{ "format": 1, "capabilities": [ { "id": "identity", "support": "native", "description": "Real email and configured OAuth sign-in, and wallet sign-in where a project enables it; identities and sessions are scoped to a project and environment. A signed-in participant reads their own verified sign-in email addresses with me.get() (email, or null after wallet-only sign-in, and emails); participant routes never return another member's. me.get() also returns the member's clock ({ now, offsetMs }), which runs ahead for a test member whose clock was advanced; memberTime(me) from @domino-sdk/relay/browser gives the member's current time for date-gated screens.", "entrypoints": [ "auth.providers", "auth.start", "auth.emailStart", "auth.emailVerify", "auth.session", "me.get" ], "evidence": [ "apps/backend/src/auth/sessions.ts", "apps/backend/src/public/routes/sign-in.ts", "apps/backend/src/auth/accounts.ts" ] }, { "id": "connected-accounts", "support": "native", "description": "Project-scoped Discord membership, roles, nickname, display name, boosting status and captured message reads. Participants link identity; operators install the bot once. X and Discord sign-ins and connections store the account's public name, handle and picture for participant profiles. Linking X signs in with X (OAuth 2.0 with PKCE) and stores the account's stable X user ID, which tracker attribution and ctx.x ownership checks use; a handle never establishes ownership. No arbitrary Discord writes. Operators read active X and Discord selections and reviewers unlink them with a reason in Console or the management API. Subject and revision preconditions prevent stale reviews from unlinking newer selections. Unlinking affects the project and environment, preserving identity ownership, sign-in grants and existing rewards, except that an imported or vouched account the member never signed in with or proved is released so its owner can link it. Reviewers restore exact retained OAuth selections through the kind-keyed members.identityStates.relink operation, with a revision and audited reason. Relink keeps ownership, sign-in grants and sessions, and redecides unlinked historical activity under the current quest policy. members.identityStates reads every identity a member proved, by kind (wallets, X, Discord and Telegram accounts, app identities), with its link, revision, sign-in and allowed actions, and unlinks or relinks any of them with an expected revision, an audited reason and a receipt-backed action ID, naming the identity as a member import does ({ kind: \"x\" | \"discord\" | \"telegram\", subject }, { kind: \"app:\", subject } or { kind: \"wallet\", chain, address }; an X or Discord subject resolves to the member's selected account, else the only one they hold, and 409 identity-ambiguous otherwise) or with the selector the list returned, whose oauth and app forms are deprecated. Each identity read says where it came from (source: member, import with the import's ID, app-login or test-link); the per-kind methods (oauthAccounts, unlinkOAuthAccount, identityLinks) are deprecated 1.x adapters.", "entrypoints": [ "auth.accounts", "auth.start", "auth.disconnect", "management.members.identityStates.list", "management.members.identityStates.unlink", "management.members.identityStates.relink" ], "cli": [ "members identities", "members unlink-identity", "members relink-identity" ], "reference": "verification", "evidence": [ "apps/backend/src/auth/accounts.ts", "apps/backend/src/public/oauth-providers.ts", "apps/backend/tests/gateway/management-member-oauth.test.ts", "apps/backend/src/auth/identity-links.ts", "apps/backend/tests/gateway/management-identity-relink.test.ts", "apps/backend/src/auth/identity-states.ts", "apps/backend/tests/gateway/management-identity-states.test.ts", "apps/backend/src/public/routes/management-identity-context.ts", "apps/backend/tests/gateway/management-org.test.ts" ] }, { "id": "identity-exchange", "support": "native", "description": "Keep an existing application login using createParticipantBackend on its server. A Console administrator creates a project/environment identity integration key. The adapter verifies the application session, exchanges its stable subject for a member-only Domino session, and routes participant requests with trusted scope. Keys never expire unless an expiry is chosen at creation. They rotate with overlap: addSecret issues a second secret while the first keeps working, revokeSecret retires the old one, and removeSecretExpiry makes an expiring secret permanent; each secret reports its last use. When an integration's last secret expires, its sessions end. rotate, which replaces every secret at once, is deprecated. A key created with an identity kind (identityKind: \"app:\", set only at creation) links each exchanged subject to its member as an app: identity, which custom tracker records can name and ctx.member.identities() lists. A kind belongs to the integration that first claimed it, also after a disconnect; a new integration reuses a kind with identities only by adopting them (adoptIdentitiesFrom plus an audited reason; identityIntegrations.kinds lists owners). Reviewers unlink and relink a member's app identity with an audited reason; unlinking ends its sessions and refuses its sign-in (409 APP_IDENTITY_UNLINKED) until relinked. Administrators manage these keys in Console, or with management.identityIntegrations from a Console session; an API key or CLI sign-in cannot change them. An administrator's CLI session lists them without secrets (identityIntegrations.list and kinds; domino identity-integrations list and kinds), so the owner creates the key in Console (which, for a Domino-hosted app, stores it as the app secret APP_IDENTITY_KEY in the same step: identityIntegrations.createIntoAppSecret and addSecretIntoAppSecret, publish permission, no token answered) or stores it with printf %s \"$KEY\" | domino secrets set APP_IDENTITY_KEY, and the agent confirms it; non-admin CLI sessions and every key type are refused. members.identityStates unlinks and relinks app identities by kind beside wallets and accounts; unlinkIdentity and relinkIdentity are deprecated adapters. With Vouches accounts on (identityIntegrations.setAccountVouching with a reason, from a Console session with publish permission), authenticate may also return accounts (wallets and one X, Telegram and Discord account each) that the exchange attaches under a member import's rules, answering each one attached, already-linked or refused with an import refusal code; with it off, accounts are refused with 403 ACCOUNT_VOUCHING_OFF. exchangeParticipant runs the same exchange from a server without a browser. inspectIntegrationKey (GET /v1/auth/integration) answers which integration a key belongs to (organization, project, environment, origin, this secret's expiry and the app's origins in that environment), never a secret and without counting as a use; domino secrets set runs it on every di_ value and refuses, storing nothing, a key that is unknown, expired, revoked or for another project or environment.", "entrypoints": [ "management.identityIntegrations.list", "management.identityIntegrations.create", "management.identityIntegrations.rotate", "management.identityIntegrations.addSecret", "management.identityIntegrations.addSecretIntoAppSecret", "management.identityIntegrations.createIntoAppSecret", "management.identityIntegrations.revokeSecret", "management.identityIntegrations.removeSecretExpiry", "management.identityIntegrations.revoke", "management.identityIntegrations.kinds", "management.identityIntegrations.setAccountVouching", "management.members.unlinkIdentity", "management.members.relinkIdentity", "management.members.identityStates.list", "management.members.identityStates.unlink", "management.members.identityStates.relink" ], "cli": ["identity-integrations list", "identity-integrations kinds"], "reference": "participant-api", "evidence": [ "apps/backend/src/auth/integrations.ts", "apps/backend/src/auth/identities.ts", "apps/backend/src/public/participant-scope.ts", "apps/backend/tests/auth.test.ts", "apps/backend/src/auth/identity-states.ts", "apps/backend/tests/gateway/management-identity-states.test.ts" ] }, { "id": "quests", "support": "native", "description": "Claim, photo, quiz, staff and automatic quests; immutable releases pin attempts and promised rewards. Keyed completions and atomic lifetime, day, week (from Monday) or month budgets of the project calendar prevent duplicate awards for repeatable quests. Evaluations replay deterministically: ctx.now is the attempt's evaluation time, Date.now() and new Date() stay frozen at it, and Math.random() and crypto randomness are seeded per attempt. Reads name tiered rewards by ID; apps match them to their keys with tieredRewards.list. Deleting a quest file does not archive it: domino quests archive|unarchive --reason (publish permission; test only, since live refuses archive state changes from every credential with promotion-required) or the quest's Console page publishes its current release again as archived or reopened, with an audited reason. Archived quests admit no new attempts, leave collections and supportedInteractions, keep completions and rewards, and stay archived when their code deploys again; unarchiving re-checks the app's supported interactions and the prerequisite graph. Console-created quests change participation in their Console editor. An operator with publish pauses or resumes one quest, or all redemptions, against the revision they saw and with a reason (management.quests.pause/resume and management.redemptions.pause/resume). With read permission, operators list each quest's current release, archived ones included (management.quests.list), and every paused or resumed operation (management.operations.list). With read and publish, they page through release history, every release a quest has had, newest first and optionally for one quest (management.releases.list), and read one current or historical release (management.releases.get). From the CLI, domino quests list|get read current quests, releases list|get read release history, and pauses list reads the revision pause and resume need; the bare domino quests, releases and status read Console's former pages and are deprecated.", "entrypoints": [ "keyed", "budget", "quests.experience", "quests.observe", "quests.open", "tieredRewards.list", "management.quests.archive", "management.quests.unarchive", "management.quests.list", "management.releases.list", "management.releases.get", "management.operations.list", "management.quests.pause", "management.quests.resume", "management.redemptions.pause", "management.redemptions.resume" ], "cli": [ "quests list", "quests get", "quests archive", "quests unarchive", "quests pause", "quests resume", "quests enrollments", "quests enroll", "quests withdraw", "releases list", "releases get", "pauses list", "redemptions pause", "redemptions resume" ], "reference": "authoring", "evidence": [ "apps/backend/src/application/quest-catalog.ts", "apps/backend/src/ledger/participation/attempts.ts", "apps/backend/src/application/quest-lifecycle.ts", "apps/backend/tests/quest-lifecycle.test.ts", "apps/backend/tests/evaluator-determinism.test.ts", "packages/management/cli/commands/quests.mjs", "tests/cli-quests.test.mjs", "apps/backend/tests/contract-operations.test.ts", "apps/backend/tests/gateway/management-resource-reads.test.ts", "apps/backend/src/ledger/operations/quest-catalog.ts", "packages/management/cli/commands/inspect.mjs", "tests/cli-resources.test.mjs" ] }, { "id": "points", "support": "native", "description": "Define typed point-ledger handles in code and pass them to authored rewards, budgets, prerequisites, leaderboards, referrals and engagement rules. settings.pointLedger selects a Console ledger as a typed reference; an empty selection pauses the quest. The server applies completion and rewards; the browser cannot write balances. A signed-in participant reads only their own balances (current and available after reservations) and point history, without operator reasons. Reads name ledgers by ID; apps match them to their keys and names with pointLedgers.list. An external score gets its own ledger, updated with absolute values (set updates) by the server that measures it; that ledger is never spent. Console member detail shows every balance and provides history, award, adjustment and reversal controls. Creating, editing or archiving a ledger needs publish and works only in test: live refuses it from every credential with promotion-required, and live ledgers come from a promotion from test. Archived ledgers stay readable and existing published rewards keep working, but new reward choices and definitions cannot use them. From the CLI, domino point-ledgers list|create|update|archive|unarchive manage ledgers.", "entrypoints": [ "defineLedger", "points", "settings.pointLedger", "decision.accept", "me.observeProgress", "me.balances", "me.pointHistory", "pointLedgers.list", "management.pointLedgers.list", "management.pointLedgers.create", "management.pointLedgers.update", "management.pointLedgers.archive" ], "cli": [ "point-ledgers list", "point-ledgers create", "point-ledgers update", "point-ledgers archive", "point-ledgers unarchive" ], "evidence": [ "apps/backend/tests/ledger/accounting/inventory.test.ts", "apps/backend/tests/gateway/participant-ledger.test.ts", "apps/backend/tests/contract-points.test.ts", "apps/console/src/features/console/member-points.test.tsx", "packages/management/cli/commands/points.mjs" ] }, { "id": "review", "support": "native", "description": "Queue a quest attempt for an authorized human reviewer. Review decisions and reward execution remain server-owned. Reviewers with review accept or reject a waiting attempt at the generation they saw, with a reason, and evaluate a failed attempt again (management.attempts.review, management.attempts.retry). With read permission, operators page through attempts newest first by quest, status and search, with the releases they pin, the members they name and a total (management.attempts.list), and read one attempt with its release, recorded events and member (management.attempts.get). From the CLI, domino attempts list|get reach the same reads. An evaluator rejects with decision.reject({ reason, code? }): the optional code (lowercase letters, digits and hyphens, at most 64 characters, none of the codes Relay writes itself such as budget-exhausted) names the cause, and these reads and Console's attempt detail show it beside the reason; member responses never carry it.", "entrypoints": [ "decision.review", "decision.reject", "management.attempts.review", "management.attempts.retry", "management.attempts.list", "management.attempts.get" ], "cli": ["attempts list", "attempts get"], "evidence": [ "tests/photo-review.test.mjs", "apps/backend/src/ledger/participation/attempts.ts", "apps/backend/tests/contract-attempts.test.ts", "apps/backend/tests/gateway/management-resource-reads.test.ts", "packages/management/cli/commands/inspect.mjs", "tests/cli-resources.test.mjs" ] }, { "id": "text-ai-review", "support": "native", "description": "Review text against author criteria with ctx.review.text. Returns pass, fail or unclear; quest code chooses the decision. Text is limited to 16,000 JavaScript string units, criteria to 2,000. Successful results are captured for replay. Provider failures remain errors. Does not add a free-text submission form or verify authorship.", "entrypoints": ["defineQuest"], "evidence": [ "tests/text-review.test.mjs", "apps/backend/tests/text-review-sandbox.test.ts", "packages/sdk/examples/text-review-quest.ts" ], "reference": "verification" }, { "id": "image-checks", "support": "native", "description": "Evaluator ctx.images.inspect, compare, review, extract and seen check images without exposing bytes or URLs to quest code. References name the attempt's photo evidence, the linked X profile picture, a post's attached image, or a reference image deployed from relay.json images. Perceptual hash distances (0-64) compare images; AI review and field extraction accept up to four images; seen records the image when called, even for a later-rejected attempt, and counts other participants' near-duplicates. Results are captured for replay. Checks run at verification time and do not prove retention.", "entrypoints": ["defineQuest"], "evidence": [ "apps/backend/tests/image-capabilities.test.ts", "apps/backend/tests/image-sandbox.test.ts", "tests/image-examples.test.mjs", "packages/sdk/examples/x-profile-picture-quest.ts", "snippets/x-profile-picture/x-profile-picture.quest.ts", "snippets/unique-photo/unique-photo.quest.ts", "snippets/community-screenshot/community-screenshot.quest.ts" ], "reference": "verification" }, { "id": "streaks", "support": "native", "description": "streak({ days }) pays one lifetime milestone per member after consecutive project calendar days with an accepted attempt. It completes manual quests (the day each submission was admitted, so a manual streak counts submission days) and tracker-triggered quests (the day of each record observation's occurredAt, such as an X post's publication or a Discord message's post time). Several accepted attempts on one day count once, late evidence repairs gaps and merges runs, and a budget-exhausted milestone keeps its days. Days end at midnight in the project timezone, a timezone change keeps runs consecutive, and a published goal never changes. Content quests and prerequisite-only automatic() quests cannot be streaks.", "entrypoints": ["streak", "manual", "automatic"], "reference": "quest-rules", "evidence": [ "apps/backend/src/ledger/participation/streaks.ts", "apps/backend/src/ledger/participation/attempts.ts", "apps/backend/src/ledger/model/quest-graph.ts", "apps/backend/tests/streaks.test.ts", "apps/backend/tests/quest-graph.test.ts", "apps/backend/tests/tracker-triggers.test.ts" ] }, { "id": "project-calendar", "support": "native", "description": "One timezone per project and environment sets where days, weeks (ISO, from Monday) and months begin for quest budgets, engagement budgets, streak days and calendar leaderboard windows, so a weekly budget and a weekly board cover the same week. Evaluators use the attempt-pinned ctx.calendar.day(at?) for the YYYY-MM-DD@Zone key and exact day bounds; without at it reads ctx.eligibleAt. UTC until set with relay.json calendar.timeZone, Console Settings, or management.calendar.configure (publish permission; live refuses it from every credential with promotion-required and takes test's calendar through a promotion). Named IANA zones only; fixed offsets are rejected, and no quest, budget, streak or board names its own zone. A change takes effect at the next midnight of the current zone: the open day, week or month finishes in the old zone, the next one ends at the new zone's next boundary, and streak days stay consecutive. A deployment applies relay.json's zone only when the declaration changes, so a Console change stays until relay.json is edited. From the CLI, domino calendar get reads the calendar and calendar configure --time-zone --reason changes it as a saved operation (--operation-id).", "entrypoints": [ "management.calendar.read", "management.calendar.configure", "budget", "streak", "defineLeaderboard", "defineEngagementReward" ], "cli": ["calendar get", "calendar configure"], "reference": "authoring", "evidence": [ "packages/sdk/src/authoring.ts", "packages/contracts/src/evaluator-readers.ts", "apps/backend/src/workflows/execution-handler.ts", "apps/backend/src/ledger/model/calendar.ts", "apps/backend/src/ledger/definitions/calendar.ts", "apps/backend/tests/ledger/participation/project-calendar.test.ts", "apps/backend/tests/project-calendar-store.test.ts", "tests/evaluator-compat.test.mjs", "packages/management/cli/commands/operator-resources.mjs", "tests/cli-resources.test.mjs" ] }, { "id": "milestones", "support": "composed", "description": "Compose typed same-participant prerequisites with completed(quest), a project-calendar day/week/month completion, balanceAtLeast(ledger, minimum), or inGroup(group). Completion prerequisites are durable facts; balance and group requirements observe current eligibility. Referral milestones are native, not composed: they count currently qualified friends and recover or restore rewards, with debt, when a friend's qualification changes. Other aggregate thresholds need application logic.", "entrypoints": [ "completed", "balanceAtLeast", "defineGroup", "inGroup", "automatic", "defineQuest" ], "reference": "quest-rules", "evidence": [ "apps/backend/src/ledger/participation/admission-facts.ts", "apps/backend/tests/campaign-eligibility.test.ts", "packages/sdk/src/prerequisites.ts" ] }, { "id": "groups", "support": "native", "description": "Project-level groups: named sets of members that inGroup prerequisites, leaderboard group filters and referral inviterGroup rules read by key. defineGroup gives code a typed handle for a key. Publishing code that names a group the environment lacks creates it with no members and the handle's title (its key when only a leaderboard or referral rule names it): a deployment in test, an approved promotion in live, audited as group-created and listed as a group-created warning beforehand; it never changes an existing group's title or members. Operators create groups and manage their members in Console Groups, with domino groups, or with management.groups. Reads need read; changes need publish, which a personal API key can use in live but a CLI session cannot. Every membership change records its reason in the audit history, and adding a member checks prerequisite-only automatic quests. A quest reward, groupMembership(group) beside points(...) and badge(...), adds the member when the completion's rewards are delivered, with the completion as the audited reason; it is how an approved application (manual review) joins a curated group in one step. Publishing refuses a group reward naming an archived group (validation-failed; conflict on promotion approval), since publishing never unarchives a group. Revoking the completion removes the membership it added unless an operator's add or another unrevoked completion also backs it; an archived group keeps the member. Groups are archived, never deleted: an archived group keeps its members, which still count, but its membership cannot change until it is unarchived. A group that the current release of a quest that is not archived rewards cannot be archived (group-in-use, naming the quests). Leaderboard settlements read the membership a group had at their cutoff. A leaderboard's exclusion group is a group too: Relay generates one per board under the reserved domino--exclusions-- key prefix, and a group bound as any board's exclusion group cannot be archived (group-in-use) until those boards are bound elsewhere. management.leaderboards.group is a deprecated alias that creates a missing group on its first member.", "entrypoints": [ "defineGroup", "inGroup", "groupMembership", "management.groups.list", "management.groups.get", "management.groups.create", "management.groups.update", "management.groups.archive", "management.groups.unarchive", "management.groups.members", "management.groups.member", "management.groups.addMember", "management.groups.removeMember" ], "cli": [ "groups list", "groups get", "groups create", "groups update", "groups archive", "groups unarchive", "groups members", "groups member", "groups add", "groups remove" ], "reference": "authoring", "evidence": [ "apps/backend/src/ledger/members/groups.ts", "apps/backend/src/ledger/operations/groups.ts", "apps/backend/tests/groups.test.ts", "apps/backend/src/ledger/accounting/rewards/kinds/group.ts", "apps/backend/tests/group-rewards.test.ts", "apps/console/src/features/console/groups.tsx", "packages/management/cli/commands/groups.mjs", "tests/cli-groups.test.mjs" ] }, { "id": "campaign-eligibility", "support": "native", "description": "Code-authored campaigns coordinate a half-open time window and optional durable enrollment across quests. Quests may narrow that window. Participant quest views return the campaign, first enrollment time and current withdrawal state, effective window, typed prerequisite failures, stable blocked reasons, and each authored budget's current remaining capacity and reset time. Members may enroll, withdraw and re-enroll themselves. Trusted servers and Console operators with enroll permission may enroll, withdraw with an audited reason, and restore a member. Withdrawal blocks new admissions without deleting attempts, completions, rewards or the first enrollment time.", "entrypoints": [ "defineCampaign", "campaigns.enroll", "campaigns.withdraw", "management.campaigns.enroll", "management.campaigns.withdraw", "quests.experience" ], "reference": "quest-rules", "evidence": [ "packages/sdk/src/campaigns.ts", "apps/backend/src/ledger/operations/campaigns.ts", "apps/backend/src/ledger/participation/admission-facts.ts", "apps/backend/tests/campaign-eligibility.test.ts" ] }, { "id": "referrals", "support": "native", "description": "Project-scoped invitation codes, immutable inviter attribution, configurable signup, quest or external qualification, fixed rewards and distinct-friend milestones. For several verified actions, qualify through a counter quest with questCompleted(quest). External qualification can be withdrawn and reconciles rewards; a group plus an inGroup quest qualifies once and group removal does not unqualify. Selective one-level inviter bonuses add points without reducing invitee awards. Code-defined rules publish through reviewed project deployments. From the CLI, domino referral-programs list|qualify, referral-relationships list|history|pause|resume and referral-rewards resolve reach the same reads and commands; changes are saved operations (--operation-id).", "entrypoints": [ "defineReferral", "referrals.list", "referrals.summary", "referrals.accept", "referrals.history", "management.referrals.list", "management.referrals.participants", "management.referrals.history", "management.referrals.qualify", "management.referrals.resolveReward", "management.referrals.pause", "management.referrals.resume" ], "cli": [ "referral-programs list", "referral-programs qualify", "referral-programs archive", "referral-programs unarchive", "referral-relationships list", "referral-relationships history", "referral-relationships pause", "referral-relationships resume", "referral-rewards resolve" ], "reference": "referrals", "evidence": [ "apps/backend/tests/ledger/accounting/referrals.test.ts", "packages/sdk/src/referrals.ts", "packages/management/cli/commands/operator-resources.mjs", "tests/cli-resources.test.mjs" ] }, { "id": "cross-participant-rewards", "support": "native", "description": "Referral programs can reward inviter and invitee independently and award a selective percentage of eligible points to the inviter. Bonuses accumulate fractions and support limits, suspension and correction recovery. Arbitrary participant-to-participant transfers and multi-level commissions are not supported.", "entrypoints": ["defineReferral", "referrals.summary"], "reference": "referrals", "evidence": [ "apps/backend/tests/ledger/accounting/referrals.test.ts", "apps/backend/src/ledger/accounting/referral-operations.ts" ] }, { "id": "rankings", "support": "native", "description": "Publish project-scoped points leaderboards through project deployments. Read paginated standings, your rank, and nearby competitors with shared tie ranks, or, on a board defined with ties: \"earliest\", equal scores ordered by who reached them first (the settlement's earliest order), each with its own rank. A signed-in member pages through the point entries behind their own score on a board (me.leaderboardHistory), selected by the board's own window, quests and calculation, so they sum to the score; an excluded member gets none. Code defines balance, earned, or net calculations and time windows. Public access is explicit; participant rows use board-specific aliases unless the project enables profiles, which add each member's name and avatar. A board's optional group ranks only that group's members (see the groups capability). A board defined with includeUnscored also lists its eligible members without qualifying points at score 0, sharing one rank after every member who scored; settlements leave them out. Scoped management APIs supply external points and corrections. A board leaves out the members of its exclusion group: its own generated group (key domino--exclusions--), created by its first exclusion, or a group an operator binds with management.leaderboards.bindExclusionGroup so it moderates several boards. management.leaderboards.exclude and exclusions change and read that group, as the groups operations do; exclusion changes need publish, also in live from a personal API key; binding an exclusion group is a definition change that live refuses with promotion-required; both are audited; an external score, such as a tracked wallet balance, gets its own ledger, updated with absolute values (set updates). Referral bonus points contribute to their named balance. Fixed and calendar earned/net boards can declare point and tiered-reward prizes at window end. Relay freezes eligible standings and the members of the exclusion group bound at the cutoff, then a reviewer approves delivery in Console or with management.leaderboards.approveSettlement; each winner gets an ordinary completion that can be revoked. A settlement may also declare a pool prize (settle.pool: a base-unit amount in points or a token unit with decimals, an optional minScore): the freeze splits it over the eligible scores in exact integer math, rounding down and giving leftover units to the largest remainders, and stores each member's pool share on the frozen row. A points pool pays each share into its ledger in the winner's completion on approval, and revoking the completion reverses it; any other unit is only recorded, and management.leaderboards.settlementExport lists each row's share with the member's verified wallets for the operator to pay off-platform, settlementPayoutCsv turns that list into the CSV the CLI prints, and Console downloads it from the settlement panel. Cross-project balances are not supported. A board that counts engagement points first takes a closing measurement: the settlement is closing while Relay resamples the content (a sample within 30 minutes after the cutoff counts as measured at it), then freezes and lists content frozen at its last good sample as unmeasured; management.leaderboards.retrySettlementMeasurement measures it again. Reviewers can reject a pending settlement with an audited reason. Rejection pays no prizes and permanently retains the frozen window; settlementReviews and settlementReview include rejected history, while legacy reads keep their original statuses. From the CLI, domino leaderboards list|standings|history|exclusions|exclusion-group read boards, leaderboards exclude|include change exclusions, leaderboards bind-exclusion-group binds a board's exclusion group, and leaderboard-settlements list|get|approve|reject|retry-measurement review settlements, leaderboard-settlements export prints the payout list as CSV (--json for the typed result); changes are saved operations (--operation-id).", "entrypoints": [ "defineLeaderboard", "leaderboards.list", "leaderboards.standings", "me.leaderboardHistory", "management.leaderboards.list", "management.leaderboards.standings", "management.leaderboards.history", "management.leaderboards.exclusions", "management.leaderboards.exclude", "management.leaderboards.exclusionGroup", "management.leaderboards.bindExclusionGroup", "management.leaderboards.group", "management.leaderboards.settlements", "management.leaderboards.settlement", "management.leaderboards.approveSettlement", "management.completions.revoke", "management.leaderboards.settlementReviews", "management.leaderboards.settlementReview", "management.leaderboards.settlementExport", "management.leaderboards.rejectSettlement", "management.leaderboards.retrySettlementMeasurement" ], "cli": [ "leaderboards list", "leaderboards standings", "leaderboards history", "leaderboards exclusions", "leaderboards exclude", "leaderboards include", "leaderboards exclusion-group", "leaderboards bind-exclusion-group", "leaderboards archive", "leaderboards unarchive", "leaderboard-settlements list", "leaderboard-settlements get", "leaderboard-settlements export", "leaderboard-settlements approve", "leaderboard-settlements reject", "leaderboard-settlements retry-measurement" ], "evidence": [ "apps/backend/tests/ledger/accounting/leaderboards.test.ts", "apps/backend/tests/ledger/accounting/leaderboard-settlements.test.ts", "apps/backend/tests/ledger/accounting/leaderboard-pool-settlements.test.ts", "apps/backend/tests/ledger/accounting/leaderboard-exclusion-groups.test.ts", "apps/backend/tests/gateway/participant-ledger.test.ts", "apps/backend/src/ledger/accounting/leaderboard-settlements.ts", "apps/backend/src/ledger/accounting/leaderboard-exclusions.ts", "apps/backend/src/ledger/operations/leaderboard-settlements.ts", "apps/console/src/features/console/leaderboards.tsx", "packages/sdk/src/leaderboards.ts", "apps/console/src/features/console/settlement-reject.tsx", "packages/management/cli/commands/operator-resources.mjs", "tests/cli-resources.test.mjs" ] }, { "id": "hosted-app-secrets", "support": "native", "description": "Operator-set secrets for a hosted app's server code, separate in each environment: test's reach staged builds and live's the live app; a promotion never copies them and warns (binding-missing) about ones live lacks. Worker apps declare the secrets they read, with descriptions and required flags, in relay.json app.secrets; domino stage warns about missing required ones and reports missingSecrets without blocking, and domino secrets list reports declared secrets that are missing. domino secrets set/list/delete (test unless --environment live; RELAY_ENVIRONMENT and relay.json are ignored, with a warning when they name live, and the result's environment says which was used), Console Settings → App secrets with Test or Live selected, or the management API; publish in that environment changes them, read lists names, and a CLI session may set and delete them in live. Values are write-only, 1 byte to 5 KiB, at most 50 per project environment; names are uppercase letters, digits and underscores, excluding DOMINO_ names and ASSETS. Worker builds staged after a change receive them as secret bindings, replacing app vars of the same name; earlier builds keep their values. A live change reaches the live app with the next build promoted to live. Static apps and domino dev receive none. KV and D1 bindings are declared separately under app.storage. domino secrets set checks a value starting with di_ as an app login key before storing it (see identity-exchange).", "entrypoints": [ "management.secrets.list", "management.secrets.set", "management.secrets.delete" ], "cli": ["secrets list", "secrets set", "secrets delete"], "reference": "hosted", "evidence": [ "apps/backend/src/management/app-secrets.ts", "apps/backend/tests/gateway/management-app-secrets.test.ts", "packages/management/cli/commands/secrets.mjs", "tests/cli-secrets.test.mjs" ] }, { "id": "plugin-connections", "support": "native", "description": "Experimental while the plugin contract is new: management.connections and the domino connections commands may change in a minor release. A project connects to plugins, the integrations Domino writes, separately in each environment; a promotion never copies a connection. management.connections.list or domino connections list answers every plugin available to the project, a never-connected one as disconnected with revision 0; get reads one (404 unknown-plugin otherwise), with its status (disconnected, ready, or attention with an issue), config, the JSON Schema the config must satisfy, its secret fields and whether each is set, and its revision. connect takes the config and a value for every secret field (422 invalid-config with the failing path, 422 invalid-secrets with the field, 409 already-connected); update replaces the config, some secrets or both and sets the status to ready (409 not-connected, 409 connection-changed on a stale expectedRevision); disconnect deletes the secrets and keeps the connection as disconnected, and connect works again. A plugin whose manifest declares OAuth connects through the vendor instead: authorize (domino connections authorize) takes the config and answers the vendor's authorizationUrl, which works once for ten minutes; the vendor's callback sends the browser to Console with a one-time oauthCode, and completeAuthorization redeems it within five minutes, for the person who started it only (403 scope-mismatch for anyone else, 409 oauth-flow-expired for a spent or expired code), making the connection ready with its tokens sealed on it; an automation, service or hosted app key can't authorize (403 credential-not-allowed); connect refuses such a plugin with 409 oauth-required, authorize refuses one connected with secrets with 409 oauth-not-supported, and a deployment without the vendor's OAuth app with 409 plugin-not-configured. A forged, replayed or expired state is refused and changes nothing. Domino refreshes the tokens before they expire; a refresh the vendor refuses, or tokens that can't be refreshed any more, set attention with reconnectReason revoked or expired, which only authorizing again clears; disconnect deletes the tokens, then revokes them at the vendor's revocation endpoint, logging a failed revocation. Every change takes an actionId, so a retry applies once; finishing an OAuth connection is once by its code instead, and a repeat answers 409 oauth-flow-expired. Reads need read and changes publish; a CLI session may change connections in live, an automation key or MCP client in test only. Secrets and OAuth tokens are sealed at rest and write-only: no read, error, log or CLI output answers one, and the CLI reads them from stdin as JSON or a hidden prompt, never from arguments. Test or live is chosen only by --environment (test by default). management.plugins.list answers the plugins the deployment runs with the public part of each manifest (name, slots, config schema, secret field names and labels, the events a destination receives, and for an OAuth plugin its scopes and whether the deployment has its OAuth app); it needs read, and Console's Integrations page builds each plugin's connection form from it. A plugin that connects through its own flow, such as Telegram's chats through Domino's bot, has no settings or secrets: its status comes from what the project connected, and connect, update and disconnect answer 409 plugin-managed. Each plugins.list entry also says which bespoke Console component, if any, replaces the generated card. A destination plugin whose manifest allows a dry run connects in the test environment without secrets or the vendor's account with connect { dryRun: true } (domino connections connect --dry-run): it records each request it would have sent instead (dryRunLog, domino connections log, the latest 500 kept), and authorizing the vendor's account turns the dry run off and starts the backfill again; 409 dry-run-not-supported and dry-run-test-only otherwise. A destination's activity (domino connections activity) answers its last sync, whether it is failing (10 failed deliveries in a row, or a day of failing deliveries without one success, until the vendor accepts one), members synced and skipped by reason, its latest backfill or resync with progress, and its latest 20 errors; resync (domino connections resync) sends every member's profile and attributes again, never past events, one at a time. These answer 409 not-a-destination for other plugins.", "entrypoints": [ "management.connections.list", "management.connections.get", "management.connections.connect", "management.connections.authorize", "management.connections.completeAuthorization", "management.connections.update", "management.connections.disconnect", "management.connections.activity", "management.connections.resync", "management.connections.dryRunLog", "management.plugins.list" ], "cli": [ "connections list", "connections get", "connections connect", "connections authorize", "connections update", "connections disconnect", "connections activity", "connections resync", "connections log" ], "reference": "management", "evidence": [ "apps/backend/src/plugins/connections.ts", "apps/backend/src/plugins/oauth.ts", "apps/backend/tests/gateway/management-connections.test.ts", "apps/backend/tests/gateway/management-connections-oauth.test.ts", "packages/management/cli/commands/connections.mjs", "tests/cli-connections.test.mjs", "apps/backend/src/plugins/deliveries.ts", "apps/backend/src/workflows/destinations.ts" ] }, { "id": "starter-export", "support": "native", "description": "domino starters export