@hot-updater/firebase 1.0.0-rc.36 → 1.0.0-rc.37

package/dist/firebase/functions/index.cjs

@@ -4524,7 +4524,7 @@ const createKvAdapter = ({ store, tablePrefix = "" }) => {
 };
 //#endregion
 //#region ../../packages/server/dist/version.mjs
-const HOT_UPDATER_SERVER_VERSION = "1.0.0-rc.36";
+const HOT_UPDATER_SERVER_VERSION = "1.0.0-rc.37";
 //#endregion
 //#region ../../packages/server/dist/handlerVersionRoutes.mjs
 /**
@@ -7681,1503 +7681,1560 @@ const apiKeys = (options = {}) => {
 	return markOfficial$1(plugin);
 };
 //#endregion
-//#region ../insights/dist/server/eventRow.mjs
-const isOptional = (value, key, valid) => !Object.hasOwn(value, key) || valid(value[key]);
-const isString = (value) => typeof value === "string";
-const isDatabaseHttpResponse = (value) => isDatabaseJsonObject(value) && (value.resource === "catalog" || value.resource === "artifact") && isString(value.path) && Number.isSafeInteger(value.status) && (value.body === null || isString(value.body)) && typeof value.body_truncated === "boolean" && Number.isSafeInteger(value.received_at_ms);
-/** An `UPDATE_FAILED` report's stored failure: a stage and a reason, and what else the client knew. */
-const isDatabaseBundleEventFailure = (value) => isDatabaseJsonObject(value) && isString(value.stage) && isString(value.reason) && isOptional(value, "resource", isString) && isOptional(value, "http_status", (status) => Number.isSafeInteger(status)) && isOptional(value, "transport", isString) && isOptional(value, "origin_code", isString) && isOptional(value, "error_message", isString) && isOptional(value, "error_stack", isString);
-const isDatabaseBundleEventMetadata = (value) => isDatabaseJsonObject(value) && typeof value.cohort === "string" && (value.update_strategy === null || value.update_strategy === "fingerprint" || value.update_strategy === "appVersion") && (value.fingerprint_hash === null || typeof value.fingerprint_hash === "string") && (value.sdk_version === null || typeof value.sdk_version === "string") && isOptional(value, "min_bundle_id", isString) && isOptional(value, "failure", isDatabaseBundleEventFailure) && isOptional(value, "http_response", isDatabaseHttpResponse) && isOptional(value, "delivery", isString) && isOptional(value, "patch_fallback", (flag) => typeof flag === "boolean");
-const isRecord$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+//#region ../insights/dist/server/schema.mjs
+const HOUR_MS$1 = 36e5;
+const DAY_MS$1 = 864e5;
+const DEFAULT_INSIGHTS_RETENTION = {
+	rawDays: 90,
+	dailyDays: 400
+};
+const bucketRetention = (days) => ({
+	field: "bucket_start_ms",
+	days
+});
+/** Every kind of row the table keeps belongs in installation history. */
+const MOVEMENTS = /* @__PURE__ */ new Set([
+	"UPDATE_DOWNLOADED",
+	"UPDATE_APPLIED",
+	"RECOVERED",
+	"UPDATE_FAILED",
+	"UNCHANGED"
+]);
+/** A failed update check: it names no target bundle, so no bundle list shows it. */
+const isFailedCheck = (row) => row.type === "UPDATE_FAILED" && row.metadata?.failure?.stage === "check";
+const metadataOf = (row) => row.metadata ?? {};
+/** A download or apply that arrived after its target ran: it counts nothing. */
+const isLateEvent = (row) => metadataOf(row).late === true;
 /**
-* The built-in bundle a report says its installation runs: the running
-* bundle, which a download leaves at its source, when it is the native
-* build's built-in bundle, whatever Release selected it. Null for any other
-* bundle, and for a report without the build's built-in bundle ID.
+* Whether a stored row launched its installation into a bundle release: an
+* apply, or a kept UNCHANGED row that moved the installation to another
+* bundle of a release, as when the apply report never arrived or a rollback
+* to the built-in bundle took it there. A first report, a release change of
+* the bundle already running, and a late row launch nothing.
 */
-const runningBuiltinBundleId = (row) => {
-	const running = row.type === "UPDATE_DOWNLOADED" ? row.from_bundle_id : row.to_bundle_id;
-	const builtin = isRecord$2(row.metadata) ? row.metadata.min_bundle_id : null;
-	return typeof builtin === "string" && running === builtin ? builtin : null;
+const isLaunch = (row) => {
+	if (isLateEvent(row)) return false;
+	if (row.type === "UPDATE_APPLIED") return true;
+	if (row.type !== "UNCHANGED") return false;
+	const kinds = metadataOf(row).change?.kinds ?? [];
+	return kinds.includes("bundle") && !kinds.includes("first_seen") && row.to_release_id !== null;
 };
-const isIdentity$1 = (value) => typeof value === "string" && value.length > 0 && value.length <= 255;
-const isTextOrNull = (value) => value === null || typeof value === "string";
-/** Each bundle event field and what it holds. */
-const BUNDLE_EVENT_FIELDS = {
-	id: (value) => typeof value === "string",
-	type: (value) => value === "UPDATE_DOWNLOADED" || value === "UPDATE_APPLIED" || value === "RECOVERED" || value === "UPDATE_FAILED" || value === "UNCHANGED",
-	install_id: isIdentity$1,
-	user_id: (value) => value === null || isIdentity$1(value),
-	from_bundle_id: isTextOrNull,
-	from_release_id: isTextOrNull,
-	to_release_id: isTextOrNull,
-	to_bundle_id: (value) => typeof value === "string",
-	platform: (value) => value === "ios" || value === "android",
-	app_version: (value) => typeof value === "string",
-	channel: (value) => typeof value === "string",
-	metadata: isDatabaseBundleEventMetadata,
-	received_at_ms: (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0
-};
-const updateStrategyOf = (row) => isRecord$2(row.metadata) ? row.metadata.update_strategy : void 0;
 /**
-* A movement, or a failed update, names the bundle it left and how the
-* device updates, and a failed update says what failed; an unchanged report
-* names neither.
+* The bundle a stored row's bundle filter matches: `from:<bundle>` for a
+* recovery; `to:<bundle>` for a download, an apply, and an update failure;
+* `on:<bundle>` for an UNCHANGED row that launched a bundle (`isLaunch`), a
+* key no other row uses. None for a failed check, which targets no bundle, a
+* late row, or any other UNCHANGED row.
 */
-const hasEventInvariants = (row) => (row.type === "UPDATE_DOWNLOADED" || row.type === "UPDATE_APPLIED" || row.type === "RECOVERED" || row.type === "UPDATE_FAILED") && typeof row.from_bundle_id === "string" && (updateStrategyOf(row) === "fingerprint" || updateStrategyOf(row) === "appVersion") && (row.type !== "UPDATE_FAILED" || isRecord$2(row.metadata) && isRecord$2(row.metadata.failure)) || row.type === "UNCHANGED" && row.from_bundle_id === null && updateStrategyOf(row) === null;
+const bundleRefsOf = (row) => {
+	if (isFailedCheck(row) || isLateEvent(row)) return [];
+	if (row.type === "RECOVERED") return [`from:${row.from_bundle_id}`];
+	if (row.type === "UNCHANGED") return isLaunch(row) ? [`on:${row.to_bundle_id}`] : [];
+	return [`to:${row.to_bundle_id}`];
+};
+/** The key a bundle filter reads, as `bundleRefsOf` writes it. */
+const bundleRefOfFilter = (filter) => filter.type === "RECOVERED" ? `from:${filter.fromBundleId}` : filter.type === "UNCHANGED" ? `on:${filter.toBundleId}` : `to:${filter.toBundleId}`;
 /**
-* Throws unless `row` has exactly the bundle event fields, each of its type,
-* and the invariants of its event type: `invalid-field` for an unknown field,
-* `invalid-data` for anything else.
+* Downloads, applies, recoveries, update failures, and the UNCHANGED
+* reports that changed what their installation runs, whole. An UNCHANGED
+* report that changes nothing counts as a launch and moves its
+* installation's head, but no row keeps it.
 */
-const validateBundleEventFields = (row) => {
-	if (!isRecord$2(row)) throw new DatabaseAdapterInputError("invalid-data");
-	for (const field of Object.keys(row)) if (!Object.hasOwn(BUNDLE_EVENT_FIELDS, field)) throw new DatabaseAdapterInputError("invalid-field");
-	for (const [field, valid] of Object.entries(BUNDLE_EVENT_FIELDS)) if (!Object.hasOwn(row, field) || !valid(row[field])) throw new DatabaseAdapterInputError("invalid-data");
-	if (!hasEventInvariants(row)) throw new DatabaseAdapterInputError("invalid-data");
-};
-//#endregion
-//#region ../insights/dist/server/contract.mjs
-const encoder = new TextEncoder();
-/** Exact UTF-8 byte ordering, without case folding or Unicode normalization. */
-const compareInsightsText = (left, right) => {
-	const a = encoder.encode(left);
-	const b = encoder.encode(right);
-	for (let index = 0; index < Math.min(a.length, b.length); index += 1) if (a[index] !== b[index]) return a[index] - b[index];
-	return a.length - b.length;
-};
-const isWellFormedText = (value) => {
-	for (const character of value) {
-		const point = character.codePointAt(0);
-		if (point >= 55296 && point <= 57343) return false;
-	}
-	return true;
-};
-const isIdentity = (value) => typeof value === "string" && value.length > 0 && value.length <= 255 && isWellFormedText(value);
-const isText$1 = (value) => typeof value === "string" && value.length > 0 && isWellFormedText(value);
-const isTimestamp = (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
-const isLimit = (value) => isTimestamp(value) && value >= 1 && value <= 101;
-const hasOnlyKeys = (value, keys) => Object.keys(value).every((key) => keys.includes(key));
-const hasScope = (value) => (value.platform === "ios" || value.platform === "android") && isText$1(value.channel);
-const isBundleFilter = (value, withKind = false) => {
-	if (!isRecord$2(value) || !hasScope(value)) return false;
-	const keys = [
-		"platform",
-		"channel",
-		"type",
-		...withKind ? ["kind"] : []
-	];
-	return value.type === "RECOVERED" ? isText$1(value.fromBundleId) && hasOnlyKeys(value, [...keys, "fromBundleId"]) : (value.type === "UPDATE_DOWNLOADED" || value.type === "UPDATE_APPLIED" || value.type === "UPDATE_FAILED") && isText$1(value.toBundleId) && hasOnlyKeys(value, [...keys, "toBundleId"]);
-};
-const isEventFilter = (value) => {
-	if (!isRecord$2(value)) return false;
-	if (value.kind === "all") return hasOnlyKeys(value, ["kind"]);
-	if (value.kind === "installationMovement") return isIdentity(value.installId) && hasOnlyKeys(value, ["kind", "installId"]);
-	return value.kind === "bundle" && isBundleFilter(value, true);
-};
-const validateRow = (model, row, result = false) => {
-	try {
-		validateBundleEventFields(row);
-		if (!isRecord$2(row) || typeof row.id !== "string" || !isUUIDv7(row.id) || [...Object.values(row), ...isRecord$2(row.metadata) ? Object.values(row.metadata) : []].some((value) => typeof value === "string" && !isWellFormedText(value))) throw new DatabaseAdapterInputError("invalid-data");
-	} catch (error) {
-		if (result) throw new DatabaseAdapterInputError("invalid-result");
-		throw error;
-	}
-};
-/** Throws `invalid-data` unless `row` is a complete, well-formed bundle event row. */
-const assertBundleEventRow = (row) => validateRow("bundle_events", row);
-/** Downloads, applies, recoveries, and failed updates belong in installation history. */
-const isInsightsMovementEvent = (event) => event.type === "UPDATE_DOWNLOADED" || event.type === "UPDATE_APPLIED" || event.type === "RECOVERED" || event.type === "UPDATE_FAILED";
-const matchesInsightsEventFilter = (event, filter) => {
-	if (filter.kind === "all") return true;
-	if (filter.kind === "installationMovement") return event.install_id === filter.installId && isInsightsMovementEvent(event);
-	return event.type === filter.type && event.platform === filter.platform && event.channel === filter.channel && (filter.type === "RECOVERED" ? event.from_bundle_id === filter.fromBundleId : event.to_bundle_id === filter.toBundleId && event.metadata.failure?.stage !== "check");
-};
-const invalidQuery = () => {
-	throw new DatabaseAdapterInputError("invalid-query");
-};
-const invalidResult = () => {
-	throw new DatabaseAdapterInputError("invalid-result");
-};
-const validateCount = (count) => isTimestamp(count) ? count : invalidResult();
-const isTimeRange = (value) => isRecord$2(value) && hasOnlyKeys(value, ["start", "end"]) && isTimestamp(value.start) && isTimestamp(value.end) && value.start < value.end;
-const isReleaseReference = (value) => isRecord$2(value) && hasOnlyKeys(value, [
-	"releaseId",
-	"platform",
-	"channel"
-]) && isIdentity(value.releaseId) && hasScope(value);
-const validateAggregateResult = (value) => {
-	const result = isRecord$2(value) ? value : invalidResult();
-	if (!isTimestamp(result.measuredAtMs)) invalidResult();
-	const coverage = result.coverage;
-	if (!isRecord$2(coverage) || coverage.kind !== "complete" && coverage.kind !== "partial" || coverage.sinceMs !== null && !isTimestamp(coverage.sinceMs)) invalidResult();
-};
-/** Validate custom and bundled providers at the same public boundary. */
-const createValidatedInsightsModel = (model) => ({
-	async recordEvent(input) {
-		if (!isRecord$2(input) || !hasOnlyKeys(input, ["event"])) throw new DatabaseAdapterInputError("invalid-data");
-		validateRow("bundle_events", input.event);
-		await model.recordEvent(input);
+const bundleEvents = (days) => defineTable({
+	id: {
+		type: "string",
+		maxLength: 36
 	},
-	async listEvents(input) {
-		if (!isRecord$2(input) || !hasOnlyKeys(input, [
-			"filter",
-			"sinceMs",
-			"beforeReceivedAtMs",
-			"after",
-			"limit"
-		]) || !isEventFilter(input.filter) || !isLimit(input.limit) || !isTimestamp(input.beforeReceivedAtMs) || input.sinceMs !== void 0 && !isTimestamp(input.sinceMs)) invalidQuery();
-		const sinceMs = input.sinceMs ?? 0;
-		if (sinceMs > input.beforeReceivedAtMs || input.after !== void 0 && (!isRecord$2(input.after) || !hasOnlyKeys(input.after, ["receivedAtMs", "id"]) || !isTimestamp(input.after.receivedAtMs) || typeof input.after.id !== "string" || !isUUIDv7(input.after.id) || input.after.receivedAtMs < sinceMs || input.after.receivedAtMs >= input.beforeReceivedAtMs)) invalidQuery();
-		const rows = await model.listEvents(input);
-		if (!Array.isArray(rows) || rows.length > input.limit) invalidResult();
-		let previous = input.after;
-		for (const row of rows) {
-			validateRow("bundle_events", row, true);
-			if (row.received_at_ms < sinceMs || row.received_at_ms >= input.beforeReceivedAtMs || !matchesInsightsEventFilter(row, input.filter) || previous !== void 0 && (row.received_at_ms > previous.receivedAtMs || row.received_at_ms === previous.receivedAtMs && row.id >= previous.id)) invalidResult();
-			previous = {
-				receivedAtMs: row.received_at_ms,
-				id: row.id
-			};
-		}
-		return rows;
+	type: {
+		type: "string",
+		maxLength: 32
 	},
-	async findLatestEvents(input) {
-		if (!isRecord$2(input)) invalidQuery();
-		if ("installId" in input) {
-			if (!hasOnlyKeys(input, ["installId"]) || !isIdentity(input.installId)) invalidQuery();
-		} else if (!hasOnlyKeys(input, [
-			"userId",
-			"afterInstallId",
-			"limit"
-		]) || !isIdentity(input.userId) || !isLimit(input.limit) || input.afterInstallId !== void 0 && !isIdentity(input.afterInstallId)) invalidQuery();
-		const rows = await model.findLatestEvents(input);
-		if (!Array.isArray(rows) || rows.length > ("installId" in input ? 1 : input.limit)) invalidResult();
-		let previous = "installId" in input ? void 0 : input.afterInstallId;
-		for (const row of rows) {
-			validateRow("bundle_events", row, true);
-			if ("installId" in input ? row.install_id !== input.installId : row.user_id !== input.userId || previous !== void 0 && compareInsightsText(row.install_id, previous) <= 0) invalidResult();
-			previous = row.install_id;
-		}
-		return rows;
+	install_id: {
+		type: "string",
+		maxLength: 255
 	},
-	async countLatestEvents(input) {
-		if (!isRecord$2(input) || !hasOnlyKeys(input, [
-			"platform",
-			"channel",
-			"sinceMs",
-			"bundle"
-		]) || !hasScope(input) || !isTimestamp(input.sinceMs) || input.bundle !== void 0 && (!Array.isArray(input.bundle) || input.bundle.length < 1 || input.bundle.length > 2 || input.bundle.some((bundle) => !isRecord$2(bundle) || !hasOnlyKeys(bundle, [
-			"field",
-			"value",
-			"types"
-		]) || bundle.field !== "from_bundle_id" && bundle.field !== "to_bundle_id" || !isText$1(bundle.value) || !Array.isArray(bundle.types) || bundle.types.length === 0 || bundle.types.some((type) => ![
-			"UNCHANGED",
-			"UPDATE_DOWNLOADED",
-			"UPDATE_APPLIED",
-			"RECOVERED"
-		].includes(type))))) invalidQuery();
-		return validateCount(await model.countLatestEvents(input));
+	user_id: {
+		type: "string",
+		maxLength: 255,
+		required: false
 	},
-	async countEvents(input) {
-		if (!isRecord$2(input) || !hasOnlyKeys(input, [
-			"filter",
-			"sinceMs",
-			"beforeReceivedAtMs"
-		]) || !isBundleFilter(input.filter) || !isTimestamp(input.sinceMs) || !isTimestamp(input.beforeReceivedAtMs) || input.sinceMs > input.beforeReceivedAtMs) invalidQuery();
-		return validateCount(await model.countEvents(input));
+	from_release_id: {
+		type: "string",
+		maxLength: 36,
+		required: false
 	},
-	async countEventSeries(input) {
-		if (!isRecord$2(input) || !hasOnlyKeys(input, [
-			"filter",
-			"timeRange",
-			"intervalMs"
-		]) || !isBundleFilter(input.filter) || !isTimeRange(input.timeRange) || !isTimestamp(input.intervalMs)) invalidQuery();
-		const { start, end } = input.timeRange;
-		const { intervalMs } = input;
-		if (intervalMs === 0 || intervalMs % 36e5 !== 0 || start % 36e5 !== 0 || (end - start) % intervalMs !== 0 || end - start > 7776e6) invalidQuery();
-		const points = await model.countEventSeries(input);
-		if (!Array.isArray(points) || points.length !== (end - start) / intervalMs || points.some((point, index) => !isRecord$2(point) || !hasOnlyKeys(point, ["startMs", "events"]) || point.startMs !== start + index * intervalMs || !isTimestamp(point.events))) invalidResult();
-		return points;
+	from_bundle_id: {
+		type: "string",
+		maxLength: 36,
+		required: false
 	},
-	async getReleaseActivity(input) {
-		if (!isRecord$2(input) || !hasOnlyKeys(input, ["releases"]) || !Array.isArray(input.releases) || input.releases.length < 1 || input.releases.length > 100 || !input.releases.every(isReleaseReference)) invalidQuery();
-		const result = await model.getReleaseActivity(input);
-		if (!isRecord$2(result) || !isTimestamp(result.measuredAtMs) || !Array.isArray(result.data) || result.data.some((item) => !isRecord$2(item) || !isReleaseReference(item.release) || !isRecord$2(item.metrics) || !isTimestamp(item.metrics.downloads) || !isTimestamp(item.metrics.applies) || !isTimestamp(item.metrics.failedLaunches))) invalidResult();
-		return result;
+	to_release_id: {
+		type: "string",
+		maxLength: 36,
+		required: false
 	},
-	async getAppUsage(input) {
-		if (!isRecord$2(input) || !hasOnlyKeys(input, [
-			"channel",
-			"platform",
-			"appVersion",
-			"timeRange",
-			"intervalMs"
-		]) || !isText$1(input.channel) || ![
-			"all",
-			"ios",
-			"android"
-		].includes(input.platform) || input.appVersion !== void 0 && !isText$1(input.appVersion) || !isTimeRange(input.timeRange) || !isTimestamp(input.intervalMs) || input.intervalMs < 36e5) invalidQuery();
-		const result = await model.getAppUsage(input);
-		validateAggregateResult(result);
-		if (!isTimestamp(result.activeInstallations) || !Array.isArray(result.points) || !Array.isArray(result.appVersions) || !Array.isArray(result.versions) || !Array.isArray(result.platforms) || !Array.isArray(result.bundleDistribution)) invalidResult();
-		return result;
+	to_bundle_id: {
+		type: "string",
+		maxLength: 36
+	},
+	platform: {
+		type: "string",
+		maxLength: 16
+	},
+	app_version: { type: "string" },
+	channel: { type: "string" },
+	metadata: { type: "json" },
+	received_at_ms: { type: "integer" }
+}, {
+	key: ["id"],
+	derived: {
+		/** The UTC day the event was received in. */
+		day: {
+			type: "integer",
+			compute: (row) => row.received_at_ms - row.received_at_ms % DAY_MS$1
+		},
+		/** Every stored event belongs in installation history. */
+		movement_install_id: {
+			type: "string",
+			compute: (row) => MOVEMENTS.has(row.type) ? row.install_id : null
+		},
+		/** The bundle a bundle filter matches (`bundleRefsOf`). */
+		bundle_ref: {
+			type: "string",
+			multi: true,
+			compute: (row) => bundleRefsOf(row)
+		}
+	},
+	indexes: {
+		movementsByInstall: {
+			eq: ["movement_install_id"],
+			sort: ["received_at_ms"]
+		},
+		byBundle: {
+			eq: [
+				"platform",
+				"channel",
+				"type",
+				"bundle_ref",
+				"day"
+			],
+			sort: ["received_at_ms"]
+		},
+		/** Events of every scope by day, for the console's unfiltered event list. */
+		byDay: {
+			eq: ["day"],
+			sort: ["received_at_ms"]
+		}
+	},
+	retention: {
+		field: "day",
+		days
 	}
 });
-//#endregion
-//#region ../insights/dist/server/model.mjs
 /**
-* The plugin's API as `InsightsModel`, validated at its boundary: what the
-* Insights routes, the console, and the e2e harness read through.
+* Each installation's latest event, whole, so reading it is one point read.
+* Its gauges count it in the UTC day of that event. An update failure moves
+* nothing, so no head holds one.
 */
-const createInsightsModel = (api) => createValidatedInsightsModel({
-	recordEvent: ({ event }) => api.recordEvent(event),
-	listEvents: api.listEvents,
-	findLatestEvents: api.findLatestEvents,
-	countLatestEvents: api.countLatestEvents,
-	countEvents: api.countEvents,
-	countEventSeries: api.countEventSeries,
-	getReleaseActivity: api.getReleaseActivity,
-	getAppUsage: api.getAppUsage
+const bundleEventHeads = (days) => defineTable({
+	install_id: {
+		type: "string",
+		maxLength: 255
+	},
+	id: {
+		type: "string",
+		maxLength: 36
+	},
+	type: {
+		type: "string",
+		maxLength: 32
+	},
+	user_id: {
+		type: "string",
+		maxLength: 255,
+		required: false
+	},
+	from_release_id: {
+		type: "string",
+		maxLength: 36,
+		required: false
+	},
+	from_bundle_id: {
+		type: "string",
+		maxLength: 36,
+		required: false
+	},
+	to_release_id: {
+		type: "string",
+		maxLength: 36,
+		required: false
+	},
+	to_bundle_id: {
+		type: "string",
+		maxLength: 36
+	},
+	platform: {
+		type: "string",
+		maxLength: 16
+	},
+	app_version: { type: "string" },
+	channel: { type: "string" },
+	metadata: { type: "json" },
+	received_at_ms: { type: "integer" }
+}, {
+	key: ["install_id"],
+	indexes: { byUser: {
+		eq: ["user_id"],
+		sort: ["install_id"]
+	} },
+	retention: {
+		field: "received_at_ms",
+		days
+	}
 });
-//#endregion
-//#region ../insights/dist/server/official.mjs
-/**
-* The brand of Hot Updater's own plugins, a registered symbol that
-* `@hot-updater/server` reads to reserve the id "insights" for this plugin.
-* Each official plugin package keeps this copy, so none imports another's
-* internals for it.
-*/
-const OFFICIAL = Symbol.for("@hot-updater/server/official-plugin");
-/** Marks a plugin one of Hot Updater's own factories made. */
-const markOfficial = (plugin) => Object.defineProperty(plugin, OFFICIAL, { value: true });
-//#endregion
-//#region ../insights/dist/server/errors.mjs
 /**
-* What Insights' API throws for an input it refuses, such as an unknown
-* event field or a malformed cursor; its routes answer 400 for it.
+* Shards are keyed by install id. Counters are blind increments and never
+* conflict, so they keep 8. Gauges and sketches are read, merged, and written
+* back. B3's rollout gate on PostgreSQL retried 2.4% of transactions at 8
+* shards and 1.3% at 16. DynamoDB's transactions take longer, so D8's gate
+* on DynamoDB Local retried 2–24% at 16, almost all on gauge rows, and 1–5%
+* with gauges at 32. Sketches stay at 16: each shard row carries 2 KB of
+* registers that every read merges.
+*
+* Every Insights aggregate is `batched`: on DynamoDB and Firestore, which
+* bill each write, an event's changes apply after it commits, merged with
+* other events' into one write per row, on one shard per writer.
 */
-var InsightsBadRequestError = class extends Error {
-	name = "InsightsBadRequestError";
+const COUNTER_SHARDS = 8;
+const GAUGE_SHARDS = 32;
+const SKETCH_SHARDS = 16;
+/** Rows keyed by a hashed identity (scope and period) and a bucket. */
+const identityFields = {
+	identity: {
+		type: "string",
+		maxLength: 32
+	},
+	bucket_start_ms: { type: "integer" }
 };
-var InsightsPayloadTooLargeError = class extends Error {
-	maximumBytes;
-	name = "InsightsPayloadTooLargeError";
-	constructor(maximumBytes) {
-		super(`Event payload exceeds ${maximumBytes} bytes`);
-		this.maximumBytes = maximumBytes;
-	}
+const window = {
+	eq: ["identity"],
+	sort: ["bucket_start_ms"]
 };
-//#endregion
-//#region ../insights/dist/server/eventInput.mjs
-const MAX_EVENT_STRING_LENGTH = 1024;
-const MAX_IDENTITY_LENGTH$2 = 255;
-const EVENT_BODY_MAX_BYTES = 16384;
-function isRecord$1(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function requireStringField(payload, key) {
-	const value = payload[key];
-	if (typeof value !== "string" || value.length === 0 || value.length > MAX_EVENT_STRING_LENGTH || new TextDecoder("utf-8", { ignoreBOM: true }).decode(new TextEncoder().encode(value)) !== value) throw new InsightsBadRequestError(`Invalid event field: ${key}`);
-	return value;
-}
-function requireNullableStringField(payload, key) {
-	if (payload[key] === null) return null;
-	return requireStringField(payload, key);
-}
-function requireIdentityField(payload, key) {
-	const value = requireStringField(payload, key);
-	if (value.length > MAX_IDENTITY_LENGTH$2) throw new InsightsBadRequestError(`Invalid event field: ${key}`);
-	return value;
-}
+/** What a release or channel row counts in every period kind. */
+const WINDOW_COUNTERS = [
+	"downloads",
+	"failed_launches",
+	"patch_downloads",
+	"patch_fallbacks"
+];
 /**
-* The report's idempotency key, when the client sends one: it creates the
-* UUIDv7 once and repeats it on every retry of that report.
+* Hourly or daily counters: a release or channel row counts downloads,
+* launches that crashed and recovered (`failed_launches`), and downloads a
+* patch delivered and those that fell back from one.
 */
-function readEventId(payload) {
-	const value = payload.eventId;
-	if (value === void 0) return void 0;
-	if (!isUUIDv7(value)) throw new InsightsBadRequestError("Invalid event field: eventId");
-	return value;
-}
+const counters = (retention) => defineAggregate(identityFields, {
+	key: ["identity", "bucket_start_ms"],
+	counters: WINDOW_COUNTERS,
+	shards: COUNTER_SHARDS,
+	batched: true,
+	indexes: { window },
+	retention
+});
 /**
-* The native build's built-in bundle ID: a bundle ID's length at most, and
-* left out when it is missing or malformed, so the report still records.
+* A release's counters since its first report, at bucket 0: the windowed
+* counters, its applies, which the bundle list reads, and its failed updates
+* (`failed_updates`), since no breakdown row outlives the raw period; windowed
+* reads sum `insights_failures` instead.
 */
-const readMinBundleId = (value) => typeof value === "string" && value.length > 0 && value.length <= 36 ? value : null;
-/** One value of an open set: any other value reads as `unknown`. */
-const oneOf = (values, value) => values.includes(value) ? value : "unknown";
-const STAGES = [
-	"check",
-	"download",
-	"install"
-];
-const REASONS = [
-	"network",
-	"http",
-	"invalid_response",
-	"hash_mismatch",
-	"signature",
-	"patch",
-	"extract",
-	"storage"
-];
-const RESOURCES = [
-	"catalog",
-	"artifact",
-	"manifest",
-	"file",
-	"patch",
-	"archive"
-];
-const TRANSPORTS = [
-	"timeout",
-	"dns",
-	"tls",
-	"connection",
-	"offline",
-	"cancelled"
-];
-const DELIVERIES = [
-	"patch",
-	"manifest",
-	"archive"
-];
-/** A storage error code: letters, digits, and `._-`. */
-const CODE = /^[A-Za-z0-9._-]{1,64}$/;
-const readCode = (value) => typeof value === "string" && CODE.test(value) ? value : void 0;
-const readMetadata = (payload) => isRecord$1(payload.metadata) ? payload.metadata : {};
+const lifetimeCounters = () => defineAggregate(identityFields, {
+	key: ["identity", "bucket_start_ms"],
+	counters: [
+		...WINDOW_COUNTERS,
+		"applies",
+		"failed_updates"
+	],
+	shards: COUNTER_SHARDS,
+	batched: true,
+	indexes: { window }
+});
 /**
-* What an UPDATE_FAILED report says failed. It never refuses the report: an
-* unknown value of a set reads as `unknown`, a missing or malformed failure
-* as an unknown stage and reason, and a malformed optional field is left out,
-* as is a null one.
+* Unique-installation sketches of one period kind: a usage row's active
+* installations (`activity_users`), and a `failure` or `check` row's
+* installations whose update or update check failed (`failed_users`).
 */
-function readFailure(value) {
-	const failure = isRecord$1(value) ? value : {};
-	const httpStatus = failure.httpStatus;
-	const originCode = readCode(failure.originCode);
-	const errorMessage = typeof failure.errorMessage === "string" && failure.errorMessage.length <= 2048 ? failure.errorMessage : void 0;
-	const errorStack = typeof failure.errorStack === "string" && failure.errorStack.length <= 4096 ? failure.errorStack : void 0;
-	return {
-		stage: oneOf(STAGES, failure.stage),
-		reason: oneOf(REASONS, failure.reason),
-		...failure.resource == null ? {} : { resource: oneOf(RESOURCES, failure.resource) },
-		...Number.isSafeInteger(httpStatus) && httpStatus >= 100 && httpStatus <= 599 ? { httpStatus } : {},
-		...failure.transport == null ? {} : { transport: oneOf(TRANSPORTS, failure.transport) },
-		...originCode === void 0 ? {} : { originCode },
-		...errorMessage === void 0 ? {} : { errorMessage },
-		...errorStack === void 0 ? {} : { errorStack }
-	};
-}
-function readHttpResponse(value) {
-	if (!isRecord$1(value) || value.resource !== "catalog" && value.resource !== "artifact" || typeof value.path !== "string" || value.path.length > 1024 || !Number.isSafeInteger(value.status) || value.status < 100 || value.status > 599 || value.body !== null && (typeof value.body !== "string" || new TextEncoder().encode(JSON.stringify(value.body)).byteLength > 4096) || typeof value.bodyTruncated !== "boolean" || !Number.isSafeInteger(value.receivedAtMs) || value.receivedAtMs < 0) throw new InsightsBadRequestError("Invalid HTTP response details");
-	return {
-		resource: value.resource,
-		path: value.path,
-		status: value.status,
-		body: value.body,
-		bodyTruncated: value.bodyTruncated,
-		receivedAtMs: value.receivedAtMs
-	};
-}
-async function readBoundedText(request) {
-	const contentLength = request.headers.get("content-length");
-	const declaredByteLength = Number(contentLength);
-	if (contentLength !== null && Number.isSafeInteger(declaredByteLength) && declaredByteLength > 16384) throw new InsightsPayloadTooLargeError(EVENT_BODY_MAX_BYTES);
-	if (request.body === null) return "";
-	const reader = request.body.getReader();
-	const decoder = new TextDecoder();
-	let byteLength = 0;
-	let text = "";
-	while (true) {
-		const result = await reader.read();
-		if (result.done) break;
-		byteLength += result.value.byteLength;
-		if (byteLength > 16384) {
-			await reader.cancel();
-			throw new InsightsPayloadTooLargeError(EVENT_BODY_MAX_BYTES);
-		}
-		text += decoder.decode(result.value, { stream: true });
-	}
-	return text + decoder.decode();
-}
-async function parseJson(request) {
-	const text = await readBoundedText(request);
-	try {
-		return JSON.parse(text);
-	} catch (error) {
-		if (error instanceof SyntaxError) throw new InsightsBadRequestError("Invalid event payload");
-		throw error;
+const sketches = (retention) => defineAggregate(identityFields, {
+	key: ["identity", "bucket_start_ms"],
+	distinct: ["activity_users", "failed_users"],
+	shards: SKETCH_SHARDS,
+	batched: true,
+	indexes: { window },
+	retention
+});
+/** Installations whose update to a release failed, since its first failure: kept, at bucket 0. */
+const lifetimeSketches = () => defineAggregate(identityFields, {
+	key: ["identity", "bucket_start_ms"],
+	distinct: ["failed_users"],
+	shards: SKETCH_SHARDS,
+	batched: true,
+	indexes: { window }
+});
+/**
+* Update failures by what failed, a row an hour. `release_id` is the failed
+* update's target release, or empty for a failed check or an unknown target.
+* `stage` and `reason` say where and why it failed, and `detail` what else
+* the client knew, as the JSON array `[resource, httpStatus, originCode,
+* transport]`. Every index is in key order, so its counters stay blind
+* increments.
+*/
+const insightsFailures = (retention) => defineAggregate({
+	platform: {
+		type: "string",
+		maxLength: 16
+	},
+	channel: { type: "string" },
+	bucket_start_ms: { type: "integer" },
+	release_id: {
+		type: "string",
+		maxLength: 36
+	},
+	stage: {
+		type: "string",
+		maxLength: 16
+	},
+	reason: {
+		type: "string",
+		maxLength: 64
+	},
+	detail: {
+		type: "string",
+		maxLength: 160
 	}
-}
-function requireEvent(payload) {
-	if (!isRecord$1(payload)) throw new InsightsBadRequestError("Invalid event payload");
-	const platform = requireStringField(payload, "platform");
-	if (platform !== "ios" && platform !== "android") throw new InsightsBadRequestError("Invalid event field: platform");
-	const eventId = readEventId(payload);
-	const metadata = readMetadata(payload);
-	const httpMetadata = metadata.httpResponse === void 0 ? {} : { httpResponse: readHttpResponse(metadata.httpResponse) };
-	const base = {
-		...metadata.httpResponse === void 0 ? {} : { metadata: httpMetadata },
-		...eventId === void 0 ? {} : { eventId },
-		installId: requireIdentityField(payload, "installId"),
-		toBundleId: requireStringField(payload, "toBundleId"),
-		...payload.userId === void 0 ? {} : { userId: requireIdentityField(payload, "userId") },
-		platform,
-		appVersion: requireStringField(payload, "appVersion"),
-		channel: requireStringField(payload, "channel"),
-		cohort: requireStringField(payload, "cohort"),
-		fingerprintHash: requireNullableStringField(payload, "fingerprintHash"),
-		sdkVersion: payload.sdkVersion === void 0 ? null : requireNullableStringField(payload, "sdkVersion"),
-		minBundleId: readMinBundleId(payload.minBundleId),
-		fromReleaseId: requireNullableStringField(payload, "fromReleaseId"),
-		toReleaseId: requireNullableStringField(payload, "toReleaseId")
-	};
-	const type = requireStringField(payload, "type");
-	const movement = () => {
-		const updateStrategy = requireStringField(payload, "updateStrategy");
-		if (updateStrategy !== "fingerprint" && updateStrategy !== "appVersion") throw new InsightsBadRequestError("Invalid event field: updateStrategy");
-		return {
-			...base,
-			fromBundleId: requireStringField(payload, "fromBundleId"),
-			updateStrategy
-		};
-	};
-	switch (type) {
-		case "UPDATE_DOWNLOADED": {
-			const delivery = metadata.delivery;
-			const read = {
-				...httpMetadata,
-				...delivery == null ? {} : { delivery: oneOf(DELIVERIES, delivery) },
-				...metadata.patchFallback === true ? { patchFallback: true } : {}
-			};
-			return {
-				...movement(),
-				type,
-				...Object.keys(read).length === 0 ? {} : { metadata: read }
-			};
+}, {
+	key: [
+		"platform",
+		"channel",
+		"bucket_start_ms",
+		"release_id",
+		"stage",
+		"reason",
+		"detail"
+	],
+	counters: ["events"],
+	shards: COUNTER_SHARDS,
+	batched: true,
+	indexes: { byScope: {
+		eq: ["platform", "channel"],
+		sort: ["bucket_start_ms"]
+	} },
+	retention
+});
+/** Installations counted in the UTC day of their latest event, so reads sum whole UTC days. */
+const insightsDistribution = (retention) => defineAggregate({
+	channel: { type: "string" },
+	platform: {
+		type: "string",
+		maxLength: 16
+	},
+	app_version: { type: "string" },
+	release_id: {
+		type: "string",
+		maxLength: 36
+	},
+	bucket_start_ms: { type: "integer" }
+}, {
+	key: [
+		"channel",
+		"platform",
+		"app_version",
+		"release_id",
+		"bucket_start_ms"
+	],
+	gauges: ["latest_installations"],
+	shards: GAUGE_SHARDS,
+	batched: true,
+	indexes: {
+		byScope: {
+			eq: ["channel", "platform"],
+			sort: ["bucket_start_ms"]
+		},
+		byVersion: {
+			eq: [
+				"channel",
+				"platform",
+				"app_version"
+			],
+			sort: ["bucket_start_ms"]
 		}
-		case "UPDATE_APPLIED":
-		case "RECOVERED": return {
-			...movement(),
-			type
-		};
-		case "UPDATE_FAILED": return {
-			...movement(),
-			type,
-			metadata: {
-				...httpMetadata,
-				failure: readFailure(metadata.failure)
-			}
-		};
-		case "UNCHANGED":
-			if (payload.fromBundleId !== null || payload.updateStrategy !== null) throw new InsightsBadRequestError("Invalid unchanged event shape");
-			return {
-				...base,
-				type,
-				fromBundleId: null,
-				updateStrategy: null
-			};
-		default: throw new InsightsBadRequestError("Invalid event field: type");
-	}
-}
-async function parseBundleEventRequest(request) {
-	return requireEvent(await parseJson(request));
-}
-function createBundleEventRow(input) {
-	input = requireEvent(input);
-	const base = {
-		app_version: input.appVersion,
-		channel: input.channel,
-		from_release_id: input.fromReleaseId,
-		id: input.eventId ?? createUUIDv7(),
-		install_id: input.installId,
-		platform: input.platform,
-		received_at_ms: Date.now(),
-		to_bundle_id: input.toBundleId,
-		to_release_id: input.toReleaseId,
-		user_id: input.userId ?? null
-	};
-	const response = input.metadata?.httpResponse;
-	const metadata = {
-		...response ? { http_response: {
-			resource: response.resource,
-			path: response.path,
-			status: response.status,
-			body: response.body,
-			body_truncated: response.bodyTruncated,
-			received_at_ms: response.receivedAtMs
-		} } : {},
-		cohort: input.cohort,
-		fingerprint_hash: input.fingerprintHash,
-		sdk_version: input.sdkVersion ?? null,
-		...input.minBundleId ? { min_bundle_id: input.minBundleId } : {},
-		update_strategy: input.updateStrategy
-	};
-	switch (input.type) {
-		case "UPDATE_DOWNLOADED": {
-			const { delivery, patchFallback } = input.metadata ?? {};
-			return {
-				...base,
-				from_bundle_id: input.fromBundleId,
-				type: input.type,
-				metadata: {
-					...metadata,
-					...delivery === void 0 ? {} : { delivery },
-					...patchFallback ? { patch_fallback: true } : {}
-				}
-			};
-		}
-		case "UPDATE_APPLIED":
-		case "RECOVERED": return {
-			...base,
-			from_bundle_id: input.fromBundleId,
-			type: input.type,
-			metadata
-		};
-		case "UPDATE_FAILED": {
-			const { failure } = input.metadata;
-			return {
-				...base,
-				from_bundle_id: input.fromBundleId,
-				type: input.type,
-				metadata: {
-					...metadata,
-					failure: {
-						stage: failure.stage,
-						reason: failure.reason,
-						...failure.errorMessage === void 0 ? {} : { error_message: failure.errorMessage },
-						...failure.errorStack === void 0 ? {} : { error_stack: failure.errorStack },
-						...failure.resource === void 0 ? {} : { resource: failure.resource },
-						...failure.httpStatus === void 0 ? {} : { http_status: failure.httpStatus },
-						...failure.transport === void 0 ? {} : { transport: failure.transport },
-						...failure.originCode === void 0 ? {} : { origin_code: failure.originCode }
-					}
-				}
-			};
-		}
-		case "UNCHANGED": return {
-			...base,
-			from_bundle_id: null,
-			type: input.type,
-			metadata
-		};
-	}
-}
-//#endregion
-//#region ../insights/dist/server/provider.mjs
-const DEFAULT_PAGE_LIMIT = 50;
-const MAX_PAGE_LIMIT$1 = 100;
-const MAX_EVENT_ID_LENGTH = 1024;
-const MAX_IDENTITY_LENGTH$1 = 255;
-const MAX_CURSOR_LENGTH$1 = 8192;
-const HOUR_MS$1 = 36e5;
-const DAY_MS$1 = 24 * HOUR_MS$1;
-const WINDOW_MS = {
-	"24h": 864e5,
-	"7d": 6048e5,
-	"30d": 2592e6
-};
-/**
-* The longest receipt range, `[sinceMs, beforeReceivedAtMs)`, of a global or
-* bundle event list, and the range one covers without `sinceMs`: raw events
-* are listed inside a time range, as analytics products list them. It is a
-* duration, so a range that ends mid-day touches 91 UTC days. Installation
-* history is one index range and reads back to `sinceMs`.
-*/
-const EVENT_LIST_RANGE_MS = 2160 * HOUR_MS$1;
-const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-const requireString = (value, label, maximumLength) => {
-	if (typeof value !== "string" || value.length === 0 || value.length > maximumLength || new TextDecoder("utf-8", { ignoreBOM: true }).decode(new TextEncoder().encode(value)) !== value) throw new InsightsBadRequestError(`Invalid ${label}.`);
-	return value;
-};
-const requireTimestamp = (value, label) => {
-	if (!Number.isSafeInteger(value) || Number(value) < 0) throw new InsightsBadRequestError(`Invalid ${label}.`);
-	return Number(value);
-};
-const readLimit = (value) => {
-	const limit = value ?? DEFAULT_PAGE_LIMIT;
-	if (!Number.isSafeInteger(limit) || limit < 1 || limit > MAX_PAGE_LIMIT$1) throw new InsightsBadRequestError("Invalid page limit.");
-	return limit;
-};
-const encodeBase64Url = (value) => {
-	const bytes = new TextEncoder().encode(value);
-	let binary = "";
-	for (const byte of bytes) binary += String.fromCharCode(byte);
-	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
-};
-const decodeBase64Url = (value) => {
-	if (value.length === 0 || value.length > MAX_CURSOR_LENGTH$1) throw new InsightsBadRequestError("Invalid Insights cursor.");
-	try {
-		const base64 = value.replaceAll("-", "+").replaceAll("_", "/");
-		const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, "=");
-		const binary = atob(padded);
-		const bytes = Uint8Array.from(binary, (character) => character.charCodeAt(0));
-		return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
-	} catch {
-		throw new InsightsBadRequestError("Invalid Insights cursor.");
-	}
-};
-const encodeCursor = (value) => encodeBase64Url(JSON.stringify(value));
-const decodeCursor = (value) => {
-	try {
-		return JSON.parse(decodeBase64Url(value));
-	} catch (error) {
-		if (error instanceof InsightsBadRequestError) throw error;
-		throw new InsightsBadRequestError("Invalid Insights cursor.");
-	}
-};
-const readScope$1 = (input) => {
-	if (input.platform !== "ios" && input.platform !== "android") throw new InsightsBadRequestError("Invalid Insights platform.");
-	return {
-		platform: input.platform,
-		channel: requireString(input.channel, "channel", MAX_EVENT_ID_LENGTH)
-	};
-};
-const bundleFilter = (input) => {
-	const scope = readScope$1(input);
-	const bundleId = requireString(input.bundleId, "bundle ID", MAX_EVENT_ID_LENGTH);
-	switch (input.outcome) {
-		case "downloaded": return {
-			...scope,
-			type: "UPDATE_DOWNLOADED",
-			toBundleId: bundleId
-		};
-		case "applied": return {
-			...scope,
-			type: "UPDATE_APPLIED",
-			toBundleId: bundleId
-		};
-		case "recovered": return {
-			...scope,
-			type: "RECOVERED",
-			fromBundleId: bundleId
-		};
-		case "failed": return {
-			...scope,
-			type: "UPDATE_FAILED",
-			toBundleId: bundleId
-		};
-		default: throw new InsightsBadRequestError("Invalid Insights outcome.");
-	}
-};
-const sameFilter = (left, right) => {
-	if (!isRecord(left) || left.kind !== right.kind) return false;
-	switch (right.kind) {
-		case "all": return true;
-		case "installationMovement": return left.installId === right.installId;
-		case "bundle": return left.platform === right.platform && left.channel === right.channel && left.type === right.type && (right.type === "RECOVERED" ? left.fromBundleId === right.fromBundleId : left.toBundleId === right.toBundleId);
-	}
-};
-const readEventCursor = (value, filter) => {
-	const cursor = decodeCursor(value);
-	if (!isRecord(cursor) || cursor.version !== 2 || cursor.kind !== "events" || !isRecord(cursor.filter) || !isRecord(cursor.after)) throw new InsightsBadRequestError("Invalid Insights cursor.");
-	if (!sameFilter(cursor.filter, filter)) throw new InsightsBadRequestError("Insights cursor does not match the requested events.");
-	if (typeof cursor.after.id !== "string" || !isUUIDv7(cursor.after.id)) throw new InsightsBadRequestError("Invalid Insights event cursor ID.");
-	return {
-		after: {
-			id: cursor.after.id,
-			receivedAtMs: requireTimestamp(cursor.after.receivedAtMs, "event cursor")
-		},
-		beforeReceivedAtMs: requireTimestamp(cursor.beforeReceivedAtMs, "event cutoff"),
-		kind: "events",
-		sinceMs: requireTimestamp(cursor.sinceMs, "event start"),
-		filter,
-		version: 2
-	};
-};
-const readUserInstallationCursor = (value, userId) => {
-	const cursor = decodeCursor(value);
-	if (!isRecord(cursor) || cursor.version !== 1 || cursor.kind !== "user-installations" || cursor.userId !== userId) throw new InsightsBadRequestError("Insights cursor does not match the requested user ID.");
-	return {
-		afterInstallId: requireString(cursor.afterInstallId, "installation cursor", MAX_IDENTITY_LENGTH$1),
-		kind: "user-installations",
-		userId,
-		version: 1
-	};
-};
-const compareEventNewest = (left, right) => right.received_at_ms - left.received_at_ms || compareInsightsText(right.id, left.id);
-const isAfterEventCursor = (row, after) => row.received_at_ms < after.receivedAtMs || row.received_at_ms === after.receivedAtMs && compareInsightsText(row.id, after.id) < 0;
-const assertEventRows = (rows, input) => {
-	if (rows.length > input.limit) throw new Error("Insights database returned too many event rows.");
-	for (let index = 0; index < rows.length; index += 1) {
-		const row = rows[index];
-		const previous = rows[index - 1];
-		if (!row || typeof row.id !== "string" || !isUUIDv7(row.id) || !Number.isSafeInteger(row.received_at_ms) || row.received_at_ms >= input.beforeReceivedAtMs || row.received_at_ms < input.sinceMs || previous !== void 0 && compareEventNewest(previous, row) >= 0 || input.after !== void 0 && !isAfterEventCursor(row, input.after) || input.filter.kind === "installationMovement" && (row.install_id !== input.filter.installId || !isInsightsMovementEvent(row)) || input.filter.kind === "bundle" && (row.platform !== input.filter.platform || row.channel !== input.filter.channel || row.type !== input.filter.type || (input.filter.type === "RECOVERED" ? row.from_bundle_id !== input.filter.fromBundleId : row.to_bundle_id !== input.filter.toBundleId))) throw new Error("Insights database returned invalid event rows.");
-	}
-};
-/** An `UPDATE_FAILED` row's failure, as the event lists show it. */
-const toFailure = (failure) => ({
-	stage: failure.stage,
-	reason: failure.reason,
-	...failure.error_message === void 0 ? {} : { errorMessage: failure.error_message },
-	...failure.error_stack === void 0 ? {} : { errorStack: failure.error_stack },
-	...failure.resource === void 0 ? {} : { resource: failure.resource },
-	...failure.http_status === void 0 ? {} : { httpStatus: failure.http_status },
-	...failure.transport === void 0 ? {} : { transport: failure.transport },
-	...failure.origin_code === void 0 ? {} : { originCode: failure.origin_code }
-});
-/** What a row's metadata adds for its type: a failure or a delivery. */
-const eventDetails = ({ type, metadata }) => ({
-	...metadata.http_response !== void 0 ? { httpResponse: {
-		resource: metadata.http_response.resource,
-		path: metadata.http_response.path,
-		status: metadata.http_response.status,
-		body: metadata.http_response.body,
-		bodyTruncated: metadata.http_response.body_truncated,
-		receivedAtMs: metadata.http_response.received_at_ms
-	} } : {},
-	...type === "UPDATE_FAILED" && metadata.failure !== void 0 ? { failure: toFailure(metadata.failure) } : {},
-	...type === "UPDATE_DOWNLOADED" && metadata.delivery !== void 0 ? { delivery: metadata.delivery } : {},
-	...type === "UPDATE_DOWNLOADED" && metadata.patch_fallback === true ? { patchFallback: true } : {}
-});
-const toEventHistoryRow = (row) => ({
-	...row.to_release_id == null ? {} : { toReleaseId: row.to_release_id },
-	...row.metadata.sdk_version == null ? {} : { sdkVersion: row.metadata.sdk_version },
-	...row.metadata.min_bundle_id === void 0 ? {} : { minBundleId: row.metadata.min_bundle_id },
-	appVersion: row.app_version,
-	channel: row.channel,
-	cohort: row.metadata.cohort,
-	fromBundleId: row.from_bundle_id,
-	id: row.id,
-	installId: row.install_id,
-	platform: row.platform,
-	receivedAtMs: row.received_at_ms,
-	toBundleId: row.to_bundle_id,
-	type: row.type,
-	userId: row.user_id,
-	...eventDetails(row)
-});
-const toInstallationRow = (row) => ({
-	...eventDetails(row).httpResponse ? { httpResponse: eventDetails(row).httpResponse } : {},
-	...row.metadata.min_bundle_id === void 0 ? {} : { minBundleId: row.metadata.min_bundle_id },
-	appVersion: row.app_version,
-	channel: row.channel,
-	cohort: row.metadata.cohort,
-	installId: row.install_id,
-	lastKnownBundleId: row.type === "UPDATE_DOWNLOADED" ? row.from_bundle_id : row.to_bundle_id,
-	pendingBundleId: row.type === "UPDATE_DOWNLOADED" ? row.to_bundle_id : null,
-	pendingReleaseId: row.type === "UPDATE_DOWNLOADED" ? row.to_release_id : null,
-	latestStatus: row.type,
-	platform: row.platform,
-	receivedAtMs: row.received_at_ms,
-	userId: row.user_id
-});
-/**
-* Where a list without `sinceMs` starts: 90 days before its cutoff for the
-* global and bundle lists, at the first event for installation history.
-*/
-const defaultEventStart = (filter, beforeReceivedAtMs) => filter.kind === "installationMovement" ? 0 : Math.max(0, beforeReceivedAtMs - EVENT_LIST_RANGE_MS);
-/** Whether a cursor's row lies inside the list's range. */
-const isInsideBounds = ({ after }, bounds) => after.receivedAtMs >= bounds.sinceMs && after.receivedAtMs < bounds.beforeReceivedAtMs;
-/** A page's range: its cursor's, which the request may repeat but not change. */
-const readEventBounds = (input, cursor, filter) => {
-	const beforeReceivedAtMs = cursor?.beforeReceivedAtMs ?? (input.beforeReceivedAtMs === void 0 ? Date.now() : requireTimestamp(input.beforeReceivedAtMs, "event cutoff"));
-	if (cursor !== void 0 && input.beforeReceivedAtMs !== void 0 && input.beforeReceivedAtMs !== beforeReceivedAtMs) throw new InsightsBadRequestError("Insights cursor does not match the requested event cutoff.");
-	const sinceMs = cursor?.sinceMs ?? (input.sinceMs === void 0 ? defaultEventStart(filter, beforeReceivedAtMs) : requireTimestamp(input.sinceMs, "event start"));
-	const bounds = {
-		beforeReceivedAtMs,
-		sinceMs
-	};
-	if (sinceMs > beforeReceivedAtMs || input.sinceMs !== void 0 && input.sinceMs !== sinceMs || cursor !== void 0 && !isInsideBounds(cursor, bounds)) throw new InsightsBadRequestError("Insights cursor or range does not match the requested event start.");
-	if (filter.kind !== "installationMovement" && beforeReceivedAtMs - sinceMs > 7776e6) throw new InsightsBadRequestError("Insights event lists cover at most 90 days: send a sinceMs no more than 90 days before beforeReceivedAtMs.");
-	return bounds;
-};
-const pageEventRows = async (model, input, filter, map) => {
-	const limit = readLimit(input.limit);
-	const cursor = input.cursor === void 0 ? void 0 : readEventCursor(input.cursor, filter);
-	const bounds = readEventBounds(input, cursor, filter);
-	const query = {
-		filter,
-		...bounds,
-		...cursor === void 0 ? {} : { after: cursor.after },
-		limit
-	};
-	const rows = await model.listEvents(query);
-	assertEventRows(rows, query);
-	const last = rows.at(-1);
-	return {
-		beforeReceivedAtMs: bounds.beforeReceivedAtMs,
-		data: rows.map(map),
-		nextCursor: rows.length === limit && last ? encodeCursor({
-			after: {
-				id: last.id,
-				receivedAtMs: last.received_at_ms
-			},
-			...bounds,
-			kind: "events",
-			filter,
-			version: 2
-		}) : null
-	};
-};
-const assertInstallationRows = (rows, input) => {
-	if (rows.length > input.limit) throw new Error("Insights database returned too many installation rows.");
-	for (let index = 0; index < rows.length; index += 1) {
-		const row = rows[index];
-		const previous = rows[index - 1];
-		if (!row || row.user_id !== input.userId || input.afterInstallId !== void 0 && compareInsightsText(row.install_id, input.afterInstallId) <= 0 || previous !== void 0 && compareInsightsText(previous.install_id, row.install_id) >= 0) throw new Error("Insights database returned invalid installation rows.");
-	}
-};
-const createInsightsProvider = (model) => Object.freeze({
-	async appendBundleEvent(input) {
-		const event = createBundleEventRow(input);
-		await model.recordEvent({ event });
-	},
-	listEvents(input) {
-		const filter = input.bundle === void 0 ? { kind: "all" } : {
-			kind: "bundle",
-			...bundleFilter(input.bundle)
-		};
-		return pageEventRows(model, input, filter, toEventHistoryRow);
-	},
-	async listInstallationEvents(input) {
-		if ("bundle" in input && input.bundle !== void 0) throw new InsightsBadRequestError("Installation movement queries cannot include a bundle filter.");
-		const installId = requireString(input.installId, "install ID", MAX_IDENTITY_LENGTH$1);
-		return pageEventRows(model, input, {
-			kind: "installationMovement",
-			installId
-		}, (row) => toEventHistoryRow(row));
-	},
-	async getInstallation({ installId }) {
-		const normalizedInstallId = requireString(installId, "install ID", MAX_IDENTITY_LENGTH$1);
-		const rows = await model.findLatestEvents({ installId: normalizedInstallId });
-		const row = rows[0] ?? null;
-		if (rows.length > 1 || row !== null && row.install_id !== normalizedInstallId) throw new Error("Insights database returned an invalid installation.");
-		return row === null ? null : toInstallationRow(row);
-	},
-	async pageInstallationsByCurrentUserId(input) {
-		const userId = requireString(input.userId, "user ID", MAX_IDENTITY_LENGTH$1);
-		const limit = readLimit(input.limit);
-		const cursor = input.cursor === void 0 ? void 0 : readUserInstallationCursor(input.cursor, userId);
-		const databaseInput = {
-			userId,
-			...cursor === void 0 ? {} : { afterInstallId: cursor.afterInstallId },
-			limit
-		};
-		const rows = await model.findLatestEvents(databaseInput);
-		assertInstallationRows(rows, databaseInput);
-		const last = rows.at(-1);
-		return {
-			data: rows.map(toInstallationRow),
-			nextCursor: rows.length === limit && last ? encodeCursor({
-				afterInstallId: last.install_id,
-				kind: "user-installations",
-				userId,
-				version: 1
-			}) : null
-		};
 	},
-	async getReportingOverview(input) {
-		const scope = readScope$1(input);
-		const { window } = input;
-		if (!Object.hasOwn(WINDOW_MS, window)) throw new InsightsBadRequestError("Invalid reporting installation window.");
-		const now = Date.now();
-		const beforeReceivedAtMs = now - now % HOUR_MS$1 + (now % HOUR_MS$1 === 0 ? 0 : HOUR_MS$1);
-		const reach = Math.max(0, beforeReceivedAtMs - WINDOW_MS[window]);
-		const sinceMs = reach - reach % DAY_MS$1;
-		const measure = async (count) => {
-			const value = await count;
-			if (!Number.isSafeInteger(value) || value < 0) throw new Error("Insights database returned an invalid count.");
-			return {
-				count: value,
-				measuredAtMs: Date.now()
-			};
-		};
-		const bundleId = input.bundleId === void 0 ? void 0 : requireString(input.bundleId, "bundle ID", MAX_EVENT_ID_LENGTH);
-		const reporting = measure(model.countLatestEvents({
-			...scope,
-			sinceMs
-		}));
-		if (bundleId === void 0) return {
-			...scope,
-			window,
-			sinceMs,
-			beforeReceivedAtMs,
-			reportingInstallations: await reporting
-		};
-		const countOutcome = (outcome) => measure(model.countEvents({
-			filter: bundleFilter({
-				...scope,
-				bundleId,
-				outcome
-			}),
-			sinceMs,
-			beforeReceivedAtMs
-		}));
-		const [reportingInstallations, bundleInstallations, downloadedReports, appliedReports, recoveredReports, failedReports] = await Promise.all([
-			reporting,
-			measure(model.countLatestEvents({
-				...scope,
-				sinceMs,
-				bundle: [{
-					field: "from_bundle_id",
-					value: bundleId,
-					types: ["UPDATE_DOWNLOADED"]
-				}, {
-					field: "to_bundle_id",
-					value: bundleId,
-					types: [
-						"UNCHANGED",
-						"UPDATE_APPLIED",
-						"RECOVERED"
-					]
-				}]
-			})),
-			countOutcome("downloaded"),
-			countOutcome("applied"),
-			countOutcome("recovered"),
-			countOutcome("failed")
-		]);
-		return {
-			...scope,
-			window,
-			sinceMs,
-			beforeReceivedAtMs,
-			reportingInstallations,
-			bundle: {
-				bundleId,
-				reportingInstallations: bundleInstallations,
-				downloadedReports,
-				appliedReports,
-				recoveredReports,
-				failedReports
-			}
-		};
-	}
-});
-//#endregion
-//#region ../insights/dist/server/schema.mjs
-const HOUR_MS = 36e5;
-const DAY_MS = 864e5;
-const DEFAULT_INSIGHTS_RETENTION = {
-	rawDays: 90,
-	dailyDays: 400
-};
-const bucketRetention = (days) => ({
-	field: "bucket_start_ms",
-	days
+	retention
 });
-const MOVEMENTS = /* @__PURE__ */ new Set([
-	"UPDATE_DOWNLOADED",
-	"UPDATE_APPLIED",
-	"RECOVERED",
-	"UPDATE_FAILED"
-]);
-/** A failed update check: it names no target bundle, so no bundle list shows it. */
-const isFailedCheck = (row) => row.type === "UPDATE_FAILED" && row.metadata?.failure?.stage === "check";
 /**
-* Downloads, applies, recoveries, and update failures, whole. An UNCHANGED
-* report counts as a launch and moves its installation's head, but no list
-* shows it, so no row keeps it.
+* The installations of `insights_distribution` that run their native build's
+* built-in bundle, by its ID (`builtin_bundle_id`), within the same rows:
+* reads move them out of the row of their release, or of no release.
 */
-const bundleEvents = (days) => defineTable({
-	id: {
-		type: "string",
-		maxLength: 36
-	},
-	type: {
-		type: "string",
-		maxLength: 32
-	},
-	install_id: {
+const insightsBuiltinDistribution = (retention) => defineAggregate({
+	channel: { type: "string" },
+	platform: {
 		type: "string",
-		maxLength: 255
+		maxLength: 16
 	},
-	user_id: {
+	app_version: { type: "string" },
+	release_id: {
 		type: "string",
-		maxLength: 255,
-		required: false
+		maxLength: 36
 	},
-	from_release_id: {
+	builtin_bundle_id: {
 		type: "string",
-		maxLength: 36,
-		required: false
+		maxLength: 36
 	},
-	from_bundle_id: {
+	bucket_start_ms: { type: "integer" }
+}, {
+	key: [
+		"channel",
+		"platform",
+		"app_version",
+		"release_id",
+		"builtin_bundle_id",
+		"bucket_start_ms"
+	],
+	gauges: ["latest_installations"],
+	shards: GAUGE_SHARDS,
+	batched: true,
+	indexes: {
+		byScope: {
+			eq: ["channel", "platform"],
+			sort: ["bucket_start_ms"]
+		},
+		byVersion: {
+			eq: [
+				"channel",
+				"platform",
+				"app_version"
+			],
+			sort: ["bucket_start_ms"]
+		}
+	},
+	retention
+});
+/** Latest events by the bundle they came from or went to, bucketed like the distribution. */
+const insightsLatestByBundle = (retention) => defineAggregate({
+	platform: {
 		type: "string",
-		maxLength: 36,
-		required: false
+		maxLength: 16
 	},
-	to_release_id: {
+	channel: { type: "string" },
+	bundle_field: {
 		type: "string",
-		maxLength: 36,
-		required: false
+		maxLength: 16
 	},
-	to_bundle_id: {
+	bundle_id: {
 		type: "string",
 		maxLength: 36
 	},
+	type: {
+		type: "string",
+		maxLength: 32
+	},
+	bucket_start_ms: { type: "integer" }
+}, {
+	key: [
+		"platform",
+		"channel",
+		"bundle_field",
+		"bundle_id",
+		"type",
+		"bucket_start_ms"
+	],
+	gauges: ["installations"],
+	shards: GAUGE_SHARDS,
+	batched: true,
+	indexes: { byBundle: {
+		eq: [
+			"platform",
+			"channel",
+			"bundle_field",
+			"bundle_id",
+			"type"
+		],
+		sort: ["bucket_start_ms"]
+	} },
+	retention
+});
+/**
+* Stored events by outcome and the bundle a bundle filter matches, a row an
+* hour, which a failed check has none of; and every stored event, a row a UTC
+* day (`DAILY_EVENTS`). Bundle counts sum the hourly rows, and event lists
+* read either to skip days without events.
+*/
+const insightsOutcomes = (retention) => defineAggregate({
 	platform: {
 		type: "string",
 		maxLength: 16
 	},
-	app_version: { type: "string" },
 	channel: { type: "string" },
-	metadata: { type: "json" },
-	received_at_ms: { type: "integer" }
-}, {
-	key: ["id"],
-	derived: {
-		/** The UTC day the event was received in. */
-		day: {
-			type: "integer",
-			compute: (row) => row.received_at_ms - row.received_at_ms % DAY_MS
-		},
-		/** Set only for events that belong in installation history. */
-		movement_install_id: {
-			type: "string",
-			compute: (row) => MOVEMENTS.has(row.type) ? row.install_id : null
-		},
-		/**
-		* The bundle a bundle filter matches: `from:<bundle>` for RECOVERED,
-		* none for a failed check, else `to:<bundle>`.
-		*/
-		bundle_ref: {
-			type: "string",
-			multi: true,
-			compute: (row) => isFailedCheck(row) ? [] : [row.type === "RECOVERED" && row.from_bundle_id !== null ? `from:${row.from_bundle_id}` : `to:${row.to_bundle_id}`]
-		}
+	type: {
+		type: "string",
+		maxLength: 32
 	},
-	indexes: {
-		movementsByInstall: {
-			eq: ["movement_install_id"],
-			sort: ["received_at_ms"]
-		},
-		byBundle: {
-			eq: [
-				"platform",
-				"channel",
-				"type",
-				"bundle_ref",
-				"day"
-			],
-			sort: ["received_at_ms"]
-		},
-		/** Events of every scope by day, for the console's unfiltered event list. */
-		byDay: {
-			eq: ["day"],
-			sort: ["received_at_ms"]
-		}
+	bundle_ref: {
+		type: "string",
+		maxLength: 41
 	},
-	retention: {
-		field: "day",
-		days
+	bucket_start_ms: { type: "integer" }
+}, {
+	key: [
+		"platform",
+		"channel",
+		"type",
+		"bundle_ref",
+		"bucket_start_ms"
+	],
+	counters: ["events"],
+	shards: COUNTER_SHARDS,
+	batched: true,
+	indexes: { byRef: {
+		eq: [
+			"platform",
+			"channel",
+			"type",
+			"bundle_ref"
+		],
+		sort: ["bucket_start_ms"]
+	} },
+	retention
+});
+/**
+* The `insights_outcomes` identity that counts every stored event, for the
+* global event list. Its bucket is a UTC day, not an hour. Every event's
+* platform is ios or android, so no outcome row of a bundle filter shares it.
+*/
+const DAILY_EVENTS = {
+	platform: "*",
+	channel: "",
+	type: "",
+	bundle_ref: ""
+};
+/**
+* Insights' tables, each expiring after its period. The periods are values
+* the engine applies at runtime; the tables and indexes are the same for
+* any periods.
+*/
+const createInsightsSchema = ({ rawDays, dailyDays } = DEFAULT_INSIGHTS_RETENTION) => {
+	const hourly = bucketRetention(rawDays);
+	const daily = bucketRetention(dailyDays);
+	return {
+		bundle_events: bundleEvents(rawDays),
+		bundle_event_heads: bundleEventHeads(dailyDays),
+		/** Hourly counters and sketches: the raw period. */
+		insights_overview: counters(hourly),
+		insights_sketches: sketches(hourly),
+		/** Daily counters and sketches: the daily period. */
+		insights_overview_daily: counters(daily),
+		insights_sketches_daily: sketches(daily),
+		/** A release's counters since its first event, and its failed installations: kept. */
+		insights_overview_lifetime: lifetimeCounters(),
+		insights_sketches_lifetime: lifetimeSketches(),
+		insights_distribution: insightsDistribution(daily),
+		insights_builtin_distribution: insightsBuiltinDistribution(daily),
+		insights_latest_by_bundle: insightsLatestByBundle(daily),
+		insights_outcomes: insightsOutcomes(hourly),
+		insights_failures: insightsFailures(hourly)
+	};
+};
+createInsightsSchema();
+//#endregion
+//#region ../insights/dist/server/eventRow.mjs
+const CHANGE_KINDS = /* @__PURE__ */ new Set([
+	"first_seen",
+	"bundle",
+	"release",
+	"app_version",
+	"channel",
+	"native_build"
+]);
+const isBundleEventChange = (value) => isDatabaseJsonObject(value) && Array.isArray(value.kinds) && value.kinds.length > 0 && value.kinds.every((kind) => CHANGE_KINDS.has(kind)) && (value.previous === null || isDatabaseJsonObject(value.previous) && typeof value.previous.bundle_id === "string" && (value.previous.release_id === null || typeof value.previous.release_id === "string") && typeof value.previous.app_version === "string" && typeof value.previous.channel === "string" && isOptional(value.previous, "min_bundle_id", isString));
+const isOptional = (value, key, valid) => !Object.hasOwn(value, key) || valid(value[key]);
+const isString = (value) => typeof value === "string";
+const isDatabaseHttpResponse = (value) => isDatabaseJsonObject(value) && (value.resource === "catalog" || value.resource === "artifact") && isString(value.path) && Number.isSafeInteger(value.status) && (value.body === null || isString(value.body)) && typeof value.body_truncated === "boolean" && Number.isSafeInteger(value.received_at_ms);
+/** An `UPDATE_FAILED` report's stored failure: a stage and a reason, and what else the client knew. */
+const isDatabaseBundleEventFailure = (value) => isDatabaseJsonObject(value) && isString(value.stage) && isString(value.reason) && isOptional(value, "resource", isString) && isOptional(value, "http_status", (status) => Number.isSafeInteger(status)) && isOptional(value, "transport", isString) && isOptional(value, "origin_code", isString) && isOptional(value, "error_message", isString) && isOptional(value, "error_stack", isString);
+const isDatabaseBundleEventMetadata = (value) => isDatabaseJsonObject(value) && typeof value.cohort === "string" && (value.update_strategy === null || value.update_strategy === "fingerprint" || value.update_strategy === "appVersion") && (value.fingerprint_hash === null || typeof value.fingerprint_hash === "string") && (value.sdk_version === null || typeof value.sdk_version === "string") && isOptional(value, "min_bundle_id", isString) && isOptional(value, "failure", isDatabaseBundleEventFailure) && isOptional(value, "http_response", isDatabaseHttpResponse) && isOptional(value, "delivery", isString) && isOptional(value, "patch_fallback", (flag) => typeof flag === "boolean") && isOptional(value, "change", isBundleEventChange) && isOptional(value, "late", (flag) => flag === true) && isOptional(value, "implied_download", (flag) => flag === true);
+const isRecord$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/**
+* The built-in bundle a report says its installation runs: the running
+* bundle, which a download leaves at its source, when it is the native
+* build's built-in bundle, whatever Release selected it. Null for any other
+* bundle, and for a report without the build's built-in bundle ID.
+*/
+const runningBuiltinBundleId = (row) => {
+	const running = row.type === "UPDATE_DOWNLOADED" ? row.from_bundle_id : row.to_bundle_id;
+	const builtin = isRecord$2(row.metadata) ? row.metadata.min_bundle_id : null;
+	return typeof builtin === "string" && running === builtin ? builtin : null;
+};
+const isIdentity$1 = (value) => typeof value === "string" && value.length > 0 && value.length <= 255;
+const isTextOrNull = (value) => value === null || typeof value === "string";
+/** Each bundle event field and what it holds. */
+const BUNDLE_EVENT_FIELDS = {
+	id: (value) => typeof value === "string",
+	type: (value) => value === "UPDATE_DOWNLOADED" || value === "UPDATE_APPLIED" || value === "RECOVERED" || value === "UPDATE_FAILED" || value === "UNCHANGED",
+	install_id: isIdentity$1,
+	user_id: (value) => value === null || isIdentity$1(value),
+	from_bundle_id: isTextOrNull,
+	from_release_id: isTextOrNull,
+	to_release_id: isTextOrNull,
+	to_bundle_id: (value) => typeof value === "string",
+	platform: (value) => value === "ios" || value === "android",
+	app_version: (value) => typeof value === "string",
+	channel: (value) => typeof value === "string",
+	metadata: isDatabaseBundleEventMetadata,
+	received_at_ms: (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0
+};
+const hasMetadata = (row, key) => isRecord$2(row.metadata) && Object.hasOwn(row.metadata, key);
+const updateStrategyOf = (row) => isRecord$2(row.metadata) ? row.metadata.update_strategy : void 0;
+/**
+* A movement, or a failed update, names the bundle it left and how the
+* device updates, and a failed update says what failed; an unchanged report
+* names neither.
+*/
+const hasEventInvariants = (row) => (row.type === "UPDATE_DOWNLOADED" || row.type === "UPDATE_APPLIED" || row.type === "RECOVERED" || row.type === "UPDATE_FAILED") && typeof row.from_bundle_id === "string" && (updateStrategyOf(row) === "fingerprint" || updateStrategyOf(row) === "appVersion") && (row.type !== "UPDATE_FAILED" || isRecord$2(row.metadata) && isRecord$2(row.metadata.failure)) && !hasMetadata(row, "change") && (!hasMetadata(row, "late") || row.type === "UPDATE_DOWNLOADED" || row.type === "UPDATE_APPLIED") && (!hasMetadata(row, "implied_download") || row.type === "UPDATE_APPLIED" || row.type === "RECOVERED") || row.type === "UNCHANGED" && !hasMetadata(row, "late") && row.from_bundle_id === null && updateStrategyOf(row) === null;
+/**
+* Throws unless `row` has exactly the bundle event fields, each of its type,
+* and the invariants of its event type: `invalid-field` for an unknown field,
+* `invalid-data` for anything else.
+*/
+const validateBundleEventFields = (row) => {
+	if (!isRecord$2(row)) throw new DatabaseAdapterInputError("invalid-data");
+	for (const field of Object.keys(row)) if (!Object.hasOwn(BUNDLE_EVENT_FIELDS, field)) throw new DatabaseAdapterInputError("invalid-field");
+	for (const [field, valid] of Object.entries(BUNDLE_EVENT_FIELDS)) if (!Object.hasOwn(row, field) || !valid(row[field])) throw new DatabaseAdapterInputError("invalid-data");
+	if (!hasEventInvariants(row)) throw new DatabaseAdapterInputError("invalid-data");
+};
+//#endregion
+//#region ../insights/dist/server/contract.mjs
+const encoder = new TextEncoder();
+/** Exact UTF-8 byte ordering, without case folding or Unicode normalization. */
+const compareInsightsText = (left, right) => {
+	const a = encoder.encode(left);
+	const b = encoder.encode(right);
+	for (let index = 0; index < Math.min(a.length, b.length); index += 1) if (a[index] !== b[index]) return a[index] - b[index];
+	return a.length - b.length;
+};
+const isWellFormedText = (value) => {
+	for (const character of value) {
+		const point = character.codePointAt(0);
+		if (point >= 55296 && point <= 57343) return false;
 	}
-});
+	return true;
+};
+const isIdentity = (value) => typeof value === "string" && value.length > 0 && value.length <= 255 && isWellFormedText(value);
+const isText$1 = (value) => typeof value === "string" && value.length > 0 && isWellFormedText(value);
+const isTimestamp = (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+const isLimit = (value) => isTimestamp(value) && value >= 1 && value <= 101;
+const hasOnlyKeys = (value, keys) => Object.keys(value).every((key) => keys.includes(key));
+const hasScope = (value) => (value.platform === "ios" || value.platform === "android") && isText$1(value.channel);
+const isBundleFilter = (value, withKind = false) => {
+	if (!isRecord$2(value) || !hasScope(value)) return false;
+	const keys = [
+		"platform",
+		"channel",
+		"type",
+		...withKind ? ["kind"] : []
+	];
+	return value.type === "RECOVERED" ? isText$1(value.fromBundleId) && hasOnlyKeys(value, [...keys, "fromBundleId"]) : (value.type === "UPDATE_DOWNLOADED" || value.type === "UPDATE_APPLIED" || value.type === "UPDATE_FAILED" || value.type === "UNCHANGED") && isText$1(value.toBundleId) && hasOnlyKeys(value, [...keys, "toBundleId"]);
+};
+const isEventFilter = (value) => {
+	if (!isRecord$2(value)) return false;
+	if (value.kind === "all") return hasOnlyKeys(value, ["kind"]);
+	if (value.kind === "installationMovement") return isIdentity(value.installId) && hasOnlyKeys(value, ["kind", "installId"]);
+	return value.kind === "bundle" && isBundleFilter(value, true);
+};
+const validateRow = (model, row, result = false) => {
+	try {
+		validateBundleEventFields(row);
+		if (!isRecord$2(row) || typeof row.id !== "string" || !isUUIDv7(row.id) || [...Object.values(row), ...isRecord$2(row.metadata) ? Object.values(row.metadata) : []].some((value) => typeof value === "string" && !isWellFormedText(value))) throw new DatabaseAdapterInputError("invalid-data");
+	} catch (error) {
+		if (result) throw new DatabaseAdapterInputError("invalid-result");
+		throw error;
+	}
+};
+/** Throws `invalid-data` unless `row` is a complete, well-formed bundle event row. */
+const assertBundleEventRow = (row) => validateRow("bundle_events", row);
 /**
-* Each installation's latest event, whole, so reading it is one point read.
-* Its gauges count it in the UTC day of that event. An update failure moves
-* nothing, so no head holds one.
+* Downloads, applies, recoveries, failed updates, and the UNCHANGED rows
+* kept for a change belong in installation history.
 */
-const bundleEventHeads = (days) => defineTable({
-	install_id: {
-		type: "string",
-		maxLength: 255
-	},
-	id: {
-		type: "string",
-		maxLength: 36
-	},
-	type: {
-		type: "string",
-		maxLength: 32
-	},
-	user_id: {
-		type: "string",
-		maxLength: 255,
-		required: false
+const isInsightsMovementEvent = (event) => event.type === "UPDATE_DOWNLOADED" || event.type === "UPDATE_APPLIED" || event.type === "RECOVERED" || event.type === "UPDATE_FAILED" || event.type === "UNCHANGED";
+const matchesInsightsEventFilter = (event, filter) => {
+	if (filter.kind === "all") return true;
+	if (filter.kind === "installationMovement") return event.install_id === filter.installId && isInsightsMovementEvent(event);
+	return event.type === filter.type && event.platform === filter.platform && event.channel === filter.channel && bundleRefsOf(event).includes(bundleRefOfFilter(filter));
+};
+const invalidQuery = () => {
+	throw new DatabaseAdapterInputError("invalid-query");
+};
+const invalidResult = () => {
+	throw new DatabaseAdapterInputError("invalid-result");
+};
+const validateCount = (count) => isTimestamp(count) ? count : invalidResult();
+const isTimeRange = (value) => isRecord$2(value) && hasOnlyKeys(value, ["start", "end"]) && isTimestamp(value.start) && isTimestamp(value.end) && value.start < value.end;
+const isReleaseReference = (value) => isRecord$2(value) && hasOnlyKeys(value, [
+	"releaseId",
+	"platform",
+	"channel"
+]) && isIdentity(value.releaseId) && hasScope(value);
+const validateAggregateResult = (value) => {
+	const result = isRecord$2(value) ? value : invalidResult();
+	if (!isTimestamp(result.measuredAtMs)) invalidResult();
+	const coverage = result.coverage;
+	if (!isRecord$2(coverage) || coverage.kind !== "complete" && coverage.kind !== "partial" || coverage.sinceMs !== null && !isTimestamp(coverage.sinceMs)) invalidResult();
+};
+/** Validate custom and bundled providers at the same public boundary. */
+const createValidatedInsightsModel = (model) => ({
+	async recordEvent(input) {
+		if (!isRecord$2(input) || !hasOnlyKeys(input, ["event"])) throw new DatabaseAdapterInputError("invalid-data");
+		validateRow("bundle_events", input.event);
+		await model.recordEvent(input);
 	},
-	from_release_id: {
-		type: "string",
-		maxLength: 36,
-		required: false
+	async listEvents(input) {
+		if (!isRecord$2(input) || !hasOnlyKeys(input, [
+			"filter",
+			"sinceMs",
+			"beforeReceivedAtMs",
+			"after",
+			"limit"
+		]) || !isEventFilter(input.filter) || !isLimit(input.limit) || !isTimestamp(input.beforeReceivedAtMs) || input.sinceMs !== void 0 && !isTimestamp(input.sinceMs)) invalidQuery();
+		const sinceMs = input.sinceMs ?? 0;
+		if (sinceMs > input.beforeReceivedAtMs || input.after !== void 0 && (!isRecord$2(input.after) || !hasOnlyKeys(input.after, ["receivedAtMs", "id"]) || !isTimestamp(input.after.receivedAtMs) || typeof input.after.id !== "string" || !isUUIDv7(input.after.id) || input.after.receivedAtMs < sinceMs || input.after.receivedAtMs >= input.beforeReceivedAtMs)) invalidQuery();
+		const rows = await model.listEvents(input);
+		if (!Array.isArray(rows) || rows.length > input.limit) invalidResult();
+		let previous = input.after;
+		for (const row of rows) {
+			validateRow("bundle_events", row, true);
+			if (row.received_at_ms < sinceMs || row.received_at_ms >= input.beforeReceivedAtMs || !matchesInsightsEventFilter(row, input.filter) || previous !== void 0 && (row.received_at_ms > previous.receivedAtMs || row.received_at_ms === previous.receivedAtMs && row.id >= previous.id)) invalidResult();
+			previous = {
+				receivedAtMs: row.received_at_ms,
+				id: row.id
+			};
+		}
+		return rows;
 	},
-	from_bundle_id: {
-		type: "string",
-		maxLength: 36,
-		required: false
+	async findLatestEvents(input) {
+		if (!isRecord$2(input)) invalidQuery();
+		if ("installId" in input) {
+			if (!hasOnlyKeys(input, ["installId"]) || !isIdentity(input.installId)) invalidQuery();
+		} else if (!hasOnlyKeys(input, [
+			"userId",
+			"afterInstallId",
+			"limit"
+		]) || !isIdentity(input.userId) || !isLimit(input.limit) || input.afterInstallId !== void 0 && !isIdentity(input.afterInstallId)) invalidQuery();
+		const rows = await model.findLatestEvents(input);
+		if (!Array.isArray(rows) || rows.length > ("installId" in input ? 1 : input.limit)) invalidResult();
+		let previous = "installId" in input ? void 0 : input.afterInstallId;
+		for (const row of rows) {
+			validateRow("bundle_events", row, true);
+			if ("installId" in input ? row.install_id !== input.installId : row.user_id !== input.userId || previous !== void 0 && compareInsightsText(row.install_id, previous) <= 0) invalidResult();
+			previous = row.install_id;
+		}
+		return rows;
 	},
-	to_release_id: {
-		type: "string",
-		maxLength: 36,
-		required: false
+	async countLatestEvents(input) {
+		if (!isRecord$2(input) || !hasOnlyKeys(input, [
+			"platform",
+			"channel",
+			"sinceMs",
+			"bundle"
+		]) || !hasScope(input) || !isTimestamp(input.sinceMs) || input.bundle !== void 0 && (!Array.isArray(input.bundle) || input.bundle.length < 1 || input.bundle.length > 2 || input.bundle.some((bundle) => !isRecord$2(bundle) || !hasOnlyKeys(bundle, [
+			"field",
+			"value",
+			"types"
+		]) || bundle.field !== "from_bundle_id" && bundle.field !== "to_bundle_id" || !isText$1(bundle.value) || !Array.isArray(bundle.types) || bundle.types.length === 0 || bundle.types.some((type) => ![
+			"UNCHANGED",
+			"UPDATE_DOWNLOADED",
+			"UPDATE_APPLIED",
+			"RECOVERED"
+		].includes(type))))) invalidQuery();
+		return validateCount(await model.countLatestEvents(input));
 	},
-	to_bundle_id: {
-		type: "string",
-		maxLength: 36
+	async countEvents(input) {
+		if (!isRecord$2(input) || !hasOnlyKeys(input, [
+			"filter",
+			"sinceMs",
+			"beforeReceivedAtMs"
+		]) || !isBundleFilter(input.filter) || !isTimestamp(input.sinceMs) || !isTimestamp(input.beforeReceivedAtMs) || input.sinceMs > input.beforeReceivedAtMs) invalidQuery();
+		return validateCount(await model.countEvents(input));
 	},
-	platform: {
-		type: "string",
-		maxLength: 16
+	async countEventSeries(input) {
+		if (!isRecord$2(input) || !hasOnlyKeys(input, [
+			"filter",
+			"timeRange",
+			"intervalMs"
+		]) || !isBundleFilter(input.filter) || !isTimeRange(input.timeRange) || !isTimestamp(input.intervalMs)) invalidQuery();
+		const { start, end } = input.timeRange;
+		const { intervalMs } = input;
+		if (intervalMs === 0 || intervalMs % 36e5 !== 0 || start % 36e5 !== 0 || (end - start) % intervalMs !== 0 || end - start > 7776e6) invalidQuery();
+		const points = await model.countEventSeries(input);
+		if (!Array.isArray(points) || points.length !== (end - start) / intervalMs || points.some((point, index) => !isRecord$2(point) || !hasOnlyKeys(point, ["startMs", "events"]) || point.startMs !== start + index * intervalMs || !isTimestamp(point.events))) invalidResult();
+		return points;
 	},
-	app_version: { type: "string" },
-	channel: { type: "string" },
-	metadata: { type: "json" },
-	received_at_ms: { type: "integer" }
-}, {
-	key: ["install_id"],
-	indexes: { byUser: {
-		eq: ["user_id"],
-		sort: ["install_id"]
-	} },
-	retention: {
-		field: "received_at_ms",
-		days
-	}
-});
-/**
-* Shards are keyed by install id. Counters are blind increments and never
-* conflict, so they keep 8. Gauges and sketches are read, merged, and written
-* back. B3's rollout gate on PostgreSQL retried 2.4% of transactions at 8
-* shards and 1.3% at 16. DynamoDB's transactions take longer, so D8's gate
-* on DynamoDB Local retried 2–24% at 16, almost all on gauge rows, and 1–5%
-* with gauges at 32. Sketches stay at 16: each shard row carries 2 KB of
-* registers that every read merges.
-*
-* Every Insights aggregate is `batched`: on DynamoDB and Firestore, which
-* bill each write, an event's changes apply after it commits, merged with
-* other events' into one write per row, on one shard per writer.
-*/
-const COUNTER_SHARDS = 8;
-const GAUGE_SHARDS = 32;
-const SKETCH_SHARDS = 16;
-/** Rows keyed by a hashed identity (scope and period) and a bucket. */
-const identityFields = {
-	identity: {
-		type: "string",
-		maxLength: 32
+	async getReleaseActivity(input) {
+		if (!isRecord$2(input) || !hasOnlyKeys(input, ["releases"]) || !Array.isArray(input.releases) || input.releases.length < 1 || input.releases.length > 100 || !input.releases.every(isReleaseReference)) invalidQuery();
+		const result = await model.getReleaseActivity(input);
+		if (!isRecord$2(result) || !isTimestamp(result.measuredAtMs) || !Array.isArray(result.data) || result.data.some((item) => !isRecord$2(item) || !isReleaseReference(item.release) || !isRecord$2(item.metrics) || !isTimestamp(item.metrics.downloads) || !isTimestamp(item.metrics.applies) || !isTimestamp(item.metrics.failedLaunches))) invalidResult();
+		return result;
 	},
-	bucket_start_ms: { type: "integer" }
-};
-const window = {
-	eq: ["identity"],
-	sort: ["bucket_start_ms"]
-};
-/** What a release or channel row counts in every period kind. */
-const WINDOW_COUNTERS = [
-	"downloads",
-	"failed_launches",
-	"patch_downloads",
-	"patch_fallbacks"
-];
+	async getAppUsage(input) {
+		if (!isRecord$2(input) || !hasOnlyKeys(input, [
+			"channel",
+			"platform",
+			"appVersion",
+			"timeRange",
+			"intervalMs"
+		]) || !isText$1(input.channel) || ![
+			"all",
+			"ios",
+			"android"
+		].includes(input.platform) || input.appVersion !== void 0 && !isText$1(input.appVersion) || !isTimeRange(input.timeRange) || !isTimestamp(input.intervalMs) || input.intervalMs < 36e5) invalidQuery();
+		const result = await model.getAppUsage(input);
+		validateAggregateResult(result);
+		if (!isTimestamp(result.activeInstallations) || !Array.isArray(result.points) || !Array.isArray(result.appVersions) || !Array.isArray(result.versions) || !Array.isArray(result.platforms) || !Array.isArray(result.bundleDistribution)) invalidResult();
+		return result;
+	}
+});
+//#endregion
+//#region ../insights/dist/server/model.mjs
 /**
-* Hourly or daily counters: a release or channel row counts downloads,
-* launches that crashed and recovered (`failed_launches`), and downloads a
-* patch delivered and those that fell back from one.
+* The plugin's API as `InsightsModel`, validated at its boundary: what the
+* Insights routes, the console, and the e2e harness read through.
 */
-const counters = (retention) => defineAggregate(identityFields, {
-	key: ["identity", "bucket_start_ms"],
-	counters: WINDOW_COUNTERS,
-	shards: COUNTER_SHARDS,
-	batched: true,
-	indexes: { window },
-	retention
+const createInsightsModel = (api) => createValidatedInsightsModel({
+	recordEvent: ({ event }) => api.recordEvent(event),
+	listEvents: api.listEvents,
+	findLatestEvents: api.findLatestEvents,
+	countLatestEvents: api.countLatestEvents,
+	countEvents: api.countEvents,
+	countEventSeries: api.countEventSeries,
+	getReleaseActivity: api.getReleaseActivity,
+	getAppUsage: api.getAppUsage
 });
+//#endregion
+//#region ../insights/dist/server/official.mjs
 /**
-* A release's counters since its first report, at bucket 0: the windowed
-* counters, its applies, which the bundle list reads, and its failed updates
-* (`failed_updates`), since no breakdown row outlives the raw period; windowed
-* reads sum `insights_failures` instead.
+* The brand of Hot Updater's own plugins, a registered symbol that
+* `@hot-updater/server` reads to reserve the id "insights" for this plugin.
+* Each official plugin package keeps this copy, so none imports another's
+* internals for it.
 */
-const lifetimeCounters = () => defineAggregate(identityFields, {
-	key: ["identity", "bucket_start_ms"],
-	counters: [
-		...WINDOW_COUNTERS,
-		"applies",
-		"failed_updates"
-	],
-	shards: COUNTER_SHARDS,
-	batched: true,
-	indexes: { window }
-});
+const OFFICIAL = Symbol.for("@hot-updater/server/official-plugin");
+/** Marks a plugin one of Hot Updater's own factories made. */
+const markOfficial = (plugin) => Object.defineProperty(plugin, OFFICIAL, { value: true });
+//#endregion
+//#region ../insights/dist/server/errors.mjs
 /**
-* Unique-installation sketches of one period kind: a usage row's active
-* installations (`activity_users`), and a `failure` or `check` row's
-* installations whose update or update check failed (`failed_users`).
+* What Insights' API throws for an input it refuses, such as an unknown
+* event field or a malformed cursor; its routes answer 400 for it.
 */
-const sketches = (retention) => defineAggregate(identityFields, {
-	key: ["identity", "bucket_start_ms"],
-	distinct: ["activity_users", "failed_users"],
-	shards: SKETCH_SHARDS,
-	batched: true,
-	indexes: { window },
-	retention
-});
-/** Installations whose update to a release failed, since its first failure: kept, at bucket 0. */
-const lifetimeSketches = () => defineAggregate(identityFields, {
-	key: ["identity", "bucket_start_ms"],
-	distinct: ["failed_users"],
-	shards: SKETCH_SHARDS,
-	batched: true,
-	indexes: { window }
-});
+var InsightsBadRequestError = class extends Error {
+	name = "InsightsBadRequestError";
+};
+var InsightsPayloadTooLargeError = class extends Error {
+	maximumBytes;
+	name = "InsightsPayloadTooLargeError";
+	constructor(maximumBytes) {
+		super(`Event payload exceeds ${maximumBytes} bytes`);
+		this.maximumBytes = maximumBytes;
+	}
+};
+//#endregion
+//#region ../insights/dist/server/eventInput.mjs
+const MAX_EVENT_STRING_LENGTH = 1024;
+const MAX_IDENTITY_LENGTH$2 = 255;
+const EVENT_BODY_MAX_BYTES = 16384;
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function requireStringField(payload, key) {
+	const value = payload[key];
+	if (typeof value !== "string" || value.length === 0 || value.length > MAX_EVENT_STRING_LENGTH || new TextDecoder("utf-8", { ignoreBOM: true }).decode(new TextEncoder().encode(value)) !== value) throw new InsightsBadRequestError(`Invalid event field: ${key}`);
+	return value;
+}
+function requireNullableStringField(payload, key) {
+	if (payload[key] === null) return null;
+	return requireStringField(payload, key);
+}
+function requireIdentityField(payload, key) {
+	const value = requireStringField(payload, key);
+	if (value.length > MAX_IDENTITY_LENGTH$2) throw new InsightsBadRequestError(`Invalid event field: ${key}`);
+	return value;
+}
 /**
-* Update failures by what failed, a row an hour. `release_id` is the failed
-* update's target release, or empty for a failed check or an unknown target.
-* `stage` and `reason` say where and why it failed, and `detail` what else
-* the client knew, as the JSON array `[resource, httpStatus, originCode,
-* transport]`. Every index is in key order, so its counters stay blind
-* increments.
+* The report's idempotency key, when the client sends one: it creates the
+* UUIDv7 once and repeats it on every retry of that report.
 */
-const insightsFailures = (retention) => defineAggregate({
-	platform: {
-		type: "string",
-		maxLength: 16
-	},
-	channel: { type: "string" },
-	bucket_start_ms: { type: "integer" },
-	release_id: {
-		type: "string",
-		maxLength: 36
-	},
-	stage: {
-		type: "string",
-		maxLength: 16
-	},
-	reason: {
-		type: "string",
-		maxLength: 64
-	},
-	detail: {
-		type: "string",
-		maxLength: 160
+function readEventId(payload) {
+	const value = payload.eventId;
+	if (value === void 0) return void 0;
+	if (!isUUIDv7(value)) throw new InsightsBadRequestError("Invalid event field: eventId");
+	return value;
+}
+/**
+* The native build's built-in bundle ID: a bundle ID's length at most, and
+* left out when it is missing or malformed, so the report still records.
+*/
+const readMinBundleId = (value) => typeof value === "string" && value.length > 0 && value.length <= 36 ? value : null;
+/** One value of an open set: any other value reads as `unknown`. */
+const oneOf = (values, value) => values.includes(value) ? value : "unknown";
+const STAGES = [
+	"check",
+	"download",
+	"install"
+];
+const REASONS = [
+	"network",
+	"http",
+	"invalid_response",
+	"hash_mismatch",
+	"signature",
+	"patch",
+	"extract",
+	"storage"
+];
+const RESOURCES = [
+	"catalog",
+	"artifact",
+	"manifest",
+	"file",
+	"patch",
+	"archive"
+];
+const TRANSPORTS = [
+	"timeout",
+	"dns",
+	"tls",
+	"connection",
+	"offline",
+	"cancelled"
+];
+const DELIVERIES = [
+	"patch",
+	"manifest",
+	"archive"
+];
+/** A storage error code: letters, digits, and `._-`. */
+const CODE = /^[A-Za-z0-9._-]{1,64}$/;
+const readCode = (value) => typeof value === "string" && CODE.test(value) ? value : void 0;
+const readMetadata = (payload) => isRecord$1(payload.metadata) ? payload.metadata : {};
+/**
+* What an UPDATE_FAILED report says failed. It never refuses the report: an
+* unknown value of a set reads as `unknown`, a missing or malformed failure
+* as an unknown stage and reason, and a malformed optional field is left out,
+* as is a null one.
+*/
+function readFailure(value) {
+	const failure = isRecord$1(value) ? value : {};
+	const httpStatus = failure.httpStatus;
+	const originCode = readCode(failure.originCode);
+	const errorMessage = typeof failure.errorMessage === "string" && failure.errorMessage.length <= 2048 ? failure.errorMessage : void 0;
+	const errorStack = typeof failure.errorStack === "string" && failure.errorStack.length <= 4096 ? failure.errorStack : void 0;
+	return {
+		stage: oneOf(STAGES, failure.stage),
+		reason: oneOf(REASONS, failure.reason),
+		...failure.resource == null ? {} : { resource: oneOf(RESOURCES, failure.resource) },
+		...Number.isSafeInteger(httpStatus) && httpStatus >= 100 && httpStatus <= 599 ? { httpStatus } : {},
+		...failure.transport == null ? {} : { transport: oneOf(TRANSPORTS, failure.transport) },
+		...originCode === void 0 ? {} : { originCode },
+		...errorMessage === void 0 ? {} : { errorMessage },
+		...errorStack === void 0 ? {} : { errorStack }
+	};
+}
+function readHttpResponse(value) {
+	if (!isRecord$1(value) || value.resource !== "catalog" && value.resource !== "artifact" || typeof value.path !== "string" || value.path.length > 1024 || !Number.isSafeInteger(value.status) || value.status < 100 || value.status > 599 || value.body !== null && (typeof value.body !== "string" || new TextEncoder().encode(JSON.stringify(value.body)).byteLength > 4096) || typeof value.bodyTruncated !== "boolean" || !Number.isSafeInteger(value.receivedAtMs) || value.receivedAtMs < 0) throw new InsightsBadRequestError("Invalid HTTP response details");
+	return {
+		resource: value.resource,
+		path: value.path,
+		status: value.status,
+		body: value.body,
+		bodyTruncated: value.bodyTruncated,
+		receivedAtMs: value.receivedAtMs
+	};
+}
+async function readBoundedText(request) {
+	const contentLength = request.headers.get("content-length");
+	const declaredByteLength = Number(contentLength);
+	if (contentLength !== null && Number.isSafeInteger(declaredByteLength) && declaredByteLength > 16384) throw new InsightsPayloadTooLargeError(EVENT_BODY_MAX_BYTES);
+	if (request.body === null) return "";
+	const reader = request.body.getReader();
+	const decoder = new TextDecoder();
+	let byteLength = 0;
+	let text = "";
+	while (true) {
+		const result = await reader.read();
+		if (result.done) break;
+		byteLength += result.value.byteLength;
+		if (byteLength > 16384) {
+			await reader.cancel();
+			throw new InsightsPayloadTooLargeError(EVENT_BODY_MAX_BYTES);
+		}
+		text += decoder.decode(result.value, { stream: true });
+	}
+	return text + decoder.decode();
+}
+async function parseJson(request) {
+	const text = await readBoundedText(request);
+	try {
+		return JSON.parse(text);
+	} catch (error) {
+		if (error instanceof SyntaxError) throw new InsightsBadRequestError("Invalid event payload");
+		throw error;
+	}
+}
+function requireEvent(payload) {
+	if (!isRecord$1(payload)) throw new InsightsBadRequestError("Invalid event payload");
+	const platform = requireStringField(payload, "platform");
+	if (platform !== "ios" && platform !== "android") throw new InsightsBadRequestError("Invalid event field: platform");
+	const eventId = readEventId(payload);
+	const metadata = readMetadata(payload);
+	const httpMetadata = metadata.httpResponse === void 0 ? {} : { httpResponse: readHttpResponse(metadata.httpResponse) };
+	const base = {
+		...metadata.httpResponse === void 0 ? {} : { metadata: httpMetadata },
+		...eventId === void 0 ? {} : { eventId },
+		installId: requireIdentityField(payload, "installId"),
+		toBundleId: requireStringField(payload, "toBundleId"),
+		...payload.userId === void 0 ? {} : { userId: requireIdentityField(payload, "userId") },
+		platform,
+		appVersion: requireStringField(payload, "appVersion"),
+		channel: requireStringField(payload, "channel"),
+		cohort: requireStringField(payload, "cohort"),
+		fingerprintHash: requireNullableStringField(payload, "fingerprintHash"),
+		sdkVersion: payload.sdkVersion === void 0 ? null : requireNullableStringField(payload, "sdkVersion"),
+		minBundleId: readMinBundleId(payload.minBundleId),
+		fromReleaseId: requireNullableStringField(payload, "fromReleaseId"),
+		toReleaseId: requireNullableStringField(payload, "toReleaseId")
+	};
+	const type = requireStringField(payload, "type");
+	const movement = () => {
+		const updateStrategy = requireStringField(payload, "updateStrategy");
+		if (updateStrategy !== "fingerprint" && updateStrategy !== "appVersion") throw new InsightsBadRequestError("Invalid event field: updateStrategy");
+		return {
+			...base,
+			fromBundleId: requireStringField(payload, "fromBundleId"),
+			updateStrategy
+		};
+	};
+	switch (type) {
+		case "UPDATE_DOWNLOADED": {
+			const delivery = metadata.delivery;
+			const read = {
+				...httpMetadata,
+				...delivery == null ? {} : { delivery: oneOf(DELIVERIES, delivery) },
+				...metadata.patchFallback === true ? { patchFallback: true } : {}
+			};
+			return {
+				...movement(),
+				type,
+				...Object.keys(read).length === 0 ? {} : { metadata: read }
+			};
+		}
+		case "UPDATE_APPLIED":
+		case "RECOVERED": return {
+			...movement(),
+			type
+		};
+		case "UPDATE_FAILED": return {
+			...movement(),
+			type,
+			metadata: {
+				...httpMetadata,
+				failure: readFailure(metadata.failure)
+			}
+		};
+		case "UNCHANGED":
+			if (payload.fromBundleId !== null || payload.updateStrategy !== null) throw new InsightsBadRequestError("Invalid unchanged event shape");
+			return {
+				...base,
+				type,
+				fromBundleId: null,
+				updateStrategy: null
+			};
+		default: throw new InsightsBadRequestError("Invalid event field: type");
 	}
-}, {
-	key: [
-		"platform",
-		"channel",
-		"bucket_start_ms",
-		"release_id",
-		"stage",
-		"reason",
-		"detail"
-	],
-	counters: ["events"],
-	shards: COUNTER_SHARDS,
-	batched: true,
-	indexes: { byScope: {
-		eq: ["platform", "channel"],
-		sort: ["bucket_start_ms"]
-	} },
-	retention
-});
-/** Installations counted in the UTC day of their latest event, so reads sum whole UTC days. */
-const insightsDistribution = (retention) => defineAggregate({
-	channel: { type: "string" },
-	platform: {
-		type: "string",
-		maxLength: 16
-	},
-	app_version: { type: "string" },
-	release_id: {
-		type: "string",
-		maxLength: 36
-	},
-	bucket_start_ms: { type: "integer" }
-}, {
-	key: [
-		"channel",
-		"platform",
-		"app_version",
-		"release_id",
-		"bucket_start_ms"
-	],
-	gauges: ["latest_installations"],
-	shards: GAUGE_SHARDS,
-	batched: true,
-	indexes: {
-		byScope: {
-			eq: ["channel", "platform"],
-			sort: ["bucket_start_ms"]
-		},
-		byVersion: {
-			eq: [
-				"channel",
-				"platform",
-				"app_version"
-			],
-			sort: ["bucket_start_ms"]
+}
+async function parseBundleEventRequest(request) {
+	return requireEvent(await parseJson(request));
+}
+function createBundleEventRow(input) {
+	input = requireEvent(input);
+	const base = {
+		app_version: input.appVersion,
+		channel: input.channel,
+		from_release_id: input.fromReleaseId,
+		id: input.eventId ?? createUUIDv7(),
+		install_id: input.installId,
+		platform: input.platform,
+		received_at_ms: Date.now(),
+		to_bundle_id: input.toBundleId,
+		to_release_id: input.toReleaseId,
+		user_id: input.userId ?? null
+	};
+	const response = input.metadata?.httpResponse;
+	const metadata = {
+		...response ? { http_response: {
+			resource: response.resource,
+			path: response.path,
+			status: response.status,
+			body: response.body,
+			body_truncated: response.bodyTruncated,
+			received_at_ms: response.receivedAtMs
+		} } : {},
+		cohort: input.cohort,
+		fingerprint_hash: input.fingerprintHash,
+		sdk_version: input.sdkVersion ?? null,
+		...input.minBundleId ? { min_bundle_id: input.minBundleId } : {},
+		update_strategy: input.updateStrategy
+	};
+	switch (input.type) {
+		case "UPDATE_DOWNLOADED": {
+			const { delivery, patchFallback } = input.metadata ?? {};
+			return {
+				...base,
+				from_bundle_id: input.fromBundleId,
+				type: input.type,
+				metadata: {
+					...metadata,
+					...delivery === void 0 ? {} : { delivery },
+					...patchFallback ? { patch_fallback: true } : {}
+				}
+			};
 		}
-	},
-	retention
-});
+		case "UPDATE_APPLIED":
+		case "RECOVERED": return {
+			...base,
+			from_bundle_id: input.fromBundleId,
+			type: input.type,
+			metadata
+		};
+		case "UPDATE_FAILED": {
+			const { failure } = input.metadata;
+			return {
+				...base,
+				from_bundle_id: input.fromBundleId,
+				type: input.type,
+				metadata: {
+					...metadata,
+					failure: {
+						stage: failure.stage,
+						reason: failure.reason,
+						...failure.errorMessage === void 0 ? {} : { error_message: failure.errorMessage },
+						...failure.errorStack === void 0 ? {} : { error_stack: failure.errorStack },
+						...failure.resource === void 0 ? {} : { resource: failure.resource },
+						...failure.httpStatus === void 0 ? {} : { http_status: failure.httpStatus },
+						...failure.transport === void 0 ? {} : { transport: failure.transport },
+						...failure.originCode === void 0 ? {} : { origin_code: failure.originCode }
+					}
+				}
+			};
+		}
+		case "UNCHANGED": return {
+			...base,
+			from_bundle_id: null,
+			type: input.type,
+			metadata
+		};
+	}
+}
+//#endregion
+//#region ../insights/dist/server/provider.mjs
+const DEFAULT_PAGE_LIMIT = 50;
+const MAX_PAGE_LIMIT$1 = 100;
+const MAX_EVENT_ID_LENGTH = 1024;
+const MAX_IDENTITY_LENGTH$1 = 255;
+const MAX_CURSOR_LENGTH$1 = 8192;
+const HOUR_MS = 36e5;
+const DAY_MS = 24 * HOUR_MS;
+const WINDOW_MS = {
+	"24h": 864e5,
+	"7d": 6048e5,
+	"30d": 2592e6
+};
 /**
-* The installations of `insights_distribution` that run their native build's
-* built-in bundle, by its ID (`builtin_bundle_id`), within the same rows:
-* reads move them out of the row of their release, or of no release.
-*/
-const insightsBuiltinDistribution = (retention) => defineAggregate({
-	channel: { type: "string" },
-	platform: {
-		type: "string",
-		maxLength: 16
-	},
-	app_version: { type: "string" },
-	release_id: {
-		type: "string",
-		maxLength: 36
-	},
-	builtin_bundle_id: {
-		type: "string",
-		maxLength: 36
-	},
-	bucket_start_ms: { type: "integer" }
-}, {
-	key: [
-		"channel",
-		"platform",
-		"app_version",
-		"release_id",
-		"builtin_bundle_id",
-		"bucket_start_ms"
-	],
-	gauges: ["latest_installations"],
-	shards: GAUGE_SHARDS,
-	batched: true,
-	indexes: {
-		byScope: {
-			eq: ["channel", "platform"],
-			sort: ["bucket_start_ms"]
+* The longest receipt range, `[sinceMs, beforeReceivedAtMs)`, of a global or
+* bundle event list, and the range one covers without `sinceMs`: raw events
+* are listed inside a time range, as analytics products list them. It is a
+* duration, so a range that ends mid-day touches 91 UTC days. Installation
+* history is one index range and reads back to `sinceMs`.
+*/
+const EVENT_LIST_RANGE_MS = 2160 * HOUR_MS;
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const requireString = (value, label, maximumLength) => {
+	if (typeof value !== "string" || value.length === 0 || value.length > maximumLength || new TextDecoder("utf-8", { ignoreBOM: true }).decode(new TextEncoder().encode(value)) !== value) throw new InsightsBadRequestError(`Invalid ${label}.`);
+	return value;
+};
+const requireTimestamp = (value, label) => {
+	if (!Number.isSafeInteger(value) || Number(value) < 0) throw new InsightsBadRequestError(`Invalid ${label}.`);
+	return Number(value);
+};
+const readLimit = (value) => {
+	const limit = value ?? DEFAULT_PAGE_LIMIT;
+	if (!Number.isSafeInteger(limit) || limit < 1 || limit > MAX_PAGE_LIMIT$1) throw new InsightsBadRequestError("Invalid page limit.");
+	return limit;
+};
+const encodeBase64Url = (value) => {
+	const bytes = new TextEncoder().encode(value);
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
+};
+const decodeBase64Url = (value) => {
+	if (value.length === 0 || value.length > MAX_CURSOR_LENGTH$1) throw new InsightsBadRequestError("Invalid Insights cursor.");
+	try {
+		const base64 = value.replaceAll("-", "+").replaceAll("_", "/");
+		const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, "=");
+		const binary = atob(padded);
+		const bytes = Uint8Array.from(binary, (character) => character.charCodeAt(0));
+		return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+	} catch {
+		throw new InsightsBadRequestError("Invalid Insights cursor.");
+	}
+};
+const encodeCursor = (value) => encodeBase64Url(JSON.stringify(value));
+const decodeCursor = (value) => {
+	try {
+		return JSON.parse(decodeBase64Url(value));
+	} catch (error) {
+		if (error instanceof InsightsBadRequestError) throw error;
+		throw new InsightsBadRequestError("Invalid Insights cursor.");
+	}
+};
+const readScope$1 = (input) => {
+	if (input.platform !== "ios" && input.platform !== "android") throw new InsightsBadRequestError("Invalid Insights platform.");
+	return {
+		platform: input.platform,
+		channel: requireString(input.channel, "channel", MAX_EVENT_ID_LENGTH)
+	};
+};
+const bundleFilter = (input) => {
+	const scope = readScope$1(input);
+	const bundleId = requireString(input.bundleId, "bundle ID", MAX_EVENT_ID_LENGTH);
+	switch (input.outcome) {
+		case "downloaded": return {
+			...scope,
+			type: "UPDATE_DOWNLOADED",
+			toBundleId: bundleId
+		};
+		case "applied": return {
+			...scope,
+			type: "UPDATE_APPLIED",
+			toBundleId: bundleId
+		};
+		case "recovered": return {
+			...scope,
+			type: "RECOVERED",
+			fromBundleId: bundleId
+		};
+		case "failed": return {
+			...scope,
+			type: "UPDATE_FAILED",
+			toBundleId: bundleId
+		};
+		default: throw new InsightsBadRequestError("Invalid Insights outcome.");
+	}
+};
+const sameFilter = (left, right) => {
+	if (!isRecord(left) || left.kind !== right.kind) return false;
+	switch (right.kind) {
+		case "all": return true;
+		case "installationMovement": return left.installId === right.installId;
+		case "bundle": return left.platform === right.platform && left.channel === right.channel && left.type === right.type && (right.type === "RECOVERED" ? left.fromBundleId === right.fromBundleId : left.toBundleId === right.toBundleId);
+	}
+};
+const readEventCursor = (value, filter) => {
+	const cursor = decodeCursor(value);
+	if (!isRecord(cursor) || cursor.version !== 2 || cursor.kind !== "events" || !isRecord(cursor.filter) || !isRecord(cursor.after)) throw new InsightsBadRequestError("Invalid Insights cursor.");
+	if (!sameFilter(cursor.filter, filter)) throw new InsightsBadRequestError("Insights cursor does not match the requested events.");
+	if (typeof cursor.after.id !== "string" || !isUUIDv7(cursor.after.id)) throw new InsightsBadRequestError("Invalid Insights event cursor ID.");
+	return {
+		after: {
+			id: cursor.after.id,
+			receivedAtMs: requireTimestamp(cursor.after.receivedAtMs, "event cursor")
 		},
-		byVersion: {
-			eq: [
-				"channel",
-				"platform",
-				"app_version"
-			],
-			sort: ["bucket_start_ms"]
-		}
-	},
-	retention
+		beforeReceivedAtMs: requireTimestamp(cursor.beforeReceivedAtMs, "event cutoff"),
+		kind: "events",
+		sinceMs: requireTimestamp(cursor.sinceMs, "event start"),
+		filter,
+		version: 2
+	};
+};
+const readUserInstallationCursor = (value, userId) => {
+	const cursor = decodeCursor(value);
+	if (!isRecord(cursor) || cursor.version !== 1 || cursor.kind !== "user-installations" || cursor.userId !== userId) throw new InsightsBadRequestError("Insights cursor does not match the requested user ID.");
+	return {
+		afterInstallId: requireString(cursor.afterInstallId, "installation cursor", MAX_IDENTITY_LENGTH$1),
+		kind: "user-installations",
+		userId,
+		version: 1
+	};
+};
+const compareEventNewest = (left, right) => right.received_at_ms - left.received_at_ms || compareInsightsText(right.id, left.id);
+const isAfterEventCursor = (row, after) => row.received_at_ms < after.receivedAtMs || row.received_at_ms === after.receivedAtMs && compareInsightsText(row.id, after.id) < 0;
+const assertEventRows = (rows, input) => {
+	if (rows.length > input.limit) throw new Error("Insights database returned too many event rows.");
+	for (let index = 0; index < rows.length; index += 1) {
+		const row = rows[index];
+		const previous = rows[index - 1];
+		if (!row || typeof row.id !== "string" || !isUUIDv7(row.id) || !Number.isSafeInteger(row.received_at_ms) || row.received_at_ms >= input.beforeReceivedAtMs || row.received_at_ms < input.sinceMs || previous !== void 0 && compareEventNewest(previous, row) >= 0 || input.after !== void 0 && !isAfterEventCursor(row, input.after) || input.filter.kind === "installationMovement" && (row.install_id !== input.filter.installId || !isInsightsMovementEvent(row)) || input.filter.kind === "bundle" && (row.platform !== input.filter.platform || row.channel !== input.filter.channel || row.type !== input.filter.type || (input.filter.type === "RECOVERED" ? row.from_bundle_id !== input.filter.fromBundleId : row.to_bundle_id !== input.filter.toBundleId))) throw new Error("Insights database returned invalid event rows.");
+	}
+};
+/** An `UPDATE_FAILED` row's failure, as the event lists show it. */
+const toFailure = (failure) => ({
+	stage: failure.stage,
+	reason: failure.reason,
+	...failure.error_message === void 0 ? {} : { errorMessage: failure.error_message },
+	...failure.error_stack === void 0 ? {} : { errorStack: failure.error_stack },
+	...failure.resource === void 0 ? {} : { resource: failure.resource },
+	...failure.http_status === void 0 ? {} : { httpStatus: failure.http_status },
+	...failure.transport === void 0 ? {} : { transport: failure.transport },
+	...failure.origin_code === void 0 ? {} : { originCode: failure.origin_code }
 });
-/** Latest events by the bundle they came from or went to, bucketed like the distribution. */
-const insightsLatestByBundle = (retention) => defineAggregate({
-	platform: {
-		type: "string",
-		maxLength: 16
-	},
-	channel: { type: "string" },
-	bundle_field: {
-		type: "string",
-		maxLength: 16
-	},
-	bundle_id: {
-		type: "string",
-		maxLength: 36
-	},
-	type: {
-		type: "string",
-		maxLength: 32
-	},
-	bucket_start_ms: { type: "integer" }
-}, {
-	key: [
-		"platform",
-		"channel",
-		"bundle_field",
-		"bundle_id",
-		"type",
-		"bucket_start_ms"
-	],
-	gauges: ["installations"],
-	shards: GAUGE_SHARDS,
-	batched: true,
-	indexes: { byBundle: {
-		eq: [
-			"platform",
-			"channel",
-			"bundle_field",
-			"bundle_id",
-			"type"
-		],
-		sort: ["bucket_start_ms"]
-	} },
-	retention
+/** What a row's metadata adds for its type: a failure or a delivery. */
+const eventDetails = ({ type, metadata }) => ({
+	...metadata.http_response !== void 0 ? { httpResponse: {
+		resource: metadata.http_response.resource,
+		path: metadata.http_response.path,
+		status: metadata.http_response.status,
+		body: metadata.http_response.body,
+		bodyTruncated: metadata.http_response.body_truncated,
+		receivedAtMs: metadata.http_response.received_at_ms
+	} } : {},
+	...type === "UPDATE_FAILED" && metadata.failure !== void 0 ? { failure: toFailure(metadata.failure) } : {},
+	...type === "UPDATE_DOWNLOADED" && metadata.delivery !== void 0 ? { delivery: metadata.delivery } : {},
+	...type === "UPDATE_DOWNLOADED" && metadata.patch_fallback === true ? { patchFallback: true } : {},
+	...type === "UNCHANGED" && metadata.change !== void 0 ? { change: {
+		kinds: metadata.change.kinds,
+		...metadata.change.previous === null ? {} : { previous: {
+			bundleId: metadata.change.previous.bundle_id,
+			releaseId: metadata.change.previous.release_id,
+			appVersion: metadata.change.previous.app_version,
+			channel: metadata.change.previous.channel,
+			...metadata.change.previous.min_bundle_id === void 0 ? {} : { minBundleId: metadata.change.previous.min_bundle_id }
+		} }
+	} } : {},
+	...metadata.late === true ? { late: true } : {},
+	...metadata.implied_download === true ? { impliedDownload: true } : {}
 });
-/**
-* Stored events by outcome and the bundle a bundle filter matches, a row an
-* hour, which a failed check has none of; and every stored event, a row a UTC
-* day (`DAILY_EVENTS`). Bundle counts sum the hourly rows, and event lists
-* read either to skip days without events.
-*/
-const insightsOutcomes = (retention) => defineAggregate({
-	platform: {
-		type: "string",
-		maxLength: 16
-	},
-	channel: { type: "string" },
-	type: {
-		type: "string",
-		maxLength: 32
-	},
-	bundle_ref: {
-		type: "string",
-		maxLength: 41
-	},
-	bucket_start_ms: { type: "integer" }
-}, {
-	key: [
-		"platform",
-		"channel",
-		"type",
-		"bundle_ref",
-		"bucket_start_ms"
-	],
-	counters: ["events"],
-	shards: COUNTER_SHARDS,
-	batched: true,
-	indexes: { byRef: {
-		eq: [
-			"platform",
-			"channel",
-			"type",
-			"bundle_ref"
-		],
-		sort: ["bucket_start_ms"]
-	} },
-	retention
+const toEventHistoryRow = (row) => ({
+	...row.to_release_id == null ? {} : { toReleaseId: row.to_release_id },
+	...row.metadata.sdk_version == null ? {} : { sdkVersion: row.metadata.sdk_version },
+	...row.metadata.min_bundle_id === void 0 ? {} : { minBundleId: row.metadata.min_bundle_id },
+	appVersion: row.app_version,
+	channel: row.channel,
+	cohort: row.metadata.cohort,
+	fromBundleId: row.from_bundle_id,
+	id: row.id,
+	installId: row.install_id,
+	platform: row.platform,
+	receivedAtMs: row.received_at_ms,
+	toBundleId: row.to_bundle_id,
+	type: row.type,
+	userId: row.user_id,
+	...eventDetails(row)
+});
+const toInstallationRow = (row) => ({
+	...eventDetails(row).httpResponse ? { httpResponse: eventDetails(row).httpResponse } : {},
+	...row.metadata.min_bundle_id === void 0 ? {} : { minBundleId: row.metadata.min_bundle_id },
+	appVersion: row.app_version,
+	channel: row.channel,
+	cohort: row.metadata.cohort,
+	installId: row.install_id,
+	lastKnownBundleId: row.type === "UPDATE_DOWNLOADED" ? row.from_bundle_id : row.to_bundle_id,
+	pendingBundleId: row.type === "UPDATE_DOWNLOADED" ? row.to_bundle_id : null,
+	pendingReleaseId: row.type === "UPDATE_DOWNLOADED" ? row.to_release_id : null,
+	latestStatus: row.type,
+	platform: row.platform,
+	receivedAtMs: row.received_at_ms,
+	userId: row.user_id
 });
 /**
-* The `insights_outcomes` identity that counts every stored event, for the
-* global event list. Its bucket is a UTC day, not an hour. Every event's
-* platform is ios or android, so no outcome row of a bundle filter shares it.
+* Where a list without `sinceMs` starts: 90 days before its cutoff for the
+* global and bundle lists, at the first event for installation history.
 */
-const DAILY_EVENTS = {
-	platform: "*",
-	channel: "",
-	type: "",
-	bundle_ref: ""
+const defaultEventStart = (filter, beforeReceivedAtMs) => filter.kind === "installationMovement" ? 0 : Math.max(0, beforeReceivedAtMs - EVENT_LIST_RANGE_MS);
+/** Whether a cursor's row lies inside the list's range. */
+const isInsideBounds = ({ after }, bounds) => after.receivedAtMs >= bounds.sinceMs && after.receivedAtMs < bounds.beforeReceivedAtMs;
+/** A page's range: its cursor's, which the request may repeat but not change. */
+const readEventBounds = (input, cursor, filter) => {
+	const beforeReceivedAtMs = cursor?.beforeReceivedAtMs ?? (input.beforeReceivedAtMs === void 0 ? Date.now() : requireTimestamp(input.beforeReceivedAtMs, "event cutoff"));
+	if (cursor !== void 0 && input.beforeReceivedAtMs !== void 0 && input.beforeReceivedAtMs !== beforeReceivedAtMs) throw new InsightsBadRequestError("Insights cursor does not match the requested event cutoff.");
+	const sinceMs = cursor?.sinceMs ?? (input.sinceMs === void 0 ? defaultEventStart(filter, beforeReceivedAtMs) : requireTimestamp(input.sinceMs, "event start"));
+	const bounds = {
+		beforeReceivedAtMs,
+		sinceMs
+	};
+	if (sinceMs > beforeReceivedAtMs || input.sinceMs !== void 0 && input.sinceMs !== sinceMs || cursor !== void 0 && !isInsideBounds(cursor, bounds)) throw new InsightsBadRequestError("Insights cursor or range does not match the requested event start.");
+	if (filter.kind !== "installationMovement" && beforeReceivedAtMs - sinceMs > 7776e6) throw new InsightsBadRequestError("Insights event lists cover at most 90 days: send a sinceMs no more than 90 days before beforeReceivedAtMs.");
+	return bounds;
 };
-/**
-* Insights' tables, each expiring after its period. The periods are values
-* the engine applies at runtime; the tables and indexes are the same for
-* any periods.
-*/
-const createInsightsSchema = ({ rawDays, dailyDays } = DEFAULT_INSIGHTS_RETENTION) => {
-	const hourly = bucketRetention(rawDays);
-	const daily = bucketRetention(dailyDays);
+const pageEventRows = async (model, input, filter, map) => {
+	const limit = readLimit(input.limit);
+	const cursor = input.cursor === void 0 ? void 0 : readEventCursor(input.cursor, filter);
+	const bounds = readEventBounds(input, cursor, filter);
+	const query = {
+		filter,
+		...bounds,
+		...cursor === void 0 ? {} : { after: cursor.after },
+		limit
+	};
+	const rows = await model.listEvents(query);
+	assertEventRows(rows, query);
+	const last = rows.at(-1);
 	return {
-		bundle_events: bundleEvents(rawDays),
-		bundle_event_heads: bundleEventHeads(dailyDays),
-		/** Hourly counters and sketches: the raw period. */
-		insights_overview: counters(hourly),
-		insights_sketches: sketches(hourly),
-		/** Daily counters and sketches: the daily period. */
-		insights_overview_daily: counters(daily),
-		insights_sketches_daily: sketches(daily),
-		/** A release's counters since its first event, and its failed installations: kept. */
-		insights_overview_lifetime: lifetimeCounters(),
-		insights_sketches_lifetime: lifetimeSketches(),
-		insights_distribution: insightsDistribution(daily),
-		insights_builtin_distribution: insightsBuiltinDistribution(daily),
-		insights_latest_by_bundle: insightsLatestByBundle(daily),
-		insights_outcomes: insightsOutcomes(hourly),
-		insights_failures: insightsFailures(hourly)
+		beforeReceivedAtMs: bounds.beforeReceivedAtMs,
+		data: rows.map(map),
+		nextCursor: rows.length === limit && last ? encodeCursor({
+			after: {
+				id: last.id,
+				receivedAtMs: last.received_at_ms
+			},
+			...bounds,
+			kind: "events",
+			filter,
+			version: 2
+		}) : null
 	};
 };
-createInsightsSchema();
+const assertInstallationRows = (rows, input) => {
+	if (rows.length > input.limit) throw new Error("Insights database returned too many installation rows.");
+	for (let index = 0; index < rows.length; index += 1) {
+		const row = rows[index];
+		const previous = rows[index - 1];
+		if (!row || row.user_id !== input.userId || input.afterInstallId !== void 0 && compareInsightsText(row.install_id, input.afterInstallId) <= 0 || previous !== void 0 && compareInsightsText(previous.install_id, row.install_id) >= 0) throw new Error("Insights database returned invalid installation rows.");
+	}
+};
+const createInsightsProvider = (model) => Object.freeze({
+	async appendBundleEvent(input) {
+		const event = createBundleEventRow(input);
+		await model.recordEvent({ event });
+	},
+	listEvents(input) {
+		const filter = input.bundle === void 0 ? { kind: "all" } : {
+			kind: "bundle",
+			...bundleFilter(input.bundle)
+		};
+		return pageEventRows(model, input, filter, toEventHistoryRow);
+	},
+	async listInstallationEvents(input) {
+		if ("bundle" in input && input.bundle !== void 0) throw new InsightsBadRequestError("Installation movement queries cannot include a bundle filter.");
+		const installId = requireString(input.installId, "install ID", MAX_IDENTITY_LENGTH$1);
+		return pageEventRows(model, input, {
+			kind: "installationMovement",
+			installId
+		}, (row) => toEventHistoryRow(row));
+	},
+	async getInstallation({ installId }) {
+		const normalizedInstallId = requireString(installId, "install ID", MAX_IDENTITY_LENGTH$1);
+		const rows = await model.findLatestEvents({ installId: normalizedInstallId });
+		const row = rows[0] ?? null;
+		if (rows.length > 1 || row !== null && row.install_id !== normalizedInstallId) throw new Error("Insights database returned an invalid installation.");
+		return row === null ? null : toInstallationRow(row);
+	},
+	async pageInstallationsByCurrentUserId(input) {
+		const userId = requireString(input.userId, "user ID", MAX_IDENTITY_LENGTH$1);
+		const limit = readLimit(input.limit);
+		const cursor = input.cursor === void 0 ? void 0 : readUserInstallationCursor(input.cursor, userId);
+		const databaseInput = {
+			userId,
+			...cursor === void 0 ? {} : { afterInstallId: cursor.afterInstallId },
+			limit
+		};
+		const rows = await model.findLatestEvents(databaseInput);
+		assertInstallationRows(rows, databaseInput);
+		const last = rows.at(-1);
+		return {
+			data: rows.map(toInstallationRow),
+			nextCursor: rows.length === limit && last ? encodeCursor({
+				afterInstallId: last.install_id,
+				kind: "user-installations",
+				userId,
+				version: 1
+			}) : null
+		};
+	},
+	async getReportingOverview(input) {
+		const scope = readScope$1(input);
+		const { window } = input;
+		if (!Object.hasOwn(WINDOW_MS, window)) throw new InsightsBadRequestError("Invalid reporting installation window.");
+		const now = Date.now();
+		const beforeReceivedAtMs = now - now % HOUR_MS + (now % HOUR_MS === 0 ? 0 : HOUR_MS);
+		const reach = Math.max(0, beforeReceivedAtMs - WINDOW_MS[window]);
+		const sinceMs = reach - reach % DAY_MS;
+		const measure = async (count) => {
+			const value = await count;
+			if (!Number.isSafeInteger(value) || value < 0) throw new Error("Insights database returned an invalid count.");
+			return {
+				count: value,
+				measuredAtMs: Date.now()
+			};
+		};
+		const bundleId = input.bundleId === void 0 ? void 0 : requireString(input.bundleId, "bundle ID", MAX_EVENT_ID_LENGTH);
+		const reporting = measure(model.countLatestEvents({
+			...scope,
+			sinceMs
+		}));
+		if (bundleId === void 0) return {
+			...scope,
+			window,
+			sinceMs,
+			beforeReceivedAtMs,
+			reportingInstallations: await reporting
+		};
+		const countOutcome = (outcome) => measure(model.countEvents({
+			filter: bundleFilter({
+				...scope,
+				bundleId,
+				outcome
+			}),
+			sinceMs,
+			beforeReceivedAtMs
+		}));
+		const [reportingInstallations, bundleInstallations, downloadedReports, appliedReports, recoveredReports, failedReports] = await Promise.all([
+			reporting,
+			measure(model.countLatestEvents({
+				...scope,
+				sinceMs,
+				bundle: [{
+					field: "from_bundle_id",
+					value: bundleId,
+					types: ["UPDATE_DOWNLOADED"]
+				}, {
+					field: "to_bundle_id",
+					value: bundleId,
+					types: [
+						"UNCHANGED",
+						"UPDATE_APPLIED",
+						"RECOVERED"
+					]
+				}]
+			})),
+			countOutcome("downloaded"),
+			countOutcome("applied"),
+			countOutcome("recovered"),
+			countOutcome("failed")
+		]);
+		return {
+			...scope,
+			window,
+			sinceMs,
+			beforeReceivedAtMs,
+			reportingInstallations,
+			bundle: {
+				bundleId,
+				reportingInstallations: bundleInstallations,
+				downloadedReports,
+				appliedReports,
+				recoveredReports,
+				failedReports
+			}
+		};
+	}
+});
 //#endregion
 //#region ../insights/dist/server/overview.mjs
 const encodeIdentity = (identity) => [
@@ -9245,18 +9302,19 @@ const insightsOverviewDeltas = (event) => {
 			bucketStartMs
 		}, windowed);
 	};
-	if (event.type === "UPDATE_DOWNLOADED") metric(event.to_release_id, {
+	const implied = event.metadata.implied_download === true ? 1 : 0;
+	if (!isLateEvent(event) && event.type === "UPDATE_DOWNLOADED") metric(event.to_release_id, {
 		downloads: 1,
 		applies: 0,
 		failedLaunches: 0
 	});
-	else if (event.type === "UPDATE_APPLIED") metric(event.to_release_id, {
-		downloads: 0,
+	else if (!isLateEvent(event) && isLaunch(event)) metric(event.to_release_id, {
+		downloads: implied,
 		applies: 1,
 		failedLaunches: 0
 	});
-	else if (event.type === "RECOVERED") metric(event.from_release_id, {
-		downloads: 0,
+	else if (!isLateEvent(event) && event.type === "RECOVERED") metric(event.from_release_id, {
+		downloads: implied,
 		applies: 0,
 		failedLaunches: 1
 	});
@@ -9280,8 +9338,8 @@ const insightsOverviewDeltas = (event) => {
 };
 //#endregion
 //#region ../insights/dist/server/recordEvent.mjs
-const hourOf = (ms) => ms - ms % HOUR_MS;
-const dayOf = (ms) => ms - ms % DAY_MS;
+const hourOf = (ms) => ms - ms % HOUR_MS$1;
+const dayOf = (ms) => ms - ms % DAY_MS$1;
 /** The `identity` of an overview or sketch row: its scope and period, hashed. */
 const insightsIdentity = (identity) => insightsOverviewId({
 	...identity,
@@ -9412,16 +9470,16 @@ const countEvent = (tx, event) => {
 	}
 };
 /**
-* A stored event's outcome rows: its bundle filter's hour, which a failed
-* check has none of, and every stored event's UTC day.
+* A stored event's outcome rows: its bundle filter's hour, when it has one
+* (`bundleRefsOf`), and every stored event's UTC day.
 */
 const countOutcome = (tx, event) => {
 	const shardBy = event.install_id;
-	if (!isFailedCheck(event)) tx.aggregate("insights_outcomes", {
+	for (const bundleRef of bundleRefsOf(event)) tx.aggregate("insights_outcomes", {
 		platform: event.platform,
 		channel: event.channel,
 		type: event.type,
-		bundle_ref: event.type === "RECOVERED" ? `from:${event.from_bundle_id}` : `to:${event.to_bundle_id}`,
+		bundle_ref: bundleRef,
 		bucket_start_ms: hourOf(event.received_at_ms)
 	}, { events: 1 }, { shardBy });
 	tx.aggregate("insights_outcomes", {
@@ -9525,6 +9583,126 @@ const countFailure = (tx, event) => {
 	}, { events: 1 }, { shardBy });
 };
 const isNewer = (event, head) => event.received_at_ms !== head.received_at_ms ? event.received_at_ms > head.received_at_ms : compareUtf8(event.id, head.id) > 0;
+/** What a head says its installation runs: a download leaves it at the source. */
+const runningOf = (head) => head.type === "UPDATE_DOWNLOADED" ? {
+	bundle_id: head.from_bundle_id,
+	release_id: head.from_release_id
+} : {
+	bundle_id: head.to_bundle_id,
+	release_id: head.to_release_id
+};
+/** The native build a report or head came from, when its SDK says. */
+const minBundleIdOf = (row) => row.metadata?.min_bundle_id;
+/** When the client made a report, from the UUIDv7 it gave it. */
+const madeAt = (id) => isUUIDv7(id) ? extractTimestampFromUUIDv7(id) : null;
+/**
+* A report that arrived after its installation moved past it: a download or
+* an apply of the bundle the head already runs, or an UNCHANGED report of the
+* bundle an apply head left, made before that apply. A reload can cut one
+* runtime's report short and deliver it after the next runtime's. It stays
+* in history but moves and counts nothing.
+*/
+const isLate = (event, head) => {
+	if (head === null) return false;
+	if (event.type === "UPDATE_DOWNLOADED" || event.type === "UPDATE_APPLIED") return event.to_bundle_id === runningOf(head).bundle_id;
+	if (event.type === "UNCHANGED" && head.type === "UPDATE_APPLIED" && event.to_bundle_id === head.from_bundle_id) {
+		const made = madeAt(event.id);
+		const applied = madeAt(head.id);
+		return made !== null && applied !== null && made < applied;
+	}
+	return false;
+};
+/**
+* What an UNCHANGED report changes against its installation's head: the
+* running bundle or release, the app version, the channel, or the native
+* build (when both name it), with the head's values before it; `first_seen`
+* when the installation has no head. A report the head already answers, one
+* older than the head, a user switch and any other event type change
+* nothing, so no row keeps them.
+*/
+const changeOf = (event, head) => {
+	if (event.type !== "UNCHANGED") return null;
+	if (head === null) return {
+		kinds: ["first_seen"],
+		previous: null
+	};
+	if (!isNewer(event, head)) return null;
+	const running = runningOf(head);
+	const build = minBundleIdOf(event);
+	const headBuild = minBundleIdOf(head);
+	const kinds = [];
+	if (event.to_bundle_id !== running.bundle_id) kinds.push("bundle");
+	if (event.to_release_id !== running.release_id) kinds.push("release");
+	if (event.app_version !== head.app_version) kinds.push("app_version");
+	if (event.channel !== head.channel) kinds.push("channel");
+	if (build !== void 0 && headBuild !== void 0 && build !== headBuild) kinds.push("native_build");
+	return kinds.length === 0 ? null : {
+		kinds,
+		previous: {
+			bundle_id: running.bundle_id,
+			release_id: running.release_id,
+			app_version: head.app_version,
+			channel: head.channel,
+			...headBuild === void 0 ? {} : { min_bundle_id: headBuild }
+		}
+	};
+};
+/**
+* Whether a launch or a crash comes with no download report for its target:
+* its head shows neither that download nor the target already running. The
+* native build's built-in bundle is never downloaded, and without a head the
+* server knows nothing of the installation's past, so it implies nothing.
+*/
+const impliesDownload = (event, head) => {
+	const target = event.type === "RECOVERED" ? {
+		bundle: event.from_bundle_id,
+		release: event.from_release_id
+	} : isLaunch(event) ? {
+		bundle: event.to_bundle_id,
+		release: event.to_release_id
+	} : null;
+	if (target === null || target.release === null || target.bundle === minBundleIdOf(event)) return false;
+	if (head === null) return false;
+	if (head.type === "UPDATE_DOWNLOADED" && head.to_bundle_id === target.bundle) return false;
+	return runningOf(head).bundle_id !== target.bundle;
+};
+/**
+* The event as recorded, with what only the server sets: what a kept
+* UNCHANGED report changed, a late report's flag, and a download its launch
+* or crash implied.
+*/
+const recordedOf = (event, head) => {
+	const { change: _change, late: _late, implied_download: _implied, ...metadata } = event.metadata;
+	const reported = {
+		...event,
+		metadata
+	};
+	const late = isLate(reported, head);
+	const change = late ? null : changeOf(reported, head);
+	const withChange = change === null ? reported : {
+		...reported,
+		metadata: {
+			...metadata,
+			change
+		}
+	};
+	return {
+		recorded: late && reported.type !== "UNCHANGED" ? {
+			...reported,
+			metadata: {
+				...metadata,
+				late: true
+			}
+		} : !late && impliesDownload(withChange, head) ? {
+			...withChange,
+			metadata: {
+				...withChange.metadata,
+				implied_download: true
+			}
+		} : withChange,
+		late
+	};
+};
 /** What an UNCHANGED report must share with its installation's head to repeat it. */
 const REPEATED_FIELDS = [
 	"channel",
@@ -9559,32 +9737,33 @@ const recordEvent = (db, event) => {
 		const [existing, previous] = await Promise.all([tx.findOne("bundle_events", { id: event.id }), tx.findOne("bundle_event_heads", { install_id: event.install_id })]);
 		if (existing !== null || previous?.id === event.id) return;
 		if (previous !== null && repeatsHead(event, previous)) return;
-		if (event.type !== "UNCHANGED") {
-			tx.create("bundle_events", event);
-			countOutcome(tx, event);
+		const { recorded, late } = recordedOf(event, previous);
+		if (recorded.type !== "UNCHANGED" || recorded.metadata.change !== void 0 && !late) {
+			tx.create("bundle_events", recorded);
+			countOutcome(tx, recorded);
 		}
-		if (event.type === "UPDATE_FAILED") {
-			countFailure(tx, event);
+		if (recorded.type === "UPDATE_FAILED") {
+			countFailure(tx, recorded);
 			return;
 		}
-		countEvent(tx, event);
-		if (previous !== null && !isNewer(event, previous)) return;
-		if (previous === null) tx.create("bundle_event_heads", event);
+		countEvent(tx, recorded);
+		if (previous !== null && (late || !isNewer(recorded, previous))) return;
+		if (previous === null) tx.create("bundle_event_heads", recorded);
 		else {
-			const { install_id: _, ...fields } = event;
+			const { install_id: _, ...fields } = recorded;
 			countHead(tx, previous, -1);
 			tx.update("bundle_event_heads", previous, fields);
 		}
-		countHead(tx, event, 1);
+		countHead(tx, recorded, 1);
 	});
 };
 //#endregion
 //#region ../insights/dist/server/reads.mjs
 const PAGE = 500;
-const hourFloor = (ms) => ms - ms % HOUR_MS;
-const hourCeil = (ms) => hourFloor(ms + HOUR_MS - 1);
-const dayFloor = (ms) => ms - ms % DAY_MS;
-const dayCeil = (ms) => dayFloor(ms + DAY_MS - 1);
+const hourFloor = (ms) => ms - ms % HOUR_MS$1;
+const hourCeil = (ms) => hourFloor(ms + HOUR_MS$1 - 1);
+const dayFloor = (ms) => ms - ms % DAY_MS$1;
+const dayCeil = (ms) => dayFloor(ms + DAY_MS$1 - 1);
 /** Every page of one read, in order. */
 const drain = async (read) => {
 	const rows = [];
@@ -9613,12 +9792,11 @@ const EVENT_FIELDS = [
 ];
 /** A stored event or head, as the event row it holds. */
 const toEvent = (row) => Object.fromEntries(EVENT_FIELDS.map((field) => [field, row[field]]));
-const bundleRef = (filter) => filter.type === "RECOVERED" ? `from:${filter.fromBundleId}` : `to:${filter.toBundleId}`;
 const scopeOf = (filter) => ({
 	platform: filter.platform,
 	channel: filter.channel,
 	type: filter.type,
-	bundle_ref: bundleRef(filter)
+	bundle_ref: bundleRefOfFilter(filter)
 });
 /** One UTC day of a global or bundle list, newest first. */
 const eventsOfDay = (db, filter, day, range, limit) => filter.kind === "all" ? db.findMany("bundle_events", {
@@ -9691,7 +9869,7 @@ const listEvents = async (db, input) => {
 	while (day !== void 0 && day >= bottom && rows.length < limit) {
 		const page = await eventsOfDay(db, filter, day, range, limit - rows.length);
 		rows.push(...page.rows.map(toEvent));
-		day = page.rows.length > 0 ? day - DAY_MS : day > bottom ? await newestDayBelow(db, filter, day, since) : void 0;
+		day = page.rows.length > 0 ? day - DAY_MS$1 : day > bottom ? await newestDayBelow(db, filter, day, since) : void 0;
 	}
 	return rows;
 };
@@ -9712,7 +9890,7 @@ const findLatestEvents = async (db, input) => {
 /** Raw events of one bundle filter over [from, to), which spans at most two partial hours. */
 const countRaw = async (db, filter, from, to) => {
 	let total = 0;
-	for (let day = dayFloor(from); from < to && day < to; day += DAY_MS) {
+	for (let day = dayFloor(from); from < to && day < to; day += DAY_MS$1) {
 		const rows = await drain((page) => db.findMany("bundle_events", {
 			index: "byBundle",
 			where: {
@@ -9836,8 +10014,8 @@ const countLatestEvents = async (db, input) => {
 };
 /** The oldest whole hour and UTC day that hourly and daily rows still hold. */
 const retained = (now, { rawDays, dailyDays }) => ({
-	hour: hourCeil(now - rawDays * DAY_MS),
-	day: dayCeil(now - dailyDays * DAY_MS)
+	hour: hourCeil(now - rawDays * DAY_MS$1),
+	day: dayCeil(now - dailyDays * DAY_MS$1)
 });
 /**
 * Whether the rows a window reads still hold all of it; an older start is
@@ -10077,7 +10255,7 @@ const getAppUsage = async (db, input, now, retention) => {
 	};
 };
 /** The longest period the failures read covers: the console's longest, 30 days. */
-const UPDATE_FAILURES_RANGE_MS = 30 * DAY_MS;
+const UPDATE_FAILURES_RANGE_MS = 30 * DAY_MS$1;
 const isRange = (range) => range === void 0 || Number.isSafeInteger(range.start) && Number.isSafeInteger(range.end) && range.start >= 0 && range.start < range.end && range.end - range.start <= UPDATE_FAILURES_RANGE_MS;
 const isText = (value, maxLength) => typeof value === "string" && value.length > 0 && value.length <= maxLength;
 const failed = (...rows) => countDistinct(mergeDistinct(rows.flat().map((row) => row.failed_users)));