@blotout/qinto-cli 0.1.3 → 0.1.5

package/dist/worker-artifact/main/index.js

@@ -326,6 +326,56 @@ var newSpanId = /* @__PURE__ */ __name(() => {
   return randomHex(8);
 }, "newSpanId");
 
+// ../../libs/tail-trace/src/redact.ts
+var SENSITIVE_URL_PARAMS = /* @__PURE__ */ new Set([
+  "access_token",
+  "api_key",
+  "api_secret",
+  "client_secret",
+  "code",
+  "key",
+  "password",
+  "refresh_token",
+  "secret",
+  "session",
+  "session_id",
+  "token"
+]);
+var PARAM_MATCHER = /(^|[?&])([^=&?\s]+)=[^&\s]*/g;
+var redactUrlParams = /* @__PURE__ */ __name((value) => {
+  return value.replaceAll(PARAM_MATCHER, (match2, separator, param) => {
+    return SENSITIVE_URL_PARAMS.has(param.toLowerCase()) ? `${separator}${param}=[REDACTED]` : match2;
+  });
+}, "redactUrlParams");
+var mappedAttrs = /* @__PURE__ */ __name((attrs, redact) => {
+  const redacted = {};
+  for (const [key, value] of Object.entries(attrs)) {
+    redacted[key] = typeof value === "string" ? redact(value) : value;
+  }
+  return redacted;
+}, "mappedAttrs");
+var redactedEvent = /* @__PURE__ */ __name((event, redact) => {
+  return {
+    ...event,
+    name: redact(event.name),
+    ...event.attrs === void 0 ? {} : { attrs: mappedAttrs(event.attrs, redact) }
+  };
+}, "redactedEvent");
+var redactedSpan = /* @__PURE__ */ __name((span, redact) => {
+  return {
+    ...span,
+    name: redact(span.name),
+    ...span.attrs === void 0 ? {} : { attrs: mappedAttrs(span.attrs, redact) },
+    ...span.events === void 0 ? {} : { events: span.events.map((event) => redactedEvent(event, redact)) },
+    ...span.error === void 0 ? {} : { error: redact(span.error) }
+  };
+}, "redactedSpan");
+var redactSpans = /* @__PURE__ */ __name((spans, redact) => {
+  return spans.map((span) => {
+    return redactedSpan(span, redact);
+  });
+}, "redactSpans");
+
 // ../../libs/tail-trace/src/scope.ts
 import { AsyncLocalStorage } from "node:async_hooks";
 var scopes = new AsyncLocalStorage();
@@ -382,7 +432,7 @@ var logRecord = /* @__PURE__ */ __name((record2) => {
   console.log(formatSpansRecord(record2));
 }, "logRecord");
 var runInvocation = /* @__PURE__ */ __name(async (input, run) => {
-  const buffer = { spans: [], flushed: false };
+  const buffer = { spans: [], flushed: false, pending: [] };
   const traceId = input.trace?.traceId ?? newTraceId();
   const root = startSpan({ traceId, parent: input.trace?.parent, name: input.name, attrs: input.attrs });
   try {
@@ -393,10 +443,12 @@ var runInvocation = /* @__PURE__ */ __name(async (input, run) => {
     throw error51;
   } finally {
     root.end = Date.now();
+    await Promise.allSettled(buffer.pending);
     buffer.spans.push(root);
     buffer.flushed = true;
     const emit = input.emit ?? logRecord;
-    emit(budgetSpans(buffer.spans, input.budget ?? MAX_SPANS_BYTES));
+    const spans = input.redact === void 0 ? buffer.spans : redactSpans(buffer.spans, input.redact);
+    emit(budgetSpans(spans, input.budget ?? MAX_SPANS_BYTES));
   }
 }, "runInvocation");
 
@@ -452,28 +504,6 @@ var parseDispatchTrace = /* @__PURE__ */ __name((header) => {
   };
 }, "parseDispatchTrace");
 
-// ../../libs/tail-trace/src/redact.ts
-var SENSITIVE_URL_PARAMS = /* @__PURE__ */ new Set([
-  "access_token",
-  "api_key",
-  "api_secret",
-  "client_secret",
-  "code",
-  "key",
-  "password",
-  "refresh_token",
-  "secret",
-  "session",
-  "session_id",
-  "token"
-]);
-var PARAM_MATCHER = /(^|[?&])([^=&?\s]+)=[^&\s]*/g;
-var redactUrlParams = /* @__PURE__ */ __name((value) => {
-  return value.replaceAll(PARAM_MATCHER, (match2, separator, param) => {
-    return SENSITIVE_URL_PARAMS.has(param.toLowerCase()) ? `${separator}${param}=[REDACTED]` : match2;
-  });
-}, "redactUrlParams");
-
 // ../../libs/tail-trace/src/trace.ts
 var traced = /* @__PURE__ */ __name(async (name, options, run) => {
   const scope = currentScope();
@@ -494,22 +524,22 @@ var traced = /* @__PURE__ */ __name(async (name, options, run) => {
     }
   }
 }, "traced");
-var liveSpan = /* @__PURE__ */ __name(() => {
+var liveScope = /* @__PURE__ */ __name(() => {
   const scope = currentScope();
   if (scope === void 0 || scope.buffer.flushed) {
     return void 0;
   }
-  return scope.span;
-}, "liveSpan");
+  return scope;
+}, "liveScope");
 var setSpanAttributes = /* @__PURE__ */ __name((attrs) => {
-  const span = liveSpan();
+  const span = liveScope()?.span;
   if (span === void 0) {
     return;
   }
   span.attrs = { ...span.attrs, ...attrs };
 }, "setSpanAttributes");
 var addSpanEvent = /* @__PURE__ */ __name((name, options = {}) => {
-  const span = liveSpan();
+  const span = liveScope()?.span;
   if (span === void 0) {
     return;
   }
@@ -522,7 +552,7 @@ var addSpanEvent = /* @__PURE__ */ __name((name, options = {}) => {
   span.events = [...span.events ?? [], event];
 }, "addSpanEvent");
 var recordError = /* @__PURE__ */ __name((error51, attrs = {}) => {
-  const span = liveSpan();
+  const span = liveScope()?.span;
   if (span === void 0) {
     return;
   }
@@ -15721,7 +15751,7 @@ var actionContextFields = {
     locale: external_exports.string().min(1).max(64).optional(),
     provenance: external_exports.enum(["edge", "caller"])
   }).strict().optional(),
-  session: external_exports.object({ id: external_exports.string().min(1).max(64), isNew: external_exports.boolean() }).strict().optional()
+  session: external_exports.object({ id: external_exports.string().min(1).max(64), isNew: external_exports.boolean(), startedAt: external_exports.number().int().nonnegative().safe() }).strict().optional()
 };
 var actionContextSchema = external_exports.discriminatedUnion("source", [
   external_exports.object({ source: external_exports.literal("browser"), ...actionContextFields }).strict(),
@@ -15740,7 +15770,7 @@ var envelopeRequestSchema = external_exports.object({
     properties: external_exports.record(external_exports.string(), external_exports.unknown()),
     geo: external_exports.record(external_exports.string(), external_exports.string()).optional()
   }).strict(),
-  consent: external_exports.object({ categories: external_exports.record(external_exports.string(), external_exports.boolean()), apps: external_exports.record(external_exports.string(), external_exports.boolean()) }).strict().optional(),
+  consent: external_exports.object({ enabled: external_exports.boolean(), categories: external_exports.record(external_exports.string(), external_exports.boolean()), apps: external_exports.record(external_exports.string(), external_exports.boolean()) }).strict().optional(),
   geo: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
   // Only what this app captured or wrote for this visitor; `updatedAt` is when the current value
   // was first seen, which is the click time a CAPI `fbc` is built from.
@@ -18185,6 +18215,18 @@ var FACT_KINDS = [
   "context_shared_kv",
   "context_shared_text"
 ];
+var APP_FACT_KINDS = [
+  "custom",
+  "attribution",
+  "identifier",
+  "conversion",
+  "pii",
+  "consent_category",
+  "consent_app",
+  "geo"
+];
+var MAX_APP_FACTS_PER_PAGE = 100;
+var MAX_APP_FACT_PAGE_BYTES = 1024 * 1024;
 var COLUMNS = "kind, scope, key, value, source, amount, currency, event_id, data_json, first_at, observed_at, synced_at";
 var rowOf = /* @__PURE__ */ __name((row) => {
   return {
@@ -18202,6 +18244,47 @@ var rowOf = /* @__PURE__ */ __name((row) => {
     syncedAt: row.synced_at
   };
 }, "rowOf");
+var appFactOf = /* @__PURE__ */ __name((row) => {
+  const { syncedAt: _syncedAt, ...fact } = rowOf(row);
+  return { ...fact, kind: fact.kind };
+}, "appFactOf");
+var listAppFacts = /* @__PURE__ */ __name((sql, query) => {
+  const maxRowId = query.maxRowId ?? sql.exec("SELECT MAX(rowid) AS maxRowId FROM facts").one().maxRowId;
+  if (maxRowId === null) {
+    return { items: [], next: null };
+  }
+  const where = ["rowid > ?", "rowid <= ?"];
+  const params = [query.afterRowId, maxRowId];
+  if (query.kinds.length > 0) {
+    where.push(`kind IN (${query.kinds.map(() => "?").join(", ")})`);
+    params.push(...query.kinds);
+  }
+  if (query.observedAtGte !== null) {
+    where.push("observed_at >= ?");
+    params.push(query.observedAtGte);
+  }
+  if (query.observedAtLt !== null) {
+    where.push("observed_at < ?");
+    params.push(query.observedAtLt);
+  }
+  const rows = sql.exec(`SELECT rowid, ${COLUMNS} FROM facts WHERE ${where.join(" AND ")} ORDER BY rowid LIMIT ?`, ...params, query.limit + 1).toArray();
+  const items = [];
+  let lastRowId = query.afterRowId;
+  for (const row of rows.slice(0, query.limit)) {
+    const fact = appFactOf(row);
+    const candidate = [...items, fact];
+    if (new TextEncoder().encode(JSON.stringify(candidate)).byteLength > MAX_APP_FACT_PAGE_BYTES) {
+      if (items.length === 0) {
+        throw new Error("fact_too_large");
+      }
+      break;
+    }
+    items.push(fact);
+    lastRowId = row.rowid;
+  }
+  const hasMore = rows.length > items.length;
+  return { items, next: hasMore ? { afterRowId: lastRowId, maxRowId } : null };
+}, "listAppFacts");
 var insertFact = /* @__PURE__ */ __name((sql, fact) => {
   sql.exec(
     `INSERT INTO facts (${COLUMNS}) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL)`,
@@ -19018,7 +19101,7 @@ var buildEnvelope = /* @__PURE__ */ __name((target, trigger, snapshot, context)
       },
       ...geoAllowed ? { geo: snapshot.userGeo } : {}
     },
-    ...buckets.includes("consentState") ? { consent: { categories: snapshot.consent.categories, apps: snapshot.consent.apps } } : {},
+    ...buckets.includes("consentState") ? { consent: { enabled: context.consentEnforced, categories: snapshot.consent.categories, apps: snapshot.consent.apps } } : {},
     ...geoAllowed && currentGeo !== void 0 ? { geo: currentGeo } : {},
     // Not gated on a capabilities.data bucket: an app only ever sees what it captured or wrote.
     ...attribution === void 0 ? {} : { attribution },
@@ -19343,7 +19426,28 @@ var contextWriteBody = external_exports.object({
   userId: external_exports.string().min(1).max(64),
   writes: external_exports.array(contextWriteSchema).min(1).max(MAX_CONTEXT_WRITES_PER_INSTALL)
 }).strict();
-var brokerBody = external_exports.discriminatedUnion("kind", [pushBody, rpcBody, installsBody, activeBody, contextReadBody, contextWriteBody]);
+var factsQuery = external_exports.object({
+  kinds: external_exports.array(external_exports.enum(APP_FACT_KINDS)).min(1).max(APP_FACT_KINDS.length).optional(),
+  observedAtGte: external_exports.number().int().nonnegative().safe().optional(),
+  observedAtLt: external_exports.number().int().nonnegative().safe().optional(),
+  limit: external_exports.number().int().min(1).max(MAX_APP_FACTS_PER_PAGE).optional()
+}).strict().refine((query) => query.observedAtGte === void 0 || query.observedAtLt === void 0 || query.observedAtGte < query.observedAtLt);
+var factsReadBody = external_exports.object({
+  ...identityFields,
+  kind: external_exports.literal("factsRead"),
+  userId: external_exports.string().min(1).max(64),
+  query: factsQuery.optional(),
+  cursor: external_exports.string().min(1).max(4096).optional()
+}).strict().refine((body) => body.query === void 0 !== (body.cursor === void 0));
+var brokerBody = external_exports.discriminatedUnion("kind", [
+  pushBody,
+  rpcBody,
+  installsBody,
+  activeBody,
+  contextReadBody,
+  contextWriteBody,
+  factsReadBody
+]);
 var BODY_ENVELOPE_ALLOWANCE_BYTES = 2 * 1024;
 var MAX_BODY_BYTES = MAX_RPC_BYTES + BODY_ENVELOPE_ALLOWANCE_BYTES;
 var parseJson = /* @__PURE__ */ __name((raw2) => {
@@ -19358,12 +19462,62 @@ var constantTimeEqual = /* @__PURE__ */ __name((expected, presented) => {
   const presentedBytes = new TextEncoder().encode(presented);
   return expectedBytes.length === presentedBytes.length && timingSafeEqual(expectedBytes, presentedBytes);
 }, "constantTimeEqual");
+var factsCursor = external_exports.object({
+  userId: external_exports.string().min(1).max(64),
+  kinds: external_exports.array(external_exports.enum(APP_FACT_KINDS)).min(1).max(APP_FACT_KINDS.length),
+  observedAtGte: external_exports.number().int().nonnegative().safe().nullable(),
+  observedAtLt: external_exports.number().int().nonnegative().safe().nullable(),
+  limit: external_exports.number().int().min(1).max(MAX_APP_FACTS_PER_PAGE),
+  afterRowId: external_exports.number().int().nonnegative().safe(),
+  maxRowId: external_exports.number().int().positive().safe().nullable()
+}).strict();
+var cursorKey = /* @__PURE__ */ __name(async (hex3) => {
+  const bytes = Uint8Array.from(hex3.matchAll(/.{2}/g), ([pair]) => Number.parseInt(pair, 16));
+  return crypto.subtle.importKey("raw", bytes, "AES-GCM", false, ["encrypt", "decrypt"]);
+}, "cursorKey");
+var encodeBase64Url = /* @__PURE__ */ __name((bytes) => {
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}, "encodeBase64Url");
+var decodeBase64Url = /* @__PURE__ */ __name((value) => {
+  const base643 = value.replaceAll("-", "+").replaceAll("_", "/");
+  const padded = base643.padEnd(Math.ceil(base643.length / 4) * 4, "=");
+  const binary = atob(padded);
+  return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+}, "decodeBase64Url");
+var encryptFactsCursor = /* @__PURE__ */ __name(async (key, cursor) => {
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+  const plaintext = new TextEncoder().encode(JSON.stringify(cursor));
+  const ciphertext = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv }, await cursorKey(key), plaintext));
+  const packed = new Uint8Array(iv.byteLength + ciphertext.byteLength);
+  packed.set(iv);
+  packed.set(ciphertext, iv.byteLength);
+  return encodeBase64Url(packed);
+}, "encryptFactsCursor");
+var decryptFactsCursor = /* @__PURE__ */ __name(async (key, encoded) => {
+  try {
+    const packed = decodeBase64Url(encoded);
+    if (packed.byteLength <= 12) {
+      return null;
+    }
+    const plaintext = await crypto.subtle.decrypt({ name: "AES-GCM", iv: packed.slice(0, 12) }, await cursorKey(key), packed.slice(12));
+    return JSON.parse(new TextDecoder().decode(plaintext));
+  } catch {
+    return null;
+  }
+}, "decryptFactsCursor");
 var invalidBody = /* @__PURE__ */ __name(() => {
   return Response.json({ error: "invalid_body" }, { status: 400 });
 }, "invalidBody");
 var forbidden = /* @__PURE__ */ __name(() => {
   return Response.json({ error: "forbidden" }, { status: 403 });
 }, "forbidden");
+var factsPermissionDenied = /* @__PURE__ */ __name(() => {
+  return Response.json({ error: "facts_permission_denied" }, { status: 403 });
+}, "factsPermissionDenied");
 var handlePush = /* @__PURE__ */ __name(async (env, body) => {
   if (new TextEncoder().encode(JSON.stringify(body.data ?? null)).length > MAX_PUSH_BYTES) {
     return invalidBody();
@@ -19544,6 +19698,49 @@ var handleContextWrite = /* @__PURE__ */ __name(async (env, body) => {
   const stored = await anonStub(env, body.userId).appContext({ slug: body.slug, writes: body.writes }, currentTraceContext());
   return Response.json({ stored }, { status: 202 });
 }, "handleContextWrite");
+var initialFactsCursor = /* @__PURE__ */ __name((body) => {
+  const query = body.query;
+  return {
+    userId: body.userId,
+    kinds: query.kinds ?? [...APP_FACT_KINDS],
+    observedAtGte: query.observedAtGte ?? null,
+    observedAtLt: query.observedAtLt ?? null,
+    limit: query.limit ?? MAX_APP_FACTS_PER_PAGE,
+    afterRowId: 0,
+    maxRowId: null
+  };
+}, "initialFactsCursor");
+var handleFactsRead = /* @__PURE__ */ __name(async (env, body) => {
+  const app2 = siteRegistry().registry.apps[body.slug];
+  if (app2 === void 0 || !app2.data.includes("facts")) {
+    return factsPermissionDenied();
+  }
+  if (await rateLimited(env, `${body.slug}::facts`)) {
+    return Response.json({ error: "rate_limited" }, { status: 429 });
+  }
+  const decoded = body.cursor === void 0 ? initialFactsCursor(body) : await decryptFactsCursor(body.key, body.cursor);
+  if (decoded === null || decoded.userId !== body.userId || body.cursor !== void 0 && decoded.maxRowId === null) {
+    return Response.json({ error: "invalid_cursor" }, { status: 400 });
+  }
+  const query = {
+    kinds: decoded.kinds,
+    observedAtGte: decoded.observedAtGte,
+    observedAtLt: decoded.observedAtLt,
+    limit: decoded.limit,
+    afterRowId: decoded.afterRowId,
+    maxRowId: decoded.maxRowId
+  };
+  const page = await anonStub(env, body.userId).getAppFacts(body.slug, query, currentTraceContext());
+  if (page === null) {
+    return factsPermissionDenied();
+  }
+  const nextCursor = page.next === null ? null : await encryptFactsCursor(body.key, {
+    ...decoded,
+    afterRowId: page.next.afterRowId,
+    maxRowId: page.next.maxRowId
+  });
+  return Response.json({ items: page.items, nextCursor });
+}, "handleFactsRead");
 var handleActive = /* @__PURE__ */ __name(async (env, body) => {
   const app2 = siteRegistry().registry.apps[body.slug];
   if (app2 === void 0) {
@@ -19562,8 +19759,14 @@ var handleBroker = /* @__PURE__ */ __name(async (request, env) => {
   if (bytes === null) {
     return Response.json({ error: "too_large" }, { status: 413 });
   }
-  const parsed = brokerBody.safeParse(parseJson(new TextDecoder().decode(bytes)));
+  const candidate = parseJson(new TextDecoder().decode(bytes));
+  const parsed = brokerBody.safeParse(candidate);
   if (!parsed.success) {
+    if (typeof candidate === "object" && candidate !== null && "kind" in candidate && candidate.kind === "factsRead") {
+      const malformedFacts = candidate;
+      const error51 = malformedFacts.cursor !== void 0 && malformedFacts.query === void 0 ? "invalid_cursor" : "invalid_query";
+      return Response.json({ error: error51 }, { status: 400 });
+    }
     return invalidBody();
   }
   const body = parsed.data;
@@ -19597,6 +19800,9 @@ var handleBroker = /* @__PURE__ */ __name(async (request, env) => {
     case "contextWrite": {
       return handleContextWrite(env, body);
     }
+    case "factsRead": {
+      return handleFactsRead(env, body);
+    }
   }
 }, "handleBroker");
 var brokerRoutes = new Hono2();
@@ -20467,7 +20673,7 @@ var authorizeUi = /* @__PURE__ */ __name(async (c, slug, origin) => {
   }
   const install = app2.installs.find((entry) => (entry.enabled ?? entry.active) && entry.id === verdict.claims.appInstallId);
   if (install === void 0) {
-    return refuse2(origin, 403, "forbidden");
+    return refuse2(origin, 401, "token_stale");
   }
   const method = c.req.method;
   const writing = method !== "GET" && method !== "HEAD";
@@ -22846,7 +23052,7 @@ var serverActionContextField = external_exports.object({
     userAgent: external_exports.string().min(1).max(512).optional(),
     locale: external_exports.string().min(1).max(64).optional()
   }).strict().optional(),
-  session: external_exports.object({ id: external_exports.string().min(1).max(64), isNew: external_exports.boolean() }).strict().optional(),
+  session: external_exports.object({ id: external_exports.string().min(1).max(64), isNew: external_exports.boolean(), startedAt: external_exports.number().int().nonnegative().safe() }).strict().optional(),
   offline: external_exports.boolean().optional(),
   replay: external_exports.boolean().optional()
 }).strict().optional();
@@ -23559,14 +23765,14 @@ var open = /* @__PURE__ */ __name(async (c) => {
 
 // browser-artifact/meta.json
 var meta_default = {
-  version: "0.1.0",
-  gitSha: "3aabe60a32914ac6facb6f28b3d21218918de80b",
-  builtAt: "2026-08-24T16:10:36.785Z",
-  hash: "004a590df1020949be545411bfdd8e25d38d172ea9238d22587658ee798b73c7"
+  version: "0.1.1",
+  gitSha: "45acc2f65889b33f7cf2828b967a26fd879455f0",
+  builtAt: "2026-08-25T22:08:34.269Z",
+  hash: "8f1c955d16978159926d9c98b73ee2d0a3c3d1ea51d4ec8e1b017c3ea6892ea1"
 };
 
 // src/paths/q-js.ts
-import qScript from "./9301296b51353552dafe33a97c95e9755e6108db-q.js.txt";
+import qScript from "./9dcfd236748459af038da772477100c4bb0223b7-q.js.txt";
 
 // src/apps-q.ts
 import appsQScript from "./apps-q.json";
@@ -25208,7 +25414,7 @@ var MAX_BROWSER_RESULTS_BYTES = 32 * 1024;
 var browserContextFrame = external_exports.object({
   occurredAt: external_exports.number().int().nonnegative().safe(),
   page: external_exports.object({ url: external_exports.string().min(1).max(4096), referrer: external_exports.string().min(1).max(4096).optional() }).strict(),
-  session: external_exports.object({ id: external_exports.string().min(1).max(64), isNew: external_exports.boolean() }).strict()
+  session: external_exports.object({ id: external_exports.string().min(1).max(64), isNew: external_exports.boolean(), startedAt: external_exports.number().int().nonnegative().safe() }).strict()
 }).strict();
 var browserResult = external_exports.unknown().refine((value) => {
   return new TextEncoder().encode(JSON.stringify(value)).length <= MAX_BROWSER_RESULT_BYTES;
@@ -25661,6 +25867,20 @@ var AnonDO = class extends DurableObject2 {
       });
     });
   }
+  getAppFacts(slug, query, trace) {
+    return runInvocation({ name: "do.anon.get_app_facts", trace, attrs: { "app.slug": slug } }, () => {
+      return this.enqueue(async () => {
+        const app2 = siteRegistry().registry.apps[slug];
+        if (await this.discardIfUnused() || app2 === void 0 || !app2.data.includes("facts")) {
+          return null;
+        }
+        if (!consentAllows(consentState2(this.kv), slug, app2.consent.category, consentEnforced(this.env))) {
+          return null;
+        }
+        return listAppFacts(this.sql, query);
+      });
+    });
+  }
   // A workflow runs outside request routing, so it re-asks this on every replay rather than trusting
   // the consent its worker's bindings carried when the instance started.
   appAllowed(slug, trace) {

package/dist/worker-artifact/version.json

@@ -1,8 +1,8 @@
 {
   "main": {
     "version": "0.1.0",
-    "gitSha": "a9087748d1cdf6fa9b590b05ebc66ffd48da563e",
-    "builtAt": "2026-08-25T06:38:11.817Z",
+    "gitSha": "45acc2f65889b33f7cf2828b967a26fd879455f0",
+    "builtAt": "2026-08-25T22:20:08.908Z",
     "compatibilityDate": "2026-06-23",
     "compatibilityFlags": [
       "nodejs_compat"
@@ -10,8 +10,8 @@
     "mainModule": "index.js",
     "modules": [
       {
-        "name": "9301296b51353552dafe33a97c95e9755e6108db-q.js.txt",
-        "path": "main/9301296b51353552dafe33a97c95e9755e6108db-q.js.txt",
+        "name": "9dcfd236748459af038da772477100c4bb0223b7-q.js.txt",
+        "path": "main/9dcfd236748459af038da772477100c4bb0223b7-q.js.txt",
         "contentType": "text/plain"
       },
       {
@@ -40,8 +40,8 @@
   },
   "app-runtime": {
     "version": "0.1.0",
-    "gitSha": "3aabe60a32914ac6facb6f28b3d21218918de80b",
-    "builtAt": "2026-08-24T16:10:29.698Z",
+    "gitSha": "45acc2f65889b33f7cf2828b967a26fd879455f0",
+    "builtAt": "2026-08-25T22:08:45.522Z",
     "compatibilityDate": "2026-06-23",
     "compatibilityFlags": [
       "nodejs_compat"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blotout/qinto-cli",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "type": "module",
   "description": "Qinto CLI: authenticate against the Qinto platform and operate it from the terminal or from an agent.",
   "repository": {

package/templates/app/full/ui/src/pages/index.astro

@@ -29,7 +29,7 @@
         ...context.installs.map((install) => {
           const option = document.createElement('option')
           option.value = install.id
-          option.textContent = install.id === context.appInstallId ? `${install.label} (this panel)` : install.label
+          option.textContent = install.enabled ? install.label : `${install.label} (disabled)`
           return option
         })
       )