@absolutejs/absolute 0.20.0-beta.85 → 0.20.0-beta.87

package/dist/mobile/index.js

@@ -604,7 +604,7 @@ __export(exports_config, {
 import { readFileSync as readFileSync2 } from "fs";
 import { resolve as resolve6 } from "path";
 import { createHash as createHash8, createPublicKey, X509Certificate as X509Certificate2 } from "crypto";
-var APP_ID_PATTERN, SCHEME_PATTERN, APPLE_APP_ID_PREFIX_PATTERN, CERTIFICATE_FINGERPRINT_PATTERN, UPDATE_NAME_PATTERN, UPDATE_PUBLIC_KEY_PATTERN, ENVIRONMENT_NAME_PATTERN, DEFAULT_UPDATE_BOOT_TIMEOUT_MS = 20000, MINIMUM_UPDATE_BOOT_TIMEOUT_MS = 5000, MAXIMUM_UPDATE_BOOT_TIMEOUT_MS = 120000, HOSTNAME_PATTERN, EXPO_RESERVED_ROUTE_PREFIXES, resolveProjectPath = (projectRoot, value, field2) => {
+var APP_ID_PATTERN, SCHEME_PATTERN, APPLE_APP_ID_PREFIX_PATTERN, CERTIFICATE_FINGERPRINT_PATTERN, UPDATE_NAME_PATTERN, UPDATE_PUBLIC_KEY_PATTERN, ENVIRONMENT_NAME_PATTERN, DEFAULT_UPDATE_BOOT_TIMEOUT_MS = 20000, DEFAULT_UPDATE_HEALTH_FAILURE_RATE = 0.2, DEFAULT_UPDATE_HEALTH_MINIMUM_REPORTS = 20, DEFAULT_UPDATE_ROLLOUT_FAILURE_RATE = 0.05, DEFAULT_UPDATE_ROLLOUT_OBSERVATION_MINUTES = 60, MINUTE_MS, DEFAULT_UPDATE_ROLLOUT_STAGES, MINIMUM_UPDATE_BOOT_TIMEOUT_MS = 5000, MAXIMUM_UPDATE_BOOT_TIMEOUT_MS = 120000, HOSTNAME_PATTERN, EXPO_RESERVED_ROUTE_PREFIXES, resolveProjectPath = (projectRoot, value, field2) => {
   const root = resolve6(projectRoot);
   const path = resolve6(root, value);
   if (path !== root && !path.startsWith(`${root}/`)) {
@@ -798,6 +798,56 @@ var APP_ID_PATTERN, SCHEME_PATTERN, APPLE_APP_ID_PREFIX_PATTERN, CERTIFICATE_FIN
   if (!ENVIRONMENT_NAME_PATTERN.test(expoPrivateKeyEnv))
     throw new TypeError("mobile.updates.server.expoPrivateKeyEnv must be a valid environment variable name.");
   const autoMount = config.updates.server?.autoMount ?? true;
+  const configuredHealth = config.updates.server?.health;
+  let health;
+  if (configuredHealth !== false) {
+    const failureRate = configuredHealth?.failureRate ?? DEFAULT_UPDATE_HEALTH_FAILURE_RATE;
+    const minimumReports = configuredHealth?.minimumReports ?? DEFAULT_UPDATE_HEALTH_MINIMUM_REPORTS;
+    const secretEnv = requireText(configuredHealth?.secretEnv ?? "ABSOLUTE_MOBILE_UPDATE_HEALTH_SECRET", "mobile.updates.server.health.secretEnv");
+    if (!Number.isFinite(failureRate) || failureRate <= 0 || failureRate > 1)
+      throw new TypeError("mobile.updates.server.health.failureRate must be greater than 0 and at most 1.");
+    if (!Number.isSafeInteger(minimumReports) || minimumReports < 1)
+      throw new TypeError("mobile.updates.server.health.minimumReports must be a positive integer.");
+    if (!ENVIRONMENT_NAME_PATTERN.test(secretEnv))
+      throw new TypeError("mobile.updates.server.health.secretEnv must be a valid environment variable name.");
+    health = { failureRate, minimumReports, secretEnv };
+  }
+  const configuredRollout = config.updates.server?.rollout;
+  let rollout;
+  if (configuredRollout !== undefined && configuredRollout !== false) {
+    if (!health)
+      throw new TypeError("mobile.updates.server.rollout requires fleet health to be enabled.");
+    if (configuredRollout.automatic !== undefined && typeof configuredRollout.automatic !== "boolean")
+      throw new TypeError("mobile.updates.server.rollout.automatic must be boolean.");
+    const configuredStages = configuredRollout.stages ?? DEFAULT_UPDATE_ROLLOUT_STAGES;
+    const stages = configuredStages.map((stage, index) => {
+      const previousStage = configuredStages[index - 1];
+      const maximumFailureRate = stage.maximumFailureRate ?? DEFAULT_UPDATE_ROLLOUT_FAILURE_RATE;
+      const minimumReports = stage.minimumReports ?? DEFAULT_UPDATE_HEALTH_MINIMUM_REPORTS;
+      const observationMinutes = stage.observationMinutes ?? DEFAULT_UPDATE_ROLLOUT_OBSERVATION_MINUTES;
+      const observationMs = observationMinutes * MINUTE_MS;
+      if (!Number.isFinite(stage.rollout) || stage.rollout <= 0 || stage.rollout > 1 || previousStage !== undefined && stage.rollout <= previousStage.rollout)
+        throw new TypeError("mobile.updates.server.rollout stages must be strictly increasing fractions greater than 0 and at most 1.");
+      if (!Number.isFinite(maximumFailureRate) || maximumFailureRate < 0 || maximumFailureRate >= health.failureRate)
+        throw new TypeError("mobile.updates.server.rollout maximumFailureRate must be non-negative and lower than the fleet-health pause rate.");
+      if (!Number.isSafeInteger(minimumReports) || minimumReports < health.minimumReports)
+        throw new TypeError("mobile.updates.server.rollout minimumReports must be an integer at least as large as the fleet-health minimumReports.");
+      if (!Number.isFinite(observationMinutes) || observationMinutes < 0 || !Number.isSafeInteger(observationMs))
+        throw new TypeError("mobile.updates.server.rollout observationMinutes must produce a non-negative whole number of milliseconds.");
+      return {
+        maximumFailureRate,
+        minimumReports,
+        observationMs,
+        rollout: stage.rollout
+      };
+    });
+    if (stages.length === 0 || stages.at(-1)?.rollout !== 1)
+      throw new TypeError("mobile.updates.server.rollout stages must end at rollout 1.");
+    rollout = {
+      automatic: configuredRollout.automatic ?? false,
+      stages
+    };
+  }
   if (autoMount) {
     const manifest = new URL(updates.manifestUrl);
     if (manifest.origin !== productionOrigin)
@@ -830,7 +880,13 @@ var APP_ID_PATTERN, SCHEME_PATTERN, APPLE_APP_ID_PREFIX_PATTERN, CERTIFICATE_FIN
       throw new TypeError(`mobile.updates.server.expoCodeSigningKeys.${keyId} certificate is not currently valid.`);
     expoCodeSigningKeys[keyId] = { certificatePem, privateKeyEnv };
   }
-  return { autoMount, expoCodeSigningKeys, registryModule };
+  return {
+    autoMount,
+    expoCodeSigningKeys,
+    ...health ? { health } : {},
+    ...rollout ? { rollout } : {},
+    registryModule
+  };
 }, validateExpoNativeRouteSegment = (path, segment, index, count, parameters) => {
   if (segment === "*" && (index !== count - 1 || count === 1)) {
     throw new TypeError(`mobile.routes.native route ${path} must use * once, as the final segment after a static or parameterized prefix.`);
@@ -922,6 +978,12 @@ var init_config = __esm(() => {
   UPDATE_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
   UPDATE_PUBLIC_KEY_PATTERN = /^[A-Za-z0-9+/]+={0,2}$/u;
   ENVIRONMENT_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/u;
+  MINUTE_MS = 60 * 1000;
+  DEFAULT_UPDATE_ROLLOUT_STAGES = [
+    { minimumReports: 20, observationMinutes: 60, rollout: 0.05 },
+    { minimumReports: 100, observationMinutes: 360, rollout: 0.25 },
+    { minimumReports: 100, observationMinutes: 0, rollout: 1 }
+  ];
   HOSTNAME_PATTERN = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(?:\.(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?))*$/;
   EXPO_RESERVED_ROUTE_PREFIXES = new Set([
     "_expo",
@@ -19962,15 +20024,18 @@ __export(exports_mobileUpdate, {
 });
 import {
   createHash as createHash15,
+  createHmac,
   createPrivateKey,
   createPublicKey as createPublicKey2,
+  randomUUID as randomUUID5,
   sign as sign2,
+  timingSafeEqual,
   verify as verify2,
   X509Certificate as X509Certificate3
 } from "crypto";
 import { readFile as readFile23, stat as stat5 } from "fs/promises";
 import path from "path";
-var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updates", MAX_FILE_BYTES, MAX_TOTAL_BYTES, DAY_MS, DEFAULT_MIN_AGE_MS, DEFAULT_GRACE_PERIOD_MS, DEFAULT_RETAIN_RECENT = 5, HASH, RELEASE, APP_ID, NAME, EXPO_DESCRIPTOR = "_absolute/expo-update.json", EXPO_CODE_SIGNING_ALGORITHM = "rsa-v1_5-sha256", MobileUpdateRegistryError, object6 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), text2 = (value, field2) => {
+var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updates", MAX_FILE_BYTES, MAX_TOTAL_BYTES, DAY_MS, DEFAULT_MIN_AGE_MS, DEFAULT_GRACE_PERIOD_MS, DEFAULT_RETAIN_RECENT = 5, HASH, RELEASE, APP_ID, NAME, EXPO_DESCRIPTOR = "_absolute/expo-update.json", EXPO_CODE_SIGNING_ALGORITHM = "rsa-v1_5-sha256", HEALTH_TOKEN_VERSION = 1, HEALTH_KINDS, FAILURE_HEALTH_KINDS, MobileUpdateRegistryError, object6 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), text2 = (value, field2) => {
   if (typeof value !== "string" || value.length === 0)
     throw new MobileUpdateRegistryError(`Mobile update ${field2} is invalid`);
   return value;
@@ -20099,7 +20164,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
     throw new MobileUpdateRegistryError("Mobile update channel is invalid");
   const appId = text2(value.appId, "channel appId");
   const channel = text2(value.channel, "channel");
-  if (!APP_ID.test(appId) || !NAME.test(channel) || !iso(value.promotedAt) || typeof value.rollout !== "number" || value.rollout < 0 || value.rollout > 1 || value.releaseId !== undefined && (typeof value.releaseId !== "string" || !RELEASE.test(value.releaseId)) || value.fallbackReleaseId !== undefined && (typeof value.fallbackReleaseId !== "string" || !RELEASE.test(value.fallbackReleaseId)) || value.activationId !== undefined && (typeof value.activationId !== "string" || !HASH.test(value.activationId)) || value.activatedAt !== undefined && !iso(value.activatedAt) || value.activationId === undefined !== (value.activatedAt === undefined))
+  if (!APP_ID.test(appId) || !NAME.test(channel) || !iso(value.promotedAt) || typeof value.rollout !== "number" || value.rollout < 0 || value.rollout > 1 || value.releaseId !== undefined && (typeof value.releaseId !== "string" || !RELEASE.test(value.releaseId)) || value.fallbackReleaseId !== undefined && (typeof value.fallbackReleaseId !== "string" || !RELEASE.test(value.fallbackReleaseId)) || value.promotionId !== undefined && (typeof value.promotionId !== "string" || !HASH.test(value.promotionId)) || value.activationId !== undefined && (typeof value.activationId !== "string" || !HASH.test(value.activationId)) || value.activatedAt !== undefined && !iso(value.activatedAt) || value.activationId === undefined !== (value.activatedAt === undefined))
     throw new MobileUpdateRegistryError("Mobile update channel is invalid");
   return {
     ...value.activationId ? { activationId: value.activationId } : {},
@@ -20108,6 +20173,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
     channel,
     ...value.fallbackReleaseId ? { fallbackReleaseId: value.fallbackReleaseId } : {},
     format: MOBILE_UPDATE_REGISTRY_FORMAT,
+    ...value.promotionId ? { promotionId: value.promotionId } : {},
     promotedAt: value.promotedAt,
     ...value.releaseId ? { releaseId: value.releaseId } : {},
     rollout: value.rollout
@@ -20130,15 +20196,50 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
     return true;
   const value = createHash15("sha256").update(`${input.appId}\x00${input.channel}\x00${input.releaseId}\x00${input.installationId}`).digest().readUInt32BE(0);
   return value / 4294967296 < input.rollout;
+}, base64Url = (value) => Buffer.from(value).toString("base64url"), healthPromotionId = (channel) => channel.promotionId ?? digest(new TextEncoder().encode(`${channel.appId}\x00${channel.channel}\x00${channel.releaseId ?? "embedded"}\x00${channel.promotedAt}`)), finiteMetric = (value, field2) => {
+  if (typeof value !== "number" || !Number.isFinite(value) || value < 0)
+    throw new MobileUpdateRegistryError(`Mobile update health ${field2} is invalid`);
+  return value;
+}, parseHealthTransfer = (value) => {
+  if (value === undefined)
+    return;
+  if (!object6(value))
+    throw new MobileUpdateRegistryError("Mobile update health transfer is invalid");
+  return {
+    avoidedBytes: finiteMetric(value.avoidedBytes, "avoidedBytes"),
+    downloadedBytes: finiteMetric(value.downloadedBytes, "downloadedBytes"),
+    durationMs: finiteMetric(value.durationMs, "durationMs"),
+    resumedBytes: finiteMetric(value.resumedBytes, "resumedBytes"),
+    reusedBytes: finiteMetric(value.reusedBytes, "reusedBytes"),
+    throughputBytesPerSecond: finiteMetric(value.throughputBytesPerSecond, "throughputBytesPerSecond")
+  };
 }, createMobileUpdateRegistry = (options) => {
   const prefix = normalizedPrefix(options.prefix ?? DEFAULT_PREFIX);
   const clock = options.clock ?? (() => new Date);
+  const health = options.health;
+  const rollout = options.rollout;
+  if (health && health.secret.length < 32)
+    throw new MobileUpdateRegistryError("Mobile update health secret must contain at least 32 characters");
+  if (health && !options.store.list)
+    throw new MobileUpdateRegistryError("Mobile update health requires storage lifecycle listing");
+  if (rollout && (!health || !options.store.list))
+    throw new MobileUpdateRegistryError("Mobile update rollout orchestration requires fleet health and storage lifecycle listing");
+  if (rollout && (rollout.stages.length === 0 || rollout.stages.some((stage, index) => stage.rollout <= 0 || stage.rollout > 1 || !Number.isSafeInteger(stage.minimumReports) || stage.minimumReports < 1 || !Number.isSafeInteger(stage.observationMs) || stage.observationMs < 0 || stage.maximumFailureRate < 0 || stage.maximumFailureRate >= 1 || index > 0 && stage.rollout <= rollout.stages[index - 1].rollout)))
+    throw new MobileUpdateRegistryError("Mobile update rollout stages are invalid");
+  const minimumReports = health?.autoPause?.minimumReports ?? 20;
+  const failureThreshold = health?.autoPause?.failureRate ?? 0.2;
+  if (health && (!Number.isSafeInteger(minimumReports) || minimumReports < 1 || failureThreshold <= 0 || failureThreshold > 1))
+    throw new MobileUpdateRegistryError("Mobile update health auto-pause policy is invalid");
   const root = (appId) => `${prefix}/${appHash(appId)}`;
   const releaseRoot = (manifest) => `${root(manifest.appId)}/releases/${manifest.releaseId}`;
   const manifestKey = (manifest) => `${releaseRoot(manifest)}/update.json`;
   const fileKey = (manifest, file) => `${releaseRoot(manifest)}/files/${file.path}`;
   const contentBlobKey = (appId, sha2563) => `${root(appId)}/blobs/${sha2563}`;
   const tombstoneKey = (appId, releaseId) => `${root(appId)}/gc/${releaseId}.json`;
+  const healthRoot = (appId, promotionId, releaseId) => `${root(appId)}/health/${promotionId}/${releaseId}`;
+  const pauseKey = (appId, promotionId, releaseId) => `${healthRoot(appId, promotionId, releaseId)}/paused.json`;
+  const rolloutRoot = (appId, promotionId, releaseId) => `${healthRoot(appId, promotionId, releaseId)}/rollout`;
+  const rolloutPlanKey = (appId, promotionId, releaseId) => `${rolloutRoot(appId, promotionId, releaseId)}/plan.json`;
   const channelKey = (appId, channel) => {
     if (!APP_ID.test(appId) || !NAME.test(channel))
       throw new MobileUpdateRegistryError("Mobile update channel identity is invalid");
@@ -20167,18 +20268,128 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
       throw new MobileUpdateRegistryError("Stored mobile update channel identity changed");
     return value;
   };
+  const listPrefix = async (value) => {
+    const objects = [];
+    const cursors = new Set;
+    let cursor;
+    do {
+      const page = await options.store.list({
+        ...cursor ? { cursor } : {},
+        prefix: value
+      });
+      objects.push(...page.objects);
+      if (!page.truncated)
+        break;
+      if (!page.cursor || cursors.has(page.cursor))
+        throw new MobileUpdateRegistryError("Mobile update storage returned an invalid cursor");
+      cursors.add(page.cursor);
+      cursor = page.cursor;
+    } while (true);
+    return objects;
+  };
+  const readVerifiedObject = async (key, label) => {
+    const bytes = await options.store.get(key);
+    if (!bytes)
+      return null;
+    const head = await options.store.head(key);
+    if (!head || head.size !== bytes.byteLength || head.metadata?.sha256 !== digest(bytes))
+      throw new MobileUpdateRegistryError(`Stored mobile update ${label} integrity failed`);
+    return decode2(bytes);
+  };
+  const parseRolloutPlan = (value, promotionId, releaseId) => {
+    if (!object6(value) || value.format !== 1 || value.promotionId !== promotionId || value.releaseId !== releaseId || typeof value.automatic !== "boolean" || !iso(value.createdAt) || !Array.isArray(value.stages))
+      throw new MobileUpdateRegistryError("Stored mobile update rollout plan is invalid");
+    const stages = value.stages.map((stage) => {
+      if (!object6(stage) || typeof stage.rollout !== "number" || typeof stage.maximumFailureRate !== "number" || !Number.isSafeInteger(stage.minimumReports) || !Number.isSafeInteger(stage.observationMs))
+        throw new MobileUpdateRegistryError("Stored mobile update rollout plan is invalid");
+      return {
+        maximumFailureRate: stage.maximumFailureRate,
+        minimumReports: stage.minimumReports,
+        observationMs: stage.observationMs,
+        rollout: stage.rollout
+      };
+    });
+    if (stages.length === 0 || stages.some((stage, index) => stage.rollout <= 0 || stage.rollout > 1 || stage.minimumReports < 1 || stage.observationMs < 0 || stage.maximumFailureRate < 0 || stage.maximumFailureRate >= 1 || index > 0 && stage.rollout <= stages[index - 1].rollout))
+      throw new MobileUpdateRegistryError("Stored mobile update rollout plan is invalid");
+    return {
+      automatic: value.automatic,
+      createdAt: value.createdAt,
+      format: 1,
+      promotionId,
+      releaseId,
+      stages
+    };
+  };
+  const initializeRollout = async (channel, signal) => {
+    if (!rollout || !channel.releaseId)
+      return;
+    if (!rollout.stages.some((stage) => stage.rollout === channel.rollout))
+      throw new MobileUpdateRegistryError("Mobile update promotion rollout must match a configured rollout stage");
+    const promotionId = healthPromotionId(channel);
+    const plan = {
+      automatic: rollout.automatic ?? false,
+      createdAt: channel.promotedAt,
+      format: 1,
+      promotionId,
+      releaseId: channel.releaseId,
+      stages: rollout.stages.map((stage) => ({ ...stage }))
+    };
+    const bytes = json(plan);
+    await options.store.put(rolloutPlanKey(channel.appId, promotionId, channel.releaseId), bytes, {
+      cacheControl: "no-store",
+      contentType: "application/json",
+      maxBytes: bytes.byteLength,
+      metadata: { releaseid: channel.releaseId, sha256: digest(bytes) },
+      signal
+    });
+  };
+  const signHealthToken = (payload) => {
+    if (!health)
+      return null;
+    const encoded = base64Url(JSON.stringify(payload));
+    const signature = createHmac("sha256", health.secret).update(encoded).digest("base64url");
+    return `${encoded}.${signature}`;
+  };
+  const verifyHealthToken = (token) => {
+    if (!health)
+      throw new MobileUpdateRegistryError("Mobile update health reporting is not configured");
+    const [encoded, provided, extra] = token.split(".");
+    if (!encoded || !provided || extra)
+      throw new MobileUpdateRegistryError("Mobile update health token is invalid");
+    const expected = createHmac("sha256", health.secret).update(encoded).digest();
+    let actual;
+    try {
+      actual = Buffer.from(provided, "base64url");
+    } catch {
+      actual = Buffer.alloc(0);
+    }
+    if (actual.byteLength !== expected.byteLength || !timingSafeEqual(actual, expected))
+      throw new MobileUpdateRegistryError("Mobile update health token is invalid");
+    let value;
+    try {
+      value = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
+    } catch {
+      throw new MobileUpdateRegistryError("Mobile update health token is invalid");
+    }
+    if (!object6(value) || value.format !== HEALTH_TOKEN_VERSION || typeof value.appId !== "string" || typeof value.channel !== "string" || typeof value.installationId !== "string" || typeof value.promotionId !== "string" || typeof value.releaseId !== "string" || typeof value.runtimeFingerprint !== "string")
+      throw new MobileUpdateRegistryError("Mobile update health token is invalid");
+    return value;
+  };
   const assertNotMarked = async (appId, releaseId) => {
     if (!APP_ID.test(appId) || !RELEASE.test(releaseId))
       throw new MobileUpdateRegistryError("Mobile update release identity is invalid");
     if (await options.store.head(tombstoneKey(appId, releaseId)))
       throw new MobileUpdateRegistryError("Mobile update release is marked for collection. Increase retention and apply garbage collection to restore it before promotion");
   };
-  const writeChannel = async (input, signal) => {
+  const writeChannel = async (input, signal, beforeWrite) => {
+    const promotedAt = clock().toISOString();
     const value = {
       ...input,
       format: MOBILE_UPDATE_REGISTRY_FORMAT,
-      promotedAt: clock().toISOString()
+      promotedAt,
+      promotionId: digest(new TextEncoder().encode(`${input.appId}\x00${input.channel}\x00${input.releaseId ?? "embedded"}\x00${promotedAt}\x00${randomUUID5()}`))
     };
+    await beforeWrite?.(value);
     const bytes = json(value);
     await options.store.put(channelKey(value.appId, value.channel), bytes, {
       cacheControl: "no-cache",
@@ -20193,10 +20404,92 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
     });
     return value;
   };
+  const rolloutContext = async (channel) => {
+    if (!options.store.list || !channel.releaseId)
+      return null;
+    const promotionId = healthPromotionId(channel);
+    const storedPlan = await readVerifiedObject(rolloutPlanKey(channel.appId, promotionId, channel.releaseId), "rollout plan");
+    if (storedPlan === null)
+      return null;
+    const plan = parseRolloutPlan(storedPlan, promotionId, channel.releaseId);
+    const initialStage = plan.stages.findIndex((stage) => stage.rollout === channel.rollout);
+    if (initialStage < 0)
+      throw new MobileUpdateRegistryError("Stored mobile update rollout does not match its plan");
+    let currentStage = initialStage;
+    let enteredAt = plan.createdAt;
+    const advances = await listPrefix(`${rolloutRoot(channel.appId, promotionId, channel.releaseId)}/advances/`);
+    for (const item of advances) {
+      const value = await readVerifiedObject(item.key, "rollout advancement");
+      if (!object6(value) || value.format !== 1 || value.promotionId !== promotionId || value.releaseId !== channel.releaseId || !Number.isSafeInteger(value.stage) || Number(value.stage) < initialStage || Number(value.stage) >= plan.stages.length || value.rollout !== plan.stages[Number(value.stage)].rollout || !iso(value.createdAt) || typeof value.failureRate !== "number" || !Number.isSafeInteger(value.terminalReports))
+        throw new MobileUpdateRegistryError("Stored mobile update rollout advancement is invalid");
+      if (Number(value.stage) >= currentStage) {
+        currentStage = Number(value.stage);
+        enteredAt = value.createdAt;
+      }
+    }
+    const controls = await listPrefix(`${rolloutRoot(channel.appId, promotionId, channel.releaseId)}/controls/`);
+    const parsedControls = [];
+    for (const item of controls) {
+      const value = await readVerifiedObject(item.key, "rollout control");
+      if (!object6(value) || value.format !== 1 || value.promotionId !== promotionId || value.releaseId !== channel.releaseId || typeof value.id !== "string" || value.action !== "pause" && value.action !== "resume" && value.action !== "cancel" || !iso(value.createdAt) || value.resumedPauseIds !== undefined && (!Array.isArray(value.resumedPauseIds) || value.resumedPauseIds.some((id) => typeof id !== "string")))
+        throw new MobileUpdateRegistryError("Stored mobile update rollout control is invalid");
+      parsedControls.push(value);
+    }
+    const cancelled = parsedControls.some(({ action }) => action === "cancel");
+    const resumedPauseIds = new Set(parsedControls.flatMap((control) => control.resumedPauseIds ?? []));
+    const activePauseIds = parsedControls.filter(({ action, id }) => action === "pause" && !resumedPauseIds.has(id)).map(({ id }) => id);
+    const operatorPaused = activePauseIds.length > 0;
+    const fleetPaused = Boolean(await options.store.head(pauseKey(channel.appId, promotionId, channel.releaseId)));
+    return {
+      cancelled,
+      activePauseIds,
+      channel,
+      currentStage,
+      enteredAt,
+      fleetPaused,
+      operatorPaused,
+      plan,
+      promotionId,
+      rollout: plan.stages[currentStage].rollout
+    };
+  };
+  const writeRolloutControl = async (channel, action, signal) => {
+    const context = await rolloutContext(channel);
+    if (!context)
+      throw new MobileUpdateRegistryError("Mobile update rollout orchestration is not configured");
+    if (context.cancelled)
+      throw new MobileUpdateRegistryError("Mobile update rollout was already cancelled");
+    if (action === "resume" && context.fleetPaused)
+      throw new MobileUpdateRegistryError("A fleet-health pause requires an explicit re-promotion");
+    const releaseId = channel.releaseId;
+    if (!releaseId)
+      throw new MobileUpdateRegistryError("Mobile update channel does not have an active release");
+    const createdAt = clock().toISOString();
+    const id = randomUUID5();
+    const event = {
+      action,
+      createdAt,
+      format: 1,
+      id,
+      promotionId: context.promotionId,
+      releaseId,
+      ...action === "resume" ? { resumedPauseIds: context.activePauseIds } : {}
+    };
+    const bytes = json(event);
+    await options.store.put(`${rolloutRoot(channel.appId, context.promotionId, releaseId)}/controls/${createdAt}-${id}-${action}.json`, bytes, {
+      cacheControl: "no-store",
+      contentType: "application/json",
+      maxBytes: bytes.byteLength,
+      metadata: { action, sha256: digest(bytes) },
+      signal
+    });
+  };
   const promoteUpdate = async (input) => {
     input.signal?.throwIfAborted();
     if (input.rollout <= 0 || input.rollout > 1)
       throw new MobileUpdateRegistryError("Mobile update rollout is invalid");
+    if (rollout && !rollout.stages.some((stage) => stage.rollout === input.rollout))
+      throw new MobileUpdateRegistryError("Mobile update promotion rollout must match a configured rollout stage");
     await assertNotMarked(input.appId, input.releaseId);
     const release = await readManifest(input.appId, input.releaseId);
     if (!release || release.manifest.channel !== input.channel)
@@ -20208,7 +20501,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
       ...existing?.releaseId && existing.releaseId !== input.releaseId ? { fallbackReleaseId: existing.releaseId } : existing?.fallbackReleaseId ? { fallbackReleaseId: existing.fallbackReleaseId } : {},
       releaseId: input.releaseId,
       rollout: input.rollout
-    }, input.signal);
+    }, input.signal, (channel) => initializeRollout(channel, input.signal));
     return {
       appId: input.appId,
       channel: input.channel,
@@ -20221,13 +20514,16 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
     const channel = await readChannel(input.appId, input.channel);
     if (!channel?.releaseId)
       return { status: "empty" };
-    const selected = rolloutMember({
+    const rolloutState = await rolloutContext(channel);
+    let selected = rolloutMember({
       appId: input.appId,
       channel: input.channel,
       installationId: input.installationId,
       releaseId: channel.releaseId,
-      rollout: channel.rollout
+      rollout: rolloutState?.rollout ?? channel.rollout
     }) ? channel.releaseId : channel.fallbackReleaseId;
+    if (selected === channel.releaseId && (rolloutState?.cancelled || rolloutState?.fleetPaused || rolloutState?.operatorPaused || health && await options.store.head(pauseKey(input.appId, healthPromotionId(channel), channel.releaseId))))
+      selected = channel.fallbackReleaseId;
     if (!selected)
       return { status: "empty" };
     const release = await readManifest(input.appId, selected);
@@ -20243,6 +20539,243 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
       status: "selected"
     };
   };
+  const issueUpdateHealthToken = async (input) => {
+    if (!health)
+      return null;
+    const channel = await readChannel(input.appId, input.channel);
+    if (!channel?.releaseId || channel.releaseId !== input.releaseId)
+      return null;
+    const resolution = await resolveUpdateState(input);
+    if (resolution.status !== "selected" || resolution.manifest.releaseId !== input.releaseId)
+      return null;
+    return signHealthToken({
+      appId: input.appId,
+      channel: input.channel,
+      format: HEALTH_TOKEN_VERSION,
+      installationId: input.installationId,
+      promotionId: healthPromotionId(channel),
+      releaseId: input.releaseId,
+      runtimeFingerprint: input.runtimeFingerprint
+    });
+  };
+  const inspectUpdateHealth = async (input) => {
+    if (!health)
+      throw new MobileUpdateRegistryError("Mobile update health reporting is not configured");
+    const channel = await readChannel(input.appId, input.channel);
+    const releaseId = input.releaseId ?? channel?.releaseId;
+    if (!channel || !releaseId || channel.releaseId !== releaseId)
+      return null;
+    const promotionId = healthPromotionId(channel);
+    const objects = await listPrefix(`${healthRoot(input.appId, promotionId, releaseId)}/events/`);
+    const installations = new Set;
+    const byKind = new Map([...HEALTH_KINDS].map((kind) => [
+      kind,
+      new Set
+    ]));
+    const transfer = {
+      avoidedBytes: 0,
+      downloadedBytes: 0,
+      durationMs: 0,
+      resumedBytes: 0,
+      reusedBytes: 0,
+      throughputBytesPerSecond: 0
+    };
+    for (const item of objects) {
+      const bytes = await options.store.get(item.key);
+      if (!bytes)
+        continue;
+      const head = await options.store.head(item.key);
+      if (!head || head.size !== bytes.byteLength || head.metadata?.sha256 !== digest(bytes))
+        throw new MobileUpdateRegistryError("Stored mobile update health evidence integrity failed");
+      const value = decode2(bytes);
+      if (!object6(value) || typeof value.installationHash !== "string" || !HEALTH_KINDS.has(String(value.kind)))
+        throw new MobileUpdateRegistryError("Stored mobile update health evidence is invalid");
+      const kind = value.kind;
+      installations.add(value.installationHash);
+      byKind.get(kind).add(value.installationHash);
+      if (kind === "downloaded" && object6(value.transfer)) {
+        const parsed = parseHealthTransfer(value.transfer);
+        for (const key of Object.keys(transfer))
+          transfer[key] += parsed[key];
+      }
+    }
+    const failures = new Set([
+      ...byKind.get("quarantined"),
+      ...byKind.get("rolled-back")
+    ]);
+    const terminals = new Set([...byKind.get("activated"), ...failures]);
+    const failureRate = terminals.size === 0 ? 0 : failures.size / terminals.size;
+    const rolloutState = await rolloutContext(channel);
+    return {
+      activated: byKind.get("activated").size,
+      appId: input.appId,
+      channel: input.channel,
+      downloaded: byKind.get("downloaded").size,
+      downloadFailed: byKind.get("download-failed").size,
+      failureRate,
+      failures: failures.size,
+      paused: Boolean(rolloutState?.cancelled || rolloutState?.fleetPaused || rolloutState?.operatorPaused || await options.store.head(pauseKey(input.appId, promotionId, releaseId))),
+      promotionId,
+      quarantined: byKind.get("quarantined").size,
+      releaseId,
+      reportedInstallations: installations.size,
+      rolledBack: byKind.get("rolled-back").size,
+      rollout: rolloutState?.rollout ?? channel.rollout,
+      terminalReports: terminals.size,
+      transfer
+    };
+  };
+  const inspectUpdateRollout = async (input) => {
+    const channel = await readChannel(input.appId, input.channel);
+    if (!channel?.releaseId)
+      return null;
+    const context = await rolloutContext(channel);
+    if (!context)
+      throw new MobileUpdateRegistryError("Mobile update rollout orchestration is not configured");
+    const healthReport = await inspectUpdateHealth(input);
+    if (!healthReport)
+      return null;
+    const paused = context.fleetPaused || context.operatorPaused;
+    const complete = context.currentStage === context.plan.stages.length - 1;
+    return {
+      ...healthReport,
+      automatic: context.plan.automatic,
+      currentStage: context.currentStage,
+      enteredAt: context.enteredAt,
+      ...!complete ? { nextStage: context.plan.stages[context.currentStage + 1] } : {},
+      ...context.fleetPaused ? { pausedBy: "fleet-health" } : context.operatorPaused ? { pausedBy: "operator" } : {},
+      status: context.cancelled ? "cancelled" : paused ? "paused" : complete ? "complete" : "active"
+    };
+  };
+  const advanceRollout = async (input, strict) => {
+    input.signal?.throwIfAborted();
+    const channel = await readChannel(input.appId, input.channel);
+    if (!channel?.releaseId)
+      throw new MobileUpdateRegistryError("Mobile update channel does not have an active release");
+    const context = await rolloutContext(channel);
+    if (!context)
+      throw new MobileUpdateRegistryError("Mobile update rollout orchestration is not configured");
+    const report = await inspectUpdateRollout(input);
+    if (!report)
+      throw new MobileUpdateRegistryError("Mobile update rollout report is unavailable");
+    const nextStage = context.plan.stages[context.currentStage + 1];
+    if (!nextStage)
+      return report;
+    if (input.rollout !== undefined && input.rollout !== nextStage.rollout)
+      throw new MobileUpdateRegistryError("Mobile update rollout can advance only to the next configured stage");
+    if (report.status !== "active") {
+      if (strict)
+        throw new MobileUpdateRegistryError(`Mobile update rollout cannot advance while ${report.status}`);
+      return report;
+    }
+    const gate = context.plan.stages[context.currentStage];
+    const observedMs = clock().getTime() - Date.parse(context.enteredAt);
+    const blocked = report.terminalReports < gate.minimumReports || report.failureRate > gate.maximumFailureRate || observedMs < gate.observationMs;
+    if (blocked) {
+      if (strict)
+        throw new MobileUpdateRegistryError(`Mobile update rollout needs ${gate.minimumReports} terminal reports, at most ${(gate.maximumFailureRate * 100).toFixed(1)}% failures, and ${gate.observationMs}ms observation at the current stage`);
+      return report;
+    }
+    const stage = context.currentStage + 1;
+    const event = {
+      createdAt: clock().toISOString(),
+      failureRate: report.failureRate,
+      format: 1,
+      promotionId: context.promotionId,
+      releaseId: channel.releaseId,
+      rollout: nextStage.rollout,
+      stage,
+      terminalReports: report.terminalReports
+    };
+    const bytes = json(event);
+    await options.store.put(`${rolloutRoot(input.appId, context.promotionId, channel.releaseId)}/advances/${String(stage).padStart(4, "0")}.json`, bytes, {
+      cacheControl: "no-store",
+      contentType: "application/json",
+      maxBytes: bytes.byteLength,
+      metadata: { releaseid: channel.releaseId, sha256: digest(bytes) },
+      signal: input.signal
+    });
+    return await inspectUpdateRollout(input);
+  };
+  const advanceUpdateRollout = (input) => advanceRollout(input, true);
+  const reconcileUpdateRollout = async (input) => {
+    const report = await inspectUpdateRollout(input);
+    if (!report || !report.automatic)
+      return report;
+    return advanceRollout(input, false);
+  };
+  const rolloutControl = (action) => async (input) => {
+    input.signal?.throwIfAborted();
+    const channel = await readChannel(input.appId, input.channel);
+    if (!channel?.releaseId)
+      throw new MobileUpdateRegistryError("Mobile update channel does not have an active release");
+    await writeRolloutControl(channel, action, input.signal);
+    return await inspectUpdateRollout(input);
+  };
+  const pauseUpdateRollout = rolloutControl("pause");
+  const resumeUpdateRollout = rolloutControl("resume");
+  const cancelUpdateRollout = rolloutControl("cancel");
+  const recordUpdateHealth = async (input) => {
+    const payload = verifyHealthToken(input.token);
+    if (payload.appId !== input.appId || payload.channel !== input.channel || payload.installationId !== input.installationId || payload.releaseId !== input.releaseId || payload.runtimeFingerprint !== input.runtimeFingerprint || !HEALTH_KINDS.has(input.kind) || input.reason !== undefined && input.reason !== "boot-interrupted" && input.reason !== "boot-timeout")
+      throw new MobileUpdateRegistryError("Mobile update health evidence does not match its token");
+    const release = await readManifest(input.appId, input.releaseId);
+    if (!release || release.manifest.runtimeFingerprint !== input.runtimeFingerprint)
+      throw new MobileUpdateRegistryError("Mobile update health release is invalid");
+    const activeChannel = await readChannel(input.appId, input.channel);
+    if (!activeChannel || activeChannel.releaseId !== input.releaseId || healthPromotionId(activeChannel) !== payload.promotionId)
+      throw new MobileUpdateRegistryError("Mobile update health promotion is no longer active");
+    const transfer = parseHealthTransfer(input.transfer);
+    const installationHash = createHmac("sha256", health.secret).update(input.installationId).digest("hex");
+    const evidence = {
+      format: 1,
+      installationHash,
+      kind: input.kind,
+      observedAt: clock().toISOString(),
+      ...input.reason ? { reason: input.reason } : {},
+      ...transfer ? { transfer } : {}
+    };
+    const bytes = json(evidence);
+    await options.store.put(`${healthRoot(input.appId, payload.promotionId, input.releaseId)}/events/${installationHash}/${input.kind}.json`, bytes, {
+      cacheControl: "no-store",
+      contentType: "application/json",
+      maxBytes: bytes.byteLength,
+      metadata: { kind: input.kind, sha256: digest(bytes) }
+    });
+    let report = await inspectUpdateHealth({
+      appId: input.appId,
+      channel: input.channel,
+      releaseId: input.releaseId
+    });
+    if (!report)
+      throw new MobileUpdateRegistryError("Mobile update health promotion is no longer active");
+    if (FAILURE_HEALTH_KINDS.has(input.kind) && report.terminalReports >= minimumReports && report.failureRate >= failureThreshold && !report.paused) {
+      const marker = json({
+        appId: input.appId,
+        channel: input.channel,
+        failureRate: report.failureRate,
+        failures: report.failures,
+        format: 1,
+        pausedAt: clock().toISOString(),
+        promotionId: payload.promotionId,
+        releaseId: input.releaseId,
+        reports: report.terminalReports
+      });
+      await options.store.put(pauseKey(input.appId, payload.promotionId, input.releaseId), marker, {
+        cacheControl: "no-store",
+        contentType: "application/json",
+        maxBytes: marker.byteLength,
+        metadata: { releaseid: input.releaseId, sha256: digest(marker) }
+      });
+      report = { ...report, paused: true };
+    }
+    if (rollout && (input.kind === "activated" || FAILURE_HEALTH_KINDS.has(input.kind)))
+      return await reconcileUpdateRollout({
+        appId: input.appId,
+        channel: input.channel
+      }) ?? report;
+    return report;
+  };
   const retentionValues = (input) => {
     if (!APP_ID.test(input.appId))
       throw new MobileUpdateRegistryError("Mobile update appId is invalid");
@@ -20485,6 +21018,15 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
     return result;
   };
   return {
+    ...health ? { inspectUpdateHealth, issueUpdateHealthToken, recordUpdateHealth } : {},
+    ...rollout ? {
+      advanceUpdateRollout,
+      cancelUpdateRollout,
+      inspectUpdateRollout,
+      pauseUpdateRollout,
+      reconcileUpdateRollout,
+      resumeUpdateRollout
+    } : {},
     inspectUpdateStorage: async (input) => (await inventory(input)).report,
     pruneUpdates,
     publishUpdate: async (input) => {
@@ -20762,7 +21304,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
     const origin = request.headers.get("origin");
     const cors = origin && allowedOrigins.has(origin) ? {
       "access-control-allow-origin": origin,
-      "access-control-expose-headers": "content-range,etag",
+      "access-control-expose-headers": "content-range,etag,x-absolute-mobile-health-token",
       vary: "Origin"
     } : {};
     if (request.method === "OPTIONS") {
@@ -20771,17 +21313,58 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
       return new Response(null, {
         headers: {
           ...cors,
-          "access-control-allow-headers": "if-range,range,x-absolute-mobile-app,x-absolute-mobile-channel,x-absolute-mobile-installation,x-absolute-mobile-release,x-absolute-mobile-runtime",
-          "access-control-allow-methods": "GET,OPTIONS",
+          "access-control-allow-headers": "content-type,if-range,range,x-absolute-mobile-app,x-absolute-mobile-channel,x-absolute-mobile-health-token,x-absolute-mobile-installation,x-absolute-mobile-release,x-absolute-mobile-runtime",
+          "access-control-allow-methods": "GET,POST,OPTIONS",
           "access-control-max-age": "600"
         },
         status: 204
       });
     }
-    if (request.method !== "GET")
-      return new Response(null, { status: 405 });
     const pathname = new URL(request.url).pathname.replace(/^\/+/, "");
     const relative17 = pathname.startsWith(`${route}/`) ? pathname.slice(route.length + 1) : "";
+    if (request.method === "POST" && relative17 === "health") {
+      if (!options.registry.recordUpdateHealth)
+        return new Response(null, { status: 404 });
+      const appId = request.headers.get("x-absolute-mobile-app");
+      const channel = request.headers.get("x-absolute-mobile-channel");
+      const installationId = request.headers.get("x-absolute-mobile-installation");
+      const runtimeFingerprint = request.headers.get("x-absolute-mobile-runtime");
+      const token = request.headers.get("x-absolute-mobile-health-token");
+      const declared = Number(request.headers.get("content-length"));
+      if (appId !== options.appId || channel !== options.channel || !installationId || !runtimeFingerprint || !token || Number.isFinite(declared) && declared > 4096)
+        return new Response(null, { status: 400 });
+      const bodyBytes = new Uint8Array(await request.arrayBuffer());
+      if (bodyBytes.byteLength > 4096)
+        return new Response(null, { status: 413 });
+      let body;
+      try {
+        body = JSON.parse(new TextDecoder().decode(bodyBytes));
+      } catch {
+        return new Response(null, { status: 400 });
+      }
+      if (!object6(body) || typeof body.releaseId !== "string" || typeof body.kind !== "string")
+        return new Response(null, { status: 400 });
+      try {
+        const report = await options.registry.recordUpdateHealth({
+          appId,
+          channel,
+          installationId,
+          kind: body.kind,
+          ...body.reason === "boot-interrupted" || body.reason === "boot-timeout" ? { reason: body.reason } : {},
+          releaseId: body.releaseId,
+          runtimeFingerprint,
+          token,
+          ...object6(body.transfer) ? { transfer: body.transfer } : {}
+        });
+        return Response.json({ paused: report.paused }, { headers: { ...cors, "cache-control": "no-store" }, status: 202 });
+      } catch (error) {
+        if (error instanceof MobileUpdateRegistryError)
+          return new Response(null, { status: 403 });
+        throw error;
+      }
+    }
+    if (request.method !== "GET")
+      return new Response(null, { status: 405 });
     if (relative17 === "update.json") {
       const expoProtocolVersion = request.headers.get("expo-protocol-version");
       const expoProtocol = expoProtocolVersion !== null;
@@ -20807,6 +21390,13 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
         installationId,
         runtimeFingerprint
       });
+      const healthToken = selected && options.registry.issueUpdateHealthToken ? await options.registry.issueUpdateHealthToken({
+        appId,
+        channel,
+        installationId,
+        releaseId: selected.manifest.releaseId,
+        runtimeFingerprint
+      }) : null;
       if (expoProtocol) {
         let requestedCodeSigning;
         try {
@@ -20858,6 +21448,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
           extra: {
             absolutejs: {
               channel: selected.manifest.channel,
+              ...healthToken ? { healthToken } : {},
               releaseId: selected.manifest.releaseId
             },
             expoClient: descriptor.expoConfig
@@ -20885,7 +21476,8 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
         headers: {
           ...cors,
           "cache-control": "no-store",
-          etag: `"${selected.manifest.releaseId}"`
+          etag: `"${selected.manifest.releaseId}"`,
+          ...healthToken ? { "x-absolute-mobile-health-token": healthToken } : {}
         }
       });
     }
@@ -20948,6 +21540,14 @@ var init_mobileUpdate = __esm(() => {
   RELEASE = /^amu_[a-f0-9]{64}$/;
   APP_ID = /^[A-Za-z][\w]*(?:\.[A-Za-z][\w]*)+$/;
   NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+  HEALTH_KINDS = new Set([
+    "activated",
+    "downloaded",
+    "download-failed",
+    "quarantined",
+    "rolled-back"
+  ]);
+  FAILURE_HEALTH_KINDS = new Set(["quarantined", "rolled-back"]);
   MobileUpdateRegistryError = class MobileUpdateRegistryError extends Error {
   };
   expoProtocolHeaders = {
@@ -21035,6 +21635,16 @@ var ABSOLUTE_MOBILE_UPDATE_SERVER_FORMAT = 1, DEFAULT_MOBILE_UPDATE_REGISTRY_MOD
   } catch (error) {
     throw new TypeError(`Durable mobile update storage verification failed for ${module.metadata.provider}. Check the bucket, endpoint, credentials, and read/write/delete permissions.`, { cause: error });
   }
+}, verifyHealthModule = (config, module) => {
+  if (!config.updateServer?.health)
+    return;
+  if (typeof module.registry.inspectUpdateHealth !== "function" || typeof module.registry.issueUpdateHealthToken !== "function" || typeof module.registry.recordUpdateHealth !== "function")
+    throw new TypeError("Mobile update fleet health is enabled but the registry is not provisioned for it. Run `absolute mobile update provision --force`.");
+}, verifyRolloutModule = (config, module) => {
+  if (!config.updateServer?.rollout)
+    return;
+  if (typeof module.registry.advanceUpdateRollout !== "function" || typeof module.registry.cancelUpdateRollout !== "function" || typeof module.registry.inspectUpdateRollout !== "function" || typeof module.registry.pauseUpdateRollout !== "function" || typeof module.registry.reconcileUpdateRollout !== "function" || typeof module.registry.resumeUpdateRollout !== "function")
+    throw new TypeError("Mobile update rollout orchestration is enabled but the registry is not provisioned for it. Run `absolute mobile update provision --force`.");
 }, expoSigningOptions = (config) => {
   if (!config.updates?.expoCodeSigning)
     return;
@@ -21066,8 +21676,11 @@ var ABSOLUTE_MOBILE_UPDATE_SERVER_FORMAT = 1, DEFAULT_MOBILE_UPDATE_REGISTRY_MOD
   if (!updates || !server?.autoMount)
     return new Elysia4({ name: "absolutejs-mobile-updates-disabled" });
   const module = await loadAbsoluteMobileUpdateServerModule(projectRoot, server.registryModule);
-  if (options.production)
+  if (options.production) {
     await verifyDurableModule(module);
+    verifyHealthModule(config, module);
+    verifyRolloutModule(config, module);
+  }
   const manifest = new URL(updates.manifestUrl);
   if (!manifest.pathname.endsWith("/update.json"))
     throw new TypeError("Auto-mounted mobile update manifests must end in /update.json.");
@@ -21086,10 +21699,12 @@ var ABSOLUTE_MOBILE_UPDATE_SERVER_FORMAT = 1, DEFAULT_MOBILE_UPDATE_REGISTRY_MOD
     return;
   const module = await loadAbsoluteMobileUpdateServerModule(projectRoot, config.updateServer?.registryModule);
   await verifyDurableModule(module);
+  verifyHealthModule(config, module);
+  verifyRolloutModule(config, module);
   if (config.engine === "expo")
     expoSigningOptions(config);
   return module.metadata;
-}, publicKeysSource = (publicKeys) => JSON.stringify(publicKeys, null, "\t"), renderAbsoluteMobileUpdateRegistry = (options) => {
+}, publicKeysSource = (publicKeys) => JSON.stringify(publicKeys, null, "\t"), renderAbsoluteMobileUpdateRegistryBase = (options) => {
   const metadata = `export const absoluteMobileUpdateServer = {
 	format: 1,
 	provider: '${options.storage}',
@@ -21155,6 +21770,27 @@ export default createMobileUpdateRegistry({
 	store
 });
 `;
+}, renderAbsoluteMobileUpdateRegistry = (options) => {
+  const source = renderAbsoluteMobileUpdateRegistryBase(options);
+  let generated = "";
+  if (options.health) {
+    const secret = options.storage === "local" ? `process.env.${options.health.secretEnv} ?? 'absolutejs-local-health-secret-not-for-production'` : `required('${options.health.secretEnv}')`;
+    generated += `	health: {
+		autoPause: { failureRate: ${options.health.failureRate}, minimumReports: ${options.health.minimumReports} },
+		secret: ${secret}
+	},
+`;
+  }
+  if (options.rollout)
+    generated += `	rollout: ${JSON.stringify(options.rollout, null, "\t").replaceAll(`
+`, `
+	`)},
+`;
+  if (!generated)
+    return source;
+  return source.replace(`export default createMobileUpdateRegistry({
+`, `export default createMobileUpdateRegistry({
+${generated}`);
 }, writeAbsoluteMobileUpdateRegistry = async (options) => {
   const path2 = projectPath3(options.projectRoot, options.modulePath ?? DEFAULT_MOBILE_UPDATE_REGISTRY_MODULE);
   if (!options.force) {
@@ -21166,6 +21802,8 @@ export default createMobileUpdateRegistry({
   }
   await mkdir18(dirname19(path2), { recursive: true });
   await Bun.write(path2, renderAbsoluteMobileUpdateRegistry({
+    ...options.health ? { health: options.health } : {},
+    ...options.rollout ? { rollout: options.rollout } : {},
     publicKeys: options.publicKeys,
     storage: options.storage
   }));
@@ -27832,11 +28470,48 @@ export default function AbsoluteLayout() {
 	return <Stack screenOptions={{ headerShown: false }} />;
 }
 `;
-var updatesRuntimeSource = () => `${EXPO_GENERATED_HEADER}import { randomUUID } from 'expo-crypto';
+var updatesRuntimeSource = (config) => `${EXPO_GENERATED_HEADER}import { randomUUID } from 'expo-crypto';
 import * as SecureStore from 'expo-secure-store';
 import * as Updates from 'expo-updates';
 
 const INSTALLATION_KEY = 'absolutejs.mobile.update.installation.v1';
+const PENDING_HEALTH_KEY = 'absolutejs.mobile.update.pending-health.v1';
+const APP_ID = ${JSON.stringify(config.appId)};
+const CHANNEL = ${JSON.stringify(config.updates?.channel)};
+const MANIFEST_URL = ${JSON.stringify(config.updates?.manifestUrl)};
+
+const updateIdentity = (value: unknown) => {
+	if (!value || typeof value !== 'object') return undefined;
+	const extra = Reflect.get(value, 'extra');
+	if (!extra || typeof extra !== 'object') return undefined;
+	const absolute = Reflect.get(extra, 'absolutejs');
+	if (!absolute || typeof absolute !== 'object') return undefined;
+	const healthToken = Reflect.get(absolute, 'healthToken');
+	const releaseId = Reflect.get(absolute, 'releaseId');
+	return typeof healthToken === 'string' && typeof releaseId === 'string'
+		? { healthToken, releaseId }
+		: undefined;
+};
+
+const report = async (installationId: string, evidence: { healthToken: string; kind: string; releaseId: string }) => {
+	const endpoint = new URL('./health', MANIFEST_URL);
+	await fetch(endpoint.href, {
+		body: JSON.stringify({ kind: evidence.kind, releaseId: evidence.releaseId }),
+		cache: 'no-store',
+		credentials: 'omit',
+		headers: {
+			'content-type': 'application/json',
+			'x-absolute-mobile-app': APP_ID,
+			'x-absolute-mobile-channel': CHANNEL,
+			'x-absolute-mobile-health-token': evidence.healthToken,
+			'x-absolute-mobile-installation': installationId,
+			'x-absolute-mobile-release': updateIdentity(Updates.manifest)?.releaseId ?? 'embedded',
+			'x-absolute-mobile-runtime': Updates.runtimeVersion ?? ''
+		},
+		method: 'POST',
+		redirect: 'error'
+	});
+};
 
 let startPromise: Promise<void> | undefined;
 export const startAbsoluteExpoUpdates = () => {
@@ -27848,9 +28523,34 @@ export const startAbsoluteExpoUpdates = () => {
 			await SecureStore.setItemAsync(INSTALLATION_KEY, installationId);
 		}
 		await Updates.setExtraParamAsync('absolute-installation', installationId);
+		const pendingSource = await SecureStore.getItemAsync(PENDING_HEALTH_KEY);
+		if (pendingSource) {
+			try {
+				const pending = JSON.parse(pendingSource);
+				const active = updateIdentity(Updates.manifest);
+				if (typeof pending?.healthToken === 'string' && typeof pending?.releaseId === 'string')
+					await report(installationId, {
+						healthToken: pending.healthToken,
+						kind: active?.releaseId === pending.releaseId ? 'activated' : 'rolled-back',
+						releaseId: pending.releaseId
+					});
+			} catch {}
+			await SecureStore.deleteItemAsync(PENDING_HEALTH_KEY);
+		}
 		const result = await Updates.checkForUpdateAsync();
 		if (result.isAvailable || result.isRollBackToEmbedded) {
-			await Updates.fetchUpdateAsync();
+			const available = updateIdentity(Reflect.get(result, 'manifest'));
+			try {
+				const fetched = await Updates.fetchUpdateAsync();
+				const identity = updateIdentity(Reflect.get(fetched, 'manifest')) ?? available;
+				if (identity) {
+					await SecureStore.setItemAsync(PENDING_HEALTH_KEY, JSON.stringify(identity));
+					await report(installationId, { ...identity, kind: 'downloaded' });
+				}
+			} catch (error) {
+				if (available) await report(installationId, { ...available, kind: 'download-failed' }).catch(() => undefined);
+				throw error;
+			}
 			if (result.isRollBackToEmbedded) {
 				await Updates.reloadAsync();
 			}
@@ -28795,7 +29495,7 @@ node_modules/
       files.set(path, source);
   }
   if (config.updates) {
-    files.set(join15(project, "src", "generated", "AbsoluteUpdates.ts"), updatesRuntimeSource());
+    files.set(join15(project, "src", "generated", "AbsoluteUpdates.ts"), updatesRuntimeSource(config));
   }
   const expoCodeSigning = config.updates?.expoCodeSigning;
   if (expoCodeSigning)
@@ -38780,6 +39480,30 @@ var requestHeaders = (config) => ({
   "x-absolute-mobile-release": config.currentReleaseId,
   "x-absolute-mobile-runtime": config.runtimeFingerprint
 });
+var healthUrl = (manifestUrl) => new URL("./health", manifestUrl);
+var reportAbsoluteMobileUpdateHealth = async (config, input, request = globalThis.fetch) => {
+  const manifestUrl = exactManifestUrl(config.manifestUrl);
+  const headers = new Headers(requestHeaders(config));
+  headers.set("content-type", "application/json");
+  headers.set("x-absolute-mobile-health-token", input.healthToken);
+  const response = await request(healthUrl(manifestUrl), {
+    body: JSON.stringify({
+      kind: input.kind,
+      ...input.reason ? { reason: input.reason } : {},
+      releaseId: input.releaseId,
+      ...input.transfer ? { transfer: input.transfer } : {}
+    }),
+    cache: "no-store",
+    credentials: "omit",
+    headers,
+    keepalive: true,
+    method: "POST",
+    redirect: "error",
+    signal: AbortSignal.timeout(15000)
+  });
+  if (response.status !== 202)
+    throw new TypeError(`Mobile update health report failed with HTTP ${response.status}.`);
+};
 var requireCompatible = (manifest, config) => {
   if (manifest.appId !== config.appId)
     throw new TypeError("Mobile update belongs to another app.");
@@ -38975,15 +39699,24 @@ var createAbsoluteMobileUpdateClient = (options) => {
       throw new TypeError("Mobile update manifest is not valid JSON.");
     }
     const manifest = parseAbsoluteMobileUpdateManifest(manifestValue);
+    const healthToken = response.headers.get("x-absolute-mobile-health-token");
     requireCompatible(manifest, options.config);
     if (!await options.verifier.verify(manifest))
       throw new TypeError("Mobile update signature verification failed.");
     if (manifest.releaseId === options.config.currentReleaseId)
       return { kind: "current" };
     if (options.config.blockedReleaseIds?.includes(manifest.releaseId))
-      return { kind: "quarantined", releaseId: manifest.releaseId };
+      return {
+        ...healthToken ? { healthToken } : {},
+        kind: "quarantined",
+        releaseId: manifest.releaseId
+      };
     if (!download)
-      return { kind: "update-available", manifest };
+      return {
+        ...healthToken ? { healthToken } : {},
+        kind: "update-available",
+        manifest
+      };
     await options.store.begin(manifest);
     let transfer;
     try {
@@ -38994,14 +39727,28 @@ var createAbsoluteMobileUpdateClient = (options) => {
         await options.store.suspend(manifest.releaseId);
       else
         await options.store.abort(manifest.releaseId);
+      if (healthToken)
+        reportAbsoluteMobileUpdateHealth(options.config, {
+          healthToken,
+          kind: "download-failed",
+          releaseId: manifest.releaseId
+        }, request).catch(() => {
+          return;
+        });
       throw error;
     }
-    return { kind: "downloaded", manifest, transfer };
+    return {
+      ...healthToken ? { healthToken } : {},
+      kind: "downloaded",
+      manifest,
+      transfer
+    };
   };
   return {
     check,
     activate: (releaseId) => options.store.activate(releaseId),
-    download: () => check(true)
+    download: () => check(true),
+    report: (input) => reportAbsoluteMobileUpdateHealth(options.config, input, request)
   };
 };
 // src/mobile/updatePublisher.ts
@@ -39124,6 +39871,66 @@ var lifecycleMethod = (publisher, name) => {
     throw new TypeError(`Mobile update registry does not support ${name}. Re-run \`absolute mobile update provision --force\` after upgrading @absolutejs/deploy.`);
   return method;
 };
+var validateHealthReport = (report, options) => {
+  if (!object5(report) || report.appId !== options.appId || report.channel !== options.channel || options.releaseId !== undefined && report.releaseId !== options.releaseId || typeof report.paused !== "boolean" || ![
+    report.activated,
+    report.downloaded,
+    report.downloadFailed,
+    report.failures,
+    report.quarantined,
+    report.reportedInstallations,
+    report.rolledBack,
+    report.terminalReports
+  ].every((value) => Number.isSafeInteger(value) && value >= 0) || !Number.isFinite(report.failureRate) || report.failureRate < 0 || report.failureRate > 1 || !Number.isFinite(report.rollout) || report.rollout < 0 || report.rollout > 1 || !object5(report.transfer) || ![
+    report.transfer.avoidedBytes,
+    report.transfer.downloadedBytes,
+    report.transfer.durationMs,
+    report.transfer.resumedBytes,
+    report.transfer.reusedBytes,
+    report.transfer.throughputBytesPerSecond
+  ].every((value) => Number.isFinite(value) && value >= 0))
+    throw new TypeError("Mobile update registry returned an invalid health report.");
+  return report;
+};
+var inspectAbsoluteMobileUpdateHealth = async (options) => {
+  const report = await lifecycleMethod(options.publisher, "inspectUpdateHealth")({
+    appId: options.appId,
+    channel: options.channel,
+    ...options.releaseId ? { releaseId: options.releaseId } : {}
+  });
+  if (report === null)
+    return null;
+  return validateHealthReport(report, options);
+};
+var validateRolloutReport = (report, options) => {
+  validateHealthReport(report, options);
+  const validStage = (stage) => stage === undefined || object5(stage) && Number.isFinite(stage.rollout) && stage.rollout > 0 && stage.rollout <= 1 && Number.isSafeInteger(stage.minimumReports) && stage.minimumReports > 0 && Number.isSafeInteger(stage.observationMs) && stage.observationMs >= 0 && Number.isFinite(stage.maximumFailureRate) && stage.maximumFailureRate >= 0 && stage.maximumFailureRate < 1;
+  if (typeof report.automatic !== "boolean" || !Number.isSafeInteger(report.currentStage) || report.currentStage < 0 || !Number.isFinite(Date.parse(report.enteredAt)) || !["active", "cancelled", "complete", "paused"].includes(report.status) || report.pausedBy !== undefined && report.pausedBy !== "fleet-health" && report.pausedBy !== "operator" || !validStage(report.nextStage) || report.paused !== (report.status === "paused" || report.status === "cancelled"))
+    throw new TypeError("Mobile update registry returned an invalid rollout report.");
+  return report;
+};
+var inspectAbsoluteMobileUpdateRollout = async (options) => {
+  const report = await lifecycleMethod(options.publisher, "inspectUpdateRollout")({ appId: options.appId, channel: options.channel });
+  return report === null ? null : validateRolloutReport(report, options);
+};
+var mutateAbsoluteMobileUpdateRollout = async (method, options) => validateRolloutReport(await lifecycleMethod(options.publisher, method)({
+  appId: options.appId,
+  channel: options.channel,
+  ...method === "advanceUpdateRollout" && options.rollout !== undefined ? { rollout: options.rollout } : {},
+  ...options.signal ? { signal: options.signal } : {}
+}), options);
+var advanceAbsoluteMobileUpdateRollout = (options) => mutateAbsoluteMobileUpdateRollout("advanceUpdateRollout", options);
+var cancelAbsoluteMobileUpdateRollout = (options) => mutateAbsoluteMobileUpdateRollout("cancelUpdateRollout", options);
+var pauseAbsoluteMobileUpdateRollout = (options) => mutateAbsoluteMobileUpdateRollout("pauseUpdateRollout", options);
+var reconcileAbsoluteMobileUpdateRollout = async (options) => {
+  const report = await lifecycleMethod(options.publisher, "reconcileUpdateRollout")({
+    appId: options.appId,
+    channel: options.channel,
+    ...options.signal ? { signal: options.signal } : {}
+  });
+  return report === null ? null : validateRolloutReport(report, options);
+};
+var resumeAbsoluteMobileUpdateRollout = (options) => mutateAbsoluteMobileUpdateRollout("resumeUpdateRollout", options);
 var validOptionalCounters = (values) => values.every((value) => value === undefined) || values.every((value) => Number.isSafeInteger(value) && (value ?? -1) >= 0);
 var validateStorageIdentity = (result, appId) => {
   if (!object5(result) || result.appId !== appId || !Array.isArray(result.releases) || ![
@@ -39324,6 +40131,7 @@ export {
   acceptsAbsoluteRouteData,
   acquireAbsoluteRemoteMacReleaseLease,
   activateAbsoluteMobilePage,
+  advanceAbsoluteMobileUpdateRollout,
   applyAbsoluteNativeDeepLinks,
   applyAbsoluteNativeDeviceCapabilities,
   applyAbsoluteNativeObservability,
@@ -39335,6 +40143,7 @@ export {
   buildAbsoluteMobileCompatibilityRelease,
   buildAbsoluteMobileUpdate,
   buildAbsoluteRemoteIosRelease,
+  cancelAbsoluteMobileUpdateRollout,
   canonicalizeAbsoluteMobileUpdate,
   captureAbsoluteMobileRouteGraph,
   captureAbsoluteRemoteMacCommand,
@@ -39385,6 +40194,8 @@ export {
   hashAbsoluteMobilePropsSchema,
   inspectAbsoluteAndroidInstalledApp,
   inspectAbsoluteMobileRouteMetadata,
+  inspectAbsoluteMobileUpdateHealth,
+  inspectAbsoluteMobileUpdateRollout,
   inspectAbsoluteMobileUpdateServer,
   inspectAbsoluteMobileUpdateStorage,
   inspectAbsoluteRemoteMac,
@@ -39436,6 +40247,7 @@ export {
   parseIosDeviceTypes,
   parseIosRuntimes,
   parseIosSimulators,
+  pauseAbsoluteMobileUpdateRollout,
   planAbsoluteExpoDevSession,
   prepareAbsoluteAndroidRelease,
   prepareAbsoluteIosDevProject,
@@ -39451,10 +40263,12 @@ export {
   readAbsoluteMobileLinkIntent,
   readAbsoluteMobileMaterializedReleases,
   readAbsoluteMobileUpdate,
+  reconcileAbsoluteMobileUpdateRollout,
   redactAbsoluteIosLog,
   removeAbsoluteRemoteMacProfile,
   renderAbsoluteMobileUpdateRegistry,
   repairAbsoluteIosDevSession,
+  reportAbsoluteMobileUpdateHealth,
   requestAbsoluteMobileBack,
   requireAbsoluteIosReleaseMetadata,
   resolveAbsoluteDeviceCapabilityPlan,
@@ -39465,6 +40279,7 @@ export {
   resolveAbsoluteMobileNavigation,
   resolveAbsoluteMobileRoute,
   resolveAbsoluteMobileUpdateRuntime,
+  resumeAbsoluteMobileUpdateRollout,
   retainAbsoluteMobileCompatibilityArtifacts,
   rollbackAbsoluteMobileUpdate,
   runAbsoluteAndroidUpgradeConformance,
@@ -39493,5 +40308,5 @@ export {
   writeAbsoluteMobileUpdateRegistry
 };
 
-//# debugId=B713A6D1CA49D10364756E2164756E21
+//# debugId=DB548297ABB3C7C964756E2164756E21
 //# sourceMappingURL=index.js.map