@blotout/qinto-cli 0.1.26 → 0.1.28

package/dist/worker-artifact/main/index.js

@@ -21530,11 +21530,16 @@ var MAX_PUSH_BYTES = 16 * 1024;
 var MAX_RESPONSE_BYTES = 1024 * 1024;
 var MAX_RPC_BYTES = 128 * 1024;
 var installSchema = external_exports.object({ id: external_exports.string().min(1).max(64), ord: external_exports.number().int().min(1), label: external_exports.string().max(100) }).strict();
-var emitSchema = external_exports.object({ type: external_exports.literal("track"), occurredAt: external_exports.number().int().nonnegative().safe(), payload: external_exports.record(external_exports.string(), external_exports.unknown()) }).strict();
 var installRuleSchema = external_exports.object({
   mode: external_exports.enum(["except", "only"]),
   installIds: external_exports.array(external_exports.string().min(1).max(64)).max(MAX_APPS_PER_DOMAIN * MAX_INSTALLS_PER_APP)
 }).strict();
+var emitSchema = external_exports.object({
+  type: external_exports.literal("track"),
+  occurredAt: external_exports.number().int().nonnegative().safe(),
+  payload: external_exports.record(external_exports.string(), external_exports.unknown()),
+  installs: installRuleSchema.optional()
+}).strict();
 var pushSchema = external_exports.object({ topic: external_exports.string().min(1).max(64), data: external_exports.unknown(), broadcast: external_exports.enum(PUSH_BROADCASTS).optional() }).strict().refine((push) => {
   return new TextEncoder().encode(JSON.stringify(push.data ?? null)).length <= MAX_PUSH_BYTES;
 }, "Push data exceeds the per-message size cap");
@@ -26513,7 +26518,14 @@ var consentEnforcedFor = /* @__PURE__ */ __name((raw2) => {
 var consentEnforced = /* @__PURE__ */ __name((env) => {
   return consentEnforcedFor(env.CONSENT_CONFIGURATION ?? "");
 }, "consentEnforced");
-var consentAllows = /* @__PURE__ */ __name((consent2, slug, category, enforced) => {
+var GPC_DENIED_CATEGORIES = ["marketing", "salesOfData"];
+var gpcDenies = /* @__PURE__ */ __name((category, gpc) => {
+  return gpc && GPC_DENIED_CATEGORIES.includes(category);
+}, "gpcDenies");
+var consentAllows = /* @__PURE__ */ __name((consent2, slug, category, { enforced, gpc }) => {
+  if (gpcDenies(category, gpc)) {
+    return false;
+  }
   if (!enforced) {
     return true;
   }
@@ -27585,7 +27597,7 @@ var trackBody = external_exports.object({
   userId: external_exports.string().min(1).max(64),
   installId: external_exports.string().min(1).max(64),
   installs: installRuleSchema.optional(),
-  event: emitSchema
+  event: emitSchema.omit({ installs: true })
 }).strict();
 var handleTrack = /* @__PURE__ */ __name(async (env, body) => {
   const app2 = siteRegistry().registry.apps[body.slug];
@@ -27785,14 +27797,14 @@ var allContext = /* @__PURE__ */ __name((sql, level, cache) => {
 
 // src/apps/context-visibility.ts
 var SHARED_CONTEXT_CAPABILITY = "sharedContext";
-var readableSharedContext = /* @__PURE__ */ __name((registry3, consent2, enforced, stored) => {
+var readableSharedContext = /* @__PURE__ */ __name((registry3, consent2, policy, stored) => {
   const readable = {};
   for (const [slug, entry] of Object.entries(stored)) {
     const app2 = registry3.apps[slug];
     if (app2 === void 0) {
       continue;
     }
-    if (!app2.data.includes(SHARED_CONTEXT_CAPABILITY) || !consentAllows(consent2, slug, app2.consent.category, enforced)) {
+    if (!app2.data.includes(SHARED_CONTEXT_CAPABILITY) || !consentAllows(consent2, slug, app2.consent.category, policy)) {
       continue;
     }
     readable[slug] = entry;
@@ -27804,7 +27816,7 @@ var siteEventReceivers = /* @__PURE__ */ __name((registry3, consent2, enforced)
     return app2.data.includes(SHARED_CONTEXT_CAPABILITY) && app2.installs.some((install) => install.active) && // The receiver's own consent, resolved here rather than left to the page: the tag's
     // `state.consent` does not see a revocation made on another device (apps.ts), so a browser
     // recheck alone would keep notifying an app the visitor has since turned off.
-    consentAllows(consent2, slug, app2.consent.category, enforced);
+    consentAllows(consent2, slug, app2.consent.category, { enforced, gpc: false });
   }).map(([slug]) => slug);
 }, "siteEventReceivers");
 var sharedContextWire = /* @__PURE__ */ __name((entries) => {
@@ -28542,7 +28554,8 @@ var buildEnvelope = /* @__PURE__ */ __name((target, trigger, snapshot, context)
   const buckets = target.app.data;
   const geoAllowed = buckets.includes("geo");
   const currentGeo = trigger.kind === "event" ? trigger.action.geo : trigger.geo;
-  const consented = consentAllows(snapshot.consent, target.slug, target.app.consent.category, context.consentEnforced);
+  const gpc = trigger.kind === "event" ? trigger.action.gpc === true : trigger.gpc === true;
+  const consented = consentAllows(snapshot.consent, target.slug, target.app.consent.category, { enforced: context.consentEnforced, gpc });
   const captures = consented ? deliverableCaptures(target, snapshot.captures[target.slug]) : void 0;
   const visitorContext = deliverableContext({ target, consented, ...snapshot.context });
   return {
@@ -28571,36 +28584,38 @@ var buildEnvelope = /* @__PURE__ */ __name((target, trigger, snapshot, context)
     ...trigger.kind === "event" ? { action: eventAction(target, trigger, snapshot) } : {}
   };
 }, "buildEnvelope");
-var ingestEmit = /* @__PURE__ */ __name(async (ingest2, { slug, ord, depth, emit, anonId, geo, host, context, fromSocket }) => {
+var emitContext = /* @__PURE__ */ __name((occurredAt, context, host) => ({
+  ...context ?? {},
+  source: "app",
+  occurredAt,
+  ...context !== void 0 || host === void 0 ? {} : {
+    network: {
+      ...host.ip === void 0 ? {} : { ip: host.ip },
+      ...host.userAgent === void 0 ? {} : { userAgent: host.userAgent },
+      ...host.locale === void 0 ? {} : { locale: host.locale },
+      provenance: "edge"
+    }
+  },
+  offline: context === void 0 || context.source === "browser" ? false : context.offline,
+  replay: context === void 0 || context.source === "browser" ? false : context.replay
+}), "emitContext");
+var ingestEmit = /* @__PURE__ */ __name(async (ingest2, { slug, ord, depth, emit, anonId, geo, host, context, fromSocket, gpc }) => {
   const parsed = emitPayloadSchema.safeParse(emit.payload);
   if (!parsed.success) {
     addSpanEvent("emit payload rejected", { level: "warn", attrs: { app: slug, ord } });
     return;
   }
   const { event, eventId, properties: properties2 } = parsed.data;
-  const inherited = {
-    ...context ?? {},
-    source: "app",
-    occurredAt: emit.occurredAt,
-    ...context !== void 0 || host === void 0 ? {} : {
-      network: {
-        ...host.ip === void 0 ? {} : { ip: host.ip },
-        ...host.userAgent === void 0 ? {} : { userAgent: host.userAgent },
-        ...host.locale === void 0 ? {} : { locale: host.locale },
-        provenance: "edge"
-      }
-    },
-    offline: context === void 0 || context.source === "browser" ? false : context.offline,
-    replay: context === void 0 || context.source === "browser" ? false : context.replay
-  };
   const action = buildAction({
     type: "track",
     userId: anonId,
     source: "app",
     payload: { event, eventId: emittedEventId(eventId, properties2), properties: properties2 ?? {} },
-    context: inherited,
+    context: emitContext(emit.occurredAt, context, host),
     origin: { app: slug, install: ord, depth: depth + 1 },
+    ...emit.installs === void 0 ? {} : { installs: emit.installs },
     fromSocket,
+    gpc,
     geo,
     host
   });
@@ -28645,7 +28660,8 @@ var applyEffects = /* @__PURE__ */ __name(async ({
   geo,
   host,
   context,
-  fromSocket
+  fromSocket,
+  gpc
 }) => {
   const captures = groups.flatMap((group) => group.captures);
   if (captures.length > 0) {
@@ -28665,7 +28681,7 @@ var applyEffects = /* @__PURE__ */ __name(async ({
       continue;
     }
     for (const emit of group.emits) {
-      await ingestEmit(ingest2, { slug, ord: group.ord, depth, emit, anonId, geo, host, context, fromSocket });
+      await ingestEmit(ingest2, { slug, ord: group.ord, depth, emit, anonId, geo, host, context, fromSocket, gpc });
     }
   }
 }, "applyEffects");
@@ -28727,6 +28743,7 @@ var runInvokeApp = /* @__PURE__ */ __name(async (env, { target, trigger, snapsho
       geo: trigger.kind === "event" ? trigger.action.geo : trigger.geo,
       host: trigger.kind === "event" ? trigger.action.host : trigger.host,
       context: trigger.kind === "event" ? trigger.action.context : void 0,
+      gpc: trigger.kind === "event" ? trigger.action.gpc : trigger.gpc,
       ...startedOnSocket(trigger) ? { fromSocket: true } : {}
     });
   } catch (error61) {
@@ -29810,6 +29827,9 @@ var originAllowed = /* @__PURE__ */ __name((request, env) => {
   if (origin === null) {
     return true;
   }
+  if (JSON.parse(env.ALLOWED_ORIGINS).includes(origin)) {
+    return true;
+  }
   let host;
   try {
     host = new URL(origin).host;
@@ -29852,6 +29872,11 @@ var authorize = /* @__PURE__ */ __name(async (c, { slug, app: app2 }) => {
   if (install === void 0) {
     return refuse(403, "forbidden");
   }
+  const gpc = c.env.GPC === "1" && c.req.header("sec-gpc") === "1";
+  if (gpcDenies(app2.consent.category, gpc)) {
+    addSpanEvent("visitor endpoint refused: Global Privacy Control", { attrs: { app: slug } });
+    return refuse(403, "forbidden");
+  }
   if (await rateLimited(c.env, `${slug}:${anonId}:visitor`, "VISITOR_RATE_LIMITER")) {
     return refuse(429, "rate_limited");
   }
@@ -30626,6 +30651,7 @@ var createApiRouter = /* @__PURE__ */ __name(() => new OpenAPIHono({ defaultHook
 // src/id-graph/anon/connection.ts
 var CONNECTION_CF_HEADER = "x-connection-cf";
 var SESSION_HEADER = "x-session";
+var GPC_HEADER = "x-gpc";
 var OPEN_PAGE_PARAMS = ["url", "referrer"];
 var MAX_HOST_USER_AGENT_LENGTH = 512;
 var MAX_HOST_LOCALE_LENGTH = 64;
@@ -30636,6 +30662,7 @@ var INTERNAL_HEADERS = /* @__PURE__ */ new Set([
   SITE_ID_HEADER,
   CONNECTION_CF_HEADER,
   SESSION_HEADER,
+  GPC_HEADER,
   TRACE_HEADER,
   CF_DATA_HEADER
 ]);
@@ -30691,7 +30718,8 @@ var connectAttrs = /* @__PURE__ */ __name((request, geo) => {
     "url.full": withoutPageParams(request.url),
     "http.request.headers": JSON.stringify(headers),
     ...cf === void 0 ? {} : { "qinto.cf": JSON.stringify(cf) },
-    ...geo === void 0 ? {} : { "qinto.geo": JSON.stringify(loggableGeo(geo)) }
+    ...geo === void 0 ? {} : { "qinto.geo": JSON.stringify(loggableGeo(geo)) },
+    ...request.headers.get(GPC_HEADER) === "1" ? { "qinto.gpc": true } : {}
   };
 }, "connectAttrs");
 var withoutQuery = /* @__PURE__ */ __name((url2) => {
@@ -30737,12 +30765,14 @@ var connectionAttachment = /* @__PURE__ */ __name((request, geo, siteId) => {
   const browserGeoBytes = attachmentFieldBytes("browserGeo", browserGeo);
   const session2 = forwardedSession(request);
   const sessionBytes = attachmentFieldBytes("session", session2);
+  const gpc = request.headers.get(GPC_HEADER) === "1";
+  const gpcBytes = attachmentFieldBytes("gpc", gpc ? true : void 0);
   const siteBytes = attachmentFieldBytes("siteId", siteId);
   const cf = forwardedCf(request);
   const cfSuffix = cf === void 0 ? "" : `,"cf":${JSON.stringify(cf)}`;
   const cfBytes = new TextEncoder().encode(cfSuffix).length;
   const emptyAttrsBytes = new TextEncoder().encode(JSON.stringify({ attrs: {} })).length;
-  const fixedBytes = siteBytes + sessionBytes + hostBytes + browserGeoBytes;
+  const fixedBytes = siteBytes + sessionBytes + hostBytes + browserGeoBytes + gpcBytes;
   const includedCf = cfBytes <= MAX_ATTACHMENT_BYTES - emptyAttrsBytes - fixedBytes ? cf : void 0;
   const budgeted = budgetAttrs(attrs, MAX_ATTACHMENT_BYTES - fixedBytes - (includedCf === void 0 ? 0 : cfBytes));
   return {
@@ -30751,7 +30781,8 @@ var connectionAttachment = /* @__PURE__ */ __name((request, geo, siteId) => {
     ...session2 === void 0 ? {} : { session: session2 },
     ...browserGeo === void 0 ? {} : { browserGeo },
     ...includedCf === void 0 ? {} : { cf: includedCf },
-    ...host === void 0 ? {} : { host }
+    ...host === void 0 ? {} : { host },
+    ...gpc ? { gpc: true } : {}
   };
 }, "connectionAttachment");
 
@@ -31191,6 +31222,12 @@ var open2 = /* @__PURE__ */ __name(async (c) => {
   if (cf !== void 0) {
     headers.set(CONNECTION_CF_HEADER, cf);
   }
+  headers.delete(GPC_HEADER);
+  const gpc = c.env.GPC === "1" && c.req.header("sec-gpc") === "1";
+  if (gpc) {
+    headers.set(GPC_HEADER, "1");
+    setSpanAttributes({ "qinto.gpc": true });
+  }
   const res = await traced("rpc anon.connect", {}, () => {
     headers.delete(TRACE_HEADER);
     const trace = currentTraceContext();
@@ -31295,12 +31332,12 @@ var appsMetadata = /* @__PURE__ */ __name(() => {
     })
   );
 }, "appsMetadata");
-var configPrelude = /* @__PURE__ */ __name(({ destination, autoCapture, consentConfiguration, apps }) => {
-  const config2 = JSON.stringify({ destination, autoCapture, consentConfiguration, apps });
+var configPrelude = /* @__PURE__ */ __name(({ destination, autoCapture, consentConfiguration, gpc, apps }) => {
+  const config2 = JSON.stringify({ destination, autoCapture, consentConfiguration, gpc, apps });
   return '(function(d){var s=d.currentScript,g=(s&&s.dataset?s.dataset.qintoGlobal:void 0)||"qinto";var w=window,o=g in w?w[g]:null;if(o&&o._q){o.config=' + config2 + ';}else if(g in w){console.error("window."+g+" is already in use");}else{Object.defineProperty(w,g,{value:{_q:1,config:' + config2 + "},writable:true,enumerable:true,configurable:true});}})(document);\n";
 }, "configPrelude");
-var scriptEtag = /* @__PURE__ */ __name(async ({ destination, autoCapture, consentConfiguration, apps }, withTag) => {
-  const settings = await digestFor(JSON.stringify({ autoCapture, consentConfiguration, apps }));
+var scriptEtag = /* @__PURE__ */ __name(async ({ destination, autoCapture, consentConfiguration, gpc, apps }, withTag) => {
+  const settings = await digestFor(JSON.stringify({ autoCapture, consentConfiguration, gpc, apps }));
   const tag = withTag ? meta_default.hash.slice(0, 32) : "sdk";
   return `"${tag}-${appsQHash}-${encodeURIComponent(destination)}-${settings}"`;
 }, "scriptEtag");
@@ -31311,6 +31348,8 @@ var qJs = /* @__PURE__ */ __name(async (c) => {
     destination,
     autoCapture: parseSettings("AUTO_CAPTURE", c.env.AUTO_CAPTURE),
     consentConfiguration: parseSettings("CONSENT_CONFIGURATION", c.env.CONSENT_CONFIGURATION),
+    // `wrangler types` narrows GPC to its dev default; a site not redeployed since GPC shipped has none.
+    gpc: c.env.GPC === "1",
     apps: appsMetadata()
   };
   const etag = await scriptEtag(config2, withTag);
@@ -31791,14 +31830,14 @@ var wantsTrigger = /* @__PURE__ */ __name((app2, trigger) => {
   }
   return app2.hooks.onEvent.includes(trigger.action.type);
 }, "wantsTrigger");
-var gatePasses = /* @__PURE__ */ __name((entry, trigger, consent2, enforced) => {
+var gatePasses = /* @__PURE__ */ __name((entry, trigger, consent2, policy) => {
   if (trigger.kind === "event" && trigger.action.origin?.app === entry.slug) {
     return false;
   }
   if (trigger.kind === "event" && trigger.action.type === "consent") {
-    return true;
+    return !gpcDenies(entry.app.consent.category, policy.gpc);
   }
-  return consentAllows(consent2, entry.slug, entry.app.consent.category, enforced);
+  return consentAllows(consent2, entry.slug, entry.app.consent.category, policy);
 }, "gatePasses");
 var eligibleApps = /* @__PURE__ */ __name((registry3, trigger, consent2, enforced) => {
   const location = visitorLocation(trigger);
@@ -31807,9 +31846,17 @@ var eligibleApps = /* @__PURE__ */ __name((registry3, trigger, consent2, enforce
   const keepListed = rule?.mode === "only";
   const targets = [];
   const geoSkipped = [];
+  const gpcSkipped = [];
+  const gpc = trigger.kind === "connect" ? trigger.gpc === true : trigger.action.gpc === true;
   for (const slug of registry3.order) {
     const app2 = registry3.apps[slug];
-    if (app2 === void 0 || !wantsTrigger(app2, trigger) || !gatePasses({ slug, app: app2 }, trigger, consent2, enforced)) {
+    if (app2 === void 0 || !wantsTrigger(app2, trigger)) {
+      continue;
+    }
+    if (!gatePasses({ slug, app: app2 }, trigger, consent2, { enforced, gpc })) {
+      if (gpc && gatePasses({ slug, app: app2 }, trigger, consent2, { enforced, gpc: false })) {
+        gpcSkipped.push(slug);
+      }
       continue;
     }
     const { runs, skipped } = geoRunnableInstalls(slug, app2, location);
@@ -31820,20 +31867,21 @@ var eligibleApps = /* @__PURE__ */ __name((registry3, trigger, consent2, enforce
     }
     targets.push({ slug, app: app2, installs });
   }
-  return { targets, geoSkipped };
+  return { targets, geoSkipped, gpcSkipped };
 }, "eligibleApps");
 
 // src/apps/fan-out.ts
 var fanOutToApps = /* @__PURE__ */ __name(async (env, { trigger, snapshot, trace }, { deliverEffects }) => {
   const { registry: registry3, error: error61 } = siteRegistry();
-  const { targets, geoSkipped } = eligibleApps(registry3, trigger, snapshot.consent, consentEnforced(env));
-  if (error61 === void 0 && targets.length === 0 && geoSkipped.length === 0) {
+  const { targets, geoSkipped, gpcSkipped } = eligibleApps(registry3, trigger, snapshot.consent, consentEnforced(env));
+  if (error61 === void 0 && targets.length === 0 && geoSkipped.length === 0 && gpcSkipped.length === 0) {
     return;
   }
   const attrs = {
     "fan_out.kind": trigger.kind,
     "fan_out.apps": targets.length,
-    ...geoSkipped.length === 0 ? {} : { "fan_out.geo_skipped": geoSkipped.join(",") }
+    ...geoSkipped.length === 0 ? {} : { "fan_out.geo_skipped": geoSkipped.join(",") },
+    ...gpcSkipped.length === 0 ? {} : { "fan_out.gpc_skipped": gpcSkipped.join(",") }
   };
   await runInvocation({ name: "app.fan_out", trace, attrs }, async () => {
     if (error61 !== void 0) {
@@ -31912,18 +31960,23 @@ var chainEntries = /* @__PURE__ */ __name((registry3, action) => {
   const location = visitorLocation({ kind: "event", action });
   const entries = [];
   const geoSkipped = [];
+  const gpcSkipped = [];
   for (const slug of registry3.order) {
     const app2 = registry3.apps[slug];
     if (app2 === void 0 || !app2.hooks.transform.includes(action.type)) {
       continue;
     }
+    if (gpcDenies(app2.consent.category, action.gpc === true)) {
+      gpcSkipped.push(slug);
+      continue;
+    }
     const { runs, skipped } = geoRunnableInstalls(slug, app2, location);
     geoSkipped.push(...skipped);
     for (const install of runs) {
       entries.push({ slug, app: app2, install: { id: install.id, ord: install.ord, label: install.label } });
     }
   }
-  return { entries, geoSkipped };
+  return { entries, geoSkipped, gpcSkipped };
 }, "chainEntries");
 var trackPayloadSchema = external_exports.object({
   event: external_exports.string().min(1),
@@ -32056,6 +32109,7 @@ var buildEffectsRelease = /* @__PURE__ */ __name(({ effects, action, deliveries
         geo: action.geo,
         host: action.host,
         context: action.context,
+        gpc: action.gpc,
         ...startedOnSocket({ kind: "event", action }) ? { fromSocket: true } : {}
       });
     }
@@ -32066,13 +32120,14 @@ var runTransformChain = /* @__PURE__ */ __name(async (env, { action, snapshot, d
   if (error61 !== void 0) {
     throw new TransformChainError(`the apps registry is malformed: ${error61}`);
   }
-  const { entries, geoSkipped } = chainEntries(registry3, action);
+  const { entries, geoSkipped, gpcSkipped } = chainEntries(registry3, action);
   const attrs = {
     "transform.entries": entries.length,
-    ...geoSkipped.length === 0 ? {} : { "transform.geo_skipped": geoSkipped.join(",") }
+    ...geoSkipped.length === 0 ? {} : { "transform.geo_skipped": geoSkipped.join(",") },
+    ...gpcSkipped.length === 0 ? {} : { "transform.gpc_skipped": gpcSkipped.join(",") }
   };
   if (entries.length === 0) {
-    if (geoSkipped.length > 0) {
+    if (geoSkipped.length > 0 || gpcSkipped.length > 0) {
       await traced("apps.transform_chain", { attrs }, () => Promise.resolve());
     }
     return { dropped: false, action, effects: [] };
@@ -32326,7 +32381,7 @@ var allCaptures = /* @__PURE__ */ __name((sql, now, cache) => {
 }, "allCaptures");
 
 // src/apps/capture.ts
-var appWriteAllowed = /* @__PURE__ */ __name((registry3, slug, { consent: consent2, enforced, location }) => {
+var appWriteAllowed = /* @__PURE__ */ __name((registry3, slug, { consent: consent2, enforced, gpc, location }) => {
   const app2 = registry3.apps[slug];
   if (app2 === void 0) {
     addSpanEvent("capture dropped: the app is not in the registry", { level: "warn", attrs: { app: slug } });
@@ -32336,7 +32391,7 @@ var appWriteAllowed = /* @__PURE__ */ __name((registry3, slug, { consent: consen
     addSpanEvent("capture dropped: no install runs for this visitor", { level: "warn", attrs: { app: slug } });
     return false;
   }
-  if (!consentAllows(consent2, slug, app2.consent.category, enforced)) {
+  if (!consentAllows(consent2, slug, app2.consent.category, { enforced, gpc })) {
     addSpanEvent("capture dropped by the consent gate", { attrs: { app: slug } });
     return false;
   }
@@ -33139,7 +33194,7 @@ var appPushFrame = /* @__PURE__ */ __name(({ push, context, consent: consent2 })
     addSpanEvent("app push dropped: the app is not in the registry", { level: "warn", attrs: { app: slug } });
     return null;
   }
-  if (!consentAllows(consent2, slug, app2.consent.category, enforced)) {
+  if (!consentAllows(consent2, slug, app2.consent.category, { enforced, gpc: false })) {
     addSpanEvent("app push dropped by the consent gate", { attrs: { app: slug } });
     return null;
   }
@@ -33167,10 +33222,18 @@ var appPushFrame = /* @__PURE__ */ __name(({ push, context, consent: consent2 })
   }
   return frame;
 }, "appPushFrame");
-var connectionPushFrame = /* @__PURE__ */ __name((frame, registry3, location) => {
+var connectionPushFrame = /* @__PURE__ */ __name((frame, registry3, location, gpc) => {
+  const sender = registry3.apps[frame.app];
+  if (sender !== void 0 && gpcDenies(sender.consent.category, gpc)) {
+    addSpanEvent("app push skipped: Global Privacy Control", { attrs: { app: frame.app } });
+    return null;
+  }
   const runningApps = /* @__PURE__ */ new Set();
   const runningInstalls = /* @__PURE__ */ new Set();
   for (const [slug, app2] of Object.entries(registry3.apps)) {
+    if (gpcDenies(app2.consent.category, gpc)) {
+      continue;
+    }
     for (const install of geoRunnableInstalls(slug, app2, location).runs) {
       runningApps.add(slug);
       runningInstalls.add(install.id);
@@ -33183,8 +33246,8 @@ var connectionPushFrame = /* @__PURE__ */ __name((frame, registry3, location) =>
   const reaches = frame.install === void 0 ? runningApps.has(frame.app) : runningInstalls.has(frame.install);
   return reaches ? JSON.stringify(frame) : null;
 }, "connectionPushFrame");
-var sharedContextFrame = /* @__PURE__ */ __name((context, consent2, stored) => {
-  const readable = readableSharedContext(context.registry, consent2, context.consentEnforced, stored);
+var sharedContextFrame = /* @__PURE__ */ __name((context, consent2, stored, gpc) => {
+  const readable = readableSharedContext(context.registry, consent2, { enforced: context.consentEnforced, gpc }, stored);
   return JSON.stringify({ t: "sharedContext", context: sharedContextWire(readable), ...consent2 });
 }, "sharedContextFrame");
 var socketsBySite = /* @__PURE__ */ __name((ctx) => {
@@ -33454,7 +33517,7 @@ var browserActionContext = /* @__PURE__ */ __name((frame, host, session2) => {
   return context;
 }, "browserActionContext");
 var actionFromFrame = /* @__PURE__ */ __name((frame, userId, connection = {}) => {
-  const { cf: geo, host, session: session2 } = connection;
+  const { cf: geo, host, session: session2, gpc } = connection;
   switch (frame.t) {
     case "identify": {
       const identifier = frame.id === void 0 ? void 0 : classifyIdentifier(frame.id);
@@ -33467,7 +33530,8 @@ var actionFromFrame = /* @__PURE__ */ __name((frame, userId, connection = {}) =>
         context: browserActionContext(frame.context, host, session2),
         browserResults: frame.appResults,
         geo,
-        host
+        host,
+        gpc
       });
     }
     case "track": {
@@ -33480,11 +33544,12 @@ var actionFromFrame = /* @__PURE__ */ __name((frame, userId, connection = {}) =>
         browserResults: frame.appResults,
         geo,
         host,
+        gpc,
         ...frame.installs === void 0 ? {} : { installs: frame.installs }
       });
     }
     case "alias": {
-      return buildAction({ type: "alias", userId, source: "website", payload: { alias: frame.alias }, geo, host });
+      return buildAction({ type: "alias", userId, source: "website", payload: { alias: frame.alias }, geo, host, gpc });
     }
     case "consent": {
       return buildAction({
@@ -33494,7 +33559,8 @@ var actionFromFrame = /* @__PURE__ */ __name((frame, userId, connection = {}) =>
         payload: { categories: frame.categories ?? {}, apps: frame.apps ?? {} },
         context: browserActionContext(frame.context, host, session2),
         geo,
-        host
+        host,
+        gpc
       });
     }
   }
@@ -33575,7 +33641,8 @@ var AnonDO = class extends DurableObject2 {
           kind: "connect",
           ...attachment.cf === void 0 ? {} : { geo: attachment.cf },
           host: attachment.host,
-          ...page === void 0 ? {} : { page }
+          ...page === void 0 ? {} : { page },
+          gpc: attachment.gpc
         },
         userId,
         context
@@ -33616,7 +33683,10 @@ var AnonDO = class extends DurableObject2 {
       return null;
     }
     if (frame.t === "capture") {
-      const { accepted } = await this.capture({ apps: frame.apps, location: socketLocation(attachment.cf) }, site);
+      const { accepted } = await this.capture(
+        { apps: frame.apps, location: socketLocation(attachment.cf), gpc: attachment.gpc === true },
+        site
+      );
       this.respond(ws, { t: "captureAck", ref, anonId: userId, accepted });
       return null;
     }
@@ -33762,7 +33832,7 @@ var AnonDO = class extends DurableObject2 {
           addSpanEvent("capture dropped: no visitor state", { level: "warn" });
           return { accepted: {} };
         }
-        return this.runCaptures(input2.apps, site, input2.location);
+        return this.runCaptures(input2.apps, site, { location: input2.location, gpc: input2.gpc });
       });
     });
   }
@@ -33776,7 +33846,7 @@ var AnonDO = class extends DurableObject2 {
         this.cleanupAlarm = await seedCleanupAlarm(this.ctx.storage, now, lastActivityAt(this.kv) ?? now, this.cleanupAlarm);
         seedMeta(this.kv, input2.anonId, now);
         touchActivity(this.kv, now);
-        return this.runCaptures(input2.apps, site, null);
+        return this.runCaptures(input2.apps, site, { location: null, gpc: false });
       });
     });
   }
@@ -33793,6 +33863,7 @@ var AnonDO = class extends DurableObject2 {
         if (!appWriteAllowed(context.registry, input2.slug, {
           consent: consentState2(this.kv),
           enforced: context.consentEnforced,
+          gpc: false,
           location: null
         })) {
           return;
@@ -33805,9 +33876,14 @@ var AnonDO = class extends DurableObject2 {
       });
     });
   }
-  async runCaptures(apps, site, location) {
+  async runCaptures(apps, site, { location, gpc }) {
     const context = await this.sites.resolve(site, Date.now());
-    const writes = acceptedCaptures(context.registry, apps, { consent: consentState2(this.kv), enforced: context.consentEnforced, location });
+    const writes = acceptedCaptures(context.registry, apps, {
+      consent: consentState2(this.kv),
+      enforced: context.consentEnforced,
+      gpc,
+      location
+    });
     return { accepted: this.storeCaptures(writes) };
   }
   storeCaptures(writes) {
@@ -33836,7 +33912,12 @@ var AnonDO = class extends DurableObject2 {
         }
         const context = await this.sites.resolve(site, Date.now());
         const { registry: registry3 } = context;
-        if (!appWriteAllowed(registry3, input2.slug, { consent: consentState2(this.kv), enforced: context.consentEnforced, location: null })) {
+        if (!appWriteAllowed(registry3, input2.slug, {
+          consent: consentState2(this.kv),
+          enforced: context.consentEnforced,
+          gpc: false,
+          location: null
+        })) {
           return [];
         }
         const granted = registry3.apps[input2.slug]?.data.includes(SHARED_CONTEXT_CAPABILITY) === true;
@@ -33883,9 +33964,11 @@ var AnonDO = class extends DurableObject2 {
   // sent even when there is nothing stored: without that baseline a browser app cannot tell an empty
   // context from one that has not arrived yet.
   sendSharedContext(sockets, context) {
-    const serialized = sharedContextFrame(context, consentState2(this.kv), allContext(this.sql, "shared", this.contextMirror));
+    const consent2 = consentState2(this.kv);
+    const stored = allContext(this.sql, "shared", this.contextMirror);
     for (const socket of sockets) {
-      sendFrame(socket, serialized);
+      const { gpc } = socket.deserializeAttachment();
+      sendFrame(socket, sharedContextFrame(context, consent2, stored, gpc === true));
     }
   }
   // Every open socket, each under its own site's registry and consent policy. A site whose context
@@ -33926,10 +34009,10 @@ var AnonDO = class extends DurableObject2 {
         }
         const consent2 = consentState2(this.kv);
         const enforced = context.consentEnforced;
-        if (!consentAllows(consent2, slug, app2.consent.category, enforced)) {
+        if (!consentAllows(consent2, slug, app2.consent.category, { enforced, gpc: false })) {
           return readableContext(void 0, {});
         }
-        const shared = app2.data.includes(SHARED_CONTEXT_CAPABILITY) ? readableSharedContext(registry3, consent2, enforced, allContext(this.sql, "shared", this.contextMirror)) : {};
+        const shared = app2.data.includes(SHARED_CONTEXT_CAPABILITY) ? readableSharedContext(registry3, consent2, { enforced, gpc: false }, allContext(this.sql, "shared", this.contextMirror)) : {};
         return readableContext(contextEntry(this.sql, "private", slug, this.contextMirror), shared);
       });
     });
@@ -33944,7 +34027,7 @@ var AnonDO = class extends DurableObject2 {
       if (unused || app2 === void 0 || !app2.data.includes("facts")) {
         return null;
       }
-      if (!consentAllows(consentState2(this.kv), slug, app2.consent.category, context.consentEnforced)) {
+      if (!consentAllows(consentState2(this.kv), slug, app2.consent.category, { enforced: context.consentEnforced, gpc: false })) {
         return null;
       }
       if (this.wiped) {
@@ -33963,7 +34046,7 @@ var AnonDO = class extends DurableObject2 {
         if (app2 === void 0) {
           return false;
         }
-        return consentAllows(consentState2(this.kv), slug, app2.consent.category, context.consentEnforced);
+        return consentAllows(consentState2(this.kv), slug, app2.consent.category, { enforced: context.consentEnforced, gpc: false });
       });
     });
   }
@@ -33975,8 +34058,8 @@ var AnonDO = class extends DurableObject2 {
       return;
     }
     for (const socket of this.ctx.getWebSockets(context.domainId)) {
-      const { cf } = socket.deserializeAttachment();
-      const serialized = connectionPushFrame(frame, context.registry, socketLocation(cf));
+      const { cf, gpc } = socket.deserializeAttachment();
+      const serialized = connectionPushFrame(frame, context.registry, socketLocation(cf), gpc === true);
       if (serialized !== null) {
         sendFrame(socket, serialized);
       }
@@ -34122,7 +34205,7 @@ var AnonDO = class extends DurableObject2 {
         shared: readableSharedContext(
           context.registry,
           consentState2(this.kv),
-          context.consentEnforced,
+          { enforced: context.consentEnforced, gpc: false },
           allContext(this.sql, "shared", this.contextMirror)
         )
       },
@@ -34138,8 +34221,8 @@ var AnonDO = class extends DurableObject2 {
   }
   appFanOut(trigger, anonId, context) {
     const { registry: registry3, registryError, consentEnforced: consentEnforced2 } = context;
-    const { targets, geoSkipped } = eligibleApps(registry3, trigger, consentState2(this.kv), consentEnforced2);
-    if (registryError === void 0 && targets.length === 0 && geoSkipped.length === 0) {
+    const { targets, geoSkipped, gpcSkipped } = eligibleApps(registry3, trigger, consentState2(this.kv), consentEnforced2);
+    if (registryError === void 0 && targets.length === 0 && geoSkipped.length === 0 && gpcSkipped.length === 0) {
       return;
     }
     const job = { trigger, snapshot: this.appsSnapshot(anonId, context), trace: currentTraceContext() };
@@ -34752,7 +34835,7 @@ var GlobalDO = class extends DurableObject3 {
       if (await this.discardIfUnused()) {
         return null;
       }
-      if (!consentAllows(globalConsentState(this.sql), gate.slug, gate.category, gate.enforced)) {
+      if (!consentAllows(globalConsentState(this.sql), gate.slug, gate.category, { enforced: gate.enforced, gpc: false })) {
         return null;
       }
       return linkedAnonsPage(this.sql, afterRowId, limit);

package/dist/worker-artifact/version.json

@@ -1,8 +1,8 @@
 {
   "main": {
-    "version": "0.1.9",
-    "gitSha": "ffbdbe7148d4aba3072a6c3c857e69f0557b0ec5",
-    "builtAt": "2026-10-01T08:37:00.893Z",
+    "version": "0.1.10",
+    "gitSha": "d7f0a00c21eb403205af7ecf5ef53a23aa983611",
+    "builtAt": "2026-10-02T07:50:13.371Z",
     "compatibilityDate": "2026-06-23",
     "compatibilityFlags": [
       "nodejs_compat"
@@ -39,9 +39,9 @@
     ]
   },
   "app-runtime": {
-    "version": "0.1.7",
-    "gitSha": "403986012db0fea5975162b971aca874682f3184",
-    "builtAt": "2026-10-01T08:37:02.873Z",
+    "version": "0.1.8",
+    "gitSha": "c97c066674cc86cb667e2e260a6409d9718e8420",
+    "builtAt": "2026-10-02T07:50:15.589Z",
     "compatibilityDate": "2026-06-23",
     "compatibilityFlags": [
       "nodejs_compat",