@playcademy/sandbox 0.3.17-beta.36 → 0.3.17-beta.38

package/dist/cli.js

@@ -339,7 +339,8 @@ var PLAYCADEMY_BASE_URLS, GAME_WORKER_DOMAINS;
 var init_domains = __esm(() => {
   PLAYCADEMY_BASE_URLS = {
     production: "https://hub.playcademy.net",
-    staging: "https://hub.dev.playcademy.net"
+    staging: "https://hub.dev.playcademy.net",
+    local: "http://localhost:5174"
   };
   GAME_WORKER_DOMAINS = {
     production: "playcademy.gg",
@@ -447,7 +448,8 @@ var WORKER_NAMING, SECRETS_PREFIX = "secrets_", CLOUDFLARE_COMPATIBILITY_DATE =
 var init_workers = __esm(() => {
   WORKER_NAMING = {
     STAGING_PREFIX: "staging-",
-    STAGING_SUFFIX: "-staging"
+    STAGING_SUFFIX: "-staging",
+    LOCAL_PREFIX: "local-"
   };
 });
 
@@ -1330,7 +1332,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@playcademy/sandbox",
-    version: "0.3.17-beta.36",
+    version: "0.3.17-beta.38",
     description: "Local development server for Playcademy game development",
     type: "module",
     exports: {
@@ -5875,21 +5877,16 @@ var init_esm = __esm(() => {
 // ../api-core/src/config/schema.ts
 function createMinimalConfig(overrides) {
   return apiConfigSchema.parse({
-    stage: "local",
-    isLocal: false,
+    sstStage: "test",
     ...overrides
   });
 }
 function getPlatformEnvironment(config2) {
-  return config2.stage === "production" ? "production" : "staging";
+  return config2.sstStage === "production" ? "production" : "staging";
 }
-function isProduction2(config2) {
-  return config2.stage === "production";
-}
-var stageSchema, ltiConfigSchema, realtimeConfigSchema, apiConfigSchema;
+var ltiConfigSchema, realtimeConfigSchema, apiConfigSchema;
 var init_schema = __esm(() => {
   init_esm();
-  stageSchema = exports_external.enum(["production", "dev", "local"]);
   ltiConfigSchema = exports_external.object({
     audience: exports_external.string(),
     jwksUrl: exports_external.string().url(),
@@ -5900,7 +5897,7 @@ var init_schema = __esm(() => {
     publishSecret: exports_external.string()
   });
   apiConfigSchema = exports_external.object({
-    stage: stageSchema,
+    sstStage: exports_external.string(),
     isLocal: exports_external.boolean().default(false),
     baseUrl: exports_external.string().url().optional(),
     gameDomain: exports_external.string().optional(),
@@ -11297,8 +11294,9 @@ var init_pg_core = __esm(() => {
 });
 
 // ../data/src/domains/game/table.ts
-var gamePlatformEnum, gameTypeEnum, gameVisibilityEnum, games, gameSessions, gameStates, deploymentProviderEnum, deployJobStatusEnum, gameDeployments, gameDeployJobs, customHostnameStatusEnum, customHostnameSslStatusEnum, customHostnameEnvironmentEnum, gameCustomHostnames;
+var gamePlatformEnum, gameTypeEnum, gameVisibilityEnum, games, gameMemberRoleEnum, gameMembers, gameMembersRelations, gameSessions, gameStates, deploymentProviderEnum, deployJobStatusEnum, gameDeployments, gameDeployJobs, customHostnameStatusEnum, customHostnameSslStatusEnum, customHostnameEnvironmentEnum, gameCustomHostnames;
 var init_table3 = __esm(() => {
+  init_drizzle_orm();
   init_pg_core();
   init_table5();
   init_table6();
@@ -11307,9 +11305,6 @@ var init_table3 = __esm(() => {
   gameVisibilityEnum = pgEnum("game_visibility", ["visible", "unlisted", "internal"]);
   games = pgTable("games", {
     id: uuid("id").primaryKey().defaultRandom(),
-    developerId: text("developer_id").references(() => users.id, {
-      onDelete: "set null"
-    }),
     slug: varchar("slug", { length: 255 }).notNull().unique(),
     displayName: varchar("display_name", { length: 255 }).notNull(),
     version: varchar("version", { length: 50 }).notNull(),
@@ -11325,6 +11320,24 @@ var init_table3 = __esm(() => {
     createdAt: timestamp("created_at", { withTimezone: true }).defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).defaultNow()
   });
+  gameMemberRoleEnum = pgEnum("game_member_role", ["owner", "collaborator"]);
+  gameMembers = pgTable("game_members", {
+    id: uuid("id").primaryKey().defaultRandom(),
+    gameId: uuid("game_id").notNull().references(() => games.id, { onDelete: "cascade" }),
+    userId: text("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+    role: gameMemberRoleEnum("role").notNull().default("collaborator"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+  }, (table3) => [uniqueIndex("game_members_game_user_idx").on(table3.gameId, table3.userId)]);
+  gameMembersRelations = relations(gameMembers, ({ one }) => ({
+    game: one(games, {
+      fields: [gameMembers.gameId],
+      references: [games.id]
+    }),
+    user: one(users, {
+      fields: [gameMembers.userId],
+      references: [users.id]
+    })
+  }));
   gameSessions = pgTable("game_sessions", {
     id: uuid("id").primaryKey().defaultRandom(),
     userId: text("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
@@ -12142,6 +12155,9 @@ __export(exports_tables_index, {
   gameScoresRelations: () => gameScoresRelations,
   gameScores: () => gameScores,
   gamePlatformEnum: () => gamePlatformEnum,
+  gameMembersRelations: () => gameMembersRelations,
+  gameMembers: () => gameMembers,
+  gameMemberRoleEnum: () => gameMemberRoleEnum,
   gameDeployments: () => gameDeployments,
   gameDeployJobs: () => gameDeployJobs,
   gameCustomHostnames: () => gameCustomHostnames,
@@ -26273,9 +26289,38 @@ var init_playcademy = __esm(() => {
   init_infra();
 });
 
+// ../utils/src/tunnel.ts
+async function getTunnelUrl() {
+  let response;
+  try {
+    response = await fetch(`${METRICS_BASE}/config`);
+  } catch {
+    throw new Error("Local tunnel is not running. Start it with `bun dev` or `bun scripts/infra/tunnel.ts`.");
+  }
+  if (!response.ok) {
+    throw new Error(`Tunnel metrics endpoint returned ${response.status}`);
+  }
+  const data = await response.json();
+  const hostname = data.config.ingress.find((r) => r.hostname)?.hostname;
+  if (!hostname) {
+    throw new Error("Tunnel is running but no hostname found in ingress config");
+  }
+  return `https://${hostname}`;
+}
+var TUNNEL_METRICS_PORT = 20241, METRICS_BASE;
+var init_tunnel = __esm(() => {
+  METRICS_BASE = `http://127.0.0.1:${TUNNEL_METRICS_PORT}`;
+});
+
 // ../api-core/src/utils/deployment.util.ts
-function getDeploymentId(gameSlug, isProduction3) {
-  return isProduction3 ? gameSlug : `${WORKER_NAMING.STAGING_PREFIX}${gameSlug}`;
+function getDeploymentId(gameSlug, sstStage) {
+  if (sstStage === "production") {
+    return gameSlug;
+  }
+  if (sstStage === "dev") {
+    return `${WORKER_NAMING.STAGING_PREFIX}${gameSlug}`;
+  }
+  return `${WORKER_NAMING.LOCAL_PREFIX}${sstStage}-${gameSlug}`;
 }
 function getGameWorkerApiKeyName(slug) {
   return `game-worker-${slug}`.substring(0, 32);
@@ -26500,8 +26545,7 @@ class DeployService {
     const game = await this.deps.validateDeveloperAccessBySlug(user, slug);
     const flags2 = this.validateDeployRequest(request, slug);
     const { hasBackend, hasFrontend } = flags2;
-    const isProd = isProduction2(this.deps.config);
-    const deploymentId = getDeploymentId(slug, isProd);
+    const deploymentId = getDeploymentId(slug, this.deps.config.sstStage);
     let frontendAssetsPath;
     let tempDir;
     if (hasFrontend) {
@@ -26515,7 +26559,15 @@ class DeployService {
       frontendAssetsPath = extracted.assetsPath;
       yield { type: "status", data: { message: "Extracting assets" } };
     }
-    const env = { GAME_ID: game.id, PLAYCADEMY_BASE_URL: this.deps.config.baseUrl };
+    let platformBaseUrl = this.deps.config.baseUrl;
+    if (this.deps.config.isLocal) {
+      try {
+        platformBaseUrl = await getTunnelUrl();
+      } catch {
+        throw new ValidationError("Local tunnel is not running. Ensure cloudflared is installed (`brew install cloudflared`) and the tunnel DevCommand started successfully.");
+      }
+    }
+    const env = { GAME_ID: game.id, PLAYCADEMY_BASE_URL: platformBaseUrl };
     yield {
       type: "status",
       data: { message: hasBackend ? "Deploying backend code" : "Deploying to platform" }
@@ -26564,14 +26616,14 @@ class DeployService {
       return;
     }
     const workerBindings = {};
-    if (bindings?.database?.length) {
-      workerBindings.d1 = bindings.database;
+    if (bindings?.database) {
+      workerBindings.d1 = [deploymentId];
     }
-    if (bindings?.keyValue?.length) {
-      workerBindings.kv = bindings.keyValue;
+    if (bindings?.keyValue) {
+      workerBindings.kv = [deploymentId];
     }
-    if (bindings?.bucket?.length) {
-      workerBindings.r2 = bindings.bucket;
+    if (bindings?.bucket) {
+      workerBindings.r2 = [deploymentId];
     }
     if (bindings?.queues) {
       let toQueueName = function(queueKey) {
@@ -26638,7 +26690,7 @@ var init_deploy_service = __esm(() => {
   init_src();
   init_tables_index();
   init_src2();
-  init_config2();
+  init_tunnel();
   init_errors();
   init_deployment_util();
   logger3 = log.scope("DeployService");
@@ -26776,29 +26828,33 @@ var init_game_service = __esm(() => {
       const db2 = this.deps.db;
       const isAdmin = caller?.role === "admin";
       const isDeveloper = caller?.role === "developer";
-      let whereClause;
       if (isAdmin) {
-        whereClause = undefined;
-      } else if (isDeveloper && caller?.id) {
-        whereClause = or(ne(games.visibility, "internal"), eq(games.developerId, caller.id));
-      } else {
-        whereClause = ne(games.visibility, "internal");
+        return db2.query.games.findMany({
+          orderBy: [desc(games.createdAt)]
+        });
+      }
+      if (isDeveloper && caller?.id) {
+        const rows = await db2.select().from(games).where(or(ne(games.visibility, "internal"), exists(db2.select({ one: sql`1` }).from(gameMembers).where(and(eq(gameMembers.gameId, games.id), eq(gameMembers.userId, caller.id)))))).orderBy(desc(games.createdAt));
+        return rows;
       }
       return db2.query.games.findMany({
-        where: whereClause,
+        where: ne(games.visibility, "internal"),
         orderBy: [desc(games.createdAt)]
       });
     }
-    async listManageable(user) {
+    async listAccessible(user) {
       const seesAllGames = user.role === "admin" || user.role === "teacher";
       if (!seesAllGames) {
         this.validateDeveloperStatus(user);
       }
       const db2 = this.deps.db;
-      return db2.query.games.findMany({
-        where: seesAllGames ? undefined : eq(games.developerId, user.id),
-        orderBy: [desc(games.createdAt)]
-      });
+      if (seesAllGames) {
+        return db2.query.games.findMany({
+          orderBy: [desc(games.createdAt)]
+        });
+      }
+      const rows = await db2.select({ games }).from(games).innerJoin(gameMembers, eq(gameMembers.gameId, games.id)).where(eq(gameMembers.userId, user.id)).orderBy(desc(games.createdAt));
+      return rows.map((r) => r.games);
     }
     async getSubjects() {
       const db2 = this.deps.db;
@@ -26822,7 +26878,7 @@ var init_game_service = __esm(() => {
       if (!game) {
         throw new NotFoundError("Game", gameId);
       }
-      this.enforceVisibility(game, caller, gameId);
+      await this.enforceVisibility(game, caller, gameId);
       return game;
     }
     async getBySlug(slug, caller) {
@@ -26833,7 +26889,7 @@ var init_game_service = __esm(() => {
       if (!game) {
         throw new NotFoundError("Game", slug);
       }
-      this.enforceVisibility(game, caller, slug);
+      await this.enforceVisibility(game, caller, slug);
       return game;
     }
     async getManifest(gameId, caller) {
@@ -26999,15 +27055,20 @@ var init_game_service = __esm(() => {
         };
       }
     }
-    enforceVisibility(game, caller, lookupIdentifier) {
+    async enforceVisibility(game, caller, lookupIdentifier) {
       if (game.visibility !== "internal") {
         return;
       }
-      const isAdmin = caller?.role === "admin";
-      const isOwner = caller?.id != null && caller.id === game.developerId;
-      if (!isAdmin && !isOwner) {
+      if (!caller) {
         throw new NotFoundError("Game", lookupIdentifier);
       }
+      if (caller.role === "admin") {
+        return;
+      }
+      if (await this.hasGameMembership(game.id, caller.id)) {
+        return;
+      }
+      throw new NotFoundError("Game", lookupIdentifier);
     }
     async upsertBySlug(slug, data, user) {
       const db2 = this.deps.db;
@@ -27044,17 +27105,24 @@ var init_game_service = __esm(() => {
           ...gameDataForDb,
           id: gameId,
           slug,
-          developerId: user.id,
           metadata: data.metadata || {},
           version: data.gameType === "external" ? "external" : "",
           deploymentUrl: null,
           createdAt: new Date
         };
-        const [createdGame] = await db2.insert(games).values(insertData).returning();
-        if (!createdGame) {
-          logger5.error("Game insert returned no rows", { slug, developerId: user.id });
-          throw new InternalError("DB insert failed to return result for new game");
-        }
+        const createdGame = await db2.transaction(async (tx) => {
+          const [game] = await tx.insert(games).values(insertData).returning();
+          if (!game) {
+            logger5.error("Game insert returned no rows", { slug, userId: user.id });
+            throw new InternalError("DB insert failed to return result for new game");
+          }
+          await tx.insert(gameMembers).values({
+            gameId: game.id,
+            userId: user.id,
+            role: "owner"
+          });
+          return game;
+        });
         gameResponse = createdGame;
       }
       if (data.mapElementId) {
@@ -27152,51 +27220,43 @@ var init_game_service = __esm(() => {
         displayName: gameToDelete.displayName
       };
     }
+    async hasGameMembership(gameId, userId) {
+      const membership = await this.deps.db.query.gameMembers.findFirst({
+        where: and(eq(gameMembers.gameId, gameId), eq(gameMembers.userId, userId)),
+        columns: { id: true }
+      });
+      return Boolean(membership);
+    }
     async validateOwnership(user, gameId) {
-      if (user.role === "admin") {
-        const gameExists = await this.deps.db.query.games.findFirst({
-          where: eq(games.id, gameId),
-          columns: { id: true }
-        });
-        if (!gameExists) {
-          throw new NotFoundError("Game", gameId);
-        }
-        return;
-      }
       const db2 = this.deps.db;
-      const gameOwnership = await db2.query.games.findFirst({
-        where: and(eq(games.id, gameId), eq(games.developerId, user.id)),
+      const gameExists = await db2.query.games.findFirst({
+        where: eq(games.id, gameId),
         columns: { id: true }
       });
-      if (!gameOwnership) {
-        const gameExists = await db2.query.games.findFirst({
-          where: eq(games.id, gameId),
-          columns: { id: true }
-        });
-        if (!gameExists) {
-          throw new NotFoundError("Game", gameId);
-        }
+      if (!gameExists) {
+        throw new NotFoundError("Game", gameId);
+      }
+      if (user.role === "admin") {
+        return;
+      }
+      if (!await this.hasGameMembership(gameId, user.id)) {
         throw new AccessDeniedError("You do not own this game");
       }
     }
     async validateDeveloperAccess(user, gameId) {
       this.validateDeveloperStatus(user);
-      if (user.role === "admin") {
-        const gameExists = await this.deps.db.query.games.findFirst({
-          where: eq(games.id, gameId),
-          columns: { id: true }
-        });
-        if (!gameExists) {
-          throw new NotFoundError("Game", gameId);
-        }
-        return;
-      }
       const db2 = this.deps.db;
-      const existingGame = await db2.query.games.findFirst({
-        where: and(eq(games.id, gameId), eq(games.developerId, user.id)),
+      const gameExists = await db2.query.games.findFirst({
+        where: eq(games.id, gameId),
         columns: { id: true }
       });
-      if (!existingGame) {
+      if (!gameExists) {
+        throw new NotFoundError("Game", gameId);
+      }
+      if (user.role === "admin") {
+        return;
+      }
+      if (!await this.hasGameMembership(gameId, user.id)) {
         throw new NotFoundError("Game", gameId);
       }
     }
@@ -27216,21 +27276,18 @@ var init_game_service = __esm(() => {
     async validateDeveloperAccessBySlug(user, slug) {
       this.validateDeveloperStatus(user);
       const db2 = this.deps.db;
-      if (user.role === "admin") {
-        const game2 = await db2.query.games.findFirst({
-          where: eq(games.slug, slug)
-        });
-        if (!game2) {
-          throw new NotFoundError("Game", slug);
-        }
-        return game2;
-      }
       const game = await db2.query.games.findFirst({
-        where: and(eq(games.slug, slug), eq(games.developerId, user.id))
+        where: eq(games.slug, slug)
       });
       if (!game) {
         throw new NotFoundError("Game", slug);
       }
+      if (user.role === "admin") {
+        return game;
+      }
+      if (!await this.hasGameMembership(game.id, user.id)) {
+        throw new NotFoundError("Game", slug);
+      }
       return game;
     }
     validateDeveloperStatus(user) {
@@ -28193,8 +28250,7 @@ class DatabaseService {
   async reset(slug, user, schema2) {
     const d1 = this.getD1();
     const game = await this.deps.validateDeveloperAccessBySlug(user, slug);
-    const isProd = isProduction2(this.deps.config);
-    const deploymentId = getDeploymentId(slug, isProd);
+    const deploymentId = getDeploymentId(slug, this.deps.config.sstStage);
     logger9.debug("Resetting database", {
       userId: user.id,
       gameId: game.id,
@@ -28270,7 +28326,6 @@ var init_database_service = __esm(() => {
   init_drizzle_orm();
   init_tables_index();
   init_src2();
-  init_config2();
   init_errors();
   init_deployment_util();
   logger9 = log.scope("DatabaseService");
@@ -28789,8 +28844,7 @@ class SecretsService {
     return this.deps.cloudflare;
   }
   getDeploymentId(slug) {
-    const isProd = isProduction2(this.deps.config);
-    return getDeploymentId(slug, isProd);
+    return getDeploymentId(slug, this.deps.config.sstStage);
   }
   async listKeys(slug, user) {
     const game = await this.deps.validateDeveloperAccessBySlug(user, slug);
@@ -28918,7 +28972,6 @@ var logger13, INTERNAL_SECRET_KEYS;
 var init_secrets_service = __esm(() => {
   init_src();
   init_src2();
-  init_config2();
   init_errors();
   init_deployment_util();
   logger13 = log.scope("SecretsService");
@@ -28970,8 +29023,7 @@ class SeedService {
   async seed(slug, code, user, secrets) {
     const cf = this.getCloudflare();
     const game = await this.deps.validateDeveloperAccessBySlug(user, slug);
-    const isProd = isProduction2(this.deps.config);
-    const deploymentId = getDeploymentId(slug, isProd);
+    const deploymentId = getDeploymentId(slug, this.deps.config.sstStage);
     const uniqueSuffix = Date.now().toString(36);
     const seedDeploymentId = `seed-${deploymentId}-${uniqueSuffix}`;
     logger14.debug("Seeding database", {
@@ -29210,7 +29262,6 @@ var init_seed_service = __esm(() => {
   init_src();
   init_setup2();
   init_src2();
-  init_config2();
   init_errors();
   init_deployment_util();
   logger14 = log.scope("SeedService");
@@ -34861,7 +34912,7 @@ class LogsService {
   constructor(deps) {
     this.deps = deps;
   }
-  async generateToken(user, slug2, environment) {
+  async generateToken(user, slug2, sstStage) {
     const db2 = this.deps.db;
     if (user.role === "admin") {
       const game = await db2.query.games.findFirst({
@@ -34871,7 +34922,7 @@ class LogsService {
       if (!game) {
         throw new NotFoundError("Game", slug2);
       }
-      logger28.info("Admin accessing game logs", { adminId: user.id, slug: slug2, environment });
+      logger28.info("Admin accessing game logs", { adminId: user.id, slug: slug2, sstStage });
     } else {
       const isApprovedDev = user.developerStatus === "approved";
       if (!isApprovedDev) {
@@ -34879,10 +34930,17 @@ class LogsService {
         throw new AccessDeniedError("Must be an approved developer");
       }
       const game = await db2.query.games.findFirst({
-        where: and(eq(games.slug, slug2), eq(games.developerId, user.id)),
+        where: eq(games.slug, slug2),
         columns: { id: true }
       });
       if (!game) {
+        throw new NotFoundError("Game", slug2);
+      }
+      const membership = await db2.query.gameMembers.findFirst({
+        where: and(eq(gameMembers.gameId, game.id), eq(gameMembers.userId, user.id)),
+        columns: { id: true }
+      });
+      if (!membership) {
         logger28.warn("Developer attempted access to unowned game logs", {
           userId: user.id,
           slug: slug2
@@ -34890,8 +34948,7 @@ class LogsService {
         throw new NotFoundError("Game", slug2);
       }
     }
-    const isProduction3 = environment === "production";
-    const workerId = getDeploymentId(slug2, isProduction3);
+    const workerId = getDeploymentId(slug2, sstStage);
     const token = await this.deps.mintLogStreamToken(user.id, workerId);
     logger28.debug("Generated log stream token", {
       userId: user.id,
@@ -35637,7 +35694,7 @@ function createServices(ctx) {
     discord,
     cloudflare,
     storage,
-    stage: config2.stage
+    stage: config2.sstStage
   });
   const player = createPlayerServices({
     db: db2,
@@ -38871,7 +38928,7 @@ var init_providers = __esm(() => {
 function buildConfig(options) {
   const baseUrl = `http://localhost:${options.port ?? 3000}`;
   return createMinimalConfig({
-    stage: "local",
+    sstStage: "sandbox",
     baseUrl,
     gameDomain: "localhost",
     uploadBucket: "sandbox-uploads",
@@ -38908,7 +38965,7 @@ function createSandboxContext(options) {
   Object.assign(services, createServices(ctx));
   cachedServiceContext = ctx;
   log.debug("[Sandbox] ServiceContext initialized", {
-    stage: config2.stage,
+    sstStage: config2.sstStage,
     baseUrl: config2.baseUrl,
     hasTimeback: Boolean(timeback2)
   });
@@ -93763,7 +93820,6 @@ async function seedCoreGames(db2) {
   const coreGames = [
     {
       id: CORE_GAME_UUIDS.PLAYGROUND,
-      developerId: DEMO_USERS.developer.id,
       slug: "playground",
       displayName: "Playground",
       version: "local",
@@ -93780,6 +93836,11 @@ async function seedCoreGames(db2) {
   for (const gameData of coreGames) {
     try {
       await db2.insert(games).values(gameData).onConflictDoNothing();
+      await db2.insert(gameMembers).values({
+        gameId: gameData.id,
+        userId: DEMO_USERS.developer.id,
+        role: "owner"
+      }).onConflictDoNothing();
     } catch (error2) {
       logger37.error(`Error seeding core game '${gameData.slug}': ${error2}`);
     }
@@ -93804,7 +93865,6 @@ async function seedCurrentProjectGame(db2, project) {
     }
     const gameRecord = {
       id: desiredGameId ?? crypto.randomUUID(),
-      developerId: DEMO_USERS.developer.id,
       slug: project.slug,
       displayName: project.displayName,
       version: project.version,
@@ -93822,6 +93882,11 @@ async function seedCurrentProjectGame(db2, project) {
     if (!newGame) {
       throw new Error("Failed to create game record");
     }
+    await db2.insert(gameMembers).values({
+      gameId: newGame.id,
+      userId: DEMO_USERS.developer.id,
+      role: "owner"
+    }).onConflictDoNothing();
     if (project.timebackCourses && project.timebackCourses.length > 0) {
       await seedTimebackIntegrations(db2, newGame.id, project.timebackCourses);
     }
@@ -94810,7 +94875,6 @@ var init_schemas2 = __esm(() => {
     id: true,
     slug: true,
     createdAt: true,
-    developerId: true,
     version: true
   }).refine((data) => {
     if (data.gameType === "hosted" && data.deploymentUrl === null) {
@@ -94903,9 +94967,9 @@ var init_schemas2 = __esm(() => {
     compatibilityDate: exports_external.string().optional(),
     compatibilityFlags: exports_external.array(exports_external.string()).optional(),
     bindings: exports_external.object({
-      database: exports_external.array(exports_external.string()).optional(),
-      keyValue: exports_external.array(exports_external.string()).optional(),
-      bucket: exports_external.array(exports_external.string()).optional(),
+      database: exports_external.union([exports_external.literal(true), exports_external.array(exports_external.string())]).optional(),
+      keyValue: exports_external.union([exports_external.literal(true), exports_external.array(exports_external.string())]).optional(),
+      bucket: exports_external.union([exports_external.literal(true), exports_external.array(exports_external.string())]).optional(),
       queues: exports_external.record(exports_external.string(), exports_external.union([
         exports_external.literal(true),
         exports_external.object({
@@ -96212,7 +96276,7 @@ var init_domain_controller = __esm(() => {
 });
 
 // ../api-core/src/controllers/game.controller.ts
-var logger48, list3, listManageable, getSubjects, getById2, getBySlug, getManifest, upsertBySlug, remove3, games2;
+var logger48, list3, listAccessible, getSubjects, getById2, getBySlug, getManifest, upsertBySlug, remove3, games2;
 var init_game_controller = __esm(() => {
   init_esm();
   init_schemas_index();
@@ -96225,9 +96289,9 @@ var init_game_controller = __esm(() => {
     logger48.debug("Listing games", { userId: ctx.user.id });
     return ctx.services.game.list(ctx.user);
   });
-  listManageable = requireNonAnonymous(async (ctx) => {
-    logger48.debug("Listing manageable games", { userId: ctx.user.id });
-    return ctx.services.game.listManageable(ctx.user);
+  listAccessible = requireNonAnonymous(async (ctx) => {
+    logger48.debug("Listing accessible games", { userId: ctx.user.id });
+    return ctx.services.game.listAccessible(ctx.user);
   });
   getSubjects = requireNonAnonymous(async (ctx) => {
     logger48.debug("Getting game subjects", { userId: ctx.user.id });
@@ -96300,7 +96364,7 @@ var init_game_controller = __esm(() => {
   });
   games2 = {
     list: list3,
-    listManageable,
+    listAccessible,
     getSubjects,
     getById: getById2,
     getManifest,
@@ -96876,8 +96940,8 @@ var init_logs_controller = __esm(() => {
     let body2;
     try {
       const json4 = await ctx.request.json();
-      if (json4.environment !== "staging" && json4.environment !== "production") {
-        throw ApiError.badRequest('Invalid environment. Must be "staging" or "production".');
+      if (json4.environment !== "local" && json4.environment !== "staging" && json4.environment !== "production") {
+        throw ApiError.badRequest('Invalid environment. Must be "local", "staging", or "production".');
       }
       body2 = json4;
     } catch (error2) {
@@ -96891,7 +96955,13 @@ var init_logs_controller = __esm(() => {
       slug: slug2,
       environment: body2.environment
     });
-    return ctx.services.logs.generateToken(ctx.user, slug2, body2.environment);
+    const envToSstStage = {
+      local: ctx.config.sstStage,
+      staging: "dev",
+      production: "production"
+    };
+    const sstStage = envToSstStage[body2.environment] ?? "dev";
+    return ctx.services.logs.generateToken(ctx.user, slug2, sstStage);
   });
   logs = {
     generateToken
@@ -97243,6 +97313,7 @@ var init_seed_controller = __esm(() => {
 var logger61, start2, end, mintToken, sessions2;
 var init_session_controller = __esm(() => {
   init_src2();
+  init_tunnel();
   init_errors();
   init_utils11();
   logger61 = log.scope("SessionController");
@@ -97277,7 +97348,14 @@ var init_session_controller = __esm(() => {
       throw ApiError.badRequest("Missing game ID or slug");
     }
     logger61.debug("Minting token", { userId: ctx.user.id, gameIdOrSlug, launchId: ctx.launchId });
-    return ctx.services.session.mintToken(gameIdOrSlug, ctx.user.id);
+    const { token, exp } = await ctx.services.session.mintToken(gameIdOrSlug, ctx.user.id);
+    let baseUrl;
+    if (ctx.config.isLocal) {
+      try {
+        baseUrl = await getTunnelUrl();
+      } catch {}
+    }
+    return { token, exp, baseUrl };
   });
   sessions2 = {
     start: start2,
@@ -98421,6 +98499,7 @@ var init_crud = __esm(() => {
   init_api();
   gameCrudRouter = new Hono2;
   gameCrudRouter.get("/", handle2(games2.list));
+  gameCrudRouter.get("/accessible", handle2(games2.listAccessible));
   gameCrudRouter.get("/:gameId{[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}}/manifest", handle2(games2.getManifest));
   gameCrudRouter.get("/:gameId{[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}}", handle2(games2.getById));
   gameCrudRouter.get("/:slug", handle2(games2.getBySlug));
@@ -98563,10 +98642,12 @@ var init_deploy = __esm(() => {
     const db2 = ctx.db;
     const existingGames = await db2.select().from(games).where(eq(games.slug, slug2));
     const existingGame = existingGames[0];
-    if (existingGame) {
-      const isAdmin = user.role === "admin";
-      const isOwner = existingGame.developerId === user.id;
-      if (!isAdmin && !isOwner) {
+    if (existingGame && user.role !== "admin") {
+      const membership = await db2.query.gameMembers.findFirst({
+        where: and(eq(gameMembers.gameId, existingGame.id), eq(gameMembers.userId, user.id)),
+        columns: { id: true }
+      });
+      if (!membership) {
         return c2.json({
           error: {
             code: "FORBIDDEN",
@@ -98590,17 +98671,24 @@ var init_deploy = __esm(() => {
       if (!body2.metadata?.displayName) {
         return c2.json({ error: { code: "BAD_REQUEST", message: "Display name required for new game" } }, 400);
       }
-      const inserted = await db2.insert(games).values({
+      const gameValues = {
         slug: slug2,
         displayName: body2.metadata.displayName,
         version: "1.0.0",
         platform: body2.metadata.platform ?? "web",
         gameType: "hosted",
-        developerId: user.id,
         deploymentUrl: `http://localhost:4321`,
         metadata: body2.metadata.metadata ?? {}
-      }).returning();
-      game = inserted[0];
+      };
+      game = await db2.transaction(async (tx) => {
+        const [inserted] = await tx.insert(games).values(gameValues).returning();
+        await tx.insert(gameMembers).values({
+          gameId: inserted.id,
+          userId: user.id,
+          role: "owner"
+        });
+        return inserted;
+      });
     }
     let backendCode = body2.code;
     if (!backendCode && body2.codeUploadToken) {
@@ -98679,13 +98767,19 @@ var init_deploy = __esm(() => {
     const ctx = getSandboxContext();
     const game = await ctx.db.query.games.findFirst({
       where: eq(games.slug, slug2 ?? ""),
-      columns: { id: true, developerId: true }
+      columns: { id: true }
     });
     if (!game) {
       return c2.json({ error: { code: "NOT_FOUND", message: "Game not found" } }, 404);
     }
-    if (game.developerId !== user.id && user.role !== "admin") {
-      return c2.json({ error: { code: "NOT_FOUND", message: "Game not found" } }, 404);
+    if (user.role !== "admin") {
+      const membership = await ctx.db.query.gameMembers.findFirst({
+        where: and(eq(gameMembers.gameId, game.id), eq(gameMembers.userId, user.id)),
+        columns: { id: true }
+      });
+      if (!membership) {
+        return c2.json({ error: { code: "NOT_FOUND", message: "Game not found" } }, 404);
+      }
     }
     const job = await ctx.db.query.gameDeployJobs.findFirst({
       where: and(eq(gameDeployJobs.id, jobId), eq(gameDeployJobs.gameId, game.id))