@blotout/qinto-cli 0.1.8 → 0.1.9

package/dist/worker-artifact/app-runtime/index.js

@@ -3036,10 +3036,10 @@ var $ZodObject = /* @__PURE__ */ $constructor("$ZodObject", (inst, def) => {
     const shape = def.shape;
     const propValues = {};
     for (const key in shape) {
-      const field = shape[key]._zod;
-      if (field.values) {
+      const field2 = shape[key]._zod;
+      if (field2.values) {
         propValues[key] ?? (propValues[key] = /* @__PURE__ */ new Set());
-        for (const v of field.values)
+        for (const v of field2.values)
           propValues[key].add(v);
       }
     }
@@ -14741,12 +14741,21 @@ var ENDPOINT_CONTEXT_HEADER = "x-qinto-endpoint-context";
 var ENDPOINT_OUTCOMES_HEADER = "x-qinto-endpoint-outcomes";
 var MAX_ENDPOINT_BODY_BYTES = 1024 * 1024;
 var MAX_ENDPOINT_OUTCOMES_BYTES = 64 * 1024;
+var MAX_ENDPOINT_PATH_LENGTH = 16 * 1024;
 var installSchema3 = external_exports.object({ id: external_exports.string().min(1).max(64), ord: external_exports.number().int().min(1), label: external_exports.string().max(100) }).strict();
 var endpointContextSchema = external_exports.object({
-  path: external_exports.string().min(1).max(255),
+  // The declared template, which keys the bundle's handler map; `path` is what the caller asked
+  // for. Only `route` may key the rate limiter — a concrete path gives every parameter value its
+  // own bucket, which is no limit at all.
+  route: external_exports.string().min(1).max(255),
+  path: external_exports.string().min(1).max(MAX_ENDPOINT_PATH_LENGTH),
+  // A name is cut from `route`, so the route's own cap bounds it; anything tighter would reject a
+  // parameter the manifest grammar accepts and the worker already matched.
+  params: external_exports.record(external_exports.string().min(1).max(255), external_exports.string().max(MAX_ENDPOINT_PATH_LENGTH)).default({}),
   method: external_exports.enum(["GET", "POST", "PUT", "PATCH", "DELETE"]),
   mode: external_exports.enum(["webhook", "api"]),
   version: external_exports.string().min(1).max(32),
+  site: external_exports.object({ origin: external_exports.string().min(1).max(255) }).strict(),
   installs: external_exports.array(installSchema3).min(1).max(15)
 }).strict().refine((context) => {
   return context.mode === "webhook" || context.installs.length === 1;
@@ -14761,6 +14770,96 @@ var endpointOutcomesSchema = external_exports.object({
   ).max(15)
 }).strict();
 
+// ../../../libs/app-envelope/src/oauth.ts
+var APP_OAUTH_BINDING_PREFIX = "OAUTH_";
+var appOauthBindingName = (providerId, ordinal) => {
+  return `${APP_OAUTH_BINDING_PREFIX}${providerId.toUpperCase().replaceAll("-", "_")}_${ordinal}`;
+};
+var parseAppOauthBinding = (raw) => {
+  if (raw === void 0 || raw === "") {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    return null;
+  }
+  const value = parsed;
+  if (value["st"] !== "connected" && value["st"] !== "reconnect_required") {
+    return null;
+  }
+  const expiresAt = value["e"];
+  const token = value["t"];
+  return {
+    ...typeof token === "string" && token !== "" ? { t: token } : {},
+    e: typeof expiresAt === "number" ? expiresAt : null,
+    st: value["st"]
+  };
+};
+
+// ../../../libs/app-envelope/src/observability.ts
+var APP_OBSERVABILITY_HEADER = "x-qinto-app-observability";
+var APP_OBSERVABILITY_VERSION = 1;
+var MAX_APP_OBSERVABILITY_EVENTS = 20;
+var MAX_APP_SAVED_ERRORS = 5;
+var MAX_APP_EVENT_NAME_BYTES = 128;
+var MAX_APP_ACTION_NAME_BYTES = 256;
+var MAX_APP_ERROR_DESCRIPTION_BYTES = 2048;
+var MAX_APP_ERROR_PAYLOAD_BYTES = 4096;
+var MAX_APP_DATA_POINT_BLOB_BYTES = 16 * 1024;
+var MAX_APP_OBSERVABILITY_BYTES = 32 * 1024;
+var APP_OBSERVABILITY_JSON_BUDGET = MAX_APP_OBSERVABILITY_BYTES / 4 * 3;
+var APP_EVENT_STATUSES = ["success", "error"];
+var APP_ERROR_CATEGORIES = ["authorization", "configuration", "validation", "rate_limit", "upstream", "internal"];
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+var observabilityEventSchema = external_exports.object({ ord: external_exports.number().int().min(1), name: external_exports.string().min(1).max(MAX_APP_EVENT_NAME_BYTES), status: external_exports.enum(APP_EVENT_STATUSES) }).strict();
+var savedErrorSchema = external_exports.object({
+  ord: external_exports.number().int().min(1),
+  category: external_exports.enum(APP_ERROR_CATEGORIES),
+  action: external_exports.string().min(1).max(MAX_APP_ACTION_NAME_BYTES),
+  description: external_exports.string().min(1).max(MAX_APP_ERROR_DESCRIPTION_BYTES),
+  payload: external_exports.string().max(MAX_APP_ERROR_PAYLOAD_BYTES).optional(),
+  error: external_exports.string().max(MAX_APP_ERROR_PAYLOAD_BYTES).optional()
+}).strict();
+var appObservabilityRecordSchema = external_exports.object({
+  v: external_exports.literal(APP_OBSERVABILITY_VERSION),
+  truncated: external_exports.boolean().optional(),
+  events: external_exports.array(observabilityEventSchema).max(MAX_APP_OBSERVABILITY_EVENTS),
+  errors: external_exports.array(savedErrorSchema).max(MAX_APP_SAVED_ERRORS)
+}).strict();
+var utf8Length = (value) => {
+  return encoder.encode(value).length;
+};
+var truncateUtf8 = (value, maxBytes) => {
+  if (utf8Length(value) <= maxBytes) {
+    return value;
+  }
+  let kept = "";
+  let used = 0;
+  for (const character of value) {
+    const size = utf8Length(character);
+    if (used + size > maxBytes) {
+      break;
+    }
+    kept += character;
+    used += size;
+  }
+  return kept;
+};
+var serializeAppObservability = (record2) => {
+  const bytes = encoder.encode(JSON.stringify(record2));
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary);
+};
+
 // ../../../libs/app-envelope/src/ui.ts
 var UI_CONTEXT_HEADER = "x-qinto-ui-context";
 var MAX_UI_BODY_BYTES = 1024 * 1024;
@@ -14806,10 +14905,10 @@ var formatSpansRecord = (record2) => {
 };
 
 // ../../../libs/tail-trace/src/app-spans.ts
-var encoder = new TextEncoder();
-var decoder = new TextDecoder();
+var encoder2 = new TextEncoder();
+var decoder2 = new TextDecoder();
 var serializeAppSpans = (record2) => {
-  const bytes = encoder.encode(JSON.stringify(record2));
+  const bytes = encoder2.encode(JSON.stringify(record2));
   let binary = "";
   for (const byte of bytes) {
     binary += String.fromCharCode(byte);
@@ -14818,12 +14917,12 @@ var serializeAppSpans = (record2) => {
 };
 
 // ../../../libs/tail-trace/src/budget.ts
-var encoder2 = new TextEncoder();
+var encoder3 = new TextEncoder();
 var byteLength = (value) => {
-  return encoder2.encode(JSON.stringify(value)).length;
+  return encoder3.encode(JSON.stringify(value)).length;
 };
 var fitsBudget = (text, max) => {
-  return text.length * 3 <= max || encoder2.encode(text).length <= max;
+  return text.length * 3 <= max || encoder3.encode(text).length <= max;
 };
 var MIN_KEEP = 64;
 var halveLongestString = (holders) => {
@@ -15407,6 +15506,162 @@ var buildAppsClient = (env, envelope) => {
   };
 };
 
+// src/oauth.ts
+var EXPIRY_FLOOR_MS = 1e3;
+var read = (env, id, ord, now) => {
+  const raw = env[appOauthBindingName(id, ord)];
+  const parsed = parseAppOauthBinding(typeof raw === "string" ? raw : void 0);
+  if (parsed === null) {
+    return null;
+  }
+  const expired = parsed.e !== null && parsed.e - now < EXPIRY_FLOOR_MS;
+  return {
+    id,
+    status: parsed.st === "connected" && !expired ? "connected" : "reconnect_required",
+    expiresAt: parsed.e
+  };
+};
+var buildOauth = (env, ord, now = Date.now) => {
+  return {
+    token: (id) => {
+      const raw = env[appOauthBindingName(id, ord)];
+      const parsed = parseAppOauthBinding(typeof raw === "string" ? raw : void 0);
+      if (parsed === null) {
+        throw new Error(`not_connected: this install has no ${id} connection`);
+      }
+      const state = read(env, id, ord, now());
+      if (parsed.t === void 0 || state?.status !== "connected") {
+        throw new Error(`reconnect_required: the ${id} connection has ended and a site manager must reconnect it`);
+      }
+      return parsed.t;
+    },
+    connection: (id) => {
+      return read(env, id, ord, now());
+    }
+  };
+};
+var oauthTokenValues = (env) => {
+  const values = /* @__PURE__ */ new Set();
+  for (const [name, raw] of Object.entries(env)) {
+    if (!name.startsWith("OAUTH_") || typeof raw !== "string") {
+      continue;
+    }
+    const token = parseAppOauthBinding(raw)?.t;
+    if (token !== void 0 && token !== "") {
+      values.add(token);
+    }
+  }
+  return [...values];
+};
+var buildUiOauth = (env, installs, now = Date.now) => {
+  const ordinalOf = (installId) => {
+    return installs.find((install) => install.id === installId)?.ord ?? null;
+  };
+  return {
+    token: (id, options) => {
+      const ord = ordinalOf(options.installId);
+      if (ord === null) {
+        throw new Error(`not_connected: ${options.installId} is not an install of this app`);
+      }
+      return buildOauth(env, ord, now).token(id);
+    },
+    connection: (id, options) => {
+      const ord = ordinalOf(options.installId);
+      return ord === null ? null : buildOauth(env, ord, now).connection(id);
+    }
+  };
+};
+
+// src/observability-collector.ts
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
+var ENVELOPE_OVERHEAD = 64;
+var collectors = new AsyncLocalStorage2();
+var serialized = (value) => {
+  if (value instanceof Error) {
+    const stack = value.stack;
+    return JSON.stringify({ name: value.name, message: value.message, ...stack === void 0 ? {} : { stack } });
+  }
+  let text;
+  try {
+    text = JSON.stringify(value);
+  } catch {
+    return String(value);
+  }
+  return typeof text === "string" ? text : String(value);
+};
+var field = (value, redact, maxBytes) => {
+  return truncateUtf8(redact(value), maxBytes);
+};
+var optionalField = (value, redact) => {
+  if (value === void 0) {
+    return void 0;
+  }
+  return field(serialized(value), redact, MAX_APP_ERROR_PAYLOAD_BYTES);
+};
+var createObservabilityCollector = (redact) => {
+  const events = [];
+  const errors = [];
+  let used = ENVELOPE_OVERHEAD;
+  let truncated = false;
+  const size = (entry) => {
+    return utf8Length(JSON.stringify(entry)) + 1;
+  };
+  return {
+    addEvent: (ord, name, status) => {
+      if (name === "" || !APP_EVENT_STATUSES.includes(status)) {
+        truncated = true;
+        return;
+      }
+      if (events.length >= MAX_APP_OBSERVABILITY_EVENTS) {
+        truncated = true;
+        return;
+      }
+      const entry = { ord, name: field(name, redact, MAX_APP_EVENT_NAME_BYTES), status };
+      used += size(entry);
+      events.push(entry);
+    },
+    addError: (ord, input) => {
+      if (!APP_ERROR_CATEGORIES.includes(input.category) || input.action === "" || input.description === "") {
+        truncated = true;
+        return;
+      }
+      if (errors.length >= MAX_APP_SAVED_ERRORS) {
+        truncated = true;
+        return;
+      }
+      const payload = optionalField(input.payload, redact);
+      const error51 = optionalField(input.error, redact);
+      const entry = {
+        ord,
+        category: input.category,
+        action: field(input.action, redact, MAX_APP_ACTION_NAME_BYTES),
+        description: field(input.description, redact, MAX_APP_ERROR_DESCRIPTION_BYTES),
+        ...payload === void 0 ? {} : { payload },
+        ...error51 === void 0 ? {} : { error: error51 }
+      };
+      const entrySize = size(entry);
+      if (used + entrySize > APP_OBSERVABILITY_JSON_BUDGET) {
+        truncated = true;
+        return;
+      }
+      used += entrySize;
+      errors.push(entry);
+    },
+    record: () => {
+      if (events.length === 0 && errors.length === 0) {
+        return null;
+      }
+      return { v: APP_OBSERVABILITY_VERSION, ...truncated ? { truncated } : {}, events, errors };
+    }
+  };
+};
+var runWithObservability = (collector, run) => {
+  return collectors.run(collector, run);
+};
+var currentObservability = () => {
+  return collectors.getStore();
+};
+
 // src/observability.ts
 var exceptionAttrs = (error51) => {
   const attrs = {
@@ -15429,7 +15684,7 @@ var consoleText = (error51) => {
   }
   return redactUrlParams(error51 instanceof Error ? error51.stack ?? error51.message : String(error51));
 };
-var buildObservability = () => {
+var buildObservability = (ord) => {
   return {
     log: (message, attrs) => {
       addSpanEvent(message, attrs === void 0 ? {} : { attrs });
@@ -15439,6 +15694,21 @@ var buildObservability = () => {
       addSpanEvent(message, { level: "error", attrs: { ...attrs, ...error51 === void 0 ? {} : exceptionAttrs(error51) } });
       console.error(redactUrlParams(message), consoleText(error51), redactAttrs(attrs ?? {}));
     },
+    event: (name, status) => {
+      addSpanEvent(name, { attrs: { "app.event.status": status } });
+      if (ord !== null) {
+        currentObservability()?.addEvent(ord, name, status);
+      }
+    },
+    saveError: (input) => {
+      addSpanEvent(input.description, {
+        level: "error",
+        attrs: { "app.error.category": input.category, "app.error.action": input.action }
+      });
+      if (ord !== null) {
+        currentObservability()?.addError(ord, input);
+      }
+    },
     span: ((...args) => {
       const [name] = args;
       const { attrs, run } = spanParts(args);
@@ -15515,6 +15785,9 @@ var secretValues = (env) => {
       values.add(value);
     }
   }
+  for (const value of oauthTokenValues(env)) {
+    values.add(value);
+  }
   return [...values];
 };
 var projectInstallValues = (maps, kinds, ord) => {
@@ -15591,13 +15864,13 @@ var readOnce = (env, subject) => {
   };
 };
 var fetchedContext = (env, subject, collector) => {
-  const read = readOnce(env, () => {
+  const read2 = readOnce(env, () => {
     return subject("context.load");
   });
   return {
     private: {
       load: async () => {
-        return (await read()).private;
+        return (await read2()).private;
       },
       set: (patch) => {
         subject("context.set");
@@ -15606,7 +15879,7 @@ var fetchedContext = (env, subject, collector) => {
     },
     shared: {
       load: async () => {
-        return (await read()).shared;
+        return (await read2()).shared;
       },
       set: (patch) => {
         subject("context.set");
@@ -15616,13 +15889,13 @@ var fetchedContext = (env, subject, collector) => {
   };
 };
 var asyncContext = (env, subject) => {
-  const read = readOnce(env, () => {
+  const read2 = readOnce(env, () => {
     return subject("context.load");
   });
   return {
     private: {
       load: async () => {
-        return (await read()).private;
+        return (await read2()).private;
       },
       set: async (patch) => {
         assertValidPatch(patch);
@@ -15634,7 +15907,7 @@ var asyncContext = (env, subject) => {
     },
     shared: {
       load: async () => {
-        return (await read()).shared;
+        return (await read2()).shared;
       },
       set: async (patch) => {
         assertValidPatch(patch);
@@ -15694,12 +15967,13 @@ var buildWorkflowContext = (env, stamp) => {
     env,
     install,
     startWorkflow: buildStartWorkflow(stamp),
+    oauth: buildOauth(env, stamp.ord),
     variables,
     secrets,
     appVariables,
     appSecrets,
     userId: stamp.anonId,
-    observability: buildObservability(),
+    observability: buildObservability(stamp.ord),
     context: asyncContext(env, (what) => {
       return requireSubject(stamp.anonId, what);
     }),
@@ -15776,6 +16050,7 @@ var buildContext = ({
     secrets,
     appVariables: appScope.appVariables,
     appSecrets: appScope.appSecrets,
+    oauth: buildOauth(env, install.ord),
     user: envelope.user ?? null,
     consent: envelope.consent,
     geo: envelope.geo,
@@ -15830,7 +16105,7 @@ var buildContext = ({
         }
       }
     },
-    observability: buildObservability(),
+    observability: buildObservability(install.ord),
     apps: buildAppsClient(env, envelope)
   };
 };
@@ -15927,11 +16202,12 @@ var dispatchSchedule = async (envelope, bundle, env) => {
         installLabel: install.label,
         anonId: null
       }),
+      oauth: buildOauth(env, install.ord),
       variables,
       secrets,
       appVariables: appScope.appVariables,
       appSecrets: appScope.appSecrets,
-      observability: buildObservability(),
+      observability: buildObservability(install.ord),
       apps: buildAppsClient(env, { depth: 0 }),
       query: buildCatalogQuery({ env, ticket: install.catalogQueryTicket, installId: install.id }),
       push: async (userId, message) => {
@@ -15993,7 +16269,7 @@ var lifecycleContext = (env, envelope) => {
       installLabel: install.label,
       anonId: null
     }),
-    observability: buildObservability()
+    observability: buildObservability(install.ord)
   };
 };
 var migrationContext = (env, envelope) => {
@@ -16003,7 +16279,9 @@ var migrationContext = (env, envelope) => {
     site: envelope.site,
     appVariables: appScope.appVariables,
     appSecrets: appScope.appSecrets,
-    observability: buildObservability()
+    // A migration runs once for the site, not once per install, so it has no install to attribute
+    // an event or a saved error to.
+    observability: buildObservability(null)
   };
 };
 var runStatementMigration = async (env, migration) => {
@@ -16132,19 +16410,22 @@ var handlerRequest = (request, context, body) => {
     body: body.byteLength === 0 ? void 0 : body
   });
 };
-var buildContext2 = ({ env, maps, kinds, appScope, install }) => {
+var buildContext2 = ({ env, maps, kinds, appScope, install, site, params }) => {
   const { variables, secrets } = projectInstallValues(maps, kinds, install.ord);
   return {
     env,
+    site,
+    params,
     install: { id: install.id, label: install.label },
     // An endpoint has no visitor, so a workflow it starts cannot push. `push` below is the
     // exception: it names its subject rather than inheriting one.
     startWorkflow: buildStartWorkflow({ ord: install.ord, installId: install.id, installLabel: install.label, anonId: null }),
+    oauth: buildOauth(env, install.ord),
     variables,
     secrets,
     appVariables: appScope.appVariables,
     appSecrets: appScope.appSecrets,
-    observability: buildObservability(),
+    observability: buildObservability(install.ord),
     apps: buildAppsClient(env, { depth: 0 }),
     push: async (userId, message) => {
       await brokerPush(env, {
@@ -16207,7 +16488,8 @@ var dispatchEndpoint = async ({ request, env, versions }) => {
     return Response.json({ error: "unknown version" }, { status: 404 });
   }
   const bundle = versions[context.version];
-  const candidate = bundle?.endpoints?.[context.path];
+  const endpoints = bundle?.endpoints;
+  const candidate = endpoints !== void 0 && Object.hasOwn(endpoints, context.route) ? endpoints[context.route] : void 0;
   if (typeof candidate !== "function") {
     return Response.json({ error: "not_found" }, { status: 404 });
   }
@@ -16218,7 +16500,10 @@ var dispatchEndpoint = async ({ request, env, versions }) => {
   const appScope = projectAppValues(env, appVariableKinds);
   const invoke = async (install) => {
     return installSpan(install, () => {
-      return handler(handlerRequest(request, context, body), buildContext2({ env, maps, kinds: variableKinds, appScope, install }));
+      return handler(
+        handlerRequest(request, context, body),
+        buildContext2({ env, maps, kinds: variableKinds, appScope, install, site: context.site, params: context.params })
+      );
     });
   };
   const installs = [...context.installs].sort((left, right) => {
@@ -16241,29 +16526,38 @@ var appSlug = (context) => {
     return "app";
   }
 };
-var withSpans = (response, record2) => {
+var withSpans = (response, record2, collector) => {
   const headers = new Headers(response.headers);
   headers.set(APP_SPANS_HEADER, serializeAppSpans(record2));
+  headers.delete(APP_OBSERVABILITY_HEADER);
+  const observability = collector.record();
+  if (observability !== null) {
+    headers.set(APP_OBSERVABILITY_HEADER, serializeAppObservability(observability));
+  }
   return new Response(response.body, { status: response.status, statusText: response.statusText, headers });
 };
 var runAppInvocation = async (input, handle) => {
   let record2 = { spans: [] };
+  const redact = spanRedactor(input.secrets);
+  const collector = createObservabilityCollector(redact);
   try {
     const response = await runInvocation(
       {
         name: appSlug(input.context),
         trace: parseTraceContext(input.request.headers.get(TRACE_HEADER)),
         budget: APP_SPANS_JSON_BUDGET,
-        redact: spanRedactor(input.secrets),
+        redact,
         emit: (emitted) => {
           record2 = emitted;
         }
       },
-      handle
+      () => {
+        return runWithObservability(collector, handle);
+      }
     );
-    return withSpans(response, record2);
+    return withSpans(response, record2, collector);
   } catch {
-    return withSpans(input.failure(), record2);
+    return withSpans(input.failure(), record2, collector);
   }
 };
 
@@ -16289,21 +16583,21 @@ var capturedBody = async (open) => {
       return void 0;
     }
     const reader = body.getReader();
-    const decoder2 = new TextDecoder();
+    const decoder3 = new TextDecoder();
     const expired = new Promise((resolve) => {
       timer = setTimeout(() => resolve(null), READ_BUDGET_MS);
     });
     let text = "";
     for (; ; ) {
-      const read = await Promise.race([reader.read(), expired]);
-      if (read === null) {
+      const read2 = await Promise.race([reader.read(), expired]);
+      if (read2 === null) {
         abandon(reader);
         return INCOMPLETE;
       }
-      if (read.done) {
+      if (read2.done) {
         break;
       }
-      text += decoder2.decode(read.value, { stream: true });
+      text += decoder3.decode(read2.value, { stream: true });
       if (text.length > MAX_BODY_CHARS) {
         abandon(reader);
         return TOO_LARGE;
@@ -16415,6 +16709,9 @@ var dispatchUi = async ({ request, env, versions }) => {
     env,
     install: { id: context.install.id, label: context.install.label },
     installs: projectAllInstallValues(maps, variableKinds, context.installs),
+    // The install is named rather than inherited: one panel serves every install, and reading the
+    // subject install's token while showing another account's UI would be silently wrong.
+    oauth: buildUiOauth(env, context.installs),
     settings: buildSettings({ env, ticket: context.writeTicket }),
     // The panel's viewer is a portal user, not a visitor, so a workflow it starts carries no subject.
     startWorkflow: buildUiStartWorkflow(
@@ -16426,7 +16723,7 @@ var dispatchUi = async ({ request, env, versions }) => {
     appVariables,
     appSecrets,
     viewer: context.viewer,
-    observability: buildObservability(),
+    observability: buildObservability(context.install.ord),
     apps: buildAppsClient(env, { depth: 0 })
   };
   let response;

package/dist/worker-artifact/main/9026260a7a674b710223f296c5d2e7a01930cfed-q.js.txt

@@ -0,0 +1 @@
+(function(){var e=class extends Error{constructor(e){super(e),this.name=`QintoError`}},t=class extends e{constructor(e){super(e),this.name=`QintoTimeoutError`}},n=class extends e{constructor(e){super(e),this.name=`QintoEnvironmentError`}},r=`0123456789ABCDEFGHJKMNPQRSTVWXYZ`,i=e=>{let t=new Uint8Array(e);return globalThis.crypto.getRandomValues(t),t},a=e=>{let t=e,n=``;for(let e=0;e<10;e++)n=r.charAt(t%32)+n,t=Math.floor(t/32);let a=``,o=0,s=0;for(let e of i(10))for(o=o<<8|e,s+=8;s>=5;)s-=5,a+=r.charAt(o>>>s&31);return n+a},o=(e=Date.now())=>`evt_${a(e)}_${e}`,s=(e,t)=>{if(e!==void 0)return e;let n=t?.orderId;return typeof n==`string`&&n!==``?n:o()},c=()=>globalThis.document!==void 0,l=[`necessary`,`functional`,`analytics`,`marketing`,`salesOfData`],u=(e,t,n)=>n===void 0||!l.some(e=>e===n)?!1:n===`necessary`||e!==null&&e.categories[n]===!0&&e.apps[t]!==!1,d=()=>{},f=100,p=1024,m=32*1024,h=(e,t,n,r)=>!r||u(e,t,n),g=e=>Object.values(e.config?.apps??{}).some(e=>e.category!==`necessary`||e.capture!==void 0),ee=(e,t)=>{let{app:n,install:r,topic:i,to:a}=e;return typeof n!=`string`||typeof i!=`string`||r!==void 0&&typeof r!=`string`||t&&!(Array.isArray(a)&&a.every(e=>typeof e==`string`))},te=(e,t,n,r)=>r===null?e.slug===t&&(n===void 0||n===e.installId):r.has(e.slug),_=(e,t)=>{console.error(`[Qinto] A handler of app "${e.slug}" (install "${e.installId}") failed.`,t)},v=(e,t,n)=>{for(let r of t)try{let t=r(n);t instanceof Promise&&t.catch(t=>{_(e,t)})}catch(t){_(e,t)}},y=(e,t,n,r)=>{e.activated.add(r.id);let i={slug:t,installId:r.id,eventHandlers:[],consentHandlers:[],pushHandlers:[],sharedContextHandlers:[]};e.instances.push(i);let a={variables:r.variables,install:{id:r.id,label:r.label},getSession:async()=>{let n=await e.client.getSession();return e.target.config?.apps?.[t]?.geo===!0?n:{...n,ip:null,geo:null}},track:(t,n)=>{e.client.track(t,n).catch(d)},onEvent:e=>{i.eventHandlers.push(e)},onConsent:e=>{i.consentHandlers.push(e)},onPush:e=>{i.pushHandlers.push(e)},onSharedContext:n=>{if(e.target.config?.apps?.[t]?.sharedContext!==!0){console.error(`[Qinto] App "${t}" reads shared context without declaring the sharedContext capability.`);return}i.sharedContextHandlers.push(n),e.sharedContext!==null&&S(e,t)&&v(i,[n],e.sharedContext)}};try{n(a)}catch(e){console.error(`[Qinto] App "${t}" failed to activate install "${r.id}".`,e)}},b=(e,t,n)=>{if(!h(e.consent,t,e.target.config?.apps?.[t]?.category,e.target.config?.consentConfiguration?.enabled===!0))return;let r=((`_appInstalls`in e.target?e.target._appInstalls:void 0)?.[t]??[]).filter(t=>!e.activated.has(t.id));if(r.length===0)return;let i=n.factory;if(i===void 0){try{i=n.loader()}catch(e){i=null,console.error(`[Qinto] App "${t}" failed to load.`,e)}e.apps.set(t,{...n,factory:i})}if(i!==null)for(let n of r)y(e,t,i,n)},x=(e,t,n)=>h(n,t,e.target.config?.apps?.[t]?.category,e.target.config?.consentConfiguration?.enabled===!0),S=(e,t)=>x(e,t,e.consent)?e.sharedContextConsent===void 0||x(e,t,e.sharedContextConsent):!1,C=e=>{let{categories:t,apps:n}=e;if(!(typeof t!=`object`||!t||typeof n!=`object`||!n))return{categories:t,apps:n}},w=(e,t)=>{let n=e;n.consent=t,n.sharedContextConsent=void 0;for(let n of e.instances)v(n,n.consentHandlers,t);e.onConsentSettled?.(t);for(let[t,n]of e.apps)b(e,t,n)},T=async e=>{try{w(e,await e.client.getConsent())}catch(e){console.error(`[Qinto] The apps consent read failed.`,e)}},ne=e=>{let t;try{t=JSON.stringify(e)}catch{return}if(!(t===void 0||new TextEncoder().encode(t).length>p))return JSON.parse(t)},re=e=>{let t={};for(let n of e){if(n.settled!==n.total||n.values.length!==1)continue;let e=ne(n.values[0]);if(e===void 0)continue;let r={...t[n.instance.slug]??{},[n.instance.installId]:e},i={...t,[n.instance.slug]:r};new TextEncoder().encode(JSON.stringify(i)).length<=m&&(t[n.instance.slug]=r)}return Object.keys(t).length===0?void 0:t},E=async(e,t)=>{e.onPageEvent?.(e.consent);let n=[],r=[];for(let i of e.instances){if(!h(e.consent,i.slug,e.target.config?.apps?.[i.slug]?.category,e.target.config?.consentConfiguration?.enabled===!0))continue;if(e.target.config?.apps?.[i.slug]?.eventResults?.includes(t.type)!==!0){v(i,i.eventHandlers,t);continue}let a={instance:i,total:i.eventHandlers.length,settled:0,values:[]};n.push(a);for(let e of i.eventHandlers){let n;try{n=e(t)}catch(e){a.settled+=1,_(i,e);continue}r.push(Promise.resolve(n).then(e=>{a.settled+=1,e!==void 0&&a.values.push(e)},e=>{a.settled+=1,_(i,e)}))}}if(r.length>0){let e=d,t=new Promise(t=>{e=t}),n=setTimeout(e,f);await Promise.race([Promise.all(r),t]),clearTimeout(n)}return re(n)},ie=e=>{let{client:t}=e;return{track:async(n,r,i)=>{let a=s(i?.eventId,r),o=t.actionContext(),c=await E(e,{type:`track`,event:n,eventId:a,properties:r??{}});return await t.submitTrack({event:n,eventId:a,properties:r,context:o,appResults:c}),{eventId:a}},identify:async(n,r)=>{let i=t.actionContext(),a=await E(e,{type:`identify`,event:`identify`,properties:n??{}});return t.submitIdentify({traits:n,id:r,context:i,appResults:a})},alias:t.alias,consent:async n=>{if(await t.submitConsent(n,t.actionContext()),e.onConsentMutation?.(),g(e.target)){let t=e;t.consent=null,await T(e)}},getAnonId:t.getAnonId,getConsent:t.getConsent,getSession:t.getSession,close:t.close}},ae=(e,t)=>{let n=new Map,r=null,i=null,a=e=>{let[t,i]=e;if(n.has(t))return;let a={loader:i};n.set(t,a),r?.(t,a)},o=e,s=`_apps`in o?o._apps:void 0,c=Array.isArray(s)?s:[];c.push=(...e)=>{for(let t of e)a(t);return 0},o._apps=c;for(let e of c.splice(0))a(e);return{sharedContext:e=>{let{context:t}=e;if(typeof t!=`object`||!t||Array.isArray(t)){console.error(`[Qinto] The server sent a malformed shared context.`,e);return}let n=i;if(n===null)return;n.sharedContext=t;let r=C(e),a=r??n.consent;n.sharedContextConsent=r;for(let e of n.instances)x(n,e.slug,a)&&v(e,e.sharedContextHandlers,n.sharedContext)},push:e=>{let{app:t,install:n,topic:r,scope:a,to:o}=e,s=a===`site`;if(ee(e,s)){console.error(`[Qinto] The server sent a malformed app push.`,e);return}let c=i;if(c===null)return;let l=s?new Set(o):null,u={topic:r,data:e.data,from:t};for(let e of c.instances)te(e,t,n,l)&&h(c.consent,e.slug,c.target.config?.apps?.[e.slug]?.category,c.target.config?.consentConfiguration?.enabled===!0)&&v(e,e.pushHandlers,u)},connect:async a=>{let o={target:e,client:a,apps:n,instances:[],activated:new Set,consent:null,sharedContext:i?.sharedContext??null,sharedContextConsent:i?.sharedContextConsent,onConsentSettled:t?.onConsentSettled,onConsentMutation:t?.onConsentMutation,onPageEvent:t?.onPageEvent};i=o,r=(e,t)=>{b(o,e,t),o.consent===null&&o.target.config?.consentConfiguration?.enabled===!0&&o.target.config?.apps?.[e]?.category!==`necessary`&&T(o)};for(let[e,t]of n)b(o,e,t);return e.config?.consentConfiguration?.enabled===!0&&g(e)?await T(o):o.onConsentSettled?.(o.consent),ie(o)}}},oe=`PageView`,D=()=>{},se=e=>{e.config?.autoCapture?.pageLoad===!0&&e.q.push([`track`,[oe],D,D])},O=512,k=1440*60*1e3,A=e=>Object.fromEntries(Object.entries(e).map(([e,t])=>[e,Object.fromEntries(Object.entries(t).map(([e,t])=>[e,t.value]))])),j=(e,t)=>`qinto:cap:${encodeURIComponent(e)}:${encodeURIComponent(t)}`,M=e=>{try{let t=window.sessionStorage.getItem(e);if(t===null)return null;let n=JSON.parse(t);return typeof n.at!=`number`||typeof n.anonId!=`string`||typeof n.apps!=`object`||n.apps===null||Date.now()-n.at>k?null:{at:n.at,anonId:n.anonId,apps:n.apps}}catch{return null}},N=(e,t)=>{try{window.sessionStorage.setItem(e,JSON.stringify(t))}catch{}},P=e=>{try{window.sessionStorage.removeItem(e)}catch{}},F=e=>{try{return decodeURIComponent(e)}catch{return e}},I=()=>{let e={};for(let t of document.cookie.split(`;`)){let n=t.indexOf(`=`);n>0&&(e[t.slice(0,n).trim()]=F(t.slice(n+1)))}return e},L=(e,t)=>{let n={};for(let r of e.queryParams){let e=t.params.get(r);e!==null&&e.length<=O&&(n[r]={value:e,source:`query`})}for(let r of e.cookies){let e=t.cookies[r];e!==void 0&&e.length<=O&&(n[r]={value:e,source:`cookie`})}return n},R=(e,t)=>{let n={params:new URLSearchParams(window.location.search),cookies:I()},r={};for(let[i,a]of Object.entries(e.config?.apps??{})){if(a.capture===void 0||!u(t,i,a.category))continue;let e=L(a.capture,n);Object.keys(e).length>0&&(r[i]=e)}return r},z=(e,t)=>{let n={};for(let[r,i]of Object.entries(e)){let e=t[r]??{},a={};for(let[t,n]of Object.entries(i))(e[t]?.value!==n.value||e[t]?.source!==n.source)&&(a[t]=n);Object.keys(a).length>0&&(n[r]=a)}return n},B=(e,t,n,r)=>{let i=j(r,n),a=M(i),o=a?.apps??{},s=a?.anonId??null,c=a===null,l={},u=0,d=(e,t)=>{s!==null&&s!==e.anonId&&(o={}),s=e.anonId;let n=new Set(Object.entries(e.accepted).flatMap(([e,t])=>t.map(t=>`${e}\u0000${t}`)));for(let[e,r]of Object.entries(t))for(let[t,i]of Object.entries(r))n.has(`${e}\u0000${t}`)&&(o[e]={...o[e],[t]:i});N(i,{at:Date.now(),anonId:s,apps:o})},f=null,p=()=>{u+=1,o={},l={},P(i)},m=n=>{if(f=n,!c)return;let r=z(R(e,n),{...o,...l});if(Object.keys(r).length===0)return;let i=u;l={...l,...r},t(A(r)).then(e=>{i===u&&d(e,r)}).catch(()=>{}).finally(()=>{l={}})};return{settled:e=>{m(e)},needsAnon:()=>!c,observedAnon:e=>{(e===null||s!==null&&s!==e)&&p(),s=e,c=!0,m(f)},clear:p}},V=Symbol.for(`qinto.connectGate`),H=()=>{},U=e=>{let t=globalThis,n=(t[V]??Promise.resolve()).then(e);return t[V]=n.then(H,H),n},W=class extends e{constructor(e){super(e),this.name=`QintoProtocolError`}},G=e=>{if(typeof e!=`string`)return null;let t;try{t=JSON.parse(e)}catch{return null}if(typeof t!=`object`||!t)return null;let n=t;return n.t===`ack`||n.t===`error`||n.t===`consentState`||n.t===`session`||n.t===`captureAck`||n.t===`appPush`||n.t===`sharedContext`?t:null},K=e=>{if(e.t===`consentState`)return{categories:e.categories,apps:e.apps};if(e.t===`session`)return{anonId:e.anonId,globalId:e.globalId,ip:e.ip,geo:e.geo};if(e.t===`captureAck`)return{anonId:e.anonId,accepted:e.accepted}},ce=e=>{let n=new Map,r=e=>{let t=n.get(e);if(t!==void 0)return clearTimeout(t.timer),n.delete(e),t};return{submit:r=>new Promise((i,a)=>{let o={frame:r,sent:e.send(r),resolve:i,reject:a,timer:setTimeout(()=>{n.delete(r.ref),a(new t(`The Qinto request timed out.`))},e.requestTimeoutMs)};n.set(r.ref,o)}),flush:()=>{for(let t of n.values())t.sent||=e.send(t.frame)},deliver:e=>{let t=e.ref===void 0?void 0:r(e.ref);if(t!==void 0){if(e.t===`error`){t.reject(new W(e.message));return}t.resolve(K(e))}},rejectAll:e=>{let t=[...n.values()];n.clear();for(let n of t)clearTimeout(n.timer),n.reject(e)}}},le=e=>new WebSocket(e),ue=500,de=3e4,fe=`session not initialized`,pe=(e,t)=>{let n=Math.min(ue*2**e,de);return Math.round(n/2+n/2*t)},me=(e,t)=>e.t===`appPush`?(t.onAppPush?.(e),!0):e.t===`sharedContext`?(t.onSharedContext?.(e),!0):!1,he=e=>{let t=`${e.destination.replace(/\/+$/,``)}/open`,n=null,r=null,i=0,a=null,o=ce({send:e=>n===null||n.readyState!==1?!1:(n.send(JSON.stringify(e)),!0),requestTimeoutMs:e.requestTimeoutMs}),s=t=>{e.onError?.(t)},c=()=>{if(r!==null&&(clearTimeout(r),r=null),n!==null){let e=n;n=null,e.close()}o.rejectAll(new W(`connection closed`))},l=()=>{let u=le(t);n=u,u.onopen=()=>{i=0;let e=a;a=null,o.flush(),e?.resolve()},u.onmessage=t=>{let n=G(t.data);if(n===null){s(new W(`invalid message`));return}me(n,e)||(`anonId`in n&&typeof n.anonId==`string`&&e.onAnonId?.(n.anonId),o.deliver(n),n.t===`error`&&n.message===fe&&u.close())},u.onerror=()=>{s(new W(`connection closed`))},u.onclose=()=>{if(n!==u)return;n=null;let e=a;if(e!==null){a=null,c(),e.reject(new W(`connection closed`));return}o.rejectAll(new W(`connection closed`)),r=setTimeout(()=>{r=null,l()},pe(i,Math.random())),i+=1}};return{connect:()=>new Promise((e,t)=>{a={resolve:e,reject:t},l()}),submit:e=>o.submit(e),close:()=>{c()}}},ge=1e4,_e=()=>{let e=0;return()=>(e+=1,`q${e}`)},ve=(e,t)=>{let n=`qinto:visit:${e.replace(/\/+$/,``)}:${t}`,r,i=!1;try{let e=sessionStorage.getItem(n),t=e===null?null:JSON.parse(e);t===null||typeof t.id!=`string`||!/^vis_[0-9a-f-]{36}$/.test(t.id)||!Number.isSafeInteger(t.startedAt)||t.startedAt<0?(r={id:`vis_${crypto.randomUUID()}`,startedAt:Date.now()},sessionStorage.setItem(n,JSON.stringify(r)),i=!0):r={id:t.id,startedAt:t.startedAt}}catch{r={id:`vis_${crypto.randomUUID()}`,startedAt:Date.now()},i=!0}return()=>{let e={...r,isNew:i};return i=!1,e}},ye=(e,t,n,r)=>{let i=null,a=ve(n,r),o=()=>{let e=document.referrer;return{occurredAt:Date.now(),page:{url:window.location.href,...e===``?{}:{referrer:e}},session:a()}},c=async()=>{let n=await e.submit({t:`getSession`,ref:t()});return i=n.anonId,n};return{actionContext:o,submitIdentify:async({traits:n,id:r,context:i,appResults:a})=>{await e.submit({t:`identify`,ref:t(),traits:n,id:r,context:i,appResults:a})},submitTrack:async({event:n,eventId:r,properties:i,context:a,appResults:o})=>{await e.submit({t:`track`,ref:t(),event:n,eventId:r,properties:i,context:a,appResults:o})},submitConsent:async(n,r)=>{await e.submit({t:`consent`,ref:t(),categories:n.categories,apps:n.apps,context:r})},identify:async(n,r)=>{await e.submit({t:`identify`,ref:t(),traits:n,id:r,context:o()})},track:async(n,r,i)=>{let a=s(i?.eventId,r);return await e.submit({t:`track`,ref:t(),event:n,eventId:a,properties:r,context:o()}),{eventId:a}},alias:async n=>{await e.submit({t:`alias`,ref:t(),customId:n})},consent:async n=>{await e.submit({t:`consent`,ref:t(),categories:n.categories,apps:n.apps,context:o()})},getConsent:async()=>await e.submit({t:`getConsent`,ref:t()}),getSession:c,getAnonId:async()=>(i===null&&await c(),i),close:()=>{e.close()}}},be=async e=>{if(!c())throw new n(`You are calling init() in a server environment. Use createClient from @blotout/qinto-sdk-server there.`);let t=he({destination:e.destination,requestTimeoutMs:e.requestTimeoutMs??ge,onError:e.onError,onAppPush:e.onAppPush,onSharedContext:e.onSharedContext,onAnonId:e.onAnonId});await U(()=>t.connect());let r=_e();return{client:ye(t,r,e.destination,e.globalName??`qinto`),submitCapture:async e=>await t.submit({t:`capture`,ref:r(),apps:e})}},xe=[`then`,`ready`,`config`],q=()=>{},Se=(e,t)=>(...n)=>{let r=new Promise((r,i)=>{e.q.push([t,n,r,i])});return r.catch(q),r},J=e=>{let t=e;return t._q=1,t.q=[],new Proxy(t,{get:(e,n)=>typeof n!=`string`||xe.includes(n)||n in t?Reflect.get(t,n):(t[n]=Se(t,n),t[n])})},Ce=()=>{let e=document.currentScript?.dataset.qintoGlobal;return typeof e==`string`&&e!==``?e:`qinto`},we=e=>typeof e==`object`&&!!e&&e._q===1,Y=(e=`qinto`)=>{let t=globalThis;if(e in t){let n=t[e];if(!we(n))return null;let r=Array.isArray(n.q)?n:J(n);return r!==n&&Object.defineProperty(t,e,{value:r,writable:!0,enumerable:!0,configurable:!0}),r}let n=J({});return Object.defineProperty(t,e,{value:n,writable:!0,enumerable:!0,configurable:!0}),n},Te=(t,n)=>async(r,i)=>{let a=Reflect.get(t,r);if(typeof a!=`function`)throw new e(`[Qinto] ${n}.${r} is not a method of this tag.`);return a.apply(t,Array.from(i))},Ee=e=>()=>Promise.reject(e),X=(e,t)=>{let[n,r,i,a]=t;e(n,r).then(i,a)},De=e=>{let t=[];return t.push=(...t)=>{for(let n of t)X(e,n);return 0},t},Oe=(e,t,n=`window.qinto`)=>{let r=e.ready;if(r!==void 0)return r;let i=e,a=e=>{let t=i.q;i.q=De(e);for(let n of t)X(e,n)},o=t().then(e=>{a(Te(e,n))},e=>{throw a(Ee(e)),e});return o.catch(q),i.ready=o,o},Z=Ce(),Q=Y(Z),$=`window.${Z}`;if(Q!==null&&Q.ready===void 0){let e=null,t=ae(Q,{onConsentSettled:t=>{e?.settled(t)},onConsentMutation:()=>{e?.clear()},onPageEvent:t=>{e?.settled(t)}});se(Q),Oe(Q,async()=>{let n=Q.config?.destination;if(typeof n!=`string`||n===``)throw Error(`[Qinto] ${$}.config.destination is missing.`);let r=await be({destination:n,globalName:Z,onAppPush:t.push,onSharedContext:t.sharedContext,onAnonId:t=>{e?.observedAnon(t)}});e=B(Q,r.submitCapture,n,Z);let i=await t.connect(r.client);return e.needsAnon()&&e.observedAnon((await r.client.getSession()).anonId),i},$)}})();