@playcademy/sandbox 0.9.0 → 0.10.0

package/dist/cli.js

@@ -1128,7 +1128,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@playcademy/sandbox",
-    version: "0.9.0",
+    version: "0.10.0",
     description: "Local development server for Playcademy game development",
     type: "module",
     exports: {
@@ -96840,10 +96840,12 @@ function compileResponseProcessing(item, itemIdentifier, maxScore, declarations)
   if (!onlyAttributes(processing, []) || !onlyWhitespaceText(processing.children) || processingRules.length === 0 || processingRules.some((rule) => rule.localName !== "qti-response-condition")) {
     return fallback(itemIdentifier, maxScore, "unsupported-response-processing");
   }
-  if (processingRules.length === 1 && declarations.size === 1 && scoreDefaultIsZero(item) && feedbackOutcomeIsDeclared(item)) {
+  if (processingRules.length === 1 && declarations.size === 1 && feedbackOutcomeIsDeclared(item)) {
     const declaration = [...declarations.values()][0];
     const rule = binaryBranchRule(processingRules[0], declaration);
-    if (rule) {
+    const scoreIsDeclared = childElements(item, "qti-outcome-declaration").some((outcome) => outcome.attributes.identifier?.trim().toUpperCase() === "SCORE");
+    const completeIdentifierMatch = rule?.comparison.kind === "match" && rule.baseType === "identifier" && (rule.cardinality === "single" || rule.cardinality === "multiple");
+    if (rule && (scoreDefaultIsZero(item) || !scoreIsDeclared && completeIdentifierMatch)) {
       return platformResult(itemIdentifier, maxScore, [rule]);
     }
   }
@@ -99791,7 +99793,7 @@ function scoringSchema(identity) {
   if (identity.kind === "assessment") {
     return exports_external.object({
       items: assessmentScoringArtifactItemsSchema2,
-      reviewBank: exports_external.undefined(),
+      reviewBank: exports_external.undefined().optional(),
       diagnostic: diagnosticContextSchema.optional()
     }).strict();
   }
@@ -99805,7 +99807,7 @@ function scoringSchema(identity) {
         standards: exports_external.array(exports_external.unknown())
       }).strict())
     }).strict(),
-    diagnostic: exports_external.undefined()
+    diagnostic: exports_external.undefined().optional()
   }).strict().refine((payload) => payload.reviewBank.items.length === payload.items.length && payload.reviewBank.items.every((item, index2) => item.itemIdentifier === payload.items[index2]?.itemIdentifier));
 }
 function assertPlayableAssessmentArtifact(payload, identity) {
@@ -100011,7 +100013,7 @@ var init_assessment_artifact_runtime_util = __esm(() => {
   }).strict();
   diagnosticContextSchema = exports_external.object({
     routingRevision: trimmedNonEmptyString3,
-    routingManifest: exports_external.record(exports_external.unknown())
+    routingManifest: exports_external.record(exports_external.string(), exports_external.unknown())
   }).strict();
 });
 
@@ -110749,10 +110751,10 @@ function createSandboxAuthProvider() {
     },
     async mintGameToken(gameId, userId) {
       const header = btoa(JSON.stringify({ alg: "none", typ: "sandbox" }));
-      const exp = Date.now() + 15 * 60 * 1000;
+      const exp = Math.floor(Date.now() / 1000) + 15 * 60;
       const payload = btoa(JSON.stringify({ sub: gameId, uid: userId, exp }));
       const token = `${header}.${payload}.sandbox`;
-      return { token, exp };
+      return { token, exp: exp * 1000 };
     },
     async validateGameToken(token) {
       try {
@@ -110760,18 +110762,9 @@ function createSandboxAuthProvider() {
         if (parts2.length !== 3) {
           return null;
         }
-        if (parts2[2] === "sandbox") {
-          const payload2 = JSON.parse(atob(parts2[1]));
-          if (payload2.sub && payload2.uid) {
-            if (payload2.exp && payload2.exp < Date.now()) {
-              log.debug("[SandboxAuthProvider] Token expired");
-              return null;
-            }
-            return payload2;
-          }
-        }
         const payload = JSON.parse(atob(parts2[1]));
-        if (payload.sub && payload.uid) {
+        const nowSeconds = Date.now() / 1000;
+        if (typeof payload?.sub === "string" && payload.sub.length > 0 && typeof payload.uid === "string" && payload.uid.length > 0 && typeof payload.exp === "number" && Number.isFinite(payload.exp) && payload.exp > nowSeconds && payload.exp < nowSeconds + MAX_TOKEN_LIFETIME_SECONDS) {
           return payload;
         }
         return null;
@@ -110869,7 +110862,7 @@ function createSandboxAuthProvider() {
     }
   };
 }
-var sandboxApiKeys, sandboxAssessmentPreparationReceipts, ASSESSMENT_PREPARATION_RECEIPT_LIFETIME_MS, sandboxAssessmentTokens;
+var sandboxApiKeys, sandboxAssessmentPreparationReceipts, ASSESSMENT_PREPARATION_RECEIPT_LIFETIME_MS, MAX_TOKEN_LIFETIME_SECONDS, sandboxAssessmentTokens;
 var init_auth_provider = __esm(async () => {
   init_src6();
   init_constants();
@@ -110877,6 +110870,7 @@ var init_auth_provider = __esm(async () => {
   sandboxApiKeys = new Map;
   sandboxAssessmentPreparationReceipts = new Map;
   ASSESSMENT_PREPARATION_RECEIPT_LIFETIME_MS = 5 * 60 * 1000;
+  MAX_TOKEN_LIFETIME_SECONDS = 30 * 24 * 60 * 60;
   sandboxAssessmentTokens = new TimebackCache({
     defaultTTL: 2 * 60 * 60 * 1000,
     maxSize: 1000
@@ -112904,56 +112898,13 @@ function extractBearerToken(authHeader) {
   }
   return authHeader.substring(7);
 }
-function parseSandboxToken(token) {
-  try {
-    const parts2 = token.split(".");
-    if (parts2.length !== 3 || parts2[2] !== "sandbox") {
-      return null;
-    }
-    const header = JSON.parse(atob(parts2[0]));
-    if (header.typ !== "sandbox") {
-      return null;
-    }
-    const payload = JSON.parse(atob(parts2[1]));
-    if (!payload.uid || !payload.sub) {
-      return null;
-    }
-    return {
-      userId: payload.uid,
-      gameSlug: payload.sub
-    };
-  } catch {
-    return null;
-  }
-}
-function parseJwtClaims(token) {
-  try {
-    const parts2 = token.split(".");
-    if (parts2.length === 3 && parts2[1]) {
-      const payload = JSON.parse(atob(parts2[1]));
-      if (payload.uid) {
-        return {
-          userId: payload.uid,
-          gameId: payload.sub
-        };
-      }
-    }
-  } catch {}
-  return null;
-}
-function resolveAuth(token) {
+async function resolveAuth(token) {
   const demoUser = DEMO_TOKENS[token];
   if (demoUser) {
     return { userId: demoUser.id };
   }
-  if (token.includes(".")) {
-    const sandboxClaims = parseSandboxToken(token);
-    if (sandboxClaims) {
-      return sandboxClaims;
-    }
-    return parseJwtClaims(token);
-  }
-  return null;
+  const payload = await sandboxAuth.validateGameToken(token);
+  return payload ? { userId: payload.uid, gameId: payload.sub } : null;
 }
 async function fetchUserFromDatabase(db2, userId) {
   try {
@@ -112966,18 +112917,6 @@ async function fetchUserFromDatabase(db2, userId) {
     throw error88;
   }
 }
-async function resolveGameIdFromSlug(db2, slug2) {
-  try {
-    const game2 = await db2.query.games.findFirst({
-      where: eq(games.slug, slug2),
-      columns: { id: true }
-    });
-    return game2?.id || null;
-  } catch (error88) {
-    console.error("[Auth] Error looking up game by slug:", error88);
-    return null;
-  }
-}
 function isPublicRoute(path, exceptions) {
   return exceptions.some((exception) => {
     if (path === exception) {
@@ -112995,35 +112934,23 @@ async function authenticateRequest(c) {
   const apiKey = c.req.header("x-api-key");
   const token = bearerToken || apiKey;
   if (!token) {
-    return {
-      success: false,
-      error: "No authorization token provided",
-      shouldReturn404: true
-    };
+    return { success: false, error: "No authorization token provided" };
   }
-  const resolved = resolveAuth(token);
+  const resolved = await resolveAuth(token);
   if (!resolved) {
-    return {
-      success: false,
-      error: "Invalid or expired token",
-      shouldReturn404: true
-    };
+    return { success: false, error: "Invalid or expired token" };
   }
   const claims = resolved;
   const db2 = c.get("db");
   if (!db2) {
     console.error("[Auth] Database not available in context");
-    return { success: false, error: "Internal server error", shouldReturn404: false };
+    return { success: false, error: "Internal server error" };
   }
   const user = await fetchUserFromDatabase(db2, claims.userId);
   if (!user) {
-    return { success: false, error: "User not found or token invalid", shouldReturn404: true };
+    return { success: false, error: "User not found or token invalid" };
   }
-  let gameId = claims.gameId;
-  if (!gameId && claims.gameSlug) {
-    gameId = await resolveGameIdFromSlug(db2, claims.gameSlug) ?? undefined;
-  }
-  return { success: true, user, gameId };
+  return { success: true, user, gameId: claims.gameId };
 }
 function setupAuth(options = {}) {
   const { exceptions = [] } = options;
@@ -113043,20 +112970,19 @@ function setupAuth(options = {}) {
       }
       c.set("authError", result.error);
       await next();
-      if (result.shouldReturn404 && c.res.status === 404) {
-        return;
-      }
-      return c.json({ error: "Unauthorized", message: result.error }, 401);
     } catch (error88) {
       console.error("[Auth] Unexpected error in authentication middleware:", error88);
       return c.json({ error: "Internal Server Error", message: "Authentication failed" }, 500);
     }
   };
 }
-var init_auth2 = __esm(() => {
+var sandboxAuth;
+var init_auth2 = __esm(async () => {
   init_drizzle_orm();
   init_tables_index();
   init_constants();
+  await init_providers();
+  sandboxAuth = createSandboxAuthProvider();
 });
 
 // src/server/app.ts
@@ -113075,11 +113001,11 @@ function createApp(db2, options) {
   }));
   return app;
 }
-var init_app = __esm(() => {
+var init_app = __esm(async () => {
   init_dist7();
   init_cors();
   init_logger2();
-  init_auth2();
+  await init_auth2();
 });
 
 // ../../node_modules/.bun/@electric-sql+pglite@0.3.16/node_modules/@electric-sql/pglite/dist/chunk-QY3QWFKW.js
@@ -169208,18 +169134,33 @@ var init_sessions = __esm(async () => {
 });
 
 // src/routes/platform/games/verify.ts
-var gameVerifyRouter;
+function toUserInfo(userData) {
+  return {
+    sub: userData.id,
+    email: userData.email || "",
+    name: userData.name || userData.username || "",
+    email_verified: true,
+    given_name: undefined,
+    family_name: undefined,
+    timeback_id: userData.timebackId || undefined
+  };
+}
+var gameVerifyRouter, sandboxAuth2;
 var init_verify = __esm(async () => {
   init_dist7();
   init_errors2();
   init_constants();
   init_error_handler();
-  await init_api3();
+  await __promiseAll([
+    init_api3(),
+    init_providers()
+  ]);
   gameVerifyRouter = new Hono2;
+  sandboxAuth2 = createSandboxAuthProvider();
   gameVerifyRouter.post("/verify", async (c2) => {
     const body2 = await c2.req.json().catch(() => ({}));
     const token = body2?.token;
-    if (!token) {
+    if (typeof token !== "string" || !token) {
       return c2.json({ error: "Missing token" }, 400);
     }
     const demoUser = DEMO_TOKENS[token];
@@ -169232,49 +169173,25 @@ var init_verify = __esm(async () => {
         return c2.json({ error: "User not found in sandbox" }, 500);
       }
       return c2.json({
-        claims: { sandbox: true },
+        claims: { sandbox: true, exp: Math.floor(Date.now() / 1000) + 15 * 60 },
         gameId: MOCK_GAME_ID,
-        user: {
-          sub: userData.id,
-          email: userData.email || "",
-          name: userData.name || userData.username || "",
-          email_verified: true,
-          given_name: undefined,
-          family_name: undefined,
-          timeback_id: userData.timebackId || undefined
-        }
+        user: toUserInfo(userData)
       });
     }
     if (token.endsWith(".sandbox")) {
+      const payload = await sandboxAuth2.validateGameToken(token);
+      if (!payload) {
+        return c2.json({ error: "Invalid or expired sandbox token" }, 400);
+      }
       try {
-        const parts2 = token.split(".");
-        if (parts2.length === 3) {
-          const payload = JSON.parse(atob(parts2[1]));
-          const userId = payload.uid;
-          const gameIdOrSlug = payload.sub;
-          const db2 = c2.get("db");
-          const userData = await db2.query.users.findFirst({
-            where: (users3, { eq: eq3 }) => eq3(users3.id, userId)
-          });
-          if (!userData) {
-            return c2.json({ error: "User not found in sandbox" }, 500);
-          }
-          return c2.json({
-            claims: payload,
-            gameId: gameIdOrSlug,
-            user: {
-              sub: userData.id,
-              email: userData.email || "",
-              name: userData.name || userData.username || "",
-              email_verified: true,
-              given_name: undefined,
-              family_name: undefined,
-              timeback_id: userData.timebackId || undefined
-            }
-          });
-        } else {
-          throw new Error("Malformed sandbox token: expected 3 parts");
+        const db2 = c2.get("db");
+        const userData = await db2.query.users.findFirst({
+          where: (users3, { eq: eq3 }) => eq3(users3.id, payload.uid)
+        });
+        if (!userData) {
+          return c2.json({ error: "User not found in sandbox" }, 500);
         }
+        return c2.json({ claims: payload, gameId: payload.sub, user: toUserInfo(userData) });
       } catch {
         return c2.json({ error: "Invalid sandbox token" }, 400);
       }
@@ -169782,13 +169699,13 @@ var init_server = __esm(async () => {
   init_port();
   init_package();
   init_config();
-  init_app();
   init_database2();
   init_options();
   await __promiseAll([
     init_api3(),
     init_context(),
-    init_providers()
+    init_providers(),
+    init_app()
   ]);
   version5 = package_default.version;
 });

package/dist/server.js

@@ -1127,7 +1127,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@playcademy/sandbox",
-    version: "0.9.0",
+    version: "0.10.0",
     description: "Local development server for Playcademy game development",
     type: "module",
     exports: {
@@ -96839,10 +96839,12 @@ function compileResponseProcessing(item, itemIdentifier, maxScore, declarations)
   if (!onlyAttributes(processing, []) || !onlyWhitespaceText(processing.children) || processingRules.length === 0 || processingRules.some((rule) => rule.localName !== "qti-response-condition")) {
     return fallback(itemIdentifier, maxScore, "unsupported-response-processing");
   }
-  if (processingRules.length === 1 && declarations.size === 1 && scoreDefaultIsZero(item) && feedbackOutcomeIsDeclared(item)) {
+  if (processingRules.length === 1 && declarations.size === 1 && feedbackOutcomeIsDeclared(item)) {
     const declaration = [...declarations.values()][0];
     const rule = binaryBranchRule(processingRules[0], declaration);
-    if (rule) {
+    const scoreIsDeclared = childElements(item, "qti-outcome-declaration").some((outcome) => outcome.attributes.identifier?.trim().toUpperCase() === "SCORE");
+    const completeIdentifierMatch = rule?.comparison.kind === "match" && rule.baseType === "identifier" && (rule.cardinality === "single" || rule.cardinality === "multiple");
+    if (rule && (scoreDefaultIsZero(item) || !scoreIsDeclared && completeIdentifierMatch)) {
       return platformResult(itemIdentifier, maxScore, [rule]);
     }
   }
@@ -99790,7 +99792,7 @@ function scoringSchema(identity) {
   if (identity.kind === "assessment") {
     return exports_external.object({
       items: assessmentScoringArtifactItemsSchema2,
-      reviewBank: exports_external.undefined(),
+      reviewBank: exports_external.undefined().optional(),
       diagnostic: diagnosticContextSchema.optional()
     }).strict();
   }
@@ -99804,7 +99806,7 @@ function scoringSchema(identity) {
         standards: exports_external.array(exports_external.unknown())
       }).strict())
     }).strict(),
-    diagnostic: exports_external.undefined()
+    diagnostic: exports_external.undefined().optional()
   }).strict().refine((payload) => payload.reviewBank.items.length === payload.items.length && payload.reviewBank.items.every((item, index2) => item.itemIdentifier === payload.items[index2]?.itemIdentifier));
 }
 function assertPlayableAssessmentArtifact(payload, identity) {
@@ -100010,7 +100012,7 @@ var init_assessment_artifact_runtime_util = __esm(() => {
   }).strict();
   diagnosticContextSchema = exports_external.object({
     routingRevision: trimmedNonEmptyString3,
-    routingManifest: exports_external.record(exports_external.unknown())
+    routingManifest: exports_external.record(exports_external.string(), exports_external.unknown())
   }).strict();
 });
 
@@ -110748,10 +110750,10 @@ function createSandboxAuthProvider() {
     },
     async mintGameToken(gameId, userId) {
       const header = btoa(JSON.stringify({ alg: "none", typ: "sandbox" }));
-      const exp = Date.now() + 15 * 60 * 1000;
+      const exp = Math.floor(Date.now() / 1000) + 15 * 60;
       const payload = btoa(JSON.stringify({ sub: gameId, uid: userId, exp }));
       const token = `${header}.${payload}.sandbox`;
-      return { token, exp };
+      return { token, exp: exp * 1000 };
     },
     async validateGameToken(token) {
       try {
@@ -110759,18 +110761,9 @@ function createSandboxAuthProvider() {
         if (parts2.length !== 3) {
           return null;
         }
-        if (parts2[2] === "sandbox") {
-          const payload2 = JSON.parse(atob(parts2[1]));
-          if (payload2.sub && payload2.uid) {
-            if (payload2.exp && payload2.exp < Date.now()) {
-              log.debug("[SandboxAuthProvider] Token expired");
-              return null;
-            }
-            return payload2;
-          }
-        }
         const payload = JSON.parse(atob(parts2[1]));
-        if (payload.sub && payload.uid) {
+        const nowSeconds = Date.now() / 1000;
+        if (typeof payload?.sub === "string" && payload.sub.length > 0 && typeof payload.uid === "string" && payload.uid.length > 0 && typeof payload.exp === "number" && Number.isFinite(payload.exp) && payload.exp > nowSeconds && payload.exp < nowSeconds + MAX_TOKEN_LIFETIME_SECONDS) {
           return payload;
         }
         return null;
@@ -110868,7 +110861,7 @@ function createSandboxAuthProvider() {
     }
   };
 }
-var sandboxApiKeys, sandboxAssessmentPreparationReceipts, ASSESSMENT_PREPARATION_RECEIPT_LIFETIME_MS, sandboxAssessmentTokens;
+var sandboxApiKeys, sandboxAssessmentPreparationReceipts, ASSESSMENT_PREPARATION_RECEIPT_LIFETIME_MS, MAX_TOKEN_LIFETIME_SECONDS, sandboxAssessmentTokens;
 var init_auth_provider = __esm(async () => {
   init_src6();
   init_constants();
@@ -110876,6 +110869,7 @@ var init_auth_provider = __esm(async () => {
   sandboxApiKeys = new Map;
   sandboxAssessmentPreparationReceipts = new Map;
   ASSESSMENT_PREPARATION_RECEIPT_LIFETIME_MS = 5 * 60 * 1000;
+  MAX_TOKEN_LIFETIME_SECONDS = 30 * 24 * 60 * 60;
   sandboxAssessmentTokens = new TimebackCache({
     defaultTTL: 2 * 60 * 60 * 1000,
     maxSize: 1000
@@ -112903,56 +112897,13 @@ function extractBearerToken(authHeader) {
   }
   return authHeader.substring(7);
 }
-function parseSandboxToken(token) {
-  try {
-    const parts2 = token.split(".");
-    if (parts2.length !== 3 || parts2[2] !== "sandbox") {
-      return null;
-    }
-    const header = JSON.parse(atob(parts2[0]));
-    if (header.typ !== "sandbox") {
-      return null;
-    }
-    const payload = JSON.parse(atob(parts2[1]));
-    if (!payload.uid || !payload.sub) {
-      return null;
-    }
-    return {
-      userId: payload.uid,
-      gameSlug: payload.sub
-    };
-  } catch {
-    return null;
-  }
-}
-function parseJwtClaims(token) {
-  try {
-    const parts2 = token.split(".");
-    if (parts2.length === 3 && parts2[1]) {
-      const payload = JSON.parse(atob(parts2[1]));
-      if (payload.uid) {
-        return {
-          userId: payload.uid,
-          gameId: payload.sub
-        };
-      }
-    }
-  } catch {}
-  return null;
-}
-function resolveAuth(token) {
+async function resolveAuth(token) {
   const demoUser = DEMO_TOKENS[token];
   if (demoUser) {
     return { userId: demoUser.id };
   }
-  if (token.includes(".")) {
-    const sandboxClaims = parseSandboxToken(token);
-    if (sandboxClaims) {
-      return sandboxClaims;
-    }
-    return parseJwtClaims(token);
-  }
-  return null;
+  const payload = await sandboxAuth.validateGameToken(token);
+  return payload ? { userId: payload.uid, gameId: payload.sub } : null;
 }
 async function fetchUserFromDatabase(db2, userId) {
   try {
@@ -112965,18 +112916,6 @@ async function fetchUserFromDatabase(db2, userId) {
     throw error88;
   }
 }
-async function resolveGameIdFromSlug(db2, slug2) {
-  try {
-    const game2 = await db2.query.games.findFirst({
-      where: eq(games.slug, slug2),
-      columns: { id: true }
-    });
-    return game2?.id || null;
-  } catch (error88) {
-    console.error("[Auth] Error looking up game by slug:", error88);
-    return null;
-  }
-}
 function isPublicRoute(path, exceptions) {
   return exceptions.some((exception) => {
     if (path === exception) {
@@ -112994,35 +112933,23 @@ async function authenticateRequest(c) {
   const apiKey = c.req.header("x-api-key");
   const token = bearerToken || apiKey;
   if (!token) {
-    return {
-      success: false,
-      error: "No authorization token provided",
-      shouldReturn404: true
-    };
+    return { success: false, error: "No authorization token provided" };
   }
-  const resolved = resolveAuth(token);
+  const resolved = await resolveAuth(token);
   if (!resolved) {
-    return {
-      success: false,
-      error: "Invalid or expired token",
-      shouldReturn404: true
-    };
+    return { success: false, error: "Invalid or expired token" };
   }
   const claims = resolved;
   const db2 = c.get("db");
   if (!db2) {
     console.error("[Auth] Database not available in context");
-    return { success: false, error: "Internal server error", shouldReturn404: false };
+    return { success: false, error: "Internal server error" };
   }
   const user = await fetchUserFromDatabase(db2, claims.userId);
   if (!user) {
-    return { success: false, error: "User not found or token invalid", shouldReturn404: true };
+    return { success: false, error: "User not found or token invalid" };
   }
-  let gameId = claims.gameId;
-  if (!gameId && claims.gameSlug) {
-    gameId = await resolveGameIdFromSlug(db2, claims.gameSlug) ?? undefined;
-  }
-  return { success: true, user, gameId };
+  return { success: true, user, gameId: claims.gameId };
 }
 function setupAuth(options = {}) {
   const { exceptions = [] } = options;
@@ -113042,20 +112969,19 @@ function setupAuth(options = {}) {
       }
       c.set("authError", result.error);
       await next();
-      if (result.shouldReturn404 && c.res.status === 404) {
-        return;
-      }
-      return c.json({ error: "Unauthorized", message: result.error }, 401);
     } catch (error88) {
       console.error("[Auth] Unexpected error in authentication middleware:", error88);
       return c.json({ error: "Internal Server Error", message: "Authentication failed" }, 500);
     }
   };
 }
-var init_auth2 = __esm(() => {
+var sandboxAuth;
+var init_auth2 = __esm(async () => {
   init_drizzle_orm();
   init_tables_index();
   init_constants();
+  await init_providers();
+  sandboxAuth = createSandboxAuthProvider();
 });
 
 // src/server/app.ts
@@ -113074,11 +113000,11 @@ function createApp(db2, options) {
   }));
   return app;
 }
-var init_app = __esm(() => {
+var init_app = __esm(async () => {
   init_dist7();
   init_cors();
   init_logger2();
-  init_auth2();
+  await init_auth2();
 });
 
 // ../../node_modules/.bun/@electric-sql+pglite@0.3.16/node_modules/@electric-sql/pglite/dist/chunk-QY3QWFKW.js
@@ -169207,18 +169133,33 @@ var init_sessions = __esm(async () => {
 });
 
 // src/routes/platform/games/verify.ts
-var gameVerifyRouter;
+function toUserInfo(userData) {
+  return {
+    sub: userData.id,
+    email: userData.email || "",
+    name: userData.name || userData.username || "",
+    email_verified: true,
+    given_name: undefined,
+    family_name: undefined,
+    timeback_id: userData.timebackId || undefined
+  };
+}
+var gameVerifyRouter, sandboxAuth2;
 var init_verify = __esm(async () => {
   init_dist7();
   init_errors2();
   init_constants();
   init_error_handler();
-  await init_api3();
+  await __promiseAll([
+    init_api3(),
+    init_providers()
+  ]);
   gameVerifyRouter = new Hono2;
+  sandboxAuth2 = createSandboxAuthProvider();
   gameVerifyRouter.post("/verify", async (c2) => {
     const body2 = await c2.req.json().catch(() => ({}));
     const token = body2?.token;
-    if (!token) {
+    if (typeof token !== "string" || !token) {
       return c2.json({ error: "Missing token" }, 400);
     }
     const demoUser = DEMO_TOKENS[token];
@@ -169231,49 +169172,25 @@ var init_verify = __esm(async () => {
         return c2.json({ error: "User not found in sandbox" }, 500);
       }
       return c2.json({
-        claims: { sandbox: true },
+        claims: { sandbox: true, exp: Math.floor(Date.now() / 1000) + 15 * 60 },
         gameId: MOCK_GAME_ID,
-        user: {
-          sub: userData.id,
-          email: userData.email || "",
-          name: userData.name || userData.username || "",
-          email_verified: true,
-          given_name: undefined,
-          family_name: undefined,
-          timeback_id: userData.timebackId || undefined
-        }
+        user: toUserInfo(userData)
       });
     }
     if (token.endsWith(".sandbox")) {
+      const payload = await sandboxAuth2.validateGameToken(token);
+      if (!payload) {
+        return c2.json({ error: "Invalid or expired sandbox token" }, 400);
+      }
       try {
-        const parts2 = token.split(".");
-        if (parts2.length === 3) {
-          const payload = JSON.parse(atob(parts2[1]));
-          const userId = payload.uid;
-          const gameIdOrSlug = payload.sub;
-          const db2 = c2.get("db");
-          const userData = await db2.query.users.findFirst({
-            where: (users3, { eq: eq3 }) => eq3(users3.id, userId)
-          });
-          if (!userData) {
-            return c2.json({ error: "User not found in sandbox" }, 500);
-          }
-          return c2.json({
-            claims: payload,
-            gameId: gameIdOrSlug,
-            user: {
-              sub: userData.id,
-              email: userData.email || "",
-              name: userData.name || userData.username || "",
-              email_verified: true,
-              given_name: undefined,
-              family_name: undefined,
-              timeback_id: userData.timebackId || undefined
-            }
-          });
-        } else {
-          throw new Error("Malformed sandbox token: expected 3 parts");
+        const db2 = c2.get("db");
+        const userData = await db2.query.users.findFirst({
+          where: (users3, { eq: eq3 }) => eq3(users3.id, payload.uid)
+        });
+        if (!userData) {
+          return c2.json({ error: "User not found in sandbox" }, 500);
         }
+        return c2.json({ claims: payload, gameId: payload.sub, user: toUserInfo(userData) });
       } catch {
         return c2.json({ error: "Invalid sandbox token" }, 400);
       }
@@ -169781,13 +169698,13 @@ var init_server = __esm(async () => {
   init_port();
   init_package();
   init_config();
-  init_app();
   init_database2();
   init_options();
   await __promiseAll([
     init_api3(),
     init_context(),
-    init_providers()
+    init_providers(),
+    init_app()
   ]);
   version5 = package_default.version;
 });

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@playcademy/sandbox",
-    "version": "0.9.0",
+    "version": "0.10.0",
     "description": "Local development server for Playcademy game development",
     "type": "module",
     "exports": {