@homie-rocks/studio 0.55.0 → 0.57.0

package/worker/relay-channel.mjs

@@ -0,0 +1,119 @@
+const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
+// Retry transport failures in order. Queue limits still bound memory during outages.
+export async function retryRelay(work, alive = () => true, wait = sleep) {
+  for (let attempt = 0; alive(); attempt++) {
+    try { return await work(); } catch (error) {
+      if (!alive()) return;
+      await wait(Math.min(5000, 100 * 2 ** Math.min(attempt, 6)));
+    }
+  }
+}
+
+/** Ordered input batches over bindings. A completed request holds no connection;
+ * output travels on a separate stream, never a recursive callback chain. */
+export function relayChannel(ctx, deliver, {sleep: wait = sleep} = {}) {
+  const listeners = new Map();
+  let chain = Promise.resolve(), closed = false, pending = 0, pendingBytes = 0, live = null, sequence = 0;
+  const emit = (name, event) => { for (const fn of listeners.get(name) ?? []) fn(event); };
+  return {
+    accept() {},
+    addEventListener(name, fn) { const list = listeners.get(name) ?? []; list.push(fn); listeners.set(name, list); },
+    emit,
+    async attachLive(socket) {
+      socket.addEventListener('message',event=>emit('message',event));
+      socket.addEventListener('close',()=>{try{socket.close(1000,'detached');}catch{}if(live===socket){live=null;emit('detached',{});}});
+      socket.addEventListener('error',()=>{if(live===socket){live=null;emit('detached',{});}});
+      await chain;
+      if(closed){socket.close(1000,'closed');return;}
+      if(socket.readyState!==1)return;
+      live=socket;
+      emit('drain',{});
+    },
+    isLive:()=>Boolean(live),
+    canSend(size) { return Boolean(live) || pendingBytes+size<=4*1024*1024; },
+    send(data) {
+      if(live){try{if(live.readyState===1){live.send(data);return;}}catch{ /* Retry over the idle transport. */ }live=null;}
+      if (closed) throw new Error('Relay channel closed');
+      const size=data.length;
+      if (pendingBytes+size>4*1024*1024) throw new Error('Relay channel queue limit');
+      pending++;pendingBytes+=size;
+      const id = ++sequence;
+      chain = chain.then(async () => {
+        if (closed) return;
+        await retryRelay(async () => {
+          const response = await deliver(data, id);
+          await response.body?.cancel();
+          if (!response.ok) throw new Error('Relay delivery failed: ' + response.status);
+        }, () => !closed, wait);
+      }).catch(error => { if (!closed) { closed = true; emit('error', {error}); } }).finally(() => { pending--;pendingBytes-=size;emit('drain',{}); });
+      ctx.waitUntil(chain);
+    },
+    close(code, reason) { if (!closed) { closed = true;live?.close(code,reason);live=null;emit('close', {code, reason}); } },
+  };
+}
+
+/** A Table's output is ordered on one stream while active. Closing the stream
+ * detaches transport, not logical players. An alarm or a player's next message
+ * can request another stream without sending a new welcome. */
+export function relayStream(ctx, wake, {sleep: wait = sleep} = {}) {
+  const listeners = new Map(), encoder = new TextEncoder();
+  const limit = 4 * 1024 * 1024;
+  let controller = null, live = null, queued = [], bytes = 0, waking = false, closed = false;
+  const emit = (name, event) => { for (const fn of listeners.get(name) ?? []) fn(event); };
+  const request = () => {
+    if (waking || closed) return;
+    waking = true;
+    ctx.waitUntil(retryRelay(wake, () => !closed && waking, wait));
+  };
+  return {
+    accept() {}, emit,
+    canSend(size, data) {
+      const needed=data===undefined?size*3+1:encoder.encode(data+'\n').byteLength;
+      return !closed && (Boolean(live) || needed+(controller?limit-controller.desiredSize:bytes)<=limit);
+    },
+    addEventListener(name, fn) { const list=listeners.get(name)??[];list.push(fn);listeners.set(name,list); },
+    send(data) {
+      if(live){try{if(live.readyState===1){live.send(data);return;}}catch{ /* Retry over the idle transport. */ }live=null;}
+      const chunk = encoder.encode(data+'\n');
+      if (chunk.byteLength + (controller ? limit-controller.desiredSize : bytes) > limit) throw new Error('Relay output queue limit');
+      if (controller) controller.enqueue(chunk);
+      else { queued.push(chunk);bytes+=chunk.byteLength;request(); }
+    },
+    attachLive(socket) {
+      controller?.close();controller=null;live?.close(1000,'replaced');live=socket;waking=false;emit('drain',{});
+      for(const chunk of queued)socket.send(new TextDecoder().decode(chunk).trimEnd());queued=[];bytes=0;
+      socket.addEventListener('close',()=>{try{socket.close(1000,'detached');}catch{}if(live===socket)live=null;});
+      socket.addEventListener('error',()=>{if(live===socket)live=null;});
+    },
+    open() {
+      controller?.close();
+      let owned;
+      return new ReadableStream({
+        start(next) { owned=next;controller=next;waking=false;for(const chunk of queued)next.enqueue(chunk);queued=[];bytes=0; },
+        pull() { emit('drain',{}); },
+        cancel() { if(controller===owned)controller=null; },
+      },{highWaterMark:limit,size:chunk=>chunk.byteLength});
+    },
+    sleep() { controller?.close();controller=null;const socket=live;live=null;socket?.close(1000,'room idle'); },
+    close(code,reason) {
+      if(closed)return;closed=true;
+      if(live){try{live.send(JSON.stringify([['link-close',code,reason]]));}catch{}live.close(code,reason);live=null;}
+      if(controller){controller.enqueue(encoder.encode(JSON.stringify([['link-close',code,reason]])+'\n'));controller.close();}
+      controller=null;queued=[];bytes=0;emit('close',{code,reason});
+    },
+  };
+}
+
+export async function readRelay(response, socket) {
+  if (!response.ok || !response.body) throw new Error('Relay stream refused');
+  const reader=response.body.getReader(),decoder=new TextDecoder();let pending='';
+  try {
+    for (;;) {
+      const {value,done}=await reader.read();if(done)break;
+      pending+=decoder.decode(value,{stream:true});
+      let end;while((end=pending.indexOf('\n'))>=0){if(end>4*1024*1024)throw new Error('Relay frame limit');const data=pending.slice(0,end);pending=pending.slice(end+1);socket.emit('message',{data});}
+      if(pending.length>4*1024*1024)throw new Error('Relay frame limit');
+    }
+    if(pending)throw new Error('Incomplete relay frame');
+  } finally { await reader.cancel().catch(()=>{}); }
+}

package/worker/request-db.mjs

@@ -1,3 +1,4 @@
+import {LIVE_ROOMS_QUERY} from './lobby-summary.mjs';
 export const METADATA_REVISION=Symbol('metadata revision');
 export const ORIGINAL_DB=Symbol('original database');
 export const MUTATIONS=Symbol('request mutations');
@@ -15,7 +16,7 @@ export function requestDatabase(DB, request, state={mutated:false}, binding=data
  // any bookmark returned by an earlier request without trusting stale auth.
  if(DB===binding&&typeof DB.withSession==='function')DB=DB.withSession('first-primary');
  let revision,records,rows,liveRooms;
- const prefetchRooms=false;
+ const prefetchRooms=state.summaries&&/^\/(?:api\/(?:rooms|games)|\.well-known\/homie-studio\.json)?\/?$/.test(new URL(request.url).pathname);
  const url=new URL(request.url),match=request.method==='GET'&&/^\/([a-z0-9][a-z0-9-]{0,39})\/api\/app\/records\/([a-z][a-z0-9-]{0,39})(?:\/([A-Za-z0-9_-]{1,64}))?$/.exec(url.pathname);
  const recordQuery=match&&(match[3]?'SELECT id, value, version, updated_at FROM app_records WHERE app = ?1 AND collection = ?2 AND id = ?3':'SELECT id, value, version, updated_at FROM app_records WHERE app = ?1 AND collection = ?2 ORDER BY updated_at, id');
  const stamp=()=>revision??=(async()=>{
@@ -27,7 +28,7 @@ export function requestDatabase(DB, request, state={mutated:false}, binding=data
   const cold=!cached;
   const statements=[query,...(cold?queries.map(sql=>DB.prepare(sql)):[])];
   if(recordQuery)statements.push(DB.prepare(recordQuery).bind(...match.slice(1).filter(x=>x!==undefined)));
-  if(prefetchRooms)statements.push(DB.prepare('SELECT game,rooms,updated FROM lobby_summaries LIMIT 500'));
+  if(prefetchRooms)statements.push(DB.prepare(LIVE_ROOMS_QUERY));
   const result=await DB.batch(statements);
   if(prefetchRooms)liveRooms=result.at(-1);
   let version=result[0].results?.[0]?.value??null;
@@ -46,7 +47,7 @@ export function requestDatabase(DB, request, state={mutated:false}, binding=data
  const prepare=(sql,args=[])=>{
   const original=()=>{const stmt=DB.prepare(sql);return args.length?stmt.bind(...args):stmt;};
   const read=async()=>{
-   if(sql==='SELECT game,rooms,updated FROM lobby_summaries LIMIT 500'&&prefetchRooms){await stamp();return liveRooms;}
+   if(sql===LIVE_ROOMS_QUERY&&prefetchRooms){await stamp();return liveRooms;}
    if(sql===recordQuery&&JSON.stringify(args)===JSON.stringify(match.slice(1).filter(x=>x!==undefined))){await stamp();return records;}
    if(!metadataQueries.has(sql))return original().all();
    await stamp();

package/worker/room-chat.mjs

@@ -130,7 +130,7 @@ onChat({ client = null, conn = null }, m) {
       if (this.room.chatPending >= CHAT_LIMITS.pending) return reply('busy');
       this.room.chatPending += 1;
       const t0 = now;
-      Promise.resolve()
+      const reviewing=Promise.resolve()
         .then(() => this.room.review(rec.text, { room: this.room.code, links: rules.links }))
         .then((v) => v, (error) => ({ ok: true, by: 'error', error: String(error?.message ?? error).slice(0, 120) }))
         .then((v) => {
@@ -150,6 +150,7 @@ onChat({ client = null, conn = null }, m) {
           if (this.room.muteOf({ token: who.token, browser: who.browser, player: who.player })) { reply('muted'); return; }
           this.room.publishChat(rec, who.conn, n);
         });
+      this.room.waitUntil?.(reviewing);
       return { ok: true, pending: true };
     }
     return this.room.publishChat(rec, who.conn, n);

package/worker/room-sessions.mjs

@@ -0,0 +1,65 @@
+/** Hibernation keeps transports outside JavaScript. Only data crosses this
+ * boundary; callbacks, bindings and sockets are reconstructed by the Table.
+ */
+// Only protocol identity, admission, controls and round deadlines survive here.
+// World snapshots/checkpoints belong to the existing host/room save, not sessions.
+const fields = new Set(`rawVocab vocab snapAt rates agentsAloneMs voteMs voteCooldownMs autoVoteMs policy level levelBy caps vote lastVoteOpen lastAutoVote lastHumanAt agentsOut officeDirty endedMatch code rules tickHz seatCap maxPlayers maxScreens perIp stallMs silentMs idleMs holdMs forgetMs persistMs gameVer currentVer occSeq seats hostId hostSince lastJoinAt lastRound lastRoster emptySince preferHost seatsDirty persistDirty lastPersistAt bans mutes announcement closedUntil closedWhy openedAt askedMax regate decideTimes defaultChat`.split(' '));
+function urlDelta(base, value) {
+  const a=new URL(base),b=new URL(value),changes=[];
+  for(const key of new Set([...a.searchParams.keys(),...b.searchParams.keys()])) {
+    const x=a.searchParams.getAll(key),y=b.searchParams.getAll(key);
+    if(JSON.stringify(x)!==JSON.stringify(y))changes.push([key,y]);
+  }
+  return {path:b.pathname,changes};
+}
+function clientURL(base, delta) {
+  const url=new URL(base);url.pathname=delta.path;
+  for(const [key,values] of delta.changes){url.searchParams.delete(key);for(const value of values)url.searchParams.append(key,value);}
+  return url.toString();
+}
+import {isQa} from './stats.mjs';
+const qa = agent => isQa({headers:new Headers({'user-agent':agent??''})})?'homie-house-qa':null;
+import {encodeSession as encode,decodeSession as decode} from './session-codec.mjs';
+const legacyDecode=value=>JSON.parse(value,(_key,item)=>item?.__roomMap?new Map(item.__roomMap):item?.__roomSet?new Set(item.__roomSet):item?.__roomNumber?item.__roomNumber*Infinity:item);
+export function roomSessions(storage) {
+  const sql=storage.sql;let previous=new Map();
+  return {
+    read() {
+      if(!sql)return null;
+      sql.exec('CREATE TABLE IF NOT EXISTS room_sessions(key TEXT PRIMARY KEY,value TEXT NOT NULL)');
+      previous=new Map(sql.exec('SELECT key,value FROM room_sessions').toArray().map(row=>[row.key,row.value]));
+      if(!previous.has('version'))return null;
+      if(!['1','2','3'].includes(previous.get('version')))throw new Error('Unsupported room session snapshot');
+      const read=previous.get('version')==='1'?legacyDecode:decode;
+      const table=previous.has('table')?read(previous.get('table')):{};
+      if(previous.get('version')==='3')table.relayDescriptors=[...previous].filter(([key])=>key.startsWith('relay:')).map(([key,value])=>{
+        const relay=read(value),prefix='relay-client:'+key.slice(6)+':';
+        relay.clients=[...previous].filter(([key])=>key.startsWith(prefix)).map(([,value])=>{const [id,clientId,delta,ip,agent]=read(value);return [id,clientId,clientURL(relay.url,delta),ip,qa(agent)];});
+        return relay;
+      });
+      return {table,fields:new Map([...previous].filter(([key])=>key.startsWith('room:')).map(([key,value])=>[key.slice(5),read(value)])),clients:new Map([...previous].filter(([key])=>key.startsWith('client:')).map(([key,value])=>[key.slice(7),read(value)]))};
+    },
+    write(room,table = {}) {
+      if(!sql)throw new Error('Room hibernation requires SQLite storage');
+      const {relayDescriptors=[],...metadata}=table;
+      const next=new Map([['version','3'],['table',encode(metadata)]]);
+      relayDescriptors.forEach((relay,index)=>{
+        next.set('relay:'+index,encode({url:relay.url}));
+        for(const [id,clientId,url,ip,agent] of relay.clients)next.set('relay-client:'+index+':'+id,encode([id,clientId,urlDelta(relay.url,url),ip,qa(agent)]));
+      });
+      for(const [key,value] of Object.entries(room))if(fields.has(key)&&value!==undefined&&typeof value!=='function')next.set('room:'+key,encode(value));
+      for(const [id,client] of room.clients){const {conn,lastSeen,probe,readyAt,ingressRateAt,rttWindow,rttReadAt,rttToldAt,measuredRtt,...state}=client;
+        if(state.rates instanceof Map)state.rates=new Map([...state.rates].filter(([key])=>key!=='ping'&&key!=='ping:view'));next.set('client:'+id,encode(state));}
+      storage.transactionSync(()=>{
+        for(const [key,value] of next)if(previous.get(key)!==value)sql.exec('INSERT INTO room_sessions VALUES(?,?) ON CONFLICT(key) DO UPDATE SET value=excluded.value',key,value);
+        for(const key of previous.keys())if(!next.has(key))sql.exec('DELETE FROM room_sessions WHERE key=?',key);
+      });
+      previous=next;
+    },
+    clear() {if(sql&&previous.size){sql.exec('DELETE FROM room_sessions');previous.clear();}},
+  };
+}
+export function restoreRoomFields(room,snapshot) {
+  if(!snapshot)return;
+  for(const [key,value] of snapshot.fields)if(fields.has(key)&&Object.hasOwn(room,key)&&typeof room[key]!=='function')room[key]=value;
+}

package/worker/room.mjs

@@ -53,6 +53,10 @@ export class NetRoom {
     this.agentsOut = null;
     /** Revision 7: the game's agents.json (the Table reads it once), the only words an AI here may say. */
     this.vocab = null;
+    this.rawVocab = null;
+    this.officeDirty = false;
+    this.endedMatch = null;
+    this.snapAt = new Map();
     this.code = code;
     this.rules = rules === true;
     this.tickHz = tickHz;
@@ -268,6 +272,7 @@ export class NetRoom {
     this.lastSnap = snap;
     if (!c) { const sentAt = (this.snapAt ??= new Map()); sentAt.set(snap.k, now); if (sentAt.size > 128) sentAt.delete(sentAt.keys().next().value); }
     if (c) c.lastSnapAt = now;
+    this.retryBrowserSeats(c);
     this.stats.snaps += 1;
     this.snapTimes.push(now);
     while (this.snapTimes.length && this.snapTimes[0] < now - 1000) this.snapTimes.shift();
@@ -384,6 +389,34 @@ export class NetRoom {
     this.tellWatchers();
   }
 
+  /** A browser can hear joins before its world exists. Its roster acknowledges
+   * bodies, so re-announce missing connected seats until it acknowledges them.
+   * Use the existing join protocol for games bundling older netplay clients.
+   * Snapshot traffic retries even if the boot roster was published too early;
+   * retries back off from 1 to 30 seconds and stop after eight attempts.
+   * An exhausted peer is logged once; retries are never sent to replicas.
+   */
+  retryBrowserSeats(host) {
+    if (!host || this.server || this.rules || host.id !== this.hostId || !this.lastRoster) return;
+    const seated = new Set(this.lastRoster.filter(s => !s.bot || s.agent).flatMap(s => [s.seat, s.agent?.seat]));
+    const now = this.now();
+    for (const peer of this.live()) {
+      if (peer.id === host.id || peer.seat === null || peer.watch) continue;
+      if (seated.has(peer.seat)) { peer.seatRetry = null; continue; }
+      const retry = peer.seatRetry?.host === host.id ? peer.seatRetry : null;
+      if (retry && now - retry.at < Math.min(1000 * 2 ** (retry.tries - 1), 30000)) continue;
+      if (retry?.tries >= 8) {
+        if (!retry.exhausted) {
+          retry.exhausted = true;
+          this.log({ ev: 'seat-retry-exhausted', room: this.code, id: peer.id, seat: peer.seat, host: host.id, tries: retry.tries });
+        }
+        continue;
+      }
+      peer.seatRetry = { host: host.id, at: now, tries: (retry?.tries ?? 0) + 1 };
+      this.send(host, { t: 'join', peer: this.peer(peer) });
+    }
+  }
+
   hostCaps(c, m) {
     // The host's game reads the dial and/or moves agents' bodies (section 17): the office and the shell say so.
     if (!Array.isArray(m.caps)) return;
@@ -401,7 +434,7 @@ export class NetRoom {
   /* ------------------------------------------------------------ sockets */
 
   /** A new relay socket. Returns the two callbacks the transport must call. */
-  attach(conn) {
+  attach(conn, resume = null) {
     const now = this.now();
     const c = {
       id: randomId(6), conn, ip: conn.ip ?? null, browser: conn.browser ?? null, player: conn.player ?? null, via: conn.via ?? null, helloed: false, seat: null, token: null, name: '', typed: '', colour: 0,
@@ -422,6 +455,7 @@ export class NetRoom {
       // address, so a helper from before revisions carries it too) when the transport gives one, else the hello's.
       verWord: 'ver' in conn ? versionOf(conn.ver) : undefined, ver: null, feat: [], staleTold: false,
     };
+    if(resume)Object.assign(c,resume,{conn});
     this.clients.set(c.id, c);
     return {
       id: c.id,
@@ -451,18 +485,19 @@ export class NetRoom {
    * The shell's watch socket: the room's facts, and (revision 6) the party's vote from the play page's card. A vote
    * from it counts as the seat of the client in this room with the same browser key (`conn.browser`).
    */
-  watch(conn) {
+  watch(conn, restored = null) {
     this.watchers.add(conn);
-    this.sendText(conn, JSON.stringify(this.facts()));
+    if (!restored) this.sendText(conn, JSON.stringify(this.facts()));
     // A shell that comes back to a room it was kicked from (or that is closed) hears so at once.
     const held = this.heldNotice(conn);
-    if (held) this.sendText(conn, JSON.stringify(held));
+    if (!restored && held) this.sendText(conn, JSON.stringify(held));
     // Room chat (section 19): the last few minutes, so a page that just opened has the conversation (never to a page the
     // studio holds out of the room, or a room it closed).
     // A line of this browser's or this account's own says so (`mine`), on this page's copy only: it may take it down.
-    if ((!held || held.t === 'muted') && (!conn.hub || this.chatRules().hub)) this.sendText(conn, JSON.stringify({ t: 'lines', lines: this.recentChat().map((r) => (this.ownLine(r, conn) ? { ...this.wireLine(r), mine: true } : this.wireLine(r))) }));
-    const rate = [];
+    if (!restored && (!held || held.t === 'muted') && (!conn.hub || this.chatRules().hub)) this.sendText(conn, JSON.stringify({ t: 'lines', lines: this.recentChat().map((r) => (this.ownLine(r, conn) ? { ...this.wireLine(r), mine: true } : this.wireLine(r))) }));
+    const rate = restored?.rate ?? [];
     return {
+      state: {rate},
       onClose: () => this.watchers.delete(conn),
       onMessage: (text) => {
         const now = this.now();
@@ -974,7 +1009,7 @@ export class NetRoom {
     const behind = !lite && this.currentVer !== undefined && c.ver !== this.currentVer;
     if (behind) c.staleTold = true;
     this.send(c, {
-      t: 'welcome', v: NET_VERSION, rev: NET_REVISION, id: c.id, room: this.code, seat: c.seat, token: c.token, name: c.name, colour: c.colour,
+      t: 'welcome', v: NET_VERSION, rev: NET_REVISION, ...(c.conn.idlePing ? {idlePing:true} : {}), id: c.id, room: this.code, seat: c.seat, token: c.token, name: c.name, colour: c.colour,
       ...(this.gameVer ? { ver: this.gameVer } : {}), ...(behind ? { stale: { ver: this.currentVer } } : {}), stall: this.stallMs,
       role, why, host: this.hostRef(), peers: this.peers(), ...(this.rules ? { held: this.heldPeers() } : {}), st: now, max: this.maxPlayers,
       round: this.lastRound, roster: this.lastRoster, snap: lite ? null : this.playerSnapshot(c, this.lastSnap, true), state: lite ? {} : this.stateObject(),
@@ -1345,18 +1380,19 @@ export class NetRoom {
   }
 
   /** Call every ~250 ms (setInterval locally, an alarm or the socket traffic on a Durable Object). */
-  tick() {
+  tick(idle = false) {
     const now = this.now();
     // Sockets that never said hello, or went silent (a slept phone, a half-open link): close them, and a seat
     // becomes a bot instead of a frozen body.
     for (const c of [...this.clients.values()]) {
+      c.lastSeen=Math.max(c.lastSeen,c.conn.lastPing?.()??0);
       if (!c.helloed) { if (now - c.joinedAt > 5000) { this.clients.delete(c.id); try { c.conn.close(4000, 'no-hello'); } catch { /* gone */ } } continue; }
       // A loopback (the Table's own house agent) cannot be half-open: it is never closed for silence.
       if (now - c.lastSeen > this.idleMs && !c.conn.loopback) this.kick(c, 'silent', 4000);
     }
     // A host that stopped sending snapshots while others are present.
     const h = this.host();
-    if (h && this.live().length > 1) {
+    if (!idle && h && this.live().length > 1) {
       const since = Math.max(h.lastSnapAt, this.hostSince, this.lastJoinAt);
       if (now - since > this.stallMs) {
         const next = this.elect(h.id, 'host-stalled');

package/worker/route-auth.mjs

@@ -0,0 +1,22 @@
+import {launchOf, settingsOf, accessOf, sameOrigin} from './office.mjs';
+import {catalogue} from './catalogue.mjs';
+/** Uses the same live session/account checks as the studio office. */
+export async function isOwner(request, env) {
+  return (await import('./office.mjs')).isOwner(request, env);
+}
+/** Checks an app's declared role with its existing link, session and grant rules. */
+export async function hasRole(request, env, app, role) {
+  const url = new URL(request.url);
+  const cat = await catalogue(env, url.origin);
+  const meta = cat.games?.find(item => item.id === app && item.kind === 'app');
+  if (!meta || typeof role !== 'string' || !Object.hasOwn(meta.roles ?? {}, role)) return false;
+  const launch = launchOf(meta, await settingsOf(env, {fresh:true}), env);
+  if (launch !== 'public' && !(await accessOf(request, env, app, launch)).ok) return false;
+  url.searchParams.set('role', role);
+  return (await (await import('./app-records.mjs')).appAccess(request, env, meta, url)).ok === true;
+}
+
+/** Return a refusal response, or null when the browser supplied same-origin evidence. */
+export function requireSameOrigin(request) {
+  return sameOrigin(request, new URL(request.url)) ? null : new Response('Same origin required', {status:403});
+}

package/worker/routes.mjs

@@ -1,4 +1,6 @@
+import {lobbyFor} from './lobby-shards.mjs';
 /** Route dispatch; large interfaces and tool runtimes load at their own entry points. */
+import {customRoute} from './custom-routes.mjs';
 import { catalogue } from './catalogue.mjs';
 
 import { RULES_WIRING_MESSAGE } from './rules-wiring.mjs';
@@ -40,6 +42,7 @@ export default async function route(request, env, ctx) {
   let pubP = null;
   // Every game (for a game's own pages and the owner's), and the public ones (every list, the rooms, the manifest).
   const getAll = () => (catP ??= catalogue(env, url.origin).then((cat) => named(cat, env)));
+  const customFallback = async () => (await customRoute(request, env, ctx)) ?? fallback(request, env, url, getCat);
   const getCat = () => (pubP ??= Promise.all([getAll(), settingsOf(env)]).then(([cat, settings]) => publicCatalogue(cat, settings, env)));
 
   // Keep tool transports and discovery on the alias; redirect browser pages only.
@@ -53,7 +56,7 @@ export default async function route(request, env, ctx) {
 
   if (path === '/_studio/office/functions') return (await import('./functions.mjs')).functionsRoute(request,env,await getAll());
 
-  if (path === '/mcp' || path === '/mcp/auth' || path.startsWith('/hooks/tools/') || path.startsWith('/oauth/') || path.startsWith('/.well-known/oauth-') || path === '/_studio/office/connections') {
+  if (path === '/.well-known/jwks.json' || path === '/mcp' || path === '/mcp/auth' || path.startsWith('/hooks/tools/') || path.startsWith('/hooks/studios/') || path.startsWith('/oauth/') || path.startsWith('/.well-known/oauth-') || path === '/_studio/office/connections') {
     const { remoteMcp } = await import('./mcp.mjs');
     return remoteMcp(request, env, ctx, { catalogueOf: getAll, definitions: await studioTools() });
   }
@@ -281,7 +284,7 @@ export default async function route(request, env, ctx) {
   if (game && GAME_ID.test(game)) {
     const all = await getAll();
     const meta = (all.games ?? []).find((g) => g.id === game);
-    if (!meta) return fallback(request, env, url, getCat);
+    if (!meta) return customFallback();
     if (parts.length === 1 && !path.endsWith('/')) return Response.redirect(`${url.origin}/${game}/`, 301);
     let sub = parts.slice(1).join('/');
     // Game bundles were already public assets; only the document carries access context.
@@ -338,7 +341,7 @@ export default async function route(request, env, ctx) {
         if(!meta.room)return appRoleSession((await import('./records-page.mjs')).recordsPage(meta,url,cat,await availableShellShop(env,cat,game),Boolean(await (await import('./local-test.mjs')).localSession(request,env)),launch!=='public'?await appAssetTicket(env,game,undefined,{request,meta,launch}):null),request,env,meta,launch);
       }
     }
-    const lobby = () => env.LOBBY.get(env.LOBBY.idFromName(game));
+    const lobby = () => lobbyFor(env,game,/^[A-Za-z0-9_-]{16,43}$/.test(url.searchParams.get('b')??'')?url.searchParams.get('b'):'');
     if (sub === 'invite') return redeemInvite(request, env, url, cat, meta, settings);
 
     // SERVERS (worker/servers.mjs, NETPLAY.md section 17): which server a request is for — its path (/s/<id>/), its
@@ -629,7 +632,7 @@ export default async function route(request, env, ctx) {
       const cur = versionOf(meta?.netplay?.version) ?? '';
       const gv = versionOf(url.searchParams.get('gv')) ?? '';
       const stall = Number(meta?.netplay?.stallMs) || 0;
-      const target = `https://table/${sub}?game=${encodeURIComponent(game)}&room=${encodeURIComponent(room)}&max=${max}${b ? `&b=${b}` : ''}${who ? `&via=${encodeURIComponent(who)}` : ''}${sub === '__net' ? `&wp=${policy}${w ? '&w=1' : ''}` : ''}&pol=${encodeFacts(pol)}&chat=${encodeFacts(lean)}${acct ? '&acct=1' : ''}${member ? '&mem=1' : ''}${hub ? '&hub=1' : ''}${ag ? `&ag=${encodeFacts(ag)}` : ''}${badge ? `&bd=${encodeURIComponent(badge)}` : ''}&cur=${encodeURIComponent(cur)}${gv ? `&gv=${encodeURIComponent(gv)}` : ''}${stall ? `&stall=${stall}` : ''}${meta?.room?.contract ? `&rules=1&hz=${meta.room.tickHz ?? 20}` : ''}${meta?.room?.host === 'server' ? '&host=server' : ''}`;
+      const target = `https://table/${sub}?relay=1&game=${encodeURIComponent(game)}&room=${encodeURIComponent(room)}&max=${max}${b ? `&b=${b}` : ''}${who ? `&via=${encodeURIComponent(who)}` : ''}${sub === '__net' ? `&wp=${policy}${w ? '&w=1' : ''}` : ''}&pol=${encodeFacts(pol)}&chat=${encodeFacts(lean)}${acct ? '&acct=1' : ''}${member ? '&mem=1' : ''}${hub ? '&hub=1' : ''}${ag ? `&ag=${encodeFacts(ag)}` : ''}${badge ? `&bd=${encodeURIComponent(badge)}` : ''}&cur=${encodeURIComponent(cur)}${gv ? `&gv=${encodeURIComponent(gv)}` : ''}${stall ? `&stall=${stall}` : ''}${meta?.room?.contract ? `&rules=1&hz=${meta.room.tickHz ?? 20}` : ''}${meta?.room?.host === 'server' ? '&host=server' : ''}`;
       // The room's own failure to answer is told apart from the browser going away while it was connecting (a closed
       // tab, a reload racing its own socket): the second is a departure, said in one line with its room, never an
       // uncaught error with nothing on it.
@@ -663,5 +666,5 @@ export default async function route(request, env, ctx) {
     }
     if (sub.startsWith('__game/')) return gameAsset(request, env, url, game, sub.slice('__game/'.length));
   }
-  return fallback(request, env, url, getCat);
+  return customFallback();
 }

package/worker/runtime-support.mjs

@@ -1,6 +1,8 @@
+import {lobbyFor} from './lobby-shards.mjs';
 import {studioTools,directoryOf} from './tool-registry.mjs';
 export {useTools,getStudioTools} from './tool-registry.mjs';
 import {json,finish} from './responses.mjs';
+import {liveRoomSummaries} from './lobby-summary.mjs';
 /** Shared catalogue, assets, and room presentation helpers. */
 import {catalogue,builtPosts} from './catalogue.mjs';
 
@@ -138,11 +140,11 @@ async function roomsOf(env, games, { servers = null } = {}) {
   const live = {};
   // Room chat (section 19): whether each room's chat is on and may show on homie.rocks's page for it.
   const chatRows = await chatRowsOf(env);
-  const summaries=null;
+  const summaries=await liveRoomSummaries(env);
   await Promise.all(games.map(async (g) => {
     let list = [];
     if(summaries)list=summaries.get(g.id)??[];
-    else try { list = (await (await env.LOBBY.get(env.LOBBY.idFromName(g.id)).fetch('https://lobby/rooms')).json()).rooms ?? []; } catch { list = []; }
+    else try { list = (await (await lobbyFor(env,g.id).fetch('https://lobby/rooms')).json()).rooms ?? []; } catch { list = []; }
     const busy = list.filter((r) => (r.players || 0) > 0);
     live[g.id] = busy.reduce((n, r) => n + (r.players || 0), 0);
     const known = busy.some((r) => r.server && r.server !== 'public') ? (servers?.[g.id] ?? await serversOf(env, g).catch(() => [])) : [];
@@ -428,7 +430,7 @@ async function weekOf(env, game) {
   const w = await playedThisWeek(env, game);
   if (!w) return null;
   let peak = 0;
-  try { peak = (await (await env.LOBBY.get(env.LOBBY.idFromName(game)).fetch('https://lobby/now')).json()).peak?.players ?? 0; } catch { peak = 0; }
+  try { peak = (await (await lobbyFor(env,game).fetch('https://lobby/now')).json()).peak?.players ?? 0; } catch { peak = 0; }
   return { plays: w.plays, rounds: w.rounds, ...(peak ? { peak } : {}) };
 }
 

package/worker/session-codec.mjs

@@ -0,0 +1,24 @@
+/** Explicit containers keep user checkpoint keys from colliding with type tags. */
+function pack(value) {
+  if(value===undefined)return ['u'];
+  if(typeof value==='number'&&!Number.isFinite(value))return ['n',String(value)];
+  if(value===null||typeof value!=='object')return ['v',value];
+  if(value instanceof Map)return ['m',[...value].map(([key,item])=>[pack(key),pack(item)])];
+  if(value instanceof Set)return ['s',[...value].map(pack)];
+  if(Array.isArray(value))return ['a',value.map(pack)];
+  return ['o',Object.entries(value).filter(([,item])=>typeof item!=='function').map(([key,item])=>[key,pack(item)])];
+}
+function unpack([type,value]) {
+  switch(type) {
+    case 'u':return undefined;
+    case 'n':return Number(value);
+    case 'v':return value;
+    case 'm':return new Map(value.map(([key,item])=>[unpack(key),unpack(item)]));
+    case 's':return new Set(value.map(unpack));
+    case 'a':return value.map(unpack);
+    case 'o':return Object.fromEntries(value.map(([key,item])=>[key,unpack(item)]));
+    default:throw new Error('Invalid room session value');
+  }
+}
+export const encodeSession=value=>JSON.stringify(pack(value));
+export const decodeSession=value=>unpack(JSON.parse(value));

package/worker/stats.mjs

@@ -1,3 +1,4 @@
+import {lobbyFor} from './lobby-shards.mjs';
 import {writePageMetric,analyticsStatus} from './analytics.mjs';
 /**
  * STUDIO METRICS: count, don't track (@homie-rocks/studio 0.6.0).
@@ -255,7 +256,7 @@ async function playingNow(env, games) {
   const out = {};
   await Promise.all(games.map(async (g) => {
     try {
-      const res = await env.LOBBY.get(env.LOBBY.idFromName(g.id)).fetch('https://lobby/now');
+      const res = await lobbyFor(env,g.id).fetch('https://lobby/now');
       const body = await res.json();
       out[g.id] = { players: Number(body.players) || 0, rooms: Number(body.rooms) || 0 };
     } catch { out[g.id] = { players: 0, rooms: 0 }; }

package/worker/studios-auth.mjs

@@ -0,0 +1,71 @@
+import {decode,originKey,verifyBytes} from './studios-keys.mjs';
+import {oauthStorage,audit} from './mcp-store.mjs';
+import {studioOrigin} from './studios-client.mjs';
+const hash=async text=>Array.from(new Uint8Array(await crypto.subtle.digest('SHA-256',new TextEncoder().encode(text))),b=>b.toString(16).padStart(2,'0')).join('');
+const json=(data,status=200)=>Response.json(data,{status,headers:{'cache-control':'no-store','pragma':'no-cache',...(status===401?{'www-authenticate':'Bearer'}:{})}});
+export async function boundedBody(request,maxBytes=65536) {
+ const reader=request.body?.getReader();if(!reader)return '';
+ const chunks=[];let bytes=0;
+ try{while(true){const {done,value}=await reader.read();if(done)break;bytes+=value.byteLength;if(bytes>maxBytes)throw new Error('Request size exceeded');chunks.push(value);}}
+ catch(error){await reader.cancel();throw error;}finally{reader.releaseLock();}
+ const body=new Uint8Array(bytes);let offset=0;for(const chunk of chunks){body.set(chunk,offset);offset+=chunk.length;}return new TextDecoder('utf-8',{fatal:true}).decode(body);
+}
+export function studioRegistration(cat,origin){
+ for(const rule of Object.values(cat.studio?.mcp?.studios?.inbound??{})){
+  try{if(studioOrigin(rule.origin,{allowPrivate:rule.allowPrivate===true})===origin&&rule.enabled!==false)return rule;}catch{/* Invalid configuration is denied. */}
+ }
+ return null;
+}
+export async function setStudioPolicy(env,origin,allow){
+ origin=studioOrigin(origin,{allowPrivate:true});
+ await oauthStorage(env.DB).put('studio-policy:'+origin,JSON.stringify({allow:allow===true}));
+}
+export async function studioPolicy(env,cat,origin){
+ const rule=studioRegistration(cat,origin);
+ return rule&&(await oauthStorage(env.DB).get('studio-policy:'+origin,'json'))?.allow===true?rule:null;
+}
+/** RFC 7523 client authentication. Only the claimed origin's HTTPS JWKS can prove it. */
+export async function studioToken(request,env,cat,options={}) {
+ if(request.method!=='POST')return null;
+ let form;try{form=new URLSearchParams(await boundedBody(request.clone(),8192));}catch{return json({error:'invalid_request'},400);}
+ if(form.get('grant_type')!=='client_credentials')return null;
+ const receiver=new URL(request.url).origin;
+ if(!receiver.startsWith('https:')||form.getAll('resource').length!==1||form.get('resource')!==receiver+'/mcp')return json({error:'invalid_target'},400);
+ if(form.has('scope')&&form.get('scope')!=='studio')return json({error:'invalid_scope'},400);
+ let origin,stage='assertion';
+ try{
+  for(const name of ['client_assertion','client_assertion_type','client_id'])if(form.getAll(name).length!==1)throw Error();
+  if(form.get('client_assertion_type')!=='urn:ietf:params:oauth:client-assertion-type:jwt-bearer')throw Error();
+  const parts=form.get('client_assertion').split('.');if(parts.length!==3)throw Error();
+  const header=decode(parts[0]),claims=decode(parts[1]);origin=claims.iss;
+  stage='policy';
+  const rule=await studioPolicy(env,cat,origin);if(!rule)throw Error();
+  stage='claims';
+  if(studioOrigin(origin,{allowPrivate:rule.allowPrivate===true})!==origin||form.get('client_id')!==origin||claims.sub!==origin||claims.aud!==receiver+'/oauth/token'||header.alg!=='EdDSA'||header.jku||header.jwk||header.crit)throw Error();
+  const now=Math.floor(Date.now()/1000);
+  if(!Number.isSafeInteger(claims.exp)||!Number.isSafeInteger(claims.iat)||claims.iat>now+30||claims.iat<now-300||claims.exp<=now||claims.exp>claims.iat+300||claims.nbf!==undefined&&(!Number.isSafeInteger(claims.nbf)||claims.nbf>now)||typeof claims.jti!=='string'||! /^[A-Za-z0-9_-]{1,128}$/.test(claims.jti))throw Error();
+  stage='key discovery';
+  const key=await originKey(env,origin,header.kid,{...options,allowPrivate:rule.allowPrivate===true});
+  stage='signature';
+  if(!await verifyBytes(key,parts[2],parts.slice(0,2).join('.')))throw Error();
+  stage='replay';
+  const used=await env.DB.prepare('INSERT OR IGNORE INTO mcp_kv(key,value,expires) VALUES(?1,?2,?3) RETURNING key').bind('studio-jti:'+await hash(JSON.stringify([origin,claims.jti])),'1',claims.exp).first();if(!used)throw Error();
+ }catch{
+  await audit(env,{client:typeof origin==='string'?origin.slice(0,2048):null},'studio-auth','denied:'+stage);
+  return json({error:'invalid_client',error_description:'Studio authentication failed'},401);
+ }
+ const token='homie_studio_'+Array.from(crypto.getRandomValues(new Uint8Array(32)),b=>b.toString(16).padStart(2,'0')).join('');
+ const record={origin,resource:receiver+'/mcp',expires:Math.floor(Date.now()/1000)+300};
+ await oauthStorage(env.DB).put('studio-token:'+await hash(token),JSON.stringify(record),{expiration:record.expires});
+ return json({access_token:token,token_type:'Bearer',expires_in:300,scope:'studio'});
+}
+/** Live D1 policy is re-read on every dispatch; handles only separate booking ownership. */
+export async function studioCaller(request,env,cat) {
+ const token=/^Bearer (homie_studio_[a-f0-9]{64})$/.exec(request.headers.get('authorization')??'')?.[1];if(!token)return null;
+ const record=await oauthStorage(env.DB).get('studio-token:'+await hash(token),'json');
+ if(!record||record.expires<=Date.now()/1000||record.resource!==new URL(request.url).origin+'/mcp')return null;
+ const rule=await studioPolicy(env,cat,record.origin);if(!rule)return null;
+ let assertedHandle;try{const raw=request.headers.get('x-studio-asserted-handle');if(raw!==null){assertedHandle=decodeURIComponent(raw);if(!/^[A-Za-z0-9._@-]{1,128}$/.test(assertedHandle))return null;}}catch{return null;}
+ return {id:'studio:'+await hash(JSON.stringify([record.origin,assertedHandle??null])),owner:false,roles:{},client:record.origin,tools:rule.tools??[],
+  studio:{origin:record.origin,verified:true,method:'private_key_jwt'},...(assertedHandle===undefined?{}:{actingFor:{assertedHandle,verified:false,assertedBy:record.origin}})};
+}