@blotout/qinto-cli 0.1.16 → 0.1.18

package/dist/worker-artifact/app-runtime/index.js

@@ -18115,10 +18115,10 @@ var stringbool = (...args) => _stringbool({
   String: ZodString
 }, ...args);
 function json(params) {
-  const jsonSchema = lazy(() => {
-    return union([string2(params), number2(), boolean2(), _null3(), array(jsonSchema), record(string2(), jsonSchema)]);
+  const jsonSchema2 = lazy(() => {
+    return union([string2(params), number2(), boolean2(), _null3(), array(jsonSchema2), record(string2(), jsonSchema2)]);
   });
-  return jsonSchema;
+  return jsonSchema2;
 }
 function preprocess(fn, schema) {
   return new ZodPreprocess({
@@ -18945,6 +18945,7 @@ function date4(params) {
 var IDENTIFIER = /^[a-z][a-z0-9-]*$/;
 var VARIABLE_NAME = /^[A-Z][A-Z0-9_]*$/;
 var APP_SLUG_PATTERN = /^[a-z][a-z0-9-]{2,29}$/;
+var FUNCTION_NAME = /^[a-zA-Z_$][a-zA-Z0-9_$]*$/;
 var identifierField = external_exports.string().min(1).max(64).regex(IDENTIFIER);
 var httpsUrl = (field2) => {
   return external_exports.url().max(2048).refine((value) => value.startsWith("https://"), `${field2} must be an HTTPS URL`);
@@ -18958,6 +18959,10 @@ var uniqueOrIssue = (ctx, values, path, label) => {
     seen.add(value);
   }
 };
+var PLATFORM_ZONES = ["blotout.io", "qinto.tech"];
+var isPlatformHost = (host) => {
+  return PLATFORM_ZONES.some((zone) => host === zone || host.endsWith(`.${zone}`));
+};
 
 // ../../../libs/app-manifest/src/oauth.ts
 var OAUTH_TOKEN_METHODS = ["POST", "GET"];
@@ -18987,8 +18992,7 @@ var RESERVED_AUTHORIZE_PARAMS = /* @__PURE__ */ new Set([
 var PRIVATE_HOST = /^(localhost|\[?::1\]?|.+\.local|.+\.internal|10\..+|127\..+|169\.254\..+|192\.168\..+|172\.(1[6-9]|2\d|3[01])\..+|\d+\.\d+\.\d+\.\d+)$/;
 var vendorUrl = (field2) => {
   return httpsUrl(field2).refine((value) => {
-    const host = new URL(value).hostname;
-    return host !== "qinto.io" && !host.endsWith(".qinto.io") && host !== "qinto.tech" && !host.endsWith(".qinto.tech");
+    return !isPlatformHost(new URL(value).hostname);
   }, `${field2} must be the vendor's own endpoint, not a Qinto platform URL`).refine((value) => {
     return !PRIVATE_HOST.test(new URL(value).hostname);
   }, `${field2} must be a public host`).refine((value) => {
@@ -19345,7 +19349,6 @@ var MAX_MANIFEST_MIGRATION_BYTES = 1024 * 1024;
 var BINDING_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
 var CLASS_NAME = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
 var MIGRATION_ID = /^[a-z0-9][a-z0-9-]*$/;
-var FUNCTION_NAME = /^[a-zA-Z_$][a-zA-Z0-9_$]*$/;
 var EVENT_TOPIC = /^[a-z][a-z0-9:_-]*$/;
 var QUERY_PARAM_NAME = /^[A-Za-z0-9_.-]+$/;
 var COOKIE_NAME = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
@@ -19383,10 +19386,10 @@ var PLATFORM_APP_RESOURCE_IDENTIFIERS = {
 };
 var PLATFORM_APP_VARIABLE_IDENTIFIER_PREFIX = "var-";
 var PLATFORM_APP_SCOPE_VARIABLE_IDENTIFIER_PREFIX = "appvar-";
+var STORAGE_LINK_BINDING_PREFIX = "QINTO_LINK_";
 var legalUrl = (field2) => {
   return httpsUrl(field2).refine((value) => {
-    const host = new URL(value).hostname;
-    return host !== "qinto.io" && !host.endsWith(".qinto.io");
+    return !isPlatformHost(new URL(value).hostname);
   }, `${field2} must be the developer's own document, not a Qinto platform URL`);
 };
 var bindingField = external_exports.string().min(1).max(255).regex(BINDING_NAME);
@@ -19559,7 +19562,7 @@ var captureSchema = external_exports.object({
 var endpointSchema = external_exports.object({
   path: external_exports.string().min(1).max(255).regex(ENDPOINT_PATH_PATTERN, "Endpoint paths are absolute; each segment is a literal or a :name parameter"),
   methods: external_exports.array(external_exports.enum(["GET", "POST", "PUT", "PATCH", "DELETE"])).min(1).max(5),
-  auth: external_exports.enum(["public", "token"]),
+  auth: external_exports.enum(["public", "token", "visitor"]),
   mode: external_exports.enum(["webhook", "api"])
 }).strict();
 var eventsSchema = external_exports.object({
@@ -19653,7 +19656,7 @@ var validateBindings = (manifest, ctx) => {
     "variable name"
   );
   for (const [index, resource] of manifest.resources.entries()) {
-    if (reserved.has(resource.binding) || resource.binding.startsWith("VAR_") || resource.binding.startsWith("APPVAR_") || resource.binding.startsWith(PLATFORM_APP_OAUTH_BINDING_PREFIX)) {
+    if (reserved.has(resource.binding) || resource.binding.startsWith("VAR_") || resource.binding.startsWith("APPVAR_") || resource.binding.startsWith(PLATFORM_APP_OAUTH_BINDING_PREFIX) || resource.binding.startsWith(STORAGE_LINK_BINDING_PREFIX)) {
       ctx.addIssue({ code: "custom", path: ["resources", index, "binding"], message: `Binding ${resource.binding} is reserved` });
     }
     if (reservedIdentifiers.has(resource.identifier) || resource.identifier.startsWith(PLATFORM_APP_VARIABLE_IDENTIFIER_PREFIX) || resource.identifier.startsWith(PLATFORM_APP_SCOPE_VARIABLE_IDENTIFIER_PREFIX)) {
@@ -19785,6 +19788,22 @@ var validatePipelines = (manifest, ctx) => {
     }
   }
 };
+var validateVisitorEndpoint = (manifest, ctx, endpoint, index) => {
+  if (endpoint.mode !== "api") {
+    ctx.addIssue({
+      code: "custom",
+      path: ["endpoints", index, "mode"],
+      message: "A visitor endpoint answers one visitor, so its mode must be api"
+    });
+  }
+  if (manifest.browser?.entry === void 0) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["endpoints", index, "auth"],
+      message: "A visitor endpoint is called by the app's own browser code, so it needs a browser entry"
+    });
+  }
+};
 var validateEndpoints = (manifest, ctx) => {
   const shapes = /* @__PURE__ */ new Map();
   for (const [index, endpoint] of manifest.endpoints.entries()) {
@@ -19810,7 +19829,9 @@ var validateEndpoints = (manifest, ctx) => {
         message: `Endpoint path ${endpoint.path} names the parameter ${repeated} twice`
       });
     }
-    if (endpoint.mode === "api" && manifest.install.multiple) {
+    if (endpoint.auth === "visitor") {
+      validateVisitorEndpoint(manifest, ctx, endpoint, index);
+    } else if (endpoint.mode === "api" && manifest.install.multiple) {
       ctx.addIssue({
         code: "custom",
         path: ["endpoints", index, "mode"],
@@ -19956,8 +19977,17 @@ var appManifestSchema = baseSchema.superRefine((manifest, ctx) => {
 var MAX_VENDOR_BODY_BYTES = 64 * 1024;
 var MAX_EXPIRES_IN_SECONDS = 365 * 24 * 60 * 60;
 
+// ../../../libs/app-manifest/src/rpc-contract.ts
+var MAX_RPC_CONTRACT_BYTES = 256 * 1024;
+var jsonSchema = external_exports.record(external_exports.string(), external_exports.unknown());
+var rpcFunctionContractSchema = external_exports.object({ visibility: external_exports.enum(["public", "private"]), input: jsonSchema, output: jsonSchema }).strict();
+var appRpcContractSchema = external_exports.record(external_exports.string().regex(FUNCTION_NAME).max(64), rpcFunctionContractSchema).refine((contract) => Object.keys(contract).length <= 32, "An RPC contract carries at most 32 functions").refine((contract) => {
+  return new TextEncoder().encode(JSON.stringify(contract)).length <= MAX_RPC_CONTRACT_BYTES;
+}, "The RPC contract exceeds the size cap");
+
 // ../../../libs/app-envelope/src/envelope.ts
-var ENVELOPE_VERSION = 2;
+var ENVELOPE_VERSION = 3;
+var ENVELOPE_ERROR_CODES = ["invalid_arguments"];
 var MAX_INSTALLS_PER_APP = 15;
 var MAX_EMITS_PER_INSTALL = 10;
 var MAX_PUSHES_PER_INSTALL = 10;
@@ -20011,12 +20041,12 @@ var actionContextSchema = external_exports.discriminatedUnion("source", [
 var envelopeRequestSchema = external_exports.object({
   v: external_exports.literal(ENVELOPE_VERSION),
   kind: external_exports.enum(["event", "connect", "transform", "rpc"]),
-  site: external_exports.object({ origin: external_exports.string().min(1).max(255) }).strict(),
   app: external_exports.object({ slug: external_exports.string().min(1).max(30), version: external_exports.string().min(1).max(32) }).strict(),
   installs: external_exports.array(installSchema).min(1).max(MAX_INSTALLS_PER_APP),
   user: external_exports.object({
     anonId: external_exports.string().min(1).max(64),
     globalId: external_exports.string().min(1).max(64).nullable(),
+    createdAt: external_exports.number().int().optional(),
     properties: external_exports.record(external_exports.string(), external_exports.unknown()),
     geo: external_exports.record(external_exports.string(), external_exports.string()).optional()
   }).strict().optional(),
@@ -20056,13 +20086,14 @@ var envelopeResponseSchema = external_exports.object({
   rpc: external_exports.object({ result: external_exports.unknown() }).strict().refine((rpc) => {
     return new TextEncoder().encode(JSON.stringify(rpc.result ?? null)).length <= MAX_RPC_BYTES;
   }, "RPC result exceeds the size cap").optional(),
-  error: external_exports.object({ message: external_exports.string().max(2048) }).strict().optional()
+  error: external_exports.object({ message: external_exports.string().max(2048), code: external_exports.enum(ENVELOPE_ERROR_CODES).optional() }).strict().optional()
 }).strict();
 
 // ../../../libs/app-envelope/src/control.ts
-var CONTROL_ENVELOPE_VERSION = 1;
+var CONTROL_ENVELOPE_VERSION = 2;
 var MAX_CONTROL_BYTES = 256 * 1024;
 var MAX_MIGRATION_CHECKPOINT_BYTES = 16 * 1024;
+var MIGRATION_DATABASE_LINK_CHANGED = "migration_database_link_changed";
 var MAX_TOOL_ARGUMENTS_BYTES = 32 * 1024;
 var MAX_TOOL_RESULT_BYTES = 64 * 1024;
 var MAX_TOOL_DATA_DEPTH = 8;
@@ -20163,7 +20194,6 @@ var toolSchema2 = external_exports.object({
 var controlEnvelopeSchema = external_exports.object({
   v: external_exports.literal(CONTROL_ENVELOPE_VERSION),
   kind: external_exports.enum(["noop", "lifecycle", "migration", "schedule", "tool"]),
-  site: external_exports.object({ origin: external_exports.string().min(1).max(255) }).strict(),
   app: external_exports.object({ slug: external_exports.string().min(1).max(30), version: external_exports.string().min(1).max(32) }).strict(),
   install: external_exports.object({ id: external_exports.string().min(1).max(64), ord: external_exports.number().int().min(1), label: external_exports.string().max(100) }).strict().optional(),
   lifecycle: lifecycleEventSchema.optional(),
@@ -20237,6 +20267,7 @@ var controlResponseSchema = external_exports.object({
 var ENDPOINT_CONTEXT_HEADER = "x-qinto-endpoint-context";
 var ENDPOINT_OUTCOMES_HEADER = "x-qinto-endpoint-outcomes";
 var MAX_ENDPOINT_BODY_BYTES = 1024 * 1024;
+var MAX_VISITOR_ENDPOINT_BODY_BYTES = 2 * 1024 * 1024;
 var MAX_ENDPOINT_OUTCOMES_BYTES = 64 * 1024;
 var MAX_ENDPOINT_PATH_LENGTH = 16 * 1024;
 var installSchema3 = external_exports.object({ id: external_exports.string().min(1).max(64), ord: external_exports.number().int().min(1), label: external_exports.string().max(100) }).strict();
@@ -20252,12 +20283,14 @@ var endpointContextSchema = external_exports.object({
   method: external_exports.enum(["GET", "POST", "PUT", "PATCH", "DELETE"]),
   mode: external_exports.enum(["webhook", "api"]),
   version: external_exports.string().min(1).max(32),
-  site: external_exports.object({ origin: external_exports.string().min(1).max(255) }).strict(),
   geo: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
-  installs: external_exports.array(installSchema3).min(1).max(15)
+  installs: external_exports.array(installSchema3).min(1).max(15),
+  user: external_exports.object({ anonId: external_exports.string().min(1).max(64) }).strict().optional()
 }).strict().refine((context) => {
   return context.mode === "webhook" || context.installs.length === 1;
-}, "An api endpoint carries exactly one install");
+}, "An api endpoint carries exactly one install").refine((context) => {
+  return context.user === void 0 || context.mode === "api";
+}, "Only an api endpoint carries a visitor");
 var endpointOutcomesSchema = external_exports.object({
   outcomes: external_exports.array(
     external_exports.object({
@@ -20868,6 +20901,10 @@ var siteChannel = (env) => {
 var channelFetch = (env, init) => {
   return siteChannel(env).fetch(BROKER_URL, init);
 };
+var brokerFailure = (answer, status) => {
+  const error61 = answer.error ?? `the broker answered ${status}`;
+  return answer.message === void 0 ? error61 : `${error61}: ${answer.message}`;
+};
 var askBroker = async (env, name, body) => {
   return traced(name, {}, async () => {
     const headers = { "content-type": "application/json" };
@@ -20891,7 +20928,7 @@ var askBroker = async (env, name, body) => {
     }
     const answer = parsed;
     if (answer.error !== void 0 || !response.ok) {
-      throw new Error(answer.error ?? `the broker answered ${response.status}`);
+      throw new Error(brokerFailure(answer, response.status));
     }
     return answer;
   });
@@ -21269,9 +21306,13 @@ var parseVariableMaps = (env) => {
   }
   return maps;
 };
-var contextKindsOf = (env) => {
+var appContextOf = (env) => {
+  const context = JSON.parse(env.APP_CONTEXT);
+  return { variableKinds: context.variableKinds ?? {}, appVariableKinds: context.appVariableKinds ?? {}, site: context.site };
+};
+var linkedDatabasesOf = (env) => {
   const context = JSON.parse(env.APP_CONTEXT);
-  return { variableKinds: context.variableKinds ?? {}, appVariableKinds: context.appVariableKinds ?? {} };
+  return context.linkedDatabases ?? [];
 };
 var projectAppValues = (env, kinds) => {
   const appVariables = {};
@@ -21290,7 +21331,7 @@ var projectAppValues = (env, kinds) => {
   return { appVariables, appSecrets };
 };
 var secretValues = (env) => {
-  const { variableKinds, appVariableKinds } = contextKindsOf(env);
+  const { variableKinds, appVariableKinds } = appContextOf(env);
   const values = /* @__PURE__ */ new Set();
   for (const [name, byOrd] of parseVariableMaps(env)) {
     if (variableKinds[name] !== "secret") {
@@ -21477,7 +21518,7 @@ var readStamp = (payload) => {
   return { q: stamp, payload: params?.payload };
 };
 var buildWorkflowContext = (env, stamp) => {
-  const { variableKinds, appVariableKinds } = contextKindsOf(env);
+  const { variableKinds, appVariableKinds } = appContextOf(env);
   const { variables, secrets } = projectInstallValues(parseVariableMaps(env), variableKinds, stamp.ord);
   const { appVariables, appSecrets } = projectAppValues(env, appVariableKinds);
   const install = { id: stamp.installId, label: stamp.installLabel };
@@ -21548,6 +21589,7 @@ var createWorkflow = (className, bundle) => {
 var buildContext = ({
   env,
   envelope,
+  site,
   install,
   maps,
   kinds,
@@ -21561,7 +21603,7 @@ var buildContext = ({
   const subject = envelope.user?.anonId ?? null;
   return {
     env,
-    site: envelope.site,
+    site,
     install: { id: install.id, label: install.label },
     startWorkflow: buildStartWorkflow({
       ord: install.ord,
@@ -21725,7 +21767,7 @@ var dispatchSchedule = async (envelope, bundle, env) => {
       error: { message: `missing handler: schedules.${schedule.id}` }
     });
   }
-  const { variableKinds, appVariableKinds } = contextKindsOf(env);
+  const { variableKinds, appVariableKinds, site } = appContextOf(env);
   const maps = parseVariableMaps(env);
   const appScope = projectAppValues(env, appVariableKinds);
   const event = { id: schedule.id, cron: schedule.cron, scheduledTime: new Date(schedule.scheduledTime) };
@@ -21734,7 +21776,7 @@ var dispatchSchedule = async (envelope, bundle, env) => {
     const { variables, secrets } = projectInstallValues(maps, variableKinds, install.ord);
     const context = {
       env,
-      site: envelope.site,
+      site,
       install: { id: install.id, label: install.label },
       startWorkflow: buildStartWorkflow({
         ord: install.ord,
@@ -21759,6 +21801,11 @@ var dispatchSchedule = async (envelope, bundle, env) => {
           data: message.data,
           broadcast: message.broadcast
         });
+      },
+      context: (userId) => {
+        return asyncContext(env, () => {
+          return userId;
+        });
       }
     };
     try {
@@ -21852,13 +21899,13 @@ var checkResult = (result) => {
 };
 var buildContext2 = (envelope, env) => {
   const install = envelope.install;
-  const { variableKinds, appVariableKinds } = contextKindsOf(env);
+  const { variableKinds, appVariableKinds, site } = appContextOf(env);
   const maps = parseVariableMaps(env);
   const appScope = projectAppValues(env, appVariableKinds);
   const { variables, secrets } = projectInstallValues(maps, variableKinds, install.ord);
   return {
     env,
-    site: envelope.site,
+    site,
     install: { id: install.id, label: install.label },
     viewer: envelope.tool.viewer,
     callId: envelope.tool.callId,
@@ -21922,20 +21969,21 @@ var controlError = (status, message) => {
   return json2(status, { v: CONTROL_ENVELOPE_VERSION, ok: false, error: { message } });
 };
 var controlContextValues = (env) => {
-  const { variableKinds, appVariableKinds } = contextKindsOf(env);
+  const { variableKinds, appVariableKinds, site } = appContextOf(env);
   return {
     maps: parseVariableMaps(env),
     variableKinds,
+    site,
     appScope: projectAppValues(env, appVariableKinds)
   };
 };
 var lifecycleContext = (env, envelope) => {
   const install = envelope.install;
-  const { maps, variableKinds, appScope } = controlContextValues(env);
+  const { maps, variableKinds, site, appScope } = controlContextValues(env);
   const { variables, secrets } = projectInstallValues(maps, variableKinds, install.ord);
   return {
     env,
-    site: envelope.site,
+    site,
     install: { id: install.id, label: install.label },
     variables,
     secrets,
@@ -21950,11 +21998,11 @@ var lifecycleContext = (env, envelope) => {
     observability: buildObservability(install.ord)
   };
 };
-var migrationContext = (env, envelope) => {
-  const { appScope } = controlContextValues(env);
+var migrationContext = (env) => {
+  const { site, appScope } = controlContextValues(env);
   return {
     env,
-    site: envelope.site,
+    site,
     appVariables: appScope.appVariables,
     appSecrets: appScope.appSecrets,
     // A migration runs once for the site, not once per install, so it has no install to attribute
@@ -21998,6 +22046,9 @@ var dispatchLifecycle = async (envelope, bundle, env) => {
 };
 var dispatchMigration = async (envelope, bundle, env) => {
   const migration = envelope.migration;
+  if (linkedDatabasesOf(env).includes(migration.resource)) {
+    return json2(200, { v: CONTROL_ENVELOPE_VERSION, ok: false, error: { message: MIGRATION_DATABASE_LINK_CHANGED } });
+  }
   try {
     if (migration.phase !== "backfill") {
       await runStatementMigration(env, migration);
@@ -22007,10 +22058,7 @@ var dispatchMigration = async (envelope, bundle, env) => {
     if (typeof handler !== "function") {
       throw new Error(`missing migration handler: ${migration.handler}`);
     }
-    const result = await handler(
-      { id: migration.id, checkpoint: migration.checkpoint },
-      migrationContext(env, envelope)
-    );
+    const result = await handler({ id: migration.id, checkpoint: migration.checkpoint }, migrationContext(env));
     if (result.done !== true && result.done !== false) {
       throw new Error("migration handler returned no completion result");
     }
@@ -22099,7 +22147,8 @@ var buildContext3 = ({
   install,
   site,
   geo,
-  params
+  params,
+  user
 }) => {
   const { variables, secrets } = projectInstallValues(maps, kinds, install.ord);
   return {
@@ -22108,9 +22157,13 @@ var buildContext3 = ({
     geo,
     params,
     install: { id: install.id, label: install.label },
-    // An endpoint has no visitor, so a workflow it starts cannot push. `push` below is the
-    // exception: it names its subject rather than inheriting one.
-    startWorkflow: buildStartWorkflow({ ord: install.ord, installId: install.id, installLabel: install.label, anonId: null }),
+    ...user === void 0 ? {} : { user: { anonId: user.anonId, globalId: null, properties: {} } },
+    startWorkflow: buildStartWorkflow({
+      ord: install.ord,
+      installId: install.id,
+      installLabel: install.label,
+      anonId: user?.anonId ?? null
+    }),
     oauth: buildOauth(env, install.ord),
     variables,
     secrets,
@@ -22128,6 +22181,11 @@ var buildContext3 = ({
         broadcast: message.broadcast
       });
     },
+    context: (userId) => {
+      return asyncContext(env, () => {
+        return userId;
+      });
+    },
     skip: () => {
       return { kind: "skip" };
     }
@@ -22171,6 +22229,21 @@ var runWebhook = async (invoke, installs) => {
   }
   return Response.json({ outcomes }, { headers: { [ENDPOINT_OUTCOMES_HEADER]: "1" } });
 };
+var endpointHandler = (bundle, context) => {
+  const endpoints = bundle?.endpoints;
+  const candidate = endpoints !== void 0 && Object.hasOwn(endpoints, context.route) ? endpoints[context.route] : void 0;
+  if (typeof candidate === "function") {
+    return candidate;
+  }
+  const visitor = typeof candidate === "object" && candidate !== null ? candidate.__qintoVisitorEndpoint : void 0;
+  if (typeof visitor !== "function") {
+    return Response.json({ error: "not_found" }, { status: 404 });
+  }
+  if (context.user === void 0) {
+    return Response.json({ error: "invalid_context" }, { status: 400 });
+  }
+  return visitor;
+};
 var dispatchEndpoint = async ({ request, env, versions }) => {
   const context = parseContext(request.headers.get(ENDPOINT_CONTEXT_HEADER));
   if (context === null) {
@@ -22179,22 +22252,29 @@ var dispatchEndpoint = async ({ request, env, versions }) => {
   if (!(context.version in versions)) {
     return Response.json({ error: "unknown version" }, { status: 404 });
   }
-  const bundle = versions[context.version];
-  const endpoints = bundle?.endpoints;
-  const candidate = endpoints !== void 0 && Object.hasOwn(endpoints, context.route) ? endpoints[context.route] : void 0;
-  if (typeof candidate !== "function") {
-    return Response.json({ error: "not_found" }, { status: 404 });
+  const handler = endpointHandler(versions[context.version], context);
+  if (handler instanceof Response) {
+    return handler;
   }
-  const handler = candidate;
   const body = await request.arrayBuffer();
   const maps = parseVariableMaps(env);
-  const { variableKinds, appVariableKinds } = contextKindsOf(env);
+  const { variableKinds, appVariableKinds, site } = appContextOf(env);
   const appScope = projectAppValues(env, appVariableKinds);
   const invoke = async (install) => {
     return installSpan(install, () => {
       return handler(
         handlerRequest(request, context, body),
-        buildContext3({ env, maps, kinds: variableKinds, appScope, install, site: context.site, geo: context.geo, params: context.params })
+        buildContext3({
+          env,
+          maps,
+          kinds: variableKinds,
+          appScope,
+          install,
+          site,
+          geo: context.geo,
+          params: context.params,
+          user: context.user
+        })
       );
     });
   };
@@ -22300,6 +22380,42 @@ var withPipelineRetry = (env, bindings) => {
   return wrapped;
 };
 
+// src/rpc-definition.ts
+var isSchema = (candidate) => {
+  return typeof candidate === "object" && candidate !== null && "~standard" in candidate;
+};
+var rpcDefinitionOf = (candidate) => {
+  if (typeof candidate !== "object" || candidate === null || !("__qintoRpc" in candidate)) {
+    return void 0;
+  }
+  const marker = candidate.__qintoRpc;
+  if (typeof marker !== "object" || marker === null || !("handler" in marker) || typeof marker.handler !== "function") {
+    return void 0;
+  }
+  const definition = { handler: marker.handler };
+  if ("input" in marker && isSchema(marker.input)) {
+    definition.input = marker.input;
+  }
+  if ("output" in marker && isSchema(marker.output)) {
+    definition.output = marker.output;
+  }
+  return definition;
+};
+var checkAgainst = async (schema, value) => {
+  if (schema === void 0) {
+    return { ok: true, value };
+  }
+  const result = await schema["~standard"].validate(value);
+  if (result.issues === void 0) {
+    return { ok: true, value: result.value };
+  }
+  const message = result.issues.map((issue2) => {
+    const path = (issue2.path ?? []).map((segment) => String(typeof segment === "object" ? segment.key : segment)).join(".");
+    return path === "" ? issue2.message : `${path}: ${issue2.message}`;
+  }).join("; ");
+  return { ok: false, message };
+};
+
 // src/traced-fetch.ts
 var MAX_BODY_CHARS = 65536;
 var TOO_LARGE = `[not recorded: the body is over ${MAX_BODY_CHARS} characters]`;
@@ -22446,12 +22562,13 @@ var dispatchUi = async ({ request, env, versions }) => {
   if (handler === void 0) {
     return Response.json({ error: "not_found" }, { status: 404 });
   }
-  const { variableKinds, appVariableKinds } = contextKindsOf(env);
+  const { variableKinds, appVariableKinds, site } = appContextOf(env);
   const maps = parseVariableMaps(env);
   const { variables, secrets } = projectInstallValues(maps, variableKinds, context.install.ord);
   const { appVariables, appSecrets } = projectAppValues(env, appVariableKinds);
   const ctx = {
     env,
+    site,
     install: { id: context.install.id, label: context.install.label },
     installs: projectAllInstallValues(maps, variableKinds, context.installs),
     // The install is named rather than inherited: one panel serves every install, and reading the
@@ -22531,7 +22648,7 @@ var projectAction = (action, installId) => {
 };
 var runInstalls = async (envelope, env, invoke) => {
   const maps = parseVariableMaps(env);
-  const { variableKinds: kinds, appVariableKinds } = contextKindsOf(env);
+  const { variableKinds: kinds, appVariableKinds, site } = appContextOf(env);
   const appScope = projectAppValues(env, appVariableKinds);
   const groups = [];
   let failure2;
@@ -22540,7 +22657,7 @@ var runInstalls = async (envelope, env, invoke) => {
     const pushes = [];
     const captures = [];
     const context = contextCollector();
-    const ctx = buildContext({ env, envelope, install, maps, kinds, appScope, emits, pushes, captures, context });
+    const ctx = buildContext({ env, envelope, site, install, maps, kinds, appScope, emits, pushes, captures, context });
     try {
       await installSpan(install, () => {
         return invoke(ctx, install);
@@ -22588,11 +22705,12 @@ var runTransform = async (envelope, env, action, handler) => {
   const captures = [];
   const context = contextCollector();
   const maps = parseVariableMaps(env);
-  const { variableKinds: kinds, appVariableKinds } = contextKindsOf(env);
+  const { variableKinds: kinds, appVariableKinds, site } = appContextOf(env);
   const appScope = projectAppValues(env, appVariableKinds);
   const { apps: _apps, ...withoutApps } = buildContext({
     env,
     envelope,
+    site,
     install,
     maps,
     kinds,
@@ -22660,21 +22778,25 @@ var dispatchRpc = async (envelope, bundle, env) => {
   if (rpc === void 0) {
     return jsonError(400, "rpc envelope carries no rpc call");
   }
-  const handler = toHandler(bundle?.rpc?.[rpc.fn]);
-  if (handler === void 0) {
+  const definition = rpcDefinitionOf(bundle?.rpc?.[rpc.fn]);
+  if (definition === void 0) {
     return jsonError(200, `missing handler: rpc.${rpc.fn}`);
   }
+  const args = await checkAgainst(definition.input, rpc.args);
+  if (!args.ok) {
+    return json2(200, { v: ENVELOPE_VERSION, error: { code: "invalid_arguments", message: failureMessage(args.message) } });
+  }
   const install = envelope.installs[0];
   const emits = [];
   const pushes = [];
   const captures = [];
   const context = contextCollector();
   const maps = parseVariableMaps(env);
-  const { variableKinds: kinds, appVariableKinds } = contextKindsOf(env);
+  const { variableKinds: kinds, appVariableKinds, site } = appContextOf(env);
   const appScope = projectAppValues(env, appVariableKinds);
   const subject = envelope.user?.anonId ?? null;
   const ctx = {
-    ...buildContext({ env, envelope, install, maps, kinds, appScope, emits, pushes, captures, context }),
+    ...buildContext({ env, envelope, site, install, maps, kinds, appScope, emits, pushes, captures, context }),
     context: fetchedContext(
       env,
       (what) => {
@@ -22686,14 +22808,18 @@ var dispatchRpc = async (envelope, bundle, env) => {
   let value;
   try {
     value = await installSpan(install, () => {
-      return handler(rpc.args, ctx);
+      return definition.handler(args.value, ctx);
     });
   } catch (error61) {
     const message = failureMessage(error61);
     console.warn(`rpc failed for install ${install.id}: ${message}`);
     return json2(200, { v: ENVELOPE_VERSION, error: { message } });
   }
-  const result = value === void 0 ? null : value;
+  const checked = await checkAgainst(definition.output, value);
+  if (!checked.ok) {
+    return jsonError(200, failureMessage(`rpc result does not match the output schema: ${checked.message}`));
+  }
+  const result = checked.value === void 0 ? null : checked.value;
   if (new TextEncoder().encode(JSON.stringify(result)).length > MAX_RPC_BYTES) {
     return jsonError(200, "rpc result exceeds the size cap");
   }