringify(localManifest) !== JSON.stringify(manifest))
+        throw new MobileUpdateRegistryError("Local mobile update manifest changed");
+      const existing = await readManifest(manifest.appId, manifest.releaseId);
+      let reused = existing !== null;
+      if (existing && JSON.stringify(existing.manifest) !== JSON.stringify(manifest))
+        throw new MobileUpdateRegistryError("Published mobile update is immutable");
+      if (!existing) {
+        for (const file of manifest.files) {
+          const local = path.join(localRoot, "files", file.path);
+          const metadata = await stat5(local).catch(() => null);
+          if (!metadata?.isFile() || metadata.size !== file.bytes)
+            throw new MobileUpdateRegistryError(`Mobile update file ${file.path} size changed`);
+          if (await fileDigest(Bun.file(local)) !== file.sha256)
+            throw new MobileUpdateRegistryError(`Mobile update file ${file.path} integrity failed`);
+          const key = fileKey(manifest, file);
+          const stored = await options.store.head(key);
+          if (!stored) {
+            await options.store.put(key, Bun.file(local).stream(), {
+              cacheControl: "public, max-age=31536000, immutable",
+              contentType: "application/octet-stream",
+              maxBytes: file.bytes,
+              metadata: { releaseid: manifest.releaseId, sha256: file.sha256 },
+              signal: input.signal
+            });
+          } else if (stored.size !== file.bytes || stored.metadata?.sha256 !== file.sha256 || (stored.metadata?.releaseid ?? stored.metadata?.releaseId) !== manifest.releaseId)
+            throw new MobileUpdateRegistryError("Stored mobile update file identity changed");
+        }
+        const bytes = json(manifest);
+        await options.store.put(manifestKey(manifest), bytes, {
+          cacheControl: "public, max-age=31536000, immutable",
+          contentType: "application/json",
+          maxBytes: bytes.byteLength,
+          metadata: { releaseid: manifest.releaseId, sha256: digest(bytes) },
+          signal: input.signal
+        });
+        if (!await readManifest(manifest.appId, manifest.releaseId))
+          throw new MobileUpdateRegistryError("Mobile update publication verification failed");
+        reused = false;
+      }
+      await promoteUpdate({
+        appId: manifest.appId,
+        channel: manifest.channel,
+        releaseId: manifest.releaseId,
+        rollout: input.rollout,
+        signal: input.signal
+      });
+      return {
+        appId: manifest.appId,
+        channel: manifest.channel,
+        releaseId: manifest.releaseId,
+        reused,
+        rollout: input.rollout,
+        stage: "published"
+      };
+    },
+    promoteUpdate,
+    rollbackUpdate: async (input) => {
+      input.signal?.throwIfAborted();
+      const existing = await readChannel(input.appId, input.channel);
+      if (!existing)
+        throw new MobileUpdateRegistryError("Mobile update channel does not exist");
+      if (input.releaseId) {
+        const release = await readManifest(input.appId, input.releaseId);
+        if (!release || release.manifest.channel !== input.channel)
+          throw new MobileUpdateRegistryError("Mobile rollback release was not published");
+      }
+      const activatedAt = clock().toISOString();
+      await writeChannel({
+        ...input.releaseId ? {
+          activationId: digest(new TextEncoder().encode(`${input.appId}\x00${input.channel}\x00${input.releaseId}\x00${activatedAt}`)),
+          activatedAt
+        } : {},
+        appId: input.appId,
+        channel: input.channel,
+        ...existing.releaseId ? { fallbackReleaseId: existing.releaseId } : {},
+        ...input.releaseId ? { releaseId: input.releaseId } : {},
+        rollout: input.releaseId ? 1 : 0
+      }, input.signal);
+      return {
+        appId: input.appId,
+        channel: input.channel,
+        ...input.releaseId ? { releaseId: input.releaseId } : {},
+        stage: "rolled-back"
+      };
+    },
+    resolveUpdate: async (input) => {
+      const resolution = await resolveUpdateState(input);
+      return resolution.status === "selected" ? { manifest: resolution.manifest, manifestKey: resolution.manifestKey } : null;
+    },
+    resolveUpdateState,
+    readUpdateFile: async (input) => {
+      const release = await readManifest(input.appId, input.releaseId);
+      if (!release)
+        return null;
+      const requested = safePath2(input.path);
+      const file = release.manifest.files.find((candidate) => candidate.path === requested);
+      if (!file)
+        return null;
+      const key = fileKey(release.manifest, file);
+      const [bytes, head] = await Promise.all([
+        options.store.get(key),
+        options.store.head(key)
+      ]);
+      if (!bytes || !head)
+        return null;
+      if (bytes.byteLength !== file.bytes || head.size !== file.bytes || head.metadata?.sha256 !== file.sha256 || (head.metadata?.releaseid ?? head.metadata?.releaseId) !== release.manifest.releaseId || digest(bytes) !== file.sha256)
+        throw new MobileUpdateRegistryError("Stored mobile update file integrity failed");
+      return { bytes, file };
+    }
+  };
+}, expoUpdateId = (releaseId) => {
+  const hash = RELEASE.test(releaseId) ? releaseId.slice("amu_".length, "amu_".length + 32) : createHash15("sha256").update(releaseId).digest("hex").slice(0, 32);
+  return `${hash.slice(0, 8)}-${hash.slice(8, 12)}-${hash.slice(12, 16)}-${hash.slice(16, 20)}-${hash.slice(20)}`;
+}, expoContentType = (extension2, launch) => {
+  if (launch)
+    return "application/javascript";
+  const normalized = extension2?.toLowerCase();
+  if (normalized === "png")
+    return "image/png";
+  if (normalized === "jpg" || normalized === "jpeg")
+    return "image/jpeg";
+  if (normalized === "webp")
+    return "image/webp";
+  if (normalized === "gif")
+    return "image/gif";
+  if (normalized === "svg")
+    return "image/svg+xml";
+  if (normalized === "json")
+    return "application/json";
+  if (normalized === "ttf")
+    return "font/ttf";
+  if (normalized === "otf")
+    return "font/otf";
+  if (normalized === "woff")
+    return "font/woff";
+  if (normalized === "woff2")
+    return "font/woff2";
+  return "application/octet-stream";
+}, encodeUpdatePath = (value) => value.split("/").map(encodeURIComponent).join("/"), expoProtocolHeaders, resolveExpoCodeSigning = (value) => {
+  if (!value)
+    return;
+  const entries = Object.entries(value.keys);
+  if (entries.length === 0)
+    throw new MobileUpdateRegistryError("Expo code signing requires at least one key");
+  return new Map(entries.map(([keyId, material]) => {
+    if (!NAME.test(keyId))
+      throw new MobileUpdateRegistryError("Expo code-signing key ID is invalid");
+    let certificate;
+    let privateKey;
+    try {
+      certificate = new X509Certificate3(material.certificate);
+      privateKey = createPrivateKey(material.privateKey);
+    } catch (error) {
+      throw new MobileUpdateRegistryError("Expo code-signing certificate or private key is invalid", { cause: error });
+    }
+    if (certificate.publicKey.asymmetricKeyType !== "rsa" || privateKey.asymmetricKeyType !== "rsa" || certificate.issuer !== certificate.subject || !certificate.verify(certificate.publicKey))
+      throw new MobileUpdateRegistryError("Expo code signing requires a self-signed RSA root and private key");
+    const certificatePublicKey = certificate.publicKey.export({
+      format: "der",
+      type: "spki"
+    });
+    const privatePublicKey = createPublicKey2(privateKey).export({
+      format: "der",
+      type: "spki"
+    });
+    if (!certificatePublicKey.equals(privatePublicKey))
+      throw new MobileUpdateRegistryError("Expo code-signing private key does not match its certificate");
+    const now = Date.now();
+    if (now < Date.parse(certificate.validFrom) || now > Date.parse(certificate.validTo))
+      throw new MobileUpdateRegistryError("Expo code-signing certificate is not currently valid");
+    return [keyId, { keyId, privateKey }];
+  }));
+}, expoSignatureExpectation = (value) => {
+  const fields = new Map;
+  for (const raw of value.split(",")) {
+    const match = /^\s*([a-z][a-z0-9_-]*)(?:=(\?1|\?0|"[^"\\]*"|[a-z0-9._-]+))?\s*$/u.exec(raw);
+    if (!match || fields.has(match[1]))
+      throw new MobileUpdateRegistryError("Expo code-signing expectation is invalid");
+    const encoded = match[2];
+    fields.set(match[1], encoded === undefined || encoded === "?1" ? true : encoded.startsWith('"') ? encoded.slice(1, -1) : encoded);
+  }
+  return fields;
+}, expoExtraParam = (request, key) => {
+  const value = request.headers.get("expo-extra-params");
+  if (!value)
+    return null;
+  for (const raw of value.split(",")) {
+    const match = /^\s*([a-z][a-z0-9_.*-]*)=(?:"((?:[^"\\]|\\["\\])*)"|([^\s,]+))\s*$/u.exec(raw);
+    if (!match || match[1] !== key)
+      continue;
+    return match[2] !== undefined ? match[2].replace(/\\(["\\])/gu, "$1") : match[3] ?? null;
+  }
+  return null;
+}, requestedExpoSignature = (request, codeSigning) => {
+  const expectation = request.headers.get("expo-expect-signature");
+  if (!expectation)
+    return;
+  if (!codeSigning)
+    throw new MobileUpdateRegistryError("Expo end-to-end code signing is not configured");
+  const fields = expoSignatureExpectation(expectation);
+  const keyId = fields.get("keyid");
+  const algorithm = fields.get("alg");
+  const signatureRequested = fields.get("sig") === true;
+  if (!signatureRequested || keyId !== undefined && typeof keyId !== "string" || algorithm !== undefined && algorithm !== EXPO_CODE_SIGNING_ALGORITHM)
+    throw new MobileUpdateRegistryError("Requested Expo code-signing parameters are unsupported");
+  const selected = typeof keyId === "string" ? codeSigning.get(keyId) : codeSigning.size === 1 ? codeSigning.values().next().value : undefined;
+  if (!selected)
+    throw new MobileUpdateRegistryError("Requested Expo code-signing key is unavailable");
+  return selected;
+}, expoSignatureHeader = (body, codeSigning) => {
+  const signature = sign2("RSA-SHA256", Buffer.from(body), codeSigning.privateKey);
+  return `sig="${signature.toString("base64")}", keyid="${codeSigning.keyId}", alg="${EXPO_CODE_SIGNING_ALGORITHM}"`;
+}, expoRollbackResponse = (request, codeSigning) => {
+  const current = request.headers.get("expo-current-update-id");
+  const embedded = request.headers.get("expo-embedded-update-id");
+  if (!current || current === embedded)
+    return new Response(null, { status: 204 });
+  const boundary = `absolutejs-${crypto.randomUUID()}`;
+  const directive = JSON.stringify({
+    parameters: { commitTime: new Date().toISOString() },
+    type: "rollBackToEmbedded"
+  });
+  const body = [
+    `--${boundary}`,
+    'content-disposition: form-data; name="directive"',
+    "content-type: application/json; charset=utf-8",
+    ...codeSigning ? [`expo-signature: ${expoSignatureHeader(directive, codeSigning)}`] : [],
+    "",
+    directive,
+    `--${boundary}--`,
+    ""
+  ].join(`\r
+`);
+  return new Response(body, {
+    headers: {
+      ...expoProtocolHeaders,
+      "content-type": `multipart/mixed; boundary=${boundary}`
+    }
+  });
+}, createMobileUpdateHandler = (options) => {
+  const route = (options.route ?? `/__absolute/mobile/updates/${options.channel}`).replace(/^\/+|\/+$/g, "");
+  const allowedOrigins = new Set(options.allowedOrigins ?? ["capacitor://localhost", "https://localhost"]);
+  const expoCodeSigning = resolveExpoCodeSigning(options.expoCodeSigning);
+  return async (request) => {
+    const origin = request.headers.get("origin");
+    const cors = origin && allowedOrigins.has(origin) ? { "access-control-allow-origin": origin, vary: "Origin" } : {};
+    if (request.method === "OPTIONS") {
+      if (!origin || !allowedOrigins.has(origin))
+        return new Response(null, { status: 403 });
+      return new Response(null, {
+        headers: {
+          ...cors,
+          "access-control-allow-headers": "x-absolute-mobile-app,x-absolute-mobile-channel,x-absolute-mobile-installation,x-absolute-mobile-release,x-absolute-mobile-runtime",
+          "access-control-allow-methods": "GET,OPTIONS",
+          "access-control-max-age": "600"
+        },
+        status: 204
+      });
+    }
+    if (request.method !== "GET")
+      return new Response(null, { status: 405 });
+    const pathname = new URL(request.url).pathname.replace(/^\/+/, "");
+    const relative17 = pathname.startsWith(`${route}/`) ? pathname.slice(route.length + 1) : "";
+    if (relative17 === "update.json") {
+      const expoProtocolVersion = request.headers.get("expo-protocol-version");
+      const expoProtocol = expoProtocolVersion !== null;
+      if (expoProtocol && expoProtocolVersion !== "1")
+        return Response.json({
+          error: `Unsupported Expo Updates protocol version: ${expoProtocolVersion}`
+        }, { status: 406 });
+      const appId = request.headers.get("x-absolute-mobile-app");
+      const channel = request.headers.get("x-absolute-mobile-channel");
+      const installationId = expoProtocol ? expoExtraParam(request, "absolute-installation") ?? request.headers.get("x-absolute-mobile-installation") : request.headers.get("x-absolute-mobile-installation");
+      const runtimeFingerprint = expoProtocol ? request.headers.get("expo-runtime-version") : request.headers.get("x-absolute-mobile-runtime");
+      if (appId !== options.appId || channel !== options.channel || !installationId || !runtimeFingerprint)
+        return new Response(null, { status: 400 });
+      const resolution = options.registry.resolveUpdateState ? await options.registry.resolveUpdateState({
+        appId,
+        channel,
+        installationId,
+        runtimeFingerprint
+      }) : undefined;
+      const selected = resolution ? resolution.status === "selected" ? resolution : null : await options.registry.resolveUpdate({
+        appId,
+        channel,
+        installationId,
+        runtimeFingerprint
+      });
+      if (expoProtocol) {
+        let requestedCodeSigning;
+        try {
+          requestedCodeSigning = requestedExpoSignature(request, expoCodeSigning);
+        } catch (error) {
+          return Response.json({
+            error: error instanceof Error ? error.message : "Expo code-signing negotiation failed"
+          }, { status: expoCodeSigning ? 406 : 400 });
+        }
+        if (!selected) {
+          if (resolution?.status === "incompatible")
+            return new Response(null, { status: 204 });
+          return expoRollbackResponse(request, requestedCodeSigning);
+        }
+        const platform5 = request.headers.get("expo-platform");
+        if (platform5 !== "android" && platform5 !== "ios")
+          return new Response(null, { status: 400 });
+        const updateId = expoUpdateId((resolution?.status === "selected" ? resolution.activationId : undefined) ?? selected.manifest.releaseId);
+        if (request.headers.get("expo-current-update-id") === updateId)
+          return new Response(null, { status: 204 });
+        const descriptorFile = await options.registry.readUpdateFile({
+          appId,
+          path: EXPO_DESCRIPTOR,
+          releaseId: selected.manifest.releaseId
+        });
+        if (!descriptorFile)
+          return new Response(null, { status: 409 });
+        const descriptor = parseExpoUpdateDescriptor(descriptorFile.bytes);
+        const platformUpdate = descriptor.platforms[platform5];
+        if (!platformUpdate || descriptor.runtimeVersion !== runtimeFingerprint)
+          return new Response(null, { status: 204 });
+        const origin2 = new URL(request.url).origin;
+        const releaseRoute = `${origin2}/${route}/${selected.manifest.releaseId}/files`;
+        const protocolAsset = (asset2, launch = false) => {
+          const file2 = selected.manifest.files.find((candidate) => candidate.path === asset2.path);
+          if (!file2)
+            throw new MobileUpdateRegistryError(`Expo update references missing signed asset ${asset2.path}`);
+          return {
+            contentType: expoContentType(asset2.extension, launch),
+            ...asset2.extension ? { fileExtension: `.${asset2.extension}` } : {},
+            key: file2.sha256,
+            hash: Buffer.from(file2.sha256, "hex").toString("base64url"),
+            url: `${releaseRoute}/${encodeUpdatePath(asset2.path)}`
+          };
+        };
+        const manifest = JSON.stringify({
+          assets: platformUpdate.assets.map((asset2) => protocolAsset(asset2)),
+          createdAt: (resolution?.status === "selected" ? resolution.activatedAt : undefined) ?? selected.manifest.createdAt,
+          extra: {
+            absolutejs: {
+              channel: selected.manifest.channel,
+              releaseId: selected.manifest.releaseId
+            },
+            expoClient: descriptor.expoConfig
+          },
+          id: updateId,
+          launchAsset: protocolAsset(platformUpdate.launchAsset, true),
+          metadata: {
+            channel: selected.manifest.channel,
+            releaseId: selected.manifest.releaseId
+          },
+          runtimeVersion: descriptor.runtimeVersion
+        });
+        return new Response(manifest, {
+          headers: {
+            ...expoProtocolHeaders,
+            ...requestedCodeSigning ? {
+              "expo-signature": expoSignatureHeader(manifest, requestedCodeSigning)
+            } : {}
+          }
+        });
+      }
+      if (!selected)
+        return new Response(null, { status: 204 });
+      return Response.json(selected.manifest, {
+        headers: {
+          ...cors,
+          "cache-control": "no-store",
+          etag: `"${selected.manifest.releaseId}"`
+        }
+      });
+    }
+    const match = /^(amu_[a-f0-9]{64})\/files\/(.+)$/.exec(relative17);
+    if (!match?.[1] || !match[2])
+      return new Response(null, { status: 404 });
+    const file = await options.registry.readUpdateFile({
+      appId: options.appId,
+      path: decodeURIComponent(match[2]),
+      releaseId: match[1]
+    });
+    if (!file)
+      return new Response(null, { status: 404 });
+    return new Response(new Blob([new Uint8Array(file.bytes).buffer]), {
+      headers: {
+        ...cors,
+        "cache-control": "public, max-age=31536000, immutable",
+        "content-length": String(file.file.bytes),
+        "content-type": expoContentType(file.file.path.includes(".") ? file.file.path.slice(file.file.path.lastIndexOf(".") + 1) : undefined, false),
+        etag: `"${file.file.sha256}"`
+      }
+    });
+  };
+};
+var init_mobileUpdate = __esm(() => {
+  MAX_FILE_BYTES = 32 * 1024 * 1024;
+  MAX_TOTAL_BYTES = 128 * 1024 * 1024;
+  HASH = /^[a-f0-9]{64}$/;
+  RELEASE = /^amu_[a-f0-9]{64}$/;
+  APP_ID = /^[A-Za-z][\w]*(?:\.[A-Za-z][\w]*)+$/;
+  NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+  MobileUpdateRegistryError = class MobileUpdateRegistryError extends Error {
+  };
+  expoProtocolHeaders = {
+    "cache-control": "private, max-age=0",
+    "content-type": "application/expo+json",
+    "expo-protocol-version": "1",
+    "expo-sfv-version": "0"
+  };
+});
+
+// src/mobile/updateServer.ts
+var exports_updateServer = {};
+__export(exports_updateServer, {
+  ABSOLUTE_MOBILE_UPDATE_SERVER_FORMAT: () => ABSOLUTE_MOBILE_UPDATE_SERVER_FORMAT,
+  DEFAULT_MOBILE_UPDATE_REGISTRY_MODULE: () => DEFAULT_MOBILE_UPDATE_REGISTRY_MODULE,
+  createAbsoluteMobileUpdateServerPlugin: () => createAbsoluteMobileUpdateServerPlugin,
+  inspectAbsoluteMobileUpdateServer: () => inspectAbsoluteMobileUpdateServer,
+  loadAbsoluteMobileUpdateServerModule: () => loadAbsoluteMobileUpdateServerModule,
+  renderAbsoluteMobileUpdateRegistry: () => renderAbsoluteMobileUpdateRegistry,
+  writeAbsoluteMobileUpdateRegistry: () => writeAbsoluteMobileUpdateRegistry
+});
+import {
+  createPrivateKey as createPrivateKey2,
+  createPublicKey as createPublicKey3,
+  X509Certificate as X509Certificate4
+} from "crypto";
+import { access as access16, mkdir as mkdir18 } from "fs/promises";
+import { dirname as dirname19, isAbsolute as isAbsolute9, relative as relative17, resolve as resolve20, sep as sep11 } from "path";
+import { pathToFileURL as pathToFileURL5 } from "url";
+import { Elysia as Elysia4 } from "elysia";
+var ABSOLUTE_MOBILE_UPDATE_SERVER_FORMAT = 1, DEFAULT_MOBILE_UPDATE_REGISTRY_MODULE = "mobile.update.ts", object7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), projectPath3 = (projectRoot, requested) => {
+  const root = resolve20(projectRoot);
+  const path2 = resolve20(root, requested);
+  const projectRelative = relative17(root, path2);
+  if (projectRelative === ".." || projectRelative.startsWith(`..${sep11}`) || isAbsolute9(projectRelative))
+    throw new TypeError("mobile.updates.server.registry must remain inside the project.");
+  return path2;
+}, isRegistry4 = (value) => object7(value) && [
+  "publishUpdate",
+  "promoteUpdate",
+  "rollbackUpdate",
+  "resolveUpdate",
+  "readUpdateFile"
+].every((method) => typeof value[method] === "function"), serverMetadata = (value) => {
+  if (!object7(value))
+    throw new TypeError("Mobile update registry must export valid absoluteMobileUpdateServer metadata. Run `absolute mobile update provision`.");
+  const { format, provider, storage } = value;
+  if (format !== ABSOLUTE_MOBILE_UPDATE_SERVER_FORMAT || storage !== "local" && storage !== "durable" || typeof provider !== "string" || !provider)
+    throw new TypeError("Mobile update registry must export valid absoluteMobileUpdateServer metadata. Run `absolute mobile update provision`.");
+  const metadata = {
+    format: ABSOLUTE_MOBILE_UPDATE_SERVER_FORMAT,
+    provider,
+    storage
+  };
+  return metadata;
+}, loadAbsoluteMobileUpdateServerModule = async (projectRoot, requestedModulePath = DEFAULT_MOBILE_UPDATE_REGISTRY_MODULE) => {
+  const modulePath = projectPath3(projectRoot, requestedModulePath);
+  await access16(modulePath).catch(() => {
+    throw new TypeError(`Mobile update server registry does not exist: ${modulePath}. Run \`absolute mobile update provision\`.`);
+  });
+  const loaded = await import(pathToFileURL5(modulePath).href);
+  if (!object7(loaded))
+    throw new TypeError("Mobile update registry module has no exports.");
+  const registry4 = loaded.default ?? loaded.registry;
+  if (!isRegistry4(registry4))
+    throw new TypeError("Mobile update registry must implement publication, promotion, rollback, resolution, and file reads.");
+  const metadata = serverMetadata(loaded.absoluteMobileUpdateServer);
+  const verifier = loaded.verifyAbsoluteMobileUpdateServer;
+  if (metadata.storage === "durable" && typeof verifier !== "function")
+    throw new TypeError("Mobile update registries marked durable must export verifyAbsoluteMobileUpdateServer(). Re-run `absolute mobile update provision --storage s3 --force` or provide an active durability check.");
+  return {
+    metadata,
+    registry: registry4,
+    ...typeof verifier === "function" ? {
+      verifyDurability: async () => {
+        await verifier();
+      }
+    } : {}
+  };
+}, verifyDurableModule = async (module) => {
+  if (module.metadata.storage !== "durable")
+    throw new TypeError("Mobile production updates require durable object storage. Re-run `absolute mobile update provision --storage s3 --force` or configure a durable adapter.");
+  try {
+    await module.verifyDurability?.();
+  } catch (error) {
+    throw new TypeError(`Durable mobile update storage verification failed for ${module.metadata.provider}. Check the bucket, endpoint, credentials, and read/write/delete permissions.`, { cause: error });
+  }
+}, expoSigningOptions = (config) => {
+  if (!config.updates?.expoCodeSigning)
+    return;
+  const entries = Object.entries(config.updateServer?.expoCodeSigningKeys ?? {});
+  const keys = Object.fromEntries(entries.map(([keyId, key]) => {
+    const privateKey = process.env[key.privateKeyEnv];
+    if (!privateKey)
+      throw new TypeError(`Expo update serving requires ${key.privateKeyEnv} on the trusted server.`);
+    try {
+      const certificate = new X509Certificate4(key.certificatePem);
+      const expected = certificate.publicKey.export({
+        format: "der",
+        type: "spki"
+      });
+      const actual = createPublicKey3(createPrivateKey2(privateKey)).export({
+        format: "der",
+        type: "spki"
+      });
+      if (!expected.equals(actual))
+        throw new Error("key mismatch");
+    } catch (error) {
+      throw new TypeError(`${key.privateKeyEnv} must contain the RSA private key matching Expo update key ${keyId}.`, { cause: error });
+    }
+    return [keyId, { certificate: key.certificatePem, privateKey }];
+  }));
+  return { keys };
+}, createAbsoluteMobileUpdateServerPlugin = async (config, projectRoot, options = {}) => {
+  const { updates, updateServer: server } = config;
+  if (!updates || !server?.autoMount)
+    return new Elysia4({ name: "absolutejs-mobile-updates-disabled" });
+  const module = await loadAbsoluteMobileUpdateServerModule(projectRoot, server.registryModule);
+  if (options.production)
+    await verifyDurableModule(module);
+  const manifest = new URL(updates.manifestUrl);
+  if (!manifest.pathname.endsWith("/update.json"))
+    throw new TypeError("Auto-mounted mobile update manifests must end in /update.json.");
+  const route = manifest.pathname.slice(0, -"/update.json".length);
+  const { createMobileUpdateHandler: createMobileUpdateHandler2 } = await Promise.resolve().then(() => (init_mobileUpdate(), exports_mobileUpdate));
+  const handler = createMobileUpdateHandler2({
+    appId: config.appId,
+    channel: updates.channel,
+    ...config.engine === "expo" ? { expoCodeSigning: expoSigningOptions(config) } : {},
+    registry: module.registry,
+    route
+  });
+  return new Elysia4({ name: "absolutejs-mobile-updates" }).all(`${route}/*`, ({ request }) => handler(request));
+}, inspectAbsoluteMobileUpdateServer = async (config, projectRoot) => {
+  if (!config.updates)
+    return;
+  const module = await loadAbsoluteMobileUpdateServerModule(projectRoot, config.updateServer?.registryModule);
+  await verifyDurableModule(module);
+  if (config.engine === "expo")
+    expoSigningOptions(config);
+  return module.metadata;
+}, publicKeysSource = (publicKeys) => JSON.stringify(publicKeys, null, "\t"), renderAbsoluteMobileUpdateRegistry = (options) => {
+  const metadata = `export const absoluteMobileUpdateServer = {
+	format: 1,
+	provider: '${options.storage}',
+	storage: '${options.storage === "local" ? "local" : "durable"}'
+} as const;`;
+  if (options.storage === "local")
+    return `import { fileURLToPath } from 'node:url';
+import { localBlobStore } from '@absolutejs/blob/local';
+import { createMobileUpdateRegistry } from '@absolutejs/deploy/mobile-update';
+
+${metadata}
+
+const store = localBlobStore({
+	root: process.env.ABSOLUTE_MOBILE_UPDATE_LOCAL_ROOT ??
+		fileURLToPath(new URL('./.absolutejs/mobile/update-registry/', import.meta.url))
+});
+
+export default createMobileUpdateRegistry({
+	publicKeys: ${publicKeysSource(options.publicKeys)},
+	store
+});
+`;
+  return `import { randomUUID } from 'node:crypto';
+import { DeleteObjectCommand, GetObjectCommand, PutObjectCommand, S3Client } from '@aws-sdk/client-s3';
+import { awsS3BlobStore } from '@absolutejs/blob/aws-s3';
+import { createMobileUpdateRegistry } from '@absolutejs/deploy/mobile-update';
+
+${metadata}
+
+const required = (name: string) => {
+	const value = process.env[name];
+	if (!value) throw new Error(\`Missing \${name}\`);
+	return value;
+};
+
+const bucket = required('ABSOLUTE_MOBILE_UPDATE_S3_BUCKET');
+const client = new S3Client({
+	region: process.env.ABSOLUTE_MOBILE_UPDATE_S3_REGION ?? 'auto',
+	forcePathStyle: process.env.ABSOLUTE_MOBILE_UPDATE_S3_FORCE_PATH_STYLE === '1',
+	...(process.env.ABSOLUTE_MOBILE_UPDATE_S3_ENDPOINT
+		? { endpoint: process.env.ABSOLUTE_MOBILE_UPDATE_S3_ENDPOINT }
+		: {})
+});
+const store = awsS3BlobStore({ bucket, client });
+
+export const verifyAbsoluteMobileUpdateServer = async () => {
+	const key = \`absolutejs/mobile-updates/_health/\${randomUUID()}\`;
+	const expected = randomUUID();
+	let stored = false;
+	try {
+		await client.send(new PutObjectCommand({ Bucket: bucket, Key: key, Body: expected }));
+		stored = true;
+		const response = await client.send(new GetObjectCommand({ Bucket: bucket, Key: key }));
+		if ((await response.Body?.transformToString()) !== expected)
+			throw new Error('Durability probe read did not match its write.');
+	} finally {
+		if (stored) await client.send(new DeleteObjectCommand({ Bucket: bucket, Key: key }));
+	}
+};
+
+export default createMobileUpdateRegistry({
+	publicKeys: ${publicKeysSource(options.publicKeys)},
+	store
+});
+`;
+}, writeAbsoluteMobileUpdateRegistry = async (options) => {
+  const path2 = projectPath3(options.projectRoot, options.modulePath ?? DEFAULT_MOBILE_UPDATE_REGISTRY_MODULE);
+  if (!options.force) {
+    await access16(path2).then(() => {
+      throw new TypeError(`Mobile update registry already exists: ${path2}. Pass --force to replace it.`);
+    }, () => {
+      return;
+    });
+  }
+  await mkdir18(dirname19(path2), { recursive: true });
+  await Bun.write(path2, renderAbsoluteMobileUpdateRegistry({
+    publicKeys: options.publicKeys,
+    storage: options.storage
+  }));
+  return path2;
+};
+var init_updateServer = () => {};
+
 // src/mobile/index.ts
 init_artifactStore();
 
@@ -37789,6 +38751,9 @@ var parseAbsoluteMobileUpdateRequest = (request) => {
     throw new TypeError("Mobile update runtime identity is invalid.");
   return identity;
 };
+
+// src/mobile/index.ts
+init_updateServer();
 export {
   ABSOLUTE_ANDROID_RELEASE_FORMAT,
   ABSOLUTE_AUTH_PACKAGE,
@@ -37822,6 +38787,7 @@ export {
   ABSOLUTE_MOBILE_UPDATE_MAX_FILE_BYTES,
   ABSOLUTE_MOBILE_UPDATE_MAX_TOTAL_BYTES,
   ABSOLUTE_MOBILE_UPDATE_RUNTIME_FORMAT,
+  ABSOLUTE_MOBILE_UPDATE_SERVER_FORMAT,
   ABSOLUTE_MOBILE_UPDATE_SIGNATURE_ALGORITHM,
   ABSOLUTE_NATIVE_AUTH_CLIENTS_ENV,
   ABSOLUTE_NATIVE_AUTH_SCOPES,
@@ -37834,6 +38800,7 @@ export {
   ANDROID_ASSOCIATION_PATH,
   APPLE_ASSOCIATION_PATH,
   AbsoluteMobilePageProtocolError,
+  DEFAULT_MOBILE_UPDATE_REGISTRY_MODULE,
   MOBILE_PAGE_REQUEST_HEADERS,
   absoluteDeviceNativeRequirements,
   absoluteExpoExecutable,
@@ -37886,6 +38853,7 @@ export {
   createAbsoluteMobileRouteMetadataPlugin,
   createAbsoluteMobileUpdateClient,
   createAbsoluteMobileUpdateRuntimeDescriptor,
+  createAbsoluteMobileUpdateServerPlugin,
   createAbsoluteMobileUpgradeResponse,
   createAbsoluteRemoteExpoIosDevProject,
   createAbsoluteRemoteIosDevProject,
@@ -37910,6 +38878,7 @@ export {
   hashAbsoluteMobilePropsSchema,
   inspectAbsoluteAndroidInstalledApp,
   inspectAbsoluteMobileRouteMetadata,
+  inspectAbsoluteMobileUpdateServer,
   inspectAbsoluteRemoteMac,
   inspectAbsoluteRemoteMacLanHost,
   inspectAbsoluteRemoteMacWorkspace,
@@ -37928,6 +38897,7 @@ export {
   loadAbsoluteDeviceCapabilityProviders,
   loadAbsoluteMobileMaterializedBundle,
   loadAbsoluteMobileUpdatePublisher,
+  loadAbsoluteMobileUpdateServerModule,
   loadAbsoluteNativeReleasePublisher,
   matchesAbsoluteMobileRoutePattern,
   materializeAbsoluteCapacitorWebBundle,
@@ -37974,6 +38944,7 @@ export {
   readAbsoluteMobileUpdate,
   redactAbsoluteIosLog,
   removeAbsoluteRemoteMacProfile,
+  renderAbsoluteMobileUpdateRegistry,
   repairAbsoluteIosDevSession,
   requestAbsoluteMobileBack,
   requireAbsoluteIosReleaseMetadata,
@@ -38009,8 +38980,9 @@ export {
   waitForAbsoluteIosHmrLog,
   writeAbsoluteCapacitorConfig,
   writeAbsoluteExpoProject,
-  writeAbsoluteMobileGithubWorkflow
+  writeAbsoluteMobileGithubWorkflow,
+  writeAbsoluteMobileUpdateRegistry
 };
 
-//# debugId=7510C0F4F58DE47064756E2164756E21
+//# debugId=A519D38D860E371564756E2164756E21
 //# sourceMappingURL=index.js.map