@homie-rocks/studio 0.12.0 → 0.13.0

package/worker/room.mjs

@@ -41,6 +41,25 @@ export const EV_RATES = Object.freeze({ host: 30, replica: 10, screen: 2 });
 /** The keyed state channel: at most this many keys and bytes per room. */
 export const STATE_CAPS = Object.freeze({ keys: 64, bytes: 65536 });
 
+/**
+ * THE OWNER'S CONTROLS (revision 4, NETPLAY.md section 15). The studio's Worker, acting for the signed-in owner,
+ * hands the room a control: kick a player out (and hold the door for some minutes), mute one, announce a line to
+ * everyone, close the room, or change its seats. The Table verifies the owner's signature before it calls
+ * `control()`; this file only applies one. What a player sees of them is new optional frames and two new refusals,
+ * so a v1 game that knows none of it keeps playing (its shell shows the notice and the banner).
+ */
+export const CONTROL_LIMITS = Object.freeze({ minutes: 24 * 60, announce: 280, announceSeconds: 3600, bans: 200, mutes: 200, message: 200 });
+/** What a muted player cannot say: an `ev` whose kind starts with one of these (a game's chat, quick lines, emotes). */
+export const SPEECH = /^(?:say|chat|emote)/i;
+const oneLine = (v, max) => String(v ?? '').replace(/[\u0000-\u001f\u007f-\u009f\u2028\u2029]+/g, ' ').replace(/\s+/g, ' ').trim().slice(0, max);
+/** A short tag for a browser's room key: enough for the owner to see "the same browser", never the key itself. */
+export function browserTag(key) {
+  if (!key) return null;
+  let h = 2166136261;
+  for (const ch of String(key)) h = Math.imul(h ^ ch.charCodeAt(0), 16777619) >>> 0;
+  return h.toString(36).padStart(6, '0').slice(-6);
+}
+
 /**
  * A seat's handle when its player typed no name: two words, varied per seat and per room ("Velvet Comet"), never
  * "Player 1" (a game that falls back to a list by seat number made every room's first player the same name).
@@ -152,6 +171,17 @@ export class NetRoom {
       kicked: 0, refused: 0, persists: 0, restoredFrom: null, bytesIn: 0, bytesOut: 0, elections: [], promotions: 0,
     };
     this.snapTimes = [];
+    /** The owner's controls (section 15): who is held out of this room until when, who is muted, the banner, a closed door. */
+    this.bans = [];
+    this.mutes = [];
+    this.announcement = null;
+    this.closedUntil = 0;
+    this.closedWhy = '';
+    /** When the room's first seat was taken (its uptime), and what the first hello asked for (`hello.max`). */
+    this.openedAt = 0;
+    this.askedMax = null;
+    /** A launch change waiting for the round to finish: who may stay (ticket kinds), and when it applies at the latest. */
+    this.regate = null;
   }
 
   /* ------------------------------------------------------------ sockets */
@@ -160,7 +190,7 @@ export class NetRoom {
   attach(conn) {
     const now = this.now();
     const c = {
-      id: randomId(6), conn, ip: conn.ip ?? null, helloed: false, seat: null, token: null, name: '', typed: '', colour: 0,
+      id: randomId(6), conn, ip: conn.ip ?? null, browser: conn.browser ?? null, player: conn.player ?? null, via: conn.via ?? null, helloed: false, seat: null, token: null, name: '', typed: '', colour: 0,
       device: 'desk', want: 'play', canHost: true, hidden: false, waiting: false, joinedAt: now, lastSeen: now, lastSnapAt: 0,
       rates: new Map(), drops: [], errAt: 0,
     };
@@ -175,6 +205,9 @@ export class NetRoom {
   watch(conn) {
     this.watchers.add(conn);
     this.sendText(conn, JSON.stringify(this.facts()));
+    // A shell that comes back to a room it was kicked from (or that is closed) hears so at once.
+    const held = this.heldNotice(conn);
+    if (held) this.sendText(conn, JSON.stringify(held));
     return { onClose: () => this.watchers.delete(conn) };
   }
 
@@ -184,13 +217,13 @@ export class NetRoom {
     try { conn.send(text); this.stats.bytesOut += text.length; } catch { /* closing */ }
   }
   send(c, msg) { this.sendText(c.conn, JSON.stringify(msg)); }
-  error(c, code, message) { this.send(c, { t: 'error', code, message }); }
+  error(c, code, message, extra = {}) { this.send(c, { t: 'error', code, message, ...extra }); }
   live() { return [...this.clients.values()].filter((c) => c.helloed); }
   others(c) { return this.live().filter((o) => o !== c); }
   host() { return this.hostId ? this.clients.get(this.hostId) ?? null : null; }
   hostRef() { const h = this.host(); return h ? { id: h.id, seat: h.seat } : null; }
   roleOf(c) { return c.id === this.hostId ? 'host' : c.seat === null ? 'screen' : 'replica'; }
-  peer(c) { return { id: c.id, seat: c.seat, name: c.name, colour: c.colour, device: c.device, want: c.want, role: this.roleOf(c) }; }
+  peer(c) { return { id: c.id, seat: c.seat, name: c.name, colour: c.colour, device: c.device, want: c.want, role: this.roleOf(c), ...(this.muteOf(c) ? { muted: true } : {}) }; }
   peers() { return this.live().map((c) => this.peer(c)); }
   stateObject() { const o = {}; for (const [k, v] of this.state) o[k] = v.d; return o; }
 
@@ -268,6 +301,8 @@ export class NetRoom {
       }
       case 'ev': {
         const kind = String(m.k ?? '').slice(0, 64);
+        // A muted player's speech goes nowhere (a host relays everyone's, so only a non-host's own is dropped).
+        if (!isHost && SPEECH.test(kind) && this.muteOf(c)) { this.stats.mutedDrops = (this.stats.mutedDrops ?? 0) + 1; return; }
         this.stats.evs += 1;
         const out = { t: 'ev', from: c.seat, k: kind, d: m.d ?? null };
         if (isHost) {
@@ -314,6 +349,8 @@ export class NetRoom {
       case 'round': {
         if (!isHost || !m.round || typeof m.round !== 'object') return;
         this.lastRound = m.round;
+        // The round a launch change waits for is over: everyone sees its results for a moment, then the room re-gates.
+        if (this.regate && m.round.phase === 'over' && (this.regate.roundN === null || Number(m.round.n) >= this.regate.roundN)) this.regate.until = Math.min(this.regate.until, this.now() + 5000);
         this.stats.rounds += 1;
         this.persistDirty = true;
         for (const o of this.others(c)) this.send(o, { t: 'round', round: m.round });
@@ -370,12 +407,16 @@ export class NetRoom {
       return;
     }
     const live = this.live();
-    const refuse = (code, message) => {
+    const refuse = (code, message, extra = {}) => {
       this.stats.refused += 1;
-      this.error(c, code, message);
+      this.error(c, code, message, extra);
       this.clients.delete(c.id);
       try { c.conn.close(1008, code); } catch { /* gone */ }
     };
+    // The owner closed this room, or held this player out of it (section 15): refused, with when it ends.
+    if (this.closedUntil > this.now()) return refuse('room-closed', this.closedWhy || 'The studio closed this room.', { until: this.closedUntil });
+    const ban = this.banOf(c, typeof m.token === 'string' ? m.token : '');
+    if (ban) return refuse('kicked', ban.message, { until: ban.until });
     if (this.perIp && c.ip && live.filter((o) => o.ip === c.ip).length >= this.perIp) return refuse('too-many', `at most ${this.perIp} sockets per address in one room`);
     if (live.length >= this.maxPlayers + this.maxScreens) return refuse('room-full', 'this room is full; try another');
     const now = this.now();
@@ -385,13 +426,14 @@ export class NetRoom {
     c.game = typeof m.game === 'string' ? m.game.slice(0, 64) : '';
     c.typed = typeof m.name === 'string' ? m.name.replace(/\s+/g, ' ').trim().slice(0, 24) : '';
     // The manifest's player count, from the first visitor of an empty room (the site's Table reads the manifest).
-    if (Number.isInteger(m.max) && !this.seats.size && !live.length) this.maxPlayers = Math.max(1, Math.min(this.seatCap, m.max));
+    if (Number.isInteger(m.max) && !this.seats.size && !live.length) { this.askedMax = m.max; this.maxPlayers = Math.max(1, Math.min(this.seatCap, m.max)); }
     this.reapSeats(now);
     let full = false;
     if (c.want === 'play' && !this.seatClient(c, typeof m.token === 'string' ? m.token : '')) { full = true; c.waiting = true; }
     if (c.seat === null) c.name = c.typed || (c.want === 'screen' ? 'Screen' : 'Watcher');
     c.helloed = true;
     c.joinedAt = now;
+    if (!this.openedAt) this.openedAt = now;
     this.emptySince = 0;
     this.lastJoinAt = now;
 
@@ -426,6 +468,7 @@ export class NetRoom {
       round: this.lastRound, roster: this.lastRoster, snap: this.lastSnap, state: this.stateObject(),
       ...(role === 'host' ? { ckpt: this.lastCkpt } : {}),
       ...(full ? { full: true } : {}),
+      ...(this.liveAnnouncement() ? { announce: this.liveAnnouncement() } : {}),
     });
     for (const o of this.others(c)) this.send(o, { t: 'join', peer: this.peer(c) });
     if (deposed) {
@@ -593,12 +636,13 @@ export class NetRoom {
       this.preferHost = null;
       if (this.live().some((c) => c.canHost)) this.elect(null, 'host-left');
     }
+    if (this.regate && now >= this.regate.until) this.applyRegate(now);
     this.reapSeats(now);
     this.seatWaiting();
     if (!this.live().length && this.emptySince && now - this.emptySince > this.forgetMs) {
       this.lastSnap = null; this.lastSnapText = null; this.lastCkpt = null; this.lastRound = null; this.lastRoster = null;
       this.state.clear(); this.stateBytes = 0; this.seats.clear(); this.preferHost = null;
-      this.emptySince = 0;
+      this.emptySince = 0; this.openedAt = 0; this.askedMax = null;
       this.seatsDirty = false; this.persistDirty = false;
       try { this.store?.clear?.(); } catch { /* best effort */ }
     }
@@ -621,7 +665,7 @@ export class NetRoom {
 
   saved(now = this.now()) {
     return {
-      v: NET_VERSION, room: this.code, savedAt: now, maxPlayers: this.maxPlayers, hostSeat: this.host()?.seat ?? null,
+      v: NET_VERSION, room: this.code, savedAt: now, maxPlayers: this.maxPlayers, hostSeat: this.host()?.seat ?? null, openedAt: this.openedAt || null,
       seats: [...this.seats].map(([seat, s]) => [seat, s.token, s.name]),
       ckpt: this.lastCkpt, round: this.lastRound, roster: this.lastRoster, state: this.stateObject(),
     };
@@ -636,6 +680,7 @@ export class NetRoom {
     const now = this.now();
     if (!saved || saved.v !== NET_VERSION || !(now - Number(saved.savedAt) < 120_000)) return false;
     if (Number.isInteger(saved.maxPlayers)) this.maxPlayers = Math.max(1, Math.min(this.seatCap, saved.maxPlayers));
+    if (Number.isFinite(saved.openedAt) && saved.openedAt > 0) this.openedAt = saved.openedAt;
     for (const [seat, token, name] of saved.seats ?? []) this.seats.set(seat, { token, name, since: now, present: false });
     this.lastCkpt = saved.ckpt ?? null;
     this.lastRound = saved.round ?? null;
@@ -652,6 +697,251 @@ export class NetRoom {
     return true;
   }
 
+  /* ------------------------------------------------------------ the owner's controls (section 15) */
+
+  /** A live client by socket id, else the present client in a seat. */
+  findClient({ id = null, seat = null } = {}) {
+    if (typeof id === 'string' && id) { const c = this.clients.get(id); if (c && c.helloed) return c; }
+    if (Number.isInteger(seat)) return this.live().find((c) => c.seat === seat) ?? null;
+    return null;
+  }
+
+  /** The hold that keeps this client out, if any: by its seat token, its browser's room key, its account, or (only when the owner asked) its address. */
+  banOf(c, token = c.token) {
+    const now = this.now();
+    return this.bans.find((b) => b.until > now && ((b.token && b.token === token) || (b.browser && b.browser === c.browser) || (b.player && b.player === c.player) || (b.ip && b.ip === c.ip))) ?? null;
+  }
+
+  muteOf(c) {
+    const now = this.now();
+    return this.mutes.find((m) => m.until > now && ((m.token && m.token === c.token) || (m.browser && m.browser === c.browser) || (m.player && m.player === c.player))) ?? null;
+  }
+
+  liveAnnouncement() {
+    const a = this.announcement;
+    return a && a.until > this.now() ? a : null;
+  }
+
+  /** What a watching shell is told on arrival: the room is closed, or its browser is held out or muted. */
+  heldNotice(conn) {
+    const now = this.now();
+    if (this.closedUntil > now) return { t: 'closed', room: this.code, until: this.closedUntil, message: this.closedWhy || 'The studio closed this room.' };
+    const probe = { token: null, browser: conn.browser ?? null, player: conn.player ?? null, ip: null };
+    if (!probe.browser && !probe.player) return null;
+    const ban = this.banOf(probe, null);
+    if (ban) return { t: 'kicked', room: this.code, until: ban.until, message: ban.message };
+    const mute = this.muteOf(probe);
+    return mute ? { t: 'muted', room: this.code, until: mute.until } : null;
+  }
+
+  /** Tell the watching shells of one browser (or account) something meant for that player alone. */
+  tellBrowser(who, msg) {
+    const text = JSON.stringify(msg);
+    for (const w of this.watchers) if ((who.browser && w.browser === who.browser) || (who.player && w.player === who.player)) this.sendText(w, text);
+  }
+
+  /**
+   * One control, already verified by the caller (the Table checks the owner's signature). Returns what happened:
+   * `{ ok: true, ... }`, or `{ ok: false, error }` when there is nobody to act on.
+   */
+  control(op, a = {}) {
+    const now = this.now();
+    const minutes = Math.max(1, Math.min(CONTROL_LIMITS.minutes, Math.floor(Number(a.minutes) || 10)));
+    this.bans = this.bans.filter((b) => b.until > now);
+    this.mutes = this.mutes.filter((m) => m.until > now);
+    switch (op) {
+      case 'kick': {
+        const target = this.findClient(a);
+        if (!target) return { ok: false, error: 'no-player', message: 'nobody is in that seat now' };
+        const until = now + minutes * 60_000;
+        // The message is the studio's words; `until` says when (the shell says it in the player's own time).
+        const message = oneLine(a.message, CONTROL_LIMITS.message) || 'The studio removed you from this room.';
+        const ban = { token: target.token, browser: target.browser, player: target.player, ip: a.address ? target.ip : null, name: target.name, seat: target.seat, until, at: now, message };
+        this.bans = [...this.bans, ban].slice(-CONTROL_LIMITS.bans);
+        // Every socket of that player in this room: the seat itself, and its browser's or account's other tabs.
+        const out = this.live().filter((o) => o === target || (ban.browser && o.browser === ban.browser) || (ban.player && o.player === ban.player));
+        for (const o of out) {
+          const seat = o.seat;
+          const token = o.token;
+          this.error(o, 'kicked', message, { until });
+          this.onClose(o, 'kicked');
+          // The seat is free for somebody else at once, and its token resumes nothing.
+          const s = seat === null ? null : this.seats.get(seat);
+          if (s && s.token === token) { this.seats.delete(seat); this.seatsDirty = true; }
+          try { o.conn.close(1008, 'kicked'); } catch { /* gone */ }
+        }
+        this.stats.ownerKicks = (this.stats.ownerKicks ?? 0) + 1;
+        this.tellBrowser(ban, { t: 'kicked', room: this.code, until, message });
+        this.persist(now);
+        this.tellWatchers();
+        return { ok: true, op, name: ban.name, seat: ban.seat, sockets: out.length, until };
+      }
+      case 'mute': {
+        const target = this.findClient(a);
+        if (!target) return { ok: false, error: 'no-player', message: 'nobody is in that seat now' };
+        const off = a.off === true;
+        const same = (m) => (m.token && m.token === target.token) || (m.browser && m.browser === target.browser) || (m.player && m.player === target.player);
+        this.mutes = this.mutes.filter((m) => !same(m));
+        const until = off ? 0 : now + minutes * 60_000;
+        if (!off) this.mutes = [...this.mutes, { token: target.token, browser: target.browser, player: target.player, name: target.name, seat: target.seat, until, at: now }].slice(-CONTROL_LIMITS.mutes);
+        const note = { t: 'mute', id: target.id, seat: target.seat, until };
+        for (const o of this.live()) this.send(o, note);
+        this.tellBrowser(target, { t: 'muted', room: this.code, until });
+        this.tellWatchers();
+        return { ok: true, op, name: target.name, seat: target.seat, until };
+      }
+      case 'announce': {
+        const text = oneLine(a.text, CONTROL_LIMITS.announce);
+        const prev = this.announcement;
+        if (!text) {
+          this.announcement = null;
+          if (prev) { const clear = JSON.stringify({ t: 'announce', id: prev.id, text: null }); for (const o of this.live()) this.sendText(o.conn, clear); for (const w of this.watchers) this.sendText(w, clear); }
+          this.tellWatchers();
+          return { ok: true, op, cleared: Boolean(prev) };
+        }
+        const seconds = Math.max(5, Math.min(CONTROL_LIMITS.announceSeconds, Math.floor(Number(a.seconds) || 30)));
+        this.announcement = { id: typeof a.id === 'string' && /^[A-Za-z0-9_-]{1,24}$/.test(a.id) ? a.id : randomId(6), text, at: now, until: now + seconds * 1000, from: 'studio' };
+        const msg = JSON.stringify({ t: 'announce', ...this.announcement });
+        for (const o of this.live()) this.sendText(o.conn, msg);
+        for (const w of this.watchers) this.sendText(w, msg);
+        this.tellWatchers();
+        return { ok: true, op, id: this.announcement.id, people: this.live().length, until: this.announcement.until };
+      }
+      case 'close': {
+        if (a.reopen === true) { this.closedUntil = 0; this.closedWhy = ''; this.tellWatchers(); return { ok: true, op, reopened: true }; }
+        // `seconds` (10 s to a day) is a short close: everyone comes back through the game's door (a launch state change).
+        const seconds = Math.floor(Number(a.seconds));
+        const until = now + (seconds >= 10 ? Math.min(seconds, CONTROL_LIMITS.minutes * 60) * 1000 : minutes * 60_000);
+        const message = oneLine(a.message, CONTROL_LIMITS.message) || 'The studio closed this room. Thanks for playing!';
+        this.closedUntil = until;
+        this.closedWhy = message;
+        const people = this.live().length;
+        for (const c of [...this.clients.values()]) {
+          if (c.helloed) this.error(c, 'room-closed', message, { until });
+          this.clients.delete(c.id);
+          try { c.conn.close(1000, 'room-closed'); } catch { /* gone */ }
+        }
+        // Everything the room held goes, as when an empty room forgets (section 4).
+        this.hostId = null;
+        this.lastSnap = null; this.lastSnapText = null; this.lastCkpt = null; this.lastRound = null; this.lastRoster = null;
+        this.state.clear(); this.stateBytes = 0; this.seats.clear(); this.preferHost = null; this.openedAt = 0; this.askedMax = null;
+        this.emptySince = now; this.seatsDirty = false; this.persistDirty = false;
+        try { this.store?.clear?.(); } catch { /* best effort */ }
+        const msg = JSON.stringify({ t: 'closed', room: this.code, until, message });
+        for (const w of this.watchers) this.sendText(w, msg);
+        this.tellWatchers();
+        return { ok: true, op, people, until };
+      }
+      case 'regate': {
+        // A game's launch state changed (NETPLAY.md section 15): who may play is now narrower (`allow`: ticket kinds o,
+        // i, p), or anyone again (`allow` absent: a pending change is cancelled). The current round finishes first.
+        if (!Array.isArray(a.allow)) { const had = Boolean(this.regate); this.regate = null; this.tellWatchers(); return { ok: true, op, cancelled: had }; }
+        const allow = a.allow.filter((k) => ['o', 'i', 'p'].includes(k));
+        const leaving = this.live().filter((c) => !this.allowedAfter(c, allow)).length;
+        if (!leaving) { this.regate = null; this.tellWatchers(); return { ok: true, op, leaving: 0 }; }
+        const r = this.lastRound;
+        const playing = Boolean(r && r.phase === 'live' && Number(r.endsAt) > now);
+        const until = Math.min(now + 15 * 60_000, playing ? Number(r.endsAt) + 20_000 : now + 30_000);
+        this.regate = { allow, roundN: playing ? Number(r.n) : null, until, at: now, message: oneLine(a.message, CONTROL_LIMITS.message) || 'Thanks for playing!' };
+        const notice = oneLine(a.notice, CONTROL_LIMITS.announce);
+        if (notice) this.control('announce', { text: notice, seconds: Math.ceil((until - now) / 1000) + 5 });
+        this.tellWatchers();
+        return { ok: true, op, leaving, until, afterRound: playing ? Number(r.n) : null };
+      }
+      case 'seats': {
+        const n = Math.floor(Number(a.max));
+        if (!(n >= 1)) return { ok: false, error: 'max', message: 'seats is a number of at least 1' };
+        this.setSeats(n);
+        this.tellWatchers();
+        return { ok: true, op, max: this.maxPlayers };
+      }
+      default:
+        return { ok: false, error: 'op', message: `no control called ${String(op).slice(0, 24)}` };
+    }
+  }
+
+  /** Whether a client may stay once the room re-gates: one of its ticket's holders (o, i-…, p-…) is of an allowed kind. */
+  allowedAfter(c, allow) {
+    return String(c.via ?? '').split('~').some((part) => (part === 'o' && allow.includes('o')) || (part.startsWith('i-') && allow.includes('i')) || (part.startsWith('p-') && allow.includes('p')));
+  }
+
+  /** The launch change, now: everyone it leaves out is sent out of the room with the studio's words; the rest play on. */
+  applyRegate(now = this.now()) {
+    const g = this.regate;
+    if (!g) return 0;
+    this.regate = null;
+    // The holder of the room's storage keeps the owner's state (the Table writes it on its next tick).
+    this.officeDirty = true;
+    const out = this.live().filter((c) => !this.allowedAfter(c, g.allow));
+    for (const c of out) {
+      const seat = c.seat;
+      const token = c.token;
+      this.error(c, 'room-closed', g.message);
+      this.onClose(c, 'regated');
+      const s = seat === null ? null : this.seats.get(seat);
+      if (s && s.token === token) { this.seats.delete(seat); this.seatsDirty = true; }
+      try { c.conn.close(1000, 'room-closed'); } catch { /* gone */ }
+      this.tellBrowser(c, { t: 'closed', room: this.code, message: g.message });
+    }
+    this.persist(now);
+    this.tellWatchers();
+    return out.length;
+  }
+
+  /**
+   * The room's seats, changed while it runs (the owner's "max players per room"). Players already seated above the
+   * new number keep their seat until they leave; nobody new is seated there. Never above the room's own cap.
+   */
+  setSeats(n, perIp = null) {
+    this.seatCap = Math.max(1, Math.floor(n));
+    this.maxPlayers = Math.max(1, Math.min(this.seatCap, this.askedMax ?? this.seatCap));
+    if (Number.isFinite(perIp) && perIp > 0) this.perIp = perIp;
+  }
+
+  /** The owner's holds, the banner and a closed door: kept apart from the room's play (they outlive an empty room). */
+  officeSaved() {
+    const now = this.now();
+    return {
+      bans: this.bans.filter((b) => b.until > now), mutes: this.mutes.filter((m) => m.until > now),
+      announcement: this.liveAnnouncement(), closedUntil: this.closedUntil > now ? this.closedUntil : 0, closedWhy: this.closedWhy,
+      regate: this.regate,
+    };
+  }
+
+  restoreOffice(o) {
+    if (!o || typeof o !== 'object') return;
+    const now = this.now();
+    this.bans = (Array.isArray(o.bans) ? o.bans : []).filter((b) => b && b.until > now).slice(-CONTROL_LIMITS.bans);
+    this.mutes = (Array.isArray(o.mutes) ? o.mutes : []).filter((m) => m && m.until > now).slice(-CONTROL_LIMITS.mutes);
+    this.announcement = o.announcement && o.announcement.until > now ? o.announcement : null;
+    this.closedUntil = Number(o.closedUntil) > now ? Number(o.closedUntil) : 0;
+    this.closedWhy = this.closedUntil ? String(o.closedWhy ?? '') : '';
+    // A launch change still waiting comes back; one long past is over (whoever it was for has gone).
+    this.regate = o.regate && Array.isArray(o.regate.allow) && Number(o.regate.until) > now - 120_000 ? o.regate : null;
+  }
+
+  /** The room as its owner sees it: the facts, plus who each player is to the studio (never an address). */
+  officeFacts() {
+    const f = this.facts();
+    const now = this.now();
+    const byId = new Map(this.live().map((c) => [c.id, c]));
+    return {
+      ...f,
+      office: {
+        openedAt: this.openedAt || null,
+        closedUntil: this.closedUntil > now ? this.closedUntil : null,
+        regate: this.regate ? { allow: this.regate.allow, until: this.regate.until, afterRound: this.regate.roundN } : null,
+        clients: f.clients.map((p) => {
+          const c = byId.get(p.id);
+          const mute = c ? this.muteOf(c) : null;
+          return { ...p, joinedAt: c?.joinedAt ?? null, lastSeen: c?.lastSeen ?? null, browser: browserTag(c?.browser), player: c?.player ?? null, via: c?.via ?? null, mutedUntil: mute ? mute.until : null };
+        }),
+        bans: this.bans.filter((b) => b.until > now).map((b) => ({ name: b.name, seat: b.seat, until: b.until, at: b.at, address: Boolean(b.ip), browser: browserTag(b.browser) })),
+        mutes: this.mutes.filter((m) => m.until > now).map((m) => ({ name: m.name, seat: m.seat, until: m.until })),
+      },
+    };
+  }
+
   /* ------------------------------------------------------------ the shell's view */
 
   facts() {
@@ -662,6 +952,9 @@ export class NetRoom {
     return {
       t: 'net', v: NET_VERSION, room: this.code, st: now,
       host: this.hostRef(),
+      openedAt: this.openedAt || null,
+      announce: this.liveAnnouncement(),
+      ...(this.closedUntil > now ? { closedUntil: this.closedUntil } : {}),
       clients: live.map((c) => ({ ...this.peer(c), hidden: c.hidden, waiting: c.waiting })),
       round: this.lastRound,
       roster: this.lastRoster,

package/worker/stats-page.mjs

@@ -10,9 +10,13 @@
 import { OWNER_COOKIE, endSession, ownerAllowed, rangeOf, readStats, spendSignin, onlyOf } from './stats.mjs';
 import { CODEX_SCRIPT } from './codex-script.mjs';
 
-/** Where a sign-in may send the owner next: the stats, or one game's codex. */
-const NEXT = /^\/_studio\/(?:stats|codex\/[a-z0-9][a-z0-9-]{0,39}\/)$/;
+/**
+ * Where a sign-in may send the owner next: the stats, one game's codex, the back office, an ask waiting for the
+ * owner's tap, or one of the studio's games (a private game's own secret road for the owner's phone).
+ */
+const NEXT = /^\/(?:_studio\/(?:stats|office|codex\/[a-z0-9][a-z0-9-]{0,39}\/|confirm\/ask_[a-f0-9]{16})|[a-z0-9][a-z0-9-]{0,39}\/(?:play)?)$/;
 const nextOf = (url) => { const to = url.searchParams.get('to') ?? ''; return NEXT.test(to) ? to : '/_studio/stats'; };
+const signinWord = (to) => (to.startsWith('/_studio/codex/') ? 'Open the codex' : to === '/_studio/office' ? 'Open the office' : to.startsWith('/_studio/confirm/') ? 'Sign in and see what your AI asks' : to.startsWith('/_studio/stats') ? 'Open the stats' : 'Sign in and play');
 let scriptHash = null;
 async function codexScriptHash() {
   if (!scriptHash) {
@@ -99,7 +103,7 @@ function statsBody(cat, s, url) {
   const videoRows = s.videos.map((e) => `<tr><td><a href="${esc(q({ video: e.slug, game: null, song: null }))}">${esc(e.title)}</a></td><td>${fmt(e.visits)}</td><td>${fmt(e.views)}</td></tr>`).join('');
   const refRows = s.referrers.map((r) => `<tr><td>${esc(r.from)} <span class="kind">${esc(KIND_WORD[r.kind] ?? r.kind)}</span></td><td>${fmt(r.visits)}</td><td>${fmt(r.plays)}</td></tr>`).join('');
   return `<header><h1>${esc(cat.studio?.name ?? 'Studio')} stats${s.only ? ` <span class="dim">· ${esc(s.only.kind)} ${esc(s.only.id)}</span>` : ''}</h1>
-<form method="post" action="/_studio/signout"><button class="ghost" type="submit">Sign out</button></form></header>
+<span><a href="/_studio/office">Office</a> &nbsp; <form method="post" action="/_studio/signout"><button class="ghost" type="submit">Sign out</button></form></span></header>
 <p class="dim">${esc(s.range.from)} to ${esc(s.range.to)} (UTC)${s.only ? ` · <a href="${esc(q({ game: null, song: null, video: null }))}">whole studio</a>` : ''}</p>
 <nav class="ranges">${ranges}</nav>
 <section class="tiles">
@@ -132,18 +136,23 @@ export async function ownerRoutes(request, env, url, { catalogueOf }) {
     if (request.method === 'GET') {
       // A GET spends nothing: a chat app's link preview must not use up the owner's one-time link.
       return page('Sign in · stats', `<h1>${esc(cat.studio?.name ?? 'Studio')} stats</h1>
-<p class="dim">Open this studio's private stats in this browser. The link works once.</p>
-<form method="post" action="/_studio/signin?k=${esc(encodeURIComponent(key))}${nextOf(url) !== '/_studio/stats' ? `&amp;to=${esc(encodeURIComponent(nextOf(url)))}` : ''}"><button type="submit">${nextOf(url).startsWith('/_studio/codex/') ? 'Open the codex' : 'Open the stats'}</button></form>`);
+<p class="dim">Sign this browser in as the studio's owner: the private stats and office, and the owner's tools in your own games. The link works once.</p>
+<form method="post" action="/_studio/signin?k=${esc(encodeURIComponent(key))}${nextOf(url) !== '/_studio/stats' ? `&amp;to=${esc(encodeURIComponent(nextOf(url)))}` : ''}"><button type="submit">${signinWord(nextOf(url))}</button></form>`);
     }
     if (request.method !== 'POST' || !sameOrigin(request, url)) return page('Not allowed', '<h1>Not allowed</h1>', 403);
     const session = await spendSignin(env, key);
     if (!session) return page('Link used or expired', `<h1>That link has been used or has expired</h1><p class="note">A sign-in link works once, for 30 minutes. Ask your AI for a new one: <code>npx --no-install homie-studio stats link</code>.</p>`, 403);
-    return new Response(null, { status: 303, headers: { location: nextOf(url), 'cache-control': 'no-store', 'set-cookie': `${OWNER_COOKIE}=${session}; Path=/_studio/; HttpOnly; SameSite=Lax; Max-Age=${30 * 24 * 3600}${secure}` } });
+    // The session lives at / (0.13.0): the owner is recognised in their own games, never readable by a page or a game.
+    return new Response(null, { status: 303, headers: { location: nextOf(url), 'cache-control': 'no-store', 'set-cookie': `${OWNER_COOKIE}=${session}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${30 * 24 * 3600}${secure}` } });
   }
   if (path === '/_studio/signout') {
     if (request.method !== 'POST' || !sameOrigin(request, url)) return page('Not allowed', '<h1>Not allowed</h1>', 403);
     await endSession(env, request);
-    return new Response(null, { status: 303, headers: { location: '/_studio/stats', 'cache-control': 'no-store', 'set-cookie': `${OWNER_COOKIE}=; Path=/_studio/; HttpOnly; SameSite=Lax; Max-Age=0${secure}` } });
+    const headers = new Headers({ location: '/_studio/stats', 'cache-control': 'no-store' });
+    // Both places a session cookie has lived (/ from 0.13.0, /_studio/ before).
+    headers.append('set-cookie', `${OWNER_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0${secure}`);
+    headers.append('set-cookie', `${OWNER_COOKIE}=; Path=/_studio/; HttpOnly; SameSite=Lax; Max-Age=0${secure}`);
+    return new Response(null, { status: 303, headers });
   }
   if (path === '/_studio/stats' || path === '/_studio/stats/') {
     if (request.method !== 'GET') return page('Not allowed', '<h1>Not allowed</h1>', 405);

package/worker/stats.mjs

@@ -25,8 +25,10 @@
  *   `homie-studio stats`        prints them (a ten-minute read key, minted and dropped by the CLI)
  *   `homie-studio stats key`    a read key for the Homie MCP tool `studio_stats` (1 hour by default)
  *   `homie-studio stats link`   a one-time sign-in link: /_studio/stats in the owner's own browser
+ *   `homie-studio office key`   a back-office key (it reads these too): worker/office.mjs
  * A key is 24 random bytes; D1 keeps only its SHA-256. The page's session cookie is the owner's alone
- * (HttpOnly, SameSite=Lax, only under /_studio/). There is no other way in.
+ * (HttpOnly, SameSite=Lax; from 0.13.0 at / so the owner is recognised in their own games, never readable by a
+ * page or a game). There is no other way in.
  *
  * FREE PLAN: D1 allows 100,000 row writes and 5 million row reads a day. A visit, a play, a room and a
  * song or video start are one write each; a finished round is three (its row in `rounds`, the round and the
@@ -134,30 +136,54 @@ export async function countVisit(request, env, ctx, subject, metric = 'visit') {
 
 /* ------------------------------------------------------------------ the owner's keys */
 
-/** Whether a presented key (Bearer header) or the owner's page session is valid. */
+/**
+ * Whether a presented key (Bearer header) or the owner's page session is valid, and which: `read` (a stats read
+ * key), `office` (a back-office key: the stats, the live rooms, and asking for the owner's controls; worker/office.mjs)
+ * or `session` (the owner's signed-in browser). A key's kind is fixed when it is minted; an office key also reads
+ * the stats.
+ */
 export async function ownerAllowed(request, env, { kinds = ['read', 'session'] } = {}) {
   if (!env?.DB) return false;
   const auth = request.headers.get('authorization') ?? '';
   const bearer = /^Bearer\s+(\S+)$/i.exec(auth)?.[1] ?? null;
-  const cookie = cookieValue(request, OWNER_COOKIE);
   const tries = [];
-  if (bearer && KEY.test(bearer) && kinds.includes('read')) tries.push(['read', bearer]);
-  if (cookie && SESSION.test(cookie) && kinds.includes('session')) tries.push(['session', cookie]);
-  for (const [kind, value] of tries) {
+  if (bearer && KEY.test(bearer) && (kinds.includes('read') || kinds.includes('office'))) tries.push([['read', 'office'].filter((k) => kinds.includes(k)), bearer]);
+  // The session cookie lives at / from 0.13.0 (the owner is recognised in their own game) and at /_studio/ before
+  // it: a browser may send both, so each is tried.
+  if (kinds.includes('session')) for (const cookie of cookieValues(request, OWNER_COOKIE).filter((v) => SESSION.test(v)).slice(0, 3)) tries.push([['session'], cookie]);
+  for (const [allowed, value] of tries) {
     try {
       const row = await env.DB.prepare('SELECT kind, expires_at FROM stats_keys WHERE hash = ?1').bind(await sha256(value)).first();
-      if (row && row.kind === kind && Number(row.expires_at) > Date.now()) return kind;
+      if (row && allowed.includes(row.kind) && Number(row.expires_at) > Date.now()) return row.kind;
     } catch { return false; }
   }
   return false;
 }
 
+/** The owner's valid page session value this request carries, or null (to carry an older /_studio/ cookie to /). */
+export async function ownerSession(request, env) {
+  if (!env?.DB) return null;
+  for (const cookie of cookieValues(request, OWNER_COOKIE).filter((v) => SESSION.test(v)).slice(0, 3)) {
+    try {
+      const row = await env.DB.prepare('SELECT kind, expires_at FROM stats_keys WHERE hash = ?1').bind(await sha256(cookie)).first();
+      if (row && row.kind === 'session' && Number(row.expires_at) > Date.now()) return cookie;
+    } catch { return null; }
+  }
+  return null;
+}
+
 export function cookieValue(request, name) {
+  return cookieValues(request, name)[0] ?? null;
+}
+
+/** Every value a request carries for one cookie name (the same name can arrive from two paths). */
+export function cookieValues(request, name) {
+  const out = [];
   for (const part of (request.headers.get('cookie') ?? '').split(';')) {
     const [k, ...v] = part.trim().split('=');
-    if (k === name) return v.join('=');
+    if (k === name) out.push(v.join('='));
   }
-  return null;
+  return out;
 }
 
 /** A one-time sign-in key turns into a 30-day page session (the key is spent). Returns the session value or null. */
@@ -178,9 +204,10 @@ export async function spendSignin(env, key) {
 }
 
 export async function endSession(env, request) {
-  const cookie = cookieValue(request, OWNER_COOKIE);
-  if (!env?.DB || !cookie || !SESSION.test(cookie)) return;
-  try { await env.DB.prepare("DELETE FROM stats_keys WHERE hash = ?1 AND kind = 'session'").bind(await sha256(cookie)).run(); } catch { /* gone */ }
+  if (!env?.DB) return;
+  for (const cookie of cookieValues(request, OWNER_COOKIE).filter((v) => SESSION.test(v)).slice(0, 3)) {
+    try { await env.DB.prepare("DELETE FROM stats_keys WHERE hash = ?1 AND kind = 'session'").bind(await sha256(cookie)).run(); } catch { /* gone */ }
+  }
 }
 
 /* ------------------------------------------------------------------ reading */

package/worker/version.mjs

@@ -1,2 +1,2 @@
 /** The @homie-rocks/studio version this Worker code is (package.json's; a test keeps them equal). Cache-busts /_homie/site.js. */
-export const STUDIO_VERSION_TAG = '0.12.0';
+export const STUDIO_VERSION_TAG = '0.13.0';