@blotout/qinto-cli 0.1.20 → 0.1.22

package/dist/worker-artifact/main/index.js

@@ -790,6 +790,10 @@ var deriveVisitorSignature = /* @__PURE__ */ __name(async (masterBase64, domainI
   return hmacHex(masterBase64, `${domainId}#visitor#${anonId}`);
 }, "deriveVisitorSignature");
 
+// ../../libs/app-manifest/src/app-roles.ts
+var DECLARABLE_APP_ROLES = ["owner", "admin", "manager", "editor", "member", "viewer"];
+var APP_ROLES = ["full", ...DECLARABLE_APP_ROLES];
+
 // ../../libs/app-manifest/src/cron.ts
 var MAX_CRON_LENGTH = 128;
 var MINUTE_LITERAL = /^([0-9]|[1-5][0-9])$/;
@@ -20348,6 +20352,10 @@ var VARIABLE_NAME = /^[A-Z][A-Z0-9_]*$/;
 var APP_SLUG_PATTERN = /^[a-z][a-z0-9-]{2,29}$/;
 var FUNCTION_NAME = /^[a-zA-Z_$][a-zA-Z0-9_$]*$/;
 var identifierField = external_exports.string().min(1).max(64).regex(IDENTIFIER);
+var RENDERABLE_TEXT = /^[^\u0000-\u0009\u000B-\u001F\u007F\u200B-\u200F\u202A-\u202E\u2066-\u2069\uFEFF]*$/;
+var renderableText = /* @__PURE__ */ __name((min, max) => {
+  return external_exports.string().min(min).max(max).regex(RENDERABLE_TEXT, "must not carry control or bidirectional-override characters");
+}, "renderableText");
 var httpsUrl = /* @__PURE__ */ __name((field) => {
   return external_exports.url().max(2048).refine((value) => value.startsWith("https://"), `${field} must be an HTTPS URL`);
 }, "httpsUrl");
@@ -20483,6 +20491,35 @@ var validateOauth = /* @__PURE__ */ __name((input2, ctx) => {
   }
 }, "validateOauth");
 
+// ../../libs/app-manifest/src/roles.ts
+var MAX_APP_ROLE_DESCRIPTION = 200;
+var roleSchema = external_exports.object({
+  key: external_exports.enum(DECLARABLE_APP_ROLES, {
+    error: /* @__PURE__ */ __name((issue2) => {
+      return issue2.input === "full" ? "full access is always available and is not declared" : void 0;
+    }, "error")
+  }),
+  description: renderableText(1, MAX_APP_ROLE_DESCRIPTION).optional()
+}).strict();
+var rolesSchema = external_exports.array(roleSchema).max(DECLARABLE_APP_ROLES.length).superRefine((roles, ctx) => {
+  uniqueOrIssue(
+    ctx,
+    roles.map((role) => role.key),
+    [],
+    "role"
+  );
+}).transform((roles) => {
+  return [...roles].sort((a, b) => APP_ROLES.indexOf(a.key) - APP_ROLES.indexOf(b.key));
+});
+var validateRoles = /* @__PURE__ */ __name((manifest, ctx) => {
+  const declared = /* @__PURE__ */ new Set(["full", ...(manifest.roles ?? []).map((role) => role.key)]);
+  for (const [index, tool] of manifest.tools.entries()) {
+    if (tool.role !== void 0 && !declared.has(tool.role)) {
+      ctx.addIssue({ code: "custom", path: ["tools", index, "role"], message: `Tool role ${tool.role} is not declared in roles` });
+    }
+  }
+}, "validateRoles");
+
 // ../../libs/app-manifest/src/route.ts
 var ENDPOINT_PATH_PATTERN = /^\/(?:(?::[a-zA-Z][a-zA-Z0-9_]*|[a-zA-Z0-9_-]+)(?:\/(?::[a-zA-Z][a-zA-Z0-9_]*|[a-zA-Z0-9_-]+))*)?$/;
 var isParam = /* @__PURE__ */ __name((segment) => {
@@ -20579,10 +20616,6 @@ var MAX_MANIFEST_TOOLS_BYTES = 150 * 1024;
 var TOOL_PROPERTY_NAME = /^[a-zA-Z][a-zA-Z0-9_]*$/;
 var RESERVED_TOOL_ARGUMENTS = ["teamId", "siteId", "installId"];
 var TOOL_STRING_FORMATS = ["uuid", "date", "date-time", "email", "uri"];
-var RENDERABLE_TEXT = /^[^\u0000-\u0009\u000B-\u001F\u007F\u200B-\u200F\u202A-\u202E\u2066-\u2069\uFEFF]*$/;
-var renderableText = /* @__PURE__ */ __name((min, max) => {
-  return external_exports.string().min(min).max(max).regex(RENDERABLE_TEXT, "must not carry control or bidirectional-override characters");
-}, "renderableText");
 var propertyName = external_exports.string().min(1).max(48).regex(TOOL_PROPERTY_NAME);
 var FORMAT_SCHEMAS = {
   uuid: external_exports.uuid(),
@@ -20678,7 +20711,8 @@ var toolSchema = external_exports.object({
   title: renderableText(1, MAX_APP_TOOL_TITLE_LENGTH),
   description: renderableText(MIN_APP_TOOL_DESCRIPTION, MAX_APP_TOOL_DESCRIPTION),
   inputSchema: toolInputSchema,
-  annotations: toolAnnotationsSchema
+  annotations: toolAnnotationsSchema,
+  role: external_exports.enum(APP_ROLES).optional()
 }).strict();
 var nodeChildren = /* @__PURE__ */ __name((value) => {
   const properties2 = value["properties"];
@@ -21082,6 +21116,9 @@ var baseSchema = external_exports.object({
     description: "The push topics this app broadcasts to every app on the site. Requires the `sharedContext` data capability; a topic left out reaches only this app\u2019s own browser code."
   }),
   endpoints: external_exports.array(endpointSchema).max(16).default([]).meta({ description: "The HTTP routes served at https://<site>/app/<slug><path>." }),
+  roles: rolesSchema.optional().meta({
+    description: "The app roles this app uses, from the fixed list owner, admin, manager, editor, member, viewer. Full access is always available and is not declared. A team member is given one app role per app."
+  }),
   tools: toolsSchema.meta({
     description: "The MCP tools this app serves to AI assistants, published as `<slug>_<name>`. Each one a site manager accepts becomes callable on their behalf by an assistant."
   }),
@@ -21438,6 +21475,7 @@ var appManifestSchema = baseSchema.superRefine((manifest, ctx) => {
   validateOauth(manifest, ctx);
   validateServer(manifest, ctx);
   validateTools(manifest.tools, ctx);
+  validateRoles(manifest, ctx);
 });
 
 // ../../libs/app-manifest/src/oauth-flow.ts
@@ -21500,9 +21538,10 @@ var effectGroupSchema = external_exports.object({
   context: external_exports.array(contextWriteSchema).optional()
 }).strict();
 var captureValueSchema = external_exports.object({ value: external_exports.string().max(512), createdAt: external_exports.number().int(), updatedAt: external_exports.number().int(), type: external_exports.enum(CAPTURE_TYPES) }).strict();
+var pageSchema = external_exports.object({ url: external_exports.string().min(1).max(4096), referrer: external_exports.string().min(1).max(4096).optional() }).strict();
 var actionContextFields = {
   occurredAt: external_exports.number().int().nonnegative().safe(),
-  page: external_exports.object({ url: external_exports.string().min(1).max(4096), referrer: external_exports.string().min(1).max(4096).optional() }).strict().optional(),
+  page: pageSchema.optional(),
   network: external_exports.object({
     ip: external_exports.string().min(1).max(64).optional(),
     userAgent: external_exports.string().min(1).max(512).optional(),
@@ -21530,6 +21569,8 @@ var envelopeRequestSchema = external_exports.object({
   }).strict().optional(),
   consent: external_exports.object({ enabled: external_exports.boolean(), categories: external_exports.record(external_exports.string(), external_exports.boolean()), apps: external_exports.record(external_exports.string(), external_exports.boolean()) }).strict().optional(),
   geo: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
+  // Connect envelopes only: the page the visitor's socket opened from.
+  page: pageSchema.optional(),
   // Only what this app captured or wrote for this visitor; `updatedAt` is when the current value
   // was first seen, which is the click time a CAPI `fbc` is built from.
   captures: external_exports.record(external_exports.string().max(64), captureValueSchema).optional(),
@@ -21705,7 +21746,12 @@ var toolSchema2 = external_exports.object({
   name: external_exports.string().min(1).max(MAX_APP_TOOL_NAME_LENGTH).regex(APP_TOOL_NAME_PATTERN),
   // Who asked, and what they may do on this site. Derived from the bearer by the portal, never
   // from the model's arguments.
-  viewer: external_exports.object({ userId: external_exports.string().min(1).max(64), access: external_exports.enum(["read", "write"]) }).strict(),
+  viewer: external_exports.object({
+    userId: external_exports.string().min(1).max(64),
+    access: external_exports.enum(["read", "write"]),
+    // Optional only while a site worker or app runtime that predates it can still receive this envelope; absent means `full`.
+    appRole: external_exports.enum(APP_ROLES).optional()
+  }).strict(),
   // Already validated against the tool's declared inputSchema, with the reserved routing names
   // stripped. Every declared input schema has an object root, so this is an object too — and a
   // call that names no arguments normalizes to `{}` rather than reaching the handler as undefined.
@@ -21911,7 +21957,12 @@ var MAX_UI_BODY_BYTES = 1024 * 1024;
 var uiInstallSchema = external_exports.object({ id: external_exports.string().min(1).max(64), ord: external_exports.number().int().min(1), label: external_exports.string().max(100), enabled: external_exports.boolean() }).strict();
 var uiContextSchema = external_exports.object({
   version: external_exports.string().min(1).max(32),
-  viewer: external_exports.object({ userId: external_exports.string().min(1).max(64), access: external_exports.enum(["read", "write"]) }).strict(),
+  viewer: external_exports.object({
+    userId: external_exports.string().min(1).max(64),
+    access: external_exports.enum(["read", "write"]),
+    // Optional only while a site worker that predates it can still send this header; absent means `full`.
+    appRole: external_exports.enum(APP_ROLES).optional()
+  }).strict(),
   install: uiInstallSchema,
   installs: external_exports.array(uiInstallSchema).min(1).max(MAX_INSTALLS_PER_APP),
   writeTicket: external_exports.string().min(1).max(2048).optional()
@@ -26305,14 +26356,15 @@ var captureAppsField = external_exports.record(external_exports.string().max(30)
   description: "Values to record, keyed by app slug and then by capture name. A name the app does not declare is dropped.",
   example: { facebook: { fbclid: "IwAR0abc" }, "google-ads": { gclid: "Cj0KCQ" } }
 });
+var pageContextField = external_exports.object({
+  url: external_exports.string().min(1).max(4096),
+  referrer: external_exports.string().min(1).max(4096).optional()
+}).strict();
 var serverActionContextField = external_exports.object({
   occurredAt: external_exports.number().int().nonnegative().safe().optional().openapi({
     description: "When the visitor action occurred, as Unix milliseconds; defaults to Qinto receipt time."
   }),
-  page: external_exports.object({
-    url: external_exports.string().min(1).max(4096),
-    referrer: external_exports.string().min(1).max(4096).optional()
-  }).strict().optional(),
+  page: pageContextField.optional(),
   network: external_exports.object({
     ip: external_exports.string().min(1).max(64).optional(),
     userAgent: external_exports.string().min(1).max(512).optional(),
@@ -27718,6 +27770,7 @@ var buildEnvelope = /* @__PURE__ */ __name((target, trigger, snapshot, context)
     },
     ...buckets.includes("consentState") ? { consent: { enabled: context.consentEnforced, categories: snapshot.consent.categories, apps: snapshot.consent.apps } } : {},
     ...geoAllowed && currentGeo !== void 0 ? { geo: currentGeo } : {},
+    ...trigger.kind === "connect" && trigger.page !== void 0 && buckets.includes("eventContext") ? { page: trigger.page } : {},
     // Not gated on a capabilities.data bucket: an app only ever sees what it captured or wrote.
     ...captures === void 0 ? {} : { captures },
     ...visitorContext === void 0 ? {} : { context: visitorContext },
@@ -29733,7 +29786,9 @@ var claimsSchema = external_exports.object({
   appId: external_exports.string().min(1),
   appInstallId: external_exports.string().min(1),
   appVersionId: external_exports.string().min(1),
-  access: external_exports.enum(["read", "write"])
+  access: external_exports.enum(["read", "write"]),
+  // Absent means `full`; see the mint below.
+  appRole: external_exports.enum(APP_ROLES).optional()
 }).strict();
 var appUiAudience = /* @__PURE__ */ __name((slug) => {
   return `app-ui:${slug}`;
@@ -29902,7 +29957,8 @@ var forwardToApp2 = /* @__PURE__ */ __name(async (c, input2) => {
         "app.install_ord": install.ord,
         "app.install_label": install.label,
         "app.viewer_id": viewer.userId,
-        "app.viewer_access": viewer.access
+        "app.viewer_access": viewer.access,
+        "app.viewer_app_role": viewer.appRole
       }
     },
     () => {
@@ -29948,7 +30004,13 @@ var authorizeUi = /* @__PURE__ */ __name(async (c, slug, origin) => {
     appId: verdict.claims.appId,
     appVersionId: verdict.claims.appVersionId
   }) : void 0;
-  return { app: app2, install, viewer: { userId: verdict.claims.userId, access: verdict.claims.access }, writeTicket };
+  return {
+    app: app2,
+    install,
+    // The portal mints `full` as no claim, so a site worker that predates the claim still accepts the token.
+    viewer: { userId: verdict.claims.userId, access: verdict.claims.access, appRole: verdict.claims.appRole ?? "full" },
+    writeTicket
+  };
 }, "authorizeUi");
 var handleAppUi = /* @__PURE__ */ __name(async (c, slug) => {
   const host = c.env.APP_UI_HOST;
@@ -30087,9 +30149,141 @@ var defaultHook = /* @__PURE__ */ __name((result, c) => {
 }, "defaultHook");
 var createApiRouter = /* @__PURE__ */ __name(() => new OpenAPIHono({ defaultHook }), "createApiRouter");
 
+// src/id-graph/anon/connection.ts
+var CONNECTION_CF_HEADER = "x-connection-cf";
+var SESSION_HEADER = "x-session";
+var OPEN_PAGE_PARAMS = ["url", "referrer"];
+var MAX_HOST_USER_AGENT_LENGTH = 512;
+var MAX_HOST_LOCALE_LENGTH = 64;
+var INTERNAL_HEADERS = /* @__PURE__ */ new Set([
+  "x-user-id",
+  "x-new-user",
+  "x-geo",
+  SITE_ID_HEADER,
+  CONNECTION_CF_HEADER,
+  SESSION_HEADER,
+  TRACE_HEADER,
+  CF_DATA_HEADER
+]);
+var REDACTED_HEADERS = /* @__PURE__ */ new Set(["authorization"]);
+var encodeConnectionCf = /* @__PURE__ */ __name((cf) => {
+  if (cf === void 0) {
+    return void 0;
+  }
+  const encoded = headerJson(cf);
+  return encoded.length > MAX_ATTACHMENT_BYTES ? void 0 : encoded;
+}, "encodeConnectionCf");
+var forwardedCf = /* @__PURE__ */ __name((request) => {
+  const raw2 = request.headers.get(CONNECTION_CF_HEADER);
+  if (raw2 === null) {
+    return void 0;
+  }
+  return JSON.parse(raw2);
+}, "forwardedCf");
+var forwardedSession = /* @__PURE__ */ __name((request) => {
+  const raw2 = request.headers.get(SESSION_HEADER);
+  if (raw2 === null) {
+    return void 0;
+  }
+  return JSON.parse(raw2);
+}, "forwardedSession");
+var withoutPageParams = /* @__PURE__ */ __name((url2) => {
+  const parsed = new URL(url2);
+  for (const param of OPEN_PAGE_PARAMS) {
+    parsed.searchParams.delete(param);
+  }
+  return parsed.toString();
+}, "withoutPageParams");
+var connectPage = /* @__PURE__ */ __name((request) => {
+  const params = new URL(request.url).searchParams;
+  const url2 = params.get("url");
+  if (url2 === null) {
+    return void 0;
+  }
+  const referrer = params.get("referrer");
+  const parsed = pageContextField.safeParse({ url: url2, ...referrer === null ? {} : { referrer } });
+  return parsed.success ? parsed.data : void 0;
+}, "connectPage");
+var connectAttrs = /* @__PURE__ */ __name((request, geo) => {
+  const headers = {};
+  for (const [name, value] of request.headers) {
+    const lower = name.toLowerCase();
+    if (!INTERNAL_HEADERS.has(lower) && !REDACTED_HEADERS.has(lower)) {
+      headers[name] = value;
+    }
+  }
+  const cf = forwardedCf(request);
+  return {
+    "url.full": withoutPageParams(request.url),
+    "http.request.headers": JSON.stringify(headers),
+    ...cf === void 0 ? {} : { "qinto.cf": JSON.stringify(cf) },
+    ...geo === void 0 ? {} : { "qinto.geo": JSON.stringify(loggableGeo(geo)) }
+  };
+}, "connectAttrs");
+var withoutQuery = /* @__PURE__ */ __name((url2) => {
+  const parsed = new URL(url2);
+  parsed.search = "";
+  return parsed.toString();
+}, "withoutQuery");
+var browserGeoFrom = /* @__PURE__ */ __name((geo) => {
+  if (geo === void 0) {
+    return void 0;
+  }
+  return {
+    country: geo.country ?? null,
+    // EdgeTag's geoRegion is Cloudflare's subdivision code.
+    region: geo.regionCode ?? null,
+    state: geo.region ?? null,
+    isEU: geo.isEUCountry === "yes"
+  };
+}, "browserGeoFrom");
+var attachmentFieldBytes = /* @__PURE__ */ __name((name, value) => {
+  return value === void 0 ? 0 : new TextEncoder().encode(`,"${name}":${JSON.stringify(value)}`).length;
+}, "attachmentFieldBytes");
+var boundedHost = /* @__PURE__ */ __name((request) => {
+  const raw2 = hostFromRequest(request);
+  const bounded = {
+    ip: raw2.ip,
+    userAgent: raw2.userAgent !== void 0 && raw2.userAgent.length <= MAX_HOST_USER_AGENT_LENGTH ? raw2.userAgent : void 0,
+    locale: raw2.locale !== void 0 && raw2.locale.length <= MAX_HOST_LOCALE_LENGTH ? raw2.locale : void 0
+  };
+  return bounded.ip === void 0 && bounded.userAgent === void 0 && bounded.locale === void 0 ? void 0 : bounded;
+}, "boundedHost");
+var connectionAttachment = /* @__PURE__ */ __name((request, geo, siteId) => {
+  const userAgent = request.headers.get("user-agent");
+  const attrs = {
+    "url.full": withoutQuery(request.url),
+    ...geo?.country === void 0 ? {} : { "qinto.country": geo.country },
+    ...geo?.city === void 0 ? {} : { "qinto.city": geo.city },
+    ...userAgent === null ? {} : { user_agent: userAgent }
+  };
+  const host = boundedHost(request);
+  const hostBytes = attachmentFieldBytes("host", host);
+  const browserGeo = browserGeoFrom(geo);
+  const browserGeoBytes = attachmentFieldBytes("browserGeo", browserGeo);
+  const session2 = forwardedSession(request);
+  const sessionBytes = attachmentFieldBytes("session", session2);
+  const siteBytes = attachmentFieldBytes("siteId", siteId);
+  const cf = forwardedCf(request);
+  const cfSuffix = cf === void 0 ? "" : `,"cf":${JSON.stringify(cf)}`;
+  const cfBytes = new TextEncoder().encode(cfSuffix).length;
+  const emptyAttrsBytes = new TextEncoder().encode(JSON.stringify({ attrs: {} })).length;
+  const fixedBytes = siteBytes + sessionBytes + hostBytes + browserGeoBytes;
+  const includedCf = cfBytes <= MAX_ATTACHMENT_BYTES - emptyAttrsBytes - fixedBytes ? cf : void 0;
+  const budgeted = budgetAttrs(attrs, MAX_ATTACHMENT_BYTES - fixedBytes - (includedCf === void 0 ? 0 : cfBytes));
+  return {
+    ...budgeted,
+    siteId,
+    ...session2 === void 0 ? {} : { session: session2 },
+    ...browserGeo === void 0 ? {} : { browserGeo },
+    ...includedCf === void 0 ? {} : { cf: includedCf },
+    ...host === void 0 ? {} : { host }
+  };
+}, "connectionAttachment");
+
 // src/helpers/request-span.ts
 var OMITTED_HEADERS = /* @__PURE__ */ new Set(["authorization", DISPATCH_HEADER, CF_DATA_HEADER]);
-var requestAttrs = /* @__PURE__ */ __name((request) => {
+var requestAttrs = /* @__PURE__ */ __name((request, pathname) => {
   const headers = {};
   for (const [name, value] of request.headers) {
     if (!OMITTED_HEADERS.has(name.toLowerCase())) {
@@ -30099,7 +30293,7 @@ var requestAttrs = /* @__PURE__ */ __name((request) => {
   const cf = request.cf;
   return {
     "http.request.method": request.method,
-    "url.full": request.url,
+    "url.full": pathname === "/open" ? withoutPageParams(request.url) : request.url,
     "http.request.headers": JSON.stringify(headers),
     ...cf === void 0 ? {} : { "qinto.cf": JSON.stringify(cf) }
   };
@@ -30114,7 +30308,7 @@ var requestSpan = /* @__PURE__ */ __name(async (c, next) => {
   const pathname = new URL(c.req.url).pathname;
   const dispatch = parseDispatchTrace(c.req.raw.headers.get(DISPATCH_HEADER));
   const trace = dispatch === void 0 ? inboundTrace(c.req.raw, pathname) : { traceId: dispatch.traceId, parent: dispatch.spanId };
-  await runInvocation({ name: `${c.req.method} ${pathname}`, trace, attrs: requestAttrs(c.req.raw) }, async () => {
+  await runInvocation({ name: `${c.req.method} ${pathname}`, trace, attrs: requestAttrs(c.req.raw, pathname) }, async () => {
     try {
       await next();
       setSpanAttributes({ "http.response.status_code": c.res.status });
@@ -30321,120 +30515,6 @@ idGraphInspect.post("/internal/id-graph/rows", async (c) => {
   return c.json({ page: await inspectObjectTable(c.env, body) });
 });
 
-// src/id-graph/anon/connection.ts
-var CONNECTION_CF_HEADER = "x-connection-cf";
-var SESSION_HEADER = "x-session";
-var MAX_HOST_USER_AGENT_LENGTH = 512;
-var MAX_HOST_LOCALE_LENGTH = 64;
-var INTERNAL_HEADERS = /* @__PURE__ */ new Set([
-  "x-user-id",
-  "x-new-user",
-  "x-geo",
-  SITE_ID_HEADER,
-  CONNECTION_CF_HEADER,
-  SESSION_HEADER,
-  TRACE_HEADER,
-  CF_DATA_HEADER
-]);
-var REDACTED_HEADERS = /* @__PURE__ */ new Set(["authorization"]);
-var encodeConnectionCf = /* @__PURE__ */ __name((cf) => {
-  if (cf === void 0) {
-    return void 0;
-  }
-  const encoded = headerJson(cf);
-  return encoded.length > MAX_ATTACHMENT_BYTES ? void 0 : encoded;
-}, "encodeConnectionCf");
-var forwardedCf = /* @__PURE__ */ __name((request) => {
-  const raw2 = request.headers.get(CONNECTION_CF_HEADER);
-  if (raw2 === null) {
-    return void 0;
-  }
-  return JSON.parse(raw2);
-}, "forwardedCf");
-var forwardedSession = /* @__PURE__ */ __name((request) => {
-  const raw2 = request.headers.get(SESSION_HEADER);
-  if (raw2 === null) {
-    return void 0;
-  }
-  return JSON.parse(raw2);
-}, "forwardedSession");
-var connectAttrs = /* @__PURE__ */ __name((request, geo) => {
-  const headers = {};
-  for (const [name, value] of request.headers) {
-    const lower = name.toLowerCase();
-    if (!INTERNAL_HEADERS.has(lower) && !REDACTED_HEADERS.has(lower)) {
-      headers[name] = value;
-    }
-  }
-  const cf = forwardedCf(request);
-  return {
-    "url.full": request.url,
-    "http.request.headers": JSON.stringify(headers),
-    ...cf === void 0 ? {} : { "qinto.cf": JSON.stringify(cf) },
-    ...geo === void 0 ? {} : { "qinto.geo": JSON.stringify(loggableGeo(geo)) }
-  };
-}, "connectAttrs");
-var withoutQuery = /* @__PURE__ */ __name((url2) => {
-  const parsed = new URL(url2);
-  parsed.search = "";
-  return parsed.toString();
-}, "withoutQuery");
-var browserGeoFrom = /* @__PURE__ */ __name((geo) => {
-  if (geo === void 0) {
-    return void 0;
-  }
-  return {
-    country: geo.country ?? null,
-    // EdgeTag's geoRegion is Cloudflare's subdivision code.
-    region: geo.regionCode ?? null,
-    state: geo.region ?? null,
-    isEU: geo.isEUCountry === "yes"
-  };
-}, "browserGeoFrom");
-var attachmentFieldBytes = /* @__PURE__ */ __name((name, value) => {
-  return value === void 0 ? 0 : new TextEncoder().encode(`,"${name}":${JSON.stringify(value)}`).length;
-}, "attachmentFieldBytes");
-var boundedHost = /* @__PURE__ */ __name((request) => {
-  const raw2 = hostFromRequest(request);
-  const bounded = {
-    ip: raw2.ip,
-    userAgent: raw2.userAgent !== void 0 && raw2.userAgent.length <= MAX_HOST_USER_AGENT_LENGTH ? raw2.userAgent : void 0,
-    locale: raw2.locale !== void 0 && raw2.locale.length <= MAX_HOST_LOCALE_LENGTH ? raw2.locale : void 0
-  };
-  return bounded.ip === void 0 && bounded.userAgent === void 0 && bounded.locale === void 0 ? void 0 : bounded;
-}, "boundedHost");
-var connectionAttachment = /* @__PURE__ */ __name((request, geo, siteId) => {
-  const userAgent = request.headers.get("user-agent");
-  const attrs = {
-    "url.full": withoutQuery(request.url),
-    ...geo?.country === void 0 ? {} : { "qinto.country": geo.country },
-    ...geo?.city === void 0 ? {} : { "qinto.city": geo.city },
-    ...userAgent === null ? {} : { user_agent: userAgent }
-  };
-  const host = boundedHost(request);
-  const hostBytes = attachmentFieldBytes("host", host);
-  const browserGeo = browserGeoFrom(geo);
-  const browserGeoBytes = attachmentFieldBytes("browserGeo", browserGeo);
-  const session2 = forwardedSession(request);
-  const sessionBytes = attachmentFieldBytes("session", session2);
-  const siteBytes = attachmentFieldBytes("siteId", siteId);
-  const cf = forwardedCf(request);
-  const cfSuffix = cf === void 0 ? "" : `,"cf":${JSON.stringify(cf)}`;
-  const cfBytes = new TextEncoder().encode(cfSuffix).length;
-  const emptyAttrsBytes = new TextEncoder().encode(JSON.stringify({ attrs: {} })).length;
-  const fixedBytes = siteBytes + sessionBytes + hostBytes + browserGeoBytes;
-  const includedCf = cfBytes <= MAX_ATTACHMENT_BYTES - emptyAttrsBytes - fixedBytes ? cf : void 0;
-  const budgeted = budgetAttrs(attrs, MAX_ATTACHMENT_BYTES - fixedBytes - (includedCf === void 0 ? 0 : cfBytes));
-  return {
-    ...budgeted,
-    siteId,
-    ...session2 === void 0 ? {} : { session: session2 },
-    ...browserGeo === void 0 ? {} : { browserGeo },
-    ...includedCf === void 0 ? {} : { cf: includedCf },
-    ...host === void 0 ? {} : { host }
-  };
-}, "connectionAttachment");
-
 // src/paths/open.ts
 var withSetCookie = /* @__PURE__ */ __name((res, cookies) => {
   if (res.webSocket) {
@@ -31638,6 +31718,10 @@ var acceptedCaptures = /* @__PURE__ */ __name((registry3, consent2, apps, enforc
   }
   return accepted;
 }, "acceptedCaptures");
+var declaredTtlMs = /* @__PURE__ */ __name((registry3, appId, key) => {
+  const app2 = registry3.apps[appId];
+  return app2 === void 0 ? null : declaration(app2, key)?.ttlMs ?? null;
+}, "declaredTtlMs");
 
 // src/id-graph/kv-cache.ts
 var cachedKv = /* @__PURE__ */ __name((kv) => {
@@ -32562,7 +32646,7 @@ var MAX_BROWSER_RESULTS_BYTES = 32 * 1024;
 var MAX_FRAME_BYTES = 64 * 1024;
 var browserContextFrame = external_exports.object({
   occurredAt: external_exports.number().int().nonnegative().safe(),
-  page: external_exports.object({ url: external_exports.string().min(1).max(4096), referrer: external_exports.string().min(1).max(4096).optional() }).strict()
+  page: pageContextField
 }).strict();
 var browserResult = external_exports.unknown().refine((value) => {
   return new TextEncoder().encode(JSON.stringify(value)).length <= MAX_BROWSER_RESULT_BYTES;
@@ -32794,8 +32878,14 @@ var AnonDO = class extends DurableObject2 {
       const attachment = connectionAttachment(request, geo, siteId);
       server.serializeAttachment(attachment);
       this.sendSharedContext([server], context);
+      const page = connectPage(request);
       this.appFanOut(
-        { kind: "connect", ...attachment.cf === void 0 ? {} : { geo: attachment.cf }, host: attachment.host },
+        {
+          kind: "connect",
+          ...attachment.cf === void 0 ? {} : { geo: attachment.cf },
+          host: attachment.host,
+          ...page === void 0 ? {} : { page }
+        },
         userId,
         context
       );
@@ -32996,7 +33086,11 @@ var AnonDO = class extends DurableObject2 {
         if (!appWriteAllowed(context.registry, consentState2(this.kv), input2.slug, context.consentEnforced)) {
           return;
         }
-        this.storeCaptures(input2.writes.map((write) => ({ ...write, appId: input2.slug, source: "app", ttlMs: null })));
+        this.storeCaptures(
+          input2.writes.map((write) => {
+            return { ...write, appId: input2.slug, source: "app", ttlMs: declaredTtlMs(context.registry, input2.slug, write.key) };
+          })
+        );
       });
     });
   }

package/dist/worker-artifact/version.json

@@ -1,8 +1,8 @@
 {
   "main": {
-    "version": "0.1.4",
-    "gitSha": "84a03b1ccdff814840f560c7efd0f72837454227",
-    "builtAt": "2026-09-24T14:23:50.391Z",
+    "version": "0.1.6",
+    "gitSha": "802179565243bb2e4dd99f79f00a3815d4f0568c",
+    "builtAt": "2026-09-28T04:28:30.340Z",
     "compatibilityDate": "2026-06-23",
     "compatibilityFlags": [
       "nodejs_compat"
@@ -39,9 +39,9 @@
     ]
   },
   "app-runtime": {
-    "version": "0.1.2",
-    "gitSha": "5c24e6442ad668125bba59aaec084adb43b70d1d",
-    "builtAt": "2026-09-24T14:23:53.656Z",
+    "version": "0.1.4",
+    "gitSha": "b53a595d63827d8fda4f898391c6c0986f0fd1fa",
+    "builtAt": "2026-09-28T04:28:33.821Z",
     "compatibilityDate": "2026-06-23",
     "compatibilityFlags": [
       "nodejs_compat"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blotout/qinto-cli",
-  "version": "0.1.20",
+  "version": "0.1.22",
   "type": "module",
   "description": "Qinto CLI: authenticate against the Qinto platform and operate it from the terminal or from an agent.",
   "repository": {
@@ -16,8 +16,7 @@
   },
   "files": [
     "bin",
-    "dist",
-    "templates"
+    "dist"
   ],
   "publishConfig": {
     "access": "public"
@@ -35,6 +34,7 @@
     "@qinto/app-build": "0.0.0",
     "@qinto/app-dev": "0.0.0",
     "@qinto/app-manifest": "0.0.0",
+    "@qinto/app-templates": "0.0.0",
     "@qinto/oauth-grammar": "0.0.0",
     "@types/node": "25.9.5",
     "@types/proper-lockfile": "4.1.4",