@absolutejs/absolute 0.20.0-beta.85 → 0.20.0-beta.86

package/dist/index.js

@@ -10636,7 +10636,7 @@ __export(exports_config, {
 import { readFileSync as readFileSync11 } from "fs";
 import { resolve as resolve12 } from "path";
 import { createHash as createHash4, createPublicKey, X509Certificate } from "crypto";
-var APP_ID_PATTERN, SCHEME_PATTERN, APPLE_APP_ID_PREFIX_PATTERN, CERTIFICATE_FINGERPRINT_PATTERN, UPDATE_NAME_PATTERN, UPDATE_PUBLIC_KEY_PATTERN, ENVIRONMENT_NAME_PATTERN, DEFAULT_UPDATE_BOOT_TIMEOUT_MS = 20000, MINIMUM_UPDATE_BOOT_TIMEOUT_MS = 5000, MAXIMUM_UPDATE_BOOT_TIMEOUT_MS = 120000, HOSTNAME_PATTERN, EXPO_RESERVED_ROUTE_PREFIXES, resolveProjectPath = (projectRoot, value, field) => {
+var APP_ID_PATTERN, SCHEME_PATTERN, APPLE_APP_ID_PREFIX_PATTERN, CERTIFICATE_FINGERPRINT_PATTERN, UPDATE_NAME_PATTERN, UPDATE_PUBLIC_KEY_PATTERN, ENVIRONMENT_NAME_PATTERN, DEFAULT_UPDATE_BOOT_TIMEOUT_MS = 20000, DEFAULT_UPDATE_HEALTH_FAILURE_RATE = 0.2, DEFAULT_UPDATE_HEALTH_MINIMUM_REPORTS = 20, MINIMUM_UPDATE_BOOT_TIMEOUT_MS = 5000, MAXIMUM_UPDATE_BOOT_TIMEOUT_MS = 120000, HOSTNAME_PATTERN, EXPO_RESERVED_ROUTE_PREFIXES, resolveProjectPath = (projectRoot, value, field) => {
   const root = resolve12(projectRoot);
   const path = resolve12(root, value);
   if (path !== root && !path.startsWith(`${root}/`)) {
@@ -10830,6 +10830,20 @@ var APP_ID_PATTERN, SCHEME_PATTERN, APPLE_APP_ID_PREFIX_PATTERN, CERTIFICATE_FIN
   if (!ENVIRONMENT_NAME_PATTERN.test(expoPrivateKeyEnv))
     throw new TypeError("mobile.updates.server.expoPrivateKeyEnv must be a valid environment variable name.");
   const autoMount = config.updates.server?.autoMount ?? true;
+  const configuredHealth = config.updates.server?.health;
+  let health;
+  if (configuredHealth !== false) {
+    const failureRate = configuredHealth?.failureRate ?? DEFAULT_UPDATE_HEALTH_FAILURE_RATE;
+    const minimumReports = configuredHealth?.minimumReports ?? DEFAULT_UPDATE_HEALTH_MINIMUM_REPORTS;
+    const secretEnv = requireText(configuredHealth?.secretEnv ?? "ABSOLUTE_MOBILE_UPDATE_HEALTH_SECRET", "mobile.updates.server.health.secretEnv");
+    if (!Number.isFinite(failureRate) || failureRate <= 0 || failureRate > 1)
+      throw new TypeError("mobile.updates.server.health.failureRate must be greater than 0 and at most 1.");
+    if (!Number.isSafeInteger(minimumReports) || minimumReports < 1)
+      throw new TypeError("mobile.updates.server.health.minimumReports must be a positive integer.");
+    if (!ENVIRONMENT_NAME_PATTERN.test(secretEnv))
+      throw new TypeError("mobile.updates.server.health.secretEnv must be a valid environment variable name.");
+    health = { failureRate, minimumReports, secretEnv };
+  }
   if (autoMount) {
     const manifest = new URL(updates.manifestUrl);
     if (manifest.origin !== productionOrigin)
@@ -10862,7 +10876,12 @@ var APP_ID_PATTERN, SCHEME_PATTERN, APPLE_APP_ID_PREFIX_PATTERN, CERTIFICATE_FIN
       throw new TypeError(`mobile.updates.server.expoCodeSigningKeys.${keyId} certificate is not currently valid.`);
     expoCodeSigningKeys[keyId] = { certificatePem, privateKeyEnv };
   }
-  return { autoMount, expoCodeSigningKeys, registryModule };
+  return {
+    autoMount,
+    expoCodeSigningKeys,
+    ...health ? { health } : {},
+    registryModule
+  };
 }, validateExpoNativeRouteSegment = (path, segment, index, count, parameters) => {
   if (segment === "*" && (index !== count - 1 || count === 1)) {
     throw new TypeError(`mobile.routes.native route ${path} must use * once, as the final segment after a static or parameterized prefix.`);
@@ -12280,15 +12299,17 @@ __export(exports_mobileUpdate, {
 });
 import {
   createHash as createHash5,
+  createHmac,
   createPrivateKey,
   createPublicKey as createPublicKey2,
   sign,
+  timingSafeEqual,
   verify,
   X509Certificate as X509Certificate2
 } from "crypto";
 import { readFile as readFile4, stat as stat2 } from "fs/promises";
 import path from "path";
-var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updates", MAX_FILE_BYTES, MAX_TOTAL_BYTES, DAY_MS, DEFAULT_MIN_AGE_MS, DEFAULT_GRACE_PERIOD_MS, DEFAULT_RETAIN_RECENT = 5, HASH, RELEASE, APP_ID, NAME, EXPO_DESCRIPTOR = "_absolute/expo-update.json", EXPO_CODE_SIGNING_ALGORITHM = "rsa-v1_5-sha256", MobileUpdateRegistryError, object3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), text2 = (value, field) => {
+var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updates", MAX_FILE_BYTES, MAX_TOTAL_BYTES, DAY_MS, DEFAULT_MIN_AGE_MS, DEFAULT_GRACE_PERIOD_MS, DEFAULT_RETAIN_RECENT = 5, HASH, RELEASE, APP_ID, NAME, EXPO_DESCRIPTOR = "_absolute/expo-update.json", EXPO_CODE_SIGNING_ALGORITHM = "rsa-v1_5-sha256", HEALTH_TOKEN_VERSION = 1, HEALTH_KINDS, FAILURE_HEALTH_KINDS, MobileUpdateRegistryError, object3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), text2 = (value, field) => {
   if (typeof value !== "string" || value.length === 0)
     throw new MobileUpdateRegistryError(`Mobile update ${field} is invalid`);
   return value;
@@ -12448,15 +12469,43 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
     return true;
   const value = createHash5("sha256").update(`${input.appId}\x00${input.channel}\x00${input.releaseId}\x00${input.installationId}`).digest().readUInt32BE(0);
   return value / 4294967296 < input.rollout;
+}, base64Url = (value) => Buffer.from(value).toString("base64url"), healthPromotionId = (channel) => digest(new TextEncoder().encode(`${channel.appId}\x00${channel.channel}\x00${channel.releaseId ?? "embedded"}\x00${channel.promotedAt}`)), finiteMetric = (value, field) => {
+  if (typeof value !== "number" || !Number.isFinite(value) || value < 0)
+    throw new MobileUpdateRegistryError(`Mobile update health ${field} is invalid`);
+  return value;
+}, parseHealthTransfer = (value) => {
+  if (value === undefined)
+    return;
+  if (!object3(value))
+    throw new MobileUpdateRegistryError("Mobile update health transfer is invalid");
+  return {
+    avoidedBytes: finiteMetric(value.avoidedBytes, "avoidedBytes"),
+    downloadedBytes: finiteMetric(value.downloadedBytes, "downloadedBytes"),
+    durationMs: finiteMetric(value.durationMs, "durationMs"),
+    resumedBytes: finiteMetric(value.resumedBytes, "resumedBytes"),
+    reusedBytes: finiteMetric(value.reusedBytes, "reusedBytes"),
+    throughputBytesPerSecond: finiteMetric(value.throughputBytesPerSecond, "throughputBytesPerSecond")
+  };
 }, createMobileUpdateRegistry = (options) => {
   const prefix = normalizedPrefix(options.prefix ?? DEFAULT_PREFIX);
   const clock = options.clock ?? (() => new Date);
+  const health = options.health;
+  if (health && health.secret.length < 32)
+    throw new MobileUpdateRegistryError("Mobile update health secret must contain at least 32 characters");
+  if (health && !options.store.list)
+    throw new MobileUpdateRegistryError("Mobile update health requires storage lifecycle listing");
+  const minimumReports = health?.autoPause?.minimumReports ?? 20;
+  const failureThreshold = health?.autoPause?.failureRate ?? 0.2;
+  if (health && (!Number.isSafeInteger(minimumReports) || minimumReports < 1 || failureThreshold <= 0 || failureThreshold > 1))
+    throw new MobileUpdateRegistryError("Mobile update health auto-pause policy is invalid");
   const root = (appId) => `${prefix}/${appHash(appId)}`;
   const releaseRoot = (manifest) => `${root(manifest.appId)}/releases/${manifest.releaseId}`;
   const manifestKey = (manifest) => `${releaseRoot(manifest)}/update.json`;
   const fileKey = (manifest, file2) => `${releaseRoot(manifest)}/files/${file2.path}`;
   const contentBlobKey = (appId, sha256) => `${root(appId)}/blobs/${sha256}`;
   const tombstoneKey = (appId, releaseId) => `${root(appId)}/gc/${releaseId}.json`;
+  const healthRoot = (appId, promotionId, releaseId) => `${root(appId)}/health/${promotionId}/${releaseId}`;
+  const pauseKey = (appId, promotionId, releaseId) => `${healthRoot(appId, promotionId, releaseId)}/paused.json`;
   const channelKey = (appId, channel) => {
     if (!APP_ID.test(appId) || !NAME.test(channel))
       throw new MobileUpdateRegistryError("Mobile update channel identity is invalid");
@@ -12485,6 +12534,38 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
       throw new MobileUpdateRegistryError("Stored mobile update channel identity changed");
     return value;
   };
+  const signHealthToken = (payload) => {
+    if (!health)
+      return null;
+    const encoded = base64Url(JSON.stringify(payload));
+    const signature = createHmac("sha256", health.secret).update(encoded).digest("base64url");
+    return `${encoded}.${signature}`;
+  };
+  const verifyHealthToken = (token) => {
+    if (!health)
+      throw new MobileUpdateRegistryError("Mobile update health reporting is not configured");
+    const [encoded, provided, extra] = token.split(".");
+    if (!encoded || !provided || extra)
+      throw new MobileUpdateRegistryError("Mobile update health token is invalid");
+    const expected = createHmac("sha256", health.secret).update(encoded).digest();
+    let actual;
+    try {
+      actual = Buffer.from(provided, "base64url");
+    } catch {
+      actual = Buffer.alloc(0);
+    }
+    if (actual.byteLength !== expected.byteLength || !timingSafeEqual(actual, expected))
+      throw new MobileUpdateRegistryError("Mobile update health token is invalid");
+    let value;
+    try {
+      value = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
+    } catch {
+      throw new MobileUpdateRegistryError("Mobile update health token is invalid");
+    }
+    if (!object3(value) || value.format !== HEALTH_TOKEN_VERSION || typeof value.appId !== "string" || typeof value.channel !== "string" || typeof value.installationId !== "string" || typeof value.promotionId !== "string" || typeof value.releaseId !== "string" || typeof value.runtimeFingerprint !== "string")
+      throw new MobileUpdateRegistryError("Mobile update health token is invalid");
+    return value;
+  };
   const assertNotMarked = async (appId, releaseId) => {
     if (!APP_ID.test(appId) || !RELEASE.test(releaseId))
       throw new MobileUpdateRegistryError("Mobile update release identity is invalid");
@@ -12539,13 +12620,15 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
     const channel = await readChannel(input.appId, input.channel);
     if (!channel?.releaseId)
       return { status: "empty" };
-    const selected = rolloutMember({
+    let selected = rolloutMember({
       appId: input.appId,
       channel: input.channel,
       installationId: input.installationId,
       releaseId: channel.releaseId,
       rollout: channel.rollout
     }) ? channel.releaseId : channel.fallbackReleaseId;
+    if (health && selected === channel.releaseId && await options.store.head(pauseKey(input.appId, healthPromotionId(channel), channel.releaseId)))
+      selected = channel.fallbackReleaseId;
     if (!selected)
       return { status: "empty" };
     const release = await readManifest(input.appId, selected);
@@ -12561,6 +12644,163 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
       status: "selected"
     };
   };
+  const issueUpdateHealthToken = async (input) => {
+    if (!health)
+      return null;
+    const channel = await readChannel(input.appId, input.channel);
+    if (!channel?.releaseId || channel.releaseId !== input.releaseId)
+      return null;
+    const resolution = await resolveUpdateState(input);
+    if (resolution.status !== "selected" || resolution.manifest.releaseId !== input.releaseId)
+      return null;
+    return signHealthToken({
+      appId: input.appId,
+      channel: input.channel,
+      format: HEALTH_TOKEN_VERSION,
+      installationId: input.installationId,
+      promotionId: healthPromotionId(channel),
+      releaseId: input.releaseId,
+      runtimeFingerprint: input.runtimeFingerprint
+    });
+  };
+  const inspectUpdateHealth = async (input) => {
+    if (!health)
+      throw new MobileUpdateRegistryError("Mobile update health reporting is not configured");
+    const channel = await readChannel(input.appId, input.channel);
+    const releaseId = input.releaseId ?? channel?.releaseId;
+    if (!channel || !releaseId || channel.releaseId !== releaseId)
+      return null;
+    const promotionId = healthPromotionId(channel);
+    const prefix2 = `${healthRoot(input.appId, promotionId, releaseId)}/events/`;
+    const objects = [];
+    const cursors = new Set;
+    let cursor;
+    do {
+      const page = await options.store.list({
+        ...cursor ? { cursor } : {},
+        prefix: prefix2
+      });
+      objects.push(...page.objects);
+      if (!page.truncated)
+        break;
+      if (!page.cursor || cursors.has(page.cursor))
+        throw new MobileUpdateRegistryError("Mobile update health storage returned an invalid cursor");
+      cursors.add(page.cursor);
+      cursor = page.cursor;
+    } while (true);
+    const installations = new Set;
+    const byKind = new Map([...HEALTH_KINDS].map((kind) => [
+      kind,
+      new Set
+    ]));
+    const transfer = {
+      avoidedBytes: 0,
+      downloadedBytes: 0,
+      durationMs: 0,
+      resumedBytes: 0,
+      reusedBytes: 0,
+      throughputBytesPerSecond: 0
+    };
+    for (const item of objects) {
+      const bytes = await options.store.get(item.key);
+      if (!bytes)
+        continue;
+      const head = await options.store.head(item.key);
+      if (!head || head.size !== bytes.byteLength || head.metadata?.sha256 !== digest(bytes))
+        throw new MobileUpdateRegistryError("Stored mobile update health evidence integrity failed");
+      const value = decode(bytes);
+      if (!object3(value) || typeof value.installationHash !== "string" || !HEALTH_KINDS.has(String(value.kind)))
+        throw new MobileUpdateRegistryError("Stored mobile update health evidence is invalid");
+      const kind = value.kind;
+      installations.add(value.installationHash);
+      byKind.get(kind).add(value.installationHash);
+      if (kind === "downloaded" && object3(value.transfer)) {
+        const parsed = parseHealthTransfer(value.transfer);
+        for (const key of Object.keys(transfer))
+          transfer[key] += parsed[key];
+      }
+    }
+    const failures = new Set([
+      ...byKind.get("quarantined"),
+      ...byKind.get("rolled-back")
+    ]);
+    const terminals = new Set([...byKind.get("activated"), ...failures]);
+    const failureRate = terminals.size === 0 ? 0 : failures.size / terminals.size;
+    return {
+      activated: byKind.get("activated").size,
+      appId: input.appId,
+      channel: input.channel,
+      downloaded: byKind.get("downloaded").size,
+      downloadFailed: byKind.get("download-failed").size,
+      failureRate,
+      failures: failures.size,
+      paused: Boolean(await options.store.head(pauseKey(input.appId, promotionId, releaseId))),
+      promotionId,
+      quarantined: byKind.get("quarantined").size,
+      releaseId,
+      reportedInstallations: installations.size,
+      rolledBack: byKind.get("rolled-back").size,
+      rollout: channel.rollout,
+      terminalReports: terminals.size,
+      transfer
+    };
+  };
+  const recordUpdateHealth = async (input) => {
+    const payload = verifyHealthToken(input.token);
+    if (payload.appId !== input.appId || payload.channel !== input.channel || payload.installationId !== input.installationId || payload.releaseId !== input.releaseId || payload.runtimeFingerprint !== input.runtimeFingerprint || !HEALTH_KINDS.has(input.kind) || input.reason !== undefined && input.reason !== "boot-interrupted" && input.reason !== "boot-timeout")
+      throw new MobileUpdateRegistryError("Mobile update health evidence does not match its token");
+    const release = await readManifest(input.appId, input.releaseId);
+    if (!release || release.manifest.runtimeFingerprint !== input.runtimeFingerprint)
+      throw new MobileUpdateRegistryError("Mobile update health release is invalid");
+    const activeChannel = await readChannel(input.appId, input.channel);
+    if (!activeChannel || activeChannel.releaseId !== input.releaseId || healthPromotionId(activeChannel) !== payload.promotionId)
+      throw new MobileUpdateRegistryError("Mobile update health promotion is no longer active");
+    const transfer = parseHealthTransfer(input.transfer);
+    const installationHash = createHmac("sha256", health.secret).update(input.installationId).digest("hex");
+    const evidence = {
+      format: 1,
+      installationHash,
+      kind: input.kind,
+      observedAt: clock().toISOString(),
+      ...input.reason ? { reason: input.reason } : {},
+      ...transfer ? { transfer } : {}
+    };
+    const bytes = json(evidence);
+    await options.store.put(`${healthRoot(input.appId, payload.promotionId, input.releaseId)}/events/${installationHash}/${input.kind}.json`, bytes, {
+      cacheControl: "no-store",
+      contentType: "application/json",
+      maxBytes: bytes.byteLength,
+      metadata: { kind: input.kind, sha256: digest(bytes) }
+    });
+    let report = await inspectUpdateHealth({
+      appId: input.appId,
+      channel: input.channel,
+      releaseId: input.releaseId
+    });
+    if (!report)
+      throw new MobileUpdateRegistryError("Mobile update health promotion is no longer active");
+    if (FAILURE_HEALTH_KINDS.has(input.kind) && report.terminalReports >= minimumReports && report.failureRate >= failureThreshold && !report.paused) {
+      const marker = json({
+        appId: input.appId,
+        channel: input.channel,
+        failureRate: report.failureRate,
+        failures: report.failures,
+        format: 1,
+        pausedAt: clock().toISOString(),
+        promotionId: payload.promotionId,
+        releaseId: input.releaseId,
+        reports: report.terminalReports
+      });
+      await options.store.put(pauseKey(input.appId, payload.promotionId, input.releaseId), marker, {
+        cacheControl: "no-store",
+        contentType: "application/json",
+        maxBytes: marker.byteLength,
+        metadata: { releaseid: input.releaseId, sha256: digest(marker) }
+      });
+      report = { ...report, paused: true };
+    }
+    return report;
+  };
   const retentionValues = (input) => {
     if (!APP_ID.test(input.appId))
       throw new MobileUpdateRegistryError("Mobile update appId is invalid");
@@ -12803,6 +13043,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
     return result;
   };
   return {
+    ...health ? { inspectUpdateHealth, issueUpdateHealthToken, recordUpdateHealth } : {},
     inspectUpdateStorage: async (input) => (await inventory(input)).report,
     pruneUpdates,
     publishUpdate: async (input) => {
@@ -13080,7 +13321,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
     const origin = request.headers.get("origin");
     const cors = origin && allowedOrigins.has(origin) ? {
       "access-control-allow-origin": origin,
-      "access-control-expose-headers": "content-range,etag",
+      "access-control-expose-headers": "content-range,etag,x-absolute-mobile-health-token",
       vary: "Origin"
     } : {};
     if (request.method === "OPTIONS") {
@@ -13089,17 +13330,58 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
       return new Response(null, {
         headers: {
           ...cors,
-          "access-control-allow-headers": "if-range,range,x-absolute-mobile-app,x-absolute-mobile-channel,x-absolute-mobile-installation,x-absolute-mobile-release,x-absolute-mobile-runtime",
-          "access-control-allow-methods": "GET,OPTIONS",
+          "access-control-allow-headers": "content-type,if-range,range,x-absolute-mobile-app,x-absolute-mobile-channel,x-absolute-mobile-health-token,x-absolute-mobile-installation,x-absolute-mobile-release,x-absolute-mobile-runtime",
+          "access-control-allow-methods": "GET,POST,OPTIONS",
           "access-control-max-age": "600"
         },
         status: 204
       });
     }
-    if (request.method !== "GET")
-      return new Response(null, { status: 405 });
     const pathname = new URL(request.url).pathname.replace(/^\/+/, "");
     const relative7 = pathname.startsWith(`${route}/`) ? pathname.slice(route.length + 1) : "";
+    if (request.method === "POST" && relative7 === "health") {
+      if (!options.registry.recordUpdateHealth)
+        return new Response(null, { status: 404 });
+      const appId = request.headers.get("x-absolute-mobile-app");
+      const channel = request.headers.get("x-absolute-mobile-channel");
+      const installationId = request.headers.get("x-absolute-mobile-installation");
+      const runtimeFingerprint = request.headers.get("x-absolute-mobile-runtime");
+      const token = request.headers.get("x-absolute-mobile-health-token");
+      const declared = Number(request.headers.get("content-length"));
+      if (appId !== options.appId || channel !== options.channel || !installationId || !runtimeFingerprint || !token || Number.isFinite(declared) && declared > 4096)
+        return new Response(null, { status: 400 });
+      const bodyBytes = new Uint8Array(await request.arrayBuffer());
+      if (bodyBytes.byteLength > 4096)
+        return new Response(null, { status: 413 });
+      let body;
+      try {
+        body = JSON.parse(new TextDecoder().decode(bodyBytes));
+      } catch {
+        return new Response(null, { status: 400 });
+      }
+      if (!object3(body) || typeof body.releaseId !== "string" || typeof body.kind !== "string")
+        return new Response(null, { status: 400 });
+      try {
+        const report = await options.registry.recordUpdateHealth({
+          appId,
+          channel,
+          installationId,
+          kind: body.kind,
+          ...body.reason === "boot-interrupted" || body.reason === "boot-timeout" ? { reason: body.reason } : {},
+          releaseId: body.releaseId,
+          runtimeFingerprint,
+          token,
+          ...object3(body.transfer) ? { transfer: body.transfer } : {}
+        });
+        return Response.json({ paused: report.paused }, { headers: { ...cors, "cache-control": "no-store" }, status: 202 });
+      } catch (error) {
+        if (error instanceof MobileUpdateRegistryError)
+          return new Response(null, { status: 403 });
+        throw error;
+      }
+    }
+    if (request.method !== "GET")
+      return new Response(null, { status: 405 });
     if (relative7 === "update.json") {
       const expoProtocolVersion = request.headers.get("expo-protocol-version");
       const expoProtocol = expoProtocolVersion !== null;
@@ -13125,6 +13407,13 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
         installationId,
         runtimeFingerprint
       });
+      const healthToken = selected && options.registry.issueUpdateHealthToken ? await options.registry.issueUpdateHealthToken({
+        appId,
+        channel,
+        installationId,
+        releaseId: selected.manifest.releaseId,
+        runtimeFingerprint
+      }) : null;
       if (expoProtocol) {
         let requestedCodeSigning;
         try {
@@ -13176,6 +13465,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
           extra: {
             absolutejs: {
               channel: selected.manifest.channel,
+              ...healthToken ? { healthToken } : {},
               releaseId: selected.manifest.releaseId
             },
             expoClient: descriptor.expoConfig
@@ -13203,7 +13493,8 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
         headers: {
           ...cors,
           "cache-control": "no-store",
-          etag: `"${selected.manifest.releaseId}"`
+          etag: `"${selected.manifest.releaseId}"`,
+          ...healthToken ? { "x-absolute-mobile-health-token": healthToken } : {}
         }
       });
     }
@@ -13266,6 +13557,14 @@ var init_mobileUpdate = __esm(() => {
   RELEASE = /^amu_[a-f0-9]{64}$/;
   APP_ID = /^[A-Za-z][\w]*(?:\.[A-Za-z][\w]*)+$/;
   NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+  HEALTH_KINDS = new Set([
+    "activated",
+    "downloaded",
+    "download-failed",
+    "quarantined",
+    "rolled-back"
+  ]);
+  FAILURE_HEALTH_KINDS = new Set(["quarantined", "rolled-back"]);
   MobileUpdateRegistryError = class MobileUpdateRegistryError extends Error {
   };
   expoProtocolHeaders = {
@@ -13353,6 +13652,11 @@ var ABSOLUTE_MOBILE_UPDATE_SERVER_FORMAT = 1, DEFAULT_MOBILE_UPDATE_REGISTRY_MOD
   } catch (error) {
     throw new TypeError(`Durable mobile update storage verification failed for ${module.metadata.provider}. Check the bucket, endpoint, credentials, and read/write/delete permissions.`, { cause: error });
   }
+}, verifyHealthModule = (config, module) => {
+  if (!config.updateServer?.health)
+    return;
+  if (typeof module.registry.inspectUpdateHealth !== "function" || typeof module.registry.issueUpdateHealthToken !== "function" || typeof module.registry.recordUpdateHealth !== "function")
+    throw new TypeError("Mobile update fleet health is enabled but the registry is not provisioned for it. Run `absolute mobile update provision --force`.");
 }, expoSigningOptions = (config) => {
   if (!config.updates?.expoCodeSigning)
     return;
@@ -13384,8 +13688,10 @@ var ABSOLUTE_MOBILE_UPDATE_SERVER_FORMAT = 1, DEFAULT_MOBILE_UPDATE_REGISTRY_MOD
   if (!updates || !server?.autoMount)
     return new Elysia4({ name: "absolutejs-mobile-updates-disabled" });
   const module = await loadAbsoluteMobileUpdateServerModule(projectRoot, server.registryModule);
-  if (options.production)
+  if (options.production) {
     await verifyDurableModule(module);
+    verifyHealthModule(config, module);
+  }
   const manifest = new URL(updates.manifestUrl);
   if (!manifest.pathname.endsWith("/update.json"))
     throw new TypeError("Auto-mounted mobile update manifests must end in /update.json.");
@@ -13404,10 +13710,11 @@ var ABSOLUTE_MOBILE_UPDATE_SERVER_FORMAT = 1, DEFAULT_MOBILE_UPDATE_REGISTRY_MOD
     return;
   const module = await loadAbsoluteMobileUpdateServerModule(projectRoot, config.updateServer?.registryModule);
   await verifyDurableModule(module);
+  verifyHealthModule(config, module);
   if (config.engine === "expo")
     expoSigningOptions(config);
   return module.metadata;
-}, publicKeysSource = (publicKeys) => JSON.stringify(publicKeys, null, "\t"), renderAbsoluteMobileUpdateRegistry = (options) => {
+}, publicKeysSource = (publicKeys) => JSON.stringify(publicKeys, null, "\t"), renderAbsoluteMobileUpdateRegistryBase = (options) => {
   const metadata2 = `export const absoluteMobileUpdateServer = {
 	format: 1,
 	provider: '${options.storage}',
@@ -13473,6 +13780,19 @@ export default createMobileUpdateRegistry({
 	store
 });
 `;
+}, renderAbsoluteMobileUpdateRegistry = (options) => {
+  const source = renderAbsoluteMobileUpdateRegistryBase(options);
+  if (!options.health)
+    return source;
+  const secret = options.storage === "local" ? `process.env.${options.health.secretEnv} ?? 'absolutejs-local-health-secret-not-for-production'` : `required('${options.health.secretEnv}')`;
+  const health = `	health: {
+		autoPause: { failureRate: ${options.health.failureRate}, minimumReports: ${options.health.minimumReports} },
+		secret: ${secret}
+	},
+`;
+  return source.replace(`export default createMobileUpdateRegistry({
+`, `export default createMobileUpdateRegistry({
+${health}`);
 }, writeAbsoluteMobileUpdateRegistry = async (options) => {
   const path2 = projectPath(options.projectRoot, options.modulePath ?? DEFAULT_MOBILE_UPDATE_REGISTRY_MODULE);
   if (!options.force) {
@@ -13484,6 +13804,7 @@ export default createMobileUpdateRegistry({
   }
   await mkdir6(dirname12(path2), { recursive: true });
   await Bun.write(path2, renderAbsoluteMobileUpdateRegistry({
+    ...options.health ? { health: options.health } : {},
     publicKeys: options.publicKeys,
     storage: options.storage
   }));
@@ -44896,5 +45217,5 @@ export {
   wrapPageHandlerWithStreamingSlots
 };
 
-//# debugId=99E9CBD68908A78B64756E2164756E21
+//# debugId=CC09B0266A0CC45B64756E2164756E21
 //# sourceMappingURL=index.js.map