@domino-sdk/relay-runtime 0.1.0 → 0.3.0

package/dist/index.js

@@ -14833,7 +14833,40 @@ var init_chunk_C2KOMNLG = __esm({
   }
 });
 
-// packages/sdk/dist/chunk-NC3UAP6T.js
+// packages/sdk/dist/chunk-6IXQRMGW.js
+var authScopeSchema, principalSchema, sessionSchema, exchangeSchema, exchangeResultSchema;
+var init_chunk_6IXQRMGW = __esm({
+  "packages/sdk/dist/chunk-6IXQRMGW.js"() {
+    "use strict";
+    init_chunk_C2KOMNLG();
+    init_zod();
+    authScopeSchema = external_exports.object({
+      organization: identifier,
+      project: identifier,
+      environment: external_exports.enum(["test", "live"])
+    }).strict();
+    principalSchema = external_exports.discriminatedUnion("kind", [
+      external_exports.object({ kind: external_exports.literal("member"), member: identifier }).strict(),
+      external_exports.object({ kind: external_exports.literal("staff"), subject: identifier }).strict(),
+      external_exports.object({ kind: external_exports.literal("operator"), subject: identifier }).strict()
+    ]);
+    sessionSchema = authScopeSchema.extend({
+      id: identifier,
+      principal: principalSchema,
+      expiresAt: external_exports.number()
+    });
+    exchangeSchema = authScopeSchema.extend({
+      identity: external_exports.object({ issuer: identifier, subject: external_exports.string().min(1).max(200) }).strict(),
+      role: external_exports.enum(["member", "staff", "operator"])
+    }).strict();
+    exchangeResultSchema = external_exports.object({
+      token: external_exports.string(),
+      session: sessionSchema
+    });
+  }
+});
+
+// packages/sdk/dist/chunk-L757OYXZ.js
 function questInteraction(trigger) {
   return trigger.kind === "automatic" ? "automatic" : trigger.actor === "staff" ? "staff" : trigger.input === "none" ? "claim" : trigger.input;
 }
@@ -15439,6 +15472,7 @@ function createRelayClient(options) {
       signOut: () => changeSession(
         () => request("/v1/auth/logout", external_exports.object({ ok: external_exports.boolean() }), json3({}))
       ),
+      /** Local development only. Existing hosted apps use createParticipantBackend from /portal-proxy. */
       exchange: (input) => request("/v1/auth/exchange", exchangeResultSchema, json3(input))
     },
     me: {
@@ -15543,10 +15577,11 @@ function createRelayClient(options) {
     decide: (id2, input) => request(`/v1/attempts/${id2}/review`, attemptSchema, json3(input))
   };
 }
-var interactionSchema, questTypeVersionSchema, collectionSlotSchema, questCollectionSchema, questInstanceSchema, questDraftChangesSchema, draftBase, questDraftSchema, questCatalogSchema, catalogDeploymentSchema, catalogDeploymentPreviewSchema, saveQuestDraftSchema, publishQuestDraftSchema, questViewSchema, collectionViewSchema, questExperienceSchema, questPublicationPreviewSchema, RelayError, common, claimInputSchema, draftSchema, recordSchema, QuestUpdatedError, authScopeSchema, principalSchema, sessionSchema, exchangeSchema, exchangeResultSchema, solanaAddressSchema, walletConnectionSchema, walletChallengeInputSchema, walletChallengeSchema, walletProofSchema, solanaBalanceSchema, collectionCodeSchema, collectionPassSchema, collectionResolveSchema, collectionBeginSchema, collectionPreviewSchema, projectDeploymentSchema, deploymentPreviewSchema, publishDeploymentSchema, deploymentResultSchema;
-var init_chunk_NC3UAP6T = __esm({
-  "packages/sdk/dist/chunk-NC3UAP6T.js"() {
+var interactionSchema, questTypeVersionSchema, collectionSlotSchema, questCollectionSchema, questInstanceSchema, questDraftChangesSchema, draftBase, questDraftSchema, questCatalogSchema, catalogDeploymentSchema, catalogDeploymentPreviewSchema, saveQuestDraftSchema, publishQuestDraftSchema, questViewSchema, collectionViewSchema, questExperienceSchema, questPublicationPreviewSchema, RelayError, common, claimInputSchema, draftSchema, recordSchema, QuestUpdatedError, solanaAddressSchema, walletConnectionSchema, walletChallengeInputSchema, walletChallengeSchema, walletProofSchema, solanaBalanceSchema, collectionCodeSchema, collectionPassSchema, collectionResolveSchema, collectionBeginSchema, collectionPreviewSchema, projectDeploymentSchema, deploymentPreviewSchema, publishDeploymentSchema, deploymentResultSchema, identityIntegrationInputSchema, identityIntegrationSchema, identityIntegrationSecretSchema, participantExchangeSchema;
+var init_chunk_L757OYXZ = __esm({
+  "packages/sdk/dist/chunk-L757OYXZ.js"() {
     "use strict";
+    init_chunk_6IXQRMGW();
     init_chunk_C2KOMNLG();
     init_zod();
     init_zod();
@@ -15718,29 +15753,6 @@ var init_chunk_NC3UAP6T = __esm({
       }
       draft;
     };
-    authScopeSchema = external_exports.object({
-      organization: identifier,
-      project: identifier,
-      environment: external_exports.enum(["test", "live"])
-    }).strict();
-    principalSchema = external_exports.discriminatedUnion("kind", [
-      external_exports.object({ kind: external_exports.literal("member"), member: identifier }).strict(),
-      external_exports.object({ kind: external_exports.literal("staff"), subject: identifier }).strict(),
-      external_exports.object({ kind: external_exports.literal("operator"), subject: identifier }).strict()
-    ]);
-    sessionSchema = authScopeSchema.extend({
-      id: identifier,
-      principal: principalSchema,
-      expiresAt: external_exports.number()
-    });
-    exchangeSchema = authScopeSchema.extend({
-      identity: external_exports.object({ issuer: identifier, subject: external_exports.string().min(1).max(200) }).strict(),
-      role: external_exports.enum(["member", "staff", "operator"])
-    }).strict();
-    exchangeResultSchema = external_exports.object({
-      token: external_exports.string(),
-      session: sessionSchema
-    });
     solanaAddressSchema = external_exports.string().min(32).max(44).regex(/^[1-9A-HJ-NP-Za-km-z]+$/);
     walletConnectionSchema = external_exports.object({
       chain: external_exports.literal("solana"),
@@ -15803,6 +15815,28 @@ var init_chunk_NC3UAP6T = __esm({
     deploymentResultSchema = deploymentPreviewSchema.extend({
       revision: external_exports.number().int().positive()
     });
+    identityIntegrationInputSchema = external_exports.object({
+      name: external_exports.string().trim().min(1).max(80),
+      origin: external_exports.string().url().refine((value) => {
+        const url2 = new URL(value);
+        return url2.protocol === "https:" && url2.origin === value;
+      }, "Use an exact HTTPS application origin")
+    }).strict();
+    identityIntegrationSchema = authScopeSchema.extend({
+      id: external_exports.string().uuid(),
+      name: external_exports.string(),
+      origin: external_exports.string(),
+      expiresAt: external_exports.number()
+    });
+    identityIntegrationSecretSchema = identityIntegrationSchema.extend(
+      {
+        token: external_exports.string()
+      }
+    );
+    participantExchangeSchema = external_exports.object({
+      subject: external_exports.string().min(1).max(200),
+      previousToken: external_exports.string().max(200).optional()
+    }).strict();
   }
 });
 
@@ -15839,12 +15873,16 @@ __export(dist_exports, {
   exchangeResultSchema: () => exchangeResultSchema,
   exchangeSchema: () => exchangeSchema,
   identifier: () => identifier,
+  identityIntegrationInputSchema: () => identityIntegrationInputSchema,
+  identityIntegrationSchema: () => identityIntegrationSchema,
+  identityIntegrationSecretSchema: () => identityIntegrationSecretSchema,
   interactionSchema: () => interactionSchema,
   mediaUrlSchema: () => mediaUrlSchema,
   memberListSchema: () => memberListSchema,
   memberPageSchema: () => memberPageSchema,
   memberProgressSchema: () => memberProgressSchema,
   parseSettings: () => parseSettings,
+  participantExchangeSchema: () => participantExchangeSchema,
   photoResultSchema: () => photoResultSchema,
   pickupAllocationSchema: () => pickupAllocationSchema,
   pickupAvailabilitySchema: () => pickupAvailabilitySchema,
@@ -15914,11 +15952,512 @@ __export(dist_exports, {
 var init_dist = __esm({
   "packages/sdk/dist/index.js"() {
     "use strict";
-    init_chunk_NC3UAP6T();
+    init_chunk_L757OYXZ();
+    init_chunk_6IXQRMGW();
     init_chunk_C2KOMNLG();
   }
 });
 
+// apps/api/src/identity-integration.ts
+init_zod();
+init_dist();
+
+// apps/api/src/access-error.ts
+var AccessError = class extends Error {
+  constructor(message2, status = 403) {
+    super(message2);
+    this.status = status;
+  }
+};
+
+// apps/api/src/auth-utils.ts
+function cookie(request, name) {
+  return request.headers.get("Cookie")?.split(";").map((value) => value.trim()).find((value) => value.startsWith(name + "="))?.slice(name.length + 1) ?? "";
+}
+function bindingCookie(value, secure, name = "relay_auth_flow") {
+  return `${name}=${value}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${value ? 600 : 0}${secure ? "; Secure" : ""}`;
+}
+async function hash2(value) {
+  const bytes = await crypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(value)
+  );
+  return Array.from(
+    new Uint8Array(bytes),
+    (b) => b.toString(16).padStart(2, "0")
+  ).join("");
+}
+function sessionToken(request) {
+  const bearer = request.headers.get("Authorization");
+  if (bearer) return bearer.startsWith("Bearer ") ? bearer.slice(7) : "";
+  return request.headers.get("Cookie")?.split(";").map((x) => x.trim()).find((x) => x.startsWith("relay_session="))?.slice("relay_session=".length) ?? "";
+}
+function sessionCookie(token, secure) {
+  return `relay_session=${token}; Path=/; HttpOnly; SameSite=Strict; Max-Age=${token ? 28800 : 0}${secure ? "; Secure" : ""}`;
+}
+function browserMutationAllowed(request, env) {
+  const origin = request.headers.get("Origin");
+  return request.headers.get("X-Relay-CSRF") === "1" && !!origin && (env.AUTH_ORIGINS ?? "").split(",").map((value) => value.trim()).includes(origin);
+}
+
+// apps/api/src/identity-integration.ts
+async function identityIntegrationRequest(request, env, participant) {
+  const path = new URL(request.url).pathname;
+  const key = request.headers.get("X-Relay-Integration-Key");
+  const exchange = path === "/v1/auth/exchange" && !(env.LOCAL_DEVELOPMENT === "true" && ["localhost", "127.0.0.1", "[::1]"].includes(
+    new URL(request.url).hostname
+  ) && !request.headers.get("Authorization")?.startsWith("Bearer di_"));
+  if (!exchange && !key) return null;
+  try {
+    const auth = env.AUTH.getByName("auth-v1");
+    if (exchange) {
+      if (request.method !== "POST")
+        return Response.json(
+          { error: "Use POST for identity exchange" },
+          { status: 405 }
+        );
+      const result = await auth.exchangeParticipant(
+        request.headers.get("Authorization")?.replace(/^Bearer /, "") ?? "",
+        participantExchangeSchema.parse(await request.json())
+      );
+      if (result.kind === "denied")
+        throw new AccessError(
+          "Use a valid identity integration server key from Console Settings. CLI and management credentials cannot issue participant sessions.",
+          401
+        );
+      if (result.kind === "limited")
+        throw new AccessError(
+          "Too many identity exchange requests. Retry shortly.",
+          429
+        );
+      return Response.json(result.result);
+    }
+    const integration = await auth.verifyIntegration(key ?? "");
+    if (!integration)
+      throw new AccessError(
+        "Identity integration key is invalid, expired, or revoked",
+        401
+      );
+    if (!/^\/v1\/(?:auth\/(?:session|logout|connections)|me\/(?:progress|experience|attempts|evidence|pass|collection-pass|wallet(?:\/challenge|\/verify)?)|attempts\/[\w-]+(?:\/retry)?)$/.test(
+      path
+    ))
+      return Response.json(
+        { error: "Route is not available through an identity integration" },
+        { status: 404 }
+      );
+    if (request.headers.get("Origin") !== integration.origin)
+      throw new AccessError(
+        "Application origin does not match the identity integration",
+        403
+      );
+    const session = await auth.integrationSession(
+      sessionToken(request),
+      integration.id
+    );
+    if (!session)
+      throw new AccessError(
+        "Participant session does not belong to this identity integration",
+        401
+      );
+    const headers = new Headers(request.headers);
+    headers.delete("X-Relay-Integration-Key");
+    return participant(
+      new Request(request, { headers }),
+      {
+        ...env,
+        LOCAL_DEVELOPMENT: "false",
+        TEST_HOOKS: "false",
+        DEMO_AUTH: "false",
+        AUTH_EMULATORS: void 0,
+        API_TOKEN: void 0,
+        AUTH_ORGANIZATION: integration.organization,
+        AUTH_PROJECT: integration.project,
+        AUTH_ENVIRONMENT: integration.environment,
+        AUTH_ORIGINS: integration.origin
+      },
+      integration.id
+    );
+  } catch (error48) {
+    if (error48 instanceof external_exports.ZodError || error48 instanceof SyntaxError)
+      return Response.json(
+        {
+          code: "INVALID_IDENTITY_EXCHANGE",
+          error: "Supply only a verified subject and optional previousToken"
+        },
+        { status: 400 }
+      );
+    if (error48 instanceof AccessError)
+      return Response.json(
+        { code: "IDENTITY_INTEGRATION_ACCESS_DENIED", error: error48.message },
+        { status: error48.status }
+      );
+    throw error48;
+  }
+}
+
+// packages/sdk/dist/portal-proxy.js
+init_chunk_6IXQRMGW();
+init_chunk_C2KOMNLG();
+async function proxyParticipant(request, upstream) {
+  const incoming = new URL(request.url);
+  const path = incoming.pathname.slice("/relay".length);
+  const allowed = incoming.pathname.startsWith("/relay/") && (/^\/v1\/auth\/(providers|connections|start|authorize|complete|session|logout|email\/start|email\/verify|callback\/(google|apple|x|discord))$/.test(
+    path
+  ) || /^\/v1\/me\/(progress|experience|attempts|evidence|pass|collection-pass|wallet(?:\/challenge|\/verify)?)$/.test(
+    path
+  ) || /^\/v1\/attempts\/[\w-]+(?:\/retry)?$/.test(path));
+  if (!allowed || !["GET", "POST"].includes(request.method))
+    return Response.json({ error: "Route not found" }, { status: 404 });
+  const target = new URL(upstream.baseUrl);
+  if (target.protocol !== "https:" || target.username || target.password || target.pathname !== "/" || target.search || target.hash)
+    return Response.json(
+      { error: "Participant API is not configured" },
+      { status: 503 }
+    );
+  target.pathname = path;
+  target.search = incoming.search;
+  const headers = new Headers();
+  for (const name of [
+    "Cookie",
+    "Origin",
+    "Content-Type",
+    "X-Relay-CSRF",
+    "X-Relay-Session",
+    "X-Relay-Upload-ID",
+    "CF-Connecting-IP"
+  ]) {
+    const value = request.headers.get(name);
+    if (value) headers.set(name, value);
+  }
+  const response = await upstream.fetch(target, {
+    method: request.method,
+    headers,
+    body: request.method === "GET" ? void 0 : await request.arrayBuffer(),
+    redirect: "manual"
+  });
+  const resultHeaders = new Headers(response.headers);
+  resultHeaders.set("Cache-Control", "no-store");
+  return new Response(response.body, {
+    status: response.status,
+    headers: resultHeaders
+  });
+}
+
+// apps/api/src/hosted-participant.ts
+init_zod();
+function hostedParticipantEnv(env, scope, origin) {
+  return {
+    ...env,
+    LOCAL_DEVELOPMENT: "false",
+    TEST_HOOKS: "false",
+    DEMO_AUTH: "false",
+    API_TOKEN: void 0,
+    AUTH_EMULATORS: void 0,
+    AUTH_ORGANIZATION: scope.organization,
+    AUTH_PROJECT: scope.project,
+    AUTH_ENVIRONMENT: "test",
+    AUTH_ORIGINS: origin
+  };
+}
+async function registeredStagingScope(origin, env) {
+  const url2 = new URL(origin);
+  if (url2.protocol !== "https:" || url2.origin !== origin || !env.STAGING_DOMAIN)
+    return null;
+  const suffix = `.${env.STAGING_DOMAIN}`;
+  if (!url2.hostname.endsWith(suffix)) return null;
+  const name = url2.hostname.slice(0, -suffix.length);
+  if (!/^stage-[a-f0-9]{32}$/.test(name)) return null;
+  const raw = name.slice(6);
+  const id2 = `${raw.slice(0, 8)}-${raw.slice(8, 12)}-${raw.slice(12, 16)}-${raw.slice(16, 20)}-${raw.slice(20)}`;
+  const build = await env.MANAGEMENT.getByName("management-v1").activeBuild(id2);
+  return build?.runtime === "hosted-test" ? { organization: build.organization, project: build.project } : null;
+}
+async function callbackEnvironment(request, env) {
+  const url2 = new URL(request.url);
+  if (request.method !== "GET") return env;
+  const code = url2.pathname === "/v1/auth/authorize" ? url2.searchParams.get("code") : /^\/v1\/auth\/callback\/[a-z]+$/.test(url2.pathname) ? url2.searchParams.get("state") : null;
+  if (!code) return env;
+  const raw = await env.AUTH.getByName("auth-v1").readFlow(code);
+  if (!raw) return env;
+  const flow = external_exports.object({ origin: external_exports.string().url() }).safeParse(JSON.parse(raw));
+  if (!flow.success) return env;
+  const scope = await registeredStagingScope(flow.data.origin, env) ?? await registeredPreviewScope(flow.data.origin, env);
+  return scope ? hostedParticipantEnv(env, scope, flow.data.origin) : env;
+}
+
+// apps/api/src/development-preview.ts
+async function registeredPreviewScope(origin, env) {
+  const url2 = new URL(origin);
+  if (url2.protocol !== "https:" || url2.origin !== origin || !env.PREVIEW_DOMAIN || !env.PREVIEW_SESSIONS)
+    return null;
+  const suffix = `.${env.PREVIEW_DOMAIN}`;
+  if (!url2.hostname.endsWith(suffix)) return null;
+  const name = url2.hostname.slice(0, -suffix.length);
+  if (!/^[a-z0-9-]+-[a-f0-9]{32}$/.test(name)) return null;
+  const scope = await env.PREVIEW_SESSIONS.getByName(name.slice(-32)).resolve();
+  return scope?.hostname === url2.hostname ? scope : null;
+}
+async function developmentPreview(request, env, participant) {
+  const url2 = new URL(request.url);
+  const scope = await registeredPreviewScope(url2.origin, env);
+  if (!scope)
+    return new Response(
+      '<!doctype html><html lang="en"><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>Preview offline</title><body style="font:18px system-ui;max-width:38rem;margin:15vh auto;padding:24px"><h1>This preview is offline</h1><p>Ask its creator to start development again, or share a staged preview that stays online.</p><button onclick="location.reload()">Try again</button></body></html>',
+      {
+        status: 503,
+        headers: {
+          "Content-Type": "text/html; charset=utf-8",
+          "Cache-Control": "no-store",
+          "X-Robots-Tag": "noindex, nofollow"
+        }
+      }
+    );
+  if (url2.pathname.startsWith("/relay/"))
+    return proxyParticipant(request, {
+      baseUrl: "https://participant.internal",
+      fetch: (input, init) => participant(
+        new Request(input, init),
+        hostedParticipantEnv(env, scope, url2.origin)
+      )
+    });
+  if (url2.pathname === "/relay" || /^\/(management|__domino)(\/|$)/.test(url2.pathname))
+    return new Response("Not found", { status: 404 });
+  return new Response(null, {
+    status: 204,
+    headers: { "X-Domino-Preview-Origin": "allowed" }
+  });
+}
+
+// apps/api/src/preview-session.ts
+init_zod();
+import { DurableObject } from "cloudflare:workers";
+
+// apps/api/src/preview-tunnel.ts
+init_zod();
+var PreviewTunnel = class {
+  constructor(env) {
+    this.env = env;
+  }
+  async call(path, method = "GET", body) {
+    const response = await fetch(
+      `https://api.cloudflare.com/client/v4${path}`,
+      {
+        method,
+        headers: {
+          Authorization: `Bearer ${this.env.PREVIEW_CF_TOKEN}`,
+          "Content-Type": "application/json"
+        },
+        ...body === void 0 ? {} : { body: JSON.stringify(body) },
+        signal: AbortSignal.timeout(1e4)
+      }
+    );
+    if (response.status === 404 && method === "DELETE") return null;
+    if (!response.ok)
+      throw new Error(
+        `Preview infrastructure request failed (${response.status}). Contact a Domino operator.`
+      );
+    const result = external_exports.object({ success: external_exports.boolean(), result: external_exports.unknown() }).parse(await response.json());
+    if (!result.success)
+      throw new Error(
+        "Preview infrastructure request failed. Contact a Domino operator."
+      );
+    return result.result;
+  }
+  get base() {
+    return `/accounts/${this.env.PREVIEW_CF_ACCOUNT}/cfd_tunnel`;
+  }
+  async lookup(name) {
+    const tunnels = external_exports.array(external_exports.object({ id: external_exports.string().uuid() })).parse(
+      await this.call(
+        `${this.base}?name=${encodeURIComponent(name)}&is_deleted=false`
+      )
+    );
+    return tunnels[0]?.id ?? null;
+  }
+  async ensure(name, hostname3, port) {
+    const existing = external_exports.array(external_exports.object({ id: external_exports.string().uuid() })).parse(
+      await this.call(
+        `${this.base}?name=${encodeURIComponent(name)}&is_deleted=false`
+      )
+    );
+    const tunnel = existing[0] ?? external_exports.object({ id: external_exports.string().uuid() }).parse(
+      await this.call(this.base, "POST", {
+        name,
+        config_src: "cloudflare"
+      })
+    );
+    await this.call(`${this.base}/${tunnel.id}/configurations`, "PUT", {
+      config: {
+        ingress: [
+          {
+            hostname: hostname3,
+            service: `http://127.0.0.1:${port}`,
+            originRequest: { httpHostHeader: hostname3 }
+          },
+          { service: "http_status:404" }
+        ]
+      }
+    });
+    const dnsBase = `/zones/${this.env.PREVIEW_CF_ZONE}/dns_records`;
+    const records = external_exports.array(
+      external_exports.object({ id: external_exports.string(), type: external_exports.string(), content: external_exports.string() })
+    ).parse(
+      await this.call(`${dnsBase}?name=${encodeURIComponent(hostname3)}`)
+    );
+    const content = `${tunnel.id}.cfargotunnel.com`;
+    if (records.some(
+      (record2) => record2.type !== "CNAME" || record2.content !== content
+    ))
+      throw new Error(
+        "Preview hostname conflicts with an existing DNS record."
+      );
+    if (!records.length)
+      await this.call(dnsBase, "POST", {
+        type: "CNAME",
+        name: hostname3,
+        content,
+        proxied: true,
+        ttl: 1
+      });
+    return tunnel.id;
+  }
+  async token(id2) {
+    return external_exports.string().min(1).parse(await this.call(`${this.base}/${id2}/token`));
+  }
+  async remove(id2, hostname3) {
+    const base3 = `/zones/${this.env.PREVIEW_CF_ZONE}/dns_records`;
+    const records = external_exports.array(
+      external_exports.object({ id: external_exports.string(), type: external_exports.string(), content: external_exports.string() })
+    ).parse(await this.call(`${base3}?name=${encodeURIComponent(hostname3)}`));
+    for (const record2 of records) {
+      if (record2.type !== "CNAME" || record2.content !== `${id2}.cfargotunnel.com`)
+        throw new Error("Preview DNS ownership changed; cleanup stopped.");
+      await this.call(`${base3}/${record2.id}`, "DELETE");
+    }
+    await this.call(`${this.base}/${id2}`, "DELETE");
+  }
+  async revoke(id2) {
+    const secret = btoa(
+      String.fromCharCode(...crypto.getRandomValues(new Uint8Array(32)))
+    );
+    await this.call(`${this.base}/${id2}`, "PATCH", { tunnel_secret: secret });
+    await this.call(`${this.base}/${id2}/connections`, "DELETE");
+  }
+};
+function previewConfigurationIssues(env) {
+  return Object.entries({
+    PREVIEW_SESSIONS: env.PREVIEW_SESSIONS,
+    PREVIEW_DOMAIN: env.PREVIEW_DOMAIN,
+    PREVIEW_CF_TOKEN: env.PREVIEW_CF_TOKEN,
+    PREVIEW_CF_ACCOUNT: env.PREVIEW_CF_ACCOUNT,
+    PREVIEW_CF_ZONE: env.PREVIEW_CF_ZONE,
+    PREVIEW_TLS_READY: env.PREVIEW_TLS_READY === "true"
+  }).filter(([, value]) => !value).map(([key]) => key);
+}
+
+// apps/api/src/preview-session.ts
+var sessionSchema2 = external_exports.object({
+  organization: external_exports.string(),
+  project: external_exports.string(),
+  actor: external_exports.string(),
+  hostname: external_exports.string(),
+  generation: external_exports.string().uuid(),
+  port: external_exports.number().int().min(1).max(65535),
+  expiresAt: external_exports.number(),
+  tunnel: external_exports.string().uuid().nullable()
+});
+var leaseMs = 9e4;
+var PreviewSession = class extends DurableObject {
+  async read() {
+    const value = await this.ctx.storage.get("session");
+    return value ? sessionSchema2.parse(value) : null;
+  }
+  async resolve() {
+    const session = await this.read();
+    return session && session.expiresAt > Date.now() && session.tunnel ? {
+      organization: session.organization,
+      project: session.project,
+      hostname: session.hostname
+    } : null;
+  }
+  async start(input) {
+    return this.ctx.blockConcurrencyWhile(async () => {
+      const old = await this.read();
+      if (old && old.expiresAt > Date.now() && old.generation !== input.generation)
+        return {
+          error: "This worktree already has a running preview. Stop it or wait 90 seconds for its lease to expire."
+        };
+      const provider = new PreviewTunnel(this.env);
+      const next = {
+        ...input,
+        expiresAt: 0,
+        tunnel: old?.tunnel ?? null
+      };
+      await this.ctx.storage.put("session", next);
+      await this.ctx.storage.setAlarm(Date.now() + leaseMs);
+      const tunnel = await provider.ensure(
+        `domino-${input.hostname.split(".")[0]}`,
+        input.hostname,
+        input.port
+      );
+      if (!old || old.generation !== input.generation || old.expiresAt <= Date.now())
+        await provider.revoke(tunnel);
+      const token = await provider.token(tunnel);
+      await this.ctx.storage.put("session", {
+        ...next,
+        tunnel,
+        expiresAt: Date.now() + leaseMs
+      });
+      await this.ctx.storage.delete("retireAt");
+      await this.ctx.storage.setAlarm(Date.now() + leaseMs);
+      return { url: `https://${input.hostname}`, token, leaseMs };
+    });
+  }
+  async heartbeat(generation) {
+    return this.ctx.blockConcurrencyWhile(async () => {
+      const session = await this.read();
+      if (!session || session.generation !== generation || session.expiresAt <= Date.now())
+        return false;
+      session.expiresAt = Date.now() + leaseMs;
+      await this.ctx.storage.put("session", session);
+      await this.ctx.storage.setAlarm(session.expiresAt);
+      return true;
+    });
+  }
+  async stop(generation) {
+    return this.ctx.blockConcurrencyWhile(async () => {
+      const session = await this.read();
+      if (!session || session.generation !== generation) return;
+      await this.ctx.storage.put("session", { ...session, expiresAt: 0 });
+      await this.ctx.storage.setAlarm(Date.now() + 1e3);
+    });
+  }
+  async alarm() {
+    await this.ctx.blockConcurrencyWhile(async () => {
+      const session = await this.read();
+      if (!session || session.expiresAt > Date.now()) return;
+      const provider = new PreviewTunnel(this.env);
+      const tunnel = session.tunnel ?? await provider.lookup(`domino-${session.hostname.split(".")[0]}`);
+      if (!tunnel) return;
+      await this.ctx.storage.put("session", { ...session, tunnel });
+      await provider.revoke(tunnel);
+      const retireAt = await this.ctx.storage.get("retireAt") ?? Date.now() + 7 * 864e5;
+      if (retireAt <= Date.now()) {
+        await provider.remove(tunnel, session.hostname);
+        await this.ctx.storage.put("session", {
+          ...session,
+          tunnel: null,
+          expiresAt: 0
+        });
+        await this.ctx.storage.delete("retireAt");
+      } else {
+        await this.ctx.storage.put("retireAt", retireAt);
+        await this.ctx.storage.setAlarm(retireAt);
+      }
+    });
+  }
+};
+
 // apps/api/src/index.ts
 import { WorkerEntrypoint as WorkerEntrypoint3 } from "cloudflare:workers";
 
@@ -15932,6 +16471,7 @@ init_zod();
 init_zod();
 init_dist();
 init_dist();
+init_zod();
 var repositorySchema = external_exports.object({
   id: external_exports.string().uuid(),
   organization: identifier,
@@ -15960,6 +16500,7 @@ var stageRequestSchema = external_exports.object({
   requestId: external_exports.string().uuid()
 }).strict();
 var buildIdentitySchema = external_exports.object({
+  runtime: external_exports.enum(["simulation", "hosted-test"]).default("simulation"),
   id: external_exports.string().uuid(),
   repository: external_exports.string().uuid(),
   organization: identifier,
@@ -16011,6 +16552,30 @@ var buildArtifactsSchema = external_exports.object({
   if (value.assets.reduce((sum, a) => sum + a.size, 0) > 1e7)
     ctx.addIssue({ code: "custom", message: "Staging assets exceed 10 MB" });
 });
+var developmentPreflightSchema = external_exports.object({
+  organization: external_exports.string(),
+  project: external_exports.string(),
+  environment: external_exports.enum(["test", "live"]),
+  identity: external_exports.object({
+    exchange: external_exports.literal("supported"),
+    activeIntegrations: external_exports.number().int().nonnegative()
+  }).optional(),
+  staging: external_exports.enum(["configured", "blocked"]),
+  development: external_exports.object({
+    status: external_exports.enum(["configured", "blocked"]),
+    missing: external_exports.array(external_exports.string()),
+    authentication: external_exports.array(external_exports.string())
+  }),
+  checks: external_exports.array(
+    external_exports.object({
+      id: external_exports.string(),
+      status: external_exports.enum(["ok", "error"]),
+      message: external_exports.string(),
+      missing: external_exports.array(external_exports.string()).optional(),
+      issues: external_exports.array(external_exports.string()).optional()
+    })
+  )
+});
 var environmentSchema = external_exports.enum(["test", "live"]);
 var roleSchema = external_exports.enum(["editor", "reviewer", "staff"]);
 var permissionSchema = external_exports.enum([
@@ -16027,7 +16592,12 @@ var rolePermissions = {
   reviewer: ["read", "review"],
   staff: ["read", "confirm", "handover"]
 };
+var projectSetupSchema = external_exports.object({
+  mode: external_exports.enum(["new", "existing"]),
+  brief: external_exports.string().trim().min(1).max(4e3)
+}).strict();
 var projectSchema = external_exports.object({
+  setup: projectSetupSchema.optional(),
   id: external_exports.string().min(1),
   organization: identifier,
   project: identifier,
@@ -16038,7 +16608,11 @@ var projectSchema = external_exports.object({
   permissions: external_exports.array(permissionSchema),
   environments: external_exports.array(environmentSchema)
 });
-var projectInputSchema = external_exports.object({ project: identifier, name: external_exports.string().trim().min(1).max(80) }).strict();
+var projectInputSchema = external_exports.object({
+  project: identifier,
+  name: external_exports.string().trim().min(1).max(80),
+  setup: projectSetupSchema.optional()
+}).strict();
 var grantSchema = external_exports.object({
   subject: external_exports.string().min(1).max(200),
   roles: external_exports.array(roleSchema),
@@ -16145,87 +16719,41 @@ var memberDetailSchema = external_exports.object({
   member: memberSchema,
   progress: memberProgressSchema,
   passes: external_exports.array(
-    external_exports.object({
-      provider: external_exports.string(),
-      event: external_exports.string(),
-      subject: external_exports.string(),
-      attempt: identifier.nullable()
-    })
-  ).default([]),
-  wallet: external_exports.object({
-    connection: walletConnectionSchema.nullable(),
-    observation: external_exports.object({ attempt: identifier, balance: solanaBalanceSchema }).nullable()
-  }).default({ connection: null, observation: null })
-});
-var stockInputSchema = external_exports.object({
-  item: identifier,
-  quantity: external_exports.number().int().positive().max(1e6),
-  actionId: identifier
-}).strict();
-var tokenInputSchema = external_exports.object({
-  name: external_exports.string().trim().min(1).max(80),
-  project: identifier,
-  environment: environmentSchema,
-  permissions: external_exports.array(permissionSchema).min(1),
-  days: external_exports.number().int().min(1).max(90).default(30)
-}).strict();
-var tokenSchema = external_exports.object({
-  id: external_exports.string(),
-  name: external_exports.string(),
-  project: external_exports.string(),
-  environment: environmentSchema,
-  permissions: external_exports.array(permissionSchema),
-  expiresAt: external_exports.number()
-});
-
-// apps/api/src/staging.ts
-init_dist();
-
-// packages/sdk/dist/portal-proxy.js
-async function proxyParticipant(request, upstream) {
-  const incoming = new URL(request.url);
-  const path = incoming.pathname.slice("/relay".length);
-  const allowed = incoming.pathname.startsWith("/relay/") && (/^\/v1\/auth\/(providers|connections|start|authorize|complete|session|logout|email\/start|email\/verify|callback\/(google|apple|x|discord))$/.test(
-    path
-  ) || /^\/v1\/me\/(progress|experience|attempts|evidence|pass|collection-pass|wallet(?:\/challenge|\/verify)?)$/.test(
-    path
-  ) || /^\/v1\/attempts\/[\w-]+(?:\/retry)?$/.test(path));
-  if (!allowed || !["GET", "POST"].includes(request.method))
-    return Response.json({ error: "Route not found" }, { status: 404 });
-  const target = new URL(upstream.baseUrl);
-  if (target.protocol !== "https:" || target.username || target.password || target.pathname !== "/" || target.search || target.hash)
-    return Response.json(
-      { error: "Participant API is not configured" },
-      { status: 503 }
-    );
-  target.pathname = path;
-  target.search = incoming.search;
-  const headers = new Headers();
-  for (const name of [
-    "Cookie",
-    "Origin",
-    "Content-Type",
-    "X-Relay-CSRF",
-    "X-Relay-Session",
-    "X-Relay-Upload-ID",
-    "CF-Connecting-IP"
-  ]) {
-    const value = request.headers.get(name);
-    if (value) headers.set(name, value);
-  }
-  const response = await upstream.fetch(target, {
-    method: request.method,
-    headers,
-    body: request.method === "GET" ? void 0 : await request.arrayBuffer(),
-    redirect: "manual"
-  });
-  const resultHeaders = new Headers(response.headers);
-  resultHeaders.set("Cache-Control", "no-store");
-  return new Response(response.body, {
-    status: response.status,
-    headers: resultHeaders
-  });
-}
+    external_exports.object({
+      provider: external_exports.string(),
+      event: external_exports.string(),
+      subject: external_exports.string(),
+      attempt: identifier.nullable()
+    })
+  ).default([]),
+  wallet: external_exports.object({
+    connection: walletConnectionSchema.nullable(),
+    observation: external_exports.object({ attempt: identifier, balance: solanaBalanceSchema }).nullable()
+  }).default({ connection: null, observation: null })
+});
+var stockInputSchema = external_exports.object({
+  item: identifier,
+  quantity: external_exports.number().int().positive().max(1e6),
+  actionId: identifier
+}).strict();
+var tokenInputSchema = external_exports.object({
+  name: external_exports.string().trim().min(1).max(80),
+  project: identifier,
+  environment: environmentSchema,
+  permissions: external_exports.array(permissionSchema).min(1),
+  days: external_exports.number().int().min(1).max(90).default(30)
+}).strict();
+var tokenSchema = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  project: external_exports.string(),
+  environment: environmentSchema,
+  permissions: external_exports.array(permissionSchema),
+  expiresAt: external_exports.number()
+});
+
+// apps/api/src/staging.ts
+init_dist();
 
 // apps/api/src/quest-catalog.ts
 init_dist();
@@ -17048,7 +17576,7 @@ var ManagementReads = class {
 // apps/api/src/ledger.ts
 init_zod();
 init_dist();
-import { DurableObject } from "cloudflare:workers";
+import { DurableObject as DurableObject2 } from "cloudflare:workers";
 
 // apps/api/src/quest-graph.ts
 init_dist();
@@ -17222,36 +17750,6 @@ function pageQuery(params) {
   return entries;
 }
 
-// apps/api/src/auth-utils.ts
-function cookie(request, name) {
-  return request.headers.get("Cookie")?.split(";").map((value) => value.trim()).find((value) => value.startsWith(name + "="))?.slice(name.length + 1) ?? "";
-}
-function bindingCookie(value, secure, name = "relay_auth_flow") {
-  return `${name}=${value}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${value ? 600 : 0}${secure ? "; Secure" : ""}`;
-}
-async function hash2(value) {
-  const bytes = await crypto.subtle.digest(
-    "SHA-256",
-    new TextEncoder().encode(value)
-  );
-  return Array.from(
-    new Uint8Array(bytes),
-    (b) => b.toString(16).padStart(2, "0")
-  ).join("");
-}
-function sessionToken(request) {
-  const bearer = request.headers.get("Authorization");
-  if (bearer) return bearer.startsWith("Bearer ") ? bearer.slice(7) : "";
-  return request.headers.get("Cookie")?.split(";").map((x) => x.trim()).find((x) => x.startsWith("relay_session="))?.slice("relay_session=".length) ?? "";
-}
-function sessionCookie(token, secure) {
-  return `relay_session=${token}; Path=/; HttpOnly; SameSite=Strict; Max-Age=${token ? 28800 : 0}${secure ? "; Secure" : ""}`;
-}
-function browserMutationAllowed(request, env) {
-  const origin = request.headers.get("Origin");
-  return request.headers.get("X-Relay-CSRF") === "1" && !!origin && (env.AUTH_ORIGINS ?? "").split(",").map((value) => value.trim()).includes(origin);
-}
-
 // node_modules/.pnpm/base-x@5.0.1/node_modules/base-x/src/esm/index.js
 function base2(ALPHABET2) {
   if (ALPHABET2.length >= 255) {
@@ -17507,7 +18005,7 @@ function json2(value) {
 function parse3(schema, data) {
   return schema.parse(JSON.parse(data));
 }
-var OrganizationLedger = class extends DurableObject {
+var OrganizationLedger = class extends DurableObject2 {
   sql;
   management;
   catalog;
@@ -19411,6 +19909,9 @@ var OrganizationLedger = class extends DurableObject {
   }
 };
 
+// apps/api/src/auth.ts
+init_dist();
+
 // apps/api/src/account-profile.ts
 init_zod();
 
@@ -20541,11 +21042,14 @@ async function profileFromStoredGrant(env, sealed, subject) {
 
 // apps/api/src/auth.ts
 init_dist();
-import { DurableObject as DurableObject2 } from "cloudflare:workers";
-var AuthStore = class extends DurableObject2 {
+import { DurableObject as DurableObject3 } from "cloudflare:workers";
+var AuthStore = class extends DurableObject3 {
   constructor(ctx, env) {
     super(ctx, env);
     ctx.storage.sql.exec(`CREATE TABLE IF NOT EXISTS identities (scope TEXT NOT NULL, issuer TEXT NOT NULL, subject TEXT NOT NULL, member TEXT NOT NULL, PRIMARY KEY(scope,issuer,subject));
+      CREATE TABLE IF NOT EXISTS identity_integrations (id TEXT PRIMARY KEY, secret TEXT NOT NULL, data TEXT NOT NULL);
+      CREATE TABLE IF NOT EXISTS integration_sessions (hash TEXT PRIMARY KEY, integration TEXT NOT NULL, subject TEXT NOT NULL);
+      CREATE TABLE IF NOT EXISTS integration_audit (actor TEXT NOT NULL, action TEXT NOT NULL, integration TEXT NOT NULL, at INTEGER NOT NULL);
       CREATE TABLE IF NOT EXISTS sessions (hash TEXT PRIMARY KEY, expires INTEGER NOT NULL, data TEXT NOT NULL);
       CREATE TABLE IF NOT EXISTS auth_flows (id TEXT PRIMARY KEY, expires INTEGER NOT NULL, data TEXT NOT NULL);
       CREATE TABLE IF NOT EXISTS connections (scope TEXT NOT NULL, issuer TEXT NOT NULL, subject TEXT NOT NULL, member TEXT NOT NULL, login INTEGER NOT NULL, provider TEXT NOT NULL, sealed TEXT NOT NULL, PRIMARY KEY(scope,issuer,subject));
@@ -20554,6 +21058,134 @@ var AuthStore = class extends DurableObject2 {
       CREATE TABLE IF NOT EXISTS wallet_challenges (id TEXT PRIMARY KEY, expires INTEGER NOT NULL, data TEXT NOT NULL, result TEXT);
       CREATE TABLE IF NOT EXISTS wallet_connections (scope TEXT NOT NULL, project TEXT NOT NULL, member TEXT NOT NULL, data TEXT NOT NULL, PRIMARY KEY(scope,project,member));`);
   }
+  integrations(scope) {
+    return this.ctx.storage.sql.exec("SELECT data FROM identity_integrations").toArray().map((row) => identityIntegrationSchema.parse(JSON.parse(row.data))).filter(
+      (item) => item.organization === scope.organization && item.project === scope.project && item.environment === scope.environment
+    );
+  }
+  async createIntegration(scope, input, actor) {
+    const record2 = identityIntegrationSchema.parse({
+      ...authScopeSchema.parse(scope),
+      ...identityIntegrationInputSchema.parse(input),
+      id: crypto.randomUUID(),
+      expiresAt: Date.now() + 90 * 864e5
+    });
+    const token = "di_" + crypto.randomUUID() + crypto.randomUUID();
+    const digest = await hash2(token);
+    this.ctx.storage.transactionSync(() => {
+      this.ctx.storage.sql.exec(
+        "INSERT INTO identity_integrations VALUES(?,?,?)",
+        record2.id,
+        digest,
+        JSON.stringify(record2)
+      );
+      this.ctx.storage.sql.exec(
+        "INSERT INTO integration_audit VALUES(?,?,?,?)",
+        actor,
+        "created",
+        record2.id,
+        Date.now()
+      );
+    });
+    return { ...record2, token };
+  }
+  async changeIntegration(scope, id2, actor, rotate) {
+    const token = "di_" + crypto.randomUUID() + crypto.randomUUID();
+    const digest = await hash2(token);
+    return this.ctx.storage.transactionSync(() => {
+      const record2 = this.integrations(scope).find((item) => item.id === id2);
+      if (!record2) return null;
+      this.ctx.storage.sql.exec(
+        "INSERT INTO integration_audit VALUES(?,?,?,?)",
+        actor,
+        rotate ? "rotated" : "revoked",
+        id2,
+        Date.now()
+      );
+      if (rotate) {
+        const next = { ...record2, expiresAt: Date.now() + 90 * 864e5 };
+        this.ctx.storage.sql.exec(
+          "UPDATE identity_integrations SET secret=?,data=? WHERE id=?",
+          digest,
+          JSON.stringify(next),
+          id2
+        );
+        return { ...next, token };
+      }
+      this.ctx.storage.sql.exec(
+        "DELETE FROM sessions WHERE hash IN (SELECT hash FROM integration_sessions WHERE integration=?)",
+        id2
+      );
+      this.ctx.storage.sql.exec(
+        "DELETE FROM integration_sessions WHERE integration=?",
+        id2
+      );
+      this.ctx.storage.sql.exec(
+        "DELETE FROM identity_integrations WHERE id=?",
+        id2
+      );
+      return null;
+    });
+  }
+  async verifyIntegration(token) {
+    const row = this.ctx.storage.sql.exec(
+      "SELECT data FROM identity_integrations WHERE secret=?",
+      await hash2(token)
+    ).toArray()[0];
+    const record2 = row ? identityIntegrationSchema.parse(JSON.parse(row.data)) : null;
+    return record2 && record2.expiresAt > Date.now() ? record2 : null;
+  }
+  async integrationSession(token, id2, subject) {
+    const digest = await hash2(token);
+    const row = this.ctx.storage.sql.exec(
+      "SELECT integration,subject FROM integration_sessions WHERE hash=?",
+      digest
+    ).toArray()[0];
+    if (!row || row.integration !== id2 || subject !== void 0 && row.subject !== subject)
+      return null;
+    return this.resolve(token, id2);
+  }
+  async exchangeParticipant(secret, value) {
+    const input = participantExchangeSchema.parse(value);
+    const record2 = await this.verifyIntegration(secret);
+    if (!record2) return { kind: "denied" };
+    if (input.previousToken) {
+      const session = await this.integrationSession(
+        input.previousToken,
+        record2.id,
+        input.subject
+      );
+      if (session)
+        return {
+          kind: "issued",
+          result: { token: input.previousToken, session }
+        };
+    }
+    if (!this.rateLimit("integration:" + record2.id, 600, 6e4))
+      return { kind: "limited" };
+    const result = await this.issue({
+      organization: record2.organization,
+      project: record2.project,
+      environment: record2.environment,
+      identity: { issuer: "app_" + record2.id, subject: input.subject },
+      role: "member"
+    });
+    if (!await this.verifyIntegration(secret)) {
+      await this.revoke(result.token);
+      return { kind: "denied" };
+    }
+    const digest = await hash2(result.token);
+    this.ctx.storage.sql.exec(
+      "DELETE FROM integration_sessions WHERE hash NOT IN (SELECT hash FROM sessions)"
+    );
+    this.ctx.storage.sql.exec(
+      "INSERT INTO integration_sessions VALUES(?,?,?)",
+      digest,
+      record2.id,
+      input.subject
+    );
+    return { kind: "issued", result };
+  }
   walletConnection(session) {
     if (session.principal.kind !== "member") return null;
     const row = this.ctx.storage.sql.exec(
@@ -20917,13 +21549,21 @@ var AuthStore = class extends DurableObject2 {
       signInEnabled: !!row.login
     }));
   }
-  async resolve(token) {
+  async resolve(token, integrationId) {
+    const digest = await hash2(token);
     const row = this.ctx.storage.sql.exec(
       "SELECT data FROM sessions WHERE hash=? AND expires>?",
-      await hash2(token),
+      digest,
       Date.now()
     ).toArray()[0];
-    return row ? sessionSchema.parse(JSON.parse(row.data)) : null;
+    if (!row) return null;
+    const binding = this.ctx.storage.sql.exec(
+      "SELECT i.data,s.integration FROM integration_sessions s LEFT JOIN identity_integrations i ON i.id=s.integration WHERE s.hash=?",
+      digest
+    ).toArray()[0];
+    if (binding && (binding.integration !== integrationId || !binding.data || identityIntegrationSchema.parse(JSON.parse(binding.data)).expiresAt <= Date.now()))
+      return null;
+    return sessionSchema.parse(JSON.parse(row.data));
   }
   async revoke(token) {
     this.ctx.storage.sql.exec(
@@ -20935,16 +21575,6 @@ var AuthStore = class extends DurableObject2 {
 
 // apps/api/src/github-repositories.ts
 init_zod();
-
-// apps/api/src/access-error.ts
-var AccessError = class extends Error {
-  constructor(message2, status = 403) {
-    super(message2);
-    this.status = status;
-  }
-};
-
-// apps/api/src/github-repositories.ts
 var githubRepositorySchema = external_exports.object({
   kind: external_exports.literal("github"),
   owner: external_exports.string().regex(/^[A-Za-z0-9-]+$/),
@@ -21195,33 +21825,32 @@ var HostingControl = class extends WorkerEntrypoint2 {
       const artifacts = buildArtifactsSchema.parse(await object2.json());
       const releases = batchReleaseSchema.parse(artifacts.quests);
       const catalog = catalogDeploymentSchema.omit({ expectedRevision: true }).parse(artifacts.catalog);
-      const ledger = this.env.STAGING_LEDGER.getByName(
-        JSON.stringify([build.organization, "test", previewProject(build.id)])
+      const ledger = (build.runtime === "hosted-test" ? this.env.LEDGER : this.env.STAGING_LEDGER).getByName(
+        JSON.stringify([
+          build.organization,
+          "test",
+          build.runtime === "hosted-test" ? build.project : previewProject(build.id)
+        ])
       );
       const headers = {
         "Content-Type": "application/json",
         "X-Relay-Actor": "management",
         "X-Relay-Actor-ID": build.actor
       };
-      if (releases.releases.length) {
-        const published = await ledger.fetch(
-          new Request("https://ledger/v1/releases/batch", {
-            method: "POST",
-            headers,
-            body: JSON.stringify(releases)
-          })
-        );
-        if (!published.ok) throw new Error(await published.text());
-      }
-      const current = await ledger.fetch(
-        new Request("https://ledger/management/v1/catalog", { headers })
+      const preview = await ledger.fetch(
+        new Request("https://ledger/management/v1/deployments/preview", {
+          method: "POST",
+          headers,
+          body: JSON.stringify({ ...releases, ...catalog })
+        })
       );
-      const { revision } = external_exports.object({ revision: external_exports.number() }).parse(await current.json());
+      if (!preview.ok) throw new Error(await preview.text());
+      const { id: id2 } = external_exports.object({ id: external_exports.string() }).parse(await preview.json());
       const deployed = await ledger.fetch(
-        new Request("https://ledger/management/v1/catalog/deploy", {
+        new Request("https://ledger/management/v1/deployments/publish", {
           method: "POST",
           headers,
-          body: JSON.stringify({ ...catalog, expectedRevision: revision })
+          body: JSON.stringify({ id: id2 })
         })
       );
       if (!deployed.ok) throw new Error(await deployed.text());
@@ -21250,6 +21879,15 @@ async function stagingRequest(request, env, participant) {
   if (!build || !env.STAGING_APPS || !env.STAGING_AUTH || !env.STAGING_LEDGER)
     return new Response("No staging build is ready yet", { status: 404 });
   if (url2.pathname.startsWith("/relay/")) {
+    if (build.runtime === "hosted-test") {
+      return proxyParticipant(request, {
+        baseUrl: "https://participant.internal",
+        fetch: (input, init) => participant(
+          new Request(input, init),
+          hostedParticipantEnv(env, build, url2.origin)
+        )
+      });
+    }
     if (url2.pathname.startsWith("/relay/v1/auth/") && !["/relay/v1/auth/session", "/relay/v1/auth/logout"].includes(
       url2.pathname
     ))
@@ -21332,7 +21970,7 @@ async function stagingRequest(request, env, participant) {
   return response.headers.get("Content-Type")?.includes("text/html") ? new HTMLRewriter().on("body", {
     element(element) {
       element.prepend(
-        '<aside style="position:sticky;top:0;z-index:99999;padding:10px;background:#fff3cd;color:#332701;text-align:center;font:14px system-ui">Staging preview \xB7 simulated participants \xB7 no live data</aside>',
+        '<aside style="position:sticky;top:0;z-index:99999;padding:10px;background:#fff3cd;color:#332701;text-align:center;font:14px system-ui">Staging preview \xB7 ' + (build.runtime === "hosted-test" ? "test data \xB7 real sign-in" : "simulated participants \xB7 no live data") + "</aside>",
         { html: true }
       );
     }
@@ -22594,6 +23232,27 @@ function localParticipantRequest(request, env) {
   return env.LOCAL_DEVELOPMENT === "true" && ["localhost", "127.0.0.1", "[::1]"].includes(new URL(request.url).hostname);
 }
 
+// apps/api/src/management.ts
+init_dist();
+
+// apps/api/src/development-preflight.ts
+function stagingConfigurationIssues(env) {
+  const required2 = {
+    BUILDER: env.BUILDER,
+    HOSTING_ASSETS: env.HOSTING_ASSETS,
+    STAGING_DOMAIN: env.STAGING_DOMAIN,
+    STAGING_APPS: env.STAGING_APPS,
+    STAGING_AUTH: env.STAGING_AUTH,
+    STAGING_LEDGER: env.STAGING_LEDGER,
+    GITHUB_APP_ID: env.GITHUB_APP_ID,
+    GITHUB_APP_PRIVATE_KEY: env.GITHUB_APP_PRIVATE_KEY,
+    GITHUB_INSTALLATION_ID: env.GITHUB_INSTALLATION_ID,
+    GITHUB_REPOSITORY_OWNER: env.GITHUB_REPOSITORY_OWNER,
+    GIT_PUBLIC_URL: env.GIT_PUBLIC_URL
+  };
+  return Object.entries(required2).filter(([, value]) => !value).map(([key]) => key);
+}
+
 // apps/api/src/readiness.ts
 function launchReadiness(env, releases, scope) {
   const issues = productionParticipantIssues(env);
@@ -32352,6 +33011,172 @@ async function managementRoutes(request, env) {
     }
     if (!organization || !(await store.projects(organization)).some((p) => p.project === project))
       throw new AccessError("Project not found", 404);
+    if (path === "/identity-integrations" || path.startsWith("/identity-integrations/")) {
+      if (personal || cliSession || !admin)
+        throw new AccessError(
+          "An organization administrator must manage identity integrations in Console"
+        );
+      const auth = env.AUTH.getByName("auth-v1");
+      const scope = { organization, project, environment };
+      if (path === "/identity-integrations" && request.method === "GET")
+        return respond(await auth.integrations(scope));
+      if (path === "/identity-integrations" && request.method === "POST")
+        return respond(
+          await auth.createIntegration(
+            scope,
+            identityIntegrationInputSchema.parse(await request.json()),
+            actor
+          ),
+          201
+        );
+      const match2 = path.match(
+        /^\/identity-integrations\/([\w-]+)(\/rotate)?$/
+      );
+      if (match2 && (match2[2] && request.method === "POST" || !match2[2] && request.method === "DELETE")) {
+        return respond(
+          await auth.changeIntegration(
+            scope,
+            external_exports.string().uuid().parse(match2[1]),
+            actor,
+            !!match2[2]
+          )
+        );
+      }
+      throw new AccessError("Identity integration route not found", 404);
+    }
+    if (path === "/development/session" && ["POST", "PUT", "DELETE"].includes(request.method)) {
+      requirePermission("publish");
+      if (environment !== "test")
+        throw new AccessError("Development requires the test environment", 422);
+      if (previewConfigurationIssues(env).length || !env.PREVIEW_SESSIONS || !env.PREVIEW_DOMAIN)
+        throw new AccessError(
+          "Shared development previews are not configured. A Domino operator must enable preview hosting. Use --offline only for isolated platform development.",
+          503
+        );
+      const input = external_exports.object({
+        workspace: external_exports.string().uuid(),
+        generation: external_exports.string().uuid(),
+        port: external_exports.number().int().min(1).max(65535).optional()
+      }).strict().parse(await request.json());
+      const id2 = (await hash2(
+        JSON.stringify([organization, project, actor, input.workspace])
+      )).slice(0, 32);
+      const session = env.PREVIEW_SESSIONS.getByName(id2);
+      if (request.method === "DELETE") {
+        await session.stop(input.generation);
+        return respond({ stopped: true });
+      }
+      if (request.method === "PUT") {
+        if (!await session.heartbeat(input.generation))
+          throw new AccessError(
+            "Preview lease expired. Restart domino dev.",
+            409
+          );
+        return respond({ renewed: true });
+      }
+      if (!input.port) throw new AccessError("An app port is required", 400);
+      if (!await env.AUTH.getByName("auth-v1").rateLimit(
+        `preview-start:${organization}:${actor}`,
+        10,
+        6e4
+      ))
+        throw new AccessError(
+          "Too many preview starts. Try again shortly.",
+          429
+        );
+      const hostname3 = `${project.toLowerCase().replace(/[^a-z0-9-]/g, "-").slice(0, 24)}-${id2}.${env.PREVIEW_DOMAIN}`;
+      const issues = productionParticipantIssues(
+        hostedParticipantEnv(
+          env,
+          { organization, project },
+          `https://${hostname3}`
+        )
+      );
+      if (issues.length)
+        throw new AccessError(
+          "Hosted test sign-in is not configured. A Domino operator must enable participant authentication.",
+          503
+        );
+      const result = await session.start({
+        organization,
+        project,
+        actor,
+        hostname: hostname3,
+        generation: input.generation,
+        port: input.port
+      });
+      if ("error" in result)
+        throw new AccessError(
+          result.error ?? "Preview is already running",
+          409
+        );
+      return respond(result);
+    }
+    if (path === "/preflight" && request.method === "GET") {
+      requirePermission("read");
+      const missing = stagingConfigurationIssues(env);
+      const repository = await store.repository(organization, project);
+      const authIssues = productionParticipantIssues(
+        hostedParticipantEnv(
+          env,
+          { organization, project },
+          `https://preflight.${env.PREVIEW_DOMAIN ?? "preview.domino.run"}`
+        )
+      );
+      const checks = [
+        {
+          id: "hosted-test-auth",
+          status: authIssues.length ? "error" : "ok",
+          message: authIssues.length ? "A Domino operator must configure real participant sign-in." : "Real sign-in is configured; complete a sign-in to verify provider availability.",
+          issues: authIssues
+        },
+        {
+          id: "project-access",
+          status: "ok",
+          message: "Project access verified."
+        },
+        {
+          id: "publication",
+          status: permissions.includes("publish") ? "ok" : "error",
+          message: permissions.includes("publish") ? "Publication permission verified." : "Ask a project administrator for publication permission."
+        },
+        {
+          id: "cloud-builds",
+          status: missing.length ? "error" : "ok",
+          message: missing.length ? "A Domino operator must configure cloud hosting before this project can stage." : "Cloud hosting configuration is present. A successful build has not been verified.",
+          missing
+        },
+        {
+          id: "repository",
+          status: repository?.status === "ready" ? "ok" : "error",
+          message: repository?.status === "ready" ? "Hosted repository is ready." : "Create a hosted repository before staging."
+        }
+      ];
+      const integrations = await env.AUTH.getByName("auth-v1").integrations({
+        organization,
+        project,
+        environment
+      });
+      const developmentMissing = previewConfigurationIssues(env);
+      return respond({
+        organization,
+        project,
+        environment,
+        identity: {
+          exchange: "supported",
+          activeIntegrations: integrations.filter(
+            (item) => item.expiresAt > Date.now()
+          ).length
+        },
+        development: {
+          status: developmentMissing.length || authIssues.length ? "blocked" : "configured",
+          missing: developmentMissing,
+          authentication: authIssues
+        },
+        staging: checks.every((check2) => check2.status === "ok") ? "configured" : "blocked",
+        checks
+      });
+    }
     if (path === "/repository" && ["GET", "POST"].includes(request.method)) {
       requirePermission(request.method === "POST" ? "publish" : "read");
       const publicBase = env.GIT_PUBLIC_URL;
@@ -32367,15 +33192,45 @@ async function managementRoutes(request, env) {
         if (repo.status !== "ready") {
           if (!env.HOSTING_ASSETS)
             throw new AccessError("Starter storage is not configured", 503);
+          const active = await env.HOSTING_ASSETS.get(
+            "starters/campaign-current.json"
+          );
+          const pointer = active ? external_exports.object({
+            format: external_exports.literal(1),
+            key: external_exports.string().regex(/^starters\/campaign\/[a-f0-9]{64}\.json$/),
+            sha256: external_exports.string().regex(/^[a-f0-9]{64}$/)
+          }).parse(await active.json()) : null;
           const starter = await env.HOSTING_ASSETS.get(
-            "starters/campaign.json"
+            pointer?.key ?? "starters/campaign.json"
           );
           if (!starter)
             throw new AccessError(
               "Campaign starter has not been uploaded",
               503
             );
-          const files = starterFilesSchema.parse(await starter.json());
+          const contents = await starter.text();
+          if (pointer && await hash2(contents) !== pointer.sha256)
+            throw new AccessError(
+              "Starter integrity check failed. Contact a Domino operator.",
+              503
+            );
+          const files = starterFilesSchema.parse(JSON.parse(contents));
+          const setup = (await store.projects(organization)).find(
+            (item) => item.project === project
+          )?.setup;
+          if (setup) {
+            const brief = {
+              path: "CAMPAIGN.md",
+              encoding: "utf-8",
+              content: `# Project brief
+
+${setup.brief}
+`
+            };
+            const index = files.findIndex((file2) => file2.path === brief.path);
+            if (index < 0) files.push(brief);
+            else files[index] = brief;
+          }
           const github = new GitHubRepositories(env);
           const provider = await github.provision(repo.id);
           await github.seed(provider, files);
@@ -32403,12 +33258,26 @@ async function managementRoutes(request, env) {
           "Staging builds require the test environment",
           422
         );
-      if (!env.BUILDER || !env.HOSTING_ASSETS || !env.STAGING_DOMAIN)
-        throw new AccessError("Cloud builds are not configured", 503);
+      if (stagingConfigurationIssues(env).length || !env.BUILDER || !env.HOSTING_ASSETS)
+        throw new AccessError(
+          "Cloud builds are not configured. Run domino doctor --remote; a Domino operator must enable cloud hosting.",
+          503
+        );
       const repository = await store.repository(organization, project);
       if (!repository || repository.status !== "ready")
         throw new AccessError("Create a hosted repository first", 409);
       if (path === "/builds" && request.method === "POST") {
+        if (productionParticipantIssues(
+          hostedParticipantEnv(
+            env,
+            { organization, project },
+            `https://stage-${repository.id.replaceAll("-", "")}.${env.STAGING_DOMAIN}`
+          )
+        ).length)
+          throw new AccessError(
+            "Hosted test sign-in is not configured. Run domino doctor --remote before staging.",
+            503
+          );
         const input = stageRequestSchema.parse(await request.json());
         await new GitHubRepositories(env).verifyCommit(
           repository.provider,
@@ -32416,6 +33285,7 @@ async function managementRoutes(request, env) {
         );
         const build2 = await store.reserveBuild({
           id: input.requestId,
+          runtime: "hosted-test",
           repository: repository.id,
           organization,
           project,
@@ -32877,7 +33747,7 @@ async function deviceRoutes(request, env) {
 
 // apps/api/src/management-store.ts
 init_zod();
-import { DurableObject as DurableObject3 } from "cloudflare:workers";
+import { DurableObject as DurableObject4 } from "cloudflare:workers";
 var repositoryBase = external_exports.object({
   id: external_exports.string().uuid(),
   organization: external_exports.string(),
@@ -32893,11 +33763,12 @@ var repositoryRecord = external_exports.discriminatedUnion("status", [
     provider: githubRepositorySchema
   })
 ]);
-var ManagementStore = class extends DurableObject3 {
+var ManagementStore = class extends DurableObject4 {
   constructor(ctx, env) {
     super(ctx, env);
     ctx.storage.sql.exec(`
       CREATE TABLE IF NOT EXISTS projects (organization TEXT, project TEXT, name TEXT NOT NULL, PRIMARY KEY(organization,project));
+      CREATE TABLE IF NOT EXISTS project_setup (organization TEXT, project TEXT, data TEXT NOT NULL, PRIMARY KEY(organization,project));
       CREATE TABLE IF NOT EXISTS grants (organization TEXT, project TEXT, subject TEXT, data TEXT NOT NULL, PRIMARY KEY(organization,project,subject));
       DROP TABLE IF EXISTS tokens;
       CREATE TABLE IF NOT EXISTS audit (id INTEGER PRIMARY KEY AUTOINCREMENT, actor TEXT NOT NULL, organization TEXT NOT NULL, action TEXT NOT NULL, data TEXT NOT NULL, at INTEGER NOT NULL);
@@ -33160,12 +34031,14 @@ var ManagementStore = class extends DurableObject3 {
     return { total, audit };
   }
   projects(organization) {
-    return organization ? this.ctx.storage.sql.exec(
-      "SELECT * FROM projects WHERE organization=? ORDER BY name,project",
-      organization
-    ).toArray() : this.ctx.storage.sql.exec(
-      "SELECT * FROM projects ORDER BY organization,name,project"
-    ).toArray();
+    const query = "SELECT p.*,s.data AS setup FROM projects p LEFT JOIN project_setup s ON p.organization=s.organization AND p.project=s.project";
+    return this.ctx.storage.sql.exec(
+      query + (organization ? " WHERE p.organization=?" : "") + " ORDER BY p.name,p.project",
+      ...organization ? [organization] : []
+    ).toArray().map(({ setup, ...project }) => ({
+      ...project,
+      ...setup ? { setup: projectSetupSchema.parse(JSON.parse(setup)) } : {}
+    }));
   }
   create(organization, input, actor) {
     return this.ctx.storage.transactionSync(() => {
@@ -33173,7 +34046,7 @@ var ManagementStore = class extends DurableObject3 {
         (p) => p.project === input.project
       );
       if (existing) {
-        if (existing.name !== input.name)
+        if (existing.name !== input.name || input.setup && JSON.stringify(existing.setup) !== JSON.stringify(input.setup))
           throw new Error("Project ID is already in use");
         return existing;
       }
@@ -33183,6 +34056,13 @@ var ManagementStore = class extends DurableObject3 {
         input.project,
         input.name
       );
+      if (input.setup)
+        this.ctx.storage.sql.exec(
+          "INSERT INTO project_setup VALUES(?,?,?)",
+          organization,
+          input.project,
+          JSON.stringify(input.setup)
+        );
       this.audit(actor, organization, "project-created", input);
       return { organization, ...input };
     });
@@ -33263,6 +34143,7 @@ var photo_quest_default = { code: 'var Kd=Object.defineProperty;var ee=(e,r)=>{f
 
 // apps/api/src/auth-routes.ts
 init_zod();
+init_dist();
 
 // apps/api/src/oauth-routes.ts
 init_zod();
@@ -33559,6 +34440,8 @@ async function oauthRoutes(request, env, session) {
 
 // apps/api/src/auth-routes.ts
 var emailFlowSchema = external_exports.object({
+  scope: authScopeSchema,
+  origin: external_exports.string(),
   email: external_exports.string().email(),
   digest: external_exports.string(),
   binding: external_exports.string()
@@ -33602,6 +34485,8 @@ async function authRoutes(request, env, session) {
       id2,
       {
         email: email3,
+        scope: authScope(env),
+        origin: request.headers.get("Origin") ?? "",
         digest: await hash2(id2 + ":" + code),
         binding: await hash2(binding)
       },
@@ -33614,6 +34499,8 @@ async function authRoutes(request, env, session) {
         id2,
         JSON.stringify({
           email: email3,
+          scope: authScope(env),
+          origin: request.headers.get("Origin") ?? "",
           digest: await hash2(id2 + ":" + code),
           binding: await hash2(binding)
         })
@@ -33638,7 +34525,12 @@ async function authRoutes(request, env, session) {
     const raw = await auth.readFlow(challenge);
     if (!raw || !await auth.rateLimit("verify:" + challenge, 5, 6e5))
       return fail("Code expired or too many attempts. Request another.");
-    const flow = emailFlowSchema.parse(JSON.parse(raw));
+    const parsed = emailFlowSchema.safeParse(JSON.parse(raw));
+    if (!parsed.success) return fail("Code expired. Request another.");
+    const flow = parsed.data;
+    const scope = authScope(env);
+    if (flow.scope.organization !== scope.organization || flow.scope.project !== scope.project || flow.scope.environment !== scope.environment || flow.origin !== (request.headers.get("Origin") ?? ""))
+      return fail("Sign-in scope changed. Request another code.");
     if (flow.binding !== await hash2(cookie(request, "relay_auth_flow")) || flow.digest !== await hash2(challenge + ":" + code))
       return fail("Invalid code");
     if (!await auth.consumeFlow(challenge, raw))
@@ -33660,7 +34552,7 @@ async function authRoutes(request, env, session) {
 
 // apps/api/src/index.ts
 var gateway = {
-  async fetch(request, env) {
+  async fetch(request, env, identityIntegration) {
     const git = await gitGateway(request, env);
     if (git) return git;
     const device = await deviceRoutes(request, env);
@@ -33677,7 +34569,7 @@ var gateway = {
     const url2 = new URL(request.url);
     const local = localParticipantRequest(request, env);
     if (!local) {
-      const issues = productionParticipantIssues(env);
+      const issues = identityIntegration ? [] : productionParticipantIssues(env);
       if (issues.length)
         return Response.json(
           { error: "Participant access is not configured for this deployment" },
@@ -33691,13 +34583,13 @@ var gateway = {
           { error: "Participant project has not been provisioned" },
           { status: 503 }
         );
-      if (url2.pathname === "/v1/auth/exchange" || url2.pathname === "/v1/auth/demo")
+      if (url2.pathname === "/v1/auth/demo")
         return Response.json({ error: "Route not found" }, { status: 404 });
     }
     const auth = env.AUTH.getByName("auth-v1");
     const token = sessionToken(request);
     const management = local && !!env.API_TOKEN && request.headers.get("Authorization") === "Bearer " + env.API_TOKEN;
-    const resolvedSession = management ? null : token ? await auth.resolve(token) : null;
+    const resolvedSession = management ? null : token ? await auth.resolve(token, identityIntegration) : null;
     const portalScope = authScope(env);
     const session = resolvedSession && (!local || !request.headers.has("Authorization")) && (resolvedSession.organization !== portalScope.organization || resolvedSession.project !== portalScope.project || resolvedSession.environment !== portalScope.environment) ? null : resolvedSession;
     if (!local && session && session.principal.kind !== "member")
@@ -34067,6 +34959,11 @@ var gateway = {
     }
   }
 };
+var PreviewGateway = class extends WorkerEntrypoint3 {
+  async fetch(request) {
+    return developmentPreview(request, this.env, gateway.fetch);
+  }
+};
 var StagingGateway = class extends WorkerEntrypoint3 {
   async fetch(request) {
     return await stagingRequest(request, this.env, gateway.fetch) ?? new Response("Staging not found", { status: 404 });
@@ -34074,7 +34971,11 @@ var StagingGateway = class extends WorkerEntrypoint3 {
 };
 var index_default = {
   async fetch(request, env) {
-    const response = await gateway.fetch(request, env);
+    const response = await identityIntegrationRequest(
+      request,
+      env,
+      (incoming, scoped, id2) => gateway.fetch(incoming, scoped, id2)
+    ) ?? await gateway.fetch(request, await callbackEnvironment(request, env));
     const headers = new Headers(response.headers);
     headers.set("Cache-Control", "no-store");
     return new Response(response.body, { status: response.status, headers });
@@ -34086,6 +34987,8 @@ export {
   HostingControl,
   ManagementStore,
   OrganizationLedger,
+  PreviewGateway,
+  PreviewSession,
   StagingAuth,
   StagingGateway,
   StagingLedger,