@blotout/qinto-cli 0.1.20 → 0.1.21

package/dist/worker-artifact/app-runtime/index.js

@@ -20026,9 +20026,10 @@ var effectGroupSchema = external_exports.object({
   context: external_exports.array(contextWriteSchema).optional()
 }).strict();
 var captureValueSchema = external_exports.object({ value: external_exports.string().max(512), createdAt: external_exports.number().int(), updatedAt: external_exports.number().int(), type: external_exports.enum(CAPTURE_TYPES) }).strict();
+var pageSchema = external_exports.object({ url: external_exports.string().min(1).max(4096), referrer: external_exports.string().min(1).max(4096).optional() }).strict();
 var actionContextFields = {
   occurredAt: external_exports.number().int().nonnegative().safe(),
-  page: external_exports.object({ url: external_exports.string().min(1).max(4096), referrer: external_exports.string().min(1).max(4096).optional() }).strict().optional(),
+  page: pageSchema.optional(),
   network: external_exports.object({
     ip: external_exports.string().min(1).max(64).optional(),
     userAgent: external_exports.string().min(1).max(512).optional(),
@@ -20056,6 +20057,8 @@ var envelopeRequestSchema = external_exports.object({
   }).strict().optional(),
   consent: external_exports.object({ enabled: external_exports.boolean(), categories: external_exports.record(external_exports.string(), external_exports.boolean()), apps: external_exports.record(external_exports.string(), external_exports.boolean()) }).strict().optional(),
   geo: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
+  // Connect envelopes only: the page the visitor's socket opened from.
+  page: pageSchema.optional(),
   // Only what this app captured or wrote for this visitor; `updatedAt` is when the current value
   // was first seen, which is the click time a CAPI `fbc` is built from.
   captures: external_exports.record(external_exports.string().max(64), captureValueSchema).optional(),
@@ -22889,7 +22892,7 @@ var dispatch = async (envelope, versions, env) => {
       if (handler === void 0) {
         return jsonError(200, "missing handler: onConnect");
       }
-      return runInstalls(envelope, env, (ctx) => handler(ctx));
+      return runInstalls(envelope, env, (ctx) => handler({ ...ctx, ...envelope.page === void 0 ? {} : { page: envelope.page } }));
     }
     case "transform": {
       return dispatchTransform(envelope, bundle, env);

package/dist/worker-artifact/main/index.js

@@ -21500,9 +21500,10 @@ var effectGroupSchema = external_exports.object({
   context: external_exports.array(contextWriteSchema).optional()
 }).strict();
 var captureValueSchema = external_exports.object({ value: external_exports.string().max(512), createdAt: external_exports.number().int(), updatedAt: external_exports.number().int(), type: external_exports.enum(CAPTURE_TYPES) }).strict();
+var pageSchema = external_exports.object({ url: external_exports.string().min(1).max(4096), referrer: external_exports.string().min(1).max(4096).optional() }).strict();
 var actionContextFields = {
   occurredAt: external_exports.number().int().nonnegative().safe(),
-  page: external_exports.object({ url: external_exports.string().min(1).max(4096), referrer: external_exports.string().min(1).max(4096).optional() }).strict().optional(),
+  page: pageSchema.optional(),
   network: external_exports.object({
     ip: external_exports.string().min(1).max(64).optional(),
     userAgent: external_exports.string().min(1).max(512).optional(),
@@ -21530,6 +21531,8 @@ var envelopeRequestSchema = external_exports.object({
   }).strict().optional(),
   consent: external_exports.object({ enabled: external_exports.boolean(), categories: external_exports.record(external_exports.string(), external_exports.boolean()), apps: external_exports.record(external_exports.string(), external_exports.boolean()) }).strict().optional(),
   geo: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
+  // Connect envelopes only: the page the visitor's socket opened from.
+  page: pageSchema.optional(),
   // Only what this app captured or wrote for this visitor; `updatedAt` is when the current value
   // was first seen, which is the click time a CAPI `fbc` is built from.
   captures: external_exports.record(external_exports.string().max(64), captureValueSchema).optional(),
@@ -26305,14 +26308,15 @@ var captureAppsField = external_exports.record(external_exports.string().max(30)
   description: "Values to record, keyed by app slug and then by capture name. A name the app does not declare is dropped.",
   example: { facebook: { fbclid: "IwAR0abc" }, "google-ads": { gclid: "Cj0KCQ" } }
 });
+var pageContextField = external_exports.object({
+  url: external_exports.string().min(1).max(4096),
+  referrer: external_exports.string().min(1).max(4096).optional()
+}).strict();
 var serverActionContextField = external_exports.object({
   occurredAt: external_exports.number().int().nonnegative().safe().optional().openapi({
     description: "When the visitor action occurred, as Unix milliseconds; defaults to Qinto receipt time."
   }),
-  page: external_exports.object({
-    url: external_exports.string().min(1).max(4096),
-    referrer: external_exports.string().min(1).max(4096).optional()
-  }).strict().optional(),
+  page: pageContextField.optional(),
   network: external_exports.object({
     ip: external_exports.string().min(1).max(64).optional(),
     userAgent: external_exports.string().min(1).max(512).optional(),
@@ -27718,6 +27722,7 @@ var buildEnvelope = /* @__PURE__ */ __name((target, trigger, snapshot, context)
     },
     ...buckets.includes("consentState") ? { consent: { enabled: context.consentEnforced, categories: snapshot.consent.categories, apps: snapshot.consent.apps } } : {},
     ...geoAllowed && currentGeo !== void 0 ? { geo: currentGeo } : {},
+    ...trigger.kind === "connect" && trigger.page !== void 0 && buckets.includes("eventContext") ? { page: trigger.page } : {},
     // Not gated on a capabilities.data bucket: an app only ever sees what it captured or wrote.
     ...captures === void 0 ? {} : { captures },
     ...visitorContext === void 0 ? {} : { context: visitorContext },
@@ -30087,9 +30092,141 @@ var defaultHook = /* @__PURE__ */ __name((result, c) => {
 }, "defaultHook");
 var createApiRouter = /* @__PURE__ */ __name(() => new OpenAPIHono({ defaultHook }), "createApiRouter");
 
+// src/id-graph/anon/connection.ts
+var CONNECTION_CF_HEADER = "x-connection-cf";
+var SESSION_HEADER = "x-session";
+var OPEN_PAGE_PARAMS = ["url", "referrer"];
+var MAX_HOST_USER_AGENT_LENGTH = 512;
+var MAX_HOST_LOCALE_LENGTH = 64;
+var INTERNAL_HEADERS = /* @__PURE__ */ new Set([
+  "x-user-id",
+  "x-new-user",
+  "x-geo",
+  SITE_ID_HEADER,
+  CONNECTION_CF_HEADER,
+  SESSION_HEADER,
+  TRACE_HEADER,
+  CF_DATA_HEADER
+]);
+var REDACTED_HEADERS = /* @__PURE__ */ new Set(["authorization"]);
+var encodeConnectionCf = /* @__PURE__ */ __name((cf) => {
+  if (cf === void 0) {
+    return void 0;
+  }
+  const encoded = headerJson(cf);
+  return encoded.length > MAX_ATTACHMENT_BYTES ? void 0 : encoded;
+}, "encodeConnectionCf");
+var forwardedCf = /* @__PURE__ */ __name((request) => {
+  const raw2 = request.headers.get(CONNECTION_CF_HEADER);
+  if (raw2 === null) {
+    return void 0;
+  }
+  return JSON.parse(raw2);
+}, "forwardedCf");
+var forwardedSession = /* @__PURE__ */ __name((request) => {
+  const raw2 = request.headers.get(SESSION_HEADER);
+  if (raw2 === null) {
+    return void 0;
+  }
+  return JSON.parse(raw2);
+}, "forwardedSession");
+var withoutPageParams = /* @__PURE__ */ __name((url2) => {
+  const parsed = new URL(url2);
+  for (const param of OPEN_PAGE_PARAMS) {
+    parsed.searchParams.delete(param);
+  }
+  return parsed.toString();
+}, "withoutPageParams");
+var connectPage = /* @__PURE__ */ __name((request) => {
+  const params = new URL(request.url).searchParams;
+  const url2 = params.get("url");
+  if (url2 === null) {
+    return void 0;
+  }
+  const referrer = params.get("referrer");
+  const parsed = pageContextField.safeParse({ url: url2, ...referrer === null ? {} : { referrer } });
+  return parsed.success ? parsed.data : void 0;
+}, "connectPage");
+var connectAttrs = /* @__PURE__ */ __name((request, geo) => {
+  const headers = {};
+  for (const [name, value] of request.headers) {
+    const lower = name.toLowerCase();
+    if (!INTERNAL_HEADERS.has(lower) && !REDACTED_HEADERS.has(lower)) {
+      headers[name] = value;
+    }
+  }
+  const cf = forwardedCf(request);
+  return {
+    "url.full": withoutPageParams(request.url),
+    "http.request.headers": JSON.stringify(headers),
+    ...cf === void 0 ? {} : { "qinto.cf": JSON.stringify(cf) },
+    ...geo === void 0 ? {} : { "qinto.geo": JSON.stringify(loggableGeo(geo)) }
+  };
+}, "connectAttrs");
+var withoutQuery = /* @__PURE__ */ __name((url2) => {
+  const parsed = new URL(url2);
+  parsed.search = "";
+  return parsed.toString();
+}, "withoutQuery");
+var browserGeoFrom = /* @__PURE__ */ __name((geo) => {
+  if (geo === void 0) {
+    return void 0;
+  }
+  return {
+    country: geo.country ?? null,
+    // EdgeTag's geoRegion is Cloudflare's subdivision code.
+    region: geo.regionCode ?? null,
+    state: geo.region ?? null,
+    isEU: geo.isEUCountry === "yes"
+  };
+}, "browserGeoFrom");
+var attachmentFieldBytes = /* @__PURE__ */ __name((name, value) => {
+  return value === void 0 ? 0 : new TextEncoder().encode(`,"${name}":${JSON.stringify(value)}`).length;
+}, "attachmentFieldBytes");
+var boundedHost = /* @__PURE__ */ __name((request) => {
+  const raw2 = hostFromRequest(request);
+  const bounded = {
+    ip: raw2.ip,
+    userAgent: raw2.userAgent !== void 0 && raw2.userAgent.length <= MAX_HOST_USER_AGENT_LENGTH ? raw2.userAgent : void 0,
+    locale: raw2.locale !== void 0 && raw2.locale.length <= MAX_HOST_LOCALE_LENGTH ? raw2.locale : void 0
+  };
+  return bounded.ip === void 0 && bounded.userAgent === void 0 && bounded.locale === void 0 ? void 0 : bounded;
+}, "boundedHost");
+var connectionAttachment = /* @__PURE__ */ __name((request, geo, siteId) => {
+  const userAgent = request.headers.get("user-agent");
+  const attrs = {
+    "url.full": withoutQuery(request.url),
+    ...geo?.country === void 0 ? {} : { "qinto.country": geo.country },
+    ...geo?.city === void 0 ? {} : { "qinto.city": geo.city },
+    ...userAgent === null ? {} : { user_agent: userAgent }
+  };
+  const host = boundedHost(request);
+  const hostBytes = attachmentFieldBytes("host", host);
+  const browserGeo = browserGeoFrom(geo);
+  const browserGeoBytes = attachmentFieldBytes("browserGeo", browserGeo);
+  const session2 = forwardedSession(request);
+  const sessionBytes = attachmentFieldBytes("session", session2);
+  const siteBytes = attachmentFieldBytes("siteId", siteId);
+  const cf = forwardedCf(request);
+  const cfSuffix = cf === void 0 ? "" : `,"cf":${JSON.stringify(cf)}`;
+  const cfBytes = new TextEncoder().encode(cfSuffix).length;
+  const emptyAttrsBytes = new TextEncoder().encode(JSON.stringify({ attrs: {} })).length;
+  const fixedBytes = siteBytes + sessionBytes + hostBytes + browserGeoBytes;
+  const includedCf = cfBytes <= MAX_ATTACHMENT_BYTES - emptyAttrsBytes - fixedBytes ? cf : void 0;
+  const budgeted = budgetAttrs(attrs, MAX_ATTACHMENT_BYTES - fixedBytes - (includedCf === void 0 ? 0 : cfBytes));
+  return {
+    ...budgeted,
+    siteId,
+    ...session2 === void 0 ? {} : { session: session2 },
+    ...browserGeo === void 0 ? {} : { browserGeo },
+    ...includedCf === void 0 ? {} : { cf: includedCf },
+    ...host === void 0 ? {} : { host }
+  };
+}, "connectionAttachment");
+
 // src/helpers/request-span.ts
 var OMITTED_HEADERS = /* @__PURE__ */ new Set(["authorization", DISPATCH_HEADER, CF_DATA_HEADER]);
-var requestAttrs = /* @__PURE__ */ __name((request) => {
+var requestAttrs = /* @__PURE__ */ __name((request, pathname) => {
   const headers = {};
   for (const [name, value] of request.headers) {
     if (!OMITTED_HEADERS.has(name.toLowerCase())) {
@@ -30099,7 +30236,7 @@ var requestAttrs = /* @__PURE__ */ __name((request) => {
   const cf = request.cf;
   return {
     "http.request.method": request.method,
-    "url.full": request.url,
+    "url.full": pathname === "/open" ? withoutPageParams(request.url) : request.url,
     "http.request.headers": JSON.stringify(headers),
     ...cf === void 0 ? {} : { "qinto.cf": JSON.stringify(cf) }
   };
@@ -30114,7 +30251,7 @@ var requestSpan = /* @__PURE__ */ __name(async (c, next) => {
   const pathname = new URL(c.req.url).pathname;
   const dispatch = parseDispatchTrace(c.req.raw.headers.get(DISPATCH_HEADER));
   const trace = dispatch === void 0 ? inboundTrace(c.req.raw, pathname) : { traceId: dispatch.traceId, parent: dispatch.spanId };
-  await runInvocation({ name: `${c.req.method} ${pathname}`, trace, attrs: requestAttrs(c.req.raw) }, async () => {
+  await runInvocation({ name: `${c.req.method} ${pathname}`, trace, attrs: requestAttrs(c.req.raw, pathname) }, async () => {
     try {
       await next();
       setSpanAttributes({ "http.response.status_code": c.res.status });
@@ -30321,120 +30458,6 @@ idGraphInspect.post("/internal/id-graph/rows", async (c) => {
   return c.json({ page: await inspectObjectTable(c.env, body) });
 });
 
-// src/id-graph/anon/connection.ts
-var CONNECTION_CF_HEADER = "x-connection-cf";
-var SESSION_HEADER = "x-session";
-var MAX_HOST_USER_AGENT_LENGTH = 512;
-var MAX_HOST_LOCALE_LENGTH = 64;
-var INTERNAL_HEADERS = /* @__PURE__ */ new Set([
-  "x-user-id",
-  "x-new-user",
-  "x-geo",
-  SITE_ID_HEADER,
-  CONNECTION_CF_HEADER,
-  SESSION_HEADER,
-  TRACE_HEADER,
-  CF_DATA_HEADER
-]);
-var REDACTED_HEADERS = /* @__PURE__ */ new Set(["authorization"]);
-var encodeConnectionCf = /* @__PURE__ */ __name((cf) => {
-  if (cf === void 0) {
-    return void 0;
-  }
-  const encoded = headerJson(cf);
-  return encoded.length > MAX_ATTACHMENT_BYTES ? void 0 : encoded;
-}, "encodeConnectionCf");
-var forwardedCf = /* @__PURE__ */ __name((request) => {
-  const raw2 = request.headers.get(CONNECTION_CF_HEADER);
-  if (raw2 === null) {
-    return void 0;
-  }
-  return JSON.parse(raw2);
-}, "forwardedCf");
-var forwardedSession = /* @__PURE__ */ __name((request) => {
-  const raw2 = request.headers.get(SESSION_HEADER);
-  if (raw2 === null) {
-    return void 0;
-  }
-  return JSON.parse(raw2);
-}, "forwardedSession");
-var connectAttrs = /* @__PURE__ */ __name((request, geo) => {
-  const headers = {};
-  for (const [name, value] of request.headers) {
-    const lower = name.toLowerCase();
-    if (!INTERNAL_HEADERS.has(lower) && !REDACTED_HEADERS.has(lower)) {
-      headers[name] = value;
-    }
-  }
-  const cf = forwardedCf(request);
-  return {
-    "url.full": request.url,
-    "http.request.headers": JSON.stringify(headers),
-    ...cf === void 0 ? {} : { "qinto.cf": JSON.stringify(cf) },
-    ...geo === void 0 ? {} : { "qinto.geo": JSON.stringify(loggableGeo(geo)) }
-  };
-}, "connectAttrs");
-var withoutQuery = /* @__PURE__ */ __name((url2) => {
-  const parsed = new URL(url2);
-  parsed.search = "";
-  return parsed.toString();
-}, "withoutQuery");
-var browserGeoFrom = /* @__PURE__ */ __name((geo) => {
-  if (geo === void 0) {
-    return void 0;
-  }
-  return {
-    country: geo.country ?? null,
-    // EdgeTag's geoRegion is Cloudflare's subdivision code.
-    region: geo.regionCode ?? null,
-    state: geo.region ?? null,
-    isEU: geo.isEUCountry === "yes"
-  };
-}, "browserGeoFrom");
-var attachmentFieldBytes = /* @__PURE__ */ __name((name, value) => {
-  return value === void 0 ? 0 : new TextEncoder().encode(`,"${name}":${JSON.stringify(value)}`).length;
-}, "attachmentFieldBytes");
-var boundedHost = /* @__PURE__ */ __name((request) => {
-  const raw2 = hostFromRequest(request);
-  const bounded = {
-    ip: raw2.ip,
-    userAgent: raw2.userAgent !== void 0 && raw2.userAgent.length <= MAX_HOST_USER_AGENT_LENGTH ? raw2.userAgent : void 0,
-    locale: raw2.locale !== void 0 && raw2.locale.length <= MAX_HOST_LOCALE_LENGTH ? raw2.locale : void 0
-  };
-  return bounded.ip === void 0 && bounded.userAgent === void 0 && bounded.locale === void 0 ? void 0 : bounded;
-}, "boundedHost");
-var connectionAttachment = /* @__PURE__ */ __name((request, geo, siteId) => {
-  const userAgent = request.headers.get("user-agent");
-  const attrs = {
-    "url.full": withoutQuery(request.url),
-    ...geo?.country === void 0 ? {} : { "qinto.country": geo.country },
-    ...geo?.city === void 0 ? {} : { "qinto.city": geo.city },
-    ...userAgent === null ? {} : { user_agent: userAgent }
-  };
-  const host = boundedHost(request);
-  const hostBytes = attachmentFieldBytes("host", host);
-  const browserGeo = browserGeoFrom(geo);
-  const browserGeoBytes = attachmentFieldBytes("browserGeo", browserGeo);
-  const session2 = forwardedSession(request);
-  const sessionBytes = attachmentFieldBytes("session", session2);
-  const siteBytes = attachmentFieldBytes("siteId", siteId);
-  const cf = forwardedCf(request);
-  const cfSuffix = cf === void 0 ? "" : `,"cf":${JSON.stringify(cf)}`;
-  const cfBytes = new TextEncoder().encode(cfSuffix).length;
-  const emptyAttrsBytes = new TextEncoder().encode(JSON.stringify({ attrs: {} })).length;
-  const fixedBytes = siteBytes + sessionBytes + hostBytes + browserGeoBytes;
-  const includedCf = cfBytes <= MAX_ATTACHMENT_BYTES - emptyAttrsBytes - fixedBytes ? cf : void 0;
-  const budgeted = budgetAttrs(attrs, MAX_ATTACHMENT_BYTES - fixedBytes - (includedCf === void 0 ? 0 : cfBytes));
-  return {
-    ...budgeted,
-    siteId,
-    ...session2 === void 0 ? {} : { session: session2 },
-    ...browserGeo === void 0 ? {} : { browserGeo },
-    ...includedCf === void 0 ? {} : { cf: includedCf },
-    ...host === void 0 ? {} : { host }
-  };
-}, "connectionAttachment");
-
 // src/paths/open.ts
 var withSetCookie = /* @__PURE__ */ __name((res, cookies) => {
   if (res.webSocket) {
@@ -31638,6 +31661,10 @@ var acceptedCaptures = /* @__PURE__ */ __name((registry3, consent2, apps, enforc
   }
   return accepted;
 }, "acceptedCaptures");
+var declaredTtlMs = /* @__PURE__ */ __name((registry3, appId, key) => {
+  const app2 = registry3.apps[appId];
+  return app2 === void 0 ? null : declaration(app2, key)?.ttlMs ?? null;
+}, "declaredTtlMs");
 
 // src/id-graph/kv-cache.ts
 var cachedKv = /* @__PURE__ */ __name((kv) => {
@@ -32562,7 +32589,7 @@ var MAX_BROWSER_RESULTS_BYTES = 32 * 1024;
 var MAX_FRAME_BYTES = 64 * 1024;
 var browserContextFrame = external_exports.object({
   occurredAt: external_exports.number().int().nonnegative().safe(),
-  page: external_exports.object({ url: external_exports.string().min(1).max(4096), referrer: external_exports.string().min(1).max(4096).optional() }).strict()
+  page: pageContextField
 }).strict();
 var browserResult = external_exports.unknown().refine((value) => {
   return new TextEncoder().encode(JSON.stringify(value)).length <= MAX_BROWSER_RESULT_BYTES;
@@ -32794,8 +32821,14 @@ var AnonDO = class extends DurableObject2 {
       const attachment = connectionAttachment(request, geo, siteId);
       server.serializeAttachment(attachment);
       this.sendSharedContext([server], context);
+      const page = connectPage(request);
       this.appFanOut(
-        { kind: "connect", ...attachment.cf === void 0 ? {} : { geo: attachment.cf }, host: attachment.host },
+        {
+          kind: "connect",
+          ...attachment.cf === void 0 ? {} : { geo: attachment.cf },
+          host: attachment.host,
+          ...page === void 0 ? {} : { page }
+        },
         userId,
         context
       );
@@ -32996,7 +33029,11 @@ var AnonDO = class extends DurableObject2 {
         if (!appWriteAllowed(context.registry, consentState2(this.kv), input2.slug, context.consentEnforced)) {
           return;
         }
-        this.storeCaptures(input2.writes.map((write) => ({ ...write, appId: input2.slug, source: "app", ttlMs: null })));
+        this.storeCaptures(
+          input2.writes.map((write) => {
+            return { ...write, appId: input2.slug, source: "app", ttlMs: declaredTtlMs(context.registry, input2.slug, write.key) };
+          })
+        );
       });
     });
   }

package/dist/worker-artifact/version.json

@@ -1,8 +1,8 @@
 {
   "main": {
-    "version": "0.1.4",
-    "gitSha": "84a03b1ccdff814840f560c7efd0f72837454227",
-    "builtAt": "2026-09-24T14:23:50.391Z",
+    "version": "0.1.5",
+    "gitSha": "7c31ca4765a91cfd5098f098208c2409638b6e24",
+    "builtAt": "2026-09-25T12:23:20.370Z",
     "compatibilityDate": "2026-06-23",
     "compatibilityFlags": [
       "nodejs_compat"
@@ -39,9 +39,9 @@
     ]
   },
   "app-runtime": {
-    "version": "0.1.2",
-    "gitSha": "5c24e6442ad668125bba59aaec084adb43b70d1d",
-    "builtAt": "2026-09-24T14:23:53.656Z",
+    "version": "0.1.3",
+    "gitSha": "5991b0352059c2c9701ccc4e3414dc93fbba3371",
+    "builtAt": "2026-09-25T12:23:22.651Z",
     "compatibilityDate": "2026-06-23",
     "compatibilityFlags": [
       "nodejs_compat"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blotout/qinto-cli",
-  "version": "0.1.20",
+  "version": "0.1.21",
   "type": "module",
   "description": "Qinto CLI: authenticate against the Qinto platform and operate it from the terminal or from an agent.",
   "repository": {
@@ -16,8 +16,7 @@
   },
   "files": [
     "bin",
-    "dist",
-    "templates"
+    "dist"
   ],
   "publishConfig": {
     "access": "public"
@@ -35,6 +34,7 @@
     "@qinto/app-build": "0.0.0",
     "@qinto/app-dev": "0.0.0",
     "@qinto/app-manifest": "0.0.0",
+    "@qinto/app-templates": "0.0.0",
     "@qinto/oauth-grammar": "0.0.0",
     "@types/node": "25.9.5",
     "@types/proper-lockfile": "4.1.4",

package/templates/app/full/qinto.app.jsonc

@@ -1,129 +0,0 @@
-{
-  "$schema": "./node_modules/@blotout/qinto-sdk-app/app.schema.json",
-  // The immutable identifier of the app on the Qinto platform.
-  "slug": "__APP_SLUG__",
-  "name": "__APP_NAME__",
-  "description": "Rewrites events on their way through, records purchases, forwards them onward, and ships its own panel.",
-  // This app both rewrites events before destinations see them and receives them afterwards.
-  "flows": ["transform", "destination"],
-  // Events reach the app only when the visitor granted this consent category.
-  "consent": { "category": "marketing" },
-  // Replace these with your own hosted documents before publishing.
-  "legal": {
-    "termsUrl": "https://example.com/terms",
-    "privacyUrl": "https://example.com/privacy"
-  },
-  "server": {
-    "entry": "src/server.ts",
-    // Must match the __hooks the server entry exports.
-    "hooks": {
-      "transform": ["track"],
-      "onEvent": ["track", "identify"],
-      "onConnect": false,
-      "onLifecycle": ["installed", "configurationChanged", "uninstalled"]
-    },
-    // Time-based runs, with no visitor behind them — a nightly rollup, a vendor reconcile, a
-    // backfill kick-off. Each entry is attempted once per active install per matching window, best
-    // effort: a missed run is not caught up, so keep handlers repeatable. The minute field must be a
-    // literal, which is what holds a schedule to at most one run an hour; the rest is standard
-    // five-field cron in UTC, with day-of-week 0 = Sunday. Ids key the handlers the bundle
-    // registers under "schedules", and the publish refuses a mismatch either way.
-    "schedules": [{ "id": "daily-rollup", "cron": "0 2 * * *", "description": "Nightly per-install rollup" }]
-  },
-  // The browser bundle ships to the visitor's page alongside the tag. "entry" is optional: an app
-  // that only wants "capture" declares this block without shipping any browser code.
-  //
-  // "capture" names the query params and cookies the platform records against each visitor for
-  // this app, which only this app reads back. Each name belongs to one list. Uncomment to use it —
-  // a site manager sees the list and must accept any name a later version adds.
-  //
-  // "type" says what a value is: "attribution" for a click or campaign id, "identity" (the default)
-  // for a vendor id that names the visitor across visits. "expiresInSeconds" is optional and runs
-  // from the first sighting of that value; seeing the same value again never extends it. Omit it to
-  // keep the value for the life of the visitor profile.
-  // "capture": { "queryParams": [{ "name": "fbclid", "type": "attribution", "expiresInSeconds": 604800 }], "cookies": [{ "name": "_fbp" }] },
-  // eventResults lets the matching server install receive this browser handler's return value on
-  // the same action as action.browser. It is untrusted page input and delivery stays fail-open.
-  "browser": { "entry": "src/browser.ts", "eventResults": ["track"] },
-  "capabilities": {
-    "api": [],
-    // "pii" is what puts the visitor's email in ctx.user.properties.
-    "data": ["pii", "customProperties", "eventContext"]
-  },
-  // The platform creates this database, binds it as env.PURCHASES, and applies these immutable,
-  // ordered entries. Expand entries are additive and run before rollout. Use backfill handlers for
-  // resumable data work and contract entries for destructive SQL after old bundles are gone.
-  "resources": [
-    {
-      "type": "d1",
-      "identifier": "purchases",
-      "binding": "PURCHASES",
-      "migrations": [
-        {
-          "id": "001-create-purchases",
-          "phase": "expand",
-          "statements": [
-            "CREATE TABLE IF NOT EXISTS purchases (order_id TEXT PRIMARY KEY, value REAL NOT NULL, email_sha256 TEXT, recorded_at INTEGER NOT NULL)"
-          ]
-        },
-        {
-          "id": "002-index-purchases",
-          "phase": "expand",
-          "statements": ["CREATE INDEX IF NOT EXISTS purchases_recorded_at ON purchases (recorded_at)"]
-        }
-      ]
-    }
-  ],
-  // What a site manager fills in per install; a secret never reaches the browser.
-  "variables": [
-    {
-      "name": "ENDPOINT_URL",
-      "kind": "plain",
-      "type": "text",
-      "label": "Delivery endpoint",
-      "required": true,
-      "helpText": "The HTTPS endpoint each event is forwarded to. Until it is set the install stays inactive and sends nothing."
-    },
-    {
-      "name": "API_KEY",
-      "kind": "secret",
-      "type": "password",
-      "label": "API key",
-      "required": true,
-      "helpText": "The key this app authenticates to that endpoint with."
-    },
-    {
-      "name": "SITE_TAG",
-      "kind": "plain",
-      "type": "text",
-      "label": "Site tag",
-      "browser": true,
-      "helpText": "Sent with every event, and readable from the browser bundle."
-    },
-    {
-      "name": "LAST_SYNCED_AT",
-      "kind": "plain",
-      "type": "text",
-      "label": "Last synced",
-      "helpText": "Written by the panel's own /refresh handler; nobody fills this in by hand."
-    }
-  ],
-  // A site installs this app once per destination, so the panel switches between them.
-  "install": { "multiple": true, "labelHint": "e.g. EU endpoint" },
-  // Values you set once for the whole app with `qinto app var set` / `qinto app secret set`; every
-  // site that installs it gets the same one, and a required one blocks the publish until it is set.
-  // They are never written here: this file is snapshotted into the published version and readable.
-  "appVariables": [
-    {
-      "name": "VENDOR_APP_SECRET",
-      "kind": "secret",
-      "type": "password",
-      "label": "Vendor app secret",
-      "required": true,
-      "helpText": "Your own credential with the vendor, the same for every site. Set it with `qinto app secret set`."
-    }
-  ],
-  // The panel the platform renders in an iframe, and the command that builds it. "writesSettings"
-  // lets its server handler change this site's settings for the app; a site manager accepts it once.
-  "ui": { "dir": "ui/dist", "build": "npm run build", "writesSettings": true }
-}

package/templates/app/full/src/browser.ts

@@ -1,15 +0,0 @@
-import { defineBrowserApp } from '@blotout/qinto-sdk-app/browser'
-
-export default defineBrowserApp((app) => {
-  // The factory runs once per active install, with that install's
-  // browser-exposed plain variables in app.variables.
-  app.onEvent((event) => {
-    console.info('event on the page', event.event, app.variables.SITE_TAG)
-
-    return { observedAt: Date.now(), siteTag: app.variables.SITE_TAG }
-  })
-
-  app.onPush((message) => {
-    console.info('server push', message.from, message.topic, message.data)
-  })
-})