@blotout/qinto-cli 0.1.21 → 0.1.23

package/dist/worker-artifact/app-runtime/index.js

@@ -4,6 +4,10 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// ../../../libs/app-manifest/src/app-roles.ts
+var DECLARABLE_APP_ROLES = ["owner", "admin", "manager", "editor", "member", "viewer"];
+var APP_ROLES = ["full", ...DECLARABLE_APP_ROLES];
+
 // ../../../libs/app-manifest/src/cron.ts
 var MAX_CRON_LENGTH = 128;
 var MINUTE_LITERAL = /^([0-9]|[1-5][0-9])$/;
@@ -18947,6 +18951,10 @@ var VARIABLE_NAME = /^[A-Z][A-Z0-9_]*$/;
 var APP_SLUG_PATTERN = /^[a-z][a-z0-9-]{2,29}$/;
 var FUNCTION_NAME = /^[a-zA-Z_$][a-zA-Z0-9_$]*$/;
 var identifierField = external_exports.string().min(1).max(64).regex(IDENTIFIER);
+var RENDERABLE_TEXT = /^[^\u0000-\u0009\u000B-\u001F\u007F\u200B-\u200F\u202A-\u202E\u2066-\u2069\uFEFF]*$/;
+var renderableText = (min, max) => {
+  return external_exports.string().min(min).max(max).regex(RENDERABLE_TEXT, "must not carry control or bidirectional-override characters");
+};
 var httpsUrl = (field2) => {
   return external_exports.url().max(2048).refine((value) => value.startsWith("https://"), `${field2} must be an HTTPS URL`);
 };
@@ -19082,6 +19090,35 @@ var validateOauth = (input2, ctx) => {
   }
 };
 
+// ../../../libs/app-manifest/src/roles.ts
+var MAX_APP_ROLE_DESCRIPTION = 200;
+var roleSchema = external_exports.object({
+  key: external_exports.enum(DECLARABLE_APP_ROLES, {
+    error: (issue2) => {
+      return issue2.input === "full" ? "full access is always available and is not declared" : void 0;
+    }
+  }),
+  description: renderableText(1, MAX_APP_ROLE_DESCRIPTION).optional()
+}).strict();
+var rolesSchema = external_exports.array(roleSchema).max(DECLARABLE_APP_ROLES.length).superRefine((roles, ctx) => {
+  uniqueOrIssue(
+    ctx,
+    roles.map((role) => role.key),
+    [],
+    "role"
+  );
+}).transform((roles) => {
+  return [...roles].sort((a, b) => APP_ROLES.indexOf(a.key) - APP_ROLES.indexOf(b.key));
+});
+var validateRoles = (manifest, ctx) => {
+  const declared = /* @__PURE__ */ new Set(["full", ...(manifest.roles ?? []).map((role) => role.key)]);
+  for (const [index, tool] of manifest.tools.entries()) {
+    if (tool.role !== void 0 && !declared.has(tool.role)) {
+      ctx.addIssue({ code: "custom", path: ["tools", index, "role"], message: `Tool role ${tool.role} is not declared in roles` });
+    }
+  }
+};
+
 // ../../../libs/app-manifest/src/route.ts
 var ENDPOINT_PATH_PATTERN = /^\/(?:(?::[a-zA-Z][a-zA-Z0-9_]*|[a-zA-Z0-9_-]+)(?:\/(?::[a-zA-Z][a-zA-Z0-9_]*|[a-zA-Z0-9_-]+))*)?$/;
 var isParam = (segment) => {
@@ -19115,10 +19152,6 @@ var MAX_MANIFEST_TOOLS_BYTES = 150 * 1024;
 var TOOL_PROPERTY_NAME = /^[a-zA-Z][a-zA-Z0-9_]*$/;
 var RESERVED_TOOL_ARGUMENTS = ["teamId", "siteId", "installId"];
 var TOOL_STRING_FORMATS = ["uuid", "date", "date-time", "email", "uri"];
-var RENDERABLE_TEXT = /^[^\u0000-\u0009\u000B-\u001F\u007F\u200B-\u200F\u202A-\u202E\u2066-\u2069\uFEFF]*$/;
-var renderableText = (min, max) => {
-  return external_exports.string().min(min).max(max).regex(RENDERABLE_TEXT, "must not carry control or bidirectional-override characters");
-};
 var propertyName = external_exports.string().min(1).max(48).regex(TOOL_PROPERTY_NAME);
 var FORMAT_SCHEMAS = {
   uuid: external_exports.uuid(),
@@ -19214,7 +19247,8 @@ var toolSchema = external_exports.object({
   title: renderableText(1, MAX_APP_TOOL_TITLE_LENGTH),
   description: renderableText(MIN_APP_TOOL_DESCRIPTION, MAX_APP_TOOL_DESCRIPTION),
   inputSchema: toolInputSchema,
-  annotations: toolAnnotationsSchema
+  annotations: toolAnnotationsSchema,
+  role: external_exports.enum(APP_ROLES).optional()
 }).strict();
 var nodeChildren = (value) => {
   const properties = value["properties"];
@@ -19618,6 +19652,9 @@ var baseSchema = external_exports.object({
     description: "The push topics this app broadcasts to every app on the site. Requires the `sharedContext` data capability; a topic left out reaches only this app\u2019s own browser code."
   }),
   endpoints: external_exports.array(endpointSchema).max(16).default([]).meta({ description: "The HTTP routes served at https://<site>/app/<slug><path>." }),
+  roles: rolesSchema.optional().meta({
+    description: "The app roles this app uses, from the fixed list owner, admin, manager, editor, member, viewer. Full access is always available and is not declared. A team member is given one app role per app."
+  }),
   tools: toolsSchema.meta({
     description: "The MCP tools this app serves to AI assistants, published as `<slug>_<name>`. Each one a site manager accepts becomes callable on their behalf by an assistant."
   }),
@@ -19974,6 +20011,7 @@ var appManifestSchema = baseSchema.superRefine((manifest, ctx) => {
   validateOauth(manifest, ctx);
   validateServer(manifest, ctx);
   validateTools(manifest.tools, ctx);
+  validateRoles(manifest, ctx);
 });
 
 // ../../../libs/app-manifest/src/oauth-flow.ts
@@ -20146,6 +20184,14 @@ var lifecycleEventSchema = external_exports.discriminatedUnion("type", [
   }).strict(),
   external_exports.object({ ...lifecycleBase, type: external_exports.literal("uninstalled"), scope: external_exports.enum(["app", "install"]) }).strict()
 ]);
+var deleteRequestSchema = external_exports.object({
+  eventId: external_exports.string().min(1).max(64),
+  occurredAt: external_exports.number().int().nonnegative().safe(),
+  install: installSchema2,
+  personId: external_exports.string().min(1).nullable(),
+  anonIds: external_exports.array(external_exports.string().min(1)),
+  identifiers: external_exports.array(external_exports.object({ type: external_exports.enum(["email", "phone", "custom"]), value: external_exports.string().min(1) }).strict()).optional()
+}).strict();
 var migrationSchema = external_exports.discriminatedUnion("phase", [
   external_exports.object({
     resource: external_exports.string().min(1).max(64),
@@ -20188,7 +20234,12 @@ var toolSchema2 = external_exports.object({
   name: external_exports.string().min(1).max(MAX_APP_TOOL_NAME_LENGTH).regex(APP_TOOL_NAME_PATTERN),
   // Who asked, and what they may do on this site. Derived from the bearer by the portal, never
   // from the model's arguments.
-  viewer: external_exports.object({ userId: external_exports.string().min(1).max(64), access: external_exports.enum(["read", "write"]) }).strict(),
+  viewer: external_exports.object({
+    userId: external_exports.string().min(1).max(64),
+    access: external_exports.enum(["read", "write"]),
+    // Optional only while a site worker or app runtime that predates it can still receive this envelope; absent means `full`.
+    appRole: external_exports.enum(APP_ROLES).optional()
+  }).strict(),
   // Already validated against the tool's declared inputSchema, with the reserved routing names
   // stripped. Every declared input schema has an object root, so this is an object too — and a
   // call that names no arguments normalizes to `{}` rather than reaching the handler as undefined.
@@ -20203,10 +20254,11 @@ var toolSchema2 = external_exports.object({
 }, "Tool arguments exceed the size cap");
 var controlEnvelopeSchema = external_exports.object({
   v: external_exports.literal(CONTROL_ENVELOPE_VERSION),
-  kind: external_exports.enum(["noop", "lifecycle", "migration", "schedule", "tool"]),
+  kind: external_exports.enum(["noop", "lifecycle", "deleteRequest", "migration", "schedule", "tool"]),
   app: external_exports.object({ slug: external_exports.string().min(1).max(30), version: external_exports.string().min(1).max(32) }).strict(),
   install: external_exports.object({ id: external_exports.string().min(1).max(64), ord: external_exports.number().int().min(1), label: external_exports.string().max(100) }).strict().optional(),
   lifecycle: lifecycleEventSchema.optional(),
+  deleteRequest: deleteRequestSchema.optional(),
   migration: migrationSchema.optional(),
   schedule: scheduleSchema2.optional(),
   tool: toolSchema2.optional()
@@ -20214,6 +20266,9 @@ var controlEnvelopeSchema = external_exports.object({
   if (envelope.kind === "lifecycle" !== (envelope.lifecycle !== void 0)) {
     ctx.addIssue({ code: "custom", path: ["lifecycle"], message: "Lifecycle payload must match the control kind" });
   }
+  if (envelope.kind === "deleteRequest" !== (envelope.deleteRequest !== void 0)) {
+    ctx.addIssue({ code: "custom", path: ["deleteRequest"], message: "Delete request payload must match the control kind" });
+  }
   if (envelope.kind === "migration" !== (envelope.migration !== void 0)) {
     ctx.addIssue({ code: "custom", path: ["migration"], message: "Migration payload must match the control kind" });
   }
@@ -20223,8 +20278,8 @@ var controlEnvelopeSchema = external_exports.object({
   if (envelope.kind === "tool" !== (envelope.tool !== void 0)) {
     ctx.addIssue({ code: "custom", path: ["tool"], message: "Tool payload must match the control kind" });
   }
-  if (envelope.kind === "lifecycle" && envelope.install === void 0) {
-    ctx.addIssue({ code: "custom", path: ["install"], message: "Lifecycle control needs an install" });
+  if ((envelope.kind === "lifecycle" || envelope.kind === "deleteRequest") && envelope.install === void 0) {
+    ctx.addIssue({ code: "custom", path: ["install"], message: `${envelope.kind} control needs an install` });
   }
   if (envelope.kind === "tool" && envelope.install === void 0) {
     ctx.addIssue({ code: "custom", path: ["install"], message: "Tool control needs an install" });
@@ -20263,6 +20318,8 @@ var toolResultSchema = external_exports.object({
 var controlResponseSchema = external_exports.object({
   v: external_exports.literal(CONTROL_ENVELOPE_VERSION),
   ok: external_exports.boolean(),
+  // The bundle has no delete request handler, so a retry cannot succeed.
+  skipped: external_exports.literal(true).optional(),
   tool: toolResultSchema.optional(),
   migration: external_exports.union([
     external_exports.object({ done: external_exports.literal(true) }).strict(),
@@ -20416,7 +20473,12 @@ var appUiAnalyticsQueryPath = (domainId, appSlug2, resourceIdentifier) => {
 var uiInstallSchema = external_exports.object({ id: external_exports.string().min(1).max(64), ord: external_exports.number().int().min(1), label: external_exports.string().max(100), enabled: external_exports.boolean() }).strict();
 var uiContextSchema = external_exports.object({
   version: external_exports.string().min(1).max(32),
-  viewer: external_exports.object({ userId: external_exports.string().min(1).max(64), access: external_exports.enum(["read", "write"]) }).strict(),
+  viewer: external_exports.object({
+    userId: external_exports.string().min(1).max(64),
+    access: external_exports.enum(["read", "write"]),
+    // Optional only while a site worker that predates it can still send this header; absent means `full`.
+    appRole: external_exports.enum(APP_ROLES).optional()
+  }).strict(),
   install: uiInstallSchema,
   installs: external_exports.array(uiInstallSchema).min(1).max(MAX_INSTALLS_PER_APP),
   writeTicket: external_exports.string().min(1).max(2048).optional()
@@ -20435,6 +20497,21 @@ var parseUiContext = (raw) => {
   return parsed.success ? parsed.data : null;
 };
 
+// src/app-env.ts
+var PLATFORM_BINDINGS = new Set(
+  PLATFORM_APP_BINDINGS.filter((name) => {
+    return name !== PLATFORM_APP_BINDING_NAMES.installToken;
+  })
+);
+var PLATFORM_PREFIXES = ["VAR_", "APPVAR_", PLATFORM_APP_OAUTH_BINDING_PREFIX];
+var appEnv = (env) => {
+  return Object.fromEntries(
+    Object.entries(env).filter(([name]) => {
+      return !PLATFORM_BINDINGS.has(name) && !PLATFORM_PREFIXES.some((prefix) => name.startsWith(prefix));
+    })
+  );
+};
+
 // ../../../libs/tail-trace/src/validate.ts
 var TRACE_ID = /^[0-9a-f]{32}$/;
 var SPAN_ID = /^[0-9a-f]{16}$/;
@@ -21023,6 +21100,15 @@ var brokerIdentityRead = async (env, identifier, options = {}) => {
   });
   return { globalId: answer.globalId ?? null, anonIds: answer.anonIds ?? [], nextCursor: answer.nextCursor ?? null };
 };
+var brokerCurrencyRates = async (env) => {
+  const answer = await askBroker(env, "apps.currency rates", {
+    v: ENVELOPE_VERSION,
+    kind: "currencyRates",
+    slug: callerSlug(env),
+    key: env.QINTO_INTERNAL_KEY
+  });
+  return { rates: answer.rates, fetchedAt: answer.fetchedAt };
+};
 var buildIdentity = (env) => {
   return {
     resolve: (identifier, options) => {
@@ -21561,7 +21647,7 @@ var buildWorkflowContext = (env, stamp) => {
     depth: 0
   });
   return {
-    env,
+    env: appEnv(env),
     install,
     startWorkflow: buildStartWorkflow(stamp),
     oauth: buildOauth(env, stamp.ord),
@@ -21634,12 +21720,13 @@ var buildContext = ({
   emits,
   pushes,
   captures,
-  context
+  context,
+  currency
 }) => {
   const { variables, secrets } = projectInstallValues(maps, kinds, install.ord);
   const subject = envelope.user?.anonId ?? null;
   return {
-    env,
+    env: appEnv(env),
     site,
     install: { id: install.id, label: install.label },
     startWorkflow: buildStartWorkflow({
@@ -21703,10 +21790,45 @@ var buildContext = ({
     },
     observability: buildObservability(install.ord),
     identity: buildIdentity(env),
+    currency,
     apps: buildAppsClient(env, envelope)
   };
 };
 
+// src/currency.ts
+var rateBetween = (rates, from, to) => {
+  const source = from.trim().toUpperCase();
+  const target = to.trim().toUpperCase();
+  if (!Object.hasOwn(rates, source) || !Object.hasOwn(rates, target)) {
+    return null;
+  }
+  return rates[source] / rates[target];
+};
+var buildCurrency = (env) => {
+  let snapshot;
+  const load = () => {
+    snapshot ??= brokerCurrencyRates(env).catch((error61) => {
+      throw new Error("the platform currency rates are not available", { cause: error61 });
+    });
+    return snapshot;
+  };
+  return {
+    convert: async (amount, from, to) => {
+      const rate = rateBetween((await load()).rates, from, to);
+      return rate === null ? null : amount * rate;
+    },
+    rate: async (from, to) => {
+      return rateBetween((await load()).rates, from, to);
+    },
+    list: async () => {
+      return Object.keys((await load()).rates).sort();
+    },
+    updatedAt: async () => {
+      return new Date((await load()).fetchedAt);
+    }
+  };
+};
+
 // src/install-span.ts
 var installSpan = (install, run) => {
   return traced(
@@ -21803,10 +21925,11 @@ var dispatchSchedule = async (envelope, bundle, env) => {
   const appScope = projectAppValues(env, appVariableKinds);
   const event = { id: schedule.id, cron: schedule.cron, scheduledTime: new Date(schedule.scheduledTime) };
   const failed = [];
+  const currency = buildCurrency(env);
   for (const install of schedule.installs) {
     const { variables, secrets } = projectInstallValues(maps, variableKinds, install.ord);
     const context = {
-      env,
+      env: appEnv(env),
       site,
       install: { id: install.id, label: install.label },
       startWorkflow: buildStartWorkflow({
@@ -21822,6 +21945,7 @@ var dispatchSchedule = async (envelope, bundle, env) => {
       appSecrets: appScope.appSecrets,
       observability: buildObservability(install.ord),
       identity: buildIdentity(env),
+      currency,
       apps: buildAppsClient(env, { depth: 0 }),
       query: buildQuery({ env, ticket: install.queryTicket, installId: install.id }),
       push: async (userId, message) => {
@@ -21938,10 +22062,11 @@ var buildContext2 = (envelope, env) => {
   const appScope = projectAppValues(env, appVariableKinds);
   const { variables, secrets } = projectInstallValues(maps, variableKinds, install.ord);
   return {
-    env,
+    env: appEnv(env),
     site,
     install: { id: install.id, label: install.label },
-    viewer: envelope.tool.viewer,
+    // An envelope from a portal that predates the role, or one carrying `full`, has no `appRole`.
+    viewer: { ...envelope.tool.viewer, appRole: envelope.tool.viewer.appRole ?? "full" },
     callId: envelope.tool.callId,
     startWorkflow: buildStartWorkflow({ ord: install.ord, installId: install.id, installLabel: install.label, anonId: null }),
     oauth: buildOauth(env, install.ord),
@@ -21951,6 +22076,7 @@ var buildContext2 = (envelope, env) => {
     appSecrets: appScope.appSecrets,
     observability: buildObservability(install.ord),
     identity: buildIdentity(env),
+    currency: buildCurrency(env),
     apps: buildAppsClient(env, { depth: 0 }),
     query: buildQuery({ env, ticket: envelope.tool.queryTicket, installId: install.id }),
     track: async (userId, event) => {
@@ -22014,12 +22140,11 @@ var controlContextValues = (env) => {
     appScope: projectAppValues(env, appVariableKinds)
   };
 };
-var lifecycleContext = (env, envelope) => {
-  const install = envelope.install;
+var lifecycleContext = (env, install) => {
   const { maps, variableKinds, site, appScope } = controlContextValues(env);
   const { variables, secrets } = projectInstallValues(maps, variableKinds, install.ord);
   return {
-    env,
+    env: appEnv(env),
     site,
     install: { id: install.id, label: install.label },
     variables,
@@ -22032,19 +22157,21 @@ var lifecycleContext = (env, envelope) => {
       installLabel: install.label,
       anonId: null
     }),
-    observability: buildObservability(install.ord)
+    observability: buildObservability(install.ord),
+    currency: buildCurrency(env)
   };
 };
 var migrationContext = (env) => {
   const { site, appScope } = controlContextValues(env);
   return {
-    env,
+    env: appEnv(env),
     site,
     appVariables: appScope.appVariables,
     appSecrets: appScope.appSecrets,
     // A migration runs once for the site, not once per install, so it has no install to attribute
     // an event or a saved error to.
-    observability: buildObservability(null)
+    observability: buildObservability(null),
+    currency: buildCurrency(env)
   };
 };
 var runStatementMigration = async (env, migration) => {
@@ -22065,22 +22192,43 @@ var runStatementMigration = async (env, migration) => {
   const ledger = database.prepare("INSERT INTO _qinto_migrations (id, checksum, phase, applied_at) VALUES (?, ?, ?, ?)").bind(migration.id, migration.checksum, migration.phase, (/* @__PURE__ */ new Date()).toISOString());
   await database.batch([...migration.statements.map((statement) => database.prepare(statement)), ledger]);
 };
-var dispatchLifecycle = async (envelope, bundle, env) => {
-  const event = envelope.lifecycle;
-  const handler = bundle.onLifecycle?.[event.type];
-  if (typeof handler !== "function") {
-    return json2(200, { v: CONTROL_ENVELOPE_VERSION, ok: true });
-  }
-  const install = envelope.install;
+var runInstallHook = async (install, run, env) => {
   try {
     await installSpan(install, () => {
-      return handler(event, lifecycleContext(env, envelope));
+      return run(lifecycleContext(env, install));
     });
     return json2(200, { v: CONTROL_ENVELOPE_VERSION, ok: true });
   } catch (error61) {
     return json2(200, { v: CONTROL_ENVELOPE_VERSION, ok: false, error: { message: failureMessage(error61) } });
   }
 };
+var dispatchLifecycle = async (envelope, bundle, env) => {
+  const event = envelope.lifecycle;
+  const handler = bundle.onLifecycle?.[event.type];
+  if (typeof handler !== "function") {
+    return json2(200, { v: CONTROL_ENVELOPE_VERSION, ok: true });
+  }
+  return runInstallHook(
+    envelope.install,
+    (context) => {
+      return handler(event, context);
+    },
+    env
+  );
+};
+var dispatchDeleteRequest = async (envelope, bundle, env) => {
+  const handler = bundle.onDeleteRequest;
+  if (typeof handler !== "function") {
+    return json2(200, { v: CONTROL_ENVELOPE_VERSION, ok: false, skipped: true });
+  }
+  return runInstallHook(
+    envelope.install,
+    (context) => {
+      return handler(envelope.deleteRequest, context);
+    },
+    env
+  );
+};
 var dispatchMigration = async (envelope, bundle, env) => {
   const migration = envelope.migration;
   if (linkedDatabasesOf(env).includes(migration.resource)) {
@@ -22135,6 +22283,9 @@ var dispatchControl = async ({ request, env, versions }) => {
     case "lifecycle": {
       return dispatchLifecycle(envelope, bundle, env);
     }
+    case "deleteRequest": {
+      return dispatchDeleteRequest(envelope, bundle, env);
+    }
     case "migration": {
       return dispatchMigration(envelope, bundle, env);
     }
@@ -22185,11 +22336,12 @@ var buildContext3 = ({
   site,
   geo,
   params,
-  user
+  user,
+  currency
 }) => {
   const { variables, secrets } = projectInstallValues(maps, kinds, install.ord);
   return {
-    env,
+    env: appEnv(env),
     site,
     geo,
     params,
@@ -22208,6 +22360,7 @@ var buildContext3 = ({
     appSecrets: appScope.appSecrets,
     observability: buildObservability(install.ord),
     identity: buildIdentity(env),
+    currency,
     apps: buildAppsClient(env, { depth: 0 }),
     push: async (userId, message) => {
       await brokerPush(env, {
@@ -22300,6 +22453,7 @@ var dispatchEndpoint = async ({ request, env, versions }) => {
   const maps = parseVariableMaps(env);
   const { variableKinds, appVariableKinds, site } = appContextOf(env);
   const appScope = projectAppValues(env, appVariableKinds);
+  const currency = buildCurrency(env);
   const invoke = async (install) => {
     return installSpan(install, () => {
       return handler(
@@ -22313,7 +22467,8 @@ var dispatchEndpoint = async ({ request, env, versions }) => {
           site,
           geo: context.geo,
           params: context.params,
-          user: context.user
+          user: context.user,
+          currency
         })
       );
     });
@@ -22456,6 +22611,69 @@ var checkAgainst = async (schema, value) => {
   return { ok: false, message };
 };
 
+// src/rpc.ts
+var dispatchRpc = async (envelope, bundle, env) => {
+  if (envelope.installs.length > 1) {
+    return jsonError(400, "rpc envelope carries more than one install");
+  }
+  const rpc = envelope.rpc;
+  if (rpc === void 0) {
+    return jsonError(400, "rpc envelope carries no rpc call");
+  }
+  const definition = rpcDefinitionOf(bundle?.rpc?.[rpc.fn]);
+  if (definition === void 0) {
+    return jsonError(200, `missing handler: rpc.${rpc.fn}`);
+  }
+  const args = await checkAgainst(definition.input, rpc.args);
+  if (!args.ok) {
+    return json2(200, { v: ENVELOPE_VERSION, error: { code: "invalid_arguments", message: failureMessage(args.message) } });
+  }
+  const install = envelope.installs[0];
+  const emits = [];
+  const pushes = [];
+  const captures = [];
+  const context = contextCollector();
+  const maps = parseVariableMaps(env);
+  const { variableKinds: kinds, appVariableKinds, site } = appContextOf(env);
+  const appScope = projectAppValues(env, appVariableKinds);
+  const currency = buildCurrency(env);
+  const subject = envelope.user?.anonId ?? null;
+  const ctx = {
+    ...buildContext({ env, envelope, site, install, maps, kinds, appScope, emits, pushes, captures, context, currency }),
+    context: fetchedContext(
+      env,
+      (what) => {
+        return requireSubject(subject, what);
+      },
+      context
+    )
+  };
+  let value;
+  try {
+    value = await installSpan(install, () => {
+      return definition.handler(args.value, ctx);
+    });
+  } catch (error61) {
+    const message = failureMessage(error61);
+    console.warn(`rpc failed for install ${install.id}: ${message}`);
+    return json2(200, { v: ENVELOPE_VERSION, error: { message } });
+  }
+  const checked = await checkAgainst(definition.output, value);
+  if (!checked.ok) {
+    return jsonError(200, failureMessage(`rpc result does not match the output schema: ${checked.message}`));
+  }
+  const result = checked.value === void 0 ? null : checked.value;
+  if (new TextEncoder().encode(JSON.stringify(result)).length > MAX_RPC_BYTES) {
+    return jsonError(200, "rpc result exceeds the size cap");
+  }
+  const body = { v: ENVELOPE_VERSION, rpc: { result } };
+  const contextWrites = context.writes();
+  if (emits.length > 0 || pushes.length > 0 || captures.length > 0 || contextWrites.length > 0) {
+    body.effects = [{ ord: install.ord, emits, pushes, captures, context: contextWrites }];
+  }
+  return json2(200, body);
+};
+
 // src/traced-fetch.ts
 var MAX_BODY_CHARS = 65536;
 var TOO_LARGE = `[not recorded: the body is over ${MAX_BODY_CHARS} characters]`;
@@ -22607,7 +22825,7 @@ var dispatchUi = async ({ request, env, versions }) => {
   const { variables, secrets } = projectInstallValues(maps, variableKinds, context.install.ord);
   const { appVariables, appSecrets } = projectAppValues(env, appVariableKinds);
   const ctx = {
-    env,
+    env: appEnv(env),
     site,
     install: { id: context.install.id, label: context.install.label },
     installs: projectAllInstallValues(maps, variableKinds, context.installs),
@@ -22624,7 +22842,8 @@ var dispatchUi = async ({ request, env, versions }) => {
     secrets,
     appVariables,
     appSecrets,
-    viewer: context.viewer,
+    // A site worker that predates app roles sends none, and every member had full access then.
+    viewer: { ...context.viewer, appRole: context.viewer.appRole ?? "full" },
     observability: buildObservability(context.install.ord),
     identity: buildIdentity(env),
     apps: buildAppsClient(env, { depth: 0 })
@@ -22666,7 +22885,7 @@ var withAppDurableObject = (Base, migrations) => {
   return class extends Base {
     constructor(ctx, env) {
       applyDurableObjectMigrations(ctx.storage, migrations);
-      super(ctx, env);
+      super(ctx, appEnv(env));
     }
   };
 };
@@ -22692,12 +22911,13 @@ var runInstalls = async (envelope, env, invoke) => {
   const appScope = projectAppValues(env, appVariableKinds);
   const groups = [];
   let failure2;
+  const currency = buildCurrency(env);
   for (const install of envelope.installs) {
     const emits = [];
     const pushes = [];
     const captures = [];
     const context = contextCollector();
-    const ctx = buildContext({ env, envelope, site, install, maps, kinds, appScope, emits, pushes, captures, context });
+    const ctx = buildContext({ env, envelope, site, install, maps, kinds, appScope, emits, pushes, captures, context, currency });
     try {
       await installSpan(install, () => {
         return invoke(ctx, install);
@@ -22758,7 +22978,8 @@ var runTransform = async (envelope, env, action, handler) => {
     emits,
     pushes,
     captures,
-    context
+    context,
+    currency: buildCurrency(env)
   });
   const ctx = {
     ...withoutApps,
@@ -22810,66 +23031,6 @@ var dispatchTransform = async (envelope, bundle, env) => {
   }
   return runTransform(envelope, env, action, handler);
 };
-var dispatchRpc = async (envelope, bundle, env) => {
-  if (envelope.installs.length > 1) {
-    return jsonError(400, "rpc envelope carries more than one install");
-  }
-  const rpc = envelope.rpc;
-  if (rpc === void 0) {
-    return jsonError(400, "rpc envelope carries no rpc call");
-  }
-  const definition = rpcDefinitionOf(bundle?.rpc?.[rpc.fn]);
-  if (definition === void 0) {
-    return jsonError(200, `missing handler: rpc.${rpc.fn}`);
-  }
-  const args = await checkAgainst(definition.input, rpc.args);
-  if (!args.ok) {
-    return json2(200, { v: ENVELOPE_VERSION, error: { code: "invalid_arguments", message: failureMessage(args.message) } });
-  }
-  const install = envelope.installs[0];
-  const emits = [];
-  const pushes = [];
-  const captures = [];
-  const context = contextCollector();
-  const maps = parseVariableMaps(env);
-  const { variableKinds: kinds, appVariableKinds, site } = appContextOf(env);
-  const appScope = projectAppValues(env, appVariableKinds);
-  const subject = envelope.user?.anonId ?? null;
-  const ctx = {
-    ...buildContext({ env, envelope, site, install, maps, kinds, appScope, emits, pushes, captures, context }),
-    context: fetchedContext(
-      env,
-      (what) => {
-        return requireSubject(subject, what);
-      },
-      context
-    )
-  };
-  let value;
-  try {
-    value = await installSpan(install, () => {
-      return definition.handler(args.value, ctx);
-    });
-  } catch (error61) {
-    const message = failureMessage(error61);
-    console.warn(`rpc failed for install ${install.id}: ${message}`);
-    return json2(200, { v: ENVELOPE_VERSION, error: { message } });
-  }
-  const checked = await checkAgainst(definition.output, value);
-  if (!checked.ok) {
-    return jsonError(200, failureMessage(`rpc result does not match the output schema: ${checked.message}`));
-  }
-  const result = checked.value === void 0 ? null : checked.value;
-  if (new TextEncoder().encode(JSON.stringify(result)).length > MAX_RPC_BYTES) {
-    return jsonError(200, "rpc result exceeds the size cap");
-  }
-  const body = { v: ENVELOPE_VERSION, rpc: { result } };
-  const contextWrites = context.writes();
-  if (emits.length > 0 || pushes.length > 0 || captures.length > 0 || contextWrites.length > 0) {
-    body.effects = [{ ord: install.ord, emits, pushes, captures, context: contextWrites }];
-  }
-  return json2(200, body);
-};
 var dispatch = async (envelope, versions, env) => {
   if (!(envelope.app.version in versions)) {
     return jsonError(200, "unknown version");