@homie-rocks/studio 0.37.0 → 0.37.2

package/lib/parts-tools.mjs

@@ -1,3 +1,4 @@
+import { purchasePortal } from './parts-purchase.mjs';
 /**
  * GAME PARTS AS CHAT TOOLS (parts/PARTS.md): parts_find, part_add, part_new and part_share, named and worded like
  * the asset tools beside them (assets_find, asset_add). Four tools are the whole surface: a newer version of a part
@@ -11,7 +12,7 @@ import { addPart, checkParts, findParts, sharePart } from './parts-store.mjs';
 import { partsLines } from './parts-cli.mjs';
 
 /** What the planning and game-making tools say about parts, in one place so a test can hold them to it. */
-export const PARTS_FIRST = 'Before writing any system from scratch (camera, movement, bots, pickups, effects, sound, UI, environment), look for what exists, two different things: (1) the @homie-rocks/* packages on npm have the general mechanism (camera, input, audio, effects): use them; (2) `parts find` (the parts_find tool) searches the pieces of real games other studios shared: a creature from one game, a level from another, a bot brain from a third, each brought in with part_add. Record in the game\'s CODEX what came from where: which packages, which parts and the game and studio each came from, and what was written here and why. After building a piece another game could use, offer the person to make it a part (part_new lifts it out of the game) and, only if they ask, to share it (part_share).';
+export const PARTS_FIRST = 'Before writing any system from scratch (camera, movement, bots, pickups, effects, sound, UI, environment), look for what exists, two different things: (1) the @homie-rocks/* packages on npm have the general mechanism (camera, input, audio, effects): use them; (2) `parts find` (the parts_find tool) searches the pieces of games, apps, music and video other studios shared: a creature from one game, a level from another, a bot brain from a third, each brought in with part_add. Record in the project notes or CODEX what came from where: which packages, which parts and the work and studio each came from, and what was written here and why. After building a reusable piece, offer the person to make it a part (part_new lifts it out of the game) and, only if they ask, to share it (part_share).';
 
 /** A fix-it line that names the plumbing, said as the chat tool that does the same. */
 export const inChat = (t) => String(t).replace(/homie-studio parts add (\S+?)(?:@(\S+))?(?: --game (\S+))?(?=[\s).,;]|$)/g, (m, ref, v, g) => `part_add { "part": "${ref}${v ? `@${v}` : ''}"${g ? `, "game": "${g}"` : ''} }`);
@@ -24,36 +25,38 @@ export function partsToolDefs(ctx, h) {
     {
       name: 'parts_find', title: 'Find game parts',
       description: 'Search the pieces of real games that studios shared (a creature, a level generator, a chase camera, a bot brain, a pickup mechanic, an audio pack), and this studio\'s own parts. The first move when planning or building a game: run it for each system the game needs before writing one from scratch, so a new game can be made with parts from several games. Each result has its licence, the game and studio it came from, its costs, what it builds on and what part_add takes. If the catalogue cannot be reached it says so (that is not "nothing exists"). Homie\'s @homie-rocks/* packages are not parts and are not listed here: they come from npm.',
-      inputSchema: { type: 'object', properties: { query: str('Words for what the game needs: "chase camera", "pickups", "cave"'), kind: { type: 'string', enum: [...PART_KINDS], description: 'Only this kind of part' }, tag: str('Only parts with this tag'), license: str('Only this licence (an SPDX identifier, e.g. CC0-1.0)'), builds: str('Only parts that build on this: a package ("@homie-rocks/camera") or a skeleton ("humanoid-v1")'), ...STUDIO_ARG } },
+      inputSchema: { type: 'object', properties: { query: str('Words for what the game needs: "chase camera", "pickups", "cave"'), kind: { type: 'string', description: 'Only this kind of part' }, tag: str('Only parts with this tag'), license: str('Only this licence (an SPDX identifier, e.g. CC0-1.0)'), builds: str('Only parts that build on this: a package ("@homie-rocks/camera") or a skeleton ("humanoid-v1")'), ...STUDIO_ARG } },
       annotations: { title: 'Find game parts', ...RO, openWorldHint: true },
       run: async (a) => {
         const root = ctx.root(a.studio, { need: false });
         const r = await findParts(root, String(a.query ?? ''), { kind: a.kind ?? null, tag: a.tag ?? null, license: a.license ?? null, builds: a.builds ?? null, fetch: net().fetch, hub: ctx.directory ?? null });
-        return ok([text(r), '', r.results.length ? 'Tell the person what you found and which game each piece is from, with your pick; part_add brings one in. Write in the game\'s CODEX which parts it uses and what you wrote yourself and why.' : 'Nothing fits: write it, and say so in the game\'s CODEX. If it turns out reusable, offer to make it a part (part_new).'].join('\n'), { kind: 'parts', ...r });
+        return ok([text(r), '', r.results.length ? 'Tell the person what you found and which work and studio each piece is from, with your pick; part_add brings one in. Write in the project notes or CODEX which parts it uses and what you wrote yourself and why.' : 'Nothing fits: write it, and say so in the project notes or CODEX. If it turns out reusable, offer to make it a part (part_new).'].join('\n'), { kind: 'parts', ...r });
       },
     },
     {
-      name: 'part_add', title: 'Add a game part',
-      description: 'Bring a part another studio shared into this studio, for a game: one exact version is fetched (the latest unless the part names one, "<studio site>/<part id>@1.2.0"), every file is checked against its SHA-256, and it is copied into parts/ where the studio owns and tunes it. The game credits it (its licence and who made it, on the game\'s credits page), and the packages it builds on are installed by npm. For a part that is already here it brings the newer version: what changed is shown, the studio\'s tuning is kept, and a file the studio edited is never replaced unless overwrite is true (ask the person first). The result says plainly when the licences of the game\'s parts cannot be combined, and gives the one import line.',
-      inputSchema: { type: 'object', properties: { part: str('"<studio site>/<part id>", as parts_find gives it; "@<version>" for one version'), game: str('The game that will use it (its credits get the line)'), overwrite: { type: 'boolean', description: 'For a newer version: also replace files this studio edited. Only after the person agreed' }, ...STUDIO_ARG }, required: ['part'] },
-      annotations: { title: 'Add a game part', ...RW, openWorldHint: true },
+      name: 'part_add', title: 'Add a studio part',
+      description: 'Bring a part another studio shared into this studio, for a game or app, music or video: one exact version is fetched (the latest unless the part names one, "<studio site>/<part id>@1.2.0"), every file is checked against its SHA-256, and it is copied into parts/ where the studio owns and tunes it. The game credits it (its licence and who made it, on the game\'s credits page), and the packages it builds on are installed by npm. For a part that is already here it brings the newer version: what changed is shown, the studio\'s tuning is kept, and a file the studio edited is never replaced unless overwrite is true (ask the person first). The result says plainly when the licences of the game\'s parts cannot be combined, and gives the one import line.',
+      inputSchema: { type: 'object', properties: { part: str('"<studio site>/<part id>", as parts_find gives it; "@<version>" for one version'), game: str('The game or app that will use it (its credits get the line)'), approve: str('The exact quote hash returned by part_add, ONLY with owner or wallet authority covering its exact price, currency, quantity, recurrence and terms'), wallet: { type: 'string', enum: ['link-cli', 'tempo', 'purl'], description: 'The person’s installed wallet client; its authority and limits govern payment' }, quantity: { type: 'integer', minimum: 1, description: 'Quantity under the seller’s licence terms' }, offline: { type: 'boolean', description: 'Restore the verified private purchase backup without the seller; revocation status is only last known' }, manage: { type: 'boolean', description: 'Return the purchase Stripe portal link to manage or cancel a subscription' }, overwrite: { type: 'boolean', description: 'For a newer version: also replace files this studio edited. Only after the person agreed' }, ...STUDIO_ARG }, required: ['part'] },
+      annotations: { title: 'Add a studio part', ...RW, openWorldHint: true },
       run: async (a) => {
         const root = ctx.root(a.studio);
+        if (a.manage) { const r = await purchasePortal(root, String(a.part ?? ''), { game: a.game ?? null, ...net() }); return ok(r.message, { kind: 'part', ...r }); }
         const said = [];
-        const r = await addPart(root, String(a.part ?? ''), { game: a.game ? String(a.game) : null, overwrite: a.overwrite === true, say: (l) => said.push(l), ...net() });
+        const r = await addPart(root, String(a.part ?? ''), { game: a.game ? String(a.game) : null, overwrite: a.overwrite === true, approve: a.approve ?? null, quantity: a.quantity ?? 1, offline: a.offline === true, wallet: a.wallet, say: (l) => said.push(l), ...net() });
+        if (!r.ok && r.purchase) return ok(r.why, { kind: 'part', ...r, awaitingPurchase: true });
         if (!r.ok) return fail(`Not added: ${inChat(r.why)}`, { kind: 'part', ...r });
         const next = [];
         if (r.import) next.push(`In the game: import … from '${r.import}', then build. Its part.json says what it takes ("contract") and its tuning.json holds the values to tune.`);
         for (const n of r.needs) next.push(`It needs another part, ${n.ref}: part_add { "part": "${n.ref}"${a.game ? `, "game": "${a.game}"` : ''} }.`);
         if (r.licences.some((c) => c.level === 'conflict')) next.push('The licences cannot be combined (above): tell the person plainly before building on it.');
         if (r.packages.some((p) => p.state === 'pinned' || p.state === 'failed')) next.push('A package it builds on is not in place (above): the part will not build until it is.');
-        return ok([...said, text(r), ...next, 'Write in the game\'s CODEX that it uses this part and which game and studio it came from.'].join('\n'), { kind: 'part', ...r });
+        return ok([...said, text(r), ...next, 'Write in the project notes or CODEX that it uses this part and which work and studio it came from.'].join('\n'), { kind: 'part', ...r });
       },
     },
     {
       name: 'part_new', title: 'Make a shared part',
-      description: 'Make a part of this studio: a reusable piece of a game, app, music or video. With from (a game\'s id) and files (paths inside that game: a module or a folder), the files are LIFTED out of the game into parts/<id>/ and the game imports them from there, so it builds and behaves as before; a file that still reaches into the rest of the game is refused by name (pass what it needs in as an argument first). Without from, an empty part to write. A part is a reusable piece, never an entire experience, in whatever form suits it (code, assets, data, a tuned config). A new part is private. Offer this after building something reusable.',
-      inputSchema: { type: 'object', properties: { id: str('The part\'s id (lowercase, digits, hyphens): "chase-camera"'), kind: { type: 'string', enum: [...PART_KINDS], description: 'What kind of part (default mechanic)' }, name: str('Its name'), uses: { type: 'array', items: { type: 'string', enum: ['game', 'app', 'venue', 'cause', 'music', 'video'] } }, from: str('The game to lift it out of'), files: { type: 'array', items: { type: 'string' }, description: 'With from: paths inside games/<from>/ that become the part ("src/creature.ts", "src/cave")' }, ...STUDIO_ARG }, required: ['id'] },
+      description: 'Make a part of this studio: a reusable piece of a game, app, music or video. With from (a game or app id) and files (paths inside that experience: a module or a folder), the files are LIFTED out of the game into parts/<id>/ and the game imports them from there, so it builds and behaves as before; a file that still reaches into the rest of the game is refused by name (pass what it needs in as an argument first). Without from, an empty part to write. A part is a reusable piece, never an entire experience, in whatever form suits it (code, assets, data, a tuned config). A new part is private. Offer this after building something reusable.',
+      inputSchema: { type: 'object', properties: { id: str('The part\'s id (lowercase, digits, hyphens): "chase-camera"'), kind: { type: 'string', description: 'What kind of part (default mechanic)' }, name: str('Its name'), uses: { type: 'array', items: { type: 'string', enum: ['game', 'app', 'venue', 'cause', 'music', 'video'] } }, from: str('The game or app to lift it out of'), files: { type: 'array', items: { type: 'string' }, description: 'With from: paths inside games/<from>/ or apps/<from>/ that become the part ("src/creature.ts", "src/cave")' }, ...STUDIO_ARG }, required: ['id'] },
       annotations: { title: 'Make a shared part', ...RW },
       run: async (a) => {
         const root = ctx.root(a.studio);
@@ -64,7 +67,7 @@ export function partsToolDefs(ctx, h) {
     },
     {
       name: 'part_share', title: 'Share a part',
-      description: 'Share one of this studio\'s parts with other studios, or stop sharing it. Only when the person asked: a part is private until they say otherwise. It needs a licence the person picked (an SPDX identifier: CC0-1.0, CC-BY-4.0, MIT…; with license it is set here), who to credit when the licence asks, and known rights to every file: anything in the way is listed in plain words and nothing is shared. It is live after the studio\'s next deploy (studio_deploy), not before; stopping takes effect then too. With share left out it only checks and reports.',
+      description: 'Share one of this studio\'s parts with other studios, or stop sharing it. Only when the person asked: a part is private until they say otherwise. It needs a licence the person picked (an SPDX identifier: CC0-1.0, CC-BY-4.0, MIT…; with license it is set here), who to credit when the licence asks, and optional sale and licenseTerms fields in part.json for a paid licence, and known rights to every file: anything in the way is listed in plain words and nothing is shared. It is live after the studio\'s next deploy (studio_deploy), not before; stopping takes effect then too. With share left out it only checks and reports.',
       inputSchema: { type: 'object', properties: { id: str('The part\'s id'), share: { type: 'boolean', description: 'true: share it; false: stop sharing it; left out: only check what stands in the way' }, license: str('The licence the person picked, an SPDX identifier (set before sharing)'), attribution: str('Who a game using it should credit'), ...STUDIO_ARG }, required: ['id'] },
       annotations: { title: 'Share a part', ...RW },
       run: async (a) => {

package/lib/parts-upload.mjs

@@ -0,0 +1,43 @@
+/** Private R2 releases. Upload and verify before a deploy exposes the public offer. */
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { listOwnParts, packedDir, packedVersions, publicPart, readPart, sha256, verifyFiles } from './parts.mjs';
+import { objectKey, releaseKey } from "../worker/parts-sale.mjs";
+
+export function paidReleases(root) {
+  return listOwnParts(root).flatMap(({ id }) => packedVersions(root, id).map((version) => {
+    const dir = packedDir(root, id, version); const part = readPart(dir);
+    return part.sale ? { dir, part: publicPart({ ...part, share: true }) } : null;
+  }).filter(Boolean));
+}
+
+/** The uploader uses the same Wrangler execution and read-back hashing as mediaMove. */
+export async function uploadPaidParts(root, { bucket, put, hash, log = () => {} }) {
+  const releases = paidReleases(root);
+  if (!releases.length) return { releases: 0, files: 0 };
+  if (!bucket) throw new Error('Paid parts need private R2 storage. Set up storage with homie-studio storage add before deploying. Never enable a public bucket domain.');
+  const temp = mkdtempSync(join(tmpdir(), 'homie-parts-upload-')); const seen = new Set();
+  try {
+    const upload = async (key, path, expected) => {
+      const before = await hash(`${bucket}/${key}`);
+      if (before.code === 0 && before.sha256 === expected.sha256 && before.bytes === expected.bytes) return;
+      if (before.code === 0 && key.startsWith('paid-parts/releases/')) throw new Error(`${key} already exists with different terms. A release is immutable`);
+      const sent = await put(`${bucket}/${key}`, path);
+      if (sent.code !== 0) throw new Error(`Paid part upload failed for ${key}. Nothing may be offered until storage is verified`);
+      const got = await hash(`${bucket}/${key}`);
+      if (got.code !== 0 || got.sha256 !== expected.sha256 || got.bytes !== expected.bytes) throw new Error(`Paid part upload failed integrity verification for ${key}`);
+    };
+    for (const { dir, part } of releases) {
+      if (!verifyFiles(dir, part).ok) throw new Error(`Packed part ${part.id} ${part.version} no longer matches its files`);
+      for (const f of part.files) {
+        if (seen.has(f.sha256)) continue;
+        await upload(objectKey(f.sha256), join(dir, f.path), f); seen.add(f.sha256);
+      }
+      const bytes = Buffer.from(JSON.stringify(part)); const file = join(temp, 'part.json'); writeFileSync(file, bytes);
+      await upload(releaseKey(part.id, part.version), file, { sha256: sha256(bytes), bytes: bytes.length });
+      log(`verified private part ${part.id} ${part.version} in R2`);
+    }
+    return { releases: releases.length, files: seen.size };
+  } finally { rmSync(temp, { recursive: true, force: true }); }
+}

package/lib/parts.mjs

@@ -20,12 +20,17 @@ import { experienceDir, experienceFile } from './studio.mjs';
  * NOTHING HERE IS A PACKAGE MANAGER: packages are npm's (lib/parts-store.mjs hands them to npm), and a part is copied
  * in and then the studio's own. There are no version ranges, no resolver and no lockfile of Homie's.
  */
+import { canonicalJson } from '../worker/referrals.mjs';
+import { createRequire } from 'node:module';
+const require = createRequire(import.meta.url);
+const parseSpdx = (value) => require('spdx-expression-parse')(value);
+import { saleProblems } from "../worker/parts-sale.mjs";
 import { createHash } from 'node:crypto';
 import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { dirname, join, relative } from 'node:path';
 
 export const PART_ID = /^[a-z0-9][a-z0-9-]{0,47}$/;
-export const PART_KINDS = Object.freeze(['character', 'rig', 'clips', 'environment', 'effect', 'sound', 'ui', 'mechanic', 'shader', 'level-generator', 'bot-brain', 'audio-pack', 'set-piece', 'quiz', 'menu-board', 'waitlist', 'live-total', 'loop', 'stem', 'track', 'video-intro', 'video-template']);
+export const PART_KINDS = Object.freeze(['character', 'rig', 'clips', 'environment', 'effect', 'sound', 'ui', 'mechanic', 'shader', 'level-generator', 'bot-brain', 'audio-pack', 'set-piece', 'quiz', 'menu-board', 'waitlist', 'live-total', 'loop', 'stem', 'track', 'video-intro', 'video-template', 'app', 'music', 'video']);
 export const NETPLAY_KINDS = Object.freeze(['host-authoritative', 'replicated', 'local']);
 export const PROVENANCE = Object.freeze(['original', 'generated', 'imported']);
 export const PIVOTS = Object.freeze(['feet', 'centre', 'base', 'origin']);
@@ -107,7 +112,10 @@ export function licenseOfPart(value) {
   const id = typeof value === 'string' ? value.trim() : '';
   // Not an identifier at all; a word people write instead of one (cc0, proprietary); or a real
   // identifier in the wrong case (SPDX is case-sensitive, and "mit" must not pass as some unknown licence).
-  if (!id || !SPDX_SHAPE.test(id)) return null;
+  if (!id) return null;
+  if (!SPDX_SHAPE.test(id)) {
+    try { parseSpdx(id); return { id, class: 'unrecognised', credit: true, asks: 'read this SPDX expression and its licence texts; no alternative was selected', known: false }; } catch { return null; }
+  }
   const cased = Object.values(CLASSES).flatMap((c) => c.ids).find((k) => k.toLowerCase() === id.toLowerCase());
   if (cased ? cased !== id : Object.hasOwn(NOT_SPDX, id.toLowerCase())) return null;
   for (const [name, c] of Object.entries(CLASSES)) if (c.ids.includes(id)) return { id, class: name, credit: c.credit, asks: c.asks, known: true };
@@ -231,7 +239,7 @@ export function checkPart(part, { id = null } = {}) {
   if (!PART_ID.test(String(part.id ?? ''))) bad('id', `"${String(part.id ?? '').slice(0, 60)}" is not a part id`, 'lowercase letters, digits and hyphens, starting with a letter or digit (chase-camera)');
   else if (id && part.id !== id) bad('id', `the folder is parts/${id} but part.json says "${part.id}"`, 'name them the same');
   if (!clean(part.name, 80)) bad('name', 'it has no name', 'a few words a person would search for ("Third-person chase camera")');
-  if (!PART_KINDS.includes(part.kind)) bad('kind', part.kind === undefined ? 'it has no kind' : `"${String(part.kind).slice(0, 40)}" is not a kind of part`, `one of: ${PART_KINDS.join(', ')}`);
+  if (!(typeof part.kind === 'string' && /^[a-z0-9][a-z0-9-]*$/.test(part.kind))) bad('kind', part.kind === undefined ? 'it has no kind' : `"${String(part.kind).slice(0, 40)}" is not a kind of part`, 'a lowercase label using letters, digits and hyphens');
   if (!isVersion(part.version)) bad('version', part.version === undefined ? 'it has no version' : `"${String(part.version).slice(0, 40)}" is not a version`, 'three numbers: 1.0.0');
   // A part being written has no summary yet; one that is shared must (shareProblems).
   if (!clean(part.summary)) warn('summary', 'it has no summary', 'one sentence: what it does and what it needs from a game');
@@ -239,6 +247,8 @@ export function checkPart(part, { id = null } = {}) {
   if (part.share !== undefined && typeof part.share !== 'boolean') bad('share', 'it is neither true nor false', 'false keeps the part private (the default); sharing the part sets it true');
   if (part.license !== undefined && part.license !== null && part.license !== '' && !licenseOfPart(part.license)) bad('license', 'it is not a licence a stranger can rely on', licenceHint(part.license));
   if (part.attribution !== undefined && typeof part.attribution !== 'string') bad('attribution', 'it is not text', 'the line a game using the part shows in its credits, or ""');
+  for (const problem of saleProblems(part)) bad('sale', problem);
+  if (part.licenseTerms !== undefined && !safePath(part.licenseTerms)) bad('licenseTerms', 'must be a file inside the part');
   if (part.tags !== undefined) {
     if (!Array.isArray(part.tags) || part.tags.some((t) => typeof t !== 'string' || !/^[a-z0-9][a-z0-9-]{0,29}$/.test(t))) bad('tags', 'a tag is not a lowercase word', 'up to 12 words such as "camera", "3d", "top-down"');
     else if (part.tags.length > 12) warn('tags', 'more than 12 tags; the first 12 are used', null);
@@ -444,6 +454,24 @@ export function packPart(root, id, { bump = null } = {}) {
   const dir = partDir(root, id);
   let part = readPart(dir);
   if (bump) { part.version = bumpVersion(part.version, bump); writePart(dir, part); }
+  // REUSE places custom licence texts under LICENSES and annotates binary files.
+  if (part.sale && part.licenseTerms && safePath(part.licenseTerms) && existsSync(join(dir, part.licenseTerms)) && !existsSync(packedDir(root, id, part.version))) {
+    const refs = [...new Set(String(part.license).match(/LicenseRef-[A-Za-z0-9.-]+/g) ?? [])];
+    if (refs.length > 1 && refs.some((ref) => !existsSync(join(dir, 'LICENSES', `${ref}.txt`)))) return { ok: false, command: 'parts pack', id, why: 'An expression with multiple custom licences needs each full text under LICENSES before packing' };
+    for (const ref of refs) {
+      const target = join(dir, 'LICENSES', `${ref}.txt`);
+      mkdirSync(dirname(target), { recursive: true });
+      if (!existsSync(target)) cpSync(join(dir, part.licenseTerms), target);
+    }
+    if (!existsSync(join(dir, 'REUSE.toml'))) writeFileSync(join(dir, 'REUSE.toml'), `version = 1
+
+[[annotations]]
+path = ["**"]
+precedence = "aggregate"
+SPDX-FileCopyrightText = ${JSON.stringify(part.attribution || 'The selling studio')}
+SPDX-License-Identifier = ${JSON.stringify(part.license)}
+`);
+  }
   part = writeHashes(dir);
   const shape = checkPart(part, { id });
   if (!shape.ok) return { ok: false, command: 'parts pack', id, why: `parts/${id} is not a part yet: ${shape.problems.filter((p) => p.level === 'refuse').map((p) => `${p.field}: ${p.problem}${p.fix ? ` (${p.fix})` : ''}`).slice(0, 4).join('; ')}`, problems: shape.problems };
@@ -451,6 +479,9 @@ export function packPart(root, id, { bump = null } = {}) {
   if (existsSync(out)) {
     const was = readPart(out);
     const same = JSON.stringify((was.files ?? []).map((f) => [f.path, f.sha256])) === JSON.stringify(part.files.map((f) => [f.path, f.sha256]));
+    if ((was.sale || part.sale) && canonicalJson(publicPart({ ...was, share: true })) !== canonicalJson(publicPart({ ...part, share: true }))) return { ok: false, command: 'parts pack', id, why: 'A paid release is immutable, including its description, price and licence. Give the change a new version.' };
+    const legalSame = JSON.stringify({ license: was.license, licenseTerms: was.licenseTerms, sale: was.sale }) === JSON.stringify({ license: part.license, licenseTerms: part.licenseTerms, sale: part.sale });
+    if (!legalSame) return { ok: false, command: 'parts pack', id, why: 'A packed version cannot change its price or licence terms. Give it a new version.' };
     if (!same) return { ok: false, command: 'parts pack', id, version: part.version, why: `parts/${id} ${part.version} is already packed with different files, and a shared version never changes (another studio may have copied it). Give the change a new version: raise "version" in parts/${id}/part.json, then share it again.` };
     // The same bytes: only the description may have moved (a summary, `share`), so the frozen copy takes it.
     writePart(out, part);
@@ -566,7 +597,7 @@ function liftPlan(root, game, paths) {
  */
 export function newPart(root, id, { kind = 'mechanic', name = null, from = null, paths = [], uses = [] } = {}) {
   if (!PART_ID.test(String(id ?? ''))) return { ok: false, command: 'parts new', why: `"${id ?? ''}" is not a part id: lowercase letters, digits and hyphens (chase-camera)` };
-  if (!PART_KINDS.includes(kind)) return { ok: false, command: 'parts new', why: `"${kind}" is not a kind of part: ${PART_KINDS.join(', ')}` };
+  if (!(typeof kind === 'string' && /^[a-z0-9][a-z0-9-]*$/.test(kind))) return { ok: false, command: 'parts new', why: `"${kind}" is not a lowercase kind label` };
   if (!Array.isArray(uses) || uses.some((u) => !['game', 'app', 'venue', 'cause', 'music', 'video'].includes(u))) return { ok: false, command: 'parts new', why: 'invalid intended uses' };
   const dir = partDir(root, id);
   if (existsSync(dir)) return { ok: false, command: 'parts new', why: `parts/${id} is there already` };
@@ -653,6 +684,19 @@ export function licenceIssues(items, { game = null } = {}) {
   const add = (level, parts, problem, fix = null) => out.push({ level, parts, problem, fix });
   const sa = new Map();
   for (const x of items.filter((y) => isObj(y.part))) {
+    if (x.vendored && x.part.sale) {
+      const s = x.part.sale; const p = x.purchase;
+      if (!p) add('conflict', [x.ref], 'No purchase evidence is recorded for this paid part', 'add it through part_add');
+      else {
+        if (p.version !== x.part.version) add('conflict', [x.ref], 'This game has no recorded grant for the installed paid release', 'call part_add for this game and version to check its update rights');
+        if (p.scope === 'game' && game && p.game !== game.id) add('conflict', [x.ref], `This licence covers game ${p.game}, not ${game.id}`, 'buy a licence for this game');
+        if (p.paidUntil && p.paidUntil <= Date.now() && s.onExpiry === 'terminate') add('conflict', [x.ref], 'The subscription licence expired', 'renew through the seller');
+        if (['refunded', 'lost'].includes(p.status) && s.onRefund === 'terminate') add('conflict', [x.ref], 'This purchase was revoked under its refund terms', 'settle the licence before publishing');
+        add('note', [x.ref], `${p.mode} purchase; ${p.scope} scope${p.scope === 'seat' ? `, ${p.quantity} seats` : ''}; last checked ${p.checkedAt ?? 'unknown'}. Offline evidence cannot prove current refund status.`);
+      }
+      if (game?.sells && !s.commercialUse) add('conflict', [x.ref], 'This paid licence excludes commercial use', 'obtain commercial rights before selling');
+      add('note', [x.ref], `Read ${x.part.licenseTerms}: source ${s.source ? 'included' : 'not included'}, transfer ${s.transferable ? 'permitted under the written terms' : 'requires a new licence'}. Publishing a game does not grant standalone part redistribution rights.`);
+    }
     const lic = licenseOfPart(x.part.license);
     if (!lic) { if (x.vendored) add('conflict', [x.ref], 'it names no licence, so nothing says a game may use it', 'ask its studio, or use another part'); continue; }
     if (lic.class === 'unrecognised') add('warn', [x.ref], `${lic.id} is not a licence the toolkit can reason about`, 'read it with the person before the game goes online');
@@ -677,7 +721,7 @@ export function creditLine(ref, entry) {
     url: entry.page ?? null,
     licence: lic?.id ?? null,
     licenceUrl: lic?.known ? `https://spdx.org/licenses/${lic.id}.html` : null,
-    note: entry.from?.name || entry.from?.game ? `A part of ${entry.from.name ?? entry.from.game}, from ${ref.split('/')[0]}` : `A game part from ${ref.split('/')[0]}`,
+    note: entry.from?.name || entry.from?.game ? `A part of ${entry.from.name ?? entry.from.game}, from ${ref.split('/')[0]}` : `A studio part from ${ref.split('/')[0]}`,
     part: ref,
   };
 }

package/lib/prepare.mjs

@@ -0,0 +1,47 @@
+/** Private Node installation for a Desktop host with a bundled runtime but no system Node.
+ * Official archive + SHA-256, no shell, administrator rights or shell profile edits.
+ */
+import { createHash } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { existsSync, mkdirSync, mkdtempSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+export const nodeHome = (home = homedir()) => join(home, '.cache', 'homie-studio', 'node');
+export async function prepareNode({ home = homedir(), platform = process.platform, arch = process.arch, fetchFn = fetch, exec = spawnSync } = {}) {
+  const base = nodeHome(home);
+  const bin = join(base, platform === 'win32' ? 'node.exe' : 'bin/node');
+  if (existsSync(bin)) return { ok: true, bin, installed: false };
+  if (!['darwin', 'linux', 'win32'].includes(platform) || !['arm64', 'x64'].includes(arch)) {
+    return { ok: false, next: 'Ask the connected AI to install Node.js 22 or newer for this operating system.', open: 'https://nodejs.org/en/download' };
+  }
+  let scratch;
+  try {
+    const get = async (url) => {
+      const r = await fetchFn(url, { signal: AbortSignal.timeout(15_000) });
+      if (!r.ok) throw new Error(`Node download answered ${r.status}`);
+      return r;
+    };
+    const url = 'https://nodejs.org/dist/latest-v22.x';
+    const sums = await (await get(`${url}/SHASUMS256.txt`)).text();
+    const suffix = `${platform === 'win32' ? 'win' : platform}-${arch}.${platform === 'win32' ? 'zip' : 'tar.gz'}`;
+    const entry = sums.split('\n').map((s) => s.trim().split(/\s+/)).find(([hash, file]) => /^[a-f0-9]{64}$/.test(hash) && new RegExp(`^node-v22\\.\\d+\\.\\d+-${suffix.replaceAll('.', '\\.')}$`).test(file ?? ''));
+    if (!entry) throw new Error('No supported Node archive in the official checksum list');
+    const [hash, file] = entry;
+    const data = Buffer.from(await (await get(`https://nodejs.org/dist/${file.match(/^node-(v22\.\d+\.\d+)-/)[1]}/${file}`)).arrayBuffer());
+    if (createHash('sha256').update(data).digest('hex') !== hash) throw new Error('Node archive checksum did not match');
+    mkdirSync(join(home, '.cache', 'homie-studio'), { recursive: true });
+    scratch = mkdtempSync(join(home, '.cache', 'homie-studio', 'node-'));
+    const archive = join(scratch, file);
+    writeFileSync(archive, data);
+    const r = exec('tar', ['-xf', archive, '-C', scratch], { encoding: 'utf8', timeout: 10_000 });
+    if (r.status !== 0) throw new Error('Could not unpack Node with the system archive tool');
+    const unpacked = join(scratch, file.replace(/\.(tar\.gz|zip)$/, ''));
+    const check = exec(join(unpacked, platform === 'win32' ? 'node.exe' : 'bin/node'), ['--version'], { encoding: 'utf8', timeout: 3000 });
+    if (check.status !== 0 || !/^v22\./.test(check.stdout ?? '')) throw new Error('Downloaded Node did not start');
+    renameSync(unpacked, base);
+    return { ok: true, bin, installed: true };
+  } catch (error) {
+    return { ok: false, why: error.message, next: 'AI: retry setup_prepare; if the network still refuses, use the Node installer.', open: 'https://nodejs.org/en/download' };
+  } finally { if (scratch) rmSync(scratch, { recursive: true, force: true }); }
+}

package/lib/purchase-links.mjs

@@ -0,0 +1,42 @@
+/** Uses the shop's authorized Stripe API transport; no API credential goes to the Worker. */
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { sharedPartsOf, readPart, packedDir } from './parts.mjs';
+import { canonicalJson } from '../worker/referrals.mjs';
+import { paymentLinkURL } from '../worker/shop-links.mjs';
+const hash = (v) => createHash('sha256').update(canonicalJson(v)).digest('hex');
+export async function syncPurchaseLinks({ root, api, slug, site, mode, list, till }) {
+  const file = join(root, 'parts', 'offers.json');
+  const settings = existsSync(file) ? JSON.parse(readFileSync(file, 'utf8')) : {};
+  const offers = sharedPartsOf(root).flatMap(({id, versions, part}) => versions.flatMap((version) => {
+    const p = readPart(packedDir(root,id,version)), config = settings[id], selected = config?.releases?.[version];
+    return p.sale && config?.active !== false && selected?.active !== false && (version === versions.at(-1) || selected?.keepOnSale === true) ? [{kind:'part',resource:id,version,name:part.name,sale:{...p.sale,...config?.price}}] : [];
+  }));
+  const configured = offers.flatMap(o => {
+    const quantities = settings[o.resource]?.quantities ?? [1];
+    if (!Array.isArray(quantities) || !quantities.length || quantities.some(q=>!Number.isSafeInteger(q) || q<1 || !Number.isSafeInteger(q*o.sale.amount))) throw new Error(`Invalid Payment Link quantities for ${o.resource}`);
+    return [...new Set(quantities)].map(quantity=>({...o,quantity}));
+  });
+  const links = (await list('/v1/payment_links')).filter((l) => l.metadata?.homie === 'purchase-links-v1' && l.metadata?.studio === slug && l.metadata?.origin === site);
+  const config = {v:1,mode,offers:[]}, keep = new Set();
+  for (const o of configured) {
+    const revision = hash({o,till});
+    let link = links.find((l)=>l.metadata?.revision === revision);
+    if (!link) {
+      const metadata = {homie:'purchase-links-v1',studio:slug,origin:site,revision};
+      const product = (await list('/v1/products')).find(p=>p.metadata?.homie === 'purchase-links-v1' && p.metadata?.studio === slug && p.metadata?.origin === site && p.metadata?.revision === revision) ?? await api('POST','/v1/products',{name:`${o.name} ${o.version}`, ...(o.sale.taxCode ? {tax_code:o.sale.taxCode}:{}),metadata},`purchase-product-${revision}`);
+      const price = (await list('/v1/prices')).find(p=>p.product === product.id && p.metadata?.revision === revision) ?? await api('POST','/v1/prices',{product:product.id,currency:o.sale.currency,unit_amount:o.sale.amount,...(o.sale.taxBehavior ? {tax_behavior:o.sale.taxBehavior}:{}),...(o.sale.billing !== 'one-time' ? {recurring:{interval:o.sale.billing}}:{}),metadata},`purchase-price-${revision}`);
+      link = await api('POST','/v1/payment_links',{line_items:[{price:price.id,quantity:o.quantity}],metadata,
+        ...(o.sale.billing === 'one-time' ? {payment_intent_data:{metadata}}:{subscription_data:{metadata}}),
+        ...(till === 'stripe-managed' ? {managed_payments:{enabled:true}} : {automatic_tax:{enabled:o.sale.automaticTax === true},...(o.sale.taxIdCollection?{tax_id_collection:{enabled:true}}:{}),...(o.sale.billing === 'one-time' && o.sale.invoiceCreation?{invoice_creation:{enabled:true}}:{}),...(o.sale.adaptivePricing === undefined?{}:{adaptive_pricing:{enabled:o.sale.adaptivePricing}})}),
+        ...(o.sale.billing === 'one-time' && o.sale.customerCreation?{customer_creation:'always'}:{}),allow_promotion_codes:o.sale.promotionCodes === true,
+        after_completion:{type:'redirect',redirect:{url:`${site}/purchases/thanks`}}},`purchase-link-${revision}`);
+    }
+    if (!paymentLinkURL(link.url)) throw new Error('Stripe returned an invalid Payment Link');
+    if (!link.active) await api('POST',`/v1/payment_links/${link.id}`,{active:true});
+    keep.add(link.id);
+    config.offers.push({kind:o.kind,resource:o.resource,version:o.version,quantity:o.quantity,offer:canonicalJson(o.sale),id:link.id,url:link.url,revision});
+  }
+  return { config, retire:async()=>{ for (const l of links) if(l.active && !keep.has(l.id)) await api('POST',`/v1/payment_links/${l.id}`,{active:false}); } };
+}

package/lib/purchase-wallet.mjs

@@ -0,0 +1,114 @@
+/** Payment authority and limits stay in the person's existing wallet client. */
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+const execute = promisify(execFile);
+export async function payWithWallet(
+  url,
+  body,
+  { client = process.env.HOMIE_PARTS_WALLET, pending, run = execute } = {},
+) {
+  if (!client) return null;
+  if (!["link-cli", "purl", "tempo"].includes(client))
+    return { data: { detail: "Choose link-cli, purl or tempo as the wallet; hosted Checkout is available." } };
+  let args;
+  if (client === "link-cli") {
+    args = [
+      "mpp",
+      "pay",
+      url,
+      "-X",
+      "POST",
+      "-d",
+      JSON.stringify(body),
+      "--format",
+      "json",
+    ];
+    if (pending?.id)
+      args.push(
+        "--spend-request-id",
+        pending.id,
+        "--approved-challenge",
+        pending.challenge,
+      );
+    else
+      args.push(
+        "--amount",
+        String(body.amount),
+        "--context",
+        `Purchase the digital resource ${body.resource} version ${body.version} from ${new URL(url).host} under the exact price and licence terms approved in this conversation. The selling studio delivers the files and signed purchase proof.`,
+      );
+  } else {
+    const atomic = BigInt(body.amount) * 10000n;
+    const purlLimit = process.env.PURL_MAX_AMOUNT;
+    if (purlLimit && !/^\d+$/.test(purlLimit))
+      return { data: { detail: "Invalid wallet maximum amount; use hosted Checkout or correct the wallet setting." } };
+    const tempoLimit = process.env.TEMPO_MAX_SPEND;
+    if (
+      tempoLimit &&
+      (!Number.isFinite(Number(tempoLimit)) || Number(tempoLimit) < 0)
+    )
+      return { data: { detail: "Invalid wallet maximum spend; use hosted Checkout or correct the wallet setting." } };
+    // Use the wallet's native per-request ceiling in its documented units.
+    const ceiling =
+      client === "tempo"
+        ? [
+            "--max-spend",
+            String(
+              Math.min(
+                body.amount / 100,
+                tempoLimit ? Number(tempoLimit) : Infinity,
+              ),
+            ),
+          ]
+        : [
+            "--max-amount",
+            String(
+              purlLimit && BigInt(purlLimit) < atomic
+                ? BigInt(purlLimit)
+                : atomic,
+            ),
+            "--network",
+            "base,base-sepolia",
+            "--output-format",
+            "json",
+          ];
+    args = [
+      ...(client === "tempo" ? ["request"] : []),
+      ...ceiling,
+      "-X",
+      "POST",
+      "--json",
+      JSON.stringify(body),
+      url,
+    ];
+  }
+  let stdout;
+  try { ({ stdout } = await run(client, args, {
+    encoding: "utf8",
+    maxBuffer: 256 * 1024 * 1024,
+    timeout: 60000,
+  })); } catch (error) {
+    if (error.code === 'ENOENT') return { data: { detail: `The ${client} wallet is not installed; use hosted Checkout.` } };
+    // Wallets often return a structured refusal with a nonzero exit status.
+    // A process timeout or broken output is ambiguous: never start a second payment.
+    if (error.stdout?.trim()) stdout = error.stdout;
+    else if (/declined|insufficient funds|spend limit|not authenticated|not logged in|unsupported (network|method)|user rejected|user denied/i.test(error.stderr ?? ''))
+      return { data: { detail: String(error.stderr).trim(), paymentStatus: 'not_paid' } };
+    else return { uncertain: true, data: { detail: 'The wallet stopped without a payment result. Retry this purchase to reconcile it; do not pay again.' } };
+  }
+  let result;
+  try { result = JSON.parse(stdout); }
+  catch { return { uncertain: true, data: { detail: 'The wallet returned an unreadable payment result. Retry this purchase to reconcile it; do not pay again.' } }; }
+  if (result._next?.pay_argv) {
+    const next = result._next.pay_argv.args;
+    return {
+      pending: {
+        id: result.id,
+        challenge: next[next.indexOf("--approved-challenge") + 1],
+      },
+      approval: result.approval_url,
+    };
+  }
+  const value = result.body ?? result;
+  return { data: typeof value === "string" ? JSON.parse(value) : value };
+}

package/lib/scaffold.mjs

@@ -1,4 +1,5 @@
 import { APPS_MIGRATION, APPS_MIGRATION_FILE } from '../worker/app-records.mjs';
+import { PURCHASE_MIGRATION, PURCHASE_MIGRATION_FILE, PURCHASE_STATE, PURCHASE_STATE_FILE } from '../worker/purchase-schema.mjs';
 /**
  * `homie-studio new <folder> --name "<Studio Name>"` — a studio is ONE
  * monorepo: a visible folder the person opens in Claude or Codex.
@@ -65,7 +66,7 @@ export function slugify(name) {
  * No `database_id` until one is known: Wrangler (4.45.0+) and the Deploy to Cloudflare flow create the database
  * the binding names and keep it linked.
  */
-export function wranglerConfig({ worker, name, d1, d1Id = null, r2 = null, layout = 'root', ai = false, routes = null, triggers = null }) {
+export function wranglerConfig({ worker, name, d1, d1Id = null, r2 = null, layout = 'root', ai = false, routes = null, paidParts = false, partsRateLimit = null, triggers = null }) {
   const at = layout === 'site' ? { schema: '../node_modules', main: 'src/worker.mjs', dist: './dist', migrations: 'migrations' }
     : { schema: 'node_modules', main: 'site/src/worker.mjs', dist: './site/dist', migrations: 'site/migrations' };
   const rooms = [{ name: 'TABLE', class_name: 'Table' }, { name: 'LOBBY', class_name: 'Lobby' }];
@@ -79,19 +80,20 @@ export function wranglerConfig({ worker, name, d1, d1Id = null, r2 = null, layou
     // subdomain) reaches it instead of failing with 1042.
     // `disallow_eval_during_startup`: no code is made from a string while the Worker loads (Cloudflare never allows it
     // later). A game's rules run in this Worker (NETPLAY.md section 29), and nothing in them is ever made from text.
-    compatibility_flags: ['global_fetch_strictly_public', 'disallow_eval_during_startup'],
+    compatibility_flags: ['global_fetch_strictly_public', 'disallow_eval_during_startup', ...(paidParts ? ['nodejs_compat'] : [])],
+    ...(paidParts ? { alias: { '@homie-rocks/studio/worker': '@homie-rocks/studio/worker/selling' }, triggers: { crons: ['*/5 * * * *'] }, ratelimits: [partsRateLimit ?? { name: 'PURCHASE_RATE_LIMITER', namespace_id: '1001', simple: { limit: 60, period: 60 } }] } : {}),
     workers_dev: true,
     preview_urls: true,
     // The studio's own custom-domain and exact-host routes, as its owner wrote them: this file is written again by
     // every deploy, and one written without them sends the studio's domain back to whatever else the zone routes
     // (lib/routes.mjs). A studio without routes gets no key at all.
     ...(routes?.length ? { routes } : {}),
-    ...(triggers ? { triggers } : {}),
+    ...(triggers ? { triggers: paidParts ? { ...triggers, crons: [...new Set([...(triggers.crons ?? []), '*/5 * * * *'])] } : triggers } : {}),
     assets: { directory: at.dist, binding: 'ASSETS', run_worker_first: true },
     durable_objects: { bindings: rooms },
     migrations: [{ tag: 'v1', new_sqlite_classes: ['Table', 'Lobby'] }],
     d1_databases: [{ binding: 'DB', database_name: d1, ...(d1Id ? { database_id: d1Id } : {}), migrations_dir: at.migrations }],
-    ...(r2 ? { r2_buckets: [{ binding: 'MEDIA', bucket_name: r2 }] } : {}),
+    ...(r2 ? { r2_buckets: [{ binding: 'MEDIA', bucket_name: r2 }, ...(paidParts ? [{ binding: 'PURCHASE_MEDIA', bucket_name: `${r2.slice(0, 52)}-purchases` }] : [])] } : {}),
     // Workers AI, only when a server's AI guides think with it (agents_brain workers-ai; deploy adds it, 0.17.0).
     // Never in Previews: they do not inherit it, so a Preview's guides answer from the game's script.
     ...(ai ? { ai: { binding: 'AI' } } : {}),
@@ -132,6 +134,16 @@ directory lists its games; homie.rocks does not host them.
 | \`studio.json\` | The studio's name, slug, Cloudflare resource names, custom domain and stats sharing. \`.studio/\` (git-ignored) is this computer's own state. |
 | \`.claude/skills/\` | Skills only this studio uses. Homie's own skills come from the Homie plugin. |
 
+The person describes an outcome; you carry it through setup, building and checks without a tutorial
+or a planning interview. Choose engineering and design defaults from their words and record them
+in the codex. Use "My Studio" when unnamed, phones and computers, local sound and CC0 art.
+They can change anything by asking. A business or charity may want an app, not a game.
+Install missing prerequisites yourself; never ask the person to run a command or handle a key,
+account id, zone id or setting. Honour an existing request to go live or list, subject to host holds.
+For a requested custom hostname, add its custom_domain route in Wrangler along with cloudflare.domain;
+Cloudflare creates DNS and TLS during deploy with the existing sign-in.
+
+
 ## Apps: one screen, roles and parts
 
 An app lives in \`apps/<id>/app.json\` and \`src/\`. Make one with \`homie-studio app new <id>\` (or \`app_make\`). Use the Homie plugin's \`app\` skill for businesses, venues, causes and customer apps. No game demo, rounds, scores, bots or mandatory fun: build what the person needs with the fewest human steps.
@@ -737,6 +749,8 @@ export { default, Table, Lobby } from '@homie-rocks/studio/worker';
     [`site/migrations/${SERVERS_MIGRATION_FILE}`]: SERVERS_MIGRATION,
     [`site/migrations/${CHAT_MIGRATION_FILE}`]: CHAT_MIGRATION,
     [`site/migrations/${SHOP_MIGRATION_FILE}`]: SHOP_MIGRATION,
+    [`site/migrations/${PURCHASE_MIGRATION_FILE}`]: PURCHASE_MIGRATION,
+    [`site/migrations/${PURCHASE_STATE_FILE}`]: PURCHASE_STATE,
     [`site/migrations/${SHOP_RESERVATIONS_FILE}`]: SHOP_RESERVATIONS,
     [`site/migrations/${SHOP_STATEMENTS_FILE}`]: SHOP_STATEMENTS,
     [`site/migrations/${SHOP_LINES_FILE}`]: SHOP_LINES,
@@ -896,8 +910,24 @@ function ensureAppsMigration(root) {
   mkdirSync(dirname(file), { recursive: true }); writeFileSync(file, APPS_MIGRATION);
   return `site/migrations/${APPS_MIGRATION_FILE}`;
 }
+export function ensurePartsMigration(root) {
+  const file = join(root, 'site', 'migrations', PURCHASE_MIGRATION_FILE);
+  if (existsSync(file)) return null;
+  mkdirSync(dirname(file), { recursive: true });
+  writeFileSync(file, PURCHASE_MIGRATION);
+  return `site/migrations/${PURCHASE_MIGRATION_FILE}`;
+}
+
+function ensurePartsStateMigration(root) {
+  const file = join(root, 'site', 'migrations', PURCHASE_STATE_FILE);
+  if (existsSync(file)) return null;
+  mkdirSync(dirname(file), { recursive: true });
+  writeFileSync(file, PURCHASE_STATE);
+  return `site/migrations/${PURCHASE_STATE_FILE}`;
+}
+
 export function ensureMigrations(root) {
-  return [ensureStatsMigration(root), ensurePlayersMigration(root), ensureOfficeMigration(root), ensureServersMigration(root), ensureChatMigration(root), ensureShopMigration(root), ensureLoungeMigration(root), ensureShopReservations(root), ensureShopStatements(root), ensureShopLines(root), ensureAppsMigration(root)].filter(Boolean);
+  return [ensureStatsMigration(root), ensurePlayersMigration(root), ensureOfficeMigration(root), ensureServersMigration(root), ensureChatMigration(root), ensureShopMigration(root), ensureLoungeMigration(root), ensureShopReservations(root), ensureShopStatements(root), ensureShopLines(root), ensureAppsMigration(root), ensurePartsMigration(root), ensurePartsStateMigration(root)].filter(Boolean);
 }
 
 /** What a migration file the template added is for, in a few words (deploy and dev say it). */

package/lib/shoot.mjs

@@ -115,7 +115,7 @@ export const VIRTUAL_CLOCK = `(() => {
   window.__homieClock = {
     get frozen() { return frozen; },
     now: perfNow,
-    freeze() { if (frozen) return vPerf; /* a whole millisecond (never earlier than the last real reading): stepped time is then base + n steps exactly, with no float dust between a step asked for and the time handed out */ vPerf = Math.ceil(R.perf()); vDate = R.D.now(); frozen = true; stepAnims(0); return vPerf; },
+    freeze() { if (frozen) return vPerf; /* a whole millisecond (never earlier than the last real reading): stepped time is then base + n steps exactly, with no float dust between a step asked for and the time handed out */ vPerf = Math.ceil(R.perf()); vDate = R.D.now(); frozen = true; runTimers(vPerf); stepAnims(0); return vPerf; },
     step(ms) {
       if (!frozen) this.freeze();
       const d = Math.max(0, Number(ms) || 0);