@blotout/qinto-cli 0.1.30 → 0.1.32

package/dist/worker-artifact/main/index.js

@@ -21071,6 +21071,7 @@ var endpointSchema = external_exports.object({
 var eventsSchema = external_exports.object({
   publishes: external_exports.array(external_exports.string().min(1).max(MAX_EVENT_TOPIC_LENGTH).regex(EVENT_TOPIC)).max(MAX_PUBLISHED_TOPICS).default([])
 }).strict();
+var dependenciesSchema = external_exports.array(external_exports.object({ app: external_exports.string().regex(APP_SLUG_PATTERN), description: renderableText(1, 200).optional() }).strict()).max(10);
 var rpcSchema = external_exports.object({
   exposes: external_exports.array(external_exports.object({ name: external_exports.string().regex(FUNCTION_NAME).max(64), visibility: external_exports.enum(["public", "private"]) }).strict()).max(32).optional(),
   calls: external_exports.array(external_exports.object({ app: external_exports.string().regex(APP_SLUG_PATTERN), fn: external_exports.string().regex(FUNCTION_NAME).max(64) }).strict()).max(64).optional()
@@ -21114,6 +21115,9 @@ var baseSchema = external_exports.object({
     description: "The app's browser surface: an optional entry for the bundle that ships inside the site's q.js, and the query params and cookies it declares for capture."
   }),
   resources: external_exports.array(resourceSchema).max(32).default([]).meta({ description: "The Cloudflare bindings the app worker is given." }),
+  dependencies: dependenciesSchema.optional().meta({
+    description: "The apps this app needs on the same site. Every app it calls over RPC must be listed."
+  }),
   rpc: rpcSchema.optional().meta({ description: "The functions this app exposes to other apps, and the ones it calls on them." }),
   events: eventsSchema.optional().meta({
     description: "The push topics this app broadcasts to every app on the site. Requires the `sharedContext` data capability; a topic left out reaches only this app\u2019s own browser code."
@@ -21430,12 +21434,33 @@ var validateRpc = /* @__PURE__ */ __name((manifest, ctx) => {
     ["rpc", "exposes"],
     "function"
   );
+  const dependencies = new Set((manifest.dependencies ?? []).map((dependency) => dependency.app));
   for (const [index, call] of (manifest.rpc?.calls ?? []).entries()) {
     if (call.app === manifest.slug) {
       ctx.addIssue({ code: "custom", path: ["rpc", "calls", index, "app"], message: "An app cannot declare an RPC call to itself" });
+    } else if (!dependencies.has(call.app)) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["rpc", "calls", index, "app"],
+        message: `${call.app} is called over RPC, so it must be in dependencies. Add { "app": "${call.app}" } to dependencies; if your Qinto CLI rejects that field, upgrade it.`
+      });
     }
   }
 }, "validateRpc");
+var validateDependencies = /* @__PURE__ */ __name((manifest, ctx) => {
+  const dependencies = manifest.dependencies ?? [];
+  uniqueOrIssue(
+    ctx,
+    dependencies.map((dependency) => dependency.app),
+    ["dependencies"],
+    "dependency"
+  );
+  for (const [index, dependency] of dependencies.entries()) {
+    if (dependency.app === manifest.slug) {
+      ctx.addIssue({ code: "custom", path: ["dependencies", index, "app"], message: "An app cannot depend on itself" });
+    }
+  }
+}, "validateDependencies");
 var validateServer = /* @__PURE__ */ __name((manifest, ctx) => {
   uniqueOrIssue(ctx, manifest.server.hooks.transform, ["server", "hooks", "transform"], "transform hook");
   uniqueOrIssue(ctx, manifest.server.hooks.onEvent, ["server", "hooks", "onEvent"], "event hook");
@@ -21483,6 +21508,7 @@ var appManifestSchema = baseSchema.superRefine((manifest, ctx) => {
   validateEndpoints(manifest, ctx);
   validateCapture(manifest, ctx);
   validateBrowserHooks(manifest, ctx);
+  validateDependencies(manifest, ctx);
   validateRpc(manifest, ctx);
   validateEvents(manifest, ctx);
   validateOauth(manifest, ctx);
@@ -21511,9 +21537,47 @@ var storageLinkBindingName = /* @__PURE__ */ __name((domainId) => {
 }, "storageLinkBindingName");
 var MAX_APPS_Q_BYTES = 4 * 1024 * 1024;
 
+// ../../libs/app-envelope/src/geo.ts
+var cfString = external_exports.string().optional().catch(void 0);
+var requestGeoSchema = external_exports.object({
+  country: cfString,
+  city: cfString,
+  region: cfString,
+  regionCode: cfString,
+  timezone: cfString,
+  postalCode: cfString,
+  continent: cfString,
+  latitude: cfString,
+  longitude: cfString,
+  isEUCountry: cfString,
+  botManagement: external_exports.object({
+    ja4: cfString,
+    ja3Hash: cfString,
+    score: external_exports.number().optional().catch(void 0),
+    verifiedBot: external_exports.boolean().optional().catch(void 0)
+  }).optional().catch(void 0)
+});
+var userGeoSchema = external_exports.object({
+  ip: external_exports.string().optional(),
+  userAgent: external_exports.string().optional(),
+  timezone: external_exports.string().optional(),
+  city: external_exports.string().optional(),
+  postalCode: external_exports.string().optional(),
+  region: external_exports.string().optional(),
+  regionCode: external_exports.string().optional(),
+  country: external_exports.string().optional(),
+  continent: external_exports.string().optional(),
+  isEUCountry: external_exports.string().optional(),
+  latitude: external_exports.string().optional(),
+  longitude: external_exports.string().optional(),
+  ja4: external_exports.string().optional(),
+  ja3: external_exports.string().optional(),
+  botScore: external_exports.string().optional()
+});
+
 // ../../libs/app-envelope/src/envelope.ts
 var ENVELOPE_VERSION = 3;
-var ENVELOPE_ERROR_CODES = ["invalid_arguments"];
+var ENVELOPE_ERROR_CODES = ["invalid_arguments", "result_too_large", "callee_timeout", "rpc_error"];
 var MAX_INSTALLS_PER_APP = 15;
 var MAX_APPS_PER_DOMAIN = 50;
 var MAX_EMITS_PER_INSTALL = 10;
@@ -21529,6 +21593,7 @@ var MAX_SHARED_CONTEXT_ENTRY_BYTES = 4 * 1024;
 var MAX_PUSH_BYTES = 16 * 1024;
 var MAX_RESPONSE_BYTES = 1024 * 1024;
 var MAX_RPC_BYTES = 128 * 1024;
+var TRAFFIC_CLASSES = ["hot", "cold"];
 var installSchema = external_exports.object({ id: external_exports.string().min(1).max(64), ord: external_exports.number().int().min(1), label: external_exports.string().max(100) }).strict();
 var installRuleSchema = external_exports.object({
   mode: external_exports.enum(["except", "only"]),
@@ -21588,11 +21653,21 @@ var envelopeRequestSchema = external_exports.object({
     anonId: external_exports.string().min(1).max(64),
     globalId: external_exports.string().min(1).max(64).nullable(),
     createdAt: external_exports.number().int().optional(),
-    properties: external_exports.record(external_exports.string(), external_exports.unknown()),
-    geo: external_exports.record(external_exports.string(), external_exports.string()).optional()
+    properties: external_exports.record(external_exports.string(), external_exports.string()),
+    geo: userGeoSchema.optional()
   }).strict().optional(),
-  consent: external_exports.object({ enabled: external_exports.boolean(), categories: external_exports.record(external_exports.string(), external_exports.boolean()), apps: external_exports.record(external_exports.string(), external_exports.boolean()) }).strict().optional(),
-  geo: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
+  consent: external_exports.object({
+    enabled: external_exports.boolean(),
+    categories: external_exports.object({
+      necessary: external_exports.literal(true),
+      functional: external_exports.boolean(),
+      analytics: external_exports.boolean(),
+      marketing: external_exports.boolean(),
+      salesOfData: external_exports.boolean()
+    }),
+    apps: external_exports.record(external_exports.string(), external_exports.boolean())
+  }).strict().optional(),
+  geo: requestGeoSchema.optional(),
   // Connect envelopes only: the page the visitor's socket opened from, and the visit session it joined.
   page: pageSchema.optional(),
   session: sessionSchema.optional(),
@@ -21603,7 +21678,15 @@ var envelopeRequestSchema = external_exports.object({
   context: external_exports.object({ private: contextEntrySchema.optional(), shared: external_exports.record(external_exports.string().min(1).max(30), contextEntrySchema).optional() }).strict().optional(),
   // RPC depth is capped at 3 by the broker; hook depth at 2 by the emit path.
   depth: external_exports.number().int().min(0).max(3),
-  rpc: external_exports.object({ caller: external_exports.string().min(1).max(30).nullable(), fn: external_exports.string().min(1).max(64), args: external_exports.unknown() }).strict().refine((rpc) => {
+  rpc: external_exports.object({
+    caller: external_exports.string().min(1).max(30).nullable(),
+    fn: external_exports.string().min(1).max(64),
+    args: external_exports.unknown(),
+    // Optional on the wire: a site worker predating traffic classes sends none, which means hot.
+    traffic: external_exports.enum(TRAFFIC_CLASSES).optional(),
+    // Cold calls only: the broker mints it so the callee can query its own catalog.
+    queryTicket: external_exports.string().min(1).max(2048).optional()
+  }).strict().refine((rpc) => {
     return new TextEncoder().encode(JSON.stringify(rpc.args ?? null)).length <= MAX_RPC_BYTES;
   }, "RPC args exceed the size cap").optional(),
   action: external_exports.object({
@@ -21900,7 +21983,7 @@ var endpointContextSchema = external_exports.object({
   method: external_exports.enum(["GET", "POST", "PUT", "PATCH", "DELETE"]),
   mode: external_exports.enum(["webhook", "api"]),
   version: external_exports.string().min(1).max(32),
-  geo: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
+  geo: requestGeoSchema.optional(),
   installs: external_exports.array(installSchema3).min(1).max(15),
   user: external_exports.object({ anonId: external_exports.string().min(1).max(64) }).strict().optional()
 }).strict().refine((context) => {
@@ -26495,6 +26578,207 @@ var constantTimeEqual = /* @__PURE__ */ __name((expected, presented) => {
   return expectedBytes.length === presentedBytes.length && timingSafeEqual(expectedBytes, presentedBytes);
 }, "constantTimeEqual");
 
+// src/helpers/durable.ts
+var ownGraphEnv = /* @__PURE__ */ __name((ctx, env) => {
+  const exports = ctx.exports;
+  return {
+    ...env,
+    get ANON_DO() {
+      return exports.AnonDO;
+    },
+    get GLOBAL_DO() {
+      return exports.GlobalDO;
+    },
+    get ALIAS_DO() {
+      return exports.AliasDO;
+    }
+  };
+}, "ownGraphEnv");
+var JURISDICTIONS = /* @__PURE__ */ new Set(["eu", "fedramp", "fedramp-high", "us"]);
+var LOCATION_HINTS = /* @__PURE__ */ new Set([
+  "wnam",
+  "enam",
+  "sam",
+  "weur",
+  "eeur",
+  "apac",
+  "apac-ne",
+  "apac-se",
+  "oc",
+  "afr",
+  "me"
+]);
+var residencyStub = /* @__PURE__ */ __name((namespace, env, name) => {
+  const residency = env;
+  const jurisdiction = residency.DO_JURISDICTION;
+  const scoped = jurisdiction !== void 0 && JURISDICTIONS.has(jurisdiction) ? namespace.jurisdiction(jurisdiction) : namespace;
+  const locationHint = residency.LOCATION_HINT;
+  const options = locationHint !== void 0 && LOCATION_HINTS.has(locationHint) ? { locationHint } : void 0;
+  return scoped.get(scoped.idFromName(name), options);
+}, "residencyStub");
+
+// src/id-graph/anon/client.ts
+var anonStub = /* @__PURE__ */ __name((env, anonId) => {
+  return residencyStub(env.ANON_DO, env, anonId);
+}, "anonStub");
+
+// src/id-graph/consent.ts
+var CONSENT_CATEGORIES2 = ["necessary", "functional", "analytics", "marketing", "salesOfData"];
+var CONSENT_CATEGORY_PREFIX = "consent.category.";
+var CONSENT_APP_PREFIX = "consent.app.";
+var consentEntries = /* @__PURE__ */ __name((payload, observedAt) => {
+  const entries = [];
+  for (const category of CONSENT_CATEGORIES2) {
+    const granted = payload.categories[category];
+    if (granted === void 0) {
+      continue;
+    }
+    entries.push({ key: `${CONSENT_CATEGORY_PREFIX}${category}`, value: String(granted), observedAt });
+  }
+  for (const [appId, granted] of Object.entries(payload.apps)) {
+    entries.push({ key: `${CONSENT_APP_PREFIX}${appId}`, value: String(granted), observedAt });
+  }
+  return entries;
+}, "consentEntries");
+
+// src/id-graph/projections.ts
+var PII_PREFIX = "pii.";
+var CUSTOM_PREFIX = "custom.";
+var GEO_PREFIX = "geo.";
+var PROJECTION_KINDS = ["pii", "custom", "consent_category", "consent_app", "geo"];
+var PROJECTION_PREFIX = {
+  pii: PII_PREFIX,
+  custom: CUSTOM_PREFIX,
+  consent_category: CONSENT_CATEGORY_PREFIX,
+  consent_app: CONSENT_APP_PREFIX,
+  geo: GEO_PREFIX
+};
+var FANOUT_KINDS = ["pii", "custom", "consent_category", "consent_app"];
+var projectionFact = /* @__PURE__ */ __name((projectionKey) => {
+  for (const kind2 of PROJECTION_KINDS) {
+    const prefix = PROJECTION_PREFIX[kind2];
+    if (projectionKey.startsWith(prefix)) {
+      return { kind: kind2, scope: "", key: projectionKey.slice(prefix.length) };
+    }
+  }
+  throw new Error(`Unknown projection key: ${projectionKey}`);
+}, "projectionFact");
+
+// src/id-graph/anon/facts.ts
+var FACT_KINDS = [
+  ...PROJECTION_KINDS,
+  "capture",
+  "identifier",
+  "conversion",
+  "context_private_kv",
+  "context_private_text",
+  "context_shared_kv",
+  "context_shared_text"
+];
+var APP_FACT_KINDS = ["custom", "capture", "identifier", "conversion", "pii", "consent_category", "consent_app", "geo"];
+var MAX_APP_FACTS_PER_PAGE = 100;
+var MAX_APP_FACT_PAGE_BYTES = 1024 * 1024;
+var COLUMNS = "kind, scope, key, value, source, type, amount, currency, event_id, data_json, first_at, observed_at, synced_at, expires_at";
+var rowOf = /* @__PURE__ */ __name((row) => {
+  return {
+    kind: row.kind,
+    scope: row.scope,
+    key: row.key,
+    value: row.value,
+    source: row.source,
+    type: row.type,
+    amount: row.amount,
+    currency: row.currency,
+    eventId: row.event_id,
+    dataJson: row.data_json,
+    firstAt: row.first_at,
+    observedAt: row.observed_at,
+    syncedAt: row.synced_at,
+    expiresAt: row.expires_at
+  };
+}, "rowOf");
+var appFactOf = /* @__PURE__ */ __name((row) => {
+  const { syncedAt: _syncedAt, expiresAt: _expiresAt, ...fact } = rowOf(row);
+  return { ...fact, kind: fact.kind };
+}, "appFactOf");
+var listAppFacts = /* @__PURE__ */ __name((sql, query, now) => {
+  const maxRowId = query.maxRowId ?? sql.exec("SELECT MAX(rowid) AS maxRowId FROM facts").one().maxRowId;
+  if (maxRowId === null) {
+    return { items: [], next: null };
+  }
+  const where = ["rowid > ?", "rowid <= ?", "(expires_at IS NULL OR expires_at > ?)"];
+  const params = [query.afterRowId, maxRowId, now];
+  if (query.kinds.length > 0) {
+    where.push(`kind IN (${query.kinds.map(() => "?").join(", ")})`);
+    params.push(...query.kinds);
+  }
+  if (query.observedAtGte !== null) {
+    where.push("observed_at >= ?");
+    params.push(query.observedAtGte);
+  }
+  if (query.observedAtLt !== null) {
+    where.push("observed_at < ?");
+    params.push(query.observedAtLt);
+  }
+  const rows = sql.exec(`SELECT rowid, ${COLUMNS} FROM facts WHERE ${where.join(" AND ")} ORDER BY rowid LIMIT ?`, ...params, query.limit + 1).toArray();
+  const items = [];
+  let lastRowId = query.afterRowId;
+  for (const row of rows.slice(0, query.limit)) {
+    const fact = appFactOf(row);
+    const candidate = [...items, fact];
+    if (new TextEncoder().encode(JSON.stringify(candidate)).byteLength > MAX_APP_FACT_PAGE_BYTES) {
+      if (items.length === 0) {
+        throw new Error("fact_too_large");
+      }
+      break;
+    }
+    items.push(fact);
+    lastRowId = row.rowid;
+  }
+  const hasMore = rows.length > items.length;
+  return { items, next: hasMore ? { afterRowId: lastRowId, maxRowId } : null };
+}, "listAppFacts");
+var insertFact = /* @__PURE__ */ __name((sql, fact) => {
+  sql.exec(
+    `INSERT INTO facts (${COLUMNS}) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, ?)`,
+    fact.kind,
+    fact.scope,
+    fact.key,
+    fact.value ?? null,
+    fact.source ?? null,
+    fact.type ?? null,
+    fact.amount ?? null,
+    fact.currency ?? null,
+    fact.eventId ?? null,
+    fact.dataJson ?? null,
+    fact.firstAt ?? null,
+    fact.observedAt,
+    fact.expiresAt ?? null
+  );
+}, "insertFact");
+var latestFact = /* @__PURE__ */ __name((sql, coords) => {
+  const row = sql.exec(
+    `SELECT ${COLUMNS} FROM facts WHERE kind = ? AND scope = ? AND key = ? ORDER BY observed_at DESC, rowid DESC LIMIT 1`,
+    coords.kind,
+    coords.scope,
+    coords.key
+  ).toArray().at(0);
+  return row === void 0 ? void 0 : rowOf(row);
+}, "latestFact");
+var latestFacts = /* @__PURE__ */ __name((sql, kind2) => {
+  const rows = sql.exec(`SELECT ${COLUMNS} FROM facts WHERE kind = ? ORDER BY scope, key, observed_at, rowid`, kind2).toArray();
+  const latest = [];
+  for (const row of rows) {
+    const previous = latest.at(-1);
+    if (previous !== void 0 && previous.scope === row.scope && previous.key === row.key) {
+      latest[latest.length - 1] = rowOf(row);
+      continue;
+    }
+    latest.push(rowOf(row));
+  }
+  return latest;
+}, "latestFacts");
+
 // src/apps/consent-gate.ts
 var parseEnforced = /* @__PURE__ */ __name((raw2) => {
   let parsed;
@@ -26577,6 +26861,9 @@ var appSchema = external_exports.object({
   // Absent from an old embedded registry; the default never equals a real claim, so the ui proxy
   // refuses stale registries with token_stale instead of turning the app off.
   versionId: external_exports.string().min(1).default(""),
+  // Absent from a registry deployed before cold rpc calls carried a query ticket; without it the
+  // broker sends the callee none.
+  appId: external_exports.string().min(1).optional(),
   consent: external_exports.object({ category: external_exports.string() }),
   // Plain strings, not the bucket enum: an unknown bucket from a newer registry must not turn apps off.
   data: external_exports.array(external_exports.string()).default([]),
@@ -26663,210 +26950,6 @@ var siteRefOf = /* @__PURE__ */ __name(({ domainId, fingerprint }) => {
   return { domainId, fingerprint };
 }, "siteRefOf");
 
-// ../../libs/cf-data/src/cf-data.ts
-var CF_DATA_HEADER = "x-cf-data";
-var parseCfData = /* @__PURE__ */ __name((raw2) => {
-  if (raw2 === null) {
-    return void 0;
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw2);
-  } catch {
-    return void 0;
-  }
-  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-    return void 0;
-  }
-  return parsed;
-}, "parseCfData");
-
-// src/helpers/geo.ts
-var UNDETERMINED_COUNTRIES = /* @__PURE__ */ new Set(["XX", "T1"]);
-var detectedCountry = /* @__PURE__ */ __name((cf) => {
-  const country = cf?.country;
-  return country && !UNDETERMINED_COUNTRIES.has(country) ? country : void 0;
-}, "detectedCountry");
-var euCountry = /* @__PURE__ */ __name((cf, country) => {
-  if (cf?.isEUCountry === "1") {
-    return "yes";
-  }
-  return country ? "no" : "unknown";
-}, "euCountry");
-var withForwardedCf = /* @__PURE__ */ __name((request) => {
-  if (request.cf !== void 0) {
-    return request;
-  }
-  const cf = parseCfData(request.headers.get(CF_DATA_HEADER));
-  return cf === void 0 ? request : new Request(request, { cf });
-}, "withForwardedCf");
-var loggableGeo = /* @__PURE__ */ __name((geo) => {
-  const fields = {};
-  for (const [key, value] of Object.entries(geo)) {
-    if (value !== void 0) {
-      fields[key] = String(value);
-    }
-  }
-  return fields;
-}, "loggableGeo");
-var hostFromRequest = /* @__PURE__ */ __name((request) => {
-  return {
-    ip: request.headers.get("cf-connecting-ip") ?? void 0,
-    userAgent: request.headers.get("user-agent") ?? void 0,
-    locale: request.headers.get("accept-language")?.split(",")[0]?.trim() || void 0
-  };
-}, "hostFromRequest");
-var geoFromCf = /* @__PURE__ */ __name((cf) => {
-  const bot = cf?.botManagement;
-  const country = detectedCountry(cf);
-  return {
-    timezone: cf?.timezone ?? void 0,
-    city: cf?.city ?? void 0,
-    postalCode: cf?.postalCode ?? void 0,
-    region: cf?.region ?? void 0,
-    regionCode: cf?.regionCode ?? void 0,
-    country,
-    continent: cf?.continent ?? void 0,
-    isEUCountry: euCountry(cf, country),
-    latitude: cf?.latitude ?? void 0,
-    longitude: cf?.longitude ?? void 0,
-    ja4: bot?.ja4,
-    ja3: bot?.ja3Hash,
-    botScore: bot?.score
-  };
-}, "geoFromCf");
-var geoFromRequest = /* @__PURE__ */ __name((request) => {
-  return {
-    ...hostFromRequest(request),
-    ...geoFromCf(request.cf)
-  };
-}, "geoFromRequest");
-
-// src/helpers/durable.ts
-var ownGraphEnv = /* @__PURE__ */ __name((ctx, env) => {
-  const exports = ctx.exports;
-  return {
-    ...env,
-    get ANON_DO() {
-      return exports.AnonDO;
-    },
-    get GLOBAL_DO() {
-      return exports.GlobalDO;
-    },
-    get ALIAS_DO() {
-      return exports.AliasDO;
-    }
-  };
-}, "ownGraphEnv");
-var JURISDICTIONS = /* @__PURE__ */ new Set(["eu", "fedramp", "fedramp-high", "us"]);
-var LOCATION_HINTS = /* @__PURE__ */ new Set([
-  "wnam",
-  "enam",
-  "sam",
-  "weur",
-  "eeur",
-  "apac",
-  "apac-ne",
-  "apac-se",
-  "oc",
-  "afr",
-  "me"
-]);
-var residencyStub = /* @__PURE__ */ __name((namespace, env, name) => {
-  const residency = env;
-  const jurisdiction = residency.DO_JURISDICTION;
-  const scoped = jurisdiction !== void 0 && JURISDICTIONS.has(jurisdiction) ? namespace.jurisdiction(jurisdiction) : namespace;
-  const locationHint = residency.LOCATION_HINT;
-  const options = locationHint !== void 0 && LOCATION_HINTS.has(locationHint) ? { locationHint } : void 0;
-  return scoped.get(scoped.idFromName(name), options);
-}, "residencyStub");
-
-// src/id-graph/anon/client.ts
-var anonStub = /* @__PURE__ */ __name((env, anonId) => {
-  return residencyStub(env.ANON_DO, env, anonId);
-}, "anonStub");
-
-// src/id-graph/consent.ts
-var CONSENT_CATEGORIES2 = ["necessary", "functional", "analytics", "marketing", "salesOfData"];
-var CONSENT_CATEGORY_PREFIX = "consent.category.";
-var CONSENT_APP_PREFIX = "consent.app.";
-var consentEntries = /* @__PURE__ */ __name((payload, observedAt) => {
-  const entries = [];
-  for (const category of CONSENT_CATEGORIES2) {
-    const granted = payload.categories[category];
-    if (granted === void 0) {
-      continue;
-    }
-    entries.push({ key: `${CONSENT_CATEGORY_PREFIX}${category}`, value: String(granted), observedAt });
-  }
-  for (const [appId, granted] of Object.entries(payload.apps)) {
-    entries.push({ key: `${CONSENT_APP_PREFIX}${appId}`, value: String(granted), observedAt });
-  }
-  return entries;
-}, "consentEntries");
-
-// src/id-graph/traits.ts
-var PII_KEYS = ["first_name", "last_name", "email", "phone", "country", "state", "city", "postal_code"];
-var snakeCase = /* @__PURE__ */ __name((key) => {
-  return key.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase();
-}, "snakeCase");
-var stringifyTrait = /* @__PURE__ */ __name((value) => {
-  return typeof value === "string" ? value : JSON.stringify(value);
-}, "stringifyTrait");
-var piiTrait = /* @__PURE__ */ __name((key, rawValue) => {
-  if (key !== "email" && key !== "phone") {
-    return stringifyTrait(rawValue);
-  }
-  if (typeof rawValue !== "string") {
-    return void 0;
-  }
-  return (key === "email" ? emailIdentifier(rawValue) : phoneIdentifier(rawValue))?.value;
-}, "piiTrait");
-var resolvePiiTrait = /* @__PURE__ */ __name((key, rawValue, unset) => {
-  return unset ? null : piiTrait(key, rawValue);
-}, "resolvePiiTrait");
-var classifyTraits = /* @__PURE__ */ __name((traits, observedAt) => {
-  const classified = { pii: {}, custom: {}, latest: [], dropped: [] };
-  for (const [rawKey, rawValue] of Object.entries(traits)) {
-    const key = snakeCase(rawKey);
-    const unset = rawValue === null || rawValue === void 0;
-    if (PII_KEYS.includes(key)) {
-      const value2 = resolvePiiTrait(key, rawValue, unset);
-      if (value2 === void 0) {
-        classified.dropped.push(key);
-        continue;
-      }
-      classified.pii[key] = value2;
-      classified.latest.push({ key: `pii.${key}`, value: value2, observedAt });
-      continue;
-    }
-    const value = unset ? null : stringifyTrait(rawValue);
-    classified.custom[key] = value;
-    classified.latest.push({ key: `custom.${key}`, value, observedAt });
-  }
-  return classified;
-}, "classifyTraits");
-var conversionFromTrack = /* @__PURE__ */ __name((payload) => {
-  const amount = payload.properties["value"];
-  if (typeof amount !== "number" || !Number.isFinite(amount)) {
-    return void 0;
-  }
-  const orderId = payload.properties["orderId"];
-  if (typeof orderId !== "string" || orderId === "") {
-    return void 0;
-  }
-  const currency = payload.properties["currency"];
-  const contents = payload.properties["contents"];
-  return {
-    eventName: payload.event,
-    eventId: payload.eventId,
-    orderId,
-    amount,
-    currency: typeof currency === "string" ? currency : null,
-    contents: contents === void 0 ? null : JSON.stringify(contents)
-  };
-}, "conversionFromTrack");
-
 // src/id-graph/alias/client.ts
 var sha256Hex = /* @__PURE__ */ __name(async (value) => {
   const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
@@ -26902,291 +26985,6 @@ var claimPair = /* @__PURE__ */ __name(async (env, identifier, globalId, anonId)
   });
 }, "claimPair");
 
-// src/id-graph/user.ts
-var EDGETAG_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}-[0-9]{13}$/;
-var isEdgeTagId = /* @__PURE__ */ __name((id) => {
-  return EDGETAG_ID.test(id);
-}, "isEdgeTagId");
-var isCanonicalId = /* @__PURE__ */ __name((id) => {
-  return id.startsWith("anon_") || isEdgeTagId(id);
-}, "isCanonicalId");
-var generateUserId = /* @__PURE__ */ __name(() => {
-  return `anon_${crypto.randomUUID()}`;
-}, "generateUserId");
-var restoreUser = /* @__PURE__ */ __name(async (env, cookie, candidate) => {
-  if (cookie === void 0) {
-    return candidate;
-  }
-  const assignment = await claimFallbackAnon(env, cookie, candidate);
-  setSpanAttributes({ "qinto.fallback_restored": assignment.anonId !== candidate });
-  return assignment.anonId;
-}, "restoreUser");
-var resolveUser = /* @__PURE__ */ __name(async (env, id) => {
-  if (isCanonicalId(id)) {
-    return { id };
-  }
-  const identifier = classifyIdentifier(id);
-  const assignment = await claimAnon(env, identifier, generateUserId());
-  return { id: assignment.anonId, identifier };
-}, "resolveUser");
-var resolveExistingUser = /* @__PURE__ */ __name(async (env, id) => {
-  if (isCanonicalId(id)) {
-    return { id };
-  }
-  const identifier = classifyIdentifier(id);
-  const anonId = (await getAssignment(env, identifier))?.anonId ?? null;
-  return anonId === null ? null : { id: anonId, identifier };
-}, "resolveExistingUser");
-var lookupUser = /* @__PURE__ */ __name(async (env, id) => {
-  if (isCanonicalId(id)) {
-    const globalId = await traced("rpc anon.get_global_id", {}, () => {
-      return anonStub(env, id).getGlobalId(currentTraceContext());
-    });
-    return { anonId: id, globalId };
-  }
-  const assignment = await getAssignment(env, classifyIdentifier(id));
-  return { anonId: assignment?.anonId ?? null, globalId: assignment?.globalId ?? null };
-}, "lookupUser");
-
-// src/id-graph/noop.ts
-var isNoopConsent = /* @__PURE__ */ __name((payload) => {
-  return consentEntries(payload, 0).length === 0;
-}, "isNoopConsent");
-var isNoopIdentify = /* @__PURE__ */ __name((traits) => {
-  return Object.keys(traits).length === 0;
-}, "isNoopIdentify");
-var isNoopSubmission = /* @__PURE__ */ __name((userId, args) => {
-  if (args.type === "consent") {
-    return isNoopConsent(args.payload);
-  }
-  if (args.type === "identify") {
-    return isCanonicalId(userId) && isNoopIdentify(args.payload.traits);
-  }
-  return false;
-}, "isNoopSubmission");
-var isNoopAction = /* @__PURE__ */ __name((action) => {
-  if (action.identifier !== void 0) {
-    return false;
-  }
-  return action.type === "consent" && isNoopConsent(action.payload);
-}, "isNoopAction");
-var isDeliveryOnlyAction = /* @__PURE__ */ __name((action) => {
-  if (action.identifier !== void 0 || action.type === "consent") {
-    return false;
-  }
-  return action.type === "track" ? conversionFromTrack(action.payload) === void 0 : isNoopIdentify(action.payload.traits);
-}, "isDeliveryOnlyAction");
-
-// src/id-graph/action.ts
-var UnknownUserError = class extends Error {
-  static {
-    __name(this, "UnknownUserError");
-  }
-  constructor() {
-    super("the identifier resolves to no user");
-    this.name = "UnknownUserError";
-  }
-};
-var mintActionId = /* @__PURE__ */ __name(() => {
-  return `act_${ulid3()}`;
-}, "mintActionId");
-var buildAction = /* @__PURE__ */ __name((args) => {
-  const receivedAt = args.receivedAt ?? Date.now();
-  return {
-    ...args,
-    actionId: mintActionId(),
-    receivedAt
-  };
-}, "buildAction");
-var ingest = /* @__PURE__ */ __name(async (env, action, site = ownSite(env)) => {
-  await traced("rpc anon.ingest", {}, () => {
-    return anonStub(env, action.userId).ingest(action, site, currentTraceContext());
-  });
-}, "ingest");
-var serverActionContext = /* @__PURE__ */ __name((input2, receivedAt) => {
-  const network = input2?.network;
-  return {
-    source: "server",
-    occurredAt: input2?.occurredAt ?? receivedAt,
-    ...input2?.page === void 0 ? {} : { page: input2.page },
-    ...network === void 0 || network.ip === void 0 && network.userAgent === void 0 && network.locale === void 0 ? {} : { network: { ...network, provenance: "caller" } },
-    ...input2?.session === void 0 ? {} : { session: input2.session },
-    offline: input2?.offline ?? false,
-    replay: input2?.replay ?? false
-  };
-}, "serverActionContext");
-var submitAction = /* @__PURE__ */ __name(async (env, userId, args, request) => {
-  const attrs = {
-    "action.type": args.type,
-    "action.payload": JSON.stringify(args.payload),
-    "action.identifier": userId,
-    ...args.type === "track" ? { "action.event": args.payload.event } : {}
-  };
-  return traced(`action ${args.type}`, { attrs }, async () => {
-    if (isNoopSubmission(userId, args)) {
-      setSpanAttributes({ "action.noop": true, ...isCanonicalId(userId) ? { "action.user_id": userId } : {} });
-      return mintActionId();
-    }
-    const resolved = await traced("resolve_user", {}, () => {
-      return args.type === "track" ? resolveExistingUser(env, userId) : resolveUser(env, userId);
-    });
-    if (resolved === null) {
-      throw new UnknownUserError();
-    }
-    const receivedAt = Date.now();
-    const action = buildAction({
-      ...args,
-      userId: resolved.id,
-      identifier: resolved.identifier,
-      receivedAt,
-      context: serverActionContext(args.context, receivedAt),
-      geo: request?.cf,
-      host: request === void 0 ? void 0 : hostFromRequest(request)
-    });
-    setSpanAttributes({ "action.user_id": resolved.id, "action.id": action.actionId });
-    await ingest(env, action);
-    return action.actionId;
-  });
-}, "submitAction");
-
-// src/id-graph/projections.ts
-var PII_PREFIX = "pii.";
-var CUSTOM_PREFIX = "custom.";
-var GEO_PREFIX = "geo.";
-var PROJECTION_KINDS = ["pii", "custom", "consent_category", "consent_app", "geo"];
-var PROJECTION_PREFIX = {
-  pii: PII_PREFIX,
-  custom: CUSTOM_PREFIX,
-  consent_category: CONSENT_CATEGORY_PREFIX,
-  consent_app: CONSENT_APP_PREFIX,
-  geo: GEO_PREFIX
-};
-var FANOUT_KINDS = ["pii", "custom", "consent_category", "consent_app"];
-var projectionFact = /* @__PURE__ */ __name((projectionKey) => {
-  for (const kind2 of PROJECTION_KINDS) {
-    const prefix = PROJECTION_PREFIX[kind2];
-    if (projectionKey.startsWith(prefix)) {
-      return { kind: kind2, scope: "", key: projectionKey.slice(prefix.length) };
-    }
-  }
-  throw new Error(`Unknown projection key: ${projectionKey}`);
-}, "projectionFact");
-
-// src/id-graph/anon/facts.ts
-var FACT_KINDS = [
-  ...PROJECTION_KINDS,
-  "capture",
-  "identifier",
-  "conversion",
-  "context_private_kv",
-  "context_private_text",
-  "context_shared_kv",
-  "context_shared_text"
-];
-var APP_FACT_KINDS = ["custom", "capture", "identifier", "conversion", "pii", "consent_category", "consent_app", "geo"];
-var MAX_APP_FACTS_PER_PAGE = 100;
-var MAX_APP_FACT_PAGE_BYTES = 1024 * 1024;
-var COLUMNS = "kind, scope, key, value, source, type, amount, currency, event_id, data_json, first_at, observed_at, synced_at, expires_at";
-var rowOf = /* @__PURE__ */ __name((row) => {
-  return {
-    kind: row.kind,
-    scope: row.scope,
-    key: row.key,
-    value: row.value,
-    source: row.source,
-    type: row.type,
-    amount: row.amount,
-    currency: row.currency,
-    eventId: row.event_id,
-    dataJson: row.data_json,
-    firstAt: row.first_at,
-    observedAt: row.observed_at,
-    syncedAt: row.synced_at,
-    expiresAt: row.expires_at
-  };
-}, "rowOf");
-var appFactOf = /* @__PURE__ */ __name((row) => {
-  const { syncedAt: _syncedAt, expiresAt: _expiresAt, ...fact } = rowOf(row);
-  return { ...fact, kind: fact.kind };
-}, "appFactOf");
-var listAppFacts = /* @__PURE__ */ __name((sql, query, now) => {
-  const maxRowId = query.maxRowId ?? sql.exec("SELECT MAX(rowid) AS maxRowId FROM facts").one().maxRowId;
-  if (maxRowId === null) {
-    return { items: [], next: null };
-  }
-  const where = ["rowid > ?", "rowid <= ?", "(expires_at IS NULL OR expires_at > ?)"];
-  const params = [query.afterRowId, maxRowId, now];
-  if (query.kinds.length > 0) {
-    where.push(`kind IN (${query.kinds.map(() => "?").join(", ")})`);
-    params.push(...query.kinds);
-  }
-  if (query.observedAtGte !== null) {
-    where.push("observed_at >= ?");
-    params.push(query.observedAtGte);
-  }
-  if (query.observedAtLt !== null) {
-    where.push("observed_at < ?");
-    params.push(query.observedAtLt);
-  }
-  const rows = sql.exec(`SELECT rowid, ${COLUMNS} FROM facts WHERE ${where.join(" AND ")} ORDER BY rowid LIMIT ?`, ...params, query.limit + 1).toArray();
-  const items = [];
-  let lastRowId = query.afterRowId;
-  for (const row of rows.slice(0, query.limit)) {
-    const fact = appFactOf(row);
-    const candidate = [...items, fact];
-    if (new TextEncoder().encode(JSON.stringify(candidate)).byteLength > MAX_APP_FACT_PAGE_BYTES) {
-      if (items.length === 0) {
-        throw new Error("fact_too_large");
-      }
-      break;
-    }
-    items.push(fact);
-    lastRowId = row.rowid;
-  }
-  const hasMore = rows.length > items.length;
-  return { items, next: hasMore ? { afterRowId: lastRowId, maxRowId } : null };
-}, "listAppFacts");
-var insertFact = /* @__PURE__ */ __name((sql, fact) => {
-  sql.exec(
-    `INSERT INTO facts (${COLUMNS}) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, ?)`,
-    fact.kind,
-    fact.scope,
-    fact.key,
-    fact.value ?? null,
-    fact.source ?? null,
-    fact.type ?? null,
-    fact.amount ?? null,
-    fact.currency ?? null,
-    fact.eventId ?? null,
-    fact.dataJson ?? null,
-    fact.firstAt ?? null,
-    fact.observedAt,
-    fact.expiresAt ?? null
-  );
-}, "insertFact");
-var latestFact = /* @__PURE__ */ __name((sql, coords) => {
-  const row = sql.exec(
-    `SELECT ${COLUMNS} FROM facts WHERE kind = ? AND scope = ? AND key = ? ORDER BY observed_at DESC, rowid DESC LIMIT 1`,
-    coords.kind,
-    coords.scope,
-    coords.key
-  ).toArray().at(0);
-  return row === void 0 ? void 0 : rowOf(row);
-}, "latestFact");
-var latestFacts = /* @__PURE__ */ __name((sql, kind2) => {
-  const rows = sql.exec(`SELECT ${COLUMNS} FROM facts WHERE kind = ? ORDER BY scope, key, observed_at, rowid`, kind2).toArray();
-  const latest = [];
-  for (const row of rows) {
-    const previous = latest.at(-1);
-    if (previous !== void 0 && previous.scope === row.scope && previous.key === row.key) {
-      latest[latest.length - 1] = rowOf(row);
-      continue;
-    }
-    latest.push(rowOf(row));
-  }
-  return latest;
-}, "latestFacts");
-
 // src/id-graph/global/client.ts
 var globalStub = /* @__PURE__ */ __name((env, globalId) => {
   return residencyStub(env.GLOBAL_DO, env, globalId);
@@ -27255,14 +27053,60 @@ var linkedAnonsPage = /* @__PURE__ */ __name((sql, afterRowId, limit) => {
     anonIds.push(row.key);
     lastRowId = row.rowid;
   }
-  return { anonIds, next: hasMore ? lastRowId : null };
-}, "linkedAnonsPage");
-var linkedAnonsExcept = /* @__PURE__ */ __name((sql, originAnonId) => {
-  return sql.exec("SELECT key FROM facts WHERE kind = 'anon' AND key != ?", originAnonId).toArray().map((row) => row.key);
-}, "linkedAnonsExcept");
-var allLinkedAnons = /* @__PURE__ */ __name((sql) => {
-  return sql.exec("SELECT key FROM facts WHERE kind = 'anon' ORDER BY rowid").toArray().map((row) => row.key);
-}, "allLinkedAnons");
+  return { anonIds, next: hasMore ? lastRowId : null };
+}, "linkedAnonsPage");
+var linkedAnonsExcept = /* @__PURE__ */ __name((sql, originAnonId) => {
+  return sql.exec("SELECT key FROM facts WHERE kind = 'anon' AND key != ?", originAnonId).toArray().map((row) => row.key);
+}, "linkedAnonsExcept");
+var allLinkedAnons = /* @__PURE__ */ __name((sql) => {
+  return sql.exec("SELECT key FROM facts WHERE kind = 'anon' ORDER BY rowid").toArray().map((row) => row.key);
+}, "allLinkedAnons");
+
+// src/id-graph/user.ts
+var EDGETAG_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}-[0-9]{13}$/;
+var isEdgeTagId = /* @__PURE__ */ __name((id) => {
+  return EDGETAG_ID.test(id);
+}, "isEdgeTagId");
+var isCanonicalId = /* @__PURE__ */ __name((id) => {
+  return id.startsWith("anon_") || isEdgeTagId(id);
+}, "isCanonicalId");
+var generateUserId = /* @__PURE__ */ __name(() => {
+  return `anon_${crypto.randomUUID()}`;
+}, "generateUserId");
+var restoreUser = /* @__PURE__ */ __name(async (env, cookie, candidate) => {
+  if (cookie === void 0) {
+    return candidate;
+  }
+  const assignment = await claimFallbackAnon(env, cookie, candidate);
+  setSpanAttributes({ "qinto.fallback_restored": assignment.anonId !== candidate });
+  return assignment.anonId;
+}, "restoreUser");
+var resolveUser = /* @__PURE__ */ __name(async (env, id) => {
+  if (isCanonicalId(id)) {
+    return { id };
+  }
+  const identifier = classifyIdentifier(id);
+  const assignment = await claimAnon(env, identifier, generateUserId());
+  return { id: assignment.anonId, identifier };
+}, "resolveUser");
+var resolveExistingUser = /* @__PURE__ */ __name(async (env, id) => {
+  if (isCanonicalId(id)) {
+    return { id };
+  }
+  const identifier = classifyIdentifier(id);
+  const anonId = (await getAssignment(env, identifier))?.anonId ?? null;
+  return anonId === null ? null : { id: anonId, identifier };
+}, "resolveExistingUser");
+var lookupUser = /* @__PURE__ */ __name(async (env, id) => {
+  if (isCanonicalId(id)) {
+    const globalId = await traced("rpc anon.get_global_id", {}, () => {
+      return anonStub(env, id).getGlobalId(currentTraceContext());
+    });
+    return { anonId: id, globalId };
+  }
+  const assignment = await getAssignment(env, classifyIdentifier(id));
+  return { anonId: assignment?.anonId ?? null, globalId: assignment?.globalId ?? null };
+}, "lookupUser");
 
 // src/id-graph/person.ts
 var IDENTITY_CAPABILITY = "identity";
@@ -27377,86 +27221,348 @@ var parseCurrencyFeed = /* @__PURE__ */ __name((feed) => {
   if (rates === null) {
     return { ok: false, reason: "the rates literal does not parse" };
   }
-  if (rates["USD"] !== 1) {
-    return { ok: false, reason: "USD is not 1" };
+  if (rates["USD"] !== 1) {
+    return { ok: false, reason: "USD is not 1" };
+  }
+  const invalid = Object.entries(rates).find(([, rate]) => !Number.isFinite(rate) || rate <= 0);
+  if (invalid !== void 0) {
+    return { ok: false, reason: `${invalid[0]} is not a positive finite rate` };
+  }
+  const count = Object.keys(rates).length;
+  if (count < MIN_CURRENCY_CODES) {
+    return { ok: false, reason: `the feed has ${count} codes` };
+  }
+  return { ok: true, rates };
+}, "parseCurrencyFeed");
+var fetchCurrencyRates = /* @__PURE__ */ __name(async () => {
+  return traced("currency.fetch", { attrs: { "http.url": CURRENCY_FEED_URL } }, async () => {
+    let feed;
+    try {
+      const response = await fetch(CURRENCY_FEED_URL, {
+        signal: AbortSignal.timeout(FEED_TIMEOUT_MS),
+        cf: { cacheTtlByStatus: { "200-299": FEED_EDGE_CACHE_TTL_S, "300-599": 0 } }
+      });
+      if (!response.ok) {
+        addSpanEvent("currency fetch failed", { level: "error", attrs: { status: response.status } });
+        return null;
+      }
+      feed = await response.text();
+    } catch (error61) {
+      addSpanEvent("currency fetch failed", { level: "error", attrs: { error: String(error61) } });
+      return null;
+    }
+    const verdict = parseCurrencyFeed(feed);
+    if (!verdict.ok) {
+      addSpanEvent("currency feed rejected", { level: "error", attrs: { reason: verdict.reason } });
+      return null;
+    }
+    return verdict.rates;
+  });
+}, "fetchCurrencyRates");
+var refreshCurrencyRates = /* @__PURE__ */ __name(async () => {
+  const rates = await fetchCurrencyRates();
+  const now = Date.now();
+  if (rates === null) {
+    const current2 = currencyMemo?.current ?? null;
+    currencyMemo = { current: current2, nextAttemptAt: now + RETRY_AFTER_FAILURE_MS };
+    return current2;
+  }
+  const current = { rates, fetchedAt: now };
+  currencyMemo = { current, nextAttemptAt: now + RATES_TTL_MS };
+  return current;
+}, "refreshCurrencyRates");
+var currentCurrencyRates = /* @__PURE__ */ __name(async (ctx) => {
+  const now = Date.now();
+  if (currencyMemo !== void 0 && now < currencyMemo.nextAttemptAt) {
+    return currencyMemo.current;
+  }
+  const stale = currencyMemo?.current ?? null;
+  if (stale === null) {
+    return refreshCurrencyRates();
+  }
+  currencyMemo = { current: stale, nextAttemptAt: now + RETRY_AFTER_FAILURE_MS };
+  ctx.waitUntil(
+    runInvocation({ name: "currency.refresh", trace: currentTraceContext() }, () => {
+      return refreshCurrencyRates();
+    })
+  );
+  return stale;
+}, "currentCurrencyRates");
+
+// src/apps/broker-currency.ts
+var currencyRatesBody = external_exports.object({
+  ...identityFields,
+  kind: external_exports.literal("currencyRates")
+}).strict();
+var handleCurrencyRates = /* @__PURE__ */ __name(async (ctx) => {
+  const current = await currentCurrencyRates(ctx);
+  if (current === null) {
+    return Response.json({ error: "currency_rates_unavailable" }, { status: 503 });
+  }
+  return Response.json(current);
+}, "handleCurrencyRates");
+
+// ../../libs/cf-data/src/cf-data.ts
+var CF_DATA_HEADER = "x-cf-data";
+var cfDataFrom = /* @__PURE__ */ __name((cf) => {
+  return {
+    country: cf?.country,
+    city: cf?.city,
+    region: cf?.region,
+    regionCode: cf?.regionCode,
+    timezone: cf?.timezone,
+    postalCode: cf?.postalCode,
+    continent: cf?.continent,
+    longitude: cf?.longitude,
+    latitude: cf?.latitude,
+    isEUCountry: cf?.isEUCountry,
+    botManagement: {
+      ja4: cf?.botManagement?.ja4,
+      ja3Hash: cf?.botManagement?.ja3Hash,
+      score: cf?.botManagement?.score,
+      verifiedBot: cf?.botManagement?.verifiedBot
+    }
+  };
+}, "cfDataFrom");
+var parseCfData = /* @__PURE__ */ __name((raw2) => {
+  if (raw2 === null) {
+    return void 0;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw2);
+  } catch {
+    return void 0;
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    return void 0;
+  }
+  return parsed;
+}, "parseCfData");
+
+// src/helpers/geo.ts
+var UNDETERMINED_COUNTRIES = /* @__PURE__ */ new Set(["XX", "T1"]);
+var detectedCountry = /* @__PURE__ */ __name((cf) => {
+  const country = cf?.country;
+  return country && !UNDETERMINED_COUNTRIES.has(country) ? country : void 0;
+}, "detectedCountry");
+var euCountry = /* @__PURE__ */ __name((cf, country) => {
+  if (cf?.isEUCountry === "1") {
+    return "yes";
+  }
+  return country ? "no" : "unknown";
+}, "euCountry");
+var withForwardedCf = /* @__PURE__ */ __name((request) => {
+  if (request.cf !== void 0) {
+    return request;
+  }
+  const cf = parseCfData(request.headers.get(CF_DATA_HEADER));
+  return cf === void 0 ? request : new Request(request, { cf });
+}, "withForwardedCf");
+var loggableGeo = /* @__PURE__ */ __name((geo) => {
+  const fields = {};
+  for (const [key, value] of Object.entries(geo)) {
+    if (value !== void 0) {
+      fields[key] = String(value);
+    }
+  }
+  return fields;
+}, "loggableGeo");
+var hostFromRequest = /* @__PURE__ */ __name((request) => {
+  return {
+    ip: request.headers.get("cf-connecting-ip") ?? void 0,
+    userAgent: request.headers.get("user-agent") ?? void 0,
+    locale: request.headers.get("accept-language")?.split(",")[0]?.trim() || void 0
+  };
+}, "hostFromRequest");
+var geoFromCf = /* @__PURE__ */ __name((cf) => {
+  const bot = cf?.botManagement;
+  const country = detectedCountry(cf);
+  return {
+    timezone: cf?.timezone ?? void 0,
+    city: cf?.city ?? void 0,
+    postalCode: cf?.postalCode ?? void 0,
+    region: cf?.region ?? void 0,
+    regionCode: cf?.regionCode ?? void 0,
+    country,
+    continent: cf?.continent ?? void 0,
+    isEUCountry: euCountry(cf, country),
+    latitude: cf?.latitude ?? void 0,
+    longitude: cf?.longitude ?? void 0,
+    ja4: bot?.ja4,
+    ja3: bot?.ja3Hash,
+    botScore: bot?.score
+  };
+}, "geoFromCf");
+var geoFromRequest = /* @__PURE__ */ __name((request) => {
+  return {
+    ...hostFromRequest(request),
+    ...geoFromCf(request.cf)
+  };
+}, "geoFromRequest");
+
+// src/id-graph/traits.ts
+var PII_KEYS = ["first_name", "last_name", "email", "phone", "country", "state", "city", "postal_code"];
+var snakeCase = /* @__PURE__ */ __name((key) => {
+  return key.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase();
+}, "snakeCase");
+var stringifyTrait = /* @__PURE__ */ __name((value) => {
+  return typeof value === "string" ? value : JSON.stringify(value);
+}, "stringifyTrait");
+var piiTrait = /* @__PURE__ */ __name((key, rawValue) => {
+  if (key !== "email" && key !== "phone") {
+    return stringifyTrait(rawValue);
+  }
+  if (typeof rawValue !== "string") {
+    return void 0;
+  }
+  return (key === "email" ? emailIdentifier(rawValue) : phoneIdentifier(rawValue))?.value;
+}, "piiTrait");
+var resolvePiiTrait = /* @__PURE__ */ __name((key, rawValue, unset) => {
+  return unset ? null : piiTrait(key, rawValue);
+}, "resolvePiiTrait");
+var classifyTraits = /* @__PURE__ */ __name((traits, observedAt) => {
+  const classified = { pii: {}, custom: {}, latest: [], dropped: [] };
+  for (const [rawKey, rawValue] of Object.entries(traits)) {
+    const key = snakeCase(rawKey);
+    const unset = rawValue === null || rawValue === void 0;
+    if (PII_KEYS.includes(key)) {
+      const value2 = resolvePiiTrait(key, rawValue, unset);
+      if (value2 === void 0) {
+        classified.dropped.push(key);
+        continue;
+      }
+      classified.pii[key] = value2;
+      classified.latest.push({ key: `pii.${key}`, value: value2, observedAt });
+      continue;
+    }
+    const value = unset ? null : stringifyTrait(rawValue);
+    classified.custom[key] = value;
+    classified.latest.push({ key: `custom.${key}`, value, observedAt });
+  }
+  return classified;
+}, "classifyTraits");
+var conversionFromTrack = /* @__PURE__ */ __name((payload) => {
+  const amount = payload.properties["value"];
+  if (typeof amount !== "number" || !Number.isFinite(amount)) {
+    return void 0;
+  }
+  const orderId = payload.properties["orderId"];
+  if (typeof orderId !== "string" || orderId === "") {
+    return void 0;
+  }
+  const currency = payload.properties["currency"];
+  const contents = payload.properties["contents"];
+  return {
+    eventName: payload.event,
+    eventId: payload.eventId,
+    orderId,
+    amount,
+    currency: typeof currency === "string" ? currency : null,
+    contents: contents === void 0 ? null : JSON.stringify(contents)
+  };
+}, "conversionFromTrack");
+
+// src/id-graph/noop.ts
+var isNoopConsent = /* @__PURE__ */ __name((payload) => {
+  return consentEntries(payload, 0).length === 0;
+}, "isNoopConsent");
+var isNoopIdentify = /* @__PURE__ */ __name((traits) => {
+  return Object.keys(traits).length === 0;
+}, "isNoopIdentify");
+var isNoopSubmission = /* @__PURE__ */ __name((userId, args) => {
+  if (args.type === "consent") {
+    return isNoopConsent(args.payload);
+  }
+  if (args.type === "identify") {
+    return isCanonicalId(userId) && isNoopIdentify(args.payload.traits);
+  }
+  return false;
+}, "isNoopSubmission");
+var isNoopAction = /* @__PURE__ */ __name((action) => {
+  if (action.identifier !== void 0) {
+    return false;
   }
-  const invalid = Object.entries(rates).find(([, rate]) => !Number.isFinite(rate) || rate <= 0);
-  if (invalid !== void 0) {
-    return { ok: false, reason: `${invalid[0]} is not a positive finite rate` };
+  return action.type === "consent" && isNoopConsent(action.payload);
+}, "isNoopAction");
+var isDeliveryOnlyAction = /* @__PURE__ */ __name((action) => {
+  if (action.identifier !== void 0 || action.type === "consent") {
+    return false;
   }
-  const count = Object.keys(rates).length;
-  if (count < MIN_CURRENCY_CODES) {
-    return { ok: false, reason: `the feed has ${count} codes` };
+  return action.type === "track" ? conversionFromTrack(action.payload) === void 0 : isNoopIdentify(action.payload.traits);
+}, "isDeliveryOnlyAction");
+
+// src/id-graph/action.ts
+var UnknownUserError = class extends Error {
+  static {
+    __name(this, "UnknownUserError");
   }
-  return { ok: true, rates };
-}, "parseCurrencyFeed");
-var fetchCurrencyRates = /* @__PURE__ */ __name(async () => {
-  return traced("currency.fetch", { attrs: { "http.url": CURRENCY_FEED_URL } }, async () => {
-    let feed;
-    try {
-      const response = await fetch(CURRENCY_FEED_URL, {
-        signal: AbortSignal.timeout(FEED_TIMEOUT_MS),
-        cf: { cacheTtlByStatus: { "200-299": FEED_EDGE_CACHE_TTL_S, "300-599": 0 } }
-      });
-      if (!response.ok) {
-        addSpanEvent("currency fetch failed", { level: "error", attrs: { status: response.status } });
-        return null;
-      }
-      feed = await response.text();
-    } catch (error61) {
-      addSpanEvent("currency fetch failed", { level: "error", attrs: { error: String(error61) } });
-      return null;
+  constructor() {
+    super("the identifier resolves to no user");
+    this.name = "UnknownUserError";
+  }
+};
+var mintActionId = /* @__PURE__ */ __name(() => {
+  return `act_${ulid3()}`;
+}, "mintActionId");
+var buildAction = /* @__PURE__ */ __name((args) => {
+  const receivedAt = args.receivedAt ?? Date.now();
+  return {
+    ...args,
+    actionId: mintActionId(),
+    receivedAt
+  };
+}, "buildAction");
+var ingest = /* @__PURE__ */ __name(async (env, action, site = ownSite(env)) => {
+  await traced("rpc anon.ingest", {}, () => {
+    return anonStub(env, action.userId).ingest(action, site, currentTraceContext());
+  });
+}, "ingest");
+var serverActionContext = /* @__PURE__ */ __name((input2, receivedAt) => {
+  const network = input2?.network;
+  return {
+    source: "server",
+    occurredAt: input2?.occurredAt ?? receivedAt,
+    ...input2?.page === void 0 ? {} : { page: input2.page },
+    ...network === void 0 || network.ip === void 0 && network.userAgent === void 0 && network.locale === void 0 ? {} : { network: { ...network, provenance: "caller" } },
+    ...input2?.session === void 0 ? {} : { session: input2.session },
+    offline: input2?.offline ?? false,
+    replay: input2?.replay ?? false
+  };
+}, "serverActionContext");
+var submitAction = /* @__PURE__ */ __name(async (env, userId, args, request) => {
+  const attrs = {
+    "action.type": args.type,
+    "action.payload": JSON.stringify(args.payload),
+    "action.identifier": userId,
+    ...args.type === "track" ? { "action.event": args.payload.event } : {}
+  };
+  return traced(`action ${args.type}`, { attrs }, async () => {
+    if (isNoopSubmission(userId, args)) {
+      setSpanAttributes({ "action.noop": true, ...isCanonicalId(userId) ? { "action.user_id": userId } : {} });
+      return mintActionId();
     }
-    const verdict = parseCurrencyFeed(feed);
-    if (!verdict.ok) {
-      addSpanEvent("currency feed rejected", { level: "error", attrs: { reason: verdict.reason } });
-      return null;
+    const resolved = await traced("resolve_user", {}, () => {
+      return args.type === "track" ? resolveExistingUser(env, userId) : resolveUser(env, userId);
+    });
+    if (resolved === null) {
+      throw new UnknownUserError();
     }
-    return verdict.rates;
+    const receivedAt = Date.now();
+    const action = buildAction({
+      ...args,
+      userId: resolved.id,
+      identifier: resolved.identifier,
+      receivedAt,
+      context: serverActionContext(args.context, receivedAt),
+      geo: request?.cf,
+      host: request === void 0 ? void 0 : hostFromRequest(request)
+    });
+    setSpanAttributes({ "action.user_id": resolved.id, "action.id": action.actionId });
+    await ingest(env, action);
+    return action.actionId;
   });
-}, "fetchCurrencyRates");
-var refreshCurrencyRates = /* @__PURE__ */ __name(async () => {
-  const rates = await fetchCurrencyRates();
-  const now = Date.now();
-  if (rates === null) {
-    const current2 = currencyMemo?.current ?? null;
-    currencyMemo = { current: current2, nextAttemptAt: now + RETRY_AFTER_FAILURE_MS };
-    return current2;
-  }
-  const current = { rates, fetchedAt: now };
-  currencyMemo = { current, nextAttemptAt: now + RATES_TTL_MS };
-  return current;
-}, "refreshCurrencyRates");
-var currentCurrencyRates = /* @__PURE__ */ __name(async (ctx) => {
-  const now = Date.now();
-  if (currencyMemo !== void 0 && now < currencyMemo.nextAttemptAt) {
-    return currencyMemo.current;
-  }
-  const stale = currencyMemo?.current ?? null;
-  if (stale === null) {
-    return refreshCurrencyRates();
-  }
-  currencyMemo = { current: stale, nextAttemptAt: now + RETRY_AFTER_FAILURE_MS };
-  ctx.waitUntil(
-    runInvocation({ name: "currency.refresh", trace: currentTraceContext() }, () => {
-      return refreshCurrencyRates();
-    })
-  );
-  return stale;
-}, "currentCurrencyRates");
-
-// src/apps/broker-currency.ts
-var currencyRatesBody = external_exports.object({
-  ...identityFields,
-  kind: external_exports.literal("currencyRates")
-}).strict();
-var handleCurrencyRates = /* @__PURE__ */ __name(async (ctx) => {
-  const current = await currentCurrencyRates(ctx);
-  if (current === null) {
-    return Response.json({ error: "currency_rates_unavailable" }, { status: 503 });
-  }
-  return Response.json(current);
-}, "handleCurrencyRates");
+}, "submitAction");
 
 // src/id-graph/upsert.ts
 var identifierValue = external_exports.string().min(1).max(256).optional();
@@ -27544,35 +27650,249 @@ var rateLimited = /* @__PURE__ */ __name(async (env, key, binding = "BROKER_RATE
     }
     return false;
   }
-  const outcome = await limiter.limit({ key });
-  return !outcome.success;
-}, "rateLimited");
+  const outcome = await limiter.limit({ key });
+  return !outcome.success;
+}, "rateLimited");
+
+// src/apps/broker-identity.ts
+var identityUpsertBody = external_exports.object({
+  ...identityFields,
+  kind: external_exports.literal("identityUpsert"),
+  person: personUpsertSchema
+}).strict();
+var identityGranted = /* @__PURE__ */ __name((slug) => {
+  return siteRegistry().registry.apps[slug]?.data.includes(IDENTITY_CAPABILITY) === true;
+}, "identityGranted");
+var identityPermissionDenied = /* @__PURE__ */ __name(() => {
+  return Response.json({ error: "identity_permission_denied" }, { status: 403 });
+}, "identityPermissionDenied");
+var handleIdentityUpsert = /* @__PURE__ */ __name(async (env, body) => {
+  if (!identityGranted(body.slug)) {
+    return identityPermissionDenied();
+  }
+  if (await rateLimited(env, `${body.slug}::identity-upsert`)) {
+    return Response.json({ error: "rate_limited" }, { status: 429 });
+  }
+  const upserted = await upsertPerson(env, body.person);
+  if (upserted === null) {
+    return Response.json({ error: "invalid_identifier" }, { status: 400 });
+  }
+  return Response.json(upserted);
+}, "handleIdentityUpsert");
+
+// ../../libs/app-ui-token/src/base64url.ts
+var base64UrlEncode = /* @__PURE__ */ __name((bytes) => {
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}, "base64UrlEncode");
+var base64UrlDecode = /* @__PURE__ */ __name((text) => {
+  const padded = text.replaceAll("-", "+").replaceAll("_", "/").padEnd(text.length + (4 - text.length % 4) % 4, "=");
+  let binary;
+  try {
+    binary = atob(padded);
+  } catch {
+    return null;
+  }
+  const bytes = new Uint8Array(binary.length);
+  for (let index = 0; index < binary.length; index += 1) {
+    bytes[index] = binary.charCodeAt(index);
+  }
+  return bytes;
+}, "base64UrlDecode");
+
+// ../../libs/app-ui-token/src/env.ts
+var envSchema = external_exports.object({
+  v: external_exports.literal(1),
+  keys: external_exports.record(external_exports.string().min(1).max(16), external_exports.string().min(1))
+}).strict();
+var parseAppUiKeyEnv = /* @__PURE__ */ __name((raw2) => {
+  let json2;
+  try {
+    json2 = JSON.parse(raw2);
+  } catch {
+    return null;
+  }
+  const parsed = envSchema.safeParse(json2);
+  if (!parsed.success) {
+    return null;
+  }
+  const keys = {};
+  for (const [kid, encoded] of Object.entries(parsed.data.keys)) {
+    const bytes = base64UrlDecode(encoded);
+    if (bytes === null) {
+      return null;
+    }
+    keys[kid] = bytes;
+  }
+  return keys;
+}, "parseAppUiKeyEnv");
+
+// ../../libs/app-ui-token/src/jwt.ts
+var headerSchema = external_exports.object({
+  alg: external_exports.literal("HS256"),
+  typ: external_exports.literal("JWT"),
+  kid: external_exports.string().min(1).max(16)
+}).strict();
+var encodeJsonPart = /* @__PURE__ */ __name((value) => {
+  return base64UrlEncode(new TextEncoder().encode(JSON.stringify(value)));
+}, "encodeJsonPart");
+var parseJsonPart = /* @__PURE__ */ __name((part) => {
+  const bytes = base64UrlDecode(part);
+  if (bytes === null) {
+    return null;
+  }
+  try {
+    return JSON.parse(new TextDecoder().decode(bytes));
+  } catch {
+    return null;
+  }
+}, "parseJsonPart");
+var hmacKey = /* @__PURE__ */ __name((key, usage) => {
+  return crypto.subtle.importKey("raw", key, { name: "HMAC", hash: "SHA-256" }, false, [usage]);
+}, "hmacKey");
+var signCompact = /* @__PURE__ */ __name(async (kid, key, claims) => {
+  const signingInput = `${encodeJsonPart({ alg: "HS256", typ: "JWT", kid })}.${encodeJsonPart(claims)}`;
+  const signature = await crypto.subtle.sign("HMAC", await hmacKey(key, "sign"), new TextEncoder().encode(signingInput));
+  return `${signingInput}.${base64UrlEncode(new Uint8Array(signature))}`;
+}, "signCompact");
+var verifyCompactSignature = /* @__PURE__ */ __name(async (token, keys) => {
+  const [headerPart, claimsPart, signaturePart, extra] = token.split(".");
+  if (headerPart === void 0 || claimsPart === void 0 || signaturePart === void 0 || extra !== void 0) {
+    return { ok: false, reason: "malformed" };
+  }
+  const header = headerSchema.safeParse(parseJsonPart(headerPart));
+  if (!header.success) {
+    return { ok: false, reason: "malformed" };
+  }
+  const key = keys[header.data.kid];
+  if (key === void 0) {
+    return { ok: false, reason: "unknown_kid" };
+  }
+  const signature = base64UrlDecode(signaturePart);
+  if (signature === null) {
+    return { ok: false, reason: "malformed" };
+  }
+  const signed = await crypto.subtle.verify(
+    "HMAC",
+    await hmacKey(key, "verify"),
+    signature,
+    new TextEncoder().encode(`${headerPart}.${claimsPart}`)
+  );
+  if (!signed) {
+    return { ok: false, reason: "bad_signature" };
+  }
+  return { ok: true, claims: parseJsonPart(claimsPart), kid: header.data.kid, key };
+}, "verifyCompactSignature");
 
-// src/apps/broker-identity.ts
-var identityUpsertBody = external_exports.object({
-  ...identityFields,
-  kind: external_exports.literal("identityUpsert"),
-  person: personUpsertSchema
+// ../../libs/app-ui-token/src/token.ts
+var APP_UI_TOKEN_SKEW_SECONDS = 60;
+var APP_UI_TOKEN_ISSUER = "qinto-portal";
+var claimsSchema = external_exports.object({
+  iss: external_exports.literal(APP_UI_TOKEN_ISSUER),
+  aud: external_exports.string().min(1),
+  sub: external_exports.string().min(1),
+  userId: external_exports.string().min(1),
+  iat: external_exports.number().int(),
+  exp: external_exports.number().int(),
+  domainId: external_exports.string().min(1),
+  appId: external_exports.string().min(1),
+  appInstallId: external_exports.string().min(1),
+  appVersionId: external_exports.string().min(1),
+  access: external_exports.enum(["read", "write"]),
+  // Absent means `full`; see the mint below.
+  appRole: external_exports.enum(APP_ROLES).optional()
 }).strict();
-var identityGranted = /* @__PURE__ */ __name((slug) => {
-  return siteRegistry().registry.apps[slug]?.data.includes(IDENTITY_CAPABILITY) === true;
-}, "identityGranted");
-var identityPermissionDenied = /* @__PURE__ */ __name(() => {
-  return Response.json({ error: "identity_permission_denied" }, { status: 403 });
-}, "identityPermissionDenied");
-var handleIdentityUpsert = /* @__PURE__ */ __name(async (env, body) => {
-  if (!identityGranted(body.slug)) {
-    return identityPermissionDenied();
+var appUiAudience = /* @__PURE__ */ __name((slug) => {
+  return `app-ui:${slug}`;
+}, "appUiAudience");
+var verifyAppUiToken = /* @__PURE__ */ __name(async (input2) => {
+  const signature = await verifyCompactSignature(input2.token, input2.keys);
+  if (!signature.ok) {
+    return signature;
   }
-  if (await rateLimited(env, `${body.slug}::identity-upsert`)) {
-    return Response.json({ error: "rate_limited" }, { status: 429 });
+  const claims = claimsSchema.safeParse(signature.claims);
+  if (!claims.success) {
+    return { ok: false, reason: "bad_claims" };
   }
-  const upserted = await upsertPerson(env, body.person);
-  if (upserted === null) {
-    return Response.json({ error: "invalid_identifier" }, { status: 400 });
+  if (claims.data.aud !== appUiAudience(input2.slug)) {
+    return { ok: false, reason: "wrong_app" };
   }
-  return Response.json(upserted);
-}, "handleIdentityUpsert");
+  const now = Math.floor(input2.now.getTime() / 1e3);
+  if (claims.data.iat > now + (input2.skewSeconds ?? APP_UI_TOKEN_SKEW_SECONDS)) {
+    return { ok: false, reason: "future_iat" };
+  }
+  if (claims.data.exp <= now) {
+    return { ok: false, reason: "expired" };
+  }
+  return { ok: true, claims: claims.data, kid: signature.kid, key: signature.key };
+}, "verifyAppUiToken");
+
+// ../../libs/app-ui-token/src/runtime-query-ticket.ts
+var APP_RUNTIME_QUERY_TICKET_TTL_SECONDS = 600;
+var APP_RUNTIME_QUERY_TICKET_ISSUER = "qinto-portal";
+var claimsSchema2 = external_exports.object({
+  iss: external_exports.literal(APP_RUNTIME_QUERY_TICKET_ISSUER),
+  aud: external_exports.string().min(1),
+  sub: external_exports.string().min(1),
+  iat: external_exports.number().int(),
+  exp: external_exports.number().int(),
+  domainId: external_exports.string().min(1),
+  appId: external_exports.string().min(1),
+  appInstallId: external_exports.string().min(1),
+  appVersionId: external_exports.string().min(1)
+}).strict();
+var appRuntimeQueryAudience = /* @__PURE__ */ __name((slug) => {
+  return `app-runtime-query:${slug}`;
+}, "appRuntimeQueryAudience");
+var mintAppRuntimeQueryTicket = /* @__PURE__ */ __name(async (input2) => {
+  const iat = Math.floor(input2.now.getTime() / 1e3);
+  const claims = {
+    iss: APP_RUNTIME_QUERY_TICKET_ISSUER,
+    aud: appRuntimeQueryAudience(input2.slug),
+    sub: input2.appInstallId,
+    iat,
+    exp: iat + (input2.ttlSeconds ?? APP_RUNTIME_QUERY_TICKET_TTL_SECONDS),
+    domainId: input2.domainId,
+    appId: input2.appId,
+    appInstallId: input2.appInstallId,
+    appVersionId: input2.appVersionId
+  };
+  return signCompact(input2.kid, input2.key, claims);
+}, "mintAppRuntimeQueryTicket");
+
+// ../../libs/app-ui-token/src/write-ticket.ts
+var APP_UI_WRITE_TICKET_TTL_SECONDS = 60;
+var APP_UI_WRITE_TICKET_ISSUER = "qinto-site";
+var claimsSchema3 = external_exports.object({
+  iss: external_exports.literal(APP_UI_WRITE_TICKET_ISSUER),
+  aud: external_exports.string().min(1),
+  sub: external_exports.string().min(1),
+  iat: external_exports.number().int(),
+  exp: external_exports.number().int(),
+  domainId: external_exports.string().min(1),
+  appId: external_exports.string().min(1),
+  appVersionId: external_exports.string().min(1)
+}).strict();
+var appUiWriteAudience = /* @__PURE__ */ __name((slug) => {
+  return `app-ui-write:${slug}`;
+}, "appUiWriteAudience");
+var mintAppUiWriteTicket = /* @__PURE__ */ __name(async (input2) => {
+  const iat = Math.floor(input2.now.getTime() / 1e3);
+  const claims = {
+    iss: APP_UI_WRITE_TICKET_ISSUER,
+    aud: appUiWriteAudience(input2.slug),
+    sub: input2.userId,
+    iat,
+    exp: iat + (input2.ttlSeconds ?? APP_UI_WRITE_TICKET_TTL_SECONDS),
+    domainId: input2.domainId,
+    appId: input2.appId,
+    appVersionId: input2.appVersionId
+  };
+  return signCompact(input2.kid, input2.key, claims);
+}, "mintAppUiWriteTicket");
 
 // src/apps/emit-payload.ts
 var emitPayloadSchema = external_exports.object({
@@ -27591,51 +27911,6 @@ var emittedEventId = /* @__PURE__ */ __name((eventId, properties2) => {
   return `evt_${ulid3()}`;
 }, "emittedEventId");
 
-// src/apps/broker-track.ts
-var trackBody = external_exports.object({
-  ...identityFields,
-  kind: external_exports.literal("track"),
-  source: external_exports.enum(APP_HANDLER_SOURCES),
-  userId: external_exports.string().min(1).max(64),
-  installId: external_exports.string().min(1).max(64),
-  installs: installRuleSchema.optional(),
-  event: emitSchema.omit({ installs: true })
-}).strict();
-var handleTrack = /* @__PURE__ */ __name(async (env, body) => {
-  const app2 = siteRegistry().registry.apps[body.slug];
-  if (app2 === void 0) {
-    return Response.json({ error: "forbidden" }, { status: 403 });
-  }
-  if (!app2.installs.some((install) => install.active && install.id === body.installId)) {
-    return Response.json({ error: "invalid_install" }, { status: 400 });
-  }
-  const parsed = emitPayloadSchema.safeParse(body.event.payload);
-  if (!parsed.success) {
-    return Response.json({ error: "invalid_event" }, { status: 400 });
-  }
-  if (!isCanonicalId(body.userId)) {
-    return Response.json({ error: "invalid_user" }, { status: 400 });
-  }
-  if (await rateLimited(env, `${body.slug}:${body.installId}:track`)) {
-    return Response.json({ error: "rate_limited" }, { status: 429 });
-  }
-  const site = ownSite(env);
-  if (!await anonStub(env, body.userId).appAllowed(body.slug, site, currentTraceContext())) {
-    return Response.json({ error: "forbidden" }, { status: 403 });
-  }
-  const { event, eventId, properties: properties2 } = parsed.data;
-  const action = buildAction({
-    type: "track",
-    userId: body.userId,
-    source: body.source,
-    payload: { event, eventId: emittedEventId(eventId, properties2), properties: properties2 ?? {} },
-    context: { source: "app", occurredAt: body.event.occurredAt, offline: false, replay: false },
-    ...body.installs === void 0 ? {} : { installs: body.installs }
-  });
-  await ingest(env, action, site);
-  return Response.json({ accepted: true }, { status: 202 });
-}, "handleTrack");
-
 // src/id-graph/anon/context.ts
 var LEVEL_KINDS = {
   private: { kv: "context_private_kv", text: "context_private_text" },
@@ -28125,7 +28400,7 @@ var BOT_SCORE_MIN = 1;
 var BOT_SCORE_MAX = 99;
 
 // ../../libs/bot-protection/src/config.ts
-var NO_PROTECTION = { minBotScore: null, countries: null };
+var NO_PROTECTION = { minBotScore: null, countries: null, blockVerifiedBots: false };
 var normalizeScore = /* @__PURE__ */ __name((value, problems) => {
   if (value === void 0 || value === null) {
     return null;
@@ -28159,6 +28434,13 @@ var normalizeCountries = /* @__PURE__ */ __name((value, problems) => {
   }
   return list.length === 0 ? null : { mode: record2.mode, list };
 }, "normalizeCountries");
+var normalizeBlockVerifiedBots = /* @__PURE__ */ __name((value, problems) => {
+  if (value === void 0 || typeof value === "boolean") {
+    return value ?? false;
+  }
+  problems.push("has a non-boolean blockVerifiedBots");
+  return false;
+}, "normalizeBlockVerifiedBots");
 var parseBotProtection = /* @__PURE__ */ __name((raw2) => {
   if (raw2.trim() === "") {
     return { config: NO_PROTECTION };
@@ -28176,15 +28458,19 @@ var parseBotProtection = /* @__PURE__ */ __name((raw2) => {
   const problems = [];
   const config2 = {
     minBotScore: normalizeScore(record2.minBotScore, problems),
-    countries: normalizeCountries(record2.countries, problems)
+    countries: normalizeCountries(record2.countries, problems),
+    blockVerifiedBots: normalizeBlockVerifiedBots(record2.blockVerifiedBots, problems)
   };
   return problems.length > 0 ? { config: config2, error: `BOT_PROTECTION ${problems.join("; ")}` } : { config: config2 };
 }, "parseBotProtection");
 var isRequestBlocked = /* @__PURE__ */ __name((config2, signal) => {
-  if (config2.minBotScore !== null && signal.botScore !== void 0 && signal.botScore < config2.minBotScore) {
+  if (isCountryBlocked(signal.country, signal.isEU ?? false, config2.countries)) {
     return true;
   }
-  return isCountryBlocked(signal.country, signal.isEU ?? false, config2.countries);
+  if (signal.verifiedBot === true) {
+    return config2.blockVerifiedBots;
+  }
+  return config2.minBotScore !== null && signal.botScore !== void 0 && signal.botScore < config2.minBotScore;
 }, "isRequestBlocked");
 
 // ../../libs/geo-filter/src/us-states.ts
@@ -28486,7 +28772,8 @@ var adoptAppSpans = /* @__PURE__ */ __name((response) => {
 }, "adoptAppSpans");
 
 // src/apps/invoke.ts
-var APP_INVOCATION_TIMEOUT_MS = 1e4;
+var RPC_HOT_TIMEOUT_MS = 1e4;
+var RPC_COLD_TIMEOUT_MS = 4e4;
 var APP_HOOK_TIMEOUT_MS = 25e3;
 var MAX_EMIT_DEPTH = 2;
 var HOOK_URL = "https://app/__qinto/hook";
@@ -28583,7 +28870,7 @@ var buildEnvelope = /* @__PURE__ */ __name((target, trigger, snapshot, context)
       ...geoAllowed ? { geo: snapshot.userGeo } : {}
     },
     ...buckets.includes("consentState") ? { consent: { enabled: context.consentEnforced, categories: snapshot.consent.categories, apps: snapshot.consent.apps } } : {},
-    ...geoAllowed && currentGeo !== void 0 ? { geo: currentGeo } : {},
+    ...geoAllowed && currentGeo !== void 0 ? { geo: cfDataFrom(currentGeo) } : {},
     ...trigger.kind === "connect" && buckets.includes("eventContext") ? connectContext(trigger) : {},
     // Not gated on a capabilities.data bucket: an app only ever sees what it captured or wrote.
     ...captures === void 0 ? {} : { captures },
@@ -28777,85 +29064,21 @@ var invokeApp = /* @__PURE__ */ __name(async (env, input2) => {
   );
 }, "invokeApp");
 
-// src/apps/broker.ts
+// src/apps/broker-rpc.ts
 var MAX_RPC_DEPTH = 3;
-var BROKER_PATHS = ["/__qinto/push", "/__qinto/rpc"];
-var pushBody = external_exports.object({
-  ...identityFields,
-  kind: external_exports.literal("push"),
-  userId: external_exports.string().min(1).max(64),
-  installId: external_exports.string().min(1).max(64).optional(),
-  broadcast: external_exports.enum(PUSH_BROADCASTS).optional(),
-  topic: external_exports.string().min(1).max(64),
-  data: external_exports.unknown().optional()
-}).strict();
 var rpcBody = external_exports.object({
   ...identityFields,
   kind: external_exports.literal("rpc"),
   // Absent when the caller is an endpoint, a schedule or a ui handler; the callee then sees no user.
-  userId: external_exports.string().min(1).max(64).optional(),
-  callee: external_exports.string().min(1).max(30),
-  fn: external_exports.string().min(1).max(64),
-  args: external_exports.unknown().optional(),
-  installId: external_exports.string().min(1).max(64).optional(),
-  depth: external_exports.number().int().min(0)
-}).strict();
-var installsBody = external_exports.object({
-  ...identityFields,
-  kind: external_exports.literal("installs"),
-  callee: external_exports.string().min(1).max(30)
-}).strict();
-var activeBody = external_exports.object({
-  ...identityFields,
-  kind: external_exports.literal("active"),
-  ord: external_exports.number().int().min(1),
-  userId: external_exports.string().min(1).max(64).optional()
-}).strict();
-var contextReadBody = external_exports.object({
-  ...identityFields,
-  kind: external_exports.literal("contextRead"),
-  userId: external_exports.string().min(1).max(64)
-}).strict();
-var contextWriteBody = external_exports.object({
-  ...identityFields,
-  kind: external_exports.literal("contextWrite"),
-  userId: external_exports.string().min(1).max(64),
-  writes: external_exports.array(contextWriteSchema).min(1).max(MAX_CONTEXT_WRITES_PER_INSTALL)
-}).strict();
-var factsQuery = external_exports.object({
-  kinds: external_exports.array(external_exports.enum(APP_FACT_KINDS)).min(1).max(APP_FACT_KINDS.length).optional(),
-  observedAtGte: external_exports.number().int().nonnegative().safe().optional(),
-  observedAtLt: external_exports.number().int().nonnegative().safe().optional(),
-  limit: external_exports.number().int().min(1).max(MAX_APP_FACTS_PER_PAGE).optional()
-}).strict().refine((query) => query.observedAtGte === void 0 || query.observedAtLt === void 0 || query.observedAtGte < query.observedAtLt);
-var factsReadBody = external_exports.object({
-  ...identityFields,
-  kind: external_exports.literal("factsRead"),
-  userId: external_exports.string().min(1).max(64),
-  query: factsQuery.optional(),
-  cursor: external_exports.string().min(1).max(4096).optional()
-}).strict().refine((body) => body.query === void 0 !== (body.cursor === void 0));
-var identityReadBody = external_exports.object({
-  ...identityFields,
-  kind: external_exports.literal("identityRead"),
-  identifier: identifierField2,
-  cursor: external_exports.string().regex(/^\d+$/).optional()
+  userId: external_exports.string().min(1).max(64).optional(),
+  callee: external_exports.string().min(1).max(30),
+  fn: external_exports.string().min(1).max(64),
+  args: external_exports.unknown().optional(),
+  installId: external_exports.string().min(1).max(64).optional(),
+  depth: external_exports.number().int().min(0),
+  // Optional on the wire: a runtime predating traffic classes sends none, which means hot.
+  traffic: external_exports.enum(TRAFFIC_CLASSES).optional()
 }).strict();
-var brokerBody = external_exports.discriminatedUnion("kind", [
-  pushBody,
-  rpcBody,
-  installsBody,
-  activeBody,
-  contextReadBody,
-  contextWriteBody,
-  factsReadBody,
-  identityReadBody,
-  identityUpsertBody,
-  currencyRatesBody,
-  trackBody
-]);
-var BODY_ENVELOPE_ALLOWANCE_BYTES = 2 * 1024;
-var MAX_BODY_BYTES = MAX_RPC_BYTES + BODY_ENVELOPE_ALLOWANCE_BYTES;
 var parseJson = /* @__PURE__ */ __name((raw2) => {
   try {
     return JSON.parse(raw2);
@@ -28863,85 +29086,6 @@ var parseJson = /* @__PURE__ */ __name((raw2) => {
     return null;
   }
 }, "parseJson");
-var factsCursor = external_exports.object({
-  userId: external_exports.string().min(1).max(64),
-  kinds: external_exports.array(external_exports.enum(APP_FACT_KINDS)).min(1).max(APP_FACT_KINDS.length),
-  observedAtGte: external_exports.number().int().nonnegative().safe().nullable(),
-  observedAtLt: external_exports.number().int().nonnegative().safe().nullable(),
-  limit: external_exports.number().int().min(1).max(MAX_APP_FACTS_PER_PAGE),
-  afterRowId: external_exports.number().int().nonnegative().safe(),
-  maxRowId: external_exports.number().int().positive().safe().nullable()
-}).strict();
-var cursorKey = /* @__PURE__ */ __name(async (hex3) => {
-  const bytes = Uint8Array.from(hex3.matchAll(/.{2}/g), ([pair]) => Number.parseInt(pair, 16));
-  return crypto.subtle.importKey("raw", bytes, "AES-GCM", false, ["encrypt", "decrypt"]);
-}, "cursorKey");
-var encodeBase64Url = /* @__PURE__ */ __name((bytes) => {
-  let binary = "";
-  for (const byte of bytes) {
-    binary += String.fromCharCode(byte);
-  }
-  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
-}, "encodeBase64Url");
-var decodeBase64Url = /* @__PURE__ */ __name((value) => {
-  const base643 = value.replaceAll("-", "+").replaceAll("_", "/");
-  const padded = base643.padEnd(Math.ceil(base643.length / 4) * 4, "=");
-  const binary = atob(padded);
-  return Uint8Array.from(binary, (character) => character.charCodeAt(0));
-}, "decodeBase64Url");
-var encryptFactsCursor = /* @__PURE__ */ __name(async (key, cursor) => {
-  const iv = crypto.getRandomValues(new Uint8Array(12));
-  const plaintext = new TextEncoder().encode(JSON.stringify(cursor));
-  const ciphertext = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv }, await cursorKey(key), plaintext));
-  const packed = new Uint8Array(iv.byteLength + ciphertext.byteLength);
-  packed.set(iv);
-  packed.set(ciphertext, iv.byteLength);
-  return encodeBase64Url(packed);
-}, "encryptFactsCursor");
-var decryptFactsCursor = /* @__PURE__ */ __name(async (key, encoded) => {
-  try {
-    const packed = decodeBase64Url(encoded);
-    if (packed.byteLength <= 12) {
-      return null;
-    }
-    const plaintext = await crypto.subtle.decrypt({ name: "AES-GCM", iv: packed.slice(0, 12) }, await cursorKey(key), packed.slice(12));
-    return JSON.parse(new TextDecoder().decode(plaintext));
-  } catch {
-    return null;
-  }
-}, "decryptFactsCursor");
-var invalidBody = /* @__PURE__ */ __name(() => {
-  return Response.json({ error: "invalid_body" }, { status: 400 });
-}, "invalidBody");
-var forbidden = /* @__PURE__ */ __name(() => {
-  return Response.json({ error: "forbidden" }, { status: 403 });
-}, "forbidden");
-var factsPermissionDenied = /* @__PURE__ */ __name(() => {
-  return Response.json({ error: "facts_permission_denied" }, { status: 403 });
-}, "factsPermissionDenied");
-var handlePush = /* @__PURE__ */ __name(async (env, body) => {
-  if (new TextEncoder().encode(JSON.stringify(body.data ?? null)).length > MAX_PUSH_BYTES) {
-    return invalidBody();
-  }
-  const broadcast = body.broadcast ?? "install";
-  if (broadcast === "install" && body.installId === void 0) {
-    return invalidBody();
-  }
-  const installId = broadcast === "install" ? body.installId : null;
-  if (await rateLimited(env, `${body.slug}:${installId ?? ""}:push`)) {
-    return Response.json({ error: "rate_limited" }, { status: 429 });
-  }
-  const app2 = siteRegistry().registry.apps[body.slug];
-  if (broadcast === "site" && (app2 === void 0 || !app2.events.publishes.includes(body.topic) || !app2.data.includes(SHARED_CONTEXT_CAPABILITY))) {
-    return Response.json({ error: "topic_not_public" }, { status: 400 });
-  }
-  await anonStub(env, body.userId).appPush(
-    { slug: body.slug, installId, topic: body.topic, data: body.data, scope: broadcast === "site" ? "site" : "app" },
-    ownSite(env),
-    currentTraceContext()
-  );
-  return Response.json({ accepted: true }, { status: 202 });
-}, "handlePush");
 var resolveInstall = /* @__PURE__ */ __name((callee, installId) => {
   const active = callee.installs.filter((install) => install.active);
   if (installId !== void 0) {
@@ -28955,6 +29099,14 @@ var calleeFailed = /* @__PURE__ */ __name((callee, reason) => {
   addSpanEvent("rpc callee failed", { level: "warn", attrs: { app: callee, reason } });
   return Response.json({ error: "callee_failed" }, { status: 502 });
 }, "calleeFailed");
+var calleeError = /* @__PURE__ */ __name((callee, error61, message) => {
+  addSpanEvent("rpc callee failed", { level: "warn", attrs: { app: callee, reason: message, code: error61 } });
+  return Response.json({ error: error61, message }, { status: 502 });
+}, "calleeError");
+var resultTooLarge = /* @__PURE__ */ __name((candidate) => {
+  const result = candidate?.rpc?.result;
+  return new TextEncoder().encode(JSON.stringify(result ?? null)).length > MAX_RPC_BYTES;
+}, "resultTooLarge");
 var deliverRpcEffects = /* @__PURE__ */ __name(async (env, { body, userId, effects, install }) => {
   for (const ord of effects.rejectedOrds) {
     addSpanEvent("app effects rejected over the per-install caps", { level: "warn", attrs: { app: body.callee, ord } });
@@ -28980,10 +29132,32 @@ var deliverRpcEffects = /* @__PURE__ */ __name(async (env, { body, userId, effec
     }, "ingest")
   });
 }, "deliverRpcEffects");
-var runRelayRpc = /* @__PURE__ */ __name(async (env, { context, body, callee, install }) => {
-  let raw2;
+var calleeQueryTicket = /* @__PURE__ */ __name(async (env, { context, body, callee, install }) => {
+  const keyEnv = env.APP_UI_KEY;
+  const [signing] = Object.entries((keyEnv === void 0 ? null : parseAppUiKeyEnv(keyEnv)) ?? {});
+  if (callee.appId === void 0 || signing === void 0) {
+    return void 0;
+  }
+  const [kid, key] = signing;
+  return mintAppRuntimeQueryTicket({
+    kid,
+    key,
+    now: /* @__PURE__ */ new Date(),
+    slug: body.callee,
+    domainId: context.domainId,
+    appId: callee.appId,
+    appInstallId: install.id,
+    // The portal authorizes a ticket only for the version the site serves, which is the registry's.
+    appVersionId: callee.versionId
+  });
+}, "calleeQueryTicket");
+var postToCallee = /* @__PURE__ */ __name(async (env, input2) => {
+  const { context, body, callee, install } = input2;
+  const traffic = body.traffic ?? "hot";
+  const timeoutMs = traffic === "cold" ? RPC_COLD_TIMEOUT_MS : RPC_HOT_TIMEOUT_MS;
   try {
     const key = await deriveAppInternalKey(context.master, context.domainId, body.callee);
+    const queryTicket = traffic === "cold" ? await calleeQueryTicket(env, input2) : void 0;
     const response = await postHookEnvelope(env, {
       binding: callee.binding,
       key,
@@ -28997,9 +29171,9 @@ var runRelayRpc = /* @__PURE__ */ __name(async (env, { context, body, callee, in
         ...body.userId === void 0 ? {} : { user: { anonId: body.userId, globalId: null, properties: {} } },
         depth: body.depth,
         // JSON.stringify drops an undefined key, and the envelope requires `args` to be present.
-        rpc: { caller: body.slug, fn: body.fn, args: body.args ?? null }
+        rpc: { caller: body.slug, fn: body.fn, args: body.args ?? null, traffic, ...queryTicket === void 0 ? {} : { queryTicket } }
       },
-      timeoutMs: APP_INVOCATION_TIMEOUT_MS
+      timeoutMs
     });
     if (response === void 0) {
       return calleeFailed(body.callee, "The callee service binding is missing.");
@@ -29015,13 +29189,27 @@ var runRelayRpc = /* @__PURE__ */ __name(async (env, { context, body, callee, in
     }
     const bytes = await readBoundedBody(response, MAX_RESPONSE_BYTES);
     if (bytes === null) {
-      return calleeFailed(body.callee, "The response exceeds the size cap.");
+      return calleeError(body.callee, "result_too_large", `The callee response exceeds ${MAX_RESPONSE_BYTES / 1024 / 1024} MB.`);
     }
-    raw2 = new TextDecoder().decode(bytes);
+    return new TextDecoder().decode(bytes);
   } catch (error61) {
+    if (error61 instanceof Error && error61.name === "TimeoutError") {
+      return calleeError(body.callee, "callee_timeout", `The callee did not answer within ${timeoutMs / 1e3} s.`);
+    }
     return calleeFailed(body.callee, String(error61));
   }
-  const verdict = validateEnvelopeResponse(parseJson(raw2), 1);
+}, "postToCallee");
+var runRelayRpc = /* @__PURE__ */ __name(async (env, input2) => {
+  const { body, install } = input2;
+  const raw2 = await postToCallee(env, input2);
+  if (raw2 instanceof Response) {
+    return raw2;
+  }
+  const candidate = parseJson(raw2);
+  if (resultTooLarge(candidate)) {
+    return calleeError(body.callee, "result_too_large", `The rpc result exceeds ${MAX_RPC_BYTES / 1024} KB.`);
+  }
+  const verdict = validateEnvelopeResponse(candidate, 1);
   if (!verdict.ok) {
     return calleeFailed(body.callee, verdict.reason);
   }
@@ -29030,6 +29218,9 @@ var runRelayRpc = /* @__PURE__ */ __name(async (env, { context, body, callee, in
     if (verdict.errorCode === "invalid_arguments") {
       return Response.json({ error: "invalid_arguments", message: reason }, { status: 400 });
     }
+    if (verdict.errorCode === "rpc_error") {
+      return calleeError(body.callee, "rpc_error", reason);
+    }
     return calleeFailed(body.callee, reason);
   }
   if (verdict.rpc === null) {
@@ -29058,7 +29249,8 @@ var relayRpc = /* @__PURE__ */ __name(async (env, input2) => {
         "app.install_ord": install.ord,
         "app.install_label": install.label,
         "app.rpc_caller": body.slug,
-        "app.rpc_depth": body.depth
+        "app.rpc_depth": body.depth,
+        "app.rpc_traffic": body.traffic ?? "hot"
       }
     },
     () => {
@@ -29072,24 +29264,223 @@ var handleRpc = /* @__PURE__ */ __name(async (env, context, body) => {
   }
   const callee = siteRegistry().registry.apps[body.callee];
   if (callee === void 0) {
-    return forbidden();
+    return Response.json({ error: "forbidden" }, { status: 403 });
+  }
+  const visibility = callee.rpc.exposes[body.fn];
+  if (visibility !== "public" && !(visibility === "private" && (callee.rpc.grants[body.slug] ?? []).includes(body.fn))) {
+    return Response.json({ error: "forbidden" }, { status: 403 });
+  }
+  const install = resolveInstall(callee, body.installId);
+  if (install === "invalid_install" || install === "install_required") {
+    return Response.json({ error: install }, { status: 400 });
+  }
+  if (new TextEncoder().encode(JSON.stringify(body.args ?? null)).length > MAX_RPC_BYTES) {
+    return Response.json({ error: "too_large" }, { status: 413 });
+  }
+  if (await rateLimited(env, `${body.slug}:${install.id}:rpc`)) {
+    return Response.json({ error: "rate_limited" }, { status: 429 });
+  }
+  return relayRpc(env, { context, body, callee, install });
+}, "handleRpc");
+
+// src/apps/broker-track.ts
+var trackBody = external_exports.object({
+  ...identityFields,
+  kind: external_exports.literal("track"),
+  source: external_exports.enum(APP_HANDLER_SOURCES),
+  userId: external_exports.string().min(1).max(64),
+  installId: external_exports.string().min(1).max(64),
+  installs: installRuleSchema.optional(),
+  event: emitSchema.omit({ installs: true })
+}).strict();
+var handleTrack = /* @__PURE__ */ __name(async (env, body) => {
+  const app2 = siteRegistry().registry.apps[body.slug];
+  if (app2 === void 0) {
+    return Response.json({ error: "forbidden" }, { status: 403 });
+  }
+  if (!app2.installs.some((install) => install.active && install.id === body.installId)) {
+    return Response.json({ error: "invalid_install" }, { status: 400 });
+  }
+  const parsed = emitPayloadSchema.safeParse(body.event.payload);
+  if (!parsed.success) {
+    return Response.json({ error: "invalid_event" }, { status: 400 });
+  }
+  if (!isCanonicalId(body.userId)) {
+    return Response.json({ error: "invalid_user" }, { status: 400 });
+  }
+  if (await rateLimited(env, `${body.slug}:${body.installId}:track`)) {
+    return Response.json({ error: "rate_limited" }, { status: 429 });
+  }
+  const site = ownSite(env);
+  if (!await anonStub(env, body.userId).appAllowed(body.slug, site, currentTraceContext())) {
+    return Response.json({ error: "forbidden" }, { status: 403 });
+  }
+  const { event, eventId, properties: properties2 } = parsed.data;
+  const action = buildAction({
+    type: "track",
+    userId: body.userId,
+    source: body.source,
+    payload: { event, eventId: emittedEventId(eventId, properties2), properties: properties2 ?? {} },
+    context: { source: "app", occurredAt: body.event.occurredAt, offline: false, replay: false },
+    ...body.installs === void 0 ? {} : { installs: body.installs }
+  });
+  await ingest(env, action, site);
+  return Response.json({ accepted: true }, { status: 202 });
+}, "handleTrack");
+
+// src/apps/broker.ts
+var BROKER_PATHS = ["/__qinto/push", "/__qinto/rpc"];
+var pushBody = external_exports.object({
+  ...identityFields,
+  kind: external_exports.literal("push"),
+  userId: external_exports.string().min(1).max(64),
+  installId: external_exports.string().min(1).max(64).optional(),
+  broadcast: external_exports.enum(PUSH_BROADCASTS).optional(),
+  topic: external_exports.string().min(1).max(64),
+  data: external_exports.unknown().optional()
+}).strict();
+var installsBody = external_exports.object({
+  ...identityFields,
+  kind: external_exports.literal("installs"),
+  callee: external_exports.string().min(1).max(30)
+}).strict();
+var activeBody = external_exports.object({
+  ...identityFields,
+  kind: external_exports.literal("active"),
+  ord: external_exports.number().int().min(1),
+  userId: external_exports.string().min(1).max(64).optional()
+}).strict();
+var contextReadBody = external_exports.object({
+  ...identityFields,
+  kind: external_exports.literal("contextRead"),
+  userId: external_exports.string().min(1).max(64)
+}).strict();
+var contextWriteBody = external_exports.object({
+  ...identityFields,
+  kind: external_exports.literal("contextWrite"),
+  userId: external_exports.string().min(1).max(64),
+  writes: external_exports.array(contextWriteSchema).min(1).max(MAX_CONTEXT_WRITES_PER_INSTALL)
+}).strict();
+var factsQuery = external_exports.object({
+  kinds: external_exports.array(external_exports.enum(APP_FACT_KINDS)).min(1).max(APP_FACT_KINDS.length).optional(),
+  observedAtGte: external_exports.number().int().nonnegative().safe().optional(),
+  observedAtLt: external_exports.number().int().nonnegative().safe().optional(),
+  limit: external_exports.number().int().min(1).max(MAX_APP_FACTS_PER_PAGE).optional()
+}).strict().refine((query) => query.observedAtGte === void 0 || query.observedAtLt === void 0 || query.observedAtGte < query.observedAtLt);
+var factsReadBody = external_exports.object({
+  ...identityFields,
+  kind: external_exports.literal("factsRead"),
+  userId: external_exports.string().min(1).max(64),
+  query: factsQuery.optional(),
+  cursor: external_exports.string().min(1).max(4096).optional()
+}).strict().refine((body) => body.query === void 0 !== (body.cursor === void 0));
+var identityReadBody = external_exports.object({
+  ...identityFields,
+  kind: external_exports.literal("identityRead"),
+  identifier: identifierField2,
+  cursor: external_exports.string().regex(/^\d+$/).optional()
+}).strict();
+var brokerBody = external_exports.discriminatedUnion("kind", [
+  pushBody,
+  rpcBody,
+  installsBody,
+  activeBody,
+  contextReadBody,
+  contextWriteBody,
+  factsReadBody,
+  identityReadBody,
+  identityUpsertBody,
+  currencyRatesBody,
+  trackBody
+]);
+var BODY_ENVELOPE_ALLOWANCE_BYTES = 2 * 1024;
+var MAX_BODY_BYTES = MAX_RPC_BYTES + BODY_ENVELOPE_ALLOWANCE_BYTES;
+var parseJson2 = /* @__PURE__ */ __name((raw2) => {
+  try {
+    return JSON.parse(raw2);
+  } catch {
+    return null;
+  }
+}, "parseJson");
+var factsCursor = external_exports.object({
+  userId: external_exports.string().min(1).max(64),
+  kinds: external_exports.array(external_exports.enum(APP_FACT_KINDS)).min(1).max(APP_FACT_KINDS.length),
+  observedAtGte: external_exports.number().int().nonnegative().safe().nullable(),
+  observedAtLt: external_exports.number().int().nonnegative().safe().nullable(),
+  limit: external_exports.number().int().min(1).max(MAX_APP_FACTS_PER_PAGE),
+  afterRowId: external_exports.number().int().nonnegative().safe(),
+  maxRowId: external_exports.number().int().positive().safe().nullable()
+}).strict();
+var cursorKey = /* @__PURE__ */ __name(async (hex3) => {
+  const bytes = Uint8Array.from(hex3.matchAll(/.{2}/g), ([pair]) => Number.parseInt(pair, 16));
+  return crypto.subtle.importKey("raw", bytes, "AES-GCM", false, ["encrypt", "decrypt"]);
+}, "cursorKey");
+var encodeBase64Url = /* @__PURE__ */ __name((bytes) => {
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
   }
-  const visibility = callee.rpc.exposes[body.fn];
-  if (visibility !== "public" && !(visibility === "private" && (callee.rpc.grants[body.slug] ?? []).includes(body.fn))) {
-    return forbidden();
+  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}, "encodeBase64Url");
+var decodeBase64Url = /* @__PURE__ */ __name((value) => {
+  const base643 = value.replaceAll("-", "+").replaceAll("_", "/");
+  const padded = base643.padEnd(Math.ceil(base643.length / 4) * 4, "=");
+  const binary = atob(padded);
+  return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+}, "decodeBase64Url");
+var encryptFactsCursor = /* @__PURE__ */ __name(async (key, cursor) => {
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+  const plaintext = new TextEncoder().encode(JSON.stringify(cursor));
+  const ciphertext = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv }, await cursorKey(key), plaintext));
+  const packed = new Uint8Array(iv.byteLength + ciphertext.byteLength);
+  packed.set(iv);
+  packed.set(ciphertext, iv.byteLength);
+  return encodeBase64Url(packed);
+}, "encryptFactsCursor");
+var decryptFactsCursor = /* @__PURE__ */ __name(async (key, encoded) => {
+  try {
+    const packed = decodeBase64Url(encoded);
+    if (packed.byteLength <= 12) {
+      return null;
+    }
+    const plaintext = await crypto.subtle.decrypt({ name: "AES-GCM", iv: packed.slice(0, 12) }, await cursorKey(key), packed.slice(12));
+    return JSON.parse(new TextDecoder().decode(plaintext));
+  } catch {
+    return null;
   }
-  const install = resolveInstall(callee, body.installId);
-  if (install === "invalid_install" || install === "install_required") {
-    return Response.json({ error: install }, { status: 400 });
+}, "decryptFactsCursor");
+var invalidBody = /* @__PURE__ */ __name(() => {
+  return Response.json({ error: "invalid_body" }, { status: 400 });
+}, "invalidBody");
+var forbidden = /* @__PURE__ */ __name(() => {
+  return Response.json({ error: "forbidden" }, { status: 403 });
+}, "forbidden");
+var factsPermissionDenied = /* @__PURE__ */ __name(() => {
+  return Response.json({ error: "facts_permission_denied" }, { status: 403 });
+}, "factsPermissionDenied");
+var handlePush = /* @__PURE__ */ __name(async (env, body) => {
+  if (new TextEncoder().encode(JSON.stringify(body.data ?? null)).length > MAX_PUSH_BYTES) {
+    return invalidBody();
   }
-  if (new TextEncoder().encode(JSON.stringify(body.args ?? null)).length > MAX_RPC_BYTES) {
-    return Response.json({ error: "too_large" }, { status: 413 });
+  const broadcast = body.broadcast ?? "install";
+  if (broadcast === "install" && body.installId === void 0) {
+    return invalidBody();
   }
-  if (await rateLimited(env, `${body.slug}:${install.id}:rpc`)) {
+  const installId = broadcast === "install" ? body.installId : null;
+  if (await rateLimited(env, `${body.slug}:${installId ?? ""}:push`)) {
     return Response.json({ error: "rate_limited" }, { status: 429 });
   }
-  return relayRpc(env, { context, body, callee, install });
-}, "handleRpc");
+  const app2 = siteRegistry().registry.apps[body.slug];
+  if (broadcast === "site" && (app2 === void 0 || !app2.events.publishes.includes(body.topic) || !app2.data.includes(SHARED_CONTEXT_CAPABILITY))) {
+    return Response.json({ error: "topic_not_public" }, { status: 400 });
+  }
+  await anonStub(env, body.userId).appPush(
+    { slug: body.slug, installId, topic: body.topic, data: body.data, scope: broadcast === "site" ? "site" : "app" },
+    ownSite(env),
+    currentTraceContext()
+  );
+  return Response.json({ accepted: true }, { status: 202 });
+}, "handlePush");
 var handleInstalls = /* @__PURE__ */ __name(async (env, body) => {
   const callee = siteRegistry().registry.apps[body.callee];
   if (callee === void 0 || !(Object.values(callee.rpc.exposes).includes("public") || (callee.rpc.grants[body.slug] ?? []).length > 0)) {
@@ -29188,7 +29579,7 @@ var handleBroker = /* @__PURE__ */ __name(async (request, env, ctx) => {
   if (bytes === null) {
     return Response.json({ error: "too_large" }, { status: 413 });
   }
-  const candidate = parseJson(new TextDecoder().decode(bytes));
+  const candidate = parseJson2(new TextDecoder().decode(bytes));
   const parsed = brokerBody.safeParse(candidate);
   if (!parsed.success) {
     if (typeof candidate === "object" && candidate !== null && "kind" in candidate && candidate.kind === "factsRead") {
@@ -29367,7 +29758,7 @@ var textBody = /* @__PURE__ */ __name(async (request) => {
   const bytes = await readBoundedBody(request, MAX_CONTROL_BYTES);
   return bytes === null ? null : new TextDecoder().decode(bytes);
 }, "textBody");
-var parseJson2 = /* @__PURE__ */ __name((value) => {
+var parseJson3 = /* @__PURE__ */ __name((value) => {
   try {
     return JSON.parse(value);
   } catch {
@@ -29396,7 +29787,7 @@ var handleControl = /* @__PURE__ */ __name(async (request, env) => {
   if (authentication === null) {
     return Response.json({ error: "unauthorized" }, { status: 401 });
   }
-  const raw2 = parseJson2(body);
+  const raw2 = parseJson3(body);
   if (raw2 === void 0) {
     return Response.json({ error: "invalid_body" }, { status: 400 });
   }
@@ -29434,7 +29825,7 @@ var handleControl = /* @__PURE__ */ __name(async (request, env) => {
   if (responseBytes === null) {
     return Response.json({ error: "invalid_response" }, { status: 502 });
   }
-  const responseBody = parseJson2(new TextDecoder().decode(responseBytes));
+  const responseBody = parseJson3(new TextDecoder().decode(responseBytes));
   if (responseBody === void 0) {
     return Response.json({ error: "invalid_response" }, { status: 502 });
   }
@@ -29765,7 +30156,7 @@ var streamWithDeadlines = /* @__PURE__ */ __name((source, { idleMs, totalMs }) =
 }, "streamWithDeadlines");
 
 // src/helpers/bot-check.ts
-var botRejected = /* @__PURE__ */ __name((env, geo) => {
+var botRejected = /* @__PURE__ */ __name((env, request, geo) => {
   return traced("bot.check", {}, () => {
     const { config: protection, error: error61 } = parseBotProtection(env.BOT_PROTECTION);
     if (error61 !== void 0) {
@@ -29774,8 +30165,19 @@ var botRejected = /* @__PURE__ */ __name((env, geo) => {
         attrs: { error: String(error61) }
       });
     }
-    const rejected = isRequestBlocked(protection, { botScore: geo.botScore, country: geo.country, isEU: geo.isEUCountry === "yes" });
-    setSpanAttributes({ "bot.blocked": rejected, ...geo.botScore === void 0 ? {} : { "bot.score": geo.botScore } });
+    const cf = request.cf;
+    const verifiedBot = cf?.botManagement?.verifiedBot;
+    const rejected = isRequestBlocked(protection, {
+      botScore: geo.botScore,
+      verifiedBot,
+      country: geo.country,
+      isEU: geo.isEUCountry === "yes"
+    });
+    setSpanAttributes({
+      "bot.blocked": rejected,
+      ...geo.botScore === void 0 ? {} : { "bot.score": geo.botScore },
+      ...verifiedBot === void 0 ? {} : { "bot.verified": verifiedBot }
+    });
     return rejected;
   });
 }, "botRejected");
@@ -29865,7 +30267,7 @@ var withCors = /* @__PURE__ */ __name((response, request, method) => {
 }, "withCors");
 var authorize = /* @__PURE__ */ __name(async (c, { slug, app: app2 }) => {
   const geo = geoFromRequest(c.req.raw);
-  if (await botRejected(c.env, geo)) {
+  if (await botRejected(c.env, c.req.raw, geo)) {
     return refuse(403, "traffic_rejected");
   }
   const anonId = getCookie(c, COOKIE_NAME2);
@@ -29999,7 +30401,7 @@ var passThroughResponse = /* @__PURE__ */ __name((upstream) => {
   });
   return new Response(body, { status: upstream.status, headers });
 }, "passThroughResponse");
-var parseJson3 = /* @__PURE__ */ __name((text) => {
+var parseJson4 = /* @__PURE__ */ __name((text) => {
   try {
     return JSON.parse(text);
   } catch {
@@ -30014,7 +30416,7 @@ var webhookAck = /* @__PURE__ */ __name(async (slug, upstream) => {
   if (bytes === null) {
     return upstreamFailed(slug, "The endpoint outcomes exceed the size cap.");
   }
-  const parsed = endpointOutcomesSchema.safeParse(parseJson3(new TextDecoder().decode(bytes)));
+  const parsed = endpointOutcomesSchema.safeParse(parseJson4(new TextDecoder().decode(bytes)));
   if (!parsed.success) {
     return upstreamFailed(slug, "The endpoint outcomes are malformed.");
   }
@@ -30064,7 +30466,7 @@ var runForwardToApp = /* @__PURE__ */ __name(async (c, input2) => {
       method: endpoint.method,
       mode: endpoint.mode,
       version: app2.version,
-      ...app2.data.includes("geo") && requestGeo !== void 0 ? { geo: requestGeo } : {},
+      ...app2.data.includes("geo") && requestGeo !== void 0 ? { geo: cfDataFrom(requestGeo) } : {},
       installs: installs.map((install) => ({ id: install.id, ord: install.ord, label: install.label })),
       ...anonId === void 0 ? {} : { user: { anonId } }
     })
@@ -30072,286 +30474,91 @@ var runForwardToApp = /* @__PURE__ */ __name(async (c, input2) => {
   let upstream;
   try {
     const url2 = `https://app/__qinto/endpoint${endpoint.route}${search}`;
-    const init = { method: endpoint.method, headers, body };
-    upstream = endpoint.mode === "api" ? await fetchApiResponse(service, url2, init) : await service.fetch(url2, { ...init, signal: AbortSignal.timeout(WEBHOOK_ENDPOINT_TIMEOUT_MS) });
-  } catch (error61) {
-    return upstreamFailed(slug, String(error61));
-  }
-  adoptAppSpans(upstream);
-  writeAppObservability(c.env, upstream, {
-    app: observabilityApp(slug, app2),
-    installs,
-    budget: createDataPointBudget()
-  });
-  setSpanAttributes({ "app.status": upstream.status });
-  return endpoint.mode === "api" ? passThroughResponse(upstream) : webhookAck(slug, upstream);
-}, "runForwardToApp");
-var forwardToApp = /* @__PURE__ */ __name(async (c, input2) => {
-  const { slug, app: app2, endpoint, installs } = input2;
-  return traced(
-    `app.endpoint ${slug}`,
-    {
-      attrs: {
-        "app.slug": slug,
-        "app.version": app2.version,
-        "app.binding": app2.binding,
-        "app.hook": `endpoint.${endpoint.method} ${endpoint.route}`,
-        "app.endpoint_mode": endpoint.mode,
-        "app.installs": installs.length
-      }
-    },
-    () => {
-      return runForwardToApp(c, input2);
-    }
-  );
-}, "forwardToApp");
-var serveEndpoint = /* @__PURE__ */ __name(async (c, input2) => {
-  const { slug, app: app2, endpoint, search } = input2;
-  const refusal = await authorizeEndpoint(c, slug, endpoint);
-  if (refusal !== void 0) {
-    return refusal;
-  }
-  const installs = app2.installs.filter((install) => install.active);
-  const [first] = installs;
-  if (first === void 0) {
-    return refuse2(503, "inactive");
-  }
-  const key = endpoint.mode === "api" ? `${slug}:${first.id}:endpoint` : `${slug}:${endpoint.route}:endpoint`;
-  if (await rateLimited(c.env, key)) {
-    return refuse2(429, "rate_limited");
-  }
-  let body;
-  if (endpoint.method !== "GET") {
-    const bytes = await readBoundedBody(c.req.raw, MAX_ENDPOINT_BODY_BYTES);
-    if (bytes === null) {
-      return refuse2(413, "too_large");
-    }
-    body = bytes;
-  }
-  return forwardToApp(c, { slug, app: app2, endpoint, installs, body, search });
-}, "serveEndpoint");
-var handleAppEndpoint = /* @__PURE__ */ __name(async (c, slug) => {
-  const app2 = siteRegistry().registry.apps[slug];
-  if (app2 === void 0) {
-    return refuse2(404, "not_found");
-  }
-  const url2 = new URL(c.req.url);
-  const prefix = `/app/${slug}`;
-  if (url2.pathname !== prefix && !url2.pathname.startsWith(`${prefix}/`)) {
-    return refuse2(404, "not_found");
-  }
-  const preflight2 = c.req.method === "OPTIONS";
-  const method = preflight2 ? c.req.header("access-control-request-method") : c.req.method;
-  const endpoint = matchEndpoint(app2, url2.pathname.slice(prefix.length) || "/", method ?? "");
-  if (endpoint === void 0 || preflight2 && endpoint.auth !== "visitor") {
-    return refuse2(404, "not_found");
-  }
-  if (endpoint.auth === "visitor") {
-    return handleVisitorEndpoint(c, { slug, app: app2, method: endpoint.method, preflight: preflight2 }, (visitor, body) => {
-      return forwardToApp(c, { slug, app: app2, endpoint, installs: [visitor.install], body, search: url2.search, anonId: visitor.anonId });
-    });
-  }
-  return serveEndpoint(c, { slug, app: app2, endpoint, search: url2.search });
-}, "handleAppEndpoint");
-var appEndpointRoutes = new Hono2();
-appEndpointRoutes.all("/app/:slug/*", (c) => {
-  return handleAppEndpoint(c, c.req.param("slug"));
-});
-
-// ../../libs/app-ui-token/src/base64url.ts
-var base64UrlEncode = /* @__PURE__ */ __name((bytes) => {
-  let binary = "";
-  for (const byte of bytes) {
-    binary += String.fromCharCode(byte);
-  }
-  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
-}, "base64UrlEncode");
-var base64UrlDecode = /* @__PURE__ */ __name((text) => {
-  const padded = text.replaceAll("-", "+").replaceAll("_", "/").padEnd(text.length + (4 - text.length % 4) % 4, "=");
-  let binary;
-  try {
-    binary = atob(padded);
-  } catch {
-    return null;
-  }
-  const bytes = new Uint8Array(binary.length);
-  for (let index = 0; index < binary.length; index += 1) {
-    bytes[index] = binary.charCodeAt(index);
-  }
-  return bytes;
-}, "base64UrlDecode");
-
-// ../../libs/app-ui-token/src/env.ts
-var envSchema = external_exports.object({
-  v: external_exports.literal(1),
-  keys: external_exports.record(external_exports.string().min(1).max(16), external_exports.string().min(1))
-}).strict();
-var parseAppUiKeyEnv = /* @__PURE__ */ __name((raw2) => {
-  let json2;
-  try {
-    json2 = JSON.parse(raw2);
-  } catch {
-    return null;
-  }
-  const parsed = envSchema.safeParse(json2);
-  if (!parsed.success) {
-    return null;
-  }
-  const keys = {};
-  for (const [kid, encoded] of Object.entries(parsed.data.keys)) {
-    const bytes = base64UrlDecode(encoded);
-    if (bytes === null) {
-      return null;
-    }
-    keys[kid] = bytes;
-  }
-  return keys;
-}, "parseAppUiKeyEnv");
-
-// ../../libs/app-ui-token/src/jwt.ts
-var headerSchema = external_exports.object({
-  alg: external_exports.literal("HS256"),
-  typ: external_exports.literal("JWT"),
-  kid: external_exports.string().min(1).max(16)
-}).strict();
-var encodeJsonPart = /* @__PURE__ */ __name((value) => {
-  return base64UrlEncode(new TextEncoder().encode(JSON.stringify(value)));
-}, "encodeJsonPart");
-var parseJsonPart = /* @__PURE__ */ __name((part) => {
-  const bytes = base64UrlDecode(part);
-  if (bytes === null) {
-    return null;
-  }
-  try {
-    return JSON.parse(new TextDecoder().decode(bytes));
-  } catch {
-    return null;
-  }
-}, "parseJsonPart");
-var hmacKey = /* @__PURE__ */ __name((key, usage) => {
-  return crypto.subtle.importKey("raw", key, { name: "HMAC", hash: "SHA-256" }, false, [usage]);
-}, "hmacKey");
-var signCompact = /* @__PURE__ */ __name(async (kid, key, claims) => {
-  const signingInput = `${encodeJsonPart({ alg: "HS256", typ: "JWT", kid })}.${encodeJsonPart(claims)}`;
-  const signature = await crypto.subtle.sign("HMAC", await hmacKey(key, "sign"), new TextEncoder().encode(signingInput));
-  return `${signingInput}.${base64UrlEncode(new Uint8Array(signature))}`;
-}, "signCompact");
-var verifyCompactSignature = /* @__PURE__ */ __name(async (token, keys) => {
-  const [headerPart, claimsPart, signaturePart, extra] = token.split(".");
-  if (headerPart === void 0 || claimsPart === void 0 || signaturePart === void 0 || extra !== void 0) {
-    return { ok: false, reason: "malformed" };
-  }
-  const header = headerSchema.safeParse(parseJsonPart(headerPart));
-  if (!header.success) {
-    return { ok: false, reason: "malformed" };
-  }
-  const key = keys[header.data.kid];
-  if (key === void 0) {
-    return { ok: false, reason: "unknown_kid" };
-  }
-  const signature = base64UrlDecode(signaturePart);
-  if (signature === null) {
-    return { ok: false, reason: "malformed" };
+    const init = { method: endpoint.method, headers, body };
+    upstream = endpoint.mode === "api" ? await fetchApiResponse(service, url2, init) : await service.fetch(url2, { ...init, signal: AbortSignal.timeout(WEBHOOK_ENDPOINT_TIMEOUT_MS) });
+  } catch (error61) {
+    return upstreamFailed(slug, String(error61));
   }
-  const signed = await crypto.subtle.verify(
-    "HMAC",
-    await hmacKey(key, "verify"),
-    signature,
-    new TextEncoder().encode(`${headerPart}.${claimsPart}`)
+  adoptAppSpans(upstream);
+  writeAppObservability(c.env, upstream, {
+    app: observabilityApp(slug, app2),
+    installs,
+    budget: createDataPointBudget()
+  });
+  setSpanAttributes({ "app.status": upstream.status });
+  return endpoint.mode === "api" ? passThroughResponse(upstream) : webhookAck(slug, upstream);
+}, "runForwardToApp");
+var forwardToApp = /* @__PURE__ */ __name(async (c, input2) => {
+  const { slug, app: app2, endpoint, installs } = input2;
+  return traced(
+    `app.endpoint ${slug}`,
+    {
+      attrs: {
+        "app.slug": slug,
+        "app.version": app2.version,
+        "app.binding": app2.binding,
+        "app.hook": `endpoint.${endpoint.method} ${endpoint.route}`,
+        "app.endpoint_mode": endpoint.mode,
+        "app.installs": installs.length
+      }
+    },
+    () => {
+      return runForwardToApp(c, input2);
+    }
   );
-  if (!signed) {
-    return { ok: false, reason: "bad_signature" };
+}, "forwardToApp");
+var serveEndpoint = /* @__PURE__ */ __name(async (c, input2) => {
+  const { slug, app: app2, endpoint, search } = input2;
+  const refusal = await authorizeEndpoint(c, slug, endpoint);
+  if (refusal !== void 0) {
+    return refusal;
   }
-  return { ok: true, claims: parseJsonPart(claimsPart), kid: header.data.kid, key };
-}, "verifyCompactSignature");
-
-// ../../libs/app-ui-token/src/token.ts
-var APP_UI_TOKEN_SKEW_SECONDS = 60;
-var APP_UI_TOKEN_ISSUER = "qinto-portal";
-var claimsSchema = external_exports.object({
-  iss: external_exports.literal(APP_UI_TOKEN_ISSUER),
-  aud: external_exports.string().min(1),
-  sub: external_exports.string().min(1),
-  userId: external_exports.string().min(1),
-  iat: external_exports.number().int(),
-  exp: external_exports.number().int(),
-  domainId: external_exports.string().min(1),
-  appId: external_exports.string().min(1),
-  appInstallId: external_exports.string().min(1),
-  appVersionId: external_exports.string().min(1),
-  access: external_exports.enum(["read", "write"]),
-  // Absent means `full`; see the mint below.
-  appRole: external_exports.enum(APP_ROLES).optional()
-}).strict();
-var appUiAudience = /* @__PURE__ */ __name((slug) => {
-  return `app-ui:${slug}`;
-}, "appUiAudience");
-var verifyAppUiToken = /* @__PURE__ */ __name(async (input2) => {
-  const signature = await verifyCompactSignature(input2.token, input2.keys);
-  if (!signature.ok) {
-    return signature;
+  const installs = app2.installs.filter((install) => install.active);
+  const [first] = installs;
+  if (first === void 0) {
+    return refuse2(503, "inactive");
   }
-  const claims = claimsSchema.safeParse(signature.claims);
-  if (!claims.success) {
-    return { ok: false, reason: "bad_claims" };
+  const key = endpoint.mode === "api" ? `${slug}:${first.id}:endpoint` : `${slug}:${endpoint.route}:endpoint`;
+  if (await rateLimited(c.env, key)) {
+    return refuse2(429, "rate_limited");
   }
-  if (claims.data.aud !== appUiAudience(input2.slug)) {
-    return { ok: false, reason: "wrong_app" };
+  let body;
+  if (endpoint.method !== "GET") {
+    const bytes = await readBoundedBody(c.req.raw, MAX_ENDPOINT_BODY_BYTES);
+    if (bytes === null) {
+      return refuse2(413, "too_large");
+    }
+    body = bytes;
   }
-  const now = Math.floor(input2.now.getTime() / 1e3);
-  if (claims.data.iat > now + (input2.skewSeconds ?? APP_UI_TOKEN_SKEW_SECONDS)) {
-    return { ok: false, reason: "future_iat" };
+  return forwardToApp(c, { slug, app: app2, endpoint, installs, body, search });
+}, "serveEndpoint");
+var handleAppEndpoint = /* @__PURE__ */ __name(async (c, slug) => {
+  const app2 = siteRegistry().registry.apps[slug];
+  if (app2 === void 0) {
+    return refuse2(404, "not_found");
   }
-  if (claims.data.exp <= now) {
-    return { ok: false, reason: "expired" };
+  const url2 = new URL(c.req.url);
+  const prefix = `/app/${slug}`;
+  if (url2.pathname !== prefix && !url2.pathname.startsWith(`${prefix}/`)) {
+    return refuse2(404, "not_found");
   }
-  return { ok: true, claims: claims.data, kid: signature.kid, key: signature.key };
-}, "verifyAppUiToken");
-
-// ../../libs/app-ui-token/src/runtime-query-ticket.ts
-var APP_RUNTIME_QUERY_TICKET_ISSUER = "qinto-portal";
-var claimsSchema2 = external_exports.object({
-  iss: external_exports.literal(APP_RUNTIME_QUERY_TICKET_ISSUER),
-  aud: external_exports.string().min(1),
-  sub: external_exports.string().min(1),
-  iat: external_exports.number().int(),
-  exp: external_exports.number().int(),
-  domainId: external_exports.string().min(1),
-  appId: external_exports.string().min(1),
-  appInstallId: external_exports.string().min(1),
-  appVersionId: external_exports.string().min(1)
-}).strict();
-
-// ../../libs/app-ui-token/src/write-ticket.ts
-var APP_UI_WRITE_TICKET_TTL_SECONDS = 60;
-var APP_UI_WRITE_TICKET_ISSUER = "qinto-site";
-var claimsSchema3 = external_exports.object({
-  iss: external_exports.literal(APP_UI_WRITE_TICKET_ISSUER),
-  aud: external_exports.string().min(1),
-  sub: external_exports.string().min(1),
-  iat: external_exports.number().int(),
-  exp: external_exports.number().int(),
-  domainId: external_exports.string().min(1),
-  appId: external_exports.string().min(1),
-  appVersionId: external_exports.string().min(1)
-}).strict();
-var appUiWriteAudience = /* @__PURE__ */ __name((slug) => {
-  return `app-ui-write:${slug}`;
-}, "appUiWriteAudience");
-var mintAppUiWriteTicket = /* @__PURE__ */ __name(async (input2) => {
-  const iat = Math.floor(input2.now.getTime() / 1e3);
-  const claims = {
-    iss: APP_UI_WRITE_TICKET_ISSUER,
-    aud: appUiWriteAudience(input2.slug),
-    sub: input2.userId,
-    iat,
-    exp: iat + (input2.ttlSeconds ?? APP_UI_WRITE_TICKET_TTL_SECONDS),
-    domainId: input2.domainId,
-    appId: input2.appId,
-    appVersionId: input2.appVersionId
-  };
-  return signCompact(input2.kid, input2.key, claims);
-}, "mintAppUiWriteTicket");
+  const preflight2 = c.req.method === "OPTIONS";
+  const method = preflight2 ? c.req.header("access-control-request-method") : c.req.method;
+  const endpoint = matchEndpoint(app2, url2.pathname.slice(prefix.length) || "/", method ?? "");
+  if (endpoint === void 0 || preflight2 && endpoint.auth !== "visitor") {
+    return refuse2(404, "not_found");
+  }
+  if (endpoint.auth === "visitor") {
+    return handleVisitorEndpoint(c, { slug, app: app2, method: endpoint.method, preflight: preflight2 }, (visitor, body) => {
+      return forwardToApp(c, { slug, app: app2, endpoint, installs: [visitor.install], body, search: url2.search, anonId: visitor.anonId });
+    });
+  }
+  return serveEndpoint(c, { slug, app: app2, endpoint, search: url2.search });
+}, "handleAppEndpoint");
+var appEndpointRoutes = new Hono2();
+appEndpointRoutes.all("/app/:slug/*", (c) => {
+  return handleAppEndpoint(c, c.req.param("slug"));
+});
 
 // src/apps/ui-proxy.ts
 var APP_UI_TIMEOUT_MS = 6e4;
@@ -30660,6 +30867,7 @@ var createApiRouter = /* @__PURE__ */ __name(() => new OpenAPIHono({ defaultHook
 var CONNECTION_CF_HEADER = "x-connection-cf";
 var SESSION_HEADER = "x-session";
 var GPC_HEADER = "x-gpc";
+var RECONNECT_HEADER = "x-reconnect";
 var OPEN_PAGE_PARAMS = ["url", "referrer"];
 var MAX_HOST_USER_AGENT_LENGTH = 512;
 var MAX_HOST_LOCALE_LENGTH = 64;
@@ -30671,6 +30879,7 @@ var INTERNAL_HEADERS = /* @__PURE__ */ new Set([
   CONNECTION_CF_HEADER,
   SESSION_HEADER,
   GPC_HEADER,
+  RECONNECT_HEADER,
   TRACE_HEADER,
   CF_DATA_HEADER
 ]);
@@ -30759,7 +30968,7 @@ var boundedHost = /* @__PURE__ */ __name((request) => {
   };
   return bounded.ip === void 0 && bounded.userAgent === void 0 && bounded.locale === void 0 ? void 0 : bounded;
 }, "boundedHost");
-var connectionAttachment = /* @__PURE__ */ __name((request, geo, siteId) => {
+var connectionAttachment = /* @__PURE__ */ __name((request, geo, { siteId, anonId }) => {
   const userAgent = request.headers.get("user-agent");
   const attrs = {
     "url.full": withoutQuery(request.url),
@@ -30775,7 +30984,7 @@ var connectionAttachment = /* @__PURE__ */ __name((request, geo, siteId) => {
   const sessionBytes = attachmentFieldBytes("session", session2);
   const gpc = request.headers.get(GPC_HEADER) === "1";
   const gpcBytes = attachmentFieldBytes("gpc", gpc ? true : void 0);
-  const siteBytes = attachmentFieldBytes("siteId", siteId);
+  const siteBytes = attachmentFieldBytes("siteId", siteId) + attachmentFieldBytes("anonId", anonId);
   const cf = forwardedCf(request);
   const cfSuffix = cf === void 0 ? "" : `,"cf":${JSON.stringify(cf)}`;
   const cfBytes = new TextEncoder().encode(cfSuffix).length;
@@ -30786,6 +30995,7 @@ var connectionAttachment = /* @__PURE__ */ __name((request, geo, siteId) => {
   return {
     ...budgeted,
     siteId,
+    anonId,
     ...session2 === void 0 ? {} : { session: session2 },
     ...browserGeo === void 0 ? {} : { browserGeo },
     ...includedCf === void 0 ? {} : { cf: includedCf },
@@ -30793,6 +31003,14 @@ var connectionAttachment = /* @__PURE__ */ __name((request, geo, siteId) => {
     ...gpc ? { gpc: true } : {}
   };
 }, "connectionAttachment");
+var attachmentGeo = /* @__PURE__ */ __name((attachment) => {
+  return {
+    // `cf` is the forwarded `request.cf`, kept as plain JSON on the socket.
+    ...geoFromCf(attachment.cf),
+    ip: attachment.host?.ip,
+    userAgent: attachment.host?.userAgent
+  };
+}, "attachmentGeo");
 
 // src/helpers/request-span.ts
 var OMITTED_HEADERS = /* @__PURE__ */ new Set(["authorization", DISPATCH_HEADER, CF_DATA_HEADER]);
@@ -31192,6 +31410,29 @@ var withSetCookie = /* @__PURE__ */ __name((res, cookies) => {
   }
   return out;
 }, "withSetCookie");
+var connectCookies = /* @__PURE__ */ __name(async (c, userId, session2) => {
+  const root = c.env.ROOT_DOMAIN;
+  const hostname3 = new URL(c.req.url).hostname;
+  const domain2 = root !== void 0 && root !== "" && (hostname3 === root || hostname3.endsWith(`.${root}`)) ? root : void 0;
+  const attributes = {
+    httpOnly: true,
+    // `wrangler types` narrows COOKIE_SAME_SITE to its dev default; deploys also set none.
+    sameSite: c.env.COOKIE_SAME_SITE,
+    secure: true,
+    path: "/",
+    maxAge: COOKIE_MAX_AGE
+  };
+  const cookies = [
+    generateCookie(COOKIE_NAME2, userId, { ...attributes, ...domain2 === void 0 ? {} : { domain: domain2 } }),
+    // Re-issued on every connect, which is what makes the session expire after 30 idle minutes.
+    generateCookie(SESSION_COOKIE_NAME, `${session2.id}.${session2.startedAt}`, { ...attributes, maxAge: SESSION_MAX_AGE })
+  ];
+  const signature = await signVisitor(c.env, userId);
+  if (signature !== void 0) {
+    cookies.push(generateCookie(VISITOR_SIGNATURE_COOKIE, signature, attributes));
+  }
+  return cookies;
+}, "connectCookies");
 var open2 = /* @__PURE__ */ __name(async (c) => {
   if (c.req.header("upgrade")?.toLowerCase() !== "websocket") {
     return c.text("expected websocket", 426);
@@ -31204,13 +31445,14 @@ var open2 = /* @__PURE__ */ __name(async (c) => {
     });
     return enriched;
   });
-  if (await botRejected(c.env, geo)) {
+  if (await botRejected(c.env, c.req.raw, geo)) {
     return c.text("traffic rejected", 403);
   }
   const existing = getCookie(c, COOKIE_NAME2);
+  const canonical = existing !== void 0 && isCanonicalId(existing);
   let isNewUser = false;
   let userId;
-  if (existing !== void 0 && isCanonicalId(existing)) {
+  if (canonical) {
     userId = existing;
   } else {
     const adopted = edgeTagUserId(c);
@@ -31236,6 +31478,10 @@ var open2 = /* @__PURE__ */ __name(async (c) => {
     headers.set(GPC_HEADER, "1");
     setSpanAttributes({ "qinto.gpc": true });
   }
+  headers.delete(RECONNECT_HEADER);
+  if (canonical && c.req.query("reconnect") === "1") {
+    headers.set(RECONNECT_HEADER, "1");
+  }
   const res = await traced("rpc anon.connect", {}, () => {
     headers.delete(TRACE_HEADER);
     const trace = currentTraceContext();
@@ -31244,39 +31490,19 @@ var open2 = /* @__PURE__ */ __name(async (c) => {
     }
     return anonStub(c.env, userId).fetch(new Request(c.req.url, { method: "GET", headers }));
   });
-  const root = c.env.ROOT_DOMAIN;
-  const hostname3 = new URL(c.req.url).hostname;
-  const domain2 = root !== void 0 && root !== "" && (hostname3 === root || hostname3.endsWith(`.${root}`)) ? root : void 0;
-  const attributes = {
-    httpOnly: true,
-    // `wrangler types` narrows COOKIE_SAME_SITE to its dev default; deploys also set none.
-    sameSite: c.env.COOKIE_SAME_SITE,
-    secure: true,
-    path: "/",
-    maxAge: COOKIE_MAX_AGE
-  };
-  const cookies = [
-    generateCookie(COOKIE_NAME2, userId, { ...attributes, ...domain2 === void 0 ? {} : { domain: domain2 } }),
-    // Re-issued on every connect, which is what makes the session expire after 30 idle minutes.
-    generateCookie(SESSION_COOKIE_NAME, `${session2.id}.${session2.startedAt}`, { ...attributes, maxAge: SESSION_MAX_AGE })
-  ];
-  const signature = await signVisitor(c.env, userId);
-  if (signature !== void 0) {
-    cookies.push(generateCookie(VISITOR_SIGNATURE_COOKIE, signature, attributes));
-  }
-  return withSetCookie(res, cookies);
+  return withSetCookie(res, await connectCookies(c, userId, session2));
 }, "open");
 
 // browser-artifact/meta.json
 var meta_default = {
-  version: "0.1.14",
-  gitSha: "38d2892377935b8b457db896715c24891fc3b1ae",
-  builtAt: "2026-10-02T07:54:26.292Z",
-  hash: "50484908a3b28aa31a614fda30b1b3d803fe5922c8a485079f12e6bbf24cd9c1"
+  version: "0.1.15",
+  gitSha: "b90e20a6f236a81312f9525a2b089d2019d0c027",
+  builtAt: "2026-10-09T06:11:09.581Z",
+  hash: "a0cb067dc6246faae53d7842489effb3c46aa848ef529484ab6ee3868fd86762"
 };
 
 // src/paths/q-js.ts
-import qScript from "./8809017061697bf9b90fa4d72f7eb2e0f0e00ad4-q.js.txt";
+import qScript from "./73ef5f028ec35836560c0489d1abdeea83eceede-q.js.txt";
 
 // src/apps-q.ts
 import appsQScript from "./apps-q.json";
@@ -32476,13 +32702,15 @@ var cachedKv = /* @__PURE__ */ __name((kv) => {
 var VERSION_KEY = "schemaVersion";
 var applyMigrations = /* @__PURE__ */ __name((storage, migrations) => {
   const applied = storage.kv.get(VERSION_KEY) ?? 0;
-  for (const [index, migration] of migrations.entries()) {
-    if (index < applied) {
-      continue;
-    }
-    storage.sql.exec(migration);
-    storage.kv.put(VERSION_KEY, index + 1);
+  if (applied >= migrations.length) {
+    return;
   }
+  storage.transactionSync(() => {
+    for (const migration of migrations.slice(applied)) {
+      storage.sql.exec(migration);
+    }
+    storage.kv.put(VERSION_KEY, migrations.length);
+  });
 }, "applyMigrations");
 
 // src/id-graph/retention.ts
@@ -32768,15 +32996,15 @@ var seedMeta = /* @__PURE__ */ __name((kv, anonId, createdAt) => {
   kv.put(META_KEY, { anonId, linkedGlobalId: null, linkedAt: null, createdAt });
   return true;
 }, "seedMeta");
+var lastActivityAt = /* @__PURE__ */ __name((kv) => {
+  return kv.get(LAST_ACTIVITY_KEY) ?? kv.get(META_KEY)?.createdAt ?? null;
+}, "lastActivityAt");
 var touchActivity = /* @__PURE__ */ __name((kv, receivedAt) => {
-  const last = kv.get(LAST_ACTIVITY_KEY);
-  if (last === void 0 || receivedAt - last >= CLEANUP_INTERVAL_MS) {
+  const last = lastActivityAt(kv);
+  if (last === null || receivedAt - last >= CLEANUP_INTERVAL_MS) {
     kv.put(LAST_ACTIVITY_KEY, receivedAt);
   }
 }, "touchActivity");
-var lastActivityAt = /* @__PURE__ */ __name((kv) => {
-  return kv.get(LAST_ACTIVITY_KEY) ?? null;
-}, "lastActivityAt");
 var linkedGlobalId = /* @__PURE__ */ __name((kv) => {
   return kv.get(META_KEY)?.linkedGlobalId ?? null;
 }, "linkedGlobalId");
@@ -33010,7 +33238,7 @@ var standsDown = /* @__PURE__ */ __name(async (storage, staleActivity) => {
   if (lastActivity === staleActivity) {
     return false;
   }
-  await storage.setAlarm(cleanupTarget(storage, Date.now(), lastActivity ?? Date.now()));
+  await storage.setAlarm(cleanupTarget(storage, Date.now(), lastActivity));
   return true;
 }, "standsDown");
 var relink = /* @__PURE__ */ __name(async (storage, env, anonId, globalId) => {
@@ -33029,7 +33257,7 @@ var relink = /* @__PURE__ */ __name(async (storage, env, anonId, globalId) => {
     addSpanEvent("expiry relink failed", { level: "warn", attrs: { "anon.id": anonId, "global.id": globalId, error: String(error61) } });
   }
   if (mutated) {
-    await storage.setAlarm(cleanupTarget(storage, Date.now(), lastActivityAt(storage.kv) ?? Date.now()));
+    await storage.setAlarm(cleanupTarget(storage, Date.now(), lastActivityAt(storage.kv)));
   }
 }, "relink");
 var unlinkFromPerson = /* @__PURE__ */ __name((env, anonId, globalId) => {
@@ -33588,10 +33816,9 @@ var AnonDO = class extends DurableObject2 {
   // In memory on purpose: a hibernated socket sent nothing, so a fresh bucket on wake is the right one.
   frameBuckets = /* @__PURE__ */ new WeakMap();
   emitBudget = createTokenBucket(EMIT_BURST, EMITS_PER_SECOND);
-  // deleteAll removes the live schema; only a later write recreates it.
+  stored;
+  // This instance deleted the visitor's storage; only a later write recreates it.
   wiped = false;
-  // True while processAction holds ingestQueue, including the transform await.
-  ingestTurn = false;
   // Warm write-through mirrors reset together after an expiry or an erase.
   kvCache;
   cachedStorage;
@@ -33607,7 +33834,6 @@ var AnonDO = class extends DurableObject2 {
   sites;
   constructor(ctx, env) {
     super(ctx, env);
-    applyMigrations(ctx.storage, ANON_MIGRATIONS);
     this.kvCache = cachedKv(ctx.storage.kv);
     this.cachedStorage = { kv: this.kvCache, sql: ctx.storage.sql };
     this.graph = ownGraphEnv(ctx, env);
@@ -33630,32 +33856,29 @@ var AnonDO = class extends DurableObject2 {
     const trace = parseTraceContext(request.headers.get(TRACE_HEADER));
     return runInvocation({ name: "do.anon.connect", trace, attrs: connectAttrs(request, geo) }, async () => {
       const context = await this.sites.resolve({ domainId: siteId }, Date.now());
-      this.revive();
-      const now = Date.now();
-      this.cleanupAlarm = await seedCleanupAlarm(this.ctx.storage, now, lastActivityAt(this.kv) ?? now, this.cleanupAlarm);
-      seedMeta(this.kv, userId, now);
-      touchActivity(this.kv, now);
-      if (geo !== void 0 && !hasGeoRecord(this.kv)) {
-        this.seedGeoOnConnect(userId, geo, now);
+      if (this.isStored()) {
+        touchActivity(this.kv, Date.now());
       }
       const { 0: client, 1: server } = new WebSocketPair();
       this.ctx.acceptWebSocket(server, [siteId]);
-      const attachment = connectionAttachment(request, geo, siteId);
+      const attachment = connectionAttachment(request, geo, { siteId, anonId: userId });
       server.serializeAttachment(attachment);
       this.sendSharedContext([server], context);
-      const page = connectPage(request);
-      this.appFanOut(
-        {
-          kind: "connect",
-          ...attachment.cf === void 0 ? {} : { geo: attachment.cf },
-          host: attachment.host,
-          ...page === void 0 ? {} : { page },
-          ...attachment.session === void 0 ? {} : { session: attachment.session },
-          gpc: attachment.gpc
-        },
-        userId,
-        context
-      );
+      if (request.headers.get(RECONNECT_HEADER) !== "1") {
+        const page = connectPage(request);
+        this.appFanOut(
+          {
+            kind: "connect",
+            ...attachment.cf === void 0 ? {} : { geo: attachment.cf },
+            host: attachment.host,
+            ...page === void 0 ? {} : { page },
+            ...attachment.session === void 0 ? {} : { session: attachment.session },
+            gpc: attachment.gpc
+          },
+          userId,
+          context
+        );
+      }
       return new Response(null, { status: 101, webSocket: client });
     });
   }
@@ -33693,7 +33916,7 @@ var AnonDO = class extends DurableObject2 {
     }
     if (frame.t === "capture") {
       const { accepted } = await this.capture(
-        { apps: frame.apps, location: socketLocation(attachment.cf), gpc: attachment.gpc === true },
+        { anonId: userId, apps: frame.apps, location: socketLocation(attachment.cf), gpc: attachment.gpc === true },
         site
       );
       this.respond(ws, { t: "captureAck", ref, anonId: userId, accepted });
@@ -33738,7 +33961,8 @@ var AnonDO = class extends DurableObject2 {
   syncFromGlobal(snapshot, trace) {
     return runInvocation({ name: "do.anon.sync_from_global", trace, attrs: { "global.id": snapshot.globalId } }, () => {
       return this.enqueue(async () => {
-        if (await this.discardIfUnused()) {
+        const anonId = storedAnonId(this.kv);
+        if (anonId === null) {
           addSpanEvent("snapshot dropped: no visitor state", { level: "warn", attrs: { "global.id": snapshot.globalId } });
           return;
         }
@@ -33746,7 +33970,7 @@ var AnonDO = class extends DurableObject2 {
           addSpanEvent("foreign snapshot dropped", { level: "warn", attrs: { "global.id": snapshot.globalId } });
           return;
         }
-        this.cleanupAlarm = await seedCleanupAlarm(this.ctx.storage, Date.now(), lastActivityAt(this.kv) ?? Date.now(), this.cleanupAlarm);
+        await this.storeVisitor(anonId, Date.now());
         await this.applyOutcome(applySnapshot(this.cachedStorage, snapshot, this.snapshotCaches()));
       });
     });
@@ -33763,7 +33987,7 @@ var AnonDO = class extends DurableObject2 {
         this.respond(ws, { t: "error", ref: parsed.ref, message: "invalid message" });
         return;
       }
-      const userId = storedAnonId(this.kv);
+      const userId = attachment?.anonId ?? null;
       setSpanAttributes(frameSpanAttrs(parsed.frame, userId));
       if (parsed.frame.t === "getConsent") {
         this.respond(ws, this.consentReply(parsed.ref, userId));
@@ -33813,10 +34037,6 @@ var AnonDO = class extends DurableObject2 {
     };
     return runInvocation({ name: "do.anon.app_push", trace, attrs }, () => {
       return this.enqueue(async () => {
-        if (await this.discardIfUnused()) {
-          addSpanEvent("app push dropped: no visitor state", { level: "warn", attrs: { app: push.slug } });
-          return;
-        }
         this.deliverAppPush(push, await this.sites.resolve(site, Date.now()));
       });
     });
@@ -33836,26 +34056,19 @@ var AnonDO = class extends DurableObject2 {
   // so a value the caps refused must never be reported as stored.
   capture(input2, site, trace) {
     return runInvocation({ name: "do.anon.capture", trace }, () => {
-      return this.enqueue(async () => {
-        if (await this.discardIfUnused()) {
-          addSpanEvent("capture dropped: no visitor state", { level: "warn" });
-          return { accepted: {} };
-        }
-        return this.runCaptures(input2.apps, site, { location: input2.location, gpc: input2.gpc });
+      return this.enqueue(() => {
+        return this.runCaptures(input2.anonId, input2.apps, site, { location: input2.location, gpc: input2.gpc });
       });
     });
   }
-  // The server door. There is no connect to have seeded the visitor, and a migrated visitor can
-  // carry click ids before any identify, so unlike the socket this one creates the profile.
+  // A migrated visitor can carry click ids before any identify, so this door creates the profile.
   serverCapture(input2, site, trace) {
     return runInvocation({ name: "do.anon.server_capture", trace }, () => {
       return this.enqueue(async () => {
-        this.revive();
         const now = Date.now();
-        this.cleanupAlarm = await seedCleanupAlarm(this.ctx.storage, now, lastActivityAt(this.kv) ?? now, this.cleanupAlarm);
-        seedMeta(this.kv, input2.anonId, now);
+        await this.storeVisitor(input2.anonId, now);
         touchActivity(this.kv, now);
-        return this.runCaptures(input2.apps, site, { location: null, gpc: false });
+        return this.runCaptures(input2.anonId, input2.apps, site, { location: null, gpc: false });
       });
     });
   }
@@ -33864,7 +34077,8 @@ var AnonDO = class extends DurableObject2 {
   appCaptures(input2, site, trace) {
     return runInvocation({ name: "do.anon.app_captures", trace, attrs: { "app.slug": input2.slug } }, () => {
       return this.enqueue(async () => {
-        if (await this.discardIfUnused()) {
+        const anonId = this.visitorId();
+        if (anonId === null) {
           addSpanEvent("capture dropped: no visitor state", { level: "warn", attrs: { app: input2.slug } });
           return;
         }
@@ -33877,7 +34091,8 @@ var AnonDO = class extends DurableObject2 {
         })) {
           return;
         }
-        this.storeCaptures(
+        await this.storeCaptures(
+          anonId,
           input2.writes.map((write) => {
             return { ...write, appId: input2.slug, source: "app", ttlMs: declaredTtlMs(context.registry, input2.slug, write.key) };
           })
@@ -33885,7 +34100,7 @@ var AnonDO = class extends DurableObject2 {
       });
     });
   }
-  async runCaptures(apps, site, { location, gpc }) {
+  async runCaptures(anonId, apps, site, { location, gpc }) {
     const context = await this.sites.resolve(site, Date.now());
     const writes = acceptedCaptures(context.registry, apps, {
       consent: consentState2(this.kv),
@@ -33893,13 +34108,13 @@ var AnonDO = class extends DurableObject2 {
       gpc,
       location
     });
-    return { accepted: this.storeCaptures(writes) };
+    return { accepted: await this.storeCaptures(anonId, writes) };
   }
-  storeCaptures(writes) {
+  async storeCaptures(anonId, writes) {
     if (writes.length === 0) {
       return {};
     }
-    this.revive();
+    await this.storeVisitor(anonId, Date.now());
     const accepted = {};
     const stored = writeCaptures(this.sql, writes, Date.now(), this.captureMirror);
     for (const write of stored) {
@@ -33915,7 +34130,8 @@ var AnonDO = class extends DurableObject2 {
   appContext(input2, site, trace) {
     return runInvocation({ name: "do.anon.app_context", trace, attrs: { "app.slug": input2.slug } }, () => {
       return this.enqueue(async () => {
-        if (await this.discardIfUnused()) {
+        const anonId = this.visitorId();
+        if (anonId === null) {
           addSpanEvent("context dropped: no visitor state", { level: "warn", attrs: { app: input2.slug } });
           return [];
         }
@@ -33940,15 +34156,18 @@ var AnonDO = class extends DurableObject2 {
           }
           return true;
         });
-        return this.storeContext(writes.map((write) => ({ ...write, appId: input2.slug })));
+        return this.storeContext(
+          anonId,
+          writes.map((write) => ({ ...write, appId: input2.slug }))
+        );
       });
     });
   }
-  async storeContext(writes) {
+  async storeContext(anonId, writes) {
     if (writes.length === 0) {
       return [];
     }
-    this.revive();
+    await this.storeVisitor(anonId, Date.now());
     const stored = [];
     for (const write of writes) {
       if (writeContext(this.sql, [write], Date.now(), this.contextMirror).length === 0) {
@@ -33966,7 +34185,7 @@ var AnonDO = class extends DurableObject2 {
     return stored;
   }
   hasSharedContext() {
-    return !this.wiped && Object.keys(allContext(this.sql, "shared", this.contextMirror)).length > 0;
+    return this.isStored() && Object.keys(allContext(this.sql, "shared", this.contextMirror)).length > 0;
   }
   // Shared context is the level every app may read, so the browser gets it too — the connecting
   // socket on open, every socket on a change. Private never leaves the server. The connect frame is
@@ -33974,7 +34193,7 @@ var AnonDO = class extends DurableObject2 {
   // context from one that has not arrived yet.
   sendSharedContext(sockets, context) {
     const consent2 = consentState2(this.kv);
-    const stored = allContext(this.sql, "shared", this.contextMirror);
+    const stored = this.isStored() ? allContext(this.sql, "shared", this.contextMirror) : {};
     for (const socket of sockets) {
       const { gpc } = socket.deserializeAttachment();
       sendFrame(socket, sharedContextFrame(context, consent2, stored, gpc === true));
@@ -34002,12 +34221,10 @@ var AnonDO = class extends DurableObject2 {
       }
     }
   }
-  // A read must not resurrect a visitor: an rpc or workflow asking about an expired or unknown anon
-  // would otherwise leave an empty object behind that no cleanup alarm collects.
   getAppContext(slug, site, trace) {
     return runInvocation({ name: "do.anon.get_app_context", trace, attrs: { "app.slug": slug } }, () => {
       return this.enqueue(async () => {
-        if (await this.discardIfUnused()) {
+        if (!this.isStored()) {
           return readableContext(void 0, {});
         }
         const context = await this.sites.resolve(site, Date.now());
@@ -34026,20 +34243,18 @@ var AnonDO = class extends DurableObject2 {
       });
     });
   }
-  // Committed projection: must not join ingestQueue (a transform that lists facts holds that slot)
-  // and must not discardIfUnused during an ingest turn (meta is seeded after the transform).
+  // Must not join ingestQueue: a transform that lists facts holds that slot.
   getAppFacts(slug, query, site, trace) {
     return runInvocation({ name: "do.anon.get_app_facts", trace, attrs: { "app.slug": slug } }, async () => {
       const context = await this.sites.resolve(site, Date.now());
-      const unused = this.ingestTurn ? false : await this.discardIfUnused();
       const app2 = context.registry.apps[slug];
-      if (unused || app2 === void 0 || !app2.data.includes("facts")) {
+      if (app2 === void 0 || !app2.data.includes("facts")) {
         return null;
       }
       if (!consentAllows(consentState2(this.kv), slug, app2.consent.category, { enforced: context.consentEnforced, gpc: false })) {
         return null;
       }
-      if (this.wiped) {
+      if (!this.isStored()) {
         return { items: [], next: null };
       }
       return listAppFacts(this.sql, query, Date.now());
@@ -34074,8 +34289,7 @@ var AnonDO = class extends DurableObject2 {
       }
     }
   }
-  // A getConsent can arrive before the session is seeded, so the visitor is named only when there
-  // is one — the tag treats its absence as "cannot vouch for the memo" rather than as a match.
+  // No anonId tells the tag "cannot vouch for the memo", not a match.
   consentReply(ref, userId) {
     return { t: "consentState", ref, ...userId === null ? {} : { anonId: userId }, ...consentState2(this.kv) };
   }
@@ -34108,7 +34322,6 @@ var AnonDO = class extends DurableObject2 {
     return run;
   }
   async processAction(action, context) {
-    this.ingestTurn = true;
     let recorded = action;
     try {
       if (isNoopAction(action)) {
@@ -34122,12 +34335,15 @@ var AnonDO = class extends DurableObject2 {
       await this.runAction(transformed.action, transformed.releaseEmissions, context);
     } finally {
       this.recordActionBlocks(recorded, context);
-      this.ingestTurn = false;
     }
   }
   recordActionBlocks(action, context) {
     setSpanAttributes(
-      actionBlocks(action, this.appsSnapshot(action.userId, context), this.wiped ? [] : allIdentifiers(this.sql, this.identifiersMirror))
+      actionBlocks(
+        action,
+        this.appsSnapshot(action.userId, context),
+        this.isStored() ? allIdentifiers(this.sql, this.identifiersMirror) : []
+      )
     );
   }
   async runAction(current, releaseEmissions, context) {
@@ -34136,14 +34352,7 @@ var AnonDO = class extends DurableObject2 {
       this.releaseTransformEmissions(releaseEmissions);
       return;
     }
-    this.revive();
-    this.cleanupAlarm = await seedCleanupAlarm(
-      this.ctx.storage,
-      Date.now(),
-      lastActivityAt(this.kv) ?? current.receivedAt,
-      this.cleanupAlarm
-    );
-    seedMeta(this.kv, current.userId, current.receivedAt);
+    await this.storeVisitor(current.userId, current.receivedAt);
     touchActivity(this.kv, current.receivedAt);
     const novelIdentifier = this.recordIdentifiers(current);
     if (novelIdentifier && linkedGlobalId(this.kv) !== null) {
@@ -34200,16 +34409,15 @@ var AnonDO = class extends DurableObject2 {
   }
   appsSnapshot(anonId, context) {
     const meta3 = storedMeta(this.kv);
+    const stored = this.isStored();
     return {
       anonId,
       globalId: meta3?.linkedGlobalId ?? null,
-      createdAt: meta3?.createdAt ?? null,
+      createdAt: meta3?.createdAt ?? Date.now(),
       pii: userProperties(this.kv),
-      // A wipe dropped the sql tables, so reading them would throw — and reviving for a transform
-      // snapshot would strand recreated storage when the chain fails or drops.
-      custom: this.wiped ? {} : customProperties(this.sql, this.customPropsMirror),
-      captures: this.wiped ? {} : allCaptures(this.sql, Date.now(), this.captureMirror),
-      context: this.wiped ? { private: {}, shared: {} } : {
+      custom: stored ? customProperties(this.sql, this.customPropsMirror) : {},
+      captures: stored ? allCaptures(this.sql, Date.now(), this.captureMirror) : {},
+      context: !stored ? { private: {}, shared: {} } : {
         private: allContext(this.sql, "private", this.contextMirror),
         shared: readableSharedContext(
           context.registry,
@@ -34244,7 +34452,7 @@ var AnonDO = class extends DurableObject2 {
   getProperties(trace) {
     return runInvocation({ name: "do.anon.get_properties", trace }, () => {
       return this.enqueue(async () => {
-        if (await this.discardIfUnused()) {
+        if (!this.isStored()) {
           return {};
         }
         return { ...userProperties(this.kv), ...customProperties(this.sql, this.customPropsMirror) };
@@ -34254,16 +34462,15 @@ var AnonDO = class extends DurableObject2 {
   getConsent(trace) {
     return runInvocation({ name: "do.anon.get_consent", trace }, () => {
       return this.enqueue(async () => {
-        await this.discardIfUnused();
         return consentState2(this.kv);
       });
     });
   }
-  // Null means no session: the id was never seeded or its profile expired, and the object it addressed is discarded.
+  // Null means no session: the id stored nothing yet or its profile expired.
   getPersonLink(trace) {
     return runInvocation({ name: "do.anon.get_person_link", trace }, () => {
       return this.enqueue(async () => {
-        if (await this.discardIfUnused()) {
+        if (!this.isStored()) {
           return null;
         }
         return { globalId: linkedGlobalId(this.kv) };
@@ -34273,7 +34480,7 @@ var AnonDO = class extends DurableObject2 {
   getGlobalId(trace) {
     return runInvocation({ name: "do.anon.get_global_id", trace }, () => {
       return this.enqueue(async () => {
-        if (await this.discardIfUnused()) {
+        if (!this.isStored()) {
           return null;
         }
         return linkedGlobalId(this.kv);
@@ -34283,8 +34490,8 @@ var AnonDO = class extends DurableObject2 {
   erasable(trace) {
     return runInvocation({ name: "do.anon.erasable", trace }, () => {
       return this.enqueue(async () => {
-        if (await this.discardIfUnused()) {
-          return null;
+        if (!this.isStored()) {
+          return this.ctx.getWebSockets().length === 0 ? null : { globalId: null, identifiers: [] };
         }
         const identifiers = allIdentifiers(this.sql, this.identifiersMirror).map(({ type, value }) => ({ type, value }));
         return { globalId: linkedGlobalId(this.kv), identifiers };
@@ -34294,7 +34501,7 @@ var AnonDO = class extends DurableObject2 {
   inspect(trace) {
     return runInvocation({ name: "do.anon.inspect", trace }, () => {
       return this.enqueue(async () => {
-        if (await this.discardIfUnused()) {
+        if (!this.isStored()) {
           return { exists: false };
         }
         return { exists: true, objectId: this.ctx.id.toString(), ...dumpStorage(this.ctx.storage) };
@@ -34304,7 +34511,7 @@ var AnonDO = class extends DurableObject2 {
   inspectTable(table, offset, limit, trace) {
     return runInvocation({ name: "do.anon.inspect_table", trace, attrs: { "inspect.table": table } }, () => {
       return this.enqueue(async () => {
-        if (await this.discardIfUnused()) {
+        if (!this.isStored()) {
           return null;
         }
         return readTable(this.ctx.storage, table, offset, limit);
@@ -34314,13 +34521,16 @@ var AnonDO = class extends DurableObject2 {
   erase(trace) {
     return runInvocation({ name: "do.anon.erase", trace }, () => {
       return this.enqueue(async () => {
-        if (await this.discardIfUnused()) {
+        const stored = this.isStored();
+        if (!stored && this.ctx.getWebSockets().length === 0) {
           return false;
         }
-        try {
-          await eraseAnon(this.ctx.storage, this.graph);
-        } finally {
-          this.resetMirrors();
+        if (stored) {
+          try {
+            await eraseAnon(this.ctx.storage, this.graph);
+          } finally {
+            this.resetMirrors();
+          }
         }
         this.wiped = true;
         for (const socket of this.ctx.getWebSockets()) {
@@ -34330,19 +34540,24 @@ var AnonDO = class extends DurableObject2 {
       });
     });
   }
-  // Addressing an object runs the constructor's schema exec, so a call that never writes — a read, an
-  // inspect, a push or a snapshot for an id that was never used — would otherwise leave an empty object
-  // behind that no cleanup alarm ever collects. Every write path seeds meta before it stores anything,
-  // so a missing meta record means there is nothing to lose.
-  async discardIfUnused() {
-    if (storedAnonId(this.kv) !== null) {
-      return false;
+  // Every write seeds meta through storeVisitor first, so an object without it has no schema to read.
+  isStored() {
+    if (this.stored === void 0) {
+      this.stored = storedMeta(this.kv) !== void 0;
+      if (this.stored) {
+        applyMigrations(this.ctx.storage, ANON_MIGRATIONS);
+      }
     }
-    if (!this.wiped) {
-      await this.ctx.storage.deleteAll();
-      this.wiped = true;
+    return this.stored;
+  }
+  // Stubs address this object by anon id, but an app may name any user, so only a canonical id counts.
+  visitorId() {
+    const anonId = storedAnonId(this.kv);
+    if (anonId !== null || this.wiped) {
+      return anonId;
     }
-    return true;
+    const name = this.ctx.id.name;
+    return name !== void 0 && isCanonicalId(name) ? name : null;
   }
   appendProjectionHistory(outcomes, source) {
     for (const { entry } of outcomes) {
@@ -34551,6 +34766,7 @@ var AnonDO = class extends DurableObject2 {
   }
   async alarm() {
     return runInvocation({ name: "do.anon.cleanup" }, async () => {
+      applyMigrations(this.ctx.storage, ANON_MIGRATIONS);
       this.cleanupAlarm = void 0;
       const now = Date.now();
       const lastActivity = lastActivityAt(this.kv) ?? now;
@@ -34575,6 +34791,7 @@ var AnonDO = class extends DurableObject2 {
   }
   resetMirrors() {
     this.kvCache.clear();
+    this.stored = void 0;
     this.cleanupAlarm = void 0;
     this.identifiersMirror.reset();
     this.conversionsMirror.reset();
@@ -34582,14 +34799,22 @@ var AnonDO = class extends DurableObject2 {
     this.captureMirror.reset();
     this.contextMirror.reset();
   }
-  revive() {
-    if (this.wiped) {
+  // Callers run in ingestQueue and nothing awaits between the stored check and the seeds.
+  async storeVisitor(anonId, at) {
+    this.cleanupAlarm = await seedCleanupAlarm(this.ctx.storage, Date.now(), lastActivityAt(this.kv) ?? at, this.cleanupAlarm);
+    if (!this.isStored()) {
       applyMigrations(this.ctx.storage, ANON_MIGRATIONS);
+      seedMeta(this.kv, anonId, at);
+      this.stored = true;
       this.wiped = false;
     }
+    const socket = hasGeoRecord(this.kv) ? void 0 : this.ctx.getWebSockets()[0]?.deserializeAttachment();
+    if (socket !== void 0) {
+      updateGeo(this.cachedStorage, attachmentGeo(socket), at);
+    }
   }
   async retargetCleanupAlarm(now) {
-    const target = cleanupTarget(this.cachedStorage, now, lastActivityAt(this.kv) ?? now);
+    const target = cleanupTarget(this.cachedStorage, now, lastActivityAt(this.kv));
     if (this.cleanupAlarm === target) {
       return;
     }
@@ -34599,14 +34824,6 @@ var AnonDO = class extends DurableObject2 {
     await this.ctx.storage.setAlarm(target);
     this.cleanupAlarm = target;
   }
-  seedGeoOnConnect(anonId, geo, observedAt) {
-    const run = this.enqueue(async () => {
-      this.revive();
-      updateGeo(this.cachedStorage, geo, observedAt);
-      await this.retargetCleanupAlarm(Date.now());
-    });
-    this.ctx.waitUntil(run.catch((error61) => console.warn("geo seed failed", { anonId, error: error61 })));
-  }
 };
 
 // src/id-graph/global/do.ts