@homie-rocks/studio 0.37.0 → 0.37.2

package/worker/parts-sale.mjs

@@ -0,0 +1,59 @@
+import { amountError } from './shop-rules.mjs';
+import { digest, manifestHash } from "./purchase-crypto.mjs";
+/** Paid-part metadata shared by the builder, buyer and Worker. No payment policy ceilings. */
+import { canonicalJson } from './referrals.mjs';
+
+export const quoteHash = async (part, quantity = 1, game = null, offer = part.sale) => digest(canonicalJson({ manifest: await manifestHash(part), part: part.id, release: part.version, scope: offer.scope, quantity, game, interval: offer.billing, currency: offer.currency, amount: offer.amount * quantity, offer }));
+export const legalTerms = (p) => ({ license: p.license, terms: p.files?.find((f) => f.path === p.licenseTerms)?.sha256, scope: p.sale?.scope, source: p.sale?.source, commercialUse: p.sale?.commercialUse, transferable: p.sale?.transferable, onRefund: p.sale?.onRefund, onExpiry: p.sale?.onExpiry, refund: p.sale?.refund, updates: p.sale?.updates });
+export const sameTerms = (a, b) => canonicalJson(legalTerms(a)) === canonicalJson(legalTerms(b));
+export const publicFiles = (p) => new Set([p.preview?.page, p.preview?.image, p.licenseTerms, ...(p.files ?? []).filter((f) => /^LICENSES\/[^/]+\.txt$/.test(f.path)).map((f) => f.path), ...(p.sale?.publicFiles ?? [])].filter(Boolean));
+export const objectKey = (hash) => `paid-parts/files/${hash}`;
+export const releaseKey = (id, version) => `paid-parts/releases/${id}/${version}.json`;
+
+export function saleProblems(p) {
+  if (p.sale === undefined) return [];
+  const s = p.sale; const errors = [];
+  if (!s || typeof s !== 'object' || Array.isArray(s)) return ['sale must be an object'];
+  const invalidAmount = amountError(s.amount, s.currency);
+  if (invalidAmount) errors.push(invalidAmount);
+  if (!Intl.supportedValuesOf('currency').map((v) => v.toLowerCase()).includes(s.currency) || /^(xau|xag|xpt|xpd|xxx|xts)$/.test(s.currency)) errors.push('currency must be a lower-case ISO currency code');
+  if (s.taxBehavior !== undefined && !['inclusive', 'exclusive', 'unspecified'].includes(s.taxBehavior)) errors.push('taxBehavior must be inclusive, exclusive or unspecified');
+  for (const key of ['immediateDelivery', 'automaticTax', 'adaptivePricing', 'promotionCodes', 'refundEndsSubscription', 'invoiceCreation', 'customerCreation', 'taxIdCollection']) if (s[key] !== undefined && typeof s[key] !== 'boolean') errors.push(`${key} must be true or false`);
+  if (s.refundWindowDays !== undefined && (!Number.isFinite(s.refundWindowDays) || s.refundWindowDays < 0)) errors.push('refundWindowDays must be a non-negative finite number');
+  if (s.renewalGraceMinutes !== undefined && (!Number.isFinite(s.renewalGraceMinutes) || s.renewalGraceMinutes < 0)) errors.push('renewalGraceMinutes must be a non-negative finite number');
+  if (s.intentMinutes !== undefined && (!Number.isFinite(s.intentMinutes) || s.intentMinutes <= 0)) errors.push('intentMinutes must be a positive finite number');
+  for (const [key, values] of Object.entries({ billing: ['one-time', 'day', 'week', 'month', 'year'], updates: ['none', 'major', 'all'], onRefund: ['retain', 'terminate'], onExpiry: ['retain', 'terminate'] })) if (!values.includes(s[key])) errors.push(`${key} must be ${values.join(', ')}`);
+  if (typeof s.scope !== 'string' || !s.scope.trim()) errors.push('scope must describe the licensed use');
+  for (const key of ['source', 'commercialUse', 'transferable']) if (typeof s[key] !== 'boolean') errors.push(`${key} must be true or false`);
+  if (typeof s.refund !== 'string' || !s.refund.trim()) errors.push('refund must state the seller refund terms');
+  if ((s.taxCode !== undefined || s.automaticTax === true) && !/^txcd_\d{8}$/.test(s.taxCode ?? '')) errors.push('taxCode must name the Stripe product tax code');
+  if (!p.licenseTerms || !p.files?.some((f) => f.path === p.licenseTerms)) errors.push('licenseTerms must name a hashed file containing the full licence');
+  if (s.publicFiles !== undefined && (!Array.isArray(s.publicFiles) || s.publicFiles.some((path) => !p.files?.some((f) => f.path === path)))) errors.push('publicFiles must list only hashed files deliberately offered before purchase');
+  return errors;
+}
+
+export function coversRelease(bought, wanted) {
+  if (bought.id !== wanted.id) return false;
+  if (bought.version === wanted.version) return true;
+  if (bought.version.includes('-') || wanted.version.includes('-')) return false;
+  if (compareVersions(wanted.version, bought.version) < 0) return false;
+  return bought.sale.updates === 'all' || (bought.sale.updates === 'major' && wanted.version.split('.')[0] === bought.version.split('.')[0]);
+}
+
+/** Semver precedence, including numeric versus text prerelease identifiers. */
+export function compareVersions(a, b) {
+  const parse = (v) => { const dash = v.indexOf('-'); const core = dash < 0 ? v : v.slice(0, dash); const pre = dash < 0 ? undefined : v.slice(dash + 1); return { core: core.split('.').map(Number), pre: pre?.split('.') }; };
+  const left = parse(a); const right = parse(b);
+  for (let i = 0; i < 3; i++) if (left.core[i] !== right.core[i]) return left.core[i] < right.core[i] ? -1 : 1;
+  if (!left.pre || !right.pre) return left.pre ? -1 : right.pre ? 1 : 0;
+  for (let i = 0; i < Math.max(left.pre.length, right.pre.length); i++) {
+    const x = left.pre[i]; const y = right.pre[i];
+    if (x === y) continue;
+    if (x === undefined || y === undefined) return x === undefined ? -1 : 1;
+    const nx = /^\d+$/.test(x); const ny = /^\d+$/.test(y);
+    if (nx && ny) return Number(x) < Number(y) ? -1 : 1;
+    if (nx !== ny) return nx ? -1 : 1;
+    return x < y ? -1 : 1;
+  }
+  return 0;
+}

package/worker/parts.mjs

@@ -1,3 +1,5 @@
+import { selling } from './extensions.mjs';
+
 /**
  * THE STUDIO'S SHARED GAME PARTS, AS ITS SITE SERVES THEM (parts/PARTS.md section 4).
  *
@@ -17,7 +19,7 @@ const VERSION = /^\d{1,6}\.\d{1,6}\.\d{1,6}(?:-[0-9A-Za-z.-]{1,40})?$/;
 /** A packed part's files: framed by the part's own page and by the hub, so they keep their own frame rule (index.mjs finish). */
 export const PART_FILES = /^\/parts\/[a-z0-9][a-z0-9-]{0,47}\/\d{1,6}\.\d{1,6}\.\d{1,6}[^/]*\//;
 export const PARTS_WELL_KNOWN = '/.well-known/homie-parts.json';
-export const isPartsPath = (path) => path === PARTS_WELL_KNOWN || path === '/parts' || path.startsWith('/parts/');
+export const isPartsPath = (path) => path === '/openapi.json' || path === '/.well-known/api-catalog' || path === '/parts/catalog.json' || path === '/purchases/keys.json' || path === PARTS_WELL_KNOWN || path === '/parts' || path.startsWith('/parts/');
 
 const CORS = { 'access-control-allow-origin': '*', 'x-content-type-options': 'nosniff' };
 const json = (body, status = 200, headers = {}) => new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json; charset=utf-8', ...headers } });
@@ -37,25 +39,29 @@ export async function partsIndex(env, origin) {
  * One index entry as the world sees it: how to add it, and the game it came out of with its page and Play address.
  * Only a PUBLIC game is named (a private or invite-only game's parts are still shared, without saying where from).
  */
-function entryOf(p, cat, url) {
+function entryOf(p, cat, url, capabilities = { machine: {} }) {
   const g = (p.from?.game ?? p.from?.app) ? (cat.games ?? []).find((x) => x.id === (p.from.game ?? p.from.app)) : null;
   const { from, ...rest } = p;
   return {
     ...rest,
-    ...(!g && from && (from.music || from.video) ? { from: { ...(from.music ? { music: from.music } : { video: from.video }), name: from.name ?? null, studio: from.studio ?? null } } : {}),
+    ...(!g && from && !from.game && !from.app ? { from } : {}),
     ...(g ? { from: { [g.kind === 'app' ? 'app' : 'game']: g.id, name: g.name ?? g.id, studio: cat.studio?.name ?? from.studio ?? null, page: `${url.origin}/${g.id}/`, [g.kind === 'app' ? 'open' : 'play']: `${url.origin}/${g.id}/${g.kind === 'app' ? 'open' : 'play'}` } } : {}),
     add: `${url.host}/${p.id}`,
+    ...(selling.entryDescription?.(p, cat, url, capabilities) ?? {}),
   };
 }
 
 export async function partsRoutes(request, env, url, { catalogueOf }) {
   const path = url.pathname;
+  if (!selling.enabled && ['/purchases/keys.json','/openapi.json','/.well-known/api-catalog'].includes(path)) return null;
+  if (selling.enabled) { const extra = await selling.discoveryRoutes(request, env, url, { catalogueOf }); if (extra) return extra; }
   const read = request.method === 'GET' || request.method === 'HEAD';
-  if (path === PARTS_WELL_KNOWN) {
+  if (path === PARTS_WELL_KNOWN || path === '/parts/catalog.json') {
     if (request.method === 'OPTIONS') return new Response(null, { status: 204, headers: { ...CORS, 'access-control-allow-methods': 'GET, HEAD' } });
     if (!read) return json({ ok: false, error: 'method' }, 405, { allow: 'GET, HEAD', ...CORS });
     const [index, cat] = await Promise.all([partsIndex(env, url.origin), catalogueOf()]);
-    return json({ v: 1, studio: { name: cat.studio?.name ?? index.studio?.name ?? null, url: url.origin }, parts: index.parts.map((p) => entryOf(p, cat, url)) }, 200, { ...CORS, 'cache-control': 'public, max-age=300' });
+    const capabilities = await selling.machineCapabilities(env);
+    return json({ v: 1, studio: { name: cat.studio?.name ?? index.studio?.name ?? null, url: url.origin }, parts: index.parts.map((p) => entryOf(p, cat, url, capabilities)) }, 200, { ...CORS, 'cache-control': 'public, max-age=300' });
   }
   const segs = path.split('/').filter(Boolean);
   // /parts/<id>/<version>/<file…>: a packed file, only when the index names that part and that version.
@@ -67,6 +73,9 @@ export async function partsRoutes(request, env, url, { catalogueOf }) {
     let file;
     try { file = segs.slice(3).map(decodeURIComponent).join('/'); } catch { file = '..'; }
     const gone = () => new Response('not found', { status: 404, headers: { ...CORS, 'cache-control': 'no-store' } });
+    if (file.split('/').some((s) => !s || s === '..' || s.startsWith('.')) || file.includes('\\')) return gone();
+    const protectedFile = part && !part.sale && !part.releases?.some((r) => r.version === segs[2] && r.sale) ? null : await selling.paidFile(request, env, url, segs[1], segs[2], file, TYPES[file.split('.').pop().toLowerCase()]);
+    if (protectedFile) return protectedFile;
     if (!part || !(part.versions ?? []).includes(segs[2]) || file.split('/').some((s) => !s || s === '..' || s.startsWith('.'))) return gone();
     const res = await env.ASSETS.fetch(new Request(`${url.origin}/parts/${segs[1]}/${segs[2]}/${file.split('/').map(encodeURIComponent).join('/')}`));
     if (!res.ok) return gone();
@@ -104,7 +113,7 @@ export async function partsRoutes(request, env, url, { catalogueOf }) {
 /* ------------------------------------------------------------------ the pages */
 
 const KIND_WORDS = { character: 'Character', rig: 'Rig', clips: 'Animation clips', environment: 'Environment', effect: 'Effect', sound: 'Sound', ui: 'UI', mechanic: 'Mechanic', shader: 'Shader', 'level-generator': 'Level generator', 'bot-brain': 'Bot brain', 'audio-pack': 'Audio pack', 'set-piece': 'Set piece' };
-const kindOf = (p) => KIND_WORDS[p.kind] ?? 'Part';
+const kindOf = (p) => KIND_WORDS[p.kind] ?? p.kind ?? 'Part';
 const CSS = `<style>
 .pgrid{display:grid;grid-template-columns:repeat(auto-fill,minmax(260px,1fr));gap:18px;margin:8px 0 0;padding:0;list-style:none}
 .pcard{display:flex;flex-direction:column;gap:8px;padding:18px;border:1px solid color-mix(in srgb,var(--fg) 14%,transparent);border-radius:16px;text-decoration:none;color:inherit;background:color-mix(in srgb,var(--fg) 3%,transparent)}
@@ -134,12 +143,12 @@ const head = (kicker, title, lead, extra = '') => `<header class="head"><p class
 const studioOf = (cat) => cat.studio?.name ?? 'Studio';
 const fromLine = (p) => ((p.from?.game ?? p.from?.app) ? `From <a href="/${esc((p.from.game ?? p.from.app))}/">${esc(p.from.name ?? (p.from.game ?? p.from.app))}</a>` : '');
 /** What a person says to their AI to get the part, in plain words with its name and reference: no command to type. */
-const sayAdd = (p) => `Add the "${p.name}" part from ${p.add} to my game`;
+const sayAdd = (p) => `Add the "${p.name}" part from ${p.add} to my studio`;
 const sayRow = (label, say) => `<div class="psay"><div><span class="ptag">${esc(label)}</span><code>${esc(say)}</code></div><button class="pcopy" type="button" data-copy="${esc(say)}">${icon('copy')}<span data-copy-word>Copy</span></button></div>`;
 
 function card(p) {
   const img = p.preview?.image ? `<img src="${esc(`${p.url}${p.preview.image}`)}" alt="" loading="lazy">` : '';
-  return `<li><a class="pcard" href="/parts/${esc(p.id)}/">${img}<span class="ptag">${esc(kindOf(p))} · ${esc(p.license ?? '')}</span><h3>${esc(p.name)}</h3><p>${esc(p.summary ?? '')}</p>${(p.from?.game ?? p.from?.app) ? `<p>From ${esc(p.from.name ?? (p.from.game ?? p.from.app))}</p>` : ''}</a></li>`;
+  return `<li><a class="pcard" href="/parts/${esc(p.id)}/">${img}<span class="ptag">${esc(kindOf(p))} · ${esc(p.license ?? '')} · ${esc(selling.priceWords(p.sale))}</span><h3>${esc(p.name)}</h3><p>${esc(p.summary ?? '')}</p>${(p.from?.game ?? p.from?.app) ? `<p>From ${esc(p.from.name ?? (p.from.game ?? p.from.app))}</p>` : ''}</a></li>`;
 }
 
 export function partsPage(cat, parts, url) {
@@ -149,7 +158,7 @@ export function partsPage(cat, parts, url) {
   for (const p of parts) { const k = (p.from?.game ?? p.from?.app) ?? ''; if (!groups.has(k)) groups.set(k, []); groups.get(k).push(p); }
   const body = [...groups].sort(([a], [b]) => (a === '' ? 1 : b === '' ? -1 : a.localeCompare(b))).map(([k, list]) => `<p class="sec"${k ? ` id="from-${esc(k)}"` : ''}>${k ? `From ${esc(list[0].from.name ?? k)}` : 'More parts'}</p><ul class="pgrid">${list.map(card).join('')}</ul>`).join('');
   return layout(cat, {
-    title: `Game parts · ${name}`, description: `Pieces of ${name}'s games that other studios can use in their own: creatures, levels, mechanics, sounds. Each with its licence.`, origin: url.origin, path: '/parts/', page: 'parts', head: CSS,
+    title: `Game parts · ${name}`, description: `Pieces of ${name}'s games that other studios can use in their own: creatures, levels, mechanics, sounds. Each with its licence.`, origin: url.origin, path: '/parts/', page: 'parts', head: CSS + (selling.enabled ? `<script type="application/ld+json">${JSON.stringify({ '@context': 'https://schema.org', '@type': 'ItemList', itemListElement: parts.map((p, i) => ({ '@type': 'ListItem', position: i + 1, item: productDescription(p, url.origin) })) }).replaceAll('<', '\\u003c')}</script>` : ''),
     main: `${head('Game parts', 'Take a piece, make a game', `Pieces of ${name}'s games, shared one by one. Take the creature from one game, the level from another and the bot brain from a third, and make something new. Each part says its licence and who to credit.`)}
 <div class="wrap">${body}</div>`,
   });
@@ -207,6 +216,8 @@ function previewOf(p) {
 <a class="popen" href="${src}" target="_blank" rel="noopener noreferrer">${icon('arrow')}<span>Open the preview in its own tab</span></a>`;
 }
 
+export const productDescription = (p, origin) => selling.productDescription?.(p, origin);
+
 export function partPage(cat, p, url) {
   const name = studioOf(cat);
   const preview = p.preview?.page
@@ -216,6 +227,8 @@ export function partPage(cat, p, url) {
     ['Kind', esc(kindOf(p))],
     p.uses?.length ? ['For', esc(p.uses.join(', '))] : null,
     (p.from?.game ?? p.from?.app) ? [p.from.app ? 'From the app' : 'From the game', `<a href="/${esc((p.from.game ?? p.from.app))}/">${esc(p.from.name ?? (p.from.game ?? p.from.app))}</a> · <a href="/${esc((p.from.game ?? p.from.app))}/${p.from.app ? 'open' : 'play'}">${p.from.app ? 'Open it' : 'Play it'}</a>`] : null,
+    ['Price', esc(selling.priceWords(p.sale))],
+    p.sale ? ['Purchase terms', esc(`${p.sale.refund} Source: ${p.sale.source ? 'included' : 'not included'}. Updates: ${p.sale.updates}.`)] : null,
     ['Licence', `${esc(p.license ?? 'none named')}${p.license && !/^LicenseRef-/.test(p.license) ? ` · <a href="https://spdx.org/licenses/${esc(p.license)}.html" rel="noopener">what it allows</a>` : ''}`],
     p.attribution ? ['Credit', esc(p.attribution)] : null,
     ['Version', `${esc(p.version)}${(p.versions ?? []).length > 1 ? ` (also ${esc(p.versions.filter((v) => v !== p.version).join(', '))})` : ''}`],
@@ -228,7 +241,7 @@ export function partPage(cat, p, url) {
     (p.tags ?? []).length ? ['Tags', esc(p.tags.join(', '))] : null,
   ].filter(Boolean);
   return layout(cat, {
-    title: `${p.name} · a game part from ${name}`, description: `${p.summary ?? ''} A ${kindOf(p).toLowerCase()} from ${name}${p.from?.name ? `'s ${p.from.name}` : ''}, shared under ${p.license ?? 'its own terms'}.`.trim(), origin: url.origin, path: `/parts/${p.id}/`, page: 'part', head: CSS,
+    title: `${p.name} · a game part from ${name}`, description: `${p.summary ?? ''} A ${kindOf(p).toLowerCase()} from ${name}${p.from?.name ? `'s ${p.from.name}` : ''}, shared under ${p.license ?? 'its own terms'}.`.trim(), origin: url.origin, path: `/parts/${p.id}/`, page: 'part', head: CSS + (selling.enabled ? `<script type="application/ld+json">${JSON.stringify(productDescription(p, url.origin)).replaceAll('<', '\\u003c')}</script>` : ''),
     image: p.preview?.image ? `${p.url}${p.preview.image}` : null,
     main: `${head(`${kindOf(p)} · shared part`, p.name, p.summary ?? '', `<div class="keys"><a class="ghost" href="/parts/">${icon('arrow')}<span>All parts</span></a>${(p.from?.game ?? p.from?.app) ? `<a class="ghost" href="/${esc((p.from.game ?? p.from.app))}/${p.from.app ? 'open' : 'play'}">${icon('games')}<span>${p.from.app ? 'Open' : 'Play'} ${esc(p.from.name ?? (p.from.game ?? p.from.app))}</span></a>` : ''}</div>`)}
 <div class="wrap">
@@ -236,7 +249,7 @@ ${preview ? `<p class="sec">Try it</p>${preview}` : ''}
 <p class="sec">Use it in your game</p>
 <p class="plead">In a chat with your Homie studio open, ask for it by name:</p>
 ${sayRow('Say', sayAdd(p))}
-<p class="plead">Your AI fetches the files, checks every one, copies them into your studio and credits ${esc(name)} in your game. They are yours to tune from there.</p>
+<p class="plead">${p.sale ? 'Your AI shows the price and asks first. After your wallet pays, it receives the files,' : 'Your AI fetches the files,'} checks every one, copies them into your studio and credits ${esc(name)} in your game. They are yours to tune from there.</p>
 <p class="sec">About this part</p>
 <dl class="pfacts">${facts.map(([k, v]) => `<dt>${esc(k)}</dt><dd>${v}</dd>`).join('')}</dl>
 </div>`,

package/worker/payment-capabilities.mjs

@@ -0,0 +1,70 @@
+/** Stripe-backed, non-settling permission checks. Never uses a card or a wallet. */
+import { stripeCall, modeOf } from './stripe.mjs';
+import { digest } from "./purchase-crypto.mjs";
+
+export const MACHINE_API_VERSION = '2026-07-29.preview';
+export async function probeMachinePayments(env, { fetcher = fetch } = {}) {
+  const mode = modeOf(env.STRIPE_KEY);
+  const result = { mode, key: await digest(env.STRIPE_KEY), checkedAt: Date.now(), machine: { card: false, tempo: false, base: false }, reasons: {}, configuration: {} };
+  const call = (method, path, params) => stripeCall(env, method, path, params, { fetcher, version: MACHINE_API_VERSION });
+  try {
+    const profile = await call('GET', '/v2/network/business_profiles/me');
+    if (!/^profile_/.test(profile?.id ?? '')) throw new Error('Create a Stripe business profile in the Dashboard');
+    result.configuration.profile = profile.id;
+    result.machine.card = true;
+  } catch (e) {
+    result.reasons.card = `${e.message}. Enable PaymentIntents Write and access to Business Profiles on this restricted key, create the account profile, then reconnect shop. SPT eligibility is controlled by Stripe.`;
+  }
+  try {
+    const configs = await call('GET', '/v1/payment_method_configurations', { limit: 100 });
+    if (!configs.data?.some((c) => c.active && c.crypto?.available && c.crypto?.display_preference?.value === 'on')) throw new Error('Stablecoins and Crypto is not active for this Stripe account. Request it in Stripe payment method settings; Stripe reviews eligibility and country support');
+    for (const network of ['base']) {
+      try {
+        const listed = await call('GET', '/v1/crypto/deposit_addresses', { network });
+        const address = listed.data?.find((a) => /^0x[0-9a-fA-F]{40}$/.test(a.address));
+        if (!address || !/^0x[0-9a-fA-F]{40}$/.test(address.address)) throw new Error('Provision a Base deposit address in Stripe, then reconnect; this read-only check creates nothing');
+        result.configuration[network] = address.address;
+        result.machine[network] = true;
+      } catch (e) { result.reasons[network] = `${e.message}. Enable Crypto Deposit Addresses access on this key and reconnect.`; }
+    }
+  } catch (e) { result.reasons.tempo = result.reasons.base = `${e.message}. Reconnect after Stripe enables this payment method.`; }
+  result.reasons.tempo = 'Tempo is disabled until an official client completes route tests in both modes.';
+  return result;
+}
+export async function machineCapabilities(env) {
+  try {
+    const cached = env.DB && await env.DB.prepare("SELECT value FROM meta WHERE key = 'purchase-capabilities'").first();
+    const configured = JSON.parse(env.PURCHASE_PAYMENT_CAPABILITIES ?? '{}');
+    const saved = cached ? JSON.parse(cached.value) : null;
+    const record = saved?.key === configured.key && saved.checkedAt >= configured.checkedAt ? saved : configured;
+    const configuration = JSON.parse(env.PURCHASE_MACHINE_PAYMENTS ?? '{}')[modeOf(env.STRIPE_KEY)];
+    if (record.mode !== modeOf(env.STRIPE_KEY) || record.key !== await digest(env.STRIPE_KEY) || !configuration?.profile)
+      return { ready: false, machine: {}, reasons: { setup: 'Reconnect shop to verify machine payment permissions and obtain the Stripe profile and deposit addresses.' } };
+    const machine = { ...record.machine, tempo: false };
+    if (configuration.manualRefunds !== true || !configuration.base || (record.mode === 'live' && (!env.CDP_API_KEY_ID || !env.CDP_API_KEY_SECRET))) machine.base = false;
+    return { ...record, machine, ready: Object.values(machine).some(Boolean) };
+  } catch { return { ready: false, machine: {}, reasons: { setup: 'Reconnect shop to repair its payment configuration.' } }; }
+}
+
+/** Scheduled checks share connect's probe. Office and public discovery never probe Stripe. */
+export async function refreshMachineCapabilities(env) {
+  const prior = await machineCapabilities(env);
+  if (prior.nextCheckAt > Date.now()) return prior;
+  const record = await probeMachinePayments(env);
+  const success = Object.values(record.machine).some(Boolean);
+  record.failures = success ? 0 : (prior.failures ?? 0) + 1;
+  record.nextCheckAt = Date.now() + (success ? 6 * 3600000 : Math.min(6 * 3600000, 300000 * 2 ** Math.min(record.failures - 1, 6)));
+  await env.DB.prepare("INSERT OR REPLACE INTO meta (key,value) VALUES (?1,?2)")
+    .bind('purchase-capabilities', JSON.stringify(record)).run();
+  return record;
+}
+export async function notePaymentRefusal(env, method, error) {
+  if ((error.statusCode ?? error.status) === 402 || error.type === 'card_error' || error.raw?.type === 'card_error') return;
+  const record = await machineCapabilities(env);
+  record.machine[method] = false;
+  record.reasons = { ...record.reasons, [method]: String(error.message).slice(0,500) };
+  record.checkedAt = Date.now();
+  record.nextCheckAt = 0;
+  await env.DB.prepare("INSERT OR REPLACE INTO meta (key,value) VALUES (?1,?2)")
+    .bind('purchase-capabilities', JSON.stringify(record)).run();
+}

package/worker/payment-dry-exchange.mjs

@@ -0,0 +1,30 @@
+/** Owner-only dry exchange through the real resource endpoint, without a wallet credential. */
+export async function dryPaymentExchange(env, origin, catalogue = {}) {
+  const { listOffers } = await import('./resource-kinds.mjs');
+  const resource = (await listOffers(env,origin)).find((r)=>r.offer.billing === 'one-time' && r.offer.currency === 'usd' && !r.offer.automaticTax && r.offer.taxBehavior !== 'exclusive');
+  const release = resource;
+  if (!release) return { verified: false, reason: 'No listed offer is eligible for a machine-payment challenge. Hosted Checkout remains available.' };
+  const { machineResource } = await import('./purchase-machine.mjs');
+  const { digest } = await import('./purchase-crypto.mjs');
+  const { byClaim } = await import('./purchase-store.mjs');
+  const claim = await digest(crypto.randomUUID());
+  const claimHash = await digest(claim);
+  try {
+    const url = new URL(`/api/purchases/resource/${resource.kind}/${resource.id}/${release.version}`, origin);
+    const request = new Request(url, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ kind: resource.kind, resource: resource.id, version: release.version, buyer: await digest(crypto.randomUUID()), claim, offerVersion: release.offerVersion, ...(release.offer.scope === 'game' ? { game: 'readiness-check' } : {}) }) });
+    const challenge = await machineResource(request, env, url, catalogue, { dryRun: true });
+    if (challenge.status !== 402) return { verified: false, reason: (await challenge.json()).detail ?? `Dry exchange answered ${challenge.status}` };
+    const { Challenge } = await import('mppx');
+    const parsed = Challenge.fromResponse(challenge);
+    if (parsed.realm !== url.hostname || !parsed.expires) throw new Error('Challenge failed realm or expiry verification');
+    return { verified: true, checkedAt: Date.now(), resource: resource.id, version: release.version, challenge: { method: parsed.method, intent: parsed.intent, realm: parsed.realm, expires: parsed.expires }, scope: 'A real unpaid request passed offer, storage, signing-key and Stripe permission checks and returned a parseable payment challenge. No wallet credential was submitted. Token eligibility, live settlement and refunds are not verified by this dry exchange.' };
+  } catch (error) { return { verified: false, reason: error.message }; }
+  finally {
+    const order = await byClaim(env, claimHash);
+    if (order) await env.DB.batch([
+      env.DB.prepare("DELETE FROM purchase_orders WHERE id = ?1 AND status = 'started'").bind(order.id),
+      env.DB.prepare("DELETE FROM resource_snapshots WHERE hash = ?1 AND NOT EXISTS (SELECT 1 FROM purchase_orders WHERE manifest_hash = ?1)").bind(order.manifest_hash),
+      env.DB.prepare("DELETE FROM purchase_offers WHERE version = ?1 AND NOT EXISTS (SELECT 1 FROM purchase_orders WHERE offer_version = ?1)").bind(order.offer_version),
+    ]);
+  }
+}

package/worker/payment-manual-refund.mjs

@@ -0,0 +1,40 @@
+/** Exact chain evidence for the studio's explicitly accepted manual refund duty. */
+export async function manualRefundDetails(env, order) {
+  if (order.payment || !order.paid_at) return null;
+  const rows = (await env.DB.prepare("SELECT network,reference,payload FROM purchase_settlements WHERE order_id = ?1 AND state IN ('settled','complete')").bind(order.id).all()).results ?? [];
+  const transfers = rows.map((row) => {
+    const data = JSON.parse(row.payload);
+    const auth = data.payload?.payload?.authorization;
+    return { network: row.network, transaction: row.reference ?? data.reference, payer: auth?.from ?? null,
+      amount: auth?.value ?? null, token: data.requirements?.asset ?? null, recipient: auth?.to ?? null };
+  });
+  return { status: 'manual_refund_required', order: order.id, delivered: Boolean(order.fulfilled_at), transfers,
+    message: 'Stripe has not recorded this chain payment. The selling studio owes any requested refund directly to the original payer. Use the exact network, token, amount and transaction below; record the refund transaction in the order note. Do not mark refunded until the transfer is confirmed.' };
+}
+
+/** Owner-supplied refund transaction must actually return the exact token amount to the payer. */
+export async function confirmManualRefund(env, order, transaction) {
+  if (!/^0x[0-9a-fA-F]{64}$/.test(transaction ?? '')) return { ok: false, error: 'refund-transaction', message: 'Supply the confirmed Base refund transaction hash.' };
+  const manual = await manualRefundDetails(env, order);
+  if (!manual?.transfers.length || manual.transfers.some((t) => t.network !== 'base')) return { ok:false, error:'refund-evidence', message:'Verified Base transfers are required.' };
+  const original = manual.transfers[0];
+  if (manual.transfers.some((t) => ['payer','token','recipient','amount'].some((key) => t[key]?.toLowerCase() !== original[key]?.toLowerCase()))) return { ok: false, error: 'refund-evidence', message: 'These transfers need separate refund evidence.' };
+  if (transaction.toLowerCase() === original.transaction?.toLowerCase()) return {ok:false,error:'refund-evidence',message:'The original payment is not a refund.'};
+  const { rpcFor } = await import('./settlement-journal.mjs');
+  const rpc = rpcFor(env,'base',order.mode);
+  const receipt = await rpc('eth_getTransactionReceipt',[transaction]);
+  const paidReceipt = await rpc('eth_getTransactionReceipt',[original.transaction]);
+  if (!receipt?.blockNumber || !paidReceipt?.blockNumber || BigInt(receipt.blockNumber) <= BigInt(paidReceipt.blockNumber)) return { ok: false, error: 'refund-evidence', message: 'The refund must be mined after the original payment.' };
+  const block = await rpc('eth_getBlockByNumber', [receipt.blockNumber, false]);
+  if (!block?.timestamp || Number(BigInt(block.timestamp)) * 1000 <= order.created_at) return { ok: false, error: 'refund-evidence', message: 'The refund must be sent after this order.' };
+  const { keccak256, toHex } = await import('viem');
+  const topic = keccak256(toHex('Transfer(address,address,uint256)'));
+  if (receipt?.status !== '0x1' || !receipt.logs?.some((log) => log.address.toLowerCase() === original.token.toLowerCase() && log.topics[0] === topic && log.topics[1]?.slice(-40).toLowerCase() === original.recipient.slice(2).toLowerCase() && log.topics[2]?.slice(-40).toLowerCase() === original.payer.slice(2).toLowerCase() && BigInt(log.data) === BigInt(original.amount)))
+    return {ok:false,error:'refund-evidence',message:'The chain receipt does not prove the exact refund to the original payer.'};
+  const { orderFact } = await import('./purchase-core.mjs');
+  await env.DB.batch([
+    env.DB.prepare('INSERT INTO purchase_manual_refunds (transaction_hash,order_id) VALUES (?1,?2)').bind(transaction.toLowerCase(),order.id),
+    orderFact(env,order.id,'refunded',{refund:transaction,refunded_at:Date.now(),note:JSON.stringify({sender:original.recipient,payer:original.payer,amount:original.amount,transaction})}),
+  ]);
+  return {ok:true,order:order.id,status:'succeeded',refund:transaction};
+}

package/worker/payment-policy.mjs

@@ -0,0 +1,40 @@
+/** One vocabulary for recovery, expiry, buyer locks and office status. */
+export const jobStates = Object.freeze({
+  submitted: { pending: true, terminal: false, blocks: true },
+  paid_recording: { pending: true, terminal: false, blocks: true },
+  recorded: { pending: true, terminal: false, blocks: true },
+  processing: { pending: true, terminal: false, blocks: true },
+  duplicate_refund: { pending: true, terminal: false, blocks: true },
+  failed: { pending: false, terminal: true, blocks: false },
+  complete: { pending: false, terminal: true, blocks: false },
+  refunded: { pending: false, terminal: true, blocks: false },
+  duplicate_refunded: { pending: false, terminal: true, blocks: false },
+  manual_review: { pending: true, terminal: false, blocks: true },
+});
+export function jobPolicy(state) {
+  if (!jobStates[state]) throw new Error(`Unknown payment job state: ${state}`);
+  return jobStates[state];
+}
+export function jobsSQL(property, prefix = '') {
+  const names = Object.entries(jobStates).filter(([state, policy]) => property === 'visible' ? policy.pending || ['failed','manual_review'].includes(state) : property === 'cleanup' ? state === 'failed' : policy[property]).map(([state]) => `'${state}'`);
+  return `${prefix}state IN (${names.join(',')})`;
+}
+export const pendingJobsSQL = jobsSQL('pending');
+export const blockingJobsSQL = jobsSQL('blocks');
+export const REPLAY_LIMIT_MS = 23 * 60 * 60 * 1000;
+export function definitiveRefusal(error) {
+  const status = error.statusCode ?? error.status;
+  if ([401,403,408,409,429].includes(status) || error.type === 'idempotency_error') return false;
+  if (error.idempotentReplayed && status >= 400 && status < 500) return true;
+  return status === 402 && (error.type === 'card_error' || error.raw?.type === 'card_error');
+}
+/** Ordered decision table. Storage faults can never authorize a refund. */
+export function recoveryAction({ state, fulfilled, provider, files, settled, deadline = false }) {
+  if (fulfilled || state === 'fulfilled') return 'final';
+  if (['refunded','disputed','lapsed','lost'].includes(state)) return 'preserve';
+  if (provider === 'paid' || settled || state === 'paid') return files === 'present' ? 'deliver' : 'storage_retry';
+  if (provider === 'refused' || provider === 'absent' && deadline) return 'fail';
+  if (provider === 'absent') return 'replay';
+  if (provider === 'processing') return 'wait';
+  return 'reconcile';
+}

package/worker/payment-recovery.mjs

@@ -0,0 +1,163 @@
+import { pendingJobsSQL, definitiveRefusal, REPLAY_LIMIT_MS, recoveryAction } from './payment-policy.mjs';
+import { orderFact, recordOrderState, releaseClaim } from './purchase-core.mjs';
+import { resumeSettlement } from './settlement-journal.mjs';
+/** Durable provider recordings outlive responses. A verified chain transfer is payment. */
+import { stripeCall, refundPayment, modeOf } from './stripe.mjs';
+import { byId, resourceAvailable } from './purchase-store.mjs';
+export async function saveRecording(env, order, params, options) {
+  const chain = params.payment_method_options?.crypto?.transaction_verification_options;
+  const id = chain ? `${order.id}:${chain.network}:${chain.transaction_hash}` : options.idempotencyKey;
+  await env.DB.prepare("INSERT OR IGNORE INTO purchase_jobs (id,order_id,mode,state,payload,updated_at) VALUES (?1,?2,?3,?4,?5,?6)")
+    .bind(id, order.id, order.mode, chain ? 'paid_recording' : 'submitted', JSON.stringify({ params, options: { ...options, idempotencyKey: chain ? chain.transaction_hash : options.idempotencyKey }, chain, startedAt: Date.now() }), Date.now()).run();
+  if (chain) {
+    // Only the protocol's verified settlement callback reaches here, never buyer input.
+    await orderFact(env, order.id, 'payment', {paid_at: Date.now()}).run();
+    await env.DB.prepare("UPDATE purchase_settlements SET state = 'complete', updated_at = ?2 WHERE order_id = ?1 AND reference = ?3").bind(order.id, Date.now(), chain.transaction_hash).run();
+  }
+  return id;
+}
+export async function recordProviderResult(env, order, id, pi) {
+  if (pi.amount !== order.amount || pi.currency !== order.currency || pi.livemode !== (order.mode === 'live')) throw new Error('Provider receipt does not match order');
+  await env.DB.prepare("UPDATE purchase_jobs SET payment = ?2, state = ?3, error = NULL, updated_at = ?4 WHERE id = ?1").bind(id, pi.id, pi.status === 'succeeded' ? 'recorded' : ['canceled','requires_payment_method'].includes(pi.status) ? 'failed' : 'processing', Date.now()).run();
+  if (pi.status !== 'succeeded') return;
+
+  await env.DB.batch([
+    orderFact(env, order.id, 'payment', {payment: pi.id, paid_at: Date.now()}),
+    env.DB.prepare("INSERT OR IGNORE INTO purchase_payments (payment,order_id) VALUES (?1,?2)").bind(pi.id, order.id),
+  ]);
+  const current = await byId(env, order.id);
+  if (current.payment !== pi.id) {
+    const refund = await refundPayment(env, pi.id);
+    await env.DB.prepare("UPDATE purchase_jobs SET state = ?2 WHERE id = ?1").bind(id, refund.status === 'succeeded' ? 'duplicate_refunded' : 'duplicate_refund').run();
+    return;
+  }
+}
+export async function recordingFailure(env, id, error) {
+  if (definitiveRefusal(error)) {
+    await env.DB.prepare("UPDATE purchase_jobs SET state = 'failed', error = ?2, attempts = attempts + 1, updated_at = ?3 WHERE id = ?1 AND state = 'submitted'").bind(id, String(error.message).slice(0, 500), Date.now()).run();
+    return;
+  }
+  // A failure of our call is not a fact about the original payment.
+  await env.DB.prepare("UPDATE purchase_jobs SET error = ?2, attempts = attempts + 1, updated_at = ?3 WHERE id = ?1")
+    .bind(id, String(error.message).slice(0, 500), Date.now()).run();
+}
+
+/** Read existing objects first. Listing avoids the search index's delayed negative answers. */
+export async function readProviderPayment(env, order, job, payment = null) {
+  const options = { version: '2026-07-29.preview' };
+  if (payment && !/^pi_[A-Za-z0-9]+$/.test(payment)) throw new Error('Supply an existing Stripe PaymentIntent id');
+  if (job.payment || payment) {
+    const pi = await stripeCall(env, 'GET', `/v1/payment_intents/${encodeURIComponent(job.payment ?? payment)}`, null, options);
+    if (pi.metadata?.order !== order.id) throw new Error('The existing PaymentIntent belongs to another order');
+    return pi;
+  }
+  let cursor;
+  for (let page = 0; page < 100; page++) {
+    const result = await stripeCall(env, 'GET', '/v1/payment_intents', { limit: 100, created: { gte: Math.floor(order.created_at / 1000) - 60 }, ...(cursor ? { starting_after: cursor } : {}) }, options);
+    if (!Array.isArray(result.data)) throw new Error('Stripe did not return an existing-payment list');
+    const found = result.data.find((pi) => pi.metadata?.order === order.id);
+    if (found) return found;
+    if (!result.has_more) return null;
+    cursor = result.data.at(-1)?.id;
+    if (!cursor) throw new Error('Stripe payment list has no continuation');
+  }
+  throw new Error(`Existing payment scan exceeded 100 pages for order ${order.id}; the owner must reconcile this order.`);
+}
+async function releaseUnpaid(env, order, job, pi = null) {
+  await env.DB.batch([
+    env.DB.prepare("UPDATE purchase_jobs SET state = 'failed', error = NULL, updated_at = ?2, payment = COALESCE(payment, ?3) WHERE id = ?1").bind(job.id, Date.now(), pi?.id ?? null),
+    orderFact(env, order.id, 'failed', {}),
+    releaseClaim(env, order.id),
+  ]);
+}
+export async function reconcileRecordings(env, orderId = null, dependencies = {}) {
+  await reconcileSettlements(env, orderId, dependencies);
+  const rows = (await env.DB.prepare(`SELECT * FROM purchase_jobs WHERE mode = ?1 AND ${pendingJobsSQL} AND (?2 IS NULL OR order_id = ?2) ORDER BY updated_at LIMIT 100`).bind(modeOf(env.STRIPE_KEY), orderId).all()).results ?? [];
+  for (const job of rows) {
+    try {
+      const order = await byId(env, job.order_id);
+      if (!order) continue;
+      const { params, options, startedAt } = JSON.parse(job.payload);
+      // An interruption always starts with a read, even inside the replay window.
+      let pi = await readProviderPayment(env, order, job, orderId ? dependencies.payment : null);
+      const deadline = Date.now() - (startedAt ?? order.created_at) >= REPLAY_LIMIT_MS;
+      const observation = { state: order.status, fulfilled: order.fulfilled_at, settled: job.state === 'paid_recording' || Boolean(order.paid_at) || Boolean(JSON.parse(job.payload).chain),
+        provider: pi ? pi.status === 'succeeded' ? 'paid' : ['canceled','requires_payment_method'].includes(pi.status) ? 'refused' : 'processing' : 'absent', deadline };
+      if (observation.settled && pi && pi.status !== 'succeeded') throw new Error(`Settled transfer needs Stripe recording: order ${order.id}; payment ${pi.id}`);
+      switch (recoveryAction(observation)) {
+        case 'fail':
+          if (pi?.status === 'requires_payment_method') {
+            pi = await stripeCall(env, 'POST', `/v1/payment_intents/${encodeURIComponent(pi.id)}/cancel`, {}, { idempotencyKey: `cancel-action-${pi.id}`, version: '2026-07-29.preview' });
+            if (pi.status !== 'canceled') throw new Error('The unpaid payment could not be canceled; the claim remains reserved');
+          }
+          await releaseUnpaid(env, order, job, pi); continue;
+        case 'replay': pi = await stripeCall(env, 'POST', '/v1/payment_intents', params, { ...options, version: '2026-07-29.preview' }); break;
+        default:
+          if (!pi) {
+            if (deadline) throw new Error(`Paid transfer still needs recording: order ${order.id}; key ${options.idempotencyKey}`);
+            pi = await stripeCall(env, 'POST', '/v1/payment_intents', params, { ...options, version: '2026-07-29.preview' });
+          }
+      }
+      if (['requires_action','requires_confirmation','requires_capture','requires_payment_method'].includes(pi.status) || orderId && dependencies.cancel === true && pi.status === 'processing') pi = await stripeCall(env, 'POST', `/v1/payment_intents/${encodeURIComponent(pi.id)}/cancel`, {}, { idempotencyKey: `cancel-action-${pi.id}`, version: '2026-07-29.preview' });
+      await recordProviderResult(env, order, job.id, pi);
+      if (['canceled','requires_payment_method'].includes(pi.status)) { await releaseUnpaid(env, order, job, pi); continue; }
+      if (pi.status !== 'succeeded') {
+        if (Date.now() - (startedAt ?? order.created_at) >= REPLAY_LIMIT_MS && !['canceled','requires_payment_method'].includes(pi.status))
+          await env.DB.prepare("UPDATE purchase_jobs SET state = 'manual_review', error = 'Provider payment remains unresolved after deadline' WHERE id = ?1").bind(job.id).run();
+        continue;
+      }
+      if ((await byId(env, order.id)).payment !== pi.id) continue;
+      const current = await byId(env, order.id);
+      const final = recoveryAction({ state: current.status, fulfilled: current.fulfilled_at, provider: 'paid', settled: false, files: 'missing' });
+      if (final === 'final' || final === 'preserve') {
+        await env.DB.prepare("UPDATE purchase_jobs SET state = 'complete', updated_at = ?2 WHERE id = ?1").bind(job.id, Date.now()).run();
+        continue;
+      }
+      const available = await resourceAvailable(env, order.resource_kind, JSON.parse(order.manifest));
+      const action = recoveryAction({ state: current.status, fulfilled: current.fulfilled_at, provider: 'paid', settled: false, files: available ? 'present' : 'missing' });
+      if (action === 'storage_retry') throw new Error('Paid files unavailable. Restore storage; payment is retained and delivery will retry.');
+      if (action === 'deliver') {
+        await recordOrderState(env, current, 'fulfilled');
+        await env.DB.prepare("UPDATE purchase_jobs SET state = 'complete', updated_at = ?2 WHERE id = ?1").bind(job.id, Date.now()).run();
+      }
+    } catch (error) { await recordingFailure(env, job.id, error); }
+  }
+  return { checked: rows.length };
+}
+
+/** Resume even when the original isolate died before the provider callback. */
+export async function reconcileSettlements(env, orderId = null, dependencies = {}) {
+  const jobs = (await env.DB.prepare("SELECT * FROM purchase_settlements WHERE mode = ?1 AND state NOT IN ('complete','unpaid') AND (?2 IS NULL OR order_id = ?2) ORDER BY updated_at LIMIT 100").bind(modeOf(env.STRIPE_KEY), orderId).all()).results ?? [];
+  for (const job of jobs) {
+    try {
+      const order = await byId(env, job.order_id);
+      if (!order) throw new Error('Settlement order is missing');
+      const reference = await resumeSettlement(env, job, dependencies);
+      if (!reference) {
+        await env.DB.prepare('UPDATE purchase_settlements SET updated_at = ?2 WHERE id = ?1').bind(job.id, Date.now()).run();
+        continue;
+      }
+      if (reference.manual) {
+        await env.DB.prepare("UPDATE purchase_settlements SET state = 'manual_review', error = ?2, updated_at = ?3 WHERE id = ?1").bind(job.id, reference.reason, Date.now()).run();
+        continue;
+      }
+      if (reference.unpaid) {
+        await env.DB.batch([
+          env.DB.prepare("UPDATE purchase_settlements SET state = 'unpaid', error = ?2, updated_at = ?3 WHERE id = ?1").bind(job.id, reference.reason, Date.now()),
+          orderFact(env, order.id, 'expired', {}),
+          releaseClaim(env, order.id),
+        ]);
+        continue;
+      }
+      const payload = JSON.parse(job.payload);
+      const params = { amount: order.amount, currency: order.currency, confirm: true,
+        payment_method_data: { type: 'crypto' }, payment_method_types: ['crypto'],
+        payment_method_options: { crypto: { mode: 'transaction_verification', transaction_verification_options: { network: job.network, transaction_hash: reference } } },
+        metadata: { homie: 'purchase-v1', order: order.id, mpp_challenge_id: payload.challengeId, mpp_method: job.network === 'base' ? 'evm' : 'tempo' } };
+      await saveRecording(env, order, params, { idempotencyKey: reference });
+      await env.DB.prepare("UPDATE purchase_settlements SET state = 'complete', reference = ?2, error = NULL, updated_at = ?3 WHERE id = ?1").bind(job.id, reference, Date.now()).run();
+    } catch (error) {
+      await env.DB.prepare("UPDATE purchase_settlements SET error = ?2, updated_at = ?3, state = CASE WHEN ?4 THEN 'manual_review' ELSE state END WHERE id = ?1").bind(job.id, String(error.message).slice(0,500), Date.now(), Date.now() - job.created_at >= REPLAY_LIMIT_MS ? 1 : 0).run();
+    }
+  }
+}

package/worker/payment-test-exchange.mjs

@@ -0,0 +1,19 @@
+/** Explicit sandbox readiness uses the same read-only facts as scheduled readiness. */
+import { modeOf } from './stripe.mjs';
+import { probeMachinePayments } from './payment-capabilities.mjs';
+import { digest } from './purchase-crypto.mjs';
+export async function testPaymentExchange(env) {
+  if (modeOf(env.STRIPE_KEY) !== 'test') throw new Error('The sandbox readiness check requires a sandbox key');
+  const key = await digest(env.STRIPE_KEY);
+  const row = await env.DB.prepare("SELECT value FROM meta WHERE key = 'purchase-test-exchange'").first();
+  const prior = row ? JSON.parse(row.value) : null;
+  if (prior?.key === key && prior.nextCheckAt > Date.now()) return prior;
+  const observed = await probeMachinePayments(env);
+  const verified = Object.values(observed.machine).some(Boolean);
+  const report = { key, checkedAt: Date.now(), verified,
+    nextCheckAt: Date.now() + (verified ? 6 * 3600000 : 300000),
+    reason: verified ? null : Object.values(observed.reasons).join('; '),
+    scope: 'Read-only sandbox configuration check. No sale, PaymentIntent, entitlement or refund was created. Write permissions and real settlement remain unverified.' };
+  await env.DB.prepare("INSERT OR REPLACE INTO meta (key,value) VALUES ('purchase-test-exchange',?1)").bind(JSON.stringify(report)).run();
+  return report;
+}