@domino-sdk/relay-runtime 0.2.0 → 0.3.0

package/dist/index.js

@@ -14833,7 +14833,40 @@ var init_chunk_C2KOMNLG = __esm({
   }
 });
 
-// packages/sdk/dist/chunk-NC3UAP6T.js
+// packages/sdk/dist/chunk-6IXQRMGW.js
+var authScopeSchema, principalSchema, sessionSchema, exchangeSchema, exchangeResultSchema;
+var init_chunk_6IXQRMGW = __esm({
+  "packages/sdk/dist/chunk-6IXQRMGW.js"() {
+    "use strict";
+    init_chunk_C2KOMNLG();
+    init_zod();
+    authScopeSchema = external_exports.object({
+      organization: identifier,
+      project: identifier,
+      environment: external_exports.enum(["test", "live"])
+    }).strict();
+    principalSchema = external_exports.discriminatedUnion("kind", [
+      external_exports.object({ kind: external_exports.literal("member"), member: identifier }).strict(),
+      external_exports.object({ kind: external_exports.literal("staff"), subject: identifier }).strict(),
+      external_exports.object({ kind: external_exports.literal("operator"), subject: identifier }).strict()
+    ]);
+    sessionSchema = authScopeSchema.extend({
+      id: identifier,
+      principal: principalSchema,
+      expiresAt: external_exports.number()
+    });
+    exchangeSchema = authScopeSchema.extend({
+      identity: external_exports.object({ issuer: identifier, subject: external_exports.string().min(1).max(200) }).strict(),
+      role: external_exports.enum(["member", "staff", "operator"])
+    }).strict();
+    exchangeResultSchema = external_exports.object({
+      token: external_exports.string(),
+      session: sessionSchema
+    });
+  }
+});
+
+// packages/sdk/dist/chunk-L757OYXZ.js
 function questInteraction(trigger) {
   return trigger.kind === "automatic" ? "automatic" : trigger.actor === "staff" ? "staff" : trigger.input === "none" ? "claim" : trigger.input;
 }
@@ -15283,7 +15316,7 @@ function createRelayClient(options) {
   }
   const submission = submissions(
     {
-      session: () => request("/v1/auth/session", sessionSchema2.nullable()),
+      session: () => request("/v1/auth/session", sessionSchema.nullable()),
       upload: (file2, action, session) => request("/v1/me/evidence", evidenceSchema, {
         method: "POST",
         headers: {
@@ -15334,7 +15367,7 @@ function createRelayClient(options) {
           throw new Error("There is no failed attempt to retry.");
         const session = await request(
           "/v1/auth/session",
-          sessionSchema2.nullable()
+          sessionSchema.nullable()
         );
         if (session?.principal.kind !== "member")
           throw new Error("Sign in to retry verification.");
@@ -15358,7 +15391,7 @@ function createRelayClient(options) {
       observe: (listener, options2) => {
         const observer = observeProgress(
           {
-            session: (signal2) => request("/v1/auth/session", sessionSchema2.nullable(), { signal: signal2 }),
+            session: (signal2) => request("/v1/auth/session", sessionSchema.nullable(), { signal: signal2 }),
             progress: (session, signal2) => request("/v1/me/experience", questExperienceSchema, {
               signal: signal2,
               headers: { "X-Relay-Session": session }
@@ -15418,7 +15451,7 @@ function createRelayClient(options) {
       emailVerify: (challenge, code) => changeSession(
         () => request(
           "/v1/auth/email/verify",
-          sessionSchema2,
+          sessionSchema,
           json3({ challenge, code })
         )
       ),
@@ -15432,20 +15465,21 @@ function createRelayClient(options) {
           })
         )
       ),
-      session: () => request("/v1/auth/session", sessionSchema2.nullable()),
+      session: () => request("/v1/auth/session", sessionSchema.nullable()),
       demoSignIn: (code) => changeSession(
-        () => request("/v1/auth/demo", sessionSchema2, json3({ code }))
+        () => request("/v1/auth/demo", sessionSchema, json3({ code }))
       ),
       signOut: () => changeSession(
         () => request("/v1/auth/logout", external_exports.object({ ok: external_exports.boolean() }), json3({}))
       ),
+      /** Local development only. Existing hosted apps use createParticipantBackend from /portal-proxy. */
       exchange: (input) => request("/v1/auth/exchange", exchangeResultSchema, json3(input))
     },
     me: {
       observeProgress: (listener, options2) => {
         const observer = observeProgress(
           {
-            session: (signal2) => request("/v1/auth/session", sessionSchema2.nullable(), { signal: signal2 }),
+            session: (signal2) => request("/v1/auth/session", sessionSchema.nullable(), { signal: signal2 }),
             progress: (session, signal2) => request("/v1/me/progress", memberProgressSchema, {
               signal: signal2,
               headers: { "X-Relay-Session": session }
@@ -15543,10 +15577,11 @@ function createRelayClient(options) {
     decide: (id2, input) => request(`/v1/attempts/${id2}/review`, attemptSchema, json3(input))
   };
 }
-var interactionSchema, questTypeVersionSchema, collectionSlotSchema, questCollectionSchema, questInstanceSchema, questDraftChangesSchema, draftBase, questDraftSchema, questCatalogSchema, catalogDeploymentSchema, catalogDeploymentPreviewSchema, saveQuestDraftSchema, publishQuestDraftSchema, questViewSchema, collectionViewSchema, questExperienceSchema, questPublicationPreviewSchema, RelayError, common, claimInputSchema, draftSchema, recordSchema, QuestUpdatedError, authScopeSchema, principalSchema, sessionSchema2, exchangeSchema, exchangeResultSchema, solanaAddressSchema, walletConnectionSchema, walletChallengeInputSchema, walletChallengeSchema, walletProofSchema, solanaBalanceSchema, collectionCodeSchema, collectionPassSchema, collectionResolveSchema, collectionBeginSchema, collectionPreviewSchema, projectDeploymentSchema, deploymentPreviewSchema, publishDeploymentSchema, deploymentResultSchema;
-var init_chunk_NC3UAP6T = __esm({
-  "packages/sdk/dist/chunk-NC3UAP6T.js"() {
+var interactionSchema, questTypeVersionSchema, collectionSlotSchema, questCollectionSchema, questInstanceSchema, questDraftChangesSchema, draftBase, questDraftSchema, questCatalogSchema, catalogDeploymentSchema, catalogDeploymentPreviewSchema, saveQuestDraftSchema, publishQuestDraftSchema, questViewSchema, collectionViewSchema, questExperienceSchema, questPublicationPreviewSchema, RelayError, common, claimInputSchema, draftSchema, recordSchema, QuestUpdatedError, solanaAddressSchema, walletConnectionSchema, walletChallengeInputSchema, walletChallengeSchema, walletProofSchema, solanaBalanceSchema, collectionCodeSchema, collectionPassSchema, collectionResolveSchema, collectionBeginSchema, collectionPreviewSchema, projectDeploymentSchema, deploymentPreviewSchema, publishDeploymentSchema, deploymentResultSchema, identityIntegrationInputSchema, identityIntegrationSchema, identityIntegrationSecretSchema, participantExchangeSchema;
+var init_chunk_L757OYXZ = __esm({
+  "packages/sdk/dist/chunk-L757OYXZ.js"() {
     "use strict";
+    init_chunk_6IXQRMGW();
     init_chunk_C2KOMNLG();
     init_zod();
     init_zod();
@@ -15718,29 +15753,6 @@ var init_chunk_NC3UAP6T = __esm({
       }
       draft;
     };
-    authScopeSchema = external_exports.object({
-      organization: identifier,
-      project: identifier,
-      environment: external_exports.enum(["test", "live"])
-    }).strict();
-    principalSchema = external_exports.discriminatedUnion("kind", [
-      external_exports.object({ kind: external_exports.literal("member"), member: identifier }).strict(),
-      external_exports.object({ kind: external_exports.literal("staff"), subject: identifier }).strict(),
-      external_exports.object({ kind: external_exports.literal("operator"), subject: identifier }).strict()
-    ]);
-    sessionSchema2 = authScopeSchema.extend({
-      id: identifier,
-      principal: principalSchema,
-      expiresAt: external_exports.number()
-    });
-    exchangeSchema = authScopeSchema.extend({
-      identity: external_exports.object({ issuer: identifier, subject: external_exports.string().min(1).max(200) }).strict(),
-      role: external_exports.enum(["member", "staff", "operator"])
-    }).strict();
-    exchangeResultSchema = external_exports.object({
-      token: external_exports.string(),
-      session: sessionSchema2
-    });
     solanaAddressSchema = external_exports.string().min(32).max(44).regex(/^[1-9A-HJ-NP-Za-km-z]+$/);
     walletConnectionSchema = external_exports.object({
       chain: external_exports.literal("solana"),
@@ -15803,6 +15815,28 @@ var init_chunk_NC3UAP6T = __esm({
     deploymentResultSchema = deploymentPreviewSchema.extend({
       revision: external_exports.number().int().positive()
     });
+    identityIntegrationInputSchema = external_exports.object({
+      name: external_exports.string().trim().min(1).max(80),
+      origin: external_exports.string().url().refine((value) => {
+        const url2 = new URL(value);
+        return url2.protocol === "https:" && url2.origin === value;
+      }, "Use an exact HTTPS application origin")
+    }).strict();
+    identityIntegrationSchema = authScopeSchema.extend({
+      id: external_exports.string().uuid(),
+      name: external_exports.string(),
+      origin: external_exports.string(),
+      expiresAt: external_exports.number()
+    });
+    identityIntegrationSecretSchema = identityIntegrationSchema.extend(
+      {
+        token: external_exports.string()
+      }
+    );
+    participantExchangeSchema = external_exports.object({
+      subject: external_exports.string().min(1).max(200),
+      previousToken: external_exports.string().max(200).optional()
+    }).strict();
   }
 });
 
@@ -15839,12 +15873,16 @@ __export(dist_exports, {
   exchangeResultSchema: () => exchangeResultSchema,
   exchangeSchema: () => exchangeSchema,
   identifier: () => identifier,
+  identityIntegrationInputSchema: () => identityIntegrationInputSchema,
+  identityIntegrationSchema: () => identityIntegrationSchema,
+  identityIntegrationSecretSchema: () => identityIntegrationSecretSchema,
   interactionSchema: () => interactionSchema,
   mediaUrlSchema: () => mediaUrlSchema,
   memberListSchema: () => memberListSchema,
   memberPageSchema: () => memberPageSchema,
   memberProgressSchema: () => memberProgressSchema,
   parseSettings: () => parseSettings,
+  participantExchangeSchema: () => participantExchangeSchema,
   photoResultSchema: () => photoResultSchema,
   pickupAllocationSchema: () => pickupAllocationSchema,
   pickupAvailabilitySchema: () => pickupAvailabilitySchema,
@@ -15891,7 +15929,7 @@ __export(dist_exports, {
   rewardKey: () => rewardKey,
   rewardSchema: () => rewardSchema,
   saveQuestDraftSchema: () => saveQuestDraftSchema,
-  sessionSchema: () => sessionSchema2,
+  sessionSchema: () => sessionSchema,
   settingFieldSchema: () => settingFieldSchema,
   settings: () => settings,
   settingsFieldsSchema: () => settingsFieldsSchema,
@@ -15914,12 +15952,152 @@ __export(dist_exports, {
 var init_dist = __esm({
   "packages/sdk/dist/index.js"() {
     "use strict";
-    init_chunk_NC3UAP6T();
+    init_chunk_L757OYXZ();
+    init_chunk_6IXQRMGW();
     init_chunk_C2KOMNLG();
   }
 });
 
+// apps/api/src/identity-integration.ts
+init_zod();
+init_dist();
+
+// apps/api/src/access-error.ts
+var AccessError = class extends Error {
+  constructor(message2, status = 403) {
+    super(message2);
+    this.status = status;
+  }
+};
+
+// apps/api/src/auth-utils.ts
+function cookie(request, name) {
+  return request.headers.get("Cookie")?.split(";").map((value) => value.trim()).find((value) => value.startsWith(name + "="))?.slice(name.length + 1) ?? "";
+}
+function bindingCookie(value, secure, name = "relay_auth_flow") {
+  return `${name}=${value}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${value ? 600 : 0}${secure ? "; Secure" : ""}`;
+}
+async function hash2(value) {
+  const bytes = await crypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(value)
+  );
+  return Array.from(
+    new Uint8Array(bytes),
+    (b) => b.toString(16).padStart(2, "0")
+  ).join("");
+}
+function sessionToken(request) {
+  const bearer = request.headers.get("Authorization");
+  if (bearer) return bearer.startsWith("Bearer ") ? bearer.slice(7) : "";
+  return request.headers.get("Cookie")?.split(";").map((x) => x.trim()).find((x) => x.startsWith("relay_session="))?.slice("relay_session=".length) ?? "";
+}
+function sessionCookie(token, secure) {
+  return `relay_session=${token}; Path=/; HttpOnly; SameSite=Strict; Max-Age=${token ? 28800 : 0}${secure ? "; Secure" : ""}`;
+}
+function browserMutationAllowed(request, env) {
+  const origin = request.headers.get("Origin");
+  return request.headers.get("X-Relay-CSRF") === "1" && !!origin && (env.AUTH_ORIGINS ?? "").split(",").map((value) => value.trim()).includes(origin);
+}
+
+// apps/api/src/identity-integration.ts
+async function identityIntegrationRequest(request, env, participant) {
+  const path = new URL(request.url).pathname;
+  const key = request.headers.get("X-Relay-Integration-Key");
+  const exchange = path === "/v1/auth/exchange" && !(env.LOCAL_DEVELOPMENT === "true" && ["localhost", "127.0.0.1", "[::1]"].includes(
+    new URL(request.url).hostname
+  ) && !request.headers.get("Authorization")?.startsWith("Bearer di_"));
+  if (!exchange && !key) return null;
+  try {
+    const auth = env.AUTH.getByName("auth-v1");
+    if (exchange) {
+      if (request.method !== "POST")
+        return Response.json(
+          { error: "Use POST for identity exchange" },
+          { status: 405 }
+        );
+      const result = await auth.exchangeParticipant(
+        request.headers.get("Authorization")?.replace(/^Bearer /, "") ?? "",
+        participantExchangeSchema.parse(await request.json())
+      );
+      if (result.kind === "denied")
+        throw new AccessError(
+          "Use a valid identity integration server key from Console Settings. CLI and management credentials cannot issue participant sessions.",
+          401
+        );
+      if (result.kind === "limited")
+        throw new AccessError(
+          "Too many identity exchange requests. Retry shortly.",
+          429
+        );
+      return Response.json(result.result);
+    }
+    const integration = await auth.verifyIntegration(key ?? "");
+    if (!integration)
+      throw new AccessError(
+        "Identity integration key is invalid, expired, or revoked",
+        401
+      );
+    if (!/^\/v1\/(?:auth\/(?:session|logout|connections)|me\/(?:progress|experience|attempts|evidence|pass|collection-pass|wallet(?:\/challenge|\/verify)?)|attempts\/[\w-]+(?:\/retry)?)$/.test(
+      path
+    ))
+      return Response.json(
+        { error: "Route is not available through an identity integration" },
+        { status: 404 }
+      );
+    if (request.headers.get("Origin") !== integration.origin)
+      throw new AccessError(
+        "Application origin does not match the identity integration",
+        403
+      );
+    const session = await auth.integrationSession(
+      sessionToken(request),
+      integration.id
+    );
+    if (!session)
+      throw new AccessError(
+        "Participant session does not belong to this identity integration",
+        401
+      );
+    const headers = new Headers(request.headers);
+    headers.delete("X-Relay-Integration-Key");
+    return participant(
+      new Request(request, { headers }),
+      {
+        ...env,
+        LOCAL_DEVELOPMENT: "false",
+        TEST_HOOKS: "false",
+        DEMO_AUTH: "false",
+        AUTH_EMULATORS: void 0,
+        API_TOKEN: void 0,
+        AUTH_ORGANIZATION: integration.organization,
+        AUTH_PROJECT: integration.project,
+        AUTH_ENVIRONMENT: integration.environment,
+        AUTH_ORIGINS: integration.origin
+      },
+      integration.id
+    );
+  } catch (error48) {
+    if (error48 instanceof external_exports.ZodError || error48 instanceof SyntaxError)
+      return Response.json(
+        {
+          code: "INVALID_IDENTITY_EXCHANGE",
+          error: "Supply only a verified subject and optional previousToken"
+        },
+        { status: 400 }
+      );
+    if (error48 instanceof AccessError)
+      return Response.json(
+        { code: "IDENTITY_INTEGRATION_ACCESS_DENIED", error: error48.message },
+        { status: error48.status }
+      );
+    throw error48;
+  }
+}
+
 // packages/sdk/dist/portal-proxy.js
+init_chunk_6IXQRMGW();
+init_chunk_C2KOMNLG();
 async function proxyParticipant(request, upstream) {
   const incoming = new URL(request.url);
   const path = incoming.pathname.slice("/relay".length);
@@ -16178,7 +16356,7 @@ function previewConfigurationIssues(env) {
 }
 
 // apps/api/src/preview-session.ts
-var sessionSchema = external_exports.object({
+var sessionSchema2 = external_exports.object({
   organization: external_exports.string(),
   project: external_exports.string(),
   actor: external_exports.string(),
@@ -16192,7 +16370,7 @@ var leaseMs = 9e4;
 var PreviewSession = class extends DurableObject {
   async read() {
     const value = await this.ctx.storage.get("session");
-    return value ? sessionSchema.parse(value) : null;
+    return value ? sessionSchema2.parse(value) : null;
   }
   async resolve() {
     const session = await this.read();
@@ -16378,6 +16556,10 @@ var developmentPreflightSchema = external_exports.object({
   organization: external_exports.string(),
   project: external_exports.string(),
   environment: external_exports.enum(["test", "live"]),
+  identity: external_exports.object({
+    exchange: external_exports.literal("supported"),
+    activeIntegrations: external_exports.number().int().nonnegative()
+  }).optional(),
   staging: external_exports.enum(["configured", "blocked"]),
   development: external_exports.object({
     status: external_exports.enum(["configured", "blocked"]),
@@ -17568,36 +17750,6 @@ function pageQuery(params) {
   return entries;
 }
 
-// apps/api/src/auth-utils.ts
-function cookie(request, name) {
-  return request.headers.get("Cookie")?.split(";").map((value) => value.trim()).find((value) => value.startsWith(name + "="))?.slice(name.length + 1) ?? "";
-}
-function bindingCookie(value, secure, name = "relay_auth_flow") {
-  return `${name}=${value}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${value ? 600 : 0}${secure ? "; Secure" : ""}`;
-}
-async function hash2(value) {
-  const bytes = await crypto.subtle.digest(
-    "SHA-256",
-    new TextEncoder().encode(value)
-  );
-  return Array.from(
-    new Uint8Array(bytes),
-    (b) => b.toString(16).padStart(2, "0")
-  ).join("");
-}
-function sessionToken(request) {
-  const bearer = request.headers.get("Authorization");
-  if (bearer) return bearer.startsWith("Bearer ") ? bearer.slice(7) : "";
-  return request.headers.get("Cookie")?.split(";").map((x) => x.trim()).find((x) => x.startsWith("relay_session="))?.slice("relay_session=".length) ?? "";
-}
-function sessionCookie(token, secure) {
-  return `relay_session=${token}; Path=/; HttpOnly; SameSite=Strict; Max-Age=${token ? 28800 : 0}${secure ? "; Secure" : ""}`;
-}
-function browserMutationAllowed(request, env) {
-  const origin = request.headers.get("Origin");
-  return request.headers.get("X-Relay-CSRF") === "1" && !!origin && (env.AUTH_ORIGINS ?? "").split(",").map((value) => value.trim()).includes(origin);
-}
-
 // node_modules/.pnpm/base-x@5.0.1/node_modules/base-x/src/esm/index.js
 function base2(ALPHABET2) {
   if (ALPHABET2.length >= 255) {
@@ -17737,7 +17889,7 @@ var esm_default2 = esm_default(ALPHABET);
 init_zod();
 init_dist();
 var storedWalletChallenge = walletChallengeSchema.extend({
-  session: sessionSchema2,
+  session: sessionSchema,
   origin: external_exports.string().url()
 });
 function solanaPublicKey(address) {
@@ -19757,6 +19909,9 @@ var OrganizationLedger = class extends DurableObject2 {
   }
 };
 
+// apps/api/src/auth.ts
+init_dist();
+
 // apps/api/src/account-profile.ts
 init_zod();
 
@@ -20892,6 +21047,9 @@ var AuthStore = class extends DurableObject3 {
   constructor(ctx, env) {
     super(ctx, env);
     ctx.storage.sql.exec(`CREATE TABLE IF NOT EXISTS identities (scope TEXT NOT NULL, issuer TEXT NOT NULL, subject TEXT NOT NULL, member TEXT NOT NULL, PRIMARY KEY(scope,issuer,subject));
+      CREATE TABLE IF NOT EXISTS identity_integrations (id TEXT PRIMARY KEY, secret TEXT NOT NULL, data TEXT NOT NULL);
+      CREATE TABLE IF NOT EXISTS integration_sessions (hash TEXT PRIMARY KEY, integration TEXT NOT NULL, subject TEXT NOT NULL);
+      CREATE TABLE IF NOT EXISTS integration_audit (actor TEXT NOT NULL, action TEXT NOT NULL, integration TEXT NOT NULL, at INTEGER NOT NULL);
       CREATE TABLE IF NOT EXISTS sessions (hash TEXT PRIMARY KEY, expires INTEGER NOT NULL, data TEXT NOT NULL);
       CREATE TABLE IF NOT EXISTS auth_flows (id TEXT PRIMARY KEY, expires INTEGER NOT NULL, data TEXT NOT NULL);
       CREATE TABLE IF NOT EXISTS connections (scope TEXT NOT NULL, issuer TEXT NOT NULL, subject TEXT NOT NULL, member TEXT NOT NULL, login INTEGER NOT NULL, provider TEXT NOT NULL, sealed TEXT NOT NULL, PRIMARY KEY(scope,issuer,subject));
@@ -20900,6 +21058,134 @@ var AuthStore = class extends DurableObject3 {
       CREATE TABLE IF NOT EXISTS wallet_challenges (id TEXT PRIMARY KEY, expires INTEGER NOT NULL, data TEXT NOT NULL, result TEXT);
       CREATE TABLE IF NOT EXISTS wallet_connections (scope TEXT NOT NULL, project TEXT NOT NULL, member TEXT NOT NULL, data TEXT NOT NULL, PRIMARY KEY(scope,project,member));`);
   }
+  integrations(scope) {
+    return this.ctx.storage.sql.exec("SELECT data FROM identity_integrations").toArray().map((row) => identityIntegrationSchema.parse(JSON.parse(row.data))).filter(
+      (item) => item.organization === scope.organization && item.project === scope.project && item.environment === scope.environment
+    );
+  }
+  async createIntegration(scope, input, actor) {
+    const record2 = identityIntegrationSchema.parse({
+      ...authScopeSchema.parse(scope),
+      ...identityIntegrationInputSchema.parse(input),
+      id: crypto.randomUUID(),
+      expiresAt: Date.now() + 90 * 864e5
+    });
+    const token = "di_" + crypto.randomUUID() + crypto.randomUUID();
+    const digest = await hash2(token);
+    this.ctx.storage.transactionSync(() => {
+      this.ctx.storage.sql.exec(
+        "INSERT INTO identity_integrations VALUES(?,?,?)",
+        record2.id,
+        digest,
+        JSON.stringify(record2)
+      );
+      this.ctx.storage.sql.exec(
+        "INSERT INTO integration_audit VALUES(?,?,?,?)",
+        actor,
+        "created",
+        record2.id,
+        Date.now()
+      );
+    });
+    return { ...record2, token };
+  }
+  async changeIntegration(scope, id2, actor, rotate) {
+    const token = "di_" + crypto.randomUUID() + crypto.randomUUID();
+    const digest = await hash2(token);
+    return this.ctx.storage.transactionSync(() => {
+      const record2 = this.integrations(scope).find((item) => item.id === id2);
+      if (!record2) return null;
+      this.ctx.storage.sql.exec(
+        "INSERT INTO integration_audit VALUES(?,?,?,?)",
+        actor,
+        rotate ? "rotated" : "revoked",
+        id2,
+        Date.now()
+      );
+      if (rotate) {
+        const next = { ...record2, expiresAt: Date.now() + 90 * 864e5 };
+        this.ctx.storage.sql.exec(
+          "UPDATE identity_integrations SET secret=?,data=? WHERE id=?",
+          digest,
+          JSON.stringify(next),
+          id2
+        );
+        return { ...next, token };
+      }
+      this.ctx.storage.sql.exec(
+        "DELETE FROM sessions WHERE hash IN (SELECT hash FROM integration_sessions WHERE integration=?)",
+        id2
+      );
+      this.ctx.storage.sql.exec(
+        "DELETE FROM integration_sessions WHERE integration=?",
+        id2
+      );
+      this.ctx.storage.sql.exec(
+        "DELETE FROM identity_integrations WHERE id=?",
+        id2
+      );
+      return null;
+    });
+  }
+  async verifyIntegration(token) {
+    const row = this.ctx.storage.sql.exec(
+      "SELECT data FROM identity_integrations WHERE secret=?",
+      await hash2(token)
+    ).toArray()[0];
+    const record2 = row ? identityIntegrationSchema.parse(JSON.parse(row.data)) : null;
+    return record2 && record2.expiresAt > Date.now() ? record2 : null;
+  }
+  async integrationSession(token, id2, subject) {
+    const digest = await hash2(token);
+    const row = this.ctx.storage.sql.exec(
+      "SELECT integration,subject FROM integration_sessions WHERE hash=?",
+      digest
+    ).toArray()[0];
+    if (!row || row.integration !== id2 || subject !== void 0 && row.subject !== subject)
+      return null;
+    return this.resolve(token, id2);
+  }
+  async exchangeParticipant(secret, value) {
+    const input = participantExchangeSchema.parse(value);
+    const record2 = await this.verifyIntegration(secret);
+    if (!record2) return { kind: "denied" };
+    if (input.previousToken) {
+      const session = await this.integrationSession(
+        input.previousToken,
+        record2.id,
+        input.subject
+      );
+      if (session)
+        return {
+          kind: "issued",
+          result: { token: input.previousToken, session }
+        };
+    }
+    if (!this.rateLimit("integration:" + record2.id, 600, 6e4))
+      return { kind: "limited" };
+    const result = await this.issue({
+      organization: record2.organization,
+      project: record2.project,
+      environment: record2.environment,
+      identity: { issuer: "app_" + record2.id, subject: input.subject },
+      role: "member"
+    });
+    if (!await this.verifyIntegration(secret)) {
+      await this.revoke(result.token);
+      return { kind: "denied" };
+    }
+    const digest = await hash2(result.token);
+    this.ctx.storage.sql.exec(
+      "DELETE FROM integration_sessions WHERE hash NOT IN (SELECT hash FROM sessions)"
+    );
+    this.ctx.storage.sql.exec(
+      "INSERT INTO integration_sessions VALUES(?,?,?)",
+      digest,
+      record2.id,
+      input.subject
+    );
+    return { kind: "issued", result };
+  }
   walletConnection(session) {
     if (session.principal.kind !== "member") return null;
     const row = this.ctx.storage.sql.exec(
@@ -21198,7 +21484,7 @@ var AuthStore = class extends DurableObject3 {
       id2,
       Date.now()
     ).toArray()[0];
-    return row ? sessionSchema2.parse(JSON.parse(row.data)) : null;
+    return row ? sessionSchema.parse(JSON.parse(row.data)) : null;
   }
   linkAccount(session, issuer, subject, provider, sealed, login, profile) {
     if (session.principal.kind !== "member")
@@ -21263,13 +21549,21 @@ var AuthStore = class extends DurableObject3 {
       signInEnabled: !!row.login
     }));
   }
-  async resolve(token) {
+  async resolve(token, integrationId) {
+    const digest = await hash2(token);
     const row = this.ctx.storage.sql.exec(
       "SELECT data FROM sessions WHERE hash=? AND expires>?",
-      await hash2(token),
+      digest,
       Date.now()
     ).toArray()[0];
-    return row ? sessionSchema2.parse(JSON.parse(row.data)) : null;
+    if (!row) return null;
+    const binding = this.ctx.storage.sql.exec(
+      "SELECT i.data,s.integration FROM integration_sessions s LEFT JOIN identity_integrations i ON i.id=s.integration WHERE s.hash=?",
+      digest
+    ).toArray()[0];
+    if (binding && (binding.integration !== integrationId || !binding.data || identityIntegrationSchema.parse(JSON.parse(binding.data)).expiresAt <= Date.now()))
+      return null;
+    return sessionSchema.parse(JSON.parse(row.data));
   }
   async revoke(token) {
     this.ctx.storage.sql.exec(
@@ -21281,16 +21575,6 @@ var AuthStore = class extends DurableObject3 {
 
 // apps/api/src/github-repositories.ts
 init_zod();
-
-// apps/api/src/access-error.ts
-var AccessError = class extends Error {
-  constructor(message2, status = 403) {
-    super(message2);
-    this.status = status;
-  }
-};
-
-// apps/api/src/github-repositories.ts
 var githubRepositorySchema = external_exports.object({
   kind: external_exports.literal("github"),
   owner: external_exports.string().regex(/^[A-Za-z0-9-]+$/),
@@ -22948,6 +23232,9 @@ function localParticipantRequest(request, env) {
   return env.LOCAL_DEVELOPMENT === "true" && ["localhost", "127.0.0.1", "[::1]"].includes(new URL(request.url).hostname);
 }
 
+// apps/api/src/management.ts
+init_dist();
+
 // apps/api/src/development-preflight.ts
 function stagingConfigurationIssues(env) {
   const required2 = {
@@ -32724,6 +33011,39 @@ async function managementRoutes(request, env) {
     }
     if (!organization || !(await store.projects(organization)).some((p) => p.project === project))
       throw new AccessError("Project not found", 404);
+    if (path === "/identity-integrations" || path.startsWith("/identity-integrations/")) {
+      if (personal || cliSession || !admin)
+        throw new AccessError(
+          "An organization administrator must manage identity integrations in Console"
+        );
+      const auth = env.AUTH.getByName("auth-v1");
+      const scope = { organization, project, environment };
+      if (path === "/identity-integrations" && request.method === "GET")
+        return respond(await auth.integrations(scope));
+      if (path === "/identity-integrations" && request.method === "POST")
+        return respond(
+          await auth.createIntegration(
+            scope,
+            identityIntegrationInputSchema.parse(await request.json()),
+            actor
+          ),
+          201
+        );
+      const match2 = path.match(
+        /^\/identity-integrations\/([\w-]+)(\/rotate)?$/
+      );
+      if (match2 && (match2[2] && request.method === "POST" || !match2[2] && request.method === "DELETE")) {
+        return respond(
+          await auth.changeIntegration(
+            scope,
+            external_exports.string().uuid().parse(match2[1]),
+            actor,
+            !!match2[2]
+          )
+        );
+      }
+      throw new AccessError("Identity integration route not found", 404);
+    }
     if (path === "/development/session" && ["POST", "PUT", "DELETE"].includes(request.method)) {
       requirePermission("publish");
       if (environment !== "test")
@@ -32832,11 +33152,22 @@ async function managementRoutes(request, env) {
           message: repository?.status === "ready" ? "Hosted repository is ready." : "Create a hosted repository before staging."
         }
       ];
+      const integrations = await env.AUTH.getByName("auth-v1").integrations({
+        organization,
+        project,
+        environment
+      });
       const developmentMissing = previewConfigurationIssues(env);
       return respond({
         organization,
         project,
         environment,
+        identity: {
+          exchange: "supported",
+          activeIntegrations: integrations.filter(
+            (item) => item.expiresAt > Date.now()
+          ).length
+        },
         development: {
           status: developmentMissing.length || authIssues.length ? "blocked" : "configured",
           missing: developmentMissing,
@@ -33831,7 +34162,7 @@ function authScope(env) {
 // apps/api/src/oauth-routes.ts
 var intentSchema = external_exports.discriminatedUnion("mode", [
   external_exports.object({ mode: external_exports.literal("sign-in"), scope: authScopeSchema }),
-  external_exports.object({ mode: external_exports.literal("connect"), session: sessionSchema2 })
+  external_exports.object({ mode: external_exports.literal("connect"), session: sessionSchema })
 ]);
 var returnSchema = external_exports.object({
   origin: external_exports.string().url(),
@@ -34221,7 +34552,7 @@ async function authRoutes(request, env, session) {
 
 // apps/api/src/index.ts
 var gateway = {
-  async fetch(request, env) {
+  async fetch(request, env, identityIntegration) {
     const git = await gitGateway(request, env);
     if (git) return git;
     const device = await deviceRoutes(request, env);
@@ -34238,7 +34569,7 @@ var gateway = {
     const url2 = new URL(request.url);
     const local = localParticipantRequest(request, env);
     if (!local) {
-      const issues = productionParticipantIssues(env);
+      const issues = identityIntegration ? [] : productionParticipantIssues(env);
       if (issues.length)
         return Response.json(
           { error: "Participant access is not configured for this deployment" },
@@ -34252,13 +34583,13 @@ var gateway = {
           { error: "Participant project has not been provisioned" },
           { status: 503 }
         );
-      if (url2.pathname === "/v1/auth/exchange" || url2.pathname === "/v1/auth/demo")
+      if (url2.pathname === "/v1/auth/demo")
         return Response.json({ error: "Route not found" }, { status: 404 });
     }
     const auth = env.AUTH.getByName("auth-v1");
     const token = sessionToken(request);
     const management = local && !!env.API_TOKEN && request.headers.get("Authorization") === "Bearer " + env.API_TOKEN;
-    const resolvedSession = management ? null : token ? await auth.resolve(token) : null;
+    const resolvedSession = management ? null : token ? await auth.resolve(token, identityIntegration) : null;
     const portalScope = authScope(env);
     const session = resolvedSession && (!local || !request.headers.has("Authorization")) && (resolvedSession.organization !== portalScope.organization || resolvedSession.project !== portalScope.project || resolvedSession.environment !== portalScope.environment) ? null : resolvedSession;
     if (!local && session && session.principal.kind !== "member")
@@ -34640,10 +34971,11 @@ var StagingGateway = class extends WorkerEntrypoint3 {
 };
 var index_default = {
   async fetch(request, env) {
-    const response = await gateway.fetch(
+    const response = await identityIntegrationRequest(
       request,
-      await callbackEnvironment(request, env)
-    );
+      env,
+      (incoming, scoped, id2) => gateway.fetch(incoming, scoped, id2)
+    ) ?? await gateway.fetch(request, await callbackEnvironment(request, env));
     const headers = new Headers(response.headers);
     headers.set("Cache-Control", "no-store");
     return new Response(response.body, { status: response.status, headers });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@domino-sdk/relay-runtime",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "license": "UNLICENSED",
   "type": "module",
   "description": "Local development runtime for Domino Relay",