@homie-rocks/studio 0.11.0 → 0.12.0

package/README.md

@@ -72,8 +72,8 @@ site. A game made with Homie's arcade controls that knocks for a Homie box (`/__
 A studio pins one version, so nothing changes until it asks. To take a newer one:
 
 ```sh
-npx -y @homie-rocks/studio@0.11.0 upgrade          # the plan; changes nothing
-npx -y @homie-rocks/studio@0.11.0 upgrade --apply  # after the person agrees
+npx -y @homie-rocks/studio@0.12.0 upgrade          # the plan; changes nothing
+npx -y @homie-rocks/studio@0.12.0 upgrade --apply  # after the person agrees
 npm install && npm run build
 ```
 
@@ -94,6 +94,32 @@ Bots, a late joiner taking a bot's body and a new host after the old one leaves
 the same at 32 as at 4. One address may hold every seat plus four sockets, so a party
 on one Wi-Fi (or strangers behind one carrier's address) fills a room with a TV beside it.
 
+## Player accounts and cloud saves
+
+A game whose progress must last (a character that levels up for days, unlocks, a collection, a hardcore mode)
+keeps it in **saves**, not in its room: a room forgets everything 60 s after its last player leaves.
+
+```json
+{ "id": "my-rpg", "saves": true }
+```
+
+```ts
+import { createSaves } from '@homie-rocks/studio/saves';
+const saves = createSaves({ game: 'my-rpg' });
+const hero = (await saves.get('hero')) ?? newHero();
+await saves.set('hero', hero);                       // on this device at once, in the studio's D1 when online
+saves.stats.add({ kills: 1 });                       // lifetime numbers that outlive any hero
+await saves.fall({ character: hero.name, summary: { level: hero.level }, wipe: true });   // hardcore
+```
+
+Pressing Play needs no account. A player who saves something is a guest on that browser; with a **passkey**
+(Face ID, a fingerprint, a PIN, no password, no email) it becomes an account on this studio only, and the same
+saves follow them to every device they sign in on. Saves are per player and game, versioned (a stale offline
+copy is a conflict, never an overwrite), capped in size, and offline-tolerant. Players see, download and delete
+everything at `/account/`; the owner sees counts (`homie-studio players`) and, through the back office, names,
+never a passkey or an email. The `ember-vale` starter is a small persistent-character game on the same public
+rooms. Everything, including what is stored and the back office's API: [saves/SAVES.md](saves/SAVES.md).
+
 ## The studio's own stats
 
 The site counts, and never tracks: pages opened, Play presses, rooms opened, the most
@@ -116,7 +142,7 @@ studio's own Cloudflare login. `worker/stats.mjs` says exactly what is counted.
 ## Setup status
 
 ```sh
-npx -y @homie-rocks/studio@0.11.0 setup status --connector yes   # before a studio exists
+npx -y @homie-rocks/studio@0.12.0 setup status --connector yes   # before a studio exists
 npx homie-studio setup status                                    # in a studio (also: homie-studio doctor)
 ```
 
@@ -205,9 +231,10 @@ Workers Builds deploys the branch as a Preview; the card's **Publish** opens the
 person's merge is the approval; Workers Builds deploys `main`, and the card says **Live** when the live site's
 manifest lists the change's mark (`homie-studio build` lists the newest marks from `changes/`).
 
-A Claude Code cloud session's default network ("Trusted") does not reach homie.rocks; the toolkit says so, and
-names the setting (the environment's Network access: Custom, add homie.rocks), instead of "did not answer". The
-build goes on with its local feed.
+A Claude Code cloud session's default network ("Trusted") reaches homie.rocks. If a session's network blocks it
+(its proxy answers 403 `host_not_allowed`, and the progress card stops updating), the toolkit says so and names the
+setting (the environment's Network access: Custom, add homie.rocks), instead of "did not answer". The build goes on
+with its local feed.
 
 The feed is `.studio/progress/<build>.json` (git-ignored). With `--share` the studio's
 directory (studio.json `homie.directory`, homie.rocks by default) keeps a copy for 24

package/bin/homie-studio.mjs

@@ -37,6 +37,8 @@
  *   homie-studio stats link               (a one-time link to the private stats page, for the owner's browser)
  *   homie-studio stats revoke             (every stats key and page session ends)
  *   homie-studio stats share on|off       (tell the homie.rocks directory "played this week", or stop)
+ *   homie-studio players                  (player accounts and guests with saves: counts, never a passkey or an email)
+ *   homie-studio players owner [--revoke] (a one-time link that marks the owner's own player account as the owner's)
  *
  *   homie-studio progress start [<id>] [--what game|song|video] [--title "<what this build does>"]
  *                                        [--budget <dollars>] [--unit usd|credits] [--share]
@@ -96,11 +98,12 @@ import { look } from '../lib/look.mjs';
 import { importPort, planPort } from '../lib/port.mjs';
 import { portCheck } from '../lib/port-check.mjs';
 import { recordUpload, resolveMedia, typeOf } from '../lib/media.mjs';
-import { ensureStatsMigration, newStudio } from '../lib/scaffold.mjs';
+import { ensureMigrations, newStudio } from '../lib/scaffold.mjs';
 import { lineDiff, upgradeApply, upgradePlan } from '../lib/upgrade.mjs';
 import { listGames, newGame, readStudio, remixGame, requireStudio, siteUrl, starters, workerDir } from '../lib/studio.mjs';
 import { STUDIO_VERSION } from '../lib/version.mjs';
 import { statsKey, statsLink, statsRevoke, statsShare, statsShow } from '../lib/stats.mjs';
+import { playersOwner, playersShow } from '../lib/players.mjs';
 import { Feed, currentFeed, currentId, flushProgress, publicFeed, readFeed, recordChange, startProgress } from '../lib/progress.mjs';
 import { formatStatus, setupStatus } from '../lib/doctor.mjs';
 import { codexTarget, newCodex, writeCodexPage } from '../lib/codex.mjs';
@@ -108,7 +111,7 @@ import { installStatusLine, statusLine } from '../lib/statusline.mjs';
 
 const argv = process.argv.slice(2);
 const flags = new Map();
-const BOOL_FLAGS = ['json', 'yes', 'detach', 'no-install', 'plan', 'stop', 'share', 'apply', 'diff', 'template', 'ci', 'fresh', 'install', 'remove', 'replace', 'artifact', 'open'];
+const BOOL_FLAGS = ['revoke', 'json', 'yes', 'detach', 'no-install', 'plan', 'stop', 'share', 'apply', 'diff', 'template', 'ci', 'fresh', 'install', 'remove', 'replace', 'artifact', 'open'];
 const positional = [];
 for (let i = 0; i < argv.length; i++) {
   const a = argv[i];
@@ -207,8 +210,17 @@ function print(result) {
       for (const e of result.songs) lines.push(`  song ${e.slug}: ${n(e.visits)} page visits, played ${n(e.plays)}`);
       for (const e of result.videos) lines.push(`  video ${e.slug}: ${n(e.visits)} page visits, watched ${n(e.views)}`);
       for (const r of result.referrers.slice(0, 10)) lines.push(`  from ${r.from} (${r.kind}): ${n(r.visits)} visits, ${n(r.plays)} plays`);
+      if (result.players) lines.push(`  players: ${n(result.players.accounts)} accounts (${n(result.players.newAccounts7d)} new this week), ${n(result.players.guests)} guests with saves, ${n(result.players.active7d)} played this week`);
       break;
     }
+    case 'players': {
+      const p = result.players;
+      lines.push(`${p.accounts} player accounts (${p.newAccounts7d} new this week), ${p.guests} guests with saves, ${p.active7d} played this week.`, result.note);
+      break;
+    }
+    case 'players owner':
+      lines.push(result.revoked ? result.message : `One-time link (until ${result.expiresAt}): ${result.link}`, ...(result.revoked ? [] : [result.use]));
+      break;
     case 'stats key':
       lines.push(`Read key (until ${result.expiresAt}): ${result.key}`, result.use);
       break;
@@ -388,6 +400,8 @@ async function main() {
     return { ok: true, command: 'storage', storage: has ? { kind: 'r2', bucket: cf.r2 } : null, why: has ? undefined : 'no storage yet: the studio runs without it; `homie-studio storage add` adds an R2 bucket for large media (Cloudflare asks for a payment method before R2 works)' };
   }
   if (cmd === 'publish') return publish(root, { homie: flags.get('homie'), site: flags.get('site') });
+  if (cmd === 'players' && sub === 'owner') return playersOwner(root, { url: flags.get('url'), revoke: flags.has('revoke') });
+  if (cmd === 'players' && !sub) return playersShow(root, { url: flags.get('url') });
   if (cmd === 'stats' && sub === 'key') return statsKey(root, { url: flags.get('url'), hours: flags.get('hours') });
   if (cmd === 'stats' && sub === 'link') return statsLink(root, { url: flags.get('url') });
   if (cmd === 'stats' && sub === 'revoke') return statsRevoke(root, { url: flags.get('url') });
@@ -562,8 +576,7 @@ async function dev(root) {
   if (!bin) return { ok: false, command: 'dev', why: 'run npm install in the studio first' };
   const studio = readStudio(root);
   const env = { ...process.env, WRANGLER_SEND_METRICS: 'false', CI: '1' };
-  const added = ensureStatsMigration(root);
-  if (added) log(`added ${added} (the studio's own stats)`);
+  for (const added of ensureMigrations(root)) log(`added ${added} (${/players/.test(added) ? 'player accounts and cloud saves' : 'the studio\'s own stats'})`);
   await new Promise((done) => {
     const m = spawn(bin, ['d1', 'migrations', 'apply', 'DB', '--local'], { cwd: workerDir(root), env, stdio: ['ignore', 'ignore', 'inherit'] });
     m.on('close', done);

package/lib/build.mjs

@@ -220,6 +220,9 @@ export async function build(root, { only = null, log = () => {} } = {}) {
       id: g.id, name: g.name ?? g.id, blurb: g.blurb ?? '', players: { min, max },
       roundSeconds: g.roundSeconds ?? net.roundSeconds ?? null, movement: net.movement ?? null, cover: g.cover ?? null,
       ...(g.screen ? { screen: g.screen } : {}),
+      // game.json "saves": true — player accounts and cloud saves (saves/SAVES.md): the play shell answers the game's
+      // saves calls, and the site's nav and the game's landing offer a player account.
+      ...(g.saves === true || (g.saves && typeof g.saves === 'object') ? { saves: true } : {}),
       landing: landingOf(g, join(dist, 'games', g.id), { videos: media.videos, songs: media.songs, log }),
     };
   });

package/lib/cloudflare.mjs

@@ -22,7 +22,7 @@ import { spawnSync } from 'node:child_process';
 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { build } from './build.mjs';
-import { ensureLocalIgnored, ensureStatsMigration, wranglerConfig } from './scaffold.mjs';
+import { ensureLocalIgnored, ensureMigrations, wranglerConfig } from './scaffold.mjs';
 import { LOCAL_STATE, configPath, isWorkersDev, layoutOf, readLocal, readStudio, siteUrl, workerDir, writeLocal, writeStudio } from './studio.mjs';
 
 const ANSI = /\u001b\[[0-9;]*m/g;
@@ -96,7 +96,7 @@ export function deployPlan(root) {
     ok: true, command: 'deploy plan', studio: studio.name, account: cf.accountId ?? null,
     cloudflare: [
       { kind: 'Worker', name: cf.worker, what: 'the studio\'s pages, each game\'s page and play shell, and /.well-known/homie-studio.json for the directory', state: mark(`worker:${cf.worker}`), plan: 'Workers Free' },
-      { kind: 'D1 database', name: cf.d1, what: 'the directory claim, every finished round, and the studio\'s own stats (daily counters of visits, plays, rooms, rounds and songs, for the owner only; nothing about a visitor)', state: mark(`d1:${cf.d1}`), plan: 'Workers Free (500 MB per database, 5 GB per account)' },
+      { kind: 'D1 database', name: cf.d1, what: 'the directory claim, every finished round, the studio\'s own stats (daily counters of visits, plays, rooms, rounds and songs, for the owner only; nothing about a visitor), and, for games that keep saves, player accounts (a passkey\'s public key, never a password) and their saves', state: mark(`d1:${cf.d1}`), plan: 'Workers Free (500 MB per database, 5 GB per account)' },
       { kind: 'Durable Object', name: 'Table', what: 'one per public room: the netplay relay (seats, host, snapshots); runs no game code', state: 'declared by the Worker', plan: 'Workers Free (SQLite-backed)' },
       { kind: 'Durable Object', name: 'Lobby', what: 'one per game: puts strangers who press Play into the same room', state: 'declared by the Worker', plan: 'Workers Free (SQLite-backed)' },
       storage
@@ -192,8 +192,7 @@ export async function deploy(root, { log = () => {}, homie } = {}) {
   if (!r2) step('no storage (R2): the studio needs none to run; `homie-studio storage add` adds it for large media');
 
   writeFileSync(configPath(root), wranglerConfig({ worker: cf.worker, name: studio.name, d1: cf.d1, d1Id: db.uuid, r2, layout: layoutOf(root) }));
-  const added = ensureStatsMigration(root);
-  if (added) step(`added ${added} (the studio's own stats: counts, never tracks)`);
+  for (const added of ensureMigrations(root)) step(`added ${added} (${/players/.test(added) ? 'player accounts and cloud saves' : 'the studio\'s own stats: counts, never tracks'})`);
   const migrate = w(['d1', 'migrations', 'apply', cf.d1, '--remote']);
   if (migrate.code !== 0) return refuse(`D1 migrations failed: ${migrate.out.trim().split('\n').slice(-4).join(' ')}`, migrate.out);
   step('D1 migrations applied');
@@ -283,7 +282,7 @@ export async function ciDeploy(root, { log = () => {} } = {}) {
   const step = (what) => { steps.push({ what }); log(what); };
   const refuse = (why, out) => ({ ok: false, command: 'deploy', ci: true, ...(explainCloudflare(out) ?? { why }), steps });
   if (!existsSync(join(root, 'site', 'dist', 'games.json'))) return { ok: false, command: 'deploy', ci: true, why: 'nothing is built: the build command is `npm run build` (homie-studio build), and it runs before this', steps };
-  if (ensureStatsMigration(root)) step('added the stats migration (the studio\'s own counters)');
+  for (const added of ensureMigrations(root)) step(`added ${added} (${/players/.test(added) ? 'player accounts and cloud saves' : 'the studio\'s own counters'})`);
   const apply = () => w(['d1', 'migrations', 'apply', names.binding, '--remote']);
   let migrate = apply();
   const first = migrate.code !== 0 && /not found|could(?:n't| not) find|does not exist|no database|database_id/i.test(migrate.out);

package/lib/codex.mjs

@@ -637,6 +637,7 @@ ${game.blurb ?? ''}
 - **Players in a room:** ${players}
 - **Round:** ${game.roundSeconds ? `${game.roundSeconds} s` : 'how long, and how it ends'}
 - **Bots:** fill empty seats; a person who arrives takes a bot's place
+- **Progress that lasts:** ${game.saves ? 'the player\'s own saves (cloud saves: what is kept, lifetime stats, hardcore or not)' : 'none: a round is all there is (or cloud saves, if the plan says progress persists across sessions or devices)'}
 
 ## Music and sound
 

package/lib/players.mjs

@@ -0,0 +1,38 @@
+/**
+ * `homie-studio players` — the studio's players, for its owner (worker/players.mjs, saves/SAVES.md).
+ *
+ *   homie-studio players [--url <site>]          how many have accounts, guests with saves, who played this week
+ *   homie-studio players owner [--url <site>]    a one-time link that marks the owner's OWN player account as the
+ *                                                owner's (open it in the browser where they are signed in on the site)
+ *   homie-studio players owner --revoke          no account is the owner's any more
+ *
+ * The proof of ownership is the studio's own Cloudflare login, as for `stats`: the link's key is minted here and
+ * only its SHA-256 goes into the studio's D1 (through Wrangler). The link works once, for 30 minutes.
+ */
+import { runner } from './cloudflare.mjs';
+import { loopback, mint, siteOf, statsShow } from './stats.mjs';
+
+export async function playersShow(root, { url } = {}) {
+  const s = await statsShow(root, { url, range: '7d' });
+  if (!s.ok) return { ...s, command: 'players' };
+  if (!s.players) return { ok: false, command: 'players', why: 'this studio\'s D1 has no player tables yet: `npm run deploy` applies migration 0004_players.sql (or `npm run dev` for a local site)' };
+  return { ok: true, command: 'players', site: s.site, players: s.players, note: 'Counts only. A player\'s name, passkeys and saves are theirs; the back office lists names, never a passkey or an email.' };
+}
+
+export function playersOwner(root, { url, revoke = false } = {}) {
+  const { studio, site } = siteOf(root, url);
+  if (!site) return { ok: false, command: 'players owner', why: 'this studio has no live site yet: `npm run deploy` first, or give --url http://127.0.0.1:8787 for `npm run dev`' };
+  const local = loopback(site);
+  if (revoke) {
+    const w = runner(root, studio.cloudflare?.accountId && !local ? { CLOUDFLARE_ACCOUNT_ID: studio.cloudflare.accountId } : {});
+    const res = w(['d1', 'execute', studio.cloudflare.d1, local ? '--local' : '--remote', '--command', "UPDATE players SET owner = 0; DELETE FROM stats_keys WHERE kind = 'player-owner';"]);
+    return res.code === 0 ? { ok: true, command: 'players owner', site, revoked: true, message: 'No player account is the owner\'s now. `homie-studio players owner` marks one again.' }
+      : { ok: false, command: 'players owner', why: res.out.trim().split('\n').slice(-3).join(' ') };
+  }
+  const k = mint(root, studio, 'player-owner', 30 * 60_000, { local });
+  if (!k.ok) return { ok: false, command: 'players owner', why: k.why };
+  return {
+    ok: true, command: 'players owner', site, link: `${site}/account/?owner=${k.key}`, expiresAt: k.expiresAt,
+    use: 'Give this link to the studio\'s owner to open in the browser where they play: they sign in (or make an account with a passkey) on that page, then press "Yes, this account is mine". It works once, within 30 minutes. It is theirs alone; do not post it anywhere.',
+  };
+}

package/lib/progress.mjs

@@ -90,9 +90,10 @@ const currentPath = (root) => join(dir(root), 'current');
 const loopback = (url) => { try { return ['127.0.0.1', 'localhost', '[::1]'].includes(new URL(url).hostname); } catch { return false; } };
 
 /*
- * A CLAUDE CODE CLOUD SESSION ON THE DEFAULT NETWORK. Its "Trusted" network reaches package registries and GitHub,
- * not homie.rocks: the session's proxy answers 403 with `x-deny-reason: host_not_allowed`. Say which setting lets
- * the card follow the build, instead of "did not answer"; the build itself goes on with its local feed.
+ * A CLAUDE CODE CLOUD SESSION WHOSE NETWORK BLOCKS THE DIRECTORY. The default "Trusted" network reached homie.rocks
+ * in a real cloud session (2026-10-01); a stricter one makes the session's proxy answer 403 with
+ * `x-deny-reason: host_not_allowed`. Then, and only then, say which setting lets the card follow the build,
+ * instead of "did not answer"; the build itself goes on with its local feed.
  */
 export function networkWhy(res, at) {
   if (res?.status === 403 && /host_not_allowed/i.test(res.headers?.get?.('x-deny-reason') ?? '')) {

package/lib/scaffold.mjs

@@ -24,6 +24,7 @@ import { homedir } from 'node:os';
 import { dirname, join, relative, resolve } from 'node:path';
 import { STUDIO_VERSION, packageSpec } from './version.mjs';
 import { STATS_MIGRATION, STATS_MIGRATION_FILE } from '../worker/stats.mjs';
+import { PLAYERS_MIGRATION, PLAYERS_MIGRATION_FILE } from '../worker/players.mjs';
 import { themeFile } from './site.mjs';
 import { PACKAGE_ROOT } from './studio.mjs';
 
@@ -149,6 +150,10 @@ studio's pinned copy, never a registry lookup of the bare name.
   \`studio_stats\` (never paste a key anywhere else). \`stats share on\` tells the directory two numbers
   (played this week). The site counts and never tracks: no cookie on a visitor, no person identified,
   nothing sent anywhere; house QA and \`check\` runs are not counted.
+- \`npx --no-install homie-studio players\` — how many players have accounts here (and guests, and who played
+  this week): counts and names for the owner, never a passkey or an email. \`players owner\` gives the owner a
+  one-time link that marks their own player account (a passkey on this site) as the owner's, so their games and
+  the studio's back office recognise them.
 - \`npx --no-install homie-studio upgrade\` — after pinning a newer \`@homie-rocks/studio\` (or through
   \`npx -y --package=<its tarball> homie-studio upgrade\`): what the newer template adds to this studio (AGENTS.md
   sections, READMEs, .gitignore lines) and what it keeps. It changes nothing until \`--apply\`, and never
@@ -191,6 +196,13 @@ studio's pinned copy, never a registry lookup of the bare name.
   a small icon (\`node_modules/@homie-rocks/studio/site/SITE.md\`). Look at it on a phone and a computer.
 - Change a game in small steps, build, and look at it (\`dev\`, then \`check\`).
 - A game's id is its URL (\`/<id>/\`); keep it once published.
+- **Progress that lasts** (a character, unlocks, a collection, days of play) goes in **saves**, never in the room:
+  a room forgets everything 60 s after its last player leaves. game.json \`"saves": true\` and
+  \`createSaves\` from \`@homie-rocks/studio/saves\` (\`node_modules/@homie-rocks/studio/saves/SAVES.md\`): per
+  player and game, versioned, offline-tolerant, in this studio's own D1. Pressing Play needs no account; a guest's
+  progress stays on that device until they make a passkey account (at \`/account/\`, or the game's own button), and
+  then it follows them to every device. Lifetime stats and a hardcore "hall of the fallen" are in it too. The
+  \`ember-vale\` starter shows the whole pattern.
 
 ## The Game Codex and progress
 
@@ -359,7 +371,7 @@ export function studioFiles({ name, slug, homie, template = false }) {
       products: ['Workers', 'D1', 'Durable Objects'],
       bindings: {
         STUDIO_NAME: { description: 'Your studio\'s name, as its site shows it (for example **Night Owls**). Claude can change it later.' },
-        DB: { description: 'The studio\'s own database: finished rounds, the studio\'s own stats (counts, never a visitor) and its claim in the [homie.rocks](https://homie.rocks/studios/) directory. Free plan.' },
+        DB: { description: 'The studio\'s own database: finished rounds, the studio\'s own stats (counts, never a visitor), player accounts and cloud saves for games that keep them, and its claim in the [homie.rocks](https://homie.rocks/studios/) directory. Free plan.' },
       },
     },
   };
@@ -384,6 +396,7 @@ export { default, Table, Lobby } from '@homie-rocks/studio/worker';
 `,
     'site/migrations/0001_studio.sql': MIGRATION,
     [`site/migrations/${STATS_MIGRATION_FILE}`]: STATS_MIGRATION,
+    [`site/migrations/${PLAYERS_MIGRATION_FILE}`]: PLAYERS_MIGRATION,
     'wrangler.jsonc': wranglerConfig({ worker, name, d1: studio.cloudflare.d1, r2: studio.cloudflare.r2, layout: 'root' }),
     '.claude/skills/.gitkeep': '',
   };
@@ -453,6 +466,23 @@ export function ensureStatsMigration(root) {
   return `site/migrations/${STATS_MIGRATION_FILE}`;
 }
 
+/**
+ * A studio made before 0.12.0 has no players migration (player accounts and cloud saves, saves/SAVES.md): add it,
+ * so the next `d1 migrations apply` makes the tables. Returns the file it wrote, or null when it was there.
+ */
+export function ensurePlayersMigration(root) {
+  const file = join(root, 'site', 'migrations', PLAYERS_MIGRATION_FILE);
+  if (existsSync(file)) return null;
+  mkdirSync(dirname(file), { recursive: true });
+  writeFileSync(file, PLAYERS_MIGRATION);
+  return `site/migrations/${PLAYERS_MIGRATION_FILE}`;
+}
+
+/** Every migration the template owns that this studio lacks, added: the files written (deploy and dev say so). */
+export function ensureMigrations(root) {
+  return [ensureStatsMigration(root), ensurePlayersMigration(root)].filter(Boolean);
+}
+
 /**
  * A studio made before 0.6.0 committed nothing under .studio/ yet: make sure git leaves it out before the first
  * deploy writes the workers.dev address there. Returns true when it added the line.

package/lib/site.mjs

@@ -214,9 +214,9 @@ export function readPosts(root, { games = [], songs = [], videos = [], log = ()
 
 export const PARTIALS = ['head', 'header', 'footer', 'home', 'game', 'post'];
 /** Paths a page of the studio's own can never take: the rooms, the game files, the API and the owner's pages. */
-const RESERVED_PAGE = /^\/(?:api|_studio|_homie|_site|media|\.well-known|games\/[^/]+)\/|^\/[a-z0-9][a-z0-9-]{0,39}\/(?:play|tv|live|api|__[a-z]+)(?:\/|$)/;
+const RESERVED_PAGE = /^\/(?:api|account|_studio|_homie|_site|media|\.well-known|games\/[^/]+)\/|^\/[a-z0-9][a-z0-9-]{0,39}\/(?:play|tv|live|api|__[a-z]+)(?:\/|$)/;
 /** Top-level names site/public must not take (the build's own output). */
-const RESERVED_PUBLIC = new Set(['games', 'music', 'videos', 'games.json', '_site', '_homie', '_studio', 'api', 'media']);
+const RESERVED_PUBLIC = new Set(['games', 'music', 'videos', 'games.json', '_site', '_homie', '_studio', 'api', 'media', 'account']);
 
 function walk(dir, fn, rel = '') {
   for (const e of readdirSync(join(dir, rel), { withFileTypes: true })) {

package/lib/stats.mjs

@@ -21,9 +21,9 @@ const HOUR = 3600_000;
 const RANGES = new Set(['1d', '7d', '30d', '90d']);
 const SLUG = /^[a-z0-9][a-z0-9-]{0,39}$/;
 
-const loopback = (url) => { try { return ['127.0.0.1', 'localhost', '[::1]'].includes(new URL(url).hostname); } catch { return false; } };
+export const loopback = (url) => { try { return ['127.0.0.1', 'localhost', '[::1]'].includes(new URL(url).hostname); } catch { return false; } };
 
-function siteOf(root, url) {
+export function siteOf(root, url) {
   const studio = readStudio(root);
   const site = String(url || siteUrl(root, studio) || '').replace(/\/+$/, '');
   if (!/^https?:\/\//.test(site)) return { studio, site: null };
@@ -31,7 +31,7 @@ function siteOf(root, url) {
 }
 
 /** Put a key's hash into the studio's D1 (remote, or local for a loopback site). The key never leaves this machine. */
-function mint(root, studio, kind, ttlMs, { local }) {
+export function mint(root, studio, kind, ttlMs, { local }) {
   const key = `hsk_${randomBytes(24).toString('hex')}`;
   const hash = createHash('sha256').update(key).digest('hex');
   const now = Date.now();

package/lib/studio.mjs

@@ -8,7 +8,7 @@ import { fileURLToPath } from 'node:url';
 
 export const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 export const GAME_ID = /^[a-z0-9][a-z0-9-]{0,39}$/;
-const RESERVED_IDS = new Set(['api', 'media', 'games', 'assets', '_homie', '_site', '_studio', 'well-known', 'index', 'play', 'studio', 'studios', 'music', 'videos', 'posts', 'rooms', 'feed']);
+const RESERVED_IDS = new Set(['api', 'media', 'games', 'assets', '_homie', '_site', '_studio', 'well-known', 'index', 'play', 'studio', 'studios', 'music', 'videos', 'posts', 'rooms', 'feed', 'account']);
 
 export function findStudio(from = process.cwd()) {
   let at = resolve(from);

package/lib/template-history.json

@@ -199,6 +199,30 @@
      "## Beta": "9d02638207a26e73"
     }
    }
+  },
+  "0.12.0": {
+   "files": {
+    "CLAUDE.md": "ddf2b2a0376202f6",
+    "README.md": "684b3cca8001673c",
+    "games/README.md": "5e5e942baa7e0372",
+    "music/README.md": "b8a828de9311bd28",
+    "videos/README.md": "70614388cbb203c7",
+    "posts/README.md": "37841aae476bd540",
+    "site/README.md": "ca131cd0472464fb",
+    "site/src/worker.mjs": "ca3f1630f2420ad3"
+   },
+   "sections": {
+    "AGENTS.md": {
+     "(intro)": "214aa46eb3a895d5",
+     "## Layout": "f14d641159480e6c",
+     "## Commands (all through the pinned CLI in node_modules)": "3a3d3bef7e8d1a50",
+     "## The site": "7d3525ba39b7f262",
+     "## Making games": "63069b31c87a2aa2",
+     "## The Game Codex and progress": "0738ef719cef3a4c",
+     "## Rules": "969318425c99f5a5",
+     "## Beta": "9d02638207a26e73"
+    }
+   }
   }
  }
 }

package/netplay/NETPLAY.md

@@ -194,6 +194,11 @@ it.
 - If the old host does not return, the relay elects someone else. That browser restores
   from the stored checkpoint (at most 30 s old) and from its own newest snapshot.
 
+**What a room is not.** A room forgets everything 60 s after its last player leaves (`forgetMs`). Progress that
+must last (a character, unlocks, days of play) is the player's, not the room's: it goes in cloud saves
+(`@homie-rocks/studio/saves`, `../saves/SAVES.md`). The host decides what happened and tells that player's own
+browser (an `ev` to its seat); only that browser changes and saves the player's progress.
+
 ## 5. Wire protocol v1
 
 - **Transport:** one WebSocket per game document, carrying JSON text frames

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homie-rocks/studio",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "A studio for games, music and video on its own Cloudflare: scaffold, multiplayer starters on the netplay contract, a port toolkit that makes existing single-player web games multiplayer, the site Worker with public rooms (Table/Lobby Durable Objects and D1, all on the free Workers plan, no payment method), a site with the hub's sections (Home, Games, Music, Videos, Rooms, Posts with feeds) in the studio's own look, an epic landing page for every game, optional R2 storage for large media, deploy, and the homie.rocks directory.",
   "type": "module",
   "license": "Apache-2.0",
@@ -26,6 +26,10 @@
       "types": "./port/early.ts",
       "default": "./port/early.ts"
     },
+    "./saves": {
+      "types": "./saves/saves.ts",
+      "default": "./saves/saves.ts"
+    },
     "./worker": "./worker/index.mjs",
     "./package.json": "./package.json"
   },
@@ -35,6 +39,7 @@
     "netplay/",
     "port/",
     "worker/",
+    "saves/",
     "starters/",
     "media/",
     "site/",

package/port/index.ts

@@ -12,6 +12,7 @@
  *   createHud    a minimal clock / scores / results overlay
  *   BotBrain, seek, nearest, rubberBand
  *                bot scaffolds
+ *   createSaves  player accounts and cloud saves (a character that lasts days, on every device; saves/SAVES.md)
  * and everything from @homie-rocks/studio/netplay.
  */
 import './early';
@@ -27,3 +28,4 @@ export { exposePort, type PortProbeOptions, type View } from './probe';
 export { createRoom, type Room, type RoomOptions, type BodyBase, type RoomSnap, type RoomCkpt } from './room';
 export { createHud, type HudOptions } from './hud';
 export { BotBrain, seek, flee, wanderer, nearest, rubberBand, protectedNewcomer, type V2 } from './bots';
+export { createSaves, SAVES_VERSION, type Saves, type SavesOptions, type Player, type SaveEntry, type SetResult, type Memorial, type SavesStatus, type Conflict } from '../saves/saves';

package/port/keys.ts

@@ -75,6 +75,9 @@ export function createKeys(target: Window | HTMLElement = window): Keys {
   const edges = new Set<string>();
   const kd = (e: Event): void => {
     const k = e as KeyboardEvent;
+    // A key typed into the game's own text box (a hero's name, a chat line) is a word, never a move.
+    const el = k.target as HTMLElement | null;
+    if (el && (el.isContentEditable || /^(INPUT|TEXTAREA|SELECT)$/.test(el.tagName ?? ''))) return;
     if (['ArrowUp', 'ArrowDown', 'ArrowLeft', 'ArrowRight', 'Space'].includes(k.code)) k.preventDefault();
     if (!held.has(k.code)) edges.add(k.code);
     held.add(k.code);