playcademy 0.13.18 → 0.13.20

package/dist/constants.d.ts

@@ -9,6 +9,33 @@ export { GAME_WORKER_DOMAINS, PLAYCADEMY_BASE_URLS, PLAYCADEMY_DOMAINS } from '@
  */
 declare const DEFAULT_API_ROUTES_DIRECTORY = "server/api";
 
+/**
+ * Configuration file constants
+ *
+ * Constants for user configuration files (tsconfig, .env, playcademy.config.js, etc.)
+ */
+/**
+ * Environment files loaded in order (later files override earlier ones)
+ *
+ * Load order:
+ * 1. .env                 ← Loaded first (base, can be committed)
+ * 2. .env.development     ← Overrides .env
+ * 3. .env.local           ← Overrides all (gitignored, personal secrets)
+ *
+ * Example: If KEY exists in both .env and .env.local, .env.local wins.
+ *
+ * This matches the pattern used by Vite, Bun, and other modern tools.
+ */
+declare const ENV_FILES: readonly [".env", ".env.development", ".env.local"];
+/**
+ * TypeScript config files to check (in priority order)
+ *
+ * Priority:
+ * 1. tsconfig.app.json  ← Modern tooling (Vite, etc.) - try first
+ * 2. tsconfig.json      ← Standard TypeScript config - fallback
+ */
+declare const TSCONFIG_FILES: readonly ["tsconfig.app.json", "tsconfig.json"];
+
 /**
  * Database-related constants
  */
@@ -99,4 +126,4 @@ declare const CONFIG_FILE_NAMES: string[];
  */
 declare const CLOUDFLARE_COMPATIBILITY_DATE = "2024-01-01";
 
-export { CALLBACK_PATH, CALLBACK_PORT, CLI_DEFAULT_OUTPUTS, CLI_DIRECTORIES, CLI_FILES, CLI_USER_DIRECTORIES, CLOUDFLARE_COMPATIBILITY_DATE, CONFIG_FILE_NAMES, DEFAULT_API_ROUTES_DIRECTORY, DEFAULT_DATABASE_DIRECTORY, DEFAULT_PORTS, DEFAULT_SCHEMA_DIRECTORY, DEFAULT_SEED_FILE, SSO_AUTH_TIMEOUT_MS, WORKSPACE_NAME };
+export { CALLBACK_PATH, CALLBACK_PORT, CLI_DEFAULT_OUTPUTS, CLI_DIRECTORIES, CLI_FILES, CLI_USER_DIRECTORIES, CLOUDFLARE_COMPATIBILITY_DATE, CONFIG_FILE_NAMES, DEFAULT_API_ROUTES_DIRECTORY, DEFAULT_DATABASE_DIRECTORY, DEFAULT_PORTS, DEFAULT_SCHEMA_DIRECTORY, DEFAULT_SEED_FILE, ENV_FILES, SSO_AUTH_TIMEOUT_MS, TSCONFIG_FILES, WORKSPACE_NAME };

package/dist/constants.js

@@ -1,6 +1,22 @@
 // src/constants/api.ts
 var DEFAULT_API_ROUTES_DIRECTORY = "server/api";
 
+// src/constants/config.ts
+var ENV_FILES = [
+  ".env",
+  // Loaded first
+  ".env.development",
+  // Overrides .env
+  ".env.local"
+  // Overrides all (highest priority)
+];
+var TSCONFIG_FILES = [
+  "tsconfig.app.json",
+  // Modern tooling (try first)
+  "tsconfig.json"
+  // Standard (fallback)
+];
+
 // src/constants/database.ts
 var DEFAULT_DATABASE_DIRECTORY = "db";
 var DEFAULT_SCHEMA_DIRECTORY = "db/schema";
@@ -121,9 +137,11 @@ export {
   DEFAULT_PORTS,
   DEFAULT_SCHEMA_DIRECTORY,
   DEFAULT_SEED_FILE,
+  ENV_FILES,
   GAME_WORKER_DOMAINS,
   PLAYCADEMY_BASE_URLS,
   PLAYCADEMY_DOMAINS,
   SSO_AUTH_TIMEOUT_MS,
+  TSCONFIG_FILES,
   WORKSPACE_NAME
 };

package/dist/db.js

@@ -412,6 +412,7 @@ function getPackageManager() {
 // src/lib/core/logger.ts
 import {
   blue,
+  blueBright,
   bold as bold2,
   cyan,
   dim as dim2,
@@ -424,8 +425,10 @@ import {
 } from "colorette";
 import { colorize } from "json-colorizer";
 function customTransform(text) {
-  const highlightCode = (text2) => text2.replace(/`([^`]+)`/g, (_, code) => greenBright(code));
-  return highlightCode(text);
+  let result = text;
+  result = result.replace(/`([^`]+)`/g, (_, code) => greenBright(code));
+  result = result.replace(/<([^>]+)>/g, (_, path) => blueBright(path));
+  return result;
 }
 function formatTable(data, title) {
   if (data.length === 0) return;

package/dist/edge-play/src/entry/middleware.ts

@@ -0,0 +1,74 @@
+/**
+ * Middleware Configuration
+ *
+ * All middleware for the game backend worker
+ */
+
+import { cors } from 'hono/cors'
+
+import { PlaycademyClient } from '@playcademy/sdk/server'
+
+import { populateProcessEnv, reconstructSecrets } from './setup'
+
+import type { Hono } from 'hono'
+import type { HonoEnv } from '../types'
+import type { RuntimeConfig } from './types'
+
+/**
+ * Register CORS middleware
+ *
+ * TODO: Harden CORS in production - restrict to trusted origins:
+ * - Game's assetBundleBase (for hosted games)
+ * - Game's externalUrl (for external games)
+ * - Platform frontend domains (hub.playcademy.com, hub.dev.playcademy.net)
+ * This would require passing game metadata through env bindings during deployment
+ */
+export function registerCors(app: Hono<HonoEnv>): void {
+    app.use(
+        '*',
+        cors({
+            origin: '*', // Permissive for now
+            allowMethods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],
+            allowHeaders: ['Content-Type', 'Authorization'],
+        }),
+    )
+}
+
+/**
+ * Register environment setup middleware
+ *
+ * Populates process.env, reconstructs secrets, and sets config
+ */
+export function registerEnvSetup(app: Hono<HonoEnv>, config: RuntimeConfig): void {
+    app.use('*', async (c, next) => {
+        populateProcessEnv(c.env)
+        c.env.secrets = reconstructSecrets(c.env)
+        c.set('config', config)
+        c.set('routeMetadata', config.__routeMetadata || [])
+        await next()
+    })
+}
+
+/**
+ * Register SDK initialization middleware
+ *
+ * Lazily initializes the Playcademy SDK on first request and
+ * makes it available via c.get('sdk')
+ */
+export function registerSdkInit(app: Hono<HonoEnv>, config: RuntimeConfig): void {
+    let sdkPromise: Promise<PlaycademyClient> | null = null
+
+    app.use('*', async (c, next) => {
+        if (!sdkPromise) {
+            sdkPromise = PlaycademyClient.init({
+                apiKey: c.env.PLAYCADEMY_API_KEY,
+                gameId: c.env.GAME_ID,
+                baseUrl: c.env.PLAYCADEMY_BASE_URL,
+                config,
+            })
+        }
+
+        c.set('sdk', await sdkPromise)
+        await next()
+    })
+}

package/dist/edge-play/src/entry/setup.ts

@@ -0,0 +1,52 @@
+/**
+ * Environment Setup Utilities
+ *
+ * Helper functions for preparing the Worker environment
+ */
+
+import { ENV_VARS } from '../constants'
+
+import type { ServerEnv } from '../types'
+
+/**
+ * Populate process.env from Worker bindings for SDK compatibility
+ */
+export function populateProcessEnv(env: ServerEnv): void {
+    globalThis.process.env = {
+        [ENV_VARS.PLAYCADEMY_API_KEY]: env.PLAYCADEMY_API_KEY,
+        [ENV_VARS.GAME_ID]: env.GAME_ID,
+        [ENV_VARS.PLAYCADEMY_BASE_URL]: env.PLAYCADEMY_BASE_URL,
+    }
+}
+
+/**
+ * Reconstruct secrets object from flat Cloudflare bindings
+ *
+ * Cloudflare bindings are flat (secrets_KEY_NAME), but we expose them
+ * as c.env.secrets.KEY_NAME for better developer ergonomics.
+ */
+export function reconstructSecrets(env: Record<string, unknown>): Record<string, string> {
+    const secrets: Record<string, string> = {}
+
+    for (const key in env) {
+        if (key.startsWith('secrets_')) {
+            const secretKey = key.slice(8) // Remove 'secrets_' prefix
+            secrets[secretKey] = env[key] as string
+        }
+    }
+
+    return secrets
+}
+
+/**
+ * Setup process global polyfill for SDK compatibility
+ *
+ * SDK code may reference process.env without importing it
+ */
+export function setupProcessGlobal(): void {
+    // @ts-expect-error - Adding global for Worker environment
+    globalThis.process = {
+        env: {}, // Populated per-request from Worker env bindings
+        cwd: () => '/',
+    }
+}

package/dist/edge-play/src/entry/types.ts

@@ -0,0 +1,30 @@
+/**
+ * Entry-specific types
+ *
+ * Types used only within the entry point bundling and runtime
+ */
+
+import type { PlaycademyConfig } from '@playcademy/sdk/server'
+
+/**
+ * Route metadata injected at build time by CLI
+ */
+export interface RouteMetadata {
+    /** Route path (e.g., '/hello') */
+    path: string
+    /** Source file path relative to api directory (e.g., 'hello.ts') */
+    file: string
+    /** HTTP methods supported by this route */
+    methods?: string[]
+}
+
+/**
+ * Runtime configuration with CLI-injected metadata
+ *
+ * This is the config available at runtime after esbuild's `define` injection.
+ * It includes both the user's playcademy.config.js and build-time metadata.
+ */
+export interface RuntimeConfig extends PlaycademyConfig {
+    /** Route metadata injected by CLI during bundling */
+    __routeMetadata?: RouteMetadata[]
+}

package/dist/edge-play/src/entry.ts

@@ -9,14 +9,12 @@
  */
 
 import { Hono } from 'hono'
-import { cors } from 'hono/cors'
 
-import { PlaycademyClient } from '@playcademy/sdk/server'
-
-import { ENV_VARS } from './constants'
+import { registerCors, registerEnvSetup, registerSdkInit } from './entry/middleware'
+import { setupProcessGlobal } from './entry/setup'
 import { registerBuiltinRoutes } from './register-routes'
 
-import type { PlaycademyConfig } from '@playcademy/sdk/server'
+import type { RuntimeConfig } from './entry/types'
 import type { HonoEnv } from './types'
 
 /**
@@ -33,76 +31,27 @@ import type { HonoEnv } from './types'
  * This enables tree-shaking: if timeback is not configured, those code paths are removed.
  * The bundled Worker only includes the routes that are actually enabled.
  */
-declare const PLAYCADEMY_CONFIG: PlaycademyConfig & {
-    customRoutes?: Array<{ path: string; file: string }>
-}
+declare const PLAYCADEMY_CONFIG: RuntimeConfig
 
-// XXX: Polyfill process global for SDK compatibility
-// SDK code may reference process.env without importing it
-// @ts-expect-error - Adding global for Worker environment
-globalThis.process = {
-    env: {}, // Populated per-request from Worker env bindings
-    cwd: () => '/',
-}
+// Setup process global polyfill for SDK compatibility
+setupProcessGlobal()
 
+// Create Hono app
 const app = new Hono<HonoEnv>()
 
-// TODO: Harden CORS in production - restrict to trusted origins:
-// - Game's assetBundleBase (for hosted games)
-// - Game's externalUrl (for external games)
-// - Platform frontend domains (hub.playcademy.com, hub.dev.playcademy.net)
-// This would require passing game metadata through env bindings during deployment
-app.use(
-    '*',
-    cors({
-        origin: '*', // Permissive for now
-        allowMethods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],
-        allowHeaders: ['Content-Type', 'Authorization'],
-    }),
-)
-
-let sdkPromise: Promise<PlaycademyClient> | null = null
-
-app.use('*', async (c, next) => {
-    // Populate process.env from Worker bindings for SDK compatibility
-    globalThis.process.env = {
-        [ENV_VARS.PLAYCADEMY_API_KEY]: c.env.PLAYCADEMY_API_KEY,
-        [ENV_VARS.GAME_ID]: c.env.GAME_ID,
-        [ENV_VARS.PLAYCADEMY_BASE_URL]: c.env.PLAYCADEMY_BASE_URL,
-    }
-
-    // Set config for all routes
-    c.set('config', PLAYCADEMY_CONFIG)
-    c.set('customRoutes', PLAYCADEMY_CONFIG.customRoutes || [])
-
-    await next()
-})
-
-// Initialize SDK lazily on first request
-app.use('*', async (c, next) => {
-    if (!sdkPromise) {
-        sdkPromise = PlaycademyClient.init({
-            apiKey: c.env[ENV_VARS.PLAYCADEMY_API_KEY],
-            gameId: c.env[ENV_VARS.GAME_ID],
-            baseUrl: c.env[ENV_VARS.PLAYCADEMY_BASE_URL],
-            config: PLAYCADEMY_CONFIG,
-        })
-    }
-
-    c.set('sdk', await sdkPromise)
-    await next()
-})
-
-/**
- * Register built-in integration routes based on enabled integrations
- *
- * This function conditionally imports and registers routes like:
- * - POST /api/integrations/timeback/end-activity (if timeback enabled)
- * - GET /api/health (always included)
- *
- * Uses dynamic imports for tree-shaking: if an integration is not enabled,
- * its route code is completely removed from the bundle.
- */
+// Register middleware
+registerCors(app)
+registerEnvSetup(app, PLAYCADEMY_CONFIG)
+registerSdkInit(app, PLAYCADEMY_CONFIG)
+
+// Register built-in integration routes based on enabled integrations
+// This function conditionally imports and registers routes like:
+// - GET /api (always included)
+// - GET /api/health (always included)
+// - POST /api/integrations/timeback/end-activity (if timeback enabled)
+//
+// Uses dynamic imports for tree-shaking: if an integration is not enabled,
+// its route code is completely removed from the bundle.
 await registerBuiltinRoutes(app, PLAYCADEMY_CONFIG.integrations)
 
 export default app

package/dist/edge-play/src/routes/health.ts

@@ -5,40 +5,69 @@
  */
 
 import type { Context } from 'hono'
-import type { HonoEnv } from '../types'
+import type { PlaycademyClient, PlaycademyConfig } from '@playcademy/sdk/server'
+import type { RouteMetadata } from '../entry/types'
+import type { HonoEnv, ServerEnv } from '../types'
+
+/**
+ * Check if all required environment variables are configured
+ */
+function isEnvConfigured(env: ServerEnv): boolean {
+    return !!env.PLAYCADEMY_API_KEY && !!env.GAME_ID && !!env.PLAYCADEMY_BASE_URL
+}
+
+/**
+ * Get count of configured secrets
+ */
+function getSecretsCount(env: ServerEnv): number {
+    return env.secrets ? Object.keys(env.secrets).length : 0
+}
+
+/**
+ * Build list of enabled integration names
+ */
+function getEnabledIntegrations(config?: PlaycademyConfig): string[] {
+    const enabled: string[] = []
+    if (config?.integrations?.timeback) enabled.push('timeback')
+    if (config?.integrations?.customRoutes) enabled.push('customRoutes')
+    if (config?.integrations?.database) enabled.push('database')
+    if (config?.integrations?.kv) enabled.push('kv')
+    if (config?.integrations?.bucket) enabled.push('bucket')
+    return enabled
+}
+
+/**
+ * Format routes into readable objects with separate path and methods
+ */
+function formatRoutes(routes: RouteMetadata[]): Array<{ path: string; methods: string[] }> {
+    return routes.map(r => ({
+        path: r.path,
+        methods: r.methods || ['*'],
+    }))
+}
+
+/**
+ * Get TimeBack debug info if applicable
+ */
+function getTimebackDebugInfo(config?: PlaycademyConfig, sdk?: PlaycademyClient) {
+    if (config?.integrations?.timeback && sdk?.timeback?.courseId) {
+        return { timeback: { courseId: sdk.timeback.courseId } }
+    }
+    return {}
+}
 
 export async function GET(c: Context<HonoEnv>): Promise<Response> {
     const config = c.get('config')
     const sdk = c.get('sdk')
+    const routeMetadata = c.get('routeMetadata')
 
     return c.json({
         status: 'ok',
         timestamp: new Date().toISOString(),
-
-        // Environment check
-        env: {
-            hasApiKey: !!c.env.PLAYCADEMY_API_KEY,
-            hasGameId: !!c.env.GAME_ID,
-            hasBaseUrl: !!c.env.PLAYCADEMY_BASE_URL,
-        },
-
-        // Config presence
-        config: {
-            hasConfig: !!config,
-            hasIntegrations: !!config?.integrations,
-        },
-
-        // TimeBack status
-        timeback: {
-            enabled: !!config?.integrations?.timeback,
-            courseIdFetched: !!sdk?.timeback?.courseId,
-        },
-
-        // Custom routes info
-        customRoutes:
-            c.get('customRoutes')?.map(r => ({
-                path: r.path,
-                methods: r.methods,
-            })) || [],
+        env: { configured: isEnvConfigured(c.env) },
+        secrets: getSecretsCount(c.env),
+        integrations: getEnabledIntegrations(config),
+        routes: formatRoutes(routeMetadata),
+        ...getTimebackDebugInfo(config, sdk),
     })
 }

package/dist/edge-play/src/routes/index.ts

@@ -2,31 +2,59 @@
  * Route discovery endpoint
  * Route: GET /api
  * Always included - lists all available routes
- *
- * NOTE: This pulls from the actual ROUTES constants used for registration,
- * ensuring the advertised routes match what's actually deployed.
  */
 
 import { ROUTES } from '../constants'
 
 import type { Context } from 'hono'
+import type { PlaycademyConfig } from '@playcademy/sdk/server'
+import type { RouteMetadata } from '../entry/types'
 import type { HonoEnv } from '../types'
 
-export async function GET(c: Context<HonoEnv>): Promise<Response> {
-    const config = c.get('config')
-    const customRoutes = c.get('customRoutes') || []
-    const routes: string[] = [`GET ${ROUTES.INDEX}`, `GET ${ROUTES.HEALTH}`]
+interface RouteInfo {
+    path: string
+    methods: string[]
+}
 
-    // Add TimeBack routes if configured
-    if (config.integrations?.timeback) {
-        routes.push(`POST ${ROUTES.TIMEBACK.END_ACTIVITY}`)
-    }
+/**
+ * Get built-in routes that are always available
+ */
+function getBuiltinRoutes(): RouteInfo[] {
+    return [
+        { path: ROUTES.INDEX, methods: ['GET'] },
+        { path: ROUTES.HEALTH, methods: ['GET'] },
+    ]
+}
 
-    // Add custom routes
-    for (const route of customRoutes) {
-        const methods = route.methods?.join(', ') || '*'
-        routes.push(`${methods} ${route.path}`)
+/**
+ * Get TimeBack integration routes if enabled
+ */
+function getTimebackRoutes(config?: PlaycademyConfig): RouteInfo[] {
+    if (config?.integrations?.timeback) {
+        return [{ path: ROUTES.TIMEBACK.END_ACTIVITY, methods: ['POST'] }]
     }
+    return []
+}
+
+/**
+ * Format custom routes from build-time metadata
+ */
+function formatCustomRoutes(routes: RouteMetadata[]): RouteInfo[] {
+    return routes.map(r => ({
+        path: r.path,
+        methods: r.methods || ['*'],
+    }))
+}
+
+export async function GET(c: Context<HonoEnv>): Promise<Response> {
+    const config = c.get('config')
+    const routeMetadata = c.get('routeMetadata')
+
+    const routes = [
+        ...getBuiltinRoutes(),
+        ...getTimebackRoutes(config),
+        ...formatCustomRoutes(routeMetadata),
+    ]
 
     return c.json({
         name: config.name,

package/dist/edge-play/src/types.ts

@@ -10,6 +10,7 @@
 /// <reference types="@cloudflare/workers-types" />
 
 import type { PlaycademyClient, PlaycademyConfig } from '@playcademy/sdk/server'
+import type { RouteMetadata } from './entry/types'
 
 /**
  * Enabled integrations from playcademy.config.js
@@ -35,6 +36,9 @@ export interface ServerEnv {
     /** Platform base URL (stage-aware: hub.playcademy.net or hub.dev.playcademy.net) */
     PLAYCADEMY_BASE_URL: string
 
+    /** Game-specific secrets (optional) */
+    secrets?: Record<string, string>
+
     /** KV namespace binding (optional, Cloudflare-specific) */
     KV?: KVNamespace
 
@@ -43,6 +47,9 @@ export interface ServerEnv {
 
     /** R2 bucket binding (optional, Cloudflare-specific) */
     BUCKET?: R2Bucket
+
+    /** Allow dynamic secret bindings (secrets_KEY_NAME) */
+    [key: string]: unknown
 }
 
 /**
@@ -51,7 +58,7 @@ export interface ServerEnv {
 export interface HonoVariables {
     sdk: PlaycademyClient
     config: PlaycademyConfig
-    customRoutes: Array<{ path: string; file: string; methods?: string[] }>
+    routeMetadata: Array<RouteMetadata>
 }
 
 /**