[studio] beta studio (#114)

* rrs stuff

* studio service yay

* rrs whitelist

* moree studiooooooo fellowwww

* rec room studio room loading yay

* fixes yay

* fix 2 because idk  yayuh

* Update cdn.app.ts

* ccontent length fix?

* Preserve content-length and upgrade metadata

Return a real zero-filled byte array for CDN HEAD responses so the runtime preserves Content-Length while still sending no payload. In notify, re-create the Request with its original headers, set OWNER_HEADER from the validated token, and forward that Request to hub.fetch to avoid losing WebSocket upgrade metadata (which could trigger 500s in Durable Objects). These changes ensure the editor's size checks and WebSocket upgrades remain reliable.

* fix x524234

* shirt thing?

* [auth] remove grant table as we already have audit_log for now

* rename table to generic device_grant

* cleanup/lint

---------

Co-authored-by: Devin Zuczek <devin.zuczek@gmail.com>

apps/rooms/src/openapi.ts

@@ -184,8 +184,14 @@ export const SubRoomDataSaveResponseDto = z.object({
 	subRoomDataSaveId: z.int(),
 	subRoomId: z.int(),
 	unityAssetId: z.string().nullable().describe('Null unless the save carried one'),
-	unityAsset: z.string().nullable().describe('Always null — we resolve no baked assets'),
-	unityAssetHash: z.string().nullable().describe('Always null — we resolve no baked assets'),
+	unityAsset: z
+		.string()
+		.nullable()
+		.describe('Windows baked-bundle filename when this save has a Studio build; otherwise null'),
+	unityAssetHash: z
+		.string()
+		.nullable()
+		.describe('Base64 SHA-256 of `unityAsset` when that file is set; otherwise null'),
 	dataBlob: z.string(),
 	dataBlobHash: z.string().nullable().describe('Echoed from the request’s `SubRoomData.Hash`'),
 	savedByAccountId: z.int().nullable(),
@@ -204,11 +210,22 @@ export const SubRoomDataSaveResponseDto = z.object({
  * scene-data blob to download. This is the ONLY place the loader looks for it, so a
  * subroom whose `CurrentSave` is missing loads no saved content at all.
  *
- * The array fields are always empty here: we neither resolve nor record referenced Unity
- * assets. They are still emitted because the client's parser expects them present.
+ * `UnitySubAssets` is empty for a maker-pen save. A Rec Room Studio build fills it
+ * with one main bundle per platform. Referenced assets stay empty. The arrays are
+ * always emitted because the client's parser expects them present.
  */
+export const UnitySubAssetDto = z.object({
+	UnityAssetId: z.string(),
+	Target: z.int().describe('0 Windows, 2 Android/Quest — the game’s `unityAssetTarget`'),
+	Version: z.int(),
+	Filename: z.string().describe('Downloaded from the CDN at `/unityasset/{Filename}`'),
+	Hash: z.string().describe('Base64 SHA-256 of the bundle'),
+})
+
 export const SubRoomDataSaveDto = z.object({
-	UnitySubAssets: z.array(z.unknown()).describe('Always empty'),
+	UnitySubAssets: z
+		.array(UnitySubAssetDto)
+		.describe('Main Studio bundles for this save; empty for a maker-pen save'),
 	ReferencedUnityAssets: z.array(z.unknown()).describe('Always empty'),
 	SubRoomDataSaveId: z.int().describe('Numbered from 1, incremented on every save'),
 	SubRoomId: z.int().describe('The owning subroom — re-pointed when a subroom is cloned'),
@@ -952,6 +969,26 @@ export const SubRoomSavesNoUnityAssetsPage = z.object({
 	TotalCount: z.int().describe('Same value as `TotalResults` — the two references disagree'),
 })
 
+/**
+ * `GET /rooms/{roomId}/subrooms/{subRoomId}/unityasset` — the editor's unity-asset
+ * document, camelCase. `bakedUnityAssets` are the main bundles; `filename`/`hash`
+ * name the Windows one. Bytes live on the CDN.
+ */
+export const BakedUnityAssetDto = z.object({
+	unityAssetId: z.string(),
+	target: z.int().describe('0 Windows, 2 Android/Quest'),
+	version: z.int(),
+	filename: z.string(),
+})
+
+export const UnityAssetWithSourceDto = z.object({
+	unityAssetId: z.string(),
+	createdByAccountId: z.int(),
+	bakedUnityAssets: z.array(BakedUnityAssetDto),
+	filename: z.string().describe('The Windows main bundle'),
+	hash: z.string().describe('Base64 SHA-256 of `filename`'),
+})
+
 // ---- Session ---------------------------------------------------------------
 
 /** One entry of the permission table the client applies when it spawns into a room. */