@domino-sdk/relay 1.63.0 → 1.65.0

package/dist/chunk-ZXGBDLVB.js

@@ -0,0 +1,1510 @@
+import {
+  imageAssetArtifactSchema
+} from "./chunk-XVZ4YOF2.js";
+import {
+  authScopeSchema,
+  exchangeResultSchema
+} from "./chunk-R2KZFX6E.js";
+import {
+  appIdentityKindSchema,
+  cosmosAddressSchema,
+  cosmosNetworkSchema,
+  evmAddressSchema,
+  identifier,
+  lifecycleReasonSchema,
+  limits,
+  offsetDateTimeSchema,
+  openIdentityKindSchema,
+  pageCursorSchema,
+  solanaAddressSchema
+} from "./chunk-HNR6G3GV.js";
+
+// src/credential-secrets.ts
+import * as z from "zod";
+var credentialSecretSchema = /* @__PURE__ */ (() => z.object({
+  id: z.string().uuid(),
+  /** The secret's last four characters, to tell secrets apart; null for one issued before hints. */
+  hint: z.string().nullable(),
+  createdAt: z.number(),
+  /** When the secret stops working; null when it never expires. */
+  expiresAt: z.number().nullable(),
+  /** When the secret last authenticated a request; null when it never has. */
+  lastUsedAt: z.number().nullable()
+}))();
+var credentialSecretInputSchema = /* @__PURE__ */ (() => z.object({
+  expiresInDays: z.number().int().min(1).max(3650).optional()
+}).strict())();
+
+// src/server/member-imports.ts
+import * as z2 from "zod";
+var importTimeSchema = /* @__PURE__ */ (() => z2.union([
+  z2.number().int().nonnegative().safe(),
+  offsetDateTimeSchema().transform((value) => Date.parse(value))
+]))();
+var importWalletSchema = /* @__PURE__ */ (() => z2.discriminatedUnion("chain", [
+  z2.object({
+    kind: z2.literal("wallet"),
+    chain: z2.literal("solana"),
+    address: solanaAddressSchema
+  }).strict(),
+  z2.object({
+    kind: z2.literal("wallet"),
+    chain: z2.literal("eip155"),
+    address: evmAddressSchema
+  }).strict(),
+  z2.object({
+    kind: z2.literal("wallet"),
+    chain: z2.literal("cosmos"),
+    network: cosmosNetworkSchema,
+    address: cosmosAddressSchema
+  }).strict()
+]))();
+var importXSchema = /* @__PURE__ */ (() => z2.object({
+  kind: z2.literal("x"),
+  subject: z2.string().regex(/^[1-9][0-9]{0,19}$/, "Use the numeric X user ID")
+}).strict())();
+var importTelegramSchema = /* @__PURE__ */ (() => z2.object({
+  kind: z2.literal("telegram"),
+  subject: z2.string().regex(/^[1-9][0-9]{0,19}$/, "Use the numeric Telegram user ID")
+}).strict())();
+var importDiscordSchema = /* @__PURE__ */ (() => z2.object({
+  kind: z2.literal("discord"),
+  subject: z2.string().regex(/^[1-9][0-9]{0,19}$/, "Use the numeric Discord user ID")
+}).strict())();
+var importAppIdentitySchema = /* @__PURE__ */ (() => z2.object({ kind: appIdentityKindSchema, subject: z2.string().min(1).max(256) }).strict())();
+var memberImportIdentitySchema = /* @__PURE__ */ (() => z2.union([
+  importAppIdentitySchema,
+  importWalletSchema,
+  importXSchema
+]))();
+var memberImportAccountSchema = /* @__PURE__ */ (() => z2.union([
+  importWalletSchema,
+  importXSchema
+]))();
+var memberImportVouchedAccountSchema = /* @__PURE__ */ (() => z2.union([
+  importWalletSchema,
+  importXSchema,
+  importTelegramSchema,
+  importDiscordSchema
+]))();
+var identityReferenceSchema = /* @__PURE__ */ (() => z2.union([
+  importAppIdentitySchema,
+  importWalletSchema,
+  importXSchema,
+  importTelegramSchema,
+  importDiscordSchema
+]))();
+var memberImportActionSchema = /* @__PURE__ */ (() => z2.object({
+  at: importTimeSchema,
+  key: z2.string().min(1).max(200).optional()
+}).strict())();
+var memberImportReferralSchema = /* @__PURE__ */ (() => z2.object({
+  /**
+   * The inviter: the `ref` of another row of this import, or the sign-in identity of a member
+   * who already exists in this environment.
+   */
+  inviter: z2.union([
+    z2.string().trim().min(1).max(200),
+    memberImportIdentitySchema
+  ]),
+  /** When the member accepted the invitation. */
+  acceptedAt: importTimeSchema,
+  /** Referral programs, by authoring key or ID, the member qualified in, and when. */
+  qualified: z2.array(
+    z2.object({ program: z2.string().min(1).max(200), at: importTimeSchema }).strict()
+  ).max(50).default([])
+}).strict())();
+var memberImportConsentSchema = /* @__PURE__ */ (() => z2.object({
+  /** The channel, such as `email`. */
+  channel: z2.string().min(1).max(64),
+  state: z2.enum(["granted", "withdrawn"]),
+  /** When the member chose, on the platform they come from. */
+  at: importTimeSchema,
+  /**
+   * The text the member saw, verbatim: required to grant, at most `consentWordingMaxLength`
+   * characters.
+   */
+  // The 2,000-character limit is a row refusal at check, so a long wording refuses its row
+  // instead of the batch; this bound only caps what a row stores.
+  wording: z2.string().max(8e3).optional()
+}).strict())();
+var memberImportRowSchema = /* @__PURE__ */ (() => z2.object({
+  /** The member's ID on the platform they come from. Unique within an import. */
+  ref: z2.string().trim().min(1).max(200),
+  identity: memberImportIdentitySchema,
+  accounts: z2.array(memberImportAccountSchema).max(20).default([]),
+  /** Opening balances, credited once per ledger as an imported entry. */
+  points: z2.array(
+    z2.object({
+      ledger: z2.string().min(1).max(200),
+      balance: z2.number().int().positive().safe()
+    }).strict()
+  ).max(50).default([]),
+  /** Quest progress, by quest authoring key or ID. */
+  quests: z2.array(
+    z2.object({
+      quest: z2.string().min(1).max(200),
+      actions: z2.array(memberImportActionSchema).min(1).max(3660)
+    }).strict()
+  ).max(200).default([]),
+  referral: memberImportReferralSchema.optional(),
+  /** The member's marketing consent, per channel, as the platform they come from recorded it. */
+  consent: z2.array(memberImportConsentSchema).max(10).optional()
+}).strict())();
+var memberImportFullRowSchema = /* @__PURE__ */ (() => memberImportRowSchema.extend({
+  accounts: z2.array(memberImportVouchedAccountSchema).max(20).default([])
+}).strict())();
+var memberImportCreateSchema = /* @__PURE__ */ (() => z2.object({
+  actionId: identifier,
+  /** Where the members come from, such as "legacy-domino". */
+  source: z2.string().trim().min(1).max(100)
+}).strict())();
+var memberImportRowsInputSchema = /* @__PURE__ */ (() => z2.object({ rows: z2.array(memberImportRowSchema).min(1).max(500) }).strict())();
+var memberImportFullRowsInputSchema = /* @__PURE__ */ (() => z2.object({ rows: z2.array(memberImportFullRowSchema).min(1).max(500) }).strict())();
+var MemberImportRefusalCode = {
+  /** An account or identity belongs to another member in the project. */
+  AccountLinkedElsewhere: "account-linked-elsewhere",
+  /** An operator unlinked the row's app identity. */
+  IdentityUnlinked: "identity-unlinked",
+  /** The row's identity names a member an operator banned (`members.ban`). */
+  MemberBanned: "member-banned",
+  /** An earlier row of the import names the same account. */
+  DuplicateAccount: "duplicate-account",
+  /** The row names two X accounts, or the member already has another X account selected. */
+  XAccountSelected: "x-account-selected",
+  /** The row names two Telegram accounts, or the member already has another one selected. */
+  TelegramAccountSelected: "telegram-account-selected",
+  /** The row names two Discord accounts, or the member already has another one selected. */
+  DiscordAccountSelected: "discord-account-selected",
+  /** The member would hold more wallets of a chain family than a member can link. */
+  LimitReached: "limit-reached",
+  UnknownLedger: "unknown-ledger",
+  UnknownQuest: "unknown-quest",
+  /** The quest has no active release in this environment. */
+  QuestNotPublished: "quest-not-published",
+  /** The quest's completions are decided per content item, which an import cannot record. */
+  QuestNotImportable: "quest-not-importable",
+  /** A keyed quest's action has no `key`. */
+  KeyRequired: "key-required",
+  /**
+   * An action's key, on a quest whose keys are unique across members, is used by another member's
+   * completion or by an earlier row of the import.
+   */
+  KeyUsed: "key-used",
+  /** An action, a referral or a consent is dated in the future. */
+  FutureAction: "future-action",
+  /** A consent names a channel Relay does not record consent for. */
+  UnsupportedConsentChannel: "unsupported-consent-channel",
+  /** A granted consent has no wording. */
+  ConsentWordingRequired: "consent-wording-required",
+  /** A consent's wording is longer than `consentWordingMaxLength` characters. */
+  ConsentWordingTooLong: "consent-wording-too-long",
+  /** A consent's wording is not plain text: it has a NUL or a lone surrogate. */
+  ConsentWordingInvalid: "consent-wording-invalid",
+  /** The row's sign-in wallet or X account is linked to its member without sign-in. */
+  SignInDisabled: "sign-in-disabled",
+  /**
+   * The row names one point ledger, quest or referral program twice, by any of its names, or one
+   * consent channel twice.
+   */
+  DuplicateEntry: "duplicate-entry",
+  /** The inviter is no row of this import, and no member of the environment signs in with it. */
+  UnknownInviter: "unknown-inviter",
+  /** The row names its own member as the inviter. */
+  SelfReferral: "self-referral",
+  /** The member already has an inviter. An import never replaces one. */
+  InviterAlreadyAccepted: "inviter-already-accepted",
+  /** The inviter was invited, directly or through others, by this row's member. */
+  ReferralCycle: "referral-cycle",
+  /** The row that names the inviter was refused, so the inviter is never imported. */
+  InviterRefused: "inviter-refused",
+  /** No referral program of that key or ID in this environment, or it is archived. */
+  UnknownReferralProgram: "unknown-referral-program"
+};
+var refusalCodeSchema = /* @__PURE__ */ (() => z2.string())();
+var memberImportRefusalSchema = /* @__PURE__ */ (() => z2.object({
+  code: refusalCodeSchema,
+  message: z2.string()
+}))();
+var memberImportRowResultSchema = /* @__PURE__ */ (() => z2.object({
+  line: z2.number().int().positive(),
+  ref: z2.string(),
+  status: z2.enum(["pending", "ready", "applied", "refused"]),
+  /** The member the row resolves to: an existing member, or the one applying created. */
+  member: identifier.nullable(),
+  /** Whether the row's identity names a member who already exists. Null until checked. */
+  existing: z2.boolean().nullable(),
+  refusals: z2.array(memberImportRefusalSchema),
+  /**
+   * Whether the import's revert went through this applied row. Absent from a Relay older than
+   * this field.
+   */
+  reverted: z2.boolean().optional()
+}))();
+var memberImportRowPageSchema = /* @__PURE__ */ (() => z2.object({
+  items: z2.array(memberImportRowResultSchema),
+  nextCursor: z2.string().nullable()
+}))();
+var memberImportRowQuerySchema = /* @__PURE__ */ (() => z2.object({
+  status: z2.enum(["pending", "ready", "applied", "refused"]).optional(),
+  cursor: z2.string().max(200).optional(),
+  limit: z2.coerce.number().int().min(1).max(500).optional()
+}).strict())();
+var memberImportSummarySchema = /* @__PURE__ */ (() => z2.object({
+  rows: z2.number().int().nonnegative(),
+  ready: z2.number().int().nonnegative(),
+  refused: z2.number().int().nonnegative(),
+  members: z2.object({
+    created: z2.number().int().nonnegative(),
+    existing: z2.number().int().nonnegative()
+  }),
+  /** Identities and accounts the ready rows attach, sign-in identities included. */
+  accounts: z2.number().int().nonnegative(),
+  /** Opening balance totals, by ledger as the rows name it. */
+  points: z2.array(
+    z2.object({ ledger: z2.string(), total: z2.number().int().nonnegative() })
+  ),
+  /** Imported actions, by quest as the rows name it. */
+  actions: z2.array(
+    z2.object({ quest: z2.string(), total: z2.number().int().nonnegative() })
+  ),
+  /**
+   * Accepted referrals the ready rows record, and their qualifications by program as the rows
+   * name it. Absent from a summary written before imports carried referrals.
+   */
+  referrals: z2.object({
+    accepted: z2.number().int().nonnegative(),
+    qualified: z2.array(
+      z2.object({
+        program: z2.string(),
+        total: z2.number().int().nonnegative()
+      })
+    )
+  }).optional(),
+  /** Refused rows, by refusal code. A row can have several. */
+  refusals: z2.array(
+    z2.object({ code: refusalCodeSchema, rows: z2.number().int().nonnegative() })
+  )
+}))();
+var memberImportCommandSchema = /* @__PURE__ */ (() => z2.object({ actionId: identifier.optional() }).strict())();
+var memberImportRevertInputSchema = /* @__PURE__ */ (() => z2.object({
+  actionId: identifier,
+  reason: z2.string().trim().min(1).max(500)
+}).strict())();
+var memberImportRevertOutcomeSchema = /* @__PURE__ */ (() => z2.object({
+  reversed: z2.object({
+    /** Applied rows the revert went through. */
+    rows: z2.number().int().nonnegative(),
+    /** Opening balance entries reversed. */
+    entries: z2.number().int().nonnegative(),
+    /** Imported completions revoked. */
+    completions: z2.number().int().nonnegative(),
+    /** Links the rows created that the revert removed. */
+    links: z2.number().int().nonnegative()
+  }),
+  /**
+   * Imported points the revert could not take back, by member and point ledger: the member had
+   * spent or reserved them. A revert takes only free points, as a completion's revocation does,
+   * so no balance goes below zero and Relay records no debt.
+   */
+  unreversedPoints: z2.array(
+    z2.object({
+      member: identifier,
+      ledger: identifier,
+      amount: z2.number().int().positive()
+    })
+  ),
+  /**
+   * Links the rows created that stay, because the member relied on them since: `signed-in` with
+   * it, or `proved` a vouched wallet. `kind` is `wallet`, the provider (`x`, `telegram`,
+   * `discord`) or `app:<name>`; `account` is the address or subject. A row whose member was erased
+   * (`members.erase`) is passed over whole: one entry with `kind: "member"`, the member ID as
+   * `account` and reason `member-erased`, and nothing of that row is reversed.
+   */
+  keptLinks: z2.array(
+    z2.object({
+      member: identifier,
+      kind: z2.string(),
+      account: z2.string(),
+      reason: z2.string()
+    })
+  ),
+  /**
+   * True when rows were applied before imports recorded the links they created: those rows'
+   * links all stay, and only their balances and completions were reversed.
+   */
+  linksUntracked: z2.boolean()
+}))();
+var memberImportRevertSchema = /* @__PURE__ */ (() => z2.object({
+  reason: z2.string(),
+  requestedAt: z2.number().int(),
+  requestedBy: z2.string().nullable(),
+  /** Applied rows reverted so far. */
+  rows: z2.number().int().nonnegative(),
+  revertedAt: z2.number().int().nullable(),
+  outcome: memberImportRevertOutcomeSchema.nullable()
+}))();
+var MemberImportState = {
+  /** Rows are being added. */
+  Open: "open",
+  /** The check (the dry run) is running. */
+  Checking: "checking",
+  /** Checked, with a summary; it can be applied. */
+  Checked: "checked",
+  /** Applying its ready rows, in the background. */
+  Applying: "applying",
+  /** Every ready row was applied or refused. */
+  Applied: "applied",
+  /** Stopped while applying: the rows it did not reach stay `ready`, and it can't be applied again. */
+  Stopped: "stopped",
+  /** Its revert is taking back what its applied rows granted, in the background. */
+  Reverting: "reverting",
+  /** Its revert went through every applied row. */
+  Reverted: "reverted",
+  /** Canceled before it was applied. */
+  Canceled: "canceled"
+};
+var memberImportStateSchema = /* @__PURE__ */ (() => z2.string())();
+var memberImportSchema = /* @__PURE__ */ (() => z2.object({
+  id: identifier,
+  source: z2.string(),
+  /**
+   * The import's state, open to states Relay adds. Absent from a Relay older than this field;
+   * `status` then holds the state, folded as below.
+   */
+  state: memberImportStateSchema.optional(),
+  /**
+   * The state as SDK 1.0 typed it: `applied` for a stopped, reverting or reverted import too, so
+   * filtering on `applied` includes them. Read `state` instead.
+   */
+  status: z2.enum([
+    "open",
+    "checking",
+    "checked",
+    "applying",
+    "applied",
+    "canceled"
+  ]),
+  rows: z2.number().int().nonnegative(),
+  /** The latest check's summary, or null before the first check and after rows change. */
+  summary: memberImportSummarySchema.nullable(),
+  /** While applying and after, stopped included: rows applied and refused so far. */
+  progress: z2.object({
+    applied: z2.number().int().nonnegative(),
+    refused: z2.number().int().nonnegative()
+  }),
+  createdAt: z2.number().int(),
+  createdBy: z2.string().nullable(),
+  checkedAt: z2.number().int().nullable(),
+  appliedAt: z2.number().int().nullable(),
+  appliedBy: z2.string().nullable(),
+  canceledAt: z2.number().int().nullable(),
+  canceledBy: z2.string().nullable(),
+  /** Set when the import was stopped while applying; `appliedAt` stays null. */
+  stoppedAt: z2.number().int().nullish(),
+  stoppedBy: z2.string().nullish(),
+  /** Set once a revert was asked for: the import is `reverting`, then `reverted`. */
+  revert: memberImportRevertSchema.nullish()
+}))();
+var memberImportPageSchema = /* @__PURE__ */ (() => z2.object({
+  items: z2.array(memberImportSchema),
+  nextCursor: z2.string().nullable()
+}))();
+var memberImportListQuerySchema = /* @__PURE__ */ (() => z2.object({
+  cursor: z2.string().max(200).optional(),
+  limit: z2.coerce.number().int().min(1).max(100).optional()
+}).strict())();
+
+// src/server/schedules.ts
+import * as z3 from "zod";
+import { Cron } from "croner";
+var APP_SCHEDULE_LIMIT = 10;
+var APP_SCHEDULE_MIN_INTERVAL = 3e5;
+var APP_SCHEDULE_TIMEOUT = 3e4;
+var appScheduleNameSchema = /* @__PURE__ */ (() => z3.string().regex(/^[a-z][a-z0-9-]{0,63}$/))();
+var appSchedulePathSchema = /* @__PURE__ */ (() => z3.string().min(2).max(512).refine((path) => {
+  if (!/^\/[a-zA-Z0-9_/-]+$/.test(path) || path.startsWith("//")) {
+    return false;
+  }
+  return path.split("/").slice(1).every((part) => part.length > 0) && new URL(path, "https://app.invalid").pathname === path;
+}, "Expected an absolute route path without a query or hidden segments"))();
+function interval(value) {
+  const amount = Number(value.slice(0, -1));
+  const unit = value.slice(-1);
+  return amount * (unit === "m" ? 6e4 : unit === "h" ? 36e5 : 864e5);
+}
+var everySchema = /* @__PURE__ */ (() => z3.string().regex(/^[1-9]\d{0,3}[mhd]$/).refine(
+  (value) => interval(value) >= limits.apps.scheduleMinIntervalMs && interval(value) <= 365 * 864e5,
+  "Use an interval from 5 minutes to 365 days, such as 5m, 1h or 1d"
+))();
+var cronSchema = /* @__PURE__ */ (() => z3.string().max(120).refine((value) => {
+  const fields = value.trim().split(/\s+/);
+  if (fields.length !== 5 || fields.some((field) => !/^[\d*,/-]+$/.test(field))) {
+    return false;
+  }
+  try {
+    const job = new Cron(value, { paused: true, timezone: "UTC" });
+    if (!job.nextRun()) {
+      return false;
+    }
+    const minutes = new Cron(`${fields[0]} * * * *`, {
+      paused: true,
+      timezone: "UTC"
+    });
+    const times = minutes.nextRuns(13, /* @__PURE__ */ new Date("2024-01-01T00:00:00Z"));
+    return times.every(
+      (time, i) => i === 0 || time.getTime() - times[i - 1].getTime() >= limits.apps.scheduleMinIntervalMs
+    );
+  } catch {
+    return false;
+  }
+}, "Expected a five-field UTC cron expression with minute slots at least five minutes apart"))();
+var declaration = /* @__PURE__ */ (() => ({
+  name: appScheduleNameSchema,
+  path: appSchedulePathSchema,
+  description: z3.string().min(1).max(500)
+}))();
+var everySchedule = /* @__PURE__ */ (() => z3.object({ ...declaration, every: everySchema }))();
+var cronSchedule = /* @__PURE__ */ (() => z3.object({ ...declaration, cron: cronSchema }))();
+var appScheduleSchema = /* @__PURE__ */ (() => z3.union([
+  everySchedule.strict(),
+  cronSchedule.strict()
+]))();
+var appSchedulesSchema = /* @__PURE__ */ (() => z3.array(appScheduleSchema).max(limits.apps.schedules).refine(
+  (items) => new Set(items.map((item) => item.name)).size === items.length,
+  "Schedule names must be unique"
+))();
+function nextScheduleRun(schedule, after) {
+  if ("every" in schedule) {
+    return after + interval(schedule.every);
+  }
+  const next = new Cron(schedule.cron, {
+    paused: true,
+    timezone: "UTC"
+  }).nextRun(new Date(after));
+  if (!next) {
+    throw new Error("Schedule has no next occurrence");
+  }
+  return next.getTime();
+}
+var appScheduleStateSchema = /* @__PURE__ */ (() => z3.enum(["active", "paused", "archived"]))();
+var appScheduleStateInputSchema = /* @__PURE__ */ (() => z3.object({
+  state: appScheduleStateSchema,
+  reason: lifecycleReasonSchema.optional()
+}).strict())();
+var APP_SCHEDULE_RESULT_BYTES = 16384;
+var appScheduleDiagnosticSchema = /* @__PURE__ */ (() => z3.object({
+  level: z3.enum(["error", "warning", "info"]),
+  message: z3.string().min(1).max(500),
+  /** What the line is about, such as a member, record or tracker ID. */
+  subject: z3.string().min(1).max(200).optional(),
+  /** A stable code the app chooses, such as `ingest-timeout`. */
+  code: z3.string().min(1).max(100).optional()
+}))();
+var appScheduleResultSchema = /* @__PURE__ */ (() => z3.object({
+  outcome: z3.enum(["succeeded", "partial", "failed"]),
+  summary: z3.string().min(1).max(500).optional(),
+  /** Counts and gauges, such as processed and failed members. */
+  metrics: z3.record(z3.string().regex(/^[A-Za-z][\w.-]{0,63}$/), z3.number()).refine(
+    (metrics) => Object.keys(metrics).length <= 50,
+    "Report at most 50 metrics"
+  ).optional(),
+  diagnostics: z3.array(appScheduleDiagnosticSchema).max(50).optional()
+}))();
+function scheduleResult(result) {
+  const body = JSON.stringify(appScheduleResultSchema.parse(result));
+  if (new TextEncoder().encode(body).byteLength > limits.apps.scheduleResultBytes) {
+    throw new Error(
+      `A schedule result must be at most ${limits.apps.scheduleResultBytes.toLocaleString("en-US")} bytes of JSON: send fewer or shorter diagnostics`
+    );
+  }
+  return new Response(body, {
+    headers: { "Content-Type": "application/json" }
+  });
+}
+var appScheduleRunSchema = /* @__PURE__ */ (() => z3.object({
+  id: z3.string().uuid(),
+  build: z3.string().uuid(),
+  startedAt: z3.number(),
+  scheduledAt: z3.number(),
+  manual: z3.boolean(),
+  status: z3.enum(["queued", "running", "succeeded", "failed", "uncertain"]),
+  duration: z3.number().nullable(),
+  /** Why the run failed or is uncertain, or why Relay ignored the app's result. */
+  error: z3.string().nullable(),
+  /** The app's JSON answer when it sent a valid result. Absent on runs from before results. */
+  result: appScheduleResultSchema.nullable().optional()
+}))();
+var appScheduleRunsSchema = /* @__PURE__ */ (() => z3.object({
+  /** Newest first: the latest twenty runs of one schedule, including a queued or running one. */
+  runs: z3.array(appScheduleRunSchema)
+}))();
+var appScheduleListSchema = /* @__PURE__ */ (() => z3.object({
+  state: appScheduleStateSchema,
+  schedules: z3.array(
+    z3.object({
+      declaration: z3.union([everySchedule, cronSchedule]),
+      nextRun: z3.number().nullable(),
+      blocked: z3.boolean(),
+      lastRun: appScheduleRunSchema.nullable()
+    })
+  )
+}))();
+var scheduledInvocationSchema = /* @__PURE__ */ (() => z3.object({
+  id: z3.string().uuid(),
+  build: z3.string().uuid(),
+  name: appScheduleNameSchema,
+  scheduledAt: z3.number().int(),
+  startedAt: z3.number().int(),
+  manual: z3.boolean()
+}).strict())();
+async function verifyScheduledRequest(request, key) {
+  const signature = request.headers.get("X-Domino-Schedule-Signature");
+  const url = new URL(request.url);
+  if (request.method !== "POST" || url.search !== "" || url.hash !== "" || !key || !signature || !/^[a-f0-9]{64}$/.test(signature)) {
+    return null;
+  }
+  const reader = request.clone().body?.getReader();
+  if (!reader) {
+    return null;
+  }
+  let body = "";
+  let size = 0;
+  const decoder = new TextDecoder();
+  try {
+    for (; ; ) {
+      const chunk = await reader.read();
+      if (chunk.done) {
+        break;
+      }
+      size += chunk.value.byteLength;
+      if (size > 4096) {
+        void reader.cancel().catch(() => {
+        });
+        return null;
+      }
+      body += decoder.decode(chunk.value, { stream: true });
+    }
+    body += decoder.decode();
+  } catch {
+    return null;
+  }
+  const secret = await crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(key),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["verify"]
+  );
+  const bytes = Uint8Array.from(
+    signature.match(/../g) ?? [],
+    (byte) => Number.parseInt(byte, 16)
+  );
+  const valid = await crypto.subtle.verify(
+    "HMAC",
+    secret,
+    bytes,
+    new TextEncoder().encode(`POST
+${url.pathname}
+${body}`)
+  );
+  if (!valid) {
+    return null;
+  }
+  const parsed = scheduledInvocationSchema.safeParse(
+    await new Response(body).json().catch(() => null)
+  );
+  if (!parsed.success || Math.abs(Date.now() - parsed.data.startedAt) > 6e4) {
+    return null;
+  }
+  return parsed.data;
+}
+
+// src/server/starters.ts
+import * as z4 from "zod";
+var starters = [
+  {
+    id: "campaign",
+    title: "Campaign tour",
+    summary: "A neutral quest app with a guided tour of every quest kind. The blank canvas for anything."
+  },
+  {
+    id: "classic",
+    title: "Classic questboard",
+    summary: "The familiar Domino portal: quests in a grid grouped by section, a claim page, points, and a leaderboard."
+  },
+  {
+    id: "waitlist",
+    title: "Waitlist",
+    summary: "Collect sign-ups before launch. People move up the line by inviting friends."
+  },
+  {
+    id: "referral",
+    title: "Referral program",
+    summary: "Give every member an invite link and reward them when friends join and qualify."
+  },
+  {
+    id: "discord",
+    title: "Discord activation",
+    summary: "Turn new Discord members into regulars with quests for joining, introducing themselves, and taking part, rewarded with roles."
+  },
+  {
+    id: "loyalty",
+    title: "Loyalty program",
+    summary: "Members earn points in a campaign, qualify into a members' group, and spend points on offers, some for members only."
+  },
+  {
+    id: "api",
+    title: "API",
+    summary: "A headless Worker with typed routes and interactive API docs, for plugging Domino into your own product."
+  }
+];
+var offeredStarterSchema = /* @__PURE__ */ (() => z4.string().refine((id) => starters.some((starter) => starter.id === id), {
+  error: `Unknown starter. Choose one of: ${starters.map((starter) => starter.id).join(", ")}.`
+}))();
+var starterTemplates = [
+  {
+    id: "campaign",
+    title: "Campaign tour",
+    summary: "A neutral quest app with a guided tour of every quest kind. The blank canvas for anything."
+  },
+  {
+    id: "classic",
+    title: "Classic questboard",
+    summary: "The familiar Domino portal: quests in a grid grouped by section, a claim page, points, and a leaderboard."
+  },
+  {
+    id: "waitlist",
+    title: "Waitlist",
+    summary: "Collect sign-ups before launch. People move up the line by inviting friends."
+  },
+  {
+    id: "referral",
+    title: "Referral program",
+    summary: "Give every member an invite link and reward them when friends join and qualify."
+  },
+  {
+    id: "discord",
+    title: "Discord activation",
+    summary: "Turn new Discord members into regulars with quests for joining, introducing themselves, and taking part, rewarded with roles."
+  },
+  {
+    id: "api",
+    title: "API",
+    summary: "A headless Worker with typed routes and interactive API docs, for plugging Domino into your own product."
+  }
+];
+var starterIdSchema = /* @__PURE__ */ (() => z4.enum(
+  starterTemplates.map((template) => template.id)
+))();
+
+// src/server/hosting.ts
+import * as z5 from "zod";
+var outputPathSchema = /* @__PURE__ */ (() => z5.string().min(1).max(512).refine(
+  (path) => path.split("/").every(
+    (part) => /^[\w-][\w.-]*$/.test(part) && part !== "node_modules"
+  ),
+  "Expected a relative build output path without hidden segments"
+))();
+var appRoutingSchema = /* @__PURE__ */ (() => z5.enum(["legacy", "transparent"]).default("legacy"))();
+var APP_SECRET_LIMIT = 50;
+var APP_KV_LIMIT = 5;
+var APP_SQL_LIMIT = 5;
+var APP_MIGRATION_LIMIT = 100;
+var APP_MIGRATION_FILE_BYTES = 9e4;
+var APP_MIGRATION_TOTAL_BYTES = 1e6;
+var appSecretNameSchema = /* @__PURE__ */ (() => z5.string().regex(
+  /^[A-Z_][A-Z0-9_]{0,63}$/,
+  "Use 1-64 uppercase letters, digits, and underscores, not starting with a digit"
+).refine(
+  (name) => !name.startsWith("DOMINO_") && name !== "ASSETS",
+  "DOMINO_ names and ASSETS are reserved for Domino's own bindings"
+))();
+var appSecretValueSchema = /* @__PURE__ */ (() => z5.string().min(1).refine(
+  (value) => new TextEncoder().encode(value).length <= 5120,
+  "Secret values can be at most 5 KiB"
+))();
+var appSecretInputSchema = /* @__PURE__ */ (() => z5.object({ value: appSecretValueSchema }).strict())();
+var appSecretSchema = /* @__PURE__ */ (() => z5.object({
+  name: appSecretNameSchema,
+  updatedAt: z5.number(),
+  updatedBy: z5.string()
+}))();
+var appSecretDeclarationSchema = /* @__PURE__ */ (() => z5.object({
+  description: z5.string().trim().min(1).max(500),
+  required: z5.boolean().default(true)
+}).strict())();
+var appSecretDeclarationsSchema = /* @__PURE__ */ (() => z5.record(appSecretNameSchema, appSecretDeclarationSchema).refine(
+  (secrets) => Object.keys(secrets).length <= limits.apps.secrets,
+  `Declare at most ${limits.apps.secrets} app secrets`
+))();
+var appSecretListSchema = /* @__PURE__ */ (() => z5.object({
+  secrets: z5.array(appSecretSchema),
+  declared: z5.array(appSecretDeclarationSchema.extend({ name: appSecretNameSchema })).default([])
+}))();
+var hostedAppSecretsSchema = /* @__PURE__ */ (() => z5.object({ secrets: z5.record(appSecretNameSchema, appSecretValueSchema) }).strict())();
+var storageDescription = /* @__PURE__ */ (() => z5.object({
+  description: z5.string().trim().min(1).max(500)
+}).strict())();
+var appStorageSchema = /* @__PURE__ */ (() => z5.object({
+  kv: z5.record(appSecretNameSchema, storageDescription).refine(
+    (stores) => Object.keys(stores).length <= limits.apps.kvStores,
+    `Declare at most ${limits.apps.kvStores} KV stores`
+  ).default({}),
+  sql: z5.record(
+    appSecretNameSchema,
+    storageDescription.extend({
+      migrations: outputPathSchema.optional()
+    }).strict()
+  ).refine(
+    (stores) => Object.keys(stores).length <= limits.apps.sqlStores,
+    `Declare at most ${limits.apps.sqlStores} SQL stores`
+  ).default({})
+}).strict())();
+var appStorageKindSchema = /* @__PURE__ */ (() => z5.enum(["kv", "sql"]))();
+var appStorageListSchema = /* @__PURE__ */ (() => z5.object({
+  stores: z5.array(
+    z5.object({
+      kind: z5.string(),
+      name: appSecretNameSchema,
+      createdAt: z5.number().nullable(),
+      declared: z5.boolean(),
+      description: z5.string().optional()
+    })
+  )
+}))();
+var APP_STORAGE_ROW_LIMIT = 50;
+var APP_STORAGE_PREVIEW_CHARACTERS = 2e3;
+var appStorageCellSchema = /* @__PURE__ */ (() => z5.union([
+  z5.string(),
+  z5.number(),
+  z5.null(),
+  z5.object({ text: z5.string(), truncated: z5.literal(true) }),
+  z5.object({ blob: z5.number().int().min(0) })
+]))();
+var appStorageTablesSchema = /* @__PURE__ */ (() => z5.object({
+  tables: z5.array(
+    /** `kind` is SQLite's: `table` or `view`. */
+    z5.object({ name: z5.string(), kind: z5.string() })
+  )
+}))();
+var appStorageRowsSchema = /* @__PURE__ */ (() => z5.object({
+  table: z5.string(),
+  columns: z5.array(z5.string()),
+  rows: z5.array(z5.array(appStorageCellSchema)),
+  /** How many rows come before this page in storage order. */
+  offset: z5.number().int().min(0),
+  total: z5.number().int().min(0),
+  /** Pass back as `cursor` for the next page; null on the last one. */
+  nextCursor: pageCursorSchema.nullable().default(null)
+}))();
+var appStorageKeysSchema = /* @__PURE__ */ (() => z5.object({
+  keys: z5.array(
+    z5.object({ name: z5.string(), expiration: z5.number().nullable() })
+  ),
+  /** Pass back as `cursor` for the next page; null on the last one. */
+  nextCursor: pageCursorSchema.nullable().default(null),
+  /** @deprecated Use `nextCursor`. Removed in 2.0.0. */
+  cursor: z5.string().nullable()
+}))();
+var appStorageValueSchema = /* @__PURE__ */ (() => z5.object({
+  key: z5.string(),
+  size: z5.number().int().min(0),
+  /** Null when the value is not UTF-8 text. */
+  text: z5.string().nullable(),
+  truncated: z5.boolean()
+}))();
+var APP_STORAGE_CELL_CHARACTERS = 1e5;
+var appStorageCellPageSchema = /* @__PURE__ */ (() => z5.object({
+  table: z5.string(),
+  column: z5.string(),
+  /** The row's position in storage order: a rows page's `offset` plus its index on that page. */
+  row: z5.number().int().min(0),
+  /** SQLite's storage class. */
+  type: z5.enum(["text", "integer", "real", "blob", "null"]),
+  /** Characters of text, or of a number's text form; bytes of a BLOB; null for NULL. */
+  length: z5.number().int().min(0).nullable(),
+  /** How many characters come before this page. */
+  offset: z5.number().int().min(0),
+  /** Up to 100,000 characters from `offset`. Null for a BLOB, whose bytes are never read, and NULL. */
+  text: z5.string().nullable(),
+  /** Pass back as `cursor` for the next page; null on the last one. */
+  nextCursor: pageCursorSchema.nullable().default(null)
+}))();
+var storageTableNameSchema = /* @__PURE__ */ (() => z5.string().min(1).max(512))();
+var appStorageSqlClearSchema = /* @__PURE__ */ (() => z5.union([
+  z5.object({
+    dryRun: z5.boolean().optional(),
+    tables: z5.array(storageTableNameSchema).min(1).max(50)
+  }).strict(),
+  z5.object({
+    dryRun: z5.boolean().optional(),
+    allTables: z5.literal(true),
+    keepTables: z5.array(storageTableNameSchema).max(50).optional()
+  }).strict()
+]))();
+var appStorageKvClearSchema = /* @__PURE__ */ (() => z5.union([
+  z5.object({
+    dryRun: z5.boolean().optional(),
+    prefix: z5.string().min(1).max(512)
+  }).strict(),
+  z5.object({ dryRun: z5.boolean().optional(), all: z5.literal(true) }).strict()
+]))();
+var appStorageSqlClearResultSchema = /* @__PURE__ */ (() => z5.object({
+  environment: z5.string(),
+  kind: z5.literal("sql"),
+  store: z5.string(),
+  dryRun: z5.boolean(),
+  /** Each table cleared, or counted by a dry run, with its row count before the clear. */
+  tables: z5.array(
+    z5.object({ name: z5.string(), rows: z5.number().int().min(0) })
+  )
+}))();
+var appStorageKvClearResultSchema = /* @__PURE__ */ (() => z5.object({
+  environment: z5.string(),
+  kind: z5.literal("kv"),
+  store: z5.string(),
+  dryRun: z5.boolean(),
+  /** Empty when every key was selected. */
+  prefix: z5.string(),
+  /** Keys deleted by this call, or counted by a dry run. */
+  keys: z5.number().int().min(0),
+  /**
+   * False when keys remain: a clear deletes at most `limits.apps.storageClearKeys` (10,000) keys a
+   * call, so call again until it is true. On a dry run, false means `keys` stopped counting at
+   * `limits.apps.storageClearCountKeys` (100,000).
+   */
+  complete: z5.boolean()
+}))();
+var appMigrationNameSchema = /* @__PURE__ */ (() => z5.string().max(255).regex(/^[\w-][\w.-]*\.sql$/))();
+function compareAppMigrations(a, b) {
+  const left = Number.parseInt(a.split("_")[0], 10);
+  const right = Number.parseInt(b.split("_")[0], 10);
+  if (left !== right) {
+    if (Number.isFinite(left) && Number.isFinite(right)) {
+      return left - right;
+    }
+    if (Number.isFinite(left)) {
+      return -1;
+    }
+    if (Number.isFinite(right)) {
+      return 1;
+    }
+  }
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+var appMigrationsSchema = /* @__PURE__ */ (() => z5.record(
+  appSecretNameSchema,
+  z5.array(
+    z5.object({
+      name: appMigrationNameSchema,
+      sql: z5.string().min(1).refine(
+        (sql) => new TextEncoder().encode(sql).length <= limits.apps.migrationFileBytes,
+        `A migration file must not exceed ${limits.apps.migrationFileBytes} bytes`
+      )
+    }).strict()
+  ).max(limits.apps.migrations).refine(
+    (files) => new Set(files.map((file) => file.name)).size === files.length,
+    "Duplicate migration filenames"
+  )
+).refine(
+  (stores) => Object.values(stores).flat().reduce(
+    (total, file) => total + new TextEncoder().encode(file.sql).length,
+    0
+  ) <= limits.apps.migrationTotalBytes,
+  `Migrations must not exceed ${limits.apps.migrationTotalBytes} bytes in total`
+))();
+var appScripts = /* @__PURE__ */ (() => ({
+  routing: appRoutingSchema,
+  devScript: z5.string().regex(/^[\w:-]+$/),
+  checkScript: z5.string().regex(/^[\w:-]+$/),
+  buildScript: z5.string().regex(/^[\w:-]+$/)
+}))();
+var workerSettings = /* @__PURE__ */ (() => ({
+  runWorkerFirst: z5.boolean().default(false),
+  main: outputPathSchema.refine(
+    (path) => /\.m?js$/.test(path),
+    "Expected a compiled JavaScript entry"
+  ),
+  compatibilityDate: z5.string().regex(/^\d{4}-\d{2}-\d{2}$/),
+  compatibilityFlags: z5.array(z5.string().min(1)).max(50).default([]),
+  vars: z5.record(
+    z5.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/).refine((name) => name !== "ASSETS"),
+    z5.string()
+  ).default({}),
+  secrets: appSecretDeclarationsSchema.default({}),
+  storage: appStorageSchema.optional(),
+  schedules: appSchedulesSchema.optional()
+}))();
+var distinctBindings = (worker, ctx) => {
+  const owners = /* @__PURE__ */ new Map();
+  const sources = [
+    ["vars", "an app var", Object.keys(worker.vars)],
+    ["secrets", "a declared secret", Object.keys(worker.secrets)],
+    ["storage", "a KV store", Object.keys(worker.storage?.kv ?? {})],
+    ["storage", "a SQL store", Object.keys(worker.storage?.sql ?? {})]
+  ];
+  for (const [path, owner, names] of sources) {
+    for (const name of names) {
+      const first = owners.get(name);
+      if (first) {
+        ctx.addIssue({
+          code: "custom",
+          message: `Binding name ${name} is used by both ${first} and ${owner}`,
+          path: [path]
+        });
+      } else {
+        owners.set(name, owner);
+      }
+    }
+  }
+};
+var hostedAppSchema = /* @__PURE__ */ (() => z5.discriminatedUnion("kind", [
+  z5.object({
+    kind: z5.literal("static"),
+    directory: outputPathSchema,
+    ...appScripts
+  }).strict(),
+  z5.object({
+    kind: z5.literal("worker"),
+    directory: outputPathSchema,
+    assetsDirectory: outputPathSchema.optional(),
+    ...appScripts,
+    ...workerSettings
+  }).strict().superRefine(distinctBindings)
+]))();
+var repositorySchema = /* @__PURE__ */ (() => z5.object({
+  id: z5.string().uuid(),
+  organization: identifier,
+  project: identifier,
+  remote: z5.string().url(),
+  defaultBranch: z5.string(),
+  status: z5.enum(["provisioning", "ready"])
+}))();
+var repositoryCreateSchema = /* @__PURE__ */ (() => z5.object({
+  /** Omitted: the starter chosen at project setup, else `campaign`. */
+  starter: offeredStarterSchema.optional()
+}).strict())();
+var createRepositorySchema = /* @__PURE__ */ (() => z5.object({
+  /** Omitted: the starter chosen at project setup, else `campaign`. */
+  starter: starterIdSchema.optional()
+}).strict())();
+var deviceStartSchema = /* @__PURE__ */ (() => z5.object({
+  challenge: z5.string().regex(/^[a-f0-9]{64}$/)
+}).strict())();
+var deviceRedeemSchema = /* @__PURE__ */ (() => z5.object({
+  id: z5.string().uuid(),
+  verifier: z5.string().min(43).max(128)
+}).strict())();
+var deviceApproveSchema = /* @__PURE__ */ (() => z5.object({
+  id: z5.string().uuid(),
+  code: z5.string().regex(/^[A-F0-9]{4}-[A-F0-9]{4}$/)
+}).strict())();
+var commitSchema = /* @__PURE__ */ (() => z5.string().regex(/^[a-f0-9]{40}$/))();
+var stageRequestSchema = /* @__PURE__ */ (() => z5.object({
+  commit: commitSchema,
+  requestId: z5.string().uuid()
+}).strict())();
+var buildIdentitySchema = /* @__PURE__ */ (() => z5.object({
+  routing: appRoutingSchema,
+  slug: z5.string().min(1).max(35).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/).optional(),
+  runtime: z5.enum(["simulation", "hosted-test"]).default("simulation"),
+  id: z5.string().uuid(),
+  repository: z5.string().uuid(),
+  organization: identifier,
+  project: identifier,
+  commit: commitSchema,
+  createdAt: z5.number(),
+  actor: z5.string(),
+  commitMessage: z5.string().max(500).optional()
+}))();
+var buildPhaseSchema = /* @__PURE__ */ (() => z5.enum([
+  "queued",
+  "source",
+  "install",
+  "check",
+  "build",
+  "deploy",
+  "ready",
+  "failed"
+]))();
+var buildStatusSchema = /* @__PURE__ */ (() => z5.object({
+  phase: buildPhaseSchema,
+  failedPhase: buildPhaseSchema.optional(),
+  updatedAt: z5.number(),
+  message: z5.string()
+}))();
+var hostedBuildSchema = /* @__PURE__ */ (() => buildIdentitySchema.extend({
+  ...buildStatusSchema.shape,
+  finished: z5.boolean(),
+  current: z5.boolean(),
+  stagingUrl: z5.string().url(),
+  /**
+   * The test deployment the build published from its quest artifacts when it activated, readable
+   * with `GET /deployments/{id}`; null until it activates. A build whose bundle declares no
+   * resources publishes none, so its ID is not found. Only `GET /builds/{id}` includes it.
+   */
+  deployment: z5.string().nullable().optional()
+}))();
+var liveAppSchema = /* @__PURE__ */ (() => z5.object({
+  url: z5.string().url().nullable(),
+  state: z5.enum(["none", "deploying", "live", "failed"]),
+  /** The build the address serves, or null before the first one goes live. */
+  build: z5.string().uuid().nullable(),
+  /** The build the last approved promotion asked for, while it differs from `build`. */
+  requested: z5.string().uuid().nullable(),
+  failure: z5.string().nullable()
+}))();
+var customDomainStateSchema = /* @__PURE__ */ (() => z5.enum([
+  "awaiting-dns",
+  "provisioning",
+  "active",
+  "attention",
+  "suspended"
+]))();
+var customDomainRecordSchema = /* @__PURE__ */ (() => z5.object({
+  type: z5.enum(["CNAME", "TXT"]),
+  name: z5.string(),
+  value: z5.string(),
+  /** The values public DNS returned: empty when it had none, null before Domino looked. */
+  found: z5.array(z5.string()).nullable(),
+  matches: z5.boolean()
+}))();
+var domainTimeMs = /* @__PURE__ */ (() => z5.number().int().nonnegative().nullish())();
+var customDomainSchema = /* @__PURE__ */ (() => z5.object({
+  id: z5.string().uuid(),
+  hostname: z5.string(),
+  url: z5.string().url(),
+  state: customDomainStateSchema,
+  /** What to fix, in plain words, while the domain needs attention or is suspended. */
+  issue: z5.object({ code: z5.string(), message: z5.string() }).nullable(),
+  records: z5.array(customDomainRecordSchema),
+  /** Cloudflare's statuses and errors in its own words, once the domain is proven. */
+  cloudflare: z5.object({
+    hostnameStatus: z5.string(),
+    certificateStatus: z5.string().nullable(),
+    validationErrors: z5.array(z5.string()),
+    verificationErrors: z5.array(z5.string()),
+    certificateExpiresAt: z5.string().nullable(),
+    certificateExpiresAtMs: domainTimeMs
+  }).nullable(),
+  checkedAt: z5.string().nullable(),
+  checkedAtMs: domainTimeMs,
+  nextCheckAt: z5.string().nullable(),
+  nextCheckAtMs: domainTimeMs,
+  createdAt: z5.string(),
+  createdAtMs: z5.number().int().nonnegative().optional()
+}))();
+var customDomainListSchema = /* @__PURE__ */ (() => z5.object({
+  domains: z5.array(customDomainSchema)
+}))();
+var customDomainInputSchema = /* @__PURE__ */ (() => z5.object({ hostname: z5.string().min(1).max(300) }).strict())();
+var stagingAccessModeSchema = /* @__PURE__ */ (() => z5.enum(["console", "password"]))();
+var stagingAccessSchema = /* @__PURE__ */ (() => z5.object({ mode: stagingAccessModeSchema }))();
+var stagingAccessInputSchema = /* @__PURE__ */ (() => z5.discriminatedUnion("mode", [
+  z5.object({ mode: z5.literal("console") }).strict(),
+  z5.object({
+    mode: z5.literal("password"),
+    password: z5.string().min(8).max(128)
+  }).strict()
+]))();
+var stagingOrigin = "https://staging.invalid";
+var stagingPathSchema = /* @__PURE__ */ (() => z5.string().max(2048).refine((path) => {
+  if (!path.startsWith("/") || path.startsWith("//") || path.includes("\\") || // oxlint-disable-next-line no-control-regex
+  /[\u0000-\u001f\u007f]/.test(path)) {
+    return false;
+  }
+  try {
+    return new URL(path, stagingOrigin).origin === stagingOrigin;
+  } catch {
+    return false;
+  }
+}, "Expected a path on the staging host"))();
+var stagingLinkSchema = /* @__PURE__ */ (() => z5.object({
+  url: z5.string().url(),
+  expiresAt: z5.number()
+}))();
+var buildSnapshotSchema = /* @__PURE__ */ (() => z5.object({
+  builds: z5.array(hostedBuildSchema),
+  current: hostedBuildSchema.nullable(),
+  selected: hostedBuildSchema.nullable(),
+  logs: z5.string()
+}))();
+var assetPathSchema = /* @__PURE__ */ (() => z5.string().max(512).refine(
+  (path) => path.startsWith("/") && // oxlint-disable-next-line no-control-regex -- Asset paths must reject control characters.
+  !/[\\\u0000-\u001f?#%]/.test(path) && path.slice(1).split("/").every((part) => part.length > 0 && !part.startsWith(".")),
+  "Expected a public asset path without hidden segments"
+))();
+var base64Schema = /* @__PURE__ */ (() => z5.string().regex(/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/))();
+var stagedDeploymentLimits = {
+  /** Bytes of JSON, uncompressed. */
+  size: 64e6,
+  /** Bytes of the Brotli-compressed object. */
+  compressedSize: 1e7
+};
+var stagedDeploymentSchema = /* @__PURE__ */ (() => z5.object({
+  encoding: z5.literal("br"),
+  sha256: z5.string().regex(/^[0-9a-f]{64}$/),
+  compressedSize: z5.number().int().positive().max(limits.stagedDeployment.compressedSize),
+  size: z5.number().int().positive().max(limits.stagedDeployment.size)
+}).strict())();
+var stagedDeploymentContentSchema = /* @__PURE__ */ (() => stagedDeploymentSchema.extend({
+  content: z5.string().max(Math.ceil(limits.stagedDeployment.compressedSize / 3) * 4)
+}).strict())();
+var stagedDeploymentKey = (build, sha256) => `builds/${build}/deployment/${sha256}.br`;
+var artifactFields = /* @__PURE__ */ (() => ({
+  routing: appRoutingSchema,
+  worker: z5.object({
+    ...workerSettings,
+    migrations: appMigrationsSchema.optional(),
+    modules: z5.array(
+      z5.object({
+        path: outputPathSchema.refine((path) => path !== "metadata"),
+        type: z5.enum([
+          "application/javascript+module",
+          "application/wasm",
+          "text/plain",
+          "application/octet-stream"
+        ]),
+        content: base64Schema.max(14e6)
+      }).strict()
+    ).min(1).max(500)
+  }).strict().superRefine(distinctBindings).optional(),
+  assets: z5.array(
+    z5.object({
+      path: assetPathSchema,
+      content: base64Schema.max(14e6),
+      size: z5.number().int().min(0).max(1e7)
+    }).strict()
+  ).max(500)
+}))();
+var inlineCode = () => z5.unknown().optional().transform((value) => value);
+var buildArtifactsSchema = /* @__PURE__ */ (() => z5.discriminatedUnion("format", [
+  z5.object({
+    format: z5.literal(1),
+    ...artifactFields,
+    quests: inlineCode(),
+    catalog: inlineCode()
+  }).strict(),
+  z5.object({
+    format: z5.literal(2),
+    ...artifactFields,
+    deployment: stagedDeploymentSchema,
+    images: z5.array(imageAssetArtifactSchema).max(10)
+  }).strict()
+]).superRefine((value, ctx) => {
+  if (value.worker) {
+    const modules = value.worker.modules;
+    for (const name of Object.keys(value.worker.migrations ?? {})) {
+      if (!value.worker.storage?.sql[name]?.migrations) {
+        ctx.addIssue({
+          code: "custom",
+          message: `Migrations for undeclared SQL store ${name}`
+        });
+      }
+    }
+    if (new Set(modules.map((m) => m.path)).size !== modules.length) {
+      ctx.addIssue({
+        code: "custom",
+        message: "Duplicate Worker module paths"
+      });
+    }
+    if (!modules.some(
+      (m) => m.path === value.worker?.main && m.type === "application/javascript+module"
+    )) {
+      ctx.addIssue({
+        code: "custom",
+        message: "Worker entry module is missing"
+      });
+    }
+    if (modules.reduce(
+      (sum, m) => sum + m.content.length * 3 / 4 - (m.content.endsWith("==") ? 2 : m.content.endsWith("=") ? 1 : 0),
+      0
+    ) > 1e7) {
+      ctx.addIssue({
+        code: "custom",
+        message: "Worker modules exceed 10 MB"
+      });
+    }
+  }
+  if (new Set(value.assets.map((a) => a.path)).size !== value.assets.length) {
+    ctx.addIssue({ code: "custom", message: "Duplicate asset paths" });
+  }
+  if (!value.worker && !value.assets.some((a) => a.path === "/index.html")) {
+    ctx.addIssue({
+      code: "custom",
+      message: "Build must include index.html"
+    });
+  }
+  if (value.assets.reduce((sum, a) => sum + a.size, 0) > 1e7) {
+    ctx.addIssue({ code: "custom", message: "Staging assets exceed 10 MB" });
+  }
+}))();
+
+// src/identity-integration.ts
+import * as z6 from "zod";
+var identityIntegrationInputSchema = /* @__PURE__ */ (() => z6.object({
+  name: z6.string().trim().min(1).max(80),
+  origin: z6.string().url().superRefine((value, context) => {
+    const url = new URL(value);
+    if (url.protocol !== "https:") {
+      context.addIssue({ code: "custom", message: "Use an HTTPS origin." });
+    } else if (url.origin !== value) {
+      context.addIssue({
+        code: "custom",
+        message: `Use the exact origin ${url.origin}, without a path, query or trailing slash.`
+      });
+    }
+  }),
+  /**
+   * The identity kind this integration owns in the project and environment, such as
+   * `app:game`. Each member it signs in gets the exchanged subject as an identity of this
+   * kind, which tracker attribution and `ctx.member.identities()` read. Its kind cannot change.
+   * Omit it for an integration that only signs members in.
+   *
+   * A kind belongs to the integration that first claimed it, also after that integration is
+   * disconnected. A new integration takes a kind that already has identities only by adopting
+   * them with `adoptIdentitiesFrom`.
+   */
+  identityKind: appIdentityKindSchema.optional(),
+  /**
+   * Adopt the identities of a disconnected integration's `identityKind`: its ID, as
+   * `identityIntegrations.kinds()` lists it. Adopt only when this app's user IDs mean the same
+   * users as that integration's, because each one then signs in as the member that ID is linked
+   * to. Needs `reason`, which the audit log keeps.
+   */
+  adoptIdentitiesFrom: z6.string().uuid().optional(),
+  /** Why the identities are adopted; required with `adoptIdentitiesFrom`. */
+  reason: z6.string().trim().min(1).max(500).optional(),
+  /** Days until the first secret expires. Omit it for a key that never expires. */
+  expiresInDays: z6.number().int().min(1).max(3650).optional()
+}).strict().refine(
+  (input) => !input.adoptIdentitiesFrom || input.identityKind,
+  "Adopting identities needs the identityKind they have"
+).refine(
+  (input) => !input.adoptIdentitiesFrom === !input.reason,
+  "Give a reason when adopting identities, and only then"
+))();
+var identityIntegrationSchema = /* @__PURE__ */ (() => z6.object({
+  ...authScopeSchema.shape,
+  id: z6.string().uuid(),
+  name: z6.string(),
+  origin: z6.string(),
+  /**
+   * When the integration's last working secret expires: 8640000000000000 (the latest date
+   * JavaScript represents) when one never does.
+   *
+   * @deprecated Read `secrets`, which gives each secret's own expiry.
+   */
+  expiresAt: z6.number(),
+  /** The integration's working secrets, oldest first. Any of them authenticates it. */
+  secrets: z6.array(credentialSecretSchema).default([]),
+  /** The latest use of any of its secrets, revoked ones included; null when none was used. */
+  lastUsedAt: z6.number().nullable().default(null),
+  /** The identity kind the integration owns; null when it only signs members in. */
+  identityKind: openIdentityKindSchema.nullable().default(null),
+  /**
+   * Whether the app's server may vouch for its members' accounts when it signs them in
+   * (`accounts` on the exchange). False in Relay versions without it.
+   */
+  vouchesAccounts: z6.boolean().default(false)
+}))();
+var identityIntegrationSecretSchema = /* @__PURE__ */ (() => identityIntegrationSchema.extend(
+  {
+    token: z6.string()
+  }
+))();
+var identityIntegrationAppSecretSchema = /* @__PURE__ */ (() => identityIntegrationSchema.extend({ appSecret: appSecretSchema }))();
+var identityKindClaimSchema = /* @__PURE__ */ (() => z6.object({
+  kind: openIdentityKindSchema,
+  /** The owning integration's ID; it stays after the integration is disconnected. */
+  integration: z6.string(),
+  /** The owning integration's name when it claimed or adopted the kind. */
+  integrationName: z6.string(),
+  /** Whether the owning integration is still connected. */
+  connected: z6.boolean(),
+  /** Linked identities of the kind; adopting them is required to reuse the kind. */
+  linked: z6.number().int().nonnegative(),
+  /** Identities an operator unlinked. */
+  unlinked: z6.number().int().nonnegative(),
+  claimedAt: z6.number().int().nonnegative()
+}))();
+var identityIntegrationAccountVouchingInputSchema = /* @__PURE__ */ (() => z6.object({
+  enabled: z6.boolean(),
+  reason: z6.string().trim().min(1).max(500),
+  actionId: identifier.optional()
+}).strict())();
+var vouchedProviders = ["x", "telegram", "discord"];
+var participantExchangeAccountsSchema = /* @__PURE__ */ (() => z6.array(memberImportVouchedAccountSchema).max(20).refine(
+  (accounts) => vouchedProviders.every(
+    (kind) => accounts.filter((entry) => entry.kind === kind).length <= 1
+  ),
+  "Vouch for at most one X, Telegram and Discord account each"
+))();
+var participantExchangeSchema = /* @__PURE__ */ (() => z6.object({
+  subject: z6.string().min(1).max(200),
+  previousToken: z6.string().max(200).optional(),
+  /**
+   * Accounts the app vouches belong to this member, attached on the organization's word like an
+   * import's. Needs an integration with `vouchesAccounts`; otherwise the exchange is refused with
+   * `ACCOUNT_VOUCHING_OFF`.
+   */
+  accounts: participantExchangeAccountsSchema.optional()
+}).strict())();
+var participantExchangeAccountResultSchema = /* @__PURE__ */ (() => z6.object({
+  account: memberImportVouchedAccountSchema,
+  status: z6.string(),
+  code: z6.string().optional(),
+  message: z6.string().optional()
+}))();
+var participantExchangeResultSchema = /* @__PURE__ */ (() => exchangeResultSchema.extend({
+  accounts: z6.array(participantExchangeAccountResultSchema).optional()
+}))();
+var identityIntegrationKeySchema = /* @__PURE__ */ (() => z6.object({
+  id: z6.string(),
+  name: z6.string(),
+  organization: z6.string(),
+  project: z6.string(),
+  environment: z6.string(),
+  origin: z6.string(),
+  identityKind: openIdentityKindSchema.nullable().default(null),
+  vouchesAccounts: z6.boolean().default(false),
+  secretExpiresAt: z6.number().nullable().default(null),
+  appOrigins: z6.array(z6.string()).default([])
+}))();
+var accountVouchedBySchema = /* @__PURE__ */ (() => z6.object({
+  /** The integration's ID; it stays after the integration is disconnected. */
+  integration: z6.string(),
+  /** The integration's name when it vouched for the account. */
+  integrationName: z6.string()
+}))();
+
+export {
+  credentialSecretSchema,
+  credentialSecretInputSchema,
+  memberImportIdentitySchema,
+  memberImportAccountSchema,
+  memberImportVouchedAccountSchema,
+  identityReferenceSchema,
+  memberImportActionSchema,
+  memberImportReferralSchema,
+  memberImportConsentSchema,
+  memberImportRowSchema,
+  memberImportFullRowSchema,
+  memberImportCreateSchema,
+  memberImportRowsInputSchema,
+  memberImportFullRowsInputSchema,
+  MemberImportRefusalCode,
+  memberImportRefusalSchema,
+  memberImportRowResultSchema,
+  memberImportRowPageSchema,
+  memberImportRowQuerySchema,
+  memberImportSummarySchema,
+  memberImportCommandSchema,
+  memberImportRevertInputSchema,
+  memberImportRevertOutcomeSchema,
+  memberImportRevertSchema,
+  MemberImportState,
+  memberImportSchema,
+  memberImportPageSchema,
+  memberImportListQuerySchema,
+  APP_SCHEDULE_LIMIT,
+  APP_SCHEDULE_MIN_INTERVAL,
+  APP_SCHEDULE_TIMEOUT,
+  appScheduleNameSchema,
+  appSchedulePathSchema,
+  appScheduleSchema,
+  appSchedulesSchema,
+  nextScheduleRun,
+  appScheduleStateSchema,
+  appScheduleStateInputSchema,
+  APP_SCHEDULE_RESULT_BYTES,
+  appScheduleDiagnosticSchema,
+  appScheduleResultSchema,
+  scheduleResult,
+  appScheduleRunSchema,
+  appScheduleRunsSchema,
+  appScheduleListSchema,
+  scheduledInvocationSchema,
+  verifyScheduledRequest,
+  starters,
+  offeredStarterSchema,
+  starterTemplates,
+  starterIdSchema,
+  appRoutingSchema,
+  APP_SECRET_LIMIT,
+  APP_KV_LIMIT,
+  APP_SQL_LIMIT,
+  APP_MIGRATION_LIMIT,
+  APP_MIGRATION_FILE_BYTES,
+  APP_MIGRATION_TOTAL_BYTES,
+  appSecretNameSchema,
+  appSecretValueSchema,
+  appSecretInputSchema,
+  appSecretSchema,
+  appSecretDeclarationSchema,
+  appSecretDeclarationsSchema,
+  appSecretListSchema,
+  hostedAppSecretsSchema,
+  appStorageSchema,
+  appStorageKindSchema,
+  appStorageListSchema,
+  APP_STORAGE_ROW_LIMIT,
+  APP_STORAGE_PREVIEW_CHARACTERS,
+  appStorageCellSchema,
+  appStorageTablesSchema,
+  appStorageRowsSchema,
+  appStorageKeysSchema,
+  appStorageValueSchema,
+  APP_STORAGE_CELL_CHARACTERS,
+  appStorageCellPageSchema,
+  appStorageSqlClearSchema,
+  appStorageKvClearSchema,
+  appStorageSqlClearResultSchema,
+  appStorageKvClearResultSchema,
+  appMigrationNameSchema,
+  compareAppMigrations,
+  hostedAppSchema,
+  repositorySchema,
+  repositoryCreateSchema,
+  createRepositorySchema,
+  deviceStartSchema,
+  deviceRedeemSchema,
+  deviceApproveSchema,
+  commitSchema,
+  stageRequestSchema,
+  buildIdentitySchema,
+  buildPhaseSchema,
+  buildStatusSchema,
+  hostedBuildSchema,
+  liveAppSchema,
+  customDomainStateSchema,
+  customDomainRecordSchema,
+  customDomainSchema,
+  customDomainListSchema,
+  customDomainInputSchema,
+  stagingAccessModeSchema,
+  stagingAccessSchema,
+  stagingAccessInputSchema,
+  stagingPathSchema,
+  stagingLinkSchema,
+  buildSnapshotSchema,
+  assetPathSchema,
+  stagedDeploymentLimits,
+  stagedDeploymentSchema,
+  stagedDeploymentContentSchema,
+  stagedDeploymentKey,
+  buildArtifactsSchema,
+  identityIntegrationInputSchema,
+  identityIntegrationSchema,
+  identityIntegrationSecretSchema,
+  identityIntegrationAppSecretSchema,
+  identityKindClaimSchema,
+  identityIntegrationAccountVouchingInputSchema,
+  participantExchangeAccountsSchema,
+  participantExchangeSchema,
+  participantExchangeAccountResultSchema,
+  participantExchangeResultSchema,
+  identityIntegrationKeySchema,
+  accountVouchedBySchema
+};