@homie-rocks/studio 0.53.0 → 0.55.0

package/worker/players.mjs

@@ -25,12 +25,12 @@ import { toolIdentity } from './tool-identity.mjs';
  * THE OWNER sees counts and names (`players.count`, `players.list`), never a passkey, a session or an email.
  * A player sees, downloads (/api/player/export) and deletes (/api/player/delete) everything of theirs.
  */
-import { handleFor } from './room.mjs';
+import { handleFor } from './room-protocol.mjs';
 import { isAiName } from './agents.mjs';
 import { cookieValue } from './stats.mjs';
 import { adoptGuest, bumpPlayerStats, dropPlayerData, fall, fallenList, getSave, listSaves, playerData, readPlayerStats, SAVE_LIMITS, savesSummary, wipeSaves, writeSaves } from './saves.mjs';
 import { bytesToB64url, randomToken, sha256Hex, verifyAssertion, verifyRegistration } from './webauthn.mjs';
-import { ACCOUNT_JS, accountPage } from './account-page.mjs';
+
 import { adoptShopStatements, migrated as shopMigrated, forgetPlayerShop, livePurchases, shopDataOf } from './shop-store.mjs';
 import { forgetPlayerHistory, playerHistory } from './lounge-store.mjs';
 
@@ -230,7 +230,7 @@ async function sessionOf(request, env, url = new URL(request.url)) {
     writes.push(env.DB.prepare('UPDATE player_sessions SET expires_at = ?2 WHERE hash = ?1').bind(hash, now + days * DAY));
     session.cookies.push(sessionCookie(url, token, days));
   }
-  if (writes.length) await env.DB.batch(writes).catch(() => {});
+  if (writes.length) await env.DB.batch(writes);
   return session;
 }
 
@@ -240,6 +240,8 @@ async function newGuest(request, env, url, addressLimit = PLAYER_LIMITS.newPlaye
   if (addressLimit !== null && limited(`${counter}:${ip}`, addressLimit, HOUR)) return { error: fail(429, 'rate', 'too many new players from this address; try again later') };
   const capped = (counter !== 'shop-new' || env.PLAYER_LIMIT_DAILY !== undefined) && await dailyCapReached(env);
   if (capped) return { error: fail(503, 'busy', 'this studio has taken all the new players it takes in one day; try again tomorrow') };
+  // Studios without scheduled functions still reclaim idle guests on this write path.
+  if (Math.random() < 0.02) await pruneGuests(env);
   const id = newPlayerId();
   const now = Date.now();
   const name = handleFor(id);
@@ -248,7 +250,6 @@ async function newGuest(request, env, url, addressLimit = PLAYER_LIMITS.newPlaye
     env.DB.prepare('INSERT INTO players (id, name, named, guest, owner, created_at, seen_at) VALUES (?1, ?2, 0, 1, 0, ?3, ?3)').bind(id, name, now),
     s.statement,
   ]);
-  if (Math.random() < 0.02) pruneGuests(env).catch(() => {});
   return { session: { player: { id, name, named: false, guest: true, owner: false, since: now }, cookies: [s.cookie], fresh: true } };
 }
 
@@ -472,12 +473,12 @@ async function gameOf(catalogueOf, id) {
 export async function playerRoutes(request, env, ctx, url, { catalogueOf }) {
   const path = url.pathname;
   const read = request.method === 'GET' || request.method === 'HEAD';
-  if (path === '/_homie/account.js') return new Response(ACCOUNT_JS, { headers: { 'content-type': 'text/javascript; charset=utf-8', 'cache-control': 'public, max-age=300', 'x-content-type-options': 'nosniff' } });
+  if (path === '/_homie/account.js') return new Response((await import('./account-page.mjs')).ACCOUNT_JS, { headers: { 'content-type': 'text/javascript; charset=utf-8', 'cache-control': 'public, max-age=300', 'x-content-type-options': 'nosniff' } });
   if (path === '/account') return Response.redirect(`${url.origin}/account/${url.search}`, 301);
   if (path === '/account/') {
     if (!read) return fail(405, 'method', 'GET only');
     const cat = await catalogueOf();
-    return accountPage(cat, { origin: url.origin, next: nextOf(url.searchParams.get('next')), owner: OWNER_KEY.test(url.searchParams.get('owner') ?? '') ? url.searchParams.get('owner') : null, link: LINK.test(url.searchParams.get('k') ?? '') ? url.searchParams.get('k') : null, mode: ['verify', 'recover'].includes(url.searchParams.get('do')) ? url.searchParams.get('do') : null, features: features(env) });
+    return (await import('./account-page.mjs')).accountPage(cat, { origin: url.origin, next: nextOf(url.searchParams.get('next')), owner: OWNER_KEY.test(url.searchParams.get('owner') ?? '') ? url.searchParams.get('owner') : null, link: LINK.test(url.searchParams.get('k') ?? '') ? url.searchParams.get('k') : null, mode: ['verify', 'recover'].includes(url.searchParams.get('do')) ? url.searchParams.get('do') : null, features: features(env) });
   }
   if (!path.startsWith('/api/player/')) return null;
   const f = features(env);
@@ -737,7 +738,7 @@ async function apiRoute(request, env, ctx, url, parts, { catalogueOf, read, f })
     const answer = json({ ok: true, message: 'If that address belongs to an account here, a link is on its way. It works once, for 30 minutes.' });
     if (!owner) return answer;
     const k = await issueChallenge(env, 'recover-link', owner.player, null, PLAYER_LIMITS.linkMinutes);
-    await sendMail(env, email, `Sign in to ${await studioName()}`, `Someone (hopefully you) asked to get back into your player account on ${await studioName()}.\n\nOpen this link on the device you want to use, and make a new passkey there:\n${url.origin}/account/?do=recover&k=${k}\n\nIt works once, for 30 minutes. If you did not ask, ignore this email: nothing changes.\n`).catch(() => {});
+    await sendMail(env, email, `Sign in to ${await studioName()}`, `Someone (hopefully you) asked to get back into your player account on ${await studioName()}.\n\nOpen this link on the device you want to use, and make a new passkey there:\n${url.origin}/account/?do=recover&k=${k}\n\nIt works once, for 30 minutes. If you did not ask, ignore this email: nothing changes.\n`).catch(error => console.warn("Recovery mail delivery failed:",error.message));
     return answer;
   }
 

package/worker/purchase-machine.mjs

@@ -1,7 +1,7 @@
 import { definitiveRefusal, blockingJobsSQL } from './payment-policy.mjs';
 import { orderFact, offerVersion, orderState } from './purchase-core.mjs';
 import { problem } from './purchase-problem.mjs';
-import { saveRecording, recordProviderResult, recordingFailure, reconcileRecordings } from './payment-recovery.mjs';
+import { saveRecording, recordProviderId, recordProviderResult, recordingFailure, reconcileRecordings } from './payment-recovery.mjs';
 import { machineCapabilities, notePaymentRefusal } from './payment-capabilities.mjs';
 import { purchaseResponse } from './purchase-response.mjs';
 /** One durable purchase, regardless of transport. No seller browser page is involved. */
@@ -262,12 +262,14 @@ function recordingClient(env, o, providerClient) {
   client.paymentIntents = Object.create(providerClient.paymentIntents);
   client.paymentIntents.create = async (params, options) => {
     params = { ...params, metadata: { ...params.metadata, homie: "purchase-v1", order: o.id } };
-    const id = await saveRecording(env, o, params, options);
+    const id = await saveRecording(env, o, params, { ...options, version: options?.apiVersion ?? providerClient.getApiField?.('version') });
     try {
       const saved = await env.DB.prepare('SELECT state,payload FROM purchase_jobs WHERE id = ?1').bind(id).first();
       if (saved.state === 'manual_review') throw new Error('Stripe recording was refused; the seller must handle any refund manually.');
       const original = JSON.parse(saved.payload);
-      let pi = await create(original.params, original.options);
+      const {version,...originalOptions}=original.options;
+      let pi = await create(original.params, { ...originalOptions, apiVersion: version });
+      await recordProviderId(env,o,id,pi);
       if (pi.status === 'processing') pi = await providerClient.paymentIntents.retrieve(pi.id);
       if (pi.status === 'requires_action') pi = await providerClient.paymentIntents.cancel(pi.id);
       await recordProviderResult(env, o, id, pi);

package/worker/reconcile-guard.mjs

@@ -0,0 +1,22 @@
+/** Private per-delivery fence, never a deploy binding. */
+export const RECONCILE_GUARD=Symbol('reconcileGuard');
+
+/** Statements may be prepared before an await, so check at execution, including batches. */
+export function guardedDatabase(db,check) {
+  const originals=new WeakMap();
+  const statement=raw=>{
+    const wrapped=new Proxy(raw,{get(target,key){
+      if(key==='bind')return (...args)=>statement(target.bind(...args));
+      if(['run','first','all','raw'].includes(key))return async(...args)=>{await check();return target[key](...args);};
+      return Reflect.get(target,key);
+    }});
+    originals.set(wrapped,raw);return wrapped;
+  };
+  return new Proxy(db,{get(target,key){
+    if(key==='prepare')return query=>statement(target.prepare(query));
+    if(key==='batch')return async statements=>{await check();return target.batch(statements.map(s=>originals.get(s)??s));};
+    if(key==='exec')return async(...args)=>{await check();return target.exec(...args);};
+    if(key==='withSession')return (...args)=>guardedDatabase(target.withSession(...args),check);
+    const value=Reflect.get(target,key);return typeof value==='function'?value.bind(target):value;
+  }});
+}

package/worker/request-db.mjs

@@ -0,0 +1,78 @@
+export const METADATA_REVISION=Symbol('metadata revision');
+export const ORIGINAL_DB=Symbol('original database');
+export const MUTATIONS=Symbol('request mutations');
+export const MUTATION_VERSION=Symbol('mutation version');
+export const databaseBinding=db=>db?.[ORIGINAL_DB]??db;
+const metadata=new WeakMap();
+const metadataQueries=new Set(['SELECT game, launch, max_players, updated_at FROM office_games LIMIT 500','SELECT * FROM servers LIMIT 2000','SELECT game, server, rules, updated_at FROM chat_rules LIMIT 1000']);
+/** Cache only completed metadata, stamped by a trigger-maintained revision. Pending
+ * D1 operations belong to one request. Cold metadata is one atomic batch.
+ */
+export function requestDatabase(DB, request, state={mutated:false}, binding=databaseBinding(DB)) {
+ if(!DB)return DB;
+ // Start at the primary so launch/role revocations are current. Later reads in
+ // this session may use replicas at or beyond that bookmark. This also meets
+ // any bookmark returned by an earlier request without trusting stale auth.
+ if(DB===binding&&typeof DB.withSession==='function')DB=DB.withSession('first-primary');
+ let revision,records,rows,liveRooms;
+ const prefetchRooms=false;
+ const url=new URL(request.url),match=request.method==='GET'&&/^\/([a-z0-9][a-z0-9-]{0,39})\/api\/app\/records\/([a-z][a-z0-9-]{0,39})(?:\/([A-Za-z0-9_-]{1,64}))?$/.exec(url.pathname);
+ const recordQuery=match&&(match[3]?'SELECT id, value, version, updated_at FROM app_records WHERE app = ?1 AND collection = ?2 AND id = ?3':'SELECT id, value, version, updated_at FROM app_records WHERE app = ?1 AND collection = ?2 ORDER BY updated_at, id');
+ const stamp=()=>revision??=(async()=>{
+  const query=DB.prepare("SELECT value FROM meta WHERE key='metadata-revision'");
+  const cached=metadata.get(binding);
+  // The revision and its rows must be from the same snapshot, including when
+  // another request changes metadata while this request is awaiting D1.
+  const queries=[...metadataQueries];
+  const cold=!cached;
+  const statements=[query,...(cold?queries.map(sql=>DB.prepare(sql)):[])];
+  if(recordQuery)statements.push(DB.prepare(recordQuery).bind(...match.slice(1).filter(x=>x!==undefined)));
+  if(prefetchRooms)statements.push(DB.prepare('SELECT game,rooms,updated FROM lobby_summaries LIMIT 500'));
+  const result=await DB.batch(statements);
+  if(prefetchRooms)liveRooms=result.at(-1);
+  let version=result[0].results?.[0]?.value??null;
+  if(recordQuery)records=result.at(-1);
+  if(cold)rows=new Map(queries.map((sql,i)=>[sql,result[i+1]]));
+  else if(cached.version===version)rows=cached.rows;
+  else {
+   const refreshed=await DB.batch([query,...queries.map(sql=>DB.prepare(sql))]);
+   version=refreshed[0].results?.[0]?.value??null;
+   rows=new Map(queries.map((sql,i)=>[sql,refreshed[i+1]]));
+  }
+  if(version!==null)metadata.set(binding,{version,rows});
+  return version;
+ })();
+ const writing=sql=>{if(!/^\s*(SELECT|PRAGMA|EXPLAIN)\b/i.test(sql)){if(/\bapp_records\b/.test(sql)){records=null;revision=null;}if(/\b(office_games|servers|chat_rules)\b/.test(sql)){revision=null;metadata.delete(binding);}if(!/\bstats_daily\b/.test(sql)){state.mutated=true;state.version=(state.version??0)+1;}}};
+ const prepare=(sql,args=[])=>{
+  const original=()=>{const stmt=DB.prepare(sql);return args.length?stmt.bind(...args):stmt;};
+  const read=async()=>{
+   if(sql==='SELECT game,rooms,updated FROM lobby_summaries LIMIT 500'&&prefetchRooms){await stamp();return liveRooms;}
+   if(sql===recordQuery&&JSON.stringify(args)===JSON.stringify(match.slice(1).filter(x=>x!==undefined))){await stamp();return records;}
+   if(!metadataQueries.has(sql))return original().all();
+   await stamp();
+   return rows.get(sql);
+  };
+  return {bind:(...args)=>prepare(sql,args),first:async column=>{writing(sql);if(!metadataQueries.has(sql)&&sql!==recordQuery)return original().first(column);const row=(await read()).results?.[0]??null;return column&&row?row[column]:row;},all:()=>{writing(sql);return read();},run:()=>{writing(sql);return original().run();},raw:(...args)=>{writing(sql);return original().raw(...args);},_original:original,_sql:sql};
+ };
+ const methods={[METADATA_REVISION]:stamp,[ORIGINAL_DB]:binding,get [MUTATIONS](){return state.mutated;},get [MUTATION_VERSION](){return state.version??0;},prepare,batch:statements=>{for(const s of statements)writing(s._sql??'UPDATE');return DB.batch(statements.map(s=>s._original?.()??s));},exec:(sql,...args)=>{writing(sql);return binding.exec(sql,...args);},withSession:(...args)=>requestDatabase(binding.withSession(...args),request,state,binding)};
+ return new Proxy(methods,{get(target,key){if(key in target)return target[key];const value=DB[key];return typeof value==='function'?value.bind(DB):value;}});
+}
+
+/** A background task may register more work while it settles. */
+export async function drainPending(pending) {
+ for(let done=0;done<pending.length;){const end=pending.length;await Promise.allSettled(pending.slice(done,end));done=end;}
+}
+
+/** Keep the runtime context intact and also deliver writes registered after the
+ * response's original drain finished (for example from response-stream work). */
+export function trackBackground(ctx,deliver) {
+ const pending=[];let finished=false;
+ const context=ctx?.waitUntil?new Proxy(ctx,{get(target,key){
+  if(key==='waitUntil')return work=>{
+   const task=Promise.resolve(work);pending.push(task);ctx.waitUntil(task);
+   if(finished)ctx.waitUntil(Promise.allSettled([task]).then(deliver));
+  };
+  const value=Reflect.get(target,key,target);return typeof value==='function'?value.bind(target):value;
+ }}):ctx;
+ return {context,async finish(){await drainPending(pending);finished=true;await deliver();}};
+}

package/worker/responses.mjs

@@ -0,0 +1,18 @@
+import {GAME_FILES,PART_FILES} from './asset-paths.mjs';
+export const json = (body, status = 200, extra = {}) => new Response(`${JSON.stringify(body)}\n`, {
+  status, headers: { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store', ...extra },
+});
+export function finish(res, path) {
+  if (!res || res.status === 101 || res.webSocket) return res;
+  if (!/text\/html/i.test(res.headers.get('content-type') ?? '')) return res;
+  const cache = res.headers.get('cache-control') ?? '';
+  const addNt = !/no-transform/i.test(cache);
+  // GAME PARTS: a shared part's preview page is framed by the part's page and the hub, sandboxed (worker/parts.mjs).
+  const playerFrame = /^\/[a-z0-9][a-z0-9-]{0,39}\/play\/embed$/.test('/' + path.split('/').filter(Boolean).join('/')) && res.status === 200 && /frame-ancestors/.test(res.headers.get('content-security-policy') ?? '');
+  const addXfo = !playerFrame && !res.headers.has('x-frame-options') && !GAME_FILES.test(path) && !PART_FILES.test(path);
+  if (!addNt && !addXfo) return res;
+  const headers = new Headers(res.headers);
+  if (addNt) headers.set('cache-control', cache ? `${cache}, no-transform` : 'no-transform');
+  if (addXfo) headers.set('x-frame-options', 'DENY');
+  return new Response(res.body, { status: res.status, statusText: res.statusText, headers });
+}

package/worker/room-chat.mjs

@@ -0,0 +1,216 @@
+/** Chat authorization, rate limits and history for a room. The relay owns its shared state. */
+
+
+
+
+
+import { CHAT_LIMITS, CHAT_RATES, HELD_WORDS, allows, cleanText, floor, normalizeChat, windowMsOf } from './chat.mjs';
+import { CONTROL_LIMITS, oneLine, handleFor, randomId } from './room-protocol.mjs';
+export class RoomChat {
+ constructor(room) {this.room=room;}
+chatRules() {
+    if (this.room.policy.chat) return this.room.policy.chat;
+    const sig = `${this.room.policy.kids}|${this.room.policy.speech}`;
+    if (!this.room.defaultChat || this.room.defaultChat.sig !== sig) this.room.defaultChat = { sig, rules: normalizeChat(null, { kids: this.room.policy.kids, speech: this.room.policy.speech }) };
+    return this.room.defaultChat.rules;
+  }
+recentChat(now = this.room.now()) {
+    const keep = windowMsOf(this.room.chatRules());
+    return this.room.chatLog.filter((r) => now - r.at <= keep).slice(-CHAT_LIMITS.keep);
+  }
+hydrate(recs) {
+    const have = new Set(this.room.chatLog.map((r) => r.id));
+    const old = (Array.isArray(recs) ? recs : []).filter((r) => r && typeof r.id === 'string' && !have.has(r.id));
+    this.room.chatLog = [...old, ...this.room.chatLog].sort((a, b) => a.at - b.at).slice(-CHAT_LIMITS.keep);
+    this.room.hydrated = true;
+    return old.length;
+  }
+wireLine(r) {
+    const base = { id: r.id, at: r.at, name: r.name, seat: r.seat, colour: r.colour, by: r.by, ...(r.bubble ? { bubble: true } : {}), ...(r.acct ? { acct: true } : {}), ...(r.owner ? { owner: true } : {}), ...(r.mod ? { mod: true } : {}), ...(r.kept ? { kept: true } : {}) };
+    if (r.kind === 'react') return { t: 'react', ...base, react: r.react, glyph: r.glyph };
+    // A show-what-you-made card (0.29.0): a page that knows cards draws one; any other shows its words.
+    return { t: 'line', ...base, text: r.text, ...(r.say ? { say: r.say } : {}), ...(r.kind === 'card' && r.card ? { card: r.card } : {}) };
+  }
+watchIdOf(conn) {
+    let id = this.room.watchIds.get(conn);
+    if (!id) { id = randomId(6); this.room.watchIds.set(conn, id); }
+    return id;
+  }
+chatter(client, conn) {
+    let g = client;
+    if (!g && conn) {
+      const mine = this.room.live().filter((o) => !o.agent && ((conn.browser && o.browser === conn.browser) || (conn.player && o.player === conn.player)));
+      g = mine.find((o) => o.seat !== null) ?? mine.find((o) => o.watch) ?? mine[0] ?? null;
+    }
+    const via = String(g?.via ?? conn?.via ?? '');
+    const owner = via.split('~').includes('o');
+    const seat = g ? g.seat : null;
+    const handle = handleFor(g?.token || g?.browser || conn?.browser || `w-${this.room.watchIdOf(conn ?? g?.conn ?? {})}`);
+    // A watcher's name: its game's, else the account name the Worker vouched for (the Lounge), else a handle.
+    const name = seat !== null ? g.name : oneLine(g?.typed, CHAT_LIMITS.name) || oneLine(conn?.name, CHAT_LIMITS.name) || handle;
+    return {
+      key: g ? `c:${g.id}` : `w:${this.room.watchIdOf(conn)}`, client: g, seat, name, colour: seat !== null ? g.colour : null,
+      player: g?.player ?? conn?.player ?? null, acct: Boolean(g?.acct || conn?.acct), member: Boolean(g?.member || conn?.member) || owner,
+      // A moderator the owner named (the Lounge): only the Worker's word, shown on their lines.
+      mod: Boolean(conn?.mod) && !owner,
+      owner, browser: g?.browser ?? conn?.browser ?? null, token: g?.token ?? null, ip: g?.ip ?? conn?.ip ?? null,
+      watch: seat === null, hub: Boolean(conn?.hub) && !g, agent: Boolean(g?.agent), conn: conn ?? g?.conn ?? null,
+    };
+  }
+takeToken(map, key, rate, now) {
+    let b = map.get(key);
+    if (!b) { b = { tokens: rate.burst, at: now }; map.set(key, b); }
+    b.tokens = Math.min(rate.burst, b.tokens + (now - b.at) / rate.refillMs);
+    b.at = now;
+    if (b.tokens < 1) return false;
+    b.tokens -= 1;
+    return true;
+  }
+onChat({ client = null, conn = null }, m) {
+    const now = this.room.now();
+    const rules = this.room.chatRules();
+    const who = this.room.chatter(client, conn);
+    const n = typeof m.n === 'string' && /^[A-Za-z0-9_-]{1,16}$/.test(m.n) ? m.n : null;
+    const kind = m.t === 'react' ? 'react' : typeof m.say === 'string' || typeof m.line === 'string' ? 'line' : 'text';
+    const stats = this.room.stats;
+    const reply = (why, extra = {}) => {
+      stats.chatHeld = stats.chatHeld ?? {};
+      stats.chatHeld[why] = (stats.chatHeld[why] ?? 0) + 1;
+      const out = JSON.stringify({ t: why === 'slow' ? 'slow' : 'held', why, message: HELD_WORDS[why] ?? HELD_WORDS.unknown, ...(n ? { n } : {}), ...extra });
+      if (who.conn) this.room.sendText(who.conn, out);
+      return { ok: false, why };
+    };
+    if (who.agent) return reply('ai_seat');
+    if (!allows(rules, kind)) return reply(rules.mode === 'off' ? 'off' : rules.mode === 'emoji' ? 'emoji' : 'lines');
+    if (who.hub && !rules.hub) return reply('hub');
+    if (who.watch && !rules.watchers && !who.owner) return reply('watchers');
+    const need = kind === 'text' ? rules.who : rules.react;
+    if (!who.owner && need === 'signed-in' && !who.acct) return reply(kind === 'text' ? 'sign-in' : 'sign-in-react');
+    if (!who.owner && need === 'members' && !who.member) return reply(kind === 'text' ? 'members' : 'members-react');
+    const mute = this.room.muteOf({ token: who.token, browser: who.browser, player: who.player });
+    if (mute) return reply('muted', { until: mute.until });
+    const b = this.room.chatBuckets.get(who.key) ?? { lastSayAt: -Infinity, lastText: '', lastTextAt: -Infinity };
+    this.room.chatBuckets.set(who.key, b);
+    if (!this.room.takeToken(this.room.chatBuckets, `${who.key}|${kind === 'react' ? 'react' : 'say'}`, kind === 'react' ? CHAT_RATES.react : CHAT_RATES.say, now)) return reply('slow');
+    if (who.ip && !this.room.takeToken(this.room.chatAddress, who.ip, CHAT_RATES.address, now)) return reply('slow');
+    if (kind !== 'react' && rules.slow && !who.owner && now - b.lastSayAt < rules.slow * 1000) return reply('slow', { until: b.lastSayAt + rules.slow * 1000, slow: rules.slow });
+    let rec;
+    if (kind === 'react') {
+      const k = String(m.kind ?? m.react ?? '');
+      const r = rules.emoji.find((x) => x.k === k);
+      if (!r) return reply('unknown');
+      // A storm of reactions: the room fans out at most so many a second (the sender's own still floats for them).
+      while (this.room.chatReacts.length && this.room.chatReacts[0] <= now - 1000) this.room.chatReacts.shift();
+      if (this.room.chatReacts.length >= CHAT_RATES.roomReactsPerSecond) { stats.chatDrops = (stats.chatDrops ?? 0) + 1; return { ok: true, dropped: true }; }
+      this.room.chatReacts.push(now);
+      rec = { kind: 'react', react: r.k, glyph: r.e };
+    } else if (kind === 'line') {
+      const id = String(m.say ?? m.line ?? '');
+      const l = rules.lines.find((x) => x.id === id);
+      if (!l) return reply('unknown');
+      rec = { kind: 'line', say: l.id, text: l.text };
+    } else {
+      const text = cleanText(m.text, rules.max);
+      if (!text) return reply('empty');
+      const f = floor(text, rules);
+      if (!f.ok) return reply(f.why);
+      if (b.lastText === text.toLowerCase() && now - b.lastTextAt < CHAT_LIMITS.repeatMs) return reply('repeat');
+      b.lastText = text.toLowerCase();
+      b.lastTextAt = now;
+      rec = { kind: 'text', text };
+    }
+    if (kind !== 'react') b.lastSayAt = now;
+    Object.assign(rec, {
+      name: who.name, seat: who.seat, colour: who.colour, by: who.hub ? 'hub' : who.watch ? 'watcher' : 'player',
+      bubble: m.bubble !== false && rules.bubbles && who.seat !== null, acct: who.acct, owner: who.owner, ...(who.mod ? { mod: true } : {}),
+      // Only the office sees these: who sent it, so a mute or a kick from the line reaches them (never an address).
+      from: { client: who.client?.id ?? null, token: who.token, browser: who.browser, player: who.player },
+    });
+    if (kind === 'text' && rules.ai && typeof this.room.review === 'function' && !who.owner) {
+      if (this.room.chatPending >= CHAT_LIMITS.pending) return reply('busy');
+      this.room.chatPending += 1;
+      const t0 = now;
+      Promise.resolve()
+        .then(() => this.room.review(rec.text, { room: this.room.code, links: rules.links }))
+        .then((v) => v, (error) => ({ ok: true, by: 'error', error: String(error?.message ?? error).slice(0, 120) }))
+        .then((v) => {
+          this.room.chatPending = Math.max(0, this.room.chatPending - 1);
+          if (v && v.ok === false) {
+            stats.chatAiHeld = (stats.chatAiHeld ?? 0) + 1;
+            // What the review thought it was (insult, hate, sexual, grooming, harm, spam): counts for the office only.
+            stats.chatAiWhy = stats.chatAiWhy ?? {};
+            const why = String(v.why ?? 'held').slice(0, 24);
+            stats.chatAiWhy[why] = (stats.chatAiWhy[why] ?? 0) + 1;
+            reply('ai');
+            return;
+          }
+          if (v?.by === 'error') stats.chatAiErrors = (stats.chatAiErrors ?? 0) + 1;
+          rec.review = { by: v?.by ?? 'ai', ms: this.room.now() - t0, ...(Number.isFinite(v?.p) ? { p: v.p } : {}) };
+          // A mute that came while it was being reviewed still holds it.
+          if (this.room.muteOf({ token: who.token, browser: who.browser, player: who.player })) { reply('muted'); return; }
+          this.room.publishChat(rec, who.conn, n);
+        });
+      return { ok: true, pending: true };
+    }
+    return this.room.publishChat(rec, who.conn, n);
+  }
+publishChat(rec, senderConn = null, n = null) {
+    const now = this.room.now();
+    rec.id = randomId(6);
+    rec.at = now;
+    this.room.chatLog.push(rec);
+    const keep = windowMsOf(this.room.chatRules());
+    while (this.room.chatLog.length > CHAT_LIMITS.keep || (this.room.chatLog.length && now - this.room.chatLog[0].at > keep)) this.room.chatLog.shift();
+    const msg = this.room.wireLine(rec);
+    const text = JSON.stringify(msg);
+    const mine = n ? JSON.stringify({ ...msg, n }) : text;
+    const hub = this.room.chatRules().hub;
+    for (const o of this.room.live()) if (!this.room.lite(o)) this.room.sendText(o.conn, o.conn === senderConn ? mine : text);
+    for (const w of this.room.watchers) if (!w.hub || hub) this.room.sendText(w, w === senderConn ? mine : text);
+    if (rec.kind === 'react') this.room.stats.chatReacts = (this.room.stats.chatReacts ?? 0) + 1;
+    else this.room.stats.chatLines = (this.room.stats.chatLines ?? 0) + 1;
+    // Kept chat (0.29.0): a room whose rules keep history hands what was said to the Table (never a reaction).
+    if (rec.kind !== 'react' && this.room.chatRules().history > 0 && typeof this.room.onPublished === 'function') { try { this.room.onPublished(rec); } catch { /* kept next time */ } }
+    return { ok: true, id: rec.id };
+  }
+unsay(ids) {
+    const gone = new Set(ids);
+    const before = this.room.chatLog.length;
+    this.room.chatLog = this.room.chatLog.filter((r) => !gone.has(r.id));
+    const text = JSON.stringify({ t: 'unline', ids: [...gone] });
+    for (const o of this.room.live()) if (!this.room.lite(o)) this.room.sendText(o.conn, text);
+    for (const w of this.room.watchers) this.room.sendText(w, text);
+    // Kept chat: what is taken down here is deleted where it was kept, older lines than the window too.
+    if (typeof this.room.onUnsaid === 'function' && gone.size) { try { this.room.onUnsaid([...gone]); } catch { /* best effort */ } }
+    return before - this.room.chatLog.length;
+  }
+ownLine(r, conn) {
+    const f = r?.from ?? {};
+    if (!conn || r?.kind === 'studio') return false;
+    return Boolean((conn.player && f.player && f.player === conn.player) || (conn.browser && f.browser && f.browser === conn.browser && !f.player));
+  }
+unsayOwn(conn, id) {
+    if (typeof id !== 'string' || !/^[A-Za-z0-9_-]{1,16}$/.test(id)) return { ok: false, error: 'no-line' };
+    const r = this.room.chatLog.find((x) => x.id === id);
+    if (!r || r.kind === 'studio') return { ok: false, error: 'no-line' };
+    if (!this.room.ownLine(r, conn)) return { ok: false, error: 'not-yours' };
+    this.room.unsay([id]);
+    this.room.stats.chatOwnRemoved = (this.room.stats.chatOwnRemoved ?? 0) + 1;
+    return { ok: true, removed: 1 };
+  }
+holdSender(line, minutes, now, { kick = false, message = '', purge = false } = {}) {
+    const f = line.from ?? {};
+    if (!f.token && !f.browser && !f.player) return { ok: false, error: 'no-player', message: 'that line has nobody to hold' };
+    const until = now + minutes * 60_000;
+    const hold = { token: f.token ?? null, browser: f.browser ?? null, player: f.player ?? null, name: line.name, seat: line.seat, until, at: now };
+    if (kick) this.room.bans = [...this.room.bans, { ...hold, ip: null, pass: null, message }].slice(-CONTROL_LIMITS.bans);
+    else this.room.mutes = [...this.room.mutes, hold].slice(-CONTROL_LIMITS.mutes);
+    this.room.tellBrowser(hold, kick ? { t: 'kicked', room: this.room.code, until, message } : { t: 'muted', room: this.room.code, until });
+    const removed = purge ? this.room.unsay(this.room.linesOf(f)) : 0;
+    this.room.tellWatchers();
+    return { ok: true, op: kick ? 'kick' : 'mute', name: line.name, seat: line.seat, until, sockets: 0, ...(removed ? { removed } : {}) };
+  }
+linesOf(from) {
+    if (!from) return [];
+    return this.room.chatLog.filter((r) => (from.client && r.from?.client === from.client) || (from.token && r.from?.token === from.token) || (from.browser && r.from?.browser === from.browser) || (from.player && r.from?.player === from.player)).map((r) => r.id);
+  }}