@voltro/sql-mysql 0.57.0 → 0.58.0

package/CHANGELOG.md

@@ -39,6 +39,207 @@ _Changes staged for the next release accumulate here (rolled up from
 
 ---
 
+## [0.58.0] — 2026-08-30
+
+### ⚠ BREAKING
+
+- **@voltro/ai, @voltro/client** — The gateway catalog names eight modalities, `ModelModality` has listed all eight since the union was widened, and the runtime could execute five. Four of the six gaps are closed.
+
+  **The catalog gives out what the response carries.** `getAvailableModels` asked `@ai-sdk/gateway`'s provider, whose entry type has six fields where the HTTP response has twenty-one — so nothing was discarded, the fifteen never arrived. `readGatewayCatalog()` reads the endpoint and adds `capabilities`, `modalities`, `contextWindow`, `maxOutputTokens`, `releasedAt`, `knowledgeCutoff` and `dataPolicy`.
+
+  `capabilities` is unioned from `tags`, `supported_parameters` and `modalities`, which overlap and regularly disagree: a model tagged `reasoning` does not always carry the parameter. Taking either alone produces a false negative, and a false "cannot" removes a model from a picker with no way to find out why — so the union is framework knowledge rather than forty lines every app writes differently. `capabilities` and `modalities` stay OPTIONAL: absent means the entry came from the injected test provider, and defaulting to all-false would turn "not known" into "this model has no vision".
+
+  **The runtime says what it can run.** `executableModalities()` / `canExecute()` replace the hand-kept list an app needs to stop a picker offering a model nothing can execute. It is tied to the exports that justify each entry, so shipping a primitive without adding it turns a test red — which it did, twice, during this change.
+
+  **`transcribe` exists.** Nine transcription models were unaddressable without pulling the raw SDK past the framework (and resolving gateway credentials twice in one process). `source` takes `{ storageRef }`, `{ url }` or `{ bytes }`, because audio is large and usually already stored — the storage read is INJECTED (`resolveRef`), so `@voltro/ai` never learns about buckets. `segments` is absent rather than `[]` when the provider returned none.
+
+  **`rerank` reaches the gateway.** It was the one primitive that did not take a `ProviderConfig`: it wanted the vendors' own keys and could not express the gateway at all, so five reranking models in the catalog were unreachable.
+
+  **A speech provider the gateway does not carry can be registered.** The gateway serves nine speech models; a real voice catalog runs to hundreds behind vendors it does not carry, so an app with its own adapter called its own synthesizer and skipped the primitive — losing the shared error type and cost path. `registerSpeechProvider` gives that adapter a socket. No adapters ship: the framework is not in the business of tracking somebody else's REST API, and the app already has them.
+
+  Not built: `realtime`. Not for want of a model surface — the gateway exposes one — but because every streaming kind in Voltro is server→client, so relaying a duplex session over the existing authenticated connection needs a transport capability that does not exist. `canExecute` answers `false` for it, which keeps it out of a picker until it does.
+
+  Migration: `rerank`'s `provider` widened from `'mock' | 'cohere' | 'voyage'` to include `ProviderConfig`. Passing a string is unchanged; reading the field off a typed options object is now a union. See the codemod note.
+
+  **And the ergonomy over them, because a primitive nobody can reach is half a feature.** `transcribeStep` puts transcription on the durable-step path with `offload: true` — the modality that runs longest was the one without it, and a ninety-minute recording held a worker for the whole call. The queue row carries the source, never the bytes. `retrieveReranked` is the second retrieval stage declared once instead of the twenty lines every app writes (fetch N, reorder, keep K — with its own N, its own K, and half of them forgetting the cost). `useTranscription` makes upload and transcription ONE state: `progress` is scoped to the phase, because a single number across both reaches 1 when the upload finishes and sits there for the whole transcription, and a bar that says finished is worse than no bar.
+
+  **`voltro update` carries you across this** — codemod `0.58.0/07_rerank_takes_a_provider_config`. If you pin versions by hand and never run it, print the notes without changing anything: `voltro update --codemods-only --from <your current version> --dry-run` (this one ships in 0.58.0).
+- **@voltro/protocol, @voltro/plugin-auth-supabase, @voltro/cli, @voltro/voltro** — An auth strategy's shared secret may be a function, so `voltro build` no longer needs the app's production credentials.
+
+  `voltro build` imports `app.config.ts`, so anything the config constructs runs at build time. `supabaseStrategy({ jwtSecret: process.env.SUPABASE_JWT_SECRET })` therefore made an image build need a production secret for a bundle that will not contain one. A placeholder is not available — this framework ships no secret values anywhere, and an `ARG SUPABASE_JWT_SECRET` in a Dockerfile is exactly that — so a deployment stayed on the slower tsx path instead.
+
+  `jwtSecret` now accepts `string | (() => string | undefined)`, on `jwtBearerStrategy` and on the Supabase strategy that specialises it.
+
+  **The deferral is paired, and that pairing is the design.** A thunk alone would trade an image-build inconvenience for a runtime surprise: the failure of a MISSING secret would move from boot to the first request that happens to carry a token, and an auth strategy that cannot verify one accepts nobody — a process that started cleanly, serving a login that can never succeed. "Fail at boot" is what the env gate, the plugin env contracts and the migration guard all promise, and this is not the place to sell it.
+
+  So `AuthStrategy` gained an optional `verifyConfig()`, and the pass over the strategies that `voltro dev` and `voltro serve` already share calls it. A build never reaches that builder. Three moments, three answers: construction is silent, boot decides, verification uses the settled value — resolved once, because a credential re-read per request is a `process.env` hit on the hot path and a value that could change under a running process.
+
+  A thunk counts as PRESENT at construction: whether it resolves is a boot question, and calling it early to find out would undo the whole point. Passing no credential at all still refuses at construction, unchanged.
+
+  Migration: passing a value is unchanged; what can stop compiling is READING `jwtSecret` off a typed config, which is now the union. That is the mirror of "more precise is still breaking" — less precise breaks readers — and the population is small, because the interface is one users construct and a literal's own inferred type never widened. `@voltro/voltro` is listed because it re-exports the type.
+
+  **`voltro update` carries you across this** — codemod `0.58.0/06_jwt_secret_may_be_a_function`. If you pin versions by hand and never run it, print the notes without changing anything: `voltro update --codemods-only --from <your current version> --dry-run` (this one ships in 0.58.0).
+- **@voltro/runtime, @voltro/cli** — A fleet view no longer counts rows left behind by processes that are gone, and the rows of live replicas actually refresh on MariaDB.
+
+  Three symptoms, one root cause and two that outlived it.
+
+  **The rows were frozen.** `writeReplicaObservation` upserts on `UNIQUE (replicaId, kind)` — a conflict key that is not the primary key, with a fresh `id` on every write — which is exactly the shape the MySQL/MariaDB upsert guard was rejecting. Every republish after the first was rolled back, so a publisher writing every 30s produced a row whose age grew second for second.
+
+  **The failure said nothing.** It was logged at `debug`, on the reasoning that a failed write leaves the previous row and the reader reports it as stale, so the failure is visible in the answer. It is not: a stale row is what a slow, busy or departed replica looks like, and the answer never says a write was REFUSED. It was also invisible where it mattered — `voltro dev` prints debug and `voltro serve` does not, so the unattended deployment got no line at all. The first failure per kind now warns.
+
+  **Nothing ever removed a row.** The table is keyed `(replicaId, kind)`, so a restart overwrites its own row and a replica that never returns leaves one forever — counted as a responder, counted in the version tally, and old enough to hold `complete` at false for the life of the deployment. Membership is the roster of who is alive, so a row whose replica it no longer lists is now reported as `departed`: separately from `stale`, because a stale row belongs to a process that is running and has stopped refreshing (a fault) and a departed one belongs to a process that is gone (a scale-down). It is reported rather than dropped — a reader who cannot see them cannot tell a fleet that scaled down from a table being written by something nobody is tracking. The publisher also forgets its own rows on shutdown, so the ordinary case leaves nothing to classify.
+
+  The sharpest consequence of the old behaviour was not the incompleteness: `versions` counted the framework version of a process that had been dead for hours and reported a version SPLIT across a fleet that had none — a line an operator acts on.
+
+  Migration: `FleetMergeResult.departed` is required, so code that CONSTRUCTS one — a test double for `fleetObservations` — needs the field. Reading one is unaffected. See the codemod note.
+
+  **`voltro update` carries you across this** — codemod `0.58.0/03_fleet_view_reports_departed_replicas`. If you pin versions by hand and never run it, print the notes without changing anything: `voltro update --codemods-only --from <your current version> --dry-run` (this one ships in 0.58.0).
+- **@voltro/client, @voltro/web** — An rpc call that fails in the client now reaches the app's error REPORTERS, not only its rpc listeners.
+
+  There were two buses. `clientErrorBus` is the module-global seam a reporter subscribes to — the route ErrorBoundary publishes render and loader failures there, `reportClientError` publishes manual captures, and the Sentry browser integration listens. `RpcErrorBus` is a per-runtime bus with a different subscriber set, for cross-cutting POLICY: redirect on `Unauthenticated`, toast on a network failure. Nothing connected them, so a call that failed in the client reached policy and never reached reporting.
+
+  The subscription case is the one that costs. A rejected subscription leaves `data: undefined`, `loading: false` and an empty list — which is also what "nothing matched" looks like — so there is nothing in the UI to notice and nothing in any reporter to find.
+
+  The bridge is in `RpcErrorBus.emit`, not at the six call sites that emit rpc errors, so a seventh is covered by existing. `ClientErrorEvent.source` gained `rpc.mutation` / `rpc.action` / `rpc.subscription` as three separate labels rather than one `rpc`: a failed mutation is a write the user watched fail, and a failed subscription is a screen that silently never filled. The rpc tag and the `traceId` — the same id the server logged — travel in `context`.
+
+  Everything is published. A reporter that must not be flooded by a reconnect storm applies its own ceiling: the bus's job is to make the failure observable, and which failures are worth an event is a policy it cannot hold for every subscriber.
+
+  Migration: only an EXHAUSTIVE switch over `event.source` stops compiling. If you bridged the two buses by hand, delete that bridge or you will report twice — and keep whatever throttling you put around it.
+
+  `@voltro/web` is listed because it re-exports the type: the union widens in its golden too, and a consumer importing `ClientErrorEvent` from there is affected identically.
+
+  **`voltro update` carries you across this** — codemod `0.58.0/04_rpc_errors_reach_reporters`. If you pin versions by hand and never run it, print the notes without changing anything: `voltro update --codemods-only --from <your current version> --dry-run` (this one ships in 0.58.0).
+- **@voltro/plugin-sentry, @voltro/cli** — Sentry performance traces are on by default, and the web entry no longer needs a config block to initialise them.
+
+  `sentryPlugin({ traces })` defaulted to `false` while the browser half defaulted `tracesSampleRate: 1.0` with `browserTracing` on. That pairing is the worst of the three available defaults: every page load, navigation and rpc call became a browser span that was emitted, paid for, and belonged to a trace with no server half — a browser hop hanging off nothing. Both-off would at least be coherent; both-on is what the two halves were built for, and the docs already said to pass `traces: true` to get it, which made that sentence a workaround note rather than a configuration option.
+
+  The rate stays 1.0 rather than being quietly lowered — a number the framework picks on your behalf is one nobody can find again — and the boot line names it: `sentry active traces=true tracesSampleRate=1`. Lower it with `tracesSampleRate`, or `traces: false` for errors and breadcrumbs only.
+
+  The browser half is reached the same way. The generated entry called `initSentryBrowser` only when `app.config.ts` carried a `sentry:` block, which made that block load-bearing for something it does not decide: the api half needs no config object (`sentryPlugin()` reads `SENTRY_DSN`) and the browser half reads `VOLTRO_PUBLIC_SENTRY_DSN`, so an app that had set its variables still had to add an empty `sentry: {}`. The entry now initialises whenever `@voltro/plugin-sentry` is a dependency of the web app — the dependency is the intent — and the block is for overrides. Without a DSN from either source the init returns immediately, so this changes nothing for an app that set none.
+
+  Migration: decide once whether you want the transactions. See the codemod note.
+
+  **`voltro update` carries you across this** — codemod `0.58.0/05_sentry_traces_on_by_default`. If you pin versions by hand and never run it, print the notes without changing anything: `voltro update --codemods-only --from <your current version> --dry-run` (this one ships in 0.58.0).
+- **@voltro/runtime, @voltro/cli** — `SYSTEM_SUBJECT` — what a schedule, a subscriber, a resumed workflow and the webhook trigger context run as — is now a `system` subject. It was `{ type: 'anonymous', id: null }`, and every exemption for "the framework acting as itself" is keyed on `type === 'system'`: the row-filter bypass in `resolveRowFilterScopeFor`, the unfiltered-read refusal in `wrapStoreWithMixinBehaviour`, and `isSystemSubject`. It matched none of them.
+
+  An app that calls `setRowFilter` therefore had every schedule fire refused at context-build time, before its handler ran — on both boot paths, from the cron timer and from `voltro schedule run` alike. The quieter half is the one that produced no error: a path that RESOLVED a scope for this subject asked the app's own filter what an anonymous caller may see, and applied that answer to a cross-tenant sweep.
+
+  `ctx.storeForTenant(id)` is fixed alongside it, and needed saying separately. It narrows to a `serviceAccount` subject by design, so a subject whose null tenant means "every tenant" cannot widen back out of the tenant it was just confined to — which also means the exemption stops at the derivation. The row-filter bypass now travels across that narrowing; the tenant confinement does not.
+
+  Migration: `actingUserId` answers `null` for a system subject, so a `runAsSystem` write stamps no `createdBy` / `updatedBy` instead of `'system'`. `createdBy` is a reference into the app's own `actors` table and the framework seeds no row there, so an id it stamps is one nothing points at — an outright insert failure where that reference is declared. Schedules, subscribers and workflows already stamped nothing and are unchanged. See the codemod note.
+
+  **`voltro update` carries you across this** — codemod `0.58.0/01_system_writes_stamp_no_actor`. If you pin versions by hand and never run it, print the notes without changing anything: `voltro update --codemods-only --from <your current version> --dry-run` (this one ships in 0.58.0).
+- **@voltro/runtime, @voltro/cli** — A workflow step now reads through its caller's row filter, resolved at execution time — and until now a workflow started by a user could not read at all.
+
+  The store refuses a context that carries neither a resolved row-filter scope nor a system subject. A BOOTSTRAP run has the system subject and passed; a run started by a user has neither, so in any app that calls `setRowFilter` every workflow step threw before its executor ran. The gap was invisible from the framework's own suites because the arm that works and the arm that does not differ only in who started the run.
+
+  Visibility is resolved in the same seam as authority, at the same moment, for the same reason: `resolveAuthority` re-reads what a three-day-old run may DO, and the scope resolved beside it re-reads what that run may SEE. Restoring either from the start-context row would be a fact frozen at start time and made durable. A failure to resolve fails the attempt rather than downgrading it — a run that silently reads fewer rows than it should is indistinguishable from one whose data is not there. An app that registered no filter pays nothing; the resolution short-circuits without touching a store.
+
+  `BuildAppContext`'s request parameter now declares `rowFilter`. It was read by the implementation and absent from the type, so the request arms were correct by the accident of passing a value the signature did not mention, while a non-request caller had no way to see there was anything to supply.
+
+  `ResolvedWorkflowCallerContext.rowFilter` is required, so code that CONSTRUCTS one — in practice a test double for a context builder — needs the field. Implementing `buildContext` is unaffected: it receives one more property it may ignore. Required rather than optional is deliberate: optional is what it effectively was, and it left a boot path able to omit the one value without which a user's workflow cannot run.
+
+  **`voltro update` carries you across this** — codemod `0.58.0/02_workflow_caller_context_carries_a_scope`. If you pin versions by hand and never run it, print the notes without changing anything: `voltro update --codemods-only --from <your current version> --dry-run` (this one ships in 0.58.0).
+
+### Added
+
+- **@voltro/cli** — `voltro doctor`'s `nullable-column-a-mutation-cannot-clear` rule now resolves FRAMEWORK and first-party PLUGIN tables.
+
+  The rule asks "is this column nullable?" by finding the `table('<name>', { … })` declaration among the sources it was handed — the app's. That is right for the app's own tables and cannot work for ours: `_voltro_webhook_targets` is declared inside `@voltro/plugin-webhooks`, so a mutation writing to it resolved to "I could not look". The rule keeps that answer distinct from "this table has no nullable columns", because the two lead to opposite conclusions — but for our tables it was a permanent unknown, leaving anyone auditing their mutations to carry them as a standing exception and count them by hand.
+
+  Doctor is a static analyser: it parses files and boots nothing, so it cannot import a plugin to ask a table about itself. The nullability of our own tables is therefore generated from our declarations — with the same extraction rule the doctor applies, so a manifest entry cannot mean something different from what the rule would have concluded — and shipped as data. `scripts/gen-framework-table-nullability.mjs --check` runs in CI, because a stale entry would answer with a value that is no longer declared, which is worse than the honest unknown it replaces.
+
+  An app's own declaration still wins where both have one: it is the more specific authority and the one a developer can actually edit.
+- **@voltro/plugin-sentry, @voltro/cli** — The browser half of the Sentry integration can now resolve its own configuration — from the public env, and from a module that runs at boot.
+
+  **It reads `VOLTRO_PUBLIC_SENTRY_DSN` / `_ENVIRONMENT` / `_RELEASE`.** The api half already resolved `SENTRY_DSN`, `SENTRY_ENVIRONMENT` and `SENTRY_RELEASE` from the environment and declared all three, so `sentryPlugin()` takes no arguments. `initSentryBrowser` resolved nothing: without an explicit `dsn` it returned, and the only way to supply one was `sentry:` in `app.config.ts`. An explicit option still wins — `app.config.ts` is the more specific authority.
+
+  **`sentry.optionsFrom` names a module the generated entry calls.** Everything else in that block is a literal frozen into the bundle, which is right for a DSN and wrong for `environment` the moment one image serves more than one environment — an ordinary pipeline with one build job and several environment-bound deploy jobs. A baked `environment` is then true for at most one of them, and a wrong environment tag is worse than an absent one because Sentry defaults a missing one to `production` and a wrong tag gets acted on.
+
+  There is no runtime channel to read instead: public values are baked at build time by construction. So the value has to be computed where it is known, which is the browser — and the entry is generated anyway, so it can call something. The resolver's result is spread LAST and may be async.
+
+  **And `voltro start` now says when a `VOLTRO_PUBLIC_*` cannot reach the browser.** Setting one as a deployment variable looks right, deploys cleanly, and does nothing — no error, no warning, no failed request. The check is exact rather than a guess, because both halves are present at boot: the process environment, and the object the build wrote (`.framework/env.public.json`, emitted alongside the baked module from the same source). A variable set to the value that was baked stays silent; one that was never baked, or that disagrees with the built one, is named with the reason. An unreadable manifest reports every runtime variable rather than none — "we could not check" and "there is nothing to report" are opposite facts.
+- **@voltro/cli, @voltro/plugin-sentry** — `voltro build` uploads source maps to Sentry and then removes them from the output.
+
+  `web.sourcemaps: 'hidden'` already produced `.map` files, and the note beside it said to upload them in a deploy step and delete them before the image is built. Every word of that was right and all three hard parts belong to the build:
+
+  - **the moment** — there is no seam in a Dockerfile between "the bundle exists" and "the image is built"; - **the release** — Sentry matches an artifact to an event by release, and the event's comes from `SENTRY_RELEASE` via `sentryPlugin`. Upload under a different value and no frame resolves, silently: an upload that matched nothing looks exactly like one that worked. A configured upload with no release now refuses the build rather than uploading under nothing; - **the deletion** — a `.map` left in `dist` is the app's source, downloadable by anyone, and "we delete it in the deploy step" is a promise a failing build breaks. It is a `finally` here: the maps go even when the upload fails, and a configured upload that did not happen fails the build. Verified against a real build — a failed upload left zero `.map` files and all five chunks.
+
+  ```ts
+  web: { sourcemaps: { mode: 'hidden', upload: { org: 'acme', project: 'web' } } }
+  ```
+
+  Selective by ordinary means: `app.config.ts` is TypeScript, so `sourcemaps: process.env.CI ? { … } : 'hidden'` emits-and-keeps locally and uploads in the pipeline. `keep` defaults to "keep them only if nothing consumed them" — false with an upload, true without.
+
+  **There is no `authToken` option**, on purpose. It is read from `SENTRY_AUTH_TOKEN`: `app.config.ts` is a committed file, and a token with `project:releases` scope can write to every project in the org. It belongs to the build, not the deployment.
+
+  The upload runs through `@sentry/cli` rather than a hand-written HTTP client, because Sentry's artifact model is debug-ID based — the ids are injected into the built JS and the map, and the matching happens on them. An uploader that skipped that injection would produce artifacts that upload cleanly and resolve nothing. **You install it: `pnpm add -D @sentry/cli` in the web app.** The framework does not depend on it anywhere, and that is a licence decision rather than a packaging one. `@sentry/cli` is FSL-1.1-MIT, which restricts competing commercial use — so unlike the MPL and LGPL dependencies we do carry, "the consumer's own install fetches it, and we neither distribute nor modify it" does not answer the question: FSL binds a user, not a distributor. An optional dependency of a package we publish is part of that package's licence surface, so it is not one.
+
+  A configured upload with the package absent refuses the build and names the command, rather than skipping the upload and leaving you to discover months later that no frame resolves.
+
+### Fixed
+
+- **@voltro/database, @voltro/protocol, @voltro/runtime, @voltro/sql-mysql** — A write the FRAMEWORK refuses now reaches the caller as a typed `ConstraintViolation` instead of a defect.
+
+  Every failure the DATABASE reports already had this: `storeMiddleware` reads the driver's error and maps it. A refusal the framework decides had nothing to map from — there is no driver code for our own decision — so it stayed a plain `Error`, which Effect classifies as a defect. It arrived at the client as a `Defect` wrapping a stringified `InternalError`, untagged, for a condition an app can genuinely branch on. A form shows a support id over an input that saved nothing.
+
+  The MySQL-family upsert raises one: `ON DUPLICATE KEY UPDATE` fires on whichever unique key the incoming row violates, so the store checks afterwards that it reached the row the caller's `conflictColumns` name, and rolls back when it did not. `unique` is the kind — a row did collide on some unique key of that table; what the engine will not say is which, and that silence is the reason the check exists, so `constraint` stays absent rather than guessed at.
+
+  `ConstraintViolation` gained an optional `detail`, populated only by these refusals and never from a driver message or a row value. The generated sentence exists because the driver's own text carries row data on several dialects; that is a rule about the DRIVER's sentence, not about length, and a sentence the framework authored carries exactly what we put in it.
+
+  The mark is read BEFORE the driver-parser and never folded into it: giving our own decision the fields `classifyConstraintViolation` reads would make the two indistinguishable inside the one function whose contract is "this is what the database said".
+
+  Not everything the store throws becomes a failure. An upsert whose conflict key cannot be looked up at all — every column database-GENERATED — stays a defect, because it is a call that cannot be served as written rather than a condition in the data, and typing it would invite an app to swallow a wiring mistake as though it were a busy row.
+- **@voltro/sql-mysql, @voltro/testing** — An upsert whose `conflictColumns` are NOT the primary key now works on MySQL and MariaDB. It threw, rolled back, and reported "Nothing was changed" — accurately, which is the only reason it was not worse.
+
+  Postgres names its target (`ON CONFLICT (a, b) DO UPDATE`); MySQL and MariaDB have no such form, so `ON DUPLICATE KEY UPDATE` fires on whichever unique key the incoming row violates. `id` is excluded from the update — it identifies the row and must not be silently rewritten — so the store checked afterwards that the returned row was the one it aimed at, by comparing the returned `id` with the one passed in.
+
+  That is the shape of the dangerous case, and it is also the shape of every correct update: an upsert that legitimately matches on the caller's own columns returns THAT row's id, never the freshly minted one. So the check fired on the case it existed to permit. The `op` classification one line below it (`id unchanged → insert, else update`) is written for a branch the throw made unreachable.
+
+  What decides it is the conflict-column VALUES, which are excluded from the update too and therefore still carry the matched row's own: equal to the input means the named key is what matched, and no other row can carry those values because the column set is unique. A difference means the statement was sent somewhere the named key could not have sent it — still refused, and the message now names the differing COLUMN instead of asserting a constraint it cannot identify. Not its values: that sentence reaches the client, and a conflict column is as likely to hold an email address as a team id — the same line `ConstraintViolation` draws when it refuses to carry the driver's own sentence. The values go to the server log, where the row already is. A conflict column the database GENERATES cannot be compared; when none of them can, that is said rather than resolved to "fine".
+
+  The parity suite gained the case that was missing: every upsert scenario in it conflicted on `id`, so the returned id always equalled the one sent and a store could not be caught being wrong about this. It now upserts on a composite unique key from a fresh id on every dialect, with a second row that must NOT be overwritten.
+
+  The LOOKUP half of the same operation — taken by every MySQL upsert, and on MariaDB by a partial row or a function `update` — now refuses clearly when a conflict column is database-GENERATED, instead of failing inside the driver.
+
+  It matches by value, and the value of a generated column is not in the row the caller passed: the classic partial-unique index on this engine IS such a column (a STORED expression plus NULL-distinct semantics, so the key constrains only the rows the expression marks). Binding the absent value reached mysql2 as `Bind parameters must not contain undefined` — a TypeError naming no column, no table and no cause, for a write that did nothing. Binding SQL NULL would make the predicate never true, so the lookup finds nothing and falls through to an INSERT the very key rejects; dropping the column would widen the lookup and can match a row the write would not have collided with, which is the one outcome that overwrites somebody else's data.
+
+  So it refuses, names the column, and points at the path that CAN answer: the single-statement form, where the database evaluates the expression itself. That path is reached on MariaDB with a complete insert row and a column-list `update`.
+- **@voltro/kv** — Closing a RESP client can no longer take the process down.
+
+  A previous round added a silent `error` listener so an ioredis client without one could not crash the process. That is a different failure, and a deployment on `voltro dev` measured the difference: after the fix, roughly one reload in three still ended in `Error: Connection is closed.` thrown from `ioredis/built/redis/event_handler.js`, unhandled, with no framework frame in the stack.
+
+  That is not an `error` event. `event_handler.js`'s `close` is where ioredis REJECTS the promises of commands that were in flight when the socket went — and `quit()` is one of those commands. Calling it on a connection that is already closing rejects, and `close: () => c.quit().then(() => undefined)` had no `catch`. A reload closes the client while the previous instance is still shutting down, which is the race.
+
+  `close()` now cannot reject, and falls back to `disconnect()` so giving up on the error does not mean giving up on the teardown — a `quit` that failed has not necessarily closed anything, and a socket leaked per reload is its own slow failure. Swallowing is right here and nowhere else in that file: a failed COMMAND reaches its caller as a `KvError`, because that is where it can be acted on, and a failed close has no such place.
+- **@voltro/plugin-broadcast** — A subscription's teardown can no longer kill the process.
+
+  `void sub.unsubscribe(channel)` in the dispose function returned by the redis broadcast provider was fire-and-forget with no `catch`. ioredis rejects the promises of every command in flight when the socket closes — `Connection is closed.`, thrown from its own close handler — so a `voltro dev` reload, which disposes subscriptions while the previous connection is going away, produced an unhandled rejection and node killed the process.
+
+  This is the THIRD round on one symptom with three different causes: a client with no `error` listener, `quit()`'s unguarded promise, and now a discarded command. Each fix was correct and none of them was the next one, so this round adds a rule instead of a fourth fix: `scripts/check-resp-fire-and-forget.mjs` (CI + gate, with a `--selftest`) fails when a discarded RESP command has no `.catch`.
+
+  The rule is deliberately narrow. The general property is `no-floating-promises`, which this repo has no eslint to run — and measured before writing it, a blanket `void <call>` rule matches **194** sites in `packages/*/src`, nearly all legitimate. The RESP subset matches 3, all correct. Widening the command list to "any method" costs the 194; the header says so, next to the number.
+
+  The local half of the teardown still runs unconditionally: detaching the message handler is synchronous and cannot fail, and it is what stops a reloaded module receiving the previous one's messages.
+- **@voltro/runtime** — A schedule firing that is rejected before its handler runs no longer outlives itself. `runHandler` wrote the `running` row, armed the watchdog, armed the heartbeat, and only then built the app context — with the `try` whose `finally` releases all three starting after them. The context build is the one step in that window that can throw on input the scheduler does not control, and when it did, each acquisition survived in its own way:
+
+  - the watchdog rejected a promise `Promise.race` never received, `maxRuntimeMs` after a firing that never started. Nothing was listening, so the rejection went unhandled and ended the process — with no recorded failure in between to connect the two events. Lowering `maxRuntimeMs`, the obvious response to a run that appears stuck, only widened the gap; - the heartbeat kept stamping `heartbeatAt` on a run that had not begun. That beat is what tells a live run from a corpse, so it certified one: a peer's overlap guard reads a beating row as alive for the life of the process, turning a bounded stale window into a permanent skip for that schedule; - the `catch` never ran either, so the row stayed `running` — the only artefact the firing left behind, saying the opposite of what happened.
+
+  Everything that acquires now lives inside the `try`, so a throw from anywhere records `failed` with its reason and releases both timers. The watchdog promise additionally carries a discarded rejection handler, which makes the CONSEQUENCE of a future leak impossible rather than only this one: `race` still sees the rejection, and node can never see it as unhandled.
+- **@voltro/runtime, @voltro/cli** — A `defineStream`'s declared `guards:` are enforced — before the executor runs.
+
+  Measured against a running api: two `POST /rpc` calls with no Authorization header, milliseconds apart, both descriptors declaring the same scope. The QUERY refused with `ScopeError`; the STREAM answered tokens. It had called a model and paid for it, so the missing check was not only a read permission — an open stream is an open wallet.
+
+  Two defects, and the second survives fixing the first.
+
+  **Nothing passed the guards.** `bindStream` has taken a `guards` argument since it was written, implements the subscribe-time gate and the per-element re-check, and documents both — and neither boot path passed it. Declared, documented, implemented, wired at zero call sites. The call's input goes with it, because a resource-scoped guard (`{ scope: 'x:read', from: 'id' }`) reads which resource was asked for out of it and otherwise fails closed.
+
+  **The gate ran after `buildStream`.** That is where the user's executor runs, so an unauthorized caller had already been served by the expensive half by the time authorization was decided. Passing the guards alone would have stopped the tokens reaching the client while still paying for them, and from the client side those two are identical. The doc comment said "before anything is registered"; the code registered first. It is first now.
+
+  This is the SECOND time this exact defect shipped: `defineEvent` accepted `guards:`, documented them, and nothing checked. That was fixed for events and `defineStream` kept the identical hole. So the test asserts the property over the SET — all five primitives that accept `guards:`, each at its named enforcement point — rather than over the one that was reported. Query, mutation, action and event were all already enforced; the stream was the only gap.
+
+---
+
 ## [0.57.0] — 2026-08-30
 
 ### Added

package/dist/index.js

@@ -1,32 +1,32 @@
 import { MysqlClient as e } from "@effect/sql-mysql2";
 import { Config as t, Effect as n, Layer as r, ManagedRuntime as i, Option as a, Redacted as o, Schedule as s } from "effect";
-import { CDC_OFFSETS_TABLE as c, DEFAULT_ACQUIRE_TIMEOUT_MS as l, EagerCardinalityError as u, _voltroCdcOffsetsTable as d, attachEagerLoads as f, attributionFields as p, attributionKey as m, beginLocalWrite as h, bulkInsertLimitsFor as g, chunkRowsForInsert as _, compileEagerJson as v, compilePredicate as y, compileRawFragment as b, compileSelect as x, decodeRowsFromSchema as S, describeRowBindings as C, encodeRowForSchema as w, endLocalWrite as T, externalChangeEvent as E, getTable as D, hasEagerLoads as O, isTableReactive as k, makeEagerFallbackReporter as ee, observeDbOp as A, qualifyTable as te, raiseChangeListenerCeiling as ne, recordsTable as j, registerPendingAttribution as M, requireTable as N, resolveEchoAttribution as re, runStoreTransaction as ie, runWriteRecorders as ae, stampGeneratedId as P, stampGeneratedIds as F, withCapturedAttribution as I } from "@voltro/database";
-import { EventEmitter as oe } from "node:events";
-import { createLogger as L } from "@voltro/logger";
-import { SqlClient as R, TransactionConnection as z } from "@effect/sql/SqlClient";
+import { CDC_OFFSETS_TABLE as c, DEFAULT_ACQUIRE_TIMEOUT_MS as l, EagerCardinalityError as u, _voltroCdcOffsetsTable as d, attachEagerLoads as f, attributionFields as p, attributionKey as m, beginLocalWrite as h, bulkInsertLimitsFor as g, chunkRowsForInsert as _, compileEagerJson as v, compilePredicate as y, compileRawFragment as b, compileSelect as x, decodeRowsFromSchema as S, describeRowBindings as C, encodeRowForSchema as w, endLocalWrite as T, externalChangeEvent as E, getTable as D, hasEagerLoads as O, isTableReactive as k, makeEagerFallbackReporter as ee, observeDbOp as A, qualifyTable as te, raiseChangeListenerCeiling as ne, recordsTable as j, refuseWrite as M, registerPendingAttribution as re, requireTable as ie, resolveEchoAttribution as ae, runStoreTransaction as oe, runWriteRecorders as N, stampGeneratedId as P, stampGeneratedIds as se, withCapturedAttribution as F } from "@voltro/database";
+import { EventEmitter as ce } from "node:events";
+import { createLogger as I } from "@voltro/logger";
+import { SqlClient as L, TransactionConnection as R } from "@effect/sql/SqlClient";
 //#region src/sqlLayer.ts
-var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
+var le = (e) => e ? { rejectUnauthorized: !1 } : void 0, ue = (e) => {
 	let t = e.acquireTimeoutMs ?? l;
 	return t > 0 ? t : void 0;
-}, le = (e) => {
+}, de = (e) => {
 	let t = e.acquireQueueLimit;
 	return t !== void 0 && t > 0 ? t : void 0;
-}, ue = (e) => {
-	let t = e.ssl === void 0 ? void 0 : se(e.ssl), n = ce(e), r = le(e);
+}, fe = (e) => {
+	let t = e.ssl === void 0 ? void 0 : le(e.ssl), n = ue(e), r = de(e);
 	return {
 		...t === void 0 ? {} : { ssl: t },
 		...n === void 0 ? {} : { connectTimeout: n },
 		...r === void 0 ? {} : { queueLimit: r }
 	};
-}, B = (n) => e.layerConfig({
+}, z = (n) => e.layerConfig({
 	host: t.succeed(n.host),
 	port: t.succeed(n.port),
 	username: t.succeed(n.username),
 	password: t.succeed(o.make(n.password)),
 	database: t.succeed(n.database),
-	poolConfig: t.succeed(ue(n)),
+	poolConfig: t.succeed(fe(n)),
 	...n.maxConnections === void 0 ? {} : { maxConnections: t.succeed(n.maxConnections) }
-}), V = (e) => {
+}), B = (e) => {
 	let t = e.get("sslmode");
 	if (t !== null) {
 		if (t === "require") return !0;
@@ -39,13 +39,13 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 		if (n === "false" || n === "0") return !1;
 		throw Error(`DB_URL '?ssl=${n}' is not supported by the mysql/mariadb dialect — use 'true'/'1' or 'false'/'0'.`);
 	}
-}, H = (e) => {
+}, V = (e) => {
 	let t = {
 		...e.acquireTimeoutMs === void 0 ? {} : { acquireTimeoutMs: e.acquireTimeoutMs },
 		...e.acquireQueueLimit === void 0 ? {} : { acquireQueueLimit: e.acquireQueueLimit }
 	};
 	if (e.url) {
-		let n = new URL(e.url), r = e.ssl ?? V(n.searchParams);
+		let n = new URL(e.url), r = e.ssl ?? B(n.searchParams);
 		return {
 			host: n.hostname || "localhost",
 			port: n.port ? Number(n.port) : 3306,
@@ -67,10 +67,33 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 		...e.ssl === void 0 ? {} : { ssl: e.ssl },
 		...t
 	};
-}, U = (e) => B(H(e)), de = (e, t) => e === null ? !1 : t === null ? !0 : e.filename === t.filename ? e.position > t.position : e.filename > t.filename, fe = (e) => e.msSinceProgress < e.stallThresholdMs ? "healthy" : e.primary !== null && !de(e.primary, e.reader) ? "idle-caught-up" : "reconnect", pe = (e) => (e instanceof Error ? e.message : String(e ?? "")).includes("schema changed between binlog event and metadata fetch"), me = (e) => {
+}, H = (e) => z(V(e)), U = (e) => e == null ? null : e instanceof Date ? String(e.getTime()) : typeof e == "bigint" ? e.toString() : typeof e == "boolean" ? e ? "1" : "0" : String(e), pe = (e, t, n) => {
+	let r = e.id;
+	if (r == null || U(t.id) === U(r)) return { kind: "sameRow" };
+	let i = n.filter((t) => e[t] !== void 0);
+	if (i.length === 0) return {
+		kind: "undecidable",
+		conflictColumns: n
+	};
+	let a = i.filter((n) => U(t[n]) !== U(e[n])).map((n) => ({
+		column: n,
+		asked: e[n],
+		found: t[n]
+	}));
+	return a.length > 0 ? {
+		kind: "otherKey",
+		mismatched: a
+	} : {
+		kind: "namedKey",
+		comparedColumns: i
+	};
+}, me = (e, t, n) => {
+	let r = `MysqlStore.upsert: the row written to '${e}' is not the row that was passed in. Upserting id '${String(t)}' matched an existing row instead, and `;
+	return n.kind === "undecidable" ? r + `nothing could establish which key it matched: none of the conflictColumns [${n.conflictColumns.join(", ")}] were present in the row, so their values could not be compared with the ones that came back. Nothing was changed.\n  → this happens when every conflict column is database-GENERATED. Name at least one column you supply yourself, or write the row with insert/update instead of upsert.` : r + `that row carries DIFFERENT values for the conflictColumns you named (${n.mismatched.map((e) => e.column).join(", ")}). Since those columns are excluded from the update, the matched row kept its own — so the statement was sent there by some OTHER unique key on this table, that row would have absorbed your values, and yours would never have been written. Nothing was changed.\n  → resolve the duplicate on that other key, or upsert on the columns that actually identify the row. The differing values are in the server log for this write.`;
+}, he = (e, t) => `upsert on '${e}' reached a row that does not carry the named conflict columns: ` + t.mismatched.map((e) => `${e.column}: sent ${JSON.stringify(e.asked)}, matched row has ${JSON.stringify(e.found)}`).join("; "), ge = (e, t) => e === null ? !1 : t === null ? !0 : e.filename === t.filename ? e.position > t.position : e.filename > t.filename, W = (e) => e.msSinceProgress < e.stallThresholdMs ? "healthy" : e.primary !== null && !ge(e.primary, e.reader) ? "idle-caught-up" : "reconnect", _e = (e) => (e instanceof Error ? e.message : String(e ?? "")).includes("schema changed between binlog event and metadata fetch"), ve = (e) => {
 	let t = e instanceof Error ? e.message : String(e ?? "");
 	return /Table\s+[^\s.]+\.(\S+)\s+schema changed between binlog event and metadata fetch/.exec(t)?.[1] ?? null;
-}, he = "\n  SELECT DISTINCT s.TABLE_NAME AS tableName\n  FROM information_schema.STATISTICS s\n  JOIN information_schema.COLUMNS c\n    ON c.TABLE_SCHEMA = s.TABLE_SCHEMA\n   AND c.TABLE_NAME  = s.TABLE_NAME\n   AND c.COLUMN_NAME = s.COLUMN_NAME\n  WHERE s.TABLE_SCHEMA = DATABASE()\n    AND s.NON_UNIQUE = 0\n    AND s.SUB_PART IS NULL\n    AND c.DATA_TYPE IN ('text','tinytext','mediumtext','longtext','blob','tinyblob','mediumblob','longblob')\n", W = "This verdict is the schema as read when the reader attached; applying the remedy does not lift it by itself. A boot that migrates in-process re-checks it once its schema work is done and re-admits the table in the same run; otherwise it holds until the process restarts.", G = (e) => `cdc: table '${e}' is EXCLUDED from binlog capture — its row image carries a hidden column the reader cannot account for. Cause: a UNIQUE constraint on an UNBOUNDED text column, which MariaDB backs with a HASH long-unique index; that index adds a hidden DB_ROW_HASH_n column to the row, present in the binlog and absent from information_schema.COLUMNS. Remedy: bound the column — text().maxLength(n) — so the constraint becomes an ordinary B-tree index with no hidden column. ALTER TABLE FORCE does NOT help: the rebuild recreates the index and the hidden column. Until then, cross-instance change events for this table are lost; own-node reactivity is unaffected (writes still emit inline). ${W}`, ge = (e) => `cdc: table '${e}' looks undecodable (a UNIQUE on an UNBOUNDED text column → MariaDB hash long-unique → a hidden DB_ROW_HASH_n column in the row image). Held OUT of binlog capture for now and re-checked after this boot's schema work — a migration that bounds the column re-admits it in the same run. Not a verdict yet; the definitive line follows.`, _e = (e) => `cdc: table '${e}' re-admitted to binlog capture — the hidden-column condition is gone (the schema moved since the reader attached). Cross-instance change events for it flow again.`, ve = 12e4, ye = (e, t = ve) => {
+}, ye = "\n  SELECT DISTINCT s.TABLE_NAME AS tableName\n  FROM information_schema.STATISTICS s\n  JOIN information_schema.COLUMNS c\n    ON c.TABLE_SCHEMA = s.TABLE_SCHEMA\n   AND c.TABLE_NAME  = s.TABLE_NAME\n   AND c.COLUMN_NAME = s.COLUMN_NAME\n  WHERE s.TABLE_SCHEMA = DATABASE()\n    AND s.NON_UNIQUE = 0\n    AND s.SUB_PART IS NULL\n    AND c.DATA_TYPE IN ('text','tinytext','mediumtext','longtext','blob','tinyblob','mediumblob','longblob')\n", be = "This verdict is the schema as read when the reader attached; applying the remedy does not lift it by itself. A boot that migrates in-process re-checks it once its schema work is done and re-admits the table in the same run; otherwise it holds until the process restarts.", G = (e) => `cdc: table '${e}' is EXCLUDED from binlog capture — its row image carries a hidden column the reader cannot account for. Cause: a UNIQUE constraint on an UNBOUNDED text column, which MariaDB backs with a HASH long-unique index; that index adds a hidden DB_ROW_HASH_n column to the row, present in the binlog and absent from information_schema.COLUMNS. Remedy: bound the column — text().maxLength(n) — so the constraint becomes an ordinary B-tree index with no hidden column. ALTER TABLE FORCE does NOT help: the rebuild recreates the index and the hidden column. Until then, cross-instance change events for this table are lost; own-node reactivity is unaffected (writes still emit inline). ${be}`, xe = (e) => `cdc: table '${e}' looks undecodable (a UNIQUE on an UNBOUNDED text column → MariaDB hash long-unique → a hidden DB_ROW_HASH_n column in the row image). Held OUT of binlog capture for now and re-checked after this boot's schema work — a migration that bounds the column re-admits it in the same run. Not a verdict yet; the definitive line follows.`, Se = (e) => `cdc: table '${e}' re-admitted to binlog capture — the hidden-column condition is gone (the schema moved since the reader attached). Cross-instance change events for it flow again.`, Ce = 12e4, we = (e, t = Ce) => {
 	let n = null, r = [], i = () => {
 		n &&= (clearTimeout(n), null), r = [];
 	};
@@ -81,7 +104,7 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 					for (let t of a) e("error", G(t));
 					return;
 				}
-				for (let t of a) e("warn", ge(t));
+				for (let t of a) e("warn", xe(t));
 				r = a, n = setTimeout(() => {
 					let i = r;
 					n = null, r = [];
@@ -93,29 +116,29 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 			i();
 			for (let n of t.stillExcluded) e("error", G(n));
 			for (let n of t.newlyExcluded) e("error", G(n));
-			for (let n of t.readmitted) e("info", _e(n));
+			for (let n of t.readmitted) e("info", Se(n));
 		},
 		dispose: i
 	};
-}, be = (e, t) => {
+}, Te = (e, t) => {
 	let n = new Set(e), r = new Set(t);
 	return {
 		stillExcluded: t.filter((e) => n.has(e)),
 		readmitted: e.filter((e) => !r.has(e)),
 		newlyExcluded: t.filter((e) => !n.has(e))
 	};
-}, xe = 3e5, Se = 3, Ce = (e, t) => {
-	let n = [...e.filter((e) => t - e < xe), t];
+}, Ee = 3e5, De = 3, Oe = (e, t) => {
+	let n = [...e.filter((e) => t - e < Ee), t];
 	return {
-		verdict: n.length >= Se ? "persistent" : "backlog",
+		verdict: n.length >= De ? "persistent" : "backlog",
 		hits: n
 	};
-}, we = /* @__PURE__ */ new Set([
+}, ke = /* @__PURE__ */ new Set([
 	"writerows",
 	"updaterows",
 	"deleterows"
-]), Te = /\b(alter|rename|drop|create)\s+(table|column)?/i, K = (e) => new Promise((t) => setTimeout(t, e)), q = async (e) => {
-	let t = L({ scope: `voltro:${e.variant}:cdc` }), n;
+]), Ae = /\b(alter|rename|drop|create)\s+(table|column)?/i, K = (e) => new Promise((t) => setTimeout(t, e)), q = async (e) => {
+	let t = I({ scope: `voltro:${e.variant}:cdc` }), n;
 	try {
 		n = (await import("@vlasky/zongji")).default;
 	} catch (t) {
@@ -130,14 +153,14 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 			o = n.binlogName;
 			return;
 		}
-		if (u === "query" && n.query && Te.test(n.query)) {
+		if (u === "query" && n.query && Ae.test(n.query)) {
 			l && (l.tableMap = {});
 			return;
 		}
 		if (n.nextPosition && o && (s = {
 			filename: o,
 			position: n.nextPosition
-		}, e.onPosition?.(s)), !we.has(u)) return;
+		}, e.onPosition?.(s)), !ke.has(u)) return;
 		let d = n.tableMap[n.tableId];
 		if (!d || d.parentSchema !== a) return;
 		let f = d.tableName;
@@ -215,9 +238,9 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 					l?.stop();
 				} catch {}
 				if (d++, await K(Math.min(3e4, 500 * 2 ** Math.min(d, 6))), u) return;
-				let i = s, a = w(n), c = !a && pe(n), f = !1;
+				let i = s, a = w(n), c = !a && _e(n), f = !1;
 				if (c) {
-					let e = me(n), i = e ?? "<unknown>", { verdict: a, hits: o } = Ce(h.get(i) ?? [], Date.now());
+					let e = ve(n), i = e ?? "<unknown>", { verdict: a, hits: o } = Oe(h.get(i) ?? [], Date.now());
 					h.set(i, o), f = a === "persistent", f && !g.has(i) && (g.add(i), e !== null && r.add(e), t.error(G(i)));
 				}
 				(a || c) && (f || t.warn(c ? "cdc: un-replayable backlog event (schema moved past it) — jumping to current end + self-heal" : "cdc: binlog gap (purged/failover) — jumping to current end + self-heal"), i = e.resolveStartPosition ? await e.resolveStartPosition().catch(() => null) : null, o = i?.filename ?? null, s = i, f || e.onResync?.());
@@ -250,7 +273,7 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 		if (u || p || Date.now() - f < v) return;
 		let n = null;
 		if (e.resolveStartPosition && (n = await e.resolveStartPosition().catch(() => null)), u || p) return;
-		let r = fe({
+		let r = W({
 			msSinceProgress: Date.now() - f,
 			stallThresholdMs: v,
 			primary: n,
@@ -298,7 +321,7 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 			}
 		}
 	};
-}, Ee = /* @__PURE__ */ new Set(["1213", "1205"]), De = (e) => {
+}, je = /* @__PURE__ */ new Set(["1213", "1205"]), Me = (e) => {
 	let t = e;
 	for (let e = 0; e < 5 && typeof t == "object" && t; e++) {
 		let e = t.errno;
@@ -308,8 +331,8 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 		t = t.cause;
 	}
 }, J = (e) => {
-	let t = De(e);
-	return t !== void 0 && Ee.has(t);
+	let t = Me(e);
+	return t !== void 0 && je.has(t);
 }, Y = (e) => J(e) ? "retry" : "noRetry", X = (e) => {
 	if (e == null) return "null";
 	let t = typeof e;
@@ -319,19 +342,19 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 	if (Array.isArray(e)) return `[${e.map(X).join(",")}]`;
 	let n = e;
 	return `{${Object.keys(n).sort().map((e) => `${JSON.stringify(e)}:${X(n[e])}`).join(",")}}`;
-}, Oe = (e) => {
+}, Ne = (e) => {
 	let t = X(e), n = 2166136261;
 	for (let e = 0; e < t.length; e++) n ^= t.charCodeAt(e), n = Math.imul(n, 16777619);
 	return (n >>> 0).toString(36);
-}, ke = (e, t) => {
+}, Pe = (e, t) => {
 	let n = setTimeout(e, t);
 	typeof n.unref == "function" && n.unref();
-}, Ae = class {
+}, Fe = class {
 	variant;
 	ttlMs;
 	schedule;
 	seen = /* @__PURE__ */ new Map();
-	constructor(e, t = 6e4, n = ke) {
+	constructor(e, t = 6e4, n = Pe) {
 		this.variant = e, this.ttlMs = t, this.schedule = n;
 	}
 	key(e) {
@@ -345,7 +368,7 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 		} catch {
 			r = t;
 		}
-		return `${e.table} ${e.op} ${String(n)} ${Oe(r)}`;
+		return `${e.table} ${e.op} ${String(n)} ${Ne(r)}`;
 	}
 	admit(e) {
 		let t = this.key(e);
@@ -365,11 +388,11 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 	1062,
 	1586
 ]), Q = async (e) => {
-	let t = e.variant ?? "mysql", n = L({ scope: `voltro:${t}` }), a = e.changeStrategy ?? "inline", o = a;
+	let t = e.variant ?? "mysql", n = I({ scope: `voltro:${t}` }), a = e.changeStrategy ?? "inline", o = a;
 	a === "cdc" && !e.cdcConfig && (n.warn("changeStrategy='cdc' requires cdcConfig (serverId + connection); falling back to 'inline'."), o = "inline");
-	let s = e.tracerLayer ? r.mergeAll(e.sqlLayer, e.tracerLayer) : e.sqlLayer, c = i.make(s), l = new je(await c.runPromise(R), c, t, o);
+	let s = e.tracerLayer ? r.mergeAll(e.sqlLayer, e.tracerLayer) : e.sqlLayer, c = i.make(s), l = new Ie(await c.runPromise(L), c, t, o);
 	return o === "cdc" && e.cdcConfig && await l.startCdcConsumer(e.cdcConfig), l;
-}, je = class e {
+}, Ie = class e {
 	sql;
 	runtime;
 	variant;
@@ -390,9 +413,9 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 	cdcGate;
 	reportEagerFallback;
 	constructor(e, t, n, r = "inline", i = null, a, o) {
-		this.sql = e, this.runtime = t, this.variant = n, this.changeStrategy = r, this.namespace = i, this.log = L({ scope: `voltro:${n}` }), this.cdcReporter = ye((e, t) => {
+		this.sql = e, this.runtime = t, this.variant = n, this.changeStrategy = r, this.namespace = i, this.log = I({ scope: `voltro:${n}` }), this.cdcReporter = we((e, t) => {
 			e === "error" ? this.log.error(t) : e === "warn" ? this.log.warn(t) : this.log.info(t);
-		}), this.reportEagerFallback = ee(this.log), this.emitter = a ?? new oe(), ne(this.emitter), this.cdcGate = o ?? new Ae(n);
+		}), this.reportEagerFallback = ee(this.log), this.emitter = a ?? new ce(), ne(this.emitter), this.cdcGate = o ?? new Fe(n);
 	}
 	withNamespace(t) {
 		return t === this.namespace ? this : new e(this.sql, this.runtime, this.variant, this.changeStrategy, t, this.emitter, this.cdcGate);
@@ -410,7 +433,7 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 		};
 	}
 	async executeQuery(e, t, r) {
-		let i = x(e, this.sql, this.namespace), a = t ? n.provideService(i, z, t) : i, o = await A(this.variant, "select", () => this.runtime.runPromise(a));
+		let i = x(e, this.sql, this.namespace), a = t ? n.provideService(i, R, t) : i, o = await A(this.variant, "select", () => this.runtime.runPromise(a));
 		return S(o, e.table, this.variant);
 	}
 	get supportsInsertReturning() {
@@ -426,7 +449,7 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 		t = P(e, t);
 		let o = this.sql;
 		if (this.supportsInsertReturning) {
-			let s = o`INSERT INTO ${o(this.nsT(e))} ${o.insert(w(t, e))} RETURNING *`, c = r ? n.provideService(s, z, r) : s, l = (await this.runtime.runPromise(c))[0];
+			let s = o`INSERT INTO ${o(this.nsT(e))} ${o.insert(w(t, e))} RETURNING *`, c = r ? n.provideService(s, R, r) : s, l = (await this.runtime.runPromise(c))[0];
 			if (!l) throw Error(`MysqlStore.insert: no row returned for table '${e}'`);
 			return await this.routeEvent({
 				table: e,
@@ -445,9 +468,9 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 				new: t
 			}, i, r, a), t;
 		}
-		let l = o`INSERT INTO ${o(this.nsT(e))} ${o.insert(s)}`, u = r ? n.provideService(l, z, r) : l;
+		let l = o`INSERT INTO ${o(this.nsT(e))} ${o.insert(s)}`, u = r ? n.provideService(l, R, r) : l;
 		await this.runtime.runPromise(u);
-		let d = o`SELECT * FROM ${o(this.nsT(e))} WHERE ${o("id")} = ${c}`, f = r ? n.provideService(d, z, r) : d, p = (await this.runtime.runPromise(f))[0];
+		let d = o`SELECT * FROM ${o(this.nsT(e))} WHERE ${o("id")} = ${c}`, f = r ? n.provideService(d, R, r) : d, p = (await this.runtime.runPromise(f))[0];
 		if (!p) throw Error(`MysqlStore.insert: row not found post-insert in '${e}'`);
 		return await this.routeEvent({
 			table: e,
@@ -460,16 +483,16 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 		let i = this.sql;
 		return this.runPinned(r, (r) => n.gen(this, function* () {
 			let a = i`INSERT INTO ${i(this.nsT(e))} ${i.insert(t)}`;
-			yield* n.provideService(a, z, r);
-			let o = (yield* n.provideService(i`SELECT LAST_INSERT_ID() AS ${i("lastId")}`, z, r))[0]?.lastId;
-			return o === void 0 || Number(o) === 0 ? yield* n.fail(/* @__PURE__ */ Error(`MysqlStore.insert: LAST_INSERT_ID() returned no id for '${e}' — is the primary key AUTO_INCREMENT?`)) : (yield* n.provideService(i`SELECT * FROM ${i(this.nsT(e))} WHERE ${i("id")} = ${o}`, z, r))[0] || (yield* n.fail(/* @__PURE__ */ Error(`MysqlStore.insert: row not found post-insert in '${e}'`)));
+			yield* n.provideService(a, R, r);
+			let o = (yield* n.provideService(i`SELECT LAST_INSERT_ID() AS ${i("lastId")}`, R, r))[0]?.lastId;
+			return o === void 0 || Number(o) === 0 ? yield* n.fail(/* @__PURE__ */ Error(`MysqlStore.insert: LAST_INSERT_ID() returned no id for '${e}' — is the primary key AUTO_INCREMENT?`)) : (yield* n.provideService(i`SELECT * FROM ${i(this.nsT(e))} WHERE ${i("id")} = ${o}`, R, r))[0] || (yield* n.fail(/* @__PURE__ */ Error(`MysqlStore.insert: row not found post-insert in '${e}'`)));
 		}), "insert");
 	}
 	async runPinned(e, t, r) {
 		if (e) return this.runtime.runPromise(t(e));
 		this.inflightTxns++;
 		try {
-			let e = n.suspend(() => this.sql.withTransaction(n.flatMap(n.serviceOption(z), (e) => a.isNone(e) ? n.fail(/* @__PURE__ */ Error(`MysqlStore.${r}: TransactionConnection missing.`)) : t(e.value)))), i = s.exponential("10 millis").pipe(s.compose(s.recurs(3)), s.whileInput(J)), o = e.pipe(n.retry(i), n.withSpan(`store.${r}`, { attributes: {
+			let e = n.suspend(() => this.sql.withTransaction(n.flatMap(n.serviceOption(R), (e) => a.isNone(e) ? n.fail(/* @__PURE__ */ Error(`MysqlStore.${r}: TransactionConnection missing.`)) : t(e.value)))), i = s.exponential("10 millis").pipe(s.compose(s.recurs(3)), s.whileInput(J)), o = e.pipe(n.retry(i), n.withSpan(`store.${r}`, { attributes: {
 				"db.system": this.variant,
 				"db.operation": r
 			} }));
@@ -479,16 +502,16 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 		}
 	}
 	async executeInsertMany(e, t, r, i, a) {
-		if (t = F(e, t), t.length === 0) return [];
+		if (t = se(e, t), t.length === 0) return [];
 		let o = this.sql, s = t.map((t) => w(t, e)), c = _(s, g(this.variant));
 		if (this.supportsInsertReturning) {
 			let t = (t) => o`INSERT INTO ${o(this.nsT(e))} ${o.insert(t)} RETURNING *`, s;
 			if (c.length === 1) {
-				let e = t(c[0]), i = r ? n.provideService(e, z, r) : e;
+				let e = t(c[0]), i = r ? n.provideService(e, R, r) : e;
 				s = await this.runtime.runPromise(i);
 			} else if (r) {
 				let e = [];
-				for (let i of c) e.push(...await this.runtime.runPromise(n.provideService(t(i), z, r)));
+				for (let i of c) e.push(...await this.runtime.runPromise(n.provideService(t(i), R, r)));
 				s = e;
 			} else s = await this.runtime.runPromise(o.withTransaction(n.map(n.forEach(c, t, { concurrency: 1 }), (e) => e.flat())));
 			for (let t of s) await this.routeEvent({
@@ -513,16 +536,16 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 		if (l.some((e) => e === void 0)) throw Error("MysqlStore.insertMany: rows mix client-supplied and missing 'id's — supply an id for every row or none (AUTO_INCREMENT recovery).");
 		let u = (t) => o`INSERT INTO ${o(this.nsT(e))} ${o.insert(t)}`;
 		if (c.length === 1) {
-			let e = r ? n.provideService(u(c[0]), z, r) : u(c[0]);
+			let e = r ? n.provideService(u(c[0]), R, r) : u(c[0]);
 			await this.runtime.runPromise(e);
-		} else if (r) for (let e of c) await this.runtime.runPromise(n.provideService(u(e), z, r));
+		} else if (r) for (let e of c) await this.runtime.runPromise(n.provideService(u(e), R, r));
 		else await this.runtime.runPromise(o.withTransaction(n.forEach(c, u, {
 			concurrency: 1,
 			discard: !0
 		})));
 		let d = _(l.map((e) => ({ id: e })), g(this.variant)), f = [];
 		for (let t of d) {
-			let i = o`SELECT * FROM ${o(this.nsT(e))} WHERE ${o("id")} IN ${o.in(t.map((e) => e.id))}`, a = r ? n.provideService(i, z, r) : i;
+			let i = o`SELECT * FROM ${o(this.nsT(e))} WHERE ${o("id")} IN ${o.in(t.map((e) => e.id))}`, a = r ? n.provideService(i, R, r) : i;
 			f.push(...await this.runtime.runPromise(a));
 		}
 		let p = new Map(f.map((e) => [e.id, e])), m = l.map((e) => p.get(e)).filter((e) => e !== void 0);
@@ -540,19 +563,19 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 			let a = [];
 			for (let o of t) {
 				let t = i`INSERT INTO ${i(this.nsT(e))} ${i.insert(o)}`;
-				yield* n.provideService(t, z, r);
-				let s = (yield* n.provideService(i`SELECT LAST_INSERT_ID() AS ${i("firstId")}`, z, r))[0]?.firstId;
+				yield* n.provideService(t, R, r);
+				let s = (yield* n.provideService(i`SELECT LAST_INSERT_ID() AS ${i("firstId")}`, R, r))[0]?.firstId;
 				if (s === void 0 || Number(s) === 0) return yield* n.fail(/* @__PURE__ */ Error(`MysqlStore.insertMany: LAST_INSERT_ID() returned no id for '${e}' — is the primary key AUTO_INCREMENT?`));
-				let c = Number(s), l = yield* n.provideService(i`SELECT * FROM ${i(this.nsT(e))} WHERE ${i("id")} BETWEEN ${c} AND ${c + o.length - 1} ORDER BY ${i("id")} ASC`, z, r);
+				let c = Number(s), l = yield* n.provideService(i`SELECT * FROM ${i(this.nsT(e))} WHERE ${i("id")} BETWEEN ${c} AND ${c + o.length - 1} ORDER BY ${i("id")} ASC`, R, r);
 				a.push(...l);
 			}
 			return a;
 		}), "insert");
 	}
 	async executePatchJson(e, t, r, i, a, o, s) {
-		let c = this.sql, l = r.split("."), u = l[0], d = l.slice(1), f = JSON.stringify(i ?? null), p = d.length === 0 ? "$" : `$.${d.join(".")}`, m = c`UPDATE ${c(this.nsT(e))} SET ${c(u)} = JSON_SET(COALESCE(${c(u)}, '{}'), ${p}, CAST(${f} AS JSON)) WHERE ${c("id")} = ${t}`, h = a ? n.provideService(m, z, a) : m, g = await this.runtime.runPromise(h);
+		let c = this.sql, l = r.split("."), u = l[0], d = l.slice(1), f = JSON.stringify(i ?? null), p = d.length === 0 ? "$" : `$.${d.join(".")}`, m = c`UPDATE ${c(this.nsT(e))} SET ${c(u)} = JSON_SET(COALESCE(${c(u)}, '{}'), ${p}, CAST(${f} AS JSON)) WHERE ${c("id")} = ${t}`, h = a ? n.provideService(m, R, a) : m, g = await this.runtime.runPromise(h);
 		if (g && typeof g.affectedRows == "number" && g.affectedRows === 0) return null;
-		let _ = c`SELECT * FROM ${c(this.nsT(e))} WHERE ${c("id")} = ${t}`, v = a ? n.provideService(_, z, a) : _, y = (await this.runtime.runPromise(v))[0];
+		let _ = c`SELECT * FROM ${c(this.nsT(e))} WHERE ${c("id")} = ${t}`, v = a ? n.provideService(_, R, a) : _, y = (await this.runtime.runPromise(v))[0];
 		return y ? (await this.routeEvent({
 			table: e,
 			op: "update",
@@ -563,7 +586,7 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 	async executeUpdate(e, t, r, i, a, o) {
 		let s = this.sql;
 		if (this.supportsUpdateReturning) {
-			let c = s`UPDATE ${s(this.nsT(e))} SET ${s.update(w(r, e))} WHERE ${s("id")} = ${t} RETURNING *`, l = i ? n.provideService(c, z, i) : c, u = (await this.runtime.runPromise(l))[0];
+			let c = s`UPDATE ${s(this.nsT(e))} SET ${s.update(w(r, e))} WHERE ${s("id")} = ${t} RETURNING *`, l = i ? n.provideService(c, R, i) : c, u = (await this.runtime.runPromise(l))[0];
 			return u ? (await this.routeEvent({
 				table: e,
 				op: "update",
@@ -571,9 +594,9 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 				new: u
 			}, a, i, o), u) : null;
 		}
-		let c = s`UPDATE ${s(this.nsT(e))} SET ${s.update(w(r, e))} WHERE ${s("id")} = ${t}`, l = i ? n.provideService(c, z, i) : c, u = await this.runtime.runPromise(l);
+		let c = s`UPDATE ${s(this.nsT(e))} SET ${s.update(w(r, e))} WHERE ${s("id")} = ${t}`, l = i ? n.provideService(c, R, i) : c, u = await this.runtime.runPromise(l);
 		if (u && typeof u.affectedRows == "number" && u.affectedRows === 0) return null;
-		let d = s`SELECT * FROM ${s(this.nsT(e))} WHERE ${s("id")} = ${t}`, f = i ? n.provideService(d, z, i) : d, p = (await this.runtime.runPromise(f))[0];
+		let d = s`SELECT * FROM ${s(this.nsT(e))} WHERE ${s("id")} = ${t}`, f = i ? n.provideService(d, R, i) : d, p = (await this.runtime.runPromise(f))[0];
 		return p ? (await this.routeEvent({
 			table: e,
 			op: "update",
@@ -584,7 +607,7 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 	async executeDelete(e, t, r, i, a) {
 		let o = this.sql;
 		if (this.supportsDeleteReturning) {
-			let s = o`DELETE FROM ${o(this.nsT(e))} WHERE ${o("id")} = ${t} RETURNING *`, c = r ? n.provideService(s, z, r) : s, l = (await this.runtime.runPromise(c))[0];
+			let s = o`DELETE FROM ${o(this.nsT(e))} WHERE ${o("id")} = ${t} RETURNING *`, c = r ? n.provideService(s, R, r) : s, l = (await this.runtime.runPromise(c))[0];
 			return l ? (await this.routeEvent({
 				table: e,
 				op: "delete",
@@ -592,9 +615,9 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 				new: null
 			}, i, r, a), !0) : !1;
 		}
-		let s = o`SELECT * FROM ${o(this.nsT(e))} WHERE ${o("id")} = ${t}`, c = r ? n.provideService(s, z, r) : s, l = (await this.runtime.runPromise(c))[0];
+		let s = o`SELECT * FROM ${o(this.nsT(e))} WHERE ${o("id")} = ${t}`, c = r ? n.provideService(s, R, r) : s, l = (await this.runtime.runPromise(c))[0];
 		if (!l) return !1;
-		let u = o`DELETE FROM ${o(this.nsT(e))} WHERE ${o("id")} = ${t}`, d = r ? n.provideService(u, z, r) : u;
+		let u = o`DELETE FROM ${o(this.nsT(e))} WHERE ${o("id")} = ${t}`, d = r ? n.provideService(u, R, r) : u;
 		return await this.runtime.runPromise(d), await this.routeEvent({
 			table: e,
 			op: "delete",
@@ -608,20 +631,20 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 	async appendInTxn(t, r, i) {
 		let a = this.sql, o = w(r, t), s = a`INSERT INTO ${a(this.nsT(t))} ${a.insert(o)}`;
 		try {
-			await this.runtime.runPromise(i ? n.provideService(s, z, i) : s);
+			await this.runtime.runPromise(i ? n.provideService(s, R, i) : s);
 		} catch (n) {
 			throw e.bindingContextFor(n, t, o);
 		}
 	}
 	async maxInTxn(e, t, r, i) {
-		let a = this.sql, o = Object.entries(r).map(([e, t]) => a`${a(e)} = ${t}`), s = a`SELECT MAX(${a(t)}) AS ${a("m")} FROM ${a(this.nsT(e))} WHERE ${a.and(o)}`, c = (await this.runtime.runPromise(i ? n.provideService(s, z, i) : s))[0]?.m;
+		let a = this.sql, o = Object.entries(r).map(([e, t]) => a`${a(e)} = ${t}`), s = a`SELECT MAX(${a(t)}) AS ${a("m")} FROM ${a(this.nsT(e))} WHERE ${a.and(o)}`, c = (await this.runtime.runPromise(i ? n.provideService(s, R, i) : s))[0]?.m;
 		return c == null ? null : Number(c);
 	}
 	async routeEvent(e, t, n = null, r) {
 		if (e = {
 			...p(r),
 			...e
-		}, j(e.table) && await ae({
+		}, j(e.table) && await N({
 			append: (e, t) => this.appendInTxn(e, t, n),
 			maxOf: (e, t, r) => this.maxInTxn(e, t, r, n)
 		}, {
@@ -633,7 +656,7 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 			subjectId: e.subjectId
 		}), this.changeStrategy === "cdc") {
 			let t = (e.op === "delete" ? e.old : e.new)?.id;
-			t != null && M(m(e.table, e.op, t), {
+			t != null && re(m(e.table, e.op, t), {
 				...e.traceId === void 0 ? {} : { traceId: e.traceId },
 				...e.subjectId === void 0 ? {} : { subjectId: e.subjectId }
 			});
@@ -671,16 +694,20 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 			}
 			return await this.executeUpdate(e, o.id, a, r, i) ?? o;
 		}
-		return I((n) => this.executeInsert(e, t, r, i, n));
+		return F((n) => this.executeInsert(e, t, r, i, n));
 	}
 	async executeMariadbUpsert(e, t, r, i, a, o) {
-		let s = this.sql, c = w(t, e), l = Object.keys(c).filter((e) => c[e] !== void 0), u = r.update === void 0 ? l.filter((e) => e !== "id" && !r.conflictColumns.includes(e)) : r.update, d = u.length > 0 ? s.csv(u.map((e) => s`${s(e)} = VALUES(${s(e)})`)) : s`${s(r.conflictColumns[0])} = VALUES(${s(r.conflictColumns[0])})`, f = await this.runPinned(i, (i) => n.tryPromise({
+		let s = this.sql, c = w(t, e), l = Object.keys(c).filter((e) => c[e] !== void 0), u = r.update === void 0 ? l.filter((e) => e !== "id" && !r.conflictColumns.includes(e)) : r.update, d = u.length > 0 ? s.csv(u.map((e) => s`${s(e)} = VALUES(${s(e)})`)) : s`${s(r.conflictColumns[0])} = VALUES(${s(r.conflictColumns[0])})`, f = await this.runPinned(i, (t) => n.tryPromise({
 			try: async () => {
-				let a = s`INSERT INTO ${s(this.nsT(e))} ${s.insert(c)} ON DUPLICATE KEY UPDATE ${d} RETURNING *`, o = (await this.runtime.runPromise(n.provideService(a, z, i)))[0];
-				if (!o) throw Error(`MysqlStore.upsert: no row returned for table '${e}'`);
-				let l = t.id;
-				if (l != null && o.id !== l) throw Error(`MysqlStore.upsert: the row written to '${e}' is not the row that was passed in. Upserting id '${String(l)}' matched an existing row with id '${String(o.id)}' on a DIFFERENT unique constraint than the conflictColumns [${r.conflictColumns.join(", ")}] you named, so that row would have been updated and yours never written. Nothing was changed. Name the constraint that actually collides, or resolve the duplicate first.`);
-				return o;
+				let i = s`INSERT INTO ${s(this.nsT(e))} ${s.insert(c)} ON DUPLICATE KEY UPDATE ${d} RETURNING *`, a = (await this.runtime.runPromise(n.provideService(i, R, t)))[0];
+				if (!a) throw Error(`MysqlStore.upsert: no row returned for table '${e}'`);
+				let o = pe(c, a, r.conflictColumns);
+				if (o.kind === "otherKey" || o.kind === "undecidable") throw o.kind === "otherKey" && this.log.error(he(e, o)), M({
+					kind: "unique",
+					detail: me(e, c.id, o),
+					...o.kind === "otherKey" && o.mismatched[0] !== void 0 ? { column: o.mismatched[0].column } : {}
+				});
+				return a;
 			},
 			catch: (e) => e
 		}), "upsert"), p = t.id !== void 0 && t.id === f.id ? "insert" : "update";
@@ -692,7 +719,7 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 		}, a, i, o), f;
 	}
 	async executeInsertIgnore(e, t, r, i, a, o) {
-		if (t = P(e, t), t.id === void 0) return await this.findByConflict(e, t, r.conflictColumns, i) || I((n) => this.executeInsert(e, t, i, a, n));
+		if (t = P(e, t), t.id === void 0) return await this.findByConflict(e, t, r.conflictColumns, i) || F((n) => this.executeInsert(e, t, i, a, n));
 		let s = await this.runPinned(i, (i) => n.tryPromise({
 			try: () => this.decideInsertIgnore(e, t, r, i),
 			catch: (e) => e
@@ -705,7 +732,7 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 		}, a, i, o), s.row;
 	}
 	async decideInsertIgnore(e, t, r, i) {
-		let a = this.sql, o = w(t, e), s = (e) => this.runtime.runPromise(n.provideService(e, z, i));
+		let a = this.sql, o = w(t, e), s = (e) => this.runtime.runPromise(n.provideService(e, R, i));
 		if (this.supportsInsertReturning) {
 			let n = (await s(a`INSERT IGNORE INTO ${a(this.nsT(e))} ${a.insert(o)} RETURNING *`))[0];
 			if (n) return {
@@ -746,7 +773,7 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 	async findUndecodableCdcTables(e) {
 		if (this.variant !== "mariadb") return [];
 		try {
-			let t = (await this.runtime.runPromise(this.sql.unsafe(he))).map((e) => String(e.tableName ?? e.TABLE_NAME ?? "")).filter((e) => e !== "");
+			let t = (await this.runtime.runPromise(this.sql.unsafe(ye))).map((e) => String(e.tableName ?? e.TABLE_NAME ?? "")).filter((e) => e !== "");
 			return e === void 0 ? t : t.filter((t) => e.includes(t));
 		} catch (e) {
 			return this.log.debug(`cdc: could not probe for undecodable tables — ${e?.message ?? String(e)}`), [];
@@ -756,7 +783,7 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 		if (e === null) return [];
 		try {
 			let t = this.sql`SHOW WARNINGS`.unprepared;
-			return (await this.runtime.runPromise(n.provideService(t, z, e))).map((e) => ({
+			return (await this.runtime.runPromise(n.provideService(t, R, e))).map((e) => ({
 				code: Number(e.Code ?? e.code ?? 0),
 				message: String(e.Message ?? e.message ?? "")
 			}));
@@ -766,8 +793,10 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 	}
 	async findByConflict(e, t, r, i) {
 		if (r.length === 0) return;
-		let a = this.sql, o = r.map((e) => a`${a(e)} = ${t[e]}`), s = a`SELECT * FROM ${a(this.nsT(e))} WHERE ${a.and(o)} LIMIT 1`, c = i ? n.provideService(s, z, i) : s;
-		return (await this.runtime.runPromise(c))[0];
+		let a = this.sql, o = r.filter((e) => t[e] === void 0);
+		if (o.length > 0) throw Error(`MysqlStore.upsert: cannot look the row up by conflictColumns [${r.join(", ")}] on '${e}' — ${o.join(", ")} ${o.length === 1 ? "has" : "have"} no value in the row you passed, so there is nothing to match on. Nothing was written.\n  This is what a database-GENERATED column looks like here: the server computes it, so a lookup by value cannot ask for it.\n  \u2192 let the DATABASE evaluate it instead of looking the row up: on MariaDB an upsert takes the single-statement path when the row is a complete INSERT row and the \`update\` option is a column list rather than a function. Pass every not-null column and use \`update: ['col']\`.\n  \u2192 or name only conflict columns you supply yourself.`);
+		let s = r.map((e) => a`${a(e)} = ${t[e]}`), c = a`SELECT * FROM ${a(this.nsT(e))} WHERE ${a.and(s)} LIMIT 1`, l = i ? n.provideService(c, R, i) : c;
+		return (await this.runtime.runPromise(l))[0];
 	}
 	query(e) {
 		return this.runWithEager(e, null);
@@ -780,7 +809,7 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 		if (!O(e)) return this.executeQuery(e, t);
 		let r = this.variant === "mariadb" ? "mariadb" : "mysql", i = this.namespace === null ? v(e, this.sql, r) : null;
 		if (i !== null) try {
-			let e = t ? n.provideService(i.fragment, z, t) : i.fragment, r = await A(this.variant, "select", () => this.runtime.runPromise(e));
+			let e = t ? n.provideService(i.fragment, R, t) : i.fragment, r = await A(this.variant, "select", () => this.runtime.runPromise(e));
 			return i.decode(r);
 		} catch (t) {
 			if (t instanceof u) throw t;
@@ -797,7 +826,7 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 			reason: "not-compilable"
 		});
 		let a = await this.executeQuery(e, t);
-		return f(a, e.eager, e.sourceTable ?? N(e.table), (e) => this.executeQuery(e, t));
+		return f(a, e.eager, e.sourceTable ?? ie(e.table), (e) => this.executeQuery(e, t));
 	}
 	getInternalRunWithEager() {
 		return this.runWithEager.bind(this);
@@ -813,10 +842,10 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 	async localWrite(e, t, n) {
 		let r = (e) => j(t) ? this.writeWithRecorders(n, e) : n(e, null, null);
 		return A(this.variant, e, async () => {
-			if (this.changeStrategy !== "cdc") return I(r);
+			if (this.changeStrategy !== "cdc") return F(r);
 			h(t);
 			try {
-				return await I(r);
+				return await F(r);
 			} finally {
 				T(t);
 			}
@@ -857,13 +886,13 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 		let i = this.sql, o = y(r.where, i, this.namespace);
 		this.changeStrategy === "cdc" && h(e), this.inflightTxns++;
 		try {
-			let r = n.suspend(() => this.sql.withTransaction(n.flatMap(n.serviceOption(z), (r) => {
+			let r = n.suspend(() => this.sql.withTransaction(n.flatMap(n.serviceOption(R), (r) => {
 				if (a.isNone(r)) return n.fail(/* @__PURE__ */ Error("MysqlStore.updateMany: TransactionConnection missing."));
 				let s = r.value, c = i`SELECT id FROM ${i(this.nsT(e))} WHERE ${o} FOR UPDATE`, l = i`UPDATE ${i(this.nsT(e))} SET ${i.update(w(t, e))} WHERE ${o}`;
-				return n.flatMap(n.provideService(c, z, s), (t) => {
+				return n.flatMap(n.provideService(c, R, s), (t) => {
 					if (t.length === 0) return n.succeed([]);
 					let r = t.map((e) => e.id), a = i`SELECT * FROM ${i(this.nsT(e))} WHERE ${i("id")} IN ${i.in(r)}`;
-					return n.flatMap(n.provideService(l, z, s), () => n.provideService(a, z, s));
+					return n.flatMap(n.provideService(l, R, s), () => n.provideService(a, R, s));
 				});
 			}))), c = s.exponential("10 millis").pipe(s.compose(s.recurs(3)), s.whileInput(J)), l = r.pipe(n.retry(c), n.withSpan("store.updateMany", { attributes: {
 				"db.system": this.variant,
@@ -896,10 +925,10 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 		}
 		this.changeStrategy === "cdc" && h(e), this.inflightTxns++;
 		try {
-			let t = n.suspend(() => this.sql.withTransaction(n.flatMap(n.serviceOption(z), (t) => {
+			let t = n.suspend(() => this.sql.withTransaction(n.flatMap(n.serviceOption(R), (t) => {
 				if (a.isNone(t)) return n.fail(/* @__PURE__ */ Error("MysqlStore.deleteMany: TransactionConnection missing."));
 				let o = t.value, s = r`SELECT * FROM ${r(this.nsT(e))} WHERE ${i} FOR UPDATE`, c = r`DELETE FROM ${r(this.nsT(e))} WHERE ${i}`;
-				return n.flatMap(n.provideService(s, z, o), (e) => e.length === 0 ? n.succeed(e) : n.as(n.provideService(c, z, o), e));
+				return n.flatMap(n.provideService(s, R, o), (e) => e.length === 0 ? n.succeed(e) : n.as(n.provideService(c, R, o), e));
 			}))), o = s.exponential("10 millis").pipe(s.compose(s.recurs(3)), s.whileInput(J)), c = t.pipe(n.retry(o), n.withSpan("store.deleteMany", { attributes: {
 				"db.system": this.variant,
 				"db.operation": "delete"
@@ -922,7 +951,7 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 	}
 	async startCdcConsumer(e) {
 		if (this.cdcHandle) return;
-		await this.assertBinlogConfig(), this.cdcReplicaId = e.replicaId, this.cdcAdminRuntime = i.make(B({
+		await this.assertBinlogConfig(), this.cdcReplicaId = e.replicaId, this.cdcAdminRuntime = i.make(z({
 			...e.connection,
 			maxConnections: 1
 		}));
@@ -963,7 +992,7 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 		let t = this.cdcAdminRuntime;
 		if (t === null) return !0;
 		try {
-			let r = await t.runPromise(n.flatMap(R, (e) => e`SHOW BINARY LOGS`.unprepared));
+			let r = await t.runPromise(n.flatMap(L, (e) => e`SHOW BINARY LOGS`.unprepared));
 			return r.length === 0 || r.some((t) => (t.Log_name ?? t.log_name) === e);
 		} catch (e) {
 			return this.log.debug(`cdc: could not list binary logs (${e?.message ?? String(e)}) — trusting the persisted offset`), !0;
@@ -991,7 +1020,7 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 	async resolveBinlogEndOverCdc() {
 		let e = this.cdcAdminRuntime;
 		if (e === null) return null;
-		let t = (e) => n.flatMap(R, (t) => t`${t.unsafe(e)}`.unprepared);
+		let t = (e) => n.flatMap(L, (t) => t`${t.unsafe(e)}`.unprepared);
 		for (let n of this.variant === "mysql" ? ["SHOW BINARY LOG STATUS", "SHOW MASTER STATUS"] : ["SHOW MASTER STATUS", "SHOW BINARY LOG STATUS"]) try {
 			let r = (await e.runPromise(t(n)))[0];
 			if (r?.File) return {
@@ -1087,16 +1116,16 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 	}
 	async emptyTablesOn(e, t) {
 		if (e.length === 0) return;
-		let r = this.sql, i = (e) => this.nsT(e), a = (e) => r.unsafe(`SET FOREIGN_KEY_CHECKS = ${+!!e}`).unprepared, o = n.acquireUseRelease(a(!1), () => n.forEach(e, (e) => r`DELETE FROM ${r(i(e))}`, { discard: !0 }), () => n.orDie(n.ignore(a(!0)))), s = t === null ? r.withTransaction(o) : n.provideService(o, z, t);
+		let r = this.sql, i = (e) => this.nsT(e), a = (e) => r.unsafe(`SET FOREIGN_KEY_CHECKS = ${+!!e}`).unprepared, o = n.acquireUseRelease(a(!1), () => n.forEach(e, (e) => r`DELETE FROM ${r(i(e))}`, { discard: !0 }), () => n.orDie(n.ignore(a(!0)))), s = t === null ? r.withTransaction(o) : n.provideService(o, R, t);
 		await this.runtime.runPromise(s);
 	}
 	async transactional(e) {
 		this.inflightTxns++;
 		try {
-			return await ie({
+			return await oe({
 				...this.txnSpec("MysqlStore.transactional"),
 				work: e,
-				makeView: (e, t) => new Me(this, e, t)
+				makeView: (e, t) => new Le(this, e, t)
 			});
 		} finally {
 			this.inflightTxns--;
@@ -1129,7 +1158,7 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 	injectExternalChange(e) {
 		if (this.changeStrategy === "cdc" && !this.cdcGate.admit(e) || !k(e.table)) return;
 		let t = (e.op === "delete" ? e.old : e.new)?.id;
-		re(e.table, e.op, t, (t) => {
+		ae(e.table, e.op, t, (t) => {
 			this.emitter.emit("change", E(e, t));
 		});
 	}
@@ -1142,7 +1171,7 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 			readmitted: [],
 			newlyExcluded: []
 		};
-		let e = await this.findUndecodableCdcTables(this.cdcIncludeTables), t = be(this.cdcExcluded, e);
+		let e = await this.findUndecodableCdcTables(this.cdcIncludeTables), t = Te(this.cdcExcluded, e);
 		return this.cdcReporter.settle(t), this.cdcExcluded = e, (t.readmitted.length > 0 || t.newlyExcluded.length > 0) && await this.cdcHandle.setUndecodableTables(e), t;
 	}
 	async close(e = 5e3) {
@@ -1167,7 +1196,7 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 	async ping() {
 		await this.runtime.runPromise(this.sql`SELECT 1`);
 	}
-}, Me = class {
+}, Le = class {
 	parent;
 	txn;
 	attr;
@@ -1243,12 +1272,12 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 			this.events.length = 0;
 		}
 	}
-}, $ = (e) => e.__mysqlReplicationFriend ?? null, Ne = () => ({
+}, $ = (e) => e.__mysqlReplicationFriend ?? null, Re = () => ({
 	async capturePrimaryPosition(e) {
 		let t = $(e);
 		if (t === null) throw Error("mysqlReplicationAdapter: primary is not a MysqlStore (missing __mysqlReplicationFriend).");
 		return t.runEffect(n.gen(function* () {
-			let e = yield* R, r = (t.variant === "mariadb" ? yield* e`SELECT @@global.gtid_current_pos AS gtid` : yield* e`SELECT @@global.gtid_executed AS gtid`)[0]?.gtid;
+			let e = yield* L, r = (t.variant === "mariadb" ? yield* e`SELECT @@global.gtid_current_pos AS gtid` : yield* e`SELECT @@global.gtid_executed AS gtid`)[0]?.gtid;
 			return typeof r == "string" ? r : yield* n.die("mysql/mariadb did not return a GTID set");
 		}));
 	},
@@ -1256,25 +1285,25 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 		let t = $(e);
 		if (t === null) throw Error("mysqlReplicationAdapter: replica is not a MysqlStore.");
 		return t.runEffect(n.gen(function* () {
-			let e = yield* R, r = (t.variant === "mariadb" ? yield* e`SELECT @@global.gtid_current_pos AS gtid` : yield* e`SELECT @@global.gtid_executed AS gtid`)[0]?.gtid;
+			let e = yield* L, r = (t.variant === "mariadb" ? yield* e`SELECT @@global.gtid_current_pos AS gtid` : yield* e`SELECT @@global.gtid_executed AS gtid`)[0]?.gtid;
 			return typeof r == "string" ? r : yield* n.die("mysql/mariadb replica did not return a GTID set");
 		}));
 	},
 	compare(e, t) {
 		return "behind";
 	}
-}), Pe = {
+}), ze = {
 	id: "mysql",
-	makeSqlLayer: (e) => U(e),
+	makeSqlLayer: (e) => H(e),
 	makeStore: (e) => Q({
 		...e,
 		variant: "mysql"
 	}),
 	compileContains: (e, t, n) => n`${e} LIKE ${`%${t.replace(/[\\%_]/g, (e) => `\\${e}`)}%`} ESCAPE '\\'`,
 	retryFilter: Y
-}, Fe = {
+}, Be = {
 	id: "mariadb",
-	makeSqlLayer: (e) => U(e),
+	makeSqlLayer: (e) => H(e),
 	makeStore: (e) => Q({
 		...e,
 		variant: "mariadb"
@@ -1283,4 +1312,4 @@ var se = (e) => e ? { rejectUnauthorized: !1 } : void 0, ce = (e) => {
 	retryFilter: Y
 };
 //#endregion
-export { c as CDC_OFFSETS_TABLE, e as MysqlClient, d as _voltroCdcOffsetsTable, H as connectionFromConfig, B as makeMysqlSqlLayer, U as makeMysqlSqlLayerFromConfig, Q as makeMysqlStore, Fe as mariadbDialect, Pe as mysqlDialect, Ne as mysqlReplicationAdapter, Y as mysqlRetryFilter, q as startBinlogCdc };
+export { c as CDC_OFFSETS_TABLE, e as MysqlClient, d as _voltroCdcOffsetsTable, V as connectionFromConfig, z as makeMysqlSqlLayer, H as makeMysqlSqlLayerFromConfig, Q as makeMysqlStore, Be as mariadbDialect, ze as mysqlDialect, Re as mysqlReplicationAdapter, Y as mysqlRetryFilter, q as startBinlogCdc };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/sql-mysql",
-  "version": "0.57.0",
+  "version": "0.58.0",
   "description": "MySQL/MariaDB dialect adapter for Voltro's cross-dialect DataStore (mariadb binlog CDC; mysql inline reactivity).",
   "keywords": [
     "voltro",
@@ -35,8 +35,8 @@
   "dependencies": {
     "@effect/sql": "^0.52.0",
     "@effect/sql-mysql2": "^0.53.0",
-    "@voltro/database": "0.57.0",
-    "@voltro/logger": "0.57.0"
+    "@voltro/database": "0.58.0",
+    "@voltro/logger": "0.58.0"
   },
   "optionalDependencies": {
     "@vlasky/zongji": "^0.9.0"