@homie-rocks/studio 0.53.0 → 0.55.0

package/lib/shop-mcp.mjs

@@ -65,11 +65,17 @@ export async function shopMcpPlan(root, {observations = [], mode = 'test', url,
         found={...written,body:{...written.body,...(lines?{line_items:Array.isArray(lines)?{data:lines.map(l=>({...l,price:typeof l.price==='string'?{id:l.price}:l.price}))}:lines}:{})}};
       }
     }
+    if (!found && method==='POST' && path==='/v1/products' && params.id) {
+      const existing=observations.findLast(o=>(o.method??'GET')==='GET' && o.path===`/v1/products/${params.id}`);
+      if (!existing) throw {next:{method:'GET',path:`/v1/products/${params.id}`,params:{expand:['default_price']}}};
+      if (existing.body?.id===params.id) return existing.body;
+      if (existing.body?.error?.code!=='resource_missing') throw new Error('Stripe product lookup failed; resolve the read before creating a product');
+    }
     if(!found)throw {next:{method,path,params,...(idempotency?{idempotency}:{})}};
     let body=found.body;
     if(method==='GET' && Array.isArray(body?.data) && !params.starting_after && !params.page && !body.has_more) {
       const kind=path.split('/')[2], rows=new Map(body.data.map(o=>[o.id,o]));
-      for(const o of observations.slice(observations.indexOf(found)+1))if(o.method==='POST') {
+      for(const o of observations.slice(observations.indexOf(found)+1))if(o.method==='POST' || (o.method??'GET')==='GET' && /^\/v1\/products\/[^/]+$/.test(o.path) && o.body?.id) {
         if(o.path.split('/')[2]===kind && o.body?.id)rows.set(o.body.id,o.body);
         if(kind==='prices' && o.body?.default_price?.id)rows.set(o.body.default_price.id,o.body.default_price);
       }

package/lib/shop.mjs

@@ -50,6 +50,8 @@ export const HOOK_EVENTS = Object.freeze([
 ]);
 /** The restricted key's permissions, as Stripe's key page names them. Nothing else. */
 export const KEY_PERMISSIONS = Object.freeze([
+  ['Products', 'Read', 'read expanded products on checkout and subscription lines'],
+  ['Prices', 'Read', 'read prices on checkout and subscription lines'],
   ['Checkout Sessions', 'Write', 'open Stripe\'s checkout page for one item'],
   ['Charges', 'Write', 'refunds (Stripe keeps refunds under Charges)'],
   ['PaymentIntents', 'Write', 'verify, create and cancel machine payments as well as read purchase receipts'],
@@ -70,6 +72,11 @@ export const SHOP_HOOK_EVENTS = Object.freeze([
 ]);
 /** The restricted key's permissions, as Stripe's key page names them. Nothing else. */
 export const SHOP_KEY_PERMISSIONS = Object.freeze([
+  ['Subscriptions', 'Read', 'verify current subscription items and paid periods'],
+  ['Invoices', 'Read', 'verify subscription renewal payments'],
+  ['Customer portal', 'Write', 'let shop buyers manage their subscription'],
+  ['Products', 'Read', 'read expanded products on checkout and subscription lines'],
+  ['Prices', 'Read', 'read prices on checkout and subscription lines'],
   ['Checkout Sessions', 'Write', 'open Stripe\'s checkout page for one item'],
   ['Charges', 'Write', 'refunds (Stripe keeps refunds under Charges)'],
   ['PaymentIntents', 'Read', 'which payment an order was'],

package/lib/static-assets.mjs

@@ -0,0 +1,27 @@
+/** Assets matching a protected namespace must pass through runtime authorization. */
+export const WORKER_ROUTES = [
+  '/', '/index.html', '/api/*', '/_studio/*', '/mcp', '/mcp/*', '/oauth/*', '/hooks/*',
+  '/.well-known/*', '/_site/*', '/parts/*', '/games/*', '/account', '/account/*',
+  '/shop', '/shop/*', '/lounge', '/lounge/*', '/_homie/*', '/media/*',
+  '/robots.txt', '/sitemap.xml', '/llms.txt', '/llms-full.txt',
+];
+export function staticWorkerRoutes(catalogue) {
+  if (catalogue?.studio?.concept === true) return true;
+  return [...WORKER_ROUTES, ...(catalogue?.games ?? []).flatMap(game =>
+    [`/${game.id}`, `/${game.id}/*`, ...(game.kind === 'app' ? [] : [`!/games/${game.id}/assets/*`, `!/games/${game.id}/_landing/*`])])];
+}
+/** Keep the owner's header rules last. Worker responses attach their own headers. */
+export function staticHeaders(custom = '', {concept = false} = {}) {
+  custom = custom.replace(/# BEGIN HOMIE HEADERS[\s\S]*?# END HOMIE HEADERS\n?/g, '');
+  return `# BEGIN HOMIE HEADERS
+# Studio defaults: public static assets are served without a Worker invocation.
+/*
+  Cache-Control: public, max-age=0, must-revalidate, no-transform
+  X-Frame-Options: DENY${concept ? "\n  X-Robots-Tag: noindex, nofollow" : ""}
+/games/*
+  ! X-Frame-Options
+/parts/*
+  ! X-Frame-Options
+# END HOMIE HEADERS
+${custom}`;
+}

package/lib/template-history.json

@@ -3963,6 +3963,90 @@
      }
     }
    }
+  },
+  "0.54.0": {
+   "files": {
+    "CLAUDE.md": "ddf2b2a0376202f6",
+    "README.md": "684b3cca8001673c",
+    "HANDOFF.md": "29337e2ace95b2e7",
+    "games/README.md": "5ad32fe80c61f117",
+    "music/README.md": "a3dc042dadd39df8",
+    "videos/README.md": "16babc3437d5545b",
+    "posts/README.md": "37841aae476bd540",
+    "site/README.md": "1dbdf22c03a1e505",
+    "site/src/worker.mjs": "6cc5c6131eaf6fd0"
+   },
+   "sections": {
+    "AGENTS.md": {
+     "(intro)": "394cbbe934e80722",
+     "## Version-matched authoring guides": "f6261a0e5801b96b",
+     "## Layout": "f3a280b8c96cd068",
+     "## Apps: one screen, roles and parts": "c10aa0441ea89702",
+     "## Commands (all through the pinned CLI in node_modules)": "c20d90de21cde0c7",
+     "## The site": "0cb8dd9a6f8a0096",
+     "## Making games": "bb715272fd1a615b",
+     "## The Game Codex and progress": "0738ef719cef3a4c",
+     "## Art direction and models": "a48fff7bf0a5f2fc",
+     "## Running live games (the back office)": "51ebf2ab756f6e4d",
+     "## Servers and AI seats": "1ccfd549d2369a60",
+     "## Selling things (the shop)": "0df5a5fe1833c624",
+     "## Continuing a build from the Claude app": "0d68081e924ca419",
+     "## Rules": "b2234d80f6cbe71d",
+     "## Telling Homie": "80b46fdd9e578db8",
+     "## Beta": "9d02638207a26e73"
+    }
+   },
+   "named": {
+    "Homie Arcade": {
+     "sections": {
+      "AGENTS.md": {
+       "## Commands (all through the pinned CLI in node_modules)": "8364e05cebefcba4"
+      }
+     }
+    }
+   }
+  },
+  "0.55.0": {
+   "files": {
+    "CLAUDE.md": "ddf2b2a0376202f6",
+    "README.md": "684b3cca8001673c",
+    "HANDOFF.md": "29337e2ace95b2e7",
+    "games/README.md": "5ad32fe80c61f117",
+    "music/README.md": "a3dc042dadd39df8",
+    "videos/README.md": "16babc3437d5545b",
+    "posts/README.md": "37841aae476bd540",
+    "site/README.md": "1dbdf22c03a1e505",
+    "site/src/worker.mjs": "6cc5c6131eaf6fd0"
+   },
+   "sections": {
+    "AGENTS.md": {
+     "(intro)": "394cbbe934e80722",
+     "## Version-matched authoring guides": "f6261a0e5801b96b",
+     "## Layout": "f3a280b8c96cd068",
+     "## Apps: one screen, roles and parts": "c10aa0441ea89702",
+     "## Commands (all through the pinned CLI in node_modules)": "c20d90de21cde0c7",
+     "## The site": "0cb8dd9a6f8a0096",
+     "## Making games": "bb715272fd1a615b",
+     "## The Game Codex and progress": "0738ef719cef3a4c",
+     "## Art direction and models": "a48fff7bf0a5f2fc",
+     "## Running live games (the back office)": "51ebf2ab756f6e4d",
+     "## Servers and AI seats": "1ccfd549d2369a60",
+     "## Selling things (the shop)": "0df5a5fe1833c624",
+     "## Continuing a build from the Claude app": "0d68081e924ca419",
+     "## Rules": "b2234d80f6cbe71d",
+     "## Telling Homie": "80b46fdd9e578db8",
+     "## Beta": "9d02638207a26e73"
+    }
+   },
+   "named": {
+    "Homie Arcade": {
+     "sections": {
+      "AGENTS.md": {
+       "## Commands (all through the pinned CLI in node_modules)": "8364e05cebefcba4"
+      }
+     }
+    }
+   }
   }
  }
 }

package/lib/worker-build.mjs

@@ -1,3 +1,4 @@
+import {staticWorkerRoutes} from './static-assets.mjs';
 import {createHash} from 'node:crypto';
 import {refreshWorkerConfig} from './worker-config.mjs';
 import {pathToFileURL} from 'node:url';
@@ -7,7 +8,7 @@ import {readConfig} from './routes.mjs';
 import {PACKAGE_ROOT,workerDir} from './studio.mjs';
 import {paidReleases} from './parts-upload.mjs';
 /** Preserve dynamic imports as real Worker modules: page startup never evaluates MCP libraries. */
-export async function buildWorker(root,esbuild) {
+export async function buildWorker(root,esbuild,metadata=null) {
   const source=join(root,'site/src/worker.mjs');if(!existsSync(source))return;
   const out=join(root,'site/src/runtime');
 
@@ -17,8 +18,16 @@ export async function buildWorker(root,esbuild) {
   if(paidReleases(root).length || existsSync(join(root,'shop.json')) || pricedTools)alias['@homie-rocks/studio/worker']='@homie-rocks/studio/worker/selling';
   // Older studio entries export only Table and Lobby. Supply the new toolkit-owned
   // classes in the generated bundle without rewriting the studio's source/customizations.
-  const contents=`export * from ${JSON.stringify(source)};\nexport { default } from ${JSON.stringify(source)};\nexport { Gate, Concentrator } from ${JSON.stringify(join(PACKAGE_ROOT,'worker/gate.mjs'))};\n`;
-  const result=await esbuild.build({stdin:{contents,resolveDir:root,sourcefile:'worker.mjs'},entryNames:'worker',absWorkingDir:root,alias,outdir:out,bundle:true,splitting:true,format:'esm',platform:'browser',mainFields:['module','main'],conditions:['workerd','worker','browser'],external:['node:*','cloudflare:*'],target:'es2022',write:false,minify:true,metafile:true,logLevel:'silent'});
+  const standardRooms=/export\s*\{[^}]*\bTable\b[^}]*\bLobby\b[^}]*\}\s*from\s*['"]@homie-rocks\/studio\/worker['"]/.test(readFileSync(source,'utf8'));
+  const lazyRooms=standardRooms?`export {Table,Lobby} from ${JSON.stringify(join(PACKAGE_ROOT,'worker/lazy-objects.mjs'))};\n`:'';
+  const contents=`${lazyRooms}export * from ${JSON.stringify(source)};\nexport { default } from ${JSON.stringify(source)};\nexport { Gate, Concentrator } from ${JSON.stringify(join(PACKAGE_ROOT,'worker/lazy-objects.mjs'))};\nexport {AppRecordHub, EventHub} from ${JSON.stringify(join(PACKAGE_ROOT,'worker/lazy-objects.mjs'))};\n`;
+  const result=await esbuild.build({stdin:{contents,resolveDir:root,sourcefile:'worker.mjs'},entryNames:'worker',absWorkingDir:root,alias,outdir:out,bundle:true,splitting:true,format:'esm',platform:'browser',mainFields:['module','main'],conditions:['workerd','worker','browser'],external:['node:*','cloudflare:*'],target:'es2022',write:false,minify:true,metafile:true,logLevel:'silent',plugins:[{name:'studio-runtime',setup(build){
+    if(metadata)build.onLoad({filter:/[/\\]worker[/\\]built-metadata\.mjs$/},()=>({contents:'export default '+JSON.stringify(metadata),loader:'js'}));
+    // Merely overriding entry exports still evaluates the barrel's dependencies.
+    // Standard generated rooms use lazy exports at that barrel as well; a studio
+    // with custom subclasses retains the original class constructors.
+    if(standardRooms)build.onLoad({filter:/[/\\]worker[/\\]index\.mjs$/},({path})=>path===join(PACKAGE_ROOT,'worker/index.mjs')?{contents:readFileSync(path,'utf8').replace("export {Table} from './table.mjs';","export {Table} from './lazy-objects.mjs';").replace("export {Lobby} from './lobby.mjs';","export {Lobby} from './lazy-objects.mjs';").replace("export { Gate, Concentrator } from './gate.mjs';","export { Gate, Concentrator } from './lazy-objects.mjs';").replace("export {AppRecordHub, EventHub} from './stream-objects.mjs';","export {AppRecordHub, EventHub} from './lazy-objects.mjs';"),loader:'js'}:undefined);
+  }}]});
   // A watcher may already have read the previous entry while this build is
   // publishing. Keep its entire graph available. Publish immutable modules first,
   // then switch the single entry atomically; never remove a running graph.
@@ -41,7 +50,7 @@ export async function buildWorker(root,esbuild) {
   }
   // Wrangler's module root is the immutable generation, so old generations are
   // retained locally for in-flight reloads but are never added to a deployment.
-  refreshWorkerConfig(root);
+  refreshWorkerConfig(root, metadata ? {workerRoutes: staticWorkerRoutes(metadata.catalogue)} : {});
   const current=join(out,'current.json'), pending=`${current}.${process.pid}.tmp`;
   writeFileSync(pending,JSON.stringify({main:join(dir,'worker.js')})+'\n');renameSync(pending,current);
   // Dev sometimes watches a copy with routes/remote AI removed. Publish its

package/lib/worker-config.mjs

@@ -1,3 +1,4 @@
+import {staticWorkerRoutes} from './static-assets.mjs';
 import {verifiedMcpConfig,publicMcpSetup} from './shop-mcp.mjs';
 import {readFileSync,writeFileSync,existsSync,renameSync} from 'node:fs';
 import {join} from 'node:path';
@@ -27,6 +28,7 @@ export function updateWorkerConfig(root,generated) {
     writeFileSync(join(root,'wrangler.custom.json'),JSON.stringify(custom,null,2)+'\n');
   }
   const next=merge(base,custom);
+  if(readStudio(root).concept===true)next.assets={...next.assets,run_worker_first:true};
   next.vars={...next.vars,HOMIE_CONCEPT:readStudio(root).concept===true?'1':'0'};
   verifiedMcpConfig(root);
   if(publicMcpSetup(root)) {
@@ -48,5 +50,5 @@ export function refreshWorkerConfig(root,overrides={}) {
   const tools=read(join(root,'site/src/tools/declarations.json'));
   const ai=cf.ai??listExperiences(root).some(g=>g.decide===true || g.chat!==false && (g.chat?.mode??'text')==='text' && g.chat?.ai!==false);
   const paid=paidReleases(root).length>0||existsSync(join(root,'shop.json'))||tools.paid===true;
-  updateWorkerConfig(root,wranglerConfig({worker:cf.worker,name:studio.name,d1:cf.d1,d1Id:cf.d1Id,r2:cf.r2,layout:layoutOf(root),ai,paidParts:paid,partsRateLimit:cf.purchaseRateLimit??null,routes:cf.routes??null,eventFeeds:studio.mcp?.events,triggers:{crons:[scheduleTrigger(functions,{eventFeeds:Object.keys(studio.mcp?.events??{}).length>0})].filter(Boolean)},...overrides}));
+  updateWorkerConfig(root,wranglerConfig({analytics:studio.stats?.analytics===true,workerRoutes:staticWorkerRoutes(read(join(root,'site/dist/games.json'))),worker:cf.worker,name:studio.name,d1:cf.d1,d1Id:cf.d1Id,r2:cf.r2,layout:layoutOf(root),ai,paidParts:paid,partsRateLimit:cf.purchaseRateLimit??null,routes:cf.routes??null,eventFeeds:studio.mcp?.events,triggers:{crons:[scheduleTrigger(functions,{eventFeeds:Object.keys(studio.mcp?.events??{}).length>0})].filter(Boolean)},...overrides}));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homie-rocks/studio",
-  "version": "0.53.0",
+  "version": "0.55.0",
   "description": "A studio for games, music and video on its own Cloudflare: scaffold, multiplayer starters on the netplay contract, a port toolkit that makes existing single-player web games multiplayer, the site Worker with public rooms (Table/Lobby Durable Objects and D1, all on the free Workers plan, no payment method), a site with the hub's sections (Home, Games, Music, Videos, Rooms, Posts with feeds) in the studio's own look, an epic landing page for every game, big songs and videos in the studio's own R2 once it has storage (uploaded, checked by SHA-256, served at the same addresses), deploy, and the homie.rocks directory.",
   "type": "module",
   "license": "Apache-2.0",

package/rules/view.ts

@@ -1314,7 +1314,7 @@ export function openRoom<R = unknown>(opts: OpenRoomOptions = {}): Room<R> {
     get viewTick() { return solo ? solo.viewTick : viewTickNow(); },
     get status() { return solo ? 'offline' : status; },
     get seat() { return solo ? solo.seat : net.seat; },
-    get me() { pump(); return meNow(true); },
+    get me() { if (!presentedEntity) pump(); return meNow(true); },
     each, get,
     ray: (from,direction,max,options) => solo ? solo.ray(from,direction,max,options) : viewRay(from,direction,max,options)[0],
     rays: options => solo ? solo.rays(options) : raySnapshot(mapAt(latest?.k??0),viewTargets(atTickOf(options)),dims,options,mine?.id),

package/shop/SHOP.md

@@ -305,7 +305,7 @@ await shop.checkout({ reference: 'table-7' });
 The default opens the synced Stripe menu containing those items. The guest chooses
 final quantities **on Stripe**, starting at one for each menu line; the local cart's
 quantities are not prefilled. Adjustable quantity minimum is zero (Stripe prevents
-removing the last item). Payment Links support at most 20 lines. Keyless sync splits catalogues into menus of ten to fit signed invoice snapshots without authenticated pagination. Split larger menus;
+removing the last item); maximum is the item’s `maxQuantity` from shop.json, default 99 (a positive integer up to 999999). Payment Links support at most 20 lines. Keyless sync splits catalogues into menus of ten to fit signed invoice snapshots without authenticated pagination. Split larger menus;
 if selected items span menus, the app receives `menu` and should offer separate
 checkouts. Custom amounts cannot be mixed into this menu; offer a separate tip link.
 Stripe invoice creation is enabled for menus (Stripe's invoice pricing applies).
@@ -329,8 +329,7 @@ the owner's AI write the complete manifest to `.studio/booking-slots.json` and r
 
 Sync after publishing or changing slots. Removed or inactive slots deactivate their
 links. Each link has `restrictions.completed_sessions.limit = capacity`, with one
-fixed service and one seat per checkout. Re-sync preserves Stripe's lifetime completed
-count. Free slots stay local and use separate slot records from paid links. Never increment capacity just to hide a full-link error.
+fixed service and an adjustable group quantity up to the published remaining seats. Stripe counts completed sessions, not seats: supply the reviewed `confirmed` seat total when resyncing. The database confirms the paid quantity atomically; a capacity race becomes a visible review order rather than an overbooking. Re-sync preserves Stripe's lifetime completed count. Free slots stay local and use separate slot records from paid links. Never increment capacity just to hide a full-link error.
 Refunds do not decrement Stripe's completed-session counter; the owner's AI must
 review availability and resync explicitly. A changed price should use a new slot;
 do not replace a sold link and accidentally reset its capacity counter.
@@ -441,15 +440,20 @@ stored preset or an empty amount; keep the expected total visible on the phone.
 
 After a signed paid session matches the frozen link, revision, mode, currency and
 order reference, `order.paid` contains the **saved basket lines**, `amount` (actual
-payment), `basketTotal` (expected total), and `settlement` (`paid` or `short`).
+payment), `basketTotal` (expected total), and `settlement` (`paid`).
 Line `amount` is the saved extended amount (unit price × quantity); line `total`
 is its proportionally allocated share of the actual aggregate payment for refunds.
-A short payment emits the event so staff can resolve it, but grants no automatic
-entitlements. Apps must compare the actual payment with `basketTotal`, show a
-shortfall explicitly, and deduplicate by order ID. More than the total is paid.
-Reopening and paying the link creates another order for the same frozen basket;
-repeated delivery of the same session never creates another round.
+A payment that differs from the saved basket total emits `payment.review`, retains
+the actual payment, and shows the customer a staff-review notice. It never emits
+`order.paid` or grants entitlements. Staff reconcile or refund the difference.
+Exact payments emit `order.paid`; deduplicate fulfillment by order ID.
 
 The Stripe heading is the connected Stripe account's business name. A sandbox
 account named “Homie sandbox” shows that name; a real pub's account shows the pub's
 name. The basket's product name and description use the pub's own wording.
+
+### Payments requiring review
+
+A signed paid deposit or basket that cannot match its saved order is retained as a `review` order, with the payment ID and actual total, a customer notice and a durable `payment.review` event. Staff reconcile fulfillment or refund in Stripe. Group payments that exceed remaining capacity follow the same path without granting seats. Repeated events do not duplicate the review order.
+
+Full connect saves `.studio/stripe-mcp.json` and public purchase configuration for the build’s JSON asset, just like plugin verification. Rebuild/deploy before retiring old links. `STRIPE_CHECKOUT_MODE` stays in public Wrangler vars; only the webhook signing secret and private purchase signing keys use secrets.

package/worker/analytics.mjs

@@ -0,0 +1,84 @@
+/** Page counters are sampled analytics, never billing or gameplay state.
+ * D1 retains historical totals. Each rollup adds only the delta from the last
+ * observed total, in the same transaction as its watermark, so retries are safe.
+ */
+export const PAGE_METRICS = new Set(['visit', 'play', 'screen', 'watch']);
+export function writePageMetric(env, row) {
+  if (!env.STUDIO_ANALYTICS || !env.STUDIO_ANALYTICS_DATASET || !PAGE_METRICS.has(row.metric)) return false;
+  const day = row.day ?? new Date().toISOString().slice(0, 10);
+  try { env.STUDIO_ANALYTICS.writeDataPoint({
+    indexes: [String(row.subject ?? '').slice(0, 80) || 'studio'],
+    blobs: [day, row.metric, String(row.subject ?? '').slice(0, 80), String(row.source ?? '').slice(0, 80)],
+    doubles: [Math.max(0, Math.floor(Number(row.n ?? 1) || 0))],
+  }); } catch (error) {
+    // Analytics is sampled telemetry. A binding failure must not fail a page or
+    // amplify the outage into a D1 write on every visit.
+    console.warn('Studio analytics point dropped:', error.message);
+  }
+  return true;
+}
+async function* analyticsPages(env,{now=Date.now(),pageSize=1000}={}) {
+  if (!env.ANALYTICS_SQL || !env.STUDIO_ANALYTICS_DATASET) return;
+  const dataset=String(env.STUDIO_ANALYTICS_DATASET);
+  if(!/^[a-z0-9_-]+$/.test(dataset))throw new Error('Invalid studio analytics dataset');
+  // Revisit each UTC day for late ingestion and sample corrections. Ordered
+  // pages avoid the aggregate 50k result ceiling, including a busy single day.
+  for(let ago=7;ago>=0;ago--) {
+    const day=new Date(now-ago*86400000).toISOString().slice(0,10);
+    for(let offset=0;;offset+=pageSize) {
+      const result=await env.ANALYTICS_SQL.query({
+        query:`SELECT blob1 AS day, blob2 AS metric, blob3 AS subject, blob4 AS source, SUM(_sample_interval * double1) AS n
+          FROM events.analyticsEngine."${dataset}" WHERE timestamp >= $start AND blob1 = $day
+          GROUP BY blob1, blob2, blob3, blob4 ORDER BY blob1, blob2, blob3, blob4 LIMIT ${pageSize} OFFSET $offset`,
+        params:{start:day+'T00:00:00Z',day,offset},
+      });
+      if(!Array.isArray(result.data))throw new Error('Incomplete studio analytics rollup');
+      yield result.data.filter(r=>/^\d{4}-\d{2}-\d{2}$/.test(r.day)&&PAGE_METRICS.has(r.metric)&&Number.isFinite(Number(r.n)));
+      if(result.data.length<pageSize)break;
+    }
+  }
+}
+export async function analyticsTotals(env,now=Date.now()) {
+  const rows=[];for await(const page of analyticsPages(env,{now}))rows.push(...page);return rows;
+}
+export async function analyticsStatus(env,now=Date.now()) {
+  const rows=(await env.DB.prepare("SELECT key,value FROM meta WHERE key IN ('analytics-rollup-error','analytics-rollup-success')").all()).results??[];
+  const values=Object.fromEntries(rows.map(r=>[r.key,r.value]));
+  const error=values['analytics-rollup-error'];
+  return {lastSuccess:Number(values['analytics-rollup-success'])||null,delayed:Boolean(error)||now-Number(values['analytics-rollup-success']??0)>7200000,error:error||null};
+}
+async function health(env,key,value) {
+  await env.DB.prepare('INSERT INTO meta(key,value) VALUES(?1,?2) ON CONFLICT(key) DO UPDATE SET value=excluded.value WHERE value!=excluded.value').bind(key,String(value)).run();
+}
+export async function rollupAnalytics(env,options={}) {
+  if(!env.DB||!env.ANALYTICS_SQL)return;
+  try {
+    for await(const rows of analyticsPages(env,options)) {
+      for(let offset=0;offset<rows.length;offset+=40) {
+        const statements=rows.slice(offset,offset+40).flatMap(r=>{
+          const args=[r.day,r.metric,r.subject,r.source,Math.round(Number(r.n))];
+          return [
+            env.DB.prepare(`INSERT INTO stats_daily(day,metric,subject,source,n)
+              SELECT ?1,?2,?3,?4,?5-COALESCE((SELECT n FROM stats_analytics_daily WHERE day=?1 AND metric=?2 AND subject=?3 AND source=?4),0)
+              WHERE NOT EXISTS(SELECT 1 FROM stats_analytics_daily WHERE day=?1 AND metric=?2 AND subject=?3 AND source=?4 AND n=?5)
+              ON CONFLICT(day,metric,subject,source) DO UPDATE SET n=stats_daily.n+excluded.n`).bind(...args),
+            env.DB.prepare(`INSERT INTO stats_analytics_daily(day,metric,subject,source,n) VALUES(?1,?2,?3,?4,?5)
+              ON CONFLICT(day,metric,subject,source) DO UPDATE SET n=excluded.n WHERE n!=excluded.n`).bind(...args),
+          ];
+        });
+        if(statements.length)await env.DB.batch(statements);
+      }
+    }
+    await health(env,'analytics-rollup-error','');
+    await health(env,'analytics-rollup-success',options.now??Date.now());
+    return {delayed:false};
+  } catch(error) {
+    console.error('Studio analytics counts delayed:',error.message);
+    await health(env,'analytics-rollup-error',String(error.message).slice(0,500));
+    return {delayed:true,error:error.message};
+  }
+}
+
+export const ANALYTICS_MIGRATION_FILE="0037_owner_analytics.sql";
+export const ANALYTICS_MIGRATION=`CREATE TABLE IF NOT EXISTS stats_analytics_daily(day TEXT NOT NULL,metric TEXT NOT NULL,subject TEXT NOT NULL,source TEXT NOT NULL,n INTEGER NOT NULL,PRIMARY KEY(day,metric,subject,source)) WITHOUT ROWID;
+`;

package/worker/app-frame.mjs

@@ -1,7 +1,7 @@
 /** Opaque frames retain their isolation. Unavailable Web Storage falls back to frame-local memory. */
 export const APP_STORAGE_JS=String.raw`(()=>{
  for(const name of ['localStorage','sessionStorage']) {
-  try {const storage=window[name];const probe='homie-storage-probe';storage.setItem(probe,'1');storage.removeItem(probe);continue;}catch{}
+  try {const storage=window[name];const probe='homie-storage-probe';storage.setItem(probe,'1');storage.removeItem(probe);continue;}catch{/* A blocked storage probe falls through to the in-memory shim. */}
   const data=new Map();const methods={getItem:k=>data.get(String(k))??null,setItem:(k,v)=>{data.set(String(k),String(v));},removeItem:k=>{data.delete(String(k));},clear:()=>data.clear(),key:i=>[...data.keys()][Number(i)]??null};
   const storage=new Proxy(methods,{get:(target,key)=>key==='length'?data.size:key in target?target[key]:data.get(String(key)),set:(_,key,value)=>{data.set(String(key),String(value));return true;},deleteProperty:(_,key)=>data.delete(String(key)),ownKeys:()=>[...data.keys()],getOwnPropertyDescriptor:()=>({enumerable:true,configurable:true})});
   Object.defineProperty(window,name,{value:storage,configurable:true});

package/worker/app-graphics.mjs

@@ -1,6 +1,6 @@
 export function appGraphicsFallback(text='This device cannot display the 3D scene. Use the text controls to continue.') {
  if(!document.querySelector('canvas')||document.querySelector('[data-webgl-fallback]'))return;
- try{const c=document.createElement('canvas');if(c.getContext('webgl2'))return;}catch{}
+ try{const c=document.createElement('canvas');if(c.getContext('webgl2'))return;}catch{/* Context creation can throw when graphics are unavailable; show the fallback. */}
  const p=document.createElement('p');p.dataset.webglFallback='';p.setAttribute('role','status');p.textContent=text;
  p.style.cssText='position:static;pointer-events:none;padding:12px;background:#fff;color:#222;font:16px system-ui;border-radius:12px';
  const canvas=document.querySelector('canvas');

package/worker/app-records.mjs

@@ -4,9 +4,9 @@ import { moveBooking } from './booking-store.mjs';
 import { toolIdentity } from './tool-identity.mjs';
 /** Lasting app records in the studio's own D1. Room hosts never authorize writes. */
 import { appRole, recordProblem } from './app-format.mjs';
-import { isOwner, sameOrigin } from './office.mjs';
+import { appAssetTicket, isOwner, sameOrigin, launchOf, settingsOf } from './office.mjs';
 import { players } from './players.mjs';
-import { ownerAllowed } from './stats.mjs';
+import { cookieValues, ownerAllowed } from './stats.mjs';
 import { appOriginOf } from './standalone.mjs';
 export const APPS_MIGRATION_FILE = '0014_studio_apps.sql';
 export const APPS_MIGRATION = `CREATE TABLE IF NOT EXISTS app_records (
@@ -52,6 +52,8 @@ export async function appAccess(request, env, meta, url) {
     const grant = await env.DB.prepare("SELECT player FROM app_roles WHERE app IN (?1, '*') AND role = ?2 AND player = ?3").bind(meta.id, role, caller.id).first();
     return grant ? { ok: true, role, can: declared.can } : { ok: false, status: 403, error: 'this account has no role grant' };
   }
+  const handoff=cookieValues(request,`studio_app_${meta.id}_${role}`)[0];
+  if(handoff&&await appAssetTicket(env,meta.id,handoff,{meta,purpose:'handoff',expectedRole:role,launch:launchOf(meta,await settingsOf(env),env)}))return {ok:true,role,can:declared.can};
   const link = await env.DB.prepare('SELECT token FROM app_role_links WHERE app = ?1 AND role = ?2').bind(meta.id, role).first();
   if (!link || link.token !== url.searchParams.get('access')) return { ok: false, status: 404, error: 'private role link required' };
   if (await isOwner(request, env)) return { ok: true, role, can: declared.can };

package/worker/app-shell.mjs

@@ -4,7 +4,12 @@ export const APP_SHELL_JS = String.raw`(function () {
   if (!boot || boot.kind !== 'app') return;
   var frame = boot.direct ? {contentWindow:window} : document.querySelector('iframe.game') || document.querySelector('iframe');
   var params = new URLSearchParams(location.search);
-  // Share short-lived reads across same-origin screens with the exact same role/access.
+  // Authorized shell responses have already set the HttpOnly role handoff.
+  if(params.has('access')) {
+    params.delete('access');
+    history.replaceState(null,'',location.pathname+(params.size?'?'+params:'')+(location.hash||''));
+  }
+  // Share short-lived reads across same-origin screens with the same role and browser cookies.
   // No records are persisted. Writes always reach the Worker and invalidate all views.
   var recent = new Map(), failures = new Map(), pending = new Map();
   var channel; try { channel = new BroadcastChannel('homie-app-records-v1'); } catch (_) {}
@@ -38,11 +43,11 @@ export const APP_SHELL_JS = String.raw`(function () {
   var live, collections=new Set(), presence=0, clock=null;
   function query() {
     var q=new URLSearchParams();
-    ['role','surface','access','room'].forEach(function(k){var v=params.get(k);if(v)q.set(k,v);});
+    ['role','surface','room'].forEach(function(k){var v=params.get(k);if(v)q.set(k,v);});
     if(boot.screen&&!q.has('role'))q.set('surface','wall');
     return q;
   }
-  function context() {return {app:boot.game,origin:location.origin,url:location.origin+'/'+boot.game+'/open',presence:presence,now:clock};}
+  function context() {var room=new URLSearchParams(location.search).get('room');return {app:boot.game,origin:location.origin,url:location.origin+'/'+boot.game+'/open'+(room&&/^[A-Za-z0-9_-]{1,32}$/.test(room)?'?room='+encodeURIComponent(room):''),presence:presence,now:clock};}
   function sendContext(){frame?.contentWindow?.postMessage({type:'homie-app-context',context:context()},'*');}
   function connect(){
     live?.close();
@@ -63,7 +68,7 @@ export const APP_SHELL_JS = String.raw`(function () {
     if (!frame || e.source !== frame.contentWindow || !m || !['homie-app','homie-app-tool'].includes(m.type) || !/^[a-f0-9]{32}$/.test(m.id || '')) return;
     if (m.type==='homie-app' && (!/^[a-z][a-z0-9-]{0,39}$/.test(m.collection || '') || !['GET','POST','PUT','DELETE'].includes(m.method) || (m.record !== undefined && !/^[A-Za-z0-9_-]{1,64}$/.test(m.record)))) return;
     var q = new URLSearchParams();
-    ['role','surface','access'].forEach(function (k) { var v = params.get(k); if (v) q.set(k, v); });
+    ['role','surface'].forEach(function (k) { var v = params.get(k); if (v) q.set(k, v); });
     if (boot.screen && !q.has('role')) q.set('surface', 'wall');
     var path = (boot.site || '') + '/' + boot.game + '/api/app/records/' + m.collection + (m.record ? '/' + m.record : '') + '?' + q;
     if(m.type==='homie-app-tool')path=(boot.site||'')+'/'+boot.game+'/api/app/tools?'+q;

package/worker/app-streams.mjs

@@ -1,3 +1,4 @@
+import {databaseBinding} from './request-db.mjs';
 import {appAccess} from './app-records.mjs';
 import {localSession} from './local-test.mjs';
 import {settingsOf,launchOf,accessOf} from './office.mjs';
@@ -9,16 +10,29 @@ ${['INSERT','UPDATE','DELETE'].map(op=>{const row=op==='DELETE'?'OLD':'NEW';retu
 END;`;}).join('\n')}
 `;
 const frame=value=>new TextEncoder().encode('data: '+JSON.stringify(value)+'\n\n');
-export const appHub=(env,app)=>env.LOBBY.get(env.LOBBY.idFromName('@app-records/'+app));
+export const appHub=(env,app)=>{const ns=env.APP_RECORDS??env.LOBBY;return ns.get(ns.idFromName('@app-records/'+app));};
+const pushedRevisions=new WeakMap();
 export async function pushAppRecords(env,cat){
- if(!env.LOBBY||!env.DB)return;
- await Promise.all((cat.games??[]).filter(g=>g.kind==='app').map(meta=>appHub(env,meta.id).fetch('https://app/__app_records',{method:'POST',body:JSON.stringify({op:'wake',meta})}).catch(error=>console.error('App notification wake failed',error))));
+ const apps=(cat.games??[]).filter(g=>g.kind==='app');
+ if(!(env.APP_RECORDS??env.LOBBY)||!env.DB||!apps.length)return;
+ const rows=(await env.DB.prepare(`SELECT app,collection,revision FROM app_record_revisions
+ UNION ALL SELECT a.app,'*',SUM(COALESCE(r.revision,0)) FROM app_tool_namespaces a LEFT JOIN tool_data_revisions r ON r.namespace=a.namespace GROUP BY a.app`).all()).results;
+ const signatures=new Map();for(const row of rows){const app=row.app.split(':check:')[0];signatures.set(app,(signatures.get(app)??'')+JSON.stringify(row));}
+ const binding=databaseBinding(env.DB),previous=pushedRevisions.get(binding)??new Map();
+ for(const meta of apps){
+  const signature=signatures.get(meta.id)??'';
+  if((previous.get(meta.id)??'')===signature)continue;
+  const response=await appHub(env,meta.id).fetch('https://app/__app_records',{method:'POST',body:JSON.stringify({op:'wake',meta})});
+  if(!response.ok)throw new Error('App notification wake failed');
+  previous.set(meta.id,signature);
+ }
+ pushedRevisions.set(binding,previous);
 }
 /** Collection invalidations, never record bodies or identifiers. Reads recheck current authorization. */
 export class AppRecordStreams {
  constructor(env,ctx){this.env=env;this.ctx=ctx;this.streams=new Set();}
  dispose(){for(const s of [...this.streams])this.close(s);}
- close(s){if(!this.streams.delete(s))return;clearInterval(s.timer);try{s.controller.close();}catch{}this.presence();}
+ close(s){if(!this.streams.delete(s))return;clearInterval(s.timer);clearTimeout(s.reconnect);try{s.controller.close();}catch{/* The reader already cancelled or the stream already closed. */}this.presence();}
  count(s){return [...this.streams].filter(x=>x.app===s.app&&x.room===s.room).length;}
  send(s,data){if(s.controller.desiredSize<=0){this.close(s);return;}try{s.controller.enqueue(frame(data));}catch{this.close(s);}}
  presence(){for(const s of this.streams)this.send(s,{presence:this.count(s)});}
@@ -28,7 +42,7 @@ export class AppRecordStreams {
   const launch=launchOf(s.meta,await settingsOf(this.env,{fresh:true}),this.env);
   return launch==='public'||(await accessOf(s.request,this.env,s.meta.id,launch)).ok;
  }
- async revisions(s){return (await this.env.DB.prepare('SELECT collection,revision FROM app_record_revisions WHERE app=?1').bind(s.app).all()).results;}
+ async revisions(s){return (await this.env.DB.prepare("SELECT collection,revision FROM app_record_revisions WHERE app=?1 UNION ALL SELECT '*',COALESCE(SUM(r.revision),0) FROM app_tool_namespaces a JOIN tool_data_revisions r ON r.namespace=a.namespace WHERE a.app=?1").bind(s.app).all()).results;}
  async open({meta,url,headers,collections=[]}){
   if(!Array.isArray(collections)||collections.some(c=>typeof c!=='string'||!Object.hasOwn(meta.records?.collections??{},c)))return new Response('unknown collection',{status:400});
   const s={meta,url:new URL(url),request:new Request(url,{headers}),collections,seen:new Map()};
@@ -40,17 +54,20 @@ export class AppRecordStreams {
   const body=new ReadableStream({start:controller=>{s.controller=controller;},cancel:()=>this.close(s)});
   this.streams.add(s);this.send(s,{collections:s.collections,presence:this.count(s),reset:true});
   for(const other of this.streams)if(other!==s)this.send(other,{presence:this.count(other)});
+  // A fresh HTTP response renews the role cookie; SSE frames cannot set cookies.
+  s.reconnect=setTimeout(()=>this.close(s),240000);
   // Recovery after a missed wake; this is not the screen's refresh clock.
-  s.timer=setInterval(()=>this.ctx.waitUntil(this.pump(s)),15000);
+  s.timer=setInterval(()=>this.ctx.waitUntil(this.pump(s,true)),15000);
   return new Response(body,{headers:{'content-type':'text/event-stream','cache-control':'no-store'}});
  }
- async pump(s){
+ async pump(s,recheck=false){
   if(!this.streams.has(s))return;if(s.busy){s.dirty=true;return;}s.busy=true;
   try{
+   const changed=new Set();
+   for(const row of await this.revisions(s)){if(s.seen.get(row.collection)!==row.revision){if(row.collection==='*')for(const c of s.collections)changed.add(c);else if(s.collections.includes(row.collection))changed.add(row.collection);}s.seen.set(row.collection,row.revision);}
+   if(!changed.size&&!recheck)return;
    if(!await this.authorized(s)){this.close(s);return;}
-   const changed=[];
-   for(const row of await this.revisions(s)){if(s.collections.includes(row.collection)&&s.seen.get(row.collection)!==row.revision)changed.push(row.collection);s.seen.set(row.collection,row.revision);}
-   this.send(s,{collections:changed,presence:this.count(s)});
+   this.send(s,{collections:[...changed],presence:this.count(s)});
   }catch{this.close(s);}finally{s.busy=false;if(s.dirty){s.dirty=false;await this.pump(s);}}
  }
  async wake(meta){for(const s of this.streams)if(meta)s.meta=meta;await Promise.all([...this.streams].map(s=>this.pump(s)));return new Response('ok');}

package/worker/app-tools.mjs

@@ -37,6 +37,7 @@ export async function appToolsRoute(request,env,meta,url,cat,definitions){
   if(tool.price)return fail(402,'Use MCP to approve payment for this tool');
   if(!await rateLimit(env,caller.id??`public:${request.headers.get('cf-connecting-ip')??'local'}`,callsPerMinute(cat)))return fail(429,'Rate limit reached');
   const namespace=(tool.namespace??tool.name)+(caller.testScope?':check:'+caller.testScope:'');
+  await env.DB.prepare('INSERT OR IGNORE INTO app_tool_namespaces(app,namespace) VALUES(?1,?2)').bind(meta.id+(caller.testScope?':check:'+caller.testScope:''),namespace).run();
   const data=await invokeAppTool(tool,body.input??{},services(env,cat,url.origin,caller,namespace,tool));
   outcome='ok';return Response.json({ok:true,data});
  }catch(error){return fail(error.status??(error instanceof SyntaxError?400:500),error.status||error.name==='StudioOperationError'?error.message:'Tool request failed');}

package/worker/asset-paths.mjs

@@ -0,0 +1,2 @@
+export const GAME_FILES = /^\/[a-z0-9][a-z0-9-]{0,39}\/(?:__game|__assets)(?:\/|$)/;
+export const PART_FILES = /^\/parts\/[a-z0-9][a-z0-9-]{0,47}\/\d{1,6}\.\d{1,6}\.\d{1,6}[^/]*\//;

package/worker/background-queue.mjs

@@ -0,0 +1,30 @@
+import {catalogue} from './catalogue.mjs';
+/** Durable rows remain the source of truth. Messages carry wakeups, never records. */
+export async function enqueueChanges(env, origin) {
+  if(env.BACKGROUND) {
+    try {return await env.BACKGROUND.send({v:1,type:'studio.changed',origin});}
+    catch(error) {console.warn('Background queue unavailable; delivering inline:',error.message);}
+  }
+  // Older wrappers and local unit fixtures without the binding keep their behavior.
+  return (await import('./functions.mjs')).runFunctions(env,()=>catalogue(env,origin),origin);
+}
+export async function consumeBackground(batch, env) {
+  const changes=batch.messages.filter(m=>m.body?.v===1&&m.body.type==='studio.changed');
+  if(changes.length) {
+    try {
+      const origin=changes[0].body.origin;
+      await (await import('./functions.mjs')).runFunctions(env,()=>catalogue(env,origin),origin);
+      for(const message of changes)message.ack();
+    } catch(error) {
+      console.error('Background delivery failed',error);
+      for(const message of changes)message.retry({delaySeconds:30});
+    }
+  }
+  for(const message of batch.messages)if(!changes.includes(message)) {
+    try {
+      if(message.body?.v!==1||message.body.type!=='stripe.event')throw new Error('Unknown background message type');
+      await (await import('./stripe-intake.mjs')).reconcileStripeEvent(env,message.body.id,await catalogue(env));
+      message.ack();
+    } catch(error) {console.error('Background queue delivery failed',error);message.retry({delaySeconds:error.retryAfterSeconds??30});}
+  }
+}

package/worker/build-id.mjs

@@ -1,2 +1,2 @@
 // Generated by lib/build-identity.mjs; identifies the bundled runtime sources.
-export const STUDIO_BUILD = Object.freeze({"version":"0.53.0","sha256":"c43b8fcfbd61ff241c86555b2806cd599baf71513376d3958c379b04697dd923"});
+export const STUDIO_BUILD = Object.freeze({"version":"0.55.0","sha256":"597d65592bde7e9519b8184bc2db2502a88ef37cfc31dd6ba3b1c9a4ece30132"});

package/worker/built-metadata.mjs

@@ -0,0 +1,2 @@
+// Replaced with this build’s immutable metadata by lib/worker-build.mjs.
+export default null;

package/worker/catalogue.mjs

@@ -0,0 +1,18 @@
+const cache = new WeakMap();
+/** Cache completed immutable data only. Never share pending I/O across requests. */
+export async function catalogue(env, origin = 'https://studio.invalid') {
+  const baked = (await import('./built-metadata.mjs')).default;
+  if (baked) return baked.catalogue;
+  const hit = cache.get(env.ASSETS);
+  if (hit?.origin === origin && env.HOMIE_PREVIEW !== '1' && env.HOMIE_DEV !== '1') return hit.value;
+  const response = await env.ASSETS.fetch(new Request(`${origin}/games.json`));
+  if (!response.ok) return {studio: {name: env.STUDIO_NAME || 'Studio'}, games: []};
+  const tag=response.headers.get('etag');
+  if(tag&&hit?.origin===origin&&hit.tag===tag){await response.body?.cancel();return hit.value;}
+  const value = await response.json();
+  cache.set(env.ASSETS, {origin, value, tag});
+  return value;
+}
+export async function builtPosts() {
+  return (await import('./built-metadata.mjs')).default?.posts;
+}