@homie-rocks/studio 0.53.0 → 0.54.0

package/worker/app-streams.mjs

@@ -1,3 +1,4 @@
+import {databaseBinding} from './request-db.mjs';
 import {appAccess} from './app-records.mjs';
 import {localSession} from './local-test.mjs';
 import {settingsOf,launchOf,accessOf} from './office.mjs';
@@ -10,15 +11,28 @@ END;`;}).join('\n')}
 `;
 const frame=value=>new TextEncoder().encode('data: '+JSON.stringify(value)+'\n\n');
 export const appHub=(env,app)=>env.LOBBY.get(env.LOBBY.idFromName('@app-records/'+app));
+const pushedRevisions=new WeakMap();
 export async function pushAppRecords(env,cat){
- if(!env.LOBBY||!env.DB)return;
- await Promise.all((cat.games??[]).filter(g=>g.kind==='app').map(meta=>appHub(env,meta.id).fetch('https://app/__app_records',{method:'POST',body:JSON.stringify({op:'wake',meta})}).catch(error=>console.error('App notification wake failed',error))));
+ const apps=(cat.games??[]).filter(g=>g.kind==='app');
+ if(!env.LOBBY||!env.DB||!apps.length)return;
+ const rows=(await env.DB.prepare(`SELECT app,collection,revision FROM app_record_revisions
+ UNION ALL SELECT a.app,'*',SUM(COALESCE(r.revision,0)) FROM app_tool_namespaces a LEFT JOIN tool_data_revisions r ON r.namespace=a.namespace GROUP BY a.app`).all()).results;
+ const signatures=new Map();for(const row of rows){const app=row.app.split(':check:')[0];signatures.set(app,(signatures.get(app)??'')+JSON.stringify(row));}
+ const binding=databaseBinding(env.DB),previous=pushedRevisions.get(binding)??new Map();
+ for(const meta of apps){
+  const signature=signatures.get(meta.id)??'';
+  if((previous.get(meta.id)??'')===signature)continue;
+  const response=await appHub(env,meta.id).fetch('https://app/__app_records',{method:'POST',body:JSON.stringify({op:'wake',meta})});
+  if(!response.ok)throw new Error('App notification wake failed');
+  previous.set(meta.id,signature);
+ }
+ pushedRevisions.set(binding,previous);
 }
 /** Collection invalidations, never record bodies or identifiers. Reads recheck current authorization. */
 export class AppRecordStreams {
  constructor(env,ctx){this.env=env;this.ctx=ctx;this.streams=new Set();}
  dispose(){for(const s of [...this.streams])this.close(s);}
- close(s){if(!this.streams.delete(s))return;clearInterval(s.timer);try{s.controller.close();}catch{}this.presence();}
+ close(s){if(!this.streams.delete(s))return;clearInterval(s.timer);clearTimeout(s.reconnect);try{s.controller.close();}catch{}this.presence();}
  count(s){return [...this.streams].filter(x=>x.app===s.app&&x.room===s.room).length;}
  send(s,data){if(s.controller.desiredSize<=0){this.close(s);return;}try{s.controller.enqueue(frame(data));}catch{this.close(s);}}
  presence(){for(const s of this.streams)this.send(s,{presence:this.count(s)});}
@@ -28,7 +42,7 @@ export class AppRecordStreams {
   const launch=launchOf(s.meta,await settingsOf(this.env,{fresh:true}),this.env);
   return launch==='public'||(await accessOf(s.request,this.env,s.meta.id,launch)).ok;
  }
- async revisions(s){return (await this.env.DB.prepare('SELECT collection,revision FROM app_record_revisions WHERE app=?1').bind(s.app).all()).results;}
+ async revisions(s){return (await this.env.DB.prepare("SELECT collection,revision FROM app_record_revisions WHERE app=?1 UNION ALL SELECT '*',COALESCE(SUM(r.revision),0) FROM app_tool_namespaces a JOIN tool_data_revisions r ON r.namespace=a.namespace WHERE a.app=?1").bind(s.app).all()).results;}
  async open({meta,url,headers,collections=[]}){
   if(!Array.isArray(collections)||collections.some(c=>typeof c!=='string'||!Object.hasOwn(meta.records?.collections??{},c)))return new Response('unknown collection',{status:400});
   const s={meta,url:new URL(url),request:new Request(url,{headers}),collections,seen:new Map()};
@@ -40,17 +54,20 @@ export class AppRecordStreams {
   const body=new ReadableStream({start:controller=>{s.controller=controller;},cancel:()=>this.close(s)});
   this.streams.add(s);this.send(s,{collections:s.collections,presence:this.count(s),reset:true});
   for(const other of this.streams)if(other!==s)this.send(other,{presence:this.count(other)});
+  // A fresh HTTP response renews the role cookie; SSE frames cannot set cookies.
+  s.reconnect=setTimeout(()=>this.close(s),240000);
   // Recovery after a missed wake; this is not the screen's refresh clock.
-  s.timer=setInterval(()=>this.ctx.waitUntil(this.pump(s)),15000);
+  s.timer=setInterval(()=>this.ctx.waitUntil(this.pump(s,true)),15000);
   return new Response(body,{headers:{'content-type':'text/event-stream','cache-control':'no-store'}});
  }
- async pump(s){
+ async pump(s,recheck=false){
   if(!this.streams.has(s))return;if(s.busy){s.dirty=true;return;}s.busy=true;
   try{
+   const changed=new Set();
+   for(const row of await this.revisions(s)){if(s.seen.get(row.collection)!==row.revision){if(row.collection==='*')for(const c of s.collections)changed.add(c);else if(s.collections.includes(row.collection))changed.add(row.collection);}s.seen.set(row.collection,row.revision);}
+   if(!changed.size&&!recheck)return;
    if(!await this.authorized(s)){this.close(s);return;}
-   const changed=[];
-   for(const row of await this.revisions(s)){if(s.collections.includes(row.collection)&&s.seen.get(row.collection)!==row.revision)changed.push(row.collection);s.seen.set(row.collection,row.revision);}
-   this.send(s,{collections:changed,presence:this.count(s)});
+   this.send(s,{collections:[...changed],presence:this.count(s)});
   }catch{this.close(s);}finally{s.busy=false;if(s.dirty){s.dirty=false;await this.pump(s);}}
  }
  async wake(meta){for(const s of this.streams)if(meta)s.meta=meta;await Promise.all([...this.streams].map(s=>this.pump(s)));return new Response('ok');}

package/worker/app-tools.mjs

@@ -37,6 +37,7 @@ export async function appToolsRoute(request,env,meta,url,cat,definitions){
   if(tool.price)return fail(402,'Use MCP to approve payment for this tool');
   if(!await rateLimit(env,caller.id??`public:${request.headers.get('cf-connecting-ip')??'local'}`,callsPerMinute(cat)))return fail(429,'Rate limit reached');
   const namespace=(tool.namespace??tool.name)+(caller.testScope?':check:'+caller.testScope:'');
+  await env.DB.prepare('INSERT OR IGNORE INTO app_tool_namespaces(app,namespace) VALUES(?1,?2)').bind(meta.id+(caller.testScope?':check:'+caller.testScope:''),namespace).run();
   const data=await invokeAppTool(tool,body.input??{},services(env,cat,url.origin,caller,namespace,tool));
   outcome='ok';return Response.json({ok:true,data});
  }catch(error){return fail(error.status??(error instanceof SyntaxError?400:500),error.status||error.name==='StudioOperationError'?error.message:'Tool request failed');}

package/worker/build-id.mjs

@@ -1,2 +1,2 @@
 // Generated by lib/build-identity.mjs; identifies the bundled runtime sources.
-export const STUDIO_BUILD = Object.freeze({"version":"0.53.0","sha256":"c43b8fcfbd61ff241c86555b2806cd599baf71513376d3958c379b04697dd923"});
+export const STUDIO_BUILD = Object.freeze({"version":"0.54.0","sha256":"4f65918ccb0f52120d8d0fa6cf761f2243b4636fdf10ccef395479318d603370"});

package/worker/chat-store.mjs

@@ -1,3 +1,4 @@
+import {databaseBinding, ORIGINAL_DB} from './request-db.mjs';
 /**
  * ROOM CHAT IN THE STUDIO'S OWN D1 (@homie-rocks/studio 0.23.0, NETPLAY.md section 19): the owner's chat rules per game
  * and per server, and the reports players make. Never the chat itself: what people say lives a few minutes in the
@@ -51,8 +52,8 @@ const cache = new WeakMap();
 /** Every chat rule row (D1), read at most every 5 s per Worker instance; empty before migration 0007. */
 export async function chatRowsOf(env, { fresh = false } = {}) {
   if (!env?.DB || env.HOMIE_PREVIEW === '1') return new Map();
-  const hit = cache.get(env.DB);
-  if (!fresh && hit && Date.now() - hit.at < 5000) return hit.map;
+  const hit = cache.get(databaseBinding(env.DB));
+  if (!env.DB[ORIGINAL_DB] && !fresh && hit && Date.now() - hit.at < 5000) return hit.map;
   let map = new Map();
   try {
     const { results } = await env.DB.prepare('SELECT game, server, rules, updated_at FROM chat_rules LIMIT 1000').all();
@@ -62,10 +63,10 @@ export async function chatRowsOf(env, { fresh = false } = {}) {
       if (rules && typeof rules === 'object') map.set(`${r.game}/${r.server ?? ''}`, { ...rules, at: Number(r.updated_at) || 0 });
     }
   } catch { map = new Map(); }
-  cache.set(env.DB, { at: Date.now(), map });
+  cache.set(databaseBinding(env.DB), { at: Date.now(), map });
   return map;
 }
-export const forgetChat = (env) => { if (env?.DB) cache.delete(env.DB); };
+export const forgetChat = (env) => { if (env?.DB) cache.delete(databaseBinding(env.DB)); };
 
 /**
  * A room's chat rules: the game's game.json "chat", the owner's rules for the game, then for this server (a server's

package/worker/event-resources.mjs

@@ -1,3 +1,4 @@
+import {databaseBinding} from './request-db.mjs';
 import {McpEventStreams} from './mcp-event-streams.mjs';
 import {listEvents} from './mcp-events.mjs';
 import {notification,sseFrame} from './mcp-events-wire.mjs';
@@ -141,13 +142,16 @@ export class EventStreams {
   }
 }
 
+const toolCatalogues=new WeakMap();
 /** Refresh active streams whenever this Worker observes a new tool catalogue. */
 export async function pushToolList(env,cat,tools,origin) {
   if(!env.LOBBY)return;
   const publicShape=tools.map(({name,description,inputSchema,audience,kind})=>({name,description,inputSchema,audience,kind}));
   const signature=JSON.stringify([publicShape,eventFeeds(env)]);
+  const binding=databaseBinding(env.DB);
+  if(toolCatalogues.get(binding)===signature)return;
   const previous=await env.DB.prepare("SELECT value FROM mcp_kv WHERE key='tools-catalogue'").first();
-  if(previous?.value===signature)return;
+  if(previous?.value===signature){toolCatalogues.set(binding,signature);return;}
   await env.DB.prepare("INSERT INTO mcp_kv(key,value) VALUES('tools-catalogue',?1) ON CONFLICT(key) DO UPDATE SET value=excluded.value").bind(signature).run();
   let after='';
   for(;;){
@@ -155,4 +159,5 @@ export async function pushToolList(env,cat,tools,origin) {
     for(const row of rows){const connection=JSON.parse(row.value).connection;await eventHub(env,connection).fetch('https://events/__studio_events',{method:'POST',body:JSON.stringify({op:'tools',connection,cat,tools:publicShape,origin})});}
     if(rows.length<100)break;after=rows.at(-1).key;
   }
+  toolCatalogues.set(binding,signature);
 }

package/worker/index.mjs

@@ -1,3 +1,4 @@
+import {trackBackground,requestDatabase,databaseBinding,MUTATIONS} from './request-db.mjs';
 import {appGraphicsFallback} from './app-graphics.mjs';
 import {JOIN_AREA_FRAME_JS} from './join-area.mjs';
 import {loadShopLinks} from './shop-links.mjs';
@@ -123,7 +124,7 @@ import { cookieValues, count, countVisit, counter, isQa, onlyOf, ownerAllowed, p
 import { ownerRoutes } from './stats-page.mjs';
 import { playerRoutes, players as playerAccounts } from './players.mjs';
 import {
-  appAssetTicket, accessOf, accountSub, gatePage, holders, isOwner, joinHolders, launchOf, regateArgs, officeRoutes, publicCatalogue, redeemInvite, sameOrigin, seatsFor, settingsOf, ticketAllows,
+  appRoleSession, appAssetTicket, accessOf, accountSub, gatePage, holders, isOwner, joinHolders, launchOf, regateArgs, officeRoutes, publicCatalogue, redeemInvite, sameOrigin, seatsFor, settingsOf, ticketAllows,
   ticketFor, ticketSub, usePlayers, verifyControl,
 } from './office.mjs';
 
@@ -168,13 +169,15 @@ const json = (body, status = 200, extra = {}) => new Response(`${JSON.stringify(
 const catalogueCache = new WeakMap();
 async function catalogue(env, origin) {
   try {
+    const cached=catalogueCache.get(env.ASSETS);
+    if(cached?.origin===origin && env.HOMIE_PREVIEW!=='1' && env.HOMIE_DEV!=='1')return cached.value;
     const res = await env.ASSETS.fetch(new Request(`${origin}/games.json`));
     if (!res.ok) return { studio: { name: env.STUDIO_NAME || 'Studio' }, games: [] };
     const tag = res.headers.get('etag');
     const hit = catalogueCache.get(env.ASSETS);
     if (tag && hit?.tag === tag && hit.origin === origin) { await res.body?.cancel(); return hit.value; }
     const value = await res.json();
-    if (tag) catalogueCache.set(env.ASSETS, { tag, origin, value });
+    catalogueCache.set(env.ASSETS, { tag, origin, value });
     return value;
   } catch { return { studio: { name: env.STUDIO_NAME || 'Studio' }, games: [] }; }
 }
@@ -539,7 +542,13 @@ async function gameDocument(request, env, url, game, meta, cat, { agent = null }
   };
   let html = await res.text();
   const fallback = meta?.kind === 'app' ? `<script>addEventListener('DOMContentLoaded',()=>(${appGraphicsFallback.toString()})(${JSON.stringify(meta.words?.fallback ?? 'This device cannot display the 3D scene. Use the text controls to continue.').replace(/</g, '\\u003c')}));</script>` : '';
-  const assetBase = meta.kind === 'app' && !url.pathname.includes('/__assets/') && launchOf(meta, await settingsOf(env, {fresh:true}), env) !== 'public' ? `<base href="/${game}/__assets/${await appAssetTicket(env,game)}/">` : '';
+  let assetBase='';
+  const assetLaunch=meta.kind==='app'?launchOf(meta,await settingsOf(env,{fresh:true}),env):'public';
+  if(meta.kind==='app'&&!url.pathname.includes('/__assets/')&&assetLaunch!=='public') {
+    const ticket=await appAssetTicket(env,game,undefined,{request,meta,launch:assetLaunch});
+    if(!ticket)return new Response('Sign in again to load this private app.',{status:403,headers:{'cache-control':'no-store'}});
+    assetBase=`<base href="/${game}/__assets/${ticket}/">`;
+  }
   const head = assetBase + `<script>${JOIN_AREA_FRAME_JS}</script>` + (meta.kind==='app'?`<script>${APP_STORAGE_JS}</script>`:'') + fallback + `${embedded ? `<script>${EMBED_GAME_JS}</script>` : ''}<script>window.HOMIE_NET=${JSON.stringify(cfg).replace(/</g, '\\u003c')}</script>`;
   html = /<head[^>]*>/i.test(html) ? html.replace(/<head([^>]*)>/i, `<head$1>${head}`) : head + html;
   return new Response(html, {
@@ -616,16 +625,10 @@ function finish(res, path) {
   return new Response(res.body, { status: res.status, statusText: res.statusText, headers });
 }
 
-// Repeat after migration: an older isolate may recreate these during a rolling deploy.
-async function removeReferralLeftovers(env) {
-  if(env.DB)await env.DB.prepare("DELETE FROM meta WHERE key GLOB 'referral_*' OR key GLOB 'referral-*'").run();
-}
-
 export default {
   async scheduled(event, env, ctx) {
     env=await loadShopLinks(env);
     const maintenance=(async () => {
-      await removeReferralLeftovers(env);
       const cat = await catalogue(env, 'https://studio.invalid');
       await notifyTools(env,cat,cat.studio?.url??'https://studio.invalid').catch(error=>console.warn('Tool catalogue refresh:',error.message));
       await reconcileOrders(env, shopOf(cat));
@@ -635,20 +638,19 @@ export default {
     await maintenance;
   },
   async fetch(request, env, ctx) {
+    const staticPath=new URL(request.url).pathname;
+    if(['GET','HEAD'].includes(request.method)&&staticPath==='/_homie/site.js')return finish(await route(request,env,ctx),staticPath);
     env=await loadShopLinks(env,new URL(request.url).origin);
-    await removeReferralLeftovers(env);
+    env={...env,DB:requestDatabase(env.DB,request)};
     const url = new URL(request.url);
     if(env.HOMIE_CONCEPT==='1' && url.pathname==='/robots.txt')return new Response('User-agent: *\nDisallow: /\n',{headers:{'content-type':'text/plain','x-robots-tag':'noindex, nofollow'}});
     if(env.HOMIE_CONCEPT==='1' && url.pathname==='/.well-known/homie-studio.json')return json({ok:false,error:'concept-unlisted'},404,{'x-robots-tag':'noindex, nofollow'});
-    await (await import('./functions.mjs')).syncFunctions(env);
     const dispatch=()=>import('./functions.mjs').then(m=>m.runFunctions(env,()=>catalogue(env,url.origin),url.origin));
     // Some routes reconcile shop state in waitUntil after returning their page.
     // Keep dispatch behind those writes too, preserving the runtime context's
     // methods and OAuth verification symbols through the proxy.
-    const requestCtx=ctx?.waitUntil?new Proxy(ctx,{get(target,key){
-      if(key==='waitUntil')return work=>ctx.waitUntil(Promise.resolve(work).finally(dispatch));
-      const value=Reflect.get(target,key,target);return typeof value==='function'?value.bind(target):value;
-    }}):ctx;
+    const background=trackBackground(ctx,()=>env.DB?.[MUTATIONS]?dispatch():undefined);
+    const requestCtx=background.context;
     // A standalone copy's Lobby call (worker/standalone.mjs): every answer to it can be read by the app's page, an
     // unknown game's 404 and a failure included, so the app can say why it plays offline. No other address is opened.
     const appRecords = isAppOrigin(request) && /^\/[^/]+\/api\/app\/records\//.test(url.pathname);
@@ -661,10 +663,16 @@ export default {
       res = json({ ok: false, error: 'failed' }, 500);
     } finally {
       // Refresh after the route has populated the catalogue cache.
-      if(env.DB&&env.LOBBY&&ctx?.waitUntil)ctx.waitUntil(catalogue(env,url.origin).then(cat=>notifyTools(env,cat,url.origin)).catch(()=>{}));
+      if(env.DB&&env.LOBBY&&ctx?.waitUntil) {
+        const binding=databaseBinding(env.DB),mutation=url.pathname.startsWith('/_studio/')&&env.DB[MUTATIONS];
+        if(!toolCatalogues.has(binding)||mutation) {
+          toolCatalogues.add(binding);
+          ctx.waitUntil(catalogue(env,url.origin).then(cat=>notifyTools(env,cat,url.origin)).catch(()=>toolCatalogues.delete(binding)));
+        }
+      }
       // A route can commit a write and then fail. Its outbox still needs delivery.
       if(env.DB) {
-        const delivery=dispatch();
+        const delivery=background.finish();
         if(ctx?.waitUntil)ctx.waitUntil(delivery);else await delivery;
       }
     }
@@ -683,6 +691,8 @@ export default {
   },
 };
 
+// Refresh once per isolate/binding, and again after studio mutations. No shared pending I/O.
+const toolCatalogues=new WeakSet();
 async function notifyTools(env,cat,origin) {
   if(!env.DB||!env.LOBBY)return;
   const [{pushToolList},{builtins}]=await Promise.all([import('./event-resources.mjs'),import('./mcp-tools.mjs')]);
@@ -950,8 +960,11 @@ async function route(request, env, ctx) {
     const meta = (all.games ?? []).find((g) => g.id === game);
     if (!meta) return fallback(request, env, url, getCat);
     if (parts.length === 1 && !path.endsWith('/')) return Response.redirect(`${url.origin}/${game}/`, 301);
-    const cat = await getCat();
     let sub = parts.slice(1).join('/');
+    // Game bundles were already public assets; only the document carries access context.
+    // Apps retain their session/role checks even for individual asset files.
+    if(read&&meta.kind!=='app'&&sub.startsWith('__game/')&&!['__game/','__game/index.html'].includes(sub))return gameAsset(request,env,url,game,sub.slice('__game/'.length));
+    const cat = await getCat();
     if (meta.kind === 'app' && /^open(?:\/(embed|preview))?$/.test(sub)) sub = sub.replace(/^open/, 'play');
     if (sub === '__restart') {
       if (env.HOMIE_PREVIEW !== '1' || request.method !== 'POST' || !hostedGame(game)) return new Response('not found', { status: 404 });
@@ -968,7 +981,7 @@ async function route(request, env, ctx) {
     if (meta.kind === 'app') {
       const asset=/^__assets\/([^/]+)\/(.+)$/.exec(sub);
       if(asset) {
-        if(!(await appAssetTicket(env,game,asset[1])))return json({ok:false,error:'not-found'},404);
+        if(!(await appAssetTicket(env,game,asset[1],{request,meta,launch})))return json({ok:false,error:'not-found'},404);
         const response=asset[2]==='index.html'?await gameDocument(request,env,url,game,meta,cat):await gameAsset(request,env,url,game,asset[2]);
         response.headers.set('cache-control','private, no-store');
         response.headers.set('referrer-policy','no-referrer');
@@ -980,14 +993,18 @@ async function route(request, env, ctx) {
         const web=await (await import('./app-web.mjs')).appWeb(request,env,meta,url,sub,()=>gameDocument(request,env,url,game,meta,cat));
         if(web)return web;
       }
+      const apiSession=async response=>{
+        const access=await appAccess(request,env,meta,url);
+        return access.ok?appRoleSession(response,request,env,meta,launch):response;
+      };
       if(sub==='api/app/live') {
         if(request.method!=='GET')return new Response('GET required',{status:405});
         const {appHub}=await import('./app-streams.mjs');
-        return appHub(env,meta.id).fetch('https://app/__app_records',{method:'POST',body:JSON.stringify({op:'open',meta,url:request.url,headers:Object.fromEntries(request.headers),collections:url.searchParams.getAll('collection')})});
+        return apiSession(await appHub(env,meta.id).fetch('https://app/__app_records',{method:'POST',body:JSON.stringify({op:'open',meta,url:request.url,headers:Object.fromEntries(request.headers),collections:url.searchParams.getAll('collection')})}));
       }
-      if(sub==='api/app/tools')return (await import('./app-tools.mjs')).appToolsRoute(request,env,meta,url,cat,await studioTools());
+      if(sub==='api/app/tools')return apiSession(await (await import('./app-tools.mjs')).appToolsRoute(request,env,meta,url,cat,await studioTools()));
       const api = await appRecordsRoute(request, env, meta, url, sub);
-      if (api) return api;
+      if (api) return sub.startsWith('api/app/records/')?apiSession(api):api;
       if (['play', 'tv', 'watch'].includes(sub)) {
         let a;
         try { a = await appAccess(request, env, meta, url); } catch { return json({ ok: false, error: 'app roles unavailable; apply studio migrations' }, 503); }
@@ -995,7 +1012,7 @@ async function route(request, env, ctx) {
           if (a.status === 401) return Response.redirect(`${url.origin}/account/?next=${encodeURIComponent(url.pathname + url.search)}`, 302);
           return json({ ok: false, error: a.error }, a.status);
         }
-        if(!meta.room)return recordsPage(meta,url,cat,await availableShellShop(env,cat,game),Boolean(await (await import('./local-test.mjs')).localSession(request,env)),launch!=='public'?await appAssetTicket(env,game):null);
+        if(!meta.room)return appRoleSession(recordsPage(meta,url,cat,await availableShellShop(env,cat,game),Boolean(await (await import('./local-test.mjs')).localSession(request,env)),launch!=='public'?await appAssetTicket(env,game,undefined,{request,meta,launch}):null),request,env,meta,launch);
       }
     }
     const lobby = () => env.LOBBY.get(env.LOBBY.idFromName(game));
@@ -1140,11 +1157,11 @@ async function route(request, env, ctx) {
         const sh = await availableShellShop(env, cat, game, { kids: pol.kids });
         let shopQr = null;
         if (sh && !local) try { shopQr = qrSvg(`${url.origin}/shop/?game=${encodeURIComponent(game)}`, { title: `Shop: ${meta.name ?? game}` }); } catch { shopQr = null; }
-        return playPage(cat, meta, { test: Boolean(await (await import('./local-test.mjs')).localSession(request,env)), origin: url.origin, screen: true, joinUrl, qr, local, room, ticket, owner: d.owner, launch, server, shop: sh ? { ...sh, qr: shopQr, url: `${url.origin}/shop/?game=${game}` } : null });
+        return appRoleSession(playPage(cat, meta, { test: Boolean(await (await import('./local-test.mjs')).localSession(request,env)), origin: url.origin, screen: true, joinUrl, qr, local, room, ticket, owner: d.owner, launch, server, shop: sh ? { ...sh, qr: shopQr, url: `${url.origin}/shop/?game=${game}` } : null }),request,env,meta,launch);
       }
       await countVisit(request, env, ctx, game, 'play');
       shareDaily(cat, url, ctx);
-      const page=playPage(cat, meta, { test: Boolean(await (await import('./local-test.mjs')).localSession(request,env)), origin: url.origin, embed, preview: env.HOMIE_EMBED_PREVIEW === '1', ticket: embed ? null : ticket, owner: !embed && d.owner, launch, server, ...(embed ? {} : await chatWho(env, game, srv, d.acct)), shop: await availableShellShop(env, cat, game, { kids: pol.kids }) });
+      const page=await appRoleSession(playPage(cat, meta, { test: Boolean(await (await import('./local-test.mjs')).localSession(request,env)), origin: url.origin, embed, preview: env.HOMIE_EMBED_PREVIEW === '1', ticket: embed ? null : ticket, owner: !embed && d.owner, launch, server, ...(embed ? {} : await chatWho(env, game, srv, d.acct)), shop: await availableShellShop(env, cat, game, { kids: pol.kids }) }),request,env,meta,launch);
       for(const cookie of recordsGuest?.cookies??[])page.headers.append('set-cookie',cookie);return page;
     }
     if (sub === 'watch') {

package/worker/office.mjs

@@ -1,3 +1,4 @@
+import {databaseBinding, ORIGINAL_DB} from './request-db.mjs';
 import { selling } from './extensions.mjs';
 import { purchaseOrderIfPresent } from './shop.mjs';
 import { toolIdentity } from './tool-identity.mjs';
@@ -170,6 +171,7 @@ export async function accountSub(request, env) {
 
 /** The owner: the signed-in owner's browser session, or (with player accounts) the owner's own account. */
 export async function isOwner(request, env) {
+  if(toolIdentity(request)?.owner)return true;
   if ((await ownerAllowed(request, env, { kinds: ['session'] })) === 'session') return true;
   try { return players?.isOwner ? (await players.isOwner(request, env)) === true : false; } catch { return false; }
 }
@@ -181,17 +183,17 @@ const settingsCache = new WeakMap();
 /** Every game's live settings (D1 office_games), read at most every 5 s per Worker instance. Empty before migration 0005. */
 export async function settingsOf(env, { fresh = false } = {}) {
   if (!env?.DB || env.HOMIE_PREVIEW === '1') return new Map();
-  const hit = settingsCache.get(env.DB);
-  if (!fresh && hit && Date.now() - hit.at < 5000) return hit.map;
+  const hit = settingsCache.get(databaseBinding(env.DB));
+  if (!env.DB[ORIGINAL_DB] && !fresh && hit && Date.now() - hit.at < 5000) return hit.map;
   let map = new Map();
   try {
     const { results } = await env.DB.prepare('SELECT game, launch, max_players, updated_at FROM office_games LIMIT 500').all();
     map = new Map((results ?? []).map((r) => [r.game, r]));
   } catch { map = new Map(); }
-  settingsCache.set(env.DB, { at: Date.now(), map });
+  settingsCache.set(databaseBinding(env.DB), { at: Date.now(), map });
   return map;
 }
-const forgetSettings = (env) => { if (env?.DB) settingsCache.delete(env.DB); };
+const forgetSettings = (env) => { if (env?.DB) settingsCache.delete(databaseBinding(env.DB)); };
 
 /** A game's launch state: the owner's (D1), else its game.json `launch`, else public. A Preview enforces none. */
 export function launchOf(meta, settings, env) {
@@ -221,7 +223,7 @@ function hexBytes(hex) { const out = new Uint8Array(hex.length / 2); for (let i
 /** The studio's office secret (a random 32 bytes in D1 meta, made on first use), as an HMAC key; null without D1. */
 async function officeKey(env) {
   if (!env?.DB) return null;
-  if (keys.has(env.DB)) return keys.get(env.DB);
+  if (keys.has(databaseBinding(env.DB))) return keys.get(databaseBinding(env.DB));
   let hex = null;
   try {
     hex = (await env.DB.prepare("SELECT value FROM meta WHERE key = 'office_key'").first())?.value ?? null;
@@ -232,7 +234,7 @@ async function officeKey(env) {
   } catch { hex = null; }
   if (!/^[a-f0-9]{64}$/.test(String(hex))) return null;
   const key = await crypto.subtle.importKey('raw', hexBytes(hex), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
-  keys.set(env.DB, key);
+  keys.set(databaseBinding(env.DB), key);
   return key;
 }
 async function mac(key, text) { return b64url(new Uint8Array(await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(text)))); }
@@ -330,6 +332,8 @@ async function inviteOpen(env, id) {
  */
 export async function accessOf(request, env, game, launch) {
   if (launch === 'public') return { ok: true, sub: null, owner: false };
+  const caller=toolIdentity(request);
+  if(caller?.localTest&&(env.HOMIE_LOCAL_TEST_SECRET||caller.remoteTest)&&caller.testApp===game)return {ok:true,sub:null,owner:false};
   if (await isOwner(request, env)) return { ok: true, sub: 'o', owner: true };
   if (launch === 'invite') {
     const pass = await passOf(request, env, game);
@@ -1378,15 +1382,70 @@ export async function officeRoutes(request, env, url, { catalogueOf }) {
   return null;
 }
 
-/** Asset-only capability: cannot authenticate records, tools or room sockets. */
-export async function appAssetTicket(env, app, ticket) {
-  const key=await officeKey(env);if(!key)return null;
-  if(ticket===undefined) {
-    const exp=(Date.now()+5*60_000).toString(36);
-    return `${exp}.${(await mac(key,`app-assets|${app}|${exp}`)).slice(0,32)}`;
+/** Encrypted, HMAC-authenticated asset capability. Session hashes never enter URLs in plaintext.
+ * Every use checks revocation, grants and role-link rotation in one D1 statement.
+ */
+export async function appAssetTicket(env, app, ticket, {request,meta,launch=meta?.launch??'public',expectedRole,purpose='asset',renew=false}={}) {
+  const key=await officeKey(env),issuing=ticket===undefined,denied=issuing?null:false;
+  if(!key||!meta)return denied;
+  const decode=text=>Uint8Array.from(atob(text.replaceAll('-','+').replaceAll('_','/')),c=>c.charCodeAt(0));
+  const cipher=await crypto.subtle.importKey('raw',decode(await mac(key,'app-assets-encryption-v1')),'AES-GCM',false,['encrypt','decrypt']);
+  let data;
+  if(issuing) {
+    if(!request)return null;
+    const url=new URL(request.url),{appRole}=await import('./app-format.mjs');
+    const role=appRole(meta,url),rights=meta.roles?.[role];if(!rights)return null;
+    const owner=cookieValues(request,OWNER_COOKIE)[0],player=cookieValues(request,'studio_player')[0],pass=cookieValues(request,passCookie(app))[0],caller=toolIdentity(request);
+    data={purpose,exp:Date.now()+5*60_000,role,rights:await sha256(JSON.stringify(rights)),hash:null,pass:pass?await sha256(pass):null,connection:null,person:null};
+    if(owner||player){data.kind=owner?'owner':'player';data.hash=await sha256(owner??player);}
+    else if(caller){
+      if(caller.localTest&&(env.HOMIE_LOCAL_TEST_SECRET||caller.remoteTest)&&caller.roles?.[app]?.includes(role)){data.kind='test';data.testApp=caller.testApp??app;}
+      else {data.kind='tool';data.connection=caller.connection??null;data.person=caller.id??null;if(data.person?.startsWith('office-'))data.hash=data.person.slice(7);}
+    } else if(launch==='invite'&&!rights.signIn&&pass){data.kind='pass';}
+    else {
+      const session=await (await import('./local-test.mjs')).localSession(request,env);
+      if(session?.app!==app||session.role!==role)return null;
+      data.kind='test';data.testApp=app;data.exp=Math.min(data.exp,session.expires??data.exp);
+    }
+  } else {
+    try {
+      const [iv,payload,signature,...extra]=ticket.split('.');
+      if(extra.length||!signature||!same(await mac(key,`app-assets|${app}|${iv}|${payload}`),signature))return false;
+      data=JSON.parse(new TextDecoder().decode(await crypto.subtle.decrypt({name:'AES-GCM',iv:decode(iv)},cipher,decode(payload))));
+    }catch{return false;}
+  }
+  if(data.kind==='test') {
+    const session=request&&await (await import('./local-test.mjs')).localSession(request,env);
+    if(!issuing&&(!session||session.app!==app||session.role!==data.role||(session.scope??null)!==data.testScope))return denied;
+    if(issuing)data.testScope=session?.scope??toolIdentity(request)?.testScope??null;
   }
-  const m=/^([a-z0-9]+)\.([A-Za-z0-9_-]{32})$/.exec(ticket);
-  return Boolean(m && parseInt(m[1],36)>Date.now() && same((await mac(key,`app-assets|${app}|${m[1]}`)).slice(0,32),m[2]));
+  if(data.purpose!==purpose||(purpose==='handoff'&&!['owner','player'].includes(data.kind)))return denied;
+  if(expectedRole&&data.role!==expectedRole)return denied;
+  if(!Number.isSafeInteger(data.exp)||data.exp<=Date.now()||data.exp>Date.now()+5*60_000||!meta.roles?.[data.role]||data.rights!==await sha256(JSON.stringify(meta.roles[data.role])))return denied;
+  const state=await env.DB.prepare(`SELECT
+    (SELECT token FROM app_role_links WHERE app=?1 AND role=?2) link,
+    EXISTS(SELECT 1 FROM stats_keys WHERE hash=?3 AND kind='session' AND expires_at>?4) owner,
+    EXISTS(SELECT 1 FROM office_passes p JOIN office_invites i ON i.id=p.invite WHERE p.hash=?5 AND p.game=?1 AND p.expires_at>?4 AND i.revoked=0) pass,
+    (SELECT p.id FROM players p WHERE p.id=(SELECT player FROM player_sessions WHERE hash=?3 AND kind='session' AND expires_at>?4)) player,
+    EXISTS(SELECT 1 FROM players p WHERE p.owner=1 AND (p.id=(SELECT player FROM player_sessions WHERE hash=?3 AND kind='session' AND expires_at>?4) OR p.id=?6)) playerOwner,
+    EXISTS(SELECT 1 FROM app_roles WHERE app IN (?1,'*') AND role=?2 AND player IN (?6,(SELECT player FROM player_sessions WHERE hash=?3 AND kind='session' AND expires_at>?4))) granted,
+    EXISTS(SELECT 1 FROM mcp_connections WHERE id=?7 AND person=?6 AND revoked=0) connected
+  `).bind(app,data.role,data.hash??null,Date.now(),data.pass??null,data.person??null,data.connection??null).first();
+  if(issuing&&purpose==='asset'&&launch==='invite'&&!meta.roles[data.role].signIn&&state.pass)data.kind='pass';
+  const gate=state.owner||state.playerOwner||launch==='public'||launch==='invite'&&state.pass;
+  const roleAllowed=!meta.roles[data.role].signIn||state.owner||state.playerOwner||state.granted;
+  const authorized=data.kind==='owner'?state.owner:data.kind==='pass'?launch==='invite'&&!meta.roles[data.role].signIn&&state.pass:data.kind==='player'?state.player&&gate&&roleAllowed:data.kind==='tool'?state.connected&&gate&&roleAllowed:data.kind==='test'?data.testApp===app:false;
+  if(!authorized)return denied;
+  const link=state.link?await sha256(state.link):null;
+  if(!issuing) {
+    if(data.link!==link)return denied;
+    if(!renew||purpose!=='handoff')return true;
+    data.exp=Date.now()+5*60_000;
+  }
+  data.link=link;
+  const iv=crypto.getRandomValues(new Uint8Array(12)),ivText=b64url(iv);
+  const payload=b64url(new Uint8Array(await crypto.subtle.encrypt({name:'AES-GCM',iv},cipher,new TextEncoder().encode(JSON.stringify(data)))));
+  return `${ivText}.${payload}.${await mac(key,`app-assets|${app}|${ivText}|${payload}`)}`;
 }
 
 /** Owner-issued test role, scoped to one app/record namespace; never an owner credential. */
@@ -1404,3 +1463,19 @@ export async function checkSessionTicket(env, data, token) {
   return session;
  }catch{return null;}
 }
+
+/** Same-origin role handoff for opening another screen, never the long-lived role URL secret. */
+export async function appRoleSession(response,request,env,meta,launch) {
+ if(meta.kind!=='app')return response;
+ const {appRole}=await import('./app-format.mjs'),role=appRole(meta,new URL(request.url));
+ if(!meta.roles?.[role]?.signIn)return response;
+ const handoff=cookieValues(request,`studio_app_${meta.id}_${role}`)[0];
+ const ticket=(handoff&&await appAssetTicket(env,meta.id,handoff,{request,meta,launch,purpose:'handoff',expectedRole:role,renew:true}))||await appAssetTicket(env,meta.id,undefined,{request,meta,launch,purpose:'handoff'});
+ if(ticket) {
+  response=new Response(response.body,{status:response.status,statusText:response.statusText,headers:response.headers});
+  // LAN dev uses HTTP: a Secure cookie is discarded before the shell removes access.
+  const secure=new URL(request.url).protocol==='https:'?'; Secure':'';
+  response.headers.append('set-cookie',`studio_app_${meta.id}_${role}=${ticket}; Path=/${meta.id}/; Max-Age=300; HttpOnly${secure}; SameSite=Strict`);
+ }
+ return response;
+}

package/worker/operational-schema.mjs

@@ -0,0 +1,30 @@
+export const OPERATIONAL_MIGRATION_FILE='0031_request_and_tool_notifications.sql';
+export const OPERATIONAL_MIGRATION=`
+-- Removed features are cleaned once, never on the request path.
+DELETE FROM meta WHERE key GLOB 'referral_*' OR key GLOB 'referral-*';
+INSERT OR IGNORE INTO meta(key,value) VALUES('tool-data-revision','0');
+${['INSERT','UPDATE','DELETE'].map(op=>`CREATE TRIGGER tool_data_live_${op.toLowerCase()} AFTER ${op} ON tool_data BEGIN
+ UPDATE meta SET value=CAST(value AS INTEGER)+1 WHERE key='tool-data-revision';
+END;`).join('\n')}
+`;
+
+export const CACHE_MIGRATION_FILE='0032_metadata_revisions.sql';
+export const CACHE_MIGRATION=`
+INSERT OR IGNORE INTO meta(key,value) VALUES('metadata-revision','0');
+${['office_games','servers','chat_rules'].flatMap(table=>['INSERT','UPDATE','DELETE'].map(op=>`CREATE TRIGGER ${table}_revision_${op.toLowerCase()} AFTER ${op} ON ${table} BEGIN
+ UPDATE meta SET value=CAST(value AS INTEGER)+1 WHERE key='metadata-revision';
+END;`)).join('\n')}
+`;
+export const TOOL_NAMESPACE_MIGRATION_FILE='0033_tool_namespace_revisions.sql';
+export const TOOL_NAMESPACE_MIGRATION=`
+DROP TRIGGER tool_data_live_insert;
+DROP TRIGGER tool_data_live_update;
+DROP TRIGGER tool_data_live_delete;
+DELETE FROM meta WHERE key='tool-data-revision';
+CREATE TABLE tool_data_revisions(namespace TEXT PRIMARY KEY,revision INTEGER NOT NULL);
+CREATE TABLE app_tool_namespaces(app TEXT NOT NULL,namespace TEXT NOT NULL,PRIMARY KEY(app,namespace));
+${['INSERT','UPDATE','DELETE'].map(op=>{const row=op==='DELETE'?'OLD':'NEW';return `CREATE TRIGGER tool_data_namespace_${op.toLowerCase()} AFTER ${op} ON tool_data BEGIN
+ INSERT INTO tool_data_revisions VALUES(${row}.namespace,1) ON CONFLICT(namespace) DO UPDATE SET revision=revision+1;
+ ${op==='UPDATE'?`INSERT INTO tool_data_revisions SELECT OLD.namespace,1 WHERE OLD.namespace!=NEW.namespace ON CONFLICT(namespace) DO UPDATE SET revision=revision+1;`:''}
+END;`;}).join('\n')}
+`;

package/worker/pages.mjs

@@ -494,7 +494,13 @@ const SHELL_JS = String.raw`${BUILD_RETRY_JS}(function () {
     ui.querySelector('[data-room-code]').textContent = labelOf(room) + (boot.embed ? ' \u00b7 Site' : '');
     ui.querySelector('[data-room-label]').textContent = labelOf(room);
     ui.querySelector('[data-room-link]').textContent = LOCAL ? 'Deploy to share: this preview address works on this computer only.' : link.replace(/^https?:\/\//, '');
-    ui.querySelector('[data-bigscreen]').href = '/' + boot.game + '/tv?room=' + encodeURIComponent(room);
+    var tv = new URL('/' + boot.game + '/tv', location.origin);
+    tv.searchParams.set('room', room);
+    if (boot.kind === 'app') {
+      var context = new URLSearchParams(location.search);
+      ['role'].forEach(function (key) { if (context.has(key)) tv.searchParams.set(key, context.get(key)); });
+    }
+    ui.querySelector('[data-bigscreen]').href = tv.pathname + tv.search;
     toggle.addEventListener('click', function (e) { e.stopPropagation(); open(sheet.hidden); });
     ui.querySelector('[data-invite]').addEventListener('click', function () {
       var data = { title: boot.name, text: (boot.appWords ? boot.appWords.open : 'Play') + ' ' + boot.name + ' with me: join my room.', url: link };

package/worker/request-db.mjs

@@ -0,0 +1,53 @@
+export const ORIGINAL_DB=Symbol('original database');
+export const MUTATIONS=Symbol('request mutations');
+export const databaseBinding=db=>db?.[ORIGINAL_DB]??db;
+const metadata=new WeakMap();
+const metadataQueries=new Set(['SELECT game, launch, max_players, updated_at FROM office_games LIMIT 500','SELECT * FROM servers LIMIT 2000','SELECT game, server, rules, updated_at FROM chat_rules LIMIT 1000']);
+/** Cache only completed metadata, stamped by a trigger-maintained revision. Pending
+ * D1 operations belong to one request; unrelated metadata tables are never loaded.
+ */
+export function requestDatabase(DB, request, state={mutated:false}, binding=databaseBinding(DB)) {
+ if(!DB)return DB;
+ let revision,records;
+ const url=new URL(request.url),match=request.method==='GET'&&/^\/([a-z0-9][a-z0-9-]{0,39})\/api\/app\/records\/([a-z][a-z0-9-]{0,39})(?:\/([A-Za-z0-9_-]{1,64}))?$/.exec(url.pathname);
+ const recordQuery=match&&(match[3]?'SELECT id, value, version, updated_at FROM app_records WHERE app = ?1 AND collection = ?2 AND id = ?3':'SELECT id, value, version, updated_at FROM app_records WHERE app = ?1 AND collection = ?2 ORDER BY updated_at, id');
+ const stamp=()=>revision??=(async()=>{
+  const query=DB.prepare("SELECT value FROM meta WHERE key='metadata-revision'");
+  if(recordQuery){const result=await DB.batch([query,DB.prepare(recordQuery).bind(...match.slice(1).filter(x=>x!==undefined))]);records=result[1];return result[0].results?.[0]?.value??null;}
+  return (await query.first())?.value??null;
+ })();
+ const writing=sql=>{if(!/^\s*(SELECT|PRAGMA|EXPLAIN)\b/i.test(sql)){if(/\bapp_records\b/.test(sql)){records=null;revision=null;}if(/\b(office_games|servers|chat_rules)\b/.test(sql)){revision=null;metadata.delete(binding);}if(!/\bstats_daily\b/.test(sql))state.mutated=true;}};
+ const prepare=(sql,args=[])=>{
+  const original=()=>{const stmt=DB.prepare(sql);return args.length?stmt.bind(...args):stmt;};
+  const read=async()=>{
+   if(sql===recordQuery&&JSON.stringify(args)===JSON.stringify(match.slice(1).filter(x=>x!==undefined))){await stamp();return records;}
+   if(!metadataQueries.has(sql))return original().all();
+   const version=await stamp();let cache=metadata.get(binding);
+   if(!cache||cache.version!==version){cache={version,rows:new Map()};metadata.set(binding,cache);}
+   if(version!==null&&cache.rows.has(sql))return cache.rows.get(sql);
+   const result=await original().all();if(version!==null)cache.rows.set(sql,result);return result;
+  };
+  return {bind:(...args)=>prepare(sql,args),first:async column=>{writing(sql);if(!metadataQueries.has(sql)&&sql!==recordQuery)return original().first(column);const row=(await read()).results?.[0]??null;return column&&row?row[column]:row;},all:()=>{writing(sql);return read();},run:()=>{writing(sql);return original().run();},raw:(...args)=>{writing(sql);return original().raw(...args);},_original:original,_sql:sql};
+ };
+ const methods={[ORIGINAL_DB]:binding,get [MUTATIONS](){return state.mutated;},prepare,batch:statements=>{for(const s of statements)writing(s._sql??'UPDATE');return DB.batch(statements.map(s=>s._original?.()??s));},exec:(sql,...args)=>{writing(sql);return DB.exec(sql,...args);},withSession:(...args)=>requestDatabase(DB.withSession(...args),request,state,binding)};
+ return new Proxy(methods,{get(target,key){if(key in target)return target[key];const value=DB[key];return typeof value==='function'?value.bind(DB):value;}});
+}
+
+/** A background task may register more work while it settles. */
+export async function drainPending(pending) {
+ for(let done=0;done<pending.length;){const end=pending.length;await Promise.allSettled(pending.slice(done,end));done=end;}
+}
+
+/** Keep the runtime context intact and also deliver writes registered after the
+ * response's original drain finished (for example from response-stream work). */
+export function trackBackground(ctx,deliver) {
+ const pending=[];let finished=false;
+ const context=ctx?.waitUntil?new Proxy(ctx,{get(target,key){
+  if(key==='waitUntil')return work=>{
+   const task=Promise.resolve(work);pending.push(task);ctx.waitUntil(task);
+   if(finished)ctx.waitUntil(Promise.allSettled([task]).then(deliver));
+  };
+  const value=Reflect.get(target,key,target);return typeof value==='function'?value.bind(target):value;
+ }}):ctx;
+ return {context,async finish(){await drainPending(pending);finished=true;await deliver();}};
+}

package/worker/servers.mjs

@@ -1,3 +1,4 @@
+import {databaseBinding, ORIGINAL_DB} from './request-db.mjs';
 /**
  * SERVERS (@homie-rocks/studio 0.16.0; NETPLAY.md section 17): a named, lasting pool of rooms for one game, with its
  * own policy, its own door and its own Lobby pool. Strangers are matched only inside one server, never across.
@@ -171,8 +172,8 @@ const serverCache = new WeakMap();
 /** Every server row of every game (D1), read at most every 5 s per Worker instance; an empty map before migration 0006. */
 async function rowsOf(env, { fresh = false } = {}) {
   if (!env?.DB || env.HOMIE_PREVIEW === '1') return new Map();
-  const hit = serverCache.get(env.DB);
-  if (!fresh && hit && Date.now() - hit.at < 5000) return hit.map;
+  const hit = serverCache.get(databaseBinding(env.DB));
+  if (!env.DB[ORIGINAL_DB] && !fresh && hit && Date.now() - hit.at < 5000) return hit.map;
   let map = new Map();
   try {
     const { results } = await env.DB.prepare('SELECT * FROM servers LIMIT 2000').all();
@@ -182,10 +183,10 @@ async function rowsOf(env, { fresh = false } = {}) {
       map.set(r.game, list);
     }
   } catch { map = new Map(); }
-  serverCache.set(env.DB, { at: Date.now(), map });
+  serverCache.set(databaseBinding(env.DB), { at: Date.now(), map });
   return map;
 }
-export const forgetServers = (env) => { if (env?.DB) serverCache.delete(env.DB); };
+export const forgetServers = (env) => { if (env?.DB) serverCache.delete(databaseBinding(env.DB)); };
 
 /**
  * A game's servers: `public` first, then the rest by when they were made. The game.json seeds (the catalogue's