@playcademy/vite-plugin 0.2.24 → 0.2.25-beta.1

package/dist/index.js

@@ -23954,6 +23954,20 @@ import fs7 from "node:fs";
 import path4 from "node:path";
 import { CONFIG_FILE_NAMES } from "playcademy/constants";
 
+// src/server/modes.ts
+function isShellMode(mode) {
+  return mode !== "standalone";
+}
+function getNextMode(mode) {
+  if (mode === "platform") {
+    return "demo";
+  }
+  if (mode === "demo") {
+    return "standalone";
+  }
+  return "platform";
+}
+
 // src/server/recreate-sandbox.ts
 var import_picocolors7 = __toESM(require_picocolors(), 1);
 
@@ -24306,6 +24320,7 @@ var init_achievements = __esm(() => {
   ];
 });
 var AUTH_PROVIDER_IDS;
+var DEMO_DISPLAY_NAME_PLACEHOLDER = "Demo Player";
 var init_auth = __esm(() => {
   AUTH_PROVIDER_IDS = {
     TIMEBACK: "timeback",
@@ -24391,7 +24406,8 @@ var init_overworld = __esm(() => {
     ERROR: 4000
   };
   CORE_GAME_UUIDS = {
-    PLAYGROUND: "00000000-0000-0000-0000-000000000001"
+    PLAYGROUND: "00000000-0000-0000-0000-000000000001",
+    DEMO: "00000000-0000-0000-0000-000000000002"
   };
 });
 var PLATFORM_TIMEZONE = "America/New_York";
@@ -24471,13 +24487,15 @@ var DEMO_USER_IDS;
 var DEMO_USERS;
 var DEMO_USER;
 var init_demo_users = __esm(() => {
+  init_src();
   now = new Date;
   DEMO_USER_IDS = {
     player: "00000000-0000-0000-0000-000000000001",
     developer: "00000000-0000-0000-0000-000000000002",
     admin: "00000000-0000-0000-0000-000000000003",
     pendingDeveloper: "00000000-0000-0000-0000-000000000004",
-    unverifiedPlayer: "00000000-0000-0000-0000-000000000005"
+    unverifiedPlayer: "00000000-0000-0000-0000-000000000005",
+    anonymousPlayer: "00000000-0000-0000-0000-000000000006"
   };
   DEMO_USERS = {
     admin: {
@@ -24539,6 +24557,19 @@ var init_demo_users = __esm(() => {
       developerStatus: "none",
       createdAt: now,
       updatedAt: now
+    },
+    anonymousPlayer: {
+      id: DEMO_USER_IDS.anonymousPlayer,
+      name: DEMO_DISPLAY_NAME_PLACEHOLDER,
+      username: "anonymous_demo_player",
+      email: "player@anon.demo.playcademy.gg",
+      emailVerified: false,
+      image: null,
+      isAnonymous: true,
+      role: "player",
+      developerStatus: "none",
+      createdAt: now,
+      updatedAt: now
     }
   };
   DEMO_USER = DEMO_USERS.player;
@@ -24553,6 +24584,7 @@ var init_demo_tokens = __esm(() => {
     "sandbox-demo-token": DEMO_USERS.player,
     "sandbox-admin-token": DEMO_USERS.admin,
     "sandbox-player-token": DEMO_USERS.player,
+    "sandbox-anonymous-token": DEMO_USERS.anonymousPlayer,
     "sandbox-developer-token": DEMO_USERS.developer,
     "sandbox-pending-dev-token": DEMO_USERS.pendingDeveloper,
     "sandbox-unverified-token": DEMO_USERS.unverifiedPlayer,
@@ -24561,6 +24593,7 @@ var init_demo_tokens = __esm(() => {
   };
   SANDBOX_TOKENS = {
     player: "sandbox-player-token",
+    anonymous: "sandbox-anonymous-token",
     developer: "sandbox-developer-token",
     admin: "sandbox-admin-token",
     pendingDeveloper: "sandbox-pending-dev-token",
@@ -25336,7 +25369,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@playcademy/sandbox",
-    version: "0.3.16",
+    version: "0.3.17-beta.14",
     description: "Local development server for Playcademy game development",
     type: "module",
     exports: {
@@ -35621,6 +35654,7 @@ var init_table6 = __esm(() => {
     name: text("name").notNull(),
     username: text("username").unique(),
     email: text("email").notNull().unique(),
+    isAnonymous: boolean("is_anonymous").notNull().default(false),
     timebackId: text("timeback_id").unique(),
     emailVerified: boolean("email_verified").notNull().default(false),
     image: text("image"),
@@ -56465,7 +56499,7 @@ class LeaderboardService {
   constructor(deps) {
     this.deps = deps;
   }
-  async submitScore(gameId, userId, input, sessionId) {
+  async submitScore(gameId, userId, input, isAnonymousUser, sessionId) {
     const db2 = this.deps.db;
     const game = await db2.select({ displayName: games.displayName }).from(games).where(eq(games.id, gameId)).limit(1).then((rows) => rows[0]);
     if (!game) {
@@ -56476,7 +56510,7 @@ class LeaderboardService {
     const prevBestScore = prevBestScoreRows[0]?.score ?? null;
     let prevRank = null;
     if (prevBestScore !== null && prevBestScore !== undefined) {
-      const higherCountRows = await db2.select({ count: sql`count(distinct ${gameScores.userId})` }).from(gameScores).where(and(eq(gameScores.gameId, gameId), sql`${gameScores.userId} != ${userId}`, sql`${gameScores.score} > ${prevBestScore}`));
+      const higherCountRows = await db2.select({ count: sql`count(distinct ${gameScores.userId})` }).from(gameScores).innerJoin(users, eq(gameScores.userId, users.id)).where(and(eq(gameScores.gameId, gameId), eq(users.isAnonymous, isAnonymousUser), sql`${gameScores.userId} != ${userId}`, sql`${gameScores.score} > ${prevBestScore}`));
       const higherCount = higherCountRows[0]?.count ?? 0;
       prevRank = Number(higherCount) + 1;
     }
@@ -56493,13 +56527,13 @@ class LeaderboardService {
     }
     const bestScoreRows = await db2.select({ score: sql`MAX(${gameScores.score})` }).from(gameScores).where(and(eq(gameScores.gameId, gameId), eq(gameScores.userId, userId)));
     const bestScore = bestScoreRows[0]?.score ?? input.score;
-    const higherCountNowRows = await db2.select({ count: sql`count(distinct ${gameScores.userId})` }).from(gameScores).where(and(eq(gameScores.gameId, gameId), sql`${gameScores.userId} != ${userId}`, sql`${gameScores.score} > ${bestScore}`));
+    const higherCountNowRows = await db2.select({ count: sql`count(distinct ${gameScores.userId})` }).from(gameScores).innerJoin(users, eq(gameScores.userId, users.id)).where(and(eq(gameScores.gameId, gameId), eq(users.isAnonymous, isAnonymousUser), sql`${gameScores.userId} != ${userId}`, sql`${gameScores.score} > ${bestScore}`));
     const higherCountNow = higherCountNowRows[0]?.count ?? 0;
     const newRank = Number(higherCountNow) + 1;
-    const totalPlayersRows = await db2.select({ count: sql`count(distinct ${gameScores.userId})` }).from(gameScores).where(eq(gameScores.gameId, gameId));
+    const totalPlayersRows = await db2.select({ count: sql`count(distinct ${gameScores.userId})` }).from(gameScores).innerJoin(users, eq(gameScores.userId, users.id)).where(and(eq(gameScores.gameId, gameId), eq(users.isAnonymous, isAnonymousUser)));
     const totalPlayers = Number(totalPlayersRows[0]?.count ?? 1);
     const { shouldNotify, crossedIntoTop3, movedUpWithinTop3, isFirstScore, isPersonalBest } = shouldNotifyRankChange(prevRank, newRank, prevBestScore, input.score);
-    if (shouldNotify) {
+    if (shouldNotify && !isAnonymousUser) {
       await this.publishScoreNotifications({
         userId,
         gameId,
@@ -56519,6 +56553,7 @@ class LeaderboardService {
     logger21.info("Score submitted", {
       gameId,
       userId,
+      isAnonymousUser,
       score: input.score,
       newRank,
       isFirstScore,
@@ -56595,7 +56630,7 @@ class LeaderboardService {
       logger21.warn("Failed to publish notification", { error });
     }
   }
-  async getLeaderboard(gameId, query) {
+  async getLeaderboard(gameId, query, isAnonymousUser) {
     const { timeframe, limit, offset } = query;
     const db2 = this.deps.db;
     const dateFilter = getTimeframeFilter(timeframe);
@@ -56607,31 +56642,35 @@ class LeaderboardService {
       score: gameScores.score,
       achievedAt: gameScores.achievedAt,
       metadata: gameScores.metadata
-    }).from(gameScores).innerJoin(users, eq(gameScores.userId, users.id)).where(and(eq(gameScores.gameId, gameId), dateFilter)).orderBy(desc(gameScores.score)).limit(limit).offset(offset);
+    }).from(gameScores).innerJoin(users, eq(gameScores.userId, users.id)).where(and(eq(gameScores.gameId, gameId), dateFilter, eq(users.isAnonymous, isAnonymousUser))).orderBy(desc(gameScores.score)).limit(limit).offset(offset);
     return scores.map((score, index2) => ({
       rank: offset + index2 + 1,
       userId: score.userId,
-      username: score.username || score.name?.split(" ")[0] || "Unknown User",
+      username: score.name || score.username || "Unknown User",
       userImage: score.userImage,
       score: score.score,
       achievedAt: score.achievedAt,
       metadata: score.metadata
     }));
   }
-  async getGlobalLeaderboard(gameId, query) {
+  async getGlobalLeaderboard(gameId, query, isAnonymousUser) {
     if (!gameId) {
       return [];
     }
     const { timeframe, limit, offset } = query;
     const db2 = this.deps.db;
     const dateFilter = getTimeframeFilter(timeframe);
-    const conditions2 = [dateFilter, eq(gameScores.gameId, gameId)];
+    const conditions2 = [
+      dateFilter,
+      eq(gameScores.gameId, gameId),
+      eq(users.isAnonymous, isAnonymousUser)
+    ];
     const bestScoresSubquery = db2.select({
       userId: gameScores.userId,
       gameId: gameScores.gameId,
       score: sql`MAX(${gameScores.score})`.as("max_score"),
       achievedAt: sql`MAX(${gameScores.achievedAt})`.as("max_achieved_at")
-    }).from(gameScores).where(and(...conditions2)).groupBy(gameScores.userId, gameScores.gameId).as("best_scores");
+    }).from(gameScores).innerJoin(users, eq(gameScores.userId, users.id)).where(and(...conditions2)).groupBy(gameScores.userId, gameScores.gameId).as("best_scores");
     const scores = await db2.select({
       userId: users.id,
       username: users.username,
@@ -56647,7 +56686,7 @@ class LeaderboardService {
     return scores.map((score, index2) => ({
       rank: offset + index2 + 1,
       userId: score.userId,
-      username: score.username || score.name?.split(" ")[0] || "Unknown User",
+      username: score.name || score.username || "Unknown User",
       userImage: score.userImage,
       score: score.score,
       achievedAt: score.achievedAt,
@@ -56657,15 +56696,15 @@ class LeaderboardService {
       gameSlug: score.gameSlug || ""
     }));
   }
-  async getUserRank(gameId, userId) {
+  async getUserRank(gameId, userId, isAnonymousUser) {
     const db2 = this.deps.db;
-    const userScoreResult = await db2.select({ score: gameScores.score }).from(gameScores).where(and(eq(gameScores.gameId, gameId), eq(gameScores.userId, userId))).orderBy(desc(gameScores.score)).limit(1);
+    const userScoreResult = await db2.select({ score: gameScores.score }).from(gameScores).innerJoin(users, eq(gameScores.userId, users.id)).where(and(eq(gameScores.gameId, gameId), eq(gameScores.userId, userId), eq(users.isAnonymous, isAnonymousUser))).orderBy(desc(gameScores.score)).limit(1);
     if (!userScoreResult.length || !userScoreResult[0]) {
       return null;
     }
     const score = userScoreResult[0].score;
-    const countResult = await db2.select({ count: sql`count(distinct ${gameScores.userId})` }).from(gameScores).where(and(eq(gameScores.gameId, gameId), sql`${gameScores.score} > ${score}`));
-    const totalResult = await db2.select({ total: sql`count(distinct ${gameScores.userId})` }).from(gameScores).where(eq(gameScores.gameId, gameId));
+    const countResult = await db2.select({ count: sql`count(distinct ${gameScores.userId})` }).from(gameScores).innerJoin(users, eq(gameScores.userId, users.id)).where(and(eq(gameScores.gameId, gameId), eq(users.isAnonymous, isAnonymousUser), sql`${gameScores.score} > ${score}`));
+    const totalResult = await db2.select({ total: sql`count(distinct ${gameScores.userId})` }).from(gameScores).innerJoin(users, eq(gameScores.userId, users.id)).where(and(eq(gameScores.gameId, gameId), eq(users.isAnonymous, isAnonymousUser)));
     const count = Number(countResult[0]?.count ?? 0);
     const total = Number(totalResult[0]?.total ?? 0);
     const rank = count + 1;
@@ -58100,6 +58139,35 @@ class UserService {
       timeback: timeback2
     };
   }
+  async getDemoProfile(userId) {
+    const userData = await this.deps.db.query.users.findFirst({
+      where: eq(users.id, userId),
+      columns: { name: true }
+    });
+    if (!userData) {
+      logger32.error("Demo user not found", { userId });
+      throw new NotFoundError("User", userId);
+    }
+    return {
+      displayName: userData.name,
+      isDefault: userData.name === DEMO_DISPLAY_NAME_PLACEHOLDER
+    };
+  }
+  async updateDemoProfile(userId, displayName) {
+    const [updatedUser] = await this.deps.db.update(users).set({
+      name: displayName,
+      updatedAt: new Date
+    }).where(eq(users.id, userId)).returning({ name: users.name });
+    if (!updatedUser) {
+      logger32.error("Demo user not found for profile update", { userId });
+      throw new NotFoundError("User", userId);
+    }
+    logger32.debug("Updated demo profile", { userId, displayName });
+    return {
+      displayName: updatedUser.name,
+      isDefault: updatedUser.name === DEMO_DISPLAY_NAME_PLACEHOLDER
+    };
+  }
   async fetchTimebackData(timebackId, gameId) {
     const [{ role, organizations: allOrganizations }, allEnrollments] = await Promise.all([
       this.fetchStudentProfile(timebackId),
@@ -58192,6 +58260,7 @@ class UserService {
 var logger32;
 var init_user_service = __esm(() => {
   init_drizzle_orm();
+  init_src();
   init_tables_index();
   init_src2();
   init_errors();
@@ -119909,7 +119978,11 @@ var init_drizzle_zod = __esm(() => {
     nullable: (column6) => !column6.notNull
   };
 });
+function normalizeDisplayName(value) {
+  return value.trim().replace(/\s+/g, " ");
+}
 var InsertUserSchema;
+var DemoProfileSchema;
 var init_schemas = __esm(() => {
   init_drizzle_zod();
   init_esm();
@@ -119918,6 +119991,9 @@ var init_schemas = __esm(() => {
     email: exports_external.string().email(),
     name: exports_external.string().optional()
   });
+  DemoProfileSchema = exports_external.object({
+    displayName: exports_external.string().transform(normalizeDisplayName).refine((value) => value.length >= 2, "Display name must be at least 2 characters").refine((value) => value.length <= 12, "Display name must be 12 characters or fewer")
+  });
 });
 var InsertGameSchema;
 var UpdateGameSchema;
@@ -120572,6 +120648,28 @@ function requireAuth(handler) {
     return handler(ctx);
   };
 }
+function requireNonAnonymous(handler) {
+  return async (ctx) => {
+    if (!isAuthenticated(ctx)) {
+      throw ApiError.unauthorized("Valid session or bearer token required");
+    }
+    if (ctx.user.isAnonymous) {
+      throw ApiError.forbidden("This operation is not available for demo/anonymous users");
+    }
+    return handler(ctx);
+  };
+}
+function requireAnonymous(handler) {
+  return async (ctx) => {
+    if (!isAuthenticated(ctx)) {
+      throw ApiError.unauthorized("Valid session or bearer token required");
+    }
+    if (!ctx.user.isAnonymous) {
+      throw ApiError.forbidden("This operation is only available for demo/anonymous users");
+    }
+    return handler(ctx);
+  };
+}
 function requireRole(roles2, handler) {
   return async (ctx) => {
     if (!isAuthenticated(ctx)) {
@@ -120806,16 +120904,16 @@ var init_achievement_controller = __esm(() => {
   init_errors();
   init_utils11();
   logger37 = log.scope("AchievementController");
-  listCurrent = requireAuth(async (ctx) => {
+  listCurrent = requireNonAnonymous(async (ctx) => {
     logger37.debug("Listing current achievements", { userId: ctx.user.id, gameId: ctx.gameId });
     return ctx.services.achievement.listCurrent(ctx.user, ctx.gameId);
   });
-  listHistory = requireAuth(async (ctx) => {
+  listHistory = requireNonAnonymous(async (ctx) => {
     const limit = Math.max(1, Math.min(100, Number(ctx.url.searchParams.get("limit")) || 20));
     logger37.debug("Listing achievement history", { userId: ctx.user.id, limit });
     return ctx.services.achievement.listHistory(ctx.user, limit);
   });
-  postProgress = requireAuth(async (ctx) => {
+  postProgress = requireNonAnonymous(async (ctx) => {
     let body2;
     try {
       const json4 = await ctx.request.json();
@@ -120976,11 +121074,11 @@ var init_character_controller = __esm(() => {
   init_errors();
   init_utils11();
   logger40 = log.scope("CharacterController");
-  get = requireAuth(async (ctx) => {
+  get = requireNonAnonymous(async (ctx) => {
     logger40.debug("Getting character", { userId: ctx.user.id });
     return ctx.services.character.getByUser(ctx.user);
   });
-  getByUserId = requireAuth(async (ctx) => {
+  getByUserId = requireNonAnonymous(async (ctx) => {
     const userId = ctx.params.userId;
     if (!userId) {
       throw ApiError.badRequest("User ID is required in the URL path");
@@ -120988,7 +121086,7 @@ var init_character_controller = __esm(() => {
     logger40.debug("Getting character by user ID", { requestedUserId: userId });
     return ctx.services.character.getByUserId(userId);
   });
-  create = requireAuth(async (ctx) => {
+  create = requireNonAnonymous(async (ctx) => {
     let body2;
     try {
       const json4 = await ctx.request.json();
@@ -121008,7 +121106,7 @@ var init_character_controller = __esm(() => {
     });
     return ctx.services.character.create(body2, ctx.user);
   });
-  update2 = requireAuth(async (ctx) => {
+  update2 = requireNonAnonymous(async (ctx) => {
     let body2;
     try {
       const json4 = await ctx.request.json();
@@ -121029,7 +121127,7 @@ var init_character_controller = __esm(() => {
     });
     return ctx.services.character.update(body2, ctx.user);
   });
-  equipAccessory = requireAuth(async (ctx) => {
+  equipAccessory = requireNonAnonymous(async (ctx) => {
     let body2;
     try {
       const json4 = await ctx.request.json();
@@ -121049,7 +121147,7 @@ var init_character_controller = __esm(() => {
     });
     return ctx.services.character.equipAccessory(body2.slot, body2.accessoryComponentId, ctx.user);
   });
-  removeAccessory = requireAuth(async (ctx) => {
+  removeAccessory = requireNonAnonymous(async (ctx) => {
     const slot = ctx.params.slot;
     if (!slot) {
       throw ApiError.badRequest("Slot is required in the URL path");
@@ -121083,11 +121181,11 @@ var init_currency_controller = __esm(() => {
   init_errors();
   init_utils11();
   logger41 = log.scope("CurrencyController");
-  list = requireAuth(async (ctx) => {
+  list = requireNonAnonymous(async (ctx) => {
     logger41.debug("Listing currencies", { userId: ctx.user.id });
     return ctx.services.currency.list();
   });
-  getById = requireAuth(async (ctx) => {
+  getById = requireNonAnonymous(async (ctx) => {
     const currencyId = ctx.params.currencyId;
     if (!currencyId) {
       throw ApiError.badRequest("Missing currency ID");
@@ -121261,11 +121359,11 @@ var init_developer_controller = __esm(() => {
   init_src2();
   init_utils11();
   logger44 = log.scope("DeveloperController");
-  apply = requireAuth(async (ctx) => {
+  apply = requireNonAnonymous(async (ctx) => {
     logger44.debug("Applying for developer status", { userId: ctx.user.id });
     await ctx.services.developer.apply(ctx.user);
   });
-  getStatus = requireAuth(async (ctx) => {
+  getStatus = requireNonAnonymous(async (ctx) => {
     logger44.debug("Getting developer status", { userId: ctx.user.id });
     const status = await ctx.services.developer.getStatus(ctx.user.id);
     return { status };
@@ -121377,19 +121475,19 @@ var init_game_controller = __esm(() => {
   init_errors();
   init_utils11();
   logger46 = log.scope("GameController");
-  list3 = requireAuth(async (ctx) => {
+  list3 = requireNonAnonymous(async (ctx) => {
     logger46.debug("Listing games", { userId: ctx.user.id });
     return ctx.services.game.list(ctx.user);
   });
-  listManageable = requireAuth(async (ctx) => {
+  listManageable = requireNonAnonymous(async (ctx) => {
     logger46.debug("Listing manageable games", { userId: ctx.user.id });
     return ctx.services.game.listManageable(ctx.user);
   });
-  getSubjects = requireAuth(async (ctx) => {
+  getSubjects = requireNonAnonymous(async (ctx) => {
     logger46.debug("Getting game subjects", { userId: ctx.user.id });
     return ctx.services.game.getSubjects();
   });
-  getById2 = requireAuth(async (ctx) => {
+  getById2 = requireNonAnonymous(async (ctx) => {
     const gameId = ctx.params.gameId;
     if (!gameId) {
       throw ApiError.badRequest("Missing game ID");
@@ -121400,7 +121498,7 @@ var init_game_controller = __esm(() => {
     logger46.debug("Getting game by ID", { userId: ctx.user.id, gameId, launchId: ctx.launchId });
     return ctx.services.game.getById(gameId, ctx.user);
   });
-  getBySlug = requireAuth(async (ctx) => {
+  getBySlug = requireNonAnonymous(async (ctx) => {
     const slug2 = ctx.params.slug;
     if (!slug2) {
       throw ApiError.badRequest("Missing game slug");
@@ -121408,7 +121506,7 @@ var init_game_controller = __esm(() => {
     logger46.debug("Getting game by slug", { userId: ctx.user.id, slug: slug2, launchId: ctx.launchId });
     return ctx.services.game.getBySlug(slug2, ctx.user);
   });
-  getManifest = requireAuth(async (ctx) => {
+  getManifest = requireNonAnonymous(async (ctx) => {
     const gameId = ctx.params.gameId;
     if (!gameId) {
       throw ApiError.badRequest("Missing game ID");
@@ -121423,7 +121521,7 @@ var init_game_controller = __esm(() => {
     });
     return ctx.services.game.getManifest(gameId, ctx.user);
   });
-  upsertBySlug = requireAuth(async (ctx) => {
+  upsertBySlug = requireNonAnonymous(async (ctx) => {
     const slug2 = ctx.params.slug;
     if (!slug2) {
       throw ApiError.badRequest("Missing game slug");
@@ -121443,7 +121541,7 @@ var init_game_controller = __esm(() => {
     logger46.debug("Upserting game", { userId: ctx.user.id, slug: slug2, displayName: body2.displayName });
     return ctx.services.game.upsertBySlug(slug2, body2, ctx.user);
   });
-  remove3 = requireAuth(async (ctx) => {
+  remove3 = requireNonAnonymous(async (ctx) => {
     const gameId = ctx.params.gameId;
     if (!gameId) {
       throw ApiError.badRequest("Missing game ID");
@@ -121477,11 +121575,11 @@ var init_inventory_controller = __esm(() => {
   init_errors();
   init_utils11();
   logger47 = log.scope("InventoryController");
-  list4 = requireAuth(async (ctx) => {
+  list4 = requireNonAnonymous(async (ctx) => {
     logger47.debug("Listing inventory", { userId: ctx.user.id });
     return ctx.services.inventory.list(ctx.user);
   });
-  addItem = requireAuth(async (ctx) => {
+  addItem = requireNonAnonymous(async (ctx) => {
     let body2;
     try {
       const json4 = await ctx.request.json();
@@ -121501,7 +121599,7 @@ var init_inventory_controller = __esm(() => {
     });
     return ctx.services.inventory.addItem(body2.itemId, body2.qty, ctx.user);
   });
-  removeItem = requireAuth(async (ctx) => {
+  removeItem = requireNonAnonymous(async (ctx) => {
     let body2;
     try {
       const json4 = await ctx.request.json();
@@ -121547,12 +121645,12 @@ var init_item_controller = __esm(() => {
   init_errors();
   init_utils11();
   logger48 = log.scope("ItemController");
-  list5 = requireAuth(async (ctx) => {
+  list5 = requireNonAnonymous(async (ctx) => {
     const gameId = ctx.url.searchParams.get("gameId") || undefined;
     logger48.debug("Listing items", { userId: ctx.user.id, gameId });
     return ctx.services.item.list(gameId);
   });
-  getById3 = requireAuth(async (ctx) => {
+  getById3 = requireNonAnonymous(async (ctx) => {
     const itemId = ctx.params.itemId;
     if (!itemId) {
       throw ApiError.badRequest("Missing item ID");
@@ -121563,7 +121661,7 @@ var init_item_controller = __esm(() => {
     logger48.debug("Getting item", { userId: ctx.user.id, itemId });
     return ctx.services.item.getById(itemId);
   });
-  resolve2 = requireAuth(async (ctx) => {
+  resolve2 = requireNonAnonymous(async (ctx) => {
     const slug2 = ctx.url.searchParams.get("slug");
     const gameId = ctx.url.searchParams.get("gameId") || undefined;
     if (!slug2) {
@@ -121638,7 +121736,7 @@ var init_item_controller = __esm(() => {
     logger48.debug("Deleting item", { userId: ctx.user.id, itemId });
     await ctx.services.item.delete(itemId);
   });
-  listByGame = requireAuth(async (ctx) => {
+  listByGame = requireNonAnonymous(async (ctx) => {
     const gameId = ctx.params.gameId;
     if (!gameId) {
       throw ApiError.badRequest("Missing game ID");
@@ -121649,7 +121747,7 @@ var init_item_controller = __esm(() => {
     logger48.debug("Listing game items", { userId: ctx.user.id, gameId });
     return ctx.services.item.listByGame(gameId);
   });
-  createForGame = requireAuth(async (ctx) => {
+  createForGame = requireNonAnonymous(async (ctx) => {
     const gameId = ctx.params.gameId;
     if (!gameId) {
       throw ApiError.badRequest("Missing game ID");
@@ -121677,7 +121775,7 @@ var init_item_controller = __esm(() => {
     });
     return ctx.services.item.createForGame(gameId, body2, ctx.user);
   });
-  updateForGame = requireAuth(async (ctx) => {
+  updateForGame = requireNonAnonymous(async (ctx) => {
     const gameId = ctx.params.gameId;
     const itemId = ctx.params.itemId;
     if (!gameId || !itemId) {
@@ -121714,7 +121812,7 @@ var init_item_controller = __esm(() => {
     });
     return ctx.services.item.updateForGame(gameId, itemId, body2, ctx.user);
   });
-  deleteForGame = requireAuth(async (ctx) => {
+  deleteForGame = requireNonAnonymous(async (ctx) => {
     const gameId = ctx.params.gameId;
     const itemId = ctx.params.itemId;
     if (!gameId || !itemId) {
@@ -121889,7 +121987,7 @@ var init_leaderboard_controller = __esm(() => {
       gameId,
       score: body2.score
     });
-    return ctx.services.leaderboard.submitScore(gameId, ctx.user.id, { score: body2.score, metadata: body2.metadata }, ctx.params.sessionId);
+    return ctx.services.leaderboard.submitScore(gameId, ctx.user.id, { score: body2.score, metadata: body2.metadata }, ctx.user.isAnonymous, ctx.params.sessionId);
   });
   getGlobalLeaderboard = requireAuth(async (ctx) => {
     const url = ctx.url;
@@ -121917,7 +122015,7 @@ var init_leaderboard_controller = __esm(() => {
       gameId,
       ...query
     });
-    return ctx.services.leaderboard.getGlobalLeaderboard(gameId, query);
+    return ctx.services.leaderboard.getGlobalLeaderboard(gameId, query, ctx.user.isAnonymous);
   });
   getLeaderboard = requireAuth(async (ctx) => {
     const gameId = ctx.params.gameId;
@@ -121945,9 +122043,9 @@ var init_leaderboard_controller = __esm(() => {
       gameId,
       ...query
     });
-    return ctx.services.leaderboard.getLeaderboard(gameId, query);
+    return ctx.services.leaderboard.getLeaderboard(gameId, query, ctx.user.isAnonymous);
   });
-  getUserRank = requireAuth(async (ctx) => {
+  getUserRank = requireNonAnonymous(async (ctx) => {
     const { gameId, userId } = ctx.params;
     if (!gameId || !userId) {
       throw ApiError.badRequest("Game ID and User ID are required");
@@ -121957,9 +122055,9 @@ var init_leaderboard_controller = __esm(() => {
       gameId,
       targetUserId: userId
     });
-    return ctx.services.leaderboard.getUserRank(gameId, userId);
+    return ctx.services.leaderboard.getUserRank(gameId, userId, ctx.user.isAnonymous);
   });
-  getUserAllScores = requireAuth(async (ctx) => {
+  getUserAllScores = requireNonAnonymous(async (ctx) => {
     const userId = ctx.params.userId;
     if (!userId) {
       throw ApiError.badRequest("User ID is required");
@@ -121975,7 +122073,7 @@ var init_leaderboard_controller = __esm(() => {
     });
     return ctx.services.leaderboard.getUserAllScores(userId, { limit, gameId });
   });
-  getUserScores = requireAuth(async (ctx) => {
+  getUserScores = requireNonAnonymous(async (ctx) => {
     const { gameId, userId } = ctx.params;
     if (!gameId || !userId) {
       throw ApiError.badRequest("Game ID and User ID are required");
@@ -122024,11 +122122,11 @@ var init_level_controller = __esm(() => {
   init_errors();
   init_utils11();
   logger51 = log.scope("LevelController");
-  getByUser = requireAuth(async (ctx) => {
+  getByUser = requireNonAnonymous(async (ctx) => {
     logger51.debug("Getting user level", { userId: ctx.user.id });
     return ctx.services.level.getByUser(ctx.user);
   });
-  getProgress = requireAuth(async (ctx) => {
+  getProgress = requireNonAnonymous(async (ctx) => {
     logger51.debug("Getting level progress", { userId: ctx.user.id });
     return ctx.services.level.getProgress(ctx.user);
   });
@@ -122083,7 +122181,7 @@ var init_lti_controller = __esm(() => {
   init_src2();
   init_utils11();
   logger53 = log.scope("LtiController");
-  getStatus3 = requireAuth(async (ctx) => {
+  getStatus3 = requireNonAnonymous(async (ctx) => {
     logger53.debug("Getting status", { userId: ctx.user.id });
     return ctx.services.lti.getStatus(ctx.user);
   });
@@ -122106,7 +122204,7 @@ var init_map_controller = __esm(() => {
   init_errors();
   init_utils11();
   logger54 = log.scope("MapController");
-  getByIdentifier = requireAuth(async (ctx) => {
+  getByIdentifier = requireNonAnonymous(async (ctx) => {
     const identifier = ctx.params.identifier;
     if (!identifier) {
       throw ApiError.badRequest("Missing map identifier");
@@ -122114,7 +122212,7 @@ var init_map_controller = __esm(() => {
     logger54.debug("Getting map", { userId: ctx.user.id, identifier });
     return ctx.services.map.getByIdentifier(identifier);
   });
-  getElements = requireAuth(async (ctx) => {
+  getElements = requireNonAnonymous(async (ctx) => {
     const mapId = ctx.url.searchParams.get("mapId");
     if (!mapId) {
       throw ApiError.badRequest("Missing required query parameter: mapId");
@@ -122125,7 +122223,7 @@ var init_map_controller = __esm(() => {
     logger54.debug("Getting map elements", { userId: ctx.user.id, mapId });
     return ctx.services.map.getElements(mapId);
   });
-  getObjects = requireAuth(async (ctx) => {
+  getObjects = requireNonAnonymous(async (ctx) => {
     const mapId = ctx.params.mapId;
     if (!mapId) {
       throw ApiError.badRequest("Missing mapId");
@@ -122136,7 +122234,7 @@ var init_map_controller = __esm(() => {
     logger54.debug("Getting map objects", { userId: ctx.user.id, mapId });
     return ctx.services.map.getObjects(mapId, ctx.user.id);
   });
-  createObject = requireAuth(async (ctx) => {
+  createObject = requireNonAnonymous(async (ctx) => {
     const mapId = ctx.params.mapId;
     if (!mapId) {
       throw ApiError.badRequest("Missing mapId");
@@ -122170,7 +122268,7 @@ var init_map_controller = __esm(() => {
     const { mapId: _mapId, ...data } = body2;
     return ctx.services.map.createObject(mapId, data, ctx.user);
   });
-  deleteObject = requireAuth(async (ctx) => {
+  deleteObject = requireNonAnonymous(async (ctx) => {
     const { mapId, objectId } = ctx.params;
     if (!mapId) {
       throw ApiError.badRequest("Missing mapId");
@@ -122209,7 +122307,7 @@ var init_notification_controller = __esm(() => {
   init_errors();
   init_utils11();
   logger55 = log.scope("NotificationController");
-  list6 = requireAuth(async (ctx) => {
+  list6 = requireNonAnonymous(async (ctx) => {
     const query = {
       status: ctx.url.searchParams.get("status") || undefined,
       type: ctx.url.searchParams.get("type") || undefined,
@@ -122225,7 +122323,7 @@ var init_notification_controller = __esm(() => {
     logger55.debug("Listing notifications", { userId: ctx.user.id, ...result.data });
     return ctx.services.notification.list(ctx.user, result.data);
   });
-  updateStatus = requireAuth(async (ctx) => {
+  updateStatus = requireNonAnonymous(async (ctx) => {
     const notificationId = ctx.params.notificationId;
     if (!notificationId) {
       throw ApiError.badRequest("Notification ID required");
@@ -122249,7 +122347,7 @@ var init_notification_controller = __esm(() => {
     });
     return ctx.services.notification.updateStatus(notificationId, body2.status, body2.method);
   });
-  getStats2 = requireAuth(async (ctx) => {
+  getStats2 = requireNonAnonymous(async (ctx) => {
     const startDate = ctx.url.searchParams.get("startDate");
     const endDate = ctx.url.searchParams.get("endDate");
     logger55.debug("Getting stats", { userId: ctx.user.id, startDate, endDate });
@@ -122258,7 +122356,7 @@ var init_notification_controller = __esm(() => {
       endDate: endDate ? new Date(endDate) : undefined
     });
   });
-  create4 = requireAuth(async (ctx) => {
+  create4 = requireNonAnonymous(async (ctx) => {
     let body2;
     try {
       const json4 = await ctx.request.json();
@@ -122288,7 +122386,7 @@ var init_notification_controller = __esm(() => {
       metadata: body2.metadata
     });
   });
-  deliver = requireAuth(async (ctx) => {
+  deliver = requireNonAnonymous(async (ctx) => {
     logger55.debug("Delivering notifications", { userId: ctx.user.id });
     try {
       await ctx.services.notification.deliverPending(ctx.user.id);
@@ -122313,7 +122411,7 @@ var init_realtime_controller = __esm(() => {
   init_src2();
   init_utils11();
   logger56 = log.scope("RealtimeController");
-  generateToken2 = requireAuth(async (ctx) => {
+  generateToken2 = requireNonAnonymous(async (ctx) => {
     const gameIdOrSlug = ctx.params.gameId;
     logger56.debug("Generating token", {
       userId: ctx.user.id,
@@ -122482,7 +122580,7 @@ var init_shop_controller = __esm(() => {
   init_src2();
   init_utils11();
   logger60 = log.scope("ShopController");
-  getShopView = requireAuth(async (ctx) => {
+  getShopView = requireNonAnonymous(async (ctx) => {
     logger60.debug("Getting shop view", { userId: ctx.user.id });
     return ctx.services.shop.getShopView(ctx.user);
   });
@@ -122586,7 +122684,7 @@ var init_shop_listing_controller = __esm(() => {
     logger61.debug("Deleting listing", { userId: ctx.user.id, listingId });
     await ctx.services.shopListing.delete(listingId);
   });
-  listByGame2 = requireAuth(async (ctx) => {
+  listByGame2 = requireNonAnonymous(async (ctx) => {
     const gameId = ctx.params.gameId;
     if (!gameId) {
       throw ApiError.badRequest("Missing game ID");
@@ -122597,7 +122695,7 @@ var init_shop_listing_controller = __esm(() => {
     logger61.debug("Listing game listings", { userId: ctx.user.id, gameId });
     return ctx.services.shopListing.listByGame(gameId, ctx.user);
   });
-  getByGameItem = requireAuth(async (ctx) => {
+  getByGameItem = requireNonAnonymous(async (ctx) => {
     const gameId = ctx.params.gameId;
     const itemId = ctx.params.itemId;
     if (!gameId || !itemId) {
@@ -122612,7 +122710,7 @@ var init_shop_listing_controller = __esm(() => {
     logger61.debug("Getting game item listing", { userId: ctx.user.id, gameId, itemId });
     return ctx.services.shopListing.getByGameItem(gameId, itemId, ctx.user);
   });
-  createForGameItem = requireAuth(async (ctx) => {
+  createForGameItem = requireNonAnonymous(async (ctx) => {
     const gameId = ctx.params.gameId;
     const itemId = ctx.params.itemId;
     if (!gameId || !itemId) {
@@ -122645,7 +122743,7 @@ var init_shop_listing_controller = __esm(() => {
     });
     return ctx.services.shopListing.createForGameItem(gameId, itemId, body2, ctx.user);
   });
-  updateForGameItem = requireAuth(async (ctx) => {
+  updateForGameItem = requireNonAnonymous(async (ctx) => {
     const gameId = ctx.params.gameId;
     const itemId = ctx.params.itemId;
     if (!gameId || !itemId) {
@@ -122679,7 +122777,7 @@ var init_shop_listing_controller = __esm(() => {
     });
     return ctx.services.shopListing.updateForGameItem(gameId, itemId, body2, ctx.user);
   });
-  deleteForGameItem = requireAuth(async (ctx) => {
+  deleteForGameItem = requireNonAnonymous(async (ctx) => {
     const gameId = ctx.params.gameId;
     const itemId = ctx.params.itemId;
     if (!gameId || !itemId) {
@@ -122764,17 +122862,17 @@ var init_timeback_controller = __esm(() => {
   init_errors();
   init_utils11();
   logger63 = log.scope("TimebackController");
-  getTodayXp = requireAuth(async (ctx) => {
+  getTodayXp = requireNonAnonymous(async (ctx) => {
     const date4 = ctx.url.searchParams.get("date") || undefined;
     const tz = ctx.url.searchParams.get("tz") || undefined;
     logger63.debug("Getting today XP", { userId: ctx.user.id, date: date4, tz });
     return ctx.services.timeback.getTodayXp(ctx.user.id, date4, tz);
   });
-  getTotalXp = requireAuth(async (ctx) => {
+  getTotalXp = requireNonAnonymous(async (ctx) => {
     logger63.debug("Getting total XP", { userId: ctx.user.id });
     return ctx.services.timeback.getTotalXp(ctx.user.id);
   });
-  updateTodayXp = requireAuth(async (ctx) => {
+  updateTodayXp = requireNonAnonymous(async (ctx) => {
     let body2;
     try {
       const json4 = await ctx.request.json();
@@ -122790,13 +122888,13 @@ var init_timeback_controller = __esm(() => {
     logger63.debug("Updating today XP", { userId: ctx.user.id, xp: body2.xp });
     return ctx.services.timeback.updateTodayXp(ctx.user.id, body2);
   });
-  getXpHistory = requireAuth(async (ctx) => {
+  getXpHistory = requireNonAnonymous(async (ctx) => {
     const startDate = ctx.url.searchParams.get("startDate") || undefined;
     const endDate = ctx.url.searchParams.get("endDate") || undefined;
     logger63.debug("Getting XP history", { userId: ctx.user.id, startDate, endDate });
     return ctx.services.timeback.getXpHistory(ctx.user.id, startDate, endDate);
   });
-  populateStudent = requireAuth(async (ctx) => {
+  populateStudent = requireNonAnonymous(async (ctx) => {
     let providedNames;
     try {
       const json4 = await ctx.request.json();
@@ -122814,11 +122912,11 @@ var init_timeback_controller = __esm(() => {
     });
     return ctx.services.timeback.populateStudent(ctx.user, providedNames);
   });
-  getUser = requireAuth(async (ctx) => {
+  getUser = requireNonAnonymous(async (ctx) => {
     logger63.debug("Getting user", { userId: ctx.user.id, gameId: ctx.gameId });
     return ctx.services.timeback.getUserData(ctx.user.id, ctx.gameId);
   });
-  getUserById = requireAuth(async (ctx) => {
+  getUserById = requireNonAnonymous(async (ctx) => {
     const timebackId = ctx.params.timebackId;
     if (!timebackId) {
       throw ApiError.badRequest("Missing timebackId parameter");
@@ -123216,17 +123314,34 @@ var init_upload_controller = __esm(() => {
 });
 var logger65;
 var getMe;
+var getDemoProfile;
+var updateDemoProfile;
 var users2;
 var init_user_controller = __esm(() => {
+  init_schemas_index();
   init_src2();
   init_utils11();
   logger65 = log.scope("UserController");
-  getMe = requireAuth(async (ctx) => {
+  getMe = requireNonAnonymous(async (ctx) => {
     logger65.debug("Getting current user", { userId: ctx.user.id, gameId: ctx.gameId });
     return ctx.services.user.getMe(ctx.user, ctx.gameId);
   });
+  getDemoProfile = requireAnonymous(async (ctx) => {
+    logger65.debug("Getting demo profile", { userId: ctx.user.id });
+    return ctx.services.user.getDemoProfile(ctx.user.id);
+  });
+  updateDemoProfile = requireAnonymous(async (ctx) => {
+    const body2 = await parseRequestBody(ctx.request, DemoProfileSchema);
+    logger65.debug("Updating demo profile", {
+      userId: ctx.user.id,
+      displayName: body2.displayName
+    });
+    return ctx.services.user.updateDemoProfile(ctx.user.id, body2.displayName);
+  });
   users2 = {
-    getMe
+    getMe,
+    getDemoProfile,
+    updateDemoProfile
   };
 });
 var logger66;
@@ -123422,6 +123537,8 @@ var init_users = __esm(() => {
     }
     return handle2(users2.getMe)(c2);
   });
+  usersRouter.get("/demo-profile", handle2(users2.getDemoProfile));
+  usersRouter.patch("/demo-profile", handle2(users2.updateDemoProfile));
   usersRouter.get("/level", handle2(levels.getByUser));
   usersRouter.get("/level/progress", handle2(levels.getProgress));
   usersRouter.get("/:userId/scores", handle2(leaderboard.getUserAllScores));
@@ -123753,6 +123870,8 @@ var init_scores = __esm(() => {
   init_api();
   gameScoresRouter = new Hono2;
   gameScoresRouter.post("/:gameId/scores", handle2(leaderboard.submitScore, { status: 201 }));
+  gameScoresRouter.get("/:gameId/leaderboard", handle2(leaderboard.getLeaderboard));
+  gameScoresRouter.get("/:gameId/users/:userId/rank", handle2(leaderboard.getUserRank));
   gameScoresRouter.get("/:gameId/users/:userId/scores", handle2(leaderboard.getUserScores));
 });
 var gameSecretsRouter;
@@ -124450,6 +124569,7 @@ async function startServer(port, project, options = {}) {
   const mainServer = serve({ fetch: app.fetch, port });
   return {
     main: mainServer,
+    db: db2,
     gameId,
     timebackMode: getTimebackDisplayMode(),
     setRole: (role) => {
@@ -125201,6 +125321,7 @@ var init_achievements4 = __esm7(() => {
   ];
 });
 var AUTH_PROVIDER_IDS2;
+var DEMO_DISPLAY_NAME_PLACEHOLDER2 = "Demo Player";
 var init_auth3 = __esm7(() => {
   AUTH_PROVIDER_IDS2 = {
     TIMEBACK: "timeback",
@@ -125285,7 +125406,8 @@ var init_overworld2 = __esm7(() => {
     ERROR: 4000
   };
   CORE_GAME_UUIDS2 = {
-    PLAYGROUND: "00000000-0000-0000-0000-000000000001"
+    PLAYGROUND: "00000000-0000-0000-0000-000000000001",
+    DEMO: "00000000-0000-0000-0000-000000000002"
   };
 });
 var TIMEBACK_ROUTES2;
@@ -125359,13 +125481,15 @@ var DEMO_USER_IDS2;
 var DEMO_USERS2;
 var DEMO_USER2;
 var init_demo_users2 = __esm7(() => {
+  init_src5();
   now2 = new Date;
   DEMO_USER_IDS2 = {
     player: "00000000-0000-0000-0000-000000000001",
     developer: "00000000-0000-0000-0000-000000000002",
     admin: "00000000-0000-0000-0000-000000000003",
     pendingDeveloper: "00000000-0000-0000-0000-000000000004",
-    unverifiedPlayer: "00000000-0000-0000-0000-000000000005"
+    unverifiedPlayer: "00000000-0000-0000-0000-000000000005",
+    anonymousPlayer: "00000000-0000-0000-0000-000000000006"
   };
   DEMO_USERS2 = {
     admin: {
@@ -125427,6 +125551,19 @@ var init_demo_users2 = __esm7(() => {
       developerStatus: "none",
       createdAt: now2,
       updatedAt: now2
+    },
+    anonymousPlayer: {
+      id: DEMO_USER_IDS2.anonymousPlayer,
+      name: DEMO_DISPLAY_NAME_PLACEHOLDER2,
+      username: "anonymous_demo_player",
+      email: "player@anon.demo.playcademy.gg",
+      emailVerified: false,
+      image: null,
+      isAnonymous: true,
+      role: "player",
+      developerStatus: "none",
+      createdAt: now2,
+      updatedAt: now2
     }
   };
   DEMO_USER2 = DEMO_USERS2.player;
@@ -125439,6 +125576,7 @@ var init_demo_tokens2 = __esm7(() => {
     "sandbox-demo-token": DEMO_USERS2.player,
     "sandbox-admin-token": DEMO_USERS2.admin,
     "sandbox-player-token": DEMO_USERS2.player,
+    "sandbox-anonymous-token": DEMO_USERS2.anonymousPlayer,
     "sandbox-developer-token": DEMO_USERS2.developer,
     "sandbox-pending-dev-token": DEMO_USERS2.pendingDeveloper,
     "sandbox-unverified-token": DEMO_USERS2.unverifiedPlayer,
@@ -125447,6 +125585,7 @@ var init_demo_tokens2 = __esm7(() => {
   };
   SANDBOX_TOKENS2 = {
     player: "sandbox-player-token",
+    anonymous: "sandbox-anonymous-token",
     developer: "sandbox-developer-token",
     admin: "sandbox-admin-token",
     pendingDeveloper: "sandbox-pending-dev-token",
@@ -125574,19 +125713,20 @@ var init_constants11 = __esm7(() => {
 init_constants11();
 
 // src/lib/sandbox/token.ts
-var ROLE_TO_USER_ID = {
+var IDENTITY_TO_USER_ID = {
   player: DEMO_USER_IDS2.player,
   developer: DEMO_USER_IDS2.developer,
-  admin: DEMO_USER_IDS2.admin
+  admin: DEMO_USER_IDS2.admin,
+  anonymous: DEMO_USER_IDS2.anonymousPlayer
 };
 function encode(obj) {
   return btoa(JSON.stringify(obj));
 }
-function createSandboxGameToken(gameSlug, role = "player") {
+function createSandboxGameToken(gameSlug, identity = "player") {
   const header = { alg: "none", typ: "sandbox" };
   const payload = {
     sub: gameSlug,
-    uid: ROLE_TO_USER_ID[role],
+    uid: IDENTITY_TO_USER_ID[identity],
     iat: Math.floor(Date.now() / 1000)
   };
   return `${encode(header)}.${encode(payload)}.sandbox`;
@@ -125658,6 +125798,7 @@ var shell_default = `<!doctype html>
                 gameId: '{{GAME_ID}}',
                 gameToken: '{{GAME_TOKEN}}',
                 gameUrl: '{{GAME_URL}}' || undefined,
+                mode: '{{MODE}}',
                 timebackJson: '{{TIMEBACK_DATA}}',
                 hideBadge: '{{HIDE_BADGE}}' === 'true',
             }
@@ -125680,10 +125821,13 @@ var shell_default = `<!doctype html>
             const log = (...args) => window.PLAYCADEMY_DEBUG && console.log('[DevShell]', ...args)
 
             async function checkSandbox() {
+                // Use the public /health endpoint as a pure liveness probe.
+                // We used to hit /api/users/me here, but that's \`requireNonAnonymous\`
+                // and 403s in demo mode (anonymous cohort) even when the sandbox
+                // is perfectly healthy. /health is auth-bypassed and is all we
+                // actually need for a reachability check.
                 try {
-                    const res = await fetch(\`\${CONFIG.sandboxUrl}/api/users/me\`, {
-                        headers: { Authorization: \`Bearer \${CONFIG.gameToken}\` },
-                    })
+                    const res = await fetch(\`\${CONFIG.sandboxUrl}/health\`)
                     if (!res.ok) throw new Error('Sandbox unavailable')
                     badge.classList.remove('offline')
                     log('Sandbox connected')
@@ -125702,6 +125846,7 @@ var shell_default = `<!doctype html>
                     gameUrl: CONFIG.gameUrl,
                     gameId: CONFIG.gameId,
                     token: CONFIG.gameToken,
+                    mode: CONFIG.mode,
                     timeback: timebackData,
                 }
 
@@ -125756,15 +125901,17 @@ var shell_default = `<!doctype html>
 `;
 
 // src/server/middleware.ts
-function generateLoaderHTML(sandboxUrl, gameSlug, options, gameUrl) {
+function generateLoaderHTML(sandboxUrl, gameSlug, gameId, options, gameUrl) {
   const timebackJson = generateTimebackJson(options.timeback);
-  const platformRole = getPlatformRoleOverride() ?? "player";
-  const gameToken = createSandboxGameToken(gameSlug, platformRole);
-  return shell_default.replace(/{{SANDBOX_URL}}/g, sandboxUrl).replace(/{{GAME_ID}}/g, gameSlug).replace(/{{GAME_TOKEN}}/g, gameToken).replace(/{{GAME_URL}}/g, gameUrl || "").replace(/{{TIMEBACK_DATA}}/g, timebackJson).replace(/{{HIDE_BADGE}}/g, String(options.hideBadge));
+  const mode = getCurrentMode();
+  const tokenIdentity = mode === "demo" ? "anonymous" : getPlatformRoleOverride() ?? "player";
+  const gameToken = createSandboxGameToken(gameSlug, tokenIdentity);
+  const handshakeGameId = gameId || gameSlug;
+  return shell_default.replace(/{{SANDBOX_URL}}/g, sandboxUrl).replace(/{{GAME_ID}}/g, handshakeGameId).replace(/{{GAME_TOKEN}}/g, gameToken).replace(/{{GAME_URL}}/g, gameUrl || "").replace(/{{MODE}}/g, isShellMode(mode) ? mode : "platform").replace(/{{TIMEBACK_DATA}}/g, timebackJson).replace(/{{HIDE_BADGE}}/g, String(options.hideBadge));
 }
 function devServerMiddleware(server, sandbox, gameUrl, options) {
   server.middlewares.use("/", (req, res, next) => {
-    if (getCurrentMode() !== "platform") {
+    if (!isShellMode(getCurrentMode())) {
       next();
       return;
     }
@@ -125774,7 +125921,7 @@ function devServerMiddleware(server, sandbox, gameUrl, options) {
         next();
       } else {
         res.setHeader("Content-Type", "text/html");
-        res.end(generateLoaderHTML(sandbox.baseUrl, sandbox.project?.slug ?? "", options, gameUrl));
+        res.end(generateLoaderHTML(sandbox.baseUrl, sandbox.project?.slug ?? "", sandbox.gameId ?? "", options, gameUrl));
       }
       return;
     }
@@ -125792,9 +125939,9 @@ async function recreateSandbox(options) {
     viteConfig.logger.error(`${prefix2} ${import_picocolors7.red("Cannot recreate sandbox database: no Vite server reference")}`);
     return { success: false, error: "No Vite server reference" };
   }
-  if (currentMode !== "platform") {
-    viteConfig.logger.warn(`${prefix2} ${import_picocolors7.yellow("can only recreate sandbox database in platform mode (m + enter)")}`);
-    return { success: false, error: "Not in platform mode" };
+  if (!isShellMode(currentMode)) {
+    viteConfig.logger.warn(`${prefix2} ${import_picocolors7.yellow("can only recreate sandbox database in platform or demo mode")}`);
+    return { success: false, error: "Not in a shell-backed mode" };
   }
   viteConfig.logger.info(`${prefix2} recreating database...`);
   if (serverState.sandbox) {
@@ -125843,7 +125990,7 @@ function createChangeHandler(server, viteConfig, platformModeOptions, watchedFil
     if (!isWatchedFile) {
       return;
     }
-    if (getCurrentMode() !== "platform") {
+    if (!isShellMode(getCurrentMode())) {
       return;
     }
     if (debounceTimer) {
@@ -125949,7 +126096,7 @@ var import_picocolors12 = __toESM(require_picocolors(), 1);
 // package.json
 var package_default2 = {
   name: "@playcademy/vite-plugin",
-  version: "0.2.24",
+  version: "0.2.25-beta.1",
   type: "module",
   exports: {
     ".": {
@@ -126191,7 +126338,7 @@ async function configureStandaloneMode(server, viteConfig, options) {
 // src/server/hotkeys/toggle-mode.ts
 async function toggleMode(options) {
   const currentMode = getCurrentMode();
-  const newMode = currentMode === "platform" ? "standalone" : "platform";
+  const newMode = getNextMode(currentMode);
   const viteServer = getViteServerRef();
   const prefix2 = createLogPrefix("playcademy");
   if (!viteServer) {
@@ -126214,7 +126361,7 @@ async function toggleMode(options) {
 function toggleModeHotkey(options) {
   return {
     key: "m",
-    description: `${import_picocolors12.cyan(import_picocolors12.bold("[playcademy]"))} toggle platform/standalone mode`,
+    description: `${import_picocolors12.cyan(import_picocolors12.bold("[playcademy]"))} cycle platform/demo/standalone mode`,
     action: () => toggleMode(options)
   };
 }

package/dist/lib/sandbox/token.d.ts

@@ -12,4 +12,14 @@
  *   - signature: "sandbox" (not cryptographically verified)
  */
 import type { PlatformRoleOverride } from '../../types';
-export declare function createSandboxGameToken(gameSlug: string, role?: PlatformRoleOverride): string;
+/**
+ * Identities the dev shell can mint sandbox tokens for.
+ *
+ * Platform roles (player/developer/admin) are driven by the role-cycle
+ * hotkey and only make sense in `platform` mode. `anonymous` resolves to
+ * the seeded `DEMO_USERS.anonymousPlayer` and is what we mint in `demo`
+ * mode so demo-only APIs (`/users/demo-profile`, anonymous leaderboard
+ * reads, etc.) can authenticate against an actual anonymous cohort.
+ */
+export type SandboxTokenIdentity = PlatformRoleOverride | 'anonymous';
+export declare function createSandboxGameToken(gameSlug: string, identity?: SandboxTokenIdentity): string;

package/dist/server/hotkeys/toggle-mode.d.ts

@@ -1,5 +1,5 @@
 /**
- * 'm' hotkey - toggle platform/standalone mode
+ * 'm' hotkey - cycle platform/demo/standalone mode
  */
 import type { HotkeyOptions } from '../../types';
 export declare function toggleModeHotkey(options: HotkeyOptions): {

package/dist/server/modes.d.ts

@@ -0,0 +1,4 @@
+import type { PlaycademyMode } from '../types/options';
+export type ShellMode = Exclude<PlaycademyMode, 'standalone'>;
+export declare function isShellMode(mode: PlaycademyMode): mode is ShellMode;
+export declare function getNextMode(mode: PlaycademyMode): PlaycademyMode;

package/dist/server/platform-mode.d.ts

@@ -1,10 +1,10 @@
 /**
- * Platform mode server configuration
- * Full Playcademy platform: sandbox + backend + shell wrapper
+ * Shell-backed mode server configuration
+ * Sandbox + backend + shell wrapper for platform and demo flows
  */
 import type { ResolvedConfig, ViteDevServer } from 'vite';
 import type { PlatformModeOptions } from '../types';
 /**
- * Configure server in platform mode (sandbox + backend + shell)
+ * Configure server in a shell-backed mode (sandbox + backend + shell)
  */
 export declare function configurePlatformMode(server: ViteDevServer, viteConfig: ResolvedConfig, options: PlatformModeOptions): Promise<void>;

package/dist/types/internal.d.ts

@@ -118,7 +118,7 @@ export interface CliDevServerOptions {
     gameId?: string;
 }
 /**
- * Options for platform mode (sandbox + backend + shell)
+ * Options for shell-backed modes (sandbox + backend + shell)
  */
 export interface PlatformModeOptions {
     startSandbox: boolean;
@@ -155,7 +155,7 @@ export interface HotkeyOptions {
 export interface BannerOptions {
     /** Plugin version */
     version: string;
-    /** Game/project name (platform mode only) */
+    /** Game/project name (shell-backed modes only) */
     gameName?: string;
     /** Sandbox server info */
     sandbox?: {
@@ -170,7 +170,7 @@ export interface BannerOptions {
         /** Vite port for proxied URL display */
         vitePort?: number;
     };
-    /** Timeback info (platform mode only) */
+    /** Timeback info (shell-backed modes only) */
     timeback?: {
         courseCount: number;
         enrolledCount: number;

package/dist/types/options.d.ts

@@ -6,11 +6,12 @@
  *
  * Controls how the Vite plugin operates during development:
  * - `'platform'`: Full Playcademy platform experience with sandbox server, backend bundling, and shell wrapper (default)
+ * - `'demo'`: Shell-backed development mode that initializes the SDK with `mode: 'demo'`
  * - `'standalone'`: Backend only, no sandbox or shell
  *
  * @default 'platform'
  */
-export type PlaycademyMode = 'platform' | 'standalone';
+export type PlaycademyMode = 'platform' | 'demo' | 'standalone';
 /**
  * Configuration options for exporting/building Playcademy games
  *
@@ -254,7 +255,7 @@ export interface PlaycademyTimebackOptions {
  * Configuration options for the development shell wrapper
  *
  * The shell provides the platform UI during development, including the
- * Playcademy badge, game selection, and other platform features.
+ * Playcademy badge and iframe wrapper used by `platform` and `demo` modes.
  */
 export interface PlaycademyDisplayOptions {
     /**
@@ -318,9 +319,11 @@ export interface PlaycademyPluginOptions {
      * Plugin operation mode.
      *
      * - `'platform'`: Full development experience with sandbox server and shell (recommended)
+     * - `'demo'`: Sandbox + shell, but initializes the SDK with `mode: 'demo'`
      * - `'standalone'`: Backend bundling only, no platform features
      *
-     * Most games should use `'platform'` mode.
+     * Most games should use `'platform'` mode; use `'demo'` to exercise
+     * anonymous/demo-specific SDK flows during local development.
      *
      * @default 'platform'
      * @example

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@playcademy/vite-plugin",
-    "version": "0.2.24",
+    "version": "0.2.25-beta.1",
     "type": "module",
     "exports": {
         ".": {