@playcademy/sandbox 0.5.1-beta.4 → 0.5.1-beta.6

package/dist/cli.js

@@ -979,10 +979,10 @@ var init_dist = __esm(() => {
 // ../utils/src/port.ts
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { createServer } from "node:net";
-import { homedir } from "node:os";
+import * as os from "node:os";
 import { join } from "node:path";
 function getRegistryPath() {
-  const home = homedir();
+  const home = os.homedir();
   const dir = join(home, ".playcademy");
   if (!existsSync(dir)) {
     mkdirSync(dir, { recursive: true });
@@ -1078,7 +1078,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@playcademy/sandbox",
-    version: "0.5.1-beta.4",
+    version: "0.5.1-beta.6",
     description: "Local development server for Playcademy game development",
     type: "module",
     exports: {
@@ -22505,7 +22505,6 @@ class DeployJobService {
         "app.deploy_job.outcome": "succeeded",
         "app.deploy_job.run_duration_ms": DeployJobService.elapsedMsSince(new Date(runStartedAt))
       });
-      await this.deps.cache.refreshGameOrigins().catch(catchAttrs("deploy_job.cache_refresh"));
       await this.deleteCodeBundle(jobId);
     } catch (error) {
       clearInterval(heartbeat);
@@ -26423,7 +26422,7 @@ ${file}:${line3}:${column2}: ERROR: ${pluginText}${e.text}`;
     return result;
   }
   var fs2 = __require("fs");
-  var os = __require("os");
+  var os2 = __require("os");
   var path = __require("path");
   var ESBUILD_BINARY_PATH = process.env.ESBUILD_BINARY_PATH || ESBUILD_BINARY_PATH;
   var isValidBinaryPath = (x) => !!x && x !== "/usr/bin/esbuild";
@@ -26465,7 +26464,7 @@ ${file}:${line3}:${column2}: ERROR: ${pluginText}${e.text}`;
     let pkg;
     let subpath;
     let isWASM = false;
-    let platformKey = `${process.platform} ${os.arch()} ${os.endianness()}`;
+    let platformKey = `${process.platform} ${os2.arch()} ${os2.endianness()}`;
     if (platformKey in knownWindowsPackages) {
       pkg = knownWindowsPackages[platformKey];
       subpath = "esbuild.exe";
@@ -26608,7 +26607,7 @@ for your current platform.`);
   var crypto3 = __require("crypto");
   var path2 = __require("path");
   var fs22 = __require("fs");
-  var os2 = __require("os");
+  var os22 = __require("os");
   var tty = __require("tty");
   var worker_threads;
   if (process.env.ESBUILD_WORKER_THREADS !== "0") {
@@ -26919,7 +26918,7 @@ More information: The file containing the code for esbuild's JavaScript API (${_
     afterClose(null);
   };
   var randomFileName = () => {
-    return path2.join(os2.tmpdir(), `esbuild-${crypto3.randomBytes(32).toString("hex")}`);
+    return path2.join(os22.tmpdir(), `esbuild-${crypto3.randomBytes(32).toString("hex")}`);
   };
   var workerThreadService = null;
   var startWorkerThreadService = (worker_threads2) => {
@@ -27181,7 +27180,8 @@ class DeployService {
       expiresIn: null,
       permissions: {
         games: [`read:${slug}`, `write:${slug}`]
-      }
+      },
+      rateLimitEnabled: false
     });
     setAttribute("app.deploy.api_key_outcome", "created");
     return apiKey;
@@ -27242,9 +27242,9 @@ class DeployService {
       throw new ValidationError("Uploaded file is empty or not found");
     }
     setAttribute("app.deploy.asset_upload_size", frontendZip.length);
-    const os = await import("os");
+    const os2 = await import("os");
     const path = await import("path");
-    const tempDir = path.join(os.tmpdir(), `playcademy-deploy-${gameId}-${Date.now()}`);
+    const tempDir = path.join(os2.tmpdir(), `playcademy-deploy-${gameId}-${Date.now()}`);
     const assetsPath = path.join(tempDir, "dist");
     await withSpan("deploy.extract_assets", () => extractZip(frontendZip, assetsPath));
     uploadDeps.deleteObject(uploadToken).catch(catchAttrs("deploy.temp_cleanup"));
@@ -27857,6 +27857,31 @@ var init_game_service = __esm(() => {
     static changedFields(data) {
       return Object.entries(data).filter(([, value]) => value !== undefined).map(([key]) => key).toSorted().join(",");
     }
+    static safeOrigin(game2) {
+      if (!game2 || game2.gameType !== "external" || !game2.externalUrl) {
+        return;
+      }
+      try {
+        return new URL(game2.externalUrl).origin;
+      } catch {
+        return;
+      }
+    }
+    cleanupStaleOrigin(origin, excludeGameId) {
+      if (!this.deps.corsKvs) {
+        return;
+      }
+      const corsKvs = this.deps.corsKvs;
+      const db2 = this.deps.db;
+      (async () => {
+        const sharesOrigin = await db2.select({ id: games.id }).from(games).where(and(ne(games.id, excludeGameId), eq(games.gameType, "external"), or(eq(games.externalUrl, origin), like(games.externalUrl, `${origin}/%`)))).limit(1);
+        if (sharesOrigin.length === 0) {
+          await corsKvs.deleteOrigin(origin);
+        } else {
+          setAttribute("app.cors_kvs.delete_skipped", true);
+        }
+      })().catch(catchAttrs("cors_kvs.delete_origin", {}));
+    }
     async list(caller) {
       const db2 = this.deps.db;
       const isAdmin = caller?.role === "admin";
@@ -28159,6 +28184,18 @@ var init_game_service = __esm(() => {
         "app.game.next_visibility": data.visibility !== undefined ? gameResponse.visibility : undefined
       });
       GameService.recordGameShape(gameResponse);
+      if (this.deps.corsKvs) {
+        const prevOrigin = GameService.safeOrigin(existingGame);
+        const nextOrigin = GameService.safeOrigin(gameResponse);
+        if (nextOrigin) {
+          setAttribute("app.cors_kvs.origin", nextOrigin);
+          this.deps.corsKvs.putOrigin(nextOrigin).catch(catchAttrs("cors_kvs.put_origin", {}));
+        }
+        if (prevOrigin && prevOrigin !== nextOrigin) {
+          setAttribute("app.cors_kvs.prev_origin", prevOrigin);
+          this.cleanupStaleOrigin(prevOrigin, gameResponse.id);
+        }
+      }
       return gameResponse;
     }
     async updateMetadata(gameId, data, user) {
@@ -28277,6 +28314,11 @@ var init_game_service = __esm(() => {
           setAttribute("app.game.api_key_cleanup_error", errorMessage(error));
         }
       }
+      const corsOrigin = GameService.safeOrigin(gameToDelete);
+      if (this.deps.corsKvs && corsOrigin) {
+        setAttribute("app.cors_kvs.origin", corsOrigin);
+        this.cleanupStaleOrigin(corsOrigin, gameId);
+      }
       return {
         slug: gameToDelete.slug,
         displayName: gameToDelete.displayName
@@ -28408,12 +28450,13 @@ var init_logs_service = __esm(() => {
 
 // ../api-core/src/services/factory/game.ts
 function createGameServices(deps) {
-  const { db: db2, config: config2, cloudflare: cloudflare2, auth: auth2, storage, cache, alerts } = deps;
+  const { db: db2, config: config2, cloudflare: cloudflare2, corsKvs, auth: auth2, storage, cache, alerts } = deps;
   const game2 = new GameService({
     db: db2,
     alerts,
     cache,
     cloudflare: cloudflare2,
+    corsKvs,
     deleteApiKeyByName: auth2.deleteApiKeyByName.bind(auth2)
   });
   const gameMember = new GameMemberService({
@@ -28434,7 +28477,6 @@ function createGameServices(deps) {
     db: db2,
     uploadBucket: config2.uploadBucket,
     storage,
-    cache,
     validateDeveloperAccessBySlug: (user, slug) => game2.validateDeveloperAccessBySlug(user, slug),
     runDeploy: (slug, request, user, uploadDeps, extractZip) => deploy.deploy(slug, request, user, uploadDeps, extractZip),
     notifyDeploymentFailure: (slug, displayName, error, developerInfo) => deploy.notifyDeploymentFailure(slug, displayName, error, developerInfo)
@@ -29319,6 +29361,9 @@ class DomainService {
     addEvent("domain.cloudflare_hostname_created", {
       "app.domain.cloudflare_id": cfHostname.id
     });
+    const corsOrigin = `https://${hostname}`;
+    setAttribute("app.cors_kvs.origin", corsOrigin);
+    this.deps.corsKvs?.putOrigin(corsOrigin).catch(catchAttrs("cors_kvs.put_origin", {}));
     return customHostname;
   }
   async list(slug, environment, user) {
@@ -29402,6 +29447,9 @@ class DomainService {
       "app.domain.status": dbHostname.status,
       "app.domain.ssl_status": dbHostname.sslStatus
     });
+    const corsOrigin = `https://${hostname}`;
+    setAttribute("app.cors_kvs.origin", corsOrigin);
+    this.deps.corsKvs?.deleteOrigin(corsOrigin).catch(catchAttrs("cors_kvs.delete_origin", {}));
   }
 }
 var init_domain_service = __esm(() => {
@@ -29696,12 +29744,13 @@ var init_secrets_service = __esm(() => {
 });
 
 // ../edge-play/src/constants.ts
-var ROUTES;
+var ASSET_ROUTE_PREFIX = "/api/assets/", ROUTES;
 var init_constants3 = __esm(() => {
   init_src();
   ROUTES = {
     INDEX: "/api",
     HEALTH: "/api/health",
+    ASSETS: `${ASSET_ROUTE_PREFIX}*`,
     TIMEBACK: {
       END_ACTIVITY: `/api${TIMEBACK_ROUTES.END_ACTIVITY}`,
       GET_XP: `/api${TIMEBACK_ROUTES.GET_XP}`,
@@ -29858,7 +29907,8 @@ class SeedService {
       }, {
         bindings: { d1: [deploymentId], r2: [], kv: [] },
         keepAssets: false,
-        compatibilityDate: CLOUDFLARE_COMPATIBILITY_DATE
+        compatibilityDate: CLOUDFLARE_COMPATIBILITY_DATE,
+        observability: false
       });
       if (secrets && Object.keys(secrets).length > 0) {
         await cf.setSecrets(seedDeploymentId, prefixSecrets(secrets));
@@ -34168,13 +34218,14 @@ var init_emoji = __esm(() => {
 });
 
 // ../data/src/domains/game/schemas.ts
-var GameEmojiSchema, GameMetadataRecordSchema, InsertGameSchema, UpdateGameSchema, InsertGameDeploymentSchema, InsertGameDeployJobSchema, UpsertGameMetadataSchema, PatchGameMetadataSchema, AddGameMemberSchema, UpdateGameMemberRoleSchema, ALLOWED_UPLOAD_EXTENSIONS, InitiateUploadSchema, AddCustomHostnameSchema, SetSecretsRequestSchema, SeedRequestSchema, SchemaInfoSchema, DatabaseResetRequestSchema, VerifyTokenSchema, KVSeedRequestSchema, DeployRequestSchema;
+var HttpUrlSchema, GameEmojiSchema, GameMetadataRecordSchema, InsertGameSchema, UpdateGameSchema, InsertGameDeploymentSchema, InsertGameDeployJobSchema, UpsertGameMetadataSchema, PatchGameMetadataSchema, AddGameMemberSchema, UpdateGameMemberRoleSchema, ALLOWED_UPLOAD_EXTENSIONS, InitiateUploadSchema, AddCustomHostnameSchema, SetSecretsRequestSchema, SeedRequestSchema, SchemaInfoSchema, DatabaseResetRequestSchema, VerifyTokenSchema, KVSeedRequestSchema, DeployRequestSchema;
 var init_schemas2 = __esm(() => {
   init_drizzle_zod();
   init_esm();
   init_src();
   init_emoji();
   init_table5();
+  HttpUrlSchema = exports_external.string().url().refine((url2) => /^https?:\/\//i.test(url2), { message: "URL must use http or https" });
   GameEmojiSchema = exports_external.string().max(16).refine((value) => value.length === 0 || isSingleEmoji(value), {
     message: "Emoji must be a single emoji."
   });
@@ -34199,7 +34250,7 @@ var init_schemas2 = __esm(() => {
     gameType: exports_external.enum(gameTypeEnum.enumValues).default("hosted"),
     visibility: exports_external.enum(gameVisibilityEnum.enumValues).default("visible"),
     deploymentUrl: exports_external.string().nullable().optional(),
-    externalUrl: exports_external.string().url().nullable().optional()
+    externalUrl: HttpUrlSchema.nullable().optional()
   }).omit({
     slug: true,
     version: true
@@ -34222,7 +34273,7 @@ var init_schemas2 = __esm(() => {
     gameType: exports_external.enum(gameTypeEnum.enumValues).optional(),
     visibility: exports_external.enum(gameVisibilityEnum.enumValues).optional(),
     deploymentUrl: exports_external.string().nullable().optional(),
-    externalUrl: exports_external.string().url().nullable().optional()
+    externalUrl: HttpUrlSchema.nullable().optional()
   }).omit({
     id: true,
     slug: true,
@@ -34252,7 +34303,7 @@ var init_schemas2 = __esm(() => {
     metadata: GameMetadataRecordSchema.optional().default({}),
     gameType: exports_external.enum(gameTypeEnum.enumValues).optional().default("hosted"),
     visibility: exports_external.enum(gameVisibilityEnum.enumValues).optional(),
-    externalUrl: exports_external.string().url().optional()
+    externalUrl: HttpUrlSchema.optional()
   }).refine((data) => {
     if (data.gameType === "external" && !data.externalUrl) {
       return false;
@@ -39163,6 +39214,7 @@ function createPlatformServices(deps) {
     db: db2,
     config: config2,
     cloudflare: cloudflare2,
+    corsKvs,
     storage: storage2,
     r2Storage,
     timebackClient,
@@ -39184,7 +39236,7 @@ function createPlatformServices(deps) {
   });
   const kv = new KVService({ db: db2, cloudflare: cloudflare2, validateDeveloperAccessBySlug });
   const secrets = new SecretsService({ config: config2, cloudflare: cloudflare2, validateDeveloperAccessBySlug });
-  const domain = new DomainService({ db: db2, cloudflare: cloudflare2, validateDeveloperAccessBySlug });
+  const domain = new DomainService({ db: db2, cloudflare: cloudflare2, corsKvs, validateDeveloperAccessBySlug });
   const database = new DatabaseService({
     db: db2,
     config: config2,
@@ -39862,7 +39914,7 @@ var init_standalone = __esm(() => {
 
 // ../api-core/src/services/factory/index.ts
 function createServices(ctx) {
-  const { db: db2, config: config2, providers, cloudflare: cloudflare2, timeback: timeback2, discord } = ctx;
+  const { db: db2, config: config2, providers, cloudflare: cloudflare2, timeback: timeback2, discord, corsKvs } = ctx;
   const { auth: auth2, storage: storage2, r2Storage, cache } = providers;
   const infra2 = createInfraServices({
     db: db2,
@@ -39876,6 +39928,7 @@ function createServices(ctx) {
     db: db2,
     config: config2,
     cloudflare: cloudflare2,
+    corsKvs,
     auth: auth2,
     storage: storage2,
     cache,
@@ -39885,6 +39938,7 @@ function createServices(ctx) {
     db: db2,
     config: config2,
     cloudflare: cloudflare2,
+    corsKvs,
     storage: storage2,
     r2Storage,
     timebackClient: timeback2,
@@ -40073,16 +40127,6 @@ var init_auth_provider = __esm(() => {
 // src/infrastructure/api/providers/cache.provider.ts
 function createSandboxCacheProvider() {
   return {
-    async refreshGameOrigins() {
-      gameOrigins = ["http://localhost:3000", "http://localhost:5173"];
-      lastRefreshTime = Date.now();
-    },
-    getGameOriginState() {
-      return {
-        origins: gameOrigins,
-        lastRefreshTime
-      };
-    },
     async get(key) {
       const entry = cache.get(key);
       if (!entry) {
@@ -40107,13 +40151,10 @@ function createSandboxCacheProvider() {
 }
 function clearSandboxCache() {
   cache.clear();
-  gameOrigins = [];
-  lastRefreshTime = 0;
 }
-var cache, gameOrigins, lastRefreshTime = 0;
+var cache;
 var init_cache_provider = __esm(() => {
   cache = new Map;
-  gameOrigins = [];
 });
 
 // src/infrastructure/api/providers/storage.provider.ts
@@ -49322,7 +49363,7 @@ var require_has_flag = __commonJS((exports, module2) => {
 
 // ../../node_modules/.bun/supports-color@7.2.0/node_modules/supports-color/index.js
 var require_supports_color = __commonJS((exports, module2) => {
-  var os = __require("os");
+  var os2 = __require("os");
   var tty = __require("tty");
   var hasFlag = require_has_flag();
   var { env } = process;
@@ -49370,7 +49411,7 @@ var require_supports_color = __commonJS((exports, module2) => {
       return min;
     }
     if (process.platform === "win32") {
-      const osRelease = os.release().split(".");
+      const osRelease = os2.release().split(".");
       if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) {
         return Number(osRelease[2]) >= 14931 ? 3 : 2;
       }
@@ -54463,7 +54504,7 @@ __export(exports_api, {
   generateDrizzleJson: () => generateDrizzleJson
 });
 import process2 from "process";
-import os from "os";
+import os2 from "os";
 import tty from "tty";
 import { randomUUID } from "crypto";
 function assembleStyles() {
@@ -54634,7 +54675,7 @@ function _supportsColor(haveStream, { streamIsTTY, sniffFlags = true } = {}) {
     return min2;
   }
   if (process2.platform === "win32") {
-    const osRelease = os.release().split(".");
+    const osRelease = os2.release().split(".");
     if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) {
       return Number(osRelease[2]) >= 14931 ? 3 : 2;
     }
@@ -67474,7 +67515,7 @@ Is ${source_default.bold.blue(this.base.name)} schema created or renamed from an
   });
   require_supports_colors = __commonJS2({
     "../node_modules/.pnpm/colors@1.4.0/node_modules/colors/lib/system/supports-colors.js"(exports, module2) {
-      var os2 = __require2("os");
+      var os22 = __require2("os");
       var hasFlag2 = require_has_flag2();
       var env2 = process.env;
       var forceColor = undefined;
@@ -67512,7 +67553,7 @@ Is ${source_default.bold.blue(this.base.name)} schema created or renamed from an
         }
         var min2 = forceColor ? 1 : 0;
         if (process.platform === "win32") {
-          var osRelease = os2.release().split(".");
+          var osRelease = os22.release().split(".");
           if (Number(process.versions.node.split(".")[0]) >= 8 && Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) {
             return Number(osRelease[2]) >= 14931 ? 3 : 2;
           }
@@ -95934,28 +95975,6 @@ var init_utils11 = __esm(() => {
   init_validation_util();
 });
 
-// ../api-core/src/controllers/admin.controller.ts
-var getAllowedOrigins, admin;
-var init_admin_controller = __esm(() => {
-  init_utils11();
-  getAllowedOrigins = requireAdmin(async (ctx) => {
-    const shouldRefresh = ctx.url.searchParams.get("refresh") === "true";
-    if (shouldRefresh) {
-      await ctx.providers.cache.refreshGameOrigins();
-    }
-    const { origins, lastRefreshTime: lastRefreshTime2 } = ctx.providers.cache.getGameOriginState();
-    return {
-      origins,
-      count: origins.length,
-      lastRefresh: lastRefreshTime2 > 0 ? new Date(lastRefreshTime2).toISOString() : null,
-      cacheAge: lastRefreshTime2 > 0 ? Date.now() - lastRefreshTime2 : null
-    };
-  });
-  admin = defineControllerNames("admin", {
-    getAllowedOrigins
-  });
-});
-
 // ../api-core/src/controllers/bucket.controller.ts
 var listFiles, getFile, putFile, deleteFile, initiateUpload, bucket;
 var init_bucket_controller = __esm(() => {
@@ -97387,7 +97406,6 @@ var init_verify_controller = __esm(() => {
 
 // ../api-core/src/controllers/index.ts
 var init_controllers = __esm(() => {
-  init_admin_controller();
   init_bucket_controller();
   init_database_controller();
   init_deploy_controller();

package/dist/infrastructure/api/providers/cache.provider.d.ts

@@ -1,18 +1,3 @@
-/**
- * Sandbox Cache Provider
- *
- * In-memory cache for local development. Simple TTL-based expiration.
- *
- * @module infrastructure/api/providers/cache
- */
 import type { CacheProvider } from '@playcademy/api-core/providers';
-/**
- * Create a sandbox cache provider.
- *
- * Uses in-memory storage with TTL support.
- */
 export declare function createSandboxCacheProvider(): CacheProvider;
-/**
- * Clear all sandbox cache (useful for testing).
- */
 export declare function clearSandboxCache(): void;

package/dist/server.js

@@ -978,10 +978,10 @@ var init_dist = __esm(() => {
 // ../utils/src/port.ts
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { createServer } from "node:net";
-import { homedir } from "node:os";
+import * as os from "node:os";
 import { join } from "node:path";
 function getRegistryPath() {
-  const home = homedir();
+  const home = os.homedir();
   const dir = join(home, ".playcademy");
   if (!existsSync(dir)) {
     mkdirSync(dir, { recursive: true });
@@ -1077,7 +1077,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@playcademy/sandbox",
-    version: "0.5.1-beta.4",
+    version: "0.5.1-beta.6",
     description: "Local development server for Playcademy game development",
     type: "module",
     exports: {
@@ -22504,7 +22504,6 @@ class DeployJobService {
         "app.deploy_job.outcome": "succeeded",
         "app.deploy_job.run_duration_ms": DeployJobService.elapsedMsSince(new Date(runStartedAt))
       });
-      await this.deps.cache.refreshGameOrigins().catch(catchAttrs("deploy_job.cache_refresh"));
       await this.deleteCodeBundle(jobId);
     } catch (error) {
       clearInterval(heartbeat);
@@ -26422,7 +26421,7 @@ ${file}:${line3}:${column2}: ERROR: ${pluginText}${e.text}`;
     return result;
   }
   var fs2 = __require("fs");
-  var os = __require("os");
+  var os2 = __require("os");
   var path = __require("path");
   var ESBUILD_BINARY_PATH = process.env.ESBUILD_BINARY_PATH || ESBUILD_BINARY_PATH;
   var isValidBinaryPath = (x) => !!x && x !== "/usr/bin/esbuild";
@@ -26464,7 +26463,7 @@ ${file}:${line3}:${column2}: ERROR: ${pluginText}${e.text}`;
     let pkg;
     let subpath;
     let isWASM = false;
-    let platformKey = `${process.platform} ${os.arch()} ${os.endianness()}`;
+    let platformKey = `${process.platform} ${os2.arch()} ${os2.endianness()}`;
     if (platformKey in knownWindowsPackages) {
       pkg = knownWindowsPackages[platformKey];
       subpath = "esbuild.exe";
@@ -26607,7 +26606,7 @@ for your current platform.`);
   var crypto3 = __require("crypto");
   var path2 = __require("path");
   var fs22 = __require("fs");
-  var os2 = __require("os");
+  var os22 = __require("os");
   var tty = __require("tty");
   var worker_threads;
   if (process.env.ESBUILD_WORKER_THREADS !== "0") {
@@ -26918,7 +26917,7 @@ More information: The file containing the code for esbuild's JavaScript API (${_
     afterClose(null);
   };
   var randomFileName = () => {
-    return path2.join(os2.tmpdir(), `esbuild-${crypto3.randomBytes(32).toString("hex")}`);
+    return path2.join(os22.tmpdir(), `esbuild-${crypto3.randomBytes(32).toString("hex")}`);
   };
   var workerThreadService = null;
   var startWorkerThreadService = (worker_threads2) => {
@@ -27180,7 +27179,8 @@ class DeployService {
       expiresIn: null,
       permissions: {
         games: [`read:${slug}`, `write:${slug}`]
-      }
+      },
+      rateLimitEnabled: false
     });
     setAttribute("app.deploy.api_key_outcome", "created");
     return apiKey;
@@ -27241,9 +27241,9 @@ class DeployService {
       throw new ValidationError("Uploaded file is empty or not found");
     }
     setAttribute("app.deploy.asset_upload_size", frontendZip.length);
-    const os = await import("os");
+    const os2 = await import("os");
     const path = await import("path");
-    const tempDir = path.join(os.tmpdir(), `playcademy-deploy-${gameId}-${Date.now()}`);
+    const tempDir = path.join(os2.tmpdir(), `playcademy-deploy-${gameId}-${Date.now()}`);
     const assetsPath = path.join(tempDir, "dist");
     await withSpan("deploy.extract_assets", () => extractZip(frontendZip, assetsPath));
     uploadDeps.deleteObject(uploadToken).catch(catchAttrs("deploy.temp_cleanup"));
@@ -27856,6 +27856,31 @@ var init_game_service = __esm(() => {
     static changedFields(data) {
       return Object.entries(data).filter(([, value]) => value !== undefined).map(([key]) => key).toSorted().join(",");
     }
+    static safeOrigin(game2) {
+      if (!game2 || game2.gameType !== "external" || !game2.externalUrl) {
+        return;
+      }
+      try {
+        return new URL(game2.externalUrl).origin;
+      } catch {
+        return;
+      }
+    }
+    cleanupStaleOrigin(origin, excludeGameId) {
+      if (!this.deps.corsKvs) {
+        return;
+      }
+      const corsKvs = this.deps.corsKvs;
+      const db2 = this.deps.db;
+      (async () => {
+        const sharesOrigin = await db2.select({ id: games.id }).from(games).where(and(ne(games.id, excludeGameId), eq(games.gameType, "external"), or(eq(games.externalUrl, origin), like(games.externalUrl, `${origin}/%`)))).limit(1);
+        if (sharesOrigin.length === 0) {
+          await corsKvs.deleteOrigin(origin);
+        } else {
+          setAttribute("app.cors_kvs.delete_skipped", true);
+        }
+      })().catch(catchAttrs("cors_kvs.delete_origin", {}));
+    }
     async list(caller) {
       const db2 = this.deps.db;
       const isAdmin = caller?.role === "admin";
@@ -28158,6 +28183,18 @@ var init_game_service = __esm(() => {
         "app.game.next_visibility": data.visibility !== undefined ? gameResponse.visibility : undefined
       });
       GameService.recordGameShape(gameResponse);
+      if (this.deps.corsKvs) {
+        const prevOrigin = GameService.safeOrigin(existingGame);
+        const nextOrigin = GameService.safeOrigin(gameResponse);
+        if (nextOrigin) {
+          setAttribute("app.cors_kvs.origin", nextOrigin);
+          this.deps.corsKvs.putOrigin(nextOrigin).catch(catchAttrs("cors_kvs.put_origin", {}));
+        }
+        if (prevOrigin && prevOrigin !== nextOrigin) {
+          setAttribute("app.cors_kvs.prev_origin", prevOrigin);
+          this.cleanupStaleOrigin(prevOrigin, gameResponse.id);
+        }
+      }
       return gameResponse;
     }
     async updateMetadata(gameId, data, user) {
@@ -28276,6 +28313,11 @@ var init_game_service = __esm(() => {
           setAttribute("app.game.api_key_cleanup_error", errorMessage(error));
         }
       }
+      const corsOrigin = GameService.safeOrigin(gameToDelete);
+      if (this.deps.corsKvs && corsOrigin) {
+        setAttribute("app.cors_kvs.origin", corsOrigin);
+        this.cleanupStaleOrigin(corsOrigin, gameId);
+      }
       return {
         slug: gameToDelete.slug,
         displayName: gameToDelete.displayName
@@ -28407,12 +28449,13 @@ var init_logs_service = __esm(() => {
 
 // ../api-core/src/services/factory/game.ts
 function createGameServices(deps) {
-  const { db: db2, config: config2, cloudflare: cloudflare2, auth: auth2, storage, cache, alerts } = deps;
+  const { db: db2, config: config2, cloudflare: cloudflare2, corsKvs, auth: auth2, storage, cache, alerts } = deps;
   const game2 = new GameService({
     db: db2,
     alerts,
     cache,
     cloudflare: cloudflare2,
+    corsKvs,
     deleteApiKeyByName: auth2.deleteApiKeyByName.bind(auth2)
   });
   const gameMember = new GameMemberService({
@@ -28433,7 +28476,6 @@ function createGameServices(deps) {
     db: db2,
     uploadBucket: config2.uploadBucket,
     storage,
-    cache,
     validateDeveloperAccessBySlug: (user, slug) => game2.validateDeveloperAccessBySlug(user, slug),
     runDeploy: (slug, request, user, uploadDeps, extractZip) => deploy.deploy(slug, request, user, uploadDeps, extractZip),
     notifyDeploymentFailure: (slug, displayName, error, developerInfo) => deploy.notifyDeploymentFailure(slug, displayName, error, developerInfo)
@@ -29318,6 +29360,9 @@ class DomainService {
     addEvent("domain.cloudflare_hostname_created", {
       "app.domain.cloudflare_id": cfHostname.id
     });
+    const corsOrigin = `https://${hostname}`;
+    setAttribute("app.cors_kvs.origin", corsOrigin);
+    this.deps.corsKvs?.putOrigin(corsOrigin).catch(catchAttrs("cors_kvs.put_origin", {}));
     return customHostname;
   }
   async list(slug, environment, user) {
@@ -29401,6 +29446,9 @@ class DomainService {
       "app.domain.status": dbHostname.status,
       "app.domain.ssl_status": dbHostname.sslStatus
     });
+    const corsOrigin = `https://${hostname}`;
+    setAttribute("app.cors_kvs.origin", corsOrigin);
+    this.deps.corsKvs?.deleteOrigin(corsOrigin).catch(catchAttrs("cors_kvs.delete_origin", {}));
   }
 }
 var init_domain_service = __esm(() => {
@@ -29695,12 +29743,13 @@ var init_secrets_service = __esm(() => {
 });
 
 // ../edge-play/src/constants.ts
-var ROUTES;
+var ASSET_ROUTE_PREFIX = "/api/assets/", ROUTES;
 var init_constants3 = __esm(() => {
   init_src();
   ROUTES = {
     INDEX: "/api",
     HEALTH: "/api/health",
+    ASSETS: `${ASSET_ROUTE_PREFIX}*`,
     TIMEBACK: {
       END_ACTIVITY: `/api${TIMEBACK_ROUTES.END_ACTIVITY}`,
       GET_XP: `/api${TIMEBACK_ROUTES.GET_XP}`,
@@ -29857,7 +29906,8 @@ class SeedService {
       }, {
         bindings: { d1: [deploymentId], r2: [], kv: [] },
         keepAssets: false,
-        compatibilityDate: CLOUDFLARE_COMPATIBILITY_DATE
+        compatibilityDate: CLOUDFLARE_COMPATIBILITY_DATE,
+        observability: false
       });
       if (secrets && Object.keys(secrets).length > 0) {
         await cf.setSecrets(seedDeploymentId, prefixSecrets(secrets));
@@ -34167,13 +34217,14 @@ var init_emoji = __esm(() => {
 });
 
 // ../data/src/domains/game/schemas.ts
-var GameEmojiSchema, GameMetadataRecordSchema, InsertGameSchema, UpdateGameSchema, InsertGameDeploymentSchema, InsertGameDeployJobSchema, UpsertGameMetadataSchema, PatchGameMetadataSchema, AddGameMemberSchema, UpdateGameMemberRoleSchema, ALLOWED_UPLOAD_EXTENSIONS, InitiateUploadSchema, AddCustomHostnameSchema, SetSecretsRequestSchema, SeedRequestSchema, SchemaInfoSchema, DatabaseResetRequestSchema, VerifyTokenSchema, KVSeedRequestSchema, DeployRequestSchema;
+var HttpUrlSchema, GameEmojiSchema, GameMetadataRecordSchema, InsertGameSchema, UpdateGameSchema, InsertGameDeploymentSchema, InsertGameDeployJobSchema, UpsertGameMetadataSchema, PatchGameMetadataSchema, AddGameMemberSchema, UpdateGameMemberRoleSchema, ALLOWED_UPLOAD_EXTENSIONS, InitiateUploadSchema, AddCustomHostnameSchema, SetSecretsRequestSchema, SeedRequestSchema, SchemaInfoSchema, DatabaseResetRequestSchema, VerifyTokenSchema, KVSeedRequestSchema, DeployRequestSchema;
 var init_schemas2 = __esm(() => {
   init_drizzle_zod();
   init_esm();
   init_src();
   init_emoji();
   init_table5();
+  HttpUrlSchema = exports_external.string().url().refine((url2) => /^https?:\/\//i.test(url2), { message: "URL must use http or https" });
   GameEmojiSchema = exports_external.string().max(16).refine((value) => value.length === 0 || isSingleEmoji(value), {
     message: "Emoji must be a single emoji."
   });
@@ -34198,7 +34249,7 @@ var init_schemas2 = __esm(() => {
     gameType: exports_external.enum(gameTypeEnum.enumValues).default("hosted"),
     visibility: exports_external.enum(gameVisibilityEnum.enumValues).default("visible"),
     deploymentUrl: exports_external.string().nullable().optional(),
-    externalUrl: exports_external.string().url().nullable().optional()
+    externalUrl: HttpUrlSchema.nullable().optional()
   }).omit({
     slug: true,
     version: true
@@ -34221,7 +34272,7 @@ var init_schemas2 = __esm(() => {
     gameType: exports_external.enum(gameTypeEnum.enumValues).optional(),
     visibility: exports_external.enum(gameVisibilityEnum.enumValues).optional(),
     deploymentUrl: exports_external.string().nullable().optional(),
-    externalUrl: exports_external.string().url().nullable().optional()
+    externalUrl: HttpUrlSchema.nullable().optional()
   }).omit({
     id: true,
     slug: true,
@@ -34251,7 +34302,7 @@ var init_schemas2 = __esm(() => {
     metadata: GameMetadataRecordSchema.optional().default({}),
     gameType: exports_external.enum(gameTypeEnum.enumValues).optional().default("hosted"),
     visibility: exports_external.enum(gameVisibilityEnum.enumValues).optional(),
-    externalUrl: exports_external.string().url().optional()
+    externalUrl: HttpUrlSchema.optional()
   }).refine((data) => {
     if (data.gameType === "external" && !data.externalUrl) {
       return false;
@@ -39162,6 +39213,7 @@ function createPlatformServices(deps) {
     db: db2,
     config: config2,
     cloudflare: cloudflare2,
+    corsKvs,
     storage: storage2,
     r2Storage,
     timebackClient,
@@ -39183,7 +39235,7 @@ function createPlatformServices(deps) {
   });
   const kv = new KVService({ db: db2, cloudflare: cloudflare2, validateDeveloperAccessBySlug });
   const secrets = new SecretsService({ config: config2, cloudflare: cloudflare2, validateDeveloperAccessBySlug });
-  const domain = new DomainService({ db: db2, cloudflare: cloudflare2, validateDeveloperAccessBySlug });
+  const domain = new DomainService({ db: db2, cloudflare: cloudflare2, corsKvs, validateDeveloperAccessBySlug });
   const database = new DatabaseService({
     db: db2,
     config: config2,
@@ -39861,7 +39913,7 @@ var init_standalone = __esm(() => {
 
 // ../api-core/src/services/factory/index.ts
 function createServices(ctx) {
-  const { db: db2, config: config2, providers, cloudflare: cloudflare2, timeback: timeback2, discord } = ctx;
+  const { db: db2, config: config2, providers, cloudflare: cloudflare2, timeback: timeback2, discord, corsKvs } = ctx;
   const { auth: auth2, storage: storage2, r2Storage, cache } = providers;
   const infra2 = createInfraServices({
     db: db2,
@@ -39875,6 +39927,7 @@ function createServices(ctx) {
     db: db2,
     config: config2,
     cloudflare: cloudflare2,
+    corsKvs,
     auth: auth2,
     storage: storage2,
     cache,
@@ -39884,6 +39937,7 @@ function createServices(ctx) {
     db: db2,
     config: config2,
     cloudflare: cloudflare2,
+    corsKvs,
     storage: storage2,
     r2Storage,
     timebackClient: timeback2,
@@ -40072,16 +40126,6 @@ var init_auth_provider = __esm(() => {
 // src/infrastructure/api/providers/cache.provider.ts
 function createSandboxCacheProvider() {
   return {
-    async refreshGameOrigins() {
-      gameOrigins = ["http://localhost:3000", "http://localhost:5173"];
-      lastRefreshTime = Date.now();
-    },
-    getGameOriginState() {
-      return {
-        origins: gameOrigins,
-        lastRefreshTime
-      };
-    },
     async get(key) {
       const entry = cache.get(key);
       if (!entry) {
@@ -40106,13 +40150,10 @@ function createSandboxCacheProvider() {
 }
 function clearSandboxCache() {
   cache.clear();
-  gameOrigins = [];
-  lastRefreshTime = 0;
 }
-var cache, gameOrigins, lastRefreshTime = 0;
+var cache;
 var init_cache_provider = __esm(() => {
   cache = new Map;
-  gameOrigins = [];
 });
 
 // src/infrastructure/api/providers/storage.provider.ts
@@ -49321,7 +49362,7 @@ var require_has_flag = __commonJS((exports, module2) => {
 
 // ../../node_modules/.bun/supports-color@7.2.0/node_modules/supports-color/index.js
 var require_supports_color = __commonJS((exports, module2) => {
-  var os = __require("os");
+  var os2 = __require("os");
   var tty = __require("tty");
   var hasFlag = require_has_flag();
   var { env } = process;
@@ -49369,7 +49410,7 @@ var require_supports_color = __commonJS((exports, module2) => {
       return min;
     }
     if (process.platform === "win32") {
-      const osRelease = os.release().split(".");
+      const osRelease = os2.release().split(".");
       if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) {
         return Number(osRelease[2]) >= 14931 ? 3 : 2;
       }
@@ -54462,7 +54503,7 @@ __export(exports_api, {
   generateDrizzleJson: () => generateDrizzleJson
 });
 import process2 from "process";
-import os from "os";
+import os2 from "os";
 import tty from "tty";
 import { randomUUID } from "crypto";
 function assembleStyles() {
@@ -54633,7 +54674,7 @@ function _supportsColor(haveStream, { streamIsTTY, sniffFlags = true } = {}) {
     return min2;
   }
   if (process2.platform === "win32") {
-    const osRelease = os.release().split(".");
+    const osRelease = os2.release().split(".");
     if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) {
       return Number(osRelease[2]) >= 14931 ? 3 : 2;
     }
@@ -67473,7 +67514,7 @@ Is ${source_default.bold.blue(this.base.name)} schema created or renamed from an
   });
   require_supports_colors = __commonJS2({
     "../node_modules/.pnpm/colors@1.4.0/node_modules/colors/lib/system/supports-colors.js"(exports, module2) {
-      var os2 = __require2("os");
+      var os22 = __require2("os");
       var hasFlag2 = require_has_flag2();
       var env2 = process.env;
       var forceColor = undefined;
@@ -67511,7 +67552,7 @@ Is ${source_default.bold.blue(this.base.name)} schema created or renamed from an
         }
         var min2 = forceColor ? 1 : 0;
         if (process.platform === "win32") {
-          var osRelease = os2.release().split(".");
+          var osRelease = os22.release().split(".");
           if (Number(process.versions.node.split(".")[0]) >= 8 && Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) {
             return Number(osRelease[2]) >= 14931 ? 3 : 2;
           }
@@ -95933,28 +95974,6 @@ var init_utils11 = __esm(() => {
   init_validation_util();
 });
 
-// ../api-core/src/controllers/admin.controller.ts
-var getAllowedOrigins, admin;
-var init_admin_controller = __esm(() => {
-  init_utils11();
-  getAllowedOrigins = requireAdmin(async (ctx) => {
-    const shouldRefresh = ctx.url.searchParams.get("refresh") === "true";
-    if (shouldRefresh) {
-      await ctx.providers.cache.refreshGameOrigins();
-    }
-    const { origins, lastRefreshTime: lastRefreshTime2 } = ctx.providers.cache.getGameOriginState();
-    return {
-      origins,
-      count: origins.length,
-      lastRefresh: lastRefreshTime2 > 0 ? new Date(lastRefreshTime2).toISOString() : null,
-      cacheAge: lastRefreshTime2 > 0 ? Date.now() - lastRefreshTime2 : null
-    };
-  });
-  admin = defineControllerNames("admin", {
-    getAllowedOrigins
-  });
-});
-
 // ../api-core/src/controllers/bucket.controller.ts
 var listFiles, getFile, putFile, deleteFile, initiateUpload, bucket;
 var init_bucket_controller = __esm(() => {
@@ -97386,7 +97405,6 @@ var init_verify_controller = __esm(() => {
 
 // ../api-core/src/controllers/index.ts
 var init_controllers = __esm(() => {
-  init_admin_controller();
   init_bucket_controller();
   init_database_controller();
   init_deploy_controller();

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@playcademy/sandbox",
-    "version": "0.5.1-beta.4",
+    "version": "0.5.1-beta.6",
     "description": "Local development server for Playcademy game development",
     "type": "module",
     "exports": {