@homie-rocks/studio 0.58.7 → 0.58.11

package/worker/move-drain.mjs

@@ -0,0 +1,47 @@
+import {LOBBY_SHARDS} from './lobby-shards.mjs';
+export const DRAIN_KEY='studio_move_drain';
+/** How long an isolate trusts its last reading of the drain flag. A move's census waits minutes after the drain
+ * starts (drainStatus), so an admission a few seconds late is still counted; steady seats and sockets cost no D1 read. */
+export const DRAIN_TTL_MS=5000;
+const readings=new WeakMap();
+export async function drainSince(env,{now=Date.now(),fresh=false}={}){
+ if(!env.DB)return null;
+ const cached=readings.get(env.DB);
+ if(!fresh&&cached&&now-cached.at<DRAIN_TTL_MS)return cached.since;
+ const db=env.DB.withSession?env.DB.withSession('first-primary'):env.DB;
+ const row=await db.prepare('SELECT value FROM meta WHERE key=?1').bind(DRAIN_KEY).first();
+ const at=Number(row?.value),since=Number.isSafeInteger(at)&&at>0?at:null;
+ readings.set(env.DB,{at:now,since});
+ return since;
+}
+export function isAdmission(request){const path=new URL(request.url).pathname;return request.headers.get('upgrade')?.toLowerCase()==='websocket'||/\/api\/(lobby|agents)(\/|$)/.test(path);}
+export const drainResponse=()=>Response.json({ok:false,error:'moving',message:'This studio is moving. Existing rooms can finish; please join again shortly.'},{status:503,headers:{'retry-after':'30','cache-control':'no-store'}});
+/** Read every shard directly: cached public summaries exclude private games and hide outages. */
+export async function drainStatus(env,cat,{now=Date.now()}={}){
+ const since=await drainSince(env,{fresh:true});if(!since)return {draining:false,drained:false};
+ let clients=0,pending=0,rooms=0;
+ for(const game of cat.games??[]){
+  const names=new Set();
+  let cursor='';
+  for(;;){
+   const rows=(await env.DB.prepare("SELECT key FROM meta WHERE key LIKE ?1 AND key>?2 ORDER BY key LIMIT 500").bind('move-room:'+game.id+':%',cursor).all()).results;
+   if(!Array.isArray(rows))throw Error('Room admission registry unavailable');
+   for(const row of rows)names.add(row.key.slice(('move-room:'+game.id+':').length));
+   if(rows.length<500)break;cursor=rows.at(-1).key;
+  }
+  for(let shard=0;shard<LOBBY_SHARDS;shard++){
+   const stub=env.LOBBY.get(env.LOBBY.idFromName(shard?`${game.id}/shard/${shard}`:game.id));
+   const r=await stub.fetch('https://lobby/rooms');if(!r.ok)throw Error('Cannot measure rooms while moving');
+   const body=await r.json();if(!Array.isArray(body.rooms))throw Error('Invalid room census');
+   for(const room of body.rooms)names.add(room.name);
+  }
+  for(const name of names){
+   const r=await env.TABLE.get(env.TABLE.idFromName(`${game.id}/${name}`)).fetch(`https://table/__move-status?game=${encodeURIComponent(game.id)}&room=${encodeURIComponent(name)}`);
+   if(!r.ok)throw Error('Cannot measure a room while moving');
+   const body=await r.json();
+   if(!Number.isSafeInteger(body.clients)||body.clients<0||!Number.isSafeInteger(body.pending)||body.pending<0)throw Error('Invalid room drain receipt');
+   clients+=body.clients;pending+=body.pending;rooms++;
+  }
+ }
+ return {draining:true,since,clients,pending,rooms,drained:now-since>=240000&&clients===0&&pending===0};
+}

package/worker/read-only.mjs

@@ -0,0 +1,113 @@
+/**
+ * READ-ONLY: the owner freezes the studio for a few minutes (a move to another host, maintenance) and nothing is lost.
+ * `homie-studio read-only on` sets the Worker secret STUDIO_READ_ONLY=1 (lib/read-only.mjs); `off` deletes it. A
+ * secret, not a var in wrangler.jsonc, because Cloudflare applies it to the live Worker at once with no build or
+ * deploy, and a deploy made while it is on keeps it on.
+ *
+ * While it is on:
+ * - every request other than GET, HEAD and OPTIONS answers 503 with Retry-After, `x-studio-read-only: 1` and
+ *   {ok:false,error:'read-only',message}; nothing it carried was applied, so the caller sends it again later;
+ * - reads keep answering, and every answer carries `x-studio-read-only: 1`; an HTML page shows a short notice;
+ *   `/api/games` says `readOnly: true`, so a tool checks the switch without sending a write;
+ * - D1 refuses writes for every request and every room: a read that would also have written (a visit counted, a
+ *   sign-in link redeemed) writes nothing, and a page that needed its write answers the same 503;
+ * - Stripe's webhook (POST /api/shop/hook) and the queued reconciliation of its events keep the whole database, so
+ *   a payment already made is still recorded and fulfilled;
+ * - live rooms keep playing (their sockets and matchmaking are GETs, their state is the room's own storage); what a
+ *   room would write to D1 waits: round records and function events stay in the room's outbox and are delivered once
+ *   the studio is open again, counters are retried with the next report;
+ * - scheduled maintenance is skipped for its tick, except the recovery of Stripe events; queued work other than
+ *   Stripe events is retried after the read-only window.
+ */
+export const READ_ONLY_HEADER = 'x-studio-read-only';
+export const READ_ONLY_RETRY_SECONDS = 120;
+export const READ_ONLY_MESSAGE = 'This studio is read-only for a few minutes. Nothing was changed: try again shortly.';
+const SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS']);
+/** Writes that must go on while the studio is read-only: a payment already made is fulfilled. */
+const WRITES_KEPT = new Set(['POST /api/shop/hook']);
+
+export const isReadOnly = (env) => /^(1|true|on)$/i.test(String(env?.STUDIO_READ_ONLY ?? '').trim());
+
+export class ReadOnlyError extends Error {
+  constructor() { super('read-only: this studio is not writing to its database for a few minutes'); this.name = 'ReadOnlyError'; }
+}
+
+export function readOnlyResponse(extra = {}) {
+  return new Response(`${JSON.stringify({ ok: false, error: 'read-only', message: READ_ONLY_MESSAGE })}\n`, {
+    status: 503,
+    headers: { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store', 'retry-after': String(READ_ONLY_RETRY_SECONDS), [READ_ONLY_HEADER]: '1', ...extra },
+  });
+}
+
+/** What a request may do while the studio is read-only: 'refuse' it, 'read' (D1 refuses writes), or 'write'. */
+export function readOnlyAccess(request, path) {
+  if (WRITES_KEPT.has(`${request.method} ${path}`)) return 'write';
+  return SAFE_METHODS.has(request.method) ? 'read' : 'refuse';
+}
+
+const WRITE_WORD = /\b(?:INSERT|UPDATE|DELETE|REPLACE|UPSERT|CREATE|DROP|ALTER|ATTACH|DETACH|VACUUM|REINDEX)\b/i;
+/** A statement that cannot change the database: SELECT, VALUES, a WITH that only selects, EXPLAIN, or a PRAGMA read. */
+export function readsOnly(sql) {
+  const text = String(sql ?? '');
+  if (/^\s*EXPLAIN\b/i.test(text)) return true;
+  if (/^\s*PRAGMA\b/i.test(text)) return !text.includes('=');
+  if (/^\s*(?:SELECT|VALUES)\b/i.test(text)) return true;
+  return /^\s*WITH\b/i.test(text) && !WRITE_WORD.test(text);
+}
+
+/**
+ * D1 that refuses writes: a write rejects with ReadOnlyError (a promise, as D1's own calls are) and never reaches the
+ * database; reads and every other property are D1's own. `refused` is called with each refused statement.
+ */
+export function readOnlyDatabase(DB, refused = () => {}) {
+  if (!DB) return DB;
+  const refuse = (sql) => { refused(sql); return Promise.reject(new ReadOnlyError()); };
+  const statement = (stmt, sql) => {
+    const guarded = (method) => async (...args) => readsOnly(sql) ? stmt[method](...args) : refuse(sql);
+    return { bind: (...args) => statement(stmt.bind(...args), sql), first: guarded('first'), all: guarded('all'), run: guarded('run'), raw: guarded('raw'), _sql: sql, _readOnly: stmt };
+  };
+  const own = {
+    prepare: (sql) => statement(DB.prepare(sql), sql),
+    batch: async (list) => {
+      const bad = list.find((s) => !s?._readOnly || !readsOnly(s._sql));
+      if (bad) return refuse(bad?._sql ?? 'UNKNOWN');
+      return DB.batch(list.map((s) => s._readOnly));
+    },
+    exec: async (sql, ...args) => readsOnly(sql) ? DB.exec(sql, ...args) : refuse(sql),
+    withSession: (...args) => readOnlyDatabase(DB.withSession(...args), refused),
+  };
+  return new Proxy(own, { get(target, key) {
+    if (key in target) return target[key];
+    const value = DB[key];
+    return typeof value === 'function' ? value.bind(DB) : value;
+  } });
+}
+
+/** A Durable Object's env: its D1 refuses writes while the studio is read-only. */
+export const readOnlyEnv = (env) => isReadOnly(env) && env.DB ? { ...env, DB: readOnlyDatabase(env.DB) } : env;
+
+/** Queued work while read-only: Stripe events are reconciled now; everything else comes back after the window. */
+export function heldBatch(batch) {
+  const now = [];
+  for (const message of batch.messages) {
+    if (message.body?.v === 1 && message.body.type === 'stripe.event') now.push(message);
+    else message.retry({ delaySeconds: READ_ONLY_RETRY_SECONDS });
+  }
+  return { ...batch, messages: now };
+}
+
+const NOTICE = '<aside role="status" data-studio-read-only style="position:fixed;z-index:2147483647;bottom:0;left:0;right:0;text-align:center;background:#1f2937;color:#f9fafb;padding:8px 12px;font:600 14px system-ui,sans-serif;pointer-events:none">Read-only for a few minutes: everything can be seen and played, and changes can be made again shortly.</aside>';
+/** Every answer says the studio is read-only; a page also shows it. */
+export async function markReadOnly(res) {
+  if (!res || res.status === 101 || res.webSocket) return res;
+  const headers = new Headers(res.headers);
+  headers.set(READ_ONLY_HEADER, '1');
+  let body = res.body;
+  if (/text\/html/i.test(headers.get('content-type') ?? '') && res.status < 300 && body) {
+    const html = await res.text();
+    body = /<\/body>/i.test(html) ? html.replace(/<\/body>(?![\s\S]*<\/body>)/i, `${NOTICE}</body>`) : html + NOTICE;
+    headers.delete('content-length');
+    headers.delete('etag');
+  }
+  return new Response(body, { status: res.status, statusText: res.statusText, headers });
+}

package/worker/routes.mjs

@@ -1,3 +1,4 @@
+import {drainStatus} from './move-drain.mjs';
 import {lobbyFor} from './lobby-shards.mjs';
 /** Route dispatch; large interfaces and tool runtimes load at their own entry points. */
 import {customRoute} from './custom-routes.mjs';
@@ -19,6 +20,7 @@ import { isLoungePath, loungeRoutes } from './lounge.mjs';
 import { doorPage, serverPage, serversPage } from './site.mjs';
 import { isLocalOrigin, qrSvg } from './qr.mjs';
 import { gateFor } from './gate-routing.mjs';
+import { isReadOnly } from './read-only.mjs';
 
 import { SITE_JS, atomFeed, creditsPage, customPage, gameCover, gameLanding, gamesPage, homeLd, homePage, jsonFeed, landingLd, mediaIndexPage, notFoundPage, postPage, postsPage, roomsPage, sectionsOf, songPage, videoPage, watchOf } from './site.mjs';
 import { cookieValues, countVisit, onlyOf, ownerAllowed, playedByGame, playedThisWeek, rangeOf, readStats } from './stats.mjs';
@@ -32,6 +34,8 @@ import { ldScript, studioNode } from './schema.mjs';
 import { licenseOf } from './license.mjs';
 import { isPartsPath, partsRoutes, withPartsBand } from './parts.mjs';
 import { GAME_ID, POST_SLUG, BROWSER_KEY, json, sellingShop, availableShellShop, postsOf, directoryOf, claimOf, named, roomsOf, MEDIA_SLUG, assetWithRange, mediaObject, ASSET_CACHE, heldInR2, mediaRow, chatWho, reportAllowed, notAHomie, gameDocument, gameAsset, shareDaily, mediaBeat, studioTools, serverLive, weekOf, fallback } from './runtime-support.mjs';
+/** Rooms whose admission row (move-drain.mjs) this isolate already wrote. */
+const REGISTERED_ROOMS = new Set();
 export default async function route(request, env, ctx) {
   const url = new URL(request.url);
   const path = url.pathname;
@@ -156,9 +160,11 @@ export default async function route(request, env, ctx) {
       ...(shopOf(cat)?.open ? { shop: { open: true, till: shopOf(cat).till, currency: shopOf(cat).currency, page: `${url.origin}/shop/` } } : {}),
     }, 200, { 'access-control-allow-origin': '*' });
   }
+  if (path === '/api/move-status' && read) return json(await drainStatus(env,await getAll()),200,{'cache-control':'no-store'});
   if (path === '/api/games') {
     const cat = await getCat();
-    return json({ studio: cat.studio, games: (cat.games ?? []).map(g => g.room?.host === 'server' && !hostedGame(g.id) ? { ...g, rulesError: RULES_WIRING_MESSAGE } : g), live: (await roomsOf(env, cat.games ?? [])).live });
+    // readOnly: the owner's switch (worker/read-only.mjs), here so a tool can check it without sending a write.
+    return json({ studio: cat.studio, readOnly: isReadOnly(env), games: (cat.games ?? []).map(g => g.room?.host === 'server' && !hostedGame(g.id) ? { ...g, rulesError: RULES_WIRING_MESSAGE } : g), live: (await roomsOf(env, cat.games ?? [])).live });
   }
   if (path === '/api/rooms') {
     if(!read)return json({ok:false,error:'method'},405);
@@ -639,6 +645,11 @@ export default async function route(request, env, ctx) {
       // one; none on a kids server, none for an AI or a watcher.
       const pid = !ag && !w && sub === '__net' ? parts.find((x) => x.startsWith('p-'))?.slice(2) : null;
       const badge = pid ? await roomBadge(env, cat, pid, { kids: pol.kids }) : null;
+      // Keep an admission registry independent of expiring lobby reports. A later move
+      // must inspect even a quiet named room and its durable outboxes.
+      // Once per room in this isolate: the row is idempotent, so later sockets to the same room cost no D1 write.
+      const roomKey='move-room:'+game+':'+room;
+      if(env.DB&&!isReadOnly(env)&&!REGISTERED_ROOMS.has(roomKey)){await env.DB.prepare("INSERT OR IGNORE INTO meta(key,value) VALUES(?1,'1')").bind(roomKey).run();REGISTERED_ROOMS.add(roomKey);}
       const stub = sub === '__net' ? gateFor(env, game, room, max, b) : env.TABLE.get(env.TABLE.idFromName(`${game}/${room}`));
       // Revision 9 (NETPLAY.md sections 22 and 23): the build that is live now (`cur`, always said, empty when the game
       // names none), the build this socket's page was served with (`gv`, from the socket's own address), and the game's

package/worker/stream-objects.mjs

@@ -1,6 +1,7 @@
+import {readOnlyEnv} from './read-only.mjs';
 /** Streams use independent namespaces so subscribers never warm matchmaking state. */
 export class AppRecordHub {
-  constructor(ctx, env) { this.ctx=ctx; this.env=env; }
+  constructor(ctx, env) { this.ctx=ctx; this.env=readOnlyEnv(env); }
   async records(){const {AppRecordStreams}=await import('./app-streams.mjs');return this.streams??=new AppRecordStreams(this.env,this.ctx);}
   async fetch(request) {
     const streams=await this.records();
@@ -17,7 +18,7 @@ export class AppRecordHub {
   async webSocketError(socket){return (await this.records()).closeSocket(socket);}
 }
 export class EventHub {
-  constructor(ctx, env) { this.ctx=ctx; this.env=env; }
+  constructor(ctx, env) { this.ctx=ctx; this.env=readOnlyEnv(env); }
   async fetch(request) {
     const {EventStreams}=await import('./event-resources.mjs');
     this.streams??=new EventStreams(this.env,this.ctx);

package/worker/table.mjs

@@ -22,6 +22,7 @@ import {holders,regateArgs,verifyControl} from './office.mjs';
 
 import {json} from './responses.mjs';
 import {catalogue} from './catalogue.mjs';
+import {readOnlyEnv} from './read-only.mjs';
 
 import {ROOM_ALARM_MS,ROOM_PAUSE_MS,roomEndAt} from './room-lifecycle.mjs';
 
@@ -29,7 +30,8 @@ export class Table {
   constructor(ctx, env) {
     this.ctx = ctx;
     this.watchSockets = new WatchSockets(ctx);
-    this.env = env;
+    // Read-only (worker/read-only.mjs): the room plays on; its D1 writes wait in its outbox or for the next report.
+    this.env = readOnlyEnv(env);
     this.room = null;
     this.timer = null;
     this.saved = null;
@@ -1087,6 +1089,13 @@ export class Table {
     }
     // The back office (worker/office.mjs), from the studio's Worker only: the room as its owner sees it, and the
     // owner's signed controls, which this room verifies before it applies one (NETPLAY.md section 15).
+    if (url.pathname === '/__move-status') {
+      await this.flushRoundRecords();await this.flushFunctionEvents();
+      const sql=this.ctx.storage.sql;
+      let pending=0;
+      for(const name of ['round_outbox','function_outbox'])if(sql?.exec("SELECT name FROM sqlite_master WHERE name=?",name).toArray().length)pending+=Number(sql.exec('SELECT COUNT(*) AS n FROM '+name).toArray()[0].n);
+      return json({clients:room.live().length,pending});
+    }
     if (url.pathname === '/__facts') return json({ ...room.officeFacts(), gates: [...(this.gateMetrics?.values() ?? [])], durability: this.storageHealth ?? { ok: true }, ...(this.house ? { brains: this.house.facts() } : {}) });
     // A chat line as the room keeps it (section 19), for a report: the Worker files the room's own copy, never a reporter's.
     if (url.pathname === '/__chat') {

package/worker/version.mjs

@@ -1,2 +1,2 @@
 /** The @homie-rocks/studio version this Worker code is (package.json's; a test keeps them equal). Cache-busts /_homie/site.js. */
-export const STUDIO_VERSION_TAG = '0.58.7';
+export const STUDIO_VERSION_TAG = '0.58.11';