@blotout/qinto-cli 0.1.22 → 0.1.23

package/dist/worker-artifact/main/index.js

@@ -21663,6 +21663,7 @@ var MAX_TOOL_DATA_NODES = 5e3;
 var CONTROL_DEADLINES_MS = {
   noop: { platform: 15e3, site: 1e4 },
   lifecycle: { platform: 15e3, site: 1e4 },
+  deleteRequest: { platform: 15e3, site: 1e4 },
   migration: { platform: 15e3, site: 1e4 },
   schedule: { platform: 65e3, site: 6e4 },
   tool: { platform: 55e3, site: 5e4 }
@@ -21704,6 +21705,14 @@ var lifecycleEventSchema = external_exports.discriminatedUnion("type", [
   }).strict(),
   external_exports.object({ ...lifecycleBase, type: external_exports.literal("uninstalled"), scope: external_exports.enum(["app", "install"]) }).strict()
 ]);
+var deleteRequestSchema = external_exports.object({
+  eventId: external_exports.string().min(1).max(64),
+  occurredAt: external_exports.number().int().nonnegative().safe(),
+  install: installSchema2,
+  personId: external_exports.string().min(1).nullable(),
+  anonIds: external_exports.array(external_exports.string().min(1)),
+  identifiers: external_exports.array(external_exports.object({ type: external_exports.enum(["email", "phone", "custom"]), value: external_exports.string().min(1) }).strict()).optional()
+}).strict();
 var migrationSchema = external_exports.discriminatedUnion("phase", [
   external_exports.object({
     resource: external_exports.string().min(1).max(64),
@@ -21766,10 +21775,11 @@ var toolSchema2 = external_exports.object({
 }, "Tool arguments exceed the size cap");
 var controlEnvelopeSchema = external_exports.object({
   v: external_exports.literal(CONTROL_ENVELOPE_VERSION),
-  kind: external_exports.enum(["noop", "lifecycle", "migration", "schedule", "tool"]),
+  kind: external_exports.enum(["noop", "lifecycle", "deleteRequest", "migration", "schedule", "tool"]),
   app: external_exports.object({ slug: external_exports.string().min(1).max(30), version: external_exports.string().min(1).max(32) }).strict(),
   install: external_exports.object({ id: external_exports.string().min(1).max(64), ord: external_exports.number().int().min(1), label: external_exports.string().max(100) }).strict().optional(),
   lifecycle: lifecycleEventSchema.optional(),
+  deleteRequest: deleteRequestSchema.optional(),
   migration: migrationSchema.optional(),
   schedule: scheduleSchema2.optional(),
   tool: toolSchema2.optional()
@@ -21777,6 +21787,9 @@ var controlEnvelopeSchema = external_exports.object({
   if (envelope.kind === "lifecycle" !== (envelope.lifecycle !== void 0)) {
     ctx.addIssue({ code: "custom", path: ["lifecycle"], message: "Lifecycle payload must match the control kind" });
   }
+  if (envelope.kind === "deleteRequest" !== (envelope.deleteRequest !== void 0)) {
+    ctx.addIssue({ code: "custom", path: ["deleteRequest"], message: "Delete request payload must match the control kind" });
+  }
   if (envelope.kind === "migration" !== (envelope.migration !== void 0)) {
     ctx.addIssue({ code: "custom", path: ["migration"], message: "Migration payload must match the control kind" });
   }
@@ -21786,8 +21799,8 @@ var controlEnvelopeSchema = external_exports.object({
   if (envelope.kind === "tool" !== (envelope.tool !== void 0)) {
     ctx.addIssue({ code: "custom", path: ["tool"], message: "Tool payload must match the control kind" });
   }
-  if (envelope.kind === "lifecycle" && envelope.install === void 0) {
-    ctx.addIssue({ code: "custom", path: ["install"], message: "Lifecycle control needs an install" });
+  if ((envelope.kind === "lifecycle" || envelope.kind === "deleteRequest") && envelope.install === void 0) {
+    ctx.addIssue({ code: "custom", path: ["install"], message: `${envelope.kind} control needs an install` });
   }
   if (envelope.kind === "tool" && envelope.install === void 0) {
     ctx.addIssue({ code: "custom", path: ["install"], message: "Tool control needs an install" });
@@ -21826,6 +21839,8 @@ var toolResultSchema = external_exports.object({
 var controlResponseSchema = external_exports.object({
   v: external_exports.literal(CONTROL_ENVELOPE_VERSION),
   ok: external_exports.boolean(),
+  // The bundle has no delete request handler, so a retry cannot succeed.
+  skipped: external_exports.literal(true).optional(),
   tool: toolResultSchema.optional(),
   migration: external_exports.union([
     external_exports.object({ done: external_exports.literal(true) }).strict(),
@@ -26323,6 +26338,16 @@ var identifierField2 = external_exports.string().trim().min(1).refine((value) =>
   description: "Who the request applies to: a canonical Qinto id (`anon_\u2026`, or a `tag_user_id` adopted from EdgeTag), or any identifier from your own systems (email, phone, custom id). Internal `gid_\u2026` ids are rejected.",
   example: "crm-user-8412"
 });
+var readIdentifierField = identifierField2.optional().openapi({
+  param: { name: "identifier", in: "query" },
+  description: "User to read: any identifier from your own systems (email, phone, custom id), or a canonical Qinto id (`anon_\u2026`, or a `tag_user_id` adopted from EdgeTag). Omit it to read the user from the first-party cookie instead. Internal `gid_\u2026` ids are rejected.",
+  example: "ada@example.com"
+});
+var canonicalIdentifierField = external_exports.string().min(1).optional().openapi({
+  param: { name: "identifier", in: "query" },
+  description: "Canonical Qinto id (`anon_\u2026`) of the user to read. Omit it to resolve the user from the first-party cookie instead. Reading by a custom identifier arrives with authenticated API access.",
+  example: "anon_7b8d1a52-6c1e-4b6f-9a30-2f8a54d1c3e9"
+});
 var consentCategoriesField = external_exports.object({
   // Necessary consent cannot be opted out.
   necessary: external_exports.literal(true).optional().openapi({
@@ -27150,6 +27175,9 @@ var linkedAnonsPage = /* @__PURE__ */ __name((sql, afterRowId, limit) => {
 var linkedAnonsExcept = /* @__PURE__ */ __name((sql, originAnonId) => {
   return sql.exec("SELECT key FROM facts WHERE kind = 'anon' AND key != ?", originAnonId).toArray().map((row) => row.key);
 }, "linkedAnonsExcept");
+var allLinkedAnons = /* @__PURE__ */ __name((sql) => {
+  return sql.exec("SELECT key FROM facts WHERE kind = 'anon' ORDER BY rowid").toArray().map((row) => row.key);
+}, "allLinkedAnons");
 
 // src/id-graph/person.ts
 var IDENTITY_CAPABILITY = "identity";
@@ -27227,6 +27255,124 @@ var identityFields = {
   key: external_exports.string().min(1)
 };
 
+// src/apps/currency-rates.ts
+var CURRENCY_FEED_URL = "https://cdn.shopify.com/s/javascripts/currencies.js";
+var RATES_TTL_MS = 60 * 60 * 1e3;
+var RETRY_AFTER_FAILURE_MS = 60 * 1e3;
+var FEED_TIMEOUT_MS = 5e3;
+var FEED_EDGE_CACHE_TTL_S = 8 * 60 * 60;
+var MIN_CURRENCY_CODES = 100;
+var currencyMemo;
+var parseRatesLiteral = /* @__PURE__ */ __name((feed) => {
+  const opening = "rates:{";
+  const start = feed.indexOf(opening);
+  if (start === -1) {
+    return null;
+  }
+  const entry = /([A-Z]{3}):(-?(?:\d+\.?\d*|\.\d+)(?:e[+-]?\d+)?)([,}])/y;
+  entry.lastIndex = start + opening.length;
+  const rates = {};
+  for (; ; ) {
+    const match2 = entry.exec(feed);
+    if (match2 === null) {
+      return null;
+    }
+    const [, code, value, terminator] = match2;
+    if (Object.hasOwn(rates, code)) {
+      return null;
+    }
+    rates[code] = Number(value);
+    if (terminator === "}") {
+      return rates;
+    }
+  }
+}, "parseRatesLiteral");
+var parseCurrencyFeed = /* @__PURE__ */ __name((feed) => {
+  const rates = parseRatesLiteral(feed);
+  if (rates === null) {
+    return { ok: false, reason: "the rates literal does not parse" };
+  }
+  if (rates["USD"] !== 1) {
+    return { ok: false, reason: "USD is not 1" };
+  }
+  const invalid = Object.entries(rates).find(([, rate]) => !Number.isFinite(rate) || rate <= 0);
+  if (invalid !== void 0) {
+    return { ok: false, reason: `${invalid[0]} is not a positive finite rate` };
+  }
+  const count = Object.keys(rates).length;
+  if (count < MIN_CURRENCY_CODES) {
+    return { ok: false, reason: `the feed has ${count} codes` };
+  }
+  return { ok: true, rates };
+}, "parseCurrencyFeed");
+var fetchCurrencyRates = /* @__PURE__ */ __name(async () => {
+  return traced("currency.fetch", { attrs: { "http.url": CURRENCY_FEED_URL } }, async () => {
+    let feed;
+    try {
+      const response = await fetch(CURRENCY_FEED_URL, {
+        signal: AbortSignal.timeout(FEED_TIMEOUT_MS),
+        cf: { cacheTtlByStatus: { "200-299": FEED_EDGE_CACHE_TTL_S, "300-599": 0 } }
+      });
+      if (!response.ok) {
+        addSpanEvent("currency fetch failed", { level: "error", attrs: { status: response.status } });
+        return null;
+      }
+      feed = await response.text();
+    } catch (error61) {
+      addSpanEvent("currency fetch failed", { level: "error", attrs: { error: String(error61) } });
+      return null;
+    }
+    const verdict = parseCurrencyFeed(feed);
+    if (!verdict.ok) {
+      addSpanEvent("currency feed rejected", { level: "error", attrs: { reason: verdict.reason } });
+      return null;
+    }
+    return verdict.rates;
+  });
+}, "fetchCurrencyRates");
+var refreshCurrencyRates = /* @__PURE__ */ __name(async () => {
+  const rates = await fetchCurrencyRates();
+  const now = Date.now();
+  if (rates === null) {
+    const current2 = currencyMemo?.current ?? null;
+    currencyMemo = { current: current2, nextAttemptAt: now + RETRY_AFTER_FAILURE_MS };
+    return current2;
+  }
+  const current = { rates, fetchedAt: now };
+  currencyMemo = { current, nextAttemptAt: now + RATES_TTL_MS };
+  return current;
+}, "refreshCurrencyRates");
+var currentCurrencyRates = /* @__PURE__ */ __name(async (ctx) => {
+  const now = Date.now();
+  if (currencyMemo !== void 0 && now < currencyMemo.nextAttemptAt) {
+    return currencyMemo.current;
+  }
+  const stale = currencyMemo?.current ?? null;
+  if (stale === null) {
+    return refreshCurrencyRates();
+  }
+  currencyMemo = { current: stale, nextAttemptAt: now + RETRY_AFTER_FAILURE_MS };
+  ctx.waitUntil(
+    runInvocation({ name: "currency.refresh", trace: currentTraceContext() }, () => {
+      return refreshCurrencyRates();
+    })
+  );
+  return stale;
+}, "currentCurrencyRates");
+
+// src/apps/broker-currency.ts
+var currencyRatesBody = external_exports.object({
+  ...identityFields,
+  kind: external_exports.literal("currencyRates")
+}).strict();
+var handleCurrencyRates = /* @__PURE__ */ __name(async (ctx) => {
+  const current = await currentCurrencyRates(ctx);
+  if (current === null) {
+    return Response.json({ error: "currency_rates_unavailable" }, { status: 503 });
+  }
+  return Response.json(current);
+}, "handleCurrencyRates");
+
 // src/apps/emit-payload.ts
 var emitPayloadSchema = external_exports.object({
   event: external_exports.string().min(1),
@@ -28029,6 +28175,7 @@ var brokerBody = external_exports.discriminatedUnion("kind", [
   contextWriteBody,
   factsReadBody,
   identityReadBody,
+  currencyRatesBody,
   trackBody
 ]);
 var BODY_ENVELOPE_ALLOWANCE_BYTES = 2 * 1024;
@@ -28364,7 +28511,7 @@ var handleActive = /* @__PURE__ */ __name(async (env, body) => {
   }
   return Response.json({ active: true });
 }, "handleActive");
-var handleBroker = /* @__PURE__ */ __name(async (request, env) => {
+var handleBroker = /* @__PURE__ */ __name(async (request, env, ctx) => {
   const bytes = await readBoundedBody(request, MAX_BODY_BYTES);
   if (bytes === null) {
     return Response.json({ error: "too_large" }, { status: 413 });
@@ -28416,6 +28563,9 @@ var handleBroker = /* @__PURE__ */ __name(async (request, env) => {
     case "identityRead": {
       return handleIdentityRead(env, body);
     }
+    case "currencyRates": {
+      return handleCurrencyRates(ctx);
+    }
     case "track": {
       return handleTrack(env, body);
     }
@@ -28426,7 +28576,7 @@ var dispatchGated = /* @__PURE__ */ __name((c) => {
   if (c.env.DEPLOY_TARGET !== "dispatch") {
     return c.notFound();
   }
-  return handleBroker(c.req.raw, c.env);
+  return handleBroker(c.req.raw, c.env, c.executionCtx);
 }, "dispatchGated");
 for (const path of BROKER_PATHS) {
   brokerRoutes.post(path, dispatchGated);
@@ -28438,7 +28588,7 @@ var Broker = class extends WorkerEntrypoint {
   fetch(request) {
     const trace = parseTraceContext(request.headers.get(TRACE_HEADER));
     return runInvocation({ name: "broker", trace }, () => {
-      return handleBroker(request, this.env);
+      return handleBroker(request, this.env, this.ctx);
     });
   }
 };
@@ -29439,20 +29589,17 @@ var matchEndpoint = /* @__PURE__ */ __name((app2, path, method) => {
   if (!isHttpMethod(method)) {
     return void 0;
   }
-  const serving = app2.endpoints.filter((endpoint) => {
-    return endpoint.methods.includes(method);
-  });
   const matched = matchEndpointPath(
-    serving.map((endpoint) => endpoint.path),
+    app2.endpoints.map((endpoint) => endpoint.path),
     path
   );
   if (matched === void 0) {
     return void 0;
   }
-  const declared = serving.find((endpoint) => {
+  const declared = app2.endpoints.find((endpoint) => {
     return endpoint.path === matched.route;
   });
-  if (!["public", "token", "visitor"].includes(declared.auth) || declared.mode !== "webhook" && declared.mode !== "api") {
+  if (!declared.methods.includes(method) || !["public", "token", "visitor"].includes(declared.auth) || declared.mode !== "webhook" && declared.mode !== "api") {
     return void 0;
   }
   return {
@@ -30058,7 +30205,7 @@ appUiRoutes.all("/apps/:slug/ui/*", (c) => {
 var apiInfo = {
   title: "Qinto Edge API",
   version: "0.1.0",
-  description: "HTTP API for recording user activity on the Qinto platform: track events, attach identity traits, link custom identifiers, and record or read a user\u2019s consent and properties.\n\nEach request applies to one user. Writes address that user by any identifier of your own (email, phone, custom id) or a canonical Qinto id (`anon_\u2026`); the same identifier always reaches the same user. Reads take a canonical id or the first-party cookie; `GET /v1/session` also accepts your own.\n\nEvery `/v1` operation takes a worker access token as `Authorization: Bearer <token>`, scoped to the endpoints it may call; generate one from the Qinto platform\u2019s worker access tokens page. Errors use one JSON envelope: `error` is a machine-readable slug to switch on, and `details` optionally carries field-level validation errors. The health check is unauthenticated and replies with plain text."
+  description: 'HTTP API for recording user activity on the Qinto platform: track events, attach identity traits, link custom identifiers, and record or read a user\u2019s consent and properties.\n\nEach request applies to one user. Writes address that user by any identifier of your own (email, phone, custom id) or a canonical Qinto id (`anon_\u2026`); the same identifier always reaches the same user. Reads take a canonical id or the first-party cookie; `GET /v1/session` also accepts your own.\n\nEvery `/v1` operation takes a worker access token as `Authorization: Bearer <token>`, scoped to the endpoints it may call; generate one from the Qinto platform\u2019s worker access tokens page. Errors use one JSON envelope: `error` is a machine-readable slug to switch on, and `details` optionally carries field-level validation errors. The health check is unauthenticated and answers `{ "status": "success" }`.'
 };
 var apiTags = [
   {
@@ -30106,7 +30253,7 @@ var ERRORS = {
   },
   internal: {
     status: 500,
-    description: "Unexpected server error. Nothing is guaranteed to have been persisted; reads are safe to retry, and conversions dedupe on their order id, but a retried ingestion request may record other parts of the action a second time."
+    description: "Unexpected server error. Nothing is guaranteed to have been persisted; reads are safe to retry, and conversions dedupe on their order id, but retrying an ingestion request can deliver the event to the site\u2019s apps again."
   }
 };
 var DETAILS_SLUGS = /* @__PURE__ */ new Set(["invalid_params", "invalid_body"]);
@@ -30363,6 +30510,140 @@ var health = createApiRouter().openapi(definition, (c) => {
   return respond(c, healthResponse, { status: "success" });
 });
 
+// src/id-graph/delete-request.ts
+var readAlias = /* @__PURE__ */ __name((env, key) => {
+  return traced("rpc alias.get", {}, () => {
+    return aliasStub(env, key).get(currentTraceContext());
+  });
+}, "readAlias");
+var readAnon = /* @__PURE__ */ __name((env, anonId) => {
+  return traced("rpc anon.erasable", { attrs: { "anon.id": anonId } }, () => {
+    return anonStub(env, anonId).erasable(currentTraceContext());
+  });
+}, "readAnon");
+var readPerson = /* @__PURE__ */ __name((env, globalId) => {
+  return traced("rpc global.erasable", { attrs: { "global.id": globalId } }, () => {
+    return globalStub(env, globalId).erasable(currentTraceContext());
+  });
+}, "readPerson");
+var typedOf = /* @__PURE__ */ __name(async (env, value) => {
+  if (isCanonicalId(value)) {
+    return { inputType: "anon", kind: "anon", name: value, alias: null, personId: null, anonId: value };
+  }
+  if (isGlobalId(value)) {
+    return { inputType: "person", kind: "global", name: value, alias: null, personId: value, anonId: null };
+  }
+  const identifier = classifyIdentifier(value);
+  const key = await aliasKey(identifier);
+  const assignment = await readAlias(env, key);
+  return {
+    inputType: identifier.type,
+    kind: "alias",
+    name: key,
+    alias: assignment === null ? null : identifier,
+    personId: assignment?.globalId ?? null,
+    anonId: assignment?.anonId ?? null
+  };
+}, "typedOf");
+var uniqueIdentifiers = /* @__PURE__ */ __name((identifiers) => {
+  const byKey = new Map(identifiers.map((identifier) => [`${identifier.type}:${identifier.value}`, identifier]));
+  return [...byKey.values()];
+}, "uniqueIdentifiers");
+var reachFrom = /* @__PURE__ */ __name(async (env, typed) => {
+  const anons = /* @__PURE__ */ new Map();
+  let personId = typed.personId;
+  if (personId === null && typed.anonId !== null) {
+    const anon = await readAnon(env, typed.anonId);
+    if (anon !== null) {
+      anons.set(typed.anonId, anon);
+      personId = anon.globalId;
+    }
+  }
+  const person2 = personId === null ? null : await readPerson(env, personId);
+  for (const anonId of person2?.anonIds ?? []) {
+    const anon = anons.has(anonId) ? null : await readAnon(env, anonId);
+    if (anon !== null) {
+      anons.set(anonId, anon);
+    }
+  }
+  return { personId, person: person2, anons };
+}, "reachFrom");
+var ownedAliases = /* @__PURE__ */ __name(async (env, typed, reached) => {
+  const aliasKeys = [];
+  const identifiers = [];
+  const held = [...reached.person?.identifiers ?? [], ...[...reached.anons.values()].flatMap((anon) => anon.identifiers)];
+  for (const identifier of uniqueIdentifiers(held)) {
+    const key = await aliasKey(identifier);
+    const assignment = key === typed.name ? null : await readAlias(env, key);
+    const owner = assignment?.globalId ?? null;
+    const owned = assignment === null || (owner === null ? [...reached.anons.keys()].some((anonId) => anonId === assignment.anonId) : owner === reached.personId);
+    if (key !== typed.name && owned) {
+      identifiers.push(identifier);
+      if (assignment !== null) {
+        aliasKeys.push(key);
+      }
+    }
+  }
+  if (typed.alias !== null) {
+    aliasKeys.push(typed.name);
+    identifiers.push(typed.alias);
+  }
+  return { aliasKeys, identifiers };
+}, "ownedAliases");
+var planOf = /* @__PURE__ */ __name(async (env, typed) => {
+  const reached = await reachFrom(env, typed);
+  const { aliasKeys, identifiers } = await ownedAliases(env, typed, reached);
+  return {
+    inputType: typed.inputType,
+    personId: reached.person === null ? null : reached.personId,
+    anonIds: [...reached.anons.keys()],
+    aliasKeys,
+    identifiers
+  };
+}, "planOf");
+var planDeleteRequest = /* @__PURE__ */ __name(async (env, value) => {
+  return planOf(env, await typedOf(env, value));
+}, "planDeleteRequest");
+var ERASERS = Object.freeze({
+  alias: /* @__PURE__ */ __name((env, name) => {
+    return traced("rpc alias.erase", {}, () => {
+      return aliasStub(env, name).erase(currentTraceContext());
+    });
+  }, "alias"),
+  anon: /* @__PURE__ */ __name((env, name) => {
+    return traced("rpc anon.erase", { attrs: { "anon.id": name } }, () => {
+      return anonStub(env, name).erase(currentTraceContext());
+    });
+  }, "anon"),
+  global: /* @__PURE__ */ __name((env, name) => {
+    return traced("rpc global.erase", { attrs: { "global.id": name } }, () => {
+      return globalStub(env, name).erase(currentTraceContext());
+    });
+  }, "global")
+});
+var eraseOrder = /* @__PURE__ */ __name((plan, typed) => {
+  const steps = [
+    ...plan.aliasKeys.map((name) => ({ kind: "alias", name })),
+    ...plan.anonIds.map((name) => ({ kind: "anon", name })),
+    ...plan.personId === null ? [] : [{ kind: "global", name: plan.personId }]
+  ];
+  const isTyped = /* @__PURE__ */ __name((step) => {
+    return step.kind === typed.kind && step.name === typed.name;
+  }, "isTyped");
+  return [...steps.filter((step) => !isTyped(step)), ...steps.filter(isTyped)];
+}, "eraseOrder");
+var runDeleteRequest = /* @__PURE__ */ __name(async (env, value) => {
+  const typed = await typedOf(env, value);
+  const plan = await planOf(env, typed);
+  const erased = { alias: 0, anon: 0, global: 0 };
+  for (const step of eraseOrder(plan, typed)) {
+    if (await ERASERS[step.kind](env, step.name)) {
+      erased[step.kind] += 1;
+    }
+  }
+  return { inputType: plan.inputType, anons: erased.anon, aliases: erased.alias, persons: erased.global };
+}, "runDeleteRequest");
+
 // src/id-graph/inspect.ts
 var MAX_TABLE_PAGE = 100;
 var INTERNAL_TABLE = /^(sqlite_|_cf_)/;
@@ -30487,6 +30768,7 @@ var rowsBody = inspectBody.extend({
   offset: external_exports.number().int().min(0).default(0),
   limit: external_exports.number().int().min(1).max(MAX_TABLE_PAGE).default(MAX_TABLE_PAGE)
 });
+var valueBody = external_exports.object({ value: external_exports.string().min(1) });
 var readBody = /* @__PURE__ */ __name(async (c, schema) => {
   const parsed = schema.safeParse(await c.req.json().catch(() => null));
   return parsed.success ? parsed.data : null;
@@ -30514,6 +30796,20 @@ idGraphInspect.post("/internal/id-graph/rows", async (c) => {
   }
   return c.json({ page: await inspectObjectTable(c.env, body) });
 });
+idGraphInspect.post("/internal/id-graph/plan", async (c) => {
+  const body = await readBody(c, valueBody);
+  if (body === null) {
+    return c.json({ error: "invalid_body" }, 400);
+  }
+  return c.json(await planDeleteRequest(c.env, body.value));
+});
+idGraphInspect.post("/internal/id-graph/delete", async (c) => {
+  const body = await readBody(c, valueBody);
+  if (body === null) {
+    return c.json({ error: "invalid_body" }, 400);
+  }
+  return c.json(await runDeleteRequest(c.env, body.value));
+});
 
 // src/paths/open.ts
 var withSetCookie = /* @__PURE__ */ __name((res, cookies) => {
@@ -30601,14 +30897,14 @@ var open2 = /* @__PURE__ */ __name(async (c) => {
 
 // browser-artifact/meta.json
 var meta_default = {
-  version: "0.1.10",
-  gitSha: "f21182929c88fa0748f575164bde781b31f4fbdd",
-  builtAt: "2026-09-23T15:34:39.048Z",
-  hash: "d1804e7914363626fed0280696cad5e06728b899e23c8a5ee6dcced3b67cf831"
+  version: "0.1.11",
+  gitSha: "bb87bca6d3b96627f24bc0c29675f2f19680ce60",
+  builtAt: "2026-09-28T04:35:01.606Z",
+  hash: "e32dfe041826d6daaa3682d1f5cac137ffcc6a24f55bfef1a936f7e3ef4cde12"
 };
 
 // src/paths/q-js.ts
-import qScript from "./7bc13565a6fa9d520d0ebed788d11591e8db5b44-q.js.txt";
+import qScript from "./944c722e73fe144b1067da970f87716a835c697e-q.js.txt";
 
 // src/apps-q.ts
 import appsQScript from "./apps-q.json";
@@ -30854,11 +31150,7 @@ var consent = createApiRouter().openapi(definition4, async (c) => {
 
 // src/paths/v1/consent-state.ts
 var consentStateQuery = external_exports.object({
-  identifier: external_exports.string().min(1).optional().openapi({
-    param: { name: "identifier", in: "query" },
-    description: "Canonical Qinto id (`anon_\u2026`) of the user to read. Omit it to resolve the user from the first-party cookie instead. Reading by a custom identifier arrives with authenticated API access.",
-    example: "anon_7b8d1a52-6c1e-4b6f-9a30-2f8a54d1c3e9"
-  })
+  identifier: canonicalIdentifierField
 });
 var consentStateResponse = external_exports.object({
   categories: external_exports.object({
@@ -30885,7 +31177,7 @@ var definition5 = createRoute({
   summary: "Get user consent",
   description: operationDescription({
     intro: "Returns the consent state currently stored for the user.",
-    howItWorks: "A request that carries neither a `identifier` nor the cookie \u2014 or a `identifier` that is not canonical \u2014 fails with `invalid_params`. A choice saved on another session reaches this one separately, so a read taken right after a write elsewhere can return the previous value, and a session with no further activity can stay behind indefinitely. Read back from the session that made the change when you need the value you just wrote."
+    howItWorks: "A request that carries neither an `identifier` nor the cookie \u2014 or an `identifier` that is not canonical \u2014 fails with `invalid_params`. A choice saved on another session reaches this one separately, so a read taken right after a write elsewhere can return the previous value, and a session with no further activity can stay behind indefinitely. Read back from the session that made the change when you need the value you just wrote."
   }),
   request: { query: consentStateQuery },
   responses: {
@@ -30956,11 +31248,7 @@ var identify = createApiRouter().openapi(definition6, async (c) => {
 
 // src/paths/v1/person.ts
 var personQuery = external_exports.object({
-  identifier: identifierField2.optional().openapi({
-    param: { name: "identifier", in: "query" },
-    description: "User to read: any identifier from your own systems (email, phone, custom id), or a canonical Qinto id (`anon_\u2026`, or a `tag_user_id` adopted from EdgeTag). Omit it to read the user from the first-party cookie instead. Internal `gid_\u2026` ids are rejected.",
-    example: "ada@example.com"
-  }),
+  identifier: readIdentifierField,
   cursor: external_exports.string().regex(/^\d+$/).optional().openapi({
     param: { name: "cursor", in: "query" },
     description: "The `nextCursor` of the previous page. Omit it for the first page.",
@@ -31013,11 +31301,7 @@ var person = createApiRouter().openapi(definition7, async (c) => {
 
 // src/paths/v1/properties.ts
 var propertiesQuery = external_exports.object({
-  identifier: external_exports.string().min(1).optional().openapi({
-    param: { name: "identifier", in: "query" },
-    description: "Canonical Qinto id (`anon_\u2026`) of the user to read. Omit it to resolve the user from the first-party cookie instead. Reading by a custom identifier arrives with authenticated API access.",
-    example: "anon_7b8d1a52-6c1e-4b6f-9a30-2f8a54d1c3e9"
-  })
+  identifier: canonicalIdentifierField
 });
 var propertiesResponse = external_exports.record(external_exports.string(), external_exports.unknown()).openapi("UserProperties", { description: "Every property currently stored for the user, keyed by property name." });
 var definition8 = createRoute({
@@ -31028,10 +31312,7 @@ var definition8 = createRoute({
   security: [{ QintoWorkerAccessToken: [] }],
   middleware: [requireScope(SCOPE.propertiesRead)],
   summary: "Get user properties",
-  description: operationDescription({
-    intro: "Returns every property currently stored for the user.",
-    howItWorks: "A request that carries neither a `identifier` nor the cookie \u2014 or a `identifier` that is not canonical \u2014 fails with `invalid_params`."
-  }),
+  description: operationDescription({ intro: "Returns every property currently stored for the user." }),
   request: { query: propertiesQuery },
   responses: {
     200: {
@@ -31054,11 +31335,7 @@ var properties = createApiRouter().openapi(definition8, async (c) => {
 
 // src/paths/v1/session.ts
 var sessionQuery = external_exports.object({
-  identifier: identifierField2.optional().openapi({
-    param: { name: "identifier", in: "query" },
-    description: "User to read: any identifier from your own systems (email, phone, custom id), or a canonical Qinto id (`anon_\u2026`). Omit it to read the user from the first-party cookie instead. Internal `gid_\u2026` ids are rejected.",
-    example: "ada@example.com"
-  })
+  identifier: readIdentifierField
 });
 var sessionResponse = external_exports.object({
   anonId: external_exports.string().nullable().openapi({
@@ -31535,6 +31812,16 @@ var AliasDO = class extends DurableObject {
       return { exists: true, objectId: this.ctx.id.toString(), assignment, databaseSize: this.ctx.storage.sql.databaseSize };
     });
   }
+  async erase(trace) {
+    return runInvocation({ name: "do.alias.erase", trace }, async () => {
+      if (await this.record() === void 0) {
+        return false;
+      }
+      await this.ctx.storage.deleteAll();
+      this.assignment = void 0;
+      return true;
+    });
+  }
   async record() {
     if (!this.loaded) {
       this.assignment = await this.ctx.storage.get(ASSIGNMENT_KEY);
@@ -32311,6 +32598,19 @@ var relink = /* @__PURE__ */ __name(async (storage, env, anonId, globalId) => {
     await storage.setAlarm(cleanupTarget(storage, Date.now(), lastActivityAt(storage.kv) ?? Date.now()));
   }
 }, "relink");
+var unlinkFromPerson = /* @__PURE__ */ __name((env, anonId, globalId) => {
+  return traced("rpc global.unlink_anon", { attrs: { "global.id": globalId } }, () => {
+    return globalStub(env, globalId).unlinkAnon(anonId, currentTraceContext());
+  });
+}, "unlinkFromPerson");
+var eraseAnon = /* @__PURE__ */ __name(async (storage, env) => {
+  const anonId = storedAnonId(storage.kv);
+  const globalId = linkedGlobalId(storage.kv);
+  if (anonId !== null && globalId !== null) {
+    await unlinkFromPerson(env, anonId, globalId);
+  }
+  await storage.deleteAll();
+}, "eraseAnon");
 var expireAnon = /* @__PURE__ */ __name(async (storage, env, staleActivity) => {
   if (await standsDown(storage, staleActivity)) {
     return false;
@@ -32319,9 +32619,7 @@ var expireAnon = /* @__PURE__ */ __name(async (storage, env, staleActivity) => {
   const globalId = linkedGlobalId(storage.kv);
   if (anonId !== null && globalId !== null) {
     try {
-      await traced("rpc global.unlink_anon", { attrs: { "global.id": globalId } }, () => {
-        return globalStub(env, globalId).unlinkAnon(anonId, currentTraceContext());
-      });
+      await unlinkFromPerson(env, anonId, globalId);
     } catch (error61) {
       addSpanEvent("expiry unlink failed", { level: "warn", attrs: { "anon.id": anonId, "global.id": globalId, error: String(error61) } });
       await storage.setAlarm(Date.now() + CLEANUP_INTERVAL_MS);
@@ -32827,7 +33125,7 @@ var AnonDO = class extends DurableObject2 {
   wiped = false;
   // True while processAction holds ingestQueue, including the transform await.
   ingestTurn = false;
-  // Warm write-through mirrors reset together after expiry.
+  // Warm write-through mirrors reset together after an expiry or an erase.
   kvCache;
   cachedStorage;
   identifiersMirror = identifiersCache();
@@ -33466,6 +33764,17 @@ var AnonDO = class extends DurableObject2 {
       });
     });
   }
+  erasable(trace) {
+    return runInvocation({ name: "do.anon.erasable", trace }, () => {
+      return this.enqueue(async () => {
+        if (await this.discardIfUnused()) {
+          return null;
+        }
+        const identifiers = allIdentifiers(this.sql, this.identifiersMirror).map(({ type, value }) => ({ type, value }));
+        return { globalId: linkedGlobalId(this.kv), identifiers };
+      });
+    });
+  }
   inspect(trace) {
     return runInvocation({ name: "do.anon.inspect", trace }, () => {
       return this.enqueue(async () => {
@@ -33486,6 +33795,25 @@ var AnonDO = class extends DurableObject2 {
       });
     });
   }
+  erase(trace) {
+    return runInvocation({ name: "do.anon.erase", trace }, () => {
+      return this.enqueue(async () => {
+        if (await this.discardIfUnused()) {
+          return false;
+        }
+        try {
+          await eraseAnon(this.ctx.storage, this.graph);
+        } finally {
+          this.resetMirrors();
+        }
+        this.wiped = true;
+        for (const socket of this.ctx.getWebSockets()) {
+          socket.close(1e3, "erased");
+        }
+        return true;
+      });
+    });
+  }
   // Addressing an object runs the constructor's schema exec, so a call that never writes — a read, an
   // inspect, a push or a snapshot for an id that was never used — would otherwise leave an empty object
   // behind that no cleanup alarm ever collects. Every write path seeds meta before it stores anything,
@@ -33725,16 +34053,19 @@ var AnonDO = class extends DurableObject2 {
       try {
         this.wiped = await expireAnon(this.ctx.storage, this.graph, staleActivity);
       } finally {
-        this.kvCache.clear();
-        this.cleanupAlarm = void 0;
-        this.identifiersMirror.reset();
-        this.conversionsMirror.reset();
-        this.customPropsMirror.reset();
-        this.captureMirror.reset();
-        this.contextMirror.reset();
+        this.resetMirrors();
       }
     });
   }
+  resetMirrors() {
+    this.kvCache.clear();
+    this.cleanupAlarm = void 0;
+    this.identifiersMirror.reset();
+    this.conversionsMirror.reset();
+    this.customPropsMirror.reset();
+    this.captureMirror.reset();
+    this.contextMirror.reset();
+  }
   revive() {
     if (this.wiped) {
       applyMigrations(this.ctx.storage, ANON_MIGRATIONS);
@@ -33976,7 +34307,9 @@ var GlobalDO = class extends DurableObject3 {
   }
   async unlinkAnon(anonId, trace) {
     return runInvocation({ name: "do.global.unlink_anon", trace, attrs: { "anon.id": anonId } }, async () => {
-      this.revive();
+      if (await this.discardIfUnused()) {
+        return;
+      }
       unlinkAnon(this.sql, anonId);
     });
   }
@@ -34001,6 +34334,30 @@ var GlobalDO = class extends DurableObject3 {
       return linkedAnonsPage(this.sql, afterRowId, limit);
     });
   }
+  async erasable(trace) {
+    return runInvocation({ name: "do.global.erasable", trace }, async () => {
+      if (await this.discardIfUnused()) {
+        return null;
+      }
+      const identifiers = allIdentifiers2(this.sql, this.identifiersMirror).map(({ type, value }) => ({ type, value }));
+      return { anonIds: allLinkedAnons(this.sql), identifiers };
+    });
+  }
+  async erase(trace) {
+    return runInvocation({ name: "do.global.erase", trace }, async () => {
+      if (await this.discardIfUnused()) {
+        return false;
+      }
+      try {
+        await this.ctx.storage.deleteAll();
+      } finally {
+        this.kvCache.clear();
+        this.identifiersMirror = identifiersCache2();
+      }
+      this.wiped = true;
+      return true;
+    });
+  }
   async inspect(trace) {
     return runInvocation({ name: "do.global.inspect", trace }, async () => {
       if (await this.discardIfUnused()) {