@blotout/qinto-cli 0.1.24 → 0.1.25

package/dist/worker-artifact/main/index.js

@@ -20604,7 +20604,7 @@ var MAX_APP_TOOL_NAME_LENGTH = 32;
 var APP_TOOL_NAME_PATTERN = /^[a-zA-Z][a-zA-Z0-9_]*$/;
 
 // ../../libs/app-manifest/src/tools.ts
-var MAX_APP_TOOLS = 8;
+var MAX_APP_TOOLS = 20;
 var MAX_APP_TOOL_TITLE_LENGTH = 60;
 var MIN_APP_TOOL_DESCRIPTION = 20;
 var MAX_APP_TOOL_DESCRIPTION = 16 * 1024;
@@ -20612,7 +20612,7 @@ var MAX_APP_TOOL_PROPERTY_DESCRIPTION = 200;
 var MAX_APP_TOOL_PROPERTIES = 24;
 var MAX_APP_TOOL_SCHEMA_DEPTH = 4;
 var MAX_APP_TOOL_ENUM_VALUES = 32;
-var MAX_MANIFEST_TOOLS_BYTES = 150 * 1024;
+var MAX_MANIFEST_TOOLS_BYTES = 375 * 1024;
 var TOOL_PROPERTY_NAME = /^[a-zA-Z][a-zA-Z0-9_]*$/;
 var RESERVED_TOOL_ARGUMENTS = ["teamId", "siteId", "installId"];
 var TOOL_STRING_FORMATS = ["uuid", "date", "date-time", "email", "uri"];
@@ -26481,7 +26481,9 @@ var installSchema4 = external_exports.object({
   active: external_exports.boolean(),
   // Absent from a registry deployed before the ui data plane moved off `active`; falling back to it
   // keeps that site's panels reachable exactly as they were until it redeploys.
-  enabled: external_exports.boolean().optional()
+  enabled: external_exports.boolean().optional(),
+  // Optional by design: present only on an install that has a geo filter.
+  geoFilter: external_exports.object({ include: external_exports.array(external_exports.string()), exclude: external_exports.array(external_exports.string()) }).optional()
 });
 var appSchema = external_exports.object({
   binding: external_exports.string().min(1),
@@ -27661,1434 +27663,6 @@ var readableContext = /* @__PURE__ */ __name((own2, shared) => {
   return { private: own2 === void 0 ? null : wireEntry(own2), shared: sharedContextWire(shared) };
 }, "readableContext");
 
-// src/apps/observability.ts
-var APP_ERROR_DATA_POINT_RESERVE = 50;
-var observabilityApp = /* @__PURE__ */ __name((slug, app2) => {
-  return { slug, name: app2.name, version: app2.version };
-}, "observabilityApp");
-var createDataPointBudget = /* @__PURE__ */ __name(() => {
-  let events = 0;
-  let total = 0;
-  return {
-    take: /* @__PURE__ */ __name((kind2) => {
-      if (total >= MAX_APP_DATA_POINTS_PER_INVOCATION) {
-        return false;
-      }
-      if (kind2 === "event") {
-        if (events >= MAX_APP_DATA_POINTS_PER_INVOCATION - APP_ERROR_DATA_POINT_RESERVE) {
-          return false;
-        }
-        events += 1;
-      }
-      total += 1;
-      return true;
-    }, "take")
-  };
-}, "createDataPointBudget");
-var totalLength = /* @__PURE__ */ __name((blobs) => {
-  return blobs.reduce((sum, blob) => {
-    return sum + utf8Length(blob);
-  }, 0);
-}, "totalLength");
-var errorBlobs = /* @__PURE__ */ __name((app2, install, record2, rowId) => {
-  const fixed = [app2.slug, app2.name, install.id, install.label, app2.version, record2.category, record2.action, rowId];
-  let remaining = MAX_APP_DATA_POINT_BLOB_BYTES - totalLength(fixed);
-  const description = truncateUtf8(record2.description, Math.max(0, remaining));
-  remaining -= utf8Length(description);
-  const payload = truncateUtf8(record2.payload ?? "", Math.max(0, remaining));
-  remaining -= utf8Length(payload);
-  const error61 = truncateUtf8(record2.error ?? "", Math.max(0, remaining));
-  return [app2.slug, app2.name, install.id, install.label, app2.version, record2.category, record2.action, description, payload, error61, rowId];
-}, "errorBlobs");
-var eventBlobs = /* @__PURE__ */ __name((app2, install, record2) => {
-  return [app2.slug, app2.name, install.id, install.label, app2.version, record2.name, record2.status];
-}, "eventBlobs");
-var writeEvents = /* @__PURE__ */ __name((env, target, byOrd, events) => {
-  for (const [index, event] of events.entries()) {
-    const install = byOrd.get(event.ord);
-    if (install === void 0) {
-      addSpanEvent("app observability names an install the site did not send", { level: "warn", attrs: { app: target.app.slug } });
-      continue;
-    }
-    if (!target.budget.take("event")) {
-      addSpanEvent("app observability dropped events at the data-point cap", {
-        level: "warn",
-        attrs: { app: target.app.slug, skipped: events.length - index }
-      });
-      break;
-    }
-    env.APP_EVENTS.writeDataPoint({ indexes: [`${install.id}:${event.status}`], blobs: eventBlobs(target.app, install, event) });
-  }
-}, "writeEvents");
-var writeErrors = /* @__PURE__ */ __name((env, target, byOrd, errors) => {
-  for (const [index, saved] of errors.entries()) {
-    const install = byOrd.get(saved.ord);
-    if (install === void 0) {
-      addSpanEvent("app observability names an install the site did not send", { level: "warn", attrs: { app: target.app.slug } });
-      continue;
-    }
-    if (!target.budget.take("error")) {
-      addSpanEvent("app observability dropped saved errors at the data-point cap", {
-        level: "warn",
-        attrs: { app: target.app.slug, skipped: errors.length - index }
-      });
-      break;
-    }
-    env.APP_ERRORS.writeDataPoint({
-      indexes: [`${install.id}:${saved.category}`],
-      blobs: errorBlobs(target.app, install, saved, ulid3())
-    });
-  }
-}, "writeErrors");
-var guarded = /* @__PURE__ */ __name((target, write) => {
-  try {
-    write();
-    return true;
-  } catch (error61) {
-    addSpanEvent("app observability write failed", { level: "warn", attrs: { app: target.app.slug, error: String(error61) } });
-    return false;
-  }
-}, "guarded");
-var writeAppObservabilityRecord = /* @__PURE__ */ __name((env, record2, target) => {
-  const byOrd = new Map(
-    target.installs.map((install) => {
-      return [install.ord, install];
-    })
-  );
-  const eventsWritten = guarded(target, () => {
-    writeEvents(env, target, byOrd, record2.events);
-  });
-  const errorsWritten = guarded(target, () => {
-    writeErrors(env, target, byOrd, record2.errors);
-  });
-  if (!eventsWritten || !errorsWritten) {
-    return;
-  }
-  if (record2.truncated === true) {
-    addSpanEvent("the app recorded more observability than one invocation carries", { level: "warn", attrs: { app: target.app.slug } });
-  }
-}, "writeAppObservabilityRecord");
-var writeAppObservability = /* @__PURE__ */ __name((env, response, target) => {
-  const record2 = parseAppObservability(response.headers.get(APP_OBSERVABILITY_HEADER));
-  if (record2 !== null) {
-    writeAppObservabilityRecord(env, record2, target);
-  }
-}, "writeAppObservability");
-
-// src/apps/read-bounded.ts
-var readBoundedBody = /* @__PURE__ */ __name(async (message, maxBytes) => {
-  const reader = message.body?.getReader();
-  if (reader === void 0) {
-    return new Uint8Array(0);
-  }
-  const chunks = [];
-  let received = 0;
-  let result = await reader.read();
-  while (!result.done) {
-    received += result.value.byteLength;
-    if (received > maxBytes) {
-      await reader.cancel();
-      return null;
-    }
-    chunks.push(result.value);
-    result = await reader.read();
-  }
-  const bytes = new Uint8Array(received);
-  let offset = 0;
-  for (const chunk of chunks) {
-    bytes.set(chunk, offset);
-    offset += chunk.byteLength;
-  }
-  return bytes;
-}, "readBoundedBody");
-
-// src/apps/spans.ts
-var adoptAppSpans = /* @__PURE__ */ __name((response) => {
-  const header = response.headers.get(APP_SPANS_HEADER);
-  if (header === null || header.length > MAX_APP_SPANS_BYTES) {
-    return;
-  }
-  const trace = currentTraceContext();
-  if (trace?.parent === void 0) {
-    return;
-  }
-  const record2 = parseAppSpans(header);
-  if (record2 === void 0) {
-    return;
-  }
-  for (const span of adoptSpans(record2.spans, { traceId: trace.traceId, parent: trace.parent })) {
-    appendSpan(span);
-  }
-  if (record2.truncated !== void 0 && record2.truncated > 0) {
-    setSpanAttributes({ "app.spans_truncated": record2.truncated });
-  }
-}, "adoptAppSpans");
-
-// src/apps/invoke.ts
-var APP_INVOCATION_TIMEOUT_MS = 1e4;
-var APP_HOOK_TIMEOUT_MS = 25e3;
-var MAX_EMIT_DEPTH = 2;
-var HOOK_URL = "https://app/__qinto/hook";
-var invocationContext = /* @__PURE__ */ __name((env) => {
-  const { APPS_KEY_MASTER: master, QINTO_DOMAIN_ID: domainId } = env;
-  if (master === void 0 || domainId === void 0) {
-    return void 0;
-  }
-  return { master, domainId, consentEnforced: consentEnforced(env) };
-}, "invocationContext");
-var postHookEnvelope = /* @__PURE__ */ __name(async (env, { binding, key, envelope, timeoutMs }) => {
-  const service = env[binding];
-  if (typeof service?.fetch !== "function") {
-    return void 0;
-  }
-  const headers = { "content-type": "application/json", "x-qinto-app-key": key };
-  const trace = currentTraceContext();
-  if (trace !== void 0) {
-    headers[TRACE_HEADER] = serializeTraceContext(trace);
-  }
-  const response = await service.fetch(HOOK_URL, {
-    method: "POST",
-    headers,
-    body: JSON.stringify(envelope),
-    signal: AbortSignal.timeout(timeoutMs)
-  });
-  adoptAppSpans(response);
-  return response;
-}, "postHookEnvelope");
-var triggerDepth = /* @__PURE__ */ __name((trigger) => {
-  return trigger.kind === "event" ? trigger.action.origin?.depth ?? 0 : 0;
-}, "triggerDepth");
-var stillDeclared = /* @__PURE__ */ __name((target, key, source) => {
-  if (source === "app") {
-    return true;
-  }
-  const { queryParams, cookies } = target.app.capture;
-  return source === "query" ? queryParams.some((entry) => entry.name === key) : cookies.some((entry) => entry.name === key);
-}, "stillDeclared");
-var deliverableCaptures = /* @__PURE__ */ __name((target, rows) => {
-  if (rows === void 0) {
-    return void 0;
-  }
-  const deliverable = {};
-  for (const [key, row] of Object.entries(rows)) {
-    if (stillDeclared(target, key, row.source)) {
-      deliverable[key] = { value: row.value, createdAt: row.createdAt, updatedAt: row.updatedAt, type: row.type };
-    }
-  }
-  return Object.keys(deliverable).length === 0 ? void 0 : deliverable;
-}, "deliverableCaptures");
-var eventAction = /* @__PURE__ */ __name((target, trigger, snapshot) => {
-  const buckets = target.app.data;
-  return {
-    actionId: trigger.action.actionId,
-    type: trigger.action.type,
-    userId: snapshot.anonId,
-    payload: trigger.action.payload,
-    receivedAt: trigger.action.receivedAt,
-    source: trigger.action.source,
-    ...buckets.includes("eventContext") && trigger.action.context !== void 0 ? { context: trigger.action.context } : {},
-    ...trigger.action.browserResults?.[target.slug] === void 0 ? {} : { browser: trigger.action.browserResults[target.slug] },
-    ...trigger.action.origin !== void 0 ? { origin: trigger.action.origin } : {}
-  };
-}, "eventAction");
-var buildEnvelope = /* @__PURE__ */ __name((target, trigger, snapshot, context) => {
-  const buckets = target.app.data;
-  const geoAllowed = buckets.includes("geo");
-  const currentGeo = trigger.kind === "event" ? trigger.action.geo : trigger.geo;
-  const consented = consentAllows(snapshot.consent, target.slug, target.app.consent.category, context.consentEnforced);
-  const captures = consented ? deliverableCaptures(target, snapshot.captures[target.slug]) : void 0;
-  const visitorContext = deliverableContext({ target, consented, ...snapshot.context });
-  return {
-    v: ENVELOPE_VERSION,
-    kind: trigger.kind,
-    app: { slug: target.slug, version: target.app.version },
-    installs: target.installs,
-    user: {
-      anonId: snapshot.anonId,
-      globalId: snapshot.globalId,
-      ...snapshot.createdAt === null ? {} : { createdAt: snapshot.createdAt },
-      // Custom properties intentionally win on key collisions with PII, matching the profile read path.
-      properties: {
-        ...buckets.includes("pii") ? snapshot.pii : {},
-        ...buckets.includes("customProperties") ? snapshot.custom : {}
-      },
-      ...geoAllowed ? { geo: snapshot.userGeo } : {}
-    },
-    ...buckets.includes("consentState") ? { consent: { enabled: context.consentEnforced, categories: snapshot.consent.categories, apps: snapshot.consent.apps } } : {},
-    ...geoAllowed && currentGeo !== void 0 ? { geo: currentGeo } : {},
-    ...trigger.kind === "connect" && trigger.page !== void 0 && buckets.includes("eventContext") ? { page: trigger.page } : {},
-    // Not gated on a capabilities.data bucket: an app only ever sees what it captured or wrote.
-    ...captures === void 0 ? {} : { captures },
-    ...visitorContext === void 0 ? {} : { context: visitorContext },
-    depth: triggerDepth(trigger),
-    ...trigger.kind === "event" ? { action: eventAction(target, trigger, snapshot) } : {}
-  };
-}, "buildEnvelope");
-var ingestEmit = /* @__PURE__ */ __name(async (ingest2, { slug, ord, depth, emit, anonId, geo, host, context }) => {
-  const parsed = emitPayloadSchema.safeParse(emit.payload);
-  if (!parsed.success) {
-    addSpanEvent("emit payload rejected", { level: "warn", attrs: { app: slug, ord } });
-    return;
-  }
-  const { event, eventId, properties: properties2 } = parsed.data;
-  const inherited = {
-    ...context ?? {},
-    source: "app",
-    occurredAt: emit.occurredAt,
-    ...context !== void 0 || host === void 0 ? {} : {
-      network: {
-        ...host.ip === void 0 ? {} : { ip: host.ip },
-        ...host.userAgent === void 0 ? {} : { userAgent: host.userAgent },
-        ...host.locale === void 0 ? {} : { locale: host.locale },
-        provenance: "edge"
-      }
-    },
-    offline: context === void 0 || context.source === "browser" ? false : context.offline,
-    replay: context === void 0 || context.source === "browser" ? false : context.replay
-  };
-  const action = buildAction({
-    type: "track",
-    userId: anonId,
-    source: "app",
-    payload: { event, eventId: emittedEventId(eventId, properties2), properties: properties2 ?? {} },
-    context: inherited,
-    origin: { app: slug, install: ord, depth: depth + 1 },
-    geo,
-    host
-  });
-  await ingest2(action);
-}, "ingestEmit");
-var deliverGroupPushes = /* @__PURE__ */ __name(async ({ slug, group, installs, deliverPush }) => {
-  const install = installs.find((entry) => entry.ord === group.ord);
-  for (const push of group.pushes) {
-    const { topic, data } = push;
-    switch (push.broadcast ?? "install") {
-      case "install": {
-        if (install === void 0) {
-          addSpanEvent("push rejected: its group matches no invoked install", { level: "warn", attrs: { app: slug, ord: group.ord } });
-          break;
-        }
-        await deliverPush({ slug, installId: install.id, topic, data, scope: "app" });
-        break;
-      }
-      case "app": {
-        await deliverPush({ slug, installId: null, topic, data, scope: "app" });
-        break;
-      }
-      // Whether this app may broadcast site-wide is settled in `deliverAppPush`, the one path every
-      // delivery funnels through; re-deciding it here would be a second authority to keep in sync.
-      case "site": {
-        await deliverPush({ slug, installId: null, topic, data, scope: "site" });
-        break;
-      }
-    }
-  }
-}, "deliverGroupPushes");
-var applyEffects = /* @__PURE__ */ __name(async ({
-  slug,
-  groups,
-  depth,
-  anonId,
-  installs,
-  deliverPush,
-  writeCaptures: writeCaptures2,
-  writeContext: writeContext2,
-  ingest: ingest2,
-  geo,
-  host,
-  context
-}) => {
-  const captures = groups.flatMap((group) => group.captures);
-  if (captures.length > 0) {
-    await writeCaptures2(slug, captures);
-  }
-  const contextWrites = groups.flatMap((group) => group.context);
-  if (contextWrites.length > 0) {
-    await writeContext2(slug, contextWrites);
-  }
-  for (const group of groups) {
-    await deliverGroupPushes({ slug, group, installs, deliverPush });
-    if (group.emits.length === 0) {
-      continue;
-    }
-    if (depth >= MAX_EMIT_DEPTH) {
-      addSpanEvent("emit rejected at the depth cap", { level: "warn", attrs: { app: slug, ord: group.ord, depth } });
-      continue;
-    }
-    for (const emit of group.emits) {
-      await ingestEmit(ingest2, { slug, ord: group.ord, depth, emit, anonId, geo, host, context });
-    }
-  }
-}, "applyEffects");
-var hookResponseBody = /* @__PURE__ */ __name(async (response, slug) => {
-  if (!response.ok) {
-    addSpanEvent("app hook failed", { level: "warn", attrs: { app: slug, status: response.status } });
-    return void 0;
-  }
-  const bytes = await readBoundedBody(response, MAX_RESPONSE_BYTES);
-  if (bytes === null) {
-    addSpanEvent("app hook response rejected", { level: "warn", attrs: { app: slug, reason: "The response exceeds the size cap." } });
-    return void 0;
-  }
-  return new TextDecoder().decode(bytes);
-}, "hookResponseBody");
-var runInvokeApp = /* @__PURE__ */ __name(async (env, { target, trigger, snapshot, context, deliverEffects, budget }) => {
-  try {
-    const key = await deriveAppInternalKey(context.master, context.domainId, target.slug);
-    const response = await postHookEnvelope(env, {
-      binding: target.app.binding,
-      key,
-      envelope: buildEnvelope(target, trigger, snapshot, context),
-      timeoutMs: APP_HOOK_TIMEOUT_MS
-    });
-    if (response === void 0) {
-      addSpanEvent("app service binding is missing", { level: "warn", attrs: { app: target.slug, binding: target.app.binding } });
-      return;
-    }
-    writeAppObservability(env, response, {
-      app: observabilityApp(target.slug, target.app),
-      installs: target.installs,
-      budget
-    });
-    setSpanAttributes({ "app.status": response.status });
-    const body = await hookResponseBody(response, target.slug);
-    if (body === void 0) {
-      return;
-    }
-    const verdict = validateEnvelopeResponse(JSON.parse(body), target.installs.length);
-    if (!verdict.ok) {
-      addSpanEvent("app hook response rejected", { level: "warn", attrs: { app: target.slug, reason: verdict.reason } });
-      return;
-    }
-    if (verdict.error !== null) {
-      addSpanEvent("app hook reported an error", { level: "warn", attrs: { app: target.slug, message: redactUrlParams(verdict.error) } });
-    }
-    for (const ord of verdict.effects.rejectedOrds) {
-      addSpanEvent("app effects rejected over the per-install caps", { level: "warn", attrs: { app: target.slug, ord } });
-    }
-    if (verdict.effects.accepted.length === 0) {
-      return;
-    }
-    await deliverEffects({
-      anonId: snapshot.anonId,
-      slug: target.slug,
-      groups: verdict.effects.accepted,
-      depth: triggerDepth(trigger),
-      installs: target.installs,
-      geo: trigger.kind === "event" ? trigger.action.geo : trigger.geo,
-      host: trigger.kind === "event" ? trigger.action.host : trigger.host,
-      context: trigger.kind === "event" ? trigger.action.context : void 0
-    });
-  } catch (error61) {
-    addSpanEvent("app invocation failed", { level: "warn", attrs: { app: target.slug, error: String(error61) } });
-  }
-}, "runInvokeApp");
-var invokeApp = /* @__PURE__ */ __name(async (env, input2) => {
-  const { target, trigger } = input2;
-  return traced(
-    `app.${trigger.kind} ${target.slug}`,
-    {
-      attrs: {
-        "app.slug": target.slug,
-        "app.version": target.app.version,
-        "app.binding": target.app.binding,
-        "app.hook": trigger.kind === "event" ? `onEvent.${trigger.action.type}` : "onConnect",
-        "app.installs": target.installs.length
-      }
-    },
-    () => {
-      return runInvokeApp(env, input2);
-    }
-  );
-}, "invokeApp");
-
-// src/apps/broker.ts
-var MAX_RPC_DEPTH = 3;
-var BROKER_PATHS = ["/__qinto/push", "/__qinto/rpc"];
-var pushBody = external_exports.object({
-  ...identityFields,
-  kind: external_exports.literal("push"),
-  userId: external_exports.string().min(1).max(64),
-  installId: external_exports.string().min(1).max(64).optional(),
-  broadcast: external_exports.enum(PUSH_BROADCASTS).optional(),
-  topic: external_exports.string().min(1).max(64),
-  data: external_exports.unknown().optional()
-}).strict();
-var rpcBody = external_exports.object({
-  ...identityFields,
-  kind: external_exports.literal("rpc"),
-  // Absent when the caller is an endpoint, a schedule or a ui handler; the callee then sees no user.
-  userId: external_exports.string().min(1).max(64).optional(),
-  callee: external_exports.string().min(1).max(30),
-  fn: external_exports.string().min(1).max(64),
-  args: external_exports.unknown().optional(),
-  installId: external_exports.string().min(1).max(64).optional(),
-  depth: external_exports.number().int().min(0)
-}).strict();
-var installsBody = external_exports.object({
-  ...identityFields,
-  kind: external_exports.literal("installs"),
-  callee: external_exports.string().min(1).max(30)
-}).strict();
-var activeBody = external_exports.object({
-  ...identityFields,
-  kind: external_exports.literal("active"),
-  ord: external_exports.number().int().min(1),
-  userId: external_exports.string().min(1).max(64).optional()
-}).strict();
-var contextReadBody = external_exports.object({
-  ...identityFields,
-  kind: external_exports.literal("contextRead"),
-  userId: external_exports.string().min(1).max(64)
-}).strict();
-var contextWriteBody = external_exports.object({
-  ...identityFields,
-  kind: external_exports.literal("contextWrite"),
-  userId: external_exports.string().min(1).max(64),
-  writes: external_exports.array(contextWriteSchema).min(1).max(MAX_CONTEXT_WRITES_PER_INSTALL)
-}).strict();
-var factsQuery = external_exports.object({
-  kinds: external_exports.array(external_exports.enum(APP_FACT_KINDS)).min(1).max(APP_FACT_KINDS.length).optional(),
-  observedAtGte: external_exports.number().int().nonnegative().safe().optional(),
-  observedAtLt: external_exports.number().int().nonnegative().safe().optional(),
-  limit: external_exports.number().int().min(1).max(MAX_APP_FACTS_PER_PAGE).optional()
-}).strict().refine((query) => query.observedAtGte === void 0 || query.observedAtLt === void 0 || query.observedAtGte < query.observedAtLt);
-var factsReadBody = external_exports.object({
-  ...identityFields,
-  kind: external_exports.literal("factsRead"),
-  userId: external_exports.string().min(1).max(64),
-  query: factsQuery.optional(),
-  cursor: external_exports.string().min(1).max(4096).optional()
-}).strict().refine((body) => body.query === void 0 !== (body.cursor === void 0));
-var identityReadBody = external_exports.object({
-  ...identityFields,
-  kind: external_exports.literal("identityRead"),
-  identifier: identifierField2,
-  cursor: external_exports.string().regex(/^\d+$/).optional()
-}).strict();
-var brokerBody = external_exports.discriminatedUnion("kind", [
-  pushBody,
-  rpcBody,
-  installsBody,
-  activeBody,
-  contextReadBody,
-  contextWriteBody,
-  factsReadBody,
-  identityReadBody,
-  currencyRatesBody,
-  trackBody
-]);
-var BODY_ENVELOPE_ALLOWANCE_BYTES = 2 * 1024;
-var MAX_BODY_BYTES = MAX_RPC_BYTES + BODY_ENVELOPE_ALLOWANCE_BYTES;
-var parseJson = /* @__PURE__ */ __name((raw2) => {
-  try {
-    return JSON.parse(raw2);
-  } catch {
-    return null;
-  }
-}, "parseJson");
-var factsCursor = external_exports.object({
-  userId: external_exports.string().min(1).max(64),
-  kinds: external_exports.array(external_exports.enum(APP_FACT_KINDS)).min(1).max(APP_FACT_KINDS.length),
-  observedAtGte: external_exports.number().int().nonnegative().safe().nullable(),
-  observedAtLt: external_exports.number().int().nonnegative().safe().nullable(),
-  limit: external_exports.number().int().min(1).max(MAX_APP_FACTS_PER_PAGE),
-  afterRowId: external_exports.number().int().nonnegative().safe(),
-  maxRowId: external_exports.number().int().positive().safe().nullable()
-}).strict();
-var cursorKey = /* @__PURE__ */ __name(async (hex3) => {
-  const bytes = Uint8Array.from(hex3.matchAll(/.{2}/g), ([pair]) => Number.parseInt(pair, 16));
-  return crypto.subtle.importKey("raw", bytes, "AES-GCM", false, ["encrypt", "decrypt"]);
-}, "cursorKey");
-var encodeBase64Url = /* @__PURE__ */ __name((bytes) => {
-  let binary = "";
-  for (const byte of bytes) {
-    binary += String.fromCharCode(byte);
-  }
-  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
-}, "encodeBase64Url");
-var decodeBase64Url = /* @__PURE__ */ __name((value) => {
-  const base643 = value.replaceAll("-", "+").replaceAll("_", "/");
-  const padded = base643.padEnd(Math.ceil(base643.length / 4) * 4, "=");
-  const binary = atob(padded);
-  return Uint8Array.from(binary, (character) => character.charCodeAt(0));
-}, "decodeBase64Url");
-var encryptFactsCursor = /* @__PURE__ */ __name(async (key, cursor) => {
-  const iv = crypto.getRandomValues(new Uint8Array(12));
-  const plaintext = new TextEncoder().encode(JSON.stringify(cursor));
-  const ciphertext = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv }, await cursorKey(key), plaintext));
-  const packed = new Uint8Array(iv.byteLength + ciphertext.byteLength);
-  packed.set(iv);
-  packed.set(ciphertext, iv.byteLength);
-  return encodeBase64Url(packed);
-}, "encryptFactsCursor");
-var decryptFactsCursor = /* @__PURE__ */ __name(async (key, encoded) => {
-  try {
-    const packed = decodeBase64Url(encoded);
-    if (packed.byteLength <= 12) {
-      return null;
-    }
-    const plaintext = await crypto.subtle.decrypt({ name: "AES-GCM", iv: packed.slice(0, 12) }, await cursorKey(key), packed.slice(12));
-    return JSON.parse(new TextDecoder().decode(plaintext));
-  } catch {
-    return null;
-  }
-}, "decryptFactsCursor");
-var invalidBody = /* @__PURE__ */ __name(() => {
-  return Response.json({ error: "invalid_body" }, { status: 400 });
-}, "invalidBody");
-var forbidden = /* @__PURE__ */ __name(() => {
-  return Response.json({ error: "forbidden" }, { status: 403 });
-}, "forbidden");
-var factsPermissionDenied = /* @__PURE__ */ __name(() => {
-  return Response.json({ error: "facts_permission_denied" }, { status: 403 });
-}, "factsPermissionDenied");
-var identityPermissionDenied = /* @__PURE__ */ __name(() => {
-  return Response.json({ error: "identity_permission_denied" }, { status: 403 });
-}, "identityPermissionDenied");
-var handlePush = /* @__PURE__ */ __name(async (env, body) => {
-  if (new TextEncoder().encode(JSON.stringify(body.data ?? null)).length > MAX_PUSH_BYTES) {
-    return invalidBody();
-  }
-  const broadcast = body.broadcast ?? "install";
-  if (broadcast === "install" && body.installId === void 0) {
-    return invalidBody();
-  }
-  const installId = broadcast === "install" ? body.installId : null;
-  if (await rateLimited(env, `${body.slug}:${installId ?? ""}:push`)) {
-    return Response.json({ error: "rate_limited" }, { status: 429 });
-  }
-  const app2 = siteRegistry().registry.apps[body.slug];
-  if (broadcast === "site" && (app2 === void 0 || !app2.events.publishes.includes(body.topic) || !app2.data.includes(SHARED_CONTEXT_CAPABILITY))) {
-    return Response.json({ error: "topic_not_public" }, { status: 400 });
-  }
-  await anonStub(env, body.userId).appPush(
-    { slug: body.slug, installId, topic: body.topic, data: body.data, scope: broadcast === "site" ? "site" : "app" },
-    ownSite(env),
-    currentTraceContext()
-  );
-  return Response.json({ accepted: true }, { status: 202 });
-}, "handlePush");
-var resolveInstall = /* @__PURE__ */ __name((callee, installId) => {
-  const active = callee.installs.filter((install) => install.active);
-  if (installId !== void 0) {
-    const install = active.find((entry) => entry.id === installId);
-    return install === void 0 ? "invalid_install" : { id: install.id, ord: install.ord, label: install.label };
-  }
-  const [only, second] = active;
-  return only === void 0 || second !== void 0 ? "install_required" : { id: only.id, ord: only.ord, label: only.label };
-}, "resolveInstall");
-var calleeFailed = /* @__PURE__ */ __name((callee, reason) => {
-  addSpanEvent("rpc callee failed", { level: "warn", attrs: { app: callee, reason } });
-  return Response.json({ error: "callee_failed" }, { status: 502 });
-}, "calleeFailed");
-var deliverRpcEffects = /* @__PURE__ */ __name(async (env, { body, userId, effects, install }) => {
-  for (const ord of effects.rejectedOrds) {
-    addSpanEvent("app effects rejected over the per-install caps", { level: "warn", attrs: { app: body.callee, ord } });
-  }
-  const site = ownSite(env);
-  await applyEffects({
-    slug: body.callee,
-    groups: effects.accepted,
-    depth: body.depth,
-    anonId: userId,
-    installs: [install],
-    deliverPush: /* @__PURE__ */ __name(async (push) => {
-      await anonStub(env, userId).appPush(push, site, currentTraceContext());
-    }, "deliverPush"),
-    writeCaptures: /* @__PURE__ */ __name(async (slug, writes) => {
-      await anonStub(env, userId).appCaptures({ slug, writes }, site, currentTraceContext());
-    }, "writeCaptures"),
-    writeContext: /* @__PURE__ */ __name(async (slug, writes) => {
-      await anonStub(env, userId).appContext({ slug, writes }, site, currentTraceContext());
-    }, "writeContext"),
-    ingest: /* @__PURE__ */ __name((action) => {
-      return ingest(env, action, site);
-    }, "ingest")
-  });
-}, "deliverRpcEffects");
-var runRelayRpc = /* @__PURE__ */ __name(async (env, { context, body, callee, install }) => {
-  let raw2;
-  try {
-    const key = await deriveAppInternalKey(context.master, context.domainId, body.callee);
-    const response = await postHookEnvelope(env, {
-      binding: callee.binding,
-      key,
-      envelope: {
-        v: ENVELOPE_VERSION,
-        kind: "rpc",
-        app: { slug: body.callee, version: callee.version },
-        installs: [install],
-        // No bucket projection for rpc: the callee sees only the subject's id, never its profile.
-        // Omitted entirely when the caller had no visitor, so the callee's ctx.user is null.
-        ...body.userId === void 0 ? {} : { user: { anonId: body.userId, globalId: null, properties: {} } },
-        depth: body.depth,
-        // JSON.stringify drops an undefined key, and the envelope requires `args` to be present.
-        rpc: { caller: body.slug, fn: body.fn, args: body.args ?? null }
-      },
-      timeoutMs: APP_INVOCATION_TIMEOUT_MS
-    });
-    if (response === void 0) {
-      return calleeFailed(body.callee, "The callee service binding is missing.");
-    }
-    writeAppObservability(env, response, {
-      app: observabilityApp(body.callee, callee),
-      installs: [install],
-      budget: createDataPointBudget()
-    });
-    setSpanAttributes({ "app.status": response.status });
-    if (!response.ok) {
-      return calleeFailed(body.callee, `The callee answered status ${response.status}.`);
-    }
-    const bytes = await readBoundedBody(response, MAX_RESPONSE_BYTES);
-    if (bytes === null) {
-      return calleeFailed(body.callee, "The response exceeds the size cap.");
-    }
-    raw2 = new TextDecoder().decode(bytes);
-  } catch (error61) {
-    return calleeFailed(body.callee, String(error61));
-  }
-  const verdict = validateEnvelopeResponse(parseJson(raw2), 1);
-  if (!verdict.ok) {
-    return calleeFailed(body.callee, verdict.reason);
-  }
-  if (verdict.error !== null) {
-    const reason = redactUrlParams(verdict.error);
-    if (verdict.errorCode === "invalid_arguments") {
-      return Response.json({ error: "invalid_arguments", message: reason }, { status: 400 });
-    }
-    return calleeFailed(body.callee, reason);
-  }
-  if (verdict.rpc === null) {
-    return calleeFailed(body.callee, "The response carries no rpc result.");
-  }
-  if (body.userId === void 0) {
-    if (verdict.effects.accepted.length > 0) {
-      addSpanEvent("rpc effects dropped: the call carries no subject", { level: "warn", attrs: { app: body.callee } });
-    }
-  } else {
-    await deliverRpcEffects(env, { body, userId: body.userId, effects: verdict.effects, install });
-  }
-  return Response.json({ result: verdict.rpc.result });
-}, "runRelayRpc");
-var relayRpc = /* @__PURE__ */ __name(async (env, input2) => {
-  const { body, callee, install } = input2;
-  return traced(
-    `app.rpc ${body.callee}`,
-    {
-      attrs: {
-        "app.slug": body.callee,
-        "app.version": callee.version,
-        "app.binding": callee.binding,
-        "app.hook": `rpc.${body.fn}`,
-        "app.install_id": install.id,
-        "app.install_ord": install.ord,
-        "app.install_label": install.label,
-        "app.rpc_caller": body.slug,
-        "app.rpc_depth": body.depth
-      }
-    },
-    () => {
-      return runRelayRpc(env, input2);
-    }
-  );
-}, "relayRpc");
-var handleRpc = /* @__PURE__ */ __name(async (env, context, body) => {
-  if (body.depth > MAX_RPC_DEPTH) {
-    return Response.json({ error: "depth_exceeded" }, { status: 400 });
-  }
-  const callee = siteRegistry().registry.apps[body.callee];
-  if (callee === void 0) {
-    return forbidden();
-  }
-  const visibility = callee.rpc.exposes[body.fn];
-  if (visibility !== "public" && !(visibility === "private" && (callee.rpc.grants[body.slug] ?? []).includes(body.fn))) {
-    return forbidden();
-  }
-  const install = resolveInstall(callee, body.installId);
-  if (install === "invalid_install" || install === "install_required") {
-    return Response.json({ error: install }, { status: 400 });
-  }
-  if (new TextEncoder().encode(JSON.stringify(body.args ?? null)).length > MAX_RPC_BYTES) {
-    return Response.json({ error: "too_large" }, { status: 413 });
-  }
-  if (await rateLimited(env, `${body.slug}:${install.id}:rpc`)) {
-    return Response.json({ error: "rate_limited" }, { status: 429 });
-  }
-  return relayRpc(env, { context, body, callee, install });
-}, "handleRpc");
-var handleInstalls = /* @__PURE__ */ __name(async (env, body) => {
-  const callee = siteRegistry().registry.apps[body.callee];
-  if (callee === void 0 || !(Object.values(callee.rpc.exposes).includes("public") || (callee.rpc.grants[body.slug] ?? []).length > 0)) {
-    return forbidden();
-  }
-  if (await rateLimited(env, `${body.slug}::installs`)) {
-    return Response.json({ error: "rate_limited" }, { status: 429 });
-  }
-  const installs = callee.installs.filter((install) => install.active).map(({ id, label }) => ({ id, label }));
-  return Response.json({ installs });
-}, "handleInstalls");
-var handleContextRead = /* @__PURE__ */ __name(async (env, body) => {
-  if (await rateLimited(env, `${body.slug}::context`)) {
-    return Response.json({ error: "rate_limited" }, { status: 429 });
-  }
-  return Response.json(await anonStub(env, body.userId).getAppContext(body.slug, ownSite(env), currentTraceContext()));
-}, "handleContextRead");
-var handleContextWrite = /* @__PURE__ */ __name(async (env, body) => {
-  if (await rateLimited(env, `${body.slug}::context`)) {
-    return Response.json({ error: "rate_limited" }, { status: 429 });
-  }
-  const stored = await anonStub(env, body.userId).appContext({ slug: body.slug, writes: body.writes }, ownSite(env), currentTraceContext());
-  return Response.json({ stored }, { status: 202 });
-}, "handleContextWrite");
-var initialFactsCursor = /* @__PURE__ */ __name((body) => {
-  const query = body.query;
-  return {
-    userId: body.userId,
-    kinds: query.kinds ?? [...APP_FACT_KINDS],
-    observedAtGte: query.observedAtGte ?? null,
-    observedAtLt: query.observedAtLt ?? null,
-    limit: query.limit ?? MAX_APP_FACTS_PER_PAGE,
-    afterRowId: 0,
-    maxRowId: null
-  };
-}, "initialFactsCursor");
-var handleFactsRead = /* @__PURE__ */ __name(async (env, body) => {
-  const app2 = siteRegistry().registry.apps[body.slug];
-  if (app2 === void 0 || !app2.data.includes("facts")) {
-    return factsPermissionDenied();
-  }
-  if (await rateLimited(env, `${body.slug}::facts`)) {
-    return Response.json({ error: "rate_limited" }, { status: 429 });
-  }
-  const decoded = body.cursor === void 0 ? initialFactsCursor(body) : await decryptFactsCursor(body.key, body.cursor);
-  if (decoded === null || decoded.userId !== body.userId || body.cursor !== void 0 && decoded.maxRowId === null) {
-    return Response.json({ error: "invalid_cursor" }, { status: 400 });
-  }
-  const query = {
-    kinds: decoded.kinds,
-    observedAtGte: decoded.observedAtGte,
-    observedAtLt: decoded.observedAtLt,
-    limit: decoded.limit,
-    afterRowId: decoded.afterRowId,
-    maxRowId: decoded.maxRowId
-  };
-  const page = await anonStub(env, body.userId).getAppFacts(body.slug, query, ownSite(env), currentTraceContext());
-  if (page === null) {
-    return factsPermissionDenied();
-  }
-  const nextCursor = page.next === null ? null : await encryptFactsCursor(body.key, {
-    ...decoded,
-    afterRowId: page.next.afterRowId,
-    maxRowId: page.next.maxRowId
-  });
-  return Response.json({ items: page.items, nextCursor });
-}, "handleFactsRead");
-var handleIdentityRead = /* @__PURE__ */ __name(async (env, body) => {
-  const app2 = siteRegistry().registry.apps[body.slug];
-  if (app2 === void 0 || !app2.data.includes(IDENTITY_CAPABILITY)) {
-    return identityPermissionDenied();
-  }
-  if (await rateLimited(env, `${body.slug}::identity`)) {
-    return Response.json({ error: "rate_limited" }, { status: 429 });
-  }
-  const person2 = await lookupPersonForApp(env, body.slug, body.identifier, body.cursor === void 0 ? 0 : Number(body.cursor));
-  if (person2 === null) {
-    return identityPermissionDenied();
-  }
-  return Response.json(person2);
-}, "handleIdentityRead");
-var handleActive = /* @__PURE__ */ __name(async (env, body) => {
-  const app2 = siteRegistry().registry.apps[body.slug];
-  if (app2 === void 0) {
-    return forbidden();
-  }
-  if (!app2.installs.some((install) => install.active && install.ord === body.ord)) {
-    return forbidden();
-  }
-  if (body.userId !== void 0 && !await anonStub(env, body.userId).appAllowed(body.slug, ownSite(env), currentTraceContext())) {
-    return forbidden();
-  }
-  return Response.json({ active: true });
-}, "handleActive");
-var handleBroker = /* @__PURE__ */ __name(async (request, env, ctx) => {
-  const bytes = await readBoundedBody(request, MAX_BODY_BYTES);
-  if (bytes === null) {
-    return Response.json({ error: "too_large" }, { status: 413 });
-  }
-  const candidate = parseJson(new TextDecoder().decode(bytes));
-  const parsed = brokerBody.safeParse(candidate);
-  if (!parsed.success) {
-    if (typeof candidate === "object" && candidate !== null && "kind" in candidate && candidate.kind === "factsRead") {
-      const malformedFacts = candidate;
-      const error61 = malformedFacts.cursor !== void 0 && malformedFacts.query === void 0 ? "invalid_cursor" : "invalid_query";
-      return Response.json({ error: error61 }, { status: 400 });
-    }
-    return invalidBody();
-  }
-  const body = parsed.data;
-  if (siteRegistry().registry.apps[body.slug] === void 0) {
-    return forbidden();
-  }
-  const context = invocationContext(env);
-  if (context === void 0) {
-    return forbidden();
-  }
-  const expected = await deriveAppInternalKey(context.master, context.domainId, body.slug);
-  if (!constantTimeEqual(expected, body.key)) {
-    return forbidden();
-  }
-  switch (body.kind) {
-    case "push": {
-      return handlePush(env, body);
-    }
-    case "rpc": {
-      return handleRpc(env, context, body);
-    }
-    case "installs": {
-      return handleInstalls(env, body);
-    }
-    case "active": {
-      return handleActive(env, body);
-    }
-    case "contextRead": {
-      return handleContextRead(env, body);
-    }
-    case "contextWrite": {
-      return handleContextWrite(env, body);
-    }
-    case "factsRead": {
-      return handleFactsRead(env, body);
-    }
-    case "identityRead": {
-      return handleIdentityRead(env, body);
-    }
-    case "currencyRates": {
-      return handleCurrencyRates(ctx);
-    }
-    case "track": {
-      return handleTrack(env, body);
-    }
-  }
-}, "handleBroker");
-var brokerRoutes = new Hono2();
-var dispatchGated = /* @__PURE__ */ __name((c) => {
-  if (c.env.DEPLOY_TARGET !== "dispatch") {
-    return c.notFound();
-  }
-  return handleBroker(c.req.raw, c.env, c.executionCtx);
-}, "dispatchGated");
-for (const path of BROKER_PATHS) {
-  brokerRoutes.post(path, dispatchGated);
-}
-var Broker = class extends WorkerEntrypoint {
-  static {
-    __name(this, "Broker");
-  }
-  fetch(request) {
-    const trace = parseTraceContext(request.headers.get(TRACE_HEADER));
-    return runInvocation({ name: "broker", trace }, () => {
-      return handleBroker(request, this.env, this.ctx);
-    });
-  }
-};
-
-// src/apps-control.ts
-import controlText from "./apps-control.json";
-var apps_control_default = controlText;
-
-// src/apps/control-targets.ts
-var controlTargetsSchema = external_exports.object({
-  v: external_exports.literal(1),
-  apps: external_exports.record(
-    external_exports.string(),
-    external_exports.object({
-      binding: external_exports.string().min(1),
-      versions: external_exports.array(external_exports.object({ version: external_exports.string().min(1), versionId: external_exports.string().min(1) }).strict()).min(1)
-    }).strict()
-  )
-}).strict();
-var EMPTY_TARGETS = Object.freeze({ v: 1, apps: Object.freeze({}) });
-var parseControlTargets = /* @__PURE__ */ __name((raw2) => {
-  try {
-    const parsed = controlTargetsSchema.safeParse(JSON.parse(raw2));
-    return parsed.success ? parsed.data : EMPTY_TARGETS;
-  } catch {
-    return EMPTY_TARGETS;
-  }
-}, "parseControlTargets");
-var cachedRaw3;
-var cachedTargets = EMPTY_TARGETS;
-var controlTargets = /* @__PURE__ */ __name(() => {
-  if (apps_control_default !== cachedRaw3) {
-    cachedTargets = parseControlTargets(apps_control_default);
-    cachedRaw3 = apps_control_default;
-  }
-  return cachedTargets;
-}, "controlTargets");
-
-// src/apps/control.ts
-var CONTROL_PATH = "/__qinto/control";
-var MAX_CLOCK_SKEW_MS = 5 * 60 * 1e3;
-var observabilityTarget = /* @__PURE__ */ __name((envelope) => {
-  const installs = envelope.schedule?.installs ?? (envelope.install === void 0 ? [] : [envelope.install]);
-  const app2 = siteRegistry().registry.apps[envelope.app.slug];
-  if (installs.length === 0 || app2 === void 0) {
-    return void 0;
-  }
-  return {
-    app: observabilityApp(envelope.app.slug, { name: app2.name, version: envelope.app.version }),
-    installs,
-    budget: createDataPointBudget()
-  };
-}, "observabilityTarget");
-var writeControlObservability = /* @__PURE__ */ __name((env, upstream, envelope) => {
-  const target = observabilityTarget(envelope);
-  if (target !== void 0) {
-    writeAppObservability(env, upstream, target);
-  }
-}, "writeControlObservability");
-var timedOutAction = /* @__PURE__ */ __name((envelope) => {
-  if (envelope.schedule !== void 0) {
-    return `schedules.${envelope.schedule.id}`;
-  }
-  if (envelope.tool !== void 0) {
-    return `tools.${envelope.tool.name}`;
-  }
-  return envelope.lifecycle === void 0 ? envelope.kind : `lifecycle.${envelope.lifecycle.type}`;
-}, "timedOutAction");
-var writeControlTimeout = /* @__PURE__ */ __name((env, envelope, deadlineMs) => {
-  const target = observabilityTarget(envelope);
-  if (target === void 0) {
-    return;
-  }
-  const action = timedOutAction(envelope);
-  const description = `${action} did not answer within ${deadlineMs / 1e3} s, so the site stopped waiting.`;
-  writeAppObservabilityRecord(
-    env,
-    {
-      v: APP_OBSERVABILITY_VERSION,
-      events: [],
-      errors: target.installs.map((install) => {
-        return { ord: install.ord, category: "internal", action, description };
-      })
-    },
-    target
-  );
-}, "writeControlTimeout");
-var forwardControl = /* @__PURE__ */ __name(async (env, service, envelope, init) => {
-  const deadlineMs = CONTROL_DEADLINES_MS[envelope.kind].site;
-  try {
-    return await service.fetch("https://app/__qinto/control", { method: "POST", ...init, signal: AbortSignal.timeout(deadlineMs) });
-  } catch (error61) {
-    if (!(error61 instanceof Error && error61.name === "TimeoutError")) {
-      throw error61;
-    }
-    writeControlTimeout(env, envelope, deadlineMs);
-    return void 0;
-  }
-}, "forwardControl");
-var textBody = /* @__PURE__ */ __name(async (request) => {
-  const bytes = await readBoundedBody(request, MAX_CONTROL_BYTES);
-  return bytes === null ? null : new TextDecoder().decode(bytes);
-}, "textBody");
-var parseJson2 = /* @__PURE__ */ __name((value) => {
-  try {
-    return JSON.parse(value);
-  } catch {
-    return void 0;
-  }
-}, "parseJson");
-var authenticateControl = /* @__PURE__ */ __name(async (request, env, body) => {
-  const timestamp = request.headers.get(CONTROL_TIMESTAMP_HEADER);
-  const signature = request.headers.get(CONTROL_SIGNATURE_HEADER);
-  const { APPS_KEY_MASTER: master, QINTO_CONTROL_KEY: controlKey, QINTO_DOMAIN_ID: domainId } = env;
-  if (timestamp === null || signature === null || master === void 0 || controlKey === void 0 || domainId === void 0) {
-    return null;
-  }
-  const timestampMs = Number(timestamp);
-  if (!Number.isSafeInteger(timestampMs) || Math.abs(Date.now() - timestampMs) > MAX_CLOCK_SKEW_MS) {
-    return null;
-  }
-  return await verifyControlRequestSignature(controlKey, timestamp, body, signature) ? { master, domainId } : null;
-}, "authenticateControl");
-var handleControl = /* @__PURE__ */ __name(async (request, env) => {
-  const body = await textBody(request);
-  if (body === null) {
-    return Response.json({ error: "too_large" }, { status: 413 });
-  }
-  const authentication = await authenticateControl(request, env, body);
-  if (authentication === null) {
-    return Response.json({ error: "unauthorized" }, { status: 401 });
-  }
-  const raw2 = parseJson2(body);
-  if (raw2 === void 0) {
-    return Response.json({ error: "invalid_body" }, { status: 400 });
-  }
-  const parsed = controlEnvelopeSchema.safeParse(raw2);
-  if (!parsed.success) {
-    return Response.json({ error: "invalid_body" }, { status: 400 });
-  }
-  const envelope = parsed.data;
-  const target = controlTargets().apps[envelope.app.slug];
-  if (target === void 0) {
-    return Response.json({ error: "target_missing" }, { status: 404 });
-  }
-  if (!target.versions.some((version2) => version2.version === envelope.app.version)) {
-    return Response.json({ error: "target_version_mismatch" }, { status: 409 });
-  }
-  const service = env[target.binding];
-  if (typeof service?.fetch !== "function") {
-    return Response.json({ error: "binding_missing" }, { status: 503 });
-  }
-  const headers = {
-    "content-type": "application/json",
-    "x-qinto-app-key": await deriveAppInternalKey(authentication.master, authentication.domainId, envelope.app.slug)
-  };
-  const trace = currentTraceContext();
-  if (trace !== void 0) {
-    headers[TRACE_HEADER] = serializeTraceContext(trace);
-  }
-  const upstream = await forwardControl(env, service, envelope, { headers, body });
-  if (upstream === void 0) {
-    return Response.json({ error: "upstream_timeout" }, { status: 504 });
-  }
-  adoptAppSpans(upstream);
-  writeControlObservability(env, upstream, envelope);
-  const responseBytes = await readBoundedBody(upstream, MAX_CONTROL_BYTES);
-  if (responseBytes === null) {
-    return Response.json({ error: "invalid_response" }, { status: 502 });
-  }
-  const responseBody = parseJson2(new TextDecoder().decode(responseBytes));
-  if (responseBody === void 0) {
-    return Response.json({ error: "invalid_response" }, { status: 502 });
-  }
-  const response = controlResponseSchema.safeParse(responseBody);
-  if (!upstream.ok || !response.success) {
-    return Response.json({ error: "invalid_response" }, { status: 502 });
-  }
-  return Response.json(response.data);
-}, "handleControl");
-var appControlRoutes = new Hono2().post(CONTROL_PATH, (c) => {
-  return handleControl(c.req.raw, c.env);
-});
-
-// ../../libs/worker-access-token/src/endpoints.ts
-var APP_ENDPOINT_PREFIX = "/app/";
-var MAX_CUSTOM_ENDPOINT_LENGTH = 128;
-var HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
-var HTTP_METHOD_BIT = { GET: 1, POST: 2, PUT: 4, PATCH: 8, DELETE: 16 };
-var ALL_METHODS_MASK = HTTP_METHODS.reduce((mask, method) => mask | HTTP_METHOD_BIT[method], 0);
-var ALLOWED_CHARS = /^[A-Za-z0-9._~/-]+$/;
-var matchesAppEndpoint = /* @__PURE__ */ __name((endpoints, path, method) => {
-  const bit = HTTP_METHODS.includes(method) ? HTTP_METHOD_BIT[method] : 0;
-  return endpoints.some((endpoint) => {
-    if ((endpoint.methods & bit) === 0) {
-      return false;
-    }
-    return endpoint.path.endsWith("/*") ? path.startsWith(endpoint.path.slice(0, -1)) : path === endpoint.path;
-  });
-}, "matchesAppEndpoint");
-var validateAppEndpoint = /* @__PURE__ */ __name((raw2) => {
-  if (!Number.isInteger(raw2.methods) || raw2.methods <= 0 || raw2.methods > ALL_METHODS_MASK) {
-    return { ok: false, reason: "Choose at least one HTTP method." };
-  }
-  const path = raw2.path.trim();
-  if (!path.startsWith(APP_ENDPOINT_PREFIX)) {
-    return { ok: false, reason: "Custom endpoints must start with /app/." };
-  }
-  if (path.length > MAX_CUSTOM_ENDPOINT_LENGTH) {
-    return { ok: false, reason: `Custom endpoint must be ${MAX_CUSTOM_ENDPOINT_LENGTH} characters or fewer.` };
-  }
-  const isWildcard = path.endsWith("/*");
-  if (path.includes("*") && (!isWildcard || path.indexOf("*") !== path.length - 1)) {
-    return { ok: false, reason: "A wildcard is only allowed as a trailing /* (e.g. /app/reports/*)." };
-  }
-  if (!isWildcard && path.endsWith("/")) {
-    return { ok: false, reason: "Custom endpoint must not end with a slash." };
-  }
-  const body = isWildcard ? path.slice(0, -1) : path;
-  if (!ALLOWED_CHARS.test(body)) {
-    return { ok: false, reason: "Custom endpoint contains invalid characters." };
-  }
-  if (body.includes("..")) {
-    return { ok: false, reason: 'Custom endpoint must not contain "..".' };
-  }
-  return { ok: true, value: { methods: raw2.methods, path } };
-}, "validateAppEndpoint");
-
-// ../../libs/worker-access-token/src/scopes.ts
-var SCOPE = {
-  track: 1,
-  identify: 2,
-  alias: 4,
-  consentWrite: 8,
-  propertiesRead: 16,
-  consentRead: 32,
-  sessionRead: 64,
-  idGraphInspect: 128,
-  capture: 256
-};
-var ALL_SCOPE_MASK = Object.values(SCOPE).reduce((mask, bit) => mask | bit, 0);
-var WORKER_ACCESS_TOKEN_SCOPES = [
-  { key: "track", bit: SCOPE.track, label: "Track events", description: "POST /v1/track \u2014 record events a user performed." },
-  { key: "identify", bit: SCOPE.identify, label: "Identify users", description: "POST /v1/identify \u2014 attach identity traits to a user." },
-  { key: "alias", bit: SCOPE.alias, label: "Link identifiers", description: "POST /v1/alias \u2014 link an identifier of your own to a user." },
-  {
-    key: "consentWrite",
-    bit: SCOPE.consentWrite,
-    label: "Save consent",
-    description: "POST /v1/consent \u2014 record a user\u2019s consent choices."
-  },
-  {
-    key: "propertiesRead",
-    bit: SCOPE.propertiesRead,
-    label: "Read properties",
-    description: "GET /v1/properties \u2014 read the properties stored for a user."
-  },
-  {
-    key: "consentRead",
-    bit: SCOPE.consentRead,
-    label: "Read consent",
-    description: "GET /v1/consent \u2014 read the consent stored for a user."
-  },
-  {
-    key: "sessionRead",
-    bit: SCOPE.sessionRead,
-    label: "Read session ids",
-    description: "GET /v1/session, GET /v1/person \u2014 read the anonymous and person ids for a user, and the sessions linked to a person."
-  },
-  {
-    key: "capture",
-    bit: SCOPE.capture,
-    label: "Write captures",
-    description: "POST /v1/capture \u2014 record click ids and vendor ids an installed app declares."
-  }
-];
-
-// ../../libs/worker-access-token/src/env.ts
-var validMask = /* @__PURE__ */ __name((mask) => {
-  return typeof mask === "number" && Number.isSafeInteger(mask) && mask >= 0 && mask <= ALL_SCOPE_MASK;
-}, "validMask");
-var validApp = /* @__PURE__ */ __name((app2) => {
-  return app2 === void 0 || typeof app2 === "string" && app2.length > 0 && app2.length <= 30;
-}, "validApp");
-var decodeEndpoints = /* @__PURE__ */ __name((value) => {
-  if (value === void 0) {
-    return { endpoints: [], dropped: 0 };
-  }
-  if (!Array.isArray(value)) {
-    return { endpoints: [], dropped: 1 };
-  }
-  const endpoints = [];
-  let dropped = 0;
-  for (const encoded of value) {
-    if (!Array.isArray(encoded) || encoded.length !== 2 || typeof encoded[0] !== "number" || typeof encoded[1] !== "string") {
-      dropped += 1;
-      continue;
-    }
-    const result = validateAppEndpoint({ methods: encoded[0], path: encoded[1] });
-    if (!result.ok) {
-      dropped += 1;
-      continue;
-    }
-    endpoints.push(Object.freeze(result.value));
-  }
-  return { endpoints: Object.freeze(endpoints), dropped };
-}, "decodeEndpoints");
-var parseTokenEntry = /* @__PURE__ */ __name((value) => {
-  if (typeof value === "number") {
-    return { entry: validMask(value) && value > 0 ? Object.freeze({ mask: value, app: null, endpoints: null }) : null, dropped: 0 };
-  }
-  if (typeof value !== "object" || value === null) {
-    return { entry: null, dropped: 0 };
-  }
-  const entry = value;
-  if (!validMask(entry.m) || !validApp(entry.a)) {
-    return { entry: null, dropped: 0 };
-  }
-  const decoded = decodeEndpoints(entry.e);
-  if (entry.m === 0 && decoded.endpoints.length === 0) {
-    return { entry: null, dropped: decoded.dropped };
-  }
-  return {
-    entry: Object.freeze({
-      mask: entry.m,
-      app: typeof entry.a === "string" ? entry.a : null,
-      endpoints: decoded.endpoints.length === 0 ? null : decoded.endpoints
-    }),
-    dropped: decoded.dropped
-  };
-}, "parseTokenEntry");
-var parseWorkerAccessTokensEnv = /* @__PURE__ */ __name((raw2) => {
-  if (raw2.trim() === "") {
-    return { tokens: /* @__PURE__ */ new Map() };
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw2);
-  } catch {
-    return { tokens: /* @__PURE__ */ new Map(), error: "WORKER_ACCESS_TOKENS is not valid JSON" };
-  }
-  if (typeof parsed !== "object" || parsed === null || parsed.v !== 2) {
-    return { tokens: /* @__PURE__ */ new Map(), error: "WORKER_ACCESS_TOKENS has an unsupported version" };
-  }
-  const table = parsed.t;
-  if (typeof table !== "object" || table === null) {
-    return { tokens: /* @__PURE__ */ new Map(), error: "WORKER_ACCESS_TOKENS is missing its token table" };
-  }
-  const tokens = /* @__PURE__ */ new Map();
-  let rejected = 0;
-  for (const [hash2, value] of Object.entries(table)) {
-    const parsedEntry = parseTokenEntry(value);
-    rejected += parsedEntry.dropped;
-    if (parsedEntry.entry === null) {
-      rejected += 1;
-      continue;
-    }
-    tokens.set(hash2, parsedEntry.entry);
-  }
-  if (rejected > 0) {
-    return { tokens, error: `WORKER_ACCESS_TOKENS dropped ${rejected} invalid entr${rejected === 1 ? "y" : "ies"}` };
-  }
-  return { tokens };
-}, "parseWorkerAccessTokensEnv");
-
-// ../../libs/worker-access-token/src/hash.ts
-var hashWorkerAccessToken = /* @__PURE__ */ __name(async (raw2) => {
-  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(raw2));
-  let binary = "";
-  for (const byte of new Uint8Array(digest)) {
-    binary += String.fromCharCode(byte);
-  }
-  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}, "hashWorkerAccessToken");
-
-// src/common/auth.ts
-var cachedRaw4;
-var cachedTokens = /* @__PURE__ */ new Map();
-var tokensFor = /* @__PURE__ */ __name((raw2) => {
-  if (raw2 === cachedRaw4) {
-    return cachedTokens;
-  }
-  const parsed = parseWorkerAccessTokensEnv(raw2);
-  if (parsed.error !== void 0) {
-    addSpanEvent("WORKER_ACCESS_TOKENS is misconfigured; rejecting affected tokens until fixed", {
-      level: "error",
-      attrs: { error: String(parsed.error) }
-    });
-  }
-  cachedRaw4 = raw2;
-  cachedTokens = parsed.tokens;
-  return cachedTokens;
-}, "tokensFor");
-var readBearerToken = /* @__PURE__ */ __name((request) => {
-  const header = request.headers.get("Authorization");
-  if (header === null) {
-    return null;
-  }
-  const prefix = "Bearer ";
-  if (!header.startsWith(prefix)) {
-    return null;
-  }
-  const token = header.slice(prefix.length).trim();
-  return token.length > 0 ? token : null;
-}, "readBearerToken");
-var workerAccessTokenEntry = /* @__PURE__ */ __name(async (env, token) => {
-  const raw2 = env.WORKER_ACCESS_TOKENS ?? "";
-  return tokensFor(raw2).get(await hashWorkerAccessToken(token));
-}, "workerAccessTokenEntry");
-var requireScope = /* @__PURE__ */ __name((bit) => {
-  return async (c, next) => {
-    const token = readBearerToken(c.req.raw);
-    if (token === null) {
-      return c.json({ error: "unauthenticated" }, 401);
-    }
-    const entry = await workerAccessTokenEntry(c.env, token);
-    if (entry === void 0) {
-      return c.json({ error: "unauthenticated" }, 401);
-    }
-    if ((entry.mask & bit) === 0) {
-      return c.json({ error: "forbidden" }, 403);
-    }
-    c.set("actionSource", entry.app === null ? "api" : "app");
-    return next();
-  };
-}, "requireScope");
-
-// src/helpers/header-json.ts
-var headerJson = /* @__PURE__ */ __name((value) => {
-  return JSON.stringify(value).replace(/[\u0080-\uffff]/g, (char) => {
-    return `\\u${char.charCodeAt(0).toString(16).padStart(4, "0")}`;
-  });
-}, "headerJson");
-
-// src/apps/stream-deadlines.ts
-var streamWithDeadlines = /* @__PURE__ */ __name((source, { idleMs, totalMs }) => {
-  if (source === null) {
-    return null;
-  }
-  const reader = source.getReader();
-  let target;
-  let totalTimer;
-  let idleTimer = null;
-  let stopped = false;
-  const clearIdleTimer = /* @__PURE__ */ __name(() => {
-    if (idleTimer !== null) {
-      clearTimeout(idleTimer);
-      idleTimer = null;
-    }
-  }, "clearIdleTimer");
-  const clearTimers = /* @__PURE__ */ __name(() => {
-    clearTimeout(totalTimer);
-    clearIdleTimer();
-  }, "clearTimers");
-  const stop = /* @__PURE__ */ __name((message) => {
-    stopped = true;
-    clearTimers();
-    const error61 = new DOMException(message, "TimeoutError");
-    target.error(error61);
-    void reader.cancel(error61).catch(() => void 0);
-  }, "stop");
-  return new ReadableStream({
-    start: /* @__PURE__ */ __name((controller) => {
-      target = controller;
-      totalTimer = setTimeout(() => {
-        stop("The app endpoint stream exceeded its maximum duration.");
-      }, totalMs);
-    }, "start"),
-    pull: /* @__PURE__ */ __name(async (controller) => {
-      idleTimer = setTimeout(() => {
-        stop("The app endpoint stream stopped producing data.");
-      }, idleMs);
-      let result;
-      try {
-        result = await reader.read();
-      } catch (error61) {
-        stopped = true;
-        clearTimers();
-        throw error61;
-      }
-      clearIdleTimer();
-      if (stopped) {
-        return;
-      }
-      if (result.done) {
-        stopped = true;
-        clearTimers();
-        controller.close();
-        return;
-      }
-      controller.enqueue(result.value);
-    }, "pull"),
-    cancel: /* @__PURE__ */ __name(async (reason) => {
-      stopped = true;
-      clearTimers();
-      await reader.cancel(reason);
-    }, "cancel")
-  });
-}, "streamWithDeadlines");
-
 // ../../libs/bot-protection/src/countries.ts
 var EU_TOKEN = "EU";
 var COUNTRY_CODES = [
@@ -29350,82 +27924,1648 @@ var matchesRule = /* @__PURE__ */ __name((country, isEU, list) => {
   if (country !== void 0 && list.includes(country)) {
     return true;
   }
-  return isEU && list.includes(EU_TOKEN);
-}, "matchesRule");
-var isCountryBlocked = /* @__PURE__ */ __name((country, isEU, rule) => {
-  if (rule === null || rule.list.length === 0) {
-    return false;
+  return isEU && list.includes(EU_TOKEN);
+}, "matchesRule");
+var isCountryBlocked = /* @__PURE__ */ __name((country, isEU, rule) => {
+  if (rule === null || rule.list.length === 0) {
+    return false;
+  }
+  const matched = matchesRule(country, isEU, rule.list);
+  return rule.mode === "block" ? matched : !matched;
+}, "isCountryBlocked");
+
+// ../../libs/bot-protection/src/score.ts
+var BOT_SCORE_MIN = 1;
+var BOT_SCORE_MAX = 99;
+
+// ../../libs/bot-protection/src/config.ts
+var NO_PROTECTION = { minBotScore: null, countries: null };
+var normalizeScore = /* @__PURE__ */ __name((value, problems) => {
+  if (value === void 0 || value === null) {
+    return null;
+  }
+  if (typeof value === "number" && Number.isInteger(value) && value >= BOT_SCORE_MIN && value <= BOT_SCORE_MAX) {
+    return value;
+  }
+  problems.push("has an out-of-range minBotScore");
+  return null;
+}, "normalizeScore");
+var normalizeCountries = /* @__PURE__ */ __name((value, problems) => {
+  if (value === void 0 || value === null) {
+    return null;
+  }
+  const record2 = value;
+  if (record2.mode !== "allow" && record2.mode !== "block" || !Array.isArray(record2.list)) {
+    problems.push("has an invalid countries rule");
+    return null;
+  }
+  const list = [];
+  let dropped = 0;
+  for (const token of record2.list) {
+    if (typeof token === "string" && isSelectableCountryToken(token)) {
+      list.push(token);
+    } else {
+      dropped += 1;
+    }
+  }
+  if (dropped > 0) {
+    problems.push(`dropped ${dropped} invalid country token(s)`);
+  }
+  return list.length === 0 ? null : { mode: record2.mode, list };
+}, "normalizeCountries");
+var parseBotProtection = /* @__PURE__ */ __name((raw2) => {
+  if (raw2.trim() === "") {
+    return { config: NO_PROTECTION };
+  }
+  let value;
+  try {
+    value = JSON.parse(raw2);
+  } catch {
+    return { config: NO_PROTECTION, error: "BOT_PROTECTION is not valid JSON" };
+  }
+  if (typeof value !== "object" || value === null) {
+    return { config: NO_PROTECTION, error: "BOT_PROTECTION is not an object" };
+  }
+  const record2 = value;
+  const problems = [];
+  const config2 = {
+    minBotScore: normalizeScore(record2.minBotScore, problems),
+    countries: normalizeCountries(record2.countries, problems)
+  };
+  return problems.length > 0 ? { config: config2, error: `BOT_PROTECTION ${problems.join("; ")}` } : { config: config2 };
+}, "parseBotProtection");
+var isRequestBlocked = /* @__PURE__ */ __name((config2, signal) => {
+  if (config2.minBotScore !== null && signal.botScore !== void 0 && signal.botScore < config2.minBotScore) {
+    return true;
+  }
+  return isCountryBlocked(signal.country, signal.isEU ?? false, config2.countries);
+}, "isRequestBlocked");
+
+// ../../libs/geo-filter/src/us-states.ts
+var US_STATE_NAMES = {
+  "US-AK": "Alaska",
+  "US-AL": "Alabama",
+  "US-AR": "Arkansas",
+  "US-AZ": "Arizona",
+  "US-CA": "California",
+  "US-CO": "Colorado",
+  "US-CT": "Connecticut",
+  "US-DC": "District of Columbia",
+  "US-DE": "Delaware",
+  "US-FL": "Florida",
+  "US-GA": "Georgia",
+  "US-HI": "Hawaii",
+  "US-IA": "Iowa",
+  "US-ID": "Idaho",
+  "US-IL": "Illinois",
+  "US-IN": "Indiana",
+  "US-KS": "Kansas",
+  "US-KY": "Kentucky",
+  "US-LA": "Louisiana",
+  "US-MA": "Massachusetts",
+  "US-MD": "Maryland",
+  "US-ME": "Maine",
+  "US-MI": "Michigan",
+  "US-MN": "Minnesota",
+  "US-MO": "Missouri",
+  "US-MS": "Mississippi",
+  "US-MT": "Montana",
+  "US-NC": "North Carolina",
+  "US-ND": "North Dakota",
+  "US-NE": "Nebraska",
+  "US-NH": "New Hampshire",
+  "US-NJ": "New Jersey",
+  "US-NM": "New Mexico",
+  "US-NV": "Nevada",
+  "US-NY": "New York",
+  "US-OH": "Ohio",
+  "US-OK": "Oklahoma",
+  "US-OR": "Oregon",
+  "US-PA": "Pennsylvania",
+  "US-RI": "Rhode Island",
+  "US-SC": "South Carolina",
+  "US-SD": "South Dakota",
+  "US-TN": "Tennessee",
+  "US-TX": "Texas",
+  "US-UT": "Utah",
+  "US-VA": "Virginia",
+  "US-VT": "Vermont",
+  "US-WA": "Washington",
+  "US-WI": "Wisconsin",
+  "US-WV": "West Virginia",
+  "US-WY": "Wyoming"
+};
+var US_STATE_TOKENS = Object.keys(US_STATE_NAMES);
+var STATE_TOKENS = new Set(US_STATE_TOKENS);
+
+// ../../libs/geo-filter/src/geo-filter.ts
+var UNKNOWN_COUNTRIES = /* @__PURE__ */ new Set(["XX", "T1"]);
+var tokenMatches = /* @__PURE__ */ __name((token, location) => {
+  if (token === EU_TOKEN) {
+    return location.isEU === true;
+  }
+  if (STATE_TOKENS.has(token)) {
+    return location.country === "US" && `US-${location.regionCode}` === token;
+  }
+  return token === location.country;
+}, "tokenMatches");
+var locationKnown = /* @__PURE__ */ __name((filter, location) => {
+  if (location.country === void 0 || UNKNOWN_COUNTRIES.has(location.country)) {
+    return false;
+  }
+  const tokens = [...filter.include, ...filter.exclude];
+  if (location.country === "US" && !location.regionCode && tokens.some((token) => STATE_TOKENS.has(token))) {
+    return false;
+  }
+  return location.isEU !== void 0 || !tokens.includes(EU_TOKEN);
+}, "locationKnown");
+var geoFilterAllows = /* @__PURE__ */ __name((filter, location) => {
+  if (!locationKnown(filter, location)) {
+    return false;
+  }
+  const included = filter.include.length === 0 || filter.include.some((token) => {
+    return tokenMatches(token, location);
+  });
+  return included && !filter.exclude.some((token) => {
+    return tokenMatches(token, location);
+  });
+}, "geoFilterAllows");
+
+// ../../libs/geo-filter/src/validate.ts
+var KNOWN_TOKENS = /* @__PURE__ */ new Set([EU_TOKEN, ...COUNTRY_CODES, ...US_STATE_TOKENS]);
+
+// src/apps/geo-filter.ts
+var startedOnSocket = /* @__PURE__ */ __name((trigger) => {
+  return trigger.kind === "connect" || trigger.action.source === "website" || trigger.action.fromSocket === true;
+}, "startedOnSocket");
+var geoLocation = /* @__PURE__ */ __name((geo) => {
+  return {
+    country: geo.country,
+    regionCode: geo.regionCode,
+    isEU: geo.isEUCountry === "unknown" ? void 0 : geo.isEUCountry === "yes"
+  };
+}, "geoLocation");
+var socketLocation = /* @__PURE__ */ __name((cf) => {
+  return geoLocation(geoFromCf(cf));
+}, "socketLocation");
+var visitorLocation = /* @__PURE__ */ __name((trigger) => {
+  if (!startedOnSocket(trigger)) {
+    return null;
+  }
+  return socketLocation(trigger.kind === "connect" ? trigger.geo : trigger.action.geo);
+}, "visitorLocation");
+var geoRunnableInstalls = /* @__PURE__ */ __name((slug, app2, location) => {
+  const runs = [];
+  const skipped = [];
+  for (const install of app2.installs) {
+    if (!install.active) {
+      continue;
+    }
+    if (install.geoFilter === void 0 || location === null || geoFilterAllows(install.geoFilter, location)) {
+      runs.push(install);
+    } else {
+      skipped.push(`${slug}:${install.id}`);
+    }
+  }
+  return { runs, skipped };
+}, "geoRunnableInstalls");
+var geoAllowedInstalls = /* @__PURE__ */ __name((registry3, cf) => {
+  const location = socketLocation(cf);
+  return Object.entries(registry3.apps).flatMap(([slug, app2]) => {
+    return geoRunnableInstalls(slug, app2, location).runs.filter((install) => install.geoFilter !== void 0).map((install) => install.id);
+  });
+}, "geoAllowedInstalls");
+
+// src/apps/observability.ts
+var APP_ERROR_DATA_POINT_RESERVE = 50;
+var observabilityApp = /* @__PURE__ */ __name((slug, app2) => {
+  return { slug, name: app2.name, version: app2.version };
+}, "observabilityApp");
+var createDataPointBudget = /* @__PURE__ */ __name(() => {
+  let events = 0;
+  let total = 0;
+  return {
+    take: /* @__PURE__ */ __name((kind2) => {
+      if (total >= MAX_APP_DATA_POINTS_PER_INVOCATION) {
+        return false;
+      }
+      if (kind2 === "event") {
+        if (events >= MAX_APP_DATA_POINTS_PER_INVOCATION - APP_ERROR_DATA_POINT_RESERVE) {
+          return false;
+        }
+        events += 1;
+      }
+      total += 1;
+      return true;
+    }, "take")
+  };
+}, "createDataPointBudget");
+var totalLength = /* @__PURE__ */ __name((blobs) => {
+  return blobs.reduce((sum, blob) => {
+    return sum + utf8Length(blob);
+  }, 0);
+}, "totalLength");
+var errorBlobs = /* @__PURE__ */ __name((app2, install, record2, rowId) => {
+  const fixed = [app2.slug, app2.name, install.id, install.label, app2.version, record2.category, record2.action, rowId];
+  let remaining = MAX_APP_DATA_POINT_BLOB_BYTES - totalLength(fixed);
+  const description = truncateUtf8(record2.description, Math.max(0, remaining));
+  remaining -= utf8Length(description);
+  const payload = truncateUtf8(record2.payload ?? "", Math.max(0, remaining));
+  remaining -= utf8Length(payload);
+  const error61 = truncateUtf8(record2.error ?? "", Math.max(0, remaining));
+  return [app2.slug, app2.name, install.id, install.label, app2.version, record2.category, record2.action, description, payload, error61, rowId];
+}, "errorBlobs");
+var eventBlobs = /* @__PURE__ */ __name((app2, install, record2) => {
+  return [app2.slug, app2.name, install.id, install.label, app2.version, record2.name, record2.status];
+}, "eventBlobs");
+var writeEvents = /* @__PURE__ */ __name((env, target, byOrd, events) => {
+  for (const [index, event] of events.entries()) {
+    const install = byOrd.get(event.ord);
+    if (install === void 0) {
+      addSpanEvent("app observability names an install the site did not send", { level: "warn", attrs: { app: target.app.slug } });
+      continue;
+    }
+    if (!target.budget.take("event")) {
+      addSpanEvent("app observability dropped events at the data-point cap", {
+        level: "warn",
+        attrs: { app: target.app.slug, skipped: events.length - index }
+      });
+      break;
+    }
+    env.APP_EVENTS.writeDataPoint({ indexes: [`${install.id}:${event.status}`], blobs: eventBlobs(target.app, install, event) });
+  }
+}, "writeEvents");
+var writeErrors = /* @__PURE__ */ __name((env, target, byOrd, errors) => {
+  for (const [index, saved] of errors.entries()) {
+    const install = byOrd.get(saved.ord);
+    if (install === void 0) {
+      addSpanEvent("app observability names an install the site did not send", { level: "warn", attrs: { app: target.app.slug } });
+      continue;
+    }
+    if (!target.budget.take("error")) {
+      addSpanEvent("app observability dropped saved errors at the data-point cap", {
+        level: "warn",
+        attrs: { app: target.app.slug, skipped: errors.length - index }
+      });
+      break;
+    }
+    env.APP_ERRORS.writeDataPoint({
+      indexes: [`${install.id}:${saved.category}`],
+      blobs: errorBlobs(target.app, install, saved, ulid3())
+    });
+  }
+}, "writeErrors");
+var guarded = /* @__PURE__ */ __name((target, write) => {
+  try {
+    write();
+    return true;
+  } catch (error61) {
+    addSpanEvent("app observability write failed", { level: "warn", attrs: { app: target.app.slug, error: String(error61) } });
+    return false;
+  }
+}, "guarded");
+var writeAppObservabilityRecord = /* @__PURE__ */ __name((env, record2, target) => {
+  const byOrd = new Map(
+    target.installs.map((install) => {
+      return [install.ord, install];
+    })
+  );
+  const eventsWritten = guarded(target, () => {
+    writeEvents(env, target, byOrd, record2.events);
+  });
+  const errorsWritten = guarded(target, () => {
+    writeErrors(env, target, byOrd, record2.errors);
+  });
+  if (!eventsWritten || !errorsWritten) {
+    return;
+  }
+  if (record2.truncated === true) {
+    addSpanEvent("the app recorded more observability than one invocation carries", { level: "warn", attrs: { app: target.app.slug } });
+  }
+}, "writeAppObservabilityRecord");
+var writeAppObservability = /* @__PURE__ */ __name((env, response, target) => {
+  const record2 = parseAppObservability(response.headers.get(APP_OBSERVABILITY_HEADER));
+  if (record2 !== null) {
+    writeAppObservabilityRecord(env, record2, target);
+  }
+}, "writeAppObservability");
+
+// src/apps/read-bounded.ts
+var readBoundedBody = /* @__PURE__ */ __name(async (message, maxBytes) => {
+  const reader = message.body?.getReader();
+  if (reader === void 0) {
+    return new Uint8Array(0);
+  }
+  const chunks = [];
+  let received = 0;
+  let result = await reader.read();
+  while (!result.done) {
+    received += result.value.byteLength;
+    if (received > maxBytes) {
+      await reader.cancel();
+      return null;
+    }
+    chunks.push(result.value);
+    result = await reader.read();
+  }
+  const bytes = new Uint8Array(received);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return bytes;
+}, "readBoundedBody");
+
+// src/apps/spans.ts
+var adoptAppSpans = /* @__PURE__ */ __name((response) => {
+  const header = response.headers.get(APP_SPANS_HEADER);
+  if (header === null || header.length > MAX_APP_SPANS_BYTES) {
+    return;
+  }
+  const trace = currentTraceContext();
+  if (trace?.parent === void 0) {
+    return;
+  }
+  const record2 = parseAppSpans(header);
+  if (record2 === void 0) {
+    return;
+  }
+  for (const span of adoptSpans(record2.spans, { traceId: trace.traceId, parent: trace.parent })) {
+    appendSpan(span);
+  }
+  if (record2.truncated !== void 0 && record2.truncated > 0) {
+    setSpanAttributes({ "app.spans_truncated": record2.truncated });
+  }
+}, "adoptAppSpans");
+
+// src/apps/invoke.ts
+var APP_INVOCATION_TIMEOUT_MS = 1e4;
+var APP_HOOK_TIMEOUT_MS = 25e3;
+var MAX_EMIT_DEPTH = 2;
+var HOOK_URL = "https://app/__qinto/hook";
+var invocationContext = /* @__PURE__ */ __name((env) => {
+  const { APPS_KEY_MASTER: master, QINTO_DOMAIN_ID: domainId } = env;
+  if (master === void 0 || domainId === void 0) {
+    return void 0;
+  }
+  return { master, domainId, consentEnforced: consentEnforced(env) };
+}, "invocationContext");
+var postHookEnvelope = /* @__PURE__ */ __name(async (env, { binding, key, envelope, timeoutMs }) => {
+  const service = env[binding];
+  if (typeof service?.fetch !== "function") {
+    return void 0;
+  }
+  const headers = { "content-type": "application/json", "x-qinto-app-key": key };
+  const trace = currentTraceContext();
+  if (trace !== void 0) {
+    headers[TRACE_HEADER] = serializeTraceContext(trace);
+  }
+  const response = await service.fetch(HOOK_URL, {
+    method: "POST",
+    headers,
+    body: JSON.stringify(envelope),
+    signal: AbortSignal.timeout(timeoutMs)
+  });
+  adoptAppSpans(response);
+  return response;
+}, "postHookEnvelope");
+var triggerDepth = /* @__PURE__ */ __name((trigger) => {
+  return trigger.kind === "event" ? trigger.action.origin?.depth ?? 0 : 0;
+}, "triggerDepth");
+var stillDeclared = /* @__PURE__ */ __name((target, key, source) => {
+  if (source === "app") {
+    return true;
+  }
+  const { queryParams, cookies } = target.app.capture;
+  return source === "query" ? queryParams.some((entry) => entry.name === key) : cookies.some((entry) => entry.name === key);
+}, "stillDeclared");
+var deliverableCaptures = /* @__PURE__ */ __name((target, rows) => {
+  if (rows === void 0) {
+    return void 0;
+  }
+  const deliverable = {};
+  for (const [key, row] of Object.entries(rows)) {
+    if (stillDeclared(target, key, row.source)) {
+      deliverable[key] = { value: row.value, createdAt: row.createdAt, updatedAt: row.updatedAt, type: row.type };
+    }
+  }
+  return Object.keys(deliverable).length === 0 ? void 0 : deliverable;
+}, "deliverableCaptures");
+var eventAction = /* @__PURE__ */ __name((target, trigger, snapshot) => {
+  const buckets = target.app.data;
+  return {
+    actionId: trigger.action.actionId,
+    type: trigger.action.type,
+    userId: snapshot.anonId,
+    payload: trigger.action.payload,
+    receivedAt: trigger.action.receivedAt,
+    source: trigger.action.source,
+    ...buckets.includes("eventContext") && trigger.action.context !== void 0 ? { context: trigger.action.context } : {},
+    ...trigger.action.browserResults?.[target.slug] === void 0 ? {} : { browser: trigger.action.browserResults[target.slug] },
+    ...trigger.action.origin !== void 0 ? { origin: trigger.action.origin } : {}
+  };
+}, "eventAction");
+var buildEnvelope = /* @__PURE__ */ __name((target, trigger, snapshot, context) => {
+  const buckets = target.app.data;
+  const geoAllowed = buckets.includes("geo");
+  const currentGeo = trigger.kind === "event" ? trigger.action.geo : trigger.geo;
+  const consented = consentAllows(snapshot.consent, target.slug, target.app.consent.category, context.consentEnforced);
+  const captures = consented ? deliverableCaptures(target, snapshot.captures[target.slug]) : void 0;
+  const visitorContext = deliverableContext({ target, consented, ...snapshot.context });
+  return {
+    v: ENVELOPE_VERSION,
+    kind: trigger.kind,
+    app: { slug: target.slug, version: target.app.version },
+    installs: target.installs,
+    user: {
+      anonId: snapshot.anonId,
+      globalId: snapshot.globalId,
+      ...snapshot.createdAt === null ? {} : { createdAt: snapshot.createdAt },
+      // Custom properties intentionally win on key collisions with PII, matching the profile read path.
+      properties: {
+        ...buckets.includes("pii") ? snapshot.pii : {},
+        ...buckets.includes("customProperties") ? snapshot.custom : {}
+      },
+      ...geoAllowed ? { geo: snapshot.userGeo } : {}
+    },
+    ...buckets.includes("consentState") ? { consent: { enabled: context.consentEnforced, categories: snapshot.consent.categories, apps: snapshot.consent.apps } } : {},
+    ...geoAllowed && currentGeo !== void 0 ? { geo: currentGeo } : {},
+    ...trigger.kind === "connect" && trigger.page !== void 0 && buckets.includes("eventContext") ? { page: trigger.page } : {},
+    // Not gated on a capabilities.data bucket: an app only ever sees what it captured or wrote.
+    ...captures === void 0 ? {} : { captures },
+    ...visitorContext === void 0 ? {} : { context: visitorContext },
+    depth: triggerDepth(trigger),
+    ...trigger.kind === "event" ? { action: eventAction(target, trigger, snapshot) } : {}
+  };
+}, "buildEnvelope");
+var ingestEmit = /* @__PURE__ */ __name(async (ingest2, { slug, ord, depth, emit, anonId, geo, host, context, fromSocket }) => {
+  const parsed = emitPayloadSchema.safeParse(emit.payload);
+  if (!parsed.success) {
+    addSpanEvent("emit payload rejected", { level: "warn", attrs: { app: slug, ord } });
+    return;
+  }
+  const { event, eventId, properties: properties2 } = parsed.data;
+  const inherited = {
+    ...context ?? {},
+    source: "app",
+    occurredAt: emit.occurredAt,
+    ...context !== void 0 || host === void 0 ? {} : {
+      network: {
+        ...host.ip === void 0 ? {} : { ip: host.ip },
+        ...host.userAgent === void 0 ? {} : { userAgent: host.userAgent },
+        ...host.locale === void 0 ? {} : { locale: host.locale },
+        provenance: "edge"
+      }
+    },
+    offline: context === void 0 || context.source === "browser" ? false : context.offline,
+    replay: context === void 0 || context.source === "browser" ? false : context.replay
+  };
+  const action = buildAction({
+    type: "track",
+    userId: anonId,
+    source: "app",
+    payload: { event, eventId: emittedEventId(eventId, properties2), properties: properties2 ?? {} },
+    context: inherited,
+    origin: { app: slug, install: ord, depth: depth + 1 },
+    fromSocket,
+    geo,
+    host
+  });
+  await ingest2(action);
+}, "ingestEmit");
+var deliverGroupPushes = /* @__PURE__ */ __name(async ({ slug, group, installs, deliverPush }) => {
+  const install = installs.find((entry) => entry.ord === group.ord);
+  for (const push of group.pushes) {
+    const { topic, data } = push;
+    switch (push.broadcast ?? "install") {
+      case "install": {
+        if (install === void 0) {
+          addSpanEvent("push rejected: its group matches no invoked install", { level: "warn", attrs: { app: slug, ord: group.ord } });
+          break;
+        }
+        await deliverPush({ slug, installId: install.id, topic, data, scope: "app" });
+        break;
+      }
+      case "app": {
+        await deliverPush({ slug, installId: null, topic, data, scope: "app" });
+        break;
+      }
+      // Whether this app may broadcast site-wide is settled in `deliverAppPush`, the one path every
+      // delivery funnels through; re-deciding it here would be a second authority to keep in sync.
+      case "site": {
+        await deliverPush({ slug, installId: null, topic, data, scope: "site" });
+        break;
+      }
+    }
+  }
+}, "deliverGroupPushes");
+var applyEffects = /* @__PURE__ */ __name(async ({
+  slug,
+  groups,
+  depth,
+  anonId,
+  installs,
+  deliverPush,
+  writeCaptures: writeCaptures2,
+  writeContext: writeContext2,
+  ingest: ingest2,
+  geo,
+  host,
+  context,
+  fromSocket
+}) => {
+  const captures = groups.flatMap((group) => group.captures);
+  if (captures.length > 0) {
+    await writeCaptures2(slug, captures);
+  }
+  const contextWrites = groups.flatMap((group) => group.context);
+  if (contextWrites.length > 0) {
+    await writeContext2(slug, contextWrites);
+  }
+  for (const group of groups) {
+    await deliverGroupPushes({ slug, group, installs, deliverPush });
+    if (group.emits.length === 0) {
+      continue;
+    }
+    if (depth >= MAX_EMIT_DEPTH) {
+      addSpanEvent("emit rejected at the depth cap", { level: "warn", attrs: { app: slug, ord: group.ord, depth } });
+      continue;
+    }
+    for (const emit of group.emits) {
+      await ingestEmit(ingest2, { slug, ord: group.ord, depth, emit, anonId, geo, host, context, fromSocket });
+    }
+  }
+}, "applyEffects");
+var hookResponseBody = /* @__PURE__ */ __name(async (response, slug) => {
+  if (!response.ok) {
+    addSpanEvent("app hook failed", { level: "warn", attrs: { app: slug, status: response.status } });
+    return void 0;
+  }
+  const bytes = await readBoundedBody(response, MAX_RESPONSE_BYTES);
+  if (bytes === null) {
+    addSpanEvent("app hook response rejected", { level: "warn", attrs: { app: slug, reason: "The response exceeds the size cap." } });
+    return void 0;
+  }
+  return new TextDecoder().decode(bytes);
+}, "hookResponseBody");
+var runInvokeApp = /* @__PURE__ */ __name(async (env, { target, trigger, snapshot, context, deliverEffects, budget }) => {
+  try {
+    const key = await deriveAppInternalKey(context.master, context.domainId, target.slug);
+    const response = await postHookEnvelope(env, {
+      binding: target.app.binding,
+      key,
+      envelope: buildEnvelope(target, trigger, snapshot, context),
+      timeoutMs: APP_HOOK_TIMEOUT_MS
+    });
+    if (response === void 0) {
+      addSpanEvent("app service binding is missing", { level: "warn", attrs: { app: target.slug, binding: target.app.binding } });
+      return;
+    }
+    writeAppObservability(env, response, {
+      app: observabilityApp(target.slug, target.app),
+      installs: target.installs,
+      budget
+    });
+    setSpanAttributes({ "app.status": response.status });
+    const body = await hookResponseBody(response, target.slug);
+    if (body === void 0) {
+      return;
+    }
+    const verdict = validateEnvelopeResponse(JSON.parse(body), target.installs.length);
+    if (!verdict.ok) {
+      addSpanEvent("app hook response rejected", { level: "warn", attrs: { app: target.slug, reason: verdict.reason } });
+      return;
+    }
+    if (verdict.error !== null) {
+      addSpanEvent("app hook reported an error", { level: "warn", attrs: { app: target.slug, message: redactUrlParams(verdict.error) } });
+    }
+    for (const ord of verdict.effects.rejectedOrds) {
+      addSpanEvent("app effects rejected over the per-install caps", { level: "warn", attrs: { app: target.slug, ord } });
+    }
+    if (verdict.effects.accepted.length === 0) {
+      return;
+    }
+    await deliverEffects({
+      anonId: snapshot.anonId,
+      slug: target.slug,
+      groups: verdict.effects.accepted,
+      depth: triggerDepth(trigger),
+      installs: target.installs,
+      geo: trigger.kind === "event" ? trigger.action.geo : trigger.geo,
+      host: trigger.kind === "event" ? trigger.action.host : trigger.host,
+      context: trigger.kind === "event" ? trigger.action.context : void 0,
+      ...startedOnSocket(trigger) ? { fromSocket: true } : {}
+    });
+  } catch (error61) {
+    addSpanEvent("app invocation failed", { level: "warn", attrs: { app: target.slug, error: String(error61) } });
+  }
+}, "runInvokeApp");
+var invokeApp = /* @__PURE__ */ __name(async (env, input2) => {
+  const { target, trigger } = input2;
+  return traced(
+    `app.${trigger.kind} ${target.slug}`,
+    {
+      attrs: {
+        "app.slug": target.slug,
+        "app.version": target.app.version,
+        "app.binding": target.app.binding,
+        "app.hook": trigger.kind === "event" ? `onEvent.${trigger.action.type}` : "onConnect",
+        "app.installs": target.installs.length
+      }
+    },
+    () => {
+      return runInvokeApp(env, input2);
+    }
+  );
+}, "invokeApp");
+
+// src/apps/broker.ts
+var MAX_RPC_DEPTH = 3;
+var BROKER_PATHS = ["/__qinto/push", "/__qinto/rpc"];
+var pushBody = external_exports.object({
+  ...identityFields,
+  kind: external_exports.literal("push"),
+  userId: external_exports.string().min(1).max(64),
+  installId: external_exports.string().min(1).max(64).optional(),
+  broadcast: external_exports.enum(PUSH_BROADCASTS).optional(),
+  topic: external_exports.string().min(1).max(64),
+  data: external_exports.unknown().optional()
+}).strict();
+var rpcBody = external_exports.object({
+  ...identityFields,
+  kind: external_exports.literal("rpc"),
+  // Absent when the caller is an endpoint, a schedule or a ui handler; the callee then sees no user.
+  userId: external_exports.string().min(1).max(64).optional(),
+  callee: external_exports.string().min(1).max(30),
+  fn: external_exports.string().min(1).max(64),
+  args: external_exports.unknown().optional(),
+  installId: external_exports.string().min(1).max(64).optional(),
+  depth: external_exports.number().int().min(0)
+}).strict();
+var installsBody = external_exports.object({
+  ...identityFields,
+  kind: external_exports.literal("installs"),
+  callee: external_exports.string().min(1).max(30)
+}).strict();
+var activeBody = external_exports.object({
+  ...identityFields,
+  kind: external_exports.literal("active"),
+  ord: external_exports.number().int().min(1),
+  userId: external_exports.string().min(1).max(64).optional()
+}).strict();
+var contextReadBody = external_exports.object({
+  ...identityFields,
+  kind: external_exports.literal("contextRead"),
+  userId: external_exports.string().min(1).max(64)
+}).strict();
+var contextWriteBody = external_exports.object({
+  ...identityFields,
+  kind: external_exports.literal("contextWrite"),
+  userId: external_exports.string().min(1).max(64),
+  writes: external_exports.array(contextWriteSchema).min(1).max(MAX_CONTEXT_WRITES_PER_INSTALL)
+}).strict();
+var factsQuery = external_exports.object({
+  kinds: external_exports.array(external_exports.enum(APP_FACT_KINDS)).min(1).max(APP_FACT_KINDS.length).optional(),
+  observedAtGte: external_exports.number().int().nonnegative().safe().optional(),
+  observedAtLt: external_exports.number().int().nonnegative().safe().optional(),
+  limit: external_exports.number().int().min(1).max(MAX_APP_FACTS_PER_PAGE).optional()
+}).strict().refine((query) => query.observedAtGte === void 0 || query.observedAtLt === void 0 || query.observedAtGte < query.observedAtLt);
+var factsReadBody = external_exports.object({
+  ...identityFields,
+  kind: external_exports.literal("factsRead"),
+  userId: external_exports.string().min(1).max(64),
+  query: factsQuery.optional(),
+  cursor: external_exports.string().min(1).max(4096).optional()
+}).strict().refine((body) => body.query === void 0 !== (body.cursor === void 0));
+var identityReadBody = external_exports.object({
+  ...identityFields,
+  kind: external_exports.literal("identityRead"),
+  identifier: identifierField2,
+  cursor: external_exports.string().regex(/^\d+$/).optional()
+}).strict();
+var brokerBody = external_exports.discriminatedUnion("kind", [
+  pushBody,
+  rpcBody,
+  installsBody,
+  activeBody,
+  contextReadBody,
+  contextWriteBody,
+  factsReadBody,
+  identityReadBody,
+  currencyRatesBody,
+  trackBody
+]);
+var BODY_ENVELOPE_ALLOWANCE_BYTES = 2 * 1024;
+var MAX_BODY_BYTES = MAX_RPC_BYTES + BODY_ENVELOPE_ALLOWANCE_BYTES;
+var parseJson = /* @__PURE__ */ __name((raw2) => {
+  try {
+    return JSON.parse(raw2);
+  } catch {
+    return null;
+  }
+}, "parseJson");
+var factsCursor = external_exports.object({
+  userId: external_exports.string().min(1).max(64),
+  kinds: external_exports.array(external_exports.enum(APP_FACT_KINDS)).min(1).max(APP_FACT_KINDS.length),
+  observedAtGte: external_exports.number().int().nonnegative().safe().nullable(),
+  observedAtLt: external_exports.number().int().nonnegative().safe().nullable(),
+  limit: external_exports.number().int().min(1).max(MAX_APP_FACTS_PER_PAGE),
+  afterRowId: external_exports.number().int().nonnegative().safe(),
+  maxRowId: external_exports.number().int().positive().safe().nullable()
+}).strict();
+var cursorKey = /* @__PURE__ */ __name(async (hex3) => {
+  const bytes = Uint8Array.from(hex3.matchAll(/.{2}/g), ([pair]) => Number.parseInt(pair, 16));
+  return crypto.subtle.importKey("raw", bytes, "AES-GCM", false, ["encrypt", "decrypt"]);
+}, "cursorKey");
+var encodeBase64Url = /* @__PURE__ */ __name((bytes) => {
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}, "encodeBase64Url");
+var decodeBase64Url = /* @__PURE__ */ __name((value) => {
+  const base643 = value.replaceAll("-", "+").replaceAll("_", "/");
+  const padded = base643.padEnd(Math.ceil(base643.length / 4) * 4, "=");
+  const binary = atob(padded);
+  return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+}, "decodeBase64Url");
+var encryptFactsCursor = /* @__PURE__ */ __name(async (key, cursor) => {
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+  const plaintext = new TextEncoder().encode(JSON.stringify(cursor));
+  const ciphertext = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv }, await cursorKey(key), plaintext));
+  const packed = new Uint8Array(iv.byteLength + ciphertext.byteLength);
+  packed.set(iv);
+  packed.set(ciphertext, iv.byteLength);
+  return encodeBase64Url(packed);
+}, "encryptFactsCursor");
+var decryptFactsCursor = /* @__PURE__ */ __name(async (key, encoded) => {
+  try {
+    const packed = decodeBase64Url(encoded);
+    if (packed.byteLength <= 12) {
+      return null;
+    }
+    const plaintext = await crypto.subtle.decrypt({ name: "AES-GCM", iv: packed.slice(0, 12) }, await cursorKey(key), packed.slice(12));
+    return JSON.parse(new TextDecoder().decode(plaintext));
+  } catch {
+    return null;
+  }
+}, "decryptFactsCursor");
+var invalidBody = /* @__PURE__ */ __name(() => {
+  return Response.json({ error: "invalid_body" }, { status: 400 });
+}, "invalidBody");
+var forbidden = /* @__PURE__ */ __name(() => {
+  return Response.json({ error: "forbidden" }, { status: 403 });
+}, "forbidden");
+var factsPermissionDenied = /* @__PURE__ */ __name(() => {
+  return Response.json({ error: "facts_permission_denied" }, { status: 403 });
+}, "factsPermissionDenied");
+var identityPermissionDenied = /* @__PURE__ */ __name(() => {
+  return Response.json({ error: "identity_permission_denied" }, { status: 403 });
+}, "identityPermissionDenied");
+var handlePush = /* @__PURE__ */ __name(async (env, body) => {
+  if (new TextEncoder().encode(JSON.stringify(body.data ?? null)).length > MAX_PUSH_BYTES) {
+    return invalidBody();
+  }
+  const broadcast = body.broadcast ?? "install";
+  if (broadcast === "install" && body.installId === void 0) {
+    return invalidBody();
+  }
+  const installId = broadcast === "install" ? body.installId : null;
+  if (await rateLimited(env, `${body.slug}:${installId ?? ""}:push`)) {
+    return Response.json({ error: "rate_limited" }, { status: 429 });
+  }
+  const app2 = siteRegistry().registry.apps[body.slug];
+  if (broadcast === "site" && (app2 === void 0 || !app2.events.publishes.includes(body.topic) || !app2.data.includes(SHARED_CONTEXT_CAPABILITY))) {
+    return Response.json({ error: "topic_not_public" }, { status: 400 });
+  }
+  await anonStub(env, body.userId).appPush(
+    { slug: body.slug, installId, topic: body.topic, data: body.data, scope: broadcast === "site" ? "site" : "app" },
+    ownSite(env),
+    currentTraceContext()
+  );
+  return Response.json({ accepted: true }, { status: 202 });
+}, "handlePush");
+var resolveInstall = /* @__PURE__ */ __name((callee, installId) => {
+  const active = callee.installs.filter((install) => install.active);
+  if (installId !== void 0) {
+    const install = active.find((entry) => entry.id === installId);
+    return install === void 0 ? "invalid_install" : { id: install.id, ord: install.ord, label: install.label };
+  }
+  const [only, second] = active;
+  return only === void 0 || second !== void 0 ? "install_required" : { id: only.id, ord: only.ord, label: only.label };
+}, "resolveInstall");
+var calleeFailed = /* @__PURE__ */ __name((callee, reason) => {
+  addSpanEvent("rpc callee failed", { level: "warn", attrs: { app: callee, reason } });
+  return Response.json({ error: "callee_failed" }, { status: 502 });
+}, "calleeFailed");
+var deliverRpcEffects = /* @__PURE__ */ __name(async (env, { body, userId, effects, install }) => {
+  for (const ord of effects.rejectedOrds) {
+    addSpanEvent("app effects rejected over the per-install caps", { level: "warn", attrs: { app: body.callee, ord } });
+  }
+  const site = ownSite(env);
+  await applyEffects({
+    slug: body.callee,
+    groups: effects.accepted,
+    depth: body.depth,
+    anonId: userId,
+    installs: [install],
+    deliverPush: /* @__PURE__ */ __name(async (push) => {
+      await anonStub(env, userId).appPush(push, site, currentTraceContext());
+    }, "deliverPush"),
+    writeCaptures: /* @__PURE__ */ __name(async (slug, writes) => {
+      await anonStub(env, userId).appCaptures({ slug, writes }, site, currentTraceContext());
+    }, "writeCaptures"),
+    writeContext: /* @__PURE__ */ __name(async (slug, writes) => {
+      await anonStub(env, userId).appContext({ slug, writes }, site, currentTraceContext());
+    }, "writeContext"),
+    ingest: /* @__PURE__ */ __name((action) => {
+      return ingest(env, action, site);
+    }, "ingest")
+  });
+}, "deliverRpcEffects");
+var runRelayRpc = /* @__PURE__ */ __name(async (env, { context, body, callee, install }) => {
+  let raw2;
+  try {
+    const key = await deriveAppInternalKey(context.master, context.domainId, body.callee);
+    const response = await postHookEnvelope(env, {
+      binding: callee.binding,
+      key,
+      envelope: {
+        v: ENVELOPE_VERSION,
+        kind: "rpc",
+        app: { slug: body.callee, version: callee.version },
+        installs: [install],
+        // No bucket projection for rpc: the callee sees only the subject's id, never its profile.
+        // Omitted entirely when the caller had no visitor, so the callee's ctx.user is null.
+        ...body.userId === void 0 ? {} : { user: { anonId: body.userId, globalId: null, properties: {} } },
+        depth: body.depth,
+        // JSON.stringify drops an undefined key, and the envelope requires `args` to be present.
+        rpc: { caller: body.slug, fn: body.fn, args: body.args ?? null }
+      },
+      timeoutMs: APP_INVOCATION_TIMEOUT_MS
+    });
+    if (response === void 0) {
+      return calleeFailed(body.callee, "The callee service binding is missing.");
+    }
+    writeAppObservability(env, response, {
+      app: observabilityApp(body.callee, callee),
+      installs: [install],
+      budget: createDataPointBudget()
+    });
+    setSpanAttributes({ "app.status": response.status });
+    if (!response.ok) {
+      return calleeFailed(body.callee, `The callee answered status ${response.status}.`);
+    }
+    const bytes = await readBoundedBody(response, MAX_RESPONSE_BYTES);
+    if (bytes === null) {
+      return calleeFailed(body.callee, "The response exceeds the size cap.");
+    }
+    raw2 = new TextDecoder().decode(bytes);
+  } catch (error61) {
+    return calleeFailed(body.callee, String(error61));
+  }
+  const verdict = validateEnvelopeResponse(parseJson(raw2), 1);
+  if (!verdict.ok) {
+    return calleeFailed(body.callee, verdict.reason);
+  }
+  if (verdict.error !== null) {
+    const reason = redactUrlParams(verdict.error);
+    if (verdict.errorCode === "invalid_arguments") {
+      return Response.json({ error: "invalid_arguments", message: reason }, { status: 400 });
+    }
+    return calleeFailed(body.callee, reason);
+  }
+  if (verdict.rpc === null) {
+    return calleeFailed(body.callee, "The response carries no rpc result.");
+  }
+  if (body.userId === void 0) {
+    if (verdict.effects.accepted.length > 0) {
+      addSpanEvent("rpc effects dropped: the call carries no subject", { level: "warn", attrs: { app: body.callee } });
+    }
+  } else {
+    await deliverRpcEffects(env, { body, userId: body.userId, effects: verdict.effects, install });
+  }
+  return Response.json({ result: verdict.rpc.result });
+}, "runRelayRpc");
+var relayRpc = /* @__PURE__ */ __name(async (env, input2) => {
+  const { body, callee, install } = input2;
+  return traced(
+    `app.rpc ${body.callee}`,
+    {
+      attrs: {
+        "app.slug": body.callee,
+        "app.version": callee.version,
+        "app.binding": callee.binding,
+        "app.hook": `rpc.${body.fn}`,
+        "app.install_id": install.id,
+        "app.install_ord": install.ord,
+        "app.install_label": install.label,
+        "app.rpc_caller": body.slug,
+        "app.rpc_depth": body.depth
+      }
+    },
+    () => {
+      return runRelayRpc(env, input2);
+    }
+  );
+}, "relayRpc");
+var handleRpc = /* @__PURE__ */ __name(async (env, context, body) => {
+  if (body.depth > MAX_RPC_DEPTH) {
+    return Response.json({ error: "depth_exceeded" }, { status: 400 });
+  }
+  const callee = siteRegistry().registry.apps[body.callee];
+  if (callee === void 0) {
+    return forbidden();
+  }
+  const visibility = callee.rpc.exposes[body.fn];
+  if (visibility !== "public" && !(visibility === "private" && (callee.rpc.grants[body.slug] ?? []).includes(body.fn))) {
+    return forbidden();
+  }
+  const install = resolveInstall(callee, body.installId);
+  if (install === "invalid_install" || install === "install_required") {
+    return Response.json({ error: install }, { status: 400 });
+  }
+  if (new TextEncoder().encode(JSON.stringify(body.args ?? null)).length > MAX_RPC_BYTES) {
+    return Response.json({ error: "too_large" }, { status: 413 });
+  }
+  if (await rateLimited(env, `${body.slug}:${install.id}:rpc`)) {
+    return Response.json({ error: "rate_limited" }, { status: 429 });
+  }
+  return relayRpc(env, { context, body, callee, install });
+}, "handleRpc");
+var handleInstalls = /* @__PURE__ */ __name(async (env, body) => {
+  const callee = siteRegistry().registry.apps[body.callee];
+  if (callee === void 0 || !(Object.values(callee.rpc.exposes).includes("public") || (callee.rpc.grants[body.slug] ?? []).length > 0)) {
+    return forbidden();
+  }
+  if (await rateLimited(env, `${body.slug}::installs`)) {
+    return Response.json({ error: "rate_limited" }, { status: 429 });
+  }
+  const installs = callee.installs.filter((install) => install.active).map(({ id, label }) => ({ id, label }));
+  return Response.json({ installs });
+}, "handleInstalls");
+var handleContextRead = /* @__PURE__ */ __name(async (env, body) => {
+  if (await rateLimited(env, `${body.slug}::context`)) {
+    return Response.json({ error: "rate_limited" }, { status: 429 });
+  }
+  return Response.json(await anonStub(env, body.userId).getAppContext(body.slug, ownSite(env), currentTraceContext()));
+}, "handleContextRead");
+var handleContextWrite = /* @__PURE__ */ __name(async (env, body) => {
+  if (await rateLimited(env, `${body.slug}::context`)) {
+    return Response.json({ error: "rate_limited" }, { status: 429 });
+  }
+  const stored = await anonStub(env, body.userId).appContext({ slug: body.slug, writes: body.writes }, ownSite(env), currentTraceContext());
+  return Response.json({ stored }, { status: 202 });
+}, "handleContextWrite");
+var initialFactsCursor = /* @__PURE__ */ __name((body) => {
+  const query = body.query;
+  return {
+    userId: body.userId,
+    kinds: query.kinds ?? [...APP_FACT_KINDS],
+    observedAtGte: query.observedAtGte ?? null,
+    observedAtLt: query.observedAtLt ?? null,
+    limit: query.limit ?? MAX_APP_FACTS_PER_PAGE,
+    afterRowId: 0,
+    maxRowId: null
+  };
+}, "initialFactsCursor");
+var handleFactsRead = /* @__PURE__ */ __name(async (env, body) => {
+  const app2 = siteRegistry().registry.apps[body.slug];
+  if (app2 === void 0 || !app2.data.includes("facts")) {
+    return factsPermissionDenied();
+  }
+  if (await rateLimited(env, `${body.slug}::facts`)) {
+    return Response.json({ error: "rate_limited" }, { status: 429 });
+  }
+  const decoded = body.cursor === void 0 ? initialFactsCursor(body) : await decryptFactsCursor(body.key, body.cursor);
+  if (decoded === null || decoded.userId !== body.userId || body.cursor !== void 0 && decoded.maxRowId === null) {
+    return Response.json({ error: "invalid_cursor" }, { status: 400 });
+  }
+  const query = {
+    kinds: decoded.kinds,
+    observedAtGte: decoded.observedAtGte,
+    observedAtLt: decoded.observedAtLt,
+    limit: decoded.limit,
+    afterRowId: decoded.afterRowId,
+    maxRowId: decoded.maxRowId
+  };
+  const page = await anonStub(env, body.userId).getAppFacts(body.slug, query, ownSite(env), currentTraceContext());
+  if (page === null) {
+    return factsPermissionDenied();
+  }
+  const nextCursor = page.next === null ? null : await encryptFactsCursor(body.key, {
+    ...decoded,
+    afterRowId: page.next.afterRowId,
+    maxRowId: page.next.maxRowId
+  });
+  return Response.json({ items: page.items, nextCursor });
+}, "handleFactsRead");
+var handleIdentityRead = /* @__PURE__ */ __name(async (env, body) => {
+  const app2 = siteRegistry().registry.apps[body.slug];
+  if (app2 === void 0 || !app2.data.includes(IDENTITY_CAPABILITY)) {
+    return identityPermissionDenied();
+  }
+  if (await rateLimited(env, `${body.slug}::identity`)) {
+    return Response.json({ error: "rate_limited" }, { status: 429 });
+  }
+  const person2 = await lookupPersonForApp(env, body.slug, body.identifier, body.cursor === void 0 ? 0 : Number(body.cursor));
+  if (person2 === null) {
+    return identityPermissionDenied();
+  }
+  return Response.json(person2);
+}, "handleIdentityRead");
+var handleActive = /* @__PURE__ */ __name(async (env, body) => {
+  const app2 = siteRegistry().registry.apps[body.slug];
+  if (app2 === void 0) {
+    return forbidden();
+  }
+  if (!app2.installs.some((install) => install.active && install.ord === body.ord)) {
+    return forbidden();
+  }
+  if (body.userId !== void 0 && !await anonStub(env, body.userId).appAllowed(body.slug, ownSite(env), currentTraceContext())) {
+    return forbidden();
+  }
+  return Response.json({ active: true });
+}, "handleActive");
+var handleBroker = /* @__PURE__ */ __name(async (request, env, ctx) => {
+  const bytes = await readBoundedBody(request, MAX_BODY_BYTES);
+  if (bytes === null) {
+    return Response.json({ error: "too_large" }, { status: 413 });
+  }
+  const candidate = parseJson(new TextDecoder().decode(bytes));
+  const parsed = brokerBody.safeParse(candidate);
+  if (!parsed.success) {
+    if (typeof candidate === "object" && candidate !== null && "kind" in candidate && candidate.kind === "factsRead") {
+      const malformedFacts = candidate;
+      const error61 = malformedFacts.cursor !== void 0 && malformedFacts.query === void 0 ? "invalid_cursor" : "invalid_query";
+      return Response.json({ error: error61 }, { status: 400 });
+    }
+    return invalidBody();
+  }
+  const body = parsed.data;
+  if (siteRegistry().registry.apps[body.slug] === void 0) {
+    return forbidden();
+  }
+  const context = invocationContext(env);
+  if (context === void 0) {
+    return forbidden();
+  }
+  const expected = await deriveAppInternalKey(context.master, context.domainId, body.slug);
+  if (!constantTimeEqual(expected, body.key)) {
+    return forbidden();
+  }
+  switch (body.kind) {
+    case "push": {
+      return handlePush(env, body);
+    }
+    case "rpc": {
+      return handleRpc(env, context, body);
+    }
+    case "installs": {
+      return handleInstalls(env, body);
+    }
+    case "active": {
+      return handleActive(env, body);
+    }
+    case "contextRead": {
+      return handleContextRead(env, body);
+    }
+    case "contextWrite": {
+      return handleContextWrite(env, body);
+    }
+    case "factsRead": {
+      return handleFactsRead(env, body);
+    }
+    case "identityRead": {
+      return handleIdentityRead(env, body);
+    }
+    case "currencyRates": {
+      return handleCurrencyRates(ctx);
+    }
+    case "track": {
+      return handleTrack(env, body);
+    }
+  }
+}, "handleBroker");
+var brokerRoutes = new Hono2();
+var dispatchGated = /* @__PURE__ */ __name((c) => {
+  if (c.env.DEPLOY_TARGET !== "dispatch") {
+    return c.notFound();
+  }
+  return handleBroker(c.req.raw, c.env, c.executionCtx);
+}, "dispatchGated");
+for (const path of BROKER_PATHS) {
+  brokerRoutes.post(path, dispatchGated);
+}
+var Broker = class extends WorkerEntrypoint {
+  static {
+    __name(this, "Broker");
+  }
+  fetch(request) {
+    const trace = parseTraceContext(request.headers.get(TRACE_HEADER));
+    return runInvocation({ name: "broker", trace }, () => {
+      return handleBroker(request, this.env, this.ctx);
+    });
+  }
+};
+
+// src/apps-control.ts
+import controlText from "./apps-control.json";
+var apps_control_default = controlText;
+
+// src/apps/control-targets.ts
+var controlTargetsSchema = external_exports.object({
+  v: external_exports.literal(1),
+  apps: external_exports.record(
+    external_exports.string(),
+    external_exports.object({
+      binding: external_exports.string().min(1),
+      versions: external_exports.array(external_exports.object({ version: external_exports.string().min(1), versionId: external_exports.string().min(1) }).strict()).min(1)
+    }).strict()
+  )
+}).strict();
+var EMPTY_TARGETS = Object.freeze({ v: 1, apps: Object.freeze({}) });
+var parseControlTargets = /* @__PURE__ */ __name((raw2) => {
+  try {
+    const parsed = controlTargetsSchema.safeParse(JSON.parse(raw2));
+    return parsed.success ? parsed.data : EMPTY_TARGETS;
+  } catch {
+    return EMPTY_TARGETS;
+  }
+}, "parseControlTargets");
+var cachedRaw3;
+var cachedTargets = EMPTY_TARGETS;
+var controlTargets = /* @__PURE__ */ __name(() => {
+  if (apps_control_default !== cachedRaw3) {
+    cachedTargets = parseControlTargets(apps_control_default);
+    cachedRaw3 = apps_control_default;
+  }
+  return cachedTargets;
+}, "controlTargets");
+
+// src/apps/control.ts
+var CONTROL_PATH = "/__qinto/control";
+var MAX_CLOCK_SKEW_MS = 5 * 60 * 1e3;
+var observabilityTarget = /* @__PURE__ */ __name((envelope) => {
+  const installs = envelope.schedule?.installs ?? (envelope.install === void 0 ? [] : [envelope.install]);
+  const app2 = siteRegistry().registry.apps[envelope.app.slug];
+  if (installs.length === 0 || app2 === void 0) {
+    return void 0;
+  }
+  return {
+    app: observabilityApp(envelope.app.slug, { name: app2.name, version: envelope.app.version }),
+    installs,
+    budget: createDataPointBudget()
+  };
+}, "observabilityTarget");
+var writeControlObservability = /* @__PURE__ */ __name((env, upstream, envelope) => {
+  const target = observabilityTarget(envelope);
+  if (target !== void 0) {
+    writeAppObservability(env, upstream, target);
   }
-  const matched = matchesRule(country, isEU, rule.list);
-  return rule.mode === "block" ? matched : !matched;
-}, "isCountryBlocked");
-
-// ../../libs/bot-protection/src/score.ts
-var BOT_SCORE_MIN = 1;
-var BOT_SCORE_MAX = 99;
-
-// ../../libs/bot-protection/src/config.ts
-var NO_PROTECTION = { minBotScore: null, countries: null };
-var normalizeScore = /* @__PURE__ */ __name((value, problems) => {
-  if (value === void 0 || value === null) {
-    return null;
+}, "writeControlObservability");
+var timedOutAction = /* @__PURE__ */ __name((envelope) => {
+  if (envelope.schedule !== void 0) {
+    return `schedules.${envelope.schedule.id}`;
   }
-  if (typeof value === "number" && Number.isInteger(value) && value >= BOT_SCORE_MIN && value <= BOT_SCORE_MAX) {
-    return value;
+  if (envelope.tool !== void 0) {
+    return `tools.${envelope.tool.name}`;
   }
-  problems.push("has an out-of-range minBotScore");
-  return null;
-}, "normalizeScore");
-var normalizeCountries = /* @__PURE__ */ __name((value, problems) => {
-  if (value === void 0 || value === null) {
+  return envelope.lifecycle === void 0 ? envelope.kind : `lifecycle.${envelope.lifecycle.type}`;
+}, "timedOutAction");
+var writeControlTimeout = /* @__PURE__ */ __name((env, envelope, deadlineMs) => {
+  const target = observabilityTarget(envelope);
+  if (target === void 0) {
+    return;
+  }
+  const action = timedOutAction(envelope);
+  const description = `${action} did not answer within ${deadlineMs / 1e3} s, so the site stopped waiting.`;
+  writeAppObservabilityRecord(
+    env,
+    {
+      v: APP_OBSERVABILITY_VERSION,
+      events: [],
+      errors: target.installs.map((install) => {
+        return { ord: install.ord, category: "internal", action, description };
+      })
+    },
+    target
+  );
+}, "writeControlTimeout");
+var forwardControl = /* @__PURE__ */ __name(async (env, service, envelope, init) => {
+  const deadlineMs = CONTROL_DEADLINES_MS[envelope.kind].site;
+  try {
+    return await service.fetch("https://app/__qinto/control", { method: "POST", ...init, signal: AbortSignal.timeout(deadlineMs) });
+  } catch (error61) {
+    if (!(error61 instanceof Error && error61.name === "TimeoutError")) {
+      throw error61;
+    }
+    writeControlTimeout(env, envelope, deadlineMs);
+    return void 0;
+  }
+}, "forwardControl");
+var textBody = /* @__PURE__ */ __name(async (request) => {
+  const bytes = await readBoundedBody(request, MAX_CONTROL_BYTES);
+  return bytes === null ? null : new TextDecoder().decode(bytes);
+}, "textBody");
+var parseJson2 = /* @__PURE__ */ __name((value) => {
+  try {
+    return JSON.parse(value);
+  } catch {
+    return void 0;
+  }
+}, "parseJson");
+var authenticateControl = /* @__PURE__ */ __name(async (request, env, body) => {
+  const timestamp = request.headers.get(CONTROL_TIMESTAMP_HEADER);
+  const signature = request.headers.get(CONTROL_SIGNATURE_HEADER);
+  const { APPS_KEY_MASTER: master, QINTO_CONTROL_KEY: controlKey, QINTO_DOMAIN_ID: domainId } = env;
+  if (timestamp === null || signature === null || master === void 0 || controlKey === void 0 || domainId === void 0) {
+    return null;
+  }
+  const timestampMs = Number(timestamp);
+  if (!Number.isSafeInteger(timestampMs) || Math.abs(Date.now() - timestampMs) > MAX_CLOCK_SKEW_MS) {
     return null;
   }
-  const record2 = value;
-  if (record2.mode !== "allow" && record2.mode !== "block" || !Array.isArray(record2.list)) {
-    problems.push("has an invalid countries rule");
-    return null;
+  return await verifyControlRequestSignature(controlKey, timestamp, body, signature) ? { master, domainId } : null;
+}, "authenticateControl");
+var handleControl = /* @__PURE__ */ __name(async (request, env) => {
+  const body = await textBody(request);
+  if (body === null) {
+    return Response.json({ error: "too_large" }, { status: 413 });
+  }
+  const authentication = await authenticateControl(request, env, body);
+  if (authentication === null) {
+    return Response.json({ error: "unauthorized" }, { status: 401 });
+  }
+  const raw2 = parseJson2(body);
+  if (raw2 === void 0) {
+    return Response.json({ error: "invalid_body" }, { status: 400 });
+  }
+  const parsed = controlEnvelopeSchema.safeParse(raw2);
+  if (!parsed.success) {
+    return Response.json({ error: "invalid_body" }, { status: 400 });
+  }
+  const envelope = parsed.data;
+  const target = controlTargets().apps[envelope.app.slug];
+  if (target === void 0) {
+    return Response.json({ error: "target_missing" }, { status: 404 });
+  }
+  if (!target.versions.some((version2) => version2.version === envelope.app.version)) {
+    return Response.json({ error: "target_version_mismatch" }, { status: 409 });
+  }
+  const service = env[target.binding];
+  if (typeof service?.fetch !== "function") {
+    return Response.json({ error: "binding_missing" }, { status: 503 });
+  }
+  const headers = {
+    "content-type": "application/json",
+    "x-qinto-app-key": await deriveAppInternalKey(authentication.master, authentication.domainId, envelope.app.slug)
+  };
+  const trace = currentTraceContext();
+  if (trace !== void 0) {
+    headers[TRACE_HEADER] = serializeTraceContext(trace);
+  }
+  const upstream = await forwardControl(env, service, envelope, { headers, body });
+  if (upstream === void 0) {
+    return Response.json({ error: "upstream_timeout" }, { status: 504 });
+  }
+  adoptAppSpans(upstream);
+  writeControlObservability(env, upstream, envelope);
+  const responseBytes = await readBoundedBody(upstream, MAX_CONTROL_BYTES);
+  if (responseBytes === null) {
+    return Response.json({ error: "invalid_response" }, { status: 502 });
+  }
+  const responseBody = parseJson2(new TextDecoder().decode(responseBytes));
+  if (responseBody === void 0) {
+    return Response.json({ error: "invalid_response" }, { status: 502 });
+  }
+  const response = controlResponseSchema.safeParse(responseBody);
+  if (!upstream.ok || !response.success) {
+    return Response.json({ error: "invalid_response" }, { status: 502 });
+  }
+  return Response.json(response.data);
+}, "handleControl");
+var appControlRoutes = new Hono2().post(CONTROL_PATH, (c) => {
+  return handleControl(c.req.raw, c.env);
+});
+
+// ../../libs/worker-access-token/src/endpoints.ts
+var APP_ENDPOINT_PREFIX = "/app/";
+var MAX_CUSTOM_ENDPOINT_LENGTH = 128;
+var HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
+var HTTP_METHOD_BIT = { GET: 1, POST: 2, PUT: 4, PATCH: 8, DELETE: 16 };
+var ALL_METHODS_MASK = HTTP_METHODS.reduce((mask, method) => mask | HTTP_METHOD_BIT[method], 0);
+var ALLOWED_CHARS = /^[A-Za-z0-9._~/-]+$/;
+var matchesAppEndpoint = /* @__PURE__ */ __name((endpoints, path, method) => {
+  const bit = HTTP_METHODS.includes(method) ? HTTP_METHOD_BIT[method] : 0;
+  return endpoints.some((endpoint) => {
+    if ((endpoint.methods & bit) === 0) {
+      return false;
+    }
+    return endpoint.path.endsWith("/*") ? path.startsWith(endpoint.path.slice(0, -1)) : path === endpoint.path;
+  });
+}, "matchesAppEndpoint");
+var validateAppEndpoint = /* @__PURE__ */ __name((raw2) => {
+  if (!Number.isInteger(raw2.methods) || raw2.methods <= 0 || raw2.methods > ALL_METHODS_MASK) {
+    return { ok: false, reason: "Choose at least one HTTP method." };
+  }
+  const path = raw2.path.trim();
+  if (!path.startsWith(APP_ENDPOINT_PREFIX)) {
+    return { ok: false, reason: "Custom endpoints must start with /app/." };
+  }
+  if (path.length > MAX_CUSTOM_ENDPOINT_LENGTH) {
+    return { ok: false, reason: `Custom endpoint must be ${MAX_CUSTOM_ENDPOINT_LENGTH} characters or fewer.` };
+  }
+  const isWildcard = path.endsWith("/*");
+  if (path.includes("*") && (!isWildcard || path.indexOf("*") !== path.length - 1)) {
+    return { ok: false, reason: "A wildcard is only allowed as a trailing /* (e.g. /app/reports/*)." };
+  }
+  if (!isWildcard && path.endsWith("/")) {
+    return { ok: false, reason: "Custom endpoint must not end with a slash." };
+  }
+  const body = isWildcard ? path.slice(0, -1) : path;
+  if (!ALLOWED_CHARS.test(body)) {
+    return { ok: false, reason: "Custom endpoint contains invalid characters." };
+  }
+  if (body.includes("..")) {
+    return { ok: false, reason: 'Custom endpoint must not contain "..".' };
+  }
+  return { ok: true, value: { methods: raw2.methods, path } };
+}, "validateAppEndpoint");
+
+// ../../libs/worker-access-token/src/scopes.ts
+var SCOPE = {
+  track: 1,
+  identify: 2,
+  alias: 4,
+  consentWrite: 8,
+  propertiesRead: 16,
+  consentRead: 32,
+  sessionRead: 64,
+  idGraphInspect: 128,
+  capture: 256
+};
+var ALL_SCOPE_MASK = Object.values(SCOPE).reduce((mask, bit) => mask | bit, 0);
+var WORKER_ACCESS_TOKEN_SCOPES = [
+  { key: "track", bit: SCOPE.track, label: "Track events", description: "POST /v1/track \u2014 record events a user performed." },
+  { key: "identify", bit: SCOPE.identify, label: "Identify users", description: "POST /v1/identify \u2014 attach identity traits to a user." },
+  { key: "alias", bit: SCOPE.alias, label: "Link identifiers", description: "POST /v1/alias \u2014 link an identifier of your own to a user." },
+  {
+    key: "consentWrite",
+    bit: SCOPE.consentWrite,
+    label: "Save consent",
+    description: "POST /v1/consent \u2014 record a user\u2019s consent choices."
+  },
+  {
+    key: "propertiesRead",
+    bit: SCOPE.propertiesRead,
+    label: "Read properties",
+    description: "GET /v1/properties \u2014 read the properties stored for a user."
+  },
+  {
+    key: "consentRead",
+    bit: SCOPE.consentRead,
+    label: "Read consent",
+    description: "GET /v1/consent \u2014 read the consent stored for a user."
+  },
+  {
+    key: "sessionRead",
+    bit: SCOPE.sessionRead,
+    label: "Read session ids",
+    description: "GET /v1/session, GET /v1/person \u2014 read the anonymous and person ids for a user, and the sessions linked to a person."
+  },
+  {
+    key: "capture",
+    bit: SCOPE.capture,
+    label: "Write captures",
+    description: "POST /v1/capture \u2014 record click ids and vendor ids an installed app declares."
+  }
+];
+
+// ../../libs/worker-access-token/src/env.ts
+var validMask = /* @__PURE__ */ __name((mask) => {
+  return typeof mask === "number" && Number.isSafeInteger(mask) && mask >= 0 && mask <= ALL_SCOPE_MASK;
+}, "validMask");
+var validApp = /* @__PURE__ */ __name((app2) => {
+  return app2 === void 0 || typeof app2 === "string" && app2.length > 0 && app2.length <= 30;
+}, "validApp");
+var decodeEndpoints = /* @__PURE__ */ __name((value) => {
+  if (value === void 0) {
+    return { endpoints: [], dropped: 0 };
+  }
+  if (!Array.isArray(value)) {
+    return { endpoints: [], dropped: 1 };
   }
-  const list = [];
+  const endpoints = [];
   let dropped = 0;
-  for (const token of record2.list) {
-    if (typeof token === "string" && isSelectableCountryToken(token)) {
-      list.push(token);
-    } else {
+  for (const encoded of value) {
+    if (!Array.isArray(encoded) || encoded.length !== 2 || typeof encoded[0] !== "number" || typeof encoded[1] !== "string") {
+      dropped += 1;
+      continue;
+    }
+    const result = validateAppEndpoint({ methods: encoded[0], path: encoded[1] });
+    if (!result.ok) {
       dropped += 1;
+      continue;
     }
+    endpoints.push(Object.freeze(result.value));
   }
-  if (dropped > 0) {
-    problems.push(`dropped ${dropped} invalid country token(s)`);
+  return { endpoints: Object.freeze(endpoints), dropped };
+}, "decodeEndpoints");
+var parseTokenEntry = /* @__PURE__ */ __name((value) => {
+  if (typeof value === "number") {
+    return { entry: validMask(value) && value > 0 ? Object.freeze({ mask: value, app: null, endpoints: null }) : null, dropped: 0 };
   }
-  return list.length === 0 ? null : { mode: record2.mode, list };
-}, "normalizeCountries");
-var parseBotProtection = /* @__PURE__ */ __name((raw2) => {
+  if (typeof value !== "object" || value === null) {
+    return { entry: null, dropped: 0 };
+  }
+  const entry = value;
+  if (!validMask(entry.m) || !validApp(entry.a)) {
+    return { entry: null, dropped: 0 };
+  }
+  const decoded = decodeEndpoints(entry.e);
+  if (entry.m === 0 && decoded.endpoints.length === 0) {
+    return { entry: null, dropped: decoded.dropped };
+  }
+  return {
+    entry: Object.freeze({
+      mask: entry.m,
+      app: typeof entry.a === "string" ? entry.a : null,
+      endpoints: decoded.endpoints.length === 0 ? null : decoded.endpoints
+    }),
+    dropped: decoded.dropped
+  };
+}, "parseTokenEntry");
+var parseWorkerAccessTokensEnv = /* @__PURE__ */ __name((raw2) => {
   if (raw2.trim() === "") {
-    return { config: NO_PROTECTION };
+    return { tokens: /* @__PURE__ */ new Map() };
   }
-  let value;
+  let parsed;
   try {
-    value = JSON.parse(raw2);
+    parsed = JSON.parse(raw2);
   } catch {
-    return { config: NO_PROTECTION, error: "BOT_PROTECTION is not valid JSON" };
+    return { tokens: /* @__PURE__ */ new Map(), error: "WORKER_ACCESS_TOKENS is not valid JSON" };
   }
-  if (typeof value !== "object" || value === null) {
-    return { config: NO_PROTECTION, error: "BOT_PROTECTION is not an object" };
+  if (typeof parsed !== "object" || parsed === null || parsed.v !== 2) {
+    return { tokens: /* @__PURE__ */ new Map(), error: "WORKER_ACCESS_TOKENS has an unsupported version" };
   }
-  const record2 = value;
-  const problems = [];
-  const config2 = {
-    minBotScore: normalizeScore(record2.minBotScore, problems),
-    countries: normalizeCountries(record2.countries, problems)
+  const table = parsed.t;
+  if (typeof table !== "object" || table === null) {
+    return { tokens: /* @__PURE__ */ new Map(), error: "WORKER_ACCESS_TOKENS is missing its token table" };
+  }
+  const tokens = /* @__PURE__ */ new Map();
+  let rejected = 0;
+  for (const [hash2, value] of Object.entries(table)) {
+    const parsedEntry = parseTokenEntry(value);
+    rejected += parsedEntry.dropped;
+    if (parsedEntry.entry === null) {
+      rejected += 1;
+      continue;
+    }
+    tokens.set(hash2, parsedEntry.entry);
+  }
+  if (rejected > 0) {
+    return { tokens, error: `WORKER_ACCESS_TOKENS dropped ${rejected} invalid entr${rejected === 1 ? "y" : "ies"}` };
+  }
+  return { tokens };
+}, "parseWorkerAccessTokensEnv");
+
+// ../../libs/worker-access-token/src/hash.ts
+var hashWorkerAccessToken = /* @__PURE__ */ __name(async (raw2) => {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(raw2));
+  let binary = "";
+  for (const byte of new Uint8Array(digest)) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}, "hashWorkerAccessToken");
+
+// src/common/auth.ts
+var cachedRaw4;
+var cachedTokens = /* @__PURE__ */ new Map();
+var tokensFor = /* @__PURE__ */ __name((raw2) => {
+  if (raw2 === cachedRaw4) {
+    return cachedTokens;
+  }
+  const parsed = parseWorkerAccessTokensEnv(raw2);
+  if (parsed.error !== void 0) {
+    addSpanEvent("WORKER_ACCESS_TOKENS is misconfigured; rejecting affected tokens until fixed", {
+      level: "error",
+      attrs: { error: String(parsed.error) }
+    });
+  }
+  cachedRaw4 = raw2;
+  cachedTokens = parsed.tokens;
+  return cachedTokens;
+}, "tokensFor");
+var readBearerToken = /* @__PURE__ */ __name((request) => {
+  const header = request.headers.get("Authorization");
+  if (header === null) {
+    return null;
+  }
+  const prefix = "Bearer ";
+  if (!header.startsWith(prefix)) {
+    return null;
+  }
+  const token = header.slice(prefix.length).trim();
+  return token.length > 0 ? token : null;
+}, "readBearerToken");
+var workerAccessTokenEntry = /* @__PURE__ */ __name(async (env, token) => {
+  const raw2 = env.WORKER_ACCESS_TOKENS ?? "";
+  return tokensFor(raw2).get(await hashWorkerAccessToken(token));
+}, "workerAccessTokenEntry");
+var requireScope = /* @__PURE__ */ __name((bit) => {
+  return async (c, next) => {
+    const token = readBearerToken(c.req.raw);
+    if (token === null) {
+      return c.json({ error: "unauthenticated" }, 401);
+    }
+    const entry = await workerAccessTokenEntry(c.env, token);
+    if (entry === void 0) {
+      return c.json({ error: "unauthenticated" }, 401);
+    }
+    if ((entry.mask & bit) === 0) {
+      return c.json({ error: "forbidden" }, 403);
+    }
+    c.set("actionSource", entry.app === null ? "api" : "app");
+    return next();
   };
-  return problems.length > 0 ? { config: config2, error: `BOT_PROTECTION ${problems.join("; ")}` } : { config: config2 };
-}, "parseBotProtection");
-var isRequestBlocked = /* @__PURE__ */ __name((config2, signal) => {
-  if (config2.minBotScore !== null && signal.botScore !== void 0 && signal.botScore < config2.minBotScore) {
-    return true;
+}, "requireScope");
+
+// src/helpers/header-json.ts
+var headerJson = /* @__PURE__ */ __name((value) => {
+  return JSON.stringify(value).replace(/[\u0080-\uffff]/g, (char) => {
+    return `\\u${char.charCodeAt(0).toString(16).padStart(4, "0")}`;
+  });
+}, "headerJson");
+
+// src/apps/stream-deadlines.ts
+var streamWithDeadlines = /* @__PURE__ */ __name((source, { idleMs, totalMs }) => {
+  if (source === null) {
+    return null;
   }
-  return isCountryBlocked(signal.country, signal.isEU ?? false, config2.countries);
-}, "isRequestBlocked");
+  const reader = source.getReader();
+  let target;
+  let totalTimer;
+  let idleTimer = null;
+  let stopped = false;
+  const clearIdleTimer = /* @__PURE__ */ __name(() => {
+    if (idleTimer !== null) {
+      clearTimeout(idleTimer);
+      idleTimer = null;
+    }
+  }, "clearIdleTimer");
+  const clearTimers = /* @__PURE__ */ __name(() => {
+    clearTimeout(totalTimer);
+    clearIdleTimer();
+  }, "clearTimers");
+  const stop = /* @__PURE__ */ __name((message) => {
+    stopped = true;
+    clearTimers();
+    const error61 = new DOMException(message, "TimeoutError");
+    target.error(error61);
+    void reader.cancel(error61).catch(() => void 0);
+  }, "stop");
+  return new ReadableStream({
+    start: /* @__PURE__ */ __name((controller) => {
+      target = controller;
+      totalTimer = setTimeout(() => {
+        stop("The app endpoint stream exceeded its maximum duration.");
+      }, totalMs);
+    }, "start"),
+    pull: /* @__PURE__ */ __name(async (controller) => {
+      idleTimer = setTimeout(() => {
+        stop("The app endpoint stream stopped producing data.");
+      }, idleMs);
+      let result;
+      try {
+        result = await reader.read();
+      } catch (error61) {
+        stopped = true;
+        clearTimers();
+        throw error61;
+      }
+      clearIdleTimer();
+      if (stopped) {
+        return;
+      }
+      if (result.done) {
+        stopped = true;
+        clearTimers();
+        controller.close();
+        return;
+      }
+      controller.enqueue(result.value);
+    }, "pull"),
+    cancel: /* @__PURE__ */ __name(async (reason) => {
+      stopped = true;
+      clearTimers();
+      await reader.cancel(reason);
+    }, "cancel")
+  });
+}, "streamWithDeadlines");
 
 // src/helpers/bot-check.ts
 var botRejected = /* @__PURE__ */ __name((env, geo) => {
@@ -29524,7 +29664,8 @@ var withCors = /* @__PURE__ */ __name((response, request, method) => {
   return new Response(response.body, { status: response.status, statusText: response.statusText, headers });
 }, "withCors");
 var authorize = /* @__PURE__ */ __name(async (c, { slug, app: app2 }) => {
-  if (await botRejected(c.env, geoFromRequest(c.req.raw))) {
+  const geo = geoFromRequest(c.req.raw);
+  if (await botRejected(c.env, geo)) {
     return refuse(403, "traffic_rejected");
   }
   const anonId = getCookie(c, COOKIE_NAME2);
@@ -29533,8 +29674,8 @@ var authorize = /* @__PURE__ */ __name(async (c, { slug, app: app2 }) => {
     return refuse(401, "visitor_required");
   }
   const installId = c.req.header(VISITOR_INSTALL_HEADER);
-  const install = app2.installs.find((candidate) => {
-    return candidate.active && candidate.id === installId;
+  const install = geoRunnableInstalls(slug, app2, geoLocation(geo)).runs.find((candidate) => {
+    return candidate.id === installId;
   });
   if (install === void 0) {
     return refuse(403, "forbidden");
@@ -31464,34 +31605,46 @@ var gatePasses = /* @__PURE__ */ __name((entry, trigger, consent2, enforced) =>
   return consentAllows(consent2, entry.slug, entry.app.consent.category, enforced);
 }, "gatePasses");
 var eligibleApps = /* @__PURE__ */ __name((registry3, trigger, consent2, enforced) => {
+  const location = visitorLocation(trigger);
   const targets = [];
+  const geoSkipped = [];
   for (const slug of registry3.order) {
     const app2 = registry3.apps[slug];
     if (app2 === void 0 || !wantsTrigger(app2, trigger) || !gatePasses({ slug, app: app2 }, trigger, consent2, enforced)) {
       continue;
     }
-    const installs = app2.installs.filter((install) => install.active).map(({ id, ord, label }) => ({ id, ord, label }));
+    const { runs, skipped } = geoRunnableInstalls(slug, app2, location);
+    geoSkipped.push(...skipped);
+    const installs = runs.map(({ id, ord, label }) => ({ id, ord, label }));
     if (installs.length === 0) {
       continue;
     }
     targets.push({ slug, app: app2, installs });
   }
-  return targets;
+  return { targets, geoSkipped };
 }, "eligibleApps");
 
 // src/apps/fan-out.ts
 var MAX_APPS_PER_DOMAIN = 50;
 var fanOutToApps = /* @__PURE__ */ __name(async (env, { trigger, snapshot, trace }, { deliverEffects }) => {
   const { registry: registry3, error: error61 } = siteRegistry();
-  const targets = eligibleApps(registry3, trigger, snapshot.consent, consentEnforced(env));
-  if (error61 === void 0 && targets.length === 0) {
+  const { targets, geoSkipped } = eligibleApps(registry3, trigger, snapshot.consent, consentEnforced(env));
+  if (error61 === void 0 && targets.length === 0 && geoSkipped.length === 0) {
     return;
   }
-  await runInvocation({ name: "app.fan_out", trace, attrs: { "fan_out.kind": trigger.kind, "fan_out.apps": targets.length } }, async () => {
+  const attrs = {
+    "fan_out.kind": trigger.kind,
+    "fan_out.apps": targets.length,
+    ...geoSkipped.length === 0 ? {} : { "fan_out.geo_skipped": geoSkipped.join(",") }
+  };
+  await runInvocation({ name: "app.fan_out", trace, attrs }, async () => {
     if (error61 !== void 0) {
       addSpanEvent("apps registry is malformed; apps are off", { level: "error", attrs: { error: error61 } });
       return;
     }
+    if (targets.length === 0) {
+      return;
+    }
     const context = invocationContext(env);
     if (context === void 0) {
       addSpanEvent("apps skipped: APPS_KEY_MASTER or QINTO_DOMAIN_ID is missing", { level: "warn" });
@@ -31557,20 +31710,22 @@ var TransformChainError = class extends Error {
     this.name = "TransformChainError";
   }
 };
-var chainEntries = /* @__PURE__ */ __name((registry3, type) => {
+var chainEntries = /* @__PURE__ */ __name((registry3, action) => {
+  const location = visitorLocation({ kind: "event", action });
   const entries = [];
+  const geoSkipped = [];
   for (const slug of registry3.order) {
     const app2 = registry3.apps[slug];
-    if (app2 === void 0 || !app2.hooks.transform.includes(type)) {
+    if (app2 === void 0 || !app2.hooks.transform.includes(action.type)) {
       continue;
     }
-    for (const install of app2.installs) {
-      if (install.active) {
-        entries.push({ slug, app: app2, install: { id: install.id, ord: install.ord, label: install.label } });
-      }
+    const { runs, skipped } = geoRunnableInstalls(slug, app2, location);
+    geoSkipped.push(...skipped);
+    for (const install of runs) {
+      entries.push({ slug, app: app2, install: { id: install.id, ord: install.ord, label: install.label } });
     }
   }
-  return entries;
+  return { entries, geoSkipped };
 }, "chainEntries");
 var trackPayloadSchema = external_exports.object({
   event: external_exports.string().min(1),
@@ -31692,7 +31847,8 @@ var buildEffectsRelease = /* @__PURE__ */ __name(({ effects, action, deliveries
         ...deliveries,
         geo: action.geo,
         host: action.host,
-        context: action.context
+        context: action.context,
+        ...startedOnSocket({ kind: "event", action }) ? { fromSocket: true } : {}
       });
     }
   };
@@ -31702,15 +31858,22 @@ var runTransformChain = /* @__PURE__ */ __name(async (env, { action, snapshot, d
   if (error61 !== void 0) {
     throw new TransformChainError(`the apps registry is malformed: ${error61}`);
   }
-  const entries = chainEntries(registry3, action.type);
+  const { entries, geoSkipped } = chainEntries(registry3, action);
+  const attrs = {
+    "transform.entries": entries.length,
+    ...geoSkipped.length === 0 ? {} : { "transform.geo_skipped": geoSkipped.join(",") }
+  };
   if (entries.length === 0) {
+    if (geoSkipped.length > 0) {
+      await traced("apps.transform_chain", { attrs }, () => Promise.resolve());
+    }
     return { dropped: false, action, effects: [] };
   }
   const context = invocationContext(env);
   if (context === void 0) {
     throw new TransformChainError("APPS_KEY_MASTER or QINTO_DOMAIN_ID is missing");
   }
-  return traced("apps.transform_chain", { attrs: { "transform.entries": entries.length } }, async () => {
+  return traced("apps.transform_chain", { attrs }, async () => {
     const collected = [];
     let budget = { totalDeadline: Date.now() + TRANSFORM_CHAIN_BUDGET_MS, appDeadline: 0 };
     let current = action;
@@ -31955,14 +32118,14 @@ var allCaptures = /* @__PURE__ */ __name((sql, now, cache) => {
 }, "allCaptures");
 
 // src/apps/capture.ts
-var appWriteAllowed = /* @__PURE__ */ __name((registry3, consent2, slug, enforced) => {
+var appWriteAllowed = /* @__PURE__ */ __name((registry3, slug, { consent: consent2, enforced, location }) => {
   const app2 = registry3.apps[slug];
   if (app2 === void 0) {
     addSpanEvent("capture dropped: the app is not in the registry", { level: "warn", attrs: { app: slug } });
     return false;
   }
-  if (!app2.installs.some((install) => install.active)) {
-    addSpanEvent("capture dropped: no active install", { level: "warn", attrs: { app: slug } });
+  if (geoRunnableInstalls(slug, app2, location).runs.length === 0) {
+    addSpanEvent("capture dropped: no install runs for this visitor", { level: "warn", attrs: { app: slug } });
     return false;
   }
   if (!consentAllows(consent2, slug, app2.consent.category, enforced)) {
@@ -31983,11 +32146,11 @@ var declaration = /* @__PURE__ */ __name((app2, key) => {
     ttlMs: declared.expiresInSeconds === void 0 ? null : declared.expiresInSeconds * 1e3
   };
 }, "declaration");
-var acceptedCaptures = /* @__PURE__ */ __name((registry3, consent2, apps, enforced) => {
+var acceptedCaptures = /* @__PURE__ */ __name((registry3, apps, gate) => {
   const accepted = [];
   for (const [slug, values] of Object.entries(apps)) {
     const app2 = registry3.apps[slug];
-    if (app2 === void 0 || !appWriteAllowed(registry3, consent2, slug, enforced)) {
+    if (app2 === void 0 || !appWriteAllowed(registry3, slug, gate)) {
       continue;
     }
     for (const [key, value] of Object.entries(values)) {
@@ -32789,14 +32952,29 @@ var appPushFrame = /* @__PURE__ */ __name(({ push, context, consent: consent2 })
     topic,
     data: data ?? null
   };
-  const serialized = JSON.stringify(frame);
   const overhead = scope === "site" ? PUSH_SITE_FRAME_OVERHEAD_BYTES : PUSH_FRAME_OVERHEAD_BYTES;
-  if (new TextEncoder().encode(serialized).length > MAX_PUSH_BYTES + overhead) {
+  if (new TextEncoder().encode(JSON.stringify(frame)).length > MAX_PUSH_BYTES + overhead) {
     addSpanEvent("app push dropped over the size cap", { level: "warn", attrs: { app: slug, topic } });
     return null;
   }
-  return serialized;
+  return frame;
 }, "appPushFrame");
+var connectionPushFrame = /* @__PURE__ */ __name((frame, registry3, location) => {
+  const runningApps = /* @__PURE__ */ new Set();
+  const runningInstalls = /* @__PURE__ */ new Set();
+  for (const [slug, app2] of Object.entries(registry3.apps)) {
+    for (const install of geoRunnableInstalls(slug, app2, location).runs) {
+      runningApps.add(slug);
+      runningInstalls.add(install.id);
+    }
+  }
+  if (frame.to !== void 0) {
+    const to = frame.to.filter((slug) => runningApps.has(slug));
+    return to.length === 0 ? null : JSON.stringify({ ...frame, to });
+  }
+  const reaches = frame.install === void 0 ? runningApps.has(frame.app) : runningInstalls.has(frame.install);
+  return reaches ? JSON.stringify(frame) : null;
+}, "connectionPushFrame");
 var sharedContextFrame = /* @__PURE__ */ __name((context, consent2, stored) => {
   const readable = readableSharedContext(context.registry, consent2, context.consentEnforced, stored);
   return JSON.stringify({ t: "sharedContext", context: sharedContextWire(readable), ...consent2 });
@@ -32994,6 +33172,10 @@ var getSessionFrame = external_exports.object({
   t: external_exports.literal("getSession"),
   ref: external_exports.string().min(1).optional()
 }).strict();
+var getGeoInstallsFrame = external_exports.object({
+  t: external_exports.literal("getGeoInstalls"),
+  ref: external_exports.string().min(1).optional()
+}).strict();
 var clientFrame = external_exports.discriminatedUnion("t", [
   identifyFrame,
   trackFrame,
@@ -33001,7 +33183,8 @@ var clientFrame = external_exports.discriminatedUnion("t", [
   consentFrame,
   captureFrame,
   getConsentFrame,
-  getSessionFrame
+  getSessionFrame,
+  getGeoInstallsFrame
 ]);
 var pluckRef = /* @__PURE__ */ __name((parsed) => {
   if (typeof parsed !== "object" || parsed === null) {
@@ -33223,12 +33406,28 @@ var AnonDO = class extends DurableObject2 {
       return null;
     }
     if (frame.t === "capture") {
-      const { accepted } = await this.capture({ apps: frame.apps }, site);
+      const { accepted } = await this.capture({ apps: frame.apps, location: socketLocation(attachment.cf) }, site);
       this.respond(ws, { t: "captureAck", ref, anonId: userId, accepted });
       return null;
     }
+    if (frame.t === "getGeoInstalls") {
+      await this.answerGeoInstalls(ws, ref, attachment, site);
+      return null;
+    }
     return frame;
   }
+  // The browser holds the page's first events until this answers, so a failure answers at once.
+  async answerGeoInstalls(ws, ref, attachment, site) {
+    let registry3;
+    try {
+      registry3 = (await this.sites.resolve(site, Date.now())).registry;
+    } catch (error61) {
+      recordError(error61, { "site.id": site.domainId });
+      this.respond(ws, { t: "error", ref, message: "geo filter read failed" });
+      return;
+    }
+    this.respond(ws, { t: "geoInstalls", ref, installs: geoAllowedInstalls(registry3, attachment.cf) });
+  }
   admitFrame(ws) {
     let bucket = this.frameBuckets.get(ws);
     if (bucket === void 0) {
@@ -33353,7 +33552,7 @@ var AnonDO = class extends DurableObject2 {
           addSpanEvent("capture dropped: no visitor state", { level: "warn" });
           return { accepted: {} };
         }
-        return this.runCaptures(input2.apps, site);
+        return this.runCaptures(input2.apps, site, input2.location);
       });
     });
   }
@@ -33367,7 +33566,7 @@ var AnonDO = class extends DurableObject2 {
         this.cleanupAlarm = await seedCleanupAlarm(this.ctx.storage, now, lastActivityAt(this.kv) ?? now, this.cleanupAlarm);
         seedMeta(this.kv, input2.anonId, now);
         touchActivity(this.kv, now);
-        return this.runCaptures(input2.apps, site);
+        return this.runCaptures(input2.apps, site, null);
       });
     });
   }
@@ -33381,7 +33580,11 @@ var AnonDO = class extends DurableObject2 {
           return;
         }
         const context = await this.sites.resolve(site, Date.now());
-        if (!appWriteAllowed(context.registry, consentState2(this.kv), input2.slug, context.consentEnforced)) {
+        if (!appWriteAllowed(context.registry, input2.slug, {
+          consent: consentState2(this.kv),
+          enforced: context.consentEnforced,
+          location: null
+        })) {
           return;
         }
         this.storeCaptures(
@@ -33392,9 +33595,9 @@ var AnonDO = class extends DurableObject2 {
       });
     });
   }
-  async runCaptures(apps, site) {
+  async runCaptures(apps, site, location) {
     const context = await this.sites.resolve(site, Date.now());
-    const writes = acceptedCaptures(context.registry, consentState2(this.kv), apps, context.consentEnforced);
+    const writes = acceptedCaptures(context.registry, apps, { consent: consentState2(this.kv), enforced: context.consentEnforced, location });
     return { accepted: this.storeCaptures(writes) };
   }
   storeCaptures(writes) {
@@ -33423,7 +33626,7 @@ var AnonDO = class extends DurableObject2 {
         }
         const context = await this.sites.resolve(site, Date.now());
         const { registry: registry3 } = context;
-        if (!appWriteAllowed(registry3, consentState2(this.kv), input2.slug, context.consentEnforced)) {
+        if (!appWriteAllowed(registry3, input2.slug, { consent: consentState2(this.kv), enforced: context.consentEnforced, location: null })) {
           return [];
         }
         const granted = registry3.apps[input2.slug]?.data.includes(SHARED_CONTEXT_CAPABILITY) === true;
@@ -33557,12 +33760,16 @@ var AnonDO = class extends DurableObject2 {
   // Only the sockets opened on the push's own site: a linked sibling's browser holds no install of
   // the app that produced it.
   deliverAppPush(push, context) {
-    const serialized = appPushFrame({ push, context, consent: consentState2(this.kv) });
-    if (serialized === null) {
+    const frame = appPushFrame({ push, context, consent: consentState2(this.kv) });
+    if (frame === null) {
       return;
     }
     for (const socket of this.ctx.getWebSockets(context.domainId)) {
-      sendFrame(socket, serialized);
+      const { cf } = socket.deserializeAttachment();
+      const serialized = connectionPushFrame(frame, context.registry, socketLocation(cf));
+      if (serialized !== null) {
+        sendFrame(socket, serialized);
+      }
     }
   }
   // A getConsent can arrive before the session is seeded, so the visitor is named only when there
@@ -33715,7 +33922,8 @@ var AnonDO = class extends DurableObject2 {
   }
   appFanOut(trigger, anonId, context) {
     const { registry: registry3, registryError, consentEnforced: consentEnforced2 } = context;
-    if (registryError === void 0 && eligibleApps(registry3, trigger, consentState2(this.kv), consentEnforced2).length === 0) {
+    const { targets, geoSkipped } = eligibleApps(registry3, trigger, consentState2(this.kv), consentEnforced2);
+    if (registryError === void 0 && targets.length === 0 && geoSkipped.length === 0) {
       return;
     }
     const job = { trigger, snapshot: this.appsSnapshot(anonId, context), trace: currentTraceContext() };