@blotout/qinto-cli 0.1.7 → 0.1.9

package/dist/worker-artifact/main/index.js

@@ -15917,7 +15917,14 @@ var scheduleSchema = external_exports.object({
   id: external_exports.string().min(1).max(32),
   cron: external_exports.string().min(1).max(MAX_CRON_LENGTH),
   scheduledTime: external_exports.number().int().nonnegative().safe(),
-  installs: external_exports.array(external_exports.object({ id: external_exports.string().min(1).max(64), ord: external_exports.number().int().min(1), label: external_exports.string().max(100) }).strict()).min(1).max(MAX_INSTALLS_PER_APP)
+  installs: external_exports.array(
+    external_exports.object({
+      id: external_exports.string().min(1).max(64),
+      ord: external_exports.number().int().min(1),
+      label: external_exports.string().max(100),
+      catalogQueryTicket: external_exports.string().min(1).max(2048)
+    }).strict()
+  ).min(1).max(MAX_INSTALLS_PER_APP)
 }).strict();
 var controlEnvelopeSchema = external_exports.object({
   v: external_exports.literal(CONTROL_ENVELOPE_VERSION),
@@ -15959,12 +15966,21 @@ var ENDPOINT_CONTEXT_HEADER = "x-qinto-endpoint-context";
 var ENDPOINT_OUTCOMES_HEADER = "x-qinto-endpoint-outcomes";
 var MAX_ENDPOINT_BODY_BYTES = 1024 * 1024;
 var MAX_ENDPOINT_OUTCOMES_BYTES = 64 * 1024;
+var MAX_ENDPOINT_PATH_LENGTH = 16 * 1024;
 var installSchema3 = external_exports.object({ id: external_exports.string().min(1).max(64), ord: external_exports.number().int().min(1), label: external_exports.string().max(100) }).strict();
 var endpointContextSchema = external_exports.object({
-  path: external_exports.string().min(1).max(255),
+  // The declared template, which keys the bundle's handler map; `path` is what the caller asked
+  // for. Only `route` may key the rate limiter — a concrete path gives every parameter value its
+  // own bucket, which is no limit at all.
+  route: external_exports.string().min(1).max(255),
+  path: external_exports.string().min(1).max(MAX_ENDPOINT_PATH_LENGTH),
+  // A name is cut from `route`, so the route's own cap bounds it; anything tighter would reject a
+  // parameter the manifest grammar accepts and the worker already matched.
+  params: external_exports.record(external_exports.string().min(1).max(255), external_exports.string().max(MAX_ENDPOINT_PATH_LENGTH)).default({}),
   method: external_exports.enum(["GET", "POST", "PUT", "PATCH", "DELETE"]),
   mode: external_exports.enum(["webhook", "api"]),
   version: external_exports.string().min(1).max(32),
+  site: external_exports.object({ origin: external_exports.string().min(1).max(255) }).strict(),
   installs: external_exports.array(installSchema3).min(1).max(15)
 }).strict().refine((context) => {
   return context.mode === "webhook" || context.installs.length === 1;
@@ -15991,6 +16007,71 @@ var aggregateEndpointOutcomes = /* @__PURE__ */ __name((outcomes) => {
   return { status: failed ? 502 : 200 };
 }, "aggregateEndpointOutcomes");
 
+// ../../libs/app-envelope/src/observability.ts
+var APP_OBSERVABILITY_HEADER = "x-qinto-app-observability";
+var APP_OBSERVABILITY_VERSION = 1;
+var MAX_APP_OBSERVABILITY_EVENTS = 20;
+var MAX_APP_SAVED_ERRORS = 5;
+var MAX_APP_EVENT_NAME_BYTES = 128;
+var MAX_APP_ACTION_NAME_BYTES = 256;
+var MAX_APP_ERROR_DESCRIPTION_BYTES = 2048;
+var MAX_APP_ERROR_PAYLOAD_BYTES = 4096;
+var MAX_APP_DATA_POINT_BLOB_BYTES = 16 * 1024;
+var MAX_APP_OBSERVABILITY_BYTES = 32 * 1024;
+var APP_OBSERVABILITY_JSON_BUDGET = MAX_APP_OBSERVABILITY_BYTES / 4 * 3;
+var MAX_APP_DATA_POINTS_PER_INVOCATION = 250;
+var APP_EVENT_STATUSES = ["success", "error"];
+var APP_ERROR_CATEGORIES = ["authorization", "configuration", "validation", "rate_limit", "upstream", "internal"];
+var encoder3 = new TextEncoder();
+var decoder2 = new TextDecoder();
+var observabilityEventSchema = external_exports.object({ ord: external_exports.number().int().min(1), name: external_exports.string().min(1).max(MAX_APP_EVENT_NAME_BYTES), status: external_exports.enum(APP_EVENT_STATUSES) }).strict();
+var savedErrorSchema = external_exports.object({
+  ord: external_exports.number().int().min(1),
+  category: external_exports.enum(APP_ERROR_CATEGORIES),
+  action: external_exports.string().min(1).max(MAX_APP_ACTION_NAME_BYTES),
+  description: external_exports.string().min(1).max(MAX_APP_ERROR_DESCRIPTION_BYTES),
+  payload: external_exports.string().max(MAX_APP_ERROR_PAYLOAD_BYTES).optional(),
+  error: external_exports.string().max(MAX_APP_ERROR_PAYLOAD_BYTES).optional()
+}).strict();
+var appObservabilityRecordSchema = external_exports.object({
+  v: external_exports.literal(APP_OBSERVABILITY_VERSION),
+  truncated: external_exports.boolean().optional(),
+  events: external_exports.array(observabilityEventSchema).max(MAX_APP_OBSERVABILITY_EVENTS),
+  errors: external_exports.array(savedErrorSchema).max(MAX_APP_SAVED_ERRORS)
+}).strict();
+var utf8Length = /* @__PURE__ */ __name((value) => {
+  return encoder3.encode(value).length;
+}, "utf8Length");
+var truncateUtf8 = /* @__PURE__ */ __name((value, maxBytes) => {
+  if (utf8Length(value) <= maxBytes) {
+    return value;
+  }
+  let kept = "";
+  let used = 0;
+  for (const character of value) {
+    const size = utf8Length(character);
+    if (used + size > maxBytes) {
+      break;
+    }
+    kept += character;
+    used += size;
+  }
+  return kept;
+}, "truncateUtf8");
+var parseAppObservability = /* @__PURE__ */ __name((header) => {
+  if (header === null || header.length > MAX_APP_OBSERVABILITY_BYTES) {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(decoder2.decode(Uint8Array.from(atob(header), (character) => character.charCodeAt(0))));
+  } catch {
+    return null;
+  }
+  const result = appObservabilityRecordSchema.safeParse(parsed);
+  return result.success ? result.data : null;
+}, "parseAppObservability");
+
 // ../../libs/app-envelope/src/ui.ts
 var UI_CONTEXT_HEADER = "x-qinto-ui-context";
 var MAX_UI_BODY_BYTES = 1024 * 1024;
@@ -16197,13 +16278,13 @@ var getPattern = /* @__PURE__ */ __name((label, next) => {
   }
   return null;
 }, "getPattern");
-var tryDecode = /* @__PURE__ */ __name((str, decoder2) => {
+var tryDecode = /* @__PURE__ */ __name((str, decoder3) => {
   try {
-    return decoder2(str);
+    return decoder3(str);
   } catch {
     return str.replace(/(?:%[0-9A-Fa-f]{2})+/g, (match2) => {
       try {
-        return decoder2(match2);
+        return decoder3(match2);
       } catch {
         return match2;
       }
@@ -18970,6 +19051,82 @@ var readableContext = /* @__PURE__ */ __name((own, shared) => {
   return { private: own === void 0 ? null : wireEntry(own), shared: sharedContextWire(shared) };
 }, "readableContext");
 
+// src/apps/observability.ts
+var observabilityApp = /* @__PURE__ */ __name((slug, app2) => {
+  return { slug, name: app2.name, version: app2.version };
+}, "observabilityApp");
+var createDataPointBudget = /* @__PURE__ */ __name(() => {
+  let spent = 0;
+  return {
+    take: /* @__PURE__ */ __name(() => {
+      if (spent >= MAX_APP_DATA_POINTS_PER_INVOCATION) {
+        return false;
+      }
+      spent += 1;
+      return true;
+    }, "take")
+  };
+}, "createDataPointBudget");
+var totalLength = /* @__PURE__ */ __name((blobs) => {
+  return blobs.reduce((sum, blob) => {
+    return sum + utf8Length(blob);
+  }, 0);
+}, "totalLength");
+var errorBlobs = /* @__PURE__ */ __name((app2, install, record2, rowId) => {
+  const fixed = [app2.slug, app2.name, install.id, install.label, app2.version, record2.category, record2.action, rowId];
+  let remaining = MAX_APP_DATA_POINT_BLOB_BYTES - totalLength(fixed);
+  const description = truncateUtf8(record2.description, Math.max(0, remaining));
+  remaining -= utf8Length(description);
+  const payload = truncateUtf8(record2.payload ?? "", Math.max(0, remaining));
+  remaining -= utf8Length(payload);
+  const error51 = truncateUtf8(record2.error ?? "", Math.max(0, remaining));
+  return [app2.slug, app2.name, install.id, install.label, app2.version, record2.category, record2.action, description, payload, error51, rowId];
+}, "errorBlobs");
+var eventBlobs = /* @__PURE__ */ __name((app2, install, record2) => {
+  return [app2.slug, app2.name, install.id, install.label, app2.version, record2.name, record2.status];
+}, "eventBlobs");
+var writeAppObservability = /* @__PURE__ */ __name((env, response, target) => {
+  const record2 = parseAppObservability(response.headers.get(APP_OBSERVABILITY_HEADER));
+  if (record2 === null) {
+    return;
+  }
+  const byOrd = new Map(
+    target.installs.map((install) => {
+      return [install.ord, install];
+    })
+  );
+  for (const event of record2.events) {
+    const install = byOrd.get(event.ord);
+    if (install === void 0) {
+      addSpanEvent("app observability names an install the site did not send", { level: "warn", attrs: { app: target.app.slug } });
+      continue;
+    }
+    if (!target.budget.take()) {
+      addSpanEvent("app observability dropped at the data-point cap", { level: "warn", attrs: { app: target.app.slug } });
+      return;
+    }
+    env.APP_EVENTS.writeDataPoint({ indexes: [`${install.id}:${event.status}`], blobs: eventBlobs(target.app, install, event) });
+  }
+  for (const saved of record2.errors) {
+    const install = byOrd.get(saved.ord);
+    if (install === void 0) {
+      addSpanEvent("app observability names an install the site did not send", { level: "warn", attrs: { app: target.app.slug } });
+      continue;
+    }
+    if (!target.budget.take()) {
+      addSpanEvent("app observability dropped at the data-point cap", { level: "warn", attrs: { app: target.app.slug } });
+      return;
+    }
+    env.APP_ERRORS.writeDataPoint({
+      indexes: [`${install.id}:${saved.category}`],
+      blobs: errorBlobs(target.app, install, saved, ulid3())
+    });
+  }
+  if (record2.truncated === true) {
+    addSpanEvent("the app recorded more observability than one invocation carries", { level: "warn", attrs: { app: target.app.slug } });
+  }
+}, "writeAppObservability");
+
 // src/apps/read-bounded.ts
 var readBoundedBody = /* @__PURE__ */ __name(async (message, maxBytes) => {
   const reader = message.body?.getReader();
@@ -19020,7 +19177,7 @@ var adoptAppSpans = /* @__PURE__ */ __name((response) => {
 }, "adoptAppSpans");
 
 // src/apps/invoke.ts
-var HOOK_TIMEOUT_MS = 1e4;
+var APP_INVOCATION_TIMEOUT_MS = 1e4;
 var MAX_EMIT_DEPTH = 2;
 var HOOK_URL = "https://app/__qinto/hook";
 var invocationContext = /* @__PURE__ */ __name((env) => {
@@ -19226,19 +19383,24 @@ var hookResponseBody = /* @__PURE__ */ __name(async (response, slug) => {
   }
   return new TextDecoder().decode(bytes);
 }, "hookResponseBody");
-var runInvokeApp = /* @__PURE__ */ __name(async (env, { target, trigger, snapshot, context, deliverPush, writeAttribution: writeAttribution2, writeContext: writeContext2 }) => {
+var runInvokeApp = /* @__PURE__ */ __name(async (env, { target, trigger, snapshot, context, deliverPush, writeAttribution: writeAttribution2, writeContext: writeContext2, budget }) => {
   try {
     const key = await deriveAppInternalKey(context.master, context.domainId, target.slug);
     const response = await postHookEnvelope(env, {
       binding: target.app.binding,
       key,
       envelope: buildEnvelope(target, trigger, snapshot, context),
-      timeoutMs: HOOK_TIMEOUT_MS
+      timeoutMs: APP_INVOCATION_TIMEOUT_MS
     });
     if (response === void 0) {
       addSpanEvent("app service binding is missing", { level: "warn", attrs: { app: target.slug, binding: target.app.binding } });
       return;
     }
+    writeAppObservability(env, response, {
+      app: observabilityApp(target.slug, target.app),
+      installs: target.installs,
+      budget
+    });
     setSpanAttributes({ "app.status": response.status });
     const body = await hookResponseBody(response, target.slug);
     if (body === void 0) {
@@ -19322,6 +19484,9 @@ var installSchema4 = external_exports.object({
 });
 var appSchema = external_exports.object({
   binding: external_exports.string().min(1),
+  // Required, with no default, for the same reason `events` is: the display name is stored on every
+  // observability data point, and a default would be a compatibility path for an older deploy.
+  name: external_exports.string().min(1).max(100),
   version: external_exports.string().min(1),
   // Absent from an old embedded registry; the default never equals a real claim, so the ui proxy
   // refuses stale registries with token_stale instead of turning the app off.
@@ -19609,11 +19774,16 @@ var runRelayRpc = /* @__PURE__ */ __name(async (env, { context, body, callee, in
         // JSON.stringify drops an undefined key, and the envelope requires `args` to be present.
         rpc: { caller: body.slug, fn: body.fn, args: body.args ?? null }
       },
-      timeoutMs: HOOK_TIMEOUT_MS
+      timeoutMs: APP_INVOCATION_TIMEOUT_MS
     });
     if (response === void 0) {
       return calleeFailed(body.callee, "The callee service binding is missing.");
     }
+    writeAppObservability(env, response, {
+      app: observabilityApp(body.callee, callee),
+      installs: [install],
+      budget: createDataPointBudget()
+    });
     setSpanAttributes({ "app.status": response.status });
     if (!response.ok) {
       return calleeFailed(body.callee, `The callee answered status ${response.status}.`);
@@ -19881,6 +20051,18 @@ var controlTargets = /* @__PURE__ */ __name(() => {
 // src/apps/control.ts
 var CONTROL_PATH = "/__qinto/control";
 var MAX_CLOCK_SKEW_MS = 5 * 60 * 1e3;
+var writeControlObservability = /* @__PURE__ */ __name((env, upstream, envelope) => {
+  const installs = envelope.schedule?.installs ?? (envelope.install === void 0 ? [] : [envelope.install]);
+  const app2 = siteRegistry().registry.apps[envelope.app.slug];
+  if (installs.length === 0 || app2 === void 0) {
+    return;
+  }
+  writeAppObservability(env, upstream, {
+    app: observabilityApp(envelope.app.slug, { name: app2.name, version: envelope.app.version }),
+    installs,
+    budget: createDataPointBudget()
+  });
+}, "writeControlObservability");
 var textBody = /* @__PURE__ */ __name(async (request) => {
   const bytes = await readBoundedBody(request, MAX_CONTROL_BYTES);
   return bytes === null ? null : new TextDecoder().decode(bytes);
@@ -19949,6 +20131,7 @@ var handleControl = /* @__PURE__ */ __name(async (request, env) => {
     signal: AbortSignal.timeout(1e4)
   });
   adoptAppSpans(upstream);
+  writeControlObservability(env, upstream, envelope);
   const responseBytes = await readBoundedBody(upstream, MAX_CONTROL_BYTES);
   if (responseBytes === null) {
     return Response.json({ error: "invalid_response" }, { status: 502 });
@@ -19967,6 +20150,73 @@ var appControlRoutes = new Hono2().post(CONTROL_PATH, (c) => {
   return handleControl(c.req.raw, c.env);
 });
 
+// ../../libs/app-manifest/src/route.ts
+var isParam = /* @__PURE__ */ __name((segment) => {
+  return segment.startsWith(":");
+}, "isParam");
+var splitRoute = /* @__PURE__ */ __name((route) => {
+  return route === "/" ? [] : route.slice(1).split("/");
+}, "splitRoute");
+var splitRequest = /* @__PURE__ */ __name((requestPath) => {
+  if (requestPath === "/") {
+    return [];
+  }
+  const decoded = [];
+  for (const segment of requestPath.slice(1).split("/")) {
+    try {
+      decoded.push(decodeURIComponent(segment));
+    } catch {
+      return null;
+    }
+  }
+  return decoded;
+}, "splitRequest");
+var matches = /* @__PURE__ */ __name((parts, segments) => {
+  if (parts.length !== segments.length) {
+    return false;
+  }
+  return parts.every((part, index) => {
+    const segment = segments[index];
+    return isParam(part) ? segment.length > 0 : part === segment;
+  });
+}, "matches");
+var isMoreSpecific = /* @__PURE__ */ __name((candidate, current) => {
+  for (const [index, part] of candidate.entries()) {
+    const candidateParam = isParam(part);
+    const currentParam = isParam(current[index]);
+    if (candidateParam !== currentParam) {
+      return !candidateParam;
+    }
+  }
+  return false;
+}, "isMoreSpecific");
+var extract = /* @__PURE__ */ __name((parts, segments) => {
+  const params = {};
+  for (const [index, part] of parts.entries()) {
+    if (isParam(part)) {
+      params[part.slice(1)] = segments[index];
+    }
+  }
+  return params;
+}, "extract");
+var matchEndpointPath = /* @__PURE__ */ __name((routes, requestPath) => {
+  const segments = splitRequest(requestPath);
+  if (segments === null) {
+    return void 0;
+  }
+  let best;
+  for (const route of routes) {
+    const parts = splitRoute(route);
+    if (matches(parts, segments) && (best === void 0 || isMoreSpecific(parts, best.parts))) {
+      best = { route, parts };
+    }
+  }
+  if (best === void 0) {
+    return void 0;
+  }
+  return { route: best.route, params: extract(best.parts, segments) };
+}, "matchEndpointPath");
+
 // ../../libs/worker-access-token/src/endpoints.ts
 var APP_ENDPOINT_PREFIX = "/app/";
 var MAX_CUSTOM_ENDPOINT_LENGTH = 128;
@@ -20202,7 +20452,76 @@ var requireScope = /* @__PURE__ */ __name((bit) => {
   };
 }, "requireScope");
 
+// src/apps/stream-deadlines.ts
+var streamWithDeadlines = /* @__PURE__ */ __name((source, { idleMs, totalMs }) => {
+  if (source === null) {
+    return null;
+  }
+  const reader = source.getReader();
+  let target;
+  let totalTimer;
+  let idleTimer = null;
+  let stopped = false;
+  const clearIdleTimer = /* @__PURE__ */ __name(() => {
+    if (idleTimer !== null) {
+      clearTimeout(idleTimer);
+      idleTimer = null;
+    }
+  }, "clearIdleTimer");
+  const clearTimers = /* @__PURE__ */ __name(() => {
+    clearTimeout(totalTimer);
+    clearIdleTimer();
+  }, "clearTimers");
+  const stop = /* @__PURE__ */ __name((message) => {
+    stopped = true;
+    clearTimers();
+    const error51 = new DOMException(message, "TimeoutError");
+    target.error(error51);
+    void reader.cancel(error51).catch(() => void 0);
+  }, "stop");
+  return new ReadableStream({
+    start: /* @__PURE__ */ __name((controller) => {
+      target = controller;
+      totalTimer = setTimeout(() => {
+        stop("The app endpoint stream exceeded its maximum duration.");
+      }, totalMs);
+    }, "start"),
+    pull: /* @__PURE__ */ __name(async (controller) => {
+      idleTimer = setTimeout(() => {
+        stop("The app endpoint stream stopped producing data.");
+      }, idleMs);
+      let result;
+      try {
+        result = await reader.read();
+      } catch (error51) {
+        stopped = true;
+        clearTimers();
+        throw error51;
+      }
+      clearIdleTimer();
+      if (stopped) {
+        return;
+      }
+      if (result.done) {
+        stopped = true;
+        clearTimers();
+        controller.close();
+        return;
+      }
+      controller.enqueue(result.value);
+    }, "pull"),
+    cancel: /* @__PURE__ */ __name(async (reason) => {
+      stopped = true;
+      clearTimers();
+      await reader.cancel(reason);
+    }, "cancel")
+  });
+}, "streamWithDeadlines");
+
 // src/apps/endpoint-proxy.ts
+var API_ENDPOINT_START_TIMEOUT_MS = 1e4;
+var API_ENDPOINT_STREAM_IDLE_TIMEOUT_MS = 15e4;
+var API_ENDPOINT_STREAM_MAX_DURATION_MS = 3e5;
 var DENIED_REQUEST_HEADERS = /* @__PURE__ */ new Set(["authorization", "cookie", "x-cf-data"]);
 var refuse = /* @__PURE__ */ __name((status, error51) => {
   return Response.json({ error: error51 }, { status });
@@ -20218,16 +20537,23 @@ var matchEndpoint = /* @__PURE__ */ __name((app2, path, method) => {
   if (!isHttpMethod(method)) {
     return void 0;
   }
-  const declared = app2.endpoints.find((endpoint) => {
-    return endpoint.path === path && endpoint.methods.includes(method);
+  const serving = app2.endpoints.filter((endpoint) => {
+    return endpoint.methods.includes(method);
   });
-  if (declared === void 0) {
+  const matched = matchEndpointPath(
+    serving.map((endpoint) => endpoint.path),
+    path
+  );
+  if (matched === void 0) {
     return void 0;
   }
+  const declared = serving.find((endpoint) => {
+    return endpoint.path === matched.route;
+  });
   if (declared.auth !== "public" && declared.auth !== "token" || declared.mode !== "webhook" && declared.mode !== "api") {
     return void 0;
   }
-  return { path: declared.path, method, auth: declared.auth, mode: declared.mode };
+  return { route: declared.path, path, params: matched.params, method, auth: declared.auth, mode: declared.mode };
 }, "matchEndpoint");
 var authorizeEndpoint = /* @__PURE__ */ __name(async (c, slug, endpoint) => {
   if (endpoint.auth === "public") {
@@ -20259,12 +20585,17 @@ var passThroughResponse = /* @__PURE__ */ __name((upstream) => {
   const headers = new Headers(upstream.headers);
   headers.delete("set-cookie");
   headers.delete(APP_SPANS_HEADER);
+  headers.delete(APP_OBSERVABILITY_HEADER);
   for (const name of [...headers.keys()]) {
     if (name.startsWith("access-control-")) {
       headers.delete(name);
     }
   }
-  return new Response(upstream.body, { status: upstream.status, headers });
+  const body = streamWithDeadlines(upstream.body, {
+    idleMs: API_ENDPOINT_STREAM_IDLE_TIMEOUT_MS,
+    totalMs: API_ENDPOINT_STREAM_MAX_DURATION_MS
+  });
+  return new Response(body, { status: upstream.status, headers });
 }, "passThroughResponse");
 var parseJson3 = /* @__PURE__ */ __name((text) => {
   try {
@@ -20294,6 +20625,17 @@ var webhookAck = /* @__PURE__ */ __name(async (slug, upstream) => {
   }
   return refuse(502, "upstream");
 }, "webhookAck");
+var fetchApiResponse = /* @__PURE__ */ __name(async (service, url2, init) => {
+  const controller = new AbortController();
+  const timer = setTimeout(() => {
+    controller.abort(new DOMException("The app endpoint did not start within its deadline.", "TimeoutError"));
+  }, API_ENDPOINT_START_TIMEOUT_MS);
+  try {
+    return await service.fetch(url2, { ...init, signal: controller.signal });
+  } finally {
+    clearTimeout(timer);
+  }
+}, "fetchApiResponse");
 var runForwardToApp = /* @__PURE__ */ __name(async (c, input) => {
   const { slug, app: app2, endpoint, installs, body, search } = input;
   const context = invocationContext(c.env);
@@ -20313,25 +20655,30 @@ var runForwardToApp = /* @__PURE__ */ __name(async (c, input) => {
   headers.set(
     ENDPOINT_CONTEXT_HEADER,
     JSON.stringify({
+      route: endpoint.route,
       path: endpoint.path,
+      params: endpoint.params,
       method: endpoint.method,
       mode: endpoint.mode,
       version: app2.version,
+      site: { origin: context.origin },
       installs: installs.map((install) => ({ id: install.id, ord: install.ord, label: install.label }))
     })
   );
   let upstream;
   try {
-    upstream = await service.fetch(`https://app/__qinto/endpoint${endpoint.path}${search}`, {
-      method: endpoint.method,
-      headers,
-      body,
-      signal: AbortSignal.timeout(HOOK_TIMEOUT_MS)
-    });
+    const url2 = `https://app/__qinto/endpoint${endpoint.route}${search}`;
+    const init = { method: endpoint.method, headers, body };
+    upstream = endpoint.mode === "api" ? await fetchApiResponse(service, url2, init) : await service.fetch(url2, { ...init, signal: AbortSignal.timeout(APP_INVOCATION_TIMEOUT_MS) });
   } catch (error51) {
     return upstreamFailed(slug, String(error51));
   }
   adoptAppSpans(upstream);
+  writeAppObservability(c.env, upstream, {
+    app: observabilityApp(slug, app2),
+    installs,
+    budget: createDataPointBudget()
+  });
   setSpanAttributes({ "app.status": upstream.status });
   return endpoint.mode === "api" ? passThroughResponse(upstream) : webhookAck(slug, upstream);
 }, "runForwardToApp");
@@ -20344,7 +20691,7 @@ var forwardToApp = /* @__PURE__ */ __name(async (c, input) => {
         "app.slug": slug,
         "app.version": app2.version,
         "app.binding": app2.binding,
-        "app.hook": `endpoint.${endpoint.method} ${endpoint.path}`,
+        "app.hook": `endpoint.${endpoint.method} ${endpoint.route}`,
         "app.endpoint_mode": endpoint.mode,
         "app.installs": installs.length
       }
@@ -20360,7 +20707,11 @@ var handleAppEndpoint = /* @__PURE__ */ __name(async (c, slug) => {
     return refuse(404, "not_found");
   }
   const url2 = new URL(c.req.url);
-  const endpoint = matchEndpoint(app2, url2.pathname.slice(`/app/${slug}`.length), c.req.method);
+  const prefix = `/app/${slug}`;
+  if (url2.pathname !== prefix && !url2.pathname.startsWith(`${prefix}/`)) {
+    return refuse(404, "not_found");
+  }
+  const endpoint = matchEndpoint(app2, url2.pathname.slice(prefix.length) || "/", c.req.method);
   if (endpoint === void 0) {
     return refuse(404, "not_found");
   }
@@ -20373,7 +20724,7 @@ var handleAppEndpoint = /* @__PURE__ */ __name(async (c, slug) => {
   if (first === void 0) {
     return refuse(503, "inactive");
   }
-  const key = endpoint.mode === "api" ? `${slug}:${first.id}:endpoint` : `${slug}:${endpoint.path}:endpoint`;
+  const key = endpoint.mode === "api" ? `${slug}:${first.id}:endpoint` : `${slug}:${endpoint.route}:endpoint`;
   if (await rateLimited(c.env, key)) {
     return refuse(429, "rate_limited");
   }
@@ -20540,10 +20891,24 @@ var verifyAppUiToken = /* @__PURE__ */ __name(async (input) => {
   return { ok: true, claims: claims.data, kid: signature.kid, key: signature.key };
 }, "verifyAppUiToken");
 
+// ../../libs/app-ui-token/src/schedule-catalog-ticket.ts
+var APP_SCHEDULE_CATALOG_TICKET_ISSUER = "qinto-portal";
+var claimsSchema2 = external_exports.object({
+  iss: external_exports.literal(APP_SCHEDULE_CATALOG_TICKET_ISSUER),
+  aud: external_exports.string().min(1),
+  sub: external_exports.string().min(1),
+  iat: external_exports.number().int(),
+  exp: external_exports.number().int(),
+  domainId: external_exports.string().min(1),
+  appId: external_exports.string().min(1),
+  appInstallId: external_exports.string().min(1),
+  appVersionId: external_exports.string().min(1)
+}).strict();
+
 // ../../libs/app-ui-token/src/write-ticket.ts
 var APP_UI_WRITE_TICKET_TTL_SECONDS = 60;
 var APP_UI_WRITE_TICKET_ISSUER = "qinto-site";
-var claimsSchema2 = external_exports.object({
+var claimsSchema3 = external_exports.object({
   iss: external_exports.literal(APP_UI_WRITE_TICKET_ISSUER),
   aud: external_exports.string().min(1),
   sub: external_exports.string().min(1),
@@ -20629,16 +20994,22 @@ var runForwardToApp2 = /* @__PURE__ */ __name(async (c, input) => {
       method: c.req.method,
       headers,
       body,
-      signal: AbortSignal.timeout(HOOK_TIMEOUT_MS)
+      signal: AbortSignal.timeout(APP_INVOCATION_TIMEOUT_MS)
     });
   } catch (error51) {
     return upstreamFailed2(origin, slug, String(error51));
   }
   adoptAppSpans(upstream);
+  writeAppObservability(c.env, upstream, {
+    app: observabilityApp(slug, app2),
+    installs: [{ id: install.id, ord: install.ord, label: install.label }],
+    budget: createDataPointBudget()
+  });
   setSpanAttributes({ "app.status": upstream.status });
   const responseHeaders = new Headers(upstream.headers);
   responseHeaders.delete("set-cookie");
   responseHeaders.delete(APP_SPANS_HEADER);
+  responseHeaders.delete(APP_OBSERVABILITY_HEADER);
   for (const name of [...responseHeaders.keys()]) {
     if (name.startsWith("access-control-")) {
       responseHeaders.delete(name);
@@ -23672,6 +24043,21 @@ var withoutQuery = /* @__PURE__ */ __name((url2) => {
   parsed.search = "";
   return parsed.toString();
 }, "withoutQuery");
+var browserGeoFrom = /* @__PURE__ */ __name((geo) => {
+  if (geo === void 0) {
+    return void 0;
+  }
+  return {
+    country: geo.country ?? null,
+    // EdgeTag's geoRegion is Cloudflare's subdivision code.
+    region: geo.regionCode ?? null,
+    state: geo.region ?? null,
+    isEU: geo.isEUCountry === "yes"
+  };
+}, "browserGeoFrom");
+var attachmentFieldBytes = /* @__PURE__ */ __name((name, value) => {
+  return value === void 0 ? 0 : new TextEncoder().encode(`,"${name}":${JSON.stringify(value)}`).length;
+}, "attachmentFieldBytes");
 var connectionAttachment = /* @__PURE__ */ __name((request, geo) => {
   const userAgent = request.headers.get("user-agent");
   const attrs = {
@@ -23687,15 +24073,18 @@ var connectionAttachment = /* @__PURE__ */ __name((request, geo) => {
     locale: raw2.locale !== void 0 && raw2.locale.length <= MAX_HOST_LOCALE_LENGTH ? raw2.locale : void 0
   };
   const host = bounded.ip === void 0 && bounded.userAgent === void 0 && bounded.locale === void 0 ? void 0 : bounded;
-  const hostBytes = host === void 0 ? 0 : new TextEncoder().encode(`,"host":${JSON.stringify(host)}`).length;
+  const hostBytes = attachmentFieldBytes("host", host);
+  const browserGeo = browserGeoFrom(geo);
+  const browserGeoBytes = attachmentFieldBytes("browserGeo", browserGeo);
   const cf = forwardedCf(request);
   const cfSuffix = cf === void 0 ? "" : `,"cf":${JSON.stringify(cf)}`;
   const cfBytes = new TextEncoder().encode(cfSuffix).length;
   const emptyAttrsBytes = new TextEncoder().encode(JSON.stringify({ attrs: {} })).length;
-  const includedCf = cfBytes <= MAX_ATTACHMENT_BYTES - emptyAttrsBytes - hostBytes ? cf : void 0;
-  const budgeted = budgetAttrs(attrs, MAX_ATTACHMENT_BYTES - hostBytes - (includedCf === void 0 ? 0 : cfBytes));
+  const includedCf = cfBytes <= MAX_ATTACHMENT_BYTES - emptyAttrsBytes - hostBytes - browserGeoBytes ? cf : void 0;
+  const budgeted = budgetAttrs(attrs, MAX_ATTACHMENT_BYTES - hostBytes - browserGeoBytes - (includedCf === void 0 ? 0 : cfBytes));
   return {
     ...budgeted,
+    ...browserGeo === void 0 ? {} : { browserGeo },
     ...includedCf === void 0 ? {} : { cf: includedCf },
     ...host === void 0 ? {} : { host }
   };
@@ -23782,14 +24171,14 @@ var open = /* @__PURE__ */ __name(async (c) => {
 
 // browser-artifact/meta.json
 var meta_default = {
-  version: "0.1.1",
-  gitSha: "45acc2f65889b33f7cf2828b967a26fd879455f0",
-  builtAt: "2026-08-25T22:08:34.269Z",
-  hash: "8f1c955d16978159926d9c98b73ee2d0a3c3d1ea51d4ec8e1b017c3ea6892ea1"
+  version: "0.1.3",
+  gitSha: "66e1bc45acbe4891948cbb3851f3f43ce06abc84",
+  builtAt: "2026-08-28T17:17:19.113Z",
+  hash: "050bb7dd702ac407623ce130c324f3342f048b8a201e2975994d5ef54de7f19f"
 };
 
 // src/paths/q-js.ts
-import qScript from "./9dcfd236748459af038da772477100c4bb0223b7-q.js.txt";
+import qScript from "./9026260a7a674b710223f296c5d2e7a01930cfed-q.js.txt";
 
 // src/apps-q.ts
 import appsQScript from "./apps-q.json";
@@ -23846,6 +24235,7 @@ var appsMetadata = /* @__PURE__ */ __name(() => {
   return Object.fromEntries(
     Object.entries(registry3.apps).map(([slug, app2]) => {
       const capture = declaredCapture(app2);
+      const geo = app2.data.includes("geo") ? { geo: true } : {};
       const sharedContext = app2.data.includes(SHARED_CONTEXT_CAPABILITY) ? { sharedContext: true } : {};
       return [
         slug,
@@ -23853,6 +24243,7 @@ var appsMetadata = /* @__PURE__ */ __name(() => {
           category: app2.consent.category,
           eventResults: app2.eventResults,
           ...capture === void 0 ? {} : { capture },
+          ...geo,
           ...sharedContext
         }
       ];
@@ -24499,7 +24890,7 @@ var runPool = /* @__PURE__ */ __name(async (limit, tasks) => {
   }
   await Promise.all(running);
 }, "runPool");
-var fanOutToApps = /* @__PURE__ */ __name(async (env, trigger, snapshot, { deliverPush, writeAttribution: writeAttribution2, writeContext: writeContext2, trace }) => {
+var fanOutToApps = /* @__PURE__ */ __name(async (env, trigger, snapshot, { deliverPush, writeAttribution: writeAttribution2, writeContext: writeContext2, budget, trace }) => {
   const { registry: registry3, error: error51 } = siteRegistry();
   const targets = eligibleApps(registry3, trigger, snapshot.consent, consentEnforced(env));
   if (error51 === void 0 && targets.length === 0) {
@@ -24527,7 +24918,7 @@ var fanOutToApps = /* @__PURE__ */ __name(async (env, trigger, snapshot, { deliv
       await runPool(
         FAN_OUT_CONCURRENCY,
         capped.map((target) => {
-          return () => invokeApp(env, { target, trigger, snapshot, context, deliverPush, writeAttribution: writeAttribution2, writeContext: writeContext2 });
+          return () => invokeApp(env, { target, trigger, snapshot, context, deliverPush, writeAttribution: writeAttribution2, writeContext: writeContext2, budget });
         })
       );
     }
@@ -24584,7 +24975,7 @@ var withReplacedPayload = /* @__PURE__ */ __name((entry, action, payload) => {
   }
   return { ...action, payload: parsed.data };
 }, "withReplacedPayload");
-var postTransform = /* @__PURE__ */ __name(async (env, entry, post) => {
+var postTransform = /* @__PURE__ */ __name(async (env, entry, post, dataPoints) => {
   let response;
   try {
     response = await postHookEnvelope(env, { binding: entry.app.binding, ...post });
@@ -24594,6 +24985,11 @@ var postTransform = /* @__PURE__ */ __name(async (env, entry, post) => {
   if (response === void 0) {
     throw entryFailure(entry, `the ${entry.app.binding} service binding is missing`);
   }
+  writeAppObservability(env, response, {
+    app: observabilityApp(entry.slug, entry.app),
+    installs: [entry.install],
+    budget: dataPoints
+  });
   setSpanAttributes({ "app.status": response.status });
   if (!response.ok) {
     throw entryFailure(entry, `the hook answered status ${response.status}`);
@@ -24608,14 +25004,14 @@ var postTransform = /* @__PURE__ */ __name(async (env, entry, post) => {
     throw entryFailure(entry, String(error51));
   }
 }, "postTransform");
-var runTransformEntry = /* @__PURE__ */ __name(async (env, { entry, action, snapshot, context, timeoutMs }) => {
+var runTransformEntry = /* @__PURE__ */ __name(async (env, { entry, action, snapshot, context, timeoutMs, dataPoints }) => {
   const target = { slug: entry.slug, app: entry.app, installs: [entry.install] };
   const envelope = {
     ...buildEnvelope(target, { kind: "event", action }, snapshot, context),
     kind: "transform"
   };
   const key = await deriveAppInternalKey(context.master, context.domainId, entry.slug);
-  const verdict = validateEnvelopeResponse(await postTransform(env, entry, { key, envelope, timeoutMs }), 1);
+  const verdict = validateEnvelopeResponse(await postTransform(env, entry, { key, envelope, timeoutMs }, dataPoints), 1);
   if (!verdict.ok) {
     throw entryFailure(entry, verdict.reason);
   }
@@ -24683,7 +25079,7 @@ var buildRelease = /* @__PURE__ */ __name((env, { collected, action, deliverPush
     }
   };
 }, "buildRelease");
-var runTransformChain = /* @__PURE__ */ __name(async (env, { action, snapshot, deliverPush, writeAttribution: writeAttribution2, writeContext: writeContext2 }) => {
+var runTransformChain = /* @__PURE__ */ __name(async (env, { action, snapshot, deliverPush, writeAttribution: writeAttribution2, writeContext: writeContext2, dataPoints }) => {
   const { registry: registry3, error: error51 } = siteRegistry();
   if (error51 !== void 0) {
     throw new TransformChainError(`the apps registry is malformed: ${error51}`);
@@ -24703,7 +25099,14 @@ var runTransformChain = /* @__PURE__ */ __name(async (env, { action, snapshot, d
     for (const entry of entries) {
       const stepped = entryBudget(budget, entry, Date.now());
       budget = stepped.budget;
-      const verdict = await invokeTransformEntry(env, { entry, action: current, snapshot, context, timeoutMs: stepped.timeoutMs });
+      const verdict = await invokeTransformEntry(env, {
+        entry,
+        action: current,
+        snapshot,
+        context,
+        timeoutMs: stepped.timeoutMs,
+        dataPoints
+      });
       if (verdict.effects.accepted.length > 0) {
         collected.push({ slug: entry.slug, installs: [entry.install], groups: verdict.effects.accepted });
       }
@@ -25684,7 +26087,11 @@ var AnonDO = class extends DurableObject2 {
       const attachment = connectionAttachment(request, geo);
       server.serializeAttachment(attachment);
       this.deliverSharedContext(server);
-      this.appFanOut({ kind: "connect", ...attachment.cf === void 0 ? {} : { geo: attachment.cf }, host: attachment.host }, userId);
+      this.appFanOut(
+        { kind: "connect", ...attachment.cf === void 0 ? {} : { geo: attachment.cf }, host: attachment.host },
+        userId,
+        createDataPointBudget()
+      );
       return new Response(null, { status: 101, webSocket: client });
     });
   }
@@ -25739,7 +26146,14 @@ var AnonDO = class extends DurableObject2 {
         return;
       }
       if (parsed.frame.t === "getSession") {
-        this.respond(ws, { t: "session", ref: parsed.ref, anonId: userId, globalId: linkedGlobalId(this.kv) });
+        this.respond(ws, {
+          t: "session",
+          ref: parsed.ref,
+          anonId: userId,
+          globalId: linkedGlobalId(this.kv),
+          ip: attachment?.host?.ip ?? null,
+          geo: attachment?.browserGeo ?? null
+        });
         return;
       }
       if (parsed.frame.t === "capture") {
@@ -26025,12 +26439,13 @@ var AnonDO = class extends DurableObject2 {
       if (isNoopAction(action)) {
         return;
       }
-      const transformed = await this.transformAction(action);
+      const dataPoints = createDataPointBudget();
+      const transformed = await this.transformAction(action, dataPoints);
       if (transformed === null) {
         return;
       }
       recorded = transformed.action;
-      await this.runAction(transformed.action, transformed.releaseEmissions);
+      await this.runAction(transformed.action, transformed.releaseEmissions, dataPoints);
     } finally {
       this.recordActionBlocks(recorded);
     }
@@ -26040,9 +26455,9 @@ var AnonDO = class extends DurableObject2 {
       actionBlocks(action, this.appsSnapshot(action.userId), this.wiped ? [] : allIdentifiers(this.sql, this.identifiersMirror))
     );
   }
-  async runAction(current, releaseEmissions) {
+  async runAction(current, releaseEmissions, dataPoints) {
     if (current.type !== "alias" && isDeliveryOnlyAction(current)) {
-      this.appFanOut({ kind: "event", action: current }, current.userId);
+      this.appFanOut({ kind: "event", action: current }, current.userId, dataPoints);
       this.releaseTransformEmissions(releaseEmissions);
       return;
     }
@@ -26078,7 +26493,7 @@ var AnonDO = class extends DurableObject2 {
       } else {
         await this.ingestConsent(current);
       }
-      this.appFanOut({ kind: "event", action: current }, current.userId);
+      this.appFanOut({ kind: "event", action: current }, current.userId, dataPoints);
       this.releaseTransformEmissions(releaseEmissions);
     } finally {
       if (novelIdentifier) {
@@ -26087,7 +26502,7 @@ var AnonDO = class extends DurableObject2 {
     }
   }
   // null means a transform dropped the action: the turn succeeds with nothing persisted (§5.4).
-  async transformAction(action) {
+  async transformAction(action, dataPoints) {
     if (action.type !== "track" && action.type !== "identify") {
       return { action, releaseEmissions: null };
     }
@@ -26096,7 +26511,8 @@ var AnonDO = class extends DurableObject2 {
       snapshot: this.appsSnapshot(action.userId),
       deliverPush: this.pushDelivery,
       writeAttribution: this.attributionDelivery,
-      writeContext: this.contextDelivery
+      writeContext: this.contextDelivery,
+      dataPoints
     });
     if (outcome.dropped) {
       this.releaseTransformEmissions(outcome.releaseEmissions);
@@ -26132,13 +26548,14 @@ var AnonDO = class extends DurableObject2 {
     }
     this.ctx.waitUntil(release().catch((error51) => console.warn("transform emission release failed", { error: error51 })));
   }
-  appFanOut(trigger, anonId) {
+  appFanOut(trigger, anonId, dataPoints) {
     const snapshot = this.appsSnapshot(anonId);
     this.ctx.waitUntil(
       fanOutToApps(this.env, trigger, snapshot, {
         deliverPush: this.pushDelivery,
         writeAttribution: this.attributionDelivery,
         writeContext: this.contextDelivery,
+        budget: dataPoints,
         trace: currentTraceContext()
       }).catch((error51) => console.warn("app fan-out failed", { error: error51 }))
     );