@homie-rocks/studio 0.22.0 → 0.24.0

package/worker/index.mjs

@@ -51,6 +51,13 @@
  *   /account/                  a player's account: a passkey, a name, their data (worker/players.mjs, saves/SAVES.md)
  *   /api/player/...            sign in and up, saves, lifetime stats and memorials (the game's saves bridge, via the
  *                              play shell), export and delete
+ *   /<game>/api/chat/report    a player reports one chat line (POST, this site's pages): the room's own copy of it is kept
+ *                              for the owner, 30 days (worker/chat-store.mjs); room chat itself rides the sockets above
+ *                              (NETPLAY.md section 19) and is never stored
+ *   /shop/, /api/shop/...      the studio's shop (worker/shop.mjs, shop/SHOP.md): its items in real money, the studio's
+ *                              OWN Stripe Checkout, the signed webhook, what a player owns (/api/player/owns), refunds;
+ *                              closed until the owner's restricted key is in; never on a kids server or a television
+ *   /api/referrals/statement   another studio's signed referral statement to this one (worker/referrals.mjs)
  *
  * A page in the studio's site/pages wins over the generated one at the same address. Every HTML answer is
  * `no-transform` (an edge in front of a custom domain injects nothing) and is never framed by another site.
@@ -80,6 +87,8 @@ import {
 } from './servers.mjs';
 import { BRAIN_BUDGET, HouseAgents, agentFacts, aiName, decodeFacts, encodeFacts, passById, passRefusal, sitRoute } from './agents.mjs';
 import { talks } from './brain.mjs';
+import { REACTIONS, reviewChat } from './chat.mjs';
+import { REPORT_REASONS, chatDay, chatOf, chatRowsOf, fileReport } from './chat-store.mjs';
 import { doorPage, serverPage, serversPage } from './site.mjs';
 import { isLocalOrigin, qrSvg } from './qr.mjs';
 import { SEAT_MAX, perAddress, seatsOf } from './seats.mjs';
@@ -99,6 +108,8 @@ import {
 // every device, and the owner's own account (`homie-studio players owner`) counts as the owner.
 usePlayers(playerAccounts);
 import { STUDIO_VERSION_TAG } from './version.mjs';
+import { roomBadge, shellShop, shopOf, shopRoutes } from './shop.mjs';
+import { arrivalCookie, manifestReferrals } from './referrals.mjs';
 import { licenseOf, remixAllowed, remixRow } from './license.mjs';
 
 export { SEAT_MAX } from './seats.mjs';
@@ -232,6 +243,8 @@ function named(cat, env) {
 async function roomsOf(env, games, { servers = null } = {}) {
   const rooms = [];
   const live = {};
+  // Room chat (section 19): whether each room's chat is on and may show on homie.rocks's page for it.
+  const chatRows = await chatRowsOf(env);
   await Promise.all(games.map(async (g) => {
     let list = [];
     try { list = (await (await env.LOBBY.get(env.LOBBY.idFromName(g.id)).fetch('https://lobby/rooms')).json()).rooms ?? []; } catch { list = []; }
@@ -242,7 +255,8 @@ async function roomsOf(env, games, { servers = null } = {}) {
       const sid = r.server ?? roomServer(r.name);
       const srv = sid === 'public' ? (known.find((x) => x.id === 'public') ?? PUBLIC_SERVER) : known.find((x) => x.id === sid);
       if (!srv || (sid !== 'public' && (!srv.listed || srv.state !== 'open' || srv.door !== 'open'))) continue;
-      rooms.push(roomView(g, r, seatsOf(g), srv));
+      const chat = chatOf(g, srv, chatRows);
+      rooms.push(roomView(g, r, seatsOf(g), srv, { chat: chat.mode !== 'off' && chat.hub }));
     }
   }));
   rooms.sort((a, b) => b.players - a.players || a.game.localeCompare(b.game) || String(a.room).localeCompare(String(b.room)));
@@ -381,6 +395,30 @@ function mediaRow(e, origin, kind, cat) {
  * wrapper Worker of its own for this. A preflight (a POST's content-type) is answered too.
  */
 const KNOCK_CORS = { 'access-control-allow-origin': '*', 'access-control-allow-methods': 'GET, POST', 'access-control-allow-headers': 'content-type', 'access-control-max-age': '86400' };
+/**
+ * Who a browser is to a room's chat (section 19): signed in with a passkey (an account, not a guest), and a member of the
+ * server (on the public server, any signed-in account). One D1 read for a signed-in player, none for a guest.
+ */
+async function chatWho(env, game, srv, holder) {
+  const pid = holders(holder).find((x) => x.startsWith('p-'))?.slice(2) ?? null;
+  if (!pid || !env.DB) return { acct: false, member: false };
+  let acct = false;
+  try { acct = Number((await env.DB.prepare('SELECT guest FROM players WHERE id = ?1').bind(pid).first())?.guest) === 0; } catch { acct = false; }
+  const member = acct && (!srv || srv.id === 'public' || Boolean(await memberOf(env, game, srv.id, pid)));
+  return { acct, member };
+}
+
+/** Reports a browser (and its address) may make: 8 in 10 minutes, counted in this Worker's memory and forgotten. */
+const reportsMade = new Map();
+function reportAllowed(key, now = Date.now()) {
+  const list = (reportsMade.get(key) ?? []).filter((at) => now - at < 10 * 60_000);
+  if (list.length >= 8) { reportsMade.set(key, list); return false; }
+  list.push(now);
+  reportsMade.set(key, list);
+  if (reportsMade.size > 5000) for (const [k, v] of reportsMade) if (!v.some((at) => now - at < 10 * 60_000)) reportsMade.delete(k);
+  return true;
+}
+
 function notAHomie(request) {
   if (request.method === 'OPTIONS') return new Response(null, { status: 204, headers: { ...KNOCK_CORS, 'cache-control': 'no-store' } });
   return json({ ok: false, error: 'not-a-homie', message: 'this is a studio site, not a Homie box; a game here plays on its own' }, 200, KNOCK_CORS);
@@ -419,6 +457,9 @@ async function gameDocument(request, env, url, game, meta, cat, { agent = null }
     ...(agent ? { agent: { hands: agent.hands, role: agent.role } } : {}),
     // The play page's "Quiet AI": this browser hides AI speech (the helper's `net.hushed`).
     ...(url.searchParams.get('hush') === '1' ? { hush: true } : {}),
+    // Room chat (section 19): this browser hides chat ("Show chat" off), or its player's own lines stay off their character.
+    ...(url.searchParams.get('chat') === '0' ? { chatOff: true } : {}),
+    ...(url.searchParams.get('bub') === '0' ? { bubbleOff: true } : {}),
     ...(device ? { device } : {}),
     want,
     ...(watching ? { watch: true, follow: /^\d+$/.test(follow) ? Number(follow) : follow, watchPolicy: policy } : {}),
@@ -426,6 +467,9 @@ async function gameDocument(request, env, url, game, meta, cat, { agent = null }
     ...(meta?.movement ? { movement: meta.movement } : {}),
     // game.json "saves": the play shell around this frame answers @homie-rocks/studio/saves (saves/SAVES.md).
     ...(meta?.saves && want === 'play' ? { saves: true } : {}),
+    // The studio sells something in this game (shop/SHOP.md): the play shell answers @homie-rocks/studio/shop. A
+    // watcher has no shop; the shell itself says "kids" on a kids server and shows only a code on a television.
+    ...(!agent && !watching && shellShop(cat, game) ? { shop: true } : {}),
   };
   let html = await res.text();
   const head = `<script>window.HOMIE_NET=${JSON.stringify(cfg).replace(/</g, '\\u003c')}</script>`;
@@ -504,7 +548,18 @@ function finish(res, path) {
 
 export default {
   async fetch(request, env, ctx) {
-    return finish(await route(request, env, ctx), new URL(request.url).pathname);
+    const url = new URL(request.url);
+    const res = finish(await route(request, env, ctx), url.pathname);
+    // A referral's arrival (worker/referrals.mjs): only a person's page load with ?via= of another site, on a studio
+    // that pays referrals. The page is answered first; a cookie is added to it only then.
+    if (url.searchParams.has('via') && res && res.status === 200 && /text\/html/i.test(res.headers.get('content-type') ?? '')) {
+      try {
+        const cat = await catalogue(env, url.origin);
+        const cookie = await arrivalCookie(request, env, url, shopOf(cat));
+        if (cookie) { const out = new Response(res.body, res); out.headers.append('set-cookie', cookie); return out; }
+      } catch { /* an arrival is never worth a failed page */ }
+    }
+    return res;
   },
 };
 
@@ -527,6 +582,11 @@ async function route(request, env, ctx) {
   }
   if (path.startsWith('/_studio/')) return (await officeRoutes(request, env, url, { catalogueOf: getAll })) ?? ownerRoutes(request, env, url, { catalogueOf: getAll });
   if (path === '/__homie' || path.startsWith('/__homie/')) return notAHomie(request);
+  // The shop (0.24.0) before player accounts: /api/player/owns is the shop's.
+  {
+    const shopped = await shopRoutes(request, env, ctx, url, { catalogueOf: getAll });
+    if (shopped) return shopped;
+  }
   if (path.startsWith('/api/player/') || path === '/account' || path === '/account/' || path === '/_homie/account.js') return playerRoutes(request, env, ctx, url, { catalogueOf: getCat });
   if (path === '/_homie/site.js') return new Response(SITE_JS, { headers: { 'content-type': 'text/javascript; charset=utf-8', 'cache-control': url.searchParams.get('v') === STUDIO_VERSION_TAG ? 'public, max-age=31536000, immutable' : 'public, max-age=300', 'x-content-type-options': 'nosniff' } });
   if (path === '/api/stats/beat' && request.method === 'POST') return mediaBeat(request, env, ctx, url);
@@ -587,6 +647,10 @@ async function route(request, env, ctx) {
       ...(shareRooms ? { rooms: `${url.origin}/api/rooms` } : {}),
       // Shared only when studio.json says `stats.share`: two numbers for the whole studio, for the hub.
       ...(played ? { played } : {}),
+      // The shop (0.24.0): whether it sells and its till, never a key or a sale; and referrals: this studio takes
+      // signed statements as a referrer, with the public half of its statement key and, if it sells, its terms.
+      ...(shopOf(cat)?.open ? { shop: { open: true, till: shopOf(cat).till, currency: shopOf(cat).currency, page: `${url.origin}/shop/` } } : {}),
+      ...(await manifestReferrals(env, url.origin, shopOf(cat), cat.studio).then((r) => (r ? { referrals: r } : {})).catch(() => ({}))),
     }, 200, { 'access-control-allow-origin': '*' });
   }
   if (path === '/api/games') {
@@ -850,11 +914,15 @@ async function route(request, env, ctx) {
         const local = isLocalOrigin(url.origin);
         let qr = null;
         if (!local) try { qr = qrSvg(joinUrl, { title: `Join ${meta.name ?? game}` }); } catch { /* too long for a QR: the address shows as text */ }
-        return playPage(cat, meta, { screen: true, joinUrl, qr, local, room, ticket, owner: d.owner, launch, server });
+        // The shop on a television is a code to buy on a phone (the TV never sells; never on a kids server).
+        const sh = shellShop(cat, game, { kids: pol.kids });
+        let shopQr = null;
+        if (sh && !local) try { shopQr = qrSvg(`${url.origin}/shop/?game=${encodeURIComponent(game)}`, { title: `Shop: ${meta.name ?? game}` }); } catch { shopQr = null; }
+        return playPage(cat, meta, { screen: true, joinUrl, qr, local, room, ticket, owner: d.owner, launch, server, shop: sh ? { ...sh, qr: shopQr, url: `${url.origin}/shop/?game=${game}` } : null });
       }
       await countVisit(request, env, ctx, game, 'play');
       shareDaily(cat, url, ctx);
-      return playPage(cat, meta, { ticket, owner: d.owner, launch, server });
+      return playPage(cat, meta, { ticket, owner: d.owner, launch, server, ...(await chatWho(env, game, srv, d.acct)), shop: shellShop(cat, game, { kids: pol.kids }) });
     }
     if (sub === 'watch') {
       // The same door as Play: a game that is private or an invite-only beta is watched only by whoever may play it.
@@ -871,7 +939,7 @@ async function route(request, env, ctx) {
       const ticket = d.holder ? await ticketFor(env, game, d.holder) : null;
       await countVisit(request, env, ctx, game, 'watch');
       shareDaily(cat, url, ctx);
-      return watchPage(cat, meta, { room: asked, ticket, policy });
+      return watchPage(cat, meta, { room: asked, ticket, policy, owner: d.owner, ...(await chatWho(env, game, srv, d.acct)) });
     }
     if (sub === 'api/watch') {
       if (!door.ok || watchOf(meta) === 'off') return json({ ok: false, error: 'not-found' }, 404);
@@ -912,6 +980,27 @@ async function route(request, env, ctx) {
         },
       });
     }
+    if (sub === 'api/chat/report') {
+      // A player reports one chat line (section 19): the room's own copy of it is what is kept, never the reporter's words.
+      if (request.method !== 'POST' || !sameOrigin(request, url)) return json({ ok: false, error: 'origin', message: 'a report comes from this site\'s own pages' }, 403);
+      if (!door.ok) return json({ ok: false, error: 'not-found' }, 404);
+      let body = {};
+      try { body = JSON.parse((await request.text()).slice(0, 2048) || '{}'); } catch { return json({ ok: false, error: 'json' }, 400); }
+      const room = String(body.room ?? '');
+      const id = String(body.id ?? '');
+      if (!ROOM_ID.test(room) || !/^[A-Za-z0-9_-]{1,16}$/.test(id)) return json({ ok: false, error: 'bad-request', message: 'room and id name the message' }, 400);
+      const reason = REPORT_REASONS.includes(body.reason) ? body.reason : 'other';
+      const key = `${BROWSER_KEY.test(String(body.b ?? '')) ? body.b : ''}|${request.headers.get('cf-connecting-ip') ?? ''}`;
+      if (!reportAllowed(key)) return json({ ok: false, error: 'rate', message: 'That is a lot of reports: the studio has them. Try again in a few minutes.' }, 429);
+      let line = null;
+      try { line = (await (await env.TABLE.get(env.TABLE.idFromName(`${game}/${room}`)).fetch(`https://table/__chat?game=${encodeURIComponent(game)}&room=${encodeURIComponent(room)}&max=${max}&op=line&id=${encodeURIComponent(id)}`)).json()).line ?? null; } catch { line = null; }
+      if (!line) return json({ ok: false, error: 'gone', message: 'That message is no longer in the room.' }, 404);
+      if (line.by === 'studio') return json({ ok: false, error: 'studio', message: 'That is the studio\'s own line.' }, 400);
+      try { await fileReport(env, { game, room, line, reason }); } catch (error) {
+        return json({ ok: false, error: 'not-migrated', message: `Reports need migration 0007_studio_chat.sql (npm run deploy). (${String(error?.message ?? error).slice(0, 120)})` }, 503);
+      }
+      return json({ ok: true, message: 'Thanks for telling the studio. They will look at it.' });
+    }
     if (sub === '__net' || sub === '__watch') {
       if (request.headers.get('upgrade') !== 'websocket') return new Response('websocket only', { status: 426 });
       const room = url.searchParams.get('room') || 'main';
@@ -942,8 +1031,19 @@ async function route(request, env, ctx) {
         const access = await serverAccess(env, { game, server: srv, holders: parts, watching: w || sub === '__watch' });
         if (!access.ok) return new Response('this server is not open to you', { status: 403 });
       }
+      // Room chat (section 19): the room's rules, and who this socket is to them: an account with a passkey (not a
+      // guest), a member of this server, or another site's page watching from elsewhere (homie.rocks's room page).
+      const chat = chatOf(meta, srv, await chatRowsOf(env));
+      const { acct, member } = await chatWho(env, game, srv, who);
+      const origin = request.headers.get('origin');
+      const hub = sub === '__watch' && Boolean(origin) && origin !== 'null' && origin !== url.origin;
+      const lean = { ...chat, emoji: chat.emoji.filter((e) => !REACTIONS.some((r) => r.k === e.k)) };
+      // A supporter's badge (the shop, 0.24.0): what the player's account owns, looked up here, so a hello can never claim
+      // one; none on a kids server, none for an AI or a watcher.
+      const pid = !ag && !w && sub === '__net' ? parts.find((x) => x.startsWith('p-'))?.slice(2) : null;
+      const badge = pid ? await roomBadge(env, cat, pid, { kids: pol.kids }) : null;
       const stub = env.TABLE.get(env.TABLE.idFromName(`${game}/${room}`));
-      const target = `https://table/${sub}?game=${encodeURIComponent(game)}&room=${encodeURIComponent(room)}&max=${max}${b ? `&b=${b}` : ''}${who ? `&via=${encodeURIComponent(who)}` : ''}${sub === '__net' ? `&wp=${policy}${w ? '&w=1' : ''}` : ''}&pol=${encodeFacts(pol)}${ag ? `&ag=${encodeFacts(ag)}` : ''}`;
+      const target = `https://table/${sub}?game=${encodeURIComponent(game)}&room=${encodeURIComponent(room)}&max=${max}${b ? `&b=${b}` : ''}${who ? `&via=${encodeURIComponent(who)}` : ''}${sub === '__net' ? `&wp=${policy}${w ? '&w=1' : ''}` : ''}&pol=${encodeFacts(pol)}&chat=${encodeFacts(lean)}${acct ? '&acct=1' : ''}${member ? '&mem=1' : ''}${hub ? '&hub=1' : ''}${ag ? `&ag=${encodeFacts(ag)}` : ''}${badge ? `&bd=${encodeURIComponent(badge)}` : ''}`;
       return stub.fetch(new Request(target, request));
     }
     // The same knock, relative to the game's own page: the same answer (see notAHomie).
@@ -1031,6 +1131,12 @@ export class Table {
     this.brainUsed = { neurons: 0, micros: 0 };
     this.brainPending = { calls: {}, neurons: 0, micros: 0 };
     this.brainReadAt = 0;
+    /** Room chat's review (section 19): the studio's day (budget and use, read at most once a minute) and what is not counted yet. */
+    this.chatCap = null;
+    this.chatUsed = 0;
+    this.chatReadAt = 0;
+    this.chatPend = { neurons: 0, ok: 0, held: 0, error: 0 };
+    this.chatSent = { chatLines: 0, chatReacts: 0, held: {} };
     ctx.blockConcurrencyWhile(async () => {
       this.saved = (await ctx.storage.get('net')) ?? null;
       this.recorded = (await ctx.storage.get('recorded')) ?? 0;
@@ -1055,9 +1161,63 @@ export class Table {
     if (this.saved) this.room.restore(this.saved);
     if (this.officeSaved) this.room.restoreOffice(this.officeSaved);
     this.vocabRead = this.readVocab(game).catch(() => false);
+    // Room chat (section 19): typed text the floor let through waits for the studio's own Workers AI.
+    this.room.review = (text, opts) => this.reviewChat(text, opts);
     return this.room;
   }
 
+  /**
+   * One typed chat message, reviewed by the studio's decision model (worker/chat.mjs reviewChat) within the day's
+   * budget for the whole studio. No binding (`homie-studio dev` without --remote-ai), no budget left, or an error: the
+   * floor alone has decided (`by` says which), and the message goes out.
+   */
+  async reviewChat(text, { links = 'block' } = {}) {
+    if (!this.env.AI) return { ok: true, by: 'none' };
+    if (this.chatCap === null || Date.now() - this.chatReadAt > 60_000) await this.readChatDay().catch(() => {});
+    if (this.chatUsed >= (this.chatCap ?? 0)) return { ok: true, by: 'budget' };
+    try {
+      const v = await reviewChat(this.env, text, { links });
+      this.chatUsed += v.neurons;
+      this.chatPend.neurons += v.neurons;
+      this.chatPend[v.ok ? 'ok' : 'held'] += 1;
+      return { ok: v.ok, by: 'ai', why: v.why, ms: v.ms, p: v.p };
+    } catch (error) {
+      this.chatPend.error += 1;
+      try { console.log(JSON.stringify({ ev: 'chat-review-failed', room: this.code, error: String(error?.message ?? error).slice(0, 200) })); } catch { /* no console */ }
+      return { ok: true, by: 'error' };
+    }
+  }
+
+  async readChatDay() {
+    const day = await chatDay(this.env, today());
+    this.chatCap = day.budget.neurons;
+    this.chatUsed = day.used.neurons + this.chatPend.neurons;
+    this.chatReadAt = Date.now();
+  }
+
+  /** Chat's counts into D1 (stats_daily): lines, reactions, held by why, reviews and neurons. Never a message or a sender. */
+  async flushChat() {
+    const s = this.room?.stats;
+    if (!s || !this.env.DB) return;
+    const game = this.game ?? '';
+    const rows = [];
+    for (const [k, metric] of [['chatLines', 'chat-lines'], ['chatReacts', 'chat-reacts']]) {
+      const d = (s[k] ?? 0) - (this.chatSent[k] ?? 0);
+      if (d > 0) { rows.push(counter(this.env, { metric, subject: game, n: d })); this.chatSent[k] = s[k]; }
+    }
+    for (const [why, n] of Object.entries(s.chatHeld ?? {})) {
+      const d = n - (this.chatSent.held[why] ?? 0);
+      if (d > 0) { rows.push(counter(this.env, { metric: 'chat-held', subject: game, source: why, n: d })); this.chatSent.held[why] = n; }
+    }
+    const p = this.chatPend;
+    for (const k of ['ok', 'held', 'error']) if (p[k]) rows.push(counter(this.env, { metric: 'chat-reviews', subject: game, source: k, n: p[k] }));
+    const neurons = Math.floor(p.neurons);
+    if (neurons) rows.push(counter(this.env, { metric: 'chat-neurons', subject: game, n: neurons }));
+    this.chatPend = { neurons: p.neurons - neurons, ok: 0, held: 0, error: 0 };
+    const list = rows.filter(Boolean);
+    if (list.length) await this.env.DB.batch(list).catch(() => {});
+  }
+
   /** The game's agents.json from the build (the only words an AI in this room may say), once. */
   async readVocab(game) {
     if (!this.env.ASSETS || !/^[a-z0-9][a-z0-9-]{0,39}$/.test(String(game ?? ''))) return false;
@@ -1156,6 +1316,12 @@ export class Table {
     // The back office (worker/office.mjs), from the studio's Worker only: the room as its owner sees it, and the
     // owner's signed controls, which this room verifies before it applies one (NETPLAY.md section 15).
     if (url.pathname === '/__facts') return json({ ...room.officeFacts(), ...(this.house ? { brains: this.house.facts() } : {}) });
+    // A chat line as the room keeps it (section 19), for a report: the Worker files the room's own copy, never a reporter's.
+    if (url.pathname === '/__chat') {
+      const id = url.searchParams.get('id');
+      const r = room.chatLog.find((x) => x.id === id);
+      return json({ ok: Boolean(r), line: r ? { id: r.id, kind: r.kind, text: r.text ?? null, glyph: r.glyph ?? null, name: r.name, seat: r.seat, at: r.at, by: r.by, player: r.from?.player ?? null } : null });
+    }
     if (url.pathname === '/__office') {
       const ctl = await request.json().catch(() => null);
       const why = await verifyControl(this.env, ctl, { game: this.game, room: this.code }, this.seen);
@@ -1172,6 +1338,9 @@ export class Table {
     if (room.seatCap !== max) room.setSeats(max, perAddress(max));
     // The room's policy (section 17), composed by the Worker for every socket: a newer one than the room's applies.
     const pol = decodeFacts(url.searchParams.get('pol'));
+    // The room's chat rules ride beside it (they may be longer than a policy): section 19.
+    const chatRules = decodeFacts(url.searchParams.get('chat'), 16384);
+    if (pol && chatRules && typeof chatRules === 'object') pol.chat = chatRules;
     if (pol) room.setPolicy(pol);
     if (this.house) this.house.sync();
     const agent = decodeFacts(url.searchParams.get('ag'));
@@ -1188,14 +1357,25 @@ export class Table {
       watch: url.searchParams.get('w') === '1',
       // An AI with a pass the Worker verified (section 17): its pass, role, hands and name. Only the Worker sets it.
       ...(agent && typeof agent === 'object' && url.pathname === '/__net' ? { agent } : {}),
+      // A badge the player's account owns (the shop): the Worker looked it up; a hello cannot set one.
+      ...(url.pathname === '/__net' && /^[\p{L}\p{N} .'&+-]{1,16}$/u.test(url.searchParams.get('bd') ?? '') ? { badge: url.searchParams.get('bd') } : {}),
       watchPolicy: WATCH_POLICIES.includes(url.searchParams.get('wp')) ? url.searchParams.get('wp') : 'follow',
       // House QA and `homie-studio check` mark their browsers; their rooms, rounds and peaks are not the studio's numbers.
       qa: isQa(request),
+      // Room chat (section 19), the Worker's word: a signed-in account (a passkey), a member of this server, a page of
+      // another site (homie.rocks's room page) watching from elsewhere.
+      acct: url.searchParams.get('acct') === '1',
+      member: url.searchParams.get('mem') === '1',
+      hub: url.pathname === '/__watch' && url.searchParams.get('hub') === '1',
       send: (text) => { try { server.send(text); } catch { /* closed */ } },
       close: (c, r) => { try { server.close(c, r); } catch { /* closed */ } },
       buffered: () => 0,
     };
     if (url.pathname === '/__watch') {
+      // Watching shells are cheap (outgoing is free) but not free: a room holds at most 256, and 24 from one address
+      // (room chat, 0.23.0: another site's page can open one too).
+      const same = conn.ip ? [...room.watchers].filter((x) => x.ip === conn.ip).length : 0;
+      if (room.watchers.size >= 256 || same >= 24) { try { server.close(1013, 'too many watching'); } catch { /* gone */ } return new Response(null, { status: 101, webSocket: client }); }
       const w = room.watch(conn);
       // The play page's vote card speaks on this socket (section 17); nothing else it says is read.
       server.addEventListener('message', (e) => { if (typeof e.data === 'string') w.onMessage(e.data); });
@@ -1247,8 +1427,10 @@ export class Table {
       if (room.officeDirty) { room.officeDirty = false; this.ctx.storage.put('office', room.officeSaved()).catch(() => {}); }
       n += 1;
       if (n % 4 === 0) { room.tellWatchers(); this.report(); this.recordRound(); this.syncHouse(); }
+      // Room chat's counts, once a minute (section 19).
+      if (n % 240 === 0) this.ctx.waitUntil(this.flushChat().catch(() => {}));
       if (room.seats.size === 0 && room.clients.size === 0) this.openCounted = false;
-      if (room.clients.size === 0 && room.watchers.size === 0) { clearInterval(this.timer); this.timer = null; this.report(); if (this.house) { this.ctx.waitUntil(this.flushBrain(true).catch(() => {})); this.house = null; } }
+      if (room.clients.size === 0 && room.watchers.size === 0) { clearInterval(this.timer); this.timer = null; this.report(); this.ctx.waitUntil(this.flushChat().catch(() => {})); if (this.house) { this.ctx.waitUntil(this.flushBrain(true).catch(() => {})); this.house = null; } }
     }, 250);
   }
 

package/worker/office-page.mjs

@@ -10,7 +10,7 @@ import { SKILLS } from './agents.mjs';
 import { KIDS_LINE, POLICY_WORDS, SERVER_LIMITS } from './servers.mjs';
 import { esc } from './site.mjs';
 
-const PRIVATE = {
+export const PRIVATE = {
   'content-type': 'text/html; charset=utf-8',
   'cache-control': 'no-store, private',
   'x-robots-tag': 'noindex, nofollow',
@@ -105,6 +105,16 @@ button.small { min-height: 30px; padding: 4px 10px; font-size: 13px; border-radi
 .warnbox { margin: 10px 16px; padding: 10px 12px; border-radius: 12px; border: 1px solid rgba(255,179,92,.45); color: var(--warn); font-size: 14px; }
 .secret { font: 600 13px/1.4 ui-monospace, Menlo, monospace; word-break: break-all; padding: 10px; border-radius: 10px; background: var(--bg); border: 1px solid var(--warn); }
 .chip.ai { color: #ffe7a8; border-color: rgba(255,207,90,.6); }
+/* Room chat (0.23.0): a room's last minutes, and each game's rules and reports. */
+.chatlog { margin-top: 10px; padding: 10px 12px; border-radius: 12px; background: var(--bg); border: 1px solid var(--line); }
+.chatlog h4 { margin: 0 0 6px; font-size: 12px; letter-spacing: .09em; text-transform: uppercase; color: var(--dim); }
+.chatlog .cl { display: grid; grid-template-columns: minmax(80px, auto) minmax(0, 1fr) auto auto; gap: 4px 10px; align-items: center; padding: 6px 0; border-top: 1px dashed var(--line); font-size: 14px; }
+.chatlog .cl:first-of-type { border-top: 0; }
+.chatlog .cl .txt { overflow-wrap: anywhere; }
+.chatlog .cl.react .txt { font-size: 18px; }
+.chatlog .cl.studio b { color: var(--accent); }
+.chatbox .inv span { overflow-wrap: anywhere; }
+@media (max-width: 720px) { .chatlog .cl { grid-template-columns: 1fr; } }
 /* The New server form: one panel, grouped, every control labelled, help under it in the office's quiet grey. */
 .newsrv { display: grid; gap: 16px; max-width: 820px; margin-top: 10px; padding: 16px; border-radius: 14px; background: var(--panel2); border: 1px solid var(--line); }
 .newsrv [hidden] { display: none !important; }
@@ -588,6 +598,103 @@ export const OFFICE_SCRIPT = String.raw`(function () {
     return box;
   }
 
+  /* ---------------------------------------------------------------- room chat (0.23.0, NETPLAY.md section 19) */
+  var CHAT_MODES = [['off', 'Off'], ['emoji', 'Emoji'], ['lines', 'Emoji + quick lines'], ['text', 'Typing too']];
+  var CHAT_WHO = [['anyone', 'Anyone'], ['signed-in', 'Signed in'], ['members', 'Members']];
+  var CHAT_MODE_HELP = { off: 'No chat at all in this game\'s rooms.', emoji: 'Players and watchers send the five reactions (and the game\'s own); they float up every screen.', lines: 'Reactions and the game\'s own quick lines ("Good game!"): nothing anyone types. What a kids or beginner server always keeps to.', text: 'Reactions, quick lines and typed messages. Every typed message passes the word list first, and this studio\'s Workers AI when the review is on.' };
+  function ago(ms) { var s = Math.max(0, Math.round(ms / 1000)); return s < 60 ? s + ' s ago' : Math.round(s / 60) + ' min ago'; }
+  /** The game's chat rules (for the whole game, or one server), the review's day, and the reports players made. */
+  function chatBox(g) {
+    var c = g.chat || {};
+    var box = el('div', 'servers chatbox');
+    var key = g.id + '/chat';
+    var d = S.drafts[key] || (S.drafts[key] = { server: '' });
+    var target = d.server ? ((c.servers || []).filter(function (x) { return x.id === d.server; })[0] || {}) : null;
+    var r = Object.assign({}, (target && target.rules) || c.rules || {}, d.edit || {});
+    var head = el('h3', '', 'Room chat');
+    var summary = el('div', 'line dim');
+    var from = c.from === 'office' ? 'your rules' : c.from === 'game.json' ? 'the game\'s game.json' : 'Homie\'s defaults';
+    summary.textContent = (c.rules ? ({ off: 'Off', emoji: 'Emoji only', lines: 'Emoji and quick lines', text: 'Typing allowed' }[c.rules.mode] || c.rules.mode) : '–') + (c.rules && c.rules.mode === 'text' ? ' · typing: ' + c.rules.who + (c.rules.ai ? ' · AI review on' : ' · word list only') : '') + ' · from ' + from + '.';
+    add(box, head, summary);
+    if (!S.open[key]) {
+      add(box, add(el('div', 'line'), btn('Change chat rules', 'ghost small', function () { S.open[key] = true; render(); })));
+    } else {
+      var form = el('form', 'newsrv');
+      var scope = sel([['', 'The whole game']].concat((g.servers || []).map(function (x) { return [x.id, 'Server: ' + x.name]; })), d.server, 'Rules for');
+      scope.onchange = function () { d.server = scope.value; d.edit = {}; render(); };
+      var set = function (k, v) { d.edit = d.edit || {}; d.edit[k] = v; };
+      var mode = segment(g.id + 'cmode', CHAT_MODES, r.mode, 'What chat allows', function (v) { set('mode', v); help.textContent = CHAT_MODE_HELP[v]; });
+      var help = el('p', 'help', CHAT_MODE_HELP[r.mode] || '');
+      var who = segment(g.id + 'cwho', CHAT_WHO, r.who, 'Who may type', function (v) { set('who', v); });
+      var react = segment(g.id + 'creact', CHAT_WHO, r.react, 'Who may react', function (v) { set('react', v); });
+      var slow = num(r.slow === undefined ? 2 : r.slow, 0, 120, 'Slow mode, seconds'); slow.onchange = function () { set('slow', Number(slow.value)); };
+      var max = num(r.max || 140, 20, 280, 'Longest message'); max.onchange = function () { set('max', Number(max.value)); };
+      var check = function (k, label, on) { var x = el('input'); x.type = 'checkbox'; x.checked = Boolean(on); x.onchange = function () { set(k, x.checked); }; return add(el('label', 'check'), x, el('span', '', label)); };
+      var words = el('input'); words.type = 'text'; words.placeholder = 'Words to hold, comma separated (word* holds it inside words too)'; words.value = (d.edit && d.edit.block !== undefined ? d.edit.block : (target ? (target.office || {}).block : (c.office || {}).block) || []).join(', ');
+      words.onchange = function () { set('block', words.value.split(',').map(function (w) { return w.trim(); }).filter(Boolean)); };
+      add(form,
+        row('Rules for', null, scope, el('p', 'help', 'A server\'s rules sit over the game\'s; a kids or beginner server always keeps chat to emoji and quick lines.')),
+        row('Chat', null, mode.box, help),
+        row('Who may type', null, who.box, el('p', 'help', 'Signed in: a player account with a passkey (no password, no email). Members: players who belong to the room\'s server.')),
+        row('Emoji and lines', null, react.box, el('p', 'help', 'Who may send reactions and quick lines. Anyone keeps the room lively for guests.')),
+        row('Slow mode', null, add(el('div', 'line'), slow, el('span', 'dim', 'seconds between one person\'s messages')), null),
+        row('Longest message', null, add(el('div', 'line'), max, el('span', 'dim', 'characters')), null),
+        row('Checks', null, add(el('div', 'ctl'),
+          check('ai', 'Review typed messages with this studio\'s Workers AI (Cloudflare\'s Clef decision model)', r.ai !== false),
+          check('links', 'Allow links (they are never clickable)', r.links === 'allow'),
+          check('swears', 'Allow swearing (slurs, sexual words and threats are always held)', r.swears === 'allow')), el('p', 'help', 'The word list always runs, and needs nothing. The review adds what a list misses (bullying, a stranger asking a kid where they live), within a day\'s budget of Cloudflare\'s free allocation; past it, the word list alone decides.')),
+        row('Your words', null, words, null),
+        row('Shown', null, add(el('div', 'ctl'),
+          check('bubbles', 'Over the speaker\'s character, in games that draw it', r.bubbles !== false),
+          check('watchers', 'Watchers may send too (not just read)', r.watchers !== false),
+          check('hub', 'On homie.rocks\'s page for the room', r.hub !== false)), null));
+      var acts = el('div', 'acts');
+      add(acts,
+        btn('Save', '', function () {
+          var body = Object.assign({ game: g.id }, d.server ? { server: d.server } : {}, d.edit || {});
+          if (Object.keys(d.edit || {}).length === 0) { toast('Nothing changed.'); return; }
+          act('/_studio/api/chat/rules', body, 'Chat rules saved: every live room has them now.').then(function (res) { if (res && res.ok) { d.edit = {}; S.open[key] = false; } });
+        }),
+        btn('Back to the game\'s own', 'ghost', function () { act('/_studio/api/chat/rules', Object.assign({ game: g.id, reset: true }, d.server ? { server: d.server } : {}), 'Back to the game\'s own chat rules.').then(function () { d.edit = {}; }); }),
+        btn('Close', 'ghost', function () { S.open[key] = false; d.edit = {}; render(); }));
+      form.appendChild(acts);
+      form.onsubmit = function (e) { e.preventDefault(); };
+      box.appendChild(form);
+    }
+    // What players reported: one message each, kept 30 days or until you dismiss it.
+    var reps = c.reports || [];
+    if (reps.length) {
+      add(box, el('h3', '', 'Reports (' + reps.length + ')'));
+      reps.forEach(function (p) {
+        var rowEl = el('div', 'inv');
+        add(rowEl, el('b', '', p.name || 'Someone'), el('span', '', '"' + p.text + '"'), el('span', 'chip muted', p.reasonText || p.reason), el('span', 'faint', p.room + ' · ' + ago(Date.now() - (S.skew || 0) - p.at)), p.player ? el('span', 'faint', 'account ' + p.player.slice(0, 10) + '…') : null,
+          btn('Dismiss', 'ghost small', function () { act('/_studio/api/chat/report', { id: p.id }, 'Report dismissed (deleted).'); }));
+        box.appendChild(rowEl);
+      });
+    }
+    return box;
+  }
+  /** A room's last minutes of chat, with Remove, Mute and Kick from a line. */
+  function roomChat(g, r, now) {
+    var ch = r.chat;
+    if (!ch || !(ch.lines || []).length) return null;
+    var box = el('div', 'chatlog');
+    add(box, el('h4', '', 'Chat · last ' + ch.lines.length + (ch.lines.length === 1 ? ' message' : ' messages')));
+    ch.lines.slice().reverse().slice(0, 20).forEach(function (l) {
+      var rowEl = el('div', 'cl' + (l.kind === 'react' ? ' react' : '') + (l.by === 'studio' ? ' studio' : ''));
+      add(rowEl, el('b', '', l.by === 'studio' ? 'Studio' : l.name), el('span', 'txt', l.kind === 'react' ? (l.glyph || '') : (l.text || '')),
+        el('span', 'faint', ago(now - l.at) + (l.by === 'watcher' ? ' · watching' : l.by === 'hub' ? ' · on homie.rocks' : l.seat !== null && l.seat !== undefined ? ' · seat ' + (l.seat + 1) : '') + (l.review && l.review.by === 'ai' ? ' · reviewed' : '')));
+      if (l.by !== 'studio') {
+        add(rowEl, add(el('span', 'pacts'),
+          btn('Remove', 'ghost small', function () { act('/_studio/api/chat/remove', { game: g.id, room: r.room, id: l.id }, 'Removed from every screen.'); }),
+          btn('Mute', 'warn small', function () { act('/_studio/api/mute', { game: g.id, room: r.room, line: l.id, minutes: hold(), purge: true }, (l.name || 'They') + ' is muted for ' + hold() + ' min; their messages are down.'); }),
+          armed('Kick', 'bad', function () { act('/_studio/api/kick', { game: g.id, room: r.room, line: l.id, minutes: hold(), purge: true }, (l.name || 'They') + ' was removed from ' + r.label + ' for ' + hold() + ' min.'); })));
+      }
+      box.appendChild(rowEl);
+    });
+    return box;
+  }
+
   function person(g, r, c, now) {
     var row = el('div', 'person');
     var who = el('div', 'who');
@@ -649,6 +756,8 @@ export const OFFICE_SCRIPT = String.raw`(function () {
         people.appendChild(el('div', 'held', 'Guides\' brain: ' + (r.brains.brain || 'script') + (r.brains.why ? ' · ' + r.brains.why : '') + ' · ' + r.brains.calls + ' calls' + (last.length ? ' · ' + last.join('; ') : '')));
       }
       (r.bans || []).forEach(function (b) { people.appendChild(el('div', 'held', 'Kicked: ' + (b.name || 'someone') + ', may come back in ' + dur(b.until - now) + (b.address ? ' (their network too)' : ''))); });
+      var said = roomChat(g, r, now);
+      if (said) people.appendChild(said);
       box.appendChild(people);
     }
     return box;
@@ -662,6 +771,10 @@ export const OFFICE_SCRIPT = String.raw`(function () {
     document.getElementById('livedot').className = 'dot' + (d.playing ? ' on' : '');
     var at = document.activeElement;
     var focus = at && root.contains(at) && (/INPUT|SELECT/.test(at.tagName) || Boolean(at.closest && at.closest('.newsrv')));
+    // The day's chat review across the studio: what it used of its budget, and what it held.
+    var cd = d.chat;
+    var chatEl = document.getElementById('chatday');
+    if (chatEl && cd) chatEl.textContent = 'Chat review today: ' + (cd.ai ? Math.round(cd.used.neurons).toLocaleString() + ' of ' + Math.round(cd.budget.neurons).toLocaleString() + ' neurons, ' + cd.used.reviews + ' reviewed, ' + cd.used.held + ' held' + (cd.used.errors ? ', ' + cd.used.errors + ' unanswered (the word list decided)' : '') : 'off (no Workers AI binding on this Worker yet: deploy once more; the word list decides meanwhile)') + '.';
     // Never redraw under a typing owner (or one working in the New server form), a control waiting for its second
     // tap, or a pass secret shown once.
     if (focus || root.querySelector('[data-armed="1"]') || root.querySelector('.secret')) return;
@@ -676,6 +789,7 @@ export const OFFICE_SCRIPT = String.raw`(function () {
       // A build from before servers (netplay rev 5 or older): what it cannot do yet, and the fix.
       if (g.build && g.build.predates && (g.servers || []).some(function (x) { return x.id !== 'public' && (x.aiSeats || x.guides); })) card.appendChild(el('div', 'warnbox', 'This build predates servers (netplay rev ' + (g.build.netplayRev || '5 or older') + '): reserved AI seats stay empty and its bots don\'t read the dial. Rebuild with @homie-rocks/studio 0.16.'));
       card.appendChild(serversBox(g));
+      card.appendChild(chatBox(g));
       card.appendChild(passes(g));
       if (g.launch === 'invite' || (g.invites && g.invites.length)) card.appendChild(invites(g));
       var rooms = el('div', 'rooms');
@@ -718,7 +832,7 @@ async function officeScriptHash() {
   return scriptHash;
 }
 
-function shell(cat, title, body, { status = 200, script = null, extra = {} } = {}) {
+export function shell(cat, title, body, { status = 200, script = null, extra = {} } = {}) {
   return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
 <meta name="robots" content="noindex, nofollow"><title>${esc(title)}</title><style>:root{--accent:${accentOf(cat)}}${CSS}</style></head><body><div class="wrap">${body}</div>${script ? `<script>${script}</script>` : ''}</body></html>`;
 }
@@ -728,12 +842,13 @@ export async function officePage(cat, headers = {}) {
   const name = cat.studio?.name ?? 'Studio';
   const options = (cat.games ?? []).map((g) => `<option value="${esc(g.id)}">every room of ${esc(g.name)}</option>`).join('');
   const body = `<header class="top"><h1>${esc(name)} <small>Office</small></h1>
-<div class="links"><span class="live"><i class="dot" id="livedot"></i><span id="live">…</span></span><a href="/_studio/stats">Stats</a>
+<div class="links"><span class="live"><i class="dot" id="livedot"></i><span id="live">…</span></span><a href="/_studio/stats">Stats</a>${cat.shop ? '<a href="/_studio/office/shop">Shop</a>' : ''}
 <form method="post" action="/_studio/signout" style="display:inline"><button class="ghost small" type="submit">Sign out</button></form></div></header>
 <form class="bar" id="announce-all"><label for="announce-text">Announce</label><input type="text" id="announce-text" maxlength="280" placeholder="A line every player sees, in the game" autocomplete="off">
 <select id="announce-scope" aria-label="Who sees it"><option value="">every room of every game</option>${options}</select><button type="submit">Send</button>
 <label for="hold" style="margin-left:auto">Kick, mute and close for</label><select id="hold"><option value="5">5 min</option><option value="10" selected>10 min</option><option value="30">30 min</option><option value="60">1 hour</option><option value="1440">a day</option></select></form>
 <p class="dim" id="status" role="status"></p>
+<p class="dim" id="chatday"></p>
 <div id="games" aria-live="polite"><p class="empty">Reading the rooms…</p></div>
 <div class="toast" id="toast" role="status" hidden></div>
 <p class="note">Servers: each game's named room pools. Open: anyone, AI with a pass marked AI. Humans only: no AI at all. Hybrid: some seats in every room are AI companions; the party votes their level. Beginner: new players, AI guides, quick lines only. Changing a server reaches its live rooms at once; AI leave after the round when a server becomes humans-only.</p>
@@ -756,7 +871,7 @@ export function lockedPage(cat, { what = 'office', ask = null } = {}) {
   return new Response(shell(cat, `${what === 'confirm' ? 'Confirm' : 'Office'} · private`, body), { status: 401, headers: { ...PRIVATE, 'content-security-policy': NO_SCRIPT_CSP } });
 }
 
-const VERB = { kick: 'Kick', mute: 'Mute', close: 'Close the room', announce: 'Announce', game: 'Change it', 'server-set': 'Change it', 'server-close': 'Close it', member: 'Remove', 'agents-brain': 'Let them talk' };
+const VERB = { refund: 'Refund it', 'shop-settle': 'Mark it paid', kick: 'Kick', mute: 'Mute', close: 'Close the room', announce: 'Announce', game: 'Change it', 'server-set': 'Change it', 'server-close': 'Close it', member: 'Remove', 'agents-brain': 'Let them talk' };
 
 /** The owner's one tap for what their AI asked, and what came of it. */
 export function confirmPage(cat, ask, { missing = false } = {}) {
@@ -768,7 +883,7 @@ export function confirmPage(cat, ask, { missing = false } = {}) {
     const verb = ask.action?.op === 'mute' && ask.action.off ? 'Unmute' : ask.action?.op === 'close' && ask.action.reopen ? 'Open it again' : VERB[ask.action?.op] ?? 'Yes';
     body = `<h1>${esc(name)} <small>Your AI asks</small></h1>
 <p style="font-size:19px;line-height:1.45;max-width:46ch">${esc(ask.what)}</p>
-<form method="post" class="bar" style="background:transparent;border:0;padding:0"><button type="submit" name="do" value="yes" class="${['kick', 'close', 'server-close', 'member'].includes(ask.action?.op) && !ask.action?.reopen ? 'armed' : ''}">${esc(verb)}</button><button type="submit" name="do" value="no" class="ghost">No</button></form>
+<form method="post" class="bar" style="background:transparent;border:0;padding:0"><button type="submit" name="do" value="yes" class="${['kick', 'close', 'server-close', 'member', 'refund'].includes(ask.action?.op) && !ask.action?.reopen ? 'armed' : ''}">${esc(verb)}</button><button type="submit" name="do" value="no" class="ghost">No</button></form>
 <p class="note">Only you can confirm this: your AI asked through the studio's office key, which cannot say yes. It lasts until ${esc(new Date(ask.expiresAt).toISOString().slice(11, 16))} UTC.</p>`;
   } else {
     const said = { done: 'Done.', failed: 'That did not work.', cancelled: 'Not done: you said no.', expired: 'This ask ran out (15 minutes). Your AI can ask again.', working: 'Working on it…' }[ask.state] ?? ask.state;