@playcademy/vite-plugin 1.2.1-beta.24 → 1.2.1-beta.26

package/dist/index.js

@@ -24315,7 +24315,7 @@ import path2 from "node:path";
 // package.json
 var package_default = {
   name: "@playcademy/vite-plugin",
-  version: "1.2.1-beta.24",
+  version: "1.2.1-beta.26",
   type: "module",
   exports: {
     ".": {
@@ -24767,6 +24767,7 @@ import { stdout } from "process";
 import { createHash } from "node:crypto";
 import { createHash as createHash2 } from "node:crypto";
 import crypto3 from "node:crypto";
+import * as crypto4 from "node:crypto";
 import * as s3 from "fs";
 import * as o3 from "path";
 import fs22 from "node:fs";
@@ -24774,10 +24775,9 @@ import { dirname, isAbsolute, join as join4 } from "node:path";
 import process22 from "process";
 import os2 from "os";
 import tty from "tty";
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 import fs3 from "node:fs";
 import fs4 from "node:fs";
-import * as crypto4 from "node:crypto";
 import { randomUUID as randomUUID3 } from "node:crypto";
 var __create2 = Object.create;
 var __getProtoOf2 = Object.getPrototypeOf;
@@ -25921,7 +25921,7 @@ var package_default2;
 var init_package = __esm(() => {
   package_default2 = {
     name: "@playcademy/sandbox",
-    version: "0.7.1-beta.22",
+    version: "0.7.1-beta.24",
     description: "Local development server for Playcademy game development",
     type: "module",
     exports: {
@@ -34376,6 +34376,9 @@ function isAssessmentAttemptOpen(attempt) {
 function isAssessmentAttemptCompleted(attempt) {
   return attempt.inProgress === ASSESSMENT_ATTEMPT_COMPLETED.inProgress && attempt.scoreStatus === ASSESSMENT_ATTEMPT_COMPLETED.scoreStatus;
 }
+function isAssessmentAttemptSuperseded(attempt) {
+  return attempt.inProgress === ASSESSMENT_ATTEMPT_SUPERSEDED.inProgress && attempt.scoreStatus === ASSESSMENT_ATTEMPT_SUPERSEDED.scoreStatus;
+}
 function classifyAssessmentSubmission(attempt, submissionId) {
   if (isAssessmentAttemptCompleted(attempt)) {
     return attempt.submissionId === submissionId ? "replay" : "reject";
@@ -34433,6 +34436,15 @@ function assessmentReviewBankShortage(fulfillment) {
 function assessmentFlowForPurpose(purpose) {
   return purpose === "review" ? "item-submit" : "attempt-submit";
 }
+function compareCodeUnits(left, right) {
+  if (left < right) {
+    return -1;
+  }
+  if (left > right) {
+    return 1;
+  }
+  return 0;
+}
 function canonicalJson(value) {
   if (value === null || typeof value !== "object") {
     return JSON.stringify(value) ?? "null";
@@ -34440,18 +34452,9 @@ function canonicalJson(value) {
   if (Array.isArray(value)) {
     return `[${value.map((item) => canonicalJson(item)).join(",")}]`;
   }
-  const entries = Object.entries(value).filter(([, entryValue]) => entryValue !== undefined).toSorted(([left], [right]) => compareCanonicalKeys(left, right)).map(([key, entryValue]) => `${JSON.stringify(key)}:${canonicalJson(entryValue)}`);
+  const entries = Object.entries(value).filter(([, entryValue]) => entryValue !== undefined).toSorted(([left], [right]) => compareCodeUnits(left, right)).map(([key, entryValue]) => `${JSON.stringify(key)}:${canonicalJson(entryValue)}`);
   return `{${entries.join(",")}}`;
 }
-function compareCanonicalKeys(left, right) {
-  if (left < right) {
-    return -1;
-  }
-  if (left > right) {
-    return 1;
-  }
-  return 0;
-}
 async function diagnosticRoutingRevision(manifest) {
   const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(canonicalJson(manifest)));
   return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
@@ -35751,15 +35754,6 @@ function assessmentPresentationForAttempt(assessment, attemptId) {
   });
   return { ...assessment, items };
 }
-function compareCodeUnits(left, right) {
-  if (left < right) {
-    return -1;
-  }
-  if (left > right) {
-    return 1;
-  }
-  return 0;
-}
 function reviewStandardFieldsWithinLimits(input) {
   return input.framework.trim().length <= TIMEBACK_ASSESSMENT_REVIEW_REQUEST_LIMITS.standardFieldLength && input.identifier.trim().length <= TIMEBACK_ASSESSMENT_REVIEW_REQUEST_LIMITS.standardFieldLength;
 }
@@ -35770,6 +35764,19 @@ function canonicalReviewStandardRef(input) {
   }
   return standard.framework && standard.identifier ? standard : null;
 }
+function isKnownDescriptiveCurriculumFramework(framework) {
+  return framework === "CCSS" || framework.startsWith("CCSS.");
+}
+function reviewRoutingStandardRefsFromMetadata(metadata2, options = {}) {
+  const refs = new Map;
+  for (const authored of qtiAssessmentStandardRefsFromMetadata(metadata2)) {
+    const standard = canonicalReviewStandardRef(authored);
+    if (standard && (!options.customOnly || !isKnownDescriptiveCurriculumFramework(standard.framework))) {
+      refs.set(assessmentStandardRefKey(standard), standard);
+    }
+  }
+  return [...refs.values()];
+}
 function canonicalRequestStandards(standards) {
   if (standards.length > TIMEBACK_ASSESSMENT_REVIEW_REQUEST_LIMITS.standards) {
     throw new RangeError(`A review request may contain at most ${TIMEBACK_ASSESSMENT_REVIEW_REQUEST_LIMITS.standards} standards`);
@@ -35825,42 +35832,172 @@ function qtiQuestionByIdentifier(questions) {
   }
   return byIdentifier;
 }
-async function buildReviewBankIndex(assessment, questions) {
+async function reviewBankRevision(input) {
+  const alignmentSignature = input.items.map((item) => ({
+    itemIdentifier: item.itemIdentifier,
+    standardKeys: item.standards.map(assessmentStandardRefKey)
+  }));
+  const bankRevisionUuid = await deterministicUUID(`playcademy:review-bank:v1:${JSON.stringify({
+    bankIdentifier: input.bankIdentifier,
+    contentRevision: input.sourceContentRevision,
+    alignments: alignmentSignature
+  })}`);
+  return `review-bank-v1:${bankRevisionUuid}`;
+}
+async function reviewBankIndex(input) {
+  return {
+    ...input,
+    bankRevision: await reviewBankRevision(input)
+  };
+}
+async function reviewBankSourceFingerprint(input) {
+  const fingerprintUuid = await deterministicUUID(`playcademy:review-bank-source:v1:${JSON.stringify({
+    bankIdentifier: input.bankIdentifier,
+    items: input.items.map((item) => ({
+      itemIdentifier: item.itemIdentifier,
+      standardKeys: item.standards.map(assessmentStandardRefKey)
+    }))
+  })}`);
+  return `review-bank-source-v1:${fingerprintUuid}`;
+}
+async function buildReviewBankIndex(assessment, questions, options = {}) {
   if (assessment.identifier !== questions.assessmentTest) {
     throw new Error(`QTI questions for ${questions.assessmentTest} do not describe assessment ${assessment.identifier}`);
   }
   const questionByIdentifier = qtiQuestionByIdentifier(questions);
   const items = assessment.items.map((item) => {
     const question = questionByIdentifier.get(item.identifier);
-    const canonical = new Map;
-    for (const authored of qtiAssessmentStandardRefsFromMetadata(question?.metadata)) {
-      const standard = canonicalReviewStandardRef(authored);
-      if (standard) {
-        canonical.set(assessmentStandardRefKey(standard), standard);
-      }
-    }
-    const standards = [...canonical.values()].toSorted((left, right) => compareCodeUnits(assessmentStandardRefKey(left), assessmentStandardRefKey(right)));
+    const standards = reviewRoutingStandardRefsFromMetadata(question?.metadata, options).toSorted((left, right) => compareCodeUnits(assessmentStandardRefKey(left), assessmentStandardRefKey(right)));
     return {
       itemIdentifier: item.identifier,
       standards
     };
   });
-  const alignmentSignature = items.map((item) => ({
-    itemIdentifier: item.itemIdentifier,
-    standardKeys: item.standards.map(assessmentStandardRefKey)
-  }));
-  const bankRevisionUuid = await deterministicUUID(`playcademy:review-bank:v1:${JSON.stringify({
-    bankIdentifier: assessment.identifier,
-    contentRevision: assessment.contentRevision,
-    alignments: alignmentSignature
-  })}`);
-  return {
+  return reviewBankIndex({
     bankIdentifier: assessment.identifier,
     sourceContentRevision: assessment.contentRevision,
-    bankRevision: `review-bank-v1:${bankRevisionUuid}`,
     items
+  });
+}
+function emptyReviewBankManifest(bankIdentifier) {
+  return {
+    version: PLAYCADEMY_REVIEW_BANK_MANIFEST_VERSION,
+    bankIdentifier,
+    sourceFingerprint: null,
+    sourceContentRevision: null,
+    bankRevision: null,
+    itemsByStandard: {}
+  };
+}
+function reviewBankMappingIssues(bank) {
+  return {
+    missingOrInvalidItemIdentifiers: bank.items.filter((item) => item.standards.length === 0).map((item) => item.itemIdentifier),
+    multipleStandardItemIdentifiers: bank.items.filter((item) => item.standards.length > 1).map((item) => item.itemIdentifier)
+  };
+}
+async function buildReviewBankManifest(bank) {
+  const itemsByStandard = new Map;
+  for (const item of bank.items) {
+    for (const standard of item.standards) {
+      const key = assessmentStandardRefKey(standard);
+      const identifiers = itemsByStandard.get(key) ?? [];
+      identifiers.push(item.itemIdentifier);
+      itemsByStandard.set(key, identifiers);
+    }
+  }
+  return {
+    version: PLAYCADEMY_REVIEW_BANK_MANIFEST_VERSION,
+    bankIdentifier: bank.bankIdentifier,
+    sourceFingerprint: await reviewBankSourceFingerprint(bank),
+    sourceContentRevision: bank.sourceContentRevision,
+    bankRevision: bank.bankRevision,
+    itemsByStandard: Object.fromEntries([...itemsByStandard.entries()].toSorted(([left], [right]) => compareCodeUnits(left, right)))
   };
 }
+function requiredManifestString(record, field) {
+  const value = record[field];
+  if (typeof value !== "string" || !value.trim()) {
+    throw new Error(`Review-bank manifest requires ${field}`);
+  }
+  return value.trim();
+}
+function standardFromManifestKey(key) {
+  try {
+    const parsed = JSON.parse(key);
+    if (!Array.isArray(parsed) || parsed.length !== 2 || typeof parsed[0] !== "string" || typeof parsed[1] !== "string") {
+      return null;
+    }
+    const standard = canonicalReviewStandardRef({
+      framework: parsed[0],
+      identifier: parsed[1]
+    });
+    return standard && assessmentStandardRefKey(standard) === key ? standard : null;
+  } catch {
+    return null;
+  }
+}
+async function reviewBankIndexFromManifest(metadata2, input) {
+  const raw = isRecord(metadata2) ? metadata2[PLAYCADEMY_REVIEW_BANK_MANIFEST_METADATA_KEY] : undefined;
+  if (raw === undefined) {
+    return null;
+  }
+  if (!isRecord(raw) || raw.version !== PLAYCADEMY_REVIEW_BANK_MANIFEST_VERSION) {
+    throw new Error("Review-bank manifest has an unsupported version or shape");
+  }
+  const manifest = raw;
+  const bankIdentifier = requiredManifestString(manifest, "bankIdentifier");
+  if (bankIdentifier !== input.bankIdentifier) {
+    throw new Error(`Review-bank manifest for ${bankIdentifier} does not describe ${input.bankIdentifier}`);
+  }
+  if (manifest.sourceFingerprint === null && manifest.sourceContentRevision === null && manifest.bankRevision === null) {
+    return null;
+  }
+  const sourceFingerprint = requiredManifestString(manifest, "sourceFingerprint");
+  const sourceContentRevision = requiredManifestString(manifest, "sourceContentRevision");
+  const declaredBankRevision = requiredManifestString(manifest, "bankRevision");
+  const itemsByStandard = manifest.itemsByStandard;
+  if (!isRecord(itemsByStandard)) {
+    throw new Error("Review-bank manifest requires an itemsByStandard mapping");
+  }
+  const membership = new Set(input.membershipItemIdentifiers);
+  const standardsByItem = new Map;
+  for (const [standardKey, rawItemIdentifiers] of Object.entries(itemsByStandard)) {
+    const standard = standardFromManifestKey(standardKey);
+    if (!standard || !Array.isArray(rawItemIdentifiers)) {
+      throw new Error("Review-bank manifest contains an invalid standard mapping");
+    }
+    for (const rawItemIdentifier of rawItemIdentifiers) {
+      if (typeof rawItemIdentifier !== "string" || !rawItemIdentifier.trim()) {
+        throw new Error("Review-bank manifest contains an invalid item identifier");
+      }
+      const itemIdentifier = rawItemIdentifier.trim();
+      if (membership.has(itemIdentifier)) {
+        const standards = standardsByItem.get(itemIdentifier) ?? new Map;
+        standards.set(assessmentStandardRefKey(standard), standard);
+        standardsByItem.set(itemIdentifier, standards);
+      }
+    }
+  }
+  const index = await reviewBankIndex({
+    bankIdentifier,
+    sourceContentRevision,
+    items: input.membershipItemIdentifiers.map((itemIdentifier) => ({
+      itemIdentifier,
+      standards: [...standardsByItem.get(itemIdentifier)?.values() ?? []].toSorted((left, right) => compareCodeUnits(assessmentStandardRefKey(left), assessmentStandardRefKey(right)))
+    }))
+  });
+  const issues = reviewBankMappingIssues(index);
+  if (issues.missingOrInvalidItemIdentifiers.length > 0 || issues.multipleStandardItemIdentifiers.length > 0) {
+    throw new Error("Review-bank manifest must map every member to exactly one standard/node key");
+  }
+  if (await reviewBankSourceFingerprint(index) !== sourceFingerprint) {
+    throw new Error("Review-bank manifest source fingerprint is stale");
+  }
+  if (index.bankRevision !== declaredBankRevision) {
+    throw new Error("Review-bank manifest revision does not match its candidate index");
+  }
+  return index;
+}
 function exposureTimestamp(value) {
   const timestamp = Date.parse(value);
   return Number.isFinite(timestamp) ? timestamp : 0;
@@ -36348,6 +36485,7 @@ var COMMON_CORE_ELA_FRAMEWORK_ALIASES;
 var COMMON_CORE_FRAMEWORK_ALIASES;
 var ASSESSMENT_ATTEMPT_OPEN;
 var ASSESSMENT_ATTEMPT_COMPLETED;
+var ASSESSMENT_ATTEMPT_SUPERSEDED;
 var ASSESSMENT_RUNTIME_ERROR_STATUS;
 var ROUTING_KEY_MAX_LENGTH = 128;
 var ROUTING_RESULT_KEY_MAX_LENGTH = 256;
@@ -36367,6 +36505,8 @@ var DiagnosticRoutingManifestV1Schema;
 var GRADE_VALUES;
 var POINT_RESPONSE_PATTERN;
 var REVIEW_SELECTION_POLICY_VERSION = "unseen-first-least-recently-delivered-v1";
+var PLAYCADEMY_REVIEW_BANK_MANIFEST_METADATA_KEY = "playcademyReviewBank";
+var PLAYCADEMY_REVIEW_BANK_MANIFEST_VERSION = 1;
 var DEFAULT_REVIEW_SELECTION_POLICY;
 var RuntimeSubjectSchema;
 var RuntimeGradeSchema;
@@ -36571,6 +36711,10 @@ var init_assessment_runtime2 = __esm(() => {
     inProgress: "false",
     scoreStatus: "fully graded"
   };
+  ASSESSMENT_ATTEMPT_SUPERSEDED = {
+    inProgress: "false",
+    scoreStatus: "not submitted"
+  };
   ASSESSMENT_RUNTIME_ERROR_STATUS = {
     NO_ELIGIBLE_TESTS: 404,
     REVIEW_BANK_SHORTAGE: 422,
@@ -62910,67 +63054,6 @@ var init_infra2 = __esm(() => {
   init_alerts_service();
   init_kv_backup_service();
 });
-function createInMemoryDatabaseLock() {
-  const tails = new Map;
-  return async (db2, key, operation) => {
-    const previous = tails.get(key) ?? Promise.resolve();
-    let release;
-    const gate = new Promise((resolve2) => {
-      release = resolve2;
-    });
-    const tail = previous.then(() => gate);
-    tails.set(key, tail);
-    await previous;
-    try {
-      return await operation(db2);
-    } finally {
-      release();
-      if (tails.get(key) === tail) {
-        tails.delete(key);
-      }
-    }
-  };
-}
-var LockContentionError;
-var init_locks = __esm(() => {
-  init_src6();
-  LockContentionError = class LockContentionError2 extends Error {
-    constructor(key) {
-      super(`Lock is already held: ${key}`);
-      this.name = "LockContentionError";
-    }
-  };
-});
-function assessmentRuntimeStartLockKey(input) {
-  return JSON.stringify([
-    ASSESSMENT_RUNTIME_LOCK_NAMESPACE,
-    "start",
-    input.studentId,
-    input.activityId,
-    input.purpose,
-    input.courseId
-  ]);
-}
-function assessmentRuntimeAttemptLockKey(attemptId) {
-  return JSON.stringify([ASSESSMENT_RUNTIME_LOCK_NAMESPACE, "attempt", attemptId]);
-}
-function createAssessmentRuntimeLock(lock) {
-  return async (db2, key, operation) => {
-    try {
-      return await lock(db2, key, operation);
-    } catch (error) {
-      if (error instanceof LockContentionError) {
-        throw new ServiceUnavailableError("Another assessment operation is in progress. Try again shortly.", { retryable: true });
-      }
-      throw error;
-    }
-  };
-}
-var ASSESSMENT_RUNTIME_LOCK_NAMESPACE = "playcademy-assessment-runtime-v1";
-var init_assessment_runtime_lock_util = __esm(() => {
-  init_locks();
-  init_errors2();
-});
 function hasPagingOptions(options) {
   return options.cursor !== undefined || options.limit !== undefined || options.delimiter !== undefined;
 }
@@ -115025,73 +115108,6 @@ function stringField2(value) {
 function firstStringField2(...values) {
   return values.map(stringField2).find(Boolean) ?? "";
 }
-function normalizedWhitespace2(value) {
-  return value.normalize("NFKC").trim().replace(/\s+/g, " ");
-}
-function normalizedIdentityCase2(value) {
-  return value.toLocaleUpperCase("en-US");
-}
-function frameworkAliasKey2(value) {
-  return value.normalize("NFKC").toLocaleLowerCase("en-US").replace(/[^a-z0-9]+/g, "");
-}
-function isUuidShaped2(value) {
-  return UUID_PATTERN2.test(value.trim());
-}
-function isCommonCoreMathIdentifier2(identifier) {
-  const canonical = normalizedIdentityCase2(normalizedWhitespace2(identifier));
-  return canonical.startsWith("CCSS.MATH.") || /^(?:K|[1-8])\.(?:CC|OA|NBT|NF|MD|RP|NS|EE|F|G|SP)\./.test(canonical) || /^(?:HS)?(?:N|A|F|G|S)-[A-Z]+\./.test(canonical) || /^MP\.?\d/.test(canonical);
-}
-function isCommonCoreElaIdentifier2(identifier) {
-  const canonical = normalizedIdentityCase2(normalizedWhitespace2(identifier));
-  return canonical.startsWith("CCSS.ELA-LITERACY.") || /^(?:RL|RI|RF|W|SL|L)\.(?:K|[1-9]|1[0-2])\./.test(canonical) || /^(?:RH|RST|WHST)\.(?:6-8|9-10|11-12)\./.test(canonical) || /^CCRA\.(?:R|W|SL|L)\./.test(canonical);
-}
-function canonicalFramework2(authoredFramework, identifier) {
-  const aliasKey = frameworkAliasKey2(authoredFramework);
-  if (COMMON_CORE_MATH_FRAMEWORK_ALIASES2.has(aliasKey) || COMMON_CORE_FRAMEWORK_ALIASES2.has(aliasKey) && isCommonCoreMathIdentifier2(identifier)) {
-    return "CCSS.Math";
-  }
-  if (COMMON_CORE_ELA_FRAMEWORK_ALIASES2.has(aliasKey) || COMMON_CORE_FRAMEWORK_ALIASES2.has(aliasKey) && isCommonCoreElaIdentifier2(identifier)) {
-    return "CCSS.ELA-Literacy";
-  }
-  if (COMMON_CORE_FRAMEWORK_ALIASES2.has(aliasKey)) {
-    return "CCSS";
-  }
-  return normalizedIdentityCase2(authoredFramework);
-}
-function canonicalIdentifier2(framework, authoredIdentifier) {
-  const identifier = normalizedIdentityCase2(normalizedWhitespace2(authoredIdentifier));
-  if (framework === "CCSS.Math") {
-    return identifier.replace(/^CCSS\.MATH\.CONTENT\./, "").replace(/^CCSS\.MATH\.PRACTICE\./, "").replace(/^CCSS\.MATH\./, "");
-  }
-  if (framework === "CCSS.ELA-Literacy") {
-    return identifier.replace(/^CCSS\.ELA-LITERACY\./, "");
-  }
-  return identifier;
-}
-function readableAlignmentIdentifier2(alignment) {
-  const identifier = alignment.identifier?.trim() ?? "";
-  if (identifier && !isUuidShaped2(identifier)) {
-    return identifier;
-  }
-  const id = alignment.id.trim();
-  return id && !isUuidShaped2(id) ? id : "";
-}
-function canonicalAssessmentStandardRef2(standard) {
-  const authoredFramework = normalizedWhitespace2(standard.framework);
-  const framework = canonicalFramework2(authoredFramework, standard.identifier);
-  const identifier = canonicalIdentifier2(framework, standard.identifier);
-  return {
-    framework,
-    identifier
-  };
-}
-function assessmentStandardRefKey2(standard) {
-  const canonical = canonicalAssessmentStandardRef2(standard);
-  return JSON.stringify([
-    normalizedIdentityCase2(canonical.framework),
-    normalizedIdentityCase2(canonical.identifier)
-  ]);
-}
 function dedupeStandards2(standards) {
   const deduped = new Map;
   for (const standard of standards) {
@@ -115182,22 +115198,6 @@ function qtiStandardsFromMetadata(metadata2) {
   standards.push(...qtiAlignmentStandardsFromMetadata2(metadata2));
   return dedupeStandards2(standards);
 }
-function qtiAssessmentStandardRefsFromMetadata2(metadata2) {
-  const refs = new Map;
-  for (const alignment of qtiAlignmentStandardsFromMetadata2(metadata2)) {
-    const identifier = readableAlignmentIdentifier2(alignment);
-    if (identifier) {
-      const canonical = canonicalAssessmentStandardRef2({
-        framework: alignment.source,
-        identifier
-      });
-      if (canonical.framework && canonical.identifier) {
-        refs.set(assessmentStandardRefKey2(canonical), canonical);
-      }
-    }
-  }
-  return [...refs.values()];
-}
 var EVENT_HANDLER_ATTRIBUTE;
 var SCRIPT_SCHEMES2;
 var DATA_RASTER_IMAGE_PATTERN2;
@@ -115242,7 +115242,6 @@ var BLANK_SENTINEL22 = "
 var PLAYABLE_POINT_VALUE;
 var POINT_INTERACTION_TYPES2;
 var INDEPENDENT_PROCESSING_TAGS2;
-var UUID_PATTERN2;
 var COMMON_CORE_MATH_FRAMEWORK_ALIASES2;
 var COMMON_CORE_ELA_FRAMEWORK_ALIASES2;
 var COMMON_CORE_FRAMEWORK_ALIASES2;
@@ -115495,7 +115494,6 @@ var init_qti = __esm(() => {
     "qti-sum",
     "qti-base-value"
   ]);
-  UUID_PATTERN2 = /^(?:urn:uuid:)?\{?[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\}?$/i;
   COMMON_CORE_MATH_FRAMEWORK_ALIASES2 = new Set([
     "ccssm",
     "ccssmath",
@@ -117851,6 +117849,109 @@ var init_timeback_admin_service = __esm(async () => {
     init_timeback_mastery_completion_util()
   ]);
 });
+function createInMemoryDatabaseLock() {
+  const tails = new Map;
+  return async (db2, key, operation) => {
+    const previous = tails.get(key) ?? Promise.resolve();
+    let release;
+    const gate = new Promise((resolve2) => {
+      release = resolve2;
+    });
+    const tail = previous.then(() => gate);
+    tails.set(key, tail);
+    await previous;
+    try {
+      return await operation(db2);
+    } finally {
+      release();
+      if (tails.get(key) === tail) {
+        tails.delete(key);
+      }
+    }
+  };
+}
+var LockContentionError;
+var init_locks = __esm(() => {
+  LockContentionError = class LockContentionError2 extends Error {
+    constructor(key) {
+      super(`Lock is already held: ${key}`);
+      this.name = "LockContentionError";
+    }
+  };
+});
+function normalizeKeys(keys) {
+  return [...new Set(keys)].toSorted();
+}
+function errorCode(error88) {
+  if (typeof error88 !== "object" || error88 === null || !("code" in error88)) {
+    return;
+  }
+  return typeof error88.code === "string" ? error88.code : undefined;
+}
+function translateAssessmentRuntimeLockError(error88) {
+  if (error88 instanceof LockContentionError) {
+    throw new ServiceUnavailableError("Another assessment operation is in progress. Try again shortly.", { retryable: true });
+  }
+  if (error88 instanceof AssessmentRuntimeLockTimeoutError) {
+    throw new ServiceUnavailableError("The assessment operation took too long. Try again shortly.", { retryable: true, reason: "LOCK_TIMEOUT" });
+  }
+  const code = errorCode(error88);
+  if (code && POSTGRES_TIMEOUT_ERROR_CODES.has(code)) {
+    throw new ServiceUnavailableError("The assessment operation took too long. Try again shortly.", { retryable: true, reason: "LOCK_TIMEOUT" });
+  }
+  if (code && POSTGRES_CONNECTION_ERROR_CODES.has(code)) {
+    throw new ServiceUnavailableError("The assessment lock connection was interrupted. Try again shortly.", { retryable: true, reason: "LOCK_CONNECTION_LOST" });
+  }
+  throw error88;
+}
+function createInMemoryAssessmentRuntimeLock() {
+  const lock = createInMemoryDatabaseLock();
+  return async (db2, keys, operation) => {
+    const ordered = normalizeKeys(keys);
+    function acquire(index2, operationDb) {
+      const key = ordered[index2];
+      return key ? lock(operationDb, key, (nested) => acquire(index2 + 1, nested)) : operation(operationDb);
+    }
+    try {
+      return await acquire(0, db2);
+    } catch (error88) {
+      return translateAssessmentRuntimeLockError(error88);
+    }
+  };
+}
+function assessmentRuntimeStartLockKey(input) {
+  return JSON.stringify([
+    ASSESSMENT_RUNTIME_LOCK_NAMESPACE,
+    "start",
+    input.studentId,
+    input.activityId,
+    input.purpose,
+    input.courseId
+  ]);
+}
+function assessmentRuntimeAttemptLockKey(attemptId) {
+  return JSON.stringify([ASSESSMENT_RUNTIME_LOCK_NAMESPACE, "attempt", attemptId]);
+}
+var ASSESSMENT_RUNTIME_LOCK_NAMESPACE = "playcademy-assessment-runtime-v1";
+var POSTGRES_TIMEOUT_ERROR_CODES;
+var POSTGRES_CONNECTION_ERROR_CODES;
+var AssessmentRuntimeLockTimeoutError;
+var init_assessment_runtime_lock_util = __esm(() => {
+  init_locks();
+  init_errors2();
+  POSTGRES_TIMEOUT_ERROR_CODES = new Set(["25P03", "57014"]);
+  POSTGRES_CONNECTION_ERROR_CODES = new Set([
+    "CONNECTION_CLOSED",
+    "CONNECTION_DESTROYED",
+    "CONNECTION_ENDED"
+  ]);
+  AssessmentRuntimeLockTimeoutError = class AssessmentRuntimeLockTimeoutError2 extends Error {
+    constructor(timeoutMs) {
+      super(`Assessment operation exceeded its ${timeoutMs}ms lock deadline`);
+      this.name = "AssessmentRuntimeLockTimeoutError";
+    }
+  };
+});
 function validateAssessmentStatusTransition(current, next) {
   if (current === next) {
     return;
@@ -117895,8 +117996,8 @@ function assertAssessmentHasQuestions(questions) {
   }
 }
 function assertReviewAssessmentHasStandards(standardCounts) {
-  if (standardCounts.some((count) => count <= 0)) {
-    throw new ValidationError("Every question in a review assessment must have a standards alignment");
+  if (standardCounts.some((count) => count !== 1)) {
+    throw new ValidationError("Every question in a review assessment must have exactly one standards alignment");
   }
 }
 function planAssessmentRemoval(status) {
@@ -117959,6 +118060,41 @@ function orderLiveAssessmentRows(liveRows, purpose, testIdentifiers) {
 var init_timeback_assessment_rules_util = __esm(() => {
   init_errors2();
 });
+function stageAssessmentAttemptSupersession(attempt) {
+  Object.assign(attempt.result, ASSESSMENT_ATTEMPT_SUPERSEDED);
+  Object.assign(attempt.selection, ASSESSMENT_ATTEMPT_SUPERSEDED);
+}
+function shouldConfirmAssessmentVersionUnavailable(details) {
+  return typeof details === "object" && details !== null && "expectedRevision" in details && typeof details.expectedRevision === "string" && !("currentRevision" in details);
+}
+function buildAssessmentAttemptSupersessionUpdate(result) {
+  if (result.status !== "active" || !isAssessmentAttemptOpen({
+    inProgress: result.inProgress ?? "",
+    scoreStatus: result.scoreStatus
+  })) {
+    return null;
+  }
+  return {
+    status: "active",
+    assessmentLineItem: result.assessmentLineItem,
+    student: result.student,
+    score: result.score ?? 0,
+    scoreDate: result.scoreDate,
+    ...ASSESSMENT_ATTEMPT_SUPERSEDED,
+    metadata: result.metadata ?? {}
+  };
+}
+async function resolveAvailableAssessmentAttempt(initialDecision, select3, resume) {
+  let decision = initialDecision;
+  while (decision?.kind === "resume") {
+    const snapshot = await resume(decision);
+    if (snapshot !== null) {
+      return { kind: "resumed", snapshot };
+    }
+    decision = select3();
+  }
+  return { kind: "continue", decision };
+}
 function buildReviewItemResultMetadata(input) {
   const administration = itemAdministration(input.metadata.itemSubmissions, input.selection.itemIdentifier);
   if (!administration) {
@@ -118403,8 +118539,8 @@ function parsePlayableItem(question) {
 function assessmentContentRevision(test, questions) {
   return sha256Hex(canonicalJson2({
     identifier: test.identifier,
+    title: test.title,
     qtiVersion: test.qtiVersion,
-    rawXml: test.rawXml,
     parts: test["qti-test-part"],
     questions: questions.questions.map(({ reference, question }) => ({
       identifier: reference.identifier,
@@ -118560,11 +118696,30 @@ async function hydrateQtiTestQuestions(client2, references) {
   }));
   return { ...references, questions };
 }
-async function loadHydratedQtiTest(client2, identifier) {
+async function hydrateQtiTestQuestionSelection(client2, references, itemIdentifiers) {
+  const referenceByIdentifier = new Map(references.questions.map((reference) => [reference.reference.identifier, reference]));
+  const selectedReferences = itemIdentifiers.map((itemIdentifier) => {
+    const reference = referenceByIdentifier.get(itemIdentifier);
+    if (!reference) {
+      throw new Error(`QTI assessment ${references.assessmentTest} does not contain item ${itemIdentifier}`);
+    }
+    return reference;
+  });
+  return hydrateQtiTestQuestions(client2, {
+    ...references,
+    totalQuestions: selectedReferences.length,
+    questions: selectedReferences
+  });
+}
+async function loadQtiTestReferences(client2, identifier) {
   const [test, references] = await Promise.all([
     client2.qtiApi.assessmentTests.get(identifier),
     client2.qtiApi.assessmentTests.getQuestions(identifier)
   ]);
+  return { test, references };
+}
+async function loadHydratedQtiTest(client2, identifier) {
+  const { test, references } = await loadQtiTestReferences(client2, identifier);
   return {
     test,
     questions: await hydrateQtiTestQuestions(client2, references)
@@ -118578,6 +118733,7 @@ class TimebackAssessmentRuntimeService {
   static ASSESSMENT_CACHE_TTL_MS = 60000;
   static EXPORT_CONCURRENCY = 4;
   static ITEM_SUBMISSION_MAX_PREPARATION_ATTEMPTS = 3;
+  static ASSESSMENT_VERSION_CONFIRMATION_DELAY_MS = 25;
   static PROJECTION_BARRIER_MAX_ATTEMPTS = 5;
   static PROJECTION_BARRIER_RETRY_DELAY_MS = 25;
   static SCORING_CONCURRENCY = 4;
@@ -118590,6 +118746,10 @@ class TimebackAssessmentRuntimeService {
     defaultTTL: TimebackAssessmentRuntimeService.ASSESSMENT_CACHE_TTL_MS,
     maxSize: TimebackAssessmentRuntimeService.ASSESSMENT_CACHE_LIMIT
   });
+  reviewSelectionCache = new TimebackCache({
+    defaultTTL: TimebackAssessmentRuntimeService.ASSESSMENT_CACHE_TTL_MS,
+    maxSize: TimebackAssessmentRuntimeService.ASSESSMENT_CACHE_LIMIT
+  });
   constructor(deps) {
     this.deps = deps;
   }
@@ -118608,14 +118768,15 @@ class TimebackAssessmentRuntimeService {
     }
     const masteryStandard = input.purpose === "mastery" ? normalizeMasteryStandard(input.standard) : undefined;
     const requestFingerprint = this.startRequestFingerprint(input);
+    const pendingSupersessions = new Set;
     const candidates = await this.candidateIntegrations(gameId, studentId, input);
     const lockKeys = candidates.rows.map((row) => assessmentRuntimeStartLockKey({
       studentId,
       activityId: input.activityId,
       purpose: input.purpose,
       courseId: row.courseId
-    })).toSorted();
-    return this.withStartLocks(lockKeys, async (db2) => {
+    }));
+    return this.deps.assessmentRuntimeLock(this.deps.db, lockKeys, async (db2) => {
       const context2 = await this.selectIntegration(candidates, studentId, input);
       const attemptScope = {
         studentId,
@@ -118630,20 +118791,21 @@ class TimebackAssessmentRuntimeService {
         this.listAttempts(attemptScope)
       ]);
       const attempts = listing.attempts;
-      const compatibleAttempts = this.attemptsMatchingRequest(attempts, requestFingerprint);
-      let decision = this.requireDecision(selectRuntimeAssessment(tests, [...compatibleAttempts.values()].map((entry2) => entry2.selection)), input.purpose);
-      if (decision.kind === "resume") {
-        return this.resumeSnapshot(decision, attempts, context2.integration);
+      const initialResolution = await this.resumeAvailableAttempt(tests, attempts, requestFingerprint, pendingSupersessions, (resumeDecision) => this.resumeSnapshot(resumeDecision, attempts, context2.integration));
+      if (initialResolution.kind === "resumed") {
+        await this.persistPendingSupersessionsBestEffort(db2, pendingSupersessions);
+        return initialResolution.snapshot;
       }
+      let decision = this.requireDecision(initialResolution.decision, input.purpose);
       let assessment = await this.loadAssessment(decision.test.qtiTestIdentifier);
       const refreshedListing = await this.listAttempts(attemptScope);
       const refreshed = refreshedListing.attempts;
-      const refreshedCompatible = this.attemptsMatchingRequest(refreshed, requestFingerprint);
-      const refreshedDecision = this.requireDecision(selectRuntimeAssessment(tests, [...refreshedCompatible.values()].map((entry2) => entry2.selection)), input.purpose);
-      if (refreshedDecision.kind === "resume") {
-        return this.resumeSnapshot(refreshedDecision, refreshed, context2.integration);
+      const refreshedResolution = await this.resumeAvailableAttempt(tests, refreshed, requestFingerprint, pendingSupersessions, (resumeDecision) => this.resumeSnapshot(resumeDecision, refreshed, context2.integration));
+      if (refreshedResolution.kind === "resumed") {
+        await this.persistPendingSupersessionsBestEffort(db2, pendingSupersessions);
+        return refreshedResolution.snapshot;
       }
-      decision = refreshedDecision;
+      decision = this.requireDecision(refreshedResolution.decision, input.purpose);
       if (assessment.identifier !== decision.test.qtiTestIdentifier) {
         assessment = await this.loadAssessment(decision.test.qtiTestIdentifier);
       }
@@ -118701,6 +118863,7 @@ class TimebackAssessmentRuntimeService {
           grade: context2.integration.grade
         })
       });
+      await this.persistPendingSupersessionsBestEffort(db2, pendingSupersessions);
       return this.snapshot(result, metadata2, assessment, context2.integration);
     });
   }
@@ -118710,14 +118873,15 @@ class TimebackAssessmentRuntimeService {
     input
   }) {
     const requestFingerprint = this.startRequestFingerprint(input);
+    const pendingSupersessions = new Set;
     const candidates = await this.candidateIntegrations(gameId, studentId, input);
     const lockKeys = candidates.rows.map((row) => assessmentRuntimeStartLockKey({
       studentId,
       activityId: input.activityId,
       purpose: input.purpose,
       courseId: row.courseId
-    })).toSorted();
-    return this.withStartLocks(lockKeys, async (db2) => {
+    }));
+    return this.deps.assessmentRuntimeLock(this.deps.db, lockKeys, async (db2) => {
       const context2 = await this.selectIntegration(candidates, studentId, input);
       const attemptScope = {
         studentId,
@@ -118731,22 +118895,23 @@ class TimebackAssessmentRuntimeService {
         this.liveTests(context2.integration.id, input.purpose, db2, undefined, input.diagnosticKey),
         this.listAttempts(attemptScope)
       ]);
-      const compatible = this.attemptsMatchingRequest(listing.attempts, requestFingerprint);
-      let decision = this.requireDecision(selectRuntimeAssessment(tests, [...compatible.values()].map((entry2) => entry2.selection)), input.purpose);
-      if (decision.kind === "resume") {
-        return this.resumeDiagnosticSnapshot(decision, listing.attempts, context2.integration, db2);
+      const initialResolution = await this.resumeAvailableAttempt(tests, listing.attempts, requestFingerprint, pendingSupersessions, (resumeDecision) => this.resumeDiagnosticSnapshot(resumeDecision, listing.attempts, context2.integration, db2));
+      if (initialResolution.kind === "resumed") {
+        await this.persistPendingSupersessionsBestEffort(db2, pendingSupersessions);
+        return initialResolution.snapshot;
       }
+      let decision = this.requireDecision(initialResolution.decision, input.purpose);
       let definition = await this.requireDiagnosticDefinition(decision.test.id, context2.integration.id, db2, true);
       let assessment = await this.loadAssessment(definition.qtiTestIdentifier);
       let routing = await this.initializeHostedDiagnostic(definition, assessment);
       const refreshedListing = await this.listAttempts(attemptScope);
       const refreshed = refreshedListing.attempts;
-      const refreshedCompatible = this.attemptsMatchingRequest(refreshed, requestFingerprint);
-      const refreshedDecision = this.requireDecision(selectRuntimeAssessment(tests, [...refreshedCompatible.values()].map((entry2) => entry2.selection)), input.purpose);
-      if (refreshedDecision.kind === "resume") {
-        return this.resumeDiagnosticSnapshot(refreshedDecision, refreshed, context2.integration, db2);
+      const refreshedResolution = await this.resumeAvailableAttempt(tests, refreshed, requestFingerprint, pendingSupersessions, (resumeDecision) => this.resumeDiagnosticSnapshot(resumeDecision, refreshed, context2.integration, db2));
+      if (refreshedResolution.kind === "resumed") {
+        await this.persistPendingSupersessionsBestEffort(db2, pendingSupersessions);
+        return refreshedResolution.snapshot;
       }
-      decision = refreshedDecision;
+      decision = this.requireDecision(refreshedResolution.decision, input.purpose);
       if (definition.id !== decision.test.id) {
         definition = await this.requireDiagnosticDefinition(decision.test.id, context2.integration.id, db2, true);
         assessment = await this.loadAssessment(definition.qtiTestIdentifier);
@@ -118815,6 +118980,7 @@ class TimebackAssessmentRuntimeService {
           grade: context2.integration.grade
         })
       });
+      await this.persistPendingSupersessionsBestEffort(db2, pendingSupersessions);
       return this.diagnosticSnapshot(result, metadata2, assessment, context2.integration, routing.state);
     });
   }
@@ -118823,7 +118989,9 @@ class TimebackAssessmentRuntimeService {
     studentId,
     input
   }) {
+    const preparationStartedAt = Date.now();
     const requestFingerprint = reviewRequestFingerprint(input, DEFAULT_REVIEW_SELECTION_POLICY);
+    const pendingSupersessions = new Set;
     const normalizedRequest = normalizeReviewRequest(input);
     const candidates = await this.candidateIntegrations(gameId, studentId, input);
     const lockKeys = candidates.rows.map((row) => assessmentRuntimeStartLockKey({
@@ -118831,8 +118999,8 @@ class TimebackAssessmentRuntimeService {
       activityId: input.activityId,
       purpose: input.purpose,
       courseId: row.courseId
-    })).toSorted();
-    return this.withStartLocks(lockKeys, async (db2) => {
+    }));
+    return this.deps.assessmentRuntimeLock(this.deps.db, lockKeys, async (db2) => {
       const context2 = await this.selectIntegration(candidates, studentId, input);
       const attemptScope = {
         studentId,
@@ -118847,38 +119015,44 @@ class TimebackAssessmentRuntimeService {
         this.listAttempts(attemptScope)
       ]);
       const attempts = listing.attempts;
-      const compatible = this.attemptsMatchingRequest(attempts, requestFingerprint);
-      let decision = selectRuntimeAssessment(tests, [...compatible.values()].map((entry2) => entry2.selection));
-      if (decision?.kind === "resume") {
-        return this.resumeReviewSnapshot(decision, compatible, listing.reviewChildren, context2);
+      const initialResolution = await this.resumeAvailableAttempt(tests, attempts, requestFingerprint, pendingSupersessions, (resumeDecision) => this.resumeReviewSnapshot(resumeDecision, attempts, listing.reviewChildren, context2));
+      if (initialResolution.kind === "resumed") {
+        await this.persistPendingSupersessionsBestEffort(db2, pendingSupersessions);
+        return initialResolution.snapshot;
       }
+      let decision = initialResolution.decision;
       if (tests.length === 0 || !decision) {
         throw AssessmentRuntimeError.from(assessmentNoEligibleTests(input.purpose));
       }
       if (tests.length > 1) {
         throw new ValidationError("Standards review requires exactly one live review-bank assessment.");
       }
-      let source = await this.loadReviewBank(decision.test.qtiTestIdentifier);
+      const manifestStartedAt = Date.now();
+      let catalog = await this.loadReviewBankCatalog(decision.test.qtiTestIdentifier);
+      this.recordReviewPreparationPhase("manifest_load", manifestStartedAt, {
+        candidateCount: catalog.bank.items.length
+      });
       const refreshedListing = await this.listAttempts(attemptScope);
       const refreshed = refreshedListing.attempts;
-      const refreshedCompatible = this.attemptsMatchingRequest(refreshed, requestFingerprint);
-      const refreshedDecision = selectRuntimeAssessment(tests, [...refreshedCompatible.values()].map((entry2) => entry2.selection));
-      if (refreshedDecision?.kind === "resume") {
-        return this.resumeReviewSnapshot(refreshedDecision, refreshedCompatible, refreshedListing.reviewChildren, context2);
+      const refreshedResolution = await this.resumeAvailableAttempt(tests, refreshed, requestFingerprint, pendingSupersessions, (resumeDecision) => this.resumeReviewSnapshot(resumeDecision, refreshed, refreshedListing.reviewChildren, context2));
+      if (refreshedResolution.kind === "resumed") {
+        await this.persistPendingSupersessionsBestEffort(db2, pendingSupersessions);
+        return refreshedResolution.snapshot;
       }
+      const refreshedDecision = refreshedResolution.decision;
       if (!refreshedDecision || refreshedDecision.kind !== "start") {
         throw AssessmentRuntimeError.from(assessmentNoEligibleTests(input.purpose));
       }
       decision = refreshedDecision;
-      if (source.assessment.identifier !== decision.test.qtiTestIdentifier) {
-        source = await this.loadReviewBank(decision.test.qtiTestIdentifier);
+      if (catalog.test.identifier !== decision.test.qtiTestIdentifier) {
+        catalog = await this.loadReviewBankCatalog(decision.test.qtiTestIdentifier);
       }
       const exposures = this.reviewExposures(refreshedListing.reviewChildren.values(), {
-        bankRevision: source.bank.bankRevision
+        bankRevision: catalog.bank.bankRevision
       });
       const selected = selectReviewItems({
         request: input,
-        bank: source.bank,
+        bank: catalog.bank,
         exposures
       });
       if (selected.selections.length === 0) {
@@ -118887,7 +119061,13 @@ class TimebackAssessmentRuntimeService {
         }
         throw AssessmentRuntimeError.from(assessmentReviewBankShortage(selected.fulfillment));
       }
+      const hydrationStartedAt = Date.now();
+      const source = await this.hydrateReviewBankSelection(catalog, selected.selections.map((selection) => selection.itemIdentifier));
+      this.recordReviewPreparationPhase("selected_hydration", hydrationStartedAt, {
+        selectedCount: selected.selections.length
+      });
       const assessment = projectReviewAssessment(source.assessment, source.bank, selected.selections);
+      const provisioningStartedAt = Date.now();
       const parentLineItemId = await this.ensureReviewBankLineItem({
         integration: context2.integration,
         activityId: input.activityId,
@@ -118950,6 +119130,12 @@ class TimebackAssessmentRuntimeService {
         existingChildResults: refreshedListing.reviewChildren,
         lookupMissingResults: false
       });
+      await this.persistPendingSupersessionsBestEffort(db2, pendingSupersessions);
+      this.recordReviewPreparationPhase("provisioning", provisioningStartedAt);
+      this.recordReviewPreparationPhase("total", preparationStartedAt, {
+        candidateCount: catalog.bank.items.length,
+        selectedCount: selected.selections.length
+      });
       return this.snapshot(result, metadata2, assessment, context2.integration);
     });
   }
@@ -119032,7 +119218,7 @@ class TimebackAssessmentRuntimeService {
         "app.error.message": errorMessage2(error88)
       });
     }
-    return this.deps.assessmentRuntimeLock(this.deps.db, assessmentRuntimeAttemptLockKey(params.attemptId), async (db2) => {
+    return this.deps.assessmentRuntimeLock(this.deps.db, [assessmentRuntimeAttemptLockKey(params.attemptId)], async (db2) => {
       const attempt = await this.authorizeAttempt(params, {
         db: db2,
         developerAccessValidated: true
@@ -119080,7 +119266,7 @@ class TimebackAssessmentRuntimeService {
     let preview = await this.prepareItemSubmission(params, input);
     let preparationAttempts = 1;
     while (true) {
-      const committed = await this.deps.assessmentRuntimeLock(this.deps.db, assessmentRuntimeAttemptLockKey(params.attemptId), async (db2) => {
+      const committed = await this.deps.assessmentRuntimeLock(this.deps.db, [assessmentRuntimeAttemptLockKey(params.attemptId)], async (db2) => {
         const attempt = await this.authorizeAttempt(params, {
           db: db2,
           developerAccessValidated: true
@@ -119176,7 +119362,7 @@ class TimebackAssessmentRuntimeService {
     let preview = await this.prepareDiagnosticItemSubmission(params, input);
     let preparationAttempts = 1;
     while (true) {
-      const committed = await this.deps.assessmentRuntimeLock(this.deps.db, assessmentRuntimeAttemptLockKey(params.attemptId), async (db2) => {
+      const committed = await this.deps.assessmentRuntimeLock(this.deps.db, [assessmentRuntimeAttemptLockKey(params.attemptId)], async (db2) => {
         const attempt = await this.authorizeAttempt(params, {
           db: db2,
           developerAccessValidated: true
@@ -119303,7 +119489,7 @@ class TimebackAssessmentRuntimeService {
         preparationAttempts += 1;
         preview = await this.scoreDiagnosticItemSubmission(params, input);
       } else {
-        await this.projectDiagnosticItemResponse(committed.projection);
+        await this.projectDiagnosticItemResponse(committed.projection, preview?.assessment);
         return committed.response;
       }
     }
@@ -119510,7 +119696,7 @@ class TimebackAssessmentRuntimeService {
   }) {
     await this.deps.validateDeveloperAccess(params.user, params.gameId);
     const preview = await this.prepareSubmission(params, input);
-    const submission = await this.deps.assessmentRuntimeLock(this.deps.db, assessmentRuntimeAttemptLockKey(params.attemptId), async (db2) => {
+    const submission = await this.deps.assessmentRuntimeLock(this.deps.db, [assessmentRuntimeAttemptLockKey(params.attemptId)], async (db2) => {
       const attempt = await this.authorizeAttempt(params, {
         db: db2,
         developerAccessValidated: true
@@ -119717,7 +119903,7 @@ class TimebackAssessmentRuntimeService {
             where: and(eq(gameTimebackAssessmentTests.id, test.id), eq(gameTimebackAssessmentTests.integrationId, integration.id))
           }) : undefined;
           const diagnostic = definition?.diagnosticKey ? await this.initializeHostedDiagnostic(definition, loaded.assessment) : null;
-          const reviewBank = purpose === "review" ? await buildReviewBankIndex(loaded.assessment, loaded.questions) : null;
+          const reviewBank = purpose === "review" ? await buildReviewBankIndex(loaded.assessment, loaded.questions, { customOnly: true }) : null;
           return {
             ...test,
             live: true,
@@ -119780,7 +119966,13 @@ class TimebackAssessmentRuntimeService {
     const enrollmentByCourse = new Map(enrollments.map((enrollment) => [enrollment.course.id, enrollment]));
     const candidateRows = integrations.filter((integration) => enrollmentByCourse.has(integration.courseId));
     const liveTestRows = candidateRows.length === 0 ? [] : await db2.query.gameTimebackAssessmentTests.findMany({
-      where: and(inArray(gameTimebackAssessmentTests.integrationId, candidateRows.map((row) => row.id)), eq(gameTimebackAssessmentTests.purpose, input.purpose), eq(gameTimebackAssessmentTests.status, "live"))
+      where: and(inArray(gameTimebackAssessmentTests.integrationId, candidateRows.map((row) => row.id)), eq(gameTimebackAssessmentTests.purpose, input.purpose), eq(gameTimebackAssessmentTests.status, "live")),
+      columns: {
+        integrationId: true,
+        standardFramework: true,
+        standardIdentifier: true,
+        diagnosticKey: true
+      }
     });
     const matchesMasteryStandard = input.purpose === "mastery" ? masteryStandardMatcher(input.standard) : undefined;
     const integrationIdsWithLiveTests = new Set(liveTestRows.filter((row) => (!matchesMasteryStandard || matchesMasteryStandard(assessmentStandardForRow(row))) && (input.purpose !== "diagnostic" || row.diagnosticKey === input.diagnosticKey)).map((row) => row.integrationId));
@@ -119827,10 +120019,6 @@ class TimebackAssessmentRuntimeService {
       enrollment: enrollmentByCourse.get(selection.selected.courseId)
     };
   }
-  async withStartLocks(keys, operation) {
-    const acquire = (index2, db2) => index2 === keys.length ? operation(db2) : this.deps.assessmentRuntimeLock(db2, keys[index2], (nested) => acquire(index2 + 1, nested));
-    return acquire(0, this.deps.db);
-  }
   async liveTests(integrationId, purpose, db2 = this.deps.db, requestedStandard, requestedDiagnosticKey) {
     const matchesMasteryStandard = requestedStandard ? masteryStandardMatcher(requestedStandard) : undefined;
     const rows = await db2.query.gameTimebackAssessmentTests.findMany({
@@ -119973,6 +120161,75 @@ class TimebackAssessmentRuntimeService {
     });
     return this.diagnosticSnapshot(resumed.result, resumed.metadata, assessment, integration, routing.state);
   }
+  async resumeAvailableAttempt(tests, attempts, requestFingerprint, pendingSupersessions, resume) {
+    const select3 = () => selectRuntimeAssessment(tests, [...this.attemptsMatchingRequest(attempts, requestFingerprint).values()].map((entry2) => entry2.selection));
+    return resolveAvailableAssessmentAttempt(select3(), select3, (decision) => this.resumeSnapshotOrStageSupersession(decision, attempts, pendingSupersessions, () => resume(decision)));
+  }
+  async resumeSnapshotOrStageSupersession(decision, attempts, pendingSupersessions, resume) {
+    try {
+      return await resume();
+    } catch (error88) {
+      if (!(error88 instanceof AssessmentRuntimeError) || error88.runtimeCode !== "SELECTED_TEST_VERSION_UNAVAILABLE") {
+        throw error88;
+      }
+      if (shouldConfirmAssessmentVersionUnavailable(error88.details)) {
+        await sleep(TimebackAssessmentRuntimeService.ASSESSMENT_VERSION_CONFIRMATION_DELAY_MS);
+        try {
+          return await resume();
+        } catch (confirmationError) {
+          if (!(confirmationError instanceof AssessmentRuntimeError) || confirmationError.runtimeCode !== "SELECTED_TEST_VERSION_UNAVAILABLE") {
+            throw confirmationError;
+          }
+        }
+      }
+      const staged = attempts.get(decision.attempt.attemptId);
+      pendingSupersessions.add(staged.result.sourcedId);
+      stageAssessmentAttemptSupersession(staged);
+      addEvent("assessment.attempt_supersession_staged", {
+        "app.assessment.attempt_id": decision.attempt.attemptId,
+        "app.assessment.reason": "selected_test_version_unavailable"
+      });
+      return null;
+    }
+  }
+  async persistPendingSupersessions(db2, attemptIds) {
+    for (const attemptId of [...attemptIds].toSorted()) {
+      await this.deps.assessmentRuntimeLock(db2, [assessmentRuntimeAttemptLockKey(attemptId)], async () => {
+        let result;
+        try {
+          result = await this.requireClient().api.oneroster.assessmentResults.get(attemptId);
+        } catch (error88) {
+          if (isApiError(error88) && error88.statusCode === 404) {
+            return;
+          }
+          throw error88;
+        }
+        const update2 = buildAssessmentAttemptSupersessionUpdate(result);
+        if (!update2) {
+          return;
+        }
+        await this.requireClient().api.oneroster.assessmentResults.upsert(attemptId, update2);
+        addEvent("assessment.attempt_superseded", {
+          "app.assessment.attempt_id": attemptId,
+          "app.assessment.reason": "selected_test_version_unavailable"
+        });
+      });
+    }
+  }
+  async persistPendingSupersessionsBestEffort(db2, attemptIds) {
+    if (attemptIds.size === 0) {
+      return;
+    }
+    try {
+      await this.persistPendingSupersessions(db2, attemptIds);
+    } catch (error88) {
+      addEvent("assessment.attempt_supersession_persist_failed", {
+        "app.assessment.attempt_ids": [...attemptIds].toSorted().join(","),
+        "exception.type": errorType(error88),
+        "app.error.message": errorMessage2(error88)
+      });
+    }
+  }
   async resumeReviewSnapshot(decision, attempts, existingChildResults, context2) {
     if (decision.additionalResumableAttemptIds.length > 0) {
       addEvent("assessment.multiple_resumable_attempts", {
@@ -119984,7 +120241,8 @@ class TimebackAssessmentRuntimeService {
     if (resumed.metadata.purpose !== "review") {
       throw new Error("A standards-review request selected a non-review attempt");
     }
-    const currentSource = await this.loadReviewBank(resumed.metadata.selectedTest.identifier, resumed.metadata.selectedTest.contentRevision);
+    const catalog = await this.loadReviewBankCatalog(resumed.metadata.selectedTest.identifier, resumed.metadata.selectedTest.contentRevision);
+    const currentSource = await this.hydrateReviewBankSelection(catalog, resumed.metadata.review.selections.map((selection) => selection.itemIdentifier));
     const source = this.pinnedReviewBankSource(currentSource, resumed.metadata);
     const assessment = projectReviewAssessment(source.assessment, source.bank, resumed.metadata.review.selections);
     await this.ensureReviewChildResults({
@@ -119998,20 +120256,68 @@ class TimebackAssessmentRuntimeService {
     });
     return this.snapshot(resumed.result, resumed.metadata, assessment, context2.integration);
   }
-  async loadReviewBank(identifier, expectedSourceRevision) {
+  recordReviewPreparationPhase(phase, startedAt, counts = {}) {
+    addEvent("assessment.review_preparation_phase", {
+      "app.assessment.review_phase": phase,
+      "app.assessment.duration_ms": Date.now() - startedAt,
+      ...counts.candidateCount === undefined ? {} : { "app.assessment.candidate_count": counts.candidateCount },
+      ...counts.selectedCount === undefined ? {} : { "app.assessment.selected_count": counts.selectedCount }
+    });
+  }
+  async loadReviewBankCatalog(identifier, expectedSourceRevision) {
     if (expectedSourceRevision) {
       const cached3 = this.reviewBankCache.get(`${identifier}\x00${expectedSourceRevision}`);
       if (cached3) {
         return cached3;
       }
     }
-    const loaded = await this.loadAssessmentSource(identifier, expectedSourceRevision);
-    const source = {
-      assessment: loaded.assessment,
-      bank: await buildReviewBankIndex(loaded.assessment, loaded.questions)
-    };
-    this.reviewBankCache.set(`${identifier}\x00${source.assessment.contentRevision}`, source);
-    return source;
+    let loaded;
+    try {
+      loaded = await loadQtiTestReferences(this.requireClient(), identifier);
+    } catch (error88) {
+      if (expectedSourceRevision && isApiError(error88) && error88.statusCode === 404) {
+        throw new AssessmentRuntimeError("SELECTED_TEST_VERSION_UNAVAILABLE", `The selected assessment version for ${identifier} is no longer available.`, { identifier, expectedRevision: expectedSourceRevision });
+      }
+      throw error88;
+    }
+    let bank;
+    try {
+      bank = await reviewBankIndexFromManifest(loaded.test.metadata, {
+        bankIdentifier: identifier,
+        membershipItemIdentifiers: loaded.references.questions.map((question) => question.reference.identifier)
+      });
+    } catch (error88) {
+      throw new ServiceUnavailableError(`Review bank ${identifier} has stale or invalid routing metadata. Use Update Mapping in assessment authoring.`, { reason: errorMessage2(error88) });
+    }
+    if (!bank) {
+      throw new ServiceUnavailableError(`Review bank ${identifier} needs its authoring mapping updated before it can serve review questions.`);
+    }
+    if (expectedSourceRevision && bank.sourceContentRevision !== expectedSourceRevision) {
+      throw new AssessmentRuntimeError("SELECTED_TEST_VERSION_UNAVAILABLE", `The selected assessment version for ${identifier} is no longer available.`, {
+        identifier,
+        expectedRevision: expectedSourceRevision,
+        currentRevision: bank.sourceContentRevision
+      });
+    }
+    const catalog = { ...loaded, bank };
+    this.reviewBankCache.set(`${identifier}\x00${bank.sourceContentRevision}`, catalog);
+    return catalog;
+  }
+  async hydrateReviewBankSelection(catalog, itemIdentifiers) {
+    const cacheKey2 = [
+      catalog.test.identifier,
+      catalog.bank.sourceContentRevision,
+      ...itemIdentifiers
+    ].join("\x00");
+    const cached3 = this.reviewSelectionCache.get(cacheKey2);
+    if (cached3) {
+      return { assessment: cached3, bank: catalog.bank };
+    }
+    const questions = await hydrateQtiTestQuestionSelection(this.requireClient(), catalog.references, itemIdentifiers);
+    const assessment = await buildPlayableAssessment(catalog.test, questions);
+    assessment.contentRevision = catalog.bank.sourceContentRevision;
+    this.reviewSelectionCache.set(cacheKey2, assessment);
+    return { assessment, bank: catalog.bank };
   }
   pinnedReviewBankSource(source, metadata2) {
     return {
@@ -120042,7 +120348,8 @@ class TimebackAssessmentRuntimeService {
     if (metadata2.purpose !== "review") {
       return this.loadAssessment(metadata2.selectedTest.identifier, metadata2.selectedTest.contentRevision);
     }
-    const currentSource = await this.loadReviewBank(metadata2.selectedTest.identifier, metadata2.selectedTest.contentRevision);
+    const catalog = await this.loadReviewBankCatalog(metadata2.selectedTest.identifier, metadata2.selectedTest.contentRevision);
+    const currentSource = await this.hydrateReviewBankSelection(catalog, metadata2.review.selections.map((selection) => selection.itemIdentifier));
     const source = this.pinnedReviewBankSource(currentSource, metadata2);
     return projectReviewAssessment(source.assessment, source.bank, metadata2.review.selections);
   }
@@ -120540,7 +120847,7 @@ class TimebackAssessmentRuntimeService {
   async crossAttemptLockBarrier(attemptId) {
     for (let attempt = 1;attempt <= TimebackAssessmentRuntimeService.PROJECTION_BARRIER_MAX_ATTEMPTS; attempt += 1) {
       try {
-        await this.deps.assessmentRuntimeLock(this.deps.db, assessmentRuntimeAttemptLockKey(attemptId), async () => {
+        await this.deps.assessmentRuntimeLock(this.deps.db, [assessmentRuntimeAttemptLockKey(attemptId)], async () => {
           return;
         });
         return;
@@ -120665,6 +120972,14 @@ class TimebackAssessmentRuntimeService {
     return AssessmentRuntimeError.from(assessmentAttemptUnauthorized(attemptId));
   }
   async snapshotForResult(result, metadata2, integration) {
+    if (isAssessmentAttemptSuperseded({
+      inProgress: result.inProgress ?? "",
+      scoreStatus: result.scoreStatus
+    })) {
+      throw new GoneError("This assessment attempt has been superseded.", {
+        attemptId: result.sourcedId
+      });
+    }
     const assessment = await this.loadAttemptAssessment(metadata2);
     if (this.isPlatformRoutedDiagnosticMetadata(metadata2)) {
       const routing = await this.loadAttemptDiagnosticRouting(metadata2, assessment);
@@ -122010,6 +122325,60 @@ function buildQtiLibraryListPlan(params) {
 }
 var PLAYCADEMY_QTI_SOURCE_PREFIX = "playcademy-test-";
 var PLAYCADEMY_QTI_SOURCE_UPPER_BOUND = "playcademy-test.";
+function reviewMappingIssueSummary(label, identifiers) {
+  if (identifiers.length === 0) {
+    return null;
+  }
+  const displayed = identifiers.slice(0, 10).join(", ");
+  const remainder = identifiers.length > 10 ? `, and ${identifiers.length - 10} more` : "";
+  return `${label} (${identifiers.length}): ${displayed}${remainder}`;
+}
+async function prepareReviewMappingUpdate(test, questions) {
+  const contentRevision = await assessmentContentRevision(test, questions);
+  const assessment = {
+    identifier: test.identifier,
+    contractVersion: 1,
+    contentRevision,
+    title: test.title,
+    items: questions.questions.map(({ question }) => ({
+      identifier: question.identifier,
+      title: question.title,
+      prompt: "",
+      maxScore: 1,
+      interactions: []
+    }))
+  };
+  const bank = await buildReviewBankIndex(assessment, questions, { customOnly: true });
+  const issues = reviewBankMappingIssues(bank);
+  if (issues.missingOrInvalidItemIdentifiers.length > 0 || issues.multipleStandardItemIdentifiers.length > 0) {
+    const details = [
+      reviewMappingIssueSummary("missing or invalid associations", issues.missingOrInvalidItemIdentifiers),
+      reviewMappingIssueSummary("multiple associations", issues.multipleStandardItemIdentifiers)
+    ].filter((detail) => detail !== null);
+    throw new ValidationError(`Every review question must have exactly one valid standard/node association. ${details.join("; ")}.`);
+  }
+  const manifest = await buildReviewBankManifest(bank);
+  return {
+    update: {
+      ...buildQtiTestUpdateInput(test, test.title),
+      metadata: {
+        ...test.metadata,
+        [PLAYCADEMY_REVIEW_BANK_MANIFEST_METADATA_KEY]: manifest
+      }
+    },
+    summary: {
+      itemCount: bank.items.length,
+      standardCount: Object.keys(manifest.itemsByStandard).length,
+      sourceFingerprint: manifest.sourceFingerprint
+    }
+  };
+}
+var init_timeback_review_mapping_util = __esm(() => {
+  init_assessment_runtime2();
+  init_errors2();
+  init_timeback_assessment_runtime_util();
+  init_timeback_qti_authoring_util();
+});
 function databaseConstraintName(error88) {
   if (typeof error88 !== "object" || error88 === null) {
     return;
@@ -122091,7 +122460,8 @@ class TimebackAssessmentsService {
         ownerGameSlug: ownership.gameSlug,
         integrationId,
         subject: integration.subject,
-        grade: String(integration.grade)
+        grade: String(integration.grade),
+        [PLAYCADEMY_REVIEW_BANK_MANIFEST_METADATA_KEY]: emptyReviewBankManifest(input.qtiTestIdentifier)
       }
     });
     try {
@@ -122160,7 +122530,9 @@ class TimebackAssessmentsService {
         assertAssessmentHasQuestions(loaded.questions.questions);
         assertPlayableAssessmentImportQuestions(manifest.targetStatus, loaded.questions.questions.map(({ question }) => question));
         if (entry2.purpose === "review") {
-          assertReviewAssessmentHasStandards(loaded.questions.questions.map(({ question }) => qtiAssessmentStandardRefsFromMetadata2(question.metadata).filter((standard) => canonicalReviewStandardRef(standard) !== null).length));
+          assertReviewAssessmentHasStandards(loaded.questions.questions.map(({ question }) => reviewRoutingStandardRefsFromMetadata(question.metadata, {
+            customOnly: true
+          }).length));
         }
         return { entry: entry2, test: loaded.test };
       } catch (error88) {
@@ -122312,6 +122684,10 @@ class TimebackAssessmentsService {
         if (input.status !== undefined) {
           validateAssessmentStatusTransition(row.status, input.status);
         }
+        if (!publishing && !activatingReview && nextPurpose === "review" && row.purpose !== "review") {
+          const ownership = await this.requireQtiTestOwnershipContext(integrationId, tx);
+          await this.rebuildReviewMapping(this.requireClient(), qtiTestIdentifier, ownership.gameSlug);
+        }
         if (input.title !== undefined) {
           assertDraftAssessment(row);
           assertAllAssessmentAssociationsDraft(associations);
@@ -122330,7 +122706,8 @@ class TimebackAssessmentsService {
             updates.diagnosticKey = nextDiagnostic.diagnosticKey;
             updates.diagnosticRoutingManifest = nextDiagnostic.routingManifest;
           } else {
-            await this.validateAssessmentHasQuestions(qtiTestIdentifier, nextPurpose === "review" && nextStatus === "live");
+            const reviewOwnership = nextPurpose === "review" && nextStatus === "live" ? await this.requireQtiTestOwnershipContext(integrationId, tx) : undefined;
+            await this.validateAssessmentHasQuestions(qtiTestIdentifier, reviewOwnership?.gameSlug);
           }
         }
         let updated = row;
@@ -122425,6 +122802,19 @@ class TimebackAssessmentsService {
     });
     return { ...result, questions };
   }
+  async updateReviewMapping(integrationId, qtiTestIdentifier) {
+    return this.withLockedAssessmentAssociations(integrationId, qtiTestIdentifier, async (row, tx, associations) => {
+      if (!associations.some((association) => association.purpose === "review")) {
+        throw new ValidationError("Review mapping is available only for standards-review assessments.");
+      }
+      const client2 = this.requireClient();
+      const ownership = await this.requireQtiTestOwnershipContext(integrationId, tx);
+      const result = await this.rebuildReviewMapping(client2, qtiTestIdentifier, ownership.gameSlug);
+      setAttribute("app.assessment.operation", "update_review_mapping");
+      setAttribute("app.assessment.review_mapping_item_count", result.itemCount);
+      return result;
+    });
+  }
   async listQuestionLibrary(integrationId, params) {
     const client2 = this.requireClient();
     await this.requireIntegration(integrationId);
@@ -122465,7 +122855,8 @@ class TimebackAssessmentsService {
       integrationId,
       subject: integration.subject,
       grade: String(integration.grade),
-      copiedFromTestIdentifier: sourceTestIdentifier
+      copiedFromTestIdentifier: sourceTestIdentifier,
+      [PLAYCADEMY_REVIEW_BANK_MANIFEST_METADATA_KEY]: emptyReviewBankManifest(targetTestIdentifier)
     }, itemPlan);
     const attemptedItemIdentifiers = [];
     let testCreationAttempted = false;
@@ -122853,16 +123244,20 @@ class TimebackAssessmentsService {
     const plan = buildQtiLibraryListPlan(params);
     return list(plan.params);
   }
-  async validateAssessmentHasQuestions(qtiTestIdentifier, requireReviewStandards = false) {
+  async validateAssessmentHasQuestions(qtiTestIdentifier, reviewGameSlug) {
     const client2 = this.requireClient();
-    const result = await client2.qtiApi.assessmentTests.getQuestions(qtiTestIdentifier);
+    const [test, result] = await Promise.all([
+      client2.qtiApi.assessmentTests.get(qtiTestIdentifier),
+      client2.qtiApi.assessmentTests.getQuestions(qtiTestIdentifier)
+    ]);
     assertAssessmentHasQuestions(result.questions);
     const hydrated = await hydrateQtiTestQuestions(client2, result);
     for (const { question } of hydrated.questions) {
       assertPlayableQtiQuestion(question);
     }
-    if (requireReviewStandards) {
-      assertReviewAssessmentHasStandards(hydrated.questions.map(({ question }) => qtiAssessmentStandardRefsFromMetadata2(question.metadata).filter((standard) => canonicalReviewStandardRef(standard) !== null).length));
+    if (reviewGameSlug) {
+      assertQtiTestOwnedByGame(test, reviewGameSlug);
+      await this.writeReviewMapping(client2, test, hydrated);
     }
   }
   async prepareDiagnosticAssociationChanges(row, nextPurpose, requested) {
@@ -122927,6 +123322,19 @@ class TimebackAssessmentsService {
       routingManifest: validation.manifest
     };
   }
+  async rebuildReviewMapping(client2, qtiTestIdentifier, gameSlug) {
+    const [test, references] = await Promise.all([
+      client2.qtiApi.assessmentTests.get(qtiTestIdentifier),
+      client2.qtiApi.assessmentTests.getQuestions(qtiTestIdentifier)
+    ]);
+    assertQtiTestOwnedByGame(test, gameSlug);
+    return this.writeReviewMapping(client2, test, await hydrateQtiTestQuestions(client2, references));
+  }
+  async writeReviewMapping(client2, test, questions) {
+    const prepared = await prepareReviewMappingUpdate(test, questions);
+    await client2.qtiApi.assessmentTests.update(test.identifier, prepared.update);
+    return prepared.summary;
+  }
 }
 var init_timeback_assessments_service = __esm(async () => {
   init_drizzle_orm();
@@ -122934,7 +123342,6 @@ var init_timeback_assessments_service = __esm(async () => {
   init_tables_index();
   init_spans();
   init_assessment_runtime2();
-  init_qti();
   init_timeback3();
   init_errors2();
   init_timeback_assessment_import_util();
@@ -122942,6 +123349,7 @@ var init_timeback_assessments_service = __esm(async () => {
   init_timeback_assessment_runtime_util();
   init_timeback_qti_authoring_util();
   init_timeback_qti_hydration_util();
+  init_timeback_review_mapping_util();
   await init_errors8();
 });
 function buildTimebackBaseConfigFromExistingConfig(config5) {
@@ -124928,7 +125336,7 @@ var init_upload_service = __esm(() => {
 function createPlatformServices(deps) {
   const {
     db: db2,
-    databaseLock,
+    assessmentRuntimeLock,
     config: config5,
     cloudflare: cloudflare2,
     corsKvs,
@@ -124997,7 +125405,7 @@ function createPlatformServices(deps) {
     db: db2,
     timeback: timebackClient,
     validateDeveloperAccess,
-    assessmentRuntimeLock: createAssessmentRuntimeLock(databaseLock)
+    assessmentRuntimeLock
   });
   return {
     bucket,
@@ -125015,7 +125423,6 @@ function createPlatformServices(deps) {
   };
 }
 var init_platform2 = __esm(async () => {
-  init_assessment_runtime_lock_util();
   init_bucket_service();
   init_database_service();
   init_deployment_state_service();
@@ -125695,7 +126102,7 @@ var init_standalone = __esm(() => {
   init_verify_service();
 });
 function createServices(ctx) {
-  const { db: db2, databaseLock, config: config5, providers, cloudflare: cloudflare2, timeback: timeback2, discord, corsKvs } = ctx;
+  const { db: db2, assessmentRuntimeLock, config: config5, providers, cloudflare: cloudflare2, timeback: timeback2, discord, corsKvs } = ctx;
   const { auth: auth2, storage, r2Storage, cache } = providers;
   const infra2 = createInfraServices({
     db: db2,
@@ -125717,7 +126124,7 @@ function createServices(ctx) {
   });
   const platform2 = createPlatformServices({
     db: db2,
-    databaseLock,
+    assessmentRuntimeLock,
     config: config5,
     cloudflare: cloudflare2,
     corsKvs,
@@ -125744,6 +126151,324 @@ var init_factory = __esm(async () => {
   init_standalone();
   await init_platform2();
 });
+function isAuthenticated(ctx) {
+  return ctx.user != null;
+}
+var init_types5 = () => {};
+function hasGameManagementAccess(user) {
+  return user.role === "admin" || user.role === "teacher" || user.role === "developer" && user.developerStatus === "approved";
+}
+function isDashboardWorkerKey(key) {
+  return Boolean(key?.permissions?.[DASHBOARD_PERMISSION_NAMESPACE]);
+}
+function workerKeyGrantsGameRead(key, slug2) {
+  if (!isDashboardWorkerKey(key) && !isGameWorkerKey(key)) {
+    return false;
+  }
+  const games2 = key?.permissions?.games;
+  return Boolean(games2?.includes(`read:${slug2}`) || games2?.includes(`write:${slug2}`));
+}
+function isGameWorkerKey(key) {
+  return Boolean(key?.name?.startsWith(GAME_WORKER_KEY_PREFIX));
+}
+function deniedWorkerKeyRequest(key, method, pathname) {
+  if (isDashboardWorkerKey(key) && !isAllowedDashboardWorkerRequest(method, pathname, key.permissions)) {
+    return DASHBOARD_WORKER_KEY_RESTRICTED;
+  }
+  return null;
+}
+function rejectDashboardWorkerKey(ctx) {
+  if (isDashboardWorkerKey(ctx.apiKey)) {
+    throw ApiError.forbidden(DASHBOARD_WORKER_KEY_RESTRICTED);
+  }
+}
+function assertAuthenticatedRequest(ctx) {
+  if (!isAuthenticated(ctx)) {
+    throw ApiError.unauthorized("Valid session or bearer token required");
+  }
+  if (ctx.apiKey) {
+    const denied = deniedWorkerKeyRequest(ctx.apiKey, ctx.request.method, ctx.url.pathname);
+    if (denied) {
+      throw ApiError.forbidden(denied);
+    }
+  }
+}
+function requireAuth(handler) {
+  return async (ctx) => {
+    assertAuthenticatedRequest(ctx);
+    return handler(ctx);
+  };
+}
+function requireNonAnonymous(handler) {
+  return async (ctx) => {
+    assertAuthenticatedRequest(ctx);
+    if (ctx.user.isAnonymous) {
+      throw ApiError.forbidden("This operation is not available for demo/anonymous users");
+    }
+    return handler(ctx);
+  };
+}
+function requireAnonymous(handler) {
+  return async (ctx) => {
+    assertAuthenticatedRequest(ctx);
+    if (!ctx.user.isAnonymous) {
+      throw ApiError.forbidden("This operation is only available for demo/anonymous users");
+    }
+    return handler(ctx);
+  };
+}
+function requireDeveloper(handler) {
+  return async (ctx) => {
+    assertAuthenticatedRequest(ctx);
+    rejectDashboardWorkerKey(ctx);
+    const isAdmin = ctx.user.role === "admin";
+    const isApprovedDev = ctx.user.role === "developer" && ctx.user.developerStatus === "approved";
+    if (!isAdmin && !isApprovedDev) {
+      throw ApiError.forbidden("Must be an approved developer");
+    }
+    return handler(ctx);
+  };
+}
+function requireHumanDeveloper(handler) {
+  return requireDeveloper(async (ctx) => {
+    if (isDashboardWorkerKey(ctx.apiKey) || isGameWorkerKey(ctx.apiKey)) {
+      throw ApiError.forbidden(WORKER_KEY_HUMAN_ONLY);
+    }
+    return handler(ctx);
+  });
+}
+function requireGameManagementAccess(handler) {
+  return async (ctx) => {
+    assertAuthenticatedRequest(ctx);
+    rejectDashboardWorkerKey(ctx);
+    if (!hasGameManagementAccess(ctx.user)) {
+      throw ApiError.forbidden("Game management access required");
+    }
+    return handler(ctx);
+  };
+}
+var WORKER_KEY_HUMAN_ONLY = "This operation requires your own credential — platform worker keys are refused";
+var init_auth_util = __esm(() => {
+  init_errors2();
+  init_types5();
+  init_dashboard_util();
+  init_deployment_util();
+});
+function defineControllerNames(namespace, handlers) {
+  for (const [key, handler] of Object.entries(handlers)) {
+    Object.defineProperty(handler, "name", {
+      value: `${namespace}.${key}`,
+      configurable: true
+    });
+  }
+  return handlers;
+}
+function generateUsername(email5) {
+  const baseUsername = (email5.split("@")[0] || "user").toLowerCase();
+  const cleanUsername = baseUsername.replace(/[^a-z0-9]/g, "");
+  const randomSuffix = Math.random().toString(36).substring(2, 7);
+  return `${cleanUsername}_${randomSuffix}`;
+}
+function extractRedirectPath(targetUri, currentHost) {
+  try {
+    const targetUrl = new URL(targetUri);
+    if (targetUrl.hostname === currentHost) {
+      return targetUrl.pathname + targetUrl.search;
+    }
+  } catch {}
+  return "/";
+}
+function validateLtiClaims(claims) {
+  const messageType = claims["https://purl.imsglobal.org/spec/lti/claim/message_type"];
+  const version4 = claims["https://purl.imsglobal.org/spec/lti/claim/version"];
+  if (messageType !== "LtiResourceLinkRequest") {
+    return `Invalid LTI message type: ${messageType}`;
+  }
+  if (version4 !== "1.3.0") {
+    return `Unsupported LTI version: ${version4}`;
+  }
+  return null;
+}
+var init_lti_util = () => {};
+async function provisionLtiUser(db2, claims) {
+  const database = db2;
+  const email5 = claims.email;
+  const ltiTimebackId = claims.sub;
+  const providerId = AUTH_PROVIDER_IDS.TIMEBACK_LTI;
+  if (!email5) {
+    throw new ValidationError("Email is required in LTI claims");
+  }
+  const existingAccount = await database.query.accounts.findFirst({
+    where: and(eq(accounts.accountId, ltiTimebackId), eq(accounts.providerId, providerId))
+  });
+  if (existingAccount) {
+    const user = await database.query.users.findFirst({
+      where: eq(users.id, existingAccount.userId)
+    });
+    if (user) {
+      setAttribute("app.lti.provision", "existing_account");
+      return user;
+    }
+  }
+  const existingUser = await database.query.users.findFirst({
+    where: eq(users.email, email5)
+  });
+  if (existingUser) {
+    await database.transaction(async (tx) => {
+      const existingLtiAccount = await tx.query.accounts.findFirst({
+        where: and(eq(accounts.userId, existingUser.id), eq(accounts.providerId, providerId))
+      });
+      if (!existingLtiAccount) {
+        const [account] = await tx.insert(accounts).values({
+          id: crypto4.randomUUID(),
+          userId: existingUser.id,
+          accountId: ltiTimebackId,
+          providerId,
+          accessToken: null,
+          refreshToken: null,
+          accessTokenExpiresAt: null,
+          refreshTokenExpiresAt: null,
+          createdAt: new Date,
+          updatedAt: new Date
+        }).returning({ id: accounts.id });
+        if (!account) {
+          throw new InternalError("Failed to link LTI account");
+        }
+      }
+    });
+    setAttribute("app.lti.provision", "linked_account");
+    return existingUser;
+  }
+  const newUserId = crypto4.randomUUID();
+  const createdUser = await database.transaction(async (tx) => {
+    const [insertedUser] = await tx.insert(users).values({
+      id: newUserId,
+      email: email5,
+      emailVerified: true,
+      username: generateUsername(email5),
+      name: claims.name || claims.given_name || email5.split("@")[0] || "Timeback User",
+      createdAt: new Date,
+      updatedAt: new Date
+    }).returning();
+    if (!insertedUser) {
+      throw new InternalError("Failed to create user");
+    }
+    await tx.insert(accounts).values({
+      id: crypto4.randomUUID(),
+      userId: newUserId,
+      accountId: ltiTimebackId,
+      providerId,
+      accessToken: null,
+      refreshToken: null,
+      accessTokenExpiresAt: null,
+      refreshTokenExpiresAt: null,
+      createdAt: new Date,
+      updatedAt: new Date
+    });
+    setAttribute("app.lti.provision", "created_user");
+    return insertedUser;
+  });
+  return createdUser;
+}
+var init_lti_provisioning = __esm(() => {
+  init_drizzle_orm();
+  init_src();
+  init_tables_index();
+  init_spans();
+  init_errors2();
+  init_lti_util();
+});
+function requireGameId(gameId) {
+  if (!gameId) {
+    throw ApiError.badRequest("Missing game ID");
+  }
+  if (!isValidUUID(gameId)) {
+    throw ApiError.unprocessableEntity("gameId must be a valid UUID format");
+  }
+  return gameId;
+}
+function requireSlug(slug2) {
+  if (!slug2) {
+    throw ApiError.badRequest("Missing game slug");
+  }
+  return slug2;
+}
+function requireUserId(userId) {
+  if (!userId) {
+    throw ApiError.badRequest("Missing user ID");
+  }
+  if (!isValidUUID(userId)) {
+    throw ApiError.unprocessableEntity("userId must be a valid UUID format");
+  }
+  return userId;
+}
+function parseLimitParam(url4, max) {
+  const raw = url4.searchParams.get("limit");
+  if (raw === null) {
+    return;
+  }
+  const limit = Number(raw);
+  if (!Number.isInteger(limit) || limit < 1 || limit > max) {
+    throw ApiError.badRequest(`limit must be an integer between 1 and ${max}`);
+  }
+  return limit;
+}
+var init_params_util = __esm(() => {
+  init_src9();
+  init_errors2();
+});
+function formatZodError(error88) {
+  const flat = error88.flatten();
+  const result = {};
+  if (Object.keys(flat.fieldErrors).length > 0) {
+    result.fields = {};
+    for (const [field, messages] of Object.entries(flat.fieldErrors)) {
+      if (messages && messages.length > 0) {
+        result.fields[field] = messages[0];
+      }
+    }
+  }
+  if (flat.formErrors.length > 0) {
+    result.errors = flat.formErrors;
+  }
+  return result;
+}
+function recordValidationFailure(details) {
+  setAttribute("app.request.outcome", "validation_failed");
+  addEvent("request.validation_failed", {
+    "app.validation.error": JSON.stringify(details)
+  });
+}
+async function parseRequestBody(request, schema2) {
+  try {
+    return schema2.parse(await request.json());
+  } catch (error88) {
+    if (error88 instanceof exports_external.ZodError) {
+      const details = formatZodError(error88);
+      recordValidationFailure(details);
+      throw ApiError.unprocessableEntity("Validation failed", details);
+    }
+    throw ApiError.invalidJsonBody();
+  }
+}
+var init_validation_util = __esm(() => {
+  init_esm();
+  init_spans();
+  init_errors2();
+});
+var init_utils7 = __esm(() => {
+  init_auth_util();
+  init_assessment_runtime_lock_util();
+  init_dashboard_util();
+  init_deployment_util();
+  init_leaderboard_util();
+  init_lti_util();
+  init_lti_provisioning();
+  init_params_util();
+  init_secrets_util();
+  init_timeback_util();
+  init_validation_util();
+});
 function buildTimebackClient() {
   if (!hasTimebackCredentials()) {
     return;
@@ -126116,7 +126841,7 @@ function createSandboxContext(options) {
   const services = {};
   const ctx = {
     db: options.db,
-    databaseLock: createInMemoryDatabaseLock(),
+    assessmentRuntimeLock: createInMemoryAssessmentRuntimeLock(),
     config: config5,
     providers,
     services,
@@ -126145,7 +126870,7 @@ var cachedServiceContext = null;
 var cachedDb = null;
 var init_context = __esm(async () => {
   init_config2();
-  init_locks();
+  init_utils7();
   init_src6();
   init_providers();
   await __promiseAll([
@@ -143454,7 +144179,7 @@ var nullableType2;
 var preprocessType2;
 var pipelineType2;
 var coerce2;
-var init_types5;
+var init_types6;
 var init_external4;
 var init_v32;
 var init_esm2;
@@ -143640,7 +144365,7 @@ var prepareMigrationMeta;
 var schemaRenameKey;
 var tableRenameKey;
 var columnRenameKey;
-var init_utils7;
+var init_utils8;
 var import_hanji;
 var warning;
 var error88;
@@ -145179,7 +145904,7 @@ var PrimaryKey3;
 var init_primary_keys3;
 var MySqlViewConfig;
 var init_view_common32;
-var init_utils8;
+var init_utils82;
 var _a3222;
 var _b239;
 var MySqlDeleteBase;
@@ -145927,7 +146652,7 @@ var sqlitePushIntrospect = async (db2, filters) => {
 };
 var generateDrizzleJson = (imports, prevId, schemaFilters, casing2) => {
   const prepared = prepareFromExports(imports);
-  const id = randomUUID();
+  const id = randomUUID2();
   const snapshot = generatePgSnapshot(prepared.tables, prepared.enums, prepared.schemas, prepared.sequences, prepared.roles, prepared.policies, prepared.views, prepared.matViews, casing2, schemaFilters);
   return fillPgSnapshot({
     serialized: snapshot,
@@ -145976,7 +146701,7 @@ var pushSchema = async (imports, drizzleInstance, schemaFilters, tablesFilter, e
 var generateSQLiteDrizzleJson = async (imports, prevId, casing2) => {
   const { prepareFromExports: prepareFromExports5 } = await Promise.resolve().then(() => (init_sqliteImports(), sqliteImports_exports));
   const prepared = prepareFromExports5(imports);
-  const id = randomUUID();
+  const id = randomUUID2();
   const snapshot = generateSqliteSnapshot(prepared.tables, prepared.views, casing2);
   return {
     ...snapshot,
@@ -146027,7 +146752,7 @@ var pushSQLiteSchema = async (imports, drizzleInstance) => {
 var generateMySQLDrizzleJson = async (imports, prevId, casing2) => {
   const { prepareFromExports: prepareFromExports5 } = await Promise.resolve().then(() => (init_mysqlImports(), mysqlImports_exports));
   const prepared = prepareFromExports5(imports);
-  const id = randomUUID();
+  const id = randomUUID2();
   const snapshot = generateMySqlSnapshot(prepared.tables, prepared.views, casing2);
   return {
     ...snapshot,
@@ -146077,7 +146802,7 @@ var pushMySQLSchema = async (imports, drizzleInstance, databaseName) => {
 var generateSingleStoreDrizzleJson = async (imports, prevId, casing2) => {
   const { prepareFromExports: prepareFromExports5 } = await Promise.resolve().then(() => (init_singlestoreImports(), singlestoreImports_exports));
   const prepared = prepareFromExports5(imports);
-  const id = randomUUID();
+  const id = randomUUID2();
   const snapshot = generateSingleStoreSnapshot(prepared.tables, casing2);
   return {
     ...snapshot,
@@ -149692,7 +150417,7 @@ See: https://github.com/isaacs/node-glob/issues/167`);
       })(errorUtil2 || (errorUtil2 = {}));
     }
   });
-  init_types5 = __esm2({
+  init_types6 = __esm2({
     "../node_modules/.pnpm/zod@3.25.42/node_modules/zod/dist/esm/v3/types.js"() {
       init_ZodError2();
       init_errors9();
@@ -152857,7 +153582,7 @@ See: https://github.com/isaacs/node-glob/issues/167`);
       init_parseUtil2();
       init_typeAliases2();
       init_util5();
-      init_types5();
+      init_types6();
       init_ZodError2();
     }
   });
@@ -154590,7 +155315,7 @@ See: https://github.com/isaacs/node-glob/issues/167`);
       backwardCompatibleSqliteSchema = unionType2([sqliteSchemaV5, schema3]);
     }
   });
-  init_utils7 = __esm2({
+  init_utils8 = __esm2({
     "src/utils.ts"() {
       init_views();
       init_global2();
@@ -154642,7 +155367,7 @@ See: https://github.com/isaacs/node-glob/issues/167`);
     "src/cli/views.ts"() {
       init_source();
       import_hanji = __toESM5(require_hanji());
-      init_utils7();
+      init_utils8();
       warning = (msg) => {
         (0, import_hanji.render)(`[${source_default.yellow("Warning")}] ${msg}`);
       };
@@ -157350,7 +158075,7 @@ Is ${source_default.bold.blue(this.base.name)} schema created or renamed from an
       init_pgSchema();
       init_singlestoreSchema();
       init_sqliteSchema();
-      init_utils7();
+      init_utils8();
       parseType = (schemaPrefix, type) => {
         const pgNativeTypes = [
           "uuid",
@@ -159846,7 +160571,7 @@ ${BREAKPOINT}ALTER TABLE ${tableNameWithSchema} ADD CONSTRAINT "${statement.newC
       init_source();
       init_sqliteSchema();
       init_sqlgenerator();
-      init_utils7();
+      init_utils8();
       _moveDataStatements = (tableName, json42, dataLoss = false) => {
         const statements = [];
         const newTableName = `__new_${tableName}`;
@@ -162004,7 +162729,7 @@ ${BREAKPOINT}ALTER TABLE ${tableNameWithSchema} ADD CONSTRAINT "${statement.newC
       init_singlestoreSchema();
       init_sqliteSchema();
       init_statementCombiner();
-      init_utils7();
+      init_utils8();
       makeChanged = (schema5) => {
         return objectType2({
           type: enumType2(["changed"]),
@@ -164229,7 +164954,7 @@ ${BREAKPOINT}ALTER TABLE ${tableNameWithSchema} ADD CONSTRAINT "${statement.newC
       init_pgSchema();
       init_sqliteSchema();
       init_snapshotsDiffer();
-      init_utils7();
+      init_utils8();
       init_words();
       init_outputs();
       init_views();
@@ -170789,7 +171514,7 @@ params: ${params}`);
       init_pg_core2();
       init_vector32();
       init_outputs();
-      init_utils7();
+      init_utils8();
       init_utils62();
       indexName = (tableName, columns2) => {
         return `${tableName}_${columns2.join("_")}_index`;
@@ -174798,7 +175523,7 @@ ORDER BY
       init_dist9();
       init_sqlite_core();
       init_outputs();
-      init_utils7();
+      init_utils8();
       init_utils62();
       generateSqliteSnapshot = (tables, views, casing2) => {
         const dialect6 = new SQLiteSyncDialect({ casing: casing2 });
@@ -176751,7 +177476,7 @@ ${withStyle.errorWarning(`We've found duplicated view name across ${source_defau
       MySqlViewConfig = Symbol.for("drizzle:MySqlViewConfig");
     }
   });
-  init_utils8 = __esm2({
+  init_utils82 = __esm2({
     "../drizzle-orm/dist/mysql-core/utils.js"() {
       init_entity2();
       init_dist9();
@@ -176773,7 +177498,7 @@ ${withStyle.errorWarning(`We've found duplicated view name across ${source_defau
       init_query_promise2();
       init_selection_proxy2();
       init_table8();
-      init_utils8();
+      init_utils82();
       MySqlDeleteBase = class extends (_b239 = QueryPromise2, _a3222 = entityKind2, _b239) {
         constructor(table62, session3, dialect6, withList) {
           super();
@@ -177621,7 +178346,7 @@ ${withStyle.errorWarning(`We've found duplicated view name across ${source_defau
       init_table8();
       init_utils22();
       init_view_common3();
-      init_utils8();
+      init_utils82();
       init_view_base3();
       _a325 = entityKind2;
       MySqlSelectBuilder = class {
@@ -178020,7 +178745,7 @@ ${withStyle.errorWarning(`We've found duplicated view name across ${source_defau
       init_sql5();
       init_table8();
       init_utils22();
-      init_utils8();
+      init_utils82();
       init_query_builder4();
       _a329 = entityKind2;
       MySqlInsertBuilder = class {
@@ -178124,7 +178849,7 @@ ${withStyle.errorWarning(`We've found duplicated view name across ${source_defau
       init_selection_proxy2();
       init_table8();
       init_utils22();
-      init_utils8();
+      init_utils82();
       _a331 = entityKind2;
       MySqlUpdateBuilder = class {
         constructor(table62, session3, dialect6, withList) {
@@ -178660,7 +179385,7 @@ ${withStyle.errorWarning(`We've found duplicated view name across ${source_defau
       init_subquery4();
       init_table42();
       init_unique_constraint3();
-      init_utils8();
+      init_utils82();
       init_view_common32();
       init_view3();
     }
@@ -178671,7 +179396,7 @@ ${withStyle.errorWarning(`We've found duplicated view name across ${source_defau
       init_dist9();
       init_mysql_core();
       init_outputs();
-      init_utils7();
+      init_utils8();
       init_utils62();
       handleEnumType = (type) => {
         let str = type.split("(")[1];
@@ -183105,7 +183830,7 @@ The unique index ${source_default.underline.blue(name22)} on the ${source_defaul
       import_hanji10 = __toESM5(require_hanji());
       init_sqlgenerator();
       init_singlestoreSchema();
-      init_utils7();
+      init_utils8();
       init_selector_ui();
       init_outputs();
       filterStatements2 = (statements, currentSchema, prevSchema) => {
@@ -183368,7 +184093,7 @@ The unique index ${source_default.underline.blue(name22)} on the ${source_defaul
   init_sqlgenerator();
   init_selector_ui();
   init_pgSchema();
-  init_utils7();
+  init_utils8();
   import_hanji6 = __toESM5(require_hanji());
   init_mjs();
   init_global2();
@@ -184231,323 +184956,6 @@ var init_manifest = __esm(async () => {
     });
   });
 });
-function isAuthenticated(ctx) {
-  return ctx.user != null;
-}
-var init_types6 = () => {};
-function hasGameManagementAccess(user) {
-  return user.role === "admin" || user.role === "teacher" || user.role === "developer" && user.developerStatus === "approved";
-}
-function isDashboardWorkerKey(key) {
-  return Boolean(key?.permissions?.[DASHBOARD_PERMISSION_NAMESPACE]);
-}
-function workerKeyGrantsGameRead(key, slug2) {
-  if (!isDashboardWorkerKey(key) && !isGameWorkerKey(key)) {
-    return false;
-  }
-  const games2 = key?.permissions?.games;
-  return Boolean(games2?.includes(`read:${slug2}`) || games2?.includes(`write:${slug2}`));
-}
-function isGameWorkerKey(key) {
-  return Boolean(key?.name?.startsWith(GAME_WORKER_KEY_PREFIX));
-}
-function deniedWorkerKeyRequest(key, method, pathname) {
-  if (isDashboardWorkerKey(key) && !isAllowedDashboardWorkerRequest(method, pathname, key.permissions)) {
-    return DASHBOARD_WORKER_KEY_RESTRICTED;
-  }
-  return null;
-}
-function rejectDashboardWorkerKey(ctx) {
-  if (isDashboardWorkerKey(ctx.apiKey)) {
-    throw ApiError.forbidden(DASHBOARD_WORKER_KEY_RESTRICTED);
-  }
-}
-function assertAuthenticatedRequest(ctx) {
-  if (!isAuthenticated(ctx)) {
-    throw ApiError.unauthorized("Valid session or bearer token required");
-  }
-  if (ctx.apiKey) {
-    const denied = deniedWorkerKeyRequest(ctx.apiKey, ctx.request.method, ctx.url.pathname);
-    if (denied) {
-      throw ApiError.forbidden(denied);
-    }
-  }
-}
-function requireAuth(handler) {
-  return async (ctx) => {
-    assertAuthenticatedRequest(ctx);
-    return handler(ctx);
-  };
-}
-function requireNonAnonymous(handler) {
-  return async (ctx) => {
-    assertAuthenticatedRequest(ctx);
-    if (ctx.user.isAnonymous) {
-      throw ApiError.forbidden("This operation is not available for demo/anonymous users");
-    }
-    return handler(ctx);
-  };
-}
-function requireAnonymous(handler) {
-  return async (ctx) => {
-    assertAuthenticatedRequest(ctx);
-    if (!ctx.user.isAnonymous) {
-      throw ApiError.forbidden("This operation is only available for demo/anonymous users");
-    }
-    return handler(ctx);
-  };
-}
-function requireDeveloper(handler) {
-  return async (ctx) => {
-    assertAuthenticatedRequest(ctx);
-    rejectDashboardWorkerKey(ctx);
-    const isAdmin = ctx.user.role === "admin";
-    const isApprovedDev = ctx.user.role === "developer" && ctx.user.developerStatus === "approved";
-    if (!isAdmin && !isApprovedDev) {
-      throw ApiError.forbidden("Must be an approved developer");
-    }
-    return handler(ctx);
-  };
-}
-function requireHumanDeveloper(handler) {
-  return requireDeveloper(async (ctx) => {
-    if (isDashboardWorkerKey(ctx.apiKey) || isGameWorkerKey(ctx.apiKey)) {
-      throw ApiError.forbidden(WORKER_KEY_HUMAN_ONLY);
-    }
-    return handler(ctx);
-  });
-}
-function requireGameManagementAccess(handler) {
-  return async (ctx) => {
-    assertAuthenticatedRequest(ctx);
-    rejectDashboardWorkerKey(ctx);
-    if (!hasGameManagementAccess(ctx.user)) {
-      throw ApiError.forbidden("Game management access required");
-    }
-    return handler(ctx);
-  };
-}
-var WORKER_KEY_HUMAN_ONLY = "This operation requires your own credential — platform worker keys are refused";
-var init_auth_util = __esm(() => {
-  init_errors2();
-  init_types6();
-  init_dashboard_util();
-  init_deployment_util();
-});
-function defineControllerNames(namespace, handlers) {
-  for (const [key, handler] of Object.entries(handlers)) {
-    Object.defineProperty(handler, "name", {
-      value: `${namespace}.${key}`,
-      configurable: true
-    });
-  }
-  return handlers;
-}
-function generateUsername(email5) {
-  const baseUsername = (email5.split("@")[0] || "user").toLowerCase();
-  const cleanUsername = baseUsername.replace(/[^a-z0-9]/g, "");
-  const randomSuffix = Math.random().toString(36).substring(2, 7);
-  return `${cleanUsername}_${randomSuffix}`;
-}
-function extractRedirectPath(targetUri, currentHost) {
-  try {
-    const targetUrl = new URL(targetUri);
-    if (targetUrl.hostname === currentHost) {
-      return targetUrl.pathname + targetUrl.search;
-    }
-  } catch {}
-  return "/";
-}
-function validateLtiClaims(claims) {
-  const messageType = claims["https://purl.imsglobal.org/spec/lti/claim/message_type"];
-  const version6 = claims["https://purl.imsglobal.org/spec/lti/claim/version"];
-  if (messageType !== "LtiResourceLinkRequest") {
-    return `Invalid LTI message type: ${messageType}`;
-  }
-  if (version6 !== "1.3.0") {
-    return `Unsupported LTI version: ${version6}`;
-  }
-  return null;
-}
-var init_lti_util = () => {};
-async function provisionLtiUser(db2, claims) {
-  const database = db2;
-  const email5 = claims.email;
-  const ltiTimebackId = claims.sub;
-  const providerId = AUTH_PROVIDER_IDS.TIMEBACK_LTI;
-  if (!email5) {
-    throw new ValidationError("Email is required in LTI claims");
-  }
-  const existingAccount = await database.query.accounts.findFirst({
-    where: and(eq(accounts.accountId, ltiTimebackId), eq(accounts.providerId, providerId))
-  });
-  if (existingAccount) {
-    const user = await database.query.users.findFirst({
-      where: eq(users.id, existingAccount.userId)
-    });
-    if (user) {
-      setAttribute("app.lti.provision", "existing_account");
-      return user;
-    }
-  }
-  const existingUser = await database.query.users.findFirst({
-    where: eq(users.email, email5)
-  });
-  if (existingUser) {
-    await database.transaction(async (tx) => {
-      const existingLtiAccount = await tx.query.accounts.findFirst({
-        where: and(eq(accounts.userId, existingUser.id), eq(accounts.providerId, providerId))
-      });
-      if (!existingLtiAccount) {
-        const [account] = await tx.insert(accounts).values({
-          id: crypto4.randomUUID(),
-          userId: existingUser.id,
-          accountId: ltiTimebackId,
-          providerId,
-          accessToken: null,
-          refreshToken: null,
-          accessTokenExpiresAt: null,
-          refreshTokenExpiresAt: null,
-          createdAt: new Date,
-          updatedAt: new Date
-        }).returning({ id: accounts.id });
-        if (!account) {
-          throw new InternalError("Failed to link LTI account");
-        }
-      }
-    });
-    setAttribute("app.lti.provision", "linked_account");
-    return existingUser;
-  }
-  const newUserId = crypto4.randomUUID();
-  const createdUser = await database.transaction(async (tx) => {
-    const [insertedUser] = await tx.insert(users).values({
-      id: newUserId,
-      email: email5,
-      emailVerified: true,
-      username: generateUsername(email5),
-      name: claims.name || claims.given_name || email5.split("@")[0] || "Timeback User",
-      createdAt: new Date,
-      updatedAt: new Date
-    }).returning();
-    if (!insertedUser) {
-      throw new InternalError("Failed to create user");
-    }
-    await tx.insert(accounts).values({
-      id: crypto4.randomUUID(),
-      userId: newUserId,
-      accountId: ltiTimebackId,
-      providerId,
-      accessToken: null,
-      refreshToken: null,
-      accessTokenExpiresAt: null,
-      refreshTokenExpiresAt: null,
-      createdAt: new Date,
-      updatedAt: new Date
-    });
-    setAttribute("app.lti.provision", "created_user");
-    return insertedUser;
-  });
-  return createdUser;
-}
-var init_lti_provisioning = __esm(() => {
-  init_drizzle_orm();
-  init_src();
-  init_tables_index();
-  init_spans();
-  init_errors2();
-  init_lti_util();
-});
-function requireGameId(gameId) {
-  if (!gameId) {
-    throw ApiError.badRequest("Missing game ID");
-  }
-  if (!isValidUUID(gameId)) {
-    throw ApiError.unprocessableEntity("gameId must be a valid UUID format");
-  }
-  return gameId;
-}
-function requireSlug(slug2) {
-  if (!slug2) {
-    throw ApiError.badRequest("Missing game slug");
-  }
-  return slug2;
-}
-function requireUserId(userId) {
-  if (!userId) {
-    throw ApiError.badRequest("Missing user ID");
-  }
-  if (!isValidUUID(userId)) {
-    throw ApiError.unprocessableEntity("userId must be a valid UUID format");
-  }
-  return userId;
-}
-function parseLimitParam(url4, max2) {
-  const raw2 = url4.searchParams.get("limit");
-  if (raw2 === null) {
-    return;
-  }
-  const limit = Number(raw2);
-  if (!Number.isInteger(limit) || limit < 1 || limit > max2) {
-    throw ApiError.badRequest(`limit must be an integer between 1 and ${max2}`);
-  }
-  return limit;
-}
-var init_params_util = __esm(() => {
-  init_src9();
-  init_errors2();
-});
-function formatZodError(error89) {
-  const flat = error89.flatten();
-  const result = {};
-  if (Object.keys(flat.fieldErrors).length > 0) {
-    result.fields = {};
-    for (const [field, messages] of Object.entries(flat.fieldErrors)) {
-      if (messages && messages.length > 0) {
-        result.fields[field] = messages[0];
-      }
-    }
-  }
-  if (flat.formErrors.length > 0) {
-    result.errors = flat.formErrors;
-  }
-  return result;
-}
-function recordValidationFailure(details) {
-  setAttribute("app.request.outcome", "validation_failed");
-  addEvent("request.validation_failed", {
-    "app.validation.error": JSON.stringify(details)
-  });
-}
-async function parseRequestBody(request, schema4) {
-  try {
-    return schema4.parse(await request.json());
-  } catch (error89) {
-    if (error89 instanceof exports_external.ZodError) {
-      const details = formatZodError(error89);
-      recordValidationFailure(details);
-      throw ApiError.unprocessableEntity("Validation failed", details);
-    }
-    throw ApiError.invalidJsonBody();
-  }
-}
-var init_validation_util = __esm(() => {
-  init_esm();
-  init_spans();
-  init_errors2();
-});
-var init_utils11 = __esm(() => {
-  init_auth_util();
-  init_dashboard_util();
-  init_deployment_util();
-  init_leaderboard_util();
-  init_lti_util();
-  init_lti_provisioning();
-  init_params_util();
-  init_secrets_util();
-  init_timeback_util();
-  init_validation_util();
-});
 var listFiles;
 var getFile;
 var putFile;
@@ -184556,7 +184964,7 @@ var initiateUpload;
 var bucket;
 var init_bucket_controller = __esm(() => {
   init_errors2();
-  init_utils11();
+  init_utils7();
   listFiles = requireDeveloper(async (ctx) => {
     const slug2 = ctx.params.slug;
     if (!slug2) {
@@ -184655,7 +185063,7 @@ var dashboard2;
 var init_dashboard_controller = __esm(() => {
   init_schemas_index();
   init_errors2();
-  init_utils11();
+  init_utils7();
   listUsers = requireHumanDeveloper(async (ctx) => {
     const slug2 = requireSlug(ctx.params.slug);
     const users2 = await ctx.services.dashboard.listUsers(slug2, ctx.user);
@@ -184726,7 +185134,7 @@ var init_database_controller = __esm(() => {
   init_esm();
   init_schemas_index();
   init_errors2();
-  init_utils11();
+  init_utils7();
   reset = requireDeveloper(async (ctx) => {
     const slug2 = ctx.params.slug;
     if (!slug2) {
@@ -184787,7 +185195,7 @@ var init_deploy_controller = __esm(() => {
   init_esm();
   init_schemas_index();
   init_errors2();
-  init_utils11();
+  init_utils7();
   deploy = defineControllerNames("deploy", {
     createJob: requireDeveloper(createJob),
     getJob: requireDeveloper(getJob)
@@ -184805,7 +185213,7 @@ var deploymentState;
 var init_deployment_state_controller = __esm(() => {
   init_schemas_index();
   init_errors2();
-  init_utils11();
+  init_utils7();
   get = requireDeveloper(async (ctx) => {
     const slug2 = requireSlug(ctx.params.slug);
     const include = ctx.url.searchParams.getAll("include").flatMap((value) => value.split(",")).filter(Boolean);
@@ -184875,7 +185283,7 @@ var apply;
 var getStatus;
 var developer;
 var init_developer_controller = __esm(() => {
-  init_utils11();
+  init_utils7();
   apply = requireNonAnonymous(async (ctx) => {
     await ctx.services.developer.apply(ctx.user);
   });
@@ -184898,7 +185306,7 @@ var init_domain_controller = __esm(() => {
   init_schemas_index();
   init_config2();
   init_errors2();
-  init_utils11();
+  init_utils7();
   add = requireDeveloper(async (ctx) => {
     const slug2 = ctx.params.slug;
     if (!slug2) {
@@ -184975,7 +185383,7 @@ var gameMembers2;
 var init_game_member_controller = __esm(() => {
   init_schemas_index();
   init_errors2();
-  init_utils11();
+  init_utils7();
   listMembers = requireNonAnonymous(async (ctx) => {
     const gameId = requireGameId(ctx.params.gameId);
     return ctx.services.gameMember.list(gameId, ctx.user);
@@ -185024,7 +185432,7 @@ var init_game_controller = __esm(() => {
   init_esm();
   init_schemas_index();
   init_errors2();
-  init_utils11();
+  init_utils7();
   init_auth_util();
   list2 = requireNonAnonymous(async (ctx) => ctx.services.game.list(ctx.user));
   listAccessible = requireNonAnonymous(async (ctx) => ctx.services.game.listAccessible(ctx.user));
@@ -185101,7 +185509,7 @@ var init_kv_controller = __esm(() => {
   init_esm();
   init_schemas_index();
   init_errors2();
-  init_utils11();
+  init_utils7();
   listKeys = requireDeveloper(async (ctx) => {
     const slug2 = ctx.params.slug;
     if (!slug2) {
@@ -185209,7 +185617,7 @@ var init_leaderboard_controller = __esm(() => {
   init_esm();
   init_schemas_index();
   init_errors2();
-  init_utils11();
+  init_utils7();
   submitScore = requireAuth(async (ctx) => {
     const gameId = ctx.params.gameId;
     if (!gameId) {
@@ -185317,7 +185725,7 @@ var generateToken;
 var logs;
 var init_logs_controller = __esm(() => {
   init_errors2();
-  init_utils11();
+  init_utils7();
   generateToken = requireDeveloper(async (ctx) => {
     const slug2 = ctx.params.slug;
     if (!slug2) {
@@ -185351,7 +185759,7 @@ var init_logs_controller = __esm(() => {
 var getStatus3;
 var lti;
 var init_lti_controller = __esm(() => {
-  init_utils11();
+  init_utils7();
   getStatus3 = requireNonAnonymous(async (ctx) => ctx.services.lti.getStatus(ctx.user));
   lti = defineControllerNames("lti", {
     getStatus: getStatus3
@@ -185366,7 +185774,7 @@ var init_secrets_controller = __esm(() => {
   init_esm();
   init_schemas_index();
   init_errors2();
-  init_utils11();
+  init_utils7();
   listKeys2 = requireDeveloper(async (ctx) => {
     const slug2 = ctx.params.slug;
     if (!slug2) {
@@ -185428,7 +185836,7 @@ var init_seed_controller = __esm(() => {
   init_esm();
   init_schemas_index();
   init_errors2();
-  init_utils11();
+  init_utils7();
   seed2 = requireDeveloper(async (ctx) => {
     const slug2 = ctx.params.slug;
     if (!slug2) {
@@ -185460,7 +185868,7 @@ var init_session_controller = __esm(() => {
   init_spans();
   init_tunnel();
   init_errors2();
-  init_utils11();
+  init_utils7();
   MintTokenBody = exports_external.object({
     reason: exports_external.enum(["initial", "refresh_scheduled", "refresh_stale"]).optional()
   });
@@ -185557,6 +185965,7 @@ var listAssessments;
 var createAssessment;
 var attachExistingAssessments;
 var updateAssessment;
+var updateReviewMapping;
 var reorderAssessments;
 var reorderQuestions;
 var removeAssessment;
@@ -185576,7 +185985,7 @@ var init_timeback_controller = __esm(() => {
   init_src9();
   init_timeback3();
   init_errors2();
-  init_utils11();
+  init_utils7();
   populateStudent = requireNonAnonymous(async (ctx) => {
     let providedNames;
     try {
@@ -186241,6 +186650,14 @@ var init_timeback_controller = __esm(() => {
     const body2 = await parseRequestBody(ctx.request, UpdateAssessmentRequestSchema);
     return ctx.services.timebackAssessments.updateAssessment(integrationId, testIdentifier, body2);
   });
+  updateReviewMapping = requireDeveloper(async (ctx) => {
+    const { gameId, courseId, testIdentifier } = ctx.params;
+    if (!gameId || !courseId || !testIdentifier) {
+      throw ApiError.badRequest("Missing gameId, courseId, or testIdentifier parameter");
+    }
+    const integrationId = await ctx.services.timebackAssessments.resolveIntegrationId(gameId, courseId, ctx.user);
+    return ctx.services.timebackAssessments.updateReviewMapping(integrationId, testIdentifier);
+  });
   reorderAssessments = requireDeveloper(async (ctx) => {
     const { gameId, courseId } = ctx.params;
     if (!gameId || !courseId) {
@@ -186383,6 +186800,7 @@ var init_timeback_controller = __esm(() => {
     createAssessment,
     attachExistingAssessments,
     updateAssessment,
+    updateReviewMapping,
     reorderAssessments,
     removeAssessment,
     reorderQuestions,
@@ -186401,7 +186819,7 @@ var init_upload_controller = __esm(() => {
   init_esm();
   init_schemas_index();
   init_errors2();
-  init_utils11();
+  init_utils7();
   initiate = requireDeveloper(async (ctx) => {
     let body2;
     try {
@@ -186428,7 +186846,7 @@ var users2;
 var init_user_controller = __esm(() => {
   init_src();
   init_schemas_index();
-  init_utils11();
+  init_utils7();
   getMe = requireNonAnonymous(async (ctx) => ctx.services.user.getMe(ctx.user, ctx.gameId, ctx.request.headers.get(PLAYCADEMY_BROWSER_TIME_ZONE_HEADER)));
   getDemoProfile = requireAnonymous(async (ctx) => ctx.services.user.getDemoProfile(ctx.user.id));
   updateDemoProfile = requireAnonymous(async (ctx) => {
@@ -186461,7 +186879,7 @@ var init_verify_controller = __esm(() => {
   init_esm();
   init_schemas_index();
   init_errors2();
-  init_utils11();
+  init_utils7();
   verify = defineControllerNames("verify", {
     verifyToken
   });
@@ -186642,7 +187060,7 @@ async function buildMockUserResponse(db2, user, gameId, observedTimeZone) {
 var LEARNING_TIME_ZONE_REFRESH_INTERVAL_MS2;
 var init_timeback7 = __esm(() => {
   init_drizzle_orm();
-  init_utils11();
+  init_utils7();
   init_src();
   init_tables_index();
   init_src6();
@@ -187053,7 +187471,7 @@ var init_seed2 = __esm(async () => {
   init_dist7();
   init_esm();
   init_errors2();
-  init_utils11();
+  init_utils7();
   init_schemas_index();
   await init_api3();
   gameSeedRouter = new Hono2;
@@ -187283,7 +187701,7 @@ var init_timeback8 = __esm(async () => {
   init_dist7();
   init_controllers();
   init_errors2();
-  init_utils11();
+  init_utils7();
   init_src();
   init_schemas_index();
   init_timeback3();
@@ -187522,7 +187940,7 @@ var init_lti = __esm(async () => {
   init_drizzle_orm();
   init_dist7();
   init_controllers();
-  init_utils11();
+  init_utils7();
   init_tables_index();
   init_src6();
   init_constants();