@blotout/qinto-cli 0.1.17 → 0.1.18

package/dist/worker-artifact/main/index.js

@@ -743,7 +743,6 @@ var cors = /* @__PURE__ */ __name((options) => {
 }, "cors");
 
 // src/apps/broker.ts
-import { timingSafeEqual } from "node:crypto";
 import { WorkerEntrypoint } from "cloudflare:workers";
 
 // ../../libs/app-deploy/src/control.ts
@@ -778,12 +777,18 @@ var verifyControlRequestSignature = /* @__PURE__ */ __name(async (key, timestamp
 }, "verifyControlRequestSignature");
 
 // ../../libs/app-deploy/src/keys.ts
-var deriveAppInternalKey = /* @__PURE__ */ __name(async (masterBase64, domainId, slug) => {
+var hmacHex = /* @__PURE__ */ __name(async (masterBase64, message) => {
   const master = Uint8Array.from(atob(masterBase64), (char) => char.charCodeAt(0));
   const key = await crypto.subtle.importKey("raw", master, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
-  const signature = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(`${domainId}|${slug}`));
+  const signature = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(message));
   return [...new Uint8Array(signature)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}, "hmacHex");
+var deriveAppInternalKey = /* @__PURE__ */ __name(async (masterBase64, domainId, slug) => {
+  return hmacHex(masterBase64, `${domainId}|${slug}`);
 }, "deriveAppInternalKey");
+var deriveVisitorSignature = /* @__PURE__ */ __name(async (masterBase64, domainId, anonId) => {
+  return hmacHex(masterBase64, `${domainId}#visitor#${anonId}`);
+}, "deriveVisitorSignature");
 
 // ../../libs/app-manifest/src/cron.ts
 var MAX_CRON_LENGTH = 128;
@@ -20355,6 +20360,10 @@ var uniqueOrIssue = /* @__PURE__ */ __name((ctx, values, path, label) => {
     seen.add(value);
   }
 }, "uniqueOrIssue");
+var PLATFORM_ZONES = ["blotout.io", "qinto.tech"];
+var isPlatformHost = /* @__PURE__ */ __name((host) => {
+  return PLATFORM_ZONES.some((zone) => host === zone || host.endsWith(`.${zone}`));
+}, "isPlatformHost");
 
 // ../../libs/app-manifest/src/oauth.ts
 var OAUTH_TOKEN_METHODS = ["POST", "GET"];
@@ -20384,8 +20393,7 @@ var RESERVED_AUTHORIZE_PARAMS = /* @__PURE__ */ new Set([
 var PRIVATE_HOST = /^(localhost|\[?::1\]?|.+\.local|.+\.internal|10\..+|127\..+|169\.254\..+|192\.168\..+|172\.(1[6-9]|2\d|3[01])\..+|\d+\.\d+\.\d+\.\d+)$/;
 var vendorUrl = /* @__PURE__ */ __name((field) => {
   return httpsUrl(field).refine((value) => {
-    const host = new URL(value).hostname;
-    return host !== "qinto.io" && !host.endsWith(".qinto.io") && host !== "qinto.tech" && !host.endsWith(".qinto.tech");
+    return !isPlatformHost(new URL(value).hostname);
   }, `${field} must be the vendor's own endpoint, not a Qinto platform URL`).refine((value) => {
     return !PRIVATE_HOST.test(new URL(value).hostname);
   }, `${field} must be a public host`).refine((value) => {
@@ -20845,8 +20853,7 @@ var PLATFORM_APP_SCOPE_VARIABLE_IDENTIFIER_PREFIX = "appvar-";
 var STORAGE_LINK_BINDING_PREFIX = "QINTO_LINK_";
 var legalUrl = /* @__PURE__ */ __name((field) => {
   return httpsUrl(field).refine((value) => {
-    const host = new URL(value).hostname;
-    return host !== "qinto.io" && !host.endsWith(".qinto.io");
+    return !isPlatformHost(new URL(value).hostname);
   }, `${field} must be the developer's own document, not a Qinto platform URL`);
 }, "legalUrl");
 var bindingField = external_exports.string().min(1).max(255).regex(BINDING_NAME);
@@ -21019,7 +21026,7 @@ var captureSchema = external_exports.object({
 var endpointSchema = external_exports.object({
   path: external_exports.string().min(1).max(255).regex(ENDPOINT_PATH_PATTERN, "Endpoint paths are absolute; each segment is a literal or a :name parameter"),
   methods: external_exports.array(external_exports.enum(["GET", "POST", "PUT", "PATCH", "DELETE"])).min(1).max(5),
-  auth: external_exports.enum(["public", "token"]),
+  auth: external_exports.enum(["public", "token", "visitor"]),
   mode: external_exports.enum(["webhook", "api"])
 }).strict();
 var eventsSchema = external_exports.object({
@@ -21245,6 +21252,22 @@ var validatePipelines = /* @__PURE__ */ __name((manifest, ctx) => {
     }
   }
 }, "validatePipelines");
+var validateVisitorEndpoint = /* @__PURE__ */ __name((manifest, ctx, endpoint, index) => {
+  if (endpoint.mode !== "api") {
+    ctx.addIssue({
+      code: "custom",
+      path: ["endpoints", index, "mode"],
+      message: "A visitor endpoint answers one visitor, so its mode must be api"
+    });
+  }
+  if (manifest.browser?.entry === void 0) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["endpoints", index, "auth"],
+      message: "A visitor endpoint is called by the app's own browser code, so it needs a browser entry"
+    });
+  }
+}, "validateVisitorEndpoint");
 var validateEndpoints = /* @__PURE__ */ __name((manifest, ctx) => {
   const shapes = /* @__PURE__ */ new Map();
   for (const [index, endpoint] of manifest.endpoints.entries()) {
@@ -21270,7 +21293,9 @@ var validateEndpoints = /* @__PURE__ */ __name((manifest, ctx) => {
         message: `Endpoint path ${endpoint.path} names the parameter ${repeated} twice`
       });
     }
-    if (endpoint.mode === "api" && manifest.install.multiple) {
+    if (endpoint.auth === "visitor") {
+      validateVisitorEndpoint(manifest, ctx, endpoint, index);
+    } else if (endpoint.mode === "api" && manifest.install.multiple) {
       ctx.addIssue({
         code: "custom",
         path: ["endpoints", index, "mode"],
@@ -21313,29 +21338,29 @@ var validateCapture = /* @__PURE__ */ __name((manifest, ctx) => {
   if (eventResults.length > 0 && browser.entry === void 0) {
     ctx.addIssue({ code: "custom", path: ["browser", "eventResults"], message: "eventResults needs a browser entry" });
   }
-  const capture = browser.capture;
-  if (capture === void 0) {
+  const capture2 = browser.capture;
+  if (capture2 === void 0) {
     return;
   }
-  if (capture.queryParams.length === 0 && capture.cookies.length === 0) {
+  if (capture2.queryParams.length === 0 && capture2.cookies.length === 0) {
     ctx.addIssue({ code: "custom", path: ["browser", "capture"], message: "capture must name at least one query param or cookie" });
   }
   uniqueOrIssue(
     ctx,
-    capture.queryParams.map((entry) => entry.name),
+    capture2.queryParams.map((entry) => entry.name),
     ["browser", "capture", "queryParams"],
     "query param"
   );
   uniqueOrIssue(
     ctx,
-    capture.cookies.map((entry) => entry.name),
+    capture2.cookies.map((entry) => entry.name),
     ["browser", "capture", "cookies"],
     "cookie"
   );
-  validateCaptureNames(ctx, capture.queryParams, ["browser", "capture", "queryParams"], false);
-  validateCaptureNames(ctx, capture.cookies, ["browser", "capture", "cookies"], true);
-  const params = new Set(capture.queryParams.map((entry) => entry.name));
-  for (const [index, entry] of capture.cookies.entries()) {
+  validateCaptureNames(ctx, capture2.queryParams, ["browser", "capture", "queryParams"], false);
+  validateCaptureNames(ctx, capture2.cookies, ["browser", "capture", "cookies"], true);
+  const params = new Set(capture2.queryParams.map((entry) => entry.name));
+  for (const [index, entry] of capture2.cookies.entries()) {
     if (params.has(entry.name)) {
       ctx.addIssue({
         code: "custom",
@@ -21433,7 +21458,7 @@ var storageLinkBindingName = /* @__PURE__ */ __name((domainId) => {
 var MAX_APPS_Q_BYTES = 4 * 1024 * 1024;
 
 // ../../libs/app-envelope/src/envelope.ts
-var ENVELOPE_VERSION = 2;
+var ENVELOPE_VERSION = 3;
 var ENVELOPE_ERROR_CODES = ["invalid_arguments"];
 var MAX_INSTALLS_PER_APP = 15;
 var MAX_EMITS_PER_INSTALL = 10;
@@ -21489,12 +21514,12 @@ var actionContextSchema = external_exports.discriminatedUnion("source", [
 var envelopeRequestSchema = external_exports.object({
   v: external_exports.literal(ENVELOPE_VERSION),
   kind: external_exports.enum(["event", "connect", "transform", "rpc"]),
-  site: external_exports.object({ origin: external_exports.string().min(1).max(255) }).strict(),
   app: external_exports.object({ slug: external_exports.string().min(1).max(30), version: external_exports.string().min(1).max(32) }).strict(),
   installs: external_exports.array(installSchema).min(1).max(MAX_INSTALLS_PER_APP),
   user: external_exports.object({
     anonId: external_exports.string().min(1).max(64),
     globalId: external_exports.string().min(1).max(64).nullable(),
+    createdAt: external_exports.number().int().optional(),
     properties: external_exports.record(external_exports.string(), external_exports.unknown()),
     geo: external_exports.record(external_exports.string(), external_exports.string()).optional()
   }).strict().optional(),
@@ -21579,7 +21604,7 @@ var validateEnvelopeResponse = /* @__PURE__ */ __name((raw2, installCount) => {
 }, "validateEnvelopeResponse");
 
 // ../../libs/app-envelope/src/control.ts
-var CONTROL_ENVELOPE_VERSION = 1;
+var CONTROL_ENVELOPE_VERSION = 2;
 var MAX_CONTROL_BYTES = 256 * 1024;
 var MAX_MIGRATION_CHECKPOINT_BYTES = 16 * 1024;
 var MAX_TOOL_ARGUMENTS_BYTES = 32 * 1024;
@@ -21688,7 +21713,6 @@ var toolSchema2 = external_exports.object({
 var controlEnvelopeSchema = external_exports.object({
   v: external_exports.literal(CONTROL_ENVELOPE_VERSION),
   kind: external_exports.enum(["noop", "lifecycle", "migration", "schedule", "tool"]),
-  site: external_exports.object({ origin: external_exports.string().min(1).max(255) }).strict(),
   app: external_exports.object({ slug: external_exports.string().min(1).max(30), version: external_exports.string().min(1).max(32) }).strict(),
   install: external_exports.object({ id: external_exports.string().min(1).max(64), ord: external_exports.number().int().min(1), label: external_exports.string().max(100) }).strict().optional(),
   lifecycle: lifecycleEventSchema.optional(),
@@ -21762,6 +21786,7 @@ var controlResponseSchema = external_exports.object({
 var ENDPOINT_CONTEXT_HEADER = "x-qinto-endpoint-context";
 var ENDPOINT_OUTCOMES_HEADER = "x-qinto-endpoint-outcomes";
 var MAX_ENDPOINT_BODY_BYTES = 1024 * 1024;
+var MAX_VISITOR_ENDPOINT_BODY_BYTES = 2 * 1024 * 1024;
 var MAX_ENDPOINT_OUTCOMES_BYTES = 64 * 1024;
 var MAX_ENDPOINT_PATH_LENGTH = 16 * 1024;
 var installSchema3 = external_exports.object({ id: external_exports.string().min(1).max(64), ord: external_exports.number().int().min(1), label: external_exports.string().max(100) }).strict();
@@ -21777,12 +21802,14 @@ var endpointContextSchema = external_exports.object({
   method: external_exports.enum(["GET", "POST", "PUT", "PATCH", "DELETE"]),
   mode: external_exports.enum(["webhook", "api"]),
   version: external_exports.string().min(1).max(32),
-  site: external_exports.object({ origin: external_exports.string().min(1).max(255) }).strict(),
   geo: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
-  installs: external_exports.array(installSchema3).min(1).max(15)
+  installs: external_exports.array(installSchema3).min(1).max(15),
+  user: external_exports.object({ anonId: external_exports.string().min(1).max(64) }).strict().optional()
 }).strict().refine((context) => {
   return context.mode === "webhook" || context.installs.length === 1;
-}, "An api endpoint carries exactly one install");
+}, "An api endpoint carries exactly one install").refine((context) => {
+  return context.user === void 0 || context.mode === "api";
+}, "Only an api endpoint carries a visitor");
 var endpointOutcomesSchema = external_exports.object({
   outcomes: external_exports.array(
     external_exports.object({
@@ -25098,14 +25125,14 @@ var OpenAPIGenerator = class {
     this.sortDefinitions();
   }
   generateDocumentData() {
-    this.definitions.forEach((definition10) => this.generateSingle(definition10));
+    this.definitions.forEach((definition11) => this.generateSingle(definition11));
     return {
       components: this.buildComponents(),
       paths: this.pathRefs
     };
   }
   generateComponents() {
-    this.definitions.forEach((definition10) => this.generateSingle(definition10));
+    this.definitions.forEach((definition11) => this.generateSingle(definition11));
     return {
       components: this.buildComponents()
     };
@@ -25156,23 +25183,23 @@ var OpenAPIGenerator = class {
       return leftIndex - rightIndex;
     });
   }
-  generateSingle(definition10) {
-    if (!("type" in definition10)) {
-      this.generateSchemaWithRef(definition10);
+  generateSingle(definition11) {
+    if (!("type" in definition11)) {
+      this.generateSchemaWithRef(definition11);
       return;
     }
-    switch (definition10.type) {
+    switch (definition11.type) {
       case "parameter":
-        this.generateParameterDefinition(definition10.schema);
+        this.generateParameterDefinition(definition11.schema);
         return;
       case "schema":
-        this.generateSchemaWithRef(definition10.schema);
+        this.generateSchemaWithRef(definition11.schema);
         return;
       case "route":
-        this.generateSingleRoute(definition10.route);
+        this.generateSingleRoute(definition11.route);
         return;
       case "component":
-        this.rawComponents.push(definition10);
+        this.rawComponents.push(definition11);
         return;
     }
   }
@@ -25617,8 +25644,8 @@ var OpenApiGeneratorV31Specifics = class {
     }));
   }
 };
-function isWebhookDefinition$1(definition10) {
-  return "type" in definition10 && definition10.type === "webhook";
+function isWebhookDefinition$1(definition11) {
+  return "type" in definition11 && definition11.type === "webhook";
 }
 __name(isWebhookDefinition$1, "isWebhookDefinition$1");
 var OpenApiGeneratorV31 = class {
@@ -25641,7 +25668,7 @@ var OpenApiGeneratorV31 = class {
   }
   generateWebhooks() {
     this.webhookRefs = {};
-    this.definitions.filter(isWebhookDefinition$1).forEach((definition10) => this.generateSingleWebhook(definition10.webhook));
+    this.definitions.filter(isWebhookDefinition$1).forEach((definition11) => this.generateSingleWebhook(definition11.webhook));
   }
   generateSingleWebhook(route) {
     const routeDoc = this.generator.generatePath(route);
@@ -26234,7 +26261,7 @@ var isGlobalId = /* @__PURE__ */ __name((id) => {
 
 // src/common/validation.ts
 var identifierField2 = external_exports.string().trim().min(1).refine((value) => !isGlobalId(value), { message: "gid_\u2026 ids are internal; pass an anon_\u2026 id or your own identifier" }).openapi({
-  description: "Who the request applies to: a canonical Qinto id (`anon_\u2026`), or any identifier from your own systems (email, phone, custom id). Internal `gid_\u2026` ids are rejected.",
+  description: "Who the request applies to: a canonical Qinto id (`anon_\u2026`, or a `tag_user_id` adopted from EdgeTag), or any identifier from your own systems (email, phone, custom id). Internal `gid_\u2026` ids are rejected.",
   example: "crm-user-8412"
 });
 var consentCategoriesField = external_exports.object({
@@ -26264,6 +26291,12 @@ var consentAppsField = external_exports.record(
   external_exports.string().min(1).max(64).regex(/^[A-Za-z0-9][A-Za-z0-9_-]*$/),
   external_exports.boolean()
 );
+var captureAppsField = external_exports.record(external_exports.string().max(30), external_exports.record(external_exports.string().max(64), external_exports.string().max(512))).refine((apps) => {
+  return Object.keys(apps).length <= 50 && Object.values(apps).every((values) => Object.keys(values).length <= 32);
+}, "capture carries more apps or keys than a site can have").openapi({
+  description: "Values to record, keyed by app slug and then by capture name. A name the app does not declare is dropped.",
+  example: { facebook: { fbclid: "IwAR0abc" }, "google-ads": { gclid: "Cj0KCQ" } }
+});
 var serverActionContextField = external_exports.object({
   occurredAt: external_exports.number().int().nonnegative().safe().optional().openapi({
     description: "When the visitor action occurred, as Unix milliseconds; defaults to Qinto receipt time."
@@ -26293,6 +26326,14 @@ var acceptedResponse = external_exports.object({
 }).openapi("AcceptedAction", { description: "Confirmation that the action was accepted." });
 var respond = /* @__PURE__ */ __name(((c, schema, data, status) => c.json(schema.parse(data), status ?? 200)), "respond");
 
+// src/helpers/constant-time.ts
+import { timingSafeEqual } from "node:crypto";
+var constantTimeEqual = /* @__PURE__ */ __name((expected, presented) => {
+  const expectedBytes = new TextEncoder().encode(expected);
+  const presentedBytes = new TextEncoder().encode(presented);
+  return expectedBytes.length === presentedBytes.length && timingSafeEqual(expectedBytes, presentedBytes);
+}, "constantTimeEqual");
+
 // src/apps/consent-gate.ts
 var parseEnforced = /* @__PURE__ */ __name((raw2) => {
   let parsed;
@@ -26692,19 +26733,22 @@ var claimPair = /* @__PURE__ */ __name(async (env, identifier, globalId, anonId)
 }, "claimPair");
 
 // src/id-graph/user.ts
+var EDGETAG_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}-[0-9]{13}$/;
+var isEdgeTagId = /* @__PURE__ */ __name((id) => {
+  return EDGETAG_ID.test(id);
+}, "isEdgeTagId");
 var isCanonicalId = /* @__PURE__ */ __name((id) => {
-  return id.startsWith("anon_");
+  return id.startsWith("anon_") || isEdgeTagId(id);
 }, "isCanonicalId");
 var generateUserId = /* @__PURE__ */ __name(() => {
   return `anon_${crypto.randomUUID()}`;
 }, "generateUserId");
-var restoreUser = /* @__PURE__ */ __name(async (env, cookie) => {
-  const minted = generateUserId();
+var restoreUser = /* @__PURE__ */ __name(async (env, cookie, candidate) => {
   if (cookie === void 0) {
-    return minted;
+    return candidate;
   }
-  const assignment = await claimFallbackAnon(env, cookie, minted);
-  setSpanAttributes({ "qinto.fallback_restored": assignment.anonId !== minted });
+  const assignment = await claimFallbackAnon(env, cookie, candidate);
+  setSpanAttributes({ "qinto.fallback_restored": assignment.anonId !== candidate });
   return assignment.anonId;
 }, "restoreUser");
 var resolveUser = /* @__PURE__ */ __name(async (env, id) => {
@@ -27497,11 +27541,11 @@ var APP_HOOK_TIMEOUT_MS = 25e3;
 var MAX_EMIT_DEPTH = 2;
 var HOOK_URL = "https://app/__qinto/hook";
 var invocationContext = /* @__PURE__ */ __name((env) => {
-  const { APPS_KEY_MASTER: master, QINTO_DOMAIN_ID: domainId, ROOT_DOMAIN: rootDomain } = env;
+  const { APPS_KEY_MASTER: master, QINTO_DOMAIN_ID: domainId } = env;
   if (master === void 0 || domainId === void 0) {
     return void 0;
   }
-  return { master, domainId, origin: `https://${rootDomain ?? ""}`, consentEnforced: consentEnforced(env) };
+  return { master, domainId, consentEnforced: consentEnforced(env) };
 }, "invocationContext");
 var postHookEnvelope = /* @__PURE__ */ __name(async (env, { binding, key, envelope, timeoutMs }) => {
   const service = env[binding];
@@ -27567,12 +27611,12 @@ var buildEnvelope = /* @__PURE__ */ __name((target, trigger, snapshot, context)
   return {
     v: ENVELOPE_VERSION,
     kind: trigger.kind,
-    site: { origin: context.origin },
     app: { slug: target.slug, version: target.app.version },
     installs: target.installs,
     user: {
       anonId: snapshot.anonId,
       globalId: snapshot.globalId,
+      ...snapshot.createdAt === null ? {} : { createdAt: snapshot.createdAt },
       // Custom properties intentionally win on key collisions with PII, matching the profile read path.
       properties: {
         ...buckets.includes("pii") ? snapshot.pii : {},
@@ -27784,12 +27828,12 @@ var invokeApp = /* @__PURE__ */ __name(async (env, input2) => {
 
 // src/apps/rate-limit.ts
 var limiterAbsenceLogged = false;
-var rateLimited = /* @__PURE__ */ __name(async (env, key) => {
-  const limiter = env.BROKER_RATE_LIMITER;
+var rateLimited = /* @__PURE__ */ __name(async (env, key, binding = "BROKER_RATE_LIMITER") => {
+  const limiter = env[binding];
   if (limiter === void 0) {
     if (!limiterAbsenceLogged) {
       limiterAbsenceLogged = true;
-      addSpanEvent("broker rate limiter binding is absent; limits are off", { level: "warn" });
+      addSpanEvent("rate limiter binding is absent; limits are off", { level: "warn", attrs: { binding } });
     }
     return false;
   }
@@ -27887,11 +27931,6 @@ var parseJson = /* @__PURE__ */ __name((raw2) => {
     return null;
   }
 }, "parseJson");
-var constantTimeEqual = /* @__PURE__ */ __name((expected, presented) => {
-  const expectedBytes = new TextEncoder().encode(expected);
-  const presentedBytes = new TextEncoder().encode(presented);
-  return expectedBytes.length === presentedBytes.length && timingSafeEqual(expectedBytes, presentedBytes);
-}, "constantTimeEqual");
 var factsCursor = external_exports.object({
   userId: external_exports.string().min(1).max(64),
   kinds: external_exports.array(external_exports.enum(APP_FACT_KINDS)).min(1).max(APP_FACT_KINDS.length),
@@ -28022,7 +28061,6 @@ var runRelayRpc = /* @__PURE__ */ __name(async (env, { context, body, callee, in
       envelope: {
         v: ENVELOPE_VERSION,
         kind: "rpc",
-        site: { origin: context.origin },
         app: { slug: body.callee, version: callee.version },
         installs: [install],
         // No bucket projection for rpc: the callee sees only the subject's id, never its profile.
@@ -28526,7 +28564,8 @@ var SCOPE = {
   propertiesRead: 16,
   consentRead: 32,
   sessionRead: 64,
-  idGraphInspect: 128
+  idGraphInspect: 128,
+  capture: 256
 };
 var ALL_SCOPE_MASK = Object.values(SCOPE).reduce((mask, bit) => mask | bit, 0);
 var WORKER_ACCESS_TOKEN_SCOPES = [
@@ -28556,6 +28595,12 @@ var WORKER_ACCESS_TOKEN_SCOPES = [
     bit: SCOPE.sessionRead,
     label: "Read session ids",
     description: "GET /v1/session, GET /v1/person \u2014 read the anonymous and person ids for a user, and the sessions linked to a person."
+  },
+  {
+    key: "capture",
+    bit: SCOPE.capture,
+    label: "Write captures",
+    description: "POST /v1/capture \u2014 record click ids and vendor ids an installed app declares."
   }
 ];
 
@@ -28781,18 +28826,498 @@ var streamWithDeadlines = /* @__PURE__ */ __name((source, { idleMs, totalMs }) =
   });
 }, "streamWithDeadlines");
 
+// ../../libs/bot-protection/src/countries.ts
+var EU_TOKEN = "EU";
+var COUNTRY_CODES = [
+  "AD",
+  "AE",
+  "AF",
+  "AG",
+  "AI",
+  "AL",
+  "AM",
+  "AO",
+  "AQ",
+  "AR",
+  "AS",
+  "AT",
+  "AU",
+  "AW",
+  "AX",
+  "AZ",
+  "BA",
+  "BB",
+  "BD",
+  "BE",
+  "BF",
+  "BG",
+  "BH",
+  "BI",
+  "BJ",
+  "BL",
+  "BM",
+  "BN",
+  "BO",
+  "BQ",
+  "BR",
+  "BS",
+  "BT",
+  "BV",
+  "BW",
+  "BY",
+  "BZ",
+  "CA",
+  "CC",
+  "CD",
+  "CF",
+  "CG",
+  "CH",
+  "CI",
+  "CK",
+  "CL",
+  "CM",
+  "CN",
+  "CO",
+  "CR",
+  "CU",
+  "CV",
+  "CW",
+  "CX",
+  "CY",
+  "CZ",
+  "DE",
+  "DJ",
+  "DK",
+  "DM",
+  "DO",
+  "DZ",
+  "EC",
+  "EE",
+  "EG",
+  "EH",
+  "ER",
+  "ES",
+  "ET",
+  "FI",
+  "FJ",
+  "FK",
+  "FM",
+  "FO",
+  "FR",
+  "GA",
+  "GB",
+  "GD",
+  "GE",
+  "GF",
+  "GG",
+  "GH",
+  "GI",
+  "GL",
+  "GM",
+  "GN",
+  "GP",
+  "GQ",
+  "GR",
+  "GS",
+  "GT",
+  "GU",
+  "GW",
+  "GY",
+  "HK",
+  "HM",
+  "HN",
+  "HR",
+  "HT",
+  "HU",
+  "ID",
+  "IE",
+  "IL",
+  "IM",
+  "IN",
+  "IO",
+  "IQ",
+  "IR",
+  "IS",
+  "IT",
+  "JE",
+  "JM",
+  "JO",
+  "JP",
+  "KE",
+  "KG",
+  "KH",
+  "KI",
+  "KM",
+  "KN",
+  "KP",
+  "KR",
+  "KW",
+  "KY",
+  "KZ",
+  "LA",
+  "LB",
+  "LC",
+  "LI",
+  "LK",
+  "LR",
+  "LS",
+  "LT",
+  "LU",
+  "LV",
+  "LY",
+  "MA",
+  "MC",
+  "MD",
+  "ME",
+  "MF",
+  "MG",
+  "MH",
+  "MK",
+  "ML",
+  "MM",
+  "MN",
+  "MO",
+  "MP",
+  "MQ",
+  "MR",
+  "MS",
+  "MT",
+  "MU",
+  "MV",
+  "MW",
+  "MX",
+  "MY",
+  "MZ",
+  "NA",
+  "NC",
+  "NE",
+  "NF",
+  "NG",
+  "NI",
+  "NL",
+  "NO",
+  "NP",
+  "NR",
+  "NU",
+  "NZ",
+  "OM",
+  "PA",
+  "PE",
+  "PF",
+  "PG",
+  "PH",
+  "PK",
+  "PL",
+  "PM",
+  "PN",
+  "PR",
+  "PS",
+  "PT",
+  "PW",
+  "PY",
+  "QA",
+  "RE",
+  "RO",
+  "RS",
+  "RU",
+  "RW",
+  "SA",
+  "SB",
+  "SC",
+  "SD",
+  "SE",
+  "SG",
+  "SH",
+  "SI",
+  "SJ",
+  "SK",
+  "SL",
+  "SM",
+  "SN",
+  "SO",
+  "SR",
+  "SS",
+  "ST",
+  "SV",
+  "SX",
+  "SY",
+  "SZ",
+  "TC",
+  "TD",
+  "TF",
+  "TG",
+  "TH",
+  "TJ",
+  "TK",
+  "TL",
+  "TM",
+  "TN",
+  "TO",
+  "TR",
+  "TT",
+  "TV",
+  "TW",
+  "TZ",
+  "UA",
+  "UG",
+  "UM",
+  "US",
+  "UY",
+  "UZ",
+  "VA",
+  "VC",
+  "VE",
+  "VG",
+  "VI",
+  "VN",
+  "VU",
+  "WF",
+  "WS",
+  "YE",
+  "YT",
+  "ZA",
+  "ZM",
+  "ZW"
+];
+var SELECTABLE_TOKENS = /* @__PURE__ */ new Set([EU_TOKEN, ...COUNTRY_CODES]);
+var isSelectableCountryToken = /* @__PURE__ */ __name((token) => {
+  return SELECTABLE_TOKENS.has(token);
+}, "isSelectableCountryToken");
+var matchesRule = /* @__PURE__ */ __name((country, isEU, list) => {
+  if (country !== void 0 && list.includes(country)) {
+    return true;
+  }
+  return isEU && list.includes(EU_TOKEN);
+}, "matchesRule");
+var isCountryBlocked = /* @__PURE__ */ __name((country, isEU, rule) => {
+  if (rule === null || rule.list.length === 0) {
+    return false;
+  }
+  const matched = matchesRule(country, isEU, rule.list);
+  return rule.mode === "block" ? matched : !matched;
+}, "isCountryBlocked");
+
+// ../../libs/bot-protection/src/score.ts
+var BOT_SCORE_MIN = 1;
+var BOT_SCORE_MAX = 99;
+
+// ../../libs/bot-protection/src/config.ts
+var NO_PROTECTION = { minBotScore: null, countries: null };
+var normalizeScore = /* @__PURE__ */ __name((value, problems) => {
+  if (value === void 0 || value === null) {
+    return null;
+  }
+  if (typeof value === "number" && Number.isInteger(value) && value >= BOT_SCORE_MIN && value <= BOT_SCORE_MAX) {
+    return value;
+  }
+  problems.push("has an out-of-range minBotScore");
+  return null;
+}, "normalizeScore");
+var normalizeCountries = /* @__PURE__ */ __name((value, problems) => {
+  if (value === void 0 || value === null) {
+    return null;
+  }
+  const record2 = value;
+  if (record2.mode !== "allow" && record2.mode !== "block" || !Array.isArray(record2.list)) {
+    problems.push("has an invalid countries rule");
+    return null;
+  }
+  const list = [];
+  let dropped = 0;
+  for (const token of record2.list) {
+    if (typeof token === "string" && isSelectableCountryToken(token)) {
+      list.push(token);
+    } else {
+      dropped += 1;
+    }
+  }
+  if (dropped > 0) {
+    problems.push(`dropped ${dropped} invalid country token(s)`);
+  }
+  return list.length === 0 ? null : { mode: record2.mode, list };
+}, "normalizeCountries");
+var parseBotProtection = /* @__PURE__ */ __name((raw2) => {
+  if (raw2.trim() === "") {
+    return { config: NO_PROTECTION };
+  }
+  let value;
+  try {
+    value = JSON.parse(raw2);
+  } catch {
+    return { config: NO_PROTECTION, error: "BOT_PROTECTION is not valid JSON" };
+  }
+  if (typeof value !== "object" || value === null) {
+    return { config: NO_PROTECTION, error: "BOT_PROTECTION is not an object" };
+  }
+  const record2 = value;
+  const problems = [];
+  const config2 = {
+    minBotScore: normalizeScore(record2.minBotScore, problems),
+    countries: normalizeCountries(record2.countries, problems)
+  };
+  return problems.length > 0 ? { config: config2, error: `BOT_PROTECTION ${problems.join("; ")}` } : { config: config2 };
+}, "parseBotProtection");
+var isRequestBlocked = /* @__PURE__ */ __name((config2, signal) => {
+  if (config2.minBotScore !== null && signal.botScore !== void 0 && signal.botScore < config2.minBotScore) {
+    return true;
+  }
+  return isCountryBlocked(signal.country, signal.isEU ?? false, config2.countries);
+}, "isRequestBlocked");
+
+// src/helpers/bot-check.ts
+var botRejected = /* @__PURE__ */ __name((env, geo) => {
+  return traced("bot.check", {}, () => {
+    const { config: protection, error: error61 } = parseBotProtection(env.BOT_PROTECTION);
+    if (error61 !== void 0) {
+      addSpanEvent("BOT_PROTECTION is misconfigured; enforcing it with the invalid parts dropped", {
+        level: "error",
+        attrs: { error: String(error61) }
+      });
+    }
+    const rejected = isRequestBlocked(protection, { botScore: geo.botScore, country: geo.country, isEU: geo.isEUCountry === "yes" });
+    setSpanAttributes({ "bot.blocked": rejected, ...geo.botScore === void 0 ? {} : { "bot.score": geo.botScore } });
+    return rejected;
+  });
+}, "botRejected");
+
+// src/helpers/cookie.ts
+var COOKIE_NAME2 = "q_user_id";
+var EDGETAG_COOKIE_NAME = "tag_user_id";
+var COOKIE_MAX_AGE = 400 * 24 * 60 * 60;
+var SESSION_COOKIE_NAME = "q_session";
+var SESSION_MAX_AGE = 30 * 60;
+var SESSION_VALUE = /^(vis_[0-9a-f-]{36})\.(\d{1,15})$/;
+var FALLBACK_MIN_LENGTH = 4;
+var fallbackCookie = /* @__PURE__ */ __name((c) => {
+  const name = c.env.FALLBACK_COOKIE;
+  if (name === "") {
+    return void 0;
+  }
+  const value = getCookie(c, name);
+  if (value === void 0 || value.length < FALLBACK_MIN_LENGTH) {
+    return void 0;
+  }
+  return { name, value };
+}, "fallbackCookie");
+var edgeTagUserId = /* @__PURE__ */ __name((c) => {
+  const value = getCookie(c, EDGETAG_COOKIE_NAME);
+  return value !== void 0 && isEdgeTagId(value) ? value : void 0;
+}, "edgeTagUserId");
+var visitSession = /* @__PURE__ */ __name((c, now) => {
+  const match2 = SESSION_VALUE.exec(getCookie(c, SESSION_COOKIE_NAME) ?? "");
+  if (match2 === null) {
+    return { id: `vis_${crypto.randomUUID()}`, isNew: true, startedAt: now };
+  }
+  return { id: match2[1], isNew: false, startedAt: Number(match2[2]) };
+}, "visitSession");
+
+// src/helpers/visitor-signature.ts
+var VISITOR_SIGNATURE_COOKIE = "q_user_sig";
+var signVisitor = /* @__PURE__ */ __name(async (env, anonId) => {
+  const context = invocationContext(env);
+  if (context === void 0) {
+    return void 0;
+  }
+  return deriveVisitorSignature(context.master, context.domainId, anonId);
+}, "signVisitor");
+var verifyVisitor = /* @__PURE__ */ __name(async (env, anonId, signature) => {
+  const expected = await signVisitor(env, anonId);
+  return expected !== void 0 && constantTimeEqual(expected, signature);
+}, "verifyVisitor");
+
+// src/apps/visitor-endpoint.ts
+var VISITOR_INSTALL_HEADER = "x-qinto-install";
+var refuse = /* @__PURE__ */ __name((status, error61) => {
+  return Response.json({ error: error61 }, { status });
+}, "refuse");
+var originAllowed = /* @__PURE__ */ __name((request, env) => {
+  const origin = request.headers.get("origin");
+  if (origin === null) {
+    return true;
+  }
+  let host;
+  try {
+    host = new URL(origin).host;
+  } catch {
+    return false;
+  }
+  if (host === new URL(request.url).host) {
+    return true;
+  }
+  const root = env.ROOT_DOMAIN;
+  return root !== void 0 && root !== "" && (host === root || host.endsWith(`.${root}`));
+}, "originAllowed");
+var withCors = /* @__PURE__ */ __name((response, request, method) => {
+  const origin = request.headers.get("origin");
+  if (origin === null) {
+    return response;
+  }
+  const headers = new Headers(response.headers);
+  headers.set("access-control-allow-origin", origin);
+  headers.set("access-control-allow-credentials", "true");
+  headers.set("access-control-allow-methods", method);
+  headers.set("access-control-allow-headers", `content-type, ${VISITOR_INSTALL_HEADER}`);
+  headers.append("vary", "Origin");
+  return new Response(response.body, { status: response.status, statusText: response.statusText, headers });
+}, "withCors");
+var authorize = /* @__PURE__ */ __name(async (c, { slug, app: app2 }) => {
+  if (await botRejected(c.env, geoFromRequest(c.req.raw))) {
+    return refuse(403, "traffic_rejected");
+  }
+  const anonId = getCookie(c, COOKIE_NAME2);
+  const signature = getCookie(c, VISITOR_SIGNATURE_COOKIE);
+  if (anonId === void 0 || signature === void 0 || !await verifyVisitor(c.env, anonId, signature)) {
+    return refuse(401, "visitor_required");
+  }
+  const installId = c.req.header(VISITOR_INSTALL_HEADER);
+  const install = app2.installs.find((candidate) => {
+    return candidate.active && candidate.id === installId;
+  });
+  if (install === void 0) {
+    return refuse(403, "forbidden");
+  }
+  if (await rateLimited(c.env, `${slug}:${anonId}:visitor`, "VISITOR_RATE_LIMITER")) {
+    return refuse(429, "rate_limited");
+  }
+  if (!await anonStub(c.env, anonId).appAllowed(slug, ownSite(c.env), currentTraceContext())) {
+    return refuse(403, "forbidden");
+  }
+  return { anonId, install };
+}, "authorize");
+var serve = /* @__PURE__ */ __name(async (c, request, forward) => {
+  const visitor = await authorize(c, request);
+  if (visitor instanceof Response) {
+    return visitor;
+  }
+  if (request.method === "GET") {
+    return forward(visitor, void 0);
+  }
+  const body = await readBoundedBody(c.req.raw, MAX_VISITOR_ENDPOINT_BODY_BYTES);
+  if (body === null) {
+    return refuse(413, "too_large");
+  }
+  return forward(visitor, body);
+}, "serve");
+var handleVisitorEndpoint = /* @__PURE__ */ __name(async (c, request, forward) => {
+  if (!originAllowed(c.req.raw, c.env)) {
+    return refuse(403, "forbidden");
+  }
+  const response = request.preflight ? new Response(null, { status: 204 }) : await serve(c, request, forward);
+  return withCors(response, c.req.raw, request.method);
+}, "handleVisitorEndpoint");
+
 // src/apps/endpoint-proxy.ts
 var API_ENDPOINT_START_TIMEOUT_MS = 6e4;
 var WEBHOOK_ENDPOINT_TIMEOUT_MS = 6e4;
 var API_ENDPOINT_STREAM_IDLE_TIMEOUT_MS = 15e4;
 var API_ENDPOINT_STREAM_MAX_DURATION_MS = 3e5;
 var DENIED_REQUEST_HEADERS = /* @__PURE__ */ new Set(["authorization", "cookie", "x-cf-data"]);
-var refuse = /* @__PURE__ */ __name((status, error61) => {
+var refuse2 = /* @__PURE__ */ __name((status, error61) => {
   return Response.json({ error: error61 }, { status });
 }, "refuse");
 var upstreamFailed = /* @__PURE__ */ __name((slug, reason) => {
   addSpanEvent("app endpoint upstream failed", { level: "warn", attrs: { app: slug, reason } });
-  return refuse(502, "upstream");
+  return refuse2(502, "upstream");
 }, "upstreamFailed");
 var isHttpMethod = /* @__PURE__ */ __name((value) => {
   return HTTP_METHODS.includes(value);
@@ -28814,10 +29339,17 @@ var matchEndpoint = /* @__PURE__ */ __name((app2, path, method) => {
   const declared = serving.find((endpoint) => {
     return endpoint.path === matched.route;
   });
-  if (declared.auth !== "public" && declared.auth !== "token" || declared.mode !== "webhook" && declared.mode !== "api") {
+  if (!["public", "token", "visitor"].includes(declared.auth) || declared.mode !== "webhook" && declared.mode !== "api") {
     return void 0;
   }
-  return { route: declared.path, path, params: matched.params, method, auth: declared.auth, mode: declared.mode };
+  return {
+    route: declared.path,
+    path,
+    params: matched.params,
+    method,
+    auth: declared.auth,
+    mode: declared.mode
+  };
 }, "matchEndpoint");
 var authorizeEndpoint = /* @__PURE__ */ __name(async (c, slug, endpoint) => {
   if (endpoint.auth === "public") {
@@ -28825,14 +29357,14 @@ var authorizeEndpoint = /* @__PURE__ */ __name(async (c, slug, endpoint) => {
   }
   const token = readBearerToken(c.req.raw);
   if (token === null) {
-    return refuse(401, "unauthorized");
+    return refuse2(401, "unauthorized");
   }
   const entry = await workerAccessTokenEntry(c.env, token);
   if (entry === void 0) {
-    return refuse(401, "unauthorized");
+    return refuse2(401, "unauthorized");
   }
   if (!matchesAppEndpoint(entry.endpoints ?? [], `/app/${slug}${endpoint.path}`, endpoint.method)) {
-    return refuse(403, "forbidden");
+    return refuse2(403, "forbidden");
   }
   return void 0;
 }, "authorizeEndpoint");
@@ -28885,9 +29417,9 @@ var webhookAck = /* @__PURE__ */ __name(async (slug, upstream) => {
     return Response.json({ ok: true });
   }
   if (status === 404) {
-    return refuse(404, "not_handled");
+    return refuse2(404, "not_handled");
   }
-  return refuse(502, "upstream");
+  return refuse2(502, "upstream");
 }, "webhookAck");
 var fetchApiResponse = /* @__PURE__ */ __name(async (service, url2, init) => {
   const controller = new AbortController();
@@ -28901,7 +29433,7 @@ var fetchApiResponse = /* @__PURE__ */ __name(async (service, url2, init) => {
   }
 }, "fetchApiResponse");
 var runForwardToApp = /* @__PURE__ */ __name(async (c, input2) => {
-  const { slug, app: app2, endpoint, installs, body, search } = input2;
+  const { slug, app: app2, endpoint, installs, body, search, anonId } = input2;
   const context = invocationContext(c.env);
   if (context === void 0) {
     return upstreamFailed(slug, "The deploy carries no apps key master.");
@@ -28926,9 +29458,9 @@ var runForwardToApp = /* @__PURE__ */ __name(async (c, input2) => {
       method: endpoint.method,
       mode: endpoint.mode,
       version: app2.version,
-      site: { origin: context.origin },
       ...app2.data.includes("geo") && requestGeo !== void 0 ? { geo: requestGeo } : {},
-      installs: installs.map((install) => ({ id: install.id, ord: install.ord, label: install.label }))
+      installs: installs.map((install) => ({ id: install.id, ord: install.ord, label: install.label })),
+      ...anonId === void 0 ? {} : { user: { anonId } }
     })
   );
   let upstream;
@@ -28967,20 +29499,8 @@ var forwardToApp = /* @__PURE__ */ __name(async (c, input2) => {
     }
   );
 }, "forwardToApp");
-var handleAppEndpoint = /* @__PURE__ */ __name(async (c, slug) => {
-  const app2 = siteRegistry().registry.apps[slug];
-  if (app2 === void 0) {
-    return refuse(404, "not_found");
-  }
-  const url2 = new URL(c.req.url);
-  const prefix = `/app/${slug}`;
-  if (url2.pathname !== prefix && !url2.pathname.startsWith(`${prefix}/`)) {
-    return refuse(404, "not_found");
-  }
-  const endpoint = matchEndpoint(app2, url2.pathname.slice(prefix.length) || "/", c.req.method);
-  if (endpoint === void 0) {
-    return refuse(404, "not_found");
-  }
+var serveEndpoint = /* @__PURE__ */ __name(async (c, input2) => {
+  const { slug, app: app2, endpoint, search } = input2;
   const refusal = await authorizeEndpoint(c, slug, endpoint);
   if (refusal !== void 0) {
     return refusal;
@@ -28988,21 +29508,44 @@ var handleAppEndpoint = /* @__PURE__ */ __name(async (c, slug) => {
   const installs = app2.installs.filter((install) => install.active);
   const [first] = installs;
   if (first === void 0) {
-    return refuse(503, "inactive");
+    return refuse2(503, "inactive");
   }
   const key = endpoint.mode === "api" ? `${slug}:${first.id}:endpoint` : `${slug}:${endpoint.route}:endpoint`;
   if (await rateLimited(c.env, key)) {
-    return refuse(429, "rate_limited");
+    return refuse2(429, "rate_limited");
   }
   let body;
   if (endpoint.method !== "GET") {
     const bytes = await readBoundedBody(c.req.raw, MAX_ENDPOINT_BODY_BYTES);
     if (bytes === null) {
-      return refuse(413, "too_large");
+      return refuse2(413, "too_large");
     }
     body = bytes;
   }
-  return forwardToApp(c, { slug, app: app2, endpoint, installs, body, search: url2.search });
+  return forwardToApp(c, { slug, app: app2, endpoint, installs, body, search });
+}, "serveEndpoint");
+var handleAppEndpoint = /* @__PURE__ */ __name(async (c, slug) => {
+  const app2 = siteRegistry().registry.apps[slug];
+  if (app2 === void 0) {
+    return refuse2(404, "not_found");
+  }
+  const url2 = new URL(c.req.url);
+  const prefix = `/app/${slug}`;
+  if (url2.pathname !== prefix && !url2.pathname.startsWith(`${prefix}/`)) {
+    return refuse2(404, "not_found");
+  }
+  const preflight2 = c.req.method === "OPTIONS";
+  const method = preflight2 ? c.req.header("access-control-request-method") : c.req.method;
+  const endpoint = matchEndpoint(app2, url2.pathname.slice(prefix.length) || "/", method ?? "");
+  if (endpoint === void 0 || preflight2 && endpoint.auth !== "visitor") {
+    return refuse2(404, "not_found");
+  }
+  if (endpoint.auth === "visitor") {
+    return handleVisitorEndpoint(c, { slug, app: app2, method: endpoint.method, preflight: preflight2 }, (visitor, body) => {
+      return forwardToApp(c, { slug, app: app2, endpoint, installs: [visitor.install], body, search: url2.search, anonId: visitor.anonId });
+    });
+  }
+  return serveEndpoint(c, { slug, app: app2, endpoint, search: url2.search });
 }, "handleAppEndpoint");
 var appEndpointRoutes = new Hono2();
 appEndpointRoutes.all("/app/:slug/*", (c) => {
@@ -29204,12 +29747,12 @@ var mintAppUiWriteTicket = /* @__PURE__ */ __name(async (input2) => {
 
 // src/apps/ui-proxy.ts
 var APP_UI_TIMEOUT_MS = 6e4;
-var refuse2 = /* @__PURE__ */ __name((origin, status, error61) => {
+var refuse3 = /* @__PURE__ */ __name((origin, status, error61) => {
   return Response.json({ error: error61 }, { status, headers: { "access-control-allow-origin": origin } });
 }, "refuse");
 var upstreamFailed2 = /* @__PURE__ */ __name((origin, slug, reason) => {
   addSpanEvent("app ui upstream failed", { level: "warn", attrs: { app: slug, reason } });
-  return refuse2(origin, 502, "upstream");
+  return refuse3(origin, 502, "upstream");
 }, "upstreamFailed");
 var preflight = /* @__PURE__ */ __name((origin) => {
   return new Response(null, {
@@ -29310,30 +29853,30 @@ var forwardToApp2 = /* @__PURE__ */ __name(async (c, input2) => {
 var authorizeUi = /* @__PURE__ */ __name(async (c, slug, origin) => {
   const app2 = siteRegistry().registry.apps[slug];
   if (app2 === void 0) {
-    return refuse2(origin, 404, "not_found");
+    return refuse3(origin, 404, "not_found");
   }
   const authorization = c.req.header("authorization");
   const token = authorization?.startsWith("Bearer ") === true ? authorization.slice("Bearer ".length) : void 0;
   const keyEnv = c.env.APP_UI_KEY;
   const keys = keyEnv === void 0 ? null : parseAppUiKeyEnv(keyEnv);
   if (token === void 0 || keys === null) {
-    return refuse2(origin, 401, "unauthorized");
+    return refuse3(origin, 401, "unauthorized");
   }
   const verdict = await verifyAppUiToken({ token, keys, slug, now: /* @__PURE__ */ new Date() });
   if (!verdict.ok) {
-    return verdict.reason === "wrong_app" ? refuse2(origin, 403, "forbidden") : refuse2(origin, 401, "unauthorized");
+    return verdict.reason === "wrong_app" ? refuse3(origin, 403, "forbidden") : refuse3(origin, 401, "unauthorized");
   }
   if (verdict.claims.appVersionId !== app2.versionId) {
-    return refuse2(origin, 401, "token_stale");
+    return refuse3(origin, 401, "token_stale");
   }
   const install = app2.installs.find((entry) => (entry.enabled ?? entry.active) && entry.id === verdict.claims.appInstallId);
   if (install === void 0) {
-    return refuse2(origin, 401, "token_stale");
+    return refuse3(origin, 401, "token_stale");
   }
   const method = c.req.method;
   const writing = method !== "GET" && method !== "HEAD";
   if (writing && verdict.claims.access !== "write") {
-    return refuse2(origin, 403, "forbidden");
+    return refuse3(origin, 403, "forbidden");
   }
   const writeTicket = writing ? await mintAppUiWriteTicket({
     kid: verdict.kid,
@@ -29361,13 +29904,13 @@ var handleAppUi = /* @__PURE__ */ __name(async (c, slug) => {
     return authorized;
   }
   if (await rateLimited(c.env, `${slug}:${authorized.install.id}:ui`)) {
-    return refuse2(origin, 429, "rate_limited");
+    return refuse3(origin, 429, "rate_limited");
   }
   let body;
   if (c.req.method !== "GET" && c.req.method !== "HEAD") {
     const bytes = await readBoundedBody(c.req.raw, MAX_UI_BODY_BYTES);
     if (bytes === null) {
-      return refuse2(origin, 413, "too_large");
+      return refuse3(origin, 413, "too_large");
     }
     body = bytes;
   }
@@ -29433,7 +29976,7 @@ var ERRORS = {
   },
   unknown_user: {
     status: 404,
-    description: "The `identifier` is one of your own that this site has never seen, and tracking never creates a user from one. Send a canonical `anon_\u2026` id, or bind the identifier first with an identify or alias call."
+    description: "The `identifier` is one of your own that this site has never seen, and this operation never creates a user from one. Send a canonical `anon_\u2026` id, or bind the identifier first with an identify or alias call."
   },
   forbidden: {
     status: 403,
@@ -29718,365 +30261,21 @@ idGraphInspect.post("/internal/id-graph/rows", async (c) => {
   return c.json({ page: await inspectObjectTable(c.env, body) });
 });
 
-// ../../libs/bot-protection/src/countries.ts
-var EU_TOKEN = "EU";
-var COUNTRY_CODES = [
-  "AD",
-  "AE",
-  "AF",
-  "AG",
-  "AI",
-  "AL",
-  "AM",
-  "AO",
-  "AQ",
-  "AR",
-  "AS",
-  "AT",
-  "AU",
-  "AW",
-  "AX",
-  "AZ",
-  "BA",
-  "BB",
-  "BD",
-  "BE",
-  "BF",
-  "BG",
-  "BH",
-  "BI",
-  "BJ",
-  "BL",
-  "BM",
-  "BN",
-  "BO",
-  "BQ",
-  "BR",
-  "BS",
-  "BT",
-  "BV",
-  "BW",
-  "BY",
-  "BZ",
-  "CA",
-  "CC",
-  "CD",
-  "CF",
-  "CG",
-  "CH",
-  "CI",
-  "CK",
-  "CL",
-  "CM",
-  "CN",
-  "CO",
-  "CR",
-  "CU",
-  "CV",
-  "CW",
-  "CX",
-  "CY",
-  "CZ",
-  "DE",
-  "DJ",
-  "DK",
-  "DM",
-  "DO",
-  "DZ",
-  "EC",
-  "EE",
-  "EG",
-  "EH",
-  "ER",
-  "ES",
-  "ET",
-  "FI",
-  "FJ",
-  "FK",
-  "FM",
-  "FO",
-  "FR",
-  "GA",
-  "GB",
-  "GD",
-  "GE",
-  "GF",
-  "GG",
-  "GH",
-  "GI",
-  "GL",
-  "GM",
-  "GN",
-  "GP",
-  "GQ",
-  "GR",
-  "GS",
-  "GT",
-  "GU",
-  "GW",
-  "GY",
-  "HK",
-  "HM",
-  "HN",
-  "HR",
-  "HT",
-  "HU",
-  "ID",
-  "IE",
-  "IL",
-  "IM",
-  "IN",
-  "IO",
-  "IQ",
-  "IR",
-  "IS",
-  "IT",
-  "JE",
-  "JM",
-  "JO",
-  "JP",
-  "KE",
-  "KG",
-  "KH",
-  "KI",
-  "KM",
-  "KN",
-  "KP",
-  "KR",
-  "KW",
-  "KY",
-  "KZ",
-  "LA",
-  "LB",
-  "LC",
-  "LI",
-  "LK",
-  "LR",
-  "LS",
-  "LT",
-  "LU",
-  "LV",
-  "LY",
-  "MA",
-  "MC",
-  "MD",
-  "ME",
-  "MF",
-  "MG",
-  "MH",
-  "MK",
-  "ML",
-  "MM",
-  "MN",
-  "MO",
-  "MP",
-  "MQ",
-  "MR",
-  "MS",
-  "MT",
-  "MU",
-  "MV",
-  "MW",
-  "MX",
-  "MY",
-  "MZ",
-  "NA",
-  "NC",
-  "NE",
-  "NF",
-  "NG",
-  "NI",
-  "NL",
-  "NO",
-  "NP",
-  "NR",
-  "NU",
-  "NZ",
-  "OM",
-  "PA",
-  "PE",
-  "PF",
-  "PG",
-  "PH",
-  "PK",
-  "PL",
-  "PM",
-  "PN",
-  "PR",
-  "PS",
-  "PT",
-  "PW",
-  "PY",
-  "QA",
-  "RE",
-  "RO",
-  "RS",
-  "RU",
-  "RW",
-  "SA",
-  "SB",
-  "SC",
-  "SD",
-  "SE",
-  "SG",
-  "SH",
-  "SI",
-  "SJ",
-  "SK",
-  "SL",
-  "SM",
-  "SN",
-  "SO",
-  "SR",
-  "SS",
-  "ST",
-  "SV",
-  "SX",
-  "SY",
-  "SZ",
-  "TC",
-  "TD",
-  "TF",
-  "TG",
-  "TH",
-  "TJ",
-  "TK",
-  "TL",
-  "TM",
-  "TN",
-  "TO",
-  "TR",
-  "TT",
-  "TV",
-  "TW",
-  "TZ",
-  "UA",
-  "UG",
-  "UM",
-  "US",
-  "UY",
-  "UZ",
-  "VA",
-  "VC",
-  "VE",
-  "VG",
-  "VI",
-  "VN",
-  "VU",
-  "WF",
-  "WS",
-  "YE",
-  "YT",
-  "ZA",
-  "ZM",
-  "ZW"
-];
-var SELECTABLE_TOKENS = /* @__PURE__ */ new Set([EU_TOKEN, ...COUNTRY_CODES]);
-var isSelectableCountryToken = /* @__PURE__ */ __name((token) => {
-  return SELECTABLE_TOKENS.has(token);
-}, "isSelectableCountryToken");
-var matchesRule = /* @__PURE__ */ __name((country, isEU, list) => {
-  if (country !== void 0 && list.includes(country)) {
-    return true;
-  }
-  return isEU && list.includes(EU_TOKEN);
-}, "matchesRule");
-var isCountryBlocked = /* @__PURE__ */ __name((country, isEU, rule) => {
-  if (rule === null || rule.list.length === 0) {
-    return false;
-  }
-  const matched = matchesRule(country, isEU, rule.list);
-  return rule.mode === "block" ? matched : !matched;
-}, "isCountryBlocked");
-
-// ../../libs/bot-protection/src/score.ts
-var BOT_SCORE_MIN = 1;
-var BOT_SCORE_MAX = 99;
-
-// ../../libs/bot-protection/src/config.ts
-var NO_PROTECTION = { minBotScore: null, countries: null };
-var normalizeScore = /* @__PURE__ */ __name((value, problems) => {
-  if (value === void 0 || value === null) {
-    return null;
-  }
-  if (typeof value === "number" && Number.isInteger(value) && value >= BOT_SCORE_MIN && value <= BOT_SCORE_MAX) {
-    return value;
-  }
-  problems.push("has an out-of-range minBotScore");
-  return null;
-}, "normalizeScore");
-var normalizeCountries = /* @__PURE__ */ __name((value, problems) => {
-  if (value === void 0 || value === null) {
-    return null;
-  }
-  const record2 = value;
-  if (record2.mode !== "allow" && record2.mode !== "block" || !Array.isArray(record2.list)) {
-    problems.push("has an invalid countries rule");
-    return null;
-  }
-  const list = [];
-  let dropped = 0;
-  for (const token of record2.list) {
-    if (typeof token === "string" && isSelectableCountryToken(token)) {
-      list.push(token);
-    } else {
-      dropped += 1;
-    }
-  }
-  if (dropped > 0) {
-    problems.push(`dropped ${dropped} invalid country token(s)`);
-  }
-  return list.length === 0 ? null : { mode: record2.mode, list };
-}, "normalizeCountries");
-var parseBotProtection = /* @__PURE__ */ __name((raw2) => {
-  if (raw2.trim() === "") {
-    return { config: NO_PROTECTION };
-  }
-  let value;
-  try {
-    value = JSON.parse(raw2);
-  } catch {
-    return { config: NO_PROTECTION, error: "BOT_PROTECTION is not valid JSON" };
-  }
-  if (typeof value !== "object" || value === null) {
-    return { config: NO_PROTECTION, error: "BOT_PROTECTION is not an object" };
-  }
-  const record2 = value;
-  const problems = [];
-  const config2 = {
-    minBotScore: normalizeScore(record2.minBotScore, problems),
-    countries: normalizeCountries(record2.countries, problems)
-  };
-  return problems.length > 0 ? { config: config2, error: `BOT_PROTECTION ${problems.join("; ")}` } : { config: config2 };
-}, "parseBotProtection");
-var isRequestBlocked = /* @__PURE__ */ __name((config2, signal) => {
-  if (config2.minBotScore !== null && signal.botScore !== void 0 && signal.botScore < config2.minBotScore) {
-    return true;
-  }
-  return isCountryBlocked(signal.country, signal.isEU ?? false, config2.countries);
-}, "isRequestBlocked");
-
-// src/helpers/cookie.ts
-var COOKIE_NAME2 = "q_user_id";
-var COOKIE_MAX_AGE = 400 * 24 * 60 * 60;
-var FALLBACK_MIN_LENGTH = 4;
-var fallbackCookie = /* @__PURE__ */ __name((c) => {
-  const name = c.env.FALLBACK_COOKIE;
-  if (name === "") {
-    return void 0;
-  }
-  const value = getCookie(c, name);
-  if (value === void 0 || value.length < FALLBACK_MIN_LENGTH) {
-    return void 0;
-  }
-  return { name, value };
-}, "fallbackCookie");
-
 // src/id-graph/anon/connection.ts
 var CONNECTION_CF_HEADER = "x-connection-cf";
+var SESSION_HEADER = "x-session";
 var MAX_HOST_USER_AGENT_LENGTH = 512;
 var MAX_HOST_LOCALE_LENGTH = 64;
-var INTERNAL_HEADERS = /* @__PURE__ */ new Set(["x-user-id", "x-new-user", "x-geo", SITE_ID_HEADER, CONNECTION_CF_HEADER, TRACE_HEADER, CF_DATA_HEADER]);
+var INTERNAL_HEADERS = /* @__PURE__ */ new Set([
+  "x-user-id",
+  "x-new-user",
+  "x-geo",
+  SITE_ID_HEADER,
+  CONNECTION_CF_HEADER,
+  SESSION_HEADER,
+  TRACE_HEADER,
+  CF_DATA_HEADER
+]);
 var REDACTED_HEADERS = /* @__PURE__ */ new Set(["authorization"]);
 var encodeConnectionCf = /* @__PURE__ */ __name((cf) => {
   if (cf === void 0) {
@@ -30092,6 +30291,13 @@ var forwardedCf = /* @__PURE__ */ __name((request) => {
   }
   return JSON.parse(raw2);
 }, "forwardedCf");
+var forwardedSession = /* @__PURE__ */ __name((request) => {
+  const raw2 = request.headers.get(SESSION_HEADER);
+  if (raw2 === null) {
+    return void 0;
+  }
+  return JSON.parse(raw2);
+}, "forwardedSession");
 var connectAttrs = /* @__PURE__ */ __name((request, geo) => {
   const headers = {};
   for (const [name, value] of request.headers) {
@@ -30128,6 +30334,15 @@ var browserGeoFrom = /* @__PURE__ */ __name((geo) => {
 var attachmentFieldBytes = /* @__PURE__ */ __name((name, value) => {
   return value === void 0 ? 0 : new TextEncoder().encode(`,"${name}":${JSON.stringify(value)}`).length;
 }, "attachmentFieldBytes");
+var boundedHost = /* @__PURE__ */ __name((request) => {
+  const raw2 = hostFromRequest(request);
+  const bounded = {
+    ip: raw2.ip,
+    userAgent: raw2.userAgent !== void 0 && raw2.userAgent.length <= MAX_HOST_USER_AGENT_LENGTH ? raw2.userAgent : void 0,
+    locale: raw2.locale !== void 0 && raw2.locale.length <= MAX_HOST_LOCALE_LENGTH ? raw2.locale : void 0
+  };
+  return bounded.ip === void 0 && bounded.userAgent === void 0 && bounded.locale === void 0 ? void 0 : bounded;
+}, "boundedHost");
 var connectionAttachment = /* @__PURE__ */ __name((request, geo, siteId) => {
   const userAgent = request.headers.get("user-agent");
   const attrs = {
@@ -30136,27 +30351,24 @@ var connectionAttachment = /* @__PURE__ */ __name((request, geo, siteId) => {
     ...geo?.city === void 0 ? {} : { "qinto.city": geo.city },
     ...userAgent === null ? {} : { user_agent: userAgent }
   };
-  const raw2 = hostFromRequest(request);
-  const bounded = {
-    ip: raw2.ip,
-    userAgent: raw2.userAgent !== void 0 && raw2.userAgent.length <= MAX_HOST_USER_AGENT_LENGTH ? raw2.userAgent : void 0,
-    locale: raw2.locale !== void 0 && raw2.locale.length <= MAX_HOST_LOCALE_LENGTH ? raw2.locale : void 0
-  };
-  const host = bounded.ip === void 0 && bounded.userAgent === void 0 && bounded.locale === void 0 ? void 0 : bounded;
+  const host = boundedHost(request);
   const hostBytes = attachmentFieldBytes("host", host);
   const browserGeo = browserGeoFrom(geo);
   const browserGeoBytes = attachmentFieldBytes("browserGeo", browserGeo);
+  const session2 = forwardedSession(request);
+  const sessionBytes = attachmentFieldBytes("session", session2);
   const siteBytes = attachmentFieldBytes("siteId", siteId);
   const cf = forwardedCf(request);
   const cfSuffix = cf === void 0 ? "" : `,"cf":${JSON.stringify(cf)}`;
   const cfBytes = new TextEncoder().encode(cfSuffix).length;
   const emptyAttrsBytes = new TextEncoder().encode(JSON.stringify({ attrs: {} })).length;
-  const fixedBytes = siteBytes + hostBytes + browserGeoBytes;
+  const fixedBytes = siteBytes + sessionBytes + hostBytes + browserGeoBytes;
   const includedCf = cfBytes <= MAX_ATTACHMENT_BYTES - emptyAttrsBytes - fixedBytes ? cf : void 0;
   const budgeted = budgetAttrs(attrs, MAX_ATTACHMENT_BYTES - fixedBytes - (includedCf === void 0 ? 0 : cfBytes));
   return {
     ...budgeted,
     siteId,
+    ...session2 === void 0 ? {} : { session: session2 },
     ...browserGeo === void 0 ? {} : { browserGeo },
     ...includedCf === void 0 ? {} : { cf: includedCf },
     ...host === void 0 ? {} : { host }
@@ -30164,14 +30376,18 @@ var connectionAttachment = /* @__PURE__ */ __name((request, geo, siteId) => {
 }, "connectionAttachment");
 
 // src/paths/open.ts
-var withSetCookie = /* @__PURE__ */ __name((res, cookie) => {
+var withSetCookie = /* @__PURE__ */ __name((res, cookies) => {
   if (res.webSocket) {
     const headers = new Headers(res.headers);
-    headers.append("set-cookie", cookie);
+    for (const cookie of cookies) {
+      headers.append("set-cookie", cookie);
+    }
     return new Response(null, { status: res.status, webSocket: res.webSocket, headers });
   }
   const out = new Response(res.body, res);
-  out.headers.append("set-cookie", cookie);
+  for (const cookie of cookies) {
+    out.headers.append("set-cookie", cookie);
+  }
   return out;
 }, "withSetCookie");
 var open2 = /* @__PURE__ */ __name(async (c) => {
@@ -30186,35 +30402,27 @@ var open2 = /* @__PURE__ */ __name(async (c) => {
     });
     return enriched;
   });
-  const blocked = await traced("bot.check", {}, () => {
-    const { config: protection, error: error61 } = parseBotProtection(c.env.BOT_PROTECTION);
-    if (error61 !== void 0) {
-      addSpanEvent("BOT_PROTECTION is misconfigured; enforcing it with the invalid parts dropped", {
-        level: "error",
-        attrs: { error: String(error61) }
-      });
-    }
-    const rejected = isRequestBlocked(protection, { botScore: geo.botScore, country: geo.country, isEU: geo.isEUCountry === "yes" });
-    setSpanAttributes({ "bot.blocked": rejected, ...geo.botScore === void 0 ? {} : { "bot.score": geo.botScore } });
-    return rejected;
-  });
-  if (blocked) {
+  if (await botRejected(c.env, geo)) {
     return c.text("traffic rejected", 403);
   }
   const existing = getCookie(c, COOKIE_NAME2);
   let isNewUser = false;
   let userId;
-  if (!existing || !isCanonicalId(existing)) {
-    userId = await restoreUser(c.env, fallbackCookie(c));
-    isNewUser = true;
-  } else {
+  if (existing !== void 0 && isCanonicalId(existing)) {
     userId = existing;
+  } else {
+    const adopted = edgeTagUserId(c);
+    setSpanAttributes({ "qinto.edgetag_adopted": adopted !== void 0 });
+    userId = await restoreUser(c.env, fallbackCookie(c), adopted ?? generateUserId());
+    isNewUser = adopted === void 0;
   }
   const headers = new Headers(c.req.raw.headers);
   headers.set("x-user-id", userId);
   headers.set("x-new-user", isNewUser.toString());
   headers.set(SITE_ID_HEADER, ownSiteId(c.env));
   headers.set("x-geo", headerJson(geo));
+  const session2 = visitSession(c, Date.now());
+  headers.set(SESSION_HEADER, JSON.stringify(session2));
   headers.delete(CONNECTION_CF_HEADER);
   const cf = encodeConnectionCf(c.req.raw.cf);
   if (cf !== void 0) {
@@ -30231,16 +30439,24 @@ var open2 = /* @__PURE__ */ __name(async (c) => {
   const root = c.env.ROOT_DOMAIN;
   const hostname3 = new URL(c.req.url).hostname;
   const domain2 = root !== void 0 && root !== "" && (hostname3 === root || hostname3.endsWith(`.${root}`)) ? root : void 0;
-  const cookie = generateCookie(COOKIE_NAME2, userId, {
+  const attributes = {
     httpOnly: true,
     // `wrangler types` narrows COOKIE_SAME_SITE to its dev default; deploys also set none.
     sameSite: c.env.COOKIE_SAME_SITE,
     secure: true,
     path: "/",
-    maxAge: COOKIE_MAX_AGE,
-    ...domain2 === void 0 ? {} : { domain: domain2 }
-  });
-  return withSetCookie(res, cookie);
+    maxAge: COOKIE_MAX_AGE
+  };
+  const cookies = [
+    generateCookie(COOKIE_NAME2, userId, { ...attributes, ...domain2 === void 0 ? {} : { domain: domain2 } }),
+    // Re-issued on every connect, which is what makes the session expire after 30 idle minutes.
+    generateCookie(SESSION_COOKIE_NAME, `${session2.id}.${session2.startedAt}`, { ...attributes, maxAge: SESSION_MAX_AGE })
+  ];
+  const signature = await signVisitor(c.env, userId);
+  if (signature !== void 0) {
+    cookies.push(generateCookie(VISITOR_SIGNATURE_COOKIE, signature, attributes));
+  }
+  return withSetCookie(res, cookies);
 }, "open");
 
 // browser-artifact/meta.json
@@ -30300,7 +30516,7 @@ var appsMetadata = /* @__PURE__ */ __name(() => {
   const { registry: registry3 } = siteRegistry();
   return Object.fromEntries(
     Object.entries(registry3.apps).map(([slug, app2]) => {
-      const capture = declaredCapture(app2);
+      const capture2 = declaredCapture(app2);
       const geo = app2.data.includes("geo") ? { geo: true } : {};
       const sharedContext = app2.data.includes(SHARED_CONTEXT_CAPABILITY) ? { sharedContext: true } : {};
       return [
@@ -30308,7 +30524,7 @@ var appsMetadata = /* @__PURE__ */ __name(() => {
         {
           category: app2.consent.category,
           eventResults: app2.eventResults,
-          ...capture === void 0 ? {} : { capture },
+          ...capture2 === void 0 ? {} : { capture: capture2 },
           ...geo,
           ...sharedContext
         }
@@ -30387,6 +30603,60 @@ var alias = createApiRouter().openapi(definition2, async (c) => {
   return respond(c, acceptedResponse, { ok: true, id });
 });
 
+// src/paths/v1/capture.ts
+var captureBody = external_exports.object({
+  identifier: identifierField2,
+  apps: captureAppsField
+}).strict().openapi("CaptureRequest", { description: "Click ids and vendor ids to record for the user, keyed by app." });
+var captureResponse = external_exports.object({
+  ok: external_exports.literal(true).openapi({
+    description: "Always true: the values were accepted, not that every one of them was stored.",
+    example: true
+  }),
+  accepted: external_exports.record(external_exports.string(), external_exports.array(external_exports.string())).openapi({
+    description: "The capture names now stored, per app slug. A name missing here was dropped.",
+    example: { facebook: ["fbclid"] }
+  })
+}).openapi("CaptureAccepted", { description: "The capture names that are now stored." });
+var definition3 = createRoute({
+  method: "post",
+  path: "/v1/capture",
+  operationId: "captureValues",
+  tags: ["Identity"],
+  security: [{ QintoWorkerAccessToken: [] }],
+  middleware: [requireScope(SCOPE.capture)],
+  summary: "Record click ids",
+  description: operationDescription({
+    intro: "Records click ids and vendor ids for the user, such as `fbclid` or `gclid`, keyed by the app that reads them.",
+    howItWorks: "A value is stored only when the named app is installed on this site, declares that name, and holds the user\u2019s consent for its category \u2014 `accepted` reports exactly what landed, so compare it against what you sent. Re-sending an unchanged value is a no-op and keeps the original click time, which is what any expiry window runs from. Capturing never creates a user: an identifier of your own that this site has not seen fails with `unknown_user`."
+  }),
+  request: {
+    body: {
+      required: true,
+      description: "The values to record.",
+      content: { "application/json": { schema: captureBody } }
+    }
+  },
+  responses: {
+    200: {
+      description: "The values were accepted.",
+      content: { "application/json": { schema: captureResponse } }
+    },
+    ...errorResponses("invalid_body", "unauthenticated", "forbidden", "unknown_user", "internal")
+  }
+});
+var capture = createApiRouter().openapi(definition3, async (c) => {
+  const { identifier, apps } = c.req.valid("json");
+  const resolved = await resolveExistingUser(c.env, identifier);
+  if (resolved === null) {
+    return c.json({ error: "unknown_user" }, 404);
+  }
+  const { accepted } = await traced("rpc anon.server_capture", {}, () => {
+    return anonStub(c.env, resolved.id).serverCapture({ anonId: resolved.id, apps }, ownSite(c.env), currentTraceContext());
+  });
+  return respond(c, captureResponse, { ok: true, accepted });
+});
+
 // src/paths/v1/consent.ts
 var consentBody = external_exports.object({
   identifier: identifierField2,
@@ -30399,7 +30669,7 @@ var consentBody = external_exports.object({
   }),
   context: serverActionContextField
 }).strict().openapi("ConsentRequest", { description: "Consent choices to record for the user." });
-var definition3 = createRoute({
+var definition4 = createRoute({
   method: "post",
   path: "/v1/consent",
   operationId: "saveUserConsent",
@@ -30426,7 +30696,7 @@ var definition3 = createRoute({
     ...errorResponses("invalid_body", "unauthenticated", "forbidden", "internal")
   }
 });
-var consent = createApiRouter().openapi(definition3, async (c) => {
+var consent = createApiRouter().openapi(definition4, async (c) => {
   const { identifier, categories, apps, context } = c.req.valid("json");
   const id = await submitAction(
     c.env,
@@ -30460,7 +30730,7 @@ var consentStateResponse = external_exports.object({
 }).openapi("ConsentState", {
   description: "The consent state currently stored for the user; categories never saved read as not granted."
 });
-var definition4 = createRoute({
+var definition5 = createRoute({
   method: "get",
   path: "/v1/consent",
   operationId: "getUserConsent",
@@ -30481,7 +30751,7 @@ var definition4 = createRoute({
     ...errorResponses("invalid_params", "unauthenticated", "forbidden", "internal")
   }
 });
-var consentState = createApiRouter().openapi(definition4, async (c) => {
+var consentState = createApiRouter().openapi(definition5, async (c) => {
   const identifier = c.req.valid("query").identifier ?? getCookie(c, COOKIE_NAME2);
   if (identifier === void 0 || !isCanonicalId(identifier)) {
     return c.json({ error: "invalid_params" }, 400);
@@ -30501,7 +30771,7 @@ var identifyBody = external_exports.object({
   }),
   context: serverActionContextField
 }).openapi("IdentifyRequest", { description: "Identity traits to record for the user." });
-var definition5 = createRoute({
+var definition6 = createRoute({
   method: "post",
   path: "/v1/identify",
   operationId: "identifyUser",
@@ -30528,7 +30798,7 @@ var definition5 = createRoute({
     ...errorResponses("invalid_body", "unauthenticated", "forbidden", "internal")
   }
 });
-var identify = createApiRouter().openapi(definition5, async (c) => {
+var identify = createApiRouter().openapi(definition6, async (c) => {
   const { identifier, traits, context } = c.req.valid("json");
   const id = await submitAction(c.env, identifier, { type: "identify", payload: { traits: traits ?? {} }, context }, c.req.raw);
   return respond(c, acceptedResponse, { ok: true, id });
@@ -30538,7 +30808,7 @@ var identify = createApiRouter().openapi(definition5, async (c) => {
 var personQuery = external_exports.object({
   identifier: identifierField2.optional().openapi({
     param: { name: "identifier", in: "query" },
-    description: "User to read: any identifier from your own systems (email, phone, custom id), or a canonical Qinto id (`anon_\u2026`). Omit it to read the user from the first-party cookie instead. Internal `gid_\u2026` ids are rejected.",
+    description: "User to read: any identifier from your own systems (email, phone, custom id), or a canonical Qinto id (`anon_\u2026`, or a `tag_user_id` adopted from EdgeTag). Omit it to read the user from the first-party cookie instead. Internal `gid_\u2026` ids are rejected.",
     example: "ada@example.com"
   }),
   cursor: external_exports.string().regex(/^\d+$/).optional().openapi({
@@ -30561,7 +30831,7 @@ var personResponse = external_exports.object({
     example: null
   })
 }).openapi("Person", { description: "The person a user belongs to, and the sessions linked to that person." });
-var definition6 = createRoute({
+var definition7 = createRoute({
   method: "get",
   path: "/v1/person",
   operationId: "getPerson",
@@ -30582,7 +30852,7 @@ var definition6 = createRoute({
     ...errorResponses("invalid_params", "unauthenticated", "forbidden", "internal")
   }
 });
-var person = createApiRouter().openapi(definition6, async (c) => {
+var person = createApiRouter().openapi(definition7, async (c) => {
   const { identifier, cursor } = c.req.valid("query");
   const id = identifier ?? getCookie(c, COOKIE_NAME2);
   if (id === void 0) {
@@ -30600,7 +30870,7 @@ var propertiesQuery = external_exports.object({
   })
 });
 var propertiesResponse = external_exports.record(external_exports.string(), external_exports.unknown()).openapi("UserProperties", { description: "Every property currently stored for the user, keyed by property name." });
-var definition7 = createRoute({
+var definition8 = createRoute({
   method: "get",
   path: "/v1/properties",
   operationId: "getUserProperties",
@@ -30621,7 +30891,7 @@ var definition7 = createRoute({
     ...errorResponses("invalid_params", "unauthenticated", "forbidden", "internal")
   }
 });
-var properties = createApiRouter().openapi(definition7, async (c) => {
+var properties = createApiRouter().openapi(definition8, async (c) => {
   const identifier = c.req.valid("query").identifier ?? getCookie(c, COOKIE_NAME2);
   if (identifier === void 0 || !isCanonicalId(identifier)) {
     return c.json({ error: "invalid_params" }, 400);
@@ -30650,7 +30920,7 @@ var sessionResponse = external_exports.object({
     example: "gid_01JZWG7Q4S1T8M6Y2E9RBD3KXN"
   })
 }).openapi("Session", { description: "The anonymous session id and the person id it is linked to." });
-var definition8 = createRoute({
+var definition9 = createRoute({
   method: "get",
   path: "/v1/session",
   operationId: "getSession",
@@ -30671,7 +30941,7 @@ var definition8 = createRoute({
     ...errorResponses("invalid_params", "unauthenticated", "forbidden", "internal")
   }
 });
-var session = createApiRouter().openapi(definition8, async (c) => {
+var session = createApiRouter().openapi(definition9, async (c) => {
   const identifier = c.req.valid("query").identifier ?? getCookie(c, COOKIE_NAME2);
   if (identifier === void 0) {
     return c.json({ error: "invalid_params" }, 400);
@@ -30696,7 +30966,7 @@ var trackBody = external_exports.object({
   }),
   context: serverActionContextField
 }).strict().openapi("TrackRequest", { description: "An event the user performed, with optional free-form properties." });
-var definition9 = createRoute({
+var definition10 = createRoute({
   method: "post",
   path: "/v1/track",
   operationId: "trackEvent",
@@ -30723,7 +30993,7 @@ var definition9 = createRoute({
     ...errorResponses("invalid_body", "unauthenticated", "forbidden", "unknown_user", "internal")
   }
 });
-var track = createApiRouter().openapi(definition9, async (c) => {
+var track = createApiRouter().openapi(definition10, async (c) => {
   const { identifier, event, eventId, properties: properties2, context } = c.req.valid("json");
   try {
     const id = await submitAction(
@@ -30741,6 +31011,12 @@ var track = createApiRouter().openapi(definition9, async (c) => {
   }
 });
 
+// src/paths/welcome.ts
+var WELCOME = "Welcome to Qinto by Blotout. This site is set up.\nFor more information, go to https://docs.blotout.io\n";
+var welcome = /* @__PURE__ */ __name((c) => {
+  return c.text(WELCOME);
+}, "welcome");
+
 // src/apps/fan-out-entrypoint.ts
 import { WorkerEntrypoint as WorkerEntrypoint2 } from "cloudflare:workers";
 
@@ -31603,9 +31879,11 @@ var nextRetentionDeadline = /* @__PURE__ */ __name((sql) => {
 var META_KEY = "meta";
 var LAST_ACTIVITY_KEY = "lastActivityAt";
 var seedMeta = /* @__PURE__ */ __name((kv, anonId, createdAt) => {
-  if (kv.get(META_KEY) === void 0) {
-    kv.put(META_KEY, { anonId, linkedGlobalId: null, linkedAt: null, createdAt });
+  if (kv.get(META_KEY) !== void 0) {
+    return false;
   }
+  kv.put(META_KEY, { anonId, linkedGlobalId: null, linkedAt: null, createdAt });
+  return true;
 }, "seedMeta");
 var touchActivity = /* @__PURE__ */ __name((kv, receivedAt) => {
   const last = kv.get(LAST_ACTIVITY_KEY);
@@ -31622,6 +31900,9 @@ var linkedGlobalId = /* @__PURE__ */ __name((kv) => {
 var storedAnonId = /* @__PURE__ */ __name((kv) => {
   return kv.get(META_KEY)?.anonId ?? null;
 }, "storedAnonId");
+var storedMeta = /* @__PURE__ */ __name((kv) => {
+  return kv.get(META_KEY);
+}, "storedMeta");
 var SYNC_DEBT_KEY = "syncDebt";
 var syncDebt = /* @__PURE__ */ __name((kv) => {
   const stored = kv.get(SYNC_DEBT_KEY);
@@ -31927,6 +32208,9 @@ var updateGeo = /* @__PURE__ */ __name((storage, geo, observedAt) => {
   }
   return appended;
 }, "updateGeo");
+var hasGeoRecord = /* @__PURE__ */ __name((kv) => {
+  return kv.get(GEO_KEY) !== void 0;
+}, "hasGeoRecord");
 var geoSnapshot = /* @__PURE__ */ __name((kv) => {
   const record2 = kv.get(GEO_KEY);
   if (record2 === void 0) {
@@ -32200,8 +32484,7 @@ var MAX_BROWSER_RESULTS_BYTES = 32 * 1024;
 var MAX_FRAME_BYTES = 64 * 1024;
 var browserContextFrame = external_exports.object({
   occurredAt: external_exports.number().int().nonnegative().safe(),
-  page: external_exports.object({ url: external_exports.string().min(1).max(4096), referrer: external_exports.string().min(1).max(4096).optional() }).strict(),
-  session: external_exports.object({ id: external_exports.string().min(1).max(64), isNew: external_exports.boolean(), startedAt: external_exports.number().int().nonnegative().safe() }).strict()
+  page: external_exports.object({ url: external_exports.string().min(1).max(4096), referrer: external_exports.string().min(1).max(4096).optional() }).strict()
 }).strict();
 var browserResult = external_exports.unknown().refine((value) => {
   return new TextEncoder().encode(JSON.stringify(value)).length <= MAX_BROWSER_RESULT_BYTES;
@@ -32241,9 +32524,7 @@ var consentFrame = external_exports.object({
 var captureFrame = external_exports.object({
   t: external_exports.literal("capture"),
   ref: external_exports.string().min(1).optional(),
-  apps: external_exports.record(external_exports.string().max(30), external_exports.record(external_exports.string().max(64), external_exports.string().max(512))).refine((apps) => {
-    return Object.keys(apps).length <= 50 && Object.values(apps).every((values) => Object.keys(values).length <= 32);
-  }, "capture carries more apps or keys than a site can have")
+  apps: captureAppsField
 }).strict();
 var getConsentFrame = external_exports.object({
   t: external_exports.literal("getConsent"),
@@ -32303,7 +32584,7 @@ var frameSpanAttrs = /* @__PURE__ */ __name((frame, userId) => {
     ...userId === null ? {} : { "action.user_id": userId }
   };
 }, "frameSpanAttrs");
-var browserActionContext = /* @__PURE__ */ __name((frame, host) => {
+var browserActionContext = /* @__PURE__ */ __name((frame, host, session2) => {
   const context = {
     source: "browser",
     occurredAt: frame.occurredAt,
@@ -32316,11 +32597,12 @@ var browserActionContext = /* @__PURE__ */ __name((frame, host) => {
         provenance: "edge"
       }
     },
-    session: frame.session
+    ...session2 === void 0 ? {} : { session: session2 }
   };
   return context;
 }, "browserActionContext");
-var actionFromFrame = /* @__PURE__ */ __name((frame, userId, geo, host) => {
+var actionFromFrame = /* @__PURE__ */ __name((frame, userId, connection = {}) => {
+  const { cf: geo, host, session: session2 } = connection;
   switch (frame.t) {
     case "identify": {
       const identifier = frame.id === void 0 ? void 0 : classifyIdentifier(frame.id);
@@ -32330,7 +32612,7 @@ var actionFromFrame = /* @__PURE__ */ __name((frame, userId, geo, host) => {
         identifier,
         source: "ws",
         payload: { traits: frame.traits ?? {} },
-        context: browserActionContext(frame.context, host),
+        context: browserActionContext(frame.context, host, session2),
         browserResults: frame.appResults,
         geo,
         host
@@ -32342,7 +32624,7 @@ var actionFromFrame = /* @__PURE__ */ __name((frame, userId, geo, host) => {
         userId,
         source: "ws",
         payload: { event: frame.event, eventId: frame.eventId, properties: frame.properties ?? {} },
-        context: browserActionContext(frame.context, host),
+        context: browserActionContext(frame.context, host, session2),
         browserResults: frame.appResults,
         geo,
         host
@@ -32357,7 +32639,7 @@ var actionFromFrame = /* @__PURE__ */ __name((frame, userId, geo, host) => {
         userId,
         source: "ws",
         payload: { categories: frame.categories ?? {}, apps: frame.apps ?? {} },
-        context: browserActionContext(frame.context, host),
+        context: browserActionContext(frame.context, host, session2),
         geo,
         host
       });
@@ -32426,8 +32708,8 @@ var AnonDO = class extends DurableObject2 {
       this.cleanupAlarm = await seedCleanupAlarm(this.ctx.storage, now, lastActivityAt(this.kv) ?? now, this.cleanupAlarm);
       seedMeta(this.kv, userId, now);
       touchActivity(this.kv, now);
-      if (geo !== void 0) {
-        this.pushGeoOnConnect(userId, geo, now);
+      if (geo !== void 0 && !hasGeoRecord(this.kv)) {
+        this.seedGeoOnConnect(userId, geo, now);
       }
       const { 0: client, 1: server } = new WebSocketPair();
       this.ctx.acceptWebSocket(server, [siteId]);
@@ -32543,7 +32825,7 @@ var AnonDO = class extends DurableObject2 {
       if (frame === null) {
         return;
       }
-      const action = actionFromFrame(frame, userId, attachment.cf, attachment.host);
+      const action = actionFromFrame(frame, userId, this.spendSession(ws, frame));
       const ref = parsed.ref ?? action.actionId;
       setSpanAttributes({ "action.id": action.actionId });
       try {
@@ -32556,6 +32838,15 @@ var AnonDO = class extends DurableObject2 {
       this.respond(ws, { t: "ack", ref, anonId: userId });
     });
   }
+  // Re-read, not taken from the message's start: across its awaits a pipelined frame may already have
+  // spent the session's first action.
+  spendSession(ws, frame) {
+    const current = ws.deserializeAttachment();
+    if (current.session?.isNew === true && frame.t !== "alias") {
+      ws.serializeAttachment({ ...current, session: { ...current.session, isNew: false } });
+    }
+    return current;
+  }
   respond(ws, frame) {
     sendFrame(ws, JSON.stringify(frame));
   }
@@ -32596,9 +32887,21 @@ var AnonDO = class extends DurableObject2 {
           addSpanEvent("capture dropped: no visitor state", { level: "warn" });
           return { accepted: {} };
         }
-        const context = await this.sites.resolve(site, Date.now());
-        const writes = acceptedCaptures(context.registry, consentState2(this.kv), input2.apps, context.consentEnforced);
-        return { accepted: this.storeCaptures(writes) };
+        return this.runCaptures(input2.apps, site);
+      });
+    });
+  }
+  // The server door. There is no connect to have seeded the visitor, and a migrated visitor can
+  // carry click ids before any identify, so unlike the socket this one creates the profile.
+  serverCapture(input2, site, trace) {
+    return runInvocation({ name: "do.anon.server_capture", trace }, () => {
+      return this.enqueue(async () => {
+        this.revive();
+        const now = Date.now();
+        this.cleanupAlarm = await seedCleanupAlarm(this.ctx.storage, now, lastActivityAt(this.kv) ?? now, this.cleanupAlarm);
+        seedMeta(this.kv, input2.anonId, now);
+        touchActivity(this.kv, now);
+        return this.runCaptures(input2.apps, site);
       });
     });
   }
@@ -32619,6 +32922,11 @@ var AnonDO = class extends DurableObject2 {
       });
     });
   }
+  async runCaptures(apps, site) {
+    const context = await this.sites.resolve(site, Date.now());
+    const writes = acceptedCaptures(context.registry, consentState2(this.kv), apps, context.consentEnforced);
+    return { accepted: this.storeCaptures(writes) };
+  }
   storeCaptures(writes) {
     if (writes.length === 0) {
       return {};
@@ -32906,9 +33214,11 @@ var AnonDO = class extends DurableObject2 {
     return { action: outcome.action, releaseEmissions };
   }
   appsSnapshot(anonId, context) {
+    const meta3 = storedMeta(this.kv);
     return {
       anonId,
-      globalId: linkedGlobalId(this.kv),
+      globalId: meta3?.linkedGlobalId ?? null,
+      createdAt: meta3?.createdAt ?? null,
       pii: userProperties(this.kv),
       // A wipe dropped the sql tables, so reading them would throw — and reviving for a transform
       // snapshot would strand recreated storage when the chain fails or drops.
@@ -33270,24 +33580,13 @@ var AnonDO = class extends DurableObject2 {
     await this.ctx.storage.setAlarm(target);
     this.cleanupAlarm = target;
   }
-  pushGeoOnConnect(anonId, geo, observedAt) {
+  seedGeoOnConnect(anonId, geo, observedAt) {
     const run = this.enqueue(async () => {
       this.revive();
-      const latest = updateGeo(this.cachedStorage, geo, observedAt);
-      if (latest.length === 0) {
-        return;
-      }
-      const globalId = linkedGlobalId(this.kv);
-      if (globalId === null) {
-        await this.retargetCleanupAlarm(Date.now());
-        return;
-      }
-      recordSyncDebt(this.kv, "ride");
+      updateGeo(this.cachedStorage, geo, observedAt);
       await this.retargetCleanupAlarm(Date.now());
-      const snapshot = await this.sync({ globalId, anonId, syncedAt: observedAt, identifiers: [], latest });
-      await this.applyReturned(snapshot, globalId);
     });
-    this.ctx.waitUntil(run.catch((error61) => console.warn("geo push failed", { anonId, error: error61 })));
+    this.ctx.waitUntil(run.catch((error61) => console.warn("geo seed failed", { anonId, error: error61 })));
   }
 };
 
@@ -33605,6 +33904,7 @@ var GlobalDO = class extends DurableObject3 {
 var app = createApiRouter();
 app.use(requestSpan);
 app.use(siteStatusGuard);
+app.get("/", welcome);
 app.get("/open", open2);
 app.use("/q.js", cors());
 app.get("/q.js", qJs);
@@ -33616,6 +33916,7 @@ app.use("/v1/*", allowCors);
 app.use("/v1/*", bodyLimit({ maxSize: MAX_V1_BODY_BYTES, onError: /* @__PURE__ */ __name((c) => c.json({ error: "too_large" }, 413), "onError") }));
 app.route("/", alias);
 app.route("/", identify);
+app.route("/", capture);
 app.route("/", track);
 app.route("/", properties);
 app.route("/", consent);