@homie-rocks/studio 0.50.5 → 0.50.7

package/lib/worker-config.mjs

@@ -2,6 +2,7 @@ import {readFileSync,writeFileSync,existsSync,renameSync} from 'node:fs';
 import {join} from 'node:path';
 import {configPath,readStudio,layoutOf,listExperiences} from './studio.mjs';
 import {wranglerConfig} from './scaffold.mjs';
+import {scheduleTrigger} from '../worker/function-schedule.mjs';
 import {paidReleases} from './parts-upload.mjs';
 const parse=t=>JSON.parse(t.replace(/^\s*\/\/.*$/gm,''));
 const read=file=>existsSync(file)?parse(readFileSync(file,'utf8')):{};
@@ -10,9 +11,25 @@ function merge(base,custom) {
   if(custom && typeof custom==='object')return Object.fromEntries([...new Set([...Object.keys(base??{}),...Object.keys(custom)])].sort().map(k=>[k,k in custom?merge(base?.[k],custom[k]):base[k]]));
   return custom;
 }
-/** Generated output is never an input. Studio additions belong in wrangler.custom.json. */
+/** Regenerate from declarations/custom config; migrate only newly encountered manual crons. */
 export function updateWorkerConfig(root,generated) {
-  const file=configPath(root),next=merge(parse(generated),read(join(root,'wrangler.custom.json')));
+  const file=configPath(root),base=parse(generated),custom=read(join(root,'wrangler.custom.json'));
+  // Preserve studio cron edits made before/after generation, including old wrangler files.
+  // Compare against the previous output to discover manual additions. Custom entries
+  // retain ownership even when their text equals a generated tick.
+  const previous=read(file);
+  let previousCrons=[];
+  try {previousCrons=JSON.parse(previous.vars?.STUDIO_FUNCTION_CRONS??'[]');}catch {}
+  const extra=(previous.triggers?.crons??[]).filter(c=>!previousCrons.includes(c)&&!(custom.triggers?.crons??[]).includes(c));
+  if(extra.length) {
+    custom.triggers={...custom.triggers,crons:[...new Set([...(custom.triggers?.crons??[]),...extra])].sort()};
+    writeFileSync(join(root,'wrangler.custom.json'),JSON.stringify(custom,null,2)+'\n');
+  }
+  const next=merge(base,custom);
+  // Crons are additive: studio-owned entries cannot erase required toolkit ticks.
+  const crons=[...new Set([...(base.triggers?.crons??[]),...(custom.triggers?.crons??[])])].sort();
+  next.triggers={...next.triggers,crons}; // [] explicitly removes old generated triggers in Wrangler.
+  next.vars={...next.vars,STUDIO_FUNCTION_CRONS:JSON.stringify(crons),STUDIO_FUNCTION_MANAGED_CRONS:JSON.stringify(base.triggers?.crons??[])};
   const text='// Generated by homie-studio. Edit studio.json or wrangler.custom.json, then build.\n'+JSON.stringify(next,null,2)+'\n';
   if(!existsSync(file)||readFileSync(file,'utf8')!==text) {const temp=`${file}.${process.pid}.tmp`;writeFileSync(temp,text);renameSync(temp,file);}
 }
@@ -24,5 +41,5 @@ export function refreshWorkerConfig(root,overrides={}) {
   const tools=read(join(root,'site/src/tools/declarations.json'));
   const ai=cf.ai??listExperiences(root).some(g=>g.decide===true || g.chat!==false && (g.chat?.mode??'text')==='text' && g.chat?.ai!==false);
   const paid=paidReleases(root).length>0||existsSync(join(root,'shop.json'))||tools.paid===true;
-  updateWorkerConfig(root,wranglerConfig({worker:cf.worker,name:studio.name,d1:cf.d1,d1Id:cf.d1Id,r2:cf.r2,layout:layoutOf(root),ai,paidParts:paid,partsRateLimit:cf.purchaseRateLimit??null,routes:cf.routes??null,eventFeeds:studio.mcp?.events,triggers:functions.length||Object.keys(studio.mcp?.events??{}).length?{crons:[...new Set(['* * * * *',...functions.map(f=>f.schedule).filter(Boolean)])].sort()}:null,...overrides}));
+  updateWorkerConfig(root,wranglerConfig({worker:cf.worker,name:studio.name,d1:cf.d1,d1Id:cf.d1Id,r2:cf.r2,layout:layoutOf(root),ai,paidParts:paid,partsRateLimit:cf.purchaseRateLimit??null,routes:cf.routes??null,eventFeeds:studio.mcp?.events,triggers:{crons:[scheduleTrigger(functions,{eventFeeds:Object.keys(studio.mcp?.events??{}).length>0})].filter(Boolean)},...overrides}));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homie-rocks/studio",
-  "version": "0.50.5",
+  "version": "0.50.7",
   "description": "A studio for games, music and video on its own Cloudflare: scaffold, multiplayer starters on the netplay contract, a port toolkit that makes existing single-player web games multiplayer, the site Worker with public rooms (Table/Lobby Durable Objects and D1, all on the free Workers plan, no payment method), a site with the hub's sections (Home, Games, Music, Videos, Rooms, Posts with feeds) in the studio's own look, an epic landing page for every game, big songs and videos in the studio's own R2 once it has storage (uploaded, checked by SHA-256, served at the same addresses), deploy, and the homie.rocks directory.",
   "type": "module",
   "license": "Apache-2.0",

package/shop/SHOP.md

@@ -188,7 +188,7 @@ and [expiring open sessions](https://docs.stripe.com/api/checkout/sessions/expir
 Replacing an open checkout expires only reservations at least a minute old; a named cancellation can expire immediately.
 Unresolved orders become eligible for reconciliation after one minute, even with no cap. A buyer's next shop
 or owned-items request schedules up to three reads off the response path, with atomic claims and backoff up
-to an hour; an optional Worker cron invokes the same reconciliation across buyers. No cron is installed for you. To run it every five minutes, add `"triggers": { "crons": ["*/5 * * * *"] }` to the studio’s root `wrangler.jsonc`; deploy preserves its triggers.
+to an hour; an optional Worker cron invokes the same reconciliation across buyers. Shop/paid-part studios install a five-minute maintenance trigger. Declared functions install their own required scheduling/retry trigger. Put additional studio crons in root `wrangler.custom.json`; build and deploy merge and preserve them.
 With an API key, every recorded payment checks Stripe’s refunds and dispute state, including payments recovered by an early refund or dispute event. The thanks page can verify a payment directly with the studio's key. Webhook events require Stripe's signature.
 Test and live books stay separate. Owner release attempts to expire an open session, records who released it
 and when, and never prevents a later verified payment grant.

package/tools/tools.ts

@@ -7,7 +7,14 @@ export interface ToolContext {
   office(path: string, body?: Record<string, unknown>, query?: Record<string, string>): Promise<unknown>;
   shop(): Promise<unknown>;
   rooms: { send(event: {game: string; room: string; event: string; data: unknown}): Promise<unknown> };
-  database: { get(key: string): Promise<unknown>; put(key: string, value: unknown): Promise<void> };
+  database: {
+    get(key: string): Promise<unknown>;
+    getVersioned(key: string): Promise<{value: unknown; version: number} | null>;
+    put(key: string, value: unknown, options?: {version?: number}): Promise<{ok: boolean; version?: number; conflict?: boolean}>;
+    increment(key: string, amount?: number): Promise<{value: number; version: number}>;
+    append(key: string, value: unknown): Promise<{value: unknown[]; version: number}>;
+    list(options?: {prefix?: string; after?: string; limit?: number}): Promise<{items: {key: string; value: unknown; version: number}[]; next: string | null}>;
+  };
   fetch: typeof fetch;
   fetchWithSecret(name: string, url: string, init?: RequestInit): Promise<Response>;
   ai(model: string, input: unknown): Promise<unknown>;

package/worker/app-format.mjs

@@ -18,7 +18,7 @@ export function appProblems(meta) {
   if (!object(meta.records) || typeof meta.records.persist !== 'boolean' || !object(meta.records.collections)) bad.push('records declares persist and collections');
   for (const [id, c] of Object.entries(collections)) {
     if (!key.test(id) || !object(c) || !object(c.fields)) { bad.push(`collection ${id}: declare fields`); continue; }
-    for (const [field, spec] of Object.entries(c.fields)) if (!key.test(field) || !object(spec) || !['string', 'number', 'boolean'].includes(spec.type) || (spec.enum && (!Array.isArray(spec.enum) || !spec.enum.length))) bad.push(`collection ${id}.${field}: invalid field`);
+    for (const [field, spec] of Object.entries(c.fields)) if (!/^[a-z][a-z0-9_]*$/.test(field) || !object(spec) || !['string', 'number', 'boolean'].includes(spec.type) || (spec.enum && (!Array.isArray(spec.enum) || !spec.enum.length))) bad.push(`collection ${id}.${field}: invalid field: names start with a lowercase letter and use lowercase letters, digits and underscore; declare a string, number or boolean type`);
   }
   for (const r of Object.values(roles)) for (const cap of Array.isArray(r?.can) ? r.can : []) if (!Object.hasOwn(meta.records?.collections ?? {}, String(cap).split(':')[1])) bad.push(`unknown collection in ${cap}`);
   for (const [k, v] of Object.entries(meta.words ?? {})) if (!/^[a-z][a-zA-Z0-9-]*$/.test(k) || typeof v !== 'string' || v.length > 500) bad.push(`words.${k}: use a short label`);
@@ -32,6 +32,7 @@ export function appRole(meta, url) {
 }
 export function recordProblem(collection, data, { create = false } = {}) {
   if (!object(data) || JSON.stringify(data).length > 8192) return 'record must be an object below 8 KB';
+  for (const k of Object.keys(data)) if (!/^[a-z][a-z0-9_]*$/.test(k)) return `invalid field ${k}: names start with a lowercase letter and use lowercase letters, digits and underscore`;
   for (const k of Object.keys(data)) if (!Object.hasOwn(collection.fields, k)) return `unknown field ${k}`;
   for (const [k, s] of Object.entries(collection.fields)) {
     const v = data[k];

package/worker/app-frame.mjs

@@ -0,0 +1,9 @@
+/** Opaque frames retain their isolation. Unavailable Web Storage falls back to frame-local memory. */
+export const APP_STORAGE_JS=String.raw`(()=>{
+ for(const name of ['localStorage','sessionStorage']) {
+  try {const storage=window[name];const probe='homie-storage-probe';storage.setItem(probe,'1');storage.removeItem(probe);continue;}catch{}
+  const data=new Map();const methods={getItem:k=>data.get(String(k))??null,setItem:(k,v)=>{data.set(String(k),String(v));},removeItem:k=>{data.delete(String(k));},clear:()=>data.clear(),key:i=>[...data.keys()][Number(i)]??null};
+  const storage=new Proxy(methods,{get:(target,key)=>key==='length'?data.size:key in target?target[key]:data.get(String(key)),set:(_,key,value)=>{data.set(String(key),String(value));return true;},deleteProperty:(_,key)=>data.delete(String(key)),ownKeys:()=>[...data.keys()],getOwnPropertyDescriptor:()=>({enumerable:true,configurable:true})});
+  Object.defineProperty(window,name,{value:storage,configurable:true});
+ }
+})();`;

package/worker/app-records.mjs

@@ -1,3 +1,4 @@
+import {localSession} from './local-test.mjs';
 import { toolIdentity } from './tool-identity.mjs';
 /** Lasting app records in the studio's own D1. Room hosts never authorize writes. */
 import { appRole, recordProblem } from './app-format.mjs';
@@ -38,12 +39,14 @@ export async function appAccess(request, env, meta, url) {
   const declared = Object.hasOwn(meta.roles ?? {}, role) ? meta.roles[role] : null;
   if (!declared) return { ok: false, status: 404, error: 'unknown role' };
   if (!declared.signIn) return { ok: true, role, can: declared.can };
+  const session = await localSession(request, env);
+  if (session?.app === meta.id && session.role === role) return {ok:true,role,can:declared.can};
   if (!env.DB) return { ok: false, status: 503, error: 'app roles need the studio database' };
   const caller = toolIdentity(request);
   if (caller) {
     if (caller.owner) return { ok: true, role, can: declared.can };
     if (!caller.id) return { ok: false, status: 401, error: 'sign in to this studio' };
-    const grant = await env.DB.prepare('SELECT player FROM app_roles WHERE app = ?1 AND role = ?2 AND player = ?3').bind(meta.id, role, caller.id).first();
+    const grant = await env.DB.prepare("SELECT player FROM app_roles WHERE app IN (?1, '*') AND role = ?2 AND player = ?3").bind(meta.id, role, caller.id).first();
     return grant ? { ok: true, role, can: declared.can } : { ok: false, status: 403, error: 'this account has no role grant' };
   }
   const link = await env.DB.prepare('SELECT token FROM app_role_links WHERE app = ?1 AND role = ?2').bind(meta.id, role).first();
@@ -51,7 +54,7 @@ export async function appAccess(request, env, meta, url) {
   if (await isOwner(request, env)) return { ok: true, role, can: declared.can };
   const person = await players.of(request, env);
   if (!person || person.guest) return { ok: false, status: 401, error: 'sign in to this studio' };
-  const grant = await env.DB.prepare('SELECT player FROM app_roles WHERE app = ?1 AND role = ?2 AND player = ?3').bind(meta.id, role, person.id).first();
+  const grant = await env.DB.prepare("SELECT player FROM app_roles WHERE app IN (?1, '*') AND role = ?2 AND player = ?3").bind(meta.id, role, person.id).first();
   return grant ? { ok: true, role, can: declared.can } : { ok: false, status: 403, error: 'this account has no role grant' };
 }
 export async function appRecordsRoute(request, env, meta, url, sub) {
@@ -69,26 +72,30 @@ export async function appRecordsRoute(request, env, meta, url, sub) {
         if (!ID.test(b.player)) return fail(400, 'invalid account');
         const p = await players.get(b.player, env);
         if (!p || p.guest) return fail(400, 'role grants require an existing signed-in account');
-        await env.DB.prepare(b.revoke === true ? 'DELETE FROM app_roles WHERE app = ?1 AND role = ?2 AND player = ?3' : 'INSERT OR IGNORE INTO app_roles (app, role, player) VALUES (?1, ?2, ?3)').bind(meta.id, b.role, b.player).run();
+        await env.DB.prepare(b.revoke === true ? 'DELETE FROM app_roles WHERE app = ?1 AND role = ?2 AND player = ?3' : 'INSERT OR IGNORE INTO app_roles (app, role, player) VALUES (?1, ?2, ?3)').bind(b.studio === true ? '*' : meta.id, b.role, b.player).run();
       }
       const token = crypto.randomUUID().replaceAll('-', '');
       if (b.rotate === true) await env.DB.prepare('DELETE FROM app_role_links WHERE app = ?1 AND role = ?2').bind(meta.id, b.role).run();
       await env.DB.prepare('INSERT OR IGNORE INTO app_role_links (app, role, token) VALUES (?1, ?2, ?3)').bind(meta.id, b.role, token).run();
       const row = await env.DB.prepare('SELECT token FROM app_role_links WHERE app = ?1 AND role = ?2').bind(meta.id, b.role).first();
-      return json({ ok: true, link: `${url.origin}/${meta.id}/open?role=${b.role}&access=${row.token}`, role: b.role });
+      return json({ ok: true, link: `${url.origin.replace('127.0.0.1','localhost')}/${meta.id}/open?role=${b.role}&access=${row.token}`, role: b.role });
     }
     const match = /^api\/app\/records\/([a-z][a-z0-9-]{0,39})(?:\/([A-Za-z0-9_-]{1,64}))?$/.exec(sub);
+    if(!match && /^api\/app\/records\/[^/]+\//.test(sub))return fail(400,'record id: 1–64 letters, digits, underscore or hyphen');
     if (!match || !Object.hasOwn(meta.records?.collections ?? {}, match[1])) return fail(404, 'unknown collection');
     if (meta.records.persist !== true) return fail(409, 'use netplay state for transient records, or enable records.persist');
     const access = await appAccess(request, env, meta, url);
     if (!access.ok) return fail(access.status, access.error);
     const [, collection, id] = match;
+    const session = await localSession(request, env);
+    const testScope = (session?.app === meta.id ? session.scope : null) ?? (env.HOMIE_LOCAL_TEST_SECRET ? toolIdentity(request)?.testScope : null);
+    const recordApp = testScope ? `${meta.id}:check:${testScope}` : meta.id;
     const op = ({ GET: 'read', POST: 'create', PUT: 'update', DELETE: 'delete' })[request.method];
     if (!op || !access.can.includes(`${op}:${collection}`)) return fail(403, 'role cannot perform this operation');
     if (op !== 'read' && !sameOrigin(request, url) && !(appOriginOf(request) && !meta.roles[access.role].signIn)) return fail(403, 'same origin required');
     if (op === 'read') {
-      const rows = id ? [await env.DB.prepare('SELECT id, value, version, updated_at FROM app_records WHERE app = ?1 AND collection = ?2 AND id = ?3').bind(meta.id, collection, id).first()].filter(Boolean)
-        : (await env.DB.prepare('SELECT id, value, version, updated_at FROM app_records WHERE app = ?1 AND collection = ?2 ORDER BY updated_at, id LIMIT 1000').bind(meta.id, collection).all()).results;
+      const rows = id ? [await env.DB.prepare('SELECT id, value, version, updated_at FROM app_records WHERE app = ?1 AND collection = ?2 AND id = ?3').bind(recordApp, collection, id).first()].filter(Boolean)
+        : (await env.DB.prepare('SELECT id, value, version, updated_at FROM app_records WHERE app = ?1 AND collection = ?2 ORDER BY updated_at, id LIMIT 1000').bind(recordApp, collection).all()).results;
       return json({ ok: true, records: rows.map((r) => ({ id: r.id, data: JSON.parse(r.value), version: r.version, updatedAt: r.updated_at })) });
     }
     if (!id) return fail(400, 'record id required');
@@ -96,9 +103,9 @@ export async function appRecordsRoute(request, env, meta, url, sub) {
     if (op !== 'delete') { const bad = recordProblem(meta.records.collections[collection], body.data, { create: op === 'create' }); if (bad) return fail(400, bad); }
     if (op !== 'create' && (!Number.isSafeInteger(body.version) || body.version < 1)) return fail(400, 'record version required');
     const stmt = op === 'create'
-      ? env.DB.prepare('INSERT OR IGNORE INTO app_records (app, collection, id, value, version, updated_at) SELECT ?1, ?2, ?3, ?4, 1, ?5 WHERE (SELECT COUNT(*) FROM app_records WHERE app = ?1 AND collection = ?2) < 1000').bind(meta.id, collection, id, JSON.stringify(body.data), Date.now())
-      : op === 'update' ? env.DB.prepare('UPDATE app_records SET value = ?4, version = version + 1, updated_at = ?5 WHERE app = ?1 AND collection = ?2 AND id = ?3 AND version = ?6').bind(meta.id, collection, id, JSON.stringify(body.data), Date.now(), body.version)
-      : env.DB.prepare('DELETE FROM app_records WHERE app = ?1 AND collection = ?2 AND id = ?3 AND version = ?4').bind(meta.id, collection, id, body.version);
+      ? env.DB.prepare('INSERT OR IGNORE INTO app_records (app, collection, id, value, version, updated_at) SELECT ?1, ?2, ?3, ?4, 1, ?5 WHERE (SELECT COUNT(*) FROM app_records WHERE app = ?1 AND collection = ?2) < 1000').bind(recordApp, collection, id, JSON.stringify(body.data), Date.now())
+      : op === 'update' ? env.DB.prepare('UPDATE app_records SET value = ?4, version = version + 1, updated_at = ?5 WHERE app = ?1 AND collection = ?2 AND id = ?3 AND version = ?6').bind(recordApp, collection, id, JSON.stringify(body.data), Date.now(), body.version)
+      : env.DB.prepare('DELETE FROM app_records WHERE app = ?1 AND collection = ?2 AND id = ?3 AND version = ?4').bind(recordApp, collection, id, body.version);
     const result = await stmt.run();
     return result.meta.changes ? json({ ok: true, id, version: op === 'create' ? 1 : body.version + 1 }) : fail(409, 'record changed, already exists, or collection full; reload');
   } catch (error) {

package/worker/build-id.mjs

@@ -1,2 +1,2 @@
 // Generated by lib/build-identity.mjs; identifies the bundled runtime sources.
-export const STUDIO_BUILD = Object.freeze({"version":"0.50.5","sha256":"11a7b1a55c4f2499f8a04e3f9808ed38f4dde1725f991fffdcfab47dc7a28ea0"});
+export const STUDIO_BUILD = Object.freeze({"version":"0.50.7","sha256":"94d707956333f370dc0a5a65762e08418b6474d19302096c765b96090d9d4845"});

package/worker/event-resources.mjs

@@ -17,7 +17,7 @@ export async function readableFeed(env,cat,caller,name) {
     if(!app||!app.records?.collections?.[feed.collection])return false;
     if(caller.owner)return true;
     if(launchOf(app,await settingsOf(env,{fresh:true}),env)!=='public')return false;
-    return Object.entries(app.roles??{}).some(([role,decl])=>decl.can.includes('read:'+feed.collection)&&(!decl.signIn||caller.roles?.[app.id]?.includes(role)));
+    return Object.entries(app.roles??{}).some(([role,decl])=>decl.can.includes('read:'+feed.collection)&&(!decl.signIn||(caller.roles?.[app.id]?.includes(role)||caller.roles?.['*']?.includes(role))));
   }
   // Non-record events have no app read capability; they remain owner-only.
   return caller.owner===true;
@@ -56,12 +56,14 @@ export async function pushEvents(env,cat,origin) {
 }
 
 /** One existing Lobby object per OAuth connection: streams never live in a Worker isolate. */
+const streamCaller=(env,connection)=>connection.startsWith('public:')?Promise.resolve({id:null,owner:false,client:null,connection}):currentCaller(env,{connection});
 export class EventStreams {
   constructor(env,ctx){this.env=env;this.ctx=ctx;this.stream=null;this.tail=Promise.resolve();}
-  close(stream){stream.cancelled=true;stream.resume?.();try{stream.controller.close();}catch{}if(this.stream===stream)this.stream=null;}
+  close(stream){stream.cancelled=true;stream.resume?.();try{stream.controller.close();}catch{}if(this.stream===stream){this.stream=null;this.ctx.waitUntil(this.env.DB.prepare('DELETE FROM mcp_kv WHERE key=?1').bind('tools-stream:'+stream.connection).run().catch(()=>{}));}}
   background(input){this.ctx.waitUntil(this.wake(input).catch(error=>{if(this.stream)this.close(this.stream);console.error('Event stream delivery failed',error);}));}
   async fetch(request) {
     const input=await request.json();
+    if(input.op==='tools') {await this.wake(input);return new Response(null,{status:204});}
     if(input.op==='stream') {
       // A reconnect replaces the previous GET, including a half-open socket.
       if(this.stream)this.close(this.stream);
@@ -73,6 +75,10 @@ export class EventStreams {
       const stream={...input,after,name,controller:null,cancelled:false,resume:null};
       const body=new ReadableStream({start:controller=>{stream.controller=controller;controller.enqueue(new TextEncoder().encode(': connected\n\n'));},pull:()=>{const resume=stream.resume;stream.resume=null;resume?.();},cancel:()=>this.close(stream)});
       this.stream=stream;
+      const caller=await streamCaller(this.env,connection).catch(()=>null);
+      if(!caller){this.close(stream);return new Response('Unauthorized',{status:401});}
+      stream.toolSignature=await this.toolSignature(input.tools??[],caller);
+      await this.env.DB.prepare('INSERT INTO mcp_kv(key,value) VALUES(?1,?2) ON CONFLICT(key) DO UPDATE SET value=excluded.value').bind('tools-stream:'+connection,JSON.stringify({connection})).run();
       // Replay and later wakes share one ordered pump. Backpressure must not
       // hold up the writer's request or a function handler.
       this.background(input);
@@ -81,11 +87,16 @@ export class EventStreams {
     this.background(input);return new Response(null,{status:204});
   }
   wake(input){const work=this.tail.then(()=>this.deliver(input));this.tail=work.catch(()=>{});return work;}
+  async toolSignature(tools,caller) {const visible=[];for(const tool of tools)if(await allowed(tool.audience,caller,this.env))visible.push(tool);return JSON.stringify(visible);}
   async deliver(input) {
     const stream=this.stream;if(!stream)return;
     let caller;
-    try{caller=await currentCaller(this.env,{connection:input.connection});}
+    try{caller=await streamCaller(this.env,input.connection);}
     catch{this.close(stream);return;}
+    if(input.tools){
+      const signature=await this.toolSignature(input.tools,caller);
+      if(stream.toolSignature!==signature){stream.toolSignature=signature;stream.controller.enqueue(new TextEncoder().encode('event: message\ndata: '+JSON.stringify({jsonrpc:'2.0',method:'notifications/tools/list_changed'})+'\n\n'));}
+    }
     const rows=(await this.env.DB.prepare("SELECT value FROM mcp_kv WHERE key LIKE ?1").bind('event-sub:'+caller.connection+':%').all()).results;
     const subscriptions=[];
     for(const row of rows){const sub=JSON.parse(row.value);if(await readableFeed(this.env,input.cat,caller,sub.name))subscriptions.push(sub);}
@@ -114,3 +125,19 @@ export class EventStreams {
     }
   }
 }
+
+/** Refresh active streams whenever this Worker observes a new tool catalogue. */
+export async function pushToolList(env,cat,tools,origin) {
+  if(!env.LOBBY)return;
+  const publicShape=tools.map(({name,description,inputSchema,audience,kind})=>({name,description,inputSchema,audience,kind}));
+  const signature=JSON.stringify(publicShape);
+  const previous=await env.DB.prepare("SELECT value FROM mcp_kv WHERE key='tools-catalogue'").first();
+  if(previous?.value===signature)return;
+  await env.DB.prepare("INSERT INTO mcp_kv(key,value) VALUES('tools-catalogue',?1) ON CONFLICT(key) DO UPDATE SET value=excluded.value").bind(signature).run();
+  let after='';
+  for(;;){
+    const rows=(await env.DB.prepare("SELECT key,value FROM mcp_kv WHERE key LIKE 'tools-stream:%' AND key>?1 ORDER BY key LIMIT 100").bind(after).all()).results;
+    for(const row of rows){const connection=JSON.parse(row.value).connection;await eventHub(env,connection).fetch('https://events/__studio_events',{method:'POST',body:JSON.stringify({op:'tools',connection,cat,tools:publicShape,origin})});}
+    if(rows.length<100)break;after=rows.at(-1).key;
+  }
+}

package/worker/function-schedule.mjs

@@ -0,0 +1,68 @@
+// Cloudflare's five-field UTC cron dialect: Sunday=1, Saturday=7.
+const ranges=[[0,59],[0,23],[1,31],[1,12],[1,7]];
+const aliases=[null,null,null,['JAN','FEB','MAR','APR','MAY','JUN','JUL','AUG','SEP','OCT','NOV','DEC'],['SUN','MON','TUE','WED','THU','FRI','SAT']];
+function field(text,index) {
+  const [min,max]=ranges[index],values=new Set(),special=[];
+  text=text.toUpperCase();
+  if(aliases[index])text=text.replace(/[A-Z]{3}/g,name=>{const n=aliases[index].indexOf(name);if(n<0)throw new Error(`Unknown cron name ${name}`);return String(n+1);});
+  for(const part of text.split(',')) {
+    if(index===2 && /^(L|LW|(?:[1-9]|[12]\d|3[01])W)$/.test(part) || index===4 && /^[1-7](L|#[1-5])$/.test(part)) {special.push(part);continue;}
+    if(!/^(\*|\d+(?:-\d+)?)(?:\/[1-9]\d*)?$/.test(part))throw new Error(`Invalid cron field ${text}`);
+    const [base,stepText]=part.split('/'),step=Number(stepText??1);
+    const [lo,hi]=base==='*'?[min,max]:base.includes('-')?base.split('-').map(Number):[Number(base),stepText?max:Number(base)];
+    if(lo<min||hi>max||lo>hi||!Number.isSafeInteger(step)||step>max-min+1)throw new Error(`Cron field out of range: ${text}`);
+    for(let n=lo;n<=hi;n+=step)values.add(n);
+  }
+  return {values:[...values].sort((a,b)=>a-b),special};
+}
+const lastDay=d=>new Date(Date.UTC(d.getUTCFullYear(),d.getUTCMonth()+1,0)).getUTCDate();
+function weekdayNear(d,day) {
+  const last=lastDay(d);if(day>last)return null;
+  const weekday=new Date(Date.UTC(d.getUTCFullYear(),d.getUTCMonth(),day)).getUTCDay();
+  return weekday===6?(day===1?3:day-1):weekday===0?(day===last?day-2:day+1):day;
+}
+export function parseSchedule(expression) {
+  if(typeof expression!=='string'||expression.trim().split(/\s+/).length!==5)throw new Error('Schedule needs five cron fields');
+  const parts=expression.trim().split(/\s+/),fields=parts.map(field);
+  const dayMatches=d=>{
+    const day=d.getUTCDate(),weekday=d.getUTCDay()+1,last=lastDay(d);
+    return fields[3].values.includes(d.getUTCMonth()+1) &&
+      (fields[2].values.includes(day)||fields[2].special.some(s=>s==='L'?day===last:s==='LW'?day===weekdayNear(d,last):day===weekdayNear(d,Number(s.slice(0,-1))))) &&
+      (fields[4].values.includes(weekday)||fields[4].special.some(s=>weekday===Number(s[0])&&(s.endsWith('L')?day+7>last:Math.ceil(day/7)===Number(s.at(-1)))));
+  };
+  return {parts,fields,dayMatches,matches(time){const d=new Date(time);return dayMatches(d)&&fields[0].values.includes(d.getUTCMinutes())&&fields[1].values.includes(d.getUTCHours());}};
+}
+export function nextDue(expression,after=Date.now()) {
+  const cron=typeof expression==='string'?parseSchedule(expression):expression;
+  const date=new Date(after);date.setUTCHours(0,0,0,0);
+  // A Gregorian calendar repeats after 400 years; this also detects impossible dates.
+  for(let days=0;days<=146097;days++,date.setUTCDate(date.getUTCDate()+1)) {
+    if(!cron.dayMatches(date))continue;
+    for(const hour of cron.fields[1].values)for(const minute of cron.fields[0].values) {
+      const time=date.getTime()+hour*3600000+minute*60000;
+      if(time>after)return time;
+    }
+  }
+  return null;
+}
+export function scheduleTrigger(definitions,{eventFeeds=false}={}) {
+  if(eventFeeds||definitions.some(f=>f.schedule===undefined))return '* * * * *';
+  const schedules=definitions.map(f=>parseSchedule(f.schedule));
+  if(!schedules.length)return null;
+  if(schedules.every(c=>c.parts.join(' ')===schedules[0].parts.join(' ')))return schedules[0].parts.join(' ');
+  return ranges.map(([min,max],i)=>{
+    if(schedules.every(c=>c.parts[i]===schedules[0].parts[i]))return schedules[0].parts[i];
+    if(i===2||i===4)return '*';
+    const values=[...new Set(schedules.flatMap(c=>c.fields[i].values))].sort((a,b)=>a-b);
+    return values.length===max-min+1?'*':values.join(',');
+  }).join(' ');
+}
+export function scheduleStatus(definitions,crons,now=Date.now()) {
+  return definitions.filter(f=>f.schedule!==undefined).map(fn=>{
+    try {
+      const due=nextDue(fn.schedule,now);
+      const runnable=due!==null && crons.some(c=>{try{return parseSchedule(c).matches(due);}catch{return false;}});
+      return {function:fn.name,schedule:fn.schedule,nextDue:due===null?null:new Date(due).toISOString(),status:due===null?'Cannot run: schedule has no matching date':runnable?'Configured; awaiting scheduled delivery':'Cannot run: no configured trigger covers the next due time'};
+    } catch(error) {return {function:fn.name,schedule:fn.schedule,nextDue:null,status:`Cannot run: ${error.message}`};}
+  });
+}

package/worker/functions-schema.mjs

@@ -84,3 +84,16 @@ WHEN EXISTS (SELECT 1 FROM function_subscriptions WHERE type='order.paid')
  'app',NEW.game,'reference',(SELECT value FROM meta WHERE key='shop-reference:' || NEW.id)),NEW.paid_at);
 END;
 `;
+
+/** Attempt history is independent of the prunable delivery queue. */
+export const FUNCTIONS_RUNS_MIGRATION_FILE = '0023_function_runs.sql';
+export const FUNCTIONS_RUNS_MIGRATION = `
+CREATE TABLE function_runs (
+ seq INTEGER PRIMARY KEY AUTOINCREMENT, id TEXT NOT NULL UNIQUE,
+ function TEXT NOT NULL, event TEXT NOT NULL, trigger TEXT NOT NULL,
+ started INTEGER NOT NULL, finished INTEGER, outcome TEXT NOT NULL,
+ error TEXT, attempt INTEGER NOT NULL
+);
+CREATE INDEX function_runs_function_seq ON function_runs(function,seq);
+CREATE INDEX function_runs_errors_seq ON function_runs(seq) WHERE outcome IN ('failed','interrupted');
+`;

package/worker/functions.mjs

@@ -1,4 +1,6 @@
 import {webhookSubscriptions,webhookFailure,webhookBackoff} from './event-webhooks.mjs';
+import {parseSchedule,scheduleStatus} from './function-schedule.mjs';
+import {redactText} from '../lib/redact.mjs';
 import {feedSubscriptions,pushEvents} from './event-resources.mjs';
 import { services } from './mcp-tools.mjs';
 import { isOwner, sameOrigin } from './office.mjs';
@@ -63,16 +65,28 @@ export async function runFunctions(env, cat, origin, {definitions, now = Date.no
       if(rows.length===100)more=true;
       for (const row of rows) {
         const lease=crypto.randomUUID();
-        const claimed=await env.DB.prepare(`UPDATE function_deliveries SET state='running',lease=?3,due=?4,attempts=attempts+1 WHERE event=?1 AND function=?2 AND state!='complete' AND due<=?5`).bind(row.event,fn.name,lease,now()+leaseMs,now()).run();
+        const started=now();
+        const [claimed]=await env.DB.batch([
+          env.DB.prepare(`UPDATE function_deliveries SET state='running',lease=?3,due=?4,attempts=attempts+1 WHERE event=?1 AND function=?2 AND state!='complete' AND due<=?5`).bind(row.event,fn.name,lease,started+leaseMs,started),
+          env.DB.prepare("UPDATE function_runs SET outcome='interrupted',error='Worker lease expired before completion was recorded' WHERE event=?1 AND function=?2 AND outcome='running' AND EXISTS(SELECT 1 FROM function_deliveries WHERE event=?1 AND function=?2 AND lease=?3)").bind(row.event,fn.name,lease),
+          env.DB.prepare("INSERT INTO function_runs(id,function,event,trigger,started,outcome,attempt) SELECT ?1,?2,?3,?4,?5,'running',attempts FROM function_deliveries WHERE event=?3 AND function=?2 AND lease=?1").bind(lease,fn.name,row.event,row.event.startsWith(`schedule:${fn.name}:`)?`schedule: ${JSON.parse(row.data).cron}`:row.type,started),
+        ]);
         if (!claimed.meta.changes) continue;
+        let failure=null;
         try {
-          const event=Object.freeze({id:row.event,type:row.type,at:row.at,data:JSON.parse(row.data),attempt:row.attempts+1});
-          await fn.handler(event,services(env,cat,origin,{id:'studio-function',owner:true,client:null},'function:'+fn.name,fn));
-          await env.DB.prepare(`UPDATE function_deliveries SET state='complete',completed=?4,error=NULL WHERE event=?1 AND function=?2 AND lease=?3`).bind(row.event,fn.name,lease,now()).run();
-        } catch (error) {
-          // Handler errors may contain credentials. The office identifies the function/event; Worker logs are the studio's debugging surface.
-          await env.DB.prepare(`UPDATE function_deliveries SET state='failed',error=?5,due=?4 WHERE event=?1 AND function=?2 AND lease=?3`).bind(row.event,fn.name,lease,now()+(fn.webhook?webhookBackoff(row.attempts+1):leaseMs),fn.webhook?webhookFailure(error):'Function failed; inspect its code and retry').run();
-        }
+          const stored=JSON.parse(row.data);
+          const isolated=env.HOMIE_LOCAL_TEST_SECRET && /^([a-z][a-z0-9-]*):check:([a-zA-Z0-9-]+)$/.exec(stored?.app??'');
+          const event=Object.freeze({id:row.event,type:row.type,at:row.at,data:isolated?{...stored,app:isolated[1]}:stored,attempt:row.attempts+1});
+          const testScope=isolated?isolated[2]:null;
+          await fn.handler(event,services(env,cat,origin,{id:'studio-function',owner:true,client:null,...(testScope?{testScope}:{})},'function:'+fn.name+(testScope?':check:'+testScope:''),fn));
+        } catch(error) {failure=fn.webhook?webhookFailure(error):functionError(error,env);}
+        const finished=now();
+        await env.DB.batch([
+          failure===null
+            ? env.DB.prepare(`UPDATE function_deliveries SET state='complete',completed=?4,error=NULL WHERE event=?1 AND function=?2 AND lease=?3`).bind(row.event,fn.name,lease,finished)
+            : env.DB.prepare(`UPDATE function_deliveries SET state='failed',error=?5,due=?4 WHERE event=?1 AND function=?2 AND lease=?3`).bind(row.event,fn.name,lease,finished+(fn.webhook?webhookBackoff(row.attempts+1):leaseMs),fn.webhook?failure:'Function failed; inspect its code and retry'),
+          env.DB.prepare("UPDATE function_runs SET outcome=?2,finished=?3,error=?4 WHERE id=?1").bind(lease,failure===null?'complete':'failed',finished,failure),
+        ]);
       }
     }
   } while(more);
@@ -82,10 +96,18 @@ export async function runFunctions(env, cat, origin, {definitions, now = Date.no
 }
 export async function scheduleFunctions(event,env,cat,origin) {
   const definitions=await syncFunctions(env);
-  for(const fn of definitions) if(fn.schedule===event.cron) await env.DB.batch([
-    env.DB.prepare(`INSERT OR IGNORE INTO studio_events(id,type,data,at) SELECT ?1,?2,?3,?4 WHERE EXISTS(SELECT 1 FROM function_subscriptions WHERE name=?5 AND last_tick<?4)`).bind(`schedule:${fn.name}:${event.scheduledTime}`,fn.event,JSON.stringify({function:fn.name,cron:event.cron,scheduledTime:event.scheduledTime}),event.scheduledTime,fn.name),
-    env.DB.prepare('UPDATE function_subscriptions SET last_tick=MAX(last_tick,?2) WHERE name=?1').bind(fn.name,event.scheduledTime),
+  const scheduledTime=Math.floor(event.scheduledTime/60000)*60000;
+  await env.DB.prepare("INSERT INTO meta(key,value) VALUES('function-last-scheduled',?1) ON CONFLICT(key) DO UPDATE SET value=excluded.value").bind(JSON.stringify({cron:event.cron,scheduledTime})).run();
+  for(const fn of definitions) {
+    if(fn.schedule===undefined)continue;
+    let due=false;
+    try {due=parseSchedule(fn.schedule).matches(scheduledTime);} catch {continue;} // An old invalid declaration stays diagnosable via the owner tool.
+    if(!due)continue;
+    await env.DB.batch([
+    env.DB.prepare(`INSERT OR IGNORE INTO studio_events(id,type,data,at) SELECT ?1,?2,?3,?4 WHERE EXISTS(SELECT 1 FROM function_subscriptions WHERE name=?5 AND last_tick<?4)`).bind(`schedule:${fn.name}:${scheduledTime}`,fn.event,JSON.stringify({function:fn.name,cron:fn.schedule,scheduledTime}),scheduledTime,fn.name),
+    env.DB.prepare('UPDATE function_subscriptions SET last_tick=MAX(last_tick,?2) WHERE name=?1').bind(fn.name,scheduledTime),
   ]);
+  }
   await runFunctions(env,cat,origin,{definitions});
 }
 export async function functionsRoute(request,env,cat) {
@@ -107,3 +129,20 @@ export async function functionsRoute(request,env,cat) {
   const rows=(await env.DB.prepare(`SELECT d.*,e.type,e.at FROM function_deliveries d JOIN studio_events e ON e.id=d.event ORDER BY e.at DESC LIMIT 100`).all()).results;
   return new Response(`<!doctype html><meta charset="utf-8"><title>Studio functions</title><h1>Studio functions</h1><p>At-least-once delivery. Use the event ID to deduplicate effects.</p><table><tr><th>Function</th><th>Event ID</th><th>Event</th><th>State</th><th>Attempts</th><th>Error</th><th>Retry</th></tr>${rows.map(r=>`<tr>${[r.function,r.event,r.type,r.state,r.attempts,r.error??''].map(v=>`<td>${esc(v)}</td>`).join('')}<td>${r.state==='failed'?`<form method="post"><input type="hidden" name="retry" value="${esc(r.event)}"><button>Retry</button></form>`:''}</td></tr>`).join('')}</table>`,{headers:{'content-type':'text/html;charset=utf-8','cache-control':'no-store'}});
 }
+
+function functionError(error,env) {
+  let message=error instanceof Error?error.message:String(error);
+  // Remove known binding values as well as recognizable credential formats.
+  for(const [key,value] of Object.entries(env))if(typeof value==='string' && value && !['STUDIO_NAME','STUDIO_EVENT_FEEDS','STUDIO_FUNCTION_CRONS','STUDIO_FUNCTION_MANAGED_CRONS'].includes(key))message=message.split(value).join('[redacted]');
+  return redactText(message).text;
+}
+export async function functionRuns(env,{name,errors=false,before}={}) {
+  const rows=(await env.DB.prepare(`SELECT seq,function,event,trigger,started,finished,outcome,error,attempt FROM function_runs
+    WHERE (?1 IS NULL OR function=?1) AND (?2=0 OR outcome IN ('failed','interrupted')) AND (?3 IS NULL OR seq<?3)
+    ORDER BY seq DESC LIMIT 101`).bind(name??null,errors?1:0,before??null).all()).results;
+  const page=rows.slice(0,100),definitions=await load();
+  let crons=[];try {crons=JSON.parse(env.STUDIO_FUNCTION_CRONS??'[]');if(!Array.isArray(crons))crons=[];}catch {}
+  const schedules=scheduleStatus(definitions.filter(f=>!name||f.name===name),crons);
+  const tick=await env.DB.prepare("SELECT value FROM meta WHERE key='function-last-scheduled'").first();
+  return {runs:page.map(r=>({...r,started:new Date(r.started).toISOString(),finished:r.finished===null?null:new Date(r.finished).toISOString()})),next:rows.length>100?page.at(-1).seq:null,schedules,crons,lastScheduled:tick?JSON.parse(tick.value):null,triggerEvidence:'Generated deployment configuration; lastScheduled proves an observed tick. Provider dashboard changes are not queried.'};
+}

package/worker/index.mjs

@@ -1,3 +1,5 @@
+import {APP_STORAGE_JS} from './app-frame.mjs';
+import {recordsPage} from './records-page.mjs';
 import { RULES_WIRING_MESSAGE } from './rules-wiring.mjs';
 import { characterStore, characterRequest } from './characters.mjs';
 export { useFunctions } from './functions.mjs';
@@ -529,8 +531,8 @@ async function gameDocument(request, env, url, game, meta, cat, { agent = null }
     ...(!agent && !watching && await availableShellShop(env, cat, game) ? { shop: true } : {}),
   };
   let html = await res.text();
-  const fallback = meta?.kind === 'app' ? `<script>addEventListener('DOMContentLoaded',function(){if(!document.querySelector('canvas')||document.querySelector('[data-webgl-fallback]'))return;try{var c=document.createElement('canvas');if(c.getContext('webgl2'))return;}catch(e){}var p=document.createElement('p');p.dataset.webglFallback='';p.setAttribute('role','status');p.textContent=${JSON.stringify(meta.words?.fallback ?? 'This device cannot display the 3D scene. Try a browser with WebGL enabled; use any available controls below.').replace(/</g, '\u003c')};p.style.cssText='position:fixed;z-index:2147483647;left:16px;right:16px;top:80px;padding:16px;background:#fff;color:#222;font:16px system-ui;border-radius:12px';document.body.append(p);});</script>` : '';
-  const head = fallback + `${embedded ? `<script>${EMBED_GAME_JS}</script>` : ''}<script>window.HOMIE_NET=${JSON.stringify(cfg).replace(/</g, '\\u003c')}</script>`;
+  const fallback = meta?.kind === 'app' ? `<script>addEventListener('DOMContentLoaded',function(){if(!document.querySelector('canvas')||document.querySelector('[data-webgl-fallback]'))return;try{var c=document.createElement('canvas');if(c.getContext('webgl2'))return;}catch(e){}var p=document.createElement('p');p.dataset.webglFallback='';p.setAttribute('role','status');p.textContent=${JSON.stringify(meta.words?.fallback ?? 'This device cannot display the 3D scene. Try a browser with WebGL enabled; use any available controls below.').replace(/</g, '\u003c')};p.style.cssText='position:fixed;z-index:2147483647;left:16px;right:16px;bottom:16px;padding:12px;background:#fff;color:#222;font:16px system-ui;border-radius:12px';document.body.append(p);});</script>` : '';
+  const head = (meta.kind==='app'?`<script>${APP_STORAGE_JS}</script>`:'') + fallback + `${embedded ? `<script>${EMBED_GAME_JS}</script>` : ''}<script>window.HOMIE_NET=${JSON.stringify(cfg).replace(/</g, '\\u003c')}</script>`;
   html = /<head[^>]*>/i.test(html) ? html.replace(/<head([^>]*)>/i, `<head$1>${head}`) : head + html;
   return new Response(html, {
     headers: {
@@ -610,6 +612,7 @@ export default {
   async scheduled(event, env, ctx) {
     const maintenance=(async () => {
       const cat = await catalogue(env, 'https://studio.invalid');
+      await notifyTools(env,cat,cat.studio?.url??'https://studio.invalid').catch(error=>console.warn('Tool catalogue refresh:',error.message));
       await reconcileOrders(env, shopOf(cat));
       await (await import('./functions.mjs')).scheduleFunctions(event,env,cat,cat.studio?.url??'https://studio.invalid');
     })();
@@ -638,6 +641,8 @@ export default {
       try { console.error(JSON.stringify({ at: new Date().toISOString(), ev: 'lobby-route-failed', path: url.pathname, error: errorLine(error) })); } catch { /* no console */ }
       res = json({ ok: false, error: 'failed' }, 500);
     } finally {
+      // Refresh after the route has populated the catalogue cache.
+      if(env.DB&&env.LOBBY&&ctx?.waitUntil)ctx.waitUntil(catalogue(env,url.origin).then(cat=>notifyTools(env,cat,url.origin)).catch(()=>{}));
       // A route can commit a write and then fail. Its outbox still needs delivery.
       if(env.DB) {
         const delivery=dispatch();
@@ -649,6 +654,11 @@ export default {
   },
 };
 
+async function notifyTools(env,cat,origin) {
+  if(!env.DB||!env.LOBBY)return;
+  const [{pushToolList},{builtins}]=await Promise.all([import('./event-resources.mjs'),import('./mcp-tools.mjs')]);
+  await pushToolList(env,cat,[...builtins(env,cat,origin),...await studioTools()],origin);
+}
 let studioTools = async () => [];
 /** Studio-authored Worker code, loaded only on the MCP surface. */
 export function useTools(load) { studioTools = load; }
@@ -920,6 +930,7 @@ async function route(request, env, ctx) {
           if (a.status === 401) return Response.redirect(`${url.origin}/account/?next=${encodeURIComponent(url.pathname + url.search)}`, 302);
           return json({ ok: false, error: a.error }, a.status);
         }
+        if(!meta.room)return recordsPage(meta,url,cat);
       }
     }
     const lobby = () => env.LOBBY.get(env.LOBBY.idFromName(game));

package/worker/local-test.mjs

@@ -0,0 +1,19 @@
+/** Only dev supplies this secret. Neither a loopback URL nor a role parameter grants authority. */
+const local = (request, env) => env.HOMIE_LOCAL_TEST_SECRET && ['localhost','127.0.0.1','[::1]'].includes(new URL(request.url).hostname);
+export async function localCaller(request, env) {
+  if (!local(request, env) || request.headers.get('authorization') !== `Bearer ${env.HOMIE_LOCAL_TEST_SECRET}`) return null;
+  return {id:'local-test-owner',owner:true,client:null};
+}
+export async function localSession(request, env) {
+  if (!local(request, env)) return null;
+  const token = /(?:^|;\s*)homie_test=([^;]+)/.exec(request.headers.get('cookie') ?? '')?.[1];
+  if (!token) return null;
+  try {
+    const [data, signature] = token.split('.');
+    if (!/^[a-f0-9]{64}$/.test(signature)) return null;
+    const key = await crypto.subtle.importKey('raw',new TextEncoder().encode(env.HOMIE_LOCAL_TEST_SECRET),{name:'HMAC',hash:'SHA-256'},false,['verify']);
+    if (!await crypto.subtle.verify('HMAC',key,Uint8Array.from(signature.match(/../g),h=>parseInt(h,16)),new TextEncoder().encode(data))) return null;
+    const session = JSON.parse(atob(data.replaceAll('-','+').replaceAll('_','/')));
+    return /^[a-z][a-z0-9-]*$/.test(session.app) && /^[a-z][a-z0-9-]*$/.test(session.role) && (!session.scope || /^[a-zA-Z0-9-]+$/.test(session.scope)) ? session : null;
+  } catch { return null; }
+}