@homie-rocks/studio 0.55.0 → 0.57.0

package/worker/lobby.mjs

@@ -1,22 +1,25 @@
+import {LobbyPeak} from './lobby-peak.mjs';
+import {MatchRouter} from './match-router.mjs';
+import {LOBBY_SHARDS,SHARDED_ROOM_BASE} from './lobby-shards.mjs';
+import {json} from './responses.mjs';
+import {lobbyStore} from './lobby-store.mjs';
 import { errorLine, versionOf } from './room-protocol.mjs';
 import { ROOM_ID } from './page-policy.mjs';
 import { SERVER_ID, pooledRoom, roomCode, roomServer } from './servers.mjs';
 import { seatCount } from './seats.mjs';
 import { counter, today } from './stats.mjs';
 
-const json = (body, status = 200, extra = {}) => new Response(`${JSON.stringify(body)}\n`, {
-  status, headers: { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store', ...extra },
-});
-
-export const LOBBY_APP_VERSIONS = 8;
-
-export const LOBBY_ROOMS_MAX = 512;
+import {LOBBY_APP_VERSIONS, LOBBY_ROOMS_MAX} from './lobby-limits.mjs';
+export {LOBBY_APP_VERSIONS, LOBBY_ROOMS_MAX} from './lobby-limits.mjs';
 
 export class Lobby {
   constructor(ctx, env) {
     this.ctx = ctx;
     this.env = env;
+    this.store = lobbyStore(ctx.storage);
     this.rooms = new Map();
+    this.reservations=new Map();
+    ctx.storage.sql?.exec("CREATE TABLE IF NOT EXISTS matchmaking_reservations(id TEXT PRIMARY KEY,body TEXT NOT NULL,expires INTEGER NOT NULL)");
     /** Each pool's next room number: { public: n, <server>: n } (a store from before servers is public's). */
     this.next = { public: 1 };
     /** Every room of this game that reported players (public and named), for "playing now" and the day's peak. */
@@ -26,11 +29,16 @@ export class Lobby {
     this.seen = new Map();
     this.closed = new Map();
     ctx.blockConcurrencyWhile(async () => {
-      const saved = await ctx.storage.get('lobby');
+      const saved = await this.store.load();
       if (saved) {
         this.current = saved.current ?? null;
         this.next = typeof saved.next === 'number' ? { public: saved.next } : saved.next && typeof saved.next === 'object' ? { public: 1, ...saved.next } : { public: 1 };
         for (const r of saved.rooms ?? []) this.rooms.set(r.name, { ...r, server: r.server ?? roomServer(r.name), agents: r.agents ?? 0, ai: r.ai ?? 0, ver: typeof r.ver === 'string' ? r.ver : '', pending: [], agentPending: [] });
+        for(const r of this.rooms.values())if(r.players>0&&r.at>Date.now()-180000)this.live.set(r.name,{players:r.players,at:r.at});
+        if(ctx.storage.sql)for(const row of ctx.storage.sql.exec('SELECT body,expires FROM matchmaking_reservations WHERE expires>?',Date.now()).toArray()) {
+          const reservation=JSON.parse(row.body),room=this.rooms.get(reservation.room);
+          if(room && reservation.pending!==false)room.pending.push(row.expires-20000);
+        }
         for (const [name, until] of saved.closed ?? []) if (until > Date.now()) this.closed.set(name, until);
       }
     });
@@ -48,15 +56,23 @@ export class Lobby {
     if (this.peak.day !== day) this.peak = { day, players: 0, room: 0 };
     let all = 0;
     for (const r of this.live.values()) all += r.players;
+    if(this.env.LOBBY){
+      const subject=game??this.game??'';if(game)this.game=game;
+      const target=new URL('https://lobby/peak');target.searchParams.set('game',subject);
+      const at=this.peakReportAt=Math.max(now,(this.peakReportAt??0)+1);
+      const body=JSON.stringify({shard:this.shard??0,players:all,room:players,at});
+      this.ctx.waitUntil(this.env.LOBBY.get(this.env.LOBBY.idFromName(subject+'/peak')).fetch(target,{method:'POST',body}).then(r=>{if(!r.ok)throw Error('peak report failed');return r.body?.cancel();}).catch(error=>console.warn('Lobby peak report failed:',error.message)));
+      return;
+    }
     const writes = [];
     if (all > this.peak.players) { this.peak.players = all; writes.push(counter(this.env, { metric: 'peak', subject: game ?? this.game ?? '', n: all, day })); }
     if (players > this.peak.room) { this.peak.room = players; writes.push(counter(this.env, { metric: 'peak-room', subject: game ?? this.game ?? '', n: players, day })); }
     if (game) this.game = game;
     const list = writes.filter(Boolean);
-    if (list.length) this.ctx.waitUntil(this.env.DB.batch(list).catch(() => {}));
+    if (list.length) this.ctx.waitUntil(this.env.DB.batch(list).catch(error => { this.peak = {day, players:0, room:0}; console.warn('Lobby peak write will retry on report:',error.message); }));
   }
 
-  save() { this.ctx.storage.put('lobby', { current: this.current ?? null, next: this.next, rooms: [...this.rooms.values()].map(({ name, players, agents, ai, server, at, ver, host }) => ({ name, players, agents, ai, server, at, ...(host ? { host } : {}), ...(ver ? { ver } : {}) })), closed: [...this.closed] }).catch(() => {}); }
+  save() { const pending=this.store.save( { current: this.current ?? null, next: this.next, rooms: [...this.rooms.values()].map(({ name, players, agents, ai, server, at, ver, host }) => ({ name, players, agents, ai, server, at, ...(host ? { host } : {}), ...(ver ? { ver } : {}) })), closed: [...this.closed] }); if(pending)this.ctx.waitUntil(pending); }
 
   prune(now) {
     for (const [name, r] of this.rooms) {
@@ -68,6 +84,8 @@ export class Lobby {
 
   /** A request that throws is said with what it was (never its body) and answered as a failure, not left uncaught. */
   async fetch(request) {
+    if(new URL(request.url).pathname==='/peak')return (this.peakStore??=new LobbyPeak(this.ctx,this.env)).fetch(request);
+    if(['/match','/match-policy'].includes(new URL(request.url).pathname))return (this.matchRouter??=new MatchRouter(this.ctx,this.env)).fetch(request);
     if(new URL(request.url).pathname==='/__app_records') {
       const {AppRecordStreams}=await import('./app-streams.mjs');
       this.appStreams??=new AppRecordStreams(this.env,this.ctx);
@@ -79,7 +97,11 @@ export class Lobby {
       this.eventStreams??=new EventStreams(this.env,this.ctx);
       return this.eventStreams.fetch(request);
     }
-    try { return await this.answer(request); } catch (error) {
+    try {
+      const response=await this.answer(request),url=new URL(request.url);
+      if(response.ok && request.method==='POST' && url.pathname==='/report' && this.env?.BACKGROUND && url.searchParams.get('game')) await this.scheduleSummary(url.searchParams.get('game'),Number(url.searchParams.get('shard'))||0);
+      return response;
+    } catch (error) {
       let path = '';
       try { path = new URL(request.url).pathname; } catch { /* not an address */ }
       try { console.error(JSON.stringify({ at: new Date().toISOString(), ev: 'lobby-failed', game: this.game ?? null, path, error: errorLine(error) })); } catch { /* no console */ }
@@ -87,14 +109,52 @@ export class Lobby {
     }
   }
 
+  async scheduleSummary(game,shard=0) {
+    this.summaryShard=shard;
+    if(this.summaryGame!==game) {await this.ctx.storage.put('summary-game',{game,shard});this.summaryGame=game;}
+    if(!this.summaryDue) {
+      this.summaryDue=Date.now()+10000;
+      try {await this.ctx.storage.setAlarm(this.summaryDue);} catch(error) {this.summaryDue=null;throw error;}
+    }
+  }
+  async alarm() {
+    if(this.matchRouter)return this.matchRouter.alarm();
+    if((await this.ctx.storage.list?.({prefix:'match:',limit:1}))?.size)return (this.matchRouter??=new MatchRouter(this.ctx,this.env)).alarm();
+    this.summaryDue=null;
+    const saved=await this.ctx.storage.get('summary-game');
+    const game=this.summaryGame??(typeof saved==='string'?saved:saved?.game),shard=this.summaryShard??saved?.shard??0;
+    if(!game||!this.env.BACKGROUND)return;
+    const at=Date.now();
+    const rooms=[...this.rooms.values()].filter(r=>r.players>0&&r.at>at-180000).map(({name,players,agents,ai,server,at})=>({name,players,agents:agents??0,ai:ai??0,server:server??roomServer(name),at}));
+    await this.env.BACKGROUND.send({v:1,type:'lobby.snapshot',game,shard,at,rooms});
+  }
+
+  reservation(key,result) {
+    const sql=this.ctx.storage.sql,now=Date.now();
+    if(sql){
+      if(result){sql.exec('DELETE FROM matchmaking_reservations WHERE expires<=?',now);sql.exec('INSERT OR REPLACE INTO matchmaking_reservations VALUES(?,?,?)',key,JSON.stringify({...result,pending:true}),now+20000);return;}
+      const row=sql.exec('SELECT body FROM matchmaking_reservations WHERE id=? AND expires>?',key,now).toArray()[0];if(!row)return null;const {pending,...saved}=JSON.parse(row.body);return saved;
+    }
+    for(const [id,row] of this.reservations)if(row.expires<=now)this.reservations.delete(id);
+    if(result)this.reservations.set(key,{result,expires:now+20000});
+    else return this.reservations.get(key)?.result;
+  }
+
   async answer(request) {
     const url = new URL(request.url);
     const now = Date.now();
+    this.shard=Number(url.searchParams.get('shard'))||0;
     this.prune(now);
     // REVISIONS (section 23): rooms are matched within one build of the game. A room that never said its build is
     // the build of a game that names none ('').
     const ver = versionOf(url.searchParams.get('ver')) ?? '';
     if (url.pathname === '/join') {
+      const shard=url.searchParams.has('shard')?Number(url.searchParams.get('shard')):null;
+      if(shard!==null&&(!Number.isInteger(shard)||shard<0||shard>=LOBBY_SHARDS))return json({error:'shard'},400);
+      const identity=url.searchParams.get('reservation');
+      const reservation=identity?JSON.stringify([url.searchParams.get('server'),ver,url.searchParams.get('host'),identity.slice(0,128)]):null;
+      const prior=reservation&&this.reservation(reservation);
+      if(prior && this.rooms.has(prior.room) && !this.closed.has(prior.room) && !(url.searchParams.get('not')??'').split(',').includes(prior.room))return json(prior);
       // A server build can run only its current rules. Persisted browser rooms
       // (including pre-kind records) and old server revisions must not consume
       // the pool or become the fallback of a server with roomsMax=1.
@@ -142,6 +202,7 @@ export class Lobby {
         if (fill >= max) continue;
         if (!best || fill > best.fill || (fill === best.fill && r.name < best.r.name)) best = { r, fill };
       }
+      if(url.searchParams.get('peek')==='1')return json({room:best?.r.name??null});
       let room = best?.r;
       let full = false;
       const fullest = (list) => list.reduce((a, b) => (b.players + b.pending.length > a.players + a.pending.length ? b : a), list[0]);
@@ -166,22 +227,26 @@ export class Lobby {
         }
       }
       if (!room) {
-        let n = this.next[server] ?? 1;
-        while (not.has(roomCode(server, n)) || this.closed.has(roomCode(server, n)) || this.rooms.has(roomCode(server, n))) n += 1;
+        const step=server==='public'&&shard!==null?LOBBY_SHARDS:1;
+        let n = Math.max(this.next[server] ?? 1,step>1?SHARDED_ROOM_BASE+shard:1);
+        while (not.has(roomCode(server, n)) || this.closed.has(roomCode(server, n)) || this.rooms.has(roomCode(server, n))) n += step;
         room = { name: roomCode(server, n), server, players: 0, agents: 0, ai: 0, at: now, ver, ...(host ? { host } : {}), pending: [], agentPending: [] };
-        this.next[server] = n + 1;
+        this.next[server] = n + step;
         this.rooms.set(room.name, room);
       }
       room.pending.push(now);
       this.save();
-      return json({ room: room.name, players: room.players, max, server, ...(full ? { full: true } : {}) });
+      const result={ room: room.name, players: room.players, max, server, ...(full ? { full: true } : {}) };
+      if(reservation)this.reservation(reservation,result);
+      return json(result);
     }
     if (url.pathname === '/report' && request.method === 'POST') {
       const body = await request.json().catch(() => ({}));
       if (typeof body.room !== 'string' || !ROOM_ID.test(body.room)) return json({ ok: false }, 400);
-      if (body.ended === true) { this.rooms.delete(body.room); this.seen.delete(body.room); this.save(); return json({ ok: true }); }
+      if (body.ended === true) { this.notePeak(body.room,0,url.searchParams.get('game')); this.rooms.delete(body.room); this.seen.delete(body.room); this.save(); return json({ ok: true }); }
       // The owner closed this room: matched with nobody until then (and forgotten as a public room).
       if (Number.isFinite(body.closed)) {
+        if(body.closed>now)this.notePeak(body.room,0,url.searchParams.get('game'));
         if (body.closed > now) { this.closed.set(body.room, body.closed); this.rooms.delete(body.room); } else this.closed.delete(body.room);
         this.seen.delete(body.room);
         this.save();
@@ -205,17 +270,20 @@ export class Lobby {
       const grew = Math.max(0, seated - r.players);
       // The room says which build it runs (it changes only when nobody on the old one is left).
       const rver = typeof body.ver === 'string' ? versionOf(body.ver) ?? '' : r.ver ?? '';
-      const changed = !this.rooms.has(r.name) || r.players !== seated || (r.agents ?? 0) !== agents || (r.ai ?? 0) !== ai || (r.ver ?? '') !== rver;
+      const changed = now-r.at>=60000 || !this.rooms.has(r.name) || r.players !== seated || (r.agents ?? 0) !== agents || (r.ai ?? 0) !== ai || (r.ver ?? '') !== rver;
       r.ver = rver;
       if (body.host === 'server' || body.host === 'browser') r.host = body.host;
       r.pending.splice(0, grew);
+      // Retain retry ownership while retiring fulfilled seat holds. Otherwise
+      // eviction restores those holds on top of the already reported players.
+      if(grew && this.ctx.storage.sql)this.ctx.storage.sql.exec("UPDATE matchmaking_reservations SET body=json_set(body,'$.pending',json('false')) WHERE id IN (SELECT id FROM matchmaking_reservations WHERE json_extract(body,'$.room')=? AND json_extract(body,'$.pending') IS NOT 0 ORDER BY expires,id LIMIT ?)",body.room,grew);
       if ((r.agents ?? 0) < agents) (r.agentPending ?? []).splice(0, agents - (r.agents ?? 0));
       r.players = seated;
       r.agents = agents;
       r.ai = ai;
       r.at = now;
       this.rooms.set(r.name, r);
-      if (changed) this.save(); // the minute's "still here" report writes nothing
+      if (changed) this.save(); // Refresh durable presence at most once per minute.
       return json({ ok: true });
     }
     if (url.pathname === '/rooms') return json({ rooms: [...this.rooms.values()].map(({ name, players, agents, ai, server, at }) => ({ name, players, agents: agents ?? 0, ai: ai ?? 0, server: server ?? roomServer(name), at })) });

package/worker/lounge-store.mjs

@@ -116,7 +116,7 @@ export function recOf(r) {
 export async function historyOf(env, game, room, { days, before = null, limit = LOUNGE_LIMITS.page, now = Date.now() } = {}) {
   if (!env?.DB || !(days > 0)) return [];
   const since = now - days * DAY;
-  await env.DB.prepare('DELETE FROM chat_history WHERE game = ?1 AND room = ?2 AND at < ?3').bind(game, room, since).run().catch(() => {});
+  await env.DB.prepare('DELETE FROM chat_history WHERE game = ?1 AND room = ?2 AND at < ?3').bind(game, room, since).run().catch(error => console.warn("Lounge retention deferred:",error.message));
   const n = Math.max(1, Math.min(LOUNGE_LIMITS.page, Math.floor(Number(limit) || LOUNGE_LIMITS.page)));
   const q = Number.isFinite(Number(before)) && before !== null
     ? env.DB.prepare('SELECT * FROM chat_history WHERE game = ?1 AND room = ?2 AND at >= ?3 AND at < ?4 ORDER BY at DESC LIMIT ?5').bind(game, room, since, Number(before), n)
@@ -192,7 +192,7 @@ export async function removeNight(env, id) {
 export async function nightsOf(env, { now = Date.now(), limit = 6 } = {}) {
   if (!env?.DB) return [];
   try {
-    await env.DB.prepare('DELETE FROM lounge_nights WHERE starts_at + minutes * 60000 < ?1').bind(now - DAY).run().catch(() => {});
+    await env.DB.prepare('DELETE FROM lounge_nights WHERE starts_at + minutes * 60000 < ?1').bind(now - DAY).run().catch(error => console.warn("Lounge retention deferred:",error.message));
     const { results } = await env.DB.prepare('SELECT * FROM lounge_nights WHERE starts_at + minutes * 60000 >= ?1 ORDER BY starts_at ASC LIMIT ?2').bind(now, Math.max(1, Math.min(LOUNGE_LIMITS.nights, limit))).all();
     return (results ?? []).map((r) => ({ id: r.id, title: r.title, at: Number(r.starts_at), minutes: Number(r.minutes), note: r.note ?? null, game: r.game ?? null, on: Number(r.starts_at) <= now }));
   } catch { return []; }

package/worker/match-router.mjs

@@ -0,0 +1,74 @@
+import {lobbyShard,LOBBY_SHARDS} from './lobby-shards.mjs';
+
+// Entry objects partition reservation ownership. They lease 8 routing decisions
+// at a time, so the policy object sees 1/8 of join traffic, never room reports.
+// A quiet game refills existing pools before opening shard zero. Spread above
+// 128 observed joins/s: below half the slowest single-coordinator throughput
+// measured by the deployed fixture (1024 durable joins, 32 concurrent).
+// Count consumed leases, not all eight slots in a newly issued lease.
+export class MatchRouter {
+  constructor(ctx,env) { this.ctx=ctx;this.env=env;this.pending=new Map();this.routes=new Map(); }
+  async fetch(request) {
+    const url=new URL(request.url),now=Date.now();
+    if(url.pathname==='/match-policy') {
+      this.demand=(this.demand??[]).filter(row=>now-row.at<1000);
+      this.demand.push({at:now,joins:Math.max(1,Math.min(8,Number(url.searchParams.get('used'))||1))});
+      return Response.json({wide:this.demand.reduce((n,row)=>n+row.joins,0)>128,until:now+1000});
+    }
+    const identity=url.searchParams.get('reservation');
+    const key=JSON.stringify([identity,url.searchParams.get('ver'),url.searchParams.get('host'),url.searchParams.get('not')]);
+    if(this.pending.has(key))return Response.json(await this.pending.get(key));
+    const task=this.join(url,key,now);this.pending.set(key,task);
+    try{return Response.json(await task);}finally{this.pending.delete(key);}
+  }
+  async join(url,key,now) {
+    const game=url.searchParams.get('game');
+    for(const [id,row] of this.routes)if(row.until<=now)this.routes.delete(id);
+    let route=this.routes.get(key)??await this.ctx.storage.get('match:'+key);
+    if(!route||route.until<=now) {
+      // Serialize lease consumption, not requests to the matching shards.
+      const previous=this.leasing??Promise.resolve();
+      const lease=previous.then(async()=>{
+        if(!this.policy||this.policy.until<=now||!this.remaining){
+          const target=new URL('https://lobby/match-policy');target.searchParams.set('game',game);target.searchParams.set('used',String(this.policy?8-this.remaining:1));
+          const response=await this.env.LOBBY.get(this.env.LOBBY.idFromName(game+'/match-policy')).fetch(target);
+          if(!response.ok)throw Error('Matching policy unavailable');
+          this.policy=await response.json();this.remaining=8;
+        }
+        this.remaining--;
+        return this.policy.wide?lobbyShard(url.searchParams.get('reservation')):null;
+      });
+      this.leasing=lease.then(()=>{},()=>{});
+      let shard=await lease;
+      if(shard===null) {
+        // Read-only discovery: persist ownership before reserving a seat. Quiet
+        // joins may refill any pool left open by a burst, including after eviction.
+        shard=0;
+        for(let candidate=0;candidate<LOBBY_SHARDS;candidate++){
+          const target=new URL(url);target.pathname='/join';target.searchParams.set('peek','1');target.searchParams.set('shard',String(candidate));
+          const name=candidate?`${game}/shard/${candidate}`:game;
+          const response=await this.env.LOBBY.get(this.env.LOBBY.idFromName(name)).fetch(target);
+          if(!response.ok)throw Error('Matching discovery unavailable');
+          if((await response.json()).room){shard=candidate;break;}
+        }
+      }
+      route={shard,until:now+20000};
+      // Persist ownership before forwarding: a lost response or entry eviction
+      // must retry the same shard, even while the game changes routing policy.
+      await this.ctx.storage.put('match:'+key,route);this.routes.set(key,route);
+      await this.ctx.storage.setAlarm?.(now+20000);
+    }
+    url.pathname='/join';url.searchParams.set('shard',String(route.shard));
+    const name=route.shard?`${game}/shard/${route.shard}`:game;
+    const response=await this.env.LOBBY.get(this.env.LOBBY.idFromName(name)).fetch(url);
+    if(!response.ok)throw Error('Matching shard unavailable');
+    return response.json();
+  }
+  async alarm() {
+    const now=Date.now();let next=Infinity;
+    for(const [key,row] of await this.ctx.storage.list({prefix:'match:'})) {
+      if(row.until<=now)await this.ctx.storage.delete(key);else next=Math.min(next,row.until);
+    }
+    if(Number.isFinite(next))await this.ctx.storage.setAlarm(next);
+  }
+}

package/worker/mcp-room.mjs

@@ -1,3 +1,4 @@
+import {lobbyFor} from './lobby-shards.mjs';
 import {signControl,settingsOf,launchOf,seatsFor} from './office.mjs';
 import {appAccess} from './app-records.mjs';
 import {withToolIdentity} from './tool-identity.mjs';
@@ -23,7 +24,7 @@ export async function remoteSeat(env,cat,caller,op,args) {
   if(refusal)throw new Error(refusal.message);
   let room=args.room;
   if(!room&&op==='sit'){
-    const joined=await env.LOBBY.get(env.LOBBY.idFromName(meta.id)).fetch(`https://lobby/join?max=${max}&server=${serverId}&agent=1&ai=${policy.aiSeats+policy.guides}`,{method:'POST'});room=(await joined.json()).room;
+    const joined=await lobbyFor(env,meta.id).fetch(`https://lobby/join?max=${max}&server=${serverId}&agent=1&ai=${policy.aiSeats+policy.guides}`,{method:'POST'});room=(await joined.json()).room;
   }
   if(!/^[A-Za-z0-9_-]{1,32}$/.test(room??''))throw new Error('No room with people; an AI never starts a room');
   const ctl=await signControl(env,{op:'mcp-seat',game:meta.id,room,args:{...args,operation:op,connection:caller.connection,person:caller.id,name:caller.name??'Studio AI'}});

package/worker/mcp-store.mjs

@@ -42,7 +42,7 @@ export async function rateLimit(env, caller, limit = null) {
   return row.n <= limit;
 }
 export async function audit(env, caller, tool, outcome) {
-  await env.DB.prepare('INSERT INTO mcp_audit(person,client,tool,at,outcome) VALUES(?1,?2,?3,?4,?5)').bind(caller.id ?? null,caller.client ?? null,tool,Date.now(),outcome).run();
+  await env.DB.prepare('INSERT INTO mcp_audit(person,client,tool,at,outcome) VALUES(?1,?2,?3,?4,?5)').bind(caller.studio?(caller.actingFor?.assertedHandle??null):caller.id ?? null,caller.studio?.origin??caller.client ?? null,tool,Date.now(),outcome).run();
   // Bounded storage, and no cleanup timer or writes on ordinary page traffic.
   await env.DB.batch([
     env.DB.prepare('DELETE FROM mcp_audit WHERE id <= (SELECT MAX(id)-10000 FROM mcp_audit)'),
@@ -55,3 +55,5 @@ export function callsPerMinute(cat) {
   const value=cat.studio?.mcp?.callsPerMinute;
   return Number.isSafeInteger(value)&&value>0?value:null;
 }
+
+export const callerLimitKey=caller=>caller.studio?'studio:'+caller.studio.origin:caller.id??caller.clientAddressKey;

package/worker/mcp-tools.mjs

@@ -1,3 +1,6 @@
+import {callerLimitKey} from './mcp-store.mjs';
+import {bookingAvailability} from './booking-availability.mjs';
+import {studiosClient} from './studios-client.mjs';
 import {bookingInputSchema,normalizeBookingArgs} from './booking-options.mjs';
 import {bookingHolds} from './booking-holds.mjs';
 import {toolDatabase} from './tool-database.mjs';
@@ -12,7 +15,7 @@ export const object = (properties = {}, required = []) => ({type:'object',proper
 const str = {type:'string',maxLength:128};
 export async function allowed(audience, caller, env) {
   if (audience === 'public') return true;
-  if (!caller.id) return false;
+  if (!caller.id || caller.studio) return false;
   if (audience === 'signed-in') return true;
   if (audience === 'studio-staff') return caller.owner === true || Boolean(await env.DB.prepare("SELECT player FROM app_roles WHERE app='*' AND role='staff' AND player=?1").bind(caller.id).first());
   if (audience === 'owner') return caller.owner === true;
@@ -70,16 +73,37 @@ export function services(env, cat, origin, caller, namespace, definition = {}) {
   const key = v=>{if(typeof v!=='string'||v.length>128||!v.length)throw new Error('invalid key');return v;};
   return Object.freeze({
     caller:Object.freeze({...caller,roles:Object.freeze(Object.fromEntries(Object.entries(caller.roles??{}).map(([app,roles])=>[app,Object.freeze([...roles])])) )}), records, office,
-    bookings:bookingHolds(env,caller,cat),
+    studios:studiosClient(env,cat,definition,{origin}),
+    bookings:Object.freeze({...bookingHolds(env,caller,cat),availability:args=>bookingAvailability(env,cat,caller,args)}),
     events:Object.freeze({publish:args=>import('./business-events.mjs').then(m=>m.publishBusinessEvent(env,caller,definition,namespace,args))}),
     rooms:Object.freeze({send:args=>import('./tool-events.mjs').then(m=>m.sendToolEvent(env,caller,definition,args))}),
     shop:()=>office('/_studio/api/shop'),
     database:toolDatabase(env.DB,namespace),
     fetch:globalThis.fetch.bind(globalThis),
+    async fetchSelf(path,init={}) {
+      const url=new URL(path,origin);
+      if(url.origin!==new URL(origin).origin || url.username || url.password)throw new Error('Same origin required');
+      const headers=new Headers(init.headers);
+      if(headers.has('authorization')||headers.has('cookie'))throw new Error('Explicit credentials refused');
+      headers.set('origin',new URL(origin).origin);
+      const request=withToolIdentity(new Request(url,{...init,headers,redirect:'error'}),caller);
+      const pending=[];
+      const response=await (await import('./custom-routes.mjs')).customRoute(request,env,{waitUntil:promise=>pending.push(promise)});
+      await Promise.all(pending);
+      return response??new Response('Not found',{status:404});
+    },
+    async rateLimit(name,key=callerLimitKey(caller)) {
+      const rule=cat.studio?.mcp?.rateLimits?.[name];
+      if(!rule?.tools?.includes(definition.name)||!env[rule.binding]?.limit)throw new Error('Rate limit not declared for this tool');
+      if(typeof key!=='string'||!key.length||key.length>256)throw new Error('Rate limit key required (1–256 characters)');
+      return env[rule.binding].limit({key:JSON.stringify([name,key])});
+    },
     // A named secret may authenticate an HTTPS request; its value is never returned.
     async fetchWithSecret(name,url,init={}) {
-      const rule=cat.studio?.mcp?.secrets?.[name]; const target=new URL(url);
-      if(!rule || target.protocol!=='https:' || target.origin!==rule.origin || (!caller.owner&&!rule.tools?.includes(definition.name))) throw new Error('secret capability refused');
+      const rule=cat.studio?.mcp?.secrets?.[name];
+      const permittedOrigin=rule?.origin==='self'?new URL(origin).origin:rule?.origin;
+      const target=new URL(url,rule?.origin==='self'?permittedOrigin:undefined);
+      if(!rule || target.protocol!=='https:' || target.username || target.password || target.origin!==permittedOrigin || (!caller.owner&&!rule.tools?.includes(definition.name))) throw new Error('secret capability refused');
       const secret=env[name];if(typeof secret!=='string')throw new Error('secret unavailable');
       const headers=new Headers(init.headers);headers.set(rule.header??'authorization',`${rule.prefix??'Bearer '}${secret}`);
       const res=await fetch(target,{...init,headers,redirect:'error'});
@@ -176,6 +200,7 @@ export function builtins(env,cat,origin) {
       const collections=new Set(Object.values(roles).flatMap(r=>r.can.map(cap=>cap.split(':')[1])));
       return {app,roles,collections:Object.fromEntries(Object.entries(meta.records?.collections??{}).filter(([name])=>collections.has(name)))};
     }),
+    tool('studio_availability','List available booking slots and options before studio_book. Returns schema.org Offers with exact booking arguments; availability is a snapshot, and booking rechecks capacity.','public',object({app:str,collection:str,after:str,quantity:{type:'integer',minimum:1},option:str,resource:str,addons:{type:'object',additionalProperties:{type:'integer',minimum:1,maximum:100}}},['app','collection']),async(args,ctx)=>ctx.bookings.availability(args)),
     tool('studio_book','Reserve a declared booking slot. Accepts slot/time, resource/preferredResource, and addons/addOns as an array or quantity object. Supply a stable id, future expiresAt and a private token for an anonymous booking. Payment is separate.','public',bookingInputSchema,async(input,ctx)=>{
       const args=normalizeBookingArgs(input),meta=cat.games.find(g=>g.id===args.app&&g.kind==='app'),spec=meta?.records?.collections?.[args.collection]?.booking;
       if(!spec)throw Object.assign(new Error('Unknown booking collection'),{name:'StudioOperationError'});

package/worker/mcp.mjs

@@ -1,3 +1,5 @@
+import {studioOrigin} from './studios-client.mjs';
+import {studioToken,studioCaller,setStudioPolicy,studioRegistration} from './studios-auth.mjs';
 import {tokenCaller,toolInScope} from './connector-token.mjs';
 import {eventMethods,eventsCapability} from './mcp-events-wire.mjs';
 import {eventsRequest} from './mcp-events.mjs';
@@ -17,7 +19,7 @@ import { players } from './players.mjs';
 import { isOwner, sameOrigin } from './office.mjs';
 import { cookieValue } from './stats.mjs';
 import { esc } from './site.mjs';
-import { oauthStorage, rateLimit, audit, callsPerMinute } from './mcp-store.mjs';
+import { oauthStorage, rateLimit, audit, callsPerMinute, callerLimitKey } from './mcp-store.mjs';
 import { allowed, currentCaller, services, builtins } from './mcp-tools.mjs';
 const validator = new CfWorkerJsonSchemaValidator();
 const json = (data,status=200)=>Response.json(data,{status,headers:{'cache-control':'no-store'}});
@@ -36,14 +38,28 @@ export async function remoteMcp(request,env,ctx,{catalogueOf,definitions=[]}) {
   const url=new URL(request.url), origin=url.origin, path=url.pathname;
   if(!env.DB)return json({error:'studio database required'},503);
   if(request.headers.has('origin') && request.headers.get('origin')!==origin)return json({error:'origin refused'},403);
+  if(path==='/.well-known/jwks.json')return Response.json((await import('./studios-keys.mjs')).publicKeys(env),{headers:{'cache-control':'public, max-age=60'}});
+  if(path==='/oauth/token'||path.startsWith('/hooks/studios/')) {
+    if(!await rateLimit(env,'studio-ingress:'+(request.headers.get('cf-connecting-ip')??'local'),60))
+      return Response.json({error:'rate_limit_exceeded'},{status:429,headers:{'retry-after':'60','cache-control':'no-store'}});
+  }
+  if(path.startsWith('/hooks/studios/')) {
+    const cat=await catalogueOf();
+    const response=await (await import('./studios-events.mjs')).receiveStudioEvent(request,env,cat);
+    if(response.ok){const delivery=import('./functions.mjs').then(m=>m.runFunctions(env,cat,origin));if(ctx?.waitUntil)ctx.waitUntil(delivery);else await delivery;}
+    return response;
+  }
   if(path.startsWith('/hooks/tools/')) return (await import('./tool-webhook.mjs')).toolWebhook(request,env,{cat:await catalogueOf(),definitions});
+  if(path==='/oauth/token'){const response=await studioToken(request,env,await catalogueOf());if(response)return response;}
+  const machine=request.headers.get('authorization')?.startsWith('Bearer homie_studio_');
   const scoped={...env,OAUTH_KV:oauthStorage(env.DB)};
   const localIdentity=await localCaller(request,env);
   const bearer=request.headers.get('authorization')?.startsWith('Bearer homie_owner_');
   const bearerIdentity=bearer?await tokenCaller(request,env):null;
   if(bearer&&!bearerIdentity)return json({error:'connector expired or revoked'},401);
   const api=async(request,env,ctx)=>{
-    const identity=async()=>{if(bearer){const fresh=await tokenCaller(request,env);if(!fresh)throw new Error('connector revoked');return fresh;}return localIdentity ?? currentCaller(env,ctx.props);};
+    const rawIdentity=async()=>{if(machine){const fresh=await studioCaller(request,env,await catalogueOf());if(!fresh)throw new Error('Studio authorization revoked');return fresh;}if(bearer){const fresh=await tokenCaller(request,env);if(!fresh)throw new Error('connector revoked');return fresh;}return localIdentity ?? currentCaller(env,ctx.props);};
+    const identity=async()=>({...await rawIdentity(),clientAddressKey:`public:${request.headers.get('cf-connecting-ip')??'local'}`});
     let caller;
     try{caller=await identity();}catch{return new Response(JSON.stringify({error:'connection revoked'}),{status:401,headers:{'content-type':'application/json','cache-control':'no-store','www-authenticate':`Bearer resource_metadata="${origin}/.well-known/oauth-protected-resource/mcp", error="invalid_token"`}});}
     if(caller.tools){
@@ -74,7 +90,7 @@ export async function remoteMcp(request,env,ctx,{catalogueOf,definitions=[]}) {
     }
     const rate=async fresh=>{
       const limit=callsPerMinute(cat);
-      if(!await rateLimit(env,fresh.id??`public:${request.headers.get('cf-connecting-ip')??'local'}`,limit))throw new Error('Rate limit reached');
+      if(!await rateLimit(env,callerLimitKey(fresh),limit))throw new Error('Rate limit reached');
     };
     const read=async(name,handler)=>{
       let outcome='error';
@@ -144,7 +160,7 @@ export async function remoteMcp(request,env,ctx,{catalogueOf,definitions=[]}) {
             if(tool.protocol) {const result=await tool.handler(args,{...context,paymentExtra:extra});outcome=result.isError?'error':'ok';return result;}
             const value=await (await import('./app-tools.mjs')).invokeAppTool(tool,args,{...context,request});
             const text=JSON.stringify({kind:'untrusted-tool-data',tool:tool.name,data:value});
-            outcome='ok';return {content:[{type:'text',text}]};
+            outcome='ok';return {structuredContent:{kind:'untrusted-tool-data',tool:tool.name,data:value??null},content:[{type:'text',text}]};
           }catch(error){if(error?.code===-32042)throw error;return {isError:true,content:[{type:'text',text:outcome==='denied'||outcome==='limited'||error?.name==='StudioOperationError'?error.message:(freshErrorMessage(error,env,caller))}]};}
           finally{
             try { await audit(env,caller,tool.name,outcome); }
@@ -178,6 +194,7 @@ export async function remoteMcp(request,env,ctx,{catalogueOf,definitions=[]}) {
   if(localIdentity||bearerIdentity)return api(request,scoped,ctx);
   const provider=new OAuthProvider({
     apiRoute:'/mcp',apiHandler:{fetch:api},
+    resolveExternalToken:async({request,env})=>(await studioCaller(request,env,await catalogueOf()))?{props:{},audience:origin+'/mcp'}:null,
     authorizeEndpoint:'/oauth/authorize',tokenEndpoint:'/oauth/token',clientRegistrationEndpoint:'/oauth/register',
     resourceMetadata:{resource:origin+'/mcp',authorization_servers:[origin]},
     scopesSupported:['studio','offline_access'],requiredScopes:['studio'],
@@ -209,7 +226,14 @@ export async function remoteMcp(request,env,ctx,{catalogueOf,definitions=[]}) {
         const owner=await isOwner(req,env);
         if(req.method==='POST'){
           if(!sameOrigin(req,u))return json({error:'origin refused'},403);
-          const f=await req.formData();const id=String(f.get('connection')??'');
+          const f=await req.formData();
+          if(f.has('studioOrigin')){
+            const studio=String(f.get('studioOrigin'));
+            if(!owner||!studioRegistration(await catalogueOf(),studio))return json({error:'studio policy refused'},403);
+            await setStudioPolicy(env,studio,f.get('allow')==='true');
+            return Response.redirect(origin+u.pathname,303);
+          }
+          const id=String(f.get('connection')??'');
           const connection=await env.DB.prepare('SELECT * FROM mcp_connections WHERE id=?1').bind(id).first();
           if(connection&&(owner||connection.person===person)){
             // Local denial takes effect first, even if upstream token cleanup must be retried.
@@ -224,9 +248,15 @@ export async function remoteMcp(request,env,ctx,{catalogueOf,definitions=[]}) {
         }
         const page=Math.max(0,Math.min(100,Number.parseInt(u.searchParams.get('page')??'0',10)||0)),offset=page*100;
         const rows=(await env.DB.prepare(owner?'SELECT c.*,p.name FROM mcp_connections c LEFT JOIN players p ON p.id=c.person ORDER BY c.created DESC LIMIT 100 OFFSET ?1':'SELECT c.*,p.name FROM mcp_connections c LEFT JOIN players p ON p.id=c.person WHERE c.person=?1 ORDER BY c.created DESC LIMIT 100 OFFSET ?2').bind(...(owner?[offset]:[person,offset])).all()).results;
-        const events=owner?(await env.DB.prepare('SELECT a.*,p.name FROM mcp_audit a LEFT JOIN players p ON p.id=a.person ORDER BY a.id DESC LIMIT 100 OFFSET ?1').bind(offset).all()).results:[];
+        const events=owner?(await env.DB.prepare("SELECT a.*,p.name FROM mcp_audit a LEFT JOIN players p ON p.id=a.person AND (a.client IS NULL OR a.client NOT LIKE 'https://%') ORDER BY a.id DESC LIMIT 100 OFFSET ?1").bind(offset).all()).results:[];
         const names=new Map(await Promise.all([...new Set([...rows,...events].map(r=>r.client).filter(Boolean))].map(async id=>[id,(await oauth.lookupClient(id).catch(()=>null))?.clientName??id])));
-        return html(`<h1>Your studio's AI connections</h1><p>Signed-in MCP address: <code>${esc(origin)}/mcp/auth</code> · Public: <code>${esc(origin)}/mcp</code></p><ul>${rows.map(r=>`<li>${esc(r.name??(r.person.startsWith('office-')?'Owner browser':r.person))} · ${esc(names.get(r.client))} · ${r.revoked?'Revoked':`<form method="post"><input type="hidden" name="connection" value="${esc(r.id)}"><button>Revoke</button></form>`}</li>`).join('')}</ul><h2>Recent tool calls</h2><ul>${events.map(r=>`<li>${esc(new Date(r.at).toISOString())} · ${esc(r.name??(r.person?.startsWith('office-')?'Owner browser':r.person)??'Public')} · ${esc(names.get(r.client)??'Anonymous')} · ${esc(r.tool)} · ${esc(r.outcome)}</li>`).join('')}</ul><nav>${page?`<a href="?page=${page-1}">Newer</a>`:''}${rows.length===100||events.length===100?`<a href="?page=${page+1}">Older</a>`:''}</nav>`);
+        const studioRows=[];
+        if(owner)for(const rule of Object.values((await catalogueOf()).studio?.mcp?.studios?.inbound??{})){
+          let peer;try{peer=studioOrigin(rule.origin,{allowPrivate:rule.allowPrivate===true});}catch{continue;}
+          const policy=await oauthStorage(env.DB).get('studio-policy:'+peer,'json');
+          studioRows.push(`<li>${esc(peer)} · ${policy?.allow?'Allowed':'Denied'}<form method="post"><input type="hidden" name="studioOrigin" value="${esc(peer)}"><input type="hidden" name="allow" value="${policy?.allow?'false':'true'}"><button>${policy?.allow?'Deny':'Allow'}</button></form></li>`);
+        }
+        return html(`${owner?'<h2>Studio connections</h2><p>Denied by default. Allow only origins you trust for their declared tools and events.</p><ul>'+studioRows.join('')+'</ul>':''}<h1>Your studio's AI connections</h1><p>Signed-in MCP address: <code>${esc(origin)}/mcp/auth</code> · Public: <code>${esc(origin)}/mcp</code></p><ul>${rows.map(r=>`<li>${esc(r.name??(r.person.startsWith('office-')?'Owner browser':r.person))} · ${esc(names.get(r.client))} · ${r.revoked?'Revoked':`<form method="post"><input type="hidden" name="connection" value="${esc(r.id)}"><button>Revoke</button></form>`}</li>`).join('')}</ul><h2>Recent tool calls</h2><ul>${events.map(r=>`<li>${esc(new Date(r.at).toISOString())} · ${esc(r.client?.startsWith('https://')?'Asserted handle: '+(r.person??'(none)'):(r.name??(r.person?.startsWith('office-')?'Owner browser':r.person)??'Public'))} · ${esc(names.get(r.client)??'Anonymous')} · ${esc(r.tool)} · ${esc(r.outcome)}</li>`).join('')}</ul><nav>${page?`<a href="?page=${page-1}">Newer</a>`:''}${rows.length===100||events.length===100?`<a href="?page=${page+1}">Older</a>`:''}</nav>`);
       }
       return json({error:'not found'},404);
     }},
@@ -235,5 +265,10 @@ export async function remoteMcp(request,env,ctx,{catalogueOf,definitions=[]}) {
     // Public tools remain available without an account. Clients can discover OAuth metadata directly.
     return api(request,scoped,ctx);
   }
-  return provider.fetch(request,scoped,ctx);
+  const response=await provider.fetch(request,scoped,ctx);
+  if(path==='/.well-known/oauth-authorization-server'&&response.ok){
+    const metadata=await response.json();
+    return json({...metadata,grant_types_supported:[...new Set([...(metadata.grant_types_supported??[]),'client_credentials'])],token_endpoint_auth_methods_supported:[...new Set([...(metadata.token_endpoint_auth_methods_supported??[]),'private_key_jwt'])]});
+  }
+  return response;
 }

package/worker/office.mjs

@@ -1,3 +1,4 @@
+import {lobbyFor} from './lobby-shards.mjs';
 import {databaseBinding, ORIGINAL_DB} from './request-db.mjs';
 import { selling } from './extensions.mjs';
 import { purchaseOrderIfPresent } from './shop.mjs';
@@ -410,7 +411,7 @@ export async function redeemInvite(request, env, url, cat, meta, settings) {
 
 /* ------------------------------------------------------------------ talking to rooms */
 
-const lobbyOf = (env, game) => env.LOBBY.get(env.LOBBY.idFromName(game));
+const lobbyOf = (env, game) => lobbyFor(env,game);
 const tableOf = (env, game, room) => env.TABLE.get(env.TABLE.idFromName(`${game}/${room}`));
 
 /** The rooms of one game with people in them now, as its Lobby last heard (public and named). */

package/worker/operational-schema.mjs

@@ -36,6 +36,8 @@ CREATE INDEX IF NOT EXISTS mcp_kv_expires ON mcp_kv(expires) WHERE expires IS NO
 `;
 
 export const EXTRA_RUNTIME_MIGRATIONS={
+  "0036_lobby_summaries.sql":`CREATE TABLE IF NOT EXISTS lobby_summaries(game TEXT PRIMARY KEY,rooms TEXT NOT NULL,updated INTEGER NOT NULL);
+`,
   "0035_payment_delivery.sql":`CREATE TABLE IF NOT EXISTS stripe_intake(id TEXT PRIMARY KEY,payload TEXT NOT NULL,origin TEXT NOT NULL,received INTEGER NOT NULL,lease INTEGER NOT NULL DEFAULT 0,done INTEGER);
 CREATE INDEX IF NOT EXISTS stripe_intake_pending ON stripe_intake(lease,received,id) WHERE done IS NULL;
 CREATE INDEX IF NOT EXISTS stripe_intake_done ON stripe_intake(done) WHERE done IS NOT NULL;

package/worker/pages.mjs

@@ -983,7 +983,7 @@ const SHELL_JS = String.raw`${BUILD_RETRY_JS}(function () {
     try { arrived = performance.getEntriesByType('navigation')[0].type; } catch (e) {}
     askedRoom = kept && (arrived === 'reload' || arrived === 'back_forward') && EMBED_ROOM.test(kept.room || '') ? kept.room : null;
   }
-  var lobbyQ = [];
+  var lobbyQ = ['b=' + encodeURIComponent(roomKey)];
   if (state.server) lobbyQ.push('server=' + encodeURIComponent(state.server.id));
   if (/^[A-Za-z0-9_,-]{1,140}$/.test(params.get('not') || '')) lobbyQ.push('not=' + encodeURIComponent(params.get('not')));
   // Once the game has the screen, the chip says the room's facts for a few seconds, then gets out of the way.