@playcademy/vite-plugin 0.2.6 → 0.2.8

package/dist/index.js

@@ -41142,10 +41142,6 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 import { stdout } from "process";
 import crypto3 from "node:crypto";
-import { request } from "https";
-import { pipeline } from "stream";
-import { createPublicKey, createVerify, verify } from "crypto";
-import * as crypto4 from "node:crypto";
 import * as s3 from "fs";
 import * as o3 from "path";
 import fs22 from "node:fs";
@@ -41153,9 +41149,10 @@ import { dirname, isAbsolute, join as join3 } from "node:path";
 import process2 from "process";
 import os from "os";
 import tty from "tty";
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID } from "crypto";
 import fs3 from "node:fs";
 import fs4 from "node:fs";
+import * as crypto4 from "node:crypto";
 import { randomUUID as randomUUID3 } from "node:crypto";
 var __create2 = Object.create;
 var __getProtoOf2 = Object.getPrototypeOf;
@@ -42382,7 +42379,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@playcademy/sandbox",
-    version: "0.3.8",
+    version: "0.3.10",
     description: "Local development server for Playcademy game development",
     type: "module",
     exports: {
@@ -46989,7 +46986,7 @@ var realtimeConfigSchema;
 var apiConfigSchema;
 var init_schema = __esm(() => {
   init_esm();
-  stageSchema = exports_external.enum(["production", "staging", "local"]);
+  stageSchema = exports_external.enum(["production", "dev", "local"]);
   ltiConfigSchema = exports_external.object({
     audience: exports_external.string(),
     jwksUrl: exports_external.string().url(),
@@ -54625,7 +54622,7 @@ class DeployService {
     }
     return cf;
   }
-  async createAndPersistApiKey(user, slug2, game, keyName) {
+  async createApiKey(user, slug2, keyName) {
     const { id, key: apiKey } = await this.ctx.providers.auth.createApiKey({
       userId: user.id,
       name: keyName,
@@ -54634,16 +54631,6 @@ class DeployService {
         games: [`read:${slug2}`, `write:${slug2}`]
       }
     });
-    try {
-      const existingSecrets = await this.ctx.providers.secrets.readSecrets(game.id) || {};
-      await this.ctx.providers.secrets.writeSecrets(game.id, {
-        ...existingSecrets,
-        PLAYCADEMY_API_KEY: apiKey
-      });
-      logger8.debug("Persisted API key to secrets", { gameId: game.id });
-    } catch (error) {
-      logger8.warn("Failed to persist API key to secrets", { error });
-    }
     logger8.info("Created new game-scoped API key", {
       userId: user.id,
       slug: slug2,
@@ -54651,56 +54638,55 @@ class DeployService {
     });
     return apiKey;
   }
-  async retrieveApiKeyFromSecrets(gameId) {
-    try {
-      const secrets = await this.ctx.providers.secrets.readSecrets(gameId);
-      if (secrets?.PLAYCADEMY_API_KEY) {
-        logger8.debug("Retrieved API key from secrets");
-        return secrets.PLAYCADEMY_API_KEY;
-      }
-      return null;
-    } catch (error) {
-      logger8.warn("Failed to retrieve secrets", { error });
-      return null;
-    }
-  }
-  async regenerateAndPersistApiKey(user, slug2, game, existingKeyId, keyName) {
-    logger8.info("Regenerating API key (migration)", {
-      userId: user.id,
-      slug: slug2,
-      oldKeyId: existingKeyId
-    });
-    try {
-      await this.ctx.providers.auth.deleteApiKey(existingKeyId);
-      logger8.debug("Revoked old API key", { keyId: existingKeyId });
-    } catch (error) {
-      logger8.warn("Failed to revoke old API key", {
-        keyId: existingKeyId,
-        error
+  async regenerateApiKey(user, slug2, existingKeyId, keyName) {
+    if (existingKeyId) {
+      logger8.info("Regenerating API key", {
+        userId: user.id,
+        slug: slug2,
+        oldKeyId: existingKeyId
       });
+      try {
+        await this.ctx.providers.auth.deleteApiKey(existingKeyId);
+        logger8.debug("Revoked old API key", { keyId: existingKeyId });
+      } catch (error) {
+        logger8.warn("Failed to revoke old API key", {
+          keyId: existingKeyId,
+          error
+        });
+      }
     }
-    return this.createAndPersistApiKey(user, slug2, game, keyName);
+    return this.createApiKey(user, slug2, keyName);
   }
-  async resolveApiKeyForDeployment(user, slug2, game, headers) {
+  async ensureApiKeyOnWorker(user, slug2, deploymentId, headers) {
+    const cf = this.getCloudflare();
     const keyName = getGameWorkerApiKeyName(slug2);
     const existingKeys = await this.ctx.providers.auth.listApiKeys(headers);
     const existingKey = existingKeys.find((k) => k.name === keyName);
+    let apiKey;
     if (!existingKey) {
-      return this.createAndPersistApiKey(user, slug2, game, keyName);
-    }
-    const apiKey = await this.retrieveApiKeyFromSecrets(game.id);
-    if (apiKey) {
-      return apiKey;
+      apiKey = await this.createApiKey(user, slug2, keyName);
+    } else {
+      try {
+        const workerSecrets = await cf.listSecrets(deploymentId);
+        if (workerSecrets.includes("PLAYCADEMY_API_KEY")) {
+          logger8.debug("API key already on worker", { slug: slug2, deploymentId });
+          return;
+        }
+      } catch (error) {
+        logger8.warn("Could not check worker secrets, will regenerate key", { error });
+      }
+      apiKey = await this.regenerateApiKey(user, slug2, existingKey.id, keyName);
     }
-    return this.regenerateAndPersistApiKey(user, slug2, game, existingKey.id, keyName);
+    await cf.setSecrets(deploymentId, { PLAYCADEMY_API_KEY: apiKey });
+    logger8.info("Set API key on worker", { slug: slug2, deploymentId });
   }
-  async* deploy(slug2, request2, user, uploadDeps, extractZip) {
+  async* deploy(slug2, request, user, uploadDeps, extractZip) {
     const cf = this.getCloudflare();
     const db2 = this.ctx.db;
     const game = await this.ctx.services.game.validateDeveloperAccessBySlug(user, slug2);
-    const hasBackend = !!request2.code;
-    const hasFrontend = !!request2.uploadToken;
-    const hasMetadata = !!request2.metadata;
+    const hasBackend = !!request.code;
+    const hasFrontend = !!request.uploadToken;
+    const hasMetadata = !!request.metadata;
     logger8.debug("Deploying game", { slug: slug2, hasBackend, hasFrontend, hasMetadata });
     if (!hasBackend && !hasFrontend && !hasMetadata) {
       throw new ValidationError("Must provide at least one of: uploadToken (frontend), code (backend), or metadata");
@@ -54720,11 +54706,11 @@ class DeployService {
         throw new ValidationError("Upload dependencies not configured for frontend deployment");
       }
       yield { type: "status", data: { message: "Fetching temporary files" } };
-      const frontendZip = await uploadDeps.getObjectAsByteArray(request2.uploadToken);
+      const frontendZip = await uploadDeps.getObjectAsByteArray(request.uploadToken);
       if (!frontendZip || frontendZip.length === 0) {
         logger8.error("Frontend upload empty or not found", {
           slug: slug2,
-          uploadToken: request2.uploadToken
+          uploadToken: request.uploadToken
         });
         throw new ValidationError("Uploaded file is empty or not found");
       }
@@ -54734,23 +54720,21 @@ class DeployService {
       tempDir = path2.join(os2.tmpdir(), `playcademy-deploy-${game.id}-${Date.now()}`);
       frontendAssetsPath = path2.join(tempDir, "dist");
       await extractZip(frontendZip, frontendAssetsPath);
-      uploadDeps.deleteObject(request2.uploadToken).catch(() => {
-        logger8.warn("Failed to delete temp object", { key: request2.uploadToken });
+      uploadDeps.deleteObject(request.uploadToken).catch(() => {
+        logger8.warn("Failed to delete temp object", { key: request.uploadToken });
       });
     }
     const env = {
       GAME_ID: game.id,
-      PLAYCADEMY_BASE_URL: playcademyBaseUrl,
-      ...request2._gameApiKey && { PLAYCADEMY_API_KEY: request2._gameApiKey },
-      ...request2.secrets && { secrets: request2.secrets }
+      PLAYCADEMY_BASE_URL: playcademyBaseUrl
     };
     const deployMsg = hasBackend ? "Deploying backend code" : "Deploying to platform";
     yield { type: "status", data: { message: deployMsg } };
     const keepAssets = hasBackend && !hasFrontend;
-    const deploymentOptions = this.mapBindingsToOptions(request2.bindings, request2.schema);
+    const deploymentOptions = this.mapBindingsToOptions(request.bindings, request.schema);
     let result;
     try {
-      result = await cf.deploy(deploymentId, request2.code, env, {
+      result = await cf.deploy(deploymentId, request.code, env, {
         ...deploymentOptions,
         assetsPath: frontendAssetsPath,
         keepAssets
@@ -54763,8 +54747,12 @@ class DeployService {
         });
       }
     }
-    const codeHash = hasBackend ? await generateDeploymentHash(request2.code) : null;
+    const codeHash = hasBackend ? await generateDeploymentHash(request.code) : null;
     await this.saveDeployment(game.id, result.deploymentId, result.url, codeHash, result.resources);
+    if (hasBackend && request._headers) {
+      yield { type: "status", data: { message: "Configuring worker secrets" } };
+      await this.ensureApiKeyOnWorker(user, slug2, result.deploymentId, request._headers);
+    }
     yield { type: "status", data: { message: "Finalizing deployment" } };
     if (hasMetadata || hasFrontend) {
       const updates = { updatedAt: new Date };
@@ -54772,12 +54760,12 @@ class DeployService {
         updates.deploymentUrl = result.url;
       }
       if (hasMetadata) {
-        if (request2.metadata.displayName)
-          updates.displayName = request2.metadata.displayName;
-        if (request2.metadata.platform)
-          updates.platform = request2.metadata.platform;
-        if (request2.metadata.metadata)
-          updates.metadata = request2.metadata.metadata;
+        if (request.metadata.displayName)
+          updates.displayName = request.metadata.displayName;
+        if (request.metadata.platform)
+          updates.platform = request.metadata.platform;
+        if (request.metadata.metadata)
+          updates.metadata = request.metadata.metadata;
       }
       await db2.update(games).set(updates).where(eq(games.id, game.id));
     }
@@ -55245,12 +55233,6 @@ class GameService {
       } catch (keyError) {
         logger11.warn("Failed to cleanup API key", { gameId, error: keyError });
       }
-      try {
-        await this.ctx.providers.secrets.deleteSecrets(gameId);
-        logger11.info("Cleaned up secrets for deleted game", { gameId });
-      } catch (secretsError) {
-        logger11.warn("Failed to cleanup secrets", { gameId, error: secretsError });
-      }
     }
     return {
       slug: gameToDelete.slug,
@@ -56138,1087 +56120,67 @@ var init_level_service = __esm(() => {
   init_errors();
   logger15 = log.scope("LevelService");
 });
-var JwtBaseError;
-var FailedAssertionError;
-var JwtParseError;
-var ParameterValidationError;
-var JwtInvalidSignatureError;
-var JwtInvalidSignatureAlgorithmError;
-var JwtInvalidClaimError;
-var JwtInvalidIssuerError;
-var JwtInvalidAudienceError;
-var JwtInvalidScopeError;
-var JwtExpiredError;
-var JwtNotBeforeError;
-var CognitoJwtInvalidGroupError;
-var CognitoJwtInvalidTokenUseError;
-var CognitoJwtInvalidClientIdError;
-var JwksValidationError;
-var JwkValidationError;
-var JwtWithoutValidKidError;
-var KidNotFoundInJwksError;
-var WaitPeriodNotYetEndedJwkError;
-var JwksNotAvailableInCacheError;
-var JwkInvalidUseError;
-var JwkInvalidKtyError;
-var FetchError;
-var NonRetryableFetchError;
-var init_error = __esm(() => {
-  JwtBaseError = class JwtBaseError2 extends Error {
-  };
-  FailedAssertionError = class FailedAssertionError2 extends JwtBaseError {
-    constructor(msg, actual, expected) {
-      super(msg);
-      this.failedAssertion = {
-        actual,
-        expected
-      };
-    }
-  };
-  JwtParseError = class JwtParseError2 extends JwtBaseError {
-    constructor(msg, error) {
-      const message = error != null ? `${msg}: ${error}` : msg;
-      super(message);
-    }
-  };
-  ParameterValidationError = class ParameterValidationError2 extends JwtBaseError {
-  };
-  JwtInvalidSignatureError = class JwtInvalidSignatureError2 extends JwtBaseError {
-  };
-  JwtInvalidSignatureAlgorithmError = class JwtInvalidSignatureAlgorithmError2 extends FailedAssertionError {
-  };
-  JwtInvalidClaimError = class JwtInvalidClaimError2 extends FailedAssertionError {
-    withRawJwt({ header, payload }) {
-      this.rawJwt = {
-        header,
-        payload
-      };
-      return this;
-    }
-  };
-  JwtInvalidIssuerError = class JwtInvalidIssuerError2 extends JwtInvalidClaimError {
-  };
-  JwtInvalidAudienceError = class JwtInvalidAudienceError2 extends JwtInvalidClaimError {
-  };
-  JwtInvalidScopeError = class JwtInvalidScopeError2 extends JwtInvalidClaimError {
-  };
-  JwtExpiredError = class JwtExpiredError2 extends JwtInvalidClaimError {
-  };
-  JwtNotBeforeError = class JwtNotBeforeError2 extends JwtInvalidClaimError {
-  };
-  CognitoJwtInvalidGroupError = class CognitoJwtInvalidGroupError2 extends JwtInvalidClaimError {
-  };
-  CognitoJwtInvalidTokenUseError = class CognitoJwtInvalidTokenUseError2 extends JwtInvalidClaimError {
-  };
-  CognitoJwtInvalidClientIdError = class CognitoJwtInvalidClientIdError2 extends JwtInvalidClaimError {
-  };
-  JwksValidationError = class JwksValidationError2 extends JwtBaseError {
-  };
-  JwkValidationError = class JwkValidationError2 extends JwtBaseError {
-  };
-  JwtWithoutValidKidError = class JwtWithoutValidKidError2 extends JwtBaseError {
-  };
-  KidNotFoundInJwksError = class KidNotFoundInJwksError2 extends JwtBaseError {
-  };
-  WaitPeriodNotYetEndedJwkError = class WaitPeriodNotYetEndedJwkError2 extends JwtBaseError {
-  };
-  JwksNotAvailableInCacheError = class JwksNotAvailableInCacheError2 extends JwtBaseError {
-  };
-  JwkInvalidUseError = class JwkInvalidUseError2 extends FailedAssertionError {
-  };
-  JwkInvalidKtyError = class JwkInvalidKtyError2 extends FailedAssertionError {
-  };
-  FetchError = class FetchError2 extends JwtBaseError {
-    constructor(uri, msg) {
-      super(`Failed to fetch ${uri}: ${msg}`);
-    }
-  };
-  NonRetryableFetchError = class NonRetryableFetchError2 extends FetchError {
-  };
-});
-async function fetch2(uri, requestOptions, data) {
-  let responseTimeout;
-  return new Promise((resolve2, reject) => {
-    const req = request(uri, {
-      method: "GET",
-      ...requestOptions
-    }, (response) => {
-      if (response.statusCode !== 200) {
-        done(new NonRetryableFetchError(uri, `Status code is ${response.statusCode}, expected 200`));
-        return;
-      }
-      pipeline(response, async (responseBody) => {
-        const chunks = [];
-        for await (const chunk of responseBody) {
-          chunks.push(chunk);
-        }
-        return Buffer.concat(chunks);
-      }, done);
-    });
-    if (requestOptions?.responseTimeout) {
-      responseTimeout = setTimeout(() => done(new FetchError(uri, `Response time-out (after ${requestOptions.responseTimeout} ms.)`)), requestOptions.responseTimeout);
-      responseTimeout.unref();
-    }
-    function done(err2, data2) {
-      if (responseTimeout)
-        clearTimeout(responseTimeout);
-      if (err2 == null) {
-        resolve2(data2);
-        return;
-      }
-      req.socket?.emit("agentRemove");
-      if (!(err2 instanceof FetchError)) {
-        err2 = new FetchError(uri, err2.message);
-      }
-      req.destroy();
-      reject(err2);
-    }
-    req.on("error", done);
-    req.end(data);
-  });
-}
-var init_https_node = __esm(() => {
-  init_error();
-});
-var JwtSignatureAlgorithmHashNames;
-var nodeWebCompat;
-var init_node_web_compat_node = __esm(() => {
-  init_https_node();
-  (function(JwtSignatureAlgorithmHashNames2) {
-    JwtSignatureAlgorithmHashNames2["RS256"] = "RSA-SHA256";
-    JwtSignatureAlgorithmHashNames2["RS384"] = "RSA-SHA384";
-    JwtSignatureAlgorithmHashNames2["RS512"] = "RSA-SHA512";
-    JwtSignatureAlgorithmHashNames2["ES256"] = "RSA-SHA256";
-    JwtSignatureAlgorithmHashNames2["ES384"] = "RSA-SHA384";
-    JwtSignatureAlgorithmHashNames2["ES512"] = "RSA-SHA512";
-  })(JwtSignatureAlgorithmHashNames || (JwtSignatureAlgorithmHashNames = {}));
-  nodeWebCompat = {
-    fetch: fetch2,
-    transformJwkToKeyObjectSync: (jwk) => createPublicKey({
-      key: jwk,
-      format: "jwk"
-    }),
-    transformJwkToKeyObjectAsync: async (jwk) => createPublicKey({
-      key: jwk,
-      format: "jwk"
-    }),
-    parseB64UrlString: (b64) => Buffer.from(b64, "base64").toString("utf8"),
-    verifySignatureSync: ({ alg, keyObject, jwsSigningInput, signature }) => alg !== "EdDSA" ? createVerify(JwtSignatureAlgorithmHashNames[alg]).update(jwsSigningInput).verify({
-      key: keyObject,
-      dsaEncoding: "ieee-p1363"
-    }, signature, "base64") : verify(null, Buffer.from(jwsSigningInput), keyObject, Buffer.from(signature, "base64")),
-    verifySignatureAsync: async (args2) => nodeWebCompat.verifySignatureSync(args2),
-    defaultFetchTimeouts: {
-      socketIdle: 1500,
-      response: 3000
-    },
-    setTimeoutUnref: (...args2) => setTimeout(...args2).unref(),
-    transformPemToJwk: async (pem) => {
-      return createPublicKey({
-        key: Buffer.from(pem),
-        format: "pem"
-      }).export({
-        format: "jwk"
-      });
-    }
-  };
-});
-
-class SimpleFetcher {
-  constructor(props) {
-    this.defaultRequestOptions = {
-      timeout: nodeWebCompat.defaultFetchTimeouts.socketIdle,
-      responseTimeout: nodeWebCompat.defaultFetchTimeouts.response,
-      ...props?.defaultRequestOptions
-    };
-  }
-  async fetch(uri, requestOptions, data) {
-    requestOptions = { ...this.defaultRequestOptions, ...requestOptions };
-    try {
-      return await fetch3(uri, requestOptions, data);
-    } catch (err2) {
-      if (err2 instanceof NonRetryableFetchError) {
-        throw err2;
-      }
-      return fetch3(uri, requestOptions, data);
-    }
-  }
-}
-var fetch3;
-var init_https = __esm(() => {
-  init_error();
-  init_node_web_compat_node();
-  fetch3 = nodeWebCompat.fetch.bind(undefined);
-});
-function isJsonObject(j) {
-  return typeof j === "object" && !Array.isArray(j) && j !== null;
-}
-function safeJsonParse(s) {
-  return JSON.parse(s, (_2, value) => {
-    if (typeof value === "object" && !Array.isArray(value) && value !== null) {
-      delete value.__proto__;
-      delete value.constructor;
-    }
-    return value;
-  });
-}
-function assertStringEquals(name3, actual, expected, errorConstructor = FailedAssertionError) {
-  if (!actual) {
-    throw new errorConstructor(`Missing ${name3}. Expected: ${expected}`, actual, expected);
-  }
-  if (typeof actual !== "string") {
-    throw new errorConstructor(`${name3} is not of type string`, actual, expected);
-  }
-  if (expected !== actual) {
-    throw new errorConstructor(`${name3} not allowed: ${actual}. Expected: ${expected}`, actual, expected);
-  }
-}
-function assertStringArrayContainsString(name3, actual, expected, errorConstructor = FailedAssertionError) {
-  if (!actual) {
-    throw new errorConstructor(`Missing ${name3}. ${expectationMessage(expected)}`, actual, expected);
-  }
-  if (typeof actual !== "string") {
-    throw new errorConstructor(`${name3} is not of type string`, actual, expected);
-  }
-  return assertStringArraysOverlap(name3, actual, expected, errorConstructor);
-}
-function assertStringArraysOverlap(name3, actual, expected, errorConstructor = FailedAssertionError) {
-  if (!actual) {
-    throw new errorConstructor(`Missing ${name3}. ${expectationMessage(expected)}`, actual, expected);
-  }
-  const expectedAsSet = new Set(Array.isArray(expected) ? expected : [expected]);
-  if (typeof actual === "string") {
-    actual = [actual];
-  }
-  if (!Array.isArray(actual)) {
-    throw new errorConstructor(`${name3} is not an array`, actual, expected);
-  }
-  const overlaps = actual.some((actualItem) => {
-    if (typeof actualItem !== "string") {
-      throw new errorConstructor(`${name3} includes elements that are not of type string`, actual, expected);
-    }
-    return expectedAsSet.has(actualItem);
-  });
-  if (!overlaps) {
-    throw new errorConstructor(`${name3} not allowed: ${actual.join(", ")}. ${expectationMessage(expected)}`, actual, expected);
-  }
-}
-function expectationMessage(expected) {
-  if (Array.isArray(expected)) {
-    if (expected.length > 1) {
-      return `Expected one of: ${expected.join(", ")}`;
-    }
-    return `Expected: ${expected[0]}`;
-  }
-  return `Expected: ${expected}`;
-}
-function assertIsNotPromise(actual, errorFactory) {
-  if (actual && typeof actual.then === "function") {
-    throw errorFactory();
-  }
-}
-var init_assert = __esm(() => {
-  init_error();
-});
-function findJwkInJwks(jwks, kid) {
-  return jwks.keys.find((jwk) => jwk.kid != null && jwk.kid === kid);
-}
-function assertIsJwks(jwks) {
-  if (!jwks) {
-    throw new JwksValidationError("JWKS empty");
-  }
-  if (!isJsonObject(jwks)) {
-    throw new JwksValidationError("JWKS should be an object");
-  }
-  if (!Object.keys(jwks).includes("keys")) {
-    throw new JwksValidationError("JWKS does not include keys");
-  }
-  if (!Array.isArray(jwks.keys)) {
-    throw new JwksValidationError("JWKS keys should be an array");
-  }
-  for (const jwk of jwks.keys) {
-    assertIsJwk(jwk);
-  }
-}
-function assertIsSignatureJwk(jwk) {
-  assertStringArrayContainsString("JWK kty", jwk.kty, ["EC", "RSA", "OKP"], JwkInvalidKtyError);
-  if (jwk.kty === "EC") {
-    assertIsEsSignatureJwk(jwk);
-  } else if (jwk.kty === "RSA") {
-    assertIsRsaSignatureJwk(jwk);
-  } else if (jwk.kty === "OKP") {
-    assertIsEdDSASignatureJwk(jwk);
-  }
-}
-function assertIsEdDSASignatureJwk(jwk) {
-  if (jwk.use) {
-    assertStringEquals("JWK use", jwk.use, "sig", JwkInvalidUseError);
-  }
-  assertStringEquals("JWK kty", jwk.kty, "OKP", JwkInvalidKtyError);
-  if (!jwk.crv)
-    throw new JwkValidationError("Missing Curve (crv)");
-  if (!jwk.x)
-    throw new JwkValidationError("Missing X Coordinate (x)");
-}
-function assertIsEsSignatureJwk(jwk) {
-  if (jwk.use) {
-    assertStringEquals("JWK use", jwk.use, "sig", JwkInvalidUseError);
-  }
-  assertStringEquals("JWK kty", jwk.kty, "EC", JwkInvalidKtyError);
-  if (!jwk.crv)
-    throw new JwkValidationError("Missing Curve (crv)");
-  if (!jwk.x)
-    throw new JwkValidationError("Missing X Coordinate (x)");
-  if (!jwk.y)
-    throw new JwkValidationError("Missing Y Coordinate (y)");
-}
-function assertIsRsaSignatureJwk(jwk) {
-  if (jwk.use) {
-    assertStringEquals("JWK use", jwk.use, "sig", JwkInvalidUseError);
-  }
-  assertStringEquals("JWK kty", jwk.kty, "RSA", JwkInvalidKtyError);
-  if (!jwk.n)
-    throw new JwkValidationError("Missing modulus (n)");
-  if (!jwk.e)
-    throw new JwkValidationError("Missing exponent (e)");
-}
-function assertIsJwk(jwk) {
-  if (!jwk) {
-    throw new JwkValidationError("JWK empty");
-  }
-  if (!isJsonObject(jwk)) {
-    throw new JwkValidationError("JWK should be an object");
-  }
-  for (const field of mandatoryJwkFieldNames) {
-    if (typeof jwk[field] !== "string") {
-      throw new JwkValidationError(`JWK ${field} should be a string`);
-    }
-  }
-  for (const field of optionalJwkFieldNames) {
-    if (field in jwk && typeof jwk[field] !== "string") {
-      throw new JwkValidationError(`JWK ${field} should be a string`);
-    }
-  }
-}
-function isJwks(jwks) {
-  try {
-    assertIsJwks(jwks);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function isJwk(jwk) {
-  try {
-    assertIsJwk(jwk);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-class SimplePenaltyBox {
-  constructor(props) {
-    this.waitingUris = new Map;
-    this.waitSeconds = props?.waitSeconds ?? 10;
-  }
-  async wait(jwksUri) {
-    if (this.waitingUris.has(jwksUri)) {
-      throw new WaitPeriodNotYetEndedJwkError("Not allowed to fetch JWKS yet, still waiting for back off period to end");
-    }
-  }
-  release(jwksUri) {
-    const i2 = this.waitingUris.get(jwksUri);
-    if (i2) {
-      clearTimeout(i2);
-      this.waitingUris.delete(jwksUri);
-    }
-  }
-  registerFailedAttempt(jwksUri) {
-    const i2 = nodeWebCompat.setTimeoutUnref(() => {
-      this.waitingUris.delete(jwksUri);
-    }, this.waitSeconds * 1000);
-    this.waitingUris.set(jwksUri, i2);
-  }
-  registerSuccessfulAttempt(jwksUri) {
-    this.release(jwksUri);
-  }
-}
 
-class SimpleJwksCache {
-  constructor(props) {
-    this.jwksCache = new Map;
-    this.fetchingJwks = new Map;
-    this.penaltyBox = props?.penaltyBox ?? new SimplePenaltyBox;
-    this.fetcher = props?.fetcher ?? new SimpleFetcher;
-    this.jwksParser = props?.jwksParser ?? parseJwks;
-  }
-  addJwks(jwksUri, jwks) {
-    this.jwksCache.set(jwksUri, jwks);
-  }
-  async getJwks(jwksUri) {
-    const existingFetch = this.fetchingJwks.get(jwksUri);
-    if (existingFetch) {
-      return existingFetch;
-    }
-    const jwksPromise = this.fetcher.fetch(jwksUri).then(this.jwksParser);
-    this.fetchingJwks.set(jwksUri, jwksPromise);
-    let jwks;
-    try {
-      jwks = await jwksPromise;
-    } finally {
-      this.fetchingJwks.delete(jwksUri);
-    }
-    this.jwksCache.set(jwksUri, jwks);
-    return jwks;
-  }
-  getCachedJwk(jwksUri, decomposedJwt) {
-    if (typeof decomposedJwt.header.kid !== "string") {
-      throw new JwtWithoutValidKidError("JWT header does not have valid kid claim");
-    }
-    if (!this.jwksCache.has(jwksUri)) {
-      throw new JwksNotAvailableInCacheError(`JWKS for uri ${jwksUri} not yet available in cache`);
-    }
-    const jwk = findJwkInJwks(this.jwksCache.get(jwksUri), decomposedJwt.header.kid);
-    if (!jwk) {
-      throw new KidNotFoundInJwksError(`JWK for kid ${decomposedJwt.header.kid} not found in the JWKS`);
-    }
-    return jwk;
-  }
-  async getJwk(jwksUri, decomposedJwt) {
-    if (typeof decomposedJwt.header.kid !== "string") {
-      throw new JwtWithoutValidKidError("JWT header does not have valid kid claim");
-    }
-    const cachedJwks = this.jwksCache.get(jwksUri);
-    if (cachedJwks) {
-      const cachedJwk = findJwkInJwks(cachedJwks, decomposedJwt.header.kid);
-      if (cachedJwk) {
-        return cachedJwk;
-      }
-    }
-    await this.penaltyBox.wait(jwksUri, decomposedJwt.header.kid);
-    const jwks = await this.getJwks(jwksUri);
-    const jwk = findJwkInJwks(jwks, decomposedJwt.header.kid);
-    if (!jwk) {
-      this.penaltyBox.registerFailedAttempt(jwksUri, decomposedJwt.header.kid);
-      throw new KidNotFoundInJwksError(`JWK for kid "${decomposedJwt.header.kid}" not found in the JWKS`);
-    } else {
-      this.penaltyBox.registerSuccessfulAttempt(jwksUri, decomposedJwt.header.kid);
-    }
-    return jwk;
-  }
-}
-var optionalJwkFieldNames;
-var mandatoryJwkFieldNames;
-var parseJwks = function(jwksBin) {
-  let jwks;
-  try {
-    const jwksText = new TextDecoder("utf8", {
-      fatal: true,
-      ignoreBOM: true
-    }).decode(jwksBin);
-    jwks = safeJsonParse(jwksText);
-  } catch (err2) {
-    throw new JwksValidationError(`JWKS could not be parsed as JSON: ${err2}`);
-  }
-  assertIsJwks(jwks);
-  return jwks;
-};
-var init_jwk = __esm(() => {
-  init_https();
-  init_error();
-  init_node_web_compat_node();
-  init_assert();
-  optionalJwkFieldNames = [
-    "use",
-    "alg",
-    "kid",
-    "n",
-    "e",
-    "x",
-    "y",
-    "crv"
-  ];
-  mandatoryJwkFieldNames = [
-    "kty"
-  ];
-});
-function assertJwtHeader(header) {
-  if (!isJsonObject(header)) {
-    throw new JwtParseError("JWT header is not an object");
-  }
-  if (header.alg !== undefined && typeof header.alg !== "string") {
-    throw new JwtParseError("JWT header alg claim is not a string");
-  }
-  if (header.kid !== undefined && typeof header.kid !== "string") {
-    throw new JwtParseError("JWT header kid claim is not a string");
-  }
-}
-function assertJwtPayload(payload) {
-  if (!isJsonObject(payload)) {
-    throw new JwtParseError("JWT payload is not an object");
-  }
-  if (payload.exp !== undefined && !Number.isFinite(payload.exp)) {
-    throw new JwtParseError("JWT payload exp claim is not a number");
-  }
-  if (payload.iss !== undefined && typeof payload.iss !== "string") {
-    throw new JwtParseError("JWT payload iss claim is not a string");
-  }
-  if (payload.sub !== undefined && typeof payload.sub !== "string") {
-    throw new JwtParseError("JWT payload sub claim is not a string");
-  }
-  if (payload.aud !== undefined && typeof payload.aud !== "string" && (!Array.isArray(payload.aud) || payload.aud.some((aud) => typeof aud !== "string"))) {
-    throw new JwtParseError("JWT payload aud claim is not a string or array of strings");
-  }
-  if (payload.nbf !== undefined && !Number.isFinite(payload.nbf)) {
-    throw new JwtParseError("JWT payload nbf claim is not a number");
-  }
-  if (payload.iat !== undefined && !Number.isFinite(payload.iat)) {
-    throw new JwtParseError("JWT payload iat claim is not a number");
-  }
-  if (payload.scope !== undefined && typeof payload.scope !== "string") {
-    throw new JwtParseError("JWT payload scope claim is not a string");
-  }
-  if (payload.jti !== undefined && typeof payload.jti !== "string") {
-    throw new JwtParseError("JWT payload jti claim is not a string");
-  }
-}
-function decomposeUnverifiedJwt(jwt) {
-  if (!jwt) {
-    throw new JwtParseError("Empty JWT");
-  }
-  if (typeof jwt !== "string") {
-    throw new JwtParseError("JWT is not a string");
-  }
-  if (!JWT_REGEX.test(jwt)) {
-    throw new JwtParseError("JWT string does not consist of exactly 3 parts (header, payload, signature)");
-  }
-  const [headerB64, payloadB64, signatureB64] = jwt.split(".");
-  const [headerString, payloadString] = [headerB64, payloadB64].map(nodeWebCompat.parseB64UrlString);
-  let header;
-  try {
-    header = safeJsonParse(headerString);
-  } catch (err2) {
-    throw new JwtParseError("Invalid JWT. Header is not a valid JSON object", err2);
-  }
-  assertJwtHeader(header);
-  let payload;
-  try {
-    payload = safeJsonParse(payloadString);
-  } catch (err2) {
-    throw new JwtParseError("Invalid JWT. Payload is not a valid JSON object", err2);
-  }
-  assertJwtPayload(payload);
-  return {
-    header,
-    headerB64,
-    payload,
-    payloadB64,
-    signatureB64
-  };
-}
-function validateJwtFields(payload, options) {
-  if (payload.exp !== undefined) {
-    if (payload.exp + (options.graceSeconds ?? 0) < Date.now() / 1000) {
-      throw new JwtExpiredError(`Token expired at ${new Date(payload.exp * 1000).toISOString()}`, payload.exp);
-    }
-  }
-  if (payload.nbf !== undefined) {
-    if (payload.nbf - (options.graceSeconds ?? 0) > Date.now() / 1000) {
-      throw new JwtNotBeforeError(`Token can't be used before ${new Date(payload.nbf * 1000).toISOString()}`, payload.nbf);
-    }
-  }
-  if (options.issuer !== null) {
-    if (options.issuer === undefined) {
-      throw new ParameterValidationError("issuer must be provided or set to null explicitly");
-    }
-    assertStringArrayContainsString("Issuer", payload.iss, options.issuer, JwtInvalidIssuerError);
-  }
-  if (options.audience !== null) {
-    if (options.audience === undefined) {
-      throw new ParameterValidationError("audience must be provided or set to null explicitly");
-    }
-    assertStringArraysOverlap("Audience", payload.aud, options.audience, JwtInvalidAudienceError);
-  }
-  if (options.scope != null) {
-    assertStringArraysOverlap("Scope", payload.scope?.split(" "), options.scope, JwtInvalidScopeError);
-  }
-}
-var JWT_REGEX;
-var init_jwt = __esm(() => {
-  init_assert();
-  init_error();
-  init_node_web_compat_node();
-  JWT_REGEX = /^[A-Za-z0-9_-]+={0,2}\.[A-Za-z0-9_-]+={0,2}\.[A-Za-z0-9_-]+={0,2}$/;
-});
-function validateJwtHeaderAndJwk(header, jwk) {
-  assertIsSignatureJwk(jwk);
-  if (jwk.alg) {
-    assertStringEquals("JWT signature algorithm", header.alg, jwk.alg, JwtInvalidSignatureAlgorithmError);
-  }
-  assertStringArrayContainsString("JWT signature algorithm", header.alg, supportedSignatureAlgorithms, JwtInvalidSignatureAlgorithmError);
-}
-async function verifyDecomposedJwt(decomposedJwt, jwksUri, options, jwkFetcher, transformJwkToKeyObjectFn) {
-  const { header, headerB64, payload, payloadB64, signatureB64 } = decomposedJwt;
-  const jwk = await jwkFetcher(jwksUri, decomposedJwt);
-  validateJwtHeaderAndJwk(decomposedJwt.header, jwk);
-  const keyObject = await transformJwkToKeyObjectFn(jwk, header.alg, payload.iss);
-  const valid = await nodeWebCompat.verifySignatureAsync({
-    jwsSigningInput: `${headerB64}.${payloadB64}`,
-    signature: signatureB64,
-    alg: header.alg,
-    keyObject
-  });
-  if (!valid) {
-    throw new JwtInvalidSignatureError("Invalid signature");
-  }
-  try {
-    validateJwtFields(payload, options);
-    if (options.customJwtCheck) {
-      await options.customJwtCheck({ header, payload, jwk });
-    }
-  } catch (err2) {
-    if (options.includeRawJwtInErrors && err2 instanceof JwtInvalidClaimError) {
-      throw err2.withRawJwt(decomposedJwt);
-    }
-    throw err2;
-  }
-  return payload;
-}
-function verifyDecomposedJwtSync(decomposedJwt, jwkOrJwks, options, transformJwkToKeyObjectFn) {
-  const { header, headerB64, payload, payloadB64, signatureB64 } = decomposedJwt;
-  let jwk;
-  if (isJwk(jwkOrJwks)) {
-    jwk = jwkOrJwks;
-  } else if (isJwks(jwkOrJwks)) {
-    const locatedJwk = header.kid ? findJwkInJwks(jwkOrJwks, header.kid) : undefined;
-    if (!locatedJwk) {
-      throw new KidNotFoundInJwksError(`JWK for kid ${header.kid} not found in the JWKS`);
-    }
-    jwk = locatedJwk;
-  } else {
-    throw new ParameterValidationError([
-      `Expected a valid JWK or JWKS (parsed as JavaScript object), but received: ${jwkOrJwks}.`,
-      "If you're passing a JWKS URI, use the async verify() method instead, it will download and parse the JWKS for you"
-    ].join());
-  }
-  validateJwtHeaderAndJwk(decomposedJwt.header, jwk);
-  const keyObject = transformJwkToKeyObjectFn(jwk, header.alg, payload.iss);
-  const valid = nodeWebCompat.verifySignatureSync({
-    jwsSigningInput: `${headerB64}.${payloadB64}`,
-    signature: signatureB64,
-    alg: header.alg,
-    keyObject
-  });
-  if (!valid) {
-    throw new JwtInvalidSignatureError("Invalid signature");
-  }
-  try {
-    validateJwtFields(payload, options);
-    if (options.customJwtCheck) {
-      const res = options.customJwtCheck({ header, payload, jwk });
-      assertIsNotPromise(res, () => new ParameterValidationError("Custom JWT checks must be synchronous but a promise was returned"));
-    }
-  } catch (err2) {
-    if (options.includeRawJwtInErrors && err2 instanceof JwtInvalidClaimError) {
-      throw err2.withRawJwt(decomposedJwt);
-    }
-    throw err2;
+class LogsService {
+  ctx;
+  constructor(ctx) {
+    this.ctx = ctx;
   }
-  return payload;
-}
-
-class JwtVerifierBase {
-  constructor(verifyProperties, jwksCache = new SimpleJwksCache) {
-    this.jwksCache = jwksCache;
-    this.issuersConfig = new Map;
-    this.publicKeyCache = new KeyObjectCache;
-    if (Array.isArray(verifyProperties)) {
-      if (!verifyProperties.length) {
-        throw new ParameterValidationError("Provide at least one issuer configuration");
-      }
-      verifyProperties.forEach((prop, index2) => {
-        if (this.issuersConfig.has(prop.issuer)) {
-          throw new ParameterValidationError(`issuer ${prop.issuer} supplied multiple times`);
-        } else if (prop.issuer === null && verifyProperties.length >= 2) {
-          throw new ParameterValidationError(`issuer cannot be null when multiple issuers are supplied (at issuer: ${index2})`);
-        }
-        this.issuersConfig.set(prop.issuer, this.withJwksUri(prop));
+  async generateToken(user, slug2, environment) {
+    const db2 = this.ctx.db;
+    if (user.role === "admin") {
+      const game = await db2.query.games.findFirst({
+        where: eq(games.slug, slug2),
+        columns: { id: true }
       });
-    } else {
-      this.issuersConfig.set(verifyProperties.issuer, this.withJwksUri(verifyProperties));
-    }
-  }
-  getIssuerConfig(issuer) {
-    if (this.issuersConfig.size === 1) {
-      issuer = this.issuersConfig.keys().next().value;
-    }
-    if (issuer === undefined) {
-      throw new ParameterValidationError("issuer must be provided");
-    }
-    const config2 = this.issuersConfig.get(issuer);
-    if (!config2) {
-      throw new ParameterValidationError(`issuer not configured: ${issuer}`);
-    }
-    return config2;
-  }
-  cacheJwks(...[jwks, issuer]) {
-    const issuerConfig = this.getIssuerConfig(issuer);
-    this.jwksCache.addJwks(issuerConfig.jwksUri, jwks);
-    this.publicKeyCache.clearCache(issuerConfig.issuer);
-  }
-  async hydrate() {
-    const jwksFetches = Array.from(this.issuersConfig.values()).map(({ jwksUri }) => this.jwksCache.getJwks(jwksUri));
-    await Promise.all(jwksFetches);
-  }
-  verifySync(...[jwt, properties]) {
-    const { decomposedJwt, jwksUri, verifyProperties } = this.getVerifyParameters(jwt, properties);
-    return this.verifyDecomposedJwtSync(decomposedJwt, jwksUri, verifyProperties);
-  }
-  verifyDecomposedJwtSync(decomposedJwt, jwksUri, verifyProperties) {
-    const jwk = this.jwksCache.getCachedJwk(jwksUri, decomposedJwt);
-    return verifyDecomposedJwtSync(decomposedJwt, jwk, verifyProperties, this.publicKeyCache.transformJwkToKeyObjectSync.bind(this.publicKeyCache));
-  }
-  async verify(...[jwt, properties]) {
-    const { decomposedJwt, jwksUri, verifyProperties } = this.getVerifyParameters(jwt, properties);
-    return this.verifyDecomposedJwt(decomposedJwt, jwksUri, verifyProperties);
-  }
-  verifyDecomposedJwt(decomposedJwt, jwksUri, verifyProperties) {
-    return verifyDecomposedJwt(decomposedJwt, jwksUri, verifyProperties, this.jwksCache.getJwk.bind(this.jwksCache), this.publicKeyCache.transformJwkToKeyObjectAsync.bind(this.publicKeyCache));
-  }
-  getVerifyParameters(jwt, verifyProperties) {
-    const decomposedJwt = decomposeUnverifiedJwt(jwt);
-    const issuerConfig = this.getIssuerConfig(decomposedJwt.payload.iss);
-    return {
-      decomposedJwt,
-      jwksUri: issuerConfig.jwksUri,
-      verifyProperties: {
-        ...issuerConfig,
-        ...verifyProperties
+      if (!game) {
+        throw new NotFoundError("Game", slug2);
       }
-    };
-  }
-  withJwksUri(config2) {
-    if (config2.jwksUri) {
-      return config2;
-    }
-    const issuer = config2.issuer;
-    if (!issuer) {
-      throw new ParameterValidationError("jwksUri must be provided for issuer null");
-    }
-    const issuerUri = new URL(issuer).pathname.replace(/\/$/, "");
-    return {
-      jwksUri: new URL(`${issuerUri}/.well-known/jwks.json`, issuer).href,
-      ...config2
-    };
-  }
-}
-
-class KeyObjectCache {
-  constructor(transformJwkToKeyObjectSyncFn = nodeWebCompat.transformJwkToKeyObjectSync, transformJwkToKeyObjectAsyncFn = nodeWebCompat.transformJwkToKeyObjectAsync) {
-    this.transformJwkToKeyObjectSyncFn = transformJwkToKeyObjectSyncFn;
-    this.transformJwkToKeyObjectAsyncFn = transformJwkToKeyObjectAsyncFn;
-    this.publicKeys = new Map;
-  }
-  transformJwkToKeyObjectSync(jwk, jwtHeaderAlg, issuer) {
-    const alg = jwk.alg ?? jwtHeaderAlg;
-    if (!issuer || !jwk.kid || !alg) {
-      return this.transformJwkToKeyObjectSyncFn(jwk, alg, issuer);
-    }
-    const fromCache = this.publicKeys.get(issuer)?.get(jwk.kid)?.get(alg);
-    if (fromCache)
-      return fromCache;
-    const publicKey = this.transformJwkToKeyObjectSyncFn(jwk, alg, issuer);
-    this.putKeyObjectInCache(issuer, jwk.kid, alg, publicKey);
-    return publicKey;
-  }
-  async transformJwkToKeyObjectAsync(jwk, jwtHeaderAlg, issuer) {
-    const alg = jwk.alg ?? jwtHeaderAlg;
-    if (!issuer || !jwk.kid || !alg) {
-      return this.transformJwkToKeyObjectAsyncFn(jwk, alg, issuer);
-    }
-    const fromCache = this.publicKeys.get(issuer)?.get(jwk.kid)?.get(alg);
-    if (fromCache)
-      return fromCache;
-    const publicKey = await this.transformJwkToKeyObjectAsyncFn(jwk, alg, issuer);
-    this.putKeyObjectInCache(issuer, jwk.kid, alg, publicKey);
-    return publicKey;
-  }
-  putKeyObjectInCache(issuer, kid, alg, publicKey) {
-    const cachedIssuer = this.publicKeys.get(issuer);
-    const cachedIssuerKid = cachedIssuer?.get(kid);
-    if (cachedIssuerKid) {
-      cachedIssuerKid.set(alg, publicKey);
-    } else if (cachedIssuer) {
-      cachedIssuer.set(kid, new Map([[alg, publicKey]]));
+      logger16.info("Admin accessing game logs", { adminId: user.id, slug: slug2, environment });
     } else {
-      this.publicKeys.set(issuer, new Map([[kid, new Map([[alg, publicKey]])]]));
-    }
-  }
-  clearCache(issuer) {
-    this.publicKeys.delete(issuer);
-  }
-}
-var supportedSignatureAlgorithms;
-var JwtVerifier;
-var init_jwt_verifier = __esm(() => {
-  init_jwk();
-  init_assert();
-  init_jwt();
-  init_error();
-  init_node_web_compat_node();
-  supportedSignatureAlgorithms = [
-    "RS256",
-    "RS384",
-    "RS512",
-    "ES256",
-    "ES384",
-    "ES512",
-    "EdDSA"
-  ];
-  JwtVerifier = class JwtVerifier2 extends JwtVerifierBase {
-    static create(verifyProperties, additionalProperties) {
-      return new this(verifyProperties, additionalProperties?.jwksCache);
-    }
-  };
-});
-function validateCognitoJwtFields(payload, options) {
-  if (options.groups != null) {
-    assertStringArraysOverlap("Cognito group", payload["cognito:groups"], options.groups, CognitoJwtInvalidGroupError);
-  }
-  assertStringArrayContainsString("Token use", payload.token_use, ["id", "access"], CognitoJwtInvalidTokenUseError);
-  if (options.tokenUse !== null) {
-    if (options.tokenUse === undefined) {
-      throw new ParameterValidationError("tokenUse must be provided or set to null explicitly");
-    }
-    assertStringEquals("Token use", payload.token_use, options.tokenUse, CognitoJwtInvalidTokenUseError);
-  }
-  if (options.clientId !== null) {
-    if (options.clientId === undefined) {
-      throw new ParameterValidationError("clientId must be provided or set to null explicitly");
-    }
-    if (payload.token_use === "id") {
-      assertStringArrayContainsString('Client ID ("audience")', payload.aud, options.clientId, CognitoJwtInvalidClientIdError);
-    } else {
-      assertStringArrayContainsString("Client ID", payload.client_id, options.clientId, CognitoJwtInvalidClientIdError);
-    }
-  }
-}
-var CognitoJwtVerifier;
-var init_cognito_verifier = __esm(() => {
-  init_error();
-  init_jwt_verifier();
-  init_assert();
-  CognitoJwtVerifier = class CognitoJwtVerifier2 extends JwtVerifierBase {
-    constructor(props, jwksCache) {
-      const issuerConfig = Array.isArray(props) ? props.map((p) => ({
-        ...p,
-        ...CognitoJwtVerifier2.parseUserPoolId(p.userPoolId),
-        audience: null
-      })) : {
-        ...props,
-        ...CognitoJwtVerifier2.parseUserPoolId(props.userPoolId),
-        audience: null
-      };
-      super(issuerConfig, jwksCache);
-    }
-    static parseUserPoolId(userPoolId) {
-      const match = userPoolId.match(this.USER_POOL_ID_REGEX);
-      if (!match) {
-        throw new ParameterValidationError(`Invalid Cognito User Pool ID: ${userPoolId}`);
-      }
-      const region = match.groups.region;
-      const issuer = `https://cognito-idp.${region}.amazonaws.com/${userPoolId}`;
-      return {
-        issuer,
-        jwksUri: `${issuer}/.well-known/jwks.json`
-      };
-    }
-    static create(verifyProperties, additionalProperties) {
-      return new this(verifyProperties, additionalProperties?.jwksCache);
-    }
-    verifySync(...[jwt, properties]) {
-      const { decomposedJwt, jwksUri, verifyProperties } = this.getVerifyParameters(jwt, properties);
-      this.verifyDecomposedJwtSync(decomposedJwt, jwksUri, verifyProperties);
-      try {
-        validateCognitoJwtFields(decomposedJwt.payload, verifyProperties);
-      } catch (err2) {
-        if (verifyProperties.includeRawJwtInErrors && err2 instanceof JwtInvalidClaimError) {
-          throw err2.withRawJwt(decomposedJwt);
-        }
-        throw err2;
-      }
-      return decomposedJwt.payload;
-    }
-    async verify(...[jwt, properties]) {
-      const { decomposedJwt, jwksUri, verifyProperties } = this.getVerifyParameters(jwt, properties);
-      await this.verifyDecomposedJwt(decomposedJwt, jwksUri, verifyProperties);
-      try {
-        validateCognitoJwtFields(decomposedJwt.payload, verifyProperties);
-      } catch (err2) {
-        if (verifyProperties.includeRawJwtInErrors && err2 instanceof JwtInvalidClaimError) {
-          throw err2.withRawJwt(decomposedJwt);
-        }
-        throw err2;
+      const isApprovedDev = user.developerStatus === "approved";
+      if (!isApprovedDev) {
+        logger16.warn("Unapproved developer attempted log access", { userId: user.id, slug: slug2 });
+        throw new AccessDeniedError("Must be an approved developer");
       }
-      return decomposedJwt.payload;
-    }
-    cacheJwks(...[jwks, userPoolId]) {
-      let issuer;
-      if (userPoolId !== undefined) {
-        issuer = CognitoJwtVerifier2.parseUserPoolId(userPoolId).issuer;
-      } else if (Array.from(this.issuersConfig).length > 1) {
-        throw new ParameterValidationError("userPoolId must be provided");
+      const game = await db2.query.games.findFirst({
+        where: and(eq(games.slug, slug2), eq(games.developerId, user.id)),
+        columns: { id: true }
+      });
+      if (!game) {
+        logger16.warn("Developer attempted access to unowned game logs", {
+          userId: user.id,
+          slug: slug2
+        });
+        throw new NotFoundError("Game", slug2);
       }
-      const issuerConfig = this.getIssuerConfig(issuer);
-      super.cacheJwks(jwks, issuerConfig.issuer);
-    }
-  };
-  CognitoJwtVerifier.USER_POOL_ID_REGEX = /^(?<region>[a-z]{2}-(gov-)?[a-z]+-\d)_[a-zA-Z0-9]+$/;
-});
-var init_alb_cache = __esm(() => {
-  init_error();
-  init_https();
-  init_node_web_compat_node();
-});
-var init_alb_verifier = __esm(() => {
-  init_alb_cache();
-  init_assert();
-  init_error();
-  init_jwt_verifier();
-});
-var init_esm2 = __esm(() => {
-  init_jwt_verifier();
-  init_cognito_verifier();
-  init_alb_verifier();
-  init_jwt_verifier();
-});
-function generateUsername(email) {
-  const baseUsername = (email.split("@")[0] || "user").toLowerCase();
-  const cleanUsername = baseUsername.replace(/[^a-z0-9]/g, "");
-  const randomSuffix = Math.random().toString(36).substring(2, 7);
-  return `${cleanUsername}_${randomSuffix}`;
-}
-function extractRedirectPath(targetUri, currentHost) {
-  try {
-    const targetUrl = new URL(targetUri);
-    if (targetUrl.hostname === currentHost) {
-      return targetUrl.pathname + targetUrl.search;
     }
-  } catch {}
-  return "/";
-}
-function getLtiRoles(claims) {
-  return claims["https://purl.imsglobal.org/spec/lti/claim/roles"] || [];
-}
-function hasLtiRole(claims, role) {
-  return getLtiRoles(claims).some((r) => r.includes(role));
-}
-function validateLtiClaims(claims) {
-  const messageType = claims["https://purl.imsglobal.org/spec/lti/claim/message_type"];
-  const version2 = claims["https://purl.imsglobal.org/spec/lti/claim/version"];
-  if (messageType !== "LtiResourceLinkRequest") {
-    return `Invalid LTI message type: ${messageType}`;
-  }
-  if (version2 !== "1.3.0") {
-    return `Unsupported LTI version: ${version2}`;
+    const isProduction3 = environment === "production";
+    const workerId = getDeploymentId(slug2, isProduction3);
+    const token = await this.ctx.providers.auth.mintLogStreamToken(user.id, workerId);
+    logger16.debug("Generated log stream token", {
+      userId: user.id,
+      slug: slug2,
+      workerId
+    });
+    return { token, workerId };
   }
-  return null;
 }
-var LtiRoleChecks;
-var init_lti_util = __esm(() => {
-  LtiRoleChecks = {
-    isLearner: (claims) => hasLtiRole(claims, "Learner"),
-    isInstructor: (claims) => hasLtiRole(claims, "Instructor"),
-    isAdministrator: (claims) => hasLtiRole(claims, "Administrator"),
-    isContentDeveloper: (claims) => hasLtiRole(claims, "ContentDeveloper"),
-    isMentor: (claims) => hasLtiRole(claims, "Mentor")
-  };
+var logger16;
+var init_logs_service = __esm(() => {
+  init_drizzle_orm();
+  init_tables_index();
+  init_src2();
+  init_errors();
+  init_deployment_util();
+  logger16 = log.scope("LogsService");
 });
 
 class LtiService {
   ctx;
-  verifier = null;
   constructor(ctx) {
     this.ctx = ctx;
   }
-  getConfig() {
-    if (!this.ctx.config.lti) {
-      logger16.error("LTI configuration not available");
-      throw new ValidationError("LTI is not configured");
-    }
-    return this.ctx.config.lti;
-  }
-  getVerifier() {
-    if (!this.verifier) {
-      const lti = this.getConfig();
-      this.verifier = JwtVerifier.create({
-        issuer: lti.issuer,
-        audience: lti.audience,
-        jwksUri: lti.jwksUrl
-      });
-    }
-    return this.verifier;
-  }
-  async verifyToken(idToken) {
-    if (this.ctx.config.ltiTestMode) {
-      if (!idToken.startsWith("mock:")) {
-        throw new ValidationError("Invalid LTI token");
-      }
-      try {
-        const jsonStr = Buffer.from(idToken.slice(5), "base64").toString();
-        return JSON.parse(jsonStr);
-      } catch {
-        throw new ValidationError("Invalid LTI token format");
-      }
-    }
-    try {
-      const verifier = this.getVerifier();
-      const claims = await verifier.verify(idToken);
-      logger16.info("Verified token", {
-        sub: claims.sub,
-        email: claims.email,
-        roles: claims["https://purl.imsglobal.org/spec/lti/claim/roles"]
-      });
-      return claims;
-    } catch (error) {
-      logger16.error("Token verification failed", {
-        error: error instanceof Error ? error.message : String(error)
-      });
-      throw new ValidationError("Invalid LTI token");
-    }
-  }
-  async processLaunch(idToken, currentHost) {
-    const claims = await this.verifyToken(idToken);
-    const validationError = validateLtiClaims(claims);
-    if (validationError) {
-      logger16.warn("LTI claims validation failed", {
-        error: validationError,
-        sub: claims.sub
-      });
-      throw new ValidationError(validationError);
-    }
-    const user = await this.provisionUser(claims);
-    logger16.info("Processed launch roles", {
-      userId: user.id,
-      isLearner: LtiRoleChecks.isLearner(claims),
-      isInstructor: LtiRoleChecks.isInstructor(claims),
-      isAdministrator: LtiRoleChecks.isAdministrator(claims),
-      allRoles: claims["https://purl.imsglobal.org/spec/lti/claim/roles"]
-    });
-    const sessionToken = await this.createSession(user.id);
-    const targetUri = claims["https://purl.imsglobal.org/spec/lti/claim/target_link_uri"];
-    const redirectPath = extractRedirectPath(targetUri, currentHost);
-    logger16.info("Launch processed", { userId: user.id, redirectPath });
-    const userInfo = {
-      sub: user.id,
-      email: user.email,
-      name: user.name,
-      email_verified: user.emailVerified,
-      timeback_id: user.timebackId ?? undefined
-    };
-    return { user: userInfo, redirectPath, sessionToken };
-  }
   async getStatus(user) {
     const db2 = this.ctx.db;
     const [ltiAccount, oauthAccount, userRecord] = await Promise.all([
@@ -57242,134 +56204,11 @@ class LtiService {
       userId: user.id
     };
   }
-  async createSession(userId) {
-    const db2 = this.ctx.db;
-    const sessionToken = crypto4.randomUUID();
-    const expiresAt = new Date(Date.now() + 2592000000);
-    const [session2] = await db2.insert(sessions).values({
-      id: crypto4.randomUUID(),
-      userId,
-      token: sessionToken,
-      expiresAt,
-      createdAt: new Date,
-      updatedAt: new Date
-    }).returning({ id: sessions.id });
-    if (!session2) {
-      logger16.error("Session insert returned no rows", { userId });
-      throw new InternalError("Failed to create session");
-    }
-    logger16.info("Created session", {
-      userId,
-      providerId: AUTH_PROVIDER_IDS.TIMEBACK_LTI
-    });
-    return sessionToken;
-  }
-  async provisionUser(claims) {
-    const db2 = this.ctx.db;
-    const email = claims.email;
-    const ltiTimebackId = claims.sub;
-    const providerId = AUTH_PROVIDER_IDS.TIMEBACK_LTI;
-    if (!email) {
-      throw new ValidationError("Email is required in LTI claims");
-    }
-    const existingAccount = await db2.query.accounts.findFirst({
-      where: and(eq(accounts.accountId, ltiTimebackId), eq(accounts.providerId, providerId))
-    });
-    if (existingAccount) {
-      const user = await db2.query.users.findFirst({
-        where: eq(users.id, existingAccount.userId)
-      });
-      if (user) {
-        logger16.info("Found user by account", {
-          userId: user.id,
-          ltiTimebackId
-        });
-        return user;
-      }
-    }
-    const existingUser = await db2.query.users.findFirst({
-      where: eq(users.email, email)
-    });
-    if (existingUser) {
-      await db2.transaction(async (tx) => {
-        const existingLtiAccount = await tx.query.accounts.findFirst({
-          where: and(eq(accounts.userId, existingUser.id), eq(accounts.providerId, providerId))
-        });
-        if (!existingLtiAccount) {
-          const [account] = await tx.insert(accounts).values({
-            id: crypto4.randomUUID(),
-            userId: existingUser.id,
-            accountId: ltiTimebackId,
-            providerId,
-            accessToken: null,
-            refreshToken: null,
-            accessTokenExpiresAt: null,
-            refreshTokenExpiresAt: null,
-            createdAt: new Date,
-            updatedAt: new Date
-          }).returning({ id: accounts.id });
-          if (!account) {
-            logger16.error("LTI account link insert returned no rows", {
-              userId: existingUser.id,
-              ltiTimebackId
-            });
-            throw new InternalError("Failed to link LTI account");
-          }
-          logger16.info("Linked existing user", {
-            userId: existingUser.id,
-            ltiTimebackId
-          });
-        }
-      });
-      return existingUser;
-    }
-    const newUserId = crypto4.randomUUID();
-    const createdUser = await db2.transaction(async (tx) => {
-      const [insertedUser] = await tx.insert(users).values({
-        id: newUserId,
-        email,
-        emailVerified: true,
-        timebackId: ltiTimebackId,
-        username: generateUsername(email),
-        name: claims.name || claims.given_name || email.split("@")[0] || "Timeback User",
-        createdAt: new Date,
-        updatedAt: new Date
-      }).returning();
-      if (!insertedUser) {
-        logger16.error("LTI user insert returned no rows", { email, ltiTimebackId });
-        throw new InternalError("Failed to create user");
-      }
-      await tx.insert(accounts).values({
-        id: crypto4.randomUUID(),
-        userId: newUserId,
-        accountId: ltiTimebackId,
-        providerId,
-        accessToken: null,
-        refreshToken: null,
-        accessTokenExpiresAt: null,
-        refreshTokenExpiresAt: null,
-        createdAt: new Date,
-        updatedAt: new Date
-      });
-      logger16.info("Provisioned user", {
-        userId: insertedUser.id,
-        ltiTimebackId
-      });
-      return insertedUser;
-    });
-    return createdUser;
-  }
 }
-var logger16;
 var init_lti_service = __esm(() => {
-  init_esm2();
   init_drizzle_orm();
   init_src();
   init_tables_index();
-  init_src2();
-  init_errors();
-  init_lti_util();
-  logger16 = log.scope("LtiService");
 });
 
 class MapService {
@@ -57860,56 +56699,88 @@ class SecretsService {
   constructor(ctx) {
     this.ctx = ctx;
   }
-  async listKeys(slug2, user) {
-    const game = await this.ctx.services.game.validateDeveloperAccessBySlug(user, slug2);
-    const secrets = await this.ctx.providers.secrets.readSecrets(game.id);
-    const keys = secrets ? Object.keys(secrets).filter((k) => !INTERNAL_SECRET_KEYS.includes(k)) : [];
-    logger20.debug("Listed secret keys", { gameId: game.id, slug: slug2, keyCount: keys.length });
-    return keys;
+  getCloudflare() {
+    if (!this.ctx.cloudflare) {
+      throw new ValidationError("Secrets management requires Cloudflare provider");
+    }
+    return this.ctx.cloudflare;
   }
-  async getValues(slug2, user) {
+  getDeploymentId(slug2) {
+    const isProd = isProduction2(this.ctx.config);
+    return getDeploymentId(slug2, isProd);
+  }
+  async listKeys(slug2, user) {
     const game = await this.ctx.services.game.validateDeveloperAccessBySlug(user, slug2);
-    const secrets = await this.ctx.providers.secrets.readSecrets(game.id);
-    if (!secrets) {
-      return {};
-    }
-    const filtered = {};
-    for (const [key, value] of Object.entries(secrets)) {
-      if (!INTERNAL_SECRET_KEYS.includes(key)) {
-        filtered[key] = value;
+    const cf = this.getCloudflare();
+    const deploymentId = this.getDeploymentId(slug2);
+    try {
+      const allKeys = await cf.listSecrets(deploymentId);
+      const keys = allKeys.filter((k) => k.startsWith(SECRETS_PREFIX)).map((k) => k.slice(SECRETS_PREFIX.length));
+      logger20.debug("Listed secret keys", { gameId: game.id, slug: slug2, keyCount: keys.length });
+      return keys;
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (message.includes("not found") || message.includes("10007")) {
+        logger20.debug("Worker not found, returning empty secrets list", {
+          gameId: game.id,
+          slug: slug2
+        });
+        return [];
       }
+      throw error;
     }
-    logger20.debug("Retrieved secret values", { gameId: game.id, slug: slug2 });
-    return filtered;
   }
   async setSecrets(slug2, newSecrets, user) {
     const game = await this.ctx.services.game.validateDeveloperAccessBySlug(user, slug2);
+    const cf = this.getCloudflare();
+    const deploymentId = this.getDeploymentId(slug2);
     const secretKeys = Object.keys(newSecrets);
     if (secretKeys.length === 0) {
+      logger20.warn("No secrets provided", { userId: user.id, slug: slug2 });
       throw new ValidationError("At least one secret must be provided");
     }
     for (const [key, value] of Object.entries(newSecrets)) {
       if (typeof value !== "string") {
+        logger20.warn("Secret value must be a string", { userId: user.id, slug: slug2, key });
         throw new ValidationError(`Secret value for "${key}" must be a string`);
       }
       if (INTERNAL_SECRET_KEYS.includes(key)) {
-        logger20.warn("Attempted to set reserved secret", {
-          userId: user.id,
+        logger20.warn("Attempted to set reserved secret", { userId: user.id, slug: slug2, key });
+        throw new ValidationError(`Cannot set reserved secret "${key}"`);
+      }
+    }
+    try {
+      const prefixedSecrets = {};
+      for (const [key, value] of Object.entries(newSecrets)) {
+        prefixedSecrets[`${SECRETS_PREFIX}${key}`] = value;
+      }
+      await cf.setSecrets(deploymentId, prefixedSecrets);
+      logger20.info("Set secrets", {
+        gameId: game.id,
+        slug: slug2,
+        deploymentId,
+        keys: secretKeys
+      });
+      const allKeys = await cf.listSecrets(deploymentId);
+      return allKeys.filter((k) => k.startsWith(SECRETS_PREFIX)).map((k) => k.slice(SECRETS_PREFIX.length));
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (message.includes("not found") || message.includes("10007")) {
+        logger20.warn("Cannot set secrets - game not deployed", {
           gameId: game.id,
-          key
+          slug: slug2,
+          deploymentId
         });
-        throw new ValidationError(`Cannot set reserved secret "${key}"`);
+        throw new ValidationError("Game must be deployed before setting secrets. Run `playcademy deploy` first.");
       }
+      logger20.error("Failed to set secrets", {
+        gameId: game.id,
+        slug: slug2,
+        deploymentId,
+        error: message
+      });
+      throw error;
     }
-    const existingSecrets = await this.ctx.providers.secrets.readSecrets(game.id) || {};
-    const updatedSecrets = { ...existingSecrets, ...newSecrets };
-    await this.ctx.providers.secrets.writeSecrets(game.id, updatedSecrets);
-    logger20.info("Set secrets", {
-      gameId: game.id,
-      slug: slug2,
-      addedKeys: secretKeys
-    });
-    return Object.keys(updatedSecrets).filter((k) => !INTERNAL_SECRET_KEYS.includes(k));
   }
   async deleteSecret(slug2, key, user) {
     if (INTERNAL_SECRET_KEYS.includes(key)) {
@@ -57921,26 +56792,55 @@ class SecretsService {
       throw new ValidationError(`Cannot delete reserved secret "${key}"`);
     }
     const game = await this.ctx.services.game.validateDeveloperAccessBySlug(user, slug2);
-    const secrets = await this.ctx.providers.secrets.readSecrets(game.id);
-    if (!secrets || !(key in secrets)) {
-      throw new NotFoundError("Secret", key);
-    }
-    delete secrets[key];
-    if (Object.keys(secrets).length > 0) {
-      await this.ctx.providers.secrets.writeSecrets(game.id, secrets);
-    } else {
-      await this.ctx.providers.secrets.deleteSecrets(game.id);
+    const cf = this.getCloudflare();
+    const deploymentId = this.getDeploymentId(slug2);
+    try {
+      const prefixedKey = `${SECRETS_PREFIX}${key}`;
+      const existingKeys = await cf.listSecrets(deploymentId);
+      if (!existingKeys.includes(prefixedKey)) {
+        throw new NotFoundError("Secret", key);
+      }
+      await cf.deleteSecret(deploymentId, prefixedKey);
+      logger20.info("Deleted secret", {
+        gameId: game.id,
+        slug: slug2,
+        deploymentId,
+        key
+      });
+    } catch (error) {
+      if (error instanceof NotFoundError) {
+        throw error;
+      }
+      const message = error instanceof Error ? error.message : String(error);
+      if (message.includes("not found") || message.includes("10007")) {
+        logger20.warn("Cannot delete secret - game not deployed", {
+          gameId: game.id,
+          slug: slug2,
+          deploymentId
+        });
+        throw new ValidationError("Game must be deployed before managing secrets. Run `playcademy deploy` first.");
+      }
+      logger20.error("Failed to delete secret", {
+        gameId: game.id,
+        slug: slug2,
+        deploymentId,
+        key,
+        error: message
+      });
+      throw error;
     }
-    logger20.info("Deleted secret", { gameId: game.id, slug: slug2, key });
   }
 }
 var logger20;
+var SECRETS_PREFIX = "secrets_";
 var INTERNAL_SECRET_KEYS;
 var init_secrets_service = __esm(() => {
   init_src2();
+  init_config2();
   init_errors();
+  init_deployment_util();
   logger20 = log.scope("SecretsService");
-  INTERNAL_SECRET_KEYS = ["PLAYCADEMY_API_KEY"];
+  INTERNAL_SECRET_KEYS = ["PLAYCADEMY_API_KEY", "GAME_ID", "PLAYCADEMY_BASE_URL"];
 });
 
 class SeedService {
@@ -59370,11 +58270,11 @@ class TimebackService {
       return [];
     }
   }
-  async setupIntegration(gameId, request2, user) {
+  async setupIntegration(gameId, request, user) {
     const client = this.requireClient();
     const db2 = this.ctx.db;
     await this.ctx.services.game.validateDeveloperAccess(user, gameId);
-    const { courses, baseConfig, verbose } = request2;
+    const { courses, baseConfig, verbose } = request;
     const existing = await db2.query.gameTimebackIntegrations.findMany({
       where: eq(gameTimebackIntegrations.gameId, gameId)
     });
@@ -59618,8 +58518,8 @@ class UploadService {
   constructor(ctx) {
     this.ctx = ctx;
   }
-  async initiate(request2, user) {
-    const { fileName, gameId } = request2;
+  async initiate(request, user) {
+    const { fileName, gameId } = request;
     const bucketName = this.ctx.config.uploadBucket;
     if (!bucketName) {
       logger27.error("Upload bucket not configured in environment");
@@ -59865,6 +58765,7 @@ function createServices(ctx) {
     item: new ItemService(ctx),
     leaderboard: new LeaderboardService(ctx),
     level: new LevelService(ctx),
+    logs: new LogsService(ctx),
     lti: new LtiService(ctx),
     map: new MapService(ctx),
     notification: new NotificationService(ctx),
@@ -59896,6 +58797,7 @@ var init_services = __esm(() => {
   init_item_service();
   init_leaderboard_service();
   init_level_service();
+  init_logs_service();
   init_lti_service();
   init_map_service();
   init_notification_service();
@@ -59990,6 +58892,38 @@ function createSandboxAuthProvider() {
       const header = btoa(JSON.stringify({ alg: "none", typ: "sandbox" }));
       const payloadStr = btoa(JSON.stringify(payload));
       return `${header}.${payloadStr}.sandbox`;
+    },
+    async mintLogStreamToken(userId, workerId) {
+      const jti = crypto.randomUUID();
+      const payload = {
+        sub: userId,
+        game: workerId,
+        jti,
+        exp: Date.now() + 60000
+      };
+      const header = btoa(JSON.stringify({ alg: "none", typ: "sandbox" }));
+      const payloadStr = btoa(JSON.stringify(payload));
+      return `${header}.${payloadStr}.sandbox`;
+    },
+    async validateLogStreamToken(token) {
+      try {
+        const parts2 = token.split(".");
+        if (parts2.length !== 3)
+          return null;
+        if (parts2[2] === "sandbox") {
+          const payload = JSON.parse(atob(parts2[1]));
+          if (payload.jti && payload.sub && payload.game) {
+            if (payload.exp && payload.exp < Date.now()) {
+              log.debug("[SandboxAuthProvider] Log stream token expired");
+              return null;
+            }
+            return { jti: payload.jti, sub: payload.sub, game: payload.game };
+          }
+        }
+        return null;
+      } catch {
+        return null;
+      }
     }
   };
 }
@@ -60044,33 +58978,6 @@ var init_cache_provider = __esm(() => {
   cache = new Map;
   gameOrigins = [];
 });
-function createSandboxSecretsProvider() {
-  return {
-    async readSecrets(gameId) {
-      const secrets = secretsStorage.get(gameId);
-      return secrets ?? null;
-    },
-    async writeSecrets(gameId, secrets) {
-      secretsStorage.set(gameId, { ...secrets });
-      log.debug("[SandboxSecretsProvider] Stored secrets", {
-        gameId,
-        keyCount: Object.keys(secrets).length
-      });
-    },
-    async deleteSecrets(gameId) {
-      secretsStorage.delete(gameId);
-      log.debug("[SandboxSecretsProvider] Deleted secrets", { gameId });
-    }
-  };
-}
-function clearSandboxSecrets() {
-  secretsStorage.clear();
-}
-var secretsStorage;
-var init_secrets_provider = __esm(() => {
-  init_src2();
-  secretsStorage = new Map;
-});
 function getBucket(bucketName) {
   let bucket = storage.get(bucketName);
   if (!bucket) {
@@ -60142,7 +59049,6 @@ var init_storage_provider = __esm(() => {
 var init_providers = __esm(() => {
   init_auth_provider();
   init_cache_provider();
-  init_secrets_provider();
   init_storage_provider();
 });
 function buildConfig(options) {
@@ -60159,7 +59065,6 @@ function buildProviders() {
   return {
     auth: createSandboxAuthProvider(),
     storage: createSandboxStorageProvider(),
-    secrets: createSandboxSecretsProvider(),
     cache: createSandboxCacheProvider()
   };
 }
@@ -60292,8 +59197,8 @@ var GET_MATCH_RESULT;
 var init_constants3 = __esm(() => {
   GET_MATCH_RESULT = Symbol();
 });
-async function parseFormData(request2, options) {
-  const formData = await request2.formData();
+async function parseFormData(request, options) {
+  const formData = await request.formData();
   if (formData) {
     return convertFormDataToBodyData(formData, options);
   }
@@ -60320,12 +59225,12 @@ function convertFormDataToBodyData(formData, options) {
   }
   return form;
 }
-var parseBody = async (request2, options = /* @__PURE__ */ Object.create(null)) => {
+var parseBody = async (request, options = /* @__PURE__ */ Object.create(null)) => {
   const { all = false, dot = false } = options;
-  const headers = request2 instanceof HonoRequest ? request2.raw.headers : request2.headers;
+  const headers = request instanceof HonoRequest ? request.raw.headers : request.headers;
   const contentType = headers.get("Content-Type");
   if (contentType?.startsWith("multipart/form-data") || contentType?.startsWith("application/x-www-form-urlencoded")) {
-    return parseFormData(request2, { all, dot });
+    return parseFormData(request, { all, dot });
   }
   return {};
 };
@@ -60427,8 +59332,8 @@ var tryDecode = (str, decoder) => {
   }
 };
 var tryDecodeURI = (str) => tryDecode(str, decodeURI);
-var getPath = (request2) => {
-  const url = request2.url;
+var getPath = (request) => {
+  const url = request.url;
   const start2 = url.indexOf("/", url.indexOf(":") + 4);
   let i2 = start2;
   for (;i2 < url.length; i2++) {
@@ -60443,8 +59348,8 @@ var getPath = (request2) => {
   }
   return url.slice(start2, i2);
 };
-var getPathNoStrict = (request2) => {
-  const result = getPath(request2);
+var getPathNoStrict = (request) => {
+  const result = getPath(request);
   return result.length > 1 && result.at(-1) === "/" ? result.slice(0, -1) : result;
 };
 var mergePath = (base, sub, ...rest) => {
@@ -60576,8 +59481,8 @@ var init_request = __esm(() => {
     routeIndex = 0;
     path;
     bodyCache = {};
-    constructor(request2, path2 = "/", matchResult = [[]]) {
-      this.raw = request2;
+    constructor(request, path2 = "/", matchResult = [[]]) {
+      this.raw = request;
       this.path = path2;
       this.#matchResult = matchResult;
       this.#validatedData = {};
@@ -61013,7 +59918,7 @@ var Hono = class {
       } else {
         optionHandler = options.optionHandler;
         if (options.replaceRequest === false) {
-          replaceRequest = (request2) => request2;
+          replaceRequest = (request) => request;
         } else {
           replaceRequest = options.replaceRequest;
         }
@@ -61032,10 +59937,10 @@ var Hono = class {
     replaceRequest ||= (() => {
       const mergedPath = mergePath(this._basePath, path2);
       const pathPrefixLength = mergedPath === "/" ? 0 : mergedPath.length;
-      return (request2) => {
-        const url = new URL(request2.url);
+      return (request) => {
+        const url = new URL(request.url);
         url.pathname = url.pathname.slice(pathPrefixLength) || "/";
-        return new Request(url, request2);
+        return new Request(url, request);
       };
     })();
     const handler = async (c, next) => {
@@ -61061,13 +59966,13 @@ var Hono = class {
     }
     throw err2;
   }
-  #dispatch(request2, executionCtx, env, method) {
+  #dispatch(request, executionCtx, env, method) {
     if (method === "HEAD") {
-      return (async () => new Response(null, await this.#dispatch(request2, executionCtx, env, "GET")))();
+      return (async () => new Response(null, await this.#dispatch(request, executionCtx, env, "GET")))();
     }
-    const path2 = this.getPath(request2, { env });
+    const path2 = this.getPath(request, { env });
     const matchResult = this.router.match(method, path2);
-    const c = new Context(request2, {
+    const c = new Context(request, {
       path: path2,
       matchResult,
       env,
@@ -61098,8 +60003,8 @@ var Hono = class {
       }
     })();
   }
-  fetch = (request2, ...rest) => {
-    return this.#dispatch(request2, rest[1], rest[0], request2.method);
+  fetch = (request, ...rest) => {
+    return this.#dispatch(request, rest[1], rest[0], request.method);
   };
   request = (input, requestInit, Env, executionCtx) => {
     if (input instanceof Request) {
@@ -69766,24 +68671,24 @@ is not a problem with esbuild. You need to fix your environment instead.
         throw new Error("The service is no longer running" + closeData.reason);
       streamIn.writeToStdin(encodePacket({ id, isRequest: false, value }));
     };
-    let handleRequest = async (id, request2) => {
+    let handleRequest = async (id, request) => {
       try {
-        if (request2.command === "ping") {
+        if (request.command === "ping") {
           sendResponse(id, {});
           return;
         }
-        if (typeof request2.key === "number") {
-          const requestCallbacks = requestCallbacksByKey[request2.key];
+        if (typeof request.key === "number") {
+          const requestCallbacks = requestCallbacksByKey[request.key];
           if (!requestCallbacks) {
             return;
           }
-          const callback = requestCallbacks[request2.command];
+          const callback = requestCallbacks[request.command];
           if (callback) {
-            await callback(id, request2);
+            await callback(id, request);
             return;
           }
         }
-        throw new Error(`Invalid command: ` + request2.command);
+        throw new Error(`Invalid command: ` + request.command);
       } catch (e) {
         const errors3 = [extractErrorMessageV8(e, streamIn, null, undefined, "")];
         try {
@@ -69852,15 +68757,15 @@ is not a problem with esbuild. You need to fix your environment instead.
             flags: flags2,
             mangleCache
           } = flagsForTransformOptions(callName, options, isTTY2, transformLogLevelDefault);
-          let request2 = {
+          let request = {
             command: "transform",
             flags: flags2,
             inputFS: inputPath !== null,
             input: inputPath !== null ? encodeUTF8(inputPath) : typeof input === "string" ? encodeUTF8(input) : input
           };
           if (mangleCache)
-            request2.mangleCache = mangleCache;
-          sendRequest(refs, request2, (error, response) => {
+            request.mangleCache = mangleCache;
+          sendRequest(refs, request, (error, response) => {
             if (error)
               return callback(new Error(error), null);
             let errors3 = replaceDetailsInMessages(response.errors, details);
@@ -69938,16 +68843,16 @@ is not a problem with esbuild. You need to fix your environment instead.
         throw new Error(`Missing "kind" in ${callName}() call`);
       if (kind !== "error" && kind !== "warning")
         throw new Error(`Expected "kind" to be "error" or "warning" in ${callName}() call`);
-      let request2 = {
+      let request = {
         command: "format-msgs",
         messages: sanitizeMessages(messages, "messages", null, "", terminalWidth),
         isWarning: kind === "warning"
       };
       if (color !== undefined)
-        request2.color = color;
+        request.color = color;
       if (terminalWidth !== undefined)
-        request2.terminalWidth = terminalWidth;
-      sendRequest(refs, request2, (error, response) => {
+        request.terminalWidth = terminalWidth;
+      sendRequest(refs, request, (error, response) => {
         if (error)
           return callback(new Error(error), null);
         callback(null, response.messages);
@@ -69960,15 +68865,15 @@ is not a problem with esbuild. You need to fix your environment instead.
       let color = getFlag(options, keys, "color", mustBeBoolean);
       let verbose = getFlag(options, keys, "verbose", mustBeBoolean);
       checkForInvalidFlags(options, keys, `in ${callName}() call`);
-      let request2 = {
+      let request = {
         command: "analyze-metafile",
         metafile
       };
       if (color !== undefined)
-        request2.color = color;
+        request.color = color;
       if (verbose !== undefined)
-        request2.verbose = verbose;
-      sendRequest(refs, request2, (error, response) => {
+        request.verbose = verbose;
+      sendRequest(refs, request, (error, response) => {
         if (error)
           return callback(new Error(error), null);
         callback(null, response.result);
@@ -70041,7 +68946,7 @@ is not a problem with esbuild. You need to fix your environment instead.
       } = flagsForBuildOptions(callName, options, isTTY2, buildLogLevelDefault, writeDefault);
       if (write && !streamIn.hasFS)
         throw new Error(`The "write" option is unavailable in this environment`);
-      const request2 = {
+      const request = {
         command: "build",
         key: buildKey,
         entries,
@@ -70054,9 +68959,9 @@ is not a problem with esbuild. You need to fix your environment instead.
         context: isContext
       };
       if (requestPlugins)
-        request2.plugins = requestPlugins;
+        request.plugins = requestPlugins;
       if (mangleCache)
-        request2.mangleCache = mangleCache;
+        request.mangleCache = mangleCache;
       const buildResponseToResult = (response, callback2) => {
         const result = {
           errors: replaceDetailsInMessages(response.errors, details),
@@ -70086,8 +68991,8 @@ is not a problem with esbuild. You need to fix your environment instead.
       let latestResultPromise;
       let provideLatestResult;
       if (isContext)
-        requestCallbacks["on-end"] = (id, request22) => new Promise((resolve2) => {
-          buildResponseToResult(request22, (err2, result, onEndErrors, onEndWarnings) => {
+        requestCallbacks["on-end"] = (id, request2) => new Promise((resolve2) => {
+          buildResponseToResult(request2, (err2, result, onEndErrors, onEndWarnings) => {
             const response = {
               errors: onEndErrors,
               warnings: onEndWarnings
@@ -70100,7 +69005,7 @@ is not a problem with esbuild. You need to fix your environment instead.
             resolve2();
           });
         });
-      sendRequest(refs, request2, (error, response) => {
+      sendRequest(refs, request, (error, response) => {
         if (error)
           return callback(new Error(error), null);
         if (!isContext) {
@@ -70123,11 +69028,11 @@ is not a problem with esbuild. You need to fix your environment instead.
                     settlePromise = () => err2 ? reject(err2) : resolve2(result2);
                 };
                 const triggerAnotherBuild = () => {
-                  const request22 = {
+                  const request2 = {
                     command: "rebuild",
                     key: buildKey
                   };
-                  sendRequest(refs, request22, (error2, response2) => {
+                  sendRequest(refs, request2, (error2, response2) => {
                     if (error2) {
                       reject(new Error(error2));
                     } else if (settlePromise) {
@@ -70147,13 +69052,13 @@ is not a problem with esbuild. You need to fix your environment instead.
             const keys = {};
             const delay = getFlag(options2, keys, "delay", mustBeInteger);
             checkForInvalidFlags(options2, keys, `in watch() call`);
-            const request22 = {
+            const request2 = {
               command: "watch",
               key: buildKey
             };
             if (delay)
-              request22.delay = delay;
-            sendRequest(refs, request22, (error2) => {
+              request2.delay = delay;
+            sendRequest(refs, request2, (error2) => {
               if (error2)
                 reject(new Error(error2));
               else
@@ -70173,33 +69078,33 @@ is not a problem with esbuild. You need to fix your environment instead.
             const cors2 = getFlag(options2, keys, "cors", mustBeObject);
             const onRequest = getFlag(options2, keys, "onRequest", mustBeFunction);
             checkForInvalidFlags(options2, keys, `in serve() call`);
-            const request22 = {
+            const request2 = {
               command: "serve",
               key: buildKey,
               onRequest: !!onRequest
             };
             if (port !== undefined)
-              request22.port = port;
+              request2.port = port;
             if (host !== undefined)
-              request22.host = host;
+              request2.host = host;
             if (servedir !== undefined)
-              request22.servedir = servedir;
+              request2.servedir = servedir;
             if (keyfile !== undefined)
-              request22.keyfile = keyfile;
+              request2.keyfile = keyfile;
             if (certfile !== undefined)
-              request22.certfile = certfile;
+              request2.certfile = certfile;
             if (fallback !== undefined)
-              request22.fallback = fallback;
+              request2.fallback = fallback;
             if (cors2) {
               const corsKeys = {};
               const origin = getFlag(cors2, corsKeys, "origin", mustBeStringOrArrayOfStrings);
               checkForInvalidFlags(cors2, corsKeys, `on "cors" object`);
               if (Array.isArray(origin))
-                request22.corsOrigin = origin;
+                request2.corsOrigin = origin;
               else if (origin !== undefined)
-                request22.corsOrigin = [origin];
+                request2.corsOrigin = [origin];
             }
-            sendRequest(refs, request22, (error2, response2) => {
+            sendRequest(refs, request2, (error2, response2) => {
               if (error2)
                 return reject(new Error(error2));
               if (onRequest) {
@@ -70214,11 +69119,11 @@ is not a problem with esbuild. You need to fix your environment instead.
           cancel: () => new Promise((resolve2) => {
             if (didDispose)
               return resolve2();
-            const request22 = {
+            const request2 = {
               command: "cancel",
               key: buildKey
             };
-            sendRequest(refs, request22, () => {
+            sendRequest(refs, request2, () => {
               resolve2();
             });
           }),
@@ -70226,11 +69131,11 @@ is not a problem with esbuild. You need to fix your environment instead.
             if (didDispose)
               return resolve2();
             didDispose = true;
-            const request22 = {
+            const request2 = {
               command: "dispose",
               key: buildKey
             };
-            sendRequest(refs, request22, () => {
+            sendRequest(refs, request2, () => {
               resolve2();
               scheduleOnDisposeCallbacks();
               refs.unref();
@@ -70288,29 +69193,29 @@ is not a problem with esbuild. You need to fix your environment instead.
           let importAttributes = getFlag(options, keys2, "with", mustBeObject);
           checkForInvalidFlags(options, keys2, "in resolve() call");
           return new Promise((resolve22, reject) => {
-            const request2 = {
+            const request = {
               command: "resolve",
               path: path3,
               key: buildKey,
               pluginName: name3
             };
             if (pluginName != null)
-              request2.pluginName = pluginName;
+              request.pluginName = pluginName;
             if (importer != null)
-              request2.importer = importer;
+              request.importer = importer;
             if (namespace != null)
-              request2.namespace = namespace;
+              request.namespace = namespace;
             if (resolveDir != null)
-              request2.resolveDir = resolveDir;
+              request.resolveDir = resolveDir;
             if (kind != null)
-              request2.kind = kind;
+              request.kind = kind;
             else
               throw new Error(`Must specify "kind" when calling "resolve"`);
             if (pluginData != null)
-              request2.pluginData = details.store(pluginData);
+              request.pluginData = details.store(pluginData);
             if (importAttributes != null)
-              request2.with = sanitizeStringMap(importAttributes, "with");
-            sendRequest(refs, request2, (error, response) => {
+              request.with = sanitizeStringMap(importAttributes, "with");
+            sendRequest(refs, request, (error, response) => {
               if (error !== null)
                 reject(new Error(error));
               else
@@ -70380,7 +69285,7 @@ is not a problem with esbuild. You need to fix your environment instead.
         return { ok: false, error: e, pluginName: name3 };
       }
     }
-    requestCallbacks["on-start"] = async (id, request2) => {
+    requestCallbacks["on-start"] = async (id, request) => {
       details.clear();
       let response = { errors: [], warnings: [] };
       await Promise.all(onStartCallbacks.map(async ({ name: name3, callback, note }) => {
@@ -70404,19 +69309,19 @@ is not a problem with esbuild. You need to fix your environment instead.
       }));
       sendResponse(id, response);
     };
-    requestCallbacks["on-resolve"] = async (id, request2) => {
+    requestCallbacks["on-resolve"] = async (id, request) => {
       let response = {}, name3 = "", callback, note;
-      for (let id2 of request2.ids) {
+      for (let id2 of request.ids) {
         try {
           ({ name: name3, callback, note } = onResolveCallbacks[id2]);
           let result = await callback({
-            path: request2.path,
-            importer: request2.importer,
-            namespace: request2.namespace,
-            resolveDir: request2.resolveDir,
-            kind: request2.kind,
-            pluginData: details.load(request2.pluginData),
-            with: request2.with
+            path: request.path,
+            importer: request.importer,
+            namespace: request.namespace,
+            resolveDir: request.resolveDir,
+            kind: request.kind,
+            pluginData: details.load(request.pluginData),
+            with: request.with
           });
           if (result != null) {
             if (typeof result !== "object")
@@ -70466,17 +69371,17 @@ is not a problem with esbuild. You need to fix your environment instead.
       }
       sendResponse(id, response);
     };
-    requestCallbacks["on-load"] = async (id, request2) => {
+    requestCallbacks["on-load"] = async (id, request) => {
       let response = {}, name3 = "", callback, note;
-      for (let id2 of request2.ids) {
+      for (let id2 of request.ids) {
         try {
           ({ name: name3, callback, note } = onLoadCallbacks[id2]);
           let result = await callback({
-            path: request2.path,
-            namespace: request2.namespace,
-            suffix: request2.suffix,
-            pluginData: details.load(request2.pluginData),
-            with: request2.with
+            path: request.path,
+            namespace: request.namespace,
+            suffix: request.suffix,
+            pluginData: details.load(request.pluginData),
+            with: request.with
           });
           if (result != null) {
             if (typeof result !== "object")
@@ -71003,7 +69908,7 @@ for your current platform.`);
     return { binPath, isWASM };
   }
   var child_process = __require2("child_process");
-  var crypto5 = __require2("crypto");
+  var crypto42 = __require2("crypto");
   var path22 = __require2("path");
   var fs222 = __require2("fs");
   var os22 = __require2("os");
@@ -71317,7 +70222,7 @@ More information: The file containing the code for esbuild's JavaScript API (${_
     afterClose(null);
   };
   var randomFileName = () => {
-    return path22.join(os22.tmpdir(), `esbuild-${crypto5.randomBytes(32).toString("hex")}`);
+    return path22.join(os22.tmpdir(), `esbuild-${crypto42.randomBytes(32).toString("hex")}`);
   };
   var workerThreadService = null;
   var startWorkerThreadService = (worker_threads2) => {
@@ -73904,8 +72809,8 @@ var require_node22 = __commonJS2((exports) => {
       }
     } catch (err2) {}
     var bufferFrom = require_buffer_from();
-    function dynamicRequire(mod, request2) {
-      return mod.require(request2);
+    function dynamicRequire(mod, request) {
+      return mod.require(request);
     }
     var errorFormatterInstalled = false;
     var uncaughtShimInstalled = false;
@@ -76709,10 +75614,10 @@ If you have no idea what this means or what Pirates is, let me explain: Pirates
       var Module2 = __require2("module");
       var originalResolveFilename = Module2._resolveFilename;
       var coreModules = getCoreModules(Module2.builtinModules);
-      Module2._resolveFilename = function(request2, _parent) {
-        var isCoreModule = coreModules.hasOwnProperty(request2);
+      Module2._resolveFilename = function(request, _parent) {
+        var isCoreModule = coreModules.hasOwnProperty(request);
         if (!isCoreModule) {
-          var found = matchPath(request2);
+          var found = matchPath(request);
           if (found) {
             var modifiedArguments = __spreadArray([found], [].slice.call(arguments, 1), true);
             return originalResolveFilename.apply(this, modifiedArguments);
@@ -76879,10 +75784,10 @@ If you have no idea what this means or what Pirates is, let me explain: Pirates
     const matchPath = (0, import_tsconfig_paths.createMatchPath)(configLoaderResult.absoluteBaseUrl, configLoaderResult.paths, configLoaderResult.mainFields, configLoaderResult.addMatchAll);
     const Module2 = __require2("module");
     const originalResolveFilename = Module2._resolveFilename;
-    Module2._resolveFilename = function(request2, _parent) {
-      const isCoreModule = _module2.builtinModules.includes(request2);
+    Module2._resolveFilename = function(request, _parent) {
+      const isCoreModule = _module2.builtinModules.includes(request);
       if (!isCoreModule) {
-        const found = matchPath(request2);
+        const found = matchPath(request);
         if (found) {
           const modifiedArguments = [found, ...[].slice.call(arguments, 1)];
           return originalResolveFilename.apply(this, modifiedArguments);
@@ -79901,7 +78806,7 @@ var coerce2;
 var init_types8;
 var init_external2;
 var init_v32;
-var init_esm3;
+var init_esm2;
 var enumSchema;
 var enumSchemaV1;
 var indexColumn;
@@ -82371,7 +81276,7 @@ var sqlitePushIntrospect = async (db2, filters) => {
 };
 var generateDrizzleJson = (imports, prevId, schemaFilters, casing2) => {
   const prepared = prepareFromExports(imports);
-  const id = randomUUID2();
+  const id = randomUUID();
   const snapshot = generatePgSnapshot(prepared.tables, prepared.enums, prepared.schemas, prepared.sequences, prepared.roles, prepared.policies, prepared.views, prepared.matViews, casing2, schemaFilters);
   return fillPgSnapshot({
     serialized: snapshot,
@@ -82420,7 +81325,7 @@ var pushSchema = async (imports, drizzleInstance, schemaFilters, tablesFilter, e
 var generateSQLiteDrizzleJson = async (imports, prevId, casing2) => {
   const { prepareFromExports: prepareFromExports5 } = await Promise.resolve().then(() => (init_sqliteImports(), sqliteImports_exports));
   const prepared = prepareFromExports5(imports);
-  const id = randomUUID2();
+  const id = randomUUID();
   const snapshot = generateSqliteSnapshot(prepared.tables, prepared.views, casing2);
   return {
     ...snapshot,
@@ -82471,7 +81376,7 @@ var pushSQLiteSchema = async (imports, drizzleInstance) => {
 var generateMySQLDrizzleJson = async (imports, prevId, casing2) => {
   const { prepareFromExports: prepareFromExports5 } = await Promise.resolve().then(() => (init_mysqlImports(), mysqlImports_exports));
   const prepared = prepareFromExports5(imports);
-  const id = randomUUID2();
+  const id = randomUUID();
   const snapshot = generateMySqlSnapshot(prepared.tables, prepared.views, casing2);
   return {
     ...snapshot,
@@ -82521,7 +81426,7 @@ var pushMySQLSchema = async (imports, drizzleInstance, databaseName) => {
 var generateSingleStoreDrizzleJson = async (imports, prevId, casing2) => {
   const { prepareFromExports: prepareFromExports5 } = await Promise.resolve().then(() => (init_singlestoreImports(), singlestoreImports_exports));
   const prepared = prepareFromExports5(imports);
-  const id = randomUUID2();
+  const id = randomUUID();
   const snapshot = generateSingleStoreSnapshot(prepared.tables, casing2);
   return {
     ...snapshot,
@@ -89311,7 +88216,7 @@ See: https://github.com/isaacs/node-glob/issues/167`);
       init_external2();
     }
   });
-  init_esm3 = __esm3({
+  init_esm2 = __esm3({
     "../node_modules/.pnpm/zod@3.25.42/node_modules/zod/dist/esm/index.js"() {
       init_v32();
       init_v32();
@@ -89320,7 +88225,7 @@ See: https://github.com/isaacs/node-glob/issues/167`);
   init_gelSchema = __esm3({
     "src/serializer/gelSchema.ts"() {
       init_global2();
-      init_esm3();
+      init_esm2();
       enumSchema = objectType2({
         name: stringType2(),
         schema: stringType2(),
@@ -89574,7 +88479,7 @@ See: https://github.com/isaacs/node-glob/issues/167`);
   });
   init_mysqlSchema = __esm3({
     "src/serializer/mysqlSchema.ts"() {
-      init_esm3();
+      init_esm2();
       init_global2();
       index22 = objectType2({
         name: stringType2(),
@@ -89880,7 +88785,7 @@ See: https://github.com/isaacs/node-glob/issues/167`);
   init_pgSchema = __esm3({
     "src/serializer/pgSchema.ts"() {
       init_global2();
-      init_esm3();
+      init_esm2();
       indexV2 = objectType2({
         name: stringType2(),
         columns: recordType2(stringType2(), objectType2({
@@ -90601,7 +89506,7 @@ See: https://github.com/isaacs/node-glob/issues/167`);
   });
   init_singlestoreSchema = __esm3({
     "src/serializer/singlestoreSchema.ts"() {
-      init_esm3();
+      init_esm2();
       init_global2();
       index4 = objectType2({
         name: stringType2(),
@@ -90760,7 +89665,7 @@ See: https://github.com/isaacs/node-glob/issues/167`);
   });
   init_sqliteSchema = __esm3({
     "src/serializer/sqliteSchema.ts"() {
-      init_esm3();
+      init_esm2();
       init_global2();
       index5 = objectType2({
         name: stringType2(),
@@ -98438,7 +97343,7 @@ ${BREAKPOINT}ALTER TABLE ${tableNameWithSchema} ADD CONSTRAINT "${statement.newC
   });
   init_snapshotsDiffer = __esm3({
     "src/snapshotsDiffer.ts"() {
-      init_esm3();
+      init_esm2();
       init_jsonDiffer();
       init_sqlgenerator();
       init_jsonStatements();
@@ -100549,7 +99454,7 @@ ${BREAKPOINT}ALTER TABLE ${tableNameWithSchema} ADD CONSTRAINT "${statement.newC
   });
   init_schemaValidator = __esm3({
     "src/schemaValidator.ts"() {
-      init_esm3();
+      init_esm2();
       init_mysqlSchema();
       init_pgSchema();
       init_singlestoreSchema();
@@ -100567,7 +99472,7 @@ ${BREAKPOINT}ALTER TABLE ${tableNameWithSchema} ADD CONSTRAINT "${statement.newC
   });
   init_common2 = __esm3({
     "src/cli/validations/common.ts"() {
-      init_esm3();
+      init_esm2();
       init_schemaValidator();
       init_outputs();
       sqliteDriversLiterals = [
@@ -115769,7 +114674,7 @@ AND
   });
   init_cli = __esm3({
     "src/cli/validations/cli.ts"() {
-      init_esm3();
+      init_esm2();
       init_schemaValidator();
       init_common2();
       cliConfigGenerate = objectType2({
@@ -115830,7 +114735,7 @@ AND
   });
   init_gel = __esm3({
     "src/cli/validations/gel.ts"() {
-      init_esm3();
+      init_esm2();
       init_views();
       init_common2();
       gelCredentials = unionType2([
@@ -115874,7 +114779,7 @@ AND
   });
   init_libsql = __esm3({
     "src/cli/validations/libsql.ts"() {
-      init_esm3();
+      init_esm2();
       init_views();
       init_common2();
       libSQLCredentials = objectType2({
@@ -115885,7 +114790,7 @@ AND
   });
   init_mysql = __esm3({
     "src/cli/validations/mysql.ts"() {
-      init_esm3();
+      init_esm2();
       init_views();
       init_common2();
       init_outputs();
@@ -115918,7 +114823,7 @@ AND
   });
   init_postgres = __esm3({
     "src/cli/validations/postgres.ts"() {
-      init_esm3();
+      init_esm2();
       init_views();
       init_common2();
       postgresCredentials = unionType2([
@@ -115963,7 +114868,7 @@ AND
   });
   init_singlestore = __esm3({
     "src/cli/validations/singlestore.ts"() {
-      init_esm3();
+      init_esm2();
       init_views();
       init_common2();
       init_outputs();
@@ -115997,7 +114902,7 @@ AND
   init_sqlite = __esm3({
     "src/cli/validations/sqlite.ts"() {
       init_global2();
-      init_esm3();
+      init_esm2();
       init_views();
       init_common2();
       sqliteCredentials = unionType2([
@@ -116024,7 +114929,7 @@ AND
   });
   init_studio = __esm3({
     "src/cli/validations/studio.ts"() {
-      init_esm3();
+      init_esm2();
       init_schemaValidator();
       init_common2();
       init_mysql();
@@ -116056,7 +114961,7 @@ AND
   init_utils9 = __esm3({
     "src/cli/commands/utils.ts"() {
       import_hanji7 = __toESM22(require_hanji());
-      init_esm3();
+      init_esm2();
       init_getTablesFilterByExtensions();
       init_global2();
       init_schemaValidator();
@@ -121502,6 +120407,137 @@ var init_auth_util = __esm(() => {
   init_errors();
   init_types9();
 });
+function generateUsername(email) {
+  const baseUsername = (email.split("@")[0] || "user").toLowerCase();
+  const cleanUsername = baseUsername.replace(/[^a-z0-9]/g, "");
+  const randomSuffix = Math.random().toString(36).substring(2, 7);
+  return `${cleanUsername}_${randomSuffix}`;
+}
+function extractRedirectPath(targetUri, currentHost) {
+  try {
+    const targetUrl = new URL(targetUri);
+    if (targetUrl.hostname === currentHost) {
+      return targetUrl.pathname + targetUrl.search;
+    }
+  } catch {}
+  return "/";
+}
+function validateLtiClaims(claims) {
+  const messageType = claims["https://purl.imsglobal.org/spec/lti/claim/message_type"];
+  const version4 = claims["https://purl.imsglobal.org/spec/lti/claim/version"];
+  if (messageType !== "LtiResourceLinkRequest") {
+    return `Invalid LTI message type: ${messageType}`;
+  }
+  if (version4 !== "1.3.0") {
+    return `Unsupported LTI version: ${version4}`;
+  }
+  return null;
+}
+var init_lti_util = () => {};
+async function provisionLtiUser(db2, claims) {
+  const database2 = db2;
+  const email = claims.email;
+  const ltiTimebackId = claims.sub;
+  const providerId = AUTH_PROVIDER_IDS.TIMEBACK_LTI;
+  if (!email) {
+    throw new ValidationError("Email is required in LTI claims");
+  }
+  const existingAccount = await database2.query.accounts.findFirst({
+    where: and(eq(accounts.accountId, ltiTimebackId), eq(accounts.providerId, providerId))
+  });
+  if (existingAccount) {
+    const user = await database2.query.users.findFirst({
+      where: eq(users.id, existingAccount.userId)
+    });
+    if (user) {
+      logger32.info("Found user by LTI account", {
+        userId: user.id,
+        ltiTimebackId
+      });
+      return user;
+    }
+  }
+  const existingUser = await database2.query.users.findFirst({
+    where: eq(users.email, email)
+  });
+  if (existingUser) {
+    await database2.transaction(async (tx) => {
+      const existingLtiAccount = await tx.query.accounts.findFirst({
+        where: and(eq(accounts.userId, existingUser.id), eq(accounts.providerId, providerId))
+      });
+      if (!existingLtiAccount) {
+        const [account] = await tx.insert(accounts).values({
+          id: crypto4.randomUUID(),
+          userId: existingUser.id,
+          accountId: ltiTimebackId,
+          providerId,
+          accessToken: null,
+          refreshToken: null,
+          accessTokenExpiresAt: null,
+          refreshTokenExpiresAt: null,
+          createdAt: new Date,
+          updatedAt: new Date
+        }).returning({ id: accounts.id });
+        if (!account) {
+          logger32.error("LTI account link insert returned no rows", {
+            userId: existingUser.id,
+            ltiTimebackId
+          });
+          throw new InternalError("Failed to link LTI account");
+        }
+        logger32.info("Linked LTI account to existing user", {
+          userId: existingUser.id,
+          ltiTimebackId
+        });
+      }
+    });
+    return existingUser;
+  }
+  const newUserId = crypto4.randomUUID();
+  const createdUser = await database2.transaction(async (tx) => {
+    const [insertedUser] = await tx.insert(users).values({
+      id: newUserId,
+      email,
+      emailVerified: true,
+      username: generateUsername(email),
+      name: claims.name || claims.given_name || email.split("@")[0] || "Timeback User",
+      createdAt: new Date,
+      updatedAt: new Date
+    }).returning();
+    if (!insertedUser) {
+      logger32.error("LTI user insert returned no rows", { email, ltiTimebackId });
+      throw new InternalError("Failed to create user");
+    }
+    await tx.insert(accounts).values({
+      id: crypto4.randomUUID(),
+      userId: newUserId,
+      accountId: ltiTimebackId,
+      providerId,
+      accessToken: null,
+      refreshToken: null,
+      accessTokenExpiresAt: null,
+      refreshTokenExpiresAt: null,
+      createdAt: new Date,
+      updatedAt: new Date
+    });
+    logger32.info("Provisioned new user from LTI", {
+      userId: insertedUser.id,
+      ltiTimebackId
+    });
+    return insertedUser;
+  });
+  return createdUser;
+}
+var logger32;
+var init_lti_provisioning = __esm(() => {
+  init_drizzle_orm();
+  init_src();
+  init_tables_index();
+  init_src2();
+  init_errors();
+  init_lti_util();
+  logger32 = log.scope("LtiProvisioning");
+});
 function formatZodError(error2) {
   const flat = error2.flatten();
   const result = {};
@@ -121524,10 +120560,11 @@ var init_utils11 = __esm(() => {
   init_deployment_util();
   init_leaderboard_util();
   init_lti_util();
+  init_lti_provisioning();
   init_scope_util();
   init_timeback_util();
 });
-var logger32;
+var logger33;
 var listCurrent;
 var listHistory;
 var postProgress;
@@ -121538,14 +120575,14 @@ var init_achievement_controller = __esm(() => {
   init_src2();
   init_errors();
   init_utils11();
-  logger32 = log.scope("AchievementController");
+  logger33 = log.scope("AchievementController");
   listCurrent = requireAuth(async (ctx) => {
-    logger32.debug("Listing current achievements", { userId: ctx.user.id, gameId: ctx.gameId });
+    logger33.debug("Listing current achievements", { userId: ctx.user.id, gameId: ctx.gameId });
     return ctx.services.achievement.listCurrent(ctx.user, ctx.gameId);
   });
   listHistory = requireAuth(async (ctx) => {
     const limit = Math.max(1, Math.min(100, Number(ctx.url.searchParams.get("limit")) || 20));
-    logger32.debug("Listing achievement history", { userId: ctx.user.id, limit });
+    logger33.debug("Listing achievement history", { userId: ctx.user.id, limit });
     return ctx.services.achievement.listHistory(ctx.user, limit);
   });
   postProgress = requireAuth(async (ctx) => {
@@ -121556,12 +120593,12 @@ var init_achievement_controller = __esm(() => {
     } catch (error2) {
       if (error2 instanceof exports_external.ZodError) {
         const details = formatZodError(error2);
-        logger32.warn("Submit achievement progress validation failed", { details });
+        logger33.warn("Submit achievement progress validation failed", { details });
         throw ApiError.unprocessableEntity("Invalid request body", details);
       }
       throw ApiError.badRequest("Invalid JSON body");
     }
-    logger32.debug("Submitting progress", {
+    logger33.debug("Submitting progress", {
       userId: ctx.user.id,
       achievementId: body2.achievementId
     });
@@ -121573,15 +120610,15 @@ var init_achievement_controller = __esm(() => {
     postProgress
   };
 });
-var logger33;
+var logger34;
 var getAllowedOrigins;
 var init_admin_controller = __esm(() => {
   init_src2();
   init_utils11();
-  logger33 = log.scope("AdminController");
+  logger34 = log.scope("AdminController");
   getAllowedOrigins = requireAdmin(async (ctx) => {
     const shouldRefresh = ctx.url.searchParams.get("refresh") === "true";
-    logger33.debug("Getting allowed origins", { userId: ctx.user.id, refresh: shouldRefresh });
+    logger34.debug("Getting allowed origins", { userId: ctx.user.id, refresh: shouldRefresh });
     if (shouldRefresh) {
       await ctx.providers.cache.refreshGameOrigins();
     }
@@ -121594,7 +120631,7 @@ var init_admin_controller = __esm(() => {
     };
   });
 });
-var logger34;
+var logger35;
 var listFiles;
 var getFile;
 var putFile;
@@ -121606,7 +120643,7 @@ var init_bucket_controller = __esm(() => {
   init_src2();
   init_errors();
   init_utils11();
-  logger34 = log.scope("BucketController");
+  logger35 = log.scope("BucketController");
   listFiles = requireDeveloper(async (ctx) => {
     const slug2 = ctx.params.slug;
     if (!slug2) {
@@ -121614,7 +120651,7 @@ var init_bucket_controller = __esm(() => {
     }
     const url = ctx.url;
     const prefix2 = url.searchParams.get("prefix") || undefined;
-    logger34.debug("Listing files", { userId: ctx.user.id, slug: slug2, prefix: prefix2 });
+    logger35.debug("Listing files", { userId: ctx.user.id, slug: slug2, prefix: prefix2 });
     const files = await ctx.services.bucket.listFiles(slug2, ctx.user, prefix2);
     return { files };
   });
@@ -121624,7 +120661,7 @@ var init_bucket_controller = __esm(() => {
     if (!slug2 || !key) {
       throw ApiError.badRequest("Missing game slug or file key");
     }
-    logger34.debug("Getting file", { userId: ctx.user.id, slug: slug2, key });
+    logger35.debug("Getting file", { userId: ctx.user.id, slug: slug2, key });
     const object = await ctx.services.bucket.getFile(slug2, key, ctx.user);
     return new Response(Buffer.from(object.body), {
       status: 200,
@@ -121643,7 +120680,7 @@ var init_bucket_controller = __esm(() => {
     const arrayBuffer = await ctx.request.arrayBuffer();
     const body2 = new Uint8Array(arrayBuffer);
     const contentType = ctx.request.headers.get("content-type") || undefined;
-    logger34.debug("Uploading file", {
+    logger35.debug("Uploading file", {
       userId: ctx.user.id,
       slug: slug2,
       key,
@@ -121659,7 +120696,7 @@ var init_bucket_controller = __esm(() => {
     if (!slug2 || !key) {
       throw ApiError.badRequest("Missing game slug or file key");
     }
-    logger34.debug("Deleting file", { userId: ctx.user.id, slug: slug2, key });
+    logger35.debug("Deleting file", { userId: ctx.user.id, slug: slug2, key });
     await ctx.services.bucket.deleteFile(slug2, key, ctx.user);
     return { success: true, key };
   });
@@ -121671,12 +120708,12 @@ var init_bucket_controller = __esm(() => {
     } catch (error2) {
       if (error2 instanceof exports_external.ZodError) {
         const details = formatZodError(error2);
-        logger34.warn("Initiate upload validation failed", { details });
+        logger35.warn("Initiate upload validation failed", { details });
         throw ApiError.unprocessableEntity("Validation failed", details);
       }
       throw ApiError.badRequest("Invalid JSON body");
     }
-    logger34.debug("Initiating multipart upload", {
+    logger35.debug("Initiating multipart upload", {
       userId: ctx.user.id,
       gameId: body2.gameId,
       fileName: body2.fileName
@@ -121691,10 +120728,10 @@ async function listComponents(ctx) {
   if (!isNaN(parsed) && isFinite(parsed)) {
     level = Math.floor(Math.max(0, parsed));
   }
-  logger35.debug("Listing components", { level });
+  logger36.debug("Listing components", { level });
   return ctx.services.character.listAvailableComponents(level);
 }
-var logger35;
+var logger36;
 var get;
 var getByUserId;
 var create;
@@ -121708,9 +120745,9 @@ var init_character_controller = __esm(() => {
   init_src2();
   init_errors();
   init_utils11();
-  logger35 = log.scope("CharacterController");
+  logger36 = log.scope("CharacterController");
   get = requireAuth(async (ctx) => {
-    logger35.debug("Getting character", { userId: ctx.user.id });
+    logger36.debug("Getting character", { userId: ctx.user.id });
     return ctx.services.character.getByUser(ctx.user);
   });
   getByUserId = requireAuth(async (ctx) => {
@@ -121718,7 +120755,7 @@ var init_character_controller = __esm(() => {
     if (!userId) {
       throw ApiError.badRequest("User ID is required in the URL path");
     }
-    logger35.debug("Getting character by user ID", { requestedUserId: userId });
+    logger36.debug("Getting character by user ID", { requestedUserId: userId });
     return ctx.services.character.getByUserId(userId);
   });
   create = requireAuth(async (ctx) => {
@@ -121729,12 +120766,12 @@ var init_character_controller = __esm(() => {
     } catch (error2) {
       if (error2 instanceof exports_external.ZodError) {
         const details = formatZodError(error2);
-        logger35.warn("Create character validation failed", { details });
+        logger36.warn("Create character validation failed", { details });
         throw ApiError.unprocessableEntity("Invalid request body", details);
       }
       throw ApiError.badRequest("Invalid JSON body");
     }
-    logger35.debug("Creating character", {
+    logger36.debug("Creating character", {
       userId: ctx.user.id,
       bodyComponentId: body2.bodyComponentId,
       hairstyleComponentId: body2.hairstyleComponentId
@@ -121749,12 +120786,12 @@ var init_character_controller = __esm(() => {
     } catch (error2) {
       if (error2 instanceof exports_external.ZodError) {
         const details = formatZodError(error2);
-        logger35.warn("Update character validation failed", { details });
+        logger36.warn("Update character validation failed", { details });
         throw ApiError.unprocessableEntity("Invalid request body", details);
       }
       throw ApiError.badRequest("Invalid JSON body");
     }
-    logger35.debug("Updating character", {
+    logger36.debug("Updating character", {
       userId: ctx.user.id,
       bodyComponentId: body2.bodyComponentId,
       hairstyleComponentId: body2.hairstyleComponentId,
@@ -121770,12 +120807,12 @@ var init_character_controller = __esm(() => {
     } catch (error2) {
       if (error2 instanceof exports_external.ZodError) {
         const details = formatZodError(error2);
-        logger35.warn("Equip accessory validation failed", { details });
+        logger36.warn("Equip accessory validation failed", { details });
         throw ApiError.unprocessableEntity("Invalid request body", details);
       }
       throw ApiError.badRequest("Invalid JSON body");
     }
-    logger35.debug("Equipping accessory", {
+    logger36.debug("Equipping accessory", {
       userId: ctx.user.id,
       slot: body2.slot,
       accessoryComponentId: body2.accessoryComponentId
@@ -121787,7 +120824,7 @@ var init_character_controller = __esm(() => {
     if (!slot) {
       throw ApiError.badRequest("Slot is required in the URL path");
     }
-    logger35.debug("Removing accessory", { userId: ctx.user.id, slot });
+    logger36.debug("Removing accessory", { userId: ctx.user.id, slot });
     await ctx.services.character.removeAccessory(slot, ctx.user);
     return { success: true };
   });
@@ -121801,7 +120838,7 @@ var init_character_controller = __esm(() => {
     removeAccessory
   };
 });
-var logger36;
+var logger37;
 var list;
 var getById;
 var create2;
@@ -121815,9 +120852,9 @@ var init_currency_controller = __esm(() => {
   init_src4();
   init_errors();
   init_utils11();
-  logger36 = log.scope("CurrencyController");
+  logger37 = log.scope("CurrencyController");
   list = requireAuth(async (ctx) => {
-    logger36.debug("Listing currencies", { userId: ctx.user.id });
+    logger37.debug("Listing currencies", { userId: ctx.user.id });
     return ctx.services.currency.list();
   });
   getById = requireAuth(async (ctx) => {
@@ -121828,7 +120865,7 @@ var init_currency_controller = __esm(() => {
     if (!isValidUUID(currencyId)) {
       throw ApiError.unprocessableEntity("currencyId must be a valid UUID format");
     }
-    logger36.debug("Getting currency", { userId: ctx.user.id, currencyId });
+    logger37.debug("Getting currency", { userId: ctx.user.id, currencyId });
     return ctx.services.currency.getById(currencyId);
   });
   create2 = requireAdmin(async (ctx) => {
@@ -121839,12 +120876,12 @@ var init_currency_controller = __esm(() => {
     } catch (error2) {
       if (error2 instanceof exports_external.ZodError) {
         const details = formatZodError(error2);
-        logger36.warn("Create currency validation failed", { details });
+        logger37.warn("Create currency validation failed", { details });
         throw ApiError.unprocessableEntity("Validation failed", details);
       }
       throw ApiError.badRequest("Invalid JSON body");
     }
-    logger36.debug("Creating currency", {
+    logger37.debug("Creating currency", {
       userId: ctx.user.id,
       symbol: body2.symbol,
       itemId: body2.itemId,
@@ -121867,12 +120904,12 @@ var init_currency_controller = __esm(() => {
     } catch (error2) {
       if (error2 instanceof exports_external.ZodError) {
         const details = formatZodError(error2);
-        logger36.warn("Update currency validation failed", { details });
+        logger37.warn("Update currency validation failed", { details });
         throw ApiError.unprocessableEntity("Validation failed", details);
       }
       throw ApiError.badRequest("Invalid JSON body");
     }
-    logger36.debug("Updating currency", {
+    logger37.debug("Updating currency", {
       userId: ctx.user.id,
       currencyId,
       symbol: body2.symbol,
@@ -121889,7 +120926,7 @@ var init_currency_controller = __esm(() => {
     if (!isValidUUID(currencyId)) {
       throw ApiError.unprocessableEntity("currencyId must be a valid UUID format");
     }
-    logger36.debug("Deleting currency", { userId: ctx.user.id, currencyId });
+    logger37.debug("Deleting currency", { userId: ctx.user.id, currencyId });
     await ctx.services.currency.delete(currencyId);
   });
   currencyController = {
@@ -121900,7 +120937,7 @@ var init_currency_controller = __esm(() => {
     remove
   };
 });
-var logger37;
+var logger38;
 var reset;
 var init_database_controller = __esm(() => {
   init_esm();
@@ -121908,7 +120945,7 @@ var init_database_controller = __esm(() => {
   init_src2();
   init_errors();
   init_utils11();
-  logger37 = log.scope("DatabaseController");
+  logger38 = log.scope("DatabaseController");
   reset = requireDeveloper(async (ctx) => {
     const slug2 = ctx.params.slug;
     if (!slug2) {
@@ -121921,11 +120958,11 @@ var init_database_controller = __esm(() => {
     } catch (error2) {
       if (error2 instanceof exports_external.ZodError) {
         const details = formatZodError(error2);
-        logger37.warn("Database reset validation failed", { details });
+        logger38.warn("Database reset validation failed", { details });
         throw ApiError.unprocessableEntity("Validation failed", details);
       }
     }
-    logger37.debug("Resetting database", {
+    logger38.debug("Resetting database", {
       userId: ctx.user.id,
       slug: slug2,
       hasSchema: !!body2.schema
@@ -130879,29 +129916,29 @@ var init_zip = __esm(() => {
   init_src2();
   import_jszip = __toESM2(require_lib4(), 1);
 });
-var logger38;
+var logger39;
 var init_deploy_controller = __esm(() => {
   init_schemas_index();
   init_src2();
   init_zip();
   init_errors();
   init_utils11();
-  logger38 = log.scope("DeployController");
+  logger39 = log.scope("DeployController");
 });
-var logger39;
+var logger40;
 var apply;
 var getStatus;
 var developer;
 var init_developer_controller = __esm(() => {
   init_src2();
   init_utils11();
-  logger39 = log.scope("DeveloperController");
+  logger40 = log.scope("DeveloperController");
   apply = requireAuth(async (ctx) => {
-    logger39.debug("Applying for developer status", { userId: ctx.user.id });
+    logger40.debug("Applying for developer status", { userId: ctx.user.id });
     await ctx.services.developer.apply(ctx.user);
   });
   getStatus = requireAuth(async (ctx) => {
-    logger39.debug("Getting developer status", { userId: ctx.user.id });
+    logger40.debug("Getting developer status", { userId: ctx.user.id });
     const status = await ctx.services.developer.getStatus(ctx.user.id);
     return { status };
   });
@@ -130910,7 +129947,7 @@ var init_developer_controller = __esm(() => {
     getStatus
   };
 });
-var logger40;
+var logger41;
 var add;
 var list2;
 var getStatus2;
@@ -130923,7 +129960,7 @@ var init_domain_controller = __esm(() => {
   init_config2();
   init_errors();
   init_utils11();
-  logger40 = log.scope("DomainController");
+  logger41 = log.scope("DomainController");
   add = requireDeveloper(async (ctx) => {
     const slug2 = ctx.params.slug;
     if (!slug2) {
@@ -130936,12 +129973,12 @@ var init_domain_controller = __esm(() => {
     } catch (error2) {
       if (error2 instanceof exports_external.ZodError) {
         const details = formatZodError(error2);
-        logger40.warn("Add domain validation failed", { details });
+        logger41.warn("Add domain validation failed", { details });
         throw ApiError.unprocessableEntity("Validation failed", details);
       }
       throw ApiError.badRequest("Invalid JSON body");
     }
-    logger40.debug("Adding domain", { userId: ctx.user.id, slug: slug2, hostname: body2.hostname });
+    logger41.debug("Adding domain", { userId: ctx.user.id, slug: slug2, hostname: body2.hostname });
     return ctx.services.domain.add(slug2, body2.hostname, body2.environment, ctx.user);
   });
   list2 = requireDeveloper(async (ctx) => {
@@ -130950,7 +129987,7 @@ var init_domain_controller = __esm(() => {
       throw ApiError.badRequest("Missing game slug");
     }
     const environment = getPlatformEnvironment(ctx.config);
-    logger40.debug("Listing domains", { userId: ctx.user.id, slug: slug2, environment });
+    logger41.debug("Listing domains", { userId: ctx.user.id, slug: slug2, environment });
     const domains22 = await ctx.services.domain.list(slug2, environment, ctx.user);
     return { domains: domains22 };
   });
@@ -130965,7 +130002,7 @@ var init_domain_controller = __esm(() => {
     }
     const refresh = ctx.url.searchParams.get("refresh") === "true";
     const environment = getPlatformEnvironment(ctx.config);
-    logger40.debug("Getting domain status", { userId: ctx.user.id, slug: slug2, hostname, refresh });
+    logger41.debug("Getting domain status", { userId: ctx.user.id, slug: slug2, hostname, refresh });
     return ctx.services.domain.getStatus(slug2, hostname, environment, ctx.user, refresh);
   });
   remove2 = requireDeveloper(async (ctx) => {
@@ -130978,7 +130015,7 @@ var init_domain_controller = __esm(() => {
       throw ApiError.badRequest("Missing hostname");
     }
     const environment = ctx.config.stage === "production" ? "production" : "staging";
-    logger40.debug("Removing domain", { userId: ctx.user.id, slug: slug2, hostname, environment });
+    logger41.debug("Removing domain", { userId: ctx.user.id, slug: slug2, hostname, environment });
     await ctx.services.domain.delete(slug2, hostname, environment, ctx.user);
   });
   domains2 = {
@@ -130988,7 +130025,7 @@ var init_domain_controller = __esm(() => {
     remove: remove2
   };
 });
-var logger41;
+var logger42;
 var list3;
 var getById2;
 var getBySlug;
@@ -131002,9 +130039,9 @@ var init_game_controller = __esm(() => {
   init_src4();
   init_errors();
   init_utils11();
-  logger41 = log.scope("GameController");
+  logger42 = log.scope("GameController");
   list3 = requireAuth(async (ctx) => {
-    logger41.debug("Listing games", { userId: ctx.user.id });
+    logger42.debug("Listing games", { userId: ctx.user.id });
     return ctx.services.game.list();
   });
   getById2 = requireAuth(async (ctx) => {
@@ -131015,7 +130052,7 @@ var init_game_controller = __esm(() => {
     if (!isValidUUID(gameId)) {
       throw ApiError.unprocessableEntity("gameId must be a valid UUID format");
     }
-    logger41.debug("Getting game by ID", { userId: ctx.user.id, gameId });
+    logger42.debug("Getting game by ID", { userId: ctx.user.id, gameId });
     return ctx.services.game.getById(gameId);
   });
   getBySlug = requireAuth(async (ctx) => {
@@ -131023,7 +130060,7 @@ var init_game_controller = __esm(() => {
     if (!slug2) {
       throw ApiError.badRequest("Missing game slug");
     }
-    logger41.debug("Getting game by slug", { userId: ctx.user.id, slug: slug2 });
+    logger42.debug("Getting game by slug", { userId: ctx.user.id, slug: slug2 });
     return ctx.services.game.getBySlug(slug2);
   });
   upsertBySlug = requireAuth(async (ctx) => {
@@ -131038,12 +130075,12 @@ var init_game_controller = __esm(() => {
     } catch (error2) {
       if (error2 instanceof exports_external.ZodError) {
         const details = formatZodError(error2);
-        logger41.warn("Upsert game validation failed", { details });
+        logger42.warn("Upsert game validation failed", { details });
         throw ApiError.unprocessableEntity("Validation failed", details);
       }
       throw ApiError.badRequest("Invalid JSON body");
     }
-    logger41.debug("Upserting game", { userId: ctx.user.id, slug: slug2, displayName: body2.displayName });
+    logger42.debug("Upserting game", { userId: ctx.user.id, slug: slug2, displayName: body2.displayName });
     return ctx.services.game.upsertBySlug(slug2, body2, ctx.user);
   });
   remove3 = requireAuth(async (ctx) => {
@@ -131054,7 +130091,7 @@ var init_game_controller = __esm(() => {
     if (!isValidUUID(gameId)) {
       throw ApiError.unprocessableEntity("gameId must be a valid UUID format");
     }
-    logger41.debug("Deleting game", { userId: ctx.user.id, gameId });
+    logger42.debug("Deleting game", { userId: ctx.user.id, gameId });
     await ctx.services.game.delete(gameId, ctx.user);
   });
   games2 = {
@@ -131065,7 +130102,7 @@ var init_game_controller = __esm(() => {
     remove: remove3
   };
 });
-var logger42;
+var logger43;
 var list4;
 var addItem;
 var removeItem;
@@ -131076,9 +130113,9 @@ var init_inventory_controller = __esm(() => {
   init_src2();
   init_errors();
   init_utils11();
-  logger42 = log.scope("InventoryController");
+  logger43 = log.scope("InventoryController");
   list4 = requireAuth(async (ctx) => {
-    logger42.debug("Listing inventory", { userId: ctx.user.id });
+    logger43.debug("Listing inventory", { userId: ctx.user.id });
     return ctx.services.inventory.list(ctx.user);
   });
   addItem = requireAuth(async (ctx) => {
@@ -131089,12 +130126,12 @@ var init_inventory_controller = __esm(() => {
     } catch (error2) {
       if (error2 instanceof exports_external.ZodError) {
         const details = formatZodError(error2);
-        logger42.warn("Add inventory item validation failed", { details });
+        logger43.warn("Add inventory item validation failed", { details });
         throw ApiError.unprocessableEntity("Invalid request body", details);
       }
       throw ApiError.badRequest("Invalid JSON body");
     }
-    logger42.debug("Adding item", {
+    logger43.debug("Adding item", {
       userId: ctx.user.id,
       itemId: body2.itemId,
       qty: body2.qty
@@ -131109,12 +130146,12 @@ var init_inventory_controller = __esm(() => {
     } catch (error2) {
       if (error2 instanceof exports_external.ZodError) {
         const details = formatZodError(error2);
-        logger42.warn("Remove inventory item validation failed", { details });
+        logger43.warn("Remove inventory item validation failed", { details });
         throw ApiError.unprocessableEntity("Invalid request body", details);
       }
       throw ApiError.badRequest("Invalid JSON body");
     }
-    logger42.debug("Removing item", {
+    logger43.debug("Removing item", {
       userId: ctx.user.id,
       itemId: body2.itemId,
       qty: body2.qty
@@ -131127,7 +130164,7 @@ var init_inventory_controller = __esm(() => {
     removeItem
   };
 });
-var logger43;
+var logger44;
 var list5;
 var getById3;
 var resolve2;
@@ -131146,10 +130183,10 @@ var init_item_controller = __esm(() => {
   init_src4();
   init_errors();
   init_utils11();
-  logger43 = log.scope("ItemController");
+  logger44 = log.scope("ItemController");
   list5 = requireAuth(async (ctx) => {
     const gameId = ctx.url.searchParams.get("gameId") || undefined;
-    logger43.debug("Listing items", { userId: ctx.user.id, gameId });
+    logger44.debug("Listing items", { userId: ctx.user.id, gameId });
     return ctx.services.item.list(gameId);
   });
   getById3 = requireAuth(async (ctx) => {
@@ -131160,7 +130197,7 @@ var init_item_controller = __esm(() => {
     if (!isValidUUID(itemId)) {
       throw ApiError.unprocessableEntity("itemId must be a valid UUID format");
     }
-    logger43.debug("Getting item", { userId: ctx.user.id, itemId });
+    logger44.debug("Getting item", { userId: ctx.user.id, itemId });
     return ctx.services.item.getById(itemId);
   });
   resolve2 = requireAuth(async (ctx) => {
@@ -131172,7 +130209,7 @@ var init_item_controller = __esm(() => {
     if (gameId && !isValidUUID(gameId)) {
       throw ApiError.unprocessableEntity("gameId must be a valid UUID format");
     }
-    logger43.debug("Resolving item", { userId: ctx.user.id, slug: slug2, gameId });
+    logger44.debug("Resolving item", { userId: ctx.user.id, slug: slug2, gameId });
     return ctx.services.item.resolveBySlug(slug2, gameId);
   });
   create3 = requireRole(["admin"], async (ctx) => {
@@ -131183,12 +130220,12 @@ var init_item_controller = __esm(() => {
     } catch (error2) {
       if (error2 instanceof exports_external.ZodError) {
         const details = formatZodError(error2);
-        logger43.warn("Create item validation failed", { details });
+        logger44.warn("Create item validation failed", { details });
         throw ApiError.unprocessableEntity("Validation failed", details);
       }
       throw ApiError.badRequest("Invalid JSON body");
     }
-    logger43.debug("Creating item", {
+    logger44.debug("Creating item", {
       userId: ctx.user.id,
       slug: body2.slug,
       displayName: body2.displayName
@@ -131210,7 +130247,7 @@ var init_item_controller = __esm(() => {
     } catch (error2) {
       if (error2 instanceof exports_external.ZodError) {
         const details = formatZodError(error2);
-        logger43.warn("Update item validation failed", { details });
+        logger44.warn("Update item validation failed", { details });
         throw ApiError.unprocessableEntity("Validation failed", details);
       }
       throw ApiError.badRequest("Invalid JSON body");
@@ -131218,7 +130255,7 @@ var init_item_controller = __esm(() => {
     if (Object.keys(body2).length === 0) {
       throw ApiError.badRequest("No update data provided");
     }
-    logger43.debug("Updating item", {
+    logger44.debug("Updating item", {
       userId: ctx.user.id,
       itemId,
       slug: body2.slug,
@@ -131235,7 +130272,7 @@ var init_item_controller = __esm(() => {
     if (!isValidUUID(itemId)) {
       throw ApiError.unprocessableEntity("itemId must be a valid UUID format");
     }
-    logger43.debug("Deleting item", { userId: ctx.user.id, itemId });
+    logger44.debug("Deleting item", { userId: ctx.user.id, itemId });
     await ctx.services.item.delete(itemId);
   });
   listByGame = requireAuth(async (ctx) => {
@@ -131246,7 +130283,7 @@ var init_item_controller = __esm(() => {
     if (!isValidUUID(gameId)) {
       throw ApiError.unprocessableEntity("gameId must be a valid UUID format");
     }
-    logger43.debug("Listing game items", { userId: ctx.user.id, gameId });
+    logger44.debug("Listing game items", { userId: ctx.user.id, gameId });
     return ctx.services.item.listByGame(gameId);
   });
   createForGame = requireAuth(async (ctx) => {
@@ -131264,12 +130301,12 @@ var init_item_controller = __esm(() => {
     } catch (error2) {
       if (error2 instanceof exports_external.ZodError) {
         const details = formatZodError(error2);
-        logger43.warn("Create game item validation failed", { details });
+        logger44.warn("Create game item validation failed", { details });
         throw ApiError.unprocessableEntity("Validation failed", details);
       }
       throw ApiError.badRequest("Invalid JSON body");
     }
-    logger43.debug("Creating game item", {
+    logger44.debug("Creating game item", {
       userId: ctx.user.id,
       gameId,
       slug: body2.slug,
@@ -131296,7 +130333,7 @@ var init_item_controller = __esm(() => {
     } catch (error2) {
       if (error2 instanceof exports_external.ZodError) {
         const details = formatZodError(error2);
-        logger43.warn("Update game item validation failed", { details });
+        logger44.warn("Update game item validation failed", { details });
         throw ApiError.unprocessableEntity("Validation failed", details);
       }
       throw ApiError.badRequest("Invalid JSON body");
@@ -131304,7 +130341,7 @@ var init_item_controller = __esm(() => {
     if (Object.keys(body2).length === 0) {
       throw ApiError.badRequest("No update data provided");
     }
-    logger43.debug("Updating game item", {
+    logger44.debug("Updating game item", {
       userId: ctx.user.id,
       gameId,
       itemId,
@@ -131326,7 +130363,7 @@ var init_item_controller = __esm(() => {
     if (!isValidUUID(itemId)) {
       throw ApiError.unprocessableEntity("itemId must be a valid UUID format");
     }
-    logger43.debug("Deleting game item", { userId: ctx.user.id, gameId, itemId });
+    logger44.debug("Deleting game item", { userId: ctx.user.id, gameId, itemId });
     await ctx.services.item.deleteForGame(gameId, itemId, ctx.user);
   });
   items2 = {
@@ -131342,7 +130379,7 @@ var init_item_controller = __esm(() => {
     deleteForGame
   };
 });
-var logger44;
+var logger45;
 var submitScore;
 var getGlobalLeaderboard;
 var getLeaderboard;
@@ -131357,7 +130394,7 @@ var init_leaderboard_controller = __esm(() => {
   init_src4();
   init_errors();
   init_utils11();
-  logger44 = log.scope("LeaderboardController");
+  logger45 = log.scope("LeaderboardController");
   submitScore = requireAuth(async (ctx) => {
     const gameId = ctx.params.gameId;
     if (!gameId) {
@@ -131370,12 +130407,12 @@ var init_leaderboard_controller = __esm(() => {
     } catch (error2) {
       if (error2 instanceof exports_external.ZodError) {
         const details = formatZodError(error2);
-        logger44.warn("Submit score validation failed", { details });
+        logger45.warn("Submit score validation failed", { details });
         throw ApiError.unprocessableEntity("Validation failed", details);
       }
       throw ApiError.badRequest("Invalid JSON body");
     }
-    logger44.debug("Submitting score", {
+    logger45.debug("Submitting score", {
       userId: ctx.user.id,
       gameId,
       score: body2.score
@@ -131398,12 +130435,12 @@ var init_leaderboard_controller = __esm(() => {
     } catch (error2) {
       if (error2 instanceof exports_external.ZodError) {
         const details = formatZodError(error2);
-        logger44.warn("Get global leaderboard query validation failed", { details });
+        logger45.warn("Get global leaderboard query validation failed", { details });
         throw ApiError.badRequest("Invalid query parameters", details);
       }
       throw ApiError.badRequest("Invalid query parameters");
     }
-    logger44.debug("Getting global leaderboard", {
+    logger45.debug("Getting global leaderboard", {
       userId: ctx.user.id,
       gameId,
       ...query
@@ -131426,12 +130463,12 @@ var init_leaderboard_controller = __esm(() => {
     } catch (error2) {
       if (error2 instanceof exports_external.ZodError) {
         const details = formatZodError(error2);
-        logger44.warn("Get leaderboard query validation failed", { details });
+        logger45.warn("Get leaderboard query validation failed", { details });
         throw ApiError.badRequest("Invalid query parameters", details);
       }
       throw ApiError.badRequest("Invalid query parameters");
     }
-    logger44.debug("Getting leaderboard", {
+    logger45.debug("Getting leaderboard", {
       userId: ctx.user.id,
       gameId,
       ...query
@@ -131446,7 +130483,7 @@ var init_leaderboard_controller = __esm(() => {
     if (!isValidUUID(userId)) {
       throw ApiError.unprocessableEntity("userId must be a valid UUID format");
     }
-    logger44.debug("Getting user rank", {
+    logger45.debug("Getting user rank", {
       requesterId: ctx.user.id,
       gameId,
       targetUserId: userId
@@ -131464,7 +130501,7 @@ var init_leaderboard_controller = __esm(() => {
     const url = ctx.url;
     const limit = Math.min(Number(url.searchParams.get("limit") || "50"), 100);
     const gameId = url.searchParams.get("gameId") || undefined;
-    logger44.debug("Getting user all scores", {
+    logger45.debug("Getting user all scores", {
       requesterId: ctx.user.id,
       targetUserId: userId,
       gameId,
@@ -131482,7 +130519,7 @@ var init_leaderboard_controller = __esm(() => {
     }
     const url = ctx.url;
     const limit = Math.min(Number(url.searchParams.get("limit") || "10"), 100);
-    logger44.debug("Getting user scores", {
+    logger45.debug("Getting user scores", {
       requesterId: ctx.user.id,
       gameId,
       targetUserId: userId,
@@ -131500,7 +130537,7 @@ var init_leaderboard_controller = __esm(() => {
   };
 });
 async function listConfigs(ctx) {
-  logger45.debug("Listing level configs");
+  logger46.debug("Listing level configs");
   return ctx.services.level.listConfigs();
 }
 async function getConfig(ctx) {
@@ -131512,10 +130549,10 @@ async function getConfig(ctx) {
   if (isNaN(level) || level < 1) {
     throw ApiError.badRequest("Level must be a positive integer");
   }
-  logger45.debug("Getting level config", { level });
+  logger46.debug("Getting level config", { level });
   return ctx.services.level.getConfig(level);
 }
-var logger45;
+var logger46;
 var getByUser;
 var getProgress;
 var levels;
@@ -131523,13 +130560,13 @@ var init_level_controller = __esm(() => {
   init_src2();
   init_errors();
   init_utils11();
-  logger45 = log.scope("LevelController");
+  logger46 = log.scope("LevelController");
   getByUser = requireAuth(async (ctx) => {
-    logger45.debug("Getting user level", { userId: ctx.user.id });
+    logger46.debug("Getting user level", { userId: ctx.user.id });
     return ctx.services.level.getByUser(ctx.user);
   });
   getProgress = requireAuth(async (ctx) => {
-    logger45.debug("Getting level progress", { userId: ctx.user.id });
+    logger46.debug("Getting level progress", { userId: ctx.user.id });
     return ctx.services.level.getProgress(ctx.user);
   });
   levels = {
@@ -131539,34 +130576,58 @@ var init_level_controller = __esm(() => {
     getProgress
   };
 });
-async function launch(ctx) {
-  const formData = await ctx.request.formData();
-  const idToken = formData.get("id_token");
-  if (!idToken || typeof idToken !== "string") {
-    throw ApiError.badRequest("Missing or invalid id_token");
-  }
-  const currentHost = ctx.url.hostname;
-  logger46.debug("Processing launch", { host: currentHost });
-  return ctx.services.lti.processLaunch(idToken, currentHost);
-}
-var logger46;
+var logger47;
+var generateToken;
+var logs;
+var init_logs_controller = __esm(() => {
+  init_src2();
+  init_errors();
+  init_utils11();
+  logger47 = log.scope("LogsController");
+  generateToken = requireDeveloper(async (ctx) => {
+    const slug2 = ctx.params.slug;
+    if (!slug2) {
+      throw ApiError.badRequest("Missing game slug");
+    }
+    let body2;
+    try {
+      const json4 = await ctx.request.json();
+      if (json4.environment !== "staging" && json4.environment !== "production") {
+        throw ApiError.badRequest('Invalid environment. Must be "staging" or "production".');
+      }
+      body2 = json4;
+    } catch (error2) {
+      if (error2 instanceof ApiError)
+        throw error2;
+      throw ApiError.badRequest("Invalid JSON body");
+    }
+    logger47.debug("Generating log stream token", {
+      userId: ctx.user.id,
+      slug: slug2,
+      environment: body2.environment
+    });
+    return ctx.services.logs.generateToken(ctx.user, slug2, body2.environment);
+  });
+  logs = {
+    generateToken
+  };
+});
+var logger48;
 var getStatus3;
 var lti;
 var init_lti_controller = __esm(() => {
   init_src2();
-  init_errors();
   init_utils11();
-  logger46 = log.scope("LtiController");
+  logger48 = log.scope("LtiController");
   getStatus3 = requireAuth(async (ctx) => {
-    logger46.debug("Getting status", { userId: ctx.user.id });
+    logger48.debug("Getting status", { userId: ctx.user.id });
     return ctx.services.lti.getStatus(ctx.user);
   });
   lti = {
-    launch,
     getStatus: getStatus3
   };
 });
-var logger47;
+var logger49;
 var getByIdentifier;
 var getElements;
 var getObjects;
@@ -131580,13 +130641,13 @@ var init_map_controller = __esm(() => {
   init_src4();
   init_errors();
   init_utils11();
-  logger47 = log.scope("MapController");
+  logger49 = log.scope("MapController");
   getByIdentifier = requireAuth(async (ctx) => {
     const identifier = ctx.params.identifier;
     if (!identifier) {
       throw ApiError.badRequest("Missing map identifier");
     }
-    logger47.debug("Getting map", { userId: ctx.user.id, identifier });
+    logger49.debug("Getting map", { userId: ctx.user.id, identifier });
     return ctx.services.map.getByIdentifier(identifier);
   });
   getElements = requireAuth(async (ctx) => {
@@ -131597,7 +130658,7 @@ var init_map_controller = __esm(() => {
     if (!isValidUUID(mapId)) {
       throw ApiError.unprocessableEntity("mapId must be a valid UUID format");
     }
-    logger47.debug("Getting map elements", { userId: ctx.user.id, mapId });
+    logger49.debug("Getting map elements", { userId: ctx.user.id, mapId });
     return ctx.services.map.getElements(mapId);
   });
   getObjects = requireAuth(async (ctx) => {
@@ -131608,7 +130669,7 @@ var init_map_controller = __esm(() => {
     if (!isValidUUID(mapId)) {
       throw ApiError.unprocessableEntity("mapId must be a valid UUID format");
     }
-    logger47.debug("Getting map objects", { userId: ctx.user.id, mapId });
+    logger49.debug("Getting map objects", { userId: ctx.user.id, mapId });
     return ctx.services.map.getObjects(mapId, ctx.user.id);
   });
   createObject = requireAuth(async (ctx) => {
@@ -131630,12 +130691,12 @@ var init_map_controller = __esm(() => {
     } catch (error2) {
       if (error2 instanceof exports_external.ZodError) {
         const details = formatZodError(error2);
-        logger47.warn("Create map object validation failed", { details });
+        logger49.warn("Create map object validation failed", { details });
         throw ApiError.unprocessableEntity("Validation failed", details);
       }
       throw ApiError.badRequest("Invalid JSON body");
     }
-    logger47.debug("Creating map object", {
+    logger49.debug("Creating map object", {
       userId: ctx.user.id,
       mapId,
       itemId: body2.itemId,
@@ -131659,7 +130720,7 @@ var init_map_controller = __esm(() => {
     if (!isValidUUID(objectId)) {
       throw ApiError.unprocessableEntity("objectId must be a valid UUID format");
     }
-    logger47.debug("Deleting map object", { userId: ctx.user.id, mapId, objectId });
+    logger49.debug("Deleting map object", { userId: ctx.user.id, mapId, objectId });
     await ctx.services.map.deleteObject(mapId, objectId, ctx.user);
   });
   maps2 = {
@@ -131670,7 +130731,7 @@ var init_map_controller = __esm(() => {
     deleteObject
   };
 });
-var logger48;
+var logger50;
 var list6;
 var updateStatus;
 var getStats;
@@ -131683,7 +130744,7 @@ var init_notification_controller = __esm(() => {
   init_src2();
   init_errors();
   init_utils11();
-  logger48 = log.scope("NotificationController");
+  logger50 = log.scope("NotificationController");
   list6 = requireAuth(async (ctx) => {
     const query = {
       status: ctx.url.searchParams.get("status") || undefined,
@@ -131694,10 +130755,10 @@ var init_notification_controller = __esm(() => {
     const result = NotificationListQuerySchema.omit({ userId: true }).safeParse(query);
     if (!result.success) {
       const details = formatZodError(result.error);
-      logger48.warn("List notifications query validation failed", { details });
+      logger50.warn("List notifications query validation failed", { details });
       throw ApiError.badRequest("Invalid query parameters", details);
     }
-    logger48.debug("Listing notifications", { userId: ctx.user.id, ...result.data });
+    logger50.debug("Listing notifications", { userId: ctx.user.id, ...result.data });
     return ctx.services.notification.list(ctx.user, result.data);
   });
   updateStatus = requireAuth(async (ctx) => {
@@ -131712,12 +130773,12 @@ var init_notification_controller = __esm(() => {
     } catch (error2) {
       if (error2 instanceof exports_external.ZodError) {
         const details = formatZodError(error2);
-        logger48.warn("Update notification status validation failed", { details });
+        logger50.warn("Update notification status validation failed", { details });
         throw ApiError.unprocessableEntity("Invalid request body", details);
       }
       throw ApiError.badRequest("Invalid JSON body");
     }
-    logger48.debug("Updating status", {
+    logger50.debug("Updating status", {
       userId: ctx.user.id,
       notificationId,
       status: body2.status
@@ -131727,7 +130788,7 @@ var init_notification_controller = __esm(() => {
   getStats = requireAuth(async (ctx) => {
     const startDate = ctx.url.searchParams.get("startDate");
     const endDate = ctx.url.searchParams.get("endDate");
-    logger48.debug("Getting stats", { userId: ctx.user.id, startDate, endDate });
+    logger50.debug("Getting stats", { userId: ctx.user.id, startDate, endDate });
     return ctx.services.notification.getStats(ctx.user, {
       startDate: startDate ? new Date(startDate) : undefined,
       endDate: endDate ? new Date(endDate) : undefined
@@ -131741,12 +130802,12 @@ var init_notification_controller = __esm(() => {
     } catch (error2) {
       if (error2 instanceof exports_external.ZodError) {
         const details = formatZodError(error2);
-        logger48.warn("Create notification validation failed", { details });
+        logger50.warn("Create notification validation failed", { details });
         throw ApiError.unprocessableEntity("Invalid request body", details);
       }
       throw ApiError.badRequest("Invalid JSON body");
     }
-    logger48.debug("Creating notification", {
+    logger50.debug("Creating notification", {
       userId: ctx.user.id,
       targetUserId: body2.userId,
       type: body2.type
@@ -131764,12 +130825,12 @@ var init_notification_controller = __esm(() => {
     });
   });
   deliver = requireAuth(async (ctx) => {
-    logger48.debug("Delivering notifications", { userId: ctx.user.id });
+    logger50.debug("Delivering notifications", { userId: ctx.user.id });
     try {
       await ctx.services.notification.deliverPending(ctx.user.id);
       return { success: true };
     } catch (error2) {
-      logger48.error("Failed to deliver notifications", { error: error2 });
+      logger50.error("Failed to deliver notifications", { error: error2 });
       throw ApiError.internal("Failed to deliver notifications");
     }
   });
@@ -131781,28 +130842,27 @@ var init_notification_controller = __esm(() => {
     deliver
   };
 });
-var logger49;
-var generateToken;
+var logger51;
+var generateToken2;
 var realtime;
 var init_realtime_controller = __esm(() => {
   init_src2();
   init_utils11();
-  logger49 = log.scope("RealtimeController");
-  generateToken = requireAuth(async (ctx) => {
+  logger51 = log.scope("RealtimeController");
+  generateToken2 = requireAuth(async (ctx) => {
     const gameIdOrSlug = ctx.params.gameId;
-    logger49.debug("Generating token", {
+    logger51.debug("Generating token", {
       userId: ctx.user.id,
       gameId: gameIdOrSlug || "global"
     });
     return ctx.services.realtime.generateToken(ctx.user, gameIdOrSlug);
   });
   realtime = {
-    generateToken
+    generateToken: generateToken2
   };
 });
-var logger50;
+var logger52;
 var listKeys;
-var getValues;
 var setSecrets;
 var deleteSecret;
 var secrets;
@@ -131812,25 +130872,16 @@ var init_secrets_controller = __esm(() => {
   init_src2();
   init_errors();
   init_utils11();
-  logger50 = log.scope("SecretsController");
+  logger52 = log.scope("SecretsController");
   listKeys = requireDeveloper(async (ctx) => {
     const slug2 = ctx.params.slug;
     if (!slug2) {
       throw ApiError.badRequest("Missing game slug");
     }
-    logger50.debug("Listing secret keys", { userId: ctx.user.id, slug: slug2 });
+    logger52.debug("Listing secret keys", { userId: ctx.user.id, slug: slug2 });
     const keys = await ctx.services.secrets.listKeys(slug2, ctx.user);
     return { keys };
   });
-  getValues = requireDeveloper(async (ctx) => {
-    const slug2 = ctx.params.slug;
-    if (!slug2) {
-      throw ApiError.badRequest("Missing game slug");
-    }
-    logger50.debug("Getting secret values", { userId: ctx.user.id, slug: slug2 });
-    const secrets2 = await ctx.services.secrets.getValues(slug2, ctx.user);
-    return { secrets: secrets2 };
-  });
   setSecrets = requireDeveloper(async (ctx) => {
     const slug2 = ctx.params.slug;
     if (!slug2) {
@@ -131843,12 +130894,12 @@ var init_secrets_controller = __esm(() => {
     } catch (error2) {
       if (error2 instanceof exports_external.ZodError) {
         const details = formatZodError(error2);
-        logger50.warn("Set secrets validation failed", { details });
+        logger52.warn("Set secrets validation failed", { details });
         throw ApiError.unprocessableEntity("Validation failed", details);
       }
       throw ApiError.badRequest("Invalid JSON body");
     }
-    logger50.debug("Setting secrets", {
+    logger52.debug("Setting secrets", {
       userId: ctx.user.id,
       slug: slug2,
       keyCount: Object.keys(body2).length
@@ -131865,18 +130916,17 @@ var init_secrets_controller = __esm(() => {
     if (!key) {
       throw ApiError.badRequest("Missing secret key");
     }
-    logger50.debug("Deleting secret", { userId: ctx.user.id, slug: slug2, key });
+    logger52.debug("Deleting secret", { userId: ctx.user.id, slug: slug2, key });
     await ctx.services.secrets.deleteSecret(slug2, key, ctx.user);
     return { success: true };
   });
   secrets = {
     listKeys,
-    getValues,
     setSecrets,
     deleteSecret
   };
 });
-var logger51;
+var logger53;
 var seed;
 var init_seed_controller = __esm(() => {
   init_esm();
@@ -131884,7 +130934,7 @@ var init_seed_controller = __esm(() => {
   init_src2();
   init_errors();
   init_utils11();
-  logger51 = log.scope("SeedController");
+  logger53 = log.scope("SeedController");
   seed = requireDeveloper(async (ctx) => {
     const slug2 = ctx.params.slug;
     if (!slug2) {
@@ -131897,16 +130947,16 @@ var init_seed_controller = __esm(() => {
     } catch (error2) {
       if (error2 instanceof exports_external.ZodError) {
         const details = formatZodError(error2);
-        logger51.warn("Seed database validation failed", { details });
+        logger53.warn("Seed database validation failed", { details });
         throw ApiError.unprocessableEntity("Validation failed", details);
       }
       throw ApiError.badRequest("Invalid JSON body");
     }
-    logger51.debug("Seeding database", { userId: ctx.user.id, slug: slug2, codeLength: body2.code.length });
+    logger53.debug("Seeding database", { userId: ctx.user.id, slug: slug2, codeLength: body2.code.length });
     return ctx.services.seed.seed(slug2, body2.code, ctx.user);
   });
 });
-var logger52;
+var logger54;
 var start2;
 var end;
 var mintToken;
@@ -131915,13 +130965,13 @@ var init_session_controller = __esm(() => {
   init_src2();
   init_errors();
   init_utils11();
-  logger52 = log.scope("SessionController");
+  logger54 = log.scope("SessionController");
   start2 = requireAuth(async (ctx) => {
     const gameIdOrSlug = ctx.params.gameId;
     if (!gameIdOrSlug) {
       throw ApiError.badRequest("Missing game ID or slug");
     }
-    logger52.debug("Starting session", { userId: ctx.user.id, gameIdOrSlug });
+    logger54.debug("Starting session", { userId: ctx.user.id, gameIdOrSlug });
     return ctx.services.session.start(gameIdOrSlug, ctx.user.id);
   });
   end = requireAuth(async (ctx) => {
@@ -131933,7 +130983,7 @@ var init_session_controller = __esm(() => {
     if (!sessionId) {
       throw ApiError.badRequest("Missing session ID");
     }
-    logger52.debug("Ending session", { userId: ctx.user.id, gameIdOrSlug, sessionId });
+    logger54.debug("Ending session", { userId: ctx.user.id, gameIdOrSlug, sessionId });
     return ctx.services.session.end(gameIdOrSlug, sessionId, ctx.user.id);
   });
   mintToken = requireAuth(async (ctx) => {
@@ -131941,7 +130991,7 @@ var init_session_controller = __esm(() => {
     if (!gameIdOrSlug) {
       throw ApiError.badRequest("Missing game ID or slug");
     }
-    logger52.debug("Minting token", { userId: ctx.user.id, gameIdOrSlug });
+    logger54.debug("Minting token", { userId: ctx.user.id, gameIdOrSlug });
     return ctx.services.session.mintToken(gameIdOrSlug, ctx.user.id);
   });
   sessions2 = {
@@ -131950,22 +131000,22 @@ var init_session_controller = __esm(() => {
     mintToken
   };
 });
-var logger53;
+var logger55;
 var getShopView;
 var shop;
 var init_shop_controller = __esm(() => {
   init_src2();
   init_utils11();
-  logger53 = log.scope("ShopController");
+  logger55 = log.scope("ShopController");
   getShopView = requireAuth(async (ctx) => {
-    logger53.debug("Getting shop view", { userId: ctx.user.id });
+    logger55.debug("Getting shop view", { userId: ctx.user.id });
     return ctx.services.shop.getShopView(ctx.user);
   });
   shop = {
     getShopView
   };
 });
-var logger54;
+var logger56;
 var list7;
 var getById4;
 var create5;
@@ -131984,9 +131034,9 @@ var init_shop_listing_controller = __esm(() => {
   init_src4();
   init_errors();
   init_utils11();
-  logger54 = log.scope("ShopListingController");
+  logger56 = log.scope("ShopListingController");
   list7 = requireAdmin(async (ctx) => {
-    logger54.debug("Listing shop listings", { userId: ctx.user.id });
+    logger56.debug("Listing shop listings", { userId: ctx.user.id });
     return ctx.services.shopListing.list();
   });
   getById4 = requireAdmin(async (ctx) => {
@@ -131997,7 +131047,7 @@ var init_shop_listing_controller = __esm(() => {
     if (!isValidUUID(listingId)) {
       throw ApiError.unprocessableEntity("listingId must be a valid UUID format");
     }
-    logger54.debug("Getting listing", { userId: ctx.user.id, listingId });
+    logger56.debug("Getting listing", { userId: ctx.user.id, listingId });
     return ctx.services.shopListing.getById(listingId);
   });
   create5 = requireAdmin(async (ctx) => {
@@ -132008,12 +131058,12 @@ var init_shop_listing_controller = __esm(() => {
     } catch (error2) {
       if (error2 instanceof exports_external.ZodError) {
         const details = formatZodError(error2);
-        logger54.warn("Create shop listing validation failed", { details });
+        logger56.warn("Create shop listing validation failed", { details });
         throw ApiError.unprocessableEntity("Validation failed", details);
       }
       throw ApiError.badRequest("Invalid JSON body");
     }
-    logger54.debug("Creating listing", {
+    logger56.debug("Creating listing", {
       userId: ctx.user.id,
       itemId: body2.itemId,
       currencyId: body2.currencyId,
@@ -132036,12 +131086,12 @@ var init_shop_listing_controller = __esm(() => {
     } catch (error2) {
       if (error2 instanceof exports_external.ZodError) {
         const details = formatZodError(error2);
-        logger54.warn("Update shop listing validation failed", { details });
+        logger56.warn("Update shop listing validation failed", { details });
         throw ApiError.unprocessableEntity("Validation failed", details);
       }
       throw ApiError.badRequest("Invalid JSON body");
     }
-    logger54.debug("Updating listing", {
+    logger56.debug("Updating listing", {
       userId: ctx.user.id,
       listingId,
       price: body2.price,
@@ -132058,7 +131108,7 @@ var init_shop_listing_controller = __esm(() => {
     if (!isValidUUID(listingId)) {
       throw ApiError.unprocessableEntity("listingId must be a valid UUID format");
     }
-    logger54.debug("Deleting listing", { userId: ctx.user.id, listingId });
+    logger56.debug("Deleting listing", { userId: ctx.user.id, listingId });
     await ctx.services.shopListing.delete(listingId);
   });
   listByGame2 = requireAuth(async (ctx) => {
@@ -132069,7 +131119,7 @@ var init_shop_listing_controller = __esm(() => {
     if (!isValidUUID(gameId)) {
       throw ApiError.unprocessableEntity("gameId must be a valid UUID format");
     }
-    logger54.debug("Listing game listings", { userId: ctx.user.id, gameId });
+    logger56.debug("Listing game listings", { userId: ctx.user.id, gameId });
     return ctx.services.shopListing.listByGame(gameId, ctx.user);
   });
   getByGameItem = requireAuth(async (ctx) => {
@@ -132084,7 +131134,7 @@ var init_shop_listing_controller = __esm(() => {
     if (!isValidUUID(itemId)) {
       throw ApiError.unprocessableEntity("itemId must be a valid UUID format");
     }
-    logger54.debug("Getting game item listing", { userId: ctx.user.id, gameId, itemId });
+    logger56.debug("Getting game item listing", { userId: ctx.user.id, gameId, itemId });
     return ctx.services.shopListing.getByGameItem(gameId, itemId, ctx.user);
   });
   createForGameItem = requireAuth(async (ctx) => {
@@ -132106,12 +131156,12 @@ var init_shop_listing_controller = __esm(() => {
     } catch (error2) {
       if (error2 instanceof exports_external.ZodError) {
         const details = formatZodError(error2);
-        logger54.warn("Create game item listing validation failed", { details });
+        logger56.warn("Create game item listing validation failed", { details });
         throw ApiError.unprocessableEntity("Validation failed", details);
       }
       throw ApiError.badRequest("Invalid JSON body");
     }
-    logger54.debug("Creating game item listing", {
+    logger56.debug("Creating game item listing", {
       userId: ctx.user.id,
       gameId,
       itemId,
@@ -132139,12 +131189,12 @@ var init_shop_listing_controller = __esm(() => {
     } catch (error2) {
       if (error2 instanceof exports_external.ZodError) {
         const details = formatZodError(error2);
-        logger54.warn("Update game item listing validation failed", { details });
+        logger56.warn("Update game item listing validation failed", { details });
         throw ApiError.unprocessableEntity("Validation failed", details);
       }
       throw ApiError.badRequest("Invalid JSON body");
     }
-    logger54.debug("Updating game item listing", {
+    logger56.debug("Updating game item listing", {
       userId: ctx.user.id,
       gameId,
       itemId,
@@ -132166,7 +131216,7 @@ var init_shop_listing_controller = __esm(() => {
     if (!isValidUUID(itemId)) {
       throw ApiError.unprocessableEntity("itemId must be a valid UUID format");
     }
-    logger54.debug("Deleting game item listing", {
+    logger56.debug("Deleting game item listing", {
       userId: ctx.user.id,
       gameId,
       itemId
@@ -132191,20 +131241,20 @@ async function getBySlug2(ctx) {
   if (!slug2) {
     throw ApiError.badRequest("Template slug is required");
   }
-  logger55.debug("Getting sprite by slug", { slug: slug2 });
+  logger57.debug("Getting sprite by slug", { slug: slug2 });
   return ctx.services.sprite.getBySlug(slug2);
 }
-var logger55;
+var logger57;
 var sprites;
 var init_sprite_controller = __esm(() => {
   init_src2();
   init_errors();
-  logger55 = log.scope("SpriteController");
+  logger57 = log.scope("SpriteController");
   sprites = {
     getBySlug: getBySlug2
   };
 });
-var logger56;
+var logger58;
 var getTodayXp;
 var getTotalXp;
 var updateTodayXp;
@@ -132226,15 +131276,15 @@ var init_timeback_controller = __esm(() => {
   init_src4();
   init_errors();
   init_utils11();
-  logger56 = log.scope("TimebackController");
+  logger58 = log.scope("TimebackController");
   getTodayXp = requireAuth(async (ctx) => {
     const date4 = ctx.url.searchParams.get("date") || undefined;
     const tz = ctx.url.searchParams.get("tz") || undefined;
-    logger56.debug("Getting today XP", { userId: ctx.user.id, date: date4, tz });
+    logger58.debug("Getting today XP", { userId: ctx.user.id, date: date4, tz });
     return ctx.services.timeback.getTodayXp(ctx.user.id, date4, tz);
   });
   getTotalXp = requireAuth(async (ctx) => {
-    logger56.debug("Getting total XP", { userId: ctx.user.id });
+    logger58.debug("Getting total XP", { userId: ctx.user.id });
     return ctx.services.timeback.getTotalXp(ctx.user.id);
   });
   updateTodayXp = requireAuth(async (ctx) => {
@@ -132245,18 +131295,18 @@ var init_timeback_controller = __esm(() => {
     } catch (error2) {
       if (error2 instanceof exports_external.ZodError) {
         const details = formatZodError(error2);
-        logger56.warn("Update today XP validation failed", { details });
+        logger58.warn("Update today XP validation failed", { details });
         throw ApiError.unprocessableEntity("Validation failed", details);
       }
       throw ApiError.badRequest("Invalid JSON body");
     }
-    logger56.debug("Updating today XP", { userId: ctx.user.id, xp: body2.xp });
+    logger58.debug("Updating today XP", { userId: ctx.user.id, xp: body2.xp });
     return ctx.services.timeback.updateTodayXp(ctx.user.id, body2);
   });
   getXpHistory = requireAuth(async (ctx) => {
     const startDate = ctx.url.searchParams.get("startDate") || undefined;
     const endDate = ctx.url.searchParams.get("endDate") || undefined;
-    logger56.debug("Getting XP history", { userId: ctx.user.id, startDate, endDate });
+    logger58.debug("Getting XP history", { userId: ctx.user.id, startDate, endDate });
     return ctx.services.timeback.getXpHistory(ctx.user.id, startDate, endDate);
   });
   populateStudent = requireAuth(async (ctx) => {
@@ -132267,18 +131317,18 @@ var init_timeback_controller = __esm(() => {
     } catch (error2) {
       if (error2 instanceof exports_external.ZodError) {
         const details = formatZodError(error2);
-        logger56.warn("Populate student validation failed", { details });
+        logger58.warn("Populate student validation failed", { details });
         throw ApiError.unprocessableEntity("Validation failed", details);
       }
     }
-    logger56.debug("Populating student", {
+    logger58.debug("Populating student", {
       userId: ctx.user.id,
       hasProvidedNames: !!providedNames
     });
     return ctx.services.timeback.populateStudent(ctx.user, providedNames);
   });
   getUser = requireAuth(async (ctx) => {
-    logger56.debug("Getting user", { userId: ctx.user.id, gameId: ctx.gameId });
+    logger58.debug("Getting user", { userId: ctx.user.id, gameId: ctx.gameId });
     return ctx.services.timeback.getUserData(ctx.user.id, ctx.gameId);
   });
   getUserById = requireAuth(async (ctx) => {
@@ -132286,7 +131336,7 @@ var init_timeback_controller = __esm(() => {
     if (!timebackId) {
       throw ApiError.badRequest("Missing timebackId parameter");
     }
-    logger56.debug("Getting user by ID", { requesterId: ctx.user.id, timebackId });
+    logger58.debug("Getting user by ID", { requesterId: ctx.user.id, timebackId });
     return ctx.services.timeback.getUserDataByTimebackId(timebackId);
   });
   setupIntegration = requireDeveloper(async (ctx) => {
@@ -132297,12 +131347,12 @@ var init_timeback_controller = __esm(() => {
     } catch (error2) {
       if (error2 instanceof exports_external.ZodError) {
         const details = formatZodError(error2);
-        logger56.warn("Setup integration validation failed", { details });
+        logger58.warn("Setup integration validation failed", { details });
         throw ApiError.unprocessableEntity("Validation failed", details);
       }
       throw ApiError.badRequest("Invalid JSON body");
     }
-    logger56.debug("Setting up integration", {
+    logger58.debug("Setting up integration", {
       userId: ctx.user.id,
       gameId: body2.gameId
     });
@@ -132314,7 +131364,7 @@ var init_timeback_controller = __esm(() => {
       throw ApiError.badRequest("Missing gameId");
     if (!isValidUUID(gameId))
       throw ApiError.unprocessableEntity("Invalid gameId format");
-    logger56.debug("Getting integrations", { userId: ctx.user.id, gameId });
+    logger58.debug("Getting integrations", { userId: ctx.user.id, gameId });
     return ctx.services.timeback.getIntegrations(gameId, ctx.user);
   });
   verifyIntegration = requireDeveloper(async (ctx) => {
@@ -132323,7 +131373,7 @@ var init_timeback_controller = __esm(() => {
       throw ApiError.badRequest("Missing gameId");
     if (!isValidUUID(gameId))
       throw ApiError.unprocessableEntity("Invalid gameId format");
-    logger56.debug("Verifying integration", { userId: ctx.user.id, gameId });
+    logger58.debug("Verifying integration", { userId: ctx.user.id, gameId });
     return ctx.services.timeback.verifyIntegration(gameId, ctx.user);
   });
   getConfig2 = requireDeveloper(async (ctx) => {
@@ -132332,7 +131382,7 @@ var init_timeback_controller = __esm(() => {
       throw ApiError.badRequest("Missing gameId");
     if (!isValidUUID(gameId))
       throw ApiError.unprocessableEntity("Invalid gameId format");
-    logger56.debug("Getting config", { userId: ctx.user.id, gameId });
+    logger58.debug("Getting config", { userId: ctx.user.id, gameId });
     return ctx.services.timeback.getConfig(gameId, ctx.user);
   });
   deleteIntegrations = requireDeveloper(async (ctx) => {
@@ -132341,7 +131391,7 @@ var init_timeback_controller = __esm(() => {
       throw ApiError.badRequest("Missing gameId");
     if (!isValidUUID(gameId))
       throw ApiError.unprocessableEntity("Invalid gameId format");
-    logger56.debug("Deleting integrations", { userId: ctx.user.id, gameId });
+    logger58.debug("Deleting integrations", { userId: ctx.user.id, gameId });
     await ctx.services.timeback.deleteIntegrations(gameId, ctx.user);
   });
   endActivity = requireDeveloper(async (ctx) => {
@@ -132352,13 +131402,13 @@ var init_timeback_controller = __esm(() => {
     } catch (error2) {
       if (error2 instanceof exports_external.ZodError) {
         const details = formatZodError(error2);
-        logger56.warn("End activity validation failed", { details });
+        logger58.warn("End activity validation failed", { details });
         throw ApiError.unprocessableEntity("Validation failed", details);
       }
       throw ApiError.badRequest("Invalid JSON body");
     }
     const { gameId, studentId, activityData, scoreData, timingData, xpEarned, masteredUnits } = body2;
-    logger56.debug("Ending activity", { userId: ctx.user.id, gameId });
+    logger58.debug("Ending activity", { userId: ctx.user.id, gameId });
     return ctx.services.timeback.endActivity(gameId, studentId, activityData, scoreData, timingData, xpEarned, masteredUnits, ctx.user);
   });
   timeback2 = {
@@ -132377,7 +131427,7 @@ var init_timeback_controller = __esm(() => {
     endActivity
   };
 });
-var logger57;
+var logger59;
 var initiate;
 var init_upload_controller = __esm(() => {
   init_esm();
@@ -132385,7 +131435,7 @@ var init_upload_controller = __esm(() => {
   init_src2();
   init_errors();
   init_utils11();
-  logger57 = log.scope("UploadController");
+  logger59 = log.scope("UploadController");
   initiate = requireDeveloper(async (ctx) => {
     let body2;
     try {
@@ -132394,37 +131444,37 @@ var init_upload_controller = __esm(() => {
     } catch (error2) {
       if (error2 instanceof exports_external.ZodError) {
         const details = formatZodError(error2);
-        logger57.warn("Initiate upload validation failed", { details });
+        logger59.warn("Initiate upload validation failed", { details });
         throw ApiError.unprocessableEntity("Validation failed", details);
       }
       throw ApiError.badRequest("Invalid JSON body");
     }
-    logger57.debug("Initiating upload", { userId: ctx.user.id, gameId: body2.gameId });
+    logger59.debug("Initiating upload", { userId: ctx.user.id, gameId: body2.gameId });
     return ctx.services.upload.initiate(body2, ctx.user);
   });
 });
-var logger58;
+var logger60;
 var getMe;
 var users2;
 var init_user_controller = __esm(() => {
   init_src2();
   init_utils11();
-  logger58 = log.scope("UserController");
+  logger60 = log.scope("UserController");
   getMe = requireAuth(async (ctx) => {
-    logger58.debug("Getting current user", { userId: ctx.user.id, gameId: ctx.gameId });
+    logger60.debug("Getting current user", { userId: ctx.user.id, gameId: ctx.gameId });
     return ctx.services.user.getMe(ctx.user, ctx.gameId);
   });
   users2 = {
     getMe
   };
 });
-var logger59;
+var logger61;
 var init_verify_controller = __esm(() => {
   init_schemas_index();
   init_src2();
   init_errors();
   init_utils11();
-  logger59 = log.scope("VerifyController");
+  logger61 = log.scope("VerifyController");
 });
 var init_controllers = __esm(() => {
   init_achievement_controller();
@@ -132441,6 +131491,7 @@ var init_controllers = __esm(() => {
   init_item_controller();
   init_leaderboard_controller();
   init_level_controller();
+  init_logs_controller();
   init_lti_controller();
   init_map_controller();
   init_notification_controller();
@@ -132931,6 +131982,14 @@ var init_items = __esm(() => {
   gameItemsRouter.patch("/:gameId/items/:itemId", handle2(items2.updateForGame));
   gameItemsRouter.delete("/:gameId/items/:itemId", handle2(items2.deleteForGame, { status: 204 }));
 });
+var gameLogsRouter;
+var init_logs = __esm(() => {
+  init_dist3();
+  init_controllers();
+  init_api();
+  gameLogsRouter = new Hono2;
+  gameLogsRouter.post("/:slug/logs/token", handle2(logs.generateToken));
+});
 var gameScoresRouter;
 var init_scores = __esm(() => {
   init_dist3();
@@ -132947,7 +132006,6 @@ var init_secrets = __esm(() => {
   init_api();
   gameSecretsRouter = new Hono2;
   gameSecretsRouter.get("/:slug/secrets", handle2(secrets.listKeys));
-  gameSecretsRouter.get("/:slug/secrets/values", handle2(secrets.getValues));
   gameSecretsRouter.post("/:slug/secrets", handle2(secrets.setSecrets));
   gameSecretsRouter.delete("/:slug/secrets/:key", handle2(secrets.deleteSecret));
 });
@@ -133231,6 +132289,7 @@ var init_games2 = __esm(() => {
   init_deploy();
   init_domains3();
   init_items();
+  init_logs();
   init_scores();
   init_secrets();
   init_seed2();
@@ -133246,6 +132305,7 @@ var init_games2 = __esm(() => {
   gamesRouter.route("/", gameDeployRouter);
   gamesRouter.route("/", gameDomainsRouter);
   gamesRouter.route("/", gameItemsRouter);
+  gamesRouter.route("/", gameLogsRouter);
   gamesRouter.route("/", gameShopRouter);
   gamesRouter.route("/", gameScoresRouter);
   gamesRouter.route("/", gameSecretsRouter);
@@ -133441,51 +132501,86 @@ var init_timeback6 = __esm(() => {
     return handle2(timeback2.getUserById)(c2);
   });
 });
+function verifyMockToken(idToken) {
+  if (!idToken.startsWith("mock:")) {
+    throw new Error("Invalid LTI token - must be mock token in sandbox");
+  }
+  try {
+    const jsonStr = Buffer.from(idToken.slice(5), "base64").toString();
+    return JSON.parse(jsonStr);
+  } catch {
+    throw new Error("Invalid LTI token format");
+  }
+}
+var logger62;
 var ltiRouter;
 var init_lti = __esm(() => {
   init_drizzle_orm();
   init_dist3();
   init_controllers();
-  init_errors();
+  init_utils11();
   init_tables_index();
+  init_src2();
   init_constants();
   init_api();
-  init_context();
+  logger62 = log.scope("SandboxLti");
   ltiRouter = new Hono2;
-  ltiRouter.all("/launch", async (c2) => {
-    if (c2.req.method !== "POST") {
-      return c2.json({
-        error: "method_not_allowed",
-        message: "LTI launches must use POST method"
-      }, 405);
-    }
-    const sandboxCtx = getSandboxContext();
-    const ctx = {
-      db: sandboxCtx.db,
-      config: sandboxCtx.config,
-      providers: sandboxCtx.providers,
-      services: sandboxCtx.services,
-      user: undefined,
-      params: {},
-      url: new URL(c2.req.url),
-      request: c2.req.raw
-    };
+  ltiRouter.post("/launch", async (c2) => {
+    const db2 = c2.get("db");
     try {
-      const result = await lti.launch(ctx);
-      c2.header("Set-Cookie", `better-auth.session=${result.sessionToken}; Path=/; HttpOnly; SameSite=Lax; Max-Age=2592000`);
-      return c2.redirect(result.redirectPath);
-    } catch (error2) {
-      if (error2 instanceof ApiError) {
+      const formData = await c2.req.formData();
+      const idToken = formData.get("id_token");
+      if (!idToken || typeof idToken !== "string") {
         return c2.json({
-          error: "lti_launch_failed",
-          message: error2.message,
-          code: error2.code,
-          details: error2.details
-        }, error2.status);
+          error: "missing_token",
+          message: "Missing or invalid id_token in request"
+        }, 400);
       }
+      let claims;
+      try {
+        claims = verifyMockToken(idToken);
+      } catch (error2) {
+        const errorMessage = error2 instanceof Error ? error2.message : String(error2);
+        logger62.error("LTI token verification failed", { error: errorMessage });
+        return c2.json({
+          error: "invalid_token",
+          message: errorMessage
+        }, 401);
+      }
+      const validationError = validateLtiClaims(claims);
+      if (validationError) {
+        logger62.warn("LTI claims validation failed", {
+          error: validationError,
+          sub: claims.sub
+        });
+        return c2.json({
+          error: "invalid_claims",
+          message: validationError
+        }, 400);
+      }
+      const user = await provisionLtiUser(db2, claims);
+      const sessionToken = crypto.randomUUID();
+      const expiresAt = new Date(Date.now() + 2592000000);
+      await db2.insert(sessions).values({
+        id: crypto.randomUUID(),
+        userId: user.id,
+        token: sessionToken,
+        expiresAt,
+        createdAt: new Date,
+        updatedAt: new Date
+      });
+      logger62.info("LTI launch successful", { userId: user.id });
+      const targetUri = claims["https://purl.imsglobal.org/spec/lti/claim/target_link_uri"];
+      const currentHost = new URL(c2.req.url).hostname;
+      const redirectPath = extractRedirectPath(targetUri, currentHost);
+      c2.header("Set-Cookie", `sandbox-session=${sessionToken}; Path=/; HttpOnly; SameSite=Lax; Max-Age=2592000`);
+      return c2.redirect(redirectPath);
+    } catch (error2) {
+      const errorMessage = error2 instanceof Error ? error2.message : String(error2);
+      logger62.error("Unexpected error during LTI launch", { error: errorMessage });
       return c2.json({
         error: "unexpected_error",
-        message: "An unexpected error occurred during LTI launch. Please try again or contact support."
+        message: "An unexpected error occurred during LTI launch"
       }, 500);
     }
   });
@@ -133609,7 +132704,6 @@ async function startServer(port, project, options = {}) {
   resetSandboxContext();
   resetHandlers();
   clearSandboxCache();
-  clearSandboxSecrets();
   clearSandboxStorage();
   const db2 = await setupServerDatabase(processedOptions, project);
   createSandboxContext({ db: db2, port });
@@ -133636,7 +132730,6 @@ async function startServer(port, project, options = {}) {
       resetSandboxContext();
       resetHandlers();
       clearSandboxCache();
-      clearSandboxSecrets();
       clearSandboxStorage();
     }
   };
@@ -134819,7 +133912,7 @@ var import_picocolors12 = __toESM(require_picocolors(), 1);
 // package.json
 var package_default2 = {
   name: "@playcademy/vite-plugin",
-  version: "0.2.6",
+  version: "0.2.8",
   type: "module",
   exports: {
     ".": {