@playcademy/vite-plugin 1.2.1-beta.25 → 1.2.1-beta.26

package/dist/index.js

@@ -24315,7 +24315,7 @@ import path2 from "node:path";
 // package.json
 var package_default = {
   name: "@playcademy/vite-plugin",
-  version: "1.2.1-beta.25",
+  version: "1.2.1-beta.26",
   type: "module",
   exports: {
     ".": {
@@ -24767,6 +24767,7 @@ import { stdout } from "process";
 import { createHash } from "node:crypto";
 import { createHash as createHash2 } from "node:crypto";
 import crypto3 from "node:crypto";
+import * as crypto4 from "node:crypto";
 import * as s3 from "fs";
 import * as o3 from "path";
 import fs22 from "node:fs";
@@ -24774,10 +24775,9 @@ import { dirname, isAbsolute, join as join4 } from "node:path";
 import process22 from "process";
 import os2 from "os";
 import tty from "tty";
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 import fs3 from "node:fs";
 import fs4 from "node:fs";
-import * as crypto4 from "node:crypto";
 import { randomUUID as randomUUID3 } from "node:crypto";
 var __create2 = Object.create;
 var __getProtoOf2 = Object.getPrototypeOf;
@@ -25921,7 +25921,7 @@ var package_default2;
 var init_package = __esm(() => {
   package_default2 = {
     name: "@playcademy/sandbox",
-    version: "0.7.1-beta.23",
+    version: "0.7.1-beta.24",
     description: "Local development server for Playcademy game development",
     type: "module",
     exports: {
@@ -63054,67 +63054,6 @@ var init_infra2 = __esm(() => {
   init_alerts_service();
   init_kv_backup_service();
 });
-function createInMemoryDatabaseLock() {
-  const tails = new Map;
-  return async (db2, key, operation) => {
-    const previous = tails.get(key) ?? Promise.resolve();
-    let release;
-    const gate = new Promise((resolve2) => {
-      release = resolve2;
-    });
-    const tail = previous.then(() => gate);
-    tails.set(key, tail);
-    await previous;
-    try {
-      return await operation(db2);
-    } finally {
-      release();
-      if (tails.get(key) === tail) {
-        tails.delete(key);
-      }
-    }
-  };
-}
-var LockContentionError;
-var init_locks = __esm(() => {
-  init_src6();
-  LockContentionError = class LockContentionError2 extends Error {
-    constructor(key) {
-      super(`Lock is already held: ${key}`);
-      this.name = "LockContentionError";
-    }
-  };
-});
-function assessmentRuntimeStartLockKey(input) {
-  return JSON.stringify([
-    ASSESSMENT_RUNTIME_LOCK_NAMESPACE,
-    "start",
-    input.studentId,
-    input.activityId,
-    input.purpose,
-    input.courseId
-  ]);
-}
-function assessmentRuntimeAttemptLockKey(attemptId) {
-  return JSON.stringify([ASSESSMENT_RUNTIME_LOCK_NAMESPACE, "attempt", attemptId]);
-}
-function createAssessmentRuntimeLock(lock) {
-  return async (db2, key, operation) => {
-    try {
-      return await lock(db2, key, operation);
-    } catch (error) {
-      if (error instanceof LockContentionError) {
-        throw new ServiceUnavailableError("Another assessment operation is in progress. Try again shortly.", { retryable: true });
-      }
-      throw error;
-    }
-  };
-}
-var ASSESSMENT_RUNTIME_LOCK_NAMESPACE = "playcademy-assessment-runtime-v1";
-var init_assessment_runtime_lock_util = __esm(() => {
-  init_locks();
-  init_errors2();
-});
 function hasPagingOptions(options) {
   return options.cursor !== undefined || options.limit !== undefined || options.delimiter !== undefined;
 }
@@ -117910,6 +117849,109 @@ var init_timeback_admin_service = __esm(async () => {
     init_timeback_mastery_completion_util()
   ]);
 });
+function createInMemoryDatabaseLock() {
+  const tails = new Map;
+  return async (db2, key, operation) => {
+    const previous = tails.get(key) ?? Promise.resolve();
+    let release;
+    const gate = new Promise((resolve2) => {
+      release = resolve2;
+    });
+    const tail = previous.then(() => gate);
+    tails.set(key, tail);
+    await previous;
+    try {
+      return await operation(db2);
+    } finally {
+      release();
+      if (tails.get(key) === tail) {
+        tails.delete(key);
+      }
+    }
+  };
+}
+var LockContentionError;
+var init_locks = __esm(() => {
+  LockContentionError = class LockContentionError2 extends Error {
+    constructor(key) {
+      super(`Lock is already held: ${key}`);
+      this.name = "LockContentionError";
+    }
+  };
+});
+function normalizeKeys(keys) {
+  return [...new Set(keys)].toSorted();
+}
+function errorCode(error88) {
+  if (typeof error88 !== "object" || error88 === null || !("code" in error88)) {
+    return;
+  }
+  return typeof error88.code === "string" ? error88.code : undefined;
+}
+function translateAssessmentRuntimeLockError(error88) {
+  if (error88 instanceof LockContentionError) {
+    throw new ServiceUnavailableError("Another assessment operation is in progress. Try again shortly.", { retryable: true });
+  }
+  if (error88 instanceof AssessmentRuntimeLockTimeoutError) {
+    throw new ServiceUnavailableError("The assessment operation took too long. Try again shortly.", { retryable: true, reason: "LOCK_TIMEOUT" });
+  }
+  const code = errorCode(error88);
+  if (code && POSTGRES_TIMEOUT_ERROR_CODES.has(code)) {
+    throw new ServiceUnavailableError("The assessment operation took too long. Try again shortly.", { retryable: true, reason: "LOCK_TIMEOUT" });
+  }
+  if (code && POSTGRES_CONNECTION_ERROR_CODES.has(code)) {
+    throw new ServiceUnavailableError("The assessment lock connection was interrupted. Try again shortly.", { retryable: true, reason: "LOCK_CONNECTION_LOST" });
+  }
+  throw error88;
+}
+function createInMemoryAssessmentRuntimeLock() {
+  const lock = createInMemoryDatabaseLock();
+  return async (db2, keys, operation) => {
+    const ordered = normalizeKeys(keys);
+    function acquire(index2, operationDb) {
+      const key = ordered[index2];
+      return key ? lock(operationDb, key, (nested) => acquire(index2 + 1, nested)) : operation(operationDb);
+    }
+    try {
+      return await acquire(0, db2);
+    } catch (error88) {
+      return translateAssessmentRuntimeLockError(error88);
+    }
+  };
+}
+function assessmentRuntimeStartLockKey(input) {
+  return JSON.stringify([
+    ASSESSMENT_RUNTIME_LOCK_NAMESPACE,
+    "start",
+    input.studentId,
+    input.activityId,
+    input.purpose,
+    input.courseId
+  ]);
+}
+function assessmentRuntimeAttemptLockKey(attemptId) {
+  return JSON.stringify([ASSESSMENT_RUNTIME_LOCK_NAMESPACE, "attempt", attemptId]);
+}
+var ASSESSMENT_RUNTIME_LOCK_NAMESPACE = "playcademy-assessment-runtime-v1";
+var POSTGRES_TIMEOUT_ERROR_CODES;
+var POSTGRES_CONNECTION_ERROR_CODES;
+var AssessmentRuntimeLockTimeoutError;
+var init_assessment_runtime_lock_util = __esm(() => {
+  init_locks();
+  init_errors2();
+  POSTGRES_TIMEOUT_ERROR_CODES = new Set(["25P03", "57014"]);
+  POSTGRES_CONNECTION_ERROR_CODES = new Set([
+    "CONNECTION_CLOSED",
+    "CONNECTION_DESTROYED",
+    "CONNECTION_ENDED"
+  ]);
+  AssessmentRuntimeLockTimeoutError = class AssessmentRuntimeLockTimeoutError2 extends Error {
+    constructor(timeoutMs) {
+      super(`Assessment operation exceeded its ${timeoutMs}ms lock deadline`);
+      this.name = "AssessmentRuntimeLockTimeoutError";
+    }
+  };
+});
 function validateAssessmentStatusTransition(current, next) {
   if (current === next) {
     return;
@@ -118733,8 +118775,8 @@ class TimebackAssessmentRuntimeService {
       activityId: input.activityId,
       purpose: input.purpose,
       courseId: row.courseId
-    })).toSorted();
-    return this.withStartLocks(lockKeys, async (db2) => {
+    }));
+    return this.deps.assessmentRuntimeLock(this.deps.db, lockKeys, async (db2) => {
       const context2 = await this.selectIntegration(candidates, studentId, input);
       const attemptScope = {
         studentId,
@@ -118751,7 +118793,7 @@ class TimebackAssessmentRuntimeService {
       const attempts = listing.attempts;
       const initialResolution = await this.resumeAvailableAttempt(tests, attempts, requestFingerprint, pendingSupersessions, (resumeDecision) => this.resumeSnapshot(resumeDecision, attempts, context2.integration));
       if (initialResolution.kind === "resumed") {
-        await this.persistPendingSupersessionsBestEffort(pendingSupersessions);
+        await this.persistPendingSupersessionsBestEffort(db2, pendingSupersessions);
         return initialResolution.snapshot;
       }
       let decision = this.requireDecision(initialResolution.decision, input.purpose);
@@ -118760,7 +118802,7 @@ class TimebackAssessmentRuntimeService {
       const refreshed = refreshedListing.attempts;
       const refreshedResolution = await this.resumeAvailableAttempt(tests, refreshed, requestFingerprint, pendingSupersessions, (resumeDecision) => this.resumeSnapshot(resumeDecision, refreshed, context2.integration));
       if (refreshedResolution.kind === "resumed") {
-        await this.persistPendingSupersessionsBestEffort(pendingSupersessions);
+        await this.persistPendingSupersessionsBestEffort(db2, pendingSupersessions);
         return refreshedResolution.snapshot;
       }
       decision = this.requireDecision(refreshedResolution.decision, input.purpose);
@@ -118821,7 +118863,7 @@ class TimebackAssessmentRuntimeService {
           grade: context2.integration.grade
         })
       });
-      await this.persistPendingSupersessionsBestEffort(pendingSupersessions);
+      await this.persistPendingSupersessionsBestEffort(db2, pendingSupersessions);
       return this.snapshot(result, metadata2, assessment, context2.integration);
     });
   }
@@ -118838,8 +118880,8 @@ class TimebackAssessmentRuntimeService {
       activityId: input.activityId,
       purpose: input.purpose,
       courseId: row.courseId
-    })).toSorted();
-    return this.withStartLocks(lockKeys, async (db2) => {
+    }));
+    return this.deps.assessmentRuntimeLock(this.deps.db, lockKeys, async (db2) => {
       const context2 = await this.selectIntegration(candidates, studentId, input);
       const attemptScope = {
         studentId,
@@ -118855,7 +118897,7 @@ class TimebackAssessmentRuntimeService {
       ]);
       const initialResolution = await this.resumeAvailableAttempt(tests, listing.attempts, requestFingerprint, pendingSupersessions, (resumeDecision) => this.resumeDiagnosticSnapshot(resumeDecision, listing.attempts, context2.integration, db2));
       if (initialResolution.kind === "resumed") {
-        await this.persistPendingSupersessionsBestEffort(pendingSupersessions);
+        await this.persistPendingSupersessionsBestEffort(db2, pendingSupersessions);
         return initialResolution.snapshot;
       }
       let decision = this.requireDecision(initialResolution.decision, input.purpose);
@@ -118866,7 +118908,7 @@ class TimebackAssessmentRuntimeService {
       const refreshed = refreshedListing.attempts;
       const refreshedResolution = await this.resumeAvailableAttempt(tests, refreshed, requestFingerprint, pendingSupersessions, (resumeDecision) => this.resumeDiagnosticSnapshot(resumeDecision, refreshed, context2.integration, db2));
       if (refreshedResolution.kind === "resumed") {
-        await this.persistPendingSupersessionsBestEffort(pendingSupersessions);
+        await this.persistPendingSupersessionsBestEffort(db2, pendingSupersessions);
         return refreshedResolution.snapshot;
       }
       decision = this.requireDecision(refreshedResolution.decision, input.purpose);
@@ -118938,7 +118980,7 @@ class TimebackAssessmentRuntimeService {
           grade: context2.integration.grade
         })
       });
-      await this.persistPendingSupersessionsBestEffort(pendingSupersessions);
+      await this.persistPendingSupersessionsBestEffort(db2, pendingSupersessions);
       return this.diagnosticSnapshot(result, metadata2, assessment, context2.integration, routing.state);
     });
   }
@@ -118957,8 +118999,8 @@ class TimebackAssessmentRuntimeService {
       activityId: input.activityId,
       purpose: input.purpose,
       courseId: row.courseId
-    })).toSorted();
-    return this.withStartLocks(lockKeys, async (db2) => {
+    }));
+    return this.deps.assessmentRuntimeLock(this.deps.db, lockKeys, async (db2) => {
       const context2 = await this.selectIntegration(candidates, studentId, input);
       const attemptScope = {
         studentId,
@@ -118975,7 +119017,7 @@ class TimebackAssessmentRuntimeService {
       const attempts = listing.attempts;
       const initialResolution = await this.resumeAvailableAttempt(tests, attempts, requestFingerprint, pendingSupersessions, (resumeDecision) => this.resumeReviewSnapshot(resumeDecision, attempts, listing.reviewChildren, context2));
       if (initialResolution.kind === "resumed") {
-        await this.persistPendingSupersessionsBestEffort(pendingSupersessions);
+        await this.persistPendingSupersessionsBestEffort(db2, pendingSupersessions);
         return initialResolution.snapshot;
       }
       let decision = initialResolution.decision;
@@ -118994,7 +119036,7 @@ class TimebackAssessmentRuntimeService {
       const refreshed = refreshedListing.attempts;
       const refreshedResolution = await this.resumeAvailableAttempt(tests, refreshed, requestFingerprint, pendingSupersessions, (resumeDecision) => this.resumeReviewSnapshot(resumeDecision, refreshed, refreshedListing.reviewChildren, context2));
       if (refreshedResolution.kind === "resumed") {
-        await this.persistPendingSupersessionsBestEffort(pendingSupersessions);
+        await this.persistPendingSupersessionsBestEffort(db2, pendingSupersessions);
         return refreshedResolution.snapshot;
       }
       const refreshedDecision = refreshedResolution.decision;
@@ -119088,7 +119130,7 @@ class TimebackAssessmentRuntimeService {
         existingChildResults: refreshedListing.reviewChildren,
         lookupMissingResults: false
       });
-      await this.persistPendingSupersessionsBestEffort(pendingSupersessions);
+      await this.persistPendingSupersessionsBestEffort(db2, pendingSupersessions);
       this.recordReviewPreparationPhase("provisioning", provisioningStartedAt);
       this.recordReviewPreparationPhase("total", preparationStartedAt, {
         candidateCount: catalog.bank.items.length,
@@ -119176,7 +119218,7 @@ class TimebackAssessmentRuntimeService {
         "app.error.message": errorMessage2(error88)
       });
     }
-    return this.deps.assessmentRuntimeLock(this.deps.db, assessmentRuntimeAttemptLockKey(params.attemptId), async (db2) => {
+    return this.deps.assessmentRuntimeLock(this.deps.db, [assessmentRuntimeAttemptLockKey(params.attemptId)], async (db2) => {
       const attempt = await this.authorizeAttempt(params, {
         db: db2,
         developerAccessValidated: true
@@ -119224,7 +119266,7 @@ class TimebackAssessmentRuntimeService {
     let preview = await this.prepareItemSubmission(params, input);
     let preparationAttempts = 1;
     while (true) {
-      const committed = await this.deps.assessmentRuntimeLock(this.deps.db, assessmentRuntimeAttemptLockKey(params.attemptId), async (db2) => {
+      const committed = await this.deps.assessmentRuntimeLock(this.deps.db, [assessmentRuntimeAttemptLockKey(params.attemptId)], async (db2) => {
         const attempt = await this.authorizeAttempt(params, {
           db: db2,
           developerAccessValidated: true
@@ -119320,7 +119362,7 @@ class TimebackAssessmentRuntimeService {
     let preview = await this.prepareDiagnosticItemSubmission(params, input);
     let preparationAttempts = 1;
     while (true) {
-      const committed = await this.deps.assessmentRuntimeLock(this.deps.db, assessmentRuntimeAttemptLockKey(params.attemptId), async (db2) => {
+      const committed = await this.deps.assessmentRuntimeLock(this.deps.db, [assessmentRuntimeAttemptLockKey(params.attemptId)], async (db2) => {
         const attempt = await this.authorizeAttempt(params, {
           db: db2,
           developerAccessValidated: true
@@ -119654,7 +119696,7 @@ class TimebackAssessmentRuntimeService {
   }) {
     await this.deps.validateDeveloperAccess(params.user, params.gameId);
     const preview = await this.prepareSubmission(params, input);
-    const submission = await this.deps.assessmentRuntimeLock(this.deps.db, assessmentRuntimeAttemptLockKey(params.attemptId), async (db2) => {
+    const submission = await this.deps.assessmentRuntimeLock(this.deps.db, [assessmentRuntimeAttemptLockKey(params.attemptId)], async (db2) => {
       const attempt = await this.authorizeAttempt(params, {
         db: db2,
         developerAccessValidated: true
@@ -119977,10 +120019,6 @@ class TimebackAssessmentRuntimeService {
       enrollment: enrollmentByCourse.get(selection.selected.courseId)
     };
   }
-  async withStartLocks(keys, operation) {
-    const acquire = (index2, db2) => index2 === keys.length ? operation(db2) : this.deps.assessmentRuntimeLock(db2, keys[index2], (nested) => acquire(index2 + 1, nested));
-    return acquire(0, this.deps.db);
-  }
   async liveTests(integrationId, purpose, db2 = this.deps.db, requestedStandard, requestedDiagnosticKey) {
     const matchesMasteryStandard = requestedStandard ? masteryStandardMatcher(requestedStandard) : undefined;
     const rows = await db2.query.gameTimebackAssessmentTests.findMany({
@@ -120154,9 +120192,9 @@ class TimebackAssessmentRuntimeService {
       return null;
     }
   }
-  async persistPendingSupersessions(attemptIds) {
+  async persistPendingSupersessions(db2, attemptIds) {
     for (const attemptId of [...attemptIds].toSorted()) {
-      await this.deps.assessmentRuntimeLock(this.deps.db, assessmentRuntimeAttemptLockKey(attemptId), async () => {
+      await this.deps.assessmentRuntimeLock(db2, [assessmentRuntimeAttemptLockKey(attemptId)], async () => {
         let result;
         try {
           result = await this.requireClient().api.oneroster.assessmentResults.get(attemptId);
@@ -120178,12 +120216,12 @@ class TimebackAssessmentRuntimeService {
       });
     }
   }
-  async persistPendingSupersessionsBestEffort(attemptIds) {
+  async persistPendingSupersessionsBestEffort(db2, attemptIds) {
     if (attemptIds.size === 0) {
       return;
     }
     try {
-      await this.persistPendingSupersessions(attemptIds);
+      await this.persistPendingSupersessions(db2, attemptIds);
     } catch (error88) {
       addEvent("assessment.attempt_supersession_persist_failed", {
         "app.assessment.attempt_ids": [...attemptIds].toSorted().join(","),
@@ -120809,7 +120847,7 @@ class TimebackAssessmentRuntimeService {
   async crossAttemptLockBarrier(attemptId) {
     for (let attempt = 1;attempt <= TimebackAssessmentRuntimeService.PROJECTION_BARRIER_MAX_ATTEMPTS; attempt += 1) {
       try {
-        await this.deps.assessmentRuntimeLock(this.deps.db, assessmentRuntimeAttemptLockKey(attemptId), async () => {
+        await this.deps.assessmentRuntimeLock(this.deps.db, [assessmentRuntimeAttemptLockKey(attemptId)], async () => {
           return;
         });
         return;
@@ -125298,7 +125336,7 @@ var init_upload_service = __esm(() => {
 function createPlatformServices(deps) {
   const {
     db: db2,
-    databaseLock,
+    assessmentRuntimeLock,
     config: config5,
     cloudflare: cloudflare2,
     corsKvs,
@@ -125367,7 +125405,7 @@ function createPlatformServices(deps) {
     db: db2,
     timeback: timebackClient,
     validateDeveloperAccess,
-    assessmentRuntimeLock: createAssessmentRuntimeLock(databaseLock)
+    assessmentRuntimeLock
   });
   return {
     bucket,
@@ -125385,7 +125423,6 @@ function createPlatformServices(deps) {
   };
 }
 var init_platform2 = __esm(async () => {
-  init_assessment_runtime_lock_util();
   init_bucket_service();
   init_database_service();
   init_deployment_state_service();
@@ -126065,7 +126102,7 @@ var init_standalone = __esm(() => {
   init_verify_service();
 });
 function createServices(ctx) {
-  const { db: db2, databaseLock, config: config5, providers, cloudflare: cloudflare2, timeback: timeback2, discord, corsKvs } = ctx;
+  const { db: db2, assessmentRuntimeLock, config: config5, providers, cloudflare: cloudflare2, timeback: timeback2, discord, corsKvs } = ctx;
   const { auth: auth2, storage, r2Storage, cache } = providers;
   const infra2 = createInfraServices({
     db: db2,
@@ -126087,7 +126124,7 @@ function createServices(ctx) {
   });
   const platform2 = createPlatformServices({
     db: db2,
-    databaseLock,
+    assessmentRuntimeLock,
     config: config5,
     cloudflare: cloudflare2,
     corsKvs,
@@ -126114,6 +126151,324 @@ var init_factory = __esm(async () => {
   init_standalone();
   await init_platform2();
 });
+function isAuthenticated(ctx) {
+  return ctx.user != null;
+}
+var init_types5 = () => {};
+function hasGameManagementAccess(user) {
+  return user.role === "admin" || user.role === "teacher" || user.role === "developer" && user.developerStatus === "approved";
+}
+function isDashboardWorkerKey(key) {
+  return Boolean(key?.permissions?.[DASHBOARD_PERMISSION_NAMESPACE]);
+}
+function workerKeyGrantsGameRead(key, slug2) {
+  if (!isDashboardWorkerKey(key) && !isGameWorkerKey(key)) {
+    return false;
+  }
+  const games2 = key?.permissions?.games;
+  return Boolean(games2?.includes(`read:${slug2}`) || games2?.includes(`write:${slug2}`));
+}
+function isGameWorkerKey(key) {
+  return Boolean(key?.name?.startsWith(GAME_WORKER_KEY_PREFIX));
+}
+function deniedWorkerKeyRequest(key, method, pathname) {
+  if (isDashboardWorkerKey(key) && !isAllowedDashboardWorkerRequest(method, pathname, key.permissions)) {
+    return DASHBOARD_WORKER_KEY_RESTRICTED;
+  }
+  return null;
+}
+function rejectDashboardWorkerKey(ctx) {
+  if (isDashboardWorkerKey(ctx.apiKey)) {
+    throw ApiError.forbidden(DASHBOARD_WORKER_KEY_RESTRICTED);
+  }
+}
+function assertAuthenticatedRequest(ctx) {
+  if (!isAuthenticated(ctx)) {
+    throw ApiError.unauthorized("Valid session or bearer token required");
+  }
+  if (ctx.apiKey) {
+    const denied = deniedWorkerKeyRequest(ctx.apiKey, ctx.request.method, ctx.url.pathname);
+    if (denied) {
+      throw ApiError.forbidden(denied);
+    }
+  }
+}
+function requireAuth(handler) {
+  return async (ctx) => {
+    assertAuthenticatedRequest(ctx);
+    return handler(ctx);
+  };
+}
+function requireNonAnonymous(handler) {
+  return async (ctx) => {
+    assertAuthenticatedRequest(ctx);
+    if (ctx.user.isAnonymous) {
+      throw ApiError.forbidden("This operation is not available for demo/anonymous users");
+    }
+    return handler(ctx);
+  };
+}
+function requireAnonymous(handler) {
+  return async (ctx) => {
+    assertAuthenticatedRequest(ctx);
+    if (!ctx.user.isAnonymous) {
+      throw ApiError.forbidden("This operation is only available for demo/anonymous users");
+    }
+    return handler(ctx);
+  };
+}
+function requireDeveloper(handler) {
+  return async (ctx) => {
+    assertAuthenticatedRequest(ctx);
+    rejectDashboardWorkerKey(ctx);
+    const isAdmin = ctx.user.role === "admin";
+    const isApprovedDev = ctx.user.role === "developer" && ctx.user.developerStatus === "approved";
+    if (!isAdmin && !isApprovedDev) {
+      throw ApiError.forbidden("Must be an approved developer");
+    }
+    return handler(ctx);
+  };
+}
+function requireHumanDeveloper(handler) {
+  return requireDeveloper(async (ctx) => {
+    if (isDashboardWorkerKey(ctx.apiKey) || isGameWorkerKey(ctx.apiKey)) {
+      throw ApiError.forbidden(WORKER_KEY_HUMAN_ONLY);
+    }
+    return handler(ctx);
+  });
+}
+function requireGameManagementAccess(handler) {
+  return async (ctx) => {
+    assertAuthenticatedRequest(ctx);
+    rejectDashboardWorkerKey(ctx);
+    if (!hasGameManagementAccess(ctx.user)) {
+      throw ApiError.forbidden("Game management access required");
+    }
+    return handler(ctx);
+  };
+}
+var WORKER_KEY_HUMAN_ONLY = "This operation requires your own credential — platform worker keys are refused";
+var init_auth_util = __esm(() => {
+  init_errors2();
+  init_types5();
+  init_dashboard_util();
+  init_deployment_util();
+});
+function defineControllerNames(namespace, handlers) {
+  for (const [key, handler] of Object.entries(handlers)) {
+    Object.defineProperty(handler, "name", {
+      value: `${namespace}.${key}`,
+      configurable: true
+    });
+  }
+  return handlers;
+}
+function generateUsername(email5) {
+  const baseUsername = (email5.split("@")[0] || "user").toLowerCase();
+  const cleanUsername = baseUsername.replace(/[^a-z0-9]/g, "");
+  const randomSuffix = Math.random().toString(36).substring(2, 7);
+  return `${cleanUsername}_${randomSuffix}`;
+}
+function extractRedirectPath(targetUri, currentHost) {
+  try {
+    const targetUrl = new URL(targetUri);
+    if (targetUrl.hostname === currentHost) {
+      return targetUrl.pathname + targetUrl.search;
+    }
+  } catch {}
+  return "/";
+}
+function validateLtiClaims(claims) {
+  const messageType = claims["https://purl.imsglobal.org/spec/lti/claim/message_type"];
+  const version4 = claims["https://purl.imsglobal.org/spec/lti/claim/version"];
+  if (messageType !== "LtiResourceLinkRequest") {
+    return `Invalid LTI message type: ${messageType}`;
+  }
+  if (version4 !== "1.3.0") {
+    return `Unsupported LTI version: ${version4}`;
+  }
+  return null;
+}
+var init_lti_util = () => {};
+async function provisionLtiUser(db2, claims) {
+  const database = db2;
+  const email5 = claims.email;
+  const ltiTimebackId = claims.sub;
+  const providerId = AUTH_PROVIDER_IDS.TIMEBACK_LTI;
+  if (!email5) {
+    throw new ValidationError("Email is required in LTI claims");
+  }
+  const existingAccount = await database.query.accounts.findFirst({
+    where: and(eq(accounts.accountId, ltiTimebackId), eq(accounts.providerId, providerId))
+  });
+  if (existingAccount) {
+    const user = await database.query.users.findFirst({
+      where: eq(users.id, existingAccount.userId)
+    });
+    if (user) {
+      setAttribute("app.lti.provision", "existing_account");
+      return user;
+    }
+  }
+  const existingUser = await database.query.users.findFirst({
+    where: eq(users.email, email5)
+  });
+  if (existingUser) {
+    await database.transaction(async (tx) => {
+      const existingLtiAccount = await tx.query.accounts.findFirst({
+        where: and(eq(accounts.userId, existingUser.id), eq(accounts.providerId, providerId))
+      });
+      if (!existingLtiAccount) {
+        const [account] = await tx.insert(accounts).values({
+          id: crypto4.randomUUID(),
+          userId: existingUser.id,
+          accountId: ltiTimebackId,
+          providerId,
+          accessToken: null,
+          refreshToken: null,
+          accessTokenExpiresAt: null,
+          refreshTokenExpiresAt: null,
+          createdAt: new Date,
+          updatedAt: new Date
+        }).returning({ id: accounts.id });
+        if (!account) {
+          throw new InternalError("Failed to link LTI account");
+        }
+      }
+    });
+    setAttribute("app.lti.provision", "linked_account");
+    return existingUser;
+  }
+  const newUserId = crypto4.randomUUID();
+  const createdUser = await database.transaction(async (tx) => {
+    const [insertedUser] = await tx.insert(users).values({
+      id: newUserId,
+      email: email5,
+      emailVerified: true,
+      username: generateUsername(email5),
+      name: claims.name || claims.given_name || email5.split("@")[0] || "Timeback User",
+      createdAt: new Date,
+      updatedAt: new Date
+    }).returning();
+    if (!insertedUser) {
+      throw new InternalError("Failed to create user");
+    }
+    await tx.insert(accounts).values({
+      id: crypto4.randomUUID(),
+      userId: newUserId,
+      accountId: ltiTimebackId,
+      providerId,
+      accessToken: null,
+      refreshToken: null,
+      accessTokenExpiresAt: null,
+      refreshTokenExpiresAt: null,
+      createdAt: new Date,
+      updatedAt: new Date
+    });
+    setAttribute("app.lti.provision", "created_user");
+    return insertedUser;
+  });
+  return createdUser;
+}
+var init_lti_provisioning = __esm(() => {
+  init_drizzle_orm();
+  init_src();
+  init_tables_index();
+  init_spans();
+  init_errors2();
+  init_lti_util();
+});
+function requireGameId(gameId) {
+  if (!gameId) {
+    throw ApiError.badRequest("Missing game ID");
+  }
+  if (!isValidUUID(gameId)) {
+    throw ApiError.unprocessableEntity("gameId must be a valid UUID format");
+  }
+  return gameId;
+}
+function requireSlug(slug2) {
+  if (!slug2) {
+    throw ApiError.badRequest("Missing game slug");
+  }
+  return slug2;
+}
+function requireUserId(userId) {
+  if (!userId) {
+    throw ApiError.badRequest("Missing user ID");
+  }
+  if (!isValidUUID(userId)) {
+    throw ApiError.unprocessableEntity("userId must be a valid UUID format");
+  }
+  return userId;
+}
+function parseLimitParam(url4, max) {
+  const raw = url4.searchParams.get("limit");
+  if (raw === null) {
+    return;
+  }
+  const limit = Number(raw);
+  if (!Number.isInteger(limit) || limit < 1 || limit > max) {
+    throw ApiError.badRequest(`limit must be an integer between 1 and ${max}`);
+  }
+  return limit;
+}
+var init_params_util = __esm(() => {
+  init_src9();
+  init_errors2();
+});
+function formatZodError(error88) {
+  const flat = error88.flatten();
+  const result = {};
+  if (Object.keys(flat.fieldErrors).length > 0) {
+    result.fields = {};
+    for (const [field, messages] of Object.entries(flat.fieldErrors)) {
+      if (messages && messages.length > 0) {
+        result.fields[field] = messages[0];
+      }
+    }
+  }
+  if (flat.formErrors.length > 0) {
+    result.errors = flat.formErrors;
+  }
+  return result;
+}
+function recordValidationFailure(details) {
+  setAttribute("app.request.outcome", "validation_failed");
+  addEvent("request.validation_failed", {
+    "app.validation.error": JSON.stringify(details)
+  });
+}
+async function parseRequestBody(request, schema2) {
+  try {
+    return schema2.parse(await request.json());
+  } catch (error88) {
+    if (error88 instanceof exports_external.ZodError) {
+      const details = formatZodError(error88);
+      recordValidationFailure(details);
+      throw ApiError.unprocessableEntity("Validation failed", details);
+    }
+    throw ApiError.invalidJsonBody();
+  }
+}
+var init_validation_util = __esm(() => {
+  init_esm();
+  init_spans();
+  init_errors2();
+});
+var init_utils7 = __esm(() => {
+  init_auth_util();
+  init_assessment_runtime_lock_util();
+  init_dashboard_util();
+  init_deployment_util();
+  init_leaderboard_util();
+  init_lti_util();
+  init_lti_provisioning();
+  init_params_util();
+  init_secrets_util();
+  init_timeback_util();
+  init_validation_util();
+});
 function buildTimebackClient() {
   if (!hasTimebackCredentials()) {
     return;
@@ -126486,7 +126841,7 @@ function createSandboxContext(options) {
   const services = {};
   const ctx = {
     db: options.db,
-    databaseLock: createInMemoryDatabaseLock(),
+    assessmentRuntimeLock: createInMemoryAssessmentRuntimeLock(),
     config: config5,
     providers,
     services,
@@ -126515,7 +126870,7 @@ var cachedServiceContext = null;
 var cachedDb = null;
 var init_context = __esm(async () => {
   init_config2();
-  init_locks();
+  init_utils7();
   init_src6();
   init_providers();
   await __promiseAll([
@@ -143824,7 +144179,7 @@ var nullableType2;
 var preprocessType2;
 var pipelineType2;
 var coerce2;
-var init_types5;
+var init_types6;
 var init_external4;
 var init_v32;
 var init_esm2;
@@ -144010,7 +144365,7 @@ var prepareMigrationMeta;
 var schemaRenameKey;
 var tableRenameKey;
 var columnRenameKey;
-var init_utils7;
+var init_utils8;
 var import_hanji;
 var warning;
 var error88;
@@ -145549,7 +145904,7 @@ var PrimaryKey3;
 var init_primary_keys3;
 var MySqlViewConfig;
 var init_view_common32;
-var init_utils8;
+var init_utils82;
 var _a3222;
 var _b239;
 var MySqlDeleteBase;
@@ -146297,7 +146652,7 @@ var sqlitePushIntrospect = async (db2, filters) => {
 };
 var generateDrizzleJson = (imports, prevId, schemaFilters, casing2) => {
   const prepared = prepareFromExports(imports);
-  const id = randomUUID();
+  const id = randomUUID2();
   const snapshot = generatePgSnapshot(prepared.tables, prepared.enums, prepared.schemas, prepared.sequences, prepared.roles, prepared.policies, prepared.views, prepared.matViews, casing2, schemaFilters);
   return fillPgSnapshot({
     serialized: snapshot,
@@ -146346,7 +146701,7 @@ var pushSchema = async (imports, drizzleInstance, schemaFilters, tablesFilter, e
 var generateSQLiteDrizzleJson = async (imports, prevId, casing2) => {
   const { prepareFromExports: prepareFromExports5 } = await Promise.resolve().then(() => (init_sqliteImports(), sqliteImports_exports));
   const prepared = prepareFromExports5(imports);
-  const id = randomUUID();
+  const id = randomUUID2();
   const snapshot = generateSqliteSnapshot(prepared.tables, prepared.views, casing2);
   return {
     ...snapshot,
@@ -146397,7 +146752,7 @@ var pushSQLiteSchema = async (imports, drizzleInstance) => {
 var generateMySQLDrizzleJson = async (imports, prevId, casing2) => {
   const { prepareFromExports: prepareFromExports5 } = await Promise.resolve().then(() => (init_mysqlImports(), mysqlImports_exports));
   const prepared = prepareFromExports5(imports);
-  const id = randomUUID();
+  const id = randomUUID2();
   const snapshot = generateMySqlSnapshot(prepared.tables, prepared.views, casing2);
   return {
     ...snapshot,
@@ -146447,7 +146802,7 @@ var pushMySQLSchema = async (imports, drizzleInstance, databaseName) => {
 var generateSingleStoreDrizzleJson = async (imports, prevId, casing2) => {
   const { prepareFromExports: prepareFromExports5 } = await Promise.resolve().then(() => (init_singlestoreImports(), singlestoreImports_exports));
   const prepared = prepareFromExports5(imports);
-  const id = randomUUID();
+  const id = randomUUID2();
   const snapshot = generateSingleStoreSnapshot(prepared.tables, casing2);
   return {
     ...snapshot,
@@ -150062,7 +150417,7 @@ See: https://github.com/isaacs/node-glob/issues/167`);
       })(errorUtil2 || (errorUtil2 = {}));
     }
   });
-  init_types5 = __esm2({
+  init_types6 = __esm2({
     "../node_modules/.pnpm/zod@3.25.42/node_modules/zod/dist/esm/v3/types.js"() {
       init_ZodError2();
       init_errors9();
@@ -153227,7 +153582,7 @@ See: https://github.com/isaacs/node-glob/issues/167`);
       init_parseUtil2();
       init_typeAliases2();
       init_util5();
-      init_types5();
+      init_types6();
       init_ZodError2();
     }
   });
@@ -154960,7 +155315,7 @@ See: https://github.com/isaacs/node-glob/issues/167`);
       backwardCompatibleSqliteSchema = unionType2([sqliteSchemaV5, schema3]);
     }
   });
-  init_utils7 = __esm2({
+  init_utils8 = __esm2({
     "src/utils.ts"() {
       init_views();
       init_global2();
@@ -155012,7 +155367,7 @@ See: https://github.com/isaacs/node-glob/issues/167`);
     "src/cli/views.ts"() {
       init_source();
       import_hanji = __toESM5(require_hanji());
-      init_utils7();
+      init_utils8();
       warning = (msg) => {
         (0, import_hanji.render)(`[${source_default.yellow("Warning")}] ${msg}`);
       };
@@ -157720,7 +158075,7 @@ Is ${source_default.bold.blue(this.base.name)} schema created or renamed from an
       init_pgSchema();
       init_singlestoreSchema();
       init_sqliteSchema();
-      init_utils7();
+      init_utils8();
       parseType = (schemaPrefix, type) => {
         const pgNativeTypes = [
           "uuid",
@@ -160216,7 +160571,7 @@ ${BREAKPOINT}ALTER TABLE ${tableNameWithSchema} ADD CONSTRAINT "${statement.newC
       init_source();
       init_sqliteSchema();
       init_sqlgenerator();
-      init_utils7();
+      init_utils8();
       _moveDataStatements = (tableName, json42, dataLoss = false) => {
         const statements = [];
         const newTableName = `__new_${tableName}`;
@@ -162374,7 +162729,7 @@ ${BREAKPOINT}ALTER TABLE ${tableNameWithSchema} ADD CONSTRAINT "${statement.newC
       init_singlestoreSchema();
       init_sqliteSchema();
       init_statementCombiner();
-      init_utils7();
+      init_utils8();
       makeChanged = (schema5) => {
         return objectType2({
           type: enumType2(["changed"]),
@@ -164599,7 +164954,7 @@ ${BREAKPOINT}ALTER TABLE ${tableNameWithSchema} ADD CONSTRAINT "${statement.newC
       init_pgSchema();
       init_sqliteSchema();
       init_snapshotsDiffer();
-      init_utils7();
+      init_utils8();
       init_words();
       init_outputs();
       init_views();
@@ -171159,7 +171514,7 @@ params: ${params}`);
       init_pg_core2();
       init_vector32();
       init_outputs();
-      init_utils7();
+      init_utils8();
       init_utils62();
       indexName = (tableName, columns2) => {
         return `${tableName}_${columns2.join("_")}_index`;
@@ -175168,7 +175523,7 @@ ORDER BY
       init_dist9();
       init_sqlite_core();
       init_outputs();
-      init_utils7();
+      init_utils8();
       init_utils62();
       generateSqliteSnapshot = (tables, views, casing2) => {
         const dialect6 = new SQLiteSyncDialect({ casing: casing2 });
@@ -177121,7 +177476,7 @@ ${withStyle.errorWarning(`We've found duplicated view name across ${source_defau
       MySqlViewConfig = Symbol.for("drizzle:MySqlViewConfig");
     }
   });
-  init_utils8 = __esm2({
+  init_utils82 = __esm2({
     "../drizzle-orm/dist/mysql-core/utils.js"() {
       init_entity2();
       init_dist9();
@@ -177143,7 +177498,7 @@ ${withStyle.errorWarning(`We've found duplicated view name across ${source_defau
       init_query_promise2();
       init_selection_proxy2();
       init_table8();
-      init_utils8();
+      init_utils82();
       MySqlDeleteBase = class extends (_b239 = QueryPromise2, _a3222 = entityKind2, _b239) {
         constructor(table62, session3, dialect6, withList) {
           super();
@@ -177991,7 +178346,7 @@ ${withStyle.errorWarning(`We've found duplicated view name across ${source_defau
       init_table8();
       init_utils22();
       init_view_common3();
-      init_utils8();
+      init_utils82();
       init_view_base3();
       _a325 = entityKind2;
       MySqlSelectBuilder = class {
@@ -178390,7 +178745,7 @@ ${withStyle.errorWarning(`We've found duplicated view name across ${source_defau
       init_sql5();
       init_table8();
       init_utils22();
-      init_utils8();
+      init_utils82();
       init_query_builder4();
       _a329 = entityKind2;
       MySqlInsertBuilder = class {
@@ -178494,7 +178849,7 @@ ${withStyle.errorWarning(`We've found duplicated view name across ${source_defau
       init_selection_proxy2();
       init_table8();
       init_utils22();
-      init_utils8();
+      init_utils82();
       _a331 = entityKind2;
       MySqlUpdateBuilder = class {
         constructor(table62, session3, dialect6, withList) {
@@ -179030,7 +179385,7 @@ ${withStyle.errorWarning(`We've found duplicated view name across ${source_defau
       init_subquery4();
       init_table42();
       init_unique_constraint3();
-      init_utils8();
+      init_utils82();
       init_view_common32();
       init_view3();
     }
@@ -179041,7 +179396,7 @@ ${withStyle.errorWarning(`We've found duplicated view name across ${source_defau
       init_dist9();
       init_mysql_core();
       init_outputs();
-      init_utils7();
+      init_utils8();
       init_utils62();
       handleEnumType = (type) => {
         let str = type.split("(")[1];
@@ -183475,7 +183830,7 @@ The unique index ${source_default.underline.blue(name22)} on the ${source_defaul
       import_hanji10 = __toESM5(require_hanji());
       init_sqlgenerator();
       init_singlestoreSchema();
-      init_utils7();
+      init_utils8();
       init_selector_ui();
       init_outputs();
       filterStatements2 = (statements, currentSchema, prevSchema) => {
@@ -183738,7 +184093,7 @@ The unique index ${source_default.underline.blue(name22)} on the ${source_defaul
   init_sqlgenerator();
   init_selector_ui();
   init_pgSchema();
-  init_utils7();
+  init_utils8();
   import_hanji6 = __toESM5(require_hanji());
   init_mjs();
   init_global2();
@@ -184601,323 +184956,6 @@ var init_manifest = __esm(async () => {
     });
   });
 });
-function isAuthenticated(ctx) {
-  return ctx.user != null;
-}
-var init_types6 = () => {};
-function hasGameManagementAccess(user) {
-  return user.role === "admin" || user.role === "teacher" || user.role === "developer" && user.developerStatus === "approved";
-}
-function isDashboardWorkerKey(key) {
-  return Boolean(key?.permissions?.[DASHBOARD_PERMISSION_NAMESPACE]);
-}
-function workerKeyGrantsGameRead(key, slug2) {
-  if (!isDashboardWorkerKey(key) && !isGameWorkerKey(key)) {
-    return false;
-  }
-  const games2 = key?.permissions?.games;
-  return Boolean(games2?.includes(`read:${slug2}`) || games2?.includes(`write:${slug2}`));
-}
-function isGameWorkerKey(key) {
-  return Boolean(key?.name?.startsWith(GAME_WORKER_KEY_PREFIX));
-}
-function deniedWorkerKeyRequest(key, method, pathname) {
-  if (isDashboardWorkerKey(key) && !isAllowedDashboardWorkerRequest(method, pathname, key.permissions)) {
-    return DASHBOARD_WORKER_KEY_RESTRICTED;
-  }
-  return null;
-}
-function rejectDashboardWorkerKey(ctx) {
-  if (isDashboardWorkerKey(ctx.apiKey)) {
-    throw ApiError.forbidden(DASHBOARD_WORKER_KEY_RESTRICTED);
-  }
-}
-function assertAuthenticatedRequest(ctx) {
-  if (!isAuthenticated(ctx)) {
-    throw ApiError.unauthorized("Valid session or bearer token required");
-  }
-  if (ctx.apiKey) {
-    const denied = deniedWorkerKeyRequest(ctx.apiKey, ctx.request.method, ctx.url.pathname);
-    if (denied) {
-      throw ApiError.forbidden(denied);
-    }
-  }
-}
-function requireAuth(handler) {
-  return async (ctx) => {
-    assertAuthenticatedRequest(ctx);
-    return handler(ctx);
-  };
-}
-function requireNonAnonymous(handler) {
-  return async (ctx) => {
-    assertAuthenticatedRequest(ctx);
-    if (ctx.user.isAnonymous) {
-      throw ApiError.forbidden("This operation is not available for demo/anonymous users");
-    }
-    return handler(ctx);
-  };
-}
-function requireAnonymous(handler) {
-  return async (ctx) => {
-    assertAuthenticatedRequest(ctx);
-    if (!ctx.user.isAnonymous) {
-      throw ApiError.forbidden("This operation is only available for demo/anonymous users");
-    }
-    return handler(ctx);
-  };
-}
-function requireDeveloper(handler) {
-  return async (ctx) => {
-    assertAuthenticatedRequest(ctx);
-    rejectDashboardWorkerKey(ctx);
-    const isAdmin = ctx.user.role === "admin";
-    const isApprovedDev = ctx.user.role === "developer" && ctx.user.developerStatus === "approved";
-    if (!isAdmin && !isApprovedDev) {
-      throw ApiError.forbidden("Must be an approved developer");
-    }
-    return handler(ctx);
-  };
-}
-function requireHumanDeveloper(handler) {
-  return requireDeveloper(async (ctx) => {
-    if (isDashboardWorkerKey(ctx.apiKey) || isGameWorkerKey(ctx.apiKey)) {
-      throw ApiError.forbidden(WORKER_KEY_HUMAN_ONLY);
-    }
-    return handler(ctx);
-  });
-}
-function requireGameManagementAccess(handler) {
-  return async (ctx) => {
-    assertAuthenticatedRequest(ctx);
-    rejectDashboardWorkerKey(ctx);
-    if (!hasGameManagementAccess(ctx.user)) {
-      throw ApiError.forbidden("Game management access required");
-    }
-    return handler(ctx);
-  };
-}
-var WORKER_KEY_HUMAN_ONLY = "This operation requires your own credential — platform worker keys are refused";
-var init_auth_util = __esm(() => {
-  init_errors2();
-  init_types6();
-  init_dashboard_util();
-  init_deployment_util();
-});
-function defineControllerNames(namespace, handlers) {
-  for (const [key, handler] of Object.entries(handlers)) {
-    Object.defineProperty(handler, "name", {
-      value: `${namespace}.${key}`,
-      configurable: true
-    });
-  }
-  return handlers;
-}
-function generateUsername(email5) {
-  const baseUsername = (email5.split("@")[0] || "user").toLowerCase();
-  const cleanUsername = baseUsername.replace(/[^a-z0-9]/g, "");
-  const randomSuffix = Math.random().toString(36).substring(2, 7);
-  return `${cleanUsername}_${randomSuffix}`;
-}
-function extractRedirectPath(targetUri, currentHost) {
-  try {
-    const targetUrl = new URL(targetUri);
-    if (targetUrl.hostname === currentHost) {
-      return targetUrl.pathname + targetUrl.search;
-    }
-  } catch {}
-  return "/";
-}
-function validateLtiClaims(claims) {
-  const messageType = claims["https://purl.imsglobal.org/spec/lti/claim/message_type"];
-  const version6 = claims["https://purl.imsglobal.org/spec/lti/claim/version"];
-  if (messageType !== "LtiResourceLinkRequest") {
-    return `Invalid LTI message type: ${messageType}`;
-  }
-  if (version6 !== "1.3.0") {
-    return `Unsupported LTI version: ${version6}`;
-  }
-  return null;
-}
-var init_lti_util = () => {};
-async function provisionLtiUser(db2, claims) {
-  const database = db2;
-  const email5 = claims.email;
-  const ltiTimebackId = claims.sub;
-  const providerId = AUTH_PROVIDER_IDS.TIMEBACK_LTI;
-  if (!email5) {
-    throw new ValidationError("Email is required in LTI claims");
-  }
-  const existingAccount = await database.query.accounts.findFirst({
-    where: and(eq(accounts.accountId, ltiTimebackId), eq(accounts.providerId, providerId))
-  });
-  if (existingAccount) {
-    const user = await database.query.users.findFirst({
-      where: eq(users.id, existingAccount.userId)
-    });
-    if (user) {
-      setAttribute("app.lti.provision", "existing_account");
-      return user;
-    }
-  }
-  const existingUser = await database.query.users.findFirst({
-    where: eq(users.email, email5)
-  });
-  if (existingUser) {
-    await database.transaction(async (tx) => {
-      const existingLtiAccount = await tx.query.accounts.findFirst({
-        where: and(eq(accounts.userId, existingUser.id), eq(accounts.providerId, providerId))
-      });
-      if (!existingLtiAccount) {
-        const [account] = await tx.insert(accounts).values({
-          id: crypto4.randomUUID(),
-          userId: existingUser.id,
-          accountId: ltiTimebackId,
-          providerId,
-          accessToken: null,
-          refreshToken: null,
-          accessTokenExpiresAt: null,
-          refreshTokenExpiresAt: null,
-          createdAt: new Date,
-          updatedAt: new Date
-        }).returning({ id: accounts.id });
-        if (!account) {
-          throw new InternalError("Failed to link LTI account");
-        }
-      }
-    });
-    setAttribute("app.lti.provision", "linked_account");
-    return existingUser;
-  }
-  const newUserId = crypto4.randomUUID();
-  const createdUser = await database.transaction(async (tx) => {
-    const [insertedUser] = await tx.insert(users).values({
-      id: newUserId,
-      email: email5,
-      emailVerified: true,
-      username: generateUsername(email5),
-      name: claims.name || claims.given_name || email5.split("@")[0] || "Timeback User",
-      createdAt: new Date,
-      updatedAt: new Date
-    }).returning();
-    if (!insertedUser) {
-      throw new InternalError("Failed to create user");
-    }
-    await tx.insert(accounts).values({
-      id: crypto4.randomUUID(),
-      userId: newUserId,
-      accountId: ltiTimebackId,
-      providerId,
-      accessToken: null,
-      refreshToken: null,
-      accessTokenExpiresAt: null,
-      refreshTokenExpiresAt: null,
-      createdAt: new Date,
-      updatedAt: new Date
-    });
-    setAttribute("app.lti.provision", "created_user");
-    return insertedUser;
-  });
-  return createdUser;
-}
-var init_lti_provisioning = __esm(() => {
-  init_drizzle_orm();
-  init_src();
-  init_tables_index();
-  init_spans();
-  init_errors2();
-  init_lti_util();
-});
-function requireGameId(gameId) {
-  if (!gameId) {
-    throw ApiError.badRequest("Missing game ID");
-  }
-  if (!isValidUUID(gameId)) {
-    throw ApiError.unprocessableEntity("gameId must be a valid UUID format");
-  }
-  return gameId;
-}
-function requireSlug(slug2) {
-  if (!slug2) {
-    throw ApiError.badRequest("Missing game slug");
-  }
-  return slug2;
-}
-function requireUserId(userId) {
-  if (!userId) {
-    throw ApiError.badRequest("Missing user ID");
-  }
-  if (!isValidUUID(userId)) {
-    throw ApiError.unprocessableEntity("userId must be a valid UUID format");
-  }
-  return userId;
-}
-function parseLimitParam(url4, max2) {
-  const raw2 = url4.searchParams.get("limit");
-  if (raw2 === null) {
-    return;
-  }
-  const limit = Number(raw2);
-  if (!Number.isInteger(limit) || limit < 1 || limit > max2) {
-    throw ApiError.badRequest(`limit must be an integer between 1 and ${max2}`);
-  }
-  return limit;
-}
-var init_params_util = __esm(() => {
-  init_src9();
-  init_errors2();
-});
-function formatZodError(error89) {
-  const flat = error89.flatten();
-  const result = {};
-  if (Object.keys(flat.fieldErrors).length > 0) {
-    result.fields = {};
-    for (const [field, messages] of Object.entries(flat.fieldErrors)) {
-      if (messages && messages.length > 0) {
-        result.fields[field] = messages[0];
-      }
-    }
-  }
-  if (flat.formErrors.length > 0) {
-    result.errors = flat.formErrors;
-  }
-  return result;
-}
-function recordValidationFailure(details) {
-  setAttribute("app.request.outcome", "validation_failed");
-  addEvent("request.validation_failed", {
-    "app.validation.error": JSON.stringify(details)
-  });
-}
-async function parseRequestBody(request, schema4) {
-  try {
-    return schema4.parse(await request.json());
-  } catch (error89) {
-    if (error89 instanceof exports_external.ZodError) {
-      const details = formatZodError(error89);
-      recordValidationFailure(details);
-      throw ApiError.unprocessableEntity("Validation failed", details);
-    }
-    throw ApiError.invalidJsonBody();
-  }
-}
-var init_validation_util = __esm(() => {
-  init_esm();
-  init_spans();
-  init_errors2();
-});
-var init_utils11 = __esm(() => {
-  init_auth_util();
-  init_dashboard_util();
-  init_deployment_util();
-  init_leaderboard_util();
-  init_lti_util();
-  init_lti_provisioning();
-  init_params_util();
-  init_secrets_util();
-  init_timeback_util();
-  init_validation_util();
-});
 var listFiles;
 var getFile;
 var putFile;
@@ -184926,7 +184964,7 @@ var initiateUpload;
 var bucket;
 var init_bucket_controller = __esm(() => {
   init_errors2();
-  init_utils11();
+  init_utils7();
   listFiles = requireDeveloper(async (ctx) => {
     const slug2 = ctx.params.slug;
     if (!slug2) {
@@ -185025,7 +185063,7 @@ var dashboard2;
 var init_dashboard_controller = __esm(() => {
   init_schemas_index();
   init_errors2();
-  init_utils11();
+  init_utils7();
   listUsers = requireHumanDeveloper(async (ctx) => {
     const slug2 = requireSlug(ctx.params.slug);
     const users2 = await ctx.services.dashboard.listUsers(slug2, ctx.user);
@@ -185096,7 +185134,7 @@ var init_database_controller = __esm(() => {
   init_esm();
   init_schemas_index();
   init_errors2();
-  init_utils11();
+  init_utils7();
   reset = requireDeveloper(async (ctx) => {
     const slug2 = ctx.params.slug;
     if (!slug2) {
@@ -185157,7 +185195,7 @@ var init_deploy_controller = __esm(() => {
   init_esm();
   init_schemas_index();
   init_errors2();
-  init_utils11();
+  init_utils7();
   deploy = defineControllerNames("deploy", {
     createJob: requireDeveloper(createJob),
     getJob: requireDeveloper(getJob)
@@ -185175,7 +185213,7 @@ var deploymentState;
 var init_deployment_state_controller = __esm(() => {
   init_schemas_index();
   init_errors2();
-  init_utils11();
+  init_utils7();
   get = requireDeveloper(async (ctx) => {
     const slug2 = requireSlug(ctx.params.slug);
     const include = ctx.url.searchParams.getAll("include").flatMap((value) => value.split(",")).filter(Boolean);
@@ -185245,7 +185283,7 @@ var apply;
 var getStatus;
 var developer;
 var init_developer_controller = __esm(() => {
-  init_utils11();
+  init_utils7();
   apply = requireNonAnonymous(async (ctx) => {
     await ctx.services.developer.apply(ctx.user);
   });
@@ -185268,7 +185306,7 @@ var init_domain_controller = __esm(() => {
   init_schemas_index();
   init_config2();
   init_errors2();
-  init_utils11();
+  init_utils7();
   add = requireDeveloper(async (ctx) => {
     const slug2 = ctx.params.slug;
     if (!slug2) {
@@ -185345,7 +185383,7 @@ var gameMembers2;
 var init_game_member_controller = __esm(() => {
   init_schemas_index();
   init_errors2();
-  init_utils11();
+  init_utils7();
   listMembers = requireNonAnonymous(async (ctx) => {
     const gameId = requireGameId(ctx.params.gameId);
     return ctx.services.gameMember.list(gameId, ctx.user);
@@ -185394,7 +185432,7 @@ var init_game_controller = __esm(() => {
   init_esm();
   init_schemas_index();
   init_errors2();
-  init_utils11();
+  init_utils7();
   init_auth_util();
   list2 = requireNonAnonymous(async (ctx) => ctx.services.game.list(ctx.user));
   listAccessible = requireNonAnonymous(async (ctx) => ctx.services.game.listAccessible(ctx.user));
@@ -185471,7 +185509,7 @@ var init_kv_controller = __esm(() => {
   init_esm();
   init_schemas_index();
   init_errors2();
-  init_utils11();
+  init_utils7();
   listKeys = requireDeveloper(async (ctx) => {
     const slug2 = ctx.params.slug;
     if (!slug2) {
@@ -185579,7 +185617,7 @@ var init_leaderboard_controller = __esm(() => {
   init_esm();
   init_schemas_index();
   init_errors2();
-  init_utils11();
+  init_utils7();
   submitScore = requireAuth(async (ctx) => {
     const gameId = ctx.params.gameId;
     if (!gameId) {
@@ -185687,7 +185725,7 @@ var generateToken;
 var logs;
 var init_logs_controller = __esm(() => {
   init_errors2();
-  init_utils11();
+  init_utils7();
   generateToken = requireDeveloper(async (ctx) => {
     const slug2 = ctx.params.slug;
     if (!slug2) {
@@ -185721,7 +185759,7 @@ var init_logs_controller = __esm(() => {
 var getStatus3;
 var lti;
 var init_lti_controller = __esm(() => {
-  init_utils11();
+  init_utils7();
   getStatus3 = requireNonAnonymous(async (ctx) => ctx.services.lti.getStatus(ctx.user));
   lti = defineControllerNames("lti", {
     getStatus: getStatus3
@@ -185736,7 +185774,7 @@ var init_secrets_controller = __esm(() => {
   init_esm();
   init_schemas_index();
   init_errors2();
-  init_utils11();
+  init_utils7();
   listKeys2 = requireDeveloper(async (ctx) => {
     const slug2 = ctx.params.slug;
     if (!slug2) {
@@ -185798,7 +185836,7 @@ var init_seed_controller = __esm(() => {
   init_esm();
   init_schemas_index();
   init_errors2();
-  init_utils11();
+  init_utils7();
   seed2 = requireDeveloper(async (ctx) => {
     const slug2 = ctx.params.slug;
     if (!slug2) {
@@ -185830,7 +185868,7 @@ var init_session_controller = __esm(() => {
   init_spans();
   init_tunnel();
   init_errors2();
-  init_utils11();
+  init_utils7();
   MintTokenBody = exports_external.object({
     reason: exports_external.enum(["initial", "refresh_scheduled", "refresh_stale"]).optional()
   });
@@ -185947,7 +185985,7 @@ var init_timeback_controller = __esm(() => {
   init_src9();
   init_timeback3();
   init_errors2();
-  init_utils11();
+  init_utils7();
   populateStudent = requireNonAnonymous(async (ctx) => {
     let providedNames;
     try {
@@ -186781,7 +186819,7 @@ var init_upload_controller = __esm(() => {
   init_esm();
   init_schemas_index();
   init_errors2();
-  init_utils11();
+  init_utils7();
   initiate = requireDeveloper(async (ctx) => {
     let body2;
     try {
@@ -186808,7 +186846,7 @@ var users2;
 var init_user_controller = __esm(() => {
   init_src();
   init_schemas_index();
-  init_utils11();
+  init_utils7();
   getMe = requireNonAnonymous(async (ctx) => ctx.services.user.getMe(ctx.user, ctx.gameId, ctx.request.headers.get(PLAYCADEMY_BROWSER_TIME_ZONE_HEADER)));
   getDemoProfile = requireAnonymous(async (ctx) => ctx.services.user.getDemoProfile(ctx.user.id));
   updateDemoProfile = requireAnonymous(async (ctx) => {
@@ -186841,7 +186879,7 @@ var init_verify_controller = __esm(() => {
   init_esm();
   init_schemas_index();
   init_errors2();
-  init_utils11();
+  init_utils7();
   verify = defineControllerNames("verify", {
     verifyToken
   });
@@ -187022,7 +187060,7 @@ async function buildMockUserResponse(db2, user, gameId, observedTimeZone) {
 var LEARNING_TIME_ZONE_REFRESH_INTERVAL_MS2;
 var init_timeback7 = __esm(() => {
   init_drizzle_orm();
-  init_utils11();
+  init_utils7();
   init_src();
   init_tables_index();
   init_src6();
@@ -187433,7 +187471,7 @@ var init_seed2 = __esm(async () => {
   init_dist7();
   init_esm();
   init_errors2();
-  init_utils11();
+  init_utils7();
   init_schemas_index();
   await init_api3();
   gameSeedRouter = new Hono2;
@@ -187663,7 +187701,7 @@ var init_timeback8 = __esm(async () => {
   init_dist7();
   init_controllers();
   init_errors2();
-  init_utils11();
+  init_utils7();
   init_src();
   init_schemas_index();
   init_timeback3();
@@ -187902,7 +187940,7 @@ var init_lti = __esm(async () => {
   init_drizzle_orm();
   init_dist7();
   init_controllers();
-  init_utils11();
+  init_utils7();
   init_tables_index();
   init_src6();
   init_constants();