@homie-rocks/studio 0.56.0 → 0.57.0

package/CHANGELOG.md

@@ -17,6 +17,39 @@ To bring a studio up to date, tell Claude: "Upgrade my studio to the newest Homi
 `npx -y @homie-rocks/studio@latest upgrade`, which shows what's new since the version your studio pins (from this
 file) and what the upgrade would change, and changes nothing until you agree.
 
+## [Unreleased]
+
+### Fixed
+
+- The MCP Events workerd conformance test now parses SSE frames across HTTP chunks, including combined event/heartbeat frames and split UTF-8. Its former one-chunk-per-event assumption caused the intermittent 0.57.0 publish-gate JSON parse failure; production delivery and webhook formats are unchanged. PR CI adds a path-filtered Events/webhook gate covering protocol, push, durable delivery and signed studio events.
+
+## [0.57.0] - 2026-10-16
+
+**Plugin 0.57.0**
+
+Studios can book at each other on behalf of a person, with proven studio identity and signed events, and friends joining a browser-hosted game at the same moment always get their seat.
+
+### Fixed
+
+- Browser-hosted games retry connected players’ seat claims when the host’s roster has no player body for them. Friends joining while the host is still loading now become seated players when its world is ready, including games with older bundled netplay clients. Fixes the 0.56.0 regression where Kart Royale replicas stayed bots across rounds; the two-browser check retains its original early-join timing. Host-driven AI seats count as acknowledged; missing-seat retries use capped exponential backoff and stop after eight attempts with one diagnostic, avoiding repeated joins when a game has no available body.
+- Studio ingress now limits requests by IP before discovery; failed JWKS fetches and unknown keys share an atomic 60-second per-origin fetch bound. Authentication errors are generic, with stage details only in owner audit logs. Signed events use the exact inbound path rule, honour disabled entries and reject non-object bodies with 400. Removed the unused v1-only webhook production dependency and documented exact manual key rotation steps through stdin.
+
+- Studio-to-studio limits aggregate by proven origin, outbound destinations require explicit configuration, and remote results retain untrusted provenance. Asserted handles never identify local accounts.
+- Availability allocates from a page snapshot in three queries instead of querying per slot, option and resource.
+- Studio identity uses Ed25519 private-key JWT and origin-hosted JWKS; events use Standard Webhooks v1a with the same key. Deploy provisions private keys through stdin. Office Allow/Deny is stored in D1, denied by default, with origin/handle audit entries. Owners exchange no secrets.
+- Studio events and business feed data share an 8,192-byte limit. Discovery and tokens are cached within each request; proof scripts use deploy URLs without reading Wrangler OAuth files.
+
+### Added
+
+- Studio-to-studio tools use the official MCP SDK with bounded HTTPS transport, receiver-owned OAuth client credentials and a verified studio caller distinct from an asserted end-user handle.
+- Booking availability returns paged schema.org offers and exact booking arguments, shared by AI tools and the existing booking choices UI.
+- Signed cross-studio events reuse Standard Webhooks, per-sender allowlists and durable business-event receipts to trigger studio functions.
+- Tools can call their own custom routes with the caller's identity and share opt-in Cloudflare Rate Limiting bindings.
+
+### Upgrade notes
+
+- Studios that call or accept calls from other studios list them in studio.json (outbound) and allow them in the office (inbound); the deploy provisions each studio's signing key — nothing is exchanged between owners. Existing OAuth browser connections, booking migrations and function delivery remain in use. No version bump or new migration. See `packages/studio/docs/studio-to-studio.md`.
+
 ## [0.56.0] - 2026-10-15
 
 **Plugin 0.56.0**

package/apps/APPS.md

@@ -339,3 +339,12 @@ compiler; run `npm install` in the studio first if it is missing. Review the dif
 combined timer/jobs, hand-written routes and business-event mirrors need a semantic
 migration to the APIs above; they are not automatically deleted. The owner's
 words, historical evidence and unresolved integration work remain intact.
+
+## Availability shared with an AI
+
+`studio_availability` and `context.bookings.availability` return paged offers with
+valid booking arguments, checking the existing slots, holds, options and resources.
+Pass that result to `createBookingChoices({container,availability})`; `value()`
+returns the selected offer's booking arguments for the same booking tool an AI
+uses. Availability is a snapshot; authoritative holds still recheck capacity.
+See [the convention](../docs/studio-to-studio.md#availability-convention-v).

package/apps/apps.ts

@@ -78,7 +78,25 @@ export function createAppContext() {
 }
 
 /** Native accessible choices; submit value() to the same booking tool used by an AI. */
-export function createBookingChoices({container,options=[],resources=[]}:{container:HTMLElement;options?:Array<{id:string;name:string}>;resources?:Array<{id:string;name:string}>}) {
+export interface BookingAvailability {
+  convention: 'studio.booking-availability/1';
+  bookingTool: string;
+  items: Array<{identifier: string; name?: string; availabilityStarts?: string; booking: {app: string; collection: string; slot: string; quantity: number; option?: string; resource?: string; addons?: Record<string,number>}}>;
+  next: string|null;
+}
+export function createBookingChoices({container,options=[],resources=[],availability}:{container:HTMLElement;options?:Array<{id:string;name:string}>;resources?:Array<{id:string;name:string}>;availability?:BookingAvailability}) {
+  if(availability){
+    if(availability.convention!=='studio.booking-availability/1')throw new Error('Unsupported booking availability convention');
+    const label=document.createElement('label');label.textContent='Available bookings';
+    const select=document.createElement('select');select.name='booking';
+    const empty=document.createElement('option');empty.value='';empty.textContent='Choose a booking';select.append(empty);
+    const bookings=availability.items.map(item=>structuredClone(item.booking));
+    for(const [index,item] of availability.items.entries()){
+      const option=document.createElement('option');option.value=String(index);option.textContent=[item.name??item.booking.slot,item.availabilityStarts].filter(Boolean).join(' · ');select.append(option);
+    }
+    label.append(select);container.append(label);
+    return {value:():Partial<BookingAvailability['items'][number]['booking']>=>select.value===''?{}:structuredClone(bookings[Number(select.value)]),dispose:()=>label.remove()};
+  }
   const fields=new Map<string,HTMLSelectElement>();
   const group=document.createElement('fieldset');
   const legend=document.createElement('legend');legend.textContent='Choose an option';group.append(legend);

package/docs/studio-to-studio.md

@@ -0,0 +1,248 @@
+# One studio acting at another
+
+A concierge can discover a venue, select a visit, reserve it for a person and tell
+its host when they will arrive. Each studio runs its own tools, OAuth, database and
+functions. The same mechanisms apply to a resort stay or any other collaboration.
+
+## Client (t)
+
+Tools and functions receive `context.studios`:
+
+```ts
+const origin = 'https://venue.example';
+const page = await ctx.studios.listTools(origin); // pass {cursor: page.nextCursor}
+const available = await ctx.studios.call(origin, 'studio_availability', {
+  app: 'venue', collection: 'bookings'
+});
+if (available.isError) throw new Error('Availability could not be read');
+// Inspect available.data.items, choose an offer, then:
+const booked = await ctx.studios.call(origin, 'studio_book', {
+  ...chosenOffer.booking, id: stableBookingId, expiresAt: Date.now() + 600000
+}, {assertedHandle: 'guest-42'});
+if (booked.isError) throw new Error('Reservation was refused');
+```
+
+The official MCP TypeScript client owns initialization, Streamable HTTP/SSE,
+OAuth discovery, client authentication, schema validation and protocol errors.
+`call` returns `{source:{origin,authenticated},untrusted:true,isError,data?,content}`. Structured content is preserved; the
+kit's legacy `untrusted-tool-data` envelope is decoded while retaining the untrusted marker and provenance. `listTools` and each description are also labelled untrusted. Before any `ctx.ai` call, wrap remote data and descriptions as untrusted input, preserving `source` and `untrusted`; never concatenate them into system instructions. Content and
+`data` remain untrusted business data, never instructions or verified claims.
+Transport failures reject; tool failures return `isError:true`. No automatic
+booking or payment retries are introduced. Use stable business IDs for retries.
+
+Each operation has a ten-second deadline including discovery, a 1 MiB response
+limit before SDK parsing, and a 64 KiB argument limit. Origins must be bare HTTPS
+origins on port 443 with public DNS names. IP literals (including IPv6, mapped and integer forms), localhost, .localhost, .local and .internal are refused unless that exact outbound entry explicitly sets `allowPrivate:true`. Config keys are normalized; duplicate normalized keys or mismatched `origin` fields fail. Never take an origin from model or user input without checking it against a list of permitted origins. All redirects are refused. Every fetch, including OAuth metadata and token
+requests, must stay on the chosen origin. Credentials are issuer-pinned. A client
+and its transport close after each operation; discovery and tokens are cached per origin within the request; tool listing is cursor-paged.
+Keep the toolkit's `global_fetch_strictly_public` compatibility flag for
+Worker-to-Worker HTTP calls. Every destination must be configured and delegated to the calling tool. Public anonymous calls require `anonymous:true` on that exact outbound entry. An unknown origin never falls back to anonymous. Studio code is trusted Worker
+code: these safeguards are not a sandbox for imported JavaScript. Choose trusted
+remote operators; this does not implement DNS address pinning.
+
+## Studio identity and allowlists (u)
+
+Each studio deploy generates its own Ed25519 key into the `STUDIO_SIGNING_KEY`
+Worker secret via stdin. Private keys never appear in model output, source or
+studio.json. Existing keys survive redeploys. Owners exchange nothing.
+The caller publishes only public keys at `https://<origin>/.well-known/jwks.json`.
+The receiver fetches that exact origin with bounded responses and no redirects.
+
+B declares permitted capabilities:
+
+```json
+{"mcp":{"studios":{"inbound":{"concierge":{
+  "origin":"https://concierge.example",
+  "tools":["studio_availability","studio_book"]
+}}}}}
+```
+
+A delegates the outbound destination:
+
+```json
+{"mcp":{"studios":{"outbound":{"https://venue.example":{
+  "tools":["plan_drive"]
+}}}}}
+```
+
+B's owner opens **Office → AI connections** and clicks **Allow** for the
+configured calling origin. All start denied. Allow/Deny is stored in D1 and takes
+effect on every dispatch without redeploying, including existing tokens. Tool and
+event capability declarations remain in configuration. Audit entries show the
+calling origin and the asserted handle, not a misleading local account name.
+
+`/oauth/token` accepts `client_credentials` with RFC 7523 `private_key_jwt`,
+`scope=studio`, and the receiver's `/mcp` resource. The client ID, issuer and subject
+are the caller's canonical origin; audience is the exact receiver token endpoint.
+Assertions have short expiry, `kid`, and a one-use `jti` checked atomically in D1.
+The receiver accepts Ed25519/EdDSA keys. Five-minute opaque access tokens are hashed
+in D1. Browser OAuth continues using the existing provider.
+
+JWKS cache lifetime is five minutes. Failed fetches are cached for 60 seconds;
+unknown `kid` refreshes are limited to once per origin per 60 seconds, including
+concurrent requests. Token and studio-hook requests share a mandatory limit of
+60 requests per IP per minute before key discovery. Throttled requests return
+429 with `Retry-After: 60`. Authentication failures return the same generic 401;
+only the owner-visible audit log records the failed stage.
+
+### Manual key rotation
+
+Rotation is manual today. From the studio's `site/` directory (the directory with
+its deployed `wrangler.jsonc`), run the following with the deployed origin in
+`STUDIO_ORIGIN`. These commands fetch only public keys; the new private key stays
+in the Node process and Wrangler stdin. Do not enable shell tracing or print the
+bulk input. Use the same Wrangler environment/account as the existing deployment.
+
+```sh
+export STUDIO_ORIGIN=https://your-studio.example
+node --input-type=module <<'NODE' | npx wrangler secret bulk
+import {generateKeyPairSync, randomUUID} from 'node:crypto';
+const response = await fetch(new URL('/.well-known/jwks.json', process.env.STUDIO_ORIGIN), {redirect:'error'});
+if (!response.ok) throw new Error('Cannot read existing public keys; rotation aborted');
+const jwks = await response.json();
+if (!Array.isArray(jwks.keys) || !jwks.keys.length || jwks.keys.length > 7 ||
+    jwks.keys.some(k => !k || k.d || k.kty !== 'OKP' || k.crv !== 'Ed25519' || !k.x || !k.kid))
+  throw new Error('Invalid or too many retained public keys; rotation aborted');
+const previous = jwks.keys.map(({kty,crv,x,kid}) => ({kty,crv,x,kid,alg:'EdDSA',use:'sig'}));
+const {privateKey} = generateKeyPairSync('ed25519');
+const next = {...privateKey.export({format:'jwk'}), kid:randomUUID()};
+process.stdout.write(JSON.stringify({
+  STUDIO_PREVIOUS_PUBLIC_KEYS: JSON.stringify(previous),
+  STUDIO_SIGNING_KEY: JSON.stringify(next)
+}));
+NODE
+```
+
+1. Confirm Wrangler reports that **both** secrets were updated. If the command
+   fails, inspect the public JWKS and Wrangler deployment status before retrying.
+2. Check `curl --fail "$STUDIO_ORIGIN/.well-known/jwks.json"`: it must publish the
+   new `kid` and the previous public keys, with no `d` field. Peer caches may take
+   up to 60 seconds to refresh for the new `kid`; retry failed operations with
+   their original stable business/event IDs.
+3. Retain the old public keys for at least ten minutes after successful rotation.
+   Then, provided no other rotation is still in its overlap period, remove them:
+   `printf '%s' '[]' | npx wrangler secret put STUDIO_PREVIOUS_PUBLIC_KEYS`.
+4. Check the public JWKS again: only the new public key should remain. Existing
+   signing keys survive future normal deploys. Deny the origin immediately if a
+   key is compromised; rotation overlap is not emergency revocation.
+
+```ts
+ctx.caller.studio // {origin:'https://concierge.example', verified:true,
+                  //  method:'private_key_jwt'}
+ctx.caller.actingFor // {assertedHandle:'guest-42', verified:false,
+                     //  assertedBy:'https://concierge.example'}
+```
+
+Verified means the caller proved possession of a key published by that HTTPS
+origin. It does not verify any person. `assertedHandle` permits only
+`[A-Za-z0-9._@-]`, 1–128 characters. Never match it to a local account or grant
+roles from it. It only separates bookings within the calling studio. A studio can
+assert any handle within its own origin; all handles share origin-level rate
+limits. Studio callers use only allowlisted public tools, never signed-in roles.
+
+References: [RFC 7523](https://www.rfc-editor.org/rfc/rfc7523) and the
+[MCP client credentials extension](https://github.com/modelcontextprotocol/ext-auth/blob/main/specification/draft/oauth-client-credentials.mdx).
+
+## Availability convention (v)
+
+`studio_availability({app,collection,after?,quantity?,option?,resource?,addons?})`
+and `ctx.bookings.availability(...)` return:
+
+```json
+{"convention":"studio.booking-availability/1","bookingTool":"studio_book",
+ "items":[{"@type":"Offer","identifier":"[\"morning\",null]",
+   "availability":"https://schema.org/InStock","remaining":2,
+   "availabilityStarts":"2030-10-15T10:00:00Z",
+   "availabilityEnds":"2030-10-15T11:00:00Z",
+   "booking":{"app":"venue","collection":"bookings","slot":"morning","quantity":1}}],
+ "next":null}
+```
+
+The snapshot loads a page of slots, resource records and active allocations in three queries regardless of slot × option count (plus access-policy checks), and uses the same
+resource/option allocator as `studio_book`. It checks app visibility and slot-read
+grants. A page scans at most 50 slots and supports at most 64 alternatives per
+slot; `next` can be non-null even when no offers on this page are available.
+Only feasible options are returned. Add-ons and preferred resources can be checked
+as query inputs. No booking is taken during discovery. Holds still enforce capacity
+atomically; concurrent clients may see the same offer and only one may book.
+Expired holds continue occupying capacity until the existing expiry function
+releases them, matching the authoritative hold path.
+
+The existing `createBookingChoices({container,availability})` UI part accepts this
+same result and returns the selected offer's exact booking arguments from `value()`.
+Its existing explicit `options`/`resources` mode remains available. Share custom
+booking parts with an availability tool returning this convention and name their
+booking tool in `bookingTool`.
+
+[Schema.org Offer](https://schema.org/Offer) supplies `availability`, `identifier`
+and availability dates. A successful hold corresponds to a
+[Reservation](https://schema.org/Reservation): its `id` maps to `reservationId`,
+`state` to reservation status, and the chosen slot to `reservationFor`. The
+kit keeps its existing versioned hold response and payment lifecycle. Local
+`booking`, `remaining`, pagination and convention fields are explicit extensions;
+this is not a claim that schema.org defines a booking API.
+
+The [Agentic Commerce Protocol](https://github.com/agentic-commerce-protocol/agentic-commerce-protocol)
+standardizes commerce/checkout interactions. Its separation of available offers
+from authoritative checkout is compatible with this convention, but it does not
+supply this toolkit's time-slot and multi-resource allocation schema. Availability
+does not invent checkout, represent a payment approval, or claim ACP conformance.
+
+## Signed arrival events (o)
+
+Use Standard Webhooks asymmetric `v1a` Ed25519 signatures with the same studio key and the envelope `{eventId,name,timestamp,source,data}`. On A's outbound destination, add:
+
+```json
+{"eventPath":"/hooks/studios/concierge","events":["arrival"]}
+```
+
+On B's inbound `concierge` entry, add
+`"events":{"arrival":"arrivals"}`. No shared event secret is needed. B's `mcp.events.arrivals` declares `event:"guest.arriving"`, an audience,
+and a schema for `{sender:{origin,verified:true},data:{booking,minutes}}`.
+Only mapped names can publish to local feeds. Define a function with
+`event:'guest.arriving'` to consume `event.data.data` and its verified
+`event.data.sender`. The sender cannot select an arbitrary local event type.
+
+```ts
+await ctx.studios.send('https://venue.example', 'arrival', {
+  id: stableArrivalId, data: {booking: bookingId, minutes: 10}
+});
+```
+
+The JavaScript `standardwebhooks` package currently supports HMAC `v1` only, so
+studio `v1a` uses Web Crypto directly, with fixed cryptographic and spec-framing
+regression vectors. The receiver verifies Standard Webhooks `id.timestamp.body` signatures with Web Crypto Ed25519, including a five-minute timestamp window. Both studio event envelopes and business-feed data are limited to **8,192 UTF-8 bytes**; oversized events return a clear 413 error. `webhook-key-id` selects the origin JWKS key; `webhook-origin` must match the configured sender and signed body. IDs are 1–128 letters,
+digits, underscores or hyphens. A receipt is committed atomically with the event
+using existing business-event publication. Identical retries return 204 without
+running the function again; a signed changed payload under the same ID returns
+409. Receipts survive event pruning. Function execution remains at least once:
+handlers must deduplicate external effects by event ID. If acceptance fails, the
+sender gets an error and can retry the same ID. Calls to `send` do not create an
+outbound retry queue; call from an existing durable function for automatic retries.
+The existing configured-feed/MCP Events subscription dispatcher remains available
+for subscription delivery. No new event bus or MCP method is introduced.
+
+## Friend routes and rate limits (p, q)
+
+`await ctx.fetchSelf('/api/friend-action', {method:'POST', body:...})` invokes the
+studio's registered `useRoutes` handler in-process. It carries the caller through
+the existing internal identity mechanism. `isOwner`, `hasRole`, and the studio's
+player lookup still perform their normal checks. Explicit cookies/Authorization
+headers, URL credentials and other origins are refused. A missing custom route
+returns 404. `fetchSelf` sets `Origin` to the local studio origin, so a custom route’s same-origin/CSRF check will pass; that check is not authorization. Routes must still check the propagated identity and roles. It does not borrow `fetchWithSecret` or mint an owner credential.
+
+`await ctx.rateLimit('friends')` uses a declared Cloudflare Rate Limiting binding,
+sharing the same namespace and account key between delegated tools:
+
+```json
+{"mcp":{"rateLimits":{"friends":{"binding":"FRIEND_RATE","tools":["join","reserve"]}}}}
+```
+
+In wrangler.jsonc, configure `ratelimits` with a stable `namespace_id`, name
+`FRIEND_RATE` and `simple:{limit:30,period:60}`. The helper returns `{success}`;
+the tool chooses its refusal response. No policy is enabled by default. Signed-in
+callers default to their identity key; studio callers default to `studio:<origin>` regardless of asserted handle. Public MCP callers expose `ctx.caller.clientAddressKey` and use that address-based key by default. Do not let customers select keys to bypass your policy.
+[Cloudflare's binding](https://developers.cloudflare.com/workers/runtime-apis/bindings/rate-limit/)
+is an approximate per-location limiter, not a globally strict quota or booking
+capacity mechanism. Existing authoritative booking/database checks remain necessary.
+

package/functions/FUNCTIONS.md

@@ -424,3 +424,12 @@ or declared webhook; functions never send email/SMS themselves.
 Apply `0028_business_events.sql` on upgrade. Local proof publications carry their
 scope and do not appear in production feed reads. Event feeds retain their declared
 type; give different business feeds distinct types when their content differs.
+
+## Events from another studio
+
+An explicitly allowed studio can send a Standard Webhooks arrival event to
+`/hooks/studios/<connection>`. The receiver maps allowed names to declared business
+feeds and commits their existing durable receipt before acknowledging. Functions
+receive the verified sender origin separately from the sender's untrusted data.
+Use `context.studios.send` inside a durable function when sending needs retries.
+See [studio-to-studio](../docs/studio-to-studio.md) for setup and replay semantics.

package/lib/cloudflare.mjs

@@ -1,3 +1,4 @@
+import {ensureStudioSigningKey} from './studios-keys.mjs';
 import {redactText} from './redact.mjs';
 import {enableReadReplication} from './read-replication.mjs';
 import {ensureBackgroundQueues,backgroundQueues} from './background-queue.mjs';
@@ -440,6 +441,7 @@ async function deployLocked(root, { log = () => {}, homie, fetchFn = null, ownRo
     dep = w(['deploy', ...(workerEntry(root) ? [workerEntry(root)] : []), ...repoVar(root)]);
   }
   if (dep.code !== 0) return refuse(`wrangler deploy failed: ${wranglerDeployError(dep.out)}`, dep.out);
+  try{await ensureStudioSigningKey(readStudio(root),w);}catch(error){return refuse(error.message);}
   if (paidReleases(root).length) {
     const bin = wranglerBin(root);
     const uploadOptions = { cwd: workerDir(root), env: { ...process.env, CLOUDFLARE_ACCOUNT_ID: accountId, WRANGLER_SEND_METRICS: 'false', CI: '1' } };
@@ -664,6 +666,7 @@ export async function ciDeploy(root, { log = () => {}, wrangler = null } = {}) {
   const started = Date.now();
   const dep = w(['deploy', ...(workerEntry(root) ? [workerEntry(root)] : []), ...repoVar(root)]);
   if (dep.code !== 0) return refuse(`wrangler deploy failed: ${wranglerDeployError(dep.out)}`, dep.out);
+  try{await ensureStudioSigningKey(readStudio(root),w);}catch(error){return refuse(error.message);}
   step(`deployed ${names.worker ?? 'the Worker'} in ${Math.round((Date.now() - started) / 1000)} s`);
   const repo = repoOf(root);
   step(repo ? `the live site knows its GitHub repository (${repo}), for the Claude app's hand-off` : 'no GitHub repository found here (no HOMIE_REPO, studio.json "github" or git remote): the Claude app\'s card asks the person which it is');

package/lib/needs-headless.mjs

@@ -26,7 +26,7 @@ export function needsHeadless({url,secret,app,meta,scope,sessionFor}) {
       if(!call?.tool)throw new Error('MCP step requires tool and optional arguments');
       const result=await client.callTool({name:call.tool,arguments:call.arguments??{}},undefined,{timeout:item.schedule?15000:10000});
       if(result.isError)throw new Error(result.content?.filter(c=>c.type==='text').map(c=>c.text).join('; ')||'MCP tool failed');
-      if(result.structuredContent!==undefined)return result.structuredContent;
+      if(result.structuredContent!==undefined){const value=result.structuredContent;return value?.kind==='untrusted-tool-data'?value.data:value;}
       const content=result.content?.filter(c=>c.type==='text');
       if(content?.length===1) {try {const parsed=JSON.parse(content[0].text);return parsed.kind==='untrusted-tool-data'?parsed.data:parsed;}catch{}}
       return result;

package/lib/studios-keys.mjs

@@ -0,0 +1,13 @@
+import {generateKeyPairSync,randomUUID} from 'node:crypto';
+/** Key material travels only in memory and Wrangler stdin. Never return it or include command output in errors. */
+export async function ensureStudioSigningKey(studio,w){
+ if(!studio.mcp?.studios)return;
+ const result=await w(['secret','list']);
+ if(result.code!==0)throw new Error('Cannot inspect studio signing key bindings');
+ let names;try{names=JSON.parse(result.stdout??result.out);}catch{throw new Error('Cannot inspect studio signing key bindings');}
+ if(names.some(entry=>entry.name==='STUDIO_SIGNING_KEY'))return;
+ const {privateKey}=generateKeyPairSync('ed25519');
+ const key={...privateKey.export({format:'jwk'}),kid:randomUUID()};
+ const saved=await w(['secret','bulk'],{input:JSON.stringify({STUDIO_SIGNING_KEY:JSON.stringify(key)})});
+ if(saved.code!==0)throw new Error('Cannot provision studio signing key');
+}

package/lib/template-history.json

@@ -4092,6 +4092,48 @@
      }
     }
    }
+  },
+  "0.57.0": {
+   "files": {
+    "CLAUDE.md": "ddf2b2a0376202f6",
+    "README.md": "684b3cca8001673c",
+    "HANDOFF.md": "29337e2ace95b2e7",
+    "games/README.md": "5ad32fe80c61f117",
+    "music/README.md": "a3dc042dadd39df8",
+    "videos/README.md": "16babc3437d5545b",
+    "posts/README.md": "37841aae476bd540",
+    "site/README.md": "1dbdf22c03a1e505",
+    "site/src/worker.mjs": "6cc5c6131eaf6fd0"
+   },
+   "sections": {
+    "AGENTS.md": {
+     "(intro)": "af7f2f732505d379",
+     "## Version-matched authoring guides": "f6261a0e5801b96b",
+     "## Layout": "f3a280b8c96cd068",
+     "## Apps: one screen, roles and parts": "c10aa0441ea89702",
+     "## Commands (all through the pinned CLI in node_modules)": "c20d90de21cde0c7",
+     "## The site": "0cb8dd9a6f8a0096",
+     "## Making games": "bb715272fd1a615b",
+     "## The Game Codex and progress": "0738ef719cef3a4c",
+     "## Art direction and models": "a48fff7bf0a5f2fc",
+     "## Running live games (the back office)": "51ebf2ab756f6e4d",
+     "## Servers and AI seats": "1ccfd549d2369a60",
+     "## Selling things (the shop)": "0df5a5fe1833c624",
+     "## Continuing a build from the Claude app": "0d68081e924ca419",
+     "## Rules": "b2234d80f6cbe71d",
+     "## Telling Homie": "80b46fdd9e578db8",
+     "## Beta": "9d02638207a26e73"
+    }
+   },
+   "named": {
+    "Homie Arcade": {
+     "sections": {
+      "AGENTS.md": {
+       "## Commands (all through the pinned CLI in node_modules)": "8364e05cebefcba4"
+      }
+     }
+    }
+   }
   }
  }
 }

package/netplay/NETPLAY.md

@@ -290,6 +290,13 @@ at once, with bots filling the slots (Gem Rush: 1 human + 2 bots).
 - A human who leaves turns back into a bot in the same body.
 - `trim()` removes surplus bots between rounds.
 - After every change the host calls `net.roster(slots)`.
+- A browser host may receive `join` before its world is ready. Once it publishes a roster,
+  snapshot traffic makes the relay retry any connected replica seat missing from that roster,
+  with delays doubling from 1 second to a 30-second cap, for at most eight retries per peer
+  and host. A roster seat (including `agent.seat` for host-driven AI) acknowledges the claim.
+  If still unacknowledged after the final wait, the relay logs once and stops retrying. Treat a repeated `join` for an
+  already claimed seat as idempotent; keep its body and score. This uses the existing wire
+  message, including for older bundled clients. Rules hosts reconcile seats separately.
 
 **Join in progress.**
 1. The `welcome` carries the last snapshot, round, roster and **all keyed state**. The

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homie-rocks/studio",
-  "version": "0.56.0",
+  "version": "0.57.0",
   "description": "A studio for games, music and video on its own Cloudflare: scaffold, multiplayer starters on the netplay contract, a port toolkit that makes existing single-player web games multiplayer, the site Worker with public rooms (Table/Lobby Durable Objects and D1, all on the free Workers plan, no payment method), a site with the hub's sections (Home, Games, Music, Videos, Rooms, Posts with feeds) in the studio's own look, an epic landing page for every game, big songs and videos in the studio's own R2 once it has storage (uploaded, checked by SHA-256, served at the same addresses), deploy, and the homie.rocks directory.",
   "type": "module",
   "license": "Apache-2.0",

package/tools/TOOLS.md

@@ -193,3 +193,19 @@ Use `/mcp/auth` for owner and staff connectors. Its anonymous 401 includes the
 Both transports use the same `/mcp` OAuth resource; `/mcp` remains public without a
 token. An approved connection retains the account’s current app grants, not a copy
 of its old permissions. Manage connections at `/_studio/office/connections`.
+
+## Acting at another studio
+
+Use `context.studios.listTools`, `call` and `send` for another studio. The official
+MCP SDK handles transport and OAuth. Configure receiver-owned studio allowlists;
+a named person's handle is an assertion, not the receiver's authenticated account.
+Discover `studio_availability` before `studio_book`. For your own registered routes,
+use `fetchSelf` to preserve the caller. Opt-in `rateLimit` shares a declared
+Cloudflare binding between tools. See [studio-to-studio](../docs/studio-to-studio.md)
+for configuration, trust boundaries, signed events and examples.
+
+Studio callers use origin-hosted JWKS and private-key JWT; office Allow/Deny is
+stored in D1. Pass `{assertedHandle:'guest-42'}`; never match this assertion to a
+local account. Results and descriptions carry `{source,untrusted:true}`. Wrap them
+as untrusted input before AI use. Anonymous MCP callers expose `clientAddressKey`,
+which is their default rate-limit key; studio callers share `studio:<origin>`.

package/tools/tools.ts

@@ -1,12 +1,21 @@
+import type {BookingAvailability} from '../apps/apps';
 /** A studio tool runs as trusted code in its own Worker. Never import an environment binding. */
 export type Audience = 'public' | 'signed-in' | 'owner' | { app: string; role: string };
+export interface RemoteStudioSource { readonly origin: string; readonly authenticated: boolean }
+export interface UntrustedStudioData { readonly source: RemoteStudioSource; readonly untrusted: true }
 export interface ToolContext {
   readonly purchase?: { readonly id: string };
-  readonly caller: { readonly id: string | null; readonly owner: boolean; readonly client: string | null; readonly roles: Readonly<Record<string, readonly string[]>> };
+  readonly caller: { readonly clientAddressKey?: string; readonly id: string | null; readonly owner: boolean; readonly client: string | null; readonly studio?: {readonly origin: string; readonly verified: true; readonly method: 'private_key_jwt'}; readonly actingFor?: {readonly assertedHandle: string; readonly verified: false; readonly assertedBy: string}; readonly roles: Readonly<Record<string, readonly string[]>> };
   records(args: { app: string; role?: string; collection: string; id?: string; operation?: 'read' | 'create' | 'update' | 'delete'; data?: Record<string, unknown>; version?: number }): Promise<unknown>;
   office(path: string, body?: Record<string, unknown>, query?: Record<string, string>): Promise<unknown>;
   shop(): Promise<unknown>;
+  studios: {
+    send(origin: string, event: string, input: {id: string; data: unknown}): Promise<{id: string}>;
+    listTools(origin: string, options?: {cursor?: string; assertedHandle?: string}): Promise<UntrustedStudioData & {tools: Array<UntrustedStudioData & {name: string; description?: string; inputSchema: Record<string, unknown>}>; nextCursor?: string}>;
+    call(origin: string, tool: string, args?: Record<string, unknown>, options?: {assertedHandle?: string}): Promise<UntrustedStudioData & {isError: boolean; data?: unknown; content: unknown[]}>;
+  };
   bookings: {
+    availability(args: {app: string; collection: string; after?: string; quantity?: number; option?: string; resource?: string; addons?: Record<string,number>}): Promise<BookingAvailability>;
     calendar(args: {app:string;startDate:string;endDate:string;timeZone?:string;time?:string;days?:number;durationMinutes?:number;capacity?:number;weekdays?:number[];resources?:string[];options?:unknown[];prefix?:string}): Array<{id:string;start:string;end:string;capacity:number;date:string;timeZone:string}>;
     hold(args: {app: string; collection: string; slot?: string; time?: string; option?: string; resource?: string; preferredResource?: string; addons?: string[] | Record<string,number>; addOns?: string[] | Record<string,number>; quantity?: number; id: string; token?: string; expiresAt: number}): Promise<BookingHold>;
     get(args: {id: string; token?: string}): Promise<BookingHold>;
@@ -24,6 +33,10 @@ export interface ToolContext {
     append(key: string, value: unknown): Promise<{value: unknown[]; version: number}>;
     list(options?: {prefix?: string; after?: string; limit?: number}): Promise<{items: {key: string; value: unknown; version: number}[]; next: string | null}>;
   };
+  /** Dispatch a custom route with caller identity and local Origin; routes must still authorize. */
+  fetchSelf(path: string, init?: RequestInit): Promise<Response>;
+  /** Opt-in shared Cloudflare Rate Limiting binding. Defaults to studio origin, signed-in identity, or anonymous MCP clientAddressKey. */
+  rateLimit(name: string, key?: string): Promise<{success: boolean}>;
   fetch: typeof fetch;
   fetchWithSecret(name: string, url: string, init?: RequestInit): Promise<Response>;
   ai(model: string, input: unknown): Promise<unknown>;

package/worker/booking-availability.mjs

@@ -0,0 +1,35 @@
+import {allocateResources,resourceSnapshot} from './booking-resources.mjs';
+import {settingsOf,launchOf} from './office.mjs';
+import {allowed} from './mcp-tools.mjs';
+const fail=message=>Object.assign(new Error(message),{name:'StudioOperationError'});
+/** A snapshot, never a reservation. Atomic holds recheck capacity at write time. */
+export async function bookingAvailability(env,cat,caller,{app,collection,after='',quantity=1,option,resource,addons}={}) {
+ const meta=cat.games.find(g=>g.id===app&&g.kind==='app'),spec=meta?.records?.collections?.[collection]?.booking;
+ if(!spec||typeof after!=='string'||after.length>64||!Number.isSafeInteger(quantity)||quantity<1)throw fail('Booking availability unavailable');
+ if(!caller.owner){
+  if(launchOf(meta,await settingsOf(env,{fresh:true}),env)!=='public')throw fail('Booking availability unavailable');
+  let readable=false;
+  for(const [role,rule] of Object.entries(meta.roles??{}))if(rule.can?.includes('read:'+spec.slots)&&(!rule.signIn||await allowed({app,role},caller,env)))readable=true;
+  if(!readable)throw fail('Booking availability unavailable');
+ }
+ const scope=caller.testScope?`${app}:check:${caller.testScope}`:app;
+ const rows=(await env.DB.prepare(`SELECT s.id,s.value,COALESCE((SELECT SUM(b.quantity) FROM shop_bookings b WHERE b.app=s.app AND b.slots=s.collection AND b.slot=s.id AND b.state IN ('held','confirmed')),0) used FROM app_records s WHERE s.app=?1 AND s.collection=?2 AND s.id>?3 ORDER BY s.id LIMIT 51`).bind(scope,spec.slots,after).all()).results;
+ const snapshot=await resourceSnapshot(env,scope,spec);
+ const items=[];
+ for(const row of rows.slice(0,50)){
+  const slot=JSON.parse(row.value),remaining=slot.capacity-row.used;
+  if(!Number.isSafeInteger(remaining)||remaining<quantity)continue;
+  const choices=option!==undefined?[option]:[...(!slot.requireOption?[undefined]:[]),...(slot.options??[]).map(o=>o.id)];
+  if(choices.length>64)throw fail('Availability supports at most 64 options per slot');
+  for(const choice of choices){
+   const booking={app,collection,slot:row.id,quantity,...(choice===undefined?{}:{option:choice}),...(resource?{resource}:{}),...(addons?{addons}:{})};
+   try{allocateResources(slot,spec,booking,snapshot);}catch(error){
+    if(/Slot unavailable|Choose a declared option|Choose an option|Unknown add-on|no declared resources|Preferred resource|Resource capacity unavailable|No resource matches/.test(error.message))continue;
+    throw error;
+   }
+   const selected=slot.options?.find(o=>o.id===choice);
+   items.push({'@type':'Offer',identifier:JSON.stringify([row.id,choice??null]),...(selected?.name?{name:selected.name}:{}),availability:'https://schema.org/InStock',...(slot.start?{availabilityStarts:slot.start}:{}),...(slot.end?{availabilityEnds:slot.end}:{}),remaining,booking});
+  }
+ }
+ return {convention:'studio.booking-availability/1',bookingTool:'studio_book',items,next:rows.length>50?rows[49].id:null};
+}

package/worker/booking-holds.mjs

@@ -1,5 +1,5 @@
 import {calendarSlots} from './booking-calendar.mjs';
-import {allocateResources} from './booking-resources.mjs';
+import {loadAndAllocateResources} from './booking-resources.mjs';
 import {normalizeBookingArgs} from './booking-options.mjs';
 import {BOOKINGS_MIGRATION} from './booking-store.mjs';
 import {linkConfig,hasStripeKey} from './shop-links.mjs';
@@ -74,7 +74,7 @@ export function bookingHolds(env,caller,cat){
      if(previous.app!==scope||previous.collection!==collection||previous.slot!==slot||previous.quantity!==quantity||JSON.stringify({...choices,...JSON.parse(previous.choices??'{}')})!==JSON.stringify(choices))throw refusal('Booking id reused with different request',409);
      return result(previous);
    }
-   let allocation;try{allocation=await allocateResources(env,scope,spec,slot,args);}catch(error){throw refusal(error.message,409);}
+   let allocation;try{allocation=await loadAndAllocateResources(env,scope,spec,slot,args);}catch(error){throw refusal(error.message,409);}
    const secret=token?await hash(token):null;
    try {await env.DB.prepare(`INSERT INTO shop_bookings(id,app,collection,slots,slot,quantity,order_id,state,updated_at,actor,token_hash,hold_until,allocation,choices)
     SELECT ?1,?2,?3,?4,?5,?6,'hold:'||?1,'held',?7,?8,?9,?10,?11,?12 WHERE NOT EXISTS(SELECT 1 FROM shop_bookings WHERE id=?1)`).bind(id,scope,collection,spec.slots,slot,quantity,Date.now(),caller.id??null,secret,expiresAt,JSON.stringify(allocation),JSON.stringify(choices)).run();}catch(error){if(/booking capacity unavailable|resource capacity unavailable/.test(error.message))throw refusal('That slot or resource capacity is unavailable. No place has been taken.',409);throw error;}

package/worker/booking-resources.mjs

@@ -14,10 +14,20 @@ CREATE TRIGGER booking_resource_move BEFORE UPDATE OF slot,quantity ON shop_book
 CREATE TRIGGER booking_resource_edit BEFORE UPDATE OF value ON app_records WHEN EXISTS(SELECT 1 FROM shop_bookings b,json_each(b.allocation) a WHERE b.app=OLD.app AND b.state IN ('held','confirmed') AND json_extract(a.value,'$.resource')=OLD.id AND json_extract(a.value,'$.collection')=OLD.collection) AND NEW.value!=OLD.value BEGIN SELECT RAISE(ABORT,'resource has active bookings; release or finish them before editing'); END;
 CREATE TRIGGER booking_resource_delete BEFORE DELETE ON app_records WHEN EXISTS(SELECT 1 FROM shop_bookings b,json_each(b.allocation) a WHERE b.app=OLD.app AND b.state IN ('held','confirmed') AND json_extract(a.value,'$.resource')=OLD.id AND json_extract(a.value,'$.collection')=OLD.collection) BEGIN SELECT RAISE(ABORT,'resource has active bookings'); END;
 `;
-export async function allocateResources(env,app,spec,slot,args) {
+export async function resourceSnapshot(env,app,spec) {
+ if(!spec.resources)return {resources:new Map(),active:[]};
+ const resources=(await env.DB.prepare('SELECT id,value FROM app_records WHERE app=?1 AND collection=?2').bind(app,spec.resources).all()).results;
+ const active=(await env.DB.prepare("SELECT allocation FROM shop_bookings WHERE app=?1 AND state IN ('held','confirmed')").bind(app).all()).results.flatMap(r=>JSON.parse(r.allocation));
+ return {resources:new Map(resources.map(r=>[r.id,JSON.parse(r.value)])),active};
+}
+export async function loadAndAllocateResources(env,app,spec,slot,args) {
  const row=await env.DB.prepare('SELECT value FROM app_records WHERE app=?1 AND collection=?2 AND id=?3').bind(app,spec.slots,slot).first();
- if(!row)throw new Error('Slot unavailable');
- const data=JSON.parse(row.value),option=args.option===undefined?null:data.options?.find(o=>o.id===args.option);
+ return allocateResources(row?JSON.parse(row.value):null,spec,args,await resourceSnapshot(env,app,spec));
+}
+/** Pure allocation against a page snapshot. Holds still enforce capacity atomically in D1. */
+export function allocateResources(data,spec,args,{resources,active}) {
+ if(!data)throw new Error('Slot unavailable');
+ const option=args.option===undefined?null:data.options?.find(o=>o.id===args.option);
  if(args.option!==undefined&&!option)throw new Error('Choose a declared option');
  if(data.requireOption&&!option)throw new Error('Choose an option');
  const parts=option?.components??(data.resources?[{resources:data.resources,skills:data.skills,attributes:data.attributes}]:[]);
@@ -31,7 +41,6 @@ export async function allocateResources(env,app,spec,slot,args) {
  const start=Date.parse(data.start),end=Date.parse(data.end);
  if(!Number.isFinite(start)||!Number.isFinite(end)||end<=start)throw new Error('Resource slot needs start and end timestamps');
  if(components.length>32)throw new Error('A package supports at most 32 resource components');
- const active=(await env.DB.prepare("SELECT allocation FROM shop_bookings WHERE app=?1 AND state IN ('held','confirmed')").bind(app).all()).results.flatMap(r=>JSON.parse(r.allocation));
  const allocations=[];
  for(const [index,c] of components.entries()) {
   if(!Array.isArray(c.resources)||!c.resources.length||c.resources.length>64)throw new Error('Declare candidate resources');
@@ -41,8 +50,7 @@ export async function allocateResources(env,app,spec,slot,args) {
   if(!Number.isSafeInteger(from)||!Number.isSafeInteger(to)||from<start||to>end||to<=from||!Number.isSafeInteger(units)||units<1)throw new Error('Invalid package resource interval or units');
   let selected,qualified=false;
   for(const resource of candidates) {
-   const record=await env.DB.prepare('SELECT value FROM app_records WHERE app=?1 AND collection=?2 AND id=?3').bind(app,spec.resources,resource).first();
-   if(!record)continue;const r=JSON.parse(record.value);
+   const r=resources.get(resource);if(!r)continue;
    if(!Number.isSafeInteger(r.capacity)||r.capacity<1||(c.skills??[]).some(skill=>!r.skills?.includes(skill))||Object.entries(c.attributes??{}).some(([k,v])=>r.attributes?.[k]!==v))continue;
    qualified=true;const overlapping=[...active,...allocations].filter(a=>a.resource===resource&&a.collection===spec.resources&&a.start<to&&a.end>from);
    if([from,...overlapping.map(a=>a.start).filter(t=>t>=from)].some(at=>units+overlapping.filter(a=>a.start<=at&&a.end>at).reduce((n,a)=>n+a.units,0)>r.capacity))continue;

package/worker/build-id.mjs

@@ -1,2 +1,2 @@
 // Generated by lib/build-identity.mjs; identifies the bundled runtime sources.
-export const STUDIO_BUILD = Object.freeze({"version":"0.56.0","sha256":"9b000afecb22ce5781d6499a02f44ffcc255c61907e9f7d469dd63d0bd9f35d1"});
+export const STUDIO_BUILD = Object.freeze({"version":"0.57.0","sha256":"0a84d357448b7257ee97cac637957a6fe5bb46323de76625644d88e80a684a87"});

package/worker/business-events.mjs

@@ -1,4 +1,5 @@
 import {canonicalJson} from './canonical-json.mjs';
+export const BUSINESS_EVENT_MAX_BYTES=8192;
 export const BUSINESS_EVENTS_MIGRATION_FILE='0028_business_events.sql';
 export const BUSINESS_EVENTS_MIGRATION=`
 ALTER TABLE studio_events ADD COLUMN scope TEXT;
@@ -19,7 +20,7 @@ export async function publishBusinessEvent(env,caller,definition,namespace,{feed
  if(typeof id!=='string'||!id.length||id.length>128)throw new Error('Event id must contain 1–128 characters');
  const {CfWorkerJsonSchemaValidator}=await import('@modelcontextprotocol/server/validators/cf-worker');
  if(!new CfWorkerJsonSchemaValidator().getValidator(declaration.schema)(data).valid)throw new Error('Event data does not match feed schema');
- const text=canonicalJson(data);if(text.length>8192)throw new Error('Event exceeds 8192 characters');
+ const text=canonicalJson(data);if(new TextEncoder().encode(text).length>BUSINESS_EVENT_MAX_BYTES)throw new Error('Event exceeds 8192 bytes');
  const key=JSON.stringify([namespace,feed,id]),digest=Array.from(new Uint8Array(await crypto.subtle.digest('SHA-256',new TextEncoder().encode(declaration.event+'\n'+text))),b=>b.toString(16).padStart(2,'0')).join('');
  await env.DB.batch([
   env.DB.prepare('INSERT OR IGNORE INTO studio_events(id,type,data,at,scope) SELECT ?1,?2,?3,?4,?5 WHERE NOT EXISTS (SELECT 1 FROM event_publications WHERE id=?1)').bind(key,declaration.event,text,Date.now(),caller.testScope??null),

package/worker/mcp-store.mjs

@@ -42,7 +42,7 @@ export async function rateLimit(env, caller, limit = null) {
   return row.n <= limit;
 }
 export async function audit(env, caller, tool, outcome) {
-  await env.DB.prepare('INSERT INTO mcp_audit(person,client,tool,at,outcome) VALUES(?1,?2,?3,?4,?5)').bind(caller.id ?? null,caller.client ?? null,tool,Date.now(),outcome).run();
+  await env.DB.prepare('INSERT INTO mcp_audit(person,client,tool,at,outcome) VALUES(?1,?2,?3,?4,?5)').bind(caller.studio?(caller.actingFor?.assertedHandle??null):caller.id ?? null,caller.studio?.origin??caller.client ?? null,tool,Date.now(),outcome).run();
   // Bounded storage, and no cleanup timer or writes on ordinary page traffic.
   await env.DB.batch([
     env.DB.prepare('DELETE FROM mcp_audit WHERE id <= (SELECT MAX(id)-10000 FROM mcp_audit)'),
@@ -55,3 +55,5 @@ export function callsPerMinute(cat) {
   const value=cat.studio?.mcp?.callsPerMinute;
   return Number.isSafeInteger(value)&&value>0?value:null;
 }
+
+export const callerLimitKey=caller=>caller.studio?'studio:'+caller.studio.origin:caller.id??caller.clientAddressKey;

package/worker/mcp-tools.mjs

@@ -1,3 +1,6 @@
+import {callerLimitKey} from './mcp-store.mjs';
+import {bookingAvailability} from './booking-availability.mjs';
+import {studiosClient} from './studios-client.mjs';
 import {bookingInputSchema,normalizeBookingArgs} from './booking-options.mjs';
 import {bookingHolds} from './booking-holds.mjs';
 import {toolDatabase} from './tool-database.mjs';
@@ -12,7 +15,7 @@ export const object = (properties = {}, required = []) => ({type:'object',proper
 const str = {type:'string',maxLength:128};
 export async function allowed(audience, caller, env) {
   if (audience === 'public') return true;
-  if (!caller.id) return false;
+  if (!caller.id || caller.studio) return false;
   if (audience === 'signed-in') return true;
   if (audience === 'studio-staff') return caller.owner === true || Boolean(await env.DB.prepare("SELECT player FROM app_roles WHERE app='*' AND role='staff' AND player=?1").bind(caller.id).first());
   if (audience === 'owner') return caller.owner === true;
@@ -70,12 +73,31 @@ export function services(env, cat, origin, caller, namespace, definition = {}) {
   const key = v=>{if(typeof v!=='string'||v.length>128||!v.length)throw new Error('invalid key');return v;};
   return Object.freeze({
     caller:Object.freeze({...caller,roles:Object.freeze(Object.fromEntries(Object.entries(caller.roles??{}).map(([app,roles])=>[app,Object.freeze([...roles])])) )}), records, office,
-    bookings:bookingHolds(env,caller,cat),
+    studios:studiosClient(env,cat,definition,{origin}),
+    bookings:Object.freeze({...bookingHolds(env,caller,cat),availability:args=>bookingAvailability(env,cat,caller,args)}),
     events:Object.freeze({publish:args=>import('./business-events.mjs').then(m=>m.publishBusinessEvent(env,caller,definition,namespace,args))}),
     rooms:Object.freeze({send:args=>import('./tool-events.mjs').then(m=>m.sendToolEvent(env,caller,definition,args))}),
     shop:()=>office('/_studio/api/shop'),
     database:toolDatabase(env.DB,namespace),
     fetch:globalThis.fetch.bind(globalThis),
+    async fetchSelf(path,init={}) {
+      const url=new URL(path,origin);
+      if(url.origin!==new URL(origin).origin || url.username || url.password)throw new Error('Same origin required');
+      const headers=new Headers(init.headers);
+      if(headers.has('authorization')||headers.has('cookie'))throw new Error('Explicit credentials refused');
+      headers.set('origin',new URL(origin).origin);
+      const request=withToolIdentity(new Request(url,{...init,headers,redirect:'error'}),caller);
+      const pending=[];
+      const response=await (await import('./custom-routes.mjs')).customRoute(request,env,{waitUntil:promise=>pending.push(promise)});
+      await Promise.all(pending);
+      return response??new Response('Not found',{status:404});
+    },
+    async rateLimit(name,key=callerLimitKey(caller)) {
+      const rule=cat.studio?.mcp?.rateLimits?.[name];
+      if(!rule?.tools?.includes(definition.name)||!env[rule.binding]?.limit)throw new Error('Rate limit not declared for this tool');
+      if(typeof key!=='string'||!key.length||key.length>256)throw new Error('Rate limit key required (1–256 characters)');
+      return env[rule.binding].limit({key:JSON.stringify([name,key])});
+    },
     // A named secret may authenticate an HTTPS request; its value is never returned.
     async fetchWithSecret(name,url,init={}) {
       const rule=cat.studio?.mcp?.secrets?.[name];
@@ -178,6 +200,7 @@ export function builtins(env,cat,origin) {
       const collections=new Set(Object.values(roles).flatMap(r=>r.can.map(cap=>cap.split(':')[1])));
       return {app,roles,collections:Object.fromEntries(Object.entries(meta.records?.collections??{}).filter(([name])=>collections.has(name)))};
     }),
+    tool('studio_availability','List available booking slots and options before studio_book. Returns schema.org Offers with exact booking arguments; availability is a snapshot, and booking rechecks capacity.','public',object({app:str,collection:str,after:str,quantity:{type:'integer',minimum:1},option:str,resource:str,addons:{type:'object',additionalProperties:{type:'integer',minimum:1,maximum:100}}},['app','collection']),async(args,ctx)=>ctx.bookings.availability(args)),
     tool('studio_book','Reserve a declared booking slot. Accepts slot/time, resource/preferredResource, and addons/addOns as an array or quantity object. Supply a stable id, future expiresAt and a private token for an anonymous booking. Payment is separate.','public',bookingInputSchema,async(input,ctx)=>{
       const args=normalizeBookingArgs(input),meta=cat.games.find(g=>g.id===args.app&&g.kind==='app'),spec=meta?.records?.collections?.[args.collection]?.booking;
       if(!spec)throw Object.assign(new Error('Unknown booking collection'),{name:'StudioOperationError'});

package/worker/mcp.mjs

@@ -1,3 +1,5 @@
+import {studioOrigin} from './studios-client.mjs';
+import {studioToken,studioCaller,setStudioPolicy,studioRegistration} from './studios-auth.mjs';
 import {tokenCaller,toolInScope} from './connector-token.mjs';
 import {eventMethods,eventsCapability} from './mcp-events-wire.mjs';
 import {eventsRequest} from './mcp-events.mjs';
@@ -17,7 +19,7 @@ import { players } from './players.mjs';
 import { isOwner, sameOrigin } from './office.mjs';
 import { cookieValue } from './stats.mjs';
 import { esc } from './site.mjs';
-import { oauthStorage, rateLimit, audit, callsPerMinute } from './mcp-store.mjs';
+import { oauthStorage, rateLimit, audit, callsPerMinute, callerLimitKey } from './mcp-store.mjs';
 import { allowed, currentCaller, services, builtins } from './mcp-tools.mjs';
 const validator = new CfWorkerJsonSchemaValidator();
 const json = (data,status=200)=>Response.json(data,{status,headers:{'cache-control':'no-store'}});
@@ -36,14 +38,28 @@ export async function remoteMcp(request,env,ctx,{catalogueOf,definitions=[]}) {
   const url=new URL(request.url), origin=url.origin, path=url.pathname;
   if(!env.DB)return json({error:'studio database required'},503);
   if(request.headers.has('origin') && request.headers.get('origin')!==origin)return json({error:'origin refused'},403);
+  if(path==='/.well-known/jwks.json')return Response.json((await import('./studios-keys.mjs')).publicKeys(env),{headers:{'cache-control':'public, max-age=60'}});
+  if(path==='/oauth/token'||path.startsWith('/hooks/studios/')) {
+    if(!await rateLimit(env,'studio-ingress:'+(request.headers.get('cf-connecting-ip')??'local'),60))
+      return Response.json({error:'rate_limit_exceeded'},{status:429,headers:{'retry-after':'60','cache-control':'no-store'}});
+  }
+  if(path.startsWith('/hooks/studios/')) {
+    const cat=await catalogueOf();
+    const response=await (await import('./studios-events.mjs')).receiveStudioEvent(request,env,cat);
+    if(response.ok){const delivery=import('./functions.mjs').then(m=>m.runFunctions(env,cat,origin));if(ctx?.waitUntil)ctx.waitUntil(delivery);else await delivery;}
+    return response;
+  }
   if(path.startsWith('/hooks/tools/')) return (await import('./tool-webhook.mjs')).toolWebhook(request,env,{cat:await catalogueOf(),definitions});
+  if(path==='/oauth/token'){const response=await studioToken(request,env,await catalogueOf());if(response)return response;}
+  const machine=request.headers.get('authorization')?.startsWith('Bearer homie_studio_');
   const scoped={...env,OAUTH_KV:oauthStorage(env.DB)};
   const localIdentity=await localCaller(request,env);
   const bearer=request.headers.get('authorization')?.startsWith('Bearer homie_owner_');
   const bearerIdentity=bearer?await tokenCaller(request,env):null;
   if(bearer&&!bearerIdentity)return json({error:'connector expired or revoked'},401);
   const api=async(request,env,ctx)=>{
-    const identity=async()=>{if(bearer){const fresh=await tokenCaller(request,env);if(!fresh)throw new Error('connector revoked');return fresh;}return localIdentity ?? currentCaller(env,ctx.props);};
+    const rawIdentity=async()=>{if(machine){const fresh=await studioCaller(request,env,await catalogueOf());if(!fresh)throw new Error('Studio authorization revoked');return fresh;}if(bearer){const fresh=await tokenCaller(request,env);if(!fresh)throw new Error('connector revoked');return fresh;}return localIdentity ?? currentCaller(env,ctx.props);};
+    const identity=async()=>({...await rawIdentity(),clientAddressKey:`public:${request.headers.get('cf-connecting-ip')??'local'}`});
     let caller;
     try{caller=await identity();}catch{return new Response(JSON.stringify({error:'connection revoked'}),{status:401,headers:{'content-type':'application/json','cache-control':'no-store','www-authenticate':`Bearer resource_metadata="${origin}/.well-known/oauth-protected-resource/mcp", error="invalid_token"`}});}
     if(caller.tools){
@@ -74,7 +90,7 @@ export async function remoteMcp(request,env,ctx,{catalogueOf,definitions=[]}) {
     }
     const rate=async fresh=>{
       const limit=callsPerMinute(cat);
-      if(!await rateLimit(env,fresh.id??`public:${request.headers.get('cf-connecting-ip')??'local'}`,limit))throw new Error('Rate limit reached');
+      if(!await rateLimit(env,callerLimitKey(fresh),limit))throw new Error('Rate limit reached');
     };
     const read=async(name,handler)=>{
       let outcome='error';
@@ -144,7 +160,7 @@ export async function remoteMcp(request,env,ctx,{catalogueOf,definitions=[]}) {
             if(tool.protocol) {const result=await tool.handler(args,{...context,paymentExtra:extra});outcome=result.isError?'error':'ok';return result;}
             const value=await (await import('./app-tools.mjs')).invokeAppTool(tool,args,{...context,request});
             const text=JSON.stringify({kind:'untrusted-tool-data',tool:tool.name,data:value});
-            outcome='ok';return {content:[{type:'text',text}]};
+            outcome='ok';return {structuredContent:{kind:'untrusted-tool-data',tool:tool.name,data:value??null},content:[{type:'text',text}]};
           }catch(error){if(error?.code===-32042)throw error;return {isError:true,content:[{type:'text',text:outcome==='denied'||outcome==='limited'||error?.name==='StudioOperationError'?error.message:(freshErrorMessage(error,env,caller))}]};}
           finally{
             try { await audit(env,caller,tool.name,outcome); }
@@ -178,6 +194,7 @@ export async function remoteMcp(request,env,ctx,{catalogueOf,definitions=[]}) {
   if(localIdentity||bearerIdentity)return api(request,scoped,ctx);
   const provider=new OAuthProvider({
     apiRoute:'/mcp',apiHandler:{fetch:api},
+    resolveExternalToken:async({request,env})=>(await studioCaller(request,env,await catalogueOf()))?{props:{},audience:origin+'/mcp'}:null,
     authorizeEndpoint:'/oauth/authorize',tokenEndpoint:'/oauth/token',clientRegistrationEndpoint:'/oauth/register',
     resourceMetadata:{resource:origin+'/mcp',authorization_servers:[origin]},
     scopesSupported:['studio','offline_access'],requiredScopes:['studio'],
@@ -209,7 +226,14 @@ export async function remoteMcp(request,env,ctx,{catalogueOf,definitions=[]}) {
         const owner=await isOwner(req,env);
         if(req.method==='POST'){
           if(!sameOrigin(req,u))return json({error:'origin refused'},403);
-          const f=await req.formData();const id=String(f.get('connection')??'');
+          const f=await req.formData();
+          if(f.has('studioOrigin')){
+            const studio=String(f.get('studioOrigin'));
+            if(!owner||!studioRegistration(await catalogueOf(),studio))return json({error:'studio policy refused'},403);
+            await setStudioPolicy(env,studio,f.get('allow')==='true');
+            return Response.redirect(origin+u.pathname,303);
+          }
+          const id=String(f.get('connection')??'');
           const connection=await env.DB.prepare('SELECT * FROM mcp_connections WHERE id=?1').bind(id).first();
           if(connection&&(owner||connection.person===person)){
             // Local denial takes effect first, even if upstream token cleanup must be retried.
@@ -224,9 +248,15 @@ export async function remoteMcp(request,env,ctx,{catalogueOf,definitions=[]}) {
         }
         const page=Math.max(0,Math.min(100,Number.parseInt(u.searchParams.get('page')??'0',10)||0)),offset=page*100;
         const rows=(await env.DB.prepare(owner?'SELECT c.*,p.name FROM mcp_connections c LEFT JOIN players p ON p.id=c.person ORDER BY c.created DESC LIMIT 100 OFFSET ?1':'SELECT c.*,p.name FROM mcp_connections c LEFT JOIN players p ON p.id=c.person WHERE c.person=?1 ORDER BY c.created DESC LIMIT 100 OFFSET ?2').bind(...(owner?[offset]:[person,offset])).all()).results;
-        const events=owner?(await env.DB.prepare('SELECT a.*,p.name FROM mcp_audit a LEFT JOIN players p ON p.id=a.person ORDER BY a.id DESC LIMIT 100 OFFSET ?1').bind(offset).all()).results:[];
+        const events=owner?(await env.DB.prepare("SELECT a.*,p.name FROM mcp_audit a LEFT JOIN players p ON p.id=a.person AND (a.client IS NULL OR a.client NOT LIKE 'https://%') ORDER BY a.id DESC LIMIT 100 OFFSET ?1").bind(offset).all()).results:[];
         const names=new Map(await Promise.all([...new Set([...rows,...events].map(r=>r.client).filter(Boolean))].map(async id=>[id,(await oauth.lookupClient(id).catch(()=>null))?.clientName??id])));
-        return html(`<h1>Your studio's AI connections</h1><p>Signed-in MCP address: <code>${esc(origin)}/mcp/auth</code> · Public: <code>${esc(origin)}/mcp</code></p><ul>${rows.map(r=>`<li>${esc(r.name??(r.person.startsWith('office-')?'Owner browser':r.person))} · ${esc(names.get(r.client))} · ${r.revoked?'Revoked':`<form method="post"><input type="hidden" name="connection" value="${esc(r.id)}"><button>Revoke</button></form>`}</li>`).join('')}</ul><h2>Recent tool calls</h2><ul>${events.map(r=>`<li>${esc(new Date(r.at).toISOString())} · ${esc(r.name??(r.person?.startsWith('office-')?'Owner browser':r.person)??'Public')} · ${esc(names.get(r.client)??'Anonymous')} · ${esc(r.tool)} · ${esc(r.outcome)}</li>`).join('')}</ul><nav>${page?`<a href="?page=${page-1}">Newer</a>`:''}${rows.length===100||events.length===100?`<a href="?page=${page+1}">Older</a>`:''}</nav>`);
+        const studioRows=[];
+        if(owner)for(const rule of Object.values((await catalogueOf()).studio?.mcp?.studios?.inbound??{})){
+          let peer;try{peer=studioOrigin(rule.origin,{allowPrivate:rule.allowPrivate===true});}catch{continue;}
+          const policy=await oauthStorage(env.DB).get('studio-policy:'+peer,'json');
+          studioRows.push(`<li>${esc(peer)} · ${policy?.allow?'Allowed':'Denied'}<form method="post"><input type="hidden" name="studioOrigin" value="${esc(peer)}"><input type="hidden" name="allow" value="${policy?.allow?'false':'true'}"><button>${policy?.allow?'Deny':'Allow'}</button></form></li>`);
+        }
+        return html(`${owner?'<h2>Studio connections</h2><p>Denied by default. Allow only origins you trust for their declared tools and events.</p><ul>'+studioRows.join('')+'</ul>':''}<h1>Your studio's AI connections</h1><p>Signed-in MCP address: <code>${esc(origin)}/mcp/auth</code> · Public: <code>${esc(origin)}/mcp</code></p><ul>${rows.map(r=>`<li>${esc(r.name??(r.person.startsWith('office-')?'Owner browser':r.person))} · ${esc(names.get(r.client))} · ${r.revoked?'Revoked':`<form method="post"><input type="hidden" name="connection" value="${esc(r.id)}"><button>Revoke</button></form>`}</li>`).join('')}</ul><h2>Recent tool calls</h2><ul>${events.map(r=>`<li>${esc(new Date(r.at).toISOString())} · ${esc(r.client?.startsWith('https://')?'Asserted handle: '+(r.person??'(none)'):(r.name??(r.person?.startsWith('office-')?'Owner browser':r.person)??'Public'))} · ${esc(names.get(r.client)??'Anonymous')} · ${esc(r.tool)} · ${esc(r.outcome)}</li>`).join('')}</ul><nav>${page?`<a href="?page=${page-1}">Newer</a>`:''}${rows.length===100||events.length===100?`<a href="?page=${page+1}">Older</a>`:''}</nav>`);
       }
       return json({error:'not found'},404);
     }},
@@ -235,5 +265,10 @@ export async function remoteMcp(request,env,ctx,{catalogueOf,definitions=[]}) {
     // Public tools remain available without an account. Clients can discover OAuth metadata directly.
     return api(request,scoped,ctx);
   }
-  return provider.fetch(request,scoped,ctx);
+  const response=await provider.fetch(request,scoped,ctx);
+  if(path==='/.well-known/oauth-authorization-server'&&response.ok){
+    const metadata=await response.json();
+    return json({...metadata,grant_types_supported:[...new Set([...(metadata.grant_types_supported??[]),'client_credentials'])],token_endpoint_auth_methods_supported:[...new Set([...(metadata.token_endpoint_auth_methods_supported??[]),'private_key_jwt'])]});
+  }
+  return response;
 }

package/worker/room.mjs

@@ -272,6 +272,7 @@ export class NetRoom {
     this.lastSnap = snap;
     if (!c) { const sentAt = (this.snapAt ??= new Map()); sentAt.set(snap.k, now); if (sentAt.size > 128) sentAt.delete(sentAt.keys().next().value); }
     if (c) c.lastSnapAt = now;
+    this.retryBrowserSeats(c);
     this.stats.snaps += 1;
     this.snapTimes.push(now);
     while (this.snapTimes.length && this.snapTimes[0] < now - 1000) this.snapTimes.shift();
@@ -388,6 +389,34 @@ export class NetRoom {
     this.tellWatchers();
   }
 
+  /** A browser can hear joins before its world exists. Its roster acknowledges
+   * bodies, so re-announce missing connected seats until it acknowledges them.
+   * Use the existing join protocol for games bundling older netplay clients.
+   * Snapshot traffic retries even if the boot roster was published too early;
+   * retries back off from 1 to 30 seconds and stop after eight attempts.
+   * An exhausted peer is logged once; retries are never sent to replicas.
+   */
+  retryBrowserSeats(host) {
+    if (!host || this.server || this.rules || host.id !== this.hostId || !this.lastRoster) return;
+    const seated = new Set(this.lastRoster.filter(s => !s.bot || s.agent).flatMap(s => [s.seat, s.agent?.seat]));
+    const now = this.now();
+    for (const peer of this.live()) {
+      if (peer.id === host.id || peer.seat === null || peer.watch) continue;
+      if (seated.has(peer.seat)) { peer.seatRetry = null; continue; }
+      const retry = peer.seatRetry?.host === host.id ? peer.seatRetry : null;
+      if (retry && now - retry.at < Math.min(1000 * 2 ** (retry.tries - 1), 30000)) continue;
+      if (retry?.tries >= 8) {
+        if (!retry.exhausted) {
+          retry.exhausted = true;
+          this.log({ ev: 'seat-retry-exhausted', room: this.code, id: peer.id, seat: peer.seat, host: host.id, tries: retry.tries });
+        }
+        continue;
+      }
+      peer.seatRetry = { host: host.id, at: now, tries: (retry?.tries ?? 0) + 1 };
+      this.send(host, { t: 'join', peer: this.peer(peer) });
+    }
+  }
+
   hostCaps(c, m) {
     // The host's game reads the dial and/or moves agents' bodies (section 17): the office and the shell say so.
     if (!Array.isArray(m.caps)) return;

package/worker/routes.mjs

@@ -56,7 +56,7 @@ export default async function route(request, env, ctx) {
 
   if (path === '/_studio/office/functions') return (await import('./functions.mjs')).functionsRoute(request,env,await getAll());
 
-  if (path === '/mcp' || path === '/mcp/auth' || path.startsWith('/hooks/tools/') || path.startsWith('/oauth/') || path.startsWith('/.well-known/oauth-') || path === '/_studio/office/connections') {
+  if (path === '/.well-known/jwks.json' || path === '/mcp' || path === '/mcp/auth' || path.startsWith('/hooks/tools/') || path.startsWith('/hooks/studios/') || path.startsWith('/oauth/') || path.startsWith('/.well-known/oauth-') || path === '/_studio/office/connections') {
     const { remoteMcp } = await import('./mcp.mjs');
     return remoteMcp(request, env, ctx, { catalogueOf: getAll, definitions: await studioTools() });
   }

package/worker/studios-auth.mjs

@@ -0,0 +1,71 @@
+import {decode,originKey,verifyBytes} from './studios-keys.mjs';
+import {oauthStorage,audit} from './mcp-store.mjs';
+import {studioOrigin} from './studios-client.mjs';
+const hash=async text=>Array.from(new Uint8Array(await crypto.subtle.digest('SHA-256',new TextEncoder().encode(text))),b=>b.toString(16).padStart(2,'0')).join('');
+const json=(data,status=200)=>Response.json(data,{status,headers:{'cache-control':'no-store','pragma':'no-cache',...(status===401?{'www-authenticate':'Bearer'}:{})}});
+export async function boundedBody(request,maxBytes=65536) {
+ const reader=request.body?.getReader();if(!reader)return '';
+ const chunks=[];let bytes=0;
+ try{while(true){const {done,value}=await reader.read();if(done)break;bytes+=value.byteLength;if(bytes>maxBytes)throw new Error('Request size exceeded');chunks.push(value);}}
+ catch(error){await reader.cancel();throw error;}finally{reader.releaseLock();}
+ const body=new Uint8Array(bytes);let offset=0;for(const chunk of chunks){body.set(chunk,offset);offset+=chunk.length;}return new TextDecoder('utf-8',{fatal:true}).decode(body);
+}
+export function studioRegistration(cat,origin){
+ for(const rule of Object.values(cat.studio?.mcp?.studios?.inbound??{})){
+  try{if(studioOrigin(rule.origin,{allowPrivate:rule.allowPrivate===true})===origin&&rule.enabled!==false)return rule;}catch{/* Invalid configuration is denied. */}
+ }
+ return null;
+}
+export async function setStudioPolicy(env,origin,allow){
+ origin=studioOrigin(origin,{allowPrivate:true});
+ await oauthStorage(env.DB).put('studio-policy:'+origin,JSON.stringify({allow:allow===true}));
+}
+export async function studioPolicy(env,cat,origin){
+ const rule=studioRegistration(cat,origin);
+ return rule&&(await oauthStorage(env.DB).get('studio-policy:'+origin,'json'))?.allow===true?rule:null;
+}
+/** RFC 7523 client authentication. Only the claimed origin's HTTPS JWKS can prove it. */
+export async function studioToken(request,env,cat,options={}) {
+ if(request.method!=='POST')return null;
+ let form;try{form=new URLSearchParams(await boundedBody(request.clone(),8192));}catch{return json({error:'invalid_request'},400);}
+ if(form.get('grant_type')!=='client_credentials')return null;
+ const receiver=new URL(request.url).origin;
+ if(!receiver.startsWith('https:')||form.getAll('resource').length!==1||form.get('resource')!==receiver+'/mcp')return json({error:'invalid_target'},400);
+ if(form.has('scope')&&form.get('scope')!=='studio')return json({error:'invalid_scope'},400);
+ let origin,stage='assertion';
+ try{
+  for(const name of ['client_assertion','client_assertion_type','client_id'])if(form.getAll(name).length!==1)throw Error();
+  if(form.get('client_assertion_type')!=='urn:ietf:params:oauth:client-assertion-type:jwt-bearer')throw Error();
+  const parts=form.get('client_assertion').split('.');if(parts.length!==3)throw Error();
+  const header=decode(parts[0]),claims=decode(parts[1]);origin=claims.iss;
+  stage='policy';
+  const rule=await studioPolicy(env,cat,origin);if(!rule)throw Error();
+  stage='claims';
+  if(studioOrigin(origin,{allowPrivate:rule.allowPrivate===true})!==origin||form.get('client_id')!==origin||claims.sub!==origin||claims.aud!==receiver+'/oauth/token'||header.alg!=='EdDSA'||header.jku||header.jwk||header.crit)throw Error();
+  const now=Math.floor(Date.now()/1000);
+  if(!Number.isSafeInteger(claims.exp)||!Number.isSafeInteger(claims.iat)||claims.iat>now+30||claims.iat<now-300||claims.exp<=now||claims.exp>claims.iat+300||claims.nbf!==undefined&&(!Number.isSafeInteger(claims.nbf)||claims.nbf>now)||typeof claims.jti!=='string'||! /^[A-Za-z0-9_-]{1,128}$/.test(claims.jti))throw Error();
+  stage='key discovery';
+  const key=await originKey(env,origin,header.kid,{...options,allowPrivate:rule.allowPrivate===true});
+  stage='signature';
+  if(!await verifyBytes(key,parts[2],parts.slice(0,2).join('.')))throw Error();
+  stage='replay';
+  const used=await env.DB.prepare('INSERT OR IGNORE INTO mcp_kv(key,value,expires) VALUES(?1,?2,?3) RETURNING key').bind('studio-jti:'+await hash(JSON.stringify([origin,claims.jti])),'1',claims.exp).first();if(!used)throw Error();
+ }catch{
+  await audit(env,{client:typeof origin==='string'?origin.slice(0,2048):null},'studio-auth','denied:'+stage);
+  return json({error:'invalid_client',error_description:'Studio authentication failed'},401);
+ }
+ const token='homie_studio_'+Array.from(crypto.getRandomValues(new Uint8Array(32)),b=>b.toString(16).padStart(2,'0')).join('');
+ const record={origin,resource:receiver+'/mcp',expires:Math.floor(Date.now()/1000)+300};
+ await oauthStorage(env.DB).put('studio-token:'+await hash(token),JSON.stringify(record),{expiration:record.expires});
+ return json({access_token:token,token_type:'Bearer',expires_in:300,scope:'studio'});
+}
+/** Live D1 policy is re-read on every dispatch; handles only separate booking ownership. */
+export async function studioCaller(request,env,cat) {
+ const token=/^Bearer (homie_studio_[a-f0-9]{64})$/.exec(request.headers.get('authorization')??'')?.[1];if(!token)return null;
+ const record=await oauthStorage(env.DB).get('studio-token:'+await hash(token),'json');
+ if(!record||record.expires<=Date.now()/1000||record.resource!==new URL(request.url).origin+'/mcp')return null;
+ const rule=await studioPolicy(env,cat,record.origin);if(!rule)return null;
+ let assertedHandle;try{const raw=request.headers.get('x-studio-asserted-handle');if(raw!==null){assertedHandle=decodeURIComponent(raw);if(!/^[A-Za-z0-9._@-]{1,128}$/.test(assertedHandle))return null;}}catch{return null;}
+ return {id:'studio:'+await hash(JSON.stringify([record.origin,assertedHandle??null])),owner:false,roles:{},client:record.origin,tools:rule.tools??[],
+  studio:{origin:record.origin,verified:true,method:'private_key_jwt'},...(assertedHandle===undefined?{}:{actingFor:{assertedHandle,verified:false,assertedBy:record.origin}})};
+}

package/worker/studios-client.mjs

@@ -0,0 +1,93 @@
+import {signAssertion} from './studios-keys.mjs';
+import {Client, StreamableHTTPClientTransport, PrivateKeyJwtProvider} from 'mcp-studio-client';
+export function studioOrigin(value,{allowPrivate=false}={}) {
+ const url=new URL(value);
+ if(url.protocol!=='https:'||url.username||url.password||url.pathname!=='/'||url.search||url.hash)throw new Error('Studio requires a bare HTTPS origin');
+ const host=url.hostname.toLowerCase().replace(/\.$/,'');
+ if(!allowPrivate&&(url.port||host.includes(':')||/^[0-9.]+$/.test(host)||!host.includes('.')||/(^|\.)(localhost|local|internal)$/.test(host)))throw new Error('Studio requires a public DNS origin on port 443');
+ return url.origin;
+}
+/** Bound bytes before SDK parsing; the SDK owns JSON-RPC, SSE and OAuth. */
+export function boundedStudioFetch(origin,signal,{maxBytes=1024*1024,fetchFn=globalThis.fetch.bind(globalThis)}={}) {
+ return async(input,init)=>{
+  const request=new Request(input,init),url=new URL(request.url);
+  if(url.origin!==origin||url.username||url.password)throw new Error('Studio request escaped its origin');
+  const response=await fetchFn(new Request(request,{redirect:'manual',signal:AbortSignal.any([signal,request.signal])}));
+  if(response.status>=300&&response.status<400){await response.body?.cancel();throw new Error('Studio redirects refused');}
+  if(Number(response.headers.get('content-length'))>maxBytes){await response.body?.cancel();throw new Error('Studio response size exceeded');}
+  if(!response.body)return response;
+  let bytes=0;
+  const body=response.body.pipeThrough(new TransformStream({transform(chunk,controller){bytes+=chunk.byteLength;if(bytes>maxBytes)throw new Error('Studio response size exceeded');controller.enqueue(chunk);}}));
+  return new Response(body,{status:response.status,statusText:response.statusText,headers:response.headers});
+ };
+}
+export function studioResult(result,source={origin:null,authenticated:false}) {
+ let data=result.structuredContent;
+ if(data===undefined&&result.content?.length===1&&result.content[0].type==='text'){
+  try{const parsed=JSON.parse(result.content[0].text);if(parsed?.kind==='untrusted-tool-data')data=parsed;}catch{/* Ordinary MCP text remains content. */}
+ }
+ if(data?.kind==='untrusted-tool-data'&&Object.hasOwn(data,'data'))data=data.data;
+ return {source,untrusted:true,isError:result.isError===true,...(data===undefined?{}:{data}),content:result.content??[]};
+}
+export function outboundRules(cat) {
+ const rules=new Map();
+ for(const [key,rule] of Object.entries(cat.studio?.mcp?.studios?.outbound??{})) {
+  const origin=studioOrigin(key,{allowPrivate:rule.allowPrivate===true});
+  if(rules.has(origin)||rule.origin!==undefined&&studioOrigin(rule.origin,{allowPrivate:rule.allowPrivate===true})!==origin)throw new Error('Studio configuration origin mismatch');
+  rules.set(origin,rule);
+ }
+ return rules;
+}
+export function studiosClient(env,cat,definition,{fetchFn=globalThis.fetch.bind(globalThis),origin:ownOrigin}={}) {
+ const providers=new Map(),discovery=new Map();
+ const rules=outboundRules(cat);
+ const run=async(origin,operation,options={})=>{
+  const candidate=new URL(origin).origin,rule=rules.get(candidate);
+  origin=studioOrigin(origin,{allowPrivate:rule?.allowPrivate===true});
+  if(!rule)throw new Error('Studio destination is not configured');
+  if(rule&&!rule.tools?.includes(definition.name))throw new Error('Studio connection not delegated to this tool');
+  const controller=new AbortController(),timer=setTimeout(()=>controller.abort(new Error('Studio request timed out')),10000);
+  const client=new Client({name:'homie-studio',version:'1'});
+  try{
+   const authenticated=rule.anonymous!==true;
+   let authProvider;
+   if(authenticated){
+    if(!ownOrigin||!env.STUDIO_SIGNING_KEY)throw new Error('Studio signing key unavailable');
+    authProvider=providers.get(origin);
+    if(!authProvider){
+     authProvider=new PrivateKeyJwtProvider({clientId:ownOrigin,privateKey:{},algorithm:'EdDSA',scope:'studio',expectedIssuer:origin});
+     authProvider.addClientAuthentication=async(_headers,params,url)=>{
+      if(String(url)!==origin+'/oauth/token')throw new Error('Unexpected studio token endpoint');
+      params.set('client_id',ownOrigin);
+      params.set('client_assertion_type','urn:ietf:params:oauth:client-assertion-type:jwt-bearer');
+      params.set('client_assertion',await signAssertion(env,ownOrigin,String(url)));
+     };
+     providers.set(origin,authProvider);
+    }
+   }
+   const cachedFetch=async(request)=>{
+    const url=new URL(request.url),cacheable=request.method==='GET'&&url.pathname.startsWith('/.well-known/');
+    if(cacheable&&discovery.has(request.url))return discovery.get(request.url).clone();
+    const response=await fetchFn(request);
+    if(cacheable&&response.ok){const bounded=await (await boundedStudioFetch(origin,controller.signal,{fetchFn:async()=>response,maxBytes:32768})(request)).arrayBuffer();if(bounded.byteLength>32768)throw new Error('Discovery size exceeded');const saved=new Response(bounded,{status:response.status,headers:response.headers});discovery.set(request.url,saved);return saved.clone();}
+    return response;
+   };
+   const headers={};
+   if(options.assertedHandle!==undefined){
+    if(!authenticated||typeof options.assertedHandle!=='string'||! /^[A-Za-z0-9._@-]{1,128}$/.test(options.assertedHandle))throw new Error('Acting-for needs an authenticated studio and a handle of 1–128 characters');
+    headers['x-studio-asserted-handle']=encodeURIComponent(options.assertedHandle);
+   }
+   const transport=new StreamableHTTPClientTransport(new URL(authenticated?'/mcp/auth':'/mcp',origin),{fetch:boundedStudioFetch(origin,controller.signal,{fetchFn:async request=>cachedFetch(request)}),authProvider,requestInit:{headers}});
+   await client.connect(transport,{signal:controller.signal,timeout:10000});
+   return await operation(client,controller.signal,{origin,authenticated});
+  }finally{controller.abort();clearTimeout(timer);await client.close();}
+ };
+ return Object.freeze({
+  send:(origin,name,event)=>import('./studios-events.mjs').then(m=>m.sendStudioEvent(env,cat,ownOrigin,definition,origin,name,event,{fetchFn})),
+  listTools:(origin,options)=>run(origin,async(client,signal,source)=>{const page=await client.listTools(options?.cursor?{cursor:options.cursor}:{},{signal,timeout:10000});return {...page,source,untrusted:true,tools:page.tools.map(tool=>({...tool,source,untrusted:true,description:'[Untrusted remote description] '+(tool.description??'')}))};},options),
+  call:(origin,tool,args={},options)=>{
+   if(new TextEncoder().encode(JSON.stringify(args)).length>65536)return Promise.reject(new Error('Studio arguments size exceeded'));
+   return run(origin,async(client,signal,source)=>studioResult(await client.callTool({name:tool,arguments:args},{signal,timeout:10000}),source),options);
+  },
+ });
+}

package/worker/studios-events.mjs

@@ -0,0 +1,52 @@
+import {boundedBody,studioPolicy} from './studios-auth.mjs';
+import {studioOrigin,outboundRules,boundedStudioFetch} from './studios-client.mjs';
+import {signBytes,originKey,verifyBytes} from './studios-keys.mjs';
+import {publishBusinessEvent,BUSINESS_EVENT_MAX_BYTES} from './business-events.mjs';
+import {syncFunctions} from './functions.mjs';
+export async function signStudioEvent(env,source,name,{id,data},{now=Date.now}={}){
+ if(typeof id!=='string'||!/^[A-Za-z0-9_-]{1,128}$/.test(id))throw new Error('Stable event id required');
+ const body=JSON.stringify({eventId:id,name,timestamp:new Date(now()).toISOString(),source,data});
+ if(new TextEncoder().encode(body).length>BUSINESS_EVENT_MAX_BYTES)throw new Error('Studio event exceeds 8192 bytes');
+ const timestamp=String(Math.floor(now()/1000)),{kid,signature}=await signBytes(env,`${id}.${timestamp}.${body}`);
+ return {body,headers:{'content-type':'application/json','webhook-id':id,'webhook-timestamp':timestamp,'webhook-signature':'v1a,'+signature,'webhook-key-id':kid,'webhook-origin':source}};
+}
+export async function sendStudioEvent(env,cat,source,definition,origin,name,event,options={}) {
+ const rule=outboundRules(cat).get(new URL(origin).origin);origin=studioOrigin(origin,{allowPrivate:rule?.allowPrivate===true});
+ if(!rule?.tools?.includes(definition.name)||!rule.events?.includes(name)||!/^\/hooks\/studios\/[a-zA-Z0-9_-]+$/.test(rule.eventPath??''))throw new Error('Studio event destination not delegated');
+ if(rule.anonymous||!source)throw new Error('Studio event requires origin authentication');
+ const signed=await signStudioEvent(env,source,name,event,options);
+ const response=await boundedStudioFetch(origin,AbortSignal.timeout(10000),options)(origin+rule.eventPath,{method:'POST',...signed});
+ await response.body?.cancel();if(!response.ok)throw new Error('Studio event rejected ('+response.status+')');
+ return {id:event.id};
+}
+/** Standard Webhooks v1a: Ed25519 over id.timestamp.exact-body, keys fetched only from configured origin. */
+export async function receiveStudioEvent(request,env,cat,options={}) {
+ if(request.method!=='POST')return new Response(null,{status:405});
+ const id=new URL(request.url).pathname.slice('/hooks/studios/'.length),entries=cat.studio?.mcp?.studios?.inbound??{};
+ const configured=Object.hasOwn(entries,id)?entries[id]:null;
+ let origin,rule;try{origin=studioOrigin(configured?.origin,{allowPrivate:configured?.allowPrivate===true});if(configured.enabled!==false&&await studioPolicy(env,cat,origin))rule=configured;}catch{}
+ if(!rule)return new Response(null,{status:403});
+ let body;try{body=await boundedBody(request,BUSINESS_EVENT_MAX_BYTES);}catch{return new Response('Studio event exceeds 8192 bytes',{status:413});}
+ let event;
+ try{
+  const timestamp=request.headers.get('webhook-timestamp'),eventId=request.headers.get('webhook-id');
+  if(!/^\d+$/.test(timestamp??'')||Math.abs(Date.now()/1000-Number(timestamp))>300||!/^[A-Za-z0-9_-]{1,128}$/.test(eventId??'')||request.headers.get('webhook-origin')!==origin)throw Error();
+  const key=await originKey(env,origin,request.headers.get('webhook-key-id'),{...options,allowPrivate:rule.allowPrivate===true});
+  let valid=false;for(const part of (request.headers.get('webhook-signature')??'').split(' ').slice(0,8)){
+   const [version,signature]=part.split(',');if(version==='v1a'&&await verifyBytes(key,signature,`${eventId}.${timestamp}.${body}`)){valid=true;break;}
+  }
+  if(!valid)throw Error();event=JSON.parse(body);
+ }catch{return new Response(null,{status:401});}
+ if(!event||typeof event!=='object'||Array.isArray(event)||event.source!==origin||event.eventId!==request.headers.get('webhook-id')||typeof event.name!=='string')return new Response(null,{status:400});
+ const feed=Object.hasOwn(rule.events??{},event.name)?rule.events[event.name]:null;
+ if(!feed)return new Response(null,{status:403});
+ await syncFunctions(env);
+ try{await publishBusinessEvent(env,{}, {publish:[feed]},'@studio:'+origin,{feed,id:event.eventId,data:{sender:{origin,verified:true},data:event.data}});}
+ catch(error){
+  if(/already published/.test(error.message))return new Response(null,{status:409});
+  if(/8192 bytes/.test(error.message))return new Response(error.message,{status:413});
+  if(/schema|characters/.test(error.message))return new Response(null,{status:400});
+  throw error;
+ }
+ return new Response(null,{status:204});
+}

package/worker/studios-keys.mjs

@@ -0,0 +1,54 @@
+import {oauthStorage} from './mcp-store.mjs';
+import {studioOrigin,boundedStudioFetch} from './studios-client.mjs';
+const bytes=text=>new TextEncoder().encode(text);
+export const base64=value=>btoa(String.fromCharCode(...new Uint8Array(value)));
+export const unbase64=value=>Uint8Array.from(atob(value),c=>c.charCodeAt(0));
+const encode=value=>base64(bytes(JSON.stringify(value))).replaceAll('+','-').replaceAll('/','_').replace(/=+$/,'');
+export const decode=value=>JSON.parse(new TextDecoder().decode(unbase64(value.replaceAll('-','+').replaceAll('_','/'))));
+export function publicKeys(env){
+ const current=JSON.parse(env.STUDIO_SIGNING_KEY??'null');
+ const keys=[current,...JSON.parse(env.STUDIO_PREVIOUS_PUBLIC_KEYS??'[]')].filter(Boolean);
+ return {keys:keys.map(({kty,crv,x,kid})=>({kty,crv,x,kid,alg:'EdDSA',use:'sig'}))};
+}
+export async function signBytes(env,text){
+ const jwk=JSON.parse(env.STUDIO_SIGNING_KEY??'null');
+ if(!jwk?.kid||jwk.crv!=='Ed25519'||!jwk.d)throw new Error('Studio signing key unavailable');
+ const key=await crypto.subtle.importKey('jwk',{...jwk,alg:'EdDSA'},'Ed25519',false,['sign']);
+ return {kid:jwk.kid,signature:base64(await crypto.subtle.sign('Ed25519',key,bytes(text)))};
+}
+export async function signAssertion(env,origin,audience){
+ const jwk=JSON.parse(env.STUDIO_SIGNING_KEY??'null'),now=Math.floor(Date.now()/1000);
+ const text=encode({alg:'EdDSA',typ:'JWT',kid:jwk?.kid})+'.'+encode({iss:origin,sub:origin,aud:audience,iat:now,exp:now+60,jti:crypto.randomUUID()});
+ return text+'.'+(await signBytes(env,text)).signature.replaceAll('+','-').replaceAll('/','_').replace(/=+$/,'');
+}
+/** D1 cache and atomic per-origin fetch claim bound failures and unknown kids across requests. */
+export async function originKey(env,origin,kid,{fetchFn=globalThis.fetch.bind(globalThis),allowPrivate=false}={}){
+ origin=studioOrigin(origin,{allowPrivate});
+ if(typeof kid!=='string'||! /^[A-Za-z0-9_-]{1,128}$/.test(kid))throw new Error('Invalid key id');
+ const store=oauthStorage(env.DB),cacheKey='studio-jwks:'+origin,now=Date.now();
+ let cached=await store.get(cacheKey,'json');
+ if(!cached||cached.until<=now||!cached.keys.some(k=>k.kid===kid)&&now-cached.at>=60000){
+  // Claim before network I/O: concurrent misses cannot each fetch. Milliseconds
+  // in value enforce a full 60 seconds; expires is the storage cleanup bound.
+  const claim=await env.DB.prepare("INSERT INTO mcp_kv(key,value,expires) VALUES(?1,?2,?3) ON CONFLICT(key) DO UPDATE SET value=excluded.value,expires=excluded.expires WHERE CAST(mcp_kv.value AS INTEGER)<=?4 RETURNING key")
+   .bind('studio-jwks-fetch:'+origin,String(now+60000),Math.ceil((now+60000)/1000),now).first();
+  if(claim){
+   try{
+    const fetch=boundedStudioFetch(origin,AbortSignal.timeout(5000),{fetchFn,maxBytes:32768});
+    const response=await fetch(origin+'/.well-known/jwks.json');if(!response.ok)throw new Error('Studio keys unavailable');
+    const jwks=await response.json();
+    if(!Array.isArray(jwks?.keys)||jwks.keys.length>8||jwks.keys.some(k=>!k||typeof k!=='object'||k.d))throw new Error('Invalid studio keys');
+    cached={keys:jwks.keys,at:now,until:now+300000};
+   }catch{
+    // Preserve still-valid known keys when an unknown-kid refresh fails.
+    cached={keys:cached?.until>now?cached.keys:[],at:now,until:Math.max(cached?.until??0,now+60000)};
+   }
+   await store.put(cacheKey,JSON.stringify(cached),{expiration:Math.ceil(cached.until/1000)});
+  }
+ }
+ if(!cached||cached.until<=now)throw new Error('Studio keys unavailable');
+ const matches=cached.keys.filter(k=>k.kid===kid&&k.kty==='OKP'&&k.crv==='Ed25519'&&(!k.alg||k.alg==='EdDSA')&&(!k.use||k.use==='sig'));
+ if(matches.length!==1)throw new Error('Unknown studio key');
+ return crypto.subtle.importKey('jwk',matches[0],'Ed25519',false,['verify']);
+}
+export async function verifyBytes(key,signature,text){return crypto.subtle.verify('Ed25519',key,unbase64(signature.replaceAll('-','+').replaceAll('_','/')),bytes(text));}

package/worker/version.mjs

@@ -1,2 +1,2 @@
 /** The @homie-rocks/studio version this Worker code is (package.json's; a test keeps them equal). Cache-busts /_homie/site.js. */
-export const STUDIO_VERSION_TAG = '0.56.0';
+export const STUDIO_VERSION_TAG = '0.57.0';