@homie-rocks/studio 0.54.0 → 0.56.0

package/worker/match-router.mjs

@@ -0,0 +1,74 @@
+import {lobbyShard,LOBBY_SHARDS} from './lobby-shards.mjs';
+
+// Entry objects partition reservation ownership. They lease 8 routing decisions
+// at a time, so the policy object sees 1/8 of join traffic, never room reports.
+// A quiet game refills existing pools before opening shard zero. Spread above
+// 128 observed joins/s: below half the slowest single-coordinator throughput
+// measured by the deployed fixture (1024 durable joins, 32 concurrent).
+// Count consumed leases, not all eight slots in a newly issued lease.
+export class MatchRouter {
+  constructor(ctx,env) { this.ctx=ctx;this.env=env;this.pending=new Map();this.routes=new Map(); }
+  async fetch(request) {
+    const url=new URL(request.url),now=Date.now();
+    if(url.pathname==='/match-policy') {
+      this.demand=(this.demand??[]).filter(row=>now-row.at<1000);
+      this.demand.push({at:now,joins:Math.max(1,Math.min(8,Number(url.searchParams.get('used'))||1))});
+      return Response.json({wide:this.demand.reduce((n,row)=>n+row.joins,0)>128,until:now+1000});
+    }
+    const identity=url.searchParams.get('reservation');
+    const key=JSON.stringify([identity,url.searchParams.get('ver'),url.searchParams.get('host'),url.searchParams.get('not')]);
+    if(this.pending.has(key))return Response.json(await this.pending.get(key));
+    const task=this.join(url,key,now);this.pending.set(key,task);
+    try{return Response.json(await task);}finally{this.pending.delete(key);}
+  }
+  async join(url,key,now) {
+    const game=url.searchParams.get('game');
+    for(const [id,row] of this.routes)if(row.until<=now)this.routes.delete(id);
+    let route=this.routes.get(key)??await this.ctx.storage.get('match:'+key);
+    if(!route||route.until<=now) {
+      // Serialize lease consumption, not requests to the matching shards.
+      const previous=this.leasing??Promise.resolve();
+      const lease=previous.then(async()=>{
+        if(!this.policy||this.policy.until<=now||!this.remaining){
+          const target=new URL('https://lobby/match-policy');target.searchParams.set('game',game);target.searchParams.set('used',String(this.policy?8-this.remaining:1));
+          const response=await this.env.LOBBY.get(this.env.LOBBY.idFromName(game+'/match-policy')).fetch(target);
+          if(!response.ok)throw Error('Matching policy unavailable');
+          this.policy=await response.json();this.remaining=8;
+        }
+        this.remaining--;
+        return this.policy.wide?lobbyShard(url.searchParams.get('reservation')):null;
+      });
+      this.leasing=lease.then(()=>{},()=>{});
+      let shard=await lease;
+      if(shard===null) {
+        // Read-only discovery: persist ownership before reserving a seat. Quiet
+        // joins may refill any pool left open by a burst, including after eviction.
+        shard=0;
+        for(let candidate=0;candidate<LOBBY_SHARDS;candidate++){
+          const target=new URL(url);target.pathname='/join';target.searchParams.set('peek','1');target.searchParams.set('shard',String(candidate));
+          const name=candidate?`${game}/shard/${candidate}`:game;
+          const response=await this.env.LOBBY.get(this.env.LOBBY.idFromName(name)).fetch(target);
+          if(!response.ok)throw Error('Matching discovery unavailable');
+          if((await response.json()).room){shard=candidate;break;}
+        }
+      }
+      route={shard,until:now+20000};
+      // Persist ownership before forwarding: a lost response or entry eviction
+      // must retry the same shard, even while the game changes routing policy.
+      await this.ctx.storage.put('match:'+key,route);this.routes.set(key,route);
+      await this.ctx.storage.setAlarm?.(now+20000);
+    }
+    url.pathname='/join';url.searchParams.set('shard',String(route.shard));
+    const name=route.shard?`${game}/shard/${route.shard}`:game;
+    const response=await this.env.LOBBY.get(this.env.LOBBY.idFromName(name)).fetch(url);
+    if(!response.ok)throw Error('Matching shard unavailable');
+    return response.json();
+  }
+  async alarm() {
+    const now=Date.now();let next=Infinity;
+    for(const [key,row] of await this.ctx.storage.list({prefix:'match:'})) {
+      if(row.until<=now)await this.ctx.storage.delete(key);else next=Math.min(next,row.until);
+    }
+    if(Number.isFinite(next))await this.ctx.storage.setAlarm(next);
+  }
+}

package/worker/mcp-event-streams.mjs

@@ -4,7 +4,7 @@ import {EVENT_ERRORS,terminalEventError,EventsError,eventError,notification,sseF
 /** Connection-scoped push subscriptions hosted by the existing per-connection Lobby. */
 export class McpEventStreams {
   constructor(env,ctx){this.env=env;this.ctx=ctx;this.streams=new Set();}
-  close(stream){if(stream.closed)return;stream.closed=true;clearInterval(stream.timer);stream.resume?.();try{stream.controller.close();}catch{}this.streams.delete(stream);if(stream.registryKey)this.ctx.waitUntil(this.env.DB.prepare('DELETE FROM mcp_kv WHERE key=?1').bind(stream.registryKey).run().catch(()=>{}));}
+  close(stream){if(stream.closed)return;stream.closed=true;clearInterval(stream.timer);stream.resume?.();try{stream.controller.close();}catch{/* The reader already cancelled or the stream already closed. */}this.streams.delete(stream);if(stream.registryKey)this.ctx.waitUntil(this.env.DB.prepare('DELETE FROM mcp_kv WHERE key=?1').bind(stream.registryKey).run().catch(error=>console.warn("MCP stream cleanup deferred to expiry:",error.message)));}
   async write(stream,value,authorize){
     if(stream.closed)return false;
     if(stream.controller.desiredSize<=0)await new Promise(resolve=>{stream.resume=resolve;});
@@ -19,7 +19,7 @@ export class McpEventStreams {
       const caller=await eventCaller(this.env,input.connection);const feed=await checkEvent(this.env,input.cat,caller,input.params);
       const start=await eventStart(this.env,input.params);
       const registryKey='mcp-event-stream:'+input.connection+':'+crypto.randomUUID();
-      await this.env.DB.prepare('INSERT INTO mcp_kv(key,value,expires) VALUES(?1,?2,?3)').bind(registryKey,JSON.stringify({connection:input.connection}),Date.now()+60000).run();
+      await this.env.DB.prepare('INSERT INTO mcp_kv(key,value,expires) VALUES(?1,?2,?3)').bind(registryKey,JSON.stringify({connection:input.connection}),Math.floor(Date.now()/1000)+60).run();
       const stream={...input,registryKey,source:eventSource(feed),cursor:cursorOf(input.params.name,start.after),closed:false,busy:false};
       const body=new ReadableStream({start:controller=>{stream.controller=controller;controller.enqueue(sseFrame(notification('active',{cursor:stream.cursor,truncated:start.truncated},stream.id)));},pull:()=>{const resume=stream.resume;stream.resume=null;resume?.();},cancel:()=>this.close(stream)});
       this.streams.add(stream);
@@ -46,7 +46,7 @@ export class McpEventStreams {
         }
         stream.cursor=page.cursor;more=page.hasMore;
       }
-      await this.env.DB.prepare('UPDATE mcp_kv SET expires=?2 WHERE key=?1').bind(stream.registryKey,Date.now()+60000).run();
+      await this.env.DB.prepare('UPDATE mcp_kv SET expires=?2 WHERE key=?1').bind(stream.registryKey,Math.floor(Date.now()/1000)+60).run();
       await this.write(stream,notification('heartbeat',{cursor:stream.cursor},stream.id));
     }catch(error){
       const details=eventError(error);

package/worker/mcp-events.mjs

@@ -78,7 +78,7 @@ export async function subscribeEvents(env,cat,caller,params,{now=Date.now}={}){
   const id=await subId(caller,params,url),previous=await stored(env,id),live=previous&&previous.expires>now();
   if(live&&previous.source!==eventSource(feed)){await removeEventHook(env,id);throw new EventsError(EVENT_ERRORS.unsupported,{feature:'payloadSchema',reason:'schema_changed'});}
   if(previous&&!live)await removeEventHook(env,id);
-  if(!live&&feed.maxSubscriptions!==undefined){const rows=(await env.DB.prepare("SELECT value FROM mcp_kv WHERE key LIKE 'mcp-event-hook:%'").all()).results;if(rows.filter(row=>{const sub=JSON.parse(row.value);return sub.name===params.name&&sub.expires>now();}).length>=feed.maxSubscriptions)throw new EventsError(EVENT_ERRORS.exhausted,{limit:'subscriptions',max:feed.maxSubscriptions});}
+  if(!live&&feed.maxSubscriptions!==undefined){const rows=(await env.DB.prepare("SELECT value FROM mcp_kv WHERE (key >= 'mcp-event-hook:' AND key < 'mcp-event-hook;')").all()).results;if(rows.filter(row=>{const sub=JSON.parse(row.value);return sub.name===params.name&&sub.expires>now();}).length>=feed.maxSubscriptions)throw new EventsError(EVENT_ERRORS.exhausted,{limit:'subscriptions',max:feed.maxSubscriptions});}
   const start=await eventStart(env,params,now());
   const sub={id,name:params.name,source:eventSource(feed),url,secret,principal:caller.id,connection:caller.connection??'local-test-owner',start:live?previous.start:start.after,expires:now()+Math.min(params.ttlMs??3600000,86400000)};
   if(live){if(previous.secret!==secret){sub.previous=previous.secret;sub.rotateUntil=now()+300000;}else if(previous.rotateUntil>now()){sub.previous=previous.previous;sub.rotateUntil=previous.rotateUntil;}}
@@ -98,15 +98,15 @@ export async function unsubscribeEvents(env,caller,params){
 /** Dynamic hooks become ordinary durable function deliveries: one queue and retry engine. */
 export async function eventHookSubscriptions(env,cat,options={}){
   const now=options.now??Date.now,definitions=[];let after='';
-  for(;;){const rows=(await env.DB.prepare("SELECT key,value FROM mcp_kv WHERE key LIKE 'mcp-event-hook:%' AND key>?1 ORDER BY key LIMIT 100").bind(after).all()).results;
+  for(;;){const rows=(await env.DB.prepare("SELECT key,value FROM mcp_kv WHERE (key >= 'mcp-event-hook:' AND key < 'mcp-event-hook;') AND key>?1 ORDER BY key LIMIT 100").bind(after).all()).results;
     for(const row of rows){const sub=JSON.parse(row.value);if(sub.expires<=now()){await removeEventHook(env,sub.id);continue;}
       let feed;
       try{feed=await checkEvent(env,cat,await eventCaller(env,sub.connection),{name:sub.name});if(!permittedCallback(env,sub.name,sub.url))throw new EventsError(EVENT_ERRORS.forbidden);if(sub.source!==eventSource(feed))throw new EventsError(EVENT_ERRORS.unsupported,{feature:'payloadSchema',reason:'schema_changed'});}
-      catch(error){try{await send(env,sub,control('terminated',{error:eventError(error)}),'msg_terminated_'+crypto.randomUUID(),options);}catch{}await removeEventHook(env,sub.id);continue;}
+      catch(error){try{await send(env,sub,control('terminated',{error:eventError(error)}),'msg_terminated_'+crypto.randomUUID(),options);}catch{/* Termination is best effort; the failed subscription is already being retired. */}await removeEventHook(env,sub.id);continue;}
       definitions.push({name:hookFunction(sub.id),event:feed.event,webhook:true,mcpEvent:true,matches:event=>matchesFeed(feed,event),async handler(event){
         const fresh=await stored(env,sub.id);if(!fresh||fresh.expires<=now())return;
         try{await checkEvent(env,cat,await eventCaller(env,fresh.connection),{name:fresh.name});}
-        catch(error){try{await send(env,fresh,control('terminated',{error:eventError(error)}),'msg_terminated_'+crypto.randomUUID(),options);}catch{}await removeEventHook(env,fresh.id);return;}
+        catch(error){try{await send(env,fresh,control('terminated',{error:eventError(error)}),'msg_terminated_'+crypto.randomUUID(),options);}catch{/* Termination is best effort; the failed subscription is already being retired. */}await removeEventHook(env,fresh.id);return;}
         try{await send(env,fresh,occurrence(fresh.name,event,await watermark(env,fresh)),event.id,options);}
         catch(error){const failure=new WebhookFailure(deliveryCategory(error));failure.permanent=error.status===410||error.status===413;throw failure;}
       }});

package/worker/mcp-room.mjs

@@ -1,3 +1,4 @@
+import {lobbyFor} from './lobby-shards.mjs';
 import {signControl,settingsOf,launchOf,seatsFor} from './office.mjs';
 import {appAccess} from './app-records.mjs';
 import {withToolIdentity} from './tool-identity.mjs';
@@ -23,7 +24,7 @@ export async function remoteSeat(env,cat,caller,op,args) {
   if(refusal)throw new Error(refusal.message);
   let room=args.room;
   if(!room&&op==='sit'){
-    const joined=await env.LOBBY.get(env.LOBBY.idFromName(meta.id)).fetch(`https://lobby/join?max=${max}&server=${serverId}&agent=1&ai=${policy.aiSeats+policy.guides}`,{method:'POST'});room=(await joined.json()).room;
+    const joined=await lobbyFor(env,meta.id).fetch(`https://lobby/join?max=${max}&server=${serverId}&agent=1&ai=${policy.aiSeats+policy.guides}`,{method:'POST'});room=(await joined.json()).room;
   }
   if(!/^[A-Za-z0-9_-]{1,32}$/.test(room??''))throw new Error('No room with people; an AI never starts a room');
   const ctl=await signControl(env,{op:'mcp-seat',game:meta.id,room,args:{...args,operation:op,connection:caller.connection,person:caller.id,name:caller.name??'Studio AI'}});

package/worker/mcp-store.mjs

@@ -1,3 +1,4 @@
+/** mcp_kv.expires is Unix seconds for ALL rows (OAuth, webhook dedupe and streams); NULL never expires. */
 /** OAuth's KV contract on the studio's existing D1. No new Cloudflare resource. */
 export const MCP_MIGRATION_FILE = '0017_studio_mcp.sql';
 export const MCP_MIGRATION = `CREATE TABLE IF NOT EXISTS mcp_kv (key TEXT PRIMARY KEY, value TEXT NOT NULL, expires INTEGER);
@@ -6,6 +7,15 @@ CREATE TABLE IF NOT EXISTS mcp_audit (id INTEGER PRIMARY KEY AUTOINCREMENT, pers
 CREATE TABLE IF NOT EXISTS mcp_limits (caller TEXT NOT NULL, minute INTEGER NOT NULL, n INTEGER NOT NULL, PRIMARY KEY(caller, minute));
 CREATE TABLE IF NOT EXISTS tool_data (namespace TEXT NOT NULL, key TEXT NOT NULL, value TEXT NOT NULL, PRIMARY KEY(namespace,key));
 `;
+/** Exclusive bound in SQLite's binary text order; null means no upper bound. */
+export function prefixEnd(prefix) {
+  const points=Array.from(prefix, c=>c.codePointAt(0));
+  while(points.length) {
+    const last=points.pop();
+    if(last<0x10ffff)return String.fromCodePoint(...points,last===0xd7ff?0xe000:last+1);
+  }
+  return null;
+}
 export function oauthStorage(DB) {
   return {
     async get(key, options) {
@@ -19,7 +29,8 @@ export function oauthStorage(DB) {
     async delete(key) { await DB.prepare('DELETE FROM mcp_kv WHERE key=?1').bind(key).run(); },
     async list({prefix = '', cursor = '', limit = 1000} = {}) {
       const n = Math.max(1,Math.min(1000,limit));
-      const rows = (await DB.prepare('SELECT key,expires FROM mcp_kv WHERE substr(key,1,?1)=?2 AND key>?3 AND (expires IS NULL OR expires>?4) ORDER BY key LIMIT ?5').bind(prefix.length,prefix,cursor,Math.floor(Date.now()/1000),n+1).all()).results;
+      const end=prefixEnd(prefix);
+      const rows = (await DB.prepare(`SELECT key,expires FROM mcp_kv WHERE key>=?1 ${end===null?'':'AND key<?2'} AND key>?3 AND (expires IS NULL OR expires>?4) ORDER BY key LIMIT ?5`).bind(prefix,end,cursor,Math.floor(Date.now()/1000),n+1).all()).results;
       return { keys: rows.slice(0,n).map(r=>({name:r.key,...(r.expires ? {expiration:r.expires}: {})})), list_complete: rows.length<=n, cursor: rows.length>n ? rows[n-1].key : '' };
     },
   };

package/worker/mcp-tools.mjs

@@ -78,8 +78,10 @@ export function services(env, cat, origin, caller, namespace, definition = {}) {
     fetch:globalThis.fetch.bind(globalThis),
     // A named secret may authenticate an HTTPS request; its value is never returned.
     async fetchWithSecret(name,url,init={}) {
-      const rule=cat.studio?.mcp?.secrets?.[name]; const target=new URL(url);
-      if(!rule || target.protocol!=='https:' || target.origin!==rule.origin || (!caller.owner&&!rule.tools?.includes(definition.name))) throw new Error('secret capability refused');
+      const rule=cat.studio?.mcp?.secrets?.[name];
+      const permittedOrigin=rule?.origin==='self'?new URL(origin).origin:rule?.origin;
+      const target=new URL(url,rule?.origin==='self'?permittedOrigin:undefined);
+      if(!rule || target.protocol!=='https:' || target.username || target.password || target.origin!==permittedOrigin || (!caller.owner&&!rule.tools?.includes(definition.name))) throw new Error('secret capability refused');
       const secret=env[name];if(typeof secret!=='string')throw new Error('secret unavailable');
       const headers=new Headers(init.headers);headers.set(rule.header??'authorization',`${rule.prefix??'Bearer '}${secret}`);
       const res=await fetch(target,{...init,headers,redirect:'error'});

package/worker/mcp.mjs

@@ -52,7 +52,11 @@ export async function remoteMcp(request,env,ctx,{catalogueOf,definitions=[]}) {
     }
     const cat=await catalogueOf();
     const tools=[...builtins(env,cat,origin),...definitions];
-    await pushToolList(env,cat,tools,origin);
+    // Catalogue notifications update existing streams; the caller's response
+    // uses the catalogue above and does not depend on that delivery finishing.
+    const refresh=pushToolList(env,cat,tools,origin);
+    if(ctx?.waitUntil)ctx.waitUntil(refresh);
+    else await refresh;
     if(request.method==='GET'&&env.LOBBY) {
       if(!request.headers.get('accept')?.includes('text/event-stream'))return json({error:'Accept text/event-stream required'},406);
       const connection=caller.connection??'public:'+crypto.randomUUID();

package/worker/office.mjs

@@ -1,3 +1,4 @@
+import {lobbyFor} from './lobby-shards.mjs';
 import {databaseBinding, ORIGINAL_DB} from './request-db.mjs';
 import { selling } from './extensions.mjs';
 import { purchaseOrderIfPresent } from './shop.mjs';
@@ -63,13 +64,13 @@ import { toolIdentity } from './tool-identity.mjs';
  * from an office key it is ALWAYS an ask (the AI may only propose one).
  */
 import { seatsOf } from './seats.mjs';
-import { diagnosticsOf, gatePlayers, roomLayout } from './gate.mjs';
+import { diagnosticsOf, gatePlayers, roomLayout } from './gate-routing.mjs';
 import { PUBLIC_SERVER, SERVER_LIMITS, checkServer, levelName, narrows, policyOf, roomServer, rowFor, serverView, serversOf, serverPassCookie, writeServer } from './servers.mjs';
 import { BRAIN_BUDGET, aiName, brainFor, fillSpot, passById, passCreate, passList, passRevoke, think } from './agents.mjs';
 import { DEFAULT_MODEL, NEURONS_PER_M, OWNER_MODEL, vocabularyOf } from './brain.mjs';
 import { OWNER_COOKIE, cookieValues, counter, ownerAllowed, ownerSession, today } from './stats.mjs';
 import { esc, layout, notFoundPage } from './site.mjs';
-import { confirmPage, lockedPage, officePage } from './office-page.mjs';
+
 import { CHAT_MODES, CHAT_WHO, checkChatRules, publicChat } from './chat.mjs';
 import { chatDay, chatOf, chatRowsOf, clearChatRules, dismissReport, reportsOf, writeChatRules } from './chat-store.mjs';
 import { checkRelease, performRelease, checkRefund, describeRefund, officeShopPage, ordersCsv, performRefund, shopOffice } from './shop.mjs';
@@ -142,12 +143,8 @@ export function canonical(v) {
 
 /* ------------------------------------------------------------------ player accounts (a seam) */
 
-let players = null;
-/**
- * The player-accounts API, handed over once by a studio's Worker that has it:
- * `{ get(id, env), of?(request, env), isOwner?(request, env) }` (worker/players.mjs `players` is exactly this).
- */
-export function usePlayers(api) { players = api && typeof api === 'object' ? api : null; }
+import {players} from './player-registry.mjs';
+export {usePlayers} from './player-registry.mjs';
 
 async function playerOf(env, id) {
   if (!players?.get || !id) return null;
@@ -414,7 +411,7 @@ export async function redeemInvite(request, env, url, cat, meta, settings) {
 
 /* ------------------------------------------------------------------ talking to rooms */
 
-const lobbyOf = (env, game) => env.LOBBY.get(env.LOBBY.idFromName(game));
+const lobbyOf = (env, game) => lobbyFor(env,game);
 const tableOf = (env, game, room) => env.TABLE.get(env.TABLE.idFromName(`${game}/${room}`));
 
 /** The rooms of one game with people in them now, as its Lobby last heard (public and named). */
@@ -554,7 +551,7 @@ export async function agentsTry(env, cat, body) {
     const n = Math.round(t.cost.neurons);
     if (n > 0) rows.push(counter(env, { metric: 'brain-neurons', subject: meta.id, n }));
     if (t.cost.micros >= 1) rows.push(counter(env, { metric: 'brain-microdollars', subject: meta.id, n: Math.round(t.cost.micros) }));
-    await env.DB.batch(rows.filter(Boolean)).catch(() => {});
+    await env.DB.batch(rows.filter(Boolean));
   }
   return {
     ok: true, game: meta.id, mode, model: t.model ?? (mode === 'workers-ai' ? e.HOMIE_BRAIN_MODEL || DEFAULT_MODEL : null), engine: t.engine, provider: t.provider,
@@ -1118,7 +1115,7 @@ export async function perform(env, cat, a) {
       if (a.budget !== undefined) {
         const day = await brainDay(env);
         const next = { neurons: day.budget.neurons, usd: day.budget.usd, ...(a.mode === 'workers-ai' ? { neurons: Math.round(a.budget) } : { usd: Math.round(a.budget * 100) / 100 }) };
-        await env.DB.prepare("INSERT OR REPLACE INTO meta (key, value) VALUES ('brain_budget', ?1)").bind(JSON.stringify(next)).run().catch(() => {});
+        await env.DB.prepare("INSERT OR REPLACE INTO meta (key, value) VALUES ('brain_budget', ?1)").bind(JSON.stringify(next)).run();
       }
       await pushPolicy(env, meta, settings, sv);
       const day = await brainDay(env);
@@ -1342,42 +1339,42 @@ export async function officeRoutes(request, env, url, { catalogueOf }) {
   if (path === '/_studio/office' || path === '/_studio/office/') {
     const cat = await catalogueOf();
     if (request.method !== 'GET') return new Response('method', { status: 405 });
-    if (!(await isOwner(request, env))) return lockedPage(cat, { what: 'office' });
+    if (!(await isOwner(request, env))) return (await import('./office-page.mjs')).lockedPage(cat, { what: 'office' });
     // A session from before 0.13.0 lives only under /_studio/: carry it to / so the owner's games know them too.
     const session = await ownerSession(request, env);
     const secure = url.protocol === 'https:' ? '; Secure' : '';
-    return officePage(cat, session ? { 'set-cookie': `${OWNER_COOKIE}=${session}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${30 * 24 * 3600}${secure}` } : {});
+    return (await import('./office-page.mjs')).officePage(cat, session ? { 'set-cookie': `${OWNER_COOKIE}=${session}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${30 * 24 * 3600}${secure}` } : {});
   }
   if (path === '/_studio/office/shop' || path === '/_studio/office/shop/') {
     const cat = await catalogueOf();
     if (request.method !== 'GET') return new Response('method', { status: 405 });
-    if (!(await isOwner(request, env))) return lockedPage(cat, { what: 'office' });
+    if (!(await isOwner(request, env))) return (await import('./office-page.mjs')).lockedPage(cat, { what: 'office' });
     return officeShopPage(cat);
   }
   const confirm = /^\/_studio\/confirm\/(ask_[a-f0-9]{16})\/?$/.exec(path);
   if (confirm) {
     const cat = await catalogueOf();
-    if (!(await isOwner(request, env))) return lockedPage(cat, { what: 'confirm', ask: confirm[1] });
+    if (!(await isOwner(request, env))) return (await import('./office-page.mjs')).lockedPage(cat, { what: 'confirm', ask: confirm[1] });
     const row = await readAsk(env, confirm[1]);
-    if (!row) return confirmPage(cat, null, { missing: true });
+    if (!row) return (await import('./office-page.mjs')).confirmPage(cat, null, { missing: true });
     const ask = askView(row, cat, url.origin);
-    if (request.method === 'GET') return confirmPage(cat, ask);
+    if (request.method === 'GET') return (await import('./office-page.mjs')).confirmPage(cat, ask);
     if (request.method !== 'POST' || !sameOrigin(request, url)) return new Response('Not allowed', { status: 403 });
     let yes = false;
     try { yes = String((await request.formData()).get('do') ?? '') === 'yes'; } catch { yes = false; }
-    if (ask.state !== 'pending') return confirmPage(cat, ask);
+    if (ask.state !== 'pending') return (await import('./office-page.mjs')).confirmPage(cat, ask);
     if (!yes) {
       await env.DB.prepare("UPDATE office_asks SET state = 'cancelled' WHERE id = ?1 AND state = 'pending'").bind(ask.id).run();
-      return confirmPage(cat, { ...ask, state: 'cancelled' });
+      return (await import('./office-page.mjs')).confirmPage(cat, { ...ask, state: 'cancelled' });
     }
     // Claim it first, so a double tap does it once.
     await env.DB.prepare("UPDATE office_asks SET state = 'working' WHERE id = ?1 AND state = 'pending'").bind(ask.id).run();
     const claimed = await readAsk(env, ask.id);
-    if (claimed?.state !== 'working') return confirmPage(cat, askView(claimed ?? row, cat, url.origin));
+    if (claimed?.state !== 'working') return (await import('./office-page.mjs')).confirmPage(cat, askView(claimed ?? row, cat, url.origin));
     if (ask.action.op === 'shop-release') ask.action.by = await releaseIdentity(request, env);
     const result = await perform(env, cat, ask.action);
     await env.DB.prepare('UPDATE office_asks SET state = ?2, result = ?3 WHERE id = ?1').bind(ask.id, result.ok ? 'done' : 'failed', JSON.stringify(result).slice(0, 4000)).run();
-    return confirmPage(cat, { ...ask, state: result.ok ? 'done' : 'failed', result });
+    return (await import('./office-page.mjs')).confirmPage(cat, { ...ask, state: result.ok ? 'done' : 'failed', result });
   }
   return null;
 }

package/worker/operational-schema.mjs

@@ -28,3 +28,19 @@ ${['INSERT','UPDATE','DELETE'].map(op=>{const row=op==='DELETE'?'OLD':'NEW';retu
  ${op==='UPDATE'?`INSERT INTO tool_data_revisions SELECT OLD.namespace,1 WHERE OLD.namespace!=NEW.namespace ON CONFLICT(namespace) DO UPDATE SET revision=revision+1;`:''}
 END;`;}).join('\n')}
 `;
+
+export const RUNTIME_INDEX_MIGRATION_FILE='0034_runtime_indexes.sql';
+export const RUNTIME_INDEX_MIGRATION=`-- Older stream registrations used milliseconds; OAuth and dedupe already use seconds.
+UPDATE mcp_kv SET expires=CAST(expires / 1000 AS INTEGER) WHERE expires>100000000000 AND (key GLOB 'tools-stream:*' OR key GLOB 'mcp-event-stream:*');
+CREATE INDEX IF NOT EXISTS mcp_kv_expires ON mcp_kv(expires) WHERE expires IS NOT NULL;
+`;
+
+export const EXTRA_RUNTIME_MIGRATIONS={
+  "0036_lobby_summaries.sql":`CREATE TABLE IF NOT EXISTS lobby_summaries(game TEXT PRIMARY KEY,rooms TEXT NOT NULL,updated INTEGER NOT NULL);
+`,
+  "0035_payment_delivery.sql":`CREATE TABLE IF NOT EXISTS stripe_intake(id TEXT PRIMARY KEY,payload TEXT NOT NULL,origin TEXT NOT NULL,received INTEGER NOT NULL,lease INTEGER NOT NULL DEFAULT 0,done INTEGER);
+CREATE INDEX IF NOT EXISTS stripe_intake_pending ON stripe_intake(lease,received,id) WHERE done IS NULL;
+CREATE INDEX IF NOT EXISTS stripe_intake_done ON stripe_intake(done) WHERE done IS NOT NULL;
+CREATE INDEX IF NOT EXISTS shop_events_at ON shop_events(at);
+`,
+};

package/worker/page-policy.mjs

@@ -0,0 +1,29 @@
+import {STUDIO_VERSION_TAG} from './version.mjs';
+import {playerAncestors} from './embed.mjs';
+export function shellKey(g) {
+  // Never what names a build (the rules' build and state hashes, the bundle's version): those change with every
+  // edit, and a newer build of the same game inside the same page is exactly what the frame's own reload is for.
+  const { build: _build, stateHash: _state, ...room } = g?.room ?? {};
+  const { version: _version, ...netplay } = g?.netplay ?? {};
+  const text = JSON.stringify([g?.kind ?? null, g?.players ?? null, room, g?.saves ?? null, g?.agents ?? null, g?.screen ?? null, netplay, g?.launch ?? null]);
+  let h = 2166136261;
+  for (let i = 0; i < text.length; i += 1) { h ^= text.charCodeAt(i); h = Math.imul(h, 16777619); }
+  return `${STUDIO_VERSION_TAG}-${(h >>> 0).toString(36)}`;
+}
+export function shellStandIn(room, key) {
+  const message = key ? { t: 'homie-net', what: 'shell', key } : { t: 'homie-net', what: 'rematch', room };
+  return `<!doctype html><meta charset="utf-8"><title>Updating</title><body style="margin:0;background:#0b0d14;color:#cfd6e6;font:15px system-ui;display:grid;place-items:center;height:100vh"><p>This game was updated. Loading it again…</p><script>try{parent.postMessage(${JSON.stringify(message).replace(/</g, '\\u003c')},'*');}catch(e){}</script>`;
+}
+export const ROOM_ID = /^[A-Za-z0-9_-]{1,32}$/;
+export function frameAncestors(cat) {
+  const extra = (Array.isArray(cat?.studio?.site?.frameAncestors) ? cat.studio.site.frameAncestors : [])
+    .map((o) => { try { const u = new URL(String(o)); return u.protocol === 'https:' && u.origin === String(o).replace(/\/+$/, '') ? u.origin : null; } catch { return null; } })
+    .filter(Boolean).slice(0, 8);
+  return ["'self'", ...extra].join(' ');
+}
+export function embedAncestors(cat, origin, preview = false) {
+  const normal = playerAncestors(cat);
+  if (!preview || !/^http:\/\/(?:localhost|127\.0\.0\.1)(?::\d+)?$/.test(origin)) return normal;
+  const port = new URL(origin).port;
+  return `${normal === "'none'" ? '' : normal} http://localhost${port ? ':' + port : ''} http://127.0.0.1${port ? ':' + port : ''}`.trim();
+}

package/worker/pages.mjs

@@ -1,3 +1,5 @@
+import {ROOM_ID,shellKey,shellStandIn,frameAncestors,embedAncestors} from './page-policy.mjs';
+export {ROOM_ID,shellKey,shellStandIn,frameAncestors,embedAncestors} from './page-policy.mjs';
 import {JOIN_AREA_SHELL_JS} from './join-area.mjs';
 import { appWords, openPath } from './app-format.mjs';
 import { APP_SHELL_JS } from './app-shell.mjs';
@@ -7,7 +9,7 @@ import { APP_SHELL_JS } from './app-shell.mjs';
  */
 import { playerAncestors, PLAYER_SANDBOX, PLAYER_SIZE } from './embed.mjs';
 import { esc, layout, gameSocialTags } from './site.mjs';
-import { NET_PALETTE } from './room.mjs';
+import { NET_PALETTE } from './room-protocol.mjs';
 import { PARAM_VALUE, PREFS_LIMITS, playParams } from './seats.mjs';
 import { STUDIO_VERSION_TAG } from './version.mjs';
 
@@ -19,26 +21,14 @@ import { STUDIO_VERSION_TAG } from './version.mjs';
  * instead of hosting a newer game inside a page that lacks what that game needs (a player ticket, for one).
  * It does not change when only the game's code or art does: that is still a reload of the frame alone.
  */
-export function shellKey(g) {
-  // Never what names a build (the rules' build and state hashes, the bundle's version): those change with every
-  // edit, and a newer build of the same game inside the same page is exactly what the frame's own reload is for.
-  const { build: _build, stateHash: _state, ...room } = g?.room ?? {};
-  const { version: _version, ...netplay } = g?.netplay ?? {};
-  const text = JSON.stringify([g?.kind ?? null, g?.players ?? null, room, g?.saves ?? null, g?.agents ?? null, g?.screen ?? null, netplay, g?.launch ?? null]);
-  let h = 2166136261;
-  for (let i = 0; i < text.length; i += 1) { h ^= text.charCodeAt(i); h = Math.imul(h, 16777619); }
-  return `${STUDIO_VERSION_TAG}-${(h >>> 0).toString(36)}`;
-}
+
 /**
  * The frame's stand-in when its page is older than the game it would host. It tells the page, and loads no game.
  * `key`: the page understands the handshake and reloads itself once. No key: a page from before the handshake, whose
  * only way to load a whole new page is the one it has for leaving a finished room; it is used only when the game cannot
  * work inside that page at all.
  */
-export function shellStandIn(room, key) {
-  const message = key ? { t: 'homie-net', what: 'shell', key } : { t: 'homie-net', what: 'rematch', room };
-  return `<!doctype html><meta charset="utf-8"><title>Updating</title><body style="margin:0;background:#0b0d14;color:#cfd6e6;font:15px system-ui;display:grid;place-items:center;height:100vh"><p>This game was updated. Loading it again…</p><script>try{parent.postMessage(${JSON.stringify(message).replace(/</g, '\\u003c')},'*');}catch(e){}</script>`;
-}
+
 import { SKILLS } from './agents.mjs';
 import { KIDS_LINE, POLICY_WORDS } from './servers.mjs';
 import { SAVES_SHELL_CSS, SAVES_SHELL_JS } from './saves-shell.mjs';
@@ -49,18 +39,13 @@ import { ARRIVAL_JS, arrivalCard } from './arrival.mjs';
 export { homePage, mediaIndexPage, notFoundPage, songPage, videoPage } from './site.mjs';
 
 /** A room code: 1 to 32 letters, digits, - or _. */
-export const ROOM_ID = /^[A-Za-z0-9_-]{1,32}$/;
+
 
 /**
  * Who may put the play page (and so the game) inside a frame: this site, plus the https origins studio.json
  * `site.frameAncestors` names (for example a hub that embeds the game). Anything else is refused by the browser.
  */
-export function frameAncestors(cat) {
-  const extra = (Array.isArray(cat?.studio?.site?.frameAncestors) ? cat.studio.site.frameAncestors : [])
-    .map((o) => { try { const u = new URL(String(o)); return u.protocol === 'https:' && u.origin === String(o).replace(/\/+$/, '') ? u.origin : null; } catch { return null; } })
-    .filter(Boolean).slice(0, 8);
-  return ["'self'", ...extra].join(' ');
-}
+
 
 /** What a play, big-screen or watch page answers to a room code it cannot use: said on the page, never a silent public room. */
 export function badRoomPage(cat, g, raw, { screen = false, watch = false } = {}) {
@@ -998,7 +983,7 @@ const SHELL_JS = String.raw`${BUILD_RETRY_JS}(function () {
     try { arrived = performance.getEntriesByType('navigation')[0].type; } catch (e) {}
     askedRoom = kept && (arrived === 'reload' || arrived === 'back_forward') && EMBED_ROOM.test(kept.room || '') ? kept.room : null;
   }
-  var lobbyQ = [];
+  var lobbyQ = ['b=' + encodeURIComponent(roomKey)];
   if (state.server) lobbyQ.push('server=' + encodeURIComponent(state.server.id));
   if (/^[A-Za-z0-9_,-]{1,140}$/.test(params.get('not') || '')) lobbyQ.push('not=' + encodeURIComponent(params.get('not')));
   // Once the game has the screen, the chip says the room's facts for a few seconds, then gets out of the way.
@@ -1596,12 +1581,7 @@ const WATCH_JS = String.raw`${BUILD_RETRY_JS}(function () {
   }
 }());`;
 
-export function embedAncestors(cat, origin, preview = false) {
-  const normal = playerAncestors(cat);
-  if (!preview || !/^http:\/\/(?:localhost|127\.0\.0\.1)(?::\d+)?$/.test(origin)) return normal;
-  const port = new URL(origin).port;
-  return `${normal === "'none'" ? '' : normal} http://localhost${port ? ':' + port : ''} http://127.0.0.1${port ? ':' + port : ''}`.trim();
-}
+
 
 export function embedPreview(cat, g, origin) {
   const frameOrigin = new URL(origin); frameOrigin.hostname = frameOrigin.hostname === 'localhost' ? '127.0.0.1' : 'localhost';

package/worker/parts.mjs

@@ -17,7 +17,8 @@ import { esc, icon, layout, notFoundPage } from './site.mjs';
 const PART_ID = /^[a-z0-9][a-z0-9-]{0,47}$/;
 const VERSION = /^\d{1,6}\.\d{1,6}\.\d{1,6}(?:-[0-9A-Za-z.-]{1,40})?$/;
 /** A packed part's files: framed by the part's own page and by the hub, so they keep their own frame rule (index.mjs finish). */
-export const PART_FILES = /^\/parts\/[a-z0-9][a-z0-9-]{0,47}\/\d{1,6}\.\d{1,6}\.\d{1,6}[^/]*\//;
+import {PART_FILES} from './asset-paths.mjs';
+export {PART_FILES} from './asset-paths.mjs';
 export const PARTS_WELL_KNOWN = '/.well-known/homie-parts.json';
 export const isPartsPath = (path) => path === '/openapi.json' || path === '/.well-known/api-catalog' || path === '/parts/catalog.json' || path === '/purchases/keys.json' || path === PARTS_WELL_KNOWN || path === '/parts' || path.startsWith('/parts/');
 

package/worker/payment-recovery.mjs

@@ -2,13 +2,13 @@ import { pendingJobsSQL, definitiveRefusal, REPLAY_LIMIT_MS, recoveryAction } fr
 import { orderFact, recordOrderState, releaseClaim } from './purchase-core.mjs';
 import { resumeSettlement } from './settlement-journal.mjs';
 /** Durable provider recordings outlive responses. A verified chain transfer is payment. */
-import { stripeCall, refundPayment, modeOf } from './stripe.mjs';
+import { stripeCall, refundPayment, modeOf, STRIPE_VERSION } from './stripe.mjs';
 import { byId, resourceAvailable } from './purchase-store.mjs';
 export async function saveRecording(env, order, params, options) {
   const chain = params.payment_method_options?.crypto?.transaction_verification_options;
   const id = chain ? `${order.id}:${chain.network}:${chain.transaction_hash}` : options.idempotencyKey;
   await env.DB.prepare("INSERT OR IGNORE INTO purchase_jobs (id,order_id,mode,state,payload,updated_at) VALUES (?1,?2,?3,?4,?5,?6)")
-    .bind(id, order.id, order.mode, chain ? 'paid_recording' : 'submitted', JSON.stringify({ params, options: { ...options, idempotencyKey: chain ? chain.transaction_hash : options.idempotencyKey }, chain, startedAt: Date.now() }), Date.now()).run();
+    .bind(id, order.id, order.mode, chain ? 'paid_recording' : 'submitted', JSON.stringify({ params, options: { ...options, version: options.version ?? options.apiVersion ?? STRIPE_VERSION, idempotencyKey: chain ? chain.transaction_hash : options.idempotencyKey }, chain, startedAt: Date.now() }), Date.now()).run();
   if (chain) {
     // Only the protocol's verified settlement callback reaches here, never buyer input.
     await orderFact(env, order.id, 'payment', {paid_at: Date.now()}).run();
@@ -16,6 +16,11 @@ export async function saveRecording(env, order, params, options) {
   }
   return id;
 }
+/** Persist the provider id before any follow-up retrieve/cancel/fulfillment call. */
+export async function recordProviderId(env, order, id, pi) {
+  if (!/^pi_[A-Za-z0-9]+$/.test(pi.id) || pi.amount !== order.amount || pi.currency !== order.currency || pi.livemode !== (order.mode === 'live')) throw new Error('Provider receipt does not match order');
+  await env.DB.prepare('UPDATE purchase_jobs SET payment=?2,updated_at=?3 WHERE id=?1').bind(id,pi.id,Date.now()).run();
+}
 export async function recordProviderResult(env, order, id, pi) {
   if (pi.amount !== order.amount || pi.currency !== order.currency || pi.livemode !== (order.mode === 'live')) throw new Error('Provider receipt does not match order');
   await env.DB.prepare("UPDATE purchase_jobs SET payment = ?2, state = ?3, error = NULL, updated_at = ?4 WHERE id = ?1").bind(id, pi.id, pi.status === 'succeeded' ? 'recorded' : ['canceled','requires_payment_method'].includes(pi.status) ? 'failed' : 'processing', Date.now()).run();
@@ -37,31 +42,40 @@ export async function recordingFailure(env, id, error) {
     await env.DB.prepare("UPDATE purchase_jobs SET state = 'failed', error = ?2, attempts = attempts + 1, updated_at = ?3 WHERE id = ?1 AND state = 'submitted'").bind(id, String(error.message).slice(0, 500), Date.now()).run();
     return;
   }
+  if(error.manualReview) {
+    await env.DB.prepare("UPDATE purchase_jobs SET state='manual_review',error=?2,updated_at=?3 WHERE id=?1").bind(id,error.message,Date.now()).run();
+    return;
+  }
   // A failure of our call is not a fact about the original payment.
   await env.DB.prepare("UPDATE purchase_jobs SET error = ?2, attempts = attempts + 1, updated_at = ?3 WHERE id = ?1")
     .bind(id, String(error.message).slice(0, 500), Date.now()).run();
 }
 
-/** Read existing objects first. Listing avoids the search index's delayed negative answers. */
+/** Read the recorded object, or recover a lost create response with its original key. */
 export async function readProviderPayment(env, order, job, payment = null) {
-  const options = { version: '2026-07-29.preview' };
+  const readOptions = { version: STRIPE_VERSION };
   if (payment && !/^pi_[A-Za-z0-9]+$/.test(payment)) throw new Error('Supply an existing Stripe PaymentIntent id');
   if (job.payment || payment) {
-    const pi = await stripeCall(env, 'GET', `/v1/payment_intents/${encodeURIComponent(job.payment ?? payment)}`, null, options);
+    const pi = await stripeCall(env, 'GET', `/v1/payment_intents/${encodeURIComponent(job.payment ?? payment)}`, null, readOptions);
     if (pi.metadata?.order !== order.id) throw new Error('The existing PaymentIntent belongs to another order');
     return pi;
   }
-  let cursor;
-  for (let page = 0; page < 100; page++) {
-    const result = await stripeCall(env, 'GET', '/v1/payment_intents', { limit: 100, created: { gte: Math.floor(order.created_at / 1000) - 60 }, ...(cursor ? { starting_after: cursor } : {}) }, options);
-    if (!Array.isArray(result.data)) throw new Error('Stripe did not return an existing-payment list');
-    const found = result.data.find((pi) => pi.metadata?.order === order.id);
-    if (found) return found;
-    if (!result.has_more) return null;
-    cursor = result.data.at(-1)?.id;
-    if (!cursor) throw new Error('Stripe payment list has no continuation');
+  const {params,options,startedAt}=JSON.parse(job.payload??'{}');
+  if(params&&options?.idempotencyKey&&Date.now()-(startedAt??order.created_at)<REPLAY_LIMIT_MS) {
+    // If the create response was lost, replay only the original request/key
+    // inside Stripe's guaranteed retention window. Never scan the account.
+    const version=options.version ?? options.apiVersion;
+    if(!version) {
+      const error=new Error('Original Stripe API version is missing; reconcile this retained order with an existing PaymentIntent id instead of replaying an uncertain request.');
+      error.manualReview=true;throw error;
+    }
+    const pi=await stripeCall(env,'POST','/v1/payment_intents',params,{...options,version});
+    await recordProviderId(env,order,job.id,pi);
+    return pi;
   }
-  throw new Error(`Existing payment scan exceeded 100 pages for order ${order.id}; the owner must reconcile this order.`);
+  const error=new Error(`PaymentIntent id missing after the safe replay window for order ${order.id}; reconcile with an existing PaymentIntent id. The order and its claim are retained.`);
+  error.manualReview=true;
+  throw error;
 }
 async function releaseUnpaid(env, order, job, pi = null) {
   await env.DB.batch([
@@ -87,18 +101,18 @@ export async function reconcileRecordings(env, orderId = null, dependencies = {}
       switch (recoveryAction(observation)) {
         case 'fail':
           if (pi?.status === 'requires_payment_method') {
-            pi = await stripeCall(env, 'POST', `/v1/payment_intents/${encodeURIComponent(pi.id)}/cancel`, {}, { idempotencyKey: `cancel-action-${pi.id}`, version: '2026-07-29.preview' });
+            pi = await stripeCall(env, 'POST', `/v1/payment_intents/${encodeURIComponent(pi.id)}/cancel`, {}, { idempotencyKey: `cancel-action-${pi.id}`, version: STRIPE_VERSION });
             if (pi.status !== 'canceled') throw new Error('The unpaid payment could not be canceled; the claim remains reserved');
           }
           await releaseUnpaid(env, order, job, pi); continue;
-        case 'replay': pi = await stripeCall(env, 'POST', '/v1/payment_intents', params, { ...options, version: '2026-07-29.preview' }); break;
+        case 'replay': pi = await stripeCall(env, 'POST', '/v1/payment_intents', params, { ...options, version: options.version ?? options.apiVersion ?? STRIPE_VERSION }); break;
         default:
           if (!pi) {
             if (deadline) throw new Error(`Paid transfer still needs recording: order ${order.id}; key ${options.idempotencyKey}`);
-            pi = await stripeCall(env, 'POST', '/v1/payment_intents', params, { ...options, version: '2026-07-29.preview' });
+            pi = await stripeCall(env, 'POST', '/v1/payment_intents', params, { ...options, version: options.version ?? options.apiVersion ?? STRIPE_VERSION });
           }
       }
-      if (['requires_action','requires_confirmation','requires_capture','requires_payment_method'].includes(pi.status) || orderId && dependencies.cancel === true && pi.status === 'processing') pi = await stripeCall(env, 'POST', `/v1/payment_intents/${encodeURIComponent(pi.id)}/cancel`, {}, { idempotencyKey: `cancel-action-${pi.id}`, version: '2026-07-29.preview' });
+      if (['requires_action','requires_confirmation','requires_capture','requires_payment_method'].includes(pi.status) || orderId && dependencies.cancel === true && pi.status === 'processing') pi = await stripeCall(env, 'POST', `/v1/payment_intents/${encodeURIComponent(pi.id)}/cancel`, {}, { idempotencyKey: `cancel-action-${pi.id}`, version: STRIPE_VERSION });
       await recordProviderResult(env, order, job.id, pi);
       if (['canceled','requires_payment_method'].includes(pi.status)) { await releaseUnpaid(env, order, job, pi); continue; }
       if (pi.status !== 'succeeded') {

package/worker/player-registry.mjs

@@ -0,0 +1,9 @@
+export let players = null;
+let configured=false;
+/**
+ * The player-accounts API, handed over once by a studio's Worker that has it:
+ * `{ get(id, env), of?(request, env), isOwner?(request, env) }` (worker/players.mjs `players` is exactly this).
+ */
+export function usePlayers(api) { configured=true; players = api && typeof api === 'object' ? api : null; }
+
+export function defaultPlayers(api) { if(!configured)players=api; }