@homie-rocks/studio 0.55.0 → 0.57.0

package/rules/host.ts

@@ -87,6 +87,8 @@ export interface HostOptions {
   restoreEpoch?: number;
   startDelayMs?: number;
   onTick?(): void;
+  /** Suspend settled round breaks; the owner persists and wakes this deadline. */
+  onRoundIdle?(until: number): void;
   /** Only the shared server isolate can attribute timer lateness to another tick. */
   enforceOverrun?: boolean;
   log?(line: Record<string, unknown>): void;
@@ -111,6 +113,8 @@ export interface Host {
   readonly epoch: number;
   readonly running: boolean;
   readonly paused: boolean;
+  readonly roundIdleUntil: number | null;
+  wakeRound(): void;
   readonly people: number;
   readonly viewRadiusM: number | null;
   readonly privateDelivery: boolean;
@@ -199,13 +203,14 @@ export function createHost(o: HostOptions): Host {
   // A log that throws takes nothing down with it.
   const log = (line: Record<string, unknown>): void => { try { o.log?.(line); } catch { /* nothing to say it with */ } };
   const random = o.random ?? Math.random;
-  const saved = o.restore ? fromBytes(o.restore) as { v: number; characters?: CharacterLease[]; core: SavedCore; names: [number, string][]; agents?: AgentsSaved; guideViews?: [number, { id: string; at: number; value: Record<string, unknown> }][]; queues: [number, Record<string, unknown>, StepInput['claim'], number, number][]; inputs?: [number, SeatIn][] } : null;
+  const saved = o.restore ? fromBytes(o.restore) as { v: number; roundIdleUntil?: number; characters?: CharacterLease[]; core: SavedCore; names: [number, string][]; agents?: AgentsSaved; guideViews?: [number, { id: string; at: number; value: Record<string, unknown> }][]; queues: [number, Record<string, unknown>, StepInput['claim'], number, number][]; inputs?: [number, SeatIn][] } : null;
   if (o.restore && (!saved || typeof saved !== 'object' || Array.isArray(saved))) throw new Error('saved host is not an object');
   if (saved) {
     const check = (ok: unknown): void => { if (!ok) throw new Error('saved host inputs are invalid'); };
     const uint = (n: unknown): boolean => Number.isSafeInteger(n) && (n as number) >= 0;
-    check(Object.keys(saved).every(k => ['v', 'core', 'names', 'agents', 'guideViews', 'queues', 'inputs', 'characters'].includes(k)));
+    check(Object.keys(saved).every(k => ['v', 'core', 'names', 'agents', 'guideViews', 'queues', 'inputs', 'characters', 'roundIdleUntil'].includes(k)));
     check(saved.core && Array.isArray(saved.names) && Array.isArray(saved.queues));
+    if (saved.roundIdleUntil !== undefined) check(Number.isFinite(saved.roundIdleUntil) && saved.roundIdleUntil >= 0 && saved.core.round[1] === 0 && !saved.core.overAt);
     if (saved.characters !== undefined) {
       check(c.settings.characters && Array.isArray(saved.characters));
       check(new Set(saved.characters.map(c => c.account)).size === saved.characters.length);
@@ -396,6 +401,7 @@ export function createHost(o: HostOptions): Host {
       core.goal(b.seat, g?.state === 'active' ? { goal: g.goal, args: g.args, from: g.from, at: Math.round(g.at / period), asked: g.asked === true } : null);
     }
   }
+  let roundIdleUntil: number | null = o.onRoundIdle && Number.isFinite(saved?.roundIdleUntil) ? saved!.roundIdleUntil! : null;
   let running = false;
   let paused = Boolean(saved && (o.startPaused ?? o.restoreEpoch !== undefined));
   let ended = false;
@@ -594,7 +600,7 @@ export function createHost(o: HostOptions): Host {
           core.seatLeave(held.seat);
           tick(o.clock.now());
         } else core.seatAway(m.seat as number, true);
-        if (running && people() === 0) pause();
+        if ((running || roundIdleUntil !== null) && people() === 0) pause();
         return;
       }
       case 'free': {
@@ -832,7 +838,17 @@ export function createHost(o: HostOptions): Host {
     }
     timing.record('tick', tickAt);
     if (ended) return;
-    if (!faulted && core.stats.ticksCut === cut) { failingSince = null; return; }
+    if (!faulted && core.stats.ticksCut === cut) {
+      failingSince = null;
+      const round = core.round();
+      if (o.onRoundIdle && running && round.phase === 'over' && round.results && round.endsAt > core.tick) {
+        roundIdleUntil = now + (round.endsAt - core.tick) * period;
+        running = false; disarm();
+        try { o.store?.save(save()); o.onRoundIdle(roundIdleUntil); }
+        catch (error) { fault('round-idle', error); stop(); o.onEnd?.('storage-or-tick-failed', { tick: core.tick }); }
+      }
+      return;
+    }
     if (failingSince === null) failingSince = now;
     if (now - failingSince < FAIL_MS) return;
     if (faulted) end('fault', { error: stats.lastFault, faults: stats.faults });
@@ -913,7 +929,7 @@ export function createHost(o: HostOptions): Host {
   const self = { blame: (): void => { blamed = true; } };
 
   function start(): void {
-    if (running || ended) return;
+    if (running || ended || roundIdleUntil !== null) return;
     running = true; paused = false;
     try {
       base = { ms: o.clock.now() + (firstTick ? o.startDelayMs ?? 0 : 0), tick: core.tick };
@@ -926,26 +942,37 @@ export function createHost(o: HostOptions): Host {
     } catch (error) { fault('start', error); } finally { keepTime(); }
   }
   function pause(): void {
-    if (!running) return;
+    if (!running) {
+      if (roundIdleUntil !== null && !paused) { paused = true; checkpoint(true); o.onPause?.(); }
+      return;
+    }
     running = false; paused = true;
     // A pending timer would keep the object in memory and billed: the pause clears it.
     disarm();
     log({ ev: 'host-pause', game: o.game, tick: core.tick });
     try { checkpoint(true); o.onPause?.(); } catch (error) { fault('onPause', error); if (persistent) { stop(); o.onEnd?.('storage-or-tick-failed', { tick: core.tick }); } }
   }
-  function resume(): void {
-    if (running || ended || !paused) return;
+  function resume(announceRound = true): void {
+    if (running || ended || !paused || roundIdleUntil !== null) return;
     running = true; paused = false;
     try {
       // The room resumes at the tick it paused on: no tick is skipped and no timer fires for the gap.
       base = { ms: o.clock.now() + (firstTick ? o.startDelayMs ?? 0 : 0), tick: core.tick };
       overSince = null; blamed = false; failingSince = null; lastStart = base.ms;
-      handle([core.round()], base.ms);
+      if (announceRound) handle([core.round()], base.ms);
       for (const q of queues.values()) q.lastFrameTick = core.tick;
       log({ ev: 'host-resume', game: o.game, tick: core.tick });
       o.onResume?.();
     } catch (error) { fault('resume', error); } finally { keepTime(); }
   }
+  function wakeRound(): void {
+    if (roundIdleUntil === null || o.clock.now() < roundIdleUntil || ended) return;
+    if (!core.resumeRound()) throw new Error('Round is not settled');
+    roundIdleUntil = null;
+    handle(core.drain(), o.clock.now());
+    if (people() > 0) { paused = true; resume(false); }
+    else { paused = true; checkpoint(true); }
+  }
   /** What a relay keeps for whoever joins next, said again: the round with its results, the roster, the shared state, the capabilities. */
   function announce(): void {
     if (ended) return;
@@ -975,7 +1002,7 @@ export function createHost(o: HostOptions): Host {
 
   function save(): Uint8Array {
     const reserved = new Set(core.bodies().filter(b => b.owner === 'reserved').map(b => b.seat));
-    return toBytes({ v: 1, ...(characters.size ? { characters: [...characters.values()] } : {}), core: core.save(), guideViews: [...guideViews], ...(agents ? { agents: agents.save() } : savedAgents ? { agents: savedAgents } : {}), names: [...names].filter(([seat]) => !reserved.has(seat)), queues: [...queues].map(([seat, q]) => [seat, q.held, q.claim, q.newest, q.ack]), inputs: [...queues] });
+    return toBytes({ v: 1, ...(roundIdleUntil !== null ? { roundIdleUntil } : {}), ...(characters.size ? { characters: [...characters.values()] } : {}), core: core.save(), guideViews: [...guideViews], ...(agents ? { agents: agents.save() } : savedAgents ? { agents: savedAgents } : {}), names: [...names].filter(([seat]) => !reserved.has(seat)), queues: [...queues].map(([seat, q]) => [seat, q.held, q.claim, q.newest, q.ack]), inputs: [...queues] });
   }
   function checkpoint(force = false): void {
     if (persistent) {
@@ -1022,7 +1049,7 @@ export function createHost(o: HostOptions): Host {
       held.character = core.character(held.seat) ?? held.character; held.returning = true;
       present.delete(held.seat); queues.delete(held.seat); names.delete(held.seat);
       if (held.seat >= 0) core.seatLeave(held.seat); tick(o.clock.now());
-      if (running && people() === 0) pause();
+      if ((running || roundIdleUntil !== null) && people() === 0) pause();
     },
     characterReturned(account, lease) { if (characters.get(account)?.returning && characters.get(account)?.lease === lease) characters.delete(account); },
     get viewSettings() { return c.settings.view; },
@@ -1032,6 +1059,8 @@ export function createHost(o: HostOptions): Host {
     get epoch() { return epoch; },
     get running() { return running; },
     get paused() { return paused; },
+    get roundIdleUntil() { return roundIdleUntil; },
+    wakeRound,
     get people() { return people(); },
     frame, start, pause, resume, announce,
     // An orderly stop of a lasting world folds what moved since the last checkpoint. One that follows a failed write, or arrives during one, writes nothing.

package/rules/view.ts

@@ -941,6 +941,7 @@ export function openRoom<R = unknown>(opts: OpenRoomOptions = {}): Room<R> {
   net.on('snapshot', onSnapshot);
   net.on('role', (e) => { if (e.snap) onSnapshot(e.snap); if (net.offline && !net.rulesHosting) setStatus(net.closedWhy ? 'closed' : 'offline'); });
   net.on('link', (e) => {
+    if (e.why === 'subscribe') return;
     if (e.state === 'online') { returningUntil = clock() + 3000; base = null; if (status !== 'playing') setStatus('connecting'); } else if (e.state === 'closed') setStatus('closed'); else if (e.state === 'alone' || e.state === 'offline') setStatus('offline');
   });
   net.on('round', (r) => { if (r.results) { results = r.results; if (round) { round = { ...round, results }; emit('round', roundNow()); } } });

package/tools/TOOLS.md

@@ -53,7 +53,12 @@ Workers AI requires the studio's own binding and owner authority, or an explicit
 never exposes the environment or raw credentials. A named secret capability in
 `studio.json` (`mcp.secrets.NAME: { origin, header, prefix, tools }`) lets an owner tool
 make an HTTPS request to one declared origin; `tools` can explicitly delegate this capability to named staff tools; redirects and credential echoes are
-refused. The studio’s AI can generate an integration secret and place it in Cloudflare and the sender through their authorized APIs. Never ask the person to find or paste a key, and never put a secret in source files.
+refused. Use `origin: 'self'` for the studio's own API: the capability resolves to
+ the current Worker request origin (or the configured studio origin for scheduled
+ functions), so a workers.dev address need not be known at build time. Calls may
+ use a relative URL such as `ctx.fetchWithSecret('API_TOKEN', '/api/sync')`.
+ HTTPS is still required; credentials in URLs and cross-origin targets are refused.
+ The studio’s AI can generate an integration secret and place it in Cloudflare and the sender through their authorized APIs. Never ask the person to find or paste a key, and never put a secret in source files.
 
 Studio handlers and imported parts are trusted Worker code, not sandboxed plugins.
 Review shared code before adding it: JavaScript wrappers cannot confine malicious
@@ -188,3 +193,19 @@ Use `/mcp/auth` for owner and staff connectors. Its anonymous 401 includes the
 Both transports use the same `/mcp` OAuth resource; `/mcp` remains public without a
 token. An approved connection retains the account’s current app grants, not a copy
 of its old permissions. Manage connections at `/_studio/office/connections`.
+
+## Acting at another studio
+
+Use `context.studios.listTools`, `call` and `send` for another studio. The official
+MCP SDK handles transport and OAuth. Configure receiver-owned studio allowlists;
+a named person's handle is an assertion, not the receiver's authenticated account.
+Discover `studio_availability` before `studio_book`. For your own registered routes,
+use `fetchSelf` to preserve the caller. Opt-in `rateLimit` shares a declared
+Cloudflare binding between tools. See [studio-to-studio](../docs/studio-to-studio.md)
+for configuration, trust boundaries, signed events and examples.
+
+Studio callers use origin-hosted JWKS and private-key JWT; office Allow/Deny is
+stored in D1. Pass `{assertedHandle:'guest-42'}`; never match this assertion to a
+local account. Results and descriptions carry `{source,untrusted:true}`. Wrap them
+as untrusted input before AI use. Anonymous MCP callers expose `clientAddressKey`,
+which is their default rate-limit key; studio callers share `studio:<origin>`.

package/tools/tools.ts

@@ -1,12 +1,21 @@
+import type {BookingAvailability} from '../apps/apps';
 /** A studio tool runs as trusted code in its own Worker. Never import an environment binding. */
 export type Audience = 'public' | 'signed-in' | 'owner' | { app: string; role: string };
+export interface RemoteStudioSource { readonly origin: string; readonly authenticated: boolean }
+export interface UntrustedStudioData { readonly source: RemoteStudioSource; readonly untrusted: true }
 export interface ToolContext {
   readonly purchase?: { readonly id: string };
-  readonly caller: { readonly id: string | null; readonly owner: boolean; readonly client: string | null; readonly roles: Readonly<Record<string, readonly string[]>> };
+  readonly caller: { readonly clientAddressKey?: string; readonly id: string | null; readonly owner: boolean; readonly client: string | null; readonly studio?: {readonly origin: string; readonly verified: true; readonly method: 'private_key_jwt'}; readonly actingFor?: {readonly assertedHandle: string; readonly verified: false; readonly assertedBy: string}; readonly roles: Readonly<Record<string, readonly string[]>> };
   records(args: { app: string; role?: string; collection: string; id?: string; operation?: 'read' | 'create' | 'update' | 'delete'; data?: Record<string, unknown>; version?: number }): Promise<unknown>;
   office(path: string, body?: Record<string, unknown>, query?: Record<string, string>): Promise<unknown>;
   shop(): Promise<unknown>;
+  studios: {
+    send(origin: string, event: string, input: {id: string; data: unknown}): Promise<{id: string}>;
+    listTools(origin: string, options?: {cursor?: string; assertedHandle?: string}): Promise<UntrustedStudioData & {tools: Array<UntrustedStudioData & {name: string; description?: string; inputSchema: Record<string, unknown>}>; nextCursor?: string}>;
+    call(origin: string, tool: string, args?: Record<string, unknown>, options?: {assertedHandle?: string}): Promise<UntrustedStudioData & {isError: boolean; data?: unknown; content: unknown[]}>;
+  };
   bookings: {
+    availability(args: {app: string; collection: string; after?: string; quantity?: number; option?: string; resource?: string; addons?: Record<string,number>}): Promise<BookingAvailability>;
     calendar(args: {app:string;startDate:string;endDate:string;timeZone?:string;time?:string;days?:number;durationMinutes?:number;capacity?:number;weekdays?:number[];resources?:string[];options?:unknown[];prefix?:string}): Array<{id:string;start:string;end:string;capacity:number;date:string;timeZone:string}>;
     hold(args: {app: string; collection: string; slot?: string; time?: string; option?: string; resource?: string; preferredResource?: string; addons?: string[] | Record<string,number>; addOns?: string[] | Record<string,number>; quantity?: number; id: string; token?: string; expiresAt: number}): Promise<BookingHold>;
     get(args: {id: string; token?: string}): Promise<BookingHold>;
@@ -24,6 +33,10 @@ export interface ToolContext {
     append(key: string, value: unknown): Promise<{value: unknown[]; version: number}>;
     list(options?: {prefix?: string; after?: string; limit?: number}): Promise<{items: {key: string; value: unknown; version: number}[]; next: string | null}>;
   };
+  /** Dispatch a custom route with caller identity and local Origin; routes must still authorize. */
+  fetchSelf(path: string, init?: RequestInit): Promise<Response>;
+  /** Opt-in shared Cloudflare Rate Limiting binding. Defaults to studio origin, signed-in identity, or anonymous MCP clientAddressKey. */
+  rateLimit(name: string, key?: string): Promise<{success: boolean}>;
   fetch: typeof fetch;
   fetchWithSecret(name: string, url: string, init?: RequestInit): Promise<Response>;
   ai(model: string, input: unknown): Promise<unknown>;

package/worker/background-queue.mjs

@@ -22,6 +22,7 @@ export async function consumeBackground(batch, env) {
   }
   for(const message of batch.messages)if(!changes.includes(message)) {
     try {
+      if(message.body?.v===1&&message.body.type==='lobby.snapshot'){await (await import('./lobby-summary.mjs')).storeLobbySummary(env,message.body);message.ack();continue;}
       if(message.body?.v!==1||message.body.type!=='stripe.event')throw new Error('Unknown background message type');
       await (await import('./stripe-intake.mjs')).reconcileStripeEvent(env,message.body.id,await catalogue(env));
       message.ack();

package/worker/booking-availability.mjs

@@ -0,0 +1,35 @@
+import {allocateResources,resourceSnapshot} from './booking-resources.mjs';
+import {settingsOf,launchOf} from './office.mjs';
+import {allowed} from './mcp-tools.mjs';
+const fail=message=>Object.assign(new Error(message),{name:'StudioOperationError'});
+/** A snapshot, never a reservation. Atomic holds recheck capacity at write time. */
+export async function bookingAvailability(env,cat,caller,{app,collection,after='',quantity=1,option,resource,addons}={}) {
+ const meta=cat.games.find(g=>g.id===app&&g.kind==='app'),spec=meta?.records?.collections?.[collection]?.booking;
+ if(!spec||typeof after!=='string'||after.length>64||!Number.isSafeInteger(quantity)||quantity<1)throw fail('Booking availability unavailable');
+ if(!caller.owner){
+  if(launchOf(meta,await settingsOf(env,{fresh:true}),env)!=='public')throw fail('Booking availability unavailable');
+  let readable=false;
+  for(const [role,rule] of Object.entries(meta.roles??{}))if(rule.can?.includes('read:'+spec.slots)&&(!rule.signIn||await allowed({app,role},caller,env)))readable=true;
+  if(!readable)throw fail('Booking availability unavailable');
+ }
+ const scope=caller.testScope?`${app}:check:${caller.testScope}`:app;
+ const rows=(await env.DB.prepare(`SELECT s.id,s.value,COALESCE((SELECT SUM(b.quantity) FROM shop_bookings b WHERE b.app=s.app AND b.slots=s.collection AND b.slot=s.id AND b.state IN ('held','confirmed')),0) used FROM app_records s WHERE s.app=?1 AND s.collection=?2 AND s.id>?3 ORDER BY s.id LIMIT 51`).bind(scope,spec.slots,after).all()).results;
+ const snapshot=await resourceSnapshot(env,scope,spec);
+ const items=[];
+ for(const row of rows.slice(0,50)){
+  const slot=JSON.parse(row.value),remaining=slot.capacity-row.used;
+  if(!Number.isSafeInteger(remaining)||remaining<quantity)continue;
+  const choices=option!==undefined?[option]:[...(!slot.requireOption?[undefined]:[]),...(slot.options??[]).map(o=>o.id)];
+  if(choices.length>64)throw fail('Availability supports at most 64 options per slot');
+  for(const choice of choices){
+   const booking={app,collection,slot:row.id,quantity,...(choice===undefined?{}:{option:choice}),...(resource?{resource}:{}),...(addons?{addons}:{})};
+   try{allocateResources(slot,spec,booking,snapshot);}catch(error){
+    if(/Slot unavailable|Choose a declared option|Choose an option|Unknown add-on|no declared resources|Preferred resource|Resource capacity unavailable|No resource matches/.test(error.message))continue;
+    throw error;
+   }
+   const selected=slot.options?.find(o=>o.id===choice);
+   items.push({'@type':'Offer',identifier:JSON.stringify([row.id,choice??null]),...(selected?.name?{name:selected.name}:{}),availability:'https://schema.org/InStock',...(slot.start?{availabilityStarts:slot.start}:{}),...(slot.end?{availabilityEnds:slot.end}:{}),remaining,booking});
+  }
+ }
+ return {convention:'studio.booking-availability/1',bookingTool:'studio_book',items,next:rows.length>50?rows[49].id:null};
+}

package/worker/booking-holds.mjs

@@ -1,5 +1,5 @@
 import {calendarSlots} from './booking-calendar.mjs';
-import {allocateResources} from './booking-resources.mjs';
+import {loadAndAllocateResources} from './booking-resources.mjs';
 import {normalizeBookingArgs} from './booking-options.mjs';
 import {BOOKINGS_MIGRATION} from './booking-store.mjs';
 import {linkConfig,hasStripeKey} from './shop-links.mjs';
@@ -74,7 +74,7 @@ export function bookingHolds(env,caller,cat){
      if(previous.app!==scope||previous.collection!==collection||previous.slot!==slot||previous.quantity!==quantity||JSON.stringify({...choices,...JSON.parse(previous.choices??'{}')})!==JSON.stringify(choices))throw refusal('Booking id reused with different request',409);
      return result(previous);
    }
-   let allocation;try{allocation=await allocateResources(env,scope,spec,slot,args);}catch(error){throw refusal(error.message,409);}
+   let allocation;try{allocation=await loadAndAllocateResources(env,scope,spec,slot,args);}catch(error){throw refusal(error.message,409);}
    const secret=token?await hash(token):null;
    try {await env.DB.prepare(`INSERT INTO shop_bookings(id,app,collection,slots,slot,quantity,order_id,state,updated_at,actor,token_hash,hold_until,allocation,choices)
     SELECT ?1,?2,?3,?4,?5,?6,'hold:'||?1,'held',?7,?8,?9,?10,?11,?12 WHERE NOT EXISTS(SELECT 1 FROM shop_bookings WHERE id=?1)`).bind(id,scope,collection,spec.slots,slot,quantity,Date.now(),caller.id??null,secret,expiresAt,JSON.stringify(allocation),JSON.stringify(choices)).run();}catch(error){if(/booking capacity unavailable|resource capacity unavailable/.test(error.message))throw refusal('That slot or resource capacity is unavailable. No place has been taken.',409);throw error;}

package/worker/booking-resources.mjs

@@ -14,10 +14,20 @@ CREATE TRIGGER booking_resource_move BEFORE UPDATE OF slot,quantity ON shop_book
 CREATE TRIGGER booking_resource_edit BEFORE UPDATE OF value ON app_records WHEN EXISTS(SELECT 1 FROM shop_bookings b,json_each(b.allocation) a WHERE b.app=OLD.app AND b.state IN ('held','confirmed') AND json_extract(a.value,'$.resource')=OLD.id AND json_extract(a.value,'$.collection')=OLD.collection) AND NEW.value!=OLD.value BEGIN SELECT RAISE(ABORT,'resource has active bookings; release or finish them before editing'); END;
 CREATE TRIGGER booking_resource_delete BEFORE DELETE ON app_records WHEN EXISTS(SELECT 1 FROM shop_bookings b,json_each(b.allocation) a WHERE b.app=OLD.app AND b.state IN ('held','confirmed') AND json_extract(a.value,'$.resource')=OLD.id AND json_extract(a.value,'$.collection')=OLD.collection) BEGIN SELECT RAISE(ABORT,'resource has active bookings'); END;
 `;
-export async function allocateResources(env,app,spec,slot,args) {
+export async function resourceSnapshot(env,app,spec) {
+ if(!spec.resources)return {resources:new Map(),active:[]};
+ const resources=(await env.DB.prepare('SELECT id,value FROM app_records WHERE app=?1 AND collection=?2').bind(app,spec.resources).all()).results;
+ const active=(await env.DB.prepare("SELECT allocation FROM shop_bookings WHERE app=?1 AND state IN ('held','confirmed')").bind(app).all()).results.flatMap(r=>JSON.parse(r.allocation));
+ return {resources:new Map(resources.map(r=>[r.id,JSON.parse(r.value)])),active};
+}
+export async function loadAndAllocateResources(env,app,spec,slot,args) {
  const row=await env.DB.prepare('SELECT value FROM app_records WHERE app=?1 AND collection=?2 AND id=?3').bind(app,spec.slots,slot).first();
- if(!row)throw new Error('Slot unavailable');
- const data=JSON.parse(row.value),option=args.option===undefined?null:data.options?.find(o=>o.id===args.option);
+ return allocateResources(row?JSON.parse(row.value):null,spec,args,await resourceSnapshot(env,app,spec));
+}
+/** Pure allocation against a page snapshot. Holds still enforce capacity atomically in D1. */
+export function allocateResources(data,spec,args,{resources,active}) {
+ if(!data)throw new Error('Slot unavailable');
+ const option=args.option===undefined?null:data.options?.find(o=>o.id===args.option);
  if(args.option!==undefined&&!option)throw new Error('Choose a declared option');
  if(data.requireOption&&!option)throw new Error('Choose an option');
  const parts=option?.components??(data.resources?[{resources:data.resources,skills:data.skills,attributes:data.attributes}]:[]);
@@ -31,7 +41,6 @@ export async function allocateResources(env,app,spec,slot,args) {
  const start=Date.parse(data.start),end=Date.parse(data.end);
  if(!Number.isFinite(start)||!Number.isFinite(end)||end<=start)throw new Error('Resource slot needs start and end timestamps');
  if(components.length>32)throw new Error('A package supports at most 32 resource components');
- const active=(await env.DB.prepare("SELECT allocation FROM shop_bookings WHERE app=?1 AND state IN ('held','confirmed')").bind(app).all()).results.flatMap(r=>JSON.parse(r.allocation));
  const allocations=[];
  for(const [index,c] of components.entries()) {
   if(!Array.isArray(c.resources)||!c.resources.length||c.resources.length>64)throw new Error('Declare candidate resources');
@@ -41,8 +50,7 @@ export async function allocateResources(env,app,spec,slot,args) {
   if(!Number.isSafeInteger(from)||!Number.isSafeInteger(to)||from<start||to>end||to<=from||!Number.isSafeInteger(units)||units<1)throw new Error('Invalid package resource interval or units');
   let selected,qualified=false;
   for(const resource of candidates) {
-   const record=await env.DB.prepare('SELECT value FROM app_records WHERE app=?1 AND collection=?2 AND id=?3').bind(app,spec.resources,resource).first();
-   if(!record)continue;const r=JSON.parse(record.value);
+   const r=resources.get(resource);if(!r)continue;
    if(!Number.isSafeInteger(r.capacity)||r.capacity<1||(c.skills??[]).some(skill=>!r.skills?.includes(skill))||Object.entries(c.attributes??{}).some(([k,v])=>r.attributes?.[k]!==v))continue;
    qualified=true;const overlapping=[...active,...allocations].filter(a=>a.resource===resource&&a.collection===spec.resources&&a.start<to&&a.end>from);
    if([from,...overlapping.map(a=>a.start).filter(t=>t>=from)].some(at=>units+overlapping.filter(a=>a.start<=at&&a.end>at).reduce((n,a)=>n+a.units,0)>r.capacity))continue;

package/worker/build-id.mjs

@@ -1,2 +1,2 @@
 // Generated by lib/build-identity.mjs; identifies the bundled runtime sources.
-export const STUDIO_BUILD = Object.freeze({"version":"0.55.0","sha256":"597d65592bde7e9519b8184bc2db2502a88ef37cfc31dd6ba3b1c9a4ece30132"});
+export const STUDIO_BUILD = Object.freeze({"version":"0.57.0","sha256":"0a84d357448b7257ee97cac637957a6fe5bb46323de76625644d88e80a684a87"});

package/worker/business-events.mjs

@@ -1,4 +1,5 @@
 import {canonicalJson} from './canonical-json.mjs';
+export const BUSINESS_EVENT_MAX_BYTES=8192;
 export const BUSINESS_EVENTS_MIGRATION_FILE='0028_business_events.sql';
 export const BUSINESS_EVENTS_MIGRATION=`
 ALTER TABLE studio_events ADD COLUMN scope TEXT;
@@ -19,7 +20,7 @@ export async function publishBusinessEvent(env,caller,definition,namespace,{feed
  if(typeof id!=='string'||!id.length||id.length>128)throw new Error('Event id must contain 1–128 characters');
  const {CfWorkerJsonSchemaValidator}=await import('@modelcontextprotocol/server/validators/cf-worker');
  if(!new CfWorkerJsonSchemaValidator().getValidator(declaration.schema)(data).valid)throw new Error('Event data does not match feed schema');
- const text=canonicalJson(data);if(text.length>8192)throw new Error('Event exceeds 8192 characters');
+ const text=canonicalJson(data);if(new TextEncoder().encode(text).length>BUSINESS_EVENT_MAX_BYTES)throw new Error('Event exceeds 8192 bytes');
  const key=JSON.stringify([namespace,feed,id]),digest=Array.from(new Uint8Array(await crypto.subtle.digest('SHA-256',new TextEncoder().encode(declaration.event+'\n'+text))),b=>b.toString(16).padStart(2,'0')).join('');
  await env.DB.batch([
   env.DB.prepare('INSERT OR IGNORE INTO studio_events(id,type,data,at,scope) SELECT ?1,?2,?3,?4,?5 WHERE NOT EXISTS (SELECT 1 FROM event_publications WHERE id=?1)').bind(key,declaration.event,text,Date.now(),caller.testScope??null),

package/worker/custom-routes.mjs

@@ -0,0 +1,16 @@
+/** Studio configuration only: register once at module evaluation, never per request. */
+let handler = null;
+export function useRoutes(routes) {
+  if (routes !== null && typeof routes !== 'function') throw new TypeError('useRoutes expects a function or null');
+  handler = routes;
+}
+export async function customRoute(request, env, ctx) {
+  const response = await handler?.(request, env, ctx);
+  if (response == null) return null;
+  if (!(response instanceof Response)) throw new TypeError('A custom route must return a Response, null, or undefined');
+  if (response.status === 101 || response.webSocket) return response;
+  const headers = new Headers(response.headers);
+  headers.set('x-content-type-options', 'nosniff');
+  if (!headers.has('referrer-policy')) headers.set('referrer-policy', 'strict-origin-when-cross-origin');
+  return new Response(response.body, {status:response.status,statusText:response.statusText,headers});
+}