@blotout/qinto-cli 0.1.11 → 0.1.13

package/dist/worker-artifact/main/index.js

@@ -570,6 +570,92 @@ var appendSpan = /* @__PURE__ */ __name((span) => {
   scope.buffer.spans.push(span);
 }, "appendSpan");
 
+// ../../node_modules/.pnpm/hono@4.12.28/node_modules/hono/dist/http-exception.js
+var HTTPException = class extends Error {
+  static {
+    __name(this, "HTTPException");
+  }
+  res;
+  status;
+  /**
+   * Creates an instance of `HTTPException`.
+   * @param status - HTTP status code for the exception. Defaults to 500.
+   * @param options - Additional options for the exception.
+   */
+  constructor(status = 500, options) {
+    super(options?.message, { cause: options?.cause });
+    this.res = options?.res;
+    this.status = status;
+  }
+  /**
+   * Returns the response object associated with the exception.
+   * If a response object is not provided, a new response is created with the error message and status code.
+   * @returns The response object.
+   */
+  getResponse() {
+    if (this.res) {
+      const newResponse = new Response(this.res.body, {
+        status: this.status,
+        headers: this.res.headers
+      });
+      return newResponse;
+    }
+    return new Response(this.message, {
+      status: this.status
+    });
+  }
+};
+
+// ../../node_modules/.pnpm/hono@4.12.28/node_modules/hono/dist/middleware/body-limit/index.js
+var ERROR_MESSAGE = "Payload Too Large";
+var bodyLimit = /* @__PURE__ */ __name((options) => {
+  const onError = options.onError || (() => {
+    const res = new Response(ERROR_MESSAGE, {
+      status: 413
+    });
+    throw new HTTPException(413, { res });
+  });
+  const maxSize = options.maxSize;
+  return /* @__PURE__ */ __name(async function bodyLimit2(c, next) {
+    if (!c.req.raw.body) {
+      return next();
+    }
+    const hasTransferEncoding = c.req.raw.headers.has("transfer-encoding");
+    const hasContentLength = c.req.raw.headers.has("content-length");
+    if (hasContentLength && !hasTransferEncoding) {
+      const contentLength = parseInt(c.req.raw.headers.get("content-length") || "0", 10);
+      return contentLength > maxSize ? onError(c) : next();
+    }
+    let size = 0;
+    const chunks = [];
+    const rawReader = c.req.raw.body.getReader();
+    for (; ; ) {
+      const { done, value } = await rawReader.read();
+      if (done) {
+        break;
+      }
+      size += value.length;
+      if (size > maxSize) {
+        return onError(c);
+      }
+      chunks.push(value);
+    }
+    const requestInit = {
+      body: new ReadableStream({
+        start(controller) {
+          for (const chunk of chunks) {
+            controller.enqueue(chunk);
+          }
+          controller.close();
+        }
+      }),
+      duplex: "half"
+    };
+    c.req.raw = new Request(c.req.raw, requestInit);
+    return next();
+  }, "bodyLimit2");
+}, "bodyLimit");
+
 // ../../node_modules/.pnpm/hono@4.12.28/node_modules/hono/dist/middleware/cors/index.js
 var cors = /* @__PURE__ */ __name((options) => {
   const opts = {
@@ -653,42 +739,6 @@ var cors = /* @__PURE__ */ __name((options) => {
   }, "cors2");
 }, "cors");
 
-// ../../node_modules/.pnpm/hono@4.12.28/node_modules/hono/dist/http-exception.js
-var HTTPException = class extends Error {
-  static {
-    __name(this, "HTTPException");
-  }
-  res;
-  status;
-  /**
-   * Creates an instance of `HTTPException`.
-   * @param status - HTTP status code for the exception. Defaults to 500.
-   * @param options - Additional options for the exception.
-   */
-  constructor(status = 500, options) {
-    super(options?.message, { cause: options?.cause });
-    this.res = options?.res;
-    this.status = status;
-  }
-  /**
-   * Returns the response object associated with the exception.
-   * If a response object is not provided, a new response is created with the error message and status code.
-   * @returns The response object.
-   */
-  getResponse() {
-    if (this.res) {
-      const newResponse = new Response(this.res.body, {
-        status: this.status,
-        headers: this.res.headers
-      });
-      return newResponse;
-    }
-    return new Response(this.message, {
-      status: this.status
-    });
-  }
-};
-
 // src/apps/broker.ts
 import { timingSafeEqual } from "node:crypto";
 import { WorkerEntrypoint } from "cloudflare:workers";
@@ -19281,6 +19331,7 @@ var adoptAppSpans = /* @__PURE__ */ __name((response) => {
 
 // src/apps/invoke.ts
 var APP_INVOCATION_TIMEOUT_MS = 1e4;
+var APP_HOOK_TIMEOUT_MS = 25e3;
 var MAX_EMIT_DEPTH = 2;
 var HOOK_URL = "https://app/__qinto/hook";
 var invocationContext = /* @__PURE__ */ __name((env) => {
@@ -19425,7 +19476,7 @@ var ingestEmit = /* @__PURE__ */ __name(async (env, { slug, ord, depth, emit, an
   });
   await ingest(env, action);
 }, "ingestEmit");
-var deliverGroupPushes = /* @__PURE__ */ __name(({ slug, group, installs, deliverPush }) => {
+var deliverGroupPushes = /* @__PURE__ */ __name(async ({ slug, group, installs, deliverPush }) => {
   const install = installs.find((entry) => entry.ord === group.ord);
   for (const push of group.pushes) {
     const { topic, data } = push;
@@ -19435,17 +19486,17 @@ var deliverGroupPushes = /* @__PURE__ */ __name(({ slug, group, installs, delive
           addSpanEvent("push rejected: its group matches no invoked install", { level: "warn", attrs: { app: slug, ord: group.ord } });
           break;
         }
-        deliverPush({ slug, installId: install.id, topic, data, scope: "app" });
+        await deliverPush({ slug, installId: install.id, topic, data, scope: "app" });
         break;
       }
       case "app": {
-        deliverPush({ slug, installId: null, topic, data, scope: "app" });
+        await deliverPush({ slug, installId: null, topic, data, scope: "app" });
         break;
       }
       // Whether this app may broadcast site-wide is settled in `deliverAppPush`, the one path every
       // delivery funnels through; re-deciding it here would be a second authority to keep in sync.
       case "site": {
-        deliverPush({ slug, installId: null, topic, data, scope: "site" });
+        await deliverPush({ slug, installId: null, topic, data, scope: "site" });
         break;
       }
     }
@@ -19461,7 +19512,7 @@ var applyEffects = /* @__PURE__ */ __name(async (env, { slug, groups, depth, ano
     await writeContext2(slug, contextWrites);
   }
   for (const group of groups) {
-    deliverGroupPushes({ slug, group, installs, deliverPush });
+    await deliverGroupPushes({ slug, group, installs, deliverPush });
     if (group.emits.length === 0) {
       continue;
     }
@@ -19486,14 +19537,14 @@ var hookResponseBody = /* @__PURE__ */ __name(async (response, slug) => {
   }
   return new TextDecoder().decode(bytes);
 }, "hookResponseBody");
-var runInvokeApp = /* @__PURE__ */ __name(async (env, { target, trigger, snapshot, context, deliverPush, writeAttribution: writeAttribution2, writeContext: writeContext2, budget }) => {
+var runInvokeApp = /* @__PURE__ */ __name(async (env, { target, trigger, snapshot, context, deliverEffects, budget }) => {
   try {
     const key = await deriveAppInternalKey(context.master, context.domainId, target.slug);
     const response = await postHookEnvelope(env, {
       binding: target.app.binding,
       key,
       envelope: buildEnvelope(target, trigger, snapshot, context),
-      timeoutMs: APP_INVOCATION_TIMEOUT_MS
+      timeoutMs: APP_HOOK_TIMEOUT_MS
     });
     if (response === void 0) {
       addSpanEvent("app service binding is missing", { level: "warn", attrs: { app: target.slug, binding: target.app.binding } });
@@ -19520,15 +19571,15 @@ var runInvokeApp = /* @__PURE__ */ __name(async (env, { target, trigger, snapsho
     for (const ord of verdict.effects.rejectedOrds) {
       addSpanEvent("app effects rejected over the per-install caps", { level: "warn", attrs: { app: target.slug, ord } });
     }
-    await applyEffects(env, {
+    if (verdict.effects.accepted.length === 0) {
+      return;
+    }
+    await deliverEffects({
+      anonId: snapshot.anonId,
       slug: target.slug,
       groups: verdict.effects.accepted,
       depth: triggerDepth(trigger),
-      anonId: snapshot.anonId,
       installs: target.installs,
-      deliverPush,
-      writeAttribution: writeAttribution2,
-      writeContext: writeContext2,
       geo: trigger.kind === "event" ? trigger.action.geo : trigger.geo,
       host: trigger.kind === "event" ? trigger.action.host : trigger.host,
       context: trigger.kind === "event" ? trigger.action.context : void 0
@@ -19835,17 +19886,15 @@ var deliverRpcEffects = /* @__PURE__ */ __name(async (env, { body, userId, effec
   for (const ord of effects.rejectedOrds) {
     addSpanEvent("app effects rejected over the per-install caps", { level: "warn", attrs: { app: body.callee, ord } });
   }
-  const pushes = [];
   await applyEffects(env, {
     slug: body.callee,
     groups: effects.accepted,
     depth: body.depth,
     anonId: userId,
     installs: [install],
-    deliverPush: /* @__PURE__ */ __name((push) => {
-      pushes.push(push);
+    deliverPush: /* @__PURE__ */ __name(async (push) => {
+      await anonStub(env, userId).appPush(push, currentTraceContext());
     }, "deliverPush"),
-    // The broker runs outside the user's AnonDO, so this reaches it the same way a push does.
     writeAttribution: /* @__PURE__ */ __name(async (slug, writes) => {
       await anonStub(env, userId).appAttribution({ slug, writes }, currentTraceContext());
     }, "writeAttribution"),
@@ -19853,9 +19902,6 @@ var deliverRpcEffects = /* @__PURE__ */ __name(async (env, { body, userId, effec
       await anonStub(env, userId).appContext({ slug, writes }, currentTraceContext());
     }, "writeContext")
   });
-  for (const push of pushes) {
-    await anonStub(env, userId).appPush(push, currentTraceContext());
-  }
 }, "deliverRpcEffects");
 var runRelayRpc = /* @__PURE__ */ __name(async (env, { context, body, callee, install }) => {
   let raw2;
@@ -24717,6 +24763,94 @@ var track = createApiRouter().openapi(definition8, async (c) => {
   }
 });
 
+// src/apps/fan-out-entrypoint.ts
+import { WorkerEntrypoint as WorkerEntrypoint2 } from "cloudflare:workers";
+
+// src/apps/eligibility.ts
+var wantsTrigger = /* @__PURE__ */ __name((app2, trigger) => {
+  if (trigger.kind === "connect") {
+    return app2.hooks.onConnect;
+  }
+  return app2.hooks.onEvent.includes(trigger.action.type);
+}, "wantsTrigger");
+var gatePasses = /* @__PURE__ */ __name((entry, trigger, consent2, enforced) => {
+  if (trigger.kind === "event" && trigger.action.origin?.app === entry.slug) {
+    return false;
+  }
+  if (trigger.kind === "event" && trigger.action.type === "consent") {
+    return true;
+  }
+  return consentAllows(consent2, entry.slug, entry.app.consent.category, enforced);
+}, "gatePasses");
+var eligibleApps = /* @__PURE__ */ __name((registry3, trigger, consent2, enforced) => {
+  const targets = [];
+  for (const slug of registry3.order) {
+    const app2 = registry3.apps[slug];
+    if (app2 === void 0 || !wantsTrigger(app2, trigger) || !gatePasses({ slug, app: app2 }, trigger, consent2, enforced)) {
+      continue;
+    }
+    const installs = app2.installs.filter((install) => install.active).map(({ id, ord, label }) => ({ id, ord, label }));
+    if (installs.length === 0) {
+      continue;
+    }
+    targets.push({ slug, app: app2, installs });
+  }
+  return targets;
+}, "eligibleApps");
+
+// src/apps/fan-out.ts
+var MAX_APPS_PER_DOMAIN = 50;
+var fanOutToApps = /* @__PURE__ */ __name(async (env, { trigger, snapshot, trace }, { deliverEffects }) => {
+  const { registry: registry3, error: error51 } = siteRegistry();
+  const targets = eligibleApps(registry3, trigger, snapshot.consent, consentEnforced(env));
+  if (error51 === void 0 && targets.length === 0) {
+    return;
+  }
+  await runInvocation({ name: "app.fan_out", trace, attrs: { "fan_out.kind": trigger.kind, "fan_out.apps": targets.length } }, async () => {
+    if (error51 !== void 0) {
+      addSpanEvent("apps registry is malformed; apps are off", { level: "error", attrs: { error: error51 } });
+      return;
+    }
+    const context = invocationContext(env);
+    if (context === void 0) {
+      addSpanEvent("apps skipped: APPS_KEY_MASTER or QINTO_DOMAIN_ID is missing", { level: "warn" });
+      return;
+    }
+    const capped = targets.slice(0, MAX_APPS_PER_DOMAIN);
+    if (capped.length < targets.length) {
+      addSpanEvent("eligible apps exceed the per-event budget", {
+        level: "warn",
+        attrs: { eligible: targets.length, cap: MAX_APPS_PER_DOMAIN }
+      });
+    }
+    const budget = createDataPointBudget();
+    await Promise.allSettled(
+      capped.map((target) => {
+        return invokeApp(env, { target, trigger, snapshot, context, deliverEffects, budget });
+      })
+    );
+  });
+}, "fanOutToApps");
+
+// src/apps/fan-out-entrypoint.ts
+var anonEffectsDelivery = /* @__PURE__ */ __name((env, anonId) => {
+  return (effects) => {
+    return anonStub(env, anonId).appEffects(effects, currentTraceContext());
+  };
+}, "anonEffectsDelivery");
+var FanOut = class extends WorkerEntrypoint2 {
+  static {
+    __name(this, "FanOut");
+  }
+  run(job) {
+    this.ctx.waitUntil(
+      fanOutToApps(this.env, job, { deliverEffects: anonEffectsDelivery(this.env, job.snapshot.anonId) }).catch((error51) => {
+        console.warn("app fan-out failed", { error: error51 });
+      })
+    );
+  }
+};
+
 // src/id-graph/alias/do.ts
 import { DurableObject } from "cloudflare:workers";
 var ASSIGNMENT_KEY = "assignment";
@@ -24949,87 +25083,6 @@ var acceptedCaptures = /* @__PURE__ */ __name((registry3, consent2, apps, enforc
   return accepted;
 }, "acceptedCaptures");
 
-// src/apps/eligibility.ts
-var wantsTrigger = /* @__PURE__ */ __name((app2, trigger) => {
-  if (trigger.kind === "connect") {
-    return app2.hooks.onConnect;
-  }
-  return app2.hooks.onEvent.includes(trigger.action.type);
-}, "wantsTrigger");
-var gatePasses = /* @__PURE__ */ __name((entry, trigger, consent2, enforced) => {
-  if (trigger.kind === "event" && trigger.action.origin?.app === entry.slug) {
-    return false;
-  }
-  if (trigger.kind === "event" && trigger.action.type === "consent") {
-    return true;
-  }
-  return consentAllows(consent2, entry.slug, entry.app.consent.category, enforced);
-}, "gatePasses");
-var eligibleApps = /* @__PURE__ */ __name((registry3, trigger, consent2, enforced) => {
-  const targets = [];
-  for (const slug of registry3.order) {
-    const app2 = registry3.apps[slug];
-    if (app2 === void 0 || !wantsTrigger(app2, trigger) || !gatePasses({ slug, app: app2 }, trigger, consent2, enforced)) {
-      continue;
-    }
-    const installs = app2.installs.filter((install) => install.active).map(({ id, ord, label }) => ({ id, ord, label }));
-    if (installs.length === 0) {
-      continue;
-    }
-    targets.push({ slug, app: app2, installs });
-  }
-  return targets;
-}, "eligibleApps");
-
-// src/apps/fan-out.ts
-var MAX_APPS_PER_DOMAIN = 50;
-var FAN_OUT_CONCURRENCY = 6;
-var runPool = /* @__PURE__ */ __name(async (limit, tasks) => {
-  const running = /* @__PURE__ */ new Set();
-  for (const task of tasks) {
-    const invocation = task().finally(() => running.delete(invocation));
-    running.add(invocation);
-    if (running.size >= limit) {
-      await Promise.race(running);
-    }
-  }
-  await Promise.all(running);
-}, "runPool");
-var fanOutToApps = /* @__PURE__ */ __name(async (env, trigger, snapshot, { deliverPush, writeAttribution: writeAttribution2, writeContext: writeContext2, budget, trace }) => {
-  const { registry: registry3, error: error51 } = siteRegistry();
-  const targets = eligibleApps(registry3, trigger, snapshot.consent, consentEnforced(env));
-  if (error51 === void 0 && targets.length === 0) {
-    return;
-  }
-  await runInvocation(
-    { name: "do.anon.app_fan_out", trace, attrs: { "fan_out.kind": trigger.kind, "fan_out.apps": targets.length } },
-    async () => {
-      if (error51 !== void 0) {
-        addSpanEvent("apps registry is malformed; apps are off", { level: "error", attrs: { error: error51 } });
-        return;
-      }
-      const context = invocationContext(env);
-      if (context === void 0) {
-        addSpanEvent("apps skipped: APPS_KEY_MASTER or QINTO_DOMAIN_ID is missing", { level: "warn" });
-        return;
-      }
-      const capped = targets.slice(0, MAX_APPS_PER_DOMAIN);
-      if (capped.length < targets.length) {
-        addSpanEvent("eligible apps exceed the per-event budget", {
-          level: "warn",
-          attrs: { eligible: targets.length, cap: MAX_APPS_PER_DOMAIN }
-        });
-      }
-      await runPool(
-        FAN_OUT_CONCURRENCY,
-        capped.map((target) => {
-          return () => invokeApp(env, { target, trigger, snapshot, context, deliverPush, writeAttribution: writeAttribution2, writeContext: writeContext2, budget });
-        })
-      );
-    }
-  );
-}, "fanOutToApps");
-
 // src/apps/transform.ts
 var TRANSFORM_TIMEOUT_MS = 500;
 var TRANSFORM_CHAIN_BUDGET_MS = 1e3;
@@ -25971,9 +26024,29 @@ CREATE UNIQUE INDEX IF NOT EXISTS idx_facts_conversion ON facts (key) WHERE kind
   "ALTER TABLE facts ADD COLUMN expires_at INTEGER;"
 ];
 
+// src/id-graph/anon/token-bucket.ts
+var createTokenBucket = /* @__PURE__ */ __name((capacity, refillPerSecond) => {
+  let tokens = capacity;
+  let updatedAt = null;
+  return {
+    take: /* @__PURE__ */ __name((now) => {
+      if (updatedAt !== null) {
+        tokens = Math.min(capacity, tokens + Math.max(0, now - updatedAt) * (refillPerSecond / 1e3));
+      }
+      updatedAt = now;
+      if (tokens < 1) {
+        return false;
+      }
+      tokens -= 1;
+      return true;
+    }, "take")
+  };
+}, "createTokenBucket");
+
 // src/id-graph/anon/websocket.ts
 var MAX_BROWSER_RESULT_BYTES = 1024;
 var MAX_BROWSER_RESULTS_BYTES = 32 * 1024;
+var MAX_FRAME_BYTES = 64 * 1024;
 var browserContextFrame = external_exports.object({
   occurredAt: external_exports.number().int().nonnegative().safe(),
   page: external_exports.object({ url: external_exports.string().min(1).max(4096), referrer: external_exports.string().min(1).max(4096).optional() }).strict(),
@@ -26046,6 +26119,10 @@ var pluckRef = /* @__PURE__ */ __name((parsed) => {
   return typeof ref === "string" && ref.length > 0 ? ref : void 0;
 }, "pluckRef");
 var parseFrame = /* @__PURE__ */ __name((message) => {
+  const size = typeof message === "string" ? message.length : message.byteLength;
+  if (size > MAX_FRAME_BYTES) {
+    return { ok: false, ref: void 0, error: new Error(`frame exceeds ${MAX_FRAME_BYTES} bytes`) };
+  }
   const text = typeof message === "string" ? message : new TextDecoder().decode(message);
   let parsed;
   try {
@@ -26144,12 +26221,19 @@ var siteAudience = /* @__PURE__ */ __name(({ registry: registry3, app: app2, top
   const allowed = app2.events.publishes.includes(topic) && app2.data.includes(SHARED_CONTEXT_CAPABILITY);
   return allowed ? siteEventReceivers(registry3, consent2, enforced) : null;
 }, "siteAudience");
+var FRAME_BURST = 60;
+var FRAMES_PER_SECOND = 10;
+var EMIT_BURST = 120;
+var EMITS_PER_SECOND = 5;
 var AnonDO = class extends DurableObject2 {
   static {
     __name(this, "AnonDO");
   }
   // Serialize link decisions so concurrent first identifiers cannot split the graph.
   ingestQueue = Promise.resolve();
+  // In memory on purpose: a hibernated socket sent nothing, so a fresh bucket on wake is the right one.
+  frameBuckets = /* @__PURE__ */ new WeakMap();
+  emitBudget = createTokenBucket(EMIT_BURST, EMITS_PER_SECOND);
   // deleteAll removes the live schema; only a later write recreates it.
   wiped = false;
   // Warm write-through mirrors reset together after expiry.
@@ -26192,11 +26276,7 @@ var AnonDO = class extends DurableObject2 {
       const attachment = connectionAttachment(request, geo);
       server.serializeAttachment(attachment);
       this.deliverSharedContext(server);
-      this.appFanOut(
-        { kind: "connect", ...attachment.cf === void 0 ? {} : { geo: attachment.cf }, host: attachment.host },
-        userId,
-        createDataPointBudget()
-      );
+      this.appFanOut({ kind: "connect", ...attachment.cf === void 0 ? {} : { geo: attachment.cf }, host: attachment.host }, userId);
       return new Response(null, { status: 101, webSocket: client });
     });
   }
@@ -26208,9 +26288,50 @@ var AnonDO = class extends DurableObject2 {
       ...action.type === "track" ? { "action.event": action.payload.event } : {}
     };
     return runInvocation({ name: "do.anon.ingest", trace, attrs }, () => {
+      if (action.origin !== void 0 && !this.emitBudget.take(Date.now())) {
+        addSpanEvent("emit rejected: the visitor\u2019s emit budget is spent", {
+          level: "warn",
+          attrs: { app: action.origin.app, depth: action.origin.depth }
+        });
+        return Promise.resolve();
+      }
       return this.ingestLocal(action);
     });
   }
+  // The frames that ask instead of act are answered in place; an action frame comes back to be queued.
+  async answerQuery(ws, parsed, userId, attachment) {
+    const { frame, ref } = parsed;
+    if (frame.t === "getSession") {
+      this.respond(ws, {
+        t: "session",
+        ref,
+        anonId: userId,
+        globalId: linkedGlobalId(this.kv),
+        ip: attachment?.host?.ip ?? null,
+        geo: attachment?.browserGeo ?? null
+      });
+      return null;
+    }
+    if (frame.t === "capture") {
+      const { accepted } = await this.capture({ apps: frame.apps });
+      this.respond(ws, { t: "captureAck", ref, anonId: userId, accepted });
+      return null;
+    }
+    return frame;
+  }
+  admitFrame(ws) {
+    let bucket = this.frameBuckets.get(ws);
+    if (bucket === void 0) {
+      bucket = createTokenBucket(FRAME_BURST, FRAMES_PER_SECOND);
+      this.frameBuckets.set(ws, bucket);
+    }
+    if (bucket.take(Date.now())) {
+      return true;
+    }
+    addSpanEvent("websocket frame rate limited", { level: "warn" });
+    this.respond(ws, { t: "error", ref: void 0, message: "rate limited" });
+    return false;
+  }
   ingestLocal(action) {
     return this.enqueue(() => this.processAction(action));
   }
@@ -26233,6 +26354,9 @@ var AnonDO = class extends DurableObject2 {
   async webSocketMessage(ws, message) {
     const attachment = ws.deserializeAttachment() ?? void 0;
     return runInvocation({ name: "ws.message", attrs: attachment?.attrs }, async () => {
+      if (!this.admitFrame(ws)) {
+        return;
+      }
       const parsed = parseFrame(message);
       if (!parsed.ok) {
         addSpanEvent("invalid websocket frame", { level: "warn", attrs: { error: String(parsed.error) } });
@@ -26250,23 +26374,11 @@ var AnonDO = class extends DurableObject2 {
         this.respond(ws, { t: "error", ref: parsed.ref, message: "session not initialized" });
         return;
       }
-      if (parsed.frame.t === "getSession") {
-        this.respond(ws, {
-          t: "session",
-          ref: parsed.ref,
-          anonId: userId,
-          globalId: linkedGlobalId(this.kv),
-          ip: attachment?.host?.ip ?? null,
-          geo: attachment?.browserGeo ?? null
-        });
+      const frame = await this.answerQuery(ws, { frame: parsed.frame, ref: parsed.ref }, userId, attachment);
+      if (frame === null) {
         return;
       }
-      if (parsed.frame.t === "capture") {
-        const { accepted } = await this.capture({ apps: parsed.frame.apps });
-        this.respond(ws, { t: "captureAck", ref: parsed.ref, anonId: userId, accepted });
-        return;
-      }
-      const action = actionFromFrame(parsed.frame, userId, attachment?.cf, attachment?.host);
+      const action = actionFromFrame(frame, userId, attachment?.cf, attachment?.host);
       const ref = parsed.ref ?? action.actionId;
       setSpanAttributes({ "action.id": action.actionId });
       try {
@@ -26303,6 +26415,21 @@ var AnonDO = class extends DurableObject2 {
       });
     });
   }
+  // Returns without awaiting the chain: the fan-out worker must not wait on this object's queue. The
+  // chain runs outside the queue turn on purpose — applyEffects awaits attributionDelivery and
+  // contextDelivery, which enqueue, so a queued task would wait on work chained behind itself.
+  appEffects(input, trace) {
+    const run = runInvocation({ name: "do.anon.app_effects", trace, attrs: { "app.slug": input.slug } }, () => {
+      return applyEffects(this.env, {
+        ...input,
+        deliverPush: this.pushDelivery,
+        writeAttribution: this.attributionDelivery,
+        writeContext: this.contextDelivery
+      });
+    });
+    this.ctx.waitUntil(run.catch((error51) => console.warn("app effects failed", { app: input.slug, error: error51 })));
+    return Promise.resolve();
+  }
   // Returns what storage now holds, not what policy allowed: the browser memoes exactly these pairs,
   // so a value the caps refused must never be reported as stored.
   capture(input, trace) {
@@ -26519,7 +26646,7 @@ var AnonDO = class extends DurableObject2 {
   consentReply(ref, userId) {
     return { t: "consentState", ref, ...userId === null ? {} : { anonId: userId }, ...consentState2(this.kv) };
   }
-  pushDelivery = /* @__PURE__ */ __name((push) => {
+  pushDelivery = /* @__PURE__ */ __name(async (push) => {
     this.deliverAppPush(push);
   }, "pushDelivery");
   // Calls the public method directly: it enqueues internally, and both effect paths already run
@@ -26544,13 +26671,12 @@ var AnonDO = class extends DurableObject2 {
       if (isNoopAction(action)) {
         return;
       }
-      const dataPoints = createDataPointBudget();
-      const transformed = await this.transformAction(action, dataPoints);
+      const transformed = await this.transformAction(action, createDataPointBudget());
       if (transformed === null) {
         return;
       }
       recorded = transformed.action;
-      await this.runAction(transformed.action, transformed.releaseEmissions, dataPoints);
+      await this.runAction(transformed.action, transformed.releaseEmissions);
     } finally {
       this.recordActionBlocks(recorded);
     }
@@ -26560,9 +26686,9 @@ var AnonDO = class extends DurableObject2 {
       actionBlocks(action, this.appsSnapshot(action.userId), this.wiped ? [] : allIdentifiers(this.sql, this.identifiersMirror))
     );
   }
-  async runAction(current, releaseEmissions, dataPoints) {
+  async runAction(current, releaseEmissions) {
     if (current.type !== "alias" && isDeliveryOnlyAction(current)) {
-      this.appFanOut({ kind: "event", action: current }, current.userId, dataPoints);
+      this.appFanOut({ kind: "event", action: current }, current.userId);
       this.releaseTransformEmissions(releaseEmissions);
       return;
     }
@@ -26598,7 +26724,7 @@ var AnonDO = class extends DurableObject2 {
       } else {
         await this.ingestConsent(current);
       }
-      this.appFanOut({ kind: "event", action: current }, current.userId, dataPoints);
+      this.appFanOut({ kind: "event", action: current }, current.userId);
       this.releaseTransformEmissions(releaseEmissions);
     } finally {
       if (novelIdentifier) {
@@ -26653,16 +26779,16 @@ var AnonDO = class extends DurableObject2 {
     }
     this.ctx.waitUntil(release().catch((error51) => console.warn("transform emission release failed", { error: error51 })));
   }
-  appFanOut(trigger, anonId, dataPoints) {
-    const snapshot = this.appsSnapshot(anonId);
+  appFanOut(trigger, anonId) {
+    const { registry: registry3, error: error51 } = siteRegistry();
+    if (error51 === void 0 && eligibleApps(registry3, trigger, consentState2(this.kv), consentEnforced(this.env)).length === 0) {
+      return;
+    }
+    const job = { trigger, snapshot: this.appsSnapshot(anonId), trace: currentTraceContext() };
     this.ctx.waitUntil(
-      fanOutToApps(this.env, trigger, snapshot, {
-        deliverPush: this.pushDelivery,
-        writeAttribution: this.attributionDelivery,
-        writeContext: this.contextDelivery,
-        budget: dataPoints,
-        trace: currentTraceContext()
-      }).catch((error51) => console.warn("app fan-out failed", { error: error51 }))
+      traced("rpc fan_out.run", {}, () => {
+        return this.ctx.exports.FanOut.run(job);
+      }).catch((error52) => console.warn("app fan-out hand-off failed", { error: error52 }))
     );
   }
   getProperties(trace) {
@@ -27009,6 +27135,19 @@ var AnonDO = class extends DurableObject2 {
 // src/id-graph/global/do.ts
 import { DurableObject as DurableObject3 } from "cloudflare:workers";
 
+// src/helpers/run-pool.ts
+var runPool = /* @__PURE__ */ __name(async (limit, tasks) => {
+  const running = /* @__PURE__ */ new Set();
+  for (const task of tasks) {
+    const invocation = task().finally(() => running.delete(invocation));
+    running.add(invocation);
+    if (running.size >= limit) {
+      await Promise.race(running);
+    }
+  }
+  await Promise.all(running);
+}, "runPool");
+
 // src/id-graph/global/facts.ts
 var FACT_KINDS2 = [...PROJECTION_KINDS, "identifier", "conversion", "anon"];
 var FACT_COLUMNS = "kind, scope, key, value, source, amount, currency, event_id, data_json, first_at, observed_at";
@@ -27192,6 +27331,7 @@ CREATE UNIQUE INDEX IF NOT EXISTS idx_facts_key ON facts (kind, scope, key);
 ];
 
 // src/id-graph/global/do.ts
+var SIBLING_FAN_OUT_CONCURRENCY = 6;
 var GlobalDO = class extends DurableObject3 {
   static {
     __name(this, "GlobalDO");
@@ -27293,8 +27433,9 @@ var GlobalDO = class extends DurableObject3 {
     }
     await runInvocation({ name: "do.global.fan_out", trace, attrs: { "global.id": globalId } }, async () => {
       const snapshot = this.snapshot(globalId);
-      await Promise.all(
-        recipients.map(async (anonId) => {
+      await runPool(
+        SIBLING_FAN_OUT_CONCURRENCY,
+        recipients.map((anonId) => async () => {
           try {
             await traced("rpc anon.sync_from_global", { attrs: { "anon.id": anonId } }, () => {
               return anonStub(this.env, anonId).syncFromGlobal(snapshot, currentTraceContext());
@@ -27317,8 +27458,10 @@ app.use("/q.js", cors());
 app.get("/q.js", qJs);
 app.use("/health", cors());
 app.route("/", health);
+var MAX_V1_BODY_BYTES = 1024 * 1024;
 var allowCors = cors({ origin: /* @__PURE__ */ __name((origin) => origin, "origin"), credentials: true });
 app.use("/v1/*", allowCors);
+app.use("/v1/*", bodyLimit({ maxSize: MAX_V1_BODY_BYTES, onError: /* @__PURE__ */ __name((c) => c.json({ error: "too_large" }, 413), "onError") }));
 app.route("/", alias);
 app.route("/", identify);
 app.route("/", track);
@@ -27359,6 +27502,7 @@ export {
   AliasDO,
   AnonDO,
   Broker,
+  FanOut,
   GlobalDO,
   app,
   index_default as default