@voltro/plugin-releases 0.87.0 → 0.88.0

package/CHANGELOG.md

@@ -41,6 +41,166 @@ _Changes staged for the next release accumulate here (rolled up from
 
 ---
 
+## [0.88.0] — 2026-11-02
+
+### ⚠ BREAKING
+
+- **Direct computed-cache key callers handle unencodable subjects** — `@voltro/runtime`, `@voltro/voltro`
+
+  `computedCacheKey()` can return `bypass: 'subject-not-encodable'` for claims that cannot safely identify a cache entry. Direct consumers with exhaustive bypass switches must handle this case by running without caching. `voltro update` identifies the direct imports to review. Queries using the native `cache:` declaration and `invoke()` tests need no manual key or code change.
+- **The framework runs on effect 4.1.0** — `@voltro/cli`, `@voltro/devtools`, `@voltro/runtime`, `@voltro/database`, `@voltro/voltro`, `@voltro/sql-sqlite`, `@voltro/sql-mysql`, `@voltro/sql-mssql`, `@voltro/sql-postgres`
+
+  Every `@voltro/*` package now pins `effect` and its `@effect/*` companions to 4.1.0. Apps pin the same version and run `voltro add patches`: it writes the 4.1.0 patch files, retires the `patchedDependencies` entries an earlier CLI shipped for 4.0.1 (pnpm refuses an install over an unused patch) and moves the lockstep overrides. Two former patch fixes ship upstream in 4.1.0 (SQL Server request cancellation, the SQL Server message-storage MERGE). On SQL Server the shared transaction key now applies to every client in the process, not only the first one built.
+
+  `chunkRowsForInsert` from `@voltro/database` returns non-empty chunks (`NonEmptyReadonlyArray`), the shape effect 4.1's `sql.insert` requires; an empty input yields no chunk instead of one empty chunk.
+
+  SQL statement spans are named after their database, following the OpenTelemetry database conventions: the database name, else the server address, else the system name (`postgresql`, `mysql`, `microsoft.sql_server`, `sqlite`). Before, every statement span was `sql.execute`. Trace queries and dashboards that match that name should match the `db.query.text` attribute instead; the devtools trace panel and durable-trace sampling already do.
+
+  **`voltro update` carries you across this** — codemod `0.88.0/01_effect-4-1`. If you pin versions by hand and never run it, print the notes without changing anything: `voltro update --codemods-only --from <your current version> --dry-run` (this one ships in 0.88.0).
+- **Runtime patch pins preserve third-party Effect majors** — `@voltro/cli`
+
+  `voltro add patches` scopes Effect pins to their current major instead of replacing unrelated libraries' Effect 3 dependencies. It migrates exact pins previously shipped by the framework, preserves unrelated policies, and refuses conflicting custom policies before writing files. In pnpm workspaces it names competing nonempty root `resolutions` or `pnpm.overrides` and explains their explicit reconciliation. Peer repair refuses cross-major global policy changes. Bun workspaces require Bun >=1.4.4 and a supported `packageManager` pin or `engines.bun` floor; upgrade the actual tool and older declarations before retrying, because Bun 1.2.0 ignored the scoped companion pin. `voltro update` carries the review as `0.88.0/06_effect-override-scope`.
+- **Keep test runners out of production KV and workflow dependency closures** — `@voltro/kv`, `@voltro/workflow`
+
+  The test-only HotStore and workflow conformance suites now require their caller to supply runner operations. Pass `{ describe, it, expect }` as the third argument to `hotStoreConformance`, and `{ describe, test, expect, beforeAll, afterEach }` as the second argument to `runClusterEngineSuite` and `runJournalEncryptionSuite`. The exported structural runner interfaces have no dependency on Vitest. Both production packages remove their optional Vitest peer; an application's development runner can no longer enter a production deployment through those peer links. Keep Vitest in the test application's own devDependencies. Runtime KV/workflow calls and `runHotStoreSqlParity` are unchanged. `voltro update` identifies direct suite imports for review.
+- **REST test handlers publish events under the request tenant** — `@voltro/testing`, `@voltro/cli`
+
+  When crossing 0.87.0, custom `makeTestApp({ restRoutes })` handlers receive a request-scoped `ctx.app` instead of the root fixture context. Event assertions must subscribe to that request tenant: the default anonymous request uses `acme` or `x-tenant`; an explicit `anonymous: 'no-tenant'` uses `''`, distinct from the event bus subscriber's default `null`. Pass the app's anonymous policy, select the subscriber tenant explicitly and assert delivered payloads even when HTTP success and `notified` already pass. Direct `invoke` retains its supplied context identity, and projected `publicApi` handlers already use request-scoped invocation. Plugin HTTP routes are not mounted by this request harness. `voltro update` locates raw request harness calls and prints the review steps.
+
+### Added
+
+- **voltro add patches --ai accepts ai 7.0.156** — `@voltro/cli`, `@voltro/ai`
+
+  `voltro add patches --ai 7.0.156` wires the AI SDK declaration correction for `@ai-sdk/provider-utils` 5.0.70, regenerated with the original build from the release commit; JavaScript stays byte-identical to the published package. 7.0.105 and 7.0.132 remain selectable. `@voltro/ai` is built and tested against ai 7.0.156.
+- **The retained invoice observations table is exported from the billing package** — `@voltro/plugin-billing`
+
+  `billingRetainedInvoiceObservationsTable` is exported from `@voltro/plugin-billing` beside the other billing tables, so an app can reference it.
+- **plugin-billing accepts stripe 23** — `@voltro/plugin-billing`
+
+  The `stripe` peer range is `^22.6.1 || ^23.0.1`. stripe 23 pins Stripe API version `2026-09-30.endive`; the plugin still sends no `apiVersion` of its own, so the SDK's pinned version applies.
+
+### Changed
+
+- **A booting server holds requests until the app is ready instead of answering 503** — `@voltro/runtime`, `@voltro/voltro`
+
+  `voltro serve`, `voltro start` and `voltro dev` used to answer every request that arrived before the boot finished with a plain-text `503 starting`. On a platform that scales to zero, that request is the visitor who woke the instance, and a browser does not act on `Retry-After` for a navigation. Requests and WebSocket upgrades that arrive while the app boots now wait and are handed to the app in arrival order once it is ready. The wait is bounded by `VOLTRO_BOOT_HOLD_MS` (default `30000`, at most five minutes, `0` restores the immediate `503`) and by 512 waiting requests. A request the wait cannot cover still gets `503` with `Retry-After: 1`, and a browser navigation gets a minimal page that reloads itself. `/internal/startup` reports waiting requests as `held`, and `bindBootListener` accepts `holdMs` and `maxHeld`. Probes are unchanged, so nothing changes under Kubernetes.
+- **DocsLayout navigation nests collapsible groups with page counts** — `@voltro/ui-shadcn`
+
+  `DocsLayout` renders its sidebar as one tree: headerless groups are flat start links, other groups and sub-groups are collapsible rows with page counts, `DocsNavSubGroup` accepts nested `subgroups` and `trailingEntries`, the current page's link carries `aria-current="page"` (forwarded through `ShellLinkProps`), and the rail scrolls the active link into view after navigation.
+- **Native Redis connections use ioredis 6 and keep the RESP2 protocol** — `@voltro/kv`, `@voltro/runtime`, `@voltro/cli`
+
+  The native Redis transport moved to ioredis 6, which defaults to RESP3. Registry connections set `protocol: 2`, so command replies, Pub/Sub and Lua results keep their shapes.
+- **Connection drivers install only with the server runtime** — `@voltro/kv`, `@voltro/runtime`
+
+  `ioredis`, `@upstash/redis` and `@nats-io/transport-node` are optional peers of `@voltro/kv` and dependencies of `@voltro/runtime`. API apps keep all three without a step; web apps and SDKs that reach `@voltro/kv` only through types no longer download server drivers. Code that opens a connection without `@voltro/runtime` adds its driver, and a missing driver now fails naming the package.
+- **The mobile template targets Expo SDK 58** — `@voltro/cli`
+
+  New mobile apps scaffold on Expo SDK 58 with React Native 0.88.1 and React 19.3.0, using the versions SDK 58 bundles for its native modules.
+- **plugin-sentry runs on Sentry 11 and exports server spans over OTLP** — `@voltro/plugin-sentry`
+
+  Sentry 11 removed `SentrySpanProcessor`. The plugin now exports the framework's spans to the OTLP endpoint Sentry derives from the DSN and links errors and logs to the active span with `openTelemetryIntegration()`; the Sentry SDK records no spans of its own. `tracesSampleRate` keeps its meaning and is applied per trace id at the export. Server traces need the optional `@opentelemetry/sdk-trace-base` and `@opentelemetry/exporter-trace-otlp-http` packages (they replace `@sentry/opentelemetry`); without them the plugin warns and reports errors and breadcrumbs only. `init.tracesSampleRate` and `init.enableOpenTelemetrySetup` are ignored, and `init.skipOpenTelemetrySetup` no longer exists in Sentry 11.
+
+### Fixed
+
+- **Deferred workflow starts retain their original caller receipt** — `@voltro/workflow`, `@voltro/cli`
+
+  A controlled workflow start now returns its existing queued receipt when another replica exhausts submission retries, or shared capacity moves, before its acceptance callback dispatches. It no longer reports an ordinary start failure while the committed submission remains unresolved. Execution identity, caller input, capacity ownership and retry limits stay unchanged; definite rejection and invalid ownership still fail explicitly.
+
+- **Aggregate counters are non-negative safe integers on every dialect** — `@voltro/database`
+
+  A `count()` / `countDistinct()` / ranking counter now decodes to a number only when it is a non-negative safe integer; a fractional, negative, non-numeric or larger value is refused instead of passed through or rounded. SQLite and Turso decode counters too when the queried table has decimal columns, where they used to stay strings.
+- **Cache clear honors connection namespace prefixes** — `@voltro/kv`, `@voltro/cache`
+
+  Clearing a cache through a named, namespaced Redis connection now binds logical cache keys to that connection's physical namespace. Redis-family engines and the local transport preserve neighboring caches and invalidation fences, while refusing foreign prefixes and forged key sets. The existing atomic cache command format remains unchanged.
+- **Cache commands use the selected app's configuration and connections** — `@voltro/cli`
+
+  `voltro cache status`, `flush` and `invalidate` resolve `app.config.ts`, environment overrides and named Redis connections exactly like Dev and Serve, including an optional target app directory. Invalid configuration fails instead of silently reporting memory, in-process transports refuse CLI mutation, and diagnostics omit endpoint URLs and credentials.
+- **Generated cache examples boot and upgrade reviews name affected lines** — `@voltro/cli`
+
+  The seeded core API example now uses an object cache declaration. Forced guide refresh discovers both flat and project-grouped app layouts, replacing stale nested examples without executing configs or crossing an app boundary. The shared cache/KV migration review lists authored code locations, including asserted backend literals, and a new review reaches applications that already crossed the original migration. It also identifies stale core guides for refresh; protected hand-maintained guides stay under their owner's control.
+- **Subject query caches follow current authority** — `@voltro/runtime`, `@voltro/testing`
+
+  Subject-scoped computed queries key the complete subject claims and raw and resolved permission sets. Removing an admin grant, changing roles or switching tenant or credential type cannot reuse a result admitted under earlier authority. Authentication refreshes before lookup, and a change while a read is pending refuses retention and delivery. Connection-local state is never covered by subject scope; handlers that read it do not retain their results. The same decisions apply to `invoke` tests, memory caches and Redis caches.
+- **Preserve connection declaration errors across module boundaries** — `@voltro/kv`
+
+  Redis, NATS, Storage, Analytics and SQL registries retain typed configuration diagnostics across module and VM boundaries instead of mislabeling them as dynamic credential failures. Errors returned by credential resolvers remain redacted.
+- **Bind demo API tenants consistently in browser and server renders** — `@voltro/cli`
+
+  The fullstack, admin, SSR API and public status templates now send their explicit demo tenant to header-based anonymous APIs. SSR API and status pages use the same binding for server-side RPC reads, so a fresh scaffold renders successfully and its browser subscriptions select the same data. API refusals for missing tenants and access checks remain enforced. These demo bindings select rows and do not authenticate users; private production data requires verified authentication. Fresh-consumer diagnostics retain uppercase error log lines.
+- **Two voltro dev processes starting together mint one set of secrets, not two** — `@voltro/cli`
+
+  `voltro dev` mints missing project secrets into `.env.local`. Two processes on one project starting at the same time (two local replicas, a dev server beside a test boot) each minted their own values; with field encryption the database recorded one key and refused the second process at boot. Minting now runs under a lock and adopts a value another process wrote meanwhile; a lock left by a crashed mint is taken over.
+- **Event warnings follow workspace package exports** — `@voltro/cli`
+
+  Development event wiring warnings now recognise sibling `useEvent` consumers imported through package exports, TypeScript path aliases, named and namespace re-exports, and static local aliases. Each subscription is matched to its descriptor so an unused import or another API's same-named module does not hide a missing consumer. Workspace discovery supports declared pnpm, npm, Yarn and Bun members and excludes nested projects and build output.
+- **Index audit preserves partial row coverage and uniqueness** — `@voltro/database`
+
+  The index audit recommends dropping an index only when another B-tree index preserves its row coverage and uniqueness. Partial unique indexes no longer make full indexes appear redundant; specialized index methods and unproved predicate relationships are excluded, and recommendations name only the safe replacement direction.
+- **Migration logs identify which operations their count includes** — `@voltro/database`
+
+  Development auto-migration logs now identify their applied-operation count as the planner pass, excluding framework bootstrap and file-based migrations. A schema plan taken before boot can include work completed by those earlier stages; run a new plan after boot to verify that no operations remain.
+- **Filter completed workflow pool owners before recovery transport** — `@voltro/cli`, `@voltro/voltro`, `@voltro/workflow`
+
+  Pool release recovery now persists its terminal settlement on submission and restart owners and filters those markers through indexed SQL predicates. Finished owner history no longer crosses the wire on every idle pass or after process restart. Lost release acknowledgements, held owners and missing evidence remain recoverable and reported; immutable owners and permit tombstones remain for receipt and replay safety. Normal framework schema migration adds two nullable settlement markers and their indexes; existing history is checked once in bounded pages. Settlement indexes use explicit short names within SQL identifier limits. Reconciliation cadence is unchanged.
+- **Presence transport warnings follow actual subscription readiness** — `@voltro/plugin-presence`
+
+  Presence reports pending binding or subscription acquisition without a false missing-provider warning after five seconds. It reports cross-instance readiness only after acquiring the broadcast subscription, while local-only bindings and failed subscriptions still warn. Closing or replacing a binding prevents stale callbacks and releases subscriptions acquired afterward.
+- **Self-updates finish after the old CLI installation is removed** — `@voltro/cli`, `@voltro/runtime`
+
+  `voltro update` loads its completion helpers before installing the target version, so removing the running CLI package no longer turns a successful upgrade into a missing-module failure. Error reporting uses the shared lightweight `@voltro/runtime/boot-refusal` entry loaded before dispatch; genuine failures keep their original message and exit code without loading the server dependency graph for help or version commands.
+- **Compiled API servers start without a source-analysis dependency** — `@voltro/cli`
+
+  The development event-consumer audit loads its source compiler only when scanning. A compiled API server can start after relocation without app sources or a direct `ts-morph` dependency. Package-export consumer discovery keeps its existing scope and does not execute application modules.
+- **SignalHeader centers its brand in the masthead** — `@voltro/ui-shadcn`
+
+  The `SignalHeader` brand slot is a centered flex row, so a brand link no longer sits on the text baseline and renders a few pixels above the masthead's center.
+- **Update reports changed runtime patch assets before boot** — `@voltro/cli`
+
+  `voltro update` compares configured pnpm Effect and SQL-driver patches with the target CLI's assets during its codemod step, including `--codemods-only`. Changed bytes produce refresh and install instructions even without workflows. Same-version checks also report drift. Custom patch paths are named and files remain untouched.
+- **Upgrade reviews omit locator counts and unchanged REST type plumbing** — `@voltro/cli`
+
+  The aggregate review excludes locator chains and local locator aliases while retaining uncertain query receivers. The idempotency review lists REST context constructions, context factories and guard definitions instead of every context or guard parameter annotation. Aliased imported calls in JavaScript custom hosts remain visible.
+
+### Internal (no consumer-facing effect)
+
+- **Effect audits distinguish regression data from executable legacy APIs**
+
+  Effect migration audits allow test data to describe a foreign dependency's retained major. Removed package imports and obsolete bound API calls remain findings in tests and application code, while production migration-residue checks remain unchanged.
+- **The doctor's table nullability manifest covers the billing history tables** — `@voltro/cli`
+
+  The generated nullability manifest `voltro doctor` reads was missing the invoice-history and customer-account tables the billing plugin added; it is regenerated from the declarations.
+- **Installation checks refuse ambient workspaces and source overrides**
+
+  Installation checks require standalone directories before creating projects. Artifact consumers use shipped template and documentation assets without inheriting maintainer source overrides or Node module loaders. Registry, package-manager and explicit application settings remain available.
+- **Installation checks require healthy applications and usable modules**
+
+  Installation checks require API readiness, successful web responses and transformed JavaScript modules while the development process remains running. HTTP errors and HTML fallbacks cannot satisfy those checks. Diagnostics distinguish application startup from shutdown.
+- **Keep CLI fixture temporary roots and child outcomes explicit**
+
+  Automatic sidecar tests inspect the actual operating-system temporary directory and release their bound owner even when an assertion fails. Schema-boot fixtures retain the child's exit signal and assert the real exit tuple alongside readiness and migration counts, so a signal cannot become a false successful process result. Production security and signal guards remain unchanged.
+
+  Workflow recovery tests distinguish the recorded failure budget from concurrent dispatches already in flight. They retain the same prepared execution identity, require one body execution, and verify that stopped or accepted submissions cannot dispatch again.
+- **Native SQL checks isolate schema ownership across fixtures**
+
+  Wallet and shop checks own separate server databases so concurrent schema creation cannot contend with another fixture's live writes. Independent pools within a fixture still share the real database. Cleanup closes all acquired pools before dropping only the owned namespace, and a native regression verifies isolation with identical wallet identities.
+- **Native reload checks retain manifests published during SQL observation**
+
+  Native geometry checks establish the expected-version receiver before reload activation. A real transport regression holds the consumer until the new manifest arrives, so asynchronous SQL observation cannot hide a missed publication. Frame deadlines retain their original call sites.
+- **Native snapshot probes join their scheduled driver**
+
+  Held-source stream probes quiesce and join the actual Host driver before directly pumping its captured graph. This prevents a scheduled turn from concurrently entering that graph and closing the fixture's native Session. Listener, SQL, controller, wire delivery, rights withdrawal and final cleanup assertions remain active; ordinary stream cases retain the running driver.
+- **Bound the reviewed Sentry tool exception and retain every dependency instance**
+
+  The owner-reviewed exception accepts only sentry 0.45.0 under FSL-1.1-Apache-2.0 as unmodified external tooling for the Sentry integration. This does not classify FSL as permissive or remove its competing-use restriction. The runtime license walk checks every resolved instance, so an accepted version cannot hide a second version or license. Generated notices and the SBOM use actual package identities. Containment checks cover framework, workspace and scaffold patch files plus declared patches with arbitrary filenames; the API bundler leaves the tool external.
+- **Stack scaffold checks require major-scoped runtime alignment**
+
+  The normal stack scaffold regression parses its generated workspace policy and verifies both Effect 4 selectors while refusing unqualified Effect and companion pins. Patch declaration and actual patch-byte checks remain, so the regression follows the preserved foreign-major contract instead of demanding its earlier unsafe global override. Its synthetic workspace declares its own pnpm version, making Compose baseline coverage independent of the test runner's package-manager environment.
+- **Dependency security checks verify installed source remediations**
+
+  Dependency security checks accept a reviewed source remediation only after verifying exact patch and implementation hashes, patched references in every lockfile document, actual caller resolution and runtime behavior. Deepmerge's returned-object prototype protection preserves ordinary configuration merging. Unaffected dependency graphs receive no exception, and a local source remediation is never reported as an upstream fixed version.
+
+---
+
 ## [0.87.0] — 2026-10-31
 
 ### ⚠ BREAKING
@@ -3231,6 +3391,15 @@ _Changes staged for the next release accumulate here (rolled up from
 - **Prepare the exact XYFlow type correction before normal installation** — `@voltro/cli`
 
   `voltro add patches --xyflow 12.12.0` prepares the original XYFlow declaration correction and its complete license/notice before a normal package-manager or UI installation. Existing conflicting project patch assets are preserved and rejected before writes.
+- **Dispatchers drain accepted reads before store disposal** — `@voltro/runtime`, `@voltro/cli`
+
+  Runtime adds `Dispatcher.closeAndDrain()` to join accepted reads and deliveries before store disposal. Normal Dev and Serve API shutdown await it; synchronous `close()` remains available.
+- **Workflow cluster hosts declare shard groups and ClusterCron routing groups** — `@voltro/workflow`, `@voltro/cli`
+
+  Workflow cluster hosts can explicitly declare available/assigned shard groups and ClusterCron routing groups. Omitted settings retain existing routing; persistent journal migration is a separate prerequisite for changing groups.
+- **PostgreSQL workflow hosts can persist routing-generation admission** — `@voltro/workflow`, `@voltro/cli`
+
+  PostgreSQL workflow engine hosts can opt into persisted routing-generation admission with `journalRouting`; actual durable MessageStorage operations use the ownership guard. Full API-role wiring and maintenance rollout remain separate requirements.
 
 ### Changed
 
@@ -24321,9 +24490,3 @@ public registry yet.
 
 Subsequent releases record their deltas from here under dated headings, with
 `⚠ BREAKING` first.
-
-- Runtime adds `Dispatcher.closeAndDrain()` to join accepted reads and deliveries before store disposal. Normal Dev and Serve API shutdown await it; synchronous `close()` remains available.
-
-- Workflow cluster hosts can explicitly declare available/assigned shard groups and ClusterCron routing groups. Omitted settings retain existing routing; persistent journal migration is a separate prerequisite for changing groups.
-
-- PostgreSQL workflow engine hosts can opt into persisted routing-generation admission with `journalRouting`; actual durable MessageStorage operations use the ownership guard. Full API-role wiring and maintenance rollout remain separate requirements.

package/THIRD-PARTY-NOTICES.md

@@ -1,15 +1,15 @@
 # Third-Party Notices — @voltro/plugin-releases
 
-This package uses the open-source software listed below. Each is the
+This package uses the third-party software listed below. Each is the
 property of its respective copyright holders and is used under the terms of
 its license. This file is provided for attribution; it grants no rights in
 @voltro/plugin-releases itself, which is proprietary (see LICENSE).
 
-Generated from the resolved runtime dependency closure (50 packages).
+Generated from the resolved runtime dependency closure (52 packages).
 
 ---
 
-## @effect/platform-node@4.0.1
+## @effect/platform-node@4.1.0
 
 License: MIT
 
@@ -37,7 +37,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## @effect/platform-node-shared@4.0.1
+## @effect/platform-node-shared@4.1.0
 
 License: MIT
 
@@ -65,7 +65,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## @ioredis/commands@1.10.0
+## @ioredis/commands@2.0.0
 
 License: MIT
 
@@ -1342,7 +1342,7 @@ Apache License
    limitations under the License.
 ```
 
-## @opentelemetry/context-async-hooks@2.11.0
+## @opentelemetry/context-async-hooks@2.12.0
 
 License: Apache-2.0
 
@@ -1550,7 +1550,7 @@ Apache License
    limitations under the License.
 ```
 
-## @opentelemetry/core@2.10.0
+## @opentelemetry/core@2.12.0
 
 License: Apache-2.0
 
@@ -2798,6 +2798,214 @@ Apache License
    limitations under the License.
 ```
 
+## @opentelemetry/resources@2.12.0
+
+License: Apache-2.0
+
+```
+Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+```
+
 ## @opentelemetry/sdk-logs@0.222.0
 
 License: Apache-2.0
@@ -3006,7 +3214,215 @@ Apache License
    limitations under the License.
 ```
 
-## @opentelemetry/sdk-metrics@2.11.0
+## @opentelemetry/sdk-metrics@2.11.0
+
+License: Apache-2.0
+
+```
+Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+```
+
+## @opentelemetry/sdk-metrics@2.12.0
 
 License: Apache-2.0
 
@@ -3422,7 +3838,215 @@ Apache License
    limitations under the License.
 ```
 
-## @opentelemetry/sdk-trace-base@2.11.0
+## @opentelemetry/sdk-trace@2.12.0
+
+License: Apache-2.0
+
+```
+Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+```
+
+## @opentelemetry/sdk-trace-base@2.12.0
 
 License: Apache-2.0
 
@@ -3630,7 +4254,7 @@ Apache License
    limitations under the License.
 ```
 
-## @opentelemetry/sdk-trace-node@2.11.0
+## @opentelemetry/sdk-trace-node@2.12.0
 
 License: Apache-2.0
 
@@ -3838,7 +4462,7 @@ Apache License
    limitations under the License.
 ```
 
-## @opentelemetry/semantic-conventions@1.43.0
+## @opentelemetry/semantic-conventions@1.44.0
 
 License: Apache-2.0
 
@@ -4130,7 +4754,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## @tanstack/react-store@0.11.1
+## @tanstack/react-store@0.11.2
 
 License: MIT
 
@@ -4158,7 +4782,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## @tanstack/store@0.11.1
+## @tanstack/store@0.11.2
 
 License: MIT
 
@@ -4186,7 +4810,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## @types/node@26.4.1
+## @types/node@26.6.6
 
 License: MIT
 
@@ -4214,7 +4838,7 @@ MIT License
     SOFTWARE
 ```
 
-## @types/ws@8.18.1
+## @types/ws@8.18.2
 
 License: MIT
 
@@ -4242,7 +4866,7 @@ MIT License
     SOFTWARE
 ```
 
-## @upstash/redis@1.38.4
+## @upstash/redis@1.40.0
 
 License: MIT
 
@@ -4524,7 +5148,7 @@ Apache License
    limitations under the License.
 ```
 
-## ioredis@5.11.1
+## ioredis@6.0.0
 
 License: MIT
 
@@ -4580,7 +5204,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## jose@6.2.12
+## jose@6.2.13
 
 License: MIT
 
@@ -4608,7 +5232,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## lib0@0.2.117
+## lib0@0.2.119
 
 License: MIT
 
@@ -4692,34 +5316,6 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## redis-parser@3.0.0
-
-License: MIT
-
-```
-The MIT License (MIT)
-
-Copyright (c) 2015 NodeRedis
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-```
-
 ## standard-as-callback@2.1.0
 
 License: MIT
@@ -4864,7 +5460,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## undici-types@8.3.0
+## undici-types@8.9.0
 
 License: MIT
 
@@ -4892,7 +5488,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## use-sync-external-store@1.6.0
+## use-sync-external-store@1.7.0
 
 License: MIT
 
@@ -4920,7 +5516,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## ws@8.21.0
+## ws@8.22.0
 
 License: MIT
 
@@ -4975,7 +5571,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## yjs@13.6.32
+## yjs@13.6.33
 
 License: MIT
 

package/dist/artifactMetadata.js

@@ -1,4 +1,4 @@
-//#region src/artifactMetadata.ts
+// src/artifactMetadata.ts
 var e = (e) => typeof e == "string" && e.trim().length > 0 && !/[\u0000-\u001f\u007f]/.test(e), t = (t) => e(t) && t.length <= 200, n = (e) => typeof e == "string" && /^[a-f0-9]{64}$/i.test(e), r = (e) => Number.isSafeInteger(e) && e > 0, i = (e) => typeof e == "string" && e.trim().length > 0 && !e.includes("\0"), a = (a) => {
 	for (let t of [
 		"releaseId",
@@ -23,5 +23,4 @@ var e = (e) => typeof e == "string" && e.trim().length > 0 && !/[\u0000-\u001f\u
 	if (!r(t)) throw Error("Stored artifact size exceeds the numeric feed range");
 	return t;
 };
-//#endregion
 export { n as artifactHash, a as artifactMetadataIssue, t as artifactOperationId, r as artifactSize, o as artifactStoredSize, e as artifactText, i as hasArtifactSignature };

package/dist/errors.js

@@ -1,5 +1,5 @@
 import { Schema as e } from "effect";
-//#region src/errors.ts
+// src/errors.ts
 var t = class extends e.TaggedError()("ReleaseNotFound", {
 	app: e.String,
 	version: e.optional(e.String),
@@ -9,5 +9,4 @@ var t = class extends e.TaggedError()("ReleaseNotFound", {
 		return this.reason;
 	}
 }, r = [t, n];
-//#endregion
 export { t as ReleaseNotFound, n as ReleaseRefused, r as releaseErrors };

package/dist/feeds.js

@@ -1,6 +1,6 @@
 import { hasArtifactSignature as e } from "./artifactMetadata.js";
 import { compareVersions as t, inRollout as n } from "./rollout.js";
-//#region src/feeds.ts
+// src/feeds.ts
 var r = (e, r) => r.currentVersion !== null && t(e.version, r.currentVersion) <= 0 ? !1 : n({
 	installId: r.installId,
 	salt: e.rolloutSalt,
@@ -108,5 +108,4 @@ var r = (e, r) => r.currentVersion !== null && t(e.version, r.currentVersion) <=
 	os: "linux",
 	arch: /aarch64|arm64/i.test(e) ? "aarch64" : "x86_64"
 } : null;
-//#endregion
 export { r as offeredTo, l as osFromUserAgent, c as pickDownload, a as renderElectronLatestYml, o as renderExpoFeed, i as renderTauriFeed };

package/dist/index.js

@@ -13,7 +13,7 @@ import { AsyncLocalStorage as we } from "node:async_hooks";
 import { definePlugin as Te } from "@voltro/protocol";
 import { and as Ee, eq as O, inSet as De, queryFor as k, registerRetention as Oe, retentionTtlMsFromEnv as ke } from "@voltro/database";
 import { newTraceId as Ae } from "@voltro/runtime";
-//#region src/index.ts
+// src/index.ts
 var A = (e, t, n = {}) => ({
 	status: e,
 	body: JSON.stringify(t),
@@ -735,5 +735,4 @@ var A = (e, t, n = {}) => ({
 	secret: !1,
 	description: "Hours a release event (create, upload, promote, rollout, rollback, policy, prune) is kept before the retention sweep removes it. Default 8760 (one year)."
 }];
-//#endregion
 export { v as BASE_NAME, y as RELEASES_MANAGE_SCOPE, m as RELEASES_TABLE, ne as RELEASE_APPS_TABLE, h as RELEASE_ARTIFACTS_TABLE, g as RELEASE_CHANNELS_TABLE, _ as RELEASE_EVENTS_TABLE, b as RELEASE_PLATFORMS, x as RELEASE_SHELLS, o as ReleaseNotFound, s as ReleaseRefused, c as compareVersions, l as evaluatePolicy, u as inRollout, d as isNewerVersion, ge as offeredTo, _e as osFromUserAgent, f as parseVersion, ve as pickDownload, S as releaseAppsTable, C as releaseArtifactsTable, w as releaseChannelsTable, me as releaseEventsTable, he as releaseTables, N as releasesPlugin, T as releasesTable, ye as renderElectronLatestYml, be as renderExpoFeed, xe as renderTauriFeed, p as rolloutBucket, ee as sortVersionsDesc };

package/dist/names.js

@@ -1,4 +1,3 @@
-//#region src/names.ts
+// src/names.ts
 var e = "_voltro_release_apps", t = "_voltro_release_channels", n = "_voltro_releases", r = "_voltro_release_artifacts", i = "_voltro_release_events";
-//#endregion
 export { n as RELEASES_TABLE, e as RELEASE_APPS_TABLE, r as RELEASE_ARTIFACTS_TABLE, t as RELEASE_CHANNELS_TABLE, i as RELEASE_EVENTS_TABLE };

package/dist/retention.js

@@ -9,5 +9,4 @@ var t = (t, n, r) => {
 	}
 	return a;
 };
-//#endregion
 export { t as planRetention };

package/dist/rollout.js

@@ -1,4 +1,4 @@
-//#region src/rollout.ts
+// src/rollout.ts
 var e = (e) => {
 	let t = /^v?(\d+)(?:\.(\d+))?(?:\.(\d+))?(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(e.trim());
 	return t ? {
@@ -51,5 +51,4 @@ var e = (e) => {
 		killed: s
 	};
 }, s = (e) => [...e].sort((e, n) => t(n, e));
-//#endregion
 export { t as compareVersions, o as evaluatePolicy, a as inRollout, n as isNewerVersion, e as parseVersion, i as rolloutBucket, s as sortVersionsDesc };

package/dist/rpc.js

@@ -3,7 +3,7 @@ import { ReleaseNotFound as a, ReleaseRefused as o } from "./errors.js";
 import { RELEASES_TABLE as s, RELEASE_APPS_TABLE as c, RELEASE_ARTIFACTS_TABLE as l, RELEASE_CHANNELS_TABLE as u } from "./names.js";
 import { Schema as d } from "effect";
 import { defineMutation as f, defineQuery as p } from "@voltro/protocol";
-//#region src/rpc.ts
+// src/rpc.ts
 var m = "@voltro/plugin-releases", h = "releases:manage", g = d.optional(d.Struct({
 	id: d.String,
 	revision: d.Number.pipe(d.check(d.isInt()), d.check(d.isGreaterThanOrEqualTo(0)))
@@ -259,5 +259,4 @@ var m = "@voltro/plugin-releases", h = "releases:manage", g = d.optional(d.Struc
 		}
 	}
 ];
-//#endregion
 export { m as BASE_NAME, _ as PolicySchema, h as RELEASES_MANAGE_SCOPE, y as ReleaseSummarySchema, O as ReleaseUploadPreparationInput, S as createDescriptor, b as listDescriptor, v as policyDescriptor, k as prepareUploadDescriptor, j as promoteDescriptor, x as registerAppDescriptor, F as releasesRpcClientImports, N as rollbackDescriptor, M as rolloutDescriptor, P as setPolicyDescriptor, A as uploadDescriptor };

package/dist/schema.js

@@ -1,6 +1,6 @@
 import { RELEASES_TABLE as e, RELEASE_APPS_TABLE as t, RELEASE_ARTIFACTS_TABLE as n, RELEASE_CHANNELS_TABLE as r, RELEASE_EVENTS_TABLE as i } from "./names.js";
 import { bigint as a, boolean as o, id as s, integer as c, json as l, table as u, text as d, timestamp as f } from "@voltro/database";
-//#region src/schema.ts
+// src/schema.ts
 var p = [
 	"web",
 	"ios",
@@ -81,5 +81,4 @@ var p = [
 	v,
 	y
 ];
-//#endregion
 export { e as RELEASES_TABLE, t as RELEASE_APPS_TABLE, n as RELEASE_ARTIFACTS_TABLE, r as RELEASE_CHANNELS_TABLE, i as RELEASE_EVENTS_TABLE, p as RELEASE_PLATFORMS, m as RELEASE_SHELLS, h as releaseAppsTable, v as releaseArtifactsTable, g as releaseChannelsTable, y as releaseEventsTable, b as releaseTables, _ as releasesTable };

package/dist/uploadIdentity.server.js

@@ -1,5 +1,4 @@
 import { createHash as e } from "node:crypto";
-//#region src/uploadIdentity.server.ts
+// src/uploadIdentity.server.ts
 var t = (t, n) => "relart_" + e("sha256").update(JSON.stringify([t, n])).digest("hex"), n = (e, t) => e.releaseId === t.releaseId && e.kind === t.kind && e.target === (t.target ?? null) && e.url === t.url && e.sha256 === t.sha256.toLowerCase() && e.size === String(t.size) && e.signature === (t.signature ?? null) && e.notarized === (t.notarized ?? !1) && e.assetKey === (t.assetKey ?? null) && e.contentType === (t.contentType ?? null);
-//#endregion
 export { n as matchesUploadArtifact, t as uploadArtifactId };

package/dist/web.js

@@ -3,7 +3,7 @@ import { BASE_NAME as t } from "./rpc.js";
 import { pluginTag as n } from "@voltro/protocol";
 import { createElement as r, useEffect as i, useRef as a } from "react";
 import { usePlatform as o, useSubscription as s } from "@voltro/client";
-//#region src/web.ts
+// src/web.ts
 var c = (e) => n(t, e), l = "voltro:install-id", u = (e) => {
 	let { storage: t } = o();
 	if (e !== void 0) return e;
@@ -43,5 +43,4 @@ var c = (e) => n(t, e), l = "voltro:install-id", u = (e) => {
 		e !== null && e !== r.current && (r.current = e, n?.check());
 	}, [t.verdict, n]), t;
 };
-//#endregion
 export { p as ForcedUpdateGate, u as useInstallId, f as useKillSwitch, d as useReleasePolicy, h as useUpdateImpulse };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-releases",
-  "version": "0.87.0",
+  "version": "0.88.0",
   "description": "Release channels, artefacts and rollouts for the apps a Voltro api serves — the self-hosted update server behind Tauri, Expo OTA, electron-updater and PWA update feeds, with a reactive release policy every client subscribes to.",
   "keywords": [
     "voltro",
@@ -48,14 +48,14 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@voltro/client": "0.87.0",
-    "@voltro/database": "0.87.0",
-    "@voltro/logger": "0.87.0",
-    "@voltro/protocol": "0.87.0",
-    "@voltro/runtime": "0.87.0"
+    "@voltro/client": "0.88.0",
+    "@voltro/database": "0.88.0",
+    "@voltro/logger": "0.88.0",
+    "@voltro/protocol": "0.88.0",
+    "@voltro/runtime": "0.88.0"
   },
   "peerDependencies": {
-    "effect": "4.0.1",
+    "effect": "4.1.0",
     "react": "^19.0.0"
   },
   "peerDependenciesMeta": {