@homie-rocks/studio 0.53.0 → 0.55.0

package/worker/office.mjs

@@ -1,3 +1,4 @@
+import {databaseBinding, ORIGINAL_DB} from './request-db.mjs';
 import { selling } from './extensions.mjs';
 import { purchaseOrderIfPresent } from './shop.mjs';
 import { toolIdentity } from './tool-identity.mjs';
@@ -62,13 +63,13 @@ import { toolIdentity } from './tool-identity.mjs';
  * from an office key it is ALWAYS an ask (the AI may only propose one).
  */
 import { seatsOf } from './seats.mjs';
-import { diagnosticsOf, gatePlayers, roomLayout } from './gate.mjs';
+import { diagnosticsOf, gatePlayers, roomLayout } from './gate-routing.mjs';
 import { PUBLIC_SERVER, SERVER_LIMITS, checkServer, levelName, narrows, policyOf, roomServer, rowFor, serverView, serversOf, serverPassCookie, writeServer } from './servers.mjs';
 import { BRAIN_BUDGET, aiName, brainFor, fillSpot, passById, passCreate, passList, passRevoke, think } from './agents.mjs';
 import { DEFAULT_MODEL, NEURONS_PER_M, OWNER_MODEL, vocabularyOf } from './brain.mjs';
 import { OWNER_COOKIE, cookieValues, counter, ownerAllowed, ownerSession, today } from './stats.mjs';
 import { esc, layout, notFoundPage } from './site.mjs';
-import { confirmPage, lockedPage, officePage } from './office-page.mjs';
+
 import { CHAT_MODES, CHAT_WHO, checkChatRules, publicChat } from './chat.mjs';
 import { chatDay, chatOf, chatRowsOf, clearChatRules, dismissReport, reportsOf, writeChatRules } from './chat-store.mjs';
 import { checkRelease, performRelease, checkRefund, describeRefund, officeShopPage, ordersCsv, performRefund, shopOffice } from './shop.mjs';
@@ -141,12 +142,8 @@ export function canonical(v) {
 
 /* ------------------------------------------------------------------ player accounts (a seam) */
 
-let players = null;
-/**
- * The player-accounts API, handed over once by a studio's Worker that has it:
- * `{ get(id, env), of?(request, env), isOwner?(request, env) }` (worker/players.mjs `players` is exactly this).
- */
-export function usePlayers(api) { players = api && typeof api === 'object' ? api : null; }
+import {players} from './player-registry.mjs';
+export {usePlayers} from './player-registry.mjs';
 
 async function playerOf(env, id) {
   if (!players?.get || !id) return null;
@@ -170,6 +167,7 @@ export async function accountSub(request, env) {
 
 /** The owner: the signed-in owner's browser session, or (with player accounts) the owner's own account. */
 export async function isOwner(request, env) {
+  if(toolIdentity(request)?.owner)return true;
   if ((await ownerAllowed(request, env, { kinds: ['session'] })) === 'session') return true;
   try { return players?.isOwner ? (await players.isOwner(request, env)) === true : false; } catch { return false; }
 }
@@ -181,17 +179,17 @@ const settingsCache = new WeakMap();
 /** Every game's live settings (D1 office_games), read at most every 5 s per Worker instance. Empty before migration 0005. */
 export async function settingsOf(env, { fresh = false } = {}) {
   if (!env?.DB || env.HOMIE_PREVIEW === '1') return new Map();
-  const hit = settingsCache.get(env.DB);
-  if (!fresh && hit && Date.now() - hit.at < 5000) return hit.map;
+  const hit = settingsCache.get(databaseBinding(env.DB));
+  if (!env.DB[ORIGINAL_DB] && !fresh && hit && Date.now() - hit.at < 5000) return hit.map;
   let map = new Map();
   try {
     const { results } = await env.DB.prepare('SELECT game, launch, max_players, updated_at FROM office_games LIMIT 500').all();
     map = new Map((results ?? []).map((r) => [r.game, r]));
   } catch { map = new Map(); }
-  settingsCache.set(env.DB, { at: Date.now(), map });
+  settingsCache.set(databaseBinding(env.DB), { at: Date.now(), map });
   return map;
 }
-const forgetSettings = (env) => { if (env?.DB) settingsCache.delete(env.DB); };
+const forgetSettings = (env) => { if (env?.DB) settingsCache.delete(databaseBinding(env.DB)); };
 
 /** A game's launch state: the owner's (D1), else its game.json `launch`, else public. A Preview enforces none. */
 export function launchOf(meta, settings, env) {
@@ -221,7 +219,7 @@ function hexBytes(hex) { const out = new Uint8Array(hex.length / 2); for (let i
 /** The studio's office secret (a random 32 bytes in D1 meta, made on first use), as an HMAC key; null without D1. */
 async function officeKey(env) {
   if (!env?.DB) return null;
-  if (keys.has(env.DB)) return keys.get(env.DB);
+  if (keys.has(databaseBinding(env.DB))) return keys.get(databaseBinding(env.DB));
   let hex = null;
   try {
     hex = (await env.DB.prepare("SELECT value FROM meta WHERE key = 'office_key'").first())?.value ?? null;
@@ -232,7 +230,7 @@ async function officeKey(env) {
   } catch { hex = null; }
   if (!/^[a-f0-9]{64}$/.test(String(hex))) return null;
   const key = await crypto.subtle.importKey('raw', hexBytes(hex), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
-  keys.set(env.DB, key);
+  keys.set(databaseBinding(env.DB), key);
   return key;
 }
 async function mac(key, text) { return b64url(new Uint8Array(await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(text)))); }
@@ -330,6 +328,8 @@ async function inviteOpen(env, id) {
  */
 export async function accessOf(request, env, game, launch) {
   if (launch === 'public') return { ok: true, sub: null, owner: false };
+  const caller=toolIdentity(request);
+  if(caller?.localTest&&(env.HOMIE_LOCAL_TEST_SECRET||caller.remoteTest)&&caller.testApp===game)return {ok:true,sub:null,owner:false};
   if (await isOwner(request, env)) return { ok: true, sub: 'o', owner: true };
   if (launch === 'invite') {
     const pass = await passOf(request, env, game);
@@ -550,7 +550,7 @@ export async function agentsTry(env, cat, body) {
     const n = Math.round(t.cost.neurons);
     if (n > 0) rows.push(counter(env, { metric: 'brain-neurons', subject: meta.id, n }));
     if (t.cost.micros >= 1) rows.push(counter(env, { metric: 'brain-microdollars', subject: meta.id, n: Math.round(t.cost.micros) }));
-    await env.DB.batch(rows.filter(Boolean)).catch(() => {});
+    await env.DB.batch(rows.filter(Boolean));
   }
   return {
     ok: true, game: meta.id, mode, model: t.model ?? (mode === 'workers-ai' ? e.HOMIE_BRAIN_MODEL || DEFAULT_MODEL : null), engine: t.engine, provider: t.provider,
@@ -1114,7 +1114,7 @@ export async function perform(env, cat, a) {
       if (a.budget !== undefined) {
         const day = await brainDay(env);
         const next = { neurons: day.budget.neurons, usd: day.budget.usd, ...(a.mode === 'workers-ai' ? { neurons: Math.round(a.budget) } : { usd: Math.round(a.budget * 100) / 100 }) };
-        await env.DB.prepare("INSERT OR REPLACE INTO meta (key, value) VALUES ('brain_budget', ?1)").bind(JSON.stringify(next)).run().catch(() => {});
+        await env.DB.prepare("INSERT OR REPLACE INTO meta (key, value) VALUES ('brain_budget', ?1)").bind(JSON.stringify(next)).run();
       }
       await pushPolicy(env, meta, settings, sv);
       const day = await brainDay(env);
@@ -1338,55 +1338,110 @@ export async function officeRoutes(request, env, url, { catalogueOf }) {
   if (path === '/_studio/office' || path === '/_studio/office/') {
     const cat = await catalogueOf();
     if (request.method !== 'GET') return new Response('method', { status: 405 });
-    if (!(await isOwner(request, env))) return lockedPage(cat, { what: 'office' });
+    if (!(await isOwner(request, env))) return (await import('./office-page.mjs')).lockedPage(cat, { what: 'office' });
     // A session from before 0.13.0 lives only under /_studio/: carry it to / so the owner's games know them too.
     const session = await ownerSession(request, env);
     const secure = url.protocol === 'https:' ? '; Secure' : '';
-    return officePage(cat, session ? { 'set-cookie': `${OWNER_COOKIE}=${session}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${30 * 24 * 3600}${secure}` } : {});
+    return (await import('./office-page.mjs')).officePage(cat, session ? { 'set-cookie': `${OWNER_COOKIE}=${session}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${30 * 24 * 3600}${secure}` } : {});
   }
   if (path === '/_studio/office/shop' || path === '/_studio/office/shop/') {
     const cat = await catalogueOf();
     if (request.method !== 'GET') return new Response('method', { status: 405 });
-    if (!(await isOwner(request, env))) return lockedPage(cat, { what: 'office' });
+    if (!(await isOwner(request, env))) return (await import('./office-page.mjs')).lockedPage(cat, { what: 'office' });
     return officeShopPage(cat);
   }
   const confirm = /^\/_studio\/confirm\/(ask_[a-f0-9]{16})\/?$/.exec(path);
   if (confirm) {
     const cat = await catalogueOf();
-    if (!(await isOwner(request, env))) return lockedPage(cat, { what: 'confirm', ask: confirm[1] });
+    if (!(await isOwner(request, env))) return (await import('./office-page.mjs')).lockedPage(cat, { what: 'confirm', ask: confirm[1] });
     const row = await readAsk(env, confirm[1]);
-    if (!row) return confirmPage(cat, null, { missing: true });
+    if (!row) return (await import('./office-page.mjs')).confirmPage(cat, null, { missing: true });
     const ask = askView(row, cat, url.origin);
-    if (request.method === 'GET') return confirmPage(cat, ask);
+    if (request.method === 'GET') return (await import('./office-page.mjs')).confirmPage(cat, ask);
     if (request.method !== 'POST' || !sameOrigin(request, url)) return new Response('Not allowed', { status: 403 });
     let yes = false;
     try { yes = String((await request.formData()).get('do') ?? '') === 'yes'; } catch { yes = false; }
-    if (ask.state !== 'pending') return confirmPage(cat, ask);
+    if (ask.state !== 'pending') return (await import('./office-page.mjs')).confirmPage(cat, ask);
     if (!yes) {
       await env.DB.prepare("UPDATE office_asks SET state = 'cancelled' WHERE id = ?1 AND state = 'pending'").bind(ask.id).run();
-      return confirmPage(cat, { ...ask, state: 'cancelled' });
+      return (await import('./office-page.mjs')).confirmPage(cat, { ...ask, state: 'cancelled' });
     }
     // Claim it first, so a double tap does it once.
     await env.DB.prepare("UPDATE office_asks SET state = 'working' WHERE id = ?1 AND state = 'pending'").bind(ask.id).run();
     const claimed = await readAsk(env, ask.id);
-    if (claimed?.state !== 'working') return confirmPage(cat, askView(claimed ?? row, cat, url.origin));
+    if (claimed?.state !== 'working') return (await import('./office-page.mjs')).confirmPage(cat, askView(claimed ?? row, cat, url.origin));
     if (ask.action.op === 'shop-release') ask.action.by = await releaseIdentity(request, env);
     const result = await perform(env, cat, ask.action);
     await env.DB.prepare('UPDATE office_asks SET state = ?2, result = ?3 WHERE id = ?1').bind(ask.id, result.ok ? 'done' : 'failed', JSON.stringify(result).slice(0, 4000)).run();
-    return confirmPage(cat, { ...ask, state: result.ok ? 'done' : 'failed', result });
+    return (await import('./office-page.mjs')).confirmPage(cat, { ...ask, state: result.ok ? 'done' : 'failed', result });
   }
   return null;
 }
 
-/** Asset-only capability: cannot authenticate records, tools or room sockets. */
-export async function appAssetTicket(env, app, ticket) {
-  const key=await officeKey(env);if(!key)return null;
-  if(ticket===undefined) {
-    const exp=(Date.now()+5*60_000).toString(36);
-    return `${exp}.${(await mac(key,`app-assets|${app}|${exp}`)).slice(0,32)}`;
+/** Encrypted, HMAC-authenticated asset capability. Session hashes never enter URLs in plaintext.
+ * Every use checks revocation, grants and role-link rotation in one D1 statement.
+ */
+export async function appAssetTicket(env, app, ticket, {request,meta,launch=meta?.launch??'public',expectedRole,purpose='asset',renew=false}={}) {
+  const key=await officeKey(env),issuing=ticket===undefined,denied=issuing?null:false;
+  if(!key||!meta)return denied;
+  const decode=text=>Uint8Array.from(atob(text.replaceAll('-','+').replaceAll('_','/')),c=>c.charCodeAt(0));
+  const cipher=await crypto.subtle.importKey('raw',decode(await mac(key,'app-assets-encryption-v1')),'AES-GCM',false,['encrypt','decrypt']);
+  let data;
+  if(issuing) {
+    if(!request)return null;
+    const url=new URL(request.url),{appRole}=await import('./app-format.mjs');
+    const role=appRole(meta,url),rights=meta.roles?.[role];if(!rights)return null;
+    const owner=cookieValues(request,OWNER_COOKIE)[0],player=cookieValues(request,'studio_player')[0],pass=cookieValues(request,passCookie(app))[0],caller=toolIdentity(request);
+    data={purpose,exp:Date.now()+5*60_000,role,rights:await sha256(JSON.stringify(rights)),hash:null,pass:pass?await sha256(pass):null,connection:null,person:null};
+    if(owner||player){data.kind=owner?'owner':'player';data.hash=await sha256(owner??player);}
+    else if(caller){
+      if(caller.localTest&&(env.HOMIE_LOCAL_TEST_SECRET||caller.remoteTest)&&caller.roles?.[app]?.includes(role)){data.kind='test';data.testApp=caller.testApp??app;}
+      else {data.kind='tool';data.connection=caller.connection??null;data.person=caller.id??null;if(data.person?.startsWith('office-'))data.hash=data.person.slice(7);}
+    } else if(launch==='invite'&&!rights.signIn&&pass){data.kind='pass';}
+    else {
+      const session=await (await import('./local-test.mjs')).localSession(request,env);
+      if(session?.app!==app||session.role!==role)return null;
+      data.kind='test';data.testApp=app;data.exp=Math.min(data.exp,session.expires??data.exp);
+    }
+  } else {
+    try {
+      const [iv,payload,signature,...extra]=ticket.split('.');
+      if(extra.length||!signature||!same(await mac(key,`app-assets|${app}|${iv}|${payload}`),signature))return false;
+      data=JSON.parse(new TextDecoder().decode(await crypto.subtle.decrypt({name:'AES-GCM',iv:decode(iv)},cipher,decode(payload))));
+    }catch{return false;}
   }
-  const m=/^([a-z0-9]+)\.([A-Za-z0-9_-]{32})$/.exec(ticket);
-  return Boolean(m && parseInt(m[1],36)>Date.now() && same((await mac(key,`app-assets|${app}|${m[1]}`)).slice(0,32),m[2]));
+  if(data.kind==='test') {
+    const session=request&&await (await import('./local-test.mjs')).localSession(request,env);
+    if(!issuing&&(!session||session.app!==app||session.role!==data.role||(session.scope??null)!==data.testScope))return denied;
+    if(issuing)data.testScope=session?.scope??toolIdentity(request)?.testScope??null;
+  }
+  if(data.purpose!==purpose||(purpose==='handoff'&&!['owner','player'].includes(data.kind)))return denied;
+  if(expectedRole&&data.role!==expectedRole)return denied;
+  if(!Number.isSafeInteger(data.exp)||data.exp<=Date.now()||data.exp>Date.now()+5*60_000||!meta.roles?.[data.role]||data.rights!==await sha256(JSON.stringify(meta.roles[data.role])))return denied;
+  const state=await env.DB.prepare(`SELECT
+    (SELECT token FROM app_role_links WHERE app=?1 AND role=?2) link,
+    EXISTS(SELECT 1 FROM stats_keys WHERE hash=?3 AND kind='session' AND expires_at>?4) owner,
+    EXISTS(SELECT 1 FROM office_passes p JOIN office_invites i ON i.id=p.invite WHERE p.hash=?5 AND p.game=?1 AND p.expires_at>?4 AND i.revoked=0) pass,
+    (SELECT p.id FROM players p WHERE p.id=(SELECT player FROM player_sessions WHERE hash=?3 AND kind='session' AND expires_at>?4)) player,
+    EXISTS(SELECT 1 FROM players p WHERE p.owner=1 AND (p.id=(SELECT player FROM player_sessions WHERE hash=?3 AND kind='session' AND expires_at>?4) OR p.id=?6)) playerOwner,
+    EXISTS(SELECT 1 FROM app_roles WHERE app IN (?1,'*') AND role=?2 AND player IN (?6,(SELECT player FROM player_sessions WHERE hash=?3 AND kind='session' AND expires_at>?4))) granted,
+    EXISTS(SELECT 1 FROM mcp_connections WHERE id=?7 AND person=?6 AND revoked=0) connected
+  `).bind(app,data.role,data.hash??null,Date.now(),data.pass??null,data.person??null,data.connection??null).first();
+  if(issuing&&purpose==='asset'&&launch==='invite'&&!meta.roles[data.role].signIn&&state.pass)data.kind='pass';
+  const gate=state.owner||state.playerOwner||launch==='public'||launch==='invite'&&state.pass;
+  const roleAllowed=!meta.roles[data.role].signIn||state.owner||state.playerOwner||state.granted;
+  const authorized=data.kind==='owner'?state.owner:data.kind==='pass'?launch==='invite'&&!meta.roles[data.role].signIn&&state.pass:data.kind==='player'?state.player&&gate&&roleAllowed:data.kind==='tool'?state.connected&&gate&&roleAllowed:data.kind==='test'?data.testApp===app:false;
+  if(!authorized)return denied;
+  const link=state.link?await sha256(state.link):null;
+  if(!issuing) {
+    if(data.link!==link)return denied;
+    if(!renew||purpose!=='handoff')return true;
+    data.exp=Date.now()+5*60_000;
+  }
+  data.link=link;
+  const iv=crypto.getRandomValues(new Uint8Array(12)),ivText=b64url(iv);
+  const payload=b64url(new Uint8Array(await crypto.subtle.encrypt({name:'AES-GCM',iv},cipher,new TextEncoder().encode(JSON.stringify(data)))));
+  return `${ivText}.${payload}.${await mac(key,`app-assets|${app}|${ivText}|${payload}`)}`;
 }
 
 /** Owner-issued test role, scoped to one app/record namespace; never an owner credential. */
@@ -1404,3 +1459,19 @@ export async function checkSessionTicket(env, data, token) {
   return session;
  }catch{return null;}
 }
+
+/** Same-origin role handoff for opening another screen, never the long-lived role URL secret. */
+export async function appRoleSession(response,request,env,meta,launch) {
+ if(meta.kind!=='app')return response;
+ const {appRole}=await import('./app-format.mjs'),role=appRole(meta,new URL(request.url));
+ if(!meta.roles?.[role]?.signIn)return response;
+ const handoff=cookieValues(request,`studio_app_${meta.id}_${role}`)[0];
+ const ticket=(handoff&&await appAssetTicket(env,meta.id,handoff,{request,meta,launch,purpose:'handoff',expectedRole:role,renew:true}))||await appAssetTicket(env,meta.id,undefined,{request,meta,launch,purpose:'handoff'});
+ if(ticket) {
+  response=new Response(response.body,{status:response.status,statusText:response.statusText,headers:response.headers});
+  // LAN dev uses HTTP: a Secure cookie is discarded before the shell removes access.
+  const secure=new URL(request.url).protocol==='https:'?'; Secure':'';
+  response.headers.append('set-cookie',`studio_app_${meta.id}_${role}=${ticket}; Path=/${meta.id}/; Max-Age=300; HttpOnly${secure}; SameSite=Strict`);
+ }
+ return response;
+}

package/worker/operational-schema.mjs

@@ -0,0 +1,44 @@
+export const OPERATIONAL_MIGRATION_FILE='0031_request_and_tool_notifications.sql';
+export const OPERATIONAL_MIGRATION=`
+-- Removed features are cleaned once, never on the request path.
+DELETE FROM meta WHERE key GLOB 'referral_*' OR key GLOB 'referral-*';
+INSERT OR IGNORE INTO meta(key,value) VALUES('tool-data-revision','0');
+${['INSERT','UPDATE','DELETE'].map(op=>`CREATE TRIGGER tool_data_live_${op.toLowerCase()} AFTER ${op} ON tool_data BEGIN
+ UPDATE meta SET value=CAST(value AS INTEGER)+1 WHERE key='tool-data-revision';
+END;`).join('\n')}
+`;
+
+export const CACHE_MIGRATION_FILE='0032_metadata_revisions.sql';
+export const CACHE_MIGRATION=`
+INSERT OR IGNORE INTO meta(key,value) VALUES('metadata-revision','0');
+${['office_games','servers','chat_rules'].flatMap(table=>['INSERT','UPDATE','DELETE'].map(op=>`CREATE TRIGGER ${table}_revision_${op.toLowerCase()} AFTER ${op} ON ${table} BEGIN
+ UPDATE meta SET value=CAST(value AS INTEGER)+1 WHERE key='metadata-revision';
+END;`)).join('\n')}
+`;
+export const TOOL_NAMESPACE_MIGRATION_FILE='0033_tool_namespace_revisions.sql';
+export const TOOL_NAMESPACE_MIGRATION=`
+DROP TRIGGER tool_data_live_insert;
+DROP TRIGGER tool_data_live_update;
+DROP TRIGGER tool_data_live_delete;
+DELETE FROM meta WHERE key='tool-data-revision';
+CREATE TABLE tool_data_revisions(namespace TEXT PRIMARY KEY,revision INTEGER NOT NULL);
+CREATE TABLE app_tool_namespaces(app TEXT NOT NULL,namespace TEXT NOT NULL,PRIMARY KEY(app,namespace));
+${['INSERT','UPDATE','DELETE'].map(op=>{const row=op==='DELETE'?'OLD':'NEW';return `CREATE TRIGGER tool_data_namespace_${op.toLowerCase()} AFTER ${op} ON tool_data BEGIN
+ INSERT INTO tool_data_revisions VALUES(${row}.namespace,1) ON CONFLICT(namespace) DO UPDATE SET revision=revision+1;
+ ${op==='UPDATE'?`INSERT INTO tool_data_revisions SELECT OLD.namespace,1 WHERE OLD.namespace!=NEW.namespace ON CONFLICT(namespace) DO UPDATE SET revision=revision+1;`:''}
+END;`;}).join('\n')}
+`;
+
+export const RUNTIME_INDEX_MIGRATION_FILE='0034_runtime_indexes.sql';
+export const RUNTIME_INDEX_MIGRATION=`-- Older stream registrations used milliseconds; OAuth and dedupe already use seconds.
+UPDATE mcp_kv SET expires=CAST(expires / 1000 AS INTEGER) WHERE expires>100000000000 AND (key GLOB 'tools-stream:*' OR key GLOB 'mcp-event-stream:*');
+CREATE INDEX IF NOT EXISTS mcp_kv_expires ON mcp_kv(expires) WHERE expires IS NOT NULL;
+`;
+
+export const EXTRA_RUNTIME_MIGRATIONS={
+  "0035_payment_delivery.sql":`CREATE TABLE IF NOT EXISTS stripe_intake(id TEXT PRIMARY KEY,payload TEXT NOT NULL,origin TEXT NOT NULL,received INTEGER NOT NULL,lease INTEGER NOT NULL DEFAULT 0,done INTEGER);
+CREATE INDEX IF NOT EXISTS stripe_intake_pending ON stripe_intake(lease,received,id) WHERE done IS NULL;
+CREATE INDEX IF NOT EXISTS stripe_intake_done ON stripe_intake(done) WHERE done IS NOT NULL;
+CREATE INDEX IF NOT EXISTS shop_events_at ON shop_events(at);
+`,
+};

package/worker/page-policy.mjs

@@ -0,0 +1,29 @@
+import {STUDIO_VERSION_TAG} from './version.mjs';
+import {playerAncestors} from './embed.mjs';
+export function shellKey(g) {
+  // Never what names a build (the rules' build and state hashes, the bundle's version): those change with every
+  // edit, and a newer build of the same game inside the same page is exactly what the frame's own reload is for.
+  const { build: _build, stateHash: _state, ...room } = g?.room ?? {};
+  const { version: _version, ...netplay } = g?.netplay ?? {};
+  const text = JSON.stringify([g?.kind ?? null, g?.players ?? null, room, g?.saves ?? null, g?.agents ?? null, g?.screen ?? null, netplay, g?.launch ?? null]);
+  let h = 2166136261;
+  for (let i = 0; i < text.length; i += 1) { h ^= text.charCodeAt(i); h = Math.imul(h, 16777619); }
+  return `${STUDIO_VERSION_TAG}-${(h >>> 0).toString(36)}`;
+}
+export function shellStandIn(room, key) {
+  const message = key ? { t: 'homie-net', what: 'shell', key } : { t: 'homie-net', what: 'rematch', room };
+  return `<!doctype html><meta charset="utf-8"><title>Updating</title><body style="margin:0;background:#0b0d14;color:#cfd6e6;font:15px system-ui;display:grid;place-items:center;height:100vh"><p>This game was updated. Loading it again…</p><script>try{parent.postMessage(${JSON.stringify(message).replace(/</g, '\\u003c')},'*');}catch(e){}</script>`;
+}
+export const ROOM_ID = /^[A-Za-z0-9_-]{1,32}$/;
+export function frameAncestors(cat) {
+  const extra = (Array.isArray(cat?.studio?.site?.frameAncestors) ? cat.studio.site.frameAncestors : [])
+    .map((o) => { try { const u = new URL(String(o)); return u.protocol === 'https:' && u.origin === String(o).replace(/\/+$/, '') ? u.origin : null; } catch { return null; } })
+    .filter(Boolean).slice(0, 8);
+  return ["'self'", ...extra].join(' ');
+}
+export function embedAncestors(cat, origin, preview = false) {
+  const normal = playerAncestors(cat);
+  if (!preview || !/^http:\/\/(?:localhost|127\.0\.0\.1)(?::\d+)?$/.test(origin)) return normal;
+  const port = new URL(origin).port;
+  return `${normal === "'none'" ? '' : normal} http://localhost${port ? ':' + port : ''} http://127.0.0.1${port ? ':' + port : ''}`.trim();
+}

package/worker/pages.mjs

@@ -1,3 +1,5 @@
+import {ROOM_ID,shellKey,shellStandIn,frameAncestors,embedAncestors} from './page-policy.mjs';
+export {ROOM_ID,shellKey,shellStandIn,frameAncestors,embedAncestors} from './page-policy.mjs';
 import {JOIN_AREA_SHELL_JS} from './join-area.mjs';
 import { appWords, openPath } from './app-format.mjs';
 import { APP_SHELL_JS } from './app-shell.mjs';
@@ -7,7 +9,7 @@ import { APP_SHELL_JS } from './app-shell.mjs';
  */
 import { playerAncestors, PLAYER_SANDBOX, PLAYER_SIZE } from './embed.mjs';
 import { esc, layout, gameSocialTags } from './site.mjs';
-import { NET_PALETTE } from './room.mjs';
+import { NET_PALETTE } from './room-protocol.mjs';
 import { PARAM_VALUE, PREFS_LIMITS, playParams } from './seats.mjs';
 import { STUDIO_VERSION_TAG } from './version.mjs';
 
@@ -19,26 +21,14 @@ import { STUDIO_VERSION_TAG } from './version.mjs';
  * instead of hosting a newer game inside a page that lacks what that game needs (a player ticket, for one).
  * It does not change when only the game's code or art does: that is still a reload of the frame alone.
  */
-export function shellKey(g) {
-  // Never what names a build (the rules' build and state hashes, the bundle's version): those change with every
-  // edit, and a newer build of the same game inside the same page is exactly what the frame's own reload is for.
-  const { build: _build, stateHash: _state, ...room } = g?.room ?? {};
-  const { version: _version, ...netplay } = g?.netplay ?? {};
-  const text = JSON.stringify([g?.kind ?? null, g?.players ?? null, room, g?.saves ?? null, g?.agents ?? null, g?.screen ?? null, netplay, g?.launch ?? null]);
-  let h = 2166136261;
-  for (let i = 0; i < text.length; i += 1) { h ^= text.charCodeAt(i); h = Math.imul(h, 16777619); }
-  return `${STUDIO_VERSION_TAG}-${(h >>> 0).toString(36)}`;
-}
+
 /**
  * The frame's stand-in when its page is older than the game it would host. It tells the page, and loads no game.
  * `key`: the page understands the handshake and reloads itself once. No key: a page from before the handshake, whose
  * only way to load a whole new page is the one it has for leaving a finished room; it is used only when the game cannot
  * work inside that page at all.
  */
-export function shellStandIn(room, key) {
-  const message = key ? { t: 'homie-net', what: 'shell', key } : { t: 'homie-net', what: 'rematch', room };
-  return `<!doctype html><meta charset="utf-8"><title>Updating</title><body style="margin:0;background:#0b0d14;color:#cfd6e6;font:15px system-ui;display:grid;place-items:center;height:100vh"><p>This game was updated. Loading it again…</p><script>try{parent.postMessage(${JSON.stringify(message).replace(/</g, '\\u003c')},'*');}catch(e){}</script>`;
-}
+
 import { SKILLS } from './agents.mjs';
 import { KIDS_LINE, POLICY_WORDS } from './servers.mjs';
 import { SAVES_SHELL_CSS, SAVES_SHELL_JS } from './saves-shell.mjs';
@@ -49,18 +39,13 @@ import { ARRIVAL_JS, arrivalCard } from './arrival.mjs';
 export { homePage, mediaIndexPage, notFoundPage, songPage, videoPage } from './site.mjs';
 
 /** A room code: 1 to 32 letters, digits, - or _. */
-export const ROOM_ID = /^[A-Za-z0-9_-]{1,32}$/;
+
 
 /**
  * Who may put the play page (and so the game) inside a frame: this site, plus the https origins studio.json
  * `site.frameAncestors` names (for example a hub that embeds the game). Anything else is refused by the browser.
  */
-export function frameAncestors(cat) {
-  const extra = (Array.isArray(cat?.studio?.site?.frameAncestors) ? cat.studio.site.frameAncestors : [])
-    .map((o) => { try { const u = new URL(String(o)); return u.protocol === 'https:' && u.origin === String(o).replace(/\/+$/, '') ? u.origin : null; } catch { return null; } })
-    .filter(Boolean).slice(0, 8);
-  return ["'self'", ...extra].join(' ');
-}
+
 
 /** What a play, big-screen or watch page answers to a room code it cannot use: said on the page, never a silent public room. */
 export function badRoomPage(cat, g, raw, { screen = false, watch = false } = {}) {
@@ -494,7 +479,13 @@ const SHELL_JS = String.raw`${BUILD_RETRY_JS}(function () {
     ui.querySelector('[data-room-code]').textContent = labelOf(room) + (boot.embed ? ' \u00b7 Site' : '');
     ui.querySelector('[data-room-label]').textContent = labelOf(room);
     ui.querySelector('[data-room-link]').textContent = LOCAL ? 'Deploy to share: this preview address works on this computer only.' : link.replace(/^https?:\/\//, '');
-    ui.querySelector('[data-bigscreen]').href = '/' + boot.game + '/tv?room=' + encodeURIComponent(room);
+    var tv = new URL('/' + boot.game + '/tv', location.origin);
+    tv.searchParams.set('room', room);
+    if (boot.kind === 'app') {
+      var context = new URLSearchParams(location.search);
+      ['role'].forEach(function (key) { if (context.has(key)) tv.searchParams.set(key, context.get(key)); });
+    }
+    ui.querySelector('[data-bigscreen]').href = tv.pathname + tv.search;
     toggle.addEventListener('click', function (e) { e.stopPropagation(); open(sheet.hidden); });
     ui.querySelector('[data-invite]').addEventListener('click', function () {
       var data = { title: boot.name, text: (boot.appWords ? boot.appWords.open : 'Play') + ' ' + boot.name + ' with me: join my room.', url: link };
@@ -1590,12 +1581,7 @@ const WATCH_JS = String.raw`${BUILD_RETRY_JS}(function () {
   }
 }());`;
 
-export function embedAncestors(cat, origin, preview = false) {
-  const normal = playerAncestors(cat);
-  if (!preview || !/^http:\/\/(?:localhost|127\.0\.0\.1)(?::\d+)?$/.test(origin)) return normal;
-  const port = new URL(origin).port;
-  return `${normal === "'none'" ? '' : normal} http://localhost${port ? ':' + port : ''} http://127.0.0.1${port ? ':' + port : ''}`.trim();
-}
+
 
 export function embedPreview(cat, g, origin) {
   const frameOrigin = new URL(origin); frameOrigin.hostname = frameOrigin.hostname === 'localhost' ? '127.0.0.1' : 'localhost';

package/worker/parts.mjs

@@ -17,7 +17,8 @@ import { esc, icon, layout, notFoundPage } from './site.mjs';
 const PART_ID = /^[a-z0-9][a-z0-9-]{0,47}$/;
 const VERSION = /^\d{1,6}\.\d{1,6}\.\d{1,6}(?:-[0-9A-Za-z.-]{1,40})?$/;
 /** A packed part's files: framed by the part's own page and by the hub, so they keep their own frame rule (index.mjs finish). */
-export const PART_FILES = /^\/parts\/[a-z0-9][a-z0-9-]{0,47}\/\d{1,6}\.\d{1,6}\.\d{1,6}[^/]*\//;
+import {PART_FILES} from './asset-paths.mjs';
+export {PART_FILES} from './asset-paths.mjs';
 export const PARTS_WELL_KNOWN = '/.well-known/homie-parts.json';
 export const isPartsPath = (path) => path === '/openapi.json' || path === '/.well-known/api-catalog' || path === '/parts/catalog.json' || path === '/purchases/keys.json' || path === PARTS_WELL_KNOWN || path === '/parts' || path.startsWith('/parts/');
 

package/worker/payment-recovery.mjs

@@ -2,13 +2,13 @@ import { pendingJobsSQL, definitiveRefusal, REPLAY_LIMIT_MS, recoveryAction } fr
 import { orderFact, recordOrderState, releaseClaim } from './purchase-core.mjs';
 import { resumeSettlement } from './settlement-journal.mjs';
 /** Durable provider recordings outlive responses. A verified chain transfer is payment. */
-import { stripeCall, refundPayment, modeOf } from './stripe.mjs';
+import { stripeCall, refundPayment, modeOf, STRIPE_VERSION } from './stripe.mjs';
 import { byId, resourceAvailable } from './purchase-store.mjs';
 export async function saveRecording(env, order, params, options) {
   const chain = params.payment_method_options?.crypto?.transaction_verification_options;
   const id = chain ? `${order.id}:${chain.network}:${chain.transaction_hash}` : options.idempotencyKey;
   await env.DB.prepare("INSERT OR IGNORE INTO purchase_jobs (id,order_id,mode,state,payload,updated_at) VALUES (?1,?2,?3,?4,?5,?6)")
-    .bind(id, order.id, order.mode, chain ? 'paid_recording' : 'submitted', JSON.stringify({ params, options: { ...options, idempotencyKey: chain ? chain.transaction_hash : options.idempotencyKey }, chain, startedAt: Date.now() }), Date.now()).run();
+    .bind(id, order.id, order.mode, chain ? 'paid_recording' : 'submitted', JSON.stringify({ params, options: { ...options, version: options.version ?? options.apiVersion ?? STRIPE_VERSION, idempotencyKey: chain ? chain.transaction_hash : options.idempotencyKey }, chain, startedAt: Date.now() }), Date.now()).run();
   if (chain) {
     // Only the protocol's verified settlement callback reaches here, never buyer input.
     await orderFact(env, order.id, 'payment', {paid_at: Date.now()}).run();
@@ -16,6 +16,11 @@ export async function saveRecording(env, order, params, options) {
   }
   return id;
 }
+/** Persist the provider id before any follow-up retrieve/cancel/fulfillment call. */
+export async function recordProviderId(env, order, id, pi) {
+  if (!/^pi_[A-Za-z0-9]+$/.test(pi.id) || pi.amount !== order.amount || pi.currency !== order.currency || pi.livemode !== (order.mode === 'live')) throw new Error('Provider receipt does not match order');
+  await env.DB.prepare('UPDATE purchase_jobs SET payment=?2,updated_at=?3 WHERE id=?1').bind(id,pi.id,Date.now()).run();
+}
 export async function recordProviderResult(env, order, id, pi) {
   if (pi.amount !== order.amount || pi.currency !== order.currency || pi.livemode !== (order.mode === 'live')) throw new Error('Provider receipt does not match order');
   await env.DB.prepare("UPDATE purchase_jobs SET payment = ?2, state = ?3, error = NULL, updated_at = ?4 WHERE id = ?1").bind(id, pi.id, pi.status === 'succeeded' ? 'recorded' : ['canceled','requires_payment_method'].includes(pi.status) ? 'failed' : 'processing', Date.now()).run();
@@ -37,31 +42,40 @@ export async function recordingFailure(env, id, error) {
     await env.DB.prepare("UPDATE purchase_jobs SET state = 'failed', error = ?2, attempts = attempts + 1, updated_at = ?3 WHERE id = ?1 AND state = 'submitted'").bind(id, String(error.message).slice(0, 500), Date.now()).run();
     return;
   }
+  if(error.manualReview) {
+    await env.DB.prepare("UPDATE purchase_jobs SET state='manual_review',error=?2,updated_at=?3 WHERE id=?1").bind(id,error.message,Date.now()).run();
+    return;
+  }
   // A failure of our call is not a fact about the original payment.
   await env.DB.prepare("UPDATE purchase_jobs SET error = ?2, attempts = attempts + 1, updated_at = ?3 WHERE id = ?1")
     .bind(id, String(error.message).slice(0, 500), Date.now()).run();
 }
 
-/** Read existing objects first. Listing avoids the search index's delayed negative answers. */
+/** Read the recorded object, or recover a lost create response with its original key. */
 export async function readProviderPayment(env, order, job, payment = null) {
-  const options = { version: '2026-07-29.preview' };
+  const readOptions = { version: STRIPE_VERSION };
   if (payment && !/^pi_[A-Za-z0-9]+$/.test(payment)) throw new Error('Supply an existing Stripe PaymentIntent id');
   if (job.payment || payment) {
-    const pi = await stripeCall(env, 'GET', `/v1/payment_intents/${encodeURIComponent(job.payment ?? payment)}`, null, options);
+    const pi = await stripeCall(env, 'GET', `/v1/payment_intents/${encodeURIComponent(job.payment ?? payment)}`, null, readOptions);
     if (pi.metadata?.order !== order.id) throw new Error('The existing PaymentIntent belongs to another order');
     return pi;
   }
-  let cursor;
-  for (let page = 0; page < 100; page++) {
-    const result = await stripeCall(env, 'GET', '/v1/payment_intents', { limit: 100, created: { gte: Math.floor(order.created_at / 1000) - 60 }, ...(cursor ? { starting_after: cursor } : {}) }, options);
-    if (!Array.isArray(result.data)) throw new Error('Stripe did not return an existing-payment list');
-    const found = result.data.find((pi) => pi.metadata?.order === order.id);
-    if (found) return found;
-    if (!result.has_more) return null;
-    cursor = result.data.at(-1)?.id;
-    if (!cursor) throw new Error('Stripe payment list has no continuation');
+  const {params,options,startedAt}=JSON.parse(job.payload??'{}');
+  if(params&&options?.idempotencyKey&&Date.now()-(startedAt??order.created_at)<REPLAY_LIMIT_MS) {
+    // If the create response was lost, replay only the original request/key
+    // inside Stripe's guaranteed retention window. Never scan the account.
+    const version=options.version ?? options.apiVersion;
+    if(!version) {
+      const error=new Error('Original Stripe API version is missing; reconcile this retained order with an existing PaymentIntent id instead of replaying an uncertain request.');
+      error.manualReview=true;throw error;
+    }
+    const pi=await stripeCall(env,'POST','/v1/payment_intents',params,{...options,version});
+    await recordProviderId(env,order,job.id,pi);
+    return pi;
   }
-  throw new Error(`Existing payment scan exceeded 100 pages for order ${order.id}; the owner must reconcile this order.`);
+  const error=new Error(`PaymentIntent id missing after the safe replay window for order ${order.id}; reconcile with an existing PaymentIntent id. The order and its claim are retained.`);
+  error.manualReview=true;
+  throw error;
 }
 async function releaseUnpaid(env, order, job, pi = null) {
   await env.DB.batch([
@@ -87,18 +101,18 @@ export async function reconcileRecordings(env, orderId = null, dependencies = {}
       switch (recoveryAction(observation)) {
         case 'fail':
           if (pi?.status === 'requires_payment_method') {
-            pi = await stripeCall(env, 'POST', `/v1/payment_intents/${encodeURIComponent(pi.id)}/cancel`, {}, { idempotencyKey: `cancel-action-${pi.id}`, version: '2026-07-29.preview' });
+            pi = await stripeCall(env, 'POST', `/v1/payment_intents/${encodeURIComponent(pi.id)}/cancel`, {}, { idempotencyKey: `cancel-action-${pi.id}`, version: STRIPE_VERSION });
             if (pi.status !== 'canceled') throw new Error('The unpaid payment could not be canceled; the claim remains reserved');
           }
           await releaseUnpaid(env, order, job, pi); continue;
-        case 'replay': pi = await stripeCall(env, 'POST', '/v1/payment_intents', params, { ...options, version: '2026-07-29.preview' }); break;
+        case 'replay': pi = await stripeCall(env, 'POST', '/v1/payment_intents', params, { ...options, version: options.version ?? options.apiVersion ?? STRIPE_VERSION }); break;
         default:
           if (!pi) {
             if (deadline) throw new Error(`Paid transfer still needs recording: order ${order.id}; key ${options.idempotencyKey}`);
-            pi = await stripeCall(env, 'POST', '/v1/payment_intents', params, { ...options, version: '2026-07-29.preview' });
+            pi = await stripeCall(env, 'POST', '/v1/payment_intents', params, { ...options, version: options.version ?? options.apiVersion ?? STRIPE_VERSION });
           }
       }
-      if (['requires_action','requires_confirmation','requires_capture','requires_payment_method'].includes(pi.status) || orderId && dependencies.cancel === true && pi.status === 'processing') pi = await stripeCall(env, 'POST', `/v1/payment_intents/${encodeURIComponent(pi.id)}/cancel`, {}, { idempotencyKey: `cancel-action-${pi.id}`, version: '2026-07-29.preview' });
+      if (['requires_action','requires_confirmation','requires_capture','requires_payment_method'].includes(pi.status) || orderId && dependencies.cancel === true && pi.status === 'processing') pi = await stripeCall(env, 'POST', `/v1/payment_intents/${encodeURIComponent(pi.id)}/cancel`, {}, { idempotencyKey: `cancel-action-${pi.id}`, version: STRIPE_VERSION });
       await recordProviderResult(env, order, job.id, pi);
       if (['canceled','requires_payment_method'].includes(pi.status)) { await releaseUnpaid(env, order, job, pi); continue; }
       if (pi.status !== 'succeeded') {

package/worker/player-registry.mjs

@@ -0,0 +1,9 @@
+export let players = null;
+let configured=false;
+/**
+ * The player-accounts API, handed over once by a studio's Worker that has it:
+ * `{ get(id, env), of?(request, env), isOwner?(request, env) }` (worker/players.mjs `players` is exactly this).
+ */
+export function usePlayers(api) { configured=true; players = api && typeof api === 'object' ? api : null; }
+
+export function defaultPlayers(api) { if(!configured)players=api; }