@voltro/plugin-releases 0.0.0-stage → 0.83.0

package/dist/index.js

@@ -0,0 +1,798 @@
+import { ReleaseNotFound as e, ReleaseRefused as t } from "./errors.js";
+import { a as n, i as r, n as i, o as a, r as o, s, t as c } from "./rollout-CGRKMTfv.js";
+import { _ as l, a as u, c as d, d as ee, f as te, g as f, h as p, l as ne, m as re, o as ie, p as ae, r as m, s as oe, t as h, u as se, v as g, y as _ } from "./rpc-U7ytx6SC.js";
+import { Effect as v } from "effect";
+import { randomBytes as y } from "node:crypto";
+import { definePlugin as ce } from "@voltro/protocol";
+import { boolean as b, eq as x, id as S, integer as C, json as w, queryFor as T, registerRetention as le, retentionTtlMsFromEnv as ue, table as E, text as D, timestamp as O } from "@voltro/database";
+import { newTraceId as de } from "@voltro/runtime";
+var fe = (e, t, n) => {
+	let r = /* @__PURE__ */ new Set();
+	for (let e of t) e.currentReleaseId !== null && r.add(e.currentReleaseId);
+	let i = [];
+	for (let a of t) {
+		let t = n(a.name), o = Number.isFinite(t) ? Math.max(1, Math.floor(t)) : 10, s = e.filter((e) => e.channelId === a.id).sort((e, t) => c(t.version, e.version));
+		for (let e of s.slice(o)) r.has(e.id) || i.push(e);
+	}
+	return i;
+}, pe = [
+	"web",
+	"ios",
+	"android",
+	"macos",
+	"windows",
+	"linux"
+], me = [
+	"pwa",
+	"expo",
+	"tauri",
+	"electron"
+], k = E(f, {
+	id: S({ prefix: "relapp" }),
+	app: D(),
+	platform: D(),
+	shell: D(),
+	bundleId: D().nullable(),
+	updaterPublicKey: D().nullable(),
+	runtimeVersion: D().nullable(),
+	createdAt: O().default("now")
+}).index("byReleaseAppTarget", [
+	"app",
+	"platform",
+	"shell"
+]), A = E(g, {
+	id: S({ prefix: "relch" }),
+	appId: D(),
+	name: D(),
+	currentReleaseId: D().nullable(),
+	minSupportedVersion: D().nullable(),
+	killSwitches: w().nullable(),
+	public: b().default(!1),
+	allowUnsigned: b().default(!1),
+	updatedAt: O().default("now").onUpdate("now")
+}).index("byReleaseChannelApp", ["appId", "name"]), j = E(p, {
+	id: S({ prefix: "rel" }),
+	appId: D(),
+	channelId: D(),
+	version: D(),
+	buildId: D().nullable(),
+	notes: D().nullable(),
+	state: D().default("draft"),
+	rolloutPercent: C().default(0),
+	rolloutSalt: D(),
+	cohorts: w().nullable(),
+	createdBy: D().nullable(),
+	createdAt: O().default("now"),
+	updatedAt: O().default("now").onUpdate("now")
+}).index("byReleaseAppChannel", ["appId", "channelId"]).index("byReleaseVersion", ["appId", "version"]), M = E(l, {
+	id: S({ prefix: "relart" }),
+	releaseId: D(),
+	kind: D(),
+	target: D().nullable(),
+	url: D(),
+	sha256: D(),
+	size: C(),
+	signature: D().nullable(),
+	notarized: b().default(!1),
+	assetKey: D().nullable(),
+	contentType: D().nullable(),
+	createdAt: O().default("now")
+}).index("byReleaseArtifactRelease", ["releaseId"]), N = E(_, {
+	id: S({ prefix: "relev" }),
+	appId: D(),
+	channelId: D().nullable(),
+	releaseId: D().nullable(),
+	kind: D(),
+	reason: D().nullable(),
+	actorId: D().nullable(),
+	detail: w().nullable(),
+	at: O().default("now")
+}).index("byReleaseEventApp", ["appId", "at"]), P = [
+	k,
+	A,
+	j,
+	M,
+	N
+], F = (e, t) => t.currentVersion !== null && c(e.version, t.currentVersion) <= 0 ? !1 : o({
+	installId: t.installId,
+	salt: e.rolloutSalt,
+	percent: e.rolloutPercent,
+	...t.cohorts === void 0 ? {} : { installCohorts: t.cohorts },
+	releaseCohorts: e.cohorts
+}), I = (e, t) => {
+	if (!F(e, t)) return null;
+	let n = e.artifacts.find((e) => e.target === t.target && e.signature !== null);
+	return !n || n.signature === null ? null : {
+		version: e.version,
+		notes: e.notes ?? "",
+		pub_date: e.createdAt.toISOString(),
+		platforms: { [t.target]: {
+			signature: n.signature,
+			url: n.url
+		} }
+	};
+}, L = (e, t, n = {}) => {
+	let r = {
+		win: [
+			"nsis",
+			"msi",
+			"exe"
+		],
+		mac: ["dmg", "zip"],
+		linux: [
+			"appimage",
+			"deb",
+			"rpm"
+		]
+	}, i = e.artifacts.filter((e) => r[t].includes(e.kind));
+	if (i.length === 0) return null;
+	let a = [`version: ${e.version}`, "files:"];
+	for (let e of i) {
+		a.push(`  - url: ${e.url}`);
+		let t = n[e.sha256];
+		a.push(t === void 0 ? `    sha256: ${e.sha256}` : `    sha512: ${t}`), a.push(`    size: ${e.size}`);
+	}
+	let o = i[0];
+	a.push(`path: ${o.url}`);
+	let s = n[o.sha256];
+	return a.push(s === void 0 ? `sha256: ${o.sha256}` : `sha512: ${s}`), a.push(`releaseDate: '${e.createdAt.toISOString()}'`), e.notes && a.push(`releaseNotes: ${JSON.stringify(e.notes)}`), a.join("\n") + "\n";
+}, R = (e, t, n) => {
+	if (n.rolledBackTo !== null) return {
+		kind: "rollback",
+		commitTime: n.rolledBackTo.commitTime.toISOString()
+	};
+	if (e === null || n.runtimeVersion !== null && n.runtimeVersion !== t.runtimeVersion) return { kind: "no-update" };
+	let r = e.buildId ?? e.id;
+	if (t.currentUpdateId === r || !F(e, {
+		installId: t.installId,
+		currentVersion: null,
+		...t.cohorts === void 0 ? {} : { cohorts: t.cohorts }
+	})) return { kind: "no-update" };
+	let i = e.artifacts.find((e) => e.kind === "expo-bundle" && e.target === t.platform);
+	if (!i) return { kind: "no-update" };
+	let a = e.artifacts.filter((e) => e.kind === "expo-asset" && (e.target === null || e.target === t.platform)).map((e) => ({
+		hash: e.sha256,
+		key: e.assetKey ?? e.sha256,
+		contentType: e.contentType ?? "application/octet-stream",
+		url: e.url
+	}));
+	return {
+		kind: "manifest",
+		manifest: {
+			id: r,
+			createdAt: e.createdAt.toISOString(),
+			runtimeVersion: t.runtimeVersion,
+			launchAsset: {
+				hash: i.sha256,
+				key: i.assetKey ?? "bundle",
+				contentType: i.contentType ?? "application/javascript",
+				url: i.url
+			},
+			assets: a,
+			metadata: {},
+			extra: {
+				version: e.version,
+				...e.notes ? { notes: e.notes } : {}
+			}
+		}
+	};
+}, z = {
+	macos: ["dmg", "zip"],
+	windows: [
+		"nsis",
+		"msi",
+		"exe"
+	],
+	linux: [
+		"appimage",
+		"deb",
+		"rpm"
+	],
+	ios: ["ipa"],
+	android: ["apk", "aab"]
+}, B = (e, t, n) => {
+	let r = z[t] ?? [], i = e.artifacts.filter((e) => r.includes(e.kind));
+	if (i.length === 0) return null;
+	if (n !== void 0) {
+		let e = i.find((e) => e.target !== null && e.target.endsWith(n));
+		if (e) return e;
+	}
+	return i[0];
+}, V = (e) => /Windows/i.test(e) ? {
+	os: "windows",
+	arch: /ARM64|aarch64/i.test(e) ? "aarch64" : "x86_64"
+} : /Macintosh|Mac OS X/i.test(e) ? { os: "macos" } : /Android/i.test(e) ? { os: "android" } : /iPhone|iPad|iPod/i.test(e) ? { os: "ios" } : /Linux/i.test(e) ? {
+	os: "linux",
+	arch: /aarch64|arm64/i.test(e) ? "aarch64" : "x86_64"
+} : null, H = (e, t, n = {}) => ({
+	status: e,
+	body: JSON.stringify(t),
+	contentType: "application/json; charset=utf-8",
+	headers: {
+		"cache-control": "no-store",
+		...n
+	}
+}), he = (e, t, n) => ({
+	status: e,
+	body: t,
+	contentType: n,
+	headers: { "cache-control": "no-store" }
+}), U = (e) => ({
+	status: e,
+	body: "",
+	headers: { "cache-control": "no-store" }
+}), W = (e) => `${e}_${y(9).toString("base64url")}`, G = (n) => {
+	let r = (n.prefix ?? "/releases").replace(/\/+$/, ""), a = n.now ?? Date.now, o, s = () => {
+		if (!o) throw new t({ reason: "releases: the app store is not bound yet" });
+		return o;
+	}, m = null, y = async (e) => {
+		let t = (await s().query(T(k).where(x("app", e.app)).descriptor)).find((t) => t.platform === e.platform && t.shell === e.shell), n = !t;
+		t ||= await s().insert(f, {
+			id: W("relapp"),
+			app: e.app,
+			platform: e.platform,
+			shell: e.shell,
+			bundleId: e.bundleId ?? null,
+			updaterPublicKey: e.updaterPublicKey ?? null,
+			runtimeVersion: e.runtimeVersion ?? null,
+			createdAt: new Date(a())
+		});
+		let r = await s().query(T(A).where(x("appId", t.id)).descriptor);
+		for (let n of e.channels ?? [
+			"stable",
+			"beta",
+			"internal"
+		]) r.some((e) => e.name === n) || await s().insert(g, {
+			id: W("relch"),
+			appId: t.id,
+			name: n,
+			currentReleaseId: null,
+			minSupportedVersion: null,
+			killSwitches: null,
+			public: n === "stable",
+			allowUnsigned: n === "internal",
+			updatedAt: new Date(a())
+		});
+		return {
+			row: t,
+			created: n
+		};
+	}, b = async () => {
+		for (let e of n.apps) await y(e);
+	}, S = () => m ?? Promise.resolve(), C = (t, n, r) => v.tryPromise({
+		try: async () => {
+			await S();
+			let i = (await s().query(T(k).where(x("app", t)).descriptor)).find((e) => (n === void 0 || e.platform === n) && (r === void 0 || e.shell === r));
+			if (!i) throw new e({ app: t });
+			return i;
+		},
+		catch: (n) => n instanceof e ? n : new e({ app: t })
+	}), w = (t, n, r) => v.tryPromise({
+		try: async () => {
+			let i = (await s().query(T(A).where(x("appId", t)).descriptor)).find((e) => e.name === n);
+			if (!i) throw new e({
+				app: r,
+				channel: n
+			});
+			return i;
+		},
+		catch: (t) => t instanceof e ? t : new e({
+			app: r,
+			channel: n
+		})
+	}), E = (e) => s().query(T(j).where(x("id", e)).descriptor).then((e) => e[0] ?? null), D = (e) => s().query(T(j).where(x("appId", e)).descriptor), O = (e) => s().query(T(M).where(x("releaseId", e)).descriptor), pe = (e) => s().query(T(A).where(x("appId", e)).descriptor), me = (e) => n.retention?.perChannel?.[e] ?? n.retention?.keep ?? 10, F = async (e, t) => {
+		let n = await pe(e), r = fe(await D(e), n, me);
+		if (r.length === 0) return [];
+		for (let e of r) await s().deleteMany(l, { where: x("releaseId", e.id) }), await s().delete(p, e.id);
+		return await K({
+			appId: e,
+			kind: "prune",
+			actorId: t,
+			detail: { removed: r.map((e) => ({
+				version: e.version,
+				channel: n.find((t) => t.id === e.channelId)?.name ?? null
+			})) }
+		}), r;
+	}, z = async (e) => {
+		let t = await O(e.id);
+		return {
+			id: e.id,
+			version: e.version,
+			buildId: e.buildId,
+			notes: e.notes,
+			createdAt: e.createdAt,
+			rolloutPercent: e.rolloutPercent,
+			rolloutSalt: e.rolloutSalt,
+			cohorts: e.cohorts ?? null,
+			artifacts: t.map((e) => ({
+				kind: e.kind,
+				target: e.target,
+				url: e.url,
+				sha256: e.sha256,
+				size: e.size,
+				signature: e.signature,
+				assetKey: e.assetKey,
+				contentType: e.contentType
+			}))
+		};
+	}, G = async (e, t) => {
+		let n = await v.runPromise(C(e)), r = await v.runPromise(w(n.id, t, e)), i = r.currentReleaseId ? await E(r.currentReleaseId) : null;
+		return {
+			app: e,
+			channel: t,
+			latestVersion: i?.version ?? null,
+			minSupportedVersion: r.minSupportedVersion,
+			killSwitches: r.killSwitches ?? {},
+			rolloutPercent: i?.rolloutPercent ?? 0,
+			rolloutSalt: i?.rolloutSalt ?? null,
+			cohorts: i?.cohorts ?? null
+		};
+	}, K = (e) => s().insert(_, {
+		id: W("relev"),
+		appId: e.appId,
+		channelId: e.channelId ?? null,
+		releaseId: e.releaseId ?? null,
+		kind: e.kind,
+		reason: e.reason ?? null,
+		actorId: e.actorId ?? null,
+		detail: e.detail ?? null,
+		at: new Date(a())
+	}), q = (e) => e.request.subject.type === "user" ? e.request.subject.id : null, ve = {
+		...oe,
+		description: "The reactive release policy of a channel: latest version, minimum supported version, kill switches, rollout.",
+		execute: (e) => v.tryPromise({
+			try: () => G(e.app, e.channel),
+			catch: (e) => e
+		})
+	}, ye = {
+		...ie,
+		description: "Every release of an app target, newest first.",
+		execute: (e) => v.gen(function* () {
+			let t = yield* C(e.app), n = yield* v.promise(() => D(t.id)), r = yield* v.promise(() => s().query(T(A).where(x("appId", t.id)).descriptor)), i = [];
+			for (let e of [...n].sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime() || c(t.version, e.version))) {
+				let t = yield* v.promise(() => O(e.id));
+				i.push({
+					id: e.id,
+					version: e.version,
+					buildId: e.buildId,
+					state: e.state,
+					rolloutPercent: e.rolloutPercent,
+					channel: r.find((t) => t.id === e.channelId)?.name ?? "?",
+					createdAt: e.createdAt.toISOString(),
+					artifacts: t.length,
+					signed: t.length > 0 && t.every((e) => e.signature !== null)
+				});
+			}
+			return i;
+		})
+	}, be = {
+		...ne,
+		description: "Register an app target at runtime, with its channels; idempotent.",
+		execute: (e) => v.tryPromise({
+			try: async () => {
+				await S();
+				let { row: t, created: n } = await y({
+					app: e.app,
+					platform: e.platform,
+					shell: e.shell,
+					...e.bundleId === void 0 ? {} : { bundleId: e.bundleId },
+					...e.updaterPublicKey === void 0 ? {} : { updaterPublicKey: e.updaterPublicKey },
+					...e.runtimeVersion === void 0 ? {} : { runtimeVersion: e.runtimeVersion },
+					...e.channels === void 0 ? {} : { channels: e.channels }
+				});
+				return {
+					id: t.id,
+					created: n
+				};
+			},
+			catch: (n) => new t({ reason: `releases: ${e.app} could not be registered: ${n instanceof Error ? n.message : String(n)}` })
+		})
+	}, xe = {
+		...u,
+		description: "Create a draft release of a version on a channel.",
+		execute: (e, n) => v.gen(function* () {
+			let r = yield* C(e.app), i = yield* w(r.id, e.channel, e.app);
+			if ((yield* v.promise(() => D(r.id))).some((t) => t.version === e.version)) return yield* v.fail(new t({ reason: `version ${e.version} already exists for ${e.app}` }));
+			let o = W("rel");
+			return yield* v.promise(() => s().insert(p, {
+				id: o,
+				appId: r.id,
+				channelId: i.id,
+				version: e.version,
+				buildId: e.buildId ?? null,
+				notes: e.notes ?? null,
+				state: "draft",
+				rolloutPercent: 0,
+				rolloutSalt: W("salt"),
+				cohorts: e.cohorts ?? null,
+				createdBy: q(n),
+				createdAt: new Date(a()),
+				updatedAt: new Date(a())
+			})), yield* v.promise(() => K({
+				appId: r.id,
+				channelId: i.id,
+				releaseId: o,
+				kind: "create",
+				actorId: q(n),
+				detail: { version: e.version }
+			})), yield* v.promise(() => F(r.id, q(n))), { id: o };
+		})
+	}, Se = {
+		...re,
+		description: "Attach an artefact (a file the client downloads) to a release.",
+		execute: (n, r) => v.gen(function* () {
+			let i = yield* v.promise(() => E(n.releaseId));
+			if (!i) return yield* v.fail(new e({
+				app: "?",
+				version: n.releaseId
+			}));
+			if (!/^[a-f0-9]{64}$/i.test(n.sha256)) return yield* v.fail(new t({ reason: "sha256 must be 64 hex characters" }));
+			let o = W("relart");
+			return yield* v.promise(() => s().insert(l, {
+				id: o,
+				releaseId: i.id,
+				kind: n.kind,
+				target: n.target ?? null,
+				url: n.url,
+				sha256: n.sha256.toLowerCase(),
+				size: n.size,
+				signature: n.signature ?? null,
+				notarized: n.notarized ?? !1,
+				assetKey: n.assetKey ?? null,
+				contentType: n.contentType ?? null,
+				createdAt: new Date(a())
+			})), yield* v.promise(() => K({
+				appId: i.appId,
+				releaseId: i.id,
+				kind: "upload",
+				actorId: q(r),
+				detail: {
+					kind: n.kind,
+					target: n.target ?? null
+				}
+			})), { id: o };
+		})
+	}, Ce = {
+		...d,
+		description: "Point a channel at a release (no rebuild) and start its rollout.",
+		execute: (n, r) => v.gen(function* () {
+			let i = yield* C(n.app), o = yield* w(i.id, n.to, n.app), c = yield* v.promise(() => D(i.id)), l = c.find((e) => e.version === n.version);
+			if (!l) return yield* v.fail(new e({
+				app: n.app,
+				version: n.version
+			}));
+			let u = yield* v.promise(() => O(l.id));
+			if (!o.allowUnsigned && u.some((e) => e.signature === null)) return yield* v.fail(new t({ reason: `release ${n.version} has unsigned artefacts; channel ${n.to} refuses them` }));
+			let d = Math.max(0, Math.min(100, n.rolloutPercent ?? 100));
+			return yield* v.promise(() => s().update(p, l.id, {
+				channelId: o.id,
+				state: d >= 100 ? "complete" : "rolling",
+				rolloutPercent: d,
+				updatedAt: new Date(a())
+			})), yield* v.promise(() => s().update(g, o.id, {
+				currentReleaseId: l.id,
+				updatedAt: new Date(a())
+			})), yield* v.promise(() => K({
+				appId: i.id,
+				channelId: o.id,
+				releaseId: l.id,
+				kind: "promote",
+				actorId: q(r),
+				detail: {
+					from: c.find((e) => e.id === o.currentReleaseId)?.version ?? null,
+					to: n.version,
+					rolloutPercent: d
+				}
+			})), {
+				channel: n.to,
+				version: n.version,
+				rolloutPercent: d
+			};
+		})
+	}, we = {
+		...te,
+		description: "Change the rollout percentage of the channel's current release.",
+		execute: (n, r) => v.gen(function* () {
+			let i = yield* C(n.app), o = yield* w(i.id, n.channel, n.app);
+			if (!o.currentReleaseId) return yield* v.fail(new t({ reason: `channel ${n.channel} has no current release` }));
+			let c = yield* v.promise(() => E(o.currentReleaseId));
+			if (!c) return yield* v.fail(new e({
+				app: n.app,
+				channel: n.channel
+			}));
+			let l = Math.max(0, Math.min(100, n.percent));
+			return yield* v.promise(() => s().update(p, c.id, {
+				rolloutPercent: l,
+				state: l >= 100 ? "complete" : "rolling",
+				updatedAt: new Date(a())
+			})), yield* v.promise(() => K({
+				appId: i.id,
+				channelId: o.id,
+				releaseId: c.id,
+				kind: "rollout",
+				actorId: q(r),
+				detail: { percent: l }
+			})), {
+				version: c.version,
+				rolloutPercent: l
+			};
+		})
+	}, Te = {
+		...ee,
+		description: "Point the channel back at the previous release; the current one is marked rolled back.",
+		execute: (e, n) => v.gen(function* () {
+			let r = yield* C(e.app), i = yield* w(r.id, e.channel, e.app);
+			if (!i.currentReleaseId) return yield* v.fail(new t({ reason: `channel ${e.channel} has no current release` }));
+			let o = yield* v.promise(() => D(r.id)), l = o.find((e) => e.id === i.currentReleaseId), u = o.filter((e) => e.channelId === i.id && e.id !== i.currentReleaseId && e.state !== "rolledBack").sort((e, t) => c(t.version, e.version))[0];
+			return l && (yield* v.promise(() => s().update(p, l.id, {
+				state: "rolledBack",
+				updatedAt: new Date(a())
+			}))), yield* v.promise(() => s().update(g, i.id, {
+				currentReleaseId: u?.id ?? null,
+				updatedAt: new Date(a())
+			})), yield* v.promise(() => K({
+				appId: r.id,
+				channelId: i.id,
+				releaseId: l?.id ?? null,
+				kind: "rollback",
+				reason: e.reason,
+				actorId: q(n),
+				detail: {
+					from: l?.version ?? null,
+					to: u?.version ?? null
+				}
+			})), { version: u?.version ?? null };
+		})
+	}, J = {
+		...ae,
+		description: "Set the minimum supported version and kill switches of a channel.",
+		execute: (e, t) => v.gen(function* () {
+			let n = yield* C(e.app), r = yield* w(n.id, e.channel, e.app);
+			return yield* v.promise(() => s().update(g, r.id, {
+				...e.minSupportedVersion === void 0 ? {} : { minSupportedVersion: e.minSupportedVersion },
+				...e.killSwitches === void 0 ? {} : { killSwitches: e.killSwitches },
+				updatedAt: new Date(a())
+			})), yield* v.promise(() => K({
+				appId: n.id,
+				channelId: r.id,
+				kind: "policy",
+				reason: e.reason,
+				actorId: q(t),
+				detail: {
+					minSupportedVersion: e.minSupportedVersion ?? null,
+					killSwitches: e.killSwitches ?? null
+				}
+			})), yield* v.promise(() => G(e.app, e.channel));
+		})
+	}, Y = async (e, t) => {
+		let n = await v.runPromise(C(e)), r = await v.runPromise(w(n.id, t, e)), i = r.currentReleaseId ? await E(r.currentReleaseId) : null;
+		return {
+			app: n,
+			channel: r,
+			release: i ? await z(i) : null
+		};
+	}, X = (e, t) => t.get("install") ?? e.headers["x-voltro-install-id"] ?? e.headers["expo-embedded-update-id"] ?? "anonymous", Ee = {
+		method: "GET",
+		path: r,
+		handle: async (t) => {
+			if (t.method !== "GET" && t.method !== "HEAD") return H(405, { error: "method_not_allowed" });
+			let n = t.path.slice(r.length).split("/").filter((e) => e.length > 0).map(decodeURIComponent), a = new URLSearchParams(t.query), [o, s] = n;
+			if (!o || !s) return H(404, { error: "not_found" });
+			try {
+				if (s === "tauri") {
+					let [, , e, r, i] = n;
+					if (!e || !r || !i) return H(400, { error: "expected /tauri/:channel/:target/:currentVersion" });
+					let { release: s } = await Y(o, e), c = s ? I(s, {
+						installId: X(t, a),
+						currentVersion: i,
+						target: r
+					}) : null;
+					return c ? H(200, c) : U(204);
+				}
+				if (s === "expo" && n[2] === "manifest") {
+					let e = t.headers["expo-channel-name"] ?? a.get("channel") ?? "stable", n = t.headers["expo-platform"] ?? a.get("platform"), r = t.headers["expo-runtime-version"] ?? a.get("runtimeVersion") ?? "";
+					if (n !== "ios" && n !== "android") return H(400, { error: "expo-platform must be ios or android" });
+					let { app: i, release: s } = await Y(o, e), c = R(s, {
+						installId: X(t, a),
+						currentVersion: null,
+						platform: n,
+						runtimeVersion: r,
+						currentUpdateId: t.headers["expo-current-update-id"] ?? null
+					}, {
+						runtimeVersion: i.runtimeVersion,
+						rolledBackTo: null
+					});
+					return c.kind === "no-update" ? H(200, { type: "noUpdateAvailable" }, {
+						"expo-protocol-version": "1",
+						"expo-sfv-version": "0"
+					}) : c.kind === "rollback" ? H(200, {
+						type: "rollBackToEmbedded",
+						parameters: { commitTime: c.commitTime }
+					}, {
+						"expo-protocol-version": "1",
+						"expo-sfv-version": "0"
+					}) : H(200, c.manifest, {
+						"expo-protocol-version": "1",
+						"expo-sfv-version": "0",
+						"expo-manifest-filters": ""
+					});
+				}
+				if (s === "electron") {
+					let [, , e, t] = n;
+					if (!e || !t) return H(400, { error: "expected /electron/:channel/latest.yml" });
+					let r = t === "latest-mac.yml" ? "mac" : t === "latest-linux.yml" ? "linux" : t === "latest.yml" ? "win" : null;
+					if (r === null) return H(404, { error: "not_found" });
+					let { release: i } = await Y(o, e), a = i ? L(i, r) : null;
+					return a ? he(200, a, "text/yaml; charset=utf-8") : U(204);
+				}
+				if (s === "download") {
+					let [, , e] = n;
+					if (!e) return H(400, { error: "expected /download/:channel" });
+					let { channel: r, release: i } = await Y(o, e);
+					if (!r.public) return H(403, { error: "channel_not_public" });
+					if (!i) return U(204);
+					let s = a.get("os") ?? V(t.headers["user-agent"] ?? "")?.os, c = a.get("arch") ?? V(t.headers["user-agent"] ?? "")?.arch;
+					if (!s) return H(400, { error: "os is required (?os=macos|windows|linux|ios|android)" });
+					let l = B(i, s, c);
+					return l ? {
+						status: 302,
+						body: "",
+						headers: {
+							location: l.url,
+							"cache-control": "no-store"
+						}
+					} : H(404, { error: "no_artifact_for_os" });
+				}
+				if (s === "policy") {
+					let [, , e] = n;
+					if (!e) return H(400, { error: "expected /policy/:channel" });
+					let r = await G(o, e), s = a.get("version"), c = s ? i(r, {
+						version: s,
+						installId: X(t, a)
+					}) : null;
+					return H(200, {
+						policy: r,
+						...c ? { verdict: c } : {}
+					});
+				}
+				return H(404, { error: "not_found" });
+			} catch (t) {
+				if (t instanceof e) return H(404, {
+					error: "not_found",
+					app: t.app
+				});
+				throw t;
+			}
+		}
+	}, Z = (e) => ({
+		kind: "json",
+		data: e
+	}), De = [{
+		method: "GET",
+		path: "/overview",
+		scope: "shared-store",
+		description: "Every app target with its channels, current versions and rollout state.",
+		handler: () => v.promise(async () => {
+			let e = await s().query(T(k).descriptor), t = await s().query(T(A).descriptor), n = await s().query(T(j).descriptor);
+			return Z({ apps: e.map((e) => ({
+				id: e.id,
+				app: e.app,
+				platform: e.platform,
+				shell: e.shell,
+				channels: t.filter((t) => t.appId === e.id).map((e) => {
+					let t = n.find((t) => t.id === e.currentReleaseId);
+					return {
+						name: e.name,
+						current: t?.version ?? null,
+						rolloutPercent: t?.rolloutPercent ?? 0,
+						state: t?.state ?? null,
+						minSupportedVersion: e.minSupportedVersion,
+						public: e.public
+					};
+				}),
+				releases: n.filter((t) => t.appId === e.id).length
+			})) });
+		})
+	}, {
+		method: "GET",
+		path: "/events",
+		scope: "shared-store",
+		description: "The last 100 release events (promote, rollback, rollout, policy).",
+		handler: () => v.promise(async () => {
+			let e = await s().query(T(N).descriptor);
+			return Z({ events: [...e].sort((e, t) => t.at.getTime() - e.at.getTime()).slice(0, 100).map((e) => ({
+				...e,
+				at: e.at.toISOString()
+			})) });
+		})
+	}], Oe = () => ({ request: {
+		subject: {
+			type: "anonymous",
+			id: null,
+			tenantId: null
+		},
+		traceId: de()
+	} }), Q = (e, t) => ({
+		kind: "json",
+		status: e,
+		data: { error: t }
+	}), $ = (n, r, i) => ({
+		method: "POST",
+		path: n,
+		description: i,
+		handler: (n) => v.gen(function* () {
+			let i;
+			try {
+				i = JSON.parse(n.body || "{}");
+			} catch {
+				return Q(400, "invalid JSON body");
+			}
+			if (typeof i != "object" || !i || Array.isArray(i)) return Q(400, "expected a JSON object body");
+			let a = yield* r.execute(i, Oe()).pipe(v.either);
+			if (a._tag === "Left") {
+				let n = a.left;
+				return n instanceof e ? Q(404, `not found: ${n.app}${n.version ? ` ${n.version}` : ""}${n.channel ? ` (${n.channel})` : ""}`) : n instanceof t ? Q(409, n.reason) : Q(400, n instanceof Error ? n.message : String(n));
+			}
+			return Z({ result: a.right });
+		})
+	}), ke = [
+		$("/apps", be, "Register an app target at runtime: { app, platform, shell, channels? }."),
+		$("/create", xe, "Create a draft release: { app, channel, version, buildId?, notes? }."),
+		$("/upload", Se, "Attach an artefact: { releaseId, kind, target?, url, sha256, size, signature? }."),
+		$("/promote", Ce, "Promote a version onto a channel: { app, version, to, rolloutPercent? }."),
+		$("/rollout", we, "Set the rollout percentage: { app, channel, percent }."),
+		$("/rollback", Te, "Roll a channel back: { app, channel, reason }."),
+		$("/policy", J, "Set the policy: { app, channel, minSupportedVersion?, killSwitches?, reason }.")
+	];
+	return le({
+		source: "plugin",
+		table: _,
+		timeColumn: "at",
+		ttlMs: ue(process.env.VOLTRO_RELEASE_EVENTS_TTL_HOURS, 8760),
+		envVar: "VOLTRO_RELEASE_EVENTS_TTL_HOURS"
+	}), ce({
+		name: n.name ? `${h}#${n.name}` : h,
+		description: "Release channels, artefacts and rollouts — the self-hosted update server behind Tauri, Expo OTA, electron-updater and PWA feeds, with a reactive release policy.",
+		permissions: [
+			"inspect:read",
+			"inspect:write",
+			"store:write"
+		],
+		routes: [
+			ve,
+			ye,
+			be,
+			xe,
+			Se,
+			Ce,
+			we,
+			Te,
+			J
+		],
+		rpcClientDescriptors: se,
+		httpRoutes: [Ee],
+		inspectEndpoints: [...De, ...ke],
+		extendSchema: { tables: [...P] },
+		declaredEnv: _e,
+		privacy: ge,
+		bindDataStore: (e) => {
+			o = e, m = b(), m.catch(() => {});
+		},
+		onActivate: () => v.tryPromise({
+			catch: (e) => /* @__PURE__ */ Error(`@voltro/plugin-releases could not seed its targets and channels: ${e instanceof Error ? e.message : String(e)}`),
+			try: () => S()
+		})
+	});
+}, ge = { collects: [{
+	category: "device-id",
+	linked: !1,
+	tracking: !1,
+	purposes: ["app-functionality"]
+}] }, _e = [{
+	name: "VOLTRO_RELEASE_EVENTS_TTL_HOURS",
+	required: !1,
+	secret: !1,
+	description: "Hours a release event (create, upload, promote, rollout, rollback, policy, prune) is kept before the retention sweep removes it. Default 8760 (one year)."
+}];
+//#endregion
+export { h as BASE_NAME, m as RELEASES_MANAGE_SCOPE, p as RELEASES_TABLE, f as RELEASE_APPS_TABLE, l as RELEASE_ARTIFACTS_TABLE, g as RELEASE_CHANNELS_TABLE, _ as RELEASE_EVENTS_TABLE, pe as RELEASE_PLATFORMS, me as RELEASE_SHELLS, e as ReleaseNotFound, t as ReleaseRefused, c as compareVersions, i as evaluatePolicy, o as inRollout, r as isNewerVersion, F as offeredTo, V as osFromUserAgent, n as parseVersion, B as pickDownload, k as releaseAppsTable, M as releaseArtifactsTable, A as releaseChannelsTable, N as releaseEventsTable, P as releaseTables, G as releasesPlugin, j as releasesTable, L as renderElectronLatestYml, R as renderExpoFeed, I as renderTauriFeed, a as rolloutBucket, s as sortVersionsDesc };