@homie-rocks/studio 0.49.0 → 0.50.1

package/lib/studio.mjs

@@ -90,7 +90,7 @@ export function listExperiences(root) {
   for (const row of rows) { if (ids.has(row.id)) throw new Error(`app/game id collision: ${row.id}`); ids.add(row.id); }
   return rows;
 }
-export const experienceDir = (root, id) => join(root, existsSync(join(root, 'apps', id, 'app.json')) ? 'apps' : 'games', id);
+export const experienceDir = (root, id) => join(root, (existsSync(join(root, 'apps', id, 'app.json')) || existsSync(join(root, 'apps', id, 'CODEX.md'))) ? 'apps' : 'games', id);
 export const experienceFile = (root, id) => join(experienceDir(root, id), existsSync(join(root, 'apps', id, 'app.json')) ? 'app.json' : 'game.json');
 function listKind(root, kind) {
   const dir = join(root, `${kind}s`);
@@ -302,7 +302,7 @@ export function addNeeds(root, needs) {
 
 export async function newApp(root, id, { name, from = 'welcome' } = {}) {
   if (!GAME_ID.test(String(id ?? '')) || RESERVED_IDS.has(id)) throw new Error('invalid app id');
-  if (listExperiences(root).some((g) => g.id === id) || existsSync(join(root, 'apps', id))) throw new Error(`app/game ${id} already exists`);
+  if (listExperiences(root).some((g) => g.id === id) || (existsSync(join(root, 'apps', id)) && readdirSync(join(root, 'apps', id)).some(f => !['CODEX.md', 'codex', 'style.json'].includes(f)))) throw new Error(`app/game ${id} already exists`);
   const dest = join(root, 'apps', id);
   if (!['welcome', 'giving', 'gathering', 'quiz', 'jobs'].includes(from)) throw new Error('app starter: welcome, giving, gathering, quiz or jobs');
   cpSync(join(PACKAGE_ROOT, 'app-starters', from), dest, { recursive: true });
@@ -312,5 +312,5 @@ export async function newApp(root, id, { name, from = 'welcome' } = {}) {
   writeFileSync(file, `${JSON.stringify(meta, null, 2)}\n`);
   const main = join(dest, meta.entry ?? 'src/main.ts');
   writeFileSync(main, readFileSync(main, 'utf8').replaceAll("game: 'welcome'", `game: '${id}'`));
-  return { ok: true, command: 'app new', id, from, dir: dest, files: readdirSync(dest, { recursive: true }).map(String), ...addNeeds(root, meta.needs) };
+  return { ok: true, command: 'app new', id, from, dir: dest, files: readdirSync(dest, { recursive: true }).map(String), ...addNeeds(root, meta.needs), next: ['This starter is plumbing: roles, records, room and a check. It is not the deliverable.', 'Read guides/plan/SKILL.md and guides/app/SKILL.md in the installed toolkit. Capture the person’s scene, people, offers and demonstrable needs in apps/' + id + '/CODEX.md. Build that scene with engines, style and shared parts; repair build failures without flattening it.', 'Install reported dependencies, build, and prove every Codex need on wall and phone before calling it done.'] };
 }

package/lib/template-history.json

@@ -3153,6 +3153,90 @@
      }
     }
    }
+  },
+  "0.50.0": {
+   "files": {
+    "CLAUDE.md": "ddf2b2a0376202f6",
+    "README.md": "684b3cca8001673c",
+    "HANDOFF.md": "29337e2ace95b2e7",
+    "games/README.md": "5ad32fe80c61f117",
+    "music/README.md": "a3dc042dadd39df8",
+    "videos/README.md": "16babc3437d5545b",
+    "posts/README.md": "37841aae476bd540",
+    "site/README.md": "1dbdf22c03a1e505",
+    "site/src/worker.mjs": "6cc5c6131eaf6fd0"
+   },
+   "sections": {
+    "AGENTS.md": {
+     "(intro)": "394cbbe934e80722",
+     "## Version-matched authoring guides": "f6261a0e5801b96b",
+     "## Layout": "f3a280b8c96cd068",
+     "## Apps: one screen, roles and parts": "c10aa0441ea89702",
+     "## Commands (all through the pinned CLI in node_modules)": "5222e08ca55e326e",
+     "## The site": "0cb8dd9a6f8a0096",
+     "## Making games": "bb715272fd1a615b",
+     "## The Game Codex and progress": "0738ef719cef3a4c",
+     "## Art direction and models": "a48fff7bf0a5f2fc",
+     "## Running live games (the back office)": "51ebf2ab756f6e4d",
+     "## Servers and AI seats": "1ccfd549d2369a60",
+     "## Selling things (the shop)": "9e020d69dd6a954e",
+     "## Continuing a build from the Claude app": "0d68081e924ca419",
+     "## Rules": "b2234d80f6cbe71d",
+     "## Telling Homie": "80b46fdd9e578db8",
+     "## Beta": "9d02638207a26e73"
+    }
+   },
+   "named": {
+    "Homie Arcade": {
+     "sections": {
+      "AGENTS.md": {
+       "## Commands (all through the pinned CLI in node_modules)": "611b437f5b3303f0"
+      }
+     }
+    }
+   }
+  },
+  "0.50.1": {
+   "files": {
+    "CLAUDE.md": "ddf2b2a0376202f6",
+    "README.md": "684b3cca8001673c",
+    "HANDOFF.md": "29337e2ace95b2e7",
+    "games/README.md": "5ad32fe80c61f117",
+    "music/README.md": "a3dc042dadd39df8",
+    "videos/README.md": "16babc3437d5545b",
+    "posts/README.md": "37841aae476bd540",
+    "site/README.md": "1dbdf22c03a1e505",
+    "site/src/worker.mjs": "6cc5c6131eaf6fd0"
+   },
+   "sections": {
+    "AGENTS.md": {
+     "(intro)": "394cbbe934e80722",
+     "## Version-matched authoring guides": "f6261a0e5801b96b",
+     "## Layout": "f3a280b8c96cd068",
+     "## Apps: one screen, roles and parts": "c10aa0441ea89702",
+     "## Commands (all through the pinned CLI in node_modules)": "5222e08ca55e326e",
+     "## The site": "0cb8dd9a6f8a0096",
+     "## Making games": "bb715272fd1a615b",
+     "## The Game Codex and progress": "0738ef719cef3a4c",
+     "## Art direction and models": "a48fff7bf0a5f2fc",
+     "## Running live games (the back office)": "51ebf2ab756f6e4d",
+     "## Servers and AI seats": "1ccfd549d2369a60",
+     "## Selling things (the shop)": "9e020d69dd6a954e",
+     "## Continuing a build from the Claude app": "0d68081e924ca419",
+     "## Rules": "b2234d80f6cbe71d",
+     "## Telling Homie": "80b46fdd9e578db8",
+     "## Beta": "9d02638207a26e73"
+    }
+   },
+   "named": {
+    "Homie Arcade": {
+     "sections": {
+      "AGENTS.md": {
+       "## Commands (all through the pinned CLI in node_modules)": "611b437f5b3303f0"
+      }
+     }
+    }
+   }
   }
  }
 }

package/lib/worker-config.mjs

@@ -24,5 +24,5 @@ export function refreshWorkerConfig(root,overrides={}) {
   const tools=read(join(root,'site/src/tools/declarations.json'));
   const ai=cf.ai??listExperiences(root).some(g=>g.decide===true || g.chat!==false && (g.chat?.mode??'text')==='text' && g.chat?.ai!==false);
   const paid=paidReleases(root).length>0||existsSync(join(root,'shop.json'))||tools.paid===true;
-  updateWorkerConfig(root,wranglerConfig({worker:cf.worker,name:studio.name,d1:cf.d1,d1Id:cf.d1Id,r2:cf.r2,layout:layoutOf(root),ai,paidParts:paid,partsRateLimit:cf.purchaseRateLimit??null,routes:cf.routes??null,triggers:functions.length?{crons:[...new Set(['* * * * *',...functions.map(f=>f.schedule).filter(Boolean)])].sort()}:null,...overrides}));
+  updateWorkerConfig(root,wranglerConfig({worker:cf.worker,name:studio.name,d1:cf.d1,d1Id:cf.d1Id,r2:cf.r2,layout:layoutOf(root),ai,paidParts:paid,partsRateLimit:cf.purchaseRateLimit??null,routes:cf.routes??null,eventFeeds:studio.mcp?.events,triggers:functions.length||Object.keys(studio.mcp?.events??{}).length?{crons:[...new Set(['* * * * *',...functions.map(f=>f.schedule).filter(Boolean)])].sort()}:null,...overrides}));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homie-rocks/studio",
-  "version": "0.49.0",
+  "version": "0.50.1",
   "description": "A studio for games, music and video on its own Cloudflare: scaffold, multiplayer starters on the netplay contract, a port toolkit that makes existing single-player web games multiplayer, the site Worker with public rooms (Table/Lobby Durable Objects and D1, all on the free Workers plan, no payment method), a site with the hub's sections (Home, Games, Music, Videos, Rooms, Posts with feeds) in the studio's own look, an epic landing page for every game, big songs and videos in the studio's own R2 once it has storage (uploaded, checked by SHA-256, served at the same addresses), deploy, and the homie.rocks directory.",
   "type": "module",
   "license": "Apache-2.0",

package/shop/SHOP.md

@@ -215,3 +215,7 @@ itemButton.onclick = () => shop.open('supporter');
 ```
 
 These calls open the same shop in games and apps. Inside a player card, purchases leave for the studio's shop; ordinary play/open pages start Stripe checkout. The studio's TV and kids policies still apply.
+
+## App payment references
+
+Create the booking/ticket/gift intention first. `shop.buy('full-tune', 1, undefined, { reference: booking.id })` or `shop.checkout({ reference: booking.id })` sends the app's own reference through checkout. Existing boolean returns are unchanged: checkout opened is not paid. The verified durable `order.paid` event carries `data.order`, `data.reference` (null if omitted) and `data.app`. Reopened Payment Links retain the reference. A reference is buyer-supplied correlation, not authorization: verify the record, app, amount and currency, deduplicate by event/order ID, then fulfil it. Keep personal data out of references. Before Stripe is connected, local prices and unpaid requests can be demonstrated; actual payment and recurring collection remain unverified. Test events must be labelled simulations.

package/shop/shop.ts

@@ -61,8 +61,8 @@ export interface Shop {
   add(item: string, quantity?: number, amount?: number): void;
   cart(): CartLine[];
   clear(): void;
-  checkout(): Promise<boolean>;
-  buy(item: string, quantity?: number, amount?: number): Promise<boolean>;
+  checkout(options?: { reference?: string }): Promise<boolean>;
+  buy(item: string, quantity?: number, amount?: number, options?: { reference?: string }): Promise<boolean>;
   /** Mark an item used; the studio's refundUsedItems policy decides whether self-service refunds still apply. */
   used(key: string): Promise<boolean>;
   on(ev: 'change', fn: (owns: string[]) => void): () => void;
@@ -129,8 +129,8 @@ export function createShop(opts: ShopOptions = {}): Shop {
     add: (item, quantity = 1, amount) => { cart.push({ item, quantity, ...(amount === undefined ? {} : { amount }) }); },
     cart: () => cart.map((line) => ({ ...line })),
     clear: () => { cart = []; },
-    checkout: async () => { const ok = Boolean((await send({ op: 'checkout', lines: cart })).ok); if (ok) cart = []; return ok; },
-    buy: async (item, quantity = 1, amount) => Boolean((await send({ op: 'checkout', lines: [{ item, quantity, ...(amount === undefined ? {} : { amount }) }] })).ok),
+    checkout: async (options = {}) => { const ok = Boolean((await send({ op: 'checkout', lines: cart, reference: options.reference })).ok); if (ok) cart = []; return ok; },
+    buy: async (item, quantity = 1, amount, options = {}) => Boolean((await send({ op: 'checkout', reference: options.reference, lines: [{ item, quantity, ...(amount === undefined ? {} : { amount }) }] })).ok),
     close: () => { void send({ op: 'close' }); },
     used: async (key) => (KEY.test(String(key)) && owns.includes(String(key)) ? Boolean((await send({ op: 'used', key })).ok) : false),
     on: ((ev: ShopEvent, fn: (x: unknown) => void) => {

package/tools/TOOLS.md

@@ -151,3 +151,24 @@ page. App record collections retain their own role capabilities.
 MCP calls have no default rate limit. Set `mcp.callsPerMinute` only if the studio
 chooses a policy. Payment-provider requirements (such as a currency supported by
 the configured wallet or tax calculation in Checkout) still apply.
+
+## Booking notifications and staff access
+
+For “tell my AI when a booking comes in”, follow the worked example in
+`functions/FUNCTIONS.md`: declare `mcp.events.bookings` in `studio.json`, build,
+then connect the owner's AI to `/mcp` with OAuth. Subscribe to
+`studio://events/bookings` with `resources/subscribe` and keep the authenticated
+SSE GET open. `notifications/resources/updated` carries the event in
+`params._meta["studio/event"]`. Resume with the SSE `Last-Event-ID`; do not poll.
+Nothing is enabled by default. Outbound webhooks are not included in 0.50.1.
+
+The owner can call `app_role` with `{app, role, signIn, revoke}`. `signIn` is an
+existing account's verified email or exact account name, not an account ID.
+Ambiguous names require a verified email. Grant with `revoke: false`; revoke with
+`revoke: true`. The person must first have signed in. Current grants govern tools,
+resources and event delivery.
+
+`app_records` also accepts `operation: "delete"`, with the record's current
+`version`, where the selected role declares `delete:<collection>`. Record conflict
+messages are returned intact so the AI can reload and retry; unexpected tool
+errors remain generic to avoid exposing secrets.

package/tools/tools.ts

@@ -3,7 +3,7 @@ export type Audience = 'public' | 'signed-in' | 'owner' | { app: string; role: s
 export interface ToolContext {
   readonly purchase?: { readonly id: string };
   readonly caller: { readonly id: string | null; readonly owner: boolean; readonly client: string | null; readonly roles: Readonly<Record<string, readonly string[]>> };
-  records(args: { app: string; role?: string; collection: string; id?: string; operation?: 'read' | 'create' | 'update'; data?: Record<string, unknown>; version?: number }): Promise<unknown>;
+  records(args: { app: string; role?: string; collection: string; id?: string; operation?: 'read' | 'create' | 'update' | 'delete'; data?: Record<string, unknown>; version?: number }): Promise<unknown>;
   office(path: string, body?: Record<string, unknown>, query?: Record<string, string>): Promise<unknown>;
   shop(): Promise<unknown>;
   rooms: { send(event: {game: string; room: string; event: string; data: unknown}): Promise<unknown> };

package/worker/build-id.mjs

@@ -1,2 +1,2 @@
 // Generated by lib/build-identity.mjs; identifies the bundled runtime sources.
-export const STUDIO_BUILD = Object.freeze({"version":"0.49.0","sha256":"26095bfdf585bf237d209c64a8ee5e2f99cbb901814dcf972d5872d753127413"});
+export const STUDIO_BUILD = Object.freeze({"version":"0.50.1","sha256":"0ff5d7cf032cfcbfd6fa3a787c60055eadce37a46fd8f7fc09c33e073310d6ae"});

package/worker/event-resources.mjs

@@ -0,0 +1,116 @@
+import {allowed,currentCaller} from './mcp-tools.mjs';
+import {settingsOf,launchOf} from './office.mjs';
+
+/** Explicit studio declarations only; these also retain their event types. */
+export function eventFeeds(env) {
+  return JSON.parse(env.STUDIO_EVENT_FEEDS??'{}');
+}
+export function feedSubscriptions(env) {
+  return Object.entries(eventFeeds(env)).map(([name,feed])=>({name:'@events/'+name,event:feed.event}));
+}
+export const feedUri=name=>'studio://events/'+name;
+export async function readableFeed(env,cat,caller,name) {
+  const feed=eventFeeds(env)[name];
+  if(!feed||!caller.id||!await allowed(feed.audience??'owner',caller,env))return false;
+  if(feed.event==='record.changed') {
+    const app=cat.games.find(g=>g.id===feed.app&&g.kind==='app');
+    if(!app||!app.records?.collections?.[feed.collection])return false;
+    if(caller.owner)return true;
+    if(launchOf(app,await settingsOf(env,{fresh:true}),env)!=='public')return false;
+    return Object.entries(app.roles??{}).some(([role,decl])=>decl.can.includes('read:'+feed.collection)&&(!decl.signIn||caller.roles?.[app.id]?.includes(role)));
+  }
+  // Non-record events have no app read capability; they remain owner-only.
+  return caller.owner===true;
+}
+export async function feedEvents(env,name,{after=0,through=Number.MAX_SAFE_INTEGER}={}) {
+  const feed=eventFeeds(env)[name];if(!feed)return [];
+  const rows=(await env.DB.prepare('SELECT seq,id,type,data,at FROM studio_events WHERE type=?1 AND seq>?2 AND seq<=?3 ORDER BY seq LIMIT 100').bind(feed.event,after,through).all()).results;
+  return rows.map(r=>({...r,data:JSON.parse(r.data)}));
+}
+export function matchesFeed(feed,event) {
+  return feed.event===event.type && (feed.event!=='record.changed'||(event.data.app===feed.app&&event.data.collection===feed.collection));
+}
+const key=(connection,name)=>'event-sub:'+connection+':'+name;
+export async function subscribeFeed(env,cat,caller,uri,remove=false) {
+  const name=uri?.startsWith('studio://events/')?uri.slice(16):'';
+  if(!/^[a-z][a-z0-9-]*$/.test(name)||!await readableFeed(env,cat,caller,name))throw new Error('Event resource unavailable');
+  if(remove)await env.DB.prepare('DELETE FROM mcp_kv WHERE key=?1').bind(key(caller.connection,name)).run();
+  else {
+    const seq=(await env.DB.prepare('SELECT COALESCE(MAX(seq),0) seq FROM studio_events').first()).seq;
+    await env.DB.prepare('INSERT OR IGNORE INTO mcp_kv(key,value,expires) VALUES(?1,?2,NULL)').bind(key(caller.connection,name),JSON.stringify({connection:caller.connection,name,after:seq})).run();
+  }
+}
+export function eventHub(env,connection) {return env.LOBBY.get(env.LOBBY.idFromName('@studio-events/'+connection));}
+export async function pushEvents(env,cat,origin) {
+  if(!env.LOBBY||!Object.keys(eventFeeds(env)).length)return;
+  // Page subscriptions, without a studio-wide subscription or delivery cap.
+  let after='';const seen=new Set();
+  for(;;){
+    const rows=(await env.DB.prepare("SELECT key,value FROM mcp_kv WHERE key LIKE 'event-sub:%' AND key>?1 ORDER BY key LIMIT 100").bind(after).all()).results;
+    for(const row of rows){const {connection}=JSON.parse(row.value);if(seen.has(connection))continue;seen.add(connection);
+      const response=await eventHub(env,connection).fetch('https://events/__studio_events',{method:'POST',body:JSON.stringify({op:'wake',connection,cat,origin})});
+      if(!response.ok)throw new Error('Event stream wake failed');
+    }
+    if(rows.length<100)break;after=rows.at(-1).key;
+  }
+}
+
+/** One existing Lobby object per OAuth connection: streams never live in a Worker isolate. */
+export class EventStreams {
+  constructor(env,ctx){this.env=env;this.ctx=ctx;this.stream=null;this.tail=Promise.resolve();}
+  close(stream){stream.cancelled=true;stream.resume?.();try{stream.controller.close();}catch{}if(this.stream===stream)this.stream=null;}
+  background(input){this.ctx.waitUntil(this.wake(input).catch(error=>{if(this.stream)this.close(this.stream);console.error('Event stream delivery failed',error);}));}
+  async fetch(request) {
+    const input=await request.json();
+    if(input.op==='stream') {
+      // A reconnect replaces the previous GET, including a half-open socket.
+      if(this.stream)this.close(this.stream);
+      await this.tail;
+      const {connection,lastId}=input;
+      const subscriptions=(await this.env.DB.prepare("SELECT value FROM mcp_kv WHERE key LIKE ?1").bind('event-sub:'+connection+':%').all()).results;
+      let after=subscriptions.length?Math.min(...subscriptions.map(r=>JSON.parse(r.value).after)):(await this.env.DB.prepare('SELECT COALESCE(MAX(seq),0) seq FROM studio_events').first()).seq,name='';
+      if(lastId){const parts=lastId.split('/');if(parts.length!==3||parts[0]!==connection||!/^\d+$/.test(parts[1]))return new Response('Invalid Last-Event-ID',{status:400});after=Number(parts[1]);name=parts[2];}
+      const stream={...input,after,name,controller:null,cancelled:false,resume:null};
+      const body=new ReadableStream({start:controller=>{stream.controller=controller;controller.enqueue(new TextEncoder().encode(': connected\n\n'));},pull:()=>{const resume=stream.resume;stream.resume=null;resume?.();},cancel:()=>this.close(stream)});
+      this.stream=stream;
+      // Replay and later wakes share one ordered pump. Backpressure must not
+      // hold up the writer's request or a function handler.
+      this.background(input);
+      return new Response(body,{headers:{'content-type':'text/event-stream','cache-control':'no-store'}});
+    }
+    this.background(input);return new Response(null,{status:204});
+  }
+  wake(input){const work=this.tail.then(()=>this.deliver(input));this.tail=work.catch(()=>{});return work;}
+  async deliver(input) {
+    const stream=this.stream;if(!stream)return;
+    let caller;
+    try{caller=await currentCaller(this.env,{connection:input.connection});}
+    catch{this.close(stream);return;}
+    const rows=(await this.env.DB.prepare("SELECT value FROM mcp_kv WHERE key LIKE ?1").bind('event-sub:'+caller.connection+':%').all()).results;
+    const subscriptions=[];
+    for(const row of rows){const sub=JSON.parse(row.value);if(await readableFeed(this.env,input.cat,caller,sub.name))subscriptions.push(sub);}
+    const through=(await this.env.DB.prepare('SELECT COALESCE(MAX(seq),0) seq FROM studio_events').first()).seq;
+    let cursor=Math.max(0,stream.after-1);
+    for(;;){
+      const events=(await this.env.DB.prepare('SELECT seq,id,type,data,at FROM studio_events WHERE seq>?1 AND seq<=?2 ORDER BY seq LIMIT 100').bind(cursor,through).all()).results;
+      for(const raw of events){const event={...raw,data:JSON.parse(raw.data)};
+        for(const sub of subscriptions.sort((a,b)=>a.name<b.name?-1:a.name>b.name?1:0)){
+          if(event.seq<=sub.after||event.seq<stream.after||event.seq===stream.after&&sub.name<=stream.name||!matchesFeed(eventFeeds(this.env)[sub.name],event))continue;
+          if(stream.cancelled)return;
+          if(stream.controller.desiredSize<=0)await new Promise(resolve=>{stream.resume=resolve;});
+          if(stream.cancelled)return;
+          // Recheck identity and grants for every event, including replay.
+          const fresh=await currentCaller(this.env,{connection:caller.connection}).catch(()=>null);
+          if(!fresh){this.close(stream);return;}
+          if(!await readableFeed(this.env,input.cat,fresh,sub.name))continue;
+          if(!await this.env.DB.prepare('SELECT key FROM mcp_kv WHERE key=?1').bind(key(caller.connection,sub.name)).first())continue;
+          const id=`${caller.connection}/${event.seq}/${sub.name}`;
+          const notification={jsonrpc:'2.0',method:'notifications/resources/updated',params:{uri:feedUri(sub.name),_meta:{'studio/event':event}}};
+          try{stream.controller.enqueue(new TextEncoder().encode(`id: ${id}\nevent: message\ndata: ${JSON.stringify(notification)}\n\n`));}catch{this.close(stream);return;}
+          stream.after=event.seq;stream.name=sub.name;
+        }
+      }
+      if(events.length<100)break;cursor=events.at(-1).seq;
+    }
+  }
+}

package/worker/functions-schema.mjs

@@ -69,3 +69,18 @@ ELSE 0 END BEGIN
  SELECT 'refund:' || json_extract(NEW.value,'$.id'),'payment.refunded',
  json_object('refund',json_extract(NEW.value,'$.id'),'payment',json_extract(NEW.value,'$.payment_intent'),'amount',json_extract(NEW.value,'$.amount'),'currency',json_extract(NEW.value,'$.currency')),json_extract(NEW.value,'$.at')*1000;
 END;`).join('\n');
+
+/** Application correlation is saved before payment; only the paid transition emits it. */
+export const FUNCTIONS_REFERENCE_MIGRATION_FILE = '0021_app_payment_reference.sql';
+export const FUNCTIONS_REFERENCE_MIGRATION = `
+DROP TRIGGER IF EXISTS shop_orders_function_paid;
+CREATE TRIGGER shop_orders_function_paid AFTER UPDATE ON shop_orders
+WHEN EXISTS (SELECT 1 FROM function_subscriptions WHERE type='order.paid')
+ AND OLD.paid_at IS NULL AND NEW.paid_at IS NOT NULL
+ AND NOT EXISTS (SELECT 1 FROM purchase_orders WHERE id=NEW.id) BEGIN
+ INSERT OR IGNORE INTO studio_events(id,type,data,at)
+ VALUES('shop_orders:' || NEW.id || ':paid','order.paid',
+ json_object('order',NEW.id,'source','shop_orders','amount',NEW.amount,'currency',NEW.currency,'mode',NEW.mode,
+ 'app',NEW.game,'reference',(SELECT value FROM meta WHERE key='shop-reference:' || NEW.id)),NEW.paid_at);
+END;
+`;

package/worker/functions.mjs

@@ -1,11 +1,13 @@
+import {feedSubscriptions,pushEvents} from './event-resources.mjs';
 import { services } from './mcp-tools.mjs';
 import { isOwner, sameOrigin } from './office.mjs';
 import { esc } from './site.mjs';
 let load = async () => [];
 export function useFunctions(loader) { load = loader; }
-export async function hasFunctionType(type) { return (await load()).some(fn=>fn.event===type); }
+export async function hasFunctionType(type,env={}) { return [...await load(),...feedSubscriptions(env)].some(fn=>fn.event===type); }
 export async function syncFunctions(env, definitions = null, now = Date.now()) {
   definitions ??= await load();
+  definitions=[...definitions.filter(fn=>!fn.name.startsWith('@events/')),...feedSubscriptions(env)];
   if (!env.DB || !definitions.length) return definitions;
   // Deploy owns the production registry; an old in-flight Worker must not overwrite it.
   if(await env.DB.prepare("SELECT 1 FROM meta WHERE key='function-registry-deployed'").first())return definitions;
@@ -39,29 +41,41 @@ export async function runFunctions(env, cat, origin, {definitions, now = Date.no
   definitions = await syncFunctions(env,definitions,now());
   if(!definitions.length)return;
   if(typeof cat==='function')cat=await cat();
-  for (const fn of definitions) {
-    const subscription=await env.DB.prepare('SELECT cursor,type FROM function_subscriptions WHERE name=?1').bind(fn.name).first();
-    if(!subscription || subscription.type!==fn.event)continue;
-    const page=(await env.DB.prepare('SELECT seq,id,data FROM studio_events WHERE type=?1 AND seq>?2 ORDER BY seq LIMIT 100').bind(fn.event,subscription.cursor).all()).results;
-    if(page.length)await env.DB.batch([
-      ...page.filter(e=>!fn.schedule||JSON.parse(e.data).function===fn.name).map(e=>env.DB.prepare('INSERT OR IGNORE INTO function_deliveries(event,function) SELECT id,?2 FROM studio_events WHERE id=?1').bind(e.id,fn.name)),
-      env.DB.prepare('UPDATE function_subscriptions SET cursor=MAX(cursor,?2) WHERE name=?1').bind(fn.name,page.at(-1).seq),
-    ]);
-    const rows=(await env.DB.prepare(`SELECT d.*,e.type,e.data,e.at FROM function_deliveries d JOIN studio_events e ON e.id=d.event WHERE d.function=?1 AND d.state IN ('pending','failed','running') AND d.due<=?2 ORDER BY d.due LIMIT 100`).bind(fn.name,now()).all()).results;
-    for (const row of rows) {
-      const lease=crypto.randomUUID();
-      const claimed=await env.DB.prepare(`UPDATE function_deliveries SET state='running',lease=?3,due=?4,attempts=attempts+1 WHERE event=?1 AND function=?2 AND state!='complete' AND due<=?5`).bind(row.event,fn.name,lease,now()+leaseMs,now()).run();
-      if (!claimed.meta.changes) continue;
-      try {
-        const event=Object.freeze({id:row.event,type:row.type,at:row.at,data:JSON.parse(row.data),attempt:row.attempts+1});
-        await fn.handler(event,services(env,cat,origin,{id:'studio-function',owner:true,client:null},'function:'+fn.name,fn));
-        await env.DB.prepare(`UPDATE function_deliveries SET state='complete',completed=?4,error=NULL WHERE event=?1 AND function=?2 AND lease=?3`).bind(row.event,fn.name,lease,now()).run();
-      } catch {
-        // Handler errors may contain credentials. The office identifies the function/event; Worker logs are the studio's debugging surface.
-        await env.DB.prepare(`UPDATE function_deliveries SET state='failed',error='Function failed; inspect its code and retry',due=?4 WHERE event=?1 AND function=?2 AND lease=?3`).bind(row.event,fn.name,lease,now()+leaseMs).run();
+  // An AI notification must not wait behind a slow function handler.
+  const notify=()=>pushEvents(env,cat,origin).catch(error=>console.error('Event notification wake failed',error));
+  const notifications=notify();
+  let more;
+  do {
+    more=false;
+    for (const fn of definitions) {
+      if(!fn.handler)continue;
+      const subscription=await env.DB.prepare('SELECT cursor,type FROM function_subscriptions WHERE name=?1').bind(fn.name).first();
+      if(!subscription || subscription.type!==fn.event)continue;
+      const page=(await env.DB.prepare('SELECT seq,id,data FROM studio_events WHERE type=?1 AND seq>?2 ORDER BY seq LIMIT 100').bind(fn.event,subscription.cursor).all()).results;
+      if(page.length)more=true;
+      if(page.length)await env.DB.batch([
+        ...page.filter(e=>!fn.schedule||JSON.parse(e.data).function===fn.name).map(e=>env.DB.prepare('INSERT OR IGNORE INTO function_deliveries(event,function) SELECT id,?2 FROM studio_events WHERE id=?1').bind(e.id,fn.name)),
+        env.DB.prepare('UPDATE function_subscriptions SET cursor=MAX(cursor,?2) WHERE name=?1').bind(fn.name,page.at(-1).seq),
+      ]);
+      const rows=(await env.DB.prepare(`SELECT d.*,e.type,e.data,e.at FROM function_deliveries d JOIN studio_events e ON e.id=d.event WHERE d.function=?1 AND d.state IN ('pending','failed','running') AND d.due<=?2 ORDER BY d.due LIMIT 100`).bind(fn.name,now()).all()).results;
+      if(rows.length===100)more=true;
+      for (const row of rows) {
+        const lease=crypto.randomUUID();
+        const claimed=await env.DB.prepare(`UPDATE function_deliveries SET state='running',lease=?3,due=?4,attempts=attempts+1 WHERE event=?1 AND function=?2 AND state!='complete' AND due<=?5`).bind(row.event,fn.name,lease,now()+leaseMs,now()).run();
+        if (!claimed.meta.changes) continue;
+        try {
+          const event=Object.freeze({id:row.event,type:row.type,at:row.at,data:JSON.parse(row.data),attempt:row.attempts+1});
+          await fn.handler(event,services(env,cat,origin,{id:'studio-function',owner:true,client:null},'function:'+fn.name,fn));
+          await env.DB.prepare(`UPDATE function_deliveries SET state='complete',completed=?4,error=NULL WHERE event=?1 AND function=?2 AND lease=?3`).bind(row.event,fn.name,lease,now()).run();
+        } catch {
+          // Handler errors may contain credentials. The office identifies the function/event; Worker logs are the studio's debugging surface.
+          await env.DB.prepare(`UPDATE function_deliveries SET state='failed',error='Function failed; inspect its code and retry',due=?4 WHERE event=?1 AND function=?2 AND lease=?3`).bind(row.event,fn.name,lease,now()+leaseMs).run();
+        }
       }
     }
-  }
+  } while(more);
+  await notifications;
+  await notify();
   await pruneEvents(env);
 }
 export async function scheduleFunctions(event,env,cat,origin) {

package/worker/index.mjs

@@ -621,18 +621,31 @@ export default {
   async fetch(request, env, ctx) {
     const url = new URL(request.url);
     await (await import('./functions.mjs')).syncFunctions(env);
+    const dispatch=()=>import('./functions.mjs').then(m=>m.runFunctions(env,()=>catalogue(env,url.origin),url.origin));
+    // Some routes reconcile shop state in waitUntil after returning their page.
+    // Keep dispatch behind those writes too, preserving the runtime context's
+    // methods and OAuth verification symbols through the proxy.
+    const requestCtx=ctx?.waitUntil?new Proxy(ctx,{get(target,key){
+      if(key==='waitUntil')return work=>ctx.waitUntil(Promise.resolve(work).finally(dispatch));
+      const value=Reflect.get(target,key,target);return typeof value==='function'?value.bind(target):value;
+    }}):ctx;
     // A standalone copy's Lobby call (worker/standalone.mjs): every answer to it can be read by the app's page, an
     // unknown game's 404 and a failure included, so the app can say why it plays offline. No other address is opened.
     const appRecords = isAppOrigin(request) && /^\/[^/]+\/api\/app\/records\//.test(url.pathname);
     if (appRecords && request.method === 'OPTIONS') return appCors(request, new Response(null, { status: 204, headers: { 'access-control-allow-methods': 'GET, POST, PUT, DELETE', 'access-control-allow-headers': 'content-type' } }));
     const appLobby = isAppOrigin(request) && /^\/[^/]+\/api\/lobby\/?$/.test(url.pathname);
     let res;
-    try { res = finish(await route(request, env, ctx), url.pathname); } catch (error) {
+    try { res = finish(await route(request, env, requestCtx), url.pathname); } catch (error) {
       if (!appLobby) throw error;
       try { console.error(JSON.stringify({ at: new Date().toISOString(), ev: 'lobby-route-failed', path: url.pathname, error: errorLine(error) })); } catch { /* no console */ }
       res = json({ ok: false, error: 'failed' }, 500);
+    } finally {
+      // A route can commit a write and then fail. Its outbox still needs delivery.
+      if(env.DB) {
+        const delivery=dispatch();
+        if(ctx?.waitUntil)ctx.waitUntil(delivery);else await delivery;
+      }
     }
-    if(ctx?.waitUntil && ['POST','PUT','DELETE'].includes(request.method)) ctx.waitUntil((async()=>{const {runFunctions}=await import('./functions.mjs');await runFunctions(env,()=>catalogue(env,url.origin),url.origin);})());
     if (appLobby || appRecords) return appCors(request, res);
     // A referral's arrival (worker/referrals.mjs): only a person's page load with ?via= of another site, on a studio
     // that pays referrals. The page is answered first; a cookie is added to it only then.
@@ -1840,7 +1853,7 @@ export class Table {
   queueFunctionEvent(type,data) {
     if(!this.env.DB || this.env.HOMIE_PREVIEW==='1' || !this.ctx.storage.sql) return;
     this.ctx.waitUntil((async()=>{
-      if(!await (await import('./functions.mjs')).hasFunctionType(type))return;
+      if(!await (await import('./functions.mjs')).hasFunctionType(type,this.env))return;
       const sql=this.ctx.storage.sql;
       sql.exec('CREATE TABLE IF NOT EXISTS function_outbox(id TEXT PRIMARY KEY,type TEXT,data TEXT,at INTEGER)');
       sql.exec('INSERT INTO function_outbox VALUES(?,?,?,?)',crypto.randomUUID(),type,JSON.stringify(data),Date.now());
@@ -1858,6 +1871,8 @@ export class Table {
       try {await emitEvent(this.env,row.type,JSON.parse(row.data),{id:row.id,at:row.at});sql.exec('DELETE FROM function_outbox WHERE id=?',row.id);}
       catch {this.armRoom(Date.now()+60000);await this.alarmWrite;return;}
     }
+    const cat=await catalogue(this.env,'https://studio.invalid');
+    await (await import('./functions.mjs')).runFunctions(this.env,cat,cat.studio?.url??'https://studio.invalid');
   }
 
   /**
@@ -2565,6 +2580,11 @@ export class Lobby {
 
   /** A request that throws is said with what it was (never its body) and answered as a failure, not left uncaught. */
   async fetch(request) {
+    if(new URL(request.url).pathname==='/__studio_events') {
+      const {EventStreams}=await import('./event-resources.mjs');
+      this.eventStreams??=new EventStreams(this.env,this.ctx);
+      return this.eventStreams.fetch(request);
+    }
     try { return await this.answer(request); } catch (error) {
       let path = '';
       try { path = new URL(request.url).pathname; } catch { /* not an address */ }

package/worker/mcp-tools.mjs

@@ -38,10 +38,10 @@ export function services(env, cat, origin, caller, namespace, definition = {}) {
     if (!meta || !/^[a-z][a-z0-9-]{0,39}$/.test(collection) || (id!==undefined && !/^[A-Za-z0-9_-]{1,64}$/.test(id))) throw new Error('unknown app, collection or record');
     if (!caller.owner && launchOf(meta,await settingsOf(env,{fresh:true}),env)!=='public') throw new Error('app is private');
     const url = new URL(`/${app}/api/app/records/${collection}${id ? '/'+id : ''}`,origin);if(role)url.searchParams.set('role',role);
-    const method = {read:'GET',create:'POST',update:'PUT'}[operation];if (!method) throw new Error('unsupported operation');
+    const method = {read:'GET',create:'POST',update:'PUT',delete:'DELETE'}[operation];if (!method) throw new Error('unsupported operation');
     const request = withToolIdentity(new Request(url,{method,headers:{origin,'content-type':'application/json'},...(method==='GET'?{}:{body:JSON.stringify({data,version})})}),caller);
     const response = await appRecordsRoute(request,env,meta,url,url.pathname.slice(app.length+2));
-    const result = await response.json(); if(!response.ok) throw new Error(result.error);return result;
+    const result = await response.json(); if(!response.ok) {const error=new Error(result.error);error.name='StudioOperationError';throw error;}return result;
   };
   const office = async (path, body, query={}) => {
     const delegated=definition.delegateOffice && await allowed(definition.audience,caller,env);
@@ -91,6 +91,17 @@ export function builtins(env,cat,origin) {
     tool('studio_info','The public studio, apps, games and posts.','public',object(),async()=>{const pub=publicCatalogue(cat,await settingsOf(env),env);return {studio:pub.studio?.name,games:pub.games.map(g=>({id:g.id,name:g.name,kind:g.kind??'game'})),posts:pub.posts};}),
     tool('studio_office','Live rooms and the players as shown in the office.','owner',object(),(_,ctx)=>ctx.office('/_studio/api/office')),
     tool('studio_shop','Orders, refunds and the shop state.','owner',object(),(_,ctx)=>ctx.shop()),
+    tool('app_role','Grant or revoke a staff role by verified email or exact sign-in name.','owner',object({app:str,role:str,signIn:{type:'string',maxLength:254},revoke:{type:'boolean'}},['app','role','signIn']),async({app,role,signIn,revoke},ctx)=>{
+      if(!ctx.caller.owner)throw new Error('Owner only');
+      const meta=cat.games.find(g=>g.id===app&&g.kind==='app');
+      if(!meta?.roles?.[role]?.signIn)throw new Error('Name a sign-in role');
+      const people=signIn.includes('@')
+        ? (await env.DB.prepare('SELECT p.id FROM players p JOIN player_emails e ON e.player=p.id WHERE e.email=?1 AND e.verified_at IS NOT NULL AND p.guest=0').bind(signIn.trim().toLowerCase()).all()).results
+        : (await env.DB.prepare('SELECT id FROM players WHERE name=?1 AND guest=0').bind(signIn).all()).results;
+      if(people.length!==1){const error=new Error(people.length?'Sign-in is ambiguous; use a verified email':'No signed-in account matches; ask the person to sign in first');error.name='StudioOperationError';throw error;}
+      await env.DB.prepare(revoke?'DELETE FROM app_roles WHERE app=?1 AND role=?2 AND player=?3':'INSERT OR IGNORE INTO app_roles(app,role,player) VALUES(?1,?2,?3)').bind(app,role,people[0].id).run();
+      return {ok:true,app,role,revoked:revoke===true};
+    }),
     tool('studio_players','The studio accounts as shown in the office.','owner',object({query:str}),({query})=>players.list(env,{q:query})),
     tool('studio_stats','Studio visits and plays.','owner',object(),()=>readStats(env,cat,{range:rangeOf(new URLSearchParams())})),
     tool('studio_posts','Published posts.','public',object(),()=>({posts:cat.posts??[]})),
@@ -102,7 +113,7 @@ export function builtins(env,cat,origin) {
       const collections=new Set(Object.values(roles).flatMap(r=>r.can.map(cap=>cap.split(':')[1])));
       return {app,roles,collections:Object.fromEntries(Object.entries(meta.records?.collections??{}).filter(([name])=>collections.has(name)))};
     }),
-    tool('app_records','List, read, create or update app records with the app role and record version.','public',object({app:str,role:str,collection:str,id:str,operation:{enum:['read','create','update']},data:{type:'object'},version:{type:'integer',minimum:1}},['app','collection']), (args,ctx)=>ctx.records(args)),
+    tool('app_records','List, read, create, update or delete app records with the app role and record version.','public',object({app:str,role:str,collection:str,id:str,operation:{enum:['read','create','update','delete']},data:{type:'object'},version:{type:'integer',minimum:1}},['app','collection']), (args,ctx)=>ctx.records(args)),
   ];
   for(const [name,path,description] of [
     ['room_announce','announce','Announce to a room.'],['room_kick','kick','Ask the owner to remove a player.'],['room_mute','mute','Ask the owner to mute a player.'],['room_close','close','Ask the owner to close a room.'],['studio_game','game','Ask the owner to change game access or room size.'],['shop_refund','shop/refund','Ask the owner to refund an order.'],