@homie-rocks/studio 0.54.0 → 0.55.0

package/worker/pages.mjs

@@ -1,3 +1,5 @@
+import {ROOM_ID,shellKey,shellStandIn,frameAncestors,embedAncestors} from './page-policy.mjs';
+export {ROOM_ID,shellKey,shellStandIn,frameAncestors,embedAncestors} from './page-policy.mjs';
 import {JOIN_AREA_SHELL_JS} from './join-area.mjs';
 import { appWords, openPath } from './app-format.mjs';
 import { APP_SHELL_JS } from './app-shell.mjs';
@@ -7,7 +9,7 @@ import { APP_SHELL_JS } from './app-shell.mjs';
  */
 import { playerAncestors, PLAYER_SANDBOX, PLAYER_SIZE } from './embed.mjs';
 import { esc, layout, gameSocialTags } from './site.mjs';
-import { NET_PALETTE } from './room.mjs';
+import { NET_PALETTE } from './room-protocol.mjs';
 import { PARAM_VALUE, PREFS_LIMITS, playParams } from './seats.mjs';
 import { STUDIO_VERSION_TAG } from './version.mjs';
 
@@ -19,26 +21,14 @@ import { STUDIO_VERSION_TAG } from './version.mjs';
  * instead of hosting a newer game inside a page that lacks what that game needs (a player ticket, for one).
  * It does not change when only the game's code or art does: that is still a reload of the frame alone.
  */
-export function shellKey(g) {
-  // Never what names a build (the rules' build and state hashes, the bundle's version): those change with every
-  // edit, and a newer build of the same game inside the same page is exactly what the frame's own reload is for.
-  const { build: _build, stateHash: _state, ...room } = g?.room ?? {};
-  const { version: _version, ...netplay } = g?.netplay ?? {};
-  const text = JSON.stringify([g?.kind ?? null, g?.players ?? null, room, g?.saves ?? null, g?.agents ?? null, g?.screen ?? null, netplay, g?.launch ?? null]);
-  let h = 2166136261;
-  for (let i = 0; i < text.length; i += 1) { h ^= text.charCodeAt(i); h = Math.imul(h, 16777619); }
-  return `${STUDIO_VERSION_TAG}-${(h >>> 0).toString(36)}`;
-}
+
 /**
  * The frame's stand-in when its page is older than the game it would host. It tells the page, and loads no game.
  * `key`: the page understands the handshake and reloads itself once. No key: a page from before the handshake, whose
  * only way to load a whole new page is the one it has for leaving a finished room; it is used only when the game cannot
  * work inside that page at all.
  */
-export function shellStandIn(room, key) {
-  const message = key ? { t: 'homie-net', what: 'shell', key } : { t: 'homie-net', what: 'rematch', room };
-  return `<!doctype html><meta charset="utf-8"><title>Updating</title><body style="margin:0;background:#0b0d14;color:#cfd6e6;font:15px system-ui;display:grid;place-items:center;height:100vh"><p>This game was updated. Loading it again…</p><script>try{parent.postMessage(${JSON.stringify(message).replace(/</g, '\\u003c')},'*');}catch(e){}</script>`;
-}
+
 import { SKILLS } from './agents.mjs';
 import { KIDS_LINE, POLICY_WORDS } from './servers.mjs';
 import { SAVES_SHELL_CSS, SAVES_SHELL_JS } from './saves-shell.mjs';
@@ -49,18 +39,13 @@ import { ARRIVAL_JS, arrivalCard } from './arrival.mjs';
 export { homePage, mediaIndexPage, notFoundPage, songPage, videoPage } from './site.mjs';
 
 /** A room code: 1 to 32 letters, digits, - or _. */
-export const ROOM_ID = /^[A-Za-z0-9_-]{1,32}$/;
+
 
 /**
  * Who may put the play page (and so the game) inside a frame: this site, plus the https origins studio.json
  * `site.frameAncestors` names (for example a hub that embeds the game). Anything else is refused by the browser.
  */
-export function frameAncestors(cat) {
-  const extra = (Array.isArray(cat?.studio?.site?.frameAncestors) ? cat.studio.site.frameAncestors : [])
-    .map((o) => { try { const u = new URL(String(o)); return u.protocol === 'https:' && u.origin === String(o).replace(/\/+$/, '') ? u.origin : null; } catch { return null; } })
-    .filter(Boolean).slice(0, 8);
-  return ["'self'", ...extra].join(' ');
-}
+
 
 /** What a play, big-screen or watch page answers to a room code it cannot use: said on the page, never a silent public room. */
 export function badRoomPage(cat, g, raw, { screen = false, watch = false } = {}) {
@@ -1596,12 +1581,7 @@ const WATCH_JS = String.raw`${BUILD_RETRY_JS}(function () {
   }
 }());`;
 
-export function embedAncestors(cat, origin, preview = false) {
-  const normal = playerAncestors(cat);
-  if (!preview || !/^http:\/\/(?:localhost|127\.0\.0\.1)(?::\d+)?$/.test(origin)) return normal;
-  const port = new URL(origin).port;
-  return `${normal === "'none'" ? '' : normal} http://localhost${port ? ':' + port : ''} http://127.0.0.1${port ? ':' + port : ''}`.trim();
-}
+
 
 export function embedPreview(cat, g, origin) {
   const frameOrigin = new URL(origin); frameOrigin.hostname = frameOrigin.hostname === 'localhost' ? '127.0.0.1' : 'localhost';

package/worker/parts.mjs

@@ -17,7 +17,8 @@ import { esc, icon, layout, notFoundPage } from './site.mjs';
 const PART_ID = /^[a-z0-9][a-z0-9-]{0,47}$/;
 const VERSION = /^\d{1,6}\.\d{1,6}\.\d{1,6}(?:-[0-9A-Za-z.-]{1,40})?$/;
 /** A packed part's files: framed by the part's own page and by the hub, so they keep their own frame rule (index.mjs finish). */
-export const PART_FILES = /^\/parts\/[a-z0-9][a-z0-9-]{0,47}\/\d{1,6}\.\d{1,6}\.\d{1,6}[^/]*\//;
+import {PART_FILES} from './asset-paths.mjs';
+export {PART_FILES} from './asset-paths.mjs';
 export const PARTS_WELL_KNOWN = '/.well-known/homie-parts.json';
 export const isPartsPath = (path) => path === '/openapi.json' || path === '/.well-known/api-catalog' || path === '/parts/catalog.json' || path === '/purchases/keys.json' || path === PARTS_WELL_KNOWN || path === '/parts' || path.startsWith('/parts/');
 

package/worker/payment-recovery.mjs

@@ -2,13 +2,13 @@ import { pendingJobsSQL, definitiveRefusal, REPLAY_LIMIT_MS, recoveryAction } fr
 import { orderFact, recordOrderState, releaseClaim } from './purchase-core.mjs';
 import { resumeSettlement } from './settlement-journal.mjs';
 /** Durable provider recordings outlive responses. A verified chain transfer is payment. */
-import { stripeCall, refundPayment, modeOf } from './stripe.mjs';
+import { stripeCall, refundPayment, modeOf, STRIPE_VERSION } from './stripe.mjs';
 import { byId, resourceAvailable } from './purchase-store.mjs';
 export async function saveRecording(env, order, params, options) {
   const chain = params.payment_method_options?.crypto?.transaction_verification_options;
   const id = chain ? `${order.id}:${chain.network}:${chain.transaction_hash}` : options.idempotencyKey;
   await env.DB.prepare("INSERT OR IGNORE INTO purchase_jobs (id,order_id,mode,state,payload,updated_at) VALUES (?1,?2,?3,?4,?5,?6)")
-    .bind(id, order.id, order.mode, chain ? 'paid_recording' : 'submitted', JSON.stringify({ params, options: { ...options, idempotencyKey: chain ? chain.transaction_hash : options.idempotencyKey }, chain, startedAt: Date.now() }), Date.now()).run();
+    .bind(id, order.id, order.mode, chain ? 'paid_recording' : 'submitted', JSON.stringify({ params, options: { ...options, version: options.version ?? options.apiVersion ?? STRIPE_VERSION, idempotencyKey: chain ? chain.transaction_hash : options.idempotencyKey }, chain, startedAt: Date.now() }), Date.now()).run();
   if (chain) {
     // Only the protocol's verified settlement callback reaches here, never buyer input.
     await orderFact(env, order.id, 'payment', {paid_at: Date.now()}).run();
@@ -16,6 +16,11 @@ export async function saveRecording(env, order, params, options) {
   }
   return id;
 }
+/** Persist the provider id before any follow-up retrieve/cancel/fulfillment call. */
+export async function recordProviderId(env, order, id, pi) {
+  if (!/^pi_[A-Za-z0-9]+$/.test(pi.id) || pi.amount !== order.amount || pi.currency !== order.currency || pi.livemode !== (order.mode === 'live')) throw new Error('Provider receipt does not match order');
+  await env.DB.prepare('UPDATE purchase_jobs SET payment=?2,updated_at=?3 WHERE id=?1').bind(id,pi.id,Date.now()).run();
+}
 export async function recordProviderResult(env, order, id, pi) {
   if (pi.amount !== order.amount || pi.currency !== order.currency || pi.livemode !== (order.mode === 'live')) throw new Error('Provider receipt does not match order');
   await env.DB.prepare("UPDATE purchase_jobs SET payment = ?2, state = ?3, error = NULL, updated_at = ?4 WHERE id = ?1").bind(id, pi.id, pi.status === 'succeeded' ? 'recorded' : ['canceled','requires_payment_method'].includes(pi.status) ? 'failed' : 'processing', Date.now()).run();
@@ -37,31 +42,40 @@ export async function recordingFailure(env, id, error) {
     await env.DB.prepare("UPDATE purchase_jobs SET state = 'failed', error = ?2, attempts = attempts + 1, updated_at = ?3 WHERE id = ?1 AND state = 'submitted'").bind(id, String(error.message).slice(0, 500), Date.now()).run();
     return;
   }
+  if(error.manualReview) {
+    await env.DB.prepare("UPDATE purchase_jobs SET state='manual_review',error=?2,updated_at=?3 WHERE id=?1").bind(id,error.message,Date.now()).run();
+    return;
+  }
   // A failure of our call is not a fact about the original payment.
   await env.DB.prepare("UPDATE purchase_jobs SET error = ?2, attempts = attempts + 1, updated_at = ?3 WHERE id = ?1")
     .bind(id, String(error.message).slice(0, 500), Date.now()).run();
 }
 
-/** Read existing objects first. Listing avoids the search index's delayed negative answers. */
+/** Read the recorded object, or recover a lost create response with its original key. */
 export async function readProviderPayment(env, order, job, payment = null) {
-  const options = { version: '2026-07-29.preview' };
+  const readOptions = { version: STRIPE_VERSION };
   if (payment && !/^pi_[A-Za-z0-9]+$/.test(payment)) throw new Error('Supply an existing Stripe PaymentIntent id');
   if (job.payment || payment) {
-    const pi = await stripeCall(env, 'GET', `/v1/payment_intents/${encodeURIComponent(job.payment ?? payment)}`, null, options);
+    const pi = await stripeCall(env, 'GET', `/v1/payment_intents/${encodeURIComponent(job.payment ?? payment)}`, null, readOptions);
     if (pi.metadata?.order !== order.id) throw new Error('The existing PaymentIntent belongs to another order');
     return pi;
   }
-  let cursor;
-  for (let page = 0; page < 100; page++) {
-    const result = await stripeCall(env, 'GET', '/v1/payment_intents', { limit: 100, created: { gte: Math.floor(order.created_at / 1000) - 60 }, ...(cursor ? { starting_after: cursor } : {}) }, options);
-    if (!Array.isArray(result.data)) throw new Error('Stripe did not return an existing-payment list');
-    const found = result.data.find((pi) => pi.metadata?.order === order.id);
-    if (found) return found;
-    if (!result.has_more) return null;
-    cursor = result.data.at(-1)?.id;
-    if (!cursor) throw new Error('Stripe payment list has no continuation');
+  const {params,options,startedAt}=JSON.parse(job.payload??'{}');
+  if(params&&options?.idempotencyKey&&Date.now()-(startedAt??order.created_at)<REPLAY_LIMIT_MS) {
+    // If the create response was lost, replay only the original request/key
+    // inside Stripe's guaranteed retention window. Never scan the account.
+    const version=options.version ?? options.apiVersion;
+    if(!version) {
+      const error=new Error('Original Stripe API version is missing; reconcile this retained order with an existing PaymentIntent id instead of replaying an uncertain request.');
+      error.manualReview=true;throw error;
+    }
+    const pi=await stripeCall(env,'POST','/v1/payment_intents',params,{...options,version});
+    await recordProviderId(env,order,job.id,pi);
+    return pi;
   }
-  throw new Error(`Existing payment scan exceeded 100 pages for order ${order.id}; the owner must reconcile this order.`);
+  const error=new Error(`PaymentIntent id missing after the safe replay window for order ${order.id}; reconcile with an existing PaymentIntent id. The order and its claim are retained.`);
+  error.manualReview=true;
+  throw error;
 }
 async function releaseUnpaid(env, order, job, pi = null) {
   await env.DB.batch([
@@ -87,18 +101,18 @@ export async function reconcileRecordings(env, orderId = null, dependencies = {}
       switch (recoveryAction(observation)) {
         case 'fail':
           if (pi?.status === 'requires_payment_method') {
-            pi = await stripeCall(env, 'POST', `/v1/payment_intents/${encodeURIComponent(pi.id)}/cancel`, {}, { idempotencyKey: `cancel-action-${pi.id}`, version: '2026-07-29.preview' });
+            pi = await stripeCall(env, 'POST', `/v1/payment_intents/${encodeURIComponent(pi.id)}/cancel`, {}, { idempotencyKey: `cancel-action-${pi.id}`, version: STRIPE_VERSION });
             if (pi.status !== 'canceled') throw new Error('The unpaid payment could not be canceled; the claim remains reserved');
           }
           await releaseUnpaid(env, order, job, pi); continue;
-        case 'replay': pi = await stripeCall(env, 'POST', '/v1/payment_intents', params, { ...options, version: '2026-07-29.preview' }); break;
+        case 'replay': pi = await stripeCall(env, 'POST', '/v1/payment_intents', params, { ...options, version: options.version ?? options.apiVersion ?? STRIPE_VERSION }); break;
         default:
           if (!pi) {
             if (deadline) throw new Error(`Paid transfer still needs recording: order ${order.id}; key ${options.idempotencyKey}`);
-            pi = await stripeCall(env, 'POST', '/v1/payment_intents', params, { ...options, version: '2026-07-29.preview' });
+            pi = await stripeCall(env, 'POST', '/v1/payment_intents', params, { ...options, version: options.version ?? options.apiVersion ?? STRIPE_VERSION });
           }
       }
-      if (['requires_action','requires_confirmation','requires_capture','requires_payment_method'].includes(pi.status) || orderId && dependencies.cancel === true && pi.status === 'processing') pi = await stripeCall(env, 'POST', `/v1/payment_intents/${encodeURIComponent(pi.id)}/cancel`, {}, { idempotencyKey: `cancel-action-${pi.id}`, version: '2026-07-29.preview' });
+      if (['requires_action','requires_confirmation','requires_capture','requires_payment_method'].includes(pi.status) || orderId && dependencies.cancel === true && pi.status === 'processing') pi = await stripeCall(env, 'POST', `/v1/payment_intents/${encodeURIComponent(pi.id)}/cancel`, {}, { idempotencyKey: `cancel-action-${pi.id}`, version: STRIPE_VERSION });
       await recordProviderResult(env, order, job.id, pi);
       if (['canceled','requires_payment_method'].includes(pi.status)) { await releaseUnpaid(env, order, job, pi); continue; }
       if (pi.status !== 'succeeded') {

package/worker/player-registry.mjs

@@ -0,0 +1,9 @@
+export let players = null;
+let configured=false;
+/**
+ * The player-accounts API, handed over once by a studio's Worker that has it:
+ * `{ get(id, env), of?(request, env), isOwner?(request, env) }` (worker/players.mjs `players` is exactly this).
+ */
+export function usePlayers(api) { configured=true; players = api && typeof api === 'object' ? api : null; }
+
+export function defaultPlayers(api) { if(!configured)players=api; }

package/worker/players.mjs

@@ -25,12 +25,12 @@ import { toolIdentity } from './tool-identity.mjs';
  * THE OWNER sees counts and names (`players.count`, `players.list`), never a passkey, a session or an email.
  * A player sees, downloads (/api/player/export) and deletes (/api/player/delete) everything of theirs.
  */
-import { handleFor } from './room.mjs';
+import { handleFor } from './room-protocol.mjs';
 import { isAiName } from './agents.mjs';
 import { cookieValue } from './stats.mjs';
 import { adoptGuest, bumpPlayerStats, dropPlayerData, fall, fallenList, getSave, listSaves, playerData, readPlayerStats, SAVE_LIMITS, savesSummary, wipeSaves, writeSaves } from './saves.mjs';
 import { bytesToB64url, randomToken, sha256Hex, verifyAssertion, verifyRegistration } from './webauthn.mjs';
-import { ACCOUNT_JS, accountPage } from './account-page.mjs';
+
 import { adoptShopStatements, migrated as shopMigrated, forgetPlayerShop, livePurchases, shopDataOf } from './shop-store.mjs';
 import { forgetPlayerHistory, playerHistory } from './lounge-store.mjs';
 
@@ -230,7 +230,7 @@ async function sessionOf(request, env, url = new URL(request.url)) {
     writes.push(env.DB.prepare('UPDATE player_sessions SET expires_at = ?2 WHERE hash = ?1').bind(hash, now + days * DAY));
     session.cookies.push(sessionCookie(url, token, days));
   }
-  if (writes.length) await env.DB.batch(writes).catch(() => {});
+  if (writes.length) await env.DB.batch(writes);
   return session;
 }
 
@@ -240,6 +240,8 @@ async function newGuest(request, env, url, addressLimit = PLAYER_LIMITS.newPlaye
   if (addressLimit !== null && limited(`${counter}:${ip}`, addressLimit, HOUR)) return { error: fail(429, 'rate', 'too many new players from this address; try again later') };
   const capped = (counter !== 'shop-new' || env.PLAYER_LIMIT_DAILY !== undefined) && await dailyCapReached(env);
   if (capped) return { error: fail(503, 'busy', 'this studio has taken all the new players it takes in one day; try again tomorrow') };
+  // Studios without scheduled functions still reclaim idle guests on this write path.
+  if (Math.random() < 0.02) await pruneGuests(env);
   const id = newPlayerId();
   const now = Date.now();
   const name = handleFor(id);
@@ -248,7 +250,6 @@ async function newGuest(request, env, url, addressLimit = PLAYER_LIMITS.newPlaye
     env.DB.prepare('INSERT INTO players (id, name, named, guest, owner, created_at, seen_at) VALUES (?1, ?2, 0, 1, 0, ?3, ?3)').bind(id, name, now),
     s.statement,
   ]);
-  if (Math.random() < 0.02) pruneGuests(env).catch(() => {});
   return { session: { player: { id, name, named: false, guest: true, owner: false, since: now }, cookies: [s.cookie], fresh: true } };
 }
 
@@ -472,12 +473,12 @@ async function gameOf(catalogueOf, id) {
 export async function playerRoutes(request, env, ctx, url, { catalogueOf }) {
   const path = url.pathname;
   const read = request.method === 'GET' || request.method === 'HEAD';
-  if (path === '/_homie/account.js') return new Response(ACCOUNT_JS, { headers: { 'content-type': 'text/javascript; charset=utf-8', 'cache-control': 'public, max-age=300', 'x-content-type-options': 'nosniff' } });
+  if (path === '/_homie/account.js') return new Response((await import('./account-page.mjs')).ACCOUNT_JS, { headers: { 'content-type': 'text/javascript; charset=utf-8', 'cache-control': 'public, max-age=300', 'x-content-type-options': 'nosniff' } });
   if (path === '/account') return Response.redirect(`${url.origin}/account/${url.search}`, 301);
   if (path === '/account/') {
     if (!read) return fail(405, 'method', 'GET only');
     const cat = await catalogueOf();
-    return accountPage(cat, { origin: url.origin, next: nextOf(url.searchParams.get('next')), owner: OWNER_KEY.test(url.searchParams.get('owner') ?? '') ? url.searchParams.get('owner') : null, link: LINK.test(url.searchParams.get('k') ?? '') ? url.searchParams.get('k') : null, mode: ['verify', 'recover'].includes(url.searchParams.get('do')) ? url.searchParams.get('do') : null, features: features(env) });
+    return (await import('./account-page.mjs')).accountPage(cat, { origin: url.origin, next: nextOf(url.searchParams.get('next')), owner: OWNER_KEY.test(url.searchParams.get('owner') ?? '') ? url.searchParams.get('owner') : null, link: LINK.test(url.searchParams.get('k') ?? '') ? url.searchParams.get('k') : null, mode: ['verify', 'recover'].includes(url.searchParams.get('do')) ? url.searchParams.get('do') : null, features: features(env) });
   }
   if (!path.startsWith('/api/player/')) return null;
   const f = features(env);
@@ -737,7 +738,7 @@ async function apiRoute(request, env, ctx, url, parts, { catalogueOf, read, f })
     const answer = json({ ok: true, message: 'If that address belongs to an account here, a link is on its way. It works once, for 30 minutes.' });
     if (!owner) return answer;
     const k = await issueChallenge(env, 'recover-link', owner.player, null, PLAYER_LIMITS.linkMinutes);
-    await sendMail(env, email, `Sign in to ${await studioName()}`, `Someone (hopefully you) asked to get back into your player account on ${await studioName()}.\n\nOpen this link on the device you want to use, and make a new passkey there:\n${url.origin}/account/?do=recover&k=${k}\n\nIt works once, for 30 minutes. If you did not ask, ignore this email: nothing changes.\n`).catch(() => {});
+    await sendMail(env, email, `Sign in to ${await studioName()}`, `Someone (hopefully you) asked to get back into your player account on ${await studioName()}.\n\nOpen this link on the device you want to use, and make a new passkey there:\n${url.origin}/account/?do=recover&k=${k}\n\nIt works once, for 30 minutes. If you did not ask, ignore this email: nothing changes.\n`).catch(error => console.warn("Recovery mail delivery failed:",error.message));
     return answer;
   }
 

package/worker/purchase-machine.mjs

@@ -1,7 +1,7 @@
 import { definitiveRefusal, blockingJobsSQL } from './payment-policy.mjs';
 import { orderFact, offerVersion, orderState } from './purchase-core.mjs';
 import { problem } from './purchase-problem.mjs';
-import { saveRecording, recordProviderResult, recordingFailure, reconcileRecordings } from './payment-recovery.mjs';
+import { saveRecording, recordProviderId, recordProviderResult, recordingFailure, reconcileRecordings } from './payment-recovery.mjs';
 import { machineCapabilities, notePaymentRefusal } from './payment-capabilities.mjs';
 import { purchaseResponse } from './purchase-response.mjs';
 /** One durable purchase, regardless of transport. No seller browser page is involved. */
@@ -262,12 +262,14 @@ function recordingClient(env, o, providerClient) {
   client.paymentIntents = Object.create(providerClient.paymentIntents);
   client.paymentIntents.create = async (params, options) => {
     params = { ...params, metadata: { ...params.metadata, homie: "purchase-v1", order: o.id } };
-    const id = await saveRecording(env, o, params, options);
+    const id = await saveRecording(env, o, params, { ...options, version: options?.apiVersion ?? providerClient.getApiField?.('version') });
     try {
       const saved = await env.DB.prepare('SELECT state,payload FROM purchase_jobs WHERE id = ?1').bind(id).first();
       if (saved.state === 'manual_review') throw new Error('Stripe recording was refused; the seller must handle any refund manually.');
       const original = JSON.parse(saved.payload);
-      let pi = await create(original.params, original.options);
+      const {version,...originalOptions}=original.options;
+      let pi = await create(original.params, { ...originalOptions, apiVersion: version });
+      await recordProviderId(env,o,id,pi);
       if (pi.status === 'processing') pi = await providerClient.paymentIntents.retrieve(pi.id);
       if (pi.status === 'requires_action') pi = await providerClient.paymentIntents.cancel(pi.id);
       await recordProviderResult(env, o, id, pi);

package/worker/reconcile-guard.mjs

@@ -0,0 +1,22 @@
+/** Private per-delivery fence, never a deploy binding. */
+export const RECONCILE_GUARD=Symbol('reconcileGuard');
+
+/** Statements may be prepared before an await, so check at execution, including batches. */
+export function guardedDatabase(db,check) {
+  const originals=new WeakMap();
+  const statement=raw=>{
+    const wrapped=new Proxy(raw,{get(target,key){
+      if(key==='bind')return (...args)=>statement(target.bind(...args));
+      if(['run','first','all','raw'].includes(key))return async(...args)=>{await check();return target[key](...args);};
+      return Reflect.get(target,key);
+    }});
+    originals.set(wrapped,raw);return wrapped;
+  };
+  return new Proxy(db,{get(target,key){
+    if(key==='prepare')return query=>statement(target.prepare(query));
+    if(key==='batch')return async statements=>{await check();return target.batch(statements.map(s=>originals.get(s)??s));};
+    if(key==='exec')return async(...args)=>{await check();return target.exec(...args);};
+    if(key==='withSession')return (...args)=>guardedDatabase(target.withSession(...args),check);
+    const value=Reflect.get(target,key);return typeof value==='function'?value.bind(target):value;
+  }});
+}

package/worker/request-db.mjs

@@ -1,35 +1,60 @@
+export const METADATA_REVISION=Symbol('metadata revision');
 export const ORIGINAL_DB=Symbol('original database');
 export const MUTATIONS=Symbol('request mutations');
+export const MUTATION_VERSION=Symbol('mutation version');
 export const databaseBinding=db=>db?.[ORIGINAL_DB]??db;
 const metadata=new WeakMap();
 const metadataQueries=new Set(['SELECT game, launch, max_players, updated_at FROM office_games LIMIT 500','SELECT * FROM servers LIMIT 2000','SELECT game, server, rules, updated_at FROM chat_rules LIMIT 1000']);
 /** Cache only completed metadata, stamped by a trigger-maintained revision. Pending
- * D1 operations belong to one request; unrelated metadata tables are never loaded.
+ * D1 operations belong to one request. Cold metadata is one atomic batch.
  */
 export function requestDatabase(DB, request, state={mutated:false}, binding=databaseBinding(DB)) {
  if(!DB)return DB;
- let revision,records;
+ // Start at the primary so launch/role revocations are current. Later reads in
+ // this session may use replicas at or beyond that bookmark. This also meets
+ // any bookmark returned by an earlier request without trusting stale auth.
+ if(DB===binding&&typeof DB.withSession==='function')DB=DB.withSession('first-primary');
+ let revision,records,rows,liveRooms;
+ const prefetchRooms=false;
  const url=new URL(request.url),match=request.method==='GET'&&/^\/([a-z0-9][a-z0-9-]{0,39})\/api\/app\/records\/([a-z][a-z0-9-]{0,39})(?:\/([A-Za-z0-9_-]{1,64}))?$/.exec(url.pathname);
  const recordQuery=match&&(match[3]?'SELECT id, value, version, updated_at FROM app_records WHERE app = ?1 AND collection = ?2 AND id = ?3':'SELECT id, value, version, updated_at FROM app_records WHERE app = ?1 AND collection = ?2 ORDER BY updated_at, id');
  const stamp=()=>revision??=(async()=>{
   const query=DB.prepare("SELECT value FROM meta WHERE key='metadata-revision'");
-  if(recordQuery){const result=await DB.batch([query,DB.prepare(recordQuery).bind(...match.slice(1).filter(x=>x!==undefined))]);records=result[1];return result[0].results?.[0]?.value??null;}
-  return (await query.first())?.value??null;
+  const cached=metadata.get(binding);
+  // The revision and its rows must be from the same snapshot, including when
+  // another request changes metadata while this request is awaiting D1.
+  const queries=[...metadataQueries];
+  const cold=!cached;
+  const statements=[query,...(cold?queries.map(sql=>DB.prepare(sql)):[])];
+  if(recordQuery)statements.push(DB.prepare(recordQuery).bind(...match.slice(1).filter(x=>x!==undefined)));
+  if(prefetchRooms)statements.push(DB.prepare('SELECT game,rooms,updated FROM lobby_summaries LIMIT 500'));
+  const result=await DB.batch(statements);
+  if(prefetchRooms)liveRooms=result.at(-1);
+  let version=result[0].results?.[0]?.value??null;
+  if(recordQuery)records=result.at(-1);
+  if(cold)rows=new Map(queries.map((sql,i)=>[sql,result[i+1]]));
+  else if(cached.version===version)rows=cached.rows;
+  else {
+   const refreshed=await DB.batch([query,...queries.map(sql=>DB.prepare(sql))]);
+   version=refreshed[0].results?.[0]?.value??null;
+   rows=new Map(queries.map((sql,i)=>[sql,refreshed[i+1]]));
+  }
+  if(version!==null)metadata.set(binding,{version,rows});
+  return version;
  })();
- const writing=sql=>{if(!/^\s*(SELECT|PRAGMA|EXPLAIN)\b/i.test(sql)){if(/\bapp_records\b/.test(sql)){records=null;revision=null;}if(/\b(office_games|servers|chat_rules)\b/.test(sql)){revision=null;metadata.delete(binding);}if(!/\bstats_daily\b/.test(sql))state.mutated=true;}};
+ const writing=sql=>{if(!/^\s*(SELECT|PRAGMA|EXPLAIN)\b/i.test(sql)){if(/\bapp_records\b/.test(sql)){records=null;revision=null;}if(/\b(office_games|servers|chat_rules)\b/.test(sql)){revision=null;metadata.delete(binding);}if(!/\bstats_daily\b/.test(sql)){state.mutated=true;state.version=(state.version??0)+1;}}};
  const prepare=(sql,args=[])=>{
   const original=()=>{const stmt=DB.prepare(sql);return args.length?stmt.bind(...args):stmt;};
   const read=async()=>{
+   if(sql==='SELECT game,rooms,updated FROM lobby_summaries LIMIT 500'&&prefetchRooms){await stamp();return liveRooms;}
    if(sql===recordQuery&&JSON.stringify(args)===JSON.stringify(match.slice(1).filter(x=>x!==undefined))){await stamp();return records;}
    if(!metadataQueries.has(sql))return original().all();
-   const version=await stamp();let cache=metadata.get(binding);
-   if(!cache||cache.version!==version){cache={version,rows:new Map()};metadata.set(binding,cache);}
-   if(version!==null&&cache.rows.has(sql))return cache.rows.get(sql);
-   const result=await original().all();if(version!==null)cache.rows.set(sql,result);return result;
+   await stamp();
+   return rows.get(sql);
   };
   return {bind:(...args)=>prepare(sql,args),first:async column=>{writing(sql);if(!metadataQueries.has(sql)&&sql!==recordQuery)return original().first(column);const row=(await read()).results?.[0]??null;return column&&row?row[column]:row;},all:()=>{writing(sql);return read();},run:()=>{writing(sql);return original().run();},raw:(...args)=>{writing(sql);return original().raw(...args);},_original:original,_sql:sql};
  };
- const methods={[ORIGINAL_DB]:binding,get [MUTATIONS](){return state.mutated;},prepare,batch:statements=>{for(const s of statements)writing(s._sql??'UPDATE');return DB.batch(statements.map(s=>s._original?.()??s));},exec:(sql,...args)=>{writing(sql);return DB.exec(sql,...args);},withSession:(...args)=>requestDatabase(DB.withSession(...args),request,state,binding)};
+ const methods={[METADATA_REVISION]:stamp,[ORIGINAL_DB]:binding,get [MUTATIONS](){return state.mutated;},get [MUTATION_VERSION](){return state.version??0;},prepare,batch:statements=>{for(const s of statements)writing(s._sql??'UPDATE');return DB.batch(statements.map(s=>s._original?.()??s));},exec:(sql,...args)=>{writing(sql);return binding.exec(sql,...args);},withSession:(...args)=>requestDatabase(binding.withSession(...args),request,state,binding)};
  return new Proxy(methods,{get(target,key){if(key in target)return target[key];const value=DB[key];return typeof value==='function'?value.bind(DB):value;}});
 }
 

package/worker/responses.mjs

@@ -0,0 +1,18 @@
+import {GAME_FILES,PART_FILES} from './asset-paths.mjs';
+export const json = (body, status = 200, extra = {}) => new Response(`${JSON.stringify(body)}\n`, {
+  status, headers: { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store', ...extra },
+});
+export function finish(res, path) {
+  if (!res || res.status === 101 || res.webSocket) return res;
+  if (!/text\/html/i.test(res.headers.get('content-type') ?? '')) return res;
+  const cache = res.headers.get('cache-control') ?? '';
+  const addNt = !/no-transform/i.test(cache);
+  // GAME PARTS: a shared part's preview page is framed by the part's page and the hub, sandboxed (worker/parts.mjs).
+  const playerFrame = /^\/[a-z0-9][a-z0-9-]{0,39}\/play\/embed$/.test('/' + path.split('/').filter(Boolean).join('/')) && res.status === 200 && /frame-ancestors/.test(res.headers.get('content-security-policy') ?? '');
+  const addXfo = !playerFrame && !res.headers.has('x-frame-options') && !GAME_FILES.test(path) && !PART_FILES.test(path);
+  if (!addNt && !addXfo) return res;
+  const headers = new Headers(res.headers);
+  if (addNt) headers.set('cache-control', cache ? `${cache}, no-transform` : 'no-transform');
+  if (addXfo) headers.set('x-frame-options', 'DENY');
+  return new Response(res.body, { status: res.status, statusText: res.statusText, headers });
+}