@domino-sdk/relay-runtime 0.1.0 → 0.2.0

package/dist/index.js

@@ -15283,7 +15283,7 @@ function createRelayClient(options) {
   }
   const submission = submissions(
     {
-      session: () => request("/v1/auth/session", sessionSchema.nullable()),
+      session: () => request("/v1/auth/session", sessionSchema2.nullable()),
       upload: (file2, action, session) => request("/v1/me/evidence", evidenceSchema, {
         method: "POST",
         headers: {
@@ -15334,7 +15334,7 @@ function createRelayClient(options) {
           throw new Error("There is no failed attempt to retry.");
         const session = await request(
           "/v1/auth/session",
-          sessionSchema.nullable()
+          sessionSchema2.nullable()
         );
         if (session?.principal.kind !== "member")
           throw new Error("Sign in to retry verification.");
@@ -15358,7 +15358,7 @@ function createRelayClient(options) {
       observe: (listener, options2) => {
         const observer = observeProgress(
           {
-            session: (signal2) => request("/v1/auth/session", sessionSchema.nullable(), { signal: signal2 }),
+            session: (signal2) => request("/v1/auth/session", sessionSchema2.nullable(), { signal: signal2 }),
             progress: (session, signal2) => request("/v1/me/experience", questExperienceSchema, {
               signal: signal2,
               headers: { "X-Relay-Session": session }
@@ -15418,7 +15418,7 @@ function createRelayClient(options) {
       emailVerify: (challenge, code) => changeSession(
         () => request(
           "/v1/auth/email/verify",
-          sessionSchema,
+          sessionSchema2,
           json3({ challenge, code })
         )
       ),
@@ -15432,9 +15432,9 @@ function createRelayClient(options) {
           })
         )
       ),
-      session: () => request("/v1/auth/session", sessionSchema.nullable()),
+      session: () => request("/v1/auth/session", sessionSchema2.nullable()),
       demoSignIn: (code) => changeSession(
-        () => request("/v1/auth/demo", sessionSchema, json3({ code }))
+        () => request("/v1/auth/demo", sessionSchema2, json3({ code }))
       ),
       signOut: () => changeSession(
         () => request("/v1/auth/logout", external_exports.object({ ok: external_exports.boolean() }), json3({}))
@@ -15445,7 +15445,7 @@ function createRelayClient(options) {
       observeProgress: (listener, options2) => {
         const observer = observeProgress(
           {
-            session: (signal2) => request("/v1/auth/session", sessionSchema.nullable(), { signal: signal2 }),
+            session: (signal2) => request("/v1/auth/session", sessionSchema2.nullable(), { signal: signal2 }),
             progress: (session, signal2) => request("/v1/me/progress", memberProgressSchema, {
               signal: signal2,
               headers: { "X-Relay-Session": session }
@@ -15543,7 +15543,7 @@ function createRelayClient(options) {
     decide: (id2, input) => request(`/v1/attempts/${id2}/review`, attemptSchema, json3(input))
   };
 }
-var interactionSchema, questTypeVersionSchema, collectionSlotSchema, questCollectionSchema, questInstanceSchema, questDraftChangesSchema, draftBase, questDraftSchema, questCatalogSchema, catalogDeploymentSchema, catalogDeploymentPreviewSchema, saveQuestDraftSchema, publishQuestDraftSchema, questViewSchema, collectionViewSchema, questExperienceSchema, questPublicationPreviewSchema, RelayError, common, claimInputSchema, draftSchema, recordSchema, QuestUpdatedError, authScopeSchema, principalSchema, sessionSchema, exchangeSchema, exchangeResultSchema, solanaAddressSchema, walletConnectionSchema, walletChallengeInputSchema, walletChallengeSchema, walletProofSchema, solanaBalanceSchema, collectionCodeSchema, collectionPassSchema, collectionResolveSchema, collectionBeginSchema, collectionPreviewSchema, projectDeploymentSchema, deploymentPreviewSchema, publishDeploymentSchema, deploymentResultSchema;
+var interactionSchema, questTypeVersionSchema, collectionSlotSchema, questCollectionSchema, questInstanceSchema, questDraftChangesSchema, draftBase, questDraftSchema, questCatalogSchema, catalogDeploymentSchema, catalogDeploymentPreviewSchema, saveQuestDraftSchema, publishQuestDraftSchema, questViewSchema, collectionViewSchema, questExperienceSchema, questPublicationPreviewSchema, RelayError, common, claimInputSchema, draftSchema, recordSchema, QuestUpdatedError, authScopeSchema, principalSchema, sessionSchema2, exchangeSchema, exchangeResultSchema, solanaAddressSchema, walletConnectionSchema, walletChallengeInputSchema, walletChallengeSchema, walletProofSchema, solanaBalanceSchema, collectionCodeSchema, collectionPassSchema, collectionResolveSchema, collectionBeginSchema, collectionPreviewSchema, projectDeploymentSchema, deploymentPreviewSchema, publishDeploymentSchema, deploymentResultSchema;
 var init_chunk_NC3UAP6T = __esm({
   "packages/sdk/dist/chunk-NC3UAP6T.js"() {
     "use strict";
@@ -15728,7 +15728,7 @@ var init_chunk_NC3UAP6T = __esm({
       external_exports.object({ kind: external_exports.literal("staff"), subject: identifier }).strict(),
       external_exports.object({ kind: external_exports.literal("operator"), subject: identifier }).strict()
     ]);
-    sessionSchema = authScopeSchema.extend({
+    sessionSchema2 = authScopeSchema.extend({
       id: identifier,
       principal: principalSchema,
       expiresAt: external_exports.number()
@@ -15739,7 +15739,7 @@ var init_chunk_NC3UAP6T = __esm({
     }).strict();
     exchangeResultSchema = external_exports.object({
       token: external_exports.string(),
-      session: sessionSchema
+      session: sessionSchema2
     });
     solanaAddressSchema = external_exports.string().min(32).max(44).regex(/^[1-9A-HJ-NP-Za-km-z]+$/);
     walletConnectionSchema = external_exports.object({
@@ -15891,7 +15891,7 @@ __export(dist_exports, {
   rewardKey: () => rewardKey,
   rewardSchema: () => rewardSchema,
   saveQuestDraftSchema: () => saveQuestDraftSchema,
-  sessionSchema: () => sessionSchema,
+  sessionSchema: () => sessionSchema2,
   settingFieldSchema: () => settingFieldSchema,
   settings: () => settings,
   settingsFieldsSchema: () => settingsFieldsSchema,
@@ -15919,6 +15919,367 @@ var init_dist = __esm({
   }
 });
 
+// packages/sdk/dist/portal-proxy.js
+async function proxyParticipant(request, upstream) {
+  const incoming = new URL(request.url);
+  const path = incoming.pathname.slice("/relay".length);
+  const allowed = incoming.pathname.startsWith("/relay/") && (/^\/v1\/auth\/(providers|connections|start|authorize|complete|session|logout|email\/start|email\/verify|callback\/(google|apple|x|discord))$/.test(
+    path
+  ) || /^\/v1\/me\/(progress|experience|attempts|evidence|pass|collection-pass|wallet(?:\/challenge|\/verify)?)$/.test(
+    path
+  ) || /^\/v1\/attempts\/[\w-]+(?:\/retry)?$/.test(path));
+  if (!allowed || !["GET", "POST"].includes(request.method))
+    return Response.json({ error: "Route not found" }, { status: 404 });
+  const target = new URL(upstream.baseUrl);
+  if (target.protocol !== "https:" || target.username || target.password || target.pathname !== "/" || target.search || target.hash)
+    return Response.json(
+      { error: "Participant API is not configured" },
+      { status: 503 }
+    );
+  target.pathname = path;
+  target.search = incoming.search;
+  const headers = new Headers();
+  for (const name of [
+    "Cookie",
+    "Origin",
+    "Content-Type",
+    "X-Relay-CSRF",
+    "X-Relay-Session",
+    "X-Relay-Upload-ID",
+    "CF-Connecting-IP"
+  ]) {
+    const value = request.headers.get(name);
+    if (value) headers.set(name, value);
+  }
+  const response = await upstream.fetch(target, {
+    method: request.method,
+    headers,
+    body: request.method === "GET" ? void 0 : await request.arrayBuffer(),
+    redirect: "manual"
+  });
+  const resultHeaders = new Headers(response.headers);
+  resultHeaders.set("Cache-Control", "no-store");
+  return new Response(response.body, {
+    status: response.status,
+    headers: resultHeaders
+  });
+}
+
+// apps/api/src/hosted-participant.ts
+init_zod();
+function hostedParticipantEnv(env, scope, origin) {
+  return {
+    ...env,
+    LOCAL_DEVELOPMENT: "false",
+    TEST_HOOKS: "false",
+    DEMO_AUTH: "false",
+    API_TOKEN: void 0,
+    AUTH_EMULATORS: void 0,
+    AUTH_ORGANIZATION: scope.organization,
+    AUTH_PROJECT: scope.project,
+    AUTH_ENVIRONMENT: "test",
+    AUTH_ORIGINS: origin
+  };
+}
+async function registeredStagingScope(origin, env) {
+  const url2 = new URL(origin);
+  if (url2.protocol !== "https:" || url2.origin !== origin || !env.STAGING_DOMAIN)
+    return null;
+  const suffix = `.${env.STAGING_DOMAIN}`;
+  if (!url2.hostname.endsWith(suffix)) return null;
+  const name = url2.hostname.slice(0, -suffix.length);
+  if (!/^stage-[a-f0-9]{32}$/.test(name)) return null;
+  const raw = name.slice(6);
+  const id2 = `${raw.slice(0, 8)}-${raw.slice(8, 12)}-${raw.slice(12, 16)}-${raw.slice(16, 20)}-${raw.slice(20)}`;
+  const build = await env.MANAGEMENT.getByName("management-v1").activeBuild(id2);
+  return build?.runtime === "hosted-test" ? { organization: build.organization, project: build.project } : null;
+}
+async function callbackEnvironment(request, env) {
+  const url2 = new URL(request.url);
+  if (request.method !== "GET") return env;
+  const code = url2.pathname === "/v1/auth/authorize" ? url2.searchParams.get("code") : /^\/v1\/auth\/callback\/[a-z]+$/.test(url2.pathname) ? url2.searchParams.get("state") : null;
+  if (!code) return env;
+  const raw = await env.AUTH.getByName("auth-v1").readFlow(code);
+  if (!raw) return env;
+  const flow = external_exports.object({ origin: external_exports.string().url() }).safeParse(JSON.parse(raw));
+  if (!flow.success) return env;
+  const scope = await registeredStagingScope(flow.data.origin, env) ?? await registeredPreviewScope(flow.data.origin, env);
+  return scope ? hostedParticipantEnv(env, scope, flow.data.origin) : env;
+}
+
+// apps/api/src/development-preview.ts
+async function registeredPreviewScope(origin, env) {
+  const url2 = new URL(origin);
+  if (url2.protocol !== "https:" || url2.origin !== origin || !env.PREVIEW_DOMAIN || !env.PREVIEW_SESSIONS)
+    return null;
+  const suffix = `.${env.PREVIEW_DOMAIN}`;
+  if (!url2.hostname.endsWith(suffix)) return null;
+  const name = url2.hostname.slice(0, -suffix.length);
+  if (!/^[a-z0-9-]+-[a-f0-9]{32}$/.test(name)) return null;
+  const scope = await env.PREVIEW_SESSIONS.getByName(name.slice(-32)).resolve();
+  return scope?.hostname === url2.hostname ? scope : null;
+}
+async function developmentPreview(request, env, participant) {
+  const url2 = new URL(request.url);
+  const scope = await registeredPreviewScope(url2.origin, env);
+  if (!scope)
+    return new Response(
+      '<!doctype html><html lang="en"><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>Preview offline</title><body style="font:18px system-ui;max-width:38rem;margin:15vh auto;padding:24px"><h1>This preview is offline</h1><p>Ask its creator to start development again, or share a staged preview that stays online.</p><button onclick="location.reload()">Try again</button></body></html>',
+      {
+        status: 503,
+        headers: {
+          "Content-Type": "text/html; charset=utf-8",
+          "Cache-Control": "no-store",
+          "X-Robots-Tag": "noindex, nofollow"
+        }
+      }
+    );
+  if (url2.pathname.startsWith("/relay/"))
+    return proxyParticipant(request, {
+      baseUrl: "https://participant.internal",
+      fetch: (input, init) => participant(
+        new Request(input, init),
+        hostedParticipantEnv(env, scope, url2.origin)
+      )
+    });
+  if (url2.pathname === "/relay" || /^\/(management|__domino)(\/|$)/.test(url2.pathname))
+    return new Response("Not found", { status: 404 });
+  return new Response(null, {
+    status: 204,
+    headers: { "X-Domino-Preview-Origin": "allowed" }
+  });
+}
+
+// apps/api/src/preview-session.ts
+init_zod();
+import { DurableObject } from "cloudflare:workers";
+
+// apps/api/src/preview-tunnel.ts
+init_zod();
+var PreviewTunnel = class {
+  constructor(env) {
+    this.env = env;
+  }
+  async call(path, method = "GET", body) {
+    const response = await fetch(
+      `https://api.cloudflare.com/client/v4${path}`,
+      {
+        method,
+        headers: {
+          Authorization: `Bearer ${this.env.PREVIEW_CF_TOKEN}`,
+          "Content-Type": "application/json"
+        },
+        ...body === void 0 ? {} : { body: JSON.stringify(body) },
+        signal: AbortSignal.timeout(1e4)
+      }
+    );
+    if (response.status === 404 && method === "DELETE") return null;
+    if (!response.ok)
+      throw new Error(
+        `Preview infrastructure request failed (${response.status}). Contact a Domino operator.`
+      );
+    const result = external_exports.object({ success: external_exports.boolean(), result: external_exports.unknown() }).parse(await response.json());
+    if (!result.success)
+      throw new Error(
+        "Preview infrastructure request failed. Contact a Domino operator."
+      );
+    return result.result;
+  }
+  get base() {
+    return `/accounts/${this.env.PREVIEW_CF_ACCOUNT}/cfd_tunnel`;
+  }
+  async lookup(name) {
+    const tunnels = external_exports.array(external_exports.object({ id: external_exports.string().uuid() })).parse(
+      await this.call(
+        `${this.base}?name=${encodeURIComponent(name)}&is_deleted=false`
+      )
+    );
+    return tunnels[0]?.id ?? null;
+  }
+  async ensure(name, hostname3, port) {
+    const existing = external_exports.array(external_exports.object({ id: external_exports.string().uuid() })).parse(
+      await this.call(
+        `${this.base}?name=${encodeURIComponent(name)}&is_deleted=false`
+      )
+    );
+    const tunnel = existing[0] ?? external_exports.object({ id: external_exports.string().uuid() }).parse(
+      await this.call(this.base, "POST", {
+        name,
+        config_src: "cloudflare"
+      })
+    );
+    await this.call(`${this.base}/${tunnel.id}/configurations`, "PUT", {
+      config: {
+        ingress: [
+          {
+            hostname: hostname3,
+            service: `http://127.0.0.1:${port}`,
+            originRequest: { httpHostHeader: hostname3 }
+          },
+          { service: "http_status:404" }
+        ]
+      }
+    });
+    const dnsBase = `/zones/${this.env.PREVIEW_CF_ZONE}/dns_records`;
+    const records = external_exports.array(
+      external_exports.object({ id: external_exports.string(), type: external_exports.string(), content: external_exports.string() })
+    ).parse(
+      await this.call(`${dnsBase}?name=${encodeURIComponent(hostname3)}`)
+    );
+    const content = `${tunnel.id}.cfargotunnel.com`;
+    if (records.some(
+      (record2) => record2.type !== "CNAME" || record2.content !== content
+    ))
+      throw new Error(
+        "Preview hostname conflicts with an existing DNS record."
+      );
+    if (!records.length)
+      await this.call(dnsBase, "POST", {
+        type: "CNAME",
+        name: hostname3,
+        content,
+        proxied: true,
+        ttl: 1
+      });
+    return tunnel.id;
+  }
+  async token(id2) {
+    return external_exports.string().min(1).parse(await this.call(`${this.base}/${id2}/token`));
+  }
+  async remove(id2, hostname3) {
+    const base3 = `/zones/${this.env.PREVIEW_CF_ZONE}/dns_records`;
+    const records = external_exports.array(
+      external_exports.object({ id: external_exports.string(), type: external_exports.string(), content: external_exports.string() })
+    ).parse(await this.call(`${base3}?name=${encodeURIComponent(hostname3)}`));
+    for (const record2 of records) {
+      if (record2.type !== "CNAME" || record2.content !== `${id2}.cfargotunnel.com`)
+        throw new Error("Preview DNS ownership changed; cleanup stopped.");
+      await this.call(`${base3}/${record2.id}`, "DELETE");
+    }
+    await this.call(`${this.base}/${id2}`, "DELETE");
+  }
+  async revoke(id2) {
+    const secret = btoa(
+      String.fromCharCode(...crypto.getRandomValues(new Uint8Array(32)))
+    );
+    await this.call(`${this.base}/${id2}`, "PATCH", { tunnel_secret: secret });
+    await this.call(`${this.base}/${id2}/connections`, "DELETE");
+  }
+};
+function previewConfigurationIssues(env) {
+  return Object.entries({
+    PREVIEW_SESSIONS: env.PREVIEW_SESSIONS,
+    PREVIEW_DOMAIN: env.PREVIEW_DOMAIN,
+    PREVIEW_CF_TOKEN: env.PREVIEW_CF_TOKEN,
+    PREVIEW_CF_ACCOUNT: env.PREVIEW_CF_ACCOUNT,
+    PREVIEW_CF_ZONE: env.PREVIEW_CF_ZONE,
+    PREVIEW_TLS_READY: env.PREVIEW_TLS_READY === "true"
+  }).filter(([, value]) => !value).map(([key]) => key);
+}
+
+// apps/api/src/preview-session.ts
+var sessionSchema = external_exports.object({
+  organization: external_exports.string(),
+  project: external_exports.string(),
+  actor: external_exports.string(),
+  hostname: external_exports.string(),
+  generation: external_exports.string().uuid(),
+  port: external_exports.number().int().min(1).max(65535),
+  expiresAt: external_exports.number(),
+  tunnel: external_exports.string().uuid().nullable()
+});
+var leaseMs = 9e4;
+var PreviewSession = class extends DurableObject {
+  async read() {
+    const value = await this.ctx.storage.get("session");
+    return value ? sessionSchema.parse(value) : null;
+  }
+  async resolve() {
+    const session = await this.read();
+    return session && session.expiresAt > Date.now() && session.tunnel ? {
+      organization: session.organization,
+      project: session.project,
+      hostname: session.hostname
+    } : null;
+  }
+  async start(input) {
+    return this.ctx.blockConcurrencyWhile(async () => {
+      const old = await this.read();
+      if (old && old.expiresAt > Date.now() && old.generation !== input.generation)
+        return {
+          error: "This worktree already has a running preview. Stop it or wait 90 seconds for its lease to expire."
+        };
+      const provider = new PreviewTunnel(this.env);
+      const next = {
+        ...input,
+        expiresAt: 0,
+        tunnel: old?.tunnel ?? null
+      };
+      await this.ctx.storage.put("session", next);
+      await this.ctx.storage.setAlarm(Date.now() + leaseMs);
+      const tunnel = await provider.ensure(
+        `domino-${input.hostname.split(".")[0]}`,
+        input.hostname,
+        input.port
+      );
+      if (!old || old.generation !== input.generation || old.expiresAt <= Date.now())
+        await provider.revoke(tunnel);
+      const token = await provider.token(tunnel);
+      await this.ctx.storage.put("session", {
+        ...next,
+        tunnel,
+        expiresAt: Date.now() + leaseMs
+      });
+      await this.ctx.storage.delete("retireAt");
+      await this.ctx.storage.setAlarm(Date.now() + leaseMs);
+      return { url: `https://${input.hostname}`, token, leaseMs };
+    });
+  }
+  async heartbeat(generation) {
+    return this.ctx.blockConcurrencyWhile(async () => {
+      const session = await this.read();
+      if (!session || session.generation !== generation || session.expiresAt <= Date.now())
+        return false;
+      session.expiresAt = Date.now() + leaseMs;
+      await this.ctx.storage.put("session", session);
+      await this.ctx.storage.setAlarm(session.expiresAt);
+      return true;
+    });
+  }
+  async stop(generation) {
+    return this.ctx.blockConcurrencyWhile(async () => {
+      const session = await this.read();
+      if (!session || session.generation !== generation) return;
+      await this.ctx.storage.put("session", { ...session, expiresAt: 0 });
+      await this.ctx.storage.setAlarm(Date.now() + 1e3);
+    });
+  }
+  async alarm() {
+    await this.ctx.blockConcurrencyWhile(async () => {
+      const session = await this.read();
+      if (!session || session.expiresAt > Date.now()) return;
+      const provider = new PreviewTunnel(this.env);
+      const tunnel = session.tunnel ?? await provider.lookup(`domino-${session.hostname.split(".")[0]}`);
+      if (!tunnel) return;
+      await this.ctx.storage.put("session", { ...session, tunnel });
+      await provider.revoke(tunnel);
+      const retireAt = await this.ctx.storage.get("retireAt") ?? Date.now() + 7 * 864e5;
+      if (retireAt <= Date.now()) {
+        await provider.remove(tunnel, session.hostname);
+        await this.ctx.storage.put("session", {
+          ...session,
+          tunnel: null,
+          expiresAt: 0
+        });
+        await this.ctx.storage.delete("retireAt");
+      } else {
+        await this.ctx.storage.put("retireAt", retireAt);
+        await this.ctx.storage.setAlarm(retireAt);
+      }
+    });
+  }
+};
+
 // apps/api/src/index.ts
 import { WorkerEntrypoint as WorkerEntrypoint3 } from "cloudflare:workers";
 
@@ -15932,6 +16293,7 @@ init_zod();
 init_zod();
 init_dist();
 init_dist();
+init_zod();
 var repositorySchema = external_exports.object({
   id: external_exports.string().uuid(),
   organization: identifier,
@@ -15960,6 +16322,7 @@ var stageRequestSchema = external_exports.object({
   requestId: external_exports.string().uuid()
 }).strict();
 var buildIdentitySchema = external_exports.object({
+  runtime: external_exports.enum(["simulation", "hosted-test"]).default("simulation"),
   id: external_exports.string().uuid(),
   repository: external_exports.string().uuid(),
   organization: identifier,
@@ -16011,6 +16374,26 @@ var buildArtifactsSchema = external_exports.object({
   if (value.assets.reduce((sum, a) => sum + a.size, 0) > 1e7)
     ctx.addIssue({ code: "custom", message: "Staging assets exceed 10 MB" });
 });
+var developmentPreflightSchema = external_exports.object({
+  organization: external_exports.string(),
+  project: external_exports.string(),
+  environment: external_exports.enum(["test", "live"]),
+  staging: external_exports.enum(["configured", "blocked"]),
+  development: external_exports.object({
+    status: external_exports.enum(["configured", "blocked"]),
+    missing: external_exports.array(external_exports.string()),
+    authentication: external_exports.array(external_exports.string())
+  }),
+  checks: external_exports.array(
+    external_exports.object({
+      id: external_exports.string(),
+      status: external_exports.enum(["ok", "error"]),
+      message: external_exports.string(),
+      missing: external_exports.array(external_exports.string()).optional(),
+      issues: external_exports.array(external_exports.string()).optional()
+    })
+  )
+});
 var environmentSchema = external_exports.enum(["test", "live"]);
 var roleSchema = external_exports.enum(["editor", "reviewer", "staff"]);
 var permissionSchema = external_exports.enum([
@@ -16027,7 +16410,12 @@ var rolePermissions = {
   reviewer: ["read", "review"],
   staff: ["read", "confirm", "handover"]
 };
+var projectSetupSchema = external_exports.object({
+  mode: external_exports.enum(["new", "existing"]),
+  brief: external_exports.string().trim().min(1).max(4e3)
+}).strict();
 var projectSchema = external_exports.object({
+  setup: projectSetupSchema.optional(),
   id: external_exports.string().min(1),
   organization: identifier,
   project: identifier,
@@ -16038,7 +16426,11 @@ var projectSchema = external_exports.object({
   permissions: external_exports.array(permissionSchema),
   environments: external_exports.array(environmentSchema)
 });
-var projectInputSchema = external_exports.object({ project: identifier, name: external_exports.string().trim().min(1).max(80) }).strict();
+var projectInputSchema = external_exports.object({
+  project: identifier,
+  name: external_exports.string().trim().min(1).max(80),
+  setup: projectSetupSchema.optional()
+}).strict();
 var grantSchema = external_exports.object({
   subject: external_exports.string().min(1).max(200),
   roles: external_exports.array(roleSchema),
@@ -16181,52 +16573,6 @@ var tokenSchema = external_exports.object({
 // apps/api/src/staging.ts
 init_dist();
 
-// packages/sdk/dist/portal-proxy.js
-async function proxyParticipant(request, upstream) {
-  const incoming = new URL(request.url);
-  const path = incoming.pathname.slice("/relay".length);
-  const allowed = incoming.pathname.startsWith("/relay/") && (/^\/v1\/auth\/(providers|connections|start|authorize|complete|session|logout|email\/start|email\/verify|callback\/(google|apple|x|discord))$/.test(
-    path
-  ) || /^\/v1\/me\/(progress|experience|attempts|evidence|pass|collection-pass|wallet(?:\/challenge|\/verify)?)$/.test(
-    path
-  ) || /^\/v1\/attempts\/[\w-]+(?:\/retry)?$/.test(path));
-  if (!allowed || !["GET", "POST"].includes(request.method))
-    return Response.json({ error: "Route not found" }, { status: 404 });
-  const target = new URL(upstream.baseUrl);
-  if (target.protocol !== "https:" || target.username || target.password || target.pathname !== "/" || target.search || target.hash)
-    return Response.json(
-      { error: "Participant API is not configured" },
-      { status: 503 }
-    );
-  target.pathname = path;
-  target.search = incoming.search;
-  const headers = new Headers();
-  for (const name of [
-    "Cookie",
-    "Origin",
-    "Content-Type",
-    "X-Relay-CSRF",
-    "X-Relay-Session",
-    "X-Relay-Upload-ID",
-    "CF-Connecting-IP"
-  ]) {
-    const value = request.headers.get(name);
-    if (value) headers.set(name, value);
-  }
-  const response = await upstream.fetch(target, {
-    method: request.method,
-    headers,
-    body: request.method === "GET" ? void 0 : await request.arrayBuffer(),
-    redirect: "manual"
-  });
-  const resultHeaders = new Headers(response.headers);
-  resultHeaders.set("Cache-Control", "no-store");
-  return new Response(response.body, {
-    status: response.status,
-    headers: resultHeaders
-  });
-}
-
 // apps/api/src/quest-catalog.ts
 init_dist();
 
@@ -17048,7 +17394,7 @@ var ManagementReads = class {
 // apps/api/src/ledger.ts
 init_zod();
 init_dist();
-import { DurableObject } from "cloudflare:workers";
+import { DurableObject as DurableObject2 } from "cloudflare:workers";
 
 // apps/api/src/quest-graph.ts
 init_dist();
@@ -17391,7 +17737,7 @@ var esm_default2 = esm_default(ALPHABET);
 init_zod();
 init_dist();
 var storedWalletChallenge = walletChallengeSchema.extend({
-  session: sessionSchema,
+  session: sessionSchema2,
   origin: external_exports.string().url()
 });
 function solanaPublicKey(address) {
@@ -17507,7 +17853,7 @@ function json2(value) {
 function parse3(schema, data) {
   return schema.parse(JSON.parse(data));
 }
-var OrganizationLedger = class extends DurableObject {
+var OrganizationLedger = class extends DurableObject2 {
   sql;
   management;
   catalog;
@@ -20541,8 +20887,8 @@ async function profileFromStoredGrant(env, sealed, subject) {
 
 // apps/api/src/auth.ts
 init_dist();
-import { DurableObject as DurableObject2 } from "cloudflare:workers";
-var AuthStore = class extends DurableObject2 {
+import { DurableObject as DurableObject3 } from "cloudflare:workers";
+var AuthStore = class extends DurableObject3 {
   constructor(ctx, env) {
     super(ctx, env);
     ctx.storage.sql.exec(`CREATE TABLE IF NOT EXISTS identities (scope TEXT NOT NULL, issuer TEXT NOT NULL, subject TEXT NOT NULL, member TEXT NOT NULL, PRIMARY KEY(scope,issuer,subject));
@@ -20852,7 +21198,7 @@ var AuthStore = class extends DurableObject2 {
       id2,
       Date.now()
     ).toArray()[0];
-    return row ? sessionSchema.parse(JSON.parse(row.data)) : null;
+    return row ? sessionSchema2.parse(JSON.parse(row.data)) : null;
   }
   linkAccount(session, issuer, subject, provider, sealed, login, profile) {
     if (session.principal.kind !== "member")
@@ -20923,7 +21269,7 @@ var AuthStore = class extends DurableObject2 {
       await hash2(token),
       Date.now()
     ).toArray()[0];
-    return row ? sessionSchema.parse(JSON.parse(row.data)) : null;
+    return row ? sessionSchema2.parse(JSON.parse(row.data)) : null;
   }
   async revoke(token) {
     this.ctx.storage.sql.exec(
@@ -21195,33 +21541,32 @@ var HostingControl = class extends WorkerEntrypoint2 {
       const artifacts = buildArtifactsSchema.parse(await object2.json());
       const releases = batchReleaseSchema.parse(artifacts.quests);
       const catalog = catalogDeploymentSchema.omit({ expectedRevision: true }).parse(artifacts.catalog);
-      const ledger = this.env.STAGING_LEDGER.getByName(
-        JSON.stringify([build.organization, "test", previewProject(build.id)])
+      const ledger = (build.runtime === "hosted-test" ? this.env.LEDGER : this.env.STAGING_LEDGER).getByName(
+        JSON.stringify([
+          build.organization,
+          "test",
+          build.runtime === "hosted-test" ? build.project : previewProject(build.id)
+        ])
       );
       const headers = {
         "Content-Type": "application/json",
         "X-Relay-Actor": "management",
         "X-Relay-Actor-ID": build.actor
       };
-      if (releases.releases.length) {
-        const published = await ledger.fetch(
-          new Request("https://ledger/v1/releases/batch", {
-            method: "POST",
-            headers,
-            body: JSON.stringify(releases)
-          })
-        );
-        if (!published.ok) throw new Error(await published.text());
-      }
-      const current = await ledger.fetch(
-        new Request("https://ledger/management/v1/catalog", { headers })
+      const preview = await ledger.fetch(
+        new Request("https://ledger/management/v1/deployments/preview", {
+          method: "POST",
+          headers,
+          body: JSON.stringify({ ...releases, ...catalog })
+        })
       );
-      const { revision } = external_exports.object({ revision: external_exports.number() }).parse(await current.json());
+      if (!preview.ok) throw new Error(await preview.text());
+      const { id: id2 } = external_exports.object({ id: external_exports.string() }).parse(await preview.json());
       const deployed = await ledger.fetch(
-        new Request("https://ledger/management/v1/catalog/deploy", {
+        new Request("https://ledger/management/v1/deployments/publish", {
           method: "POST",
           headers,
-          body: JSON.stringify({ ...catalog, expectedRevision: revision })
+          body: JSON.stringify({ id: id2 })
         })
       );
       if (!deployed.ok) throw new Error(await deployed.text());
@@ -21250,6 +21595,15 @@ async function stagingRequest(request, env, participant) {
   if (!build || !env.STAGING_APPS || !env.STAGING_AUTH || !env.STAGING_LEDGER)
     return new Response("No staging build is ready yet", { status: 404 });
   if (url2.pathname.startsWith("/relay/")) {
+    if (build.runtime === "hosted-test") {
+      return proxyParticipant(request, {
+        baseUrl: "https://participant.internal",
+        fetch: (input, init) => participant(
+          new Request(input, init),
+          hostedParticipantEnv(env, build, url2.origin)
+        )
+      });
+    }
     if (url2.pathname.startsWith("/relay/v1/auth/") && !["/relay/v1/auth/session", "/relay/v1/auth/logout"].includes(
       url2.pathname
     ))
@@ -21332,7 +21686,7 @@ async function stagingRequest(request, env, participant) {
   return response.headers.get("Content-Type")?.includes("text/html") ? new HTMLRewriter().on("body", {
     element(element) {
       element.prepend(
-        '<aside style="position:sticky;top:0;z-index:99999;padding:10px;background:#fff3cd;color:#332701;text-align:center;font:14px system-ui">Staging preview \xB7 simulated participants \xB7 no live data</aside>',
+        '<aside style="position:sticky;top:0;z-index:99999;padding:10px;background:#fff3cd;color:#332701;text-align:center;font:14px system-ui">Staging preview \xB7 ' + (build.runtime === "hosted-test" ? "test data \xB7 real sign-in" : "simulated participants \xB7 no live data") + "</aside>",
         { html: true }
       );
     }
@@ -22594,6 +22948,24 @@ function localParticipantRequest(request, env) {
   return env.LOCAL_DEVELOPMENT === "true" && ["localhost", "127.0.0.1", "[::1]"].includes(new URL(request.url).hostname);
 }
 
+// apps/api/src/development-preflight.ts
+function stagingConfigurationIssues(env) {
+  const required2 = {
+    BUILDER: env.BUILDER,
+    HOSTING_ASSETS: env.HOSTING_ASSETS,
+    STAGING_DOMAIN: env.STAGING_DOMAIN,
+    STAGING_APPS: env.STAGING_APPS,
+    STAGING_AUTH: env.STAGING_AUTH,
+    STAGING_LEDGER: env.STAGING_LEDGER,
+    GITHUB_APP_ID: env.GITHUB_APP_ID,
+    GITHUB_APP_PRIVATE_KEY: env.GITHUB_APP_PRIVATE_KEY,
+    GITHUB_INSTALLATION_ID: env.GITHUB_INSTALLATION_ID,
+    GITHUB_REPOSITORY_OWNER: env.GITHUB_REPOSITORY_OWNER,
+    GIT_PUBLIC_URL: env.GIT_PUBLIC_URL
+  };
+  return Object.entries(required2).filter(([, value]) => !value).map(([key]) => key);
+}
+
 // apps/api/src/readiness.ts
 function launchReadiness(env, releases, scope) {
   const issues = productionParticipantIssues(env);
@@ -32352,6 +32724,128 @@ async function managementRoutes(request, env) {
     }
     if (!organization || !(await store.projects(organization)).some((p) => p.project === project))
       throw new AccessError("Project not found", 404);
+    if (path === "/development/session" && ["POST", "PUT", "DELETE"].includes(request.method)) {
+      requirePermission("publish");
+      if (environment !== "test")
+        throw new AccessError("Development requires the test environment", 422);
+      if (previewConfigurationIssues(env).length || !env.PREVIEW_SESSIONS || !env.PREVIEW_DOMAIN)
+        throw new AccessError(
+          "Shared development previews are not configured. A Domino operator must enable preview hosting. Use --offline only for isolated platform development.",
+          503
+        );
+      const input = external_exports.object({
+        workspace: external_exports.string().uuid(),
+        generation: external_exports.string().uuid(),
+        port: external_exports.number().int().min(1).max(65535).optional()
+      }).strict().parse(await request.json());
+      const id2 = (await hash2(
+        JSON.stringify([organization, project, actor, input.workspace])
+      )).slice(0, 32);
+      const session = env.PREVIEW_SESSIONS.getByName(id2);
+      if (request.method === "DELETE") {
+        await session.stop(input.generation);
+        return respond({ stopped: true });
+      }
+      if (request.method === "PUT") {
+        if (!await session.heartbeat(input.generation))
+          throw new AccessError(
+            "Preview lease expired. Restart domino dev.",
+            409
+          );
+        return respond({ renewed: true });
+      }
+      if (!input.port) throw new AccessError("An app port is required", 400);
+      if (!await env.AUTH.getByName("auth-v1").rateLimit(
+        `preview-start:${organization}:${actor}`,
+        10,
+        6e4
+      ))
+        throw new AccessError(
+          "Too many preview starts. Try again shortly.",
+          429
+        );
+      const hostname3 = `${project.toLowerCase().replace(/[^a-z0-9-]/g, "-").slice(0, 24)}-${id2}.${env.PREVIEW_DOMAIN}`;
+      const issues = productionParticipantIssues(
+        hostedParticipantEnv(
+          env,
+          { organization, project },
+          `https://${hostname3}`
+        )
+      );
+      if (issues.length)
+        throw new AccessError(
+          "Hosted test sign-in is not configured. A Domino operator must enable participant authentication.",
+          503
+        );
+      const result = await session.start({
+        organization,
+        project,
+        actor,
+        hostname: hostname3,
+        generation: input.generation,
+        port: input.port
+      });
+      if ("error" in result)
+        throw new AccessError(
+          result.error ?? "Preview is already running",
+          409
+        );
+      return respond(result);
+    }
+    if (path === "/preflight" && request.method === "GET") {
+      requirePermission("read");
+      const missing = stagingConfigurationIssues(env);
+      const repository = await store.repository(organization, project);
+      const authIssues = productionParticipantIssues(
+        hostedParticipantEnv(
+          env,
+          { organization, project },
+          `https://preflight.${env.PREVIEW_DOMAIN ?? "preview.domino.run"}`
+        )
+      );
+      const checks = [
+        {
+          id: "hosted-test-auth",
+          status: authIssues.length ? "error" : "ok",
+          message: authIssues.length ? "A Domino operator must configure real participant sign-in." : "Real sign-in is configured; complete a sign-in to verify provider availability.",
+          issues: authIssues
+        },
+        {
+          id: "project-access",
+          status: "ok",
+          message: "Project access verified."
+        },
+        {
+          id: "publication",
+          status: permissions.includes("publish") ? "ok" : "error",
+          message: permissions.includes("publish") ? "Publication permission verified." : "Ask a project administrator for publication permission."
+        },
+        {
+          id: "cloud-builds",
+          status: missing.length ? "error" : "ok",
+          message: missing.length ? "A Domino operator must configure cloud hosting before this project can stage." : "Cloud hosting configuration is present. A successful build has not been verified.",
+          missing
+        },
+        {
+          id: "repository",
+          status: repository?.status === "ready" ? "ok" : "error",
+          message: repository?.status === "ready" ? "Hosted repository is ready." : "Create a hosted repository before staging."
+        }
+      ];
+      const developmentMissing = previewConfigurationIssues(env);
+      return respond({
+        organization,
+        project,
+        environment,
+        development: {
+          status: developmentMissing.length || authIssues.length ? "blocked" : "configured",
+          missing: developmentMissing,
+          authentication: authIssues
+        },
+        staging: checks.every((check2) => check2.status === "ok") ? "configured" : "blocked",
+        checks
+      });
+    }
     if (path === "/repository" && ["GET", "POST"].includes(request.method)) {
       requirePermission(request.method === "POST" ? "publish" : "read");
       const publicBase = env.GIT_PUBLIC_URL;
@@ -32367,15 +32861,45 @@ async function managementRoutes(request, env) {
         if (repo.status !== "ready") {
           if (!env.HOSTING_ASSETS)
             throw new AccessError("Starter storage is not configured", 503);
+          const active = await env.HOSTING_ASSETS.get(
+            "starters/campaign-current.json"
+          );
+          const pointer = active ? external_exports.object({
+            format: external_exports.literal(1),
+            key: external_exports.string().regex(/^starters\/campaign\/[a-f0-9]{64}\.json$/),
+            sha256: external_exports.string().regex(/^[a-f0-9]{64}$/)
+          }).parse(await active.json()) : null;
           const starter = await env.HOSTING_ASSETS.get(
-            "starters/campaign.json"
+            pointer?.key ?? "starters/campaign.json"
           );
           if (!starter)
             throw new AccessError(
               "Campaign starter has not been uploaded",
               503
             );
-          const files = starterFilesSchema.parse(await starter.json());
+          const contents = await starter.text();
+          if (pointer && await hash2(contents) !== pointer.sha256)
+            throw new AccessError(
+              "Starter integrity check failed. Contact a Domino operator.",
+              503
+            );
+          const files = starterFilesSchema.parse(JSON.parse(contents));
+          const setup = (await store.projects(organization)).find(
+            (item) => item.project === project
+          )?.setup;
+          if (setup) {
+            const brief = {
+              path: "CAMPAIGN.md",
+              encoding: "utf-8",
+              content: `# Project brief
+
+${setup.brief}
+`
+            };
+            const index = files.findIndex((file2) => file2.path === brief.path);
+            if (index < 0) files.push(brief);
+            else files[index] = brief;
+          }
           const github = new GitHubRepositories(env);
           const provider = await github.provision(repo.id);
           await github.seed(provider, files);
@@ -32403,12 +32927,26 @@ async function managementRoutes(request, env) {
           "Staging builds require the test environment",
           422
         );
-      if (!env.BUILDER || !env.HOSTING_ASSETS || !env.STAGING_DOMAIN)
-        throw new AccessError("Cloud builds are not configured", 503);
+      if (stagingConfigurationIssues(env).length || !env.BUILDER || !env.HOSTING_ASSETS)
+        throw new AccessError(
+          "Cloud builds are not configured. Run domino doctor --remote; a Domino operator must enable cloud hosting.",
+          503
+        );
       const repository = await store.repository(organization, project);
       if (!repository || repository.status !== "ready")
         throw new AccessError("Create a hosted repository first", 409);
       if (path === "/builds" && request.method === "POST") {
+        if (productionParticipantIssues(
+          hostedParticipantEnv(
+            env,
+            { organization, project },
+            `https://stage-${repository.id.replaceAll("-", "")}.${env.STAGING_DOMAIN}`
+          )
+        ).length)
+          throw new AccessError(
+            "Hosted test sign-in is not configured. Run domino doctor --remote before staging.",
+            503
+          );
         const input = stageRequestSchema.parse(await request.json());
         await new GitHubRepositories(env).verifyCommit(
           repository.provider,
@@ -32416,6 +32954,7 @@ async function managementRoutes(request, env) {
         );
         const build2 = await store.reserveBuild({
           id: input.requestId,
+          runtime: "hosted-test",
           repository: repository.id,
           organization,
           project,
@@ -32877,7 +33416,7 @@ async function deviceRoutes(request, env) {
 
 // apps/api/src/management-store.ts
 init_zod();
-import { DurableObject as DurableObject3 } from "cloudflare:workers";
+import { DurableObject as DurableObject4 } from "cloudflare:workers";
 var repositoryBase = external_exports.object({
   id: external_exports.string().uuid(),
   organization: external_exports.string(),
@@ -32893,11 +33432,12 @@ var repositoryRecord = external_exports.discriminatedUnion("status", [
     provider: githubRepositorySchema
   })
 ]);
-var ManagementStore = class extends DurableObject3 {
+var ManagementStore = class extends DurableObject4 {
   constructor(ctx, env) {
     super(ctx, env);
     ctx.storage.sql.exec(`
       CREATE TABLE IF NOT EXISTS projects (organization TEXT, project TEXT, name TEXT NOT NULL, PRIMARY KEY(organization,project));
+      CREATE TABLE IF NOT EXISTS project_setup (organization TEXT, project TEXT, data TEXT NOT NULL, PRIMARY KEY(organization,project));
       CREATE TABLE IF NOT EXISTS grants (organization TEXT, project TEXT, subject TEXT, data TEXT NOT NULL, PRIMARY KEY(organization,project,subject));
       DROP TABLE IF EXISTS tokens;
       CREATE TABLE IF NOT EXISTS audit (id INTEGER PRIMARY KEY AUTOINCREMENT, actor TEXT NOT NULL, organization TEXT NOT NULL, action TEXT NOT NULL, data TEXT NOT NULL, at INTEGER NOT NULL);
@@ -33160,12 +33700,14 @@ var ManagementStore = class extends DurableObject3 {
     return { total, audit };
   }
   projects(organization) {
-    return organization ? this.ctx.storage.sql.exec(
-      "SELECT * FROM projects WHERE organization=? ORDER BY name,project",
-      organization
-    ).toArray() : this.ctx.storage.sql.exec(
-      "SELECT * FROM projects ORDER BY organization,name,project"
-    ).toArray();
+    const query = "SELECT p.*,s.data AS setup FROM projects p LEFT JOIN project_setup s ON p.organization=s.organization AND p.project=s.project";
+    return this.ctx.storage.sql.exec(
+      query + (organization ? " WHERE p.organization=?" : "") + " ORDER BY p.name,p.project",
+      ...organization ? [organization] : []
+    ).toArray().map(({ setup, ...project }) => ({
+      ...project,
+      ...setup ? { setup: projectSetupSchema.parse(JSON.parse(setup)) } : {}
+    }));
   }
   create(organization, input, actor) {
     return this.ctx.storage.transactionSync(() => {
@@ -33173,7 +33715,7 @@ var ManagementStore = class extends DurableObject3 {
         (p) => p.project === input.project
       );
       if (existing) {
-        if (existing.name !== input.name)
+        if (existing.name !== input.name || input.setup && JSON.stringify(existing.setup) !== JSON.stringify(input.setup))
           throw new Error("Project ID is already in use");
         return existing;
       }
@@ -33183,6 +33725,13 @@ var ManagementStore = class extends DurableObject3 {
         input.project,
         input.name
       );
+      if (input.setup)
+        this.ctx.storage.sql.exec(
+          "INSERT INTO project_setup VALUES(?,?,?)",
+          organization,
+          input.project,
+          JSON.stringify(input.setup)
+        );
       this.audit(actor, organization, "project-created", input);
       return { organization, ...input };
     });
@@ -33263,6 +33812,7 @@ var photo_quest_default = { code: 'var Kd=Object.defineProperty;var ee=(e,r)=>{f
 
 // apps/api/src/auth-routes.ts
 init_zod();
+init_dist();
 
 // apps/api/src/oauth-routes.ts
 init_zod();
@@ -33281,7 +33831,7 @@ function authScope(env) {
 // apps/api/src/oauth-routes.ts
 var intentSchema = external_exports.discriminatedUnion("mode", [
   external_exports.object({ mode: external_exports.literal("sign-in"), scope: authScopeSchema }),
-  external_exports.object({ mode: external_exports.literal("connect"), session: sessionSchema })
+  external_exports.object({ mode: external_exports.literal("connect"), session: sessionSchema2 })
 ]);
 var returnSchema = external_exports.object({
   origin: external_exports.string().url(),
@@ -33559,6 +34109,8 @@ async function oauthRoutes(request, env, session) {
 
 // apps/api/src/auth-routes.ts
 var emailFlowSchema = external_exports.object({
+  scope: authScopeSchema,
+  origin: external_exports.string(),
   email: external_exports.string().email(),
   digest: external_exports.string(),
   binding: external_exports.string()
@@ -33602,6 +34154,8 @@ async function authRoutes(request, env, session) {
       id2,
       {
         email: email3,
+        scope: authScope(env),
+        origin: request.headers.get("Origin") ?? "",
         digest: await hash2(id2 + ":" + code),
         binding: await hash2(binding)
       },
@@ -33614,6 +34168,8 @@ async function authRoutes(request, env, session) {
         id2,
         JSON.stringify({
           email: email3,
+          scope: authScope(env),
+          origin: request.headers.get("Origin") ?? "",
           digest: await hash2(id2 + ":" + code),
           binding: await hash2(binding)
         })
@@ -33638,7 +34194,12 @@ async function authRoutes(request, env, session) {
     const raw = await auth.readFlow(challenge);
     if (!raw || !await auth.rateLimit("verify:" + challenge, 5, 6e5))
       return fail("Code expired or too many attempts. Request another.");
-    const flow = emailFlowSchema.parse(JSON.parse(raw));
+    const parsed = emailFlowSchema.safeParse(JSON.parse(raw));
+    if (!parsed.success) return fail("Code expired. Request another.");
+    const flow = parsed.data;
+    const scope = authScope(env);
+    if (flow.scope.organization !== scope.organization || flow.scope.project !== scope.project || flow.scope.environment !== scope.environment || flow.origin !== (request.headers.get("Origin") ?? ""))
+      return fail("Sign-in scope changed. Request another code.");
     if (flow.binding !== await hash2(cookie(request, "relay_auth_flow")) || flow.digest !== await hash2(challenge + ":" + code))
       return fail("Invalid code");
     if (!await auth.consumeFlow(challenge, raw))
@@ -34067,6 +34628,11 @@ var gateway = {
     }
   }
 };
+var PreviewGateway = class extends WorkerEntrypoint3 {
+  async fetch(request) {
+    return developmentPreview(request, this.env, gateway.fetch);
+  }
+};
 var StagingGateway = class extends WorkerEntrypoint3 {
   async fetch(request) {
     return await stagingRequest(request, this.env, gateway.fetch) ?? new Response("Staging not found", { status: 404 });
@@ -34074,7 +34640,10 @@ var StagingGateway = class extends WorkerEntrypoint3 {
 };
 var index_default = {
   async fetch(request, env) {
-    const response = await gateway.fetch(request, env);
+    const response = await gateway.fetch(
+      request,
+      await callbackEnvironment(request, env)
+    );
     const headers = new Headers(response.headers);
     headers.set("Cache-Control", "no-store");
     return new Response(response.body, { status: response.status, headers });
@@ -34086,6 +34655,8 @@ export {
   HostingControl,
   ManagementStore,
   OrganizationLedger,
+  PreviewGateway,
+  PreviewSession,
   StagingAuth,
   StagingGateway,
   StagingLedger,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@domino-sdk/relay-runtime",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "license": "UNLICENSED",
   "type": "module",
   "description": "Local development runtime for Domino Relay",

package/wrangler.jsonc

@@ -28,6 +28,10 @@
       {
         "name": "STAGING_AUTH",
         "class_name": "StagingAuth"
+      },
+      {
+        "name": "PREVIEW_SESSIONS",
+        "class_name": "PreviewSession"
       }
     ]
   },
@@ -56,12 +60,22 @@
         "StagingLedger",
         "StagingAuth"
       ]
+    },
+    {
+      "tag": "v5-preview-sessions",
+      "new_sqlite_classes": [
+        "PreviewSession"
+      ]
     }
   ],
   "r2_buckets": [
     {
       "binding": "EVIDENCE",
       "bucket_name": "domino-relay-evidence"
+    },
+    {
+      "binding": "HOSTING_ASSETS",
+      "bucket_name": "domino-relay-hosting-development"
     }
   ],
   "vars": {