@hot-updater/aws 1.0.0-rc.1 → 1.0.0-rc.14

package/dist/iac/index.cjs

@@ -6,7 +6,7 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __commonJSMin = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
+var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
 var __copyProps = (to, from, except, desc) => {
 	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
 		key = keys[i];
@@ -17,7 +17,7 @@ var __copyProps = (to, from, except, desc) => {
 	}
 	return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, "default") ? __defProp(target, "default", {
 	value: mod,
 	enumerable: true
 }) : target, mod));
@@ -29,13 +29,13 @@ let node_child_process = require("node:child_process");
 let node_string_decoder = require("node:string_decoder");
 let node_util = require("node:util");
 let node_process = require("node:process");
-node_process = __toESM(node_process);
+node_process = __toESM(node_process, 1);
 let node_tty = require("node:tty");
-node_tty = __toESM(node_tty);
+node_tty = __toESM(node_tty, 1);
 let node_path = require("node:path");
-node_path = __toESM(node_path);
+node_path = __toESM(node_path, 1);
 let path = require("path");
-path = __toESM(path);
+path = __toESM(path, 1);
 let node_timers_promises = require("node:timers/promises");
 let node_os = require("node:os");
 let node_events = require("node:events");
@@ -44,6 +44,7 @@ let node_fs = require("node:fs");
 let node_stream_promises = require("node:stream/promises");
 let node_stream = require("node:stream");
 let node_buffer = require("node:buffer");
+let node_crypto = require("node:crypto");
 let _aws_sdk_client_cloudfront = require("@aws-sdk/client-cloudfront");
 let _aws_sdk_client_dynamodb = require("@aws-sdk/client-dynamodb");
 let _aws_sdk_lib_dynamodb = require("@aws-sdk/lib-dynamodb");
@@ -52,12 +53,11 @@ let _hot_updater_plugin_core_internal = require("@hot-updater/plugin-core/intern
 let _aws_sdk_credential_providers = require("@aws-sdk/credential-providers");
 let _aws_sdk_client_lambda = require("@aws-sdk/client-lambda");
 let crypto = require("crypto");
-crypto = __toESM(crypto);
-let node_crypto = require("node:crypto");
+crypto = __toESM(crypto, 1);
 let _aws_sdk_client_iam = require("@aws-sdk/client-iam");
 let _aws_sdk_client_sts = require("@aws-sdk/client-sts");
 let fs_promises = require("fs/promises");
-fs_promises = __toESM(fs_promises);
+fs_promises = __toESM(fs_promises, 1);
 let _aws_sdk_client_s3 = require("@aws-sdk/client-s3");
 let _aws_sdk_client_ssm = require("@aws-sdk/client-ssm");
 //#region ../../node_modules/.pnpm/is-plain-obj@4.1.0/node_modules/is-plain-obj/index.js
@@ -158,7 +158,8 @@ const parseTemplate = ({ templates, expressions, tokens, index, template }) => {
 	const newTokens = concatTokens(tokens, nextTokens, leadingWhitespaces);
 	if (index === expressions.length) return newTokens;
 	const expression = expressions[index];
-	return concatTokens(newTokens, Array.isArray(expression) ? expression.map((expression) => parseExpression(expression)) : [parseExpression(expression)], trailingWhitespaces);
+	const expressionTokens = Array.isArray(expression) ? expression.map((expression) => parseExpression(expression)) : [parseExpression(expression)];
+	return concatTokens(newTokens, expressionTokens, trailingWhitespaces);
 };
 const splitByWhitespaces = (template, rawTemplate) => {
 	if (rawTemplate.length === 0) return {
@@ -191,7 +192,7 @@ const splitByWhitespaces = (template, rawTemplate) => {
 		trailingWhitespaces
 	};
 };
-const DELIMITERS = new Set([
+const DELIMITERS = /* @__PURE__ */ new Set([
 	" ",
 	"	",
 	"\r",
@@ -243,7 +244,8 @@ const normalizeFdSpecificOptions = (options) => {
 };
 const normalizeFdSpecificOption = (options, optionName) => {
 	const optionBaseArray = Array.from({ length: getStdioLength(options) + 1 });
-	return addDefaultValue$1(normalizeFdSpecificValue(options[optionName], optionBaseArray, optionName), optionName);
+	const optionArray = normalizeFdSpecificValue(options[optionName], optionBaseArray, optionName);
+	return addDefaultValue$1(optionArray, optionName);
 };
 const getStdioLength = ({ stdio }) => Array.isArray(stdio) ? Math.max(stdio.length, STANDARD_STREAMS_ALIASES.length) : STANDARD_STREAMS_ALIASES.length;
 const normalizeFdSpecificValue = (optionValue, optionArray, optionName) => isPlainObject(optionValue) ? normalizeOptionObject(optionValue, optionArray, optionName) : optionArray.fill(optionValue);
@@ -276,7 +278,7 @@ const addDefaultValue$1 = (optionArray, optionName) => optionArray.map((optionVa
 const DEFAULT_OPTIONS = {
 	lines: false,
 	buffer: true,
-	maxBuffer: 1e3 * 1e3 * 100,
+	maxBuffer: 1e8,
 	verbose: (0, node_util.debuglog)("execa").enabled ? "full" : "none",
 	stripFinalNewline: true
 };
@@ -324,7 +326,7 @@ const escapeControlCharacter = (character) => {
 };
 const getSpecialCharRegExp = () => {
 	try {
-		return /* @__PURE__ */ new RegExp("\\p{Separator}|\\p{Other}", "gu");
+		return new RegExp("\\p{Separator}|\\p{Other}", "gu");
 	} catch {
 		return /[\s\u0000-\u001F\u007F-\u009F\u00AD]/g;
 	}
@@ -744,11 +746,13 @@ const appendNewline = (printedLine) => printedLine.endsWith("\n") ? printedLine
 //#endregion
 //#region ../../node_modules/.pnpm/execa@9.5.2/node_modules/execa/lib/verbose/log.js
 const verboseLog = ({ type, verboseMessage, fdNumber, verboseInfo, result }) => {
-	const finalLines = applyVerboseOnLines(getPrintedLines(verboseMessage, getVerboseObject({
+	const verboseObject = getVerboseObject({
 		type,
 		result,
 		verboseInfo
-	})), verboseInfo, fdNumber);
+	});
+	const printedLines = getPrintedLines(verboseMessage, verboseObject);
+	const finalLines = applyVerboseOnLines(printedLines, verboseInfo, fdNumber);
 	if (finalLines !== "") console.warn(finalLines.slice(0, -1));
 };
 const getVerboseObject = ({ type, result, verboseInfo: { escapedCommand, commandId, rawOptions: { piped = false, ...options } } }) => ({
@@ -771,7 +775,8 @@ const getPrintedLine = (verboseObject) => {
 	};
 };
 const serializeVerboseMessage = (message) => {
-	return escapeLines(typeof message === "string" ? message : (0, node_util.inspect)(message)).replaceAll("	", " ".repeat(TAB_SIZE));
+	const messageString = typeof message === "string" ? message : (0, node_util.inspect)(message);
+	return escapeLines(messageString).replaceAll("	", " ".repeat(TAB_SIZE));
 };
 const TAB_SIZE = 2;
 //#endregion
@@ -816,7 +821,8 @@ const getDurationMs = (startTime) => Number(node_process.hrtime.bigint() - start
 const handleCommand = (filePath, rawArguments, rawOptions) => {
 	const startTime = getStartTime();
 	const { command, escapedCommand } = joinCommand(filePath, rawArguments);
-	const verboseInfo = getVerboseInfo(normalizeFdSpecificOption(rawOptions, "verbose"), escapedCommand, { ...rawOptions });
+	const verbose = normalizeFdSpecificOption(rawOptions, "verbose");
+	const verboseInfo = getVerboseInfo(verbose, escapedCommand, { ...rawOptions });
 	logCommand(escapedCommand, verboseInfo);
 	return {
 		command,
@@ -937,7 +943,8 @@ var require_which = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const getNotFoundError = (cmd) => Object.assign(/* @__PURE__ */ new Error(`not found: ${cmd}`), { code: "ENOENT" });
 	const getPathInfo = (cmd, opt) => {
 		const colon = opt.colon || COLON;
-		const pathEnv = cmd.match(/\//) || isWindows && cmd.match(/\\/) ? [""] : [...isWindows ? [process.cwd()] : [], ...(opt.path || process.env.PATH || "").split(colon)];
+		const pathEnv = cmd.match(/\//) || isWindows && cmd.match(/\\/) ? [""] : [...isWindows ? [process.cwd()] : [], ...(opt.path || process.env.PATH || 
+		/* istanbul ignore next: very unusual */ "").split(colon)];
 		const pathExtExe = isWindows ? opt.pathExt || process.env.PATHEXT || ".EXE;.CMD;.BAT;.COM" : "";
 		const pathExt = isWindows ? pathExtExe.split(colon) : [""];
 		if (isWindows) {
@@ -962,14 +969,17 @@ var require_which = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			const ppRaw = pathEnv[i];
 			const pathPart = /^".*"$/.test(ppRaw) ? ppRaw.slice(1, -1) : ppRaw;
 			const pCmd = path$9.join(pathPart, cmd);
-			resolve(subStep(!pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd : pCmd, i, 0));
+			const p = !pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd : pCmd;
+			resolve(subStep(p, i, 0));
 		});
 		const subStep = (p, i, ii) => new Promise((resolve, reject) => {
 			if (ii === pathExt.length) return resolve(step(i + 1));
 			const ext = pathExt[ii];
 			isexe(p + ext, { pathExt: pathExtExe }, (er, is) => {
-				if (!er && is) if (opt.all) found.push(p + ext);
-				else return resolve(p + ext);
+				if (!er && is) {
+					if (opt.all) found.push(p + ext);
+					else return resolve(p + ext);
+				}
 				return resolve(subStep(p, i, ii + 1));
 			});
 		});
@@ -987,8 +997,10 @@ var require_which = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			for (let j = 0; j < pathExt.length; j++) {
 				const cur = p + pathExt[j];
 				try {
-					if (isexe.sync(cur, { pathExt: pathExtExe })) if (opt.all) found.push(cur);
-					else return cur;
+					if (isexe.sync(cur, { pathExt: pathExtExe })) {
+						if (opt.all) found.push(cur);
+						else return cur;
+					}
 				} catch (ex) {}
 			}
 		}
@@ -1679,7 +1691,7 @@ const normalizeForceKillAfterDelay = (forceKillAfterDelay) => {
 	if (!Number.isFinite(forceKillAfterDelay) || forceKillAfterDelay < 0) throw new TypeError(`Expected the \`forceKillAfterDelay\` option to be a non-negative integer, got \`${forceKillAfterDelay}\` (${typeof forceKillAfterDelay})`);
 	return forceKillAfterDelay;
 };
-const DEFAULT_FORCE_KILL_TIMEOUT = 1e3 * 5;
+const DEFAULT_FORCE_KILL_TIMEOUT = 5e3;
 const subprocessKill = ({ kill, options: { forceKillAfterDelay, killSignal }, onInternalError, context, controller }, signalOrError, errorArgument) => {
 	const { signal, error } = parseKillArguments(signalOrError, errorArgument, killSignal);
 	emitKillError(error, onInternalError);
@@ -1781,7 +1793,7 @@ const handleSerializationError = ({ error, methodName, isSubprocess, message })
 	if (isSerializationError(error)) throw new Error(`${getMethodName(methodName, isSubprocess)}'s argument type is invalid: the message cannot be serialized: ${String(message)}.`, { cause: error });
 };
 const isSerializationError = ({ code, message }) => SERIALIZATION_ERROR_CODES.has(code) || SERIALIZATION_ERROR_MESSAGES.some((serializationErrorMessage) => message.includes(serializationErrorMessage));
-const SERIALIZATION_ERROR_CODES = new Set(["ERR_MISSING_ARGS", "ERR_INVALID_ARG_TYPE"]);
+const SERIALIZATION_ERROR_CODES = /* @__PURE__ */ new Set(["ERR_MISSING_ARGS", "ERR_INVALID_ARG_TYPE"]);
 const SERIALIZATION_ERROR_MESSAGES = [
 	"could not be cloned",
 	"circular structure",
@@ -1991,7 +2003,8 @@ const isConnected = (anyProcess) => {
 //#region ../../node_modules/.pnpm/execa@9.5.2/node_modules/execa/lib/ipc/strict.js
 const handleSendStrict = ({ anyProcess, channel, isSubprocess, message, strict }) => {
 	if (!strict) return message;
-	const hasListeners = hasMessageListeners(anyProcess, getIpcEmitter(anyProcess, channel, isSubprocess));
+	const ipcEmitter = getIpcEmitter(anyProcess, channel, isSubprocess);
+	const hasListeners = hasMessageListeners(anyProcess, ipcEmitter);
 	return {
 		id: count++,
 		type: REQUEST_TYPE,
@@ -2223,7 +2236,8 @@ const throwOnGracefulCancel = ({ subprocess, cancelSignal, gracefulCancel, force
 })] : [];
 const sendOnAbort = async ({ subprocess, cancelSignal, forceKillAfterDelay, context, controller: { signal } }) => {
 	await onAbortedSignal(cancelSignal, signal);
-	await sendAbort(subprocess, getReason(cancelSignal));
+	const reason = getReason(cancelSignal);
+	await sendAbort(subprocess, reason);
 	killOnTimeout({
 		kill: subprocess.kill,
 		forceKillAfterDelay,
@@ -2335,8 +2349,8 @@ Please rename it to ${serializeEncoding(correctEncoding)}.`);
 	throw new TypeError(`Invalid option \`encoding: ${serializeEncoding(encoding)}\`.
 Please rename it to one of: ${correctEncodings}.`);
 };
-const TEXT_ENCODINGS = new Set(["utf8", "utf16le"]);
-const BINARY_ENCODINGS = new Set([
+const TEXT_ENCODINGS = /* @__PURE__ */ new Set(["utf8", "utf16le"]);
+const BINARY_ENCODINGS = /* @__PURE__ */ new Set([
 	"buffer",
 	"hex",
 	"base64",
@@ -2344,7 +2358,7 @@ const BINARY_ENCODINGS = new Set([
 	"latin1",
 	"ascii"
 ]);
-const ENCODINGS = new Set([...TEXT_ENCODINGS, ...BINARY_ENCODINGS]);
+const ENCODINGS = /* @__PURE__ */ new Set([...TEXT_ENCODINGS, ...BINARY_ENCODINGS]);
 const getCorrectEncoding = (encoding) => {
 	if (encoding === null) return "buffer";
 	if (typeof encoding !== "string") return;
@@ -2391,7 +2405,8 @@ const normalizeOptions = (filePath, rawArguments, rawOptions) => {
 	rawOptions.cwd = normalizeCwd(rawOptions.cwd);
 	const [processedFile, processedArguments, processedOptions] = handleNodeOption(filePath, rawArguments, rawOptions);
 	const { command: file, args: commandArguments, options: initialOptions } = import_cross_spawn.default._parse(processedFile, processedArguments, processedOptions);
-	const options = addDefaultOptions(normalizeFdSpecificOptions(initialOptions));
+	const fdOptions = normalizeFdSpecificOptions(initialOptions);
+	const options = addDefaultOptions(fdOptions);
 	validateTimeout(options);
 	validateEncoding(options);
 	validateIpcInputOption(options);
@@ -2592,14 +2607,17 @@ const getStreamContents$1 = async (stream, { init, convertChunk, getSize, trunca
 	const state = init();
 	state.length = 0;
 	try {
-		for await (const chunk of asyncIterable) appendChunk({
-			convertedChunk: convertChunk[getChunkType(chunk)](chunk, state),
-			state,
-			getSize,
-			truncateChunk,
-			addChunk,
-			maxBuffer
-		});
+		for await (const chunk of asyncIterable) {
+			const convertedChunk = convertChunk[getChunkType(chunk)](chunk, state);
+			appendChunk({
+				convertedChunk,
+				state,
+				getSize,
+				truncateChunk,
+				addChunk,
+				maxBuffer
+			});
+		}
 		appendFinalChunk({
 			state,
 			convertChunk,
@@ -2885,7 +2903,8 @@ const getErrorPrefix = ({ originalError, timedOut, timeout, isMaxBuffer, maxBuff
 const getForcefulSuffix = (isForcefullyTerminated, forceKillAfterDelay) => isForcefullyTerminated ? ` and was forcefully terminated after ${forceKillAfterDelay} milliseconds` : "";
 const getOriginalMessage = (originalError, cwd) => {
 	if (originalError instanceof DiscardedError) return;
-	const escapedOriginalMessage = escapeLines(fixCwdError(isExecaError(originalError) ? originalError.originalMessage : String(originalError?.message ?? originalError), cwd));
+	const originalMessage = isExecaError(originalError) ? originalError.originalMessage : String(originalError?.message ?? originalError);
+	const escapedOriginalMessage = escapeLines(fixCwdError(originalMessage, cwd));
 	return escapedOriginalMessage === "" ? void 0 : escapedOriginalMessage;
 };
 const serializeIpcMessage = (ipcMessage) => typeof ipcMessage === "string" ? ipcMessage : (0, node_util.inspect)(ipcMessage);
@@ -3096,26 +3115,28 @@ function prettyMilliseconds(milliseconds, options) {
 		add(Number(parsed.hours), "hour", "h");
 	}
 	add(Number(parsed.minutes), "minute", "m");
-	if (!options.hideSeconds) if (options.separateMilliseconds || options.formatSubMilliseconds || !options.colonNotation && milliseconds < 1e3 && !options.subSecondsAsDecimals) {
-		const seconds = Number(parsed.seconds);
-		const milliseconds = Number(parsed.milliseconds);
-		const microseconds = Number(parsed.microseconds);
-		const nanoseconds = Number(parsed.nanoseconds);
-		add(seconds, "second", "s");
-		if (options.formatSubMilliseconds) {
-			add(milliseconds, "millisecond", "ms");
-			add(microseconds, "microsecond", "µs");
-			add(nanoseconds, "nanosecond", "ns");
+	if (!options.hideSeconds) {
+		if (options.separateMilliseconds || options.formatSubMilliseconds || !options.colonNotation && milliseconds < 1e3 && !options.subSecondsAsDecimals) {
+			const seconds = Number(parsed.seconds);
+			const milliseconds = Number(parsed.milliseconds);
+			const microseconds = Number(parsed.microseconds);
+			const nanoseconds = Number(parsed.nanoseconds);
+			add(seconds, "second", "s");
+			if (options.formatSubMilliseconds) {
+				add(milliseconds, "millisecond", "ms");
+				add(microseconds, "microsecond", "µs");
+				add(nanoseconds, "nanosecond", "ns");
+			} else {
+				const millisecondsAndBelow = milliseconds + microseconds / 1e3 + nanoseconds / 1e6;
+				const millisecondsDecimalDigits = typeof options.millisecondsDecimalDigits === "number" ? options.millisecondsDecimalDigits : 0;
+				const millisecondsString = millisecondsDecimalDigits ? millisecondsAndBelow.toFixed(millisecondsDecimalDigits) : millisecondsAndBelow >= 1 ? Math.round(millisecondsAndBelow) : Math.ceil(millisecondsAndBelow);
+				add(Number.parseFloat(millisecondsString), "millisecond", "ms", millisecondsString);
+			}
 		} else {
-			const millisecondsAndBelow = milliseconds + microseconds / 1e3 + nanoseconds / 1e6;
-			const millisecondsDecimalDigits = typeof options.millisecondsDecimalDigits === "number" ? options.millisecondsDecimalDigits : 0;
-			const millisecondsString = millisecondsDecimalDigits ? millisecondsAndBelow.toFixed(millisecondsDecimalDigits) : millisecondsAndBelow >= 1 ? Math.round(millisecondsAndBelow) : Math.ceil(millisecondsAndBelow);
-			add(Number.parseFloat(millisecondsString), "millisecond", "ms", millisecondsString);
+			const secondsFixed = floorDecimals((isBigInt ? Number(milliseconds % ONE_DAY_IN_MILLISECONDS) : milliseconds) / 1e3 % 60, typeof options.secondsDecimalDigits === "number" ? options.secondsDecimalDigits : 1);
+			const secondsString = options.keepDecimalsOnWholeSeconds ? secondsFixed : secondsFixed.replace(/\.0+$/, "");
+			add(Number.parseFloat(secondsString), "second", "s", secondsString);
 		}
-	} else {
-		const secondsFixed = floorDecimals((isBigInt ? Number(milliseconds % ONE_DAY_IN_MILLISECONDS) : milliseconds) / 1e3 % 60, typeof options.secondsDecimalDigits === "number" ? options.secondsDecimalDigits : 1);
-		const secondsString = options.keepDecimalsOnWholeSeconds ? secondsFixed : secondsFixed.replace(/\.0+$/, "");
-		add(Number.parseFloat(secondsString), "second", "s", secondsString);
 	}
 	if (result.length === 0) return sign + "0" + (options.verbose ? " milliseconds" : "ms");
 	const separator = options.colonNotation ? ":" : " ";
@@ -3140,9 +3161,10 @@ const logResult = (result, verboseInfo) => {
 	logDuration(result, verboseInfo);
 };
 const logDuration = (result, verboseInfo) => {
+	const verboseMessage = `(done in ${prettyMilliseconds(result.durationMs)})`;
 	verboseLog({
 		type: "duration",
-		verboseMessage: `(done in ${prettyMilliseconds(result.durationMs)})`,
+		verboseMessage,
 		verboseInfo,
 		result
 	});
@@ -3210,10 +3232,10 @@ const isTransformOptions = (value) => isPlainObject(value) && (value.transform !
 const isUrl = (value) => Object.prototype.toString.call(value) === "[object URL]";
 const isRegularUrl = (value) => isUrl(value) && value.protocol !== "file:";
 const isFilePathObject = (value) => isPlainObject(value) && Object.keys(value).length > 0 && Object.keys(value).every((key) => FILE_PATH_KEYS.has(key)) && isFilePathString(value.file);
-const FILE_PATH_KEYS = new Set(["file", "append"]);
+const FILE_PATH_KEYS = /* @__PURE__ */ new Set(["file", "append"]);
 const isFilePathString = (file) => typeof file === "string";
 const isUnknownStdioString = (type, value) => type === "native" && typeof value === "string" && !KNOWN_STDIO_STRINGS.has(value);
-const KNOWN_STDIO_STRINGS = new Set([
+const KNOWN_STDIO_STRINGS = /* @__PURE__ */ new Set([
 	"ipc",
 	"ignore",
 	"inherit",
@@ -3227,24 +3249,24 @@ const isTransformStream = (value) => isReadableStream(value?.readable) && isWrit
 const isAsyncIterableObject = (value) => isObject(value) && typeof value[Symbol.asyncIterator] === "function";
 const isIterableObject = (value) => isObject(value) && typeof value[Symbol.iterator] === "function";
 const isObject = (value) => typeof value === "object" && value !== null;
-const TRANSFORM_TYPES = new Set([
+const TRANSFORM_TYPES = /* @__PURE__ */ new Set([
 	"generator",
 	"asyncGenerator",
 	"duplex",
 	"webTransform"
 ]);
-const FILE_TYPES = new Set([
+const FILE_TYPES = /* @__PURE__ */ new Set([
 	"fileUrl",
 	"filePath",
 	"fileNumber"
 ]);
-const SPECIAL_DUPLICATE_TYPES_SYNC = new Set(["fileUrl", "filePath"]);
-const SPECIAL_DUPLICATE_TYPES = new Set([
+const SPECIAL_DUPLICATE_TYPES_SYNC = /* @__PURE__ */ new Set(["fileUrl", "filePath"]);
+const SPECIAL_DUPLICATE_TYPES = /* @__PURE__ */ new Set([
 	...SPECIAL_DUPLICATE_TYPES_SYNC,
 	"webStream",
 	"nodeStream"
 ]);
-const FORBID_DUPLICATE_TYPES = new Set(["webTransform", "duplex"]);
+const FORBID_DUPLICATE_TYPES = /* @__PURE__ */ new Set(["webTransform", "duplex"]);
 const TYPE_TO_MESSAGE = {
 	generator: "a generator",
 	asyncGenerator: "an async generator",
@@ -3577,7 +3599,8 @@ const validateDuplicateStreamSync = ({ otherStdioItems, type, value, optionName,
 const getDuplicateStreamInstance = ({ otherStdioItems, type, value, optionName, direction }) => {
 	const duplicateStdioItems = otherStdioItems.filter((stdioItem) => hasSameValue(stdioItem, value));
 	if (duplicateStdioItems.length === 0) return;
-	throwOnDuplicateStream(duplicateStdioItems.find((stdioItem) => stdioItem.direction !== direction), optionName, type);
+	const differentStdioItem = duplicateStdioItems.find((stdioItem) => stdioItem.direction !== direction);
+	throwOnDuplicateStream(differentStdioItem, optionName, type);
 	return direction === "output" ? duplicateStdioItems[0].stream : void 0;
 };
 const hasSameValue = ({ type, value }, secondValue) => {
@@ -3586,7 +3609,8 @@ const hasSameValue = ({ type, value }, secondValue) => {
 	return value === secondValue;
 };
 const validateDuplicateTransform = ({ otherStdioItems, type, value, optionName }) => {
-	throwOnDuplicateStream(otherStdioItems.find(({ value: { transform } }) => transform === value.transform), optionName, type);
+	const duplicateStdioItem = otherStdioItems.find(({ value: { transform } }) => transform === value.transform);
+	throwOnDuplicateStream(duplicateStdioItem, optionName, type);
 };
 const throwOnDuplicateStream = (stdioItem, optionName, type) => {
 	if (stdioItem !== void 0) throw new TypeError(`The \`${stdioItem.optionName}\` and \`${optionName}\` options must not target ${TYPE_TO_MESSAGE[type]} that is the same.`);
@@ -3594,13 +3618,14 @@ const throwOnDuplicateStream = (stdioItem, optionName, type) => {
 //#endregion
 //#region ../../node_modules/.pnpm/execa@9.5.2/node_modules/execa/lib/stdio/handle.js
 const handleStdio = (addProperties, options, verboseInfo, isSync) => {
+	const initialFileDescriptors = normalizeStdioOption(options, verboseInfo, isSync).map((stdioOption, fdNumber) => getFileDescriptor({
+		stdioOption,
+		fdNumber,
+		options,
+		isSync
+	}));
 	const fileDescriptors = getFinalFileDescriptors({
-		initialFileDescriptors: normalizeStdioOption(options, verboseInfo, isSync).map((stdioOption, fdNumber) => getFileDescriptor({
-			stdioOption,
-			fdNumber,
-			options,
-			isSync
-		})),
+		initialFileDescriptors,
 		addProperties,
 		options,
 		isSync
@@ -3617,13 +3642,14 @@ const getFileDescriptor = ({ stdioOption, fdNumber, options, isSync }) => {
 		optionName
 	});
 	const direction = getStreamDirection(initialStdioItems, fdNumber, optionName);
-	const normalizedStdioItems = normalizeTransforms(initialStdioItems.map((stdioItem) => handleNativeStream({
+	const stdioItems = initialStdioItems.map((stdioItem) => handleNativeStream({
 		stdioItem,
 		isStdioArray,
 		fdNumber,
 		direction,
 		isSync
-	})), optionName, direction, options);
+	}));
+	const normalizedStdioItems = normalizeTransforms(stdioItems, optionName, direction, options);
 	const objectMode = getFdObjectMode(normalizedStdioItems, direction);
 	validateFileObjectMode(normalizedStdioItems, objectMode);
 	return {
@@ -3633,7 +3659,8 @@ const getFileDescriptor = ({ stdioOption, fdNumber, options, isSync }) => {
 	};
 };
 const initializeStdioItems = ({ stdioOption, fdNumber, options, optionName }) => {
-	const stdioItems = filterDuplicates([...(Array.isArray(stdioOption) ? stdioOption : [stdioOption]).map((value) => initializeStdioItem(value, optionName)), ...handleInputOptions(options, fdNumber)]);
+	const initialStdioItems = [...(Array.isArray(stdioOption) ? stdioOption : [stdioOption]).map((value) => initializeStdioItem(value, optionName)), ...handleInputOptions(options, fdNumber)];
+	const stdioItems = filterDuplicates(initialStdioItems);
 	const isStdioArray = stdioItems.length > 1;
 	validateStdioArray(stdioItems, isStdioArray, optionName);
 	validateStreams(stdioItems);
@@ -3652,7 +3679,7 @@ const validateStdioArray = (stdioItems, isStdioArray, optionName) => {
 	if (!isStdioArray) return;
 	for (const { value, optionName } of stdioItems) if (INVALID_STDIO_ARRAY_OPTIONS.has(value)) throw new Error(`The \`${optionName}\` option must not include \`${value}\`.`);
 };
-const INVALID_STDIO_ARRAY_OPTIONS = new Set(["ignore", "ipc"]);
+const INVALID_STDIO_ARRAY_OPTIONS = /* @__PURE__ */ new Set(["ignore", "ipc"]);
 const validateStreams = (stdioItems) => {
 	for (const stdioItem of stdioItems) validateFileStdio(stdioItem);
 };
@@ -3981,7 +4008,10 @@ const generatorToStream = ({ value, value: { transform, final, writableObjectMod
 const runGeneratorsSync = (chunks, stdioItems, encoding, isInput) => {
 	const generators = stdioItems.filter(({ type }) => type === "generator");
 	const reversedGenerators = isInput ? generators.reverse() : generators;
-	for (const { value, optionName } of reversedGenerators) chunks = runTransformSync(addInternalGenerators(value, encoding, optionName), chunks);
+	for (const { value, optionName } of reversedGenerators) {
+		const generators = addInternalGenerators(value, encoding, optionName);
+		chunks = runTransformSync(generators, chunks);
+	}
 	return chunks;
 };
 const addInternalGenerators = ({ transform, final, binary, writableObjectMode, readableObjectMode, preserveNewlines }, encoding, optionName) => {
@@ -4017,7 +4047,8 @@ const addInputOptionSync = (fileDescriptors, fdNumber, options) => {
 		const [{ type, optionName }] = allStdioItems;
 		throw new TypeError(`Only the \`stdin\` option, not \`${optionName}\`, can be ${TYPE_TO_MESSAGE[type]} with synchronous methods.`);
 	}
-	options.input = joinToUint8Array(allStdioItems.map(({ contents }) => contents).map((contents) => applySingleInputGeneratorsSync(contents, stdioItems)));
+	const transformedContents = allStdioItems.map(({ contents }) => contents).map((contents) => applySingleInputGeneratorsSync(contents, stdioItems));
+	options.input = joinToUint8Array(transformedContents);
 };
 const applySingleInputGeneratorsSync = (contents, stdioItems) => {
 	const newContents = runGeneratorsSync(contents, stdioItems, "utf8", true);
@@ -4032,7 +4063,7 @@ const validateSerializable = (newContents) => {
 //#region ../../node_modules/.pnpm/execa@9.5.2/node_modules/execa/lib/verbose/output.js
 const shouldLogOutput = ({ stdioItems, encoding, verboseInfo, fdNumber }) => fdNumber !== "all" && isFullVerbose(verboseInfo, fdNumber) && !BINARY_ENCODINGS.has(encoding) && fdUsesVerbose(fdNumber) && (stdioItems.some(({ type, value }) => type === "native" && PIPED_STDIO_VALUES.has(value)) || stdioItems.every(({ type }) => TRANSFORM_TYPES.has(type)));
 const fdUsesVerbose = (fdNumber) => fdNumber === 1 || fdNumber === 2;
-const PIPED_STDIO_VALUES = new Set(["pipe", "overlapped"]);
+const PIPED_STDIO_VALUES = /* @__PURE__ */ new Set(["pipe", "overlapped"]);
 const logLines = async (linesIterable, stream, fdNumber, verboseInfo) => {
 	for await (const line of linesIterable) if (!isPipingStream(stream)) logLine(line, fdNumber, verboseInfo);
 };
@@ -4041,9 +4072,10 @@ const logLinesSync = (linesArray, fdNumber, verboseInfo) => {
 };
 const isPipingStream = (stream) => stream._readableState.pipes.length > 0;
 const logLine = (line, fdNumber, verboseInfo) => {
+	const verboseMessage = serializeVerboseMessage(line);
 	verboseLog({
 		type: "output",
-		verboseMessage: serializeVerboseMessage(line),
+		verboseMessage,
 		fdNumber,
 		verboseInfo
 	});
@@ -4069,10 +4101,12 @@ const transformOutputSync = ({ fileDescriptors, syncResult: { output }, options,
 };
 const transformOutputResultSync = ({ result, fileDescriptors, fdNumber, state, outputFiles, isMaxBuffer, verboseInfo }, { buffer, encoding, lines, stripFinalNewline, maxBuffer }) => {
 	if (result === null) return;
-	const uint8ArrayResult = bufferToUint8Array(truncateMaxBufferSync(result, isMaxBuffer, maxBuffer));
+	const truncatedResult = truncateMaxBufferSync(result, isMaxBuffer, maxBuffer);
+	const uint8ArrayResult = bufferToUint8Array(truncatedResult);
 	const { stdioItems, objectMode } = fileDescriptors[fdNumber];
+	const chunks = runOutputGeneratorsSync([uint8ArrayResult], stdioItems, encoding, state);
 	const { serializedResult, finalResult = serializedResult } = serializeChunks({
-		chunks: runOutputGeneratorsSync([uint8ArrayResult], stdioItems, encoding, state),
+		chunks,
 		objectMode,
 		encoding,
 		lines,
@@ -4196,7 +4230,7 @@ const getResultError = (error, exitCode, signal) => {
 //#region ../../node_modules/.pnpm/execa@9.5.2/node_modules/execa/lib/methods/main-sync.js
 const execaCoreSync = (rawFile, rawArguments, rawOptions) => {
 	const { file, commandArguments, command, escapedCommand, startTime, verboseInfo, options, fileDescriptors } = handleSyncArguments(rawFile, rawArguments, rawOptions);
-	return handleResult(spawnSubprocessSync({
+	const result = spawnSubprocessSync({
 		file,
 		commandArguments,
 		options,
@@ -4205,11 +4239,13 @@ const execaCoreSync = (rawFile, rawArguments, rawOptions) => {
 		verboseInfo,
 		fileDescriptors,
 		startTime
-	}), verboseInfo, options);
+	});
+	return handleResult(result, verboseInfo, options);
 };
 const handleSyncArguments = (rawFile, rawArguments, rawOptions) => {
 	const { command, escapedCommand, startTime, verboseInfo } = handleCommand(rawFile, rawArguments, rawOptions);
-	const { file, commandArguments, options } = normalizeOptions(rawFile, rawArguments, normalizeSyncOptions(rawOptions));
+	const syncOptions = normalizeSyncOptions(rawOptions);
+	const { file, commandArguments, options } = normalizeOptions(rawFile, rawArguments, syncOptions);
 	validateSyncOptions(options);
 	return {
 		file,
@@ -4254,14 +4290,16 @@ const spawnSubprocessSync = ({ file, commandArguments, options, command, escaped
 		isMaxBuffer,
 		verboseInfo
 	});
+	const stdio = output.map((stdioOutput, fdNumber) => stripNewline(stdioOutput, options, fdNumber));
+	const all = stripNewline(getAllSync(output, options), options, "all");
 	return getSyncResult({
 		error,
 		exitCode,
 		signal,
 		timedOut,
 		isMaxBuffer,
-		stdio: output.map((stdioOutput, fdNumber) => stripNewline(stdioOutput, options, fdNumber)),
-		all: stripNewline(getAllSync(output, options), options, "all"),
+		stdio,
+		all,
 		options,
 		command,
 		escapedCommand,
@@ -4271,7 +4309,8 @@ const spawnSubprocessSync = ({ file, commandArguments, options, command, escaped
 const runSubprocessSync = ({ file, commandArguments, options, command, escapedCommand, fileDescriptors, startTime }) => {
 	try {
 		addInputOptionsSync(fileDescriptors, options);
-		return (0, node_child_process.spawnSync)(file, commandArguments, normalizeSpawnSyncOptions(options));
+		const normalizedOptions = normalizeSpawnSyncOptions(options);
+		return (0, node_child_process.spawnSync)(file, commandArguments, normalizedOptions);
 	} catch (error) {
 		return makeEarlyError({
 			error,
@@ -4485,17 +4524,18 @@ const handleEarlyError = ({ error, command, escapedCommand, fileDescriptors, opt
 		writable,
 		duplex
 	});
+	const earlyError = makeEarlyError({
+		error,
+		command,
+		escapedCommand,
+		fileDescriptors,
+		options,
+		startTime,
+		isSync: false
+	});
 	return {
 		subprocess,
-		promise: handleDummyPromise(makeEarlyError({
-			error,
-			command,
-			escapedCommand,
-			fileDescriptors,
-			options,
-			startTime,
-			isSync: false
-		}), verboseInfo, options)
+		promise: handleDummyPromise(earlyError, verboseInfo, options)
 	};
 };
 const createDummyStreams = (subprocess, fileDescriptors) => {
@@ -4679,8 +4719,10 @@ const endWhenStreamsDone = async ({ passThroughStream, stream, streams, ended, a
 		controller.abort();
 		updateMaxListeners(passThroughStream, -PASSTHROUGH_LISTENERS_PER_STREAM);
 	}
-	if (streams.size > 0 && streams.size === ended.size + aborted.size) if (ended.size === 0 && aborted.size > 0) abortStream(passThroughStream);
-	else endStream(passThroughStream);
+	if (streams.size > 0 && streams.size === ended.size + aborted.size) {
+		if (ended.size === 0 && aborted.size > 0) abortStream(passThroughStream);
+		else endStream(passThroughStream);
+	}
 };
 const afterMergedStreamFinished = async (onFinished, stream, { signal }) => {
 	try {
@@ -4786,7 +4828,10 @@ const pipeOutputAsync = (subprocess, fileDescriptors, controller) => {
 			controller
 		});
 	}
-	for (const [outputStream, inputStreams] of pipeGroups.entries()) pipeStreams(inputStreams.length === 1 ? inputStreams[0] : mergeStreams(inputStreams), outputStream);
+	for (const [outputStream, inputStreams] of pipeGroups.entries()) {
+		const inputStream = inputStreams.length === 1 ? inputStreams[0] : mergeStreams(inputStreams);
+		pipeStreams(inputStream, outputStream);
+	}
 };
 const pipeTransform = (subprocess, stream, direction, fdNumber) => {
 	if (direction === "output") pipeStreams(subprocess.stdio[fdNumber], stream);
@@ -5275,12 +5320,13 @@ const stopReadingOnStreamEnd = async (onStreamEnd, controller, stream) => {
 	}
 };
 const iterateOnStream = ({ stream, controller, binary, shouldEncode, encoding, shouldSplit, preserveNewlines }) => {
+	const onStdoutChunk = (0, node_events.on)(stream, "data", {
+		signal: controller.signal,
+		highWaterMark: HIGH_WATER_MARK,
+		highWatermark: HIGH_WATER_MARK
+	});
 	return iterateOnData({
-		onStdoutChunk: (0, node_events.on)(stream, "data", {
-			signal: controller.signal,
-			highWaterMark: HIGH_WATER_MARK,
-			highWatermark: HIGH_WATER_MARK
-		}),
+		onStdoutChunk,
 		controller,
 		binary,
 		shouldEncode,
@@ -5324,12 +5370,13 @@ const getStreamOutput = async ({ stream, onStreamEnd, fdNumber, encoding, buffer
 		await Promise.all([resumeStream(stream), logPromise]);
 		return;
 	}
+	const stripFinalNewlineValue = getStripFinalNewline(stripFinalNewline, fdNumber);
 	const iterable = iterateForResult({
 		stream,
 		onStreamEnd,
 		lines,
 		encoding,
-		stripFinalNewline: getStripFinalNewline(stripFinalNewline, fdNumber),
+		stripFinalNewline: stripFinalNewlineValue,
 		allMixed
 	});
 	const [output] = await Promise.all([getStreamContents({
@@ -5349,14 +5396,15 @@ const logOutputAsync = async ({ stream, onStreamEnd, fdNumber, encoding, allMixe
 		verboseInfo,
 		fdNumber
 	})) return;
-	await logLines(iterateForResult({
+	const linesIterable = iterateForResult({
 		stream,
 		onStreamEnd,
 		lines: true,
 		encoding,
 		stripFinalNewline: true,
 		allMixed
-	}), stream, fdNumber, verboseInfo);
+	});
+	await logLines(linesIterable, stream, fdNumber, verboseInfo);
 };
 const resumeStream = async (stream) => {
 	await (0, node_timers_promises.setImmediate)();
@@ -5502,9 +5550,10 @@ const getAllMixed = ({ all, stdout, stderr }) => all && stdout && stderr && stdo
 //#region ../../node_modules/.pnpm/execa@9.5.2/node_modules/execa/lib/verbose/ipc.js
 const shouldLogIpc = (verboseInfo) => isFullVerbose(verboseInfo, "ipc");
 const logIpcOutput = (message, verboseInfo) => {
+	const verboseMessage = serializeVerboseMessage(message);
 	verboseLog({
 		type: "ipc",
-		verboseMessage: serializeVerboseMessage(message),
+		verboseMessage,
 		fdNumber: "ipc",
 		verboseInfo
 	});
@@ -5900,14 +5949,15 @@ const onDuplexDestroy = async ({ subprocessStdout, subprocessStdin, subprocess,
 const createIterable = (subprocess, encoding, { from, binary: binaryOption = false, preserveNewlines = false } = {}) => {
 	const binary = binaryOption || BINARY_ENCODINGS.has(encoding);
 	const subprocessStdout = getFromStream(subprocess, from);
-	return iterateOnStdoutData(iterateOnSubprocessStream({
+	const onStdoutData = iterateOnSubprocessStream({
 		subprocessStdout,
 		subprocess,
 		binary,
 		shouldEncode: true,
 		encoding,
 		preserveNewlines
-	}), subprocessStdout, subprocess);
+	});
+	return iterateOnStdoutData(onStdoutData, subprocessStdout, subprocess);
 };
 const iterateOnStdoutData = async function* (onStdoutData, subprocessStdout, subprocess) {
 	try {
@@ -6067,19 +6117,22 @@ const handlePromise = async ({ subprocess, options, startTime, verboseInfo, file
 	});
 	controller.abort();
 	onInternalError.resolve();
-	return handleResult(getAsyncResult({
+	const stdio = stdioResults.map((stdioResult, fdNumber) => stripNewline(stdioResult, options, fdNumber));
+	const all = stripNewline(allResult, options, "all");
+	const result = getAsyncResult({
 		errorInfo,
 		exitCode,
 		signal,
-		stdio: stdioResults.map((stdioResult, fdNumber) => stripNewline(stdioResult, options, fdNumber)),
-		all: stripNewline(allResult, options, "all"),
+		stdio,
+		all,
 		ipcOutput,
 		context,
 		options,
 		command,
 		escapedCommand,
 		startTime
-	}), verboseInfo, options);
+	});
+	return handleResult(result, verboseInfo, options);
 };
 const getAsyncResult = ({ errorInfo, exitCode, signal, stdio, all, ipcOutput, context, options, command, escapedCommand, startTime }) => "error" in errorInfo ? makeError({
 	error: errorInfo.error,
@@ -6123,7 +6176,7 @@ const mergeOption = (optionName, boundOptionValue, optionValue) => {
 	};
 	return optionValue;
 };
-const DEEP_OPTIONS = new Set(["env", ...FD_SPECIFIC_OPTIONS]);
+const DEEP_OPTIONS = /* @__PURE__ */ new Set(["env", ...FD_SPECIFIC_OPTIONS]);
 //#endregion
 //#region ../../node_modules/.pnpm/execa@9.5.2/node_modules/execa/lib/methods/create.js
 const createExeca = (mapArguments, boundOptions, deepOptions, setBoundExeca) => {
@@ -6150,7 +6203,8 @@ const callBoundExeca = ({ mapArguments, deepOptions = {}, boundOptions = {}, set
 	return isSync ? execaCoreSync(file, commandArguments, options) : execaCoreAsync(file, commandArguments, options, createNested);
 };
 const parseArguments = ({ mapArguments, firstArgument, nextArguments, deepOptions, boundOptions }) => {
-	const [initialFile, initialArguments, initialOptions] = normalizeParameters(...isTemplateString(firstArgument) ? parseTemplates(firstArgument, nextArguments) : [firstArgument, ...nextArguments]);
+	const callArguments = isTemplateString(firstArgument) ? parseTemplates(firstArgument, nextArguments) : [firstArgument, ...nextArguments];
+	const [initialFile, initialArguments, initialOptions] = normalizeParameters(...callArguments);
 	const mergedOptions = mergeOptions(mergeOptions(deepOptions, boundOptions), initialOptions);
 	const { file = initialFile, commandArguments = initialArguments, options = mergedOptions, isSync = false } = mapArguments({
 		file: initialFile,
@@ -6221,7 +6275,7 @@ const { sendMessage, getOneMessage, getEachMessage, getCancelSignal } = getIpcEx
 //#endregion
 //#region src/cloudFrontInvalidation.ts
 const DEFAULT_POLL_INTERVAL_MS = 2e3;
-const DEFAULT_TIMEOUT_MS = 300 * 1e3;
+const DEFAULT_TIMEOUT_MS = 3e5;
 const sleep = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds));
 const invalidateCloudFront = async (client, distributionId, paths, options) => {
 	if (paths.length === 0) return;
@@ -6250,9 +6304,10 @@ const invalidateCloudFront = async (client, distributionId, paths, options) => {
 };
 //#endregion
 //#region src/dynamoDB.ts
-const DYNAMODB_MAX_METADATA_ITEM_BYTES = 8 * 1024;
-const DYNAMODB_MAX_CATALOG_ITEM_BYTES = 400 * 1024;
+const DYNAMODB_MAX_METADATA_ITEM_BYTES = 8192;
+const DYNAMODB_MAX_CATALOG_ITEM_BYTES = 409600;
 var DynamoDBMetadataItemSizeError = class extends Error {
+	byteLength;
 	name = "DynamoDBMetadataItemSizeError";
 	constructor(byteLength) {
 		super(`DynamoDB metadata item is ${byteLength} bytes; maximum is ${DYNAMODB_MAX_METADATA_ITEM_BYTES}`);
@@ -6265,6 +6320,7 @@ const boundedDynamoDBMetadataItem = (item) => {
 	return item;
 };
 var DynamoDBCatalogItemSizeError = class extends Error {
+	byteLength;
 	name = "DynamoDBCatalogItemSizeError";
 	constructor(byteLength) {
 		super(`DynamoDB catalog item is ${byteLength} bytes; maximum is ${DYNAMODB_MAX_CATALOG_ITEM_BYTES}`);
@@ -6325,7 +6381,6 @@ const parseDynamoDBItem = (value) => {
 		version,
 		row
 	};
-	if (typeof gsi1pk !== "string" || typeof gsi1sk !== "string") throw new DynamoDBStoredItemError();
 	if (pk === "bundles" && isBundleRow(row)) {
 		if (typeof relationCount !== "number" || typeof ownedPatchCount !== "number") throw new DynamoDBStoredItemError();
 		return {
@@ -6334,12 +6389,10 @@ const parseDynamoDBItem = (value) => {
 			version,
 			relation_count: relationCount,
 			owned_patch_count: ownedPatchCount,
-			gsi1pk,
-			gsi1sk,
 			row
 		};
 	}
-	if (pk === "bundle_patches" && isPatchRow(row)) return {
+	if (pk === "bundle_patches" && typeof gsi1pk === "string" && typeof gsi1sk === "string" && isPatchRow(row)) return {
 		pk,
 		sk,
 		version,
@@ -6349,7 +6402,6 @@ const parseDynamoDBItem = (value) => {
 	};
 	throw new DynamoDBStoredItemError();
 };
-const bundlePlatformPartition = (row) => `bundle#${row.platform}`;
 const patchOwnerPartition = (bundleId) => `patch-owner#${bundleId}`;
 const patchOrderKey = (row) => `${row.order_index.toString().padStart(10, "0")}#${row.id}`;
 const toDynamoDBBundleItem = (row, version = 1, relationCount = 0, ownedPatchCount = 0) => ({
@@ -6358,8 +6410,6 @@ const toDynamoDBBundleItem = (row, version = 1, relationCount = 0, ownedPatchCou
 	version,
 	relation_count: relationCount,
 	owned_patch_count: ownedPatchCount,
-	gsi1pk: bundlePlatformPartition(row),
-	gsi1sk: row.id,
 	row
 });
 const toDynamoDBPatchItem = (row, version = 1) => {
@@ -6716,6 +6766,7 @@ const queryOwnerPatchIds = async (store, indexName, bundleId) => {
 	})).filter((item) => item.pk === "bundle_patches").map(({ sk }) => sk);
 };
 var DynamoDBTransactionLimitError = class extends Error {
+	actionCount;
 	name = "DynamoDBTransactionLimitError";
 	constructor(actionCount) {
 		super(`DynamoDB transaction requires ${actionCount} actions; maximum is 100`);
@@ -6796,6 +6847,7 @@ const commitDynamoDBTransaction = async (store, actions) => {
 const DYNAMODB_BATCH_GET_ATTEMPTS = 5;
 const DYNAMODB_BATCH_GET_BASE_DELAY_MS = 25;
 var DynamoDBBatchGetExhaustedError = class extends Error {
+	unprocessedKeyCount;
 	name = "DynamoDBBatchGetExhaustedError";
 	constructor(unprocessedKeyCount) {
 		super(`DynamoDB did not process ${unprocessedKeyCount} batch-get keys after ${DYNAMODB_BATCH_GET_ATTEMPTS} attempts`);
@@ -6848,6 +6900,8 @@ const loadMetadataCount = async (store, model) => {
 	return typeof count === "number" && Number.isSafeInteger(count) && count >= 0 ? count : void 0;
 };
 var DynamoDBPatchIndexConsistencyError = class extends Error {
+	bundleId;
+	expectedCount;
 	name = "DynamoDBPatchIndexConsistencyError";
 	constructor(bundleId, expectedCount) {
 		super(`DynamoDB patch index did not converge to ${expectedCount} rows for bundle "${bundleId}"`);
@@ -6875,7 +6929,8 @@ const queryCompleteOwnersPatches = async (store, indexName, bundleIds) => {
 	let failedOwner = firstOwner;
 	for (let attempt = 0; attempt < 3; attempt++) {
 		const candidateIdsByOwner = await Promise.all(owners.map(({ sk }) => queryOwnerPatchIds(store, indexName, sk)));
-		const patches = await loadPatchItemsById(store, candidateIdsByOwner.flat());
+		const candidateIds = candidateIdsByOwner.flat();
+		const patches = await loadPatchItemsById(store, candidateIds);
 		const patchesById = new Map(patches.map((patch) => [patch.sk, patch]));
 		const mismatchedOwner = owners.find((owner, ownerIndex) => {
 			const ids = candidateIdsByOwner[ownerIndex] ?? [];
@@ -6976,7 +7031,7 @@ const createDynamoDBBundle = async (store, row) => {
 	} }]);
 };
 const createDynamoDBPatch = async (store, row) => {
-	const bundleIds = [...new Set([row.bundle_id, row.base_bundle_id])];
+	const bundleIds = [.../* @__PURE__ */ new Set([row.bundle_id, row.base_bundle_id])];
 	const counter = metadataUpdate(store, { bundle_patches: 1 });
 	if (!counter) return;
 	await commitDynamoDBTransaction(store, [
@@ -7012,9 +7067,10 @@ const deleteAction = (store, item) => ({ Delete: {
 const deleteDynamoDBPatch = async (store, item) => {
 	const counter = metadataUpdate(store, { bundle_patches: -1 });
 	if (!counter) return;
+	const bundleIds = [.../* @__PURE__ */ new Set([item.row.bundle_id, item.row.base_bundle_id])];
 	await commitDynamoDBTransaction(store, [
 		counter,
-		...[...new Set([item.row.bundle_id, item.row.base_bundle_id])].map((id) => updateBundleRelation(store, id, -1, id === item.row.bundle_id ? -1 : 0)),
+		...bundleIds.map((id) => updateBundleRelation(store, id, -1, id === item.row.bundle_id ? -1 : 0)),
 		deleteAction(store, item)
 	]);
 };
@@ -7025,7 +7081,7 @@ const deleteBundle = async (store, bundle, patches) => {
 	});
 	if (!counter) return;
 	const otherEndpointCounts = /* @__PURE__ */ new Map();
-	for (const { row } of patches) for (const id of new Set([row.bundle_id, row.base_bundle_id])) {
+	for (const { row } of patches) for (const id of /* @__PURE__ */ new Set([row.bundle_id, row.base_bundle_id])) {
 		if (id === bundle.sk) continue;
 		const current = otherEndpointCounts.get(id) ?? {
 			owned: 0,
@@ -7076,6 +7132,9 @@ const exactDynamoDBField = (where, fieldName) => {
 	return typeof value === "string" ? value : void 0;
 };
 const createDynamoDBCrud = (store, updateIndexName) => ({
+	recordInsights: (input) => recordDynamoDBInsightsEvent(store, input),
+	findLatestInsightsEvents: (input) => createDynamoDBInsightsTable(store).findLatestEvents(input),
+	countLatestInsightsEvents: (input) => createDynamoDBInsightsTable(store).countLatestEvents(input),
 	async create(input) {
 		switch (input.model) {
 			case "bundles":
@@ -7232,14 +7291,19 @@ const createDynamoDBCrud = (store, updateIndexName) => ({
 			if (count !== void 0) return count;
 		}
 		switch (input.model) {
-			case "bundles": return countDistinctDynamoDBRows((await loadBundleItems(store)).map(({ row }) => row).filter((row) => matchesDynamoDBWhere(row, input.where)), distinctFields(input.distinct));
+			case "bundles": {
+				const rows = (await loadBundleItems(store)).map(({ row }) => row).filter((row) => matchesDynamoDBWhere(row, input.where));
+				return countDistinctDynamoDBRows(rows, distinctFields(input.distinct));
+			}
 			case "bundle_patches": {
 				const ownerId = exactDynamoDBPatchOwner(input.where);
-				return countDistinctDynamoDBRows((ownerId ? await queryCompleteOwnerPatches(store, updateIndexName, ownerId) : (await loadPatchItems(store)).map(({ row }) => row)).filter((row) => matchesDynamoDBWhere(row, input.where)), distinctFields(input.distinct));
+				const rows = (ownerId ? await queryCompleteOwnerPatches(store, updateIndexName, ownerId) : (await loadPatchItems(store)).map(({ row }) => row)).filter((row) => matchesDynamoDBWhere(row, input.where));
+				return countDistinctDynamoDBRows(rows, distinctFields(input.distinct));
 			}
 			case "releases": {
 				const scopeKey = exactDynamoDBField(input.where, "scope_key");
-				return countDistinctDynamoDBRows((scopeKey === void 0 ? await loadReleaseItems(store) : await loadReleaseItemsByScope(store, scopeKey)).map(({ row }) => row).filter((row) => matchesDynamoDBWhere(row, input.where)), distinctFields(input.distinct));
+				const rows = (scopeKey === void 0 ? await loadReleaseItems(store) : await loadReleaseItemsByScope(store, scopeKey)).map(({ row }) => row).filter((row) => matchesDynamoDBWhere(row, input.where));
+				return countDistinctDynamoDBRows(rows, distinctFields(input.distinct));
 			}
 		}
 		throw new DynamoDBUnsupportedModelError();
@@ -7257,7 +7321,6 @@ const createDynamoDBCrud = (store, updateIndexName) => ({
 					if (ownerId === void 0) break;
 					return (await queryCompleteOwnerPatches(store, updateIndexName, ownerId)).find((row) => matchesDynamoDBWhere(row, input.where)) ?? null;
 				}
-				break;
 			case "channels":
 				if (id !== void 0) return (await loadChannelItem(store, id))?.row ?? null;
 				return (await loadChannelItems(store)).map(({ row }) => row).find((row) => matchesDynamoDBWhere(row, input.where)) ?? null;
@@ -7313,6 +7376,7 @@ const createDynamoDBCrud = (store, updateIndexName) => ({
 	deleteChannel: (input) => deleteDynamoDBChannel(store, input)
 });
 var DynamoDBDuplicatePatchError = class extends Error {
+	patchId;
 	name = "DynamoDBDuplicatePatchError";
 	constructor(patchId) {
 		super(`DynamoDB bundle mutation contains duplicate patch "${patchId}"`);
@@ -7425,7 +7489,6 @@ const compileAndCommitDynamoDBChanges = async (store, input) => {
 	const originalApiKeys = /* @__PURE__ */ new Map();
 	const apiKeys = /* @__PURE__ */ new Map();
 	const apiKeyHashes = /* @__PURE__ */ new Map();
-	const insights = /* @__PURE__ */ new Map();
 	const rememberApiKey = (value) => {
 		if (value === null || apiKeys.has(value.row.id)) return;
 		originalApiKeys.set(value.row.id, value);
@@ -7548,48 +7611,40 @@ const compileAndCommitDynamoDBChanges = async (store, input) => {
 				patches.set(change.row.id, change.row);
 			} else for (const [id, patch] of patches) if (patch.bundle_id === change.where.bundleId) patches.delete(id);
 			break;
-		case "insights": {
-			const key = insightsSortKey(change.row);
-			if (insights.has(key)) throw new DynamoDBCommitStateError(`Insights event "${change.row.id}" is duplicated`);
-			insights.set(key, change.row);
-			break;
+		case "apiKeys": if (change.operation === "insert") {
+			rememberApiKey(await loadApiKeyByHash(store, change.row.hash));
+			if (apiKeyHashes.has(change.row.hash)) break;
+			rememberApiKey(await loadApiKey(store, change.row.id));
+			if (apiKeys.has(change.row.id)) throw new DynamoDBCommitStateError(`API key id "${change.row.id}" already exists`);
+			const inserted = {
+				row: change.row,
+				version: 1
+			};
+			apiKeys.set(change.row.id, inserted);
+			apiKeyHashes.set(change.row.hash, change.row.id);
+		} else {
+			rememberApiKey(await loadApiKey(store, change.where.id));
+			const current = apiKeys.get(change.where.id);
+			if (current === void 0) return {
+				committed: false,
+				conflict: {
+					changeIndex,
+					reason: "not_found"
+				}
+			};
+			apiKeys.set(change.where.id, {
+				row: {
+					...current.row,
+					revoked_at_ms: change.update.revokedAtMs
+				},
+				version: current.version
+			});
 		}
-		case "apiKeys":
-			if (change.operation === "insert") {
-				rememberApiKey(await loadApiKeyByHash(store, change.row.hash));
-				if (apiKeyHashes.has(change.row.hash)) break;
-				rememberApiKey(await loadApiKey(store, change.row.id));
-				if (apiKeys.has(change.row.id)) throw new DynamoDBCommitStateError(`API key id "${change.row.id}" already exists`);
-				const inserted = {
-					row: change.row,
-					version: 1
-				};
-				apiKeys.set(change.row.id, inserted);
-				apiKeyHashes.set(change.row.hash, change.row.id);
-			} else {
-				rememberApiKey(await loadApiKey(store, change.where.id));
-				const current = apiKeys.get(change.where.id);
-				if (current === void 0) return {
-					committed: false,
-					conflict: {
-						changeIndex,
-						reason: "not_found"
-					}
-				};
-				apiKeys.set(change.where.id, {
-					row: {
-						...current.row,
-						revoked_at_ms: change.update.revokedAtMs
-					},
-					version: current.version
-				});
-			}
-			break;
 	}
 	const relationCounts = /* @__PURE__ */ new Map();
 	const ownedPatchCounts = /* @__PURE__ */ new Map();
 	for (const patch of patches.values()) {
-		for (const id of new Set([patch.bundle_id, patch.base_bundle_id])) relationCounts.set(id, (relationCounts.get(id) ?? 0) + 1);
+		for (const id of /* @__PURE__ */ new Set([patch.bundle_id, patch.base_bundle_id])) relationCounts.set(id, (relationCounts.get(id) ?? 0) + 1);
 		ownedPatchCounts.set(patch.bundle_id, (ownedPatchCounts.get(patch.bundle_id) ?? 0) + 1);
 	}
 	const channelReferenceCounts = /* @__PURE__ */ new Map();
@@ -7698,7 +7753,7 @@ const compileAndCommitDynamoDBChanges = async (store, input) => {
 			...original ? { ExpressionAttributeValues: { ":version": original.version } } : {}
 		} });
 	}
-	const changedReleaseIds = new Set([...new Set([...originalReleases.keys(), ...releases.keys()])].filter((id) => {
+	const changedReleaseIds = new Set([.../* @__PURE__ */ new Set([...originalReleases.keys(), ...releases.keys()])].filter((id) => {
 		const original = originalReleases.get(id)?.row;
 		const next = releases.get(id);
 		return original === void 0 || next === void 0 || !rowsEqual(original, next);
@@ -7740,17 +7795,6 @@ const compileAndCommitDynamoDBChanges = async (store, input) => {
 		bundle_patches: patches.size - originalPatches.size
 	});
 	if (counter !== void 0) actions.push(counter);
-	for (const [key, row] of insights) actions.push({ Put: {
-		TableName: store.tableName,
-		Item: boundedDynamoDBMetadataItem({
-			pk: DYNAMODB_INSIGHTS_PARTITION,
-			sk: key,
-			version: 1,
-			row
-		}),
-		ConditionExpression: "attribute_not_exists(#pk)",
-		ExpressionAttributeNames: { "#pk": "pk" }
-	} });
 	for (const [id, current] of apiKeys) {
 		const original = originalApiKeys.get(id);
 		if (original !== void 0 && rowsEqual(original.row, current.row)) continue;
@@ -7785,13 +7829,22 @@ const createDynamoDBCommit = (store) => async (input) => {
 	}
 };
 const DYNAMODB_INSIGHTS_PARTITION = "bundle_events";
+const DYNAMODB_INSIGHTS_INSTALLATIONS_PARTITION = "_hot-updater#insights-installations";
+const DYNAMODB_INSIGHTS_EVENT_IDS_PARTITION = "_hot-updater#insights-event-ids";
+const DYNAMODB_INSIGHTS_BUNDLE_PREFIX = "_hot-updater#insights-bundle#";
 const DYNAMODB_API_KEY_PARTITION = "api_keys";
 const DYNAMODB_API_KEY_HASH_PARTITION = "_hot-updater#api-key-hashes";
+const DYNAMODB_INSIGHTS_MOVEMENT_PREFIX = "_hot-updater#insights-movement#";
+const DYNAMODB_INSIGHTS_USER_PREFIX = "_hot-updater#insights-user#";
+const DYNAMODB_INSIGHTS_SCOPE_PREFIX = "_hot-updater#insights-scope#";
+const DYNAMODB_INSIGHTS_RECORD_ATTEMPTS = 3;
 const hasValidBundleEventShape = (value) => {
 	const type = field(value, "type");
 	const fromBundleId = field(value, "from_bundle_id");
-	const updateStrategy = field(value, "update_strategy");
-	return (type === "UPDATE_APPLIED" || type === "RECOVERED" || type === "RELEASE_ADOPTED") && typeof fromBundleId === "string" && (updateStrategy === "fingerprint" || updateStrategy === "appVersion") || type === "UNCHANGED" && fromBundleId === null && updateStrategy === null;
+	const metadata = field(value, "metadata");
+	if (!(0, _hot_updater_plugin_core.isDatabaseBundleEventMetadata)(metadata)) return false;
+	const updateStrategy = metadata.update_strategy;
+	return (type === "UPDATE_DOWNLOADED" || type === "UPDATE_APPLIED" || type === "RECOVERED") && typeof fromBundleId === "string" && (updateStrategy === "fingerprint" || updateStrategy === "appVersion") || type === "UNCHANGED" && fromBundleId === null && updateStrategy === null;
 };
 const isBundleEventRow = (value) => typeof value === "object" && value !== null && typeof field(value, "id") === "string" && typeof field(value, "install_id") === "string" && isNullableString(field(value, "from_release_id")) && isNullableString(field(value, "to_release_id")) && typeof field(value, "to_bundle_id") === "string" && (field(value, "platform") === "ios" || field(value, "platform") === "android") && typeof field(value, "received_at_ms") === "number" && hasValidBundleEventShape(value);
 const isApiKeyRow = (value) => typeof value === "object" && value !== null && typeof field(value, "id") === "string" && typeof field(value, "hash") === "string" && typeof field(value, "name") === "string" && typeof field(value, "prefix") === "string" && field(value, "role") === "client" && typeof field(value, "created_at_ms") === "number" && (field(value, "revoked_at_ms") === null || typeof field(value, "revoked_at_ms") === "number");
@@ -7804,51 +7857,302 @@ const parseOfficialRowItem = (value, partition, isRow) => {
 };
 const timestampSortKey = (timestampMs) => Math.trunc(timestampMs).toString().padStart(16, "0");
 const insightsSortKey = (row) => `${timestampSortKey(row.received_at_ms)}#${row.id}`;
-const createDynamoDBInsightsTable = (store) => ({
-	async append(row) {
-		await store.client.send(new _aws_sdk_lib_dynamodb.PutCommand({
+const insightsMovementPartition = (installId) => `${DYNAMODB_INSIGHTS_MOVEMENT_PREFIX}${installId}`;
+const insightsUserPartition = (userId) => `${DYNAMODB_INSIGHTS_USER_PREFIX}${userId}`;
+const insightsScopePartition = (scope) => `${DYNAMODB_INSIGHTS_SCOPE_PREFIX}${(0, node_crypto.createHash)("sha256").update(JSON.stringify([scope.platform, scope.channel]), "utf8").digest("hex")}`;
+const toInsightsScopeItem = (row) => ({
+	pk: insightsScopePartition(row),
+	sk: row.install_id,
+	received_at_ms: row.received_at_ms,
+	type: row.type,
+	from_bundle_id: row.from_bundle_id,
+	to_bundle_id: row.to_bundle_id
+});
+const insightsBundlePartition = (filter) => {
+	const scope = JSON.stringify([
+		filter.platform,
+		filter.channel,
+		filter.type,
+		filter.type === "RECOVERED" ? filter.fromBundleId : filter.toBundleId
+	]);
+	return `${DYNAMODB_INSIGHTS_BUNDLE_PREFIX}${(0, node_crypto.createHash)("sha256").update(scope, "utf8").digest("hex")}`;
+};
+const toInsightsBundleItem = (row) => boundedDynamoDBMetadataItem({
+	pk: insightsBundlePartition({
+		platform: row.platform,
+		channel: row.channel,
+		...row.type === "RECOVERED" ? {
+			type: row.type,
+			fromBundleId: row.from_bundle_id
+		} : {
+			type: row.type,
+			toBundleId: row.to_bundle_id
+		}
+	}),
+	sk: insightsSortKey(row),
+	version: 1,
+	row
+});
+const toInsightsEventItem = (row) => {
+	const orderKey = insightsSortKey(row);
+	return boundedDynamoDBMetadataItem({
+		pk: DYNAMODB_INSIGHTS_PARTITION,
+		sk: orderKey,
+		version: 1,
+		row,
+		...(0, _hot_updater_plugin_core.isInsightsMovementEvent)(row) ? {
+			gsi1pk: insightsMovementPartition(row.install_id),
+			gsi1sk: orderKey
+		} : {}
+	});
+};
+const toInsightsInstallationItem = (row) => boundedDynamoDBMetadataItem({
+	pk: DYNAMODB_INSIGHTS_INSTALLATIONS_PARTITION,
+	sk: row.install_id,
+	order_key: insightsSortKey(row),
+	version: 1,
+	row
+});
+const toInsightsUserItem = (row) => boundedDynamoDBMetadataItem({
+	pk: insightsUserPartition(row.user_id),
+	sk: row.install_id,
+	order_key: insightsSortKey(row),
+	version: 1,
+	row
+});
+const parseInsightsInstallationItem = (value, partition) => {
+	const row = value.row;
+	if (value.pk !== partition || typeof value.sk !== "string" || typeof value.order_key !== "string" || value.version !== 1 || !isBundleEventRow(row) || value.sk !== row.install_id || value.order_key !== insightsSortKey(row)) throw new DynamoDBStoredItemError();
+	return {
+		...value,
+		row
+	};
+};
+const loadInsightsInstallationItem = async (store, installId) => {
+	const { Item } = await store.client.send(new _aws_sdk_lib_dynamodb.GetCommand({
+		TableName: store.tableName,
+		Key: {
+			pk: DYNAMODB_INSIGHTS_INSTALLATIONS_PARTITION,
+			sk: installId
+		},
+		ConsistentRead: true
+	}));
+	return Item === void 0 ? null : parseInsightsInstallationItem(Item, DYNAMODB_INSIGHTS_INSTALLATIONS_PARTITION);
+};
+const advancesInsightsInstallation = (row, current) => row.received_at_ms > current.received_at_ms || row.received_at_ms === current.received_at_ms && row.id > current.id;
+const recordDynamoDBInsightsEvent = async (store, { event: row }) => {
+	const next = row;
+	const eventItem = toInsightsEventItem(row);
+	const bundleItem = toInsightsBundleItem(row);
+	const identityKey = {
+		pk: DYNAMODB_INSIGHTS_EVENT_IDS_PARTITION,
+		sk: row.id
+	};
+	for (let attempt = 0; attempt < DYNAMODB_INSIGHTS_RECORD_ATTEMPTS; attempt++) {
+		const { Item: accepted } = await store.client.send(new _aws_sdk_lib_dynamodb.GetCommand({
 			TableName: store.tableName,
-			Item: boundedDynamoDBMetadataItem({
-				pk: DYNAMODB_INSIGHTS_PARTITION,
-				sk: insightsSortKey(row),
-				version: 1,
-				row
-			}),
-			ConditionExpression: "attribute_not_exists(#pk)",
-			ExpressionAttributeNames: { "#pk": "pk" }
+			Key: identityKey,
+			ConsistentRead: true
 		}));
+		if (accepted !== void 0) return;
+		const current = await loadInsightsInstallationItem(store, row.install_id);
+		const actions = [
+			{ Put: {
+				TableName: store.tableName,
+				Item: identityKey,
+				ConditionExpression: "attribute_not_exists(#pk)",
+				ExpressionAttributeNames: { "#pk": "pk" }
+			} },
+			{ Put: {
+				TableName: store.tableName,
+				Item: eventItem
+			} },
+			{ Put: {
+				TableName: store.tableName,
+				Item: bundleItem
+			} }
+		];
+		if (current === null || advancesInsightsInstallation(next, current.row)) {
+			actions.push({ Put: {
+				TableName: store.tableName,
+				Item: toInsightsInstallationItem(next),
+				ConditionExpression: current === null ? "attribute_not_exists(#pk)" : "#orderKey = :currentOrderKey",
+				ExpressionAttributeNames: current === null ? { "#pk": "pk" } : { "#orderKey": "order_key" },
+				...current === null ? {} : { ExpressionAttributeValues: { ":currentOrderKey": current.order_key } }
+			} });
+			if (current !== null && insightsScopePartition(current.row) !== insightsScopePartition(next)) actions.push({ Delete: {
+				TableName: store.tableName,
+				Key: {
+					pk: insightsScopePartition(current.row),
+					sk: current.row.install_id
+				}
+			} });
+			actions.push({ Put: {
+				TableName: store.tableName,
+				Item: toInsightsScopeItem(next)
+			} });
+			if (current !== null && current.row.user_id !== null && current.row.user_id !== next.user_id) actions.push({ Delete: {
+				TableName: store.tableName,
+				Key: {
+					pk: insightsUserPartition(current.row.user_id),
+					sk: current.row.install_id
+				}
+			} });
+			if (next.user_id !== null) actions.push({ Put: {
+				TableName: store.tableName,
+				Item: toInsightsUserItem({
+					...next,
+					user_id: next.user_id
+				})
+			} });
+		}
+		try {
+			await commitDynamoDBTransaction(store, actions);
+			return;
+		} catch (error) {
+			if (!isDynamoDBTransactionConflict(error)) throw error;
+			const { Item } = await store.client.send(new _aws_sdk_lib_dynamodb.GetCommand({
+				TableName: store.tableName,
+				Key: identityKey,
+				ConsistentRead: true
+			}));
+			if (Item !== void 0) return;
+			if (attempt === 2) throw error;
+		}
+	}
+};
+const insightsEventRange = (input) => {
+	const upperExclusive = input.after ? `${timestampSortKey(input.after.receivedAtMs)}#${input.after.id}` : `${timestampSortKey(input.beforeReceivedAtMs)}#`;
+	const upper = `${upperExclusive.slice(0, -1)}${String.fromCharCode(upperExclusive.charCodeAt(upperExclusive.length - 1) - 1)}~`;
+	const movement = input.filter.kind === "installationMovement";
+	const partition = movement ? insightsMovementPartition(input.filter.installId) : input.filter.kind === "bundle" ? insightsBundlePartition(input.filter) : DYNAMODB_INSIGHTS_PARTITION;
+	return {
+		partition,
+		query: {
+			...movement ? { IndexName: DYNAMODB_UPDATE_INDEX_NAME } : { ConsistentRead: true },
+			KeyConditionExpression: "#partition = :partition AND #order BETWEEN :since AND :upper",
+			ExpressionAttributeNames: {
+				"#partition": movement ? "gsi1pk" : "pk",
+				"#order": movement ? "gsi1sk" : "sk"
+			},
+			ExpressionAttributeValues: {
+				":partition": partition,
+				":since": `${timestampSortKey(input.sinceMs ?? 0)}#`,
+				":upper": upper
+			}
+		}
+	};
+};
+const createDynamoDBInsightsTable = (store) => ({
+	recordEvent: (input) => recordDynamoDBInsightsEvent(store, input),
+	async listEvents(input) {
+		if ((input.sinceMs ?? 0) === input.beforeReceivedAtMs) return [];
+		const range = insightsEventRange(input);
+		const rows = [];
+		let exclusiveStartKey;
+		do {
+			const page = await store.client.send(new _aws_sdk_lib_dynamodb.QueryCommand({
+				TableName: store.tableName,
+				...range.query,
+				ExclusiveStartKey: exclusiveStartKey,
+				Limit: input.limit - rows.length,
+				ScanIndexForward: false
+			}));
+			rows.push(...(page.Items ?? []).slice(0, input.limit - rows.length).map((item) => parseOfficialRowItem(item, input.filter.kind === "bundle" ? range.partition : DYNAMODB_INSIGHTS_PARTITION, isBundleEventRow).row));
+			exclusiveStartKey = page.LastEvaluatedKey;
+		} while (rows.length < input.limit && exclusiveStartKey !== void 0);
+		return rows;
 	},
-	async scan(input) {
-		if (input.limit <= 0) return [];
-		if (input.after !== void 0 && input.after.receivedAtMs >= input.beforeReceivedAtMs) return [];
+	async findLatestEvents(input) {
+		if ("installId" in input) {
+			const stored = await loadInsightsInstallationItem(store, input.installId);
+			return stored === null ? [] : [stored.row];
+		}
+		const partition = insightsUserPartition(input.userId);
 		const rows = [];
-		const afterKey = input.after === void 0 ? void 0 : `${timestampSortKey(input.after.receivedAtMs)}#${input.after.id}`;
 		let exclusiveStartKey;
 		do {
 			const page = await store.client.send(new _aws_sdk_lib_dynamodb.QueryCommand({
 				TableName: store.tableName,
+				ConsistentRead: true,
 				ExclusiveStartKey: exclusiveStartKey,
-				KeyConditionExpression: afterKey === void 0 ? "#pk = :pk AND #sk < :before" : "#pk = :pk AND #sk BETWEEN :after AND :before",
+				KeyConditionExpression: input.afterInstallId === void 0 ? "#pk = :pk" : "#pk = :pk AND #sk > :after",
 				ExpressionAttributeNames: {
 					"#pk": "pk",
-					"#sk": "sk"
+					...input.afterInstallId === void 0 ? {} : { "#sk": "sk" }
 				},
 				ExpressionAttributeValues: {
-					":before": `${timestampSortKey(input.beforeReceivedAtMs)}#`,
-					":pk": DYNAMODB_INSIGHTS_PARTITION,
-					...afterKey === void 0 ? {} : { ":after": afterKey }
+					":pk": partition,
+					...input.afterInstallId === void 0 ? {} : { ":after": input.afterInstallId }
 				},
-				Limit: input.limit - rows.length + (afterKey === void 0 ? 0 : 1),
+				Limit: input.limit - rows.length,
 				ScanIndexForward: true
 			}));
-			for (const item of page.Items ?? []) {
-				if (item.sk === afterKey) continue;
-				rows.push(parseOfficialRowItem(item, DYNAMODB_INSIGHTS_PARTITION, isBundleEventRow).row);
-				if (rows.length === input.limit) return rows;
+			for (const item of (page.Items ?? []).slice(0, input.limit - rows.length)) {
+				const stored = parseInsightsInstallationItem(item, partition);
+				const current = await loadInsightsInstallationItem(store, stored.row.install_id);
+				if (current?.row.user_id === input.userId) rows.push(current.row);
 			}
 			exclusiveStartKey = page.LastEvaluatedKey;
-		} while (exclusiveStartKey !== void 0);
+		} while (rows.length < input.limit && exclusiveStartKey !== void 0);
 		return rows;
+	},
+	async countLatestEvents(input) {
+		const bundleConditions = input.bundle?.map((bundle, group) => `#bundle${group} = :bundle${group} AND #type IN (${bundle.types.map((_, i) => `:type${group}_${i}`).join(", ")})`);
+		const bundleFilter = bundleConditions === void 0 ? "" : ` AND ${bundleConditions.length === 1 ? bundleConditions[0] : `(${bundleConditions.join(" OR ")})`}`;
+		let count = 0;
+		let exclusiveStartKey;
+		do {
+			const page = await store.client.send(new _aws_sdk_lib_dynamodb.QueryCommand({
+				TableName: store.tableName,
+				ConsistentRead: true,
+				ExclusiveStartKey: exclusiveStartKey,
+				KeyConditionExpression: "#pk = :pk",
+				FilterExpression: "#received >= :since" + bundleFilter,
+				ExpressionAttributeNames: {
+					"#pk": "pk",
+					"#received": "received_at_ms",
+					...input.bundle === void 0 ? {} : {
+						...Object.fromEntries(input.bundle.map((bundle, group) => [`#bundle${group}`, bundle.field])),
+						"#type": "type"
+					}
+				},
+				ExpressionAttributeValues: {
+					":pk": insightsScopePartition(input),
+					":since": input.sinceMs,
+					...input.bundle === void 0 ? {} : Object.fromEntries(input.bundle.flatMap((bundle, group) => [[`:bundle${group}`, bundle.value], ...bundle.types.map((type, i) => [`:type${group}_${i}`, type])]))
+				},
+				Select: "COUNT",
+				ScanIndexForward: true
+			}));
+			count += page.Count ?? 0;
+			exclusiveStartKey = page.LastEvaluatedKey;
+		} while (exclusiveStartKey !== void 0);
+		return count;
+	},
+	async countEvents(input) {
+		if (input.sinceMs === input.beforeReceivedAtMs) return 0;
+		const { query } = insightsEventRange({
+			...input,
+			filter: {
+				kind: "bundle",
+				...input.filter
+			},
+			limit: 1
+		});
+		let count = 0;
+		let exclusiveStartKey;
+		do {
+			const page = await store.client.send(new _aws_sdk_lib_dynamodb.QueryCommand({
+				TableName: store.tableName,
+				...query,
+				ExclusiveStartKey: exclusiveStartKey,
+				Select: "COUNT"
+			}));
+			count += page.Count ?? 0;
+			exclusiveStartKey = page.LastEvaluatedKey;
+		} while (exclusiveStartKey !== void 0);
+		return count;
 	}
 });
 const apiKeyItem = (row, version) => ({
@@ -9106,6 +9410,7 @@ var CloudFrontManager = class {
 //#region iac/dynamodb.ts
 const DYNAMODB_DESCRIBE_TABLE_ACTION = "dynamodb:DescribeTable";
 var DynamoDBTableSchemaError = class extends Error {
+	tableName;
 	name = "DynamoDBTableSchemaError";
 	constructor(tableName) {
 		super(`DynamoDB table "${tableName}" does not match the Hot Updater key and index schema`);
@@ -9113,6 +9418,8 @@ var DynamoDBTableSchemaError = class extends Error {
 	}
 };
 var DynamoDBPermissionError = class extends _hot_updater_cli_tools.InitError {
+	tableName;
+	region;
 	name = "DynamoDBPermissionError";
 	requiredAction = DYNAMODB_DESCRIBE_TABLE_ACTION;
 	constructor(tableName, region, cause) {
@@ -9158,7 +9465,43 @@ const hasExpectedSchema = (table) => {
 	return keyAttributes.every((attributeName) => table?.AttributeDefinitions?.some(({ AttributeName, AttributeType }) => AttributeName === attributeName && AttributeType === "S")) && table?.BillingModeSummary?.BillingMode === "PAY_PER_REQUEST" && table.OnDemandThroughput?.MaxReadRequestUnits === onDemandThroughput.MaxReadRequestUnits && table.OnDemandThroughput?.MaxWriteRequestUnits === onDemandThroughput.MaxWriteRequestUnits && hasKeySchema(table?.KeySchema, primaryKeySchema) && hasKeySchema(updateIndex?.KeySchema, updateIndexKeySchema) && updateIndex?.OnDemandThroughput?.MaxReadRequestUnits === onDemandThroughput.MaxReadRequestUnits && updateIndex?.OnDemandThroughput?.MaxWriteRequestUnits === onDemandThroughput.MaxWriteRequestUnits && updateIndex?.Projection?.ProjectionType === "ALL";
 };
 const isResourceNotFound = (error) => typeof error === "object" && error !== null && Reflect.get(error, "name") === "ResourceNotFoundException";
+const buildDynamoDBCreateTableInput = (tableName) => ({
+	AttributeDefinitions: [
+		{
+			AttributeName: "pk",
+			AttributeType: "S"
+		},
+		{
+			AttributeName: "sk",
+			AttributeType: "S"
+		},
+		{
+			AttributeName: "gsi1pk",
+			AttributeType: "S"
+		},
+		{
+			AttributeName: "gsi1sk",
+			AttributeType: "S"
+		}
+	],
+	BillingMode: "PAY_PER_REQUEST",
+	DeletionProtectionEnabled: true,
+	GlobalSecondaryIndexes: [{
+		IndexName: DYNAMODB_UPDATE_INDEX_NAME,
+		KeySchema: [...updateIndexKeySchema],
+		Projection: { ProjectionType: "ALL" },
+		OnDemandThroughput: onDemandThroughput
+	}],
+	KeySchema: [...primaryKeySchema],
+	OnDemandThroughput: onDemandThroughput,
+	TableName: tableName
+});
+const buildDynamoDBBackupInput = (tableName) => ({
+	PointInTimeRecoverySpecification: { PointInTimeRecoveryEnabled: true },
+	TableName: tableName
+});
 var DynamoDBManager = class {
+	region;
 	client;
 	constructor(region, credentials) {
 		this.region = region;
@@ -9177,37 +9520,7 @@ var DynamoDBManager = class {
 			if (error instanceof Error && error.name === "AccessDeniedException" && error.message.includes(DYNAMODB_DESCRIBE_TABLE_ACTION)) throw new DynamoDBPermissionError(tableName, this.region, error);
 			if (!isResourceNotFound(error)) throw error;
 		}
-		await this.client.createTable({
-			AttributeDefinitions: [
-				{
-					AttributeName: "pk",
-					AttributeType: "S"
-				},
-				{
-					AttributeName: "sk",
-					AttributeType: "S"
-				},
-				{
-					AttributeName: "gsi1pk",
-					AttributeType: "S"
-				},
-				{
-					AttributeName: "gsi1sk",
-					AttributeType: "S"
-				}
-			],
-			BillingMode: "PAY_PER_REQUEST",
-			DeletionProtectionEnabled: true,
-			GlobalSecondaryIndexes: [{
-				IndexName: DYNAMODB_UPDATE_INDEX_NAME,
-				KeySchema: [...updateIndexKeySchema],
-				Projection: { ProjectionType: "ALL" },
-				OnDemandThroughput: onDemandThroughput
-			}],
-			KeySchema: [...primaryKeySchema],
-			OnDemandThroughput: onDemandThroughput,
-			TableName: tableName
-		});
+		await this.client.createTable(buildDynamoDBCreateTableInput(tableName));
 		await (0, _aws_sdk_client_dynamodb.waitUntilTableExists)({
 			client: this.client,
 			maxWaitTime: 120
@@ -9217,14 +9530,84 @@ var DynamoDBManager = class {
 	async ensureLifecycle(tableName) {
 		const { ContinuousBackupsDescription } = await this.client.describeContinuousBackups({ TableName: tableName });
 		if (ContinuousBackupsDescription?.PointInTimeRecoveryDescription?.PointInTimeRecoveryStatus === "ENABLED") return;
-		await this.client.updateContinuousBackups({
-			PointInTimeRecoverySpecification: { PointInTimeRecoveryEnabled: true },
-			TableName: tableName
-		});
+		await this.client.updateContinuousBackups(buildDynamoDBBackupInput(tableName));
 	}
 };
 //#endregion
 //#region iac/iam.ts
+const buildDynamoDBPolicy = (region, accountId, tableName) => {
+	const tableArn = `arn:aws:dynamodb:${region}:${accountId}:table/${tableName}`;
+	return {
+		Version: "2012-10-17",
+		Statement: [{
+			Action: ["dynamodb:Query"],
+			Effect: "Allow",
+			Resource: [`${tableArn}/index/${DYNAMODB_UPDATE_INDEX_NAME}`]
+		}, {
+			Action: [
+				"dynamodb:BatchGetItem",
+				"dynamodb:DeleteItem",
+				"dynamodb:GetItem",
+				"dynamodb:PutItem",
+				"dynamodb:Query",
+				"dynamodb:TransactWriteItems",
+				"dynamodb:UpdateItem"
+			],
+			Condition: { "ForAllValues:StringLike": { "dynamodb:LeadingKeys": [
+				"_hot-updater",
+				"bundles",
+				"bundle_patches",
+				"release-scope#*",
+				"release_catalogs",
+				DYNAMODB_RELEASE_ID_PARTITION,
+				DYNAMODB_CHANNEL_PARTITION,
+				DYNAMODB_CHANNEL_NAME_PARTITION,
+				DYNAMODB_INSIGHTS_PARTITION,
+				DYNAMODB_INSIGHTS_INSTALLATIONS_PARTITION,
+				DYNAMODB_INSIGHTS_EVENT_IDS_PARTITION,
+				`${DYNAMODB_INSIGHTS_BUNDLE_PREFIX}*`,
+				"_hot-updater#insights-user#*",
+				"_hot-updater#insights-scope#*",
+				DYNAMODB_API_KEY_PARTITION,
+				DYNAMODB_API_KEY_HASH_PARTITION
+			] } },
+			Effect: "Allow",
+			Resource: [tableArn]
+		}]
+	};
+};
+const buildS3Policy = (bucketName) => {
+	return {
+		Version: "2012-10-17",
+		Statement: [{
+			Action: ["s3:ListBucket"],
+			Effect: "Allow",
+			Resource: [`arn:aws:s3:::${bucketName}`]
+		}, {
+			Action: ["s3:GetObject"],
+			Effect: "Allow",
+			Resource: [`arn:aws:s3:::${bucketName}/*`]
+		}]
+	};
+};
+const buildSsmPolicy = (region, accountId, parameterName) => {
+	return {
+		Version: "2012-10-17",
+		Statement: [{
+			Effect: "Allow",
+			Action: ["ssm:GetParameter"],
+			Resource: `arn:aws:ssm:${region}:${accountId}:parameter/${parameterName.replace(/^\/+/, "")}`
+		}]
+	};
+};
+const LAMBDA_EDGE_TRUST_POLICY = {
+	Version: "2012-10-17",
+	Statement: [{
+		Effect: "Allow",
+		Principal: { Service: ["lambda.amazonaws.com", "edgelambda.amazonaws.com"] },
+		Action: "sts:AssumeRole"
+	}]
+};
 var IAMManager = class {
 	region;
 	credentials;
@@ -9241,71 +9624,22 @@ var IAMManager = class {
 		});
 	}
 	async ensureDynamoDBPolicy(iamClient, roleName, accountId, tableName) {
-		const tableArn = `arn:aws:dynamodb:${this.region}:${accountId}:table/${tableName}`;
 		await iamClient.putRolePolicy({
-			PolicyDocument: JSON.stringify({
-				Version: "2012-10-17",
-				Statement: [{
-					Action: ["dynamodb:Query"],
-					Effect: "Allow",
-					Resource: [`${tableArn}/index/${DYNAMODB_UPDATE_INDEX_NAME}`]
-				}, {
-					Action: [
-						"dynamodb:BatchGetItem",
-						"dynamodb:DeleteItem",
-						"dynamodb:GetItem",
-						"dynamodb:PutItem",
-						"dynamodb:Query",
-						"dynamodb:TransactWriteItems",
-						"dynamodb:UpdateItem"
-					],
-					Condition: { "ForAllValues:StringEquals": { "dynamodb:LeadingKeys": [
-						"_hot-updater",
-						"bundles",
-						"bundle_patches",
-						DYNAMODB_CHANNEL_PARTITION,
-						DYNAMODB_CHANNEL_NAME_PARTITION,
-						DYNAMODB_INSIGHTS_PARTITION,
-						DYNAMODB_API_KEY_PARTITION,
-						DYNAMODB_API_KEY_HASH_PARTITION
-					] } },
-					Effect: "Allow",
-					Resource: [tableArn]
-				}]
-			}),
+			PolicyDocument: JSON.stringify(buildDynamoDBPolicy(this.region, accountId, tableName)),
 			PolicyName: "HotUpdaterDynamoDBReadAccess",
 			RoleName: roleName
 		});
 	}
 	async ensureS3Policy(iamClient, roleName, bucketName) {
 		await iamClient.putRolePolicy({
-			PolicyDocument: JSON.stringify({
-				Version: "2012-10-17",
-				Statement: [{
-					Action: ["s3:ListBucket"],
-					Effect: "Allow",
-					Resource: [`arn:aws:s3:::${bucketName}`]
-				}, {
-					Action: ["s3:GetObject"],
-					Effect: "Allow",
-					Resource: [`arn:aws:s3:::${bucketName}/*`]
-				}]
-			}),
+			PolicyDocument: JSON.stringify(buildS3Policy(bucketName)),
 			PolicyName: "HotUpdaterS3ReadAccess",
 			RoleName: roleName
 		});
 	}
 	async ensureSsmPolicy(iamClient, roleName, accountId, parameterName) {
-		const parameterPath = parameterName.replace(/^\/+/, "");
 		await iamClient.putRolePolicy({
-			PolicyDocument: JSON.stringify({
-				Version: "2012-10-17",
-				Statement: [{
-					Effect: "Allow",
-					Action: ["ssm:GetParameter"],
-					Resource: `arn:aws:ssm:${this.region}:${accountId}:parameter/${parameterPath}`
-				}]
-			}),
+			PolicyDocument: JSON.stringify(buildSsmPolicy(this.region, accountId, parameterName)),
 			PolicyName: "HotUpdaterSSMAccess",
 			RoleName: roleName
 		});
@@ -9320,14 +9654,7 @@ var IAMManager = class {
 			credentials: this.credentials
 		}).getCallerIdentity({})).Account;
 		if (!accountId) throw new Error("Failed to get AWS account ID");
-		const assumeRolePolicyDocument = JSON.stringify({
-			Version: "2012-10-17",
-			Statement: [{
-				Effect: "Allow",
-				Principal: { Service: ["lambda.amazonaws.com", "edgelambda.amazonaws.com"] },
-				Action: "sts:AssumeRole"
-			}]
-		});
+		const assumeRolePolicyDocument = JSON.stringify(LAMBDA_EDGE_TRUST_POLICY);
 		const roleName = `hot-updater-edge-${(0, node_crypto.createHash)("sha256").update(options.lambdaName).digest("hex").slice(0, 16)}`;
 		try {
 			const { Role: existingRole } = await iamClient.getRole({ RoleName: roleName });
@@ -9403,7 +9730,8 @@ var LambdaEdgeDeployer = class {
 	async deploy(lambdaRoleArn, lambdaName, config) {
 		const cwd = (0, _hot_updater_cli_tools.getCwd)();
 		const lambdaPath = require.resolve("@hot-updater/aws/lambda");
-		const { tmpDir, removeTmpDir } = await (0, _hot_updater_cli_tools.copyDirToTmp)(path.default.dirname(lambdaPath));
+		const lambdaDir = path.default.dirname(lambdaPath);
+		const { tmpDir, removeTmpDir } = await (0, _hot_updater_cli_tools.copyDirToTmp)(lambdaDir);
 		const indexPath = path.default.join(tmpDir, "index.cjs");
 		const code = (0, _hot_updater_cli_tools.transformEnv)(indexPath, {
 			CLOUDFRONT_KEY_PAIR_ID: config.publicKeyId,
@@ -9711,12 +10039,11 @@ const awsOptions = {
 };`.trim()
 			}];
 			break;
-		case "account":
-			helperStatements = [{
-				name: "awsOptions",
-				strategy: "merge-object",
-				replaceIncompatibleProperties: ["credentials"],
-				code: `
+		case "account": helperStatements = [{
+			name: "awsOptions",
+			strategy: "merge-object",
+			replaceIncompatibleProperties: ["credentials"],
+			code: `
 const awsOptions = {
   region: process.env.HOT_UPDATER_S3_REGION!,
   credentials: {
@@ -9724,8 +10051,7 @@ const awsOptions = {
     secretAccessKey: process.env.HOT_UPDATER_S3_SECRET_ACCESS_KEY!,
   },
 };`.trim()
-			}];
-			break;
+		}];
 	}
 	const builder = new _hot_updater_cli_tools.ConfigBuilder().setBuildType(build).setStorage(storageConfig).setDatabase(databaseConfig).setIntermediateCode(helperStatements.map((statement) => statement.code.trim()).join("\n\n"));
 	switch (authMode.mode) {
@@ -9735,13 +10061,10 @@ const awsOptions = {
 				named: ["fromSSO"]
 			});
 			break;
-		case "local":
-			builder.addImport({
-				pkg: "@aws-sdk/credential-providers",
-				named: [authMode.profile ? "fromIni" : "fromNodeProviderChain"]
-			});
-			break;
-		case "account": break;
+		case "local": builder.addImport({
+			pkg: "@aws-sdk/credential-providers",
+			named: [authMode.profile ? "fromIni" : "fromNodeProviderChain"]
+		});
 	}
 	return (0, _hot_updater_cli_tools.createHotUpdaterConfigScaffoldFromBuilder)(builder, { helperStatements });
 };
@@ -9776,7 +10099,7 @@ const isAwsRegion = (value) => {
 	return value !== void 0 && Object.hasOwn(regionLocationMap, value);
 };
 const prepareDynamoDBDeployment = async (input) => {
-	return new DynamoDBManager(input.region, input.credentials).ensureTable(input.tableName);
+	await new DynamoDBManager(input.region, input.credentials).ensureTable(input.tableName);
 };
 const prepareDynamoDBApiKey = async (input) => {
 	return (await (0, _hot_updater_server.provisionApiKey)({
@@ -9905,13 +10228,14 @@ const runInit = async ({ build, envFile }) => {
 		dynamodbTableName: resolvedDynamoDBTableName,
 		lambdaName
 	};
+	const persistCredentialInputs = await (0, _hot_updater_cli_tools.confirmInitInputPersistence)({
+		existingEnv: managedEnv,
+		inputs: resolvedInputs,
+		nonInteractive,
+		provider: initProvider
+	});
 	const initEnv = (0, _hot_updater_cli_tools.getInitProviderEnvVars)({
-		includeConsentInputs: await (0, _hot_updater_cli_tools.confirmInitInputPersistence)({
-			existingEnv: managedEnv,
-			inputs: resolvedInputs,
-			nonInteractive,
-			provider: initProvider
-		}),
+		includeConsentInputs: persistCredentialInputs,
 		inputs: resolvedInputs,
 		provider: initProvider
 	});
@@ -10001,6 +10325,12 @@ const runInit = async ({ build, envFile }) => {
 	_hot_updater_cli_tools.p.log.success("Done! 🎉");
 };
 //#endregion
+exports.LAMBDA_EDGE_TRUST_POLICY = LAMBDA_EDGE_TRUST_POLICY;
+exports.buildDynamoDBBackupInput = buildDynamoDBBackupInput;
+exports.buildDynamoDBCreateTableInput = buildDynamoDBCreateTableInput;
+exports.buildDynamoDBPolicy = buildDynamoDBPolicy;
+exports.buildS3Policy = buildS3Policy;
+exports.buildSsmPolicy = buildSsmPolicy;
 exports.prepareDynamoDBApiKey = prepareDynamoDBApiKey;
 exports.prepareDynamoDBDeployment = prepareDynamoDBDeployment;
 exports.runInit = runInit;