@playcademy/sandbox 0.12.2-beta.5 → 0.12.2-beta.7

package/dist/cli.js

@@ -2517,7 +2517,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@playcademy/sandbox",
-    version: "0.12.2-beta.5",
+    version: "0.12.2-beta.7",
     description: "Local development server for Playcademy game development",
     type: "module",
     exports: {
@@ -20895,21 +20895,25 @@ var init_table7 = __esm(() => {
 });
 
 // ../data/src/domains/embed/table.ts
-var embedPartners, embedLaunches, embedLaunchesRelations;
+var embedContextRoleEnum, embedPartners, embedLaunches, embedLaunchesRelations;
 var init_table8 = __esm(() => {
   init_drizzle_orm();
   init_pg_core();
   init_table5();
   init_table3();
+  embedContextRoleEnum = pgEnum("embed_context_role", ["host"]);
   embedPartners = pgTable("embed_partners", {
     id: uuid("id").primaryKey().defaultRandom(),
     name: text("name").notNull(),
     clientId: text("client_id").notNull().unique(),
+    handle: text("handle").unique(),
     allowedOrigins: text("allowed_origins").array().notNull().default([]),
     enabled: boolean("enabled").notNull().default(true),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
-  });
+  }, (table) => [
+    check("embed_partners_handle_check", sql`${table.handle} ~ '^[a-z0-9]([a-z0-9-]*[a-z0-9])?([.][a-z0-9]([a-z0-9-]*[a-z0-9])?)+$'`)
+  ]);
   embedLaunches = pgTable("embed_launches", {
     id: uuid("id").primaryKey().defaultRandom(),
     partnerId: uuid("partner_id").notNull().references(() => embedPartners.id, { onDelete: "restrict" }),
@@ -20918,6 +20922,8 @@ var init_table8 = __esm(() => {
     parentOrigin: text("parent_origin").notNull(),
     timebackCourseId: text("timeback_course_id"),
     contextId: text("context_id"),
+    contextRole: embedContextRoleEnum("context_role"),
+    contextAttributes: jsonb("context_attributes").$type(),
     passHash: text("pass_hash").unique(),
     passExpiresAt: timestamp("pass_expires_at", { withTimezone: true }).notNull(),
     redeemedAt: timestamp("redeemed_at", { withTimezone: true }),
@@ -20957,6 +20963,7 @@ __export(exports_tables_index, {
   deploymentProviderEnum: () => deploymentProviderEnum,
   deploymentTargetEnum: () => deploymentTargetEnum,
   developerStatusEnum: () => developerStatusEnum,
+  embedContextRoleEnum: () => embedContextRoleEnum,
   embedLaunches: () => embedLaunches,
   embedLaunchesRelations: () => embedLaunchesRelations,
   embedPartners: () => embedPartners,
@@ -50824,16 +50831,29 @@ function isCanonicalOrigin(value) {
   }
   return url.protocol === "https:" || url.protocol === "http:" && isLocalHostname(url.hostname);
 }
-var LOCAL_HOSTNAMES, EmbedOriginSchema, EmbedContextIdSchema, EmbedPartnerClientIdSchema, EnsureEmbedPartnerSchema, AddEmbedPartnerOriginSchema, CreateEmbedLaunchSchema, RedeemEmbedPassSchema;
+var LOCAL_HOSTNAMES, EmbedOriginSchema, EmbedContextIdSchema, MAX_CONTEXT_ATTRIBUTES = 10, EmbedContextAttributesSchema, EmbedContextSchema, EmbedPartnerClientIdSchema, EnsureEmbedPartnerSchema, AddEmbedPartnerOriginSchema, CreateEmbedLaunchSchema, RedeemEmbedPassSchema;
 var init_schemas5 = __esm(() => {
   init_esm();
+  init_table8();
   LOCAL_HOSTNAMES = new Set(["localhost", "127.0.0.1"]);
   EmbedOriginSchema = stringType().refine(isCanonicalOrigin, {
     message: "Origin must be a bare https origin like https://example.com, with no path or slash"
   });
   EmbedContextIdSchema = stringType().regex(/^[A-Za-z0-9._~-]{1,128}$/, {
-    message: "contextId must be 1-128 URL-safe characters (letters, digits, . _ ~ -)"
-  });
+    message: "context.id must be 1-128 URL-safe characters (letters, digits, . _ ~ -)"
+  });
+  EmbedContextAttributesSchema = recordType(stringType().regex(/^[A-Za-z][A-Za-z0-9_]{0,39}$/, {
+    message: "context.attributes keys must be 1-40 characters: a letter, then letters, digits or _"
+  }), stringType().regex(/^[A-Za-z0-9._~-]{1,100}$/, {
+    message: "context.attributes values must be 1-100 URL-safe characters (letters, digits, . _ ~ -)"
+  })).refine((attributes) => Object.keys(attributes).length <= MAX_CONTEXT_ATTRIBUTES, {
+    message: `context.attributes takes at most ${MAX_CONTEXT_ATTRIBUTES} keys`
+  });
+  EmbedContextSchema = objectType({
+    id: EmbedContextIdSchema,
+    role: enumType(embedContextRoleEnum.enumValues).optional(),
+    attributes: EmbedContextAttributesSchema.optional()
+  }).strict();
   EmbedPartnerClientIdSchema = stringType().trim().min(1).max(200);
   EnsureEmbedPartnerSchema = objectType({
     name: stringType().trim().min(1).max(100)
@@ -50846,7 +50866,7 @@ var init_schemas5 = __esm(() => {
     gameSlug: stringType().trim().min(1).max(100),
     parentOrigin: EmbedOriginSchema,
     timebackCourseId: stringType().trim().min(1).max(200).optional(),
-    contextId: EmbedContextIdSchema.optional()
+    context: EmbedContextSchema.optional()
   }).strict();
   RedeemEmbedPassSchema = objectType({
     pass: stringType().min(1).max(200),
@@ -95691,8 +95711,18 @@ var init_embed_util = __esm(() => {
 async function scopedContextId(partnerId, contextId) {
   return sha256Hex(`${partnerId}:${contextId}`);
 }
-function launchTokenClaims(launch) {
-  return launch.contextId ? { contextId: launch.contextId } : {};
+function launchTokenClaims(launch, partner) {
+  if (!launch.contextId) {
+    return {};
+  }
+  return {
+    context: {
+      id: launch.contextId,
+      ...launch.contextRole && { role: launch.contextRole },
+      ...launch.contextAttributes && { attributes: launch.contextAttributes },
+      ...partner.handle && { partner: partner.handle }
+    }
+  };
 }
 
 class EmbedService {
@@ -95738,7 +95768,9 @@ class EmbedService {
       gameId: game.id,
       parentOrigin: input.parentOrigin,
       timebackCourseId: input.timebackCourseId ?? null,
-      contextId: input.contextId ? await scopedContextId(partner.id, input.contextId) : null,
+      contextId: input.context ? await scopedContextId(partner.id, input.context.id) : null,
+      contextRole: input.context?.role ?? null,
+      contextAttributes: input.context?.attributes ?? null,
       passHash: await sha256Hex(pass),
       passExpiresAt,
       expiresAt: new Date(now + EMBED_LAUNCH_TTL_MS)
@@ -95749,12 +95781,16 @@ class EmbedService {
     setAttributes({
       "app.launch.id": launch.id,
       "app.user.id": user.id,
-      "app.embed.has_context": input.contextId !== undefined
+      "app.embed.has_context": input.context !== undefined,
+      ...input.context?.role && { "app.embed.context_role": input.context.role },
+      ...input.context?.attributes && {
+        "app.embed.context_attribute_keys": Object.keys(input.context.attributes).toSorted()
+      }
     });
     return { launchId: launch.id, pass, passExpiresAt, gameSlug: game.slug };
   }
   async redeemLaunch(input, timeZone) {
-    const launch = await this.consumePass(input);
+    const { launch, partner } = await this.consumePass(input);
     try {
       const user = await this.deps.db.query.users.findFirst({
         where: eq(users.id, launch.userId)
@@ -95765,7 +95801,7 @@ class EmbedService {
       const [game, profile, token] = await Promise.all([
         this.deps.getGameForStudent(launch.gameId, user),
         this.deps.getGameProfile(user, launch.gameId, timeZone),
-        this.deps.mintGameToken(launch.gameId, user.id, launchTokenClaims(launch))
+        this.deps.mintGameToken(launch.gameId, user.id, launchTokenClaims(launch, partner))
       ]);
       await this.deps.db.update(embedLaunches).set({ redeemedAt: new Date }).where(eq(embedLaunches.id, launch.id));
       return {
@@ -95797,7 +95833,7 @@ class EmbedService {
     if (outcome) {
       throw new AccessDeniedError("This launch has ended");
     }
-    return this.deps.mintGameToken(launch.gameId, launch.userId, launchTokenClaims(launch));
+    return this.deps.mintGameToken(launch.gameId, launch.userId, launchTokenClaims(launch, partner));
   }
   async endLaunch(launchId) {
     await this.deps.db.update(embedLaunches).set({ endedAt: sql`coalesce(${embedLaunches.endedAt}, now())`, passHash: null }).where(eq(embedLaunches.id, launchId));
@@ -95817,18 +95853,17 @@ class EmbedService {
     });
     const partner = await this.deps.db.query.embedPartners.findFirst({
       where: eq(embedPartners.id, launch.partnerId),
-      columns: { enabled: true, allowedOrigins: true }
+      columns: { enabled: true, allowedOrigins: true, handle: true }
     });
     const originMatches = launch.parentOrigin === input.parentOrigin;
-    const stillAllowed = partner !== undefined && canPartnerLaunch(partner, launch.parentOrigin);
-    if (!originMatches || !stillAllowed) {
+    if (!originMatches || !partner || !canPartnerLaunch(partner, launch.parentOrigin)) {
       await this.endLaunch(launch.id);
       setAttributes({
         "app.embed.outcome": originMatches ? "partner_disallowed" : "origin_mismatch"
       });
       throw new UnauthorizedError("This launch pass is not valid");
     }
-    return launch;
+    return { launch, partner };
   }
 }
 function renewalRefusal(launch, isAllowed) {

package/dist/server.js

@@ -697,7 +697,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@playcademy/sandbox",
-    version: "0.12.2-beta.5",
+    version: "0.12.2-beta.7",
     description: "Local development server for Playcademy game development",
     type: "module",
     exports: {
@@ -19075,21 +19075,25 @@ var init_table7 = __esm(() => {
 });
 
 // ../data/src/domains/embed/table.ts
-var embedPartners, embedLaunches, embedLaunchesRelations;
+var embedContextRoleEnum, embedPartners, embedLaunches, embedLaunchesRelations;
 var init_table8 = __esm(() => {
   init_drizzle_orm();
   init_pg_core();
   init_table5();
   init_table3();
+  embedContextRoleEnum = pgEnum("embed_context_role", ["host"]);
   embedPartners = pgTable("embed_partners", {
     id: uuid("id").primaryKey().defaultRandom(),
     name: text("name").notNull(),
     clientId: text("client_id").notNull().unique(),
+    handle: text("handle").unique(),
     allowedOrigins: text("allowed_origins").array().notNull().default([]),
     enabled: boolean("enabled").notNull().default(true),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
-  });
+  }, (table) => [
+    check("embed_partners_handle_check", sql`${table.handle} ~ '^[a-z0-9]([a-z0-9-]*[a-z0-9])?([.][a-z0-9]([a-z0-9-]*[a-z0-9])?)+$'`)
+  ]);
   embedLaunches = pgTable("embed_launches", {
     id: uuid("id").primaryKey().defaultRandom(),
     partnerId: uuid("partner_id").notNull().references(() => embedPartners.id, { onDelete: "restrict" }),
@@ -19098,6 +19102,8 @@ var init_table8 = __esm(() => {
     parentOrigin: text("parent_origin").notNull(),
     timebackCourseId: text("timeback_course_id"),
     contextId: text("context_id"),
+    contextRole: embedContextRoleEnum("context_role"),
+    contextAttributes: jsonb("context_attributes").$type(),
     passHash: text("pass_hash").unique(),
     passExpiresAt: timestamp("pass_expires_at", { withTimezone: true }).notNull(),
     redeemedAt: timestamp("redeemed_at", { withTimezone: true }),
@@ -19137,6 +19143,7 @@ __export(exports_tables_index, {
   deploymentProviderEnum: () => deploymentProviderEnum,
   deploymentTargetEnum: () => deploymentTargetEnum,
   developerStatusEnum: () => developerStatusEnum,
+  embedContextRoleEnum: () => embedContextRoleEnum,
   embedLaunches: () => embedLaunches,
   embedLaunchesRelations: () => embedLaunchesRelations,
   embedPartners: () => embedPartners,
@@ -49004,16 +49011,29 @@ function isCanonicalOrigin(value) {
   }
   return url.protocol === "https:" || url.protocol === "http:" && isLocalHostname(url.hostname);
 }
-var LOCAL_HOSTNAMES, EmbedOriginSchema, EmbedContextIdSchema, EmbedPartnerClientIdSchema, EnsureEmbedPartnerSchema, AddEmbedPartnerOriginSchema, CreateEmbedLaunchSchema, RedeemEmbedPassSchema;
+var LOCAL_HOSTNAMES, EmbedOriginSchema, EmbedContextIdSchema, MAX_CONTEXT_ATTRIBUTES = 10, EmbedContextAttributesSchema, EmbedContextSchema, EmbedPartnerClientIdSchema, EnsureEmbedPartnerSchema, AddEmbedPartnerOriginSchema, CreateEmbedLaunchSchema, RedeemEmbedPassSchema;
 var init_schemas5 = __esm(() => {
   init_esm();
+  init_table8();
   LOCAL_HOSTNAMES = new Set(["localhost", "127.0.0.1"]);
   EmbedOriginSchema = stringType().refine(isCanonicalOrigin, {
     message: "Origin must be a bare https origin like https://example.com, with no path or slash"
   });
   EmbedContextIdSchema = stringType().regex(/^[A-Za-z0-9._~-]{1,128}$/, {
-    message: "contextId must be 1-128 URL-safe characters (letters, digits, . _ ~ -)"
-  });
+    message: "context.id must be 1-128 URL-safe characters (letters, digits, . _ ~ -)"
+  });
+  EmbedContextAttributesSchema = recordType(stringType().regex(/^[A-Za-z][A-Za-z0-9_]{0,39}$/, {
+    message: "context.attributes keys must be 1-40 characters: a letter, then letters, digits or _"
+  }), stringType().regex(/^[A-Za-z0-9._~-]{1,100}$/, {
+    message: "context.attributes values must be 1-100 URL-safe characters (letters, digits, . _ ~ -)"
+  })).refine((attributes) => Object.keys(attributes).length <= MAX_CONTEXT_ATTRIBUTES, {
+    message: `context.attributes takes at most ${MAX_CONTEXT_ATTRIBUTES} keys`
+  });
+  EmbedContextSchema = objectType({
+    id: EmbedContextIdSchema,
+    role: enumType(embedContextRoleEnum.enumValues).optional(),
+    attributes: EmbedContextAttributesSchema.optional()
+  }).strict();
   EmbedPartnerClientIdSchema = stringType().trim().min(1).max(200);
   EnsureEmbedPartnerSchema = objectType({
     name: stringType().trim().min(1).max(100)
@@ -49026,7 +49046,7 @@ var init_schemas5 = __esm(() => {
     gameSlug: stringType().trim().min(1).max(100),
     parentOrigin: EmbedOriginSchema,
     timebackCourseId: stringType().trim().min(1).max(200).optional(),
-    contextId: EmbedContextIdSchema.optional()
+    context: EmbedContextSchema.optional()
   }).strict();
   RedeemEmbedPassSchema = objectType({
     pass: stringType().min(1).max(200),
@@ -93871,8 +93891,18 @@ var init_embed_util = __esm(() => {
 async function scopedContextId(partnerId, contextId) {
   return sha256Hex(`${partnerId}:${contextId}`);
 }
-function launchTokenClaims(launch) {
-  return launch.contextId ? { contextId: launch.contextId } : {};
+function launchTokenClaims(launch, partner) {
+  if (!launch.contextId) {
+    return {};
+  }
+  return {
+    context: {
+      id: launch.contextId,
+      ...launch.contextRole && { role: launch.contextRole },
+      ...launch.contextAttributes && { attributes: launch.contextAttributes },
+      ...partner.handle && { partner: partner.handle }
+    }
+  };
 }
 
 class EmbedService {
@@ -93918,7 +93948,9 @@ class EmbedService {
       gameId: game.id,
       parentOrigin: input.parentOrigin,
       timebackCourseId: input.timebackCourseId ?? null,
-      contextId: input.contextId ? await scopedContextId(partner.id, input.contextId) : null,
+      contextId: input.context ? await scopedContextId(partner.id, input.context.id) : null,
+      contextRole: input.context?.role ?? null,
+      contextAttributes: input.context?.attributes ?? null,
       passHash: await sha256Hex(pass),
       passExpiresAt,
       expiresAt: new Date(now + EMBED_LAUNCH_TTL_MS)
@@ -93929,12 +93961,16 @@ class EmbedService {
     setAttributes({
       "app.launch.id": launch.id,
       "app.user.id": user.id,
-      "app.embed.has_context": input.contextId !== undefined
+      "app.embed.has_context": input.context !== undefined,
+      ...input.context?.role && { "app.embed.context_role": input.context.role },
+      ...input.context?.attributes && {
+        "app.embed.context_attribute_keys": Object.keys(input.context.attributes).toSorted()
+      }
     });
     return { launchId: launch.id, pass, passExpiresAt, gameSlug: game.slug };
   }
   async redeemLaunch(input, timeZone) {
-    const launch = await this.consumePass(input);
+    const { launch, partner } = await this.consumePass(input);
     try {
       const user = await this.deps.db.query.users.findFirst({
         where: eq(users.id, launch.userId)
@@ -93945,7 +93981,7 @@ class EmbedService {
       const [game, profile, token] = await Promise.all([
         this.deps.getGameForStudent(launch.gameId, user),
         this.deps.getGameProfile(user, launch.gameId, timeZone),
-        this.deps.mintGameToken(launch.gameId, user.id, launchTokenClaims(launch))
+        this.deps.mintGameToken(launch.gameId, user.id, launchTokenClaims(launch, partner))
       ]);
       await this.deps.db.update(embedLaunches).set({ redeemedAt: new Date }).where(eq(embedLaunches.id, launch.id));
       return {
@@ -93977,7 +94013,7 @@ class EmbedService {
     if (outcome) {
       throw new AccessDeniedError("This launch has ended");
     }
-    return this.deps.mintGameToken(launch.gameId, launch.userId, launchTokenClaims(launch));
+    return this.deps.mintGameToken(launch.gameId, launch.userId, launchTokenClaims(launch, partner));
   }
   async endLaunch(launchId) {
     await this.deps.db.update(embedLaunches).set({ endedAt: sql`coalesce(${embedLaunches.endedAt}, now())`, passHash: null }).where(eq(embedLaunches.id, launchId));
@@ -93997,18 +94033,17 @@ class EmbedService {
     });
     const partner = await this.deps.db.query.embedPartners.findFirst({
       where: eq(embedPartners.id, launch.partnerId),
-      columns: { enabled: true, allowedOrigins: true }
+      columns: { enabled: true, allowedOrigins: true, handle: true }
     });
     const originMatches = launch.parentOrigin === input.parentOrigin;
-    const stillAllowed = partner !== undefined && canPartnerLaunch(partner, launch.parentOrigin);
-    if (!originMatches || !stillAllowed) {
+    if (!originMatches || !partner || !canPartnerLaunch(partner, launch.parentOrigin)) {
       await this.endLaunch(launch.id);
       setAttributes({
         "app.embed.outcome": originMatches ? "partner_disallowed" : "origin_mismatch"
       });
       throw new UnauthorizedError("This launch pass is not valid");
     }
-    return launch;
+    return { launch, partner };
   }
 }
 function renewalRefusal(launch, isAllowed) {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@playcademy/sandbox",
-    "version": "0.12.2-beta.5",
+    "version": "0.12.2-beta.7",
     "description": "Local development server for Playcademy game development",
     "type": "module",
     "exports": {