@homie-rocks/studio 0.51.7 → 0.52.0

package/worker/app-records.mjs

@@ -103,11 +103,15 @@ export async function appRecordsRoute(request, env, meta, url, sub) {
       for(const r of rows) {
         const record={id:r.id,data:JSON.parse(r.value),version:r.version,updatedAt:r.updated_at};
         const link=linkConfig(env)?.slots?.find(l=>l.app===meta.id&&l.slots===collection&&l.slot===r.id);
+        if(Object.values(meta.records.collections).some(c=>c.booking?.slots===collection)) {
+          const count=await env.DB.prepare("SELECT COALESCE(SUM(quantity),0) n FROM shop_bookings WHERE app=?1 AND slots=?2 AND slot=?3 AND state IN ('held','confirmed')").bind(recordApp,collection,r.id).first();
+          record.booking={full:count.n>=record.data.capacity,available:Math.max(0,record.data.capacity-count.n),synced:true};
+        }
         if(link) {
           const saved=await env.DB.prepare('SELECT value FROM meta WHERE key=?1').bind(`shop-slot-link:${link.id}`).first();
           const observed=saved?JSON.parse(saved.value):null;
           const status=observed && observed.capacity===(link.limit??link.capacity) ? observed : link;
-          const count=await env.DB.prepare("SELECT COALESCE(SUM(quantity),0) n FROM shop_bookings WHERE app=?1 AND slots=?2 AND slot=?3 AND state='confirmed'").bind(recordApp,collection,r.id).first();
+          const count=await env.DB.prepare("SELECT COALESCE(SUM(quantity),0) n FROM shop_bookings WHERE app=?1 AND slots=?2 AND slot=?3 AND state IN ('held','confirmed')").bind(recordApp,collection,r.id).first();
           record.booking={full:!status.active||status.count>=(link.limit??link.capacity)||count.n>=link.capacity,available:status.active?Math.max(0,Math.min(link.capacity-count.n,(link.limit??link.capacity)-status.count)):0,synced:link.capacity===record.data.capacity};
         }
         records.push(record);

package/worker/app-shell.mjs

@@ -4,26 +4,70 @@ export const APP_SHELL_JS = String.raw`(function () {
   if (!boot || boot.kind !== 'app') return;
   var frame = document.querySelector('iframe.game') || document.querySelector('iframe');
   var params = new URLSearchParams(location.search);
-  var inflight = 0;
-  addEventListener('message', async function (e) {
-    var m = e.data;
-    if (frame && e.source === frame.contentWindow && m?.type === 'homie-app-ticket' && /^[a-f0-9]{32}$/.test(m.ticket)) { params.set('ticket', m.ticket); history.replaceState(null, '', location.pathname + '?' + params); return; }
-    if (!frame || e.source !== frame.contentWindow || !m || m.type !== 'homie-app' || !/^[a-f0-9]{32}$/.test(m.id || '')) return;
-    if (!/^[a-z][a-z0-9-]{0,39}$/.test(m.collection || '') || !['GET','POST','PUT','DELETE'].includes(m.method) || (m.record !== undefined && !/^[A-Za-z0-9_-]{1,64}$/.test(m.record))) return;
-    var result;
-    if (inflight >= 8) result = { ok: false, error: 'too many requests' };
-    else {
-      inflight++;
+  // Share short-lived reads across same-origin screens with the exact same role/access.
+  // No records are persisted. Writes always reach the Worker and invalidate all views.
+  var recent = new Map(), failures = new Map(), pending = new Map();
+  var channel; try { channel = new BroadcastChannel('homie-app-records-v1'); } catch (_) {}
+  function accept(m) { if (m?.invalidate) { recent.clear(); failures.clear(); } else if (m?.path && m?.entry) recent.set(m.path, m.entry); }
+  if (channel) channel.onmessage = function(e) { accept(e.data); };
+  function share(m) { accept(m); if (channel) channel.postMessage(m); }
+  function locked(run) { return typeof navigator !== 'undefined' && navigator.locks ? navigator.locks.request('homie-app-records-v1', run) : run(); }
+  async function request(path, m) {
+    var read = m.type!=='homie-app-tool' && m.method === 'GET';
+    if (read && pending.has(path)) return pending.get(path);
+    var job = locked(async function() {
+      var cached = recent.get(path);
+      if (read && cached && cached.until > Date.now()) return cached.result;
+      var result;
       try {
-        var q = new URLSearchParams();
-        ['role','surface','access'].forEach(function (k) { var v = params.get(k); if (v) q.set(k, v); });
-        if (boot.screen && !q.has('role')) q.set('surface', 'wall');
-        var path = (boot.site || '') + '/' + boot.game + '/api/app/records/' + m.collection + (m.record ? '/' + m.record : '') + '?' + q;
-        var res = await fetch(path, { method: m.method, headers: { 'content-type': 'application/json' }, body: m.method === 'GET' ? undefined : JSON.stringify({ data: m.data, version: m.version }) });
+        var res = await fetch(path, { method: m.type==='homie-app-tool'?'POST':m.method, headers: { 'content-type': 'application/json' }, body: m.type==='homie-app-tool'?JSON.stringify({name:m.name,input:m.input}):read ? undefined : JSON.stringify({ data: m.data, version: m.version }), signal: AbortSignal.timeout(8000) });
         result = await res.json();
-      } catch (err) { result = { ok: false, error: 'records unavailable; reconnect and retry' }; }
-      finally { inflight--; }
+        if (res.status === 429 || res.status >= 500) throw new Error('reconnect');
+        failures.delete(path);
+        if (read && result.ok) share({path: path, entry: {result: result, until: Date.now() + 1500}});
+        if (!read && result.ok) share({invalidate: true});
+      } catch (_) {
+        result = {ok: false, error: 'Reconnecting. Your saved updates will appear shortly.'};
+        if (read) { var count = (failures.get(path) || 0) + 1; failures.set(path, count); share({path: path, entry: {result: result, until: Date.now() + Math.min(30000, 1000 * Math.pow(2, count - 1))}}); }
+      }
+      return result;
+    });
+    if (read) { pending.set(path, job); job.finally(function() { pending.delete(path); }); }
+    return job;
+  }
+  var live, collections=new Set(), presence=0, clock=null;
+  function query() {
+    var q=new URLSearchParams();
+    ['role','surface','access','room'].forEach(function(k){var v=params.get(k);if(v)q.set(k,v);});
+    if(boot.screen&&!q.has('role'))q.set('surface','wall');
+    return q;
+  }
+  function context() {return {app:boot.game,origin:location.origin,url:location.origin+'/'+boot.game+'/open',presence:presence,now:clock};}
+  function sendContext(){frame?.contentWindow?.postMessage({type:'homie-app-context',context:context()},'*');}
+  function connect(){
+    live?.close();
+    var q=query();collections.forEach(function(c){q.append('collection',c);});
+    live=new EventSource((boot.site||'')+'/'+boot.game+'/api/app/live?'+q);
+    live.onmessage=function(e){var value=JSON.parse(e.data);if(presence!==value.presence){presence=value.presence;sendContext();}if(value.collections?.length){share({invalidate:true});Promise.allSettled([...pending.values()]).then(function(){share({invalidate:true});frame?.contentWindow?.postMessage({type:'homie-app-changed',collections:value.collections},'*');});}};
+  }
+  window.homieApp=Object.freeze({get context(){return context();},setTestClock:function(value){if(!boot.test)throw new Error('Local proof session required');if(value!==null&&!Number.isFinite(value))throw new Error('Invalid clock');clock=value;sendContext();}});
+  addEventListener('pagehide',function(){live?.close();});
+  addEventListener('message', async function (e) {
+    var m = e.data;
+    if(frame&&e.source===frame.contentWindow&&m?.type==='homie-app-context'){sendContext();return;}
+    if(frame&&e.source===frame.contentWindow&&m?.type==='homie-app-subscribe'){
+      if(!Array.isArray(m.collections)||m.collections.some(c=>!/^[a-z][a-z0-9-]{0,39}$/.test(c)))return;
+      m.collections.forEach(c=>collections.add(c));connect();return;
     }
+    if (frame && e.source === frame.contentWindow && m?.type === 'homie-app-ticket' && /^[a-f0-9]{32}$/.test(m.ticket)) { params.set('ticket', m.ticket); history.replaceState(null, '', location.pathname + '?' + params); return; }
+    if (!frame || e.source !== frame.contentWindow || !m || !['homie-app','homie-app-tool'].includes(m.type) || !/^[a-f0-9]{32}$/.test(m.id || '')) return;
+    if (m.type==='homie-app' && (!/^[a-z][a-z0-9-]{0,39}$/.test(m.collection || '') || !['GET','POST','PUT','DELETE'].includes(m.method) || (m.record !== undefined && !/^[A-Za-z0-9_-]{1,64}$/.test(m.record)))) return;
+    var q = new URLSearchParams();
+    ['role','surface','access'].forEach(function (k) { var v = params.get(k); if (v) q.set(k, v); });
+    if (boot.screen && !q.has('role')) q.set('surface', 'wall');
+    var path = (boot.site || '') + '/' + boot.game + '/api/app/records/' + m.collection + (m.record ? '/' + m.record : '') + '?' + q;
+    if(m.type==='homie-app-tool')path=(boot.site||'')+'/'+boot.game+'/api/app/tools?'+q;
+    var result = await request(path, m);
     e.source.postMessage({ type: 'homie-app-result', id: m.id, result: result }, '*');
   });
 })();`;

package/worker/app-streams.mjs

@@ -0,0 +1,57 @@
+import {appAccess} from './app-records.mjs';
+import {localSession} from './local-test.mjs';
+import {settingsOf,launchOf,accessOf} from './office.mjs';
+export const APP_LIVE_MIGRATION_FILE='0027_app_live.sql';
+export const APP_LIVE_MIGRATION=`
+CREATE TABLE app_record_revisions(app TEXT NOT NULL,collection TEXT NOT NULL,revision INTEGER NOT NULL,PRIMARY KEY(app,collection));
+${['INSERT','UPDATE','DELETE'].map(op=>{const row=op==='DELETE'?'OLD':'NEW';return `CREATE TRIGGER app_records_live_${op.toLowerCase()} AFTER ${op} ON app_records BEGIN
+ INSERT INTO app_record_revisions VALUES(${row}.app,${row}.collection,1) ON CONFLICT(app,collection) DO UPDATE SET revision=revision+1;
+END;`;}).join('\n')}
+`;
+const frame=value=>new TextEncoder().encode('data: '+JSON.stringify(value)+'\n\n');
+export const appHub=(env,app)=>env.LOBBY.get(env.LOBBY.idFromName('@app-records/'+app));
+export async function pushAppRecords(env,cat){
+ if(!env.LOBBY||!env.DB)return;
+ await Promise.all((cat.games??[]).filter(g=>g.kind==='app').map(meta=>appHub(env,meta.id).fetch('https://app/__app_records',{method:'POST',body:JSON.stringify({op:'wake',meta})}).catch(error=>console.error('App notification wake failed',error))));
+}
+/** Collection invalidations, never record bodies or identifiers. Reads recheck current authorization. */
+export class AppRecordStreams {
+ constructor(env,ctx){this.env=env;this.ctx=ctx;this.streams=new Set();}
+ dispose(){for(const s of [...this.streams])this.close(s);}
+ close(s){if(!this.streams.delete(s))return;clearInterval(s.timer);try{s.controller.close();}catch{}this.presence();}
+ count(s){return [...this.streams].filter(x=>x.app===s.app&&x.room===s.room).length;}
+ send(s,data){if(s.controller.desiredSize<=0){this.close(s);return;}try{s.controller.enqueue(frame(data));}catch{this.close(s);}}
+ presence(){for(const s of this.streams)this.send(s,{presence:this.count(s)});}
+ async authorized(s){
+  const access=await appAccess(s.request,this.env,s.meta,s.url);
+  if(!access.ok||s.collections.some(c=>!access.can.includes('read:'+c)))return false;
+  const launch=launchOf(s.meta,await settingsOf(this.env,{fresh:true}),this.env);
+  return launch==='public'||(await accessOf(s.request,this.env,s.meta.id,launch)).ok;
+ }
+ async revisions(s){return (await this.env.DB.prepare('SELECT collection,revision FROM app_record_revisions WHERE app=?1').bind(s.app).all()).results;}
+ async open({meta,url,headers,collections=[]}){
+  if(!Array.isArray(collections)||collections.some(c=>typeof c!=='string'||!Object.hasOwn(meta.records?.collections??{},c)))return new Response('unknown collection',{status:400});
+  const s={meta,url:new URL(url),request:new Request(url,{headers}),collections,seen:new Map()};
+  if(!await this.authorized(s))return new Response('role cannot read collections',{status:403});
+  const session=await localSession(s.request,this.env);
+  s.app=session?.app===meta.id&&session.scope?`${meta.id}:check:${session.scope}`:meta.id;
+  s.room=s.url.searchParams.get('room')??'main';
+  for(const row of await this.revisions(s))s.seen.set(row.collection,row.revision);
+  const body=new ReadableStream({start:controller=>{s.controller=controller;},cancel:()=>this.close(s)});
+  this.streams.add(s);this.send(s,{collections:s.collections,presence:this.count(s),reset:true});
+  for(const other of this.streams)if(other!==s)this.send(other,{presence:this.count(other)});
+  // Recovery after a missed wake; this is not the screen's refresh clock.
+  s.timer=setInterval(()=>this.ctx.waitUntil(this.pump(s)),15000);
+  return new Response(body,{headers:{'content-type':'text/event-stream','cache-control':'no-store'}});
+ }
+ async pump(s){
+  if(!this.streams.has(s))return;if(s.busy){s.dirty=true;return;}s.busy=true;
+  try{
+   if(!await this.authorized(s)){this.close(s);return;}
+   const changed=[];
+   for(const row of await this.revisions(s)){if(s.collections.includes(row.collection)&&s.seen.get(row.collection)!==row.revision)changed.push(row.collection);s.seen.set(row.collection,row.revision);}
+   this.send(s,{collections:changed,presence:this.count(s)});
+  }catch{this.close(s);}finally{s.busy=false;if(s.dirty){s.dirty=false;await this.pump(s);}}
+ }
+ async wake(meta){for(const s of this.streams)if(meta)s.meta=meta;await Promise.all([...this.streams].map(s=>this.pump(s)));return new Response('ok');}
+}

package/worker/app-tools.mjs

@@ -0,0 +1,44 @@
+import {CfWorkerJsonSchemaValidator} from '@modelcontextprotocol/server/validators/cf-worker';
+import {allowed,services} from './mcp-tools.mjs';
+import {appAccess} from './app-records.mjs';
+import {localSession} from './local-test.mjs';
+import {players} from './players.mjs';
+import {isOwner,sameOrigin} from './office.mjs';
+import {audit,callsPerMinute,rateLimit} from './mcp-store.mjs';
+const validator=new CfWorkerJsonSchemaValidator();
+export async function invokeAppTool(tool,input,context){
+ if(!validator.getValidator(tool.inputSchema)(input).valid)throw Object.assign(new Error('Input does not match the tool schema'),{status:400});
+ return tool.handler(input,context);
+}
+export async function appCaller(request,env,meta,url){
+ const access=await appAccess(request,env,meta,url);
+ if(!access.ok)throw Object.assign(new Error(access.error),{status:access.status});
+ const session=await localSession(request,env);
+ if(session?.app===meta.id)return {id:`local-test-${session.app}-${session.role}`,owner:session.role==='owner',client:null,localTest:true,roles:{[meta.id]:[session.role]},testApp:meta.id,testScope:session.scope};
+ const person=await players.of(request,env);
+ const owner=await isOwner(request,env);
+ const roles={};
+ if(person&&!person.guest){for(const row of (await env.DB.prepare('SELECT app,role FROM app_roles WHERE player=?1').bind(person.id).all()).results)(roles[row.app]??=[]).push(row.role);}
+ return {id:owner?(person?.id??'browser-owner'):person&&!person.guest?person.id:null,owner,client:null,roles};
+}
+/** Same-origin shell transport; body fields never supply an identity or a role. */
+export async function appToolsRoute(request,env,meta,url,cat,definitions){
+ const fail=(status,error)=>Response.json({ok:false,error},{status});
+ if(request.method!=='POST')return fail(405,'POST required');
+ if(!sameOrigin(request,url))return fail(403,'same origin required');
+ let caller,tool,outcome='error';
+ try{
+  caller=await appCaller(request,env,meta,url);
+  const reader=request.body?.getReader();let size=0,text='';const decoder=new TextDecoder();
+  if(reader)for(;;){const {done,value}=await reader.read();if(done)break;size+=value.byteLength;if(size>12288){await reader.cancel();return fail(413,'body too large');}text+=decoder.decode(value,{stream:true});}
+  const body=JSON.parse(text+decoder.decode());
+  tool=definitions.find(t=>t.name===body.name&&(!t.kind||t.kind==='tool'));
+  if(!tool||!await allowed(tool.audience,caller,env)){outcome='denied';return fail(403,'Permission denied or unknown tool');}
+  if(tool.price)return fail(402,'Use MCP to approve payment for this tool');
+  if(!await rateLimit(env,caller.id??`public:${request.headers.get('cf-connecting-ip')??'local'}`,callsPerMinute(cat)))return fail(429,'Rate limit reached');
+  const namespace=(tool.namespace??tool.name)+(caller.testScope?':check:'+caller.testScope:'');
+  const data=await invokeAppTool(tool,body.input??{},services(env,cat,url.origin,caller,namespace,tool));
+  outcome='ok';return Response.json({ok:true,data});
+ }catch(error){return fail(error.status??(error instanceof SyntaxError?400:500),error.status||error.name==='StudioOperationError'?error.message:'Tool request failed');}
+ finally{if(caller)await audit(env,caller,tool?.name??'unknown-tool',outcome);}
+}

package/worker/booking-holds.mjs

@@ -0,0 +1,87 @@
+import {BOOKINGS_MIGRATION} from './booking-store.mjs';
+import {linkConfig,hasStripeKey} from './shop-links.mjs';
+export const BOOKING_HOLDS_MIGRATION_FILE='0029_booking_holds.sql';
+export const BOOKING_HOLDS_MIGRATION=`
+ALTER TABLE shop_bookings ADD COLUMN paid_at INTEGER;
+ALTER TABLE shop_bookings ADD COLUMN actor TEXT;
+ALTER TABLE shop_bookings ADD COLUMN token_hash TEXT;
+ALTER TABLE shop_bookings ADD COLUMN hold_until INTEGER;
+DROP TRIGGER booking_capacity_move;
+CREATE TRIGGER booking_capacity_move BEFORE UPDATE OF slot,quantity,state ON shop_bookings
+WHEN NEW.state IN ('held','confirmed') BEGIN
+ SELECT RAISE(ABORT,'booking capacity unavailable') WHERE NOT EXISTS (
+ SELECT 1 FROM app_records s WHERE s.app=NEW.app AND s.collection=NEW.slots AND s.id=NEW.slot
+ AND json_type(s.value,'$.capacity')='integer' AND json_extract(s.value,'$.capacity') >= NEW.quantity +
+ (SELECT COALESCE(SUM(quantity),0) FROM shop_bookings WHERE app=NEW.app AND slots=NEW.slots AND slot=NEW.slot AND id!=NEW.id AND state IN ('held','confirmed')));
+END;
+CREATE TRIGGER booking_hold_claim BEFORE UPDATE OF order_id ON shop_bookings BEGIN
+ SELECT RAISE(ABORT,'booking hold changed or expired') WHERE NEW.order_id IS NULL OR OLD.order_id!='hold:'||OLD.id OR OLD.state NOT IN ('held','confirmed') OR (OLD.state='held' AND OLD.hold_until<=NEW.updated_at);
+END;
+DROP TRIGGER booking_order_state;
+CREATE TRIGGER booking_order_state AFTER UPDATE OF status,paid_at ON shop_orders
+WHEN NEW.status!=OLD.status OR (OLD.paid_at IS NULL AND NEW.paid_at IS NOT NULL) BEGIN
+ UPDATE shop_bookings SET state=CASE WHEN NEW.status='paid' THEN 'confirmed' ELSE 'released' END,
+ paid_at=COALESCE(NEW.paid_at,paid_at),version=version+1,updated_at=NEW.updated_at
+ WHERE order_id=NEW.id AND ((state IN ('pending','held','confirmed') AND NEW.status='paid')
+ OR (state IN ('pending','held') AND NEW.status IN ('expired','failed'))
+ OR (state IN ('pending','held','confirmed') AND NEW.status IN ('refunded','lost')));
+END;
+${['insert','update'].map(op=>{
+ const trigger=BOOKINGS_MIGRATION.match(new RegExp('CREATE TRIGGER booking_record_'+op+'[\\s\\S]*?END;'))[0];
+ return 'DROP TRIGGER booking_record_'+op+';\n'+trigger.replace("'state',NEW.state)","'state',NEW.state,'paid',json(CASE WHEN NEW.paid_at IS NULL THEN 'false' ELSE 'true' END))");
+}).join('\n')}
+UPDATE shop_bookings SET paid_at=(SELECT paid_at FROM shop_orders WHERE id=order_id),version=version+1 WHERE EXISTS(SELECT 1 FROM shop_orders WHERE id=order_id AND paid_at IS NOT NULL);
+`;
+const refusal=(message,status=400)=>Object.assign(new Error(message),{name:'StudioOperationError',status});
+const valid=v=>typeof v==='string'&&/^[A-Za-z0-9_-]{1,64}$/.test(v);
+const hash=async token=>Array.from(new Uint8Array(await crypto.subtle.digest('SHA-256',new TextEncoder().encode(token))),b=>b.toString(16).padStart(2,'0')).join('');
+export async function ownedHold(env,caller,{id,token}){
+ if(!valid(id))throw refusal('Invalid booking id');
+ const row=await env.DB.prepare('SELECT * FROM shop_bookings WHERE id=?1').bind(id).first();
+ if(!row||!(caller.owner||row.actor&&row.actor===caller.id||row.token_hash&&typeof token==='string'&&await hash(token)===row.token_hash))throw refusal('Booking owner required',403);
+ if(caller.testScope&&!row.app.endsWith(':check:'+caller.testScope))throw refusal('Booking owner required',403);
+ return row;
+}
+/** A hold is the very row checkout later confirms. Secrets never enter its public projection. */
+export function bookingHolds(env,caller,cat){
+ const result=r=>({id:r.id,slot:r.slot,quantity:r.quantity,state:r.state,version:r.version,expiresAt:r.hold_until,paid:r.paid_at!==null});
+ const change=async(args,state)=>{
+  const row=await ownedHold(env,caller,args);
+  if(row.order_id!=='hold:'+row.id)throw refusal('Checkout owns this booking; reconcile payment before release');
+  if(!Number.isSafeInteger(args.version)||args.version<1)throw refusal('Booking version required');
+  const changed=await env.DB.prepare(`UPDATE shop_bookings SET state=?2,version=version+1,updated_at=?3 WHERE id=?1 AND version=?4 AND state IN ('held','confirmed') AND (?2='released' OR hold_until>?3) RETURNING *`).bind(row.id,state,Date.now(),args.version).first();
+  if(!changed)throw refusal('Booking changed or expired; reload',409);return result(changed);
+ };
+ return Object.freeze({
+  async hold({app,collection,slot,quantity=1,id,token,expiresAt}){
+   const meta=cat.games.find(g=>g.id===app&&g.kind==='app'),spec=meta?.records?.collections?.[collection]?.booking;
+   if(!spec||!valid(id)||!valid(slot)||!Number.isSafeInteger(quantity)||quantity<1)throw refusal('Choose a declared slot, positive quantity and stable booking id');
+   if(!Number.isSafeInteger(expiresAt)||expiresAt<=Date.now())throw refusal('Hold needs a future expiry');
+   if(token!==undefined&&!(typeof token==='string'&&/^[a-f0-9]{32,128}$/.test(token)))throw refusal('Invalid private booking token');
+   if(!caller.id&&!token)throw refusal('Booking owner or private token required');
+   if(!hasStripeKey(env)&&linkConfig(env)?.slots?.some(l=>l.app===app&&l.slots===spec.slots&&l.slot===slot))throw refusal('Keyless Stripe inventory cannot share local holds; configure session checkout first');
+   const scope=caller.testScope?`${app}:check:${caller.testScope}`:app;
+   id=await hash(JSON.stringify([scope,collection,id]));
+   const secret=token?await hash(token):null;
+   try {await env.DB.prepare(`INSERT INTO shop_bookings(id,app,collection,slots,slot,quantity,order_id,state,updated_at,actor,token_hash,hold_until)
+    SELECT ?1,?2,?3,?4,?5,?6,'hold:'||?1,'held',?7,?8,?9,?10 WHERE NOT EXISTS(SELECT 1 FROM shop_bookings WHERE id=?1)`).bind(id,scope,collection,spec.slots,slot,quantity,Date.now(),caller.id??null,secret,expiresAt).run();}catch(error){if(/booking capacity unavailable/.test(error.message))throw refusal('That slot is full. No place has been taken.',409);throw error;}
+   const row=await ownedHold(env,caller,{id,token});
+   if(row.app!==scope||row.collection!==collection||row.slot!==slot||row.quantity!==quantity)throw refusal('Booking id reused with different request',409);
+   return result(row);
+  },
+  async get(args){return result(await ownedHold(env,caller,args));},
+  confirm:args=>change(args,'confirmed'),release:args=>change(args,'released'),
+  async releaseExpired({app,collection,now=Date.now()}){
+   if(!caller.owner)throw refusal('Owner or scheduled function required');
+   if(!Number.isSafeInteger(now))throw refusal('Invalid release time');
+   const scope=caller.testScope?`${app}:check:${caller.testScope}`:app;
+   const r=await env.DB.prepare("UPDATE shop_bookings SET state='released',version=version+1,updated_at=?3 WHERE app=?1 AND collection=?2 AND order_id='hold:'||id AND state='held' AND hold_until<=?3").bind(scope,collection,now).run();return {released:r.meta.changes};
+  }
+ });
+}
+/** Used in the same transaction as the order reservation. A second checkout cannot claim the hold. */
+export function claimHoldStatement(env,{hold,app,collection,slots,slot,quantity,order,now=Date.now()}){
+ return env.DB.prepare(`UPDATE shop_bookings SET order_id=CASE WHEN app=?4 AND collection=?5 AND slots=?6 AND slot=?7 AND quantity=?8 THEN ?2 ELSE NULL END,version=version+1,updated_at=?3
+ WHERE id=?1
+ AND EXISTS(SELECT 1 FROM shop_orders WHERE id=?2)`).bind(hold,order,now,app,collection,slots,slot,quantity);
+}

package/worker/build-id.mjs

@@ -1,2 +1,2 @@
 // Generated by lib/build-identity.mjs; identifies the bundled runtime sources.
-export const STUDIO_BUILD = Object.freeze({"version":"0.51.7","sha256":"1f82ad29d4066e96c2d8ed5c02c405f030ec270917c73b68543042cf53c5e6a7"});
+export const STUDIO_BUILD = Object.freeze({"version":"0.52.0","sha256":"f2d43374183c3a1d807c67754b0b9e868b18d5f6b137e0fd5f224fd6e5866e17"});

package/worker/business-events.mjs

@@ -0,0 +1,31 @@
+import {canonicalJson} from './canonical-json.mjs';
+export const BUSINESS_EVENTS_MIGRATION_FILE='0028_business_events.sql';
+export const BUSINESS_EVENTS_MIGRATION=`
+ALTER TABLE studio_events ADD COLUMN scope TEXT;
+CREATE TABLE event_publications(id TEXT PRIMARY KEY,digest TEXT NOT NULL);
+${['INSERT','UPDATE','DELETE'].map(op=>{const row=op==='DELETE'?'OLD':'NEW';return `
+DROP TRIGGER IF EXISTS app_records_function_${op.toLowerCase()};
+CREATE TRIGGER app_records_function_${op.toLowerCase()} AFTER ${op} ON app_records
+WHEN EXISTS (SELECT 1 FROM function_subscriptions WHERE type='record.changed') BEGIN
+ INSERT INTO studio_events(id,type,data,at) VALUES(lower(hex(randomblob(16))),'record.changed',
+ json_object('app',${row}.app,'collection',${row}.collection,'record',${row}.id,'version',${row}.version,'operation','${op.toLowerCase()}',
+ 'data',json(${row}.value),'previous',${op==='INSERT'?'NULL':'json(OLD.value)'}),${row}.updated_at);
+END;`;}).join('\n')}
+`;
+/** Durable idempotency survives feed retention/pruning; no sleep or read-back races. */
+export async function publishBusinessEvent(env,caller,definition,namespace,{feed,id,data}){
+ const declaration=JSON.parse(env.STUDIO_EVENT_FEEDS??'{}')[feed];
+ if(!definition.publish?.includes(feed)||!declaration?.schema)throw new Error('Business feed must be declared with a schema and publish capability');
+ if(typeof id!=='string'||!id.length||id.length>128)throw new Error('Event id must contain 1–128 characters');
+ const {CfWorkerJsonSchemaValidator}=await import('@modelcontextprotocol/server/validators/cf-worker');
+ if(!new CfWorkerJsonSchemaValidator().getValidator(declaration.schema)(data).valid)throw new Error('Event data does not match feed schema');
+ const text=canonicalJson(data);if(text.length>8192)throw new Error('Event exceeds 8192 characters');
+ const key=JSON.stringify([namespace,feed,id]),digest=Array.from(new Uint8Array(await crypto.subtle.digest('SHA-256',new TextEncoder().encode(declaration.event+'\n'+text))),b=>b.toString(16).padStart(2,'0')).join('');
+ await env.DB.batch([
+  env.DB.prepare('INSERT OR IGNORE INTO studio_events(id,type,data,at,scope) SELECT ?1,?2,?3,?4,?5 WHERE NOT EXISTS (SELECT 1 FROM event_publications WHERE id=?1)').bind(key,declaration.event,text,Date.now(),caller.testScope??null),
+  env.DB.prepare('INSERT OR IGNORE INTO event_publications(id,digest) VALUES(?1,?2)').bind(key,digest)
+ ]);
+ const saved=await env.DB.prepare('SELECT digest FROM event_publications WHERE id=?1').bind(key).first();
+ if(saved.digest!==digest)throw new Error('Event id already published with different data');
+ return {id:key};
+}

package/worker/connector-token.mjs

@@ -0,0 +1,11 @@
+import {oauthStorage} from './mcp-store.mjs';
+/** A hashed bearer, bound to this origin and exact tool names; re-read on every dispatch. */
+export async function tokenCaller(request,env) {
+ const token=/^Bearer (homie_owner_[a-f0-9]{64})$/.exec(request.headers.get('authorization')??'')?.[1];if(!token)return null;
+ const hash=await crypto.subtle.digest('SHA-256',new TextEncoder().encode(token));
+ const id=Array.from(new Uint8Array(hash),b=>b.toString(16).padStart(2,'0')).join('');
+ const row=await oauthStorage(env.DB).get('connector:'+id,'json');
+ if(!row||row.origin!==new URL(request.url).origin||row.expires<=Date.now()/1000)return null;
+ return {id:'connector:'+id,owner:true,client:'owner-connector',connection:'connector:'+id,tools:row.tools};
+}
+export function toolInScope(caller,name){return !caller.tools||caller.tools.includes(name);}

package/worker/event-resources.mjs

@@ -28,7 +28,7 @@ export async function readableFeed(env,cat,caller,name) {
 export async function feedEvents(env,name,{after=0,through=Number.MAX_SAFE_INTEGER,caller}={}) {
   const feed=eventFeeds(env)[name];if(!feed)return [];
   const scopedApp=env.HOMIE_LOCAL_TEST_SECRET&&caller?.localTest&&caller.testScope&&feed.event==='record.changed'?`${feed.app}:check:${caller.testScope}`:null;
-  const rows=(await env.DB.prepare("SELECT seq,id,type,data,at FROM studio_events WHERE type=?1 AND seq>?2 AND seq<=?3 AND (?4 IS NULL OR json_extract(data,'$.app')=?4) ORDER BY seq LIMIT 100").bind(feed.event,after,through,scopedApp).all()).results;
+  const rows=(await env.DB.prepare("SELECT seq,id,type,data,at FROM studio_events WHERE type=?1 AND seq>?2 AND seq<=?3 AND scope IS ?5 AND (?4 IS NULL OR json_extract(data,'$.app')=?4) ORDER BY seq LIMIT 100").bind(feed.event,after,through,scopedApp,feed.event==='record.changed'?null:caller?.testScope??null).all()).results;
   const events=rows.map(r=>({...r,data:JSON.parse(r.data)}));
   if(env.HOMIE_LOCAL_TEST_SECRET && caller?.localTest && caller.testScope && feed.event==='record.changed') {
     const app=`${feed.app}:check:${caller.testScope}`;

package/worker/functions.mjs

@@ -43,6 +43,10 @@ export async function pruneEvents(env) {
 /** A lease is for retry after a crashed Worker, not a deadline imposed on studio code. */
 export async function runFunctions(env, cat, origin, {definitions, now = Date.now, leaseMs = 60000, webhookOptions = {}} = {}) {
   if(!env.DB)return;
+  if(env.LOBBY){
+    if(typeof cat==='function')cat=await cat();
+    await (await import('./app-streams.mjs')).pushAppRecords(env,cat);
+  }
   definitions = await syncFunctions(env,definitions,now());
   if(!definitions.length&&!env.STUDIO_EVENT_FEEDS)return;
   if(typeof cat==='function')cat=await cat();
@@ -95,6 +99,7 @@ export async function runFunctions(env, cat, origin, {definitions, now = Date.no
       }
     }
   } while(more);
+  await (await import('./app-streams.mjs')).pushAppRecords(env,cat);
   await notifications;
   await notify();
   await pruneEvents(env);

package/worker/index.mjs

@@ -1,3 +1,6 @@
+import {appGraphicsFallback} from './app-graphics.mjs';
+import {JOIN_AREA_FRAME_JS} from './join-area.mjs';
+import {loadShopLinks} from './shop-links.mjs';
 import { directoryUrl } from './directory-choice.mjs';
 import {APP_STORAGE_JS} from './app-frame.mjs';
 import {recordsPage} from './records-page.mjs';
@@ -506,6 +509,7 @@ async function gameDocument(request, env, url, game, meta, cat, { agent = null }
   const params = paramsFrom(url.searchParams, meta);
   if (meta.kind === 'app' && !params.role) params.role = appRole(meta, url);
   const cfg = {
+    ...(meta.kind === 'app' ? {kind: 'app'} : {}),
     v: 1,
     url: `${wsBase}/${game}/__net?room=${encodeURIComponent(room)}${b ? `&b=${b}` : ''}${t ? `&t=${encodeURIComponent(t)}` : ''}${watching ? '&w=1' : ''}${ver ? `&gv=${encodeURIComponent(ver)}` : ''}`,
     room,
@@ -534,8 +538,8 @@ async function gameDocument(request, env, url, game, meta, cat, { agent = null }
     ...(!agent && !watching && await availableShellShop(env, cat, game) ? { shop: true } : {}),
   };
   let html = await res.text();
-  const fallback = meta?.kind === 'app' ? `<script>addEventListener('DOMContentLoaded',function(){if(!document.querySelector('canvas')||document.querySelector('[data-webgl-fallback]'))return;try{var c=document.createElement('canvas');if(c.getContext('webgl2'))return;}catch(e){}var p=document.createElement('p');p.dataset.webglFallback='';p.setAttribute('role','status');p.textContent=${JSON.stringify(meta.words?.fallback ?? 'This device cannot display the 3D scene. Try a browser with WebGL enabled; use any available controls below.').replace(/</g, '\u003c')};p.style.cssText='position:fixed;z-index:2147483647;left:16px;right:16px;bottom:16px;padding:12px;background:#fff;color:#222;font:16px system-ui;border-radius:12px';document.body.append(p);});</script>` : '';
-  const head = (meta.kind==='app'?`<script>${APP_STORAGE_JS}</script>`:'') + fallback + `${embedded ? `<script>${EMBED_GAME_JS}</script>` : ''}<script>window.HOMIE_NET=${JSON.stringify(cfg).replace(/</g, '\\u003c')}</script>`;
+  const fallback = meta?.kind === 'app' ? `<script>addEventListener('DOMContentLoaded',()=>(${appGraphicsFallback.toString()})(${JSON.stringify(meta.words?.fallback ?? 'This device cannot display the 3D scene. Use the text controls to continue.').replace(/</g, '\\u003c')}));</script>` : '';
+  const head = `<script>${JOIN_AREA_FRAME_JS}</script>` + (meta.kind==='app'?`<script>${APP_STORAGE_JS}</script>`:'') + fallback + `${embedded ? `<script>${EMBED_GAME_JS}</script>` : ''}<script>window.HOMIE_NET=${JSON.stringify(cfg).replace(/</g, '\\u003c')}</script>`;
   html = /<head[^>]*>/i.test(html) ? html.replace(/<head([^>]*)>/i, `<head$1>${head}`) : head + html;
   return new Response(html, {
     headers: {
@@ -618,6 +622,7 @@ async function removeReferralLeftovers(env) {
 
 export default {
   async scheduled(event, env, ctx) {
+    env=await loadShopLinks(env);
     const maintenance=(async () => {
       await removeReferralLeftovers(env);
       const cat = await catalogue(env, 'https://studio.invalid');
@@ -629,6 +634,7 @@ export default {
     await maintenance;
   },
   async fetch(request, env, ctx) {
+    env=await loadShopLinks(env,new URL(request.url).origin);
     await removeReferralLeftovers(env);
     const url = new URL(request.url);
     await (await import('./functions.mjs')).syncFunctions(env);
@@ -944,6 +950,12 @@ async function route(request, env, ctx) {
     const max = seatsFor(meta, settings);
     if (meta.kind === 'app') {
       if (launch !== 'public' && !(await accessOf(request, env, game, launch)).ok) return json({ ok: false, error: 'not-found' }, 404);
+      if(sub==='api/app/live') {
+        if(request.method!=='GET')return new Response('GET required',{status:405});
+        const {appHub}=await import('./app-streams.mjs');
+        return appHub(env,meta.id).fetch('https://app/__app_records',{method:'POST',body:JSON.stringify({op:'open',meta,url:request.url,headers:Object.fromEntries(request.headers),collections:url.searchParams.getAll('collection')})});
+      }
+      if(sub==='api/app/tools')return (await import('./app-tools.mjs')).appToolsRoute(request,env,meta,url,cat,await studioTools());
       const api = await appRecordsRoute(request, env, meta, url, sub);
       if (api) return api;
       if (['play', 'tv', 'watch'].includes(sub)) {
@@ -953,7 +965,7 @@ async function route(request, env, ctx) {
           if (a.status === 401) return Response.redirect(`${url.origin}/account/?next=${encodeURIComponent(url.pathname + url.search)}`, 302);
           return json({ ok: false, error: a.error }, a.status);
         }
-        if(!meta.room)return recordsPage(meta,url,cat,await availableShellShop(env,cat,game));
+        if(!meta.room)return recordsPage(meta,url,cat,await availableShellShop(env,cat,game),Boolean(await (await import('./local-test.mjs')).localSession(request,env)));
       }
     }
     const lobby = () => env.LOBBY.get(env.LOBBY.idFromName(game));
@@ -1098,11 +1110,11 @@ async function route(request, env, ctx) {
         const sh = await availableShellShop(env, cat, game, { kids: pol.kids });
         let shopQr = null;
         if (sh && !local) try { shopQr = qrSvg(`${url.origin}/shop/?game=${encodeURIComponent(game)}`, { title: `Shop: ${meta.name ?? game}` }); } catch { shopQr = null; }
-        return playPage(cat, meta, { origin: url.origin, screen: true, joinUrl, qr, local, room, ticket, owner: d.owner, launch, server, shop: sh ? { ...sh, qr: shopQr, url: `${url.origin}/shop/?game=${game}` } : null });
+        return playPage(cat, meta, { test: Boolean(await (await import('./local-test.mjs')).localSession(request,env)), origin: url.origin, screen: true, joinUrl, qr, local, room, ticket, owner: d.owner, launch, server, shop: sh ? { ...sh, qr: shopQr, url: `${url.origin}/shop/?game=${game}` } : null });
       }
       await countVisit(request, env, ctx, game, 'play');
       shareDaily(cat, url, ctx);
-      const page=playPage(cat, meta, { origin: url.origin, embed, preview: env.HOMIE_EMBED_PREVIEW === '1', ticket: embed ? null : ticket, owner: !embed && d.owner, launch, server, ...(embed ? {} : await chatWho(env, game, srv, d.acct)), shop: await availableShellShop(env, cat, game, { kids: pol.kids }) });
+      const page=playPage(cat, meta, { test: Boolean(await (await import('./local-test.mjs')).localSession(request,env)), origin: url.origin, embed, preview: env.HOMIE_EMBED_PREVIEW === '1', ticket: embed ? null : ticket, owner: !embed && d.owner, launch, server, ...(embed ? {} : await chatWho(env, game, srv, d.acct)), shop: await availableShellShop(env, cat, game, { kids: pol.kids }) });
       for(const cookie of recordsGuest?.cookies??[])page.headers.append('set-cookie',cookie);return page;
     }
     if (sub === 'watch') {
@@ -1120,7 +1132,7 @@ async function route(request, env, ctx) {
       const ticket = d.holder ? await ticketFor(env, game, d.holder) : null;
       await countVisit(request, env, ctx, game, 'watch');
       shareDaily(cat, url, ctx);
-      return watchPage(cat, meta, { origin: url.origin, room: asked, ticket, policy, owner: d.owner, ...(await chatWho(env, game, srv, d.acct)) });
+      return watchPage(cat, meta, { test: Boolean(await (await import('./local-test.mjs')).localSession(request,env)), origin: url.origin, room: asked, ticket, policy, owner: d.owner, ...(await chatWho(env, game, srv, d.acct)) });
     }
     if (sub === 'api/watch') {
       if (!door.ok || watchOf(meta) === 'off') return json({ ok: false, error: 'not-found' }, 404);
@@ -2601,6 +2613,12 @@ export class Lobby {
 
   /** A request that throws is said with what it was (never its body) and answered as a failure, not left uncaught. */
   async fetch(request) {
+    if(new URL(request.url).pathname==='/__app_records') {
+      const {AppRecordStreams}=await import('./app-streams.mjs');
+      this.appStreams??=new AppRecordStreams(this.env,this.ctx);
+      const input=await request.json();
+      return input.op==='open'?this.appStreams.open(input):this.appStreams.wake(input.meta);
+    }
     if(new URL(request.url).pathname==='/__studio_events') {
       const {EventStreams}=await import('./event-resources.mjs');
       this.eventStreams??=new EventStreams(this.env,this.ctx);

package/worker/join-area.mjs

@@ -0,0 +1,35 @@
+/** The shell owns these measurements; sandboxed views receive only geometry. */
+export function joinAreaShell() {
+ const frame=document.querySelector('iframe.game');
+ const update=()=>{
+  const card=document.querySelector('[data-join]');
+  const r=card?.getBoundingClientRect();
+  const visible=!!(r?.width&&r.height&&getComputedStyle(card).visibility!=='hidden'&&getComputedStyle(card).display!=='none');
+  const corner=card?.className??'';
+  const box=visible?{x:r.x,y:r.y,width:r.width,height:r.height,top:corner.includes('top')?r.bottom:0,bottom:corner.includes('top')?0:innerHeight-r.top,left:corner.includes('left')?r.right:0,right:corner.includes('left')?0:innerWidth-r.left}:{};
+  document.body.classList.toggle('homie-join-visible',visible);
+  for(const k of ['top','bottom','left','right'])document.documentElement.style.setProperty('--homie-join-inset-'+k,(box[k]??0)+'px');
+  for(const k of ['x','y','width','height'])document.documentElement.style.setProperty('--homie-join-'+k,(box[k]??0)+'px');
+  frame?.contentWindow?.postMessage({type:'homie-join-area',visible,box},'*');
+ };
+ new ResizeObserver(update).observe(document.body);
+ const card=document.querySelector('[data-join]');if(card)new ResizeObserver(update).observe(card);
+ new MutationObserver(update).observe(document.body,{childList:true,subtree:true,attributes:true,attributeFilter:['hidden','class']});
+ frame?.addEventListener('load',update);addEventListener('resize',update);
+ addEventListener('message',e=>{if(e.source===frame?.contentWindow&&e.data?.type==='homie-join-ready')update();});
+ update();
+}
+export function joinAreaFrame() {
+ addEventListener('message',e=>{
+  if(e.source!==parent||e.data?.type!=='homie-join-area')return;
+  const {box,visible}=e.data;
+  document.body?.classList.toggle('homie-join-visible',!!visible);
+  for(const k of ['top','bottom','left','right','x','y','width','height']) {
+   const v=box?.[k];if(v!==undefined&&(!Number.isFinite(v)||v<0))return;
+   document.documentElement.style.setProperty('--homie-join-'+(['top','bottom','left','right'].includes(k)?'inset-':'')+k,(v??0)+'px');
+  }
+ });
+ addEventListener('DOMContentLoaded',()=>parent.postMessage({type:'homie-join-ready'},'*'));
+}
+export const JOIN_AREA_SHELL_JS=`(${joinAreaShell.toString()})();`;
+export const JOIN_AREA_FRAME_JS=`(${joinAreaFrame.toString()})();`;

package/worker/mcp-events.mjs

@@ -39,9 +39,9 @@ export async function pollEvents(env,cat,caller,params,now=Date.now()){
   // Filter before limiting: unrelated collections must not create a false hasMore
   // or force the client through pages containing no matching occurrences.
   const rows=(await env.DB.prepare(`SELECT seq,id,type,data,at FROM studio_events
-    WHERE type=?1 AND seq>?2 AND seq<=?3
+    WHERE type=?1 AND seq>?2 AND seq<=?3 AND scope IS ?7
       AND (?4 IS NULL OR (json_extract(data,'$.app')=?4 AND json_extract(data,'$.collection')=?5))
-    ORDER BY seq LIMIT ?6`).bind(feed.event,start.after,start.through,feed.event==='record.changed'?(env.HOMIE_LOCAL_TEST_SECRET&&caller.localTest&&caller.testScope?`${feed.app}:check:${caller.testScope}`:feed.app):null,feed.collection??null,max+1).all()).results;
+    ORDER BY seq LIMIT ?6`).bind(feed.event,start.after,start.through,feed.event==='record.changed'?(env.HOMIE_LOCAL_TEST_SECRET&&caller.localTest&&caller.testScope?`${feed.app}:check:${caller.testScope}`:feed.app):null,feed.collection??null,max+1,feed.event==='record.changed'?null:caller.testScope??null).all()).results;
   const hasMore=rows.length>max,page=rows.slice(0,max);
   const events=page.map(row=>{const data=JSON.parse(row.data);if(env.HOMIE_LOCAL_TEST_SECRET&&caller.localTest&&caller.testScope&&feed.event==='record.changed')data.app=feed.app;return occurrence(params.name,{...row,data},cursorOf(params.name,row.seq));});
   const after=hasMore?page.at(-1).seq:start.through;

package/worker/mcp-tools.mjs

@@ -1,3 +1,4 @@
+import {bookingHolds} from './booking-holds.mjs';
 import {toolDatabase} from './tool-database.mjs';
 import { selling } from './extensions.mjs';
 import { withToolIdentity } from './tool-identity.mjs';
@@ -66,6 +67,8 @@ export function services(env, cat, origin, caller, namespace, definition = {}) {
   const key = v=>{if(typeof v!=='string'||v.length>128||!v.length)throw new Error('invalid key');return v;};
   return Object.freeze({
     caller:Object.freeze({...caller,roles:Object.freeze(Object.fromEntries(Object.entries(caller.roles??{}).map(([app,roles])=>[app,Object.freeze([...roles])])) )}), records, office,
+    bookings:bookingHolds(env,caller,cat),
+    events:Object.freeze({publish:args=>import('./business-events.mjs').then(m=>m.publishBusinessEvent(env,caller,definition,namespace,args))}),
     rooms:Object.freeze({send:args=>import('./tool-events.mjs').then(m=>m.sendToolEvent(env,caller,definition,args))}),
     shop:()=>office('/_studio/api/shop'),
     database:toolDatabase(env.DB,namespace),