playcademy 0.28.1-beta.1 → 0.28.1-beta.2

package/dist/bucket.js

@@ -44,7 +44,7 @@ var GAME_API_ROUTES_DIRECTORY = join2(GAME_SERVER_ROOT_DIRECTORY, "api");
 // ../better-auth/package.json
 var package_default = {
   name: "@playcademy/better-auth",
-  version: "0.0.21-beta.1",
+  version: "0.0.21-beta.2",
   type: "module",
   exports: {
     "./server": {

package/dist/cli.js

@@ -1207,7 +1207,7 @@ var SAMPLE_BUCKET_FILENAME = "bucket.ts";
 // ../better-auth/package.json
 var package_default = {
   name: "@playcademy/better-auth",
-  version: "0.0.21-beta.1",
+  version: "0.0.21-beta.2",
   type: "module",
   exports: {
     "./server": {
@@ -3009,7 +3009,7 @@ import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as re
 import { join as join13 } from "node:path";
 
 // src/version.ts
-var cliVersion = false ? "0.0.0-dev" : "0.28.1-beta.1";
+var cliVersion = false ? "0.0.0-dev" : "0.28.1-beta.2";
 
 // src/lib/init/database.ts
 var drizzleConfigTemplate = loadTemplateString("database/drizzle-config.ts");

package/dist/constants.d.ts

@@ -277,8 +277,8 @@ declare const GODOT_EXECUTABLE_PATTERNS: {
 declare const CALLBACK_PORT = 6175;
 /** Path for the OAuth callback endpoint */
 declare const CALLBACK_PATH = "/callback";
-/** Timeout for SSO authentication in milliseconds (30 seconds) */
-declare const SSO_AUTH_TIMEOUT_MS = 30000;
+/** Timeout for the whole browser SSO flow (login page + provider auth + MFA) */
+declare const SSO_AUTH_TIMEOUT_MS = 90000;
 
 /**
  * Path constants for CLI directories and files

package/dist/constants.js

@@ -21,7 +21,7 @@ var SAMPLE_BUCKET_FILENAME = "bucket.ts";
 // ../better-auth/package.json
 var package_default = {
   name: "@playcademy/better-auth",
-  version: "0.0.21-beta.1",
+  version: "0.0.21-beta.2",
   type: "module",
   exports: {
     "./server": {
@@ -182,7 +182,7 @@ var GODOT_EXECUTABLE_PATTERNS = {
 // src/constants/http-server.ts
 var CALLBACK_PORT = 6175;
 var CALLBACK_PATH = "/callback";
-var SSO_AUTH_TIMEOUT_MS = 3e4;
+var SSO_AUTH_TIMEOUT_MS = 9e4;
 
 // src/constants/paths.ts
 import { homedir } from "node:os";

package/dist/db.js

@@ -2335,7 +2335,7 @@ var GAME_API_ROUTES_DIRECTORY = join2(GAME_SERVER_ROOT_DIRECTORY, "api");
 // ../better-auth/package.json
 var package_default = {
   name: "@playcademy/better-auth",
-  version: "0.0.21-beta.1",
+  version: "0.0.21-beta.2",
   type: "module",
   exports: {
     "./server": {

package/dist/index.d.ts

@@ -1437,12 +1437,8 @@ interface ScaffoldResult {
  * Callback data received from the Playcademy server after SSO authentication
  */
 interface SsoCallbackData {
-    /** The session token from SSO authentication */
-    sessionToken: string;
-    /** User's email address */
-    email: string;
-    /** User's ID */
-    userId: string;
+    /** One-time login code, exchanged at /auth/cli/exchange for an API key */
+    code: string;
 }
 /**
  * Result from starting and running the callback server

package/dist/index.js

@@ -2346,7 +2346,7 @@ var SAMPLE_BUCKET_FILENAME = "bucket.ts";
 // ../better-auth/package.json
 var package_default = {
   name: "@playcademy/better-auth",
-  version: "0.0.21-beta.1",
+  version: "0.0.21-beta.2",
   type: "module",
   exports: {
     "./server": {
@@ -2500,6 +2500,7 @@ var GODOT_EXECUTABLE_PATTERNS = {
 // src/constants/http-server.ts
 var CALLBACK_PORT = 6175;
 var CALLBACK_PATH = "/callback";
+var SSO_AUTH_TIMEOUT_MS = 9e4;
 
 // src/constants/paths.ts
 import { homedir } from "node:os";
@@ -2574,6 +2575,13 @@ var CONFIG_FILE_NAMES = [
   "playcademy.config.mjs"
 ];
 
+// ../constants/src/auth.ts
+var DEFAULT_PERSONAL_API_KEY_PERMISSIONS = {
+  games: ["read", "write", "delete"],
+  users: ["read:self", "write:self"],
+  dev: ["read", "write"]
+};
+
 // ../constants/src/dashboard.ts
 var DASHBOARD_USER_ROLES = {
   ADMIN: "admin",
@@ -3148,8 +3156,8 @@ function writeBlank() {
 }
 var FG_RESET = "\x1B[39m";
 function nestColor(content, color2) {
-  const open2 = color2("").replace(FG_RESET, "");
-  return color2(open2 ? content.replaceAll(FG_RESET, open2) : content);
+  const open3 = color2("").replace(FG_RESET, "");
+  return color2(open3 ? content.replaceAll(FG_RESET, open3) : content);
 }
 function customTransform(text4) {
   let result = text4;
@@ -3906,9 +3914,9 @@ var Spinner = class {
   indent;
   constructor(taskIds, texts, options) {
     this.indent = options?.indent ?? 0;
-    taskIds.forEach((id, index3) => {
+    taskIds.forEach((id, index4) => {
       this.tasks.set(id, {
-        text: texts[index3] || "",
+        text: texts[index4] || "",
         status: "pending"
       });
     });
@@ -4335,9 +4343,9 @@ function buildQueueImportStatements(queueHandlers) {
   if (queueHandlers.length === 0) {
     return "// No queue handlers";
   }
-  return queueHandlers.map((handler, index3) => {
+  return queueHandlers.map((handler, index4) => {
     const normalizedFile = handler.file.replace(/^server\//, "").replace(/\\/g, "/");
-    return `import queueHandler${index3} from '@game-server/${normalizedFile}'`;
+    return `import queueHandler${index4} from '@game-server/${normalizedFile}'`;
   }).join("\n");
 }
 function buildQueueHandlerCode(queueHandlers) {
@@ -4346,7 +4354,7 @@ function buildQueueHandlerCode(queueHandlers) {
   }
   return [
     "const __queueHandlers = {",
-    ...queueHandlers.map((handler, index3) => `    '${handler.key}': queueHandler${index3},`),
+    ...queueHandlers.map((handler, index4) => `    '${handler.key}': queueHandler${index4},`),
     "}",
     "",
     "registerQueueIngressRoute(app, __queueHandlers)",
@@ -5518,9 +5526,9 @@ function findMatchingBrace(content, openBrace) {
   let quote = null;
   let inLineComment = false;
   let inBlockComment = false;
-  for (let index3 = openBrace; index3 < content.length; index3 += 1) {
-    const char = content[index3];
-    const next = content[index3 + 1];
+  for (let index4 = openBrace; index4 < content.length; index4 += 1) {
+    const char = content[index4];
+    const next = content[index4 + 1];
     if (inLineComment) {
       if (char === "\n") {
         inLineComment = false;
@@ -5528,18 +5536,18 @@ function findMatchingBrace(content, openBrace) {
     } else if (inBlockComment) {
       if (char === "*" && next === "/") {
         inBlockComment = false;
-        index3 += 1;
+        index4 += 1;
       }
     } else if (quote) {
-      if (char === quote && !isEscapedCharacter(content, index3)) {
+      if (char === quote && !isEscapedCharacter(content, index4)) {
         quote = null;
       }
     } else if (char === "/" && next === "/") {
       inLineComment = true;
-      index3 += 1;
+      index4 += 1;
     } else if (char === "/" && next === "*") {
       inBlockComment = true;
-      index3 += 1;
+      index4 += 1;
     } else if (char === "'" || char === '"' || char === "`") {
       quote = char;
     } else if (char === "{") {
@@ -5547,7 +5555,7 @@ function findMatchingBrace(content, openBrace) {
     } else if (char === "}") {
       depth -= 1;
       if (depth === 0) {
-        return index3;
+        return index4;
       }
     }
   }
@@ -5560,9 +5568,9 @@ function isTopLevelObjectProperty(content, openBrace, keyStart) {
   let quote = null;
   let inLineComment = false;
   let inBlockComment = false;
-  for (let index3 = openBrace + 1; index3 < keyStart; index3 += 1) {
-    const char = content[index3];
-    const next = content[index3 + 1];
+  for (let index4 = openBrace + 1; index4 < keyStart; index4 += 1) {
+    const char = content[index4];
+    const next = content[index4 + 1];
     if (inLineComment) {
       if (char === "\n") {
         inLineComment = false;
@@ -5570,18 +5578,18 @@ function isTopLevelObjectProperty(content, openBrace, keyStart) {
     } else if (inBlockComment) {
       if (char === "*" && next === "/") {
         inBlockComment = false;
-        index3 += 1;
+        index4 += 1;
       }
     } else if (quote) {
-      if (char === quote && !isEscapedCharacter(content, index3)) {
+      if (char === quote && !isEscapedCharacter(content, index4)) {
         quote = null;
       }
     } else if (char === "/" && next === "/") {
       inLineComment = true;
-      index3 += 1;
+      index4 += 1;
     } else if (char === "/" && next === "*") {
       inBlockComment = true;
-      index3 += 1;
+      index4 += 1;
     } else if (char === "'" || char === '"' || char === "`") {
       quote = char;
     } else if (char === "{") {
@@ -5600,9 +5608,9 @@ function isTopLevelObjectProperty(content, openBrace, keyStart) {
   }
   return !inLineComment && !inBlockComment && !quote && objectDepth === 0 && bracketDepth === 0 && parenDepth === 0;
 }
-function isEscapedCharacter(content, index3) {
+function isEscapedCharacter(content, index4) {
   let backslashCount = 0;
-  for (let cursor2 = index3 - 1; cursor2 >= 0 && content[cursor2] === "\\"; cursor2 -= 1) {
+  for (let cursor2 = index4 - 1; cursor2 >= 0 && content[cursor2] === "\\"; cursor2 -= 1) {
     backslashCount += 1;
   }
   return backslashCount % 2 === 1;
@@ -6382,7 +6390,7 @@ import { existsSync as existsSync10, mkdirSync as mkdirSync2, readFileSync as re
 import { join as join13 } from "node:path";
 
 // src/version.ts
-var cliVersion = false ? "0.0.0-dev" : "0.28.1-beta.1";
+var cliVersion = false ? "0.0.0-dev" : "0.28.1-beta.2";
 
 // src/lib/init/database.ts
 var drizzleConfigTemplate = loadTemplateString("database/drizzle-config.ts");
@@ -9163,12 +9171,12 @@ var MIGRATION_LEDGER_DDL = `CREATE TABLE IF NOT EXISTS ${MIGRATION_LEDGER_TABLE}
 // ../cloudflare/src/utils/journal.ts
 function findOutOfOrderTags(orderedTags, applied2) {
   let lastAppliedIndex = -1;
-  orderedTags.forEach((tag2, index3) => {
+  orderedTags.forEach((tag2, index4) => {
     if (applied2.has(tag2)) {
-      lastAppliedIndex = index3;
+      lastAppliedIndex = index4;
     }
   });
-  return orderedTags.filter((tag2, index3) => index3 < lastAppliedIndex && !applied2.has(tag2));
+  return orderedTags.filter((tag2, index4) => index4 < lastAppliedIndex && !applied2.has(tag2));
 }
 
 // ../cloudflare/src/utils/sql.ts
@@ -9489,11 +9497,11 @@ function seedClaimedTags(seed) {
   if (!seed?.lastAppliedMigrationTag || !seed.journal) {
     return [];
   }
-  const index3 = seed.journal.findIndex((entry) => entry.tag === seed.lastAppliedMigrationTag);
-  if (index3 === -1) {
+  const index4 = seed.journal.findIndex((entry) => entry.tag === seed.lastAppliedMigrationTag);
+  if (index4 === -1) {
     return [];
   }
-  return seed.journal.slice(0, index3 + 1).map((entry) => entry.tag);
+  return seed.journal.slice(0, index4 + 1).map((entry) => entry.tag);
 }
 async function buildPushPlan(state, options) {
   const adopted = isSchemaAdopted(state);
@@ -9882,8 +9890,8 @@ async function discoverRoutes(apiDir, options = {}) {
   const workspaceRoot = options.workspaceRoot ?? getWorkspace();
   const absolutePaths = files.map((file) => join27(apiDir, file));
   const methodsByFile = await detectExportedMethods(absolutePaths);
-  return files.map((file, index3) => {
-    const absolutePath = absolutePaths[index3];
+  return files.map((file, index4) => {
+    const absolutePath = absolutePaths[index4];
     const relativePath = relative3(workspaceRoot, absolutePath).replace(/\\/g, "/");
     return {
       path: filePathToRoutePath(file),
@@ -11583,16 +11591,16 @@ function normalizeString(path4, allowAboveRoot) {
   let lastSlash = -1;
   let dots = 0;
   let char = null;
-  for (let index3 = 0; index3 <= path4.length; ++index3) {
-    if (index3 < path4.length) {
-      char = path4[index3];
+  for (let index4 = 0; index4 <= path4.length; ++index4) {
+    if (index4 < path4.length) {
+      char = path4[index4];
     } else if (char === "/") {
       break;
     } else {
       char = "/";
     }
     if (char === "/") {
-      if (lastSlash === index3 - 1 || dots === 1) ;
+      if (lastSlash === index4 - 1 || dots === 1) ;
       else if (dots === 2) {
         if (res.length < 2 || lastSegmentLength !== 2 || res[res.length - 1] !== "." || res[res.length - 2] !== ".") {
           if (res.length > 2) {
@@ -11604,13 +11612,13 @@ function normalizeString(path4, allowAboveRoot) {
               res = res.slice(0, lastSlashIndex);
               lastSegmentLength = res.length - 1 - res.lastIndexOf("/");
             }
-            lastSlash = index3;
+            lastSlash = index4;
             dots = 0;
             continue;
           } else if (res.length > 0) {
             res = "";
             lastSegmentLength = 0;
-            lastSlash = index3;
+            lastSlash = index4;
             dots = 0;
             continue;
           }
@@ -11621,13 +11629,13 @@ function normalizeString(path4, allowAboveRoot) {
         }
       } else {
         if (res.length > 0) {
-          res += `/${path4.slice(lastSlash + 1, index3)}`;
+          res += `/${path4.slice(lastSlash + 1, index4)}`;
         } else {
-          res = path4.slice(lastSlash + 1, index3);
+          res = path4.slice(lastSlash + 1, index4);
         }
-        lastSegmentLength = index3 - lastSlash - 1;
+        lastSegmentLength = index4 - lastSlash - 1;
       }
-      lastSlash = index3;
+      lastSlash = index4;
       dots = 0;
     } else if (char === "." && dots !== -1) {
       ++dots;
@@ -12053,11 +12061,11 @@ function getDataProtocolModuleFormat(parsed) {
 }
 function extname2(url) {
   const pathname = url.pathname;
-  let index3 = pathname.length;
-  while (index3--) {
-    const code = pathname.codePointAt(index3);
+  let index4 = pathname.length;
+  while (index4--) {
+    const code = pathname.codePointAt(index4);
     if (code === 47) return "";
-    if (code === 46) return pathname.codePointAt(index3 - 1) === 47 ? "" : pathname.slice(index3);
+    if (code === 46) return pathname.codePointAt(index4 - 1) === 47 ? "" : pathname.slice(index4);
   }
   return "";
 }
@@ -13113,12 +13121,12 @@ function createNodeCompatPlugin(options = {}) {
 // src/lib/bundle/route-codegen.ts
 function buildRouteModuleImports(entries, alias, varPrefix) {
   return entries.map(
-    (entry, index3) => `import * as ${varPrefix}${index3} from '${alias}/${entry.importPath}'`
+    (entry, index4) => `import * as ${varPrefix}${index4} from '${alias}/${entry.importPath}'`
   );
 }
 function buildRouteModuleArrayItems(entries, varPrefix) {
   return entries.map(
-    (entry, index3) => `    { path: ${JSON.stringify(entry.path)}, module: ${varPrefix}${index3} },`
+    (entry, index4) => `    { path: ${JSON.stringify(entry.path)}, module: ${varPrefix}${index4} },`
   );
 }
 
@@ -15968,10 +15976,10 @@ var ZodObject = class _ZodObject extends ZodType {
   //   }) as any;
   //   return merged;
   // }
-  catchall(index3) {
+  catchall(index4) {
     return new _ZodObject({
       ...this._def,
-      catchall: index3
+      catchall: index4
     });
   }
   pick(mask) {
@@ -16289,9 +16297,9 @@ function mergeValues(a, b) {
       return { valid: false };
     }
     const newArray = [];
-    for (let index3 = 0; index3 < a.length; index3++) {
-      const itemA = a[index3];
-      const itemB = b[index3];
+    for (let index4 = 0; index4 < a.length; index4++) {
+      const itemA = a[index4];
+      const itemB = b[index4];
       const sharedValue = mergeValues(itemA, itemB);
       if (!sharedValue.valid) {
         return { valid: false };
@@ -16497,10 +16505,10 @@ var ZodMap = class extends ZodType {
     }
     const keyType = this._def.keyType;
     const valueType = this._def.valueType;
-    const pairs = [...ctx.data.entries()].map(([key, value], index3) => {
+    const pairs = [...ctx.data.entries()].map(([key, value], index4) => {
       return {
-        key: keyType._parse(new ParseInputLazyPath(ctx, key, ctx.path, [index3, "key"])),
-        value: valueType._parse(new ParseInputLazyPath(ctx, value, ctx.path, [index3, "value"]))
+        key: keyType._parse(new ParseInputLazyPath(ctx, key, ctx.path, [index4, "key"])),
+        value: valueType._parse(new ParseInputLazyPath(ctx, value, ctx.path, [index4, "value"]))
       };
     });
     if (ctx.common.async) {
@@ -20895,8 +20903,8 @@ function diffCreated(base, target) {
         }
       }
     }
-    for (const [indexKey, index3] of Object.entries(table.indexes ?? {})) {
-      const name = index3.name ?? indexKey;
+    for (const [indexKey, index4] of Object.entries(table.indexes ?? {})) {
+      const name = index4.name ?? indexKey;
       if (!counterpart?.indexes?.[indexKey] && name) {
         createsIndexes.push(name);
       }
@@ -23857,7 +23865,7 @@ import { and, eq } from "drizzle-orm";
 import { relations } from "drizzle-orm";
 import {
   boolean as boolean2,
-  index,
+  index as index2,
   integer,
   jsonb,
   pgEnum as pgEnum2,
@@ -23870,7 +23878,7 @@ import {
 } from "drizzle-orm/pg-core";
 
 // ../data/src/domains/user/table.ts
-import { boolean, pgEnum, pgTable, text, timestamp, uniqueIndex } from "drizzle-orm/pg-core";
+import { boolean, index, pgEnum, pgTable, text, timestamp, uniqueIndex } from "drizzle-orm/pg-core";
 var userRoleEnum = pgEnum("user_role", ["admin", "player", "developer", "teacher"]);
 var developerStatusEnum = pgEnum("developer_status", ["none", "pending", "approved"]);
 var users = pgTable("user", {
@@ -23948,24 +23956,30 @@ var sessions = pgTable("session", {
     withTimezone: true
   }).notNull()
 });
-var verification = pgTable("verification", {
-  id: text("id").primaryKey().$defaultFn(() => crypto.randomUUID()),
-  identifier: text("identifier").notNull(),
-  // Typically email
-  value: text("value").notNull(),
-  expiresAt: timestamp("expires_at", {
-    mode: "date",
-    withTimezone: true
-  }).notNull(),
-  createdAt: timestamp("created_at", {
-    mode: "date",
-    withTimezone: true
-  }).notNull(),
-  updatedAt: timestamp("updated_at", {
-    mode: "date",
-    withTimezone: true
-  }).notNull()
-});
+var verification = pgTable(
+  "verification",
+  {
+    id: text("id").primaryKey().$defaultFn(() => crypto.randomUUID()),
+    identifier: text("identifier").notNull(),
+    // email, or a namespaced token key
+    value: text("value").notNull(),
+    expiresAt: timestamp("expires_at", {
+      mode: "date",
+      withTimezone: true
+    }).notNull(),
+    createdAt: timestamp("created_at", {
+      mode: "date",
+      withTimezone: true
+    }).notNull(),
+    updatedAt: timestamp("updated_at", {
+      mode: "date",
+      withTimezone: true
+    }).notNull()
+  },
+  // Every lookup (better-auth's own token verification, and the CLI login-code
+  // redemption) keys on identifier; without this it degrades to a table scan.
+  (table) => [index("verification_identifier_idx").on(table.identifier)]
+);
 
 // ../data/src/domains/game/table.ts
 var gamePlatformEnum = pgEnum2("game_platform", ["web", "godot", "unity"]);
@@ -24085,7 +24099,7 @@ var gameDeployments = pgTable2(
   },
   // Every per-request lookup (active deployment, restore points) filters
   // by game and target over this append-only table
-  (table) => [index("game_deployments_game_target_idx").on(table.gameId, table.target)]
+  (table) => [index2("game_deployments_game_target_idx").on(table.gameId, table.target)]
 );
 var gameDeployJobs = pgTable2(
   "game_deploy_jobs",
@@ -24133,7 +24147,7 @@ var gameDeployEvents = pgTable2(
     createdAt: timestamp2("created_at", { mode: "date", withTimezone: true }).notNull().defaultNow()
   },
   // History reads are per game, newest first.
-  (table) => [index("game_deploy_events_game_idx").on(table.gameId, table.createdAt)]
+  (table) => [index2("game_deploy_events_game_idx").on(table.gameId, table.createdAt)]
 );
 var gameDeploymentState = pgTable2("game_deployment_state", {
   id: uuid("id").primaryKey().defaultRandom(),
@@ -24210,7 +24224,7 @@ import { sql as sql2 } from "drizzle-orm";
 import { sql } from "drizzle-orm";
 import {
   doublePrecision,
-  index as index2,
+  index as index3,
   integer as integer2,
   pgEnum as pgEnum3,
   pgTable as pgTable3,
@@ -24293,7 +24307,7 @@ var gameTimebackMetricDiscrepancyVerifications = pgTable3(
       table.studentId,
       table.runId
     ),
-    index2("game_timeback_metric_discrepancy_verifications_course_idx").on(
+    index3("game_timeback_metric_discrepancy_verifications_course_idx").on(
       table.gameId,
       table.courseId,
       table.verifiedAt
@@ -25593,8 +25607,8 @@ function displayMigrateDiff(plan) {
     1
   );
   logger.newLine();
-  plan.pendingTags.forEach((tag2, index3) => {
-    logger.data(`${index3 + 1}`, tag2, 1);
+  plan.pendingTags.forEach((tag2, index4) => {
+    logger.data(`${index4 + 1}`, tag2, 1);
   });
   logger.newLine();
   return;
@@ -26219,6 +26233,27 @@ async function executeSeedFile(seedFilePath, mf, envSecrets = {}) {
   logger.newLine();
 }
 
+// src/lib/auth/exchange.ts
+var EXCHANGE_TIMEOUT_MS = 15e3;
+async function exchangeLoginCode(baseUrl, code, name) {
+  const response = await fetch(`${baseUrl}/auth/cli/exchange`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ code, name }),
+    signal: AbortSignal.timeout(EXCHANGE_TIMEOUT_MS)
+  });
+  const body = await response.json().catch(() => null);
+  if (!response.ok || !body?.apiKey || !body.userId || !body.email) {
+    throw new Error(body?.error || `Login code exchange failed (HTTP ${response.status})`);
+  }
+  return { apiKey: body.apiKey, userId: body.userId, email: body.email };
+}
+
+// src/lib/auth/login-flow.ts
+import { userInfo } from "os";
+import { bold as bold12, whiteBright } from "colorette";
+import open from "open";
+
 // src/lib/auth/http-server/server.ts
 import { createServer as createServer2 } from "node:http";
 
@@ -26349,10 +26384,27 @@ function getErrorHtml(error) {
 }
 
 // src/lib/auth/http-server/server.ts
-async function startCallbackServer(timeoutMs) {
-  return new Promise((resolve18) => {
+function parseCallbackRequest(url, expectedState) {
+  if (url.searchParams.get("state") !== expectedState) {
+    return { success: false, error: "The response does not belong to this login attempt" };
+  }
+  const code = url.searchParams.get("code");
+  if (!code) {
+    return { success: false, error: "Invalid callback data received" };
+  }
+  return { success: true, data: { code } };
+}
+function startCallbackServer(timeoutMs, expectedState) {
+  let bound;
+  let bindFailed;
+  const listening = new Promise((res, rej) => {
+    bound = res;
+    bindFailed = rej;
+  });
+  const result = new Promise((resolve18) => {
     let server = null;
     let timeoutId = null;
+    let didBind = false;
     function cleanup(callback) {
       if (timeoutId) {
         clearTimeout(timeoutId);
@@ -26377,16 +26429,8 @@ async function startCallbackServer(timeoutMs) {
     server = createServer2((req, res) => {
       const url = new URL(req.url, `http://localhost:${CALLBACK_PORT}`);
       if (url.pathname === CALLBACK_PATH) {
-        const sessionToken = url.searchParams.get("sessionToken");
-        const email = url.searchParams.get("email");
-        const userId = url.searchParams.get("userId");
-        if (!sessionToken || !email || !userId) {
-          cleanup(() => {
-            resolve18({
-              success: false,
-              error: "Invalid callback data received"
-            });
-          });
+        const parsed = parseCallbackRequest(url, expectedState);
+        if (!parsed.success) {
           res.writeHead(400, { "Content-Type": "text/html" });
           res.end(getErrorHtml("Invalid authentication data"));
           return;
@@ -26394,23 +26438,164 @@ async function startCallbackServer(timeoutMs) {
         res.writeHead(200, { "Content-Type": "text/html" });
         res.end(SUCCESS_HTML);
         cleanup(() => {
-          resolve18({
-            success: true,
-            data: { sessionToken, email, userId }
-          });
+          resolve18(parsed);
         });
         return;
       }
       res.writeHead(404, { "Content-Type": "text/plain" });
       res.end("Not Found");
     });
+    server.on("listening", () => {
+      didBind = true;
+      bound();
+    });
+    server.on("error", (error) => {
+      const reason = error.code === "EADDRINUSE" ? `Port ${CALLBACK_PORT} is already in use \u2014 is another \`playcademy login\` running?` : errorMessage(error);
+      const message2 = `Could not start the login listener: ${reason}`;
+      if (!didBind) {
+        bindFailed(new Error(message2));
+      }
+      cleanup(() => {
+        resolve18({ success: false, error: message2 });
+      });
+    });
     server.listen(CALLBACK_PORT);
   });
+  return { listening, result };
 }
 function getCallbackUrl() {
   return `http://localhost:${CALLBACK_PORT}${CALLBACK_PATH}`;
 }
 
+// src/lib/auth/login-flow.ts
+var STATE_LENGTH = 22;
+function cliKeyName() {
+  return userInfo().username.substring(0, 32);
+}
+async function runEmailPasswordLogin(environment, profileName, email, userPassword) {
+  try {
+    const client = await createClient();
+    const loginResult = await runStep(
+      "Logging in with email/password",
+      async () => {
+        const result = await client.auth.login({ email, password: userPassword });
+        if (!result.success) {
+          throw new Error(result.error || "Login failed");
+        }
+        return result;
+      },
+      () => "Successfully authenticated"
+    );
+    const apiKeyResult = await runStep(
+      "Creating API key for CLI usage",
+      () => client.auth.apiKeys.create({
+        name: cliKeyName(),
+        expiresIn: null,
+        // No expiration
+        permissions: DEFAULT_PERSONAL_API_KEY_PERMISSIONS
+      }),
+      "API key created successfully"
+    );
+    const authProfile = {
+      token: apiKeyResult.apiKey,
+      tokenType: "apiKey",
+      userId: loginResult.user.id,
+      email: loginResult.user.email
+    };
+    logger.admonition("warning", "Your API Key", [apiKeyResult.apiKey]);
+    logger.warn("Save this key securely - it will not be shown again!", 1);
+    logger.newLine();
+    await runStep(
+      `Saving credentials to profile "${profileName}"`,
+      () => saveProfile(environment, profileName, authProfile),
+      "Credentials saved successfully"
+    );
+    logger.admonition("tip", "Logged In Successfully!", [
+      `Email: ${authProfile.email}`,
+      `Environment: ${environment}`,
+      ...profileName !== "default" ? [`Profile: ${profileName}`] : [],
+      ...profileName !== "default" ? [`Use \`--profile ${profileName}\` with commands to use this profile`] : [],
+      "",
+      "Learn more: <<https://docs.playcademy.net/platform/cli/authentication>>"
+    ]);
+  } catch (error) {
+    logAndExit(error, { prefix: "Authentication failed" });
+  }
+}
+async function runSsoLogin(environment, profileName) {
+  try {
+    const state = generateSecureRandomStringSync(STATE_LENGTH);
+    const server = startCallbackServer(SSO_AUTH_TIMEOUT_MS, state);
+    await server.listening;
+    const baseUrl = getBaseUrl();
+    const callbackUrl = getCallbackUrl();
+    const authUrl = `${baseUrl}/auth/cli?callback=${encodeURIComponent(callbackUrl)}&state=${state}`;
+    await open(authUrl);
+    logger.admonition("info", "Waiting for Authentication", [
+      "Please complete authentication in your browser..."
+    ]);
+    const result = await server.result;
+    if (!result.success || !result.data) {
+      logger.newLine();
+      logger.error(`Authentication failed: ${result.error || "Unknown error"}`);
+      logger.newLine();
+      process.exit(1);
+    }
+    const code = result.data.code;
+    const exchange = await runStep(
+      "Creating API key for CLI usage",
+      () => exchangeLoginCode(baseUrl, code, cliKeyName()),
+      "API key created successfully"
+    );
+    const authProfile = {
+      token: exchange.apiKey,
+      tokenType: "apiKey",
+      userId: exchange.userId,
+      email: exchange.email
+    };
+    logger.admonition("warning", "Your API Key", [
+      "Save this key securely - it will not be shown again!",
+      "",
+      whiteBright(bold12(exchange.apiKey))
+    ]);
+    await runStep(
+      `Saving credentials to profile "${profileName}"`,
+      () => saveProfile(environment, profileName, authProfile),
+      "Credentials saved successfully",
+      { silent: true }
+    );
+    logger.success(`Logged in to ${environment} as ${authProfile.email}`);
+    logger.newLine();
+  } catch (error) {
+    logAndExit(error, { prefix: "SSO authentication failed" });
+  }
+}
+async function promptForEmail() {
+  return input({
+    message: "Email:",
+    nonInteractiveHint: "Pass --email or authenticate with PLAYCADEMY_API_TOKEN.",
+    validate: (value) => {
+      if (!value || !value.includes("@")) {
+        return "Please enter a valid email address";
+      }
+      return true;
+    }
+  });
+}
+async function promptForPassword() {
+  return password({
+    message: "Password:",
+    mask: "*",
+    nonInteractiveHint: "Pass --password or authenticate with PLAYCADEMY_API_TOKEN.",
+    validate: (value) => {
+      if (!value) {
+        return "Password is required";
+      }
+      return true;
+    }
+  });
+}
+
 // src/lib/bucket/collect.ts
 import { readdirSync as readdirSync6, statSync as statSync4 } from "fs";
 import { join as join55, relative as relative8, sep as sep4 } from "path";
@@ -26557,7 +26742,7 @@ function buildManifest(hashedFiles) {
 }
 
 // src/lib/bucket/migrate.ts
-import { bold as bold12, cyan as cyan7 } from "colorette";
+import { bold as bold13, cyan as cyan7 } from "colorette";
 var SAMPLE_LIMIT = 10;
 async function resolveMigrationDecision({
   shadowedOriginals,
@@ -26586,7 +26771,7 @@ async function resolveMigrationDecision({
   }
   logger.admonition("info", "Migrating your bucket to versioned assets", [
     `Versioned filenames make each URL immutable to facilitate better caching.`,
-    `Found ${bold12(`${count} ${noun}`)} using the previous layout, listed below.`
+    `Found ${bold13(`${count} ${noun}`)} using the previous layout, listed below.`
   ]);
   const sample = shadowedOriginals.slice(0, SAMPLE_LIMIT);
   logger.table(sample.map((o) => ({ Key: o.key, Size: formatBytes(o.size) })));
@@ -26633,15 +26818,15 @@ async function resolveMigrationDecision({
     message: "Select the files to remove (unchecked files are kept):",
     choices: shadowedOriginals.map((o) => ({
       value: o.key,
-      name: `${o.key} ${bold12(`(${formatBytes(o.size)})`)}`
+      name: `${o.key} ${bold13(`(${formatBytes(o.size)})`)}`
     })),
-    instructions: ` ${bold12("(")}${cyan7("space")}${bold12(" to toggle, ")}${cyan7("enter")}${bold12(" to confirm)")}`,
+    instructions: ` ${bold13("(")}${cyan7("space")}${bold13(" to toggle, ")}${cyan7("enter")}${bold13(" to confirm)")}`,
     nonInteractiveHint: NON_INTERACTIVE_HINTS.MIGRATE_MODE
   });
 }
 
 // src/lib/bucket/output.ts
-import { bold as bold13, dim as dim12, yellowBright as yellowBright2 } from "colorette";
+import { bold as bold14, dim as dim12, yellowBright as yellowBright2 } from "colorette";
 function collectSyncFiles(directory) {
   const gitignorePatterns = loadGitignorePatterns(directory);
   return collectFiles(directory, directory, gitignorePatterns);
@@ -26667,7 +26852,7 @@ function outputDryRunResults(plan, json) {
     logger.newLine();
     return;
   }
-  logger.raw(`${bold13(yellowBright2("\u2726"))} ${bold13("Dry run")} ${dim12("(no changes will be made)")}`);
+  logger.raw(`${bold14(yellowBright2("\u2726"))} ${bold14("Dry run")} ${dim12("(no changes will be made)")}`);
   logger.newLine();
   if (plan.toUpload.length > 0) {
     const count = plan.toUpload.length;
@@ -27001,7 +27186,7 @@ function buildCollectorUrl(workerId, endpoint, token) {
 }
 
 // src/lib/logs/display.ts
-import { blue as blue3, bold as bold14, cyan as cyan8, dim as dim14, gray as gray2, green as green9, magenta as magenta3, red as red6, yellow as yellow7 } from "colorette";
+import { blue as blue3, bold as bold15, cyan as cyan8, dim as dim14, gray as gray2, green as green9, magenta as magenta3, red as red6, yellow as yellow7 } from "colorette";
 var LEVEL_COLORS = {
   log: gray2,
   info: blue3,
@@ -27059,7 +27244,7 @@ function formatStatus(status) {
   } else if (status >= 200) {
     colorFn = green9;
   }
-  const boldCode = colorFn(bold14(String(status)));
+  const boldCode = colorFn(bold15(String(status)));
   return text4 ? `${boldCode} ${colorFn(text4)}` : boldCode;
 }
 function stripLogPrefix(message2) {
@@ -27095,7 +27280,7 @@ function displayLogEntry(entry) {
     const queueMatch = path4.match(/^\/__playcademy\/queue\/(.+)$/);
     if (queueMatch) {
       const queueKey = decodeURIComponent(queueMatch[1]);
-      const label = magenta3(bold14("QUEUE"));
+      const label = magenta3(bold15("QUEUE"));
       let status = outcomeColor(entry.outcome);
       if (entry.outcome === "ok") {
         status = green9("processed");
@@ -27104,7 +27289,7 @@ function displayLogEntry(entry) {
       }
       logger.raw(`${time} ${label} ${queueKey} ${status}`);
     } else {
-      const method = cyan8(bold14(entry.request.method));
+      const method = cyan8(bold15(entry.request.method));
       const status = entry.response?.status;
       let statusPart = "";
       if (status) {
@@ -27120,12 +27305,12 @@ function displayLogEntry(entry) {
   }
   for (const log2 of entry.logs) {
     const levelColor = LEVEL_COLORS[log2.level] ?? gray2;
-    const level = levelColor(bold14(log2.level.toUpperCase()));
+    const level = levelColor(bold15(log2.level.toUpperCase()));
     const message2 = log2.message.map(formatValue2).join(" ");
     logger.raw(`${time} ${level} ${message2}`);
   }
   for (const exception of entry.exceptions) {
-    const level = red6(bold14("ERROR"));
+    const level = red6(bold15("ERROR"));
     logger.raw(`${time} ${level} ${exception.name}: ${exception.message}`);
   }
 }
@@ -27559,7 +27744,7 @@ function isRealCalendarDate(year2, month, day2) {
 }
 
 // src/lib/timeback/display.ts
-import { bold as bold15, greenBright as greenBright2, redBright as redBright3 } from "colorette";
+import { bold as bold16, greenBright as greenBright2, redBright as redBright3 } from "colorette";
 function displayIntegrationDetails(integration) {
   logger.highlight("Verified Course");
   logger.newLine();
@@ -27596,9 +27781,9 @@ function displayIntegrationList(integrations, statusByCourseId, options) {
     if (showStatusColumn) {
       if (options?.staticLabel) {
         const coloredLabel = options.staticLabelColor ? options.staticLabelColor(options.staticLabel) : greenBright2(options.staticLabel);
-        statusText = bold15(coloredLabel);
+        statusText = bold16(coloredLabel);
       } else if (statusByCourseId && integration.courseId in statusByCourseId) {
-        statusText = statusByCourseId[integration.courseId] ? bold15(greenBright2(successLabel)) : bold15(redBright3(failureLabel));
+        statusText = statusByCourseId[integration.courseId] ? bold16(greenBright2(successLabel)) : bold16(redBright3(failureLabel));
       }
     }
     const row = {
@@ -27631,7 +27816,7 @@ function displayCleanupWarning(integrations, gameName, logger2) {
 }
 
 // src/lib/timeback/setup.ts
-import { bold as bold16 } from "colorette";
+import { bold as bold17 } from "colorette";
 function displaySetupDryRun(derivedRequest, env, logger2) {
   logger2.highlight("TimeBack Setup [DRY RUN]");
   logger2.newLine();
@@ -27660,7 +27845,7 @@ function displaySetupDryRun(derivedRequest, env, logger2) {
   logger2.admonition("tip", "Ready for setup", [
     "Your Timeback configuration has been validated!",
     "",
-    `Run without \`--dry-run\` to create ${bold16(`${derivedRequest.courses.length} course(s)`)} in ${bold16(env || "staging")}`
+    `Run without \`--dry-run\` to create ${bold17(`${derivedRequest.courses.length} course(s)`)} in ${bold17(env || "staging")}`
   ]);
 }
 
@@ -28016,7 +28201,7 @@ function getInstallMethod() {
 }
 
 // src/lib/upgrade/guards.ts
-import { bold as bold17 } from "colorette";
+import { bold as bold18 } from "colorette";
 
 // src/lib/upgrade/constants.ts
 var INSTALL_SCRIPT_URL = "https://playcademy.net/cli";
@@ -28064,7 +28249,7 @@ function handleNonStandaloneInstall(installMethod) {
   };
   const uninstallCmd = uninstallCommands[installMethod];
   logger.admonition("warning", "Legacy Install Detected", [
-    `The CLI was installed via ${bold17(installMethod)}, which is no longer supported.`,
+    `The CLI was installed via ${bold18(installMethod)}, which is no longer supported.`,
     "",
     "Uninstall it first (it would shadow the standalone binary):",
     "",
@@ -28076,7 +28261,7 @@ function handleNonStandaloneInstall(installMethod) {
 }
 
 // src/lib/upgrade/perform.ts
-import { bold as bold18, dim as dim15, green as green10, red as red7, yellow as yellow8 } from "colorette";
+import { bold as bold19, dim as dim15, green as green10, red as red7, yellow as yellow8 } from "colorette";
 
 // src/lib/upgrade/standalone.ts
 import { spawn as spawn2 } from "node:child_process";
@@ -28227,7 +28412,7 @@ function verifyInstalledBinary(expectedVersion) {
 // src/lib/upgrade/windows.ts
 import { createHash as createHash6 } from "node:crypto";
 import { existsSync as existsSync39 } from "node:fs";
-import { copyFile, mkdir as mkdir9, open, rename, rm as rm3 } from "node:fs/promises";
+import { copyFile, mkdir as mkdir9, open as open2, rename, rm as rm3 } from "node:fs/promises";
 import { homedir as homedir3 } from "node:os";
 import { basename as basename5, dirname as dirname9, join as join58 } from "node:path";
 var COMPANION_TOOLS = ["workerd", "esbuild"];
@@ -28282,7 +28467,7 @@ async function downloadVerified(url, expected, download) {
     throw new Error(`Download failed (HTTP ${response.status}): ${url}`);
   }
   const hash = createHash6("sha256");
-  const handle = await open(download, "w");
+  const handle = await open2(download, "w");
   try {
     for await (const chunk of response.body) {
       hash.update(chunk);
@@ -28359,13 +28544,13 @@ async function swapInPlace(dest, download) {
 function printUpgradeHeader(currentVersion, desiredVersion, isDowngrade) {
   const targetColor = isDowngrade ? yellow8 : green10;
   console.log(
-    `  ${bold18("Playcademy CLI")} ${bold18("(")}${red7(currentVersion)} \u2192 ${targetColor(desiredVersion)}${bold18(")")}`
+    `  ${bold19("Playcademy CLI")} ${bold19("(")}${red7(currentVersion)} \u2192 ${targetColor(desiredVersion)}${bold19(")")}`
   );
   logger.newLine();
 }
 function reportUpToDate(desiredVersion) {
   console.log(
-    `  ${green10("\u2714")} ${bold18("Playcademy CLI")} ${dim15(`${desiredVersion} is already up to date`)}`
+    `  ${green10("\u2714")} ${bold19("Playcademy CLI")} ${dim15(`${desiredVersion} is already up to date`)}`
   );
   logger.newLine();
 }
@@ -28374,7 +28559,7 @@ async function performUpgrade(resolved) {
   const isDowngrade = resolved.direction > 0;
   printUpgradeHeader(currentVersion, desiredVersion, isDowngrade);
   const shouldUpgrade = await confirm({
-    message: `Download and install ${bold18(desiredVersion)}?`,
+    message: `Download and install ${bold19(desiredVersion)}?`,
     default: true,
     nonInteractiveHint: "Pass --yes to confirm the upgrade."
   });
@@ -28382,7 +28567,7 @@ async function performUpgrade(resolved) {
     logger.newLine();
     process.exit(0);
   }
-  const doneLabel = isDowngrade ? `Installed ${bold18(desiredVersion)}` : `Upgraded to ${bold18(desiredVersion)}`;
+  const doneLabel = isDowngrade ? `Installed ${bold19(desiredVersion)}` : `Upgraded to ${bold19(desiredVersion)}`;
   await runStep(
     "Downloading and installing...",
     async () => {
@@ -28603,6 +28788,7 @@ export {
   ensurePlaycademyTypes,
   ensureRootGitignore,
   entrySearchText,
+  exchangeLoginCode,
   executeSeedFile,
   executeUpdates,
   exitAfterStdoutDrain,
@@ -28775,6 +28961,7 @@ export {
   outOfOrderLines,
   outputDryRunResults,
   outputSyncResults,
+  parseCallbackRequest,
   parseChannelFlag,
   parseCompatibilityManifest,
   parseHistoryBody,
@@ -28798,10 +28985,12 @@ export {
   promptForAuthStrategies,
   promptForCustomRoutes,
   promptForDatabase,
+  promptForEmail,
   promptForEngine,
   promptForFramework,
   promptForIntegrations,
   promptForMissingConfig,
+  promptForPassword,
   promptForProjectDirectory,
   promptForProjectInfo,
   promptForTemplate,
@@ -28865,8 +29054,10 @@ export {
   resolveUpgrade,
   restoreUnsupportedLines,
   rollbackDisplayName,
+  runEmailPasswordLogin,
   runInit,
   runShell,
+  runSsoLogin,
   saveAuthStore,
   saveDeployedGame,
   saveDeploymentState,

package/dist/runtime/dashboard-runtime/manifest.json

@@ -1,7 +1,7 @@
 {
-  "cliVersion": "0.28.1-beta.1",
-  "sdkVersion": "0.16.1-beta.1",
-  "runtimeBuildId": "e927c5aa07bd",
-  "inputFingerprint": "e927c5aa07bdd6d27f0d41ef862380da6c5d5c9b74b8a4f398aa7a4012559577",
+  "cliVersion": "0.28.1-beta.2",
+  "sdkVersion": "0.16.1-beta.2",
+  "runtimeBuildId": "ae26f3f7d729",
+  "inputFingerprint": "ae26f3f7d7295446ac2eeefeefd3796000b0ff85798ee067d55becd93088a976",
   "entry": "index.js"
 }

package/dist/runtime/game-runtime/index.js

@@ -6510,9 +6510,9 @@ var init_list = __esm({
 // ../edge-play/src/game/lib/metadata.ts
 function getRuntimeMetadata() {
   return {
-    cliVersion: true ? "0.28.1-beta.1" : "0.0.0-dev",
-    sdkVersion: true ? "0.16.1-beta.1" : "0.0.0-dev",
-    buildId: true ? "e927c5aa07bd" : "dev-source"
+    cliVersion: true ? "0.28.1-beta.2" : "0.0.0-dev",
+    sdkVersion: true ? "0.16.1-beta.2" : "0.0.0-dev",
+    buildId: true ? "ae26f3f7d729" : "dev-source"
   };
 }
 var init_metadata = __esm({

package/dist/runtime/game-runtime/manifest.json

@@ -1,7 +1,7 @@
 {
-  "cliVersion": "0.28.1-beta.1",
-  "sdkVersion": "0.16.1-beta.1",
-  "runtimeBuildId": "e927c5aa07bd",
-  "inputFingerprint": "e927c5aa07bdd6d27f0d41ef862380da6c5d5c9b74b8a4f398aa7a4012559577",
+  "cliVersion": "0.28.1-beta.2",
+  "sdkVersion": "0.16.1-beta.2",
+  "runtimeBuildId": "ae26f3f7d729",
+  "inputFingerprint": "ae26f3f7d7295446ac2eeefeefd3796000b0ff85798ee067d55becd93088a976",
   "entry": "index.js"
 }

package/dist/utils.js

@@ -383,7 +383,7 @@ var DASHBOARD_API_ROUTES_DIRECTORY = "api";
 // ../better-auth/package.json
 var package_default = {
   name: "@playcademy/better-auth",
-  version: "0.0.21-beta.1",
+  version: "0.0.21-beta.2",
   type: "module",
   exports: {
     "./server": {
@@ -2795,7 +2795,7 @@ import { existsSync as existsSync9, mkdirSync as mkdirSync2, writeFileSync as wr
 import { dirname as dirname4, join as join14 } from "node:path";
 
 // src/version.ts
-var cliVersion = false ? "0.0.0-dev" : "0.28.1-beta.1";
+var cliVersion = false ? "0.0.0-dev" : "0.28.1-beta.2";
 
 // src/lib/build/binary-resource.ts
 function writeFileTree(baseDir, files) {

package/dist/version.js

@@ -1,5 +1,5 @@
 // src/version.ts
-var cliVersion = false ? "0.0.0-dev" : "0.28.1-beta.1";
+var cliVersion = false ? "0.0.0-dev" : "0.28.1-beta.2";
 export {
   cliVersion
 };

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "playcademy",
-    "version": "0.28.1-beta.1",
+    "version": "0.28.1-beta.2",
     "type": "module",
     "exports": {
         ".": {
@@ -55,7 +55,7 @@
     },
     "dependencies": {
         "@inquirer/prompts": "^7.8.6",
-        "@playcademy/sdk": "0.16.1-beta.1",
+        "@playcademy/sdk": "0.16.1-beta.2",
         "chokidar": "^4.0.3",
         "colorette": "^2.0.20",
         "commander": "^14.0.1",