@blotout/qinto-cli 0.1.11 → 0.1.12

package/dist/worker-artifact/main/index.js

@@ -570,6 +570,92 @@ var appendSpan = /* @__PURE__ */ __name((span) => {
   scope.buffer.spans.push(span);
 }, "appendSpan");
 
+// ../../node_modules/.pnpm/hono@4.12.28/node_modules/hono/dist/http-exception.js
+var HTTPException = class extends Error {
+  static {
+    __name(this, "HTTPException");
+  }
+  res;
+  status;
+  /**
+   * Creates an instance of `HTTPException`.
+   * @param status - HTTP status code for the exception. Defaults to 500.
+   * @param options - Additional options for the exception.
+   */
+  constructor(status = 500, options) {
+    super(options?.message, { cause: options?.cause });
+    this.res = options?.res;
+    this.status = status;
+  }
+  /**
+   * Returns the response object associated with the exception.
+   * If a response object is not provided, a new response is created with the error message and status code.
+   * @returns The response object.
+   */
+  getResponse() {
+    if (this.res) {
+      const newResponse = new Response(this.res.body, {
+        status: this.status,
+        headers: this.res.headers
+      });
+      return newResponse;
+    }
+    return new Response(this.message, {
+      status: this.status
+    });
+  }
+};
+
+// ../../node_modules/.pnpm/hono@4.12.28/node_modules/hono/dist/middleware/body-limit/index.js
+var ERROR_MESSAGE = "Payload Too Large";
+var bodyLimit = /* @__PURE__ */ __name((options) => {
+  const onError = options.onError || (() => {
+    const res = new Response(ERROR_MESSAGE, {
+      status: 413
+    });
+    throw new HTTPException(413, { res });
+  });
+  const maxSize = options.maxSize;
+  return /* @__PURE__ */ __name(async function bodyLimit2(c, next) {
+    if (!c.req.raw.body) {
+      return next();
+    }
+    const hasTransferEncoding = c.req.raw.headers.has("transfer-encoding");
+    const hasContentLength = c.req.raw.headers.has("content-length");
+    if (hasContentLength && !hasTransferEncoding) {
+      const contentLength = parseInt(c.req.raw.headers.get("content-length") || "0", 10);
+      return contentLength > maxSize ? onError(c) : next();
+    }
+    let size = 0;
+    const chunks = [];
+    const rawReader = c.req.raw.body.getReader();
+    for (; ; ) {
+      const { done, value } = await rawReader.read();
+      if (done) {
+        break;
+      }
+      size += value.length;
+      if (size > maxSize) {
+        return onError(c);
+      }
+      chunks.push(value);
+    }
+    const requestInit = {
+      body: new ReadableStream({
+        start(controller) {
+          for (const chunk of chunks) {
+            controller.enqueue(chunk);
+          }
+          controller.close();
+        }
+      }),
+      duplex: "half"
+    };
+    c.req.raw = new Request(c.req.raw, requestInit);
+    return next();
+  }, "bodyLimit2");
+}, "bodyLimit");
+
 // ../../node_modules/.pnpm/hono@4.12.28/node_modules/hono/dist/middleware/cors/index.js
 var cors = /* @__PURE__ */ __name((options) => {
   const opts = {
@@ -653,42 +739,6 @@ var cors = /* @__PURE__ */ __name((options) => {
   }, "cors2");
 }, "cors");
 
-// ../../node_modules/.pnpm/hono@4.12.28/node_modules/hono/dist/http-exception.js
-var HTTPException = class extends Error {
-  static {
-    __name(this, "HTTPException");
-  }
-  res;
-  status;
-  /**
-   * Creates an instance of `HTTPException`.
-   * @param status - HTTP status code for the exception. Defaults to 500.
-   * @param options - Additional options for the exception.
-   */
-  constructor(status = 500, options) {
-    super(options?.message, { cause: options?.cause });
-    this.res = options?.res;
-    this.status = status;
-  }
-  /**
-   * Returns the response object associated with the exception.
-   * If a response object is not provided, a new response is created with the error message and status code.
-   * @returns The response object.
-   */
-  getResponse() {
-    if (this.res) {
-      const newResponse = new Response(this.res.body, {
-        status: this.status,
-        headers: this.res.headers
-      });
-      return newResponse;
-    }
-    return new Response(this.message, {
-      status: this.status
-    });
-  }
-};
-
 // src/apps/broker.ts
 import { timingSafeEqual } from "node:crypto";
 import { WorkerEntrypoint } from "cloudflare:workers";
@@ -25971,9 +26021,29 @@ CREATE UNIQUE INDEX IF NOT EXISTS idx_facts_conversion ON facts (key) WHERE kind
   "ALTER TABLE facts ADD COLUMN expires_at INTEGER;"
 ];
 
+// src/id-graph/anon/token-bucket.ts
+var createTokenBucket = /* @__PURE__ */ __name((capacity, refillPerSecond) => {
+  let tokens = capacity;
+  let updatedAt = null;
+  return {
+    take: /* @__PURE__ */ __name((now) => {
+      if (updatedAt !== null) {
+        tokens = Math.min(capacity, tokens + Math.max(0, now - updatedAt) * (refillPerSecond / 1e3));
+      }
+      updatedAt = now;
+      if (tokens < 1) {
+        return false;
+      }
+      tokens -= 1;
+      return true;
+    }, "take")
+  };
+}, "createTokenBucket");
+
 // src/id-graph/anon/websocket.ts
 var MAX_BROWSER_RESULT_BYTES = 1024;
 var MAX_BROWSER_RESULTS_BYTES = 32 * 1024;
+var MAX_FRAME_BYTES = 64 * 1024;
 var browserContextFrame = external_exports.object({
   occurredAt: external_exports.number().int().nonnegative().safe(),
   page: external_exports.object({ url: external_exports.string().min(1).max(4096), referrer: external_exports.string().min(1).max(4096).optional() }).strict(),
@@ -26046,6 +26116,10 @@ var pluckRef = /* @__PURE__ */ __name((parsed) => {
   return typeof ref === "string" && ref.length > 0 ? ref : void 0;
 }, "pluckRef");
 var parseFrame = /* @__PURE__ */ __name((message) => {
+  const size = typeof message === "string" ? message.length : message.byteLength;
+  if (size > MAX_FRAME_BYTES) {
+    return { ok: false, ref: void 0, error: new Error(`frame exceeds ${MAX_FRAME_BYTES} bytes`) };
+  }
   const text = typeof message === "string" ? message : new TextDecoder().decode(message);
   let parsed;
   try {
@@ -26144,12 +26218,19 @@ var siteAudience = /* @__PURE__ */ __name(({ registry: registry3, app: app2, top
   const allowed = app2.events.publishes.includes(topic) && app2.data.includes(SHARED_CONTEXT_CAPABILITY);
   return allowed ? siteEventReceivers(registry3, consent2, enforced) : null;
 }, "siteAudience");
+var FRAME_BURST = 60;
+var FRAMES_PER_SECOND = 10;
+var EMIT_BURST = 120;
+var EMITS_PER_SECOND = 5;
 var AnonDO = class extends DurableObject2 {
   static {
     __name(this, "AnonDO");
   }
   // Serialize link decisions so concurrent first identifiers cannot split the graph.
   ingestQueue = Promise.resolve();
+  // In memory on purpose: a hibernated socket sent nothing, so a fresh bucket on wake is the right one.
+  frameBuckets = /* @__PURE__ */ new WeakMap();
+  emitBudget = createTokenBucket(EMIT_BURST, EMITS_PER_SECOND);
   // deleteAll removes the live schema; only a later write recreates it.
   wiped = false;
   // Warm write-through mirrors reset together after expiry.
@@ -26208,9 +26289,50 @@ var AnonDO = class extends DurableObject2 {
       ...action.type === "track" ? { "action.event": action.payload.event } : {}
     };
     return runInvocation({ name: "do.anon.ingest", trace, attrs }, () => {
+      if (action.origin !== void 0 && !this.emitBudget.take(Date.now())) {
+        addSpanEvent("emit rejected: the visitor\u2019s emit budget is spent", {
+          level: "warn",
+          attrs: { app: action.origin.app, depth: action.origin.depth }
+        });
+        return Promise.resolve();
+      }
       return this.ingestLocal(action);
     });
   }
+  // The frames that ask instead of act are answered in place; an action frame comes back to be queued.
+  async answerQuery(ws, parsed, userId, attachment) {
+    const { frame, ref } = parsed;
+    if (frame.t === "getSession") {
+      this.respond(ws, {
+        t: "session",
+        ref,
+        anonId: userId,
+        globalId: linkedGlobalId(this.kv),
+        ip: attachment?.host?.ip ?? null,
+        geo: attachment?.browserGeo ?? null
+      });
+      return null;
+    }
+    if (frame.t === "capture") {
+      const { accepted } = await this.capture({ apps: frame.apps });
+      this.respond(ws, { t: "captureAck", ref, anonId: userId, accepted });
+      return null;
+    }
+    return frame;
+  }
+  admitFrame(ws) {
+    let bucket = this.frameBuckets.get(ws);
+    if (bucket === void 0) {
+      bucket = createTokenBucket(FRAME_BURST, FRAMES_PER_SECOND);
+      this.frameBuckets.set(ws, bucket);
+    }
+    if (bucket.take(Date.now())) {
+      return true;
+    }
+    addSpanEvent("websocket frame rate limited", { level: "warn" });
+    this.respond(ws, { t: "error", ref: void 0, message: "rate limited" });
+    return false;
+  }
   ingestLocal(action) {
     return this.enqueue(() => this.processAction(action));
   }
@@ -26233,6 +26355,9 @@ var AnonDO = class extends DurableObject2 {
   async webSocketMessage(ws, message) {
     const attachment = ws.deserializeAttachment() ?? void 0;
     return runInvocation({ name: "ws.message", attrs: attachment?.attrs }, async () => {
+      if (!this.admitFrame(ws)) {
+        return;
+      }
       const parsed = parseFrame(message);
       if (!parsed.ok) {
         addSpanEvent("invalid websocket frame", { level: "warn", attrs: { error: String(parsed.error) } });
@@ -26250,23 +26375,11 @@ var AnonDO = class extends DurableObject2 {
         this.respond(ws, { t: "error", ref: parsed.ref, message: "session not initialized" });
         return;
       }
-      if (parsed.frame.t === "getSession") {
-        this.respond(ws, {
-          t: "session",
-          ref: parsed.ref,
-          anonId: userId,
-          globalId: linkedGlobalId(this.kv),
-          ip: attachment?.host?.ip ?? null,
-          geo: attachment?.browserGeo ?? null
-        });
-        return;
-      }
-      if (parsed.frame.t === "capture") {
-        const { accepted } = await this.capture({ apps: parsed.frame.apps });
-        this.respond(ws, { t: "captureAck", ref: parsed.ref, anonId: userId, accepted });
+      const frame = await this.answerQuery(ws, { frame: parsed.frame, ref: parsed.ref }, userId, attachment);
+      if (frame === null) {
         return;
       }
-      const action = actionFromFrame(parsed.frame, userId, attachment?.cf, attachment?.host);
+      const action = actionFromFrame(frame, userId, attachment?.cf, attachment?.host);
       const ref = parsed.ref ?? action.actionId;
       setSpanAttributes({ "action.id": action.actionId });
       try {
@@ -27192,6 +27305,7 @@ CREATE UNIQUE INDEX IF NOT EXISTS idx_facts_key ON facts (kind, scope, key);
 ];
 
 // src/id-graph/global/do.ts
+var SIBLING_FAN_OUT_CONCURRENCY = 6;
 var GlobalDO = class extends DurableObject3 {
   static {
     __name(this, "GlobalDO");
@@ -27293,8 +27407,9 @@ var GlobalDO = class extends DurableObject3 {
     }
     await runInvocation({ name: "do.global.fan_out", trace, attrs: { "global.id": globalId } }, async () => {
       const snapshot = this.snapshot(globalId);
-      await Promise.all(
-        recipients.map(async (anonId) => {
+      await runPool(
+        SIBLING_FAN_OUT_CONCURRENCY,
+        recipients.map((anonId) => async () => {
           try {
             await traced("rpc anon.sync_from_global", { attrs: { "anon.id": anonId } }, () => {
               return anonStub(this.env, anonId).syncFromGlobal(snapshot, currentTraceContext());
@@ -27317,8 +27432,10 @@ app.use("/q.js", cors());
 app.get("/q.js", qJs);
 app.use("/health", cors());
 app.route("/", health);
+var MAX_V1_BODY_BYTES = 1024 * 1024;
 var allowCors = cors({ origin: /* @__PURE__ */ __name((origin) => origin, "origin"), credentials: true });
 app.use("/v1/*", allowCors);
+app.use("/v1/*", bodyLimit({ maxSize: MAX_V1_BODY_BYTES, onError: /* @__PURE__ */ __name((c) => c.json({ error: "too_large" }, 413), "onError") }));
 app.route("/", alias);
 app.route("/", identify);
 app.route("/", track);

package/dist/worker-artifact/version.json

@@ -1,8 +1,8 @@
 {
   "main": {
     "version": "0.1.0",
-    "gitSha": "83bcac7072f2feb866505c4a7b99f7281b08d972",
-    "builtAt": "2026-08-29T21:13:15.188Z",
+    "gitSha": "539e97d61a67ca9c5c6580b94350354e917fcf99",
+    "builtAt": "2026-08-31T10:11:02.141Z",
     "compatibilityDate": "2026-06-23",
     "compatibilityFlags": [
       "nodejs_compat"
@@ -23,8 +23,8 @@
   },
   "wfp": {
     "version": "0.1.0",
-    "gitSha": "c71e3d19431cd96a0c9f43eccabaa36d021401f7",
-    "builtAt": "2026-08-24T10:38:20.398Z",
+    "gitSha": "6064f0fb074965ec6add05255c92ece93bb31321",
+    "builtAt": "2026-08-31T12:30:46.702Z",
     "compatibilityDate": "2026-06-23",
     "compatibilityFlags": [
       "nodejs_compat"

package/dist/worker-artifact/wfp/index.js

@@ -2158,10 +2158,9 @@ var EDGETAG_PREFIXES = [
 
 // src/allowed-paths.ts
 var QINTO_PREFIXES = ["/open", "/q.js", "/health", "/v1/", "/openapi.json", "/apps/", "/app/"];
-var QINTO_EXACT = /* @__PURE__ */ new Set(["/__qinto/control"]);
 var ALLOWED_PREFIXES = [...QINTO_PREFIXES, ...EDGETAG_PREFIXES];
 var allowedPaths = /* @__PURE__ */ __name((path) => {
-  return path === "/" || QINTO_EXACT.has(path) || ALLOWED_PREFIXES.some((prefix) => path.startsWith(prefix));
+  return path === "/" || ALLOWED_PREFIXES.some((prefix) => path.startsWith(prefix));
 }, "allowedPaths");
 
 // ../../libs/wfp-control-token/src/control-token.ts
@@ -2244,6 +2243,21 @@ var requireControlToken = /* @__PURE__ */ __name(async (c, next) => {
   return next();
 }, "requireControlToken");
 
+// src/control/app.ts
+var forwardAppControl = /* @__PURE__ */ __name(async (c) => {
+  const workerName = c.req.query("workerName");
+  if (workerName === void 0 || workerName === "") {
+    return c.text("workerName required", 400);
+  }
+  const url = new URL(c.req.url);
+  url.pathname = "/__qinto/control";
+  url.search = "";
+  const headers = new Headers(c.req.raw.headers);
+  headers.delete("authorization");
+  const body = await c.req.raw.text();
+  return c.env.DISPATCHER.get(workerName).fetch(new Request(url, { method: "POST", headers, body }));
+}, "forwardAppControl");
+
 // src/control/id-graph.ts
 var INSPECT_AUTHORIZATION_HEADER = "x-qinto-inspect-authorization";
 var ACTIONS = /* @__PURE__ */ new Set(["resolve", "inspect", "rows"]);
@@ -2683,6 +2697,7 @@ var Tail = class extends DurableObject {
 // src/index.ts
 var app = new Hono2();
 app.get("/tail", requireControlToken, openTailSocket);
+app.post("/control/app", requireControlToken, forwardAppControl);
 app.post("/control/id-graph/:action", requireControlToken, forwardIdGraph);
 app.all("*", (c) => {
   if (!allowedPaths(c.req.path)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blotout/qinto-cli",
-  "version": "0.1.11",
+  "version": "0.1.12",
   "type": "module",
   "description": "Qinto CLI: authenticate against the Qinto platform and operate it from the terminal or from an agent.",
   "repository": {
@@ -40,9 +40,9 @@
     "typescript": "6.0.3",
     "vite": "^8.0.0",
     "vitest": "4.1.10",
-    "@qinto/app-build": "0.0.0",
-    "@qinto/app-dev": "0.0.0",
     "@qinto/app-manifest": "0.0.0",
+    "@qinto/app-dev": "0.0.0",
+    "@qinto/app-build": "0.0.0",
     "@qinto/oauth-grammar": "0.0.0"
   },
   "scripts": {