playcademy 0.28.1-beta.2 → 0.28.1-beta.20

package/dist/bin.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { createRequire as __pcCreateRequire } from 'node:module'; const require = __pcCreateRequire(import.meta.url);
 
 // src/bin.ts
 import { spawnSync } from "node:child_process";

package/dist/bucket.d.ts

@@ -1,3 +1,4 @@
+import { GamePermission } from '@playcademy/constants';
 import { TimebackCourseConfig, CourseConfig, OrganizationConfig, ComponentConfig, ResourceConfig, ComponentResourceConfig } from '@playcademy/types/timeback';
 import { Miniflare } from 'miniflare';
 
@@ -137,6 +138,19 @@ interface DashboardThemeConfig {
     /** Secondary/accent color as a hex string, e.g. '#ffd166' */
     secondary?: string;
 }
+/**
+ * Child-catalog contract generation (see @playcademy/sdk/contracts).
+ * The extractor is a repo-local script (run with the CLI's runtime) that
+ * prints `{ generatedFrom, deliveries }` as JSON on stdout; the CLI
+ * validates, stamps the contract fields, and writes
+ * `.playcademy/catalog.json` deterministically. The document carries no
+ * app identity — consuming repos assign the namespace key from sync
+ * provenance.
+ */
+interface CatalogConfig {
+    /** Path to the extractor script, relative to the config file. */
+    extractor: string;
+}
 /**
  * Unified Playcademy configuration
  * Used for playcademy.config.{js,json}
@@ -148,6 +162,13 @@ interface PlaycademyConfig {
     description?: string;
     /** Game emoji icon */
     emoji?: string;
+    /**
+     * Browser permissions to request for the game's iframe (e.g.
+     * `['microphone']`). Opt-in per game; only `microphone` and `camera` are
+     * delegated this way. Fullscreen, autoplay, and gamepad are granted to
+     * every game automatically.
+     */
+    permissions?: GamePermission[];
     /** Build command to run before deployment */
     buildCommand?: string[];
     /** Path to build output */
@@ -162,6 +183,8 @@ interface PlaycademyConfig {
     dashboard?: DashboardConfig | boolean;
     /** Integrations (database, custom routes, external services) */
     integrations?: IntegrationsConfig;
+    /** Child-catalog contract generation (`playcademy catalog`) */
+    catalog?: CatalogConfig;
 }
 
 /**

package/dist/bucket.js

@@ -1,3 +1,4 @@
+import { createRequire as __pcCreateRequire } from 'node:module'; const require = __pcCreateRequire(import.meta.url);
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
@@ -44,7 +45,7 @@ var GAME_API_ROUTES_DIRECTORY = join2(GAME_SERVER_ROOT_DIRECTORY, "api");
 // ../better-auth/package.json
 var package_default = {
   name: "@playcademy/better-auth",
-  version: "0.0.21-beta.2",
+  version: "0.0.21-beta.19",
   type: "module",
   exports: {
     "./server": {
@@ -87,18 +88,7 @@ var package_default = {
 // src/constants/auth.ts
 var BETTER_AUTH_VERSION = package_default.dependencies["better-auth"];
 
-// src/constants/config.ts
-var ENV_FILES = [
-  ".env",
-  // Loaded first
-  ".env.development",
-  // Overrides .env
-  ".env.local"
-  // Overrides all (highest priority)
-];
-
 // src/constants/bucket.ts
-var BUCKET_ALWAYS_SKIP = [".git", ".DS_Store", ".gitignore", ...ENV_FILES];
 var PRESIGNED_UPLOAD_THRESHOLD = 4 * 1024 * 1024;
 
 // src/constants/cloudflare.ts
@@ -282,11 +272,44 @@ var PLAYCADEMY_SUPPORTED_QTI_INTERACTION_TYPES = [
   "text-entry",
   "order",
   "match",
-  "hottext"
+  "hottext",
+  "hotspot",
+  "gap-match",
+  "graphic-gap-match",
+  "select-point",
+  "graphic-associate",
+  "position-object"
 ];
 var PLAYCADEMY_SUPPORTED_QTI_INTERACTION_TYPE_SET = new Set(
   PLAYCADEMY_SUPPORTED_QTI_INTERACTION_TYPES
 );
+var PLAYCADEMY_AUTHORABLE_QTI_INTERACTION_TYPES = [
+  "choice",
+  "inline-choice",
+  "text-entry",
+  "order",
+  "match",
+  "hottext",
+  "gap-match",
+  "hotspot",
+  "graphic-associate",
+  "graphic-gap-match"
+];
+var PLAYCADEMY_AUTHORABLE_QTI_INTERACTION_TYPE_SET = new Set(
+  PLAYCADEMY_AUTHORABLE_QTI_INTERACTION_TYPES
+);
+var QTI_RASTER_IMAGE_MIME_TYPES = [
+  "image/png",
+  "image/jpeg",
+  // Some browsers and operating systems still report the legacy jpg spelling.
+  "image/jpg",
+  "image/gif",
+  "image/webp",
+  "image/bmp"
+];
+var QTI_RASTER_IMAGE_SUBTYPE_PATTERN = QTI_RASTER_IMAGE_MIME_TYPES.map(
+  (type) => type.slice("image/".length)
+).join("|");
 var TIMEBACK_DISCREPANCY_QUEUE_WINDOW_VALUES = new Set(TIMEBACK_DISCREPANCY_QUEUE_WINDOWS);
 var TIMEBACK_DISCREPANCY_QUEUE_METRIC_VALUES = new Set(TIMEBACK_DISCREPANCY_QUEUE_METRICS);
 

package/dist/cli.js

@@ -1,3 +1,4 @@
+import { createRequire as __pcCreateRequire } from 'node:module'; const require = __pcCreateRequire(import.meta.url);
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __esm = (fn, res) => function __init() {
@@ -514,7 +515,10 @@ function nestColor(content, color2) {
 function customTransform(text) {
   let result = text;
   result = result.replace(/<<([^>]+)>>/g, (_, url) => blueBright(underline(url)));
-  result = result.replace(/<([^>]+)>/g, (_, inner) => blueBright(`<${inner}>`));
+  result = result.replace(
+    /<([^>]+)>/g,
+    (match, inner) => blueBright(/[./]/.test(inner) ? inner : match)
+  );
   result = result.replace(/`([^`]+)`/g, (_, code) => nestColor(code, greenBright));
   return result;
 }
@@ -1207,7 +1211,7 @@ var SAMPLE_BUCKET_FILENAME = "bucket.ts";
 // ../better-auth/package.json
 var package_default = {
   name: "@playcademy/better-auth",
-  version: "0.0.21-beta.2",
+  version: "0.0.21-beta.19",
   type: "module",
   exports: {
     "./server": {
@@ -1252,6 +1256,12 @@ var BETTER_AUTH_VERSION = package_default.dependencies["better-auth"];
 var PLAYCADEMY_AUTH_VERSION = "latest";
 var AUTH_CONFIG_FILE = "auth.ts";
 
+// src/constants/bucket.ts
+var PRESIGNED_UPLOAD_THRESHOLD = 4 * 1024 * 1024;
+
+// src/constants/cloudflare.ts
+var QUEUE_NAME_PREFIX = "playcademy";
+
 // src/constants/config.ts
 var ENV_FILES = [
   ".env",
@@ -1277,13 +1287,6 @@ var TSCONFIG_REQUIRED_INCLUDES = [
   // Server-side code
 ];
 
-// src/constants/bucket.ts
-var BUCKET_ALWAYS_SKIP = [".git", ".DS_Store", ".gitignore", ...ENV_FILES];
-var PRESIGNED_UPLOAD_THRESHOLD = 4 * 1024 * 1024;
-
-// src/constants/cloudflare.ts
-var QUEUE_NAME_PREFIX = "playcademy";
-
 // src/constants/database.ts
 import { join as join4 } from "path";
 var DEFAULT_DATABASE_DIRECTORY = join4("server", "db");
@@ -2123,11 +2126,44 @@ var PLAYCADEMY_SUPPORTED_QTI_INTERACTION_TYPES = [
   "text-entry",
   "order",
   "match",
-  "hottext"
+  "hottext",
+  "hotspot",
+  "gap-match",
+  "graphic-gap-match",
+  "select-point",
+  "graphic-associate",
+  "position-object"
 ];
 var PLAYCADEMY_SUPPORTED_QTI_INTERACTION_TYPE_SET = new Set(
   PLAYCADEMY_SUPPORTED_QTI_INTERACTION_TYPES
 );
+var PLAYCADEMY_AUTHORABLE_QTI_INTERACTION_TYPES = [
+  "choice",
+  "inline-choice",
+  "text-entry",
+  "order",
+  "match",
+  "hottext",
+  "gap-match",
+  "hotspot",
+  "graphic-associate",
+  "graphic-gap-match"
+];
+var PLAYCADEMY_AUTHORABLE_QTI_INTERACTION_TYPE_SET = new Set(
+  PLAYCADEMY_AUTHORABLE_QTI_INTERACTION_TYPES
+);
+var QTI_RASTER_IMAGE_MIME_TYPES = [
+  "image/png",
+  "image/jpeg",
+  // Some browsers and operating systems still report the legacy jpg spelling.
+  "image/jpg",
+  "image/gif",
+  "image/webp",
+  "image/bmp"
+];
+var QTI_RASTER_IMAGE_SUBTYPE_PATTERN = QTI_RASTER_IMAGE_MIME_TYPES.map(
+  (type) => type.slice("image/".length)
+).join("|");
 var TIMEBACK_DISCREPANCY_QUEUE_WINDOW_VALUES = new Set(TIMEBACK_DISCREPANCY_QUEUE_WINDOWS);
 var TIMEBACK_DISCREPANCY_QUEUE_METRIC_VALUES = new Set(TIMEBACK_DISCREPANCY_QUEUE_METRICS);
 
@@ -3009,7 +3045,7 @@ import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as re
 import { join as join13 } from "node:path";
 
 // src/version.ts
-var cliVersion = false ? "0.0.0-dev" : "0.28.1-beta.2";
+var cliVersion = false ? "0.0.0-dev" : "0.28.1-beta.20";
 
 // src/lib/init/database.ts
 var drizzleConfigTemplate = loadTemplateString("database/drizzle-config.ts");

package/dist/constants.d.ts

@@ -59,15 +59,18 @@ declare const AUTH_CONFIG_FILE = "auth.ts";
  * Bucket-related constants
  */
 /**
- * Files and directories that are always excluded from bucket sync uploads
+ * Files and directories that are always excluded from bucket uploads
  *
- * These are automatically skipped regardless of .gitignore patterns:
+ * These exact names are skipped regardless of .gitignore patterns:
  * - .git - Git repository data
  * - .DS_Store - macOS filesystem metadata
  * - .gitignore - Git ignore configuration (shouldn't be uploaded to storage)
- * - .env* - Environment files (should never be uploaded to storage)
+ *
+ * Environment files are excluded separately by the `.env*` name pattern in
+ * the collector, so every variant (`.env.production`, `.envrc`, ...) is
+ * covered, not just the ones the CLI loads.
  */
-declare const BUCKET_ALWAYS_SKIP: readonly [".git", ".DS_Store", ".gitignore", ".env", ".env.development", ".env.local"];
+declare const BUCKET_ALWAYS_SKIP: readonly ['.git', '.DS_Store', '.gitignore'];
 declare const PRESIGNED_UPLOAD_THRESHOLD: number;
 /**
  * Default directory synced to the bucket by `playcademy bucket sync`.

package/dist/constants.js

@@ -1,3 +1,5 @@
+import { createRequire as __pcCreateRequire } from 'node:module'; const require = __pcCreateRequire(import.meta.url);
+
 // src/constants/api.ts
 import { join as join2 } from "node:path";
 
@@ -21,7 +23,7 @@ var SAMPLE_BUCKET_FILENAME = "bucket.ts";
 // ../better-auth/package.json
 var package_default = {
   name: "@playcademy/better-auth",
-  version: "0.0.21-beta.2",
+  version: "0.0.21-beta.19",
   type: "module",
   exports: {
     "./server": {
@@ -73,6 +75,24 @@ var OAUTH_CALLBACK_URL_PATTERN = "{appUrl}/api/auth/callback/{provider}";
 var PLACEHOLDER_APP_URL = "https://your-app.playcademy.gg";
 var AUTH_CONFIG_FILE = "auth.ts";
 
+// src/constants/bucket.ts
+var BUCKET_ALWAYS_SKIP = [".git", ".DS_Store", ".gitignore"];
+var PRESIGNED_UPLOAD_THRESHOLD = 4 * 1024 * 1024;
+var DEFAULT_BUCKET_DIRECTORY = "bucket";
+
+// src/constants/cloudflare.ts
+var CLOUDFLARE_BINDINGS = {
+  /** R2 bucket binding name */
+  BUCKET: "BUCKET",
+  /** KV namespace binding name */
+  KV: "KV",
+  /** D1 database binding name */
+  DB: "DB"
+};
+var MINIFLARE_D1_DIRECTORY = "miniflare-D1DatabaseObject";
+var QUEUE_NAME_PREFIX = "playcademy";
+var SELF_WORKER_NAME_BINDING = "__PLAYCADEMY_WORKER_NAME";
+
 // src/constants/config.ts
 var ENV_FILES = [
   ".env",
@@ -98,24 +118,6 @@ var TSCONFIG_REQUIRED_INCLUDES = [
   // Server-side code
 ];
 
-// src/constants/bucket.ts
-var BUCKET_ALWAYS_SKIP = [".git", ".DS_Store", ".gitignore", ...ENV_FILES];
-var PRESIGNED_UPLOAD_THRESHOLD = 4 * 1024 * 1024;
-var DEFAULT_BUCKET_DIRECTORY = "bucket";
-
-// src/constants/cloudflare.ts
-var CLOUDFLARE_BINDINGS = {
-  /** R2 bucket binding name */
-  BUCKET: "BUCKET",
-  /** KV namespace binding name */
-  KV: "KV",
-  /** D1 database binding name */
-  DB: "DB"
-};
-var MINIFLARE_D1_DIRECTORY = "miniflare-D1DatabaseObject";
-var QUEUE_NAME_PREFIX = "playcademy";
-var SELF_WORKER_NAME_BINDING = "__PLAYCADEMY_WORKER_NAME";
-
 // src/constants/database.ts
 import { join as join3 } from "path";
 var DEFAULT_DATABASE_DIRECTORY = join3("server", "db");

package/dist/db.js

@@ -1,3 +1,4 @@
+import { createRequire as __pcCreateRequire } from 'node:module'; const require = __pcCreateRequire(import.meta.url);
 var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
@@ -2335,7 +2336,7 @@ var GAME_API_ROUTES_DIRECTORY = join2(GAME_SERVER_ROOT_DIRECTORY, "api");
 // ../better-auth/package.json
 var package_default = {
   name: "@playcademy/better-auth",
-  version: "0.0.21-beta.2",
+  version: "0.0.21-beta.19",
   type: "module",
   exports: {
     "./server": {
@@ -2378,18 +2379,7 @@ var package_default = {
 // src/constants/auth.ts
 var BETTER_AUTH_VERSION = package_default.dependencies["better-auth"];
 
-// src/constants/config.ts
-var ENV_FILES = [
-  ".env",
-  // Loaded first
-  ".env.development",
-  // Overrides .env
-  ".env.local"
-  // Overrides all (highest priority)
-];
-
 // src/constants/bucket.ts
-var BUCKET_ALWAYS_SKIP = [".git", ".DS_Store", ".gitignore", ...ENV_FILES];
 var PRESIGNED_UPLOAD_THRESHOLD = 4 * 1024 * 1024;
 
 // src/constants/cloudflare.ts
@@ -2828,7 +2818,10 @@ function nestColor(content, color2) {
 function customTransform(text) {
   let result = text;
   result = result.replace(/<<([^>]+)>>/g, (_, url) => blueBright(underline(url)));
-  result = result.replace(/<([^>]+)>/g, (_, inner) => blueBright(`<${inner}>`));
+  result = result.replace(
+    /<([^>]+)>/g,
+    (match, inner) => blueBright(/[./]/.test(inner) ? inner : match)
+  );
   result = result.replace(/`([^`]+)`/g, (_, code) => nestColor(code, greenBright));
   return result;
 }
@@ -3396,6 +3389,17 @@ async function requireAuthenticatedClient() {
 
 // src/lib/core/errors.ts
 import { ApiError as ApiError2 } from "@playcademy/sdk/internal";
+
+// src/lib/core/exit.ts
+function exitAfterStdoutDrain(code) {
+  return new Promise(() => {
+    process.stdout.write("", () => {
+      process.exit(code);
+    });
+  });
+}
+
+// src/lib/core/errors.ts
 function getErrorMessage(error) {
   if (error instanceof ApiError2) {
     if (error.message) {
@@ -3420,15 +3424,6 @@ function getErrorMessage(error) {
   return "Unknown error";
 }
 
-// src/lib/core/exit.ts
-function exitAfterStdoutDrain(code) {
-  return new Promise(() => {
-    process.stdout.write("", () => {
-      process.exit(code);
-    });
-  });
-}
-
 // ../utils/src/uuid.ts
 var UUID_REGEX = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 function isValidUUID(value) {
@@ -4209,11 +4204,44 @@ var PLAYCADEMY_SUPPORTED_QTI_INTERACTION_TYPES = [
   "text-entry",
   "order",
   "match",
-  "hottext"
+  "hottext",
+  "hotspot",
+  "gap-match",
+  "graphic-gap-match",
+  "select-point",
+  "graphic-associate",
+  "position-object"
 ];
 var PLAYCADEMY_SUPPORTED_QTI_INTERACTION_TYPE_SET = new Set(
   PLAYCADEMY_SUPPORTED_QTI_INTERACTION_TYPES
 );
+var PLAYCADEMY_AUTHORABLE_QTI_INTERACTION_TYPES = [
+  "choice",
+  "inline-choice",
+  "text-entry",
+  "order",
+  "match",
+  "hottext",
+  "gap-match",
+  "hotspot",
+  "graphic-associate",
+  "graphic-gap-match"
+];
+var PLAYCADEMY_AUTHORABLE_QTI_INTERACTION_TYPE_SET = new Set(
+  PLAYCADEMY_AUTHORABLE_QTI_INTERACTION_TYPES
+);
+var QTI_RASTER_IMAGE_MIME_TYPES = [
+  "image/png",
+  "image/jpeg",
+  // Some browsers and operating systems still report the legacy jpg spelling.
+  "image/jpg",
+  "image/gif",
+  "image/webp",
+  "image/bmp"
+];
+var QTI_RASTER_IMAGE_SUBTYPE_PATTERN = QTI_RASTER_IMAGE_MIME_TYPES.map(
+  (type) => type.slice("image/".length)
+).join("|");
 var TIMEBACK_DISCREPANCY_QUEUE_WINDOW_VALUES = new Set(TIMEBACK_DISCREPANCY_QUEUE_WINDOWS);
 var TIMEBACK_DISCREPANCY_QUEUE_METRIC_VALUES = new Set(TIMEBACK_DISCREPANCY_QUEUE_METRICS);
 

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 import { ApiKeyRow } from '@playcademy/data/types';
 import { UserInfo } from '@playcademy/types/user';
 import { SchemaInfo } from '@playcademy/cloudflare';
+import { GamePermission } from '@playcademy/constants';
 import { TimebackCourseConfig, CourseConfig, OrganizationConfig, ComponentConfig, ResourceConfig, ComponentResourceConfig } from '@playcademy/types/timeback';
 export { ComponentConfig, ComponentResourceConfig, OrganizationConfig, ResourceConfig, TimebackCourseConfig, TimebackGrade, TimebackSourcedIds, TimebackSubject } from '@playcademy/types/timeback';
 import { PlaycademyClient } from '@playcademy/sdk/internal';
@@ -185,11 +186,10 @@ interface GameBackendFeatures {
  * Bucket command types
  */
 /**
- * Base options shared across bucket commands
+ * Base options shared across bucket commands. `raw` is not here on purpose:
+ * only the commands that register `--raw` (list, get, put) carry it.
  */
 interface BaseBucketOptions {
-    /** Output in raw format */
-    raw?: boolean;
     /** Output in JSON format */
     json?: boolean;
     /** Use remote bucket storage */
@@ -201,15 +201,21 @@ interface BaseBucketOptions {
  * Options for the bucket list command
  */
 interface BucketListOptions extends BaseBucketOptions {
+    /** Output all file keys one per line, no formatting (implies `recursive`) */
+    raw?: boolean;
     /** Filter files by key prefix */
     prefix?: string;
     /** Show the literal stored R2 keys (`_assets/sprites/hero.a1b2c3d4.svg`) instead of logical paths */
     literal?: boolean;
+    /** List every object under the prefix instead of one directory level */
+    recursive?: boolean;
 }
 /**
  * Options for the bucket get command
  */
 interface BucketGetOptions extends BaseBucketOptions {
+    /** Write file content straight to stdout */
+    raw?: boolean;
     /** Output file path */
     output?: string;
     /** Skip manifest resolution and fetch the literal key as stored */
@@ -218,7 +224,35 @@ interface BucketGetOptions extends BaseBucketOptions {
 /**
  * Options for the bucket put command (local debug only)
  */
-type BucketPutOptions = BaseBucketOptions;
+interface BucketPutOptions extends BaseBucketOptions {
+    /** Output minimal confirmation */
+    raw?: boolean;
+}
+/**
+ * Options for the bucket upload command
+ */
+interface BucketUploadOptions extends BaseBucketOptions {
+    /** Key prefix every uploaded file lands under */
+    prefix?: string;
+    /** Show what would be uploaded without uploading */
+    dryRun?: boolean;
+    /**
+     * Re-upload every file, even one already present at the same size — the
+     * escape hatch for the size-only diff (a file whose bytes changed but
+     * whose size did not is otherwise skipped). Authorizing the resulting
+     * replacements is a separate concern (the global `--yes`).
+     */
+    overwrite?: boolean;
+}
+/**
+ * Options for the bucket delete command
+ */
+interface BucketDeleteOptions extends BaseBucketOptions {
+    /** Delete every object under this key prefix instead of explicit keys */
+    prefix?: string;
+    /** Show what would be deleted without deleting */
+    dryRun?: boolean;
+}
 /**
  * How `bucket sync` treats pre-CAS objects already in the bucket that share a
  * logical path with a file being uploaded (a first-time migration).
@@ -256,6 +290,19 @@ interface BucketObjectRef {
     key: string;
     size: number;
 }
+/** One listed object, as the list command displays it. */
+interface ListedObject {
+    key: string;
+    size: number;
+    lastModified: string;
+}
+/** One directory level of a bucket: directory rows plus the files at that level. */
+interface BucketLevelView {
+    /** Directory rows (ending with the delimiter), sorted */
+    prefixes: string[];
+    /** Files at this level, sorted by key */
+    files: ListedObject[];
+}
 /**
  * Content-addressable asset manifest: maps logical paths to bare content-hashed
  * keys. Persisted to the bucket as `_manifest.json` (transport-free — the
@@ -278,11 +325,20 @@ interface HashedFile {
     content: Buffer;
 }
 /**
- * Transport-agnostic bucket operations the sync engine drives. Implemented for
- * both the remote API (presigned/uploads) and the local Miniflare R2 binding.
+ * Transport-agnostic bucket operations the bucket commands drive. Implemented
+ * for both the remote API (presigned/uploads) and the local Miniflare R2
+ * binding.
  */
 interface BucketAdapter {
-    list(): Promise<BucketObjectRef[]>;
+    /** List objects under `prefix` (or everything). */
+    list(prefix?: string): Promise<BucketObjectRef[]>;
+    /**
+     * Whether an object exists at exactly `key`. Implementations must check
+     * membership, never listing position: R2's S3 listing does not return
+     * keys in byte-lexicographic order, so among prefix-sharing keys the
+     * exact key is not guaranteed to appear first.
+     */
+    exists(key: string): Promise<boolean>;
     put(key: string, content: Buffer, contentType: string): Promise<void>;
     delete(key: string): Promise<void>;
 }
@@ -423,6 +479,19 @@ interface DashboardThemeConfig {
     /** Secondary/accent color as a hex string, e.g. '#ffd166' */
     secondary?: string;
 }
+/**
+ * Child-catalog contract generation (see @playcademy/sdk/contracts).
+ * The extractor is a repo-local script (run with the CLI's runtime) that
+ * prints `{ generatedFrom, deliveries }` as JSON on stdout; the CLI
+ * validates, stamps the contract fields, and writes
+ * `.playcademy/catalog.json` deterministically. The document carries no
+ * app identity — consuming repos assign the namespace key from sync
+ * provenance.
+ */
+interface CatalogConfig {
+    /** Path to the extractor script, relative to the config file. */
+    extractor: string;
+}
 /**
  * Unified Playcademy configuration
  * Used for playcademy.config.{js,json}
@@ -434,6 +503,13 @@ interface PlaycademyConfig {
     description?: string;
     /** Game emoji icon */
     emoji?: string;
+    /**
+     * Browser permissions to request for the game's iframe (e.g.
+     * `['microphone']`). Opt-in per game; only `microphone` and `camera` are
+     * delegated this way. Fullscreen, autoplay, and gamepad are granted to
+     * every game automatically.
+     */
+    permissions?: GamePermission[];
     /** Build command to run before deployment */
     buildCommand?: string[];
     /** Path to build output */
@@ -448,6 +524,8 @@ interface PlaycademyConfig {
     dashboard?: DashboardConfig | boolean;
     /** Integrations (database, custom routes, external services) */
     integrations?: IntegrationsConfig;
+    /** Child-catalog contract generation (`playcademy catalog`) */
+    catalog?: CatalogConfig;
 }
 
 /**
@@ -485,6 +563,8 @@ interface WorkerDeploymentBundle {
 interface GameMetadata {
     description?: string;
     emoji?: string;
+    /** Browser permissions delegated to the game's iframe (opt-in per game). */
+    permissions?: GamePermission[];
     [key: string]: unknown;
 }
 declare const games: drizzle_orm_pg_core.PgTableWithColumns<{
@@ -1079,6 +1159,13 @@ interface DeployConfig {
     description?: string;
     /** Emoji icon for the project */
     emoji?: string;
+    /**
+     * Browser permissions the game's iframe should be granted (e.g.
+     * `['microphone']`). Opt-in per game; only `microphone` and `camera` are
+     * delegated this way. Fullscreen, autoplay, and gamepad are granted to
+     * every game automatically.
+     */
+    permissions?: GamePermission[];
     /** Path to the build directory or zip file */
     buildPath?: string;
     /** Game platform (defaults to 'web') */
@@ -1291,6 +1378,10 @@ interface ConfigDiff {
         old: string | undefined;
         new: string | undefined;
     };
+    permissions?: {
+        old: string[] | undefined;
+        new: string[] | undefined;
+    };
     gameType?: {
         old: string;
         new: string;
@@ -1766,4 +1857,4 @@ interface RunShellOptions {
     env?: NodeJS.ProcessEnv;
 }
 
-export type { ApiConfig, ApiErrorResponse, ApiKeyListItem, ApiKeyWithSecret, ApiRequestOptions, ApplySecretsOptions, AssetManifest, AuthProfile, AuthStore, AuthStrategy, AvailableUpdate, BackendDiff, BaseKVOptions, BlockedCode, BucketAdapter, BucketGetOptions, BucketListOptions, BucketMigrateMode, BucketObjectRef, BucketPutOptions, BucketSyncOptions, BuildDiff, BundleOptions, CallbackServerResult, CheckSecretsOptions, CollectedFile, CompatibilityKey, CompatibilityManifest, ConfigDiff, CreateApiKeyResponse, CustomRoutesIntegrationOptions, DashboardConfig, DatabaseIntegrationOptions, DependencyCheck, DeployConfig, DeployNewGameOptions, DeployedGameInfo, DeploymentChanges, DeploymentContext, DeploymentDiffOptions, DeploymentPlan, DeploymentResult, DiscoveredDependency, EngineConfig, EngineType, EnvironmentAuthProfiles, GameBackendBundle, GameBackendDeploymentMetadata, GameBackendFeatures, GameDevServerOptions, GameRuntimePaths, GameStore, HashedFile, InstalledVersions, IntegrationChangeDetector, IntegrationChangeDetectors, IntegrationConfigChange, IntegrationsConfig, IntegrationsDiff, KVClearOptions, KVDeleteOptions, KVDumpOptions, KVGetOptions, KVInspectOptions, KVListOptions, KVSeedOptions, KVSetOptions, KVStatsOptions, KeyMetadata, KeyStats, LoadConfigResult, LogEntry, LogFilters, LogHistoryQuery, LogHistoryResult, LogStreamConfig, LogStreamUrlOptions, LoginCredentials, LoginResponse, MissingSecret, PlaycademyConfig, PluginLogger, PreviewOptions, PreviewResponse, ProjectDirectoryInfo, QueueConfig, RunShellOptions, RuntimeManifest, ScaffoldResult, SecretCommandOptions, SecretListOptions, SecretPushOptions, SecretsSyncOptions, SecretsSyncResult, SignInResponse, SsoCallbackData, Template, TemplateFramework, TemplateHook, TemplateHookOptions, TemplateSource, TimebackBaseConfig, TimebackCourseConfigWithOverrides, TimebackIntegrationConfig, TokenType, UpdateCommand, UpdateExistingGameOptions, Violation, WorkspaceDependencies };
+export type { ApiConfig, ApiErrorResponse, ApiKeyListItem, ApiKeyWithSecret, ApiRequestOptions, ApplySecretsOptions, AssetManifest, AuthProfile, AuthStore, AuthStrategy, AvailableUpdate, BackendDiff, BaseKVOptions, BlockedCode, BucketAdapter, BucketDeleteOptions, BucketGetOptions, BucketLevelView, BucketListOptions, BucketMigrateMode, BucketObjectRef, BucketPutOptions, BucketSyncOptions, BucketUploadOptions, BuildDiff, BundleOptions, CallbackServerResult, CheckSecretsOptions, CollectedFile, CompatibilityKey, CompatibilityManifest, ConfigDiff, CreateApiKeyResponse, CustomRoutesIntegrationOptions, DashboardConfig, DatabaseIntegrationOptions, DependencyCheck, DeployConfig, DeployNewGameOptions, DeployedGameInfo, DeploymentChanges, DeploymentContext, DeploymentDiffOptions, DeploymentPlan, DeploymentResult, DiscoveredDependency, EngineConfig, EngineType, EnvironmentAuthProfiles, GameBackendBundle, GameBackendDeploymentMetadata, GameBackendFeatures, GameDevServerOptions, GameRuntimePaths, GameStore, HashedFile, InstalledVersions, IntegrationChangeDetector, IntegrationChangeDetectors, IntegrationConfigChange, IntegrationsConfig, IntegrationsDiff, KVClearOptions, KVDeleteOptions, KVDumpOptions, KVGetOptions, KVInspectOptions, KVListOptions, KVSeedOptions, KVSetOptions, KVStatsOptions, KeyMetadata, KeyStats, ListedObject, LoadConfigResult, LogEntry, LogFilters, LogHistoryQuery, LogHistoryResult, LogStreamConfig, LogStreamUrlOptions, LoginCredentials, LoginResponse, MissingSecret, PlaycademyConfig, PluginLogger, PreviewOptions, PreviewResponse, ProjectDirectoryInfo, QueueConfig, RunShellOptions, RuntimeManifest, ScaffoldResult, SecretCommandOptions, SecretListOptions, SecretPushOptions, SecretsSyncOptions, SecretsSyncResult, SignInResponse, SsoCallbackData, Template, TemplateFramework, TemplateHook, TemplateHookOptions, TemplateSource, TimebackBaseConfig, TimebackCourseConfigWithOverrides, TimebackIntegrationConfig, TokenType, UpdateCommand, UpdateExistingGameOptions, Violation, WorkspaceDependencies };