@absolutejs/absolute 0.20.0-beta.85 → 0.20.0-beta.87

package/dist/cli/{compile-d7g2fvqe.js → compile-5hchbcbd.js}

@@ -12,7 +12,7 @@ import {
   createIslandRegistryDefinitionPlugin,
   finalizeAbsoluteMobileCompatibilityBuild,
   resolveServerBundleExternals
-} from "./index-8gksmws3.js";
+} from "./index-jqdt7841.js";
 import {
   loadIslandRegistryBuildInfo
 } from "./index-bzs19w3r.js";
@@ -35,8 +35,8 @@ import {
 import"./index-w5vswatm.js";
 import {
   normalizeAbsoluteMobileConfig
-} from "./index-czw3jd8f.js";
-import"./index-p8ezgd5e.js";
+} from "./index-rd2hbttb.js";
+import"./index-tame6e2c.js";
 import {
   ABSOLUTE_NATIVE_AUTH_CLIENTS_ENV,
   installAbsoluteMobileAuthEnvironment

package/dist/cli/{config-naw5fer4.js → config-vy04mqce.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   normalizeAbsoluteMobileConfig
-} from "./index-czw3jd8f.js";
+} from "./index-rd2hbttb.js";
 import"./index-mywsk201.js";
 export {
   normalizeAbsoluteMobileConfig

package/dist/cli/{dev-skb8dz33.js → dev-6shm8qsn.js}

@@ -1281,8 +1281,8 @@ var loadAbsoluteMobileDevModules = async () => {
     remoteMacProtocol,
     iosNativeWatcher
   ] = await Promise.all([
-    import("./config-naw5fer4.js"),
-    import("./expoProject-3mmwtemn.js"),
+    import("./config-vy04mqce.js"),
+    import("./expoProject-dac8fqhq.js"),
     import("./expoDevController-n19kb5fr.js"),
     import("./nativeAuth-zx4tsb1f.js"),
     import("./androidEmulatorController-nybhzc6c.js"),

package/dist/cli/{expoProject-3mmwtemn.js → expoProject-dac8fqhq.js}

@@ -2,7 +2,7 @@
 import {
   syncAbsoluteExpoWebAssets,
   writeAbsoluteExpoProject
-} from "./index-p8ezgd5e.js";
+} from "./index-tame6e2c.js";
 import"./index-ar4gz15x.js";
 import"./index-mywsk201.js";
 export {

package/dist/cli/{index-q78x1k9q.js → index-39j0dhq7.js}

@@ -6,7 +6,7 @@ import {
   createIslandRegistryDefinitionPlugin,
   finalizeAbsoluteMobileCompatibilityBuild,
   resolveServerBundleExternals
-} from "./index-8gksmws3.js";
+} from "./index-jqdt7841.js";
 import {
   loadIslandRegistryBuildInfo
 } from "./index-bzs19w3r.js";
@@ -26,7 +26,7 @@ import {
 } from "./index-9kwmb3c0.js";
 import {
   normalizeAbsoluteMobileConfig
-} from "./index-czw3jd8f.js";
+} from "./index-rd2hbttb.js";
 import {
   installAbsoluteMobileAuthEnvironment
 } from "./index-ar4gz15x.js";

package/dist/cli/{index-8gksmws3.js → index-jqdt7841.js}

@@ -4,13 +4,13 @@ import {
 } from "./index-s2tazax7.js";
 import {
   normalizeAbsoluteMobileConfig
-} from "./index-czw3jd8f.js";
+} from "./index-rd2hbttb.js";
 import {
   assertAbsoluteDeviceCapabilityPackages,
   resolveAbsoluteMobileUpdateRuntime,
   syncAbsoluteExpoWebAssets,
   writeAbsoluteExpoProject
-} from "./index-p8ezgd5e.js";
+} from "./index-tame6e2c.js";
 
 // src/build/islandRegistryTransform.ts
 import { basename } from "path";

package/dist/cli/{index-czw3jd8f.js → index-rd2hbttb.js}

@@ -11,6 +11,16 @@ var UPDATE_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
 var UPDATE_PUBLIC_KEY_PATTERN = /^[A-Za-z0-9+/]+={0,2}$/u;
 var ENVIRONMENT_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/u;
 var DEFAULT_UPDATE_BOOT_TIMEOUT_MS = 20000;
+var DEFAULT_UPDATE_HEALTH_FAILURE_RATE = 0.2;
+var DEFAULT_UPDATE_HEALTH_MINIMUM_REPORTS = 20;
+var DEFAULT_UPDATE_ROLLOUT_FAILURE_RATE = 0.05;
+var DEFAULT_UPDATE_ROLLOUT_OBSERVATION_MINUTES = 60;
+var MINUTE_MS = 60 * 1000;
+var DEFAULT_UPDATE_ROLLOUT_STAGES = [
+  { minimumReports: 20, observationMinutes: 60, rollout: 0.05 },
+  { minimumReports: 100, observationMinutes: 360, rollout: 0.25 },
+  { minimumReports: 100, observationMinutes: 0, rollout: 1 }
+];
 var MINIMUM_UPDATE_BOOT_TIMEOUT_MS = 5000;
 var MAXIMUM_UPDATE_BOOT_TIMEOUT_MS = 120000;
 var HOSTNAME_PATTERN = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(?:\.(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?))*$/;
@@ -230,6 +240,56 @@ var normalizeUpdateServer = (config, productionOrigin, projectRoot, updates) =>
   if (!ENVIRONMENT_NAME_PATTERN.test(expoPrivateKeyEnv))
     throw new TypeError("mobile.updates.server.expoPrivateKeyEnv must be a valid environment variable name.");
   const autoMount = config.updates.server?.autoMount ?? true;
+  const configuredHealth = config.updates.server?.health;
+  let health;
+  if (configuredHealth !== false) {
+    const failureRate = configuredHealth?.failureRate ?? DEFAULT_UPDATE_HEALTH_FAILURE_RATE;
+    const minimumReports = configuredHealth?.minimumReports ?? DEFAULT_UPDATE_HEALTH_MINIMUM_REPORTS;
+    const secretEnv = requireText(configuredHealth?.secretEnv ?? "ABSOLUTE_MOBILE_UPDATE_HEALTH_SECRET", "mobile.updates.server.health.secretEnv");
+    if (!Number.isFinite(failureRate) || failureRate <= 0 || failureRate > 1)
+      throw new TypeError("mobile.updates.server.health.failureRate must be greater than 0 and at most 1.");
+    if (!Number.isSafeInteger(minimumReports) || minimumReports < 1)
+      throw new TypeError("mobile.updates.server.health.minimumReports must be a positive integer.");
+    if (!ENVIRONMENT_NAME_PATTERN.test(secretEnv))
+      throw new TypeError("mobile.updates.server.health.secretEnv must be a valid environment variable name.");
+    health = { failureRate, minimumReports, secretEnv };
+  }
+  const configuredRollout = config.updates.server?.rollout;
+  let rollout;
+  if (configuredRollout !== undefined && configuredRollout !== false) {
+    if (!health)
+      throw new TypeError("mobile.updates.server.rollout requires fleet health to be enabled.");
+    if (configuredRollout.automatic !== undefined && typeof configuredRollout.automatic !== "boolean")
+      throw new TypeError("mobile.updates.server.rollout.automatic must be boolean.");
+    const configuredStages = configuredRollout.stages ?? DEFAULT_UPDATE_ROLLOUT_STAGES;
+    const stages = configuredStages.map((stage, index) => {
+      const previousStage = configuredStages[index - 1];
+      const maximumFailureRate = stage.maximumFailureRate ?? DEFAULT_UPDATE_ROLLOUT_FAILURE_RATE;
+      const minimumReports = stage.minimumReports ?? DEFAULT_UPDATE_HEALTH_MINIMUM_REPORTS;
+      const observationMinutes = stage.observationMinutes ?? DEFAULT_UPDATE_ROLLOUT_OBSERVATION_MINUTES;
+      const observationMs = observationMinutes * MINUTE_MS;
+      if (!Number.isFinite(stage.rollout) || stage.rollout <= 0 || stage.rollout > 1 || previousStage !== undefined && stage.rollout <= previousStage.rollout)
+        throw new TypeError("mobile.updates.server.rollout stages must be strictly increasing fractions greater than 0 and at most 1.");
+      if (!Number.isFinite(maximumFailureRate) || maximumFailureRate < 0 || maximumFailureRate >= health.failureRate)
+        throw new TypeError("mobile.updates.server.rollout maximumFailureRate must be non-negative and lower than the fleet-health pause rate.");
+      if (!Number.isSafeInteger(minimumReports) || minimumReports < health.minimumReports)
+        throw new TypeError("mobile.updates.server.rollout minimumReports must be an integer at least as large as the fleet-health minimumReports.");
+      if (!Number.isFinite(observationMinutes) || observationMinutes < 0 || !Number.isSafeInteger(observationMs))
+        throw new TypeError("mobile.updates.server.rollout observationMinutes must produce a non-negative whole number of milliseconds.");
+      return {
+        maximumFailureRate,
+        minimumReports,
+        observationMs,
+        rollout: stage.rollout
+      };
+    });
+    if (stages.length === 0 || stages.at(-1)?.rollout !== 1)
+      throw new TypeError("mobile.updates.server.rollout stages must end at rollout 1.");
+    rollout = {
+      automatic: configuredRollout.automatic ?? false,
+      stages
+    };
+  }
   if (autoMount) {
     const manifest = new URL(updates.manifestUrl);
     if (manifest.origin !== productionOrigin)
@@ -262,7 +322,13 @@ var normalizeUpdateServer = (config, productionOrigin, projectRoot, updates) =>
       throw new TypeError(`mobile.updates.server.expoCodeSigningKeys.${keyId} certificate is not currently valid.`);
     expoCodeSigningKeys[keyId] = { certificatePem, privateKeyEnv };
   }
-  return { autoMount, expoCodeSigningKeys, registryModule };
+  return {
+    autoMount,
+    expoCodeSigningKeys,
+    ...health ? { health } : {},
+    ...rollout ? { rollout } : {},
+    registryModule
+  };
 };
 var validateExpoNativeRouteSegment = (path, segment, index, count, parameters) => {
   if (segment === "*" && (index !== count - 1 || count === 1)) {

package/dist/cli/{index-p8ezgd5e.js → index-tame6e2c.js}

@@ -1728,11 +1728,48 @@ export default function AbsoluteLayout() {
 	return <Stack screenOptions={{ headerShown: false }} />;
 }
 `;
-var updatesRuntimeSource = () => `${EXPO_GENERATED_HEADER}import { randomUUID } from 'expo-crypto';
+var updatesRuntimeSource = (config) => `${EXPO_GENERATED_HEADER}import { randomUUID } from 'expo-crypto';
 import * as SecureStore from 'expo-secure-store';
 import * as Updates from 'expo-updates';
 
 const INSTALLATION_KEY = 'absolutejs.mobile.update.installation.v1';
+const PENDING_HEALTH_KEY = 'absolutejs.mobile.update.pending-health.v1';
+const APP_ID = ${JSON.stringify(config.appId)};
+const CHANNEL = ${JSON.stringify(config.updates?.channel)};
+const MANIFEST_URL = ${JSON.stringify(config.updates?.manifestUrl)};
+
+const updateIdentity = (value: unknown) => {
+	if (!value || typeof value !== 'object') return undefined;
+	const extra = Reflect.get(value, 'extra');
+	if (!extra || typeof extra !== 'object') return undefined;
+	const absolute = Reflect.get(extra, 'absolutejs');
+	if (!absolute || typeof absolute !== 'object') return undefined;
+	const healthToken = Reflect.get(absolute, 'healthToken');
+	const releaseId = Reflect.get(absolute, 'releaseId');
+	return typeof healthToken === 'string' && typeof releaseId === 'string'
+		? { healthToken, releaseId }
+		: undefined;
+};
+
+const report = async (installationId: string, evidence: { healthToken: string; kind: string; releaseId: string }) => {
+	const endpoint = new URL('./health', MANIFEST_URL);
+	await fetch(endpoint.href, {
+		body: JSON.stringify({ kind: evidence.kind, releaseId: evidence.releaseId }),
+		cache: 'no-store',
+		credentials: 'omit',
+		headers: {
+			'content-type': 'application/json',
+			'x-absolute-mobile-app': APP_ID,
+			'x-absolute-mobile-channel': CHANNEL,
+			'x-absolute-mobile-health-token': evidence.healthToken,
+			'x-absolute-mobile-installation': installationId,
+			'x-absolute-mobile-release': updateIdentity(Updates.manifest)?.releaseId ?? 'embedded',
+			'x-absolute-mobile-runtime': Updates.runtimeVersion ?? ''
+		},
+		method: 'POST',
+		redirect: 'error'
+	});
+};
 
 let startPromise: Promise<void> | undefined;
 export const startAbsoluteExpoUpdates = () => {
@@ -1744,9 +1781,34 @@ export const startAbsoluteExpoUpdates = () => {
 			await SecureStore.setItemAsync(INSTALLATION_KEY, installationId);
 		}
 		await Updates.setExtraParamAsync('absolute-installation', installationId);
+		const pendingSource = await SecureStore.getItemAsync(PENDING_HEALTH_KEY);
+		if (pendingSource) {
+			try {
+				const pending = JSON.parse(pendingSource);
+				const active = updateIdentity(Updates.manifest);
+				if (typeof pending?.healthToken === 'string' && typeof pending?.releaseId === 'string')
+					await report(installationId, {
+						healthToken: pending.healthToken,
+						kind: active?.releaseId === pending.releaseId ? 'activated' : 'rolled-back',
+						releaseId: pending.releaseId
+					});
+			} catch {}
+			await SecureStore.deleteItemAsync(PENDING_HEALTH_KEY);
+		}
 		const result = await Updates.checkForUpdateAsync();
 		if (result.isAvailable || result.isRollBackToEmbedded) {
-			await Updates.fetchUpdateAsync();
+			const available = updateIdentity(Reflect.get(result, 'manifest'));
+			try {
+				const fetched = await Updates.fetchUpdateAsync();
+				const identity = updateIdentity(Reflect.get(fetched, 'manifest')) ?? available;
+				if (identity) {
+					await SecureStore.setItemAsync(PENDING_HEALTH_KEY, JSON.stringify(identity));
+					await report(installationId, { ...identity, kind: 'downloaded' });
+				}
+			} catch (error) {
+				if (available) await report(installationId, { ...available, kind: 'download-failed' }).catch(() => undefined);
+				throw error;
+			}
 			if (result.isRollBackToEmbedded) {
 				await Updates.reloadAsync();
 			}
@@ -2691,7 +2753,7 @@ node_modules/
       files.set(path, source);
   }
   if (config.updates) {
-    files.set(join4(project, "src", "generated", "AbsoluteUpdates.ts"), updatesRuntimeSource());
+    files.set(join4(project, "src", "generated", "AbsoluteUpdates.ts"), updatesRuntimeSource(config));
   }
   const expoCodeSigning = config.updates?.expoCodeSigning;
   if (expoCodeSigning)

package/dist/cli/index.js

@@ -58,7 +58,7 @@ if (command === "dev") {
   }
   const positionalArgs = stripNamedArgs("--config", "--android-device", "--ios-device").filter((arg) => arg !== "--no-mobile" && arg !== "--eager");
   const serverEntry = positionalArgs[0] ?? DEFAULT_SERVER_ENTRY;
-  const { dev } = await import("./dev-skb8dz33.js");
+  const { dev } = await import("./dev-6shm8qsn.js");
   await dev(serverEntry, configPath, {
     androidDevice,
     eager: args.includes("--eager"),
@@ -71,7 +71,7 @@ if (command === "dev") {
   const configPath = parseNamedArg("--config");
   const positionalArgs = stripNamedArgs("--outdir", "--config").filter((arg) => arg !== "--prebuilt");
   const serverEntry = positionalArgs[0] ?? DEFAULT_SERVER_ENTRY;
-  const { start } = await import("./start-jbgfw27x.js");
+  const { start } = await import("./start-7jg0csqy.js");
   await start(serverEntry, outdir, configPath, {
     prebuilt: args.includes("--prebuilt")
   });
@@ -81,7 +81,7 @@ if (command === "dev") {
   const configPath = parseNamedArg("--config");
   const positionalArgs = stripNamedArgs("--outdir", "--config");
   const serverEntry = positionalArgs[0] ?? DEFAULT_SERVER_ENTRY;
-  const { start } = await import("./start-jbgfw27x.js");
+  const { start } = await import("./start-7jg0csqy.js");
   await start(serverEntry, outdir, configPath, { prepareOnly: true });
 } else if (command === "build") {
   sendTelemetryEvent("cli:command", { command });
@@ -197,13 +197,13 @@ if (command === "dev") {
   const configPath = parseNamedArg("--config");
   const positionalArgs = stripNamedArgs("--outdir", "--outfile", "--config");
   const serverEntry = positionalArgs[0] ?? DEFAULT_SERVER_ENTRY;
-  const { compile } = await import("./compile-d7g2fvqe.js");
+  const { compile } = await import("./compile-5hchbcbd.js");
   await compile(serverEntry, outdir, outfile, configPath);
 } else if (command === "mobile") {
   sendTelemetryEvent("cli:command", {
     command: `mobile:${workspaceCommand ?? "unknown"}`
   });
-  const { runMobile } = await import("./mobile-pdck6a35.js");
+  const { runMobile } = await import("./mobile-c94a5y9k.js");
   try {
     await runMobile(args);
   } catch (error) {

package/dist/cli/{mobile-pdck6a35.js → mobile-c94a5y9k.js}

@@ -7,12 +7,12 @@ import {
 } from "./index-9r7n9dqp.js";
 import {
   start
-} from "./index-q78x1k9q.js";
+} from "./index-39j0dhq7.js";
 import {
   ABSOLUTE_MOBILE_CLIENT_MANIFEST_FORMAT,
   ABSOLUTE_MOBILE_PAGE_PROTOCOL_VERSION,
   resolveAbsoluteMobileRoute
-} from "./index-8gksmws3.js";
+} from "./index-jqdt7841.js";
 import"./index-bzs19w3r.js";
 import"./index-s2tazax7.js";
 import {
@@ -52,7 +52,7 @@ import {
 import"./index-w5vswatm.js";
 import {
   normalizeAbsoluteMobileConfig
-} from "./index-czw3jd8f.js";
+} from "./index-rd2hbttb.js";
 import {
   ABSOLUTE_MOBILE_UPDATE_FORMAT,
   absoluteDeviceNativeRequirements,
@@ -66,7 +66,7 @@ import {
   syncAbsoluteExpoWebAssets,
   unsignedAbsoluteMobileUpdate,
   writeAbsoluteExpoProject
-} from "./index-p8ezgd5e.js";
+} from "./index-tame6e2c.js";
 import {
   normalizeAbsoluteIosDeviceIdentifier
 } from "./index-j66p8hn5.js";
@@ -19318,6 +19318,18 @@ var verifyDurableModule = async (module) => {
     throw new TypeError(`Durable mobile update storage verification failed for ${module.metadata.provider}. Check the bucket, endpoint, credentials, and read/write/delete permissions.`, { cause: error });
   }
 };
+var verifyHealthModule = (config, module) => {
+  if (!config.updateServer?.health)
+    return;
+  if (typeof module.registry.inspectUpdateHealth !== "function" || typeof module.registry.issueUpdateHealthToken !== "function" || typeof module.registry.recordUpdateHealth !== "function")
+    throw new TypeError("Mobile update fleet health is enabled but the registry is not provisioned for it. Run `absolute mobile update provision --force`.");
+};
+var verifyRolloutModule = (config, module) => {
+  if (!config.updateServer?.rollout)
+    return;
+  if (typeof module.registry.advanceUpdateRollout !== "function" || typeof module.registry.cancelUpdateRollout !== "function" || typeof module.registry.inspectUpdateRollout !== "function" || typeof module.registry.pauseUpdateRollout !== "function" || typeof module.registry.reconcileUpdateRollout !== "function" || typeof module.registry.resumeUpdateRollout !== "function")
+    throw new TypeError("Mobile update rollout orchestration is enabled but the registry is not provisioned for it. Run `absolute mobile update provision --force`.");
+};
 var expoSigningOptions = (config) => {
   if (!config.updates?.expoCodeSigning)
     return;
@@ -19350,12 +19362,14 @@ var inspectAbsoluteMobileUpdateServer = async (config, projectRoot) => {
     return;
   const module = await loadAbsoluteMobileUpdateServerModule(projectRoot, config.updateServer?.registryModule);
   await verifyDurableModule(module);
+  verifyHealthModule(config, module);
+  verifyRolloutModule(config, module);
   if (config.engine === "expo")
     expoSigningOptions(config);
   return module.metadata;
 };
 var publicKeysSource = (publicKeys) => JSON.stringify(publicKeys, null, "\t");
-var renderAbsoluteMobileUpdateRegistry = (options) => {
+var renderAbsoluteMobileUpdateRegistryBase = (options) => {
   const metadata = `export const absoluteMobileUpdateServer = {
 	format: 1,
 	provider: '${options.storage}',
@@ -19422,6 +19436,28 @@ export default createMobileUpdateRegistry({
 });
 `;
 };
+var renderAbsoluteMobileUpdateRegistry = (options) => {
+  const source = renderAbsoluteMobileUpdateRegistryBase(options);
+  let generated = "";
+  if (options.health) {
+    const secret = options.storage === "local" ? `process.env.${options.health.secretEnv} ?? 'absolutejs-local-health-secret-not-for-production'` : `required('${options.health.secretEnv}')`;
+    generated += `	health: {
+		autoPause: { failureRate: ${options.health.failureRate}, minimumReports: ${options.health.minimumReports} },
+		secret: ${secret}
+	},
+`;
+  }
+  if (options.rollout)
+    generated += `	rollout: ${JSON.stringify(options.rollout, null, "\t").replaceAll(`
+`, `
+	`)},
+`;
+  if (!generated)
+    return source;
+  return source.replace(`export default createMobileUpdateRegistry({
+`, `export default createMobileUpdateRegistry({
+${generated}`);
+};
 var writeAbsoluteMobileUpdateRegistry = async (options) => {
   const path = projectPath(options.projectRoot, options.modulePath ?? DEFAULT_MOBILE_UPDATE_REGISTRY_MODULE);
   if (!options.force) {
@@ -19433,6 +19469,8 @@ var writeAbsoluteMobileUpdateRegistry = async (options) => {
   }
   await mkdir5(dirname4(path), { recursive: true });
   await Bun.write(path, renderAbsoluteMobileUpdateRegistry({
+    ...options.health ? { health: options.health } : {},
+    ...options.rollout ? { rollout: options.rollout } : {},
     publicKeys: options.publicKeys,
     storage: options.storage
   }));
@@ -21994,6 +22032,66 @@ var lifecycleMethod = (publisher, name) => {
     throw new TypeError(`Mobile update registry does not support ${name}. Re-run \`absolute mobile update provision --force\` after upgrading @absolutejs/deploy.`);
   return method;
 };
+var validateHealthReport = (report, options) => {
+  if (!object3(report) || report.appId !== options.appId || report.channel !== options.channel || options.releaseId !== undefined && report.releaseId !== options.releaseId || typeof report.paused !== "boolean" || ![
+    report.activated,
+    report.downloaded,
+    report.downloadFailed,
+    report.failures,
+    report.quarantined,
+    report.reportedInstallations,
+    report.rolledBack,
+    report.terminalReports
+  ].every((value) => Number.isSafeInteger(value) && value >= 0) || !Number.isFinite(report.failureRate) || report.failureRate < 0 || report.failureRate > 1 || !Number.isFinite(report.rollout) || report.rollout < 0 || report.rollout > 1 || !object3(report.transfer) || ![
+    report.transfer.avoidedBytes,
+    report.transfer.downloadedBytes,
+    report.transfer.durationMs,
+    report.transfer.resumedBytes,
+    report.transfer.reusedBytes,
+    report.transfer.throughputBytesPerSecond
+  ].every((value) => Number.isFinite(value) && value >= 0))
+    throw new TypeError("Mobile update registry returned an invalid health report.");
+  return report;
+};
+var inspectAbsoluteMobileUpdateHealth = async (options) => {
+  const report = await lifecycleMethod(options.publisher, "inspectUpdateHealth")({
+    appId: options.appId,
+    channel: options.channel,
+    ...options.releaseId ? { releaseId: options.releaseId } : {}
+  });
+  if (report === null)
+    return null;
+  return validateHealthReport(report, options);
+};
+var validateRolloutReport = (report, options) => {
+  validateHealthReport(report, options);
+  const validStage = (stage) => stage === undefined || object3(stage) && Number.isFinite(stage.rollout) && stage.rollout > 0 && stage.rollout <= 1 && Number.isSafeInteger(stage.minimumReports) && stage.minimumReports > 0 && Number.isSafeInteger(stage.observationMs) && stage.observationMs >= 0 && Number.isFinite(stage.maximumFailureRate) && stage.maximumFailureRate >= 0 && stage.maximumFailureRate < 1;
+  if (typeof report.automatic !== "boolean" || !Number.isSafeInteger(report.currentStage) || report.currentStage < 0 || !Number.isFinite(Date.parse(report.enteredAt)) || !["active", "cancelled", "complete", "paused"].includes(report.status) || report.pausedBy !== undefined && report.pausedBy !== "fleet-health" && report.pausedBy !== "operator" || !validStage(report.nextStage) || report.paused !== (report.status === "paused" || report.status === "cancelled"))
+    throw new TypeError("Mobile update registry returned an invalid rollout report.");
+  return report;
+};
+var inspectAbsoluteMobileUpdateRollout = async (options) => {
+  const report = await lifecycleMethod(options.publisher, "inspectUpdateRollout")({ appId: options.appId, channel: options.channel });
+  return report === null ? null : validateRolloutReport(report, options);
+};
+var mutateAbsoluteMobileUpdateRollout = async (method, options) => validateRolloutReport(await lifecycleMethod(options.publisher, method)({
+  appId: options.appId,
+  channel: options.channel,
+  ...method === "advanceUpdateRollout" && options.rollout !== undefined ? { rollout: options.rollout } : {},
+  ...options.signal ? { signal: options.signal } : {}
+}), options);
+var advanceAbsoluteMobileUpdateRollout = (options) => mutateAbsoluteMobileUpdateRollout("advanceUpdateRollout", options);
+var cancelAbsoluteMobileUpdateRollout = (options) => mutateAbsoluteMobileUpdateRollout("cancelUpdateRollout", options);
+var pauseAbsoluteMobileUpdateRollout = (options) => mutateAbsoluteMobileUpdateRollout("pauseUpdateRollout", options);
+var reconcileAbsoluteMobileUpdateRollout = async (options) => {
+  const report = await lifecycleMethod(options.publisher, "reconcileUpdateRollout")({
+    appId: options.appId,
+    channel: options.channel,
+    ...options.signal ? { signal: options.signal } : {}
+  });
+  return report === null ? null : validateRolloutReport(report, options);
+};
+var resumeAbsoluteMobileUpdateRollout = (options) => mutateAbsoluteMobileUpdateRollout("resumeUpdateRollout", options);
 var validOptionalCounters = (values) => values.every((value) => value === undefined) || values.every((value) => Number.isSafeInteger(value) && (value ?? -1) >= 0);
 var validateStorageIdentity = (result, appId) => {
   if (!object3(result) || result.appId !== appId || !Array.isArray(result.releases) || ![
@@ -22780,6 +22878,7 @@ var mobileUpdatePublisher = async (args) => {
     throw new TypeError("Mobile updates are not configured.");
   const modulePath = valueAfter(args, "--registry") ?? mobile.updateServer.registryModule;
   return {
+    mobile,
     projectRoot,
     publisher: await loadAbsoluteMobileUpdatePublisher(projectRoot, modulePath)
   };
@@ -22793,7 +22892,7 @@ var provisionMobileUpdate = async (args) => {
     throw new TypeError("--storage must be local or s3.");
   const modulePath = valueAfter(args, "--registry") ?? mobile.updateServer.registryModule;
   const packages = [
-    "@absolutejs/deploy@0.25.7",
+    "@absolutejs/deploy@0.25.13",
     "@absolutejs/blob@0.5.2",
     ...requestedStorage === "s3" ? [
       "@aws-sdk/client-s3@3.1095.0",
@@ -22806,6 +22905,8 @@ var provisionMobileUpdate = async (args) => {
   await installApprovedPackages(projectRoot, args, `Mobile update serving needs ${missing.map(packageNameFromSpec).join(", ")}. Install them now?`, missing);
   const path = await writeAbsoluteMobileUpdateRegistry({
     force: args.includes("--force"),
+    ...mobile.updateServer.health ? { health: mobile.updateServer.health } : {},
+    ...mobile.updateServer.rollout ? { rollout: mobile.updateServer.rollout } : {},
     modulePath,
     projectRoot,
     publicKeys: mobile.updates.publicKeys,
@@ -22815,7 +22916,7 @@ var provisionMobileUpdate = async (args) => {
   if (requestedStorage === "local")
     console.log("Production release checks will require durable storage. Re-run with --storage s3 --force before deploying.");
   else
-    console.log("Set ABSOLUTE_MOBILE_UPDATE_S3_BUCKET and standard AWS credentials on the trusted server; endpoint and region overrides are optional.");
+    console.log(`Set ABSOLUTE_MOBILE_UPDATE_S3_BUCKET${mobile.updateServer.health ? `, ${mobile.updateServer.health.secretEnv},` : ""} and standard AWS credentials on the trusted server; endpoint and region overrides are optional.`);
   const expoSigning = mobile.updates.expoCodeSigning;
   if (expoSigning) {
     const signingKey = mobile.updateServer.expoCodeSigningKeys[expoSigning.keyId];
@@ -22834,12 +22935,12 @@ var publishMobileUpdate = async (args) => {
   });
   if (!releaseDirectory)
     throw new TypeError("mobile update publish requires a release directory.");
-  const { projectRoot, publisher } = await mobileUpdatePublisher(args);
+  const { mobile, projectRoot, publisher } = await mobileUpdatePublisher(args);
   const result = await publishAbsoluteMobileUpdate({
     projectRoot,
     publisher,
     releaseDirectory,
-    rollout: updateRollout(args, 0.05)
+    rollout: updateRollout(args, mobile.updateServer?.rollout?.stages[0]?.rollout ?? 0.05)
   });
   console.log(`${result.reused ? "Reused" : "Published"} mobile update ${result.releaseId} to ${result.channel} at ${Math.round(result.rollout * 100)}%.`);
   if (result.storedBytes !== undefined && result.reusedBytes !== undefined && result.storedFiles !== undefined && result.reusedFiles !== undefined)
@@ -22938,6 +23039,92 @@ var inspectMobileUpdateStorage = async (args) => {
   });
   return report;
 };
+var inspectMobileUpdateHealth = async (args) => {
+  const { mobile } = await loadMobile(valueAfter(args, "--config"));
+  if (!mobile.updates)
+    throw new TypeError("mobile update status requires mobile.updates config.");
+  const { publisher } = await mobileUpdatePublisher(args);
+  const releaseId = valueAfter(args, "--release");
+  const rolloutReport = mobile.updateServer?.rollout ? await inspectAbsoluteMobileUpdateRollout({
+    appId: mobile.appId,
+    channel: mobile.updates.channel,
+    publisher
+  }) : undefined;
+  const report = mobile.updateServer?.rollout ? rolloutReport : await inspectAbsoluteMobileUpdateHealth({
+    appId: mobile.appId,
+    channel: mobile.updates.channel,
+    publisher,
+    ...releaseId ? { releaseId } : {}
+  });
+  if (args.includes("--json"))
+    console.log(JSON.stringify(report, null, 2));
+  else if (!report)
+    console.log(`No active mobile update exists on ${mobile.updates.channel}.`);
+  else {
+    console.log(`${report.releaseId} is ${rolloutReport?.status.toUpperCase() ?? (report.paused ? "PAUSED" : "ACTIVE")} at ${Math.round(report.rollout * 100)}%: ${report.terminalReports} terminal reports, ${report.failures} failures (${(report.failureRate * 100).toFixed(1)}%).`);
+    if (rolloutReport)
+      console.log(`  Stage ${rolloutReport.currentStage + 1} entered ${rolloutReport.enteredAt}; advancement is ${rolloutReport.automatic ? "automatic" : "manual"}${rolloutReport.nextStage ? `, next ${Math.round(rolloutReport.nextStage.rollout * 100)}%` : ""}${rolloutReport.pausedBy ? `, paused by ${rolloutReport.pausedBy}` : ""}.`);
+    console.log(`  ${report.activated} activated, ${report.rolledBack} rolled back, ${report.quarantined} quarantined, ${report.downloaded} downloaded, ${report.downloadFailed} download failures.`);
+    console.log(`  Transfer: ${formatBytes(report.transfer.downloadedBytes)} downloaded, ${formatBytes(report.transfer.avoidedBytes)} avoided (${formatBytes(report.transfer.resumedBytes)} resumed, ${formatBytes(report.transfer.reusedBytes)} reused).`);
+  }
+  return report;
+};
+var MOBILE_UPDATE_ROLLOUT_ACTION_LABEL = {
+  advance: "Advanced",
+  cancel: "Cancelled",
+  pause: "Paused",
+  reconcile: "Reconciled",
+  resume: "Resumed"
+};
+var isMobileUpdateRolloutAction = (value) => value !== undefined && Object.hasOwn(MOBILE_UPDATE_ROLLOUT_ACTION_LABEL, value);
+var controlMobileUpdateRollout = async (action, args) => {
+  const startedAt = performance.now();
+  const { mobile } = await loadMobile(valueAfter(args, "--config"));
+  if (!mobile.updates || !mobile.updateServer?.rollout)
+    throw new TypeError(`mobile update ${action} requires mobile.updates.server.rollout config.`);
+  const { publisher } = await mobileUpdatePublisher(args);
+  const options = {
+    appId: mobile.appId,
+    channel: mobile.updates.channel,
+    publisher
+  };
+  const requestedRollout = valueAfter(args, "--rollout");
+  let report;
+  switch (action) {
+    case "advance":
+      report = await advanceAbsoluteMobileUpdateRollout({
+        ...options,
+        ...requestedRollout ? { rollout: updateRollout(args) } : {}
+      });
+      break;
+    case "cancel":
+      report = await cancelAbsoluteMobileUpdateRollout(options);
+      break;
+    case "pause":
+      report = await pauseAbsoluteMobileUpdateRollout(options);
+      break;
+    case "reconcile":
+      report = await reconcileAbsoluteMobileUpdateRollout(options);
+      break;
+    case "resume":
+      report = await resumeAbsoluteMobileUpdateRollout(options);
+  }
+  if (args.includes("--json"))
+    console.log(JSON.stringify(report, null, 2));
+  else if (!report)
+    console.log(`No active mobile update exists on ${mobile.updates.channel}.`);
+  else
+    console.log(`${MOBILE_UPDATE_ROLLOUT_ACTION_LABEL[action]} ${report.releaseId}: ${report.status.toUpperCase()} at ${Math.round(report.rollout * 100)}% (stage ${report.currentStage + 1}).`);
+  sendTelemetryEvent("mobile:update-rollout", {
+    action,
+    durationMs: Math.round(performance.now() - startedAt),
+    ...report ? {
+      automatic: report.automatic,
+      status: report.status
+    } : { status: "empty" }
+  });
+  return report;
+};
 var collectMobileUpdates = async (args) => {
   const startedAt = performance.now();
   const { mobile } = await loadMobile(valueAfter(args, "--config"));
@@ -24316,6 +24503,14 @@ var runMobile = async (args) => {
     await inspectMobileUpdateStorage(args.slice(2));
     return;
   }
+  if (command === "update" && args[1] === "status") {
+    await inspectMobileUpdateHealth(args.slice(2));
+    return;
+  }
+  if (command === "update" && isMobileUpdateRolloutAction(args[1])) {
+    await controlMobileUpdateRollout(args[1], args.slice(2));
+    return;
+  }
   if (command === "update" && args[1] === "gc") {
     await collectMobileUpdates(args.slice(2));
     return;
@@ -24328,7 +24523,7 @@ var runMobile = async (args) => {
     await publishIos(args.slice(2));
     return;
   }
-  throw new TypeError("Usage: absolute mobile <pair mac <name> <user@host> [--port n] [--workspace path] | remotes [inspect [name] [--json] | clean [name] --yes | --json] | unpair mac <name> | init [--no-native] [--force] | sync [ios|android] | inspect [--json] [--require-bundle] | associations [--outdir dir] [--verify] | ci github [server-entry] [--publish] [--registry module] [--secret-env NAME] [--output path] [--force] [--json] | doctor [ios|android|release [ios|android]] [--remote name] [--json|--fix [--yes]] | build <android|ios> [server-entry] [--remote name] [--outdir dir] [--web-outdir dir] [--unsigned] | update provision [--storage local|s3] [--registry module] [--force] [--yes] | update signing generate --private-key path [--certificate path] [--public-key path] [--key-id id] [--common-name name] [--validity-years n] | update build [server-entry] --classification bug-fix|content|security --key-id id --signing-key path --within-submitted-purpose [--outdir dir] [--web-outdir dir] | update publish <release-directory> [--rollout fraction] [--registry module] | update promote --release id --rollout fraction [--registry module] | update rollback [--release id] [--registry module] | update storage [--retain count] [--min-age-days days] [--registry module] [--json] | update gc [--retain count] [--min-age-days days] [--grace-days days] [--apply] [--registry module] [--json] | publish android [server-entry] [--registry module] [--channel name] [--play-track track] [--play-status completed|draft|halted|in-progress] [--play-rollout fraction] [--play-name name] [--play-notes language=text] [--play-update-priority 0..5] [--play-hold-review] [--play-cancel-existing-review] [--outdir dir] [--web-outdir dir] [--unsigned] | publish ios [server-entry] [--remote name] [--registry module] [--channel name] [--testflight-group name-or-id] [--testflight-notes locale=text] [--testflight-submit-review] [--outdir dir] [--web-outdir dir] [--unsigned] | test android [--route path] [--wait-for-hmr] [--report [dir]] [--timeout ms] [--port n] [--serial id] [--artifacts dir] [--json] | test ios [--device identifier [--remote name] | --udid id] [--wait-for-hmr] [--report [dir]] [--timeout ms] [--port n] [--artifacts dir] [--json]> [--config path]");
+  throw new TypeError("Usage: absolute mobile <pair mac <name> <user@host> [--port n] [--workspace path] | remotes [inspect [name] [--json] | clean [name] --yes | --json] | unpair mac <name> | init [--no-native] [--force] | sync [ios|android] | inspect [--json] [--require-bundle] | associations [--outdir dir] [--verify] | ci github [server-entry] [--publish] [--registry module] [--secret-env NAME] [--output path] [--force] [--json] | doctor [ios|android|release [ios|android]] [--remote name] [--json|--fix [--yes]] | build <android|ios> [server-entry] [--remote name] [--outdir dir] [--web-outdir dir] [--unsigned] | update provision [--storage local|s3] [--registry module] [--force] [--yes] | update signing generate --private-key path [--certificate path] [--public-key path] [--key-id id] [--common-name name] [--validity-years n] | update build [server-entry] --classification bug-fix|content|security --key-id id --signing-key path --within-submitted-purpose [--outdir dir] [--web-outdir dir] | update publish <release-directory> [--rollout fraction] [--registry module] | update promote --release id --rollout fraction [--registry module] | update rollback [--release id] [--registry module] | update status [--registry module] [--json] | update advance [--rollout fraction] [--registry module] [--json] | update pause|resume|cancel|reconcile [--registry module] [--json] | update storage [--retain count] [--min-age-days days] [--registry module] [--json] | update gc [--retain count] [--min-age-days days] [--grace-days days] [--apply] [--registry module] [--json] | publish android [server-entry] [--registry module] [--channel name] [--play-track track] [--play-status completed|draft|halted|in-progress] [--play-rollout fraction] [--play-name name] [--play-notes language=text] [--play-update-priority 0..5] [--play-hold-review] [--play-cancel-existing-review] [--outdir dir] [--web-outdir dir] [--unsigned] | publish ios [server-entry] [--remote name] [--registry module] [--channel name] [--testflight-group name-or-id] [--testflight-notes locale=text] [--testflight-submit-review] [--outdir dir] [--web-outdir dir] [--unsigned] | test android [--route path] [--wait-for-hmr] [--report [dir]] [--timeout ms] [--port n] [--serial id] [--artifacts dir] [--json]> [--config path]");
 };
 export {
   runMobile