@blotout/qinto-cli 0.1.21 → 0.1.23

package/dist/worker-artifact/main/index.js

@@ -790,6 +790,10 @@ var deriveVisitorSignature = /* @__PURE__ */ __name(async (masterBase64, domainI
   return hmacHex(masterBase64, `${domainId}#visitor#${anonId}`);
 }, "deriveVisitorSignature");
 
+// ../../libs/app-manifest/src/app-roles.ts
+var DECLARABLE_APP_ROLES = ["owner", "admin", "manager", "editor", "member", "viewer"];
+var APP_ROLES = ["full", ...DECLARABLE_APP_ROLES];
+
 // ../../libs/app-manifest/src/cron.ts
 var MAX_CRON_LENGTH = 128;
 var MINUTE_LITERAL = /^([0-9]|[1-5][0-9])$/;
@@ -20348,6 +20352,10 @@ var VARIABLE_NAME = /^[A-Z][A-Z0-9_]*$/;
 var APP_SLUG_PATTERN = /^[a-z][a-z0-9-]{2,29}$/;
 var FUNCTION_NAME = /^[a-zA-Z_$][a-zA-Z0-9_$]*$/;
 var identifierField = external_exports.string().min(1).max(64).regex(IDENTIFIER);
+var RENDERABLE_TEXT = /^[^\u0000-\u0009\u000B-\u001F\u007F\u200B-\u200F\u202A-\u202E\u2066-\u2069\uFEFF]*$/;
+var renderableText = /* @__PURE__ */ __name((min, max) => {
+  return external_exports.string().min(min).max(max).regex(RENDERABLE_TEXT, "must not carry control or bidirectional-override characters");
+}, "renderableText");
 var httpsUrl = /* @__PURE__ */ __name((field) => {
   return external_exports.url().max(2048).refine((value) => value.startsWith("https://"), `${field} must be an HTTPS URL`);
 }, "httpsUrl");
@@ -20483,6 +20491,35 @@ var validateOauth = /* @__PURE__ */ __name((input2, ctx) => {
   }
 }, "validateOauth");
 
+// ../../libs/app-manifest/src/roles.ts
+var MAX_APP_ROLE_DESCRIPTION = 200;
+var roleSchema = external_exports.object({
+  key: external_exports.enum(DECLARABLE_APP_ROLES, {
+    error: /* @__PURE__ */ __name((issue2) => {
+      return issue2.input === "full" ? "full access is always available and is not declared" : void 0;
+    }, "error")
+  }),
+  description: renderableText(1, MAX_APP_ROLE_DESCRIPTION).optional()
+}).strict();
+var rolesSchema = external_exports.array(roleSchema).max(DECLARABLE_APP_ROLES.length).superRefine((roles, ctx) => {
+  uniqueOrIssue(
+    ctx,
+    roles.map((role) => role.key),
+    [],
+    "role"
+  );
+}).transform((roles) => {
+  return [...roles].sort((a, b) => APP_ROLES.indexOf(a.key) - APP_ROLES.indexOf(b.key));
+});
+var validateRoles = /* @__PURE__ */ __name((manifest, ctx) => {
+  const declared = /* @__PURE__ */ new Set(["full", ...(manifest.roles ?? []).map((role) => role.key)]);
+  for (const [index, tool] of manifest.tools.entries()) {
+    if (tool.role !== void 0 && !declared.has(tool.role)) {
+      ctx.addIssue({ code: "custom", path: ["tools", index, "role"], message: `Tool role ${tool.role} is not declared in roles` });
+    }
+  }
+}, "validateRoles");
+
 // ../../libs/app-manifest/src/route.ts
 var ENDPOINT_PATH_PATTERN = /^\/(?:(?::[a-zA-Z][a-zA-Z0-9_]*|[a-zA-Z0-9_-]+)(?:\/(?::[a-zA-Z][a-zA-Z0-9_]*|[a-zA-Z0-9_-]+))*)?$/;
 var isParam = /* @__PURE__ */ __name((segment) => {
@@ -20579,10 +20616,6 @@ var MAX_MANIFEST_TOOLS_BYTES = 150 * 1024;
 var TOOL_PROPERTY_NAME = /^[a-zA-Z][a-zA-Z0-9_]*$/;
 var RESERVED_TOOL_ARGUMENTS = ["teamId", "siteId", "installId"];
 var TOOL_STRING_FORMATS = ["uuid", "date", "date-time", "email", "uri"];
-var RENDERABLE_TEXT = /^[^\u0000-\u0009\u000B-\u001F\u007F\u200B-\u200F\u202A-\u202E\u2066-\u2069\uFEFF]*$/;
-var renderableText = /* @__PURE__ */ __name((min, max) => {
-  return external_exports.string().min(min).max(max).regex(RENDERABLE_TEXT, "must not carry control or bidirectional-override characters");
-}, "renderableText");
 var propertyName = external_exports.string().min(1).max(48).regex(TOOL_PROPERTY_NAME);
 var FORMAT_SCHEMAS = {
   uuid: external_exports.uuid(),
@@ -20678,7 +20711,8 @@ var toolSchema = external_exports.object({
   title: renderableText(1, MAX_APP_TOOL_TITLE_LENGTH),
   description: renderableText(MIN_APP_TOOL_DESCRIPTION, MAX_APP_TOOL_DESCRIPTION),
   inputSchema: toolInputSchema,
-  annotations: toolAnnotationsSchema
+  annotations: toolAnnotationsSchema,
+  role: external_exports.enum(APP_ROLES).optional()
 }).strict();
 var nodeChildren = /* @__PURE__ */ __name((value) => {
   const properties2 = value["properties"];
@@ -21082,6 +21116,9 @@ var baseSchema = external_exports.object({
     description: "The push topics this app broadcasts to every app on the site. Requires the `sharedContext` data capability; a topic left out reaches only this app\u2019s own browser code."
   }),
   endpoints: external_exports.array(endpointSchema).max(16).default([]).meta({ description: "The HTTP routes served at https://<site>/app/<slug><path>." }),
+  roles: rolesSchema.optional().meta({
+    description: "The app roles this app uses, from the fixed list owner, admin, manager, editor, member, viewer. Full access is always available and is not declared. A team member is given one app role per app."
+  }),
   tools: toolsSchema.meta({
     description: "The MCP tools this app serves to AI assistants, published as `<slug>_<name>`. Each one a site manager accepts becomes callable on their behalf by an assistant."
   }),
@@ -21438,6 +21475,7 @@ var appManifestSchema = baseSchema.superRefine((manifest, ctx) => {
   validateOauth(manifest, ctx);
   validateServer(manifest, ctx);
   validateTools(manifest.tools, ctx);
+  validateRoles(manifest, ctx);
 });
 
 // ../../libs/app-manifest/src/oauth-flow.ts
@@ -21625,6 +21663,7 @@ var MAX_TOOL_DATA_NODES = 5e3;
 var CONTROL_DEADLINES_MS = {
   noop: { platform: 15e3, site: 1e4 },
   lifecycle: { platform: 15e3, site: 1e4 },
+  deleteRequest: { platform: 15e3, site: 1e4 },
   migration: { platform: 15e3, site: 1e4 },
   schedule: { platform: 65e3, site: 6e4 },
   tool: { platform: 55e3, site: 5e4 }
@@ -21666,6 +21705,14 @@ var lifecycleEventSchema = external_exports.discriminatedUnion("type", [
   }).strict(),
   external_exports.object({ ...lifecycleBase, type: external_exports.literal("uninstalled"), scope: external_exports.enum(["app", "install"]) }).strict()
 ]);
+var deleteRequestSchema = external_exports.object({
+  eventId: external_exports.string().min(1).max(64),
+  occurredAt: external_exports.number().int().nonnegative().safe(),
+  install: installSchema2,
+  personId: external_exports.string().min(1).nullable(),
+  anonIds: external_exports.array(external_exports.string().min(1)),
+  identifiers: external_exports.array(external_exports.object({ type: external_exports.enum(["email", "phone", "custom"]), value: external_exports.string().min(1) }).strict()).optional()
+}).strict();
 var migrationSchema = external_exports.discriminatedUnion("phase", [
   external_exports.object({
     resource: external_exports.string().min(1).max(64),
@@ -21708,7 +21755,12 @@ var toolSchema2 = external_exports.object({
   name: external_exports.string().min(1).max(MAX_APP_TOOL_NAME_LENGTH).regex(APP_TOOL_NAME_PATTERN),
   // Who asked, and what they may do on this site. Derived from the bearer by the portal, never
   // from the model's arguments.
-  viewer: external_exports.object({ userId: external_exports.string().min(1).max(64), access: external_exports.enum(["read", "write"]) }).strict(),
+  viewer: external_exports.object({
+    userId: external_exports.string().min(1).max(64),
+    access: external_exports.enum(["read", "write"]),
+    // Optional only while a site worker or app runtime that predates it can still receive this envelope; absent means `full`.
+    appRole: external_exports.enum(APP_ROLES).optional()
+  }).strict(),
   // Already validated against the tool's declared inputSchema, with the reserved routing names
   // stripped. Every declared input schema has an object root, so this is an object too — and a
   // call that names no arguments normalizes to `{}` rather than reaching the handler as undefined.
@@ -21723,10 +21775,11 @@ var toolSchema2 = external_exports.object({
 }, "Tool arguments exceed the size cap");
 var controlEnvelopeSchema = external_exports.object({
   v: external_exports.literal(CONTROL_ENVELOPE_VERSION),
-  kind: external_exports.enum(["noop", "lifecycle", "migration", "schedule", "tool"]),
+  kind: external_exports.enum(["noop", "lifecycle", "deleteRequest", "migration", "schedule", "tool"]),
   app: external_exports.object({ slug: external_exports.string().min(1).max(30), version: external_exports.string().min(1).max(32) }).strict(),
   install: external_exports.object({ id: external_exports.string().min(1).max(64), ord: external_exports.number().int().min(1), label: external_exports.string().max(100) }).strict().optional(),
   lifecycle: lifecycleEventSchema.optional(),
+  deleteRequest: deleteRequestSchema.optional(),
   migration: migrationSchema.optional(),
   schedule: scheduleSchema2.optional(),
   tool: toolSchema2.optional()
@@ -21734,6 +21787,9 @@ var controlEnvelopeSchema = external_exports.object({
   if (envelope.kind === "lifecycle" !== (envelope.lifecycle !== void 0)) {
     ctx.addIssue({ code: "custom", path: ["lifecycle"], message: "Lifecycle payload must match the control kind" });
   }
+  if (envelope.kind === "deleteRequest" !== (envelope.deleteRequest !== void 0)) {
+    ctx.addIssue({ code: "custom", path: ["deleteRequest"], message: "Delete request payload must match the control kind" });
+  }
   if (envelope.kind === "migration" !== (envelope.migration !== void 0)) {
     ctx.addIssue({ code: "custom", path: ["migration"], message: "Migration payload must match the control kind" });
   }
@@ -21743,8 +21799,8 @@ var controlEnvelopeSchema = external_exports.object({
   if (envelope.kind === "tool" !== (envelope.tool !== void 0)) {
     ctx.addIssue({ code: "custom", path: ["tool"], message: "Tool payload must match the control kind" });
   }
-  if (envelope.kind === "lifecycle" && envelope.install === void 0) {
-    ctx.addIssue({ code: "custom", path: ["install"], message: "Lifecycle control needs an install" });
+  if ((envelope.kind === "lifecycle" || envelope.kind === "deleteRequest") && envelope.install === void 0) {
+    ctx.addIssue({ code: "custom", path: ["install"], message: `${envelope.kind} control needs an install` });
   }
   if (envelope.kind === "tool" && envelope.install === void 0) {
     ctx.addIssue({ code: "custom", path: ["install"], message: "Tool control needs an install" });
@@ -21783,6 +21839,8 @@ var toolResultSchema = external_exports.object({
 var controlResponseSchema = external_exports.object({
   v: external_exports.literal(CONTROL_ENVELOPE_VERSION),
   ok: external_exports.boolean(),
+  // The bundle has no delete request handler, so a retry cannot succeed.
+  skipped: external_exports.literal(true).optional(),
   tool: toolResultSchema.optional(),
   migration: external_exports.union([
     external_exports.object({ done: external_exports.literal(true) }).strict(),
@@ -21914,7 +21972,12 @@ var MAX_UI_BODY_BYTES = 1024 * 1024;
 var uiInstallSchema = external_exports.object({ id: external_exports.string().min(1).max(64), ord: external_exports.number().int().min(1), label: external_exports.string().max(100), enabled: external_exports.boolean() }).strict();
 var uiContextSchema = external_exports.object({
   version: external_exports.string().min(1).max(32),
-  viewer: external_exports.object({ userId: external_exports.string().min(1).max(64), access: external_exports.enum(["read", "write"]) }).strict(),
+  viewer: external_exports.object({
+    userId: external_exports.string().min(1).max(64),
+    access: external_exports.enum(["read", "write"]),
+    // Optional only while a site worker that predates it can still send this header; absent means `full`.
+    appRole: external_exports.enum(APP_ROLES).optional()
+  }).strict(),
   install: uiInstallSchema,
   installs: external_exports.array(uiInstallSchema).min(1).max(MAX_INSTALLS_PER_APP),
   writeTicket: external_exports.string().min(1).max(2048).optional()
@@ -26275,6 +26338,16 @@ var identifierField2 = external_exports.string().trim().min(1).refine((value) =>
   description: "Who the request applies to: a canonical Qinto id (`anon_\u2026`, or a `tag_user_id` adopted from EdgeTag), or any identifier from your own systems (email, phone, custom id). Internal `gid_\u2026` ids are rejected.",
   example: "crm-user-8412"
 });
+var readIdentifierField = identifierField2.optional().openapi({
+  param: { name: "identifier", in: "query" },
+  description: "User to read: any identifier from your own systems (email, phone, custom id), or a canonical Qinto id (`anon_\u2026`, or a `tag_user_id` adopted from EdgeTag). Omit it to read the user from the first-party cookie instead. Internal `gid_\u2026` ids are rejected.",
+  example: "ada@example.com"
+});
+var canonicalIdentifierField = external_exports.string().min(1).optional().openapi({
+  param: { name: "identifier", in: "query" },
+  description: "Canonical Qinto id (`anon_\u2026`) of the user to read. Omit it to resolve the user from the first-party cookie instead. Reading by a custom identifier arrives with authenticated API access.",
+  example: "anon_7b8d1a52-6c1e-4b6f-9a30-2f8a54d1c3e9"
+});
 var consentCategoriesField = external_exports.object({
   // Necessary consent cannot be opted out.
   necessary: external_exports.literal(true).optional().openapi({
@@ -27102,6 +27175,9 @@ var linkedAnonsPage = /* @__PURE__ */ __name((sql, afterRowId, limit) => {
 var linkedAnonsExcept = /* @__PURE__ */ __name((sql, originAnonId) => {
   return sql.exec("SELECT key FROM facts WHERE kind = 'anon' AND key != ?", originAnonId).toArray().map((row) => row.key);
 }, "linkedAnonsExcept");
+var allLinkedAnons = /* @__PURE__ */ __name((sql) => {
+  return sql.exec("SELECT key FROM facts WHERE kind = 'anon' ORDER BY rowid").toArray().map((row) => row.key);
+}, "allLinkedAnons");
 
 // src/id-graph/person.ts
 var IDENTITY_CAPABILITY = "identity";
@@ -27179,6 +27255,124 @@ var identityFields = {
   key: external_exports.string().min(1)
 };
 
+// src/apps/currency-rates.ts
+var CURRENCY_FEED_URL = "https://cdn.shopify.com/s/javascripts/currencies.js";
+var RATES_TTL_MS = 60 * 60 * 1e3;
+var RETRY_AFTER_FAILURE_MS = 60 * 1e3;
+var FEED_TIMEOUT_MS = 5e3;
+var FEED_EDGE_CACHE_TTL_S = 8 * 60 * 60;
+var MIN_CURRENCY_CODES = 100;
+var currencyMemo;
+var parseRatesLiteral = /* @__PURE__ */ __name((feed) => {
+  const opening = "rates:{";
+  const start = feed.indexOf(opening);
+  if (start === -1) {
+    return null;
+  }
+  const entry = /([A-Z]{3}):(-?(?:\d+\.?\d*|\.\d+)(?:e[+-]?\d+)?)([,}])/y;
+  entry.lastIndex = start + opening.length;
+  const rates = {};
+  for (; ; ) {
+    const match2 = entry.exec(feed);
+    if (match2 === null) {
+      return null;
+    }
+    const [, code, value, terminator] = match2;
+    if (Object.hasOwn(rates, code)) {
+      return null;
+    }
+    rates[code] = Number(value);
+    if (terminator === "}") {
+      return rates;
+    }
+  }
+}, "parseRatesLiteral");
+var parseCurrencyFeed = /* @__PURE__ */ __name((feed) => {
+  const rates = parseRatesLiteral(feed);
+  if (rates === null) {
+    return { ok: false, reason: "the rates literal does not parse" };
+  }
+  if (rates["USD"] !== 1) {
+    return { ok: false, reason: "USD is not 1" };
+  }
+  const invalid = Object.entries(rates).find(([, rate]) => !Number.isFinite(rate) || rate <= 0);
+  if (invalid !== void 0) {
+    return { ok: false, reason: `${invalid[0]} is not a positive finite rate` };
+  }
+  const count = Object.keys(rates).length;
+  if (count < MIN_CURRENCY_CODES) {
+    return { ok: false, reason: `the feed has ${count} codes` };
+  }
+  return { ok: true, rates };
+}, "parseCurrencyFeed");
+var fetchCurrencyRates = /* @__PURE__ */ __name(async () => {
+  return traced("currency.fetch", { attrs: { "http.url": CURRENCY_FEED_URL } }, async () => {
+    let feed;
+    try {
+      const response = await fetch(CURRENCY_FEED_URL, {
+        signal: AbortSignal.timeout(FEED_TIMEOUT_MS),
+        cf: { cacheTtlByStatus: { "200-299": FEED_EDGE_CACHE_TTL_S, "300-599": 0 } }
+      });
+      if (!response.ok) {
+        addSpanEvent("currency fetch failed", { level: "error", attrs: { status: response.status } });
+        return null;
+      }
+      feed = await response.text();
+    } catch (error61) {
+      addSpanEvent("currency fetch failed", { level: "error", attrs: { error: String(error61) } });
+      return null;
+    }
+    const verdict = parseCurrencyFeed(feed);
+    if (!verdict.ok) {
+      addSpanEvent("currency feed rejected", { level: "error", attrs: { reason: verdict.reason } });
+      return null;
+    }
+    return verdict.rates;
+  });
+}, "fetchCurrencyRates");
+var refreshCurrencyRates = /* @__PURE__ */ __name(async () => {
+  const rates = await fetchCurrencyRates();
+  const now = Date.now();
+  if (rates === null) {
+    const current2 = currencyMemo?.current ?? null;
+    currencyMemo = { current: current2, nextAttemptAt: now + RETRY_AFTER_FAILURE_MS };
+    return current2;
+  }
+  const current = { rates, fetchedAt: now };
+  currencyMemo = { current, nextAttemptAt: now + RATES_TTL_MS };
+  return current;
+}, "refreshCurrencyRates");
+var currentCurrencyRates = /* @__PURE__ */ __name(async (ctx) => {
+  const now = Date.now();
+  if (currencyMemo !== void 0 && now < currencyMemo.nextAttemptAt) {
+    return currencyMemo.current;
+  }
+  const stale = currencyMemo?.current ?? null;
+  if (stale === null) {
+    return refreshCurrencyRates();
+  }
+  currencyMemo = { current: stale, nextAttemptAt: now + RETRY_AFTER_FAILURE_MS };
+  ctx.waitUntil(
+    runInvocation({ name: "currency.refresh", trace: currentTraceContext() }, () => {
+      return refreshCurrencyRates();
+    })
+  );
+  return stale;
+}, "currentCurrencyRates");
+
+// src/apps/broker-currency.ts
+var currencyRatesBody = external_exports.object({
+  ...identityFields,
+  kind: external_exports.literal("currencyRates")
+}).strict();
+var handleCurrencyRates = /* @__PURE__ */ __name(async (ctx) => {
+  const current = await currentCurrencyRates(ctx);
+  if (current === null) {
+    return Response.json({ error: "currency_rates_unavailable" }, { status: 503 });
+  }
+  return Response.json(current);
+}, "handleCurrencyRates");
+
 // src/apps/emit-payload.ts
 var emitPayloadSchema = external_exports.object({
   event: external_exports.string().min(1),
@@ -27981,6 +28175,7 @@ var brokerBody = external_exports.discriminatedUnion("kind", [
   contextWriteBody,
   factsReadBody,
   identityReadBody,
+  currencyRatesBody,
   trackBody
 ]);
 var BODY_ENVELOPE_ALLOWANCE_BYTES = 2 * 1024;
@@ -28316,7 +28511,7 @@ var handleActive = /* @__PURE__ */ __name(async (env, body) => {
   }
   return Response.json({ active: true });
 }, "handleActive");
-var handleBroker = /* @__PURE__ */ __name(async (request, env) => {
+var handleBroker = /* @__PURE__ */ __name(async (request, env, ctx) => {
   const bytes = await readBoundedBody(request, MAX_BODY_BYTES);
   if (bytes === null) {
     return Response.json({ error: "too_large" }, { status: 413 });
@@ -28368,6 +28563,9 @@ var handleBroker = /* @__PURE__ */ __name(async (request, env) => {
     case "identityRead": {
       return handleIdentityRead(env, body);
     }
+    case "currencyRates": {
+      return handleCurrencyRates(ctx);
+    }
     case "track": {
       return handleTrack(env, body);
     }
@@ -28378,7 +28576,7 @@ var dispatchGated = /* @__PURE__ */ __name((c) => {
   if (c.env.DEPLOY_TARGET !== "dispatch") {
     return c.notFound();
   }
-  return handleBroker(c.req.raw, c.env);
+  return handleBroker(c.req.raw, c.env, c.executionCtx);
 }, "dispatchGated");
 for (const path of BROKER_PATHS) {
   brokerRoutes.post(path, dispatchGated);
@@ -28390,7 +28588,7 @@ var Broker = class extends WorkerEntrypoint {
   fetch(request) {
     const trace = parseTraceContext(request.headers.get(TRACE_HEADER));
     return runInvocation({ name: "broker", trace }, () => {
-      return handleBroker(request, this.env);
+      return handleBroker(request, this.env, this.ctx);
     });
   }
 };
@@ -29391,20 +29589,17 @@ var matchEndpoint = /* @__PURE__ */ __name((app2, path, method) => {
   if (!isHttpMethod(method)) {
     return void 0;
   }
-  const serving = app2.endpoints.filter((endpoint) => {
-    return endpoint.methods.includes(method);
-  });
   const matched = matchEndpointPath(
-    serving.map((endpoint) => endpoint.path),
+    app2.endpoints.map((endpoint) => endpoint.path),
     path
   );
   if (matched === void 0) {
     return void 0;
   }
-  const declared = serving.find((endpoint) => {
+  const declared = app2.endpoints.find((endpoint) => {
     return endpoint.path === matched.route;
   });
-  if (!["public", "token", "visitor"].includes(declared.auth) || declared.mode !== "webhook" && declared.mode !== "api") {
+  if (!declared.methods.includes(method) || !["public", "token", "visitor"].includes(declared.auth) || declared.mode !== "webhook" && declared.mode !== "api") {
     return void 0;
   }
   return {
@@ -29738,7 +29933,9 @@ var claimsSchema = external_exports.object({
   appId: external_exports.string().min(1),
   appInstallId: external_exports.string().min(1),
   appVersionId: external_exports.string().min(1),
-  access: external_exports.enum(["read", "write"])
+  access: external_exports.enum(["read", "write"]),
+  // Absent means `full`; see the mint below.
+  appRole: external_exports.enum(APP_ROLES).optional()
 }).strict();
 var appUiAudience = /* @__PURE__ */ __name((slug) => {
   return `app-ui:${slug}`;
@@ -29907,7 +30104,8 @@ var forwardToApp2 = /* @__PURE__ */ __name(async (c, input2) => {
         "app.install_ord": install.ord,
         "app.install_label": install.label,
         "app.viewer_id": viewer.userId,
-        "app.viewer_access": viewer.access
+        "app.viewer_access": viewer.access,
+        "app.viewer_app_role": viewer.appRole
       }
     },
     () => {
@@ -29953,7 +30151,13 @@ var authorizeUi = /* @__PURE__ */ __name(async (c, slug, origin) => {
     appId: verdict.claims.appId,
     appVersionId: verdict.claims.appVersionId
   }) : void 0;
-  return { app: app2, install, viewer: { userId: verdict.claims.userId, access: verdict.claims.access }, writeTicket };
+  return {
+    app: app2,
+    install,
+    // The portal mints `full` as no claim, so a site worker that predates the claim still accepts the token.
+    viewer: { userId: verdict.claims.userId, access: verdict.claims.access, appRole: verdict.claims.appRole ?? "full" },
+    writeTicket
+  };
 }, "authorizeUi");
 var handleAppUi = /* @__PURE__ */ __name(async (c, slug) => {
   const host = c.env.APP_UI_HOST;
@@ -30001,7 +30205,7 @@ appUiRoutes.all("/apps/:slug/ui/*", (c) => {
 var apiInfo = {
   title: "Qinto Edge API",
   version: "0.1.0",
-  description: "HTTP API for recording user activity on the Qinto platform: track events, attach identity traits, link custom identifiers, and record or read a user\u2019s consent and properties.\n\nEach request applies to one user. Writes address that user by any identifier of your own (email, phone, custom id) or a canonical Qinto id (`anon_\u2026`); the same identifier always reaches the same user. Reads take a canonical id or the first-party cookie; `GET /v1/session` also accepts your own.\n\nEvery `/v1` operation takes a worker access token as `Authorization: Bearer <token>`, scoped to the endpoints it may call; generate one from the Qinto platform\u2019s worker access tokens page. Errors use one JSON envelope: `error` is a machine-readable slug to switch on, and `details` optionally carries field-level validation errors. The health check is unauthenticated and replies with plain text."
+  description: 'HTTP API for recording user activity on the Qinto platform: track events, attach identity traits, link custom identifiers, and record or read a user\u2019s consent and properties.\n\nEach request applies to one user. Writes address that user by any identifier of your own (email, phone, custom id) or a canonical Qinto id (`anon_\u2026`); the same identifier always reaches the same user. Reads take a canonical id or the first-party cookie; `GET /v1/session` also accepts your own.\n\nEvery `/v1` operation takes a worker access token as `Authorization: Bearer <token>`, scoped to the endpoints it may call; generate one from the Qinto platform\u2019s worker access tokens page. Errors use one JSON envelope: `error` is a machine-readable slug to switch on, and `details` optionally carries field-level validation errors. The health check is unauthenticated and answers `{ "status": "success" }`.'
 };
 var apiTags = [
   {
@@ -30049,7 +30253,7 @@ var ERRORS = {
   },
   internal: {
     status: 500,
-    description: "Unexpected server error. Nothing is guaranteed to have been persisted; reads are safe to retry, and conversions dedupe on their order id, but a retried ingestion request may record other parts of the action a second time."
+    description: "Unexpected server error. Nothing is guaranteed to have been persisted; reads are safe to retry, and conversions dedupe on their order id, but retrying an ingestion request can deliver the event to the site\u2019s apps again."
   }
 };
 var DETAILS_SLUGS = /* @__PURE__ */ new Set(["invalid_params", "invalid_body"]);
@@ -30306,6 +30510,140 @@ var health = createApiRouter().openapi(definition, (c) => {
   return respond(c, healthResponse, { status: "success" });
 });
 
+// src/id-graph/delete-request.ts
+var readAlias = /* @__PURE__ */ __name((env, key) => {
+  return traced("rpc alias.get", {}, () => {
+    return aliasStub(env, key).get(currentTraceContext());
+  });
+}, "readAlias");
+var readAnon = /* @__PURE__ */ __name((env, anonId) => {
+  return traced("rpc anon.erasable", { attrs: { "anon.id": anonId } }, () => {
+    return anonStub(env, anonId).erasable(currentTraceContext());
+  });
+}, "readAnon");
+var readPerson = /* @__PURE__ */ __name((env, globalId) => {
+  return traced("rpc global.erasable", { attrs: { "global.id": globalId } }, () => {
+    return globalStub(env, globalId).erasable(currentTraceContext());
+  });
+}, "readPerson");
+var typedOf = /* @__PURE__ */ __name(async (env, value) => {
+  if (isCanonicalId(value)) {
+    return { inputType: "anon", kind: "anon", name: value, alias: null, personId: null, anonId: value };
+  }
+  if (isGlobalId(value)) {
+    return { inputType: "person", kind: "global", name: value, alias: null, personId: value, anonId: null };
+  }
+  const identifier = classifyIdentifier(value);
+  const key = await aliasKey(identifier);
+  const assignment = await readAlias(env, key);
+  return {
+    inputType: identifier.type,
+    kind: "alias",
+    name: key,
+    alias: assignment === null ? null : identifier,
+    personId: assignment?.globalId ?? null,
+    anonId: assignment?.anonId ?? null
+  };
+}, "typedOf");
+var uniqueIdentifiers = /* @__PURE__ */ __name((identifiers) => {
+  const byKey = new Map(identifiers.map((identifier) => [`${identifier.type}:${identifier.value}`, identifier]));
+  return [...byKey.values()];
+}, "uniqueIdentifiers");
+var reachFrom = /* @__PURE__ */ __name(async (env, typed) => {
+  const anons = /* @__PURE__ */ new Map();
+  let personId = typed.personId;
+  if (personId === null && typed.anonId !== null) {
+    const anon = await readAnon(env, typed.anonId);
+    if (anon !== null) {
+      anons.set(typed.anonId, anon);
+      personId = anon.globalId;
+    }
+  }
+  const person2 = personId === null ? null : await readPerson(env, personId);
+  for (const anonId of person2?.anonIds ?? []) {
+    const anon = anons.has(anonId) ? null : await readAnon(env, anonId);
+    if (anon !== null) {
+      anons.set(anonId, anon);
+    }
+  }
+  return { personId, person: person2, anons };
+}, "reachFrom");
+var ownedAliases = /* @__PURE__ */ __name(async (env, typed, reached) => {
+  const aliasKeys = [];
+  const identifiers = [];
+  const held = [...reached.person?.identifiers ?? [], ...[...reached.anons.values()].flatMap((anon) => anon.identifiers)];
+  for (const identifier of uniqueIdentifiers(held)) {
+    const key = await aliasKey(identifier);
+    const assignment = key === typed.name ? null : await readAlias(env, key);
+    const owner = assignment?.globalId ?? null;
+    const owned = assignment === null || (owner === null ? [...reached.anons.keys()].some((anonId) => anonId === assignment.anonId) : owner === reached.personId);
+    if (key !== typed.name && owned) {
+      identifiers.push(identifier);
+      if (assignment !== null) {
+        aliasKeys.push(key);
+      }
+    }
+  }
+  if (typed.alias !== null) {
+    aliasKeys.push(typed.name);
+    identifiers.push(typed.alias);
+  }
+  return { aliasKeys, identifiers };
+}, "ownedAliases");
+var planOf = /* @__PURE__ */ __name(async (env, typed) => {
+  const reached = await reachFrom(env, typed);
+  const { aliasKeys, identifiers } = await ownedAliases(env, typed, reached);
+  return {
+    inputType: typed.inputType,
+    personId: reached.person === null ? null : reached.personId,
+    anonIds: [...reached.anons.keys()],
+    aliasKeys,
+    identifiers
+  };
+}, "planOf");
+var planDeleteRequest = /* @__PURE__ */ __name(async (env, value) => {
+  return planOf(env, await typedOf(env, value));
+}, "planDeleteRequest");
+var ERASERS = Object.freeze({
+  alias: /* @__PURE__ */ __name((env, name) => {
+    return traced("rpc alias.erase", {}, () => {
+      return aliasStub(env, name).erase(currentTraceContext());
+    });
+  }, "alias"),
+  anon: /* @__PURE__ */ __name((env, name) => {
+    return traced("rpc anon.erase", { attrs: { "anon.id": name } }, () => {
+      return anonStub(env, name).erase(currentTraceContext());
+    });
+  }, "anon"),
+  global: /* @__PURE__ */ __name((env, name) => {
+    return traced("rpc global.erase", { attrs: { "global.id": name } }, () => {
+      return globalStub(env, name).erase(currentTraceContext());
+    });
+  }, "global")
+});
+var eraseOrder = /* @__PURE__ */ __name((plan, typed) => {
+  const steps = [
+    ...plan.aliasKeys.map((name) => ({ kind: "alias", name })),
+    ...plan.anonIds.map((name) => ({ kind: "anon", name })),
+    ...plan.personId === null ? [] : [{ kind: "global", name: plan.personId }]
+  ];
+  const isTyped = /* @__PURE__ */ __name((step) => {
+    return step.kind === typed.kind && step.name === typed.name;
+  }, "isTyped");
+  return [...steps.filter((step) => !isTyped(step)), ...steps.filter(isTyped)];
+}, "eraseOrder");
+var runDeleteRequest = /* @__PURE__ */ __name(async (env, value) => {
+  const typed = await typedOf(env, value);
+  const plan = await planOf(env, typed);
+  const erased = { alias: 0, anon: 0, global: 0 };
+  for (const step of eraseOrder(plan, typed)) {
+    if (await ERASERS[step.kind](env, step.name)) {
+      erased[step.kind] += 1;
+    }
+  }
+  return { inputType: plan.inputType, anons: erased.anon, aliases: erased.alias, persons: erased.global };
+}, "runDeleteRequest");
+
 // src/id-graph/inspect.ts
 var MAX_TABLE_PAGE = 100;
 var INTERNAL_TABLE = /^(sqlite_|_cf_)/;
@@ -30430,6 +30768,7 @@ var rowsBody = inspectBody.extend({
   offset: external_exports.number().int().min(0).default(0),
   limit: external_exports.number().int().min(1).max(MAX_TABLE_PAGE).default(MAX_TABLE_PAGE)
 });
+var valueBody = external_exports.object({ value: external_exports.string().min(1) });
 var readBody = /* @__PURE__ */ __name(async (c, schema) => {
   const parsed = schema.safeParse(await c.req.json().catch(() => null));
   return parsed.success ? parsed.data : null;
@@ -30457,6 +30796,20 @@ idGraphInspect.post("/internal/id-graph/rows", async (c) => {
   }
   return c.json({ page: await inspectObjectTable(c.env, body) });
 });
+idGraphInspect.post("/internal/id-graph/plan", async (c) => {
+  const body = await readBody(c, valueBody);
+  if (body === null) {
+    return c.json({ error: "invalid_body" }, 400);
+  }
+  return c.json(await planDeleteRequest(c.env, body.value));
+});
+idGraphInspect.post("/internal/id-graph/delete", async (c) => {
+  const body = await readBody(c, valueBody);
+  if (body === null) {
+    return c.json({ error: "invalid_body" }, 400);
+  }
+  return c.json(await runDeleteRequest(c.env, body.value));
+});
 
 // src/paths/open.ts
 var withSetCookie = /* @__PURE__ */ __name((res, cookies) => {
@@ -30544,14 +30897,14 @@ var open2 = /* @__PURE__ */ __name(async (c) => {
 
 // browser-artifact/meta.json
 var meta_default = {
-  version: "0.1.10",
-  gitSha: "f21182929c88fa0748f575164bde781b31f4fbdd",
-  builtAt: "2026-09-23T15:34:39.048Z",
-  hash: "d1804e7914363626fed0280696cad5e06728b899e23c8a5ee6dcced3b67cf831"
+  version: "0.1.11",
+  gitSha: "bb87bca6d3b96627f24bc0c29675f2f19680ce60",
+  builtAt: "2026-09-28T04:35:01.606Z",
+  hash: "e32dfe041826d6daaa3682d1f5cac137ffcc6a24f55bfef1a936f7e3ef4cde12"
 };
 
 // src/paths/q-js.ts
-import qScript from "./7bc13565a6fa9d520d0ebed788d11591e8db5b44-q.js.txt";
+import qScript from "./944c722e73fe144b1067da970f87716a835c697e-q.js.txt";
 
 // src/apps-q.ts
 import appsQScript from "./apps-q.json";
@@ -30797,11 +31150,7 @@ var consent = createApiRouter().openapi(definition4, async (c) => {
 
 // src/paths/v1/consent-state.ts
 var consentStateQuery = external_exports.object({
-  identifier: external_exports.string().min(1).optional().openapi({
-    param: { name: "identifier", in: "query" },
-    description: "Canonical Qinto id (`anon_\u2026`) of the user to read. Omit it to resolve the user from the first-party cookie instead. Reading by a custom identifier arrives with authenticated API access.",
-    example: "anon_7b8d1a52-6c1e-4b6f-9a30-2f8a54d1c3e9"
-  })
+  identifier: canonicalIdentifierField
 });
 var consentStateResponse = external_exports.object({
   categories: external_exports.object({
@@ -30828,7 +31177,7 @@ var definition5 = createRoute({
   summary: "Get user consent",
   description: operationDescription({
     intro: "Returns the consent state currently stored for the user.",
-    howItWorks: "A request that carries neither a `identifier` nor the cookie \u2014 or a `identifier` that is not canonical \u2014 fails with `invalid_params`. A choice saved on another session reaches this one separately, so a read taken right after a write elsewhere can return the previous value, and a session with no further activity can stay behind indefinitely. Read back from the session that made the change when you need the value you just wrote."
+    howItWorks: "A request that carries neither an `identifier` nor the cookie \u2014 or an `identifier` that is not canonical \u2014 fails with `invalid_params`. A choice saved on another session reaches this one separately, so a read taken right after a write elsewhere can return the previous value, and a session with no further activity can stay behind indefinitely. Read back from the session that made the change when you need the value you just wrote."
   }),
   request: { query: consentStateQuery },
   responses: {
@@ -30899,11 +31248,7 @@ var identify = createApiRouter().openapi(definition6, async (c) => {
 
 // src/paths/v1/person.ts
 var personQuery = external_exports.object({
-  identifier: identifierField2.optional().openapi({
-    param: { name: "identifier", in: "query" },
-    description: "User to read: any identifier from your own systems (email, phone, custom id), or a canonical Qinto id (`anon_\u2026`, or a `tag_user_id` adopted from EdgeTag). Omit it to read the user from the first-party cookie instead. Internal `gid_\u2026` ids are rejected.",
-    example: "ada@example.com"
-  }),
+  identifier: readIdentifierField,
   cursor: external_exports.string().regex(/^\d+$/).optional().openapi({
     param: { name: "cursor", in: "query" },
     description: "The `nextCursor` of the previous page. Omit it for the first page.",
@@ -30956,11 +31301,7 @@ var person = createApiRouter().openapi(definition7, async (c) => {
 
 // src/paths/v1/properties.ts
 var propertiesQuery = external_exports.object({
-  identifier: external_exports.string().min(1).optional().openapi({
-    param: { name: "identifier", in: "query" },
-    description: "Canonical Qinto id (`anon_\u2026`) of the user to read. Omit it to resolve the user from the first-party cookie instead. Reading by a custom identifier arrives with authenticated API access.",
-    example: "anon_7b8d1a52-6c1e-4b6f-9a30-2f8a54d1c3e9"
-  })
+  identifier: canonicalIdentifierField
 });
 var propertiesResponse = external_exports.record(external_exports.string(), external_exports.unknown()).openapi("UserProperties", { description: "Every property currently stored for the user, keyed by property name." });
 var definition8 = createRoute({
@@ -30971,10 +31312,7 @@ var definition8 = createRoute({
   security: [{ QintoWorkerAccessToken: [] }],
   middleware: [requireScope(SCOPE.propertiesRead)],
   summary: "Get user properties",
-  description: operationDescription({
-    intro: "Returns every property currently stored for the user.",
-    howItWorks: "A request that carries neither a `identifier` nor the cookie \u2014 or a `identifier` that is not canonical \u2014 fails with `invalid_params`."
-  }),
+  description: operationDescription({ intro: "Returns every property currently stored for the user." }),
   request: { query: propertiesQuery },
   responses: {
     200: {
@@ -30997,11 +31335,7 @@ var properties = createApiRouter().openapi(definition8, async (c) => {
 
 // src/paths/v1/session.ts
 var sessionQuery = external_exports.object({
-  identifier: identifierField2.optional().openapi({
-    param: { name: "identifier", in: "query" },
-    description: "User to read: any identifier from your own systems (email, phone, custom id), or a canonical Qinto id (`anon_\u2026`). Omit it to read the user from the first-party cookie instead. Internal `gid_\u2026` ids are rejected.",
-    example: "ada@example.com"
-  })
+  identifier: readIdentifierField
 });
 var sessionResponse = external_exports.object({
   anonId: external_exports.string().nullable().openapi({
@@ -31478,6 +31812,16 @@ var AliasDO = class extends DurableObject {
       return { exists: true, objectId: this.ctx.id.toString(), assignment, databaseSize: this.ctx.storage.sql.databaseSize };
     });
   }
+  async erase(trace) {
+    return runInvocation({ name: "do.alias.erase", trace }, async () => {
+      if (await this.record() === void 0) {
+        return false;
+      }
+      await this.ctx.storage.deleteAll();
+      this.assignment = void 0;
+      return true;
+    });
+  }
   async record() {
     if (!this.loaded) {
       this.assignment = await this.ctx.storage.get(ASSIGNMENT_KEY);
@@ -32254,6 +32598,19 @@ var relink = /* @__PURE__ */ __name(async (storage, env, anonId, globalId) => {
     await storage.setAlarm(cleanupTarget(storage, Date.now(), lastActivityAt(storage.kv) ?? Date.now()));
   }
 }, "relink");
+var unlinkFromPerson = /* @__PURE__ */ __name((env, anonId, globalId) => {
+  return traced("rpc global.unlink_anon", { attrs: { "global.id": globalId } }, () => {
+    return globalStub(env, globalId).unlinkAnon(anonId, currentTraceContext());
+  });
+}, "unlinkFromPerson");
+var eraseAnon = /* @__PURE__ */ __name(async (storage, env) => {
+  const anonId = storedAnonId(storage.kv);
+  const globalId = linkedGlobalId(storage.kv);
+  if (anonId !== null && globalId !== null) {
+    await unlinkFromPerson(env, anonId, globalId);
+  }
+  await storage.deleteAll();
+}, "eraseAnon");
 var expireAnon = /* @__PURE__ */ __name(async (storage, env, staleActivity) => {
   if (await standsDown(storage, staleActivity)) {
     return false;
@@ -32262,9 +32619,7 @@ var expireAnon = /* @__PURE__ */ __name(async (storage, env, staleActivity) => {
   const globalId = linkedGlobalId(storage.kv);
   if (anonId !== null && globalId !== null) {
     try {
-      await traced("rpc global.unlink_anon", { attrs: { "global.id": globalId } }, () => {
-        return globalStub(env, globalId).unlinkAnon(anonId, currentTraceContext());
-      });
+      await unlinkFromPerson(env, anonId, globalId);
     } catch (error61) {
       addSpanEvent("expiry unlink failed", { level: "warn", attrs: { "anon.id": anonId, "global.id": globalId, error: String(error61) } });
       await storage.setAlarm(Date.now() + CLEANUP_INTERVAL_MS);
@@ -32770,7 +33125,7 @@ var AnonDO = class extends DurableObject2 {
   wiped = false;
   // True while processAction holds ingestQueue, including the transform await.
   ingestTurn = false;
-  // Warm write-through mirrors reset together after expiry.
+  // Warm write-through mirrors reset together after an expiry or an erase.
   kvCache;
   cachedStorage;
   identifiersMirror = identifiersCache();
@@ -33409,6 +33764,17 @@ var AnonDO = class extends DurableObject2 {
       });
     });
   }
+  erasable(trace) {
+    return runInvocation({ name: "do.anon.erasable", trace }, () => {
+      return this.enqueue(async () => {
+        if (await this.discardIfUnused()) {
+          return null;
+        }
+        const identifiers = allIdentifiers(this.sql, this.identifiersMirror).map(({ type, value }) => ({ type, value }));
+        return { globalId: linkedGlobalId(this.kv), identifiers };
+      });
+    });
+  }
   inspect(trace) {
     return runInvocation({ name: "do.anon.inspect", trace }, () => {
       return this.enqueue(async () => {
@@ -33429,6 +33795,25 @@ var AnonDO = class extends DurableObject2 {
       });
     });
   }
+  erase(trace) {
+    return runInvocation({ name: "do.anon.erase", trace }, () => {
+      return this.enqueue(async () => {
+        if (await this.discardIfUnused()) {
+          return false;
+        }
+        try {
+          await eraseAnon(this.ctx.storage, this.graph);
+        } finally {
+          this.resetMirrors();
+        }
+        this.wiped = true;
+        for (const socket of this.ctx.getWebSockets()) {
+          socket.close(1e3, "erased");
+        }
+        return true;
+      });
+    });
+  }
   // Addressing an object runs the constructor's schema exec, so a call that never writes — a read, an
   // inspect, a push or a snapshot for an id that was never used — would otherwise leave an empty object
   // behind that no cleanup alarm ever collects. Every write path seeds meta before it stores anything,
@@ -33668,16 +34053,19 @@ var AnonDO = class extends DurableObject2 {
       try {
         this.wiped = await expireAnon(this.ctx.storage, this.graph, staleActivity);
       } finally {
-        this.kvCache.clear();
-        this.cleanupAlarm = void 0;
-        this.identifiersMirror.reset();
-        this.conversionsMirror.reset();
-        this.customPropsMirror.reset();
-        this.captureMirror.reset();
-        this.contextMirror.reset();
+        this.resetMirrors();
       }
     });
   }
+  resetMirrors() {
+    this.kvCache.clear();
+    this.cleanupAlarm = void 0;
+    this.identifiersMirror.reset();
+    this.conversionsMirror.reset();
+    this.customPropsMirror.reset();
+    this.captureMirror.reset();
+    this.contextMirror.reset();
+  }
   revive() {
     if (this.wiped) {
       applyMigrations(this.ctx.storage, ANON_MIGRATIONS);
@@ -33919,7 +34307,9 @@ var GlobalDO = class extends DurableObject3 {
   }
   async unlinkAnon(anonId, trace) {
     return runInvocation({ name: "do.global.unlink_anon", trace, attrs: { "anon.id": anonId } }, async () => {
-      this.revive();
+      if (await this.discardIfUnused()) {
+        return;
+      }
       unlinkAnon(this.sql, anonId);
     });
   }
@@ -33944,6 +34334,30 @@ var GlobalDO = class extends DurableObject3 {
       return linkedAnonsPage(this.sql, afterRowId, limit);
     });
   }
+  async erasable(trace) {
+    return runInvocation({ name: "do.global.erasable", trace }, async () => {
+      if (await this.discardIfUnused()) {
+        return null;
+      }
+      const identifiers = allIdentifiers2(this.sql, this.identifiersMirror).map(({ type, value }) => ({ type, value }));
+      return { anonIds: allLinkedAnons(this.sql), identifiers };
+    });
+  }
+  async erase(trace) {
+    return runInvocation({ name: "do.global.erase", trace }, async () => {
+      if (await this.discardIfUnused()) {
+        return false;
+      }
+      try {
+        await this.ctx.storage.deleteAll();
+      } finally {
+        this.kvCache.clear();
+        this.identifiersMirror = identifiersCache2();
+      }
+      this.wiped = true;
+      return true;
+    });
+  }
   async inspect(trace) {
     return runInvocation({ name: "do.global.inspect", trace }, async () => {
       if (await this.discardIfUnused()) {