@domino-sdk/relay 1.0.0-next.10 → 1.0.0-next.13

package/dist/server/index.js

@@ -0,0 +1,1884 @@
+import {
+  deploymentPreviewSchema,
+  deploymentResultSchema,
+  projectDeploymentSchema,
+  publishDeploymentSchema
+} from "../chunk-KS33GOUL.js";
+import {
+  identityIntegrationInputSchema,
+  identityIntegrationSchema,
+  identityIntegrationSecretSchema
+} from "../chunk-MNQI35OG.js";
+import {
+  imageAssetArtifactSchema
+} from "../chunk-II7DRZSL.js";
+import "../chunk-6A2V4L3T.js";
+import {
+  allocateQuestSchema,
+  allocatedQuestSchema,
+  catalogDeploymentPreviewSchema,
+  catalogDeploymentSchema,
+  collectionBeginSchema,
+  collectionPreviewSchema,
+  collectionResolveSchema,
+  createPointLedgerSchema,
+  pointLedgerSchema,
+  publishQuestDraftSchema,
+  questCatalogSchema,
+  questDraftSchema,
+  questPublicationPreviewSchema,
+  rewardDeliveriesSchema,
+  rewardDeliverySchema,
+  saveQuestDraftSchema
+} from "../chunk-M64XHC42.js";
+import {
+  RequestError,
+  engagementBoundaryPageSchema,
+  engagementChangePreviewInputSchema,
+  engagementChangePreviewSchema,
+  engagementChangeSchema,
+  engagementPageQuerySchema,
+  engagementPageSchema,
+  engagementPublishSchema,
+  engagementRuleSchema,
+  engagementVersionPageSchema,
+  engagementVersionQuerySchema,
+  evmChainIdSchema,
+  isRequestError,
+  leaderboardExclusionSchema,
+  leaderboardGroupSchema,
+  leaderboardPageSchema,
+  leaderboardQuerySchema,
+  linkedWalletSchema,
+  managedProfileSchema,
+  pointsAccountSchema,
+  pointsEntrySchema,
+  pointsMutationSchema,
+  pointsResultSchema,
+  profileModerationSchema,
+  profileSettingsInputSchema,
+  profileSettingsSchema,
+  publishedLeaderboardSchema,
+  publishedReferralSchema,
+  referralControlSchema,
+  referralHistorySchema,
+  referralManagementSchema,
+  solanaBalanceSchema,
+  solanaMainnet,
+  walletBalanceSchema,
+  walletConnectionSchema,
+  walletSignInNetworksSchema,
+  walletUnlinkInputSchema
+} from "../chunk-OA2KMQVZ.js";
+import "../chunk-FXYJ4OMX.js";
+import {
+  attemptSchema,
+  authProviderSchema,
+  beginHandoverSchema,
+  configurePickupSchema,
+  confirmHandoverSchema,
+  contentAdmissionPageSchema,
+  contentAdmissionQuerySchema,
+  contentAdmissionSchema,
+  contentEnrollmentInputSchema,
+  contentEnrollmentSchema,
+  contentPerformancePageSchema,
+  contentPerformanceQuerySchema,
+  contentQualificationPageSchema,
+  contentQualificationQuerySchema,
+  contentReleaseInputSchema,
+  createStockItemSchema,
+  entitlementSchema,
+  identifier,
+  memberProgressSchema,
+  observationInputSchema,
+  observationReceiptSchema,
+  pickupAvailabilitySchema,
+  pickupCatalogSchema,
+  projectCalendarInputSchema,
+  projectCalendarSchema,
+  publishedReleaseSchema,
+  questSettingsInputSchema,
+  snapshotSchema,
+  staffDecisionSchema,
+  stockItemSchema,
+  submitSchema,
+  trackerContentReadSchema,
+  trackerContentSchema,
+  trackerControlSchema,
+  trackerIngestResultSchema,
+  trackerIngestSchema,
+  trackerOutcomePageSchema,
+  trackerOutcomeQuerySchema,
+  trackerOutcomeRetrySchema,
+  trackerOutcomeSchema,
+  trackerPageSchema,
+  trackerPreviewInputSchema,
+  trackerPreviewSchema,
+  trackerQuerySchema,
+  trackerStatusSchema,
+  trackerSummarySchema
+} from "../chunk-CRNQP7NV.js";
+
+// src/server/index.ts
+import { z as z5 } from "zod";
+
+// src/server/errors.ts
+var ManagementErrorCode = {
+  /** The input or an option failed validation before anything was sent (kind `client`). */
+  InvalidInput: "invalid-input",
+  /** The client's `getToken` failed before anything was sent (kind `client` or `network`). */
+  Credential: "credential",
+  Network: "network",
+  Timeout: "timeout",
+  Aborted: "aborted",
+  InvalidResponse: "invalid-response"
+};
+var uncertainStatuses = /* @__PURE__ */ new Set([500, 502, 504]);
+function uncertainOutcome(init) {
+  if (init.method === void 0 || init.method === "GET") {
+    return false;
+  }
+  switch (init.kind) {
+    case "network":
+    case "timeout":
+    case "aborted":
+      return true;
+    case "http":
+      return uncertainStatuses.has(init.status ?? 0);
+    case "invalid-response":
+      return (init.status ?? 0) >= 200 && (init.status ?? 0) < 300;
+    default:
+      return false;
+  }
+}
+var managementErrorBrand = /* @__PURE__ */ Symbol.for("@domino-sdk/relay.ManagementError");
+function isManagementError(value) {
+  return isRequestError(value) && value[managementErrorBrand] === true;
+}
+var ManagementError = class extends RequestError {
+  name = "ManagementError";
+  [managementErrorBrand] = true;
+  /** The rest of the server's error body besides `error` and `code`, such as `moved`; absent when there is none. */
+  details;
+  /** The request's method; absent when the call failed before forming a request. */
+  method;
+  /** The management API path, below `/management/v1`, without its query; absent like `method`. */
+  path;
+  constructor(init) {
+    super(init.message, {
+      kind: init.kind,
+      uncertain: init.uncertain ?? uncertainOutcome(init),
+      status: init.status,
+      code: init.code,
+      operationId: init.actionId,
+      cause: init.cause
+    });
+    this.details = init.details && Object.keys(init.details).length ? init.details : void 0;
+    this.method = init.method;
+    this.path = init.path;
+  }
+};
+var DEFAULT_MANAGEMENT_TIMEOUT = 3e4;
+
+// src/server/hosting.ts
+import { z as z2 } from "zod";
+
+// src/server/starters.ts
+import { z } from "zod";
+var starterTemplates = [
+  {
+    id: "campaign",
+    title: "Campaign tour",
+    summary: "A neutral quest app with a guided tour of every quest kind. The blank canvas for anything."
+  },
+  {
+    id: "classic",
+    title: "Classic questboard",
+    summary: "The familiar Domino portal: quests in a grid grouped by section, a claim page, points, and a leaderboard."
+  },
+  {
+    id: "waitlist",
+    title: "Waitlist",
+    summary: "Collect sign-ups before launch. People move up the line by inviting friends."
+  },
+  {
+    id: "referral",
+    title: "Referral program",
+    summary: "Give every member an invite link and reward them when friends join and qualify."
+  },
+  {
+    id: "discord",
+    title: "Discord activation",
+    summary: "Turn new Discord members into regulars with quests for joining, introducing themselves, and taking part, rewarded with roles."
+  },
+  {
+    id: "api",
+    title: "API",
+    summary: "A headless Worker with typed routes and interactive API docs, for plugging Domino into your own product."
+  }
+];
+var starterIdSchema = z.enum(
+  starterTemplates.map((template) => template.id)
+);
+
+// src/server/hosting.ts
+var outputPathSchema = z2.string().min(1).max(512).refine(
+  (path) => path.split("/").every(
+    (part) => /^[\w-][\w.-]*$/.test(part) && part !== "node_modules"
+  ),
+  "Expected a relative build output path without hidden segments"
+);
+var appRoutingSchema = z2.enum(["legacy", "transparent"]).default("legacy");
+var APP_SECRET_LIMIT = 50;
+var appSecretNameSchema = z2.string().regex(
+  /^[A-Z_][A-Z0-9_]{0,63}$/,
+  "Use 1-64 uppercase letters, digits, and underscores, not starting with a digit"
+).refine(
+  (name) => !name.startsWith("DOMINO_") && name !== "ASSETS",
+  "DOMINO_ names and ASSETS are reserved for Domino's own bindings"
+);
+var appSecretValueSchema = z2.string().min(1).refine(
+  (value) => new TextEncoder().encode(value).length <= 5120,
+  "Secret values can be at most 5 KiB"
+);
+var appSecretInputSchema = z2.object({ value: appSecretValueSchema }).strict();
+var appSecretSchema = z2.object({
+  name: appSecretNameSchema,
+  updatedAt: z2.number(),
+  updatedBy: z2.string()
+});
+var appSecretDeclarationSchema = z2.object({
+  description: z2.string().trim().min(1).max(500),
+  required: z2.boolean().default(true)
+}).strict();
+var appSecretDeclarationsSchema = z2.record(appSecretNameSchema, appSecretDeclarationSchema).refine(
+  (secrets) => Object.keys(secrets).length <= APP_SECRET_LIMIT,
+  `Declare at most ${APP_SECRET_LIMIT} app secrets`
+);
+var appSecretListSchema = z2.object({
+  secrets: z2.array(appSecretSchema),
+  declared: z2.array(appSecretDeclarationSchema.extend({ name: appSecretNameSchema })).default([])
+});
+var hostedAppSecretsSchema = z2.object({ secrets: z2.record(appSecretNameSchema, appSecretValueSchema) }).strict();
+var appScripts = {
+  routing: appRoutingSchema,
+  devScript: z2.string().regex(/^[\w:-]+$/),
+  checkScript: z2.string().regex(/^[\w:-]+$/),
+  buildScript: z2.string().regex(/^[\w:-]+$/)
+};
+var workerSettings = {
+  runWorkerFirst: z2.boolean().default(false),
+  main: outputPathSchema.refine(
+    (path) => /\.m?js$/.test(path),
+    "Expected a compiled JavaScript entry"
+  ),
+  compatibilityDate: z2.string().regex(/^\d{4}-\d{2}-\d{2}$/),
+  compatibilityFlags: z2.array(z2.string().min(1)).max(50).default([]),
+  vars: z2.record(
+    z2.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/).refine((name) => name !== "ASSETS"),
+    z2.string()
+  ).default({}),
+  secrets: appSecretDeclarationsSchema.default({})
+};
+var distinctBindings = (worker) => !Object.keys(worker.secrets).some((name) => name in worker.vars);
+var distinctBindingsMessage = {
+  message: "A name can't be both an app var and a declared secret",
+  path: ["secrets"]
+};
+var hostedAppSchema = z2.discriminatedUnion("kind", [
+  z2.object({
+    kind: z2.literal("static"),
+    directory: outputPathSchema,
+    ...appScripts
+  }).strict(),
+  z2.object({
+    kind: z2.literal("worker"),
+    directory: outputPathSchema,
+    assetsDirectory: outputPathSchema.optional(),
+    ...appScripts,
+    ...workerSettings
+  }).strict().refine(distinctBindings, distinctBindingsMessage)
+]);
+var repositorySchema = z2.object({
+  id: z2.string().uuid(),
+  organization: identifier,
+  project: identifier,
+  remote: z2.string().url(),
+  defaultBranch: z2.string(),
+  status: z2.enum(["provisioning", "ready"])
+});
+var createRepositorySchema = z2.object({
+  /** Omitted: the starter chosen at project setup, else `campaign`. */
+  starter: starterIdSchema.optional()
+}).strict();
+var deviceStartSchema = z2.object({
+  challenge: z2.string().regex(/^[a-f0-9]{64}$/)
+}).strict();
+var deviceRedeemSchema = z2.object({
+  id: z2.string().uuid(),
+  verifier: z2.string().min(43).max(128)
+}).strict();
+var deviceApproveSchema = z2.object({
+  id: z2.string().uuid(),
+  code: z2.string().regex(/^[A-F0-9]{4}-[A-F0-9]{4}$/)
+}).strict();
+var commitSchema = z2.string().regex(/^[a-f0-9]{40}$/);
+var stageRequestSchema = z2.object({
+  commit: commitSchema,
+  requestId: z2.string().uuid()
+}).strict();
+var buildIdentitySchema = z2.object({
+  routing: appRoutingSchema,
+  slug: z2.string().min(1).max(35).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/).optional(),
+  runtime: z2.enum(["simulation", "hosted-test"]).default("simulation"),
+  id: z2.string().uuid(),
+  repository: z2.string().uuid(),
+  organization: identifier,
+  project: identifier,
+  commit: commitSchema,
+  createdAt: z2.number(),
+  actor: z2.string(),
+  commitMessage: z2.string().max(500).optional()
+});
+var buildPhaseSchema = z2.enum([
+  "queued",
+  "source",
+  "install",
+  "check",
+  "build",
+  "deploy",
+  "ready",
+  "failed"
+]);
+var buildStatusSchema = z2.object({
+  phase: buildPhaseSchema,
+  failedPhase: buildPhaseSchema.optional(),
+  updatedAt: z2.number(),
+  message: z2.string()
+});
+var hostedBuildSchema = buildIdentitySchema.extend({
+  ...buildStatusSchema.shape,
+  finished: z2.boolean(),
+  current: z2.boolean(),
+  stagingUrl: z2.string().url()
+});
+var stagingAccessModeSchema = z2.enum(["console", "password"]);
+var stagingAccessSchema = z2.object({ mode: stagingAccessModeSchema });
+var stagingAccessInputSchema = z2.discriminatedUnion("mode", [
+  z2.object({ mode: z2.literal("console") }).strict(),
+  z2.object({
+    mode: z2.literal("password"),
+    password: z2.string().min(8).max(128)
+  }).strict()
+]);
+var stagingPathSchema = z2.string().max(2048).refine(
+  (path) => path.startsWith("/") && !path.startsWith("//") && !path.includes("\\"),
+  "Expected a path on the staging host"
+);
+var stagingLinkSchema = z2.object({
+  url: z2.string().url(),
+  expiresAt: z2.number()
+});
+var buildSnapshotSchema = z2.object({
+  builds: z2.array(hostedBuildSchema),
+  current: hostedBuildSchema.nullable(),
+  selected: hostedBuildSchema.nullable(),
+  logs: z2.string()
+});
+var assetPathSchema = z2.string().max(512).refine(
+  (path) => path.startsWith("/") && // oxlint-disable-next-line no-control-regex -- Asset paths must reject control characters.
+  !/[\\\u0000-\u001f?#%]/.test(path) && path.slice(1).split("/").every((part) => part.length > 0 && !part.startsWith(".")),
+  "Expected a public asset path without hidden segments"
+);
+var base64Schema = z2.string().regex(/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/);
+var stagedDeploymentLimits = {
+  /** Bytes of JSON, uncompressed. */
+  size: 64e6,
+  /** Bytes of the Brotli-compressed object. */
+  compressedSize: 1e7
+};
+var stagedDeploymentSchema = z2.object({
+  encoding: z2.literal("br"),
+  sha256: z2.string().regex(/^[0-9a-f]{64}$/),
+  compressedSize: z2.number().int().positive().max(stagedDeploymentLimits.compressedSize),
+  size: z2.number().int().positive().max(stagedDeploymentLimits.size)
+}).strict();
+var stagedDeploymentContentSchema = stagedDeploymentSchema.extend({
+  content: z2.string().max(Math.ceil(stagedDeploymentLimits.compressedSize / 3) * 4)
+}).strict();
+var stagedDeploymentKey = (build, sha256) => `builds/${build}/deployment/${sha256}.br`;
+var artifactFields = {
+  routing: appRoutingSchema,
+  worker: z2.object({
+    ...workerSettings,
+    modules: z2.array(
+      z2.object({
+        path: outputPathSchema.refine((path) => path !== "metadata"),
+        type: z2.enum([
+          "application/javascript+module",
+          "application/wasm",
+          "text/plain",
+          "application/octet-stream"
+        ]),
+        content: base64Schema.max(14e6)
+      }).strict()
+    ).min(1).max(500)
+  }).strict().refine(distinctBindings, distinctBindingsMessage).optional(),
+  assets: z2.array(
+    z2.object({
+      path: assetPathSchema,
+      content: base64Schema.max(14e6),
+      size: z2.number().int().min(0).max(1e7)
+    }).strict()
+  ).max(500)
+};
+var buildArtifactsSchema = z2.discriminatedUnion("format", [
+  z2.object({
+    format: z2.literal(1),
+    ...artifactFields,
+    quests: z2.unknown(),
+    catalog: z2.unknown()
+  }).strict(),
+  z2.object({
+    format: z2.literal(2),
+    ...artifactFields,
+    deployment: stagedDeploymentSchema,
+    images: z2.array(imageAssetArtifactSchema).max(10)
+  }).strict()
+]).superRefine((value, ctx) => {
+  if (value.worker) {
+    const modules = value.worker.modules;
+    if (new Set(modules.map((m) => m.path)).size !== modules.length) {
+      ctx.addIssue({
+        code: "custom",
+        message: "Duplicate Worker module paths"
+      });
+    }
+    if (!modules.some(
+      (m) => m.path === value.worker?.main && m.type === "application/javascript+module"
+    )) {
+      ctx.addIssue({
+        code: "custom",
+        message: "Worker entry module is missing"
+      });
+    }
+    if (modules.reduce(
+      (sum, m) => sum + m.content.length * 3 / 4 - (m.content.endsWith("==") ? 2 : m.content.endsWith("=") ? 1 : 0),
+      0
+    ) > 1e7) {
+      ctx.addIssue({
+        code: "custom",
+        message: "Worker modules exceed 10 MB"
+      });
+    }
+  }
+  if (new Set(value.assets.map((a) => a.path)).size !== value.assets.length) {
+    ctx.addIssue({ code: "custom", message: "Duplicate asset paths" });
+  }
+  if (!value.worker && !value.assets.some((a) => a.path === "/index.html")) {
+    ctx.addIssue({
+      code: "custom",
+      message: "Build must include index.html"
+    });
+  }
+  if (value.assets.reduce((sum, a) => sum + a.size, 0) > 1e7) {
+    ctx.addIssue({ code: "custom", message: "Staging assets exceed 10 MB" });
+  }
+});
+
+// src/server/development.ts
+import { z as z3 } from "zod";
+var developmentPreflightSchema = z3.object({
+  organization: z3.string(),
+  project: z3.string(),
+  environment: z3.enum(["test", "live"]),
+  identity: z3.object({
+    exchange: z3.literal("supported"),
+    activeIntegrations: z3.number().int().nonnegative()
+  }).optional(),
+  staging: z3.enum(["configured", "blocked"]),
+  development: z3.object({
+    status: z3.enum(["configured", "blocked"]),
+    // How `domino dev` reaches the preview origin: a Cloudflare tunnel, or a direct route on a
+    // local development stack. APIs that predate the field use tunnels.
+    transport: z3.enum(["tunnel", "direct"]).default("tunnel"),
+    missing: z3.array(z3.string()),
+    authentication: z3.array(z3.string())
+  }),
+  checks: z3.array(
+    z3.object({
+      id: z3.string(),
+      status: z3.enum(["ok", "error"]),
+      message: z3.string(),
+      missing: z3.array(z3.string()).optional(),
+      issues: z3.array(z3.string()).optional()
+    })
+  )
+});
+
+// src/server/hosted.ts
+import { z as z4 } from "zod";
+var hostedKeyPermissions = ["read", "points", "ingest"];
+var hostedKeyPermissionList = z4.array(z4.string()).transform(
+  (values) => values.filter(
+    (value) => hostedKeyPermissions.includes(value)
+  )
+);
+var hostedManagementBindings = [
+  "DOMINO_MANAGEMENT_KEY",
+  "DOMINO_API_URL",
+  "DOMINO_ORGANIZATION",
+  "DOMINO_PROJECT",
+  "DOMINO_ENVIRONMENT"
+];
+var hostedKeySecretSchema = z4.string().regex(/^dhk_[A-Za-z0-9_-]{43}$/, "Expected a hosted app key");
+var hostedKeySchema = z4.object({
+  id: z4.string().uuid(),
+  token: hostedKeySecretSchema,
+  organization: identifier,
+  project: identifier,
+  environment: z4.enum(["test", "live"]),
+  permissions: hostedKeyPermissionList,
+  expiresAt: z4.number().nullable()
+}).strict();
+var hostedDeploymentKeySchema = hostedKeySchema.extend({ apiUrl: z4.string().url() }).strict();
+function hostedManagementClient(env) {
+  const missing = hostedManagementBindings.filter((name) => !env[name]);
+  if (missing.length) {
+    throw new Error(
+      `Missing ${missing.join(", ")}. Domino sets these for hosted apps and domino dev; update the project's vite.config.ts to forward them in development.`
+    );
+  }
+  const environment = z4.enum(["test", "live"]).parse(env.DOMINO_ENVIRONMENT);
+  const token = env.DOMINO_MANAGEMENT_KEY;
+  return createManagementClient({
+    baseUrl: env.DOMINO_API_URL.replace(/\/+$/, ""),
+    getToken: async () => token,
+    organization: env.DOMINO_ORGANIZATION,
+    project: env.DOMINO_PROJECT,
+    environment
+  });
+}
+
+// src/server/index.ts
+var environmentSchema = z5.enum(["test", "live"]);
+var roleSchema = z5.enum(["editor", "reviewer", "staff"]);
+var permissionSchema = z5.enum([
+  "read",
+  "publish",
+  "review",
+  "confirm",
+  "handover",
+  "inventory",
+  "access",
+  "points",
+  "observe",
+  /**
+   * Custom tracker ingestion only (`trackers.ingest`), such as for an indexer's key. Editors and
+   * hosted-app keys hold it. `observe` also allows ingestion, so keys issued with only `observe`
+   * keep ingesting.
+   */
+  "ingest"
+]);
+var permissionListSchema = z5.array(z5.string()).transform(
+  (values) => values.filter(
+    (value) => permissionSchema.safeParse(value).success
+  )
+);
+var rolePermissions = {
+  editor: ["read", "publish", "inventory", "points", "observe", "ingest"],
+  reviewer: ["read", "review"],
+  staff: ["read", "confirm", "handover"]
+};
+var projectSetupSchema = z5.object({
+  mode: z5.enum(["new", "existing"]),
+  brief: z5.string().trim().min(1).max(4e3)
+}).strict();
+var projectSchema = z5.object({
+  slug: z5.string().min(1).max(35).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/),
+  /** A response, so fields a newer server adds to the setup are dropped, not rejected. */
+  setup: z5.object(projectSetupSchema.shape).optional(),
+  /** The starter chosen at setup. A plain string, so later starters still parse. */
+  starter: z5.string().optional(),
+  id: z5.string().min(1),
+  organization: identifier,
+  project: identifier,
+  name: z5.string(),
+  subtitle: z5.string(),
+  initials: z5.string(),
+  color: z5.string(),
+  permissions: permissionListSchema,
+  environments: z5.array(environmentSchema)
+});
+var projectInputSchema = z5.object({
+  actionId: identifier,
+  name: z5.string().trim().min(1).max(80),
+  setup: projectSetupSchema.optional(),
+  /** The starter a new hosted app begins from, with `setup.mode` "new". */
+  starter: starterIdSchema.optional()
+}).strict();
+var projectDeletionInputSchema = z5.object({ confirm: z5.string().min(1).max(80) }).strict();
+var projectDeletionSchema = z5.object({
+  project: identifier,
+  purgeAfter: z5.number().int()
+});
+var projectTransferInputSchema = z5.object({ organization: identifier, confirm: z5.string().min(1).max(80) }).strict();
+var projectTransferSchema = z5.object({
+  organization: identifier,
+  project: identifier
+});
+var grantSchema = z5.object({
+  subject: z5.string().min(1).max(200),
+  roles: z5.array(roleSchema),
+  environments: z5.array(environmentSchema)
+}).strict();
+var grantRecordSchema = z5.object(grantSchema.shape);
+var stockAdditionSchema = z5.object({
+  item: identifier,
+  quantity: z5.number().int(),
+  actionId: identifier
+});
+var [availableEntitlement, handingOverEntitlement, collectedEntitlement] = entitlementSchema.options;
+var entitlementRecordSchema = z5.discriminatedUnion("status", [
+  z5.object(availableEntitlement.shape),
+  z5.object(handingOverEntitlement.shape),
+  z5.object(collectedEntitlement.shape)
+]);
+var accessSchema = z5.object({
+  actor: z5.string(),
+  organization: z5.string(),
+  admin: z5.boolean(),
+  local: z5.boolean(),
+  projects: z5.array(projectSchema)
+});
+var querySchema = z5.object({
+  q: z5.string().max(200).default(""),
+  filter: z5.string().max(50).default("all"),
+  offset: z5.coerce.number().int().min(0).max(1e6).default(0),
+  limit: z5.coerce.number().int().min(1).max(100).default(25)
+});
+var accountProfileSchema = z5.object({
+  name: z5.string().optional(),
+  /** The account's handle, where the provider has one (X and Discord). */
+  username: z5.string().optional(),
+  email: z5.string().optional(),
+  emailVerified: z5.boolean().default(false),
+  imageUrl: z5.string().url().optional()
+});
+var memberAccountSchema = z5.object({
+  /**
+   * `wallet` for a wallet the member signs in with (listed with the member's wallets), `account`
+   * for any other sign-in or connected account. Older servers omit it: it then reads `account`.
+   */
+  kind: z5.enum(["account", "wallet"]).default("account"),
+  provider: z5.string(),
+  subject: z5.string(),
+  signInEnabled: z5.boolean(),
+  profile: accountProfileSchema.optional()
+});
+var operationSchema = z5.object({
+  target: z5.string(),
+  paused: z5.boolean(),
+  revision: z5.number().int(),
+  reason: z5.string(),
+  actor: z5.string().nullable(),
+  changedAt: z5.number()
+});
+var operationInputSchema = z5.object({
+  target: z5.union([
+    z5.literal("redemptions"),
+    z5.string().regex(/^quest:[\w-]+$/)
+  ]),
+  paused: z5.boolean(),
+  revision: z5.number().int().nonnegative(),
+  reason: z5.string().trim().min(1).max(500),
+  actionId: identifier
+}).strict();
+var questLifecycleInputSchema = z5.object({
+  quest: identifier,
+  expectedRelease: identifier.optional(),
+  archived: z5.boolean(),
+  reason: z5.string().trim().min(1).max(500),
+  actionId: identifier
+}).strict();
+var questLifecycleSchema = z5.object({
+  quest: identifier,
+  key: identifier.nullable(),
+  title: z5.string(),
+  release: identifier,
+  lifecycle: z5.enum(["active", "paused", "archived"]),
+  changed: z5.boolean()
+});
+var memberSchema = z5.object({
+  id: z5.string(),
+  accounts: z5.array(memberAccountSchema).default([]),
+  attempts: z5.number(),
+  completions: z5.number(),
+  rewards: z5.number(),
+  lastActivity: z5.number().nullable()
+});
+var personSchema = z5.object({
+  id: z5.string(),
+  accounts: z5.array(memberAccountSchema).default([])
+});
+var metricsSchema = z5.object({
+  quests: z5.number(),
+  members: z5.number(),
+  attempts: z5.number(),
+  completions: z5.number(),
+  review: z5.number(),
+  failed: z5.number(),
+  entitlements: z5.number()
+});
+var readinessSchema = z5.object({
+  checks: z5.array(
+    z5.object({
+      id: z5.string(),
+      status: z5.enum(["ready", "blocked"]),
+      title: z5.string(),
+      detail: z5.string()
+    })
+  )
+});
+var inventorySchema = z5.object({
+  item: z5.string(),
+  name: z5.string().nullable().default(null),
+  available: z5.number(),
+  reserved: z5.number(),
+  allocated: z5.number().default(0)
+});
+var auditRecordSchema = z5.object({
+  id: z5.string(),
+  action: z5.string(),
+  actor: z5.string().nullable(),
+  detail: z5.string(),
+  at: z5.number(),
+  attempt: z5.string().nullable()
+});
+var pageSchema = z5.object({
+  snapshot: snapshotSchema,
+  members: z5.array(memberSchema),
+  people: z5.array(personSchema).default([]),
+  metrics: metricsSchema,
+  total: z5.number(),
+  offset: z5.number(),
+  limit: z5.number(),
+  inventory: z5.array(inventorySchema),
+  operations: z5.array(operationSchema).default([]),
+  audit: z5.array(auditRecordSchema).default([]),
+  questCounts: z5.record(z5.string(), z5.number())
+});
+var managedWalletSchema = linkedWalletSchema.extend({
+  status: z5.enum(["linked", "unlinked"]),
+  unlinkedAt: z5.number().int().nullable(),
+  /** "member", or the operator or key that unlinked it. */
+  unlinkedBy: z5.string().nullable()
+});
+var balanceCheckSchema = walletBalanceSchema.pick({
+  chain: true,
+  token: true,
+  decimals: true,
+  total: true,
+  wallets: true,
+  observedAt: true
+}).extend({ attempt: identifier });
+var walletBalanceChainsSchema = z5.object({
+  chains: z5.array(
+    z5.object({
+      chain: z5.union([z5.literal(solanaMainnet), evmChainIdSchema]),
+      name: z5.string(),
+      testnet: z5.boolean()
+    })
+  )
+});
+var memberWalletUnlinkInputSchema = walletUnlinkInputSchema.extend({ reason: z5.string().trim().min(1).max(500) }).strict();
+var memberWalletSignInInputSchema = walletUnlinkInputSchema.extend({
+  enabled: z5.boolean(),
+  reason: z5.string().trim().min(1).max(500)
+}).strict();
+var participantSignInSchema = z5.object({
+  providers: z5.array(
+    z5.object({ provider: authProviderSchema, configured: z5.boolean() })
+  ),
+  email: z5.boolean(),
+  /** Wallet families: `"solana"`, `"eip155"`, `"cosmos"`. */
+  wallets: walletSignInNetworksSchema,
+  /** Why participants cannot sign in to this project, or null. */
+  issue: z5.string().nullable(),
+  updatedAt: z5.number().nullable(),
+  updatedBy: z5.string().nullable()
+});
+var participantSignInInputSchema = z5.object({
+  wallets: z5.array(z5.string()).max(4).refine(
+    (value) => new Set(value).size === value.length,
+    "Duplicate wallet network"
+  ).pipe(walletSignInNetworksSchema)
+}).strict();
+var memberDetailSchema = z5.object({
+  snapshot: snapshotSchema,
+  member: memberSchema,
+  progress: memberProgressSchema,
+  passes: z5.array(
+    z5.object({
+      provider: z5.string(),
+      event: z5.string(),
+      subject: z5.string(),
+      attempt: identifier.nullable()
+    })
+  ).default([]),
+  wallet: z5.object({
+    connection: walletConnectionSchema.nullable(),
+    observation: z5.object({ attempt: identifier, balance: solanaBalanceSchema }).nullable()
+  }).default({ connection: null, observation: null }),
+  /** Linked and unlinked wallets; `wallet` keeps the legacy newest-Solana view for older clients. */
+  wallets: z5.array(managedWalletSchema).default([]),
+  /** The member's 10 most recent recorded balance reads, newest first. */
+  balanceChecks: z5.array(balanceCheckSchema).default([]),
+  /** The member's participant profile in this project; older servers omit it. */
+  profile: managedProfileSchema.nullable().default(null)
+});
+var stockInputSchema = z5.object({
+  item: identifier,
+  quantity: z5.number().int().positive().max(1e6),
+  actionId: identifier
+}).strict();
+var tokenInputSchema = z5.object({
+  name: z5.string().trim().min(1).max(80),
+  project: identifier,
+  environment: environmentSchema,
+  permissions: z5.array(permissionSchema).min(1),
+  days: z5.number().int().min(1).max(90).default(30)
+}).strict();
+var tokenSchema = z5.object({
+  id: z5.string(),
+  name: z5.string(),
+  project: z5.string(),
+  environment: environmentSchema,
+  permissions: permissionListSchema,
+  expiresAt: z5.number()
+});
+var issuedTokenSchema = tokenSchema.extend({ token: z5.string() });
+var teamSchema = z5.array(
+  z5.object({ id: z5.string(), label: z5.string() })
+);
+var memberLookupSchema = z5.object({
+  provider: z5.string().min(1).max(200),
+  subject: z5.string().min(1).max(2048)
+}).strict();
+var verifiedPassSchema = z5.object({
+  provider: identifier,
+  event: identifier,
+  subject: z5.string().min(1).max(2048),
+  member: identifier,
+  quest: identifier
+}).strict();
+function withActionId(input) {
+  return { ...input, actionId: input.actionId ?? crypto.randomUUID() };
+}
+function actionIdOf(input) {
+  return typeof input === "object" && input !== null && "actionId" in input && typeof input.actionId === "string" ? input.actionId : void 0;
+}
+function queryString(values) {
+  const query = new URLSearchParams(
+    Object.entries(values).flatMap(
+      ([key, value]) => value === void 0 ? [] : [[key, String(value)]]
+    )
+  ).toString();
+  return query ? "?" + query : "";
+}
+var serverErrorSchema = z5.looseObject({
+  error: z5.string(),
+  code: z5.string().optional()
+});
+function checkedTimeout(timeout) {
+  if (timeout !== void 0 && !(Number.isFinite(timeout) && timeout > 0)) {
+    throw new ManagementError({
+      kind: "client",
+      code: ManagementErrorCode.InvalidInput,
+      message: "Management timeout must be a positive, finite number of milliseconds"
+    });
+  }
+  return timeout;
+}
+function clientFailure(error) {
+  if (error instanceof ManagementError) {
+    return error;
+  }
+  return new ManagementError({
+    kind: "client",
+    code: ManagementErrorCode.InvalidInput,
+    message: error instanceof z5.ZodError ? `Invalid management request: ${z5.prettifyError(error)}` : error instanceof Error ? error.message : "Invalid management request",
+    cause: error
+  });
+}
+function guarded(api) {
+  return Object.fromEntries(
+    Object.entries(api).map(([key, value]) => [
+      key,
+      typeof value === "function" ? (...args) => {
+        try {
+          return Promise.resolve(value(...args)).catch((error) => {
+            throw clientFailure(error);
+          });
+        } catch (error) {
+          return Promise.reject(clientFailure(error));
+        }
+      } : value && typeof value === "object" ? guarded(value) : value
+    ])
+  );
+}
+function createManagementClient(options) {
+  const clientTimeout = checkedTimeout(options.timeout) ?? DEFAULT_MANAGEMENT_TIMEOUT;
+  function transportFailure(error, context, lifetime, sent, status) {
+    if (error instanceof ManagementError) {
+      return error;
+    }
+    const unsent = {
+      ...sent ? {} : { uncertain: false },
+      ...status === void 0 ? {} : { status }
+    };
+    if (lifetime.caller?.aborted) {
+      return new ManagementError({
+        ...context,
+        ...unsent,
+        kind: "aborted",
+        code: ManagementErrorCode.Aborted,
+        message: "The management request was cancelled",
+        cause: lifetime.caller.reason
+      });
+    }
+    if (lifetime.timer.aborted) {
+      return new ManagementError({
+        ...context,
+        ...unsent,
+        kind: "timeout",
+        code: ManagementErrorCode.Timeout,
+        message: `The management request did not finish within ${lifetime.timeout} ms`,
+        cause: error
+      });
+    }
+    return new ManagementError({
+      ...context,
+      ...unsent,
+      kind: "network",
+      code: ManagementErrorCode.Network,
+      message: "The management request failed before Domino answered",
+      cause: error
+    });
+  }
+  async function send(path, init, actionId) {
+    const { timeout, signal: callerSignal, ...fetchInit } = init ?? {};
+    const context = {
+      method: (fetchInit.method ?? "GET").toUpperCase(),
+      path: path.split("?")[0],
+      ...actionId ? { actionId } : {}
+    };
+    const limit = checkedTimeout(timeout) ?? clientTimeout;
+    const deadline = new AbortController();
+    const caller = callerSignal ?? void 0;
+    const lifetime = {
+      signal: caller ? AbortSignal.any([caller, deadline.signal]) : deadline.signal,
+      caller,
+      timer: deadline.signal,
+      timeout: limit,
+      end: () => clearTimeout(timer)
+    };
+    const timer = setTimeout(
+      () => deadline.abort(
+        new DOMException("The management request timed out", "TimeoutError")
+      ),
+      limit
+    );
+    if (lifetime.signal.aborted) {
+      lifetime.end();
+      throw transportFailure(lifetime.signal.reason, context, lifetime, false);
+    }
+    try {
+      return await exchange(path, fetchInit, context, lifetime);
+    } catch (error) {
+      lifetime.end();
+      throw error;
+    }
+  }
+  async function credential(context, lifetime) {
+    if (!options.getToken) {
+      return null;
+    }
+    const getToken = options.getToken;
+    try {
+      return await new Promise((resolve, reject) => {
+        const stop = () => reject(lifetime.signal.reason);
+        lifetime.signal.addEventListener("abort", stop, { once: true });
+        getToken().then(resolve, reject).finally(() => lifetime.signal.removeEventListener("abort", stop));
+      });
+    } catch (error) {
+      if (lifetime.signal.aborted) {
+        throw transportFailure(error, context, lifetime, false);
+      }
+      throw new ManagementError({
+        ...context,
+        // A token source that could not reach its own service failed like a network call.
+        kind: error instanceof TypeError ? "network" : "client",
+        code: ManagementErrorCode.Credential,
+        uncertain: false,
+        message: "Could not get a management credential",
+        cause: error
+      });
+    }
+  }
+  async function exchange(path, fetchInit, context, lifetime) {
+    const headers = new Headers(fetchInit.headers);
+    const token = await credential(context, lifetime);
+    if (token) {
+      headers.set("Authorization", `Bearer ${token}`);
+    }
+    if (options.organization) {
+      headers.set("X-Relay-Organization", options.organization);
+    }
+    if (options.project) {
+      headers.set("X-Relay-Project", options.project);
+    }
+    if (options.environment) {
+      headers.set("X-Relay-Environment", options.environment);
+    }
+    let response;
+    try {
+      response = await fetch(`${options.baseUrl}/management/v1${path}`, {
+        ...fetchInit,
+        headers,
+        signal: lifetime.signal
+      });
+    } catch (error) {
+      throw transportFailure(error, context, lifetime, true);
+    }
+    if (!response.ok) {
+      const body = await response.json().catch(() => null);
+      const parsed = serverErrorSchema.safeParse(body);
+      const { error, code, ...details } = parsed.success ? parsed.data : { error: `Request failed (${response.status})`, code: void 0 };
+      throw new ManagementError({
+        ...context,
+        kind: "http",
+        status: response.status,
+        message: error,
+        ...code === void 0 ? {} : { code },
+        details
+      });
+    }
+    return { response, context, lifetime };
+  }
+  async function raw(path, init) {
+    const { response, lifetime } = await send(path, init, void 0);
+    lifetime.end();
+    return response;
+  }
+  async function request(path, schema, input, method = input === void 0 ? "GET" : "POST", call) {
+    const { response, context, lifetime } = await send(
+      path,
+      {
+        ...call,
+        ...method === "GET" ? {} : { method },
+        ...input === void 0 ? {} : {
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify(input)
+        }
+      },
+      actionIdOf(input)
+    );
+    let body;
+    try {
+      body = await response.json();
+    } catch (error) {
+      if (error instanceof SyntaxError && !lifetime.signal.aborted) {
+        throw new ManagementError({
+          ...context,
+          kind: "invalid-response",
+          code: ManagementErrorCode.InvalidResponse,
+          status: response.status,
+          message: "Domino answered with a body that is not JSON",
+          cause: error
+        });
+      }
+      throw transportFailure(error, context, lifetime, true, response.status);
+    } finally {
+      lifetime.end();
+    }
+    const parsed = schema.safeParse(body);
+    if (!parsed.success) {
+      throw new ManagementError({
+        ...context,
+        kind: "invalid-response",
+        code: ManagementErrorCode.InvalidResponse,
+        status: response.status,
+        message: "Domino answered with a response this client does not recognize",
+        cause: parsed.error
+      });
+    }
+    return parsed.data;
+  }
+  const get = (path, schema, call) => request(path, schema, void 0, "GET", call);
+  const post = (path, schema, input, call) => request(path, schema, input, "POST", call);
+  async function create(path, responseSchema, inputSchema, input, call) {
+    const payload = inputSchema.parse(withActionId(input));
+    try {
+      return await post(path, responseSchema, payload, call);
+    } catch (error) {
+      if (error instanceof ManagementError && error.uncertain && (error.kind === "network" || error.kind === "http")) {
+        return await post(path, responseSchema, payload, call);
+      }
+      throw error;
+    }
+  }
+  const ok = z5.object({ ok: z5.literal(true) });
+  return guarded({
+    raw,
+    request,
+    trackers: {
+      list: (call) => get("/trackers", z5.array(trackerStatusSchema), call),
+      get: (reference, call) => get(
+        `/trackers/${identifier.parse(reference)}`,
+        trackerStatusSchema,
+        call
+      ),
+      records: (reference, query = {}, call) => get(
+        `/trackers/${identifier.parse(reference)}/records${queryString(trackerQuerySchema.parse(query))}`,
+        trackerPageSchema,
+        call
+      ),
+      summary: (reference, query = {}, call) => get(
+        `/trackers/${identifier.parse(reference)}/summary${queryString(trackerQuerySchema.parse(query))}`,
+        trackerSummarySchema,
+        call
+      ),
+      content: (reference, query, call) => get(
+        `/trackers/${identifier.parse(reference)}/content${queryString(trackerContentReadSchema.parse(query))}`,
+        trackerContentSchema,
+        call
+      ),
+      control: (reference, input, call) => post(
+        `/trackers/${identifier.parse(reference)}/control`,
+        trackerStatusSchema,
+        trackerControlSchema.parse(input),
+        call
+      ),
+      ingest: (reference, input, call) => post(
+        `/trackers/${identifier.parse(reference)}/records`,
+        trackerIngestResultSchema,
+        trackerIngestSchema.parse(input),
+        call
+      ),
+      /** Why each tracker-triggered quest admitted or skipped a record observation, newest first. */
+      outcomes: (reference, query = {}, call) => get(
+        `/trackers/${identifier.parse(reference)}/outcomes${queryString(trackerOutcomeQuerySchema.parse(query))}`,
+        trackerOutcomePageSchema,
+        call
+      ),
+      /**
+       * Re-runs admission for a skipped observation under the quest's current release, links and
+       * membership; requires `review` permission. Fails with 409 and the current reason when it
+       * still cannot admit.
+       */
+      retryOutcome: (reference, input, call) => post(
+        `/trackers/${identifier.parse(reference)}/outcomes/retry`,
+        trackerOutcomeSchema,
+        trackerOutcomeRetrySchema.parse(input),
+        call
+      ),
+      /** A bounded X search sample to explore a query before defining a tracker. Stores nothing. */
+      preview: (input, call) => post(
+        "/tracker-preview",
+        trackerPreviewSchema,
+        trackerPreviewInputSchema.parse(input),
+        call
+      )
+    },
+    engagement: {
+      previewChange: (input, call) => post(
+        "/engagement/preview-change",
+        engagementChangePreviewSchema,
+        engagementChangePreviewInputSchema.parse(input),
+        call
+      ),
+      change: (input, call) => post(
+        "/engagement/change",
+        engagementRuleSchema,
+        engagementChangeSchema.parse(input),
+        call
+      ),
+      versions: (input, call) => get(
+        "/engagement/versions" + queryString(engagementVersionQuerySchema.parse(input)),
+        engagementVersionPageSchema,
+        call
+      ),
+      boundaries: (input, call) => get(
+        "/engagement/boundaries" + queryString(engagementPageQuerySchema.parse(input)),
+        engagementBoundaryPageSchema,
+        call
+      ),
+      publish: (input, call) => post(
+        "/engagement/publish",
+        engagementRuleSchema,
+        engagementPublishSchema.parse(input),
+        call
+      ),
+      list: (call) => get("/engagement", z5.array(engagementRuleSchema), call),
+      page: (input, call) => get(
+        "/engagement/history" + queryString(engagementPageQuerySchema.parse(input)),
+        engagementPageSchema,
+        call
+      )
+    },
+    content: {
+      performance: (input, call) => get(
+        "/content/performance" + queryString(contentPerformanceQuerySchema.parse(input)),
+        contentPerformancePageSchema,
+        call
+      ),
+      qualifications: (input, call) => get(
+        "/content/qualifications" + queryString(contentQualificationQuerySchema.parse(input)),
+        contentQualificationPageSchema,
+        call
+      ),
+      admissions: (input, call) => get(
+        "/content/admissions" + queryString(contentAdmissionQuerySchema.parse(input)),
+        contentAdmissionPageSchema,
+        call
+      ),
+      enroll: (input, call) => post(
+        "/content/enrollments",
+        contentEnrollmentSchema,
+        contentEnrollmentInputSchema.parse(input),
+        call
+      ),
+      approve: (input, call) => post(
+        "/content/approvals",
+        contentAdmissionSchema,
+        contentReleaseInputSchema.parse(input),
+        call
+      )
+    },
+    observations: {
+      submit: (input, call) => post(
+        "/observations",
+        observationReceiptSchema,
+        observationInputSchema.parse(input),
+        call
+      )
+    },
+    pointLedgers: {
+      list: (call) => get("/point-ledgers", z5.array(pointLedgerSchema), call),
+      save: (input, call) => post(
+        "/point-ledgers/update",
+        pointLedgerSchema,
+        pointLedgerSchema.parse(input),
+        call
+      )
+    },
+    points: {
+      ledgers: (call) => get("/point-ledgers", z5.array(pointLedgerSchema), call),
+      createLedger: (input, call) => create(
+        "/point-ledgers",
+        pointLedgerSchema,
+        createPointLedgerSchema,
+        input,
+        call
+      ),
+      update: (input, call) => post(
+        "/points",
+        pointsResultSchema,
+        pointsMutationSchema.parse(input),
+        call
+      ),
+      balance: (member, balance, call) => get(
+        `/points/${identifier.parse(member)}/${identifier.parse(balance)}`,
+        pointsAccountSchema,
+        call
+      ),
+      history: (member, balance, before, call) => get(
+        `/points/${identifier.parse(member)}/${identifier.parse(balance)}/history${queryString({ before })}`,
+        z5.object({
+          items: z5.array(pointsEntrySchema),
+          next: z5.number().nullable()
+        }),
+        call
+      )
+    },
+    referrals: {
+      /** A member's referral point history, newest first. Pass `nextCursor` as `cursor`. */
+      history: (member, query = {}, call) => get(
+        `/referrals/history/${identifier.parse(member)}${queryString({ cursor: query.cursor })}`,
+        referralHistorySchema,
+        call
+      ),
+      list: (call) => get("/referrals", z5.array(publishedReferralSchema), call),
+      participants: (before, call) => get(
+        `/referrals/participants${queryString({ before })}`,
+        referralManagementSchema,
+        call
+      ),
+      control: (input, call) => post(
+        "/referrals/control",
+        ok,
+        referralControlSchema.parse(input),
+        call
+      )
+    },
+    leaderboards: {
+      list: (call) => get("/leaderboards", z5.array(publishedLeaderboardSchema), call),
+      standings: (board, input = {}, call) => {
+        const query = leaderboardQuerySchema.parse(input);
+        return get(
+          `/leaderboards/${identifier.parse(board)}${queryString({
+            limit: query.limit,
+            cursor: query.cursor || void 0
+          })}`,
+          leaderboardPageSchema,
+          call
+        );
+      },
+      history: (board, call) => get(
+        `/leaderboards/${identifier.parse(board)}/history`,
+        z5.array(publishedLeaderboardSchema),
+        call
+      ),
+      exclusions: (board, call) => get(
+        `/leaderboards/${identifier.parse(board)}/exclusions`,
+        z5.array(z5.object({ member: identifier })),
+        call
+      ),
+      exclude: (board, input, call) => post(
+        `/leaderboards/${identifier.parse(board)}/exclusions`,
+        ok,
+        leaderboardExclusionSchema.parse(input),
+        call
+      ),
+      group: (group, input, call) => post(
+        `/leaderboard-groups/${identifier.parse(group)}`,
+        ok,
+        leaderboardGroupSchema.parse(input),
+        call
+      )
+    },
+    deployments: {
+      preview: (input, call) => {
+        const { engagement, ...deployment } = projectDeploymentSchema.parse(input);
+        return post(
+          "/deployments/preview",
+          deploymentPreviewSchema,
+          { ...deployment, ...engagement.length ? { engagement } : {} },
+          call
+        );
+      },
+      publish: (input, call) => post(
+        "/deployments/publish",
+        deploymentResultSchema,
+        publishDeploymentSchema.parse(input),
+        call
+      )
+    },
+    catalog: {
+      allocateQuest: (input = {}, call) => create(
+        "/catalog/quests",
+        allocatedQuestSchema,
+        allocateQuestSchema,
+        input,
+        call
+      ),
+      read: (call) => get("/catalog", questCatalogSchema, call),
+      previewDeployment: (input, call) => post(
+        "/catalog/deploy/preview",
+        catalogDeploymentPreviewSchema,
+        catalogDeploymentSchema.parse(input),
+        call
+      ),
+      deploy: (input, call) => post(
+        "/catalog/deploy",
+        questCatalogSchema,
+        catalogDeploymentSchema.parse(input),
+        call
+      ),
+      saveDraft: (input, call) => post(
+        "/catalog/drafts",
+        questDraftSchema,
+        saveQuestDraftSchema.parse(input),
+        call
+      ),
+      preview: (input, call) => post(
+        "/catalog/preview",
+        questPublicationPreviewSchema,
+        publishQuestDraftSchema.parse(input),
+        call
+      ),
+      publish: (input, call) => post(
+        "/catalog/publish",
+        questPublicationPreviewSchema,
+        publishQuestDraftSchema.parse(input),
+        call
+      )
+    },
+    /** Staff-confirmed quests and reviews. */
+    attempts: {
+      /**
+       * Submits a staff-confirmed quest (`manual({ actor: "staff" })`) for a member; requires
+       * `confirm` permission. Resolves with the queued attempt, or with the original attempt when
+       * the action ID repeats. Any other quest fails with 403.
+       */
+      confirm: (input, call) => post(
+        "/attempts",
+        attemptSchema,
+        submitSchema.parse(withActionId(input)),
+        call
+      ),
+      /**
+       * Accepts or rejects an attempt waiting for review, at the `generation` the reviewer saw,
+       * with a reason; requires `review` permission.
+       */
+      review: (attempt, input, call) => post(
+        `/attempts/${identifier.parse(attempt)}/review`,
+        attemptSchema,
+        staffDecisionSchema.parse(withActionId(input)),
+        call
+      ),
+      /** Evaluates a failed attempt again under a new generation; requires `review` permission. */
+      retry: (attempt, call) => post(
+        `/attempts/${identifier.parse(attempt)}/retry`,
+        attemptSchema,
+        {},
+        call
+      )
+    },
+    passes: {
+      /**
+       * Records a member's external event pass, which the app verified, and submits the entry
+       * quest (`manual({ actor: "staff" })`); requires `confirm` permission. The same pass for
+       * the same member resolves with the original attempt.
+       */
+      verify: (input, call) => post(
+        "/passes/verify",
+        attemptSchema,
+        verifiedPassSchema.parse(input),
+        call
+      )
+    },
+    /** Staff handover of a member's reward entitlement; requires `handover` permission. */
+    handover: {
+      /** Starts handing over an entitlement at the `revision` staff saw, with an optional pickup selection. */
+      begin: (entitlement, input, call) => post(
+        `/entitlements/${identifier.parse(entitlement)}/begin`,
+        entitlementRecordSchema,
+        beginHandoverSchema.parse(withActionId(input)),
+        call
+      ),
+      /** Completes the handover `begin` started; the entitlement becomes collected. */
+      confirm: (entitlement, input, call) => post(
+        `/entitlements/${identifier.parse(entitlement)}/confirm`,
+        entitlementRecordSchema,
+        confirmHandoverSchema.parse(withActionId(input)),
+        call
+      )
+    },
+    collection: {
+      resolve: (code, call) => post(
+        "/collection/resolve",
+        collectionPreviewSchema,
+        collectionResolveSchema.parse({ code }),
+        call
+      ),
+      begin: (input, call) => post(
+        "/collection/begin",
+        entitlementRecordSchema,
+        collectionBeginSchema.parse(input),
+        call
+      )
+    },
+    operations: {
+      /**
+       * Pauses or resumes redemptions or one quest's participation, against the `revision` the
+       * operator saw, with a reason; requires `publish` permission.
+       */
+      configure: (input, call) => post(
+        "/operations",
+        operationSchema,
+        operationInputSchema.parse(withActionId(input)),
+        call
+      )
+    },
+    inventory: {
+      createItem: (input, call) => create(
+        "/stock-items",
+        stockItemSchema,
+        createStockItemSchema,
+        input,
+        call
+      ),
+      /** Adds `quantity` units to a stock item; requires `inventory` permission. */
+      addStock: (input, call) => post(
+        "/stock",
+        stockAdditionSchema,
+        stockInputSchema.parse(withActionId(input)),
+        call
+      ),
+      catalog: (call) => get("/pickup-inventory", z5.array(pickupCatalogSchema), call),
+      configure: (input, call) => post(
+        "/pickup-inventory",
+        pickupCatalogSchema,
+        configurePickupSchema.parse(input),
+        call
+      ),
+      availability: (entitlement, call) => get(
+        `/pickup-inventory/${encodeURIComponent(entitlement)}`,
+        pickupAvailabilitySchema,
+        call
+      )
+    },
+    readiness: (call) => get("/readiness", readinessSchema, call),
+    access: (call) => get("/access", accessSchema, call),
+    createProject: (input, call) => create("/projects", projectSchema, projectInputSchema, input, call),
+    /** Delete the client's current project. Domino support can restore it for 30 days. */
+    deleteProject: (input, call) => request(
+      "/project",
+      projectDeletionSchema,
+      projectDeletionInputSchema.parse(input),
+      "DELETE",
+      call
+    ),
+    /** Move the client's current project to another organization the caller administers. */
+    transferProject: (input, call) => post(
+      "/project/transfer",
+      projectTransferSchema,
+      projectTransferInputSchema.parse(input),
+      call
+    ),
+    /**
+     * The signed-in person's personal API keys. Only a Console session manages them; an API key
+     * cannot list, create or revoke keys.
+     */
+    tokens: {
+      list: (call) => get("/tokens", z5.array(tokenSchema), call),
+      /**
+       * Issues a key for one project and environment, limited to permissions the caller holds
+       * there. The secret `token` is in this response only.
+       */
+      create: (input, call) => post("/tokens", issuedTokenSchema, tokenInputSchema.parse(input), call),
+      revoke: (id, call) => request(
+        `/tokens/${encodeURIComponent(z5.string().min(1).parse(id))}`,
+        ok,
+        void 0,
+        "DELETE",
+        call
+      )
+    },
+    /** Who holds which roles on the client's project; organization administrators only. */
+    grants: {
+      list: (call) => get("/grants", z5.array(grantRecordSchema), call),
+      /** Replaces one person's roles and environments on the project. The audit log records it. */
+      set: (input, call) => request(
+        "/grants",
+        grantRecordSchema,
+        grantSchema.parse(input),
+        "PUT",
+        call
+      )
+    },
+    /** The organization's people, to choose a grant's `subject`; organization administrators only. */
+    team: {
+      list: (call) => get("/team", teamSchema, call)
+    },
+    /**
+     * Keys that let an existing app exchange its own login for member sessions, per project and
+     * environment. Organization administrators, from a Console session only.
+     */
+    identityIntegrations: {
+      list: (call) => get("/identity-integrations", z5.array(identityIntegrationSchema), call),
+      /** The secret `token` is in this response only. */
+      create: (input, call) => post(
+        "/identity-integrations",
+        identityIntegrationSecretSchema,
+        identityIntegrationInputSchema.parse(input),
+        call
+      ),
+      /** Replaces the key's secret and extends it by 90 days; the old secret stops working. */
+      rotate: (id, call) => post(
+        `/identity-integrations/${z5.string().uuid().parse(id)}/rotate`,
+        identityIntegrationSecretSchema,
+        {},
+        call
+      ),
+      /** Deletes the key and ends every member session it issued. */
+      revoke: (id, call) => request(
+        `/identity-integrations/${z5.string().uuid().parse(id)}`,
+        z5.null(),
+        void 0,
+        "DELETE",
+        call
+      )
+    },
+    page: (page, query, call) => get(`/${page}${queryString(query)}`, pageSchema, call),
+    rewardDeliveries: (member, call) => get(
+      `/reward-deliveries${queryString({ member })}`,
+      rewardDeliveriesSchema,
+      call
+    ),
+    /** Moves a failed delivery back to pending under a new generation; requires `review` permission. */
+    retryRewardDelivery: (id, call) => post(
+      `/reward-deliveries/${encodeURIComponent(id)}/retry`,
+      rewardDeliverySchema,
+      {},
+      call
+    ),
+    /** The project's members, as operators see them. */
+    members: {
+      /** A member's detail: accounts, progress, passes, wallets and profile. */
+      get: (member, call) => get(`/members/${encodeURIComponent(member)}`, memberDetailSchema, call),
+      /**
+       * The one member of the client's project holding exactly this account, with `provider` and `subject` as a member's
+       * `accounts` list them; requires `read` permission. Fails with 404 `member-not-found` when
+       * nobody holds it. Unlike the members page's `q` search, it never matches part of a value
+       * or another letter case.
+       */
+      lookup: (input, call) => get(
+        `/members/lookup${queryString(memberLookupSchema.parse(input))}`,
+        personSchema,
+        call
+      ),
+      /** Who each member is: up to 100 distinct IDs; unknown IDs come back without accounts. */
+      people: (members, call) => get(
+        `/people${queryString({ ids: members.join(",") })}`,
+        z5.array(personSchema),
+        call
+      ),
+      /** Unlinks a member's wallet from the project with a reason; requires `review` permission. The address stays bound to the member. */
+      unlinkWallet: (member, input, call) => post(
+        `/members/${encodeURIComponent(member)}/wallets/unlink`,
+        z5.array(managedWalletSchema),
+        memberWalletUnlinkInputSchema.parse(input),
+        call
+      ),
+      /**
+       * Enables or disables sign-in with a member's wallet, across the organization and environment,
+       * with a reason; requires `review` permission. Sessions it already issued run out within 8 hours.
+       */
+      setWalletSignIn: (member, input, call) => post(
+        `/members/${encodeURIComponent(member)}/wallets/sign-in`,
+        z5.array(managedWalletSchema),
+        memberWalletSignInInputSchema.parse(input),
+        call
+      )
+    },
+    /** The hosted app's secrets. Values are write-only; builds staged after a change receive it. */
+    secrets: {
+      list: (call) => get("/secrets", appSecretListSchema, call),
+      set: (name, value, call) => request(
+        `/secrets/${appSecretNameSchema.parse(name)}`,
+        appSecretSchema,
+        appSecretInputSchema.parse({ value }),
+        "PUT",
+        call
+      ),
+      delete: async (name, call) => {
+        await raw(`/secrets/${appSecretNameSchema.parse(name)}`, {
+          ...call,
+          method: "DELETE"
+        });
+      }
+    },
+    /**
+     * The chains quest code can read token balances on with `ctx.wallet.balance()`, with their
+     * names; requires `read` permission. Any other chain fails the evaluation.
+     */
+    walletBalanceChains: (call) => get("/wallet-balance-chains", walletBalanceChainsSchema, call),
+    /**
+     * The project calendar in this environment: the timezone that sets where days, weeks and months
+     * begin for budgets, streaks and leaderboards.
+     */
+    calendar: {
+      /**
+       * The timezone in effect, today's date, when today ends, any pending change, and a stored
+       * timezone the calendar no longer accepts (`unsupported`, read as UTC).
+       */
+      read: (call) => get("/calendar", projectCalendarSchema, call),
+      /**
+       * Changes the project timezone from the next day boundary, with a reason; requires `publish`
+       * permission. The current timezone cancels a pending change; a call that changes nothing
+       * records nothing. In live, only a person in Console can change it, not an API key.
+       */
+      configure: (input, call) => post(
+        "/calendar",
+        projectCalendarSchema,
+        projectCalendarInputSchema.parse(withActionId(input)),
+        call
+      )
+    },
+    /** Participant profiles in this project and environment. */
+    profiles: {
+      /** Who sees profiles, and which accounts supply default names and pictures, in order. */
+      settings: (call) => get("/profile-settings", profileSettingsSchema, call),
+      /**
+       * Changes the profile settings against `expectedRevision`, with a reason; requires `publish`
+       * permission. In live, only a person in Console can change them, not an API key.
+       */
+      configure: (input, call) => post(
+        "/profile-settings",
+        profileSettingsSchema,
+        profileSettingsInputSchema.parse(withActionId(input)),
+        call
+      ),
+      /**
+       * Resets a member's name, removes their picture, or locks or unlocks their profile, with a
+       * reason; requires `review` permission.
+       */
+      moderate: (member, input, call) => post(
+        `/members/${identifier.parse(member)}/profile`,
+        managedProfileSchema,
+        profileModerationSchema.parse(withActionId(input)),
+        call
+      )
+    },
+    /**
+     * Code-authored quests. Quests created in Console change participation through a catalog draft
+     * instead. These methods require `publish` permission; in live, only a person in Console can
+     * use them.
+     */
+    quests: {
+      /**
+       * Stops new participation and hides the quest from collections, with a reason. Completions,
+       * attempts and rewards stay. Deploying the quest's code again keeps it archived.
+       */
+      archive: (quest, input, call) => post(
+        "/releases/lifecycle",
+        questLifecycleSchema,
+        questLifecycleInputSchema.parse(
+          withActionId({ ...input, quest, archived: true })
+        ),
+        call
+      ),
+      /**
+       * Opens an archived quest again, with a reason. It must pass the prerequisite graph and the
+       * app's supported interactions; it stays paused while a resource setting is empty.
+       */
+      unarchive: (quest, input, call) => post(
+        "/releases/lifecycle",
+        questLifecycleSchema,
+        questLifecycleInputSchema.parse(
+          withActionId({ ...input, quest, archived: false })
+        ),
+        call
+      ),
+      /**
+       * Changes a quest's settings values (`set`) or returns them to their defaults (`reset`),
+       * publishing a new release from `expectedRelease`, the release the operator saw.
+       */
+      updateSettings: (input, call) => post(
+        "/releases/settings",
+        publishedReleaseSchema,
+        questSettingsInputSchema.parse(input),
+        call
+      )
+    },
+    /** How participants sign in to this project and environment. */
+    participantSignIn: (call) => get("/participant-sign-in", participantSignInSchema, call),
+    /** Sets the wallet networks participants can sign in with; requires `publish` permission. */
+    configureParticipantSignIn: (input, call) => request(
+      "/participant-sign-in",
+      participantSignInSchema,
+      participantSignInInputSchema.parse(input),
+      "PUT",
+      call
+    )
+  });
+}
+export {
+  APP_SECRET_LIMIT,
+  DEFAULT_MANAGEMENT_TIMEOUT,
+  ManagementError,
+  ManagementErrorCode,
+  accessSchema,
+  accountProfileSchema,
+  appRoutingSchema,
+  appSecretDeclarationSchema,
+  appSecretDeclarationsSchema,
+  appSecretInputSchema,
+  appSecretListSchema,
+  appSecretNameSchema,
+  appSecretSchema,
+  appSecretValueSchema,
+  assetPathSchema,
+  auditRecordSchema,
+  balanceCheckSchema,
+  buildArtifactsSchema,
+  buildIdentitySchema,
+  buildPhaseSchema,
+  buildSnapshotSchema,
+  buildStatusSchema,
+  commitSchema,
+  createManagementClient,
+  createRepositorySchema,
+  developmentPreflightSchema,
+  deviceApproveSchema,
+  deviceRedeemSchema,
+  deviceStartSchema,
+  entitlementRecordSchema,
+  environmentSchema,
+  grantRecordSchema,
+  grantSchema,
+  hostedAppSchema,
+  hostedAppSecretsSchema,
+  hostedBuildSchema,
+  hostedDeploymentKeySchema,
+  hostedKeyPermissions,
+  hostedKeySchema,
+  hostedKeySecretSchema,
+  hostedManagementBindings,
+  hostedManagementClient,
+  inventorySchema,
+  isManagementError,
+  issuedTokenSchema,
+  managedWalletSchema,
+  memberAccountSchema,
+  memberDetailSchema,
+  memberLookupSchema,
+  memberSchema,
+  memberWalletSignInInputSchema,
+  memberWalletUnlinkInputSchema,
+  metricsSchema,
+  operationInputSchema,
+  operationSchema,
+  pageSchema,
+  participantSignInInputSchema,
+  participantSignInSchema,
+  permissionSchema,
+  personSchema,
+  projectDeletionInputSchema,
+  projectDeletionSchema,
+  projectInputSchema,
+  projectSchema,
+  projectSetupSchema,
+  projectTransferInputSchema,
+  projectTransferSchema,
+  querySchema,
+  questLifecycleInputSchema,
+  questLifecycleSchema,
+  readinessSchema,
+  repositorySchema,
+  rolePermissions,
+  roleSchema,
+  stageRequestSchema,
+  stagedDeploymentContentSchema,
+  stagedDeploymentKey,
+  stagedDeploymentLimits,
+  stagedDeploymentSchema,
+  stagingAccessInputSchema,
+  stagingAccessModeSchema,
+  stagingAccessSchema,
+  stagingLinkSchema,
+  stagingPathSchema,
+  starterIdSchema,
+  starterTemplates,
+  stockAdditionSchema,
+  stockInputSchema,
+  teamSchema,
+  tokenInputSchema,
+  tokenSchema,
+  verifiedPassSchema,
+  walletBalanceChainsSchema
+};