@blotout/qinto-cli 0.1.10 → 0.1.11

package/dist/worker-artifact/app-runtime/index.js

@@ -14706,7 +14706,7 @@ var scheduleSchema = external_exports.object({
       id: external_exports.string().min(1).max(64),
       ord: external_exports.number().int().min(1),
       label: external_exports.string().max(100),
-      catalogQueryTicket: external_exports.string().min(1).max(2048)
+      queryTicket: external_exports.string().min(1).max(2048)
     }).strict()
   ).min(1).max(MAX_INSTALLS_PER_APP)
 }).strict();
@@ -14722,7 +14722,10 @@ var toolSchema = external_exports.object({
   // call that names no arguments normalizes to `{}` rather than reaching the handler as undefined.
   arguments: external_exports.record(external_exports.string(), external_exports.unknown()).default({}),
   // Stable across a collapsed retry, so an app can deduplicate its external effects on it.
-  callId: external_exports.string().min(1).max(64)
+  callId: external_exports.string().min(1).max(64),
+  // The short-lived install/version-scoped credential used only by the app runtime's query
+  // broker. It never enters handler arguments or app-authored result data.
+  queryTicket: external_exports.string().min(1).max(2048)
 }).strict().refine((tool) => {
   return new TextEncoder().encode(JSON.stringify(tool.arguments)).length <= MAX_TOOL_ARGUMENTS_BYTES;
 }, "Tool arguments exceed the size cap");
@@ -14932,6 +14935,9 @@ var appUiWritePath = (domainId, appSlug2) => {
 var appUiCatalogQueryPath = (domainId, appSlug2, resourceIdentifier) => {
   return `/app-ui/sites/${domainId}/apps/${appSlug2}/catalogs/${resourceIdentifier}/query`;
 };
+var appUiAnalyticsQueryPath = (domainId, appSlug2, resourceIdentifier) => {
+  return `/app-ui/sites/${domainId}/apps/${appSlug2}/analytics/${resourceIdentifier}/query`;
+};
 var uiInstallSchema = external_exports.object({ id: external_exports.string().min(1).max(64), ord: external_exports.number().int().min(1), label: external_exports.string().max(100), enabled: external_exports.boolean() }).strict();
 var uiContextSchema = external_exports.object({
   version: external_exports.string().min(1).max(32),
@@ -16195,43 +16201,58 @@ var failureMessage = (error51) => {
   return message.slice(0, MAX_ERROR_MESSAGE_LENGTH);
 };
 
-// src/catalog-query.ts
-var MAX_CATALOG_RESPONSE_BYTES = 5 * 1024 * 1024;
-var parseCatalogResponse = async (response) => {
-  const raw = await readBody(response, MAX_CATALOG_RESPONSE_BYTES);
+// src/query.ts
+var MAX_QUERY_RESPONSE_BYTES = 5 * 1024 * 1024;
+var parseQueryResponse = async (kind, response) => {
+  const raw = await readBody(response, MAX_QUERY_RESPONSE_BYTES);
   if (raw === null) {
-    throw new Error("The catalog query response exceeded the app runtime limit.");
+    throw new Error(`The ${kind} query response exceeded the app runtime limit.`);
   }
   let body;
   try {
     body = JSON.parse(raw);
   } catch {
-    throw new Error(`The catalog query returned an invalid response (${response.status}).`);
+    throw new Error(`The ${kind} query returned an invalid response (${response.status}).`);
   }
   if (!response.ok) {
     const error51 = body;
     const reason = typeof error51.message === "string" ? error51.message : typeof error51.error === "string" ? error51.error : `request failed with status ${response.status}`;
-    throw new Error(`Catalog query failed: ${reason}`);
+    throw new Error(`${kind === "catalog" ? "Catalog" : "Analytics"} query failed: ${reason}`);
   }
   return body;
 };
-var buildCatalogQuery = ({ env, ticket, installId }) => {
+var buildQuery = ({ env, ticket, installId }) => {
+  const platform = env;
+  const context = JSON.parse(platform.APP_CONTEXT);
+  const post = async (kind, path, resourceIdentifier, sql) => {
+    return traced(
+      `qinto.${kind}.query`,
+      { attrs: { "app.install_id": installId, [`app.${kind}.resource`]: resourceIdentifier } },
+      async () => {
+        const response = await fetch(new URL(path, platform.QINTO_PLATFORM_API), {
+          method: "POST",
+          headers: { authorization: `Bearer ${ticket}`, "content-type": "application/json" },
+          body: JSON.stringify({ sql })
+        });
+        return parseQueryResponse(kind, response);
+      }
+    );
+  };
   return {
     catalog: async (resourceIdentifier, sql) => {
-      const platform = env;
-      const context = JSON.parse(platform.APP_CONTEXT);
-      const path = appUiCatalogQueryPath(context.domainId, context.slug, resourceIdentifier);
-      return traced(
-        "qinto.catalog.query",
-        { attrs: { "app.install_id": installId, "app.catalog.resource": resourceIdentifier } },
-        async () => {
-          const response = await fetch(new URL(path, platform.QINTO_PLATFORM_API), {
-            method: "POST",
-            headers: { authorization: `Bearer ${ticket}`, "content-type": "application/json" },
-            body: JSON.stringify({ sql })
-          });
-          return parseCatalogResponse(response);
-        }
+      return post(
+        "catalog",
+        appUiCatalogQueryPath(context.domainId, context.slug, resourceIdentifier),
+        resourceIdentifier,
+        sql
+      );
+    },
+    analytics: async (resourceIdentifier, sql) => {
+      return post(
+        "analytics",
+        appUiAnalyticsQueryPath(context.domainId, context.slug, resourceIdentifier),
+        resourceIdentifier,
+        sql
       );
     }
   };
@@ -16273,7 +16294,7 @@ var dispatchSchedule = async (envelope, bundle, env) => {
       appSecrets: appScope.appSecrets,
       observability: buildObservability(install.ord),
       apps: buildAppsClient(env, { depth: 0 }),
-      query: buildCatalogQuery({ env, ticket: install.catalogQueryTicket, installId: install.id }),
+      query: buildQuery({ env, ticket: install.queryTicket, installId: install.id }),
       push: async (userId, message) => {
         await brokerPush(env, {
           userId,
@@ -16393,6 +16414,7 @@ var buildContext2 = (envelope, env) => {
     appSecrets: appScope.appSecrets,
     observability: buildObservability(install.ord),
     apps: buildAppsClient(env, { depth: 0 }),
+    query: buildQuery({ env, ticket: envelope.tool.queryTicket, installId: install.id }),
     fail: (message) => {
       return { kind: "tool_error", message: truncate(message) };
     }

package/dist/worker-artifact/main/index.js

@@ -15932,7 +15932,7 @@ var scheduleSchema = external_exports.object({
       id: external_exports.string().min(1).max(64),
       ord: external_exports.number().int().min(1),
       label: external_exports.string().max(100),
-      catalogQueryTicket: external_exports.string().min(1).max(2048)
+      queryTicket: external_exports.string().min(1).max(2048)
     }).strict()
   ).min(1).max(MAX_INSTALLS_PER_APP)
 }).strict();
@@ -15948,7 +15948,10 @@ var toolSchema = external_exports.object({
   // call that names no arguments normalizes to `{}` rather than reaching the handler as undefined.
   arguments: external_exports.record(external_exports.string(), external_exports.unknown()).default({}),
   // Stable across a collapsed retry, so an app can deduplicate its external effects on it.
-  callId: external_exports.string().min(1).max(64)
+  callId: external_exports.string().min(1).max(64),
+  // The short-lived install/version-scoped credential used only by the app runtime's query
+  // broker. It never enters handler arguments or app-authored result data.
+  queryTicket: external_exports.string().min(1).max(2048)
 }).strict().refine((tool) => {
   return new TextEncoder().encode(JSON.stringify(tool.arguments)).length <= MAX_TOOL_ARGUMENTS_BYTES;
 }, "Tool arguments exceed the size cap");
@@ -20993,10 +20996,10 @@ var verifyAppUiToken = /* @__PURE__ */ __name(async (input) => {
   return { ok: true, claims: claims.data, kid: signature.kid, key: signature.key };
 }, "verifyAppUiToken");
 
-// ../../libs/app-ui-token/src/schedule-catalog-ticket.ts
-var APP_SCHEDULE_CATALOG_TICKET_ISSUER = "qinto-portal";
+// ../../libs/app-ui-token/src/runtime-query-ticket.ts
+var APP_RUNTIME_QUERY_TICKET_ISSUER = "qinto-portal";
 var claimsSchema2 = external_exports.object({
-  iss: external_exports.literal(APP_SCHEDULE_CATALOG_TICKET_ISSUER),
+  iss: external_exports.literal(APP_RUNTIME_QUERY_TICKET_ISSUER),
   aud: external_exports.string().min(1),
   sub: external_exports.string().min(1),
   iat: external_exports.number().int(),

package/dist/worker-artifact/version.json

@@ -1,8 +1,8 @@
 {
   "main": {
     "version": "0.1.0",
-    "gitSha": "eccf5ef7a3b8ef9131bc38d28b66cc5a3add163b",
-    "builtAt": "2026-08-29T05:28:12.232Z",
+    "gitSha": "83bcac7072f2feb866505c4a7b99f7281b08d972",
+    "builtAt": "2026-08-29T21:13:15.188Z",
     "compatibilityDate": "2026-06-23",
     "compatibilityFlags": [
       "nodejs_compat"
@@ -40,8 +40,8 @@
   },
   "app-runtime": {
     "version": "0.1.0",
-    "gitSha": "eccf5ef7a3b8ef9131bc38d28b66cc5a3add163b",
-    "builtAt": "2026-08-29T05:28:14.997Z",
+    "gitSha": "83bcac7072f2feb866505c4a7b99f7281b08d972",
+    "builtAt": "2026-08-29T21:13:19.154Z",
     "compatibilityDate": "2026-06-23",
     "compatibilityFlags": [
       "nodejs_compat"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blotout/qinto-cli",
-  "version": "0.1.10",
+  "version": "0.1.11",
   "type": "module",
   "description": "Qinto CLI: authenticate against the Qinto platform and operate it from the terminal or from an agent.",
   "repository": {