@domino-sdk/relay 0.2.0 → 0.3.0

package/dist/browser.js

@@ -1,6 +1,7 @@
 import {
   createRelayClient
-} from "./chunk-NC3UAP6T.js";
+} from "./chunk-L757OYXZ.js";
+import "./chunk-6IXQRMGW.js";
 import "./chunk-C2KOMNLG.js";
 
 // src/browser.ts

package/dist/chunk-6IXQRMGW.js

@@ -0,0 +1,37 @@
+import {
+  identifier
+} from "./chunk-C2KOMNLG.js";
+
+// src/auth.ts
+import { z } from "zod";
+var authScopeSchema = z.object({
+  organization: identifier,
+  project: identifier,
+  environment: z.enum(["test", "live"])
+}).strict();
+var principalSchema = z.discriminatedUnion("kind", [
+  z.object({ kind: z.literal("member"), member: identifier }).strict(),
+  z.object({ kind: z.literal("staff"), subject: identifier }).strict(),
+  z.object({ kind: z.literal("operator"), subject: identifier }).strict()
+]);
+var sessionSchema = authScopeSchema.extend({
+  id: identifier,
+  principal: principalSchema,
+  expiresAt: z.number()
+});
+var exchangeSchema = authScopeSchema.extend({
+  identity: z.object({ issuer: identifier, subject: z.string().min(1).max(200) }).strict(),
+  role: z.enum(["member", "staff", "operator"])
+}).strict();
+var exchangeResultSchema = z.object({
+  token: z.string(),
+  session: sessionSchema
+});
+
+export {
+  authScopeSchema,
+  principalSchema,
+  sessionSchema,
+  exchangeSchema,
+  exchangeResultSchema
+};

package/dist/{chunk-NC3UAP6T.js → chunk-L757OYXZ.js}

@@ -1,3 +1,8 @@
+import {
+  authScopeSchema,
+  exchangeResultSchema,
+  sessionSchema
+} from "./chunk-6IXQRMGW.js";
 import {
   attemptSchema,
   entitlementSchema,
@@ -572,80 +577,54 @@ function observeProgress(transport, listener, options = {}, onDispose = () => {
 // src/index.ts
 import { z as z7 } from "zod";
 
-// src/auth.ts
-import { z as z3 } from "zod";
-var authScopeSchema = z3.object({
-  organization: identifier,
-  project: identifier,
-  environment: z3.enum(["test", "live"])
-}).strict();
-var principalSchema = z3.discriminatedUnion("kind", [
-  z3.object({ kind: z3.literal("member"), member: identifier }).strict(),
-  z3.object({ kind: z3.literal("staff"), subject: identifier }).strict(),
-  z3.object({ kind: z3.literal("operator"), subject: identifier }).strict()
-]);
-var sessionSchema = authScopeSchema.extend({
-  id: identifier,
-  principal: principalSchema,
-  expiresAt: z3.number()
-});
-var exchangeSchema = authScopeSchema.extend({
-  identity: z3.object({ issuer: identifier, subject: z3.string().min(1).max(200) }).strict(),
-  role: z3.enum(["member", "staff", "operator"])
-}).strict();
-var exchangeResultSchema = z3.object({
-  token: z3.string(),
-  session: sessionSchema
-});
-
 // src/wallet.ts
-import { z as z4 } from "zod";
-var solanaAddressSchema = z4.string().min(32).max(44).regex(/^[1-9A-HJ-NP-Za-km-z]+$/);
-var walletConnectionSchema = z4.object({
-  chain: z4.literal("solana"),
+import { z as z3 } from "zod";
+var solanaAddressSchema = z3.string().min(32).max(44).regex(/^[1-9A-HJ-NP-Za-km-z]+$/);
+var walletConnectionSchema = z3.object({
+  chain: z3.literal("solana"),
   address: solanaAddressSchema,
-  verifiedAt: z4.number().int().nonnegative(),
-  revision: z4.number().int().positive()
+  verifiedAt: z3.number().int().nonnegative(),
+  revision: z3.number().int().positive()
 }).strict();
-var walletChallengeInputSchema = z4.object({
-  chain: z4.literal("solana"),
+var walletChallengeInputSchema = z3.object({
+  chain: z3.literal("solana"),
   address: solanaAddressSchema
 }).strict();
 var walletChallengeSchema = walletChallengeInputSchema.extend({
-  id: z4.string().uuid(),
-  message: z4.string(),
-  expiresAt: z4.number()
+  id: z3.string().uuid(),
+  message: z3.string(),
+  expiresAt: z3.number()
 });
-var walletProofSchema = z4.object({
-  challenge: z4.string().uuid(),
-  signature: z4.string().min(64).max(88).regex(/^[1-9A-HJ-NP-Za-km-z]+$/)
+var walletProofSchema = z3.object({
+  challenge: z3.string().uuid(),
+  signature: z3.string().min(64).max(88).regex(/^[1-9A-HJ-NP-Za-km-z]+$/)
 }).strict();
-var solanaBalanceSchema = z4.object({
+var solanaBalanceSchema = z3.object({
   address: solanaAddressSchema,
-  network: z4.literal("mainnet-beta"),
-  lamports: z4.string().regex(/^(0|[1-9][0-9]*)$/),
-  slot: z4.number().int().nonnegative().safe(),
-  observedAt: z4.number().int().nonnegative()
+  network: z3.literal("mainnet-beta"),
+  lamports: z3.string().regex(/^(0|[1-9][0-9]*)$/),
+  slot: z3.number().int().nonnegative().safe(),
+  observedAt: z3.number().int().nonnegative()
 }).strict();
 
 // src/collection.ts
-import { z as z5 } from "zod";
-var collectionCodeSchema = z5.string().regex(/^relay:collect:[a-f0-9]{64}$/);
-var collectionPassSchema = z5.object({
+import { z as z4 } from "zod";
+var collectionCodeSchema = z4.string().regex(/^relay:collect:[a-f0-9]{64}$/);
+var collectionPassSchema = z4.object({
   code: collectionCodeSchema,
-  expiresAt: z5.number(),
+  expiresAt: z4.number(),
   entitlement: identifier
 });
-var collectionResolveSchema = z5.object({ code: collectionCodeSchema }).strict();
+var collectionResolveSchema = z4.object({ code: collectionCodeSchema }).strict();
 var collectionBeginSchema = collectionResolveSchema.extend({
   actionId: identifier,
-  revision: z5.number().int().positive(),
+  revision: z4.number().int().positive(),
   selection: pickupSelectionSchema.optional()
 });
-var collectionPreviewSchema = z5.object({
+var collectionPreviewSchema = z4.object({
   entitlement: entitlementSchema,
   inventory: pickupAvailabilitySchema,
-  expiresAt: z5.number()
+  expiresAt: z4.number()
 });
 
 // src/configuration.ts
@@ -663,26 +642,51 @@ function questConfiguration(release) {
 }
 
 // src/deployments.ts
-import { z as z6 } from "zod";
+import { z as z5 } from "zod";
 var projectDeploymentSchema = catalogDeploymentSchema.omit({ expectedRevision: true }).extend({
-  releases: z6.array(releaseSchema).max(50).default([])
+  releases: z5.array(releaseSchema).max(50).default([])
 }).refine(
   (value) => value.releases.length > 0 || value.types.length > 0 || value.collections.length > 0 || value.supportedInteractions !== void 0,
   "No resources configured. Add quests, questTypes, collections, or supportedInteractions to relay.json."
 );
-var deploymentPreviewSchema = z6.object({
+var deploymentPreviewSchema = z5.object({
   id: identifier,
-  baseRevision: z6.number().int().nonnegative(),
-  releases: z6.array(publishedReleaseSchema),
-  types: z6.array(questTypeVersionSchema),
-  collections: z6.array(questCollectionSchema),
-  supportedInteractions: z6.array(interactionSchema)
+  baseRevision: z5.number().int().nonnegative(),
+  releases: z5.array(publishedReleaseSchema),
+  types: z5.array(questTypeVersionSchema),
+  collections: z5.array(questCollectionSchema),
+  supportedInteractions: z5.array(interactionSchema)
 });
-var publishDeploymentSchema = z6.object({ id: identifier }).strict();
+var publishDeploymentSchema = z5.object({ id: identifier }).strict();
 var deploymentResultSchema = deploymentPreviewSchema.extend({
-  revision: z6.number().int().positive()
+  revision: z5.number().int().positive()
 });
 
+// src/identity-integration.ts
+import { z as z6 } from "zod";
+var identityIntegrationInputSchema = z6.object({
+  name: z6.string().trim().min(1).max(80),
+  origin: z6.string().url().refine((value) => {
+    const url = new URL(value);
+    return url.protocol === "https:" && url.origin === value;
+  }, "Use an exact HTTPS application origin")
+}).strict();
+var identityIntegrationSchema = authScopeSchema.extend({
+  id: z6.string().uuid(),
+  name: z6.string(),
+  origin: z6.string(),
+  expiresAt: z6.number()
+});
+var identityIntegrationSecretSchema = identityIntegrationSchema.extend(
+  {
+    token: z6.string()
+  }
+);
+var participantExchangeSchema = z6.object({
+  subject: z6.string().min(1).max(200),
+  previousToken: z6.string().max(200).optional()
+}).strict();
+
 // src/index.ts
 function createRelayClient(options) {
   async function send(path, init = {}) {
@@ -904,6 +908,7 @@ function createRelayClient(options) {
       signOut: () => changeSession(
         () => request("/v1/auth/logout", z7.object({ ok: z7.boolean() }), json({}))
       ),
+      /** Local development only. Existing hosted apps use createParticipantBackend from /portal-proxy. */
       exchange: (input) => request("/v1/auth/exchange", exchangeResultSchema, json(input))
     },
     me: {
@@ -1031,11 +1036,6 @@ export {
   QuestUpdatedError,
   reconcileQuestDraft,
   questActions,
-  authScopeSchema,
-  principalSchema,
-  sessionSchema,
-  exchangeSchema,
-  exchangeResultSchema,
   solanaAddressSchema,
   walletConnectionSchema,
   walletChallengeInputSchema,
@@ -1052,5 +1052,9 @@ export {
   deploymentPreviewSchema,
   publishDeploymentSchema,
   deploymentResultSchema,
+  identityIntegrationInputSchema,
+  identityIntegrationSchema,
+  identityIntegrationSecretSchema,
+  participantExchangeSchema,
   createRelayClient
 };

package/dist/index.d.ts

@@ -3502,6 +3502,40 @@ declare const deploymentResultSchema: z.ZodObject<{
 }, z.core.$strip>;
 type DeploymentPreview = z.infer<typeof deploymentPreviewSchema>;
 
+declare const identityIntegrationInputSchema: z.ZodObject<{
+    name: z.ZodString;
+    origin: z.ZodString;
+}, z.core.$strict>;
+declare const identityIntegrationSchema: z.ZodObject<{
+    organization: z.ZodString;
+    project: z.ZodString;
+    environment: z.ZodEnum<{
+        test: "test";
+        live: "live";
+    }>;
+    id: z.ZodString;
+    name: z.ZodString;
+    origin: z.ZodString;
+    expiresAt: z.ZodNumber;
+}, z.core.$strict>;
+declare const identityIntegrationSecretSchema: z.ZodObject<{
+    organization: z.ZodString;
+    project: z.ZodString;
+    environment: z.ZodEnum<{
+        test: "test";
+        live: "live";
+    }>;
+    id: z.ZodString;
+    name: z.ZodString;
+    origin: z.ZodString;
+    expiresAt: z.ZodNumber;
+    token: z.ZodString;
+}, z.core.$strict>;
+declare const participantExchangeSchema: z.ZodObject<{
+    subject: z.ZodString;
+    previousToken: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+
 declare function createRelayClient(options: {
     baseUrl: string;
     token?: string;
@@ -4101,6 +4135,7 @@ declare function createRelayClient(options: {
         signOut: () => Promise<{
             ok: boolean;
         }>;
+        /** Local development only. Existing hosted apps use createParticipantBackend from /portal-proxy. */
         exchange: (input: ExchangeInput) => Promise<{
             token: string;
             session: {
@@ -5775,4 +5810,4 @@ declare function createRelayClient(options: {
     }>;
 };
 
-export { Attempt, type ClaimSubmission, type CollectionPass, type DeploymentPreview, type ExchangeInput, MemberListOptions, MemberProgress, type PhotoSubmission, type ProgressObservation, type ProgressObserver, PublishedRelease, type QuestActionResult, type QuestCatalog, type QuestController, type QuestDraft, type QuestInstance, type QuestInteraction, QuestUpdatedError, type QuestView, QuizEvidence, type QuizSubmission, RelayError, ReleaseInput, ReviewListOptions, type Session, type SubmissionDraft, type SubmissionStatus, type SubmissionStore, SubmitInput, authScopeSchema, beginHandoverSchema, catalogDeploymentPreviewSchema, catalogDeploymentSchema, collectionBeginSchema, collectionCodeSchema, collectionPassSchema, collectionPreviewSchema, collectionResolveSchema, collectionSlotSchema, collectionViewSchema, createRelayClient, deploymentPreviewSchema, deploymentResultSchema, errorSchema, exchangeResultSchema, exchangeSchema, interactionSchema, principalSchema, projectDeploymentSchema, publishDeploymentSchema, publishQuestDraftSchema, questActions, questCatalogSchema, questCollectionSchema, questConfiguration, questDescriptionSchema, questDraftChangesSchema, questDraftSchema, questExperienceSchema, questInstanceSchema, questInteraction, questPublicationPreviewSchema, questTypeVersionSchema, questViewSchema, reconcileQuestDraft, saveQuestDraftSchema, sessionSchema, walletChallengeInputSchema, walletProofSchema };
+export { Attempt, type ClaimSubmission, type CollectionPass, type DeploymentPreview, type ExchangeInput, MemberListOptions, MemberProgress, type PhotoSubmission, type ProgressObservation, type ProgressObserver, PublishedRelease, type QuestActionResult, type QuestCatalog, type QuestController, type QuestDraft, type QuestInstance, type QuestInteraction, QuestUpdatedError, type QuestView, QuizEvidence, type QuizSubmission, RelayError, ReleaseInput, ReviewListOptions, type Session, type SubmissionDraft, type SubmissionStatus, type SubmissionStore, SubmitInput, authScopeSchema, beginHandoverSchema, catalogDeploymentPreviewSchema, catalogDeploymentSchema, collectionBeginSchema, collectionCodeSchema, collectionPassSchema, collectionPreviewSchema, collectionResolveSchema, collectionSlotSchema, collectionViewSchema, createRelayClient, deploymentPreviewSchema, deploymentResultSchema, errorSchema, exchangeResultSchema, exchangeSchema, identityIntegrationInputSchema, identityIntegrationSchema, identityIntegrationSecretSchema, interactionSchema, participantExchangeSchema, principalSchema, projectDeploymentSchema, publishDeploymentSchema, publishQuestDraftSchema, questActions, questCatalogSchema, questCollectionSchema, questConfiguration, questDescriptionSchema, questDraftChangesSchema, questDraftSchema, questExperienceSchema, questInstanceSchema, questInteraction, questPublicationPreviewSchema, questTypeVersionSchema, questViewSchema, reconcileQuestDraft, saveQuestDraftSchema, sessionSchema, walletChallengeInputSchema, walletProofSchema };

package/dist/index.js

@@ -1,7 +1,6 @@
 import {
   QuestUpdatedError,
   RelayError,
-  authScopeSchema,
   catalogDeploymentPreviewSchema,
   catalogDeploymentSchema,
   collectionBeginSchema,
@@ -14,10 +13,11 @@ import {
   createRelayClient,
   deploymentPreviewSchema,
   deploymentResultSchema,
-  exchangeResultSchema,
-  exchangeSchema,
+  identityIntegrationInputSchema,
+  identityIntegrationSchema,
+  identityIntegrationSecretSchema,
   interactionSchema,
-  principalSchema,
+  participantExchangeSchema,
   projectDeploymentSchema,
   publishDeploymentSchema,
   publishQuestDraftSchema,
@@ -35,14 +35,20 @@ import {
   questViewSchema,
   reconcileQuestDraft,
   saveQuestDraftSchema,
-  sessionSchema,
   solanaAddressSchema,
   solanaBalanceSchema,
   walletChallengeInputSchema,
   walletChallengeSchema,
   walletConnectionSchema,
   walletProofSchema
-} from "./chunk-NC3UAP6T.js";
+} from "./chunk-L757OYXZ.js";
+import {
+  authScopeSchema,
+  exchangeResultSchema,
+  exchangeSchema,
+  principalSchema,
+  sessionSchema
+} from "./chunk-6IXQRMGW.js";
 import {
   artifactSchema,
   attemptSchema,
@@ -134,12 +140,16 @@ export {
   exchangeResultSchema,
   exchangeSchema,
   identifier,
+  identityIntegrationInputSchema,
+  identityIntegrationSchema,
+  identityIntegrationSecretSchema,
   interactionSchema,
   mediaUrlSchema,
   memberListSchema,
   memberPageSchema,
   memberProgressSchema,
   parseSettings,
+  participantExchangeSchema,
   photoResultSchema,
   pickupAllocationSchema,
   pickupAvailabilitySchema,

package/dist/portal-proxy.d.ts

@@ -1,7 +1,22 @@
-/** Server-only proxy: browser cookies stay on the participant origin. */
+/**
+ * Server-only proxy: browser cookies stay on the participant origin.
+ * Point upstream at a participant deployment with trusted server scope configured.
+ * Browser Authorization and organization/project/environment selectors are discarded.
+ * This does not provide backend identity exchange or configure upstream scope.
+ */
 declare function proxyParticipant(request: Request, upstream: {
     baseUrl: string;
     fetch: typeof fetch;
 }): Promise<Response>;
+/** Use only in an app server route. authenticate must verify the app's own session. */
+declare function createParticipantBackend(options: {
+    baseUrl: string;
+    integrationKey: string;
+    origin: string;
+    authenticate: (request: Request) => Promise<{
+        subject: string;
+    } | null>;
+    fetch?: typeof fetch;
+}): (request: Request) => Promise<Response>;
 
-export { proxyParticipant };
+export { createParticipantBackend, proxyParticipant };

package/dist/portal-proxy.js

@@ -1,3 +1,8 @@
+import {
+  exchangeResultSchema
+} from "./chunk-6IXQRMGW.js";
+import "./chunk-C2KOMNLG.js";
+
 // src/portal-proxy.ts
 async function proxyParticipant(request, upstream) {
   const incoming = new URL(request.url);
@@ -43,6 +48,74 @@ async function proxyParticipant(request, upstream) {
     headers: resultHeaders
   });
 }
+function createParticipantBackend(options) {
+  const origin = new URL(options.origin);
+  const base = new URL(options.baseUrl);
+  if (origin.protocol !== "https:" || origin.origin !== options.origin || base.protocol !== "https:" || base.origin !== options.baseUrl)
+    throw new Error(
+      "Configure exact HTTPS application and participant API origins"
+    );
+  if (!options.integrationKey.startsWith("di_"))
+    throw new Error(
+      "Use an identity integration server key from Console Settings"
+    );
+  const send = options.fetch ?? fetch;
+  const cookie = (token) => `domino_app_session=${token}; Path=/relay; HttpOnly; Secure; SameSite=Strict; Max-Age=${token ? 28800 : 0}`;
+  return async (request) => {
+    const url = new URL(request.url);
+    const reject = (error, status) => Response.json(
+      { error },
+      { status, headers: { "Cache-Control": "no-store" } }
+    );
+    if (url.origin !== options.origin)
+      return reject("Unexpected application origin", 403);
+    if (request.method !== "GET" && (request.headers.get("Origin") !== options.origin || request.headers.get("X-Relay-CSRF") !== "1"))
+      return reject("Untrusted browser request", 403);
+    const identity = await options.authenticate(request);
+    if (!identity)
+      return Response.json(
+        url.pathname === "/relay/v1/auth/session" ? null : { error: "Sign in to the application" },
+        {
+          status: url.pathname === "/relay/v1/auth/session" ? 200 : 401,
+          headers: { "Set-Cookie": cookie(""), "Cache-Control": "no-store" }
+        }
+      );
+    const previousToken = request.headers.get("Cookie")?.split(";").map((value) => value.trim()).find((value) => value.startsWith("domino_app_session="))?.slice("domino_app_session=".length);
+    const exchanged = await send(options.baseUrl + "/v1/auth/exchange", {
+      method: "POST",
+      redirect: "error",
+      headers: {
+        Authorization: "Bearer " + options.integrationKey,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({ subject: identity.subject, previousToken })
+    });
+    if (!exchanged.ok)
+      return reject(
+        "Domino identity exchange failed. Check the server integration key and its expiry in Console Settings.",
+        exchanged.status
+      );
+    const { token } = exchangeResultSchema.parse(await exchanged.json());
+    const response = await proxyParticipant(request, {
+      baseUrl: options.baseUrl,
+      fetch: async (target, init) => {
+        const headers2 = new Headers(init?.headers);
+        headers2.delete("Cookie");
+        headers2.set("Authorization", "Bearer " + token);
+        headers2.set("X-Relay-Integration-Key", options.integrationKey);
+        headers2.set("Origin", options.origin);
+        return send(target, { ...init, headers: headers2, redirect: "error" });
+      }
+    });
+    const headers = new Headers(response.headers);
+    headers.set(
+      "Set-Cookie",
+      cookie(url.pathname === "/relay/v1/auth/logout" ? "" : token)
+    );
+    return new Response(response.body, { status: response.status, headers });
+  };
+}
 export {
+  createParticipantBackend,
   proxyParticipant
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@domino-sdk/relay",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "type": "module",
   "exports": {
     ".": {