@deslop/scope 0.1.1235 → 0.1.1239

package/dist/server.js

@@ -4007,7 +4007,7 @@ const min$1 = (O) => dual(2, (self, that) => self === that || O(self, that) < 1
 * @category comparisons
 * @since 2.0.0
 */
-const max$2 = (O) => dual(2, (self, that) => self === that || O(self, that) > -1 ? self : that);
+const max$3 = (O) => dual(2, (self, that) => self === that || O(self, that) > -1 ? self : that);
 // ../../node_modules/.pnpm/effect@4.1.2/node_modules/effect/dist/Option.js
 /**
 * Creates an `Option` representing the absence of a value.
@@ -4525,6 +4525,63 @@ const map$11 = /*#__PURE__*/ dual(2, (self, f) => isNone(self) ? none() : some$1
 */
 const flatMap$7 = /*#__PURE__*/ dual(2, (self, f) => isNone(self) ? none() : f(self.value));
 /**
+* Combines a structure of `Option`s (tuple, struct, or iterable) into a single
+* `Option` containing the unwrapped structure.
+*
+* **When to use**
+*
+* Use when you need to combine multiple `Option` values into one while
+* preserving the input shape, with any `None` making the result `None`.
+*
+* **Details**
+*
+* - Tuple input → `Option` of a tuple with the same length
+* - Struct input → `Option` of a struct with the same keys
+* - Iterable input → `Option` of an `Array`
+* - Any `None` in the input → entire result is `None`
+*
+* **Example** (Combining a tuple and a struct)
+*
+* ```ts import.meta.vitest
+* import { Option } from "effect"
+*
+* const maybeName: Option.Option<string> = Option.some("John")
+* const maybeAge: Option.Option<number> = Option.some(25)
+*
+* //      ┌─── Option<[string, number]>
+* //      ▼
+* const tuple = Option.all([maybeName, maybeAge]) // => Option.some(["John", 25])
+*
+* //      ┌─── Option<{ name: string; age: number; }>
+* //      ▼
+* const struct = Option.all({ name: maybeName, age: maybeAge }) // => Option.some({ name: "John", age: 25 })
+* ```
+*
+* @see {@link product} for combining exactly two
+* @see {@link productMany} for a homogeneous collection
+*
+* @stability stable
+* @category combining
+* @since 2.0.0
+*/
+const all$4 = (input) => {
+	if (Symbol.iterator in input) {
+		const out = [];
+		for (const o of input) {
+			if (isNone(o)) return none();
+			out.push(o.value);
+		}
+		return some$1(out);
+	}
+	const out = {};
+	for (const key of Object.keys(input)) {
+		const o = input[key];
+		if (isNone(o)) return none();
+		assignProperty(out, key, o.value);
+	}
+	return some$1(out);
+};
+/**
 * Converts an `Option` into an `Array`.
 *
 * **When to use**
@@ -6169,7 +6226,7 @@ const values$2 = (self) => collect$1(self, (_, a) => a);
 * @category mutations
 * @since 2.0.0
 */
-const set$6 = /*#__PURE__*/ dual(3, (self, key, value) => {
+const set$7 = /*#__PURE__*/ dual(3, (self, key, value) => {
 	return {
 		...self,
 		[key]: value
@@ -6208,6 +6265,31 @@ const isSubrecordBy = (equivalence) => dual(2, (self, that) => {
 	return true;
 });
 /**
+* Merges two records, preserving entries that exist in either of the records.
+* For keys that exist in both records, the provided combine function is used to merge the values.
+*
+* **Example** (Merging records with union)
+*
+* ```ts import.meta.vitest
+* import { Record } from "effect"
+*
+* Record.union({ a: 1, b: 2 }, { b: 3, c: 4 }, (a, b) => a + b) // => { a: 1, b: 5, c: 4 }
+* ```
+*
+* @stability stable
+* @category combining
+* @since 2.0.0
+*/
+const union$2 = /*#__PURE__*/ dual(3, (self, that, combine) => {
+	if (isEmptyRecord(self)) return { ...that };
+	if (isEmptyRecord(that)) return { ...self };
+	const out = empty$12();
+	for (const key of keys$1(self)) if (has$4(that, key)) assignProperty(out, key, combine(self[key], that[key]));
+	else assignProperty(out, key, self[key]);
+	for (const key of keys$1(that)) if (!has$4(out, key)) assignProperty(out, key, that[key]);
+	return out;
+});
+/**
 * Create an `Equivalence` for records using the provided `Equivalence` for values.
 * Two records are considered equivalent if they have the same keys and their corresponding values are equivalent.
 *
@@ -7259,6 +7341,26 @@ const some = /*#__PURE__*/ dual(2, (self, predicate) => self.some(predicate));
 */
 const min = /*#__PURE__*/ dual(2, (self, O) => self.reduce(min$1(O)));
 /**
+* Returns the maximum element of a non-empty array according to the given
+* `Order`.
+*
+* **Example** (Finding the maximum)
+*
+* ```ts import.meta.vitest
+* import { Array, Order } from "effect"
+*
+* Array.max([3, 1, 2], Order.Number) // => 3
+* ```
+*
+* @see {@link min} — find the minimum
+* @see {@link sort} — sort the entire array
+*
+* @stability stable
+* @category getters
+* @since 2.0.0
+*/
+const max$2 = /*#__PURE__*/ dual(2, (self, O) => self.reduce(max$3(O)));
+/**
 * Builds an array by repeatedly applying a function to a seed value. The
 * function returns `Option.some([element, nextSeed])` to continue, or
 * `Option.none()` to stop.
@@ -7505,15 +7607,15 @@ const DURATION_REGEXP = /^(-?\d+(?:\.\d+)?)\s+(nanos?|micros?|millis?|seconds?|m
 const fromInputUnsafe$1 = (input) => {
 	switch (typeof input) {
 		case "number": return millis(input);
-		case "bigint": return nanos(input);
+		case "bigint": return nanos$1(input);
 		case "string": {
 			if (input === "Infinity") return infinity;
 			if (input === "-Infinity") return negativeInfinity;
 			const match = DURATION_REGEXP.exec(input);
 			if (!match) break;
 			const [_, valueStr, unit] = match;
-			if (unit === "nano" || unit === "nanos") return nanos(parseNanos(valueStr, bigint1$2));
-			if (unit === "micro" || unit === "micros") return nanos(parseNanos(valueStr, bigint1e3));
+			if (unit === "nano" || unit === "nanos") return nanos$1(parseNanos(valueStr, bigint1$2));
+			if (unit === "micro" || unit === "micros") return nanos$1(parseNanos(valueStr, bigint1e3));
 			switch (unit) {
 				case "milli":
 				case "millis": return fromMillisString(valueStr, 1);
@@ -7841,7 +7943,7 @@ const negativeInfinity = /*#__PURE__*/ make$80(-Infinity);
 * @category constructors
 * @since 2.0.0
 */
-const nanos = (nanos) => make$80(nanos);
+const nanos$1 = (nanos) => make$80(nanos);
 /**
 * Creates a Duration from milliseconds.
 *
@@ -8118,7 +8220,7 @@ const Equivalence$3 = (self, that) => matchPair(self, that, {
 * @category ordering
 * @since 2.0.0
 */
-const max$1 = /*#__PURE__*/ max$2(Order$4);
+const max$1 = /*#__PURE__*/ max$3(Order$4);
 /**
 * Adds two Durations together.
 *
@@ -8842,6 +8944,38 @@ var EncodingError = class extends (/*#__PURE__*/ TaggedError$1("EncodingError"))
 	*/
 	[EncodingErrorTypeId] = EncodingErrorTypeId;
 };
+// ../../node_modules/.pnpm/effect@4.1.2/node_modules/effect/dist/encoding/Hex.js
+/**
+* Hexadecimal encoding, decoding, and random value helpers.
+*
+* @stability stable
+* @since 4.0.0
+*/
+/**
+* Encodes the given value into a hex `string`.
+*
+* **When to use**
+*
+* Use to encode text or bytes as lowercase hexadecimal text.
+*
+* **Example** (Encoding hex strings and bytes)
+*
+* ```ts import.meta.vitest
+* import { Hex } from "effect/encoding"
+*
+* // Encode a string to hex
+* Hex.encode("hello") // => "68656c6c6f"
+*
+* // Encode binary data to hex
+* const bytes = new Uint8Array([72, 101, 108, 108, 111])
+* Hex.encode(bytes) // => "48656c6c6f"
+* ```
+*
+* @stability stable
+* @category encoding
+* @since 4.0.0
+*/
+const encode$1 = (input) => typeof input === "string" ? hexEncodeUint8Array(encoder$5.encode(input)) : hexEncodeUint8Array(input);
 /**
 * Generates a random lowercase hexadecimal string, optimized for lengths that
 * are multiples of 8.
@@ -8891,6 +9025,71 @@ const random32 = () => {
 	const d = randomWord();
 	return String.fromCharCode(hexCharCodes[a >>> 28], hexCharCodes[a >>> 24 & 15], hexCharCodes[a >>> 20 & 15], hexCharCodes[a >>> 16 & 15], hexCharCodes[a >>> 12 & 15], hexCharCodes[a >>> 8 & 15], hexCharCodes[a >>> 4 & 15], hexCharCodes[a & 15], hexCharCodes[b >>> 28], hexCharCodes[b >>> 24 & 15], hexCharCodes[b >>> 20 & 15], hexCharCodes[b >>> 16 & 15], hexCharCodes[b >>> 12 & 15], hexCharCodes[b >>> 8 & 15], hexCharCodes[b >>> 4 & 15], hexCharCodes[b & 15], hexCharCodes[c >>> 28], hexCharCodes[c >>> 24 & 15], hexCharCodes[c >>> 20 & 15], hexCharCodes[c >>> 16 & 15], hexCharCodes[c >>> 12 & 15], hexCharCodes[c >>> 8 & 15], hexCharCodes[c >>> 4 & 15], hexCharCodes[c & 15], hexCharCodes[d >>> 28], hexCharCodes[d >>> 24 & 15], hexCharCodes[d >>> 20 & 15], hexCharCodes[d >>> 16 & 15], hexCharCodes[d >>> 12 & 15], hexCharCodes[d >>> 8 & 15], hexCharCodes[d >>> 4 & 15], hexCharCodes[d & 15]);
 };
+/**
+* Decodes a hexadecimal string into bytes safely.
+*
+* **When to use**
+*
+* Use to decode hexadecimal text into bytes without throwing on invalid input.
+*
+* **Details**
+*
+* Returns `Result.succeed` with a `Uint8Array` when decoding succeeds, or
+* `Result.fail` with an `EncodingError` when the input has an odd length or
+* contains invalid hex characters.
+*
+* **Example** (Decoding hex bytes)
+*
+* ```ts import.meta.vitest
+* import { Result } from "effect"
+* import { Hex } from "effect/encoding"
+*
+* Hex.decode("48656c6c6f") // => Result.succeed(new Uint8Array([72, 101, 108, 108, 111]))
+* ```
+*
+* @stability stable
+* @category decoding
+* @since 4.0.0
+*/
+const decode$2 = (str) => {
+	const bytes = new TextEncoder().encode(str);
+	if (bytes.length % 2 !== 0) return fail$11(new EncodingError({
+		module: "Hex",
+		kind: "Decode",
+		input: str,
+		message: `Length must be a multiple of 2, but is ${bytes.length}`
+	}));
+	try {
+		const length = bytes.length / 2;
+		const result = new Uint8Array(length);
+		for (let i = 0; i < length; i++) {
+			const a = fromHexChar(bytes[i * 2]);
+			const b = fromHexChar(bytes[i * 2 + 1]);
+			result[i] = a << 4 | b;
+		}
+		return succeed$10(result);
+	} catch (e) {
+		return fail$11(new EncodingError({
+			module: "Hex",
+			kind: "Decode",
+			input: str,
+			message: e instanceof Error ? e.message : "Invalid input"
+		}));
+	}
+};
+const encoder$5 = /*#__PURE__*/ new TextEncoder();
+const byteToHex = /*#__PURE__*/ Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, "0"));
+const hexEncodeUint8Array = (bytes) => {
+	let result = "";
+	for (let i = 0; i < bytes.length; i++) result += byteToHex[bytes[i]];
+	return result;
+};
+const fromHexChar = (byte) => {
+	if (48 <= byte && byte <= 57) return byte - 48;
+	if (97 <= byte && byte <= 102) return byte - 97 + 10;
+	if (65 <= byte && byte <= 70) return byte - 65 + 10;
+	throw new TypeError("Invalid input");
+};
 // ../../node_modules/.pnpm/effect@4.1.2/node_modules/effect/dist/Tracer.js
 /**
 * Defines the low-level tracing model used by Effect.
@@ -15375,7 +15574,7 @@ const increment$1 = (n) => n + 1;
 * @category math
 * @since 2.0.0
 */
-const max = /*#__PURE__*/ max$2(Number$6);
+const max = /*#__PURE__*/ max$3(Number$6);
 /**
 * Parses a `number` from a `string` safely using the `Number()` function.
 * The following special string values are supported: "NaN", "Infinity", "-Infinity".
@@ -15531,6 +15730,23 @@ const capitalize = (self) => {
 */
 const replace = (searchValue, replaceValue) => (self) => self.replace(searchValue, replaceValue);
 /**
+* Extracts a section of a string and returns it as a new string.
+*
+* **Example** (Slicing strings)
+*
+* ```ts import.meta.vitest
+* import { pipe, String } from "effect"
+*
+* pipe("abcd", String.slice(1, 3)) // => "bc"
+* pipe("hello world", String.slice(0, 5)) // => "hello"
+* ```
+*
+* @stability stable
+* @category transforming
+* @since 2.0.0
+*/
+const slice = (start, end) => (self) => self.slice(start, end);
+/**
 * Checks whether a `string` is non-empty.
 *
 * **Example** (Checking for non-empty strings)
@@ -15643,6 +15859,23 @@ const endsWith = (searchString, position) => (self) => self.endsWith(searchStrin
 */
 const match$3 = (regExp) => (self) => fromNullOr(self.match(regExp));
 /**
+* Pads the string from the start with a given fill string to a specified length.
+*
+* **Example** (Padding strings at the start)
+*
+* ```ts import.meta.vitest
+* import { pipe, String } from "effect"
+*
+* pipe("a", String.padStart(5)) // => "    a"
+* pipe("a", String.padStart(5, "_")) // => "____a"
+* ```
+*
+* @stability stable
+* @category transforming
+* @since 2.0.0
+*/
+const padStart = (maxLength, fillString) => (self) => self.padStart(maxLength, fillString);
+/**
 * Replaces all occurrences of a substring or pattern in a string.
 *
 * **Example** (Replacing all matches)
@@ -16414,7 +16647,7 @@ const getFromBucket = (self, bucket, key) => {
 * @category mutations
 * @since 2.0.0
 */
-const set$5 = /*#__PURE__*/ dual(3, (self, key, value) => {
+const set$6 = /*#__PURE__*/ dual(3, (self, key, value) => {
 	if (self.backing.has(key) || isSimpleKey(key)) {
 		self.backing.set(key, value);
 		return self;
@@ -23224,7 +23457,7 @@ const increment = (bytes) => {
 	return false;
 };
 // ../../node_modules/.pnpm/effect@4.1.2/node_modules/effect/dist/internal/uuid.js
-const hex = /*#__PURE__*/ Array.from({ length: 256 }, (_, byte) => byte.toString(16).padStart(2, "0"));
+const hex$1 = /*#__PURE__*/ Array.from({ length: 256 }, (_, byte) => byte.toString(16).padStart(2, "0"));
 /** @internal */
 const stringify = (bytes) => {
 	if (bytes.length < 16) return [
@@ -23233,8 +23466,8 @@ const stringify = (bytes) => {
 		bytes.subarray(6, 8),
 		bytes.subarray(8, 10),
 		bytes.subarray(10, 16)
-	].map((segment) => Array.from(segment, (byte) => hex[byte]).join("")).join("-");
-	return hex[bytes[0]] + hex[bytes[1]] + hex[bytes[2]] + hex[bytes[3]] + "-" + hex[bytes[4]] + hex[bytes[5]] + "-" + hex[bytes[6]] + hex[bytes[7]] + "-" + hex[bytes[8]] + hex[bytes[9]] + "-" + hex[bytes[10]] + hex[bytes[11]] + hex[bytes[12]] + hex[bytes[13]] + hex[bytes[14]] + hex[bytes[15]];
+	].map((segment) => Array.from(segment, (byte) => hex$1[byte]).join("")).join("-");
+	return hex$1[bytes[0]] + hex$1[bytes[1]] + hex$1[bytes[2]] + hex$1[bytes[3]] + "-" + hex$1[bytes[4]] + hex$1[bytes[5]] + "-" + hex$1[bytes[6]] + hex$1[bytes[7]] + "-" + hex$1[bytes[8]] + hex$1[bytes[9]] + "-" + hex$1[bytes[10]] + hex$1[bytes[11]] + hex$1[bytes[12]] + hex$1[bytes[13]] + hex$1[bytes[14]] + hex$1[bytes[15]];
 };
 /** @internal */
 const v4Bytes = (bytes) => {
@@ -27403,7 +27636,7 @@ const checkSaltLength = (algorithm, cryptoKey) => {
 * @category services
 * @since 4.0.0
 */
-var Signature = class extends (/*#__PURE__*/ Service$2()("effect/crypto/Signature")) {};
+var Signature$1 = class extends (/*#__PURE__*/ Service$2()("effect/crypto/Signature")) {};
 /**
 * Layer that provides `Signature` on the `WebCrypto` reference.
 *
@@ -27417,11 +27650,11 @@ var Signature = class extends (/*#__PURE__*/ Service$2()("effect/crypto/Signatur
 * @category layers
 * @since 4.0.0
 */
-const layerWebCrypto$1 = /*#__PURE__*/ effect(Signature, /*#__PURE__*/ gen(function* () {
+const layerWebCrypto$1 = /*#__PURE__*/ effect(Signature$1, /*#__PURE__*/ gen(function* () {
 	const random = yield* SecureRandom;
 	const crypto = yield* WebCrypto;
 	const caches = makeCaches(family);
-	return Signature.of({
+	return Signature$1.of({
 		generateKeyPair: (algorithm) => generateKeyPair(family, crypto, random, algorithm, generateParams(algorithm)),
 		sign: (privateKey, data) => run$6("Signature", "sign", privateKey.algorithm.name, crypto, async (subtle) => {
 			const cryptoKey = await caches.privateKey(subtle, privateKey);
@@ -28213,7 +28446,7 @@ const setHash$1 = (self, key, hash, value) => {
 	return new HashMapImpl(false, impl._edit, newRoot, impl._size + (added.value ? 1 : 0));
 };
 /** @internal */
-const set$4 = /*#__PURE__*/ dual(3, (self, key, value) => {
+const set$5 = /*#__PURE__*/ dual(3, (self, key, value) => {
 	return setHash$1(self, key, hash(key), value);
 });
 /** @internal */
@@ -28311,7 +28544,7 @@ const fromIterable$4 = fromIterable$5;
 * @category transforming
 * @since 2.0.0
 */
-const set$3 = set$4;
+const set$4 = set$5;
 /**
 * Returns an `IterableIterator` of the values within the `HashMap`.
 *
@@ -28397,7 +28630,7 @@ const make$67 = (...values) => fromIterable$3(values);
 /** @internal */
 const fromIterable$3 = (values) => {
 	let map = empty$8();
-	for (const value of values) map = set$4(map, value, true);
+	for (const value of values) map = set$5(map, value, true);
 	return makeImpl(map);
 };
 /** @internal */
@@ -28405,7 +28638,7 @@ const has$1 = (self, value) => has$2(keyMap(self), value);
 /** @internal */
 const add$2 = (self, value) => {
 	const map = keyMap(self);
-	return has$2(map, value) ? self : makeImpl(set$4(map, value, true));
+	return has$2(map, value) ? self : makeImpl(set$5(map, value, true));
 };
 /** @internal */
 const size = (self) => size$1(keyMap(self));
@@ -29165,7 +29398,7 @@ const get$6 = /*#__PURE__*/ dual(2, (self, key) => fromUndefinedOr(self[key.toLo
 * @category combinators
 * @since 4.0.0
 */
-const set$2 = /*#__PURE__*/ dual(3, (self, key, value) => {
+const set$3 = /*#__PURE__*/ dual(3, (self, key, value) => {
 	const out = make$64(self);
 	out[key.toLowerCase()] = value;
 	return out;
@@ -29432,7 +29665,7 @@ const parseRetryAfter$1 = (input) => {
 	const trimmed = input.trim();
 	if (wholeSeconds.test(trimmed)) {
 		const seconds$1 = Number(trimmed);
-		const duration = Number.isSafeInteger(seconds$1 * 1e3) ? seconds(seconds$1) : nanos(BigInt(trimmed) * nanosPerSecond);
+		const duration = Number.isSafeInteger(seconds$1 * 1e3) ? seconds(seconds$1) : nanos$1(BigInt(trimmed) * nanosPerSecond);
 		return succeed$10({
 			_tag: "Duration",
 			duration
@@ -30994,6 +31227,33 @@ function encodeBase64() {
 	return transform$2(encode);
 }
 /**
+* Encodes a `Uint8Array` or string to a hexadecimal string.
+*
+* **Details**
+*
+* The getter is pure and never fails.
+*
+* **Example** (Encoding to hex)
+*
+* ```ts import.meta.vitest
+* import { Effect, Option, SchemaGetter } from "effect"
+*
+* const encode = SchemaGetter.encodeHex<Uint8Array>()
+* const result = Effect.runSync(SchemaGetter.run(encode, Option.some(new Uint8Array([1, 2, 3])), {}))
+* result // => Option.some("010203")
+* ```
+*
+* @see {@link decodeHex} for the inverse operation to `Uint8Array`
+* @see {@link decodeHexString} for the inverse operation to `string`
+*
+* @stability stable
+* @category encoding
+* @since 4.0.0
+*/
+function encodeHex() {
+	return transform$2(encode$1);
+}
+/**
 * Decodes a Base64 string to a `Uint8Array`.
 *
 * **Details**
@@ -31021,6 +31281,36 @@ function decodeBase64() {
 	return transformEffect$1((input, options) => mapErrorEager(fromResult(decode$1(input)), () => new InvalidValue$1({ expected: "a valid Base64 string" }, input, options)));
 }
 /**
+* Decodes a hexadecimal string to a `Uint8Array`.
+*
+* **Details**
+*
+* - Fails with `SchemaIssue.InvalidValue` if the input is not valid hex.
+*
+* **Example** (Decoding hex to bytes)
+*
+* ```ts import.meta.vitest
+* import { Effect, Option, SchemaGetter } from "effect"
+*
+* const decode = SchemaGetter.decodeHex<string>()
+* const result = await Effect.runPromise(SchemaGetter.run(decode, Option.some("010203"), {}))
+* Option.map(result, Array.from) // => Option.some([1, 2, 3])
+* ```
+*
+* @see {@link decodeHexString} to decode to `string` instead
+* @see {@link encodeHex} for the inverse operation
+*
+* @stability stable
+* @category decoding
+* @since 4.0.0
+*/
+function decodeHex() {
+	return transformEffect$1((input, options) => match$7(decode$2(input), {
+		onFailure: () => fail$6(new InvalidValue$1({ expected: "a valid hexadecimal string" }, input, options)),
+		onSuccess: succeed$5
+	}));
+}
+/**
 * Encodes a present string using `encodeURIComponent`.
 *
 * **Details**
@@ -34205,6 +34495,12 @@ function decodeUnknownEffect$1(schema, options) {
 	const parser = run$5(schema.ast);
 	return options === void 0 ? parser : (input, overrideOptions) => parser(input, mergeParseOptions(options, overrideOptions));
 }
+/** @internal */
+function decodeUnknownOption$1(schema, options) {
+	return asOption(decodeUnknownEffect$1(schema, options));
+}
+/** @internal */
+const decodeOption$1 = decodeUnknownOption$1;
 /**
 * Creates a decoder for `unknown` input that reports failure safely as a
 * `Result`.
@@ -34290,6 +34586,16 @@ function runWithCompiler(compiler, ast) {
 function asExit(parser) {
 	return (input, options) => runSyncExit(parser(input, options));
 }
+/** @internal */
+function asOption(parser) {
+	const parserExit = asExit(parser);
+	return (input, options) => {
+		const exit = parserExit(input, options);
+		if (isSuccess(exit)) return some$1(exit.value);
+		getSchemaIssueOrThrow(exit.cause, "Option adapter can only return none for schema issues");
+		return none();
+	};
+}
 function asResult(parser) {
 	const parserExit = asExit(parser);
 	return (input, options) => {
@@ -36748,6 +37054,61 @@ function decodeUnknownEffect(schema, options) {
 */
 const decodeEffect = decodeUnknownEffect;
 /**
+* Decodes an `unknown` input against a schema, returning an `Option` that is
+* `Some` with the decoded value on success or `None` for schema mismatches.
+*
+* **When to use**
+*
+* Use when you do not know the input type statically and only need to know
+* whether decoding succeeded.
+*
+* **Details**
+*
+* Prefer this over {@link decodeUnknownExit} or {@link decodeUnknownEffect}
+* when you don't need error details. For input already typed as the schema's
+* `Encoded` type use {@link decodeOption}.
+* Options may be provided either when creating the decoder or when applying it;
+* application options override creation options.
+*
+* **Gotchas**
+*
+* Only causes made entirely of schema issues are converted to `None`. Causes
+* that contain defects, interruptions, or other non-schema reasons throw
+* instead.
+*
+* @stability stable
+* @category decoding
+* @since 3.10.0
+*/
+const decodeUnknownOption = decodeUnknownOption$1;
+/**
+* Decodes a typed input (the schema's `Encoded` type) against a schema,
+* returning an `Option` that is `Some` with the decoded value on success or
+* `None` for schema mismatches.
+*
+* **When to use**
+*
+* Use when you already have input typed as the schema's `Encoded` type and
+* only need to know whether decoding succeeded.
+*
+* **Details**
+*
+* For `unknown` input use {@link decodeUnknownOption}.
+* Options may be provided either when creating the decoder or when applying it;
+* application options override creation options.
+*
+* **Gotchas**
+*
+* Only causes made entirely of schema issues are converted to `None`. Causes
+* that contain defects, interruptions, or other non-schema reasons throw
+* instead.
+*
+* @stability stable
+* @category decoding
+* @since 3.10.0
+*/
+const decodeOption = decodeOption$1;
+/**
 * Decodes an `unknown` input against a schema, returning a `Result` that
 * succeeds with the decoded value or fails with a {@link SchemaError} for schema
 * mismatches.
@@ -38547,6 +38908,26 @@ const Uint8Array$2 = /*#__PURE__*/ instanceOf(globalThis.Uint8Array, {
 */
 const Uint8ArrayFromBase64 = /*#__PURE__*/ Base64String.pipe(/*#__PURE__*/ decodeTo(Uint8Array$2, uint8ArrayFromBase64String));
 /**
+* Schema that decodes a hex encoded string into a
+* `Uint8Array`.
+*
+* **Details**
+*
+* Decoding:
+* - A **valid** hex encoded string is decoded as a `Uint8Array`.
+*
+* Encoding:
+* - A `Uint8Array` is encoded as a hex encoded string.
+*
+* @stability stable
+* @category schemas
+* @since 3.10.0
+*/
+const Uint8ArrayFromHex = /*#__PURE__*/ String$6.annotate({ expected: "a hex encoded string that will be decoded as a Uint8Array" }).pipe(/*#__PURE__*/ decodeTo(Uint8Array$2, {
+	decode: /*#__PURE__*/ decodeHex(),
+	encode: /*#__PURE__*/ encodeHex()
+}));
+/**
 * Creates a schema for `Cause.Reason` values using separate schemas for typed
 * failures and unexpected defects.
 *
@@ -38806,7 +39187,7 @@ const Duration = /*#__PURE__*/ declare(isDuration, {
 			switch (e._tag) {
 				case "Infinity": return infinity;
 				case "NegativeInfinity": return negativeInfinity;
-				case "Nanos": return nanos(e.value);
+				case "Nanos": return nanos$1(e.value);
 				case "Millis": return millis(e.value);
 			}
 		},
@@ -38931,7 +39312,7 @@ function Exit(value, error, defect) {
 * @category schemas
 * @since 3.10.0
 */
-function Redacted(value, options) {
+function Redacted$1(value, options) {
 	const label = typeof options?.label === "string" ? options.label : void 0;
 	const disallowJsonEncode = options?.disallowJsonEncode === true;
 	const normalizedOptions = label !== void 0 ? disallowJsonEncode ? {
@@ -39631,7 +40012,7 @@ const make$58 = (value) => {
 * @category mutations
 * @since 2.0.0
 */
-const set$1 = /*#__PURE__*/ dual(2, (self, value) => {
+const set$2 = /*#__PURE__*/ dual(2, (self, value) => {
 	self.current = value;
 	return self;
 });
@@ -39893,7 +40274,7 @@ const subscribe = (self) => uninterruptible(contextWith((services) => {
 	return addFinalizer$1(scope, unsubscribe(subscription)).pipe(andThen(addFinalizerExit(localScope, (exit) => close(scope, exit))), as(subscription));
 }));
 const unsubscribe = (self) => uninterruptible(withFiber((state) => {
-	set$1(self.shutdownFlag, true);
+	set$2(self.shutdownFlag, true);
 	return forEach$1(takeAll$2(self.pollers), (d) => interruptWith(d, state.id), {
 		discard: true,
 		concurrency: "unbounded"
@@ -43303,7 +43684,7 @@ const get$4 = /*#__PURE__*/ dual(2, (self, key) => uninterruptibleMask((restore)
 			refCount: 1
 		};
 		entry.finalizer = release$1(self, key, entry);
-		set$5(state.map, key, entry);
+		set$6(state.map, key, entry);
 		const context = new Map(self.context.mapUnsafe);
 		parent.context.mapUnsafe.forEach((value, key) => {
 			context.set(key, value);
@@ -46426,6 +46807,46 @@ function Record(key, value, pathOrOptions, options) {
 function Port$1(name) {
 	return schema$1(PortSchema, name);
 }
+/**
+* Creates a config for a redacted string value. The parsed result is wrapped
+* in a `Redacted` container that hides the value from logs and `toString`.
+*
+* **When to use**
+*
+* Use to read secret string settings that should not be exposed in logs or
+* string output.
+*
+* **Details**
+*
+* Shortcut for `Config.schema(Schema.Redacted(Schema.String), name)`.
+*
+* **Example** (Reading a secret)
+*
+* ```ts import.meta.vitest
+* import { Config, ConfigProvider, Effect } from "effect"
+*
+* const program = Config.Redacted("API_KEY").pipe(Effect.map(String))
+*
+* const provider = ConfigProvider.fromEnv({
+*   env: {
+*     API_KEY: "sk-1234567890abcdef"
+*   }
+* })
+*
+* Effect.runSync(
+*   program.pipe(Effect.provideService(ConfigProvider.ConfigProvider, provider))
+* ) // => "<redacted>"
+* ```
+*
+* @see {@link String} for non-secret string settings
+*
+* @stability stable
+* @category constructors
+* @since 2.0.0
+*/
+function Redacted(name) {
+	return schema$1(Redacted$1(String$6), name);
+}
 // ../../node_modules/.pnpm/effect@4.1.2/node_modules/effect/dist/Console.js
 /**
 * Context reference for the current console service in the Effect system, allowing access to the active console implementation from within the Effect context.
@@ -47788,6 +48209,42 @@ const make$45 = (value) => sync(() => makeUnsafe$1(value));
 */
 const get$1 = (self) => sync(() => self.ref.current);
 /**
+* Sets the value of the Ref to the specified value.
+*
+* **When to use**
+*
+* Use to replace the current `Ref` value with a known value.
+*
+* **Example** (Setting a value)
+*
+* ```ts import.meta.vitest
+* import { Effect, Ref } from "effect"
+*
+* const program = Effect.gen(function*() {
+*   const ref = yield* Ref.make(0)
+*   yield* Ref.set(ref, 42)
+*   return yield* Ref.get(ref)
+* })
+*
+* const program2 = Effect.gen(function*() {
+*   const ref = yield* Ref.make(0)
+*   yield* Ref.set(ref, 100)
+*   return yield* Ref.get(ref)
+* })
+*
+* await Effect.runPromise(program) // => 42
+* await Effect.runPromise(program2) // => 100
+* ```
+*
+* @see {@link getAndSet} for setting while returning the previous value
+* @see {@link setAndGet} for setting while returning the new value
+*
+* @stability stable
+* @category mutations
+* @since 2.0.0
+*/
+const set$1 = /*#__PURE__*/ dual(2, (self, value) => sync(() => set$2(self.ref, value)));
+/**
 * Updates the value of the Ref atomically using the given function.
 *
 * **When to use**
@@ -48821,7 +49278,7 @@ const getCurrentVersion = () => currentVersion;
 */
 const HttpResponseDetails = /*#__PURE__*/ Struct({
 	status: Int$1,
-	headers: Record$1(String$6, Union([String$6, Redacted(String$6)]))
+	headers: Record$1(String$6, Union([String$6, Redacted$1(String$6)]))
 }).annotate({ identifier: "HttpResponseDetails" });
 const ReasonTypeId = "~effect/ai/AiError/Reason";
 const providerMetadataWithDefaults = () => ProviderMetadata.pipe(withConstructorDefault(succeed$5({})), withDecodingDefault(succeed$5({})));
@@ -51090,7 +51547,7 @@ const encodeText = buffer !== void 0 ? (body) => buffer.from(body, "utf8") : (bo
 * @category constructors
 * @since 4.0.0
 */
-const text$1 = (body, contentType) => {
+const text$2 = (body, contentType) => {
 	if (typeof body !== "string") body = body === void 0 ? "" : String(body);
 	if (buffer !== void 0) return new Uint8Array$1(void 0, contentType ?? "text/plain", buffer.byteLength(body, "utf8"), body);
 	const bytes = encoder$2.encode(body);
@@ -51107,7 +51564,7 @@ const text$1 = (body, contentType) => {
 * @category constructors
 * @since 4.0.0
 */
-const jsonUnsafe$1 = (body, contentType) => text$1(JSON.stringify(body), contentType ?? "application/json");
+const jsonUnsafe$1 = (body, contentType) => text$2(JSON.stringify(body), contentType ?? "application/json");
 /**
 * Creates a JSON HTTP body in an `Effect`.
 *
@@ -51120,7 +51577,7 @@ const jsonUnsafe$1 = (body, contentType) => text$1(JSON.stringify(body), content
 * @since 4.0.0
 */
 const json$1 = (body, contentType) => try_({
-	try: () => text$1(JSON.stringify(body), contentType ?? "application/json"),
+	try: () => text$2(JSON.stringify(body), contentType ?? "application/json"),
 	catch: (cause) => new HttpBodyError({
 		reason: { _tag: "JsonError" },
 		cause
@@ -51506,7 +51963,7 @@ const compressBody$1 = (body, algorithm, options) => {
 */
 const updateHeaders = (headers, body) => {
 	if (body._tag === "Empty" || body._tag === "FormData") return remove$1(remove$1(headers, "content-type"), "content-length");
-	headers = body.contentType === void 0 ? remove$1(headers, "content-type") : set$2(headers, "content-type", body.contentType);
+	headers = body.contentType === void 0 ? remove$1(headers, "content-type") : set$3(headers, "content-type", body.contentType);
 	return updateContentLength(headers, body);
 };
 /**
@@ -51514,7 +51971,7 @@ const updateHeaders = (headers, body) => {
 */
 const updateContentLength = (headers, body) => {
 	const contentLength = body._tag === "Empty" || body._tag === "FormData" ? void 0 : body.contentLength;
-	return contentLength === void 0 ? remove$1(headers, "content-length") : set$2(headers, "content-length", contentLength.toString());
+	return contentLength === void 0 ? remove$1(headers, "content-length") : set$3(headers, "content-length", contentLength.toString());
 };
 // ../../node_modules/.pnpm/effect@4.1.2/node_modules/effect/dist/http/Url.js
 /**
@@ -51665,7 +52122,7 @@ const setMethod = /*#__PURE__*/ dual(2, (self, method) => makeWith$1(method, sel
 * @category combinators
 * @since 4.0.0
 */
-const setHeader$1 = /*#__PURE__*/ dual(3, (self, key, value) => makeWith$1(self.method, self.url, self.urlParams, self.hash, set$2(self.headers, key, value), self.body));
+const setHeader$1 = /*#__PURE__*/ dual(3, (self, key, value) => makeWith$1(self.method, self.url, self.urlParams, self.hash, set$3(self.headers, key, value), self.body));
 /**
 * Sets multiple request headers from an input collection, replacing existing values with matching names.
 *
@@ -51765,7 +52222,7 @@ const setBody$1 = /*#__PURE__*/ dual(2, (self, body) => {
 */
 const compressBody = /*#__PURE__*/ dual((args) => isHttpClientRequest(args[0]), (self, algorithm, options) => {
 	if (self.headers["content-encoding"] !== void 0) return succeed$5(self);
-	return map$5(compressBody$1(self.body, algorithm, options), (body) => body === self.body ? self : makeWith$1(self.method, self.url, self.urlParams, self.hash, set$2(updateContentLength(self.headers, body), "content-encoding", algorithm), body));
+	return map$5(compressBody$1(self.body, algorithm, options), (body) => body === self.body ? self : makeWith$1(self.method, self.url, self.urlParams, self.hash, set$3(updateContentLength(self.headers, body), "content-encoding", algorithm), body));
 });
 /**
 * Sets a JSON request body using unsafe JSON encoding.
@@ -53183,7 +53640,7 @@ const makeCollectorUnsafe = () => {
 *
 * @internal
 */
-const spanName = (spanPrefix, tag) => spanPrefix === void 0 ? tag : `${spanPrefix}.${tag}`;
+const spanName$1 = (spanPrefix, tag) => spanPrefix === void 0 ? tag : `${spanPrefix}.${tag}`;
 /**
 * Default RPC span attributes, overridden by user `spanAttributes`.
 *
@@ -57210,7 +57667,7 @@ function decodeValueUnchecked(layout, r) {
 			}
 		}
 		case "duration": switch (r.byte()) {
-			case 0: return nanos(r.zigzag());
+			case 0: return nanos$1(r.zigzag());
 			case 1: return infinity;
 			case 2: return negativeInfinity;
 			default: return invalid("duration", void 0, r.options);
@@ -57798,7 +58255,7 @@ const makeNoSerialization$1 = /*#__PURE__*/ fnUntraced(function* (group, options
 			const context = opts?.context ?? empty$14();
 			if (!isStream) {
 				const onRequest = (span) => onEffectRequest(rpc, middleware, span, rpc.payloadSchema.make(payload), headers, context, opts?.discard ?? false);
-				return disableTracing ? onRequest(void 0) : useSpan(spanName(spanPrefix, rpc._tag), {
+				return disableTracing ? onRequest(void 0) : useSpan(spanName$1(spanPrefix, rpc._tag), {
 					kind: "client",
 					attributes: spanAttributes(rpc._tag, options.spanAttributes)
 				}, onRequest);
@@ -57861,7 +58318,7 @@ const makeNoSerialization$1 = /*#__PURE__*/ fnUntraced(function* (group, options
 	});
 	const onStreamRequest = fnUntraced(function* (rpc, middleware, payload, headers, streamBufferSize, context) {
 		if (isShutdown) return yield* interrupt$1;
-		const span = disableTracing ? void 0 : yield* makeSpanScoped(spanName(spanPrefix, rpc._tag), {
+		const span = disableTracing ? void 0 : yield* makeSpanScoped(spanName$1(spanPrefix, rpc._tag), {
 			kind: "client",
 			attributes: spanAttributes(rpc._tag, options.spanAttributes)
 		});
@@ -63817,14 +64274,14 @@ const getContentType = (options, headers) => {
 * @category constructors
 * @since 4.0.0
 */
-const text = (body, options) => {
+const text$1 = (body, options) => {
 	const headers = options?.headers ? fromInput$1(options.headers) : empty$6;
 	return makeResponse({
 		status: options?.status ?? 200,
 		statusText: options?.statusText,
 		headers,
 		cookies: options?.cookies ?? empty$7,
-		body: text$1(body, getContentType(options, headers))
+		body: text$2(body, getContentType(options, headers))
 	});
 };
 /**
@@ -63932,7 +64389,7 @@ const stream$1 = (body, options) => {
 * @category combinators
 * @since 4.0.0
 */
-const setHeader = /*#__PURE__*/ dual(3, (self, key, value) => makeResponse(self, set$2(self.headers, key, value)));
+const setHeader = /*#__PURE__*/ dual(3, (self, key, value) => makeResponse(self, set$3(self.headers, key, value)));
 /**
 * Returns a response with the specified header removed.
 *
@@ -64096,7 +64553,7 @@ const make$26 = /*#__PURE__*/ fnUntraced(function* (impl) {
 			const limit = bytesToRead === void 0 ? void 0 : offset + contentLength;
 			const start = yield* fileResponseNumber(offset, "offset");
 			const end = limit === void 0 ? void 0 : yield* fileResponseNumber(limit, "end");
-			const headers = set$2(optionHeaders(options), "etag", toString(etag));
+			const headers = set$3(optionHeaders(options), "etag", toString(etag));
 			if (isSome(info.mtime)) headers["last-modified"] = info.mtime.value.toUTCString();
 			return impl.fileResponse(path, options?.status ?? 200, options?.statusText, headers, start, end, contentLength);
 		}),
@@ -64113,7 +64570,7 @@ const make$26 = /*#__PURE__*/ fnUntraced(function* (impl) {
 });
 const optionHeaders = (options) => {
 	const headers = options?.headers ? fromInput$1(options.headers) : empty$6;
-	return options?.contentType ? set$2(headers, "content-type", options.contentType) : headers;
+	return options?.contentType ? set$3(headers, "content-type", options.contentType) : headers;
 };
 const fileResponseSize = (input, field) => {
 	const size = fromInput$2(input);
@@ -65728,7 +66185,7 @@ const cors$1 = (options) => {
 	};
 	const preResponseHandler = (request, response) => {
 		const headers = headersFromRequest(request);
-		return succeed$5(setHeaders(response, headers["vary"] === void 0 ? headers : set$2(headers, "vary", varyWith(response.headers, "Origin"))));
+		return succeed$5(setHeaders(response, headers["vary"] === void 0 ? headers : set$3(headers, "vary", varyWith(response.headers, "Origin"))));
 	};
 	return (httpApp) => withFiber((fiber) => {
 		const request = getUnsafe$2(fiber.context, HttpServerRequest);
@@ -68768,7 +69225,7 @@ const makeNoSerialization = /*#__PURE__*/ fnUntraced(function* (group, options)
 		if (opts?.onRequest) effect = opts.onRequest(effect);
 		if (enableTracing) {
 			const parentSpan = getOrUndefined(requestFiber.context, ParentSpan);
-			effect = withSpan(effect, spanName(spanPrefix, request.tag), {
+			effect = withSpan(effect, spanName$1(spanPrefix, request.tag), {
 				captureStackTrace: false,
 				kind: "server",
 				attributes: spanAttributes(request.tag, options.spanAttributes),
@@ -69263,7 +69720,7 @@ const makeProtocolWithHttpEffect = /*#__PURE__*/ fnUntraced(function* (options =
 		if (!includesFraming) {
 			const responses = yield* interruptible(collect(queue));
 			const encoded = parser.encode(responses);
-			return text(encoded === void 0 ? "" : encoded, { contentType: serialization.contentType });
+			return text$1(encoded === void 0 ? "" : encoded, { contentType: serialization.contentType });
 		}
 		const initialChunk = yield* interruptible(catchDone(takeAll$1(queue), () => succeed$5([])));
 		if (queue.state._tag === "Done") return uint8Array(initialChunk.length === 1 ? initialChunk[0] : concat$2(initialChunk), { contentType: serialization.contentType });
@@ -70686,6 +71143,79 @@ const makeUriMatcher = () => {
 	};
 };
 const isProtocolVersion = (version) => version === "2024-11-05" || version === "2025-03-26" || version === "2025-06-18" || version === "2025-11-25" || version === "2026-07-28";
+/**
+* Service that derives bytes from a secret.
+*
+* **Example** (Deriving a key with HKDF)
+*
+* ```ts import.meta.vitest
+* import { Effect } from "effect"
+* import { Kdf } from "effect/crypto"
+*
+* const program = Effect.gen(function*() {
+*   const kdf = yield* Kdf.Kdf
+*   return yield* kdf.derive(Kdf.hkdfSha256, new Uint8Array(32), {
+*     salt: new Uint8Array(16),
+*     info: new TextEncoder().encode("encryption"),
+*     length: 32
+*   })
+* })
+*
+* const bytes = await Effect.runPromise(program.pipe(Effect.provide(Kdf.layerWebCrypto)))
+* bytes.length // => 32
+* ```
+*
+* @stability unstable
+* @category services
+* @since 4.0.0
+*/
+var Kdf = class extends (/*#__PURE__*/ Service$2()("effect/crypto/Kdf")) {};
+const invalidArgument = (description) => fail$5("Kdf", "derive", new InvalidArgument({ description }));
+const isIntegerIn$1 = (n, min, max) => Number.isSafeInteger(n) && n >= min && n <= max;
+const checkArguments = (algorithm, options) => {
+	if (algorithm._tag !== "Hkdf" && options.info !== void 0) return invalidArgument("info only applies to HKDF");
+	if (algorithm._tag === "Argon2id") return void 0;
+	if (algorithm.hash.name === "MD5") return invalidArgument(`${algorithm._tag} needs a SHA hash, not MD5`);
+	if (algorithm._tag === "Hkdf") {
+		const maxLength = 255 * algorithm.hash.outputLength;
+		return isIntegerIn$1(options.length, 1, maxLength) ? void 0 : invalidArgument(`length must be between 1 and ${maxLength} bytes for ${algorithm.name}`);
+	}
+	if (!isIntegerIn$1(algorithm.iterations, 1, 2147483647)) return invalidArgument("iterations must be between 1 and 2^31 - 1");
+	return isIntegerIn$1(options.length, 1, 536870911) ? void 0 : invalidArgument("length must be between 1 and 2^29 - 1 bytes");
+};
+const webCryptoParams = (algorithm, options) => algorithm._tag === "Hkdf" ? {
+	name: "HKDF",
+	hash: algorithm.hash.name,
+	salt: options.salt,
+	info: options.info ?? /* @__PURE__ */ new Uint8Array()
+} : {
+	name: "PBKDF2",
+	hash: algorithm.hash.name,
+	salt: options.salt,
+	iterations: algorithm.iterations
+};
+/**
+* Layer that provides `Kdf` on the `WebCrypto` reference.
+*
+* **Details**
+*
+* HKDF and PBKDF2 run on `crypto.subtle`, off the event loop where the runtime
+* supports it. Argon2id fails with an `Unsupported` reason.
+*
+* @stability unstable
+* @category layers
+* @since 4.0.0
+*/
+const layerWebCrypto = /*#__PURE__*/ effect(Kdf, /*#__PURE__*/ WebCrypto.use((crypto) => succeed$5(Kdf.of({ derive: (algorithm, secret, options) => suspend$2(() => {
+	const failure = checkArguments(algorithm, options);
+	if (failure !== void 0) return failure;
+	if (algorithm._tag === "Argon2id") return fail$5("Kdf", "derive", new Unsupported({ description: "Kdf.layerWebCrypto does not provide argon2id" }));
+	const name = algorithm._tag === "Hkdf" ? "HKDF" : "PBKDF2";
+	return run$6("Kdf", "derive", algorithm.name, crypto, async (subtle) => {
+		const handle = await subtle.importKey("raw", secret, name, false, ["deriveBits"]);
+		return new Uint8Array(await subtle.deriveBits(webCryptoParams(algorithm, options), handle, options.length * 8));
+	});
+}) }))));
 // ../../node_modules/.pnpm/effect@4.1.2/node_modules/effect/dist/http/FetchHttpClient.js
 /**
 * Fetch-based implementation of the Effect HTTP client service.
@@ -76489,79 +77019,6 @@ require_sender();
 require_subprotocol();
 require_websocket();
 var import_websocket_server = /* @__PURE__ */ __toESM(require_websocket_server(), 1);
-/**
-* Service that derives bytes from a secret.
-*
-* **Example** (Deriving a key with HKDF)
-*
-* ```ts import.meta.vitest
-* import { Effect } from "effect"
-* import { Kdf } from "effect/crypto"
-*
-* const program = Effect.gen(function*() {
-*   const kdf = yield* Kdf.Kdf
-*   return yield* kdf.derive(Kdf.hkdfSha256, new Uint8Array(32), {
-*     salt: new Uint8Array(16),
-*     info: new TextEncoder().encode("encryption"),
-*     length: 32
-*   })
-* })
-*
-* const bytes = await Effect.runPromise(program.pipe(Effect.provide(Kdf.layerWebCrypto)))
-* bytes.length // => 32
-* ```
-*
-* @stability unstable
-* @category services
-* @since 4.0.0
-*/
-var Kdf = class extends (/*#__PURE__*/ Service$2()("effect/crypto/Kdf")) {};
-const invalidArgument = (description) => fail$5("Kdf", "derive", new InvalidArgument({ description }));
-const isIntegerIn$1 = (n, min, max) => Number.isSafeInteger(n) && n >= min && n <= max;
-const checkArguments = (algorithm, options) => {
-	if (algorithm._tag !== "Hkdf" && options.info !== void 0) return invalidArgument("info only applies to HKDF");
-	if (algorithm._tag === "Argon2id") return void 0;
-	if (algorithm.hash.name === "MD5") return invalidArgument(`${algorithm._tag} needs a SHA hash, not MD5`);
-	if (algorithm._tag === "Hkdf") {
-		const maxLength = 255 * algorithm.hash.outputLength;
-		return isIntegerIn$1(options.length, 1, maxLength) ? void 0 : invalidArgument(`length must be between 1 and ${maxLength} bytes for ${algorithm.name}`);
-	}
-	if (!isIntegerIn$1(algorithm.iterations, 1, 2147483647)) return invalidArgument("iterations must be between 1 and 2^31 - 1");
-	return isIntegerIn$1(options.length, 1, 536870911) ? void 0 : invalidArgument("length must be between 1 and 2^29 - 1 bytes");
-};
-const webCryptoParams = (algorithm, options) => algorithm._tag === "Hkdf" ? {
-	name: "HKDF",
-	hash: algorithm.hash.name,
-	salt: options.salt,
-	info: options.info ?? /* @__PURE__ */ new Uint8Array()
-} : {
-	name: "PBKDF2",
-	hash: algorithm.hash.name,
-	salt: options.salt,
-	iterations: algorithm.iterations
-};
-/**
-* Layer that provides `Kdf` on the `WebCrypto` reference.
-*
-* **Details**
-*
-* HKDF and PBKDF2 run on `crypto.subtle`, off the event loop where the runtime
-* supports it. Argon2id fails with an `Unsupported` reason.
-*
-* @stability unstable
-* @category layers
-* @since 4.0.0
-*/
-const layerWebCrypto = /*#__PURE__*/ effect(Kdf, /*#__PURE__*/ WebCrypto.use((crypto) => succeed$5(Kdf.of({ derive: (algorithm, secret, options) => suspend$2(() => {
-	const failure = checkArguments(algorithm, options);
-	if (failure !== void 0) return failure;
-	if (algorithm._tag === "Argon2id") return fail$5("Kdf", "derive", new Unsupported({ description: "Kdf.layerWebCrypto does not provide argon2id" }));
-	const name = algorithm._tag === "Hkdf" ? "HKDF" : "PBKDF2";
-	return run$6("Kdf", "derive", algorithm.name, crypto, async (subtle) => {
-		const handle = await subtle.importKey("raw", secret, name, false, ["deriveBits"]);
-		return new Uint8Array(await subtle.deriveBits(webCryptoParams(algorithm, options), handle, options.length * 8));
-	});
-}) }))));
 // ../../node_modules/.pnpm/@effect+platform-node-shared@4.1.2_effect@4.1.2/node_modules/@effect/platform-node-shared/dist/NodeCrypto.js
 /**
 * Node.js layers for the `effect/crypto` modules, also used by Bun.
@@ -86257,7 +86714,7 @@ const make$3 = /*#__PURE__*/ fnUntraced(function* (options) {
 	const exporterUserAgent = `OTel-OTLP-Exporter-JavaScript-Effect-${options.label}/${getCurrentVersion()}`;
 	const userHeaders = fromInput$1(options.headers);
 	const userAgent = userHeaders["user-agent"];
-	const headers = set$2(userHeaders, "user-agent", userAgent ? `${userAgent} ${exporterUserAgent}` : exporterUserAgent);
+	const headers = set$3(userHeaders, "user-agent", userAgent ? `${userAgent} ${exporterUserAgent}` : exporterUserAgent);
 	const request = post(options.url, { headers });
 	const exportsEmpty = options.maxBatchSize === "disabled" && options.exportEmpty === true;
 	let buffer = [];
@@ -86468,7 +86925,7 @@ function jsonReplacer(key, value) {
 }
 const jsonBody = (data) => {
 	const json = JSON.stringify(data);
-	return text$1(json.includes("null") || json.includes("\"bytesValue\":") ? JSON.stringify(data, jsonReplacer) : json, "application/json");
+	return text$2(json.includes("null") || json.includes("\"bytesValue\":") ? JSON.stringify(data, jsonReplacer) : json, "application/json");
 };
 /**
 * Provides `OtlpSerialization` using OTLP/HTTP JSON bodies.
@@ -86828,7 +87285,7 @@ const SpanKind = {
 	consumer: 5
 };
 // ../../packages/runtime/src/telemetry.ts
-function layerOtlp(serviceName, url, runtime) {
+function layerOtlp(serviceName, url, runtime, version) {
 	return unwrap$7(gen(function* () {
 		const start = `${yield* currentTimeNanos}`;
 		const resource = {
@@ -86837,7 +87294,8 @@ function layerOtlp(serviceName, url, runtime) {
 				"scope.runtime": runtime,
 				"service.instance.id": start
 			},
-			serviceName
+			serviceName,
+			serviceVersion: getOrUndefined$1(liftPredicate(version, (current) => current !== "0.1.0"))
 		};
 		return pipe(mergeAll$1(layer({
 			exportInterval: "250 millis",
@@ -86861,7 +87319,7 @@ var RpcAuth = class RpcAuth extends Service$1()("@deslop/runtime/auth/lib/utils/
 	static layerClient = (token) => layerClient(RpcAuth, (options) => gen(function* () {
 		return yield* options.next({
 			...options.request,
-			headers: set$2(options.request.headers, "authorization", `Bearer ${yield* token}`)
+			headers: set$3(options.request.headers, "authorization", `Bearer ${yield* token}`)
 		});
 	}));
 };
@@ -86883,7 +87341,7 @@ function rejected(message) {
 function developer() {
 	return succeed$5(DEVELOPER);
 }
-const unavailable = text("The authorization service is temporarily unavailable; retry later", {
+const unavailable = text$1("The authorization service is temporarily unavailable; retry later", {
 	headers: { "retry-after": "5" },
 	status: 503
 });
@@ -86918,7 +87376,7 @@ middleware()(gen(function* () {
 		const user = yield* result$1(auth.user((yield* HttpServerRequest).headers));
 		if (isFailure$1(user)) {
 			if (user.failure.error === "temporarily_unavailable") return unavailable;
-			return text("Sign in first", { status: 401 });
+			return text$1("Sign in first", { status: 401 });
 		}
 		return yield* provideService(app, CurrentUser, user.success);
 	});
@@ -86930,14 +87388,14 @@ function layerMcpAuth(resource) {
 		return (app) => gen(function* () {
 			const headers = (yield* HttpServerRequest).headers;
 			const challenge = `Bearer resource_metadata="${new URL("/.well-known/oauth-protected-resource/mcp", resource).href}", scope="deslop"`;
-			if (isNone(get$6(headers, "authorization"))) return text("OAuth authorization required; sign in with your MCP client", {
+			if (isNone(get$6(headers, "authorization"))) return text$1("OAuth authorization required; sign in with your MCP client", {
 				headers: { "www-authenticate": challenge },
 				status: 401
 			});
 			const user = yield* result$1(auth.access(headers, resource));
 			if (isFailure$1(user)) {
 				if (user.failure.error === "temporarily_unavailable") return unavailable;
-				return text("The access token is invalid or expired; your MCP client refreshes it, and asks you to sign in again only if refreshing fails", {
+				return text$1("The access token is invalid or expired; your MCP client refreshes it, and asks you to sign in again only if refreshing fails", {
 					headers: { "www-authenticate": `${challenge}, error="invalid_token"` },
 					status: 401
 				});
@@ -86957,7 +87415,7 @@ const packageMetadata = gen(function* () {
 	const file = (yield* Path$1).join(packageRoot, "package.json");
 	return yield* decodeEffect(fromJsonString(PackageMetadata))(yield* (yield* FileSystem).readFileString(file));
 });
-const appName = map$5(packageMetadata, (metadata) => replace("@deslop/", "")(metadata.name));
+const appName$1 = map$5(packageMetadata, (metadata) => replace("@deslop/", "")(metadata.name));
 const checkoutRoot = fnUntraced(function* (directory) {
 	const path = yield* Path$1;
 	if (yield* orElseSucceed((yield* FileSystem).exists(path.join(directory, "pnpm-workspace.yaml")), () => false)) return some$1(directory);
@@ -86966,7 +87424,7 @@ const checkoutRoot = fnUntraced(function* (directory) {
 });
 const dataDirectory = gen(function* () {
 	const path = yield* Path$1;
-	const name = yield* appName;
+	const name = yield* appName$1;
 	const directory = yield* match$8(yield* checkoutRoot(packageRoot), {
 		onNone: () => map$5(String$5("HOME"), (home) => path.join(home, ".deslop", name)),
 		onSome: (root) => succeed$5(path.join(root, ".deslop", name))
@@ -87040,10 +87498,10 @@ function layerKeyValueStore(directory) {
 unwrap$7(map$5(dataDirectory, layerKeyValueStore));
 const layerProtocol = mergeAll$1(layerSchemaBinary(), succeed$6(MaxBodySize)(mebibytes(10)));
 const layerTelemetry = unwrap$7(gen(function* () {
-	const name = (yield* packageMetadata).name;
+	const metadata = yield* packageMetadata;
 	return match$8(yield* option(String$5("OTEL_URL")), {
 		onNone: () => empty$10,
-		onSome: (url) => layerOtlp(`${name}-server`, url, "server")
+		onSome: (url) => layerOtlp(`${metadata.name}-server`, url, "server", metadata.version)
 	});
 }));
 const layerRoutes = use((router) => gen(function* () {
@@ -87055,7 +87513,7 @@ const layerRoutes = use((router) => gen(function* () {
 		const request = yield* HttpServerRequest;
 		const next = filter$5(liftThrowable(() => new URL(new URL(request.url, canonical).searchParams.get("next") ?? canonical, canonical))(), (url) => url.origin === canonical);
 		return match$8(issuer, {
-			onNone: () => text("Sign-in is not configured for this app", { status: 503 }),
+			onNone: () => text$1("Sign-in is not configured for this app", { status: 503 }),
 			onSome: (origin) => match$8(next, {
 				onNone: () => empty({ status: 400 }),
 				onSome: (url) => redirect(`${new URL("/", origin).href}?${new URLSearchParams({
@@ -87071,7 +87529,7 @@ const layerRoutes = use((router) => gen(function* () {
 				onNone: () => ({}),
 				onSome: (origin) => ({ auth: origin })
 			}),
-			name: yield* appName,
+			name: yield* appName$1,
 			traces,
 			version: (yield* packageMetadata).version
 		});
@@ -87104,7 +87562,7 @@ const layerAnnounce = effectDiscard(gen(function* () {
 	});
 }));
 function layerIcon(icon) {
-	const response = succeed$5(text(icon, {
+	const response = succeed$5(text$1(icon, {
 		contentType: "image/svg+xml",
 		headers: { "cache-control": "public, max-age=86400" }
 	}));
@@ -87113,7 +87571,7 @@ function layerIcon(icon) {
 const layerWeb = unwrap$7(gen(function* () {
 	const client = fileURLToPath(new URL("./client", import.meta.url));
 	if (!(yield* (yield* FileSystem).exists((yield* Path$1).join(client, "index.html")))) return empty$10;
-	const name = capitalize(yield* appName);
+	const name = capitalize(yield* appName$1);
 	return mergeAll$1(add("GET", "/manifest.webmanifest", succeed$5(jsonUnsafe({
 		background_color: "#0a0a0a",
 		display: "standalone",
@@ -87153,7 +87611,7 @@ function layerMcp(options) {
 			...options,
 			allowSessionTermination: true,
 			icons: [{ src: new URL("/icon", canonical).href }],
-			name: yield* appName,
+			name: yield* appName$1,
 			path: "/mcp",
 			protocols: [
 				v2026_07_28,
@@ -87360,7 +87818,7 @@ function runApp(app) {
 	};
 	const program = gen(function* () {
 		const metadata = yield* packageMetadata;
-		const name = yield* appName;
+		const name = yield* appName$1;
 		const root = pipe(make$4(name), withSharedFlags(flagsOf(settings)));
 		const given = map$5(root, (input) => getSomes$1(input));
 		return yield* pipe(root, withHandler((input) => flatMap$2(provider(getSomes$1(input)), (values) => provideService(server(app), ConfigProvider, values))), withSubcommands([pipe(make$4("service"), withSubcommands([
@@ -87504,6 +87962,7 @@ const Runtime = Literals([
 	"web",
 	"mobile",
 	"server",
+	"ci",
 	"unknown"
 ]);
 const Service = Struct({
@@ -87514,7 +87973,8 @@ const ServiceStatus = Struct({
 	...Service.fields,
 	entries: Natural,
 	lastEventAt: Nano,
-	runStartedAt: Nano
+	runStartedAt: Nano,
+	version: String$6
 });
 const IngestionStatus = Struct({
 	rejections: ArraySchema(Struct({
@@ -87545,14 +88005,14 @@ const TracesPage = Struct({
 	})),
 	total: Int$1
 });
-const Overview = Struct({ services: ArraySchema(Struct({
+const Overview = Struct({ apps: ArraySchema(Struct({
 	name: String$6,
 	operations: ArraySchema(Struct({
 		count: Int$1,
 		failures: Int$1,
 		name: String$6,
 		p50Ms: Finite,
-		p95Ms: Finite,
+		runtime: Runtime,
 		traces: ArraySchema(Struct({
 			durationMs: Finite,
 			failure: optional$8(Struct({
@@ -87562,6 +88022,10 @@ const Overview = Struct({ services: ArraySchema(Struct({
 			id: TraceId,
 			time: Nano
 		}))
+	})),
+	versions: ArraySchema(Struct({
+		runtimes: ArraySchema(Runtime),
+		version: String$6
 	}))
 })) });
 const Stats = Struct({
@@ -87616,6 +88080,7 @@ var RpcContracts = class extends make$29(make$31("scope.overview", {
 	success: Trace
 })).middleware(RpcAuth) {};
 // src/services/telemetry/lib/utils.ts
+const byRelease = mapInput(Array_(Number$6), (version) => map$8(split(version, "."), (part) => getOrElse(parse$2(part), () => 0)));
 function queryOf(filters, now) {
 	return {
 		limit: 1e3,
@@ -87632,6 +88097,38 @@ function logTime(log, now) {
 function resourceString(resource, key) {
 	return pipe(resource.attributes ?? [], findFirst((attribute) => attribute.key === key), flatMap$7((attribute) => liftPredicate(attribute.value["stringValue"], isString$1)), getOrElse(() => ""));
 }
+function spanName(span) {
+	const name = getOrElse(liftPredicate(span["name"], isString$1), () => "");
+	const attributes = { attributes: getOrElse(decodeUnknownOption(ArraySchema(Attribute))(span["attributes"]), () => []) };
+	if (name === "" || name !== resourceString(attributes, "http.request.method")) return name;
+	const route = resourceString(attributes, "http.route");
+	if (isNonEmpty$1(route)) return `${name} ${route}`;
+	if (span["kind"] === 2) return `${name} (no route)`;
+	return pipe(liftPredicate(resourceString(attributes, "url.path"), isNonEmpty$1), match$8({
+		onNone: () => name,
+		onSome: (path) => `${name} ${path}`
+	}));
+}
+function versionOf(entry) {
+	return resourceString(entry.resource, "service.version");
+}
+function releaseOf(entry) {
+	return getOrElse(liftPredicate(versionOf(entry), (version) => isSome(match$3(/^\d+(?:\.\d+)*$/u)(version))), () => "");
+}
+function newestVersions(entries, known) {
+	const versioned = filter$3(map$8(entries, (entry) => ({
+		service: entry.service,
+		version: releaseOf(entry)
+	})), (item) => item.version !== "");
+	return union$2(known, map$9(groupBy(versioned, (item) => item.service), (group) => max$2(map$8(group, (item) => item.version), byRelease)), max$3(byRelease));
+}
+function superseded(entry, newest) {
+	const version = releaseOf(entry);
+	return version !== "" && exists(get$10(newest, entry.service), (latest) => isLessThan$1(byRelease)(version, latest));
+}
+function appName(service) {
+	return pipe(service, replace(/^@deslop\//u, ""), replace(/-(?:server|client|ios)$/u, ""));
+}
 function runtime(resource) {
 	const value = resourceString(resource, "scope.runtime");
 	if (is$2(Runtime)(value)) return value;
@@ -87727,7 +88224,8 @@ function serviceStatuses(entries) {
 			}),
 			name,
 			runStartedAt: `${run}`,
-			runtime: runtime(latest.resource)
+			runtime: runtime(latest.resource),
+			version: versionOf(latest)
 		};
 	});
 }
@@ -87814,8 +88312,9 @@ function traced(records, now) {
 		if (!(some(spans, (span) => parentId(span) === "") || now - pipe(parse$2(`${BigInt(timing.time) / 1000000n}`), getOrElse(() => now)) > 6e4)) return none();
 		const root = rootOf(spans);
 		return some$1({
+			app: appName(root.service),
 			name: root.name,
-			service: root.service,
+			runtime: runtime(root.resource),
 			trace: {
 				durationMs: timing.durationMs,
 				...match$8(brokeAt(spans), {
@@ -87827,30 +88326,32 @@ function traced(records, now) {
 				}),
 				id: root.traceId,
 				time: timing.time
-			}
+			},
+			version: versionOf(root)
 		});
 	});
 }
 function operationsOf(group, keep) {
-	return sort(map$8(toEntries(groupBy(group, (item) => item.name)), (entry) => {
+	return sort(map$8(toEntries(groupBy(group, (item) => `${item.runtime} ${item.name}`)), (entry) => {
 		const times = sort(map$8(entry[1], (item) => item.trace.durationMs), Number$6);
-		function percentile(ratio) {
-			return getOrElse(get$9(times, max(0, Math.ceil(times.length * ratio) - 1)), () => 0);
-		}
 		return {
 			count: entry[1].length,
 			failures: failureCount(entry[1]),
-			name: entry[0],
-			p50Ms: percentile(.5),
-			p95Ms: percentile(.95),
+			name: headNonEmpty(entry[1]).name,
+			p50Ms: getOrElse(get$9(times, max(0, Math.ceil(times.length / 2) - 1)), () => 0),
+			runtime: headNonEmpty(entry[1]).runtime,
 			traces: map$8(sort(take$3(dedupeWith([...take$3(sort(filter$3(entry[1], (item) => item.trace.failure !== void 0), mapInput(flip$2(BigInt$5), (item) => BigInt(item.trace.time))), keep / 2), ...sort(entry[1], mapInput(flip$2(Number$6), (item) => item.trace.durationMs))], (first, second) => first.trace.id === second.trace.id), keep), mapInput(flip$2(Number$6), (item) => item.trace.durationMs)), (item) => item.trace)
 		};
 	}), combine$2(mapInput(flip$2(Number$6), (operation) => operation.failures), mapInput(flip$2(Number$6), (operation) => operation.count)));
 }
 function overview(entries, keep, now) {
-	return { services: map$8(sort(toEntries(groupBy(getSomes(map$8(values$2(groupBy(filter$3(entries, (entry) => entry.traceId !== ""), (entry) => entry.traceId)), (records) => traced(records, now))), (item) => item.service)), combine$2(mapInput(flip$2(Number$6), (entry) => failureCount(entry[1])), mapInput(flip$2(Number$6), (entry) => entry[1].length))), (entry) => ({
-		name: entry[0],
-		operations: operationsOf(entry[1], keep)
+	return { apps: map$8(sort(values$2(groupBy(getSomes(map$8(values$2(groupBy(filter$3(entries, (entry) => entry.traceId !== ""), (entry) => entry.traceId)), (records) => traced(records, now))), (item) => item.app)), combine$2(mapInput(flip$2(Number$6), (group) => failureCount(group)), mapInput(flip$2(Number$6), (group) => group.length))), (group) => ({
+		name: headNonEmpty(group).app,
+		operations: operationsOf(group, keep),
+		versions: sort(map$8(toEntries(groupBy(filter$3(group, (item) => item.version !== ""), (item) => item.version)), (entry) => ({
+			runtimes: dedupe(map$8(entry[1], (item) => item.runtime)),
+			version: entry[0]
+		})), mapInput(flip$2(byRelease), (release) => release.version))
 	})) };
 }
 // src/services/telemetry/service.ts
@@ -87874,11 +88375,19 @@ var Telemetry = class extends Service$2()("@deslop/scope/services/telemetry/serv
 		try: () => decodeURIComponent(file)
 	}), filterOrFail((key) => !endsWith(".tmp")(key)), flatMap$2((key) => store.get(key)), catch_$2(() => as(fs.remove(path.join(directory, file), { force: true }), none()))), { concurrency: 8 });
 	const version = yield* make$41(0);
-	const state = yield* make$43(fromIterable$4(map$8(getSomes(saved), (entry) => [entry.id, entry])));
+	const releases = yield* make$45(newestVersions(getSomes(saved), empty$12()));
+	const state = yield* make$43(fromIterable$4(map$8(getSomes(saved), (entry) => {
+		if (entry.signal === "log") return [entry.id, entry];
+		return [entry.id, {
+			...entry,
+			name: spanName(entry.payload)
+		}];
+	})));
 	const prune = gen(function* () {
 		const cutoff = BigInt((yield* currentTimeMillis) - toMillis(RETENTION)) * 1000000n;
+		const newest = yield* get$1(releases);
 		yield* updateEffect(state, (current) => {
-			const expired = filter$3(fromIterable$6(values(current)), (entry) => BigInt(entry.time) < cutoff);
+			const expired = filter$3(fromIterable$6(values(current)), (entry) => BigInt(entry.time) < cutoff || superseded(entry, newest));
 			return as(forEach$1(expired, (entry) => store.remove(entry.id), {
 				concurrency: 1,
 				discard: true
@@ -87898,10 +88407,25 @@ var Telemetry = class extends Service$2()("@deslop/scope/services/telemetry/serv
 		return currentEntries(entries);
 	});
 	const save = fnUntraced(function* (entries) {
-		yield* uninterruptible(updateEffect(state, (current) => as(forEach$1(entries, (entry) => store.set(entry.id, entry), {
-			concurrency: 1,
-			discard: true
-		}), reduce(entries, current, (all, entry) => set$3(all, entry.id, entry)))));
+		yield* uninterruptible(updateEffect(state, fnUntraced(function* (current) {
+			const known = yield* get$1(releases);
+			const newest = newestVersions(entries, known);
+			const kept = filter$3(entries, (entry) => !superseded(entry, newest));
+			const replaced = filter$3(match$1(isEmptyRecord(filter$4(newest, (latest, name) => known[name] !== latest)), {
+				onFalse: () => fromIterable$6(values(current)),
+				onTrue: () => []
+			}), (entry) => superseded(entry, newest));
+			yield* forEach$1(replaced, (entry) => store.remove(entry.id), {
+				concurrency: 1,
+				discard: true
+			});
+			yield* forEach$1(kept, (entry) => store.set(entry.id, entry), {
+				concurrency: 1,
+				discard: true
+			});
+			yield* set$1(releases, newest);
+			return reduce(kept, reduce(replaced, current, (all, entry) => remove$2(all, entry.id)), (all, entry) => set$4(all, entry.id, entry));
+		})));
 	}, failed);
 	const live = yield* make$41(overview(yield* read, 20, yield* currentTimeMillis));
 	yield* pipe(changes(version), buffer$1({
@@ -87949,7 +88473,7 @@ var Telemetry = class extends Service$2()("@deslop/scope/services/telemetry/serv
 			yield* save(flatMap$5(payload.resourceSpans ?? [], (group) => flatMap$5(group.scopeSpans ?? [], (scope) => map$8(scope.spans ?? [], (span) => ({
 				durationMs: durationMs(span.startTimeUnixNano, span.endTimeUnixNano ?? "0"),
 				id: `${toLowerCase(span.traceId)}:${toLowerCase(span.spanId)}`,
-				name: span.name ?? "",
+				name: spanName(span),
 				payload: span,
 				resource: group.resource ?? {},
 				resourceSchemaUrl: group.schemaUrl ?? "",
@@ -87971,7 +88495,7 @@ var Telemetry = class extends Service$2()("@deslop/scope/services/telemetry/serv
 		reject: fnUntraced(function* (input) {
 			const now = yield* currentTimeMillis;
 			const key = `${input.route}:${input.status}:${input.credential}`;
-			yield* update$2(rejections, (current) => set$6(current, key, {
+			yield* update$2(rejections, (current) => set$7(current, key, {
 				...input,
 				count: (current[key]?.count ?? 0) + 1,
 				lastAt: now
@@ -88036,9 +88560,171 @@ const RpcHandlers = RpcContracts.toLayer(gen(function* () {
 		"scope.trace": (input) => telemetry.trace(input.id)
 	});
 }));
+// src/services/github/lib/utils.ts
+function nanos(time) {
+	return `${BigInt(toEpochMillis(makeUnsafe$5(time))) * 1000000n}`;
+}
+function hex(value, width) {
+	return padStart(width, "0")(value.toString(16));
+}
+function traceIdOf(run, attempt) {
+	return `${hex(run, 24)}${hex(attempt, 8)}`;
+}
+function runSpanId(run) {
+	return `1${hex(run, 15)}`;
+}
+function jobSpanId(job) {
+	return `2${hex(job, 15)}`;
+}
+function statusOf(conclusion, message) {
+	if (conclusion === "failure" || conclusion === "timed_out" || conclusion === "startup_failure") return {
+		code: 2,
+		message
+	};
+	if (conclusion === "success") return {
+		code: 1,
+		message: ""
+	};
+	return {
+		code: 0,
+		message: ""
+	};
+}
+function text(key, value) {
+	return {
+		key,
+		value: { stringValue: value }
+	};
+}
+function request(repository, spans) {
+	return TracesRequest.make({ resourceSpans: [{
+		resource: { attributes: [text("service.name", repository), text("scope.runtime", "ci")] },
+		scopeSpans: [{
+			scope: { name: "github-actions" },
+			spans
+		}]
+	}] });
+}
+function runIds(event) {
+	return {
+		spanId: runSpanId(event.workflow_run.id),
+		traceId: traceIdOf(event.workflow_run.id, event.workflow_run.run_attempt)
+	};
+}
+function runTrace(event) {
+	const run = event.workflow_run;
+	return request(event.repository.full_name, [{
+		attributes: [
+			text("github.title", run.display_title),
+			text("github.event", run.event),
+			text("git.branch", run.head_branch ?? ""),
+			text("git.commit", run.head_sha),
+			text("github.conclusion", run.conclusion ?? ""),
+			text("url.full", run.html_url)
+		],
+		kind: 1,
+		name: run.name ?? run.display_title,
+		parentSpanId: "",
+		startTimeUnixNano: nanos(run.run_started_at),
+		status: statusOf(run.conclusion, `${run.display_title} failed`),
+		...runIds(event),
+		...match$8(liftPredicate(event.action, (action) => action === "completed"), {
+			onNone: () => ({}),
+			onSome: () => ({ endTimeUnixNano: nanos(run.updated_at) })
+		})
+	}]);
+}
+function jobTrace(event) {
+	const job = event.workflow_job;
+	const traceId = traceIdOf(job.run_id, job.run_attempt);
+	const steps = getSomes(map$8(job.steps, (step) => pipe(all$4({
+		completed: fromNullishOr(step.completed_at),
+		started: fromNullishOr(step.started_at)
+	}), filter$5(() => step.conclusion !== "skipped"), map$11((times) => ({
+		...step,
+		...times
+	})))));
+	const failed = findFirst(steps, (step) => statusOf(step.conclusion, "").code === 2);
+	return request(event.repository.full_name, [{
+		attributes: [
+			text("github.runner", job.runner_name ?? ""),
+			text("github.conclusion", job.conclusion ?? ""),
+			{
+				key: "github.queued_ms",
+				value: { intValue: `${toEpochMillis(makeUnsafe$5(job.started_at)) - toEpochMillis(makeUnsafe$5(job.created_at))}` }
+			},
+			text("url.full", job.html_url)
+		],
+		endTimeUnixNano: nanos(job.completed_at ?? job.started_at),
+		kind: 1,
+		name: job.name,
+		parentSpanId: runSpanId(job.run_id),
+		spanId: jobSpanId(job.id),
+		startTimeUnixNano: nanos(job.started_at),
+		status: statusOf(job.conclusion, match$8(failed, {
+			onNone: () => `${job.name} failed`,
+			onSome: (step) => `${step.name} failed`
+		})),
+		traceId
+	}, ...map$8(steps, (step) => ({
+		attributes: [text("github.conclusion", step.conclusion ?? ""), text("url.full", `${job.html_url}#step:${step.number}:1`)],
+		endTimeUnixNano: nanos(step.completed),
+		kind: 1,
+		name: step.name,
+		parentSpanId: jobSpanId(job.id),
+		spanId: `3${hex(job.id, 12)}${hex(step.number, 3)}`,
+		startTimeUnixNano: nanos(step.started),
+		status: statusOf(step.conclusion, `${step.name} failed`),
+		traceId
+	}))]);
+}
+// src/services/github/schema.ts
+const Repository = Struct({ full_name: String$6 });
+const Step = Struct({
+	completed_at: NullOr(String$6),
+	conclusion: NullOr(String$6),
+	name: String$6,
+	number: Int$1,
+	started_at: NullOr(String$6)
+});
+const WorkflowJob = Struct({
+	action: String$6,
+	repository: Repository,
+	workflow_job: Struct({
+		completed_at: NullOr(String$6),
+		conclusion: NullOr(String$6),
+		created_at: String$6,
+		html_url: String$6,
+		id: Int$1,
+		name: String$6,
+		run_attempt: Int$1,
+		run_id: Int$1,
+		runner_name: NullOr(String$6),
+		started_at: String$6,
+		steps: ArraySchema(Step)
+	})
+});
+const WorkflowRun = Struct({
+	action: String$6,
+	repository: Repository,
+	workflow_run: Struct({
+		conclusion: NullOr(String$6),
+		display_title: String$6,
+		event: String$6,
+		head_branch: NullOr(String$6),
+		head_sha: String$6,
+		html_url: String$6,
+		id: Int$1,
+		name: NullOr(String$6),
+		run_attempt: Int$1,
+		run_number: Int$1,
+		run_started_at: String$6,
+		updated_at: String$6
+	})
+});
 // src/tools/contracts.ts
 const Tools = make$37(make$38("list_services", {
-	description: "Start here: each service with its latest run, last event and entry count, plus rejected exports. A service missing here sent nothing in the last three days.",
+	description: "Start here: each service with its latest run, release, last event and entry count, plus rejected exports. Only each service's newest release is kept, so nothing here predates it. A service missing here sent nothing in the last three days.",
 	failure: TelemetryError,
 	success: IngestionStatus
 }).annotate(Readonly, true), make$38("find", {
@@ -88082,7 +88768,7 @@ const cors = cors$1({
 function answer(schema, save) {
 	return flatMap$2(HttpServerRequest, (request) => {
 		if (!startsWith("application/json")(request.headers["content-type"] ?? "")) return succeed$5(empty({ status: 415 }));
-		return pipe(schemaBodyJson(schema), flatMap$2(save), as(text("{}", { contentType: "application/json" })), catchTags({
+		return pipe(schemaBodyJson(schema), flatMap$2(save), as(text$1("{}", { contentType: "application/json" })), catchTags({
 			HttpServerError: () => succeed$5(jsonUnsafe({
 				code: 3,
 				message: "Invalid OTLP JSON body"
@@ -88098,31 +88784,70 @@ function answer(schema, save) {
 		}));
 	});
 }
+const receiver = use((router) => gen(function* () {
+	const telemetry = yield* Telemetry;
+	const ingest = fnUntraced(function* (route, schema, save) {
+		const request = yield* HttpServerRequest;
+		const response = yield* answer(schema, save);
+		if (response.status >= 400) {
+			function credential() {
+				if (request.headers["authorization"] !== void 0) return "authorization";
+				if (request.headers["cookie"] !== void 0) return "cookie";
+				return "none";
+			}
+			yield* telemetry.reject({
+				credential: credential(),
+				route,
+				status: response.status
+			});
+		}
+		return response;
+	});
+	yield* router.add("POST", "/v1/traces", cors(ingest("/v1/traces", TracesRequest, telemetry.ingestTraces)));
+	yield* router.add("POST", "/v1/logs", cors(ingest("/v1/logs", LogsRequest, telemetry.ingestLogs)));
+	yield* router.add("OPTIONS", "/v1/*", cors(succeed$5(empty())));
+	yield* router.add("GET", "/health", text$1("ready"));
+}));
+const Signature = pipe(String$6, check(isPattern(/^sha256=[0-9a-f]{64}$/u)), decodeTo(Uint8ArrayFromHex, {
+	decode: transform$2(slice(7)),
+	encode: transform$2((tag) => `sha256=${tag}`)
+}));
 runApp({
 	icon: icon_default,
-	routes: pipe(mergeAll$1(use((router) => gen(function* () {
+	routes: pipe(mergeAll$1(receiver, use((router) => gen(function* () {
 		const telemetry = yield* Telemetry;
-		const ingest = fnUntraced(function* (route, schema, save) {
-			const request = yield* HttpServerRequest;
-			const response = yield* answer(schema, save);
-			if (response.status >= 400) {
-				function credential() {
-					if (request.headers["authorization"] !== void 0) return "authorization";
-					if (request.headers["cookie"] !== void 0) return "cookie";
-					return "none";
-				}
-				yield* telemetry.reject({
-					credential: credential(),
-					route,
-					status: response.status
-				});
-			}
-			return response;
+		const mac = yield* Mac;
+		yield* match$8(yield* option(Redacted("GITHUB_WEBHOOK_SECRET")), {
+			onNone: () => void_$1,
+			onSome: fnUntraced(function* (secret) {
+				const key = yield* key$1(hmacSha256, new TextEncoder().encode(value$2(secret)));
+				yield* router.add("POST", "/v1/github", catchTags(gen(function* () {
+					const request = yield* HttpServerRequest;
+					const body = new Uint8Array(yield* request.arrayBuffer);
+					if (!(yield* match$8(decodeOption(Signature)(request.headers["x-hub-signature-256"] ?? ""), {
+						onNone: () => succeed$5(false),
+						onSome: (tag) => mac.verify(key, tag, body)
+					}))) return empty({ status: 401 });
+					const text = new TextDecoder().decode(body);
+					if (request.headers["x-github-event"] === "workflow_run") {
+						const event = yield* decodeEffect(fromJsonString(WorkflowRun))(text);
+						const ids = runIds(event);
+						const finished = yield* map$5(option$1(telemetry.trace(ids.traceId)), exists((trace) => some(trace.spans, (span) => span.spanId === ids.spanId && isString$2(span.payload["endTimeUnixNano"]))));
+						if (event.action === "completed" || event.action === "in_progress" && !finished) yield* telemetry.ingestTraces(runTrace(event));
+					}
+					if (request.headers["x-github-event"] === "workflow_job") {
+						const event = yield* decodeEffect(fromJsonString(WorkflowJob))(text);
+						if (event.action === "completed" && event.workflow_job.conclusion !== "skipped") yield* telemetry.ingestTraces(jobTrace(event));
+					}
+					return empty({ status: 204 });
+				}), {
+					CryptoError: () => succeed$5(empty({ status: 401 })),
+					HttpServerError: () => succeed$5(empty({ status: 400 })),
+					SchemaError: (error) => succeed$5(text$1(error.message, { status: 400 })),
+					TelemetryError: () => succeed$5(empty({ status: 503 }))
+				}));
+			})
 		});
-		yield* router.add("POST", "/v1/traces", cors(ingest("/v1/traces", TracesRequest, telemetry.ingestTraces)));
-		yield* router.add("POST", "/v1/logs", cors(ingest("/v1/logs", LogsRequest, telemetry.ingestLogs)));
-		yield* router.add("OPTIONS", "/v1/*", cors(succeed$5(empty())));
-		yield* router.add("GET", "/health", text("ready"));
 	})), pipe(layerHttp$1({
 		group: RpcContracts,
 		path: "/api/rpc",