@absolutejs/absolute 0.20.0-beta.85 → 0.20.0-beta.86

package/dist/mobile/index.js

@@ -604,7 +604,7 @@ __export(exports_config, {
 import { readFileSync as readFileSync2 } from "fs";
 import { resolve as resolve6 } from "path";
 import { createHash as createHash8, createPublicKey, X509Certificate as X509Certificate2 } from "crypto";
-var APP_ID_PATTERN, SCHEME_PATTERN, APPLE_APP_ID_PREFIX_PATTERN, CERTIFICATE_FINGERPRINT_PATTERN, UPDATE_NAME_PATTERN, UPDATE_PUBLIC_KEY_PATTERN, ENVIRONMENT_NAME_PATTERN, DEFAULT_UPDATE_BOOT_TIMEOUT_MS = 20000, MINIMUM_UPDATE_BOOT_TIMEOUT_MS = 5000, MAXIMUM_UPDATE_BOOT_TIMEOUT_MS = 120000, HOSTNAME_PATTERN, EXPO_RESERVED_ROUTE_PREFIXES, resolveProjectPath = (projectRoot, value, field2) => {
+var APP_ID_PATTERN, SCHEME_PATTERN, APPLE_APP_ID_PREFIX_PATTERN, CERTIFICATE_FINGERPRINT_PATTERN, UPDATE_NAME_PATTERN, UPDATE_PUBLIC_KEY_PATTERN, ENVIRONMENT_NAME_PATTERN, DEFAULT_UPDATE_BOOT_TIMEOUT_MS = 20000, DEFAULT_UPDATE_HEALTH_FAILURE_RATE = 0.2, DEFAULT_UPDATE_HEALTH_MINIMUM_REPORTS = 20, MINIMUM_UPDATE_BOOT_TIMEOUT_MS = 5000, MAXIMUM_UPDATE_BOOT_TIMEOUT_MS = 120000, HOSTNAME_PATTERN, EXPO_RESERVED_ROUTE_PREFIXES, resolveProjectPath = (projectRoot, value, field2) => {
   const root = resolve6(projectRoot);
   const path = resolve6(root, value);
   if (path !== root && !path.startsWith(`${root}/`)) {
@@ -798,6 +798,20 @@ var APP_ID_PATTERN, SCHEME_PATTERN, APPLE_APP_ID_PREFIX_PATTERN, CERTIFICATE_FIN
   if (!ENVIRONMENT_NAME_PATTERN.test(expoPrivateKeyEnv))
     throw new TypeError("mobile.updates.server.expoPrivateKeyEnv must be a valid environment variable name.");
   const autoMount = config.updates.server?.autoMount ?? true;
+  const configuredHealth = config.updates.server?.health;
+  let health;
+  if (configuredHealth !== false) {
+    const failureRate = configuredHealth?.failureRate ?? DEFAULT_UPDATE_HEALTH_FAILURE_RATE;
+    const minimumReports = configuredHealth?.minimumReports ?? DEFAULT_UPDATE_HEALTH_MINIMUM_REPORTS;
+    const secretEnv = requireText(configuredHealth?.secretEnv ?? "ABSOLUTE_MOBILE_UPDATE_HEALTH_SECRET", "mobile.updates.server.health.secretEnv");
+    if (!Number.isFinite(failureRate) || failureRate <= 0 || failureRate > 1)
+      throw new TypeError("mobile.updates.server.health.failureRate must be greater than 0 and at most 1.");
+    if (!Number.isSafeInteger(minimumReports) || minimumReports < 1)
+      throw new TypeError("mobile.updates.server.health.minimumReports must be a positive integer.");
+    if (!ENVIRONMENT_NAME_PATTERN.test(secretEnv))
+      throw new TypeError("mobile.updates.server.health.secretEnv must be a valid environment variable name.");
+    health = { failureRate, minimumReports, secretEnv };
+  }
   if (autoMount) {
     const manifest = new URL(updates.manifestUrl);
     if (manifest.origin !== productionOrigin)
@@ -830,7 +844,12 @@ var APP_ID_PATTERN, SCHEME_PATTERN, APPLE_APP_ID_PREFIX_PATTERN, CERTIFICATE_FIN
       throw new TypeError(`mobile.updates.server.expoCodeSigningKeys.${keyId} certificate is not currently valid.`);
     expoCodeSigningKeys[keyId] = { certificatePem, privateKeyEnv };
   }
-  return { autoMount, expoCodeSigningKeys, registryModule };
+  return {
+    autoMount,
+    expoCodeSigningKeys,
+    ...health ? { health } : {},
+    registryModule
+  };
 }, validateExpoNativeRouteSegment = (path, segment, index, count, parameters) => {
   if (segment === "*" && (index !== count - 1 || count === 1)) {
     throw new TypeError(`mobile.routes.native route ${path} must use * once, as the final segment after a static or parameterized prefix.`);
@@ -19962,15 +19981,17 @@ __export(exports_mobileUpdate, {
 });
 import {
   createHash as createHash15,
+  createHmac,
   createPrivateKey,
   createPublicKey as createPublicKey2,
   sign as sign2,
+  timingSafeEqual,
   verify as verify2,
   X509Certificate as X509Certificate3
 } from "crypto";
 import { readFile as readFile23, stat as stat5 } from "fs/promises";
 import path from "path";
-var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updates", MAX_FILE_BYTES, MAX_TOTAL_BYTES, DAY_MS, DEFAULT_MIN_AGE_MS, DEFAULT_GRACE_PERIOD_MS, DEFAULT_RETAIN_RECENT = 5, HASH, RELEASE, APP_ID, NAME, EXPO_DESCRIPTOR = "_absolute/expo-update.json", EXPO_CODE_SIGNING_ALGORITHM = "rsa-v1_5-sha256", MobileUpdateRegistryError, object6 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), text2 = (value, field2) => {
+var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updates", MAX_FILE_BYTES, MAX_TOTAL_BYTES, DAY_MS, DEFAULT_MIN_AGE_MS, DEFAULT_GRACE_PERIOD_MS, DEFAULT_RETAIN_RECENT = 5, HASH, RELEASE, APP_ID, NAME, EXPO_DESCRIPTOR = "_absolute/expo-update.json", EXPO_CODE_SIGNING_ALGORITHM = "rsa-v1_5-sha256", HEALTH_TOKEN_VERSION = 1, HEALTH_KINDS, FAILURE_HEALTH_KINDS, MobileUpdateRegistryError, object6 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), text2 = (value, field2) => {
   if (typeof value !== "string" || value.length === 0)
     throw new MobileUpdateRegistryError(`Mobile update ${field2} is invalid`);
   return value;
@@ -20130,15 +20151,43 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
     return true;
   const value = createHash15("sha256").update(`${input.appId}\x00${input.channel}\x00${input.releaseId}\x00${input.installationId}`).digest().readUInt32BE(0);
   return value / 4294967296 < input.rollout;
+}, base64Url = (value) => Buffer.from(value).toString("base64url"), healthPromotionId = (channel) => digest(new TextEncoder().encode(`${channel.appId}\x00${channel.channel}\x00${channel.releaseId ?? "embedded"}\x00${channel.promotedAt}`)), finiteMetric = (value, field2) => {
+  if (typeof value !== "number" || !Number.isFinite(value) || value < 0)
+    throw new MobileUpdateRegistryError(`Mobile update health ${field2} is invalid`);
+  return value;
+}, parseHealthTransfer = (value) => {
+  if (value === undefined)
+    return;
+  if (!object6(value))
+    throw new MobileUpdateRegistryError("Mobile update health transfer is invalid");
+  return {
+    avoidedBytes: finiteMetric(value.avoidedBytes, "avoidedBytes"),
+    downloadedBytes: finiteMetric(value.downloadedBytes, "downloadedBytes"),
+    durationMs: finiteMetric(value.durationMs, "durationMs"),
+    resumedBytes: finiteMetric(value.resumedBytes, "resumedBytes"),
+    reusedBytes: finiteMetric(value.reusedBytes, "reusedBytes"),
+    throughputBytesPerSecond: finiteMetric(value.throughputBytesPerSecond, "throughputBytesPerSecond")
+  };
 }, createMobileUpdateRegistry = (options) => {
   const prefix = normalizedPrefix(options.prefix ?? DEFAULT_PREFIX);
   const clock = options.clock ?? (() => new Date);
+  const health = options.health;
+  if (health && health.secret.length < 32)
+    throw new MobileUpdateRegistryError("Mobile update health secret must contain at least 32 characters");
+  if (health && !options.store.list)
+    throw new MobileUpdateRegistryError("Mobile update health requires storage lifecycle listing");
+  const minimumReports = health?.autoPause?.minimumReports ?? 20;
+  const failureThreshold = health?.autoPause?.failureRate ?? 0.2;
+  if (health && (!Number.isSafeInteger(minimumReports) || minimumReports < 1 || failureThreshold <= 0 || failureThreshold > 1))
+    throw new MobileUpdateRegistryError("Mobile update health auto-pause policy is invalid");
   const root = (appId) => `${prefix}/${appHash(appId)}`;
   const releaseRoot = (manifest) => `${root(manifest.appId)}/releases/${manifest.releaseId}`;
   const manifestKey = (manifest) => `${releaseRoot(manifest)}/update.json`;
   const fileKey = (manifest, file) => `${releaseRoot(manifest)}/files/${file.path}`;
   const contentBlobKey = (appId, sha2563) => `${root(appId)}/blobs/${sha2563}`;
   const tombstoneKey = (appId, releaseId) => `${root(appId)}/gc/${releaseId}.json`;
+  const healthRoot = (appId, promotionId, releaseId) => `${root(appId)}/health/${promotionId}/${releaseId}`;
+  const pauseKey = (appId, promotionId, releaseId) => `${healthRoot(appId, promotionId, releaseId)}/paused.json`;
   const channelKey = (appId, channel) => {
     if (!APP_ID.test(appId) || !NAME.test(channel))
       throw new MobileUpdateRegistryError("Mobile update channel identity is invalid");
@@ -20167,6 +20216,38 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
       throw new MobileUpdateRegistryError("Stored mobile update channel identity changed");
     return value;
   };
+  const signHealthToken = (payload) => {
+    if (!health)
+      return null;
+    const encoded = base64Url(JSON.stringify(payload));
+    const signature = createHmac("sha256", health.secret).update(encoded).digest("base64url");
+    return `${encoded}.${signature}`;
+  };
+  const verifyHealthToken = (token) => {
+    if (!health)
+      throw new MobileUpdateRegistryError("Mobile update health reporting is not configured");
+    const [encoded, provided, extra] = token.split(".");
+    if (!encoded || !provided || extra)
+      throw new MobileUpdateRegistryError("Mobile update health token is invalid");
+    const expected = createHmac("sha256", health.secret).update(encoded).digest();
+    let actual;
+    try {
+      actual = Buffer.from(provided, "base64url");
+    } catch {
+      actual = Buffer.alloc(0);
+    }
+    if (actual.byteLength !== expected.byteLength || !timingSafeEqual(actual, expected))
+      throw new MobileUpdateRegistryError("Mobile update health token is invalid");
+    let value;
+    try {
+      value = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
+    } catch {
+      throw new MobileUpdateRegistryError("Mobile update health token is invalid");
+    }
+    if (!object6(value) || value.format !== HEALTH_TOKEN_VERSION || typeof value.appId !== "string" || typeof value.channel !== "string" || typeof value.installationId !== "string" || typeof value.promotionId !== "string" || typeof value.releaseId !== "string" || typeof value.runtimeFingerprint !== "string")
+      throw new MobileUpdateRegistryError("Mobile update health token is invalid");
+    return value;
+  };
   const assertNotMarked = async (appId, releaseId) => {
     if (!APP_ID.test(appId) || !RELEASE.test(releaseId))
       throw new MobileUpdateRegistryError("Mobile update release identity is invalid");
@@ -20221,13 +20302,15 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
     const channel = await readChannel(input.appId, input.channel);
     if (!channel?.releaseId)
       return { status: "empty" };
-    const selected = rolloutMember({
+    let selected = rolloutMember({
       appId: input.appId,
       channel: input.channel,
       installationId: input.installationId,
       releaseId: channel.releaseId,
       rollout: channel.rollout
     }) ? channel.releaseId : channel.fallbackReleaseId;
+    if (health && selected === channel.releaseId && await options.store.head(pauseKey(input.appId, healthPromotionId(channel), channel.releaseId)))
+      selected = channel.fallbackReleaseId;
     if (!selected)
       return { status: "empty" };
     const release = await readManifest(input.appId, selected);
@@ -20243,6 +20326,163 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
       status: "selected"
     };
   };
+  const issueUpdateHealthToken = async (input) => {
+    if (!health)
+      return null;
+    const channel = await readChannel(input.appId, input.channel);
+    if (!channel?.releaseId || channel.releaseId !== input.releaseId)
+      return null;
+    const resolution = await resolveUpdateState(input);
+    if (resolution.status !== "selected" || resolution.manifest.releaseId !== input.releaseId)
+      return null;
+    return signHealthToken({
+      appId: input.appId,
+      channel: input.channel,
+      format: HEALTH_TOKEN_VERSION,
+      installationId: input.installationId,
+      promotionId: healthPromotionId(channel),
+      releaseId: input.releaseId,
+      runtimeFingerprint: input.runtimeFingerprint
+    });
+  };
+  const inspectUpdateHealth = async (input) => {
+    if (!health)
+      throw new MobileUpdateRegistryError("Mobile update health reporting is not configured");
+    const channel = await readChannel(input.appId, input.channel);
+    const releaseId = input.releaseId ?? channel?.releaseId;
+    if (!channel || !releaseId || channel.releaseId !== releaseId)
+      return null;
+    const promotionId = healthPromotionId(channel);
+    const prefix2 = `${healthRoot(input.appId, promotionId, releaseId)}/events/`;
+    const objects = [];
+    const cursors = new Set;
+    let cursor;
+    do {
+      const page = await options.store.list({
+        ...cursor ? { cursor } : {},
+        prefix: prefix2
+      });
+      objects.push(...page.objects);
+      if (!page.truncated)
+        break;
+      if (!page.cursor || cursors.has(page.cursor))
+        throw new MobileUpdateRegistryError("Mobile update health storage returned an invalid cursor");
+      cursors.add(page.cursor);
+      cursor = page.cursor;
+    } while (true);
+    const installations = new Set;
+    const byKind = new Map([...HEALTH_KINDS].map((kind) => [
+      kind,
+      new Set
+    ]));
+    const transfer = {
+      avoidedBytes: 0,
+      downloadedBytes: 0,
+      durationMs: 0,
+      resumedBytes: 0,
+      reusedBytes: 0,
+      throughputBytesPerSecond: 0
+    };
+    for (const item of objects) {
+      const bytes = await options.store.get(item.key);
+      if (!bytes)
+        continue;
+      const head = await options.store.head(item.key);
+      if (!head || head.size !== bytes.byteLength || head.metadata?.sha256 !== digest(bytes))
+        throw new MobileUpdateRegistryError("Stored mobile update health evidence integrity failed");
+      const value = decode2(bytes);
+      if (!object6(value) || typeof value.installationHash !== "string" || !HEALTH_KINDS.has(String(value.kind)))
+        throw new MobileUpdateRegistryError("Stored mobile update health evidence is invalid");
+      const kind = value.kind;
+      installations.add(value.installationHash);
+      byKind.get(kind).add(value.installationHash);
+      if (kind === "downloaded" && object6(value.transfer)) {
+        const parsed = parseHealthTransfer(value.transfer);
+        for (const key of Object.keys(transfer))
+          transfer[key] += parsed[key];
+      }
+    }
+    const failures = new Set([
+      ...byKind.get("quarantined"),
+      ...byKind.get("rolled-back")
+    ]);
+    const terminals = new Set([...byKind.get("activated"), ...failures]);
+    const failureRate = terminals.size === 0 ? 0 : failures.size / terminals.size;
+    return {
+      activated: byKind.get("activated").size,
+      appId: input.appId,
+      channel: input.channel,
+      downloaded: byKind.get("downloaded").size,
+      downloadFailed: byKind.get("download-failed").size,
+      failureRate,
+      failures: failures.size,
+      paused: Boolean(await options.store.head(pauseKey(input.appId, promotionId, releaseId))),
+      promotionId,
+      quarantined: byKind.get("quarantined").size,
+      releaseId,
+      reportedInstallations: installations.size,
+      rolledBack: byKind.get("rolled-back").size,
+      rollout: channel.rollout,
+      terminalReports: terminals.size,
+      transfer
+    };
+  };
+  const recordUpdateHealth = async (input) => {
+    const payload = verifyHealthToken(input.token);
+    if (payload.appId !== input.appId || payload.channel !== input.channel || payload.installationId !== input.installationId || payload.releaseId !== input.releaseId || payload.runtimeFingerprint !== input.runtimeFingerprint || !HEALTH_KINDS.has(input.kind) || input.reason !== undefined && input.reason !== "boot-interrupted" && input.reason !== "boot-timeout")
+      throw new MobileUpdateRegistryError("Mobile update health evidence does not match its token");
+    const release = await readManifest(input.appId, input.releaseId);
+    if (!release || release.manifest.runtimeFingerprint !== input.runtimeFingerprint)
+      throw new MobileUpdateRegistryError("Mobile update health release is invalid");
+    const activeChannel = await readChannel(input.appId, input.channel);
+    if (!activeChannel || activeChannel.releaseId !== input.releaseId || healthPromotionId(activeChannel) !== payload.promotionId)
+      throw new MobileUpdateRegistryError("Mobile update health promotion is no longer active");
+    const transfer = parseHealthTransfer(input.transfer);
+    const installationHash = createHmac("sha256", health.secret).update(input.installationId).digest("hex");
+    const evidence = {
+      format: 1,
+      installationHash,
+      kind: input.kind,
+      observedAt: clock().toISOString(),
+      ...input.reason ? { reason: input.reason } : {},
+      ...transfer ? { transfer } : {}
+    };
+    const bytes = json(evidence);
+    await options.store.put(`${healthRoot(input.appId, payload.promotionId, input.releaseId)}/events/${installationHash}/${input.kind}.json`, bytes, {
+      cacheControl: "no-store",
+      contentType: "application/json",
+      maxBytes: bytes.byteLength,
+      metadata: { kind: input.kind, sha256: digest(bytes) }
+    });
+    let report = await inspectUpdateHealth({
+      appId: input.appId,
+      channel: input.channel,
+      releaseId: input.releaseId
+    });
+    if (!report)
+      throw new MobileUpdateRegistryError("Mobile update health promotion is no longer active");
+    if (FAILURE_HEALTH_KINDS.has(input.kind) && report.terminalReports >= minimumReports && report.failureRate >= failureThreshold && !report.paused) {
+      const marker = json({
+        appId: input.appId,
+        channel: input.channel,
+        failureRate: report.failureRate,
+        failures: report.failures,
+        format: 1,
+        pausedAt: clock().toISOString(),
+        promotionId: payload.promotionId,
+        releaseId: input.releaseId,
+        reports: report.terminalReports
+      });
+      await options.store.put(pauseKey(input.appId, payload.promotionId, input.releaseId), marker, {
+        cacheControl: "no-store",
+        contentType: "application/json",
+        maxBytes: marker.byteLength,
+        metadata: { releaseid: input.releaseId, sha256: digest(marker) }
+      });
+      report = { ...report, paused: true };
+    }
+    return report;
+  };
   const retentionValues = (input) => {
     if (!APP_ID.test(input.appId))
       throw new MobileUpdateRegistryError("Mobile update appId is invalid");
@@ -20485,6 +20725,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
     return result;
   };
   return {
+    ...health ? { inspectUpdateHealth, issueUpdateHealthToken, recordUpdateHealth } : {},
     inspectUpdateStorage: async (input) => (await inventory(input)).report,
     pruneUpdates,
     publishUpdate: async (input) => {
@@ -20762,7 +21003,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
     const origin = request.headers.get("origin");
     const cors = origin && allowedOrigins.has(origin) ? {
       "access-control-allow-origin": origin,
-      "access-control-expose-headers": "content-range,etag",
+      "access-control-expose-headers": "content-range,etag,x-absolute-mobile-health-token",
       vary: "Origin"
     } : {};
     if (request.method === "OPTIONS") {
@@ -20771,17 +21012,58 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
       return new Response(null, {
         headers: {
           ...cors,
-          "access-control-allow-headers": "if-range,range,x-absolute-mobile-app,x-absolute-mobile-channel,x-absolute-mobile-installation,x-absolute-mobile-release,x-absolute-mobile-runtime",
-          "access-control-allow-methods": "GET,OPTIONS",
+          "access-control-allow-headers": "content-type,if-range,range,x-absolute-mobile-app,x-absolute-mobile-channel,x-absolute-mobile-health-token,x-absolute-mobile-installation,x-absolute-mobile-release,x-absolute-mobile-runtime",
+          "access-control-allow-methods": "GET,POST,OPTIONS",
           "access-control-max-age": "600"
         },
         status: 204
       });
     }
-    if (request.method !== "GET")
-      return new Response(null, { status: 405 });
     const pathname = new URL(request.url).pathname.replace(/^\/+/, "");
     const relative17 = pathname.startsWith(`${route}/`) ? pathname.slice(route.length + 1) : "";
+    if (request.method === "POST" && relative17 === "health") {
+      if (!options.registry.recordUpdateHealth)
+        return new Response(null, { status: 404 });
+      const appId = request.headers.get("x-absolute-mobile-app");
+      const channel = request.headers.get("x-absolute-mobile-channel");
+      const installationId = request.headers.get("x-absolute-mobile-installation");
+      const runtimeFingerprint = request.headers.get("x-absolute-mobile-runtime");
+      const token = request.headers.get("x-absolute-mobile-health-token");
+      const declared = Number(request.headers.get("content-length"));
+      if (appId !== options.appId || channel !== options.channel || !installationId || !runtimeFingerprint || !token || Number.isFinite(declared) && declared > 4096)
+        return new Response(null, { status: 400 });
+      const bodyBytes = new Uint8Array(await request.arrayBuffer());
+      if (bodyBytes.byteLength > 4096)
+        return new Response(null, { status: 413 });
+      let body;
+      try {
+        body = JSON.parse(new TextDecoder().decode(bodyBytes));
+      } catch {
+        return new Response(null, { status: 400 });
+      }
+      if (!object6(body) || typeof body.releaseId !== "string" || typeof body.kind !== "string")
+        return new Response(null, { status: 400 });
+      try {
+        const report = await options.registry.recordUpdateHealth({
+          appId,
+          channel,
+          installationId,
+          kind: body.kind,
+          ...body.reason === "boot-interrupted" || body.reason === "boot-timeout" ? { reason: body.reason } : {},
+          releaseId: body.releaseId,
+          runtimeFingerprint,
+          token,
+          ...object6(body.transfer) ? { transfer: body.transfer } : {}
+        });
+        return Response.json({ paused: report.paused }, { headers: { ...cors, "cache-control": "no-store" }, status: 202 });
+      } catch (error) {
+        if (error instanceof MobileUpdateRegistryError)
+          return new Response(null, { status: 403 });
+        throw error;
+      }
+    }
+    if (request.method !== "GET")
+      return new Response(null, { status: 405 });
     if (relative17 === "update.json") {
       const expoProtocolVersion = request.headers.get("expo-protocol-version");
       const expoProtocol = expoProtocolVersion !== null;
@@ -20807,6 +21089,13 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
         installationId,
         runtimeFingerprint
       });
+      const healthToken = selected && options.registry.issueUpdateHealthToken ? await options.registry.issueUpdateHealthToken({
+        appId,
+        channel,
+        installationId,
+        releaseId: selected.manifest.releaseId,
+        runtimeFingerprint
+      }) : null;
       if (expoProtocol) {
         let requestedCodeSigning;
         try {
@@ -20858,6 +21147,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
           extra: {
             absolutejs: {
               channel: selected.manifest.channel,
+              ...healthToken ? { healthToken } : {},
               releaseId: selected.manifest.releaseId
             },
             expoClient: descriptor.expoConfig
@@ -20885,7 +21175,8 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
         headers: {
           ...cors,
           "cache-control": "no-store",
-          etag: `"${selected.manifest.releaseId}"`
+          etag: `"${selected.manifest.releaseId}"`,
+          ...healthToken ? { "x-absolute-mobile-health-token": healthToken } : {}
         }
       });
     }
@@ -20948,6 +21239,14 @@ var init_mobileUpdate = __esm(() => {
   RELEASE = /^amu_[a-f0-9]{64}$/;
   APP_ID = /^[A-Za-z][\w]*(?:\.[A-Za-z][\w]*)+$/;
   NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+  HEALTH_KINDS = new Set([
+    "activated",
+    "downloaded",
+    "download-failed",
+    "quarantined",
+    "rolled-back"
+  ]);
+  FAILURE_HEALTH_KINDS = new Set(["quarantined", "rolled-back"]);
   MobileUpdateRegistryError = class MobileUpdateRegistryError extends Error {
   };
   expoProtocolHeaders = {
@@ -21035,6 +21334,11 @@ var ABSOLUTE_MOBILE_UPDATE_SERVER_FORMAT = 1, DEFAULT_MOBILE_UPDATE_REGISTRY_MOD
   } catch (error) {
     throw new TypeError(`Durable mobile update storage verification failed for ${module.metadata.provider}. Check the bucket, endpoint, credentials, and read/write/delete permissions.`, { cause: error });
   }
+}, verifyHealthModule = (config, module) => {
+  if (!config.updateServer?.health)
+    return;
+  if (typeof module.registry.inspectUpdateHealth !== "function" || typeof module.registry.issueUpdateHealthToken !== "function" || typeof module.registry.recordUpdateHealth !== "function")
+    throw new TypeError("Mobile update fleet health is enabled but the registry is not provisioned for it. Run `absolute mobile update provision --force`.");
 }, expoSigningOptions = (config) => {
   if (!config.updates?.expoCodeSigning)
     return;
@@ -21066,8 +21370,10 @@ var ABSOLUTE_MOBILE_UPDATE_SERVER_FORMAT = 1, DEFAULT_MOBILE_UPDATE_REGISTRY_MOD
   if (!updates || !server?.autoMount)
     return new Elysia4({ name: "absolutejs-mobile-updates-disabled" });
   const module = await loadAbsoluteMobileUpdateServerModule(projectRoot, server.registryModule);
-  if (options.production)
+  if (options.production) {
     await verifyDurableModule(module);
+    verifyHealthModule(config, module);
+  }
   const manifest = new URL(updates.manifestUrl);
   if (!manifest.pathname.endsWith("/update.json"))
     throw new TypeError("Auto-mounted mobile update manifests must end in /update.json.");
@@ -21086,10 +21392,11 @@ var ABSOLUTE_MOBILE_UPDATE_SERVER_FORMAT = 1, DEFAULT_MOBILE_UPDATE_REGISTRY_MOD
     return;
   const module = await loadAbsoluteMobileUpdateServerModule(projectRoot, config.updateServer?.registryModule);
   await verifyDurableModule(module);
+  verifyHealthModule(config, module);
   if (config.engine === "expo")
     expoSigningOptions(config);
   return module.metadata;
-}, publicKeysSource = (publicKeys) => JSON.stringify(publicKeys, null, "\t"), renderAbsoluteMobileUpdateRegistry = (options) => {
+}, publicKeysSource = (publicKeys) => JSON.stringify(publicKeys, null, "\t"), renderAbsoluteMobileUpdateRegistryBase = (options) => {
   const metadata = `export const absoluteMobileUpdateServer = {
 	format: 1,
 	provider: '${options.storage}',
@@ -21155,6 +21462,19 @@ export default createMobileUpdateRegistry({
 	store
 });
 `;
+}, renderAbsoluteMobileUpdateRegistry = (options) => {
+  const source = renderAbsoluteMobileUpdateRegistryBase(options);
+  if (!options.health)
+    return source;
+  const secret = options.storage === "local" ? `process.env.${options.health.secretEnv} ?? 'absolutejs-local-health-secret-not-for-production'` : `required('${options.health.secretEnv}')`;
+  const health = `	health: {
+		autoPause: { failureRate: ${options.health.failureRate}, minimumReports: ${options.health.minimumReports} },
+		secret: ${secret}
+	},
+`;
+  return source.replace(`export default createMobileUpdateRegistry({
+`, `export default createMobileUpdateRegistry({
+${health}`);
 }, writeAbsoluteMobileUpdateRegistry = async (options) => {
   const path2 = projectPath3(options.projectRoot, options.modulePath ?? DEFAULT_MOBILE_UPDATE_REGISTRY_MODULE);
   if (!options.force) {
@@ -21166,6 +21486,7 @@ export default createMobileUpdateRegistry({
   }
   await mkdir18(dirname19(path2), { recursive: true });
   await Bun.write(path2, renderAbsoluteMobileUpdateRegistry({
+    ...options.health ? { health: options.health } : {},
     publicKeys: options.publicKeys,
     storage: options.storage
   }));
@@ -27832,11 +28153,48 @@ export default function AbsoluteLayout() {
 	return <Stack screenOptions={{ headerShown: false }} />;
 }
 `;
-var updatesRuntimeSource = () => `${EXPO_GENERATED_HEADER}import { randomUUID } from 'expo-crypto';
+var updatesRuntimeSource = (config) => `${EXPO_GENERATED_HEADER}import { randomUUID } from 'expo-crypto';
 import * as SecureStore from 'expo-secure-store';
 import * as Updates from 'expo-updates';
 
 const INSTALLATION_KEY = 'absolutejs.mobile.update.installation.v1';
+const PENDING_HEALTH_KEY = 'absolutejs.mobile.update.pending-health.v1';
+const APP_ID = ${JSON.stringify(config.appId)};
+const CHANNEL = ${JSON.stringify(config.updates?.channel)};
+const MANIFEST_URL = ${JSON.stringify(config.updates?.manifestUrl)};
+
+const updateIdentity = (value: unknown) => {
+	if (!value || typeof value !== 'object') return undefined;
+	const extra = Reflect.get(value, 'extra');
+	if (!extra || typeof extra !== 'object') return undefined;
+	const absolute = Reflect.get(extra, 'absolutejs');
+	if (!absolute || typeof absolute !== 'object') return undefined;
+	const healthToken = Reflect.get(absolute, 'healthToken');
+	const releaseId = Reflect.get(absolute, 'releaseId');
+	return typeof healthToken === 'string' && typeof releaseId === 'string'
+		? { healthToken, releaseId }
+		: undefined;
+};
+
+const report = async (installationId: string, evidence: { healthToken: string; kind: string; releaseId: string }) => {
+	const endpoint = new URL('./health', MANIFEST_URL);
+	await fetch(endpoint.href, {
+		body: JSON.stringify({ kind: evidence.kind, releaseId: evidence.releaseId }),
+		cache: 'no-store',
+		credentials: 'omit',
+		headers: {
+			'content-type': 'application/json',
+			'x-absolute-mobile-app': APP_ID,
+			'x-absolute-mobile-channel': CHANNEL,
+			'x-absolute-mobile-health-token': evidence.healthToken,
+			'x-absolute-mobile-installation': installationId,
+			'x-absolute-mobile-release': updateIdentity(Updates.manifest)?.releaseId ?? 'embedded',
+			'x-absolute-mobile-runtime': Updates.runtimeVersion ?? ''
+		},
+		method: 'POST',
+		redirect: 'error'
+	});
+};
 
 let startPromise: Promise<void> | undefined;
 export const startAbsoluteExpoUpdates = () => {
@@ -27848,9 +28206,34 @@ export const startAbsoluteExpoUpdates = () => {
 			await SecureStore.setItemAsync(INSTALLATION_KEY, installationId);
 		}
 		await Updates.setExtraParamAsync('absolute-installation', installationId);
+		const pendingSource = await SecureStore.getItemAsync(PENDING_HEALTH_KEY);
+		if (pendingSource) {
+			try {
+				const pending = JSON.parse(pendingSource);
+				const active = updateIdentity(Updates.manifest);
+				if (typeof pending?.healthToken === 'string' && typeof pending?.releaseId === 'string')
+					await report(installationId, {
+						healthToken: pending.healthToken,
+						kind: active?.releaseId === pending.releaseId ? 'activated' : 'rolled-back',
+						releaseId: pending.releaseId
+					});
+			} catch {}
+			await SecureStore.deleteItemAsync(PENDING_HEALTH_KEY);
+		}
 		const result = await Updates.checkForUpdateAsync();
 		if (result.isAvailable || result.isRollBackToEmbedded) {
-			await Updates.fetchUpdateAsync();
+			const available = updateIdentity(Reflect.get(result, 'manifest'));
+			try {
+				const fetched = await Updates.fetchUpdateAsync();
+				const identity = updateIdentity(Reflect.get(fetched, 'manifest')) ?? available;
+				if (identity) {
+					await SecureStore.setItemAsync(PENDING_HEALTH_KEY, JSON.stringify(identity));
+					await report(installationId, { ...identity, kind: 'downloaded' });
+				}
+			} catch (error) {
+				if (available) await report(installationId, { ...available, kind: 'download-failed' }).catch(() => undefined);
+				throw error;
+			}
 			if (result.isRollBackToEmbedded) {
 				await Updates.reloadAsync();
 			}
@@ -28795,7 +29178,7 @@ node_modules/
       files.set(path, source);
   }
   if (config.updates) {
-    files.set(join15(project, "src", "generated", "AbsoluteUpdates.ts"), updatesRuntimeSource());
+    files.set(join15(project, "src", "generated", "AbsoluteUpdates.ts"), updatesRuntimeSource(config));
   }
   const expoCodeSigning = config.updates?.expoCodeSigning;
   if (expoCodeSigning)
@@ -38780,6 +39163,30 @@ var requestHeaders = (config) => ({
   "x-absolute-mobile-release": config.currentReleaseId,
   "x-absolute-mobile-runtime": config.runtimeFingerprint
 });
+var healthUrl = (manifestUrl) => new URL("./health", manifestUrl);
+var reportAbsoluteMobileUpdateHealth = async (config, input, request = globalThis.fetch) => {
+  const manifestUrl = exactManifestUrl(config.manifestUrl);
+  const headers = new Headers(requestHeaders(config));
+  headers.set("content-type", "application/json");
+  headers.set("x-absolute-mobile-health-token", input.healthToken);
+  const response = await request(healthUrl(manifestUrl), {
+    body: JSON.stringify({
+      kind: input.kind,
+      ...input.reason ? { reason: input.reason } : {},
+      releaseId: input.releaseId,
+      ...input.transfer ? { transfer: input.transfer } : {}
+    }),
+    cache: "no-store",
+    credentials: "omit",
+    headers,
+    keepalive: true,
+    method: "POST",
+    redirect: "error",
+    signal: AbortSignal.timeout(15000)
+  });
+  if (response.status !== 202)
+    throw new TypeError(`Mobile update health report failed with HTTP ${response.status}.`);
+};
 var requireCompatible = (manifest, config) => {
   if (manifest.appId !== config.appId)
     throw new TypeError("Mobile update belongs to another app.");
@@ -38975,15 +39382,24 @@ var createAbsoluteMobileUpdateClient = (options) => {
       throw new TypeError("Mobile update manifest is not valid JSON.");
     }
     const manifest = parseAbsoluteMobileUpdateManifest(manifestValue);
+    const healthToken = response.headers.get("x-absolute-mobile-health-token");
     requireCompatible(manifest, options.config);
     if (!await options.verifier.verify(manifest))
       throw new TypeError("Mobile update signature verification failed.");
     if (manifest.releaseId === options.config.currentReleaseId)
       return { kind: "current" };
     if (options.config.blockedReleaseIds?.includes(manifest.releaseId))
-      return { kind: "quarantined", releaseId: manifest.releaseId };
+      return {
+        ...healthToken ? { healthToken } : {},
+        kind: "quarantined",
+        releaseId: manifest.releaseId
+      };
     if (!download)
-      return { kind: "update-available", manifest };
+      return {
+        ...healthToken ? { healthToken } : {},
+        kind: "update-available",
+        manifest
+      };
     await options.store.begin(manifest);
     let transfer;
     try {
@@ -38994,14 +39410,28 @@ var createAbsoluteMobileUpdateClient = (options) => {
         await options.store.suspend(manifest.releaseId);
       else
         await options.store.abort(manifest.releaseId);
+      if (healthToken)
+        reportAbsoluteMobileUpdateHealth(options.config, {
+          healthToken,
+          kind: "download-failed",
+          releaseId: manifest.releaseId
+        }, request).catch(() => {
+          return;
+        });
       throw error;
     }
-    return { kind: "downloaded", manifest, transfer };
+    return {
+      ...healthToken ? { healthToken } : {},
+      kind: "downloaded",
+      manifest,
+      transfer
+    };
   };
   return {
     check,
     activate: (releaseId) => options.store.activate(releaseId),
-    download: () => check(true)
+    download: () => check(true),
+    report: (input) => reportAbsoluteMobileUpdateHealth(options.config, input, request)
   };
 };
 // src/mobile/updatePublisher.ts
@@ -39124,6 +39554,34 @@ var lifecycleMethod = (publisher, name) => {
     throw new TypeError(`Mobile update registry does not support ${name}. Re-run \`absolute mobile update provision --force\` after upgrading @absolutejs/deploy.`);
   return method;
 };
+var inspectAbsoluteMobileUpdateHealth = async (options) => {
+  const report = await lifecycleMethod(options.publisher, "inspectUpdateHealth")({
+    appId: options.appId,
+    channel: options.channel,
+    ...options.releaseId ? { releaseId: options.releaseId } : {}
+  });
+  if (report === null)
+    return null;
+  if (!object5(report) || report.appId !== options.appId || report.channel !== options.channel || options.releaseId !== undefined && report.releaseId !== options.releaseId || typeof report.paused !== "boolean" || ![
+    report.activated,
+    report.downloaded,
+    report.downloadFailed,
+    report.failures,
+    report.quarantined,
+    report.reportedInstallations,
+    report.rolledBack,
+    report.terminalReports
+  ].every((value) => Number.isSafeInteger(value) && value >= 0) || !Number.isFinite(report.failureRate) || report.failureRate < 0 || report.failureRate > 1 || !Number.isFinite(report.rollout) || report.rollout < 0 || report.rollout > 1 || !object5(report.transfer) || ![
+    report.transfer.avoidedBytes,
+    report.transfer.downloadedBytes,
+    report.transfer.durationMs,
+    report.transfer.resumedBytes,
+    report.transfer.reusedBytes,
+    report.transfer.throughputBytesPerSecond
+  ].every((value) => Number.isFinite(value) && value >= 0))
+    throw new TypeError("Mobile update registry returned an invalid health report.");
+  return report;
+};
 var validOptionalCounters = (values) => values.every((value) => value === undefined) || values.every((value) => Number.isSafeInteger(value) && (value ?? -1) >= 0);
 var validateStorageIdentity = (result, appId) => {
   if (!object5(result) || result.appId !== appId || !Array.isArray(result.releases) || ![
@@ -39385,6 +39843,7 @@ export {
   hashAbsoluteMobilePropsSchema,
   inspectAbsoluteAndroidInstalledApp,
   inspectAbsoluteMobileRouteMetadata,
+  inspectAbsoluteMobileUpdateHealth,
   inspectAbsoluteMobileUpdateServer,
   inspectAbsoluteMobileUpdateStorage,
   inspectAbsoluteRemoteMac,
@@ -39455,6 +39914,7 @@ export {
   removeAbsoluteRemoteMacProfile,
   renderAbsoluteMobileUpdateRegistry,
   repairAbsoluteIosDevSession,
+  reportAbsoluteMobileUpdateHealth,
   requestAbsoluteMobileBack,
   requireAbsoluteIosReleaseMetadata,
   resolveAbsoluteDeviceCapabilityPlan,
@@ -39493,5 +39953,5 @@ export {
   writeAbsoluteMobileUpdateRegistry
 };
 
-//# debugId=B713A6D1CA49D10364756E2164756E21
+//# debugId=01F0CE93B9ED6BCC64756E2164756E21
 //# sourceMappingURL=index.js.map