@absolutejs/absolute 0.20.0-beta.86 → 0.20.0-beta.87

package/dist/mobile/index.js

@@ -604,7 +604,7 @@ __export(exports_config, {
 import { readFileSync as readFileSync2 } from "fs";
 import { resolve as resolve6 } from "path";
 import { createHash as createHash8, createPublicKey, X509Certificate as X509Certificate2 } from "crypto";
-var APP_ID_PATTERN, SCHEME_PATTERN, APPLE_APP_ID_PREFIX_PATTERN, CERTIFICATE_FINGERPRINT_PATTERN, UPDATE_NAME_PATTERN, UPDATE_PUBLIC_KEY_PATTERN, ENVIRONMENT_NAME_PATTERN, DEFAULT_UPDATE_BOOT_TIMEOUT_MS = 20000, DEFAULT_UPDATE_HEALTH_FAILURE_RATE = 0.2, DEFAULT_UPDATE_HEALTH_MINIMUM_REPORTS = 20, MINIMUM_UPDATE_BOOT_TIMEOUT_MS = 5000, MAXIMUM_UPDATE_BOOT_TIMEOUT_MS = 120000, HOSTNAME_PATTERN, EXPO_RESERVED_ROUTE_PREFIXES, resolveProjectPath = (projectRoot, value, field2) => {
+var APP_ID_PATTERN, SCHEME_PATTERN, APPLE_APP_ID_PREFIX_PATTERN, CERTIFICATE_FINGERPRINT_PATTERN, UPDATE_NAME_PATTERN, UPDATE_PUBLIC_KEY_PATTERN, ENVIRONMENT_NAME_PATTERN, DEFAULT_UPDATE_BOOT_TIMEOUT_MS = 20000, DEFAULT_UPDATE_HEALTH_FAILURE_RATE = 0.2, DEFAULT_UPDATE_HEALTH_MINIMUM_REPORTS = 20, DEFAULT_UPDATE_ROLLOUT_FAILURE_RATE = 0.05, DEFAULT_UPDATE_ROLLOUT_OBSERVATION_MINUTES = 60, MINUTE_MS, DEFAULT_UPDATE_ROLLOUT_STAGES, MINIMUM_UPDATE_BOOT_TIMEOUT_MS = 5000, MAXIMUM_UPDATE_BOOT_TIMEOUT_MS = 120000, HOSTNAME_PATTERN, EXPO_RESERVED_ROUTE_PREFIXES, resolveProjectPath = (projectRoot, value, field2) => {
   const root = resolve6(projectRoot);
   const path = resolve6(root, value);
   if (path !== root && !path.startsWith(`${root}/`)) {
@@ -812,6 +812,42 @@ var APP_ID_PATTERN, SCHEME_PATTERN, APPLE_APP_ID_PREFIX_PATTERN, CERTIFICATE_FIN
       throw new TypeError("mobile.updates.server.health.secretEnv must be a valid environment variable name.");
     health = { failureRate, minimumReports, secretEnv };
   }
+  const configuredRollout = config.updates.server?.rollout;
+  let rollout;
+  if (configuredRollout !== undefined && configuredRollout !== false) {
+    if (!health)
+      throw new TypeError("mobile.updates.server.rollout requires fleet health to be enabled.");
+    if (configuredRollout.automatic !== undefined && typeof configuredRollout.automatic !== "boolean")
+      throw new TypeError("mobile.updates.server.rollout.automatic must be boolean.");
+    const configuredStages = configuredRollout.stages ?? DEFAULT_UPDATE_ROLLOUT_STAGES;
+    const stages = configuredStages.map((stage, index) => {
+      const previousStage = configuredStages[index - 1];
+      const maximumFailureRate = stage.maximumFailureRate ?? DEFAULT_UPDATE_ROLLOUT_FAILURE_RATE;
+      const minimumReports = stage.minimumReports ?? DEFAULT_UPDATE_HEALTH_MINIMUM_REPORTS;
+      const observationMinutes = stage.observationMinutes ?? DEFAULT_UPDATE_ROLLOUT_OBSERVATION_MINUTES;
+      const observationMs = observationMinutes * MINUTE_MS;
+      if (!Number.isFinite(stage.rollout) || stage.rollout <= 0 || stage.rollout > 1 || previousStage !== undefined && stage.rollout <= previousStage.rollout)
+        throw new TypeError("mobile.updates.server.rollout stages must be strictly increasing fractions greater than 0 and at most 1.");
+      if (!Number.isFinite(maximumFailureRate) || maximumFailureRate < 0 || maximumFailureRate >= health.failureRate)
+        throw new TypeError("mobile.updates.server.rollout maximumFailureRate must be non-negative and lower than the fleet-health pause rate.");
+      if (!Number.isSafeInteger(minimumReports) || minimumReports < health.minimumReports)
+        throw new TypeError("mobile.updates.server.rollout minimumReports must be an integer at least as large as the fleet-health minimumReports.");
+      if (!Number.isFinite(observationMinutes) || observationMinutes < 0 || !Number.isSafeInteger(observationMs))
+        throw new TypeError("mobile.updates.server.rollout observationMinutes must produce a non-negative whole number of milliseconds.");
+      return {
+        maximumFailureRate,
+        minimumReports,
+        observationMs,
+        rollout: stage.rollout
+      };
+    });
+    if (stages.length === 0 || stages.at(-1)?.rollout !== 1)
+      throw new TypeError("mobile.updates.server.rollout stages must end at rollout 1.");
+    rollout = {
+      automatic: configuredRollout.automatic ?? false,
+      stages
+    };
+  }
   if (autoMount) {
     const manifest = new URL(updates.manifestUrl);
     if (manifest.origin !== productionOrigin)
@@ -848,6 +884,7 @@ var APP_ID_PATTERN, SCHEME_PATTERN, APPLE_APP_ID_PREFIX_PATTERN, CERTIFICATE_FIN
     autoMount,
     expoCodeSigningKeys,
     ...health ? { health } : {},
+    ...rollout ? { rollout } : {},
     registryModule
   };
 }, validateExpoNativeRouteSegment = (path, segment, index, count, parameters) => {
@@ -941,6 +978,12 @@ var init_config = __esm(() => {
   UPDATE_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
   UPDATE_PUBLIC_KEY_PATTERN = /^[A-Za-z0-9+/]+={0,2}$/u;
   ENVIRONMENT_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/u;
+  MINUTE_MS = 60 * 1000;
+  DEFAULT_UPDATE_ROLLOUT_STAGES = [
+    { minimumReports: 20, observationMinutes: 60, rollout: 0.05 },
+    { minimumReports: 100, observationMinutes: 360, rollout: 0.25 },
+    { minimumReports: 100, observationMinutes: 0, rollout: 1 }
+  ];
   HOSTNAME_PATTERN = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(?:\.(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?))*$/;
   EXPO_RESERVED_ROUTE_PREFIXES = new Set([
     "_expo",
@@ -19984,6 +20027,7 @@ import {
   createHmac,
   createPrivateKey,
   createPublicKey as createPublicKey2,
+  randomUUID as randomUUID5,
   sign as sign2,
   timingSafeEqual,
   verify as verify2,
@@ -20120,7 +20164,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
     throw new MobileUpdateRegistryError("Mobile update channel is invalid");
   const appId = text2(value.appId, "channel appId");
   const channel = text2(value.channel, "channel");
-  if (!APP_ID.test(appId) || !NAME.test(channel) || !iso(value.promotedAt) || typeof value.rollout !== "number" || value.rollout < 0 || value.rollout > 1 || value.releaseId !== undefined && (typeof value.releaseId !== "string" || !RELEASE.test(value.releaseId)) || value.fallbackReleaseId !== undefined && (typeof value.fallbackReleaseId !== "string" || !RELEASE.test(value.fallbackReleaseId)) || value.activationId !== undefined && (typeof value.activationId !== "string" || !HASH.test(value.activationId)) || value.activatedAt !== undefined && !iso(value.activatedAt) || value.activationId === undefined !== (value.activatedAt === undefined))
+  if (!APP_ID.test(appId) || !NAME.test(channel) || !iso(value.promotedAt) || typeof value.rollout !== "number" || value.rollout < 0 || value.rollout > 1 || value.releaseId !== undefined && (typeof value.releaseId !== "string" || !RELEASE.test(value.releaseId)) || value.fallbackReleaseId !== undefined && (typeof value.fallbackReleaseId !== "string" || !RELEASE.test(value.fallbackReleaseId)) || value.promotionId !== undefined && (typeof value.promotionId !== "string" || !HASH.test(value.promotionId)) || value.activationId !== undefined && (typeof value.activationId !== "string" || !HASH.test(value.activationId)) || value.activatedAt !== undefined && !iso(value.activatedAt) || value.activationId === undefined !== (value.activatedAt === undefined))
     throw new MobileUpdateRegistryError("Mobile update channel is invalid");
   return {
     ...value.activationId ? { activationId: value.activationId } : {},
@@ -20129,6 +20173,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
     channel,
     ...value.fallbackReleaseId ? { fallbackReleaseId: value.fallbackReleaseId } : {},
     format: MOBILE_UPDATE_REGISTRY_FORMAT,
+    ...value.promotionId ? { promotionId: value.promotionId } : {},
     promotedAt: value.promotedAt,
     ...value.releaseId ? { releaseId: value.releaseId } : {},
     rollout: value.rollout
@@ -20151,7 +20196,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
     return true;
   const value = createHash15("sha256").update(`${input.appId}\x00${input.channel}\x00${input.releaseId}\x00${input.installationId}`).digest().readUInt32BE(0);
   return value / 4294967296 < input.rollout;
-}, base64Url = (value) => Buffer.from(value).toString("base64url"), healthPromotionId = (channel) => digest(new TextEncoder().encode(`${channel.appId}\x00${channel.channel}\x00${channel.releaseId ?? "embedded"}\x00${channel.promotedAt}`)), finiteMetric = (value, field2) => {
+}, base64Url = (value) => Buffer.from(value).toString("base64url"), healthPromotionId = (channel) => channel.promotionId ?? digest(new TextEncoder().encode(`${channel.appId}\x00${channel.channel}\x00${channel.releaseId ?? "embedded"}\x00${channel.promotedAt}`)), finiteMetric = (value, field2) => {
   if (typeof value !== "number" || !Number.isFinite(value) || value < 0)
     throw new MobileUpdateRegistryError(`Mobile update health ${field2} is invalid`);
   return value;
@@ -20172,10 +20217,15 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
   const prefix = normalizedPrefix(options.prefix ?? DEFAULT_PREFIX);
   const clock = options.clock ?? (() => new Date);
   const health = options.health;
+  const rollout = options.rollout;
   if (health && health.secret.length < 32)
     throw new MobileUpdateRegistryError("Mobile update health secret must contain at least 32 characters");
   if (health && !options.store.list)
     throw new MobileUpdateRegistryError("Mobile update health requires storage lifecycle listing");
+  if (rollout && (!health || !options.store.list))
+    throw new MobileUpdateRegistryError("Mobile update rollout orchestration requires fleet health and storage lifecycle listing");
+  if (rollout && (rollout.stages.length === 0 || rollout.stages.some((stage, index) => stage.rollout <= 0 || stage.rollout > 1 || !Number.isSafeInteger(stage.minimumReports) || stage.minimumReports < 1 || !Number.isSafeInteger(stage.observationMs) || stage.observationMs < 0 || stage.maximumFailureRate < 0 || stage.maximumFailureRate >= 1 || index > 0 && stage.rollout <= rollout.stages[index - 1].rollout)))
+    throw new MobileUpdateRegistryError("Mobile update rollout stages are invalid");
   const minimumReports = health?.autoPause?.minimumReports ?? 20;
   const failureThreshold = health?.autoPause?.failureRate ?? 0.2;
   if (health && (!Number.isSafeInteger(minimumReports) || minimumReports < 1 || failureThreshold <= 0 || failureThreshold > 1))
@@ -20188,6 +20238,8 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
   const tombstoneKey = (appId, releaseId) => `${root(appId)}/gc/${releaseId}.json`;
   const healthRoot = (appId, promotionId, releaseId) => `${root(appId)}/health/${promotionId}/${releaseId}`;
   const pauseKey = (appId, promotionId, releaseId) => `${healthRoot(appId, promotionId, releaseId)}/paused.json`;
+  const rolloutRoot = (appId, promotionId, releaseId) => `${healthRoot(appId, promotionId, releaseId)}/rollout`;
+  const rolloutPlanKey = (appId, promotionId, releaseId) => `${rolloutRoot(appId, promotionId, releaseId)}/plan.json`;
   const channelKey = (appId, channel) => {
     if (!APP_ID.test(appId) || !NAME.test(channel))
       throw new MobileUpdateRegistryError("Mobile update channel identity is invalid");
@@ -20216,6 +20268,81 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
       throw new MobileUpdateRegistryError("Stored mobile update channel identity changed");
     return value;
   };
+  const listPrefix = async (value) => {
+    const objects = [];
+    const cursors = new Set;
+    let cursor;
+    do {
+      const page = await options.store.list({
+        ...cursor ? { cursor } : {},
+        prefix: value
+      });
+      objects.push(...page.objects);
+      if (!page.truncated)
+        break;
+      if (!page.cursor || cursors.has(page.cursor))
+        throw new MobileUpdateRegistryError("Mobile update storage returned an invalid cursor");
+      cursors.add(page.cursor);
+      cursor = page.cursor;
+    } while (true);
+    return objects;
+  };
+  const readVerifiedObject = async (key, label) => {
+    const bytes = await options.store.get(key);
+    if (!bytes)
+      return null;
+    const head = await options.store.head(key);
+    if (!head || head.size !== bytes.byteLength || head.metadata?.sha256 !== digest(bytes))
+      throw new MobileUpdateRegistryError(`Stored mobile update ${label} integrity failed`);
+    return decode2(bytes);
+  };
+  const parseRolloutPlan = (value, promotionId, releaseId) => {
+    if (!object6(value) || value.format !== 1 || value.promotionId !== promotionId || value.releaseId !== releaseId || typeof value.automatic !== "boolean" || !iso(value.createdAt) || !Array.isArray(value.stages))
+      throw new MobileUpdateRegistryError("Stored mobile update rollout plan is invalid");
+    const stages = value.stages.map((stage) => {
+      if (!object6(stage) || typeof stage.rollout !== "number" || typeof stage.maximumFailureRate !== "number" || !Number.isSafeInteger(stage.minimumReports) || !Number.isSafeInteger(stage.observationMs))
+        throw new MobileUpdateRegistryError("Stored mobile update rollout plan is invalid");
+      return {
+        maximumFailureRate: stage.maximumFailureRate,
+        minimumReports: stage.minimumReports,
+        observationMs: stage.observationMs,
+        rollout: stage.rollout
+      };
+    });
+    if (stages.length === 0 || stages.some((stage, index) => stage.rollout <= 0 || stage.rollout > 1 || stage.minimumReports < 1 || stage.observationMs < 0 || stage.maximumFailureRate < 0 || stage.maximumFailureRate >= 1 || index > 0 && stage.rollout <= stages[index - 1].rollout))
+      throw new MobileUpdateRegistryError("Stored mobile update rollout plan is invalid");
+    return {
+      automatic: value.automatic,
+      createdAt: value.createdAt,
+      format: 1,
+      promotionId,
+      releaseId,
+      stages
+    };
+  };
+  const initializeRollout = async (channel, signal) => {
+    if (!rollout || !channel.releaseId)
+      return;
+    if (!rollout.stages.some((stage) => stage.rollout === channel.rollout))
+      throw new MobileUpdateRegistryError("Mobile update promotion rollout must match a configured rollout stage");
+    const promotionId = healthPromotionId(channel);
+    const plan = {
+      automatic: rollout.automatic ?? false,
+      createdAt: channel.promotedAt,
+      format: 1,
+      promotionId,
+      releaseId: channel.releaseId,
+      stages: rollout.stages.map((stage) => ({ ...stage }))
+    };
+    const bytes = json(plan);
+    await options.store.put(rolloutPlanKey(channel.appId, promotionId, channel.releaseId), bytes, {
+      cacheControl: "no-store",
+      contentType: "application/json",
+      maxBytes: bytes.byteLength,
+      metadata: { releaseid: channel.releaseId, sha256: digest(bytes) },
+      signal
+    });
+  };
   const signHealthToken = (payload) => {
     if (!health)
       return null;
@@ -20254,12 +20381,15 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
     if (await options.store.head(tombstoneKey(appId, releaseId)))
       throw new MobileUpdateRegistryError("Mobile update release is marked for collection. Increase retention and apply garbage collection to restore it before promotion");
   };
-  const writeChannel = async (input, signal) => {
+  const writeChannel = async (input, signal, beforeWrite) => {
+    const promotedAt = clock().toISOString();
     const value = {
       ...input,
       format: MOBILE_UPDATE_REGISTRY_FORMAT,
-      promotedAt: clock().toISOString()
+      promotedAt,
+      promotionId: digest(new TextEncoder().encode(`${input.appId}\x00${input.channel}\x00${input.releaseId ?? "embedded"}\x00${promotedAt}\x00${randomUUID5()}`))
     };
+    await beforeWrite?.(value);
     const bytes = json(value);
     await options.store.put(channelKey(value.appId, value.channel), bytes, {
       cacheControl: "no-cache",
@@ -20274,10 +20404,92 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
     });
     return value;
   };
+  const rolloutContext = async (channel) => {
+    if (!options.store.list || !channel.releaseId)
+      return null;
+    const promotionId = healthPromotionId(channel);
+    const storedPlan = await readVerifiedObject(rolloutPlanKey(channel.appId, promotionId, channel.releaseId), "rollout plan");
+    if (storedPlan === null)
+      return null;
+    const plan = parseRolloutPlan(storedPlan, promotionId, channel.releaseId);
+    const initialStage = plan.stages.findIndex((stage) => stage.rollout === channel.rollout);
+    if (initialStage < 0)
+      throw new MobileUpdateRegistryError("Stored mobile update rollout does not match its plan");
+    let currentStage = initialStage;
+    let enteredAt = plan.createdAt;
+    const advances = await listPrefix(`${rolloutRoot(channel.appId, promotionId, channel.releaseId)}/advances/`);
+    for (const item of advances) {
+      const value = await readVerifiedObject(item.key, "rollout advancement");
+      if (!object6(value) || value.format !== 1 || value.promotionId !== promotionId || value.releaseId !== channel.releaseId || !Number.isSafeInteger(value.stage) || Number(value.stage) < initialStage || Number(value.stage) >= plan.stages.length || value.rollout !== plan.stages[Number(value.stage)].rollout || !iso(value.createdAt) || typeof value.failureRate !== "number" || !Number.isSafeInteger(value.terminalReports))
+        throw new MobileUpdateRegistryError("Stored mobile update rollout advancement is invalid");
+      if (Number(value.stage) >= currentStage) {
+        currentStage = Number(value.stage);
+        enteredAt = value.createdAt;
+      }
+    }
+    const controls = await listPrefix(`${rolloutRoot(channel.appId, promotionId, channel.releaseId)}/controls/`);
+    const parsedControls = [];
+    for (const item of controls) {
+      const value = await readVerifiedObject(item.key, "rollout control");
+      if (!object6(value) || value.format !== 1 || value.promotionId !== promotionId || value.releaseId !== channel.releaseId || typeof value.id !== "string" || value.action !== "pause" && value.action !== "resume" && value.action !== "cancel" || !iso(value.createdAt) || value.resumedPauseIds !== undefined && (!Array.isArray(value.resumedPauseIds) || value.resumedPauseIds.some((id) => typeof id !== "string")))
+        throw new MobileUpdateRegistryError("Stored mobile update rollout control is invalid");
+      parsedControls.push(value);
+    }
+    const cancelled = parsedControls.some(({ action }) => action === "cancel");
+    const resumedPauseIds = new Set(parsedControls.flatMap((control) => control.resumedPauseIds ?? []));
+    const activePauseIds = parsedControls.filter(({ action, id }) => action === "pause" && !resumedPauseIds.has(id)).map(({ id }) => id);
+    const operatorPaused = activePauseIds.length > 0;
+    const fleetPaused = Boolean(await options.store.head(pauseKey(channel.appId, promotionId, channel.releaseId)));
+    return {
+      cancelled,
+      activePauseIds,
+      channel,
+      currentStage,
+      enteredAt,
+      fleetPaused,
+      operatorPaused,
+      plan,
+      promotionId,
+      rollout: plan.stages[currentStage].rollout
+    };
+  };
+  const writeRolloutControl = async (channel, action, signal) => {
+    const context = await rolloutContext(channel);
+    if (!context)
+      throw new MobileUpdateRegistryError("Mobile update rollout orchestration is not configured");
+    if (context.cancelled)
+      throw new MobileUpdateRegistryError("Mobile update rollout was already cancelled");
+    if (action === "resume" && context.fleetPaused)
+      throw new MobileUpdateRegistryError("A fleet-health pause requires an explicit re-promotion");
+    const releaseId = channel.releaseId;
+    if (!releaseId)
+      throw new MobileUpdateRegistryError("Mobile update channel does not have an active release");
+    const createdAt = clock().toISOString();
+    const id = randomUUID5();
+    const event = {
+      action,
+      createdAt,
+      format: 1,
+      id,
+      promotionId: context.promotionId,
+      releaseId,
+      ...action === "resume" ? { resumedPauseIds: context.activePauseIds } : {}
+    };
+    const bytes = json(event);
+    await options.store.put(`${rolloutRoot(channel.appId, context.promotionId, releaseId)}/controls/${createdAt}-${id}-${action}.json`, bytes, {
+      cacheControl: "no-store",
+      contentType: "application/json",
+      maxBytes: bytes.byteLength,
+      metadata: { action, sha256: digest(bytes) },
+      signal
+    });
+  };
   const promoteUpdate = async (input) => {
     input.signal?.throwIfAborted();
     if (input.rollout <= 0 || input.rollout > 1)
       throw new MobileUpdateRegistryError("Mobile update rollout is invalid");
+    if (rollout && !rollout.stages.some((stage) => stage.rollout === input.rollout))
+      throw new MobileUpdateRegistryError("Mobile update promotion rollout must match a configured rollout stage");
     await assertNotMarked(input.appId, input.releaseId);
     const release = await readManifest(input.appId, input.releaseId);
     if (!release || release.manifest.channel !== input.channel)
@@ -20289,7 +20501,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
       ...existing?.releaseId && existing.releaseId !== input.releaseId ? { fallbackReleaseId: existing.releaseId } : existing?.fallbackReleaseId ? { fallbackReleaseId: existing.fallbackReleaseId } : {},
       releaseId: input.releaseId,
       rollout: input.rollout
-    }, input.signal);
+    }, input.signal, (channel) => initializeRollout(channel, input.signal));
     return {
       appId: input.appId,
       channel: input.channel,
@@ -20302,14 +20514,15 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
     const channel = await readChannel(input.appId, input.channel);
     if (!channel?.releaseId)
       return { status: "empty" };
+    const rolloutState = await rolloutContext(channel);
     let selected = rolloutMember({
       appId: input.appId,
       channel: input.channel,
       installationId: input.installationId,
       releaseId: channel.releaseId,
-      rollout: channel.rollout
+      rollout: rolloutState?.rollout ?? channel.rollout
     }) ? channel.releaseId : channel.fallbackReleaseId;
-    if (health && selected === channel.releaseId && await options.store.head(pauseKey(input.appId, healthPromotionId(channel), channel.releaseId)))
+    if (selected === channel.releaseId && (rolloutState?.cancelled || rolloutState?.fleetPaused || rolloutState?.operatorPaused || health && await options.store.head(pauseKey(input.appId, healthPromotionId(channel), channel.releaseId))))
       selected = channel.fallbackReleaseId;
     if (!selected)
       return { status: "empty" };
@@ -20353,23 +20566,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
     if (!channel || !releaseId || channel.releaseId !== releaseId)
       return null;
     const promotionId = healthPromotionId(channel);
-    const prefix2 = `${healthRoot(input.appId, promotionId, releaseId)}/events/`;
-    const objects = [];
-    const cursors = new Set;
-    let cursor;
-    do {
-      const page = await options.store.list({
-        ...cursor ? { cursor } : {},
-        prefix: prefix2
-      });
-      objects.push(...page.objects);
-      if (!page.truncated)
-        break;
-      if (!page.cursor || cursors.has(page.cursor))
-        throw new MobileUpdateRegistryError("Mobile update health storage returned an invalid cursor");
-      cursors.add(page.cursor);
-      cursor = page.cursor;
-    } while (true);
+    const objects = await listPrefix(`${healthRoot(input.appId, promotionId, releaseId)}/events/`);
     const installations = new Set;
     const byKind = new Map([...HEALTH_KINDS].map((kind) => [
       kind,
@@ -20408,6 +20605,7 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
     ]);
     const terminals = new Set([...byKind.get("activated"), ...failures]);
     const failureRate = terminals.size === 0 ? 0 : failures.size / terminals.size;
+    const rolloutState = await rolloutContext(channel);
     return {
       activated: byKind.get("activated").size,
       appId: input.appId,
@@ -20416,17 +20614,107 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
       downloadFailed: byKind.get("download-failed").size,
       failureRate,
       failures: failures.size,
-      paused: Boolean(await options.store.head(pauseKey(input.appId, promotionId, releaseId))),
+      paused: Boolean(rolloutState?.cancelled || rolloutState?.fleetPaused || rolloutState?.operatorPaused || await options.store.head(pauseKey(input.appId, promotionId, releaseId))),
       promotionId,
       quarantined: byKind.get("quarantined").size,
       releaseId,
       reportedInstallations: installations.size,
       rolledBack: byKind.get("rolled-back").size,
-      rollout: channel.rollout,
+      rollout: rolloutState?.rollout ?? channel.rollout,
       terminalReports: terminals.size,
       transfer
     };
   };
+  const inspectUpdateRollout = async (input) => {
+    const channel = await readChannel(input.appId, input.channel);
+    if (!channel?.releaseId)
+      return null;
+    const context = await rolloutContext(channel);
+    if (!context)
+      throw new MobileUpdateRegistryError("Mobile update rollout orchestration is not configured");
+    const healthReport = await inspectUpdateHealth(input);
+    if (!healthReport)
+      return null;
+    const paused = context.fleetPaused || context.operatorPaused;
+    const complete = context.currentStage === context.plan.stages.length - 1;
+    return {
+      ...healthReport,
+      automatic: context.plan.automatic,
+      currentStage: context.currentStage,
+      enteredAt: context.enteredAt,
+      ...!complete ? { nextStage: context.plan.stages[context.currentStage + 1] } : {},
+      ...context.fleetPaused ? { pausedBy: "fleet-health" } : context.operatorPaused ? { pausedBy: "operator" } : {},
+      status: context.cancelled ? "cancelled" : paused ? "paused" : complete ? "complete" : "active"
+    };
+  };
+  const advanceRollout = async (input, strict) => {
+    input.signal?.throwIfAborted();
+    const channel = await readChannel(input.appId, input.channel);
+    if (!channel?.releaseId)
+      throw new MobileUpdateRegistryError("Mobile update channel does not have an active release");
+    const context = await rolloutContext(channel);
+    if (!context)
+      throw new MobileUpdateRegistryError("Mobile update rollout orchestration is not configured");
+    const report = await inspectUpdateRollout(input);
+    if (!report)
+      throw new MobileUpdateRegistryError("Mobile update rollout report is unavailable");
+    const nextStage = context.plan.stages[context.currentStage + 1];
+    if (!nextStage)
+      return report;
+    if (input.rollout !== undefined && input.rollout !== nextStage.rollout)
+      throw new MobileUpdateRegistryError("Mobile update rollout can advance only to the next configured stage");
+    if (report.status !== "active") {
+      if (strict)
+        throw new MobileUpdateRegistryError(`Mobile update rollout cannot advance while ${report.status}`);
+      return report;
+    }
+    const gate = context.plan.stages[context.currentStage];
+    const observedMs = clock().getTime() - Date.parse(context.enteredAt);
+    const blocked = report.terminalReports < gate.minimumReports || report.failureRate > gate.maximumFailureRate || observedMs < gate.observationMs;
+    if (blocked) {
+      if (strict)
+        throw new MobileUpdateRegistryError(`Mobile update rollout needs ${gate.minimumReports} terminal reports, at most ${(gate.maximumFailureRate * 100).toFixed(1)}% failures, and ${gate.observationMs}ms observation at the current stage`);
+      return report;
+    }
+    const stage = context.currentStage + 1;
+    const event = {
+      createdAt: clock().toISOString(),
+      failureRate: report.failureRate,
+      format: 1,
+      promotionId: context.promotionId,
+      releaseId: channel.releaseId,
+      rollout: nextStage.rollout,
+      stage,
+      terminalReports: report.terminalReports
+    };
+    const bytes = json(event);
+    await options.store.put(`${rolloutRoot(input.appId, context.promotionId, channel.releaseId)}/advances/${String(stage).padStart(4, "0")}.json`, bytes, {
+      cacheControl: "no-store",
+      contentType: "application/json",
+      maxBytes: bytes.byteLength,
+      metadata: { releaseid: channel.releaseId, sha256: digest(bytes) },
+      signal: input.signal
+    });
+    return await inspectUpdateRollout(input);
+  };
+  const advanceUpdateRollout = (input) => advanceRollout(input, true);
+  const reconcileUpdateRollout = async (input) => {
+    const report = await inspectUpdateRollout(input);
+    if (!report || !report.automatic)
+      return report;
+    return advanceRollout(input, false);
+  };
+  const rolloutControl = (action) => async (input) => {
+    input.signal?.throwIfAborted();
+    const channel = await readChannel(input.appId, input.channel);
+    if (!channel?.releaseId)
+      throw new MobileUpdateRegistryError("Mobile update channel does not have an active release");
+    await writeRolloutControl(channel, action, input.signal);
+    return await inspectUpdateRollout(input);
+  };
+  const pauseUpdateRollout = rolloutControl("pause");
+  const resumeUpdateRollout = rolloutControl("resume");
+  const cancelUpdateRollout = rolloutControl("cancel");
   const recordUpdateHealth = async (input) => {
     const payload = verifyHealthToken(input.token);
     if (payload.appId !== input.appId || payload.channel !== input.channel || payload.installationId !== input.installationId || payload.releaseId !== input.releaseId || payload.runtimeFingerprint !== input.runtimeFingerprint || !HEALTH_KINDS.has(input.kind) || input.reason !== undefined && input.reason !== "boot-interrupted" && input.reason !== "boot-timeout")
@@ -20481,6 +20769,11 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
       });
       report = { ...report, paused: true };
     }
+    if (rollout && (input.kind === "activated" || FAILURE_HEALTH_KINDS.has(input.kind)))
+      return await reconcileUpdateRollout({
+        appId: input.appId,
+        channel: input.channel
+      }) ?? report;
     return report;
   };
   const retentionValues = (input) => {
@@ -20726,6 +21019,14 @@ var MOBILE_UPDATE_REGISTRY_FORMAT = 1, DEFAULT_PREFIX = "absolutejs/mobile-updat
   };
   return {
     ...health ? { inspectUpdateHealth, issueUpdateHealthToken, recordUpdateHealth } : {},
+    ...rollout ? {
+      advanceUpdateRollout,
+      cancelUpdateRollout,
+      inspectUpdateRollout,
+      pauseUpdateRollout,
+      reconcileUpdateRollout,
+      resumeUpdateRollout
+    } : {},
     inspectUpdateStorage: async (input) => (await inventory(input)).report,
     pruneUpdates,
     publishUpdate: async (input) => {
@@ -21339,6 +21640,11 @@ var ABSOLUTE_MOBILE_UPDATE_SERVER_FORMAT = 1, DEFAULT_MOBILE_UPDATE_REGISTRY_MOD
     return;
   if (typeof module.registry.inspectUpdateHealth !== "function" || typeof module.registry.issueUpdateHealthToken !== "function" || typeof module.registry.recordUpdateHealth !== "function")
     throw new TypeError("Mobile update fleet health is enabled but the registry is not provisioned for it. Run `absolute mobile update provision --force`.");
+}, verifyRolloutModule = (config, module) => {
+  if (!config.updateServer?.rollout)
+    return;
+  if (typeof module.registry.advanceUpdateRollout !== "function" || typeof module.registry.cancelUpdateRollout !== "function" || typeof module.registry.inspectUpdateRollout !== "function" || typeof module.registry.pauseUpdateRollout !== "function" || typeof module.registry.reconcileUpdateRollout !== "function" || typeof module.registry.resumeUpdateRollout !== "function")
+    throw new TypeError("Mobile update rollout orchestration is enabled but the registry is not provisioned for it. Run `absolute mobile update provision --force`.");
 }, expoSigningOptions = (config) => {
   if (!config.updates?.expoCodeSigning)
     return;
@@ -21373,6 +21679,7 @@ var ABSOLUTE_MOBILE_UPDATE_SERVER_FORMAT = 1, DEFAULT_MOBILE_UPDATE_REGISTRY_MOD
   if (options.production) {
     await verifyDurableModule(module);
     verifyHealthModule(config, module);
+    verifyRolloutModule(config, module);
   }
   const manifest = new URL(updates.manifestUrl);
   if (!manifest.pathname.endsWith("/update.json"))
@@ -21393,6 +21700,7 @@ var ABSOLUTE_MOBILE_UPDATE_SERVER_FORMAT = 1, DEFAULT_MOBILE_UPDATE_REGISTRY_MOD
   const module = await loadAbsoluteMobileUpdateServerModule(projectRoot, config.updateServer?.registryModule);
   await verifyDurableModule(module);
   verifyHealthModule(config, module);
+  verifyRolloutModule(config, module);
   if (config.engine === "expo")
     expoSigningOptions(config);
   return module.metadata;
@@ -21464,17 +21772,25 @@ export default createMobileUpdateRegistry({
 `;
 }, renderAbsoluteMobileUpdateRegistry = (options) => {
   const source = renderAbsoluteMobileUpdateRegistryBase(options);
-  if (!options.health)
-    return source;
-  const secret = options.storage === "local" ? `process.env.${options.health.secretEnv} ?? 'absolutejs-local-health-secret-not-for-production'` : `required('${options.health.secretEnv}')`;
-  const health = `	health: {
+  let generated = "";
+  if (options.health) {
+    const secret = options.storage === "local" ? `process.env.${options.health.secretEnv} ?? 'absolutejs-local-health-secret-not-for-production'` : `required('${options.health.secretEnv}')`;
+    generated += `	health: {
 		autoPause: { failureRate: ${options.health.failureRate}, minimumReports: ${options.health.minimumReports} },
 		secret: ${secret}
 	},
 `;
+  }
+  if (options.rollout)
+    generated += `	rollout: ${JSON.stringify(options.rollout, null, "\t").replaceAll(`
+`, `
+	`)},
+`;
+  if (!generated)
+    return source;
   return source.replace(`export default createMobileUpdateRegistry({
 `, `export default createMobileUpdateRegistry({
-${health}`);
+${generated}`);
 }, writeAbsoluteMobileUpdateRegistry = async (options) => {
   const path2 = projectPath3(options.projectRoot, options.modulePath ?? DEFAULT_MOBILE_UPDATE_REGISTRY_MODULE);
   if (!options.force) {
@@ -21487,6 +21803,7 @@ ${health}`);
   await mkdir18(dirname19(path2), { recursive: true });
   await Bun.write(path2, renderAbsoluteMobileUpdateRegistry({
     ...options.health ? { health: options.health } : {},
+    ...options.rollout ? { rollout: options.rollout } : {},
     publicKeys: options.publicKeys,
     storage: options.storage
   }));
@@ -39554,14 +39871,7 @@ var lifecycleMethod = (publisher, name) => {
     throw new TypeError(`Mobile update registry does not support ${name}. Re-run \`absolute mobile update provision --force\` after upgrading @absolutejs/deploy.`);
   return method;
 };
-var inspectAbsoluteMobileUpdateHealth = async (options) => {
-  const report = await lifecycleMethod(options.publisher, "inspectUpdateHealth")({
-    appId: options.appId,
-    channel: options.channel,
-    ...options.releaseId ? { releaseId: options.releaseId } : {}
-  });
-  if (report === null)
-    return null;
+var validateHealthReport = (report, options) => {
   if (!object5(report) || report.appId !== options.appId || report.channel !== options.channel || options.releaseId !== undefined && report.releaseId !== options.releaseId || typeof report.paused !== "boolean" || ![
     report.activated,
     report.downloaded,
@@ -39582,6 +39892,45 @@ var inspectAbsoluteMobileUpdateHealth = async (options) => {
     throw new TypeError("Mobile update registry returned an invalid health report.");
   return report;
 };
+var inspectAbsoluteMobileUpdateHealth = async (options) => {
+  const report = await lifecycleMethod(options.publisher, "inspectUpdateHealth")({
+    appId: options.appId,
+    channel: options.channel,
+    ...options.releaseId ? { releaseId: options.releaseId } : {}
+  });
+  if (report === null)
+    return null;
+  return validateHealthReport(report, options);
+};
+var validateRolloutReport = (report, options) => {
+  validateHealthReport(report, options);
+  const validStage = (stage) => stage === undefined || object5(stage) && Number.isFinite(stage.rollout) && stage.rollout > 0 && stage.rollout <= 1 && Number.isSafeInteger(stage.minimumReports) && stage.minimumReports > 0 && Number.isSafeInteger(stage.observationMs) && stage.observationMs >= 0 && Number.isFinite(stage.maximumFailureRate) && stage.maximumFailureRate >= 0 && stage.maximumFailureRate < 1;
+  if (typeof report.automatic !== "boolean" || !Number.isSafeInteger(report.currentStage) || report.currentStage < 0 || !Number.isFinite(Date.parse(report.enteredAt)) || !["active", "cancelled", "complete", "paused"].includes(report.status) || report.pausedBy !== undefined && report.pausedBy !== "fleet-health" && report.pausedBy !== "operator" || !validStage(report.nextStage) || report.paused !== (report.status === "paused" || report.status === "cancelled"))
+    throw new TypeError("Mobile update registry returned an invalid rollout report.");
+  return report;
+};
+var inspectAbsoluteMobileUpdateRollout = async (options) => {
+  const report = await lifecycleMethod(options.publisher, "inspectUpdateRollout")({ appId: options.appId, channel: options.channel });
+  return report === null ? null : validateRolloutReport(report, options);
+};
+var mutateAbsoluteMobileUpdateRollout = async (method, options) => validateRolloutReport(await lifecycleMethod(options.publisher, method)({
+  appId: options.appId,
+  channel: options.channel,
+  ...method === "advanceUpdateRollout" && options.rollout !== undefined ? { rollout: options.rollout } : {},
+  ...options.signal ? { signal: options.signal } : {}
+}), options);
+var advanceAbsoluteMobileUpdateRollout = (options) => mutateAbsoluteMobileUpdateRollout("advanceUpdateRollout", options);
+var cancelAbsoluteMobileUpdateRollout = (options) => mutateAbsoluteMobileUpdateRollout("cancelUpdateRollout", options);
+var pauseAbsoluteMobileUpdateRollout = (options) => mutateAbsoluteMobileUpdateRollout("pauseUpdateRollout", options);
+var reconcileAbsoluteMobileUpdateRollout = async (options) => {
+  const report = await lifecycleMethod(options.publisher, "reconcileUpdateRollout")({
+    appId: options.appId,
+    channel: options.channel,
+    ...options.signal ? { signal: options.signal } : {}
+  });
+  return report === null ? null : validateRolloutReport(report, options);
+};
+var resumeAbsoluteMobileUpdateRollout = (options) => mutateAbsoluteMobileUpdateRollout("resumeUpdateRollout", options);
 var validOptionalCounters = (values) => values.every((value) => value === undefined) || values.every((value) => Number.isSafeInteger(value) && (value ?? -1) >= 0);
 var validateStorageIdentity = (result, appId) => {
   if (!object5(result) || result.appId !== appId || !Array.isArray(result.releases) || ![
@@ -39782,6 +40131,7 @@ export {
   acceptsAbsoluteRouteData,
   acquireAbsoluteRemoteMacReleaseLease,
   activateAbsoluteMobilePage,
+  advanceAbsoluteMobileUpdateRollout,
   applyAbsoluteNativeDeepLinks,
   applyAbsoluteNativeDeviceCapabilities,
   applyAbsoluteNativeObservability,
@@ -39793,6 +40143,7 @@ export {
   buildAbsoluteMobileCompatibilityRelease,
   buildAbsoluteMobileUpdate,
   buildAbsoluteRemoteIosRelease,
+  cancelAbsoluteMobileUpdateRollout,
   canonicalizeAbsoluteMobileUpdate,
   captureAbsoluteMobileRouteGraph,
   captureAbsoluteRemoteMacCommand,
@@ -39844,6 +40195,7 @@ export {
   inspectAbsoluteAndroidInstalledApp,
   inspectAbsoluteMobileRouteMetadata,
   inspectAbsoluteMobileUpdateHealth,
+  inspectAbsoluteMobileUpdateRollout,
   inspectAbsoluteMobileUpdateServer,
   inspectAbsoluteMobileUpdateStorage,
   inspectAbsoluteRemoteMac,
@@ -39895,6 +40247,7 @@ export {
   parseIosDeviceTypes,
   parseIosRuntimes,
   parseIosSimulators,
+  pauseAbsoluteMobileUpdateRollout,
   planAbsoluteExpoDevSession,
   prepareAbsoluteAndroidRelease,
   prepareAbsoluteIosDevProject,
@@ -39910,6 +40263,7 @@ export {
   readAbsoluteMobileLinkIntent,
   readAbsoluteMobileMaterializedReleases,
   readAbsoluteMobileUpdate,
+  reconcileAbsoluteMobileUpdateRollout,
   redactAbsoluteIosLog,
   removeAbsoluteRemoteMacProfile,
   renderAbsoluteMobileUpdateRegistry,
@@ -39925,6 +40279,7 @@ export {
   resolveAbsoluteMobileNavigation,
   resolveAbsoluteMobileRoute,
   resolveAbsoluteMobileUpdateRuntime,
+  resumeAbsoluteMobileUpdateRollout,
   retainAbsoluteMobileCompatibilityArtifacts,
   rollbackAbsoluteMobileUpdate,
   runAbsoluteAndroidUpgradeConformance,
@@ -39953,5 +40308,5 @@ export {
   writeAbsoluteMobileUpdateRegistry
 };
 
-//# debugId=01F0CE93B9ED6BCC64756E2164756E21
+//# debugId=DB548297ABB3C7C964756E2164756E21
 //# sourceMappingURL=index.js.map