@playcademy/sandbox 0.10.2-beta.1 → 0.10.2-beta.3

package/dist/cli.js

@@ -282,7 +282,17 @@ var init_platform = __esm(() => {
 });
 
 // ../constants/src/skills.ts
-var init_skills = () => {};
+var SKILL_STATUS_ROUTE = "/__playcademy/skills/status", SKILL_STATUS_TOKEN_AUDIENCE = "playcademy-game-skill-status", SKILL_STATUS_MAX_SKILLS = 50, SKILL_STATUSES, SKILL_MASTERY_SOURCES;
+var init_skills = __esm(() => {
+  SKILL_STATUSES = [
+    "locked",
+    "unlocked",
+    "in_progress",
+    "mastered",
+    "unknown_skill"
+  ];
+  SKILL_MASTERY_SOURCES = ["assessment", "placement", "test_out", "manual"];
+});
 
 // ../constants/src/system.ts
 var PLATFORM_TIMEZONE = "America/New_York";
@@ -1132,7 +1142,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@playcademy/sandbox",
-    version: "0.10.2-beta.1",
+    version: "0.10.2-beta.3",
     description: "Local development server for Playcademy game development",
     type: "module",
     exports: {
@@ -30009,6 +30019,23 @@ function generateDeploymentHash(code) {
 function computeDeployPayloadFingerprint(payload) {
   return sha256Hex(canonicalJson2(payload));
 }
+function toActiveDeploymentRow(record) {
+  return {
+    gameId: record.gameId,
+    deploymentId: record.deploymentId,
+    provider: "cloudflare",
+    target: record.target,
+    url: record.url,
+    codeHash: record.codeHash,
+    schemaHash: record.schemaHash ?? null,
+    schemaFingerprint: record.schemaFingerprint ?? null,
+    timeTravelBookmark: record.timeTravelBookmark ?? null,
+    bookmarkCapturedAt: record.bookmarkCapturedAt ?? null,
+    resources: record.resources,
+    isActive: true,
+    deployJobId: record.deployJobId ?? null
+  };
+}
 var GAME_WORKER_KEY_PREFIX = "game-worker-", DASHBOARD_WORKER_KEY_PREFIX = "dash-worker-";
 var init_deployment_util = __esm(() => {
   init_drizzle_orm();
@@ -37032,24 +37059,9 @@ class DeployService {
     }
   }
   async saveDeployment(record) {
-    const db2 = this.deps.db;
-    await db2.transaction(async (tx) => {
+    await this.deps.db.transaction(async (tx) => {
       await tx.update(gameDeployments).set({ isActive: false }).where(and(eq(gameDeployments.gameId, record.gameId), eq(gameDeployments.target, record.target)));
-      await tx.insert(gameDeployments).values({
-        gameId: record.gameId,
-        deploymentId: record.deploymentId,
-        provider: "cloudflare",
-        target: record.target,
-        url: record.url,
-        codeHash: record.codeHash,
-        schemaHash: record.schemaHash ?? null,
-        schemaFingerprint: record.schemaFingerprint ?? null,
-        timeTravelBookmark: record.timeTravelBookmark ?? null,
-        bookmarkCapturedAt: record.bookmarkCapturedAt ?? null,
-        resources: record.resources,
-        isActive: true,
-        deployJobId: record.deployJobId ?? null
-      });
+      await tx.insert(gameDeployments).values(toActiveDeploymentRow(record));
     });
   }
   async notifyDeploymentFailure(failure) {
@@ -46881,6 +46893,39 @@ function publishableRepositoryUrl(value) {
   return value;
 }
 
+// ../api-core/src/utils/releases.util.ts
+function toRelease(row) {
+  return {
+    slug: row.slug,
+    url: row.url,
+    source: normalizeDeploySource(row.source),
+    deployedAt: row.deployedAt.toISOString()
+  };
+}
+function toGameReleaseResponse(rows, history) {
+  const releases = rows.map(toRelease);
+  const current = releases[0] ?? null;
+  return history === undefined ? { current } : { current, history: releases };
+}
+function normalizeDeploySource(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return null;
+  }
+  const raw = value;
+  const repository = nullableString(raw.repository);
+  return {
+    repository: repository === null ? null : publishableRepositoryUrl(repository),
+    commit: nullableString(raw.commit),
+    branch: nullableString(raw.branch),
+    dirty: raw.dirty === true,
+    externalBuild: raw.externalBuild === true
+  };
+}
+function nullableString(value) {
+  return typeof value === "string" && value.length > 0 ? value : null;
+}
+var init_releases_util = () => {};
+
 // ../api-core/src/services/releases.service.ts
 class ReleasesService {
   deps;
@@ -46905,9 +46950,7 @@ class ReleasesService {
       "app.releases.history_requested": history ?? 0,
       "app.releases.history_rows": rows.length
     });
-    const releases = rows.map(toRelease);
-    const current = releases[0] ?? null;
-    return history === undefined ? { current } : { current, history: releases };
+    return toGameReleaseResponse(rows, history);
   }
 }
 function releaseColumns() {
@@ -46924,36 +46967,12 @@ function listedGame() {
 function activeWorkerDeployment() {
   return and(eq(gameDeployments.isActive, true), eq(gameDeployments.target, "game"));
 }
-function toRelease(row) {
-  return {
-    slug: row.slug,
-    url: row.url,
-    source: normalizeSource(row.source),
-    deployedAt: row.deployedAt.toISOString()
-  };
-}
-function normalizeSource(value) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    return null;
-  }
-  const raw = value;
-  const repository = nullableString(raw.repository);
-  return {
-    repository: repository === null ? null : publishableRepositoryUrl(repository),
-    commit: nullableString(raw.commit),
-    branch: nullableString(raw.branch),
-    dirty: raw.dirty === true,
-    externalBuild: raw.externalBuild === true
-  };
-}
-function nullableString(value) {
-  return typeof value === "string" && value.length > 0 ? value : null;
-}
 var init_releases_service = __esm(() => {
   init_drizzle_orm();
   init_tables_index();
   init_spans();
   init_errors2();
+  init_releases_util();
 });
 
 // ../api-core/src/services/secrets.service.ts
@@ -47409,6 +47428,226 @@ var init_seed_service = __esm(() => {
   init_deployment_util();
 });
 
+// ../api-core/src/utils/game-worker-call.util.ts
+function resolveGameWorkerBaseUrl(localGameUrls, slug, deployedUrl) {
+  return (slug ? localGameUrls[slug] : undefined) ?? deployedUrl;
+}
+async function callGameWorker(url, token, options) {
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), options.timeoutMs);
+  try {
+    const response = await fetch(url, {
+      method: "GET",
+      headers: {
+        Accept: "application/json",
+        Authorization: `Bearer ${token}`
+      },
+      signal: controller.signal
+    });
+    const body2 = await response.text();
+    return {
+      ok: true,
+      response: new Response(NULL_BODY_STATUSES.has(response.status) ? null : body2, {
+        status: response.status,
+        headers: response.headers
+      })
+    };
+  } catch (error) {
+    if (error instanceof Error && error.name === "AbortError") {
+      return { ok: false, reason: "timeout", details: options.timeoutMessage };
+    }
+    return { ok: false, reason: "fetch_failed", details: errorMessage(error) };
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+var NULL_BODY_STATUSES;
+var init_game_worker_call_util = __esm(() => {
+  NULL_BODY_STATUSES = new Set([101, 204, 205, 304]);
+});
+
+// ../utils/src/skills.ts
+function normalizeSkillId(skill) {
+  return skill.trim().toLowerCase();
+}
+function normalizeSkillIds(skills2, max) {
+  const normalized = [...new Set(skills2.map(normalizeSkillId).filter((skill) => skill.length > 0))];
+  if (normalized.length === 0) {
+    return { ok: false, error: "At least one skill is required" };
+  }
+  if (normalized.length > max) {
+    return { ok: false, error: `At most ${max} skills can be requested at once` };
+  }
+  return { ok: true, skills: normalized };
+}
+
+// ../edge-play/src/game/lib/skills.ts
+function isValidIsoDate(value) {
+  if (typeof value !== "string" || !ISO_DATE_PATTERN.test(value)) {
+    return false;
+  }
+  const [year, month, day] = value.slice(0, 10).split("-").map(Number);
+  const date3 = new Date(Date.UTC(year, month - 1, day));
+  return !isNaN(Date.parse(value)) && date3.getUTCFullYear() === year && date3.getUTCMonth() === month - 1 && date3.getUTCDate() === day;
+}
+function normalizeResult(result) {
+  if (!isRecord(result)) {
+    return null;
+  }
+  if (typeof result.skill !== "string" || !STATUSES.has(result.status)) {
+    return null;
+  }
+  const status = result.status;
+  if (result.source !== undefined) {
+    if (status !== "mastered" || !MASTERY_SOURCES.has(result.source)) {
+      return null;
+    }
+  }
+  if (result.asOf !== undefined && !isValidIsoDate(result.asOf)) {
+    return null;
+  }
+  return {
+    skill: normalizeSkillId(result.skill),
+    status,
+    ...result.source === undefined ? {} : { source: result.source },
+    ...result.asOf === undefined ? {} : { asOf: result.asOf }
+  };
+}
+function validateSkillStatusResponse(value, studentId, askedSkills) {
+  if (!isRecord(value)) {
+    return null;
+  }
+  const response = value;
+  if (response.studentId !== studentId || !Array.isArray(response.results)) {
+    return null;
+  }
+  const asked = new Set(askedSkills);
+  const results = new Map;
+  for (const raw of response.results) {
+    const result = normalizeResult(raw);
+    if (!result || !asked.has(result.skill) || results.has(result.skill)) {
+      return null;
+    }
+    results.set(result.skill, result);
+  }
+  return results.size === asked.size ? results : null;
+}
+var STATUSES, MASTERY_SOURCES, ISO_DATE_PATTERN;
+var init_skills2 = __esm(() => {
+  init_src();
+  STATUSES = new Set(SKILL_STATUSES);
+  MASTERY_SOURCES = new Set(SKILL_MASTERY_SOURCES);
+  ISO_DATE_PATTERN = /^\d{4}-\d{2}-\d{2}(?:T\d{2}:\d{2}(?::\d{2}(?:\.\d{1,9})?)?(?:Z|[+-]\d{2}:\d{2}))?$/;
+});
+
+// ../api-core/src/utils/skill-status.util.ts
+function normalizeSkillStatusRequest(skills2) {
+  const normalized = normalizeSkillIds(skills2, SKILL_STATUS_MAX_SKILLS);
+  if (!normalized.ok) {
+    throw new ValidationError(normalized.error);
+  }
+  return normalized.skills;
+}
+function buildSkillStatusUrl(baseUrl, skills2) {
+  const url = new URL(SKILL_STATUS_ROUTE, baseUrl);
+  for (const skill of skills2) {
+    url.searchParams.append("skill", skill);
+  }
+  return url;
+}
+function pickSkillStatusGames(rows, requestingSlug, answeringSlug) {
+  const requestingGame = rows.find((row) => row.slug === requestingSlug);
+  const answeringGame = rows.find((row) => row.slug === answeringSlug);
+  if (!requestingGame) {
+    throw new NotFoundError("Game", requestingSlug);
+  }
+  if (!answeringGame) {
+    throw new NotFoundError("Game", answeringSlug);
+  }
+  return { requestingGame, answeringGame };
+}
+async function classifySkillStatusResponse(response, studentId, skills2) {
+  if (response.status === 404) {
+    return { supported: false, reason: "not_implemented" };
+  }
+  if (!response.ok) {
+    return { supported: false, reason: "fetch_failed" };
+  }
+  let json3;
+  try {
+    json3 = JSON.parse(await response.text());
+  } catch {
+    return { supported: false, reason: "not_implemented" };
+  }
+  const answered = validateSkillStatusResponse(json3, studentId, skills2);
+  if (!answered) {
+    return { supported: false, reason: "invalid_response" };
+  }
+  return { supported: true, results: skills2.map((skill) => answered.get(skill)) };
+}
+var init_skill_status_util = __esm(() => {
+  init_src();
+  init_skills2();
+  init_errors2();
+});
+
+// ../api-core/src/services/skill-status.service.ts
+class SkillStatusService {
+  deps;
+  constructor(deps) {
+    this.deps = deps;
+  }
+  async getStatus(input) {
+    const skills2 = normalizeSkillStatusRequest(input.skills);
+    setAttributes({
+      "app.skill_status.requesting_game": input.requestingGameSlug,
+      "app.skill_status.answering_game": input.game,
+      "app.skill_status.skill_count": skills2.length
+    });
+    const rows = await this.deps.db.select({ id: games.id, slug: games.slug }).from(games).where(inArray(games.slug, [input.requestingGameSlug, input.game]));
+    const { requestingGame, answeringGame } = pickSkillStatusGames(rows, input.requestingGameSlug, input.game);
+    const deployment = await this.deps.db.query.gameDeployments.findFirst({
+      where: activeDeploymentWhere(answeringGame.id),
+      columns: { url: true }
+    });
+    const baseUrl = resolveGameWorkerBaseUrl(this.deps.localGameUrls, answeringGame.slug, deployment?.url);
+    if (!baseUrl) {
+      return recordResult({ supported: false, reason: "no_active_deployment" });
+    }
+    const token = await this.deps.mintSkillStatusToken({
+      gameId: answeringGame.id,
+      studentId: input.studentId,
+      requestingGame
+    });
+    const call = await callGameWorker(buildSkillStatusUrl(baseUrl, skills2), token, {
+      timeoutMs: SKILL_STATUS_TIMEOUT_MS,
+      timeoutMessage: "Skill status request timed out"
+    });
+    if (!call.ok) {
+      setAttributes({ "app.skill_status.failure_details": call.details });
+      return recordResult({ supported: false, reason: call.reason });
+    }
+    setAttributes({ "app.skill_status.http_status": call.response.status });
+    return recordResult(await classifySkillStatusResponse(call.response, input.studentId, skills2));
+  }
+}
+function recordResult(result) {
+  setAttributes(result.supported ? {
+    "app.skill_status.supported": true,
+    "app.skill_status.unknown_skill_count": result.results.filter((entry) => entry.status === "unknown_skill").length
+  } : { "app.skill_status.supported": false, "app.skill_status.reason": result.reason });
+  return result;
+}
+var SKILL_STATUS_TIMEOUT_MS = 3000;
+var init_skill_status_service = __esm(() => {
+  init_drizzle_orm();
+  init_helpers_index();
+  init_tables_index();
+  init_spans();
+  init_game_worker_call_util();
+  init_skill_status_util();
+});
+
 // ../../node_modules/.bun/drizzle-zod@0.7.1+3ad0422b77d1a05b/node_modules/drizzle-zod/index.mjs
 function isColumnType(column2, columnTypes) {
   return columnTypes.includes(column2.columnType);
@@ -98258,12 +98497,6 @@ class TimebackAdminService {
       grade: integration.grade
     };
   }
-  resolveGameMetricsBaseUrl(slug2, deployedUrl) {
-    if (!slug2) {
-      return deployedUrl;
-    }
-    return this.deps.config.localGameUrls[slug2] ?? deployedUrl;
-  }
   static resolveGameMetricsUrl(baseUrl, runIds) {
     try {
       const url4 = new URL("/__playcademy/metrics", baseUrl);
@@ -98297,9 +98530,6 @@ class TimebackAdminService {
     }
     return chunks;
   }
-  static isAbortError(error88) {
-    return error88 instanceof Error && error88.name === "AbortError";
-  }
   static roundXpToTenths(value) {
     const rounded = Math.round(value * TimebackAdminService.XP_PRECISION_FACTOR) / TimebackAdminService.XP_PRECISION_FACTOR;
     return Object.is(rounded, -0) ? 0 : rounded;
@@ -98937,7 +99167,7 @@ class TimebackAdminService {
       if (enrollmentsByCourseId.size === 0) {
         throw new NotFoundError("Student enrollment", `${timebackId}:${gameId}`);
       }
-      const metricsBaseUrl = this.resolveGameMetricsBaseUrl(game2?.slug, deployment?.url);
+      const metricsBaseUrl = resolveGameWorkerBaseUrl(this.deps.config.localGameUrls, game2?.slug, deployment?.url);
       if (!metricsBaseUrl) {
         setAttributes({
           "app.timeback.metrics.supported": false,
@@ -98960,40 +99190,18 @@ class TimebackAdminService {
         };
       }
       const token = await this.deps.mintPlatformServiceToken(gameId, targetUser.id);
-      const controller = new AbortController;
-      const timeout = setTimeout(() => controller.abort(), options?.timeoutMs ?? TimebackAdminService.GAME_METRICS_FETCH_TIMEOUT_MS);
-      let response;
-      try {
-        response = await fetch(metricsUrl, {
-          method: "GET",
-          headers: {
-            Accept: "application/json",
-            Authorization: `Bearer ${token}`
-          },
-          signal: controller.signal
-        });
-      } catch (error88) {
-        const timedOut = TimebackAdminService.isAbortError(error88);
-        let details;
-        if (timedOut) {
-          details = "Game metrics request timed out";
-        } else if (error88 instanceof Error) {
-          details = error88.message;
-        } else {
-          details = String(error88);
-        }
+      const call = await callGameWorker(metricsUrl, token, {
+        timeoutMs: options?.timeoutMs ?? TimebackAdminService.GAME_METRICS_FETCH_TIMEOUT_MS,
+        timeoutMessage: "Game metrics request timed out"
+      });
+      if (!call.ok) {
         setAttributes({
           "app.timeback.metrics.supported": false,
-          "app.timeback.metrics.reason": timedOut ? "timeout" : "fetch_failed"
+          "app.timeback.metrics.reason": call.reason
         });
-        return {
-          supported: false,
-          reason: timedOut ? "timeout" : "fetch_failed",
-          details
-        };
-      } finally {
-        clearTimeout(timeout);
+        return { supported: false, reason: call.reason, details: call.details };
       }
+      const { response } = call;
       const result = await classifyGameMetricsResponse(response, { gameId, timebackId });
       setAttributes({
         "app.timeback.metrics.supported": result.supported,
@@ -99991,6 +100199,7 @@ var init_timeback_admin_service = __esm(async () => {
   init_src9();
   init_timeback3();
   init_errors2();
+  init_game_worker_call_util();
   init_timeback_admin_metrics_util();
   init_timeback_admin_util();
   init_timeback_discrepancy_queue_util();
@@ -109902,6 +110111,7 @@ function createPlatformServices(deps) {
     timebackClient,
     alerts,
     mintPlatformServiceToken,
+    mintSkillStatusToken,
     mintAssessmentPreparationReceipt,
     verifyAssessmentPreparationReceipt,
     mintAssessmentToken,
@@ -109985,6 +110195,11 @@ function createPlatformServices(deps) {
     mintAssessmentToken,
     verifyAssessmentToken
   });
+  const skillStatus = new SkillStatusService({
+    db: db2,
+    localGameUrls: config5.localGameUrls,
+    mintSkillStatusToken
+  });
   return {
     assessmentAssets,
     assessmentArtifacts,
@@ -109997,6 +110212,7 @@ function createPlatformServices(deps) {
     deploymentState,
     database,
     seed,
+    skillStatus,
     timeback: timeback2,
     timebackAdmin,
     timebackAssessmentRuntime,
@@ -110015,6 +110231,7 @@ var init_platform2 = __esm(async () => {
   init_releases_service();
   init_secrets_service();
   init_seed_service();
+  init_skill_status_service();
   init_upload_service();
   await __promiseAll([
     init_timeback_admin_service(),
@@ -110733,6 +110950,7 @@ function createServices(ctx) {
     timebackClient: timeback2,
     alerts: infra2.alerts,
     mintPlatformServiceToken: auth2.mintPlatformServiceToken.bind(auth2),
+    mintSkillStatusToken: auth2.mintSkillStatusToken.bind(auth2),
     mintAssessmentPreparationReceipt: auth2.mintAssessmentPreparationReceipt.bind(auth2),
     verifyAssessmentPreparationReceipt: auth2.verifyAssessmentPreparationReceipt.bind(auth2),
     mintAssessmentToken: auth2.mintAssessmentToken.bind(auth2),
@@ -110781,6 +110999,17 @@ function workerKeyGrantsGameRead(key, slug2) {
 function isGameWorkerKey(key) {
   return Boolean(key?.name?.startsWith(GAME_WORKER_KEY_PREFIX));
 }
+function gameWorkerKeySlug(key) {
+  if (!isGameWorkerKey(key)) {
+    return null;
+  }
+  const writes = (key?.permissions?.games ?? []).filter((scope) => scope.startsWith("write:"));
+  if (writes.length !== 1) {
+    return null;
+  }
+  const slug2 = writes[0].slice("write:".length);
+  return slug2.length > 0 ? slug2 : null;
+}
 function deniedWorkerKeyRequest(key, method, pathname) {
   if (isDashboardWorkerKey(key) && !isAllowedDashboardWorkerRequest(method, pathname, key.permissions)) {
     return DASHBOARD_WORKER_KEY_RESTRICTED;
@@ -111157,6 +111386,19 @@ var init_clients = __esm(async () => {
 });
 
 // src/infrastructure/api/providers/auth.provider.ts
+function mintSandboxServiceToken(audience, claims) {
+  const now2 = Math.floor(Date.now() / 1000);
+  const header = btoa(JSON.stringify({ alg: "none", kid: "sandbox", typ: "sandbox" }));
+  const payload = btoa(JSON.stringify({
+    iss: "playcademy-platform",
+    aud: audience,
+    ...claims,
+    iat: now2,
+    exp: now2 + 60,
+    jti: crypto.randomUUID()
+  }));
+  return `${header}.${payload}.sandbox`;
+}
 function createSandboxAuthProvider() {
   return {
     async createApiKey(params) {
@@ -111228,18 +111470,10 @@ function createSandboxAuthProvider() {
       }
     },
     async mintPlatformServiceToken(gameId, studentId) {
-      const now2 = Math.floor(Date.now() / 1000);
-      const header = btoa(JSON.stringify({ alg: "none", kid: "sandbox", typ: "sandbox" }));
-      const payload = btoa(JSON.stringify({
-        iss: "playcademy-platform",
-        aud: "playcademy-game-metrics",
-        gameId,
-        studentId,
-        iat: now2,
-        exp: now2 + 60,
-        jti: crypto.randomUUID()
-      }));
-      return `${header}.${payload}.sandbox`;
+      return mintSandboxServiceToken("playcademy-game-metrics", { gameId, studentId });
+    },
+    async mintSkillStatusToken(claims) {
+      return mintSandboxServiceToken(SKILL_STATUS_TOKEN_AUDIENCE, { ...claims });
     },
     async mintAssessmentPreparationReceipt(plan) {
       const now2 = Date.now();
@@ -111319,6 +111553,7 @@ function createSandboxAuthProvider() {
 }
 var sandboxApiKeys, sandboxAssessmentPreparationReceipts, ASSESSMENT_PREPARATION_RECEIPT_LIFETIME_MS, MAX_TOKEN_LIFETIME_SECONDS, sandboxAssessmentTokens;
 var init_auth_provider = __esm(async () => {
+  init_src();
   init_src6();
   init_constants();
   await init_dist5();
@@ -167914,6 +168149,36 @@ var init_session_controller = __esm(() => {
   });
 });
 
+// ../api-core/src/controllers/skills.controller.ts
+async function getStatus4(ctx) {
+  const requestingGameSlug = gameWorkerKeySlug(ctx.apiKey);
+  if (!requestingGameSlug) {
+    throw ApiError.forbidden("Skill status can only be requested by a deployed game worker");
+  }
+  const body2 = await parseRequestBody(ctx.request, SkillStatusRequestSchema);
+  return ctx.services.skillStatus.getStatus({ ...body2, requestingGameSlug });
+}
+async function getStatusLocally(ctx) {
+  await parseRequestBody(ctx.request, SkillStatusRequestSchema);
+  return { supported: false, reason: "no_active_deployment" };
+}
+var SkillStatusRequestSchema, skills2;
+var init_skills_controller = __esm(() => {
+  init_esm();
+  init_src();
+  init_errors2();
+  init_utils7();
+  SkillStatusRequestSchema = exports_external.object({
+    game: exports_external.string().min(1),
+    studentId: exports_external.string().min(1),
+    skills: exports_external.array(exports_external.string()).min(1).max(SKILL_STATUS_MAX_SKILLS * 2)
+  });
+  skills2 = defineControllerNames("skills", {
+    getStatus: requireAuth(getStatus4),
+    getStatusLocally: requireAuth(getStatusLocally)
+  });
+});
+
 // ../api-core/src/controllers/timeback.controller.ts
 function parseQtiLibraryParams(searchParams) {
   const requestedPage = Number(searchParams.get("page"));
@@ -168951,6 +169216,7 @@ var init_controllers = __esm(() => {
   init_secrets_controller();
   init_seed_controller();
   init_session_controller();
+  init_skills_controller();
   init_timeback_controller();
   init_upload_controller();
   init_user_controller();
@@ -169764,6 +170030,16 @@ var init_leaderboard = __esm(async () => {
   leaderboardRouter.get("/", handle2(leaderboard.getGlobalLeaderboard));
 });
 
+// src/routes/platform/skills.ts
+var skillsRouter;
+var init_skills3 = __esm(async () => {
+  init_dist7();
+  init_controllers();
+  await init_api3();
+  skillsRouter = new Hono2;
+  skillsRouter.post("/status", handle2(skills2.getStatusLocally));
+});
+
 // src/routes/integrations/timeback.ts
 function hashCode(str) {
   let hash2 = 0;
@@ -170112,6 +170388,7 @@ var exports_routes = {};
 __export(exports_routes, {
   usersRouter: () => usersRouter,
   timebackRouter: () => timebackRouter,
+  skillsRouter: () => skillsRouter,
   manifestRouter: () => manifestRouter,
   ltiRouter: () => ltiRouter,
   leaderboardRouter: () => leaderboardRouter,
@@ -170128,6 +170405,7 @@ var init_routes = __esm(async () => {
     init_users(),
     init_games2(),
     init_leaderboard(),
+    init_skills3(),
     init_timeback8(),
     init_lti()
   ]);
@@ -170143,6 +170421,7 @@ async function registerRoutes(app) {
     leaderboardRouter: leaderboardRouter2,
     ltiRouter: ltiRouter2,
     manifestRouter: manifestRouter2,
+    skillsRouter: skillsRouter2,
     timebackRouter: timebackRouter2,
     usersRouter: usersRouter2
   } = await init_routes().then(() => exports_routes);
@@ -170151,6 +170430,7 @@ async function registerRoutes(app) {
   app.route("/api/users", usersRouter2);
   app.route("/api/games", gamesRouter2);
   app.route("/api/leaderboard", leaderboardRouter2);
+  app.route("/api/skills", skillsRouter2);
   app.route("/api/dev", devRouter2);
   app.route("/api/timeback", timebackRouter2);
   app.route("/api/lti", ltiRouter2);

package/dist/constants.js

@@ -97,7 +97,17 @@ var init_platform = __esm(() => {
 });
 
 // ../constants/src/skills.ts
-var init_skills = () => {};
+var SKILL_STATUS_ROUTE = "/__playcademy/skills/status", SKILL_STATUS_TOKEN_AUDIENCE = "playcademy-game-skill-status", SKILL_STATUS_MAX_SKILLS = 50, SKILL_STATUSES, SKILL_MASTERY_SOURCES;
+var init_skills = __esm(() => {
+  SKILL_STATUSES = [
+    "locked",
+    "unlocked",
+    "in_progress",
+    "mastered",
+    "unknown_skill"
+  ];
+  SKILL_MASTERY_SOURCES = ["assessment", "placement", "test_out", "manual"];
+});
 
 // ../constants/src/system.ts
 var PLATFORM_TIMEZONE = "America/New_York";

package/dist/server.js

@@ -281,7 +281,17 @@ var init_platform = __esm(() => {
 });
 
 // ../constants/src/skills.ts
-var init_skills = () => {};
+var SKILL_STATUS_ROUTE = "/__playcademy/skills/status", SKILL_STATUS_TOKEN_AUDIENCE = "playcademy-game-skill-status", SKILL_STATUS_MAX_SKILLS = 50, SKILL_STATUSES, SKILL_MASTERY_SOURCES;
+var init_skills = __esm(() => {
+  SKILL_STATUSES = [
+    "locked",
+    "unlocked",
+    "in_progress",
+    "mastered",
+    "unknown_skill"
+  ];
+  SKILL_MASTERY_SOURCES = ["assessment", "placement", "test_out", "manual"];
+});
 
 // ../constants/src/system.ts
 var PLATFORM_TIMEZONE = "America/New_York";
@@ -1131,7 +1141,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@playcademy/sandbox",
-    version: "0.10.2-beta.1",
+    version: "0.10.2-beta.3",
     description: "Local development server for Playcademy game development",
     type: "module",
     exports: {
@@ -30008,6 +30018,23 @@ function generateDeploymentHash(code) {
 function computeDeployPayloadFingerprint(payload) {
   return sha256Hex(canonicalJson2(payload));
 }
+function toActiveDeploymentRow(record) {
+  return {
+    gameId: record.gameId,
+    deploymentId: record.deploymentId,
+    provider: "cloudflare",
+    target: record.target,
+    url: record.url,
+    codeHash: record.codeHash,
+    schemaHash: record.schemaHash ?? null,
+    schemaFingerprint: record.schemaFingerprint ?? null,
+    timeTravelBookmark: record.timeTravelBookmark ?? null,
+    bookmarkCapturedAt: record.bookmarkCapturedAt ?? null,
+    resources: record.resources,
+    isActive: true,
+    deployJobId: record.deployJobId ?? null
+  };
+}
 var GAME_WORKER_KEY_PREFIX = "game-worker-", DASHBOARD_WORKER_KEY_PREFIX = "dash-worker-";
 var init_deployment_util = __esm(() => {
   init_drizzle_orm();
@@ -37031,24 +37058,9 @@ class DeployService {
     }
   }
   async saveDeployment(record) {
-    const db2 = this.deps.db;
-    await db2.transaction(async (tx) => {
+    await this.deps.db.transaction(async (tx) => {
       await tx.update(gameDeployments).set({ isActive: false }).where(and(eq(gameDeployments.gameId, record.gameId), eq(gameDeployments.target, record.target)));
-      await tx.insert(gameDeployments).values({
-        gameId: record.gameId,
-        deploymentId: record.deploymentId,
-        provider: "cloudflare",
-        target: record.target,
-        url: record.url,
-        codeHash: record.codeHash,
-        schemaHash: record.schemaHash ?? null,
-        schemaFingerprint: record.schemaFingerprint ?? null,
-        timeTravelBookmark: record.timeTravelBookmark ?? null,
-        bookmarkCapturedAt: record.bookmarkCapturedAt ?? null,
-        resources: record.resources,
-        isActive: true,
-        deployJobId: record.deployJobId ?? null
-      });
+      await tx.insert(gameDeployments).values(toActiveDeploymentRow(record));
     });
   }
   async notifyDeploymentFailure(failure) {
@@ -46880,6 +46892,39 @@ function publishableRepositoryUrl(value) {
   return value;
 }
 
+// ../api-core/src/utils/releases.util.ts
+function toRelease(row) {
+  return {
+    slug: row.slug,
+    url: row.url,
+    source: normalizeDeploySource(row.source),
+    deployedAt: row.deployedAt.toISOString()
+  };
+}
+function toGameReleaseResponse(rows, history) {
+  const releases = rows.map(toRelease);
+  const current = releases[0] ?? null;
+  return history === undefined ? { current } : { current, history: releases };
+}
+function normalizeDeploySource(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return null;
+  }
+  const raw = value;
+  const repository = nullableString(raw.repository);
+  return {
+    repository: repository === null ? null : publishableRepositoryUrl(repository),
+    commit: nullableString(raw.commit),
+    branch: nullableString(raw.branch),
+    dirty: raw.dirty === true,
+    externalBuild: raw.externalBuild === true
+  };
+}
+function nullableString(value) {
+  return typeof value === "string" && value.length > 0 ? value : null;
+}
+var init_releases_util = () => {};
+
 // ../api-core/src/services/releases.service.ts
 class ReleasesService {
   deps;
@@ -46904,9 +46949,7 @@ class ReleasesService {
       "app.releases.history_requested": history ?? 0,
       "app.releases.history_rows": rows.length
     });
-    const releases = rows.map(toRelease);
-    const current = releases[0] ?? null;
-    return history === undefined ? { current } : { current, history: releases };
+    return toGameReleaseResponse(rows, history);
   }
 }
 function releaseColumns() {
@@ -46923,36 +46966,12 @@ function listedGame() {
 function activeWorkerDeployment() {
   return and(eq(gameDeployments.isActive, true), eq(gameDeployments.target, "game"));
 }
-function toRelease(row) {
-  return {
-    slug: row.slug,
-    url: row.url,
-    source: normalizeSource(row.source),
-    deployedAt: row.deployedAt.toISOString()
-  };
-}
-function normalizeSource(value) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    return null;
-  }
-  const raw = value;
-  const repository = nullableString(raw.repository);
-  return {
-    repository: repository === null ? null : publishableRepositoryUrl(repository),
-    commit: nullableString(raw.commit),
-    branch: nullableString(raw.branch),
-    dirty: raw.dirty === true,
-    externalBuild: raw.externalBuild === true
-  };
-}
-function nullableString(value) {
-  return typeof value === "string" && value.length > 0 ? value : null;
-}
 var init_releases_service = __esm(() => {
   init_drizzle_orm();
   init_tables_index();
   init_spans();
   init_errors2();
+  init_releases_util();
 });
 
 // ../api-core/src/services/secrets.service.ts
@@ -47408,6 +47427,226 @@ var init_seed_service = __esm(() => {
   init_deployment_util();
 });
 
+// ../api-core/src/utils/game-worker-call.util.ts
+function resolveGameWorkerBaseUrl(localGameUrls, slug, deployedUrl) {
+  return (slug ? localGameUrls[slug] : undefined) ?? deployedUrl;
+}
+async function callGameWorker(url, token, options) {
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), options.timeoutMs);
+  try {
+    const response = await fetch(url, {
+      method: "GET",
+      headers: {
+        Accept: "application/json",
+        Authorization: `Bearer ${token}`
+      },
+      signal: controller.signal
+    });
+    const body2 = await response.text();
+    return {
+      ok: true,
+      response: new Response(NULL_BODY_STATUSES.has(response.status) ? null : body2, {
+        status: response.status,
+        headers: response.headers
+      })
+    };
+  } catch (error) {
+    if (error instanceof Error && error.name === "AbortError") {
+      return { ok: false, reason: "timeout", details: options.timeoutMessage };
+    }
+    return { ok: false, reason: "fetch_failed", details: errorMessage(error) };
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+var NULL_BODY_STATUSES;
+var init_game_worker_call_util = __esm(() => {
+  NULL_BODY_STATUSES = new Set([101, 204, 205, 304]);
+});
+
+// ../utils/src/skills.ts
+function normalizeSkillId(skill) {
+  return skill.trim().toLowerCase();
+}
+function normalizeSkillIds(skills2, max) {
+  const normalized = [...new Set(skills2.map(normalizeSkillId).filter((skill) => skill.length > 0))];
+  if (normalized.length === 0) {
+    return { ok: false, error: "At least one skill is required" };
+  }
+  if (normalized.length > max) {
+    return { ok: false, error: `At most ${max} skills can be requested at once` };
+  }
+  return { ok: true, skills: normalized };
+}
+
+// ../edge-play/src/game/lib/skills.ts
+function isValidIsoDate(value) {
+  if (typeof value !== "string" || !ISO_DATE_PATTERN.test(value)) {
+    return false;
+  }
+  const [year, month, day] = value.slice(0, 10).split("-").map(Number);
+  const date3 = new Date(Date.UTC(year, month - 1, day));
+  return !isNaN(Date.parse(value)) && date3.getUTCFullYear() === year && date3.getUTCMonth() === month - 1 && date3.getUTCDate() === day;
+}
+function normalizeResult(result) {
+  if (!isRecord(result)) {
+    return null;
+  }
+  if (typeof result.skill !== "string" || !STATUSES.has(result.status)) {
+    return null;
+  }
+  const status = result.status;
+  if (result.source !== undefined) {
+    if (status !== "mastered" || !MASTERY_SOURCES.has(result.source)) {
+      return null;
+    }
+  }
+  if (result.asOf !== undefined && !isValidIsoDate(result.asOf)) {
+    return null;
+  }
+  return {
+    skill: normalizeSkillId(result.skill),
+    status,
+    ...result.source === undefined ? {} : { source: result.source },
+    ...result.asOf === undefined ? {} : { asOf: result.asOf }
+  };
+}
+function validateSkillStatusResponse(value, studentId, askedSkills) {
+  if (!isRecord(value)) {
+    return null;
+  }
+  const response = value;
+  if (response.studentId !== studentId || !Array.isArray(response.results)) {
+    return null;
+  }
+  const asked = new Set(askedSkills);
+  const results = new Map;
+  for (const raw of response.results) {
+    const result = normalizeResult(raw);
+    if (!result || !asked.has(result.skill) || results.has(result.skill)) {
+      return null;
+    }
+    results.set(result.skill, result);
+  }
+  return results.size === asked.size ? results : null;
+}
+var STATUSES, MASTERY_SOURCES, ISO_DATE_PATTERN;
+var init_skills2 = __esm(() => {
+  init_src();
+  STATUSES = new Set(SKILL_STATUSES);
+  MASTERY_SOURCES = new Set(SKILL_MASTERY_SOURCES);
+  ISO_DATE_PATTERN = /^\d{4}-\d{2}-\d{2}(?:T\d{2}:\d{2}(?::\d{2}(?:\.\d{1,9})?)?(?:Z|[+-]\d{2}:\d{2}))?$/;
+});
+
+// ../api-core/src/utils/skill-status.util.ts
+function normalizeSkillStatusRequest(skills2) {
+  const normalized = normalizeSkillIds(skills2, SKILL_STATUS_MAX_SKILLS);
+  if (!normalized.ok) {
+    throw new ValidationError(normalized.error);
+  }
+  return normalized.skills;
+}
+function buildSkillStatusUrl(baseUrl, skills2) {
+  const url = new URL(SKILL_STATUS_ROUTE, baseUrl);
+  for (const skill of skills2) {
+    url.searchParams.append("skill", skill);
+  }
+  return url;
+}
+function pickSkillStatusGames(rows, requestingSlug, answeringSlug) {
+  const requestingGame = rows.find((row) => row.slug === requestingSlug);
+  const answeringGame = rows.find((row) => row.slug === answeringSlug);
+  if (!requestingGame) {
+    throw new NotFoundError("Game", requestingSlug);
+  }
+  if (!answeringGame) {
+    throw new NotFoundError("Game", answeringSlug);
+  }
+  return { requestingGame, answeringGame };
+}
+async function classifySkillStatusResponse(response, studentId, skills2) {
+  if (response.status === 404) {
+    return { supported: false, reason: "not_implemented" };
+  }
+  if (!response.ok) {
+    return { supported: false, reason: "fetch_failed" };
+  }
+  let json3;
+  try {
+    json3 = JSON.parse(await response.text());
+  } catch {
+    return { supported: false, reason: "not_implemented" };
+  }
+  const answered = validateSkillStatusResponse(json3, studentId, skills2);
+  if (!answered) {
+    return { supported: false, reason: "invalid_response" };
+  }
+  return { supported: true, results: skills2.map((skill) => answered.get(skill)) };
+}
+var init_skill_status_util = __esm(() => {
+  init_src();
+  init_skills2();
+  init_errors2();
+});
+
+// ../api-core/src/services/skill-status.service.ts
+class SkillStatusService {
+  deps;
+  constructor(deps) {
+    this.deps = deps;
+  }
+  async getStatus(input) {
+    const skills2 = normalizeSkillStatusRequest(input.skills);
+    setAttributes({
+      "app.skill_status.requesting_game": input.requestingGameSlug,
+      "app.skill_status.answering_game": input.game,
+      "app.skill_status.skill_count": skills2.length
+    });
+    const rows = await this.deps.db.select({ id: games.id, slug: games.slug }).from(games).where(inArray(games.slug, [input.requestingGameSlug, input.game]));
+    const { requestingGame, answeringGame } = pickSkillStatusGames(rows, input.requestingGameSlug, input.game);
+    const deployment = await this.deps.db.query.gameDeployments.findFirst({
+      where: activeDeploymentWhere(answeringGame.id),
+      columns: { url: true }
+    });
+    const baseUrl = resolveGameWorkerBaseUrl(this.deps.localGameUrls, answeringGame.slug, deployment?.url);
+    if (!baseUrl) {
+      return recordResult({ supported: false, reason: "no_active_deployment" });
+    }
+    const token = await this.deps.mintSkillStatusToken({
+      gameId: answeringGame.id,
+      studentId: input.studentId,
+      requestingGame
+    });
+    const call = await callGameWorker(buildSkillStatusUrl(baseUrl, skills2), token, {
+      timeoutMs: SKILL_STATUS_TIMEOUT_MS,
+      timeoutMessage: "Skill status request timed out"
+    });
+    if (!call.ok) {
+      setAttributes({ "app.skill_status.failure_details": call.details });
+      return recordResult({ supported: false, reason: call.reason });
+    }
+    setAttributes({ "app.skill_status.http_status": call.response.status });
+    return recordResult(await classifySkillStatusResponse(call.response, input.studentId, skills2));
+  }
+}
+function recordResult(result) {
+  setAttributes(result.supported ? {
+    "app.skill_status.supported": true,
+    "app.skill_status.unknown_skill_count": result.results.filter((entry) => entry.status === "unknown_skill").length
+  } : { "app.skill_status.supported": false, "app.skill_status.reason": result.reason });
+  return result;
+}
+var SKILL_STATUS_TIMEOUT_MS = 3000;
+var init_skill_status_service = __esm(() => {
+  init_drizzle_orm();
+  init_helpers_index();
+  init_tables_index();
+  init_spans();
+  init_game_worker_call_util();
+  init_skill_status_util();
+});
+
 // ../../node_modules/.bun/drizzle-zod@0.7.1+3ad0422b77d1a05b/node_modules/drizzle-zod/index.mjs
 function isColumnType(column2, columnTypes) {
   return columnTypes.includes(column2.columnType);
@@ -98257,12 +98496,6 @@ class TimebackAdminService {
       grade: integration.grade
     };
   }
-  resolveGameMetricsBaseUrl(slug2, deployedUrl) {
-    if (!slug2) {
-      return deployedUrl;
-    }
-    return this.deps.config.localGameUrls[slug2] ?? deployedUrl;
-  }
   static resolveGameMetricsUrl(baseUrl, runIds) {
     try {
       const url4 = new URL("/__playcademy/metrics", baseUrl);
@@ -98296,9 +98529,6 @@ class TimebackAdminService {
     }
     return chunks;
   }
-  static isAbortError(error88) {
-    return error88 instanceof Error && error88.name === "AbortError";
-  }
   static roundXpToTenths(value) {
     const rounded = Math.round(value * TimebackAdminService.XP_PRECISION_FACTOR) / TimebackAdminService.XP_PRECISION_FACTOR;
     return Object.is(rounded, -0) ? 0 : rounded;
@@ -98936,7 +99166,7 @@ class TimebackAdminService {
       if (enrollmentsByCourseId.size === 0) {
         throw new NotFoundError("Student enrollment", `${timebackId}:${gameId}`);
       }
-      const metricsBaseUrl = this.resolveGameMetricsBaseUrl(game2?.slug, deployment?.url);
+      const metricsBaseUrl = resolveGameWorkerBaseUrl(this.deps.config.localGameUrls, game2?.slug, deployment?.url);
       if (!metricsBaseUrl) {
         setAttributes({
           "app.timeback.metrics.supported": false,
@@ -98959,40 +99189,18 @@ class TimebackAdminService {
         };
       }
       const token = await this.deps.mintPlatformServiceToken(gameId, targetUser.id);
-      const controller = new AbortController;
-      const timeout = setTimeout(() => controller.abort(), options?.timeoutMs ?? TimebackAdminService.GAME_METRICS_FETCH_TIMEOUT_MS);
-      let response;
-      try {
-        response = await fetch(metricsUrl, {
-          method: "GET",
-          headers: {
-            Accept: "application/json",
-            Authorization: `Bearer ${token}`
-          },
-          signal: controller.signal
-        });
-      } catch (error88) {
-        const timedOut = TimebackAdminService.isAbortError(error88);
-        let details;
-        if (timedOut) {
-          details = "Game metrics request timed out";
-        } else if (error88 instanceof Error) {
-          details = error88.message;
-        } else {
-          details = String(error88);
-        }
+      const call = await callGameWorker(metricsUrl, token, {
+        timeoutMs: options?.timeoutMs ?? TimebackAdminService.GAME_METRICS_FETCH_TIMEOUT_MS,
+        timeoutMessage: "Game metrics request timed out"
+      });
+      if (!call.ok) {
         setAttributes({
           "app.timeback.metrics.supported": false,
-          "app.timeback.metrics.reason": timedOut ? "timeout" : "fetch_failed"
+          "app.timeback.metrics.reason": call.reason
         });
-        return {
-          supported: false,
-          reason: timedOut ? "timeout" : "fetch_failed",
-          details
-        };
-      } finally {
-        clearTimeout(timeout);
+        return { supported: false, reason: call.reason, details: call.details };
       }
+      const { response } = call;
       const result = await classifyGameMetricsResponse(response, { gameId, timebackId });
       setAttributes({
         "app.timeback.metrics.supported": result.supported,
@@ -99990,6 +100198,7 @@ var init_timeback_admin_service = __esm(async () => {
   init_src9();
   init_timeback3();
   init_errors2();
+  init_game_worker_call_util();
   init_timeback_admin_metrics_util();
   init_timeback_admin_util();
   init_timeback_discrepancy_queue_util();
@@ -109901,6 +110110,7 @@ function createPlatformServices(deps) {
     timebackClient,
     alerts,
     mintPlatformServiceToken,
+    mintSkillStatusToken,
     mintAssessmentPreparationReceipt,
     verifyAssessmentPreparationReceipt,
     mintAssessmentToken,
@@ -109984,6 +110194,11 @@ function createPlatformServices(deps) {
     mintAssessmentToken,
     verifyAssessmentToken
   });
+  const skillStatus = new SkillStatusService({
+    db: db2,
+    localGameUrls: config5.localGameUrls,
+    mintSkillStatusToken
+  });
   return {
     assessmentAssets,
     assessmentArtifacts,
@@ -109996,6 +110211,7 @@ function createPlatformServices(deps) {
     deploymentState,
     database,
     seed,
+    skillStatus,
     timeback: timeback2,
     timebackAdmin,
     timebackAssessmentRuntime,
@@ -110014,6 +110230,7 @@ var init_platform2 = __esm(async () => {
   init_releases_service();
   init_secrets_service();
   init_seed_service();
+  init_skill_status_service();
   init_upload_service();
   await __promiseAll([
     init_timeback_admin_service(),
@@ -110732,6 +110949,7 @@ function createServices(ctx) {
     timebackClient: timeback2,
     alerts: infra2.alerts,
     mintPlatformServiceToken: auth2.mintPlatformServiceToken.bind(auth2),
+    mintSkillStatusToken: auth2.mintSkillStatusToken.bind(auth2),
     mintAssessmentPreparationReceipt: auth2.mintAssessmentPreparationReceipt.bind(auth2),
     verifyAssessmentPreparationReceipt: auth2.verifyAssessmentPreparationReceipt.bind(auth2),
     mintAssessmentToken: auth2.mintAssessmentToken.bind(auth2),
@@ -110780,6 +110998,17 @@ function workerKeyGrantsGameRead(key, slug2) {
 function isGameWorkerKey(key) {
   return Boolean(key?.name?.startsWith(GAME_WORKER_KEY_PREFIX));
 }
+function gameWorkerKeySlug(key) {
+  if (!isGameWorkerKey(key)) {
+    return null;
+  }
+  const writes = (key?.permissions?.games ?? []).filter((scope) => scope.startsWith("write:"));
+  if (writes.length !== 1) {
+    return null;
+  }
+  const slug2 = writes[0].slice("write:".length);
+  return slug2.length > 0 ? slug2 : null;
+}
 function deniedWorkerKeyRequest(key, method, pathname) {
   if (isDashboardWorkerKey(key) && !isAllowedDashboardWorkerRequest(method, pathname, key.permissions)) {
     return DASHBOARD_WORKER_KEY_RESTRICTED;
@@ -111156,6 +111385,19 @@ var init_clients = __esm(async () => {
 });
 
 // src/infrastructure/api/providers/auth.provider.ts
+function mintSandboxServiceToken(audience, claims) {
+  const now2 = Math.floor(Date.now() / 1000);
+  const header = btoa(JSON.stringify({ alg: "none", kid: "sandbox", typ: "sandbox" }));
+  const payload = btoa(JSON.stringify({
+    iss: "playcademy-platform",
+    aud: audience,
+    ...claims,
+    iat: now2,
+    exp: now2 + 60,
+    jti: crypto.randomUUID()
+  }));
+  return `${header}.${payload}.sandbox`;
+}
 function createSandboxAuthProvider() {
   return {
     async createApiKey(params) {
@@ -111227,18 +111469,10 @@ function createSandboxAuthProvider() {
       }
     },
     async mintPlatformServiceToken(gameId, studentId) {
-      const now2 = Math.floor(Date.now() / 1000);
-      const header = btoa(JSON.stringify({ alg: "none", kid: "sandbox", typ: "sandbox" }));
-      const payload = btoa(JSON.stringify({
-        iss: "playcademy-platform",
-        aud: "playcademy-game-metrics",
-        gameId,
-        studentId,
-        iat: now2,
-        exp: now2 + 60,
-        jti: crypto.randomUUID()
-      }));
-      return `${header}.${payload}.sandbox`;
+      return mintSandboxServiceToken("playcademy-game-metrics", { gameId, studentId });
+    },
+    async mintSkillStatusToken(claims) {
+      return mintSandboxServiceToken(SKILL_STATUS_TOKEN_AUDIENCE, { ...claims });
     },
     async mintAssessmentPreparationReceipt(plan) {
       const now2 = Date.now();
@@ -111318,6 +111552,7 @@ function createSandboxAuthProvider() {
 }
 var sandboxApiKeys, sandboxAssessmentPreparationReceipts, ASSESSMENT_PREPARATION_RECEIPT_LIFETIME_MS, MAX_TOKEN_LIFETIME_SECONDS, sandboxAssessmentTokens;
 var init_auth_provider = __esm(async () => {
+  init_src();
   init_src6();
   init_constants();
   await init_dist5();
@@ -167913,6 +168148,36 @@ var init_session_controller = __esm(() => {
   });
 });
 
+// ../api-core/src/controllers/skills.controller.ts
+async function getStatus4(ctx) {
+  const requestingGameSlug = gameWorkerKeySlug(ctx.apiKey);
+  if (!requestingGameSlug) {
+    throw ApiError.forbidden("Skill status can only be requested by a deployed game worker");
+  }
+  const body2 = await parseRequestBody(ctx.request, SkillStatusRequestSchema);
+  return ctx.services.skillStatus.getStatus({ ...body2, requestingGameSlug });
+}
+async function getStatusLocally(ctx) {
+  await parseRequestBody(ctx.request, SkillStatusRequestSchema);
+  return { supported: false, reason: "no_active_deployment" };
+}
+var SkillStatusRequestSchema, skills2;
+var init_skills_controller = __esm(() => {
+  init_esm();
+  init_src();
+  init_errors2();
+  init_utils7();
+  SkillStatusRequestSchema = exports_external.object({
+    game: exports_external.string().min(1),
+    studentId: exports_external.string().min(1),
+    skills: exports_external.array(exports_external.string()).min(1).max(SKILL_STATUS_MAX_SKILLS * 2)
+  });
+  skills2 = defineControllerNames("skills", {
+    getStatus: requireAuth(getStatus4),
+    getStatusLocally: requireAuth(getStatusLocally)
+  });
+});
+
 // ../api-core/src/controllers/timeback.controller.ts
 function parseQtiLibraryParams(searchParams) {
   const requestedPage = Number(searchParams.get("page"));
@@ -168950,6 +169215,7 @@ var init_controllers = __esm(() => {
   init_secrets_controller();
   init_seed_controller();
   init_session_controller();
+  init_skills_controller();
   init_timeback_controller();
   init_upload_controller();
   init_user_controller();
@@ -169763,6 +170029,16 @@ var init_leaderboard = __esm(async () => {
   leaderboardRouter.get("/", handle2(leaderboard.getGlobalLeaderboard));
 });
 
+// src/routes/platform/skills.ts
+var skillsRouter;
+var init_skills3 = __esm(async () => {
+  init_dist7();
+  init_controllers();
+  await init_api3();
+  skillsRouter = new Hono2;
+  skillsRouter.post("/status", handle2(skills2.getStatusLocally));
+});
+
 // src/routes/integrations/timeback.ts
 function hashCode(str) {
   let hash2 = 0;
@@ -170111,6 +170387,7 @@ var exports_routes = {};
 __export(exports_routes, {
   usersRouter: () => usersRouter,
   timebackRouter: () => timebackRouter,
+  skillsRouter: () => skillsRouter,
   manifestRouter: () => manifestRouter,
   ltiRouter: () => ltiRouter,
   leaderboardRouter: () => leaderboardRouter,
@@ -170127,6 +170404,7 @@ var init_routes = __esm(async () => {
     init_users(),
     init_games2(),
     init_leaderboard(),
+    init_skills3(),
     init_timeback8(),
     init_lti()
   ]);
@@ -170142,6 +170420,7 @@ async function registerRoutes(app) {
     leaderboardRouter: leaderboardRouter2,
     ltiRouter: ltiRouter2,
     manifestRouter: manifestRouter2,
+    skillsRouter: skillsRouter2,
     timebackRouter: timebackRouter2,
     usersRouter: usersRouter2
   } = await init_routes().then(() => exports_routes);
@@ -170150,6 +170429,7 @@ async function registerRoutes(app) {
   app.route("/api/users", usersRouter2);
   app.route("/api/games", gamesRouter2);
   app.route("/api/leaderboard", leaderboardRouter2);
+  app.route("/api/skills", skillsRouter2);
   app.route("/api/dev", devRouter2);
   app.route("/api/timeback", timebackRouter2);
   app.route("/api/lti", ltiRouter2);

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@playcademy/sandbox",
-    "version": "0.10.2-beta.1",
+    "version": "0.10.2-beta.3",
     "description": "Local development server for Playcademy game development",
     "type": "module",
     "exports": {