@homie-rocks/studio 0.37.1 → 0.38.0

package/lib/port-check.mjs

@@ -60,6 +60,25 @@ function yawDeg(a, b) {
   const d = a[5] * b[5] + a[6] * b[6]; const la = Math.hypot(a[5], a[6]) || 1; const lb = Math.hypot(b[5], b[6]) || 1;
   return (Math.acos(Math.max(-1, Math.min(1, d / (la * lb)))) * 180) / Math.PI;
 }
+/** A server room keeps its authority and advances; a browser room must promote a host. */
+export function roomContinued(before, after, serverHosted) {
+  return serverHosted
+    ? after?.hosted === 'server' && after?.role === 'replica' && Number.isFinite(before?.tick) && after?.tick > before.tick && after?.frames > before.frames
+    : after?.role === 'host';
+}
+
+/** Compare two observations on the same browser clock, including time spent taking screenshots. */
+export function roundClockContinued(before, after) {
+  return !before?.round || !after?.round || before.round.n !== after.round.n
+    || Math.abs((before.round.leftMs - after.round.leftMs) - (after.observedAt - before.observedAt)) < 6000;
+}
+
+/** A wall can leave too little runway; retry the same hold after moving away, never excuse steering faults. */
+export function needsRunway(res) {
+  return !res.ok && (res.why === 'barely moved' || res.why?.startsWith('blocked at once'))
+    && res.yawChangeDeg < 10 && (res.dirErrDeg === null || res.dirErrDeg < 15);
+}
+
 const finite = (r) => r && Number.isFinite(r[1]) && Number.isFinite(r[2]);
 /** A frame the player steers (the probe's `busy` says when a knockback, a stun or a respawn has the body). */
 const steerable = (r) => finite(r) && !r[8];
@@ -134,6 +153,9 @@ export function judgePresses(rows, presses, size, view) {
   const out = presses.map((p) => {
     const seg = rows.filter((r) => r[0] >= p.a && r[0] <= p.b + 60 && steerable(r));
     if (seg.length < 4) return rows.some((r) => r[0] >= p.a && r[0] <= p.b && finite(r) && r[8]) ? { dir: p.dir, ok: false, blocked: true, busy: true } : { dir: p.dir, ok: false, why: 'no samples' };
+    // The first post-input frame can already show the response. Keep its preceding drawn pose.
+    const before = rows.filter((r) => r[0] < p.a).at(-1);
+    if (before && steerable(before)) seg.unshift(before);
     const u = DIRV[p.dir]; const r0 = seg[0];
     let matchAt = null, after = 0, afterOk = 0, maxYaw = 0, peakAlong = 0, contact = false;
     for (let i = 1; i < seg.length; i++) {
@@ -258,7 +280,7 @@ async function webkit(pw) {
 const frameOf = (h) => h.page.frames().find((f) => f.url().includes('/__game/')) ?? null;
 async function inFrame(h, src, v = null) { const f = frameOf(h); return f ? T(f.evaluate(src), 10_000, v) : v; }
 const shell = (h) => T(h.page.evaluate(() => { const s = window.__shell; return s ? { room: s.room, seat: s.seat, role: s.stats?.role ?? null, results: s.results ?? [], facts: s.facts ? { counts: s.facts.counts } : null } : null; }), 8000, null);
-const info = (h) => inFrame(h, '(() => { const p = window.__homiePort; if (!p) return null; const i = p.info(); const n = window.__homieNet; i.net = n ? { snapHzIn: n.stats().snapHzIn, snapHzOut: n.stats().snapHzOut, rtt: n.stats().rtt, promotions: n.stats().promotions } : null; i.v = p.view; i.size = p.size; i.keys = p.keys; i.thumb = p.thumb; return i; })()');
+const info = (h) => inFrame(h, '(() => { const p = window.__homiePort; if (!p) return null; const i = p.info(); i.observedAt = performance.now(); const n = window.__homieNet; i.net = n ? { snapHzIn: n.stats().snapHzIn, snapHzOut: n.stats().snapHzOut, rtt: n.stats().rtt, promotions: n.stats().promotions } : null; i.hosted = n?.probe?.hosted?.() ?? null; i.tick = n?.probe?.tick?.() ?? null; i.v = p.view; i.size = p.size; i.keys = p.keys; i.thumb = p.thumb; return i; })()');
 const rowsSince = (h, t) => inFrame(h, `(window.__homiePort ? window.__homiePort.rows(${Number(t) || 0}) : [])`, []);
 const frameNow = (h) => inFrame(h, '(window.__homiePort ? window.__homiePort.now() : performance.now())', 0);
 
@@ -285,13 +307,14 @@ async function focusGame(h) {
 
 /* ------------------------------------------------------------------ input */
 
-async function holdKey(h, code, ms) { await h.page.keyboard.down(code); await sleep(ms); await h.page.keyboard.up(code); }
+async function holdKey(h, code, ms, ready) { await h.page.keyboard.down(code); if (ready) await ready(); await sleep(ms); await h.page.keyboard.up(code); }
 
 function thumbAt(h, i) { const t = i?.thumb ?? [0.24, 0.74]; return [Math.round(h.vp.width * t[0]), Math.round(h.vp.height * t[1])]; }
-async function touchDrag(h, from, dir, reach, holdMs) {
+async function touchDrag(h, from, dir, reach, holdMs, ready) {
   const [x0, y0] = from; const u = DIRV[dir];
   await h.touch('touchStart', [{ id: 1, x: x0, y: y0 }]);
   for (let k = 1; k <= 8; k++) { await h.touch('touchMove', [{ id: 1, x: Math.round(x0 + (u[0] * reach * k) / 8), y: Math.round(y0 + (u[1] * reach * k) / 8) }]); await sleep(12); }
+  if (ready) await ready();
   const end = Date.now() + holdMs;
   let w = 0;
   while (Date.now() < end) {
@@ -302,6 +325,31 @@ async function touchDrag(h, from, dir, reach, holdMs) {
   }
   await h.touch('touchEnd', h.touchAll ? [] : [{ id: 1, x: Math.round(x0 + u[0] * reach), y: Math.round(y0 + u[1] * reach) }]);
 }
+/** Timestamp real input delivery, then keep it held until four frames can judge its direction.
+ * The response limit stays 600 ms; slow automation delivery and the thumb's ramp are not game latency. */
+export async function measuredPress(h, how, code, from, dir) {
+  await inFrame(h, `(() => {
+    if (!window.__homieCheckInput) {
+      const state = window.__homieCheckInput = {};
+      addEventListener('keydown', e => { if (state.code === e.code && state.key === null) state.key = performance.now(); }, true);
+      addEventListener('touchmove', () => { state.touch = performance.now(); }, { capture: true, passive: true });
+    }
+    Object.assign(window.__homieCheckInput, { code: ${JSON.stringify(code)}, key: null, touch: null });
+  })()`);
+  let a = null, b = null;
+  const ready = async () => {
+    a = await inFrame(h, `window.__homieCheckInput.${how === 'keys' ? 'key' : 'touch'}`);
+    if (!Number.isFinite(a)) throw new Error('the game frame did not receive the measured input');
+    await sleep(420);
+    const until = Date.now() + 3000;
+    while (Date.now() < until && (await rowsSince(h, a)).length < 4) await sleep(50);
+    b = await frameNow(h);
+  };
+  if (how === 'keys') await holdKey(h, code, 0, ready);
+  else await touchDrag(h, from, dir, 70, 0, ready);
+  return { dir, a, b };
+}
+
 async function swipe(h, dir) {
   const x0 = Math.round(h.vp.width * 0.5); const y0 = Math.round(h.vp.height * 0.55); const u = DIRV[dir]; const reach = Math.round(Math.min(h.vp.width, h.vp.height) * 0.3);
   await h.touch('touchStart', [{ id: 2, x: x0, y: y0 }]);
@@ -365,11 +413,22 @@ async function ownerTests(h, how, log) {
   const holds = view === 'side' ? ['right', 'left'] : ['down', 'left'];
   out.holds = [];
   for (const dir of holds) {
-    const a = await frameNow(h);
-    if (how === 'keys') await holdKey(h, keys[dir], 5000); else await touchDrag(h, thumbAt(h, i), dir, 70, 5000);
-    const b = await frameNow(h);
-    await sleep(250);
-    const res = judgeHold(await rowsSince(h, a - 50), dir, a, b, size, view);
+    const hold = async () => {
+      const a = await frameNow(h);
+      if (how === 'keys') await holdKey(h, keys[dir], 5000); else await touchDrag(h, thumbAt(h, i), dir, 70, 5000);
+      const b = await frameNow(h);
+      await sleep(250);
+      return judgeHold(await rowsSince(h, a - 50), dir, a, b, size, view);
+    };
+    let res = await hold();
+    if (needsRunway(res)) {
+      const first = res;
+      const away = { up: 'down', down: 'up', left: 'right', right: 'left' }[dir];
+      log(`  ${h.engine}-${h.kind} ${how} hold ${dir}: ${first.why}; move ${away} and retry the same hold`);
+      if (how === 'keys') await holdKey(h, keys[away], 1100); else await touchDrag(h, thumbAt(h, i), away, 70, 1100);
+      await sleep(400);
+      res = { ...await hold(), runwayRetry: first };
+    }
     out.holds.push(res);
     log(`  ${h.engine}-${h.kind} ${how} hold ${dir}: ${res.ok ? 'ok' : `FAIL (${res.why})`} travel ${res.travelBodies} bodies, yaw ${res.yawChangeDeg}°`);
     await sleep(400);
@@ -383,12 +442,9 @@ async function ownerTests(h, how, log) {
   const presses = [];
   const a0 = await frameNow(h);
   const until = Date.now() + 10_000;
-  for (let k = 0; Date.now() < until; k++) {
+  for (let k = 0; k < alt.length || Date.now() < until; k++) {
     const dir = alt[k % alt.length];
-    const a = await frameNow(h);
-    if (how === 'keys') await holdKey(h, keys[dir], 420); else await touchDrag(h, thumbAt(h, i), dir, 70, 380);
-    const b = await frameNow(h);
-    presses.push({ dir, a, b });
+    presses.push(await measuredPress(h, how, keys[dir], thumbAt(h, i), dir));
     await sleep(170);
   }
   await sleep(200);
@@ -595,10 +651,13 @@ export async function portCheck({ url, game, root, only = null, shots = null, lo
         if (!oa.ok || !ob.ok) { row('host-kill', false, { why: 'a browser was never seated' }); row('late-join', null, { why: 'skipped: no room' }); collect(A); collect(B); await close(A); await close(B); }
         else {
           await sleep(3000);
-          const ia = await info(A); const ib = await info(B);
-          if (ia?.role !== 'host') row('host-kill', null, { why: `the first browser was not the host (it was ${ia?.role}); skipped`, ia: ia?.role, ib: ib?.role });
+          const ia = await info(A); let ib = await info(B);
+          const serverHosted = ia?.hosted === 'server' && ib?.hosted === 'server';
+          if (ia?.role !== 'host' && !serverHosted) row('host-kill', null, { why: `the first browser was not the host (it was ${ia?.role}); skipped`, ia: ia?.role, ib: ib?.role });
           else {
             await shot(B, 'life-before');
+            // Screenshot encoding may span a round on a software renderer. Observe the room we actually leave.
+            ib = await info(B);
             const pids = A.pid ? [A.pid, ...descendants(A.pid)] : [];
             const killAt = Date.now();
             for (const p of pids) { try { process.kill(p, 'SIGKILL'); } catch { /* gone */ } }
@@ -606,14 +665,14 @@ export async function portCheck({ url, game, root, only = null, shots = null, lo
             collect(A);
             void A.close();
             let promoted = null; let ibAfter = null;
-            while (Date.now() - killAt < 15_000) { ibAfter = await info(B); if (ibAfter?.role === 'host') { promoted = Date.now() - killAt; break; } await sleep(100); }
+            while (Date.now() - killAt < 15_000) { ibAfter = await info(B); if (roomContinued(ib, ibAfter, serverHosted)) { promoted = Date.now() - killAt; break; } await sleep(100); }
             await sleep(1500);
             const ib2 = await info(B);
             const sameRound = ib?.round && ib2?.round && (ib2.round.n === ib.round.n || (ib.round.phase === 'over' || ib.round.leftMs < 3000));
-            const clockOk = ib?.round && ib2?.round && ib2.round.n === ib.round.n ? Math.abs((ib.round.leftMs - ib2.round.leftMs) - (Date.now() - killAt + 0)) < 6000 : true;
+            const clockOk = roundClockContinued(ib, ib2);
             const running = (ib2?.frames ?? 0) > (ibAfter?.frames ?? 0) && (ib2?.net?.snapHzOut ?? 0) >= 0;
             await shot(B, 'life-after-kill');
-            row('host-kill', Boolean(promoted !== null && promoted <= 5000 && sameRound && clockOk && running), { promotedMs: promoted, roundBefore: ib?.round ?? null, roundAfter: ib2?.round ?? null, why: promoted === null ? 'nobody took over as host within 15 s' : promoted > 5000 ? `the phone took over after ${promoted} ms (over 5 s)` : !sameRound ? 'the round did not continue (a new round started)' : !clockOk ? 'the round clock jumped at the takeover' : undefined });
+            row('host-kill', Boolean(promoted !== null && promoted <= 5000 && sameRound && clockOk && running), { hosted: serverHosted ? 'server' : 'browser', promotedMs: serverHosted ? null : promoted, continuedMs: serverHosted ? promoted : null, roundBefore: ib?.round ?? null, roundAfter: ib2?.round ?? null, why: promoted === null ? (serverHosted ? 'the server room stopped after a browser left' : 'nobody took over as host within 15 s') : promoted > 5000 ? `the phone took over after ${promoted} ms (over 5 s)` : !sameRound ? 'the round did not continue (a new round started)' : !clockOk ? 'the round clock jumped at the takeover' : undefined });
             // Late joiner into the same, running room.
             const C = await launch('desk');
             const joinAt = Date.now();

package/lib/purchase-links.mjs

@@ -0,0 +1,42 @@
+/** Uses the shop's authorized Stripe API transport; no API credential goes to the Worker. */
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { sharedPartsOf, readPart, packedDir } from './parts.mjs';
+import { canonicalJson } from '../worker/referrals.mjs';
+import { paymentLinkURL } from '../worker/shop-links.mjs';
+const hash = (v) => createHash('sha256').update(canonicalJson(v)).digest('hex');
+export async function syncPurchaseLinks({ root, api, slug, site, mode, list, till }) {
+  const file = join(root, 'parts', 'offers.json');
+  const settings = existsSync(file) ? JSON.parse(readFileSync(file, 'utf8')) : {};
+  const offers = sharedPartsOf(root).flatMap(({id, versions, part}) => versions.flatMap((version) => {
+    const p = readPart(packedDir(root,id,version)), config = settings[id], selected = config?.releases?.[version];
+    return p.sale && config?.active !== false && selected?.active !== false && (version === versions.at(-1) || selected?.keepOnSale === true) ? [{kind:'part',resource:id,version,name:part.name,sale:{...p.sale,...config?.price}}] : [];
+  }));
+  const configured = offers.flatMap(o => {
+    const quantities = settings[o.resource]?.quantities ?? [1];
+    if (!Array.isArray(quantities) || !quantities.length || quantities.some(q=>!Number.isSafeInteger(q) || q<1 || !Number.isSafeInteger(q*o.sale.amount))) throw new Error(`Invalid Payment Link quantities for ${o.resource}`);
+    return [...new Set(quantities)].map(quantity=>({...o,quantity}));
+  });
+  const links = (await list('/v1/payment_links')).filter((l) => l.metadata?.homie === 'purchase-links-v1' && l.metadata?.studio === slug && l.metadata?.origin === site);
+  const config = {v:1,mode,offers:[]}, keep = new Set();
+  for (const o of configured) {
+    const revision = hash({o,till});
+    let link = links.find((l)=>l.metadata?.revision === revision);
+    if (!link) {
+      const metadata = {homie:'purchase-links-v1',studio:slug,origin:site,revision};
+      const product = (await list('/v1/products')).find(p=>p.metadata?.homie === 'purchase-links-v1' && p.metadata?.studio === slug && p.metadata?.origin === site && p.metadata?.revision === revision) ?? await api('POST','/v1/products',{name:`${o.name} ${o.version}`, ...(o.sale.taxCode ? {tax_code:o.sale.taxCode}:{}),metadata},`purchase-product-${revision}`);
+      const price = (await list('/v1/prices')).find(p=>p.product === product.id && p.metadata?.revision === revision) ?? await api('POST','/v1/prices',{product:product.id,currency:o.sale.currency,unit_amount:o.sale.amount,...(o.sale.taxBehavior ? {tax_behavior:o.sale.taxBehavior}:{}),...(o.sale.billing !== 'one-time' ? {recurring:{interval:o.sale.billing}}:{}),metadata},`purchase-price-${revision}`);
+      link = await api('POST','/v1/payment_links',{line_items:[{price:price.id,quantity:o.quantity}],metadata,
+        ...(o.sale.billing === 'one-time' ? {payment_intent_data:{metadata}}:{subscription_data:{metadata}}),
+        ...(till === 'stripe-managed' ? {managed_payments:{enabled:true}} : {automatic_tax:{enabled:o.sale.automaticTax === true},...(o.sale.taxIdCollection?{tax_id_collection:{enabled:true}}:{}),...(o.sale.billing === 'one-time' && o.sale.invoiceCreation?{invoice_creation:{enabled:true}}:{}),...(o.sale.adaptivePricing === undefined?{}:{adaptive_pricing:{enabled:o.sale.adaptivePricing}})}),
+        ...(o.sale.billing === 'one-time' && o.sale.customerCreation?{customer_creation:'always'}:{}),allow_promotion_codes:o.sale.promotionCodes === true,
+        after_completion:{type:'redirect',redirect:{url:`${site}/purchases/thanks`}}},`purchase-link-${revision}`);
+    }
+    if (!paymentLinkURL(link.url)) throw new Error('Stripe returned an invalid Payment Link');
+    if (!link.active) await api('POST',`/v1/payment_links/${link.id}`,{active:true});
+    keep.add(link.id);
+    config.offers.push({kind:o.kind,resource:o.resource,version:o.version,quantity:o.quantity,offer:canonicalJson(o.sale),id:link.id,url:link.url,revision});
+  }
+  return { config, retire:async()=>{ for (const l of links) if(l.active && !keep.has(l.id)) await api('POST',`/v1/payment_links/${l.id}`,{active:false}); } };
+}

package/lib/purchase-wallet.mjs

@@ -0,0 +1,114 @@
+/** Payment authority and limits stay in the person's existing wallet client. */
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+const execute = promisify(execFile);
+export async function payWithWallet(
+  url,
+  body,
+  { client = process.env.HOMIE_PARTS_WALLET, pending, run = execute } = {},
+) {
+  if (!client) return null;
+  if (!["link-cli", "purl", "tempo"].includes(client))
+    return { data: { detail: "Choose link-cli, purl or tempo as the wallet; hosted Checkout is available." } };
+  let args;
+  if (client === "link-cli") {
+    args = [
+      "mpp",
+      "pay",
+      url,
+      "-X",
+      "POST",
+      "-d",
+      JSON.stringify(body),
+      "--format",
+      "json",
+    ];
+    if (pending?.id)
+      args.push(
+        "--spend-request-id",
+        pending.id,
+        "--approved-challenge",
+        pending.challenge,
+      );
+    else
+      args.push(
+        "--amount",
+        String(body.amount),
+        "--context",
+        `Purchase the digital resource ${body.resource} version ${body.version} from ${new URL(url).host} under the exact price and licence terms approved in this conversation. The selling studio delivers the files and signed purchase proof.`,
+      );
+  } else {
+    const atomic = BigInt(body.amount) * 10000n;
+    const purlLimit = process.env.PURL_MAX_AMOUNT;
+    if (purlLimit && !/^\d+$/.test(purlLimit))
+      return { data: { detail: "Invalid wallet maximum amount; use hosted Checkout or correct the wallet setting." } };
+    const tempoLimit = process.env.TEMPO_MAX_SPEND;
+    if (
+      tempoLimit &&
+      (!Number.isFinite(Number(tempoLimit)) || Number(tempoLimit) < 0)
+    )
+      return { data: { detail: "Invalid wallet maximum spend; use hosted Checkout or correct the wallet setting." } };
+    // Use the wallet's native per-request ceiling in its documented units.
+    const ceiling =
+      client === "tempo"
+        ? [
+            "--max-spend",
+            String(
+              Math.min(
+                body.amount / 100,
+                tempoLimit ? Number(tempoLimit) : Infinity,
+              ),
+            ),
+          ]
+        : [
+            "--max-amount",
+            String(
+              purlLimit && BigInt(purlLimit) < atomic
+                ? BigInt(purlLimit)
+                : atomic,
+            ),
+            "--network",
+            "base,base-sepolia",
+            "--output-format",
+            "json",
+          ];
+    args = [
+      ...(client === "tempo" ? ["request"] : []),
+      ...ceiling,
+      "-X",
+      "POST",
+      "--json",
+      JSON.stringify(body),
+      url,
+    ];
+  }
+  let stdout;
+  try { ({ stdout } = await run(client, args, {
+    encoding: "utf8",
+    maxBuffer: 256 * 1024 * 1024,
+    timeout: 60000,
+  })); } catch (error) {
+    if (error.code === 'ENOENT') return { data: { detail: `The ${client} wallet is not installed; use hosted Checkout.` } };
+    // Wallets often return a structured refusal with a nonzero exit status.
+    // A process timeout or broken output is ambiguous: never start a second payment.
+    if (error.stdout?.trim()) stdout = error.stdout;
+    else if (/declined|insufficient funds|spend limit|not authenticated|not logged in|unsupported (network|method)|user rejected|user denied/i.test(error.stderr ?? ''))
+      return { data: { detail: String(error.stderr).trim(), paymentStatus: 'not_paid' } };
+    else return { uncertain: true, data: { detail: 'The wallet stopped without a payment result. Retry this purchase to reconcile it; do not pay again.' } };
+  }
+  let result;
+  try { result = JSON.parse(stdout); }
+  catch { return { uncertain: true, data: { detail: 'The wallet returned an unreadable payment result. Retry this purchase to reconcile it; do not pay again.' } }; }
+  if (result._next?.pay_argv) {
+    const next = result._next.pay_argv.args;
+    return {
+      pending: {
+        id: result.id,
+        challenge: next[next.indexOf("--approved-challenge") + 1],
+      },
+      approval: result.approval_url,
+    };
+  }
+  const value = result.body ?? result;
+  return { data: typeof value === "string" ? JSON.parse(value) : value };
+}

package/lib/rules-check-worker.mjs

@@ -183,12 +183,14 @@ function play(c, companions, allow) {
   const free = (seat) => { if (!seated.has(seat)) return; seated.delete(seat); did.push(`seat ${seat} left`); frames.push({ t: 'free', seat }); };
   const bots = (mode) => { policy = { ...(policy ?? {}), bots: mode }; frames.push({ t: 'policy', policy }); };
 
-  let A = open({ observe, noted, send });
+  const movesToCheck = [];
+  const moved = (...args) => movesToCheck.push(args);
+  let A = open({ observe, noted, moved, send });
   for (const m of told()) A.frame(m);
   /** The room stops and starts again as a deploy restarts it: a new epoch, everybody away until they are back. */
   const restart = () => {
     const bytes = A.save(); const epoch = A.epoch + 1; A.stop();
-    A = open({ observe, noted, send, restore: bytes, restoreEpoch: epoch });
+    A = open({ observe, noted, moved, send, restore: bytes, restoreEpoch: epoch });
     for (const m of told()) A.frame(m);
     // Everybody is back at once, but for the highest seat, which is a second late.
     const top = Math.max(...seated.keys());
@@ -342,6 +344,17 @@ function play(c, companions, allow) {
     const stats = A.core.stats; const cut = stats.ticksCut; const held = stats.held;
     A.tickNow();
     units += A.core.stats.tickUnits;
+    for (const [name, tick, input, before, after] of movesToCheck.splice(0)) {
+      const kind = c.kinds.find(k => k.name === name);
+      moveTick = tick;
+      const result = L.P.stepMove(kind.move, before, input, moveCtx.get(name), Math.max(1, Math.floor(budget / 4)), kind.motion, c.dims,
+        error => { fault ??= `${siteOf(name, 'move')} ${name}.move: prediction failed: ${error.message}.${when()}`; });
+      units += result.used;
+      const r = kind.body.radius, bounds = c.map.bounds;
+      result.pos = L.P.vec3({ x: Math.max(bounds.min.x + r, Math.min(bounds.max.x - r, result.pos.x)), y: Math.max(bounds.min.y + r, Math.min(bounds.max.y - r, result.pos.y)), z: result.pos.z }, c.dims);
+      delete result.used;
+      if (JSON.stringify(result) !== JSON.stringify(after)) fault ??= `${siteOf(name, 'move')} ${name}.move: prediction and the server produced different bodies from the same input.${when()}`;
+    }
     if (A.core.stats.tickUnits > peak) peak = A.core.stats.tickUnits;
     if (A.core.stats.maxUnits > most) { most = A.core.stats.maxUnits; worst = A.core.stats.worst; }
     const facts = A.facts();

package/lib/scaffold.mjs

@@ -1,4 +1,5 @@
 import { APPS_MIGRATION, APPS_MIGRATION_FILE } from '../worker/app-records.mjs';
+import { PURCHASE_MIGRATION, PURCHASE_MIGRATION_FILE, PURCHASE_STATE, PURCHASE_STATE_FILE } from '../worker/purchase-schema.mjs';
 /**
  * `homie-studio new <folder> --name "<Studio Name>"` — a studio is ONE
  * monorepo: a visible folder the person opens in Claude or Codex.
@@ -65,7 +66,7 @@ export function slugify(name) {
  * No `database_id` until one is known: Wrangler (4.45.0+) and the Deploy to Cloudflare flow create the database
  * the binding names and keep it linked.
  */
-export function wranglerConfig({ worker, name, d1, d1Id = null, r2 = null, layout = 'root', ai = false, routes = null, triggers = null }) {
+export function wranglerConfig({ worker, name, d1, d1Id = null, r2 = null, layout = 'root', ai = false, routes = null, paidParts = false, partsRateLimit = null, triggers = null }) {
   const at = layout === 'site' ? { schema: '../node_modules', main: 'src/worker.mjs', dist: './dist', migrations: 'migrations' }
     : { schema: 'node_modules', main: 'site/src/worker.mjs', dist: './site/dist', migrations: 'site/migrations' };
   const rooms = [{ name: 'TABLE', class_name: 'Table' }, { name: 'LOBBY', class_name: 'Lobby' }];
@@ -79,19 +80,20 @@ export function wranglerConfig({ worker, name, d1, d1Id = null, r2 = null, layou
     // subdomain) reaches it instead of failing with 1042.
     // `disallow_eval_during_startup`: no code is made from a string while the Worker loads (Cloudflare never allows it
     // later). A game's rules run in this Worker (NETPLAY.md section 29), and nothing in them is ever made from text.
-    compatibility_flags: ['global_fetch_strictly_public', 'disallow_eval_during_startup'],
+    compatibility_flags: ['global_fetch_strictly_public', 'disallow_eval_during_startup', ...(paidParts ? ['nodejs_compat'] : [])],
+    ...(paidParts ? { alias: { '@homie-rocks/studio/worker': '@homie-rocks/studio/worker/selling' }, triggers: { crons: ['*/5 * * * *'] }, ratelimits: [partsRateLimit ?? { name: 'PURCHASE_RATE_LIMITER', namespace_id: '1001', simple: { limit: 60, period: 60 } }] } : {}),
     workers_dev: true,
     preview_urls: true,
     // The studio's own custom-domain and exact-host routes, as its owner wrote them: this file is written again by
     // every deploy, and one written without them sends the studio's domain back to whatever else the zone routes
     // (lib/routes.mjs). A studio without routes gets no key at all.
     ...(routes?.length ? { routes } : {}),
-    ...(triggers ? { triggers } : {}),
+    ...(triggers ? { triggers: paidParts ? { ...triggers, crons: [...new Set([...(triggers.crons ?? []), '*/5 * * * *'])] } : triggers } : {}),
     assets: { directory: at.dist, binding: 'ASSETS', run_worker_first: true },
     durable_objects: { bindings: rooms },
     migrations: [{ tag: 'v1', new_sqlite_classes: ['Table', 'Lobby'] }],
     d1_databases: [{ binding: 'DB', database_name: d1, ...(d1Id ? { database_id: d1Id } : {}), migrations_dir: at.migrations }],
-    ...(r2 ? { r2_buckets: [{ binding: 'MEDIA', bucket_name: r2 }] } : {}),
+    ...(r2 ? { r2_buckets: [{ binding: 'MEDIA', bucket_name: r2 }, ...(paidParts ? [{ binding: 'PURCHASE_MEDIA', bucket_name: `${r2.slice(0, 52)}-purchases` }] : [])] } : {}),
     // Workers AI, only when a server's AI guides think with it (agents_brain workers-ai; deploy adds it, 0.17.0).
     // Never in Previews: they do not inherit it, so a Preview's guides answer from the game's script.
     ...(ai ? { ai: { binding: 'AI' } } : {}),
@@ -747,6 +749,8 @@ export { default, Table, Lobby } from '@homie-rocks/studio/worker';
     [`site/migrations/${SERVERS_MIGRATION_FILE}`]: SERVERS_MIGRATION,
     [`site/migrations/${CHAT_MIGRATION_FILE}`]: CHAT_MIGRATION,
     [`site/migrations/${SHOP_MIGRATION_FILE}`]: SHOP_MIGRATION,
+    [`site/migrations/${PURCHASE_MIGRATION_FILE}`]: PURCHASE_MIGRATION,
+    [`site/migrations/${PURCHASE_STATE_FILE}`]: PURCHASE_STATE,
     [`site/migrations/${SHOP_RESERVATIONS_FILE}`]: SHOP_RESERVATIONS,
     [`site/migrations/${SHOP_STATEMENTS_FILE}`]: SHOP_STATEMENTS,
     [`site/migrations/${SHOP_LINES_FILE}`]: SHOP_LINES,
@@ -906,8 +910,24 @@ function ensureAppsMigration(root) {
   mkdirSync(dirname(file), { recursive: true }); writeFileSync(file, APPS_MIGRATION);
   return `site/migrations/${APPS_MIGRATION_FILE}`;
 }
+export function ensurePartsMigration(root) {
+  const file = join(root, 'site', 'migrations', PURCHASE_MIGRATION_FILE);
+  if (existsSync(file)) return null;
+  mkdirSync(dirname(file), { recursive: true });
+  writeFileSync(file, PURCHASE_MIGRATION);
+  return `site/migrations/${PURCHASE_MIGRATION_FILE}`;
+}
+
+function ensurePartsStateMigration(root) {
+  const file = join(root, 'site', 'migrations', PURCHASE_STATE_FILE);
+  if (existsSync(file)) return null;
+  mkdirSync(dirname(file), { recursive: true });
+  writeFileSync(file, PURCHASE_STATE);
+  return `site/migrations/${PURCHASE_STATE_FILE}`;
+}
+
 export function ensureMigrations(root) {
-  return [ensureStatsMigration(root), ensurePlayersMigration(root), ensureOfficeMigration(root), ensureServersMigration(root), ensureChatMigration(root), ensureShopMigration(root), ensureLoungeMigration(root), ensureShopReservations(root), ensureShopStatements(root), ensureShopLines(root), ensureAppsMigration(root)].filter(Boolean);
+  return [ensureStatsMigration(root), ensurePlayersMigration(root), ensureOfficeMigration(root), ensureServersMigration(root), ensureChatMigration(root), ensureShopMigration(root), ensureLoungeMigration(root), ensureShopReservations(root), ensureShopStatements(root), ensureShopLines(root), ensureAppsMigration(root), ensurePartsMigration(root), ensurePartsStateMigration(root)].filter(Boolean);
 }
 
 /** What a migration file the template added is for, in a few words (deploy and dev say it). */

package/lib/shoot.mjs

@@ -27,7 +27,7 @@
  *
  * `--preview` (no --url): THE FRAMES HALF WITHOUT THE WHOLE SITE. It starts the light preview server itself
  * (lib/preview.mjs: the one built game's files on 127.0.0.1, no Wrangler, no rooms), opens the game's own page there
- * and shoots it. The game plays alone, offline, with its bots, which is what pictures of the game itself want. The
+ * and shoots it. A game with offline play enabled plays alone, with its bots, which is what pictures of the game itself want. The
  * smoke is NOT RUN (there is no room to meet in: that half needs `dev`), and there is no loading cover to wait for.
  * The result says which build the frames are of (`build`: its hash, the one `build` printed) and that the page
  * really loaded that build's hashed bundle (`bundle`: lib/build.mjs bundleOf, never a guess at assets/main.js).
@@ -115,7 +115,7 @@ export const VIRTUAL_CLOCK = `(() => {
   window.__homieClock = {
     get frozen() { return frozen; },
     now: perfNow,
-    freeze() { if (frozen) return vPerf; /* a whole millisecond (never earlier than the last real reading): stepped time is then base + n steps exactly, with no float dust between a step asked for and the time handed out */ vPerf = Math.ceil(R.perf()); vDate = R.D.now(); frozen = true; stepAnims(0); return vPerf; },
+    freeze() { if (frozen) return vPerf; /* a whole millisecond (never earlier than the last real reading): stepped time is then base + n steps exactly, with no float dust between a step asked for and the time handed out */ vPerf = Math.ceil(R.perf()); vDate = R.D.now(); frozen = true; runTimers(vPerf); stepAnims(0); return vPerf; },
     step(ms) {
       if (!frozen) this.freeze();
       const d = Math.max(0, Number(ms) || 0);
@@ -274,7 +274,11 @@ export async function shoot({ url, game, frames = 60, fps = 30, device = 'comput
     const inAll = (fn, arg) => Promise.all(all().map((f) => T(f.evaluate(fn, arg), 20_000)));
     const frozen = await inAll(() => (window.__homieClock ? (window.__homieClock.freeze(), true) : false));
     if (!frozen.some(Boolean)) { result.why = 'the virtual clock is not in the page (it was opened before the script could be injected)'; return result; }
-    if (hold) await first.page.keyboard.down(hold).catch(() => {});
+    if (hold) {
+      // The play page owns the top-level focus; the game's key listener lives in its iframe.
+      if (gf) await T(gf.evaluate(() => window.focus()), 5000);
+      await first.page.keyboard.down(hold).catch(() => {});
+    }
     const rows = [];
     for (let n = 1; n <= frames; n++) {
       if (left() < 3000) { result.partial = `stopped at frame ${n - 1} of ${frames}: the ${Math.round(timeoutMs / 1000)} s bound was reached (a slow renderer; ask for fewer frames or a longer --timeout)`; break; }
@@ -287,6 +291,7 @@ export async function shoot({ url, game, frames = 60, fps = 30, device = 'comput
       rows.push({ n, file, virtualMs: +(n * (1000 / fps)).toFixed(3), clockMs: nows.find((v) => Number.isFinite(v)) ?? null, realMs: Date.now() - t, ...(await frameFacts(first) ?? {}) });
     }
     if (hold) await first.page.keyboard.up(hold).catch(() => {});
+    result.rules = gf ? await T(gf.evaluate(() => { const p = window.__homieNet?.probe; return typeof p?.hosted === 'function' ? { hosted: p.hosted(), status: p.status?.(), tick: p.tick?.() } : null; }), 5000) : null;
     result.frames = rows.length;
     result.realSeconds = +((Date.now() - started) / 1000).toFixed(1);
     result.virtualSeconds = +((rows.length * 1000) / fps / 1000).toFixed(3);
@@ -294,10 +299,11 @@ export async function shoot({ url, game, frames = 60, fps = 30, device = 'comput
     result.limits = 'Stepped: requestAnimationFrame, performance.now, Date, setTimeout, setInterval, CSS and Web animations, in the page and the game\'s frame. NOT stepped: the room\'s socket and its server clock (other players and the round arrive in real time), Web Audio\'s clock, <video>, workers. These frames show what was drawn; they are not a frame rate.';
     const probed = rows.some((r) => r.phase !== undefined);
     if (!probed) result.note = [result.note, 'the game exposes no port probe (exposePort): the frames carry no round phase or position'].filter(Boolean).join('; ');
-    writeFileSync(join(out, 'shoot.json'), `${JSON.stringify({ v: 1, kind: 'homie-shoot', ...result, rows }, null, 1)}\n`);
     const smokeOk = result.smoke.ok !== false;
-    result.ok = rows.length === frames && smokeOk;
-    if (!result.ok) result.why = !smokeOk ? `smoke: ${result.smoke.why}` : result.partial;
+    const rulesOk = !result.rules || (result.rules.status === 'playing' && result.rules.tick > 0);
+    result.ok = rows.length === frames && smokeOk && rulesOk && !result.errors.length;
+    if (!result.ok) result.why = !smokeOk ? `smoke: ${result.smoke.why}` : !rulesOk ? 'The rules game is not playing. A server-only build needs its room: run homie-studio dev and shoot with --url (or explicitly enable room.offline for offline play).' : result.errors.length ? `game errors: ${result.errors.join('; ')}` : result.partial;
+    writeFileSync(join(out, 'shoot.json'), `${JSON.stringify({ v: 1, kind: 'homie-shoot', ...result, rows }, null, 1)}\n`);
     return result;
   } finally {
     if (served?.server) { served.server.closeAllConnections?.(); served.server.close(); }

package/lib/shop-links.mjs

@@ -3,10 +3,10 @@ import { createHash, randomUUID } from 'node:crypto';
 import { productIdOf, WEBHOOK_SECRET_SHAPE } from '../worker/stripe.mjs';
 import { defaultTaxCode } from '../worker/shop-rules.mjs';
 import { LINKS_STRIPE_VERSION, linkSettings, paymentLinkURL } from '../worker/shop-links.mjs';
-import { HOOK_EVENTS } from './shop.mjs';
+import { HOOK_EVENTS, SHOP_HOOK_EVENTS } from './shop.mjs';
 const hash = (value) => createHash('sha256').update(JSON.stringify(value)).digest('hex');
 const same = (a, b) => Object.keys(a ?? {}).length === Object.keys(b).length && Object.entries(b).every(([k, v]) => a?.[k] === v);
-export async function syncPaymentLinks({ api, shop, slug, site, mode, w, receipt, saveReceipt }) {
+export async function syncPaymentLinks({ root, api, shop, slug, site, mode, w, receipt, saveReceipt }) {
   const list = async (path, params = {}) => {
     const all = []; let cursor;
     do {
@@ -62,26 +62,35 @@ export async function syncPaymentLinks({ api, shop, slug, site, mode, w, receipt
     keepLinks.add(link.id);
     config.items.push({ item: item.id, id: link.id, url: link.url, revision: linkRevision });
   }
+  const purchases = root ? await (await import('./purchase-links.mjs')).syncPurchaseLinks({ root, api, slug, site, mode, list, till: shop.purchasesTill ?? shop.till }) : null;
+  const purchaseSecrets = {};
+  if (purchases?.config.offers.length && !has('PURCHASE_SIGNING_KEYS')) {
+    const { generateKeyPair, exportJWK } = await import('jose');
+    const pair = await generateKeyPair('Ed25519', { extractable: true });
+    purchaseSecrets.PURCHASE_SIGNING_KEYS = JSON.stringify([await exportJWK(pair.privateKey)]);
+  }
+  const events = purchases?.config.offers.length ? HOOK_EVENTS : SHOP_HOOK_EVENTS;
   const endpoints = await list('/v1/webhook_endpoints');
   const url = `${site}/api/shop/hook`;
-  const current = endpoints.find((e) => e.id === receipt?.endpoint && e.url === url && e.status === 'enabled' && HOOK_EVENTS.every((event) => e.enabled_events?.includes(event)));
+  const current = endpoints.find((e) => e.id === receipt?.endpoint && e.url === url && e.status === 'enabled' && events.every((event) => e.enabled_events?.includes(event)));
   let endpoint = current, secret;
   if (!endpoint || !has('STRIPE_WEBHOOK_SECRET')) {
     const pending = receipt?.url === url && receipt?.pending ? receipt.pending : randomUUID();
     saveReceipt({ ...receipt, pending, mode, url }); // Retry the same private creation response; never persist the secret.
-    endpoint = await api('POST', '/v1/webhook_endpoints', { url, enabled_events: [...HOOK_EVENTS], api_version: LINKS_STRIPE_VERSION, metadata: { homie: 'shop-v1' }, description: 'Studio shop' }, `webhook-${pending}`);
+    endpoint = await api('POST', '/v1/webhook_endpoints', { url, enabled_events: [...events], api_version: LINKS_STRIPE_VERSION, metadata: { homie: 'shop-v1' }, description: 'Studio shop' }, `webhook-${pending}`);
     if (!WEBHOOK_SECRET_SHAPE.test(endpoint.secret ?? '')) throw new Error('Missing signing secret');
     secret = endpoint.secret;
   }
-  const fingerprint = hash(config);
+  const fingerprint = hash({config, purchases:purchases?.config});
   const unchanged = current && !secret && receipt?.fingerprint === fingerprint && has('STRIPE_SHOP_LINKS') && !has('STRIPE_KEY');
   if (!unchanged) {
-    const saved = await w(['secret', 'bulk'], { input: JSON.stringify({ STRIPE_SHOP_LINKS: JSON.stringify(config), ...(secret ? { STRIPE_WEBHOOK_SECRET: secret } : {}) }) });
+    const saved = await w(['secret', 'bulk'], { input: JSON.stringify({ STRIPE_SHOP_LINKS: JSON.stringify(config), ...purchaseSecrets, ...(purchases && (purchases.config.offers.length || has('PURCHASE_LINKS')) ? { PURCHASE_LINKS: JSON.stringify(purchases.config) } : {}), ...(secret ? { STRIPE_WEBHOOK_SECRET: secret } : {}) }) });
     if (saved.code !== 0) return { ok: false, needs: 'cloudflare', why: 'Cloudflare could not save the shop connection. Run shop connect again; existing webhooks remain active.' };
     // Explicitly running connect selects keyless; manual selects the existing keyed checkout.
     if (has('STRIPE_KEY') && (await w(['secret', 'delete', 'STRIPE_KEY'], { input: 'y\n' })).code !== 0) return { ok: false, needs: 'cloudflare', why: 'The links are ready; run shop connect again to finish removing the old checkout credential.' };
     saveReceipt({ mode, endpoint: endpoint.id, url, fingerprint, keyless: true });
   }
+  await purchases?.retire();
   // Retire only after the replacement configuration and signing secret are installed.
   for (const link of links.filter((p) => own(p) && p.active && !keepLinks.has(p.id))) await api('POST', `/v1/payment_links/${link.id}`, { active: false });
   for (const price of prices.filter((p) => own(p) && p.active && !keepPrices.has(p.id))) await api('POST', `/v1/prices/${price.id}`, { active: false });