@blotout/qinto-cli 0.1.9 → 0.1.10

package/dist/worker-artifact/app-runtime/index.js

@@ -7,6 +7,10 @@ var __export = (target, all) => {
 // ../../../libs/app-manifest/src/cron.ts
 var MAX_CRON_LENGTH = 128;
 
+// ../../../libs/app-manifest/src/tool-names.ts
+var MAX_APP_TOOL_NAME_LENGTH = 32;
+var APP_TOOL_NAME_PATTERN = /^[a-zA-Z][a-zA-Z0-9_]*$/;
+
 // ../../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 var external_exports = {};
 __export(external_exports, {
@@ -2348,13 +2352,13 @@ var $ZodType = /* @__PURE__ */ $constructor("$ZodType", (inst, def) => {
         canary.aborted = true;
         return canary;
       }
-      const checkResult = runChecks(payload, checks, ctx);
-      if (checkResult instanceof Promise) {
+      const checkResult2 = runChecks(payload, checks, ctx);
+      if (checkResult2 instanceof Promise) {
         if (ctx.async === false)
           throw new $ZodAsyncError();
-        return checkResult.then((checkResult2) => inst._zod.parse(checkResult2, ctx));
+        return checkResult2.then((checkResult3) => inst._zod.parse(checkResult3, ctx));
       }
-      return inst._zod.parse(checkResult, ctx);
+      return inst._zod.parse(checkResult2, ctx);
     };
     inst._zod.run = (payload, ctx) => {
       if (ctx.skipChecks) {
@@ -14628,6 +14632,11 @@ var envelopeResponseSchema = external_exports.object({
 var CONTROL_ENVELOPE_VERSION = 1;
 var MAX_CONTROL_BYTES = 256 * 1024;
 var MAX_MIGRATION_CHECKPOINT_BYTES = 16 * 1024;
+var MAX_TOOL_ARGUMENTS_BYTES = 32 * 1024;
+var MAX_TOOL_RESULT_BYTES = 64 * 1024;
+var MAX_TOOL_DATA_DEPTH = 8;
+var MAX_TOOL_DATA_NODES = 5e3;
+var MAX_TOOL_ERROR_MESSAGE_LENGTH = 512;
 var installSchema2 = external_exports.object({
   id: external_exports.string().min(1).max(64),
   ord: external_exports.number().int().min(1),
@@ -14701,15 +14710,32 @@ var scheduleSchema = external_exports.object({
     }).strict()
   ).min(1).max(MAX_INSTALLS_PER_APP)
 }).strict();
+var toolSchema = external_exports.object({
+  // The manifest's tools[].name, never the `<slug>_` composed MCP name: the slug is already in
+  // `app.slug`, and carrying it twice would give the app worker two sources for one fact.
+  name: external_exports.string().min(1).max(MAX_APP_TOOL_NAME_LENGTH).regex(APP_TOOL_NAME_PATTERN),
+  // Who asked, and what they may do on this site. Derived from the bearer by the portal, never
+  // from the model's arguments.
+  viewer: external_exports.object({ userId: external_exports.string().min(1).max(64), access: external_exports.enum(["read", "write"]) }).strict(),
+  // Already validated against the tool's declared inputSchema, with the reserved routing names
+  // stripped. Every declared input schema has an object root, so this is an object too — and a
+  // call that names no arguments normalizes to `{}` rather than reaching the handler as undefined.
+  arguments: external_exports.record(external_exports.string(), external_exports.unknown()).default({}),
+  // Stable across a collapsed retry, so an app can deduplicate its external effects on it.
+  callId: external_exports.string().min(1).max(64)
+}).strict().refine((tool) => {
+  return new TextEncoder().encode(JSON.stringify(tool.arguments)).length <= MAX_TOOL_ARGUMENTS_BYTES;
+}, "Tool arguments exceed the size cap");
 var controlEnvelopeSchema = external_exports.object({
   v: external_exports.literal(CONTROL_ENVELOPE_VERSION),
-  kind: external_exports.enum(["noop", "lifecycle", "migration", "schedule"]),
+  kind: external_exports.enum(["noop", "lifecycle", "migration", "schedule", "tool"]),
   site: external_exports.object({ origin: external_exports.string().min(1).max(255) }).strict(),
   app: external_exports.object({ slug: external_exports.string().min(1).max(30), version: external_exports.string().min(1).max(32) }).strict(),
   install: external_exports.object({ id: external_exports.string().min(1).max(64), ord: external_exports.number().int().min(1), label: external_exports.string().max(100) }).strict().optional(),
   lifecycle: lifecycleEventSchema.optional(),
   migration: migrationSchema.optional(),
-  schedule: scheduleSchema.optional()
+  schedule: scheduleSchema.optional(),
+  tool: toolSchema.optional()
 }).strict().superRefine((envelope, ctx) => {
   if (envelope.kind === "lifecycle" !== (envelope.lifecycle !== void 0)) {
     ctx.addIssue({ code: "custom", path: ["lifecycle"], message: "Lifecycle payload must match the control kind" });
@@ -14720,13 +14746,50 @@ var controlEnvelopeSchema = external_exports.object({
   if (envelope.kind === "schedule" !== (envelope.schedule !== void 0)) {
     ctx.addIssue({ code: "custom", path: ["schedule"], message: "Schedule payload must match the control kind" });
   }
+  if (envelope.kind === "tool" !== (envelope.tool !== void 0)) {
+    ctx.addIssue({ code: "custom", path: ["tool"], message: "Tool payload must match the control kind" });
+  }
   if (envelope.kind === "lifecycle" && envelope.install === void 0) {
     ctx.addIssue({ code: "custom", path: ["install"], message: "Lifecycle control needs an install" });
   }
+  if (envelope.kind === "tool" && envelope.install === void 0) {
+    ctx.addIssue({ code: "custom", path: ["install"], message: "Tool control needs an install" });
+  }
 });
+var toolDataWithinLimits = (value) => {
+  const stack = [{ value, depth: 0 }];
+  let seen = 0;
+  while (stack.length > 0) {
+    const next = stack.pop();
+    seen += 1;
+    if (next.depth > MAX_TOOL_DATA_DEPTH || seen > MAX_TOOL_DATA_NODES) {
+      return false;
+    }
+    if (next.value !== null && typeof next.value === "object") {
+      for (const child of Object.values(next.value)) {
+        stack.push({ value: child, depth: next.depth + 1 });
+      }
+    }
+  }
+  return true;
+};
+var toolResultSchema = external_exports.object({
+  content: external_exports.string().max(MAX_TOOL_RESULT_BYTES),
+  // MCP defines `structuredContent` as an object, so a bare scalar or array is refused here rather
+  // than surfacing as a protocol error at the client.
+  data: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
+  // True when the handler chose to fail with `ctx.fail`: `content` is then the app's own message
+  // for the model. A thrown handler is `ok: false` with no `tool` at all.
+  failed: external_exports.boolean()
+}).strict().refine((result) => {
+  return toolDataWithinLimits(result.data);
+}, "Tool result nests too deeply or carries too many values").refine((result) => {
+  return new TextEncoder().encode(JSON.stringify({ content: result.content, data: result.data ?? null })).length <= MAX_TOOL_RESULT_BYTES;
+}, "Tool result exceeds the size cap");
 var controlResponseSchema = external_exports.object({
   v: external_exports.literal(CONTROL_ENVELOPE_VERSION),
   ok: external_exports.boolean(),
+  tool: toolResultSchema.optional(),
   migration: external_exports.union([
     external_exports.object({ done: external_exports.literal(true) }).strict(),
     external_exports.object({ done: external_exports.literal(false), checkpoint: external_exports.unknown() }).strict().refine((result) => {
@@ -16177,7 +16240,8 @@ var buildCatalogQuery = ({ env, ticket, installId }) => {
 // src/schedule.ts
 var dispatchSchedule = async (envelope, bundle, env) => {
   const schedule = envelope.schedule;
-  const handler = bundle.schedules?.[schedule.id];
+  const schedules = bundle.schedules;
+  const handler = schedules !== void 0 && Object.hasOwn(schedules, schedule.id) ? schedules[schedule.id] : void 0;
   if (typeof handler !== "function") {
     return json2(200, {
       v: CONTROL_ENVELOPE_VERSION,
@@ -16239,6 +16303,141 @@ var dispatchSchedule = async (envelope, bundle, env) => {
   return json2(200, { v: CONTROL_ENVELOPE_VERSION, ok: true });
 };
 
+// src/tool.ts
+var failure = (message) => {
+  return json2(200, { v: CONTROL_ENVELOPE_VERSION, ok: false, error: { message } });
+};
+var isFailure = (value) => {
+  return value !== null && typeof value === "object" && value.kind === "tool_error" && typeof value.message === "string";
+};
+var isResult = (value) => {
+  return value !== null && typeof value === "object" && typeof value.content === "string";
+};
+var isStructuredData = (data) => {
+  return data === void 0 || data !== null && typeof data === "object" && !Array.isArray(data);
+};
+var isPlainContainer = (value) => {
+  const prototype = Object.getPrototypeOf(value);
+  return Array.isArray(value) || prototype === Object.prototype || prototype === null;
+};
+var jsonScalarVerdict = (value) => {
+  if (value === null || typeof value === "string" || typeof value === "boolean") {
+    return "ok";
+  }
+  if (typeof value === "number") {
+    return Number.isFinite(value) ? "ok" : "invalid";
+  }
+  if (value === void 0 || typeof value !== "object" || !isPlainContainer(value)) {
+    return "invalid";
+  }
+  return "container";
+};
+var isJsonValue = (root) => {
+  const stack = [root];
+  const seen = /* @__PURE__ */ new Set();
+  while (stack.length > 0) {
+    const value = stack.pop();
+    const verdict = jsonScalarVerdict(value);
+    if (verdict === "invalid") {
+      return false;
+    }
+    if (verdict === "ok" || seen.has(value)) {
+      continue;
+    }
+    seen.add(value);
+    if (Array.isArray(value) && Object.keys(value).length !== value.length) {
+      return false;
+    }
+    stack.push(...Object.values(value));
+  }
+  return true;
+};
+var truncate = (message) => {
+  return message.length <= MAX_TOOL_ERROR_MESSAGE_LENGTH ? message : message.slice(0, MAX_TOOL_ERROR_MESSAGE_LENGTH);
+};
+var checkResult = (result) => {
+  if (!isStructuredData(result.data)) {
+    return "not_structured";
+  }
+  if (result.data !== void 0 && !isJsonValue(result.data)) {
+    return "not_serializable";
+  }
+  let encoded;
+  try {
+    encoded = new TextEncoder().encode(JSON.stringify({ content: result.content, data: result.data ?? null }));
+  } catch {
+    return "not_serializable";
+  }
+  if (encoded.length > MAX_TOOL_RESULT_BYTES || !toolDataWithinLimits(result.data)) {
+    return "too_large";
+  }
+  return "ok";
+};
+var buildContext2 = (envelope, env) => {
+  const install = envelope.install;
+  const { variableKinds, appVariableKinds } = contextKindsOf(env);
+  const maps = parseVariableMaps(env);
+  const appScope = projectAppValues(env, appVariableKinds);
+  const { variables, secrets } = projectInstallValues(maps, variableKinds, install.ord);
+  return {
+    env,
+    site: envelope.site,
+    install: { id: install.id, label: install.label },
+    viewer: envelope.tool.viewer,
+    callId: envelope.tool.callId,
+    startWorkflow: buildStartWorkflow({ ord: install.ord, installId: install.id, installLabel: install.label, anonId: null }),
+    oauth: buildOauth(env, install.ord),
+    variables,
+    secrets,
+    appVariables: appScope.appVariables,
+    appSecrets: appScope.appSecrets,
+    observability: buildObservability(install.ord),
+    apps: buildAppsClient(env, { depth: 0 }),
+    fail: (message) => {
+      return { kind: "tool_error", message: truncate(message) };
+    }
+  };
+};
+var dispatchTool = async (envelope, bundle, env) => {
+  const name = envelope.tool.name;
+  const tools = bundle.tools;
+  const handler = tools !== void 0 && Object.hasOwn(tools, name) ? tools[name] : void 0;
+  if (typeof handler !== "function") {
+    return failure(`missing handler: tools.${name}`);
+  }
+  setSpanAttributes({ "app.tool": name, "app.tool_call_id": envelope.tool.callId });
+  let value;
+  try {
+    value = await installSpan(envelope.install, () => {
+      return handler(envelope.tool.arguments, buildContext2(envelope, env));
+    });
+  } catch (error51) {
+    console.warn(`tool ${name} failed for install ${envelope.install.id}: ${failureMessage(error51)}`);
+    return failure(`tool ${name} failed`);
+  }
+  if (isFailure(value)) {
+    return json2(200, { v: CONTROL_ENVELOPE_VERSION, ok: true, tool: { content: truncate(value.message), failed: true } });
+  }
+  if (!isResult(value)) {
+    return failure(`tool ${name} returned no result`);
+  }
+  const verdict = checkResult(value);
+  if (verdict === "not_structured") {
+    return failure(`tool ${name} returned data that is not a JSON object`);
+  }
+  if (verdict === "not_serializable") {
+    return failure(`tool ${name} returned data that cannot be serialized`);
+  }
+  if (verdict === "too_large") {
+    return failure(`tool ${name} returned a result over the size cap`);
+  }
+  return json2(200, {
+    v: CONTROL_ENVELOPE_VERSION,
+    ok: true,
+    tool: { content: value.content, ...value.data === void 0 ? {} : { data: value.data }, failed: false }
+  });
+};
+
 // src/control.ts
 var controlError = (status, message) => {
   return json2(status, { v: CONTROL_ENVELOPE_VERSION, ok: false, error: { message } });
@@ -16378,6 +16577,9 @@ var dispatchControl = async ({ request, env, versions }) => {
     case "schedule": {
       return dispatchSchedule(envelope, bundle, env);
     }
+    case "tool": {
+      return dispatchTool(envelope, bundle, env);
+    }
   }
 };
 
@@ -16410,7 +16612,7 @@ var handlerRequest = (request, context, body) => {
     body: body.byteLength === 0 ? void 0 : body
   });
 };
-var buildContext2 = ({ env, maps, kinds, appScope, install, site, params }) => {
+var buildContext3 = ({ env, maps, kinds, appScope, install, site, params }) => {
   const { variables, secrets } = projectInstallValues(maps, kinds, install.ord);
   return {
     env,
@@ -16502,7 +16704,7 @@ var dispatchEndpoint = async ({ request, env, versions }) => {
     return installSpan(install, () => {
       return handler(
         handlerRequest(request, context, body),
-        buildContext2({ env, maps, kinds: variableKinds, appScope, install, site: context.site, params: context.params })
+        buildContext3({ env, maps, kinds: variableKinds, appScope, install, site: context.site, params: context.params })
       );
     });
   };
@@ -16788,7 +16990,7 @@ var runInstalls = async (envelope, env, invoke) => {
   const { variableKinds: kinds, appVariableKinds } = contextKindsOf(env);
   const appScope = projectAppValues(env, appVariableKinds);
   const groups = [];
-  let failure;
+  let failure2;
   for (const install of envelope.installs) {
     const emits = [];
     const pushes = [];
@@ -16802,7 +17004,7 @@ var runInstalls = async (envelope, env, invoke) => {
     } catch (error51) {
       const message = failureMessage(error51);
       console.warn(`app hook failed for install ${install.id}: ${message}`);
-      failure ??= message;
+      failure2 ??= message;
       continue;
     }
     const contextWrites = context.writes();
@@ -16814,8 +17016,8 @@ var runInstalls = async (envelope, env, invoke) => {
   if (groups.length > 0) {
     body.effects = groups;
   }
-  if (failure !== void 0) {
-    body.error = { message: failure };
+  if (failure2 !== void 0) {
+    body.error = { message: failure2 };
   }
   return json2(200, body);
 };

package/dist/worker-artifact/main/index.js

@@ -739,6 +739,10 @@ var MAX_APPS_Q_BYTES = 4 * 1024 * 1024;
 // ../../libs/app-manifest/src/cron.ts
 var MAX_CRON_LENGTH = 128;
 
+// ../../libs/app-manifest/src/tool-names.ts
+var MAX_APP_TOOL_NAME_LENGTH = 32;
+var APP_TOOL_NAME_PATTERN = /^[a-zA-Z][a-zA-Z0-9_]*$/;
+
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 var external_exports = {};
 __export(external_exports, {
@@ -15853,6 +15857,12 @@ var validateEnvelopeResponse = /* @__PURE__ */ __name((raw2, installCount) => {
 var CONTROL_ENVELOPE_VERSION = 1;
 var MAX_CONTROL_BYTES = 256 * 1024;
 var MAX_MIGRATION_CHECKPOINT_BYTES = 16 * 1024;
+var MAX_TOOL_ARGUMENTS_BYTES = 32 * 1024;
+var MAX_TOOL_RESULT_BYTES = 64 * 1024;
+var MAX_TOOL_DATA_DEPTH = 8;
+var MAX_TOOL_DATA_NODES = 5e3;
+var CONTROL_FORWARD_TIMEOUT_MS = 1e4;
+var CONTROL_TOOL_FORWARD_TIMEOUT_MS = 5e4;
 var installSchema2 = external_exports.object({
   id: external_exports.string().min(1).max(64),
   ord: external_exports.number().int().min(1),
@@ -15926,15 +15936,32 @@ var scheduleSchema = external_exports.object({
     }).strict()
   ).min(1).max(MAX_INSTALLS_PER_APP)
 }).strict();
+var toolSchema = external_exports.object({
+  // The manifest's tools[].name, never the `<slug>_` composed MCP name: the slug is already in
+  // `app.slug`, and carrying it twice would give the app worker two sources for one fact.
+  name: external_exports.string().min(1).max(MAX_APP_TOOL_NAME_LENGTH).regex(APP_TOOL_NAME_PATTERN),
+  // Who asked, and what they may do on this site. Derived from the bearer by the portal, never
+  // from the model's arguments.
+  viewer: external_exports.object({ userId: external_exports.string().min(1).max(64), access: external_exports.enum(["read", "write"]) }).strict(),
+  // Already validated against the tool's declared inputSchema, with the reserved routing names
+  // stripped. Every declared input schema has an object root, so this is an object too — and a
+  // call that names no arguments normalizes to `{}` rather than reaching the handler as undefined.
+  arguments: external_exports.record(external_exports.string(), external_exports.unknown()).default({}),
+  // Stable across a collapsed retry, so an app can deduplicate its external effects on it.
+  callId: external_exports.string().min(1).max(64)
+}).strict().refine((tool) => {
+  return new TextEncoder().encode(JSON.stringify(tool.arguments)).length <= MAX_TOOL_ARGUMENTS_BYTES;
+}, "Tool arguments exceed the size cap");
 var controlEnvelopeSchema = external_exports.object({
   v: external_exports.literal(CONTROL_ENVELOPE_VERSION),
-  kind: external_exports.enum(["noop", "lifecycle", "migration", "schedule"]),
+  kind: external_exports.enum(["noop", "lifecycle", "migration", "schedule", "tool"]),
   site: external_exports.object({ origin: external_exports.string().min(1).max(255) }).strict(),
   app: external_exports.object({ slug: external_exports.string().min(1).max(30), version: external_exports.string().min(1).max(32) }).strict(),
   install: external_exports.object({ id: external_exports.string().min(1).max(64), ord: external_exports.number().int().min(1), label: external_exports.string().max(100) }).strict().optional(),
   lifecycle: lifecycleEventSchema.optional(),
   migration: migrationSchema.optional(),
-  schedule: scheduleSchema.optional()
+  schedule: scheduleSchema.optional(),
+  tool: toolSchema.optional()
 }).strict().superRefine((envelope, ctx) => {
   if (envelope.kind === "lifecycle" !== (envelope.lifecycle !== void 0)) {
     ctx.addIssue({ code: "custom", path: ["lifecycle"], message: "Lifecycle payload must match the control kind" });
@@ -15945,13 +15972,50 @@ var controlEnvelopeSchema = external_exports.object({
   if (envelope.kind === "schedule" !== (envelope.schedule !== void 0)) {
     ctx.addIssue({ code: "custom", path: ["schedule"], message: "Schedule payload must match the control kind" });
   }
+  if (envelope.kind === "tool" !== (envelope.tool !== void 0)) {
+    ctx.addIssue({ code: "custom", path: ["tool"], message: "Tool payload must match the control kind" });
+  }
   if (envelope.kind === "lifecycle" && envelope.install === void 0) {
     ctx.addIssue({ code: "custom", path: ["install"], message: "Lifecycle control needs an install" });
   }
+  if (envelope.kind === "tool" && envelope.install === void 0) {
+    ctx.addIssue({ code: "custom", path: ["install"], message: "Tool control needs an install" });
+  }
 });
+var toolDataWithinLimits = /* @__PURE__ */ __name((value) => {
+  const stack = [{ value, depth: 0 }];
+  let seen = 0;
+  while (stack.length > 0) {
+    const next = stack.pop();
+    seen += 1;
+    if (next.depth > MAX_TOOL_DATA_DEPTH || seen > MAX_TOOL_DATA_NODES) {
+      return false;
+    }
+    if (next.value !== null && typeof next.value === "object") {
+      for (const child of Object.values(next.value)) {
+        stack.push({ value: child, depth: next.depth + 1 });
+      }
+    }
+  }
+  return true;
+}, "toolDataWithinLimits");
+var toolResultSchema = external_exports.object({
+  content: external_exports.string().max(MAX_TOOL_RESULT_BYTES),
+  // MCP defines `structuredContent` as an object, so a bare scalar or array is refused here rather
+  // than surfacing as a protocol error at the client.
+  data: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
+  // True when the handler chose to fail with `ctx.fail`: `content` is then the app's own message
+  // for the model. A thrown handler is `ok: false` with no `tool` at all.
+  failed: external_exports.boolean()
+}).strict().refine((result) => {
+  return toolDataWithinLimits(result.data);
+}, "Tool result nests too deeply or carries too many values").refine((result) => {
+  return new TextEncoder().encode(JSON.stringify({ content: result.content, data: result.data ?? null })).length <= MAX_TOOL_RESULT_BYTES;
+}, "Tool result exceeds the size cap");
 var controlResponseSchema = external_exports.object({
   v: external_exports.literal(CONTROL_ENVELOPE_VERSION),
   ok: external_exports.boolean(),
+  tool: toolResultSchema.optional(),
   migration: external_exports.union([
     external_exports.object({ done: external_exports.literal(true) }).strict(),
     external_exports.object({ done: external_exports.literal(false), checkpoint: external_exports.unknown() }).strict().refine((result) => {
@@ -19052,17 +19116,25 @@ var readableContext = /* @__PURE__ */ __name((own, shared) => {
 }, "readableContext");
 
 // src/apps/observability.ts
+var APP_ERROR_DATA_POINT_RESERVE = 50;
 var observabilityApp = /* @__PURE__ */ __name((slug, app2) => {
   return { slug, name: app2.name, version: app2.version };
 }, "observabilityApp");
 var createDataPointBudget = /* @__PURE__ */ __name(() => {
-  let spent = 0;
+  let events = 0;
+  let total = 0;
   return {
-    take: /* @__PURE__ */ __name(() => {
-      if (spent >= MAX_APP_DATA_POINTS_PER_INVOCATION) {
+    take: /* @__PURE__ */ __name((kind2) => {
+      if (total >= MAX_APP_DATA_POINTS_PER_INVOCATION) {
         return false;
       }
-      spent += 1;
+      if (kind2 === "event") {
+        if (events >= MAX_APP_DATA_POINTS_PER_INVOCATION - APP_ERROR_DATA_POINT_RESERVE) {
+          return false;
+        }
+        events += 1;
+      }
+      total += 1;
       return true;
     }, "take")
   };
@@ -19085,43 +19157,71 @@ var errorBlobs = /* @__PURE__ */ __name((app2, install, record2, rowId) => {
 var eventBlobs = /* @__PURE__ */ __name((app2, install, record2) => {
   return [app2.slug, app2.name, install.id, install.label, app2.version, record2.name, record2.status];
 }, "eventBlobs");
-var writeAppObservability = /* @__PURE__ */ __name((env, response, target) => {
-  const record2 = parseAppObservability(response.headers.get(APP_OBSERVABILITY_HEADER));
-  if (record2 === null) {
-    return;
-  }
-  const byOrd = new Map(
-    target.installs.map((install) => {
-      return [install.ord, install];
-    })
-  );
-  for (const event of record2.events) {
+var writeEvents = /* @__PURE__ */ __name((env, target, byOrd, events) => {
+  for (const [index, event] of events.entries()) {
     const install = byOrd.get(event.ord);
     if (install === void 0) {
       addSpanEvent("app observability names an install the site did not send", { level: "warn", attrs: { app: target.app.slug } });
       continue;
     }
-    if (!target.budget.take()) {
-      addSpanEvent("app observability dropped at the data-point cap", { level: "warn", attrs: { app: target.app.slug } });
-      return;
+    if (!target.budget.take("event")) {
+      addSpanEvent("app observability dropped events at the data-point cap", {
+        level: "warn",
+        attrs: { app: target.app.slug, skipped: events.length - index }
+      });
+      break;
     }
     env.APP_EVENTS.writeDataPoint({ indexes: [`${install.id}:${event.status}`], blobs: eventBlobs(target.app, install, event) });
   }
-  for (const saved of record2.errors) {
+}, "writeEvents");
+var writeErrors = /* @__PURE__ */ __name((env, target, byOrd, errors) => {
+  for (const [index, saved] of errors.entries()) {
     const install = byOrd.get(saved.ord);
     if (install === void 0) {
       addSpanEvent("app observability names an install the site did not send", { level: "warn", attrs: { app: target.app.slug } });
       continue;
     }
-    if (!target.budget.take()) {
-      addSpanEvent("app observability dropped at the data-point cap", { level: "warn", attrs: { app: target.app.slug } });
-      return;
+    if (!target.budget.take("error")) {
+      addSpanEvent("app observability dropped saved errors at the data-point cap", {
+        level: "warn",
+        attrs: { app: target.app.slug, skipped: errors.length - index }
+      });
+      break;
     }
     env.APP_ERRORS.writeDataPoint({
       indexes: [`${install.id}:${saved.category}`],
       blobs: errorBlobs(target.app, install, saved, ulid3())
     });
   }
+}, "writeErrors");
+var guarded = /* @__PURE__ */ __name((target, write) => {
+  try {
+    write();
+    return true;
+  } catch (error51) {
+    addSpanEvent("app observability write failed", { level: "warn", attrs: { app: target.app.slug, error: String(error51) } });
+    return false;
+  }
+}, "guarded");
+var writeAppObservability = /* @__PURE__ */ __name((env, response, target) => {
+  const record2 = parseAppObservability(response.headers.get(APP_OBSERVABILITY_HEADER));
+  if (record2 === null) {
+    return;
+  }
+  const byOrd = new Map(
+    target.installs.map((install) => {
+      return [install.ord, install];
+    })
+  );
+  const eventsWritten = guarded(target, () => {
+    writeEvents(env, target, byOrd, record2.events);
+  });
+  const errorsWritten = guarded(target, () => {
+    writeErrors(env, target, byOrd, record2.errors);
+  });
+  if (!eventsWritten || !errorsWritten) {
+    return;
+  }
   if (record2.truncated === true) {
     addSpanEvent("the app recorded more observability than one invocation carries", { level: "warn", attrs: { app: target.app.slug } });
   }
@@ -20128,7 +20228,9 @@ var handleControl = /* @__PURE__ */ __name(async (request, env) => {
     method: "POST",
     headers,
     body,
-    signal: AbortSignal.timeout(1e4)
+    // Strictly inside the portal's own deadline for the same kind, so a slow tool times out here
+    // first and the failure is attributable to the app worker rather than to the hop above it.
+    signal: AbortSignal.timeout(envelope.kind === "tool" ? CONTROL_TOOL_FORWARD_TIMEOUT_MS : CONTROL_FORWARD_TIMEOUT_MS)
   });
   adoptAppSpans(upstream);
   writeControlObservability(env, upstream, envelope);

package/dist/worker-artifact/version.json

@@ -1,8 +1,8 @@
 {
   "main": {
     "version": "0.1.0",
-    "gitSha": "66e1bc45acbe4891948cbb3851f3f43ce06abc84",
-    "builtAt": "2026-08-28T17:17:21.657Z",
+    "gitSha": "eccf5ef7a3b8ef9131bc38d28b66cc5a3add163b",
+    "builtAt": "2026-08-29T05:28:12.232Z",
     "compatibilityDate": "2026-06-23",
     "compatibilityFlags": [
       "nodejs_compat"
@@ -40,8 +40,8 @@
   },
   "app-runtime": {
     "version": "0.1.0",
-    "gitSha": "56a8b638b8c5712c5d9de6a9292d6a0dd0536653",
-    "builtAt": "2026-08-28T10:56:46.912Z",
+    "gitSha": "eccf5ef7a3b8ef9131bc38d28b66cc5a3add163b",
+    "builtAt": "2026-08-29T05:28:14.997Z",
     "compatibilityDate": "2026-06-23",
     "compatibilityFlags": [
       "nodejs_compat"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blotout/qinto-cli",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "type": "module",
   "description": "Qinto CLI: authenticate against the Qinto platform and operate it from the terminal or from an agent.",
   "repository": {