@absolutejs/absolute 0.20.0-beta.85 → 0.20.0-beta.87

package/dist/index.js

@@ -10636,7 +10636,7 @@ __export(exports_config, {
 import { readFileSync as readFileSync11 } from "fs";
 import { resolve as resolve12 } from "path";
 import { createHash as createHash4, createPublicKey, X509Certificate } from "crypto";
-var APP_ID_PATTERN, SCHEME_PATTERN, APPLE_APP_ID_PREFIX_PATTERN, CERTIFICATE_FINGERPRINT_PATTERN, UPDATE_NAME_PATTERN, UPDATE_PUBLIC_KEY_PATTERN, ENVIRONMENT_NAME_PATTERN, DEFAULT_UPDATE_BOOT_TIMEOUT_MS = 20000, MINIMUM_UPDATE_BOOT_TIMEOUT_MS = 5000, MAXIMUM_UPDATE_BOOT_TIMEOUT_MS = 120000, HOSTNAME_PATTERN, EXPO_RESERVED_ROUTE_PREFIXES, resolveProjectPath = (projectRoot, value, field) => {
+var APP_ID_PATTERN, SCHEME_PATTERN, APPLE_APP_ID_PREFIX_PATTERN, CERTIFICATE_FINGERPRINT_PATTERN, UPDATE_NAME_PATTERN, UPDATE_PUBLIC_KEY_PATTERN, ENVIRONMENT_NAME_PATTERN, DEFAULT_UPDATE_BOOT_TIMEOUT_MS = 20000, DEFAULT_UPDATE_HEALTH_FAILURE_RATE = 0.2, DEFAULT_UPDATE_HEALTH_MINIMUM_REPORTS = 20, DEFAULT_UPDATE_ROLLOUT_FAILURE_RATE = 0.05, DEFAULT_UPDATE_ROLLOUT_OBSERVATION_MINUTES = 60, MINUTE_MS, DEFAULT_UPDATE_ROLLOUT_STAGES, MINIMUM_UPDATE_BOOT_TIMEOUT_MS = 5000, MAXIMUM_UPDATE_BOOT_TIMEOUT_MS = 120000, HOSTNAME_PATTERN, EXPO_RESERVED_ROUTE_PREFIXES, resolveProjectPath = (projectRoot, value, field) => {
   const root = resolve12(projectRoot);
   const path = resolve12(root, value);
   if (path !== root && !path.startsWith(`${root}/`)) {
@@ -10830,6 +10830,56 @@ var APP_ID_PATTERN, SCHEME_PATTERN, APPLE_APP_ID_PREFIX_PATTERN, CERTIFICATE_FIN
   if (!ENVIRONMENT_NAME_PATTERN.test(expoPrivateKeyEnv))
     throw new TypeError("mobile.updates.server.expoPrivateKeyEnv must be a valid environment variable name.");
   const autoMount = config.updates.server?.autoMount ?? true;
+  const configuredHealth = config.updates.server?.health;
+  let health;
+  if (configuredHealth !== false) {
+    const failureRate = configuredHealth?.failureRate ?? DEFAULT_UPDATE_HEALTH_FAILURE_RATE;
+    const minimumReports = configuredHealth?.minimumReports ?? DEFAULT_UPDATE_HEALTH_MINIMUM_REPORTS;
+    const secretEnv = requireText(configuredHealth?.secretEnv ?? "ABSOLUTE_MOBILE_UPDATE_HEALTH_SECRET", "mobile.updates.server.health.secretEnv");
+    if (!Number.isFinite(failureRate) || failureRate <= 0 || failureRate > 1)
+      throw new TypeError("mobile.updates.server.health.failureRate must be greater than 0 and at most 1.");
+    if (!Number.isSafeInteger(minimumReports) || minimumReports < 1)
+      throw new TypeError("mobile.updates.server.health.minimumReports must be a positive integer.");
+    if (!ENVIRONMENT_NAME_PATTERN.test(secretEnv))
+      throw new TypeError("mobile.updates.server.health.secretEnv must be a valid environment variable name.");
+    health = { failureRate, minimumReports, secretEnv };
+  }
+  const configuredRollout = config.updates.server?.rollout;
+  let rollout;
+  if (configuredRollout !== undefined && configuredRollout !== false) {
+    if (!health)
+      throw new TypeError("mobile.updates.server.rollout requires fleet health to be enabled.");
+    if (configuredRollout.automatic !== undefined && typeof configuredRollout.automatic !== "boolean")
+      throw new TypeError("mobile.updates.server.rollout.automatic must be boolean.");
+    const configuredStages = configuredRollout.stages ?? DEFAULT_UPDATE_ROLLOUT_STAGES;
+    const stages = configuredStages.map((stage, index) => {
+      const previousStage = configuredStages[index - 1];
+      const maximumFailureRate = stage.maximumFailureRate ?? DEFAULT_UPDATE_ROLLOUT_FAILURE_RATE;
+      const minimumReports = stage.minimumReports ?? DEFAULT_UPDATE_HEALTH_MINIMUM_REPORTS;
+      const observationMinutes = stage.observationMinutes ?? DEFAULT_UPDATE_ROLLOUT_OBSERVATION_MINUTES;
+      const observationMs = observationMinutes * MINUTE_MS;
+      if (!Number.isFinite(stage.rollout) || stage.rollout <= 0 || stage.rollout > 1 || previousStage !== undefined && stage.rollout <= previousStage.rollout)
+        throw new TypeError("mobile.updates.server.rollout stages must be strictly increasing fractions greater than 0 and at most 1.");
+      if (!Number.isFinite(maximumFailureRate) || maximumFailureRate < 0 || maximumFailureRate >= health.failureRate)
+        throw new TypeError("mobile.updates.server.rollout maximumFailureRate must be non-negative and lower than the fleet-health pause rate.");
+      if (!Number.isSafeInteger(minimumReports) || minimumReports < health.minimumReports)
+        throw new TypeError("mobile.updates.server.rollout minimumReports must be an integer at least as large as the fleet-health minimumReports.");
+      if (!Number.isFinite(observationMinutes) || observationMinutes < 0 || !Number.isSafeInteger(observationMs))
+        throw new TypeError("mobile.updates.server.rollout observationMinutes must produce a non-negative whole number of milliseconds.");
+      return {
+        maximumFailureRate,
+        minimumReports,
+        observationMs,
+        rollout: stage.rollout
+      };
+    });
+    if (stages.length === 0 || stages.at(-1)?.rollout !== 1)
+      throw new TypeError("mobile.updates.server.rollout stages must end at rollout 1.");
+    rollout = {
+      automatic: configuredRollout.automatic ?? false,
+      stages
+    };
+  }
   if (autoMount) {
     const manifest = new URL(updates.manifestUrl);
     if (manifest.origin !== productionOrigin)
@@ -10862,7 +10912,13 @@ var APP_ID_PATTERN, SCHEME_PATTERN, APPLE_APP_ID_PREFIX_PATTERN, CERTIFICATE_FIN
       throw new TypeError(`mobile.updates.server.expoCodeSigningKeys.${keyId} certificate is not currently valid.`);
     expoCodeSigningKeys[keyId] = { certificatePem, privateKeyEnv };
   }
-  return { autoMount, expoCodeSigningKeys, registryModule };
+  return {
+    autoMount,
+    expoCodeSigningKeys,
+    ...health ? { health } : {},
+    ...rollout ? { rollout } : {},
+    registryModule
+  };
 }, validateExpoNativeRouteSegment = (path, segment, index, count, parameters) => {
   if (segment === "*" && (index !== count - 1 || count === 1)) {
     throw new TypeError(`mobile.routes.native route ${path} must use * once, as the final segment after a static or parameterized prefix.`);
@@ -10954,6 +11010,12 @@ var init_config = __esm(() => {
   UPDATE_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
   UPDATE_PUBLIC_KEY_PATTERN = /^[A-Za-z0-9+/]+={0,2}$/u;
   ENVIRONMENT_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/u;
+  MINUTE_MS = 60 * 1000;
+  DEFAULT_UPDATE_ROLLOUT_STAGES = [
+    { minimumReports: 20, observationMinutes: 60, rollout: 0.05 },
+    { minimumReports: 100, observationMinutes: 360, rollout: 0.25 },
+    { minimumReports: 100, observationMinutes: 0, rollout: 1 }
+  ];
   HOSTNAME_PATTERN = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(?:\.(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?))*$/;
   EXPO_RESERVED_ROUTE_PREFIXES = new Set([
     "_expo",
@@ -12280,15 +12342,18 @@ __export(exports_mobileUpdate, {
 });
 import {
   createHash as createHash5,
+  createHmac,
   createPrivateKey,
   createPublicKey as createPublicKey2,
+  randomUUID,
   sign,
+  timingSafeEqual,
   verify,
   X509Certificate as X509Certificate2
 } from "crypto";
 import { readFile as readFile4, stat as stat2 } from "fs/promises";
 import path from "path";
-var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updates", MAX_FILE_BYTES, MAX_TOTAL_BYTES, DAY_MS, DEFAULT_MIN_AGE_MS, DEFAULT_GRACE_PERIOD_MS, DEFAULT_RETAIN_RECENT = 5, HASH, RELEASE, APP_ID, NAME, EXPO_DESCRIPTOR = "_absolute/expo-update.json", EXPO_CODE_SIGNING_ALGORITHM = "rsa-v1_5-sha256", MobileUpdateRegistryError, object3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), text2 = (value, field) => {
+var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updates", MAX_FILE_BYTES, MAX_TOTAL_BYTES, DAY_MS, DEFAULT_MIN_AGE_MS, DEFAULT_GRACE_PERIOD_MS, DEFAULT_RETAIN_RECENT = 5, HASH, RELEASE, APP_ID, NAME, EXPO_DESCRIPTOR = "_absolute/expo-update.json", EXPO_CODE_SIGNING_ALGORITHM = "rsa-v1_5-sha256", HEALTH_TOKEN_VERSION = 1, HEALTH_KINDS, FAILURE_HEALTH_KINDS, MobileUpdateRegistryError, object3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), text2 = (value, field) => {
   if (typeof value !== "string" || value.length === 0)
     throw new MobileUpdateRegistryError(`Mobile update ${field} is invalid`);
   return value;
@@ -12417,7 +12482,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
     throw new MobileUpdateRegistryError("Mobile update channel is invalid");
   const appId = text2(value.appId, "channel appId");
   const channel = text2(value.channel, "channel");
-  if (!APP_ID.test(appId) || !NAME.test(channel) || !iso(value.promotedAt) || typeof value.rollout !== "number" || value.rollout < 0 || value.rollout > 1 || value.releaseId !== undefined && (typeof value.releaseId !== "string" || !RELEASE.test(value.releaseId)) || value.fallbackReleaseId !== undefined && (typeof value.fallbackReleaseId !== "string" || !RELEASE.test(value.fallbackReleaseId)) || value.activationId !== undefined && (typeof value.activationId !== "string" || !HASH.test(value.activationId)) || value.activatedAt !== undefined && !iso(value.activatedAt) || value.activationId === undefined !== (value.activatedAt === undefined))
+  if (!APP_ID.test(appId) || !NAME.test(channel) || !iso(value.promotedAt) || typeof value.rollout !== "number" || value.rollout < 0 || value.rollout > 1 || value.releaseId !== undefined && (typeof value.releaseId !== "string" || !RELEASE.test(value.releaseId)) || value.fallbackReleaseId !== undefined && (typeof value.fallbackReleaseId !== "string" || !RELEASE.test(value.fallbackReleaseId)) || value.promotionId !== undefined && (typeof value.promotionId !== "string" || !HASH.test(value.promotionId)) || value.activationId !== undefined && (typeof value.activationId !== "string" || !HASH.test(value.activationId)) || value.activatedAt !== undefined && !iso(value.activatedAt) || value.activationId === undefined !== (value.activatedAt === undefined))
     throw new MobileUpdateRegistryError("Mobile update channel is invalid");
   return {
     ...value.activationId ? { activationId: value.activationId } : {},
@@ -12426,6 +12491,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
     channel,
     ...value.fallbackReleaseId ? { fallbackReleaseId: value.fallbackReleaseId } : {},
     format: MOBILE_UPDATE_REGISTRY_FORMAT,
+    ...value.promotionId ? { promotionId: value.promotionId } : {},
     promotedAt: value.promotedAt,
     ...value.releaseId ? { releaseId: value.releaseId } : {},
     rollout: value.rollout
@@ -12448,15 +12514,50 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
     return true;
   const value = createHash5("sha256").update(`${input.appId}\x00${input.channel}\x00${input.releaseId}\x00${input.installationId}`).digest().readUInt32BE(0);
   return value / 4294967296 < input.rollout;
+}, base64Url = (value) => Buffer.from(value).toString("base64url"), healthPromotionId = (channel) => channel.promotionId ?? digest(new TextEncoder().encode(`${channel.appId}\x00${channel.channel}\x00${channel.releaseId ?? "embedded"}\x00${channel.promotedAt}`)), finiteMetric = (value, field) => {
+  if (typeof value !== "number" || !Number.isFinite(value) || value < 0)
+    throw new MobileUpdateRegistryError(`Mobile update health ${field} is invalid`);
+  return value;
+}, parseHealthTransfer = (value) => {
+  if (value === undefined)
+    return;
+  if (!object3(value))
+    throw new MobileUpdateRegistryError("Mobile update health transfer is invalid");
+  return {
+    avoidedBytes: finiteMetric(value.avoidedBytes, "avoidedBytes"),
+    downloadedBytes: finiteMetric(value.downloadedBytes, "downloadedBytes"),
+    durationMs: finiteMetric(value.durationMs, "durationMs"),
+    resumedBytes: finiteMetric(value.resumedBytes, "resumedBytes"),
+    reusedBytes: finiteMetric(value.reusedBytes, "reusedBytes"),
+    throughputBytesPerSecond: finiteMetric(value.throughputBytesPerSecond, "throughputBytesPerSecond")
+  };
 }, createMobileUpdateRegistry = (options) => {
   const prefix = normalizedPrefix(options.prefix ?? DEFAULT_PREFIX);
   const clock = options.clock ?? (() => new Date);
+  const health = options.health;
+  const rollout = options.rollout;
+  if (health && health.secret.length < 32)
+    throw new MobileUpdateRegistryError("Mobile update health secret must contain at least 32 characters");
+  if (health && !options.store.list)
+    throw new MobileUpdateRegistryError("Mobile update health requires storage lifecycle listing");
+  if (rollout && (!health || !options.store.list))
+    throw new MobileUpdateRegistryError("Mobile update rollout orchestration requires fleet health and storage lifecycle listing");
+  if (rollout && (rollout.stages.length === 0 || rollout.stages.some((stage, index) => stage.rollout <= 0 || stage.rollout > 1 || !Number.isSafeInteger(stage.minimumReports) || stage.minimumReports < 1 || !Number.isSafeInteger(stage.observationMs) || stage.observationMs < 0 || stage.maximumFailureRate < 0 || stage.maximumFailureRate >= 1 || index > 0 && stage.rollout <= rollout.stages[index - 1].rollout)))
+    throw new MobileUpdateRegistryError("Mobile update rollout stages are invalid");
+  const minimumReports = health?.autoPause?.minimumReports ?? 20;
+  const failureThreshold = health?.autoPause?.failureRate ?? 0.2;
+  if (health && (!Number.isSafeInteger(minimumReports) || minimumReports < 1 || failureThreshold <= 0 || failureThreshold > 1))
+    throw new MobileUpdateRegistryError("Mobile update health auto-pause policy is invalid");
   const root = (appId) => `${prefix}/${appHash(appId)}`;
   const releaseRoot = (manifest) => `${root(manifest.appId)}/releases/${manifest.releaseId}`;
   const manifestKey = (manifest) => `${releaseRoot(manifest)}/update.json`;
   const fileKey = (manifest, file2) => `${releaseRoot(manifest)}/files/${file2.path}`;
   const contentBlobKey = (appId, sha256) => `${root(appId)}/blobs/${sha256}`;
   const tombstoneKey = (appId, releaseId) => `${root(appId)}/gc/${releaseId}.json`;
+  const healthRoot = (appId, promotionId, releaseId) => `${root(appId)}/health/${promotionId}/${releaseId}`;
+  const pauseKey = (appId, promotionId, releaseId) => `${healthRoot(appId, promotionId, releaseId)}/paused.json`;
+  const rolloutRoot = (appId, promotionId, releaseId) => `${healthRoot(appId, promotionId, releaseId)}/rollout`;
+  const rolloutPlanKey = (appId, promotionId, releaseId) => `${rolloutRoot(appId, promotionId, releaseId)}/plan.json`;
   const channelKey = (appId, channel) => {
     if (!APP_ID.test(appId) || !NAME.test(channel))
       throw new MobileUpdateRegistryError("Mobile update channel identity is invalid");
@@ -12485,18 +12586,128 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
       throw new MobileUpdateRegistryError("Stored mobile update channel identity changed");
     return value;
   };
+  const listPrefix = async (value) => {
+    const objects = [];
+    const cursors = new Set;
+    let cursor;
+    do {
+      const page = await options.store.list({
+        ...cursor ? { cursor } : {},
+        prefix: value
+      });
+      objects.push(...page.objects);
+      if (!page.truncated)
+        break;
+      if (!page.cursor || cursors.has(page.cursor))
+        throw new MobileUpdateRegistryError("Mobile update storage returned an invalid cursor");
+      cursors.add(page.cursor);
+      cursor = page.cursor;
+    } while (true);
+    return objects;
+  };
+  const readVerifiedObject = async (key, label) => {
+    const bytes = await options.store.get(key);
+    if (!bytes)
+      return null;
+    const head = await options.store.head(key);
+    if (!head || head.size !== bytes.byteLength || head.metadata?.sha256 !== digest(bytes))
+      throw new MobileUpdateRegistryError(`Stored mobile update ${label} integrity failed`);
+    return decode(bytes);
+  };
+  const parseRolloutPlan = (value, promotionId, releaseId) => {
+    if (!object3(value) || value.format !== 1 || value.promotionId !== promotionId || value.releaseId !== releaseId || typeof value.automatic !== "boolean" || !iso(value.createdAt) || !Array.isArray(value.stages))
+      throw new MobileUpdateRegistryError("Stored mobile update rollout plan is invalid");
+    const stages = value.stages.map((stage) => {
+      if (!object3(stage) || typeof stage.rollout !== "number" || typeof stage.maximumFailureRate !== "number" || !Number.isSafeInteger(stage.minimumReports) || !Number.isSafeInteger(stage.observationMs))
+        throw new MobileUpdateRegistryError("Stored mobile update rollout plan is invalid");
+      return {
+        maximumFailureRate: stage.maximumFailureRate,
+        minimumReports: stage.minimumReports,
+        observationMs: stage.observationMs,
+        rollout: stage.rollout
+      };
+    });
+    if (stages.length === 0 || stages.some((stage, index) => stage.rollout <= 0 || stage.rollout > 1 || stage.minimumReports < 1 || stage.observationMs < 0 || stage.maximumFailureRate < 0 || stage.maximumFailureRate >= 1 || index > 0 && stage.rollout <= stages[index - 1].rollout))
+      throw new MobileUpdateRegistryError("Stored mobile update rollout plan is invalid");
+    return {
+      automatic: value.automatic,
+      createdAt: value.createdAt,
+      format: 1,
+      promotionId,
+      releaseId,
+      stages
+    };
+  };
+  const initializeRollout = async (channel, signal) => {
+    if (!rollout || !channel.releaseId)
+      return;
+    if (!rollout.stages.some((stage) => stage.rollout === channel.rollout))
+      throw new MobileUpdateRegistryError("Mobile update promotion rollout must match a configured rollout stage");
+    const promotionId = healthPromotionId(channel);
+    const plan = {
+      automatic: rollout.automatic ?? false,
+      createdAt: channel.promotedAt,
+      format: 1,
+      promotionId,
+      releaseId: channel.releaseId,
+      stages: rollout.stages.map((stage) => ({ ...stage }))
+    };
+    const bytes = json(plan);
+    await options.store.put(rolloutPlanKey(channel.appId, promotionId, channel.releaseId), bytes, {
+      cacheControl: "no-store",
+      contentType: "application/json",
+      maxBytes: bytes.byteLength,
+      metadata: { releaseid: channel.releaseId, sha256: digest(bytes) },
+      signal
+    });
+  };
+  const signHealthToken = (payload) => {
+    if (!health)
+      return null;
+    const encoded = base64Url(JSON.stringify(payload));
+    const signature = createHmac("sha256", health.secret).update(encoded).digest("base64url");
+    return `${encoded}.${signature}`;
+  };
+  const verifyHealthToken = (token) => {
+    if (!health)
+      throw new MobileUpdateRegistryError("Mobile update health reporting is not configured");
+    const [encoded, provided, extra] = token.split(".");
+    if (!encoded || !provided || extra)
+      throw new MobileUpdateRegistryError("Mobile update health token is invalid");
+    const expected = createHmac("sha256", health.secret).update(encoded).digest();
+    let actual;
+    try {
+      actual = Buffer.from(provided, "base64url");
+    } catch {
+      actual = Buffer.alloc(0);
+    }
+    if (actual.byteLength !== expected.byteLength || !timingSafeEqual(actual, expected))
+      throw new MobileUpdateRegistryError("Mobile update health token is invalid");
+    let value;
+    try {
+      value = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
+    } catch {
+      throw new MobileUpdateRegistryError("Mobile update health token is invalid");
+    }
+    if (!object3(value) || value.format !== HEALTH_TOKEN_VERSION || typeof value.appId !== "string" || typeof value.channel !== "string" || typeof value.installationId !== "string" || typeof value.promotionId !== "string" || typeof value.releaseId !== "string" || typeof value.runtimeFingerprint !== "string")
+      throw new MobileUpdateRegistryError("Mobile update health token is invalid");
+    return value;
+  };
   const assertNotMarked = async (appId, releaseId) => {
     if (!APP_ID.test(appId) || !RELEASE.test(releaseId))
       throw new MobileUpdateRegistryError("Mobile update release identity is invalid");
     if (await options.store.head(tombstoneKey(appId, releaseId)))
       throw new MobileUpdateRegistryError("Mobile update release is marked for collection. Increase retention and apply garbage collection to restore it before promotion");
   };
-  const writeChannel = async (input, signal) => {
+  const writeChannel = async (input, signal, beforeWrite) => {
+    const promotedAt = clock().toISOString();
     const value = {
       ...input,
       format: MOBILE_UPDATE_REGISTRY_FORMAT,
-      promotedAt: clock().toISOString()
+      promotedAt,
+      promotionId: digest(new TextEncoder().encode(`${input.appId}\x00${input.channel}\x00${input.releaseId ?? "embedded"}\x00${promotedAt}\x00${randomUUID()}`))
     };
+    await beforeWrite?.(value);
     const bytes = json(value);
     await options.store.put(channelKey(value.appId, value.channel), bytes, {
       cacheControl: "no-cache",
@@ -12511,10 +12722,92 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
     });
     return value;
   };
+  const rolloutContext = async (channel) => {
+    if (!options.store.list || !channel.releaseId)
+      return null;
+    const promotionId = healthPromotionId(channel);
+    const storedPlan = await readVerifiedObject(rolloutPlanKey(channel.appId, promotionId, channel.releaseId), "rollout plan");
+    if (storedPlan === null)
+      return null;
+    const plan = parseRolloutPlan(storedPlan, promotionId, channel.releaseId);
+    const initialStage = plan.stages.findIndex((stage) => stage.rollout === channel.rollout);
+    if (initialStage < 0)
+      throw new MobileUpdateRegistryError("Stored mobile update rollout does not match its plan");
+    let currentStage = initialStage;
+    let enteredAt = plan.createdAt;
+    const advances = await listPrefix(`${rolloutRoot(channel.appId, promotionId, channel.releaseId)}/advances/`);
+    for (const item of advances) {
+      const value = await readVerifiedObject(item.key, "rollout advancement");
+      if (!object3(value) || value.format !== 1 || value.promotionId !== promotionId || value.releaseId !== channel.releaseId || !Number.isSafeInteger(value.stage) || Number(value.stage) < initialStage || Number(value.stage) >= plan.stages.length || value.rollout !== plan.stages[Number(value.stage)].rollout || !iso(value.createdAt) || typeof value.failureRate !== "number" || !Number.isSafeInteger(value.terminalReports))
+        throw new MobileUpdateRegistryError("Stored mobile update rollout advancement is invalid");
+      if (Number(value.stage) >= currentStage) {
+        currentStage = Number(value.stage);
+        enteredAt = value.createdAt;
+      }
+    }
+    const controls = await listPrefix(`${rolloutRoot(channel.appId, promotionId, channel.releaseId)}/controls/`);
+    const parsedControls = [];
+    for (const item of controls) {
+      const value = await readVerifiedObject(item.key, "rollout control");
+      if (!object3(value) || value.format !== 1 || value.promotionId !== promotionId || value.releaseId !== channel.releaseId || typeof value.id !== "string" || value.action !== "pause" && value.action !== "resume" && value.action !== "cancel" || !iso(value.createdAt) || value.resumedPauseIds !== undefined && (!Array.isArray(value.resumedPauseIds) || value.resumedPauseIds.some((id) => typeof id !== "string")))
+        throw new MobileUpdateRegistryError("Stored mobile update rollout control is invalid");
+      parsedControls.push(value);
+    }
+    const cancelled = parsedControls.some(({ action }) => action === "cancel");
+    const resumedPauseIds = new Set(parsedControls.flatMap((control) => control.resumedPauseIds ?? []));
+    const activePauseIds = parsedControls.filter(({ action, id }) => action === "pause" && !resumedPauseIds.has(id)).map(({ id }) => id);
+    const operatorPaused = activePauseIds.length > 0;
+    const fleetPaused = Boolean(await options.store.head(pauseKey(channel.appId, promotionId, channel.releaseId)));
+    return {
+      cancelled,
+      activePauseIds,
+      channel,
+      currentStage,
+      enteredAt,
+      fleetPaused,
+      operatorPaused,
+      plan,
+      promotionId,
+      rollout: plan.stages[currentStage].rollout
+    };
+  };
+  const writeRolloutControl = async (channel, action, signal) => {
+    const context = await rolloutContext(channel);
+    if (!context)
+      throw new MobileUpdateRegistryError("Mobile update rollout orchestration is not configured");
+    if (context.cancelled)
+      throw new MobileUpdateRegistryError("Mobile update rollout was already cancelled");
+    if (action === "resume" && context.fleetPaused)
+      throw new MobileUpdateRegistryError("A fleet-health pause requires an explicit re-promotion");
+    const releaseId = channel.releaseId;
+    if (!releaseId)
+      throw new MobileUpdateRegistryError("Mobile update channel does not have an active release");
+    const createdAt = clock().toISOString();
+    const id = randomUUID();
+    const event = {
+      action,
+      createdAt,
+      format: 1,
+      id,
+      promotionId: context.promotionId,
+      releaseId,
+      ...action === "resume" ? { resumedPauseIds: context.activePauseIds } : {}
+    };
+    const bytes = json(event);
+    await options.store.put(`${rolloutRoot(channel.appId, context.promotionId, releaseId)}/controls/${createdAt}-${id}-${action}.json`, bytes, {
+      cacheControl: "no-store",
+      contentType: "application/json",
+      maxBytes: bytes.byteLength,
+      metadata: { action, sha256: digest(bytes) },
+      signal
+    });
+  };
   const promoteUpdate = async (input) => {
     input.signal?.throwIfAborted();
     if (input.rollout <= 0 || input.rollout > 1)
       throw new MobileUpdateRegistryError("Mobile update rollout is invalid");
+    if (rollout && !rollout.stages.some((stage) => stage.rollout === input.rollout))
+      throw new MobileUpdateRegistryError("Mobile update promotion rollout must match a configured rollout stage");
     await assertNotMarked(input.appId, input.releaseId);
     const release = await readManifest(input.appId, input.releaseId);
     if (!release || release.manifest.channel !== input.channel)
@@ -12526,7 +12819,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
       ...existing?.releaseId && existing.releaseId !== input.releaseId ? { fallbackReleaseId: existing.releaseId } : existing?.fallbackReleaseId ? { fallbackReleaseId: existing.fallbackReleaseId } : {},
       releaseId: input.releaseId,
       rollout: input.rollout
-    }, input.signal);
+    }, input.signal, (channel) => initializeRollout(channel, input.signal));
     return {
       appId: input.appId,
       channel: input.channel,
@@ -12539,13 +12832,16 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
     const channel = await readChannel(input.appId, input.channel);
     if (!channel?.releaseId)
       return { status: "empty" };
-    const selected = rolloutMember({
+    const rolloutState = await rolloutContext(channel);
+    let selected = rolloutMember({
       appId: input.appId,
       channel: input.channel,
       installationId: input.installationId,
       releaseId: channel.releaseId,
-      rollout: channel.rollout
+      rollout: rolloutState?.rollout ?? channel.rollout
     }) ? channel.releaseId : channel.fallbackReleaseId;
+    if (selected === channel.releaseId && (rolloutState?.cancelled || rolloutState?.fleetPaused || rolloutState?.operatorPaused || health && await options.store.head(pauseKey(input.appId, healthPromotionId(channel), channel.releaseId))))
+      selected = channel.fallbackReleaseId;
     if (!selected)
       return { status: "empty" };
     const release = await readManifest(input.appId, selected);
@@ -12561,6 +12857,243 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
       status: "selected"
     };
   };
+  const issueUpdateHealthToken = async (input) => {
+    if (!health)
+      return null;
+    const channel = await readChannel(input.appId, input.channel);
+    if (!channel?.releaseId || channel.releaseId !== input.releaseId)
+      return null;
+    const resolution = await resolveUpdateState(input);
+    if (resolution.status !== "selected" || resolution.manifest.releaseId !== input.releaseId)
+      return null;
+    return signHealthToken({
+      appId: input.appId,
+      channel: input.channel,
+      format: HEALTH_TOKEN_VERSION,
+      installationId: input.installationId,
+      promotionId: healthPromotionId(channel),
+      releaseId: input.releaseId,
+      runtimeFingerprint: input.runtimeFingerprint
+    });
+  };
+  const inspectUpdateHealth = async (input) => {
+    if (!health)
+      throw new MobileUpdateRegistryError("Mobile update health reporting is not configured");
+    const channel = await readChannel(input.appId, input.channel);
+    const releaseId = input.releaseId ?? channel?.releaseId;
+    if (!channel || !releaseId || channel.releaseId !== releaseId)
+      return null;
+    const promotionId = healthPromotionId(channel);
+    const objects = await listPrefix(`${healthRoot(input.appId, promotionId, releaseId)}/events/`);
+    const installations = new Set;
+    const byKind = new Map([...HEALTH_KINDS].map((kind) => [
+      kind,
+      new Set
+    ]));
+    const transfer = {
+      avoidedBytes: 0,
+      downloadedBytes: 0,
+      durationMs: 0,
+      resumedBytes: 0,
+      reusedBytes: 0,
+      throughputBytesPerSecond: 0
+    };
+    for (const item of objects) {
+      const bytes = await options.store.get(item.key);
+      if (!bytes)
+        continue;
+      const head = await options.store.head(item.key);
+      if (!head || head.size !== bytes.byteLength || head.metadata?.sha256 !== digest(bytes))
+        throw new MobileUpdateRegistryError("Stored mobile update health evidence integrity failed");
+      const value = decode(bytes);
+      if (!object3(value) || typeof value.installationHash !== "string" || !HEALTH_KINDS.has(String(value.kind)))
+        throw new MobileUpdateRegistryError("Stored mobile update health evidence is invalid");
+      const kind = value.kind;
+      installations.add(value.installationHash);
+      byKind.get(kind).add(value.installationHash);
+      if (kind === "downloaded" && object3(value.transfer)) {
+        const parsed = parseHealthTransfer(value.transfer);
+        for (const key of Object.keys(transfer))
+          transfer[key] += parsed[key];
+      }
+    }
+    const failures = new Set([
+      ...byKind.get("quarantined"),
+      ...byKind.get("rolled-back")
+    ]);
+    const terminals = new Set([...byKind.get("activated"), ...failures]);
+    const failureRate = terminals.size === 0 ? 0 : failures.size / terminals.size;
+    const rolloutState = await rolloutContext(channel);
+    return {
+      activated: byKind.get("activated").size,
+      appId: input.appId,
+      channel: input.channel,
+      downloaded: byKind.get("downloaded").size,
+      downloadFailed: byKind.get("download-failed").size,
+      failureRate,
+      failures: failures.size,
+      paused: Boolean(rolloutState?.cancelled || rolloutState?.fleetPaused || rolloutState?.operatorPaused || await options.store.head(pauseKey(input.appId, promotionId, releaseId))),
+      promotionId,
+      quarantined: byKind.get("quarantined").size,
+      releaseId,
+      reportedInstallations: installations.size,
+      rolledBack: byKind.get("rolled-back").size,
+      rollout: rolloutState?.rollout ?? channel.rollout,
+      terminalReports: terminals.size,
+      transfer
+    };
+  };
+  const inspectUpdateRollout = async (input) => {
+    const channel = await readChannel(input.appId, input.channel);
+    if (!channel?.releaseId)
+      return null;
+    const context = await rolloutContext(channel);
+    if (!context)
+      throw new MobileUpdateRegistryError("Mobile update rollout orchestration is not configured");
+    const healthReport = await inspectUpdateHealth(input);
+    if (!healthReport)
+      return null;
+    const paused = context.fleetPaused || context.operatorPaused;
+    const complete = context.currentStage === context.plan.stages.length - 1;
+    return {
+      ...healthReport,
+      automatic: context.plan.automatic,
+      currentStage: context.currentStage,
+      enteredAt: context.enteredAt,
+      ...!complete ? { nextStage: context.plan.stages[context.currentStage + 1] } : {},
+      ...context.fleetPaused ? { pausedBy: "fleet-health" } : context.operatorPaused ? { pausedBy: "operator" } : {},
+      status: context.cancelled ? "cancelled" : paused ? "paused" : complete ? "complete" : "active"
+    };
+  };
+  const advanceRollout = async (input, strict) => {
+    input.signal?.throwIfAborted();
+    const channel = await readChannel(input.appId, input.channel);
+    if (!channel?.releaseId)
+      throw new MobileUpdateRegistryError("Mobile update channel does not have an active release");
+    const context = await rolloutContext(channel);
+    if (!context)
+      throw new MobileUpdateRegistryError("Mobile update rollout orchestration is not configured");
+    const report = await inspectUpdateRollout(input);
+    if (!report)
+      throw new MobileUpdateRegistryError("Mobile update rollout report is unavailable");
+    const nextStage = context.plan.stages[context.currentStage + 1];
+    if (!nextStage)
+      return report;
+    if (input.rollout !== undefined && input.rollout !== nextStage.rollout)
+      throw new MobileUpdateRegistryError("Mobile update rollout can advance only to the next configured stage");
+    if (report.status !== "active") {
+      if (strict)
+        throw new MobileUpdateRegistryError(`Mobile update rollout cannot advance while ${report.status}`);
+      return report;
+    }
+    const gate = context.plan.stages[context.currentStage];
+    const observedMs = clock().getTime() - Date.parse(context.enteredAt);
+    const blocked = report.terminalReports < gate.minimumReports || report.failureRate > gate.maximumFailureRate || observedMs < gate.observationMs;
+    if (blocked) {
+      if (strict)
+        throw new MobileUpdateRegistryError(`Mobile update rollout needs ${gate.minimumReports} terminal reports, at most ${(gate.maximumFailureRate * 100).toFixed(1)}% failures, and ${gate.observationMs}ms observation at the current stage`);
+      return report;
+    }
+    const stage = context.currentStage + 1;
+    const event = {
+      createdAt: clock().toISOString(),
+      failureRate: report.failureRate,
+      format: 1,
+      promotionId: context.promotionId,
+      releaseId: channel.releaseId,
+      rollout: nextStage.rollout,
+      stage,
+      terminalReports: report.terminalReports
+    };
+    const bytes = json(event);
+    await options.store.put(`${rolloutRoot(input.appId, context.promotionId, channel.releaseId)}/advances/${String(stage).padStart(4, "0")}.json`, bytes, {
+      cacheControl: "no-store",
+      contentType: "application/json",
+      maxBytes: bytes.byteLength,
+      metadata: { releaseid: channel.releaseId, sha256: digest(bytes) },
+      signal: input.signal
+    });
+    return await inspectUpdateRollout(input);
+  };
+  const advanceUpdateRollout = (input) => advanceRollout(input, true);
+  const reconcileUpdateRollout = async (input) => {
+    const report = await inspectUpdateRollout(input);
+    if (!report || !report.automatic)
+      return report;
+    return advanceRollout(input, false);
+  };
+  const rolloutControl = (action) => async (input) => {
+    input.signal?.throwIfAborted();
+    const channel = await readChannel(input.appId, input.channel);
+    if (!channel?.releaseId)
+      throw new MobileUpdateRegistryError("Mobile update channel does not have an active release");
+    await writeRolloutControl(channel, action, input.signal);
+    return await inspectUpdateRollout(input);
+  };
+  const pauseUpdateRollout = rolloutControl("pause");
+  const resumeUpdateRollout = rolloutControl("resume");
+  const cancelUpdateRollout = rolloutControl("cancel");
+  const recordUpdateHealth = async (input) => {
+    const payload = verifyHealthToken(input.token);
+    if (payload.appId !== input.appId || payload.channel !== input.channel || payload.installationId !== input.installationId || payload.releaseId !== input.releaseId || payload.runtimeFingerprint !== input.runtimeFingerprint || !HEALTH_KINDS.has(input.kind) || input.reason !== undefined && input.reason !== "boot-interrupted" && input.reason !== "boot-timeout")
+      throw new MobileUpdateRegistryError("Mobile update health evidence does not match its token");
+    const release = await readManifest(input.appId, input.releaseId);
+    if (!release || release.manifest.runtimeFingerprint !== input.runtimeFingerprint)
+      throw new MobileUpdateRegistryError("Mobile update health release is invalid");
+    const activeChannel = await readChannel(input.appId, input.channel);
+    if (!activeChannel || activeChannel.releaseId !== input.releaseId || healthPromotionId(activeChannel) !== payload.promotionId)
+      throw new MobileUpdateRegistryError("Mobile update health promotion is no longer active");
+    const transfer = parseHealthTransfer(input.transfer);
+    const installationHash = createHmac("sha256", health.secret).update(input.installationId).digest("hex");
+    const evidence = {
+      format: 1,
+      installationHash,
+      kind: input.kind,
+      observedAt: clock().toISOString(),
+      ...input.reason ? { reason: input.reason } : {},
+      ...transfer ? { transfer } : {}
+    };
+    const bytes = json(evidence);
+    await options.store.put(`${healthRoot(input.appId, payload.promotionId, input.releaseId)}/events/${installationHash}/${input.kind}.json`, bytes, {
+      cacheControl: "no-store",
+      contentType: "application/json",
+      maxBytes: bytes.byteLength,
+      metadata: { kind: input.kind, sha256: digest(bytes) }
+    });
+    let report = await inspectUpdateHealth({
+      appId: input.appId,
+      channel: input.channel,
+      releaseId: input.releaseId
+    });
+    if (!report)
+      throw new MobileUpdateRegistryError("Mobile update health promotion is no longer active");
+    if (FAILURE_HEALTH_KINDS.has(input.kind) && report.terminalReports >= minimumReports && report.failureRate >= failureThreshold && !report.paused) {
+      const marker = json({
+        appId: input.appId,
+        channel: input.channel,
+        failureRate: report.failureRate,
+        failures: report.failures,
+        format: 1,
+        pausedAt: clock().toISOString(),
+        promotionId: payload.promotionId,
+        releaseId: input.releaseId,
+        reports: report.terminalReports
+      });
+      await options.store.put(pauseKey(input.appId, payload.promotionId, input.releaseId), marker, {
+        cacheControl: "no-store",
+        contentType: "application/json",
+        maxBytes: marker.byteLength,
+        metadata: { releaseid: input.releaseId, sha256: digest(marker) }
+      });
+      report = { ...report, paused: true };
+    }
+    if (rollout && (input.kind === "activated" || FAILURE_HEALTH_KINDS.has(input.kind)))
+      return await reconcileUpdateRollout({
+        appId: input.appId,
+        channel: input.channel
+      }) ?? report;
+    return report;
+  };
   const retentionValues = (input) => {
     if (!APP_ID.test(input.appId))
       throw new MobileUpdateRegistryError("Mobile update appId is invalid");
@@ -12803,6 +13336,15 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
     return result;
   };
   return {
+    ...health ? { inspectUpdateHealth, issueUpdateHealthToken, recordUpdateHealth } : {},
+    ...rollout ? {
+      advanceUpdateRollout,
+      cancelUpdateRollout,
+      inspectUpdateRollout,
+      pauseUpdateRollout,
+      reconcileUpdateRollout,
+      resumeUpdateRollout
+    } : {},
     inspectUpdateStorage: async (input) => (await inventory(input)).report,
     pruneUpdates,
     publishUpdate: async (input) => {
@@ -13080,7 +13622,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
     const origin = request.headers.get("origin");
     const cors = origin && allowedOrigins.has(origin) ? {
       "access-control-allow-origin": origin,
-      "access-control-expose-headers": "content-range,etag",
+      "access-control-expose-headers": "content-range,etag,x-absolute-mobile-health-token",
       vary: "Origin"
     } : {};
     if (request.method === "OPTIONS") {
@@ -13089,17 +13631,58 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
       return new Response(null, {
         headers: {
           ...cors,
-          "access-control-allow-headers": "if-range,range,x-absolute-mobile-app,x-absolute-mobile-channel,x-absolute-mobile-installation,x-absolute-mobile-release,x-absolute-mobile-runtime",
-          "access-control-allow-methods": "GET,OPTIONS",
+          "access-control-allow-headers": "content-type,if-range,range,x-absolute-mobile-app,x-absolute-mobile-channel,x-absolute-mobile-health-token,x-absolute-mobile-installation,x-absolute-mobile-release,x-absolute-mobile-runtime",
+          "access-control-allow-methods": "GET,POST,OPTIONS",
           "access-control-max-age": "600"
         },
         status: 204
       });
     }
-    if (request.method !== "GET")
-      return new Response(null, { status: 405 });
     const pathname = new URL(request.url).pathname.replace(/^\/+/, "");
     const relative7 = pathname.startsWith(`${route}/`) ? pathname.slice(route.length + 1) : "";
+    if (request.method === "POST" && relative7 === "health") {
+      if (!options.registry.recordUpdateHealth)
+        return new Response(null, { status: 404 });
+      const appId = request.headers.get("x-absolute-mobile-app");
+      const channel = request.headers.get("x-absolute-mobile-channel");
+      const installationId = request.headers.get("x-absolute-mobile-installation");
+      const runtimeFingerprint = request.headers.get("x-absolute-mobile-runtime");
+      const token = request.headers.get("x-absolute-mobile-health-token");
+      const declared = Number(request.headers.get("content-length"));
+      if (appId !== options.appId || channel !== options.channel || !installationId || !runtimeFingerprint || !token || Number.isFinite(declared) && declared > 4096)
+        return new Response(null, { status: 400 });
+      const bodyBytes = new Uint8Array(await request.arrayBuffer());
+      if (bodyBytes.byteLength > 4096)
+        return new Response(null, { status: 413 });
+      let body;
+      try {
+        body = JSON.parse(new TextDecoder().decode(bodyBytes));
+      } catch {
+        return new Response(null, { status: 400 });
+      }
+      if (!object3(body) || typeof body.releaseId !== "string" || typeof body.kind !== "string")
+        return new Response(null, { status: 400 });
+      try {
+        const report = await options.registry.recordUpdateHealth({
+          appId,
+          channel,
+          installationId,
+          kind: body.kind,
+          ...body.reason === "boot-interrupted" || body.reason === "boot-timeout" ? { reason: body.reason } : {},
+          releaseId: body.releaseId,
+          runtimeFingerprint,
+          token,
+          ...object3(body.transfer) ? { transfer: body.transfer } : {}
+        });
+        return Response.json({ paused: report.paused }, { headers: { ...cors, "cache-control": "no-store" }, status: 202 });
+      } catch (error) {
+        if (error instanceof MobileUpdateRegistryError)
+          return new Response(null, { status: 403 });
+        throw error;
+      }
+    }
+    if (request.method !== "GET")
+      return new Response(null, { status: 405 });
     if (relative7 === "update.json") {
       const expoProtocolVersion = request.headers.get("expo-protocol-version");
       const expoProtocol = expoProtocolVersion !== null;
@@ -13125,6 +13708,13 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
         installationId,
         runtimeFingerprint
       });
+      const healthToken = selected && options.registry.issueUpdateHealthToken ? await options.registry.issueUpdateHealthToken({
+        appId,
+        channel,
+        installationId,
+        releaseId: selected.manifest.releaseId,
+        runtimeFingerprint
+      }) : null;
       if (expoProtocol) {
         let requestedCodeSigning;
         try {
@@ -13176,6 +13766,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
           extra: {
             absolutejs: {
               channel: selected.manifest.channel,
+              ...healthToken ? { healthToken } : {},
               releaseId: selected.manifest.releaseId
             },
             expoClient: descriptor.expoConfig
@@ -13203,7 +13794,8 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
         headers: {
           ...cors,
           "cache-control": "no-store",
-          etag: `"${selected.manifest.releaseId}"`
+          etag: `"${selected.manifest.releaseId}"`,
+          ...healthToken ? { "x-absolute-mobile-health-token": healthToken } : {}
         }
       });
     }
@@ -13266,6 +13858,14 @@ var init_mobileUpdate = __esm(() => {
   RELEASE = /^amu_[a-f0-9]{64}$/;
   APP_ID = /^[A-Za-z][\w]*(?:\.[A-Za-z][\w]*)+$/;
   NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+  HEALTH_KINDS = new Set([
+    "activated",
+    "downloaded",
+    "download-failed",
+    "quarantined",
+    "rolled-back"
+  ]);
+  FAILURE_HEALTH_KINDS = new Set(["quarantined", "rolled-back"]);
   MobileUpdateRegistryError = class MobileUpdateRegistryError extends Error {
   };
   expoProtocolHeaders = {
@@ -13353,6 +13953,16 @@ var ABSOLUTE_MOBILE_UPDATE_SERVER_FORMAT = 1, DEFAULT_MOBILE_UPDATE_REGISTRY_MOD
   } catch (error) {
     throw new TypeError(`Durable mobile update storage verification failed for ${module.metadata.provider}. Check the bucket, endpoint, credentials, and read/write/delete permissions.`, { cause: error });
   }
+}, verifyHealthModule = (config, module) => {
+  if (!config.updateServer?.health)
+    return;
+  if (typeof module.registry.inspectUpdateHealth !== "function" || typeof module.registry.issueUpdateHealthToken !== "function" || typeof module.registry.recordUpdateHealth !== "function")
+    throw new TypeError("Mobile update fleet health is enabled but the registry is not provisioned for it. Run `absolute mobile update provision --force`.");
+}, verifyRolloutModule = (config, module) => {
+  if (!config.updateServer?.rollout)
+    return;
+  if (typeof module.registry.advanceUpdateRollout !== "function" || typeof module.registry.cancelUpdateRollout !== "function" || typeof module.registry.inspectUpdateRollout !== "function" || typeof module.registry.pauseUpdateRollout !== "function" || typeof module.registry.reconcileUpdateRollout !== "function" || typeof module.registry.resumeUpdateRollout !== "function")
+    throw new TypeError("Mobile update rollout orchestration is enabled but the registry is not provisioned for it. Run `absolute mobile update provision --force`.");
 }, expoSigningOptions = (config) => {
   if (!config.updates?.expoCodeSigning)
     return;
@@ -13384,8 +13994,11 @@ var ABSOLUTE_MOBILE_UPDATE_SERVER_FORMAT = 1, DEFAULT_MOBILE_UPDATE_REGISTRY_MOD
   if (!updates || !server?.autoMount)
     return new Elysia4({ name: "absolutejs-mobile-updates-disabled" });
   const module = await loadAbsoluteMobileUpdateServerModule(projectRoot, server.registryModule);
-  if (options.production)
+  if (options.production) {
     await verifyDurableModule(module);
+    verifyHealthModule(config, module);
+    verifyRolloutModule(config, module);
+  }
   const manifest = new URL(updates.manifestUrl);
   if (!manifest.pathname.endsWith("/update.json"))
     throw new TypeError("Auto-mounted mobile update manifests must end in /update.json.");
@@ -13404,10 +14017,12 @@ var ABSOLUTE_MOBILE_UPDATE_SERVER_FORMAT = 1, DEFAULT_MOBILE_UPDATE_REGISTRY_MOD
     return;
   const module = await loadAbsoluteMobileUpdateServerModule(projectRoot, config.updateServer?.registryModule);
   await verifyDurableModule(module);
+  verifyHealthModule(config, module);
+  verifyRolloutModule(config, module);
   if (config.engine === "expo")
     expoSigningOptions(config);
   return module.metadata;
-}, publicKeysSource = (publicKeys) => JSON.stringify(publicKeys, null, "\t"), renderAbsoluteMobileUpdateRegistry = (options) => {
+}, publicKeysSource = (publicKeys) => JSON.stringify(publicKeys, null, "\t"), renderAbsoluteMobileUpdateRegistryBase = (options) => {
   const metadata2 = `export const absoluteMobileUpdateServer = {
 	format: 1,
 	provider: '${options.storage}',
@@ -13473,6 +14088,27 @@ export default createMobileUpdateRegistry({
 	store
 });
 `;
+}, renderAbsoluteMobileUpdateRegistry = (options) => {
+  const source = renderAbsoluteMobileUpdateRegistryBase(options);
+  let generated = "";
+  if (options.health) {
+    const secret = options.storage === "local" ? `process.env.${options.health.secretEnv} ?? 'absolutejs-local-health-secret-not-for-production'` : `required('${options.health.secretEnv}')`;
+    generated += `	health: {
+		autoPause: { failureRate: ${options.health.failureRate}, minimumReports: ${options.health.minimumReports} },
+		secret: ${secret}
+	},
+`;
+  }
+  if (options.rollout)
+    generated += `	rollout: ${JSON.stringify(options.rollout, null, "\t").replaceAll(`
+`, `
+	`)},
+`;
+  if (!generated)
+    return source;
+  return source.replace(`export default createMobileUpdateRegistry({
+`, `export default createMobileUpdateRegistry({
+${generated}`);
 }, writeAbsoluteMobileUpdateRegistry = async (options) => {
   const path2 = projectPath(options.projectRoot, options.modulePath ?? DEFAULT_MOBILE_UPDATE_REGISTRY_MODULE);
   if (!options.force) {
@@ -13484,6 +14120,8 @@ export default createMobileUpdateRegistry({
   }
   await mkdir6(dirname12(path2), { recursive: true });
   await Bun.write(path2, renderAbsoluteMobileUpdateRegistry({
+    ...options.health ? { health: options.health } : {},
+    ...options.rollout ? { rollout: options.rollout } : {},
     publicKeys: options.publicKeys,
     storage: options.storage
   }));
@@ -44896,5 +45534,5 @@ export {
   wrapPageHandlerWithStreamingSlots
 };
 
-//# debugId=99E9CBD68908A78B64756E2164756E21
+//# debugId=95E12D596BC2404464756E2164756E21
 //# sourceMappingURL=index.js.map