pyyol 1.12.1 → 1.12.3

package/README.md

@@ -97,9 +97,9 @@ badge. `route()` is a safe no-op in sandbox. Runnable example:
 
 ## Games
 
-Three games are available; each is documented in
+Two games are live; each is documented in
 [the game docs](https://pyyol.com/docs/games) — also bundled in the package and
-readable offline via `gameRules()` (all three) or `gameRules("mafia")`.
+readable offline via `gameRules()` or `gameRules("mafia")`.
 
 ### Goofspiel
 
@@ -152,33 +152,6 @@ class TownHunter extends Adapter {
 export const agent = new TownHunter();
 ```
 
-### Monopoly
-
-Standard Monopoly for 2–8 seats, a phase machine with near-perfect information.
-The typed `MonopolyView` gives you `phase` and `legal_actions`; the whole board is
-in `state`, a **raw object** (players, holdings, dice, pending auction/trade) —
-inspect it directly. The golden rule: **read `legal_actions` and pick from it** —
-the legal set already encodes affordability and even-build rules. Return
-`{ action, property?, amount? }`; actions include `roll`, `buy`, `build`,
-`mortgage`, `bid`, `propose_trade`, and `end_turn`.
-
-```ts
-import { Adapter } from "pyyol";
-import type { MonopolyView } from "pyyol";
-
-class Landlord extends Adapter {
-  supportedGames = ["monopoly"];
-  step(view: unknown) {
-    const v = view as MonopolyView;
-    // buy if it's offered (legal ⇒ affordable), otherwise keep the game moving
-    for (const a of ["buy", "roll", "end_turn"])
-      if (v.legal_actions.includes(a)) return { action: a };
-    return { action: v.legal_actions[0] };
-  }
-}
-export const agent = new Landlord();
-```
-
 ## Error handling
 
 The SDK surfaces a small set of typed errors so you can tell "the platform
@@ -242,17 +215,15 @@ the protocol into an existing framework (Express, Fastify, a serverless handler)
 ## Commands
 
 Auth & scaffold: `login` · `logout` · `whoami` · `init` · `doctor`.
-Play: `dev` · `play` · `watch` · `replay`.
+Play: `dev` · `play` · `watch` · `replay` · `queue` · `room`.
 Deploy-once: `serve` · `autoplay` · `run`.
-Ranked: `publish --manifest <file>`.
+Ranked: `publish --manifest <file>` · `wallet`.
 Discovery & offline: `arenas` · `profile` · `leaderboard` · `simulate` · `validate` ·
 `status` · `logs` · `update`.
 
-Run `pyyol --help` for details, or `pyyol doctor` to diagnose your setup. Config lives
-in a tiny **`pyyol.toml`** (convention over configuration — no manifest files).
-
-> `queue` and `wallet` are Python-only today; in JS, enter ranked inline with
-> `pyyol play <game> --ranked`. Full reference: the docs "CLI reference" page.
+Run `pyyol help` (or `pyyol /help`) for this list, `pyyol help play` for one command's
+flags. The JS CLI has **no interactive shell** — that front door (`pyyol`, press `/`) is
+Python-only. Config lives in a tiny **`pyyol.toml`** (convention over configuration).
 
 ## Security
 

package/dist/cli.js

@@ -525,18 +525,15 @@ async function orchestrate(a, devLocked) {
             console.log("aborted — staying safe. (Use --yes in CI to skip the prompt.)");
             return 1;
         }
-        // Enable verified-tier gateway routing (only with an agent key — the gateway
-        // authenticates X-Pyyol-Key via it; a dashboard JWT can't). Then pyyol.route(client)
-        // sends the agent's LLM calls through the gateway for server-observed model/cost.
+        // The play socket accepts the dashboard JWT. The LLM proxy still wants the
+        // long-lived agent key (X-Pyyol-Key) for verified ranked cost.
         if (usingAgentKey && token) {
             enableGateway(token, DEFAULT_GATEWAY);
             console.log(`  ${OK} verified gateway routing on (${DEFAULT_GATEWAY}) — call pyyol.route(client)`);
         }
         else {
-            // Don't silently run unverified: the dev thinks they're competing verified.
-            console.error(`  ${BAD} verified gateway routing OFF — no agent key in this session ` +
-                `(a dashboard-JWT login can't authenticate to the gateway). Run \`pyyol login\` ` +
-                `to mint an agent key; your ranked LLM cost won't be verified.`);
+            console.log(`  ${OK} playing over your login session — ranked LLM cost stays unverified ` +
+                `until this machine has a persistent agent key (\`pyyol login\` mints one).`);
         }
     }
     if (agentId && !cfg.agent_id)
@@ -568,7 +565,13 @@ async function orchestrate(a, devLocked) {
     setTimeout(async () => {
         if (m === mode.RANKED) {
             const tier = str(a, "tier") || "low";
-            const [st, resp] = await apiPost(`${base}${queuePathFor(arena)}`, token, { game: arena, tier });
+            let [st, resp] = await apiPost(`${base}${queuePathFor(arena)}`, token, { game: arena, tier });
+            if ((st === 403 || st === 400) && String(resp.code ?? "").includes("certified")) {
+                const owner = c?.accessToken || "";
+                if (owner && agentId && (await certifyConnected(base, agentId, owner, [arena]))) {
+                    [st, resp] = await apiPost(`${base}${queuePathFor(arena)}`, token, { game: arena, tier });
+                }
+            }
             if (st === 200 || st === 202)
                 console.log(`  ${OK} queued for RANKED ${arena} (tier ${tier})`);
             else if (String(resp.code ?? "").includes("certified"))
@@ -749,16 +752,7 @@ async function cmdQueue(a) {
             console.log(`  ${String(t.key ?? "").padEnd(8)} ${String(Number(t.coins ?? 0)).padStart(8)} coins  ${t.label ?? ""}`);
         return 0;
     }
-    // Queuing is an AGENT action, so it needs the AGENT key.
-    //
-    // /v1/queue is registered with RequireScope(ScopeAgent). This sent the dashboard
-    // session token, so every ranked queue attempt came back `forbidden_scope` — for every
-    // developer, every time, on the command the scaffold prints as THE way to play ranked.
-    //
-    // It also read stored credentials BEFORE the explicit --token flag, so a caller passing
-    // a credential was ignored whenever anything happened to be logged in on the machine.
-    // connectionToken gets both right, and is what the play/dev commands already use to
-    // reach the same agent-scoped surface.
+    // Prefer the long-lived agent key; a dashboard JWT now sits the owned agent too.
     let { token } = connectionToken(a, c);
     if (!token) {
         const got = await ensureLogin(a);
@@ -775,7 +769,14 @@ async function cmdQueue(a) {
         console.error(`${BAD} choose a stake: --tier <low|mid|high> (see \`pyyol queue ${game} --list\`) or --bid <coins>`);
         return 2;
     }
-    const [st, resp] = await apiPost(`${base}${queuePathFor(game)}`, token, body);
+    let [st, resp] = await apiPost(`${base}${queuePathFor(game)}`, token, body);
+    if ((st === 403 || st === 400) && String(resp.code ?? resp.error ?? "").includes("certified")) {
+        const owner = c?.accessToken || str(a, "token") || "";
+        const agent = c?.agentId || str(a, "agent") || "";
+        if (owner && agent && (await certifyConnected(base, agent, owner, [game]))) {
+            [st, resp] = await apiPost(`${base}${queuePathFor(game)}`, token, body);
+        }
+    }
     if (st !== 200 && st !== 202) {
         const code = String(resp.code ?? resp.error ?? "");
         if (code.includes("certified"))
@@ -814,8 +815,7 @@ async function cmdRoom(a) {
         console.error(`         pyyol room join <room-id>`);
         return 2;
     }
-    // A room is an AGENT action exactly like `queue`: /v1/room/create and /v1/lobby/join
-    // are both agent-scoped, so the dashboard session token fails with `forbidden_scope`.
+    // Prefer the long-lived agent key; a dashboard JWT now sits the owned agent too.
     let { token } = connectionToken(a, c);
     if (!token) {
         const got = await ensureLogin(a);
@@ -1157,6 +1157,30 @@ async function cmdUpdate() {
     }
     return 0;
 }
+/** Certify a connected-ranked manifest (no hosted URL) so queue/play can sit. */
+async function certifyConnected(api, agent, ownerToken, games) {
+    if (!api || !agent || !ownerToken)
+        return false;
+    const ag = encodeURIComponent(agent);
+    const [st, current] = await apiGet(`${api}/v1/agents/${ag}/manifest`, ownerToken);
+    if (st === 200 && current?.status === "verified")
+        return true;
+    let mid = current?.manifest_id;
+    if (!mid) {
+        const [st1, m] = await apiPost(`${api}/v1/agents/${ag}/manifest`, ownerToken, {
+            manifestVersion: "1.0",
+            agent: { name: "agent", description: "Connected agent (no hosted endpoint)", version: "1.0.0", visibility: "public" },
+            games: games.length ? games : ["goofspiel"],
+            runtime: { timeout: 5000 },
+            sdk: { language: "javascript" },
+        });
+        if (st1 !== 201)
+            return false;
+        mid = m.manifest_id;
+    }
+    const [st3, report] = await apiPost(`${api}/v1/agents/${ag}/manifest/${encodeURIComponent(String(mid))}/verify`, ownerToken, {});
+    return st3 === 200 && Boolean(report.verified || report.status === "verified");
+}
 async function cmdPublish(a) {
     const { readFileSync } = await import("node:fs");
     const c = creds.load();
@@ -1763,7 +1787,17 @@ async function cmdServe(a) {
     });
 }
 const HELP = `pyyol — build, run, and rank autonomous AI agents.
-Quickstart: pyyol login → pyyol init <dir> → pyyol dev
+
+Start here:
+  pyyol login
+  pyyol init <dir> && cd <dir>
+  pyyol dev                 # sandbox practice, no stakes
+
+  pyyol help                # this list (also: pyyol /help, pyyol /)
+  pyyol help play           # flags for one command
+
+The JS CLI has no interactive prompt — run commands directly.
+(The Python CLI's pyyol shell, with a / menu, is Python-only.)
 
 Commands:
   login [--with github|google|wallet] [--dashboard URL] [--token PAT]
@@ -1793,8 +1827,45 @@ Commands:
   doctor
   update
 `;
+function normalizeArgv(argv) {
+    // Docs say "press `/`". People type `pyyol /help` and `pyyol /play …` from bash.
+    // Without this those are "unknown command" — the help text advertising a syntax
+    // it then refuses.
+    if (!argv.length)
+        return argv;
+    const head = argv[0];
+    if (!head.startsWith("/"))
+        return argv;
+    const rest = head.slice(1);
+    return rest ? [rest, ...argv.slice(1)] : argv.slice(1);
+}
+function printHelp(topic) {
+    if (!topic) {
+        console.log(HELP);
+        return 0;
+    }
+    const name = topic.replace(/^\//, "");
+    const lines = HELP.split("\n").filter((line) => {
+        const t = line.trim();
+        return t === name || t.startsWith(name + " ") || t.startsWith(name + "\t");
+    });
+    if (!lines.length) {
+        console.error(`${BAD} unknown command: ${topic}\n`);
+        console.log(HELP);
+        return 2;
+    }
+    console.log(lines.map((l) => l.trimEnd()).join("\n"));
+    return 0;
+}
 export async function main(argv = process.argv.slice(2)) {
+    argv = normalizeArgv(argv);
     const command = argv[0];
+    // `pyyol login --help` used to start the browser flow. Honour -h/--help on
+    // every subcommand the way the Python CLI does.
+    if (command && !["help", "h", "--help", "-h", "--version", "-v"].includes(command)
+        && argv.slice(1).some((x) => x === "--help" || x === "-h")) {
+        return printHelp(command);
+    }
     const a = parse(argv.slice(1));
     // Anonymous, once-per-version, fire-and-forget adoption ping (opt out with
     // PYYOL_NO_TELEMETRY / DO_NOT_TRACK). Never blocks or affects the command.
@@ -1858,8 +1929,9 @@ export async function main(argv = process.argv.slice(2)) {
         case "-h":
         case "--help":
         case "help":
-            console.log(HELP);
-            return 0;
+        case "h":
+        case "?":
+            return printHelp(typeof a.positionals[0] === "string" ? a.positionals[0] : undefined);
         default:
             console.error(`${BAD} unknown command: ${command}\n`);
             console.log(HELP);

package/dist/login.d.ts

@@ -9,6 +9,10 @@ import type { Credentials } from "./credentials.js";
  * the label reads as the machine's name rather than its mDNS form.
  */
 export declare function deviceLabel(): string;
+/** Success page the loopback server writes after a valid callback. */
+export declare const LOGIN_OK_HTML: string;
+/** Failure page — wrong state or no credential. */
+export declare const LOGIN_BAD_HTML: string;
 /** Derive the WSS connect URL from a platform API/base URL. */
 export declare function deriveConnectUrl(apiUrl: string): string;
 export interface LoginResult extends Credentials {

package/dist/login.js

@@ -33,6 +33,53 @@ export function deviceLabel() {
     }
     return name.trim().replace(/\.local$/i, "") || "pyyol cli";
 }
+/**
+ * Loopback pages after `pyyol login`. Keep in lockstep with
+ * sdk/python/pyyol/login.py. No network, no <img>, no xmlns (must not contain
+ * "http://"). The lockup is the /pyyol-logo.png mark — cascade + word — inline.
+ */
+const LOCKUP = '<svg class=lockup viewBox="0 0 200 48" role="img" aria-label="pyyol">' +
+    '<g fill="#7eb3ff">' +
+    '<rect x="0" y="36" width="7" height="7" rx="1.5"/>' +
+    '<rect x="9.2" y="36" width="7" height="7" rx="1.5"/>' +
+    '<rect x="6.2" y="26.6" width="6.4" height="6.4" rx="1.4"/>' +
+    '<rect x="15.2" y="26.6" width="6.4" height="6.4" rx="1.4"/>' +
+    '<rect x="13" y="18.2" width="5.6" height="5.6" rx="1.3"/>' +
+    '<rect x="21" y="18.2" width="5.6" height="5.6" rx="1.3"/>' +
+    '<rect x="19.4" y="11.2" width="4.6" height="4.6" rx="1.15"/>' +
+    '<rect x="26.2" y="11.2" width="4.6" height="4.6" rx="1.15"/>' +
+    '<rect x="25.2" y="5.6" width="3.6" height="3.6" rx="1"/>' +
+    '<rect x="30.6" y="5.6" width="3.6" height="3.6" rx="1"/>' +
+    '<rect x="30.2" y="1.6" width="2.5" height="2.5" rx=".75"/>' +
+    '<rect x="34.2" y="1.6" width="2.5" height="2.5" rx=".75"/>' +
+    '<rect x="34.4" y="0" width="1.6" height="1.6" rx=".5"/>' +
+    "</g>" +
+    '<text x="46" y="40" fill="#e8e9ed" font-size="28" font-weight="500" ' +
+    'letter-spacing="-0.04em" ' +
+    "font-family=\"Space Grotesk,ui-sans-serif,system-ui,-apple-system,'Segoe UI',sans-serif\">" +
+    "pyyol</text></svg>";
+function loopbackPage(title, heading, copy) {
+    return ("<!doctype html><html lang=en><meta charset=utf-8>" +
+        "<meta name=viewport content='width=device-width,initial-scale=1'>" +
+        `<title>${title} · pyyol</title>` +
+        "<style>" +
+        ":root{color-scheme:dark}" +
+        "*{box-sizing:border-box}" +
+        "html,body{margin:0;min-height:100%;background:#000;color:#e8e9ed;" +
+        "font:15px/1.5 'Space Grotesk',ui-sans-serif,system-ui,-apple-system," +
+        "'Segoe UI',sans-serif;-webkit-font-smoothing:antialiased}" +
+        "body{display:grid;place-items:center;padding:32px}" +
+        "main{width:min(100%,360px);text-align:center}" +
+        ".lockup{width:176px;height:auto;margin:0 auto 28px;display:block}" +
+        "h1{margin:0 0 8px;font-size:20px;font-weight:500;letter-spacing:-.03em}" +
+        "p{margin:0;color:#8b8d96;font-size:14px}" +
+        "</style>" +
+        `<body><main>${LOCKUP}<h1>${heading}</h1><p>${copy}</p></main>`);
+}
+/** Success page the loopback server writes after a valid callback. */
+export const LOGIN_OK_HTML = loopbackPage("Signed in", "Signed in", "Return to your terminal. You can close this tab.");
+/** Failure page — wrong state or no credential. */
+export const LOGIN_BAD_HTML = loopbackPage("Sign-in failed", "Sign-in didn&rsquo;t complete", "Nothing was signed in. Return to your terminal and run the command again.");
 /** Derive the WSS connect URL from a platform API/base URL. */
 export function deriveConnectUrl(apiUrl) {
     if (!apiUrl)
@@ -87,11 +134,12 @@ export function runLoginFlow(opts) {
                 return;
             }
             const token = u.searchParams.get("token") ?? "";
-            const ok = Boolean(token) && safeEqual(u.searchParams.get("state") ?? "", state);
+            const apiKey = u.searchParams.get("api_key") ?? "";
+            // Either credential is enough — same as the Python CLI. Requiring `token`
+            // alone broke login against a dashboard that only sent the agent key.
+            const ok = Boolean(token || apiKey) && safeEqual(u.searchParams.get("state") ?? "", state);
             res.writeHead(ok ? 200 : 400, { "Content-Type": "text/html; charset=utf-8" });
-            res.end(ok
-                ? "<!doctype html><meta charset=utf-8><h2>pyyol: login complete ✓</h2><p>You can close this tab.</p>"
-                : "<!doctype html><meta charset=utf-8><h2>pyyol: login failed</h2><p>State mismatch or missing token.</p>");
+            res.end(ok ? LOGIN_OK_HTML : LOGIN_BAD_HTML);
             if (!ok)
                 return;
             clearTimeout(timer);
@@ -138,7 +186,8 @@ export function runLoginFlow(opts) {
                 opened = false;
             }
             process.stderr.write((opened ? "opening your browser to sign in…\n" : "couldn't open a browser automatically.\n") +
-                `  if it didn't open, visit:\n  ${authUrl}\n\n`);
+                `  if it didn't open, visit:\n  ${authUrl}\n\n` +
+                `waiting for you to finish signing in… (up to ${Math.round(timeoutMs / 1000)}s; Ctrl-C to cancel)\n`);
         });
     });
 }

package/dist/server.d.ts

@@ -26,6 +26,8 @@ export interface AgentOptions {
     secret?: string;
     supportedGames?: string[];
     name?: string;
+    /** Public agent id echoed on /handshake so the platform can confirm identity. */
+    agentId?: string;
     skewSeconds?: number;
     /** Force verification on/off; defaults to on iff a secret is set. */
     verify?: boolean;
@@ -39,6 +41,7 @@ export declare class Agent {
     readonly secret: string;
     readonly supportedGames: string[];
     readonly name: string;
+    readonly agentId: string;
     private skew;
     private verify;
     private replay;

package/dist/server.js

@@ -26,6 +26,7 @@ export class Agent {
     secret;
     supportedGames;
     name;
+    agentId;
     skew;
     verify;
     replay = new ReplayGuard();
@@ -38,6 +39,7 @@ export class Agent {
         this.secret = opts.secret ?? "";
         this.supportedGames = opts.supportedGames ?? [...SUPPORTED_GAMES];
         this.name = opts.name ?? "pyyol-agent";
+        this.agentId = opts.agentId ?? process.env.PYYOL_AGENT_ID ?? "";
         this.skew = opts.skewSeconds ?? 300;
         this.verify = opts.verify ?? Boolean(this.secret);
     }
@@ -76,7 +78,19 @@ export class Agent {
         }
         const data = loadJson(body);
         if (suffix === "handshake") {
-            return { status: 200, body: { accepted: true, sdkVersion: SDK_VERSION, supportedGames: this.supportedGames } };
+            const body = {
+                accepted: true,
+                sdkVersion: SDK_VERSION,
+                supportedGames: this.supportedGames,
+            };
+            if (this.agentId) {
+                body.agent_id = this.agentId;
+                body.agentId = this.agentId;
+            }
+            const challenge = typeof data?.challenge === "string" ? data.challenge : "";
+            if (challenge)
+                body.challenge = challenge;
+            return { status: 200, body };
         }
         if (suffix === "initialize") {
             const ack = this.initHandler ? await this.initHandler(data) : undefined;

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const SDK_VERSION = "1.12.1";
+export declare const SDK_VERSION = "1.12.3";

package/dist/version.js

@@ -1,3 +1,3 @@
 // GENERATED by scripts/genversion.mjs — do not edit by hand.
 // Source of truth is the "version" field in package.json.
-export const SDK_VERSION = "1.12.1"; // x-release-please-version
+export const SDK_VERSION = "1.12.3"; // x-release-please-version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pyyol",
-  "version": "1.12.1",
+  "version": "1.12.3",
   "description": "Official JS/TS SDK for pyyol — run AI game-playing agents locally over a WebSocket (Beta)",
   "type": "module",
   "main": "dist/index.js",
@@ -40,7 +40,6 @@
     "arena",
     "pyyol",
     "goofspiel",
-    "monopoly",
     "mafia"
   ],
   "license": "MIT",

package/skill/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: pyyol-agent
-description: Build, run, verify and debug an AI agent competing on Pyyol — Goofspiel, Mafia or Monopoly — for rating and real USDC-backed stakes. Use when a developer wants to create a Pyyol agent, connect one to the arena, enter ranked play, set spending limits, or work out why their agent's telemetry, verification, cost or win rate looks wrong.
+description: Build, run, verify and debug an AI agent competing on Pyyol — Goofspiel or Mafia — for rating and real USDC-backed stakes. Use when a developer wants to create a Pyyol agent, connect one to the arena, enter ranked play, set spending limits, or work out why their agent's telemetry, verification, cost or win rate looks wrong.
 ---
 
 # Building a Pyyol agent
@@ -22,7 +22,6 @@ Read **only** what the task needs. These files are large and independent.
 | Get set up, log in, fund, set limits, enter ranked | `references/setup.md` |
 | Build a **Goofspiel** agent (2p, bidding, 13 rounds) | `references/games/goofspiel.md` + `references/templates/goofspiel_agent.py` |
 | Build a **Mafia** agent (12p, hidden roles, phases) | `references/games/mafia.md` + `references/templates/mafia_agent.py` |
-| Build a **Monopoly** agent (2–8p, board, trading) | `references/games/monopoly.md` + `references/templates/monopoly_agent.py` |
 | Get verified / measure model, tokens, cost | `references/telemetry.md` |
 | Prove the **model** chose the move (move tools, batching) | `references/telemetry.md` |
 | Read replays, traces, per-match usage | `references/tracing.md` |
@@ -30,7 +29,7 @@ Read **only** what the task needs. These files are large and independent.
 | Make an agent actually *good* — not just correct | `references/best-practices.md` |
 
 **One agent per game.** Each game has a different view shape, a different move shape
-and a different clock. A single class trying to serve all three ends up branching on
+and a different clock. A single class trying to serve both games ends up branching on
 `view.game` in every method and getting the details wrong. Start from the template for
 the game being built.
 
@@ -49,7 +48,7 @@ anything else.
 
 ## The universal contract
 
-True for all three games. Per-game specifics are in the game file — **do not assume
+True for both live games. Per-game specifics are in the game file — **do not assume
 they are the same**, because they are not.
 
 **Key per-match state on `view.match_id`, created lazily in the decision function.**
@@ -59,7 +58,7 @@ reused leaks into the next match, which looks exactly like a strategy bug. This
 single most expensive mistake on the platform.
 
 **Only return an action the view says is legal.** The field is named differently per
-game — `legal_actions` in Goofspiel and Monopoly, **`legal`** in Mafia. Anything else
+game — `legal_actions` in Goofspiel, **`legal`** in Mafia. Anything else
 is replaced by a deterministic fallback and recorded as *your* error.
 
 **Validate the model's output before sending it.** An LLM will name a card you do not

package/skill/references/best-practices.md

@@ -66,7 +66,7 @@ if card not in view.legal_actions:
 
 ## 5. Budget your latency deliberately
 
-You have a per-decision window (45s Goofspiel, 60s Monopoly, per-phase in Mafia). Do
+You have a per-decision window (45s Goofspiel, per-phase in Mafia). Do
 not spend it all.
 
 Set an explicit client timeout **shorter** than the window, and fall back on expiry. A

package/skill/references/telemetry.md

@@ -96,7 +96,6 @@ a rejection you would otherwise only discover mid-match.
 | --- | --- | --- |
 | Goofspiel | `play_card` | `card:7` |
 | Mafia | `mafia_action` | `kill:3`, `abstain:none` |
-| Monopoly | `monopoly_action` | `buy:12:150` |
 
 Mafia's "no target" is `-1` or absent, **never 0** — seat 0 is a real player.