@absolutejs/absolute 0.20.0-beta.81 → 0.20.0-beta.83

package/dist/cli/index.js

@@ -203,7 +203,7 @@ if (command === "dev") {
   sendTelemetryEvent("cli:command", {
     command: `mobile:${workspaceCommand ?? "unknown"}`
   });
-  const { runMobile } = await import("./mobile-rdwdcks1.js");
+  const { runMobile } = await import("./mobile-9dx39bd3.js");
   try {
     await runMobile(args);
   } catch (error) {

package/dist/cli/{mobile-rdwdcks1.js → mobile-9dx39bd3.js}

@@ -2,6 +2,9 @@
 import {
   installPackages
 } from "./index-zh6hhrwy.js";
+import {
+  formatBytes
+} from "./index-9r7n9dqp.js";
 import {
   start
 } from "./index-q78x1k9q.js";
@@ -19292,11 +19295,29 @@ var loadAbsoluteMobileUpdateServerModule = async (projectRoot, requestedModulePa
   const registry = loaded.default ?? loaded.registry;
   if (!isRegistry(registry))
     throw new TypeError("Mobile update registry must implement publication, promotion, rollback, resolution, and file reads.");
+  const metadata = serverMetadata(loaded.absoluteMobileUpdateServer);
+  const verifier = loaded.verifyAbsoluteMobileUpdateServer;
+  if (metadata.storage === "durable" && typeof verifier !== "function")
+    throw new TypeError("Mobile update registries marked durable must export verifyAbsoluteMobileUpdateServer(). Re-run `absolute mobile update provision --storage s3 --force` or provide an active durability check.");
   return {
-    metadata: serverMetadata(loaded.absoluteMobileUpdateServer),
-    registry
+    metadata,
+    registry,
+    ...typeof verifier === "function" ? {
+      verifyDurability: async () => {
+        await verifier();
+      }
+    } : {}
   };
 };
+var verifyDurableModule = async (module) => {
+  if (module.metadata.storage !== "durable")
+    throw new TypeError("Mobile production updates require durable object storage. Re-run `absolute mobile update provision --storage s3 --force` or configure a durable adapter.");
+  try {
+    await module.verifyDurability?.();
+  } catch (error) {
+    throw new TypeError(`Durable mobile update storage verification failed for ${module.metadata.provider}. Check the bucket, endpoint, credentials, and read/write/delete permissions.`, { cause: error });
+  }
+};
 var expoSigningOptions = (config) => {
   if (!config.updates?.expoCodeSigning)
     return;
@@ -19328,8 +19349,7 @@ var inspectAbsoluteMobileUpdateServer = async (config, projectRoot) => {
   if (!config.updates)
     return;
   const module = await loadAbsoluteMobileUpdateServerModule(projectRoot, config.updateServer?.registryModule);
-  if (module.metadata.storage !== "durable")
-    throw new TypeError("Mobile production updates require durable object storage; the configured registry is local-only.");
+  await verifyDurableModule(module);
   if (config.engine === "expo")
     expoSigningOptions(config);
   return module.metadata;
@@ -19358,7 +19378,8 @@ export default createMobileUpdateRegistry({
 	store
 });
 `;
-  return `import { S3Client } from '@aws-sdk/client-s3';
+  return `import { randomUUID } from 'node:crypto';
+import { DeleteObjectCommand, GetObjectCommand, PutObjectCommand, S3Client } from '@aws-sdk/client-s3';
 import { awsS3BlobStore } from '@absolutejs/blob/aws-s3';
 import { createMobileUpdateRegistry } from '@absolutejs/deploy/mobile-update';
 
@@ -19370,6 +19391,7 @@ const required = (name: string) => {
 	return value;
 };
 
+const bucket = required('ABSOLUTE_MOBILE_UPDATE_S3_BUCKET');
 const client = new S3Client({
 	region: process.env.ABSOLUTE_MOBILE_UPDATE_S3_REGION ?? 'auto',
 	forcePathStyle: process.env.ABSOLUTE_MOBILE_UPDATE_S3_FORCE_PATH_STYLE === '1',
@@ -19377,10 +19399,22 @@ const client = new S3Client({
 		? { endpoint: process.env.ABSOLUTE_MOBILE_UPDATE_S3_ENDPOINT }
 		: {})
 });
-const store = awsS3BlobStore({
-	bucket: required('ABSOLUTE_MOBILE_UPDATE_S3_BUCKET'),
-	client
-});
+const store = awsS3BlobStore({ bucket, client });
+
+export const verifyAbsoluteMobileUpdateServer = async () => {
+	const key = \`absolutejs/mobile-updates/_health/\${randomUUID()}\`;
+	const expected = randomUUID();
+	let stored = false;
+	try {
+		await client.send(new PutObjectCommand({ Bucket: bucket, Key: key, Body: expected }));
+		stored = true;
+		const response = await client.send(new GetObjectCommand({ Bucket: bucket, Key: key }));
+		if ((await response.Body?.transformToString()) !== expected)
+			throw new Error('Durability probe read did not match its write.');
+	} finally {
+		if (stored) await client.send(new DeleteObjectCommand({ Bucket: bucket, Key: key }));
+	}
+};
 
 export default createMobileUpdateRegistry({
 	publicKeys: ${publicKeysSource(options.publicKeys)},
@@ -19468,7 +19502,7 @@ var mobileUpdateServerCheck = async (config, projectRoot) => {
     return;
   try {
     const metadata = await inspectAbsoluteMobileUpdateServer(config, projectRoot);
-    return pass("updates.trusted-server", `The trusted update server uses durable ${metadata?.provider ?? "object"} storage, supports publish/promote/rollback, and has valid server-only signing material.`, config.updateServer?.registryModule);
+    return pass("updates.trusted-server", `The trusted update server proved durable ${metadata?.provider ?? "object"} storage read/write/delete access, supports publish/promote/rollback, and has valid server-only signing material.`, config.updateServer?.registryModule);
   } catch (error) {
     return fail("updates.trusted-server", error instanceof Error ? error.message : "The trusted mobile update server is not release-ready.", config.updateServer?.registryModule ?? "mobile.update.ts", "Run `absolute mobile update provision --storage s3 --force`, provision its environment variables on the trusted server, and rerun the release doctor.");
   }
@@ -21954,6 +21988,45 @@ var generateAbsoluteExpoCodeSigning = async (options) => {
 import { access as access11 } from "fs/promises";
 import { isAbsolute as isAbsolute5, relative as relative10, resolve as resolve11, sep as sep6 } from "path";
 import { pathToFileURL as pathToFileURL3 } from "url";
+var lifecycleMethod = (publisher, name) => {
+  const method = publisher[name];
+  if (typeof method !== "function")
+    throw new TypeError(`Mobile update registry does not support ${name}. Re-run \`absolute mobile update provision --force\` after upgrading @absolutejs/deploy.`);
+  return method;
+};
+var validateStorageIdentity = (result, appId) => {
+  if (!object3(result) || result.appId !== appId || !Array.isArray(result.releases) || ![
+    result.channelCount,
+    result.reclaimableBytes,
+    result.releaseBytes,
+    result.releaseCount,
+    result.totalBytes,
+    result.totalObjectCount,
+    result.untrackedBytes
+  ].every((value) => Number.isSafeInteger(value) && value >= 0))
+    throw new TypeError("Mobile update registry returned an invalid storage report.");
+  return result;
+};
+var inspectAbsoluteMobileUpdateStorage = async (options) => validateStorageIdentity(await lifecycleMethod(options.publisher, "inspectUpdateStorage")({
+  appId: options.appId,
+  ...options.minAgeMs === undefined ? {} : { minAgeMs: options.minAgeMs },
+  ...options.retainRecent === undefined ? {} : { retainRecent: options.retainRecent },
+  ...options.signal ? { signal: options.signal } : {}
+}), options.appId);
+var pruneAbsoluteMobileUpdates = async (options) => {
+  const result = await lifecycleMethod(options.publisher, "pruneUpdates")({
+    appId: options.appId,
+    ...options.apply === undefined ? {} : { apply: options.apply },
+    ...options.gracePeriodMs === undefined ? {} : { gracePeriodMs: options.gracePeriodMs },
+    ...options.minAgeMs === undefined ? {} : { minAgeMs: options.minAgeMs },
+    ...options.retainRecent === undefined ? {} : { retainRecent: options.retainRecent },
+    ...options.signal ? { signal: options.signal } : {}
+  });
+  validateStorageIdentity(result, options.appId);
+  if (!Array.isArray(result.marked) || !Array.isArray(result.restored) || !Array.isArray(result.swept) || typeof result.dryRun !== "boolean" || !Number.isSafeInteger(result.reclaimedBytes) || result.reclaimedBytes < 0)
+    throw new TypeError("Mobile update registry returned an invalid collection report.");
+  return result;
+};
 var object3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var isPublisher2 = (value) => object3(value) && typeof value.publishUpdate === "function" && typeof value.promoteUpdate === "function" && typeof value.rollbackUpdate === "function";
 var projectPath3 = (projectRoot, requested, label) => {
@@ -22710,7 +22783,7 @@ var provisionMobileUpdate = async (args) => {
     throw new TypeError("--storage must be local or s3.");
   const modulePath = valueAfter(args, "--registry") ?? mobile.updateServer.registryModule;
   const packages = [
-    "@absolutejs/deploy@0.25.5",
+    "@absolutejs/deploy@0.25.7",
     "@absolutejs/blob@0.5.2",
     ...requestedStorage === "s3" ? [
       "@aws-sdk/client-s3@3.1095.0",
@@ -22794,6 +22867,97 @@ var rollbackMobileUpdate = async (args) => {
   console.log(result.releaseId ? `Rolled ${result.channel} back to ${result.releaseId}.` : `Rolled ${result.channel} back to the embedded store build.`);
   return result;
 };
+var mobileUpdateDays = (args, flag) => {
+  const value = valueAfter(args, flag);
+  if (value === undefined)
+    return;
+  const parsed = Number(value);
+  const milliseconds = parsed * 24 * 60 * 60 * 1000;
+  if (!Number.isFinite(parsed) || parsed < 0 || !Number.isSafeInteger(milliseconds))
+    throw new TypeError(`${flag} must be a non-negative number of days.`);
+  return milliseconds;
+};
+var mobileUpdateRetention = (args) => {
+  const retainedValue = valueAfter(args, "--retain");
+  const retainRecent = retainedValue === undefined ? undefined : Number(retainedValue);
+  if (retainRecent !== undefined && (!Number.isSafeInteger(retainRecent) || retainRecent < 0))
+    throw new TypeError("--retain must be a non-negative integer.");
+  return {
+    minAgeMs: mobileUpdateDays(args, "--min-age-days"),
+    retainRecent
+  };
+};
+var printMobileUpdateStorage = (report) => {
+  console.log(`${report.appId}: ${report.releaseCount} releases use ${formatBytes(report.releaseBytes)}; ${formatBytes(report.reclaimableBytes)} is eligible across ${report.totalObjectCount} stored objects.`);
+  for (const release of report.releases) {
+    let state = "eligible";
+    if (release.protectedBy.length > 0)
+      state = `kept: ${release.protectedBy.join(", ")}`;
+    else if (release.markedAt)
+      state = `marked ${release.markedAt}`;
+    console.log(`  ${release.releaseId} ${release.channel} ${formatBytes(release.bytes)} (${state})`);
+  }
+  if (report.untrackedBytes > 0)
+    console.log(`${formatBytes(report.untrackedBytes)} is used by channels, collection markers, or incomplete/unrecognized objects and will not be swept as a release.`);
+};
+var inspectMobileUpdateStorage = async (args) => {
+  const startedAt = performance.now();
+  const { mobile } = await loadMobile(valueAfter(args, "--config"));
+  if (!mobile.updates)
+    throw new TypeError("mobile update storage requires mobile.updates config.");
+  const policy = mobileUpdateRetention(args);
+  const { publisher } = await mobileUpdatePublisher(args);
+  const report = await inspectAbsoluteMobileUpdateStorage({
+    appId: mobile.appId,
+    publisher,
+    ...policy.minAgeMs === undefined ? {} : { minAgeMs: policy.minAgeMs },
+    ...policy.retainRecent === undefined ? {} : { retainRecent: policy.retainRecent }
+  });
+  if (args.includes("--json"))
+    console.log(JSON.stringify(report, null, 2));
+  else
+    printMobileUpdateStorage(report);
+  sendTelemetryEvent("mobile:update-storage", {
+    durationMs: Math.round(performance.now() - startedAt),
+    reclaimableReleaseCount: report.releases.filter((release) => release.protectedBy.length === 0).length,
+    releaseCount: report.releaseCount
+  });
+  return report;
+};
+var collectMobileUpdates = async (args) => {
+  const startedAt = performance.now();
+  const { mobile } = await loadMobile(valueAfter(args, "--config"));
+  if (!mobile.updates)
+    throw new TypeError("mobile update gc requires mobile.updates config.");
+  const policy = mobileUpdateRetention(args);
+  const gracePeriodMs = mobileUpdateDays(args, "--grace-days");
+  const { publisher } = await mobileUpdatePublisher(args);
+  const result = await pruneAbsoluteMobileUpdates({
+    appId: mobile.appId,
+    apply: args.includes("--apply"),
+    publisher,
+    ...gracePeriodMs === undefined ? {} : { gracePeriodMs },
+    ...policy.minAgeMs === undefined ? {} : { minAgeMs: policy.minAgeMs },
+    ...policy.retainRecent === undefined ? {} : { retainRecent: policy.retainRecent }
+  });
+  if (args.includes("--json"))
+    console.log(JSON.stringify(result, null, 2));
+  else {
+    printMobileUpdateStorage(result);
+    if (result.dryRun)
+      console.log("No storage was changed. Re-run with --apply to mark eligible releases and sweep releases whose grace period has elapsed.");
+    else
+      console.log(`Collection applied: ${result.marked.length} marked, ${result.restored.length} restored, ${result.swept.length} swept, ${formatBytes(result.reclaimedBytes)} reclaimed.`);
+  }
+  sendTelemetryEvent("mobile:update-gc", {
+    applied: !result.dryRun,
+    durationMs: Math.round(performance.now() - startedAt),
+    markedCount: result.marked.length,
+    restoredCount: result.restored.length,
+    sweptCount: result.swept.length
+  });
+  return result;
+};
 var requireValueAfter = (args, flag) => {
   const value = valueAfter(args, flag);
   if (!value || value.startsWith("-")) {
@@ -24134,6 +24298,14 @@ var runMobile = async (args) => {
     await rollbackMobileUpdate(args.slice(2));
     return;
   }
+  if (command === "update" && args[1] === "storage") {
+    await inspectMobileUpdateStorage(args.slice(2));
+    return;
+  }
+  if (command === "update" && args[1] === "gc") {
+    await collectMobileUpdates(args.slice(2));
+    return;
+  }
   if (command === "publish" && args[1] === "android") {
     await publishAndroid(args.slice(2));
     return;
@@ -24142,7 +24314,7 @@ var runMobile = async (args) => {
     await publishIos(args.slice(2));
     return;
   }
-  throw new TypeError("Usage: absolute mobile <pair mac <name> <user@host> [--port n] [--workspace path] | remotes [inspect [name] [--json] | clean [name] --yes | --json] | unpair mac <name> | init [--no-native] [--force] | sync [ios|android] | inspect [--json] [--require-bundle] | associations [--outdir dir] [--verify] | ci github [server-entry] [--publish] [--registry module] [--secret-env NAME] [--output path] [--force] [--json] | doctor [ios|android|release [ios|android]] [--remote name] [--json|--fix [--yes]] | build <android|ios> [server-entry] [--remote name] [--outdir dir] [--web-outdir dir] [--unsigned] | update provision [--storage local|s3] [--registry module] [--force] [--yes] | update signing generate --private-key path [--certificate path] [--public-key path] [--key-id id] [--common-name name] [--validity-years n] | update build [server-entry] --classification bug-fix|content|security --key-id id --signing-key path --within-submitted-purpose [--outdir dir] [--web-outdir dir] | update publish <release-directory> [--rollout fraction] [--registry module] | update promote --release id --rollout fraction [--registry module] | update rollback [--release id] [--registry module] | publish android [server-entry] [--registry module] [--channel name] [--play-track track] [--play-status completed|draft|halted|in-progress] [--play-rollout fraction] [--play-name name] [--play-notes language=text] [--play-update-priority 0..5] [--play-hold-review] [--play-cancel-existing-review] [--outdir dir] [--web-outdir dir] [--unsigned] | publish ios [server-entry] [--remote name] [--registry module] [--channel name] [--testflight-group name-or-id] [--testflight-notes locale=text] [--testflight-submit-review] [--outdir dir] [--web-outdir dir] [--unsigned] | test android [--route path] [--wait-for-hmr] [--report [dir]] [--timeout ms] [--port n] [--serial id] [--artifacts dir] [--json] | test ios [--device identifier [--remote name] | --udid id] [--wait-for-hmr] [--report [dir]] [--timeout ms] [--port n] [--artifacts dir] [--json]> [--config path]");
+  throw new TypeError("Usage: absolute mobile <pair mac <name> <user@host> [--port n] [--workspace path] | remotes [inspect [name] [--json] | clean [name] --yes | --json] | unpair mac <name> | init [--no-native] [--force] | sync [ios|android] | inspect [--json] [--require-bundle] | associations [--outdir dir] [--verify] | ci github [server-entry] [--publish] [--registry module] [--secret-env NAME] [--output path] [--force] [--json] | doctor [ios|android|release [ios|android]] [--remote name] [--json|--fix [--yes]] | build <android|ios> [server-entry] [--remote name] [--outdir dir] [--web-outdir dir] [--unsigned] | update provision [--storage local|s3] [--registry module] [--force] [--yes] | update signing generate --private-key path [--certificate path] [--public-key path] [--key-id id] [--common-name name] [--validity-years n] | update build [server-entry] --classification bug-fix|content|security --key-id id --signing-key path --within-submitted-purpose [--outdir dir] [--web-outdir dir] | update publish <release-directory> [--rollout fraction] [--registry module] | update promote --release id --rollout fraction [--registry module] | update rollback [--release id] [--registry module] | update storage [--retain count] [--min-age-days days] [--registry module] [--json] | update gc [--retain count] [--min-age-days days] [--grace-days days] [--apply] [--registry module] [--json] | publish android [server-entry] [--registry module] [--channel name] [--play-track track] [--play-status completed|draft|halted|in-progress] [--play-rollout fraction] [--play-name name] [--play-notes language=text] [--play-update-priority 0..5] [--play-hold-review] [--play-cancel-existing-review] [--outdir dir] [--web-outdir dir] [--unsigned] | publish ios [server-entry] [--remote name] [--registry module] [--channel name] [--testflight-group name-or-id] [--testflight-notes locale=text] [--testflight-submit-review] [--outdir dir] [--web-outdir dir] [--unsigned] | test android [--route path] [--wait-for-hmr] [--report [dir]] [--timeout ms] [--port n] [--serial id] [--artifacts dir] [--json] | test ios [--device identifier [--remote name] | --udid id] [--wait-for-hmr] [--report [dir]] [--timeout ms] [--port n] [--artifacts dir] [--json]> [--config path]");
 };
 export {
   runMobile