@domino-sdk/relay 1.24.0 → 1.29.0

package/dist/{chunk-PLELWE5L.js → chunk-ZLYVOLU2.js}

@@ -1,7 +1,7 @@
 import {
   createRelayAction,
   withActionId
-} from "./chunk-E7MVYASS.js";
+} from "./chunk-W7PDXGYB.js";
 import {
   collectionPassSchema,
   participantActivityQuerySchema,
@@ -16,7 +16,7 @@ import {
   questOutcomeQuerySchema,
   questOutcomeSchema,
   rewardDeliveriesSchema
-} from "./chunk-GB26FIZT.js";
+} from "./chunk-MNL5NSC4.js";
 import {
   AVATAR_UPLOAD_LIMIT,
   avatarUploadTypes,
@@ -45,29 +45,29 @@ import {
   referralDefinitionSchema,
   referralHistorySchema,
   referralSummarySchema
-} from "./chunk-MRU7GX2V.js";
+} from "./chunk-C3KL5SGM.js";
 import {
   telegramAccountConnectionSchema,
   telegramMiniAppSignInSchema,
   telegramSignInMethodsSchema
-} from "./chunk-W33PYWYQ.js";
+} from "./chunk-JNBNL7FE.js";
 import {
   PARTICIPANT_TIMEOUT,
   lifetime,
   retryAfter,
   retrying,
   validTimeout
-} from "./chunk-WOGCRDFT.js";
+} from "./chunk-CCTZIHWN.js";
 import {
   clientIdentity
-} from "./chunk-MO2FASX4.js";
+} from "./chunk-5FQ2BNG2.js";
 import {
   exchangeResultSchema,
   exchangeSchema,
   memberSummarySchema,
   participantSessionSchema,
   sessionMember
-} from "./chunk-JUQ2GNMD.js";
+} from "./chunk-PNCLJOUD.js";
 import {
   RelayError,
   RelayErrorCode,
@@ -92,6 +92,8 @@ import {
   missingPrerequisiteSchema,
   pageQuerySchema,
   parseInput,
+  questSubmissionResultSchema,
+  questSubmissionSchema,
   quizEvidenceSchema,
   submissionEvidenceSchema,
   submitSchema,
@@ -104,10 +106,10 @@ import {
   walletSignInNetworksSchema,
   walletSignatureSchema,
   walletUnlinkInputSchema
-} from "./chunk-6UFXPKLA.js";
+} from "./chunk-BVEWY2ZL.js";
 
-// src/submissions.ts
-import { z } from "zod";
+// src/legacy-submissions.ts
+import * as z from "zod";
 var common = {
   id: identifier,
   quest: identifier,
@@ -156,7 +158,7 @@ var recordSchema = z.union([
     previous: activeRecordSchema
   })
 ]);
-function submissions(transport, configuredStore, namespace) {
+function legacySubmissions(transport, configuredStore, namespace) {
   async function open(quest, options = {
     input: "photo"
   }) {
@@ -168,6 +170,7 @@ function submissions(transport, configuredStore, namespace) {
     }
     const store = configuredStore;
     parseInput(identifier, quest);
+    parseInput(identifier.optional(), options.release);
     const session = await transport.session();
     const member = sessionMember(session);
     if (!session || !member) {
@@ -186,8 +189,8 @@ function submissions(transport, configuredStore, namespace) {
       member,
       quest
     ]);
-    async function currentSession() {
-      const current = await transport.session();
+    async function currentSession(step) {
+      const current = await transport.session(step());
       if (current?.id !== sessionId) {
         throw clientError(
           "Your session changed. Reopen the submission before continuing.",
@@ -217,7 +220,7 @@ function submissions(transport, configuredStore, namespace) {
       }
       return record;
     }
-    async function claim(record) {
+    async function claim(record, step) {
       try {
         return await transport.claim(
           {
@@ -226,10 +229,11 @@ function submissions(transport, configuredStore, namespace) {
             ...record.release ? { release: record.release } : {},
             ..."evidence" in record ? { evidence: record.evidence } : record.input.kind !== "none" ? { input: record.input } : {}
           },
-          sessionId
+          sessionId,
+          step()
         );
       } catch (error) {
-        if (isRelayError(error) && error.kind === "http" && !error.uncertain && error.status === 409 && error.code === "operation-retired") {
+        if (isRelayError(error) && error.kind === "http" && !error.uncertain && error.status === 409 && error.code === RelayErrorCode.OperationRetired) {
           await store.write(key, {
             id: record.id,
             quest,
@@ -244,10 +248,10 @@ function submissions(transport, configuredStore, namespace) {
     function retiredError() {
       return clientError(
         "This saved submission was retired. Review the current quest, then discard it before starting a new submission.",
-        "operation-retired"
+        RelayErrorCode.OperationRetired
       );
     }
-    async function resumeRecord(saved) {
+    async function resumeRecord(saved, step) {
       if (saved.stage === "retired") {
         throw retiredError();
       }
@@ -260,11 +264,9 @@ function submissions(transport, configuredStore, namespace) {
       }
       let record = saved;
       if (record.stage === "upload") {
-        const evidence = await transport.upload(
-          record.file,
-          record.id,
-          sessionId
-        );
+        const file = record.file;
+        const action = record.id;
+        const evidence = await transport.upload(file, action, sessionId, step());
         record = {
           id: record.id,
           quest,
@@ -277,7 +279,7 @@ function submissions(transport, configuredStore, namespace) {
       }
       let attempt;
       try {
-        attempt = await claim(record);
+        attempt = await claim(record, step);
       } catch (error) {
         if (error instanceof RelayError && error.status === 422 && error.code === "invalid-submission" && record.stage === "claim") {
           await store.write(key, null);
@@ -306,13 +308,14 @@ function submissions(transport, configuredStore, namespace) {
         attempt: attempt.id
       });
       if (attempt.status === "failed") {
-        attempt = await transport.retry(attempt.id, sessionId);
+        const failed = attempt.id;
+        attempt = await transport.retry(failed, sessionId, step());
       }
       return attempt;
     }
-    async function submit(record) {
+    async function submit(record, step) {
       return store.exclusive(key, async () => {
-        await currentSession();
+        await currentSession(step);
         const existing = await read();
         if (existing?.stage === "retired") {
           throw retiredError();
@@ -331,27 +334,29 @@ function submissions(transport, configuredStore, namespace) {
           );
         }
         if (existing?.stage === "submitted") {
-          const previous = await claim(existing);
+          const previous = await claim(existing, step);
           if (previous.status === "failed") {
-            return transport.retry(previous.id, sessionId);
+            return transport.retry(previous.id, sessionId, step());
           }
           if (previous.status !== "rejected" && !(options.repeatable && previous.status === "accepted")) {
             return previous;
           }
         }
         await store.write(key, record);
-        return resumeRecord(record);
+        return resumeRecord(record, step);
       });
     }
     const handle = {
-      async discard() {
+      async discard(call) {
+        const step = steps(call);
         return store.exclusive(key, async () => {
-          await currentSession();
+          await currentSession(step);
           const record = await read();
           if (!record) {
             return;
           }
           if (record.stage === "retired") {
+            step();
             await store.write(key, null);
             return;
           }
@@ -361,18 +366,20 @@ function submissions(transport, configuredStore, namespace) {
               RelayErrorCode.SubmissionConflict
             );
           }
-          const attempt = await claim(record);
+          const attempt = await claim(record, step);
           if (attempt.status !== "failed" && attempt.status !== "rejected" && !(options.repeatable && attempt.status === "accepted")) {
             throw clientError(
               "Only a failed or rejected submission can be discarded.",
               RelayErrorCode.SubmissionConflict
             );
           }
+          step();
           await store.write(key, null);
         });
       },
-      async status() {
-        await currentSession();
+      async status(call) {
+        const step = steps(call);
+        await currentSession(step);
         const record = await read();
         if (!record) {
           return { kind: "empty" };
@@ -385,9 +392,10 @@ function submissions(transport, configuredStore, namespace) {
         }
         return record.stage === "submitted" ? { kind: "submitted", attempt: record.attempt } : { kind: "pending", stage: record.stage };
       },
-      async resume() {
+      async resume(call) {
+        const step = steps(call);
         return store.exclusive(key, async () => {
-          await currentSession();
+          await currentSession(step);
           const record = await read();
           if (!record) {
             throw clientError(
@@ -395,7 +403,7 @@ function submissions(transport, configuredStore, namespace) {
               RelayErrorCode.SubmissionConflict
             );
           }
-          return resumeRecord(record);
+          return resumeRecord(record, step);
         });
       }
     };
@@ -403,54 +411,347 @@ function submissions(transport, configuredStore, namespace) {
       const kind = options.input;
       return {
         ...handle,
-        submit(value) {
+        async submit(value, call) {
           const input = parseInput(valueEvidenceSchema, { kind, value });
-          return submit({
-            id: crypto.randomUUID(),
-            quest,
-            release: options.release,
-            stage: "claim",
-            input
-          });
+          const step = steps(call);
+          return submit(
+            {
+              id: crypto.randomUUID(),
+              quest,
+              release: options.release,
+              stage: "claim",
+              input
+            },
+            step
+          );
         }
       };
     }
     if (options.input === "quiz") {
       return {
         ...handle,
-        submit(answers, version) {
+        async submit(answers, call = {}) {
+          const { release, ...callOptions } = call;
+          const step = steps(callOptions);
           const input = parseInput(quizEvidenceSchema, {
             kind: "quiz",
             answers,
-            ...version || options.release ? { release: version?.release ?? options.release } : {}
-          });
-          return submit({
-            id: crypto.randomUUID(),
-            ...options.release ? { release: options.release } : {},
-            quest,
-            stage: "claim",
-            input
+            ...release || options.release ? { release: release ?? options.release } : {}
           });
+          return submit(
+            {
+              id: crypto.randomUUID(),
+              ...options.release ? { release: options.release } : {},
+              quest,
+              stage: "claim",
+              input
+            },
+            step
+          );
         }
       };
     }
     if (options.input === "none") {
       return {
         ...handle,
-        submit() {
-          return submit({
+        async submit(call) {
+          const step = steps(call);
+          return submit(
+            {
+              id: crypto.randomUUID(),
+              ...options.release ? { release: options.release } : {},
+              quest,
+              stage: "claim",
+              input: { kind: "none" }
+            },
+            step
+          );
+        }
+      };
+    }
+    return {
+      ...handle,
+      async submit(file, call) {
+        const step = steps(call);
+        if (!["image/jpeg", "image/png"].includes(file.type) || file.size === 0 || file.size > 5 * 1024 * 1024) {
+          throw clientError(
+            "Choose a JPG or PNG photo under 5 MB",
+            RelayErrorCode.InvalidInput
+          );
+        }
+        const bytes = new Uint8Array(await file.slice(0, 4).arrayBuffer());
+        const signature = file.type === "image/png" ? [137, 80, 78, 71] : [255, 216, 255];
+        if (!signature.every((byte, index) => bytes[index] === byte)) {
+          throw clientError(
+            "Image content does not match its file type",
+            RelayErrorCode.InvalidInput
+          );
+        }
+        return submit(
+          {
             id: crypto.randomUUID(),
             ...options.release ? { release: options.release } : {},
             quest,
-            stage: "claim",
-            input: { kind: "none" }
+            stage: "upload",
+            file
+          },
+          step
+        );
+      }
+    };
+  }
+  return open;
+}
+function legacySubmissionKey(namespace, session, member, quest) {
+  return JSON.stringify([
+    "relay-submission-v1",
+    namespace,
+    session.organization,
+    session.environment,
+    session.project,
+    member,
+    quest
+  ]);
+}
+async function legacySubmissionState(store, key) {
+  try {
+    const saved = await store.read(key);
+    if (saved === void 0 || saved === null) {
+      return "none";
+    }
+    const parsed = recordSchema.safeParse(saved);
+    return parsed.success && parsed.data.stage === "submitted" ? "submitted" : "unfinished";
+  } catch {
+    return "none";
+  }
+}
+
+// src/submissions.ts
+function steps(options = {}) {
+  const { signal, timeout } = options;
+  if (timeout !== void 0 && !validTimeout(timeout)) {
+    throw clientError(
+      "timeout must be a positive, finite number of milliseconds",
+      RelayErrorCode.InvalidInput
+    );
+  }
+  const ends = timeout === void 0 ? void 0 : Date.now() + timeout;
+  return () => {
+    if (signal?.aborted) {
+      throw new RelayError("The request was cancelled", {
+        kind: "aborted",
+        code: RelayErrorCode.Aborted,
+        cause: signal.reason
+      });
+    }
+    if (ends === void 0) {
+      return { signal };
+    }
+    const remaining = ends - Date.now();
+    if (remaining <= 0) {
+      throw new RelayError(`Relay did not respond within ${timeout} ms`, {
+        kind: "timeout",
+        code: RelayErrorCode.Timeout
+      });
+    }
+    return { signal, timeout: remaining };
+  };
+}
+var questChanged = (error) => isRelayError(error) && error.kind === "http" && error.status === 409 && (error.code === RelayErrorCode.QuestUpdated || error.code === RelayErrorCode.StaleQuiz);
+function submissions(transport, configuredStore, namespace) {
+  const legacy = configuredStore ? legacySubmissions(transport.legacy, configuredStore, namespace) : null;
+  async function open(quest, options = { input: "photo" }) {
+    parseInput(identifier, quest);
+    parseInput(identifier.optional(), options.release);
+    const session = await transport.session();
+    const member = sessionMember(session);
+    if (!session || !member) {
+      throw clientError(
+        "Sign in to submit an activity",
+        RelayErrorCode.NotSignedIn
+      );
+    }
+    const sessionId = session.id;
+    const legacyKey = legacySubmissionKey(namespace, session, member, quest);
+    const legacyState = async () => configuredStore && legacy ? legacySubmissionState(configuredStore, legacyKey) : "none";
+    const pendingLegacy = async () => await legacyState() === "unfinished";
+    const legacyHandle = await legacyState() !== "none" ? await legacy(
+      quest,
+      options
+    ) : null;
+    const draftOf = (submission, file) => file ? { kind: "photo", file } : submission.input ? submission.input : options.input === "none" ? { kind: "none" } : null;
+    const outdated = (submission) => submission.reviewRequired || options.release !== void 0 && submission.release !== null && submission.release !== options.release;
+    const drafted = (submission) => options.input === "none" ? true : options.input === "photo" ? submission.evidence !== null : submission.release !== null || submission.input !== null || submission.evidence !== null;
+    async function finish(submission, step, file) {
+      let attempt;
+      try {
+        attempt = (await transport.submit(submission.id, sessionId, step())).attempt;
+      } catch (error) {
+        if (questChanged(error)) {
+          throw new QuestUpdatedError(
+            error.message,
+            error.code,
+            draftOf(submission, file),
+            error
+          );
+        }
+        throw error;
+      }
+      return attempt.status === "failed" ? transport.retry(attempt.id, sessionId, step()) : attempt;
+    }
+    async function submit(draft, step) {
+      const current = await transport.current(quest, sessionId, step());
+      if (current?.status === "submitted" && current.attempt) {
+        const previous = await finish(current, step);
+        if (previous.status !== "rejected" && !(options.repeatable && previous.status === "accepted")) {
+          return previous;
+        }
+      }
+      const opened = await transport.open(quest, sessionId, step());
+      let saved;
+      try {
+        saved = await transport.save(
+          opened.id,
+          {
+            release: options.release ?? null,
+            input: draft.input ?? null,
+            evidence: null
+          },
+          sessionId,
+          step()
+        );
+        if (draft.file) {
+          saved = await transport.upload(
+            opened.id,
+            draft.file,
+            sessionId,
+            step()
+          );
+        }
+      } catch (error) {
+        if (isRelayError(error) && error.code === "submission-closed") {
+          return finish(opened, step, draft.file);
+        }
+        throw error;
+      }
+      try {
+        return await finish(saved, step, draft.file);
+      } catch (error) {
+        if (isRelayError(error) && error.code === "attempt-pending") {
+          await transport.discard(saved.id, sessionId, step());
+          const latest = await transport.current(quest, sessionId, step());
+          if (latest?.status === "submitted" && latest.attempt) {
+            return finish(latest, step);
+          }
+        }
+        throw error;
+      }
+    }
+    const serverHandle = {
+      async status(call) {
+        const step = steps(call);
+        const current = await transport.current(quest, sessionId, step());
+        if (!current) {
+          return { kind: "empty" };
+        }
+        if (current.status === "submitted" && current.attempt) {
+          return { kind: "submitted", attempt: current.attempt };
+        }
+        if (current.status !== "open" || !drafted(current)) {
+          return { kind: "empty" };
+        }
+        return outdated(current) ? { kind: "needs-review" } : { kind: "pending", stage: "claim" };
+      },
+      async resume(call) {
+        const step = steps(call);
+        const current = await transport.current(quest, sessionId, step());
+        if (current?.status === "open" && drafted(current)) {
+          if (outdated(current)) {
+            throw new QuestUpdatedError(
+              "This quest changed. Review it before submitting again.",
+              "quest-updated",
+              draftOf(current)
+            );
+          }
+          return finish(current, step);
+        }
+        if (current?.status === "submitted") {
+          return finish(current, step);
+        }
+        throw clientError(
+          "There is no saved submission to resume",
+          RelayErrorCode.SubmissionConflict
+        );
+      },
+      async discard(call) {
+        const step = steps(call);
+        const current = await transport.current(quest, sessionId, step());
+        if (current?.status === "open") {
+          await transport.discard(current.id, sessionId, step());
+        }
+      }
+    };
+    const viaLegacy = (server, pick) => async (...args) => legacyHandle && await pendingLegacy() ? pick(legacyHandle)(...args) : server(...args);
+    const handle = {
+      status: viaLegacy(serverHandle.status, (h) => h.status),
+      async resume(call) {
+        const state = legacyHandle ? await legacyState() : "none";
+        if (legacyHandle && (state === "unfinished" || state === "submitted" && !await transport.current(quest, sessionId, steps(call)()))) {
+          return legacyHandle.resume(call);
+        }
+        return serverHandle.resume(call);
+      },
+      discard: viaLegacy(serverHandle.discard, (h) => h.discard)
+    };
+    if (options.input === "text" || options.input === "url") {
+      const kind = options.input;
+      return {
+        ...handle,
+        async submit(value, call) {
+          if (legacyHandle && await pendingLegacy()) {
+            return legacyHandle.submit(value, call);
+          }
+          const input = parseInput(valueEvidenceSchema, { kind, value });
+          return submit({ input }, steps(call));
+        }
+      };
+    }
+    if (options.input === "quiz") {
+      return {
+        ...handle,
+        async submit(answers, call = {}) {
+          if (legacyHandle && await pendingLegacy()) {
+            return legacyHandle.submit(answers, call);
+          }
+          const { release, ...callOptions } = call;
+          const step = steps(callOptions);
+          const input = parseInput(quizEvidenceSchema, {
+            kind: "quiz",
+            answers,
+            ...release || options.release ? { release: release ?? options.release } : {}
           });
+          return submit({ input }, step);
+        }
+      };
+    }
+    if (options.input === "none") {
+      return {
+        ...handle,
+        async submit(call) {
+          if (legacyHandle && await pendingLegacy()) {
+            return legacyHandle.submit(call);
+          }
+          return submit({}, steps(call));
         }
       };
     }
     return {
       ...handle,
-      async submit(file) {
+      async submit(file, call) {
+        if (legacyHandle && await pendingLegacy()) {
+          return legacyHandle.submit(file, call);
+        }
+        const step = steps(call);
         if (!["image/jpeg", "image/png"].includes(file.type) || file.size === 0 || file.size > 5 * 1024 * 1024) {
           throw clientError(
             "Choose a JPG or PNG photo under 5 MB",
@@ -465,13 +766,7 @@ function submissions(transport, configuredStore, namespace) {
             RelayErrorCode.InvalidInput
           );
         }
-        return submit({
-          id: crypto.randomUUID(),
-          ...options.release ? { release: options.release } : {},
-          quest,
-          stage: "upload",
-          file
-        });
+        return submit({ file }, step);
       }
     };
   }
@@ -493,7 +788,7 @@ var QuestUpdatedError = class extends RelayError {
 };
 
 // src/client.ts
-import { z as z2 } from "zod";
+import * as z2 from "zod";
 
 // src/progress.ts
 function sessionEnded(error) {
@@ -680,16 +975,22 @@ function reconcileQuestDraft(view, draft) {
 }
 function questActions(submission, latest) {
   return async (view) => {
-    async function run(task) {
+    async function run(call, task) {
+      const step = steps(call);
       try {
         return { kind: "submitted", attempt: await task() };
       } catch (error) {
         if (!(error instanceof QuestUpdatedError)) {
           throw error;
         }
-        const current = await latest(view.quest).catch(() => {
-          throw error;
-        });
+        const current = await latest(view.quest, step()).catch(
+          (failure) => {
+            if (isRelayError(failure) && (failure.kind === "aborted" || failure.kind === "timeout")) {
+              throw failure;
+            }
+            throw error;
+          }
+        );
         return {
           kind: "quest-updated",
           latest: current,
@@ -710,7 +1011,7 @@ function questActions(submission, latest) {
         view,
         status: handle.status,
         discard: handle.discard,
-        resume: () => run(handle.resume)
+        resume: (call) => run(call, () => handle.resume(call))
       };
     }
     switch (view.interaction) {
@@ -728,8 +1029,8 @@ function questActions(submission, latest) {
           view,
           status: handle.status,
           discard: handle.discard,
-          resume: () => run(handle.resume),
-          submit: (value) => run(() => {
+          resume: (call) => run(call, () => handle.resume(call)),
+          submit: (value, call) => run(call, () => {
             if (view.trigger.kind !== "manual" || view.trigger.input !== "text" && view.trigger.input !== "url") {
               throw clientError(
                 "Quest input changed",
@@ -743,7 +1044,7 @@ function questActions(submission, latest) {
             if (problem) {
               throw clientError(problem, RelayErrorCode.InvalidInput);
             }
-            return handle.submit(value);
+            return handle.submit(value, call);
           })
         };
       }
@@ -759,8 +1060,8 @@ function questActions(submission, latest) {
           view,
           status: handle.status,
           discard: handle.discard,
-          resume: () => run(handle.resume),
-          submit: (file) => run(() => handle.submit(file))
+          resume: (call) => run(call, () => handle.resume(call)),
+          submit: (file, call) => run(call, () => handle.submit(file, call))
         };
       }
       case "quiz": {
@@ -775,8 +1076,14 @@ function questActions(submission, latest) {
           view,
           status: handle.status,
           discard: handle.discard,
-          resume: () => run(handle.resume),
-          submit: (answers) => run(() => handle.submit(answers, { release: view.release }))
+          resume: (call) => run(call, () => handle.resume(call)),
+          submit: (answers, call) => run(
+            call,
+            () => handle.submit(answers, {
+              ...call,
+              release: view.release
+            })
+          )
         };
       }
       case "claim": {
@@ -791,8 +1098,8 @@ function questActions(submission, latest) {
           view,
           status: handle.status,
           discard: handle.discard,
-          resume: () => run(handle.resume),
-          submit: () => run(handle.submit)
+          resume: (call) => run(call, () => handle.resume(call)),
+          submit: (call) => run(call, () => handle.submit(call))
         };
       }
     }
@@ -800,6 +1107,14 @@ function questActions(submission, latest) {
 }
 
 // src/client.ts
+var authStartSchema = z2.strictObject({
+  provider: authProviderSchema,
+  mode: z2.enum(["sign-in", "connect"])
+});
+var emailVerificationSchema = z2.strictObject({
+  challenge: z2.string().min(1).max(200),
+  code: z2.string().transform((code) => code.trim()).pipe(z2.string().regex(/^\d{6}$/, "Enter the 6-digit code"))
+});
 function errorBody(value) {
   const body = value !== null && typeof value === "object" ? value : {};
   const window = body.window === "tracker" ? "tracker" : body.window === "quest" ? "quest" : void 0;
@@ -900,40 +1215,123 @@ function relayClient(options) {
   if (options.timeout !== void 0 && !validTimeout(options.timeout)) {
     throw invalidTimeout();
   }
-  const clientTimeout = options.timeout ?? PARTICIPANT_TIMEOUT;
-  async function send(path, call, life) {
-    const method = methodOf(call);
-    const headers = new Headers(call.headers);
-    headers.set("X-Domino-Client", clientIdentity());
-    let body2 = call.body;
+  if (options.token !== void 0 && options.getToken) {
+    throw clientError(
+      "Pass token or getToken, not both",
+      RelayErrorCode.InvalidInput
+    );
+  }
+  try {
+    const headers = new Headers(options.headers);
     if (options.token) {
       headers.set("Authorization", `Bearer ${options.token}`);
     }
-    if (options.organization) {
-      headers.set("X-Relay-Organization", options.organization);
-    }
-    if (options.project) {
-      headers.set("X-Relay-Project", options.project);
-    }
-    if (options.environment) {
-      headers.set("X-Relay-Environment", options.environment);
+    headers.set("X-Relay-Organization", options.organization ?? "");
+    headers.set("X-Relay-Project", options.project ?? "");
+  } catch (error) {
+    throw clientError(
+      "headers, token, organization and project must be valid HTTP header values",
+      RelayErrorCode.InvalidInput,
+      { cause: error }
+    );
+  }
+  const clientTimeout = options.timeout ?? PARTICIPANT_TIMEOUT;
+  async function credential(call, life) {
+    if (!options.getToken) {
+      return options.token;
     }
-    if (call.options?.session) {
-      headers.set("X-Relay-Session", call.options.session);
+    const getToken = options.getToken;
+    try {
+      return await new Promise((resolve, reject) => {
+        const stop = () => reject(life.signal.reason);
+        life.signal.addEventListener("abort", stop, { once: true });
+        getToken().then(resolve, reject).finally(() => life.signal.removeEventListener("abort", stop));
+      });
+    } catch (error) {
+      if (life.signal.aborted) {
+        throw interrupted(call, life, error, { sent: false });
+      }
+      throw new RelayError("Could not get a Relay credential", {
+        // A token source that could not reach its own service failed like a network call.
+        kind: error instanceof TypeError ? "network" : "client",
+        code: RelayErrorCode.Credential,
+        operationId: call.operationId,
+        replaySafe: call.replaySafe,
+        cause: error
+      });
     }
-    if (call.json !== void 0) {
-      headers.set("Content-Type", "application/json");
-      body2 = JSON.stringify(call.json);
+  }
+  async function send(path, call, life) {
+    if (life.signal.aborted) {
+      throw interrupted(call, life, life.reason(), { sent: false });
     }
-    if (method !== "GET") {
-      headers.set("X-Relay-CSRF", "1");
+    const method = methodOf(call);
+    const token = await credential(call, life);
+    let headers;
+    let body2 = call.body;
+    try {
+      headers = new Headers(options.headers);
+      new Headers(call.headers).forEach(
+        (value, name) => headers.set(name, value)
+      );
+      headers.set("X-Domino-Client", clientIdentity());
+      if (token) {
+        try {
+          headers.set("Authorization", `Bearer ${token}`);
+        } catch (error) {
+          throw new RelayError(
+            "getToken returned a value that is not a token",
+            {
+              kind: "client",
+              code: RelayErrorCode.Credential,
+              operationId: call.operationId,
+              replaySafe: call.replaySafe,
+              cause: error
+            }
+          );
+        }
+      } else if (options.getToken) {
+        headers.delete("Authorization");
+      }
+      if (options.organization) {
+        headers.set("X-Relay-Organization", options.organization);
+      }
+      if (options.project) {
+        headers.set("X-Relay-Project", options.project);
+      }
+      if (options.environment) {
+        headers.set("X-Relay-Environment", options.environment);
+      }
+      if (call.options?.session) {
+        headers.set("X-Relay-Session", call.options.session);
+      }
+      if (call.json !== void 0) {
+        headers.set("Content-Type", "application/json");
+        body2 = JSON.stringify(call.json);
+      }
+      if (method !== "GET") {
+        headers.set("X-Relay-CSRF", "1");
+      }
+    } catch (error) {
+      if (isRelayError(error)) {
+        throw error;
+      }
+      throw clientError(
+        "The request has a header or body that cannot be sent",
+        RelayErrorCode.InvalidInput,
+        {
+          operationId: call.operationId,
+          replaySafe: call.replaySafe,
+          cause: error
+        }
+      );
     }
     if (life.signal.aborted) {
       throw interrupted(call, life, life.reason(), { sent: false });
     }
     let response;
     try {
-      response = await fetch(options.baseUrl + path, {
+      response = await (options.fetch ?? fetch)(options.baseUrl + path, {
         method,
         headers,
         body: body2,
@@ -1078,23 +1476,65 @@ function relayClient(options) {
   }
   const submission = submissions(
     {
-      session: () => readSession(),
-      upload: (file, action, session) => request("/v1/me/evidence", evidenceSchema, {
+      session: (call) => readSession(call),
+      current: (quest, session, call) => request(
+        `/v1/me/quests/${quest}/submission`,
+        questSubmissionSchema.nullable(),
+        { options: { ...call, session } }
+      ),
+      // Opening, saving, submitting and discarding apply once: each repeat returns the same
+      // submission or attempt, so all are replay-safe.
+      open: (quest, session, call) => request(`/v1/me/quests/${quest}/submission`, questSubmissionSchema, {
+        json: {},
+        options: { ...call, session },
+        replaySafe: true
+      }),
+      save: (id, update, session, call) => request(`/v1/me/submissions/${id}`, questSubmissionSchema, {
+        json: update,
+        options: { ...call, session },
+        replaySafe: true
+      }),
+      submit: (id, session, call) => request(
+        `/v1/me/submissions/${id}/submit`,
+        questSubmissionResultSchema,
+        { json: {}, options: { ...call, session }, operationId: id }
+      ),
+      discard: (id, session, call) => request(`/v1/me/submissions/${id}/discard`, questSubmissionSchema, {
+        json: {},
+        options: { ...call, session },
+        operationId: id
+      }),
+      // Relay derives the upload ID from the submission and the bytes: a repeat attaches the same photo.
+      upload: (id, file, session, call) => request(`/v1/me/submissions/${id}/evidence`, questSubmissionSchema, {
         method: "POST",
         body: file,
-        headers: { "Content-Type": file.type, "X-Relay-Upload-ID": action },
-        options: { session },
-        operationId: action
-      }),
-      claim: async (claim, session) => request("/v1/me/attempts", attemptSchema, {
-        json: claim,
-        options: { session },
-        operationId: claim.actionId
+        headers: { "Content-Type": file.type },
+        options: { ...call, session },
+        replaySafe: true
       }),
-      retry: (attempt, session) => request(`/v1/attempts/${attempt}/retry`, attemptSchema, {
+      retry: (attempt, session, call) => request(`/v1/attempts/${attempt}/retry`, attemptSchema, {
         json: {},
-        options: { session }
-      })
+        options: { ...call, session }
+      }),
+      legacy: {
+        session: (call) => readSession(call),
+        upload: (file, action, session, call) => request("/v1/me/evidence", evidenceSchema, {
+          method: "POST",
+          body: file,
+          headers: { "Content-Type": file.type, "X-Relay-Upload-ID": action },
+          options: { ...call, session },
+          operationId: action
+        }),
+        claim: async (claim, session, call) => request("/v1/me/attempts", attemptSchema, {
+          json: claim,
+          options: { ...call, session },
+          operationId: claim.actionId
+        }),
+        retry: (attempt, session, call) => request(`/v1/attempts/${attempt}/retry`, attemptSchema, {
+          json: {},
+          options: { ...call, session }
+        })
+      }
     },
     options.submissionStore,
     options.baseUrl
@@ -1124,6 +1564,26 @@ function relayClient(options) {
     }
     return quest;
   }
+  async function authStart(start, ...rest) {
+    const [value, requestOptions] = typeof start === "string" ? [{ provider: start, mode: rest[0] }, rest[1]] : [start, rest[0]];
+    return request("/v1/auth/start", z2.object({ url: z2.string() }), {
+      json: parseInput(authStartSchema, value),
+      options: requestOptions
+    });
+  }
+  async function emailVerify(verification, ...rest) {
+    const [value, requestOptions] = typeof verification === "string" ? [
+      { challenge: verification, code: rest[0] },
+      rest[1]
+    ] : [verification, rest[0]];
+    const body2 = parseInput(emailVerificationSchema, value);
+    return changeSession(
+      () => request("/v1/auth/email/verify", participantSessionSchema, {
+        json: body2,
+        options: requestOptions
+      })
+    );
+  }
   const ok = z2.object({ ok: z2.literal(true) });
   const acknowledged = z2.object({ ok: z2.boolean() });
   return {
@@ -1159,10 +1619,13 @@ function relayClient(options) {
         options: requestOptions
       }),
       /** Redeems one offer. Persist `actionId` to retry after an uncertain result. */
-      redeem: (offer, input = {}, requestOptions) => {
-        const actionId = identifier.parse(input.actionId ?? crypto.randomUUID());
+      redeem: async (offer, value = {}, requestOptions) => {
+        const actionId = parseInput(
+          identifier,
+          value.actionId ?? crypto.randomUUID()
+        );
         return request(
-          `/v1/offers/${identifier.parse(offer)}/redeem`,
+          `/v1/offers/${parseInput(identifier, offer)}/redeem`,
           redemptionSchema,
           {
             json: { actionId },
@@ -1252,7 +1715,7 @@ function relayClient(options) {
      * `@domino-sdk/relay/avatar`.
      */
     profiles: {
-      badges: (profile, options2) => request(
+      badges: async (profile, options2) => request(
         `/v1/profiles/${parseInput(identifier, profile)}/badges`,
         memberBadgesSchema,
         { options: options2 }
@@ -1412,7 +1875,7 @@ function relayClient(options) {
         }
         return collection;
       },
-      open: questActions(submission, (id) => getQuest(id)),
+      open: questActions(submission, (id, options2) => getQuest(id, options2)),
       observe: (listener, observeOptions) => {
         const observer = observeProgress(
           {
@@ -1530,32 +1993,17 @@ function relayClient(options) {
         }),
         { options: requestOptions }
       ),
-      start: async (provider, mode, requestOptions) => request("/v1/auth/start", z2.object({ url: z2.string() }), {
+      start: authStart,
+      emailStart: async (email2, requestOptions) => request("/v1/auth/email/start", z2.object({ challenge: z2.string() }), {
         json: {
-          provider: parseInput(authProviderSchema, provider),
-          mode: parseInput(z2.enum(["sign-in", "connect"]), mode)
+          email: parseInput(
+            z2.email().max(254),
+            typeof email2 === "string" ? email2.trim() : email2
+          )
         },
         options: requestOptions
       }),
-      emailStart: async (email, requestOptions) => request("/v1/auth/email/start", z2.object({ challenge: z2.string() }), {
-        json: { email: parseInput(z2.email().max(254), email.trim()) },
-        options: requestOptions
-      }),
-      emailVerify: async (challenge, code, requestOptions) => {
-        const body2 = {
-          challenge: parseInput(z2.string().min(1).max(200), challenge),
-          code: parseInput(
-            z2.string().regex(/^\d{6}$/, "Enter the 6-digit code"),
-            code.trim()
-          )
-        };
-        return changeSession(
-          () => request("/v1/auth/email/verify", participantSessionSchema, {
-            json: body2,
-            options: requestOptions
-          })
-        );
-      },
+      emailVerify,
       /**
        * Sign in, or sign up, with a Solana, EVM or Cosmos wallet where the project enabled it
        * (`providers().wallets`). A wallet the member linked while signed in cannot sign in.
@@ -1652,7 +2100,7 @@ function relayClient(options) {
             })
           ),
           /** Links the Telegram user who opened the Mini App to the signed-in member. */
-          connect: (initData, requestOptions) => request("/v1/auth/telegram/mini-app", acknowledged, {
+          connect: async (initData, requestOptions) => request("/v1/auth/telegram/mini-app", acknowledged, {
             json: parseInput(telegramMiniAppSignInSchema, {
               initData,
               mode: "connect"
@@ -1685,7 +2133,7 @@ function relayClient(options) {
     me: {
       badges: (options2) => request("/v1/me/badges", memberBadgesSchema, { options: options2 }),
       activity: {
-        list: (query = {}, options2) => {
+        list: async (query = {}, options2) => {
           const parsed = parseInput(participantActivityQuerySchema, query);
           return request(
             withQuery("/v1/me/activity", parsed),
@@ -1801,7 +2249,7 @@ function relayClient(options) {
         });
       },
       /** Uploads evidence with a generated key; reuse `actionId` and the same file to replay. */
-      upload: (file, requestOptions = {}) => {
+      upload: async (file, requestOptions = {}) => {
         const { actionId, uploadId, ...options2 } = requestOptions;
         const operationId = parseInput(
           identifier,