@homie-rocks/studio 0.34.0 → 0.35.0

package/CHANGELOG.md

@@ -17,9 +17,21 @@ To bring a studio up to date, tell Claude: "Upgrade my studio to the newest Homi
 `npx -y @homie-rocks/studio@latest upgrade`, which shows what's new since the version your studio pins (from this
 file) and what the upgrade would change, and changes nothing until you agree.
 
+## [0.35.0] - 2026-10-08
+
+**Plugin 0.36.0** · [#67](https://github.com/homie-rocks/homie/pull/67)
+
+A shop with no Stripe key to find. You approve once in your browser, and your AI sets up the rest in your own Stripe account.
+
+### Added
+
+- New shops use Stripe Payment Links by default: one official CLI browser approval when needed, no human-handled key and no API key in the Worker. Connect syncs Products, fixed/custom-amount Prices, links and the webhook from shop.json; edits replace versions and removals archive them.
+- Signed events fulfill keyless purchases and chosen-amount tips, book refunds and disputes even when delivery is reordered, and reject forged events. Free orders remain local. Office refunds point to Stripe or the owner's connected AI; missing webhooks wait for Stripe redelivery.
+- Keep the existing keyed checkout for dynamic carts, spending reservations, custom expiry, provider-read recovery and office refunds. Readiness explains the next step; skills, guide, scaffold and MCP instructions follow the keyless default. No Homie service enters the money path.
+
 ## [0.34.0] - 2026-10-08
 
-**Plugin 0.35.0** · [#64](https://github.com/homie-rocks/homie/pull/64)
+**Plugin 0.35.0** · [#64](https://github.com/homie-rocks/homie/pull/64) · [release-2026-10-08-studio-0.34.0](https://github.com/homie-rocks/homie/releases/tag/release-2026-10-08-studio-0.34.0)
 
 A plain shop: nothing is imposed unless you write it. A shop is open to guests by default, the protective rules 0.33.0 started with are a preset you choose, and a player can put several items in a cart and pay once.
 

package/README.md

@@ -460,18 +460,22 @@ The studio chooses its settings in shop.json; [shop/SHOP.md](shop/SHOP.md) expla
 npx homie-studio shop init --supporter        # shop.json with a US$5 Supporter pack, and SELLING.md (the owner's plain words)
 npx homie-studio shop check                   # the studio settings and provider requirements; every build checks them too
 npx homie-studio shop catalog [--have <file>] # the items as Products in Stripe: the read, then the exact writes (Stripe's MCP)
-npx homie-studio shop connect                 # a page on THIS computer: the owner pastes one restricted key; it makes the webhook
+npx homie-studio shop connect                 # Stripe browser approval; reports any remaining Worker credential step
 npx homie-studio shop                         # open (test or live) or what is missing
 npx homie-studio shop refund ord_…            # an ASK: the owner taps once (or Refund in /_studio/office/shop)
 ```
 
-Since 0.24.3 the owner's AI sets it up with **Stripe's own agent tools** (`npm install -g @stripe/cli@latest && stripe
-agent setup`: Stripe's MCP server and skills; the owner signs in once on Stripe's page, a sandbox first): it makes the
-catalog through the MCP (`shop catalog` says exactly what to write), reads the tax settings, and answers "how are
-sales?" read-only. The owner makes the account, approves Stripe's pages and pastes **one** restricted key on the
-connect page, which makes the webhook with it, so its signing secret goes straight to the Worker and never through a
-chat. A webhook is never made through Stripe's MCP (its answer carries the secret). From 2026-10-31 Stripe's MCP takes
-only OAuth or Agent-tagged keys; the shop's own key is a plain restricted key and is not affected.
+Connect with `stripe_login` or `shop connect`: the owner approves Stripe's official browser page, sandbox first.
+Where the CLI supplies a transferable legacy test key, the toolkit creates the webhook and installs both Worker
+secrets privately. It reports the 90-day expiry; `shop connect --renew` obtains approval again. Current CLI OAuth
+and live mode cannot export an independent Worker's key, so the result names that limitation. Only if the owner
+chooses the fallback does `shop connect --manual` open the old local key page (`--manual --live` for live mode).
+Never request a key in chat. Login is not a verified purchase; complete the test purchase, webhook and refund check.
+
+Stripe's optional agent tools (`stripe agent setup`) provide MCP and skills for catalog work (`shop catalog`),
+tax reads and sales questions. They are separate from the Worker's credentials. Never create a webhook through
+MCP because its response contains a secret. From 2026-10-31 Stripe MCP accepts only OAuth or Agent-tagged keys;
+that change does not affect the shop's ordinary restricted API key. [SHOP.md](shop/SHOP.md) describes the flow.
 
 In a game: `createShop()` from `@homie-rocks/studio/shop` (`has`, `entitlements`, `on('change')`, `open`, `used`, `add`, `checkout`, `buy`); a
 supporter's badge rides on their seat (`peer.badge`). Stripe Checkout (hosted), optional Stripe Tax, or Stripe Managed

package/bin/homie-studio.mjs

@@ -170,7 +170,7 @@
  *   homie-studio shop                     is the studio's shop selling (its own Stripe), and if not, what is missing
  *   homie-studio shop init [--supporter] [--currency usd] [--price 500] [--managed]   shop.json and SELLING.md
  *   homie-studio shop check               shop.json against studio settings and provider requirements
- *   homie-studio shop connect [--managed] [--live]   a page on THIS computer where the owner pastes the studio's
+ *   homie-studio shop connect [--live] [--renew] [--manual]   sync Payment Links and webhook through Stripe browser approval; --manual chooses the local page for the studio's
  *                                         restricted Stripe key; with it this makes the webhook (0.24.3), and the key
  *                                         and the webhook's secret go straight to the Worker secrets, never a chat or a
  *                                         file (test keys only unless --live)
@@ -368,7 +368,7 @@ import { standaloneDeployNotes } from '../lib/standalone.mjs';
 
 const argv = process.argv.slice(2);
 const flags = new Map();
-const BOOL_FLAGS = ['off', 'revoke', 'json', 'yes', 'detach', 'no-install', 'plan', 'stop', 'share', 'apply', 'diff', 'template', 'ci', 'fresh', 'install', 'remove', 'replace', 'artifact', 'open', 'reopen', 'kids', 'remote-ai', 'dry-run', 'verify', 'maps', 'profile', 'hands-on', 'automatic', 'unlock', 'confirm', 'no-library', 'no-validate', 'rigged', 'no-rig', 'supporter', 'managed', 'live', 'send', 'accept-tos', 'quiet', 'no-local-ai', 'timestamps', 'overwrite', 'own-route', 'before', 'release', 'device'];
+const BOOL_FLAGS = ['off', 'revoke', 'json', 'yes', 'detach', 'no-install', 'plan', 'stop', 'share', 'apply', 'diff', 'template', 'ci', 'fresh', 'install', 'remove', 'replace', 'artifact', 'open', 'reopen', 'kids', 'remote-ai', 'dry-run', 'verify', 'maps', 'profile', 'hands-on', 'automatic', 'unlock', 'confirm', 'no-library', 'no-validate', 'rigged', 'no-rig', 'supporter', 'managed', 'live', 'manual', 'renew', 'send', 'accept-tos', 'quiet', 'no-local-ai', 'timestamps', 'overwrite', 'own-route', 'before', 'release', 'device'];
 const positional = [];
 for (let i = 0; i < argv.length; i++) {
   const a = argv[i];
@@ -810,7 +810,7 @@ const OUTWARD_FLAGS = {
   'lounge mod': ['url', 'remove'], 'lounge remove': ['url', 'all'],
   'chat remove': ['url', 'all'], 'chat budget': ['url'],
   'servers close': ['url', 'reopen'], 'servers level': ['url'], 'servers member': ['url', 'role', 'remove'],
-  'shop connect': ['url', 'managed', 'live'], 'shop disconnect': ['url'], 'shop refund': ['url', 'reason', 'note'], 'shop statements': ['url', 'period', 'send', 'cursor'],
+  'shop connect': ['url', 'managed', 'live', 'manual', 'renew'], 'shop disconnect': ['url'], 'shop refund': ['url', 'reason', 'note'], 'shop statements': ['url', 'period', 'send', 'cursor'],
   'agents pass': ['url', 'label', 'server', 'hands', 'role', 'days'], 'agents revoke': ['url'], 'agents brain': ['url', 'budget', 'remove'],
   'agents sit': ['url', 'server', 'pass', 'label', 'brain'],
   // With --device it adds a phone to the person's Apple team and installs on it: a flag it does not know stops it.
@@ -1039,7 +1039,7 @@ async function main() {
     if (!sub) return shopStatus(root, { url });
     if (sub === 'init') return shopInit(root, { supporter: flags.has('supporter'), currency: flags.get('currency') ?? 'usd', price: flags.get('price') ?? 500, managed: flags.has('managed') });
     if (sub === 'check') return shopCheck(root);
-    if (sub === 'connect') return shopConnect(root, { managed: flags.has('managed') ? true : null, live: flags.has('live'), log });
+    if (sub === 'connect') return shopConnect(root, { managed: flags.has('managed') ? true : null, live: flags.has('live'), manual: flags.has('manual'), renew: flags.has('renew'), log: (line) => process.stderr.write(`${line}\n`) });
     if (sub === 'disconnect') return shopDisconnect(root);
     if (sub === 'catalog') {
       const from = flags.get('have');

package/lib/doctor.mjs

@@ -24,9 +24,9 @@
  *   GitHub             optional    a private backup, publishing by pull request, building from the Claude app
  *   ElevenLabs         optional    songs and game scores
  *   fal                optional    painted art and generated video
- *   Stripe             for selling only in a studio with shop.json (0.24.3): Stripe's own agent plugin (its MCP server
- *                                  and skills) for this AI, set up when the studio starts selling; the shop's key itself
- *                                  goes in through `homie-studio shop connect`, never here
+ *   Stripe             for selling only in a studio with shop.json: official CLI browser connection first; optional
+ *                                  agent tooling is reported separately. `shop connect` names payment readiness;
+ *                                  a CLI or MCP installation alone never proves the Worker can sell.
  *   Standalone builds  optional    only in a studio where a game.json has a "standalone" block: Xcode, the Android SDK
  *                                  and a JDK it builds on, Apple signing (a count of identities, never a name),
  *                                  notarization and steamcmd (lib/standalone.mjs standaloneRows)
@@ -401,19 +401,19 @@ export async function setupStatus({
     fix: fal.key && fal.valid !== false ? null : { who: 'person', open: 'https://fal.ai/dashboard/keys', say: 'Make a key, put FAL_KEY in the environment your AI runs in (for example a line in your shell profile), and start a new session. Never paste it into the chat.' },
   });
 
-  // Stripe, only in a studio that sells (shop.json): Stripe's own agent plugin, set up when selling starts (lazy, like
-  // every provider here). The shop's key never comes through here: `homie-studio shop connect` takes it on a page.
+  // Stripe, only in a studio that sells. Installing agent tooling is not proof of Worker credentials.
+  // shop connect runs browser pairing and reports the remaining steps; this read-only status never reads keys.
   if (root && existsSync(join(root, 'shop.json'))) {
     const v = await exec('stripe', ['--version']);
     const version = v.code === 0 ? /(\d+\.\d+\.\d+)/.exec(v.stdout)?.[1] ?? null : null;
     const mcp = stripeAgentConfigured({ root, env });
     rows.push({
-      id: 'stripe', label: 'Stripe', need: 'for selling', state: mcp ? 'ok' : 'act',
-      detail: [mcp ? `Stripe's MCP is set up for ${mcp}` : 'Stripe\'s MCP is not set up for this AI', version ? `the Stripe CLI ${version}` : 'no Stripe CLI'].join('; '),
-      unlocks: 'the shop: your AI makes the catalog, checks tax and Managed Payments and answers "how are sales?" with Stripe\'s own tools, on your own Stripe account; you sign in on Stripe\'s page',
-      fix: mcp ? null : {
-        who: 'ai', run: 'npm install -g @stripe/cli@latest && stripe agent setup',
-        say: 'Stripe\'s own agent plugin for Claude Code and Codex (its MCP server and skills, kept up to date); you approve the install. Then sign in once on Stripe\'s page and give access to your Stripe sandbox first.',
+      id: 'stripe', label: 'Stripe', need: 'for selling', state: 'act',
+      detail: [version ? `Stripe CLI ${version} is installed` : 'Stripe CLI is not installed', mcp ? `optional MCP is set up for ${mcp}` : 'optional MCP is not set up', 'CLI access is not proof that Worker credentials or a purchase work'].join('; '),
+      unlocks: 'Connect the studio’s own Stripe with browser approval; shop connect syncs Payment Links and the webhook without a Worker API key. Verify a test purchase before calling the shop ready.',
+      fix: {
+        who: 'ai', run: version ? 'npx --no-install homie-studio shop connect' : 'npm install -g @stripe/cli@latest',
+        say: 'Use stripe_login or shop connect. Never ask for a key in chat. Sync Products, Prices, Payment Links and the webhook through the approved CLI. The Worker needs only the signing secret; repeat connect after edits.',
         open: 'https://dashboard.stripe.com/register',
       },
     });

package/lib/mcp-tools.mjs

@@ -1102,6 +1102,21 @@ export function toolDefs(ctx, avail = {}) {
         return startRun(ctx, root, { kind: 'deploy', game: null, title: `${studio.name}: online`, steps: [{ label: 'deploy', args: ['deploy', ...(a.ownRoute === true ? ['--own-route'] : [])] }] });
       },
     },
+    {
+      name: 'stripe_login', title: 'Connect the studio to Stripe',
+      description: 'Connect and sync shop.json through Stripe’s official CLI with one browser approval if needed. Creates Products, Prices, Payment Links and the webhook; installs only links and signing secret, no API key in the Worker. Repeat after edits. Follow studio_job. An existing key supports fuller checkout; manual only if explicitly chosen for those features. live only when the owner says go live.',
+      inputSchema: { type: 'object', properties: { ...STUDIO_ARG, live: { type: 'boolean' }, renew: { type: 'boolean' }, manual: { type: 'boolean' } } },
+      annotations: { title: 'Connect Stripe', readOnlyHint: false, destructiveHint: false, openWorldHint: true },
+      run: async (a) => {
+        const root = ctx.root(a.studio);
+        const args = ['shop', 'connect', ...(a.live ? ['--live'] : []), ...(a.renew ? ['--renew'] : []), ...(a.manual ? ['--manual'] : [])];
+        const job = cliJob(root, 'Stripe connection', args, { cli: join(PACKAGE_ROOT, 'bin', 'homie-studio.mjs'), keep: false });
+        const ended = await waitJob(job, Math.min(ctx.waitMs, 1000));
+        ctx.status = null;
+        if (ended && job.code !== 0) return fail(whyOf(job), { kind: 'job', ...jobView(job) });
+        return ok(ended ? jobView(job).tail.join('\n') || 'Stripe connection finished; inspect the job result.' : 'Stripe connection is running. Approve Stripe in the browser when it opens. Check this job for the result and any remaining setup step.', { kind: 'job', ...jobView(job) });
+      },
+    },
     {
       name: 'cloudflare_login', title: 'Sign in to Cloudflare',
       description: 'Open Cloudflare in the person\'s browser to approve this computer once (Wrangler\'s own sign-in; a free account, no payment method, no key pasted anywhere). Say in one line that Cloudflare opened and they should approve it.',

package/lib/mcp.mjs

@@ -40,6 +40,7 @@ A new studio follows one checklist, in order and never ahead. Show it in your fi
 3. One small change from one sentence of theirs: to the copied game, or to the studio's home (site/theme.json colours, a tagline in studio.json, a first post in posts/). Then build and preview_run, and they reload.
 4. Plan their game (game_plan): a short interview, two or three questions a message with options and your pick; then fill games/<id>/CODEX.md and show it (game_codex). Look for pieces first: the @homie-rocks/* packages for general mechanisms, and parts_find for pieces other studios shared (part_add brings one in).
 5. Build it: build_open, then game_make under the planned id (the codex stays), file edits (few and large: one file_edit carries every change to a file in its edits list, never a call per change), build, preview_run, check. The card follows every build.
+For a shop: stripe_login (shop connect) syncs Products, Prices, Payment Links and the webhook through Stripe CLI browser approval. Follow studio_job. Default is keyless: no API key in the Worker, no human-handled key. Rerun after shop.json changes. Never expose CLI credentials or webhook secrets. Follow the single next step, verify purchase/webhook/grant and a refund in Stripe or through the connected AI. An existing Worker key selects fuller carts, caps, expiry, automatic recovery and office refunds; explain that only when requested. Never choose manual automatically. Lost webhook: resend from Stripe, never grant from the return URL. Live only when requested.
 6. Playtest it (playtest), then put it online: studio_deploy with plan: true first (say what it creates and costs, free), cloudflare_login when not signed in (they approve once in their browser), studio_deploy, then studio_publish.
 If they ask for everything at once, show the list, make your own choices for steps 2 to 4 in one line each, and go on.
 

package/lib/scaffold.mjs

@@ -445,13 +445,20 @@ where it sells and for Stripe's terms. Homie takes no cut.
   presets, including in existing files, use the open default. Individual overrides are in SHOP.md.
 - \`createShop()\` from \`@homie-rocks/studio/shop\` supplies \`open\`, \`has\`, \`entitlements\`, \`used\`, and \`change\`.
   \`shop.add(item, quantity)\` builds a cart; \`shop.checkout()\` pays; \`shop.buy(item)\` buys directly.
-- A cart has independent lines and quantities. The office can refund a whole order or line. The optional
+- With the fuller connection, a cart has independent lines and quantities. The office can refund a whole order or line. The optional
   player refund window covers items; a tip is never taken back by the player.
 - Flood settings are configurable: buyer attempts 6/minute, address attempts 600/minute,
   new guest buyers 600/hour. Stripe constraints, integer arithmetic, ownership and signatures protect payments.
-- \`shop check\` validates settings; \`shop connect\` provides a local page for credentials, stored as Worker
-  secrets. Stripe's agent tools can manage Products through \`shop catalog\`; the connect page creates the
-  webhook so its secret stays out of chat. Both the key and signing secret are part of working payment setup.
+- \`shop check\` validates settings; \`stripe_login\` / \`shop connect\` starts Stripe browser approval.
+  Never ask a person for a key. Follow the result's next step: deploy first if needed, then rerun connect.
+  The default syncs Products, Prices, Payment Links and the webhook through the approved Stripe CLI.
+  The Worker stores only links and a signing secret; buying needs no API key or running AI.
+  Rerun \`shop connect\` after shop.json changes; use \`shop connect --renew\` if approval needs renewal.
+  Verify a test purchase, signed webhook, item grant, and a refund in Stripe or through the connected AI.
+  Never ask a person for a key. An existing Worker key selects the fuller cart/cap/refund path;
+  explain it only when those features are requested. Never silently choose \`--manual\`. Live only on request.
+  A lost webhook stays pending: ask Stripe to resend it. Free orders need no Stripe.
+  Never create secret-returning webhooks through conversation MCP tools; connect captures secrets privately.
   Stripe's approval links belong to the owner. \`checkoutMinutes\` is optional (Stripe: 30 to 1440 minutes,
   default 1440; values below 31 use 31 for transport margin); cancelling a named checkout, or replacing one at least a minute old, expires the open session on Stripe's confirmation.
 - \`shop orders\` and \`/_studio/office/shop\` show sales. \`shop refund <order>\` asks the owner to confirm.
@@ -876,7 +883,7 @@ export function ensureMigrations(root) {
 
 /** What a migration file the template added is for, in a few words (deploy and dev say it). */
 export function migrationWord(file) {
-  return /lounge/.test(file) ? 'the Lounge and kept chat: play nights, moderators, and what was said only where an owner turns history on' : /shop/.test(file) ? 'the shop: orders, what players own, refunds and referral books (it sells nothing until shop.json and the owner\'s Stripe key are in)' : /players/.test(file) ? 'player accounts and cloud saves' : /chat/.test(file) ? 'room chat: the owner\'s chat rules and players\' reports (never the chat itself)' : /servers/.test(file) ? 'servers and agent seats: room pools with their own rules, AI passes' : /office/.test(file) ? 'the back office: launch states, invites, the owner\'s controls' : 'the studio\'s own stats: counts, never tracks';
+  return /lounge/.test(file) ? 'the Lounge and kept chat: play nights, moderators, and what was said only where an owner turns history on' : /shop/.test(file) ? 'the shop: orders, what players own, refunds and referral books (paid sales wait until shop.json and the studio\'s Stripe connection are ready)' : /players/.test(file) ? 'player accounts and cloud saves' : /chat/.test(file) ? 'room chat: the owner\'s chat rules and players\' reports (never the chat itself)' : /servers/.test(file) ? 'servers and agent seats: room pools with their own rules, AI passes' : /office/.test(file) ? 'the back office: launch states, invites, the owner\'s controls' : 'the studio\'s own stats: counts, never tracks';
 }
 
 /**

package/lib/shop-links.mjs

@@ -0,0 +1,91 @@
+/** Reconcile through the owner's official Stripe CLI session; never export its credentials. */
+import { createHash, randomUUID } from 'node:crypto';
+import { productIdOf, WEBHOOK_SECRET_SHAPE } from '../worker/stripe.mjs';
+import { defaultTaxCode } from '../worker/shop-rules.mjs';
+import { LINKS_STRIPE_VERSION, linkSettings, paymentLinkURL } from '../worker/shop-links.mjs';
+import { HOOK_EVENTS } from './shop.mjs';
+const hash = (value) => createHash('sha256').update(JSON.stringify(value)).digest('hex');
+const same = (a, b) => Object.keys(a ?? {}).length === Object.keys(b).length && Object.entries(b).every(([k, v]) => a?.[k] === v);
+export async function syncPaymentLinks({ api, shop, slug, site, mode, w, receipt, saveReceipt }) {
+  const list = async (path, params = {}) => {
+    const all = []; let cursor;
+    do {
+      const p = await api('GET', path, { ...params, limit: 100, ...(cursor ? { starting_after: cursor } : {}) });
+      if (!Array.isArray(p.data)) throw new Error('Incomplete Stripe list');
+      all.push(...p.data);
+      const next = p.has_more ? p.data.at(-1)?.id : null;
+      if (p.has_more && (!next || next === cursor)) throw new Error('Incomplete Stripe pagination');
+      cursor = next;
+    } while (cursor);
+    return all;
+  };
+  const secrets = await w(['secret', 'list']);
+  if (secrets.code !== 0) return { ok: false, needs: 'cloudflare', why: 'Connect Cloudflare and deploy the studio, then run shop connect again.' };
+  const names = JSON.parse(secrets.stdout ?? secrets.out);
+  const has = (name) => names.some((s) => s.name === name);
+  const products = await list('/v1/products');
+  const prices = await list('/v1/prices');
+  const links = await list('/v1/payment_links');
+  const own = (o) => o.metadata?.homie === 'shop-links-v1' && o.metadata?.studio === slug && o.metadata?.origin === site;
+  const config = { v: 1, mode, settings: linkSettings(shop), items: [] };
+  const keepPrices = new Set(), keepLinks = new Set(), keepProducts = new Set();
+  for (const item of shop.items) {
+    const id = await productIdOf(slug, item.id);
+    keepProducts.add(id);
+    const metadata = { homie: 'shop-links-v1', studio: slug, origin: site };
+    const fields = { name: item.name, description: item.blurb ?? '', tax_code: item.taxCode ?? defaultTaxCode(item), metadata, active: true };
+    let product = products.find((p) => p.id === id);
+    if (!product) product = await api('POST', '/v1/products', { id, ...fields }, `product-${hash(id)}`);
+    else if (!same(product.metadata, metadata) || product.name !== fields.name || (product.description ?? '') !== fields.description || (product.tax_code?.id ?? product.tax_code) !== fields.tax_code || !product.active) await api('POST', `/v1/products/${id}`, fields);
+    const priceFields = { product: id, currency: shop.currency, tax_behavior: 'exclusive', ...(item.price === 'choose'
+      ? { custom_unit_amount: { enabled: true, minimum: item.min, ...(item.max !== null ? { maximum: item.max } : {}) } }
+      : { unit_amount: item.price }) };
+    const revision = hash(priceFields);
+    let price = prices.find((p) => own(p) && p.product === id && p.metadata?.revision === revision);
+    if (!price) price = await api('POST', '/v1/prices', { ...priceFields, metadata: { ...metadata, revision } }, `price-${hash({ priceFields, metadata })}`);
+    if (!price.active) await api('POST', `/v1/prices/${price.id}`, { active: true });
+    keepPrices.add(price.id);
+    if ((product.default_price?.id ?? product.default_price) !== price.id) await api('POST', `/v1/products/${id}`, { default_price: price.id });
+    if (item.price === 0) continue; // Free orders never leave the studio.
+    const params = { line_items: [{ price: price.id, quantity: 1, ...(item.price !== 'choose' ? { adjustable_quantity: { enabled: shop.policy.repeatPurchases, minimum: 1, maximum: 999999 } } : {}) }],
+      after_completion: { type: 'redirect', redirect: { url: `${site}/shop/thanks?session_id={CHECKOUT_SESSION_ID}` } },
+      ...(shop.till === 'stripe-managed' ? { managed_payments: { enabled: true } } : { automatic_tax: { enabled: shop.automaticTax } }),
+      payment_intent_data: { metadata },
+    };
+    const linkRevision = hash({ params, item, policy: shop.policy });
+    let link = links.find((p) => own(p) && p.metadata?.revision === linkRevision);
+    if (!link) link = await api('POST', '/v1/payment_links', { ...params, metadata: { ...metadata, revision: linkRevision } }, `link-${linkRevision}`);
+    if (!link.active) await api('POST', `/v1/payment_links/${link.id}`, { active: true });
+    if (!paymentLinkURL(link.url) || !/^plink_\w+$/.test(link.id)) throw new Error('Invalid Payment Link');
+    keepLinks.add(link.id);
+    config.items.push({ item: item.id, id: link.id, url: link.url, revision: linkRevision });
+  }
+  const endpoints = await list('/v1/webhook_endpoints');
+  const url = `${site}/api/shop/hook`;
+  const current = endpoints.find((e) => e.id === receipt?.endpoint && e.url === url && e.status === 'enabled' && HOOK_EVENTS.every((event) => e.enabled_events?.includes(event)));
+  let endpoint = current, secret;
+  if (!endpoint || !has('STRIPE_WEBHOOK_SECRET')) {
+    const pending = receipt?.url === url && receipt?.pending ? receipt.pending : randomUUID();
+    saveReceipt({ ...receipt, pending, mode, url }); // Retry the same private creation response; never persist the secret.
+    endpoint = await api('POST', '/v1/webhook_endpoints', { url, enabled_events: [...HOOK_EVENTS], api_version: LINKS_STRIPE_VERSION, metadata: { homie: 'shop-v1' }, description: 'Studio shop' }, `webhook-${pending}`);
+    if (!WEBHOOK_SECRET_SHAPE.test(endpoint.secret ?? '')) throw new Error('Missing signing secret');
+    secret = endpoint.secret;
+  }
+  const fingerprint = hash(config);
+  const unchanged = current && !secret && receipt?.fingerprint === fingerprint && has('STRIPE_SHOP_LINKS') && !has('STRIPE_KEY');
+  if (!unchanged) {
+    const saved = await w(['secret', 'bulk'], { input: JSON.stringify({ STRIPE_SHOP_LINKS: JSON.stringify(config), ...(secret ? { STRIPE_WEBHOOK_SECRET: secret } : {}) }) });
+    if (saved.code !== 0) return { ok: false, needs: 'cloudflare', why: 'Cloudflare could not save the shop connection. Run shop connect again; existing webhooks remain active.' };
+    // Explicitly running connect selects keyless; manual selects the existing keyed checkout.
+    if (has('STRIPE_KEY') && (await w(['secret', 'delete', 'STRIPE_KEY'], { input: 'y\n' })).code !== 0) return { ok: false, needs: 'cloudflare', why: 'The links are ready; run shop connect again to finish removing the old checkout credential.' };
+    saveReceipt({ mode, endpoint: endpoint.id, url, fingerprint, keyless: true });
+  }
+  // Retire only after the replacement configuration and signing secret are installed.
+  for (const link of links.filter((p) => own(p) && p.active && !keepLinks.has(p.id))) await api('POST', `/v1/payment_links/${link.id}`, { active: false });
+  for (const price of prices.filter((p) => own(p) && p.active && !keepPrices.has(p.id))) await api('POST', `/v1/prices/${price.id}`, { active: false });
+  for (const product of products.filter((p) => own(p) && p.active && !keepProducts.has(p.id))) await api('POST', `/v1/products/${product.id}`, { active: false });
+  for (const e of endpoints.filter((e) => e.id !== endpoint.id && e.url === url && e.metadata?.homie === 'shop-v1' && e.status !== 'disabled')) await api('POST', `/v1/webhook_endpoints/${e.id}`, { disabled: true });
+  return { ok: true, command: 'shop connect', mode, keyless: true, saved: !unchanged, alreadyConnected: Boolean(unchanged), webhook: { id: endpoint.id, url }, verifiedPurchase: false,
+    message: 'Your shop uses Stripe Payment Links. No Stripe API key is stored in the Worker.',
+    next: ['Verify a purchase, its signed webhook and item grant; refund in Stripe or ask your connected AI, then verify removal.'] };
+}

package/lib/shop.mjs

@@ -6,7 +6,8 @@
  *   homie-studio shop init [--supporter] [--currency usd] [--price 500] [--managed]
  *                                           writes shop.json (a $5 Supporter pack with --supporter) and SELLING.md
  *   homie-studio shop check                 shop.json against the studio settings and provider requirements
- *   homie-studio shop connect [--managed] [--live]   a page on THIS computer (127.0.0.1, one use, ten minutes) where the owner
+ *   homie-studio shop connect             sync Payment Links and webhook with the approved Stripe CLI; no Worker API key
+ *   homie-studio shop connect --manual [--managed] [--live]   a fallback page on THIS computer (127.0.0.1, one use, ten minutes) where the owner
  *                                           pastes the studio's restricted Stripe key (the one thing only they can make);
  *                                           with it this process makes the webhook (0.24.3), and the key and the
  *                                           webhook's signing secret go straight to the Worker secrets STRIPE_KEY and
@@ -98,7 +99,7 @@ export function shopInit(root, { supporter = false, currency = 'usd', price = 50
   writeFileSync(file, `${JSON.stringify(shop, null, 2)}\n`);
   const wrote = [SHOP_FILE];
   if (!existsSync(join(root, 'SELLING.md')) && existsSync(SELLING)) { writeFileSync(join(root, 'SELLING.md'), readFileSync(SELLING, 'utf8')); wrote.push('SELLING.md'); }
-  return { ok: true, command: 'shop init', wrote, till: shop.till, items: shop.items.map((i) => i.id), next: ['homie-studio shop check', 'npm run deploy (the shop stays closed until the key and webhook signing secret are in)', 'homie-studio shop connect (the owner pastes a Stripe key into a page on this computer)'] };
+  return { ok: true, command: 'shop init', wrote, till: shop.till, items: shop.items.map((i) => i.id), next: ['homie-studio shop check', 'npm run deploy (paid sales wait for the Stripe connection)', 'homie-studio shop connect (approve Stripe in your browser; the result names any remaining step)'] };
 }
 
 /** The office's view of the live shop: open or what is missing, the last 30 days, links to Stripe. */
@@ -106,7 +107,10 @@ export async function shopStatus(root, { url } = {}) {
   const r = await withKey(root, url, (call) => call('/_studio/api/shop'));
   if (!r.ok) return { ok: false, command: 'shop', why: r.message ?? r.why ?? 'the studio did not answer' };
   const local = readShop(root);
-  return { ok: true, command: 'shop', ready: r.ready, mode: r.mode, missing: r.missing, totals: r.totals, stripe: r.stripe, hook: r.hook, till: r.shop?.till ?? null, items: r.shop?.items ?? [], local: { ok: local.ok, absent: Boolean(local.absent), errors: local.errors } };
+  const { stripeConnectionInfo } = await import('./stripe-connect.mjs');
+  const connection = r.mode === 'test' ? stripeConnectionInfo(root) : null;
+  const missing = [...(r.missing ?? []), ...(connection?.expired ? [{ id: 'stripe-expired', words: 'Stripe test credentials have expired. Run homie-studio shop connect --renew and approve Stripe again.' }] : [])];
+  return { ok: true, command: 'shop', ready: r.ready && !connection?.expired, mode: r.mode, missing, connection, totals: r.totals, stripe: r.stripe, hook: r.hook, till: r.shop?.till ?? null, items: r.shop?.items ?? [], local: { ok: local.ok, absent: Boolean(local.absent), errors: local.errors } };
 }
 
 export async function shopOrders(root, { url } = {}) {
@@ -240,11 +244,11 @@ async function probeManaged(env, shop, { fetcher }) {
 }
 
 /**
- * `homie-studio shop connect`: the page above on 127.0.0.1 (one use, ten minutes). The key goes to Stripe once (a
+ * `homie-studio shop connect --manual`: the fallback page above on 127.0.0.1 (one use, ten minutes). The key goes to Stripe once (a
  * read, then the webhook), and to `wrangler secret put` on its standard input; so does the webhook's signing secret,
  * which Stripe hands this process when it makes the endpoint. Nothing is printed or returned but ids and words.
  */
-export async function shopConnect(root, { managed = null, live = false, log = () => {}, port = 0, wait = 10 * 60_000, verify = true, fetcher = fetch } = {}) {
+export async function shopConnectManual(root, { managed = null, live = false, log = () => {}, port = 0, wait = 10 * 60_000, verify = true, fetcher = fetch } = {}) {
   const studio = readStudio(root);
   const site = siteUrl(root);
   if (!site) return { ok: false, command: 'shop connect', needs: 'deploy', why: 'the studio has no live address yet, and Stripe needs one to send payments to (the webhook): run npm run deploy first, then this' };
@@ -272,7 +276,7 @@ export async function shopConnect(root, { managed = null, live = false, log = ()
           if (busy) { say(said(409, 'Still saving the last press. Wait a moment.')); return; }
           if (!KEY_SHAPE.test(key)) { say(said(400, 'That does not look like a Stripe key (rk_test_…, rk_live_…, sk_test_… or sk_live_…). Go back and try again.')); return; }
           // Test mode unless the owner's AI ran it with --live on purpose: a live key on the test page is refused.
-          if (modeOf(key) !== (live ? 'live' : 'test')) { say(said(400, live ? 'This page takes a LIVE Stripe key (rk_live_… or sk_live_…).' : 'This page is for TEST mode: paste a test key (rk_test_… or sk_test_…). Live keys go in only when the shop is ready to sell for real (shop connect --live).')); return; }
+          if (modeOf(key) !== (live ? 'live' : 'test')) { say(said(400, live ? 'This page takes a LIVE Stripe key (rk_live_… or sk_live_…).' : 'This page is for TEST mode: paste a test key (rk_test_… or sk_test_…). Live keys go in only when the shop is ready to sell for real (shop connect --manual --live).')); return; }
           if (hook && !WEBHOOK_SECRET_SHAPE.test(hook)) { say(said(400, 'That does not look like a webhook signing secret (whsec_…). Go back and try again, or leave it empty and this page makes the webhook.')); return; }
           busy = true;
           try {
@@ -342,7 +346,8 @@ export function shopDisconnect(root) {
   const w = runner(root, studio.cloudflare?.accountId ? { CLOUDFLARE_ACCOUNT_ID: studio.cloudflare.accountId } : {});
   const a = w(['secret', 'delete', 'STRIPE_KEY'], { input: 'y\n' });
   const b = w(['secret', 'delete', 'STRIPE_WEBHOOK_SECRET'], { input: 'y\n' });
-  return a.code === 0 || b.code === 0 ? { ok: true, command: 'shop disconnect', message: 'The Stripe key and webhook secret are gone from the Worker: the shop is closed. Delete the restricted key in Stripe too (Developers → API keys).' } : { ok: false, command: 'shop disconnect', why: a.out.trim().split('\n').slice(-2).join(' ') };
+  const c = w(['secret', 'delete', 'STRIPE_SHOP_LINKS'], { input: 'y\n' });
+  return a.code === 0 || b.code === 0 || c.code === 0 ? { ok: true, command: 'shop disconnect', message: 'The Worker payment connection was removed. Ask your connected AI to deactivate existing Payment Links in Stripe too; already opened Stripe checkouts can still complete.' } : { ok: false, command: 'shop disconnect', why: a.out.trim().split('\n').slice(-2).join(' ') };
 }
 
 /** Lines for a person (the CLI's print). */
@@ -351,6 +356,7 @@ export function shopLines(r) {
   if (r.command === 'shop') {
     lines.push(r.ready ? `The shop is open${r.mode === 'test' ? ' in TEST MODE (no real money)' : ', live'} (till: ${r.till}).` : 'The shop is not selling yet:');
     for (const m of r.missing ?? []) lines.push(`  - ${m.words}`);
+    if (r.connection) lines.push(`Stripe test credentials expire ${r.connection.expiresAt}. Renew: ${r.connection.renew}`);
     if (r.totals) lines.push(`Last 30 days: ${r.totals.sales} sales, ${money(r.totals.paid, r.totals.currency)} before tax and fees; ${r.totals.refunds} refunded; ${r.totals.disputes} disputed.`);
     lines.push(`Webhook endpoint for Stripe: ${r.hook}`, `Payouts: ${r.stripe?.payouts}`);
     if (r.local && !r.local.ok) lines.push(`shop.json here: ${r.local.errors.map((e) => e.message).join('; ')}`);
@@ -372,6 +378,9 @@ export function shopLines(r) {
     if (r.sent) for (const s of r.sent) lines.push(`${s.via}: ${s.ok ? 'sent' : `not sent (${s.why ?? s.status})`}`);
     else for (const s of r.statements ?? []) lines.push(`${s.statement.referrer}: due ${s.statement.totals ? money(s.statement.totals.due, s.statement.currency) : 'see first page'} (${s.statement.lines.length} line(s)), signed`);
     if (!(r.sent ?? r.statements ?? []).length) lines.push(`No referral statements for ${r.period}.`);
-  } else lines.push(r.message ?? '');
+  } else { lines.push(r.message ?? r.why ?? (r.alreadyConnected ? 'Stripe test credentials are already installed.' : '')); for (const step of r.next ?? []) lines.push(step); if (r.fallback) lines.push(`Optional fallback, only if chosen: ${r.fallback}`); }
   return lines;
 }
+
+// Public entry point: browser pairing by default; the local key page is explicitly opt-in.
+export { shopConnect } from './stripe-connect.mjs';

package/lib/stripe-connect.mjs

@@ -0,0 +1,135 @@
+/** Stripe owns browser authorization. This module owns only secret transport and a non-secret receipt.
+ * See docs/stripe-connect-research.md: current CLI OAuth is NOT a Worker credential issuer. */
+import { spawn } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { runner } from './cloudflare.mjs';
+import { lockDeploy } from './deploy-state.mjs';
+import { readStudio, siteUrl } from './studio.mjs';
+import { hookUrlOf, readShop, shopConnectManual } from './shop.mjs';
+import { syncPaymentLinks } from './shop-links.mjs';
+import { LINKS_STRIPE_VERSION, fullerReason } from '../worker/shop-links.mjs';
+import { formEncode } from '../worker/stripe.mjs';
+
+const hash = (s) => createHash('sha256').update(s).digest('hex');
+const failure = (needs, why, extra = {}) => ({ ok: false, command: 'shop connect', needs, why, ...extra });
+const receiptHome = () => join(homedir(), '.config', 'homie', 'stripe');
+const receiptDir = (root, storage) => join(storage, hash(realpathSync(root)).slice(0, 24));
+
+/** Local expiry evidence only; no account query and no credentials in the result. */
+export function stripeConnectionInfo(root, { storage = receiptHome(), now = Date.now } = {}) {
+  try {
+    const r = JSON.parse(readFileSync(join(receiptDir(root, storage), 'test.json'), 'utf8'));
+    if (r.url !== hookUrlOf(siteUrl(root)) || !Number.isFinite(Date.parse(r.expiresAt))) return null;
+    return { mode: 'test', expiresAt: r.expiresAt, expired: Date.parse(r.expiresAt) <= now(), renew: 'homie-studio shop connect --renew' };
+  } catch { return null; }
+}
+
+const json = (s) => { try { return JSON.parse(s); } catch { return null; } };
+// This output stays private, including CLI config, completion, errors and API responses.
+export function stripeProcess(args, { cwd, env = process.env } = {}) {
+  const childEnv = { ...env, CI: '1', NO_COLOR: '1' };
+  for (const k of Object.keys(childEnv)) if (k.startsWith('STRIPE_')) delete childEnv[k];
+  return new Promise((resolve) => {
+    const p = spawn('stripe', args, { cwd, env: childEnv, stdio: ['ignore', 'pipe', 'pipe'] });
+    let stdout = '', stderr = '', ended = false;
+    const end = (r) => { if (!ended) { ended = true; clearTimeout(timer); resolve(r); } };
+    const timer = setTimeout(() => { p.kill(); end({ code: 1 }); }, 10 * 60_000);
+    p.stdout.on('data', (b) => { stdout += b; if (stdout.length > 4_000_000) p.kill(); });
+    p.stderr.on('data', (b) => { stderr += b; if (stderr.length > 1_000_000) p.kill(); });
+    p.on('error', (e) => end({ code: 1, missing: e.code === 'ENOENT' }));
+    p.on('close', (code) => end({ code: code ?? 1, stdout, stderr }));
+  });
+}
+
+function openBrowser(url) {
+  const cmd = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'rundll32' : 'xdg-open';
+  const args = process.platform === 'win32' ? ['url.dll,FileProtocolHandler', url] : [url];
+  const p = spawn(cmd, args, { stdio: 'ignore', detached: true });
+  p.on('error', () => {}); p.unref();
+}
+
+const stripeURL = (s) => {
+  try { const u = new URL(s); return u.protocol === 'https:' && ['dashboard.stripe.com', 'access.stripe.com'].includes(u.hostname) && !u.username && !u.password && !u.port; } catch { return false; }
+};
+/** Accept only Stripe's known login continuations. Never execute next_step as shell text. */
+export function completionArgs(step) {
+  if (step === 'stripe login --complete-device') return ['login', '--complete-device'];
+  if (step === 'stripe login --complete-reauth') return ['login', '--complete-reauth'];
+  const m = /^stripe login --complete[ =](?:'([^']+)'|"([^"]+)"|(\S+))$/.exec(step ?? '');
+  const url = m && (m[1] || m[2] || m[3]);
+  return stripeURL(url) ? ['login', '--complete', url] : null;
+}
+
+export async function shopConnect(root, options = {}) {
+  if (options.manual) {
+    const result = await shopConnectManual(root, options);
+    if (result.ok) rmSync(join(receiptDir(root, options.storage ?? receiptHome()), 'test.json'), { force: true });
+    return result;
+  }
+  const { live = false, renew = false, log = () => {}, exec = stripeProcess, open = openBrowser,
+    storage = receiptHome(), wrangler = null } = options;
+  const mode = live ? 'live' : 'test';
+  const checked = readShop(root);
+  if (!checked.ok || checked.absent) return failure('shop', 'Create and check shop.json first: homie-studio shop init, then shop check.');
+  if (options.managed === true && checked.shop.till !== 'stripe-managed') return failure('shop-settings', 'For Managed Payments, set shop.json till to stripe-managed and deploy that choice before connecting. Stripe’s own eligibility and terms still apply.');
+  const id = hash(realpathSync(root)).slice(0, 24);
+  const profile = `homie-${id}`;
+  const dir = join(storage, id);
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  // Reuse the toolkit’s process-aware lock, in the private receipt folder. Dead processes do not strand setup.
+  const lock = lockDeploy(dir);
+  if (!lock.ok) return failure('busy', 'Stripe connection is already running for this studio. Wait for that command to finish.');
+  try {
+    const cli = (args) => exec(['--project-name', profile, ...args], { cwd: root });
+    const installed = await cli(['--version']);
+    if (installed.code !== 0) return failure('stripe-cli', 'Install Stripe’s official CLI, then run shop connect again.', { next: ['npm install -g @stripe/cli@latest'] });
+
+    // A read both checks existing credentials and lets Stripe refresh its OAuth session itself.
+    let probe = renew ? { code: 1 } : await cli(['get', '/v1/products', '-d', 'limit=1', ...(live ? ['--live'] : [])]);
+    if (probe.code !== 0 || !Array.isArray(json(probe.stdout)?.data)) {
+      const start = await cli(['login', '--non-interactive', ...(renew ? ['--new-session'] : [])]);
+      const login = json(start.stdout);
+      const complete = completionArgs(login?.next_step);
+      if (start.code !== 0 || !stripeURL(login?.browser_url) || !complete || !/^[a-zA-Z0-9 -]{1,100}$/.test(login?.verification_code ?? '')) {
+        return failure('stripe-login', 'Stripe could not start browser approval. Update the official Stripe CLI and try shop connect again. An account administrator may need to enable CLI access in Stripe’s MCP and CLI access settings.');
+      }
+      log(`Approve your studio’s Stripe account in your browser. Pairing code: ${login.verification_code}. ${login.browser_url}`);
+      open(login.browser_url);
+      const finished = await cli(complete);
+      if (finished.code !== 0) return failure('stripe-login', 'Stripe approval did not finish. Run shop connect again when ready.');
+
+      probe = await cli(['get', '/v1/products', '-d', 'limit=1', ...(live ? ['--live'] : [])]);
+      if (probe.code !== 0 || !Array.isArray(json(probe.stdout)?.data)) return failure('stripe-access', 'Stripe is signed in but cannot read Products in the requested mode. Review the account, sandbox and permissions in Stripe, then run shop connect --renew again.');
+    }
+    const site = siteUrl(root);
+    if (!site) return failure('deploy', 'Stripe is connected on this computer. Deploy the studio with studio_deploy (Cloudflare approval first if needed), then run shop connect again.', { mode, connected: true });
+    let target;
+    try { target = new URL(site); } catch { return failure('deploy', 'Deploy the studio to a public HTTPS address, then run shop connect again.'); }
+    if (target.protocol !== 'https:' || target.username || target.password || /^(localhost|127\.|\[::1\])/.test(target.hostname)) return failure('deploy', 'Deploy the studio to a public HTTPS address, then run shop connect again.');
+    const api = async (method, path, params, idempotency) => {
+      const args = [method.toLowerCase(), path, '--stripe-version', LINKS_STRIPE_VERSION, ...(live ? ['--live'] : []), ...(idempotency ? ['--idempotency', idempotency] : [])];
+      for (const [k, v] of formEncode(params)) args.push('-d', `${k}=${v}`);
+      const r = await cli(args);
+      const body = json(r.stdout);
+      if (r.code !== 0 || !body || body.error) throw new Error('Stripe API operation failed');
+      return body;
+    };
+    const reason = fullerReason(checked.shop);
+    if (reason) return failure('fuller-checkout', reason, { mode, connected: true });
+    const studio = readStudio(root);
+    const w = wrangler ?? runner(root, studio.cloudflare?.accountId ? { CLOUDFLARE_ACCOUNT_ID: studio.cloudflare.accountId } : {});
+    const receiptFile = join(dir, `${mode}.json`);
+    const receipt = existsSync(receiptFile) ? json(readFileSync(receiptFile, 'utf8')) : null;
+    const result = await syncPaymentLinks({ api, shop: checked.shop, slug: studio.slug, site: target.origin, mode, w, receipt,
+      saveReceipt: (record) => {
+        writeFileSync(`${receiptFile}.tmp`, JSON.stringify(record), { mode: 0o600 });
+        renameSync(`${receiptFile}.tmp`, receiptFile);
+      } });
+    return { ...result, profile };
+  } catch {
+    return failure('stripe-setup', 'Stripe setup could not finish. Check the studio’s Stripe session and Products, Prices, Payment Links and Webhook Endpoints write permissions, and the Cloudflare login, then run shop connect again. No credentials were printed.');
+  } finally { lock.release(); }
+}

package/lib/template-history.json

@@ -1846,7 +1846,51 @@
      "## Art direction and models": "a48fff7bf0a5f2fc",
      "## Running live games (the back office)": "51ebf2ab756f6e4d",
      "## Servers and AI seats": "98d08705087a33ec",
-     "## Selling things (the shop)": "57c04f6526e16890",
+     "## Selling things (the shop)": [
+      "57c04f6526e16890",
+      "6c30b932b0783495",
+      "9e020d69dd6a954e"
+     ],
+     "## Continuing a build from the Claude app": "0d68081e924ca419",
+     "## Rules": "2e6b29afb85dcf7e",
+     "## Telling Homie": "80b46fdd9e578db8",
+     "## Beta": "9d02638207a26e73"
+    }
+   },
+   "named": {
+    "Homie Arcade": {
+     "sections": {
+      "AGENTS.md": {
+       "## Commands (all through the pinned CLI in node_modules)": "7cad8fd10f62fef1"
+      }
+     }
+    }
+   }
+  },
+  "0.35.0": {
+   "files": {
+    "CLAUDE.md": "ddf2b2a0376202f6",
+    "README.md": "684b3cca8001673c",
+    "HANDOFF.md": "29337e2ace95b2e7",
+    "games/README.md": "5ad32fe80c61f117",
+    "music/README.md": "a3dc042dadd39df8",
+    "videos/README.md": "16babc3437d5545b",
+    "posts/README.md": "37841aae476bd540",
+    "site/README.md": "732894273a32dc3f",
+    "site/src/worker.mjs": "fc90f3609cad18ba"
+   },
+   "sections": {
+    "AGENTS.md": {
+     "(intro)": "214aa46eb3a895d5",
+     "## Layout": "8baf49e4291e7e88",
+     "## Commands (all through the pinned CLI in node_modules)": "a7f290579585368c",
+     "## The site": "0cb8dd9a6f8a0096",
+     "## Making games": "2da7fa74c8884834",
+     "## The Game Codex and progress": "0738ef719cef3a4c",
+     "## Art direction and models": "a48fff7bf0a5f2fc",
+     "## Running live games (the back office)": "51ebf2ab756f6e4d",
+     "## Servers and AI seats": "98d08705087a33ec",
+     "## Selling things (the shop)": "9e020d69dd6a954e",
      "## Continuing a build from the Claude app": "0d68081e924ca419",
      "## Rules": "2e6b29afb85dcf7e",
      "## Telling Homie": "80b46fdd9e578db8",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homie-rocks/studio",
-  "version": "0.34.0",
+  "version": "0.35.0",
   "description": "A studio for games, music and video on its own Cloudflare: scaffold, multiplayer starters on the netplay contract, a port toolkit that makes existing single-player web games multiplayer, the site Worker with public rooms (Table/Lobby Durable Objects and D1, all on the free Workers plan, no payment method), a site with the hub's sections (Home, Games, Music, Videos, Rooms, Posts with feeds) in the studio's own look, an epic landing page for every game, big songs and videos in the studio's own R2 once it has storage (uploaded, checked by SHA-256, served at the same addresses), deploy, and the homie.rocks directory.",
   "type": "module",
   "license": "Apache-2.0",