@playcademy/vite-plugin 1.0.1-beta.4 → 1.1.0-beta.1

package/dist/index.js

@@ -23746,7 +23746,7 @@ import path from "node:path";
 // package.json
 var package_default = {
   name: "@playcademy/vite-plugin",
-  version: "1.0.1-beta.4",
+  version: "1.1.0-beta.1",
   type: "module",
   exports: {
     ".": {
@@ -23974,6 +23974,172 @@ function configResolvedHook(resolvedConfig, context) {
 // src/hooks/configure-server.ts
 import { DEFAULT_PORTS as DEFAULT_PORTS3 } from "playcademy/constants";
 
+// src/lib/assets/index.ts
+var import_picocolors4 = __toESM(require_picocolors(), 1);
+import {
+  ASSET_DEV_ROUTE_PREFIX,
+  hasCustomAssetsRoute,
+  openLocalAssetBucket,
+  readLocalAsset,
+  readLocalManifestScript
+} from "playcademy/bucket";
+import { loadPlaycademyConfig } from "playcademy/utils";
+
+// ../utils/src/vite-logger.ts
+var import_picocolors2 = __toESM(require_picocolors(), 1);
+var { bold, cyan, dim } = import_picocolors2.default;
+function formatTimestamp() {
+  const now = new Date;
+  const hours = now.getHours();
+  const minutes = now.getMinutes().toString().padStart(2, "0");
+  const seconds = now.getSeconds().toString().padStart(2, "0");
+  const ampm = hours >= 12 ? "PM" : "AM";
+  const displayHours = hours % 12 || 12;
+  return dim(`${displayHours}:${minutes}:${seconds} ${ampm}`);
+}
+function createLogPrefix(entity, domain) {
+  const timestamp = formatTimestamp();
+  const label = bold(cyan(`[${entity}]`));
+  if (domain) {
+    return `${timestamp} ${label} ${dim(`(${domain})`)}`;
+  }
+  return `${timestamp} ${label}`;
+}
+
+// src/lib/logging/adapter.ts
+function createLoggerAdapter(domain) {
+  return {
+    info: (msg) => console.log(`${createLogPrefix("playcademy", domain)} ${msg}`),
+    warn: (msg) => console.warn(`${createLogPrefix("playcademy", domain)} ${msg}`),
+    error: (msg) => console.error(`${createLogPrefix("playcademy", domain)} ${msg}`)
+  };
+}
+// src/lib/logging/utils.ts
+var import_picocolors3 = __toESM(require_picocolors(), 1);
+
+// ../utils/src/string.ts
+function pluralize(count, singular, pluralForm) {
+  return count === 1 ? singular : pluralForm || `${singular}s`;
+}
+
+// src/lib/logging/utils.ts
+function createBackendBannerOptions(backendPort, vitePort) {
+  if (!backendPort) {
+    return;
+  }
+  return { port: backendPort, vitePort };
+}
+function createTimebackBannerOptions(timebackMode, courseCount, enrolledCount) {
+  if (!timebackMode || !courseCount) {
+    return;
+  }
+  return {
+    courseCount,
+    enrolledCount: enrolledCount ?? courseCount,
+    mode: timebackMode
+  };
+}
+function printBanner(viteConfig, options) {
+  const INDENT = " ".repeat(2);
+  const { version, gameName, sandbox, backend, timeback } = options;
+  viteConfig.logger.info("");
+  viteConfig.logger.info(`${INDENT}${import_picocolors3.green(import_picocolors3.bold("PLAYCADEMY"))} ${import_picocolors3.green(`v${version}`)}`);
+  viteConfig.logger.info("");
+  if (gameName) {
+    viteConfig.logger.info(`${INDENT}${import_picocolors3.green("➜")}  ${import_picocolors3.bold("Project:")}  ${import_picocolors3.cyan(gameName)}`);
+  }
+  if (sandbox?.enabled) {
+    viteConfig.logger.info(`${INDENT}${import_picocolors3.green("➜")}  ${import_picocolors3.bold("Sandbox:")}  ${import_picocolors3.cyan(`http://localhost:${import_picocolors3.bold(sandbox.port.toString())}/api`)}`);
+  } else if (sandbox) {
+    viteConfig.logger.info(`${INDENT}${import_picocolors3.green("➜")}  ${import_picocolors3.bold("Sandbox:")}  ${import_picocolors3.cyan("Disabled")}`);
+  }
+  if (backend) {
+    const backendUrl = backend.vitePort ? `http://localhost:${import_picocolors3.bold(backend.vitePort.toString())}/api ${import_picocolors3.dim(`(via ${backend.port})`)}` : `http://localhost:${import_picocolors3.bold(backend.port.toString())}/api`;
+    viteConfig.logger.info(`${INDENT}${import_picocolors3.green("➜")}  ${import_picocolors3.bold("Backend:")}  ${import_picocolors3.cyan(backendUrl)}`);
+  }
+  if (timeback && timeback.courseCount > 0) {
+    const enrollmentInfo = timeback.enrolledCount !== timeback.courseCount ? ` / ${timeback.enrolledCount} enrolled` : "";
+    const label = `${timeback.courseCount} ${pluralize(timeback.courseCount, "course")}${enrollmentInfo} ${import_picocolors3.dim(`(${timeback.mode})`)}`;
+    viteConfig.logger.info(`${INDENT}${import_picocolors3.green("➜")}  ${import_picocolors3.bold("Timeback:")} ${import_picocolors3.cyan(label)}`);
+  }
+  viteConfig.logger.info("");
+}
+// src/lib/assets/index.ts
+var logger = createLoggerAdapter("assets");
+async function loadConfigSafely(configPath) {
+  try {
+    return await loadPlaycademyConfig(configPath);
+  } catch {
+    return null;
+  }
+}
+var session = null;
+var hasWarnedNoManifest = false;
+async function getBucket() {
+  if (!session) {
+    session = await openLocalAssetBucket();
+  }
+  return session.bucket;
+}
+async function disposeAssetBucket() {
+  if (session) {
+    await session.dispose();
+    session = null;
+  }
+  hasWarnedNoManifest = false;
+}
+async function getDevManifestScript(configPath) {
+  const config = await loadConfigSafely(configPath);
+  if (!config?.integrations?.bucket) {
+    return null;
+  }
+  const script = await readLocalManifestScript(await getBucket());
+  if (!script) {
+    if (!hasWarnedNoManifest) {
+      hasWarnedNoManifest = true;
+      logger.warn(`No local asset manifest found (run ${import_picocolors4.greenBright("playcademy bucket sync")} to serve bucket assets in local dev)`);
+    }
+    return null;
+  }
+  return script;
+}
+async function registerAssetMiddleware(server, projectRoot, configPath) {
+  const config = await loadConfigSafely(configPath);
+  if (!config?.integrations?.bucket) {
+    return;
+  }
+  if (hasCustomAssetsRoute(projectRoot, config)) {
+    return;
+  }
+  server.middlewares.use(ASSET_DEV_ROUTE_PREFIX, (req, res, next) => {
+    serveAsset(req, res, next);
+  });
+}
+async function serveAsset(req, res, next) {
+  const raw = (req.url ?? "").split("?")[0].replace(/^\/+/, "");
+  let servingKey;
+  try {
+    servingKey = decodeURIComponent(raw);
+  } catch {
+    res.statusCode = 400;
+    res.end("Malformed asset path");
+    return;
+  }
+  if (!servingKey) {
+    next();
+    return;
+  }
+  const asset = await readLocalAsset(await getBucket(), servingKey);
+  if (!asset) {
+    next();
+    return;
+  }
+  res.statusCode = 200;
+  res.setHeader("Content-Type", asset.contentType);
+  res.setHeader("Cache-Control", "no-store");
+  res.end(Buffer.from(asset.body));
+}
+
 // src/server/state.ts
 var serverState = {
   sandbox: null,
@@ -24016,6 +24182,9 @@ function setPlatformRoleOverride(role) {
 
 // src/server/cleanup.ts
 async function cleanupServers() {
+  try {
+    await disposeAssetBucket();
+  } catch {}
   if (serverState.backend) {
     try {
       await serverState.backend.server.dispose();
@@ -24053,31 +24222,10 @@ function getNextMode(mode) {
 }
 
 // src/server/recreate-sandbox.ts
-var import_picocolors7 = __toESM(require_picocolors(), 1);
-
-// ../utils/src/vite-logger.ts
-var import_picocolors2 = __toESM(require_picocolors(), 1);
-var { bold, cyan, dim } = import_picocolors2.default;
-function formatTimestamp() {
-  const now = new Date;
-  const hours = now.getHours();
-  const minutes = now.getMinutes().toString().padStart(2, "0");
-  const seconds = now.getSeconds().toString().padStart(2, "0");
-  const ampm = hours >= 12 ? "PM" : "AM";
-  const displayHours = hours % 12 || 12;
-  return dim(`${displayHours}:${minutes}:${seconds} ${ampm}`);
-}
-function createLogPrefix(entity, domain) {
-  const timestamp = formatTimestamp();
-  const label = bold(cyan(`[${entity}]`));
-  if (domain) {
-    return `${timestamp} ${label} ${dim(`(${domain})`)}`;
-  }
-  return `${timestamp} ${label}`;
-}
+var import_picocolors8 = __toESM(require_picocolors(), 1);
 
 // src/lib/sandbox/server.ts
-var import_picocolors6 = __toESM(require_picocolors(), 1);
+var import_picocolors7 = __toESM(require_picocolors(), 1);
 import { DEFAULT_PORTS as DEFAULT_PORTS2 } from "playcademy/constants";
 
 // ../sandbox/dist/server.js
@@ -24089,7 +24237,7 @@ import { Readable } from "stream";
 import crypto2 from "crypto";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { createServer } from "node:net";
-import { homedir as homedir2 } from "node:os";
+import * as os from "node:os";
 import { join } from "node:path";
 import { mkdir, writeFile } from "fs/promises";
 import { join as join2 } from "path";
@@ -24103,7 +24251,7 @@ import * as o3 from "path";
 import fs22 from "node:fs";
 import { dirname, isAbsolute, join as join4 } from "node:path";
 import process2 from "process";
-import os from "os";
+import os2 from "os";
 import tty from "tty";
 import { randomUUID } from "crypto";
 import fs3 from "node:fs";
@@ -25100,7 +25248,7 @@ var init_dist = __esm(() => {
   outgoingEnded = Symbol("outgoingEnded");
 });
 function getRegistryPath() {
-  const home = homedir2();
+  const home = os.homedir();
   const dir = join(home, ".playcademy");
   if (!existsSync(dir)) {
     mkdirSync(dir, { recursive: true });
@@ -25194,7 +25342,7 @@ var package_default2;
 var init_package = __esm(() => {
   package_default2 = {
     name: "@playcademy/sandbox",
-    version: "0.5.1-beta.4",
+    version: "0.5.1-beta.5",
     description: "Local development server for Playcademy game development",
     type: "module",
     exports: {
@@ -25646,7 +25794,7 @@ function createLogger(scopeName) {
 var colors;
 var levelPriority;
 var customHandler;
-var log;
+var log2;
 var init_src2 = __esm(() => {
   colors = {
     reset: "\x1B[0m",
@@ -25664,7 +25812,7 @@ var init_src2 = __esm(() => {
     warn: 2,
     error: 3
   };
-  log = createLogger();
+  log2 = createLogger();
 });
 function formatSSE(eventType, data) {
   const payload = `event: ${eventType}
@@ -25701,7 +25849,7 @@ function toApiError(err2) {
     return ApiError.fromDomain(err2);
   }
   const message = err2 instanceof Error ? err2.message : "Unknown error";
-  log.error("[api-hono] Unexpected error", { error: err2 });
+  log2.error("[api-hono] Unexpected error", { error: err2 });
   return ApiError.internal(message);
 }
 function errorResponse(c, err2) {
@@ -25742,7 +25890,7 @@ function createStreamHandle(buildContext) {
             } catch (error) {
               const apiError = toApiError(error);
               const logLevel = apiError.status >= 500 ? "error" : "warn";
-              log[logLevel]("[api-hono] Stream error", {
+              log2[logLevel]("[api-hono] Stream error", {
                 status: apiError.status,
                 code: apiError.code,
                 message: apiError.message,
@@ -33225,9 +33373,9 @@ var init_delete = __esm(() => {
   init_tracing();
   init_utils();
   PgDeleteBase = class PgDeleteBase2 extends QueryPromise {
-    constructor(table2, session, dialect, withList) {
+    constructor(table2, session2, dialect, withList) {
       super();
-      this.session = session;
+      this.session = session2;
       this.dialect = dialect;
       this.config = { table: table2, withList };
     }
@@ -33365,7 +33513,7 @@ var init_dialect = __esm(() => {
     constructor(config2) {
       this.casing = new CasingCache(config2?.casing);
     }
-    async migrate(migrations, session, config2) {
+    async migrate(migrations, session2, config2) {
       const migrationsTable = typeof config2 === "string" ? "__drizzle_migrations" : config2.migrationsTable ?? "__drizzle_migrations";
       const migrationsSchema = typeof config2 === "string" ? "drizzle" : config2.migrationsSchema ?? "drizzle";
       const migrationTableCreate = sql`
@@ -33375,11 +33523,11 @@ var init_dialect = __esm(() => {
 				created_at bigint
 			)
 		`;
-      await session.execute(sql`CREATE SCHEMA IF NOT EXISTS ${sql.identifier(migrationsSchema)}`);
-      await session.execute(migrationTableCreate);
-      const dbMigrations = await session.all(sql`select id, hash, created_at from ${sql.identifier(migrationsSchema)}.${sql.identifier(migrationsTable)} order by created_at desc limit 1`);
+      await session2.execute(sql`CREATE SCHEMA IF NOT EXISTS ${sql.identifier(migrationsSchema)}`);
+      await session2.execute(migrationTableCreate);
+      const dbMigrations = await session2.all(sql`select id, hash, created_at from ${sql.identifier(migrationsSchema)}.${sql.identifier(migrationsTable)} order by created_at desc limit 1`);
       const lastDbMigration = dbMigrations[0];
-      await session.transaction(async (tx) => {
+      await session2.transaction(async (tx) => {
         for await (const migration of migrations) {
           if (!lastDbMigration || Number(lastDbMigration.created_at) < migration.folderMillis) {
             for (const stmt of migration.sql) {
@@ -34026,7 +34174,7 @@ var init_select2 = __esm(() => {
     isPartialSelect;
     session;
     dialect;
-    constructor({ table: table2, fields, isPartialSelect, session, dialect, withList, distinct }) {
+    constructor({ table: table2, fields, isPartialSelect, session: session2, dialect, withList, distinct }) {
       super();
       this.config = {
         withList,
@@ -34036,7 +34184,7 @@ var init_select2 = __esm(() => {
         setOperators: []
       };
       this.isPartialSelect = isPartialSelect;
-      this.session = session;
+      this.session = session2;
       this.dialect = dialect;
       this._ = {
         selectedFields: fields
@@ -34200,13 +34348,13 @@ var init_select2 = __esm(() => {
   PgSelectBase = class PgSelectBase2 extends PgSelectQueryBuilderBase {
     static [entityKind] = "PgSelect";
     _prepare(name2) {
-      const { session, config: config2, dialect, joinsNotNullableMap, authToken } = this;
-      if (!session) {
+      const { session: session2, config: config2, dialect, joinsNotNullableMap, authToken } = this;
+      if (!session2) {
         throw new Error("Cannot execute a query on a query builder. Please use a database instance instead.");
       }
       return tracer.startActiveSpan("drizzle.prepareQuery", () => {
         const fieldsList = orderSelectedFields(config2.fields);
-        const query = session.prepareQuery(dialect.sqlToQuery(this.getSQL()), fieldsList, name2, true);
+        const query = session2.prepareQuery(dialect.sqlToQuery(this.getSQL()), fieldsList, name2, true);
         query.joinsNotNullableMap = joinsNotNullableMap;
         return query.setToken(authToken);
       });
@@ -34329,9 +34477,9 @@ var init_insert = __esm(() => {
   init_utils();
   init_query_builder2();
   PgInsertBuilder = class PgInsertBuilder2 {
-    constructor(table2, session, dialect, withList, overridingSystemValue_) {
+    constructor(table2, session2, dialect, withList, overridingSystemValue_) {
       this.table = table2;
-      this.session = session;
+      this.session = session2;
       this.dialect = dialect;
       this.withList = withList;
       this.overridingSystemValue_ = overridingSystemValue_;
@@ -34371,9 +34519,9 @@ var init_insert = __esm(() => {
     }
   };
   PgInsertBase = class PgInsertBase2 extends QueryPromise {
-    constructor(table2, values, session, dialect, withList, select2, overridingSystemValue_) {
+    constructor(table2, values, session2, dialect, withList, select2, overridingSystemValue_) {
       super();
-      this.session = session;
+      this.session = session2;
       this.dialect = dialect;
       this.config = { table: table2, values, withList, select: select2, overridingSystemValue_ };
     }
@@ -34451,9 +34599,9 @@ var init_refresh_materialized_view = __esm(() => {
   init_query_promise();
   init_tracing();
   PgRefreshMaterializedView = class PgRefreshMaterializedView2 extends QueryPromise {
-    constructor(view, session, dialect) {
+    constructor(view, session2, dialect) {
       super();
-      this.session = session;
+      this.session = session2;
       this.dialect = dialect;
       this.config = { view };
     }
@@ -34513,9 +34661,9 @@ var init_update = __esm(() => {
   init_utils();
   init_view_common();
   PgUpdateBuilder = class PgUpdateBuilder2 {
-    constructor(table2, session, dialect, withList) {
+    constructor(table2, session2, dialect, withList) {
       this.table = table2;
-      this.session = session;
+      this.session = session2;
       this.dialect = dialect;
       this.withList = withList;
     }
@@ -34530,9 +34678,9 @@ var init_update = __esm(() => {
     }
   };
   PgUpdateBase = class PgUpdateBase2 extends QueryPromise {
-    constructor(table2, set, session, dialect, withList) {
+    constructor(table2, set, session2, dialect, withList) {
       super();
-      this.session = session;
+      this.session = session2;
       this.dialect = dialect;
       this.config = { set, table: table2, withList, joins: [] };
       this.tableName = getTableLikeName(table2);
@@ -34720,14 +34868,14 @@ var init_query = __esm(() => {
   init_relations();
   init_tracing();
   RelationalQueryBuilder = class RelationalQueryBuilder2 {
-    constructor(fullSchema, schema, tableNamesMap, table2, tableConfig, dialect, session) {
+    constructor(fullSchema, schema, tableNamesMap, table2, tableConfig, dialect, session2) {
       this.fullSchema = fullSchema;
       this.schema = schema;
       this.tableNamesMap = tableNamesMap;
       this.table = table2;
       this.tableConfig = tableConfig;
       this.dialect = dialect;
-      this.session = session;
+      this.session = session2;
     }
     static [entityKind] = "PgRelationalQueryBuilder";
     findMany(config2) {
@@ -34738,7 +34886,7 @@ var init_query = __esm(() => {
     }
   };
   PgRelationalQuery = class PgRelationalQuery2 extends QueryPromise {
-    constructor(fullSchema, schema, tableNamesMap, table2, tableConfig, dialect, session, config2, mode) {
+    constructor(fullSchema, schema, tableNamesMap, table2, tableConfig, dialect, session2, config2, mode) {
       super();
       this.fullSchema = fullSchema;
       this.schema = schema;
@@ -34746,7 +34894,7 @@ var init_query = __esm(() => {
       this.table = table2;
       this.tableConfig = tableConfig;
       this.dialect = dialect;
-      this.session = session;
+      this.session = session2;
       this.config = config2;
       this.mode = mode;
     }
@@ -34842,24 +34990,24 @@ var init_db = __esm(() => {
   init_raw();
   init_refresh_materialized_view();
   PgDatabase = class PgDatabase2 {
-    constructor(dialect, session, schema) {
+    constructor(dialect, session2, schema) {
       this.dialect = dialect;
-      this.session = session;
+      this.session = session2;
       this._ = schema ? {
         schema: schema.schema,
         fullSchema: schema.fullSchema,
         tableNamesMap: schema.tableNamesMap,
-        session
+        session: session2
       } : {
         schema: undefined,
         fullSchema: {},
         tableNamesMap: {},
-        session
+        session: session2
       };
       this.query = {};
       if (this._.schema) {
         for (const [tableName, columns] of Object.entries(this._.schema)) {
-          this.query[tableName] = new RelationalQueryBuilder(schema.fullSchema, this._.schema, this._.tableNamesMap, schema.fullSchema[tableName], columns, dialect, session);
+          this.query[tableName] = new RelationalQueryBuilder(schema.fullSchema, this._.schema, this._.tableNamesMap, schema.fullSchema[tableName], columns, dialect, session2);
         }
       }
     }
@@ -35114,8 +35262,8 @@ var init_session = __esm(() => {
     }
   };
   PgTransaction = class PgTransaction2 extends PgDatabase {
-    constructor(dialect, session, schema, nestedIndex = 0) {
-      super(dialect, session, schema);
+    constructor(dialect, session2, schema, nestedIndex = 0) {
+      super(dialect, session2, schema);
       this.schema = schema;
       this.nestedIndex = nestedIndex;
     }
@@ -45982,13 +46130,13 @@ async function extractZipToDirectory(zipBuffer, targetDir) {
       }
     });
     await Promise.all(extractPromises);
-    log.debug("[utils/zip] Extracted ZIP to directory", {
+    log2.debug("[utils/zip] Extracted ZIP to directory", {
       targetDir,
       fileCount: Object.keys(zip.files).length
     });
   } catch (error) {
     const errorMessage2 = error instanceof Error ? error.message : String(error);
-    log.error("[utils/zip] Failed to extract ZIP", { targetDir, error });
+    log2.error("[utils/zip] Failed to extract ZIP", { targetDir, error });
     throw new Error(`Failed to extract ZIP to ${targetDir}: ${errorMessage2}`, { cause: error });
   }
 }
@@ -46410,7 +46558,6 @@ class DeployJobService {
         "app.deploy_job.outcome": "succeeded",
         "app.deploy_job.run_duration_ms": DeployJobService.elapsedMsSince(new Date(runStartedAt))
       });
-      await this.deps.cache.refreshGameOrigins().catch(catchAttrs("deploy_job.cache_refresh"));
       await this.deleteCodeBundle(jobId);
     } catch (error) {
       clearInterval(heartbeat);
@@ -50276,7 +50423,7 @@ ${file}:${line3}:${column2}: ERROR: ${pluginText}${e.text}`;
     return result;
   }
   var fs23 = __require2("fs");
-  var os2 = __require2("os");
+  var os22 = __require2("os");
   var path2 = __require2("path");
   var ESBUILD_BINARY_PATH = process.env.ESBUILD_BINARY_PATH || ESBUILD_BINARY_PATH;
   var isValidBinaryPath = (x) => !!x && x !== "/usr/bin/esbuild";
@@ -50318,7 +50465,7 @@ ${file}:${line3}:${column2}: ERROR: ${pluginText}${e.text}`;
     let pkg;
     let subpath;
     let isWASM = false;
-    let platformKey = `${process.platform} ${os2.arch()} ${os2.endianness()}`;
+    let platformKey = `${process.platform} ${os22.arch()} ${os22.endianness()}`;
     if (platformKey in knownWindowsPackages) {
       pkg = knownWindowsPackages[platformKey];
       subpath = "esbuild.exe";
@@ -50463,7 +50610,7 @@ for your current platform.`);
   var crypto32 = __require2("crypto");
   var path22 = __require2("path");
   var fs222 = __require2("fs");
-  var os22 = __require2("os");
+  var os222 = __require2("os");
   var tty2 = __require2("tty");
   var worker_threads;
   if (process.env.ESBUILD_WORKER_THREADS !== "0") {
@@ -50774,7 +50921,7 @@ More information: The file containing the code for esbuild's JavaScript API (${_
     afterClose(null);
   };
   var randomFileName = () => {
-    return path22.join(os22.tmpdir(), `esbuild-${crypto32.randomBytes(32).toString("hex")}`);
+    return path22.join(os222.tmpdir(), `esbuild-${crypto32.randomBytes(32).toString("hex")}`);
   };
   var workerThreadService = null;
   var startWorkerThreadService = (worker_threads2) => {
@@ -51015,7 +51162,8 @@ class DeployService {
       expiresIn: null,
       permissions: {
         games: [`read:${slug}`, `write:${slug}`]
-      }
+      },
+      rateLimitEnabled: false
     });
     setAttribute("app.deploy.api_key_outcome", "created");
     return apiKey;
@@ -51076,9 +51224,9 @@ class DeployService {
       throw new ValidationError("Uploaded file is empty or not found");
     }
     setAttribute("app.deploy.asset_upload_size", frontendZip.length);
-    const os2 = await import("os");
+    const os22 = await import("os");
     const path2 = await import("path");
-    const tempDir = path2.join(os2.tmpdir(), `playcademy-deploy-${gameId}-${Date.now()}`);
+    const tempDir = path2.join(os22.tmpdir(), `playcademy-deploy-${gameId}-${Date.now()}`);
     const assetsPath = path2.join(tempDir, "dist");
     await withSpan("deploy.extract_assets", () => extractZip(frontendZip, assetsPath));
     uploadDeps.deleteObject(uploadToken).catch(catchAttrs("deploy.temp_cleanup"));
@@ -51686,6 +51834,31 @@ var init_game_service = __esm(() => {
     static changedFields(data) {
       return Object.entries(data).filter(([, value]) => value !== undefined).map(([key]) => key).toSorted().join(",");
     }
+    static safeOrigin(game2) {
+      if (!game2 || game2.gameType !== "external" || !game2.externalUrl) {
+        return;
+      }
+      try {
+        return new URL(game2.externalUrl).origin;
+      } catch {
+        return;
+      }
+    }
+    cleanupStaleOrigin(origin, excludeGameId) {
+      if (!this.deps.corsKvs) {
+        return;
+      }
+      const corsKvs = this.deps.corsKvs;
+      const db2 = this.deps.db;
+      (async () => {
+        const sharesOrigin = await db2.select({ id: games.id }).from(games).where(and(ne(games.id, excludeGameId), eq(games.gameType, "external"), or(eq(games.externalUrl, origin), like(games.externalUrl, `${origin}/%`)))).limit(1);
+        if (sharesOrigin.length === 0) {
+          await corsKvs.deleteOrigin(origin);
+        } else {
+          setAttribute("app.cors_kvs.delete_skipped", true);
+        }
+      })().catch(catchAttrs("cors_kvs.delete_origin", {}));
+    }
     async list(caller) {
       const db2 = this.deps.db;
       const isAdmin = caller?.role === "admin";
@@ -51988,6 +52161,18 @@ var init_game_service = __esm(() => {
         "app.game.next_visibility": data.visibility !== undefined ? gameResponse.visibility : undefined
       });
       GameService2.recordGameShape(gameResponse);
+      if (this.deps.corsKvs) {
+        const prevOrigin = GameService2.safeOrigin(existingGame);
+        const nextOrigin = GameService2.safeOrigin(gameResponse);
+        if (nextOrigin) {
+          setAttribute("app.cors_kvs.origin", nextOrigin);
+          this.deps.corsKvs.putOrigin(nextOrigin).catch(catchAttrs("cors_kvs.put_origin", {}));
+        }
+        if (prevOrigin && prevOrigin !== nextOrigin) {
+          setAttribute("app.cors_kvs.prev_origin", prevOrigin);
+          this.cleanupStaleOrigin(prevOrigin, gameResponse.id);
+        }
+      }
       return gameResponse;
     }
     async updateMetadata(gameId, data, user) {
@@ -52106,6 +52291,11 @@ var init_game_service = __esm(() => {
           setAttribute("app.game.api_key_cleanup_error", errorMessage(error));
         }
       }
+      const corsOrigin = GameService2.safeOrigin(gameToDelete);
+      if (this.deps.corsKvs && corsOrigin) {
+        setAttribute("app.cors_kvs.origin", corsOrigin);
+        this.cleanupStaleOrigin(corsOrigin, gameId);
+      }
       return {
         slug: gameToDelete.slug,
         displayName: gameToDelete.displayName
@@ -52234,12 +52424,13 @@ var init_logs_service = __esm(() => {
   init_deployment_util();
 });
 function createGameServices(deps) {
-  const { db: db2, config: config2, cloudflare: cloudflare2, auth: auth2, storage, cache, alerts } = deps;
+  const { db: db2, config: config2, cloudflare: cloudflare2, corsKvs, auth: auth2, storage, cache, alerts } = deps;
   const game2 = new GameService({
     db: db2,
     alerts,
     cache,
     cloudflare: cloudflare2,
+    corsKvs,
     deleteApiKeyByName: auth2.deleteApiKeyByName.bind(auth2)
   });
   const gameMember = new GameMemberService({
@@ -52260,7 +52451,6 @@ function createGameServices(deps) {
     db: db2,
     uploadBucket: config2.uploadBucket,
     storage,
-    cache,
     validateDeveloperAccessBySlug: (user, slug) => game2.validateDeveloperAccessBySlug(user, slug),
     runDeploy: (slug, request, user, uploadDeps, extractZip) => deploy.deploy(slug, request, user, uploadDeps, extractZip),
     notifyDeploymentFailure: (slug, displayName, error, developerInfo) => deploy.notifyDeploymentFailure(slug, displayName, error, developerInfo)
@@ -53131,6 +53321,9 @@ class DomainService {
     addEvent("domain.cloudflare_hostname_created", {
       "app.domain.cloudflare_id": cfHostname.id
     });
+    const corsOrigin = `https://${hostname}`;
+    setAttribute("app.cors_kvs.origin", corsOrigin);
+    this.deps.corsKvs?.putOrigin(corsOrigin).catch(catchAttrs("cors_kvs.put_origin", {}));
     return customHostname;
   }
   async list(slug, environment, user) {
@@ -53214,6 +53407,9 @@ class DomainService {
       "app.domain.status": dbHostname.status,
       "app.domain.ssl_status": dbHostname.sslStatus
     });
+    const corsOrigin = `https://${hostname}`;
+    setAttribute("app.cors_kvs.origin", corsOrigin);
+    this.deps.corsKvs?.deleteOrigin(corsOrigin).catch(catchAttrs("cors_kvs.delete_origin", {}));
   }
 }
 var init_domain_service = __esm(() => {
@@ -53504,12 +53700,14 @@ var init_secrets_service = __esm(() => {
   init_deployment_util();
   INTERNAL_SECRET_KEYS = ["PLAYCADEMY_API_KEY", "GAME_ID", "PLAYCADEMY_BASE_URL"];
 });
+var ASSET_ROUTE_PREFIX = "/api/assets/";
 var ROUTES;
 var init_constants3 = __esm(() => {
   init_src();
   ROUTES = {
     INDEX: "/api",
     HEALTH: "/api/health",
+    ASSETS: `${ASSET_ROUTE_PREFIX}*`,
     TIMEBACK: {
       END_ACTIVITY: `/api${TIMEBACK_ROUTES.END_ACTIVITY}`,
       GET_XP: `/api${TIMEBACK_ROUTES.GET_XP}`,
@@ -53664,7 +53862,8 @@ class SeedService {
       }, {
         bindings: { d1: [deploymentId], r2: [], kv: [] },
         keepAssets: false,
-        compatibilityDate: CLOUDFLARE_COMPATIBILITY_DATE
+        compatibilityDate: CLOUDFLARE_COMPATIBILITY_DATE,
+        observability: false
       });
       if (secrets && Object.keys(secrets).length > 0) {
         await cf.setSecrets(seedDeploymentId, prefixSecrets(secrets));
@@ -58092,6 +58291,7 @@ var SINGLE_EMOJI_REGEX;
 var init_emoji = __esm(() => {
   SINGLE_EMOJI_REGEX = /^(?:(?:\p{Regional_Indicator}{2})|(?:[#*0-9]\uFE0F?\u20E3)|(?:\p{Extended_Pictographic}(?:\uFE0F|\p{Emoji_Modifier})?(?:\u200D\p{Extended_Pictographic}(?:\uFE0F|\p{Emoji_Modifier})?)*))$/u;
 });
+var HttpUrlSchema;
 var GameEmojiSchema;
 var GameMetadataRecordSchema;
 var InsertGameSchema;
@@ -58118,6 +58318,7 @@ var init_schemas2 = __esm(() => {
   init_src();
   init_emoji();
   init_table5();
+  HttpUrlSchema = exports_external.string().url().refine((url2) => /^https?:\/\//i.test(url2), { message: "URL must use http or https" });
   GameEmojiSchema = exports_external.string().max(16).refine((value) => value.length === 0 || isSingleEmoji(value), {
     message: "Emoji must be a single emoji."
   });
@@ -58142,7 +58343,7 @@ var init_schemas2 = __esm(() => {
     gameType: exports_external.enum(gameTypeEnum.enumValues).default("hosted"),
     visibility: exports_external.enum(gameVisibilityEnum.enumValues).default("visible"),
     deploymentUrl: exports_external.string().nullable().optional(),
-    externalUrl: exports_external.string().url().nullable().optional()
+    externalUrl: HttpUrlSchema.nullable().optional()
   }).omit({
     slug: true,
     version: true
@@ -58165,7 +58366,7 @@ var init_schemas2 = __esm(() => {
     gameType: exports_external.enum(gameTypeEnum.enumValues).optional(),
     visibility: exports_external.enum(gameVisibilityEnum.enumValues).optional(),
     deploymentUrl: exports_external.string().nullable().optional(),
-    externalUrl: exports_external.string().url().nullable().optional()
+    externalUrl: HttpUrlSchema.nullable().optional()
   }).omit({
     id: true,
     slug: true,
@@ -58195,7 +58396,7 @@ var init_schemas2 = __esm(() => {
     metadata: GameMetadataRecordSchema.optional().default({}),
     gameType: exports_external.enum(gameTypeEnum.enumValues).optional().default("hosted"),
     visibility: exports_external.enum(gameVisibilityEnum.enumValues).optional(),
-    externalUrl: exports_external.string().url().optional()
+    externalUrl: HttpUrlSchema.optional()
   }).refine((data) => {
     if (data.gameType === "external" && !data.externalUrl) {
       return false;
@@ -63132,6 +63333,7 @@ function createPlatformServices(deps) {
     db: db2,
     config: config2,
     cloudflare: cloudflare2,
+    corsKvs,
     storage: storage2,
     r2Storage,
     timebackClient,
@@ -63153,7 +63355,7 @@ function createPlatformServices(deps) {
   });
   const kv = new KVService({ db: db2, cloudflare: cloudflare2, validateDeveloperAccessBySlug });
   const secrets = new SecretsService({ config: config2, cloudflare: cloudflare2, validateDeveloperAccessBySlug });
-  const domain = new DomainService({ db: db2, cloudflare: cloudflare2, validateDeveloperAccessBySlug });
+  const domain = new DomainService({ db: db2, cloudflare: cloudflare2, corsKvs, validateDeveloperAccessBySlug });
   const database = new DatabaseService({
     db: db2,
     config: config2,
@@ -63818,7 +64020,7 @@ var init_standalone = __esm(() => {
   init_verify_service();
 });
 function createServices(ctx) {
-  const { db: db2, config: config2, providers, cloudflare: cloudflare2, timeback: timeback2, discord } = ctx;
+  const { db: db2, config: config2, providers, cloudflare: cloudflare2, timeback: timeback2, discord, corsKvs } = ctx;
   const { auth: auth2, storage: storage2, r2Storage, cache } = providers;
   const infra2 = createInfraServices({
     db: db2,
@@ -63832,6 +64034,7 @@ function createServices(ctx) {
     db: db2,
     config: config2,
     cloudflare: cloudflare2,
+    corsKvs,
     auth: auth2,
     storage: storage2,
     cache,
@@ -63841,6 +64044,7 @@ function createServices(ctx) {
     db: db2,
     config: config2,
     cloudflare: cloudflare2,
+    corsKvs,
     storage: storage2,
     r2Storage,
     timebackClient: timeback2,
@@ -63870,14 +64074,14 @@ function buildTimebackClient() {
   }
   const { mode, onerosterApiUrl, caliperApiUrl, clientId, clientSecret, authUrl } = config.timeback;
   if (mode === "local") {
-    log.debug("[Sandbox] Initializing TimeBack client (local mode)", { onerosterApiUrl });
+    log2.debug("[Sandbox] Initializing TimeBack client (local mode)", { onerosterApiUrl });
     return new TimebackClient({
       baseUrl: onerosterApiUrl,
       caliperUrl: caliperApiUrl
     });
   }
   if (mode === "remote" && clientId && clientSecret && authUrl) {
-    log.debug("[Sandbox] Initializing TimeBack client (remote mode)", { onerosterApiUrl });
+    log2.debug("[Sandbox] Initializing TimeBack client (remote mode)", { onerosterApiUrl });
     return new TimebackClient({
       baseUrl: onerosterApiUrl,
       caliperUrl: caliperApiUrl,
@@ -63912,7 +64116,7 @@ function createSandboxAuthProvider() {
         expiresAt: params.expiresIn ? new Date(Date.now() + params.expiresIn * 1000) : null
       };
       sandboxApiKeys.set(id, apiKey);
-      log.debug("[SandboxAuthProvider] Created API key", { id, name: params.name });
+      log2.debug("[SandboxAuthProvider] Created API key", { id, name: params.name });
       return { id, key };
     },
     async listApiKeys(_headers) {
@@ -63920,13 +64124,13 @@ function createSandboxAuthProvider() {
     },
     async deleteApiKey(keyId) {
       sandboxApiKeys.delete(keyId);
-      log.debug("[SandboxAuthProvider] Deleted API key", { keyId });
+      log2.debug("[SandboxAuthProvider] Deleted API key", { keyId });
     },
     async deleteApiKeyByName(name3, userId) {
       for (const [id, key] of sandboxApiKeys.entries()) {
         if (key.name === name3 && key.userId === userId) {
           sandboxApiKeys.delete(id);
-          log.debug("[SandboxAuthProvider] Deleted API key by name", { id, name: name3 });
+          log2.debug("[SandboxAuthProvider] Deleted API key by name", { id, name: name3 });
           return id;
         }
       }
@@ -63949,7 +64153,7 @@ function createSandboxAuthProvider() {
           const payload2 = JSON.parse(atob(parts2[1]));
           if (payload2.sub && payload2.uid) {
             if (payload2.exp && payload2.exp < Date.now()) {
-              log.debug("[SandboxAuthProvider] Token expired");
+              log2.debug("[SandboxAuthProvider] Token expired");
               return null;
             }
             return payload2;
@@ -64000,7 +64204,7 @@ function createSandboxAuthProvider() {
           const payload = JSON.parse(atob(parts2[1]));
           if (payload.jti && payload.sub && payload.game) {
             if (payload.exp && payload.exp < Date.now()) {
-              log.debug("[SandboxAuthProvider] Log stream token expired");
+              log2.debug("[SandboxAuthProvider] Log stream token expired");
               return null;
             }
             return { jti: payload.jti, sub: payload.sub, game: payload.game };
@@ -64021,16 +64225,6 @@ var init_auth_provider = __esm(() => {
 });
 function createSandboxCacheProvider() {
   return {
-    async refreshGameOrigins() {
-      gameOrigins = ["http://localhost:3000", "http://localhost:5173"];
-      lastRefreshTime = Date.now();
-    },
-    getGameOriginState() {
-      return {
-        origins: gameOrigins,
-        lastRefreshTime
-      };
-    },
     async get(key) {
       const entry = cache.get(key);
       if (!entry) {
@@ -64055,17 +64249,12 @@ function createSandboxCacheProvider() {
 }
 function clearSandboxCache() {
   cache.clear();
-  gameOrigins = [];
-  lastRefreshTime = 0;
 }
 var cache;
-var gameOrigins;
-var lastRefreshTime = 0;
 var init_cache_provider = __esm(() => {
   cache = new Map;
-  gameOrigins = [];
 });
-function getBucket(bucketName) {
+function getBucket2(bucketName) {
   let bucket = storage2.get(bucketName);
   if (!bucket) {
     bucket = new Map;
@@ -64076,7 +64265,7 @@ function getBucket(bucketName) {
 function createSandboxStorageProvider() {
   return {
     async listObjects(bucketName, prefix) {
-      const bucket = getBucket(bucketName);
+      const bucket = getBucket2(bucketName);
       const files = [];
       for (const [key, data] of bucket.entries()) {
         if (!prefix || key.startsWith(prefix)) {
@@ -64091,7 +64280,7 @@ function createSandboxStorageProvider() {
       return files;
     },
     async getObject(bucketName, key) {
-      const bucket = getBucket(bucketName);
+      const bucket = getBucket2(bucketName);
       const data = bucket.get(key);
       if (!data) {
         return null;
@@ -64103,18 +64292,18 @@ function createSandboxStorageProvider() {
       };
     },
     async putObject(bucketName, key, body2, options) {
-      const bucket = getBucket(bucketName);
+      const bucket = getBucket2(bucketName);
       bucket.set(key, { body: body2, contentType: options?.contentType });
-      log.debug("[SandboxStorageProvider] Stored object", {
+      log2.debug("[SandboxStorageProvider] Stored object", {
         bucket: bucketName,
         key,
         size: body2.length
       });
     },
     async deleteObject(bucketName, key) {
-      const bucket = getBucket(bucketName);
+      const bucket = getBucket2(bucketName);
       bucket.delete(key);
-      log.debug("[SandboxStorageProvider] Deleted object", { bucket: bucketName, key });
+      log2.debug("[SandboxStorageProvider] Deleted object", { bucket: bucketName, key });
     },
     async generatePresignedPutUrl(bucketName, key, _contentType, _expiresIn) {
       const baseUrl = "http://localhost:3000";
@@ -64180,7 +64369,7 @@ function createSandboxContext(options) {
   };
   Object.assign(services, createServices(ctx));
   cachedServiceContext = ctx;
-  log.debug("[Sandbox] ServiceContext initialized", {
+  log2.debug("[Sandbox] ServiceContext initialized", {
     sstStage: config2.sstStage,
     baseUrl: config2.baseUrl,
     hasTimeback: Boolean(timeback2)
@@ -73500,7 +73689,7 @@ var require_has_flag = __commonJS2((exports, module2) => {
   };
 });
 var require_supports_color = __commonJS2((exports, module2) => {
-  var os2 = __require2("os");
+  var os22 = __require2("os");
   var tty2 = __require2("tty");
   var hasFlag = require_has_flag();
   var { env } = process;
@@ -73548,7 +73737,7 @@ var require_supports_color = __commonJS2((exports, module2) => {
       return min;
     }
     if (process.platform === "win32") {
-      const osRelease = os2.release().split(".");
+      const osRelease = os22.release().split(".");
       if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) {
         return Number(osRelease[2]) >= 14931 ? 3 : 2;
       }
@@ -78662,8 +78851,8 @@ function assembleStyles() {
   styles2.bgColor.ansi16m = wrapAnsi16m(ANSI_BACKGROUND_OFFSET);
   Object.defineProperties(styles2, {
     rgbToAnsi256: {
-      value(red, green, blue) {
-        if (red === green && green === blue) {
+      value(red, green2, blue2) {
+        if (red === green2 && green2 === blue2) {
           if (red < 8) {
             return 16;
           }
@@ -78672,7 +78861,7 @@ function assembleStyles() {
           }
           return Math.round((red - 8) / 247 * 24) + 232;
         }
-        return 16 + 36 * Math.round(red / 255 * 5) + 6 * Math.round(green / 255 * 5) + Math.round(blue / 255 * 5);
+        return 16 + 36 * Math.round(red / 255 * 5) + 6 * Math.round(green2 / 255 * 5) + Math.round(blue2 / 255 * 5);
       },
       enumerable: false
     },
@@ -78708,24 +78897,24 @@ function assembleStyles() {
           return 90 + (code - 8);
         }
         let red;
-        let green;
-        let blue;
+        let green2;
+        let blue2;
         if (code >= 232) {
           red = ((code - 232) * 10 + 8) / 255;
-          green = red;
-          blue = red;
+          green2 = red;
+          blue2 = red;
         } else {
           code -= 16;
           const remainder = code % 36;
           red = Math.floor(code / 36) / 5;
-          green = Math.floor(remainder / 6) / 5;
-          blue = remainder % 6 / 5;
+          green2 = Math.floor(remainder / 6) / 5;
+          blue2 = remainder % 6 / 5;
         }
-        const value = Math.max(red, green, blue) * 2;
+        const value = Math.max(red, green2, blue2) * 2;
         if (value === 0) {
           return 30;
         }
-        let result = 30 + (Math.round(blue) << 2 | Math.round(green) << 1 | Math.round(red));
+        let result = 30 + (Math.round(blue2) << 2 | Math.round(green2) << 1 | Math.round(red));
         if (value === 2) {
           result += 60;
         }
@@ -78734,7 +78923,7 @@ function assembleStyles() {
       enumerable: false
     },
     rgbToAnsi: {
-      value: (red, green, blue) => styles2.ansi256ToAnsi(styles2.rgbToAnsi256(red, green, blue)),
+      value: (red, green2, blue2) => styles2.ansi256ToAnsi(styles2.rgbToAnsi256(red, green2, blue2)),
       enumerable: false
     },
     hexToAnsi: {
@@ -78800,7 +78989,7 @@ function _supportsColor(haveStream, { streamIsTTY, sniffFlags = true } = {}) {
     return min2;
   }
   if (process2.platform === "win32") {
-    const osRelease = os.release().split(".");
+    const osRelease = os2.release().split(".");
     if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) {
       return Number(osRelease[2]) >= 14931 ? 3 : 2;
     }
@@ -84201,7 +84390,7 @@ var init_api2 = __esm(() => {
       ANSI_BACKGROUND_OFFSET = 10;
       wrapAnsi16 = (offset = 0) => (code) => `\x1B[${code + offset}m`;
       wrapAnsi256 = (offset = 0) => (code) => `\x1B[${38 + offset};5;${code}m`;
-      wrapAnsi16m = (offset = 0) => (red, green, blue) => `\x1B[${38 + offset};2;${red};${green};${blue}m`;
+      wrapAnsi16m = (offset = 0) => (red, green2, blue2) => `\x1B[${38 + offset};2;${red};${green2};${blue2}m`;
       styles2 = {
         modifier: {
           reset: [0, 0],
@@ -94067,7 +94256,7 @@ Is ${source_default.bold.blue(this.base.name)} schema created or renamed from an
   });
   require_supports_colors = __commonJS22({
     "../node_modules/.pnpm/colors@1.4.0/node_modules/colors/lib/system/supports-colors.js"(exports, module2) {
-      var os2 = __require22("os");
+      var os22 = __require22("os");
       var hasFlag2 = require_has_flag2();
       var env2 = process.env;
       var forceColor = undefined;
@@ -94105,7 +94294,7 @@ Is ${source_default.bold.blue(this.base.name)} schema created or renamed from an
         }
         var min2 = forceColor ? 1 : 0;
         if (process.platform === "win32") {
-          var osRelease = os2.release().split(".");
+          var osRelease = os22.release().split(".");
           if (Number(process.versions.node.split(".")[0]) >= 8 && Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) {
             return Number(osRelease[2]) >= 14931 ? 3 : 2;
           }
@@ -121883,8 +122072,8 @@ var require_colorette = __commonJS2((exports) => {
   var createColors = ({ useColor = isColorSupported } = {}) => useColor ? colors3 : Object.keys(colors3).reduce((colors4, key) => ({ ...colors4, [key]: String }), {});
   var {
     reset,
-    bold: bold2,
-    dim: dim2,
+    bold: bold22,
+    dim: dim22,
     italic,
     underline,
     inverse,
@@ -121892,11 +122081,11 @@ var require_colorette = __commonJS2((exports) => {
     strikethrough,
     black,
     red,
-    green,
+    green: green2,
     yellow,
-    blue,
+    blue: blue2,
     magenta,
-    cyan: cyan2,
+    cyan: cyan3,
     white,
     gray,
     bgBlack,
@@ -121909,7 +122098,7 @@ var require_colorette = __commonJS2((exports) => {
     bgWhite,
     blackBright,
     redBright,
-    greenBright,
+    greenBright: greenBright2,
     yellowBright,
     blueBright,
     magentaBright,
@@ -121942,16 +122131,16 @@ var require_colorette = __commonJS2((exports) => {
   exports.bgYellowBright = bgYellowBright;
   exports.black = black;
   exports.blackBright = blackBright;
-  exports.blue = blue;
+  exports.blue = blue2;
   exports.blueBright = blueBright;
-  exports.bold = bold2;
+  exports.bold = bold22;
   exports.createColors = createColors;
-  exports.cyan = cyan2;
+  exports.cyan = cyan3;
   exports.cyanBright = cyanBright;
-  exports.dim = dim2;
+  exports.dim = dim22;
   exports.gray = gray;
-  exports.green = green;
-  exports.greenBright = greenBright;
+  exports.green = green2;
+  exports.greenBright = greenBright2;
   exports.hidden = hidden;
   exports.inverse = inverse;
   exports.isColorSupported = isColorSupported;
@@ -122130,7 +122319,7 @@ function processServerOptions(_port, options) {
   if (customLogger2) {
     setLogger(customLogger2);
     setCustomLogHandler((level, message, context2, scope) => {
-      const scopePrefix = scope ? `${import_picocolors3.default.bold(`[${scope}]`)} ` : "";
+      const scopePrefix = scope ? `${import_picocolors5.default.bold(`[${scope}]`)} ` : "";
       let formattedMessage = `${scopePrefix}${message}`;
       if (context2) {
         const colorized = import_json_colorizer.colorize(context2);
@@ -122154,13 +122343,13 @@ ${stripped}`;
   };
 }
 var import_json_colorizer;
-var import_picocolors3;
+var import_picocolors5;
 var init_options = __esm(() => {
   init_src2();
   init_config();
   init_logging();
   import_json_colorizer = __toESM2(require_dist2(), 1);
-  import_picocolors3 = __toESM2(require_picocolors2(), 1);
+  import_picocolors5 = __toESM2(require_picocolors2(), 1);
 });
 var healthRouter;
 var init_health = __esm(() => {
@@ -122483,27 +122672,6 @@ var init_utils11 = __esm(() => {
   init_timeback_util();
   init_validation_util();
 });
-var getAllowedOrigins;
-var admin;
-var init_admin_controller = __esm(() => {
-  init_utils11();
-  getAllowedOrigins = requireAdmin(async (ctx) => {
-    const shouldRefresh = ctx.url.searchParams.get("refresh") === "true";
-    if (shouldRefresh) {
-      await ctx.providers.cache.refreshGameOrigins();
-    }
-    const { origins, lastRefreshTime: lastRefreshTime2 } = ctx.providers.cache.getGameOriginState();
-    return {
-      origins,
-      count: origins.length,
-      lastRefresh: lastRefreshTime2 > 0 ? new Date(lastRefreshTime2).toISOString() : null,
-      cacheAge: lastRefreshTime2 > 0 ? Date.now() - lastRefreshTime2 : null
-    };
-  });
-  admin = defineControllerNames("admin", {
-    getAllowedOrigins
-  });
-});
 var listFiles;
 var getFile;
 var putFile;
@@ -123996,7 +124164,6 @@ var init_verify_controller = __esm(() => {
   });
 });
 var init_controllers = __esm(() => {
-  init_admin_controller();
   init_bucket_controller();
   init_database_controller();
   init_deploy_controller();
@@ -124088,7 +124255,7 @@ async function getMockTimebackData(db2, timebackId, gameId) {
   const { role, organizations } = getMockStudentProfile();
   const allEnrollments = await getMockEnrollments(db2);
   const enrollments = gameId ? filterEnrollmentsByGame(allEnrollments, gameId) : allEnrollments;
-  log.debug("[Timeback] Sandbox is using mock data", {
+  log2.debug("[Timeback] Sandbox is using mock data", {
     timebackId,
     role,
     enrollments: enrollments.map((e) => `${e.subject}:${e.grade}`),
@@ -124293,7 +124460,7 @@ var init_deploy = __esm(() => {
   init_src2();
   init_api();
   init_uploads();
-  logger4 = log.scope("SandboxDeploy");
+  logger4 = log2.scope("SandboxDeploy");
   gameDeployRouter = new Hono2;
   gameDeployRouter.post("/:slug/deploy", async (c2) => {
     const user = c2.get("user");
@@ -124991,7 +125158,7 @@ var init_lti = __esm(() => {
   init_src2();
   init_constants();
   init_api();
-  logger5 = log.scope("SandboxLti");
+  logger5 = log2.scope("SandboxLti");
   ltiRouter = new Hono2;
   ltiRouter.post("/launch", async (c2) => {
     const db2 = c2.get("db");
@@ -125178,68 +125345,10 @@ var init_server = __esm(() => {
 });
 init_server();
 
-// src/lib/logging/adapter.ts
-function createLoggerAdapter(domain) {
-  return {
-    info: (msg) => console.log(`${createLogPrefix("playcademy", domain)} ${msg}`),
-    warn: (msg) => console.warn(`${createLogPrefix("playcademy", domain)} ${msg}`),
-    error: (msg) => console.error(`${createLogPrefix("playcademy", domain)} ${msg}`)
-  };
-}
-// src/lib/logging/utils.ts
-var import_picocolors4 = __toESM(require_picocolors(), 1);
-
-// ../utils/src/string.ts
-function pluralize(count2, singular, plural) {
-  return count2 === 1 ? singular : plural || `${singular}s`;
-}
-
-// src/lib/logging/utils.ts
-function createBackendBannerOptions(backendPort, vitePort) {
-  if (!backendPort) {
-    return;
-  }
-  return { port: backendPort, vitePort };
-}
-function createTimebackBannerOptions(timebackMode, courseCount, enrolledCount) {
-  if (!timebackMode || !courseCount) {
-    return;
-  }
-  return {
-    courseCount,
-    enrolledCount: enrolledCount ?? courseCount,
-    mode: timebackMode
-  };
-}
-function printBanner(viteConfig, options) {
-  const INDENT = " ".repeat(2);
-  const { version: version4, gameName, sandbox, backend, timeback } = options;
-  viteConfig.logger.info("");
-  viteConfig.logger.info(`${INDENT}${import_picocolors4.green(import_picocolors4.bold("PLAYCADEMY"))} ${import_picocolors4.green(`v${version4}`)}`);
-  viteConfig.logger.info("");
-  if (gameName) {
-    viteConfig.logger.info(`${INDENT}${import_picocolors4.green("➜")}  ${import_picocolors4.bold("Project:")}  ${import_picocolors4.cyan(gameName)}`);
-  }
-  if (sandbox?.enabled) {
-    viteConfig.logger.info(`${INDENT}${import_picocolors4.green("➜")}  ${import_picocolors4.bold("Sandbox:")}  ${import_picocolors4.cyan(`http://localhost:${import_picocolors4.bold(sandbox.port.toString())}/api`)}`);
-  } else if (sandbox) {
-    viteConfig.logger.info(`${INDENT}${import_picocolors4.green("➜")}  ${import_picocolors4.bold("Sandbox:")}  ${import_picocolors4.cyan("Disabled")}`);
-  }
-  if (backend) {
-    const backendUrl = backend.vitePort ? `http://localhost:${import_picocolors4.bold(backend.vitePort.toString())}/api ${import_picocolors4.dim(`(via ${backend.port})`)}` : `http://localhost:${import_picocolors4.bold(backend.port.toString())}/api`;
-    viteConfig.logger.info(`${INDENT}${import_picocolors4.green("➜")}  ${import_picocolors4.bold("Backend:")}  ${import_picocolors4.cyan(backendUrl)}`);
-  }
-  if (timeback && timeback.courseCount > 0) {
-    const enrollmentInfo = timeback.enrolledCount !== timeback.courseCount ? ` / ${timeback.enrolledCount} enrolled` : "";
-    const label = `${timeback.courseCount} ${pluralize(timeback.courseCount, "course")}${enrollmentInfo} ${import_picocolors4.dim(`(${timeback.mode})`)}`;
-    viteConfig.logger.info(`${INDENT}${import_picocolors4.green("➜")}  ${import_picocolors4.bold("Timeback:")} ${import_picocolors4.cyan(label)}`);
-  }
-  viteConfig.logger.info("");
-}
 // src/lib/sandbox/project-info.ts
 import fs5 from "node:fs";
 import path3 from "node:path";
-import { loadPlaycademyConfig } from "playcademy/utils";
+import { loadPlaycademyConfig as loadPlaycademyConfig2 } from "playcademy/utils";
 
 // ../utils/src/uuid.ts
 var UUID_REGEX2 = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
@@ -125460,7 +125569,7 @@ async function extractProjectInfo(viteConfig, timebackOptions) {
   const directoryName = path3.basename(projectRoot);
   let config2 = null;
   try {
-    config2 = await loadPlaycademyConfig();
+    config2 = await loadPlaycademyConfig2();
   } catch {}
   let packageJson = {};
   try {
@@ -125492,7 +125601,7 @@ async function extractProjectInfo(viteConfig, timebackOptions) {
 }
 
 // src/lib/sandbox/timeback.ts
-var import_picocolors5 = __toESM(require_picocolors(), 1);
+var import_picocolors6 = __toESM(require_picocolors(), 1);
 // ../constants/src/domains.ts
 var POSTHOG_CONFIG = {
   apiKey: "phc_z7aVQnB4P9FHm91g0BSfJTlIU6lISCBVhIJEFdfnYfX",
@@ -125557,9 +125666,9 @@ function validateTimebackConfig(viteConfig, timeback3) {
   if (realCourses.length > 0 && !hasTimebackCredentials2()) {
     const courseList = realCourses.map(([key]) => key).join(", ");
     viteConfig.logger.warn("");
-    viteConfig.logger.warn(import_picocolors5.default.yellow(`⚠️  TimeBack: Real course IDs for ${import_picocolors5.default.bold(courseList)} but credentials missing.`));
-    viteConfig.logger.warn(import_picocolors5.default.dim(`   Required: TIMEBACK_API_CLIENT_ID, TIMEBACK_API_CLIENT_SECRET, TIMEBACK_API_AUTH_URL, TIMEBACK_ONEROSTER_API_URL`));
-    viteConfig.logger.warn(import_picocolors5.default.dim(`   Or use 'mock' for local testing.`));
+    viteConfig.logger.warn(import_picocolors6.default.yellow(`⚠️  TimeBack: Real course IDs for ${import_picocolors6.default.bold(courseList)} but credentials missing.`));
+    viteConfig.logger.warn(import_picocolors6.default.dim(`   Required: TIMEBACK_API_CLIENT_ID, TIMEBACK_API_CLIENT_SECRET, TIMEBACK_API_AUTH_URL, TIMEBACK_ONEROSTER_API_URL`));
+    viteConfig.logger.warn(import_picocolors6.default.dim(`   Or use 'mock' for local testing.`));
     viteConfig.logger.warn("");
   }
 }
@@ -125678,7 +125787,7 @@ async function startSandbox(viteConfig, autoStart = true, options = {}) {
       }
     };
   } catch (error2) {
-    viteConfig.logger.error(import_picocolors6.default.red(`[Playcademy] Failed to start sandbox: ${error2}`));
+    viteConfig.logger.error(import_picocolors7.default.red(`[Playcademy] Failed to start sandbox: ${error2}`));
     return {
       baseUrl: `http://localhost:${DEFAULT_PORTS2.SANDBOX}`,
       port: DEFAULT_PORTS2.SANDBOX,
@@ -126151,11 +126260,11 @@ async function recreateSandbox(options) {
   const viteServer = getViteServerRef();
   const prefix2 = createLogPrefix("playcademy", "sandbox");
   if (!viteServer) {
-    viteConfig.logger.error(`${prefix2} ${import_picocolors7.red("Cannot recreate sandbox database: no Vite server reference")}`);
+    viteConfig.logger.error(`${prefix2} ${import_picocolors8.red("Cannot recreate sandbox database: no Vite server reference")}`);
     return { success: false, error: "No Vite server reference" };
   }
   if (!isShellMode(currentMode)) {
-    viteConfig.logger.warn(`${prefix2} ${import_picocolors7.yellow("can only recreate sandbox database in platform or demo mode")}`);
+    viteConfig.logger.warn(`${prefix2} ${import_picocolors8.yellow("can only recreate sandbox database in platform or demo mode")}`);
     return { success: false, error: "Not in a shell-backed mode" };
   }
   viteConfig.logger.info(`${prefix2} recreating database...`);
@@ -126188,7 +126297,7 @@ async function recreateSandbox(options) {
       }
     });
   }
-  viteConfig.logger.info(`${prefix2} ${import_picocolors7.green("database recreated")}`);
+  viteConfig.logger.info(`${prefix2} ${import_picocolors8.green("database recreated")}`);
   return { success: true };
 }
 
@@ -126235,38 +126344,38 @@ function setupConfigWatcher(server, viteConfig, platformModeOptions) {
 }
 
 // src/server/hotkeys/cycle-platform-role.ts
-var import_picocolors8 = __toESM(require_picocolors(), 1);
+var import_picocolors9 = __toESM(require_picocolors(), 1);
 
 // src/types/internal.ts
 var TIMEBACK_ROLES = ["student", "parent", "teacher", "administrator"];
 var PLATFORM_ROLES = ["player", "developer", "admin"];
 // src/server/hotkeys/cycle-platform-role.ts
-function cyclePlatformRole(logger) {
+function cyclePlatformRole(logger6) {
   const currentRole = getPlatformRoleOverride() ?? "player";
   const currentIndex = PLATFORM_ROLES.indexOf(currentRole);
   const nextIndex = (currentIndex + 1) % PLATFORM_ROLES.length;
   const nextRole = PLATFORM_ROLES[nextIndex];
   const prefix2 = createLogPrefix("playcademy", "user");
   setPlatformRoleOverride(nextRole);
-  logger.info(`${prefix2} ${import_picocolors8.red(currentRole)} → ${import_picocolors8.green(nextRole)}`);
+  logger6.info(`${prefix2} ${import_picocolors9.red(currentRole)} → ${import_picocolors9.green(nextRole)}`);
   if (getViteServerRef()) {
     getViteServerRef()?.ws.send({ type: "full-reload", path: "*" });
   } else {
-    logger.warn(`${prefix2} ${import_picocolors8.yellow("Cannot cycle platform role: no Vite server reference")}`);
+    logger6.warn(`${prefix2} ${import_picocolors9.yellow("Cannot cycle platform role: no Vite server reference")}`);
   }
 }
 function cyclePlatformRoleHotkey(options) {
   return {
     key: "p",
-    description: `${import_picocolors8.cyan(import_picocolors8.bold("[playcademy]"))} cycle platform role`,
+    description: `${import_picocolors9.cyan(import_picocolors9.bold("[playcademy]"))} cycle platform role`,
     action: () => cyclePlatformRole(options.viteConfig.logger)
   };
 }
 
 // src/server/hotkeys/cycle-timeback-role.ts
-var import_picocolors9 = __toESM(require_picocolors(), 1);
-var { bold: bold5, cyan: cyan4, green: green4, red: red3, yellow: yellow3 } = import_picocolors9.default;
-function cycleTimebackRole(logger) {
+var import_picocolors10 = __toESM(require_picocolors(), 1);
+var { bold: bold5, cyan: cyan4, green: green4, red: red3, yellow: yellow3 } = import_picocolors10.default;
+function cycleTimebackRole(logger6) {
   const currentRole = getTimebackRoleOverride() ?? "student";
   const currentIndex = TIMEBACK_ROLES.indexOf(currentRole);
   const nextIndex = (currentIndex + 1) % TIMEBACK_ROLES.length;
@@ -126274,11 +126383,11 @@ function cycleTimebackRole(logger) {
   setTimebackRoleOverride(nextRole);
   getSandboxRef()?.setRole?.(nextRole);
   const prefix2 = createLogPrefix("playcademy", "timeback");
-  logger.info(`${prefix2} ${red3(currentRole)} → ${green4(nextRole)}`);
+  logger6.info(`${prefix2} ${red3(currentRole)} → ${green4(nextRole)}`);
   if (getViteServerRef()) {
     getViteServerRef()?.ws.send({ type: "full-reload", path: "*" });
   } else {
-    logger.warn(`${prefix2} ${yellow3("Cannot cycle TimeBack role: no Vite server reference")}`);
+    logger6.warn(`${prefix2} ${yellow3("Cannot cycle TimeBack role: no Vite server reference")}`);
   }
 }
 function cycleTimebackRoleHotkey(options) {
@@ -126290,8 +126399,8 @@ function cycleTimebackRoleHotkey(options) {
 }
 
 // src/server/hotkeys/recreate-database.ts
-var import_picocolors10 = __toESM(require_picocolors(), 1);
-var { bold: bold6, cyan: cyan5 } = import_picocolors10.default;
+var import_picocolors11 = __toESM(require_picocolors(), 1);
+var { bold: bold6, cyan: cyan5 } = import_picocolors11.default;
 async function recreateSandboxDatabase(options) {
   await recreateSandbox({
     viteConfig: options.viteConfig,
@@ -126307,7 +126416,7 @@ function recreateDatabaseHotkey(options) {
 }
 
 // src/server/hotkeys/toggle-mode.ts
-var import_picocolors12 = __toESM(require_picocolors(), 1);
+var import_picocolors13 = __toESM(require_picocolors(), 1);
 
 // src/lib/backend/server.ts
 import {
@@ -126317,7 +126426,7 @@ import {
 } from "playcademy/utils";
 
 // src/lib/backend/hot-reload.ts
-var import_picocolors11 = __toESM(require_picocolors(), 1);
+var import_picocolors12 = __toESM(require_picocolors(), 1);
 import path5 from "node:path";
 function createHotReloadCallbacks(viteConfig) {
   function formatPath(changedPath) {
@@ -126334,7 +126443,7 @@ function createHotReloadCallbacks(viteConfig) {
     onSuccess: (changedPath) => {
       const relativePath = formatPath(changedPath);
       if (relativePath) {
-        viteConfig.logger.info(`${prefix2} ${import_picocolors11.green("hmr update")} ${import_picocolors11.dim(relativePath)}`);
+        viteConfig.logger.info(`${prefix2} ${import_picocolors12.green("hmr update")} ${import_picocolors12.dim(relativePath)}`);
       } else {
         viteConfig.logger.info(`${prefix2} reloaded`);
       }
@@ -126516,7 +126625,7 @@ async function toggleMode(options) {
   const viteServer = getViteServerRef();
   const prefix2 = createLogPrefix("playcademy");
   if (!viteServer) {
-    options.viteConfig.logger.error(`${prefix2} ${import_picocolors12.red("Cannot toggle mode: no Vite server reference")}`);
+    options.viteConfig.logger.error(`${prefix2} ${import_picocolors13.red("Cannot toggle mode: no Vite server reference")}`);
     return;
   }
   await cleanupServers();
@@ -126530,12 +126639,12 @@ async function toggleMode(options) {
   } else {
     await configurePlatformMode(viteServer, options.viteConfig, options.platformModeOptions);
   }
-  options.viteConfig.logger.info(`${prefix2} ${import_picocolors12.green("switched to")} ${import_picocolors12.green(import_picocolors12.bold(newMode))} ${import_picocolors12.green("mode")}`);
+  options.viteConfig.logger.info(`${prefix2} ${import_picocolors13.green("switched to")} ${import_picocolors13.green(import_picocolors13.bold(newMode))} ${import_picocolors13.green("mode")}`);
 }
 function toggleModeHotkey(options) {
   return {
     key: "m",
-    description: `${import_picocolors12.cyan(import_picocolors12.bold("[playcademy]"))} cycle platform/demo/standalone mode`,
+    description: `${import_picocolors13.cyan(import_picocolors13.bold("[playcademy]"))} cycle platform/demo/standalone mode`,
     action: () => toggleMode(options)
   };
 }
@@ -126578,6 +126687,7 @@ async function configureServerHook(server, context) {
   setViteServerRef(server);
   setCurrentMode(context.options.mode);
   setupProcessShutdownHandlers();
+  await registerAssetMiddleware(server, context.viteConfig.root, context.options.configPath);
   if (hasActiveServers()) {
     await cleanupServers();
   }
@@ -126656,17 +126766,24 @@ function buildInitCall() {
   ].join(",");
   return `posthog.init('${POSTHOG_CONFIG.apiKey}',{${config2}},'${POSTHOG_INSTANCE_NAME}');`;
 }
-function transformIndexHtmlHook(context) {
-  if (context.viteConfig?.command !== "build") {
-    return;
+async function transformIndexHtmlHook(context) {
+  const isBuild = context.viteConfig?.command === "build";
+  const tags = [];
+  if (!isBuild) {
+    const manifestScript = await getDevManifestScript(context.options.configPath);
+    if (manifestScript) {
+      const body2 = manifestScript.replace(/^<script>/, "").replace(/<\/script>$/, "");
+      tags.push({ tag: "script", children: body2, injectTo: "head" });
+    }
   }
-  return [
-    {
+  if (isBuild) {
+    tags.push({
       tag: "script",
       children: SERVER_TIMING_PATCH + POSTHOG_LOADER + buildInitCall(),
       injectTo: "head"
-    }
-  ];
+    });
+  }
+  return tags;
 }
 
 // src/hooks/write-bundle.ts