@hot-updater/console 1.0.0-rc.2 → 1.0.0-rc.20

package/.output/server/_ssr/runtime.server-NucbYjc7.mjs

@@ -0,0 +1,1372 @@
+import { i as resolveConsoleFeatures, n as consoleFeatures, t as ConsoleFeatureUnavailableError } from "./console-features-CsbyHYfK.mjs";
+import { C as isUUIDv7 } from "./dist-B-r4u3Lg.mjs";
+import { n as DatabasePluginInputError, o as isDatabaseJsonObject } from "./databaseRows-CXxf_VIB.mjs";
+import { t as createUUIDv7 } from "./uuidv7-BzSO-fr-.mjs";
+import { a as createCoreReads, c as engineAdapterOf, d as validateSchema, i as createCoreApi, l as pruneDuringWrites, n as aggregateBatchingModule, r as coreModule, s as createDatabaseEngine, t as OFF_ENGINE_DATABASE, u as resolveSchema } from "./api-C0G9MTMI.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/runtime.server-NucbYjc7.js
+/** Whether a configured database is a self-hosted server's. */
+var isRemoteDatabase = (database) => "core" in database && "fetchAdmin" in database;
+/** The settings rows migrations write, last, and the fence reads. */
+var SETTINGS_TABLE = {
+	name: "private_hot_updater_settings",
+	columns: [
+		{
+			name: "key",
+			type: "string",
+			nullable: false,
+			maxLength: 255
+		},
+		{
+			name: "value",
+			type: "string",
+			nullable: false,
+			maxLength: 255
+		},
+		{
+			name: "_v",
+			type: "integer",
+			nullable: false,
+			default: 0
+		}
+	],
+	key: ["key"],
+	indexes: []
+};
+/** The engine's storage-layout generation; it changes only with a migration. */
+var ENGINE_SCHEMA_KEY = "schema.engine";
+var settingMessage = (adapterName, { key, expected, found }) => `Hot Updater schema setting "${key}" for ${adapterName} is ${found === null ? "missing" : `"${found}"`}; expected "${expected}". ${key === "schema.engine" ? "Create a new empty database and run `hot-updater db migrate`; databases from before the storage engine are not converted." : "Run `hot-updater db migrate`."}`;
+/** The database needs `hot-updater db migrate`, or a new database; the handler answers 503. */
+var HotUpdaterSchemaMigrationRequiredError = class extends Error {
+	adapterName;
+	currentVersion;
+	setting;
+	constructor(adapterName, currentVersion, setting, options) {
+		super(setting !== void 0 ? settingMessage(adapterName, setting) : currentVersion === void 0 ? `Hot Updater database schema is not initialized for ${adapterName}. Run \`hot-updater db migrate\` before using this adapter.` : `Hot Updater v1 cannot migrate schema ${currentVersion} in place. Create a new empty database and run \`hot-updater db migrate\`.`, options);
+		this.adapterName = adapterName;
+		this.currentVersion = currentVersion;
+		this.setting = setting;
+		this.name = "HotUpdaterSchemaMigrationRequiredError";
+	}
+};
+/** Driver codes for a table or column the database lacks. */
+var MISSING_SCHEMA_CODES = /* @__PURE__ */ new Set([
+	"42P01",
+	"42703",
+	"ER_NO_SUCH_TABLE",
+	"ER_BAD_FIELD_ERROR"
+]);
+var MISSING_SCHEMA_MESSAGE = /no such (?:table|column)|(?:relation|column) .+ does not exist|table .+ doesn't exist|unknown column/iu;
+/**
+* Whether a read failed because a table or column is missing, so the
+* database needs migrations. ORMs may wrap the driver's error in `cause`.
+*/
+var isMissingSchemaError = (error) => {
+	for (let depth = 0; error instanceof Object && depth < 8; depth += 1) {
+		const { code, message, cause } = error;
+		if (MISSING_SCHEMA_CODES.has(String(code)) || typeof message === "string" && MISSING_SCHEMA_MESSAGE.test(message)) return true;
+		error = cause;
+	}
+	return false;
+};
+var readSettings = (adapter, keys) => adapter.get(SETTINGS_TABLE, keys.map((key) => [key]));
+/** Throws unless every expected setting is stored with its value: one batch read. */
+var checkSchemaFence = async (adapter, adapterName, expected) => {
+	const keys = Object.keys(expected);
+	let rows;
+	try {
+		rows = await readSettings(adapter, keys);
+	} catch (cause) {
+		if (!isMissingSchemaError(cause)) throw cause;
+		throw new HotUpdaterSchemaMigrationRequiredError(adapterName, void 0, {
+			key: ENGINE_SCHEMA_KEY,
+			expected: "1",
+			found: null
+		}, { cause });
+	}
+	keys.forEach((key, position) => {
+		const found = rows[position]?.value;
+		if (found !== expected[key]) throw new HotUpdaterSchemaMigrationRequiredError(adapterName, void 0, {
+			key,
+			expected: expected[key],
+			found: typeof found === "string" ? found : null
+		});
+	});
+};
+/** The database name a fenced adapter carries, so a server can fence its plugins' rows too. */
+var FENCED = Symbol.for("@hot-updater/server/schema-fence");
+/** The database name an adapter behind the schema fence reports under. */
+var fencedName = (adapter) => adapter[FENCED];
+/**
+* The adapter behind the schema fence: a process's first read or write
+* checks the settings first. Success is kept; a failure is checked again on
+* the next call.
+*/
+var withSchemaFence = (adapter, adapterName, expected) => {
+	let ready;
+	const fence = () => {
+		ready ??= checkSchemaFence(adapter, adapterName, expected).catch((error) => {
+			ready = void 0;
+			throw error;
+		});
+		return ready;
+	};
+	return {
+		...adapter,
+		[FENCED]: adapterName,
+		get: (table, keys) => fence().then(() => adapter.get(table, keys)),
+		query: (table, request) => fence().then(() => adapter.query(table, request)),
+		write: (ops) => fence().then(() => adapter.write(ops)),
+		...adapter.prune && { prune: (table, before, limit) => fence().then(() => adapter.prune(table, before, limit)) }
+	};
+};
+/** A misconfigured `createHotUpdater` call, reported at startup. */
+var HotUpdaterConfigError = class extends Error {
+	name = "HotUpdaterConfigError";
+};
+var EXPORT_NAME = /^[A-Za-z_$][\w$]*$/u;
+/**
+* Names app code cannot import as they are: reserved words, and the names
+* the printed app code declares itself.
+*/
+var UNAVAILABLE_NAMES = /* @__PURE__ */ new Set([
+	"App",
+	"HotUpdater",
+	"arguments",
+	"await",
+	"break",
+	"case",
+	"catch",
+	"class",
+	"const",
+	"continue",
+	"debugger",
+	"default",
+	"delete",
+	"do",
+	"else",
+	"enum",
+	"eval",
+	"export",
+	"extends",
+	"false",
+	"finally",
+	"for",
+	"function",
+	"if",
+	"implements",
+	"import",
+	"in",
+	"instanceof",
+	"interface",
+	"let",
+	"new",
+	"null",
+	"package",
+	"private",
+	"protected",
+	"public",
+	"return",
+	"static",
+	"super",
+	"switch",
+	"this",
+	"throw",
+	"true",
+	"try",
+	"typeof",
+	"var",
+	"void",
+	"while",
+	"with",
+	"yield"
+]);
+var isRecord$5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/**
+* The client plugins an app adds for the plugins, each once, in plugin
+* order: what init prints in `HotUpdater.init`'s `plugins`. A malformed one,
+* or one name from two modules, throws `HotUpdaterConfigError`.
+*/
+var clientPluginsOf = (plugins) => {
+	if (!Array.isArray(plugins)) throw new HotUpdaterConfigError("plugins must be an array of plugins.");
+	const found = [];
+	for (const plugin of plugins) {
+		if (!isRecord$5(plugin) || !isRecord$5(plugin.cli)) continue;
+		const value = plugin.cli.clientPlugin;
+		if (value === void 0) continue;
+		const id = String(plugin.id);
+		if (!isRecord$5(value) || typeof value.module !== "string" || value.module === "" || typeof value.name !== "string" || !EXPORT_NAME.test(value.name) || UNAVAILABLE_NAMES.has(value.name)) throw new HotUpdaterConfigError(`Plugin "${id}" cli.clientPlugin needs a module and an export name the app can import: an identifier other than a reserved word, App, or HotUpdater.`);
+		const { module, name } = value;
+		const named = found.find((entry) => entry.name === name);
+		if (named === void 0) found.push({
+			module,
+			name
+		});
+		else if (named.module !== module) throw new HotUpdaterConfigError(`Plugin "${id}" names the client plugin "${name}" from ${module}, but another plugin names it from ${named.module}.`);
+	}
+	return found;
+};
+resolveSchema([coreModule]);
+/** Each plugin's `schema.<id>` settings row. */
+var pluginSettings = (plugins) => Object.fromEntries(plugins.map(({ id, schemaVersion }) => [`schema.${id}`, schemaVersion]));
+/** A plugin's schema as the engine resolves it: prefixed by its id unless it keeps its names. */
+var pluginModule = ({ id, schema, namespace }) => ({
+	id,
+	schema,
+	...namespace === false ? {} : { namespace: id }
+});
+var PLUGIN_KEYS = /* @__PURE__ */ new Set([
+	"id",
+	"provides",
+	"schemaVersion",
+	"schema",
+	"namespace",
+	"init",
+	"cli"
+]);
+var CLI_KEYS = /* @__PURE__ */ new Set([
+	"commands",
+	"clientCredential",
+	"clientPlugin"
+]);
+var INSTANCE_KEYS = /* @__PURE__ */ new Set([
+	"api",
+	"endpoints",
+	"clientAuth"
+]);
+var METHODS = /* @__PURE__ */ new Set([
+	"GET",
+	"POST",
+	"PUT",
+	"PATCH",
+	"DELETE"
+]);
+/** An id that prefixes table names is a SQL name; one that does not may use camelCase. */
+var PREFIX_ID = /^[a-z][a-z0-9_]*$/u;
+var UNPREFIXED_ID = /^[a-z][A-Za-z0-9_]*$/u;
+var PATH = /^(\/(:?[A-Za-z0-9_.~-]+))+$/u;
+var fail = (message) => {
+	throw new HotUpdaterConfigError(message);
+};
+var isRecord$4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var checkPlugin = (value, at) => {
+	if (!isRecord$4(value)) return fail(`${at} is not a plugin.`);
+	if ("kind" in value) fail(`${at} has a kind; core is built in and is never passed as a plugin.`);
+	const unknown = Object.keys(value).find((key) => !PLUGIN_KEYS.has(key));
+	if (unknown !== void 0) fail(`${at} has an unknown key "${unknown}".`);
+	const plugin = value;
+	if (plugin.namespace !== void 0 && plugin.namespace !== false) fail(`${at} may only set namespace: false.`);
+	const pattern = plugin.namespace === false ? UNPREFIXED_ID : PREFIX_ID;
+	if (typeof plugin.id !== "string" || !pattern.test(plugin.id)) fail(`${at} needs an id matching ${pattern.source}.`);
+	if (plugin.id === coreModule.id) fail(`${at} uses the id "core", which is core's own.`);
+	if (typeof plugin.schemaVersion !== "string" || !isRecord$4(plugin.schema) || typeof plugin.init !== "function") fail(`Plugin "${plugin.id}" needs a schemaVersion, a schema, and init.`);
+	const provides = plugin.provides;
+	if (provides !== void 0 && (!isRecord$4(provides) || Object.entries(provides).some(([key, flag]) => key !== "clientAuth" || flag !== true))) fail(`Plugin "${plugin.id}" may only declare provides: { clientAuth: true }.`);
+	const cli = value.cli;
+	if (cli !== void 0) {
+		if (!isRecord$4(cli) || Object.keys(cli).some((key) => !CLI_KEYS.has(key)) || cli.commands !== void 0 && !Array.isArray(cli.commands)) fail(`Plugin "${plugin.id}" cli may only hold commands (an array), clientCredential, and clientPlugin.`);
+		if (cli.clientCredential !== void 0 && plugin.provides?.clientAuth !== true) fail(`Plugin "${plugin.id}" adds cli.clientCredential without declaring provides: { clientAuth: true }.`);
+	}
+	return plugin;
+};
+var checkEndpoint = (id, value) => {
+	const endpoint = isRecord$4(value) ? value : {};
+	if (!METHODS.has(endpoint.method) || typeof endpoint.path !== "string" || !PATH.test(endpoint.path) || endpoint.access !== "client" && endpoint.access !== "admin" || typeof endpoint.handler !== "function") fail(`Plugin "${id}" has an endpoint that needs a method, a path like /name/:param, access "client" or "admin", and a handler.`);
+	return {
+		...endpoint,
+		plugin: id
+	};
+};
+var checkInstance = (plugin, instance) => {
+	const { id } = plugin;
+	if (!isRecord$4(instance)) return fail(`Plugin "${id}" init returned no instance.`);
+	if (typeof instance.then === "function") fail(`Plugin "${id}" init returned a promise; init must be synchronous.`);
+	const unknown = Object.keys(instance).find((key) => !INSTANCE_KEYS.has(key));
+	if (unknown !== void 0 || !("api" in instance)) fail(`Plugin "${id}" init must return { api, endpoints?, clientAuth? }${unknown === void 0 ? "" : `, not "${unknown}"`}.`);
+	const declared = plugin.provides?.clientAuth === true;
+	const clientAuth = instance.clientAuth;
+	if (declared !== (clientAuth !== void 0)) fail(declared ? `Plugin "${id}" declares provides: { clientAuth: true } but its instance has no clientAuth.` : `Plugin "${id}" returns clientAuth without declaring provides: { clientAuth: true }.`);
+	if (clientAuth !== void 0 && (typeof clientAuth.authenticate !== "function" || !Array.isArray(clientAuth.varyHeaders) || !clientAuth.varyHeaders.every((header) => typeof header === "string"))) fail(`Plugin "${id}" clientAuth needs varyHeaders and authenticate.`);
+	const endpoints = instance.endpoints ?? [];
+	if (!Array.isArray(endpoints)) fail(`Plugin "${id}" endpoints must be an array.`);
+	return {
+		api: instance.api,
+		clientAuth,
+		endpoints: endpoints.map((endpoint) => checkEndpoint(id, endpoint))
+	};
+};
+/**
+* Checks every plugin, runs each `init` once against one engine over the
+* database's storage adapter, and collects APIs, endpoints, and clientAuth.
+* Core's reads run on the same engine, so plugins read core through `ctx.core`.
+*/
+var assemblePlugins = (value, adapter, { now = Date.now, storage = { resolveFileUrl: async () => null }, verify = false, onCachedRoutesChange, batching } = {}) => {
+	if (!Array.isArray(value)) return fail("plugins must be an array of plugins.");
+	const plugins = value.map((plugin, position) => checkPlugin(plugin, `plugins[${position}]`));
+	const ids = /* @__PURE__ */ new Set();
+	for (const { id } of plugins) {
+		if (ids.has(id)) fail(`Plugin "${id}" is registered twice.`);
+		ids.add(id);
+	}
+	clientPluginsOf(plugins);
+	const modules = plugins.map(pluginModule);
+	if (modules.length > 0) validateSchema([coreModule, ...modules]);
+	const name = fencedName(adapter);
+	const fenced = name === void 0 || plugins.length === 0 ? adapter : withSchemaFence(adapter, name, pluginSettings(plugins));
+	const schema = resolveSchema([
+		coreModule,
+		...modules,
+		...batching === void 0 ? [] : [aggregateBatchingModule]
+	]);
+	const engine = createDatabaseEngine({
+		adapter: verify ? fenced : pruneDuringWrites(fenced, schema.tables, {
+			leaseTable: SETTINGS_TABLE,
+			now
+		}),
+		schema,
+		verify,
+		...batching === void 0 ? {} : {
+			batching,
+			now
+		}
+	});
+	const coreDatabase = engine.database(coreModule);
+	const core = createCoreApi(coreDatabase, storage, {
+		now,
+		...onCachedRoutesChange === void 0 ? {} : { onCachedRoutesChange }
+	});
+	const reads = createCoreReads(coreDatabase, storage);
+	const api = {};
+	const endpoints = [];
+	let clientAuth;
+	plugins.forEach((plugin, position) => {
+		const instance = checkInstance(plugin, plugin.init({
+			db: engine.database(modules[position]),
+			core: reads,
+			now
+		}));
+		if (instance.clientAuth !== void 0) {
+			if (clientAuth !== void 0) fail(`Plugins "${clientAuth.plugin}" and "${plugin.id}" both provide clientAuth; keep one.`);
+			const provided = instance.clientAuth;
+			clientAuth = {
+				plugin: plugin.id,
+				varyHeaders: provided.varyHeaders,
+				authenticate: (headers) => provided.authenticate(headers)
+			};
+		}
+		endpoints.push(...instance.endpoints);
+		api[plugin.id] = instance.api;
+	});
+	return {
+		core,
+		api,
+		endpoints,
+		...clientAuth === void 0 ? {} : { clientAuth },
+		...verify ? { measureReads: engine.measureReads } : {},
+		flush: engine.flush
+	};
+};
+function createDatabasePluginApis(database, plugins, options = {}) {
+	const adapter = engineAdapterOf(database);
+	if (adapter === void 0) throw new Error(OFF_ENGINE_DATABASE);
+	const { aggregateBatching } = database;
+	return assemblePlugins(plugins, adapter, {
+		...options,
+		...aggregateBatching === void 0 ? {} : { batching: aggregateBatching }
+	}).api;
+}
+var isOptional = (value, key, valid) => !Object.hasOwn(value, key) || valid(value[key]);
+var isString = (value) => typeof value === "string";
+/** An `UPDATE_FAILED` report's stored failure: a stage and a reason, and what else the client knew. */
+var isDatabaseBundleEventFailure = (value) => isDatabaseJsonObject(value) && isString(value.stage) && isString(value.reason) && isOptional(value, "resource", isString) && isOptional(value, "http_status", (status) => Number.isSafeInteger(status)) && isOptional(value, "transport", isString) && isOptional(value, "origin_code", isString) && isOptional(value, "previous_process_exit", isString);
+var isDatabaseBundleEventMetadata = (value) => isDatabaseJsonObject(value) && typeof value.cohort === "string" && (value.update_strategy === null || value.update_strategy === "fingerprint" || value.update_strategy === "appVersion") && (value.fingerprint_hash === null || typeof value.fingerprint_hash === "string") && (value.sdk_version === null || typeof value.sdk_version === "string") && isOptional(value, "failure", isDatabaseBundleEventFailure) && isOptional(value, "delivery", isString) && isOptional(value, "patch_fallback", (flag) => typeof flag === "boolean") && isOptional(value, "previous_process_exit", isString);
+var isRecord$3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isIdentity$1 = (value) => typeof value === "string" && value.length > 0 && value.length <= 255;
+var isTextOrNull = (value) => value === null || typeof value === "string";
+/** Each bundle event field and what it holds. */
+var BUNDLE_EVENT_FIELDS = {
+	id: (value) => typeof value === "string",
+	type: (value) => value === "UPDATE_DOWNLOADED" || value === "UPDATE_APPLIED" || value === "RECOVERED" || value === "UPDATE_FAILED" || value === "UNCHANGED",
+	install_id: isIdentity$1,
+	user_id: (value) => value === null || isIdentity$1(value),
+	from_bundle_id: isTextOrNull,
+	from_release_id: isTextOrNull,
+	to_release_id: isTextOrNull,
+	to_bundle_id: (value) => typeof value === "string",
+	platform: (value) => value === "ios" || value === "android",
+	app_version: (value) => typeof value === "string",
+	channel: (value) => typeof value === "string",
+	metadata: isDatabaseBundleEventMetadata,
+	received_at_ms: (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0
+};
+var updateStrategyOf = (row) => isRecord$3(row.metadata) ? row.metadata.update_strategy : void 0;
+/**
+* A movement, or a failed update, names the bundle it left and how the
+* device updates, and a failed update says what failed; an unchanged report
+* names neither.
+*/
+var hasEventInvariants = (row) => (row.type === "UPDATE_DOWNLOADED" || row.type === "UPDATE_APPLIED" || row.type === "RECOVERED" || row.type === "UPDATE_FAILED") && typeof row.from_bundle_id === "string" && (updateStrategyOf(row) === "fingerprint" || updateStrategyOf(row) === "appVersion") && (row.type !== "UPDATE_FAILED" || isRecord$3(row.metadata) && isRecord$3(row.metadata.failure)) || row.type === "UNCHANGED" && row.from_bundle_id === null && updateStrategyOf(row) === null;
+/**
+* Throws unless `row` has exactly the bundle event fields, each of its type,
+* and the invariants of its event type: `invalid-field` for an unknown field,
+* `invalid-data` for anything else.
+*/
+var validateBundleEventFields = (row) => {
+	if (!isRecord$3(row)) throw new DatabasePluginInputError("invalid-data");
+	for (const field of Object.keys(row)) if (!Object.hasOwn(BUNDLE_EVENT_FIELDS, field)) throw new DatabasePluginInputError("invalid-field");
+	for (const [field, valid] of Object.entries(BUNDLE_EVENT_FIELDS)) if (!Object.hasOwn(row, field) || !valid(row[field])) throw new DatabasePluginInputError("invalid-data");
+	if (!hasEventInvariants(row)) throw new DatabasePluginInputError("invalid-data");
+};
+var encoder = new TextEncoder();
+/** Exact UTF-8 byte ordering, without case folding or Unicode normalization. */
+var compareInsightsText = (left, right) => {
+	const a = encoder.encode(left);
+	const b = encoder.encode(right);
+	for (let index = 0; index < Math.min(a.length, b.length); index += 1) if (a[index] !== b[index]) return a[index] - b[index];
+	return a.length - b.length;
+};
+var isWellFormedText = (value) => {
+	for (const character of value) {
+		const point = character.codePointAt(0);
+		if (point >= 55296 && point <= 57343) return false;
+	}
+	return true;
+};
+var isIdentity = (value) => typeof value === "string" && value.length > 0 && value.length <= 255 && isWellFormedText(value);
+var isText = (value) => typeof value === "string" && value.length > 0 && isWellFormedText(value);
+var isTimestamp = (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+var isLimit = (value) => isTimestamp(value) && value >= 1 && value <= 101;
+var hasOnlyKeys = (value, keys) => Object.keys(value).every((key) => keys.includes(key));
+var hasScope = (value) => (value.platform === "ios" || value.platform === "android") && isText(value.channel);
+var isBundleFilter = (value, withKind = false) => {
+	if (!isRecord$3(value) || !hasScope(value)) return false;
+	const keys = [
+		"platform",
+		"channel",
+		"type",
+		...withKind ? ["kind"] : []
+	];
+	return value.type === "RECOVERED" ? isText(value.fromBundleId) && hasOnlyKeys(value, [...keys, "fromBundleId"]) : (value.type === "UPDATE_DOWNLOADED" || value.type === "UPDATE_APPLIED" || value.type === "UPDATE_FAILED") && isText(value.toBundleId) && hasOnlyKeys(value, [...keys, "toBundleId"]);
+};
+var isEventFilter = (value) => {
+	if (!isRecord$3(value)) return false;
+	if (value.kind === "all") return hasOnlyKeys(value, ["kind"]);
+	if (value.kind === "installationMovement") return isIdentity(value.installId) && hasOnlyKeys(value, ["kind", "installId"]);
+	return value.kind === "bundle" && isBundleFilter(value, true);
+};
+var validateRow = (model, row, result = false) => {
+	try {
+		validateBundleEventFields(row);
+		if (!isRecord$3(row) || typeof row.id !== "string" || !isUUIDv7(row.id) || [...Object.values(row), ...isRecord$3(row.metadata) ? Object.values(row.metadata) : []].some((value) => typeof value === "string" && !isWellFormedText(value))) throw new DatabasePluginInputError("invalid-data");
+	} catch (error) {
+		if (result) throw new DatabasePluginInputError("invalid-result");
+		throw error;
+	}
+};
+/** Downloads, applies, recoveries, and failed updates belong in installation history. */
+var isInsightsMovementEvent = (event) => event.type === "UPDATE_DOWNLOADED" || event.type === "UPDATE_APPLIED" || event.type === "RECOVERED" || event.type === "UPDATE_FAILED";
+var matchesInsightsEventFilter = (event, filter) => {
+	if (filter.kind === "all") return true;
+	if (filter.kind === "installationMovement") return event.install_id === filter.installId && isInsightsMovementEvent(event);
+	return event.type === filter.type && event.platform === filter.platform && event.channel === filter.channel && (filter.type === "RECOVERED" ? event.from_bundle_id === filter.fromBundleId : event.to_bundle_id === filter.toBundleId && event.metadata.failure?.stage !== "check");
+};
+var invalidQuery = () => {
+	throw new DatabasePluginInputError("invalid-query");
+};
+var invalidResult = () => {
+	throw new DatabasePluginInputError("invalid-result");
+};
+var validateCount = (count) => isTimestamp(count) ? count : invalidResult();
+var isTimeRange = (value) => isRecord$3(value) && hasOnlyKeys(value, ["start", "end"]) && isTimestamp(value.start) && isTimestamp(value.end) && value.start < value.end;
+var isReleaseReference = (value) => isRecord$3(value) && hasOnlyKeys(value, [
+	"releaseId",
+	"platform",
+	"channel"
+]) && isIdentity(value.releaseId) && hasScope(value);
+var validateAggregateResult = (value) => {
+	const result = isRecord$3(value) ? value : invalidResult();
+	if (!isTimestamp(result.measuredAtMs)) invalidResult();
+	const coverage = result.coverage;
+	if (!isRecord$3(coverage) || coverage.kind !== "complete" && coverage.kind !== "partial" || coverage.sinceMs !== null && !isTimestamp(coverage.sinceMs)) invalidResult();
+};
+/** Validate custom and bundled providers at the same public boundary. */
+var createValidatedInsightsModel = (model) => ({
+	async recordEvent(input) {
+		if (!isRecord$3(input) || !hasOnlyKeys(input, ["event"])) throw new DatabasePluginInputError("invalid-data");
+		validateRow("bundle_events", input.event);
+		await model.recordEvent(input);
+	},
+	async listEvents(input) {
+		if (!isRecord$3(input) || !hasOnlyKeys(input, [
+			"filter",
+			"sinceMs",
+			"beforeReceivedAtMs",
+			"after",
+			"limit"
+		]) || !isEventFilter(input.filter) || !isLimit(input.limit) || !isTimestamp(input.beforeReceivedAtMs) || input.sinceMs !== void 0 && !isTimestamp(input.sinceMs)) invalidQuery();
+		const sinceMs = input.sinceMs ?? 0;
+		if (sinceMs > input.beforeReceivedAtMs || input.after !== void 0 && (!isRecord$3(input.after) || !hasOnlyKeys(input.after, ["receivedAtMs", "id"]) || !isTimestamp(input.after.receivedAtMs) || typeof input.after.id !== "string" || !isUUIDv7(input.after.id) || input.after.receivedAtMs < sinceMs || input.after.receivedAtMs >= input.beforeReceivedAtMs)) invalidQuery();
+		const rows = await model.listEvents(input);
+		if (!Array.isArray(rows) || rows.length > input.limit) invalidResult();
+		let previous = input.after;
+		for (const row of rows) {
+			validateRow("bundle_events", row, true);
+			if (row.received_at_ms < sinceMs || row.received_at_ms >= input.beforeReceivedAtMs || !matchesInsightsEventFilter(row, input.filter) || previous !== void 0 && (row.received_at_ms > previous.receivedAtMs || row.received_at_ms === previous.receivedAtMs && row.id >= previous.id)) invalidResult();
+			previous = {
+				receivedAtMs: row.received_at_ms,
+				id: row.id
+			};
+		}
+		return rows;
+	},
+	async findLatestEvents(input) {
+		if (!isRecord$3(input)) invalidQuery();
+		if ("installId" in input) {
+			if (!hasOnlyKeys(input, ["installId"]) || !isIdentity(input.installId)) invalidQuery();
+		} else if (!hasOnlyKeys(input, [
+			"userId",
+			"afterInstallId",
+			"limit"
+		]) || !isIdentity(input.userId) || !isLimit(input.limit) || input.afterInstallId !== void 0 && !isIdentity(input.afterInstallId)) invalidQuery();
+		const rows = await model.findLatestEvents(input);
+		if (!Array.isArray(rows) || rows.length > ("installId" in input ? 1 : input.limit)) invalidResult();
+		let previous = "installId" in input ? void 0 : input.afterInstallId;
+		for (const row of rows) {
+			validateRow("bundle_events", row, true);
+			if ("installId" in input ? row.install_id !== input.installId : row.user_id !== input.userId || previous !== void 0 && compareInsightsText(row.install_id, previous) <= 0) invalidResult();
+			previous = row.install_id;
+		}
+		return rows;
+	},
+	async countLatestEvents(input) {
+		if (!isRecord$3(input) || !hasOnlyKeys(input, [
+			"platform",
+			"channel",
+			"sinceMs",
+			"bundle"
+		]) || !hasScope(input) || !isTimestamp(input.sinceMs) || input.bundle !== void 0 && (!Array.isArray(input.bundle) || input.bundle.length < 1 || input.bundle.length > 2 || input.bundle.some((bundle) => !isRecord$3(bundle) || !hasOnlyKeys(bundle, [
+			"field",
+			"value",
+			"types"
+		]) || bundle.field !== "from_bundle_id" && bundle.field !== "to_bundle_id" || !isText(bundle.value) || !Array.isArray(bundle.types) || bundle.types.length === 0 || bundle.types.some((type) => ![
+			"UNCHANGED",
+			"UPDATE_DOWNLOADED",
+			"UPDATE_APPLIED",
+			"RECOVERED"
+		].includes(type))))) invalidQuery();
+		return validateCount(await model.countLatestEvents(input));
+	},
+	async countEvents(input) {
+		if (!isRecord$3(input) || !hasOnlyKeys(input, [
+			"filter",
+			"sinceMs",
+			"beforeReceivedAtMs"
+		]) || !isBundleFilter(input.filter) || !isTimestamp(input.sinceMs) || !isTimestamp(input.beforeReceivedAtMs) || input.sinceMs > input.beforeReceivedAtMs) invalidQuery();
+		return validateCount(await model.countEvents(input));
+	},
+	async getReleaseActivity(input) {
+		if (!isRecord$3(input) || !hasOnlyKeys(input, [
+			"releases",
+			"scope",
+			"timeRange"
+		])) invalidQuery();
+		const releases = input.releases;
+		const scope = input.scope;
+		const timeRange = input.timeRange;
+		const releaseQuery = Array.isArray(releases) && releases.length > 0 && releases.length <= 100 && releases.every(isReleaseReference) && scope === void 0 && (timeRange === void 0 || isTimeRange(timeRange));
+		const scopeQuery = releases === void 0 && isRecord$3(scope) && hasOnlyKeys(scope, ["platform", "channel"]) && hasScope(scope) && isTimeRange(timeRange);
+		if (!releaseQuery && !scopeQuery) invalidQuery();
+		const result = await model.getReleaseActivity(input);
+		validateAggregateResult(result);
+		if (!Array.isArray(result.data)) invalidResult();
+		return result;
+	},
+	async getAppUsage(input) {
+		if (!isRecord$3(input) || !hasOnlyKeys(input, [
+			"channel",
+			"platform",
+			"appVersion",
+			"timeRange",
+			"intervalMs"
+		]) || !isText(input.channel) || ![
+			"all",
+			"ios",
+			"android"
+		].includes(input.platform) || input.appVersion !== void 0 && !isText(input.appVersion) || !isTimeRange(input.timeRange) || !isTimestamp(input.intervalMs) || input.intervalMs < 36e5) invalidQuery();
+		const result = await model.getAppUsage(input);
+		validateAggregateResult(result);
+		if (!isTimestamp(result.activeInstallations) || !Array.isArray(result.points) || !Array.isArray(result.appVersions) || !Array.isArray(result.versions) || !Array.isArray(result.platforms) || !Array.isArray(result.bundleDistribution)) invalidResult();
+		return result;
+	}
+});
+/**
+* The plugin's API as `InsightsModel`, validated at its boundary: what the
+* Insights routes, the console, and the e2e harness read through.
+*/
+var createInsightsModel = (api) => createValidatedInsightsModel({
+	recordEvent: ({ event }) => api.recordEvent(event),
+	listEvents: api.listEvents,
+	findLatestEvents: api.findLatestEvents,
+	countLatestEvents: api.countLatestEvents,
+	countEvents: api.countEvents,
+	getReleaseActivity: api.getReleaseActivity,
+	getAppUsage: api.getAppUsage
+});
+var InsightsBadRequestError = class extends Error {
+	name = "InsightsBadRequestError";
+};
+var MAX_EVENT_STRING_LENGTH = 1024;
+var MAX_IDENTITY_LENGTH$1 = 255;
+function isRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function requireStringField(payload, key) {
+	const value = payload[key];
+	if (typeof value !== "string" || value.length === 0 || value.length > MAX_EVENT_STRING_LENGTH || new TextDecoder("utf-8", { ignoreBOM: true }).decode(new TextEncoder().encode(value)) !== value) throw new InsightsBadRequestError(`Invalid event field: ${key}`);
+	return value;
+}
+function requireNullableStringField(payload, key) {
+	if (payload[key] === null) return null;
+	return requireStringField(payload, key);
+}
+function requireIdentityField(payload, key) {
+	const value = requireStringField(payload, key);
+	if (value.length > MAX_IDENTITY_LENGTH$1) throw new InsightsBadRequestError(`Invalid event field: ${key}`);
+	return value;
+}
+/**
+* The report's idempotency key, when the client sends one: it creates the
+* UUIDv7 once and repeats it on every retry of that report.
+*/
+function readEventId(payload) {
+	const value = payload.eventId;
+	if (value === void 0) return void 0;
+	if (!isUUIDv7(value)) throw new InsightsBadRequestError("Invalid event field: eventId");
+	return value;
+}
+/** One value of an open set: any other value reads as `unknown`. */
+var oneOf = (values, value) => values.includes(value) ? value : "unknown";
+var STAGES = [
+	"check",
+	"download",
+	"install"
+];
+var REASONS = [
+	"network",
+	"http",
+	"invalid_response",
+	"hash_mismatch",
+	"signature",
+	"patch",
+	"extract",
+	"storage"
+];
+var RESOURCES = [
+	"catalog",
+	"artifact",
+	"manifest",
+	"file",
+	"patch",
+	"archive"
+];
+var TRANSPORTS = [
+	"timeout",
+	"dns",
+	"tls",
+	"connection",
+	"offline",
+	"cancelled"
+];
+var DELIVERIES = [
+	"patch",
+	"manifest",
+	"archive"
+];
+/** A storage error code or an Android exit reason: letters, digits, and `._-`. */
+var CODE = /^[A-Za-z0-9._-]{1,64}$/;
+var readCode = (value) => typeof value === "string" && CODE.test(value) ? value : void 0;
+var readMetadata = (payload) => isRecord$2(payload.metadata) ? payload.metadata : {};
+/**
+* What an UPDATE_FAILED report says failed. It never refuses the report: an
+* unknown value of a set reads as `unknown`, a missing or malformed failure
+* as an unknown stage and reason, and a malformed optional field is left out,
+* as is a null one.
+*/
+function readFailure(value) {
+	const failure = isRecord$2(value) ? value : {};
+	const httpStatus = failure.httpStatus;
+	const originCode = readCode(failure.originCode);
+	const previousProcessExit = readCode(failure.previousProcessExit);
+	return {
+		stage: oneOf(STAGES, failure.stage),
+		reason: oneOf(REASONS, failure.reason),
+		...failure.resource == null ? {} : { resource: oneOf(RESOURCES, failure.resource) },
+		...Number.isSafeInteger(httpStatus) && httpStatus >= 100 && httpStatus <= 599 ? { httpStatus } : {},
+		...failure.transport == null ? {} : { transport: oneOf(TRANSPORTS, failure.transport) },
+		...originCode === void 0 ? {} : { originCode },
+		...previousProcessExit === void 0 ? {} : { previousProcessExit }
+	};
+}
+function requireEvent(payload) {
+	if (!isRecord$2(payload)) throw new InsightsBadRequestError("Invalid event payload");
+	const platform = requireStringField(payload, "platform");
+	if (platform !== "ios" && platform !== "android") throw new InsightsBadRequestError("Invalid event field: platform");
+	const eventId = readEventId(payload);
+	const base = {
+		...eventId === void 0 ? {} : { eventId },
+		installId: requireIdentityField(payload, "installId"),
+		toBundleId: requireStringField(payload, "toBundleId"),
+		...payload.userId === void 0 ? {} : { userId: requireIdentityField(payload, "userId") },
+		platform,
+		appVersion: requireStringField(payload, "appVersion"),
+		channel: requireStringField(payload, "channel"),
+		cohort: requireStringField(payload, "cohort"),
+		fingerprintHash: requireNullableStringField(payload, "fingerprintHash"),
+		sdkVersion: payload.sdkVersion === void 0 ? null : requireNullableStringField(payload, "sdkVersion"),
+		fromReleaseId: requireNullableStringField(payload, "fromReleaseId"),
+		toReleaseId: requireNullableStringField(payload, "toReleaseId")
+	};
+	const type = requireStringField(payload, "type");
+	const movement = () => {
+		const updateStrategy = requireStringField(payload, "updateStrategy");
+		if (updateStrategy !== "fingerprint" && updateStrategy !== "appVersion") throw new InsightsBadRequestError("Invalid event field: updateStrategy");
+		return {
+			...base,
+			fromBundleId: requireStringField(payload, "fromBundleId"),
+			updateStrategy
+		};
+	};
+	const metadata = readMetadata(payload);
+	switch (type) {
+		case "UPDATE_DOWNLOADED": {
+			const delivery = metadata.delivery;
+			const read = {
+				...delivery == null ? {} : { delivery: oneOf(DELIVERIES, delivery) },
+				...metadata.patchFallback === true ? { patchFallback: true } : {}
+			};
+			return {
+				...movement(),
+				type,
+				...Object.keys(read).length === 0 ? {} : { metadata: read }
+			};
+		}
+		case "UPDATE_APPLIED": return {
+			...movement(),
+			type
+		};
+		case "RECOVERED": {
+			const previousProcessExit = readCode(metadata.previousProcessExit);
+			return {
+				...movement(),
+				type,
+				...previousProcessExit === void 0 ? {} : { metadata: { previousProcessExit } }
+			};
+		}
+		case "UPDATE_FAILED": return {
+			...movement(),
+			type,
+			metadata: { failure: readFailure(metadata.failure) }
+		};
+		case "UNCHANGED":
+			if (payload.fromBundleId !== null || payload.updateStrategy !== null) throw new InsightsBadRequestError("Invalid unchanged event shape");
+			return {
+				...base,
+				type,
+				fromBundleId: null,
+				updateStrategy: null
+			};
+		default: throw new InsightsBadRequestError("Invalid event field: type");
+	}
+}
+function createBundleEventRow(input) {
+	input = requireEvent(input);
+	const base = {
+		app_version: input.appVersion,
+		channel: input.channel,
+		from_release_id: input.fromReleaseId,
+		id: input.eventId ?? createUUIDv7(),
+		install_id: input.installId,
+		platform: input.platform,
+		received_at_ms: Date.now(),
+		to_bundle_id: input.toBundleId,
+		to_release_id: input.toReleaseId,
+		user_id: input.userId ?? null
+	};
+	const metadata = {
+		cohort: input.cohort,
+		fingerprint_hash: input.fingerprintHash,
+		sdk_version: input.sdkVersion ?? null,
+		update_strategy: input.updateStrategy
+	};
+	switch (input.type) {
+		case "UPDATE_DOWNLOADED": {
+			const { delivery, patchFallback } = input.metadata ?? {};
+			return {
+				...base,
+				from_bundle_id: input.fromBundleId,
+				type: input.type,
+				metadata: {
+					...metadata,
+					...delivery === void 0 ? {} : { delivery },
+					...patchFallback ? { patch_fallback: true } : {}
+				}
+			};
+		}
+		case "UPDATE_APPLIED": return {
+			...base,
+			from_bundle_id: input.fromBundleId,
+			type: input.type,
+			metadata
+		};
+		case "RECOVERED": {
+			const exit = input.metadata?.previousProcessExit;
+			return {
+				...base,
+				from_bundle_id: input.fromBundleId,
+				type: input.type,
+				metadata: {
+					...metadata,
+					...exit === void 0 ? {} : { previous_process_exit: exit }
+				}
+			};
+		}
+		case "UPDATE_FAILED": {
+			const { failure } = input.metadata;
+			return {
+				...base,
+				from_bundle_id: input.fromBundleId,
+				type: input.type,
+				metadata: {
+					...metadata,
+					failure: {
+						stage: failure.stage,
+						reason: failure.reason,
+						...failure.resource === void 0 ? {} : { resource: failure.resource },
+						...failure.httpStatus === void 0 ? {} : { http_status: failure.httpStatus },
+						...failure.transport === void 0 ? {} : { transport: failure.transport },
+						...failure.originCode === void 0 ? {} : { origin_code: failure.originCode },
+						...failure.previousProcessExit === void 0 ? {} : { previous_process_exit: failure.previousProcessExit }
+					}
+				}
+			};
+		}
+		case "UNCHANGED": return {
+			...base,
+			from_bundle_id: null,
+			type: input.type,
+			metadata
+		};
+	}
+}
+var DEFAULT_PAGE_LIMIT = 50;
+var MAX_PAGE_LIMIT = 100;
+var MAX_EVENT_ID_LENGTH = 1024;
+var MAX_IDENTITY_LENGTH = 255;
+var MAX_CURSOR_LENGTH = 8192;
+var HOUR_MS = 36e5;
+var DAY_MS = 24 * HOUR_MS;
+var WINDOW_MS = {
+	"24h": 864e5,
+	"7d": 6048e5,
+	"30d": 2592e6
+};
+/**
+* The longest receipt range, `[sinceMs, beforeReceivedAtMs)`, of a global or
+* bundle event list, and the range one covers without `sinceMs`: raw events
+* are listed inside a time range, as analytics products list them. It is a
+* duration, so a range that ends mid-day touches 91 UTC days. Installation
+* history is one index range and reads back to `sinceMs`.
+*/
+var EVENT_LIST_RANGE_MS = 2160 * HOUR_MS;
+var isRecord$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var requireString = (value, label, maximumLength) => {
+	if (typeof value !== "string" || value.length === 0 || value.length > maximumLength || new TextDecoder("utf-8", { ignoreBOM: true }).decode(new TextEncoder().encode(value)) !== value) throw new InsightsBadRequestError(`Invalid ${label}.`);
+	return value;
+};
+var requireTimestamp = (value, label) => {
+	if (!Number.isSafeInteger(value) || Number(value) < 0) throw new InsightsBadRequestError(`Invalid ${label}.`);
+	return Number(value);
+};
+var readLimit = (value) => {
+	const limit = value ?? DEFAULT_PAGE_LIMIT;
+	if (!Number.isSafeInteger(limit) || limit < 1 || limit > MAX_PAGE_LIMIT) throw new InsightsBadRequestError("Invalid page limit.");
+	return limit;
+};
+var encodeBase64Url = (value) => {
+	const bytes = new TextEncoder().encode(value);
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
+};
+var decodeBase64Url = (value) => {
+	if (value.length === 0 || value.length > MAX_CURSOR_LENGTH) throw new InsightsBadRequestError("Invalid Insights cursor.");
+	try {
+		const base64 = value.replaceAll("-", "+").replaceAll("_", "/");
+		const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, "=");
+		const binary = atob(padded);
+		const bytes = Uint8Array.from(binary, (character) => character.charCodeAt(0));
+		return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+	} catch {
+		throw new InsightsBadRequestError("Invalid Insights cursor.");
+	}
+};
+var encodeCursor = (value) => encodeBase64Url(JSON.stringify(value));
+var decodeCursor = (value) => {
+	try {
+		return JSON.parse(decodeBase64Url(value));
+	} catch (error) {
+		if (error instanceof InsightsBadRequestError) throw error;
+		throw new InsightsBadRequestError("Invalid Insights cursor.");
+	}
+};
+var readScope = (input) => {
+	if (input.platform !== "ios" && input.platform !== "android") throw new InsightsBadRequestError("Invalid Insights platform.");
+	return {
+		platform: input.platform,
+		channel: requireString(input.channel, "channel", MAX_EVENT_ID_LENGTH)
+	};
+};
+var bundleFilter = (input) => {
+	const scope = readScope(input);
+	const bundleId = requireString(input.bundleId, "bundle ID", MAX_EVENT_ID_LENGTH);
+	switch (input.outcome) {
+		case "downloaded": return {
+			...scope,
+			type: "UPDATE_DOWNLOADED",
+			toBundleId: bundleId
+		};
+		case "applied": return {
+			...scope,
+			type: "UPDATE_APPLIED",
+			toBundleId: bundleId
+		};
+		case "recovered": return {
+			...scope,
+			type: "RECOVERED",
+			fromBundleId: bundleId
+		};
+		case "failed": return {
+			...scope,
+			type: "UPDATE_FAILED",
+			toBundleId: bundleId
+		};
+		default: throw new InsightsBadRequestError("Invalid Insights outcome.");
+	}
+};
+var sameFilter = (left, right) => {
+	if (!isRecord$1(left) || left.kind !== right.kind) return false;
+	switch (right.kind) {
+		case "all": return true;
+		case "installationMovement": return left.installId === right.installId;
+		case "bundle": return left.platform === right.platform && left.channel === right.channel && left.type === right.type && (right.type === "RECOVERED" ? left.fromBundleId === right.fromBundleId : left.toBundleId === right.toBundleId);
+	}
+};
+var readEventCursor = (value, filter) => {
+	const cursor = decodeCursor(value);
+	if (!isRecord$1(cursor) || cursor.version !== 2 || cursor.kind !== "events" || !isRecord$1(cursor.filter) || !isRecord$1(cursor.after)) throw new InsightsBadRequestError("Invalid Insights cursor.");
+	if (!sameFilter(cursor.filter, filter)) throw new InsightsBadRequestError("Insights cursor does not match the requested events.");
+	if (typeof cursor.after.id !== "string" || !isUUIDv7(cursor.after.id)) throw new InsightsBadRequestError("Invalid Insights event cursor ID.");
+	return {
+		after: {
+			id: cursor.after.id,
+			receivedAtMs: requireTimestamp(cursor.after.receivedAtMs, "event cursor")
+		},
+		beforeReceivedAtMs: requireTimestamp(cursor.beforeReceivedAtMs, "event cutoff"),
+		kind: "events",
+		sinceMs: requireTimestamp(cursor.sinceMs, "event start"),
+		filter,
+		version: 2
+	};
+};
+var readUserInstallationCursor = (value, userId) => {
+	const cursor = decodeCursor(value);
+	if (!isRecord$1(cursor) || cursor.version !== 1 || cursor.kind !== "user-installations" || cursor.userId !== userId) throw new InsightsBadRequestError("Insights cursor does not match the requested user ID.");
+	return {
+		afterInstallId: requireString(cursor.afterInstallId, "installation cursor", MAX_IDENTITY_LENGTH),
+		kind: "user-installations",
+		userId,
+		version: 1
+	};
+};
+var compareEventNewest = (left, right) => right.received_at_ms - left.received_at_ms || compareInsightsText(right.id, left.id);
+var isAfterEventCursor = (row, after) => row.received_at_ms < after.receivedAtMs || row.received_at_ms === after.receivedAtMs && compareInsightsText(row.id, after.id) < 0;
+var assertEventRows = (rows, input) => {
+	if (rows.length > input.limit) throw new Error("Insights database returned too many event rows.");
+	for (let index = 0; index < rows.length; index += 1) {
+		const row = rows[index];
+		const previous = rows[index - 1];
+		if (!row || typeof row.id !== "string" || !isUUIDv7(row.id) || !Number.isSafeInteger(row.received_at_ms) || row.received_at_ms >= input.beforeReceivedAtMs || row.received_at_ms < input.sinceMs || previous !== void 0 && compareEventNewest(previous, row) >= 0 || input.after !== void 0 && !isAfterEventCursor(row, input.after) || input.filter.kind === "installationMovement" && (row.install_id !== input.filter.installId || !isInsightsMovementEvent(row)) || input.filter.kind === "bundle" && (row.platform !== input.filter.platform || row.channel !== input.filter.channel || row.type !== input.filter.type || (input.filter.type === "RECOVERED" ? row.from_bundle_id !== input.filter.fromBundleId : row.to_bundle_id !== input.filter.toBundleId))) throw new Error("Insights database returned invalid event rows.");
+	}
+};
+/** An `UPDATE_FAILED` row's failure, as the event lists show it. */
+var toFailure = (failure) => ({
+	stage: failure.stage,
+	reason: failure.reason,
+	...failure.resource === void 0 ? {} : { resource: failure.resource },
+	...failure.http_status === void 0 ? {} : { httpStatus: failure.http_status },
+	...failure.transport === void 0 ? {} : { transport: failure.transport },
+	...failure.origin_code === void 0 ? {} : { originCode: failure.origin_code },
+	...failure.previous_process_exit === void 0 ? {} : { previousProcessExit: failure.previous_process_exit }
+});
+/** What a row's metadata adds for its type: a failure, a delivery, an exit reason. */
+var eventDetails = ({ type, metadata }) => ({
+	...type === "UPDATE_FAILED" && metadata.failure !== void 0 ? { failure: toFailure(metadata.failure) } : {},
+	...type === "UPDATE_DOWNLOADED" && metadata.delivery !== void 0 ? { delivery: metadata.delivery } : {},
+	...type === "UPDATE_DOWNLOADED" && metadata.patch_fallback === true ? { patchFallback: true } : {},
+	...type === "RECOVERED" && metadata.previous_process_exit !== void 0 ? { previousProcessExit: metadata.previous_process_exit } : {}
+});
+var toEventHistoryRow = (row) => ({
+	appVersion: row.app_version,
+	channel: row.channel,
+	cohort: row.metadata.cohort,
+	fromBundleId: row.from_bundle_id,
+	id: row.id,
+	installId: row.install_id,
+	platform: row.platform,
+	receivedAtMs: row.received_at_ms,
+	toBundleId: row.to_bundle_id,
+	type: row.type,
+	userId: row.user_id,
+	...eventDetails(row)
+});
+var toInstallationRow = (row) => ({
+	appVersion: row.app_version,
+	channel: row.channel,
+	cohort: row.metadata.cohort,
+	installId: row.install_id,
+	lastKnownBundleId: row.type === "UPDATE_DOWNLOADED" ? row.from_bundle_id : row.to_bundle_id,
+	pendingBundleId: row.type === "UPDATE_DOWNLOADED" ? row.to_bundle_id : null,
+	pendingReleaseId: row.type === "UPDATE_DOWNLOADED" ? row.to_release_id : null,
+	latestStatus: row.type,
+	platform: row.platform,
+	receivedAtMs: row.received_at_ms,
+	userId: row.user_id
+});
+/**
+* Where a list without `sinceMs` starts: 90 days before its cutoff for the
+* global and bundle lists, at the first event for installation history.
+*/
+var defaultEventStart = (filter, beforeReceivedAtMs) => filter.kind === "installationMovement" ? 0 : Math.max(0, beforeReceivedAtMs - EVENT_LIST_RANGE_MS);
+/** Whether a cursor's row lies inside the list's range. */
+var isInsideBounds = ({ after }, bounds) => after.receivedAtMs >= bounds.sinceMs && after.receivedAtMs < bounds.beforeReceivedAtMs;
+/** A page's range: its cursor's, which the request may repeat but not change. */
+var readEventBounds = (input, cursor, filter) => {
+	const beforeReceivedAtMs = cursor?.beforeReceivedAtMs ?? (input.beforeReceivedAtMs === void 0 ? Date.now() : requireTimestamp(input.beforeReceivedAtMs, "event cutoff"));
+	if (cursor !== void 0 && input.beforeReceivedAtMs !== void 0 && input.beforeReceivedAtMs !== beforeReceivedAtMs) throw new InsightsBadRequestError("Insights cursor does not match the requested event cutoff.");
+	const sinceMs = cursor?.sinceMs ?? (input.sinceMs === void 0 ? defaultEventStart(filter, beforeReceivedAtMs) : requireTimestamp(input.sinceMs, "event start"));
+	const bounds = {
+		beforeReceivedAtMs,
+		sinceMs
+	};
+	if (sinceMs > beforeReceivedAtMs || input.sinceMs !== void 0 && input.sinceMs !== sinceMs || cursor !== void 0 && !isInsideBounds(cursor, bounds)) throw new InsightsBadRequestError("Insights cursor or range does not match the requested event start.");
+	if (filter.kind !== "installationMovement" && beforeReceivedAtMs - sinceMs > 7776e6) throw new InsightsBadRequestError("Insights event lists cover at most 90 days: send a sinceMs no more than 90 days before beforeReceivedAtMs.");
+	return bounds;
+};
+var pageEventRows = async (model, input, filter, map) => {
+	const limit = readLimit(input.limit);
+	const cursor = input.cursor === void 0 ? void 0 : readEventCursor(input.cursor, filter);
+	const bounds = readEventBounds(input, cursor, filter);
+	const query = {
+		filter,
+		...bounds,
+		...cursor === void 0 ? {} : { after: cursor.after },
+		limit
+	};
+	const rows = await model.listEvents(query);
+	assertEventRows(rows, query);
+	const last = rows.at(-1);
+	return {
+		beforeReceivedAtMs: bounds.beforeReceivedAtMs,
+		data: rows.map(map),
+		nextCursor: rows.length === limit && last ? encodeCursor({
+			after: {
+				id: last.id,
+				receivedAtMs: last.received_at_ms
+			},
+			...bounds,
+			kind: "events",
+			filter,
+			version: 2
+		}) : null
+	};
+};
+var assertInstallationRows = (rows, input) => {
+	if (rows.length > input.limit) throw new Error("Insights database returned too many installation rows.");
+	for (let index = 0; index < rows.length; index += 1) {
+		const row = rows[index];
+		const previous = rows[index - 1];
+		if (!row || row.user_id !== input.userId || input.afterInstallId !== void 0 && compareInsightsText(row.install_id, input.afterInstallId) <= 0 || previous !== void 0 && compareInsightsText(previous.install_id, row.install_id) >= 0) throw new Error("Insights database returned invalid installation rows.");
+	}
+};
+var createInsightsProvider = (model) => Object.freeze({
+	async appendBundleEvent(input) {
+		const event = createBundleEventRow(input);
+		await model.recordEvent({ event });
+	},
+	listEvents(input) {
+		return pageEventRows(model, input, input.bundle === void 0 ? { kind: "all" } : {
+			kind: "bundle",
+			...bundleFilter(input.bundle)
+		}, toEventHistoryRow);
+	},
+	async listInstallationEvents(input) {
+		if ("bundle" in input && input.bundle !== void 0) throw new InsightsBadRequestError("Installation movement queries cannot include a bundle filter.");
+		return pageEventRows(model, input, {
+			kind: "installationMovement",
+			installId: requireString(input.installId, "install ID", MAX_IDENTITY_LENGTH)
+		}, (row) => toEventHistoryRow(row));
+	},
+	async getInstallation({ installId }) {
+		const normalizedInstallId = requireString(installId, "install ID", MAX_IDENTITY_LENGTH);
+		const rows = await model.findLatestEvents({ installId: normalizedInstallId });
+		const row = rows[0] ?? null;
+		if (rows.length > 1 || row !== null && row.install_id !== normalizedInstallId) throw new Error("Insights database returned an invalid installation.");
+		return row === null ? null : toInstallationRow(row);
+	},
+	async pageInstallationsByCurrentUserId(input) {
+		const userId = requireString(input.userId, "user ID", MAX_IDENTITY_LENGTH);
+		const limit = readLimit(input.limit);
+		const cursor = input.cursor === void 0 ? void 0 : readUserInstallationCursor(input.cursor, userId);
+		const databaseInput = {
+			userId,
+			...cursor === void 0 ? {} : { afterInstallId: cursor.afterInstallId },
+			limit
+		};
+		const rows = await model.findLatestEvents(databaseInput);
+		assertInstallationRows(rows, databaseInput);
+		const last = rows.at(-1);
+		return {
+			data: rows.map(toInstallationRow),
+			nextCursor: rows.length === limit && last ? encodeCursor({
+				afterInstallId: last.install_id,
+				kind: "user-installations",
+				userId,
+				version: 1
+			}) : null
+		};
+	},
+	async getReportingOverview(input) {
+		const scope = readScope(input);
+		const { window } = input;
+		if (!Object.hasOwn(WINDOW_MS, window)) throw new InsightsBadRequestError("Invalid reporting installation window.");
+		const now = Date.now();
+		const beforeReceivedAtMs = now - now % HOUR_MS + (now % HOUR_MS === 0 ? 0 : HOUR_MS);
+		const reach = Math.max(0, beforeReceivedAtMs - WINDOW_MS[window]);
+		const sinceMs = reach - reach % DAY_MS;
+		const measure = async (count) => {
+			const value = await count;
+			if (!Number.isSafeInteger(value) || value < 0) throw new Error("Insights database returned an invalid count.");
+			return {
+				count: value,
+				measuredAtMs: Date.now()
+			};
+		};
+		const bundleId = input.bundleId === void 0 ? void 0 : requireString(input.bundleId, "bundle ID", MAX_EVENT_ID_LENGTH);
+		const reporting = measure(model.countLatestEvents({
+			...scope,
+			sinceMs
+		}));
+		if (bundleId === void 0) return {
+			...scope,
+			window,
+			sinceMs,
+			beforeReceivedAtMs,
+			reportingInstallations: await reporting
+		};
+		const countOutcome = (outcome) => measure(model.countEvents({
+			filter: bundleFilter({
+				...scope,
+				bundleId,
+				outcome
+			}),
+			sinceMs,
+			beforeReceivedAtMs
+		}));
+		const [reportingInstallations, bundleInstallations, downloadedReports, appliedReports, recoveredReports, failedReports] = await Promise.all([
+			reporting,
+			measure(model.countLatestEvents({
+				...scope,
+				sinceMs,
+				bundle: [{
+					field: "from_bundle_id",
+					value: bundleId,
+					types: ["UPDATE_DOWNLOADED"]
+				}, {
+					field: "to_bundle_id",
+					value: bundleId,
+					types: [
+						"UNCHANGED",
+						"UPDATE_APPLIED",
+						"RECOVERED"
+					]
+				}]
+			})),
+			countOutcome("downloaded"),
+			countOutcome("applied"),
+			countOutcome("recovered"),
+			countOutcome("failed")
+		]);
+		return {
+			...scope,
+			window,
+			sinceMs,
+			beforeReceivedAtMs,
+			reportingInstallations,
+			bundle: {
+				bundleId,
+				reportingInstallations: bundleInstallations,
+				downloadedReports,
+				appliedReports,
+				recoveredReports,
+				failedReports
+			}
+		};
+	}
+});
+/** The `error` a failed admin route answered with, or a message naming its status. */
+var errorOf = async (response, path) => {
+	const body = await response.json().catch(() => null);
+	return new Error(typeof body === "object" && body !== null && typeof Reflect.get(body, "error") === "string" ? String(Reflect.get(body, "error")) : `The server answered ${path.split("?")[0]} with ${response.status}.`);
+};
+var withQuery = (path, input) => {
+	const query = new URLSearchParams();
+	for (const [key, value] of Object.entries(input)) if (value !== void 0) query.set(key, String(value));
+	const value = query.toString();
+	return value.length === 0 ? path : `${path}?${value}`;
+};
+var eventQuery = ({ beforeReceivedAtMs, sinceMs, cursor, limit }) => ({
+	beforeReceivedAtMs,
+	sinceMs,
+	cursor,
+	limit
+});
+/**
+* A self-hosted server's Insights, read through the admin routes its
+* `insights()` plugin serves.
+*/
+var createAdminInsightsReads = (fetchAdmin) => {
+	const read = async (path) => {
+		const response = await fetchAdmin(path);
+		if (response.status === 404) return null;
+		if (!response.ok) throw await errorOf(response, path);
+		return await response.json();
+	};
+	const required = async (path) => {
+		const value = await read(path);
+		if (value === null) throw new ConsoleFeatureUnavailableError("insights", { remote: true });
+		return value;
+	};
+	return {
+		getReportingOverview: ({ platform, channel, window, bundleId }) => required(withQuery("/overview", {
+			platform,
+			channel,
+			window,
+			bundleId
+		})),
+		listEvents: ({ bundle, ...input }) => required(withQuery("/events", {
+			...eventQuery(input),
+			...bundle === void 0 ? {} : {
+				platform: bundle.platform,
+				channel: bundle.channel,
+				bundleId: bundle.bundleId,
+				outcome: bundle.outcome
+			}
+		})),
+		listInstallationEvents: ({ installId, ...input }) => required(withQuery(`/installations/${encodeURIComponent(installId)}/events`, eventQuery(input))),
+		getInstallation: ({ installId }) => read(`/installations/${encodeURIComponent(installId)}`),
+		pageInstallationsByCurrentUserId: ({ userId, cursor, limit }) => required(withQuery("/installations", {
+			userId,
+			cursor,
+			limit
+		})),
+		getUpdateFailures: ({ platform, channel, releaseId, timeRange }) => required(withQuery("/failures", {
+			platform,
+			channel,
+			releaseId,
+			start: timeRange?.start,
+			end: timeRange?.end
+		})),
+		getRetention: () => required("/retention")
+	};
+};
+var featureApi = (api) => api;
+/** What serves each console feature, keyed like `consoleFeatures`. */
+var consoleFeatureApis = {
+	insights: featureApi({
+		local: (api) => ({
+			...createInsightsProvider(createInsightsModel(api)),
+			getRetention: async () => api.retention,
+			getUpdateFailures: api.getUpdateFailures
+		}),
+		remote: createAdminInsightsReads
+	}),
+	insightsAnalytics: featureApi({ local: (api) => createInsightsModel(api) }),
+	apiKeys: featureApi({ local: (api) => api })
+};
+var isRecord = (value) => typeof value === "object" && value !== null;
+/** The ids of the plugins a self-hosted server lists on its admin `/version`. */
+var readServerPlugins = async (fetchAdmin) => {
+	const response = await fetchAdmin("/version");
+	if (!response.ok) throw new Error(`The server answered /version with ${response.status}.`);
+	const body = await response.json();
+	const plugins = isRecord(body) ? body.plugins : void 0;
+	return Array.isArray(plugins) ? plugins.filter((id) => typeof id === "string") : [];
+};
+/** Runs `load` once and keeps its result; a failure is not kept, so the next call retries. */
+var once = (load) => {
+	let pending;
+	return () => pending ??= load().catch((error) => {
+		pending = void 0;
+		throw error;
+	});
+};
+var featureIds = Object.keys(consoleFeatureApis);
+/**
+* What serves each feature, built by its factory: over the plugins' APIs the
+* console assembled, or over a self-hosted server's admin API. A feature
+* without its plugin, or without a factory for the admin API, has none.
+*/
+var featureApis = (build) => Object.fromEntries(featureIds.flatMap((feature) => {
+	const api = build(feature);
+	return api === void 0 ? [] : [[feature, api]];
+}));
+/**
+* The console's features and what serves them, for a console config:
+* - a self-hosted server (`standaloneRepository`) runs its plugins and lists
+*   them on its admin `/version`; the console serves what that server's admin
+*   API serves, and nothing that needs the database;
+* - otherwise the console assembles `plugins` over the database, as the
+*   server does, and serves the features of the plugins it assembled.
+*/
+var createConsoleRuntime = (config) => {
+	const { database } = config;
+	if (isRemoteDatabase(database)) {
+		const { fetchAdmin } = database;
+		return {
+			remote: true,
+			features: once(async () => resolveConsoleFeatures(await readServerPlugins(fetchAdmin), { remote: true })),
+			apis: featureApis((feature) => consoleFeatureApis[feature].remote?.(fetchAdmin))
+		};
+	}
+	const api = createDatabasePluginApis(database, config.plugins ?? []);
+	const features = resolveConsoleFeatures(Object.keys(api), { remote: false });
+	return {
+		remote: false,
+		features: async () => features,
+		apis: featureApis((feature) => {
+			const pluginApi = api[consoleFeatures[feature].plugin];
+			return pluginApi === void 0 ? void 0 : consoleFeatureApis[feature].local(pluginApi);
+		})
+	};
+};
+/**
+* What serves `feature`. Every feature's server function asks for it first,
+* so a feature the console does not serve is refused with one error the
+* client recognizes, before anything is read.
+*/
+var requireFeature = async (runtime, feature) => {
+	const api = runtime.apis[feature];
+	if (api === void 0 || !(await runtime.features())[feature]) throw new ConsoleFeatureUnavailableError(feature, { remote: runtime.remote });
+	return api;
+};
+//#endregion
+export { createConsoleRuntime, requireFeature };