@playcademy/sandbox 0.6.1-beta.4 → 0.6.1-beta.6

package/dist/cli.js

@@ -204,6 +204,20 @@ var init_auth = __esm(() => {
   };
 });
 
+// ../constants/src/dashboard.ts
+var DASHBOARD_USER_ROLES, DASHBOARD_WORKER_ROUTES, DASHBOARD_WORKER_SUFFIX = "-dash";
+var init_dashboard = __esm(() => {
+  DASHBOARD_USER_ROLES = {
+    ADMIN: "admin",
+    VIEWER: "viewer"
+  };
+  DASHBOARD_WORKER_ROUTES = {
+    verifySession: "/sessions",
+    acceptInvite: "/invites/accept",
+    acceptReset: "/resets/accept"
+  };
+});
+
 // ../constants/src/typescript.ts
 var init_typescript = () => {};
 
@@ -245,17 +259,8 @@ var init_platform = __esm(() => {
 var PLATFORM_TIMEZONE = "America/New_York";
 
 // ../constants/src/timeback.ts
-var TIMEBACK_ROUTES, TIMEBACK_ORG_SOURCED_ID = "PLAYCADEMY", TIMEBACK_ORG_NAME = "Playcademy Studios", TIMEBACK_ORG_TYPE = "department", TIMEBACK_COURSE_DEFAULTS, TIMEBACK_RESOURCE_DEFAULTS, TIMEBACK_COMPONENT_DEFAULTS, TIMEBACK_COMPONENT_RESOURCE_DEFAULTS, TIMEBACK_GAME_METRIC_DECIMAL_PLACES, TIMEBACK_GAME_METRIC_COMPARISON_TOLERANCE;
+var TIMEBACK_ORG_SOURCED_ID = "PLAYCADEMY", TIMEBACK_ORG_NAME = "Playcademy Studios", TIMEBACK_ORG_TYPE = "department", TIMEBACK_COURSE_DEFAULTS, TIMEBACK_RESOURCE_DEFAULTS, TIMEBACK_COMPONENT_DEFAULTS, TIMEBACK_COMPONENT_RESOURCE_DEFAULTS, TIMEBACK_GAME_METRIC_DECIMAL_PLACES, TIMEBACK_GAME_METRIC_COMPARISON_TOLERANCE;
 var init_timeback2 = __esm(() => {
-  TIMEBACK_ROUTES = {
-    END_ACTIVITY: "/integrations/timeback/end-activity",
-    GET_XP: "/integrations/timeback/xp",
-    GET_MASTERY: "/integrations/timeback/mastery",
-    GET_HIGHEST_GRADE_MASTERED: "/integrations/timeback/highest-grade-mastered",
-    HEARTBEAT: "/integrations/timeback/heartbeat",
-    ADVANCE_COURSE: "/integrations/timeback/advance-course",
-    UNENROLL_COURSE: "/integrations/timeback/unenroll-course"
-  };
   TIMEBACK_COURSE_DEFAULTS = {
     gradingScheme: "STANDARD",
     level: {
@@ -306,7 +311,7 @@ var init_timeback2 = __esm(() => {
 });
 
 // ../constants/src/cloudflare.ts
-var WORKER_NAMING, SECRETS_PREFIX = "secrets_", CLOUDFLARE_COMPATIBILITY_DATE = "2025-10-11";
+var WORKER_NAMING, MAX_WORKER_NAME_LENGTH = 63, SECRETS_PREFIX = "secrets_", CLOUDFLARE_COMPATIBILITY_DATE = "2025-10-11";
 var init_cloudflare = __esm(() => {
   WORKER_NAMING = {
     STAGING_PREFIX: "staging-",
@@ -318,6 +323,7 @@ var init_cloudflare = __esm(() => {
 // ../constants/src/index.ts
 var init_src = __esm(() => {
   init_auth();
+  init_dashboard();
   init_typescript();
   init_domains();
   init_env_vars();
@@ -1057,8 +1063,7 @@ async function waitForPort(port, timeoutMs = 5000) {
   const start2 = Date.now();
   while (await isPortInUse(port)) {
     if (Date.now() - start2 > timeoutMs) {
-      throw new Error(`Port ${port} is already in use.
-` + `Stop the other server or specify a different port with --port <number>.`);
+      throw new Error(`Port ${port} is already in use`);
     }
     await new Promise((resolve) => setTimeout(resolve, 100));
   }
@@ -1067,8 +1072,7 @@ async function requirePortAvailable(port, timeoutMs = 100) {
   const start2 = Date.now();
   while (await isPortInUse(port)) {
     if (Date.now() - start2 > timeoutMs) {
-      throw new Error(`Port ${port} is already in use.
-` + `Stop the other server or specify a different port with --port <number>.`);
+      throw new Error(`Port ${port} is already in use`);
     }
     await new Promise((resolve) => setTimeout(resolve, 50));
   }
@@ -1080,7 +1084,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@playcademy/sandbox",
-    version: "0.6.1-beta.4",
+    version: "0.6.1-beta.6",
     description: "Local development server for Playcademy game development",
     type: "module",
     exports: {
@@ -1149,7 +1153,7 @@ var init_package = __esm(() => {
 });
 
 // ../api-core/src/errors/domain.error.ts
-var DomainError, BadRequestError, AccessDeniedError, NotFoundError, ConflictError, AlreadyExistsError, ValidationError, InternalError, ServiceUnavailableError, TimeoutError;
+var DomainError, BadRequestError, UnauthorizedError, AccessDeniedError, NotFoundError, ConflictError, AlreadyExistsError, ValidationError, RateLimitError, InternalError, ServiceUnavailableError, TimeoutError;
 var init_domain_error = __esm(() => {
   DomainError = class DomainError extends Error {
     code;
@@ -1167,6 +1171,12 @@ var init_domain_error = __esm(() => {
       this.name = "BadRequestError";
     }
   };
+  UnauthorizedError = class UnauthorizedError extends DomainError {
+    constructor(message = "Unauthorized", details) {
+      super("UNAUTHORIZED", message, details);
+      this.name = "UnauthorizedError";
+    }
+  };
   AccessDeniedError = class AccessDeniedError extends DomainError {
     constructor(message = "Access denied", details) {
       super("ACCESS_DENIED", message, details);
@@ -1199,6 +1209,12 @@ var init_domain_error = __esm(() => {
       this.name = "ValidationError";
     }
   };
+  RateLimitError = class RateLimitError extends DomainError {
+    constructor(message = "Rate limit exceeded", details) {
+      super("RATE_LIMITED", message, details);
+      this.name = "RateLimitError";
+    }
+  };
   InternalError = class InternalError extends DomainError {
     constructor(message = "Internal error", details) {
       super("INTERNAL", message, details);
@@ -1557,12 +1573,24 @@ data: ${JSON.stringify(data)}
   return sseEncoder.encode(payload);
 }
 function createContextBuilder(options) {
-  const { db, config: config2, providers, services, cloudflare: cloudflare2, timeback: timeback2, resolveUser, resolveGameId } = options;
+  const {
+    db,
+    config: config2,
+    providers,
+    services,
+    cloudflare: cloudflare2,
+    timeback: timeback2,
+    resolveUser,
+    resolveGameId,
+    resolveApiKey
+  } = options;
   return async (c) => {
     const user = resolveUser ? await resolveUser(c) : null;
     const gameId = resolveGameId ? await resolveGameId(c) : undefined;
+    const apiKey = resolveApiKey ? await resolveApiKey(c) : undefined;
     return {
       user,
+      apiKey,
       gameId,
       params: c.req.param(),
       url: new URL(c.req.url),
@@ -5661,6 +5689,14 @@ var init_schema = __esm(() => {
     platformServiceJwt: platformServiceJwtConfigSchema.optional(),
     uploadBucket: exports_external.string().optional(),
     queueIngressSecret: exports_external.string().optional()
+  }).superRefine((config2, ctx) => {
+    if (config2.isLocal && !config2.baseUrl) {
+      ctx.addIssue({
+        code: exports_external.ZodIssueCode.custom,
+        path: ["baseUrl"],
+        message: "baseUrl is required when isLocal is true"
+      });
+    }
   });
 });
 
@@ -11181,7 +11217,7 @@ var init_table4 = __esm(() => {
 });
 
 // ../data/src/domains/game/table.ts
-var gamePlatformEnum, gameTypeEnum, gameVisibilityEnum, games, gameMemberRoleEnum, gameMembers, gameMembersRelations, deploymentProviderEnum, deployJobStatusEnum, gameDeployments, gameDeployJobs, customHostnameStatusEnum, customHostnameSslStatusEnum, customHostnameEnvironmentEnum, gameCustomHostnames;
+var gamePlatformEnum, gameTypeEnum, gameVisibilityEnum, games, gameMemberRoleEnum, gameMembers, gameMembersRelations, gameDashboardUserRoleEnum, gameDashboardUsers, gameDashboardUsersRelations, deploymentProviderEnum, deploymentTargetEnum, deployJobStatusEnum, gameDeployments, gameDeployJobs, customHostnameStatusEnum, customHostnameSslStatusEnum, customHostnameEnvironmentEnum, gameCustomHostnames;
 var init_table5 = __esm(() => {
   init_drizzle_orm();
   init_pg_core();
@@ -11225,7 +11261,37 @@ var init_table5 = __esm(() => {
       references: [users.id]
     })
   }));
+  gameDashboardUserRoleEnum = pgEnum("game_dashboard_user_role", [
+    DASHBOARD_USER_ROLES.ADMIN,
+    DASHBOARD_USER_ROLES.VIEWER
+  ]);
+  gameDashboardUsers = pgTable("game_dashboard_users", {
+    id: uuid("id").primaryKey().defaultRandom(),
+    gameId: uuid("game_id").notNull().references(() => games.id, { onDelete: "cascade" }),
+    email: text("email").notNull(),
+    displayName: text("display_name"),
+    role: gameDashboardUserRoleEnum("role").notNull().default(DASHBOARD_USER_ROLES.VIEWER),
+    passwordHash: text("password_hash"),
+    inviteTokenHash: text("invite_token_hash"),
+    inviteExpiresAt: timestamp("invite_expires_at", { withTimezone: true }),
+    resetTokenHash: text("reset_token_hash"),
+    resetExpiresAt: timestamp("reset_expires_at", { withTimezone: true }),
+    failedLoginAttempts: integer("failed_login_attempts").notNull().default(0),
+    lastFailedLoginAt: timestamp("last_failed_login_at", { withTimezone: true }),
+    platformUserId: text("platform_user_id").references(() => users.id, {
+      onDelete: "set null"
+    }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  }, (table3) => [uniqueIndex("game_dashboard_users_game_email_idx").on(table3.gameId, table3.email)]);
+  gameDashboardUsersRelations = relations(gameDashboardUsers, ({ one }) => ({
+    game: one(games, {
+      fields: [gameDashboardUsers.gameId],
+      references: [games.id]
+    })
+  }));
   deploymentProviderEnum = pgEnum("deployment_provider", ["cloudflare", "aws"]);
+  deploymentTargetEnum = pgEnum("deployment_target", ["game", "dashboard"]);
   deployJobStatusEnum = pgEnum("deploy_job_status", [
     "pending",
     "running",
@@ -11237,6 +11303,7 @@ var init_table5 = __esm(() => {
     gameId: uuid("game_id").notNull().references(() => games.id, { onDelete: "cascade" }),
     deploymentId: text("deployment_id").notNull(),
     provider: deploymentProviderEnum("provider").notNull(),
+    target: deploymentTargetEnum("target").notNull().default("game"),
     url: text("url").notNull(),
     codeHash: text("code_hash"),
     isActive: boolean("is_active").notNull().default(false),
@@ -11424,8 +11491,12 @@ __export(exports_tables_index, {
   gameMemberRoleEnum: () => gameMemberRoleEnum,
   gameDeployments: () => gameDeployments,
   gameDeployJobs: () => gameDeployJobs,
+  gameDashboardUsersRelations: () => gameDashboardUsersRelations,
+  gameDashboardUsers: () => gameDashboardUsers,
+  gameDashboardUserRoleEnum: () => gameDashboardUserRoleEnum,
   gameCustomHostnames: () => gameCustomHostnames,
   developerStatusEnum: () => developerStatusEnum,
+  deploymentTargetEnum: () => deploymentTargetEnum,
   deploymentProviderEnum: () => deploymentProviderEnum,
   deployJobStatusEnum: () => deployJobStatusEnum,
   customHostnameStatusEnum: () => customHostnameStatusEnum,
@@ -12929,6 +13000,10 @@ function errorMessage(err2) {
 function errorType(err2) {
   return err2 instanceof Error ? err2.constructor.name : typeof err2;
 }
+function isUniqueViolation(err2) {
+  return typeof err2 === "object" && err2 !== null && err2.code === PG_UNIQUE_VIOLATION;
+}
+var PG_UNIQUE_VIOLATION = "23505";
 
 // ../otel/src/spans.ts
 function truncate(value) {
@@ -13007,6 +13082,310 @@ var init_spans = __esm(() => {
   ROOT_SPAN_KEY = import_api2.createContextKey("playcademy.root_span");
 });
 
+// ../utils/src/random.ts
+async function generateSecureRandomString(length) {
+  const charset = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
+  const randomValues = new Uint8Array(length);
+  crypto.getRandomValues(randomValues);
+  return [...randomValues].map((byte) => charset[byte % charset.length]).join("");
+}
+
+// ../api-core/src/utils/hash.util.ts
+async function sha256Hex(input) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(input));
+  return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+
+// ../api-core/src/utils/dashboard.util.ts
+function dashboardCredentialScope(slug) {
+  return `${CREDENTIAL_SCOPE_PREFIX}${slug}`;
+}
+function dashboardCredentialSlugs(permissions) {
+  return (permissions?.[DASHBOARD_PERMISSION_NAMESPACE] ?? []).filter((scope) => scope.startsWith(CREDENTIAL_SCOPE_PREFIX)).map((scope) => scope.slice(CREDENTIAL_SCOPE_PREFIX.length)).filter((slug) => slug.length > 0);
+}
+function isAllowedDashboardWorkerRequest(method, pathname, permissions) {
+  const path = pathname.replace(/\/+$/, "");
+  return dashboardCredentialSlugs(permissions).some((slug) => {
+    if (method === "GET") {
+      return path === `/api/games/${slug}`;
+    }
+    if (method === "POST") {
+      return Object.values(DASHBOARD_WORKER_ROUTES).some((subpath) => path === `/api/games/${slug}/dashboard${subpath}`);
+    }
+    return false;
+  });
+}
+function hashDashboardToken(token) {
+  return sha256Hex(token);
+}
+function loginBackoffMs(failedAttempts) {
+  if (failedAttempts < LOGIN_BACKOFF_THRESHOLD) {
+    return 0;
+  }
+  return Math.min(LOGIN_BACKOFF_CAP_MS, LOGIN_BACKOFF_BASE_MS * 2 ** (failedAttempts - LOGIN_BACKOFF_THRESHOLD));
+}
+var DASHBOARD_PERMISSION_NAMESPACE = "dashboard", DASHBOARD_WORKER_KEY_RESTRICTED = "The dashboard worker key is restricted to dashboard runtime endpoints", CREDENTIAL_SCOPE_PREFIX = "credentials:", LOGIN_BACKOFF_THRESHOLD = 5, LOGIN_BACKOFF_BASE_MS = 1000, LOGIN_BACKOFF_CAP_MS;
+var init_dashboard_util = __esm(() => {
+  init_src();
+  LOGIN_BACKOFF_CAP_MS = 5 * 60 * 1000;
+});
+
+// ../api-core/src/services/dashboard.service.ts
+function alreadyExists(gameId) {
+  return new AlreadyExistsError("A dashboard user with this email already exists", { gameId });
+}
+var DashboardService;
+var init_dashboard_service = __esm(() => {
+  init_drizzle_orm();
+  init_tables_index();
+  init_spans();
+  init_errors();
+  init_dashboard_util();
+  DashboardService = class DashboardService {
+    deps;
+    static INVITE_TOKEN_LENGTH = 48;
+    static INVITE_TTL_MS = 72 * 60 * 60 * 1000;
+    static RESET_TTL_MS = 24 * 60 * 60 * 1000;
+    constructor(deps) {
+      this.deps = deps;
+    }
+    async listUsers(slug, user) {
+      const game2 = await this.deps.validateDeveloperAccessBySlug(user, slug);
+      const rows = await this.deps.db.select({
+        id: gameDashboardUsers.id,
+        gameId: gameDashboardUsers.gameId,
+        email: gameDashboardUsers.email,
+        displayName: gameDashboardUsers.displayName,
+        role: gameDashboardUsers.role,
+        platformUserId: gameDashboardUsers.platformUserId,
+        createdAt: gameDashboardUsers.createdAt,
+        updatedAt: gameDashboardUsers.updatedAt,
+        pending: sql`(${gameDashboardUsers.passwordHash} IS NULL)`
+      }).from(gameDashboardUsers).where(eq(gameDashboardUsers.gameId, game2.id)).orderBy(asc(gameDashboardUsers.createdAt));
+      setAttributes({
+        "app.dashboard.operation": "list_users",
+        "app.dashboard.result_count": rows.length
+      });
+      return rows;
+    }
+    async addUser(slug, user, input) {
+      const game2 = await this.deps.validateDeveloperAccessBySlug(user, slug);
+      const email = input.email.toLowerCase();
+      setAttributes({
+        "app.dashboard.operation": "add_user",
+        "app.dashboard.user_role": input.role
+      });
+      const existing = await this.findByEmail(game2.id, email);
+      if (existing) {
+        throw alreadyExists(game2.id);
+      }
+      const inviteToken = await generateSecureRandomString(DashboardService.INVITE_TOKEN_LENGTH);
+      let created;
+      try {
+        [created] = await this.deps.db.insert(gameDashboardUsers).values({
+          gameId: game2.id,
+          email,
+          displayName: input.displayName,
+          role: input.role,
+          inviteTokenHash: await hashDashboardToken(inviteToken),
+          inviteExpiresAt: new Date(Date.now() + DashboardService.INVITE_TTL_MS),
+          platformUserId: email === user.email.toLowerCase() ? user.id : undefined
+        }).returning();
+      } catch (error) {
+        if (isUniqueViolation(error)) {
+          throw alreadyExists(game2.id);
+        }
+        throw error;
+      }
+      if (!created) {
+        throw new ValidationError("Failed to create dashboard user");
+      }
+      return { user: DashboardService.toSummary(created), token: inviteToken, kind: "invite" };
+    }
+    async removeUser(slug, user, dashboardUserId) {
+      const game2 = await this.deps.validateDeveloperAccessBySlug(user, slug);
+      setAttributes({
+        "app.dashboard.operation": "remove_user",
+        "app.dashboard.user_id": dashboardUserId
+      });
+      const [deleted] = await this.deps.db.delete(gameDashboardUsers).where(and(eq(gameDashboardUsers.gameId, game2.id), eq(gameDashboardUsers.id, dashboardUserId))).returning({ id: gameDashboardUsers.id });
+      if (!deleted) {
+        throw new NotFoundError("Dashboard user", dashboardUserId);
+      }
+    }
+    async verifyLogin(slug, input) {
+      const game2 = await this.getGameForRuntime(slug);
+      setAttributes({ "app.dashboard.operation": "verify_login" });
+      const dashboardUser = await this.findByEmail(game2.id, input.email.toLowerCase());
+      if (!dashboardUser?.passwordHash) {
+        throw new UnauthorizedError("Invalid credentials");
+      }
+      if (dashboardUser.lastFailedLoginAt) {
+        const retryAt = dashboardUser.lastFailedLoginAt.getTime() + loginBackoffMs(dashboardUser.failedLoginAttempts);
+        if (retryAt > Date.now()) {
+          addEvent("dashboard.login_throttled", {
+            "app.dashboard.failed_attempts": dashboardUser.failedLoginAttempts
+          });
+          throw new RateLimitError("Too many failed attempts — try again shortly", {
+            retryAfterSeconds: Math.ceil((retryAt - Date.now()) / 1000)
+          });
+        }
+      }
+      const valid = await this.deps.verifyPassword({
+        hash: dashboardUser.passwordHash,
+        password: input.password
+      });
+      if (!valid) {
+        await this.deps.db.update(gameDashboardUsers).set({
+          failedLoginAttempts: sql`${gameDashboardUsers.failedLoginAttempts} + 1`,
+          lastFailedLoginAt: new Date
+        }).where(eq(gameDashboardUsers.id, dashboardUser.id));
+        throw new UnauthorizedError("Invalid credentials");
+      }
+      if (dashboardUser.failedLoginAttempts > 0) {
+        await this.deps.db.update(gameDashboardUsers).set({ failedLoginAttempts: 0, lastFailedLoginAt: null }).where(eq(gameDashboardUsers.id, dashboardUser.id));
+      }
+      return DashboardService.toSummary(dashboardUser);
+    }
+    async acceptInvite(slug, input) {
+      const game2 = await this.getGameForRuntime(slug);
+      setAttributes({ "app.dashboard.operation": "accept_invite" });
+      const tokenHash = await hashDashboardToken(input.token);
+      const invited = await this.deps.db.query.gameDashboardUsers.findFirst({
+        where: and(eq(gameDashboardUsers.gameId, game2.id), eq(gameDashboardUsers.inviteTokenHash, tokenHash))
+      });
+      if (!invited) {
+        throw new UnauthorizedError("Invalid or already-used invite token");
+      }
+      if (invited.inviteExpiresAt && invited.inviteExpiresAt.getTime() < Date.now()) {
+        throw new UnauthorizedError("This invite has expired — ask for a new one");
+      }
+      const passwordHash = await this.deps.hashPassword(input.password);
+      const [updated] = await this.deps.db.update(gameDashboardUsers).set({
+        passwordHash,
+        inviteTokenHash: null,
+        inviteExpiresAt: null,
+        updatedAt: new Date
+      }).where(and(eq(gameDashboardUsers.id, invited.id), eq(gameDashboardUsers.inviteTokenHash, tokenHash), isNull(gameDashboardUsers.passwordHash))).returning();
+      if (!updated) {
+        throw new UnauthorizedError("Invalid or already-used invite token");
+      }
+      return DashboardService.toSummary(updated);
+    }
+    async acceptReset(slug, input) {
+      const game2 = await this.getGameForRuntime(slug);
+      setAttributes({ "app.dashboard.operation": "accept_reset" });
+      const tokenHash = await hashDashboardToken(input.token);
+      const found = await this.deps.db.query.gameDashboardUsers.findFirst({
+        where: and(eq(gameDashboardUsers.gameId, game2.id), eq(gameDashboardUsers.resetTokenHash, tokenHash))
+      });
+      if (!found) {
+        throw new UnauthorizedError("Invalid or already-used reset token");
+      }
+      if (found.resetExpiresAt && found.resetExpiresAt.getTime() < Date.now()) {
+        throw new UnauthorizedError("This reset link has expired — ask for a new one");
+      }
+      const passwordHash = await this.deps.hashPassword(input.password);
+      const [updated] = await this.deps.db.update(gameDashboardUsers).set({
+        passwordHash,
+        resetTokenHash: null,
+        resetExpiresAt: null,
+        inviteTokenHash: null,
+        inviteExpiresAt: null,
+        failedLoginAttempts: 0,
+        lastFailedLoginAt: null,
+        updatedAt: new Date
+      }).where(and(eq(gameDashboardUsers.id, found.id), eq(gameDashboardUsers.resetTokenHash, tokenHash))).returning();
+      if (!updated) {
+        throw new UnauthorizedError("Invalid or already-used reset token");
+      }
+      return DashboardService.toSummary(updated);
+    }
+    async issueRecoveryLink(slug, user, dashboardUserId) {
+      const game2 = await this.deps.validateDeveloperAccessBySlug(user, slug);
+      const existing = await this.deps.db.query.gameDashboardUsers.findFirst({
+        where: and(eq(gameDashboardUsers.gameId, game2.id), eq(gameDashboardUsers.id, dashboardUserId))
+      });
+      if (!existing) {
+        throw new NotFoundError("Dashboard user", dashboardUserId);
+      }
+      const kind = existing.passwordHash ? "reset" : "invite";
+      setAttributes({
+        "app.dashboard.operation": "issue_recovery_link",
+        "app.dashboard.recovery_kind": kind
+      });
+      const token = await generateSecureRandomString(DashboardService.INVITE_TOKEN_LENGTH);
+      const tokenHash = await hashDashboardToken(token);
+      const fields = kind === "invite" ? {
+        inviteTokenHash: tokenHash,
+        inviteExpiresAt: new Date(Date.now() + DashboardService.INVITE_TTL_MS)
+      } : {
+        resetTokenHash: tokenHash,
+        resetExpiresAt: new Date(Date.now() + DashboardService.RESET_TTL_MS)
+      };
+      const [updated] = await this.deps.db.update(gameDashboardUsers).set({ ...fields, updatedAt: new Date }).where(eq(gameDashboardUsers.id, existing.id)).returning();
+      if (!updated) {
+        throw new NotFoundError("Dashboard user", dashboardUserId);
+      }
+      return { user: DashboardService.toSummary(updated), token, kind };
+    }
+    async getGameForRuntime(slug) {
+      const game2 = await this.deps.db.query.games.findFirst({
+        where: eq(games.slug, slug),
+        columns: { id: true }
+      });
+      if (!game2) {
+        throw new NotFoundError("Game", slug);
+      }
+      return game2;
+    }
+    async findByEmail(gameId, email) {
+      const row = await this.deps.db.query.gameDashboardUsers.findFirst({
+        where: and(eq(gameDashboardUsers.gameId, gameId), eq(gameDashboardUsers.email, email))
+      });
+      return row ?? null;
+    }
+    static toSummary(row) {
+      return {
+        id: row.id,
+        gameId: row.gameId,
+        email: row.email,
+        displayName: row.displayName,
+        role: row.role,
+        platformUserId: row.platformUserId,
+        createdAt: row.createdAt,
+        updatedAt: row.updatedAt,
+        pending: !row.passwordHash
+      };
+    }
+  };
+});
+
+// ../data/src/domains/game/helpers.ts
+function activeDeploymentWhere(gameId, target = "game") {
+  return and(eq(gameDeployments.gameId, gameId), eq(gameDeployments.target, target), eq(gameDeployments.isActive, true));
+}
+var init_helpers = __esm(() => {
+  init_drizzle_orm();
+  init_table5();
+});
+
+// ../data/src/domains/timeback/helpers.ts
+function isActiveGameTimebackIntegrationStatus(statusColumn = gameTimebackIntegrations.status) {
+  return sql`${statusColumn} IS DISTINCT FROM ${DEACTIVATED_GAME_TIMEBACK_INTEGRATION_STATUS}`;
+}
+var ACTIVE_GAME_TIMEBACK_INTEGRATION_STATUS = "active", DEACTIVATED_GAME_TIMEBACK_INTEGRATION_STATUS = "deactivated";
+var init_helpers2 = __esm(() => {
+  init_drizzle_orm();
+  init_table7();
+});
+
+// ../data/src/helpers.index.ts
+var init_helpers_index = __esm(() => {
+  init_helpers();
+  init_helpers2();
+});
+
 // ../../node_modules/.bun/process-nextick-args@2.0.1/node_modules/process-nextick-args/index.js
 var require_process_nextick_args = __commonJS((exports, module2) => {
   if (typeof process === "undefined" || !process.version || process.version.indexOf("v0.") === 0 || process.version.indexOf("v1.") === 0 && process.version.indexOf("v1.8.") !== 0) {
@@ -22087,8 +22466,8 @@ var require_lib3 = __commonJS((exports, module2) => {
 });
 
 // ../utils/src/zip.ts
-import { mkdir, writeFile } from "fs/promises";
-import { join as join2 } from "path";
+import { mkdir, readdir, readFile, writeFile } from "fs/promises";
+import { join as join2, relative, sep } from "path";
 async function extractZipToDirectory(zipBuffer, targetDir) {
   try {
     const zip = await import_jszip.default.loadAsync(zipBuffer);
@@ -22114,9 +22493,10 @@ async function extractZipToDirectory(zipBuffer, targetDir) {
       fileCount: Object.keys(zip.files).length
     });
   } catch (error) {
-    const errorMessage2 = error instanceof Error ? error.message : String(error);
     log.error("[utils/zip] Failed to extract ZIP", { targetDir, error });
-    throw new Error(`Failed to extract ZIP to ${targetDir}: ${errorMessage2}`, { cause: error });
+    throw new Error(`Failed to extract ZIP to ${targetDir}: ${errorMessage(error)}`, {
+      cause: error
+    });
   }
 }
 var import_jszip;
@@ -22386,6 +22766,7 @@ class DeployJobService {
     jobId,
     leaseId,
     leaseLost,
+    target,
     game: game2,
     user,
     error
@@ -22415,9 +22796,12 @@ class DeployJobService {
       }
     }
     if (!effectiveLeaseLost) {
-      await this.deps.notifyDeploymentFailure(game2.slug, game2.displayName, message, {
-        id: user.id,
-        email: user.email
+      await this.deps.notifyDeploymentFailure({
+        slug: game2.slug,
+        displayName: game2.displayName,
+        error: message,
+        target,
+        developer: { id: user.id, email: user.email }
       });
     }
     await this.deleteCodeBundle(jobId);
@@ -22519,7 +22903,7 @@ class DeployJobService {
       }
       assertLease();
       const activeDeployment = await this.deps.db.query.gameDeployments.findFirst({
-        where: and(eq(gameDeployments.gameId, job.gameId), eq(gameDeployments.isActive, true)),
+        where: activeDeploymentWhere(job.gameId, request.target ?? "game"),
         columns: {
           deploymentId: true,
           url: true
@@ -22542,7 +22926,15 @@ class DeployJobService {
     } catch (error) {
       clearInterval(heartbeat);
       setAttribute("app.deploy_job.run_duration_ms", DeployJobService.elapsedMsSince(new Date(runStartedAt)));
-      await this.handleRunError({ jobId, leaseId, leaseLost, game: game2, user, error });
+      await this.handleRunError({
+        jobId,
+        leaseId,
+        leaseLost,
+        target: request.target ?? "game",
+        game: game2,
+        user,
+        error
+      });
       throw error;
     }
   }
@@ -22561,6 +22953,7 @@ async function forceMarkDeployJobFailed(db2, jobId, error) {
 var STATUS_MAP2, DEPLOY_JOB_LEASE_MS, DEPLOY_JOB_HEARTBEAT_MS, DEPLOY_JOB_CODE_BUNDLE_PREFIX = "deploy-job-code";
 var init_deploy_job_service = __esm(() => {
   init_drizzle_orm();
+  init_helpers_index();
   init_tables_index();
   init_spans();
   init_zip();
@@ -24704,7 +25097,7 @@ var init_bindings = __esm(() => {
 });
 
 // ../cloudflare/src/playcademy/provider/helpers.ts
-var init_helpers = __esm(() => {
+var init_helpers3 = __esm(() => {
   init_mime();
 });
 
@@ -24716,7 +25109,7 @@ var init_provider = __esm(() => {
   init_constants2();
   init_assets_config();
   init_bindings();
-  init_helpers();
+  init_helpers3();
 });
 // ../cloudflare/src/playcademy/provider/index.ts
 var init_provider2 = __esm(() => {
@@ -27135,26 +27528,70 @@ var init_playcademy = __esm(() => {
 });
 
 // ../utils/src/tunnel.ts
-async function getTunnelUrl() {
-  let response;
+function servicePort(service) {
+  if (!service) {
+    return null;
+  }
   try {
-    response = await fetch(`${METRICS_BASE}/config`);
+    const url = new URL(service);
+    return url.port || (url.protocol === "https:" ? "443" : "80");
   } catch {
-    throw new Error("Local tunnel is not running. Start it with `bun dev` or `bun scripts/infra/tunnel.ts`.");
+    return null;
   }
-  if (!response.ok) {
-    throw new Error(`Tunnel metrics endpoint returned ${response.status}`);
+}
+async function readTunnelIngress(port) {
+  try {
+    const response = await fetch(`http://127.0.0.1:${port}/config`, {
+      signal: AbortSignal.timeout(1000)
+    });
+    if (!response.ok) {
+      return null;
+    }
+    const data = await response.json();
+    return data.config?.ingress ?? [];
+  } catch {
+    return null;
+  }
+}
+function matchingHostname(rules, expectedPort) {
+  for (const rule of rules ?? []) {
+    if (rule.hostname && servicePort(rule.service) === expectedPort) {
+      return rule.hostname;
+    }
+  }
+  return null;
+}
+async function getTunnelUrl(platformBaseUrl) {
+  const expectedPort = servicePort(platformBaseUrl);
+  if (!expectedPort) {
+    throw new Error(`Cannot resolve a tunnel for unparseable platform URL '${platformBaseUrl}'`);
+  }
+  const cachedPort = matchedPorts.get(expectedPort);
+  if (cachedPort !== undefined) {
+    const hostname = matchingHostname(await readTunnelIngress(cachedPort), expectedPort);
+    if (hostname) {
+      return `https://${hostname}`;
+    }
+    matchedPorts.delete(expectedPort);
+  }
+  const ports = Array.from({ length: TUNNEL_METRICS_PORT_RANGE }, (_, offset) => TUNNEL_METRICS_PORT + offset);
+  const results = await Promise.all(ports.map(async (port) => ({ port, rules: await readTunnelIngress(port) })));
+  for (const { port, rules } of results) {
+    const hostname = matchingHostname(rules, expectedPort);
+    if (hostname) {
+      matchedPorts.set(expectedPort, port);
+      return `https://${hostname}`;
+    }
   }
-  const data = await response.json();
-  const hostname = data.config.ingress.find((r) => r.hostname)?.hostname;
-  if (!hostname) {
-    throw new Error("Tunnel is running but no hostname found in ingress config");
+  const foreign = results.flatMap(({ rules }) => (rules ?? []).filter((rule) => rule.hostname).map((rule) => `${rule.hostname} -> ${rule.service}`));
+  if (foreign.length > 0) {
+    throw new Error(`A local tunnel is running, but none route to the platform at ${platformBaseUrl} (found: ${foreign.join(", ")}). ${TUNNEL_START_HINT}`);
   }
-  return `https://${hostname}`;
+  throw new Error(`Local tunnel is not running. ${TUNNEL_START_HINT}`);
 }
-var TUNNEL_METRICS_PORT = 20241, METRICS_BASE;
+var TUNNEL_METRICS_PORT = 20241, TUNNEL_METRICS_PORT_RANGE = 10, TUNNEL_START_HINT = "Start this platform's tunnel with `bun dev` or `bun run tunnel`.", matchedPorts;
 var init_tunnel = __esm(() => {
-  METRICS_BASE = `http://127.0.0.1:${TUNNEL_METRICS_PORT}`;
+  matchedPorts = new Map;
 });
 
 // ../utils/src/stages.ts
@@ -27167,7 +27604,7 @@ var init_stages = __esm(() => {
 });
 
 // ../api-core/src/utils/deployment.util.ts
-function getDeploymentId(gameSlug, sstStage) {
+function getGameDeploymentId(gameSlug, sstStage) {
   if (sstStage === "production") {
     return gameSlug;
   }
@@ -27176,45 +27613,57 @@ function getDeploymentId(gameSlug, sstStage) {
   }
   return `${WORKER_NAMING.LOCAL_PREFIX}${sstStage}-${gameSlug}`;
 }
+function getDashboardDeploymentId(gameSlug, sstStage) {
+  return `${getGameDeploymentId(gameSlug, sstStage)}${DASHBOARD_WORKER_SUFFIX}`;
+}
 function getGameWorkerApiKeyName(slug) {
-  return `game-worker-${slug}`.substring(0, 32);
+  return `${GAME_WORKER_KEY_PREFIX}${slug}`.substring(0, 32);
+}
+function getDashboardWorkerApiKeyName(slug) {
+  return `${DASHBOARD_WORKER_KEY_PREFIX}${slug}`;
 }
 function toBindingName(queueKey) {
   return `${queueKey.replace(/-/g, "_").toUpperCase()}_QUEUE`;
 }
-async function generateDeploymentHash(code) {
-  const encoder = new TextEncoder;
-  const data = encoder.encode(code);
-  const hashBuffer = await crypto.subtle.digest("SHA-256", data);
-  const hashArray = [...new Uint8Array(hashBuffer)];
-  return hashArray.map((b) => b.toString(16).padStart(2, "0")).join("");
+function generateDeploymentHash(code) {
+  return sha256Hex(code);
 }
+var GAME_WORKER_KEY_PREFIX = "game-worker-", DASHBOARD_WORKER_KEY_PREFIX = "dash-worker-";
 var init_deployment_util = __esm(() => {
   init_src();
   init_stages();
 });
 
+// ../api-core/src/utils/worker-keys.util.ts
+async function sweepDashboardWorkerKeys(deleteApiKeysByName, slug) {
+  try {
+    await deleteApiKeysByName(getDashboardWorkerApiKeyName(slug));
+  } catch (error) {
+    addEvent("dashboard.worker_key_sweep_failed", {
+      "exception.type": errorType(error),
+      "app.error.message": errorMessage(error)
+    });
+  }
+}
+var init_worker_keys_util = __esm(() => {
+  init_spans();
+  init_deployment_util();
+});
+
 // ../api-core/src/services/deploy.service.ts
+function readDashboardTheme(config2) {
+  const theme = config2?.dashboard?.theme;
+  return {
+    ...typeof theme?.primary === "string" && { primary: theme.primary },
+    ...typeof theme?.secondary === "string" && { secondary: theme.secondary }
+  };
+}
+
 class DeployService {
   deps;
   constructor(deps) {
     this.deps = deps;
   }
-  static classifyDeployType(flags2) {
-    if (flags2.hasBackend && flags2.hasFrontend) {
-      return "full_stack";
-    }
-    if (flags2.hasFrontend) {
-      return "frontend_only";
-    }
-    if (flags2.hasBackend) {
-      return "backend_only";
-    }
-    return "metadata_only";
-  }
-  static countDeadLetterQueues(bindings) {
-    return bindings?.queues?.filter((queue) => Boolean(queue.deadLetterQueue)).length ?? 0;
-  }
   getCloudflare() {
     const cf = this.deps.cloudflare;
     if (!cf) {
@@ -27222,86 +27671,307 @@ class DeployService {
     }
     return cf;
   }
-  async createApiKey(user, slug, keyName) {
-    const { key: apiKey } = await this.deps.createAuthApiKey({
-      userId: user.id,
-      name: keyName,
-      expiresIn: null,
-      permissions: {
-        games: [`read:${slug}`, `write:${slug}`]
-      },
-      rateLimitEnabled: false
-    });
-    setAttribute("app.deploy.api_key_outcome", "created");
-    return apiKey;
-  }
-  async regenerateApiKey(user, slug, existingKeyId, keyName) {
-    if (existingKeyId) {
-      setAttribute("app.deploy.api_key_outcome", "regenerated");
-      try {
-        await this.deps.deleteAuthApiKey(existingKeyId);
-      } catch (error) {
-        addEvent("deploy.api_key_revoke_failed", {
-          "exception.type": errorType(error),
-          "app.error.message": errorMessage(error),
-          "app.deploy.old_key_id": existingKeyId
-        });
+  async* deploy(slug, request, user, uploadDeps, extractZip) {
+    const game2 = await this.deps.validateDeveloperAccessBySlug(user, slug);
+    const context2 = { slug, request, user, game: game2, uploadDeps, extractZip };
+    switch (request.target ?? "game") {
+      case "dashboard": {
+        yield* this.deployDashboard(context2);
+        break;
+      }
+      case "game": {
+        yield* this.deployGame(context2);
+        break;
+      }
+      default: {
+        throw new ValidationError("Invalid deployment target");
       }
     }
-    return this.createApiKey(user, slug, keyName);
   }
-  async ensureApiKeyOnWorker(user, slug, deploymentId) {
+  async* deployGame(context2) {
+    const { slug, request, user, game: game2, uploadDeps, extractZip } = context2;
     const cf = this.getCloudflare();
-    const keyName = getGameWorkerApiKeyName(slug);
-    const existingKey = await this.deps.db.query.apikey.findFirst({
-      where: and(eq(apikey.userId, user.id), eq(apikey.name, keyName)),
+    const db2 = this.deps.db;
+    const flags2 = this.validateGameRequest(request);
+    const { hasBackend, hasFrontend } = flags2;
+    const deploymentId = getGameDeploymentId(slug, this.deps.config.sstStage);
+    let frontendAssetsPath;
+    let tempDir;
+    if (hasFrontend) {
+      if (!uploadDeps || !extractZip) {
+        throw new ValidationError("Upload dependencies not configured for frontend deployment");
+      }
+      yield { type: "status", data: { message: "Fetching temporary files" } };
+      const extracted = await this.fetchAndExtractFrontendAssets(slug, game2.id, request.uploadToken, uploadDeps, extractZip);
+      tempDir = extracted.tempDir;
+      frontendAssetsPath = extracted.assetsPath;
+      yield { type: "status", data: { message: "Extracting assets" } };
+    }
+    const platformBaseUrl = await this.resolvePlatformBaseUrl();
+    const env = {
+      GAME_ID: game2.id,
+      PLAYCADEMY_BASE_URL: platformBaseUrl,
+      PLAYCADEMY_PLATFORM_SERVICE_JWKS: this.deps.config.platformServiceJwt?.publicJwks
+    };
+    yield {
+      type: "status",
+      data: { message: hasBackend ? "Deploying backend code" : "Deploying to platform" }
+    };
+    const keepAssets = hasBackend && !hasFrontend;
+    const deploymentOptions = this.mapGameBindingsToOptions(deploymentId, request.bindings, request.schema);
+    const bindings = deploymentOptions?.bindings;
+    setAttributes({
+      "app.deploy.has_d1": Boolean(bindings?.d1?.length),
+      "app.deploy.has_kv": Boolean(bindings?.kv?.length),
+      "app.deploy.has_r2": Boolean(bindings?.r2?.length),
+      "app.deploy.queue_count": bindings?.queues?.length ?? 0,
+      "app.deploy.dead_letter_queue_count": DeployService.countDeadLetterQueues(bindings)
+    });
+    const activeDeployment = await db2.query.gameDeployments.findFirst({
+      where: activeDeploymentWhere(game2.id, "game"),
+      columns: { resources: true }
+    });
+    if (deploymentOptions?.bindings?.d1?.length) {
+      await this.cleanupOrphanD1Databases(cf, deploymentOptions.bindings.d1, slug, game2.id);
+    }
+    const result = await this.deployToCloudflare({
+      deploymentId,
+      code: request.code,
+      env,
+      tempDir,
+      options: {
+        ...deploymentOptions,
+        compatibilityDate: request.compatibilityDate ?? CLOUDFLARE_COMPATIBILITY_DATE,
+        compatibilityFlags: request.compatibilityFlags,
+        existingResources: activeDeployment?.resources ?? undefined,
+        assetsPath: frontendAssetsPath,
+        keepAssets
+      }
+    });
+    yield { type: "status", data: { message: "Finalizing deployment" } };
+    const updatedGame = await this.finalizeGameDeployment({
+      game: game2,
+      slug,
+      deploymentId,
+      result,
+      request,
+      user,
+      flags: flags2
+    });
+    yield { type: "complete", data: updatedGame };
+  }
+  async* deployDashboard(context2) {
+    const { slug, request, user, game: game2 } = context2;
+    const db2 = this.deps.db;
+    const contract = this.validateDashboardRequest(request, context2.uploadDeps, context2.extractZip);
+    const deploymentId = getDashboardDeploymentId(slug, this.deps.config.sstStage);
+    if (deploymentId.length > MAX_WORKER_NAME_LENGTH) {
+      throw new ValidationError(`Dashboard worker name '${deploymentId}' exceeds Cloudflare's ${MAX_WORKER_NAME_LENGTH}-character limit — shorten the game slug`);
+    }
+    const collidingGame = await db2.query.games.findFirst({
+      where: eq(games.slug, `${slug}${DASHBOARD_WORKER_SUFFIX}`),
       columns: { id: true }
     });
-    let apiKey;
-    if (!existingKey) {
-      apiKey = await this.createApiKey(user, slug, keyName);
-    } else {
-      try {
-        const workerSecrets = await cf.listSecrets(deploymentId);
-        if (workerSecrets.includes("PLAYCADEMY_API_KEY")) {
-          setAttribute("app.deploy.api_key_outcome", "already_set");
-          return;
-        }
-      } catch (error) {
-        addEvent("deploy.worker_secrets_check_failed", {
-          "exception.type": errorType(error),
-          "app.error.message": errorMessage(error)
-        });
+    if (collidingGame) {
+      throw new ValidationError(`Cannot deploy this dashboard: an existing game's slug is '${slug}${DASHBOARD_WORKER_SUFFIX}', which owns the '${deploymentId}' worker name`);
+    }
+    const gameDeployment = await db2.query.gameDeployments.findFirst({
+      where: activeDeploymentWhere(game2.id, "game"),
+      columns: { resources: true }
+    });
+    if (!gameDeployment) {
+      throw new ValidationError("Deploy the game before its dashboard — the dashboard attaches to the game deployment");
+    }
+    setAttributes({
+      "app.deploy.type": "dashboard",
+      "app.deploy.deployment_id": deploymentId,
+      "app.deploy.code_size": contract.code.length,
+      "app.deploy.compatibility_date": request.compatibilityDate ?? CLOUDFLARE_COMPATIBILITY_DATE,
+      "app.deploy.compatibility_flag_count": request.compatibilityFlags?.length ?? 0
+    });
+    yield { type: "status", data: { message: "Fetching temporary files" } };
+    const [{ tempDir, assetsPath }, platformBaseUrl, dashboardActive] = await Promise.all([
+      this.fetchAndExtractFrontendAssets(slug, game2.id, contract.uploadToken, contract.uploadDeps, contract.extractZip),
+      this.resolvePlatformBaseUrl(),
+      db2.query.gameDeployments.findFirst({
+        where: activeDeploymentWhere(game2.id, "dashboard"),
+        columns: { resources: true }
+      })
+    ]);
+    yield { type: "status", data: { message: "Extracting assets" } };
+    const theme = readDashboardTheme(request.config);
+    const env = {
+      GAME_ID: game2.id,
+      GAME_SLUG: slug,
+      GAME_NAME: game2.displayName,
+      ...game2.metadata?.emoji && { GAME_EMOJI: game2.metadata.emoji },
+      ...theme.primary && { DASHBOARD_THEME_PRIMARY: theme.primary },
+      ...theme.secondary && { DASHBOARD_THEME_SECONDARY: theme.secondary },
+      PLAYCADEMY_BASE_URL: platformBaseUrl,
+      PLAYCADEMY_PLATFORM_SERVICE_JWKS: this.deps.config.platformServiceJwt?.publicJwks
+    };
+    const gameResources = gameDeployment.resources;
+    const bindings = {
+      d1: gameResources?.d1?.map((database) => database.name) ?? [],
+      kv: gameResources?.kv?.map((namespace) => namespace.name) ?? [],
+      r2: gameResources?.r2?.filter((bucket) => bucket.kind !== "assets").map((bucket) => bucket.name) ?? []
+    };
+    const existingResources = {
+      ...dashboardActive?.resources,
+      d1: gameResources?.d1,
+      kv: gameResources?.kv,
+      r2: gameResources?.r2
+    };
+    yield { type: "status", data: { message: "Deploying dashboard" } };
+    const result = await this.deployToCloudflare({
+      deploymentId,
+      code: contract.code,
+      env,
+      tempDir,
+      options: {
+        bindings,
+        compatibilityDate: request.compatibilityDate ?? CLOUDFLARE_COMPATIBILITY_DATE,
+        compatibilityFlags: request.compatibilityFlags,
+        existingResources,
+        assetsPath,
+        keepAssets: false,
+        assetsConfig: { run_worker_first: true }
       }
-      apiKey = await this.regenerateApiKey(user, slug, existingKey.id, keyName);
+    });
+    yield { type: "status", data: { message: "Finalizing deployment" } };
+    await withSpan("deploy.configure_worker_secrets", async () => {
+      const existingSecrets = await this.listWorkerSecretNames(result.deploymentId);
+      await this.ensureWorkerApiKeyOnWorker(user, DeployService.dashboardWorkerKeySpec(slug), result.deploymentId, existingSecrets);
+      await this.ensureDashboardSessionSecret(result.deploymentId, existingSecrets, Boolean(dashboardActive));
+    });
+    const codeHash = await generateDeploymentHash(contract.code);
+    await this.saveDeployment({
+      gameId: game2.id,
+      deploymentId: result.deploymentId,
+      url: result.url,
+      codeHash,
+      resources: result.resources,
+      target: "dashboard"
+    });
+    setAttribute("app.deploy.code_hash", codeHash);
+    try {
+      await withSpan("deploy.send_alert", () => this.deps.alerts.notifyDashboardDeployment({
+        slug,
+        displayName: game2.displayName,
+        url: result.url,
+        developer: { id: user.id, email: user.email }
+      }));
+    } catch (error) {
+      setAttribute("app.alerts.delivery", "failed");
+      setAttribute("app.alerts.delivery_error", errorMessage(error));
+      setAttribute("app.alerts.type", "dashboard_deployment");
     }
-    await cf.setSecrets(deploymentId, { PLAYCADEMY_API_KEY: apiKey });
+    yield { type: "complete", data: game2 };
   }
-  async ensureQueueIngressSecretOnWorker(slug, deploymentId) {
-    const secret = this.deps.config.queueIngressSecret;
-    if (!secret) {
-      return;
+  validateGameRequest(request) {
+    const hasBackend = Boolean(request.code);
+    const hasFrontend = Boolean(request.uploadToken);
+    const hasMetadata = Boolean(request.metadata);
+    setAttributes({
+      "app.deploy.has_backend": hasBackend,
+      "app.deploy.has_frontend": hasFrontend,
+      "app.deploy.has_metadata": hasMetadata,
+      "app.deploy.type": DeployService.classifyGameDeployType({
+        hasBackend,
+        hasFrontend,
+        hasMetadata
+      }),
+      "app.deploy.code_size": request.code?.length ?? 0,
+      "app.deploy.compatibility_date": request.compatibilityDate ?? CLOUDFLARE_COMPATIBILITY_DATE,
+      "app.deploy.compatibility_flag_count": request.compatibilityFlags?.length ?? 0,
+      "app.deploy.has_schema": Boolean(request.schema)
+    });
+    if (!hasBackend && !hasFrontend && !hasMetadata) {
+      throw new ValidationError("Must provide at least one of: uploadToken (frontend), code (backend), or metadata");
     }
-    const cf = this.getCloudflare();
-    await cf.setSecrets(deploymentId, { QUEUE_INGRESS_SECRET: secret });
+    if (!this.deps.config.baseUrl) {
+      throw new ValidationError("baseUrl is not configured");
+    }
+    return { hasBackend, hasFrontend, hasMetadata };
   }
-  async fetchAndExtractFrontendAssets(slug, gameId, uploadToken, uploadDeps, extractZip) {
-    const frontendZip = await withSpan("deploy.fetch_temporary_files", () => uploadDeps.getObjectAsByteArray(uploadToken));
-    if (!frontendZip || frontendZip.length === 0) {
-      throw new ValidationError("Uploaded file is empty or not found");
+  validateDashboardRequest(request, uploadDeps, extractZip) {
+    if (!request.code || !request.uploadToken) {
+      throw new ValidationError("Dashboard deployments require both worker code and an asset upload");
     }
-    setAttribute("app.deploy.asset_upload_size", frontendZip.length);
-    const os2 = await import("os");
-    const path = await import("path");
-    const tempDir = path.join(os2.tmpdir(), `playcademy-deploy-${gameId}-${Date.now()}`);
-    const assetsPath = path.join(tempDir, "dist");
-    await withSpan("deploy.extract_assets", () => extractZip(frontendZip, assetsPath));
-    uploadDeps.deleteObject(uploadToken).catch(catchAttrs("deploy.temp_cleanup"));
-    return { frontendZip, tempDir, assetsPath };
+    if (request.metadata) {
+      throw new ValidationError("Dashboard deployments cannot update game metadata");
+    }
+    if (!uploadDeps || !extractZip) {
+      throw new ValidationError("Upload dependencies not configured for frontend deployment");
+    }
+    if (!this.deps.config.baseUrl) {
+      throw new ValidationError("baseUrl is not configured");
+    }
+    return { code: request.code, uploadToken: request.uploadToken, uploadDeps, extractZip };
+  }
+  static classifyGameDeployType(flags2) {
+    if (flags2.hasBackend && flags2.hasFrontend) {
+      return "full_stack";
+    }
+    if (flags2.hasFrontend) {
+      return "frontend_only";
+    }
+    if (flags2.hasBackend) {
+      return "backend_only";
+    }
+    return "metadata_only";
+  }
+  mapGameBindingsToOptions(deploymentId, bindings, schema2) {
+    if (!bindings && !schema2) {
+      return;
+    }
+    const workerBindings = {};
+    if (bindings?.database) {
+      workerBindings.d1 = [deploymentId];
+    }
+    if (bindings?.keyValue) {
+      workerBindings.kv = [deploymentId];
+    }
+    if (bindings?.bucket) {
+      workerBindings.r2 = [deploymentId];
+    }
+    if (bindings?.queues) {
+      let toQueueName = function(queueKey) {
+        return `${QUEUE_NAME_PREFIX}-${deploymentId}--${queueKey}`;
+      };
+      const queueNameByKey = new Map;
+      for (const queueKey of Object.keys(bindings.queues)) {
+        queueNameByKey.set(queueKey, toQueueName(queueKey));
+      }
+      workerBindings.queues = Object.entries(bindings.queues).map(([queueKey, queueConfig]) => {
+        const config2 = queueConfig === true ? undefined : queueConfig;
+        const deadLetterQueue = config2?.deadLetterQueue && queueNameByKey.get(config2.deadLetterQueue) ? queueNameByKey.get(config2.deadLetterQueue) : undefined;
+        return {
+          bindingName: toBindingName(queueKey),
+          queueName: toQueueName(queueKey),
+          settings: config2 ? {
+            maxBatchSize: config2.maxBatchSize,
+            maxRetries: config2.maxRetries,
+            maxBatchTimeout: config2.maxBatchTimeout,
+            maxConcurrency: config2.maxConcurrency,
+            retryDelay: config2.retryDelay
+          } : undefined,
+          deadLetterQueue
+        };
+      });
+    }
+    const hasBindings = workerBindings.d1?.length || workerBindings.kv?.length || workerBindings.r2?.length || workerBindings.queues?.length;
+    return {
+      ...hasBindings && { bindings: workerBindings },
+      ...schema2 && { schema: schema2 }
+    };
+  }
+  static countDeadLetterQueues(bindings) {
+    return bindings?.queues?.filter((queue) => Boolean(queue.deadLetterQueue)).length ?? 0;
   }
   async cleanupOrphanD1Databases(cf, d1Names, slug, gameId) {
     const hasAnyPriorDeployment = await this.deps.db.query.gameDeployments.findFirst({
-      where: eq(gameDeployments.gameId, gameId),
+      where: and(eq(gameDeployments.gameId, gameId), eq(gameDeployments.target, "game")),
       columns: { id: true }
     });
     if (hasAnyPriorDeployment) {
@@ -27336,33 +28006,7 @@ class DeployService {
     }
     await this.deps.db.update(games).set(updates).where(eq(games.id, gameId));
   }
-  validateDeployRequest(request) {
-    const hasBackend = Boolean(request.code);
-    const hasFrontend = Boolean(request.uploadToken);
-    const hasMetadata = Boolean(request.metadata);
-    setAttributes({
-      "app.deploy.has_backend": hasBackend,
-      "app.deploy.has_frontend": hasFrontend,
-      "app.deploy.has_metadata": hasMetadata,
-      "app.deploy.type": DeployService.classifyDeployType({
-        hasBackend,
-        hasFrontend,
-        hasMetadata
-      }),
-      "app.deploy.code_size": request.code?.length ?? 0,
-      "app.deploy.compatibility_date": request.compatibilityDate ?? CLOUDFLARE_COMPATIBILITY_DATE,
-      "app.deploy.compatibility_flag_count": request.compatibilityFlags?.length ?? 0,
-      "app.deploy.has_schema": Boolean(request.schema)
-    });
-    if (!hasBackend && !hasFrontend && !hasMetadata) {
-      throw new ValidationError("Must provide at least one of: uploadToken (frontend), code (backend), or metadata");
-    }
-    if (!this.deps.config.baseUrl) {
-      throw new ValidationError("baseUrl is not configured");
-    }
-    return { hasBackend, hasFrontend, hasMetadata };
-  }
-  async finalizeDeployment({
+  async finalizeGameDeployment({
     game: game2,
     slug,
     deploymentId,
@@ -27374,10 +28018,17 @@ class DeployService {
     const { hasBackend, hasFrontend, hasMetadata } = flags2;
     const db2 = this.deps.db;
     const codeHash = hasBackend ? await generateDeploymentHash(request.code) : null;
-    await this.saveDeployment(game2.id, result.deploymentId, result.url, codeHash, result.resources);
+    await this.saveDeployment({
+      gameId: game2.id,
+      deploymentId: result.deploymentId,
+      url: result.url,
+      codeHash,
+      resources: result.resources,
+      target: "game"
+    });
     if (hasBackend) {
       await withSpan("deploy.configure_worker_secrets", async () => {
-        await this.ensureApiKeyOnWorker(user, slug, result.deploymentId);
+        await this.ensureWorkerApiKeyOnWorker(user, DeployService.gameWorkerKeySpec(slug), result.deploymentId);
         await this.ensureQueueIngressSecretOnWorker(slug, result.deploymentId);
       });
     }
@@ -27410,169 +28061,232 @@ class DeployService {
     }
     return updatedGame;
   }
-  async* deploy(slug, request, user, uploadDeps, extractZip) {
-    const cf = this.getCloudflare();
-    const db2 = this.deps.db;
-    const game2 = await this.deps.validateDeveloperAccessBySlug(user, slug);
-    const flags2 = this.validateDeployRequest(request);
-    const { hasBackend, hasFrontend } = flags2;
-    const deploymentId = getDeploymentId(slug, this.deps.config.sstStage);
-    let frontendAssetsPath;
-    let tempDir;
-    if (hasFrontend) {
-      if (!uploadDeps || !extractZip) {
-        throw new ValidationError("Upload dependencies not configured for frontend deployment");
-      }
-      yield { type: "status", data: { message: "Fetching temporary files" } };
-      const extracted = await this.fetchAndExtractFrontendAssets(slug, game2.id, request.uploadToken, uploadDeps, extractZip);
-      tempDir = extracted.tempDir;
-      frontendAssetsPath = extracted.assetsPath;
-      yield { type: "status", data: { message: "Extracting assets" } };
-    }
-    let platformBaseUrl = this.deps.config.baseUrl;
-    if (this.deps.config.isLocal) {
-      try {
-        platformBaseUrl = await getTunnelUrl();
-      } catch {
-        setAttributes({
-          "app.deploy.tunnel_available": false,
-          "app.deploy.failure_kind": "local_tunnel_unavailable"
-        });
-        throw new ValidationError("Local tunnel is not running. Ensure cloudflared is installed (`brew install cloudflared`) and the tunnel DevCommand started successfully.");
-      }
-    }
-    const env = {
-      GAME_ID: game2.id,
-      PLAYCADEMY_BASE_URL: platformBaseUrl,
-      PLAYCADEMY_PLATFORM_SERVICE_JWKS: this.deps.config.platformServiceJwt?.publicJwks
+  static gameWorkerKeySpec(slug) {
+    return {
+      keyName: getGameWorkerApiKeyName(slug),
+      permissions: { games: [`read:${slug}`, `write:${slug}`] },
+      lookup: "owner-and-name"
     };
-    yield {
-      type: "status",
-      data: { message: hasBackend ? "Deploying backend code" : "Deploying to platform" }
+  }
+  static dashboardWorkerKeySpec(slug) {
+    return {
+      keyName: getDashboardWorkerApiKeyName(slug),
+      permissions: {
+        games: [`read:${slug}`],
+        [DASHBOARD_PERMISSION_NAMESPACE]: [dashboardCredentialScope(slug)]
+      },
+      rateLimit: { maxRequests: 300, timeWindowMs: 60000 },
+      lookup: "name",
+      isCurrent: (permissionsJson) => DeployService.hasDashboardCredentialScope(permissionsJson, slug)
     };
-    const keepAssets = hasBackend && !hasFrontend;
-    const deploymentOptions = this.mapBindingsToOptions(deploymentId, request.bindings, request.schema);
-    const bindings = deploymentOptions?.bindings;
-    setAttributes({
-      "app.deploy.has_d1": Boolean(bindings?.d1?.length),
-      "app.deploy.has_kv": Boolean(bindings?.kv?.length),
-      "app.deploy.has_r2": Boolean(bindings?.r2?.length),
-      "app.deploy.queue_count": bindings?.queues?.length ?? 0,
-      "app.deploy.dead_letter_queue_count": DeployService.countDeadLetterQueues(bindings)
-    });
-    const activeDeployment = await db2.query.gameDeployments.findFirst({
-      where: and(eq(gameDeployments.gameId, game2.id), eq(gameDeployments.isActive, true)),
-      columns: { resources: true }
-    });
-    if (deploymentOptions?.bindings?.d1?.length) {
-      await this.cleanupOrphanD1Databases(cf, deploymentOptions.bindings.d1, slug, game2.id);
+  }
+  static hasDashboardCredentialScope(permissionsJson, slug) {
+    if (!permissionsJson) {
+      return false;
     }
-    let result;
     try {
-      result = await withSpan("deploy.cloudflare", () => cf.deploy(deploymentId, request.code, env, {
-        ...deploymentOptions,
-        compatibilityDate: request.compatibilityDate ?? CLOUDFLARE_COMPATIBILITY_DATE,
-        compatibilityFlags: request.compatibilityFlags,
-        existingResources: activeDeployment?.resources ?? undefined,
-        assetsPath: frontendAssetsPath,
-        keepAssets
-      }));
-    } finally {
-      if (tempDir) {
-        const fs2 = await import("fs/promises");
-        fs2.rm(tempDir, { recursive: true, force: true }).catch(catchAttrs("deploy.temp_cleanup"));
+      const parsed = JSON.parse(permissionsJson);
+      return dashboardCredentialSlugs(parsed).includes(slug);
+    } catch {
+      return false;
+    }
+  }
+  async ensureWorkerApiKeyOnWorker(user, spec, deploymentId, existingSecrets) {
+    const cf = this.getCloudflare();
+    const existingKey = await this.deps.db.query.apikey.findFirst({
+      where: spec.lookup === "owner-and-name" ? and(eq(apikey.userId, user.id), eq(apikey.name, spec.keyName)) : eq(apikey.name, spec.keyName),
+      columns: { id: true, permissions: true }
+    });
+    let apiKey;
+    if (!existingKey) {
+      apiKey = await this.createApiKey(user, spec);
+    } else {
+      const current = spec.isCurrent?.(existingKey.permissions) ?? true;
+      const workerHasKey = existingSecrets ? existingSecrets.includes("PLAYCADEMY_API_KEY") : await this.workerHasSecret(deploymentId, "PLAYCADEMY_API_KEY");
+      if (current && workerHasKey) {
+        setAttribute("app.deploy.api_key_outcome", "already_set");
+        return;
       }
+      apiKey = await this.regenerateApiKey(user, existingKey.id, spec);
     }
-    yield { type: "status", data: { message: "Finalizing deployment" } };
-    const updatedGame = await this.finalizeDeployment({
-      game: game2,
-      slug,
-      deploymentId,
-      result,
-      request,
-      user,
-      flags: flags2
+    await cf.setSecrets(deploymentId, { PLAYCADEMY_API_KEY: apiKey });
+  }
+  async createApiKey(user, spec) {
+    const { key: apiKey } = await this.deps.createAuthApiKey({
+      userId: user.id,
+      name: spec.keyName,
+      expiresIn: null,
+      permissions: spec.permissions,
+      ...spec.rateLimit ? {
+        rateLimitEnabled: true,
+        rateLimitMax: spec.rateLimit.maxRequests,
+        rateLimitTimeWindow: spec.rateLimit.timeWindowMs
+      } : { rateLimitEnabled: false }
     });
-    yield { type: "complete", data: updatedGame };
+    setAttribute("app.deploy.api_key_outcome", "created");
+    return apiKey;
   }
-  mapBindingsToOptions(deploymentId, bindings, schema2) {
-    if (!bindings && !schema2) {
+  async regenerateApiKey(user, existingKeyId, spec) {
+    setAttribute("app.deploy.api_key_outcome", "regenerated");
+    try {
+      await this.deps.deleteAuthApiKey(existingKeyId);
+    } catch (error) {
+      addEvent("deploy.api_key_revoke_failed", {
+        "exception.type": errorType(error),
+        "app.error.message": errorMessage(error),
+        "app.deploy.old_key_id": existingKeyId
+      });
+    }
+    return this.createApiKey(user, spec);
+  }
+  async listWorkerSecretNames(deploymentId) {
+    try {
+      return await this.getCloudflare().listSecrets(deploymentId);
+    } catch (error) {
+      addEvent("deploy.worker_secrets_check_failed", {
+        "exception.type": errorType(error),
+        "app.error.message": errorMessage(error)
+      });
+      return null;
+    }
+  }
+  async workerHasSecret(deploymentId, secretName) {
+    const workerSecrets = await this.listWorkerSecretNames(deploymentId);
+    return Boolean(workerSecrets?.includes(secretName));
+  }
+  async ensureQueueIngressSecretOnWorker(slug, deploymentId) {
+    const secret = this.deps.config.queueIngressSecret;
+    if (!secret) {
       return;
     }
-    const workerBindings = {};
-    if (bindings?.database) {
-      workerBindings.d1 = [deploymentId];
+    const cf = this.getCloudflare();
+    await cf.setSecrets(deploymentId, { QUEUE_INGRESS_SECRET: secret });
+  }
+  async ensureDashboardSessionSecret(deploymentId, existingSecrets, hasPriorDeployment) {
+    if (existingSecrets === null && hasPriorDeployment) {
+      setAttribute("app.deploy.session_secret_outcome", "check_failed_kept");
+      return;
     }
-    if (bindings?.keyValue) {
-      workerBindings.kv = [deploymentId];
+    if (existingSecrets?.includes("DASHBOARD_SESSION_SECRET")) {
+      setAttribute("app.deploy.session_secret_outcome", "already_set");
+      return;
     }
-    if (bindings?.bucket) {
-      workerBindings.r2 = [deploymentId];
+    const secret = await generateSecureRandomString(64);
+    await this.getCloudflare().setSecrets(deploymentId, { DASHBOARD_SESSION_SECRET: secret });
+    setAttribute("app.deploy.session_secret_outcome", "created");
+  }
+  async rotateDashboardSessionSecret(slug, user) {
+    const game2 = await this.deps.validateDeveloperAccessBySlug(user, slug);
+    const deployment = await this.deps.db.query.gameDeployments.findFirst({
+      where: activeDeploymentWhere(game2.id, "dashboard"),
+      columns: { deploymentId: true }
+    });
+    if (!deployment) {
+      await sweepDashboardWorkerKeys(this.deps.deleteApiKeysByName, slug);
+      throw new NotFoundError("Dashboard deployment", slug);
     }
-    if (bindings?.queues) {
-      let toQueueName = function(queueKey) {
-        return `${QUEUE_NAME_PREFIX}-${deploymentId}--${queueKey}`;
-      };
-      const queueNameByKey = new Map;
-      for (const queueKey of Object.keys(bindings.queues)) {
-        queueNameByKey.set(queueKey, toQueueName(queueKey));
-      }
-      workerBindings.queues = Object.entries(bindings.queues).map(([queueKey, queueConfig]) => {
-        const config2 = queueConfig === true ? undefined : queueConfig;
-        const deadLetterQueue = config2?.deadLetterQueue && queueNameByKey.get(config2.deadLetterQueue) ? queueNameByKey.get(config2.deadLetterQueue) : undefined;
-        return {
-          bindingName: toBindingName(queueKey),
-          queueName: toQueueName(queueKey),
-          settings: config2 ? {
-            maxBatchSize: config2.maxBatchSize,
-            maxRetries: config2.maxRetries,
-            maxBatchTimeout: config2.maxBatchTimeout,
-            maxConcurrency: config2.maxConcurrency,
-            retryDelay: config2.retryDelay
-          } : undefined,
-          deadLetterQueue
-        };
+    const secret = await generateSecureRandomString(64);
+    await this.getCloudflare().setSecrets(deployment.deploymentId, {
+      DASHBOARD_SESSION_SECRET: secret
+    });
+    setAttribute("app.deploy.session_secret_outcome", "rotated");
+  }
+  async removeDashboard(slug, user) {
+    const game2 = await this.deps.validateDeveloperAccessBySlug(user, slug);
+    const db2 = this.deps.db;
+    const deployment = await db2.query.gameDeployments.findFirst({
+      where: activeDeploymentWhere(game2.id, "dashboard"),
+      columns: { deploymentId: true, provider: true, resources: true }
+    });
+    if (!deployment) {
+      await sweepDashboardWorkerKeys(this.deps.deleteApiKeysByName, slug);
+      throw new NotFoundError("Dashboard deployment", slug);
+    }
+    const assetBuckets = deployment.resources?.r2?.filter((bucket) => bucket.kind === "assets") ?? [];
+    await this.getCloudflare().delete(deployment.deploymentId, {
+      deleteBindings: assetBuckets.length > 0,
+      resources: assetBuckets.length > 0 ? { r2: assetBuckets } : undefined
+    });
+    await sweepDashboardWorkerKeys(this.deps.deleteApiKeysByName, slug);
+    await db2.delete(gameDeployments).where(and(eq(gameDeployments.gameId, game2.id), eq(gameDeployments.target, "dashboard")));
+    setAttribute("app.deploy.dashboard_removed", true);
+    await withSpan("deploy.send_alert", () => this.deps.alerts.notifyDashboardRemoval({
+      slug,
+      displayName: game2.displayName,
+      developer: { id: user.id, email: user.email }
+    })).catch(catchAttrs("alerts.delivery", { "app.alerts.type": "dashboard_removal" }));
+  }
+  async fetchAndExtractFrontendAssets(slug, gameId, uploadToken, uploadDeps, extractZip) {
+    const frontendZip = await withSpan("deploy.fetch_temporary_files", () => uploadDeps.getObjectAsByteArray(uploadToken));
+    if (!frontendZip || frontendZip.length === 0) {
+      throw new ValidationError("Uploaded file is empty or not found");
+    }
+    setAttribute("app.deploy.asset_upload_size", frontendZip.length);
+    const os2 = await import("os");
+    const path = await import("path");
+    const tempDir = path.join(os2.tmpdir(), `playcademy-deploy-${gameId}-${Date.now()}`);
+    const assetsPath = path.join(tempDir, "dist");
+    await withSpan("deploy.extract_assets", () => extractZip(frontendZip, assetsPath));
+    uploadDeps.deleteObject(uploadToken).catch(catchAttrs("deploy.temp_cleanup"));
+    return { frontendZip, tempDir, assetsPath };
+  }
+  async resolvePlatformBaseUrl() {
+    if (!this.deps.config.isLocal) {
+      return this.deps.config.baseUrl;
+    }
+    try {
+      return await getTunnelUrl(this.deps.config.baseUrl);
+    } catch (error) {
+      setAttributes({
+        "app.deploy.tunnel_available": false,
+        "app.deploy.failure_kind": "local_tunnel_unavailable"
       });
+      throw new ValidationError(errorMessage(error));
     }
-    const hasBindings = workerBindings.d1?.length || workerBindings.kv?.length || workerBindings.r2?.length || workerBindings.queues?.length;
-    return {
-      ...hasBindings && { bindings: workerBindings },
-      ...schema2 && { schema: schema2 }
-    };
   }
-  async notifyDeploymentFailure(slug, displayName, error, developer) {
-    await this.deps.alerts.notifyDeploymentFailure({
-      slug,
-      displayName,
-      error,
-      developer
-    }).catch(catchAttrs("alerts.delivery", { "app.alerts.type": "deployment_failure" }));
+  async deployToCloudflare(args2) {
+    const cf = this.getCloudflare();
+    try {
+      return await withSpan("deploy.cloudflare", () => cf.deploy(args2.deploymentId, args2.code, args2.env, args2.options));
+    } finally {
+      if (args2.tempDir) {
+        const fs2 = await import("fs/promises");
+        fs2.rm(args2.tempDir, { recursive: true, force: true }).catch(catchAttrs("deploy.temp_cleanup"));
+      }
+    }
   }
-  async saveDeployment(gameId, deploymentId, url, codeHash, resources) {
+  async saveDeployment(record) {
     const db2 = this.deps.db;
     await db2.transaction(async (tx) => {
-      await tx.update(gameDeployments).set({ isActive: false }).where(eq(gameDeployments.gameId, gameId));
+      await tx.update(gameDeployments).set({ isActive: false }).where(and(eq(gameDeployments.gameId, record.gameId), eq(gameDeployments.target, record.target)));
       await tx.insert(gameDeployments).values({
-        gameId,
-        deploymentId,
+        gameId: record.gameId,
+        deploymentId: record.deploymentId,
         provider: "cloudflare",
-        url,
-        codeHash,
-        resources,
+        target: record.target,
+        url: record.url,
+        codeHash: record.codeHash,
+        resources: record.resources,
         isActive: true
       });
     });
   }
+  async notifyDeploymentFailure(failure) {
+    await this.deps.alerts.notifyDeploymentFailure(failure).catch(catchAttrs("alerts.delivery", { "app.alerts.type": "deployment_failure" }));
+  }
 }
 var init_deploy_service = __esm(() => {
   init_drizzle_orm();
   init_playcademy();
   init_src();
+  init_helpers_index();
   init_tables_index();
   init_spans();
   init_tunnel();
   init_errors();
+  init_dashboard_util();
   init_deployment_util();
+  init_worker_keys_util();
 });
 
 // ../api-core/src/services/developer.service.ts
@@ -27817,20 +28531,6 @@ var init_game_member_service = __esm(() => {
   init_spans();
   init_errors();
 });
-// ../data/src/domains/timeback/helpers.ts
-function isActiveGameTimebackIntegrationStatus(statusColumn = gameTimebackIntegrations.status) {
-  return sql`${statusColumn} IS DISTINCT FROM ${DEACTIVATED_GAME_TIMEBACK_INTEGRATION_STATUS}`;
-}
-var ACTIVE_GAME_TIMEBACK_INTEGRATION_STATUS = "active", DEACTIVATED_GAME_TIMEBACK_INTEGRATION_STATUS = "deactivated";
-var init_helpers2 = __esm(() => {
-  init_drizzle_orm();
-  init_table7();
-});
-
-// ../data/src/helpers.index.ts
-var init_helpers_index = __esm(() => {
-  init_helpers2();
-});
 
 // ../utils/src/fns.ts
 function sleep(ms) {
@@ -28274,6 +28974,7 @@ var init_game_service = __esm(() => {
   init_errors();
   init_deployment_util();
   init_timeback_util();
+  init_worker_keys_util();
   inFlightManifestFetches = new Map;
   GameService = class GameService {
     deps;
@@ -28460,7 +29161,7 @@ var init_game_service = __esm(() => {
       GameService.recordGameShape(game2);
       return game2;
     }
-    async getBySlug(slug, caller) {
+    async getBySlug(slug, caller, options) {
       const db2 = this.deps.db;
       const game2 = await db2.query.games.findFirst({
         where: eq(games.slug, slug)
@@ -28468,7 +29169,9 @@ var init_game_service = __esm(() => {
       if (!game2) {
         throw new NotFoundError("Game", slug);
       }
-      await this.enforceVisibility(game2, caller, slug);
+      if (!options?.scopeAuthorized) {
+        await this.enforceVisibility(game2, caller, slug);
+      }
       GameService.recordGameShape(game2);
       return game2;
     }
@@ -28645,6 +29348,9 @@ var init_game_service = __esm(() => {
         await this.validateDeveloperAccess(user, gameId);
       } else {
         this.validateDeveloperStatus(user);
+        if (slug.endsWith(DASHBOARD_WORKER_SUFFIX)) {
+          throw new ValidationError(`Game slugs may not end with '${DASHBOARD_WORKER_SUFFIX}' — it is reserved for dashboard workers`);
+        }
       }
       const gameDataForDb = {
         displayName: data.displayName,
@@ -28771,15 +29477,21 @@ var init_game_service = __esm(() => {
       if (!gameToDelete?.slug) {
         throw new NotFoundError("Game", gameId);
       }
-      const activeDeployment = await db2.query.gameDeployments.findFirst({
-        where: and(eq(gameDeployments.gameId, gameId), eq(gameDeployments.isActive, true)),
-        columns: { deploymentId: true, provider: true, resources: true }
-      });
-      const customHostnames = await db2.select({
-        hostname: gameCustomHostnames.hostname,
-        cloudflareId: gameCustomHostnames.cloudflareId,
-        environment: gameCustomHostnames.environment
-      }).from(gameCustomHostnames).where(eq(gameCustomHostnames.gameId, gameId));
+      const [activeDeployment, dashboardDeployment, customHostnames] = await Promise.all([
+        db2.query.gameDeployments.findFirst({
+          where: activeDeploymentWhere(gameId, "game"),
+          columns: { deploymentId: true, provider: true, resources: true }
+        }),
+        db2.query.gameDeployments.findFirst({
+          where: activeDeploymentWhere(gameId, "dashboard"),
+          columns: { deploymentId: true, provider: true, resources: true }
+        }),
+        db2.select({
+          hostname: gameCustomHostnames.hostname,
+          cloudflareId: gameCustomHostnames.cloudflareId,
+          environment: gameCustomHostnames.environment
+        }).from(gameCustomHostnames).where(eq(gameCustomHostnames.gameId, gameId))
+      ]);
       const result = await db2.delete(games).where(eq(games.id, gameId)).returning({ id: games.id });
       if (result.length === 0) {
         throw new NotFoundError("Game", gameId);
@@ -28823,6 +29535,22 @@ var init_game_service = __esm(() => {
           setAttribute("app.game.api_key_cleanup_error", errorMessage(error));
         }
       }
+      if (dashboardDeployment?.provider === "cloudflare" && this.deps.cloudflare) {
+        const dashboardAssetBuckets = dashboardDeployment.resources?.r2?.filter((bucket) => bucket.kind === "assets") ?? [];
+        try {
+          await this.deps.cloudflare.delete(dashboardDeployment.deploymentId, {
+            deleteBindings: dashboardAssetBuckets.length > 0,
+            resources: dashboardAssetBuckets.length > 0 ? { r2: dashboardAssetBuckets } : undefined
+          });
+          setAttribute("app.game.dashboard_cleanup", "succeeded");
+        } catch (error) {
+          setAttributes({
+            "app.game.dashboard_cleanup": "failed",
+            "app.game.dashboard_cleanup_error": errorMessage(error)
+          });
+        }
+      }
+      await sweepDashboardWorkerKeys(this.deps.deleteApiKeysByName, gameToDelete.slug);
       const corsOrigin = GameService.safeOrigin(gameToDelete);
       if (this.deps.corsKvs && corsOrigin) {
         setAttribute("app.cors_kvs.origin", corsOrigin);
@@ -28946,7 +29674,7 @@ class LogsService {
   }
   async generateToken(user, slug, sstStage) {
     await this.deps.validateDeveloperAccessBySlug(user, slug);
-    const workerId = getDeploymentId(slug, sstStage);
+    const workerId = getGameDeploymentId(slug, sstStage);
     const token = await this.deps.mintLogStreamToken(user.id, workerId);
     setAttribute("app.logs.worker_id", workerId);
     return { token, workerId };
@@ -28966,7 +29694,8 @@ function createGameServices(deps) {
     cache,
     cloudflare: cloudflare2,
     corsKvs,
-    deleteApiKeyByName: auth2.deleteApiKeyByName.bind(auth2)
+    deleteApiKeyByName: auth2.deleteApiKeyByName.bind(auth2),
+    deleteApiKeysByName: auth2.deleteApiKeysByName.bind(auth2)
   });
   const gameMember = new GameMemberService({
     db: db2,
@@ -28979,6 +29708,7 @@ function createGameServices(deps) {
     cloudflare: cloudflare2,
     createAuthApiKey: auth2.createApiKey.bind(auth2),
     deleteAuthApiKey: auth2.deleteApiKey.bind(auth2),
+    deleteApiKeysByName: auth2.deleteApiKeysByName.bind(auth2),
     alerts,
     validateDeveloperAccessBySlug: (user, slug) => game2.validateDeveloperAccessBySlug(user, slug)
   });
@@ -28988,14 +29718,20 @@ function createGameServices(deps) {
     storage,
     validateDeveloperAccessBySlug: (user, slug) => game2.validateDeveloperAccessBySlug(user, slug),
     runDeploy: (slug, request, user, uploadDeps, extractZip) => deploy.deploy(slug, request, user, uploadDeps, extractZip),
-    notifyDeploymentFailure: (slug, displayName, error, developerInfo) => deploy.notifyDeploymentFailure(slug, displayName, error, developerInfo)
+    notifyDeploymentFailure: (failure) => deploy.notifyDeploymentFailure(failure)
   });
   const logs = new LogsService({
     mintLogStreamToken: auth2.mintLogStreamToken.bind(auth2),
     validateDeveloperAccessBySlug: (user, slug) => game2.validateDeveloperAccessBySlug(user, slug)
   });
+  const dashboard2 = new DashboardService({
+    db: db2,
+    hashPassword: auth2.hashPassword.bind(auth2),
+    verifyPassword: auth2.verifyPassword.bind(auth2),
+    validateDeveloperAccessBySlug: (user, slug) => game2.validateDeveloperAccessBySlug(user, slug)
+  });
   return {
-    services: { game: game2, gameMember, developer, deploy, deployJobs, logs },
+    services: { game: game2, gameMember, developer, deploy, deployJobs, logs, dashboard: dashboard2 },
     validators: {
       validateDeveloperAccessBySlug: (user, slug) => game2.validateDeveloperAccessBySlug(user, slug),
       validateDeveloperAccess: (user, gameId) => game2.validateDeveloperAccess(user, gameId),
@@ -29005,6 +29741,7 @@ function createGameServices(deps) {
   };
 }
 var init_game2 = __esm(() => {
+  init_dashboard_service();
   init_deploy_job_service();
   init_deploy_service();
   init_developer_service();
@@ -29189,12 +29926,25 @@ class AlertsService {
     embed.setFooter("Playcademy Developer Platform").setTimestamp();
     await this.sendAlert(discord, embed.build());
   }
+  async notifyDashboardDeployment(dashboard2) {
+    const discord = this.recordAlert("dashboard_deployment");
+    if (!discord) {
+      return;
+    }
+    const embed = new DiscordEmbedBuilder().setTitle("\uD83D\uDCCA Dashboard Deployed").setDescription(`The dashboard for **${dashboard2.displayName || dashboard2.slug}** has been deployed (**${this.getEnvironment()}**).`).setColor(DiscordColors.GREEN).addField("Slug", dashboard2.slug, true).addField("URL", dashboard2.url, false);
+    if (dashboard2.developer) {
+      embed.addField("Developer", dashboard2.developer.email || dashboard2.developer.id, true);
+    }
+    embed.setFooter("Playcademy Developer Platform").setTimestamp();
+    await this.sendAlert(discord, embed.build());
+  }
   async notifyDeploymentFailure(failure) {
     const discord = this.recordAlert("deployment_failure");
     if (!discord) {
       return;
     }
-    const embed = new DiscordEmbedBuilder().setTitle("❌ Deployment Failed").setDescription(`Deployment failed for **${failure.displayName || failure.slug}** (**${this.getEnvironment()}**).`).setColor(DiscordColors.RED).addField("Slug", failure.slug, true);
+    const [title, subject] = failure.target === "dashboard" ? ["❌ Dashboard Deployment Failed", "Dashboard deployment"] : ["❌ Deployment Failed", "Deployment"];
+    const embed = new DiscordEmbedBuilder().setTitle(title).setDescription(`${subject} failed for **${failure.displayName || failure.slug}** (**${this.getEnvironment()}**).`).setColor(DiscordColors.RED).addField("Slug", failure.slug, true);
     if (failure.developer) {
       embed.addField("Developer", failure.developer.email || failure.developer.id, true);
     }
@@ -29209,6 +29959,14 @@ class AlertsService {
     const embed = new DiscordEmbedBuilder().setTitle("\uD83D\uDDD1️ Game Deleted").setDescription(`**${game2.displayName || game2.slug}** has been deleted (**${this.getEnvironment()}**).`).setColor(DiscordColors.ORANGE).addField("Slug", game2.slug, true).addField("Developer", game2.developer.email || game2.developer.id, true).setFooter("Playcademy Developer Platform").setTimestamp().build();
     await this.sendAlert(discord, embed);
   }
+  async notifyDashboardRemoval(dashboard2) {
+    const discord = this.recordAlert("dashboard_removal");
+    if (!discord) {
+      return;
+    }
+    const embed = new DiscordEmbedBuilder().setTitle("\uD83D\uDDD1️ Dashboard Removed").setDescription(`The dashboard for **${dashboard2.displayName || dashboard2.slug}** has been removed (**${this.getEnvironment()}**).`).setColor(DiscordColors.ORANGE).addField("Slug", dashboard2.slug, true).addField("Developer", dashboard2.developer.email || dashboard2.developer.id, true).setFooter("Playcademy Developer Platform").setTimestamp().build();
+    await this.sendAlert(discord, embed);
+  }
   async notifySeedFailure(failure) {
     const discord = this.recordAlert("seed_failure");
     if (!discord) {
@@ -29374,6 +30132,7 @@ class KVBackupService {
   async getTargets(gameSlug) {
     const conditions2 = [
       eq(gameDeployments.isActive, true),
+      eq(gameDeployments.target, "game"),
       eq(gameDeployments.provider, "cloudflare")
     ];
     if (gameSlug) {
@@ -29600,7 +30359,7 @@ class BucketService {
     return extensionIndex > 0 ? fileName.slice(extensionIndex + 1).toLowerCase() : "(none)";
   }
   getBucketName(slug) {
-    return getDeploymentId(slug, this.deps.sstStage);
+    return getGameDeploymentId(slug, this.deps.sstStage);
   }
   async listFiles(slug, user, prefix) {
     const game2 = await this.deps.validateDeveloperAccessBySlug(user, slug);
@@ -29689,6 +30448,32 @@ class DatabaseService {
     }
     return d1;
   }
+  async syncDashboardD1Binding(gameId, d1ResourceName, databaseId) {
+    const dashboardDeployment = await this.deps.db.query.gameDeployments.findFirst({
+      where: activeDeploymentWhere(gameId, "dashboard"),
+      columns: { id: true, deploymentId: true, resources: true }
+    });
+    if (!dashboardDeployment || !this.deps.cloudflare) {
+      return;
+    }
+    try {
+      await this.deps.cloudflare.updateD1Binding(dashboardDeployment.deploymentId, databaseId);
+      if (dashboardDeployment.resources?.d1?.length) {
+        const updatedResources = {
+          ...dashboardDeployment.resources,
+          d1: dashboardDeployment.resources.d1.map((dbResource) => dbResource.name === d1ResourceName ? { ...dbResource, id: databaseId } : dbResource)
+        };
+        await this.deps.db.update(gameDeployments).set({ resources: updatedResources }).where(eq(gameDeployments.id, dashboardDeployment.id));
+      }
+      setAttribute("app.database.dashboard_binding", "updated");
+    } catch (error) {
+      addEvent("database.dashboard_binding_sync_failed", {
+        "exception.type": errorType(error),
+        "app.error.message": errorMessage(error),
+        "app.deploy.deployment_id": dashboardDeployment.deploymentId
+      });
+    }
+  }
   async reset(slug, user, schema2) {
     setAttributes({
       "app.database.operation": "reset",
@@ -29697,7 +30482,7 @@ class DatabaseService {
     });
     const d1 = this.getD1();
     const game2 = await this.deps.validateDeveloperAccessBySlug(user, slug);
-    const deploymentId = getDeploymentId(slug, this.deps.config.sstStage);
+    const deploymentId = getGameDeploymentId(slug, this.deps.config.sstStage);
     try {
       const databaseId = await d1.reset(deploymentId);
       setAttribute("app.database.id", databaseId);
@@ -29713,7 +30498,7 @@ class DatabaseService {
         setAttribute("app.database.binding", "skipped_no_provider");
       }
       const activeDeployment = await this.deps.db.query.gameDeployments.findFirst({
-        where: and(eq(gameDeployments.gameId, game2.id), eq(gameDeployments.isActive, true)),
+        where: activeDeploymentWhere(game2.id),
         columns: { id: true, resources: true }
       });
       setAttribute("app.database.active_deployment_found", Boolean(activeDeployment));
@@ -29724,6 +30509,7 @@ class DatabaseService {
         };
         await this.deps.db.update(gameDeployments).set({ resources: updatedResources }).where(eq(gameDeployments.id, activeDeployment.id));
       }
+      await this.syncDashboardD1Binding(game2.id, deploymentId, databaseId);
       setAttributes({
         "app.database.deployment_id": deploymentId,
         "app.database.schema_pushed": schemaPushed
@@ -29747,6 +30533,7 @@ class DatabaseService {
 }
 var init_database_service = __esm(() => {
   init_drizzle_orm();
+  init_helpers_index();
   init_tables_index();
   init_spans();
   init_errors();
@@ -29990,7 +30777,7 @@ class KVService {
     const game2 = await this.deps.validateDeveloperAccessBySlug(user, slug);
     const db2 = this.deps.db;
     const deployment = await db2.query.gameDeployments.findFirst({
-      where: and(eq(gameDeployments.gameId, game2.id), eq(gameDeployments.isActive, true)),
+      where: activeDeploymentWhere(game2.id),
       columns: { resources: true }
     });
     if (!deployment?.resources?.kv?.length) {
@@ -30111,8 +30898,7 @@ class KVService {
   }
 }
 var init_kv_service = __esm(() => {
-  init_drizzle_orm();
-  init_tables_index();
+  init_helpers_index();
   init_spans();
   init_errors();
 });
@@ -30129,13 +30915,13 @@ class SecretsService {
     }
     return this.deps.cloudflare;
   }
-  getDeploymentId(slug) {
-    return getDeploymentId(slug, this.deps.config.sstStage);
+  getGameDeploymentId(slug) {
+    return getGameDeploymentId(slug, this.deps.config.sstStage);
   }
   async listKeys(slug, user) {
     await this.deps.validateDeveloperAccessBySlug(user, slug);
     const cf = this.getCloudflare();
-    const deploymentId = this.getDeploymentId(slug);
+    const deploymentId = this.getGameDeploymentId(slug);
     try {
       const allKeys = await cf.listSecrets(deploymentId);
       const userKeys = allKeys.filter((k) => k.startsWith(SECRETS_PREFIX)).map((k) => k.slice(SECRETS_PREFIX.length));
@@ -30161,7 +30947,7 @@ class SecretsService {
   async setSecrets(slug, newSecrets, user) {
     await this.deps.validateDeveloperAccessBySlug(user, slug);
     const cf = this.getCloudflare();
-    const deploymentId = this.getDeploymentId(slug);
+    const deploymentId = this.getGameDeploymentId(slug);
     const secretKeys = Object.keys(newSecrets);
     if (secretKeys.length === 0) {
       throw new ValidationError("At least one secret must be provided");
@@ -30214,7 +31000,7 @@ class SecretsService {
     }
     await this.deps.validateDeveloperAccessBySlug(user, slug);
     const cf = this.getCloudflare();
-    const deploymentId = this.getDeploymentId(slug);
+    const deploymentId = this.getGameDeploymentId(slug);
     try {
       const prefixedKey = `${SECRETS_PREFIX}${key}`;
       const existingKeys = await cf.listSecrets(deploymentId);
@@ -30251,27 +31037,7 @@ var init_secrets_service = __esm(() => {
   init_deployment_util();
   INTERNAL_SECRET_KEYS = ["PLAYCADEMY_API_KEY", "GAME_ID", "PLAYCADEMY_BASE_URL"];
 });
-
-// ../edge-play/src/constants.ts
-var ASSET_ROUTE_PREFIX = "/api/assets/", ROUTES;
-var init_constants3 = __esm(() => {
-  init_src();
-  ROUTES = {
-    INDEX: "/api",
-    HEALTH: "/api/health",
-    ASSETS: `${ASSET_ROUTE_PREFIX}*`,
-    TIMEBACK: {
-      END_ACTIVITY: `/api${TIMEBACK_ROUTES.END_ACTIVITY}`,
-      GET_XP: `/api${TIMEBACK_ROUTES.GET_XP}`,
-      GET_MASTERY: `/api${TIMEBACK_ROUTES.GET_MASTERY}`,
-      GET_HIGHEST_GRADE_MASTERED: `/api${TIMEBACK_ROUTES.GET_HIGHEST_GRADE_MASTERED}`,
-      HEARTBEAT: `/api${TIMEBACK_ROUTES.HEARTBEAT}`,
-      ADVANCE_COURSE: `/api${TIMEBACK_ROUTES.ADVANCE_COURSE}`,
-      UNENROLL_COURSE: `/api${TIMEBACK_ROUTES.UNENROLL_COURSE}`
-    }
-  };
-});
-// ../edge-play/src/entry/setup.ts
+// ../edge-play/src/game/setup.ts
 function prefixSecrets(secrets) {
   const prefixed = {};
   for (const [key, value] of Object.entries(secrets)) {
@@ -30281,7 +31047,6 @@ function prefixSecrets(secrets) {
 }
 var init_setup2 = __esm(() => {
   init_src();
-  init_constants3();
 });
 
 // ../api-core/src/services/seed.service.ts
@@ -30316,7 +31081,7 @@ class SeedService {
   async seed(slug, code, user, secrets) {
     const cf = this.getCloudflare();
     const game2 = await this.deps.validateDeveloperAccessBySlug(user, slug);
-    const deploymentId = getDeploymentId(slug, this.deps.config.sstStage);
+    const deploymentId = getGameDeploymentId(slug, this.deps.config.sstStage);
     const uniqueSuffix = Date.now().toString(36);
     const seedDeploymentId = `seed-${deploymentId}-${uniqueSuffix}`;
     setAttributes({
@@ -30807,7 +31572,7 @@ var init_emoji = __esm(() => {
 });
 
 // ../data/src/domains/game/schemas.ts
-var HttpUrlSchema, GameEmojiSchema, GameMetadataRecordSchema, InsertGameSchema, UpdateGameSchema, InsertGameDeploymentSchema, InsertGameDeployJobSchema, UpsertGameMetadataSchema, PatchGameMetadataSchema, AddGameMemberSchema, UpdateGameMemberRoleSchema, ALLOWED_UPLOAD_EXTENSIONS, InitiateUploadSchema, AddCustomHostnameSchema, SetSecretsRequestSchema, SeedRequestSchema, SchemaInfoSchema, DatabaseResetRequestSchema, VerifyTokenSchema, KVSeedRequestSchema, DeployRequestSchema;
+var HttpUrlSchema, GameEmojiSchema, GameMetadataRecordSchema, InsertGameSchema, UpdateGameSchema, InsertGameDeploymentSchema, InsertGameDeployJobSchema, UpsertGameMetadataSchema, PatchGameMetadataSchema, AddGameMemberSchema, UpdateGameMemberRoleSchema, AddGameDashboardUserSchema, VerifyGameDashboardLoginSchema, AcceptGameDashboardInviteSchema, AcceptGameDashboardResetSchema, ALLOWED_UPLOAD_EXTENSIONS, InitiateUploadSchema, AddCustomHostnameSchema, SetSecretsRequestSchema, SeedRequestSchema, SchemaInfoSchema, DatabaseResetRequestSchema, VerifyTokenSchema, KVSeedRequestSchema, DeployRequestSchema;
 var init_schemas2 = __esm(() => {
   init_drizzle_zod();
   init_esm();
@@ -30918,6 +31683,20 @@ var init_schemas2 = __esm(() => {
   UpdateGameMemberRoleSchema = exports_external.object({
     role: exports_external.enum(gameMemberRoleEnum.enumValues)
   }).strict();
+  AddGameDashboardUserSchema = exports_external.object({
+    email: exports_external.string().email().max(255),
+    displayName: exports_external.string().min(1).max(255).optional(),
+    role: exports_external.enum(gameDashboardUserRoleEnum.enumValues).optional().default(DASHBOARD_USER_ROLES.VIEWER)
+  }).strict();
+  VerifyGameDashboardLoginSchema = exports_external.object({
+    email: exports_external.string().email().max(255),
+    password: exports_external.string().min(1).max(1024)
+  }).strict();
+  AcceptGameDashboardInviteSchema = exports_external.object({
+    token: exports_external.string().min(1).max(255),
+    password: exports_external.string().min(8, "Password must be at least 8 characters").max(1024, "Password must be at most 1024 characters")
+  }).strict();
+  AcceptGameDashboardResetSchema = AcceptGameDashboardInviteSchema;
   ALLOWED_UPLOAD_EXTENSIONS = [".zip", ".js"];
   InitiateUploadSchema = exports_external.object({
     fileName: exports_external.string().min(1).refine((name2) => ALLOWED_UPLOAD_EXTENSIONS.some((ext) => name2.endsWith(ext)), {
@@ -30952,6 +31731,7 @@ var init_schemas2 = __esm(() => {
     }))
   });
   DeployRequestSchema = exports_external.object({
+    target: exports_external.enum(deploymentTargetEnum.enumValues).optional().default("game"),
     uploadToken: exports_external.string().optional(),
     code: exports_external.string().optional(),
     codeUploadToken: exports_external.string().optional(),
@@ -30987,6 +31767,9 @@ var init_schemas2 = __esm(() => {
   }).refine((data) => !(data.code && data.codeUploadToken), {
     message: "Specify either code or codeUploadToken, not both",
     path: ["codeUploadToken"]
+  }).refine((data) => !(data.target === "dashboard" && (data.schema || data.bindings)), {
+    message: "Dashboard deployments cannot include schema or bindings — they attach to the game deployment’s existing resources",
+    path: ["target"]
   });
 });
 
@@ -74418,6 +75201,17 @@ function isValidUUID(value) {
   }
   return UUID_REGEX.test(value);
 }
+async function deterministicUUID(input) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(input));
+  const bytes = new Uint8Array(digest).slice(0, 16);
+  bytes[6] = bytes[6] & 15 | 80;
+  bytes[8] = bytes[8] & 63 | 128;
+  const hex3 = Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+  return `${hex3.slice(0, 8)}-${hex3.slice(8, 12)}-${hex3.slice(12, 16)}-${hex3.slice(16, 20)}-${hex3.slice(20)}`;
+}
+async function localGameId(slug) {
+  return deterministicUUID(`playcademy:local-game:${slug}`);
+}
 var UUID_REGEX;
 var init_uuid2 = __esm(() => {
   UUID_REGEX = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
@@ -76819,7 +77613,7 @@ function deriveTimebackCourseLevelFromGrade(grade) {
   return TIMEBACK_COURSE_DEFAULTS.level.high;
 }
 var ONEROSTER_STATUS2, SCORE_STATUS2, CACHE_DEFAULTS3, RESOURCE_DEFAULTS3;
-var init_constants4 = __esm(() => {
+var init_constants3 = __esm(() => {
   init_src();
   ONEROSTER_STATUS2 = {
     active: "active",
@@ -77793,7 +78587,7 @@ function qtiIdCandidates(parentLineItem, resource) {
 }
 var GRADE_LEVEL_TEST_TYPES, naturalTitleSort;
 var init_timeback_grade_level_results_util = __esm(() => {
-  init_constants4();
+  init_constants3();
   GRADE_LEVEL_TEST_TYPES = [
     "placement",
     "test out",
@@ -77988,7 +78782,7 @@ async function upsertMasteryCompletionEntry(params) {
 }
 var init_timeback_mastery_completion_util = __esm(async () => {
   init_spans();
-  init_constants4();
+  init_constants3();
   init_utils6();
   await init_errors8();
 });
@@ -78684,7 +79478,7 @@ class TimebackAdminService {
           columns: { slug: true }
         }),
         this.deps.db.query.gameDeployments.findFirst({
-          where: and(eq(gameDeployments.gameId, gameId), eq(gameDeployments.isActive, true)),
+          where: activeDeploymentWhere(gameId),
           columns: { url: true }
         })
       ]);
@@ -79765,7 +80559,7 @@ var init_timeback_admin_service = __esm(async () => {
   init_schemas_index();
   init_tables_index();
   init_spans();
-  init_constants4();
+  init_constants3();
   init_types2();
   init_utils6();
   init_src4();
@@ -80240,7 +81034,7 @@ function timebackConfigMatchesCreateIntegrationRequest(config4, request) {
   return subject === request.subject && grade === request.grade && config4.course.title === request.title && config4.course.courseCode === request.courseCode && config4.course.level === requestedLevel && (getTotalXpFromTimebackConfig(config4) ?? null) === request.totalXp && (getMasterableUnitsFromTimebackConfig(config4) ?? null) === request.masterableUnits;
 }
 var init_timeback_create_integration_util = __esm(() => {
-  init_constants4();
+  init_constants3();
   init_types2();
   init_timeback_util();
 });
@@ -83086,6 +83880,19 @@ function createSandboxAuthProvider() {
       }
       return null;
     },
+    async deleteApiKeysByName(name3) {
+      const deleted = [];
+      for (const [id, key] of sandboxApiKeys.entries()) {
+        if (key.name === name3) {
+          sandboxApiKeys.delete(id);
+          deleted.push(id);
+        }
+      }
+      if (deleted.length > 0) {
+        log.debug("[SandboxAuthProvider] Deleted API keys by name", { name: name3, deleted });
+      }
+      return deleted;
+    },
     async mintGameToken(gameId, userId) {
       const header = btoa(JSON.stringify({ alg: "none", typ: "sandbox" }));
       const exp = Date.now() + 15 * 60 * 1000;
@@ -83164,6 +83971,12 @@ function createSandboxAuthProvider() {
       } catch {
         return null;
       }
+    },
+    async hashPassword(password) {
+      return `sandbox:${btoa(password)}`;
+    },
+    async verifyPassword(data) {
+      return data.hash === `sandbox:${btoa(data.password)}`;
     }
   };
 }
@@ -83448,7 +84261,7 @@ var init_http_exception = () => {};
 
 // ../../node_modules/.bun/hono@4.10.7/node_modules/hono/dist/request/constants.js
 var GET_MATCH_RESULT;
-var init_constants5 = __esm(() => {
+var init_constants4 = __esm(() => {
   GET_MATCH_RESULT = Symbol();
 });
 
@@ -83712,7 +84525,7 @@ var init_url = __esm(() => {
 var tryDecodeURIComponent = (str) => tryDecode(str, decodeURIComponent_), HonoRequest;
 var init_request = __esm(() => {
   init_http_exception();
-  init_constants5();
+  init_constants4();
   init_body();
   init_url();
   HonoRequest = class {
@@ -84042,7 +84855,7 @@ var init_router = __esm(() => {
 
 // ../../node_modules/.bun/hono@4.10.7/node_modules/hono/dist/utils/constants.js
 var COMPOSED_HANDLER = "__COMPOSED_HANDLER";
-var init_constants6 = () => {};
+var init_constants5 = () => {};
 
 // ../../node_modules/.bun/hono@4.10.7/node_modules/hono/dist/hono-base.js
 var notFoundHandler = (c) => {
@@ -84264,7 +85077,7 @@ var init_hono_base = __esm(() => {
   init_compose();
   init_context2();
   init_router();
-  init_constants6();
+  init_constants5();
   init_url();
 });
 
@@ -92934,7 +93747,7 @@ var require_node3 = __commonJS((exports) => {
     exports2.isAbsolute = function(aPath) {
       return aPath.charAt(0) === "/" || urlRegexp.test(aPath);
     };
-    function relative(aRoot, aPath) {
+    function relative2(aRoot, aPath) {
       if (aRoot === "") {
         aRoot = ".";
       }
@@ -92953,7 +93766,7 @@ var require_node3 = __commonJS((exports) => {
       }
       return Array(level + 1).join("../") + aPath.substr(aRoot.length + 1);
     }
-    exports2.relative = relative;
+    exports2.relative = relative2;
     var supportsNullProto = function() {
       var obj = Object.create(null);
       return !("__proto__" in obj);
@@ -94984,7 +95797,7 @@ If you have no idea what this means or what Pirates is, let me explain: Pirates
         });
       };
     }
-    var readFile = (fp) => new Promise((resolve2, reject) => {
+    var readFile2 = (fp) => new Promise((resolve2, reject) => {
       _fs.default.readFile(fp, "utf8", (err2, data) => {
         if (err2)
           return reject(err2);
@@ -95182,7 +95995,7 @@ If you have no idea what this means or what Pirates is, let me explain: Pirates
                   data: _this3.packageJsonCache.get(filepath)[options.packageKey]
                 };
               }
-              const data = _this3.options.parseJSON(yield readFile(filepath));
+              const data = _this3.options.parseJSON(yield readFile2(filepath));
               return {
                 path: filepath,
                 data
@@ -95190,7 +96003,7 @@ If you have no idea what this means or what Pirates is, let me explain: Pirates
             }
             return {
               path: filepath,
-              data: yield readFile(filepath)
+              data: yield readFile2(filepath)
             };
           }
           return {};
@@ -100235,7 +101048,7 @@ var __create2, __defProp2, __getOwnPropDesc, __getOwnPropNames2, __getProtoOf2,
         __defProp2(to, key, { get: () => from[key], enumerable: !(desc2 = __getOwnPropDesc(from, key)) || desc2.enumerable });
   }
   return to;
-}, __toESM5 = (mod, isNodeMode, target) => (target = mod != null ? __create2(__getProtoOf2(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp2(target, "default", { value: mod, enumerable: true }) : target, mod)), __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value), ANSI_BACKGROUND_OFFSET, wrapAnsi16, wrapAnsi256, wrapAnsi16m, styles2, modifierNames, foregroundColorNames, backgroundColorNames, colorNames, ansiStyles, ansi_styles_default, init_ansi_styles, env, flagForceColor, supportsColor, supports_color_default, init_supports_color, init_utilities, stdoutColor, stderrColor, GENERATOR, STYLER, IS_EMPTY, levelMapping, styles22, applyOptions, chalkFactory, getModelAnsi, usedModels, proto, createStyler, createBuilder, applyStyle, chalk, chalkStderr, source_default, init_source, require_old, require_fs, require_path, require_balanced_match, require_brace_expansion, require_minimatch, require_inherits_browser2, require_inherits2, require_common3, require_sync, require_wrappy, require_once, require_inflight, require_glob, require_readline, require_src3, require_utils4, require_lodash, require_hanji, originUUID, snapshotVersion, mapValues, mapKeys, mapEntries, customMapEntries, init_global2, util3, objectUtil2, ZodParsedType2, getParsedType4, init_util4, ZodIssueCode4, ZodError5, init_ZodError2, errorMap2, en_default4, init_en4, overrideErrorMap2, init_errors9, makeIssue2, ParseStatus2, INVALID3, DIRTY2, OK2, isAborted2, isDirty2, isValid2, isAsync2, init_parseUtil2, init_typeAliases2, errorUtil2, init_errorUtil2, ParseInputLazyPath2, handleResult2, ZodType4, cuidRegex2, cuid2Regex2, ulidRegex2, uuidRegex2, nanoidRegex2, jwtRegex2, durationRegex2, emailRegex2, _emojiRegex2, emojiRegex2, ipv4Regex2, ipv4CidrRegex2, ipv6Regex2, ipv6CidrRegex2, base64Regex2, base64urlRegex2, dateRegexSource2, dateRegex2, ZodString4, ZodNumber4, ZodBigInt4, ZodBoolean4, ZodDate4, ZodSymbol4, ZodUndefined4, ZodNull4, ZodAny4, ZodUnknown4, ZodNever4, ZodVoid4, ZodArray4, ZodObject4, ZodUnion4, getDiscriminator2, ZodDiscriminatedUnion4, ZodIntersection4, ZodTuple4, ZodRecord4, ZodMap4, ZodSet4, ZodFunction3, ZodLazy4, ZodLiteral4, ZodEnum4, ZodNativeEnum2, ZodPromise4, ZodEffects2, ZodOptional4, ZodNullable4, ZodDefault4, ZodCatch4, ZodNaN4, BRAND2, ZodBranded2, ZodPipeline2, ZodReadonly4, late2, ZodFirstPartyTypeKind3, stringType2, numberType2, nanType2, bigIntType2, booleanType2, dateType2, symbolType2, undefinedType2, nullType2, anyType2, unknownType2, neverType2, voidType2, arrayType2, objectType2, strictObjectType2, unionType2, discriminatedUnionType2, intersectionType2, tupleType2, recordType2, mapType2, setType2, functionType2, lazyType2, literalType2, enumType2, nativeEnumType2, promiseType2, effectsType2, optionalType2, nullableType2, preprocessType2, pipelineType2, coerce2, init_types5, init_external4, init_v32, init_esm2, enumSchema, enumSchemaV1, indexColumn, index2, fk, sequenceSchema, roleSchema, sequenceSquashed, column2, checkConstraint, columnSquashed, compositePK, uniqueConstraint, policy, policySquashed, viewWithOption, matViewWithOption, mergedViewWithOption, view2, table8, schemaHash, kitInternals, gelSchemaExternal, gelSchemaInternal, tableSquashed, gelSchemaSquashed, gelSchema, dryGel, init_gelSchema, index22, fk2, column22, tableV3, compositePK2, uniqueConstraint2, checkConstraint2, tableV4, table22, viewMeta, view22, kitInternals2, dialect2, schemaHash2, schemaInternalV3, schemaInternalV4, schemaInternalV5, schemaInternal, schemaV3, schemaV4, schemaV5, schema2, tableSquashedV4, tableSquashed2, viewSquashed, schemaSquashed, schemaSquashedV4, MySqlSquasher, squashMysqlScheme, mysqlSchema, mysqlSchemaV5, mysqlSchemaSquashed, backwardCompatibleMysqlSchema, dryMySql, init_mysqlSchema, indexV2, columnV2, tableV2, enumSchemaV12, enumSchema2, pgSchemaV2, references, columnV1, tableV1, pgSchemaV1, indexColumn2, index3, indexV4, indexV5, indexV6, fk3, sequenceSchema2, roleSchema2, sequenceSquashed2, columnV7, column3, checkConstraint3, columnSquashed2, tableV32, compositePK3, uniqueConstraint3, policy2, policySquashed2, viewWithOption2, matViewWithOption2, mergedViewWithOption2, view3, tableV42, tableV5, tableV6, tableV7, table32, schemaHash3, kitInternals3, pgSchemaInternalV3, pgSchemaInternalV4, pgSchemaInternalV5, pgSchemaInternalV6, pgSchemaExternal, pgSchemaInternalV7, pgSchemaInternal, tableSquashed3, tableSquashedV42, pgSchemaSquashedV4, pgSchemaSquashedV6, pgSchemaSquashed, pgSchemaV3, pgSchemaV4, pgSchemaV5, pgSchemaV6, pgSchemaV7, pgSchema, backwardCompatiblePgSchema, PgSquasher, squashPgScheme, dryPg, init_pgSchema, index4, column4, compositePK4, uniqueConstraint4, table42, viewMeta2, kitInternals4, dialect22, schemaHash4, schemaInternal2, schema22, tableSquashed4, schemaSquashed2, SingleStoreSquasher, squashSingleStoreScheme, singlestoreSchema, singlestoreSchemaSquashed, backwardCompatibleSingleStoreSchema, drySingleStore, init_singlestoreSchema, index5, fk4, compositePK5, column5, tableV33, uniqueConstraint5, checkConstraint4, table52, view4, dialect3, schemaHash5, schemaInternalV32, schemaInternalV42, schemaInternalV52, kitInternals5, latestVersion, schemaInternal3, schemaV32, schemaV42, schemaV52, schema3, tableSquashed5, schemaSquashed3, SQLiteSquasher, squashSqliteScheme, drySQLite, sqliteSchemaV5, sqliteSchema, SQLiteSchemaSquashed, backwardCompatibleSqliteSchema, init_sqliteSchema, copy, prepareMigrationMeta, schemaRenameKey, tableRenameKey, columnRenameKey, init_utils7, import_hanji, warning, error88, isRenamePromptItem, ResolveColumnSelect, tableKey, ResolveSelectNamed, ResolveSelect, ResolveSchemasSelect, Spinner2, ProgressView, init_views, glob, init_serializer, fillPgSnapshot, init_migrationPreparator, require_heap, require_heap2, require_difflib, require_difflib2, require_util2, require_styles, require_has_flag2, require_supports_colors, require_trap, require_zalgo, require_america, require_zebra, require_rainbow, require_random, require_colors, require_safe, require_colorize, require_lib4, import_json_diff, mapArraysDiff, findAlternationsInTable, alternationsInColumn, init_jsonDiffer, parseType, Convertor, PgCreateRoleConvertor, PgDropRoleConvertor, PgRenameRoleConvertor, PgAlterRoleConvertor, PgCreatePolicyConvertor, PgDropPolicyConvertor, PgRenamePolicyConvertor, PgAlterPolicyConvertor, PgCreateIndPolicyConvertor, PgDropIndPolicyConvertor, PgRenameIndPolicyConvertor, PgAlterIndPolicyConvertor, PgEnableRlsConvertor, PgDisableRlsConvertor, PgCreateTableConvertor, MySqlCreateTableConvertor, SingleStoreCreateTableConvertor, SQLiteCreateTableConvertor, PgCreateViewConvertor, MySqlCreateViewConvertor, SqliteCreateViewConvertor, PgDropViewConvertor, MySqlDropViewConvertor, SqliteDropViewConvertor, MySqlAlterViewConvertor, PgRenameViewConvertor, MySqlRenameViewConvertor, PgAlterViewSchemaConvertor, PgAlterViewAddWithOptionConvertor, PgAlterViewDropWithOptionConvertor, PgAlterViewAlterTablespaceConvertor, PgAlterViewAlterUsingConvertor, PgAlterTableAlterColumnSetGenerated, PgAlterTableAlterColumnDropGenerated, PgAlterTableAlterColumnAlterGenerated, PgAlterTableAddUniqueConstraintConvertor, PgAlterTableDropUniqueConstraintConvertor, PgAlterTableAddCheckConstraintConvertor, PgAlterTableDeleteCheckConstraintConvertor, MySQLAlterTableAddUniqueConstraintConvertor, MySQLAlterTableDropUniqueConstraintConvertor, MySqlAlterTableAddCheckConstraintConvertor, SingleStoreAlterTableAddUniqueConstraintConvertor, SingleStoreAlterTableDropUniqueConstraintConvertor, MySqlAlterTableDeleteCheckConstraintConvertor, CreatePgSequenceConvertor, DropPgSequenceConvertor, RenamePgSequenceConvertor, MovePgSequenceConvertor, AlterPgSequenceConvertor, CreateTypeEnumConvertor, DropTypeEnumConvertor, AlterTypeAddValueConvertor, AlterTypeSetSchemaConvertor, AlterRenameTypeConvertor, AlterTypeDropValueConvertor, PgDropTableConvertor, MySQLDropTableConvertor, SingleStoreDropTableConvertor, SQLiteDropTableConvertor, PgRenameTableConvertor, SqliteRenameTableConvertor, MySqlRenameTableConvertor, SingleStoreRenameTableConvertor, PgAlterTableRenameColumnConvertor, MySqlAlterTableRenameColumnConvertor, SingleStoreAlterTableRenameColumnConvertor, SQLiteAlterTableRenameColumnConvertor, PgAlterTableDropColumnConvertor, MySqlAlterTableDropColumnConvertor, SingleStoreAlterTableDropColumnConvertor, SQLiteAlterTableDropColumnConvertor, PgAlterTableAddColumnConvertor, MySqlAlterTableAddColumnConvertor, SingleStoreAlterTableAddColumnConvertor, SQLiteAlterTableAddColumnConvertor, PgAlterTableAlterColumnSetTypeConvertor, PgAlterTableAlterColumnSetDefaultConvertor, PgAlterTableAlterColumnDropDefaultConvertor, PgAlterTableAlterColumnDropGeneratedConvertor, PgAlterTableAlterColumnSetExpressionConvertor, PgAlterTableAlterColumnAlterrGeneratedConvertor, SqliteAlterTableAlterColumnDropGeneratedConvertor, SqliteAlterTableAlterColumnSetExpressionConvertor, SqliteAlterTableAlterColumnAlterGeneratedConvertor, MySqlAlterTableAlterColumnAlterrGeneratedConvertor, MySqlAlterTableAddPk, MySqlAlterTableDropPk, LibSQLModifyColumn, MySqlModifyColumn, SingleStoreAlterTableAlterColumnAlterrGeneratedConvertor, SingleStoreAlterTableAddPk, SingleStoreAlterTableDropPk, SingleStoreModifyColumn, PgAlterTableCreateCompositePrimaryKeyConvertor, PgAlterTableDeleteCompositePrimaryKeyConvertor, PgAlterTableAlterCompositePrimaryKeyConvertor, MySqlAlterTableCreateCompositePrimaryKeyConvertor, MySqlAlterTableDeleteCompositePrimaryKeyConvertor, MySqlAlterTableAlterCompositePrimaryKeyConvertor, PgAlterTableAlterColumnSetPrimaryKeyConvertor, PgAlterTableAlterColumnDropPrimaryKeyConvertor, PgAlterTableAlterColumnSetNotNullConvertor, PgAlterTableAlterColumnDropNotNullConvertor, PgCreateForeignKeyConvertor, LibSQLCreateForeignKeyConvertor, MySqlCreateForeignKeyConvertor, PgAlterForeignKeyConvertor, PgDeleteForeignKeyConvertor, MySqlDeleteForeignKeyConvertor, CreatePgIndexConvertor, CreateMySqlIndexConvertor, CreateSingleStoreIndexConvertor, CreateSqliteIndexConvertor, PgDropIndexConvertor, PgCreateSchemaConvertor, PgRenameSchemaConvertor, PgDropSchemaConvertor, PgAlterTableSetSchemaConvertor, PgAlterTableSetNewSchemaConvertor, PgAlterTableRemoveFromSchemaConvertor, SqliteDropIndexConvertor, MySqlDropIndexConvertor, SingleStoreDropIndexConvertor, SQLiteRecreateTableConvertor, LibSQLRecreateTableConvertor, SingleStoreRecreateTableConvertor, convertors, init_sqlgenerator, _moveDataStatements, getOldTableName, getNewTableName, logSuggestionsAndReturn, init_sqlitePushUtils, preparePgCreateTableJson, prepareMySqlCreateTableJson, prepareSingleStoreCreateTableJson, prepareSQLiteCreateTable, prepareDropTableJson, prepareRenameTableJson, prepareCreateEnumJson, prepareAddValuesToEnumJson, prepareDropEnumValues, prepareDropEnumJson, prepareMoveEnumJson, prepareRenameEnumJson, prepareCreateSequenceJson, prepareAlterSequenceJson, prepareDropSequenceJson, prepareMoveSequenceJson, prepareRenameSequenceJson, prepareCreateRoleJson, prepareAlterRoleJson, prepareDropRoleJson, prepareRenameRoleJson, prepareCreateSchemasJson, prepareRenameSchemasJson, prepareDeleteSchemasJson, prepareRenameColumns, _prepareDropColumns, _prepareAddColumns, _prepareSqliteAddColumns, prepareAlterColumnsMysql, preparePgAlterColumns, prepareSqliteAlterColumns, prepareRenamePolicyJsons, prepareRenameIndPolicyJsons, prepareCreatePolicyJsons, prepareCreateIndPolicyJsons, prepareDropPolicyJsons, prepareDropIndPolicyJsons, prepareAlterPolicyJson, prepareAlterIndPolicyJson, preparePgCreateIndexesJson, prepareCreateIndexesJson, prepareCreateReferencesJson, prepareLibSQLCreateReferencesJson, prepareDropReferencesJson, prepareLibSQLDropReferencesJson, prepareAlterReferencesJson, prepareDropIndexesJson, prepareAddCompositePrimaryKeySqlite, prepareDeleteCompositePrimaryKeySqlite, prepareAlterCompositePrimaryKeySqlite, prepareAddCompositePrimaryKeyPg, prepareDeleteCompositePrimaryKeyPg, prepareAlterCompositePrimaryKeyPg, prepareAddUniqueConstraintPg, prepareDeleteUniqueConstraintPg, prepareAddCheckConstraint, prepareDeleteCheckConstraint, prepareAddCompositePrimaryKeyMySql, prepareDeleteCompositePrimaryKeyMySql, prepareAlterCompositePrimaryKeyMySql, preparePgCreateViewJson, prepareMySqlCreateViewJson, prepareSqliteCreateViewJson, prepareDropViewJson, prepareRenameViewJson, preparePgAlterViewAlterSchemaJson, preparePgAlterViewAddWithOptionJson, preparePgAlterViewDropWithOptionJson, preparePgAlterViewAlterTablespaceJson, preparePgAlterViewAlterUsingJson, prepareMySqlAlterView, init_jsonStatements, prepareLibSQLRecreateTable, prepareSQLiteRecreateTable, libSQLCombineStatements, sqliteCombineStatements, prepareSingleStoreRecreateTable, singleStoreCombineStatements, init_statementCombiner, snapshotsDiffer_exports, makeChanged, makeSelfOrChanged, makePatched, makeSelfOrPatched, columnSchema, alteredColumnSchema, enumSchema3, changedEnumSchema, tableScheme, alteredTableScheme, alteredViewCommon, alteredPgViewSchema, alteredMySqlViewSchema, diffResultScheme, diffResultSchemeMysql, diffResultSchemeSingleStore, diffResultSchemeSQLite, schemaChangeFor, nameChangeFor, nameSchemaChangeFor, columnChangeFor, applyPgSnapshotsDiff, applyMysqlSnapshotsDiff, applySingleStoreSnapshotsDiff, applySqliteSnapshotsDiff, applyLibSQLSnapshotsDiff, init_snapshotsDiffer, init_words, dialects, dialect4, commonSquashedSchema, commonSchema, init_schemaValidator, sqliteDriversLiterals, postgresqlDriversLiterals, prefixes, prefix, casingTypes, casingType, sqliteDriver, postgresDriver, driver2, configMigrations, configCommonSchema, casing, introspectParams, configIntrospectCliSchema, configGenerateSchema, configPushSchema, init_common2, withStyle, init_outputs, import_hanji2, schemasResolver, tablesResolver, viewsResolver, mySqlViewsResolver, sqliteViewsResolver, sequencesResolver, roleResolver, policyResolver, indPolicyResolver, enumsResolver, columnsResolver, promptColumnsConflicts, promptNamedConflict, promptNamedWithSchemasConflict, promptSchemasConflict, BREAKPOINT, init_migrate, posixClasses, braceEscape, regexpEscape, rangesToString, parseClass, init_brace_expressions, escape, init_escape, unescape, init_unescape, import_brace_expansion, minimatch, starDotExtRE, starDotExtTest, starDotExtTestDot, starDotExtTestNocase, starDotExtTestNocaseDot, starDotStarRE, starDotStarTest, starDotStarTestDot, dotStarRE, dotStarTest, starRE, starTest, starTestDot, qmarksRE, qmarksTestNocase, qmarksTestNocaseDot, qmarksTestDot, qmarksTest, qmarksTestNoExt, qmarksTestNoExtDot, defaultPlatform, path, sep, GLOBSTAR, plTypes, qmark, star, twoStarDot, twoStarNoDot, charSet, reSpecials, addPatternStartSet, filter, ext, defaults, braceExpand, MAX_PATTERN_LENGTH, assertValidPattern, makeRe, match2, globUnescape, globMagic, regExpEscape, Minimatch, init_mjs, entityKind2, hasOwnEntityKind2, init_entity2, _a3, Column2, init_column2, _a22, ColumnBuilder2, init_column_builder2, TableName2, init_table_utils2, _a32, ForeignKeyBuilder2, _a4, ForeignKey2, init_foreign_keys2, init_tracing_utils2, _a5, UniqueConstraintBuilder, _a6, UniqueOnConstraintBuilder, _a7, UniqueConstraint, init_unique_constraint2, init_array2, _a8, _b, PgColumnBuilder2, _a9, _b2, PgColumn2, _a10, _b3, ExtraConfigColumn2, _a11, IndexedColumn2, _a12, _b4, PgArrayBuilder2, _a13, _b5, _PgArray, PgArray2, init_common22, _a14, _b6, PgEnumObjectColumnBuilder2, _a15, _b7, PgEnumObjectColumn2, isPgEnumSym2, _a16, _b8, PgEnumColumnBuilder2, _a17, _b9, PgEnumColumn2, init_enum2, _a18, Subquery2, _a19, _b10, WithSubquery2, init_subquery2, version4, init_version2, otel2, rawTracer2, tracer2, init_tracing2, ViewBaseConfig2, init_view_common3, Schema2, Columns2, ExtraConfigColumns2, OriginalName2, BaseName2, IsAlias2, ExtraConfigBuilder2, IsDrizzleTable2, _a20, _b11, _c, _d, _e3, _f, _g, _h, _i, _j, Table2, init_table8, _a21, FakePrimitiveParam, _a222, StringChunk2, _a23, _SQL, SQL2, _a24, Name2, noopDecoder2, noopEncoder2, noopMapper2, _a25, Param2, _a26, Placeholder2, IsDrizzleView2, _a27, _b12, _c2, View3, init_sql3, _a28, ColumnAliasProxyHandler2, _a29, TableAliasProxyHandler2, _a30, RelationTableAliasProxyHandler, init_alias3, _a31, _b13, DrizzleError2, DrizzleQueryError, _a322, _b14, TransactionRollbackError2, init_errors22, _a33, ConsoleLogWriter2, _a34, DefaultLogger2, _a35, NoopLogger2, init_logger3, init_operations, _a36, _b15, QueryPromise2, init_query_promise2, textDecoder, init_utils22, _a37, _b16, PgIntColumnBaseBuilder2, init_int_common2, _a38, _b17, PgBigInt53Builder2, _a39, _b18, PgBigInt532, _a40, _b19, PgBigInt64Builder2, _a41, _b20, PgBigInt642, init_bigint2, _a42, _b21, PgBigSerial53Builder2, _a43, _b22, PgBigSerial532, _a44, _b23, PgBigSerial64Builder2, _a45, _b24, PgBigSerial642, init_bigserial2, _a46, _b25, PgBooleanBuilder2, _a47, _b26, PgBoolean2, init_boolean2, _a48, _b27, PgCharBuilder2, _a49, _b28, PgChar2, init_char2, _a50, _b29, PgCidrBuilder2, _a51, _b30, PgCidr2, init_cidr2, _a52, _b31, PgCustomColumnBuilder2, _a53, _b32, PgCustomColumn2, init_custom2, _a54, _b33, PgDateColumnBaseBuilder2, init_date_common2, _a55, _b34, PgDateBuilder2, _a56, _b35, PgDate2, _a57, _b36, PgDateStringBuilder2, _a58, _b37, PgDateString2, init_date2, _a59, _b38, PgDoublePrecisionBuilder2, _a60, _b39, PgDoublePrecision2, init_double_precision2, _a61, _b40, PgInetBuilder2, _a62, _b41, PgInet2, init_inet2, _a63, _b42, PgIntegerBuilder2, _a64, _b43, PgInteger2, init_integer2, _a65, _b44, PgIntervalBuilder2, _a66, _b45, PgInterval2, init_interval2, _a67, _b46, PgJsonBuilder2, _a68, _b47, PgJson2, init_json2, _a69, _b48, PgJsonbBuilder2, _a70, _b49, PgJsonb2, init_jsonb2, _a71, _b50, PgLineBuilder2, _a72, _b51, PgLineTuple2, _a73, _b52, PgLineABCBuilder2, _a74, _b53, PgLineABC2, init_line2, _a75, _b54, PgMacaddrBuilder2, _a76, _b55, PgMacaddr2, init_macaddr2, _a77, _b56, PgMacaddr8Builder2, _a78, _b57, PgMacaddr82, init_macaddr82, _a79, _b58, PgNumericBuilder2, _a80, _b59, PgNumeric2, _a81, _b60, PgNumericNumberBuilder2, _a82, _b61, PgNumericNumber2, _a83, _b62, PgNumericBigIntBuilder2, _a84, _b63, PgNumericBigInt2, init_numeric2, _a85, _b64, PgPointTupleBuilder2, _a86, _b65, PgPointTuple2, _a87, _b66, PgPointObjectBuilder2, _a88, _b67, PgPointObject2, init_point2, init_utils32, _a89, _b68, PgGeometryBuilder2, _a90, _b69, PgGeometry2, _a91, _b70, PgGeometryObjectBuilder2, _a92, _b71, PgGeometryObject2, init_geometry2, _a93, _b72, PgRealBuilder2, _a94, _b73, PgReal2, init_real2, _a95, _b74, PgSerialBuilder2, _a96, _b75, PgSerial2, init_serial2, _a97, _b76, PgSmallIntBuilder2, _a98, _b77, PgSmallInt2, init_smallint2, _a99, _b78, PgSmallSerialBuilder2, _a100, _b79, PgSmallSerial2, init_smallserial2, _a101, _b80, PgTextBuilder2, _a102, _b81, PgText2, init_text2, _a103, _b82, PgTimeBuilder2, _a104, _b83, PgTime2, init_time2, _a105, _b84, PgTimestampBuilder2, _a106, _b85, PgTimestamp2, _a107, _b86, PgTimestampStringBuilder2, _a108, _b87, PgTimestampString2, init_timestamp2, _a109, _b88, PgUUIDBuilder2, _a110, _b89, PgUUID2, init_uuid3, _a111, _b90, PgVarcharBuilder2, _a112, _b91, PgVarchar2, init_varchar2, _a113, _b92, PgBinaryVectorBuilder2, _a114, _b93, PgBinaryVector2, init_bit2, _a115, _b94, PgHalfVectorBuilder2, _a116, _b95, PgHalfVector2, init_halfvec2, _a117, _b96, PgSparseVectorBuilder2, _a118, _b97, PgSparseVector2, init_sparsevec2, _a119, _b98, PgVectorBuilder2, _a120, _b99, PgVector2, init_vector3, init_all2, InlineForeignKeys2, EnableRLS2, _a121, _b100, _c3, _d2, _e22, _f2, PgTable2, pgTable2, init_table22, _a122, PrimaryKeyBuilder2, _a123, PrimaryKey2, init_primary_keys2, eq2, ne4, gt3, gte2, lt4, lte2, init_conditions2, init_select3, init_expressions2, _a124, Relation2, _a125, Relations2, _a126, _b101, _One, One2, _a127, _b102, _Many, Many2, init_relations2, init_aggregate2, init_vector22, init_functions2, init_sql22, dist_exports, init_dist9, init_alias22, _a128, CheckBuilder, _a129, Check, init_checks6, init_columns2, _a130, _SelectionProxyHandler, SelectionProxyHandler2, init_selection_proxy2, _a131, IndexBuilderOn2, _a132, IndexBuilder2, _a133, Index2, init_indexes2, _a134, PgPolicy, init_policies2, PgViewConfig2, init_view_common22, _a135, CasingCache2, init_casing2, _a136, _b103, PgViewBase2, init_view_base2, _a137, PgDialect2, init_dialect2, _a138, TypedQueryBuilder2, init_query_builder3, _a139, PgSelectBuilder2, _a140, _b104, PgSelectQueryBuilderBase2, _a141, _b105, PgSelectBase2, getPgSetOperators2, union22, unionAll2, intersect2, intersectAll2, except2, exceptAll2, init_select22, _a142, QueryBuilder2, init_query_builder22, _a143, DefaultViewBuilderCore, _a144, _b106, ViewBuilder, _a145, _b107, ManualViewBuilder, _a146, MaterializedViewBuilderCore, _a147, _b108, MaterializedViewBuilder, _a148, _b109, ManualMaterializedViewBuilder, _a149, _b110, _c4, PgView2, PgMaterializedViewConfig2, _a150, _b111, _c5, PgMaterializedView, init_view2, init_utils42, _a151, _b112, PgDeleteBase2, init_delete2, _a152, PgInsertBuilder2, _a153, _b113, PgInsertBase2, init_insert2, _a154, _b114, PgRefreshMaterializedView2, init_refresh_materialized_view2, init_select_types, _a155, PgUpdateBuilder2, _a156, _b115, PgUpdateBase2, init_update2, init_query_builders2, _a157, _b116, _c6, _PgCountBuilder, PgCountBuilder2, init_count2, _a158, RelationalQueryBuilder2, _a159, _b117, PgRelationalQuery2, init_query2, _a160, _b118, PgRaw2, init_raw2, _a161, PgDatabase2, init_db2, _a162, PgRole, init_roles2, _a163, PgSequence, init_sequence2, _a164, PgSchema5, init_schema3, _a165, Cache, _a166, _b119, NoopCache, init_cache, _a167, PgPreparedQuery2, _a168, PgSession2, _a169, _b120, PgTransaction2, init_session3, init_subquery22, init_utils52, init_pg_core2, vectorOps, init_vector32, sqlToStr, init_utils62, indexName, generatePgSnapshot, trimChar, fromDatabase, defaultForColumn, getColumnsInfoQuery, init_pgSerializer, import_hanji4, Select, init_selector_ui, init_alias32, _a170, CheckBuilder2, _a171, Check2, init_checks22, _a172, ForeignKeyBuilder22, _a173, ForeignKey22, init_foreign_keys22, _a174, UniqueConstraintBuilder2, _a175, UniqueOnConstraintBuilder2, _a176, UniqueConstraint2, init_unique_constraint22, _a177, _b121, SQLiteColumnBuilder, _a178, _b122, SQLiteColumn, init_common3, _a179, _b123, SQLiteBigIntBuilder, _a180, _b124, SQLiteBigInt, _a181, _b125, SQLiteBlobJsonBuilder, _a182, _b126, SQLiteBlobJson, _a183, _b127, SQLiteBlobBufferBuilder, _a184, _b128, SQLiteBlobBuffer, init_blob, _a185, _b129, SQLiteCustomColumnBuilder, _a186, _b130, SQLiteCustomColumn, init_custom22, _a187, _b131, SQLiteBaseIntegerBuilder, _a188, _b132, SQLiteBaseInteger, _a189, _b133, SQLiteIntegerBuilder, _a190, _b134, SQLiteInteger, _a191, _b135, SQLiteTimestampBuilder, _a192, _b136, SQLiteTimestamp, _a193, _b137, SQLiteBooleanBuilder, _a194, _b138, SQLiteBoolean, init_integer22, _a195, _b139, SQLiteNumericBuilder, _a196, _b140, SQLiteNumeric, _a197, _b141, SQLiteNumericNumberBuilder, _a198, _b142, SQLiteNumericNumber, _a199, _b143, SQLiteNumericBigIntBuilder, _a200, _b144, SQLiteNumericBigInt, init_numeric22, _a201, _b145, SQLiteRealBuilder, _a202, _b146, SQLiteReal, init_real22, _a203, _b147, SQLiteTextBuilder, _a204, _b148, SQLiteText, _a205, _b149, SQLiteTextJsonBuilder, _a206, _b150, SQLiteTextJson, init_text22, init_columns22, init_all22, InlineForeignKeys22, _a207, _b151, _c7, _d3, _e32, SQLiteTable, sqliteTable, init_table32, _a208, IndexBuilderOn22, _a209, IndexBuilder22, _a210, Index4, init_indexes22, _a211, PrimaryKeyBuilder22, _a212, PrimaryKey22, init_primary_keys22, init_utils72, _a213, _b152, SQLiteDeleteBase, init_delete22, _a214, _b153, SQLiteViewBase, init_view_base22, _a215, SQLiteDialect, _a216, _b154, SQLiteSyncDialect, _a217, _b155, SQLiteAsyncDialect, init_dialect22, _a218, SQLiteSelectBuilder, _a219, _b156, SQLiteSelectQueryBuilderBase, _a220, _b157, SQLiteSelectBase, getSQLiteSetOperators, union32, unionAll22, intersect22, except22, init_select32, _a221, QueryBuilder22, init_query_builder32, _a2222, SQLiteInsertBuilder, _a223, _b158, SQLiteInsertBase, init_insert22, init_select_types2, _a224, SQLiteUpdateBuilder, _a225, _b159, SQLiteUpdateBase, init_update22, init_query_builders22, _a226, _b160, _c8, _SQLiteCountBuilder, SQLiteCountBuilder, init_count22, _a227, RelationalQueryBuilder22, _a228, _b161, SQLiteRelationalQuery, _a229, _b162, SQLiteSyncRelationalQuery, init_query22, _a230, _b163, SQLiteRaw, init_raw22, _a231, BaseSQLiteDatabase, init_db22, _a232, _b164, ExecuteResultSync, _a233, SQLitePreparedQuery, _a234, SQLiteSession, _a235, _b165, SQLiteTransaction, init_session22, init_subquery3, _a236, ViewBuilderCore, _a237, _b166, ViewBuilder2, _a238, _b167, ManualViewBuilder2, _a239, _b168, SQLiteView2, init_view22, init_sqlite_core, generateSqliteSnapshot, fromDatabase2, init_sqliteSerializer, getTablesFilterByExtensions, init_getTablesFilterByExtensions, init_alias4, _a240, CheckBuilder3, _a241, Check3, init_checks32, _a242, ForeignKeyBuilder3, _a243, ForeignKey3, init_foreign_keys3, _a244, UniqueConstraintBuilder3, _a245, UniqueOnConstraintBuilder3, _a246, UniqueConstraint3, init_unique_constraint3, _a247, _b169, MySqlColumnBuilder, _a248, _b170, MySqlColumn, _a249, _b171, MySqlColumnBuilderWithAutoIncrement, _a250, _b172, MySqlColumnWithAutoIncrement, init_common4, _a251, _b173, MySqlBigInt53Builder, _a252, _b174, MySqlBigInt53, _a253, _b175, MySqlBigInt64Builder, _a254, _b176, MySqlBigInt64, init_bigint22, _a255, _b177, MySqlBinaryBuilder, _a256, _b178, MySqlBinary, init_binary, _a257, _b179, MySqlBooleanBuilder, _a258, _b180, MySqlBoolean, init_boolean22, _a259, _b181, MySqlCharBuilder, _a260, _b182, MySqlChar, init_char22, _a261, _b183, MySqlCustomColumnBuilder, _a262, _b184, MySqlCustomColumn, init_custom3, _a263, _b185, MySqlDateBuilder, _a264, _b186, MySqlDate, _a265, _b187, MySqlDateStringBuilder, _a266, _b188, MySqlDateString, init_date22, _a267, _b189, MySqlDateTimeBuilder, _a268, _b190, MySqlDateTime, _a269, _b191, MySqlDateTimeStringBuilder, _a270, _b192, MySqlDateTimeString, init_datetime, _a271, _b193, MySqlDecimalBuilder, _a272, _b194, MySqlDecimal, _a273, _b195, MySqlDecimalNumberBuilder, _a274, _b196, MySqlDecimalNumber, _a275, _b197, MySqlDecimalBigIntBuilder, _a276, _b198, MySqlDecimalBigInt, init_decimal, _a277, _b199, MySqlDoubleBuilder, _a278, _b200, MySqlDouble, init_double, _a279, _b201, MySqlEnumColumnBuilder, _a280, _b202, MySqlEnumColumn, _a281, _b203, MySqlEnumObjectColumnBuilder, _a282, _b204, MySqlEnumObjectColumn, init_enum22, _a283, _b205, MySqlFloatBuilder, _a284, _b206, MySqlFloat, init_float, _a285, _b207, MySqlIntBuilder, _a286, _b208, MySqlInt, init_int, _a287, _b209, MySqlJsonBuilder, _a288, _b210, MySqlJson, init_json22, _a289, _b211, MySqlMediumIntBuilder, _a290, _b212, MySqlMediumInt, init_mediumint, _a291, _b213, MySqlRealBuilder, _a292, _b214, MySqlReal, init_real3, _a293, _b215, MySqlSerialBuilder, _a294, _b216, MySqlSerial, init_serial22, _a295, _b217, MySqlSmallIntBuilder, _a296, _b218, MySqlSmallInt, init_smallint22, _a297, _b219, MySqlTextBuilder, _a298, _b220, MySqlText, init_text3, _a299, _b221, MySqlTimeBuilder, _a300, _b222, MySqlTime, init_time22, _a301, _b223, MySqlDateColumnBaseBuilder, _a302, _b224, MySqlDateBaseColumn, init_date_common22, _a303, _b225, MySqlTimestampBuilder, _a304, _b226, MySqlTimestamp, _a305, _b227, MySqlTimestampStringBuilder, _a306, _b228, MySqlTimestampString, init_timestamp22, _a307, _b229, MySqlTinyIntBuilder, _a308, _b230, MySqlTinyInt, init_tinyint, _a309, _b231, MySqlVarBinaryBuilder, _a310, _b232, MySqlVarBinary, init_varbinary, _a311, _b233, MySqlVarCharBuilder, _a312, _b234, MySqlVarChar, init_varchar22, _a313, _b235, MySqlYearBuilder, _a314, _b236, MySqlYear, init_year, init_columns3, _a315, _b237, _c9, _MySqlCountBuilder, MySqlCountBuilder, init_count3, _a316, IndexBuilderOn3, _a317, IndexBuilder3, _a318, Index5, init_indexes3, init_all3, InlineForeignKeys3, _a319, _b238, _c10, _d4, _e4, MySqlTable, mysqlTable, init_table42, _a320, PrimaryKeyBuilder3, _a321, PrimaryKey3, init_primary_keys3, MySqlViewConfig, init_view_common32, init_utils8, _a3222, _b239, MySqlDeleteBase, init_delete3, _a323, _b240, MySqlViewBase, init_view_base3, _a324, MySqlDialect, init_dialect3, _a325, MySqlSelectBuilder, _a326, _b241, MySqlSelectQueryBuilderBase, _a327, _b242, MySqlSelectBase, getMySqlSetOperators, union4, unionAll3, intersect3, intersectAll22, except3, exceptAll22, init_select4, _a328, QueryBuilder3, init_query_builder4, _a329, MySqlInsertBuilder, _a330, _b243, MySqlInsertBase, init_insert3, init_select_types3, _a331, MySqlUpdateBuilder, _a332, _b244, MySqlUpdateBase, init_update3, init_query_builders3, _a333, RelationalQueryBuilder3, _a334, _b245, MySqlRelationalQuery, init_query3, _a335, MySqlDatabase, init_db3, _a336, ViewBuilderCore2, _a337, _b246, ViewBuilder3, _a338, _b247, ManualViewBuilder3, _a339, _b248, _c11, MySqlView2, init_view3, _a340, MySqlSchema5, init_schema22, _a341, MySqlPreparedQuery, _a342, MySqlSession, _a343, _b249, MySqlTransaction, init_session32, init_subquery4, init_mysql_core, handleEnumType, generateMySqlSnapshot, fromDatabase3, init_mysqlSerializer, cliConfigGenerate, pushParams, pullParams, configCheck, cliConfigCheck, init_cli, gelCredentials, init_gel, libSQLCredentials, init_libsql, mysqlCredentials, init_mysql, postgresCredentials, init_postgres, singlestoreCredentials, init_singlestore, sqliteCredentials, init_sqlite, credentials, studioCliParams, studioConfig, init_studio, es5_exports, _3, es5_default, init_es5, import_hanji7, assertES5, safeRegister, migrateConfig, init_utils9, prepareFromExports, init_pgImports, init_alias5, _a344, UniqueConstraintBuilder4, _a345, UniqueOnConstraintBuilder4, _a346, UniqueConstraint4, init_unique_constraint4, _a347, _b250, SingleStoreColumnBuilder, _a348, _b251, SingleStoreColumn, _a349, _b252, SingleStoreColumnBuilderWithAutoIncrement, _a350, _b253, SingleStoreColumnWithAutoIncrement, init_common5, _a351, _b254, SingleStoreBigInt53Builder, _a352, _b255, SingleStoreBigInt53, _a353, _b256, SingleStoreBigInt64Builder, _a354, _b257, SingleStoreBigInt64, init_bigint3, _a355, _b258, SingleStoreBinaryBuilder, _a356, _b259, SingleStoreBinary, init_binary2, _a357, _b260, SingleStoreBooleanBuilder, _a358, _b261, SingleStoreBoolean, init_boolean3, _a359, _b262, SingleStoreCharBuilder, _a360, _b263, SingleStoreChar, init_char3, _a361, _b264, SingleStoreCustomColumnBuilder, _a362, _b265, SingleStoreCustomColumn, init_custom4, _a363, _b266, SingleStoreDateBuilder, _a364, _b267, SingleStoreDate, _a365, _b268, SingleStoreDateStringBuilder, _a366, _b269, SingleStoreDateString, init_date3, _a367, _b270, SingleStoreDateTimeBuilder, _a368, _b271, SingleStoreDateTime, _a369, _b272, SingleStoreDateTimeStringBuilder, _a370, _b273, SingleStoreDateTimeString, init_datetime2, _a371, _b274, SingleStoreDecimalBuilder, _a372, _b275, SingleStoreDecimal, _a373, _b276, SingleStoreDecimalNumberBuilder, _a374, _b277, SingleStoreDecimalNumber, _a375, _b278, SingleStoreDecimalBigIntBuilder, _a376, _b279, SingleStoreDecimalBigInt, init_decimal2, _a377, _b280, SingleStoreDoubleBuilder, _a378, _b281, SingleStoreDouble, init_double2, _a379, _b282, SingleStoreEnumColumnBuilder, _a380, _b283, SingleStoreEnumColumn, init_enum3, _a381, _b284, SingleStoreFloatBuilder, _a382, _b285, SingleStoreFloat, init_float2, _a383, _b286, SingleStoreIntBuilder, _a384, _b287, SingleStoreInt, init_int2, _a385, _b288, SingleStoreJsonBuilder, _a386, _b289, SingleStoreJson, init_json3, _a387, _b290, SingleStoreMediumIntBuilder, _a388, _b291, SingleStoreMediumInt, init_mediumint2, _a389, _b292, SingleStoreRealBuilder, _a390, _b293, SingleStoreReal, init_real4, _a391, _b294, SingleStoreSerialBuilder, _a392, _b295, SingleStoreSerial, init_serial3, _a393, _b296, SingleStoreSmallIntBuilder, _a394, _b297, SingleStoreSmallInt, init_smallint3, _a395, _b298, SingleStoreTextBuilder, _a396, _b299, SingleStoreText, init_text4, _a397, _b300, SingleStoreTimeBuilder, _a398, _b301, SingleStoreTime, init_time3, _a399, _b302, SingleStoreDateColumnBaseBuilder, _a400, _b303, SingleStoreDateBaseColumn, init_date_common3, _a401, _b304, SingleStoreTimestampBuilder, _a402, _b305, SingleStoreTimestamp, _a403, _b306, SingleStoreTimestampStringBuilder, _a404, _b307, SingleStoreTimestampString, init_timestamp3, _a405, _b308, SingleStoreTinyIntBuilder, _a406, _b309, SingleStoreTinyInt, init_tinyint2, _a407, _b310, SingleStoreVarBinaryBuilder, _a408, _b311, SingleStoreVarBinary, init_varbinary2, _a409, _b312, SingleStoreVarCharBuilder, _a410, _b313, SingleStoreVarChar, init_varchar3, _a411, _b314, SingleStoreVectorBuilder, _a412, _b315, SingleStoreVector, init_vector4, _a413, _b316, SingleStoreYearBuilder, _a414, _b317, SingleStoreYear, init_year2, init_columns4, _a415, _b318, _c12, _SingleStoreCountBuilder, SingleStoreCountBuilder, init_count4, _a416, IndexBuilderOn4, _a417, IndexBuilder4, _a418, Index6, init_indexes4, init_all4, _a419, _b319, _c13, _d5, SingleStoreTable, init_table52, _a420, PrimaryKeyBuilder4, _a421, PrimaryKey4, init_primary_keys4, init_utils10, _a422, _b320, SingleStoreDeleteBase, init_delete4, _a423, SingleStoreInsertBuilder, _a424, _b321, SingleStoreInsertBase, init_insert4, _a425, SingleStoreDialect, init_dialect4, _a426, SingleStoreSelectBuilder, _a427, _b322, SingleStoreSelectQueryBuilderBase, _a428, _b323, SingleStoreSelectBase, getSingleStoreSetOperators, union5, unionAll4, intersect4, except4, minus, init_select5, _a429, QueryBuilder4, init_query_builder5, init_select_types4, _a430, SingleStoreUpdateBuilder, _a431, _b324, SingleStoreUpdateBase, init_update4, init_query_builders4, _a432, SingleStoreDatabase, init_db4, _a433, SingleStoreSchema5, init_schema32, _a434, SingleStorePreparedQuery, _a435, SingleStoreSession, _a436, _b325, SingleStoreTransaction, init_session4, init_subquery5, init_singlestore_core, dialect5, generateSingleStoreSnapshot, fromDatabase4, init_singlestoreSerializer, sqliteImports_exports, prepareFromExports2, prepareFromSqliteImports, init_sqliteImports, mysqlImports_exports, prepareFromExports3, prepareFromMySqlImports, init_mysqlImports, mysqlPushUtils_exports, import_hanji8, filterStatements, logSuggestionsAndReturn2, init_mysqlPushUtils, mysqlIntrospect_exports, import_hanji9, mysqlPushIntrospect, init_mysqlIntrospect, singlestoreImports_exports, prepareFromExports4, prepareFromSingleStoreImports, init_singlestoreImports, singlestorePushUtils_exports, import_hanji10, filterStatements2, logSuggestionsAndReturn3, init_singlestorePushUtils, singlestoreIntrospect_exports, import_hanji11, singlestorePushIntrospect, init_singlestoreIntrospect, import_hanji3, pgPushIntrospect = async (db2, filters, schemaFilters, entities, tsSchema) => {
+}, __toESM5 = (mod, isNodeMode, target) => (target = mod != null ? __create2(__getProtoOf2(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp2(target, "default", { value: mod, enumerable: true }) : target, mod)), __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value), ANSI_BACKGROUND_OFFSET, wrapAnsi16, wrapAnsi256, wrapAnsi16m, styles2, modifierNames, foregroundColorNames, backgroundColorNames, colorNames, ansiStyles, ansi_styles_default, init_ansi_styles, env, flagForceColor, supportsColor, supports_color_default, init_supports_color, init_utilities, stdoutColor, stderrColor, GENERATOR, STYLER, IS_EMPTY, levelMapping, styles22, applyOptions, chalkFactory, getModelAnsi, usedModels, proto, createStyler, createBuilder, applyStyle, chalk, chalkStderr, source_default, init_source, require_old, require_fs, require_path, require_balanced_match, require_brace_expansion, require_minimatch, require_inherits_browser2, require_inherits2, require_common3, require_sync, require_wrappy, require_once, require_inflight, require_glob, require_readline, require_src3, require_utils4, require_lodash, require_hanji, originUUID, snapshotVersion, mapValues, mapKeys, mapEntries, customMapEntries, init_global2, util3, objectUtil2, ZodParsedType2, getParsedType4, init_util4, ZodIssueCode4, ZodError5, init_ZodError2, errorMap2, en_default4, init_en4, overrideErrorMap2, init_errors9, makeIssue2, ParseStatus2, INVALID3, DIRTY2, OK2, isAborted2, isDirty2, isValid2, isAsync2, init_parseUtil2, init_typeAliases2, errorUtil2, init_errorUtil2, ParseInputLazyPath2, handleResult2, ZodType4, cuidRegex2, cuid2Regex2, ulidRegex2, uuidRegex2, nanoidRegex2, jwtRegex2, durationRegex2, emailRegex2, _emojiRegex2, emojiRegex2, ipv4Regex2, ipv4CidrRegex2, ipv6Regex2, ipv6CidrRegex2, base64Regex2, base64urlRegex2, dateRegexSource2, dateRegex2, ZodString4, ZodNumber4, ZodBigInt4, ZodBoolean4, ZodDate4, ZodSymbol4, ZodUndefined4, ZodNull4, ZodAny4, ZodUnknown4, ZodNever4, ZodVoid4, ZodArray4, ZodObject4, ZodUnion4, getDiscriminator2, ZodDiscriminatedUnion4, ZodIntersection4, ZodTuple4, ZodRecord4, ZodMap4, ZodSet4, ZodFunction3, ZodLazy4, ZodLiteral4, ZodEnum4, ZodNativeEnum2, ZodPromise4, ZodEffects2, ZodOptional4, ZodNullable4, ZodDefault4, ZodCatch4, ZodNaN4, BRAND2, ZodBranded2, ZodPipeline2, ZodReadonly4, late2, ZodFirstPartyTypeKind3, stringType2, numberType2, nanType2, bigIntType2, booleanType2, dateType2, symbolType2, undefinedType2, nullType2, anyType2, unknownType2, neverType2, voidType2, arrayType2, objectType2, strictObjectType2, unionType2, discriminatedUnionType2, intersectionType2, tupleType2, recordType2, mapType2, setType2, functionType2, lazyType2, literalType2, enumType2, nativeEnumType2, promiseType2, effectsType2, optionalType2, nullableType2, preprocessType2, pipelineType2, coerce2, init_types5, init_external4, init_v32, init_esm2, enumSchema, enumSchemaV1, indexColumn, index2, fk, sequenceSchema, roleSchema, sequenceSquashed, column2, checkConstraint, columnSquashed, compositePK, uniqueConstraint, policy, policySquashed, viewWithOption, matViewWithOption, mergedViewWithOption, view2, table8, schemaHash, kitInternals, gelSchemaExternal, gelSchemaInternal, tableSquashed, gelSchemaSquashed, gelSchema, dryGel, init_gelSchema, index22, fk2, column22, tableV3, compositePK2, uniqueConstraint2, checkConstraint2, tableV4, table22, viewMeta, view22, kitInternals2, dialect2, schemaHash2, schemaInternalV3, schemaInternalV4, schemaInternalV5, schemaInternal, schemaV3, schemaV4, schemaV5, schema2, tableSquashedV4, tableSquashed2, viewSquashed, schemaSquashed, schemaSquashedV4, MySqlSquasher, squashMysqlScheme, mysqlSchema, mysqlSchemaV5, mysqlSchemaSquashed, backwardCompatibleMysqlSchema, dryMySql, init_mysqlSchema, indexV2, columnV2, tableV2, enumSchemaV12, enumSchema2, pgSchemaV2, references, columnV1, tableV1, pgSchemaV1, indexColumn2, index3, indexV4, indexV5, indexV6, fk3, sequenceSchema2, roleSchema2, sequenceSquashed2, columnV7, column3, checkConstraint3, columnSquashed2, tableV32, compositePK3, uniqueConstraint3, policy2, policySquashed2, viewWithOption2, matViewWithOption2, mergedViewWithOption2, view3, tableV42, tableV5, tableV6, tableV7, table32, schemaHash3, kitInternals3, pgSchemaInternalV3, pgSchemaInternalV4, pgSchemaInternalV5, pgSchemaInternalV6, pgSchemaExternal, pgSchemaInternalV7, pgSchemaInternal, tableSquashed3, tableSquashedV42, pgSchemaSquashedV4, pgSchemaSquashedV6, pgSchemaSquashed, pgSchemaV3, pgSchemaV4, pgSchemaV5, pgSchemaV6, pgSchemaV7, pgSchema, backwardCompatiblePgSchema, PgSquasher, squashPgScheme, dryPg, init_pgSchema, index4, column4, compositePK4, uniqueConstraint4, table42, viewMeta2, kitInternals4, dialect22, schemaHash4, schemaInternal2, schema22, tableSquashed4, schemaSquashed2, SingleStoreSquasher, squashSingleStoreScheme, singlestoreSchema, singlestoreSchemaSquashed, backwardCompatibleSingleStoreSchema, drySingleStore, init_singlestoreSchema, index5, fk4, compositePK5, column5, tableV33, uniqueConstraint5, checkConstraint4, table52, view4, dialect3, schemaHash5, schemaInternalV32, schemaInternalV42, schemaInternalV52, kitInternals5, latestVersion, schemaInternal3, schemaV32, schemaV42, schemaV52, schema3, tableSquashed5, schemaSquashed3, SQLiteSquasher, squashSqliteScheme, drySQLite, sqliteSchemaV5, sqliteSchema, SQLiteSchemaSquashed, backwardCompatibleSqliteSchema, init_sqliteSchema, copy, prepareMigrationMeta, schemaRenameKey, tableRenameKey, columnRenameKey, init_utils7, import_hanji, warning, error88, isRenamePromptItem, ResolveColumnSelect, tableKey, ResolveSelectNamed, ResolveSelect, ResolveSchemasSelect, Spinner2, ProgressView, init_views, glob, init_serializer, fillPgSnapshot, init_migrationPreparator, require_heap, require_heap2, require_difflib, require_difflib2, require_util2, require_styles, require_has_flag2, require_supports_colors, require_trap, require_zalgo, require_america, require_zebra, require_rainbow, require_random, require_colors, require_safe, require_colorize, require_lib4, import_json_diff, mapArraysDiff, findAlternationsInTable, alternationsInColumn, init_jsonDiffer, parseType, Convertor, PgCreateRoleConvertor, PgDropRoleConvertor, PgRenameRoleConvertor, PgAlterRoleConvertor, PgCreatePolicyConvertor, PgDropPolicyConvertor, PgRenamePolicyConvertor, PgAlterPolicyConvertor, PgCreateIndPolicyConvertor, PgDropIndPolicyConvertor, PgRenameIndPolicyConvertor, PgAlterIndPolicyConvertor, PgEnableRlsConvertor, PgDisableRlsConvertor, PgCreateTableConvertor, MySqlCreateTableConvertor, SingleStoreCreateTableConvertor, SQLiteCreateTableConvertor, PgCreateViewConvertor, MySqlCreateViewConvertor, SqliteCreateViewConvertor, PgDropViewConvertor, MySqlDropViewConvertor, SqliteDropViewConvertor, MySqlAlterViewConvertor, PgRenameViewConvertor, MySqlRenameViewConvertor, PgAlterViewSchemaConvertor, PgAlterViewAddWithOptionConvertor, PgAlterViewDropWithOptionConvertor, PgAlterViewAlterTablespaceConvertor, PgAlterViewAlterUsingConvertor, PgAlterTableAlterColumnSetGenerated, PgAlterTableAlterColumnDropGenerated, PgAlterTableAlterColumnAlterGenerated, PgAlterTableAddUniqueConstraintConvertor, PgAlterTableDropUniqueConstraintConvertor, PgAlterTableAddCheckConstraintConvertor, PgAlterTableDeleteCheckConstraintConvertor, MySQLAlterTableAddUniqueConstraintConvertor, MySQLAlterTableDropUniqueConstraintConvertor, MySqlAlterTableAddCheckConstraintConvertor, SingleStoreAlterTableAddUniqueConstraintConvertor, SingleStoreAlterTableDropUniqueConstraintConvertor, MySqlAlterTableDeleteCheckConstraintConvertor, CreatePgSequenceConvertor, DropPgSequenceConvertor, RenamePgSequenceConvertor, MovePgSequenceConvertor, AlterPgSequenceConvertor, CreateTypeEnumConvertor, DropTypeEnumConvertor, AlterTypeAddValueConvertor, AlterTypeSetSchemaConvertor, AlterRenameTypeConvertor, AlterTypeDropValueConvertor, PgDropTableConvertor, MySQLDropTableConvertor, SingleStoreDropTableConvertor, SQLiteDropTableConvertor, PgRenameTableConvertor, SqliteRenameTableConvertor, MySqlRenameTableConvertor, SingleStoreRenameTableConvertor, PgAlterTableRenameColumnConvertor, MySqlAlterTableRenameColumnConvertor, SingleStoreAlterTableRenameColumnConvertor, SQLiteAlterTableRenameColumnConvertor, PgAlterTableDropColumnConvertor, MySqlAlterTableDropColumnConvertor, SingleStoreAlterTableDropColumnConvertor, SQLiteAlterTableDropColumnConvertor, PgAlterTableAddColumnConvertor, MySqlAlterTableAddColumnConvertor, SingleStoreAlterTableAddColumnConvertor, SQLiteAlterTableAddColumnConvertor, PgAlterTableAlterColumnSetTypeConvertor, PgAlterTableAlterColumnSetDefaultConvertor, PgAlterTableAlterColumnDropDefaultConvertor, PgAlterTableAlterColumnDropGeneratedConvertor, PgAlterTableAlterColumnSetExpressionConvertor, PgAlterTableAlterColumnAlterrGeneratedConvertor, SqliteAlterTableAlterColumnDropGeneratedConvertor, SqliteAlterTableAlterColumnSetExpressionConvertor, SqliteAlterTableAlterColumnAlterGeneratedConvertor, MySqlAlterTableAlterColumnAlterrGeneratedConvertor, MySqlAlterTableAddPk, MySqlAlterTableDropPk, LibSQLModifyColumn, MySqlModifyColumn, SingleStoreAlterTableAlterColumnAlterrGeneratedConvertor, SingleStoreAlterTableAddPk, SingleStoreAlterTableDropPk, SingleStoreModifyColumn, PgAlterTableCreateCompositePrimaryKeyConvertor, PgAlterTableDeleteCompositePrimaryKeyConvertor, PgAlterTableAlterCompositePrimaryKeyConvertor, MySqlAlterTableCreateCompositePrimaryKeyConvertor, MySqlAlterTableDeleteCompositePrimaryKeyConvertor, MySqlAlterTableAlterCompositePrimaryKeyConvertor, PgAlterTableAlterColumnSetPrimaryKeyConvertor, PgAlterTableAlterColumnDropPrimaryKeyConvertor, PgAlterTableAlterColumnSetNotNullConvertor, PgAlterTableAlterColumnDropNotNullConvertor, PgCreateForeignKeyConvertor, LibSQLCreateForeignKeyConvertor, MySqlCreateForeignKeyConvertor, PgAlterForeignKeyConvertor, PgDeleteForeignKeyConvertor, MySqlDeleteForeignKeyConvertor, CreatePgIndexConvertor, CreateMySqlIndexConvertor, CreateSingleStoreIndexConvertor, CreateSqliteIndexConvertor, PgDropIndexConvertor, PgCreateSchemaConvertor, PgRenameSchemaConvertor, PgDropSchemaConvertor, PgAlterTableSetSchemaConvertor, PgAlterTableSetNewSchemaConvertor, PgAlterTableRemoveFromSchemaConvertor, SqliteDropIndexConvertor, MySqlDropIndexConvertor, SingleStoreDropIndexConvertor, SQLiteRecreateTableConvertor, LibSQLRecreateTableConvertor, SingleStoreRecreateTableConvertor, convertors, init_sqlgenerator, _moveDataStatements, getOldTableName, getNewTableName, logSuggestionsAndReturn, init_sqlitePushUtils, preparePgCreateTableJson, prepareMySqlCreateTableJson, prepareSingleStoreCreateTableJson, prepareSQLiteCreateTable, prepareDropTableJson, prepareRenameTableJson, prepareCreateEnumJson, prepareAddValuesToEnumJson, prepareDropEnumValues, prepareDropEnumJson, prepareMoveEnumJson, prepareRenameEnumJson, prepareCreateSequenceJson, prepareAlterSequenceJson, prepareDropSequenceJson, prepareMoveSequenceJson, prepareRenameSequenceJson, prepareCreateRoleJson, prepareAlterRoleJson, prepareDropRoleJson, prepareRenameRoleJson, prepareCreateSchemasJson, prepareRenameSchemasJson, prepareDeleteSchemasJson, prepareRenameColumns, _prepareDropColumns, _prepareAddColumns, _prepareSqliteAddColumns, prepareAlterColumnsMysql, preparePgAlterColumns, prepareSqliteAlterColumns, prepareRenamePolicyJsons, prepareRenameIndPolicyJsons, prepareCreatePolicyJsons, prepareCreateIndPolicyJsons, prepareDropPolicyJsons, prepareDropIndPolicyJsons, prepareAlterPolicyJson, prepareAlterIndPolicyJson, preparePgCreateIndexesJson, prepareCreateIndexesJson, prepareCreateReferencesJson, prepareLibSQLCreateReferencesJson, prepareDropReferencesJson, prepareLibSQLDropReferencesJson, prepareAlterReferencesJson, prepareDropIndexesJson, prepareAddCompositePrimaryKeySqlite, prepareDeleteCompositePrimaryKeySqlite, prepareAlterCompositePrimaryKeySqlite, prepareAddCompositePrimaryKeyPg, prepareDeleteCompositePrimaryKeyPg, prepareAlterCompositePrimaryKeyPg, prepareAddUniqueConstraintPg, prepareDeleteUniqueConstraintPg, prepareAddCheckConstraint, prepareDeleteCheckConstraint, prepareAddCompositePrimaryKeyMySql, prepareDeleteCompositePrimaryKeyMySql, prepareAlterCompositePrimaryKeyMySql, preparePgCreateViewJson, prepareMySqlCreateViewJson, prepareSqliteCreateViewJson, prepareDropViewJson, prepareRenameViewJson, preparePgAlterViewAlterSchemaJson, preparePgAlterViewAddWithOptionJson, preparePgAlterViewDropWithOptionJson, preparePgAlterViewAlterTablespaceJson, preparePgAlterViewAlterUsingJson, prepareMySqlAlterView, init_jsonStatements, prepareLibSQLRecreateTable, prepareSQLiteRecreateTable, libSQLCombineStatements, sqliteCombineStatements, prepareSingleStoreRecreateTable, singleStoreCombineStatements, init_statementCombiner, snapshotsDiffer_exports, makeChanged, makeSelfOrChanged, makePatched, makeSelfOrPatched, columnSchema, alteredColumnSchema, enumSchema3, changedEnumSchema, tableScheme, alteredTableScheme, alteredViewCommon, alteredPgViewSchema, alteredMySqlViewSchema, diffResultScheme, diffResultSchemeMysql, diffResultSchemeSingleStore, diffResultSchemeSQLite, schemaChangeFor, nameChangeFor, nameSchemaChangeFor, columnChangeFor, applyPgSnapshotsDiff, applyMysqlSnapshotsDiff, applySingleStoreSnapshotsDiff, applySqliteSnapshotsDiff, applyLibSQLSnapshotsDiff, init_snapshotsDiffer, init_words, dialects, dialect4, commonSquashedSchema, commonSchema, init_schemaValidator, sqliteDriversLiterals, postgresqlDriversLiterals, prefixes, prefix, casingTypes, casingType, sqliteDriver, postgresDriver, driver2, configMigrations, configCommonSchema, casing, introspectParams, configIntrospectCliSchema, configGenerateSchema, configPushSchema, init_common2, withStyle, init_outputs, import_hanji2, schemasResolver, tablesResolver, viewsResolver, mySqlViewsResolver, sqliteViewsResolver, sequencesResolver, roleResolver, policyResolver, indPolicyResolver, enumsResolver, columnsResolver, promptColumnsConflicts, promptNamedConflict, promptNamedWithSchemasConflict, promptSchemasConflict, BREAKPOINT, init_migrate, posixClasses, braceEscape, regexpEscape, rangesToString, parseClass, init_brace_expressions, escape, init_escape, unescape, init_unescape, import_brace_expansion, minimatch, starDotExtRE, starDotExtTest, starDotExtTestDot, starDotExtTestNocase, starDotExtTestNocaseDot, starDotStarRE, starDotStarTest, starDotStarTestDot, dotStarRE, dotStarTest, starRE, starTest, starTestDot, qmarksRE, qmarksTestNocase, qmarksTestNocaseDot, qmarksTestDot, qmarksTest, qmarksTestNoExt, qmarksTestNoExtDot, defaultPlatform, path, sep2, GLOBSTAR, plTypes, qmark, star, twoStarDot, twoStarNoDot, charSet, reSpecials, addPatternStartSet, filter, ext, defaults, braceExpand, MAX_PATTERN_LENGTH, assertValidPattern, makeRe, match2, globUnescape, globMagic, regExpEscape, Minimatch, init_mjs, entityKind2, hasOwnEntityKind2, init_entity2, _a3, Column2, init_column2, _a22, ColumnBuilder2, init_column_builder2, TableName2, init_table_utils2, _a32, ForeignKeyBuilder2, _a4, ForeignKey2, init_foreign_keys2, init_tracing_utils2, _a5, UniqueConstraintBuilder, _a6, UniqueOnConstraintBuilder, _a7, UniqueConstraint, init_unique_constraint2, init_array2, _a8, _b, PgColumnBuilder2, _a9, _b2, PgColumn2, _a10, _b3, ExtraConfigColumn2, _a11, IndexedColumn2, _a12, _b4, PgArrayBuilder2, _a13, _b5, _PgArray, PgArray2, init_common22, _a14, _b6, PgEnumObjectColumnBuilder2, _a15, _b7, PgEnumObjectColumn2, isPgEnumSym2, _a16, _b8, PgEnumColumnBuilder2, _a17, _b9, PgEnumColumn2, init_enum2, _a18, Subquery2, _a19, _b10, WithSubquery2, init_subquery2, version4, init_version2, otel2, rawTracer2, tracer2, init_tracing2, ViewBaseConfig2, init_view_common3, Schema2, Columns2, ExtraConfigColumns2, OriginalName2, BaseName2, IsAlias2, ExtraConfigBuilder2, IsDrizzleTable2, _a20, _b11, _c, _d, _e3, _f, _g, _h, _i, _j, Table2, init_table8, _a21, FakePrimitiveParam, _a222, StringChunk2, _a23, _SQL, SQL2, _a24, Name2, noopDecoder2, noopEncoder2, noopMapper2, _a25, Param2, _a26, Placeholder2, IsDrizzleView2, _a27, _b12, _c2, View3, init_sql3, _a28, ColumnAliasProxyHandler2, _a29, TableAliasProxyHandler2, _a30, RelationTableAliasProxyHandler, init_alias3, _a31, _b13, DrizzleError2, DrizzleQueryError, _a322, _b14, TransactionRollbackError2, init_errors22, _a33, ConsoleLogWriter2, _a34, DefaultLogger2, _a35, NoopLogger2, init_logger3, init_operations, _a36, _b15, QueryPromise2, init_query_promise2, textDecoder, init_utils22, _a37, _b16, PgIntColumnBaseBuilder2, init_int_common2, _a38, _b17, PgBigInt53Builder2, _a39, _b18, PgBigInt532, _a40, _b19, PgBigInt64Builder2, _a41, _b20, PgBigInt642, init_bigint2, _a42, _b21, PgBigSerial53Builder2, _a43, _b22, PgBigSerial532, _a44, _b23, PgBigSerial64Builder2, _a45, _b24, PgBigSerial642, init_bigserial2, _a46, _b25, PgBooleanBuilder2, _a47, _b26, PgBoolean2, init_boolean2, _a48, _b27, PgCharBuilder2, _a49, _b28, PgChar2, init_char2, _a50, _b29, PgCidrBuilder2, _a51, _b30, PgCidr2, init_cidr2, _a52, _b31, PgCustomColumnBuilder2, _a53, _b32, PgCustomColumn2, init_custom2, _a54, _b33, PgDateColumnBaseBuilder2, init_date_common2, _a55, _b34, PgDateBuilder2, _a56, _b35, PgDate2, _a57, _b36, PgDateStringBuilder2, _a58, _b37, PgDateString2, init_date2, _a59, _b38, PgDoublePrecisionBuilder2, _a60, _b39, PgDoublePrecision2, init_double_precision2, _a61, _b40, PgInetBuilder2, _a62, _b41, PgInet2, init_inet2, _a63, _b42, PgIntegerBuilder2, _a64, _b43, PgInteger2, init_integer2, _a65, _b44, PgIntervalBuilder2, _a66, _b45, PgInterval2, init_interval2, _a67, _b46, PgJsonBuilder2, _a68, _b47, PgJson2, init_json2, _a69, _b48, PgJsonbBuilder2, _a70, _b49, PgJsonb2, init_jsonb2, _a71, _b50, PgLineBuilder2, _a72, _b51, PgLineTuple2, _a73, _b52, PgLineABCBuilder2, _a74, _b53, PgLineABC2, init_line2, _a75, _b54, PgMacaddrBuilder2, _a76, _b55, PgMacaddr2, init_macaddr2, _a77, _b56, PgMacaddr8Builder2, _a78, _b57, PgMacaddr82, init_macaddr82, _a79, _b58, PgNumericBuilder2, _a80, _b59, PgNumeric2, _a81, _b60, PgNumericNumberBuilder2, _a82, _b61, PgNumericNumber2, _a83, _b62, PgNumericBigIntBuilder2, _a84, _b63, PgNumericBigInt2, init_numeric2, _a85, _b64, PgPointTupleBuilder2, _a86, _b65, PgPointTuple2, _a87, _b66, PgPointObjectBuilder2, _a88, _b67, PgPointObject2, init_point2, init_utils32, _a89, _b68, PgGeometryBuilder2, _a90, _b69, PgGeometry2, _a91, _b70, PgGeometryObjectBuilder2, _a92, _b71, PgGeometryObject2, init_geometry2, _a93, _b72, PgRealBuilder2, _a94, _b73, PgReal2, init_real2, _a95, _b74, PgSerialBuilder2, _a96, _b75, PgSerial2, init_serial2, _a97, _b76, PgSmallIntBuilder2, _a98, _b77, PgSmallInt2, init_smallint2, _a99, _b78, PgSmallSerialBuilder2, _a100, _b79, PgSmallSerial2, init_smallserial2, _a101, _b80, PgTextBuilder2, _a102, _b81, PgText2, init_text2, _a103, _b82, PgTimeBuilder2, _a104, _b83, PgTime2, init_time2, _a105, _b84, PgTimestampBuilder2, _a106, _b85, PgTimestamp2, _a107, _b86, PgTimestampStringBuilder2, _a108, _b87, PgTimestampString2, init_timestamp2, _a109, _b88, PgUUIDBuilder2, _a110, _b89, PgUUID2, init_uuid3, _a111, _b90, PgVarcharBuilder2, _a112, _b91, PgVarchar2, init_varchar2, _a113, _b92, PgBinaryVectorBuilder2, _a114, _b93, PgBinaryVector2, init_bit2, _a115, _b94, PgHalfVectorBuilder2, _a116, _b95, PgHalfVector2, init_halfvec2, _a117, _b96, PgSparseVectorBuilder2, _a118, _b97, PgSparseVector2, init_sparsevec2, _a119, _b98, PgVectorBuilder2, _a120, _b99, PgVector2, init_vector3, init_all2, InlineForeignKeys2, EnableRLS2, _a121, _b100, _c3, _d2, _e22, _f2, PgTable2, pgTable2, init_table22, _a122, PrimaryKeyBuilder2, _a123, PrimaryKey2, init_primary_keys2, eq2, ne4, gt3, gte2, lt4, lte2, init_conditions2, init_select3, init_expressions2, _a124, Relation2, _a125, Relations2, _a126, _b101, _One, One2, _a127, _b102, _Many, Many2, init_relations2, init_aggregate2, init_vector22, init_functions2, init_sql22, dist_exports, init_dist9, init_alias22, _a128, CheckBuilder, _a129, Check, init_checks6, init_columns2, _a130, _SelectionProxyHandler, SelectionProxyHandler2, init_selection_proxy2, _a131, IndexBuilderOn2, _a132, IndexBuilder2, _a133, Index2, init_indexes2, _a134, PgPolicy, init_policies2, PgViewConfig2, init_view_common22, _a135, CasingCache2, init_casing2, _a136, _b103, PgViewBase2, init_view_base2, _a137, PgDialect2, init_dialect2, _a138, TypedQueryBuilder2, init_query_builder3, _a139, PgSelectBuilder2, _a140, _b104, PgSelectQueryBuilderBase2, _a141, _b105, PgSelectBase2, getPgSetOperators2, union22, unionAll2, intersect2, intersectAll2, except2, exceptAll2, init_select22, _a142, QueryBuilder2, init_query_builder22, _a143, DefaultViewBuilderCore, _a144, _b106, ViewBuilder, _a145, _b107, ManualViewBuilder, _a146, MaterializedViewBuilderCore, _a147, _b108, MaterializedViewBuilder, _a148, _b109, ManualMaterializedViewBuilder, _a149, _b110, _c4, PgView2, PgMaterializedViewConfig2, _a150, _b111, _c5, PgMaterializedView, init_view2, init_utils42, _a151, _b112, PgDeleteBase2, init_delete2, _a152, PgInsertBuilder2, _a153, _b113, PgInsertBase2, init_insert2, _a154, _b114, PgRefreshMaterializedView2, init_refresh_materialized_view2, init_select_types, _a155, PgUpdateBuilder2, _a156, _b115, PgUpdateBase2, init_update2, init_query_builders2, _a157, _b116, _c6, _PgCountBuilder, PgCountBuilder2, init_count2, _a158, RelationalQueryBuilder2, _a159, _b117, PgRelationalQuery2, init_query2, _a160, _b118, PgRaw2, init_raw2, _a161, PgDatabase2, init_db2, _a162, PgRole, init_roles2, _a163, PgSequence, init_sequence2, _a164, PgSchema5, init_schema3, _a165, Cache, _a166, _b119, NoopCache, init_cache, _a167, PgPreparedQuery2, _a168, PgSession2, _a169, _b120, PgTransaction2, init_session3, init_subquery22, init_utils52, init_pg_core2, vectorOps, init_vector32, sqlToStr, init_utils62, indexName, generatePgSnapshot, trimChar, fromDatabase, defaultForColumn, getColumnsInfoQuery, init_pgSerializer, import_hanji4, Select, init_selector_ui, init_alias32, _a170, CheckBuilder2, _a171, Check2, init_checks22, _a172, ForeignKeyBuilder22, _a173, ForeignKey22, init_foreign_keys22, _a174, UniqueConstraintBuilder2, _a175, UniqueOnConstraintBuilder2, _a176, UniqueConstraint2, init_unique_constraint22, _a177, _b121, SQLiteColumnBuilder, _a178, _b122, SQLiteColumn, init_common3, _a179, _b123, SQLiteBigIntBuilder, _a180, _b124, SQLiteBigInt, _a181, _b125, SQLiteBlobJsonBuilder, _a182, _b126, SQLiteBlobJson, _a183, _b127, SQLiteBlobBufferBuilder, _a184, _b128, SQLiteBlobBuffer, init_blob, _a185, _b129, SQLiteCustomColumnBuilder, _a186, _b130, SQLiteCustomColumn, init_custom22, _a187, _b131, SQLiteBaseIntegerBuilder, _a188, _b132, SQLiteBaseInteger, _a189, _b133, SQLiteIntegerBuilder, _a190, _b134, SQLiteInteger, _a191, _b135, SQLiteTimestampBuilder, _a192, _b136, SQLiteTimestamp, _a193, _b137, SQLiteBooleanBuilder, _a194, _b138, SQLiteBoolean, init_integer22, _a195, _b139, SQLiteNumericBuilder, _a196, _b140, SQLiteNumeric, _a197, _b141, SQLiteNumericNumberBuilder, _a198, _b142, SQLiteNumericNumber, _a199, _b143, SQLiteNumericBigIntBuilder, _a200, _b144, SQLiteNumericBigInt, init_numeric22, _a201, _b145, SQLiteRealBuilder, _a202, _b146, SQLiteReal, init_real22, _a203, _b147, SQLiteTextBuilder, _a204, _b148, SQLiteText, _a205, _b149, SQLiteTextJsonBuilder, _a206, _b150, SQLiteTextJson, init_text22, init_columns22, init_all22, InlineForeignKeys22, _a207, _b151, _c7, _d3, _e32, SQLiteTable, sqliteTable, init_table32, _a208, IndexBuilderOn22, _a209, IndexBuilder22, _a210, Index4, init_indexes22, _a211, PrimaryKeyBuilder22, _a212, PrimaryKey22, init_primary_keys22, init_utils72, _a213, _b152, SQLiteDeleteBase, init_delete22, _a214, _b153, SQLiteViewBase, init_view_base22, _a215, SQLiteDialect, _a216, _b154, SQLiteSyncDialect, _a217, _b155, SQLiteAsyncDialect, init_dialect22, _a218, SQLiteSelectBuilder, _a219, _b156, SQLiteSelectQueryBuilderBase, _a220, _b157, SQLiteSelectBase, getSQLiteSetOperators, union32, unionAll22, intersect22, except22, init_select32, _a221, QueryBuilder22, init_query_builder32, _a2222, SQLiteInsertBuilder, _a223, _b158, SQLiteInsertBase, init_insert22, init_select_types2, _a224, SQLiteUpdateBuilder, _a225, _b159, SQLiteUpdateBase, init_update22, init_query_builders22, _a226, _b160, _c8, _SQLiteCountBuilder, SQLiteCountBuilder, init_count22, _a227, RelationalQueryBuilder22, _a228, _b161, SQLiteRelationalQuery, _a229, _b162, SQLiteSyncRelationalQuery, init_query22, _a230, _b163, SQLiteRaw, init_raw22, _a231, BaseSQLiteDatabase, init_db22, _a232, _b164, ExecuteResultSync, _a233, SQLitePreparedQuery, _a234, SQLiteSession, _a235, _b165, SQLiteTransaction, init_session22, init_subquery3, _a236, ViewBuilderCore, _a237, _b166, ViewBuilder2, _a238, _b167, ManualViewBuilder2, _a239, _b168, SQLiteView2, init_view22, init_sqlite_core, generateSqliteSnapshot, fromDatabase2, init_sqliteSerializer, getTablesFilterByExtensions, init_getTablesFilterByExtensions, init_alias4, _a240, CheckBuilder3, _a241, Check3, init_checks32, _a242, ForeignKeyBuilder3, _a243, ForeignKey3, init_foreign_keys3, _a244, UniqueConstraintBuilder3, _a245, UniqueOnConstraintBuilder3, _a246, UniqueConstraint3, init_unique_constraint3, _a247, _b169, MySqlColumnBuilder, _a248, _b170, MySqlColumn, _a249, _b171, MySqlColumnBuilderWithAutoIncrement, _a250, _b172, MySqlColumnWithAutoIncrement, init_common4, _a251, _b173, MySqlBigInt53Builder, _a252, _b174, MySqlBigInt53, _a253, _b175, MySqlBigInt64Builder, _a254, _b176, MySqlBigInt64, init_bigint22, _a255, _b177, MySqlBinaryBuilder, _a256, _b178, MySqlBinary, init_binary, _a257, _b179, MySqlBooleanBuilder, _a258, _b180, MySqlBoolean, init_boolean22, _a259, _b181, MySqlCharBuilder, _a260, _b182, MySqlChar, init_char22, _a261, _b183, MySqlCustomColumnBuilder, _a262, _b184, MySqlCustomColumn, init_custom3, _a263, _b185, MySqlDateBuilder, _a264, _b186, MySqlDate, _a265, _b187, MySqlDateStringBuilder, _a266, _b188, MySqlDateString, init_date22, _a267, _b189, MySqlDateTimeBuilder, _a268, _b190, MySqlDateTime, _a269, _b191, MySqlDateTimeStringBuilder, _a270, _b192, MySqlDateTimeString, init_datetime, _a271, _b193, MySqlDecimalBuilder, _a272, _b194, MySqlDecimal, _a273, _b195, MySqlDecimalNumberBuilder, _a274, _b196, MySqlDecimalNumber, _a275, _b197, MySqlDecimalBigIntBuilder, _a276, _b198, MySqlDecimalBigInt, init_decimal, _a277, _b199, MySqlDoubleBuilder, _a278, _b200, MySqlDouble, init_double, _a279, _b201, MySqlEnumColumnBuilder, _a280, _b202, MySqlEnumColumn, _a281, _b203, MySqlEnumObjectColumnBuilder, _a282, _b204, MySqlEnumObjectColumn, init_enum22, _a283, _b205, MySqlFloatBuilder, _a284, _b206, MySqlFloat, init_float, _a285, _b207, MySqlIntBuilder, _a286, _b208, MySqlInt, init_int, _a287, _b209, MySqlJsonBuilder, _a288, _b210, MySqlJson, init_json22, _a289, _b211, MySqlMediumIntBuilder, _a290, _b212, MySqlMediumInt, init_mediumint, _a291, _b213, MySqlRealBuilder, _a292, _b214, MySqlReal, init_real3, _a293, _b215, MySqlSerialBuilder, _a294, _b216, MySqlSerial, init_serial22, _a295, _b217, MySqlSmallIntBuilder, _a296, _b218, MySqlSmallInt, init_smallint22, _a297, _b219, MySqlTextBuilder, _a298, _b220, MySqlText, init_text3, _a299, _b221, MySqlTimeBuilder, _a300, _b222, MySqlTime, init_time22, _a301, _b223, MySqlDateColumnBaseBuilder, _a302, _b224, MySqlDateBaseColumn, init_date_common22, _a303, _b225, MySqlTimestampBuilder, _a304, _b226, MySqlTimestamp, _a305, _b227, MySqlTimestampStringBuilder, _a306, _b228, MySqlTimestampString, init_timestamp22, _a307, _b229, MySqlTinyIntBuilder, _a308, _b230, MySqlTinyInt, init_tinyint, _a309, _b231, MySqlVarBinaryBuilder, _a310, _b232, MySqlVarBinary, init_varbinary, _a311, _b233, MySqlVarCharBuilder, _a312, _b234, MySqlVarChar, init_varchar22, _a313, _b235, MySqlYearBuilder, _a314, _b236, MySqlYear, init_year, init_columns3, _a315, _b237, _c9, _MySqlCountBuilder, MySqlCountBuilder, init_count3, _a316, IndexBuilderOn3, _a317, IndexBuilder3, _a318, Index5, init_indexes3, init_all3, InlineForeignKeys3, _a319, _b238, _c10, _d4, _e4, MySqlTable, mysqlTable, init_table42, _a320, PrimaryKeyBuilder3, _a321, PrimaryKey3, init_primary_keys3, MySqlViewConfig, init_view_common32, init_utils8, _a3222, _b239, MySqlDeleteBase, init_delete3, _a323, _b240, MySqlViewBase, init_view_base3, _a324, MySqlDialect, init_dialect3, _a325, MySqlSelectBuilder, _a326, _b241, MySqlSelectQueryBuilderBase, _a327, _b242, MySqlSelectBase, getMySqlSetOperators, union4, unionAll3, intersect3, intersectAll22, except3, exceptAll22, init_select4, _a328, QueryBuilder3, init_query_builder4, _a329, MySqlInsertBuilder, _a330, _b243, MySqlInsertBase, init_insert3, init_select_types3, _a331, MySqlUpdateBuilder, _a332, _b244, MySqlUpdateBase, init_update3, init_query_builders3, _a333, RelationalQueryBuilder3, _a334, _b245, MySqlRelationalQuery, init_query3, _a335, MySqlDatabase, init_db3, _a336, ViewBuilderCore2, _a337, _b246, ViewBuilder3, _a338, _b247, ManualViewBuilder3, _a339, _b248, _c11, MySqlView2, init_view3, _a340, MySqlSchema5, init_schema22, _a341, MySqlPreparedQuery, _a342, MySqlSession, _a343, _b249, MySqlTransaction, init_session32, init_subquery4, init_mysql_core, handleEnumType, generateMySqlSnapshot, fromDatabase3, init_mysqlSerializer, cliConfigGenerate, pushParams, pullParams, configCheck, cliConfigCheck, init_cli, gelCredentials, init_gel, libSQLCredentials, init_libsql, mysqlCredentials, init_mysql, postgresCredentials, init_postgres, singlestoreCredentials, init_singlestore, sqliteCredentials, init_sqlite, credentials, studioCliParams, studioConfig, init_studio, es5_exports, _3, es5_default, init_es5, import_hanji7, assertES5, safeRegister, migrateConfig, init_utils9, prepareFromExports, init_pgImports, init_alias5, _a344, UniqueConstraintBuilder4, _a345, UniqueOnConstraintBuilder4, _a346, UniqueConstraint4, init_unique_constraint4, _a347, _b250, SingleStoreColumnBuilder, _a348, _b251, SingleStoreColumn, _a349, _b252, SingleStoreColumnBuilderWithAutoIncrement, _a350, _b253, SingleStoreColumnWithAutoIncrement, init_common5, _a351, _b254, SingleStoreBigInt53Builder, _a352, _b255, SingleStoreBigInt53, _a353, _b256, SingleStoreBigInt64Builder, _a354, _b257, SingleStoreBigInt64, init_bigint3, _a355, _b258, SingleStoreBinaryBuilder, _a356, _b259, SingleStoreBinary, init_binary2, _a357, _b260, SingleStoreBooleanBuilder, _a358, _b261, SingleStoreBoolean, init_boolean3, _a359, _b262, SingleStoreCharBuilder, _a360, _b263, SingleStoreChar, init_char3, _a361, _b264, SingleStoreCustomColumnBuilder, _a362, _b265, SingleStoreCustomColumn, init_custom4, _a363, _b266, SingleStoreDateBuilder, _a364, _b267, SingleStoreDate, _a365, _b268, SingleStoreDateStringBuilder, _a366, _b269, SingleStoreDateString, init_date3, _a367, _b270, SingleStoreDateTimeBuilder, _a368, _b271, SingleStoreDateTime, _a369, _b272, SingleStoreDateTimeStringBuilder, _a370, _b273, SingleStoreDateTimeString, init_datetime2, _a371, _b274, SingleStoreDecimalBuilder, _a372, _b275, SingleStoreDecimal, _a373, _b276, SingleStoreDecimalNumberBuilder, _a374, _b277, SingleStoreDecimalNumber, _a375, _b278, SingleStoreDecimalBigIntBuilder, _a376, _b279, SingleStoreDecimalBigInt, init_decimal2, _a377, _b280, SingleStoreDoubleBuilder, _a378, _b281, SingleStoreDouble, init_double2, _a379, _b282, SingleStoreEnumColumnBuilder, _a380, _b283, SingleStoreEnumColumn, init_enum3, _a381, _b284, SingleStoreFloatBuilder, _a382, _b285, SingleStoreFloat, init_float2, _a383, _b286, SingleStoreIntBuilder, _a384, _b287, SingleStoreInt, init_int2, _a385, _b288, SingleStoreJsonBuilder, _a386, _b289, SingleStoreJson, init_json3, _a387, _b290, SingleStoreMediumIntBuilder, _a388, _b291, SingleStoreMediumInt, init_mediumint2, _a389, _b292, SingleStoreRealBuilder, _a390, _b293, SingleStoreReal, init_real4, _a391, _b294, SingleStoreSerialBuilder, _a392, _b295, SingleStoreSerial, init_serial3, _a393, _b296, SingleStoreSmallIntBuilder, _a394, _b297, SingleStoreSmallInt, init_smallint3, _a395, _b298, SingleStoreTextBuilder, _a396, _b299, SingleStoreText, init_text4, _a397, _b300, SingleStoreTimeBuilder, _a398, _b301, SingleStoreTime, init_time3, _a399, _b302, SingleStoreDateColumnBaseBuilder, _a400, _b303, SingleStoreDateBaseColumn, init_date_common3, _a401, _b304, SingleStoreTimestampBuilder, _a402, _b305, SingleStoreTimestamp, _a403, _b306, SingleStoreTimestampStringBuilder, _a404, _b307, SingleStoreTimestampString, init_timestamp3, _a405, _b308, SingleStoreTinyIntBuilder, _a406, _b309, SingleStoreTinyInt, init_tinyint2, _a407, _b310, SingleStoreVarBinaryBuilder, _a408, _b311, SingleStoreVarBinary, init_varbinary2, _a409, _b312, SingleStoreVarCharBuilder, _a410, _b313, SingleStoreVarChar, init_varchar3, _a411, _b314, SingleStoreVectorBuilder, _a412, _b315, SingleStoreVector, init_vector4, _a413, _b316, SingleStoreYearBuilder, _a414, _b317, SingleStoreYear, init_year2, init_columns4, _a415, _b318, _c12, _SingleStoreCountBuilder, SingleStoreCountBuilder, init_count4, _a416, IndexBuilderOn4, _a417, IndexBuilder4, _a418, Index6, init_indexes4, init_all4, _a419, _b319, _c13, _d5, SingleStoreTable, init_table52, _a420, PrimaryKeyBuilder4, _a421, PrimaryKey4, init_primary_keys4, init_utils10, _a422, _b320, SingleStoreDeleteBase, init_delete4, _a423, SingleStoreInsertBuilder, _a424, _b321, SingleStoreInsertBase, init_insert4, _a425, SingleStoreDialect, init_dialect4, _a426, SingleStoreSelectBuilder, _a427, _b322, SingleStoreSelectQueryBuilderBase, _a428, _b323, SingleStoreSelectBase, getSingleStoreSetOperators, union5, unionAll4, intersect4, except4, minus, init_select5, _a429, QueryBuilder4, init_query_builder5, init_select_types4, _a430, SingleStoreUpdateBuilder, _a431, _b324, SingleStoreUpdateBase, init_update4, init_query_builders4, _a432, SingleStoreDatabase, init_db4, _a433, SingleStoreSchema5, init_schema32, _a434, SingleStorePreparedQuery, _a435, SingleStoreSession, _a436, _b325, SingleStoreTransaction, init_session4, init_subquery5, init_singlestore_core, dialect5, generateSingleStoreSnapshot, fromDatabase4, init_singlestoreSerializer, sqliteImports_exports, prepareFromExports2, prepareFromSqliteImports, init_sqliteImports, mysqlImports_exports, prepareFromExports3, prepareFromMySqlImports, init_mysqlImports, mysqlPushUtils_exports, import_hanji8, filterStatements, logSuggestionsAndReturn2, init_mysqlPushUtils, mysqlIntrospect_exports, import_hanji9, mysqlPushIntrospect, init_mysqlIntrospect, singlestoreImports_exports, prepareFromExports4, prepareFromSingleStoreImports, init_singlestoreImports, singlestorePushUtils_exports, import_hanji10, filterStatements2, logSuggestionsAndReturn3, init_singlestorePushUtils, singlestoreIntrospect_exports, import_hanji11, singlestorePushIntrospect, init_singlestoreIntrospect, import_hanji3, pgPushIntrospect = async (db2, filters, schemaFilters, entities, tsSchema) => {
   const matchers = filters.map((it3) => {
     return new Minimatch(it3);
   });
@@ -119281,8 +120094,8 @@ ${BREAKPOINT}ALTER TABLE ${tableNameWithSchema} ADD CONSTRAINT "${statement.newC
         win32: { sep: "\\" },
         posix: { sep: "/" }
       };
-      sep = defaultPlatform === "win32" ? path.win32.sep : path.posix.sep;
-      minimatch.sep = sep;
+      sep2 = defaultPlatform === "win32" ? path.win32.sep : path.posix.sep;
+      minimatch.sep = sep2;
       GLOBSTAR = Symbol("globstar **");
       minimatch.GLOBSTAR = GLOBSTAR;
       plTypes = {
@@ -138184,7 +138997,7 @@ async function seedCoreGames(db2) {
 }
 async function seedCurrentProjectGame(db2, project) {
   const now2 = new Date;
-  const desiredGameId = project.gameId?.trim() || undefined;
+  const desiredGameId = project.gameId?.trim() || await localGameId(project.slug);
   try {
     const existingGame = await db2.query.games.findFirst({
       where: (row, operators) => operators.eq(row.slug, project.slug)
@@ -138200,7 +139013,7 @@ async function seedCurrentProjectGame(db2, project) {
       }
     }
     const gameRecord = {
-      id: desiredGameId ?? crypto.randomUUID(),
+      id: desiredGameId,
       slug: project.slug,
       displayName: project.displayName,
       version: project.version,
@@ -138235,6 +139048,7 @@ var init_games = __esm(() => {
   init_drizzle_orm();
   init_src();
   init_tables_index();
+  init_uuid2();
   init_constants();
   init_logging();
   init_timeback5();
@@ -138820,19 +139634,50 @@ var init_types6 = () => {};
 function hasGameManagementAccess(user) {
   return user.role === "admin" || user.role === "teacher" || user.role === "developer" && user.developerStatus === "approved";
 }
+function isDashboardWorkerKey(key) {
+  return Boolean(key?.permissions?.[DASHBOARD_PERMISSION_NAMESPACE]);
+}
+function workerKeyGrantsGameRead(key, slug2) {
+  if (!isDashboardWorkerKey(key) && !isGameWorkerKey(key)) {
+    return false;
+  }
+  const games2 = key?.permissions?.games;
+  return Boolean(games2?.includes(`read:${slug2}`) || games2?.includes(`write:${slug2}`));
+}
+function isGameWorkerKey(key) {
+  return Boolean(key?.name?.startsWith(GAME_WORKER_KEY_PREFIX));
+}
+function deniedWorkerKeyRequest(key, method, pathname) {
+  if (isDashboardWorkerKey(key) && !isAllowedDashboardWorkerRequest(method, pathname, key.permissions)) {
+    return DASHBOARD_WORKER_KEY_RESTRICTED;
+  }
+  return null;
+}
+function rejectDashboardWorkerKey(ctx) {
+  if (isDashboardWorkerKey(ctx.apiKey)) {
+    throw ApiError.forbidden(DASHBOARD_WORKER_KEY_RESTRICTED);
+  }
+}
+function assertAuthenticatedRequest(ctx) {
+  if (!isAuthenticated(ctx)) {
+    throw ApiError.unauthorized("Valid session or bearer token required");
+  }
+  if (ctx.apiKey) {
+    const denied = deniedWorkerKeyRequest(ctx.apiKey, ctx.request.method, ctx.url.pathname);
+    if (denied) {
+      throw ApiError.forbidden(denied);
+    }
+  }
+}
 function requireAuth(handler) {
   return async (ctx) => {
-    if (!isAuthenticated(ctx)) {
-      throw ApiError.unauthorized("Valid session or bearer token required");
-    }
+    assertAuthenticatedRequest(ctx);
     return handler(ctx);
   };
 }
 function requireNonAnonymous(handler) {
   return async (ctx) => {
-    if (!isAuthenticated(ctx)) {
-      throw ApiError.unauthorized("Valid session or bearer token required");
-    }
+    assertAuthenticatedRequest(ctx);
     if (ctx.user.isAnonymous) {
       throw ApiError.forbidden("This operation is not available for demo/anonymous users");
     }
@@ -138841,9 +139686,7 @@ function requireNonAnonymous(handler) {
 }
 function requireAnonymous(handler) {
   return async (ctx) => {
-    if (!isAuthenticated(ctx)) {
-      throw ApiError.unauthorized("Valid session or bearer token required");
-    }
+    assertAuthenticatedRequest(ctx);
     if (!ctx.user.isAnonymous) {
       throw ApiError.forbidden("This operation is only available for demo/anonymous users");
     }
@@ -138852,9 +139695,8 @@ function requireAnonymous(handler) {
 }
 function requireAdmin(handler) {
   return async (ctx) => {
-    if (!isAuthenticated(ctx)) {
-      throw ApiError.unauthorized("Valid session or bearer token required");
-    }
+    assertAuthenticatedRequest(ctx);
+    rejectDashboardWorkerKey(ctx);
     if (ctx.user.role !== "admin") {
       throw ApiError.forbidden("Admin access required");
     }
@@ -138863,9 +139705,8 @@ function requireAdmin(handler) {
 }
 function requireDeveloper(handler) {
   return async (ctx) => {
-    if (!isAuthenticated(ctx)) {
-      throw ApiError.unauthorized("Valid session or bearer token required");
-    }
+    assertAuthenticatedRequest(ctx);
+    rejectDashboardWorkerKey(ctx);
     const isAdmin = ctx.user.role === "admin";
     const isApprovedDev = ctx.user.role === "developer" && ctx.user.developerStatus === "approved";
     if (!isAdmin && !isApprovedDev) {
@@ -138874,20 +139715,30 @@ function requireDeveloper(handler) {
     return handler(ctx);
   };
 }
+function requireHumanDeveloper(handler) {
+  return requireDeveloper(async (ctx) => {
+    if (isDashboardWorkerKey(ctx.apiKey) || isGameWorkerKey(ctx.apiKey)) {
+      throw ApiError.forbidden(WORKER_KEY_HUMAN_ONLY);
+    }
+    return handler(ctx);
+  });
+}
 function requireGameManagementAccess(handler) {
   return async (ctx) => {
-    if (!isAuthenticated(ctx)) {
-      throw ApiError.unauthorized("Valid session or bearer token required");
-    }
+    assertAuthenticatedRequest(ctx);
+    rejectDashboardWorkerKey(ctx);
     if (!hasGameManagementAccess(ctx.user)) {
       throw ApiError.forbidden("Game management access required");
     }
     return handler(ctx);
   };
 }
+var WORKER_KEY_HUMAN_ONLY = "This operation requires your own credential — platform worker keys are refused";
 var init_auth_util = __esm(() => {
   init_errors();
   init_types6();
+  init_dashboard_util();
+  init_deployment_util();
 });
 
 // ../api-core/src/utils/controller.util.ts
@@ -139031,6 +139882,21 @@ function requireGameId(gameId) {
   }
   return gameId;
 }
+function requireSlug(slug2) {
+  if (!slug2) {
+    throw ApiError.badRequest("Missing game slug");
+  }
+  return slug2;
+}
+function requireUserId(userId) {
+  if (!userId) {
+    throw ApiError.badRequest("Missing user ID");
+  }
+  if (!isValidUUID(userId)) {
+    throw ApiError.unprocessableEntity("userId must be a valid UUID format");
+  }
+  return userId;
+}
 var init_params_util = __esm(() => {
   init_src4();
   init_errors();
@@ -139079,6 +139945,7 @@ var init_validation_util = __esm(() => {
 // ../api-core/src/utils/index.ts
 var init_utils11 = __esm(() => {
   init_auth_util();
+  init_dashboard_util();
   init_deployment_util();
   init_leaderboard_util();
   init_lti_util();
@@ -139171,6 +140038,83 @@ var init_bucket_controller = __esm(() => {
   });
 });
 
+// ../api-core/src/controllers/dashboard.controller.ts
+function requireDashboardWorkerKey(ctx, slug2) {
+  const scopes = ctx.apiKey?.permissions?.[DASHBOARD_PERMISSION_NAMESPACE];
+  if (!scopes?.includes(dashboardCredentialScope(slug2))) {
+    throw ApiError.forbidden("This endpoint requires the dashboard worker key for this game");
+  }
+}
+var listUsers, addUser, issueRecoveryLink, removeUser, remove, verifyLogin, acceptInvite, revokeSessions, acceptReset, dashboard2;
+var init_dashboard_controller = __esm(() => {
+  init_schemas_index();
+  init_errors();
+  init_utils11();
+  listUsers = requireHumanDeveloper(async (ctx) => {
+    const slug2 = requireSlug(ctx.params.slug);
+    const users2 = await ctx.services.dashboard.listUsers(slug2, ctx.user);
+    return { users: users2 };
+  });
+  addUser = requireHumanDeveloper(async (ctx) => {
+    const slug2 = requireSlug(ctx.params.slug);
+    const body2 = await parseRequestBody(ctx.request, AddGameDashboardUserSchema);
+    return ctx.services.dashboard.addUser(slug2, ctx.user, body2);
+  });
+  issueRecoveryLink = requireHumanDeveloper(async (ctx) => {
+    const slug2 = requireSlug(ctx.params.slug);
+    const userId = requireUserId(ctx.params.userId);
+    return ctx.services.dashboard.issueRecoveryLink(slug2, ctx.user, userId);
+  });
+  removeUser = requireHumanDeveloper(async (ctx) => {
+    const slug2 = requireSlug(ctx.params.slug);
+    const userId = requireUserId(ctx.params.userId);
+    await ctx.services.dashboard.removeUser(slug2, ctx.user, userId);
+    return { success: true };
+  });
+  remove = requireHumanDeveloper(async (ctx) => {
+    const slug2 = requireSlug(ctx.params.slug);
+    await ctx.services.deploy.removeDashboard(slug2, ctx.user);
+    return { success: true };
+  });
+  verifyLogin = requireAuth(async (ctx) => {
+    const slug2 = requireSlug(ctx.params.slug);
+    requireDashboardWorkerKey(ctx, slug2);
+    const body2 = await parseRequestBody(ctx.request, VerifyGameDashboardLoginSchema);
+    const user = await ctx.services.dashboard.verifyLogin(slug2, body2);
+    return { user };
+  });
+  acceptInvite = requireAuth(async (ctx) => {
+    const slug2 = requireSlug(ctx.params.slug);
+    requireDashboardWorkerKey(ctx, slug2);
+    const body2 = await parseRequestBody(ctx.request, AcceptGameDashboardInviteSchema);
+    const user = await ctx.services.dashboard.acceptInvite(slug2, body2);
+    return { user };
+  });
+  revokeSessions = requireHumanDeveloper(async (ctx) => {
+    const slug2 = requireSlug(ctx.params.slug);
+    await ctx.services.deploy.rotateDashboardSessionSecret(slug2, ctx.user);
+    return { success: true };
+  });
+  acceptReset = requireAuth(async (ctx) => {
+    const slug2 = requireSlug(ctx.params.slug);
+    requireDashboardWorkerKey(ctx, slug2);
+    const body2 = await parseRequestBody(ctx.request, AcceptGameDashboardResetSchema);
+    const user = await ctx.services.dashboard.acceptReset(slug2, body2);
+    return { user };
+  });
+  dashboard2 = defineControllerNames("dashboard", {
+    listUsers,
+    addUser,
+    removeUser,
+    remove,
+    issueRecoveryLink,
+    revokeSessions,
+    verifyLogin,
+    acceptInvite,
+    acceptReset
+  });
+});
+
 // ../api-core/src/controllers/database.controller.ts
 var reset, database;
 var init_database_controller = __esm(() => {
@@ -139265,7 +140209,7 @@ var init_developer_controller = __esm(() => {
 });
 
 // ../api-core/src/controllers/domain.controller.ts
-var add, list, getStatus2, remove, domains2;
+var add, list, getStatus2, remove2, domains2;
 var init_domain_controller = __esm(() => {
   init_esm();
   init_schemas_index();
@@ -139314,7 +140258,7 @@ var init_domain_controller = __esm(() => {
     const environment = getPlatformEnvironment(ctx.config);
     return ctx.services.domain.getStatus(slug2, hostname4, environment, ctx.user, refresh);
   });
-  remove = requireDeveloper(async (ctx) => {
+  remove2 = requireDeveloper(async (ctx) => {
     const slug2 = ctx.params.slug;
     const hostname4 = ctx.params.hostname;
     if (!slug2) {
@@ -139330,12 +140274,12 @@ var init_domain_controller = __esm(() => {
     add,
     list,
     getStatus: getStatus2,
-    remove
+    remove: remove2
   });
 });
 
 // ../api-core/src/controllers/game-member.controller.ts
-function requireUserId(userId) {
+function requireUserId2(userId) {
   if (!userId) {
     throw ApiError.badRequest("Missing user ID");
   }
@@ -139357,13 +140301,13 @@ var init_game_member_controller = __esm(() => {
   });
   updateMemberRole = requireNonAnonymous(async (ctx) => {
     const gameId = requireGameId(ctx.params.gameId);
-    const userId = requireUserId(ctx.params.userId);
+    const userId = requireUserId2(ctx.params.userId);
     const body2 = await parseRequestBody(ctx.request, UpdateGameMemberRoleSchema);
     return ctx.services.gameMember.updateRole(gameId, userId, ctx.user, body2);
   });
   removeMember = requireNonAnonymous(async (ctx) => {
     const gameId = requireGameId(ctx.params.gameId);
-    const userId = requireUserId(ctx.params.userId);
+    const userId = requireUserId2(ctx.params.userId);
     await ctx.services.gameMember.remove(gameId, userId, ctx.user);
   });
   searchUsersForMember = requireNonAnonymous(async (ctx) => {
@@ -139381,12 +140325,13 @@ var init_game_member_controller = __esm(() => {
 });
 
 // ../api-core/src/controllers/game.controller.ts
-var list2, listAccessible, getSubjects, getTimebackSummaries, getById, getBySlug, getManifest, upsertBySlug, patchGameMetadata, remove2, games2;
+var list2, listAccessible, getSubjects, getTimebackSummaries, getById, getBySlug, getManifest, upsertBySlug, patchGameMetadata, remove3, games2;
 var init_game_controller = __esm(() => {
   init_esm();
   init_schemas_index();
   init_errors();
   init_utils11();
+  init_auth_util();
   list2 = requireNonAnonymous(async (ctx) => ctx.services.game.list(ctx.user));
   listAccessible = requireNonAnonymous(async (ctx) => ctx.services.game.listAccessible(ctx.user));
   getSubjects = requireNonAnonymous(async (ctx) => ctx.services.game.getSubjects());
@@ -139400,7 +140345,9 @@ var init_game_controller = __esm(() => {
     if (!slug2) {
       throw ApiError.badRequest("Missing game slug");
     }
-    return ctx.services.game.getBySlug(slug2, ctx.user);
+    return ctx.services.game.getBySlug(slug2, ctx.user, {
+      scopeAuthorized: workerKeyGrantsGameRead(ctx.apiKey, slug2)
+    });
   });
   getManifest = requireNonAnonymous(async (ctx) => {
     const gameId = requireGameId(ctx.params.gameId);
@@ -139430,7 +140377,7 @@ var init_game_controller = __esm(() => {
     const body2 = await parseRequestBody(ctx.request, PatchGameMetadataSchema);
     return ctx.services.game.updateMetadata(gameId, body2, ctx.user);
   });
-  remove2 = requireNonAnonymous(async (ctx) => {
+  remove3 = requireNonAnonymous(async (ctx) => {
     const gameId = requireGameId(ctx.params.gameId);
     await ctx.services.game.delete(gameId, ctx.user);
   });
@@ -139444,7 +140391,7 @@ var init_game_controller = __esm(() => {
     getBySlug,
     upsertBySlug,
     patchGameMetadata,
-    remove: remove2
+    remove: remove3
   });
 });
 
@@ -139819,7 +140766,7 @@ var init_session_controller = __esm(() => {
     let baseUrl;
     if (ctx.config.isLocal) {
       try {
-        baseUrl = await getTunnelUrl();
+        baseUrl = await getTunnelUrl(ctx.config.baseUrl);
       } catch {}
     }
     return { token, exp, baseUrl };
@@ -140598,6 +141545,7 @@ var init_verify_controller = __esm(() => {
 // ../api-core/src/controllers/index.ts
 var init_controllers = __esm(() => {
   init_bucket_controller();
+  init_dashboard_controller();
   init_database_controller();
   init_deploy_controller();
   init_developer_controller();
@@ -143746,7 +144694,7 @@ import { resolve as resolve3 } from "node:path";
 
 // ../utils/src/file-loader.ts
 import { existsSync as existsSync3, readdirSync, statSync } from "fs";
-import { readFile } from "fs/promises";
+import { readFile as readFile2 } from "fs/promises";
 import { dirname as dirname2, parse as parse9, resolve as resolve2 } from "path";
 function findFilePath(filename, startDir, maxLevels = 3) {
   const filenames = Array.isArray(filename) ? filename : [filename];
@@ -143815,7 +144763,7 @@ async function loadFile(filename, options = {}) {
     return null;
   }
   try {
-    let content = await readFile(fileResult.path, "utf8");
+    let content = await readFile2(fileResult.path, "utf8");
     if (parseJson) {
       if (stripComments) {
         content = stripJsonComments(content);
@@ -144044,6 +144992,9 @@ program2.name("playcademy-sandbox").description("Local development server for Pl
     process.on("SIGTERM", cleanup);
   } catch (error89) {
     console.error(`❌ Failed to start sandbox: ${error89}`);
+    if (error89 instanceof Error && error89.message.includes("already in use")) {
+      console.error("Stop the other server or specify a different port with --port <number>.");
+    }
     process.exit(1);
   }
 });