@homie-rocks/studio 0.50.4 → 0.50.6

package/lib/shop.mjs

@@ -22,7 +22,6 @@ import { paidReleases } from './parts-upload.mjs';
  *   homie-studio shop orders                the latest orders (never a card or an email)
  *   homie-studio shop refund <order> [--reason requested_by_customer|duplicate|fraudulent] [--note "<why>"]
  *                                           ASKS the owner (a one-tap link): the AI never refunds by itself
- *   homie-studio shop statements [--period YYYY-MM] [--send]   the signed referral statements this studio owes
  *
  * The proof of ownership is the studio's own Cloudflare login, as for the office.
  */
@@ -139,7 +138,7 @@ export async function shopStatus(root, { url } = {}) {
 export async function shopOrders(root, { url } = {}) {
   const r = await withKey(root, url, (call) => call('/_studio/api/shop'));
   if (!r.ok) return { ok: false, command: 'shop orders', why: r.message ?? r.why ?? 'the studio did not answer' };
-  return { ok: true, command: 'shop orders', orders: (r.orders ?? []).map((o) => ({ id: o.id, at: new Date(o.createdAt).toISOString(), item: o.item, name: o.name, shown: o.shown, status: o.status, mode: o.mode, player: o.player?.name ?? null, via: o.via, stripe: o.stripe, manualRefund: o.manualRefund ?? null })) };
+  return { ok: true, command: 'shop orders', orders: (r.orders ?? []).map((o) => ({ id: o.id, at: new Date(o.createdAt).toISOString(), item: o.item, name: o.name, shown: o.shown, status: o.status, mode: o.mode, player: o.player?.name ?? null, stripe: o.stripe, manualRefund: o.manualRefund ?? null })) };
 }
 
 /** The AI proposes a refund: an ask the owner confirms with one tap (an office key can never refund by itself). */
@@ -149,28 +148,6 @@ export async function shopRefund(root, order, { url, reason, note, manualTransac
   return askedFor(root, url, r, 'shop refund');
 }
 
-export async function shopStatements(root, { url, period, cursor = '', send = false } = {}) {
-  if (!send) {
-    const r = await withKey(root, url, (call) => call(`/_studio/api/shop/statements?cursor=${encodeURIComponent(cursor)}${period ? `&period=${encodeURIComponent(period)}` : ''}`));
-    return r.ok ? { ok: true, command: 'shop statements', period: r.period, nextCursor: r.nextCursor, statements: r.statements } : { ok: false, command: 'shop statements', why: r.message ?? r.why ?? 'the studio did not answer' };
-  }
-  const sent = [];
-  console.error('Sending statements. Keep this command open; run it again after closing to resume safely.');
-  return withKey(root, url, async (call) => {
-    do {
-      const page = await call('/_studio/api/shop/statements/send', { cursor, ...(period ? { period } : {}) });
-      if (!page.ok) return { ok: false, command: 'shop statements', sent, why: page.message ?? page.why ?? 'the studio did not answer' };
-      for (const failure of page.failures ?? []) if (!sent.some((x) => !x.ok && x.via === failure.via)) { sent.push(failure); console.error(`${failure.via}: failed: ${failure.why ?? failure.status}`); }
-      sent.push(...page.sent);
-      for (const result of page.sent) console.error(`${result.via}: ${result.ok ? 'page sent' : 'failed: ' + (result.why ?? result.status)}`);
-      period = page.period;
-      cursor = page.nextCursor;
-      if (page.retryAfter) await new Promise((resolve) => setTimeout(resolve, page.retryAfter * 1000));
-    } while (cursor !== null);
-    return { ok: true, command: 'shop statements', period, nextCursor: null, sent };
-  });
-}
-
 /* ------------------------------------------------------------------ the key, from a page on this computer */
 
 const esc = (v) => String(v ?? '').replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c]);
@@ -439,7 +416,7 @@ export function shopLines(r) {
     lines.push(`Webhook endpoint for Stripe: ${r.hook}`, `Payouts: ${r.stripe?.payouts}`);
     if (r.local && !r.local.ok) lines.push(`shop.json here: ${r.local.errors.map((e) => e.message).join('; ')}`);
   } else if (r.command === 'shop orders') {
-    for (const o of r.orders) lines.push(`${o.id}  ${o.at.slice(0, 16)}  ${o.name} ${o.shown}  ${o.status}${o.mode === 'test' ? ' (test)' : ''}  ${o.player ?? '(deleted account)'}${o.via ? `  via ${o.via}` : ''}`);
+    for (const o of r.orders) lines.push(`${o.id}  ${o.at.slice(0, 16)}  ${o.name} ${o.shown}  ${o.status}${o.mode === 'test' ? ' (test)' : ''}  ${o.player ?? '(deleted account)'}`);
     if (!r.orders.length) lines.push('No orders yet.');
   } else if (r.command === 'shop check') {
     if (r.absent) lines.push(r.message);
@@ -451,11 +428,6 @@ export function shopLines(r) {
     }
   } else if (r.command === 'shop init') {
     lines.push(`Wrote ${r.wrote.join(', ')} (till: ${r.till}${r.items.length ? `; ${r.items.join(', ')}` : ''}). Next:`, ...r.next.map((n) => `  ${n}`));
-  } else if (r.command === 'shop statements') {
-    if (r.nextCursor) lines.push(`More rows: shop statements --period ${r.period} --cursor '${r.nextCursor.replaceAll("'", "'\\''")}'${r.sent ? ' --send' : ''}`);
-    if (r.sent) for (const s of r.sent) lines.push(`${s.via}: ${s.ok ? 'sent' : `not sent (${s.why ?? s.status})`}`);
-    else for (const s of r.statements ?? []) lines.push(`${s.statement.referrer}: due ${s.statement.totals ? money(s.statement.totals.due, s.statement.currency) : 'see first page'} (${s.statement.lines.length} line(s)), signed`);
-    if (!(r.sent ?? r.statements ?? []).length) lines.push(`No referral statements for ${r.period}.`);
   } else { lines.push(r.message ?? r.why ?? (r.alreadyConnected ? 'Stripe test credentials are already installed.' : '')); for (const step of r.next ?? []) lines.push(step); if (r.fallback) lines.push(`Optional fallback, only if chosen: ${r.fallback}`); }
   return lines;
 }

package/lib/template-history.json

@@ -3263,7 +3263,10 @@
      "## Art direction and models": "a48fff7bf0a5f2fc",
      "## Running live games (the back office)": "51ebf2ab756f6e4d",
      "## Servers and AI seats": "1ccfd549d2369a60",
-     "## Selling things (the shop)": "9e020d69dd6a954e",
+     "## Selling things (the shop)": [
+      "43a3556be93d1235",
+      "9e020d69dd6a954e"
+     ],
      "## Continuing a build from the Claude app": "0d68081e924ca419",
      "## Rules": "b2234d80f6cbe71d",
      "## Telling Homie": "80b46fdd9e578db8",
@@ -3363,6 +3366,90 @@
      }
     }
    }
+  },
+  "0.50.5": {
+   "files": {
+    "CLAUDE.md": "ddf2b2a0376202f6",
+    "README.md": "684b3cca8001673c",
+    "HANDOFF.md": "29337e2ace95b2e7",
+    "games/README.md": "5ad32fe80c61f117",
+    "music/README.md": "a3dc042dadd39df8",
+    "videos/README.md": "16babc3437d5545b",
+    "posts/README.md": "37841aae476bd540",
+    "site/README.md": "1dbdf22c03a1e505",
+    "site/src/worker.mjs": "6cc5c6131eaf6fd0"
+   },
+   "sections": {
+    "AGENTS.md": {
+     "(intro)": "394cbbe934e80722",
+     "## Version-matched authoring guides": "f6261a0e5801b96b",
+     "## Layout": "f3a280b8c96cd068",
+     "## Apps: one screen, roles and parts": "c10aa0441ea89702",
+     "## Commands (all through the pinned CLI in node_modules)": "5222e08ca55e326e",
+     "## The site": "0cb8dd9a6f8a0096",
+     "## Making games": "bb715272fd1a615b",
+     "## The Game Codex and progress": "0738ef719cef3a4c",
+     "## Art direction and models": "a48fff7bf0a5f2fc",
+     "## Running live games (the back office)": "51ebf2ab756f6e4d",
+     "## Servers and AI seats": "1ccfd549d2369a60",
+     "## Selling things (the shop)": "43a3556be93d1235",
+     "## Continuing a build from the Claude app": "0d68081e924ca419",
+     "## Rules": "b2234d80f6cbe71d",
+     "## Telling Homie": "80b46fdd9e578db8",
+     "## Beta": "9d02638207a26e73"
+    }
+   },
+   "named": {
+    "Homie Arcade": {
+     "sections": {
+      "AGENTS.md": {
+       "## Commands (all through the pinned CLI in node_modules)": "611b437f5b3303f0"
+      }
+     }
+    }
+   }
+  },
+  "0.50.6": {
+   "files": {
+    "CLAUDE.md": "ddf2b2a0376202f6",
+    "README.md": "684b3cca8001673c",
+    "HANDOFF.md": "29337e2ace95b2e7",
+    "games/README.md": "5ad32fe80c61f117",
+    "music/README.md": "a3dc042dadd39df8",
+    "videos/README.md": "16babc3437d5545b",
+    "posts/README.md": "37841aae476bd540",
+    "site/README.md": "1dbdf22c03a1e505",
+    "site/src/worker.mjs": "6cc5c6131eaf6fd0"
+   },
+   "sections": {
+    "AGENTS.md": {
+     "(intro)": "394cbbe934e80722",
+     "## Version-matched authoring guides": "f6261a0e5801b96b",
+     "## Layout": "f3a280b8c96cd068",
+     "## Apps: one screen, roles and parts": "c10aa0441ea89702",
+     "## Commands (all through the pinned CLI in node_modules)": "5222e08ca55e326e",
+     "## The site": "0cb8dd9a6f8a0096",
+     "## Making games": "bb715272fd1a615b",
+     "## The Game Codex and progress": "0738ef719cef3a4c",
+     "## Art direction and models": "a48fff7bf0a5f2fc",
+     "## Running live games (the back office)": "51ebf2ab756f6e4d",
+     "## Servers and AI seats": "1ccfd549d2369a60",
+     "## Selling things (the shop)": "43a3556be93d1235",
+     "## Continuing a build from the Claude app": "0d68081e924ca419",
+     "## Rules": "b2234d80f6cbe71d",
+     "## Telling Homie": "80b46fdd9e578db8",
+     "## Beta": "9d02638207a26e73"
+    }
+   },
+   "named": {
+    "Homie Arcade": {
+     "sections": {
+      "AGENTS.md": {
+       "## Commands (all through the pinned CLI in node_modules)": "611b437f5b3303f0"
+      }
+     }
+    }
+   }
   }
  }
 }

package/lib/worker-config.mjs

@@ -2,6 +2,7 @@ import {readFileSync,writeFileSync,existsSync,renameSync} from 'node:fs';
 import {join} from 'node:path';
 import {configPath,readStudio,layoutOf,listExperiences} from './studio.mjs';
 import {wranglerConfig} from './scaffold.mjs';
+import {scheduleTrigger} from '../worker/function-schedule.mjs';
 import {paidReleases} from './parts-upload.mjs';
 const parse=t=>JSON.parse(t.replace(/^\s*\/\/.*$/gm,''));
 const read=file=>existsSync(file)?parse(readFileSync(file,'utf8')):{};
@@ -10,9 +11,25 @@ function merge(base,custom) {
   if(custom && typeof custom==='object')return Object.fromEntries([...new Set([...Object.keys(base??{}),...Object.keys(custom)])].sort().map(k=>[k,k in custom?merge(base?.[k],custom[k]):base[k]]));
   return custom;
 }
-/** Generated output is never an input. Studio additions belong in wrangler.custom.json. */
+/** Regenerate from declarations/custom config; migrate only newly encountered manual crons. */
 export function updateWorkerConfig(root,generated) {
-  const file=configPath(root),next=merge(parse(generated),read(join(root,'wrangler.custom.json')));
+  const file=configPath(root),base=parse(generated),custom=read(join(root,'wrangler.custom.json'));
+  // Preserve studio cron edits made before/after generation, including old wrangler files.
+  // Compare against the previous output to discover manual additions. Custom entries
+  // retain ownership even when their text equals a generated tick.
+  const previous=read(file);
+  let previousCrons=[];
+  try {previousCrons=JSON.parse(previous.vars?.STUDIO_FUNCTION_CRONS??'[]');}catch {}
+  const extra=(previous.triggers?.crons??[]).filter(c=>!previousCrons.includes(c)&&!(custom.triggers?.crons??[]).includes(c));
+  if(extra.length) {
+    custom.triggers={...custom.triggers,crons:[...new Set([...(custom.triggers?.crons??[]),...extra])].sort()};
+    writeFileSync(join(root,'wrangler.custom.json'),JSON.stringify(custom,null,2)+'\n');
+  }
+  const next=merge(base,custom);
+  // Crons are additive: studio-owned entries cannot erase required toolkit ticks.
+  const crons=[...new Set([...(base.triggers?.crons??[]),...(custom.triggers?.crons??[])])].sort();
+  next.triggers={...next.triggers,crons}; // [] explicitly removes old generated triggers in Wrangler.
+  next.vars={...next.vars,STUDIO_FUNCTION_CRONS:JSON.stringify(crons),STUDIO_FUNCTION_MANAGED_CRONS:JSON.stringify(base.triggers?.crons??[])};
   const text='// Generated by homie-studio. Edit studio.json or wrangler.custom.json, then build.\n'+JSON.stringify(next,null,2)+'\n';
   if(!existsSync(file)||readFileSync(file,'utf8')!==text) {const temp=`${file}.${process.pid}.tmp`;writeFileSync(temp,text);renameSync(temp,file);}
 }
@@ -24,5 +41,5 @@ export function refreshWorkerConfig(root,overrides={}) {
   const tools=read(join(root,'site/src/tools/declarations.json'));
   const ai=cf.ai??listExperiences(root).some(g=>g.decide===true || g.chat!==false && (g.chat?.mode??'text')==='text' && g.chat?.ai!==false);
   const paid=paidReleases(root).length>0||existsSync(join(root,'shop.json'))||tools.paid===true;
-  updateWorkerConfig(root,wranglerConfig({worker:cf.worker,name:studio.name,d1:cf.d1,d1Id:cf.d1Id,r2:cf.r2,layout:layoutOf(root),ai,paidParts:paid,partsRateLimit:cf.purchaseRateLimit??null,routes:cf.routes??null,eventFeeds:studio.mcp?.events,triggers:functions.length||Object.keys(studio.mcp?.events??{}).length?{crons:[...new Set(['* * * * *',...functions.map(f=>f.schedule).filter(Boolean)])].sort()}:null,...overrides}));
+  updateWorkerConfig(root,wranglerConfig({worker:cf.worker,name:studio.name,d1:cf.d1,d1Id:cf.d1Id,r2:cf.r2,layout:layoutOf(root),ai,paidParts:paid,partsRateLimit:cf.purchaseRateLimit??null,routes:cf.routes??null,eventFeeds:studio.mcp?.events,triggers:{crons:[scheduleTrigger(functions,{eventFeeds:Object.keys(studio.mcp?.events??{}).length>0})].filter(Boolean)},...overrides}));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homie-rocks/studio",
-  "version": "0.50.4",
+  "version": "0.50.6",
   "description": "A studio for games, music and video on its own Cloudflare: scaffold, multiplayer starters on the netplay contract, a port toolkit that makes existing single-player web games multiplayer, the site Worker with public rooms (Table/Lobby Durable Objects and D1, all on the free Workers plan, no payment method), a site with the hub's sections (Home, Games, Music, Videos, Rooms, Posts with feeds) in the studio's own look, an epic landing page for every game, big songs and videos in the studio's own R2 once it has storage (uploaded, checked by SHA-256, served at the same addresses), deploy, and the homie.rocks directory.",
   "type": "module",
   "license": "Apache-2.0",

package/shop/SELLING.md

@@ -4,7 +4,7 @@ You sell with your own Stripe account. Money goes directly to you; Homie takes n
 The studio is the seller and is responsible for the law where it sells and for Stripe's terms.
 
 Your `shop.json` chooses items, wording, prices, currency, tax integration, sale dates, entitlements,
-referral terms, optional spending caps and optional refund windows. Nothing requires an account or age
+optional spending caps and optional refund windows. Nothing requires an account or age
 question by default. Guests can buy repeatedly and keep their purchases when signing in later.
 
 You can choose `policy.preset: "protective"` or `"adults-only"`, or set individual options.

package/shop/SHOP.md

@@ -34,20 +34,16 @@ A kind is a label, not a recurring-billing, wallet, random-reward or fulfillment
   Its reservation releases only when Stripe confirms expiry or another terminal outcome.
 - `refundDays`: optional self-service refund window for items, including used items by default.
   A tip is never refunded by the player. The studio can refund any paid order or line from its office; disputed charges wait for Stripe to resolve the dispute.
-- `referrals`: optional `rate`, `windowDays`, `capPerPlayer`, `holdDays`, `minimumInvoice`,
-  `billingEmail` and `accept`. `rate` defaults to zero until written;
-  omitted limits do not apply. `referralNewPlayersOnly: true` limits attribution to new players.
 - `catalog`: modes (`test`, `live`) populated by `homie-studio shop catalog` for named Stripe Products.
   Prices always come from your file, even when a Stripe Product exists.
 - Optional flood protection: `purchaseAttemptsPerMinute`,
   `purchaseAttemptsPerAddressPerMinute`, `guestBuyersPerAddressPerHour`.
   Omitted or null means no limit. Explicit positive integers apply per Worker instance.
   An explicitly set `PLAYER_LIMIT_DAILY` also applies to new shop buyers.
-  Referral delivery uses `REFERRAL_STATEMENTS_PER_MINUTE`, `REFERRAL_STATEMENTS_GLOBAL_PER_MINUTE`
-  (both 30), and `REFERRAL_STATEMENT_BYTES` (65536). `requestBytes` overrides the catalog-sized shop request
+  `requestBytes` overrides the catalog-sized shop request
   allowance; `SHOP_WEBHOOK_BYTES` (524288) controls the webhook byte allowance.
 
-No toolkit ceiling applies to prices, quantities, tips, durations, refund windows, caps or referral terms.
+No toolkit ceiling applies to prices, quantities, tips, durations, refund windows or caps.
 Money is integer Stripe currency units, with checked safe arithmetic. Stripe's currency rules and
 [Checkout's maximum of 100 lines](https://docs.stripe.com/api/checkout/sessions/create#line_items) apply.
 Free and paid lines can share a cart. An entirely free cart grants locally without a Stripe call. Product text limits and currency-unit requirements come from Stripe;
@@ -161,22 +157,23 @@ secret-returning webhook through a conversation tool: the private connect proces
 
 ## Payment guarantees and schema
 
-The schema step `0012_shop_lines.sql` follows the reservation and statement steps. Deploy applies it through
+The schema step `0012_shop_lines.sql` follows the reservation step. Deploy applies it through
 the existing migration mechanism. It adds tables and columns without changing any existing primary key or
 column meaning. Released code keeps working after the step, including through rollback. The new Worker
 without the step still reads owned items and refunds from the office; new sales wait for the named step.
 
-A verified payment atomically grants all line snapshots and records the referral share on the order total.
+`0022_remove_referrals.sql` removes the old referral tables, keys and sales-attribution columns; orders and entitlements remain intact. Old referral settings are ignored with a build note.
+
+A verified payment atomically records the payment and grants all line snapshots.
 Duplicate events, reconciliation and late payments grant exactly once, including after a missing mark,
-owner release, expiry or failure. Refunds revoke only their own lines, retain other purchases of the same key,
-and adjust the referral share with exact integer allocation. Stripe tax is read per line when applicable.
+owner release, expiry or failure. Refunds revoke only their own lines, and retain other purchases of the same key. Stripe tax is read per line when applicable.
 Snapshots preserve delivery after catalog edits; the schema step represents older orders as one line.
 An unpaid older order has no historical item snapshot and needs its catalog definition to complete delivery.
 A missing definition gives a named retryable response and office note; the office can refund the verified
 payment. Older paid orders missing a grant are repaired once. An unknown older item is refunded by the office,
 since its original kind cannot be recovered safely for player self-service.
 A whole-order refund uses one Stripe refund for the remaining charge. Dashboard partial refunds reduce cap
-usage and referral shares by their pre-tax portion, without assigning money to an unnamed line.
+usage by their pre-tax portion, without assigning money to an unnamed line.
 Refunds are rebuilt from [Stripe’s refunds list](https://docs.stripe.com/api/refunds/list). Only
 [succeeded refunds](https://docs.stripe.com/api/refunds/object#refund_object-status) revoke items;
 pending refunds keep them and failed refunds restore them. A named line loses only its own items;
@@ -191,7 +188,7 @@ and [expiring open sessions](https://docs.stripe.com/api/checkout/sessions/expir
 Replacing an open checkout expires only reservations at least a minute old; a named cancellation can expire immediately.
 Unresolved orders become eligible for reconciliation after one minute, even with no cap. A buyer's next shop
 or owned-items request schedules up to three reads off the response path, with atomic claims and backoff up
-to an hour; an optional Worker cron invokes the same reconciliation across buyers. No cron is installed for you. To run it every five minutes, add `"triggers": { "crons": ["*/5 * * * *"] }` to the studio’s root `wrangler.jsonc`; deploy preserves its triggers.
+to an hour; an optional Worker cron invokes the same reconciliation across buyers. Shop/paid-part studios install a five-minute maintenance trigger. Declared functions install their own required scheduling/retry trigger. Put additional studio crons in root `wrangler.custom.json`; build and deploy merge and preserve them.
 With an API key, every recorded payment checks Stripe’s refunds and dispute state, including payments recovered by an early refund or dispute event. The thanks page can verify a payment directly with the studio's key. Webhook events require Stripe's signature.
 Test and live books stay separate. Owner release attempts to expire an open session, records who released it
 and when, and never prevents a later verified payment grant.
@@ -219,3 +216,5 @@ These calls open the same shop in games and apps. Inside a player card, purchase
 ## App payment references
 
 Create the booking/ticket/gift intention first. `shop.buy('full-tune', 1, undefined, { reference: booking.id })` or `shop.checkout({ reference: booking.id })` sends the app's own reference through checkout. Existing boolean returns are unchanged: checkout opened is not paid. The verified durable `order.paid` event carries `data.order`, `data.reference` (null if omitted) and `data.app`. Reopened Payment Links retain the reference. A reference is buyer-supplied correlation, not authorization: verify the record, app, amount and currency, deduplicate by event/order ID, then fulfil it. Keep personal data out of references. Before Stripe is connected, local prices and unpaid requests can be demonstrated; actual payment and recurring collection remain unverified. Test events must be labelled simulations.
+
+For referrals, use Stripe Connect to split payments or a Stripe-based affiliate service; Homie builds none.

package/worker/build-id.mjs

@@ -1,2 +1,2 @@
 // Generated by lib/build-identity.mjs; identifies the bundled runtime sources.
-export const STUDIO_BUILD = Object.freeze({"version":"0.50.4","sha256":"d3f8cab6830919a815fcb6f995ea98a43fa1f246d240a2d1afe22905f38aae08"});
+export const STUDIO_BUILD = Object.freeze({"version":"0.50.6","sha256":"8aabf4298c649e24766b5dbd5836625be78a4c69c1005c221d93d4c9e4e45b3e"});

package/worker/canonical-json.mjs

@@ -0,0 +1,6 @@
+/** JSON with sorted keys: what a signature covers, byte for byte, on both sides. */
+export function canonicalJson(v) {
+  if (Array.isArray(v)) return `[${v.map(canonicalJson).join(',')}]`;
+  if (v && typeof v === 'object') return `{${Object.keys(v).sort().filter((k) => v[k] !== undefined).map((k) => `${JSON.stringify(k)}:${canonicalJson(v[k])}`).join(',')}}`;
+  return JSON.stringify(v ?? null);
+}

package/worker/customer-mcp.mjs

@@ -1,5 +1,5 @@
 import {byClaim} from './purchase-store.mjs';
-import {canonicalJson} from './referrals.mjs';
+import {canonicalJson} from './canonical-json.mjs';
 import {purchaseResponse} from './purchase-response.mjs';
 import {machineResource} from './purchase-machine.mjs';
 import {purchaseSchema} from './purchase-mcp.mjs';

package/worker/customer-resources.mjs

@@ -4,7 +4,7 @@ import {registerResourceKind} from './resource-kinds.mjs';
 import {quoteHash,legalTerms} from './parts-sale.mjs';
 import {digest,manifestHash} from './purchase-crypto.mjs';
 import {offerVersion} from './purchase-core.mjs';
-import {canonicalJson} from './referrals.mjs';
+import {canonicalJson} from './canonical-json.mjs';
 import {serviceTerms} from './service-terms.mjs';
 export {serviceTerms} from './service-terms.mjs';
 export async function pruneOffers(env,now=Date.now()) {

package/worker/function-schedule.mjs

@@ -0,0 +1,68 @@
+// Cloudflare's five-field UTC cron dialect: Sunday=1, Saturday=7.
+const ranges=[[0,59],[0,23],[1,31],[1,12],[1,7]];
+const aliases=[null,null,null,['JAN','FEB','MAR','APR','MAY','JUN','JUL','AUG','SEP','OCT','NOV','DEC'],['SUN','MON','TUE','WED','THU','FRI','SAT']];
+function field(text,index) {
+  const [min,max]=ranges[index],values=new Set(),special=[];
+  text=text.toUpperCase();
+  if(aliases[index])text=text.replace(/[A-Z]{3}/g,name=>{const n=aliases[index].indexOf(name);if(n<0)throw new Error(`Unknown cron name ${name}`);return String(n+1);});
+  for(const part of text.split(',')) {
+    if(index===2 && /^(L|LW|(?:[1-9]|[12]\d|3[01])W)$/.test(part) || index===4 && /^[1-7](L|#[1-5])$/.test(part)) {special.push(part);continue;}
+    if(!/^(\*|\d+(?:-\d+)?)(?:\/[1-9]\d*)?$/.test(part))throw new Error(`Invalid cron field ${text}`);
+    const [base,stepText]=part.split('/'),step=Number(stepText??1);
+    const [lo,hi]=base==='*'?[min,max]:base.includes('-')?base.split('-').map(Number):[Number(base),stepText?max:Number(base)];
+    if(lo<min||hi>max||lo>hi||!Number.isSafeInteger(step)||step>max-min+1)throw new Error(`Cron field out of range: ${text}`);
+    for(let n=lo;n<=hi;n+=step)values.add(n);
+  }
+  return {values:[...values].sort((a,b)=>a-b),special};
+}
+const lastDay=d=>new Date(Date.UTC(d.getUTCFullYear(),d.getUTCMonth()+1,0)).getUTCDate();
+function weekdayNear(d,day) {
+  const last=lastDay(d);if(day>last)return null;
+  const weekday=new Date(Date.UTC(d.getUTCFullYear(),d.getUTCMonth(),day)).getUTCDay();
+  return weekday===6?(day===1?3:day-1):weekday===0?(day===last?day-2:day+1):day;
+}
+export function parseSchedule(expression) {
+  if(typeof expression!=='string'||expression.trim().split(/\s+/).length!==5)throw new Error('Schedule needs five cron fields');
+  const parts=expression.trim().split(/\s+/),fields=parts.map(field);
+  const dayMatches=d=>{
+    const day=d.getUTCDate(),weekday=d.getUTCDay()+1,last=lastDay(d);
+    return fields[3].values.includes(d.getUTCMonth()+1) &&
+      (fields[2].values.includes(day)||fields[2].special.some(s=>s==='L'?day===last:s==='LW'?day===weekdayNear(d,last):day===weekdayNear(d,Number(s.slice(0,-1))))) &&
+      (fields[4].values.includes(weekday)||fields[4].special.some(s=>weekday===Number(s[0])&&(s.endsWith('L')?day+7>last:Math.ceil(day/7)===Number(s.at(-1)))));
+  };
+  return {parts,fields,dayMatches,matches(time){const d=new Date(time);return dayMatches(d)&&fields[0].values.includes(d.getUTCMinutes())&&fields[1].values.includes(d.getUTCHours());}};
+}
+export function nextDue(expression,after=Date.now()) {
+  const cron=typeof expression==='string'?parseSchedule(expression):expression;
+  const date=new Date(after);date.setUTCHours(0,0,0,0);
+  // A Gregorian calendar repeats after 400 years; this also detects impossible dates.
+  for(let days=0;days<=146097;days++,date.setUTCDate(date.getUTCDate()+1)) {
+    if(!cron.dayMatches(date))continue;
+    for(const hour of cron.fields[1].values)for(const minute of cron.fields[0].values) {
+      const time=date.getTime()+hour*3600000+minute*60000;
+      if(time>after)return time;
+    }
+  }
+  return null;
+}
+export function scheduleTrigger(definitions,{eventFeeds=false}={}) {
+  if(eventFeeds||definitions.some(f=>f.schedule===undefined))return '* * * * *';
+  const schedules=definitions.map(f=>parseSchedule(f.schedule));
+  if(!schedules.length)return null;
+  if(schedules.every(c=>c.parts.join(' ')===schedules[0].parts.join(' ')))return schedules[0].parts.join(' ');
+  return ranges.map(([min,max],i)=>{
+    if(schedules.every(c=>c.parts[i]===schedules[0].parts[i]))return schedules[0].parts[i];
+    if(i===2||i===4)return '*';
+    const values=[...new Set(schedules.flatMap(c=>c.fields[i].values))].sort((a,b)=>a-b);
+    return values.length===max-min+1?'*':values.join(',');
+  }).join(' ');
+}
+export function scheduleStatus(definitions,crons,now=Date.now()) {
+  return definitions.filter(f=>f.schedule!==undefined).map(fn=>{
+    try {
+      const due=nextDue(fn.schedule,now);
+      const runnable=due!==null && crons.some(c=>{try{return parseSchedule(c).matches(due);}catch{return false;}});
+      return {function:fn.name,schedule:fn.schedule,nextDue:due===null?null:new Date(due).toISOString(),status:due===null?'Cannot run: schedule has no matching date':runnable?'Configured; awaiting scheduled delivery':'Cannot run: no configured trigger covers the next due time'};
+    } catch(error) {return {function:fn.name,schedule:fn.schedule,nextDue:null,status:`Cannot run: ${error.message}`};}
+  });
+}

package/worker/functions-schema.mjs

@@ -84,3 +84,16 @@ WHEN EXISTS (SELECT 1 FROM function_subscriptions WHERE type='order.paid')
  'app',NEW.game,'reference',(SELECT value FROM meta WHERE key='shop-reference:' || NEW.id)),NEW.paid_at);
 END;
 `;
+
+/** Attempt history is independent of the prunable delivery queue. */
+export const FUNCTIONS_RUNS_MIGRATION_FILE = '0023_function_runs.sql';
+export const FUNCTIONS_RUNS_MIGRATION = `
+CREATE TABLE function_runs (
+ seq INTEGER PRIMARY KEY AUTOINCREMENT, id TEXT NOT NULL UNIQUE,
+ function TEXT NOT NULL, event TEXT NOT NULL, trigger TEXT NOT NULL,
+ started INTEGER NOT NULL, finished INTEGER, outcome TEXT NOT NULL,
+ error TEXT, attempt INTEGER NOT NULL
+);
+CREATE INDEX function_runs_function_seq ON function_runs(function,seq);
+CREATE INDEX function_runs_errors_seq ON function_runs(seq) WHERE outcome IN ('failed','interrupted');
+`;

package/worker/functions.mjs

@@ -1,4 +1,6 @@
 import {webhookSubscriptions,webhookFailure,webhookBackoff} from './event-webhooks.mjs';
+import {parseSchedule,scheduleStatus} from './function-schedule.mjs';
+import {redactText} from '../lib/redact.mjs';
 import {feedSubscriptions,pushEvents} from './event-resources.mjs';
 import { services } from './mcp-tools.mjs';
 import { isOwner, sameOrigin } from './office.mjs';
@@ -63,16 +65,25 @@ export async function runFunctions(env, cat, origin, {definitions, now = Date.no
       if(rows.length===100)more=true;
       for (const row of rows) {
         const lease=crypto.randomUUID();
-        const claimed=await env.DB.prepare(`UPDATE function_deliveries SET state='running',lease=?3,due=?4,attempts=attempts+1 WHERE event=?1 AND function=?2 AND state!='complete' AND due<=?5`).bind(row.event,fn.name,lease,now()+leaseMs,now()).run();
+        const started=now();
+        const [claimed]=await env.DB.batch([
+          env.DB.prepare(`UPDATE function_deliveries SET state='running',lease=?3,due=?4,attempts=attempts+1 WHERE event=?1 AND function=?2 AND state!='complete' AND due<=?5`).bind(row.event,fn.name,lease,started+leaseMs,started),
+          env.DB.prepare("UPDATE function_runs SET outcome='interrupted',error='Worker lease expired before completion was recorded' WHERE event=?1 AND function=?2 AND outcome='running' AND EXISTS(SELECT 1 FROM function_deliveries WHERE event=?1 AND function=?2 AND lease=?3)").bind(row.event,fn.name,lease),
+          env.DB.prepare("INSERT INTO function_runs(id,function,event,trigger,started,outcome,attempt) SELECT ?1,?2,?3,?4,?5,'running',attempts FROM function_deliveries WHERE event=?3 AND function=?2 AND lease=?1").bind(lease,fn.name,row.event,row.event.startsWith(`schedule:${fn.name}:`)?`schedule: ${JSON.parse(row.data).cron}`:row.type,started),
+        ]);
         if (!claimed.meta.changes) continue;
+        let failure=null;
         try {
           const event=Object.freeze({id:row.event,type:row.type,at:row.at,data:JSON.parse(row.data),attempt:row.attempts+1});
           await fn.handler(event,services(env,cat,origin,{id:'studio-function',owner:true,client:null},'function:'+fn.name,fn));
-          await env.DB.prepare(`UPDATE function_deliveries SET state='complete',completed=?4,error=NULL WHERE event=?1 AND function=?2 AND lease=?3`).bind(row.event,fn.name,lease,now()).run();
-        } catch (error) {
-          // Handler errors may contain credentials. The office identifies the function/event; Worker logs are the studio's debugging surface.
-          await env.DB.prepare(`UPDATE function_deliveries SET state='failed',error=?5,due=?4 WHERE event=?1 AND function=?2 AND lease=?3`).bind(row.event,fn.name,lease,now()+(fn.webhook?webhookBackoff(row.attempts+1):leaseMs),fn.webhook?webhookFailure(error):'Function failed; inspect its code and retry').run();
-        }
+        } catch(error) {failure=fn.webhook?webhookFailure(error):functionError(error,env);}
+        const finished=now();
+        await env.DB.batch([
+          failure===null
+            ? env.DB.prepare(`UPDATE function_deliveries SET state='complete',completed=?4,error=NULL WHERE event=?1 AND function=?2 AND lease=?3`).bind(row.event,fn.name,lease,finished)
+            : env.DB.prepare(`UPDATE function_deliveries SET state='failed',error=?5,due=?4 WHERE event=?1 AND function=?2 AND lease=?3`).bind(row.event,fn.name,lease,finished+(fn.webhook?webhookBackoff(row.attempts+1):leaseMs),fn.webhook?failure:'Function failed; inspect its code and retry'),
+          env.DB.prepare("UPDATE function_runs SET outcome=?2,finished=?3,error=?4 WHERE id=?1").bind(lease,failure===null?'complete':'failed',finished,failure),
+        ]);
       }
     }
   } while(more);
@@ -82,10 +93,18 @@ export async function runFunctions(env, cat, origin, {definitions, now = Date.no
 }
 export async function scheduleFunctions(event,env,cat,origin) {
   const definitions=await syncFunctions(env);
-  for(const fn of definitions) if(fn.schedule===event.cron) await env.DB.batch([
-    env.DB.prepare(`INSERT OR IGNORE INTO studio_events(id,type,data,at) SELECT ?1,?2,?3,?4 WHERE EXISTS(SELECT 1 FROM function_subscriptions WHERE name=?5 AND last_tick<?4)`).bind(`schedule:${fn.name}:${event.scheduledTime}`,fn.event,JSON.stringify({function:fn.name,cron:event.cron,scheduledTime:event.scheduledTime}),event.scheduledTime,fn.name),
-    env.DB.prepare('UPDATE function_subscriptions SET last_tick=MAX(last_tick,?2) WHERE name=?1').bind(fn.name,event.scheduledTime),
+  const scheduledTime=Math.floor(event.scheduledTime/60000)*60000;
+  await env.DB.prepare("INSERT INTO meta(key,value) VALUES('function-last-scheduled',?1) ON CONFLICT(key) DO UPDATE SET value=excluded.value").bind(JSON.stringify({cron:event.cron,scheduledTime})).run();
+  for(const fn of definitions) {
+    if(fn.schedule===undefined)continue;
+    let due=false;
+    try {due=parseSchedule(fn.schedule).matches(scheduledTime);} catch {continue;} // An old invalid declaration stays diagnosable via the owner tool.
+    if(!due)continue;
+    await env.DB.batch([
+    env.DB.prepare(`INSERT OR IGNORE INTO studio_events(id,type,data,at) SELECT ?1,?2,?3,?4 WHERE EXISTS(SELECT 1 FROM function_subscriptions WHERE name=?5 AND last_tick<?4)`).bind(`schedule:${fn.name}:${scheduledTime}`,fn.event,JSON.stringify({function:fn.name,cron:fn.schedule,scheduledTime}),scheduledTime,fn.name),
+    env.DB.prepare('UPDATE function_subscriptions SET last_tick=MAX(last_tick,?2) WHERE name=?1').bind(fn.name,scheduledTime),
   ]);
+  }
   await runFunctions(env,cat,origin,{definitions});
 }
 export async function functionsRoute(request,env,cat) {
@@ -107,3 +126,20 @@ export async function functionsRoute(request,env,cat) {
   const rows=(await env.DB.prepare(`SELECT d.*,e.type,e.at FROM function_deliveries d JOIN studio_events e ON e.id=d.event ORDER BY e.at DESC LIMIT 100`).all()).results;
   return new Response(`<!doctype html><meta charset="utf-8"><title>Studio functions</title><h1>Studio functions</h1><p>At-least-once delivery. Use the event ID to deduplicate effects.</p><table><tr><th>Function</th><th>Event ID</th><th>Event</th><th>State</th><th>Attempts</th><th>Error</th><th>Retry</th></tr>${rows.map(r=>`<tr>${[r.function,r.event,r.type,r.state,r.attempts,r.error??''].map(v=>`<td>${esc(v)}</td>`).join('')}<td>${r.state==='failed'?`<form method="post"><input type="hidden" name="retry" value="${esc(r.event)}"><button>Retry</button></form>`:''}</td></tr>`).join('')}</table>`,{headers:{'content-type':'text/html;charset=utf-8','cache-control':'no-store'}});
 }
+
+function functionError(error,env) {
+  let message=error instanceof Error?error.message:String(error);
+  // Remove known binding values as well as recognizable credential formats.
+  for(const [key,value] of Object.entries(env))if(typeof value==='string' && value && !['STUDIO_NAME','STUDIO_EVENT_FEEDS','STUDIO_FUNCTION_CRONS','STUDIO_FUNCTION_MANAGED_CRONS'].includes(key))message=message.split(value).join('[redacted]');
+  return redactText(message).text;
+}
+export async function functionRuns(env,{name,errors=false,before}={}) {
+  const rows=(await env.DB.prepare(`SELECT seq,function,event,trigger,started,finished,outcome,error,attempt FROM function_runs
+    WHERE (?1 IS NULL OR function=?1) AND (?2=0 OR outcome IN ('failed','interrupted')) AND (?3 IS NULL OR seq<?3)
+    ORDER BY seq DESC LIMIT 101`).bind(name??null,errors?1:0,before??null).all()).results;
+  const page=rows.slice(0,100),definitions=await load();
+  let crons=[];try {crons=JSON.parse(env.STUDIO_FUNCTION_CRONS??'[]');if(!Array.isArray(crons))crons=[];}catch {}
+  const schedules=scheduleStatus(definitions.filter(f=>!name||f.name===name),crons);
+  const tick=await env.DB.prepare("SELECT value FROM meta WHERE key='function-last-scheduled'").first();
+  return {runs:page.map(r=>({...r,started:new Date(r.started).toISOString(),finished:r.finished===null?null:new Date(r.finished).toISOString()})),next:rows.length>100?page.at(-1).seq:null,schedules,crons,lastScheduled:tick?JSON.parse(tick.value):null,triggerEvidence:'Generated deployment configuration; lastScheduled proves an observed tick. Provider dashboard changes are not queried.'};
+}

package/worker/index.mjs

@@ -66,7 +66,6 @@ import { appRole, openPath } from './app-format.mjs';
  *   /shop/, /api/shop/...      the studio's shop (worker/shop.mjs, shop/SHOP.md): its items in real money, the studio's
  *                              OWN Stripe Checkout, the signed webhook, what a player owns (/api/player/owns), refunds;
  *                              closed until the owner's restricted key is in; never on a kids server or a television
- *   /api/referrals/statement   another studio's signed referral statement to this one (worker/referrals.mjs)
  *
  * A page in the studio's site/pages wins over the generated one at the same address. Every HTML answer is
  * `no-transform` (an edge in front of a custom domain injects nothing) and is never framed by another site.
@@ -130,7 +129,6 @@ import { STUDIO_VERSION_TAG } from './version.mjs';
 import { reconcileOrders, readiness, roomBadge, shellShop, shopOf, shopRoutes } from './shop.mjs';
 import { DISCOVERY_FILES, discoveryResponse, llmsTxt, robotsTxt, sitemapXml } from './discover.mjs';
 import { ldScript, studioNode } from './schema.mjs';
-import { arrivalCookie, manifestReferrals } from './referrals.mjs';
 import { licenseOf } from './license.mjs';
 // GAME PARTS (parts/PARTS.md section 4): three call-outs below, everything else is worker/parts.mjs.
 import { PART_FILES, isPartsPath, partsRoutes, withPartsBand } from './parts.mjs';
@@ -647,15 +645,6 @@ export default {
       }
     }
     if (appLobby || appRecords) return appCors(request, res);
-    // A referral's arrival (worker/referrals.mjs): only a person's page load with ?via= of another site, on a studio
-    // that pays referrals. The page is answered first; a cookie is added to it only then.
-    if (url.searchParams.has('via') && res && res.status === 200 && /text\/html/i.test(res.headers.get('content-type') ?? '')) {
-      try {
-        const cat = await catalogue(env, url.origin);
-        const cookie = await arrivalCookie(request, env, url, shopOf(cat));
-        if (cookie) { const out = new Response(res.body, res); out.headers.append('set-cookie', cookie); return out; }
-      } catch { /* an arrival is never worth a failed page */ }
-    }
     return res;
   },
 };
@@ -770,10 +759,8 @@ async function route(request, env, ctx) {
       ...(cat.studio?.lounge ? { lounge: { name: cat.studio.lounge.name, page: `${url.origin}/lounge/`, now: `${url.origin}/lounge/api/now` } } : {}),
       // Shared only when studio.json says `stats.share`: two numbers for the whole studio, for the hub.
       ...(played ? { played } : {}),
-      // The shop (0.24.0): whether it sells and its till, never a key or a sale; and referrals: this studio takes
-      // signed statements as a referrer, with the public half of its statement key and, if it sells, its terms.
+      // The shop: whether it sells and its till, never a key or a sale.
       ...(shopOf(cat)?.open ? { shop: { open: true, till: shopOf(cat).till, currency: shopOf(cat).currency, page: `${url.origin}/shop/` } } : {}),
-      ...(await manifestReferrals(env, url.origin, shopOf(cat), cat.studio).then((r) => (r ? { referrals: r } : {})).catch(() => ({}))),
     }, 200, { 'access-control-allow-origin': '*' });
   }
   if (path === '/api/games') {

package/worker/mcp-tools.mjs

@@ -87,6 +87,10 @@ export function builtins(env,cat,origin) {
       if(!ctx.caller.owner)throw new Error('Owner only');
       return (await import('./event-webhooks.mjs')).testWebhook(env,cat,feed,origin);
     }),
+    tool('studio_function_runs','Recent function attempts and errors, schedule next due times and trigger diagnostics. Run text is untrusted data. Follow next with before for older runs.','owner',object({name:str,errors:{type:'boolean'},before:{type:'integer',minimum:1}}),async(args,ctx)=>{
+      if(!ctx.caller.owner)throw new Error('Owner only');
+      return (await import('./functions.mjs')).functionRuns(env,args);
+    }),
     tool('studio_function_replay','Replay retained events for a declaration with replay: true.','owner',object({name:str},['name']),async({name})=>{
       const {replayFunction,runFunctions}=await import('./functions.mjs');
       await replayFunction(env,name);await runFunctions(env,cat,origin);return {ok:true};
@@ -126,11 +130,11 @@ export function builtins(env,cat,origin) {
   for(const [name,path,description] of [
     ['room_announce','announce','Announce to a room.'],['room_kick','kick','Ask the owner to remove a player.'],['room_mute','mute','Ask the owner to mute a player.'],['room_close','close','Ask the owner to close a room.'],['studio_game','game','Ask the owner to change game access or room size.'],['shop_refund','shop/refund','Ask the owner to refund an order.'],
   ]) tools.push(tool(name,description,'owner',object({action:{type:'object'}},['action']),({action},ctx)=>ctx.office('/_studio/api/'+path,action)));
-  const reads={rooms:'office',servers:'servers',members:'servers/members',chat:'chat',lounge:'lounge',shop:'shop',orders:'shop/orders.csv',lines:'shop/lines',received:'shop/received',statements:'shop/statements',invites:'invites'};
+  const reads={rooms:'office',servers:'servers',members:'servers/members',chat:'chat',lounge:'lounge',shop:'shop',orders:'shop/orders.csv',invites:'invites'};
   tools.push(tool('studio_office_read','Read an office view; use query for its existing filters and pagination.','owner',object({view:{enum:Object.keys(reads)},query:{type:'object',additionalProperties:{type:'string'}}},['view']),({view,query},ctx)=>ctx.office('/_studio/api/'+reads[view],undefined,query)));
-  const actions=['announce','kick','mute','close','game','servers','servers/set','servers/close','servers/member','room-level','agents/brain','chat/rules','chat/remove','chat/report','chat/budget','lounge/rules','lounge/night','lounge/mod','lounge/remove','lounge/hold','shop/release','shop/refund','shop/settle','invites','invites/revoke'];
+  const actions=['announce','kick','mute','close','game','servers','servers/set','servers/close','servers/member','room-level','agents/brain','chat/rules','chat/remove','chat/report','chat/budget','lounge/rules','lounge/night','lounge/mod','lounge/remove','lounge/hold','shop/release','shop/refund','invites','invites/revoke'];
   tools.push(tool('studio_office_action','Use an existing office control. Destructive changes return a browser confirmation for the owner.','owner',object({operation:{enum:actions},action:{type:'object'}},['operation','action']),({operation,action},ctx)=>ctx.office('/_studio/api/'+operation,action)));
   for (const op of ['sit','look','act','speak','stand']) tools.push(tool('agent_'+op, 'A marked AI guide: '+op+'. Room policy and declared vocabulary apply.', 'signed-in', object({game:str,role:str,server:str,room:str,goal:str,line:str,args:{type:'object'}},['game']), async (args,ctx)=>(await import('./mcp-room.mjs')).remoteSeat(env,cat,ctx.caller,op,args)));
   tools.push(...selling.customerTools(env,cat,origin));
-  return tools.map(tool => ({...tool, delegateOffice:Object.hasOwn(cat.studio?.mcp?.audiences??{},tool.name), audience: cat.studio?.mcp?.audiences?.[tool.name] ?? tool.audience}));
+  return tools.map(tool => tool.name==='studio_function_runs'?tool:({...tool, delegateOffice:Object.hasOwn(cat.studio?.mcp?.audiences??{},tool.name), audience: cat.studio?.mcp?.audiences?.[tool.name] ?? tool.audience}));
 }

package/worker/office-page.mjs

@@ -978,7 +978,7 @@ export function lockedPage(cat, { what = 'office', ask = null } = {}) {
   return new Response(shell(cat, `${what === 'confirm' ? 'Confirm' : 'Office'} · private`, body), { status: 401, headers: { ...PRIVATE, 'content-security-policy': NO_SCRIPT_CSP } });
 }
 
-const VERB = { refund: 'Refund it', 'shop-settle': 'Mark it paid', kick: 'Kick', mute: 'Mute', close: 'Close the room', announce: 'Announce', game: 'Change it', 'server-set': 'Change it', 'server-close': 'Close it', member: 'Remove', 'agents-brain': 'Let them talk' };
+const VERB = { refund: 'Refund it', kick: 'Kick', mute: 'Mute', close: 'Close the room', announce: 'Announce', game: 'Change it', 'server-set': 'Change it', 'server-close': 'Close it', member: 'Remove', 'agents-brain': 'Let them talk' };
 
 /** The owner's one tap for what their AI asked, and what came of it. */
 export function confirmPage(cat, ask, { missing = false } = {}) {