@hot-updater/console 1.0.0-rc.2 → 1.0.0-rc.21

package/.output/server/_ssr/runtime.server-fL0o6I2b.mjs

@@ -0,0 +1,1459 @@
+import { i as resolveConsoleFeatures, n as consoleFeatures, t as ConsoleFeatureUnavailableError } from "./console-features-Dzu2iUGD.mjs";
+import { C as isUUIDv7 } from "./dist-Cxo9ghYv.mjs";
+import { i as isDatabaseJsonObject, t as DatabaseAdapterInputError } from "./databaseJsonValue-Bhxciy7Z.mjs";
+import { t as createUUIDv7 } from "./uuidv7-C8bwiZr8.mjs";
+import { n as defineTable, r as isRemoteDatabase, t as defineAggregate } from "./schema-BKY9SqaY.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/runtime.server-fL0o6I2b.js
+var isOptional = (value, key, valid) => !Object.hasOwn(value, key) || valid(value[key]);
+var isString = (value) => typeof value === "string";
+/** An `UPDATE_FAILED` report's stored failure: a stage and a reason, and what else the client knew. */
+var isDatabaseBundleEventFailure = (value) => isDatabaseJsonObject(value) && isString(value.stage) && isString(value.reason) && isOptional(value, "resource", isString) && isOptional(value, "http_status", (status) => Number.isSafeInteger(status)) && isOptional(value, "transport", isString) && isOptional(value, "origin_code", isString) && isOptional(value, "previous_process_exit", isString);
+var isDatabaseBundleEventMetadata = (value) => isDatabaseJsonObject(value) && typeof value.cohort === "string" && (value.update_strategy === null || value.update_strategy === "fingerprint" || value.update_strategy === "appVersion") && (value.fingerprint_hash === null || typeof value.fingerprint_hash === "string") && (value.sdk_version === null || typeof value.sdk_version === "string") && isOptional(value, "failure", isDatabaseBundleEventFailure) && isOptional(value, "delivery", isString) && isOptional(value, "patch_fallback", (flag) => typeof flag === "boolean") && isOptional(value, "previous_process_exit", isString);
+var isRecord$3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isIdentity$1 = (value) => typeof value === "string" && value.length > 0 && value.length <= 255;
+var isTextOrNull = (value) => value === null || typeof value === "string";
+/** Each bundle event field and what it holds. */
+var BUNDLE_EVENT_FIELDS = {
+	id: (value) => typeof value === "string",
+	type: (value) => value === "UPDATE_DOWNLOADED" || value === "UPDATE_APPLIED" || value === "RECOVERED" || value === "UPDATE_FAILED" || value === "UNCHANGED",
+	install_id: isIdentity$1,
+	user_id: (value) => value === null || isIdentity$1(value),
+	from_bundle_id: isTextOrNull,
+	from_release_id: isTextOrNull,
+	to_release_id: isTextOrNull,
+	to_bundle_id: (value) => typeof value === "string",
+	platform: (value) => value === "ios" || value === "android",
+	app_version: (value) => typeof value === "string",
+	channel: (value) => typeof value === "string",
+	metadata: isDatabaseBundleEventMetadata,
+	received_at_ms: (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0
+};
+var updateStrategyOf = (row) => isRecord$3(row.metadata) ? row.metadata.update_strategy : void 0;
+/**
+* A movement, or a failed update, names the bundle it left and how the
+* device updates, and a failed update says what failed; an unchanged report
+* names neither.
+*/
+var hasEventInvariants = (row) => (row.type === "UPDATE_DOWNLOADED" || row.type === "UPDATE_APPLIED" || row.type === "RECOVERED" || row.type === "UPDATE_FAILED") && typeof row.from_bundle_id === "string" && (updateStrategyOf(row) === "fingerprint" || updateStrategyOf(row) === "appVersion") && (row.type !== "UPDATE_FAILED" || isRecord$3(row.metadata) && isRecord$3(row.metadata.failure)) || row.type === "UNCHANGED" && row.from_bundle_id === null && updateStrategyOf(row) === null;
+/**
+* Throws unless `row` has exactly the bundle event fields, each of its type,
+* and the invariants of its event type: `invalid-field` for an unknown field,
+* `invalid-data` for anything else.
+*/
+var validateBundleEventFields = (row) => {
+	if (!isRecord$3(row)) throw new DatabaseAdapterInputError("invalid-data");
+	for (const field of Object.keys(row)) if (!Object.hasOwn(BUNDLE_EVENT_FIELDS, field)) throw new DatabaseAdapterInputError("invalid-field");
+	for (const [field, valid] of Object.entries(BUNDLE_EVENT_FIELDS)) if (!Object.hasOwn(row, field) || !valid(row[field])) throw new DatabaseAdapterInputError("invalid-data");
+	if (!hasEventInvariants(row)) throw new DatabaseAdapterInputError("invalid-data");
+};
+var encoder = new TextEncoder();
+/** Exact UTF-8 byte ordering, without case folding or Unicode normalization. */
+var compareInsightsText = (left, right) => {
+	const a = encoder.encode(left);
+	const b = encoder.encode(right);
+	for (let index = 0; index < Math.min(a.length, b.length); index += 1) if (a[index] !== b[index]) return a[index] - b[index];
+	return a.length - b.length;
+};
+var isWellFormedText = (value) => {
+	for (const character of value) {
+		const point = character.codePointAt(0);
+		if (point >= 55296 && point <= 57343) return false;
+	}
+	return true;
+};
+var isIdentity = (value) => typeof value === "string" && value.length > 0 && value.length <= 255 && isWellFormedText(value);
+var isText = (value) => typeof value === "string" && value.length > 0 && isWellFormedText(value);
+var isTimestamp = (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+var isLimit = (value) => isTimestamp(value) && value >= 1 && value <= 101;
+var hasOnlyKeys = (value, keys) => Object.keys(value).every((key) => keys.includes(key));
+var hasScope = (value) => (value.platform === "ios" || value.platform === "android") && isText(value.channel);
+var isBundleFilter = (value, withKind = false) => {
+	if (!isRecord$3(value) || !hasScope(value)) return false;
+	const keys = [
+		"platform",
+		"channel",
+		"type",
+		...withKind ? ["kind"] : []
+	];
+	return value.type === "RECOVERED" ? isText(value.fromBundleId) && hasOnlyKeys(value, [...keys, "fromBundleId"]) : (value.type === "UPDATE_DOWNLOADED" || value.type === "UPDATE_APPLIED" || value.type === "UPDATE_FAILED") && isText(value.toBundleId) && hasOnlyKeys(value, [...keys, "toBundleId"]);
+};
+var isEventFilter = (value) => {
+	if (!isRecord$3(value)) return false;
+	if (value.kind === "all") return hasOnlyKeys(value, ["kind"]);
+	if (value.kind === "installationMovement") return isIdentity(value.installId) && hasOnlyKeys(value, ["kind", "installId"]);
+	return value.kind === "bundle" && isBundleFilter(value, true);
+};
+var validateRow = (model, row, result = false) => {
+	try {
+		validateBundleEventFields(row);
+		if (!isRecord$3(row) || typeof row.id !== "string" || !isUUIDv7(row.id) || [...Object.values(row), ...isRecord$3(row.metadata) ? Object.values(row.metadata) : []].some((value) => typeof value === "string" && !isWellFormedText(value))) throw new DatabaseAdapterInputError("invalid-data");
+	} catch (error) {
+		if (result) throw new DatabaseAdapterInputError("invalid-result");
+		throw error;
+	}
+};
+/** Downloads, applies, recoveries, and failed updates belong in installation history. */
+var isInsightsMovementEvent = (event) => event.type === "UPDATE_DOWNLOADED" || event.type === "UPDATE_APPLIED" || event.type === "RECOVERED" || event.type === "UPDATE_FAILED";
+var matchesInsightsEventFilter = (event, filter) => {
+	if (filter.kind === "all") return true;
+	if (filter.kind === "installationMovement") return event.install_id === filter.installId && isInsightsMovementEvent(event);
+	return event.type === filter.type && event.platform === filter.platform && event.channel === filter.channel && (filter.type === "RECOVERED" ? event.from_bundle_id === filter.fromBundleId : event.to_bundle_id === filter.toBundleId && event.metadata.failure?.stage !== "check");
+};
+var invalidQuery = () => {
+	throw new DatabaseAdapterInputError("invalid-query");
+};
+var invalidResult = () => {
+	throw new DatabaseAdapterInputError("invalid-result");
+};
+var validateCount = (count) => isTimestamp(count) ? count : invalidResult();
+var isTimeRange = (value) => isRecord$3(value) && hasOnlyKeys(value, ["start", "end"]) && isTimestamp(value.start) && isTimestamp(value.end) && value.start < value.end;
+var isReleaseReference = (value) => isRecord$3(value) && hasOnlyKeys(value, [
+	"releaseId",
+	"platform",
+	"channel"
+]) && isIdentity(value.releaseId) && hasScope(value);
+var validateAggregateResult = (value) => {
+	const result = isRecord$3(value) ? value : invalidResult();
+	if (!isTimestamp(result.measuredAtMs)) invalidResult();
+	const coverage = result.coverage;
+	if (!isRecord$3(coverage) || coverage.kind !== "complete" && coverage.kind !== "partial" || coverage.sinceMs !== null && !isTimestamp(coverage.sinceMs)) invalidResult();
+};
+/** Validate custom and bundled providers at the same public boundary. */
+var createValidatedInsightsModel = (model) => ({
+	async recordEvent(input) {
+		if (!isRecord$3(input) || !hasOnlyKeys(input, ["event"])) throw new DatabaseAdapterInputError("invalid-data");
+		validateRow("bundle_events", input.event);
+		await model.recordEvent(input);
+	},
+	async listEvents(input) {
+		if (!isRecord$3(input) || !hasOnlyKeys(input, [
+			"filter",
+			"sinceMs",
+			"beforeReceivedAtMs",
+			"after",
+			"limit"
+		]) || !isEventFilter(input.filter) || !isLimit(input.limit) || !isTimestamp(input.beforeReceivedAtMs) || input.sinceMs !== void 0 && !isTimestamp(input.sinceMs)) invalidQuery();
+		const sinceMs = input.sinceMs ?? 0;
+		if (sinceMs > input.beforeReceivedAtMs || input.after !== void 0 && (!isRecord$3(input.after) || !hasOnlyKeys(input.after, ["receivedAtMs", "id"]) || !isTimestamp(input.after.receivedAtMs) || typeof input.after.id !== "string" || !isUUIDv7(input.after.id) || input.after.receivedAtMs < sinceMs || input.after.receivedAtMs >= input.beforeReceivedAtMs)) invalidQuery();
+		const rows = await model.listEvents(input);
+		if (!Array.isArray(rows) || rows.length > input.limit) invalidResult();
+		let previous = input.after;
+		for (const row of rows) {
+			validateRow("bundle_events", row, true);
+			if (row.received_at_ms < sinceMs || row.received_at_ms >= input.beforeReceivedAtMs || !matchesInsightsEventFilter(row, input.filter) || previous !== void 0 && (row.received_at_ms > previous.receivedAtMs || row.received_at_ms === previous.receivedAtMs && row.id >= previous.id)) invalidResult();
+			previous = {
+				receivedAtMs: row.received_at_ms,
+				id: row.id
+			};
+		}
+		return rows;
+	},
+	async findLatestEvents(input) {
+		if (!isRecord$3(input)) invalidQuery();
+		if ("installId" in input) {
+			if (!hasOnlyKeys(input, ["installId"]) || !isIdentity(input.installId)) invalidQuery();
+		} else if (!hasOnlyKeys(input, [
+			"userId",
+			"afterInstallId",
+			"limit"
+		]) || !isIdentity(input.userId) || !isLimit(input.limit) || input.afterInstallId !== void 0 && !isIdentity(input.afterInstallId)) invalidQuery();
+		const rows = await model.findLatestEvents(input);
+		if (!Array.isArray(rows) || rows.length > ("installId" in input ? 1 : input.limit)) invalidResult();
+		let previous = "installId" in input ? void 0 : input.afterInstallId;
+		for (const row of rows) {
+			validateRow("bundle_events", row, true);
+			if ("installId" in input ? row.install_id !== input.installId : row.user_id !== input.userId || previous !== void 0 && compareInsightsText(row.install_id, previous) <= 0) invalidResult();
+			previous = row.install_id;
+		}
+		return rows;
+	},
+	async countLatestEvents(input) {
+		if (!isRecord$3(input) || !hasOnlyKeys(input, [
+			"platform",
+			"channel",
+			"sinceMs",
+			"bundle"
+		]) || !hasScope(input) || !isTimestamp(input.sinceMs) || input.bundle !== void 0 && (!Array.isArray(input.bundle) || input.bundle.length < 1 || input.bundle.length > 2 || input.bundle.some((bundle) => !isRecord$3(bundle) || !hasOnlyKeys(bundle, [
+			"field",
+			"value",
+			"types"
+		]) || bundle.field !== "from_bundle_id" && bundle.field !== "to_bundle_id" || !isText(bundle.value) || !Array.isArray(bundle.types) || bundle.types.length === 0 || bundle.types.some((type) => ![
+			"UNCHANGED",
+			"UPDATE_DOWNLOADED",
+			"UPDATE_APPLIED",
+			"RECOVERED"
+		].includes(type))))) invalidQuery();
+		return validateCount(await model.countLatestEvents(input));
+	},
+	async countEvents(input) {
+		if (!isRecord$3(input) || !hasOnlyKeys(input, [
+			"filter",
+			"sinceMs",
+			"beforeReceivedAtMs"
+		]) || !isBundleFilter(input.filter) || !isTimestamp(input.sinceMs) || !isTimestamp(input.beforeReceivedAtMs) || input.sinceMs > input.beforeReceivedAtMs) invalidQuery();
+		return validateCount(await model.countEvents(input));
+	},
+	async getReleaseActivity(input) {
+		if (!isRecord$3(input) || !hasOnlyKeys(input, [
+			"releases",
+			"scope",
+			"timeRange"
+		])) invalidQuery();
+		const releases = input.releases;
+		const scope = input.scope;
+		const timeRange = input.timeRange;
+		const releaseQuery = Array.isArray(releases) && releases.length > 0 && releases.length <= 100 && releases.every(isReleaseReference) && scope === void 0 && (timeRange === void 0 || isTimeRange(timeRange));
+		const scopeQuery = releases === void 0 && isRecord$3(scope) && hasOnlyKeys(scope, ["platform", "channel"]) && hasScope(scope) && isTimeRange(timeRange);
+		if (!releaseQuery && !scopeQuery) invalidQuery();
+		const result = await model.getReleaseActivity(input);
+		validateAggregateResult(result);
+		if (!Array.isArray(result.data)) invalidResult();
+		return result;
+	},
+	async getAppUsage(input) {
+		if (!isRecord$3(input) || !hasOnlyKeys(input, [
+			"channel",
+			"platform",
+			"appVersion",
+			"timeRange",
+			"intervalMs"
+		]) || !isText(input.channel) || ![
+			"all",
+			"ios",
+			"android"
+		].includes(input.platform) || input.appVersion !== void 0 && !isText(input.appVersion) || !isTimeRange(input.timeRange) || !isTimestamp(input.intervalMs) || input.intervalMs < 36e5) invalidQuery();
+		const result = await model.getAppUsage(input);
+		validateAggregateResult(result);
+		if (!isTimestamp(result.activeInstallations) || !Array.isArray(result.points) || !Array.isArray(result.appVersions) || !Array.isArray(result.versions) || !Array.isArray(result.platforms) || !Array.isArray(result.bundleDistribution)) invalidResult();
+		return result;
+	}
+});
+/**
+* The plugin's API as `InsightsModel`, validated at its boundary: what the
+* Insights routes, the console, and the e2e harness read through.
+*/
+var createInsightsModel = (api) => createValidatedInsightsModel({
+	recordEvent: ({ event }) => api.recordEvent(event),
+	listEvents: api.listEvents,
+	findLatestEvents: api.findLatestEvents,
+	countLatestEvents: api.countLatestEvents,
+	countEvents: api.countEvents,
+	getReleaseActivity: api.getReleaseActivity,
+	getAppUsage: api.getAppUsage
+});
+/**
+* What Insights' API throws for an input it refuses, such as an unknown
+* event field or a malformed cursor; its routes answer 400 for it.
+*/
+var InsightsBadRequestError = class extends Error {
+	name = "InsightsBadRequestError";
+};
+var MAX_EVENT_STRING_LENGTH = 1024;
+var MAX_IDENTITY_LENGTH$1 = 255;
+function isRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function requireStringField(payload, key) {
+	const value = payload[key];
+	if (typeof value !== "string" || value.length === 0 || value.length > MAX_EVENT_STRING_LENGTH || new TextDecoder("utf-8", { ignoreBOM: true }).decode(new TextEncoder().encode(value)) !== value) throw new InsightsBadRequestError(`Invalid event field: ${key}`);
+	return value;
+}
+function requireNullableStringField(payload, key) {
+	if (payload[key] === null) return null;
+	return requireStringField(payload, key);
+}
+function requireIdentityField(payload, key) {
+	const value = requireStringField(payload, key);
+	if (value.length > MAX_IDENTITY_LENGTH$1) throw new InsightsBadRequestError(`Invalid event field: ${key}`);
+	return value;
+}
+/**
+* The report's idempotency key, when the client sends one: it creates the
+* UUIDv7 once and repeats it on every retry of that report.
+*/
+function readEventId(payload) {
+	const value = payload.eventId;
+	if (value === void 0) return void 0;
+	if (!isUUIDv7(value)) throw new InsightsBadRequestError("Invalid event field: eventId");
+	return value;
+}
+/** One value of an open set: any other value reads as `unknown`. */
+var oneOf = (values, value) => values.includes(value) ? value : "unknown";
+var STAGES = [
+	"check",
+	"download",
+	"install"
+];
+var REASONS = [
+	"network",
+	"http",
+	"invalid_response",
+	"hash_mismatch",
+	"signature",
+	"patch",
+	"extract",
+	"storage"
+];
+var RESOURCES = [
+	"catalog",
+	"artifact",
+	"manifest",
+	"file",
+	"patch",
+	"archive"
+];
+var TRANSPORTS = [
+	"timeout",
+	"dns",
+	"tls",
+	"connection",
+	"offline",
+	"cancelled"
+];
+var DELIVERIES = [
+	"patch",
+	"manifest",
+	"archive"
+];
+/** A storage error code or an Android exit reason: letters, digits, and `._-`. */
+var CODE = /^[A-Za-z0-9._-]{1,64}$/;
+var readCode = (value) => typeof value === "string" && CODE.test(value) ? value : void 0;
+var readMetadata = (payload) => isRecord$2(payload.metadata) ? payload.metadata : {};
+/**
+* What an UPDATE_FAILED report says failed. It never refuses the report: an
+* unknown value of a set reads as `unknown`, a missing or malformed failure
+* as an unknown stage and reason, and a malformed optional field is left out,
+* as is a null one.
+*/
+function readFailure(value) {
+	const failure = isRecord$2(value) ? value : {};
+	const httpStatus = failure.httpStatus;
+	const originCode = readCode(failure.originCode);
+	const previousProcessExit = readCode(failure.previousProcessExit);
+	return {
+		stage: oneOf(STAGES, failure.stage),
+		reason: oneOf(REASONS, failure.reason),
+		...failure.resource == null ? {} : { resource: oneOf(RESOURCES, failure.resource) },
+		...Number.isSafeInteger(httpStatus) && httpStatus >= 100 && httpStatus <= 599 ? { httpStatus } : {},
+		...failure.transport == null ? {} : { transport: oneOf(TRANSPORTS, failure.transport) },
+		...originCode === void 0 ? {} : { originCode },
+		...previousProcessExit === void 0 ? {} : { previousProcessExit }
+	};
+}
+function requireEvent(payload) {
+	if (!isRecord$2(payload)) throw new InsightsBadRequestError("Invalid event payload");
+	const platform = requireStringField(payload, "platform");
+	if (platform !== "ios" && platform !== "android") throw new InsightsBadRequestError("Invalid event field: platform");
+	const eventId = readEventId(payload);
+	const base = {
+		...eventId === void 0 ? {} : { eventId },
+		installId: requireIdentityField(payload, "installId"),
+		toBundleId: requireStringField(payload, "toBundleId"),
+		...payload.userId === void 0 ? {} : { userId: requireIdentityField(payload, "userId") },
+		platform,
+		appVersion: requireStringField(payload, "appVersion"),
+		channel: requireStringField(payload, "channel"),
+		cohort: requireStringField(payload, "cohort"),
+		fingerprintHash: requireNullableStringField(payload, "fingerprintHash"),
+		sdkVersion: payload.sdkVersion === void 0 ? null : requireNullableStringField(payload, "sdkVersion"),
+		fromReleaseId: requireNullableStringField(payload, "fromReleaseId"),
+		toReleaseId: requireNullableStringField(payload, "toReleaseId")
+	};
+	const type = requireStringField(payload, "type");
+	const movement = () => {
+		const updateStrategy = requireStringField(payload, "updateStrategy");
+		if (updateStrategy !== "fingerprint" && updateStrategy !== "appVersion") throw new InsightsBadRequestError("Invalid event field: updateStrategy");
+		return {
+			...base,
+			fromBundleId: requireStringField(payload, "fromBundleId"),
+			updateStrategy
+		};
+	};
+	const metadata = readMetadata(payload);
+	switch (type) {
+		case "UPDATE_DOWNLOADED": {
+			const delivery = metadata.delivery;
+			const read = {
+				...delivery == null ? {} : { delivery: oneOf(DELIVERIES, delivery) },
+				...metadata.patchFallback === true ? { patchFallback: true } : {}
+			};
+			return {
+				...movement(),
+				type,
+				...Object.keys(read).length === 0 ? {} : { metadata: read }
+			};
+		}
+		case "UPDATE_APPLIED": return {
+			...movement(),
+			type
+		};
+		case "RECOVERED": {
+			const previousProcessExit = readCode(metadata.previousProcessExit);
+			return {
+				...movement(),
+				type,
+				...previousProcessExit === void 0 ? {} : { metadata: { previousProcessExit } }
+			};
+		}
+		case "UPDATE_FAILED": return {
+			...movement(),
+			type,
+			metadata: { failure: readFailure(metadata.failure) }
+		};
+		case "UNCHANGED":
+			if (payload.fromBundleId !== null || payload.updateStrategy !== null) throw new InsightsBadRequestError("Invalid unchanged event shape");
+			return {
+				...base,
+				type,
+				fromBundleId: null,
+				updateStrategy: null
+			};
+		default: throw new InsightsBadRequestError("Invalid event field: type");
+	}
+}
+function createBundleEventRow(input) {
+	input = requireEvent(input);
+	const base = {
+		app_version: input.appVersion,
+		channel: input.channel,
+		from_release_id: input.fromReleaseId,
+		id: input.eventId ?? createUUIDv7(),
+		install_id: input.installId,
+		platform: input.platform,
+		received_at_ms: Date.now(),
+		to_bundle_id: input.toBundleId,
+		to_release_id: input.toReleaseId,
+		user_id: input.userId ?? null
+	};
+	const metadata = {
+		cohort: input.cohort,
+		fingerprint_hash: input.fingerprintHash,
+		sdk_version: input.sdkVersion ?? null,
+		update_strategy: input.updateStrategy
+	};
+	switch (input.type) {
+		case "UPDATE_DOWNLOADED": {
+			const { delivery, patchFallback } = input.metadata ?? {};
+			return {
+				...base,
+				from_bundle_id: input.fromBundleId,
+				type: input.type,
+				metadata: {
+					...metadata,
+					...delivery === void 0 ? {} : { delivery },
+					...patchFallback ? { patch_fallback: true } : {}
+				}
+			};
+		}
+		case "UPDATE_APPLIED": return {
+			...base,
+			from_bundle_id: input.fromBundleId,
+			type: input.type,
+			metadata
+		};
+		case "RECOVERED": {
+			const exit = input.metadata?.previousProcessExit;
+			return {
+				...base,
+				from_bundle_id: input.fromBundleId,
+				type: input.type,
+				metadata: {
+					...metadata,
+					...exit === void 0 ? {} : { previous_process_exit: exit }
+				}
+			};
+		}
+		case "UPDATE_FAILED": {
+			const { failure } = input.metadata;
+			return {
+				...base,
+				from_bundle_id: input.fromBundleId,
+				type: input.type,
+				metadata: {
+					...metadata,
+					failure: {
+						stage: failure.stage,
+						reason: failure.reason,
+						...failure.resource === void 0 ? {} : { resource: failure.resource },
+						...failure.httpStatus === void 0 ? {} : { http_status: failure.httpStatus },
+						...failure.transport === void 0 ? {} : { transport: failure.transport },
+						...failure.originCode === void 0 ? {} : { origin_code: failure.originCode },
+						...failure.previousProcessExit === void 0 ? {} : { previous_process_exit: failure.previousProcessExit }
+					}
+				}
+			};
+		}
+		case "UNCHANGED": return {
+			...base,
+			from_bundle_id: null,
+			type: input.type,
+			metadata
+		};
+	}
+}
+var DEFAULT_PAGE_LIMIT = 50;
+var MAX_PAGE_LIMIT = 100;
+var MAX_EVENT_ID_LENGTH = 1024;
+var MAX_IDENTITY_LENGTH = 255;
+var MAX_CURSOR_LENGTH = 8192;
+var HOUR_MS = 36e5;
+var DAY_MS$1 = 24 * HOUR_MS;
+var WINDOW_MS = {
+	"24h": 864e5,
+	"7d": 6048e5,
+	"30d": 2592e6
+};
+/**
+* The longest receipt range, `[sinceMs, beforeReceivedAtMs)`, of a global or
+* bundle event list, and the range one covers without `sinceMs`: raw events
+* are listed inside a time range, as analytics products list them. It is a
+* duration, so a range that ends mid-day touches 91 UTC days. Installation
+* history is one index range and reads back to `sinceMs`.
+*/
+var EVENT_LIST_RANGE_MS = 2160 * HOUR_MS;
+var isRecord$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var requireString = (value, label, maximumLength) => {
+	if (typeof value !== "string" || value.length === 0 || value.length > maximumLength || new TextDecoder("utf-8", { ignoreBOM: true }).decode(new TextEncoder().encode(value)) !== value) throw new InsightsBadRequestError(`Invalid ${label}.`);
+	return value;
+};
+var requireTimestamp = (value, label) => {
+	if (!Number.isSafeInteger(value) || Number(value) < 0) throw new InsightsBadRequestError(`Invalid ${label}.`);
+	return Number(value);
+};
+var readLimit = (value) => {
+	const limit = value ?? DEFAULT_PAGE_LIMIT;
+	if (!Number.isSafeInteger(limit) || limit < 1 || limit > MAX_PAGE_LIMIT) throw new InsightsBadRequestError("Invalid page limit.");
+	return limit;
+};
+var encodeBase64Url = (value) => {
+	const bytes = new TextEncoder().encode(value);
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
+};
+var decodeBase64Url = (value) => {
+	if (value.length === 0 || value.length > MAX_CURSOR_LENGTH) throw new InsightsBadRequestError("Invalid Insights cursor.");
+	try {
+		const base64 = value.replaceAll("-", "+").replaceAll("_", "/");
+		const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, "=");
+		const binary = atob(padded);
+		const bytes = Uint8Array.from(binary, (character) => character.charCodeAt(0));
+		return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+	} catch {
+		throw new InsightsBadRequestError("Invalid Insights cursor.");
+	}
+};
+var encodeCursor = (value) => encodeBase64Url(JSON.stringify(value));
+var decodeCursor = (value) => {
+	try {
+		return JSON.parse(decodeBase64Url(value));
+	} catch (error) {
+		if (error instanceof InsightsBadRequestError) throw error;
+		throw new InsightsBadRequestError("Invalid Insights cursor.");
+	}
+};
+var readScope = (input) => {
+	if (input.platform !== "ios" && input.platform !== "android") throw new InsightsBadRequestError("Invalid Insights platform.");
+	return {
+		platform: input.platform,
+		channel: requireString(input.channel, "channel", MAX_EVENT_ID_LENGTH)
+	};
+};
+var bundleFilter = (input) => {
+	const scope = readScope(input);
+	const bundleId = requireString(input.bundleId, "bundle ID", MAX_EVENT_ID_LENGTH);
+	switch (input.outcome) {
+		case "downloaded": return {
+			...scope,
+			type: "UPDATE_DOWNLOADED",
+			toBundleId: bundleId
+		};
+		case "applied": return {
+			...scope,
+			type: "UPDATE_APPLIED",
+			toBundleId: bundleId
+		};
+		case "recovered": return {
+			...scope,
+			type: "RECOVERED",
+			fromBundleId: bundleId
+		};
+		case "failed": return {
+			...scope,
+			type: "UPDATE_FAILED",
+			toBundleId: bundleId
+		};
+		default: throw new InsightsBadRequestError("Invalid Insights outcome.");
+	}
+};
+var sameFilter = (left, right) => {
+	if (!isRecord$1(left) || left.kind !== right.kind) return false;
+	switch (right.kind) {
+		case "all": return true;
+		case "installationMovement": return left.installId === right.installId;
+		case "bundle": return left.platform === right.platform && left.channel === right.channel && left.type === right.type && (right.type === "RECOVERED" ? left.fromBundleId === right.fromBundleId : left.toBundleId === right.toBundleId);
+	}
+};
+var readEventCursor = (value, filter) => {
+	const cursor = decodeCursor(value);
+	if (!isRecord$1(cursor) || cursor.version !== 2 || cursor.kind !== "events" || !isRecord$1(cursor.filter) || !isRecord$1(cursor.after)) throw new InsightsBadRequestError("Invalid Insights cursor.");
+	if (!sameFilter(cursor.filter, filter)) throw new InsightsBadRequestError("Insights cursor does not match the requested events.");
+	if (typeof cursor.after.id !== "string" || !isUUIDv7(cursor.after.id)) throw new InsightsBadRequestError("Invalid Insights event cursor ID.");
+	return {
+		after: {
+			id: cursor.after.id,
+			receivedAtMs: requireTimestamp(cursor.after.receivedAtMs, "event cursor")
+		},
+		beforeReceivedAtMs: requireTimestamp(cursor.beforeReceivedAtMs, "event cutoff"),
+		kind: "events",
+		sinceMs: requireTimestamp(cursor.sinceMs, "event start"),
+		filter,
+		version: 2
+	};
+};
+var readUserInstallationCursor = (value, userId) => {
+	const cursor = decodeCursor(value);
+	if (!isRecord$1(cursor) || cursor.version !== 1 || cursor.kind !== "user-installations" || cursor.userId !== userId) throw new InsightsBadRequestError("Insights cursor does not match the requested user ID.");
+	return {
+		afterInstallId: requireString(cursor.afterInstallId, "installation cursor", MAX_IDENTITY_LENGTH),
+		kind: "user-installations",
+		userId,
+		version: 1
+	};
+};
+var compareEventNewest = (left, right) => right.received_at_ms - left.received_at_ms || compareInsightsText(right.id, left.id);
+var isAfterEventCursor = (row, after) => row.received_at_ms < after.receivedAtMs || row.received_at_ms === after.receivedAtMs && compareInsightsText(row.id, after.id) < 0;
+var assertEventRows = (rows, input) => {
+	if (rows.length > input.limit) throw new Error("Insights database returned too many event rows.");
+	for (let index = 0; index < rows.length; index += 1) {
+		const row = rows[index];
+		const previous = rows[index - 1];
+		if (!row || typeof row.id !== "string" || !isUUIDv7(row.id) || !Number.isSafeInteger(row.received_at_ms) || row.received_at_ms >= input.beforeReceivedAtMs || row.received_at_ms < input.sinceMs || previous !== void 0 && compareEventNewest(previous, row) >= 0 || input.after !== void 0 && !isAfterEventCursor(row, input.after) || input.filter.kind === "installationMovement" && (row.install_id !== input.filter.installId || !isInsightsMovementEvent(row)) || input.filter.kind === "bundle" && (row.platform !== input.filter.platform || row.channel !== input.filter.channel || row.type !== input.filter.type || (input.filter.type === "RECOVERED" ? row.from_bundle_id !== input.filter.fromBundleId : row.to_bundle_id !== input.filter.toBundleId))) throw new Error("Insights database returned invalid event rows.");
+	}
+};
+/** An `UPDATE_FAILED` row's failure, as the event lists show it. */
+var toFailure = (failure) => ({
+	stage: failure.stage,
+	reason: failure.reason,
+	...failure.resource === void 0 ? {} : { resource: failure.resource },
+	...failure.http_status === void 0 ? {} : { httpStatus: failure.http_status },
+	...failure.transport === void 0 ? {} : { transport: failure.transport },
+	...failure.origin_code === void 0 ? {} : { originCode: failure.origin_code },
+	...failure.previous_process_exit === void 0 ? {} : { previousProcessExit: failure.previous_process_exit }
+});
+/** What a row's metadata adds for its type: a failure, a delivery, an exit reason. */
+var eventDetails = ({ type, metadata }) => ({
+	...type === "UPDATE_FAILED" && metadata.failure !== void 0 ? { failure: toFailure(metadata.failure) } : {},
+	...type === "UPDATE_DOWNLOADED" && metadata.delivery !== void 0 ? { delivery: metadata.delivery } : {},
+	...type === "UPDATE_DOWNLOADED" && metadata.patch_fallback === true ? { patchFallback: true } : {},
+	...type === "RECOVERED" && metadata.previous_process_exit !== void 0 ? { previousProcessExit: metadata.previous_process_exit } : {}
+});
+var toEventHistoryRow = (row) => ({
+	appVersion: row.app_version,
+	channel: row.channel,
+	cohort: row.metadata.cohort,
+	fromBundleId: row.from_bundle_id,
+	id: row.id,
+	installId: row.install_id,
+	platform: row.platform,
+	receivedAtMs: row.received_at_ms,
+	toBundleId: row.to_bundle_id,
+	type: row.type,
+	userId: row.user_id,
+	...eventDetails(row)
+});
+var toInstallationRow = (row) => ({
+	appVersion: row.app_version,
+	channel: row.channel,
+	cohort: row.metadata.cohort,
+	installId: row.install_id,
+	lastKnownBundleId: row.type === "UPDATE_DOWNLOADED" ? row.from_bundle_id : row.to_bundle_id,
+	pendingBundleId: row.type === "UPDATE_DOWNLOADED" ? row.to_bundle_id : null,
+	pendingReleaseId: row.type === "UPDATE_DOWNLOADED" ? row.to_release_id : null,
+	latestStatus: row.type,
+	platform: row.platform,
+	receivedAtMs: row.received_at_ms,
+	userId: row.user_id
+});
+/**
+* Where a list without `sinceMs` starts: 90 days before its cutoff for the
+* global and bundle lists, at the first event for installation history.
+*/
+var defaultEventStart = (filter, beforeReceivedAtMs) => filter.kind === "installationMovement" ? 0 : Math.max(0, beforeReceivedAtMs - EVENT_LIST_RANGE_MS);
+/** Whether a cursor's row lies inside the list's range. */
+var isInsideBounds = ({ after }, bounds) => after.receivedAtMs >= bounds.sinceMs && after.receivedAtMs < bounds.beforeReceivedAtMs;
+/** A page's range: its cursor's, which the request may repeat but not change. */
+var readEventBounds = (input, cursor, filter) => {
+	const beforeReceivedAtMs = cursor?.beforeReceivedAtMs ?? (input.beforeReceivedAtMs === void 0 ? Date.now() : requireTimestamp(input.beforeReceivedAtMs, "event cutoff"));
+	if (cursor !== void 0 && input.beforeReceivedAtMs !== void 0 && input.beforeReceivedAtMs !== beforeReceivedAtMs) throw new InsightsBadRequestError("Insights cursor does not match the requested event cutoff.");
+	const sinceMs = cursor?.sinceMs ?? (input.sinceMs === void 0 ? defaultEventStart(filter, beforeReceivedAtMs) : requireTimestamp(input.sinceMs, "event start"));
+	const bounds = {
+		beforeReceivedAtMs,
+		sinceMs
+	};
+	if (sinceMs > beforeReceivedAtMs || input.sinceMs !== void 0 && input.sinceMs !== sinceMs || cursor !== void 0 && !isInsideBounds(cursor, bounds)) throw new InsightsBadRequestError("Insights cursor or range does not match the requested event start.");
+	if (filter.kind !== "installationMovement" && beforeReceivedAtMs - sinceMs > 7776e6) throw new InsightsBadRequestError("Insights event lists cover at most 90 days: send a sinceMs no more than 90 days before beforeReceivedAtMs.");
+	return bounds;
+};
+var pageEventRows = async (model, input, filter, map) => {
+	const limit = readLimit(input.limit);
+	const cursor = input.cursor === void 0 ? void 0 : readEventCursor(input.cursor, filter);
+	const bounds = readEventBounds(input, cursor, filter);
+	const query = {
+		filter,
+		...bounds,
+		...cursor === void 0 ? {} : { after: cursor.after },
+		limit
+	};
+	const rows = await model.listEvents(query);
+	assertEventRows(rows, query);
+	const last = rows.at(-1);
+	return {
+		beforeReceivedAtMs: bounds.beforeReceivedAtMs,
+		data: rows.map(map),
+		nextCursor: rows.length === limit && last ? encodeCursor({
+			after: {
+				id: last.id,
+				receivedAtMs: last.received_at_ms
+			},
+			...bounds,
+			kind: "events",
+			filter,
+			version: 2
+		}) : null
+	};
+};
+var assertInstallationRows = (rows, input) => {
+	if (rows.length > input.limit) throw new Error("Insights database returned too many installation rows.");
+	for (let index = 0; index < rows.length; index += 1) {
+		const row = rows[index];
+		const previous = rows[index - 1];
+		if (!row || row.user_id !== input.userId || input.afterInstallId !== void 0 && compareInsightsText(row.install_id, input.afterInstallId) <= 0 || previous !== void 0 && compareInsightsText(previous.install_id, row.install_id) >= 0) throw new Error("Insights database returned invalid installation rows.");
+	}
+};
+var createInsightsProvider = (model) => Object.freeze({
+	async appendBundleEvent(input) {
+		const event = createBundleEventRow(input);
+		await model.recordEvent({ event });
+	},
+	listEvents(input) {
+		return pageEventRows(model, input, input.bundle === void 0 ? { kind: "all" } : {
+			kind: "bundle",
+			...bundleFilter(input.bundle)
+		}, toEventHistoryRow);
+	},
+	async listInstallationEvents(input) {
+		if ("bundle" in input && input.bundle !== void 0) throw new InsightsBadRequestError("Installation movement queries cannot include a bundle filter.");
+		return pageEventRows(model, input, {
+			kind: "installationMovement",
+			installId: requireString(input.installId, "install ID", MAX_IDENTITY_LENGTH)
+		}, (row) => toEventHistoryRow(row));
+	},
+	async getInstallation({ installId }) {
+		const normalizedInstallId = requireString(installId, "install ID", MAX_IDENTITY_LENGTH);
+		const rows = await model.findLatestEvents({ installId: normalizedInstallId });
+		const row = rows[0] ?? null;
+		if (rows.length > 1 || row !== null && row.install_id !== normalizedInstallId) throw new Error("Insights database returned an invalid installation.");
+		return row === null ? null : toInstallationRow(row);
+	},
+	async pageInstallationsByCurrentUserId(input) {
+		const userId = requireString(input.userId, "user ID", MAX_IDENTITY_LENGTH);
+		const limit = readLimit(input.limit);
+		const cursor = input.cursor === void 0 ? void 0 : readUserInstallationCursor(input.cursor, userId);
+		const databaseInput = {
+			userId,
+			...cursor === void 0 ? {} : { afterInstallId: cursor.afterInstallId },
+			limit
+		};
+		const rows = await model.findLatestEvents(databaseInput);
+		assertInstallationRows(rows, databaseInput);
+		const last = rows.at(-1);
+		return {
+			data: rows.map(toInstallationRow),
+			nextCursor: rows.length === limit && last ? encodeCursor({
+				afterInstallId: last.install_id,
+				kind: "user-installations",
+				userId,
+				version: 1
+			}) : null
+		};
+	},
+	async getReportingOverview(input) {
+		const scope = readScope(input);
+		const { window } = input;
+		if (!Object.hasOwn(WINDOW_MS, window)) throw new InsightsBadRequestError("Invalid reporting installation window.");
+		const now = Date.now();
+		const beforeReceivedAtMs = now - now % HOUR_MS + (now % HOUR_MS === 0 ? 0 : HOUR_MS);
+		const reach = Math.max(0, beforeReceivedAtMs - WINDOW_MS[window]);
+		const sinceMs = reach - reach % DAY_MS$1;
+		const measure = async (count) => {
+			const value = await count;
+			if (!Number.isSafeInteger(value) || value < 0) throw new Error("Insights database returned an invalid count.");
+			return {
+				count: value,
+				measuredAtMs: Date.now()
+			};
+		};
+		const bundleId = input.bundleId === void 0 ? void 0 : requireString(input.bundleId, "bundle ID", MAX_EVENT_ID_LENGTH);
+		const reporting = measure(model.countLatestEvents({
+			...scope,
+			sinceMs
+		}));
+		if (bundleId === void 0) return {
+			...scope,
+			window,
+			sinceMs,
+			beforeReceivedAtMs,
+			reportingInstallations: await reporting
+		};
+		const countOutcome = (outcome) => measure(model.countEvents({
+			filter: bundleFilter({
+				...scope,
+				bundleId,
+				outcome
+			}),
+			sinceMs,
+			beforeReceivedAtMs
+		}));
+		const [reportingInstallations, bundleInstallations, downloadedReports, appliedReports, recoveredReports, failedReports] = await Promise.all([
+			reporting,
+			measure(model.countLatestEvents({
+				...scope,
+				sinceMs,
+				bundle: [{
+					field: "from_bundle_id",
+					value: bundleId,
+					types: ["UPDATE_DOWNLOADED"]
+				}, {
+					field: "to_bundle_id",
+					value: bundleId,
+					types: [
+						"UNCHANGED",
+						"UPDATE_APPLIED",
+						"RECOVERED"
+					]
+				}]
+			})),
+			countOutcome("downloaded"),
+			countOutcome("applied"),
+			countOutcome("recovered"),
+			countOutcome("failed")
+		]);
+		return {
+			...scope,
+			window,
+			sinceMs,
+			beforeReceivedAtMs,
+			reportingInstallations,
+			bundle: {
+				bundleId,
+				reportingInstallations: bundleInstallations,
+				downloadedReports,
+				appliedReports,
+				recoveredReports,
+				failedReports
+			}
+		};
+	}
+});
+var DAY_MS = 864e5;
+var DEFAULT_INSIGHTS_RETENTION = {
+	rawDays: 90,
+	dailyDays: 400
+};
+var bucketRetention = (days) => ({
+	field: "bucket_start_ms",
+	days
+});
+var MOVEMENTS = /* @__PURE__ */ new Set([
+	"UPDATE_DOWNLOADED",
+	"UPDATE_APPLIED",
+	"RECOVERED",
+	"UPDATE_FAILED"
+]);
+/** A failed update check: it names no target bundle, so no bundle list shows it. */
+var isFailedCheck = (row) => row.type === "UPDATE_FAILED" && row.metadata?.failure?.stage === "check";
+/**
+* Downloads, applies, recoveries, and update failures, whole. An UNCHANGED
+* report counts as a launch and moves its installation's head, but no list
+* shows it, so no row keeps it.
+*/
+var bundleEvents = (days) => defineTable({
+	id: {
+		type: "string",
+		maxLength: 36
+	},
+	type: {
+		type: "string",
+		maxLength: 32
+	},
+	install_id: {
+		type: "string",
+		maxLength: 255
+	},
+	user_id: {
+		type: "string",
+		maxLength: 255,
+		required: false
+	},
+	from_release_id: {
+		type: "string",
+		maxLength: 36,
+		required: false
+	},
+	from_bundle_id: {
+		type: "string",
+		maxLength: 36,
+		required: false
+	},
+	to_release_id: {
+		type: "string",
+		maxLength: 36,
+		required: false
+	},
+	to_bundle_id: {
+		type: "string",
+		maxLength: 36
+	},
+	platform: {
+		type: "string",
+		maxLength: 16
+	},
+	app_version: { type: "string" },
+	channel: { type: "string" },
+	metadata: { type: "json" },
+	received_at_ms: { type: "integer" }
+}, {
+	key: ["id"],
+	derived: {
+		day: {
+			type: "integer",
+			compute: (row) => row.received_at_ms - row.received_at_ms % DAY_MS
+		},
+		movement_install_id: {
+			type: "string",
+			compute: (row) => MOVEMENTS.has(row.type) ? row.install_id : null
+		},
+		bundle_ref: {
+			type: "string",
+			multi: true,
+			compute: (row) => isFailedCheck(row) ? [] : [row.type === "RECOVERED" && row.from_bundle_id !== null ? `from:${row.from_bundle_id}` : `to:${row.to_bundle_id}`]
+		}
+	},
+	indexes: {
+		recent: {
+			eq: [
+				"channel",
+				"platform",
+				"day"
+			],
+			sort: ["received_at_ms"]
+		},
+		movementsByInstall: {
+			eq: ["movement_install_id"],
+			sort: ["received_at_ms"]
+		},
+		byBundle: {
+			eq: [
+				"platform",
+				"channel",
+				"type",
+				"bundle_ref",
+				"day"
+			],
+			sort: ["received_at_ms"]
+		},
+		byDay: {
+			eq: ["day"],
+			sort: ["received_at_ms"]
+		}
+	},
+	retention: {
+		field: "day",
+		days
+	}
+});
+/**
+* Each installation's latest event, whole, so reading it is one point read.
+* Its gauges count it in the UTC day of that event. An update failure moves
+* nothing, so no head holds one.
+*/
+var bundleEventHeads = (days) => defineTable({
+	install_id: {
+		type: "string",
+		maxLength: 255
+	},
+	id: {
+		type: "string",
+		maxLength: 36
+	},
+	type: {
+		type: "string",
+		maxLength: 32
+	},
+	user_id: {
+		type: "string",
+		maxLength: 255,
+		required: false
+	},
+	from_release_id: {
+		type: "string",
+		maxLength: 36,
+		required: false
+	},
+	from_bundle_id: {
+		type: "string",
+		maxLength: 36,
+		required: false
+	},
+	to_release_id: {
+		type: "string",
+		maxLength: 36,
+		required: false
+	},
+	to_bundle_id: {
+		type: "string",
+		maxLength: 36
+	},
+	platform: {
+		type: "string",
+		maxLength: 16
+	},
+	app_version: { type: "string" },
+	channel: { type: "string" },
+	metadata: { type: "json" },
+	received_at_ms: { type: "integer" }
+}, {
+	key: ["install_id"],
+	indexes: { byUser: {
+		eq: ["user_id"],
+		sort: ["install_id"]
+	} },
+	retention: {
+		field: "received_at_ms",
+		days
+	}
+});
+/**
+* Shards are keyed by install id. Counters are blind increments and never
+* conflict, so they keep 8. Gauges and sketches are read, merged, and written
+* back. B3's rollout gate on PostgreSQL retried 2.4% of transactions at 8
+* shards and 1.3% at 16. DynamoDB's transactions take longer, so D8's gate
+* on DynamoDB Local retried 2–24% at 16, almost all on gauge rows, and 1–5%
+* with gauges at 32. Sketches stay at 16: each shard row carries 2 KB of
+* registers that every read merges.
+*
+* Every Insights aggregate is `batched`: on DynamoDB and Firestore, which
+* bill each write, an event's changes apply after it commits, merged with
+* other events' into one write per row, on one shard per writer.
+*/
+var COUNTER_SHARDS = 8;
+var GAUGE_SHARDS = 32;
+var SKETCH_SHARDS = 16;
+/** Rows keyed by a hashed identity (scope and period) and a bucket. */
+var identityFields = {
+	identity: {
+		type: "string",
+		maxLength: 32
+	},
+	bucket_start_ms: { type: "integer" }
+};
+var window = {
+	eq: ["identity"],
+	sort: ["bucket_start_ms"]
+};
+/**
+* Counters of one period kind: hourly, daily, or lifetime at bucket 0. A
+* release or channel row counts downloads, launches, and failed launches,
+* and downloads a patch delivered and those that fell back from one. A
+* release's lifetime row counts its failed updates (`failed_updates`), since
+* no breakdown row outlives the raw period; windowed reads sum
+* `insights_failures` instead.
+*/
+var counters = (retention) => defineAggregate(identityFields, {
+	key: ["identity", "bucket_start_ms"],
+	counters: [
+		"downloads",
+		"launches",
+		"failed_launches",
+		"failed_updates",
+		"patch_downloads",
+		"patch_fallbacks"
+	],
+	shards: COUNTER_SHARDS,
+	batched: true,
+	indexes: { window },
+	...retention === void 0 ? {} : { retention }
+});
+/**
+* Unique-installation sketches of one period kind. Rows of a failure
+* identity (`failure` and `check` scopes) keep only `failed_users`, so a
+* release's launch rows never grow by a failure's registers.
+*/
+var sketches = (retention) => defineAggregate(identityFields, {
+	key: ["identity", "bucket_start_ms"],
+	distinct: [
+		"launch_users",
+		"activity_users",
+		"failed_users"
+	],
+	shards: SKETCH_SHARDS,
+	batched: true,
+	indexes: { window },
+	retention
+});
+/** Installations whose update to a release failed, since its first failure: kept, at bucket 0. */
+var lifetimeSketches = () => defineAggregate(identityFields, {
+	key: ["identity", "bucket_start_ms"],
+	distinct: ["failed_users"],
+	shards: SKETCH_SHARDS,
+	batched: true,
+	indexes: { window }
+});
+/**
+* Update failures by what failed, and recoveries by why the crashed process
+* exited, a row an hour. `release_id` is the failed update's target release,
+* or empty for a failed check or an unknown target, and the recovered
+* release for a recovery. A failure's `stage` and `reason` say where and why
+* it failed, and `detail` what else the client knew, as the JSON array
+* `[resource, httpStatus, originCode, transport]`. A recovery's stage is
+* `launch` and its reason the exit reason, with an empty detail. Every index
+* is in key order, so its counters stay blind increments.
+*/
+var insightsFailures = (retention) => defineAggregate({
+	platform: {
+		type: "string",
+		maxLength: 16
+	},
+	channel: { type: "string" },
+	bucket_start_ms: { type: "integer" },
+	release_id: {
+		type: "string",
+		maxLength: 36
+	},
+	stage: {
+		type: "string",
+		maxLength: 16
+	},
+	reason: {
+		type: "string",
+		maxLength: 64
+	},
+	detail: {
+		type: "string",
+		maxLength: 160
+	}
+}, {
+	key: [
+		"platform",
+		"channel",
+		"bucket_start_ms",
+		"release_id",
+		"stage",
+		"reason",
+		"detail"
+	],
+	counters: ["events"],
+	shards: COUNTER_SHARDS,
+	batched: true,
+	indexes: { byScope: {
+		eq: ["platform", "channel"],
+		sort: ["bucket_start_ms"]
+	} },
+	retention
+});
+/** Installations counted in the UTC day of their latest event, so reads sum whole UTC days. */
+var insightsDistribution = (retention) => defineAggregate({
+	channel: { type: "string" },
+	platform: {
+		type: "string",
+		maxLength: 16
+	},
+	app_version: { type: "string" },
+	release_id: {
+		type: "string",
+		maxLength: 36
+	},
+	bucket_start_ms: { type: "integer" }
+}, {
+	key: [
+		"channel",
+		"platform",
+		"app_version",
+		"release_id",
+		"bucket_start_ms"
+	],
+	gauges: ["latest_installations"],
+	shards: GAUGE_SHARDS,
+	batched: true,
+	indexes: {
+		byScope: {
+			eq: ["channel", "platform"],
+			sort: ["bucket_start_ms"]
+		},
+		byVersion: {
+			eq: [
+				"channel",
+				"platform",
+				"app_version"
+			],
+			sort: ["bucket_start_ms"]
+		}
+	},
+	retention
+});
+/** Latest events by the bundle they came from or went to, bucketed like the distribution. */
+var insightsLatestByBundle = (retention) => defineAggregate({
+	platform: {
+		type: "string",
+		maxLength: 16
+	},
+	channel: { type: "string" },
+	bundle_field: {
+		type: "string",
+		maxLength: 16
+	},
+	bundle_id: {
+		type: "string",
+		maxLength: 36
+	},
+	type: {
+		type: "string",
+		maxLength: 32
+	},
+	bucket_start_ms: { type: "integer" }
+}, {
+	key: [
+		"platform",
+		"channel",
+		"bundle_field",
+		"bundle_id",
+		"type",
+		"bucket_start_ms"
+	],
+	gauges: ["installations"],
+	shards: GAUGE_SHARDS,
+	batched: true,
+	indexes: { byBundle: {
+		eq: [
+			"platform",
+			"channel",
+			"bundle_field",
+			"bundle_id",
+			"type"
+		],
+		sort: ["bucket_start_ms"]
+	} },
+	retention
+});
+/**
+* Stored events by outcome and the bundle a bundle filter matches, a row an
+* hour, which a failed check has none of; and every stored event, a row a UTC
+* day (`DAILY_EVENTS`). Bundle counts sum the hourly rows, and event lists
+* read either to skip days without events.
+*/
+var insightsOutcomes = (retention) => defineAggregate({
+	platform: {
+		type: "string",
+		maxLength: 16
+	},
+	channel: { type: "string" },
+	type: {
+		type: "string",
+		maxLength: 32
+	},
+	bundle_ref: {
+		type: "string",
+		maxLength: 41
+	},
+	bucket_start_ms: { type: "integer" }
+}, {
+	key: [
+		"platform",
+		"channel",
+		"type",
+		"bundle_ref",
+		"bucket_start_ms"
+	],
+	counters: ["events"],
+	shards: COUNTER_SHARDS,
+	batched: true,
+	indexes: { byRef: {
+		eq: [
+			"platform",
+			"channel",
+			"type",
+			"bundle_ref"
+		],
+		sort: ["bucket_start_ms"]
+	} },
+	retention
+});
+/**
+* Insights' tables, each expiring after its period. The periods are values
+* the engine applies at runtime; the tables and indexes are the same for
+* any periods.
+*/
+var createInsightsSchema = ({ rawDays, dailyDays } = DEFAULT_INSIGHTS_RETENTION) => {
+	const hourly = bucketRetention(rawDays);
+	const daily = bucketRetention(dailyDays);
+	return {
+		bundle_events: bundleEvents(rawDays),
+		bundle_event_heads: bundleEventHeads(dailyDays),
+		insights_overview: counters(hourly),
+		insights_sketches: sketches(hourly),
+		insights_overview_daily: counters(daily),
+		insights_sketches_daily: sketches(daily),
+		insights_overview_lifetime: counters(),
+		insights_sketches_lifetime: lifetimeSketches(),
+		insights_distribution: insightsDistribution(daily),
+		insights_latest_by_bundle: insightsLatestByBundle(daily),
+		insights_outcomes: insightsOutcomes(hourly),
+		insights_failures: insightsFailures(hourly)
+	};
+};
+createInsightsSchema();
+30 * DAY_MS;
+/** The `error` a failed admin route answered with, or a message naming its status. */
+var errorOf = async (response, path) => {
+	const body = await response.json().catch(() => null);
+	return new Error(typeof body === "object" && body !== null && typeof Reflect.get(body, "error") === "string" ? String(Reflect.get(body, "error")) : `The server answered ${path.split("?")[0]} with ${response.status}.`);
+};
+var withQuery = (path, input) => {
+	const query = new URLSearchParams();
+	for (const [key, value] of Object.entries(input)) if (value !== void 0) query.set(key, String(value));
+	const value = query.toString();
+	return value.length === 0 ? path : `${path}?${value}`;
+};
+var eventQuery = ({ beforeReceivedAtMs, sinceMs, cursor, limit }) => ({
+	beforeReceivedAtMs,
+	sinceMs,
+	cursor,
+	limit
+});
+/**
+* A self-hosted server's Insights, read through the admin routes its
+* `insights()` plugin serves.
+*/
+var createAdminInsightsReads = (fetchAdmin) => {
+	const read = async (path) => {
+		const response = await fetchAdmin(path);
+		if (response.status === 404) return null;
+		if (!response.ok) throw await errorOf(response, path);
+		return await response.json();
+	};
+	const required = async (path) => {
+		const value = await read(path);
+		if (value === null) throw new ConsoleFeatureUnavailableError("insights", { remote: true });
+		return value;
+	};
+	return {
+		getReportingOverview: ({ platform, channel, window, bundleId }) => required(withQuery("/overview", {
+			platform,
+			channel,
+			window,
+			bundleId
+		})),
+		listEvents: ({ bundle, ...input }) => required(withQuery("/events", {
+			...eventQuery(input),
+			...bundle === void 0 ? {} : {
+				platform: bundle.platform,
+				channel: bundle.channel,
+				bundleId: bundle.bundleId,
+				outcome: bundle.outcome
+			}
+		})),
+		listInstallationEvents: ({ installId, ...input }) => required(withQuery(`/installations/${encodeURIComponent(installId)}/events`, eventQuery(input))),
+		getInstallation: ({ installId }) => read(`/installations/${encodeURIComponent(installId)}`),
+		pageInstallationsByCurrentUserId: ({ userId, cursor, limit }) => required(withQuery("/installations", {
+			userId,
+			cursor,
+			limit
+		})),
+		getUpdateFailures: ({ platform, channel, releaseId, timeRange }) => required(withQuery("/failures", {
+			platform,
+			channel,
+			releaseId,
+			start: timeRange?.start,
+			end: timeRange?.end
+		})),
+		getRetention: () => required("/retention")
+	};
+};
+var featureApi = (api) => api;
+/** What serves each console feature, keyed like `consoleFeatures`. */
+var consoleFeatureApis = {
+	insights: featureApi({
+		local: (api) => ({
+			...createInsightsProvider(createInsightsModel(api)),
+			getRetention: async () => api.retention,
+			getUpdateFailures: api.getUpdateFailures
+		}),
+		remote: createAdminInsightsReads
+	}),
+	insightsAnalytics: featureApi({ local: (api) => createInsightsModel(api) }),
+	apiKeys: featureApi({ local: (api) => api })
+};
+var isRecord = (value) => typeof value === "object" && value !== null;
+/**
+* Whether one of Hot Updater's own factories made `plugin`: the brand they
+* set under a registered symbol, read here with a copy of the key so the
+* console imports no package's internals. Assembly refuses any other plugin
+* that takes one of their ids, so features key on it.
+*/
+var isOfficialPlugin = (plugin) => isRecord(plugin) && Reflect.get(plugin, Symbol.for("@hot-updater/server/official-plugin")) === true;
+var featureIds = Object.keys(consoleFeatureApis);
+/**
+* What serves each feature, built by its factory: over the plugins' APIs the
+* console assembled, or over a self-hosted server's admin API. A feature
+* without its plugin, or without a factory for the admin API, has none.
+*/
+var featureApis = (build) => Object.fromEntries(featureIds.flatMap((feature) => {
+	const api = build(feature);
+	return api === void 0 ? [] : [[feature, api]];
+}));
+/**
+* The console's features and what serves them, for the plugins its config
+* lists, the plugins the server runs:
+* - a self-hosted server (`standaloneRepository`) runs them itself; the
+*   console serves what that server's admin API serves of their features,
+*   and nothing that needs the database;
+* - otherwise the console runs them over the database, as the server does,
+*   and serves their features through `api`, their APIs.
+*/
+var createConsoleRuntime = (config) => {
+	const { database } = config;
+	const official = new Set(config.plugins.filter(isOfficialPlugin).map((plugin) => plugin.id));
+	if (isRemoteDatabase(database)) {
+		const { fetchAdmin } = database;
+		const features = resolveConsoleFeatures([...official], { remote: true });
+		return {
+			remote: true,
+			features: async () => features,
+			apis: featureApis((feature) => consoleFeatureApis[feature].remote?.(fetchAdmin))
+		};
+	}
+	const api = config.api ?? {};
+	const features = resolveConsoleFeatures([...official], { remote: false });
+	return {
+		remote: false,
+		features: async () => features,
+		apis: featureApis((feature) => {
+			const { plugin } = consoleFeatures[feature];
+			const pluginApi = official.has(plugin) ? api[plugin] : void 0;
+			return pluginApi === void 0 ? void 0 : consoleFeatureApis[feature].local(pluginApi);
+		})
+	};
+};
+/**
+* What serves `feature`. Every feature's server function asks for it first,
+* so a feature the console does not serve is refused with one error the
+* client recognizes, before anything is read.
+*/
+var requireFeature = async (runtime, feature) => {
+	const api = runtime.apis[feature];
+	if (api === void 0 || !(await runtime.features())[feature]) throw new ConsoleFeatureUnavailableError(feature, { remote: runtime.remote });
+	return api;
+};
+//#endregion
+export { createConsoleRuntime, requireFeature };