@homie-rocks/studio 0.56.0 → 0.58.0

package/worker/mcp.mjs

@@ -1,3 +1,5 @@
+import {studioOrigin} from './studios-client.mjs';
+import {studioToken,studioCaller,setStudioPolicy,studioRegistration} from './studios-auth.mjs';
 import {tokenCaller,toolInScope} from './connector-token.mjs';
 import {eventMethods,eventsCapability} from './mcp-events-wire.mjs';
 import {eventsRequest} from './mcp-events.mjs';
@@ -17,7 +19,7 @@ import { players } from './players.mjs';
 import { isOwner, sameOrigin } from './office.mjs';
 import { cookieValue } from './stats.mjs';
 import { esc } from './site.mjs';
-import { oauthStorage, rateLimit, audit, callsPerMinute } from './mcp-store.mjs';
+import { oauthStorage, rateLimit, audit, callsPerMinute, callerLimitKey } from './mcp-store.mjs';
 import { allowed, currentCaller, services, builtins } from './mcp-tools.mjs';
 const validator = new CfWorkerJsonSchemaValidator();
 const json = (data,status=200)=>Response.json(data,{status,headers:{'cache-control':'no-store'}});
@@ -36,14 +38,28 @@ export async function remoteMcp(request,env,ctx,{catalogueOf,definitions=[]}) {
   const url=new URL(request.url), origin=url.origin, path=url.pathname;
   if(!env.DB)return json({error:'studio database required'},503);
   if(request.headers.has('origin') && request.headers.get('origin')!==origin)return json({error:'origin refused'},403);
+  if(path==='/.well-known/jwks.json')return Response.json((await import('./studios-keys.mjs')).publicKeys(env),{headers:{'cache-control':'public, max-age=60'}});
+  if(path==='/oauth/token'||path.startsWith('/hooks/studios/')) {
+    if(!await rateLimit(env,'studio-ingress:'+(request.headers.get('cf-connecting-ip')??'local'),60))
+      return Response.json({error:'rate_limit_exceeded'},{status:429,headers:{'retry-after':'60','cache-control':'no-store'}});
+  }
+  if(path.startsWith('/hooks/studios/')) {
+    const cat=await catalogueOf();
+    const response=await (await import('./studios-events.mjs')).receiveStudioEvent(request,env,cat);
+    if(response.ok){const delivery=import('./functions.mjs').then(m=>m.runFunctions(env,cat,origin));if(ctx?.waitUntil)ctx.waitUntil(delivery);else await delivery;}
+    return response;
+  }
   if(path.startsWith('/hooks/tools/')) return (await import('./tool-webhook.mjs')).toolWebhook(request,env,{cat:await catalogueOf(),definitions});
+  if(path==='/oauth/token'){const response=await studioToken(request,env,await catalogueOf());if(response)return response;}
+  const machine=request.headers.get('authorization')?.startsWith('Bearer homie_studio_');
   const scoped={...env,OAUTH_KV:oauthStorage(env.DB)};
   const localIdentity=await localCaller(request,env);
   const bearer=request.headers.get('authorization')?.startsWith('Bearer homie_owner_');
   const bearerIdentity=bearer?await tokenCaller(request,env):null;
   if(bearer&&!bearerIdentity)return json({error:'connector expired or revoked'},401);
   const api=async(request,env,ctx)=>{
-    const identity=async()=>{if(bearer){const fresh=await tokenCaller(request,env);if(!fresh)throw new Error('connector revoked');return fresh;}return localIdentity ?? currentCaller(env,ctx.props);};
+    const rawIdentity=async()=>{if(machine){const fresh=await studioCaller(request,env,await catalogueOf());if(!fresh)throw new Error('Studio authorization revoked');return fresh;}if(bearer){const fresh=await tokenCaller(request,env);if(!fresh)throw new Error('connector revoked');return fresh;}return localIdentity ?? currentCaller(env,ctx.props);};
+    const identity=async()=>({...await rawIdentity(),clientAddressKey:`public:${request.headers.get('cf-connecting-ip')??'local'}`});
     let caller;
     try{caller=await identity();}catch{return new Response(JSON.stringify({error:'connection revoked'}),{status:401,headers:{'content-type':'application/json','cache-control':'no-store','www-authenticate':`Bearer resource_metadata="${origin}/.well-known/oauth-protected-resource/mcp", error="invalid_token"`}});}
     if(caller.tools){
@@ -74,7 +90,7 @@ export async function remoteMcp(request,env,ctx,{catalogueOf,definitions=[]}) {
     }
     const rate=async fresh=>{
       const limit=callsPerMinute(cat);
-      if(!await rateLimit(env,fresh.id??`public:${request.headers.get('cf-connecting-ip')??'local'}`,limit))throw new Error('Rate limit reached');
+      if(!await rateLimit(env,callerLimitKey(fresh),limit))throw new Error('Rate limit reached');
     };
     const read=async(name,handler)=>{
       let outcome='error';
@@ -144,7 +160,7 @@ export async function remoteMcp(request,env,ctx,{catalogueOf,definitions=[]}) {
             if(tool.protocol) {const result=await tool.handler(args,{...context,paymentExtra:extra});outcome=result.isError?'error':'ok';return result;}
             const value=await (await import('./app-tools.mjs')).invokeAppTool(tool,args,{...context,request});
             const text=JSON.stringify({kind:'untrusted-tool-data',tool:tool.name,data:value});
-            outcome='ok';return {content:[{type:'text',text}]};
+            outcome='ok';return {structuredContent:{kind:'untrusted-tool-data',tool:tool.name,data:value??null},content:[{type:'text',text}]};
           }catch(error){if(error?.code===-32042)throw error;return {isError:true,content:[{type:'text',text:outcome==='denied'||outcome==='limited'||error?.name==='StudioOperationError'?error.message:(freshErrorMessage(error,env,caller))}]};}
           finally{
             try { await audit(env,caller,tool.name,outcome); }
@@ -178,6 +194,7 @@ export async function remoteMcp(request,env,ctx,{catalogueOf,definitions=[]}) {
   if(localIdentity||bearerIdentity)return api(request,scoped,ctx);
   const provider=new OAuthProvider({
     apiRoute:'/mcp',apiHandler:{fetch:api},
+    resolveExternalToken:async({request,env})=>(await studioCaller(request,env,await catalogueOf()))?{props:{},audience:origin+'/mcp'}:null,
     authorizeEndpoint:'/oauth/authorize',tokenEndpoint:'/oauth/token',clientRegistrationEndpoint:'/oauth/register',
     resourceMetadata:{resource:origin+'/mcp',authorization_servers:[origin]},
     scopesSupported:['studio','offline_access'],requiredScopes:['studio'],
@@ -209,7 +226,14 @@ export async function remoteMcp(request,env,ctx,{catalogueOf,definitions=[]}) {
         const owner=await isOwner(req,env);
         if(req.method==='POST'){
           if(!sameOrigin(req,u))return json({error:'origin refused'},403);
-          const f=await req.formData();const id=String(f.get('connection')??'');
+          const f=await req.formData();
+          if(f.has('studioOrigin')){
+            const studio=String(f.get('studioOrigin'));
+            if(!owner||!studioRegistration(await catalogueOf(),studio))return json({error:'studio policy refused'},403);
+            await setStudioPolicy(env,studio,f.get('allow')==='true');
+            return Response.redirect(origin+u.pathname,303);
+          }
+          const id=String(f.get('connection')??'');
           const connection=await env.DB.prepare('SELECT * FROM mcp_connections WHERE id=?1').bind(id).first();
           if(connection&&(owner||connection.person===person)){
             // Local denial takes effect first, even if upstream token cleanup must be retried.
@@ -224,9 +248,15 @@ export async function remoteMcp(request,env,ctx,{catalogueOf,definitions=[]}) {
         }
         const page=Math.max(0,Math.min(100,Number.parseInt(u.searchParams.get('page')??'0',10)||0)),offset=page*100;
         const rows=(await env.DB.prepare(owner?'SELECT c.*,p.name FROM mcp_connections c LEFT JOIN players p ON p.id=c.person ORDER BY c.created DESC LIMIT 100 OFFSET ?1':'SELECT c.*,p.name FROM mcp_connections c LEFT JOIN players p ON p.id=c.person WHERE c.person=?1 ORDER BY c.created DESC LIMIT 100 OFFSET ?2').bind(...(owner?[offset]:[person,offset])).all()).results;
-        const events=owner?(await env.DB.prepare('SELECT a.*,p.name FROM mcp_audit a LEFT JOIN players p ON p.id=a.person ORDER BY a.id DESC LIMIT 100 OFFSET ?1').bind(offset).all()).results:[];
+        const events=owner?(await env.DB.prepare("SELECT a.*,p.name FROM mcp_audit a LEFT JOIN players p ON p.id=a.person AND (a.client IS NULL OR a.client NOT LIKE 'https://%') ORDER BY a.id DESC LIMIT 100 OFFSET ?1").bind(offset).all()).results:[];
         const names=new Map(await Promise.all([...new Set([...rows,...events].map(r=>r.client).filter(Boolean))].map(async id=>[id,(await oauth.lookupClient(id).catch(()=>null))?.clientName??id])));
-        return html(`<h1>Your studio's AI connections</h1><p>Signed-in MCP address: <code>${esc(origin)}/mcp/auth</code> · Public: <code>${esc(origin)}/mcp</code></p><ul>${rows.map(r=>`<li>${esc(r.name??(r.person.startsWith('office-')?'Owner browser':r.person))} · ${esc(names.get(r.client))} · ${r.revoked?'Revoked':`<form method="post"><input type="hidden" name="connection" value="${esc(r.id)}"><button>Revoke</button></form>`}</li>`).join('')}</ul><h2>Recent tool calls</h2><ul>${events.map(r=>`<li>${esc(new Date(r.at).toISOString())} · ${esc(r.name??(r.person?.startsWith('office-')?'Owner browser':r.person)??'Public')} · ${esc(names.get(r.client)??'Anonymous')} · ${esc(r.tool)} · ${esc(r.outcome)}</li>`).join('')}</ul><nav>${page?`<a href="?page=${page-1}">Newer</a>`:''}${rows.length===100||events.length===100?`<a href="?page=${page+1}">Older</a>`:''}</nav>`);
+        const studioRows=[];
+        if(owner)for(const rule of Object.values((await catalogueOf()).studio?.mcp?.studios?.inbound??{})){
+          let peer;try{peer=studioOrigin(rule.origin,{allowPrivate:rule.allowPrivate===true});}catch{continue;}
+          const policy=await oauthStorage(env.DB).get('studio-policy:'+peer,'json');
+          studioRows.push(`<li>${esc(peer)} · ${policy?.allow?'Allowed':'Denied'}<form method="post"><input type="hidden" name="studioOrigin" value="${esc(peer)}"><input type="hidden" name="allow" value="${policy?.allow?'false':'true'}"><button>${policy?.allow?'Deny':'Allow'}</button></form></li>`);
+        }
+        return html(`${owner?'<h2>Studio connections</h2><p>Denied by default. Allow only origins you trust for their declared tools and events.</p><ul>'+studioRows.join('')+'</ul>':''}<h1>Your studio's AI connections</h1><p>Signed-in MCP address: <code>${esc(origin)}/mcp/auth</code> · Public: <code>${esc(origin)}/mcp</code></p><ul>${rows.map(r=>`<li>${esc(r.name??(r.person.startsWith('office-')?'Owner browser':r.person))} · ${esc(names.get(r.client))} · ${r.revoked?'Revoked':`<form method="post"><input type="hidden" name="connection" value="${esc(r.id)}"><button>Revoke</button></form>`}</li>`).join('')}</ul><h2>Recent tool calls</h2><ul>${events.map(r=>`<li>${esc(new Date(r.at).toISOString())} · ${esc(r.client?.startsWith('https://')?'Asserted handle: '+(r.person??'(none)'):(r.name??(r.person?.startsWith('office-')?'Owner browser':r.person)??'Public'))} · ${esc(names.get(r.client)??'Anonymous')} · ${esc(r.tool)} · ${esc(r.outcome)}</li>`).join('')}</ul><nav>${page?`<a href="?page=${page-1}">Newer</a>`:''}${rows.length===100||events.length===100?`<a href="?page=${page+1}">Older</a>`:''}</nav>`);
       }
       return json({error:'not found'},404);
     }},
@@ -235,5 +265,10 @@ export async function remoteMcp(request,env,ctx,{catalogueOf,definitions=[]}) {
     // Public tools remain available without an account. Clients can discover OAuth metadata directly.
     return api(request,scoped,ctx);
   }
-  return provider.fetch(request,scoped,ctx);
+  const response=await provider.fetch(request,scoped,ctx);
+  if(path==='/.well-known/oauth-authorization-server'&&response.ok){
+    const metadata=await response.json();
+    return json({...metadata,grant_types_supported:[...new Set([...(metadata.grant_types_supported??[]),'client_credentials'])],token_endpoint_auth_methods_supported:[...new Set([...(metadata.token_endpoint_auth_methods_supported??[]),'private_key_jwt'])]});
+  }
+  return response;
 }

package/worker/room.mjs

@@ -272,6 +272,7 @@ export class NetRoom {
     this.lastSnap = snap;
     if (!c) { const sentAt = (this.snapAt ??= new Map()); sentAt.set(snap.k, now); if (sentAt.size > 128) sentAt.delete(sentAt.keys().next().value); }
     if (c) c.lastSnapAt = now;
+    this.retryBrowserSeats(c);
     this.stats.snaps += 1;
     this.snapTimes.push(now);
     while (this.snapTimes.length && this.snapTimes[0] < now - 1000) this.snapTimes.shift();
@@ -388,6 +389,34 @@ export class NetRoom {
     this.tellWatchers();
   }
 
+  /** A browser can hear joins before its world exists. Its roster acknowledges
+   * bodies, so re-announce missing connected seats until it acknowledges them.
+   * Use the existing join protocol for games bundling older netplay clients.
+   * Snapshot traffic retries even if the boot roster was published too early;
+   * retries back off from 1 to 30 seconds and stop after eight attempts.
+   * An exhausted peer is logged once; retries are never sent to replicas.
+   */
+  retryBrowserSeats(host) {
+    if (!host || this.server || this.rules || host.id !== this.hostId || !this.lastRoster) return;
+    const seated = new Set(this.lastRoster.filter(s => !s.bot || s.agent).flatMap(s => [s.seat, s.agent?.seat]));
+    const now = this.now();
+    for (const peer of this.live()) {
+      if (peer.id === host.id || peer.seat === null || peer.watch) continue;
+      if (seated.has(peer.seat)) { peer.seatRetry = null; continue; }
+      const retry = peer.seatRetry?.host === host.id ? peer.seatRetry : null;
+      if (retry && now - retry.at < Math.min(1000 * 2 ** (retry.tries - 1), 30000)) continue;
+      if (retry?.tries >= 8) {
+        if (!retry.exhausted) {
+          retry.exhausted = true;
+          this.log({ ev: 'seat-retry-exhausted', room: this.code, id: peer.id, seat: peer.seat, host: host.id, tries: retry.tries });
+        }
+        continue;
+      }
+      peer.seatRetry = { host: host.id, at: now, tries: (retry?.tries ?? 0) + 1 };
+      this.send(host, { t: 'join', peer: this.peer(peer) });
+    }
+  }
+
   hostCaps(c, m) {
     // The host's game reads the dial and/or moves agents' bodies (section 17): the office and the shell say so.
     if (!Array.isArray(m.caps)) return;

package/worker/routes.mjs

@@ -56,7 +56,7 @@ export default async function route(request, env, ctx) {
 
   if (path === '/_studio/office/functions') return (await import('./functions.mjs')).functionsRoute(request,env,await getAll());
 
-  if (path === '/mcp' || path === '/mcp/auth' || path.startsWith('/hooks/tools/') || path.startsWith('/oauth/') || path.startsWith('/.well-known/oauth-') || path === '/_studio/office/connections') {
+  if (path === '/.well-known/jwks.json' || path === '/mcp' || path === '/mcp/auth' || path.startsWith('/hooks/tools/') || path.startsWith('/hooks/studios/') || path.startsWith('/oauth/') || path.startsWith('/.well-known/oauth-') || path === '/_studio/office/connections') {
     const { remoteMcp } = await import('./mcp.mjs');
     return remoteMcp(request, env, ctx, { catalogueOf: getAll, definitions: await studioTools() });
   }

package/worker/studios-auth.mjs

@@ -0,0 +1,71 @@
+import {decode,originKey,verifyBytes} from './studios-keys.mjs';
+import {oauthStorage,audit} from './mcp-store.mjs';
+import {studioOrigin} from './studios-client.mjs';
+const hash=async text=>Array.from(new Uint8Array(await crypto.subtle.digest('SHA-256',new TextEncoder().encode(text))),b=>b.toString(16).padStart(2,'0')).join('');
+const json=(data,status=200)=>Response.json(data,{status,headers:{'cache-control':'no-store','pragma':'no-cache',...(status===401?{'www-authenticate':'Bearer'}:{})}});
+export async function boundedBody(request,maxBytes=65536) {
+ const reader=request.body?.getReader();if(!reader)return '';
+ const chunks=[];let bytes=0;
+ try{while(true){const {done,value}=await reader.read();if(done)break;bytes+=value.byteLength;if(bytes>maxBytes)throw new Error('Request size exceeded');chunks.push(value);}}
+ catch(error){await reader.cancel();throw error;}finally{reader.releaseLock();}
+ const body=new Uint8Array(bytes);let offset=0;for(const chunk of chunks){body.set(chunk,offset);offset+=chunk.length;}return new TextDecoder('utf-8',{fatal:true}).decode(body);
+}
+export function studioRegistration(cat,origin){
+ for(const rule of Object.values(cat.studio?.mcp?.studios?.inbound??{})){
+  try{if(studioOrigin(rule.origin,{allowPrivate:rule.allowPrivate===true})===origin&&rule.enabled!==false)return rule;}catch{/* Invalid configuration is denied. */}
+ }
+ return null;
+}
+export async function setStudioPolicy(env,origin,allow){
+ origin=studioOrigin(origin,{allowPrivate:true});
+ await oauthStorage(env.DB).put('studio-policy:'+origin,JSON.stringify({allow:allow===true}));
+}
+export async function studioPolicy(env,cat,origin){
+ const rule=studioRegistration(cat,origin);
+ return rule&&(await oauthStorage(env.DB).get('studio-policy:'+origin,'json'))?.allow===true?rule:null;
+}
+/** RFC 7523 client authentication. Only the claimed origin's HTTPS JWKS can prove it. */
+export async function studioToken(request,env,cat,options={}) {
+ if(request.method!=='POST')return null;
+ let form;try{form=new URLSearchParams(await boundedBody(request.clone(),8192));}catch{return json({error:'invalid_request'},400);}
+ if(form.get('grant_type')!=='client_credentials')return null;
+ const receiver=new URL(request.url).origin;
+ if(!receiver.startsWith('https:')||form.getAll('resource').length!==1||form.get('resource')!==receiver+'/mcp')return json({error:'invalid_target'},400);
+ if(form.has('scope')&&form.get('scope')!=='studio')return json({error:'invalid_scope'},400);
+ let origin,stage='assertion';
+ try{
+  for(const name of ['client_assertion','client_assertion_type','client_id'])if(form.getAll(name).length!==1)throw Error();
+  if(form.get('client_assertion_type')!=='urn:ietf:params:oauth:client-assertion-type:jwt-bearer')throw Error();
+  const parts=form.get('client_assertion').split('.');if(parts.length!==3)throw Error();
+  const header=decode(parts[0]),claims=decode(parts[1]);origin=claims.iss;
+  stage='policy';
+  const rule=await studioPolicy(env,cat,origin);if(!rule)throw Error();
+  stage='claims';
+  if(studioOrigin(origin,{allowPrivate:rule.allowPrivate===true})!==origin||form.get('client_id')!==origin||claims.sub!==origin||claims.aud!==receiver+'/oauth/token'||header.alg!=='EdDSA'||header.jku||header.jwk||header.crit)throw Error();
+  const now=Math.floor(Date.now()/1000);
+  if(!Number.isSafeInteger(claims.exp)||!Number.isSafeInteger(claims.iat)||claims.iat>now+30||claims.iat<now-300||claims.exp<=now||claims.exp>claims.iat+300||claims.nbf!==undefined&&(!Number.isSafeInteger(claims.nbf)||claims.nbf>now)||typeof claims.jti!=='string'||! /^[A-Za-z0-9_-]{1,128}$/.test(claims.jti))throw Error();
+  stage='key discovery';
+  const key=await originKey(env,origin,header.kid,{...options,allowPrivate:rule.allowPrivate===true});
+  stage='signature';
+  if(!await verifyBytes(key,parts[2],parts.slice(0,2).join('.')))throw Error();
+  stage='replay';
+  const used=await env.DB.prepare('INSERT OR IGNORE INTO mcp_kv(key,value,expires) VALUES(?1,?2,?3) RETURNING key').bind('studio-jti:'+await hash(JSON.stringify([origin,claims.jti])),'1',claims.exp).first();if(!used)throw Error();
+ }catch{
+  await audit(env,{client:typeof origin==='string'?origin.slice(0,2048):null},'studio-auth','denied:'+stage);
+  return json({error:'invalid_client',error_description:'Studio authentication failed'},401);
+ }
+ const token='homie_studio_'+Array.from(crypto.getRandomValues(new Uint8Array(32)),b=>b.toString(16).padStart(2,'0')).join('');
+ const record={origin,resource:receiver+'/mcp',expires:Math.floor(Date.now()/1000)+300};
+ await oauthStorage(env.DB).put('studio-token:'+await hash(token),JSON.stringify(record),{expiration:record.expires});
+ return json({access_token:token,token_type:'Bearer',expires_in:300,scope:'studio'});
+}
+/** Live D1 policy is re-read on every dispatch; handles only separate booking ownership. */
+export async function studioCaller(request,env,cat) {
+ const token=/^Bearer (homie_studio_[a-f0-9]{64})$/.exec(request.headers.get('authorization')??'')?.[1];if(!token)return null;
+ const record=await oauthStorage(env.DB).get('studio-token:'+await hash(token),'json');
+ if(!record||record.expires<=Date.now()/1000||record.resource!==new URL(request.url).origin+'/mcp')return null;
+ const rule=await studioPolicy(env,cat,record.origin);if(!rule)return null;
+ let assertedHandle;try{const raw=request.headers.get('x-studio-asserted-handle');if(raw!==null){assertedHandle=decodeURIComponent(raw);if(!/^[A-Za-z0-9._@-]{1,128}$/.test(assertedHandle))return null;}}catch{return null;}
+ return {id:'studio:'+await hash(JSON.stringify([record.origin,assertedHandle??null])),owner:false,roles:{},client:record.origin,tools:rule.tools??[],
+  studio:{origin:record.origin,verified:true,method:'private_key_jwt'},...(assertedHandle===undefined?{}:{actingFor:{assertedHandle,verified:false,assertedBy:record.origin}})};
+}

package/worker/studios-client.mjs

@@ -0,0 +1,93 @@
+import {signAssertion} from './studios-keys.mjs';
+import {Client, StreamableHTTPClientTransport, PrivateKeyJwtProvider} from 'mcp-studio-client';
+export function studioOrigin(value,{allowPrivate=false}={}) {
+ const url=new URL(value);
+ if(url.protocol!=='https:'||url.username||url.password||url.pathname!=='/'||url.search||url.hash)throw new Error('Studio requires a bare HTTPS origin');
+ const host=url.hostname.toLowerCase().replace(/\.$/,'');
+ if(!allowPrivate&&(url.port||host.includes(':')||/^[0-9.]+$/.test(host)||!host.includes('.')||/(^|\.)(localhost|local|internal)$/.test(host)))throw new Error('Studio requires a public DNS origin on port 443');
+ return url.origin;
+}
+/** Bound bytes before SDK parsing; the SDK owns JSON-RPC, SSE and OAuth. */
+export function boundedStudioFetch(origin,signal,{maxBytes=1024*1024,fetchFn=globalThis.fetch.bind(globalThis)}={}) {
+ return async(input,init)=>{
+  const request=new Request(input,init),url=new URL(request.url);
+  if(url.origin!==origin||url.username||url.password)throw new Error('Studio request escaped its origin');
+  const response=await fetchFn(new Request(request,{redirect:'manual',signal:AbortSignal.any([signal,request.signal])}));
+  if(response.status>=300&&response.status<400){await response.body?.cancel();throw new Error('Studio redirects refused');}
+  if(Number(response.headers.get('content-length'))>maxBytes){await response.body?.cancel();throw new Error('Studio response size exceeded');}
+  if(!response.body)return response;
+  let bytes=0;
+  const body=response.body.pipeThrough(new TransformStream({transform(chunk,controller){bytes+=chunk.byteLength;if(bytes>maxBytes)throw new Error('Studio response size exceeded');controller.enqueue(chunk);}}));
+  return new Response(body,{status:response.status,statusText:response.statusText,headers:response.headers});
+ };
+}
+export function studioResult(result,source={origin:null,authenticated:false}) {
+ let data=result.structuredContent;
+ if(data===undefined&&result.content?.length===1&&result.content[0].type==='text'){
+  try{const parsed=JSON.parse(result.content[0].text);if(parsed?.kind==='untrusted-tool-data')data=parsed;}catch{/* Ordinary MCP text remains content. */}
+ }
+ if(data?.kind==='untrusted-tool-data'&&Object.hasOwn(data,'data'))data=data.data;
+ return {source,untrusted:true,isError:result.isError===true,...(data===undefined?{}:{data}),content:result.content??[]};
+}
+export function outboundRules(cat) {
+ const rules=new Map();
+ for(const [key,rule] of Object.entries(cat.studio?.mcp?.studios?.outbound??{})) {
+  const origin=studioOrigin(key,{allowPrivate:rule.allowPrivate===true});
+  if(rules.has(origin)||rule.origin!==undefined&&studioOrigin(rule.origin,{allowPrivate:rule.allowPrivate===true})!==origin)throw new Error('Studio configuration origin mismatch');
+  rules.set(origin,rule);
+ }
+ return rules;
+}
+export function studiosClient(env,cat,definition,{fetchFn=globalThis.fetch.bind(globalThis),origin:ownOrigin}={}) {
+ const providers=new Map(),discovery=new Map();
+ const rules=outboundRules(cat);
+ const run=async(origin,operation,options={})=>{
+  const candidate=new URL(origin).origin,rule=rules.get(candidate);
+  origin=studioOrigin(origin,{allowPrivate:rule?.allowPrivate===true});
+  if(!rule)throw new Error('Studio destination is not configured');
+  if(rule&&!rule.tools?.includes(definition.name))throw new Error('Studio connection not delegated to this tool');
+  const controller=new AbortController(),timer=setTimeout(()=>controller.abort(new Error('Studio request timed out')),10000);
+  const client=new Client({name:'homie-studio',version:'1'});
+  try{
+   const authenticated=rule.anonymous!==true;
+   let authProvider;
+   if(authenticated){
+    if(!ownOrigin||!env.STUDIO_SIGNING_KEY)throw new Error('Studio signing key unavailable');
+    authProvider=providers.get(origin);
+    if(!authProvider){
+     authProvider=new PrivateKeyJwtProvider({clientId:ownOrigin,privateKey:{},algorithm:'EdDSA',scope:'studio',expectedIssuer:origin});
+     authProvider.addClientAuthentication=async(_headers,params,url)=>{
+      if(String(url)!==origin+'/oauth/token')throw new Error('Unexpected studio token endpoint');
+      params.set('client_id',ownOrigin);
+      params.set('client_assertion_type','urn:ietf:params:oauth:client-assertion-type:jwt-bearer');
+      params.set('client_assertion',await signAssertion(env,ownOrigin,String(url)));
+     };
+     providers.set(origin,authProvider);
+    }
+   }
+   const cachedFetch=async(request)=>{
+    const url=new URL(request.url),cacheable=request.method==='GET'&&url.pathname.startsWith('/.well-known/');
+    if(cacheable&&discovery.has(request.url))return discovery.get(request.url).clone();
+    const response=await fetchFn(request);
+    if(cacheable&&response.ok){const bounded=await (await boundedStudioFetch(origin,controller.signal,{fetchFn:async()=>response,maxBytes:32768})(request)).arrayBuffer();if(bounded.byteLength>32768)throw new Error('Discovery size exceeded');const saved=new Response(bounded,{status:response.status,headers:response.headers});discovery.set(request.url,saved);return saved.clone();}
+    return response;
+   };
+   const headers={};
+   if(options.assertedHandle!==undefined){
+    if(!authenticated||typeof options.assertedHandle!=='string'||! /^[A-Za-z0-9._@-]{1,128}$/.test(options.assertedHandle))throw new Error('Acting-for needs an authenticated studio and a handle of 1–128 characters');
+    headers['x-studio-asserted-handle']=encodeURIComponent(options.assertedHandle);
+   }
+   const transport=new StreamableHTTPClientTransport(new URL(authenticated?'/mcp/auth':'/mcp',origin),{fetch:boundedStudioFetch(origin,controller.signal,{fetchFn:async request=>cachedFetch(request)}),authProvider,requestInit:{headers}});
+   await client.connect(transport,{signal:controller.signal,timeout:10000});
+   return await operation(client,controller.signal,{origin,authenticated});
+  }finally{controller.abort();clearTimeout(timer);await client.close();}
+ };
+ return Object.freeze({
+  send:(origin,name,event)=>import('./studios-events.mjs').then(m=>m.sendStudioEvent(env,cat,ownOrigin,definition,origin,name,event,{fetchFn})),
+  listTools:(origin,options)=>run(origin,async(client,signal,source)=>{const page=await client.listTools(options?.cursor?{cursor:options.cursor}:{},{signal,timeout:10000});return {...page,source,untrusted:true,tools:page.tools.map(tool=>({...tool,source,untrusted:true,description:'[Untrusted remote description] '+(tool.description??'')}))};},options),
+  call:(origin,tool,args={},options)=>{
+   if(new TextEncoder().encode(JSON.stringify(args)).length>65536)return Promise.reject(new Error('Studio arguments size exceeded'));
+   return run(origin,async(client,signal,source)=>studioResult(await client.callTool({name:tool,arguments:args},{signal,timeout:10000}),source),options);
+  },
+ });
+}

package/worker/studios-events.mjs

@@ -0,0 +1,52 @@
+import {boundedBody,studioPolicy} from './studios-auth.mjs';
+import {studioOrigin,outboundRules,boundedStudioFetch} from './studios-client.mjs';
+import {signBytes,originKey,verifyBytes} from './studios-keys.mjs';
+import {publishBusinessEvent,BUSINESS_EVENT_MAX_BYTES} from './business-events.mjs';
+import {syncFunctions} from './functions.mjs';
+export async function signStudioEvent(env,source,name,{id,data},{now=Date.now}={}){
+ if(typeof id!=='string'||!/^[A-Za-z0-9_-]{1,128}$/.test(id))throw new Error('Stable event id required');
+ const body=JSON.stringify({eventId:id,name,timestamp:new Date(now()).toISOString(),source,data});
+ if(new TextEncoder().encode(body).length>BUSINESS_EVENT_MAX_BYTES)throw new Error('Studio event exceeds 8192 bytes');
+ const timestamp=String(Math.floor(now()/1000)),{kid,signature}=await signBytes(env,`${id}.${timestamp}.${body}`);
+ return {body,headers:{'content-type':'application/json','webhook-id':id,'webhook-timestamp':timestamp,'webhook-signature':'v1a,'+signature,'webhook-key-id':kid,'webhook-origin':source}};
+}
+export async function sendStudioEvent(env,cat,source,definition,origin,name,event,options={}) {
+ const rule=outboundRules(cat).get(new URL(origin).origin);origin=studioOrigin(origin,{allowPrivate:rule?.allowPrivate===true});
+ if(!rule?.tools?.includes(definition.name)||!rule.events?.includes(name)||!/^\/hooks\/studios\/[a-zA-Z0-9_-]+$/.test(rule.eventPath??''))throw new Error('Studio event destination not delegated');
+ if(rule.anonymous||!source)throw new Error('Studio event requires origin authentication');
+ const signed=await signStudioEvent(env,source,name,event,options);
+ const response=await boundedStudioFetch(origin,AbortSignal.timeout(10000),options)(origin+rule.eventPath,{method:'POST',...signed});
+ await response.body?.cancel();if(!response.ok)throw new Error('Studio event rejected ('+response.status+')');
+ return {id:event.id};
+}
+/** Standard Webhooks v1a: Ed25519 over id.timestamp.exact-body, keys fetched only from configured origin. */
+export async function receiveStudioEvent(request,env,cat,options={}) {
+ if(request.method!=='POST')return new Response(null,{status:405});
+ const id=new URL(request.url).pathname.slice('/hooks/studios/'.length),entries=cat.studio?.mcp?.studios?.inbound??{};
+ const configured=Object.hasOwn(entries,id)?entries[id]:null;
+ let origin,rule;try{origin=studioOrigin(configured?.origin,{allowPrivate:configured?.allowPrivate===true});if(configured.enabled!==false&&await studioPolicy(env,cat,origin))rule=configured;}catch{}
+ if(!rule)return new Response(null,{status:403});
+ let body;try{body=await boundedBody(request,BUSINESS_EVENT_MAX_BYTES);}catch{return new Response('Studio event exceeds 8192 bytes',{status:413});}
+ let event;
+ try{
+  const timestamp=request.headers.get('webhook-timestamp'),eventId=request.headers.get('webhook-id');
+  if(!/^\d+$/.test(timestamp??'')||Math.abs(Date.now()/1000-Number(timestamp))>300||!/^[A-Za-z0-9_-]{1,128}$/.test(eventId??'')||request.headers.get('webhook-origin')!==origin)throw Error();
+  const key=await originKey(env,origin,request.headers.get('webhook-key-id'),{...options,allowPrivate:rule.allowPrivate===true});
+  let valid=false;for(const part of (request.headers.get('webhook-signature')??'').split(' ').slice(0,8)){
+   const [version,signature]=part.split(',');if(version==='v1a'&&await verifyBytes(key,signature,`${eventId}.${timestamp}.${body}`)){valid=true;break;}
+  }
+  if(!valid)throw Error();event=JSON.parse(body);
+ }catch{return new Response(null,{status:401});}
+ if(!event||typeof event!=='object'||Array.isArray(event)||event.source!==origin||event.eventId!==request.headers.get('webhook-id')||typeof event.name!=='string')return new Response(null,{status:400});
+ const feed=Object.hasOwn(rule.events??{},event.name)?rule.events[event.name]:null;
+ if(!feed)return new Response(null,{status:403});
+ await syncFunctions(env);
+ try{await publishBusinessEvent(env,{}, {publish:[feed]},'@studio:'+origin,{feed,id:event.eventId,data:{sender:{origin,verified:true},data:event.data}});}
+ catch(error){
+  if(/already published/.test(error.message))return new Response(null,{status:409});
+  if(/8192 bytes/.test(error.message))return new Response(error.message,{status:413});
+  if(/schema|characters/.test(error.message))return new Response(null,{status:400});
+  throw error;
+ }
+ return new Response(null,{status:204});
+}

package/worker/studios-keys.mjs

@@ -0,0 +1,54 @@
+import {oauthStorage} from './mcp-store.mjs';
+import {studioOrigin,boundedStudioFetch} from './studios-client.mjs';
+const bytes=text=>new TextEncoder().encode(text);
+export const base64=value=>btoa(String.fromCharCode(...new Uint8Array(value)));
+export const unbase64=value=>Uint8Array.from(atob(value),c=>c.charCodeAt(0));
+const encode=value=>base64(bytes(JSON.stringify(value))).replaceAll('+','-').replaceAll('/','_').replace(/=+$/,'');
+export const decode=value=>JSON.parse(new TextDecoder().decode(unbase64(value.replaceAll('-','+').replaceAll('_','/'))));
+export function publicKeys(env){
+ const current=JSON.parse(env.STUDIO_SIGNING_KEY??'null');
+ const keys=[current,...JSON.parse(env.STUDIO_PREVIOUS_PUBLIC_KEYS??'[]')].filter(Boolean);
+ return {keys:keys.map(({kty,crv,x,kid})=>({kty,crv,x,kid,alg:'EdDSA',use:'sig'}))};
+}
+export async function signBytes(env,text){
+ const jwk=JSON.parse(env.STUDIO_SIGNING_KEY??'null');
+ if(!jwk?.kid||jwk.crv!=='Ed25519'||!jwk.d)throw new Error('Studio signing key unavailable');
+ const key=await crypto.subtle.importKey('jwk',{...jwk,alg:'EdDSA'},'Ed25519',false,['sign']);
+ return {kid:jwk.kid,signature:base64(await crypto.subtle.sign('Ed25519',key,bytes(text)))};
+}
+export async function signAssertion(env,origin,audience){
+ const jwk=JSON.parse(env.STUDIO_SIGNING_KEY??'null'),now=Math.floor(Date.now()/1000);
+ const text=encode({alg:'EdDSA',typ:'JWT',kid:jwk?.kid})+'.'+encode({iss:origin,sub:origin,aud:audience,iat:now,exp:now+60,jti:crypto.randomUUID()});
+ return text+'.'+(await signBytes(env,text)).signature.replaceAll('+','-').replaceAll('/','_').replace(/=+$/,'');
+}
+/** D1 cache and atomic per-origin fetch claim bound failures and unknown kids across requests. */
+export async function originKey(env,origin,kid,{fetchFn=globalThis.fetch.bind(globalThis),allowPrivate=false}={}){
+ origin=studioOrigin(origin,{allowPrivate});
+ if(typeof kid!=='string'||! /^[A-Za-z0-9_-]{1,128}$/.test(kid))throw new Error('Invalid key id');
+ const store=oauthStorage(env.DB),cacheKey='studio-jwks:'+origin,now=Date.now();
+ let cached=await store.get(cacheKey,'json');
+ if(!cached||cached.until<=now||!cached.keys.some(k=>k.kid===kid)&&now-cached.at>=60000){
+  // Claim before network I/O: concurrent misses cannot each fetch. Milliseconds
+  // in value enforce a full 60 seconds; expires is the storage cleanup bound.
+  const claim=await env.DB.prepare("INSERT INTO mcp_kv(key,value,expires) VALUES(?1,?2,?3) ON CONFLICT(key) DO UPDATE SET value=excluded.value,expires=excluded.expires WHERE CAST(mcp_kv.value AS INTEGER)<=?4 RETURNING key")
+   .bind('studio-jwks-fetch:'+origin,String(now+60000),Math.ceil((now+60000)/1000),now).first();
+  if(claim){
+   try{
+    const fetch=boundedStudioFetch(origin,AbortSignal.timeout(5000),{fetchFn,maxBytes:32768});
+    const response=await fetch(origin+'/.well-known/jwks.json');if(!response.ok)throw new Error('Studio keys unavailable');
+    const jwks=await response.json();
+    if(!Array.isArray(jwks?.keys)||jwks.keys.length>8||jwks.keys.some(k=>!k||typeof k!=='object'||k.d))throw new Error('Invalid studio keys');
+    cached={keys:jwks.keys,at:now,until:now+300000};
+   }catch{
+    // Preserve still-valid known keys when an unknown-kid refresh fails.
+    cached={keys:cached?.until>now?cached.keys:[],at:now,until:Math.max(cached?.until??0,now+60000)};
+   }
+   await store.put(cacheKey,JSON.stringify(cached),{expiration:Math.ceil(cached.until/1000)});
+  }
+ }
+ if(!cached||cached.until<=now)throw new Error('Studio keys unavailable');
+ const matches=cached.keys.filter(k=>k.kid===kid&&k.kty==='OKP'&&k.crv==='Ed25519'&&(!k.alg||k.alg==='EdDSA')&&(!k.use||k.use==='sig'));
+ if(matches.length!==1)throw new Error('Unknown studio key');
+ return crypto.subtle.importKey('jwk',matches[0],'Ed25519',false,['verify']);
+}
+export async function verifyBytes(key,signature,text){return crypto.subtle.verify('Ed25519',key,unbase64(signature.replaceAll('-','+').replaceAll('_','/')),bytes(text));}

package/worker/version.mjs

@@ -1,2 +1,2 @@
 /** The @homie-rocks/studio version this Worker code is (package.json's; a test keeps them equal). Cache-busts /_homie/site.js. */
-export const STUDIO_VERSION_TAG = '0.56.0';
+export const STUDIO_VERSION_TAG = '0.58.0';