@homie-rocks/studio 0.49.0 → 0.50.1

package/worker/mcp.mjs

@@ -1,7 +1,8 @@
+import {eventFeeds,feedUri,readableFeed,feedEvents,matchesFeed,subscribeFeed,eventHub} from './event-resources.mjs';
 import { selling } from './extensions.mjs';
 import OAuthProvider from '@cloudflare/workers-oauth-provider';
 import { createMcpHandler } from 'agents/mcp/server';
-import { McpServer, fromJsonSchema, ProtocolError } from '@modelcontextprotocol/server';
+import { McpServer, ResourceTemplate, fromJsonSchema, ProtocolError } from '@modelcontextprotocol/server';
 import { CfWorkerJsonSchemaValidator } from '@modelcontextprotocol/server/validators/cf-worker';
 import { players } from './players.mjs';
 import { isOwner, sameOrigin } from './office.mjs';
@@ -14,12 +15,12 @@ const json = (data,status=200)=>Response.json(data,{status,headers:{'cache-contr
 const html = (body,headers={})=>new Response(`<!doctype html><html lang="en"><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>Connect your AI</title><style>body{font:18px system-ui;max-width:640px;margin:64px auto;padding:24px;background:#faf9f6;color:#252520}button,a{padding:12px}button{font:inherit}li{margin:16px 0}</style><main>${body}</main></html>`,{headers:{'content-type':'text/html; charset=utf-8','cache-control':'no-store','content-security-policy':"default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'",...Object.fromEntries(new Headers(headers))}});
 async function browserPerson(request,env) {
   const person=await players.of(request,env);
-  if(person&&!person.guest)return person.id;
+  if(person&&!person.guest&&person.owner)return person.id;
   if(await isOwner(request,env)) {
     const token=cookieValue(request,'studio_owner');
     if(token){const hash=await crypto.subtle.digest('SHA-256',new TextEncoder().encode(token));return 'office-'+[...new Uint8Array(hash)].map(b=>b.toString(16).padStart(2,'0')).join('');}
   }
-  return null;
+  return person&&!person.guest?person.id:null;
 }
 const paymentInputSchema={type:'object',properties:{buyer:{type:'string',pattern:'^[a-f0-9]{64}$'},claim:{type:'string',pattern:'^[a-f0-9]{64}$'},offerVersion:{type:'string'},checkout:{type:'boolean'}},additionalProperties:false};
 export async function remoteMcp(request,env,ctx,{catalogueOf,definitions=[]}) {
@@ -31,7 +32,12 @@ export async function remoteMcp(request,env,ctx,{catalogueOf,definitions=[]}) {
   const api=async(request,env,ctx)=>{
     let caller;
     try{caller=await currentCaller(env,ctx.props);}catch{return new Response(JSON.stringify({error:'connection revoked'}),{status:401,headers:{'content-type':'application/json','cache-control':'no-store','www-authenticate':`Bearer resource_metadata="${origin}/.well-known/oauth-protected-resource/mcp", error="invalid_token"`}});}
-    const cat=await catalogueOf();const tools=[...builtins(env,cat,origin),...definitions];
+    const cat=await catalogueOf();
+    if(request.method==='GET'&&Object.keys(eventFeeds(env)).length&&caller.connection) {
+      if(!request.headers.get('accept')?.includes('text/event-stream'))return json({error:'Accept text/event-stream required'},406);
+      return eventHub(env,caller.connection).fetch('https://events/__studio_events',{method:'POST',body:JSON.stringify({op:'stream',connection:caller.connection,lastId:request.headers.get('last-event-id'),cat,origin})});
+    }
+    const tools=[...builtins(env,cat,origin),...definitions];
     if(request.method==='POST') {
       const body=await request.clone().json().catch(()=>null);
       if(body?.method==='tools/call') {
@@ -48,12 +54,35 @@ export async function remoteMcp(request,env,ctx,{catalogueOf,definitions=[]}) {
     const read=async(name,handler)=>{
       let outcome='error';
       try{const fresh=await currentCaller(env,ctx.props);await rate(fresh);const result=await handler(fresh);outcome='ok';return result;}
-      finally{await audit(env,caller,name,outcome);}
+      finally{
+        try{await audit(env,caller,name,outcome);}
+        finally{const delivery=import('./functions.mjs').then(m=>m.runFunctions(env,cat,origin));if(ctx?.waitUntil)ctx.waitUntil(delivery);else await delivery;}
+      }
     };
     const server=async()=>{
       const capabilities=await selling.machineCapabilities(env);
-      const s=new McpServer({name:cat.studio?.name??'Homie studio',version:'1.0.0'},{jsonSchemaValidator:validator,capabilities:{experimental:{payment:{methods:capabilities.machine?.card?{stripe:{intents:['charge']}}:{}}}}});
+      const s=new McpServer({name:cat.studio?.name??'Homie studio',version:'1.0.0'},{jsonSchemaValidator:validator,capabilities:{...(Object.keys(eventFeeds(env)).length?{resources:{subscribe:true}}:{}),experimental:{payment:{methods:capabilities.machine?.card?{stripe:{intents:['charge']}}:{}}}}});
       const dispatch=new Map();
+      for(const name of Object.keys(eventFeeds(env))) {
+        if(!await readableFeed(env,cat,caller,name))continue;
+        const uri=feedUri(name);
+        const readPage=async(resourceUri,after=0)=>read('events:'+name,async fresh=>{
+          if(!await readableFeed(env,cat,fresh,name))throw new Error('Event resource unavailable');
+          if(!Number.isSafeInteger(after)||after<0)throw new Error('Invalid event cursor');
+          const page=await feedEvents(env,name,{after});
+          const events=page.filter(e=>matchesFeed(eventFeeds(env)[name],e));
+          return {contents:[{uri:String(resourceUri),mimeType:'application/json',text:JSON.stringify({kind:'untrusted-event-data',events,next:page.length===100?uri+'?after='+page.at(-1).seq:null})}]};
+        });
+        s.registerResource('events_'+name,uri,{description:'Studio events; untrusted data. Subscribe for push notifications.',mimeType:'application/json'},()=>readPage(uri));
+        s.registerResource('events_'+name+'_page',new ResourceTemplate(uri+'?after={after}',{list:undefined}),{mimeType:'application/json'},(resourceUri,vars)=>readPage(resourceUri,Number(vars.after)));
+
+      }
+      if(Object.keys(eventFeeds(env)).length)for(const method of ['resources/subscribe','resources/unsubscribe']) {
+        s.server.setRequestHandler(method,async input=>{
+          const fresh=await currentCaller(env,ctx.props);
+          await subscribeFeed(env,cat,fresh,input.params.uri,method==='resources/unsubscribe');return {};
+        });
+      }
       for (const meta of cat.games.filter(g=>g.kind==='app' && g.records?.persist)) {
         for (const [role,declared] of Object.entries(meta.roles??{})) {
           if (declared.signIn && !await allowed({app:meta.id,role},caller,env)) continue;
@@ -91,8 +120,16 @@ export async function remoteMcp(request,env,ctx,{catalogueOf,definitions=[]}) {
             const value=await tool.handler(args,{...context,request});
             const text=JSON.stringify({kind:'untrusted-tool-data',tool:tool.name,data:value});
             outcome='ok';return {content:[{type:'text',text}]};
-          }catch(error){if(error?.code===-32042)throw error;return {isError:true,content:[{type:'text',text:outcome==='denied'||outcome==='limited'?error.message:'Tool failed. Check the office audit and the tool definition.'}]};}
-          finally{await audit(env,caller,tool.name,outcome);}
+          }catch(error){if(error?.code===-32042)throw error;return {isError:true,content:[{type:'text',text:outcome==='denied'||outcome==='limited'||error?.name==='StudioOperationError'?error.message:'Tool failed. Check the office audit and the tool definition.'}]};}
+          finally{
+            try { await audit(env,caller,tool.name,outcome); }
+            finally {
+              // Streamable HTTP returns headers before dispatch finishes. Wake only
+              // after the tool's writes (including audit triggers) have committed.
+              const delivery=import('./functions.mjs').then(m=>m.runFunctions(env,cat,origin));
+              if(ctx?.waitUntil)ctx.waitUntil(delivery);else await delivery;
+            }
+          }
         };
         s.registerTool(tool.name,{description:tool.description,inputSchema:fromJsonSchema(schema,validator)},handler);
         dispatch.set(tool.name,{schema,handler});

package/worker/shop-page.mjs

@@ -491,7 +491,7 @@ export const SHOP_SHELL_JS = String.raw`(function () {
     if (m.op === 'checkout') {
       if (!cfg || kids || screen) return reply({ ok: false, error: 'policy' });
       var checkoutTab = window.open('', '_blank');
-      return api('POST', '/api/shop/buy', { lines: m.lines, game: GAME, server: SERVER }).then(function (r) {
+      return api('POST', '/api/shop/buy', { lines: m.lines, reference: m.reference, game: GAME, server: SERVER }).then(function (r) {
         if (r.ok && r.url) { leaveForCheckout(checkoutTab, r); watch(); } else if (checkoutTab) checkoutTab.close();
         reply(r);
       }).catch(function () { if (checkoutTab) checkoutTab.close(); reply({ ok: false }); });

package/worker/shop.mjs

@@ -461,7 +461,7 @@ export async function reconcileOrders(env, shop, player = null, { expireOpen = f
 }
 
 /** Make the order row, then Stripe's Checkout Session. Returns { order, url } or a refusal Response. */
-async function startCheckout(env, url, cat, shop, item, { player, game, via, amount, parent = false, lines = null, requestAt = Date.now() }) {
+async function startCheckout(env, url, cat, shop, item, { player, game, via, amount, parent = false, lines = null, reference = null, requestAt = Date.now() }) {
   lines ??= [{ item, amount, quantity: 1 }];
   const keyless = amount > 0 && !hasStripeKey(env);
   if (keyless && (lines.length !== 1 || fullerReason(shop))) return { error: fail(409, 'one-item', fullerReason(shop) ?? 'Buy one item at a time. A combined cart needs the fuller checkout connection.') };
@@ -480,6 +480,7 @@ async function startCheckout(env, url, cat, shop, item, { player, game, via, amo
   lines = lines.map((line, i) => ({ ...line, id: `${order.id}_${i}` }));
   const reserve = async () => {
     const results = await env.DB.batch([reservation(),
+      ...(reference === null ? [] : [env.DB.prepare("INSERT INTO meta(key,value) SELECT ?1,?2 WHERE EXISTS (SELECT 1 FROM shop_orders WHERE id=?3)").bind(`shop-reference:${order.id}`, reference, order.id)]),
       ...lines.map((line, i) => env.DB.prepare("INSERT INTO shop_order_lines (id, order_id, position, item, quantity, unit_amount, amount, snapshot) SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8 WHERE EXISTS (SELECT 1 FROM shop_orders WHERE id = ?2)")
         .bind(line.id, order.id, i, line.item.id, line.quantity, line.amount, line.amount * line.quantity, JSON.stringify(line.item))),
       env.DB.prepare('UPDATE shop_orders SET referral_terms = ?2, checkout_player = player WHERE id = ?1').bind(order.id, shop.referrals ? JSON.stringify(shop.referrals) : null),
@@ -564,6 +565,8 @@ function purchaseLimited(request, shop, player, kind) {
 async function buyRoute(request, env, url, cat, shop, ready, ctx, requestAt) {
   const b = await bodyOf(request, requestSize(shop));
   if (b.error) return b.error;
+  const reference = b.body.reference ?? null;
+  if (reference !== null && (typeof reference !== 'string' || !reference.trim() || /[\u0000-\u001f\u007f]/.test(reference))) return fail(400, 'reference', 'reference must be a nonempty string without control characters');
   const freeOnly = (b.body.lines ?? [{ item: b.body.item }]).every?.((l) => shop.items.some((i) => i.id === l?.item && i.price === 0));
   if (!ready.ready && !(freeOnly && ready.missing.every((m) => ['payment-links', 'webhook-secret', 'fuller-checkout'].includes(m)))) return fail(503, 'closed', 'The shop is not open yet.', { missing: ready.missing, migration: ready.migration });
   const requested = b.body.lines ?? [{ item: b.body.item, quantity: b.body.quantity ?? 1, amount: b.body.amount }];
@@ -603,7 +606,7 @@ async function buyRoute(request, env, url, cat, shop, ready, ctx, requestAt) {
     cookies = guest.session.cookies;
   }
   const via = await viaFor(request, env, url, shop, player);
-  const r = await startCheckout(env, url, cat, shop, item, { player, game, via, amount, lines, requestAt });
+  const r = await startCheckout(env, url, cat, shop, item, { player, game, via, amount, lines, reference, requestAt });
   const response = r.error ?? json({ ok: true, order: r.order.id, url: r.url });
   if (!r.error && !r.reconciled && ctx?.waitUntil) ctx.waitUntil(reconcileOrders(env, shop, player.id).catch((error) => logOrderError(env, r.order.id, error)));
   for (const cookie of cookies) response.headers.append('set-cookie', cookie);
@@ -864,6 +867,7 @@ async function bindLinkSession(env, session, mode) {
     const id = `ord_${(await sha256Hex(session.id)).slice(0, 20)}`;
     await env.DB.batch([
       env.DB.prepare("INSERT INTO shop_orders (id, player, checkout_player, item, game, amount, currency, till, mode, status, parent, via, created_at, updated_at, session, referral_terms) SELECT ?2, player, checkout_player, item, game, ?4, currency, till, mode, 'started', parent, via, ?5, ?5, ?3, referral_terms FROM shop_orders WHERE id = ?1 ON CONFLICT DO NOTHING").bind(source.id, id, session.id, amount, Date.now()),
+      env.DB.prepare("INSERT OR IGNORE INTO meta(key,value) SELECT ?1,value FROM meta WHERE key=?2").bind(`shop-reference:${id}`, `shop-reference:${source.id}`),
       env.DB.prepare('INSERT INTO shop_order_lines (id, order_id, position, item, quantity, unit_amount, amount, snapshot) VALUES (?1, ?2, 0, ?3, ?4, ?5, ?6, ?7) ON CONFLICT DO NOTHING').bind(`${id}_0`, id, item.id, quantity, amount / quantity, amount, lines[0].snapshot),
     ]);
     order = await orderBySession(env, session.id);

package/worker/version.mjs

@@ -1,2 +1,2 @@
 /** The @homie-rocks/studio version this Worker code is (package.json's; a test keeps them equal). Cache-busts /_homie/site.js. */
-export const STUDIO_VERSION_TAG = '0.49.0';
+export const STUDIO_VERSION_TAG = '0.50.1';