@hot-updater/server 1.0.0-rc.0 → 1.0.0-rc.14

package/dist/insights/provider.mjs

@@ -0,0 +1,332 @@
+import { InsightsBadRequestError } from "./errors.mjs";
+import { createBundleEventRow } from "./eventInput.mjs";
+import { compareInsightsText, isInsightsMovementEvent, isUUIDv7 } from "@hot-updater/plugin-core";
+//#region src/insights/provider.ts
+const DEFAULT_PAGE_LIMIT = 50;
+const MAX_PAGE_LIMIT = 100;
+const MAX_EVENT_ID_LENGTH = 1024;
+const MAX_IDENTITY_LENGTH = 255;
+const MAX_CURSOR_LENGTH = 8192;
+const WINDOW_MS = {
+	"24h": 864e5,
+	"7d": 6048e5,
+	"30d": 2592e6
+};
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const requireString = (value, label, maximumLength) => {
+	if (typeof value !== "string" || value.length === 0 || value.length > maximumLength || new TextDecoder("utf-8", { ignoreBOM: true }).decode(new TextEncoder().encode(value)) !== value) throw new InsightsBadRequestError(`Invalid ${label}.`);
+	return value;
+};
+const requireTimestamp = (value, label) => {
+	if (!Number.isSafeInteger(value) || Number(value) < 0) throw new InsightsBadRequestError(`Invalid ${label}.`);
+	return Number(value);
+};
+const readLimit = (value) => {
+	const limit = value ?? DEFAULT_PAGE_LIMIT;
+	if (!Number.isSafeInteger(limit) || limit < 1 || limit > MAX_PAGE_LIMIT) throw new InsightsBadRequestError("Invalid page limit.");
+	return limit;
+};
+const encodeBase64Url = (value) => {
+	const bytes = new TextEncoder().encode(value);
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
+};
+const decodeBase64Url = (value) => {
+	if (value.length === 0 || value.length > MAX_CURSOR_LENGTH) throw new InsightsBadRequestError("Invalid Insights cursor.");
+	try {
+		const base64 = value.replaceAll("-", "+").replaceAll("_", "/");
+		const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, "=");
+		const binary = atob(padded);
+		const bytes = Uint8Array.from(binary, (character) => character.charCodeAt(0));
+		return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+	} catch {
+		throw new InsightsBadRequestError("Invalid Insights cursor.");
+	}
+};
+const encodeCursor = (value) => encodeBase64Url(JSON.stringify(value));
+const decodeCursor = (value) => {
+	try {
+		return JSON.parse(decodeBase64Url(value));
+	} catch (error) {
+		if (error instanceof InsightsBadRequestError) throw error;
+		throw new InsightsBadRequestError("Invalid Insights cursor.");
+	}
+};
+const readScope = (input) => {
+	if (input.platform !== "ios" && input.platform !== "android") throw new InsightsBadRequestError("Invalid Insights platform.");
+	return {
+		platform: input.platform,
+		channel: requireString(input.channel, "channel", MAX_EVENT_ID_LENGTH)
+	};
+};
+const bundleFilter = (input) => {
+	const scope = readScope(input);
+	const bundleId = requireString(input.bundleId, "bundle ID", MAX_EVENT_ID_LENGTH);
+	switch (input.outcome) {
+		case "downloaded": return {
+			...scope,
+			type: "UPDATE_DOWNLOADED",
+			toBundleId: bundleId
+		};
+		case "applied": return {
+			...scope,
+			type: "UPDATE_APPLIED",
+			toBundleId: bundleId
+		};
+		case "recovered": return {
+			...scope,
+			type: "RECOVERED",
+			fromBundleId: bundleId
+		};
+		case "unchanged": return {
+			...scope,
+			type: "UNCHANGED",
+			toBundleId: bundleId
+		};
+		default: throw new InsightsBadRequestError("Invalid Insights outcome.");
+	}
+};
+const sameFilter = (left, right) => {
+	if (!isRecord(left) || left.kind !== right.kind) return false;
+	switch (right.kind) {
+		case "all": return true;
+		case "installationMovement": return left.installId === right.installId;
+		case "bundle": return left.platform === right.platform && left.channel === right.channel && left.type === right.type && (right.type === "RECOVERED" ? left.fromBundleId === right.fromBundleId : left.toBundleId === right.toBundleId);
+	}
+};
+const readEventCursor = (value, filter) => {
+	const cursor = decodeCursor(value);
+	if (!isRecord(cursor) || cursor.version !== 2 || cursor.kind !== "events" || !isRecord(cursor.filter) || !isRecord(cursor.after)) throw new InsightsBadRequestError("Invalid Insights cursor.");
+	if (!sameFilter(cursor.filter, filter)) throw new InsightsBadRequestError("Insights cursor does not match the requested events.");
+	if (typeof cursor.after.id !== "string" || !isUUIDv7(cursor.after.id)) throw new InsightsBadRequestError("Invalid Insights event cursor ID.");
+	return {
+		after: {
+			id: cursor.after.id,
+			receivedAtMs: requireTimestamp(cursor.after.receivedAtMs, "event cursor")
+		},
+		beforeReceivedAtMs: requireTimestamp(cursor.beforeReceivedAtMs, "event cutoff"),
+		kind: "events",
+		sinceMs: requireTimestamp(cursor.sinceMs, "event start"),
+		filter,
+		version: 2
+	};
+};
+const readUserInstallationCursor = (value, userId) => {
+	const cursor = decodeCursor(value);
+	if (!isRecord(cursor) || cursor.version !== 1 || cursor.kind !== "user-installations" || cursor.userId !== userId) throw new InsightsBadRequestError("Insights cursor does not match the requested user ID.");
+	return {
+		afterInstallId: requireString(cursor.afterInstallId, "installation cursor", MAX_IDENTITY_LENGTH),
+		kind: "user-installations",
+		userId,
+		version: 1
+	};
+};
+const compareEventNewest = (left, right) => right.received_at_ms - left.received_at_ms || compareInsightsText(right.id, left.id);
+const isAfterEventCursor = (row, after) => row.received_at_ms < after.receivedAtMs || row.received_at_ms === after.receivedAtMs && compareInsightsText(row.id, after.id) < 0;
+const assertEventRows = (rows, input) => {
+	if (rows.length > input.limit) throw new Error("Insights database returned too many event rows.");
+	for (let index = 0; index < rows.length; index += 1) {
+		const row = rows[index];
+		const previous = rows[index - 1];
+		if (!row || typeof row.id !== "string" || !isUUIDv7(row.id) || !Number.isSafeInteger(row.received_at_ms) || row.received_at_ms >= input.beforeReceivedAtMs || row.received_at_ms < input.sinceMs || previous !== void 0 && compareEventNewest(previous, row) >= 0 || input.after !== void 0 && !isAfterEventCursor(row, input.after) || input.filter.kind === "installationMovement" && (row.install_id !== input.filter.installId || !isInsightsMovementEvent(row)) || input.filter.kind === "bundle" && (row.platform !== input.filter.platform || row.channel !== input.filter.channel || row.type !== input.filter.type || (input.filter.type === "RECOVERED" ? row.from_bundle_id !== input.filter.fromBundleId : row.to_bundle_id !== input.filter.toBundleId))) throw new Error("Insights database returned invalid event rows.");
+	}
+};
+const toEventHistoryRow = (row) => ({
+	appVersion: row.app_version,
+	channel: row.channel,
+	cohort: row.metadata.cohort,
+	fromBundleId: row.from_bundle_id,
+	id: row.id,
+	installId: row.install_id,
+	platform: row.platform,
+	receivedAtMs: row.received_at_ms,
+	toBundleId: row.to_bundle_id,
+	type: row.type,
+	userId: row.user_id,
+	username: row.metadata.username
+});
+const toInstallationRow = (row) => ({
+	appVersion: row.app_version,
+	channel: row.channel,
+	cohort: row.metadata.cohort,
+	installId: row.install_id,
+	lastKnownBundleId: row.type === "UPDATE_DOWNLOADED" ? row.from_bundle_id : row.to_bundle_id,
+	pendingBundleId: row.type === "UPDATE_DOWNLOADED" ? row.to_bundle_id : null,
+	pendingReleaseId: row.type === "UPDATE_DOWNLOADED" ? row.to_release_id : null,
+	latestStatus: row.type,
+	platform: row.platform,
+	receivedAtMs: row.received_at_ms,
+	userId: row.user_id,
+	username: row.metadata.username
+});
+const pageEventRows = async (model, input, filter, map) => {
+	const limit = readLimit(input.limit);
+	const cursor = input.cursor === void 0 ? void 0 : readEventCursor(input.cursor, filter);
+	const beforeReceivedAtMs = cursor?.beforeReceivedAtMs ?? (input.beforeReceivedAtMs === void 0 ? Date.now() : requireTimestamp(input.beforeReceivedAtMs, "event cutoff"));
+	if (cursor !== void 0 && input.beforeReceivedAtMs !== void 0 && input.beforeReceivedAtMs !== beforeReceivedAtMs) throw new InsightsBadRequestError("Insights cursor does not match the requested event cutoff.");
+	const sinceMs = cursor?.sinceMs ?? (input.sinceMs === void 0 ? 0 : requireTimestamp(input.sinceMs, "event start"));
+	if (sinceMs > beforeReceivedAtMs || input.sinceMs !== void 0 && input.sinceMs !== sinceMs || cursor !== void 0 && (cursor.after.receivedAtMs < sinceMs || cursor.after.receivedAtMs >= beforeReceivedAtMs)) throw new InsightsBadRequestError("Insights cursor or range does not match the requested event start.");
+	const databaseInput = {
+		filter,
+		sinceMs,
+		beforeReceivedAtMs,
+		...cursor === void 0 ? {} : { after: cursor.after },
+		limit: limit + 1
+	};
+	const rows = await model.listEvents(databaseInput);
+	assertEventRows(rows, databaseInput);
+	const pageRows = rows.slice(0, limit);
+	const last = pageRows.at(-1);
+	return {
+		beforeReceivedAtMs,
+		data: pageRows.map(map),
+		nextCursor: rows.length > limit && last ? encodeCursor({
+			after: {
+				id: last.id,
+				receivedAtMs: last.received_at_ms
+			},
+			beforeReceivedAtMs,
+			kind: "events",
+			filter,
+			sinceMs,
+			version: 2
+		}) : null
+	};
+};
+const assertInstallationRows = (rows, input) => {
+	if (rows.length > input.limit) throw new Error("Insights database returned too many installation rows.");
+	for (let index = 0; index < rows.length; index += 1) {
+		const row = rows[index];
+		const previous = rows[index - 1];
+		if (!row || row.user_id !== input.userId || input.afterInstallId !== void 0 && compareInsightsText(row.install_id, input.afterInstallId) <= 0 || previous !== void 0 && compareInsightsText(previous.install_id, row.install_id) >= 0) throw new Error("Insights database returned invalid installation rows.");
+	}
+};
+const createInsightsProvider = (model) => Object.freeze({
+	async appendBundleEvent(input) {
+		const event = createBundleEventRow(input);
+		await model.recordEvent({ event });
+	},
+	listEvents(input) {
+		const filter = input.bundle === void 0 ? { kind: "all" } : {
+			kind: "bundle",
+			...bundleFilter(input.bundle)
+		};
+		return pageEventRows(model, input, filter, toEventHistoryRow);
+	},
+	async listInstallationEvents(input) {
+		if ("bundle" in input && input.bundle !== void 0) throw new InsightsBadRequestError("Installation movement queries cannot include a bundle filter.");
+		const installId = requireString(input.installId, "install ID", MAX_IDENTITY_LENGTH);
+		return pageEventRows(model, input, {
+			kind: "installationMovement",
+			installId
+		}, (row) => toEventHistoryRow(row));
+	},
+	async getInstallation({ installId }) {
+		const normalizedInstallId = requireString(installId, "install ID", MAX_IDENTITY_LENGTH);
+		const rows = await model.findLatestEvents({ installId: normalizedInstallId });
+		const row = rows[0] ?? null;
+		if (rows.length > 1 || row !== null && row.install_id !== normalizedInstallId) throw new Error("Insights database returned an invalid installation.");
+		return row === null ? null : toInstallationRow(row);
+	},
+	async pageInstallationsByCurrentUserId(input) {
+		const userId = requireString(input.userId, "user ID", MAX_IDENTITY_LENGTH);
+		const limit = readLimit(input.limit);
+		const cursor = input.cursor === void 0 ? void 0 : readUserInstallationCursor(input.cursor, userId);
+		const databaseInput = {
+			userId,
+			...cursor === void 0 ? {} : { afterInstallId: cursor.afterInstallId },
+			limit: limit + 1
+		};
+		const rows = await model.findLatestEvents(databaseInput);
+		assertInstallationRows(rows, databaseInput);
+		const pageRows = rows.slice(0, limit);
+		const last = pageRows.at(-1);
+		return {
+			data: pageRows.map(toInstallationRow),
+			nextCursor: rows.length > limit && last ? encodeCursor({
+				afterInstallId: last.install_id,
+				kind: "user-installations",
+				userId,
+				version: 1
+			}) : null
+		};
+	},
+	async getReportingOverview(input) {
+		const scope = readScope(input);
+		const { window } = input;
+		if (!Object.hasOwn(WINDOW_MS, window)) throw new InsightsBadRequestError("Invalid reporting installation window.");
+		const beforeReceivedAtMs = Date.now();
+		const sinceMs = Math.max(0, beforeReceivedAtMs - WINDOW_MS[window]);
+		const measure = async (count) => {
+			const value = await count;
+			if (!Number.isSafeInteger(value) || value < 0) throw new Error("Insights database returned an invalid count.");
+			return {
+				count: value,
+				measuredAtMs: Date.now()
+			};
+		};
+		const bundleId = input.bundleId === void 0 ? void 0 : requireString(input.bundleId, "bundle ID", MAX_EVENT_ID_LENGTH);
+		const reporting = measure(model.countLatestEvents({
+			...scope,
+			sinceMs
+		}));
+		if (bundleId === void 0) return {
+			...scope,
+			window,
+			sinceMs,
+			beforeReceivedAtMs,
+			reportingInstallations: await reporting
+		};
+		const countOutcome = (outcome) => measure(model.countEvents({
+			filter: bundleFilter({
+				...scope,
+				bundleId,
+				outcome
+			}),
+			sinceMs,
+			beforeReceivedAtMs
+		}));
+		const [reportingInstallations, bundleInstallations, downloadedReports, appliedReports, recoveredReports, unchangedReports] = await Promise.all([
+			reporting,
+			measure(model.countLatestEvents({
+				...scope,
+				sinceMs,
+				bundle: [{
+					field: "from_bundle_id",
+					value: bundleId,
+					types: ["UPDATE_DOWNLOADED"]
+				}, {
+					field: "to_bundle_id",
+					value: bundleId,
+					types: [
+						"UNCHANGED",
+						"UPDATE_APPLIED",
+						"RECOVERED"
+					]
+				}]
+			})),
+			countOutcome("downloaded"),
+			countOutcome("applied"),
+			countOutcome("recovered"),
+			countOutcome("unchanged")
+		]);
+		return {
+			...scope,
+			window,
+			sinceMs,
+			beforeReceivedAtMs,
+			reportingInstallations,
+			bundle: {
+				bundleId,
+				reportingInstallations: bundleInstallations,
+				downloadedReports,
+				appliedReports,
+				recoveredReports,
+				unchangedReports
+			}
+		};
+	}
+});
+//#endregion
+export { createInsightsProvider };

package/dist/insights/queryInput.cjs

@@ -0,0 +1,93 @@
+const require_errors = require("./errors.cjs");
+//#region src/insights/queryInput.ts
+const MAX_PAGE_LIMIT = 100;
+const MAX_IDENTITY_LENGTH = 255;
+const MAX_CURSOR_LENGTH = 8192;
+const readSingle = (url, key) => {
+	const values = url.searchParams.getAll(key);
+	if (values.length > 1) throw new require_errors.InsightsBadRequestError(`Duplicate '${key}' query parameter.`);
+	return values[0];
+};
+const readPageLimit = (url) => {
+	const value = readSingle(url, "limit");
+	if (value === void 0) return void 0;
+	const limit = Number(value);
+	if (!Number.isSafeInteger(limit) || limit < 1 || limit > MAX_PAGE_LIMIT) throw new require_errors.InsightsBadRequestError("Invalid 'limit' query parameter.");
+	return limit;
+};
+const readCursor = (url) => {
+	const cursor = readSingle(url, "cursor");
+	if (cursor !== void 0 && (cursor.length === 0 || cursor.length > MAX_CURSOR_LENGTH)) throw new require_errors.InsightsBadRequestError("Invalid 'cursor' query parameter.");
+	return cursor;
+};
+const readId = (url, key, maximumLength = MAX_IDENTITY_LENGTH) => {
+	const value = readSingle(url, key);
+	if (value === void 0 || value.length === 0 || value.length > maximumLength) throw new require_errors.InsightsBadRequestError(`Invalid '${key}' query parameter.`);
+	return value;
+};
+const readTimestamp = (url, key) => {
+	const raw = readSingle(url, key);
+	if (raw === void 0) return void 0;
+	const value = Number(raw);
+	if (!raw.length || !Number.isSafeInteger(value) || value < 0) throw new require_errors.InsightsBadRequestError(`Invalid '${key}' query parameter.`);
+	return value;
+};
+const readScope = (url) => {
+	const platform = readSingle(url, "platform");
+	if (platform !== "ios" && platform !== "android") throw new require_errors.InsightsBadRequestError("Invalid 'platform' query parameter.");
+	return {
+		platform,
+		channel: readId(url, "channel", 1024)
+	};
+};
+const parseEventPageInput = (request) => {
+	const url = new URL(request.url);
+	const bundleFields = [
+		"bundleId",
+		"outcome",
+		"platform",
+		"channel"
+	];
+	let bundle;
+	if (bundleFields.some((key) => url.searchParams.has(key))) {
+		const outcome = readSingle(url, "outcome");
+		if (outcome !== "downloaded" && outcome !== "applied" && outcome !== "recovered" && outcome !== "unchanged") throw new require_errors.InsightsBadRequestError("Invalid 'outcome' query parameter.");
+		bundle = {
+			...readScope(url),
+			bundleId: readId(url, "bundleId", 1024),
+			outcome
+		};
+	}
+	return {
+		beforeReceivedAtMs: readTimestamp(url, "beforeReceivedAtMs"),
+		sinceMs: readTimestamp(url, "sinceMs"),
+		cursor: readCursor(url),
+		limit: readPageLimit(url),
+		...bundle === void 0 ? {} : { bundle }
+	};
+};
+const parseUserInstallationPageInput = (request) => {
+	const url = new URL(request.url);
+	const cursor = readCursor(url);
+	const limit = readPageLimit(url);
+	return {
+		userId: readId(url, "userId"),
+		...cursor === void 0 ? {} : { cursor },
+		...limit === void 0 ? {} : { limit }
+	};
+};
+const parseReportingOverviewInput = (request) => {
+	const url = new URL(request.url);
+	const window = readSingle(url, "window") ?? "30d";
+	if (window !== "24h" && window !== "7d" && window !== "30d") throw new require_errors.InsightsBadRequestError("Invalid 'window' query parameter.");
+	const bundleId = readSingle(url, "bundleId");
+	return {
+		...readScope(url),
+		window,
+		...bundleId === void 0 ? {} : { bundleId: readId(url, "bundleId", 1024) }
+	};
+};
+//#endregion
+exports.parseEventPageInput = parseEventPageInput;
+exports.parseReportingOverviewInput = parseReportingOverviewInput;
+exports.parseUserInstallationPageInput = parseUserInstallationPageInput;

package/dist/insights/queryInput.mjs

@@ -0,0 +1,91 @@
+import { InsightsBadRequestError } from "./errors.mjs";
+//#region src/insights/queryInput.ts
+const MAX_PAGE_LIMIT = 100;
+const MAX_IDENTITY_LENGTH = 255;
+const MAX_CURSOR_LENGTH = 8192;
+const readSingle = (url, key) => {
+	const values = url.searchParams.getAll(key);
+	if (values.length > 1) throw new InsightsBadRequestError(`Duplicate '${key}' query parameter.`);
+	return values[0];
+};
+const readPageLimit = (url) => {
+	const value = readSingle(url, "limit");
+	if (value === void 0) return void 0;
+	const limit = Number(value);
+	if (!Number.isSafeInteger(limit) || limit < 1 || limit > MAX_PAGE_LIMIT) throw new InsightsBadRequestError("Invalid 'limit' query parameter.");
+	return limit;
+};
+const readCursor = (url) => {
+	const cursor = readSingle(url, "cursor");
+	if (cursor !== void 0 && (cursor.length === 0 || cursor.length > MAX_CURSOR_LENGTH)) throw new InsightsBadRequestError("Invalid 'cursor' query parameter.");
+	return cursor;
+};
+const readId = (url, key, maximumLength = MAX_IDENTITY_LENGTH) => {
+	const value = readSingle(url, key);
+	if (value === void 0 || value.length === 0 || value.length > maximumLength) throw new InsightsBadRequestError(`Invalid '${key}' query parameter.`);
+	return value;
+};
+const readTimestamp = (url, key) => {
+	const raw = readSingle(url, key);
+	if (raw === void 0) return void 0;
+	const value = Number(raw);
+	if (!raw.length || !Number.isSafeInteger(value) || value < 0) throw new InsightsBadRequestError(`Invalid '${key}' query parameter.`);
+	return value;
+};
+const readScope = (url) => {
+	const platform = readSingle(url, "platform");
+	if (platform !== "ios" && platform !== "android") throw new InsightsBadRequestError("Invalid 'platform' query parameter.");
+	return {
+		platform,
+		channel: readId(url, "channel", 1024)
+	};
+};
+const parseEventPageInput = (request) => {
+	const url = new URL(request.url);
+	const bundleFields = [
+		"bundleId",
+		"outcome",
+		"platform",
+		"channel"
+	];
+	let bundle;
+	if (bundleFields.some((key) => url.searchParams.has(key))) {
+		const outcome = readSingle(url, "outcome");
+		if (outcome !== "downloaded" && outcome !== "applied" && outcome !== "recovered" && outcome !== "unchanged") throw new InsightsBadRequestError("Invalid 'outcome' query parameter.");
+		bundle = {
+			...readScope(url),
+			bundleId: readId(url, "bundleId", 1024),
+			outcome
+		};
+	}
+	return {
+		beforeReceivedAtMs: readTimestamp(url, "beforeReceivedAtMs"),
+		sinceMs: readTimestamp(url, "sinceMs"),
+		cursor: readCursor(url),
+		limit: readPageLimit(url),
+		...bundle === void 0 ? {} : { bundle }
+	};
+};
+const parseUserInstallationPageInput = (request) => {
+	const url = new URL(request.url);
+	const cursor = readCursor(url);
+	const limit = readPageLimit(url);
+	return {
+		userId: readId(url, "userId"),
+		...cursor === void 0 ? {} : { cursor },
+		...limit === void 0 ? {} : { limit }
+	};
+};
+const parseReportingOverviewInput = (request) => {
+	const url = new URL(request.url);
+	const window = readSingle(url, "window") ?? "30d";
+	if (window !== "24h" && window !== "7d" && window !== "30d") throw new InsightsBadRequestError("Invalid 'window' query parameter.");
+	const bundleId = readSingle(url, "bundleId");
+	return {
+		...readScope(url),
+		window,
+		...bundleId === void 0 ? {} : { bundleId: readId(url, "bundleId", 1024) }
+	};
+};
+//#endregion
+export { parseEventPageInput, parseReportingOverviewInput, parseUserInstallationPageInput };

package/dist/insights/routes.cjs

@@ -0,0 +1,58 @@
+const require_errors = require("./errors.cjs");
+const require_eventInput = require("./eventInput.cjs");
+const require_queryInput = require("./queryInput.cjs");
+//#region src/insights/routes.ts
+const json = (body, status) => Response.json(body, {
+	headers: { "cache-control": "private, no-store" },
+	status
+});
+const requireParam = (params, key) => {
+	const value = params[key];
+	if (value === void 0 || value.length === 0) throw new require_errors.InsightsBadRequestError(`Missing route parameter: ${key}`);
+	try {
+		return decodeURIComponent(value);
+	} catch {
+		throw new require_errors.InsightsBadRequestError(`Invalid route parameter: ${key}`);
+	}
+};
+const run = async (operation) => {
+	try {
+		return await operation();
+	} catch (error) {
+		if (error instanceof require_errors.InsightsBadRequestError) return json({ error: error.message }, 400);
+		if (error instanceof require_errors.InsightsPayloadTooLargeError) return json({ error: error.message }, 413);
+		throw error;
+	}
+};
+const query = (operation) => run(async () => json(await operation(), 200));
+const createInsightsRouteHandlers = (provider) => ({
+	appendBundleEvent: async (_params, request) => run(async () => {
+		await provider.appendBundleEvent(await require_eventInput.parseBundleEventRequest(request));
+		return new Response(null, { status: 204 });
+	}),
+	getReportingOverview: (_params, request) => query(() => provider.getReportingOverview(require_queryInput.parseReportingOverviewInput(request))),
+	getInstallation: (params) => run(async () => {
+		const installation = await provider.getInstallation({ installId: requireParam(params, "installId") });
+		return installation === null ? json({ error: "Installation not found" }, 404) : json(installation, 200);
+	}),
+	listEvents: (_params, request) => query(() => provider.listEvents(require_queryInput.parseEventPageInput(request))),
+	listInstallationEvents: (params, request) => query(() => provider.listInstallationEvents({
+		...require_queryInput.parseEventPageInput(request),
+		installId: requireParam(params, "installId")
+	})),
+	pageInstallationsByCurrentUserId: (_params, request) => query(() => provider.pageInstallationsByCurrentUserId(require_queryInput.parseUserInstallationPageInput(request)))
+});
+const registerInsightsClientRoutes = (add) => {
+	add("POST", "/events", "appendBundleEvent");
+};
+const registerInsightsAdminRoutes = (add) => {
+	add("GET", "/events", "listEvents");
+	add("GET", "/overview", "getReportingOverview");
+	add("GET", "/installations", "pageInstallationsByCurrentUserId");
+	add("GET", "/installations/:installId/events", "listInstallationEvents");
+	add("GET", "/installations/:installId", "getInstallation");
+};
+//#endregion
+exports.createInsightsRouteHandlers = createInsightsRouteHandlers;
+exports.registerInsightsAdminRoutes = registerInsightsAdminRoutes;
+exports.registerInsightsClientRoutes = registerInsightsClientRoutes;

package/dist/insights/routes.mjs

@@ -0,0 +1,56 @@
+import { InsightsBadRequestError, InsightsPayloadTooLargeError } from "./errors.mjs";
+import { parseBundleEventRequest } from "./eventInput.mjs";
+import { parseEventPageInput, parseReportingOverviewInput, parseUserInstallationPageInput } from "./queryInput.mjs";
+//#region src/insights/routes.ts
+const json = (body, status) => Response.json(body, {
+	headers: { "cache-control": "private, no-store" },
+	status
+});
+const requireParam = (params, key) => {
+	const value = params[key];
+	if (value === void 0 || value.length === 0) throw new InsightsBadRequestError(`Missing route parameter: ${key}`);
+	try {
+		return decodeURIComponent(value);
+	} catch {
+		throw new InsightsBadRequestError(`Invalid route parameter: ${key}`);
+	}
+};
+const run = async (operation) => {
+	try {
+		return await operation();
+	} catch (error) {
+		if (error instanceof InsightsBadRequestError) return json({ error: error.message }, 400);
+		if (error instanceof InsightsPayloadTooLargeError) return json({ error: error.message }, 413);
+		throw error;
+	}
+};
+const query = (operation) => run(async () => json(await operation(), 200));
+const createInsightsRouteHandlers = (provider) => ({
+	appendBundleEvent: async (_params, request) => run(async () => {
+		await provider.appendBundleEvent(await parseBundleEventRequest(request));
+		return new Response(null, { status: 204 });
+	}),
+	getReportingOverview: (_params, request) => query(() => provider.getReportingOverview(parseReportingOverviewInput(request))),
+	getInstallation: (params) => run(async () => {
+		const installation = await provider.getInstallation({ installId: requireParam(params, "installId") });
+		return installation === null ? json({ error: "Installation not found" }, 404) : json(installation, 200);
+	}),
+	listEvents: (_params, request) => query(() => provider.listEvents(parseEventPageInput(request))),
+	listInstallationEvents: (params, request) => query(() => provider.listInstallationEvents({
+		...parseEventPageInput(request),
+		installId: requireParam(params, "installId")
+	})),
+	pageInstallationsByCurrentUserId: (_params, request) => query(() => provider.pageInstallationsByCurrentUserId(parseUserInstallationPageInput(request)))
+});
+const registerInsightsClientRoutes = (add) => {
+	add("POST", "/events", "appendBundleEvent");
+};
+const registerInsightsAdminRoutes = (add) => {
+	add("GET", "/events", "listEvents");
+	add("GET", "/overview", "getReportingOverview");
+	add("GET", "/installations", "pageInstallationsByCurrentUserId");
+	add("GET", "/installations/:installId/events", "listInstallationEvents");
+	add("GET", "/installations/:installId", "getInstallation");
+};
+//#endregion
+export { createInsightsRouteHandlers, registerInsightsAdminRoutes, registerInsightsClientRoutes };

package/dist/insights/types.d.cts

@@ -0,0 +1,32 @@
+import { ActiveInstallationWindow, CreateBundleEventRequest, CursorPage, EventCursorPage, EventHistoryRow, InsightsBundleSelection, InsightsScope, InstallationHistoryRow, InstallationRow, ReportingOverview } from "./domain.cjs";
+//#region src/insights/types.d.ts
+type InsightsEventPageInput = {
+  readonly beforeReceivedAtMs?: number;
+  readonly sinceMs?: number;
+  readonly bundle?: InsightsBundleSelection;
+  readonly cursor?: string;
+  readonly limit?: number;
+};
+type InsightsInstallationEventPageInput = Omit<InsightsEventPageInput, "bundle"> & {
+  readonly installId: string;
+};
+type InsightsUserInstallationPageInput = {
+  readonly userId: string;
+  readonly cursor?: string;
+  readonly limit?: number;
+};
+type InsightsProvider = {
+  appendBundleEvent(input: CreateBundleEventRequest): Promise<void>;
+  listEvents(input: InsightsEventPageInput): Promise<EventCursorPage<EventHistoryRow>>;
+  listInstallationEvents(input: InsightsInstallationEventPageInput): Promise<EventCursorPage<InstallationHistoryRow>>;
+  getInstallation(input: {
+    readonly installId: string;
+  }): Promise<InstallationRow | null>;
+  pageInstallationsByCurrentUserId(input: InsightsUserInstallationPageInput): Promise<CursorPage<InstallationRow>>;
+  getReportingOverview(input: InsightsScope & {
+    readonly window: ActiveInstallationWindow;
+    readonly bundleId?: string;
+  }): Promise<ReportingOverview>;
+};
+//#endregion
+export { InsightsEventPageInput, InsightsInstallationEventPageInput, InsightsProvider, InsightsUserInstallationPageInput };