@voltro/plugin-releases 0.83.1 → 0.84.0

package/dist/index.js

@@ -1,12 +1,13 @@
 import { ReleaseNotFound as e, ReleaseRefused as t } from "./errors.js";
 import { a as n, i as r, n as i, o as a, r as o, s, t as c } from "./rollout-CGRKMTfv.js";
-import { _ as l, a as u, c as d, d as ee, f as te, g as f, h as p, l as ne, m as re, o as ie, p as ae, r as m, s as oe, t as h, u as se, v as g, y as _ } from "./rpc-U7ytx6SC.js";
-import { Effect as v } from "effect";
-import { randomBytes as y } from "node:crypto";
-import { definePlugin as ce } from "@voltro/protocol";
-import { boolean as b, eq as x, id as S, integer as C, json as w, queryFor as T, registerRetention as le, retentionTtlMsFromEnv as ue, table as E, text as D, timestamp as O } from "@voltro/database";
-import { newTraceId as de } from "@voltro/runtime";
-var fe = (e, t, n) => {
+import { _ as l, a as u, c as ee, d as te, f as ne, g as d, h as f, l as re, m as ie, o as ae, p as oe, r as p, s as se, t as m, u as ce, v as h, y as g } from "./rpc-DeEV8l3U.js";
+import { Effect as _, Runtime as le, Schema as ue } from "effect";
+import { randomBytes as v } from "node:crypto";
+import { AsyncLocalStorage as y } from "node:async_hooks";
+import { definePlugin as de } from "@voltro/protocol";
+import { and as fe, boolean as b, eq as x, id as S, integer as C, json as w, queryFor as T, registerRetention as pe, retentionTtlMsFromEnv as me, table as E, text as D, timestamp as O } from "@voltro/database";
+import { newTraceId as he } from "@voltro/runtime";
+var ge = (e, t, n) => {
 	let r = /* @__PURE__ */ new Set();
 	for (let e of t) e.currentReleaseId !== null && r.add(e.currentReleaseId);
 	let i = [];
@@ -15,23 +16,24 @@ var fe = (e, t, n) => {
 		for (let e of s.slice(o)) r.has(e.id) || i.push(e);
 	}
 	return i;
-}, pe = [
+}, k = [
 	"web",
 	"ios",
 	"android",
 	"macos",
 	"windows",
 	"linux"
-], me = [
+], A = [
 	"pwa",
 	"expo",
 	"tauri",
 	"electron"
-], k = E(f, {
+], j = E(d, {
 	id: S({ prefix: "relapp" }),
 	app: D(),
 	platform: D(),
 	shell: D(),
+	revision: C().default(0),
 	bundleId: D().nullable(),
 	updaterPublicKey: D().nullable(),
 	runtimeVersion: D().nullable(),
@@ -40,7 +42,7 @@ var fe = (e, t, n) => {
 	"app",
 	"platform",
 	"shell"
-]), A = E(g, {
+]), M = E(h, {
 	id: S({ prefix: "relch" }),
 	appId: D(),
 	name: D(),
@@ -50,7 +52,7 @@ var fe = (e, t, n) => {
 	public: b().default(!1),
 	allowUnsigned: b().default(!1),
 	updatedAt: O().default("now").onUpdate("now")
-}).index("byReleaseChannelApp", ["appId", "name"]), j = E(p, {
+}).index("byReleaseChannelApp", ["appId", "name"]), N = E(f, {
 	id: S({ prefix: "rel" }),
 	appId: D(),
 	channelId: D(),
@@ -64,7 +66,7 @@ var fe = (e, t, n) => {
 	createdBy: D().nullable(),
 	createdAt: O().default("now"),
 	updatedAt: O().default("now").onUpdate("now")
-}).index("byReleaseAppChannel", ["appId", "channelId"]).index("byReleaseVersion", ["appId", "version"]), M = E(l, {
+}).index("byReleaseAppChannel", ["appId", "channelId"]).index("byReleaseVersion", ["appId", "version"]), P = E(l, {
 	id: S({ prefix: "relart" }),
 	releaseId: D(),
 	kind: D(),
@@ -77,7 +79,7 @@ var fe = (e, t, n) => {
 	assetKey: D().nullable(),
 	contentType: D().nullable(),
 	createdAt: O().default("now")
-}).index("byReleaseArtifactRelease", ["releaseId"]), N = E(_, {
+}).index("byReleaseArtifactRelease", ["releaseId"]), F = E(g, {
 	id: S({ prefix: "relev" }),
 	appId: D(),
 	channelId: D().nullable(),
@@ -87,20 +89,20 @@ var fe = (e, t, n) => {
 	actorId: D().nullable(),
 	detail: w().nullable(),
 	at: O().default("now")
-}).index("byReleaseEventApp", ["appId", "at"]), P = [
-	k,
-	A,
+}).index("byReleaseEventApp", ["appId", "at"]), I = [
 	j,
 	M,
-	N
-], F = (e, t) => t.currentVersion !== null && c(e.version, t.currentVersion) <= 0 ? !1 : o({
+	N,
+	P,
+	F
+], L = (e, t) => t.currentVersion !== null && c(e.version, t.currentVersion) <= 0 ? !1 : o({
 	installId: t.installId,
 	salt: e.rolloutSalt,
 	percent: e.rolloutPercent,
 	...t.cohorts === void 0 ? {} : { installCohorts: t.cohorts },
 	releaseCohorts: e.cohorts
-}), I = (e, t) => {
-	if (!F(e, t)) return null;
+}), R = (e, t) => {
+	if (!L(e, t)) return null;
 	let n = e.artifacts.find((e) => e.target === t.target && e.signature !== null);
 	return !n || n.signature === null ? null : {
 		version: e.version,
@@ -111,7 +113,7 @@ var fe = (e, t, n) => {
 			url: n.url
 		} }
 	};
-}, L = (e, t, n = {}) => {
+}, z = (e, t, n = {}) => {
 	let r = {
 		win: [
 			"nsis",
@@ -136,14 +138,14 @@ var fe = (e, t, n) => {
 	a.push(`path: ${o.url}`);
 	let s = n[o.sha256];
 	return a.push(s === void 0 ? `sha256: ${o.sha256}` : `sha512: ${s}`), a.push(`releaseDate: '${e.createdAt.toISOString()}'`), e.notes && a.push(`releaseNotes: ${JSON.stringify(e.notes)}`), a.join("\n") + "\n";
-}, R = (e, t, n) => {
+}, B = (e, t, n) => {
 	if (n.rolledBackTo !== null) return {
 		kind: "rollback",
 		commitTime: n.rolledBackTo.commitTime.toISOString()
 	};
 	if (e === null || n.runtimeVersion !== null && n.runtimeVersion !== t.runtimeVersion) return { kind: "no-update" };
 	let r = e.buildId ?? e.id;
-	if (t.currentUpdateId === r || !F(e, {
+	if (t.currentUpdateId === r || !L(e, {
 		installId: t.installId,
 		currentVersion: null,
 		...t.cohorts === void 0 ? {} : { cohorts: t.cohorts }
@@ -176,7 +178,7 @@ var fe = (e, t, n) => {
 			}
 		}
 	};
-}, z = {
+}, V = {
 	macos: ["dmg", "zip"],
 	windows: [
 		"nsis",
@@ -190,21 +192,21 @@ var fe = (e, t, n) => {
 	],
 	ios: ["ipa"],
 	android: ["apk", "aab"]
-}, B = (e, t, n) => {
-	let r = z[t] ?? [], i = e.artifacts.filter((e) => r.includes(e.kind));
+}, _e = (e, t, n) => {
+	let r = V[t] ?? [], i = e.artifacts.filter((e) => r.includes(e.kind));
 	if (i.length === 0) return null;
 	if (n !== void 0) {
 		let e = i.find((e) => e.target !== null && e.target.endsWith(n));
 		if (e) return e;
 	}
 	return i[0];
-}, V = (e) => /Windows/i.test(e) ? {
+}, H = (e) => /Windows/i.test(e) ? {
 	os: "windows",
 	arch: /ARM64|aarch64/i.test(e) ? "aarch64" : "x86_64"
 } : /Macintosh|Mac OS X/i.test(e) ? { os: "macos" } : /Android/i.test(e) ? { os: "android" } : /iPhone|iPad|iPod/i.test(e) ? { os: "ios" } : /Linux/i.test(e) ? {
 	os: "linux",
 	arch: /aarch64|arm64/i.test(e) ? "aarch64" : "x86_64"
-} : null, H = (e, t, n = {}) => ({
+} : null, U = (e, t, n = {}) => ({
 	status: e,
 	body: JSON.stringify(t),
 	contentType: "application/json; charset=utf-8",
@@ -212,38 +214,41 @@ var fe = (e, t, n) => {
 		"cache-control": "no-store",
 		...n
 	}
-}), he = (e, t, n) => ({
+}), ve = (e, t, n) => ({
 	status: e,
 	body: t,
 	contentType: n,
 	headers: { "cache-control": "no-store" }
-}), U = (e) => ({
+}), W = (e) => ({
 	status: e,
 	body: "",
 	headers: { "cache-control": "no-store" }
-}), W = (e) => `${e}_${y(9).toString("base64url")}`, G = (n) => {
-	let r = (n.prefix ?? "/releases").replace(/\/+$/, ""), a = n.now ?? Date.now, o, s = () => {
+}), G = (e) => `${e}_${v(9).toString("base64url")}`, ye = (n) => {
+	let r = (n.prefix ?? "/releases").replace(/\/+$/, ""), a = n.now ?? Date.now, o, s = new y(), p = new y(), v = () => {
+		let e = s.getStore();
+		if (e) return e;
 		if (!o) throw new t({ reason: "releases: the app store is not bound yet" });
 		return o;
-	}, m = null, y = async (e) => {
-		let t = (await s().query(T(k).where(x("app", e.app)).descriptor)).find((t) => t.platform === e.platform && t.shell === e.shell), n = !t;
-		t ||= await s().insert(f, {
-			id: W("relapp"),
+	}, b = null, S = async (e) => {
+		let t = (await v().query(T(j).where(x("app", e.app)).descriptor)).find((t) => t.platform === e.platform && t.shell === e.shell), n = !t;
+		t ||= await v().insert(d, {
+			id: G("relapp"),
 			app: e.app,
 			platform: e.platform,
 			shell: e.shell,
+			revision: 0,
 			bundleId: e.bundleId ?? null,
 			updaterPublicKey: e.updaterPublicKey ?? null,
 			runtimeVersion: e.runtimeVersion ?? null,
 			createdAt: new Date(a())
 		});
-		let r = await s().query(T(A).where(x("appId", t.id)).descriptor);
+		let r = await v().query(T(M).where(x("appId", t.id)).descriptor);
 		for (let n of e.channels ?? [
 			"stable",
 			"beta",
 			"internal"
-		]) r.some((e) => e.name === n) || await s().insert(g, {
-			id: W("relch"),
+		]) r.some((e) => e.name === n) || await v().insert(h, {
+			id: G("relch"),
 			appId: t.id,
 			name: n,
 			currentReleaseId: null,
@@ -257,19 +262,19 @@ var fe = (e, t, n) => {
 			row: t,
 			created: n
 		};
-	}, b = async () => {
-		for (let e of n.apps) await y(e);
-	}, S = () => m ?? Promise.resolve(), C = (t, n, r) => v.tryPromise({
+	}, C = async () => {
+		for (let e of n.apps) await S(e);
+	}, w = () => b ?? Promise.resolve(), E = (t, n, r) => _.tryPromise({
 		try: async () => {
-			await S();
-			let i = (await s().query(T(k).where(x("app", t)).descriptor)).find((e) => (n === void 0 || e.platform === n) && (r === void 0 || e.shell === r));
-			if (!i) throw new e({ app: t });
-			return i;
+			await w();
+			let i = await v().query(T(j).where(x("app", t)).descriptor), a = p.getStore(), o = i.find((e) => (a === void 0 || e.id === a) && (n === void 0 || e.platform === n) && (r === void 0 || e.shell === r));
+			if (!o) throw new e({ app: t });
+			return o;
 		},
 		catch: (n) => n instanceof e ? n : new e({ app: t })
-	}), w = (t, n, r) => v.tryPromise({
+	}), D = (t, n, r) => _.tryPromise({
 		try: async () => {
-			let i = (await s().query(T(A).where(x("appId", t)).descriptor)).find((e) => e.name === n);
+			let i = (await v().query(T(M).where(x("appId", t)).descriptor)).find((e) => e.name === n);
 			if (!i) throw new e({
 				app: r,
 				channel: n
@@ -280,11 +285,11 @@ var fe = (e, t, n) => {
 			app: r,
 			channel: n
 		})
-	}), E = (e) => s().query(T(j).where(x("id", e)).descriptor).then((e) => e[0] ?? null), D = (e) => s().query(T(j).where(x("appId", e)).descriptor), O = (e) => s().query(T(M).where(x("releaseId", e)).descriptor), pe = (e) => s().query(T(A).where(x("appId", e)).descriptor), me = (e) => n.retention?.perChannel?.[e] ?? n.retention?.keep ?? 10, F = async (e, t) => {
-		let n = await pe(e), r = fe(await D(e), n, me);
+	}), O = (e) => v().query(T(N).where(x("id", e)).descriptor).then((e) => e[0] ?? null), k = (e) => v().query(T(N).where(x("appId", e)).descriptor), A = (e) => v().query(T(P).where(x("releaseId", e)).descriptor), L = (e) => v().query(T(M).where(x("appId", e)).descriptor), V = (e) => n.retention?.perChannel?.[e] ?? n.retention?.keep ?? 10, ye = async (e, t) => {
+		let n = await L(e), r = ge(await k(e), n, V);
 		if (r.length === 0) return [];
-		for (let e of r) await s().deleteMany(l, { where: x("releaseId", e.id) }), await s().delete(p, e.id);
-		return await K({
+		for (let e of r) await v().deleteMany(l, { where: x("releaseId", e.id) }), await v().delete(f, e.id);
+		return await q({
 			appId: e,
 			kind: "prune",
 			actorId: t,
@@ -293,8 +298,8 @@ var fe = (e, t, n) => {
 				channel: n.find((t) => t.id === e.channelId)?.name ?? null
 			})) }
 		}), r;
-	}, z = async (e) => {
-		let t = await O(e.id);
+	}, Se = async (e) => {
+		let t = await A(e.id);
 		return {
 			id: e.id,
 			version: e.version,
@@ -315,8 +320,8 @@ var fe = (e, t, n) => {
 				contentType: e.contentType
 			}))
 		};
-	}, G = async (e, t) => {
-		let n = await v.runPromise(C(e)), r = await v.runPromise(w(n.id, t, e)), i = r.currentReleaseId ? await E(r.currentReleaseId) : null;
+	}, K = async (e, t) => {
+		let n = await _.runPromise(E(e)), r = await _.runPromise(D(n.id, t, e)), i = r.currentReleaseId ? await O(r.currentReleaseId) : null;
 		return {
 			app: e,
 			channel: t,
@@ -327,8 +332,8 @@ var fe = (e, t, n) => {
 			rolloutSalt: i?.rolloutSalt ?? null,
 			cohorts: i?.cohorts ?? null
 		};
-	}, K = (e) => s().insert(_, {
-		id: W("relev"),
+	}, q = (e) => v().insert(g, {
+		id: G("relev"),
 		appId: e.appId,
 		channelId: e.channelId ?? null,
 		releaseId: e.releaseId ?? null,
@@ -337,20 +342,20 @@ var fe = (e, t, n) => {
 		actorId: e.actorId ?? null,
 		detail: e.detail ?? null,
 		at: new Date(a())
-	}), q = (e) => e.request.subject.type === "user" ? e.request.subject.id : null, ve = {
-		...oe,
+	}), J = (e) => e.request.subject.type === "user" ? e.request.subject.id : null, Ce = {
+		...se,
 		description: "The reactive release policy of a channel: latest version, minimum supported version, kill switches, rollout.",
-		execute: (e) => v.tryPromise({
-			try: () => G(e.app, e.channel),
+		execute: (e) => _.tryPromise({
+			try: () => K(e.app, e.channel),
 			catch: (e) => e
 		})
-	}, ye = {
-		...ie,
+	}, we = {
+		...ae,
 		description: "Every release of an app target, newest first.",
-		execute: (e) => v.gen(function* () {
-			let t = yield* C(e.app), n = yield* v.promise(() => D(t.id)), r = yield* v.promise(() => s().query(T(A).where(x("appId", t.id)).descriptor)), i = [];
+		execute: (e) => _.gen(function* () {
+			let t = yield* E(e.app), n = yield* _.promise(() => k(t.id)), r = yield* _.promise(() => v().query(T(M).where(x("appId", t.id)).descriptor)), i = [];
 			for (let e of [...n].sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime() || c(t.version, e.version))) {
-				let t = yield* v.promise(() => O(e.id));
+				let t = yield* _.promise(() => A(e.id));
 				i.push({
 					id: e.id,
 					version: e.version,
@@ -365,13 +370,13 @@ var fe = (e, t, n) => {
 			}
 			return i;
 		})
-	}, be = {
-		...ne,
+	}, Te = {
+		...re,
 		description: "Register an app target at runtime, with its channels; idempotent.",
-		execute: (e) => v.tryPromise({
+		execute: (e) => _.tryPromise({
 			try: async () => {
-				await S();
-				let { row: t, created: n } = await y({
+				await w();
+				let { row: t, created: n } = await S({
 					app: e.app,
 					platform: e.platform,
 					shell: e.shell,
@@ -387,14 +392,14 @@ var fe = (e, t, n) => {
 			},
 			catch: (n) => new t({ reason: `releases: ${e.app} could not be registered: ${n instanceof Error ? n.message : String(n)}` })
 		})
-	}, xe = {
+	}, Ee = {
 		...u,
 		description: "Create a draft release of a version on a channel.",
-		execute: (e, n) => v.gen(function* () {
-			let r = yield* C(e.app), i = yield* w(r.id, e.channel, e.app);
-			if ((yield* v.promise(() => D(r.id))).some((t) => t.version === e.version)) return yield* v.fail(new t({ reason: `version ${e.version} already exists for ${e.app}` }));
-			let o = W("rel");
-			return yield* v.promise(() => s().insert(p, {
+		execute: (e, n) => _.gen(function* () {
+			let r = yield* E(e.app), i = yield* D(r.id, e.channel, e.app);
+			if ((yield* _.promise(() => k(r.id))).some((t) => t.version === e.version)) return yield* _.fail(new t({ reason: `version ${e.version} already exists for ${e.app}` }));
+			let o = G("rel");
+			return yield* _.promise(() => v().insert(f, {
 				id: o,
 				appId: r.id,
 				channelId: i.id,
@@ -403,32 +408,32 @@ var fe = (e, t, n) => {
 				notes: e.notes ?? null,
 				state: "draft",
 				rolloutPercent: 0,
-				rolloutSalt: W("salt"),
+				rolloutSalt: G("salt"),
 				cohorts: e.cohorts ?? null,
-				createdBy: q(n),
+				createdBy: J(n),
 				createdAt: new Date(a()),
 				updatedAt: new Date(a())
-			})), yield* v.promise(() => K({
+			})), yield* _.promise(() => q({
 				appId: r.id,
 				channelId: i.id,
 				releaseId: o,
 				kind: "create",
-				actorId: q(n),
+				actorId: J(n),
 				detail: { version: e.version }
-			})), yield* v.promise(() => F(r.id, q(n))), { id: o };
+			})), yield* _.promise(() => ye(r.id, J(n))), { id: o };
 		})
-	}, Se = {
-		...re,
+	}, De = {
+		...ie,
 		description: "Attach an artefact (a file the client downloads) to a release.",
-		execute: (n, r) => v.gen(function* () {
-			let i = yield* v.promise(() => E(n.releaseId));
-			if (!i) return yield* v.fail(new e({
+		execute: (n, r) => _.gen(function* () {
+			let i = yield* _.promise(() => O(n.releaseId));
+			if (!i) return yield* _.fail(new e({
 				app: "?",
 				version: n.releaseId
 			}));
-			if (!/^[a-f0-9]{64}$/i.test(n.sha256)) return yield* v.fail(new t({ reason: "sha256 must be 64 hex characters" }));
-			let o = W("relart");
-			return yield* v.promise(() => s().insert(l, {
+			if (!/^[a-f0-9]{64}$/i.test(n.sha256)) return yield* _.fail(new t({ reason: "sha256 must be 64 hex characters" }));
+			let o = G("relart");
+			return yield* _.promise(() => v().insert(l, {
 				id: o,
 				releaseId: i.id,
 				kind: n.kind,
@@ -441,158 +446,158 @@ var fe = (e, t, n) => {
 				assetKey: n.assetKey ?? null,
 				contentType: n.contentType ?? null,
 				createdAt: new Date(a())
-			})), yield* v.promise(() => K({
+			})), yield* _.promise(() => q({
 				appId: i.appId,
 				releaseId: i.id,
 				kind: "upload",
-				actorId: q(r),
+				actorId: J(r),
 				detail: {
 					kind: n.kind,
 					target: n.target ?? null
 				}
 			})), { id: o };
 		})
-	}, Ce = {
-		...d,
+	}, Oe = {
+		...ee,
 		description: "Point a channel at a release (no rebuild) and start its rollout.",
-		execute: (n, r) => v.gen(function* () {
-			let i = yield* C(n.app), o = yield* w(i.id, n.to, n.app), c = yield* v.promise(() => D(i.id)), l = c.find((e) => e.version === n.version);
-			if (!l) return yield* v.fail(new e({
+		execute: (n, r) => _.gen(function* () {
+			let i = yield* E(n.app), o = yield* D(i.id, n.to, n.app), s = yield* _.promise(() => k(i.id)), c = s.find((e) => e.version === n.version);
+			if (!c) return yield* _.fail(new e({
 				app: n.app,
 				version: n.version
 			}));
-			let u = yield* v.promise(() => O(l.id));
-			if (!o.allowUnsigned && u.some((e) => e.signature === null)) return yield* v.fail(new t({ reason: `release ${n.version} has unsigned artefacts; channel ${n.to} refuses them` }));
-			let d = Math.max(0, Math.min(100, n.rolloutPercent ?? 100));
-			return yield* v.promise(() => s().update(p, l.id, {
+			let l = yield* _.promise(() => A(c.id));
+			if (!o.allowUnsigned && l.some((e) => e.signature === null)) return yield* _.fail(new t({ reason: `release ${n.version} has unsigned artefacts; channel ${n.to} refuses them` }));
+			let u = Math.max(0, Math.min(100, n.rolloutPercent ?? 100));
+			return yield* _.promise(() => v().update(f, c.id, {
 				channelId: o.id,
-				state: d >= 100 ? "complete" : "rolling",
-				rolloutPercent: d,
+				state: u >= 100 ? "complete" : "rolling",
+				rolloutPercent: u,
 				updatedAt: new Date(a())
-			})), yield* v.promise(() => s().update(g, o.id, {
-				currentReleaseId: l.id,
+			})), yield* _.promise(() => v().update(h, o.id, {
+				currentReleaseId: c.id,
 				updatedAt: new Date(a())
-			})), yield* v.promise(() => K({
+			})), yield* _.promise(() => q({
 				appId: i.id,
 				channelId: o.id,
-				releaseId: l.id,
+				releaseId: c.id,
 				kind: "promote",
-				actorId: q(r),
+				actorId: J(r),
 				detail: {
-					from: c.find((e) => e.id === o.currentReleaseId)?.version ?? null,
+					from: s.find((e) => e.id === o.currentReleaseId)?.version ?? null,
 					to: n.version,
-					rolloutPercent: d
+					rolloutPercent: u
 				}
 			})), {
 				channel: n.to,
 				version: n.version,
-				rolloutPercent: d
+				rolloutPercent: u
 			};
 		})
-	}, we = {
-		...te,
+	}, ke = {
+		...ne,
 		description: "Change the rollout percentage of the channel's current release.",
-		execute: (n, r) => v.gen(function* () {
-			let i = yield* C(n.app), o = yield* w(i.id, n.channel, n.app);
-			if (!o.currentReleaseId) return yield* v.fail(new t({ reason: `channel ${n.channel} has no current release` }));
-			let c = yield* v.promise(() => E(o.currentReleaseId));
-			if (!c) return yield* v.fail(new e({
+		execute: (n, r) => _.gen(function* () {
+			let i = yield* E(n.app), o = yield* D(i.id, n.channel, n.app);
+			if (!o.currentReleaseId) return yield* _.fail(new t({ reason: `channel ${n.channel} has no current release` }));
+			let s = yield* _.promise(() => O(o.currentReleaseId));
+			if (!s) return yield* _.fail(new e({
 				app: n.app,
 				channel: n.channel
 			}));
-			let l = Math.max(0, Math.min(100, n.percent));
-			return yield* v.promise(() => s().update(p, c.id, {
-				rolloutPercent: l,
-				state: l >= 100 ? "complete" : "rolling",
+			let c = Math.max(0, Math.min(100, n.percent));
+			return yield* _.promise(() => v().update(f, s.id, {
+				rolloutPercent: c,
+				state: c >= 100 ? "complete" : "rolling",
 				updatedAt: new Date(a())
-			})), yield* v.promise(() => K({
+			})), yield* _.promise(() => q({
 				appId: i.id,
 				channelId: o.id,
-				releaseId: c.id,
+				releaseId: s.id,
 				kind: "rollout",
-				actorId: q(r),
-				detail: { percent: l }
+				actorId: J(r),
+				detail: { percent: c }
 			})), {
-				version: c.version,
-				rolloutPercent: l
+				version: s.version,
+				rolloutPercent: c
 			};
 		})
-	}, Te = {
-		...ee,
+	}, Ae = {
+		...te,
 		description: "Point the channel back at the previous release; the current one is marked rolled back.",
-		execute: (e, n) => v.gen(function* () {
-			let r = yield* C(e.app), i = yield* w(r.id, e.channel, e.app);
-			if (!i.currentReleaseId) return yield* v.fail(new t({ reason: `channel ${e.channel} has no current release` }));
-			let o = yield* v.promise(() => D(r.id)), l = o.find((e) => e.id === i.currentReleaseId), u = o.filter((e) => e.channelId === i.id && e.id !== i.currentReleaseId && e.state !== "rolledBack").sort((e, t) => c(t.version, e.version))[0];
-			return l && (yield* v.promise(() => s().update(p, l.id, {
+		execute: (e, n) => _.gen(function* () {
+			let r = yield* E(e.app), i = yield* D(r.id, e.channel, e.app);
+			if (!i.currentReleaseId) return yield* _.fail(new t({ reason: `channel ${e.channel} has no current release` }));
+			let o = yield* _.promise(() => k(r.id)), s = o.find((e) => e.id === i.currentReleaseId), l = o.filter((e) => e.channelId === i.id && e.id !== i.currentReleaseId && e.state !== "rolledBack").sort((e, t) => c(t.version, e.version))[0];
+			return s && (yield* _.promise(() => v().update(f, s.id, {
 				state: "rolledBack",
 				updatedAt: new Date(a())
-			}))), yield* v.promise(() => s().update(g, i.id, {
-				currentReleaseId: u?.id ?? null,
+			}))), yield* _.promise(() => v().update(h, i.id, {
+				currentReleaseId: l?.id ?? null,
 				updatedAt: new Date(a())
-			})), yield* v.promise(() => K({
+			})), yield* _.promise(() => q({
 				appId: r.id,
 				channelId: i.id,
-				releaseId: l?.id ?? null,
+				releaseId: s?.id ?? null,
 				kind: "rollback",
 				reason: e.reason,
-				actorId: q(n),
+				actorId: J(n),
 				detail: {
-					from: l?.version ?? null,
-					to: u?.version ?? null
+					from: s?.version ?? null,
+					to: l?.version ?? null
 				}
-			})), { version: u?.version ?? null };
+			})), { version: l?.version ?? null };
 		})
-	}, J = {
-		...ae,
+	}, je = {
+		...oe,
 		description: "Set the minimum supported version and kill switches of a channel.",
-		execute: (e, t) => v.gen(function* () {
-			let n = yield* C(e.app), r = yield* w(n.id, e.channel, e.app);
-			return yield* v.promise(() => s().update(g, r.id, {
+		execute: (e, t) => _.gen(function* () {
+			let n = yield* E(e.app), r = yield* D(n.id, e.channel, e.app);
+			return yield* _.promise(() => v().update(h, r.id, {
 				...e.minSupportedVersion === void 0 ? {} : { minSupportedVersion: e.minSupportedVersion },
 				...e.killSwitches === void 0 ? {} : { killSwitches: e.killSwitches },
 				updatedAt: new Date(a())
-			})), yield* v.promise(() => K({
+			})), yield* _.promise(() => q({
 				appId: n.id,
 				channelId: r.id,
 				kind: "policy",
 				reason: e.reason,
-				actorId: q(t),
+				actorId: J(t),
 				detail: {
 					minSupportedVersion: e.minSupportedVersion ?? null,
 					killSwitches: e.killSwitches ?? null
 				}
-			})), yield* v.promise(() => G(e.app, e.channel));
+			})), yield* _.promise(() => K(e.app, e.channel));
 		})
 	}, Y = async (e, t) => {
-		let n = await v.runPromise(C(e)), r = await v.runPromise(w(n.id, t, e)), i = r.currentReleaseId ? await E(r.currentReleaseId) : null;
+		let n = await _.runPromise(E(e)), r = await _.runPromise(D(n.id, t, e)), i = r.currentReleaseId ? await O(r.currentReleaseId) : null;
 		return {
 			app: n,
 			channel: r,
-			release: i ? await z(i) : null
+			release: i ? await Se(i) : null
 		};
-	}, X = (e, t) => t.get("install") ?? e.headers["x-voltro-install-id"] ?? e.headers["expo-embedded-update-id"] ?? "anonymous", Ee = {
+	}, X = (e, t) => t.get("install") ?? e.headers["x-voltro-install-id"] ?? e.headers["expo-embedded-update-id"] ?? "anonymous", Me = {
 		method: "GET",
 		path: r,
 		handle: async (t) => {
-			if (t.method !== "GET" && t.method !== "HEAD") return H(405, { error: "method_not_allowed" });
+			if (t.method !== "GET" && t.method !== "HEAD") return U(405, { error: "method_not_allowed" });
 			let n = t.path.slice(r.length).split("/").filter((e) => e.length > 0).map(decodeURIComponent), a = new URLSearchParams(t.query), [o, s] = n;
-			if (!o || !s) return H(404, { error: "not_found" });
+			if (!o || !s) return U(404, { error: "not_found" });
 			try {
 				if (s === "tauri") {
 					let [, , e, r, i] = n;
-					if (!e || !r || !i) return H(400, { error: "expected /tauri/:channel/:target/:currentVersion" });
-					let { release: s } = await Y(o, e), c = s ? I(s, {
+					if (!e || !r || !i) return U(400, { error: "expected /tauri/:channel/:target/:currentVersion" });
+					let { release: s } = await Y(o, e), c = s ? R(s, {
 						installId: X(t, a),
 						currentVersion: i,
 						target: r
 					}) : null;
-					return c ? H(200, c) : U(204);
+					return c ? U(200, c) : W(204);
 				}
 				if (s === "expo" && n[2] === "manifest") {
 					let e = t.headers["expo-channel-name"] ?? a.get("channel") ?? "stable", n = t.headers["expo-platform"] ?? a.get("platform"), r = t.headers["expo-runtime-version"] ?? a.get("runtimeVersion") ?? "";
-					if (n !== "ios" && n !== "android") return H(400, { error: "expo-platform must be ios or android" });
-					let { app: i, release: s } = await Y(o, e), c = R(s, {
+					if (n !== "ios" && n !== "android") return U(400, { error: "expo-platform must be ios or android" });
+					let { app: i, release: s } = await Y(o, e), c = B(s, {
 						installId: X(t, a),
 						currentVersion: null,
 						platform: n,
@@ -602,16 +607,16 @@ var fe = (e, t, n) => {
 						runtimeVersion: i.runtimeVersion,
 						rolledBackTo: null
 					});
-					return c.kind === "no-update" ? H(200, { type: "noUpdateAvailable" }, {
+					return c.kind === "no-update" ? U(200, { type: "noUpdateAvailable" }, {
 						"expo-protocol-version": "1",
 						"expo-sfv-version": "0"
-					}) : c.kind === "rollback" ? H(200, {
+					}) : c.kind === "rollback" ? U(200, {
 						type: "rollBackToEmbedded",
 						parameters: { commitTime: c.commitTime }
 					}, {
 						"expo-protocol-version": "1",
 						"expo-sfv-version": "0"
-					}) : H(200, c.manifest, {
+					}) : U(200, c.manifest, {
 						"expo-protocol-version": "1",
 						"expo-sfv-version": "0",
 						"expo-manifest-filters": ""
@@ -619,21 +624,21 @@ var fe = (e, t, n) => {
 				}
 				if (s === "electron") {
 					let [, , e, t] = n;
-					if (!e || !t) return H(400, { error: "expected /electron/:channel/latest.yml" });
+					if (!e || !t) return U(400, { error: "expected /electron/:channel/latest.yml" });
 					let r = t === "latest-mac.yml" ? "mac" : t === "latest-linux.yml" ? "linux" : t === "latest.yml" ? "win" : null;
-					if (r === null) return H(404, { error: "not_found" });
-					let { release: i } = await Y(o, e), a = i ? L(i, r) : null;
-					return a ? he(200, a, "text/yaml; charset=utf-8") : U(204);
+					if (r === null) return U(404, { error: "not_found" });
+					let { release: i } = await Y(o, e), a = i ? z(i, r) : null;
+					return a ? ve(200, a, "text/yaml; charset=utf-8") : W(204);
 				}
 				if (s === "download") {
 					let [, , e] = n;
-					if (!e) return H(400, { error: "expected /download/:channel" });
+					if (!e) return U(400, { error: "expected /download/:channel" });
 					let { channel: r, release: i } = await Y(o, e);
-					if (!r.public) return H(403, { error: "channel_not_public" });
-					if (!i) return U(204);
-					let s = a.get("os") ?? V(t.headers["user-agent"] ?? "")?.os, c = a.get("arch") ?? V(t.headers["user-agent"] ?? "")?.arch;
-					if (!s) return H(400, { error: "os is required (?os=macos|windows|linux|ios|android)" });
-					let l = B(i, s, c);
+					if (!r.public) return U(403, { error: "channel_not_public" });
+					if (!i) return W(204);
+					let s = a.get("os") ?? H(t.headers["user-agent"] ?? "")?.os, c = a.get("arch") ?? H(t.headers["user-agent"] ?? "")?.arch;
+					if (!s) return U(400, { error: "os is required (?os=macos|windows|linux|ios|android)" });
+					let l = _e(i, s, c);
 					return l ? {
 						status: 302,
 						body: "",
@@ -641,23 +646,23 @@ var fe = (e, t, n) => {
 							location: l.url,
 							"cache-control": "no-store"
 						}
-					} : H(404, { error: "no_artifact_for_os" });
+					} : U(404, { error: "no_artifact_for_os" });
 				}
 				if (s === "policy") {
 					let [, , e] = n;
-					if (!e) return H(400, { error: "expected /policy/:channel" });
-					let r = await G(o, e), s = a.get("version"), c = s ? i(r, {
+					if (!e) return U(400, { error: "expected /policy/:channel" });
+					let r = await K(o, e), s = a.get("version"), c = s ? i(r, {
 						version: s,
 						installId: X(t, a)
 					}) : null;
-					return H(200, {
+					return U(200, {
 						policy: r,
 						...c ? { verdict: c } : {}
 					});
 				}
-				return H(404, { error: "not_found" });
+				return U(404, { error: "not_found" });
 			} catch (t) {
-				if (t instanceof e) return H(404, {
+				if (t instanceof e) return U(404, {
 					error: "not_found",
 					app: t.app
 				});
@@ -667,18 +672,19 @@ var fe = (e, t, n) => {
 	}, Z = (e) => ({
 		kind: "json",
 		data: e
-	}), De = [{
+	}), Ne = [{
 		method: "GET",
 		path: "/overview",
 		scope: "shared-store",
 		description: "Every app target with its channels, current versions and rollout state.",
-		handler: () => v.promise(async () => {
-			let e = await s().query(T(k).descriptor), t = await s().query(T(A).descriptor), n = await s().query(T(j).descriptor);
+		handler: () => _.promise(async () => {
+			let e = await v().query(T(j).descriptor), t = await v().query(T(M).descriptor), n = await v().query(T(N).descriptor);
 			return Z({ apps: e.map((e) => ({
 				id: e.id,
 				app: e.app,
 				platform: e.platform,
 				shell: e.shell,
+				revision: e.revision,
 				channels: t.filter((t) => t.appId === e.id).map((e) => {
 					let t = n.find((t) => t.id === e.currentReleaseId);
 					return {
@@ -698,20 +704,48 @@ var fe = (e, t, n) => {
 		path: "/events",
 		scope: "shared-store",
 		description: "The last 100 release events (promote, rollback, rollout, policy).",
-		handler: () => v.promise(async () => {
-			let e = await s().query(T(N).descriptor);
+		handler: () => _.promise(async () => {
+			let e = await v().query(T(F).descriptor), t = await v().query(T(M).descriptor), n = new Map(t.map((e) => [e.id, e.name]));
 			return Z({ events: [...e].sort((e, t) => t.at.getTime() - e.at.getTime()).slice(0, 100).map((e) => ({
 				...e,
+				channelName: e.channelId === null ? null : n.get(e.channelId) ?? null,
 				at: e.at.toISOString()
 			})) });
 		})
-	}], Oe = () => ({ request: {
+	}], Pe = async (n, r) => {
+		let i = n.releaseId === void 0 ? null : await O(n.releaseId);
+		if (n.releaseId !== void 0 && !i) throw new e({ app: n.releaseId });
+		let a = (await v().query(T(j).descriptor)).filter((e) => (n.app === void 0 || e.app === n.app) && (n.platform === void 0 || e.platform === n.platform) && (n.shell === void 0 || e.shell === n.shell) && (i === null || e.id === i.appId) && (n.expectedTarget === void 0 || e.id === n.expectedTarget.id));
+		if (a.length === 0 && r) return;
+		if (a.length === 0) throw new e({ app: n.app ?? n.releaseId ?? "" });
+		if (a.length !== 1) throw new t({ reason: "Multiple release targets match this app. Select an exact target." });
+		let o = a[0], s = n.expectedTarget?.revision ?? o.revision;
+		if (!Number.isSafeInteger(s) || s < 0 || s >= 2 ** 53 - 1 || o.revision !== s || await v().updateMany("_voltro_release_apps", { revision: s + 1 }, { where: fe(x("id", o.id), x("revision", s)) }) !== 1) throw new t({ reason: "Release target changed. Refresh and review the action again." });
+		return o.id;
+	}, Fe = (e) => e.kind === "mutation" ? {
+		...e,
+		execute: (t, n) => _.gen(function* () {
+			let r = yield* _.runtime();
+			return yield* _.tryPromise({
+				try: async (i) => {
+					await w();
+					let a = (a) => s.run(a, async () => {
+						let a = await Pe(t, e.name === "releases.registerApp"), o = () => le.runPromise(r)(e.execute(t, n).pipe(_.either), { signal: i }), s = a === void 0 ? await o() : await p.run(a, o);
+						if (s._tag === "Left") throw s.left;
+						return s.right;
+					});
+					return n.mutationStore ? a(n.mutationStore) : v().transactional(a);
+				},
+				catch: (e) => e
+			});
+		})
+	} : e, Ie = () => ({ request: {
 		subject: {
 			type: "anonymous",
 			id: null,
 			tenantId: null
 		},
-		traceId: de()
+		traceId: he()
 	} }), Q = (e, t) => ({
 		kind: "json",
 		status: e,
@@ -720,7 +754,7 @@ var fe = (e, t, n) => {
 		method: "POST",
 		path: n,
 		description: i,
-		handler: (n) => v.gen(function* () {
+		handler: (n) => _.gen(function* () {
 			let i;
 			try {
 				i = JSON.parse(n.body || "{}");
@@ -728,30 +762,32 @@ var fe = (e, t, n) => {
 				return Q(400, "invalid JSON body");
 			}
 			if (typeof i != "object" || !i || Array.isArray(i)) return Q(400, "expected a JSON object body");
-			let a = yield* r.execute(i, Oe()).pipe(v.either);
-			if (a._tag === "Left") {
-				let n = a.left;
-				return n instanceof e ? Q(404, `not found: ${n.app}${n.version ? ` ${n.version}` : ""}${n.channel ? ` (${n.channel})` : ""}`) : n instanceof t ? Q(409, n.reason) : Q(400, n instanceof Error ? n.message : String(n));
+			let a = yield* ue.decodeUnknown(r.input)(i).pipe(_.either);
+			if (a._tag === "Left") return Q(400, "invalid action input");
+			let o = yield* Fe(r).execute(a.right, Ie()).pipe(_.either);
+			if (o._tag === "Left") {
+				let n = o.left;
+				return n instanceof e ? Q(404, `not found: ${n.app}${n.version ? ` ${n.version}` : ""}${n.channel ? ` (${n.channel})` : ""}`) : n instanceof t ? Q(409, n.reason) : Q(500, "release action failed");
 			}
-			return Z({ result: a.right });
+			return Z({ result: o.right });
 		})
-	}), ke = [
-		$("/apps", be, "Register an app target at runtime: { app, platform, shell, channels? }."),
-		$("/create", xe, "Create a draft release: { app, channel, version, buildId?, notes? }."),
-		$("/upload", Se, "Attach an artefact: { releaseId, kind, target?, url, sha256, size, signature? }."),
-		$("/promote", Ce, "Promote a version onto a channel: { app, version, to, rolloutPercent? }."),
-		$("/rollout", we, "Set the rollout percentage: { app, channel, percent }."),
-		$("/rollback", Te, "Roll a channel back: { app, channel, reason }."),
-		$("/policy", J, "Set the policy: { app, channel, minSupportedVersion?, killSwitches?, reason }.")
+	}), Le = [
+		$("/apps", Te, "Register an app target at runtime: { app, platform, shell, channels? }."),
+		$("/create", Ee, "Create a draft release: { app, channel, version, buildId?, notes? }."),
+		$("/upload", De, "Attach an artefact: { releaseId, kind, target?, url, sha256, size, signature? }."),
+		$("/promote", Oe, "Promote a version onto a channel: { app, version, to, rolloutPercent? }."),
+		$("/rollout", ke, "Set the rollout percentage: { app, channel, percent }."),
+		$("/rollback", Ae, "Roll a channel back: { app, channel, reason }."),
+		$("/policy", je, "Set the policy: { app, channel, minSupportedVersion?, killSwitches?, reason }.")
 	];
-	return le({
+	return pe({
 		source: "plugin",
-		table: _,
+		table: g,
 		timeColumn: "at",
-		ttlMs: ue(process.env.VOLTRO_RELEASE_EVENTS_TTL_HOURS, 8760),
+		ttlMs: me(process.env.VOLTRO_RELEASE_EVENTS_TTL_HOURS, 8760),
 		envVar: "VOLTRO_RELEASE_EVENTS_TTL_HOURS"
-	}), ce({
-		name: n.name ? `${h}#${n.name}` : h,
+	}), de({
+		name: n.name ? `${m}#${n.name}` : m,
 		description: "Release channels, artefacts and rollouts — the self-hosted update server behind Tauri, Expo OTA, electron-updater and PWA feeds, with a reactive release policy.",
 		permissions: [
 			"inspect:read",
@@ -759,40 +795,40 @@ var fe = (e, t, n) => {
 			"store:write"
 		],
 		routes: [
-			ve,
-			ye,
-			be,
-			xe,
-			Se,
 			Ce,
 			we,
 			Te,
-			J
-		],
-		rpcClientDescriptors: se,
-		httpRoutes: [Ee],
-		inspectEndpoints: [...De, ...ke],
-		extendSchema: { tables: [...P] },
-		declaredEnv: _e,
-		privacy: ge,
+			Ee,
+			De,
+			Oe,
+			ke,
+			Ae,
+			je
+		].map(Fe),
+		rpcClientDescriptors: ce,
+		httpRoutes: [Me],
+		inspectEndpoints: [...Ne, ...Le],
+		extendSchema: { tables: [...I] },
+		declaredEnv: xe,
+		privacy: be,
 		bindDataStore: (e) => {
-			o = e, m = b(), m.catch(() => {});
+			o = e, b = C(), b.catch(() => {});
 		},
-		onActivate: () => v.tryPromise({
+		onActivate: () => _.tryPromise({
 			catch: (e) => /* @__PURE__ */ Error(`@voltro/plugin-releases could not seed its targets and channels: ${e instanceof Error ? e.message : String(e)}`),
-			try: () => S()
+			try: () => w()
 		})
 	});
-}, ge = { collects: [{
+}, be = { collects: [{
 	category: "device-id",
 	linked: !1,
 	tracking: !1,
 	purposes: ["app-functionality"]
-}] }, _e = [{
+}] }, xe = [{
 	name: "VOLTRO_RELEASE_EVENTS_TTL_HOURS",
 	required: !1,
 	secret: !1,
 	description: "Hours a release event (create, upload, promote, rollout, rollback, policy, prune) is kept before the retention sweep removes it. Default 8760 (one year)."
 }];
 //#endregion
-export { h as BASE_NAME, m as RELEASES_MANAGE_SCOPE, p as RELEASES_TABLE, f as RELEASE_APPS_TABLE, l as RELEASE_ARTIFACTS_TABLE, g as RELEASE_CHANNELS_TABLE, _ as RELEASE_EVENTS_TABLE, pe as RELEASE_PLATFORMS, me as RELEASE_SHELLS, e as ReleaseNotFound, t as ReleaseRefused, c as compareVersions, i as evaluatePolicy, o as inRollout, r as isNewerVersion, F as offeredTo, V as osFromUserAgent, n as parseVersion, B as pickDownload, k as releaseAppsTable, M as releaseArtifactsTable, A as releaseChannelsTable, N as releaseEventsTable, P as releaseTables, G as releasesPlugin, j as releasesTable, L as renderElectronLatestYml, R as renderExpoFeed, I as renderTauriFeed, a as rolloutBucket, s as sortVersionsDesc };
+export { m as BASE_NAME, p as RELEASES_MANAGE_SCOPE, f as RELEASES_TABLE, d as RELEASE_APPS_TABLE, l as RELEASE_ARTIFACTS_TABLE, h as RELEASE_CHANNELS_TABLE, g as RELEASE_EVENTS_TABLE, k as RELEASE_PLATFORMS, A as RELEASE_SHELLS, e as ReleaseNotFound, t as ReleaseRefused, c as compareVersions, i as evaluatePolicy, o as inRollout, r as isNewerVersion, L as offeredTo, H as osFromUserAgent, n as parseVersion, _e as pickDownload, j as releaseAppsTable, P as releaseArtifactsTable, M as releaseChannelsTable, F as releaseEventsTable, I as releaseTables, ye as releasesPlugin, N as releasesTable, z as renderElectronLatestYml, B as renderExpoFeed, R as renderTauriFeed, a as rolloutBucket, s as sortVersionsDesc };