@blotout/qinto-cli 0.1.31 → 0.1.32

package/dist/worker-artifact/main/index.js

@@ -21577,7 +21577,7 @@ var userGeoSchema = external_exports.object({
 
 // ../../libs/app-envelope/src/envelope.ts
 var ENVELOPE_VERSION = 3;
-var ENVELOPE_ERROR_CODES = ["invalid_arguments"];
+var ENVELOPE_ERROR_CODES = ["invalid_arguments", "result_too_large", "callee_timeout", "rpc_error"];
 var MAX_INSTALLS_PER_APP = 15;
 var MAX_APPS_PER_DOMAIN = 50;
 var MAX_EMITS_PER_INSTALL = 10;
@@ -21593,6 +21593,7 @@ var MAX_SHARED_CONTEXT_ENTRY_BYTES = 4 * 1024;
 var MAX_PUSH_BYTES = 16 * 1024;
 var MAX_RESPONSE_BYTES = 1024 * 1024;
 var MAX_RPC_BYTES = 128 * 1024;
+var TRAFFIC_CLASSES = ["hot", "cold"];
 var installSchema = external_exports.object({ id: external_exports.string().min(1).max(64), ord: external_exports.number().int().min(1), label: external_exports.string().max(100) }).strict();
 var installRuleSchema = external_exports.object({
   mode: external_exports.enum(["except", "only"]),
@@ -21677,7 +21678,15 @@ var envelopeRequestSchema = external_exports.object({
   context: external_exports.object({ private: contextEntrySchema.optional(), shared: external_exports.record(external_exports.string().min(1).max(30), contextEntrySchema).optional() }).strict().optional(),
   // RPC depth is capped at 3 by the broker; hook depth at 2 by the emit path.
   depth: external_exports.number().int().min(0).max(3),
-  rpc: external_exports.object({ caller: external_exports.string().min(1).max(30).nullable(), fn: external_exports.string().min(1).max(64), args: external_exports.unknown() }).strict().refine((rpc) => {
+  rpc: external_exports.object({
+    caller: external_exports.string().min(1).max(30).nullable(),
+    fn: external_exports.string().min(1).max(64),
+    args: external_exports.unknown(),
+    // Optional on the wire: a site worker predating traffic classes sends none, which means hot.
+    traffic: external_exports.enum(TRAFFIC_CLASSES).optional(),
+    // Cold calls only: the broker mints it so the callee can query its own catalog.
+    queryTicket: external_exports.string().min(1).max(2048).optional()
+  }).strict().refine((rpc) => {
     return new TextEncoder().encode(JSON.stringify(rpc.args ?? null)).length <= MAX_RPC_BYTES;
   }, "RPC args exceed the size cap").optional(),
   action: external_exports.object({
@@ -26569,6 +26578,207 @@ var constantTimeEqual = /* @__PURE__ */ __name((expected, presented) => {
   return expectedBytes.length === presentedBytes.length && timingSafeEqual(expectedBytes, presentedBytes);
 }, "constantTimeEqual");
 
+// src/helpers/durable.ts
+var ownGraphEnv = /* @__PURE__ */ __name((ctx, env) => {
+  const exports = ctx.exports;
+  return {
+    ...env,
+    get ANON_DO() {
+      return exports.AnonDO;
+    },
+    get GLOBAL_DO() {
+      return exports.GlobalDO;
+    },
+    get ALIAS_DO() {
+      return exports.AliasDO;
+    }
+  };
+}, "ownGraphEnv");
+var JURISDICTIONS = /* @__PURE__ */ new Set(["eu", "fedramp", "fedramp-high", "us"]);
+var LOCATION_HINTS = /* @__PURE__ */ new Set([
+  "wnam",
+  "enam",
+  "sam",
+  "weur",
+  "eeur",
+  "apac",
+  "apac-ne",
+  "apac-se",
+  "oc",
+  "afr",
+  "me"
+]);
+var residencyStub = /* @__PURE__ */ __name((namespace, env, name) => {
+  const residency = env;
+  const jurisdiction = residency.DO_JURISDICTION;
+  const scoped = jurisdiction !== void 0 && JURISDICTIONS.has(jurisdiction) ? namespace.jurisdiction(jurisdiction) : namespace;
+  const locationHint = residency.LOCATION_HINT;
+  const options = locationHint !== void 0 && LOCATION_HINTS.has(locationHint) ? { locationHint } : void 0;
+  return scoped.get(scoped.idFromName(name), options);
+}, "residencyStub");
+
+// src/id-graph/anon/client.ts
+var anonStub = /* @__PURE__ */ __name((env, anonId) => {
+  return residencyStub(env.ANON_DO, env, anonId);
+}, "anonStub");
+
+// src/id-graph/consent.ts
+var CONSENT_CATEGORIES2 = ["necessary", "functional", "analytics", "marketing", "salesOfData"];
+var CONSENT_CATEGORY_PREFIX = "consent.category.";
+var CONSENT_APP_PREFIX = "consent.app.";
+var consentEntries = /* @__PURE__ */ __name((payload, observedAt) => {
+  const entries = [];
+  for (const category of CONSENT_CATEGORIES2) {
+    const granted = payload.categories[category];
+    if (granted === void 0) {
+      continue;
+    }
+    entries.push({ key: `${CONSENT_CATEGORY_PREFIX}${category}`, value: String(granted), observedAt });
+  }
+  for (const [appId, granted] of Object.entries(payload.apps)) {
+    entries.push({ key: `${CONSENT_APP_PREFIX}${appId}`, value: String(granted), observedAt });
+  }
+  return entries;
+}, "consentEntries");
+
+// src/id-graph/projections.ts
+var PII_PREFIX = "pii.";
+var CUSTOM_PREFIX = "custom.";
+var GEO_PREFIX = "geo.";
+var PROJECTION_KINDS = ["pii", "custom", "consent_category", "consent_app", "geo"];
+var PROJECTION_PREFIX = {
+  pii: PII_PREFIX,
+  custom: CUSTOM_PREFIX,
+  consent_category: CONSENT_CATEGORY_PREFIX,
+  consent_app: CONSENT_APP_PREFIX,
+  geo: GEO_PREFIX
+};
+var FANOUT_KINDS = ["pii", "custom", "consent_category", "consent_app"];
+var projectionFact = /* @__PURE__ */ __name((projectionKey) => {
+  for (const kind2 of PROJECTION_KINDS) {
+    const prefix = PROJECTION_PREFIX[kind2];
+    if (projectionKey.startsWith(prefix)) {
+      return { kind: kind2, scope: "", key: projectionKey.slice(prefix.length) };
+    }
+  }
+  throw new Error(`Unknown projection key: ${projectionKey}`);
+}, "projectionFact");
+
+// src/id-graph/anon/facts.ts
+var FACT_KINDS = [
+  ...PROJECTION_KINDS,
+  "capture",
+  "identifier",
+  "conversion",
+  "context_private_kv",
+  "context_private_text",
+  "context_shared_kv",
+  "context_shared_text"
+];
+var APP_FACT_KINDS = ["custom", "capture", "identifier", "conversion", "pii", "consent_category", "consent_app", "geo"];
+var MAX_APP_FACTS_PER_PAGE = 100;
+var MAX_APP_FACT_PAGE_BYTES = 1024 * 1024;
+var COLUMNS = "kind, scope, key, value, source, type, amount, currency, event_id, data_json, first_at, observed_at, synced_at, expires_at";
+var rowOf = /* @__PURE__ */ __name((row) => {
+  return {
+    kind: row.kind,
+    scope: row.scope,
+    key: row.key,
+    value: row.value,
+    source: row.source,
+    type: row.type,
+    amount: row.amount,
+    currency: row.currency,
+    eventId: row.event_id,
+    dataJson: row.data_json,
+    firstAt: row.first_at,
+    observedAt: row.observed_at,
+    syncedAt: row.synced_at,
+    expiresAt: row.expires_at
+  };
+}, "rowOf");
+var appFactOf = /* @__PURE__ */ __name((row) => {
+  const { syncedAt: _syncedAt, expiresAt: _expiresAt, ...fact } = rowOf(row);
+  return { ...fact, kind: fact.kind };
+}, "appFactOf");
+var listAppFacts = /* @__PURE__ */ __name((sql, query, now) => {
+  const maxRowId = query.maxRowId ?? sql.exec("SELECT MAX(rowid) AS maxRowId FROM facts").one().maxRowId;
+  if (maxRowId === null) {
+    return { items: [], next: null };
+  }
+  const where = ["rowid > ?", "rowid <= ?", "(expires_at IS NULL OR expires_at > ?)"];
+  const params = [query.afterRowId, maxRowId, now];
+  if (query.kinds.length > 0) {
+    where.push(`kind IN (${query.kinds.map(() => "?").join(", ")})`);
+    params.push(...query.kinds);
+  }
+  if (query.observedAtGte !== null) {
+    where.push("observed_at >= ?");
+    params.push(query.observedAtGte);
+  }
+  if (query.observedAtLt !== null) {
+    where.push("observed_at < ?");
+    params.push(query.observedAtLt);
+  }
+  const rows = sql.exec(`SELECT rowid, ${COLUMNS} FROM facts WHERE ${where.join(" AND ")} ORDER BY rowid LIMIT ?`, ...params, query.limit + 1).toArray();
+  const items = [];
+  let lastRowId = query.afterRowId;
+  for (const row of rows.slice(0, query.limit)) {
+    const fact = appFactOf(row);
+    const candidate = [...items, fact];
+    if (new TextEncoder().encode(JSON.stringify(candidate)).byteLength > MAX_APP_FACT_PAGE_BYTES) {
+      if (items.length === 0) {
+        throw new Error("fact_too_large");
+      }
+      break;
+    }
+    items.push(fact);
+    lastRowId = row.rowid;
+  }
+  const hasMore = rows.length > items.length;
+  return { items, next: hasMore ? { afterRowId: lastRowId, maxRowId } : null };
+}, "listAppFacts");
+var insertFact = /* @__PURE__ */ __name((sql, fact) => {
+  sql.exec(
+    `INSERT INTO facts (${COLUMNS}) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, ?)`,
+    fact.kind,
+    fact.scope,
+    fact.key,
+    fact.value ?? null,
+    fact.source ?? null,
+    fact.type ?? null,
+    fact.amount ?? null,
+    fact.currency ?? null,
+    fact.eventId ?? null,
+    fact.dataJson ?? null,
+    fact.firstAt ?? null,
+    fact.observedAt,
+    fact.expiresAt ?? null
+  );
+}, "insertFact");
+var latestFact = /* @__PURE__ */ __name((sql, coords) => {
+  const row = sql.exec(
+    `SELECT ${COLUMNS} FROM facts WHERE kind = ? AND scope = ? AND key = ? ORDER BY observed_at DESC, rowid DESC LIMIT 1`,
+    coords.kind,
+    coords.scope,
+    coords.key
+  ).toArray().at(0);
+  return row === void 0 ? void 0 : rowOf(row);
+}, "latestFact");
+var latestFacts = /* @__PURE__ */ __name((sql, kind2) => {
+  const rows = sql.exec(`SELECT ${COLUMNS} FROM facts WHERE kind = ? ORDER BY scope, key, observed_at, rowid`, kind2).toArray();
+  const latest = [];
+  for (const row of rows) {
+    const previous = latest.at(-1);
+    if (previous !== void 0 && previous.scope === row.scope && previous.key === row.key) {
+      latest[latest.length - 1] = rowOf(row);
+      continue;
+    }
+    latest.push(rowOf(row));
+  }
+  return latest;
+}, "latestFacts");
+
 // src/apps/consent-gate.ts
 var parseEnforced = /* @__PURE__ */ __name((raw2) => {
   let parsed;
@@ -26651,6 +26861,9 @@ var appSchema = external_exports.object({
   // Absent from an old embedded registry; the default never equals a real claim, so the ui proxy
   // refuses stale registries with token_stale instead of turning the app off.
   versionId: external_exports.string().min(1).default(""),
+  // Absent from a registry deployed before cold rpc calls carried a query ticket; without it the
+  // broker sends the callee none.
+  appId: external_exports.string().min(1).optional(),
   consent: external_exports.object({ category: external_exports.string() }),
   // Plain strings, not the bucket enum: an unknown bucket from a newer registry must not turn apps off.
   data: external_exports.array(external_exports.string()).default([]),
@@ -26737,559 +26950,50 @@ var siteRefOf = /* @__PURE__ */ __name(({ domainId, fingerprint }) => {
   return { domainId, fingerprint };
 }, "siteRefOf");
 
-// ../../libs/cf-data/src/cf-data.ts
-var CF_DATA_HEADER = "x-cf-data";
-var cfDataFrom = /* @__PURE__ */ __name((cf) => {
-  return {
-    country: cf?.country,
-    city: cf?.city,
-    region: cf?.region,
-    regionCode: cf?.regionCode,
-    timezone: cf?.timezone,
-    postalCode: cf?.postalCode,
-    continent: cf?.continent,
-    longitude: cf?.longitude,
-    latitude: cf?.latitude,
-    isEUCountry: cf?.isEUCountry,
-    botManagement: {
-      ja4: cf?.botManagement?.ja4,
-      ja3Hash: cf?.botManagement?.ja3Hash,
-      score: cf?.botManagement?.score,
-      verifiedBot: cf?.botManagement?.verifiedBot
-    }
-  };
-}, "cfDataFrom");
-var parseCfData = /* @__PURE__ */ __name((raw2) => {
-  if (raw2 === null) {
-    return void 0;
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw2);
-  } catch {
-    return void 0;
-  }
-  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-    return void 0;
-  }
-  return parsed;
-}, "parseCfData");
-
-// src/helpers/geo.ts
-var UNDETERMINED_COUNTRIES = /* @__PURE__ */ new Set(["XX", "T1"]);
-var detectedCountry = /* @__PURE__ */ __name((cf) => {
-  const country = cf?.country;
-  return country && !UNDETERMINED_COUNTRIES.has(country) ? country : void 0;
-}, "detectedCountry");
-var euCountry = /* @__PURE__ */ __name((cf, country) => {
-  if (cf?.isEUCountry === "1") {
-    return "yes";
-  }
-  return country ? "no" : "unknown";
-}, "euCountry");
-var withForwardedCf = /* @__PURE__ */ __name((request) => {
-  if (request.cf !== void 0) {
-    return request;
-  }
-  const cf = parseCfData(request.headers.get(CF_DATA_HEADER));
-  return cf === void 0 ? request : new Request(request, { cf });
-}, "withForwardedCf");
-var loggableGeo = /* @__PURE__ */ __name((geo) => {
-  const fields = {};
-  for (const [key, value] of Object.entries(geo)) {
-    if (value !== void 0) {
-      fields[key] = String(value);
-    }
-  }
-  return fields;
-}, "loggableGeo");
-var hostFromRequest = /* @__PURE__ */ __name((request) => {
-  return {
-    ip: request.headers.get("cf-connecting-ip") ?? void 0,
-    userAgent: request.headers.get("user-agent") ?? void 0,
-    locale: request.headers.get("accept-language")?.split(",")[0]?.trim() || void 0
-  };
-}, "hostFromRequest");
-var geoFromCf = /* @__PURE__ */ __name((cf) => {
-  const bot = cf?.botManagement;
-  const country = detectedCountry(cf);
-  return {
-    timezone: cf?.timezone ?? void 0,
-    city: cf?.city ?? void 0,
-    postalCode: cf?.postalCode ?? void 0,
-    region: cf?.region ?? void 0,
-    regionCode: cf?.regionCode ?? void 0,
-    country,
-    continent: cf?.continent ?? void 0,
-    isEUCountry: euCountry(cf, country),
-    latitude: cf?.latitude ?? void 0,
-    longitude: cf?.longitude ?? void 0,
-    ja4: bot?.ja4,
-    ja3: bot?.ja3Hash,
-    botScore: bot?.score
-  };
-}, "geoFromCf");
-var geoFromRequest = /* @__PURE__ */ __name((request) => {
-  return {
-    ...hostFromRequest(request),
-    ...geoFromCf(request.cf)
-  };
-}, "geoFromRequest");
-
-// src/helpers/durable.ts
-var ownGraphEnv = /* @__PURE__ */ __name((ctx, env) => {
-  const exports = ctx.exports;
-  return {
-    ...env,
-    get ANON_DO() {
-      return exports.AnonDO;
-    },
-    get GLOBAL_DO() {
-      return exports.GlobalDO;
-    },
-    get ALIAS_DO() {
-      return exports.AliasDO;
-    }
-  };
-}, "ownGraphEnv");
-var JURISDICTIONS = /* @__PURE__ */ new Set(["eu", "fedramp", "fedramp-high", "us"]);
-var LOCATION_HINTS = /* @__PURE__ */ new Set([
-  "wnam",
-  "enam",
-  "sam",
-  "weur",
-  "eeur",
-  "apac",
-  "apac-ne",
-  "apac-se",
-  "oc",
-  "afr",
-  "me"
-]);
-var residencyStub = /* @__PURE__ */ __name((namespace, env, name) => {
-  const residency = env;
-  const jurisdiction = residency.DO_JURISDICTION;
-  const scoped = jurisdiction !== void 0 && JURISDICTIONS.has(jurisdiction) ? namespace.jurisdiction(jurisdiction) : namespace;
-  const locationHint = residency.LOCATION_HINT;
-  const options = locationHint !== void 0 && LOCATION_HINTS.has(locationHint) ? { locationHint } : void 0;
-  return scoped.get(scoped.idFromName(name), options);
-}, "residencyStub");
-
-// src/id-graph/anon/client.ts
-var anonStub = /* @__PURE__ */ __name((env, anonId) => {
-  return residencyStub(env.ANON_DO, env, anonId);
-}, "anonStub");
-
-// src/id-graph/consent.ts
-var CONSENT_CATEGORIES2 = ["necessary", "functional", "analytics", "marketing", "salesOfData"];
-var CONSENT_CATEGORY_PREFIX = "consent.category.";
-var CONSENT_APP_PREFIX = "consent.app.";
-var consentEntries = /* @__PURE__ */ __name((payload, observedAt) => {
-  const entries = [];
-  for (const category of CONSENT_CATEGORIES2) {
-    const granted = payload.categories[category];
-    if (granted === void 0) {
-      continue;
-    }
-    entries.push({ key: `${CONSENT_CATEGORY_PREFIX}${category}`, value: String(granted), observedAt });
-  }
-  for (const [appId, granted] of Object.entries(payload.apps)) {
-    entries.push({ key: `${CONSENT_APP_PREFIX}${appId}`, value: String(granted), observedAt });
-  }
-  return entries;
-}, "consentEntries");
-
-// src/id-graph/traits.ts
-var PII_KEYS = ["first_name", "last_name", "email", "phone", "country", "state", "city", "postal_code"];
-var snakeCase = /* @__PURE__ */ __name((key) => {
-  return key.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase();
-}, "snakeCase");
-var stringifyTrait = /* @__PURE__ */ __name((value) => {
-  return typeof value === "string" ? value : JSON.stringify(value);
-}, "stringifyTrait");
-var piiTrait = /* @__PURE__ */ __name((key, rawValue) => {
-  if (key !== "email" && key !== "phone") {
-    return stringifyTrait(rawValue);
-  }
-  if (typeof rawValue !== "string") {
-    return void 0;
-  }
-  return (key === "email" ? emailIdentifier(rawValue) : phoneIdentifier(rawValue))?.value;
-}, "piiTrait");
-var resolvePiiTrait = /* @__PURE__ */ __name((key, rawValue, unset) => {
-  return unset ? null : piiTrait(key, rawValue);
-}, "resolvePiiTrait");
-var classifyTraits = /* @__PURE__ */ __name((traits, observedAt) => {
-  const classified = { pii: {}, custom: {}, latest: [], dropped: [] };
-  for (const [rawKey, rawValue] of Object.entries(traits)) {
-    const key = snakeCase(rawKey);
-    const unset = rawValue === null || rawValue === void 0;
-    if (PII_KEYS.includes(key)) {
-      const value2 = resolvePiiTrait(key, rawValue, unset);
-      if (value2 === void 0) {
-        classified.dropped.push(key);
-        continue;
-      }
-      classified.pii[key] = value2;
-      classified.latest.push({ key: `pii.${key}`, value: value2, observedAt });
-      continue;
-    }
-    const value = unset ? null : stringifyTrait(rawValue);
-    classified.custom[key] = value;
-    classified.latest.push({ key: `custom.${key}`, value, observedAt });
-  }
-  return classified;
-}, "classifyTraits");
-var conversionFromTrack = /* @__PURE__ */ __name((payload) => {
-  const amount = payload.properties["value"];
-  if (typeof amount !== "number" || !Number.isFinite(amount)) {
-    return void 0;
-  }
-  const orderId = payload.properties["orderId"];
-  if (typeof orderId !== "string" || orderId === "") {
-    return void 0;
-  }
-  const currency = payload.properties["currency"];
-  const contents = payload.properties["contents"];
-  return {
-    eventName: payload.event,
-    eventId: payload.eventId,
-    orderId,
-    amount,
-    currency: typeof currency === "string" ? currency : null,
-    contents: contents === void 0 ? null : JSON.stringify(contents)
-  };
-}, "conversionFromTrack");
-
-// src/id-graph/alias/client.ts
-var sha256Hex = /* @__PURE__ */ __name(async (value) => {
-  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
-  return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
-}, "sha256Hex");
-var aliasKey = /* @__PURE__ */ __name(async (identifier) => {
-  return `alias:${identifier.type}:${await sha256Hex(identifier.value)}`;
-}, "aliasKey");
-var fallbackKey = /* @__PURE__ */ __name(async (cookie) => {
-  return `fallback:cookie:${await sha256Hex(`${cookie.name}=${cookie.value}`)}`;
-}, "fallbackKey");
-var aliasStub = /* @__PURE__ */ __name((env, key) => {
-  return residencyStub(env.ALIAS_DO, env, key);
-}, "aliasStub");
-var getAssignment = /* @__PURE__ */ __name(async (env, identifier) => {
-  return traced("rpc alias.get", { attrs: { type: identifier.type } }, async () => {
-    return aliasStub(env, await aliasKey(identifier)).get(currentTraceContext());
-  });
-}, "getAssignment");
-var claimAnon = /* @__PURE__ */ __name(async (env, identifier, anonId) => {
-  return traced("rpc alias.claim_anon", { attrs: { type: identifier.type } }, async () => {
-    return aliasStub(env, await aliasKey(identifier)).claimAnon(anonId, currentTraceContext());
-  });
-}, "claimAnon");
-var claimFallbackAnon = /* @__PURE__ */ __name(async (env, cookie, anonId) => {
-  return traced("rpc alias.claim_anon", { attrs: { type: "fallback" } }, async () => {
-    return aliasStub(env, await fallbackKey(cookie)).claimAnon(anonId, currentTraceContext());
-  });
-}, "claimFallbackAnon");
-var claimPair = /* @__PURE__ */ __name(async (env, identifier, globalId, anonId) => {
-  return traced("rpc alias.claim_pair", { attrs: { type: identifier.type } }, async () => {
-    return aliasStub(env, await aliasKey(identifier)).claimPair(globalId, anonId, currentTraceContext());
-  });
-}, "claimPair");
-
-// src/id-graph/user.ts
-var EDGETAG_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}-[0-9]{13}$/;
-var isEdgeTagId = /* @__PURE__ */ __name((id) => {
-  return EDGETAG_ID.test(id);
-}, "isEdgeTagId");
-var isCanonicalId = /* @__PURE__ */ __name((id) => {
-  return id.startsWith("anon_") || isEdgeTagId(id);
-}, "isCanonicalId");
-var generateUserId = /* @__PURE__ */ __name(() => {
-  return `anon_${crypto.randomUUID()}`;
-}, "generateUserId");
-var restoreUser = /* @__PURE__ */ __name(async (env, cookie, candidate) => {
-  if (cookie === void 0) {
-    return candidate;
-  }
-  const assignment = await claimFallbackAnon(env, cookie, candidate);
-  setSpanAttributes({ "qinto.fallback_restored": assignment.anonId !== candidate });
-  return assignment.anonId;
-}, "restoreUser");
-var resolveUser = /* @__PURE__ */ __name(async (env, id) => {
-  if (isCanonicalId(id)) {
-    return { id };
-  }
-  const identifier = classifyIdentifier(id);
-  const assignment = await claimAnon(env, identifier, generateUserId());
-  return { id: assignment.anonId, identifier };
-}, "resolveUser");
-var resolveExistingUser = /* @__PURE__ */ __name(async (env, id) => {
-  if (isCanonicalId(id)) {
-    return { id };
-  }
-  const identifier = classifyIdentifier(id);
-  const anonId = (await getAssignment(env, identifier))?.anonId ?? null;
-  return anonId === null ? null : { id: anonId, identifier };
-}, "resolveExistingUser");
-var lookupUser = /* @__PURE__ */ __name(async (env, id) => {
-  if (isCanonicalId(id)) {
-    const globalId = await traced("rpc anon.get_global_id", {}, () => {
-      return anonStub(env, id).getGlobalId(currentTraceContext());
-    });
-    return { anonId: id, globalId };
-  }
-  const assignment = await getAssignment(env, classifyIdentifier(id));
-  return { anonId: assignment?.anonId ?? null, globalId: assignment?.globalId ?? null };
-}, "lookupUser");
-
-// src/id-graph/noop.ts
-var isNoopConsent = /* @__PURE__ */ __name((payload) => {
-  return consentEntries(payload, 0).length === 0;
-}, "isNoopConsent");
-var isNoopIdentify = /* @__PURE__ */ __name((traits) => {
-  return Object.keys(traits).length === 0;
-}, "isNoopIdentify");
-var isNoopSubmission = /* @__PURE__ */ __name((userId, args) => {
-  if (args.type === "consent") {
-    return isNoopConsent(args.payload);
-  }
-  if (args.type === "identify") {
-    return isCanonicalId(userId) && isNoopIdentify(args.payload.traits);
-  }
-  return false;
-}, "isNoopSubmission");
-var isNoopAction = /* @__PURE__ */ __name((action) => {
-  if (action.identifier !== void 0) {
-    return false;
-  }
-  return action.type === "consent" && isNoopConsent(action.payload);
-}, "isNoopAction");
-var isDeliveryOnlyAction = /* @__PURE__ */ __name((action) => {
-  if (action.identifier !== void 0 || action.type === "consent") {
-    return false;
-  }
-  return action.type === "track" ? conversionFromTrack(action.payload) === void 0 : isNoopIdentify(action.payload.traits);
-}, "isDeliveryOnlyAction");
-
-// src/id-graph/action.ts
-var UnknownUserError = class extends Error {
-  static {
-    __name(this, "UnknownUserError");
-  }
-  constructor() {
-    super("the identifier resolves to no user");
-    this.name = "UnknownUserError";
-  }
-};
-var mintActionId = /* @__PURE__ */ __name(() => {
-  return `act_${ulid3()}`;
-}, "mintActionId");
-var buildAction = /* @__PURE__ */ __name((args) => {
-  const receivedAt = args.receivedAt ?? Date.now();
-  return {
-    ...args,
-    actionId: mintActionId(),
-    receivedAt
-  };
-}, "buildAction");
-var ingest = /* @__PURE__ */ __name(async (env, action, site = ownSite(env)) => {
-  await traced("rpc anon.ingest", {}, () => {
-    return anonStub(env, action.userId).ingest(action, site, currentTraceContext());
-  });
-}, "ingest");
-var serverActionContext = /* @__PURE__ */ __name((input2, receivedAt) => {
-  const network = input2?.network;
-  return {
-    source: "server",
-    occurredAt: input2?.occurredAt ?? receivedAt,
-    ...input2?.page === void 0 ? {} : { page: input2.page },
-    ...network === void 0 || network.ip === void 0 && network.userAgent === void 0 && network.locale === void 0 ? {} : { network: { ...network, provenance: "caller" } },
-    ...input2?.session === void 0 ? {} : { session: input2.session },
-    offline: input2?.offline ?? false,
-    replay: input2?.replay ?? false
-  };
-}, "serverActionContext");
-var submitAction = /* @__PURE__ */ __name(async (env, userId, args, request) => {
-  const attrs = {
-    "action.type": args.type,
-    "action.payload": JSON.stringify(args.payload),
-    "action.identifier": userId,
-    ...args.type === "track" ? { "action.event": args.payload.event } : {}
-  };
-  return traced(`action ${args.type}`, { attrs }, async () => {
-    if (isNoopSubmission(userId, args)) {
-      setSpanAttributes({ "action.noop": true, ...isCanonicalId(userId) ? { "action.user_id": userId } : {} });
-      return mintActionId();
-    }
-    const resolved = await traced("resolve_user", {}, () => {
-      return args.type === "track" ? resolveExistingUser(env, userId) : resolveUser(env, userId);
-    });
-    if (resolved === null) {
-      throw new UnknownUserError();
-    }
-    const receivedAt = Date.now();
-    const action = buildAction({
-      ...args,
-      userId: resolved.id,
-      identifier: resolved.identifier,
-      receivedAt,
-      context: serverActionContext(args.context, receivedAt),
-      geo: request?.cf,
-      host: request === void 0 ? void 0 : hostFromRequest(request)
-    });
-    setSpanAttributes({ "action.user_id": resolved.id, "action.id": action.actionId });
-    await ingest(env, action);
-    return action.actionId;
-  });
-}, "submitAction");
-
-// src/id-graph/projections.ts
-var PII_PREFIX = "pii.";
-var CUSTOM_PREFIX = "custom.";
-var GEO_PREFIX = "geo.";
-var PROJECTION_KINDS = ["pii", "custom", "consent_category", "consent_app", "geo"];
-var PROJECTION_PREFIX = {
-  pii: PII_PREFIX,
-  custom: CUSTOM_PREFIX,
-  consent_category: CONSENT_CATEGORY_PREFIX,
-  consent_app: CONSENT_APP_PREFIX,
-  geo: GEO_PREFIX
-};
-var FANOUT_KINDS = ["pii", "custom", "consent_category", "consent_app"];
-var projectionFact = /* @__PURE__ */ __name((projectionKey) => {
-  for (const kind2 of PROJECTION_KINDS) {
-    const prefix = PROJECTION_PREFIX[kind2];
-    if (projectionKey.startsWith(prefix)) {
-      return { kind: kind2, scope: "", key: projectionKey.slice(prefix.length) };
-    }
-  }
-  throw new Error(`Unknown projection key: ${projectionKey}`);
-}, "projectionFact");
-
-// src/id-graph/anon/facts.ts
-var FACT_KINDS = [
-  ...PROJECTION_KINDS,
-  "capture",
-  "identifier",
-  "conversion",
-  "context_private_kv",
-  "context_private_text",
-  "context_shared_kv",
-  "context_shared_text"
-];
-var APP_FACT_KINDS = ["custom", "capture", "identifier", "conversion", "pii", "consent_category", "consent_app", "geo"];
-var MAX_APP_FACTS_PER_PAGE = 100;
-var MAX_APP_FACT_PAGE_BYTES = 1024 * 1024;
-var COLUMNS = "kind, scope, key, value, source, type, amount, currency, event_id, data_json, first_at, observed_at, synced_at, expires_at";
-var rowOf = /* @__PURE__ */ __name((row) => {
-  return {
-    kind: row.kind,
-    scope: row.scope,
-    key: row.key,
-    value: row.value,
-    source: row.source,
-    type: row.type,
-    amount: row.amount,
-    currency: row.currency,
-    eventId: row.event_id,
-    dataJson: row.data_json,
-    firstAt: row.first_at,
-    observedAt: row.observed_at,
-    syncedAt: row.synced_at,
-    expiresAt: row.expires_at
-  };
-}, "rowOf");
-var appFactOf = /* @__PURE__ */ __name((row) => {
-  const { syncedAt: _syncedAt, expiresAt: _expiresAt, ...fact } = rowOf(row);
-  return { ...fact, kind: fact.kind };
-}, "appFactOf");
-var listAppFacts = /* @__PURE__ */ __name((sql, query, now) => {
-  const maxRowId = query.maxRowId ?? sql.exec("SELECT MAX(rowid) AS maxRowId FROM facts").one().maxRowId;
-  if (maxRowId === null) {
-    return { items: [], next: null };
-  }
-  const where = ["rowid > ?", "rowid <= ?", "(expires_at IS NULL OR expires_at > ?)"];
-  const params = [query.afterRowId, maxRowId, now];
-  if (query.kinds.length > 0) {
-    where.push(`kind IN (${query.kinds.map(() => "?").join(", ")})`);
-    params.push(...query.kinds);
-  }
-  if (query.observedAtGte !== null) {
-    where.push("observed_at >= ?");
-    params.push(query.observedAtGte);
-  }
-  if (query.observedAtLt !== null) {
-    where.push("observed_at < ?");
-    params.push(query.observedAtLt);
-  }
-  const rows = sql.exec(`SELECT rowid, ${COLUMNS} FROM facts WHERE ${where.join(" AND ")} ORDER BY rowid LIMIT ?`, ...params, query.limit + 1).toArray();
-  const items = [];
-  let lastRowId = query.afterRowId;
-  for (const row of rows.slice(0, query.limit)) {
-    const fact = appFactOf(row);
-    const candidate = [...items, fact];
-    if (new TextEncoder().encode(JSON.stringify(candidate)).byteLength > MAX_APP_FACT_PAGE_BYTES) {
-      if (items.length === 0) {
-        throw new Error("fact_too_large");
-      }
-      break;
-    }
-    items.push(fact);
-    lastRowId = row.rowid;
-  }
-  const hasMore = rows.length > items.length;
-  return { items, next: hasMore ? { afterRowId: lastRowId, maxRowId } : null };
-}, "listAppFacts");
-var insertFact = /* @__PURE__ */ __name((sql, fact) => {
-  sql.exec(
-    `INSERT INTO facts (${COLUMNS}) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, ?)`,
-    fact.kind,
-    fact.scope,
-    fact.key,
-    fact.value ?? null,
-    fact.source ?? null,
-    fact.type ?? null,
-    fact.amount ?? null,
-    fact.currency ?? null,
-    fact.eventId ?? null,
-    fact.dataJson ?? null,
-    fact.firstAt ?? null,
-    fact.observedAt,
-    fact.expiresAt ?? null
-  );
-}, "insertFact");
-var latestFact = /* @__PURE__ */ __name((sql, coords) => {
-  const row = sql.exec(
-    `SELECT ${COLUMNS} FROM facts WHERE kind = ? AND scope = ? AND key = ? ORDER BY observed_at DESC, rowid DESC LIMIT 1`,
-    coords.kind,
-    coords.scope,
-    coords.key
-  ).toArray().at(0);
-  return row === void 0 ? void 0 : rowOf(row);
-}, "latestFact");
-var latestFacts = /* @__PURE__ */ __name((sql, kind2) => {
-  const rows = sql.exec(`SELECT ${COLUMNS} FROM facts WHERE kind = ? ORDER BY scope, key, observed_at, rowid`, kind2).toArray();
-  const latest = [];
-  for (const row of rows) {
-    const previous = latest.at(-1);
-    if (previous !== void 0 && previous.scope === row.scope && previous.key === row.key) {
-      latest[latest.length - 1] = rowOf(row);
-      continue;
-    }
-    latest.push(rowOf(row));
-  }
-  return latest;
-}, "latestFacts");
-
-// src/id-graph/global/client.ts
-var globalStub = /* @__PURE__ */ __name((env, globalId) => {
-  return residencyStub(env.GLOBAL_DO, env, globalId);
-}, "globalStub");
-
-// src/id-graph/global/facts.ts
-var FACT_KINDS2 = [...PROJECTION_KINDS, "identifier", "conversion", "anon"];
-var FACT_COLUMNS = "kind, scope, key, value, source, amount, currency, event_id, data_json, first_at, observed_at";
-var rowOf2 = /* @__PURE__ */ __name((row) => {
+// src/id-graph/alias/client.ts
+var sha256Hex = /* @__PURE__ */ __name(async (value) => {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
+  return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}, "sha256Hex");
+var aliasKey = /* @__PURE__ */ __name(async (identifier) => {
+  return `alias:${identifier.type}:${await sha256Hex(identifier.value)}`;
+}, "aliasKey");
+var fallbackKey = /* @__PURE__ */ __name(async (cookie) => {
+  return `fallback:cookie:${await sha256Hex(`${cookie.name}=${cookie.value}`)}`;
+}, "fallbackKey");
+var aliasStub = /* @__PURE__ */ __name((env, key) => {
+  return residencyStub(env.ALIAS_DO, env, key);
+}, "aliasStub");
+var getAssignment = /* @__PURE__ */ __name(async (env, identifier) => {
+  return traced("rpc alias.get", { attrs: { type: identifier.type } }, async () => {
+    return aliasStub(env, await aliasKey(identifier)).get(currentTraceContext());
+  });
+}, "getAssignment");
+var claimAnon = /* @__PURE__ */ __name(async (env, identifier, anonId) => {
+  return traced("rpc alias.claim_anon", { attrs: { type: identifier.type } }, async () => {
+    return aliasStub(env, await aliasKey(identifier)).claimAnon(anonId, currentTraceContext());
+  });
+}, "claimAnon");
+var claimFallbackAnon = /* @__PURE__ */ __name(async (env, cookie, anonId) => {
+  return traced("rpc alias.claim_anon", { attrs: { type: "fallback" } }, async () => {
+    return aliasStub(env, await fallbackKey(cookie)).claimAnon(anonId, currentTraceContext());
+  });
+}, "claimFallbackAnon");
+var claimPair = /* @__PURE__ */ __name(async (env, identifier, globalId, anonId) => {
+  return traced("rpc alias.claim_pair", { attrs: { type: identifier.type } }, async () => {
+    return aliasStub(env, await aliasKey(identifier)).claimPair(globalId, anonId, currentTraceContext());
+  });
+}, "claimPair");
+
+// src/id-graph/global/client.ts
+var globalStub = /* @__PURE__ */ __name((env, globalId) => {
+  return residencyStub(env.GLOBAL_DO, env, globalId);
+}, "globalStub");
+
+// src/id-graph/global/facts.ts
+var FACT_KINDS2 = [...PROJECTION_KINDS, "identifier", "conversion", "anon"];
+var FACT_COLUMNS = "kind, scope, key, value, source, amount, currency, event_id, data_json, first_at, observed_at";
+var rowOf2 = /* @__PURE__ */ __name((row) => {
   return {
     kind: row.kind,
     scope: row.scope,
@@ -27358,6 +27062,52 @@ var allLinkedAnons = /* @__PURE__ */ __name((sql) => {
   return sql.exec("SELECT key FROM facts WHERE kind = 'anon' ORDER BY rowid").toArray().map((row) => row.key);
 }, "allLinkedAnons");
 
+// src/id-graph/user.ts
+var EDGETAG_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}-[0-9]{13}$/;
+var isEdgeTagId = /* @__PURE__ */ __name((id) => {
+  return EDGETAG_ID.test(id);
+}, "isEdgeTagId");
+var isCanonicalId = /* @__PURE__ */ __name((id) => {
+  return id.startsWith("anon_") || isEdgeTagId(id);
+}, "isCanonicalId");
+var generateUserId = /* @__PURE__ */ __name(() => {
+  return `anon_${crypto.randomUUID()}`;
+}, "generateUserId");
+var restoreUser = /* @__PURE__ */ __name(async (env, cookie, candidate) => {
+  if (cookie === void 0) {
+    return candidate;
+  }
+  const assignment = await claimFallbackAnon(env, cookie, candidate);
+  setSpanAttributes({ "qinto.fallback_restored": assignment.anonId !== candidate });
+  return assignment.anonId;
+}, "restoreUser");
+var resolveUser = /* @__PURE__ */ __name(async (env, id) => {
+  if (isCanonicalId(id)) {
+    return { id };
+  }
+  const identifier = classifyIdentifier(id);
+  const assignment = await claimAnon(env, identifier, generateUserId());
+  return { id: assignment.anonId, identifier };
+}, "resolveUser");
+var resolveExistingUser = /* @__PURE__ */ __name(async (env, id) => {
+  if (isCanonicalId(id)) {
+    return { id };
+  }
+  const identifier = classifyIdentifier(id);
+  const anonId = (await getAssignment(env, identifier))?.anonId ?? null;
+  return anonId === null ? null : { id: anonId, identifier };
+}, "resolveExistingUser");
+var lookupUser = /* @__PURE__ */ __name(async (env, id) => {
+  if (isCanonicalId(id)) {
+    const globalId = await traced("rpc anon.get_global_id", {}, () => {
+      return anonStub(env, id).getGlobalId(currentTraceContext());
+    });
+    return { anonId: id, globalId };
+  }
+  const assignment = await getAssignment(env, classifyIdentifier(id));
+  return { anonId: assignment?.anonId ?? null, globalId: assignment?.globalId ?? null };
+}, "lookupUser");
+
 // src/id-graph/person.ts
 var IDENTITY_CAPABILITY = "identity";
 var personLink = /* @__PURE__ */ __name(async (env, anonId) => {
@@ -27517,40 +27267,302 @@ var refreshCurrencyRates = /* @__PURE__ */ __name(async () => {
     currencyMemo = { current: current2, nextAttemptAt: now + RETRY_AFTER_FAILURE_MS };
     return current2;
   }
-  const current = { rates, fetchedAt: now };
-  currencyMemo = { current, nextAttemptAt: now + RATES_TTL_MS };
-  return current;
-}, "refreshCurrencyRates");
-var currentCurrencyRates = /* @__PURE__ */ __name(async (ctx) => {
-  const now = Date.now();
-  if (currencyMemo !== void 0 && now < currencyMemo.nextAttemptAt) {
-    return currencyMemo.current;
+  const current = { rates, fetchedAt: now };
+  currencyMemo = { current, nextAttemptAt: now + RATES_TTL_MS };
+  return current;
+}, "refreshCurrencyRates");
+var currentCurrencyRates = /* @__PURE__ */ __name(async (ctx) => {
+  const now = Date.now();
+  if (currencyMemo !== void 0 && now < currencyMemo.nextAttemptAt) {
+    return currencyMemo.current;
+  }
+  const stale = currencyMemo?.current ?? null;
+  if (stale === null) {
+    return refreshCurrencyRates();
+  }
+  currencyMemo = { current: stale, nextAttemptAt: now + RETRY_AFTER_FAILURE_MS };
+  ctx.waitUntil(
+    runInvocation({ name: "currency.refresh", trace: currentTraceContext() }, () => {
+      return refreshCurrencyRates();
+    })
+  );
+  return stale;
+}, "currentCurrencyRates");
+
+// src/apps/broker-currency.ts
+var currencyRatesBody = external_exports.object({
+  ...identityFields,
+  kind: external_exports.literal("currencyRates")
+}).strict();
+var handleCurrencyRates = /* @__PURE__ */ __name(async (ctx) => {
+  const current = await currentCurrencyRates(ctx);
+  if (current === null) {
+    return Response.json({ error: "currency_rates_unavailable" }, { status: 503 });
+  }
+  return Response.json(current);
+}, "handleCurrencyRates");
+
+// ../../libs/cf-data/src/cf-data.ts
+var CF_DATA_HEADER = "x-cf-data";
+var cfDataFrom = /* @__PURE__ */ __name((cf) => {
+  return {
+    country: cf?.country,
+    city: cf?.city,
+    region: cf?.region,
+    regionCode: cf?.regionCode,
+    timezone: cf?.timezone,
+    postalCode: cf?.postalCode,
+    continent: cf?.continent,
+    longitude: cf?.longitude,
+    latitude: cf?.latitude,
+    isEUCountry: cf?.isEUCountry,
+    botManagement: {
+      ja4: cf?.botManagement?.ja4,
+      ja3Hash: cf?.botManagement?.ja3Hash,
+      score: cf?.botManagement?.score,
+      verifiedBot: cf?.botManagement?.verifiedBot
+    }
+  };
+}, "cfDataFrom");
+var parseCfData = /* @__PURE__ */ __name((raw2) => {
+  if (raw2 === null) {
+    return void 0;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw2);
+  } catch {
+    return void 0;
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    return void 0;
+  }
+  return parsed;
+}, "parseCfData");
+
+// src/helpers/geo.ts
+var UNDETERMINED_COUNTRIES = /* @__PURE__ */ new Set(["XX", "T1"]);
+var detectedCountry = /* @__PURE__ */ __name((cf) => {
+  const country = cf?.country;
+  return country && !UNDETERMINED_COUNTRIES.has(country) ? country : void 0;
+}, "detectedCountry");
+var euCountry = /* @__PURE__ */ __name((cf, country) => {
+  if (cf?.isEUCountry === "1") {
+    return "yes";
+  }
+  return country ? "no" : "unknown";
+}, "euCountry");
+var withForwardedCf = /* @__PURE__ */ __name((request) => {
+  if (request.cf !== void 0) {
+    return request;
+  }
+  const cf = parseCfData(request.headers.get(CF_DATA_HEADER));
+  return cf === void 0 ? request : new Request(request, { cf });
+}, "withForwardedCf");
+var loggableGeo = /* @__PURE__ */ __name((geo) => {
+  const fields = {};
+  for (const [key, value] of Object.entries(geo)) {
+    if (value !== void 0) {
+      fields[key] = String(value);
+    }
+  }
+  return fields;
+}, "loggableGeo");
+var hostFromRequest = /* @__PURE__ */ __name((request) => {
+  return {
+    ip: request.headers.get("cf-connecting-ip") ?? void 0,
+    userAgent: request.headers.get("user-agent") ?? void 0,
+    locale: request.headers.get("accept-language")?.split(",")[0]?.trim() || void 0
+  };
+}, "hostFromRequest");
+var geoFromCf = /* @__PURE__ */ __name((cf) => {
+  const bot = cf?.botManagement;
+  const country = detectedCountry(cf);
+  return {
+    timezone: cf?.timezone ?? void 0,
+    city: cf?.city ?? void 0,
+    postalCode: cf?.postalCode ?? void 0,
+    region: cf?.region ?? void 0,
+    regionCode: cf?.regionCode ?? void 0,
+    country,
+    continent: cf?.continent ?? void 0,
+    isEUCountry: euCountry(cf, country),
+    latitude: cf?.latitude ?? void 0,
+    longitude: cf?.longitude ?? void 0,
+    ja4: bot?.ja4,
+    ja3: bot?.ja3Hash,
+    botScore: bot?.score
+  };
+}, "geoFromCf");
+var geoFromRequest = /* @__PURE__ */ __name((request) => {
+  return {
+    ...hostFromRequest(request),
+    ...geoFromCf(request.cf)
+  };
+}, "geoFromRequest");
+
+// src/id-graph/traits.ts
+var PII_KEYS = ["first_name", "last_name", "email", "phone", "country", "state", "city", "postal_code"];
+var snakeCase = /* @__PURE__ */ __name((key) => {
+  return key.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase();
+}, "snakeCase");
+var stringifyTrait = /* @__PURE__ */ __name((value) => {
+  return typeof value === "string" ? value : JSON.stringify(value);
+}, "stringifyTrait");
+var piiTrait = /* @__PURE__ */ __name((key, rawValue) => {
+  if (key !== "email" && key !== "phone") {
+    return stringifyTrait(rawValue);
+  }
+  if (typeof rawValue !== "string") {
+    return void 0;
+  }
+  return (key === "email" ? emailIdentifier(rawValue) : phoneIdentifier(rawValue))?.value;
+}, "piiTrait");
+var resolvePiiTrait = /* @__PURE__ */ __name((key, rawValue, unset) => {
+  return unset ? null : piiTrait(key, rawValue);
+}, "resolvePiiTrait");
+var classifyTraits = /* @__PURE__ */ __name((traits, observedAt) => {
+  const classified = { pii: {}, custom: {}, latest: [], dropped: [] };
+  for (const [rawKey, rawValue] of Object.entries(traits)) {
+    const key = snakeCase(rawKey);
+    const unset = rawValue === null || rawValue === void 0;
+    if (PII_KEYS.includes(key)) {
+      const value2 = resolvePiiTrait(key, rawValue, unset);
+      if (value2 === void 0) {
+        classified.dropped.push(key);
+        continue;
+      }
+      classified.pii[key] = value2;
+      classified.latest.push({ key: `pii.${key}`, value: value2, observedAt });
+      continue;
+    }
+    const value = unset ? null : stringifyTrait(rawValue);
+    classified.custom[key] = value;
+    classified.latest.push({ key: `custom.${key}`, value, observedAt });
+  }
+  return classified;
+}, "classifyTraits");
+var conversionFromTrack = /* @__PURE__ */ __name((payload) => {
+  const amount = payload.properties["value"];
+  if (typeof amount !== "number" || !Number.isFinite(amount)) {
+    return void 0;
+  }
+  const orderId = payload.properties["orderId"];
+  if (typeof orderId !== "string" || orderId === "") {
+    return void 0;
+  }
+  const currency = payload.properties["currency"];
+  const contents = payload.properties["contents"];
+  return {
+    eventName: payload.event,
+    eventId: payload.eventId,
+    orderId,
+    amount,
+    currency: typeof currency === "string" ? currency : null,
+    contents: contents === void 0 ? null : JSON.stringify(contents)
+  };
+}, "conversionFromTrack");
+
+// src/id-graph/noop.ts
+var isNoopConsent = /* @__PURE__ */ __name((payload) => {
+  return consentEntries(payload, 0).length === 0;
+}, "isNoopConsent");
+var isNoopIdentify = /* @__PURE__ */ __name((traits) => {
+  return Object.keys(traits).length === 0;
+}, "isNoopIdentify");
+var isNoopSubmission = /* @__PURE__ */ __name((userId, args) => {
+  if (args.type === "consent") {
+    return isNoopConsent(args.payload);
+  }
+  if (args.type === "identify") {
+    return isCanonicalId(userId) && isNoopIdentify(args.payload.traits);
   }
-  const stale = currencyMemo?.current ?? null;
-  if (stale === null) {
-    return refreshCurrencyRates();
+  return false;
+}, "isNoopSubmission");
+var isNoopAction = /* @__PURE__ */ __name((action) => {
+  if (action.identifier !== void 0) {
+    return false;
   }
-  currencyMemo = { current: stale, nextAttemptAt: now + RETRY_AFTER_FAILURE_MS };
-  ctx.waitUntil(
-    runInvocation({ name: "currency.refresh", trace: currentTraceContext() }, () => {
-      return refreshCurrencyRates();
-    })
-  );
-  return stale;
-}, "currentCurrencyRates");
+  return action.type === "consent" && isNoopConsent(action.payload);
+}, "isNoopAction");
+var isDeliveryOnlyAction = /* @__PURE__ */ __name((action) => {
+  if (action.identifier !== void 0 || action.type === "consent") {
+    return false;
+  }
+  return action.type === "track" ? conversionFromTrack(action.payload) === void 0 : isNoopIdentify(action.payload.traits);
+}, "isDeliveryOnlyAction");
 
-// src/apps/broker-currency.ts
-var currencyRatesBody = external_exports.object({
-  ...identityFields,
-  kind: external_exports.literal("currencyRates")
-}).strict();
-var handleCurrencyRates = /* @__PURE__ */ __name(async (ctx) => {
-  const current = await currentCurrencyRates(ctx);
-  if (current === null) {
-    return Response.json({ error: "currency_rates_unavailable" }, { status: 503 });
+// src/id-graph/action.ts
+var UnknownUserError = class extends Error {
+  static {
+    __name(this, "UnknownUserError");
   }
-  return Response.json(current);
-}, "handleCurrencyRates");
+  constructor() {
+    super("the identifier resolves to no user");
+    this.name = "UnknownUserError";
+  }
+};
+var mintActionId = /* @__PURE__ */ __name(() => {
+  return `act_${ulid3()}`;
+}, "mintActionId");
+var buildAction = /* @__PURE__ */ __name((args) => {
+  const receivedAt = args.receivedAt ?? Date.now();
+  return {
+    ...args,
+    actionId: mintActionId(),
+    receivedAt
+  };
+}, "buildAction");
+var ingest = /* @__PURE__ */ __name(async (env, action, site = ownSite(env)) => {
+  await traced("rpc anon.ingest", {}, () => {
+    return anonStub(env, action.userId).ingest(action, site, currentTraceContext());
+  });
+}, "ingest");
+var serverActionContext = /* @__PURE__ */ __name((input2, receivedAt) => {
+  const network = input2?.network;
+  return {
+    source: "server",
+    occurredAt: input2?.occurredAt ?? receivedAt,
+    ...input2?.page === void 0 ? {} : { page: input2.page },
+    ...network === void 0 || network.ip === void 0 && network.userAgent === void 0 && network.locale === void 0 ? {} : { network: { ...network, provenance: "caller" } },
+    ...input2?.session === void 0 ? {} : { session: input2.session },
+    offline: input2?.offline ?? false,
+    replay: input2?.replay ?? false
+  };
+}, "serverActionContext");
+var submitAction = /* @__PURE__ */ __name(async (env, userId, args, request) => {
+  const attrs = {
+    "action.type": args.type,
+    "action.payload": JSON.stringify(args.payload),
+    "action.identifier": userId,
+    ...args.type === "track" ? { "action.event": args.payload.event } : {}
+  };
+  return traced(`action ${args.type}`, { attrs }, async () => {
+    if (isNoopSubmission(userId, args)) {
+      setSpanAttributes({ "action.noop": true, ...isCanonicalId(userId) ? { "action.user_id": userId } : {} });
+      return mintActionId();
+    }
+    const resolved = await traced("resolve_user", {}, () => {
+      return args.type === "track" ? resolveExistingUser(env, userId) : resolveUser(env, userId);
+    });
+    if (resolved === null) {
+      throw new UnknownUserError();
+    }
+    const receivedAt = Date.now();
+    const action = buildAction({
+      ...args,
+      userId: resolved.id,
+      identifier: resolved.identifier,
+      receivedAt,
+      context: serverActionContext(args.context, receivedAt),
+      geo: request?.cf,
+      host: request === void 0 ? void 0 : hostFromRequest(request)
+    });
+    setSpanAttributes({ "action.user_id": resolved.id, "action.id": action.actionId });
+    await ingest(env, action);
+    return action.actionId;
+  });
+}, "submitAction");
 
 // src/id-graph/upsert.ts
 var identifierValue = external_exports.string().min(1).max(256).optional();
@@ -27638,35 +27650,249 @@ var rateLimited = /* @__PURE__ */ __name(async (env, key, binding = "BROKER_RATE
     }
     return false;
   }
-  const outcome = await limiter.limit({ key });
-  return !outcome.success;
-}, "rateLimited");
+  const outcome = await limiter.limit({ key });
+  return !outcome.success;
+}, "rateLimited");
+
+// src/apps/broker-identity.ts
+var identityUpsertBody = external_exports.object({
+  ...identityFields,
+  kind: external_exports.literal("identityUpsert"),
+  person: personUpsertSchema
+}).strict();
+var identityGranted = /* @__PURE__ */ __name((slug) => {
+  return siteRegistry().registry.apps[slug]?.data.includes(IDENTITY_CAPABILITY) === true;
+}, "identityGranted");
+var identityPermissionDenied = /* @__PURE__ */ __name(() => {
+  return Response.json({ error: "identity_permission_denied" }, { status: 403 });
+}, "identityPermissionDenied");
+var handleIdentityUpsert = /* @__PURE__ */ __name(async (env, body) => {
+  if (!identityGranted(body.slug)) {
+    return identityPermissionDenied();
+  }
+  if (await rateLimited(env, `${body.slug}::identity-upsert`)) {
+    return Response.json({ error: "rate_limited" }, { status: 429 });
+  }
+  const upserted = await upsertPerson(env, body.person);
+  if (upserted === null) {
+    return Response.json({ error: "invalid_identifier" }, { status: 400 });
+  }
+  return Response.json(upserted);
+}, "handleIdentityUpsert");
+
+// ../../libs/app-ui-token/src/base64url.ts
+var base64UrlEncode = /* @__PURE__ */ __name((bytes) => {
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}, "base64UrlEncode");
+var base64UrlDecode = /* @__PURE__ */ __name((text) => {
+  const padded = text.replaceAll("-", "+").replaceAll("_", "/").padEnd(text.length + (4 - text.length % 4) % 4, "=");
+  let binary;
+  try {
+    binary = atob(padded);
+  } catch {
+    return null;
+  }
+  const bytes = new Uint8Array(binary.length);
+  for (let index = 0; index < binary.length; index += 1) {
+    bytes[index] = binary.charCodeAt(index);
+  }
+  return bytes;
+}, "base64UrlDecode");
+
+// ../../libs/app-ui-token/src/env.ts
+var envSchema = external_exports.object({
+  v: external_exports.literal(1),
+  keys: external_exports.record(external_exports.string().min(1).max(16), external_exports.string().min(1))
+}).strict();
+var parseAppUiKeyEnv = /* @__PURE__ */ __name((raw2) => {
+  let json2;
+  try {
+    json2 = JSON.parse(raw2);
+  } catch {
+    return null;
+  }
+  const parsed = envSchema.safeParse(json2);
+  if (!parsed.success) {
+    return null;
+  }
+  const keys = {};
+  for (const [kid, encoded] of Object.entries(parsed.data.keys)) {
+    const bytes = base64UrlDecode(encoded);
+    if (bytes === null) {
+      return null;
+    }
+    keys[kid] = bytes;
+  }
+  return keys;
+}, "parseAppUiKeyEnv");
+
+// ../../libs/app-ui-token/src/jwt.ts
+var headerSchema = external_exports.object({
+  alg: external_exports.literal("HS256"),
+  typ: external_exports.literal("JWT"),
+  kid: external_exports.string().min(1).max(16)
+}).strict();
+var encodeJsonPart = /* @__PURE__ */ __name((value) => {
+  return base64UrlEncode(new TextEncoder().encode(JSON.stringify(value)));
+}, "encodeJsonPart");
+var parseJsonPart = /* @__PURE__ */ __name((part) => {
+  const bytes = base64UrlDecode(part);
+  if (bytes === null) {
+    return null;
+  }
+  try {
+    return JSON.parse(new TextDecoder().decode(bytes));
+  } catch {
+    return null;
+  }
+}, "parseJsonPart");
+var hmacKey = /* @__PURE__ */ __name((key, usage) => {
+  return crypto.subtle.importKey("raw", key, { name: "HMAC", hash: "SHA-256" }, false, [usage]);
+}, "hmacKey");
+var signCompact = /* @__PURE__ */ __name(async (kid, key, claims) => {
+  const signingInput = `${encodeJsonPart({ alg: "HS256", typ: "JWT", kid })}.${encodeJsonPart(claims)}`;
+  const signature = await crypto.subtle.sign("HMAC", await hmacKey(key, "sign"), new TextEncoder().encode(signingInput));
+  return `${signingInput}.${base64UrlEncode(new Uint8Array(signature))}`;
+}, "signCompact");
+var verifyCompactSignature = /* @__PURE__ */ __name(async (token, keys) => {
+  const [headerPart, claimsPart, signaturePart, extra] = token.split(".");
+  if (headerPart === void 0 || claimsPart === void 0 || signaturePart === void 0 || extra !== void 0) {
+    return { ok: false, reason: "malformed" };
+  }
+  const header = headerSchema.safeParse(parseJsonPart(headerPart));
+  if (!header.success) {
+    return { ok: false, reason: "malformed" };
+  }
+  const key = keys[header.data.kid];
+  if (key === void 0) {
+    return { ok: false, reason: "unknown_kid" };
+  }
+  const signature = base64UrlDecode(signaturePart);
+  if (signature === null) {
+    return { ok: false, reason: "malformed" };
+  }
+  const signed = await crypto.subtle.verify(
+    "HMAC",
+    await hmacKey(key, "verify"),
+    signature,
+    new TextEncoder().encode(`${headerPart}.${claimsPart}`)
+  );
+  if (!signed) {
+    return { ok: false, reason: "bad_signature" };
+  }
+  return { ok: true, claims: parseJsonPart(claimsPart), kid: header.data.kid, key };
+}, "verifyCompactSignature");
 
-// src/apps/broker-identity.ts
-var identityUpsertBody = external_exports.object({
-  ...identityFields,
-  kind: external_exports.literal("identityUpsert"),
-  person: personUpsertSchema
+// ../../libs/app-ui-token/src/token.ts
+var APP_UI_TOKEN_SKEW_SECONDS = 60;
+var APP_UI_TOKEN_ISSUER = "qinto-portal";
+var claimsSchema = external_exports.object({
+  iss: external_exports.literal(APP_UI_TOKEN_ISSUER),
+  aud: external_exports.string().min(1),
+  sub: external_exports.string().min(1),
+  userId: external_exports.string().min(1),
+  iat: external_exports.number().int(),
+  exp: external_exports.number().int(),
+  domainId: external_exports.string().min(1),
+  appId: external_exports.string().min(1),
+  appInstallId: external_exports.string().min(1),
+  appVersionId: external_exports.string().min(1),
+  access: external_exports.enum(["read", "write"]),
+  // Absent means `full`; see the mint below.
+  appRole: external_exports.enum(APP_ROLES).optional()
 }).strict();
-var identityGranted = /* @__PURE__ */ __name((slug) => {
-  return siteRegistry().registry.apps[slug]?.data.includes(IDENTITY_CAPABILITY) === true;
-}, "identityGranted");
-var identityPermissionDenied = /* @__PURE__ */ __name(() => {
-  return Response.json({ error: "identity_permission_denied" }, { status: 403 });
-}, "identityPermissionDenied");
-var handleIdentityUpsert = /* @__PURE__ */ __name(async (env, body) => {
-  if (!identityGranted(body.slug)) {
-    return identityPermissionDenied();
+var appUiAudience = /* @__PURE__ */ __name((slug) => {
+  return `app-ui:${slug}`;
+}, "appUiAudience");
+var verifyAppUiToken = /* @__PURE__ */ __name(async (input2) => {
+  const signature = await verifyCompactSignature(input2.token, input2.keys);
+  if (!signature.ok) {
+    return signature;
   }
-  if (await rateLimited(env, `${body.slug}::identity-upsert`)) {
-    return Response.json({ error: "rate_limited" }, { status: 429 });
+  const claims = claimsSchema.safeParse(signature.claims);
+  if (!claims.success) {
+    return { ok: false, reason: "bad_claims" };
   }
-  const upserted = await upsertPerson(env, body.person);
-  if (upserted === null) {
-    return Response.json({ error: "invalid_identifier" }, { status: 400 });
+  if (claims.data.aud !== appUiAudience(input2.slug)) {
+    return { ok: false, reason: "wrong_app" };
   }
-  return Response.json(upserted);
-}, "handleIdentityUpsert");
+  const now = Math.floor(input2.now.getTime() / 1e3);
+  if (claims.data.iat > now + (input2.skewSeconds ?? APP_UI_TOKEN_SKEW_SECONDS)) {
+    return { ok: false, reason: "future_iat" };
+  }
+  if (claims.data.exp <= now) {
+    return { ok: false, reason: "expired" };
+  }
+  return { ok: true, claims: claims.data, kid: signature.kid, key: signature.key };
+}, "verifyAppUiToken");
+
+// ../../libs/app-ui-token/src/runtime-query-ticket.ts
+var APP_RUNTIME_QUERY_TICKET_TTL_SECONDS = 600;
+var APP_RUNTIME_QUERY_TICKET_ISSUER = "qinto-portal";
+var claimsSchema2 = external_exports.object({
+  iss: external_exports.literal(APP_RUNTIME_QUERY_TICKET_ISSUER),
+  aud: external_exports.string().min(1),
+  sub: external_exports.string().min(1),
+  iat: external_exports.number().int(),
+  exp: external_exports.number().int(),
+  domainId: external_exports.string().min(1),
+  appId: external_exports.string().min(1),
+  appInstallId: external_exports.string().min(1),
+  appVersionId: external_exports.string().min(1)
+}).strict();
+var appRuntimeQueryAudience = /* @__PURE__ */ __name((slug) => {
+  return `app-runtime-query:${slug}`;
+}, "appRuntimeQueryAudience");
+var mintAppRuntimeQueryTicket = /* @__PURE__ */ __name(async (input2) => {
+  const iat = Math.floor(input2.now.getTime() / 1e3);
+  const claims = {
+    iss: APP_RUNTIME_QUERY_TICKET_ISSUER,
+    aud: appRuntimeQueryAudience(input2.slug),
+    sub: input2.appInstallId,
+    iat,
+    exp: iat + (input2.ttlSeconds ?? APP_RUNTIME_QUERY_TICKET_TTL_SECONDS),
+    domainId: input2.domainId,
+    appId: input2.appId,
+    appInstallId: input2.appInstallId,
+    appVersionId: input2.appVersionId
+  };
+  return signCompact(input2.kid, input2.key, claims);
+}, "mintAppRuntimeQueryTicket");
+
+// ../../libs/app-ui-token/src/write-ticket.ts
+var APP_UI_WRITE_TICKET_TTL_SECONDS = 60;
+var APP_UI_WRITE_TICKET_ISSUER = "qinto-site";
+var claimsSchema3 = external_exports.object({
+  iss: external_exports.literal(APP_UI_WRITE_TICKET_ISSUER),
+  aud: external_exports.string().min(1),
+  sub: external_exports.string().min(1),
+  iat: external_exports.number().int(),
+  exp: external_exports.number().int(),
+  domainId: external_exports.string().min(1),
+  appId: external_exports.string().min(1),
+  appVersionId: external_exports.string().min(1)
+}).strict();
+var appUiWriteAudience = /* @__PURE__ */ __name((slug) => {
+  return `app-ui-write:${slug}`;
+}, "appUiWriteAudience");
+var mintAppUiWriteTicket = /* @__PURE__ */ __name(async (input2) => {
+  const iat = Math.floor(input2.now.getTime() / 1e3);
+  const claims = {
+    iss: APP_UI_WRITE_TICKET_ISSUER,
+    aud: appUiWriteAudience(input2.slug),
+    sub: input2.userId,
+    iat,
+    exp: iat + (input2.ttlSeconds ?? APP_UI_WRITE_TICKET_TTL_SECONDS),
+    domainId: input2.domainId,
+    appId: input2.appId,
+    appVersionId: input2.appVersionId
+  };
+  return signCompact(input2.kid, input2.key, claims);
+}, "mintAppUiWriteTicket");
 
 // src/apps/emit-payload.ts
 var emitPayloadSchema = external_exports.object({
@@ -27685,51 +27911,6 @@ var emittedEventId = /* @__PURE__ */ __name((eventId, properties2) => {
   return `evt_${ulid3()}`;
 }, "emittedEventId");
 
-// src/apps/broker-track.ts
-var trackBody = external_exports.object({
-  ...identityFields,
-  kind: external_exports.literal("track"),
-  source: external_exports.enum(APP_HANDLER_SOURCES),
-  userId: external_exports.string().min(1).max(64),
-  installId: external_exports.string().min(1).max(64),
-  installs: installRuleSchema.optional(),
-  event: emitSchema.omit({ installs: true })
-}).strict();
-var handleTrack = /* @__PURE__ */ __name(async (env, body) => {
-  const app2 = siteRegistry().registry.apps[body.slug];
-  if (app2 === void 0) {
-    return Response.json({ error: "forbidden" }, { status: 403 });
-  }
-  if (!app2.installs.some((install) => install.active && install.id === body.installId)) {
-    return Response.json({ error: "invalid_install" }, { status: 400 });
-  }
-  const parsed = emitPayloadSchema.safeParse(body.event.payload);
-  if (!parsed.success) {
-    return Response.json({ error: "invalid_event" }, { status: 400 });
-  }
-  if (!isCanonicalId(body.userId)) {
-    return Response.json({ error: "invalid_user" }, { status: 400 });
-  }
-  if (await rateLimited(env, `${body.slug}:${body.installId}:track`)) {
-    return Response.json({ error: "rate_limited" }, { status: 429 });
-  }
-  const site = ownSite(env);
-  if (!await anonStub(env, body.userId).appAllowed(body.slug, site, currentTraceContext())) {
-    return Response.json({ error: "forbidden" }, { status: 403 });
-  }
-  const { event, eventId, properties: properties2 } = parsed.data;
-  const action = buildAction({
-    type: "track",
-    userId: body.userId,
-    source: body.source,
-    payload: { event, eventId: emittedEventId(eventId, properties2), properties: properties2 ?? {} },
-    context: { source: "app", occurredAt: body.event.occurredAt, offline: false, replay: false },
-    ...body.installs === void 0 ? {} : { installs: body.installs }
-  });
-  await ingest(env, action, site);
-  return Response.json({ accepted: true }, { status: 202 });
-}, "handleTrack");
-
 // src/id-graph/anon/context.ts
 var LEVEL_KINDS = {
   private: { kv: "context_private_kv", text: "context_private_text" },
@@ -28591,7 +28772,8 @@ var adoptAppSpans = /* @__PURE__ */ __name((response) => {
 }, "adoptAppSpans");
 
 // src/apps/invoke.ts
-var APP_INVOCATION_TIMEOUT_MS = 1e4;
+var RPC_HOT_TIMEOUT_MS = 1e4;
+var RPC_COLD_TIMEOUT_MS = 4e4;
 var APP_HOOK_TIMEOUT_MS = 25e3;
 var MAX_EMIT_DEPTH = 2;
 var HOOK_URL = "https://app/__qinto/hook";
@@ -28882,18 +29064,8 @@ var invokeApp = /* @__PURE__ */ __name(async (env, input2) => {
   );
 }, "invokeApp");
 
-// src/apps/broker.ts
+// src/apps/broker-rpc.ts
 var MAX_RPC_DEPTH = 3;
-var BROKER_PATHS = ["/__qinto/push", "/__qinto/rpc"];
-var pushBody = external_exports.object({
-  ...identityFields,
-  kind: external_exports.literal("push"),
-  userId: external_exports.string().min(1).max(64),
-  installId: external_exports.string().min(1).max(64).optional(),
-  broadcast: external_exports.enum(PUSH_BROADCASTS).optional(),
-  topic: external_exports.string().min(1).max(64),
-  data: external_exports.unknown().optional()
-}).strict();
 var rpcBody = external_exports.object({
   ...identityFields,
   kind: external_exports.literal("rpc"),
@@ -28903,150 +29075,17 @@ var rpcBody = external_exports.object({
   fn: external_exports.string().min(1).max(64),
   args: external_exports.unknown().optional(),
   installId: external_exports.string().min(1).max(64).optional(),
-  depth: external_exports.number().int().min(0)
-}).strict();
-var installsBody = external_exports.object({
-  ...identityFields,
-  kind: external_exports.literal("installs"),
-  callee: external_exports.string().min(1).max(30)
-}).strict();
-var activeBody = external_exports.object({
-  ...identityFields,
-  kind: external_exports.literal("active"),
-  ord: external_exports.number().int().min(1),
-  userId: external_exports.string().min(1).max(64).optional()
-}).strict();
-var contextReadBody = external_exports.object({
-  ...identityFields,
-  kind: external_exports.literal("contextRead"),
-  userId: external_exports.string().min(1).max(64)
-}).strict();
-var contextWriteBody = external_exports.object({
-  ...identityFields,
-  kind: external_exports.literal("contextWrite"),
-  userId: external_exports.string().min(1).max(64),
-  writes: external_exports.array(contextWriteSchema).min(1).max(MAX_CONTEXT_WRITES_PER_INSTALL)
-}).strict();
-var factsQuery = external_exports.object({
-  kinds: external_exports.array(external_exports.enum(APP_FACT_KINDS)).min(1).max(APP_FACT_KINDS.length).optional(),
-  observedAtGte: external_exports.number().int().nonnegative().safe().optional(),
-  observedAtLt: external_exports.number().int().nonnegative().safe().optional(),
-  limit: external_exports.number().int().min(1).max(MAX_APP_FACTS_PER_PAGE).optional()
-}).strict().refine((query) => query.observedAtGte === void 0 || query.observedAtLt === void 0 || query.observedAtGte < query.observedAtLt);
-var factsReadBody = external_exports.object({
-  ...identityFields,
-  kind: external_exports.literal("factsRead"),
-  userId: external_exports.string().min(1).max(64),
-  query: factsQuery.optional(),
-  cursor: external_exports.string().min(1).max(4096).optional()
-}).strict().refine((body) => body.query === void 0 !== (body.cursor === void 0));
-var identityReadBody = external_exports.object({
-  ...identityFields,
-  kind: external_exports.literal("identityRead"),
-  identifier: identifierField2,
-  cursor: external_exports.string().regex(/^\d+$/).optional()
-}).strict();
-var brokerBody = external_exports.discriminatedUnion("kind", [
-  pushBody,
-  rpcBody,
-  installsBody,
-  activeBody,
-  contextReadBody,
-  contextWriteBody,
-  factsReadBody,
-  identityReadBody,
-  identityUpsertBody,
-  currencyRatesBody,
-  trackBody
-]);
-var BODY_ENVELOPE_ALLOWANCE_BYTES = 2 * 1024;
-var MAX_BODY_BYTES = MAX_RPC_BYTES + BODY_ENVELOPE_ALLOWANCE_BYTES;
-var parseJson = /* @__PURE__ */ __name((raw2) => {
-  try {
-    return JSON.parse(raw2);
-  } catch {
-    return null;
-  }
-}, "parseJson");
-var factsCursor = external_exports.object({
-  userId: external_exports.string().min(1).max(64),
-  kinds: external_exports.array(external_exports.enum(APP_FACT_KINDS)).min(1).max(APP_FACT_KINDS.length),
-  observedAtGte: external_exports.number().int().nonnegative().safe().nullable(),
-  observedAtLt: external_exports.number().int().nonnegative().safe().nullable(),
-  limit: external_exports.number().int().min(1).max(MAX_APP_FACTS_PER_PAGE),
-  afterRowId: external_exports.number().int().nonnegative().safe(),
-  maxRowId: external_exports.number().int().positive().safe().nullable()
+  depth: external_exports.number().int().min(0),
+  // Optional on the wire: a runtime predating traffic classes sends none, which means hot.
+  traffic: external_exports.enum(TRAFFIC_CLASSES).optional()
 }).strict();
-var cursorKey = /* @__PURE__ */ __name(async (hex3) => {
-  const bytes = Uint8Array.from(hex3.matchAll(/.{2}/g), ([pair]) => Number.parseInt(pair, 16));
-  return crypto.subtle.importKey("raw", bytes, "AES-GCM", false, ["encrypt", "decrypt"]);
-}, "cursorKey");
-var encodeBase64Url = /* @__PURE__ */ __name((bytes) => {
-  let binary = "";
-  for (const byte of bytes) {
-    binary += String.fromCharCode(byte);
-  }
-  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
-}, "encodeBase64Url");
-var decodeBase64Url = /* @__PURE__ */ __name((value) => {
-  const base643 = value.replaceAll("-", "+").replaceAll("_", "/");
-  const padded = base643.padEnd(Math.ceil(base643.length / 4) * 4, "=");
-  const binary = atob(padded);
-  return Uint8Array.from(binary, (character) => character.charCodeAt(0));
-}, "decodeBase64Url");
-var encryptFactsCursor = /* @__PURE__ */ __name(async (key, cursor) => {
-  const iv = crypto.getRandomValues(new Uint8Array(12));
-  const plaintext = new TextEncoder().encode(JSON.stringify(cursor));
-  const ciphertext = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv }, await cursorKey(key), plaintext));
-  const packed = new Uint8Array(iv.byteLength + ciphertext.byteLength);
-  packed.set(iv);
-  packed.set(ciphertext, iv.byteLength);
-  return encodeBase64Url(packed);
-}, "encryptFactsCursor");
-var decryptFactsCursor = /* @__PURE__ */ __name(async (key, encoded) => {
+var parseJson = /* @__PURE__ */ __name((raw2) => {
   try {
-    const packed = decodeBase64Url(encoded);
-    if (packed.byteLength <= 12) {
-      return null;
-    }
-    const plaintext = await crypto.subtle.decrypt({ name: "AES-GCM", iv: packed.slice(0, 12) }, await cursorKey(key), packed.slice(12));
-    return JSON.parse(new TextDecoder().decode(plaintext));
+    return JSON.parse(raw2);
   } catch {
     return null;
   }
-}, "decryptFactsCursor");
-var invalidBody = /* @__PURE__ */ __name(() => {
-  return Response.json({ error: "invalid_body" }, { status: 400 });
-}, "invalidBody");
-var forbidden = /* @__PURE__ */ __name(() => {
-  return Response.json({ error: "forbidden" }, { status: 403 });
-}, "forbidden");
-var factsPermissionDenied = /* @__PURE__ */ __name(() => {
-  return Response.json({ error: "facts_permission_denied" }, { status: 403 });
-}, "factsPermissionDenied");
-var handlePush = /* @__PURE__ */ __name(async (env, body) => {
-  if (new TextEncoder().encode(JSON.stringify(body.data ?? null)).length > MAX_PUSH_BYTES) {
-    return invalidBody();
-  }
-  const broadcast = body.broadcast ?? "install";
-  if (broadcast === "install" && body.installId === void 0) {
-    return invalidBody();
-  }
-  const installId = broadcast === "install" ? body.installId : null;
-  if (await rateLimited(env, `${body.slug}:${installId ?? ""}:push`)) {
-    return Response.json({ error: "rate_limited" }, { status: 429 });
-  }
-  const app2 = siteRegistry().registry.apps[body.slug];
-  if (broadcast === "site" && (app2 === void 0 || !app2.events.publishes.includes(body.topic) || !app2.data.includes(SHARED_CONTEXT_CAPABILITY))) {
-    return Response.json({ error: "topic_not_public" }, { status: 400 });
-  }
-  await anonStub(env, body.userId).appPush(
-    { slug: body.slug, installId, topic: body.topic, data: body.data, scope: broadcast === "site" ? "site" : "app" },
-    ownSite(env),
-    currentTraceContext()
-  );
-  return Response.json({ accepted: true }, { status: 202 });
-}, "handlePush");
+}, "parseJson");
 var resolveInstall = /* @__PURE__ */ __name((callee, installId) => {
   const active = callee.installs.filter((install) => install.active);
   if (installId !== void 0) {
@@ -29060,6 +29099,14 @@ var calleeFailed = /* @__PURE__ */ __name((callee, reason) => {
   addSpanEvent("rpc callee failed", { level: "warn", attrs: { app: callee, reason } });
   return Response.json({ error: "callee_failed" }, { status: 502 });
 }, "calleeFailed");
+var calleeError = /* @__PURE__ */ __name((callee, error61, message) => {
+  addSpanEvent("rpc callee failed", { level: "warn", attrs: { app: callee, reason: message, code: error61 } });
+  return Response.json({ error: error61, message }, { status: 502 });
+}, "calleeError");
+var resultTooLarge = /* @__PURE__ */ __name((candidate) => {
+  const result = candidate?.rpc?.result;
+  return new TextEncoder().encode(JSON.stringify(result ?? null)).length > MAX_RPC_BYTES;
+}, "resultTooLarge");
 var deliverRpcEffects = /* @__PURE__ */ __name(async (env, { body, userId, effects, install }) => {
   for (const ord of effects.rejectedOrds) {
     addSpanEvent("app effects rejected over the per-install caps", { level: "warn", attrs: { app: body.callee, ord } });
@@ -29085,10 +29132,32 @@ var deliverRpcEffects = /* @__PURE__ */ __name(async (env, { body, userId, effec
     }, "ingest")
   });
 }, "deliverRpcEffects");
-var runRelayRpc = /* @__PURE__ */ __name(async (env, { context, body, callee, install }) => {
-  let raw2;
+var calleeQueryTicket = /* @__PURE__ */ __name(async (env, { context, body, callee, install }) => {
+  const keyEnv = env.APP_UI_KEY;
+  const [signing] = Object.entries((keyEnv === void 0 ? null : parseAppUiKeyEnv(keyEnv)) ?? {});
+  if (callee.appId === void 0 || signing === void 0) {
+    return void 0;
+  }
+  const [kid, key] = signing;
+  return mintAppRuntimeQueryTicket({
+    kid,
+    key,
+    now: /* @__PURE__ */ new Date(),
+    slug: body.callee,
+    domainId: context.domainId,
+    appId: callee.appId,
+    appInstallId: install.id,
+    // The portal authorizes a ticket only for the version the site serves, which is the registry's.
+    appVersionId: callee.versionId
+  });
+}, "calleeQueryTicket");
+var postToCallee = /* @__PURE__ */ __name(async (env, input2) => {
+  const { context, body, callee, install } = input2;
+  const traffic = body.traffic ?? "hot";
+  const timeoutMs = traffic === "cold" ? RPC_COLD_TIMEOUT_MS : RPC_HOT_TIMEOUT_MS;
   try {
     const key = await deriveAppInternalKey(context.master, context.domainId, body.callee);
+    const queryTicket = traffic === "cold" ? await calleeQueryTicket(env, input2) : void 0;
     const response = await postHookEnvelope(env, {
       binding: callee.binding,
       key,
@@ -29102,9 +29171,9 @@ var runRelayRpc = /* @__PURE__ */ __name(async (env, { context, body, callee, in
         ...body.userId === void 0 ? {} : { user: { anonId: body.userId, globalId: null, properties: {} } },
         depth: body.depth,
         // JSON.stringify drops an undefined key, and the envelope requires `args` to be present.
-        rpc: { caller: body.slug, fn: body.fn, args: body.args ?? null }
+        rpc: { caller: body.slug, fn: body.fn, args: body.args ?? null, traffic, ...queryTicket === void 0 ? {} : { queryTicket } }
       },
-      timeoutMs: APP_INVOCATION_TIMEOUT_MS
+      timeoutMs
     });
     if (response === void 0) {
       return calleeFailed(body.callee, "The callee service binding is missing.");
@@ -29120,13 +29189,27 @@ var runRelayRpc = /* @__PURE__ */ __name(async (env, { context, body, callee, in
     }
     const bytes = await readBoundedBody(response, MAX_RESPONSE_BYTES);
     if (bytes === null) {
-      return calleeFailed(body.callee, "The response exceeds the size cap.");
+      return calleeError(body.callee, "result_too_large", `The callee response exceeds ${MAX_RESPONSE_BYTES / 1024 / 1024} MB.`);
     }
-    raw2 = new TextDecoder().decode(bytes);
+    return new TextDecoder().decode(bytes);
   } catch (error61) {
+    if (error61 instanceof Error && error61.name === "TimeoutError") {
+      return calleeError(body.callee, "callee_timeout", `The callee did not answer within ${timeoutMs / 1e3} s.`);
+    }
     return calleeFailed(body.callee, String(error61));
   }
-  const verdict = validateEnvelopeResponse(parseJson(raw2), 1);
+}, "postToCallee");
+var runRelayRpc = /* @__PURE__ */ __name(async (env, input2) => {
+  const { body, install } = input2;
+  const raw2 = await postToCallee(env, input2);
+  if (raw2 instanceof Response) {
+    return raw2;
+  }
+  const candidate = parseJson(raw2);
+  if (resultTooLarge(candidate)) {
+    return calleeError(body.callee, "result_too_large", `The rpc result exceeds ${MAX_RPC_BYTES / 1024} KB.`);
+  }
+  const verdict = validateEnvelopeResponse(candidate, 1);
   if (!verdict.ok) {
     return calleeFailed(body.callee, verdict.reason);
   }
@@ -29135,6 +29218,9 @@ var runRelayRpc = /* @__PURE__ */ __name(async (env, { context, body, callee, in
     if (verdict.errorCode === "invalid_arguments") {
       return Response.json({ error: "invalid_arguments", message: reason }, { status: 400 });
     }
+    if (verdict.errorCode === "rpc_error") {
+      return calleeError(body.callee, "rpc_error", reason);
+    }
     return calleeFailed(body.callee, reason);
   }
   if (verdict.rpc === null) {
@@ -29163,38 +29249,238 @@ var relayRpc = /* @__PURE__ */ __name(async (env, input2) => {
         "app.install_ord": install.ord,
         "app.install_label": install.label,
         "app.rpc_caller": body.slug,
-        "app.rpc_depth": body.depth
+        "app.rpc_depth": body.depth,
+        "app.rpc_traffic": body.traffic ?? "hot"
       }
     },
     () => {
       return runRelayRpc(env, input2);
     }
-  );
-}, "relayRpc");
-var handleRpc = /* @__PURE__ */ __name(async (env, context, body) => {
-  if (body.depth > MAX_RPC_DEPTH) {
-    return Response.json({ error: "depth_exceeded" }, { status: 400 });
-  }
-  const callee = siteRegistry().registry.apps[body.callee];
-  if (callee === void 0) {
-    return forbidden();
-  }
-  const visibility = callee.rpc.exposes[body.fn];
-  if (visibility !== "public" && !(visibility === "private" && (callee.rpc.grants[body.slug] ?? []).includes(body.fn))) {
-    return forbidden();
+  );
+}, "relayRpc");
+var handleRpc = /* @__PURE__ */ __name(async (env, context, body) => {
+  if (body.depth > MAX_RPC_DEPTH) {
+    return Response.json({ error: "depth_exceeded" }, { status: 400 });
+  }
+  const callee = siteRegistry().registry.apps[body.callee];
+  if (callee === void 0) {
+    return Response.json({ error: "forbidden" }, { status: 403 });
+  }
+  const visibility = callee.rpc.exposes[body.fn];
+  if (visibility !== "public" && !(visibility === "private" && (callee.rpc.grants[body.slug] ?? []).includes(body.fn))) {
+    return Response.json({ error: "forbidden" }, { status: 403 });
+  }
+  const install = resolveInstall(callee, body.installId);
+  if (install === "invalid_install" || install === "install_required") {
+    return Response.json({ error: install }, { status: 400 });
+  }
+  if (new TextEncoder().encode(JSON.stringify(body.args ?? null)).length > MAX_RPC_BYTES) {
+    return Response.json({ error: "too_large" }, { status: 413 });
+  }
+  if (await rateLimited(env, `${body.slug}:${install.id}:rpc`)) {
+    return Response.json({ error: "rate_limited" }, { status: 429 });
+  }
+  return relayRpc(env, { context, body, callee, install });
+}, "handleRpc");
+
+// src/apps/broker-track.ts
+var trackBody = external_exports.object({
+  ...identityFields,
+  kind: external_exports.literal("track"),
+  source: external_exports.enum(APP_HANDLER_SOURCES),
+  userId: external_exports.string().min(1).max(64),
+  installId: external_exports.string().min(1).max(64),
+  installs: installRuleSchema.optional(),
+  event: emitSchema.omit({ installs: true })
+}).strict();
+var handleTrack = /* @__PURE__ */ __name(async (env, body) => {
+  const app2 = siteRegistry().registry.apps[body.slug];
+  if (app2 === void 0) {
+    return Response.json({ error: "forbidden" }, { status: 403 });
+  }
+  if (!app2.installs.some((install) => install.active && install.id === body.installId)) {
+    return Response.json({ error: "invalid_install" }, { status: 400 });
+  }
+  const parsed = emitPayloadSchema.safeParse(body.event.payload);
+  if (!parsed.success) {
+    return Response.json({ error: "invalid_event" }, { status: 400 });
+  }
+  if (!isCanonicalId(body.userId)) {
+    return Response.json({ error: "invalid_user" }, { status: 400 });
+  }
+  if (await rateLimited(env, `${body.slug}:${body.installId}:track`)) {
+    return Response.json({ error: "rate_limited" }, { status: 429 });
+  }
+  const site = ownSite(env);
+  if (!await anonStub(env, body.userId).appAllowed(body.slug, site, currentTraceContext())) {
+    return Response.json({ error: "forbidden" }, { status: 403 });
+  }
+  const { event, eventId, properties: properties2 } = parsed.data;
+  const action = buildAction({
+    type: "track",
+    userId: body.userId,
+    source: body.source,
+    payload: { event, eventId: emittedEventId(eventId, properties2), properties: properties2 ?? {} },
+    context: { source: "app", occurredAt: body.event.occurredAt, offline: false, replay: false },
+    ...body.installs === void 0 ? {} : { installs: body.installs }
+  });
+  await ingest(env, action, site);
+  return Response.json({ accepted: true }, { status: 202 });
+}, "handleTrack");
+
+// src/apps/broker.ts
+var BROKER_PATHS = ["/__qinto/push", "/__qinto/rpc"];
+var pushBody = external_exports.object({
+  ...identityFields,
+  kind: external_exports.literal("push"),
+  userId: external_exports.string().min(1).max(64),
+  installId: external_exports.string().min(1).max(64).optional(),
+  broadcast: external_exports.enum(PUSH_BROADCASTS).optional(),
+  topic: external_exports.string().min(1).max(64),
+  data: external_exports.unknown().optional()
+}).strict();
+var installsBody = external_exports.object({
+  ...identityFields,
+  kind: external_exports.literal("installs"),
+  callee: external_exports.string().min(1).max(30)
+}).strict();
+var activeBody = external_exports.object({
+  ...identityFields,
+  kind: external_exports.literal("active"),
+  ord: external_exports.number().int().min(1),
+  userId: external_exports.string().min(1).max(64).optional()
+}).strict();
+var contextReadBody = external_exports.object({
+  ...identityFields,
+  kind: external_exports.literal("contextRead"),
+  userId: external_exports.string().min(1).max(64)
+}).strict();
+var contextWriteBody = external_exports.object({
+  ...identityFields,
+  kind: external_exports.literal("contextWrite"),
+  userId: external_exports.string().min(1).max(64),
+  writes: external_exports.array(contextWriteSchema).min(1).max(MAX_CONTEXT_WRITES_PER_INSTALL)
+}).strict();
+var factsQuery = external_exports.object({
+  kinds: external_exports.array(external_exports.enum(APP_FACT_KINDS)).min(1).max(APP_FACT_KINDS.length).optional(),
+  observedAtGte: external_exports.number().int().nonnegative().safe().optional(),
+  observedAtLt: external_exports.number().int().nonnegative().safe().optional(),
+  limit: external_exports.number().int().min(1).max(MAX_APP_FACTS_PER_PAGE).optional()
+}).strict().refine((query) => query.observedAtGte === void 0 || query.observedAtLt === void 0 || query.observedAtGte < query.observedAtLt);
+var factsReadBody = external_exports.object({
+  ...identityFields,
+  kind: external_exports.literal("factsRead"),
+  userId: external_exports.string().min(1).max(64),
+  query: factsQuery.optional(),
+  cursor: external_exports.string().min(1).max(4096).optional()
+}).strict().refine((body) => body.query === void 0 !== (body.cursor === void 0));
+var identityReadBody = external_exports.object({
+  ...identityFields,
+  kind: external_exports.literal("identityRead"),
+  identifier: identifierField2,
+  cursor: external_exports.string().regex(/^\d+$/).optional()
+}).strict();
+var brokerBody = external_exports.discriminatedUnion("kind", [
+  pushBody,
+  rpcBody,
+  installsBody,
+  activeBody,
+  contextReadBody,
+  contextWriteBody,
+  factsReadBody,
+  identityReadBody,
+  identityUpsertBody,
+  currencyRatesBody,
+  trackBody
+]);
+var BODY_ENVELOPE_ALLOWANCE_BYTES = 2 * 1024;
+var MAX_BODY_BYTES = MAX_RPC_BYTES + BODY_ENVELOPE_ALLOWANCE_BYTES;
+var parseJson2 = /* @__PURE__ */ __name((raw2) => {
+  try {
+    return JSON.parse(raw2);
+  } catch {
+    return null;
+  }
+}, "parseJson");
+var factsCursor = external_exports.object({
+  userId: external_exports.string().min(1).max(64),
+  kinds: external_exports.array(external_exports.enum(APP_FACT_KINDS)).min(1).max(APP_FACT_KINDS.length),
+  observedAtGte: external_exports.number().int().nonnegative().safe().nullable(),
+  observedAtLt: external_exports.number().int().nonnegative().safe().nullable(),
+  limit: external_exports.number().int().min(1).max(MAX_APP_FACTS_PER_PAGE),
+  afterRowId: external_exports.number().int().nonnegative().safe(),
+  maxRowId: external_exports.number().int().positive().safe().nullable()
+}).strict();
+var cursorKey = /* @__PURE__ */ __name(async (hex3) => {
+  const bytes = Uint8Array.from(hex3.matchAll(/.{2}/g), ([pair]) => Number.parseInt(pair, 16));
+  return crypto.subtle.importKey("raw", bytes, "AES-GCM", false, ["encrypt", "decrypt"]);
+}, "cursorKey");
+var encodeBase64Url = /* @__PURE__ */ __name((bytes) => {
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}, "encodeBase64Url");
+var decodeBase64Url = /* @__PURE__ */ __name((value) => {
+  const base643 = value.replaceAll("-", "+").replaceAll("_", "/");
+  const padded = base643.padEnd(Math.ceil(base643.length / 4) * 4, "=");
+  const binary = atob(padded);
+  return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+}, "decodeBase64Url");
+var encryptFactsCursor = /* @__PURE__ */ __name(async (key, cursor) => {
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+  const plaintext = new TextEncoder().encode(JSON.stringify(cursor));
+  const ciphertext = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv }, await cursorKey(key), plaintext));
+  const packed = new Uint8Array(iv.byteLength + ciphertext.byteLength);
+  packed.set(iv);
+  packed.set(ciphertext, iv.byteLength);
+  return encodeBase64Url(packed);
+}, "encryptFactsCursor");
+var decryptFactsCursor = /* @__PURE__ */ __name(async (key, encoded) => {
+  try {
+    const packed = decodeBase64Url(encoded);
+    if (packed.byteLength <= 12) {
+      return null;
+    }
+    const plaintext = await crypto.subtle.decrypt({ name: "AES-GCM", iv: packed.slice(0, 12) }, await cursorKey(key), packed.slice(12));
+    return JSON.parse(new TextDecoder().decode(plaintext));
+  } catch {
+    return null;
   }
-  const install = resolveInstall(callee, body.installId);
-  if (install === "invalid_install" || install === "install_required") {
-    return Response.json({ error: install }, { status: 400 });
+}, "decryptFactsCursor");
+var invalidBody = /* @__PURE__ */ __name(() => {
+  return Response.json({ error: "invalid_body" }, { status: 400 });
+}, "invalidBody");
+var forbidden = /* @__PURE__ */ __name(() => {
+  return Response.json({ error: "forbidden" }, { status: 403 });
+}, "forbidden");
+var factsPermissionDenied = /* @__PURE__ */ __name(() => {
+  return Response.json({ error: "facts_permission_denied" }, { status: 403 });
+}, "factsPermissionDenied");
+var handlePush = /* @__PURE__ */ __name(async (env, body) => {
+  if (new TextEncoder().encode(JSON.stringify(body.data ?? null)).length > MAX_PUSH_BYTES) {
+    return invalidBody();
   }
-  if (new TextEncoder().encode(JSON.stringify(body.args ?? null)).length > MAX_RPC_BYTES) {
-    return Response.json({ error: "too_large" }, { status: 413 });
+  const broadcast = body.broadcast ?? "install";
+  if (broadcast === "install" && body.installId === void 0) {
+    return invalidBody();
   }
-  if (await rateLimited(env, `${body.slug}:${install.id}:rpc`)) {
+  const installId = broadcast === "install" ? body.installId : null;
+  if (await rateLimited(env, `${body.slug}:${installId ?? ""}:push`)) {
     return Response.json({ error: "rate_limited" }, { status: 429 });
   }
-  return relayRpc(env, { context, body, callee, install });
-}, "handleRpc");
+  const app2 = siteRegistry().registry.apps[body.slug];
+  if (broadcast === "site" && (app2 === void 0 || !app2.events.publishes.includes(body.topic) || !app2.data.includes(SHARED_CONTEXT_CAPABILITY))) {
+    return Response.json({ error: "topic_not_public" }, { status: 400 });
+  }
+  await anonStub(env, body.userId).appPush(
+    { slug: body.slug, installId, topic: body.topic, data: body.data, scope: broadcast === "site" ? "site" : "app" },
+    ownSite(env),
+    currentTraceContext()
+  );
+  return Response.json({ accepted: true }, { status: 202 });
+}, "handlePush");
 var handleInstalls = /* @__PURE__ */ __name(async (env, body) => {
   const callee = siteRegistry().registry.apps[body.callee];
   if (callee === void 0 || !(Object.values(callee.rpc.exposes).includes("public") || (callee.rpc.grants[body.slug] ?? []).length > 0)) {
@@ -29293,7 +29579,7 @@ var handleBroker = /* @__PURE__ */ __name(async (request, env, ctx) => {
   if (bytes === null) {
     return Response.json({ error: "too_large" }, { status: 413 });
   }
-  const candidate = parseJson(new TextDecoder().decode(bytes));
+  const candidate = parseJson2(new TextDecoder().decode(bytes));
   const parsed = brokerBody.safeParse(candidate);
   if (!parsed.success) {
     if (typeof candidate === "object" && candidate !== null && "kind" in candidate && candidate.kind === "factsRead") {
@@ -29472,7 +29758,7 @@ var textBody = /* @__PURE__ */ __name(async (request) => {
   const bytes = await readBoundedBody(request, MAX_CONTROL_BYTES);
   return bytes === null ? null : new TextDecoder().decode(bytes);
 }, "textBody");
-var parseJson2 = /* @__PURE__ */ __name((value) => {
+var parseJson3 = /* @__PURE__ */ __name((value) => {
   try {
     return JSON.parse(value);
   } catch {
@@ -29501,7 +29787,7 @@ var handleControl = /* @__PURE__ */ __name(async (request, env) => {
   if (authentication === null) {
     return Response.json({ error: "unauthorized" }, { status: 401 });
   }
-  const raw2 = parseJson2(body);
+  const raw2 = parseJson3(body);
   if (raw2 === void 0) {
     return Response.json({ error: "invalid_body" }, { status: 400 });
   }
@@ -29539,7 +29825,7 @@ var handleControl = /* @__PURE__ */ __name(async (request, env) => {
   if (responseBytes === null) {
     return Response.json({ error: "invalid_response" }, { status: 502 });
   }
-  const responseBody = parseJson2(new TextDecoder().decode(responseBytes));
+  const responseBody = parseJson3(new TextDecoder().decode(responseBytes));
   if (responseBody === void 0) {
     return Response.json({ error: "invalid_response" }, { status: 502 });
   }
@@ -30115,7 +30401,7 @@ var passThroughResponse = /* @__PURE__ */ __name((upstream) => {
   });
   return new Response(body, { status: upstream.status, headers });
 }, "passThroughResponse");
-var parseJson3 = /* @__PURE__ */ __name((text) => {
+var parseJson4 = /* @__PURE__ */ __name((text) => {
   try {
     return JSON.parse(text);
   } catch {
@@ -30130,7 +30416,7 @@ var webhookAck = /* @__PURE__ */ __name(async (slug, upstream) => {
   if (bytes === null) {
     return upstreamFailed(slug, "The endpoint outcomes exceed the size cap.");
   }
-  const parsed = endpointOutcomesSchema.safeParse(parseJson3(new TextDecoder().decode(bytes)));
+  const parsed = endpointOutcomesSchema.safeParse(parseJson4(new TextDecoder().decode(bytes)));
   if (!parsed.success) {
     return upstreamFailed(slug, "The endpoint outcomes are malformed.");
   }
@@ -30274,201 +30560,6 @@ appEndpointRoutes.all("/app/:slug/*", (c) => {
   return handleAppEndpoint(c, c.req.param("slug"));
 });
 
-// ../../libs/app-ui-token/src/base64url.ts
-var base64UrlEncode = /* @__PURE__ */ __name((bytes) => {
-  let binary = "";
-  for (const byte of bytes) {
-    binary += String.fromCharCode(byte);
-  }
-  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
-}, "base64UrlEncode");
-var base64UrlDecode = /* @__PURE__ */ __name((text) => {
-  const padded = text.replaceAll("-", "+").replaceAll("_", "/").padEnd(text.length + (4 - text.length % 4) % 4, "=");
-  let binary;
-  try {
-    binary = atob(padded);
-  } catch {
-    return null;
-  }
-  const bytes = new Uint8Array(binary.length);
-  for (let index = 0; index < binary.length; index += 1) {
-    bytes[index] = binary.charCodeAt(index);
-  }
-  return bytes;
-}, "base64UrlDecode");
-
-// ../../libs/app-ui-token/src/env.ts
-var envSchema = external_exports.object({
-  v: external_exports.literal(1),
-  keys: external_exports.record(external_exports.string().min(1).max(16), external_exports.string().min(1))
-}).strict();
-var parseAppUiKeyEnv = /* @__PURE__ */ __name((raw2) => {
-  let json2;
-  try {
-    json2 = JSON.parse(raw2);
-  } catch {
-    return null;
-  }
-  const parsed = envSchema.safeParse(json2);
-  if (!parsed.success) {
-    return null;
-  }
-  const keys = {};
-  for (const [kid, encoded] of Object.entries(parsed.data.keys)) {
-    const bytes = base64UrlDecode(encoded);
-    if (bytes === null) {
-      return null;
-    }
-    keys[kid] = bytes;
-  }
-  return keys;
-}, "parseAppUiKeyEnv");
-
-// ../../libs/app-ui-token/src/jwt.ts
-var headerSchema = external_exports.object({
-  alg: external_exports.literal("HS256"),
-  typ: external_exports.literal("JWT"),
-  kid: external_exports.string().min(1).max(16)
-}).strict();
-var encodeJsonPart = /* @__PURE__ */ __name((value) => {
-  return base64UrlEncode(new TextEncoder().encode(JSON.stringify(value)));
-}, "encodeJsonPart");
-var parseJsonPart = /* @__PURE__ */ __name((part) => {
-  const bytes = base64UrlDecode(part);
-  if (bytes === null) {
-    return null;
-  }
-  try {
-    return JSON.parse(new TextDecoder().decode(bytes));
-  } catch {
-    return null;
-  }
-}, "parseJsonPart");
-var hmacKey = /* @__PURE__ */ __name((key, usage) => {
-  return crypto.subtle.importKey("raw", key, { name: "HMAC", hash: "SHA-256" }, false, [usage]);
-}, "hmacKey");
-var signCompact = /* @__PURE__ */ __name(async (kid, key, claims) => {
-  const signingInput = `${encodeJsonPart({ alg: "HS256", typ: "JWT", kid })}.${encodeJsonPart(claims)}`;
-  const signature = await crypto.subtle.sign("HMAC", await hmacKey(key, "sign"), new TextEncoder().encode(signingInput));
-  return `${signingInput}.${base64UrlEncode(new Uint8Array(signature))}`;
-}, "signCompact");
-var verifyCompactSignature = /* @__PURE__ */ __name(async (token, keys) => {
-  const [headerPart, claimsPart, signaturePart, extra] = token.split(".");
-  if (headerPart === void 0 || claimsPart === void 0 || signaturePart === void 0 || extra !== void 0) {
-    return { ok: false, reason: "malformed" };
-  }
-  const header = headerSchema.safeParse(parseJsonPart(headerPart));
-  if (!header.success) {
-    return { ok: false, reason: "malformed" };
-  }
-  const key = keys[header.data.kid];
-  if (key === void 0) {
-    return { ok: false, reason: "unknown_kid" };
-  }
-  const signature = base64UrlDecode(signaturePart);
-  if (signature === null) {
-    return { ok: false, reason: "malformed" };
-  }
-  const signed = await crypto.subtle.verify(
-    "HMAC",
-    await hmacKey(key, "verify"),
-    signature,
-    new TextEncoder().encode(`${headerPart}.${claimsPart}`)
-  );
-  if (!signed) {
-    return { ok: false, reason: "bad_signature" };
-  }
-  return { ok: true, claims: parseJsonPart(claimsPart), kid: header.data.kid, key };
-}, "verifyCompactSignature");
-
-// ../../libs/app-ui-token/src/token.ts
-var APP_UI_TOKEN_SKEW_SECONDS = 60;
-var APP_UI_TOKEN_ISSUER = "qinto-portal";
-var claimsSchema = external_exports.object({
-  iss: external_exports.literal(APP_UI_TOKEN_ISSUER),
-  aud: external_exports.string().min(1),
-  sub: external_exports.string().min(1),
-  userId: external_exports.string().min(1),
-  iat: external_exports.number().int(),
-  exp: external_exports.number().int(),
-  domainId: external_exports.string().min(1),
-  appId: external_exports.string().min(1),
-  appInstallId: external_exports.string().min(1),
-  appVersionId: external_exports.string().min(1),
-  access: external_exports.enum(["read", "write"]),
-  // Absent means `full`; see the mint below.
-  appRole: external_exports.enum(APP_ROLES).optional()
-}).strict();
-var appUiAudience = /* @__PURE__ */ __name((slug) => {
-  return `app-ui:${slug}`;
-}, "appUiAudience");
-var verifyAppUiToken = /* @__PURE__ */ __name(async (input2) => {
-  const signature = await verifyCompactSignature(input2.token, input2.keys);
-  if (!signature.ok) {
-    return signature;
-  }
-  const claims = claimsSchema.safeParse(signature.claims);
-  if (!claims.success) {
-    return { ok: false, reason: "bad_claims" };
-  }
-  if (claims.data.aud !== appUiAudience(input2.slug)) {
-    return { ok: false, reason: "wrong_app" };
-  }
-  const now = Math.floor(input2.now.getTime() / 1e3);
-  if (claims.data.iat > now + (input2.skewSeconds ?? APP_UI_TOKEN_SKEW_SECONDS)) {
-    return { ok: false, reason: "future_iat" };
-  }
-  if (claims.data.exp <= now) {
-    return { ok: false, reason: "expired" };
-  }
-  return { ok: true, claims: claims.data, kid: signature.kid, key: signature.key };
-}, "verifyAppUiToken");
-
-// ../../libs/app-ui-token/src/runtime-query-ticket.ts
-var APP_RUNTIME_QUERY_TICKET_ISSUER = "qinto-portal";
-var claimsSchema2 = external_exports.object({
-  iss: external_exports.literal(APP_RUNTIME_QUERY_TICKET_ISSUER),
-  aud: external_exports.string().min(1),
-  sub: external_exports.string().min(1),
-  iat: external_exports.number().int(),
-  exp: external_exports.number().int(),
-  domainId: external_exports.string().min(1),
-  appId: external_exports.string().min(1),
-  appInstallId: external_exports.string().min(1),
-  appVersionId: external_exports.string().min(1)
-}).strict();
-
-// ../../libs/app-ui-token/src/write-ticket.ts
-var APP_UI_WRITE_TICKET_TTL_SECONDS = 60;
-var APP_UI_WRITE_TICKET_ISSUER = "qinto-site";
-var claimsSchema3 = external_exports.object({
-  iss: external_exports.literal(APP_UI_WRITE_TICKET_ISSUER),
-  aud: external_exports.string().min(1),
-  sub: external_exports.string().min(1),
-  iat: external_exports.number().int(),
-  exp: external_exports.number().int(),
-  domainId: external_exports.string().min(1),
-  appId: external_exports.string().min(1),
-  appVersionId: external_exports.string().min(1)
-}).strict();
-var appUiWriteAudience = /* @__PURE__ */ __name((slug) => {
-  return `app-ui-write:${slug}`;
-}, "appUiWriteAudience");
-var mintAppUiWriteTicket = /* @__PURE__ */ __name(async (input2) => {
-  const iat = Math.floor(input2.now.getTime() / 1e3);
-  const claims = {
-    iss: APP_UI_WRITE_TICKET_ISSUER,
-    aud: appUiWriteAudience(input2.slug),
-    sub: input2.userId,
-    iat,
-    exp: iat + (input2.ttlSeconds ?? APP_UI_WRITE_TICKET_TTL_SECONDS),
-    domainId: input2.domainId,
-    appId: input2.appId,
-    appVersionId: input2.appVersionId
-  };
-  return signCompact(input2.kid, input2.key, claims);
-}, "mintAppUiWriteTicket");
-
 // src/apps/ui-proxy.ts
 var APP_UI_TIMEOUT_MS = 6e4;
 var refuse3 = /* @__PURE__ */ __name((origin, status, error61) => {
@@ -31404,14 +31495,14 @@ var open2 = /* @__PURE__ */ __name(async (c) => {
 
 // browser-artifact/meta.json
 var meta_default = {
-  version: "0.1.14",
-  gitSha: "38d2892377935b8b457db896715c24891fc3b1ae",
-  builtAt: "2026-10-02T07:54:26.292Z",
-  hash: "50484908a3b28aa31a614fda30b1b3d803fe5922c8a485079f12e6bbf24cd9c1"
+  version: "0.1.15",
+  gitSha: "b90e20a6f236a81312f9525a2b089d2019d0c027",
+  builtAt: "2026-10-09T06:11:09.581Z",
+  hash: "a0cb067dc6246faae53d7842489effb3c46aa848ef529484ab6ee3868fd86762"
 };
 
 // src/paths/q-js.ts
-import qScript from "./8809017061697bf9b90fa4d72f7eb2e0f0e00ad4-q.js.txt";
+import qScript from "./73ef5f028ec35836560c0489d1abdeea83eceede-q.js.txt";
 
 // src/apps-q.ts
 import appsQScript from "./apps-q.json";