@hot-updater/console 1.0.0-rc.20 → 1.0.0-rc.21

package/.output/server/_ssr/{runtime.server-NucbYjc7.mjs → runtime.server-fL0o6I2b.mjs}

@@ -1,379 +1,9 @@
-import { i as resolveConsoleFeatures, n as consoleFeatures, t as ConsoleFeatureUnavailableError } from "./console-features-CsbyHYfK.mjs";
-import { C as isUUIDv7 } from "./dist-B-r4u3Lg.mjs";
-import { n as DatabasePluginInputError, o as isDatabaseJsonObject } from "./databaseRows-CXxf_VIB.mjs";
-import { t as createUUIDv7 } from "./uuidv7-BzSO-fr-.mjs";
-import { a as createCoreReads, c as engineAdapterOf, d as validateSchema, i as createCoreApi, l as pruneDuringWrites, n as aggregateBatchingModule, r as coreModule, s as createDatabaseEngine, t as OFF_ENGINE_DATABASE, u as resolveSchema } from "./api-C0G9MTMI.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/runtime.server-NucbYjc7.js
-/** Whether a configured database is a self-hosted server's. */
-var isRemoteDatabase = (database) => "core" in database && "fetchAdmin" in database;
-/** The settings rows migrations write, last, and the fence reads. */
-var SETTINGS_TABLE = {
-	name: "private_hot_updater_settings",
-	columns: [
-		{
-			name: "key",
-			type: "string",
-			nullable: false,
-			maxLength: 255
-		},
-		{
-			name: "value",
-			type: "string",
-			nullable: false,
-			maxLength: 255
-		},
-		{
-			name: "_v",
-			type: "integer",
-			nullable: false,
-			default: 0
-		}
-	],
-	key: ["key"],
-	indexes: []
-};
-/** The engine's storage-layout generation; it changes only with a migration. */
-var ENGINE_SCHEMA_KEY = "schema.engine";
-var settingMessage = (adapterName, { key, expected, found }) => `Hot Updater schema setting "${key}" for ${adapterName} is ${found === null ? "missing" : `"${found}"`}; expected "${expected}". ${key === "schema.engine" ? "Create a new empty database and run `hot-updater db migrate`; databases from before the storage engine are not converted." : "Run `hot-updater db migrate`."}`;
-/** The database needs `hot-updater db migrate`, or a new database; the handler answers 503. */
-var HotUpdaterSchemaMigrationRequiredError = class extends Error {
-	adapterName;
-	currentVersion;
-	setting;
-	constructor(adapterName, currentVersion, setting, options) {
-		super(setting !== void 0 ? settingMessage(adapterName, setting) : currentVersion === void 0 ? `Hot Updater database schema is not initialized for ${adapterName}. Run \`hot-updater db migrate\` before using this adapter.` : `Hot Updater v1 cannot migrate schema ${currentVersion} in place. Create a new empty database and run \`hot-updater db migrate\`.`, options);
-		this.adapterName = adapterName;
-		this.currentVersion = currentVersion;
-		this.setting = setting;
-		this.name = "HotUpdaterSchemaMigrationRequiredError";
-	}
-};
-/** Driver codes for a table or column the database lacks. */
-var MISSING_SCHEMA_CODES = /* @__PURE__ */ new Set([
-	"42P01",
-	"42703",
-	"ER_NO_SUCH_TABLE",
-	"ER_BAD_FIELD_ERROR"
-]);
-var MISSING_SCHEMA_MESSAGE = /no such (?:table|column)|(?:relation|column) .+ does not exist|table .+ doesn't exist|unknown column/iu;
-/**
-* Whether a read failed because a table or column is missing, so the
-* database needs migrations. ORMs may wrap the driver's error in `cause`.
-*/
-var isMissingSchemaError = (error) => {
-	for (let depth = 0; error instanceof Object && depth < 8; depth += 1) {
-		const { code, message, cause } = error;
-		if (MISSING_SCHEMA_CODES.has(String(code)) || typeof message === "string" && MISSING_SCHEMA_MESSAGE.test(message)) return true;
-		error = cause;
-	}
-	return false;
-};
-var readSettings = (adapter, keys) => adapter.get(SETTINGS_TABLE, keys.map((key) => [key]));
-/** Throws unless every expected setting is stored with its value: one batch read. */
-var checkSchemaFence = async (adapter, adapterName, expected) => {
-	const keys = Object.keys(expected);
-	let rows;
-	try {
-		rows = await readSettings(adapter, keys);
-	} catch (cause) {
-		if (!isMissingSchemaError(cause)) throw cause;
-		throw new HotUpdaterSchemaMigrationRequiredError(adapterName, void 0, {
-			key: ENGINE_SCHEMA_KEY,
-			expected: "1",
-			found: null
-		}, { cause });
-	}
-	keys.forEach((key, position) => {
-		const found = rows[position]?.value;
-		if (found !== expected[key]) throw new HotUpdaterSchemaMigrationRequiredError(adapterName, void 0, {
-			key,
-			expected: expected[key],
-			found: typeof found === "string" ? found : null
-		});
-	});
-};
-/** The database name a fenced adapter carries, so a server can fence its plugins' rows too. */
-var FENCED = Symbol.for("@hot-updater/server/schema-fence");
-/** The database name an adapter behind the schema fence reports under. */
-var fencedName = (adapter) => adapter[FENCED];
-/**
-* The adapter behind the schema fence: a process's first read or write
-* checks the settings first. Success is kept; a failure is checked again on
-* the next call.
-*/
-var withSchemaFence = (adapter, adapterName, expected) => {
-	let ready;
-	const fence = () => {
-		ready ??= checkSchemaFence(adapter, adapterName, expected).catch((error) => {
-			ready = void 0;
-			throw error;
-		});
-		return ready;
-	};
-	return {
-		...adapter,
-		[FENCED]: adapterName,
-		get: (table, keys) => fence().then(() => adapter.get(table, keys)),
-		query: (table, request) => fence().then(() => adapter.query(table, request)),
-		write: (ops) => fence().then(() => adapter.write(ops)),
-		...adapter.prune && { prune: (table, before, limit) => fence().then(() => adapter.prune(table, before, limit)) }
-	};
-};
-/** A misconfigured `createHotUpdater` call, reported at startup. */
-var HotUpdaterConfigError = class extends Error {
-	name = "HotUpdaterConfigError";
-};
-var EXPORT_NAME = /^[A-Za-z_$][\w$]*$/u;
-/**
-* Names app code cannot import as they are: reserved words, and the names
-* the printed app code declares itself.
-*/
-var UNAVAILABLE_NAMES = /* @__PURE__ */ new Set([
-	"App",
-	"HotUpdater",
-	"arguments",
-	"await",
-	"break",
-	"case",
-	"catch",
-	"class",
-	"const",
-	"continue",
-	"debugger",
-	"default",
-	"delete",
-	"do",
-	"else",
-	"enum",
-	"eval",
-	"export",
-	"extends",
-	"false",
-	"finally",
-	"for",
-	"function",
-	"if",
-	"implements",
-	"import",
-	"in",
-	"instanceof",
-	"interface",
-	"let",
-	"new",
-	"null",
-	"package",
-	"private",
-	"protected",
-	"public",
-	"return",
-	"static",
-	"super",
-	"switch",
-	"this",
-	"throw",
-	"true",
-	"try",
-	"typeof",
-	"var",
-	"void",
-	"while",
-	"with",
-	"yield"
-]);
-var isRecord$5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-/**
-* The client plugins an app adds for the plugins, each once, in plugin
-* order: what init prints in `HotUpdater.init`'s `plugins`. A malformed one,
-* or one name from two modules, throws `HotUpdaterConfigError`.
-*/
-var clientPluginsOf = (plugins) => {
-	if (!Array.isArray(plugins)) throw new HotUpdaterConfigError("plugins must be an array of plugins.");
-	const found = [];
-	for (const plugin of plugins) {
-		if (!isRecord$5(plugin) || !isRecord$5(plugin.cli)) continue;
-		const value = plugin.cli.clientPlugin;
-		if (value === void 0) continue;
-		const id = String(plugin.id);
-		if (!isRecord$5(value) || typeof value.module !== "string" || value.module === "" || typeof value.name !== "string" || !EXPORT_NAME.test(value.name) || UNAVAILABLE_NAMES.has(value.name)) throw new HotUpdaterConfigError(`Plugin "${id}" cli.clientPlugin needs a module and an export name the app can import: an identifier other than a reserved word, App, or HotUpdater.`);
-		const { module, name } = value;
-		const named = found.find((entry) => entry.name === name);
-		if (named === void 0) found.push({
-			module,
-			name
-		});
-		else if (named.module !== module) throw new HotUpdaterConfigError(`Plugin "${id}" names the client plugin "${name}" from ${module}, but another plugin names it from ${named.module}.`);
-	}
-	return found;
-};
-resolveSchema([coreModule]);
-/** Each plugin's `schema.<id>` settings row. */
-var pluginSettings = (plugins) => Object.fromEntries(plugins.map(({ id, schemaVersion }) => [`schema.${id}`, schemaVersion]));
-/** A plugin's schema as the engine resolves it: prefixed by its id unless it keeps its names. */
-var pluginModule = ({ id, schema, namespace }) => ({
-	id,
-	schema,
-	...namespace === false ? {} : { namespace: id }
-});
-var PLUGIN_KEYS = /* @__PURE__ */ new Set([
-	"id",
-	"provides",
-	"schemaVersion",
-	"schema",
-	"namespace",
-	"init",
-	"cli"
-]);
-var CLI_KEYS = /* @__PURE__ */ new Set([
-	"commands",
-	"clientCredential",
-	"clientPlugin"
-]);
-var INSTANCE_KEYS = /* @__PURE__ */ new Set([
-	"api",
-	"endpoints",
-	"clientAuth"
-]);
-var METHODS = /* @__PURE__ */ new Set([
-	"GET",
-	"POST",
-	"PUT",
-	"PATCH",
-	"DELETE"
-]);
-/** An id that prefixes table names is a SQL name; one that does not may use camelCase. */
-var PREFIX_ID = /^[a-z][a-z0-9_]*$/u;
-var UNPREFIXED_ID = /^[a-z][A-Za-z0-9_]*$/u;
-var PATH = /^(\/(:?[A-Za-z0-9_.~-]+))+$/u;
-var fail = (message) => {
-	throw new HotUpdaterConfigError(message);
-};
-var isRecord$4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var checkPlugin = (value, at) => {
-	if (!isRecord$4(value)) return fail(`${at} is not a plugin.`);
-	if ("kind" in value) fail(`${at} has a kind; core is built in and is never passed as a plugin.`);
-	const unknown = Object.keys(value).find((key) => !PLUGIN_KEYS.has(key));
-	if (unknown !== void 0) fail(`${at} has an unknown key "${unknown}".`);
-	const plugin = value;
-	if (plugin.namespace !== void 0 && plugin.namespace !== false) fail(`${at} may only set namespace: false.`);
-	const pattern = plugin.namespace === false ? UNPREFIXED_ID : PREFIX_ID;
-	if (typeof plugin.id !== "string" || !pattern.test(plugin.id)) fail(`${at} needs an id matching ${pattern.source}.`);
-	if (plugin.id === coreModule.id) fail(`${at} uses the id "core", which is core's own.`);
-	if (typeof plugin.schemaVersion !== "string" || !isRecord$4(plugin.schema) || typeof plugin.init !== "function") fail(`Plugin "${plugin.id}" needs a schemaVersion, a schema, and init.`);
-	const provides = plugin.provides;
-	if (provides !== void 0 && (!isRecord$4(provides) || Object.entries(provides).some(([key, flag]) => key !== "clientAuth" || flag !== true))) fail(`Plugin "${plugin.id}" may only declare provides: { clientAuth: true }.`);
-	const cli = value.cli;
-	if (cli !== void 0) {
-		if (!isRecord$4(cli) || Object.keys(cli).some((key) => !CLI_KEYS.has(key)) || cli.commands !== void 0 && !Array.isArray(cli.commands)) fail(`Plugin "${plugin.id}" cli may only hold commands (an array), clientCredential, and clientPlugin.`);
-		if (cli.clientCredential !== void 0 && plugin.provides?.clientAuth !== true) fail(`Plugin "${plugin.id}" adds cli.clientCredential without declaring provides: { clientAuth: true }.`);
-	}
-	return plugin;
-};
-var checkEndpoint = (id, value) => {
-	const endpoint = isRecord$4(value) ? value : {};
-	if (!METHODS.has(endpoint.method) || typeof endpoint.path !== "string" || !PATH.test(endpoint.path) || endpoint.access !== "client" && endpoint.access !== "admin" || typeof endpoint.handler !== "function") fail(`Plugin "${id}" has an endpoint that needs a method, a path like /name/:param, access "client" or "admin", and a handler.`);
-	return {
-		...endpoint,
-		plugin: id
-	};
-};
-var checkInstance = (plugin, instance) => {
-	const { id } = plugin;
-	if (!isRecord$4(instance)) return fail(`Plugin "${id}" init returned no instance.`);
-	if (typeof instance.then === "function") fail(`Plugin "${id}" init returned a promise; init must be synchronous.`);
-	const unknown = Object.keys(instance).find((key) => !INSTANCE_KEYS.has(key));
-	if (unknown !== void 0 || !("api" in instance)) fail(`Plugin "${id}" init must return { api, endpoints?, clientAuth? }${unknown === void 0 ? "" : `, not "${unknown}"`}.`);
-	const declared = plugin.provides?.clientAuth === true;
-	const clientAuth = instance.clientAuth;
-	if (declared !== (clientAuth !== void 0)) fail(declared ? `Plugin "${id}" declares provides: { clientAuth: true } but its instance has no clientAuth.` : `Plugin "${id}" returns clientAuth without declaring provides: { clientAuth: true }.`);
-	if (clientAuth !== void 0 && (typeof clientAuth.authenticate !== "function" || !Array.isArray(clientAuth.varyHeaders) || !clientAuth.varyHeaders.every((header) => typeof header === "string"))) fail(`Plugin "${id}" clientAuth needs varyHeaders and authenticate.`);
-	const endpoints = instance.endpoints ?? [];
-	if (!Array.isArray(endpoints)) fail(`Plugin "${id}" endpoints must be an array.`);
-	return {
-		api: instance.api,
-		clientAuth,
-		endpoints: endpoints.map((endpoint) => checkEndpoint(id, endpoint))
-	};
-};
-/**
-* Checks every plugin, runs each `init` once against one engine over the
-* database's storage adapter, and collects APIs, endpoints, and clientAuth.
-* Core's reads run on the same engine, so plugins read core through `ctx.core`.
-*/
-var assemblePlugins = (value, adapter, { now = Date.now, storage = { resolveFileUrl: async () => null }, verify = false, onCachedRoutesChange, batching } = {}) => {
-	if (!Array.isArray(value)) return fail("plugins must be an array of plugins.");
-	const plugins = value.map((plugin, position) => checkPlugin(plugin, `plugins[${position}]`));
-	const ids = /* @__PURE__ */ new Set();
-	for (const { id } of plugins) {
-		if (ids.has(id)) fail(`Plugin "${id}" is registered twice.`);
-		ids.add(id);
-	}
-	clientPluginsOf(plugins);
-	const modules = plugins.map(pluginModule);
-	if (modules.length > 0) validateSchema([coreModule, ...modules]);
-	const name = fencedName(adapter);
-	const fenced = name === void 0 || plugins.length === 0 ? adapter : withSchemaFence(adapter, name, pluginSettings(plugins));
-	const schema = resolveSchema([
-		coreModule,
-		...modules,
-		...batching === void 0 ? [] : [aggregateBatchingModule]
-	]);
-	const engine = createDatabaseEngine({
-		adapter: verify ? fenced : pruneDuringWrites(fenced, schema.tables, {
-			leaseTable: SETTINGS_TABLE,
-			now
-		}),
-		schema,
-		verify,
-		...batching === void 0 ? {} : {
-			batching,
-			now
-		}
-	});
-	const coreDatabase = engine.database(coreModule);
-	const core = createCoreApi(coreDatabase, storage, {
-		now,
-		...onCachedRoutesChange === void 0 ? {} : { onCachedRoutesChange }
-	});
-	const reads = createCoreReads(coreDatabase, storage);
-	const api = {};
-	const endpoints = [];
-	let clientAuth;
-	plugins.forEach((plugin, position) => {
-		const instance = checkInstance(plugin, plugin.init({
-			db: engine.database(modules[position]),
-			core: reads,
-			now
-		}));
-		if (instance.clientAuth !== void 0) {
-			if (clientAuth !== void 0) fail(`Plugins "${clientAuth.plugin}" and "${plugin.id}" both provide clientAuth; keep one.`);
-			const provided = instance.clientAuth;
-			clientAuth = {
-				plugin: plugin.id,
-				varyHeaders: provided.varyHeaders,
-				authenticate: (headers) => provided.authenticate(headers)
-			};
-		}
-		endpoints.push(...instance.endpoints);
-		api[plugin.id] = instance.api;
-	});
-	return {
-		core,
-		api,
-		endpoints,
-		...clientAuth === void 0 ? {} : { clientAuth },
-		...verify ? { measureReads: engine.measureReads } : {},
-		flush: engine.flush
-	};
-};
-function createDatabasePluginApis(database, plugins, options = {}) {
-	const adapter = engineAdapterOf(database);
-	if (adapter === void 0) throw new Error(OFF_ENGINE_DATABASE);
-	const { aggregateBatching } = database;
-	return assemblePlugins(plugins, adapter, {
-		...options,
-		...aggregateBatching === void 0 ? {} : { batching: aggregateBatching }
-	}).api;
-}
+import { i as resolveConsoleFeatures, n as consoleFeatures, t as ConsoleFeatureUnavailableError } from "./console-features-Dzu2iUGD.mjs";
+import { C as isUUIDv7 } from "./dist-Cxo9ghYv.mjs";
+import { i as isDatabaseJsonObject, t as DatabaseAdapterInputError } from "./databaseJsonValue-Bhxciy7Z.mjs";
+import { t as createUUIDv7 } from "./uuidv7-C8bwiZr8.mjs";
+import { n as defineTable, r as isRemoteDatabase, t as defineAggregate } from "./schema-BKY9SqaY.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/runtime.server-fL0o6I2b.js
 var isOptional = (value, key, valid) => !Object.hasOwn(value, key) || valid(value[key]);
 var isString = (value) => typeof value === "string";
 /** An `UPDATE_FAILED` report's stored failure: a stage and a reason, and what else the client knew. */
@@ -411,10 +41,10 @@ var hasEventInvariants = (row) => (row.type === "UPDATE_DOWNLOADED" || row.type
 * `invalid-data` for anything else.
 */
 var validateBundleEventFields = (row) => {
-	if (!isRecord$3(row)) throw new DatabasePluginInputError("invalid-data");
-	for (const field of Object.keys(row)) if (!Object.hasOwn(BUNDLE_EVENT_FIELDS, field)) throw new DatabasePluginInputError("invalid-field");
-	for (const [field, valid] of Object.entries(BUNDLE_EVENT_FIELDS)) if (!Object.hasOwn(row, field) || !valid(row[field])) throw new DatabasePluginInputError("invalid-data");
-	if (!hasEventInvariants(row)) throw new DatabasePluginInputError("invalid-data");
+	if (!isRecord$3(row)) throw new DatabaseAdapterInputError("invalid-data");
+	for (const field of Object.keys(row)) if (!Object.hasOwn(BUNDLE_EVENT_FIELDS, field)) throw new DatabaseAdapterInputError("invalid-field");
+	for (const [field, valid] of Object.entries(BUNDLE_EVENT_FIELDS)) if (!Object.hasOwn(row, field) || !valid(row[field])) throw new DatabaseAdapterInputError("invalid-data");
+	if (!hasEventInvariants(row)) throw new DatabaseAdapterInputError("invalid-data");
 };
 var encoder = new TextEncoder();
 /** Exact UTF-8 byte ordering, without case folding or Unicode normalization. */
@@ -456,9 +86,9 @@ var isEventFilter = (value) => {
 var validateRow = (model, row, result = false) => {
 	try {
 		validateBundleEventFields(row);
-		if (!isRecord$3(row) || typeof row.id !== "string" || !isUUIDv7(row.id) || [...Object.values(row), ...isRecord$3(row.metadata) ? Object.values(row.metadata) : []].some((value) => typeof value === "string" && !isWellFormedText(value))) throw new DatabasePluginInputError("invalid-data");
+		if (!isRecord$3(row) || typeof row.id !== "string" || !isUUIDv7(row.id) || [...Object.values(row), ...isRecord$3(row.metadata) ? Object.values(row.metadata) : []].some((value) => typeof value === "string" && !isWellFormedText(value))) throw new DatabaseAdapterInputError("invalid-data");
 	} catch (error) {
-		if (result) throw new DatabasePluginInputError("invalid-result");
+		if (result) throw new DatabaseAdapterInputError("invalid-result");
 		throw error;
 	}
 };
@@ -470,10 +100,10 @@ var matchesInsightsEventFilter = (event, filter) => {
 	return event.type === filter.type && event.platform === filter.platform && event.channel === filter.channel && (filter.type === "RECOVERED" ? event.from_bundle_id === filter.fromBundleId : event.to_bundle_id === filter.toBundleId && event.metadata.failure?.stage !== "check");
 };
 var invalidQuery = () => {
-	throw new DatabasePluginInputError("invalid-query");
+	throw new DatabaseAdapterInputError("invalid-query");
 };
 var invalidResult = () => {
-	throw new DatabasePluginInputError("invalid-result");
+	throw new DatabaseAdapterInputError("invalid-result");
 };
 var validateCount = (count) => isTimestamp(count) ? count : invalidResult();
 var isTimeRange = (value) => isRecord$3(value) && hasOnlyKeys(value, ["start", "end"]) && isTimestamp(value.start) && isTimestamp(value.end) && value.start < value.end;
@@ -491,7 +121,7 @@ var validateAggregateResult = (value) => {
 /** Validate custom and bundled providers at the same public boundary. */
 var createValidatedInsightsModel = (model) => ({
 	async recordEvent(input) {
-		if (!isRecord$3(input) || !hasOnlyKeys(input, ["event"])) throw new DatabasePluginInputError("invalid-data");
+		if (!isRecord$3(input) || !hasOnlyKeys(input, ["event"])) throw new DatabaseAdapterInputError("invalid-data");
 		validateRow("bundle_events", input.event);
 		await model.recordEvent(input);
 	},
@@ -611,6 +241,10 @@ var createInsightsModel = (api) => createValidatedInsightsModel({
 	getReleaseActivity: api.getReleaseActivity,
 	getAppUsage: api.getAppUsage
 });
+/**
+* What Insights' API throws for an input it refuses, such as an unknown
+* event field or a malformed cursor; its routes answer 400 for it.
+*/
 var InsightsBadRequestError = class extends Error {
 	name = "InsightsBadRequestError";
 };
@@ -863,7 +497,7 @@ var MAX_EVENT_ID_LENGTH = 1024;
 var MAX_IDENTITY_LENGTH = 255;
 var MAX_CURSOR_LENGTH = 8192;
 var HOUR_MS = 36e5;
-var DAY_MS = 24 * HOUR_MS;
+var DAY_MS$1 = 24 * HOUR_MS;
 var WINDOW_MS = {
 	"24h": 864e5,
 	"7d": 6048e5,
@@ -1151,7 +785,7 @@ var createInsightsProvider = (model) => Object.freeze({
 		const now = Date.now();
 		const beforeReceivedAtMs = now - now % HOUR_MS + (now % HOUR_MS === 0 ? 0 : HOUR_MS);
 		const reach = Math.max(0, beforeReceivedAtMs - WINDOW_MS[window]);
-		const sinceMs = reach - reach % DAY_MS;
+		const sinceMs = reach - reach % DAY_MS$1;
 		const measure = async (count) => {
 			const value = await count;
 			if (!Number.isSafeInteger(value) || value < 0) throw new Error("Insights database returned an invalid count.");
@@ -1222,6 +856,464 @@ var createInsightsProvider = (model) => Object.freeze({
 		};
 	}
 });
+var DAY_MS = 864e5;
+var DEFAULT_INSIGHTS_RETENTION = {
+	rawDays: 90,
+	dailyDays: 400
+};
+var bucketRetention = (days) => ({
+	field: "bucket_start_ms",
+	days
+});
+var MOVEMENTS = /* @__PURE__ */ new Set([
+	"UPDATE_DOWNLOADED",
+	"UPDATE_APPLIED",
+	"RECOVERED",
+	"UPDATE_FAILED"
+]);
+/** A failed update check: it names no target bundle, so no bundle list shows it. */
+var isFailedCheck = (row) => row.type === "UPDATE_FAILED" && row.metadata?.failure?.stage === "check";
+/**
+* Downloads, applies, recoveries, and update failures, whole. An UNCHANGED
+* report counts as a launch and moves its installation's head, but no list
+* shows it, so no row keeps it.
+*/
+var bundleEvents = (days) => defineTable({
+	id: {
+		type: "string",
+		maxLength: 36
+	},
+	type: {
+		type: "string",
+		maxLength: 32
+	},
+	install_id: {
+		type: "string",
+		maxLength: 255
+	},
+	user_id: {
+		type: "string",
+		maxLength: 255,
+		required: false
+	},
+	from_release_id: {
+		type: "string",
+		maxLength: 36,
+		required: false
+	},
+	from_bundle_id: {
+		type: "string",
+		maxLength: 36,
+		required: false
+	},
+	to_release_id: {
+		type: "string",
+		maxLength: 36,
+		required: false
+	},
+	to_bundle_id: {
+		type: "string",
+		maxLength: 36
+	},
+	platform: {
+		type: "string",
+		maxLength: 16
+	},
+	app_version: { type: "string" },
+	channel: { type: "string" },
+	metadata: { type: "json" },
+	received_at_ms: { type: "integer" }
+}, {
+	key: ["id"],
+	derived: {
+		day: {
+			type: "integer",
+			compute: (row) => row.received_at_ms - row.received_at_ms % DAY_MS
+		},
+		movement_install_id: {
+			type: "string",
+			compute: (row) => MOVEMENTS.has(row.type) ? row.install_id : null
+		},
+		bundle_ref: {
+			type: "string",
+			multi: true,
+			compute: (row) => isFailedCheck(row) ? [] : [row.type === "RECOVERED" && row.from_bundle_id !== null ? `from:${row.from_bundle_id}` : `to:${row.to_bundle_id}`]
+		}
+	},
+	indexes: {
+		recent: {
+			eq: [
+				"channel",
+				"platform",
+				"day"
+			],
+			sort: ["received_at_ms"]
+		},
+		movementsByInstall: {
+			eq: ["movement_install_id"],
+			sort: ["received_at_ms"]
+		},
+		byBundle: {
+			eq: [
+				"platform",
+				"channel",
+				"type",
+				"bundle_ref",
+				"day"
+			],
+			sort: ["received_at_ms"]
+		},
+		byDay: {
+			eq: ["day"],
+			sort: ["received_at_ms"]
+		}
+	},
+	retention: {
+		field: "day",
+		days
+	}
+});
+/**
+* Each installation's latest event, whole, so reading it is one point read.
+* Its gauges count it in the UTC day of that event. An update failure moves
+* nothing, so no head holds one.
+*/
+var bundleEventHeads = (days) => defineTable({
+	install_id: {
+		type: "string",
+		maxLength: 255
+	},
+	id: {
+		type: "string",
+		maxLength: 36
+	},
+	type: {
+		type: "string",
+		maxLength: 32
+	},
+	user_id: {
+		type: "string",
+		maxLength: 255,
+		required: false
+	},
+	from_release_id: {
+		type: "string",
+		maxLength: 36,
+		required: false
+	},
+	from_bundle_id: {
+		type: "string",
+		maxLength: 36,
+		required: false
+	},
+	to_release_id: {
+		type: "string",
+		maxLength: 36,
+		required: false
+	},
+	to_bundle_id: {
+		type: "string",
+		maxLength: 36
+	},
+	platform: {
+		type: "string",
+		maxLength: 16
+	},
+	app_version: { type: "string" },
+	channel: { type: "string" },
+	metadata: { type: "json" },
+	received_at_ms: { type: "integer" }
+}, {
+	key: ["install_id"],
+	indexes: { byUser: {
+		eq: ["user_id"],
+		sort: ["install_id"]
+	} },
+	retention: {
+		field: "received_at_ms",
+		days
+	}
+});
+/**
+* Shards are keyed by install id. Counters are blind increments and never
+* conflict, so they keep 8. Gauges and sketches are read, merged, and written
+* back. B3's rollout gate on PostgreSQL retried 2.4% of transactions at 8
+* shards and 1.3% at 16. DynamoDB's transactions take longer, so D8's gate
+* on DynamoDB Local retried 2–24% at 16, almost all on gauge rows, and 1–5%
+* with gauges at 32. Sketches stay at 16: each shard row carries 2 KB of
+* registers that every read merges.
+*
+* Every Insights aggregate is `batched`: on DynamoDB and Firestore, which
+* bill each write, an event's changes apply after it commits, merged with
+* other events' into one write per row, on one shard per writer.
+*/
+var COUNTER_SHARDS = 8;
+var GAUGE_SHARDS = 32;
+var SKETCH_SHARDS = 16;
+/** Rows keyed by a hashed identity (scope and period) and a bucket. */
+var identityFields = {
+	identity: {
+		type: "string",
+		maxLength: 32
+	},
+	bucket_start_ms: { type: "integer" }
+};
+var window = {
+	eq: ["identity"],
+	sort: ["bucket_start_ms"]
+};
+/**
+* Counters of one period kind: hourly, daily, or lifetime at bucket 0. A
+* release or channel row counts downloads, launches, and failed launches,
+* and downloads a patch delivered and those that fell back from one. A
+* release's lifetime row counts its failed updates (`failed_updates`), since
+* no breakdown row outlives the raw period; windowed reads sum
+* `insights_failures` instead.
+*/
+var counters = (retention) => defineAggregate(identityFields, {
+	key: ["identity", "bucket_start_ms"],
+	counters: [
+		"downloads",
+		"launches",
+		"failed_launches",
+		"failed_updates",
+		"patch_downloads",
+		"patch_fallbacks"
+	],
+	shards: COUNTER_SHARDS,
+	batched: true,
+	indexes: { window },
+	...retention === void 0 ? {} : { retention }
+});
+/**
+* Unique-installation sketches of one period kind. Rows of a failure
+* identity (`failure` and `check` scopes) keep only `failed_users`, so a
+* release's launch rows never grow by a failure's registers.
+*/
+var sketches = (retention) => defineAggregate(identityFields, {
+	key: ["identity", "bucket_start_ms"],
+	distinct: [
+		"launch_users",
+		"activity_users",
+		"failed_users"
+	],
+	shards: SKETCH_SHARDS,
+	batched: true,
+	indexes: { window },
+	retention
+});
+/** Installations whose update to a release failed, since its first failure: kept, at bucket 0. */
+var lifetimeSketches = () => defineAggregate(identityFields, {
+	key: ["identity", "bucket_start_ms"],
+	distinct: ["failed_users"],
+	shards: SKETCH_SHARDS,
+	batched: true,
+	indexes: { window }
+});
+/**
+* Update failures by what failed, and recoveries by why the crashed process
+* exited, a row an hour. `release_id` is the failed update's target release,
+* or empty for a failed check or an unknown target, and the recovered
+* release for a recovery. A failure's `stage` and `reason` say where and why
+* it failed, and `detail` what else the client knew, as the JSON array
+* `[resource, httpStatus, originCode, transport]`. A recovery's stage is
+* `launch` and its reason the exit reason, with an empty detail. Every index
+* is in key order, so its counters stay blind increments.
+*/
+var insightsFailures = (retention) => defineAggregate({
+	platform: {
+		type: "string",
+		maxLength: 16
+	},
+	channel: { type: "string" },
+	bucket_start_ms: { type: "integer" },
+	release_id: {
+		type: "string",
+		maxLength: 36
+	},
+	stage: {
+		type: "string",
+		maxLength: 16
+	},
+	reason: {
+		type: "string",
+		maxLength: 64
+	},
+	detail: {
+		type: "string",
+		maxLength: 160
+	}
+}, {
+	key: [
+		"platform",
+		"channel",
+		"bucket_start_ms",
+		"release_id",
+		"stage",
+		"reason",
+		"detail"
+	],
+	counters: ["events"],
+	shards: COUNTER_SHARDS,
+	batched: true,
+	indexes: { byScope: {
+		eq: ["platform", "channel"],
+		sort: ["bucket_start_ms"]
+	} },
+	retention
+});
+/** Installations counted in the UTC day of their latest event, so reads sum whole UTC days. */
+var insightsDistribution = (retention) => defineAggregate({
+	channel: { type: "string" },
+	platform: {
+		type: "string",
+		maxLength: 16
+	},
+	app_version: { type: "string" },
+	release_id: {
+		type: "string",
+		maxLength: 36
+	},
+	bucket_start_ms: { type: "integer" }
+}, {
+	key: [
+		"channel",
+		"platform",
+		"app_version",
+		"release_id",
+		"bucket_start_ms"
+	],
+	gauges: ["latest_installations"],
+	shards: GAUGE_SHARDS,
+	batched: true,
+	indexes: {
+		byScope: {
+			eq: ["channel", "platform"],
+			sort: ["bucket_start_ms"]
+		},
+		byVersion: {
+			eq: [
+				"channel",
+				"platform",
+				"app_version"
+			],
+			sort: ["bucket_start_ms"]
+		}
+	},
+	retention
+});
+/** Latest events by the bundle they came from or went to, bucketed like the distribution. */
+var insightsLatestByBundle = (retention) => defineAggregate({
+	platform: {
+		type: "string",
+		maxLength: 16
+	},
+	channel: { type: "string" },
+	bundle_field: {
+		type: "string",
+		maxLength: 16
+	},
+	bundle_id: {
+		type: "string",
+		maxLength: 36
+	},
+	type: {
+		type: "string",
+		maxLength: 32
+	},
+	bucket_start_ms: { type: "integer" }
+}, {
+	key: [
+		"platform",
+		"channel",
+		"bundle_field",
+		"bundle_id",
+		"type",
+		"bucket_start_ms"
+	],
+	gauges: ["installations"],
+	shards: GAUGE_SHARDS,
+	batched: true,
+	indexes: { byBundle: {
+		eq: [
+			"platform",
+			"channel",
+			"bundle_field",
+			"bundle_id",
+			"type"
+		],
+		sort: ["bucket_start_ms"]
+	} },
+	retention
+});
+/**
+* Stored events by outcome and the bundle a bundle filter matches, a row an
+* hour, which a failed check has none of; and every stored event, a row a UTC
+* day (`DAILY_EVENTS`). Bundle counts sum the hourly rows, and event lists
+* read either to skip days without events.
+*/
+var insightsOutcomes = (retention) => defineAggregate({
+	platform: {
+		type: "string",
+		maxLength: 16
+	},
+	channel: { type: "string" },
+	type: {
+		type: "string",
+		maxLength: 32
+	},
+	bundle_ref: {
+		type: "string",
+		maxLength: 41
+	},
+	bucket_start_ms: { type: "integer" }
+}, {
+	key: [
+		"platform",
+		"channel",
+		"type",
+		"bundle_ref",
+		"bucket_start_ms"
+	],
+	counters: ["events"],
+	shards: COUNTER_SHARDS,
+	batched: true,
+	indexes: { byRef: {
+		eq: [
+			"platform",
+			"channel",
+			"type",
+			"bundle_ref"
+		],
+		sort: ["bucket_start_ms"]
+	} },
+	retention
+});
+/**
+* Insights' tables, each expiring after its period. The periods are values
+* the engine applies at runtime; the tables and indexes are the same for
+* any periods.
+*/
+var createInsightsSchema = ({ rawDays, dailyDays } = DEFAULT_INSIGHTS_RETENTION) => {
+	const hourly = bucketRetention(rawDays);
+	const daily = bucketRetention(dailyDays);
+	return {
+		bundle_events: bundleEvents(rawDays),
+		bundle_event_heads: bundleEventHeads(dailyDays),
+		insights_overview: counters(hourly),
+		insights_sketches: sketches(hourly),
+		insights_overview_daily: counters(daily),
+		insights_sketches_daily: sketches(daily),
+		insights_overview_lifetime: counters(),
+		insights_sketches_lifetime: lifetimeSketches(),
+		insights_distribution: insightsDistribution(daily),
+		insights_latest_by_bundle: insightsLatestByBundle(daily),
+		insights_outcomes: insightsOutcomes(hourly),
+		insights_failures: insightsFailures(hourly)
+	};
+};
+createInsightsSchema();
+30 * DAY_MS;
 /** The `error` a failed admin route answered with, or a message naming its status. */
 var errorOf = async (response, path) => {
 	const body = await response.json().catch(() => null);
@@ -1303,22 +1395,13 @@ var consoleFeatureApis = {
 	apiKeys: featureApi({ local: (api) => api })
 };
 var isRecord = (value) => typeof value === "object" && value !== null;
-/** The ids of the plugins a self-hosted server lists on its admin `/version`. */
-var readServerPlugins = async (fetchAdmin) => {
-	const response = await fetchAdmin("/version");
-	if (!response.ok) throw new Error(`The server answered /version with ${response.status}.`);
-	const body = await response.json();
-	const plugins = isRecord(body) ? body.plugins : void 0;
-	return Array.isArray(plugins) ? plugins.filter((id) => typeof id === "string") : [];
-};
-/** Runs `load` once and keeps its result; a failure is not kept, so the next call retries. */
-var once = (load) => {
-	let pending;
-	return () => pending ??= load().catch((error) => {
-		pending = void 0;
-		throw error;
-	});
-};
+/**
+* Whether one of Hot Updater's own factories made `plugin`: the brand they
+* set under a registered symbol, read here with a copy of the key so the
+* console imports no package's internals. Assembly refuses any other plugin
+* that takes one of their ids, so features key on it.
+*/
+var isOfficialPlugin = (plugin) => isRecord(plugin) && Reflect.get(plugin, Symbol.for("@hot-updater/server/official-plugin")) === true;
 var featureIds = Object.keys(consoleFeatureApis);
 /**
 * What serves each feature, built by its factory: over the plugins' APIs the
@@ -1330,30 +1413,34 @@ var featureApis = (build) => Object.fromEntries(featureIds.flatMap((feature) =>
 	return api === void 0 ? [] : [[feature, api]];
 }));
 /**
-* The console's features and what serves them, for a console config:
-* - a self-hosted server (`standaloneRepository`) runs its plugins and lists
-*   them on its admin `/version`; the console serves what that server's admin
-*   API serves, and nothing that needs the database;
-* - otherwise the console assembles `plugins` over the database, as the
-*   server does, and serves the features of the plugins it assembled.
+* The console's features and what serves them, for the plugins its config
+* lists, the plugins the server runs:
+* - a self-hosted server (`standaloneRepository`) runs them itself; the
+*   console serves what that server's admin API serves of their features,
+*   and nothing that needs the database;
+* - otherwise the console runs them over the database, as the server does,
+*   and serves their features through `api`, their APIs.
 */
 var createConsoleRuntime = (config) => {
 	const { database } = config;
+	const official = new Set(config.plugins.filter(isOfficialPlugin).map((plugin) => plugin.id));
 	if (isRemoteDatabase(database)) {
 		const { fetchAdmin } = database;
+		const features = resolveConsoleFeatures([...official], { remote: true });
 		return {
 			remote: true,
-			features: once(async () => resolveConsoleFeatures(await readServerPlugins(fetchAdmin), { remote: true })),
+			features: async () => features,
 			apis: featureApis((feature) => consoleFeatureApis[feature].remote?.(fetchAdmin))
 		};
 	}
-	const api = createDatabasePluginApis(database, config.plugins ?? []);
-	const features = resolveConsoleFeatures(Object.keys(api), { remote: false });
+	const api = config.api ?? {};
+	const features = resolveConsoleFeatures([...official], { remote: false });
 	return {
 		remote: false,
 		features: async () => features,
 		apis: featureApis((feature) => {
-			const pluginApi = api[consoleFeatures[feature].plugin];
+			const { plugin } = consoleFeatures[feature];
+			const pluginApi = official.has(plugin) ? api[plugin] : void 0;
 			return pluginApi === void 0 ? void 0 : consoleFeatureApis[feature].local(pluginApi);
 		})
 	};