@domino-sdk/relay 1.62.0 → 1.65.0

package/dist/internal.js

@@ -4,72 +4,102 @@ import {
   managementTransport,
   questConfiguration,
   sequenceCursorSchema
-} from "./chunk-UPQPUJOU.js";
+} from "./chunk-CVQZ2YP7.js";
 import {
   parseImageExtraction,
   parseImageResult
-} from "./chunk-E6IKQHTX.js";
-import "./chunk-QYPMPWVX.js";
+} from "./chunk-EDNKKVGU.js";
 import {
   sourceDataSchema,
   sourceRoles,
   validateQuestShape
-} from "./chunk-5TEYFX6X.js";
+} from "./chunk-SE7XHQFP.js";
+import {
+  bareOrigin,
+  loopbackHosts,
+  secureOrLoopbackOrigin
+} from "./chunk-UZ765UGH.js";
 import {
   accountVouchedBySchema,
   identityIntegrationAccountVouchingInputSchema,
+  identityIntegrationAppSecretSchema,
   identityIntegrationInputSchema,
+  identityIntegrationKeySchema,
   identityIntegrationSchema,
   identityIntegrationSecretSchema,
   identityKindClaimSchema,
+  nextScheduleRun,
   participantExchangeAccountResultSchema,
   participantExchangeAccountsSchema,
   participantExchangeResultSchema,
   participantExchangeSchema
-} from "./chunk-UAKYDVT3.js";
+} from "./chunk-ZXGBDLVB.js";
 import {
   isIntegrationParticipantPath,
   isParticipantRoute,
   participantRoutePattern,
   participantRoutes
-} from "./chunk-CZFXGGEK.js";
+} from "./chunk-U66GUVSG.js";
+import "./chunk-RD3XJ4DH.js";
+import "./chunk-XVZ4YOF2.js";
+import {
+  dashboardIssue,
+  normalizeDashboard
+} from "./chunk-ZQ3IPCI6.js";
+import "./chunk-MWMCQLCG.js";
 import {
   hostEnvironmentPath,
   hostEnvironmentSchema
-} from "./chunk-KDR2VAJP.js";
+} from "./chunk-UYVJZR33.js";
+import "./chunk-7H4MRVQF.js";
 import {
   MANAGEMENT_TIMEOUT,
   lifetime,
   retryAfter,
   retrying
-} from "./chunk-3PYYGFSB.js";
-import "./chunk-XJFYAXET.js";
+} from "./chunk-DLABJSBO.js";
+import "./chunk-MPTE7EIV.js";
+import "./chunk-R2KZFX6E.js";
+import "./chunk-NG4GZ54I.js";
 import {
+  compatibleSettingKinds,
+  isBoundSetting,
   schemaCheckedReader,
+  sourceContent,
   trackerDataBatchSteps,
   trackerDataIssue,
   trackerDataIssues,
   trackerDataPathTypes,
   trackerDataRecordSteps,
-  whereSchemaIssue
-} from "./chunk-MK425RXJ.js";
-import "./chunk-K2KS3JLY.js";
+  whereSchemaIssue,
+  whereSettings
+} from "./chunk-HNR6G3GV.js";
+import "./chunk-EOUEAOWJ.js";
 export {
   MANAGEMENT_TIMEOUT,
   REFERRAL_INTEGRATION_REWARD_ERROR,
   accountVouchedBySchema,
+  bareOrigin,
+  compatibleSettingKinds,
   containsReferralIntegrationReward,
+  dashboardIssue,
   hostEnvironmentPath,
   hostEnvironmentSchema,
   identityIntegrationAccountVouchingInputSchema,
+  identityIntegrationAppSecretSchema,
   identityIntegrationInputSchema,
+  identityIntegrationKeySchema,
   identityIntegrationSchema,
   identityIntegrationSecretSchema,
   identityKindClaimSchema,
+  isBoundSetting,
   isIntegrationParticipantPath,
   isParticipantRoute,
   lifetime,
+  loopbackHosts,
   managementTransport,
+  nextScheduleRun,
+  normalizeDashboard,
   parseImageExtraction,
   parseImageResult,
   participantExchangeAccountResultSchema,
@@ -82,7 +112,9 @@ export {
   retryAfter,
   retrying,
   schemaCheckedReader,
+  secureOrLoopbackOrigin,
   sequenceCursorSchema,
+  sourceContent,
   sourceDataSchema,
   sourceRoles,
   trackerDataBatchSteps,
@@ -91,5 +123,6 @@ export {
   trackerDataPathTypes,
   trackerDataRecordSteps,
   validateQuestShape,
-  whereSchemaIssue
+  whereSchemaIssue,
+  whereSettings
 };

package/dist/{analytics-BwAKLi7O.d.ts → limits-pE04y9O2.d.ts}

@@ -1,5 +1,5 @@
 import * as z from 'zod';
-import { aa as PhotoResult, V as AttemptCodeSource } from './accounts-CCqCKCVx.js';
+import { aa as PhotoResult, V as AttemptCodeSource } from './accounts-_lNsiR2k.js';
 
 /**
  * Quest code names an image; the platform fetches, decodes and pins it. No bytes or URLs cross the
@@ -729,7 +729,11 @@ declare const analyticsCatalogSchema: z.ZodObject<{
     }, z.core.$strip>>;
 }, z.core.$strip>;
 type AnalyticsCatalog = z.infer<typeof analyticsCatalogSchema>;
-/** A breakdown or query returns up to this many rows; the rest are summed into `other`. */
+/**
+ * A breakdown or query returns up to this many rows; the rest are summed into `other`.
+ *
+ * @deprecated Use `limits.analyticsQueryRows`, which a 1.x release can raise.
+ */
 declare const analyticsQueryLimit = 100;
 /**
  * What `analytics.query` reads on the wire. The metric, breakdown and filter names are checked by
@@ -823,4 +827,128 @@ declare const analyticsMetricResultSchema: z.ZodObject<{
 type AnalyticsMetricResult = z.infer<typeof analyticsMetricResultSchema>;
 type AnalyticsBreakdownRow = NonNullable<AnalyticsMetricResult["breakdown"]>["rows"][number];
 
-export { analyticsBreakdowns as $, xIdSchema as A, xPostSchema as B, xProfileSchema as C, xRequestSchema as D, type Extracted as E, xUserLookupInputSchema as F, xUserSchema as G, xUsernameSchema as H, type ImageReader as I, type AnalyticsMetricId as J, analyticsCatalog as K, type AnalyticsQuery as L, type AnalyticsRead as M, type AnalyticsCatalog as N, type AnalyticsMetricQuery as O, type PublishedImage as P, type AnalyticsMetricResult as Q, type AnalyticsBreakdown as R, type AnalyticsBreakdownRow as S, type AnalyticsCatalogEntry as T, type AnalyticsChart as U, type AnalyticsFilter as V, type AnalyticsMetric as W, type XReader as X, type AnalyticsMetricKind as Y, type AnalyticsQuest as Z, type AnalyticsRange as _, type ImageAssetArtifact as a, analyticsCatalogSchema as a0, analyticsCharts as a1, analyticsFilters as a2, analyticsMetricIds as a3, analyticsMetricQuerySchema as a4, analyticsMetricResultSchema as a5, analyticsQueryLimit as a6, analyticsQuerySchema as a7, analyticsRanges as a8, analyticsReadSchema as a9, type ImageComparison as b, type ImageExtraction as c, type ImageFields as d, type ImageInspection as e, type ImageReference as f, type ImageRequest as g, type ImageSightings as h, type XConnection as i, type XPost as j, type XProfile as k, type XUser as l, type XUserLookupInput as m, imageAssetArtifactSchema as n, imageComparisonSchema as o, imageExtractionSchema as p, imageFieldSchema as q, imageFieldsSchema as r, imageInspectionSchema as s, imageReferenceSchema as t, imageRequestSchema as u, imageSightingsSchema as v, imageUploadRequestSchema as w, imageUploadsSchema as x, publishedImageSchema as y, xConnectionSchema as z };
+/**
+ * Relay's platform limits. A 1.x release can raise them, and add new ones. Released SDKs keep
+ * checking the values they shipped with, so Relay answers them within those.
+ *
+ * @compat output
+ */
+type Limits = {
+    /** Quests one deployment, draft or release batch can hold. */
+    readonly quests: number;
+    /** Quest types one deployment, draft or release batch can hold. */
+    readonly questTypes: number;
+    /** Collections one deployment, draft or release batch can hold. */
+    readonly collections: number;
+    /** The SDK runtime a quest bundle imports instead of bundling. */
+    readonly sdkRuntime: {
+        /** Modules in one runtime. */
+        readonly modules: number;
+        /** Characters of module source, summed over all modules. */
+        readonly size: number;
+    };
+    /** The most completions one `ctx.member.completions()` call returns, and its default `limit`. */
+    readonly memberCompletions: number;
+    /** Panels one dashboard holds. */
+    readonly dashboardPanels: number;
+    /** Dashboards that are not archived one project holds. */
+    readonly dashboards: number;
+    /** Bounds for successful non-terminal evaluator decisions, independent of failure retries. */
+    readonly defer: {
+        readonly minRetryAfterMs: number;
+        readonly maxRetryAfterMs: number;
+        /** The delay a defer without `retryAfterMs` waits. */
+        readonly retryAfterMs: number;
+        /** How long after the first defer an attempt can still be deferred. */
+        readonly horizonMs: number;
+        readonly maxDefers: number;
+    };
+    /**
+     * Bounds of a quest's retry cooldown (`retryCooldownMs`) and completion cooldown
+     * (`completionCooldownMs`).
+     */
+    readonly retryCooldown: {
+        readonly minMs: number;
+        readonly maxMs: number;
+    };
+    /** Rows an analytics breakdown or query returns; the rest are summed into `other`. */
+    readonly analyticsQueryRows: number;
+    /** Limits of hosted apps, per project environment. */
+    readonly apps: {
+        /** App secrets one project environment holds. */
+        readonly secrets: number;
+        /** KV stores one app declares. */
+        readonly kvStores: number;
+        /** SQL stores one app declares. */
+        readonly sqlStores: number;
+        /** Migrations one SQL store holds. */
+        readonly migrations: number;
+        /** Bytes of one migration file. */
+        readonly migrationFileBytes: number;
+        /** Bytes of one SQL store's migrations, summed. */
+        readonly migrationTotalBytes: number;
+        /** Rows per page when browsing a SQL store's table. */
+        readonly storageRows: number;
+        /** Longest text a browsed cell or KV value shows; longer values end in `truncated`. */
+        readonly storagePreviewCharacters: number;
+        /** Characters a full SQL value read returns per page. */
+        readonly storageCellCharacters: number;
+        /**
+         * KV keys one test storage clear deletes before answering `complete: false`: one Cloudflare
+         * bulk delete, which takes at most 10,000 keys.
+         */
+        readonly storageClearKeys: number;
+        /** KV keys a test storage clear's dry run counts before answering `complete: false`. */
+        readonly storageClearCountKeys: number;
+        /** Schedules one app declares. */
+        readonly schedules: number;
+        /** The shortest interval between two runs of one schedule, in milliseconds. */
+        readonly scheduleMinIntervalMs: number;
+        /** How long Relay waits for a scheduled route to answer, in milliseconds. */
+        readonly scheduleTimeoutMs: number;
+        /**
+         * The most a scheduled route's JSON answer can hold for Relay to record it as the run's result.
+         */
+        readonly scheduleResultBytes: number;
+    };
+    /** Caps on a build's staged quest and catalog code. */
+    readonly stagedDeployment: {
+        /** Bytes of JSON, uncompressed. */
+        readonly size: number;
+        /** Bytes of the Brotli-compressed object. */
+        readonly compressedSize: number;
+    };
+    /**
+     * The most capability calls one hosted evaluation run can make, shared by all capabilities. The
+     * next call throws a `CapabilityError` with code `capability-limit`.
+     */
+    readonly capabilityCalls: number;
+    /** Bounds of a tracker data schema. */
+    readonly trackerData: {
+        /** The most branches one union may list. */
+        readonly branches: number;
+        /**
+         * The most properties, `required` keys, enum values or allowed key names one schema node lists.
+         */
+        readonly entries: number;
+    };
+    /** Bounds of an X search preview: one sample, never stored, never a tracker. */
+    readonly trackerPreview: {
+        readonly pages: number;
+        readonly posts: number;
+        readonly days: number;
+    };
+    /**
+     * The most wallets of one chain family a member can have linked to one project at a time. Sign-in
+     * wallets do not count: signing in always links the wallet.
+     */
+    readonly walletsPerChain: number;
+    /** The most logs one `ctx.wallet.events()` read may match before `where` filters them. */
+    readonly walletEventLogs: number;
+    /** The most transactions one `ctx.wallet.transactions()` read fetches per wallet. */
+    readonly walletTransactions: number;
+};
+/** Relay's platform limits. A 1.x release can raise them, so read them here at run time. */
+declare const limits: Limits;
+
+export { type AnalyticsQuest as $, type AnalyticsMetricId as A, publishedImageSchema as B, xConnectionSchema as C, xIdSchema as D, type Extracted as E, xPostSchema as F, xProfileSchema as G, xRequestSchema as H, type ImageReader as I, xUserLookupInputSchema as J, xUserSchema as K, type Limits as L, xUsernameSchema as M, type AnalyticsQuery as N, type AnalyticsRead as O, type PublishedImage as P, type AnalyticsCatalog as Q, type AnalyticsMetricQuery as R, type AnalyticsMetricResult as S, type AnalyticsBreakdown as T, type AnalyticsBreakdownRow as U, type AnalyticsCatalogEntry as V, type AnalyticsChart as W, type XReader as X, type AnalyticsFilter as Y, type AnalyticsMetric as Z, type AnalyticsMetricKind as _, analyticsCatalog as a, type AnalyticsRange as a0, analyticsBreakdowns as a1, analyticsCatalogSchema as a2, analyticsCharts as a3, analyticsFilters as a4, analyticsMetricIds as a5, analyticsMetricQuerySchema as a6, analyticsMetricResultSchema as a7, analyticsQueryLimit as a8, analyticsQuerySchema as a9, analyticsRanges as aa, analyticsReadSchema as ab, type ImageAssetArtifact as b, type ImageComparison as c, type ImageExtraction as d, type ImageFields as e, type ImageInspection as f, type ImageReference as g, type ImageRequest as h, type ImageSightings as i, type XConnection as j, type XPost as k, limits as l, type XProfile as m, type XUser as n, type XUserLookupInput as o, imageAssetArtifactSchema as p, imageComparisonSchema as q, imageExtractionSchema as r, imageFieldSchema as s, imageFieldsSchema as t, imageInspectionSchema as u, imageReferenceSchema as v, imageRequestSchema as w, imageSightingsSchema as x, imageUploadRequestSchema as y, imageUploadsSchema as z };

package/dist/{offers-DhAtss4_.d.ts → offers-Hw2P6tcK.d.ts}

@@ -1,6 +1,6 @@
 import * as z from 'zod';
-import { R as ResourceHandle } from './tracker-data-Hb1uQnk5.js';
-import { Z as AuthoringIdentity } from './accounts-CCqCKCVx.js';
+import { R as ResourceHandle } from './tracker-data-Bl-qPIvZ.js';
+import { Z as AuthoringIdentity } from './accounts-_lNsiR2k.js';
 
 declare const badgePropertiesSchema: z.ZodObject<{
     name: z.ZodString;
@@ -92,6 +92,7 @@ type ManagedBadge = z.infer<typeof managedBadgeSchema>;
 type MemberBadge = z.infer<typeof memberBadgeSchema>;
 /** @compat output */
 type MemberBadges = z.infer<typeof memberBadgesSchema>;
+/** The active badge catalog, as `GET /v1/badges/catalog` returns it. */
 type BadgeCatalog = z.infer<typeof badgeCatalogSchema>;
 
 declare const offerPriceSchema: z.ZodObject<{

package/dist/{participant-activity-D-Drp24G.d.ts → participant-activity-DXRq4s6K.d.ts}

@@ -94,6 +94,7 @@ declare const memberSummarySchema: z.ZodObject<{
     avatarSeed: z.ZodString;
     email: z.ZodDefault<z.ZodNullable<z.ZodString>>;
     emails: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    eligible: z.ZodDefault<z.ZodBoolean>;
     clock: z.ZodOptional<z.ZodObject<{
         now: z.ZodNumber;
         offsetMs: z.ZodNumber;

package/dist/portal-proxy.d.ts

@@ -1,6 +1,6 @@
-import { M as MemberImportVouchedAccount, P as ParticipantExchangeAccountResult, d as ParticipantExchangeResult } from './identity-integration-3mX6b5iH.js';
+import { M as MemberImportVouchedAccount, P as ParticipantExchangeAccountResult, a as ParticipantExchangeResult, I as IdentityIntegrationKey } from './identity-integration-Ci2vGKtX.js';
 import { R as RequestError } from './request-error-D_dUPLwo.js';
-import './tracker-data-Hb1uQnk5.js';
+import './tracker-data-Bl-qPIvZ.js';
 import 'zod';
 
 /**
@@ -60,6 +60,18 @@ declare function exchangeParticipant(options: {
     accounts?: MemberImportVouchedAccount[];
     fetch?: typeof fetch;
 }): Promise<ParticipantExchangeResult>;
+/**
+ * Which integration an app login key (`di_…`) belongs to: its organization, project, environment,
+ * origin and the expiry of this key, never a secret. Checking a key does not count as using it.
+ * `baseUrl` is the participant API origin: HTTPS, or a loopback HTTP origin for a local stack.
+ * Throws ParticipantExchangeError when Domino refuses the key: 401 `invalid-credential` for a key
+ * that is unknown, expired or revoked, or whose project was deleted.
+ */
+declare function inspectIntegrationKey(options: {
+    baseUrl: string;
+    integrationKey: string;
+    fetch?: typeof fetch;
+}): Promise<IdentityIntegrationKey>;
 /**
  * Use only in an app server route. authenticate must verify the app's own session.
  * `origin` is the app's exact HTTPS origin, or a loopback HTTP origin
@@ -69,6 +81,11 @@ declare function exchangeParticipant(options: {
  * `authenticate` may also return `accounts` the app vouches belong to the user, which needs the
  * key's **Vouches accounts** setting; `onAccounts` receives each one's outcome, such as an account
  * another member holds.
+ * `onExchangeError` receives each refused exchange as Domino answered it (status, code, message and
+ * `retryAfter`) before the browser gets its answer, so the server can log why sign-in failed. The
+ * browser's answer does not change, and a callback that throws does not change it either.
+ * The browser does not see the app's own sign-in or logout: under `RelayProvider`, call
+ * `useSession().refresh()` after each.
  */
 declare function createParticipantBackend(options: {
     baseUrl: string;
@@ -79,6 +96,7 @@ declare function createParticipantBackend(options: {
         accounts?: MemberImportVouchedAccount[];
     } | null>;
     onAccounts?: (results: ParticipantExchangeAccountResult[], request: Request) => void | Promise<void>;
+    onExchangeError?: (error: ParticipantExchangeError, request: Request) => void | Promise<void>;
     fetch?: typeof fetch;
 }): (request: Request) => Promise<Response>;
 /**
@@ -117,4 +135,4 @@ declare function signedInMember(request: Request, env: HostedAppEnv, options: {
     fetch?: typeof fetch;
 }): Promise<string | null>;
 
-export { type HostedAppEnv, ParticipantExchangeError, createParticipantBackend, exchangeParticipant, handleHostedApp, hostedAppRequest, isParticipantExchangeError, proxyParticipant, signedInMember };
+export { type HostedAppEnv, ParticipantExchangeError, createParticipantBackend, exchangeParticipant, handleHostedApp, hostedAppRequest, inspectIntegrationKey, isParticipantExchangeError, proxyParticipant, signedInMember };

package/dist/portal-proxy.js

@@ -1,23 +1,33 @@
 import {
+  secureOrLoopbackOrigin
+} from "./chunk-UZ765UGH.js";
+import {
+  identityIntegrationKeySchema,
   participantExchangeAccountsSchema,
   participantExchangeResultSchema
-} from "./chunk-UAKYDVT3.js";
+} from "./chunk-ZXGBDLVB.js";
 import {
   isParticipantRoute
-} from "./chunk-CZFXGGEK.js";
+} from "./chunk-U66GUVSG.js";
+import "./chunk-RD3XJ4DH.js";
+import "./chunk-XVZ4YOF2.js";
+import "./chunk-ZQ3IPCI6.js";
+import "./chunk-MWMCQLCG.js";
 import {
   clientIdentity,
   retryAfter
-} from "./chunk-3PYYGFSB.js";
+} from "./chunk-DLABJSBO.js";
+import "./chunk-MPTE7EIV.js";
 import {
   participantPrincipalSchema,
   sessionMember
-} from "./chunk-XJFYAXET.js";
-import "./chunk-MK425RXJ.js";
+} from "./chunk-R2KZFX6E.js";
+import "./chunk-NG4GZ54I.js";
+import "./chunk-HNR6G3GV.js";
 import {
   RequestError,
   isRequestError
-} from "./chunk-K2KS3JLY.js";
+} from "./chunk-EOUEAOWJ.js";
 
 // src/portal-proxy.ts
 import * as z from "zod";
@@ -110,9 +120,9 @@ function requestExchange(options, body) {
     })
   });
 }
-var participantExchangeErrorBrand = /* @__PURE__ */ Symbol.for(
+var participantExchangeErrorBrand = /* @__PURE__ */ (() => /* @__PURE__ */ Symbol.for(
   "@domino-sdk/relay.ParticipantExchangeError"
-);
+))();
 function isParticipantExchangeError(value) {
   return isRequestError(value) && value[participantExchangeErrorBrand] === true;
 }
@@ -139,24 +149,53 @@ async function exchangeParticipant(options) {
     accounts: options.accounts
   });
   if (!exchanged.ok) {
-    const body = await exchanged.json().catch(() => null);
-    throw new ParticipantExchangeError(
-      typeof body?.error === "string" ? body.error : `Domino identity exchange failed with status ${exchanged.status}`,
-      {
-        status: exchanged.status,
-        code: typeof body?.code === "string" ? body.code : statusCode(exchanged.status),
-        retryAfter: retryAfter(exchanged.headers)
-      }
-    );
+    throw await refusal(exchanged, "Domino identity exchange");
   }
   return participantExchangeResultSchema.parse(await exchanged.json());
 }
-var loopbackHosts = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
+async function refusal(response, what) {
+  return refusalError(response, await response.json().catch(() => null), what);
+}
+function refusalError(response, body, what) {
+  return new ParticipantExchangeError(
+    typeof body?.error === "string" ? body.error : `${what} failed with status ${response.status}`,
+    {
+      status: response.status,
+      code: typeof body?.code === "string" ? body.code : statusCode(response.status),
+      retryAfter: retryAfter(response.headers)
+    }
+  );
+}
+async function inspectIntegrationKey(options) {
+  const base = new URL(options.baseUrl);
+  if (!secureOrLoopbackOrigin(base) || base.origin !== options.baseUrl) {
+    throw new Error("Configure the exact participant API origin");
+  }
+  if (!options.integrationKey.startsWith("di_")) {
+    throw new Error(
+      "Use an identity integration server key from Console Settings"
+    );
+  }
+  const answered = await (options.fetch ?? fetch)(
+    options.baseUrl + "/v1/auth/integration",
+    {
+      method: "GET",
+      redirect: "manual",
+      headers: {
+        Authorization: "Bearer " + options.integrationKey,
+        "X-Domino-Client": clientIdentity()
+      }
+    }
+  );
+  if (!answered.ok) {
+    throw await refusal(answered, "Domino app login key check");
+  }
+  return identityIntegrationKeySchema.parse(await answered.json());
+}
 function createParticipantBackend(options) {
   const origin = new URL(options.origin);
   const base = new URL(options.baseUrl);
-  const loopback = origin.protocol === "http:" && loopbackHosts.has(origin.hostname);
-  if (origin.protocol !== "https:" && !loopback || origin.origin !== options.origin || base.protocol !== "https:" || base.origin !== options.baseUrl) {
+  if (!secureOrLoopbackOrigin(origin) || origin.origin !== options.origin || base.protocol !== "https:" || base.origin !== options.baseUrl) {
     throw new Error(
       "Configure exact HTTPS application and participant API origins"
     );
@@ -167,6 +206,7 @@ function createParticipantBackend(options) {
     );
   }
   const send = options.fetch ?? fetch;
+  const loopback = origin.protocol === "http:";
   const cookie = (token) => (
     // WebKit drops a Secure cookie on http://localhost, so a loopback origin sets it without.
     `domino_app_session=${token}; Path=/relay; HttpOnly;${loopback ? "" : " Secure;"} SameSite=Lax; Max-Age=${token ? 28800 : 0}`
@@ -204,8 +244,15 @@ function createParticipantBackend(options) {
     });
     if (!exchanged.ok) {
       const body = await exchanged.json().catch(() => null);
-      const code = typeof body?.code === "string" ? body.code : statusCode(exchanged.status);
+      const failure = refusalError(exchanged, body, "Domino identity exchange");
+      const { code } = failure;
       const wait = exchanged.headers.get("Retry-After");
+      if (options.onExchangeError) {
+        try {
+          await options.onExchangeError(failure, request);
+        } catch {
+        }
+      }
       return Response.json(
         {
           error: (exchanged.status === 409 || code === "ACCOUNT_VOUCHING_OFF") && typeof body?.error === "string" ? body.error : exchanged.status === 409 ? "Domino refused this account. Ask an organizer." : "Domino identity exchange failed. Check the server integration key and its expiry in Console Settings.",
@@ -229,6 +276,8 @@ function createParticipantBackend(options) {
     }
     const response = await proxyParticipant(request, {
       baseUrl: options.baseUrl,
+      // The integration key selects the scope; an app origin would ask for the staging pass.
+      hosted: false,
       fetch: async (target, init) => {
         const headers2 = new Headers(init?.headers);
         headers2.delete("Cookie");
@@ -320,13 +369,14 @@ async function signedInMember(request, env, options) {
   );
   return session.success ? sessionMember(session.data) : null;
 }
-var signedInSessionSchema = z.object({ principal: participantPrincipalSchema }).nullable();
+var signedInSessionSchema = /* @__PURE__ */ (() => z.object({ principal: participantPrincipalSchema }).nullable())();
 export {
   ParticipantExchangeError,
   createParticipantBackend,
   exchangeParticipant,
   handleHostedApp,
   hostedAppRequest,
+  inspectIntegrationKey,
   isParticipantExchangeError,
   proxyParticipant,
   signedInMember

package/dist/react/index.d.ts

@@ -1,23 +1,23 @@
-import { B as Badge, c as MemberBadges, O as Offer, f as Redemption } from '../offers-DhAtss4_.js';
-import { b as ParticipantSession, R as RelayEvent, P as ParticipantActivity, M as MemberSummary } from '../participant-activity-D-Drp24G.js';
-import { g as RelayError, R as RelayClient, m as SubmissionDraft } from '../client-B-hbHX30.js';
-import { P as Page, s as RewardDeliveryAction, e as CreatorAccountProvider, K as KnownConsentChannel, M as MemberConsent, n as QuestOutcomeQuery, l as QuestOutcome } from '../pages-B8q8Y_dQ.js';
-export { C as ConsentChannel, b as ConsentSource, c as ConsentState, d as CreatorAccount, f as CreatorAccounts, g as KnownConsentSource, h as KnownConsentState } from '../pages-B8q8Y_dQ.js';
+import { B as Badge, c as MemberBadges, O as Offer, f as Redemption } from '../offers-Hw2P6tcK.js';
+import { b as ParticipantSession, R as RelayEvent, P as ParticipantActivity, M as MemberSummary } from '../participant-activity-DXRq4s6K.js';
+import { g as RelayError, R as RelayClient, m as SubmissionDraft } from '../client-D7IiwEq2.js';
+import { P as Page, u as RewardDeliveryAction, e as CreatorAccountProvider, K as KnownConsentChannel, M as MemberConsent, n as QuestOutcomeQuery, l as QuestOutcome } from '../reward-deliveries-BCV8hznc.js';
+export { C as ConsentChannel, b as ConsentSource, c as ConsentState, d as CreatorAccount, f as CreatorAccounts, g as KnownConsentSource, h as KnownConsentState } from '../reward-deliveries-BCV8hznc.js';
 import * as react from 'react';
 import { ReactNode } from 'react';
 import * as z from 'zod';
 import { z as z$1 } from 'zod';
-import { l as collectionViewSchema, b as QuestView } from '../catalog--ZIlskAo.js';
-import { E as Entitlement, b as AttemptStatus, V as AttemptCodeSource, c as AuthProvider, J as SignInProvider, A as AccountConnection, I as SignInAccountStatus, p as LeaderboardPlacement, dL as referralSummarySchema, o as LeaderboardPage, u as PointEntry, t as PointBalances, y as PointLedgerReference, U as TieredRewardReference } from '../accounts-CCqCKCVx.js';
-export { S as SignInAccount, N as SignInProviderOption } from '../accounts-CCqCKCVx.js';
-import { c as SignInMethods, C as CosmosChains, d as SignInOption, P as ProviderSignInOption, f as SignInUnavailable, T as TelegramSignInOption, g as SignInWallet, D as DiscoveredWallet } from '../telegram-browser-BCE7zdOb.js';
-export { a as EmailSignInOption, O as OAuthSignInOption, b as SignInIcon, W as WalletSignInOption, t as telegramMiniAppInitData } from '../telegram-browser-BCE7zdOb.js';
-import { m as WalletSigner, k as WalletSignInNetwork, L as LinkedWallet, g as ProfileUpdate, f as ProfileSummary, b as ProfileCompletion, e as ProfileReferral } from '../wallet-DTO7SXj7.js';
-export { T as TelegramAccountConnection, a as TelegramSignInMethods } from '../submission-input-DHGKhXfp.js';
-import '../tracker-data-Hb1uQnk5.js';
+import { l as collectionViewSchema, b as QuestView } from '../catalog-ByZMRS7I.js';
+import { E as Entitlement, b as AttemptStatus, V as AttemptCodeSource, c as AuthProvider, J as SignInProvider, A as AccountConnection, I as SignInAccountStatus, p as LeaderboardPlacement, dN as referralSummarySchema, o as LeaderboardPage, u as PointEntry, t as PointBalances, y as PointLedgerReference, U as TieredRewardReference } from '../accounts-_lNsiR2k.js';
+export { S as SignInAccount, N as SignInProviderOption } from '../accounts-_lNsiR2k.js';
+import { c as SignInMethods, C as CosmosChains, d as SignInOption, P as ProviderSignInOption, f as SignInUnavailable, T as TelegramSignInOption, g as SignInWallet, D as DiscoveredWallet } from '../telegram-browser-K27t4TwM.js';
+export { a as EmailSignInOption, O as OAuthSignInOption, b as SignInIcon, W as WalletSignInOption, t as telegramMiniAppInitData } from '../telegram-browser-K27t4TwM.js';
+import { m as WalletSigner, k as WalletSignInNetwork, L as LinkedWallet, g as ProfileUpdate, f as ProfileSummary, b as ProfileCompletion, e as ProfileReferral } from '../wallet-B7e06v4m.js';
+export { T as TelegramAccountConnection, a as TelegramSignInMethods } from '../submission-input-ChL1aYNH.js';
+import '../tracker-data-Bl-qPIvZ.js';
 import '../request-error-D_dUPLwo.js';
 import '../action-9Xl0StBg.js';
-import '../sign-in-providers-BkjcDsFF.js';
+import '../sign-in-providers-BAkGjSXo.js';
 
 /**
  * A query's identity: plain JSON values, outermost group first, such as
@@ -190,6 +190,13 @@ declare function useSetQueryData(): <T>(key: QueryKey, update: T | ((current: T
  * Independent of the quest experience: a failing experience read signs nobody out.
  */
 declare function useSession(): Query<ParticipantSession | null> & {
+    /**
+     * Reads the session again now; never rejects. With app login (`createParticipantBackend`), call
+     * it after the app's own sign-in route succeeds, before showing member pages, and after its
+     * logout route clears the app session: the provider keeps the session it read until it reads
+     * again. Sign out through the app, not `useSignOut()`, which the app session would undo.
+     */
+    refresh(): Promise<void>;
     /** The signed-in member's ID, or null. */
     member: string | null;
 };
@@ -342,13 +349,20 @@ declare function useRelay(): RelayClient;
  * experience every `polling.snapshotMs` (30 seconds), for changes no event announces and as the
  * fallback when the feed is unavailable. A new `polling` value takes effect like a new client.
  *
+ * After a wallet sign-in, the provider follows the wallet: when it switches to another account or
+ * locks, the member is signed out, so the page never shows one account's progress beside another
+ * account's wallet. Pass `followWallet={false}` to keep the session until the member signs out,
+ * for an app that handles `accountsChanged` itself.
+ *
  * On a staging host, Domino's test toolbar fires `domino:test-state-changed` on `window` after it
  * changes test data under the page; the provider then reads the session and every query again.
  */
-declare function RelayProvider({ client, baseUrl, polling, children, }: {
+declare function RelayProvider({ client, baseUrl, polling, followWallet, children, }: {
     client?: RelayClient;
     baseUrl?: string;
     polling?: RelayPolling;
+    /** Sign the member out when the wallet they signed in with switches account or locks. Default true. */
+    followWallet?: boolean;
     children: ReactNode;
 }): react.JSX.Element;