@homie-rocks/studio 0.39.0 → 0.42.0

package/worker/functions.mjs

@@ -0,0 +1,93 @@
+import { services } from './mcp-tools.mjs';
+import { isOwner, sameOrigin } from './office.mjs';
+import { esc } from './site.mjs';
+let load = async () => [];
+export function useFunctions(loader) { load = loader; }
+export async function hasFunctionType(type) { return (await load()).some(fn=>fn.event===type); }
+export async function syncFunctions(env, definitions = null, now = Date.now()) {
+  definitions ??= await load();
+  if (!env.DB || !definitions.length) return definitions;
+  // Deploy owns the production registry; an old in-flight Worker must not overwrite it.
+  if(await env.DB.prepare("SELECT 1 FROM meta WHERE key='function-registry-deployed'").first())return definitions;
+  const statements=definitions.map(fn=>env.DB.prepare(`INSERT INTO function_subscriptions(name,type,cursor,started) VALUES(?1,?2,(SELECT COALESCE(MAX(seq),0) FROM studio_events),?3) ON CONFLICT(name) DO UPDATE SET type=excluded.type,cursor=excluded.cursor,started=excluded.started WHERE type!=excluded.type`).bind(fn.name,fn.event,now));
+  statements.push(env.DB.prepare(`DELETE FROM function_subscriptions WHERE name NOT IN (SELECT value FROM json_each(?1))`).bind(JSON.stringify(definitions.map(f=>f.name))));
+  await env.DB.batch(statements);
+  return definitions;
+}
+export async function emitEvent(env, type, data, {id = crypto.randomUUID(), at = Date.now()} = {}) {
+  await env.DB.prepare('INSERT OR IGNORE INTO studio_events(id,type,data,at) SELECT ?1,?2,?3,?4 WHERE EXISTS (SELECT 1 FROM function_subscriptions WHERE type=?2)').bind(id,type,JSON.stringify(data),at).run();
+  return id;
+}
+export async function replayFunction(env, name, definitions = null) {
+  definitions ??= await load();
+  if (!definitions.some(fn=>fn.name===name && fn.replay===true)) throw new Error('Declare replay: true before requesting retained history');
+  await env.DB.prepare('UPDATE function_subscriptions SET cursor=0 WHERE name=?1').bind(name).run();
+}
+export async function pruneEvents(env) {
+  // Visit a bounded sequence page even when millions of failed events remain.
+  const cursor=Number((await env.DB.prepare("SELECT value FROM meta WHERE key='function-prune-cursor'").first())?.value??0);
+  const rows=(await env.DB.prepare('SELECT seq,id FROM studio_events WHERE seq>?1 ORDER BY seq LIMIT 100').bind(cursor).all()).results;
+  const statements=rows.flatMap(({id})=>[
+    env.DB.prepare(`DELETE FROM function_deliveries WHERE event=?1 AND (state='complete' OR NOT EXISTS (SELECT 1 FROM function_subscriptions s WHERE s.name=function_deliveries.function))`).bind(id),
+    env.DB.prepare(`DELETE FROM studio_events WHERE id=?1 AND NOT EXISTS (SELECT 1 FROM function_subscriptions s WHERE s.type=studio_events.type AND s.cursor<studio_events.seq) AND NOT EXISTS (SELECT 1 FROM function_deliveries d WHERE d.event=studio_events.id)`).bind(id),
+  ]);
+  statements.push(env.DB.prepare("INSERT INTO meta(key,value) VALUES('function-prune-cursor',?1) ON CONFLICT(key) DO UPDATE SET value=excluded.value").bind(String(rows.at(-1)?.seq??0)));
+  await env.DB.batch(statements);
+}
+/** A lease is for retry after a crashed Worker, not a deadline imposed on studio code. */
+export async function runFunctions(env, cat, origin, {definitions, now = Date.now, leaseMs = 60000} = {}) {
+  definitions = await syncFunctions(env,definitions,now());
+  if(!definitions.length)return;
+  if(typeof cat==='function')cat=await cat();
+  for (const fn of definitions) {
+    const subscription=await env.DB.prepare('SELECT cursor,type FROM function_subscriptions WHERE name=?1').bind(fn.name).first();
+    if(!subscription || subscription.type!==fn.event)continue;
+    const page=(await env.DB.prepare('SELECT seq,id,data FROM studio_events WHERE type=?1 AND seq>?2 ORDER BY seq LIMIT 100').bind(fn.event,subscription.cursor).all()).results;
+    if(page.length)await env.DB.batch([
+      ...page.filter(e=>!fn.schedule||JSON.parse(e.data).function===fn.name).map(e=>env.DB.prepare('INSERT OR IGNORE INTO function_deliveries(event,function) SELECT id,?2 FROM studio_events WHERE id=?1').bind(e.id,fn.name)),
+      env.DB.prepare('UPDATE function_subscriptions SET cursor=MAX(cursor,?2) WHERE name=?1').bind(fn.name,page.at(-1).seq),
+    ]);
+    const rows=(await env.DB.prepare(`SELECT d.*,e.type,e.data,e.at FROM function_deliveries d JOIN studio_events e ON e.id=d.event WHERE d.function=?1 AND d.state IN ('pending','failed','running') AND d.due<=?2 ORDER BY d.due LIMIT 100`).bind(fn.name,now()).all()).results;
+    for (const row of rows) {
+      const lease=crypto.randomUUID();
+      const claimed=await env.DB.prepare(`UPDATE function_deliveries SET state='running',lease=?3,due=?4,attempts=attempts+1 WHERE event=?1 AND function=?2 AND state!='complete' AND due<=?5`).bind(row.event,fn.name,lease,now()+leaseMs,now()).run();
+      if (!claimed.meta.changes) continue;
+      try {
+        const event=Object.freeze({id:row.event,type:row.type,at:row.at,data:JSON.parse(row.data),attempt:row.attempts+1});
+        await fn.handler(event,services(env,cat,origin,{id:'studio-function',owner:true,client:null},'function:'+fn.name,fn));
+        await env.DB.prepare(`UPDATE function_deliveries SET state='complete',completed=?4,error=NULL WHERE event=?1 AND function=?2 AND lease=?3`).bind(row.event,fn.name,lease,now()).run();
+      } catch {
+        // Handler errors may contain credentials. The office identifies the function/event; Worker logs are the studio's debugging surface.
+        await env.DB.prepare(`UPDATE function_deliveries SET state='failed',error='Function failed; inspect its code and retry',due=?4 WHERE event=?1 AND function=?2 AND lease=?3`).bind(row.event,fn.name,lease,now()+leaseMs).run();
+      }
+    }
+  }
+  await pruneEvents(env);
+}
+export async function scheduleFunctions(event,env,cat,origin) {
+  const definitions=await syncFunctions(env);
+  for(const fn of definitions) if(fn.schedule===event.cron) await env.DB.batch([
+    env.DB.prepare(`INSERT OR IGNORE INTO studio_events(id,type,data,at) SELECT ?1,?2,?3,?4 WHERE EXISTS(SELECT 1 FROM function_subscriptions WHERE name=?5 AND last_tick<?4)`).bind(`schedule:${fn.name}:${event.scheduledTime}`,fn.event,JSON.stringify({function:fn.name,cron:event.cron,scheduledTime:event.scheduledTime}),event.scheduledTime,fn.name),
+    env.DB.prepare('UPDATE function_subscriptions SET last_tick=MAX(last_tick,?2) WHERE name=?1').bind(fn.name,event.scheduledTime),
+  ]);
+  await runFunctions(env,cat,origin,{definitions});
+}
+export async function functionsRoute(request,env,cat) {
+  const url=new URL(request.url);
+  if (!await isOwner(request,env)) return new Response('Sign in to the office',{status:403});
+  if(request.method==='POST') {
+    if(!sameOrigin(request,url))return new Response('Origin refused',{status:403});
+    const form=request.headers.get('content-type')?.includes('application/x-www-form-urlencoded');
+    const body=form?Object.fromEntries(await request.formData()):await request.json();
+    if(body.replay) await replayFunction(env,body.replay);
+    if(body.retry) await env.DB.prepare(`UPDATE function_deliveries SET due=0 WHERE event=?1 AND state='failed'`).bind(body.retry).run();
+    if(body.fire) {
+      if(!['localhost','127.0.0.1','[::1]'].includes(url.hostname))return new Response('Local testing only',{status:403});
+      await emitEvent(env,body.fire,body.data??{},{id:body.id??crypto.randomUUID()});
+    }
+    await runFunctions(env,cat,url.origin);
+    return form?Response.redirect(url.href,303):Response.json({ok:true});
+  }
+  const rows=(await env.DB.prepare(`SELECT d.*,e.type,e.at FROM function_deliveries d JOIN studio_events e ON e.id=d.event ORDER BY e.at DESC LIMIT 100`).all()).results;
+  return new Response(`<!doctype html><meta charset="utf-8"><title>Studio functions</title><h1>Studio functions</h1><p>At-least-once delivery. Use the event ID to deduplicate effects.</p><table><tr><th>Function</th><th>Event ID</th><th>Event</th><th>State</th><th>Attempts</th><th>Error</th><th>Retry</th></tr>${rows.map(r=>`<tr>${[r.function,r.event,r.type,r.state,r.attempts,r.error??''].map(v=>`<td>${esc(v)}</td>`).join('')}<td>${r.state==='failed'?`<form method="post"><input type="hidden" name="retry" value="${esc(r.event)}"><button>Retry</button></form>`:''}</td></tr>`).join('')}</table>`,{headers:{'content-type':'text/html;charset=utf-8','cache-control':'no-store'}});
+}

package/worker/index.mjs

@@ -1,3 +1,4 @@
+export { useFunctions } from './functions.mjs';
 import { appAccess, appRecordsRoute } from './app-records.mjs';
 import { appRole, openPath } from './app-format.mjs';
 /**
@@ -600,13 +601,17 @@ function finish(res, path) {
 
 export default {
   async scheduled(event, env, ctx) {
-    ctx.waitUntil((async () => {
+    const maintenance=(async () => {
       const cat = await catalogue(env, 'https://studio.invalid');
       await reconcileOrders(env, shopOf(cat));
-    })());
+      await (await import('./functions.mjs')).scheduleFunctions(event,env,cat,cat.studio?.url??'https://studio.invalid');
+    })();
+    ctx.waitUntil(maintenance);
+    await maintenance;
   },
   async fetch(request, env, ctx) {
     const url = new URL(request.url);
+    await (await import('./functions.mjs')).syncFunctions(env);
     // A standalone copy's Lobby call (worker/standalone.mjs): every answer to it can be read by the app's page, an
     // unknown game's 404 and a failure included, so the app can say why it plays offline. No other address is opened.
     const appRecords = isAppOrigin(request) && /^\/[^/]+\/api\/app\/records\//.test(url.pathname);
@@ -618,6 +623,7 @@ export default {
       try { console.error(JSON.stringify({ at: new Date().toISOString(), ev: 'lobby-route-failed', path: url.pathname, error: errorLine(error) })); } catch { /* no console */ }
       res = json({ ok: false, error: 'failed' }, 500);
     }
+    if(ctx?.waitUntil && ['POST','PUT','DELETE'].includes(request.method)) ctx.waitUntil((async()=>{const {runFunctions}=await import('./functions.mjs');await runFunctions(env,()=>catalogue(env,url.origin),url.origin);})());
     if (appLobby || appRecords) return appCors(request, res);
     // A referral's arrival (worker/referrals.mjs): only a person's page load with ?via= of another site, on a studio
     // that pays referrals. The page is answered first; a cookie is added to it only then.
@@ -635,6 +641,7 @@ export default {
 let studioTools = async () => [];
 /** Studio-authored Worker code, loaded only on the MCP surface. */
 export function useTools(load) { studioTools = load; }
+export function getStudioTools() { return studioTools(); }
 
 async function route(request, env, ctx) {
   const url = new URL(request.url);
@@ -647,6 +654,8 @@ async function route(request, env, ctx) {
   const getAll = () => (catP ??= catalogue(env, url.origin).then((cat) => named(cat, env)));
   const getCat = () => (pubP ??= Promise.all([getAll(), settingsOf(env)]).then(([cat, settings]) => publicCatalogue(cat, settings, env)));
 
+  if (path === '/_studio/office/functions') return (await import('./functions.mjs')).functionsRoute(request,env,await getAll());
+
   if (path === '/mcp' || path.startsWith('/hooks/tools/') || path.startsWith('/oauth/') || path.startsWith('/.well-known/oauth-') || path === '/_studio/office/connections') {
     const { remoteMcp } = await import('./mcp.mjs');
     return remoteMcp(request, env, ctx, { catalogueOf: getAll, definitions: await studioTools() });
@@ -1672,11 +1681,35 @@ export class Table {
    * a failure goes to the error stream, everything else to the log (and not at all with HOMIE_ROOM_LOG=0).
    */
   say(line) {
+    if(line?.ev==='hello'&&!line.resumed&&line.seat!==null) this.queueFunctionEvent('player.joined',{game:this.game,room:line.room,player:this.room?.clients.get(line.id)?.conn?.player??null,seat:line.seat});
     const bad = line?.ev === 'failed' || line?.ev === 'socket-error' || line?.ev === 'tick-failed' || line?.ev === 'persist-failed';
     if (!bad && this.env.HOMIE_ROOM_LOG === '0') return;
     try { console[bad ? 'error' : 'log'](JSON.stringify({ at: new Date().toISOString(), ...line, game: this.game ?? null, room: line?.room ?? this.code ?? null })); } catch { /* no console */ }
   }
 
+  queueFunctionEvent(type,data) {
+    if(!this.env.DB || this.env.HOMIE_PREVIEW==='1' || !this.ctx.storage.sql) return;
+    this.ctx.waitUntil((async()=>{
+      if(!await (await import('./functions.mjs')).hasFunctionType(type))return;
+      const sql=this.ctx.storage.sql;
+      sql.exec('CREATE TABLE IF NOT EXISTS function_outbox(id TEXT PRIMARY KEY,type TEXT,data TEXT,at INTEGER)');
+      sql.exec('INSERT INTO function_outbox VALUES(?,?,?,?)',crypto.randomUUID(),type,JSON.stringify(data),Date.now());
+      this.armRoom(Date.now()+60000);
+      await this.flushFunctionEvents();
+    })());
+  }
+
+  async flushFunctionEvents() {
+    const sql=this.ctx.storage.sql;
+    if(!sql || !this.env.DB)return;
+    if(!sql.exec("SELECT name FROM sqlite_master WHERE name='function_outbox'").toArray().length)return;
+    const {emitEvent}=await import('./functions.mjs');
+    for(const row of sql.exec('SELECT * FROM function_outbox LIMIT 100').toArray()) {
+      try {await emitEvent(this.env,row.type,JSON.parse(row.data),{id:row.id,at:row.at});sql.exec('DELETE FROM function_outbox WHERE id=?',row.id);}
+      catch {this.armRoom(Date.now()+60000);await this.alarmWrite;return;}
+    }
+  }
+
   /**
    * A socket's `error` event. The runtime raises one when the other end simply went away ("Network connection lost":
    * a closed tab, a phone that slept, a browser the test harness shut): that is a departure, and the room handles it
@@ -1893,6 +1926,7 @@ export class Table {
 
   /** The alarm: the house guides' brains decide (worker/agents.mjs), then the day's usage is written. */
   async alarm() {
+    await this.flushFunctionEvents();
     // A brain that throws never takes the room with it: the alarm is not retried, the guides answer from the floor.
     try { if (this.house) await this.house.onAlarm(); } catch (error) { try { console.log(JSON.stringify({ ev: 'brain-alarm-failed', room: this.code, error: String(error?.stack ?? error).slice(0, 400) })); } catch { /* no console */ } }
     try { await this.flushBrain(); } catch { /* counted next time */ }
@@ -2099,6 +2133,7 @@ export class Table {
 
   /** Tell the Lobby this room closed (until when; 0 when it opened again), so it sends nobody here meanwhile. */
   tellLobby(extra) {
+    if(extra.closed || extra.ended) this.queueFunctionEvent('room.closed',{game:this.game,room:this.code,...extra});
     if (!this.game || !this.code) return;
     const lobby = this.env.LOBBY.get(this.env.LOBBY.idFromName(this.game));
     this.lastReport = -1;

package/worker/machine-payments.mjs

@@ -39,7 +39,7 @@ export async function paymentProtocol(
   });
   capabilities ??= await machineCapabilities(env);
   let methods = capabilities.machine.card ? [payments.spt.charge()] : [];
-  if (config.base && capabilities.machine.base && !mcp) {
+  if (order.resource_kind !== 'service' && config.base && capabilities.machine.base && !mcp) {
     facilitator ??= new HTTPFacilitatorClient(
       mode === "live"
         ? createFacilitatorConfig(env.CDP_API_KEY_ID, env.CDP_API_KEY_SECRET)

package/worker/mcp-store.mjs

@@ -24,7 +24,8 @@ export function oauthStorage(DB) {
     },
   };
 }
-export async function rateLimit(env, caller, limit = 60) {
+export async function rateLimit(env, caller, limit = null) {
+  if (limit == null) return true;
   const minute = Math.floor(Date.now()/60000);
   const row = await env.DB.prepare('INSERT INTO mcp_limits(caller,minute,n) VALUES(?1,?2,1) ON CONFLICT(caller,minute) DO UPDATE SET n=n+1 RETURNING n').bind(caller,minute).first();
   return row.n <= limit;
@@ -41,5 +42,5 @@ export async function audit(env, caller, tool, outcome) {
 
 export function callsPerMinute(cat) {
   const value=cat.studio?.mcp?.callsPerMinute;
-  return Number.isSafeInteger(value)&&value>0?value:60;
+  return Number.isSafeInteger(value)&&value>0?value:null;
 }

package/worker/mcp-tools.mjs

@@ -1,3 +1,4 @@
+import { selling } from './extensions.mjs';
 import { withToolIdentity } from './tool-identity.mjs';
 import { officeRoutes } from './office.mjs';
 import { appRecordsRoute } from './app-records.mjs';
@@ -43,10 +44,11 @@ export function services(env, cat, origin, caller, namespace, definition = {}) {
     const result = await response.json(); if(!response.ok) throw new Error(result.error);return result;
   };
   const office = async (path, body, query={}) => {
-    if (!caller.owner || !/^\/_studio\/api\//.test(path) || path.includes('..') || path.includes('?')) throw new Error('owner only');
+    const delegated=definition.delegateOffice && await allowed(definition.audience,caller,env);
+    if ((!caller.owner && !delegated) || !/^\/_studio\/api\//.test(path) || path.includes('..') || path.includes('?')) throw new Error('owner only');
     const url = new URL(path,origin);
     for(const [key,value] of Object.entries(query))url.searchParams.set(key,String(value));
-    const request = withToolIdentity(new Request(url,{method:body?'POST':'GET',headers:{origin,'content-type':'application/json'},...(body?{body:JSON.stringify(body)}:{})}),caller);
+    const request = withToolIdentity(new Request(url,{method:body?'POST':'GET',headers:{origin,'content-type':'application/json'},...(body?{body:JSON.stringify(body)}:{})}),delegated?{...caller,owner:true}:caller);
     const response = await officeRoutes(request,env,url,{catalogueOf:async()=>cat});
     const result = response.headers.get('content-type')?.includes('application/json')?await response.json():{text:await response.text()}; if(!response.ok && response.status!==202) throw new Error(result.error);return result;
   };
@@ -57,7 +59,7 @@ export function services(env, cat, origin, caller, namespace, definition = {}) {
     shop:()=>office('/_studio/api/shop'),
     database:Object.freeze({
       async get(k){const r=await env.DB.prepare('SELECT value FROM tool_data WHERE namespace=?1 AND key=?2').bind(namespace,key(k)).first();return r?JSON.parse(r.value):null;},
-      async put(k,value){const text=JSON.stringify(value);if(text.length>16384)throw new Error('value too large');await env.DB.prepare('INSERT INTO tool_data(namespace,key,value) VALUES(?1,?2,?3) ON CONFLICT(namespace,key) DO UPDATE SET value=excluded.value').bind(namespace,key(k),text).run();},
+      async put(k,value){const text=JSON.stringify(value);await env.DB.prepare('INSERT INTO tool_data(namespace,key,value) VALUES(?1,?2,?3) ON CONFLICT(namespace,key) DO UPDATE SET value=excluded.value').bind(namespace,key(k),text).run();},
     }),
     fetch:globalThis.fetch.bind(globalThis),
     // A named secret may authenticate an HTTPS request; its value is never returned.
@@ -77,6 +79,15 @@ export function services(env, cat, origin, caller, namespace, definition = {}) {
 export function builtins(env,cat,origin) {
   const tool=(name,description,audience,inputSchema,handler)=>({name,description,audience,inputSchema,handler});
   const tools=[
+    tool('studio_function_replay','Replay retained events for a declaration with replay: true.','owner',object({name:str},['name']),async({name})=>{
+      const {replayFunction,runFunctions}=await import('./functions.mjs');
+      await replayFunction(env,name);await runFunctions(env,cat,origin);return {ok:true};
+    }),
+    tool('studio_function_fire','Fire an event locally through the durable function dispatcher.','owner',object({event:str,id:str,data:{type:'object'}},['event']),async(args)=>{
+      if(!['localhost','127.0.0.1','[::1]'].includes(new URL(origin).hostname))throw new Error('Local testing only');
+      const {emitEvent,runFunctions}=await import('./functions.mjs');
+      const id=await emitEvent(env,args.event,args.data??{},{id:args.id});await runFunctions(env,cat,origin);return {id};
+    }),
     tool('studio_info','The public studio, apps, games and posts.','public',object(),async()=>{const pub=publicCatalogue(cat,await settingsOf(env),env);return {studio:pub.studio?.name,games:pub.games.map(g=>({id:g.id,name:g.name,kind:g.kind??'game'})),posts:pub.posts};}),
     tool('studio_office','Live rooms and the players as shown in the office.','owner',object(),(_,ctx)=>ctx.office('/_studio/api/office')),
     tool('studio_shop','Orders, refunds and the shop state.','owner',object(),(_,ctx)=>ctx.shop()),
@@ -101,5 +112,6 @@ export function builtins(env,cat,origin) {
   const actions=['announce','kick','mute','close','game','servers','servers/set','servers/close','servers/member','room-level','agents/brain','chat/rules','chat/remove','chat/report','chat/budget','lounge/rules','lounge/night','lounge/mod','lounge/remove','lounge/hold','shop/release','shop/refund','shop/settle','invites','invites/revoke'];
   tools.push(tool('studio_office_action','Use an existing office control. Destructive changes return a browser confirmation for the owner.','owner',object({operation:{enum:actions},action:{type:'object'}},['operation','action']),({operation,action},ctx)=>ctx.office('/_studio/api/'+operation,action)));
   for (const op of ['sit','look','act','speak','stand']) tools.push(tool('agent_'+op, 'A marked AI guide: '+op+'. Room policy and declared vocabulary apply.', 'signed-in', object({game:str,role:str,server:str,room:str,goal:str,line:str,args:{type:'object'}},['game']), async (args,ctx)=>(await import('./mcp-room.mjs')).remoteSeat(env,cat,ctx.caller,op,args)));
-  return tools;
+  tools.push(...selling.customerTools(env,cat,origin));
+  return tools.map(tool => ({...tool, delegateOffice:Object.hasOwn(cat.studio?.mcp?.audiences??{},tool.name), audience: cat.studio?.mcp?.audiences?.[tool.name] ?? tool.audience}));
 }

package/worker/mcp.mjs

@@ -1,6 +1,7 @@
+import { selling } from './extensions.mjs';
 import OAuthProvider from '@cloudflare/workers-oauth-provider';
 import { createMcpHandler } from 'agents/mcp/server';
-import { McpServer, fromJsonSchema } from '@modelcontextprotocol/server';
+import { McpServer, fromJsonSchema, ProtocolError } from '@modelcontextprotocol/server';
 import { CfWorkerJsonSchemaValidator } from '@modelcontextprotocol/server/validators/cf-worker';
 import { players } from './players.mjs';
 import { isOwner, sameOrigin } from './office.mjs';
@@ -20,16 +21,11 @@ async function browserPerson(request,env) {
   }
   return null;
 }
+const paymentInputSchema={type:'object',properties:{buyer:{type:'string',pattern:'^[a-f0-9]{64}$'},claim:{type:'string',pattern:'^[a-f0-9]{64}$'},offerVersion:{type:'string'},checkout:{type:'boolean'}},additionalProperties:false};
 export async function remoteMcp(request,env,ctx,{catalogueOf,definitions=[]}) {
   const url=new URL(request.url), origin=url.origin, path=url.pathname;
   if(!env.DB)return json({error:'studio database required'},503);
   if(request.headers.has('origin') && request.headers.get('origin')!==origin)return json({error:'origin refused'},403);
-  // Cap all protocol bodies before handing them to a library or a handler.
-  if(request.body){
-    const reader=request.body.getReader(),chunks=[];let size=0;
-    for(;;){const {done,value}=await reader.read();if(done)break;size+=value.length;if(size>65536){await reader.cancel();return json({error:'request too large'},413);}chunks.push(value);}
-    const bytes=new Uint8Array(size);let at=0;for(const chunk of chunks){bytes.set(chunk,at);at+=chunk.length;}request=new Request(request,{body:bytes});
-  }
   if(path.startsWith('/hooks/tools/')) return (await import('./tool-webhook.mjs')).toolWebhook(request,env,{cat:await catalogueOf(),definitions});
   const scoped={...env,OAUTH_KV:oauthStorage(env.DB)};
   const api=async(request,env,ctx)=>{
@@ -40,7 +36,8 @@ export async function remoteMcp(request,env,ctx,{catalogueOf,definitions=[]}) {
       const body=await request.clone().json().catch(()=>null);
       if(body?.method==='tools/call') {
         const tool=tools.find(t=>t.name===body.params?.name);
-        if(tool&&!validator.getValidator(tool.inputSchema)(body.params?.arguments??{}).valid)await audit(env,caller,tool.name,'invalid');
+        const schema=tool?.price?{...tool.inputSchema,properties:{...tool.inputSchema.properties,_payment:paymentInputSchema}}:tool?.inputSchema;
+        if(tool&&!validator.getValidator(schema)(body.params?.arguments??{}).valid)await audit(env,caller,tool.name,'invalid');
         if(!tool)await audit(env,caller,'unknown-tool','denied');
       }
     }
@@ -50,11 +47,13 @@ export async function remoteMcp(request,env,ctx,{catalogueOf,definitions=[]}) {
     };
     const read=async(name,handler)=>{
       let outcome='error';
-      try{const fresh=await currentCaller(env,ctx.props);await rate(fresh);const result=await handler(fresh);if(JSON.stringify(result).length>65536)throw new Error('Result too large');outcome='ok';return result;}
+      try{const fresh=await currentCaller(env,ctx.props);await rate(fresh);const result=await handler(fresh);outcome='ok';return result;}
       finally{await audit(env,caller,name,outcome);}
     };
     const server=async()=>{
-      const s=new McpServer({name:cat.studio?.name??'Homie studio',version:'1.0.0'},{jsonSchemaValidator:validator});
+      const capabilities=await selling.machineCapabilities(env);
+      const s=new McpServer({name:cat.studio?.name??'Homie studio',version:'1.0.0'},{jsonSchemaValidator:validator,capabilities:{experimental:{payment:{methods:capabilities.machine?.card?{stripe:{intents:['charge']}}:{}}}}});
+      const dispatch=new Map();
       for (const meta of cat.games.filter(g=>g.kind==='app' && g.records?.persist)) {
         for (const [role,declared] of Object.entries(meta.roles??{})) {
           if (declared.signIn && !await allowed({app:meta.id,role},caller,env)) continue;
@@ -69,6 +68,7 @@ export async function remoteMcp(request,env,ctx,{catalogueOf,definitions=[]}) {
         }
       }
       for(const tool of tools){
+        if (!await allowed(tool.audience,caller,env)) continue;
         if (tool.kind==='prompt') {
           if (!await allowed(tool.audience,caller,env)) continue;
           s.registerPrompt(tool.name,{description:tool.description,argsSchema:fromJsonSchema(tool.inputSchema,validator)},async(args)=>read('prompt:'+tool.name,async fresh=>{
@@ -77,21 +77,37 @@ export async function remoteMcp(request,env,ctx,{catalogueOf,definitions=[]}) {
             return {messages:[{role:'user',content:{type:'text',text:JSON.stringify({kind:'studio-prompt-data',prompt:tool.name,data:text})}}]};
           }));continue;
         }
-        s.registerTool(tool.name,{description:tool.description,inputSchema:fromJsonSchema(tool.inputSchema,validator)},async(args)=>{
+        const schema=tool.price?{...tool.inputSchema,properties:{...tool.inputSchema.properties,_payment:paymentInputSchema}}:tool.inputSchema;
+        const handler=async(args,extra)=>{
           let outcome='error';
           try{
             // Recheck inside dispatch, even when a connection listed tools earlier.
             const fresh=await currentCaller(env,ctx.props);
             if(!await allowed(tool.audience,fresh,env)){outcome='denied';throw new Error('Permission denied');}
             try{await rate(fresh);}catch(error){outcome='limited';throw error;}
-            const value=await tool.handler(args,services(env,cat,origin,fresh,tool.namespace??tool.name,tool));
+            const context=services(env,cat,origin,fresh,tool.namespace??tool.name,tool);
+            if(tool.price) {const result=await selling.paidTool(env,cat,origin,tool,args,context,extra);outcome=result.isError?'error':'ok';return result;}
+            if(tool.protocol) {const result=await tool.handler(args,{...context,paymentExtra:extra});outcome=result.isError?'error':'ok';return result;}
+            const value=await tool.handler(args,{...context,request});
             const text=JSON.stringify({kind:'untrusted-tool-data',tool:tool.name,data:value});
-            if(text.length>65536)throw new Error('Result too large; narrow your request');
             outcome='ok';return {content:[{type:'text',text}]};
-          }catch(error){return {isError:true,content:[{type:'text',text:outcome==='denied'||outcome==='limited'?error.message:'Tool failed. Check the office audit and the tool definition.'}]};}
+          }catch(error){if(error?.code===-32042)throw error;return {isError:true,content:[{type:'text',text:outcome==='denied'||outcome==='limited'?error.message:'Tool failed. Check the office audit and the tool definition.'}]};}
           finally{await audit(env,caller,tool.name,outcome);}
-        });
+        };
+        s.registerTool(tool.name,{description:tool.description,inputSchema:fromJsonSchema(schema,validator)},handler);
+        dispatch.set(tool.name,{schema,handler});
       }
+      // Payment binding errors are JSON-RPC errors, not tool failures. The SDK's
+      // convenience dispatcher turns arbitrary errors into isError results; use its
+      // public protocol handler to preserve mppx's standard -32042 challenge.
+      s.server.setRequestHandler('tools/call',async(input,extra)=>{
+        const entry=dispatch.get(input.params.name);
+        if(!entry)return {isError:true,content:[{type:'text',text:'Permission denied or unknown tool'}]};
+        const args=input.params.arguments??{};
+        if(!validator.getValidator(entry.schema)(args).valid)return {isError:true,content:[{type:'text',text:'Invalid arguments'}]};
+        try{return await entry.handler(args,{...extra,_meta:input.params._meta});}
+        catch(error){if(error?.code===-32042)throw new ProtocolError(error.code,error.message,error.data);throw error;}
+      });
       return s;
     };
     return createMcpHandler(server)(request,env,ctx);

package/worker/office-page.mjs

@@ -937,7 +937,7 @@ export async function officePage(cat, headers = {}) {
   const name = cat.studio?.name ?? 'Studio';
   const options = (cat.games ?? []).map((g) => `<option value="${esc(g.id)}">every room of ${esc(g.name)}</option>`).join('');
   const body = `<header class="top"><h1>${esc(name)} <small>Office</small></h1>
-<div class="links"><span class="live"><i class="dot" id="livedot"></i><span id="live">…</span></span><a href="/_studio/stats">Stats</a><a href="/_studio/office/connections">AI connections</a>${cat.shop ? '<a href="/_studio/office/shop">Shop</a>' : ''}
+<div class="links"><span class="live"><i class="dot" id="livedot"></i><span id="live">…</span></span><a href="/_studio/stats">Stats</a><a href="/_studio/office/connections">AI connections</a><a href="/_studio/office/functions">Functions</a>${cat.shop ? '<a href="/_studio/office/shop">Shop</a>' : ''}
 <form method="post" action="/_studio/signout" style="display:inline"><button class="ghost small" type="submit">Sign out</button></form></div></header>
 <form class="bar" id="announce-all"><label for="announce-text">Announce</label><input type="text" id="announce-text" maxlength="280" placeholder="A line every player sees, in the game" autocomplete="off">
 <select id="announce-scope" aria-label="Who sees it"><option value="">every room of every game</option>${options}</select><button type="submit">Send</button>

package/worker/players.mjs

@@ -1,3 +1,4 @@
+import { toolIdentity } from './tool-identity.mjs';
 /**
  * PLAYERS — accounts on ONE studio, passkey first, and the cloud saves a persistent game keeps (saves/SAVES.md).
  *
@@ -236,8 +237,8 @@ async function sessionOf(request, env, url = new URL(request.url)) {
 /** A guest for a request with no player yet (the first save). Refused past the address's or the day's limit. */
 async function newGuest(request, env, url, addressLimit = PLAYER_LIMITS.newPlayersPerHour, counter = 'new') {
   const ip = addressOf(request);
-  if (limited(`${counter}:${ip}`, addressLimit, HOUR)) return { error: fail(429, 'rate', 'too many new players from this address; try again later') };
-  const capped = await dailyCapReached(env);
+  if (addressLimit !== null && limited(`${counter}:${ip}`, addressLimit, HOUR)) return { error: fail(429, 'rate', 'too many new players from this address; try again later') };
+  const capped = (counter !== 'shop-new' || env.PLAYER_LIMIT_DAILY !== undefined) && await dailyCapReached(env);
   if (capped) return { error: fail(503, 'busy', 'this studio has taken all the new players it takes in one day; try again tomorrow') };
   const id = newPlayerId();
   const now = Date.now();
@@ -383,6 +384,8 @@ export const players = Object.freeze({
   },
   /** The request's signed-in player ({ id, name, guest, owner }), or null. */
   async of(request, env) {
+    const identity=toolIdentity(request);
+    if(identity?.id && !identity.id.startsWith('office-')) { const p=await env.DB.prepare('SELECT id,name,guest,owner FROM players WHERE id=?1').bind(identity.id).first();return p?{...p,guest:Boolean(p.guest),owner:Boolean(p.owner)}:null; }
     try { const s = await sessionOf(request, env); return s ? { id: s.player.id, name: s.player.name, guest: s.player.guest, owner: s.player.owner } : null; } catch { return null; }
   },
   /** Shop guest creation uses the studio's new-guest address rate and the daily player limit. */

package/worker/purchase-delivery.mjs

@@ -55,6 +55,7 @@ export async function grantPurchase(env, origin, o, b = {}) {
     : null;
   if (!rights || !rights.active)
     return fail(402, `Purchase is ${coreOrder.state}; delivery is unavailable`);
+  await resourceKind(o.resource_kind).fulfill?.(env,origin,o);
   const key = await signingKey(env);
   const now = Math.floor(Date.now() / 1000);
   const claims = {

package/worker/purchase-hosted-readiness.mjs

@@ -8,7 +8,6 @@ import { recurringReady } from './purchase-store.mjs';
 export async function hostedReadiness(env, catalogue, recurring = false) {
   const missing = [];
   if (!env.DB || env.HOMIE_PREVIEW === '1') missing.push('Studio purchases need the deployed database');
-  if (!env.PURCHASE_RATE_LIMITER) missing.push('Deploy the purchase rate limiting binding');
   try { await signingKey(env); } catch { missing.push('Create a valid purchase signing key'); }
   if ((!hasStripeKey(env) && !purchaseLinks(env)) || !WEBHOOK_SECRET_SHAPE.test(env.STRIPE_WEBHOOK_SECRET ?? '') || !['stripe', 'stripe-managed'].includes(catalogue.shop?.purchasesTill ?? catalogue.shop?.till)) missing.push('Connect this studio shop to Stripe first');
   if (recurring && hasStripeKey(env) && !(await recurringReady(env))) missing.push('Reconnect the shop to verify subscription permissions and webhook events before selling recurring resources');

package/worker/purchase-links.mjs

@@ -5,5 +5,5 @@ export function purchaseLinks(env) {
   try { const c = JSON.parse(env.PURCHASE_LINKS ?? 'null'); return c?.v === 1 && c.mode === linkConfig(env)?.mode && Array.isArray(c.offers) ? c : null; } catch { return null; }
 }
 export function purchaseLink(env, o) {
-  return purchaseLinks(env)?.offers.find((link) => (link.quantity ?? 1) === o.quantity && link.kind === o.resource_kind && link.resource === o.resource_id && link.version === JSON.parse(o.manifest).version && link.offer === canonicalJson(JSON.parse(o.offer)) && paymentLinkURL(link.url));
+  return purchaseLinks(env)?.offers.find((link) => (link.quantity ?? 1) === o.quantity && link.kind === o.resource_kind && link.resource === (o.resource_kind==='service'?JSON.parse(o.manifest).tool:o.resource_id) && link.version === JSON.parse(o.manifest).version && link.offer === canonicalJson(JSON.parse(o.offer)) && paymentLinkURL(link.url));
 }

package/worker/purchase-machine.mjs

@@ -154,6 +154,7 @@ export async function machineResource(
     .first();
   o = await byId(env, o.id);
   if (["paid", "fulfilled", "disputed"].includes(o.status)) {
+    if(mcp && core?.transport==='checkout') {const result=await response();return result instanceof Response?result:machineMcpDelivery(result,dependencies);}
     const recorded = stored ? null : await env.DB.prepare("SELECT payload FROM purchase_jobs WHERE order_id = ?1 ORDER BY updated_at DESC LIMIT 1").bind(o.id).first();
     const recording = recorded && JSON.parse(recorded.payload);
     const challengeId = recording?.params?.metadata?.mpp_challenge_id;

package/worker/purchase-office.mjs

@@ -27,7 +27,7 @@ export async function extendOffice(env, cat, origin, out) {
   try {
     out.purchases = await purchaseReadiness(env, origin, cat);
     const rows = (await env.DB.prepare('SELECT o.*, r.manifest AS manifest FROM purchase_orders o JOIN resource_snapshots r ON r.hash=o.manifest_hash ORDER BY o.created_at DESC LIMIT 100').all()).results ?? [];
-    for (const r of rows) out.orders.push({ id: r.id, status: r.status, resourceKind: r.resource_kind, resource: r.resource_id, name: JSON.parse(r.manifest).name, shown: money(r.amount,r.currency), amount:r.amount, currency:r.currency, createdAt:r.created_at, mode:r.mode, player:{name:r.buyer_label}, stripe:r.payment ? dashboardLink(r.mode,'payment',r.payment):null, refundable:hasStripeKey(env) && ['paid','fulfilled'].includes(r.status), manualRefund:await manualRefundDetails(env,r) });
+    for (const r of rows.filter(r=>!out.orders.some(o=>o.id===r.id))) out.orders.push({ id: r.id, status: r.status, resourceKind: r.resource_kind, resource: r.resource_id, name: JSON.parse(r.manifest).name, shown: money(r.amount,r.currency), amount:r.amount, currency:r.currency, createdAt:r.created_at, mode:r.mode, player:{name:r.buyer_label}, stripe:r.payment ? dashboardLink(r.mode,'payment',r.payment):null, refundable:hasStripeKey(env) && ['paid','fulfilled'].includes(r.status), manualRefund:await manualRefundDetails(env,r) });
     out.orders.sort((a,b)=>b.createdAt-a.createdAt);
     out.paymentRecovery = (await env.DB.prepare(`SELECT id AS request_key, order_id, state, payment, error, attempts, updated_at FROM purchase_jobs WHERE ${jobsSQL('visible')} ORDER BY updated_at`).all()).results ?? [];
     out.settlementRecovery = (await env.DB.prepare('SELECT order_id, network, state, reference, error, created_at, updated_at FROM purchase_settlements ORDER BY created_at').all()).results ?? [];

package/worker/purchase-owner.mjs

@@ -109,8 +109,6 @@ export async function purchaseReadiness(env, origin, catalogue = {}) {
     missing.push(
       "Reconnect the shop to verify subscription permissions and webhook events",
     );
-  if (!env.PURCHASE_RATE_LIMITER)
-    missing.push("Deploy the Cloudflare purchase rate limiting binding");
   if (!env.PURCHASE_SIGNING_KEYS)
     missing.push("Create the separate purchase signing key");
   const machine = await machineCapabilities(env);

package/worker/purchase-reconciliation.mjs

@@ -298,6 +298,7 @@ export async function reconcileOneTime(env, o) {
 export async function reconcileOrder(env, o) {
   if (o.subscription && hasStripeKey(env) && !await linkOf(env,o.id)) await reconcileSubscription(env, o);
   else await reconcileOneTime(env, o);
+  if(o.resource_kind==='cart' && o.payment) await (await import('./shop.mjs')).syncRefunds(env,o.payment);
 }
 
 /** Called only AFTER the existing shop webhook signature/mode check. Return null for player orders. */

package/worker/purchase-routes.mjs

@@ -136,19 +136,7 @@ export async function purchaseRoutes(
   if (env.HOMIE_PREVIEW === "1" || !env.DB)
     return fail(503, "Studio purchases need the deployed database");
   try {
-    if (!env.PURCHASE_RATE_LIMITER)
-      return fail(
-        503,
-        "Deploy the Cloudflare purchase rate limiting binding before selling",
-      );
-    if (
-      !(
-        await env.PURCHASE_RATE_LIMITER.limit({
-          key: `${request.headers.get("cf-connecting-ip") ?? "unknown"}:${request.method}`,
-        })
-      ).success
-    )
-      return fail(429, "Too many purchase requests. Try again shortly");
+    if (env.PURCHASE_RATE_LIMITER && !(await env.PURCHASE_RATE_LIMITER.limit({key: `${request.headers.get('cf-connecting-ip') ?? 'unknown'}:${request.method}`})).success) return fail(429, 'Studio purchase rate limit reached');
     if (path === "/api/purchases/mcp") {
       const { purchaseMcp } = await import("./purchase-mcp.mjs");
       return purchaseMcp(request, env, url, cat);
@@ -193,7 +181,7 @@ export async function purchaseRoutes(
       ].includes(path) &&
       request.method === "POST"
     ) {
-      return await claimedPurchase(request, env, url, path);
+      return await claimedPurchase(request, env, url, path, cat);
     }
     return fail(404, "No such studio purchase route");
   } catch (error) {
@@ -484,7 +472,7 @@ async function verifyPurchaseEvidence(request, env, url) {
   });
 }
 
-async function claimedPurchase(request, env, url, path) {
+async function claimedPurchase(request, env, url, path, cat) {
   const claim = bearer(request);
   if (!/^[a-f0-9]{64}$/.test(claim ?? ""))
     return fail(401, "Purchase claim required");
@@ -514,6 +502,12 @@ async function claimedPurchase(request, env, url, path) {
       await reconcileSubscription(env, o);
       o = await byId(env, o.id);
     }
+    if (o.resource_kind === 'cart') {
+      const { refundableShopOrder, shopOf } = await import('./shop.mjs');
+      const { orderById } = await import('./shop-store.mjs');
+      if (!await refundableShopOrder(env, await orderById(env, o.id), shopOf(cat)))
+        return fail(403, 'Ask the studio for this refund. Tips and used items follow the studio refund settings.');
+    }
     const days = termsOf(o).refundWindowDays;
     let paidAt = Number(o.paid_at);
     if (o.subscription && o.payment) {
@@ -536,12 +530,12 @@ async function claimedPurchase(request, env, url, path) {
     }
     if (o.paid_at && !o.payment) return fail(409, 'Stripe has not recorded this chain payment. Contact the seller for a direct refund to the original payer.');
     if (!o.paid_at) return fail(409, "This order is not paid; there is no payment to refund");
-    if (
+    if (o.resource_kind !== 'cart' && (
       !Number.isFinite(days) ||
       days <= 0 ||
       !paidAt ||
       Date.now() > paidAt + days * 86400000
-    )
+    ))
       return fail(
         403,
         "This purchase is outside the seller self-service refund window; contact the seller with your receipt",

package/worker/purchase-store.mjs

@@ -75,6 +75,7 @@ export async function privateRelease(env, kind, id, version) {
 export async function listedRelease(env, origin, kind, id, version) {
   if (await env.DB.prepare("SELECT 1 FROM resource_retirements WHERE resource = ?1").bind(`${shopMode(env)}:${kind}:${id}`).first()) return null;
   const adapter = resourceKind(kind);
+  if (adapter.listed) return adapter.listed(env,id,version,origin);
   const listed = (await adapter.list(env,origin)).find((r)=>r.id===id && r.version===version);
   if (!listed) return null;
   const resource = await privateRelease(env,kind,id,version);

package/worker/selling/runtime.mjs

@@ -1,3 +1,5 @@
+import {pruneOffers} from '../customer-resources.mjs';
+import { customerTools, paidTool } from '../customer-mcp.mjs';
 import { productDescription, entryDescription, discoveryRoutes } from '../parts-purchase-catalogue.mjs';
 import { officeScript } from '../purchase-office-script.mjs';
 import { officeRoutes } from '../purchase-office-routes.mjs';
@@ -27,10 +29,11 @@ import { paidFile } from '../parts-protected.mjs';
 import { priceWords } from '../purchase-pricing.mjs';
 import { purchaseDiscovery } from '../purchase-discovery.mjs';
 import { testPaymentExchange } from '../payment-test-exchange.mjs';
-useSelling({ enabled: true, productDescription, entryDescription, discoveryRoutes, officeScript, officeRoutes, refundOrder, extendOffice, testPaymentExchange, jobsSQL, manualRefundDetails, confirmManualRefund, listOffers, orderFact, resourceOrder, currentPurchaseOrder, purchasePaymentEvent, refundPurchasePayment, purchaseReadiness, purchaseRoutes, recordOrderState, authorizePurchaseTest, expirePurchaseCheckouts, reissuePurchaseClaim, retireResource, reconcileRecordings, machineCapabilities, paidFile, priceWords, purchaseDiscovery });
+useSelling({ enabled: true, customerTools, paidTool, productDescription, entryDescription, discoveryRoutes, officeScript, officeRoutes, refundOrder, extendOffice, testPaymentExchange, jobsSQL, manualRefundDetails, confirmManualRefund, listOffers, orderFact, resourceOrder, currentPurchaseOrder, purchasePaymentEvent, refundPurchasePayment, purchaseReadiness, purchaseRoutes, recordOrderState, authorizePurchaseTest, expirePurchaseCheckouts, reissuePurchaseClaim, retireResource, reconcileRecordings, machineCapabilities, paidFile, priceWords, purchaseDiscovery });
 export default { ...worker,
   async scheduled(controller, env, ctx) {
     await worker.scheduled(controller, env, ctx);
+    if(env.DB)await pruneOffers(env);
     if (!env.PURCHASE_MACHINE_PAYMENTS || !env.DB) return;
     const { refreshMachineCapabilities } = await import('../payment-capabilities.mjs');
     const errors = [];

package/worker/service-run.mjs

@@ -0,0 +1,25 @@
+/** A running service is never executed again, even if its Worker disappears.
+ * Heartbeats follow active work; an abandoned run goes to refund recovery. */
+export async function serviceResult(env,id,handler,refund,{now=Date.now,leaseMs=60000}={}) {
+  await env.DB.prepare(`INSERT OR IGNORE INTO service_results(order_id,state,due) VALUES(?1,'pending',0)`).bind(id).run();
+  const lease=crypto.randomUUID();
+  const claimed=await env.DB.prepare(`UPDATE service_results SET state='running',lease=?2,due=?3 WHERE order_id=?1 AND state='pending'`).bind(id,lease,now()+leaseMs).run();
+  const fail=async()=>env.DB.prepare(`UPDATE service_results SET state='refund-pending' WHERE order_id=?1 AND state='running'`).bind(id).run();
+  if(claimed.meta.changes) {
+    let renewal=Promise.resolve();
+    const timer=setInterval(()=>{renewal=renewal.then(()=>env.DB.prepare(`UPDATE service_results SET due=?3 WHERE order_id=?1 AND lease=?2 AND state='running'`).bind(id,lease,now()+leaseMs).run()).catch(()=>{});},leaseMs/3);
+    try {
+      const value=await handler();
+      await env.DB.prepare(`UPDATE service_results SET state='complete',result=?3 WHERE order_id=?1 AND lease=?2 AND state='running'`).bind(id,lease,JSON.stringify(value??null)).run();
+    } catch {await fail();}
+    finally{clearInterval(timer);await renewal;}
+  }
+  let saved=await env.DB.prepare('SELECT state,result,due FROM service_results WHERE order_id=?1').bind(id).first();
+  if(saved.state==='running' && saved.due<=now()){await fail();saved.state='refund-pending';}
+  if(saved.state==='refund-pending') {
+    let outcome;try{outcome=await refund();}catch{outcome={ok:false};}
+    if(outcome.ok && !outcome.pending){await env.DB.prepare(`UPDATE service_results SET state='refunded',result=?2 WHERE order_id=?1 AND state='refund-pending'`).bind(id,JSON.stringify({message:'The tool failed. Your payment was automatically refunded.'})).run();}
+    saved=await env.DB.prepare('SELECT state,result,due FROM service_results WHERE order_id=?1').bind(id).first();
+  }
+  return {order:id,state:saved.state,...(saved.state==='complete'?{data:JSON.parse(saved.result)}:saved.state==='refunded'?JSON.parse(saved.result):saved.state==='refund-pending'?{message:'The tool failed. An automatic refund is pending; retry this same claim to check it. The tool will not run again.'}:{retry:'Retry this same claim; the service is running.'})};
+}