@playcademy/sandbox 0.8.1-beta.7 → 0.9.1-beta.1

package/dist/cli.js

@@ -1128,7 +1128,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@playcademy/sandbox",
-    version: "0.8.1-beta.7",
+    version: "0.9.1-beta.1",
     description: "Local development server for Playcademy game development",
     type: "module",
     exports: {
@@ -100429,6 +100429,20 @@ function assessmentAttemptId(input) {
     String(input.attemptNumber)
   ].join("\x00"));
 }
+function buildAssessmentAttemptResultWhere(scope) {
+  return {
+    "student.sourcedId": scope.studentId,
+    status: ONEROSTER_STATUS2.active,
+    [`metadata.${PLAYCADEMY_ASSESSMENT_RESULT_METADATA_KEY}.activityId`]: scope.activityId
+  };
+}
+function buildAssessmentChildResultWhere(scope) {
+  return {
+    "student.sourcedId": scope.studentId,
+    status: ONEROSTER_STATUS2.active,
+    [`metadata.${PLAYCADEMY_ASSESSMENT_ITEM_RESULT_METADATA_KEY}.payload.attempt.activityId`]: scope.activityId
+  };
+}
 async function findLatestAssessmentResult(results, match) {
   let latest = null;
   let latestTimestamp = 0;
@@ -100868,6 +100882,7 @@ var PLAYABLE_SHAPE_SET;
 var init_timeback_assessment_runtime_util = __esm(() => {
   init_src();
   init_assessment_runtime2();
+  init_constants3();
   init_qti();
   init_types2();
   init_utils6();
@@ -103728,7 +103743,11 @@ var init_timeback_assessment_runtime_service = __esm(async () => {
       const startedAt = Date.now();
       const [candidates, results] = await Promise.all([
         this.candidateIntegrations(params.gameId, params.studentId, params.input),
-        this.studentAssessmentResults(params.studentId)
+        this.activityAssessmentResults({
+          studentId: params.studentId,
+          activityId: params.input.activityId,
+          purpose: params.input.purpose
+        })
       ]);
       const context2 = await this.selectIntegration(candidates, params.input);
       const attemptScope = {
@@ -104791,12 +104810,19 @@ var init_timeback_assessment_runtime_service = __esm(async () => {
         standard: assessmentStandardForRow(row)
       })).filter((test) => !matchesMasteryStandard || matchesMasteryStandard(test.standard));
     }
-    async studentAssessmentResults(studentId) {
+    async activityAssessmentResults(scope) {
+      const [parents, children] = await Promise.all([
+        this.collectAssessmentResults(buildAssessmentAttemptResultWhere(scope)),
+        scope.purpose === "review" ? this.activityChildResults(scope) : []
+      ]);
+      return [...parents, ...children];
+    }
+    activityChildResults(scope) {
+      return this.collectAssessmentResults(buildAssessmentChildResultWhere(scope));
+    }
+    async collectAssessmentResults(where) {
       const stream = this.requireClient().api.oneroster.assessmentResults.stream({
-        where: {
-          "student.sourcedId": studentId,
-          status: ONEROSTER_STATUS2.active
-        }
+        where
       });
       const results = [];
       for await (const result of stream) {
@@ -104805,7 +104831,7 @@ var init_timeback_assessment_runtime_service = __esm(async () => {
       return results;
     }
     async listAttempts(scope) {
-      return this.attemptListing(await this.studentAssessmentResults(scope.studentId), scope);
+      return this.attemptListing(await this.activityAssessmentResults(scope), scope);
     }
     async attemptListing(results, scope) {
       const attempts = new Map;
@@ -105570,7 +105596,10 @@ var init_timeback_assessment_runtime_service = __esm(async () => {
       const graded = await resumeAssessmentTranscript({
         suppliedTranscript,
         checkpointTranscript: metadata2.transcript,
-        recover: async () => recoverAssessmentTranscript(context2, await this.studentAssessmentResults(context2.studentId)),
+        recover: async () => recoverAssessmentTranscript(context2, await this.activityChildResults({
+          studentId: context2.studentId,
+          activityId: context2.metadata.activityId
+        })),
         grade: (transcript) => this.gradeTranscript(context2, transcript)
       });
       const session2 = await this.assessmentSession(context2, graded.transcript);
@@ -110720,10 +110749,10 @@ function createSandboxAuthProvider() {
     },
     async mintGameToken(gameId, userId) {
       const header = btoa(JSON.stringify({ alg: "none", typ: "sandbox" }));
-      const exp = Date.now() + 15 * 60 * 1000;
+      const exp = Math.floor(Date.now() / 1000) + 15 * 60;
       const payload = btoa(JSON.stringify({ sub: gameId, uid: userId, exp }));
       const token = `${header}.${payload}.sandbox`;
-      return { token, exp };
+      return { token, exp: exp * 1000 };
     },
     async validateGameToken(token) {
       try {
@@ -110731,18 +110760,9 @@ function createSandboxAuthProvider() {
         if (parts2.length !== 3) {
           return null;
         }
-        if (parts2[2] === "sandbox") {
-          const payload2 = JSON.parse(atob(parts2[1]));
-          if (payload2.sub && payload2.uid) {
-            if (payload2.exp && payload2.exp < Date.now()) {
-              log.debug("[SandboxAuthProvider] Token expired");
-              return null;
-            }
-            return payload2;
-          }
-        }
         const payload = JSON.parse(atob(parts2[1]));
-        if (payload.sub && payload.uid) {
+        const nowSeconds = Date.now() / 1000;
+        if (typeof payload?.sub === "string" && payload.sub.length > 0 && typeof payload.uid === "string" && payload.uid.length > 0 && typeof payload.exp === "number" && Number.isFinite(payload.exp) && payload.exp > nowSeconds && payload.exp < nowSeconds + MAX_TOKEN_LIFETIME_SECONDS) {
           return payload;
         }
         return null;
@@ -110840,7 +110860,7 @@ function createSandboxAuthProvider() {
     }
   };
 }
-var sandboxApiKeys, sandboxAssessmentPreparationReceipts, ASSESSMENT_PREPARATION_RECEIPT_LIFETIME_MS, sandboxAssessmentTokens;
+var sandboxApiKeys, sandboxAssessmentPreparationReceipts, ASSESSMENT_PREPARATION_RECEIPT_LIFETIME_MS, MAX_TOKEN_LIFETIME_SECONDS, sandboxAssessmentTokens;
 var init_auth_provider = __esm(async () => {
   init_src6();
   init_constants();
@@ -110848,6 +110868,7 @@ var init_auth_provider = __esm(async () => {
   sandboxApiKeys = new Map;
   sandboxAssessmentPreparationReceipts = new Map;
   ASSESSMENT_PREPARATION_RECEIPT_LIFETIME_MS = 5 * 60 * 1000;
+  MAX_TOKEN_LIFETIME_SECONDS = 30 * 24 * 60 * 60;
   sandboxAssessmentTokens = new TimebackCache({
     defaultTTL: 2 * 60 * 60 * 1000,
     maxSize: 1000
@@ -112875,56 +112896,13 @@ function extractBearerToken(authHeader) {
   }
   return authHeader.substring(7);
 }
-function parseSandboxToken(token) {
-  try {
-    const parts2 = token.split(".");
-    if (parts2.length !== 3 || parts2[2] !== "sandbox") {
-      return null;
-    }
-    const header = JSON.parse(atob(parts2[0]));
-    if (header.typ !== "sandbox") {
-      return null;
-    }
-    const payload = JSON.parse(atob(parts2[1]));
-    if (!payload.uid || !payload.sub) {
-      return null;
-    }
-    return {
-      userId: payload.uid,
-      gameSlug: payload.sub
-    };
-  } catch {
-    return null;
-  }
-}
-function parseJwtClaims(token) {
-  try {
-    const parts2 = token.split(".");
-    if (parts2.length === 3 && parts2[1]) {
-      const payload = JSON.parse(atob(parts2[1]));
-      if (payload.uid) {
-        return {
-          userId: payload.uid,
-          gameId: payload.sub
-        };
-      }
-    }
-  } catch {}
-  return null;
-}
-function resolveAuth(token) {
+async function resolveAuth(token) {
   const demoUser = DEMO_TOKENS[token];
   if (demoUser) {
     return { userId: demoUser.id };
   }
-  if (token.includes(".")) {
-    const sandboxClaims = parseSandboxToken(token);
-    if (sandboxClaims) {
-      return sandboxClaims;
-    }
-    return parseJwtClaims(token);
-  }
-  return null;
+  const payload = await sandboxAuth.validateGameToken(token);
+  return payload ? { userId: payload.uid, gameId: payload.sub } : null;
 }
 async function fetchUserFromDatabase(db2, userId) {
   try {
@@ -112937,18 +112915,6 @@ async function fetchUserFromDatabase(db2, userId) {
     throw error88;
   }
 }
-async function resolveGameIdFromSlug(db2, slug2) {
-  try {
-    const game2 = await db2.query.games.findFirst({
-      where: eq(games.slug, slug2),
-      columns: { id: true }
-    });
-    return game2?.id || null;
-  } catch (error88) {
-    console.error("[Auth] Error looking up game by slug:", error88);
-    return null;
-  }
-}
 function isPublicRoute(path, exceptions) {
   return exceptions.some((exception) => {
     if (path === exception) {
@@ -112966,35 +112932,23 @@ async function authenticateRequest(c) {
   const apiKey = c.req.header("x-api-key");
   const token = bearerToken || apiKey;
   if (!token) {
-    return {
-      success: false,
-      error: "No authorization token provided",
-      shouldReturn404: true
-    };
+    return { success: false, error: "No authorization token provided" };
   }
-  const resolved = resolveAuth(token);
+  const resolved = await resolveAuth(token);
   if (!resolved) {
-    return {
-      success: false,
-      error: "Invalid or expired token",
-      shouldReturn404: true
-    };
+    return { success: false, error: "Invalid or expired token" };
   }
   const claims = resolved;
   const db2 = c.get("db");
   if (!db2) {
     console.error("[Auth] Database not available in context");
-    return { success: false, error: "Internal server error", shouldReturn404: false };
+    return { success: false, error: "Internal server error" };
   }
   const user = await fetchUserFromDatabase(db2, claims.userId);
   if (!user) {
-    return { success: false, error: "User not found or token invalid", shouldReturn404: true };
+    return { success: false, error: "User not found or token invalid" };
   }
-  let gameId = claims.gameId;
-  if (!gameId && claims.gameSlug) {
-    gameId = await resolveGameIdFromSlug(db2, claims.gameSlug) ?? undefined;
-  }
-  return { success: true, user, gameId };
+  return { success: true, user, gameId: claims.gameId };
 }
 function setupAuth(options = {}) {
   const { exceptions = [] } = options;
@@ -113014,20 +112968,19 @@ function setupAuth(options = {}) {
       }
       c.set("authError", result.error);
       await next();
-      if (result.shouldReturn404 && c.res.status === 404) {
-        return;
-      }
-      return c.json({ error: "Unauthorized", message: result.error }, 401);
     } catch (error88) {
       console.error("[Auth] Unexpected error in authentication middleware:", error88);
       return c.json({ error: "Internal Server Error", message: "Authentication failed" }, 500);
     }
   };
 }
-var init_auth2 = __esm(() => {
+var sandboxAuth;
+var init_auth2 = __esm(async () => {
   init_drizzle_orm();
   init_tables_index();
   init_constants();
+  await init_providers();
+  sandboxAuth = createSandboxAuthProvider();
 });
 
 // src/server/app.ts
@@ -113046,11 +112999,11 @@ function createApp(db2, options) {
   }));
   return app;
 }
-var init_app = __esm(() => {
+var init_app = __esm(async () => {
   init_dist7();
   init_cors();
   init_logger2();
-  init_auth2();
+  await init_auth2();
 });
 
 // ../../node_modules/.bun/@electric-sql+pglite@0.3.16/node_modules/@electric-sql/pglite/dist/chunk-QY3QWFKW.js
@@ -169179,18 +169132,33 @@ var init_sessions = __esm(async () => {
 });
 
 // src/routes/platform/games/verify.ts
-var gameVerifyRouter;
+function toUserInfo(userData) {
+  return {
+    sub: userData.id,
+    email: userData.email || "",
+    name: userData.name || userData.username || "",
+    email_verified: true,
+    given_name: undefined,
+    family_name: undefined,
+    timeback_id: userData.timebackId || undefined
+  };
+}
+var gameVerifyRouter, sandboxAuth2;
 var init_verify = __esm(async () => {
   init_dist7();
   init_errors2();
   init_constants();
   init_error_handler();
-  await init_api3();
+  await __promiseAll([
+    init_api3(),
+    init_providers()
+  ]);
   gameVerifyRouter = new Hono2;
+  sandboxAuth2 = createSandboxAuthProvider();
   gameVerifyRouter.post("/verify", async (c2) => {
     const body2 = await c2.req.json().catch(() => ({}));
     const token = body2?.token;
-    if (!token) {
+    if (typeof token !== "string" || !token) {
       return c2.json({ error: "Missing token" }, 400);
     }
     const demoUser = DEMO_TOKENS[token];
@@ -169203,49 +169171,25 @@ var init_verify = __esm(async () => {
         return c2.json({ error: "User not found in sandbox" }, 500);
       }
       return c2.json({
-        claims: { sandbox: true },
+        claims: { sandbox: true, exp: Math.floor(Date.now() / 1000) + 15 * 60 },
         gameId: MOCK_GAME_ID,
-        user: {
-          sub: userData.id,
-          email: userData.email || "",
-          name: userData.name || userData.username || "",
-          email_verified: true,
-          given_name: undefined,
-          family_name: undefined,
-          timeback_id: userData.timebackId || undefined
-        }
+        user: toUserInfo(userData)
       });
     }
     if (token.endsWith(".sandbox")) {
+      const payload = await sandboxAuth2.validateGameToken(token);
+      if (!payload) {
+        return c2.json({ error: "Invalid or expired sandbox token" }, 400);
+      }
       try {
-        const parts2 = token.split(".");
-        if (parts2.length === 3) {
-          const payload = JSON.parse(atob(parts2[1]));
-          const userId = payload.uid;
-          const gameIdOrSlug = payload.sub;
-          const db2 = c2.get("db");
-          const userData = await db2.query.users.findFirst({
-            where: (users3, { eq: eq3 }) => eq3(users3.id, userId)
-          });
-          if (!userData) {
-            return c2.json({ error: "User not found in sandbox" }, 500);
-          }
-          return c2.json({
-            claims: payload,
-            gameId: gameIdOrSlug,
-            user: {
-              sub: userData.id,
-              email: userData.email || "",
-              name: userData.name || userData.username || "",
-              email_verified: true,
-              given_name: undefined,
-              family_name: undefined,
-              timeback_id: userData.timebackId || undefined
-            }
-          });
-        } else {
-          throw new Error("Malformed sandbox token: expected 3 parts");
+        const db2 = c2.get("db");
+        const userData = await db2.query.users.findFirst({
+          where: (users3, { eq: eq3 }) => eq3(users3.id, payload.uid)
+        });
+        if (!userData) {
+          return c2.json({ error: "User not found in sandbox" }, 500);
         }
+        return c2.json({ claims: payload, gameId: payload.sub, user: toUserInfo(userData) });
       } catch {
         return c2.json({ error: "Invalid sandbox token" }, 400);
       }
@@ -169753,13 +169697,13 @@ var init_server = __esm(async () => {
   init_port();
   init_package();
   init_config();
-  init_app();
   init_database2();
   init_options();
   await __promiseAll([
     init_api3(),
     init_context(),
-    init_providers()
+    init_providers(),
+    init_app()
   ]);
   version5 = package_default.version;
 });

package/dist/server.js

@@ -1127,7 +1127,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@playcademy/sandbox",
-    version: "0.8.1-beta.7",
+    version: "0.9.1-beta.1",
     description: "Local development server for Playcademy game development",
     type: "module",
     exports: {
@@ -100428,6 +100428,20 @@ function assessmentAttemptId(input) {
     String(input.attemptNumber)
   ].join("\x00"));
 }
+function buildAssessmentAttemptResultWhere(scope) {
+  return {
+    "student.sourcedId": scope.studentId,
+    status: ONEROSTER_STATUS2.active,
+    [`metadata.${PLAYCADEMY_ASSESSMENT_RESULT_METADATA_KEY}.activityId`]: scope.activityId
+  };
+}
+function buildAssessmentChildResultWhere(scope) {
+  return {
+    "student.sourcedId": scope.studentId,
+    status: ONEROSTER_STATUS2.active,
+    [`metadata.${PLAYCADEMY_ASSESSMENT_ITEM_RESULT_METADATA_KEY}.payload.attempt.activityId`]: scope.activityId
+  };
+}
 async function findLatestAssessmentResult(results, match) {
   let latest = null;
   let latestTimestamp = 0;
@@ -100867,6 +100881,7 @@ var PLAYABLE_SHAPE_SET;
 var init_timeback_assessment_runtime_util = __esm(() => {
   init_src();
   init_assessment_runtime2();
+  init_constants3();
   init_qti();
   init_types2();
   init_utils6();
@@ -103727,7 +103742,11 @@ var init_timeback_assessment_runtime_service = __esm(async () => {
       const startedAt = Date.now();
       const [candidates, results] = await Promise.all([
         this.candidateIntegrations(params.gameId, params.studentId, params.input),
-        this.studentAssessmentResults(params.studentId)
+        this.activityAssessmentResults({
+          studentId: params.studentId,
+          activityId: params.input.activityId,
+          purpose: params.input.purpose
+        })
       ]);
       const context2 = await this.selectIntegration(candidates, params.input);
       const attemptScope = {
@@ -104790,12 +104809,19 @@ var init_timeback_assessment_runtime_service = __esm(async () => {
         standard: assessmentStandardForRow(row)
       })).filter((test) => !matchesMasteryStandard || matchesMasteryStandard(test.standard));
     }
-    async studentAssessmentResults(studentId) {
+    async activityAssessmentResults(scope) {
+      const [parents, children] = await Promise.all([
+        this.collectAssessmentResults(buildAssessmentAttemptResultWhere(scope)),
+        scope.purpose === "review" ? this.activityChildResults(scope) : []
+      ]);
+      return [...parents, ...children];
+    }
+    activityChildResults(scope) {
+      return this.collectAssessmentResults(buildAssessmentChildResultWhere(scope));
+    }
+    async collectAssessmentResults(where) {
       const stream = this.requireClient().api.oneroster.assessmentResults.stream({
-        where: {
-          "student.sourcedId": studentId,
-          status: ONEROSTER_STATUS2.active
-        }
+        where
       });
       const results = [];
       for await (const result of stream) {
@@ -104804,7 +104830,7 @@ var init_timeback_assessment_runtime_service = __esm(async () => {
       return results;
     }
     async listAttempts(scope) {
-      return this.attemptListing(await this.studentAssessmentResults(scope.studentId), scope);
+      return this.attemptListing(await this.activityAssessmentResults(scope), scope);
     }
     async attemptListing(results, scope) {
       const attempts = new Map;
@@ -105569,7 +105595,10 @@ var init_timeback_assessment_runtime_service = __esm(async () => {
       const graded = await resumeAssessmentTranscript({
         suppliedTranscript,
         checkpointTranscript: metadata2.transcript,
-        recover: async () => recoverAssessmentTranscript(context2, await this.studentAssessmentResults(context2.studentId)),
+        recover: async () => recoverAssessmentTranscript(context2, await this.activityChildResults({
+          studentId: context2.studentId,
+          activityId: context2.metadata.activityId
+        })),
         grade: (transcript) => this.gradeTranscript(context2, transcript)
       });
       const session2 = await this.assessmentSession(context2, graded.transcript);
@@ -110719,10 +110748,10 @@ function createSandboxAuthProvider() {
     },
     async mintGameToken(gameId, userId) {
       const header = btoa(JSON.stringify({ alg: "none", typ: "sandbox" }));
-      const exp = Date.now() + 15 * 60 * 1000;
+      const exp = Math.floor(Date.now() / 1000) + 15 * 60;
       const payload = btoa(JSON.stringify({ sub: gameId, uid: userId, exp }));
       const token = `${header}.${payload}.sandbox`;
-      return { token, exp };
+      return { token, exp: exp * 1000 };
     },
     async validateGameToken(token) {
       try {
@@ -110730,18 +110759,9 @@ function createSandboxAuthProvider() {
         if (parts2.length !== 3) {
           return null;
         }
-        if (parts2[2] === "sandbox") {
-          const payload2 = JSON.parse(atob(parts2[1]));
-          if (payload2.sub && payload2.uid) {
-            if (payload2.exp && payload2.exp < Date.now()) {
-              log.debug("[SandboxAuthProvider] Token expired");
-              return null;
-            }
-            return payload2;
-          }
-        }
         const payload = JSON.parse(atob(parts2[1]));
-        if (payload.sub && payload.uid) {
+        const nowSeconds = Date.now() / 1000;
+        if (typeof payload?.sub === "string" && payload.sub.length > 0 && typeof payload.uid === "string" && payload.uid.length > 0 && typeof payload.exp === "number" && Number.isFinite(payload.exp) && payload.exp > nowSeconds && payload.exp < nowSeconds + MAX_TOKEN_LIFETIME_SECONDS) {
           return payload;
         }
         return null;
@@ -110839,7 +110859,7 @@ function createSandboxAuthProvider() {
     }
   };
 }
-var sandboxApiKeys, sandboxAssessmentPreparationReceipts, ASSESSMENT_PREPARATION_RECEIPT_LIFETIME_MS, sandboxAssessmentTokens;
+var sandboxApiKeys, sandboxAssessmentPreparationReceipts, ASSESSMENT_PREPARATION_RECEIPT_LIFETIME_MS, MAX_TOKEN_LIFETIME_SECONDS, sandboxAssessmentTokens;
 var init_auth_provider = __esm(async () => {
   init_src6();
   init_constants();
@@ -110847,6 +110867,7 @@ var init_auth_provider = __esm(async () => {
   sandboxApiKeys = new Map;
   sandboxAssessmentPreparationReceipts = new Map;
   ASSESSMENT_PREPARATION_RECEIPT_LIFETIME_MS = 5 * 60 * 1000;
+  MAX_TOKEN_LIFETIME_SECONDS = 30 * 24 * 60 * 60;
   sandboxAssessmentTokens = new TimebackCache({
     defaultTTL: 2 * 60 * 60 * 1000,
     maxSize: 1000
@@ -112874,56 +112895,13 @@ function extractBearerToken(authHeader) {
   }
   return authHeader.substring(7);
 }
-function parseSandboxToken(token) {
-  try {
-    const parts2 = token.split(".");
-    if (parts2.length !== 3 || parts2[2] !== "sandbox") {
-      return null;
-    }
-    const header = JSON.parse(atob(parts2[0]));
-    if (header.typ !== "sandbox") {
-      return null;
-    }
-    const payload = JSON.parse(atob(parts2[1]));
-    if (!payload.uid || !payload.sub) {
-      return null;
-    }
-    return {
-      userId: payload.uid,
-      gameSlug: payload.sub
-    };
-  } catch {
-    return null;
-  }
-}
-function parseJwtClaims(token) {
-  try {
-    const parts2 = token.split(".");
-    if (parts2.length === 3 && parts2[1]) {
-      const payload = JSON.parse(atob(parts2[1]));
-      if (payload.uid) {
-        return {
-          userId: payload.uid,
-          gameId: payload.sub
-        };
-      }
-    }
-  } catch {}
-  return null;
-}
-function resolveAuth(token) {
+async function resolveAuth(token) {
   const demoUser = DEMO_TOKENS[token];
   if (demoUser) {
     return { userId: demoUser.id };
   }
-  if (token.includes(".")) {
-    const sandboxClaims = parseSandboxToken(token);
-    if (sandboxClaims) {
-      return sandboxClaims;
-    }
-    return parseJwtClaims(token);
-  }
-  return null;
+  const payload = await sandboxAuth.validateGameToken(token);
+  return payload ? { userId: payload.uid, gameId: payload.sub } : null;
 }
 async function fetchUserFromDatabase(db2, userId) {
   try {
@@ -112936,18 +112914,6 @@ async function fetchUserFromDatabase(db2, userId) {
     throw error88;
   }
 }
-async function resolveGameIdFromSlug(db2, slug2) {
-  try {
-    const game2 = await db2.query.games.findFirst({
-      where: eq(games.slug, slug2),
-      columns: { id: true }
-    });
-    return game2?.id || null;
-  } catch (error88) {
-    console.error("[Auth] Error looking up game by slug:", error88);
-    return null;
-  }
-}
 function isPublicRoute(path, exceptions) {
   return exceptions.some((exception) => {
     if (path === exception) {
@@ -112965,35 +112931,23 @@ async function authenticateRequest(c) {
   const apiKey = c.req.header("x-api-key");
   const token = bearerToken || apiKey;
   if (!token) {
-    return {
-      success: false,
-      error: "No authorization token provided",
-      shouldReturn404: true
-    };
+    return { success: false, error: "No authorization token provided" };
   }
-  const resolved = resolveAuth(token);
+  const resolved = await resolveAuth(token);
   if (!resolved) {
-    return {
-      success: false,
-      error: "Invalid or expired token",
-      shouldReturn404: true
-    };
+    return { success: false, error: "Invalid or expired token" };
   }
   const claims = resolved;
   const db2 = c.get("db");
   if (!db2) {
     console.error("[Auth] Database not available in context");
-    return { success: false, error: "Internal server error", shouldReturn404: false };
+    return { success: false, error: "Internal server error" };
   }
   const user = await fetchUserFromDatabase(db2, claims.userId);
   if (!user) {
-    return { success: false, error: "User not found or token invalid", shouldReturn404: true };
+    return { success: false, error: "User not found or token invalid" };
   }
-  let gameId = claims.gameId;
-  if (!gameId && claims.gameSlug) {
-    gameId = await resolveGameIdFromSlug(db2, claims.gameSlug) ?? undefined;
-  }
-  return { success: true, user, gameId };
+  return { success: true, user, gameId: claims.gameId };
 }
 function setupAuth(options = {}) {
   const { exceptions = [] } = options;
@@ -113013,20 +112967,19 @@ function setupAuth(options = {}) {
       }
       c.set("authError", result.error);
       await next();
-      if (result.shouldReturn404 && c.res.status === 404) {
-        return;
-      }
-      return c.json({ error: "Unauthorized", message: result.error }, 401);
     } catch (error88) {
       console.error("[Auth] Unexpected error in authentication middleware:", error88);
       return c.json({ error: "Internal Server Error", message: "Authentication failed" }, 500);
     }
   };
 }
-var init_auth2 = __esm(() => {
+var sandboxAuth;
+var init_auth2 = __esm(async () => {
   init_drizzle_orm();
   init_tables_index();
   init_constants();
+  await init_providers();
+  sandboxAuth = createSandboxAuthProvider();
 });
 
 // src/server/app.ts
@@ -113045,11 +112998,11 @@ function createApp(db2, options) {
   }));
   return app;
 }
-var init_app = __esm(() => {
+var init_app = __esm(async () => {
   init_dist7();
   init_cors();
   init_logger2();
-  init_auth2();
+  await init_auth2();
 });
 
 // ../../node_modules/.bun/@electric-sql+pglite@0.3.16/node_modules/@electric-sql/pglite/dist/chunk-QY3QWFKW.js
@@ -169178,18 +169131,33 @@ var init_sessions = __esm(async () => {
 });
 
 // src/routes/platform/games/verify.ts
-var gameVerifyRouter;
+function toUserInfo(userData) {
+  return {
+    sub: userData.id,
+    email: userData.email || "",
+    name: userData.name || userData.username || "",
+    email_verified: true,
+    given_name: undefined,
+    family_name: undefined,
+    timeback_id: userData.timebackId || undefined
+  };
+}
+var gameVerifyRouter, sandboxAuth2;
 var init_verify = __esm(async () => {
   init_dist7();
   init_errors2();
   init_constants();
   init_error_handler();
-  await init_api3();
+  await __promiseAll([
+    init_api3(),
+    init_providers()
+  ]);
   gameVerifyRouter = new Hono2;
+  sandboxAuth2 = createSandboxAuthProvider();
   gameVerifyRouter.post("/verify", async (c2) => {
     const body2 = await c2.req.json().catch(() => ({}));
     const token = body2?.token;
-    if (!token) {
+    if (typeof token !== "string" || !token) {
       return c2.json({ error: "Missing token" }, 400);
     }
     const demoUser = DEMO_TOKENS[token];
@@ -169202,49 +169170,25 @@ var init_verify = __esm(async () => {
         return c2.json({ error: "User not found in sandbox" }, 500);
       }
       return c2.json({
-        claims: { sandbox: true },
+        claims: { sandbox: true, exp: Math.floor(Date.now() / 1000) + 15 * 60 },
         gameId: MOCK_GAME_ID,
-        user: {
-          sub: userData.id,
-          email: userData.email || "",
-          name: userData.name || userData.username || "",
-          email_verified: true,
-          given_name: undefined,
-          family_name: undefined,
-          timeback_id: userData.timebackId || undefined
-        }
+        user: toUserInfo(userData)
       });
     }
     if (token.endsWith(".sandbox")) {
+      const payload = await sandboxAuth2.validateGameToken(token);
+      if (!payload) {
+        return c2.json({ error: "Invalid or expired sandbox token" }, 400);
+      }
       try {
-        const parts2 = token.split(".");
-        if (parts2.length === 3) {
-          const payload = JSON.parse(atob(parts2[1]));
-          const userId = payload.uid;
-          const gameIdOrSlug = payload.sub;
-          const db2 = c2.get("db");
-          const userData = await db2.query.users.findFirst({
-            where: (users3, { eq: eq3 }) => eq3(users3.id, userId)
-          });
-          if (!userData) {
-            return c2.json({ error: "User not found in sandbox" }, 500);
-          }
-          return c2.json({
-            claims: payload,
-            gameId: gameIdOrSlug,
-            user: {
-              sub: userData.id,
-              email: userData.email || "",
-              name: userData.name || userData.username || "",
-              email_verified: true,
-              given_name: undefined,
-              family_name: undefined,
-              timeback_id: userData.timebackId || undefined
-            }
-          });
-        } else {
-          throw new Error("Malformed sandbox token: expected 3 parts");
+        const db2 = c2.get("db");
+        const userData = await db2.query.users.findFirst({
+          where: (users3, { eq: eq3 }) => eq3(users3.id, payload.uid)
+        });
+        if (!userData) {
+          return c2.json({ error: "User not found in sandbox" }, 500);
         }
+        return c2.json({ claims: payload, gameId: payload.sub, user: toUserInfo(userData) });
       } catch {
         return c2.json({ error: "Invalid sandbox token" }, 400);
       }
@@ -169752,13 +169696,13 @@ var init_server = __esm(async () => {
   init_port();
   init_package();
   init_config();
-  init_app();
   init_database2();
   init_options();
   await __promiseAll([
     init_api3(),
     init_context(),
-    init_providers()
+    init_providers(),
+    init_app()
   ]);
   version5 = package_default.version;
 });

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@playcademy/sandbox",
-    "version": "0.8.1-beta.7",
+    "version": "0.9.1-beta.1",
     "description": "Local development server for Playcademy game development",
     "type": "module",
     "exports": {