@homie-rocks/studio 0.11.0 → 0.12.0

package/worker/saves.mjs

@@ -0,0 +1,287 @@
+/**
+ * CLOUD SAVES, LIFETIME STATS AND MEMORIALS — per player, per game, in the studio's own D1 (saves/SAVES.md).
+ *
+ *   saves         key → JSON value, versioned (every write adds one), per player and game. A write may name the
+ *                 version it was based on (`base`): if another device wrote in between, it is refused with the
+ *                 current value (a conflict), so a stale offline copy never overwrites newer progress silently.
+ *   player_stats  numbers that only add up (or keep the highest or lowest) and survive a wipe: time played, gold
+ *                 earned, kills, best level. A hardcore death wipes the saves and keeps these.
+ *   memorials     the hall of the fallen: a character's name, the player's display name and a small summary,
+ *                 written when a hardcore character dies (optionally wiping that game's saves in the same step).
+ *
+ * LIMITS (SAVE_LIMITS): 64 KiB a value, 64 keys and 256 KiB a game per player in D1. With the studio's storage (R2,
+ * `homie-studio storage add`) a value up to 1 MiB goes to R2 instead (4 MiB a game per player), under a random
+ * object key that the public /media/ route refuses. Keys are 1 to 64 of A-Z a-z 0-9 _ . : -.
+ * A write is atomic per key, not across keys: keep a character in ONE key.
+ */
+import { randomToken } from './webauthn.mjs';
+
+export const SAVE_LIMITS = Object.freeze({
+  valueBytes: 64 * 1024, gameBytes: 256 * 1024, keys: 64, batch: 32,
+  blobBytes: 1024 * 1024, gameBlobBytes: 4 * 1024 * 1024,
+  stats: 64, memorialBytes: 2048, memorialsPerDay: 20, fallenList: 50,
+});
+export const SAVE_KEY = /^[A-Za-z0-9_.:-]{1,64}$/;
+export const STAT_NAME = /^[A-Za-z0-9_.:-]{1,32}$/;
+const BLOB = /^r2:(players\/[A-Za-z0-9_-]{16,64})$/;
+const ENC = new TextEncoder();
+const bytesOf = (text) => ENC.encode(text).length;
+
+/** The R2 object a blob row points at, or null for a value kept in D1. */
+const blobKey = (row) => (row && Number(row.blob) === 1 ? BLOB.exec(String(row.value))?.[1] ?? null : null);
+
+async function valueOf(env, row) {
+  const key = blobKey(row);
+  if (!key) { try { return JSON.parse(row.value); } catch { return null; } }
+  if (!env.MEDIA) return null;
+  const obj = await env.MEDIA.get(key);
+  if (!obj) return null;
+  try { return JSON.parse(await obj.text()); } catch { return null; }
+}
+
+async function dropBlobs(env, keys) {
+  const list = keys.filter(Boolean);
+  if (!list.length || !env.MEDIA) return;
+  try { await env.MEDIA.delete(list); } catch { /* a missing object is already gone */ }
+}
+
+/** Every key of one player's game, with its version and size; `values` adds each value. */
+export async function listSaves(env, player, game, { values = false } = {}) {
+  const rows = (await env.DB.prepare('SELECT key, value, bytes, version, updated_at, blob FROM saves WHERE player = ?1 AND game = ?2 ORDER BY key LIMIT 200').bind(player, game).all()).results ?? [];
+  const keys = [];
+  for (const r of rows) {
+    const k = { key: r.key, version: Number(r.version), bytes: Number(r.bytes), updatedAt: Number(r.updated_at) };
+    if (values) k.value = await valueOf(env, r);
+    keys.push(k);
+  }
+  return { keys, used: usage(rows) };
+}
+
+function usage(rows) {
+  let bytes = 0; let blobBytes = 0;
+  for (const r of rows) { if (Number(r.blob) === 1) blobBytes += Number(r.bytes); else bytes += Number(r.bytes); }
+  return { keys: rows.length, bytes, blobBytes };
+}
+
+export async function getSave(env, player, game, key) {
+  if (!SAVE_KEY.test(String(key))) return { ok: false, error: 'key', message: 'a save key is 1 to 64 letters, digits, _ . : or -' };
+  const row = await env.DB.prepare('SELECT value, bytes, version, updated_at, blob FROM saves WHERE player = ?1 AND game = ?2 AND key = ?3').bind(player, game, key).first();
+  if (!row) return { ok: true, key, value: null, version: 0, updatedAt: null };
+  return { ok: true, key, value: await valueOf(env, row), version: Number(row.version), updatedAt: Number(row.updated_at) };
+}
+
+/**
+ * Write and delete keys of one player's game. Each item: { key, value, base? } to set, { key, base? } to delete.
+ * `base` is the version the change was made from (0: the key did not exist); without it the write is
+ * unconditional. Returns one result per item: { key, ok: true, version } or { key, ok: false, error, current? }.
+ */
+export async function writeSaves(env, player, game, { set = [], del = [] } = {}) {
+  const items = [...(Array.isArray(set) ? set : []).map((s) => ({ ...s, op: 'set' })), ...(Array.isArray(del) ? del : []).map((s) => ({ ...s, op: 'del' }))];
+  if (!items.length) return { ok: true, results: [] };
+  if (items.length > SAVE_LIMITS.batch) return { ok: false, error: 'batch', message: `at most ${SAVE_LIMITS.batch} keys in one write` };
+  const rows = (await env.DB.prepare('SELECT key, value, bytes, version, blob FROM saves WHERE player = ?1 AND game = ?2').bind(player, game).all()).results ?? [];
+  const now = new Map(rows.map((r) => [r.key, r]));
+  const results = [];
+  const at = Date.now();
+  for (const item of items) {
+    const key = String(item?.key ?? '');
+    if (!SAVE_KEY.test(key)) { results.push({ key, ok: false, error: 'key', message: 'a save key is 1 to 64 letters, digits, _ . : or -' }); continue; }
+    const base = item.base === undefined || item.base === null ? null : Math.floor(Number(item.base));
+    if (base !== null && !(base >= 0)) { results.push({ key, ok: false, error: 'base', message: 'base is the version the change was made from (0 when the key is new)' }); continue; }
+    const prev = now.get(key) ?? null;
+    if (base !== null && (prev ? Number(prev.version) : 0) !== base) {
+      results.push({ key, ok: false, error: 'conflict', message: 'another device saved this key since', current: prev ? { value: await valueOf(env, prev), version: Number(prev.version) } : { value: null, version: 0 } });
+      continue;
+    }
+    if (item.op === 'del') {
+      if (!prev) { results.push({ key, ok: true, version: 0 }); continue; }
+      const gone = await env.DB.prepare('DELETE FROM saves WHERE player = ?1 AND game = ?2 AND key = ?3 AND version = ?4 RETURNING version').bind(player, game, key, Number(prev.version)).first();
+      if (!gone) { results.push({ key, ok: false, error: 'conflict', message: 'another device saved this key since' }); continue; }
+      await dropBlobs(env, [blobKey(prev)]);
+      now.delete(key);
+      results.push({ key, ok: true, version: 0 });
+      continue;
+    }
+    if (item.value === undefined) { results.push({ key, ok: false, error: 'value', message: 'a save needs a value (null is a value; use del to remove a key)' }); continue; }
+    let text;
+    try { text = JSON.stringify(item.value); } catch { results.push({ key, ok: false, error: 'value', message: 'a save is JSON' }); continue; }
+    const size = bytesOf(text);
+    const others = [...now.values()].filter((r) => r.key !== key);
+    const used = usage(others);
+    if (!prev && others.length >= SAVE_LIMITS.keys) { results.push({ key, ok: false, error: 'too-many-keys', message: `a game keeps at most ${SAVE_LIMITS.keys} keys per player` }); continue; }
+    let stored = text; let blob = 0; let newObject = null;
+    if (size > SAVE_LIMITS.valueBytes) {
+      if (!env.MEDIA) { results.push({ key, ok: false, error: 'too-large', message: `a save is at most ${SAVE_LIMITS.valueBytes / 1024} KiB (this studio has no storage for larger ones)` }); continue; }
+      if (size > SAVE_LIMITS.blobBytes) { results.push({ key, ok: false, error: 'too-large', message: `a save is at most ${SAVE_LIMITS.blobBytes / 1024} KiB` }); continue; }
+      if (used.blobBytes + size > SAVE_LIMITS.gameBlobBytes) { results.push({ key, ok: false, error: 'full', message: `a game keeps at most ${SAVE_LIMITS.gameBlobBytes / 1048576} MiB of large saves per player` }); continue; }
+      newObject = `players/${randomToken(24)}`;
+      await env.MEDIA.put(newObject, text, { httpMetadata: { contentType: 'application/json' } });
+      stored = `r2:${newObject}`; blob = 1;
+    } else if (used.bytes + size > SAVE_LIMITS.gameBytes) {
+      results.push({ key, ok: false, error: 'full', message: `a game keeps at most ${SAVE_LIMITS.gameBytes / 1024} KiB of saves per player` });
+      continue;
+    }
+    let row;
+    if (base === null) {
+      row = await env.DB.prepare('INSERT INTO saves (player, game, key, value, bytes, version, updated_at, blob) VALUES (?1, ?2, ?3, ?4, ?5, 1, ?6, ?7) ON CONFLICT(player, game, key) DO UPDATE SET value = excluded.value, bytes = excluded.bytes, version = saves.version + 1, updated_at = excluded.updated_at, blob = excluded.blob RETURNING version')
+        .bind(player, game, key, stored, size, at, blob).first();
+    } else if (base === 0) {
+      row = await env.DB.prepare('INSERT INTO saves (player, game, key, value, bytes, version, updated_at, blob) VALUES (?1, ?2, ?3, ?4, ?5, 1, ?6, ?7) ON CONFLICT(player, game, key) DO NOTHING RETURNING version')
+        .bind(player, game, key, stored, size, at, blob).first();
+    } else {
+      row = await env.DB.prepare('UPDATE saves SET value = ?4, bytes = ?5, version = version + 1, updated_at = ?6, blob = ?7 WHERE player = ?1 AND game = ?2 AND key = ?3 AND version = ?8 RETURNING version')
+        .bind(player, game, key, stored, size, at, blob, base).first();
+    }
+    if (!row) {
+      await dropBlobs(env, [newObject]);
+      results.push({ key, ok: false, error: 'conflict', message: 'another device saved this key since' });
+      continue;
+    }
+    if (prev) await dropBlobs(env, [blobKey(prev)]);
+    now.set(key, { key, value: stored, bytes: size, version: Number(row.version), blob });
+    results.push({ key, ok: true, version: Number(row.version) });
+  }
+  return { ok: true, results, used: usage([...now.values()]) };
+}
+
+/** Every save of one player's game, except the `keep` keys: a hardcore death, or "new game". */
+export function wipeStatements(env, player, game, keep = []) {
+  const kept = (Array.isArray(keep) ? keep : []).filter((k) => SAVE_KEY.test(String(k))).slice(0, SAVE_LIMITS.keys);
+  const marks = kept.map((_, i) => `?${i + 3}`).join(', ');
+  return env.DB.prepare(`DELETE FROM saves WHERE player = ?1 AND game = ?2${kept.length ? ` AND key NOT IN (${marks})` : ''} RETURNING key, value, blob`).bind(player, game, ...kept);
+}
+
+export async function wipeSaves(env, player, game, { keep = [] } = {}) {
+  const gone = (await wipeStatements(env, player, game, keep).all()).results ?? [];
+  await dropBlobs(env, gone.map(blobKey));
+  return { ok: true, wiped: gone.map((r) => r.key) };
+}
+
+/* ------------------------------------------------------------------ lifetime stats */
+
+export async function readPlayerStats(env, player, game) {
+  const rows = (await env.DB.prepare('SELECT name, n FROM player_stats WHERE player = ?1 AND game = ?2 ORDER BY name LIMIT 100').bind(player, game).all()).results ?? [];
+  return Object.fromEntries(rows.map((r) => [r.name, Number(r.n)]));
+}
+
+/**
+ * Add to counters (`add`), keep the highest (`max`) or the lowest (`min`): { add: { kills: 1 }, max: { level: 7 } }.
+ * Numbers only, finite, |n| < 1e15. They never go back on their own: a wipe keeps them.
+ */
+export async function bumpPlayerStats(env, player, game, { add = {}, max = {}, min = {} } = {}) {
+  const ops = [];
+  for (const [kind, obj] of [['add', add], ['max', max], ['min', min]]) {
+    if (!obj || typeof obj !== 'object' || Array.isArray(obj)) continue;
+    for (const [name, raw] of Object.entries(obj)) {
+      const n = Number(raw);
+      if (!STAT_NAME.test(name)) return { ok: false, error: 'stat', message: `a stat name is 1 to 32 letters, digits, _ . : or - (got ${JSON.stringify(String(name).slice(0, 40))})` };
+      if (!Number.isFinite(n) || Math.abs(n) >= 1e15) return { ok: false, error: 'stat', message: `${name} is not a number a stat can hold` };
+      if (kind === 'add' && n === 0) continue;
+      ops.push({ kind, name, n });
+    }
+  }
+  if (ops.length > SAVE_LIMITS.stats) return { ok: false, error: 'stat', message: `at most ${SAVE_LIMITS.stats} stats at once` };
+  if (!ops.length) return { ok: true, stats: await readPlayerStats(env, player, game) };
+  const have = await readPlayerStats(env, player, game);
+  const fresh = new Set(ops.map((o) => o.name).filter((name) => !(name in have)));
+  if (Object.keys(have).length + fresh.size > SAVE_LIMITS.stats) return { ok: false, error: 'stat', message: `a game keeps at most ${SAVE_LIMITS.stats} stats per player` };
+  const at = Date.now();
+  const sql = {
+    add: 'INSERT INTO player_stats (player, game, name, n, updated_at) VALUES (?1, ?2, ?3, ?4, ?5) ON CONFLICT(player, game, name) DO UPDATE SET n = player_stats.n + excluded.n, updated_at = excluded.updated_at',
+    max: 'INSERT INTO player_stats (player, game, name, n, updated_at) VALUES (?1, ?2, ?3, ?4, ?5) ON CONFLICT(player, game, name) DO UPDATE SET n = max(player_stats.n, excluded.n), updated_at = excluded.updated_at',
+    min: 'INSERT INTO player_stats (player, game, name, n, updated_at) VALUES (?1, ?2, ?3, ?4, ?5) ON CONFLICT(player, game, name) DO UPDATE SET n = min(player_stats.n, excluded.n), updated_at = excluded.updated_at',
+  };
+  await env.DB.batch(ops.map((o) => env.DB.prepare(sql[o.kind]).bind(player, game, o.name, o.n, at)));
+  return { ok: true, stats: await readPlayerStats(env, player, game) };
+}
+
+/* ------------------------------------------------------------------ the hall of the fallen */
+
+/**
+ * A memorial: { character, summary, wipe, keep }. `character` follows the display-name rules (the caller cleans
+ * it); `summary` is a small JSON object (level, cause, gold, days survived…), 2 KiB at most. `wipe: true` deletes
+ * this game's saves (except `keep`) in the SAME transaction, so a death and its wipe can never half-happen.
+ */
+export async function fall(env, player, playerName, game, { character, summary = {}, wipe = false, keep = [] }) {
+  if (summary === null || typeof summary !== 'object' || Array.isArray(summary)) return { ok: false, error: 'summary', message: 'a memorial summary is a JSON object' };
+  const text = JSON.stringify(summary);
+  if (bytesOf(text) > SAVE_LIMITS.memorialBytes) return { ok: false, error: 'too-large', message: `a memorial summary is at most ${SAVE_LIMITS.memorialBytes} bytes` };
+  const at = Date.now();
+  const today = await env.DB.prepare('SELECT COUNT(*) AS n FROM memorials WHERE player = ?1 AND game = ?2 AND at >= ?3').bind(player, game, at - 86400_000).first();
+  if (Number(today?.n) >= SAVE_LIMITS.memorialsPerDay) return { ok: false, error: 'rate', message: `at most ${SAVE_LIMITS.memorialsPerDay} memorials a day per player` };
+  const insert = env.DB.prepare('INSERT INTO memorials (player, game, character, player_name, summary, at) VALUES (?1, ?2, ?3, ?4, ?5, ?6) RETURNING id').bind(player, game, character, playerName, text, at);
+  const [made, wiped] = await env.DB.batch(wipe ? [insert, wipeStatements(env, player, game, keep)] : [insert]);
+  const gone = wiped?.results ?? [];
+  await dropBlobs(env, gone.map(blobKey));
+  return { ok: true, memorial: { id: Number(made?.results?.[0]?.id ?? 0), character, player: playerName, summary, at }, wiped: gone.map((r) => r.key) };
+}
+
+/** The newest memorials of a game (everyone's), or one player's own: { character, player, summary, at }. */
+export async function fallenList(env, game, { limit = 20, player = null } = {}) {
+  const n = Math.max(1, Math.min(SAVE_LIMITS.fallenList, Math.floor(Number(limit)) || 20));
+  const rows = (await (player
+    ? env.DB.prepare('SELECT character, player_name, summary, at FROM memorials WHERE game = ?1 AND player = ?2 ORDER BY at DESC LIMIT ?3').bind(game, player, n)
+    : env.DB.prepare('SELECT character, player_name, summary, at FROM memorials WHERE game = ?1 ORDER BY at DESC LIMIT ?2').bind(game, n)).all()).results ?? [];
+  return rows.map((r) => {
+    let summary = {};
+    try { summary = JSON.parse(r.summary); } catch { summary = {}; }
+    return { character: r.character, player: r.player_name, summary, at: Number(r.at) };
+  });
+}
+
+/* ------------------------------------------------------------------ a player's whole data */
+
+/** Everything this player has in every game, for their export (values included, large ones from R2). */
+export async function playerData(env, player) {
+  const rows = (await env.DB.prepare('SELECT game, key, value, bytes, version, updated_at, blob FROM saves WHERE player = ?1 ORDER BY game, key').bind(player).all()).results ?? [];
+  const stats = (await env.DB.prepare('SELECT game, name, n, updated_at FROM player_stats WHERE player = ?1 ORDER BY game, name').bind(player).all()).results ?? [];
+  const mem = (await env.DB.prepare('SELECT game, character, player_name, summary, at FROM memorials WHERE player = ?1 ORDER BY at').bind(player).all()).results ?? [];
+  const games = {};
+  const of = (g) => (games[g] ??= { saves: {}, stats: {}, memorials: [] });
+  for (const r of rows) of(r.game).saves[r.key] = { value: await valueOf(env, r), version: Number(r.version), updatedAt: new Date(Number(r.updated_at)).toISOString() };
+  for (const s of stats) of(s.game).stats[s.name] = Number(s.n);
+  for (const m of mem) {
+    let summary = {};
+    try { summary = JSON.parse(m.summary); } catch { summary = {}; }
+    of(m.game).memorials.push({ character: m.character, as: m.player_name, summary, at: new Date(Number(m.at)).toISOString() });
+  }
+  return games;
+}
+
+/** Per game: keys, bytes and the last write, for the owner's view of a player (never the values). */
+export async function savesSummary(env, player) {
+  const rows = (await env.DB.prepare('SELECT game, COUNT(*) AS keys, SUM(bytes) AS bytes, MAX(updated_at) AS at FROM saves WHERE player = ?1 GROUP BY game').bind(player).all()).results ?? [];
+  return rows.map((r) => ({ game: r.game, keys: Number(r.keys), bytes: Number(r.bytes) || 0, updatedAt: Number(r.at) || null }));
+}
+
+/** The statements that delete a player's saves, stats and memorials (and their large saves' objects, after). */
+export async function dropPlayerData(env, player) {
+  const blobs = (await env.DB.prepare('SELECT value, blob FROM saves WHERE player = ?1 AND blob = 1').bind(player).all()).results ?? [];
+  return {
+    statements: [
+      env.DB.prepare('DELETE FROM saves WHERE player = ?1').bind(player),
+      env.DB.prepare('DELETE FROM player_stats WHERE player = ?1').bind(player),
+      env.DB.prepare('DELETE FROM memorials WHERE player = ?1').bind(player),
+    ],
+    after: () => dropBlobs(env, blobs.map(blobKey)),
+  };
+}
+
+/**
+ * A guest signs in to an account they already have: the account keeps what it has, and whatever only the guest
+ * had moves over (saves of keys the account lacks, stats it lacks, the guest's memorials). Statements for one
+ * batch, and the guest's large saves that the account already had (to drop after).
+ */
+export async function adoptStatements(env, from, to) {
+  const clash = (await env.DB.prepare('SELECT g.value, g.blob FROM saves g JOIN saves a ON a.player = ?2 AND a.game = g.game AND a.key = g.key WHERE g.player = ?1 AND g.blob = 1').bind(from, to).all()).results ?? [];
+  return {
+    statements: [
+      env.DB.prepare('INSERT OR IGNORE INTO saves (player, game, key, value, bytes, version, updated_at, blob) SELECT ?2, game, key, value, bytes, version, updated_at, blob FROM saves WHERE player = ?1').bind(from, to),
+      env.DB.prepare('INSERT OR IGNORE INTO player_stats (player, game, name, n, updated_at) SELECT ?2, game, name, n, updated_at FROM player_stats WHERE player = ?1').bind(from, to),
+      env.DB.prepare('UPDATE memorials SET player = ?2 WHERE player = ?1').bind(from, to),
+      env.DB.prepare('DELETE FROM saves WHERE player = ?1').bind(from),
+      env.DB.prepare('DELETE FROM player_stats WHERE player = ?1').bind(from),
+    ],
+    after: () => dropBlobs(env, clash.map(blobKey)),
+  };
+}

package/worker/site.mjs

@@ -912,7 +912,7 @@ export function gameLanding(cat, g, { origin = '', rooms = [], playing = 0, week
       <a class="play" href="/${esc(g.id)}/play" data-play>${PLAY_ICON}<span>Play now — free</span></a>
       ${liveLine(g, playing, { idle: `Bots hold every empty seat · one tap and you are in` })}
     </div>
-    ${tvOn ? `<a class="also" href="#anywhere">${icon('tv')}<span>Or put it on the big screen</span></a>` : ''}${trailer ? `<a class="also" href="/videos/${esc(trailer.slug)}/">${icon('videos')}<span>Watch the trailer</span></a>` : ''}
+    ${tvOn ? `<a class="also" href="#anywhere">${icon('tv')}<span>Or put it on the big screen</span></a>` : ''}${trailer ? `<a class="also" href="/videos/${esc(trailer.slug)}/">${icon('videos')}<span>Watch the trailer</span></a>` : ''}${g.saves ? `<a class="also" href="/account/?next=${encodeURIComponent(`/${g.id}/play`)}" data-account>${icon('spark')}<span>Your progress follows you: sign in</span></a>` : ''}
   </div>
 </section>`;
 

package/worker/stats-page.mjs

@@ -106,6 +106,7 @@ function statsBody(cat, s, url) {
 ${tile(t.visits, 'visits')}${tile(t.plays, 'Play presses')}${tile(t.rooms, 'rooms opened')}${tile(t.rounds, 'rounds finished')}
 ${tile(t.peopleInRounds, 'people in finished rounds')}${tile(t.peakPlayers, 'most playing at once')}${tile(t.playingNow, 'playing right now', t.playingNow ? 'live' : '')}
 ${tile(t.songPlays, 'songs played')}${tile(t.videoViews, 'videos watched')}
+${s.players && (s.players.accounts || s.players.guests) ? `${tile(s.players.accounts, 'player accounts')}${tile(s.players.guests, 'guests with saves')}${tile(s.players.active7d, 'players this week')}` : ''}
 </section>
 <h2>Every day</h2><div class="bars" role="img" aria-label="visits and plays per day">${bars}</div>
 <h2>Games</h2><div class="scroll"><table class="wide"><thead><tr><th>Game</th><th>Visits</th><th>Plays</th><th>Rooms</th><th>Rounds</th><th>People in rounds</th><th>Peak</th><th>Peak in a room</th><th>Now</th></tr></thead><tbody>${gameRows || '<tr><td colspan="9" class="dim">No games.</td></tr>'}</tbody></table></div>

package/worker/stats.mjs

@@ -200,6 +200,19 @@ export function rangeOf(params, now = Date.now()) {
   return { from: dayOffset(end, -(days - 1)), to: end, days };
 }
 
+/**
+ * Player accounts (0.12.0, worker/players.mjs): how many, never who. Null before migration 0004 or with no D1.
+ * `accounts` have a passkey; `guests` saved something without one; `active7d` played in the last 7 days.
+ */
+export async function playersNow(env) {
+  if (!env?.DB) return null;
+  const now = Date.now();
+  try {
+    const r = await env.DB.prepare('SELECT SUM(guest = 0) AS accounts, SUM(guest = 1) AS guests, SUM(guest = 0 AND created_at >= ?1) AS new7d, SUM(seen_at >= ?1) AS active7d FROM players').bind(now - 7 * 86400_000).first();
+    return { accounts: Number(r?.accounts) || 0, guests: Number(r?.guests) || 0, newAccounts7d: Number(r?.new7d) || 0, active7d: Number(r?.active7d) || 0 };
+  } catch { return null; }
+}
+
 /** The Lobby's count of people in every room of each game, right now. */
 async function playingNow(env, games) {
   const out = {};
@@ -243,7 +256,7 @@ export async function readStats(env, cat, { range, only = null, studios = new Se
   const scoped = rows.filter(inScope);
   const sum = (pred) => scoped.reduce((n, r) => n + (pred(r) ? Number(r.n) : 0), 0);
   const maxOf = (pred) => scoped.reduce((n, r) => Math.max(n, pred(r) ? Number(r.n) : 0), 0);
-  const now = await playingNow(env, games);
+  const [now, people] = await Promise.all([playingNow(env, games), only ? null : playersNow(env)]);
   const perGame = games.map((g) => {
     const of = (m, extra = () => true) => sum((r) => r.metric === m && r.subject === g.id && extra(r));
     return {
@@ -282,6 +295,8 @@ export async function readStats(env, cat, { range, only = null, studios = new Se
       peakPlayers: Math.max(0, ...perGame.map((g) => g.peakPlayers)), peakInOneRoom: Math.max(0, ...perGame.map((g) => g.peakInOneRoom)),
       playingNow: perGame.reduce((n, g) => n + g.playingNow, 0),
     },
+    // Player accounts (saves/SAVES.md): counts only, never a name, a passkey or an email.
+    ...(people ? { players: people } : {}),
     crossings: { fromHub: byKind('hub'), fromStudios: byKind('studio'), fromSearch: byKind('search'), fromWeb: byKind('web'), fromLinks: byKind('link') },
     // The studio's own pages: its home, and the /music/ and /videos/ lists (a catalogue's road).
     pages: Object.fromEntries(['home', 'games', 'rooms', 'posts', 'music', 'videos'].map((p) => [p, sum((r) => r.metric === 'visit' && r.subject === p)])),

package/worker/version.mjs

@@ -1,2 +1,2 @@
 /** The @homie-rocks/studio version this Worker code is (package.json's; a test keeps them equal). Cache-busts /_homie/site.js. */
-export const STUDIO_VERSION_TAG = '0.11.0';
+export const STUDIO_VERSION_TAG = '0.12.0';

package/worker/webauthn.mjs

@@ -0,0 +1,259 @@
+/**
+ * PASSKEYS (WebAuthn), verified in the studio's own Worker with WebCrypto and nothing else.
+ *
+ * What arrives from a browser is a PUBLIC key and signatures: worthless to anyone who copies them. The private key
+ * never leaves the player's device (or its own sync: iCloud Keychain, Google Password Manager, a password manager).
+ *
+ * Checked on every ceremony (each check is a refusal somebody could otherwise walk through):
+ *   - clientData.type is the ceremony that was asked for (a registration cannot be replayed as a sign-in);
+ *   - clientData.challenge is one this site issued and has not spent (the caller passes it);
+ *   - clientData.origin is this site (an https origin, or a loopback one for `homie-studio dev`);
+ *   - the authenticator data's rpIdHash is SHA-256 of this site's host name;
+ *   - the user-present flag is set (somebody touched or looked at the device);
+ *   - on sign-in, the signature over authenticatorData || SHA-256(clientDataJSON) verifies against the stored key,
+ *     and the signature counter did not go backwards (a counter that moves back is a cloned authenticator; one
+ *     that is always 0 is normal, for synced passkeys).
+ * Not checked, on purpose: attestation. Registration asks for `none`: a game studio has no reason to care which
+ * brand of authenticator a player holds, and refusing some would lock real people out.
+ *
+ * Keys: ES256 (COSE -7, P-256) and RS256 (COSE -257), stored as a JWK. A tiny CBOR reader takes what an
+ * attestation object and a COSE key contain (integers, byte and text strings, arrays, maps) and refuses the rest.
+ */
+
+const ENC = new TextEncoder();
+const DEC = new TextDecoder();
+
+export function b64urlToBytes(text) {
+  const s = String(text ?? '');
+  if (!/^[A-Za-z0-9_-]*$/.test(s)) throw new Error('base64url');
+  const b64 = s.replace(/-/g, '+').replace(/_/g, '/');
+  const bin = atob(b64 + '='.repeat((4 - (b64.length % 4)) % 4));
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i += 1) out[i] = bin.charCodeAt(i);
+  return out;
+}
+
+export function bytesToB64url(bytes) {
+  let bin = '';
+  for (const b of bytes) bin += String.fromCharCode(b);
+  return btoa(bin).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+
+export function randomToken(bytes = 32) {
+  const raw = new Uint8Array(bytes);
+  crypto.getRandomValues(raw);
+  return bytesToB64url(raw);
+}
+
+export async function sha256(input) {
+  const bytes = typeof input === 'string' ? ENC.encode(input) : input;
+  return new Uint8Array(await crypto.subtle.digest('SHA-256', bytes));
+}
+
+export async function sha256Hex(text) {
+  return [...await sha256(text)].map((b) => b.toString(16).padStart(2, '0')).join('');
+}
+
+/** Equal bytes, in time that does not depend on where they differ. */
+export function sameBytes(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i += 1) diff |= a[i] ^ b[i];
+  return diff === 0;
+}
+
+/* ------------------------------------------------------------------ CBOR (just enough) */
+
+export function cborDecode(bytes, at = 0, depth = 0) {
+  if (depth > 8) throw new Error('cbor-deep');
+  if (at >= bytes.length) throw new Error('cbor-short');
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  const head = bytes[at];
+  const major = head >> 5;
+  const minor = head & 31;
+  let n = minor;
+  let p = at + 1;
+  if (minor === 24) { n = bytes[p]; p += 1; }
+  else if (minor === 25) { n = view.getUint16(p); p += 2; }
+  else if (minor === 26) { n = view.getUint32(p); p += 4; }
+  else if (minor >= 27) throw new Error('cbor-unsupported-length');
+  if (p > bytes.length) throw new Error('cbor-short');
+  switch (major) {
+    case 0: return [n, p];
+    case 1: return [-1 - n, p];
+    case 2: if (p + n > bytes.length) throw new Error('cbor-short'); return [bytes.subarray(p, p + n), p + n];
+    case 3: if (p + n > bytes.length) throw new Error('cbor-short'); return [DEC.decode(bytes.subarray(p, p + n)), p + n];
+    case 4: {
+      if (n > 64) throw new Error('cbor-big');
+      const list = [];
+      for (let i = 0; i < n; i += 1) { const [v, q] = cborDecode(bytes, p, depth + 1); list.push(v); p = q; }
+      return [list, p];
+    }
+    case 5: {
+      if (n > 64) throw new Error('cbor-big');
+      const map = new Map();
+      for (let i = 0; i < n; i += 1) {
+        const [k, q] = cborDecode(bytes, p, depth + 1);
+        const [v, r] = cborDecode(bytes, q, depth + 1);
+        map.set(k, v);
+        p = r;
+      }
+      return [map, p];
+    }
+    default: throw new Error('cbor-unsupported');
+  }
+}
+
+/* ------------------------------------------------------------------ authenticator data */
+
+/** rpIdHash (32) | flags (1) | signCount (4) | [aaguid (16) | idLength (2) | credentialId | COSE key]. */
+export function parseAuthData(bytes) {
+  if (!(bytes instanceof Uint8Array) || bytes.length < 37) throw new Error('authdata-short');
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  const flags = bytes[32];
+  const out = {
+    rpIdHash: bytes.subarray(0, 32),
+    up: Boolean(flags & 0x01),
+    uv: Boolean(flags & 0x04),
+    backupEligible: Boolean(flags & 0x08),
+    backedUp: Boolean(flags & 0x10),
+    at: Boolean(flags & 0x40),
+    signCount: view.getUint32(33),
+  };
+  if (!out.at) return out;
+  if (bytes.length < 55) throw new Error('authdata-short');
+  const idLen = view.getUint16(53);
+  if (55 + idLen > bytes.length) throw new Error('authdata-short');
+  out.credentialId = bytes.subarray(55, 55 + idLen);
+  const [cose] = cborDecode(bytes, 55 + idLen);
+  out.cose = cose;
+  return out;
+}
+
+/** A COSE public key as { alg, jwk }: ES256 (P-256) or RS256 only. */
+export function coseToJwk(cose) {
+  if (!(cose instanceof Map)) throw new Error('cose');
+  const kty = cose.get(1);
+  const alg = cose.get(3);
+  if (kty === 2 && alg === -7) {
+    if (cose.get(-1) !== 1) throw new Error('cose-curve');
+    const x = cose.get(-2); const y = cose.get(-3);
+    if (!(x instanceof Uint8Array) || !(y instanceof Uint8Array) || x.length !== 32 || y.length !== 32) throw new Error('cose-ec');
+    return { alg, jwk: { kty: 'EC', crv: 'P-256', x: bytesToB64url(x), y: bytesToB64url(y) } };
+  }
+  if (kty === 3 && alg === -257) {
+    const nn = cose.get(-1); const e = cose.get(-2);
+    if (!(nn instanceof Uint8Array) || !(e instanceof Uint8Array) || nn.length < 256) throw new Error('cose-rsa');
+    return { alg, jwk: { kty: 'RSA', n: bytesToB64url(nn), e: bytesToB64url(e) } };
+  }
+  throw new Error('cose-alg');
+}
+
+function algorithms(alg) {
+  if (alg === -7) return { importAs: { name: 'ECDSA', namedCurve: 'P-256' }, verifyAs: { name: 'ECDSA', hash: 'SHA-256' } };
+  if (alg === -257) return { importAs: { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' }, verifyAs: { name: 'RSASSA-PKCS1-v1_5' } };
+  throw new Error('alg');
+}
+
+/** An ECDSA signature arrives DER-encoded; WebCrypto wants r || s, 32 bytes each. */
+export function derToRaw(der) {
+  if (der[0] !== 0x30) throw new Error('der');
+  let p = 2;
+  if (der[1] & 0x80) p = 2 + (der[1] & 0x7f);
+  const int = () => {
+    if (der[p] !== 0x02) throw new Error('der-int');
+    const len = der[p + 1];
+    let v = der.subarray(p + 2, p + 2 + len);
+    p += 2 + len;
+    while (v.length > 32 && v[0] === 0) v = v.subarray(1);
+    if (v.length > 32) throw new Error('der-int');
+    const out = new Uint8Array(32);
+    out.set(v, 32 - v.length);
+    return out;
+  };
+  const raw = new Uint8Array(64);
+  raw.set(int(), 0);
+  raw.set(int(), 32);
+  return raw;
+}
+
+/* ------------------------------------------------------------------ ceremonies */
+
+/** Is `origin` this site: the same origin as the request, https (or http on a loopback address for dev). */
+export function originOk(origin, site) {
+  try {
+    const o = new URL(origin);
+    const s = new URL(site);
+    if (o.origin !== s.origin) return false;
+    return o.protocol === 'https:' || (o.protocol === 'http:' && ['127.0.0.1', 'localhost', '[::1]'].includes(o.hostname));
+  } catch { return false; }
+}
+
+/** clientDataJSON: its type, challenge and origin. Returns { ok, client, bytes } or { ok: false, error }. */
+function readClient(clientDataJSON, { type, challenge, site }) {
+  let bytes; let client;
+  try { bytes = b64urlToBytes(clientDataJSON); client = JSON.parse(DEC.decode(bytes)); } catch { return { ok: false, error: 'client-data' }; }
+  if (!client || client.type !== type) return { ok: false, error: 'ceremony' };
+  if (typeof client.challenge !== 'string' || !sameBytes(ENC.encode(client.challenge), ENC.encode(String(challenge ?? '')))) return { ok: false, error: 'challenge' };
+  if (!originOk(client.origin, site)) return { ok: false, error: 'origin' };
+  if (client.crossOrigin === true) return { ok: false, error: 'cross-origin' };
+  return { ok: true, client, bytes };
+}
+
+/**
+ * A registration (navigator.credentials.create): verifies it and returns the credential to keep:
+ * { ok, id, alg, jwk, signCount, backedUp } or { ok: false, error }.
+ */
+export async function verifyRegistration(response, { challenge, site, rpId }) {
+  if (!response || typeof response !== 'object') return { ok: false, error: 'response' };
+  const c = readClient(response.clientDataJSON, { type: 'webauthn.create', challenge, site });
+  if (!c.ok) return c;
+  let auth;
+  try {
+    const [att] = cborDecode(b64urlToBytes(response.attestationObject));
+    if (!(att instanceof Map) || !(att.get('authData') instanceof Uint8Array)) return { ok: false, error: 'attestation' };
+    auth = parseAuthData(att.get('authData'));
+  } catch (e) { return { ok: false, error: `attestation:${String(e.message).slice(0, 40)}` }; }
+  if (!sameBytes(auth.rpIdHash, await sha256(rpId))) return { ok: false, error: 'rp' };
+  if (!auth.up) return { ok: false, error: 'presence' };
+  if (!auth.at || !auth.credentialId?.length || auth.credentialId.length > 1023) return { ok: false, error: 'credential' };
+  let key;
+  try { key = coseToJwk(auth.cose); } catch (e) { return { ok: false, error: String(e.message) }; }
+  const id = bytesToB64url(auth.credentialId);
+  if (response.id && response.id !== id) return { ok: false, error: 'credential-id' };
+  // The key must import: a stored key that cannot verify would lock its player out later.
+  try { await crypto.subtle.importKey('jwk', key.jwk, algorithms(key.alg).importAs, false, ['verify']); } catch { return { ok: false, error: 'key' }; }
+  return { ok: true, id, alg: key.alg, jwk: key.jwk, signCount: auth.signCount, backedUp: auth.backedUp };
+}
+
+/**
+ * A sign-in (navigator.credentials.get) against a stored credential { alg, jwk, signCount }:
+ * { ok, signCount, uv } or { ok: false, error }.
+ */
+export async function verifyAssertion(response, stored, { challenge, site, rpId }) {
+  if (!response || typeof response !== 'object' || !stored) return { ok: false, error: 'response' };
+  const c = readClient(response.clientDataJSON, { type: 'webauthn.get', challenge, site });
+  if (!c.ok) return c;
+  let authBytes; let auth; let sig;
+  try {
+    authBytes = b64urlToBytes(response.authenticatorData);
+    auth = parseAuthData(authBytes);
+    sig = b64urlToBytes(response.signature);
+  } catch { return { ok: false, error: 'assertion' }; }
+  if (!sameBytes(auth.rpIdHash, await sha256(rpId))) return { ok: false, error: 'rp' };
+  if (!auth.up) return { ok: false, error: 'presence' };
+  let ok = false;
+  try {
+    const { importAs, verifyAs } = algorithms(Number(stored.alg));
+    const key = await crypto.subtle.importKey('jwk', typeof stored.jwk === 'string' ? JSON.parse(stored.jwk) : stored.jwk, importAs, false, ['verify']);
+    const clientHash = await sha256(c.bytes);
+    const signed = new Uint8Array(authBytes.length + clientHash.length);
+    signed.set(authBytes, 0);
+    signed.set(clientHash, authBytes.length);
+    ok = await crypto.subtle.verify(verifyAs, key, Number(stored.alg) === -7 ? derToRaw(sig) : sig, signed);
+  } catch { ok = false; }
+  if (!ok) return { ok: false, error: 'signature' };
+  const before = Number(stored.signCount) || 0;
+  if ((auth.signCount !== 0 || before !== 0) && auth.signCount <= before) return { ok: false, error: 'counter' };
+  return { ok: true, signCount: auth.signCount, uv: auth.uv };
+}