@homie-rocks/studio 0.40.0 → 0.43.0

package/worker/mcp.mjs

@@ -1,6 +1,7 @@
+import { selling } from './extensions.mjs';
 import OAuthProvider from '@cloudflare/workers-oauth-provider';
 import { createMcpHandler } from 'agents/mcp/server';
-import { McpServer, fromJsonSchema } from '@modelcontextprotocol/server';
+import { McpServer, fromJsonSchema, ProtocolError } from '@modelcontextprotocol/server';
 import { CfWorkerJsonSchemaValidator } from '@modelcontextprotocol/server/validators/cf-worker';
 import { players } from './players.mjs';
 import { isOwner, sameOrigin } from './office.mjs';
@@ -20,16 +21,11 @@ async function browserPerson(request,env) {
   }
   return null;
 }
+const paymentInputSchema={type:'object',properties:{buyer:{type:'string',pattern:'^[a-f0-9]{64}$'},claim:{type:'string',pattern:'^[a-f0-9]{64}$'},offerVersion:{type:'string'},checkout:{type:'boolean'}},additionalProperties:false};
 export async function remoteMcp(request,env,ctx,{catalogueOf,definitions=[]}) {
   const url=new URL(request.url), origin=url.origin, path=url.pathname;
   if(!env.DB)return json({error:'studio database required'},503);
   if(request.headers.has('origin') && request.headers.get('origin')!==origin)return json({error:'origin refused'},403);
-  // Cap all protocol bodies before handing them to a library or a handler.
-  if(request.body){
-    const reader=request.body.getReader(),chunks=[];let size=0;
-    for(;;){const {done,value}=await reader.read();if(done)break;size+=value.length;if(size>65536){await reader.cancel();return json({error:'request too large'},413);}chunks.push(value);}
-    const bytes=new Uint8Array(size);let at=0;for(const chunk of chunks){bytes.set(chunk,at);at+=chunk.length;}request=new Request(request,{body:bytes});
-  }
   if(path.startsWith('/hooks/tools/')) return (await import('./tool-webhook.mjs')).toolWebhook(request,env,{cat:await catalogueOf(),definitions});
   const scoped={...env,OAUTH_KV:oauthStorage(env.DB)};
   const api=async(request,env,ctx)=>{
@@ -40,7 +36,8 @@ export async function remoteMcp(request,env,ctx,{catalogueOf,definitions=[]}) {
       const body=await request.clone().json().catch(()=>null);
       if(body?.method==='tools/call') {
         const tool=tools.find(t=>t.name===body.params?.name);
-        if(tool&&!validator.getValidator(tool.inputSchema)(body.params?.arguments??{}).valid)await audit(env,caller,tool.name,'invalid');
+        const schema=tool?.price?{...tool.inputSchema,properties:{...tool.inputSchema.properties,_payment:paymentInputSchema}}:tool?.inputSchema;
+        if(tool&&!validator.getValidator(schema)(body.params?.arguments??{}).valid)await audit(env,caller,tool.name,'invalid');
         if(!tool)await audit(env,caller,'unknown-tool','denied');
       }
     }
@@ -50,11 +47,13 @@ export async function remoteMcp(request,env,ctx,{catalogueOf,definitions=[]}) {
     };
     const read=async(name,handler)=>{
       let outcome='error';
-      try{const fresh=await currentCaller(env,ctx.props);await rate(fresh);const result=await handler(fresh);if(JSON.stringify(result).length>65536)throw new Error('Result too large');outcome='ok';return result;}
+      try{const fresh=await currentCaller(env,ctx.props);await rate(fresh);const result=await handler(fresh);outcome='ok';return result;}
       finally{await audit(env,caller,name,outcome);}
     };
     const server=async()=>{
-      const s=new McpServer({name:cat.studio?.name??'Homie studio',version:'1.0.0'},{jsonSchemaValidator:validator});
+      const capabilities=await selling.machineCapabilities(env);
+      const s=new McpServer({name:cat.studio?.name??'Homie studio',version:'1.0.0'},{jsonSchemaValidator:validator,capabilities:{experimental:{payment:{methods:capabilities.machine?.card?{stripe:{intents:['charge']}}:{}}}}});
+      const dispatch=new Map();
       for (const meta of cat.games.filter(g=>g.kind==='app' && g.records?.persist)) {
         for (const [role,declared] of Object.entries(meta.roles??{})) {
           if (declared.signIn && !await allowed({app:meta.id,role},caller,env)) continue;
@@ -69,6 +68,7 @@ export async function remoteMcp(request,env,ctx,{catalogueOf,definitions=[]}) {
         }
       }
       for(const tool of tools){
+        if (!await allowed(tool.audience,caller,env)) continue;
         if (tool.kind==='prompt') {
           if (!await allowed(tool.audience,caller,env)) continue;
           s.registerPrompt(tool.name,{description:tool.description,argsSchema:fromJsonSchema(tool.inputSchema,validator)},async(args)=>read('prompt:'+tool.name,async fresh=>{
@@ -77,21 +77,37 @@ export async function remoteMcp(request,env,ctx,{catalogueOf,definitions=[]}) {
             return {messages:[{role:'user',content:{type:'text',text:JSON.stringify({kind:'studio-prompt-data',prompt:tool.name,data:text})}}]};
           }));continue;
         }
-        s.registerTool(tool.name,{description:tool.description,inputSchema:fromJsonSchema(tool.inputSchema,validator)},async(args)=>{
+        const schema=tool.price?{...tool.inputSchema,properties:{...tool.inputSchema.properties,_payment:paymentInputSchema}}:tool.inputSchema;
+        const handler=async(args,extra)=>{
           let outcome='error';
           try{
             // Recheck inside dispatch, even when a connection listed tools earlier.
             const fresh=await currentCaller(env,ctx.props);
             if(!await allowed(tool.audience,fresh,env)){outcome='denied';throw new Error('Permission denied');}
             try{await rate(fresh);}catch(error){outcome='limited';throw error;}
-            const value=await tool.handler(args,services(env,cat,origin,fresh,tool.namespace??tool.name,tool));
+            const context=services(env,cat,origin,fresh,tool.namespace??tool.name,tool);
+            if(tool.price) {const result=await selling.paidTool(env,cat,origin,tool,args,context,extra);outcome=result.isError?'error':'ok';return result;}
+            if(tool.protocol) {const result=await tool.handler(args,{...context,paymentExtra:extra});outcome=result.isError?'error':'ok';return result;}
+            const value=await tool.handler(args,{...context,request});
             const text=JSON.stringify({kind:'untrusted-tool-data',tool:tool.name,data:value});
-            if(text.length>65536)throw new Error('Result too large; narrow your request');
             outcome='ok';return {content:[{type:'text',text}]};
-          }catch(error){return {isError:true,content:[{type:'text',text:outcome==='denied'||outcome==='limited'?error.message:'Tool failed. Check the office audit and the tool definition.'}]};}
+          }catch(error){if(error?.code===-32042)throw error;return {isError:true,content:[{type:'text',text:outcome==='denied'||outcome==='limited'?error.message:'Tool failed. Check the office audit and the tool definition.'}]};}
           finally{await audit(env,caller,tool.name,outcome);}
-        });
+        };
+        s.registerTool(tool.name,{description:tool.description,inputSchema:fromJsonSchema(schema,validator)},handler);
+        dispatch.set(tool.name,{schema,handler});
       }
+      // Payment binding errors are JSON-RPC errors, not tool failures. The SDK's
+      // convenience dispatcher turns arbitrary errors into isError results; use its
+      // public protocol handler to preserve mppx's standard -32042 challenge.
+      s.server.setRequestHandler('tools/call',async(input,extra)=>{
+        const entry=dispatch.get(input.params.name);
+        if(!entry)return {isError:true,content:[{type:'text',text:'Permission denied or unknown tool'}]};
+        const args=input.params.arguments??{};
+        if(!validator.getValidator(entry.schema)(args).valid)return {isError:true,content:[{type:'text',text:'Invalid arguments'}]};
+        try{return await entry.handler(args,{...extra,_meta:input.params._meta});}
+        catch(error){if(error?.code===-32042)throw new ProtocolError(error.code,error.message,error.data);throw error;}
+      });
       return s;
     };
     return createMcpHandler(server)(request,env,ctx);

package/worker/office-page.mjs

@@ -937,7 +937,7 @@ export async function officePage(cat, headers = {}) {
   const name = cat.studio?.name ?? 'Studio';
   const options = (cat.games ?? []).map((g) => `<option value="${esc(g.id)}">every room of ${esc(g.name)}</option>`).join('');
   const body = `<header class="top"><h1>${esc(name)} <small>Office</small></h1>
-<div class="links"><span class="live"><i class="dot" id="livedot"></i><span id="live">…</span></span><a href="/_studio/stats">Stats</a><a href="/_studio/office/connections">AI connections</a>${cat.shop ? '<a href="/_studio/office/shop">Shop</a>' : ''}
+<div class="links"><span class="live"><i class="dot" id="livedot"></i><span id="live">…</span></span><a href="/_studio/stats">Stats</a><a href="/_studio/office/connections">AI connections</a><a href="/_studio/office/functions">Functions</a>${cat.shop ? '<a href="/_studio/office/shop">Shop</a>' : ''}
 <form method="post" action="/_studio/signout" style="display:inline"><button class="ghost small" type="submit">Sign out</button></form></div></header>
 <form class="bar" id="announce-all"><label for="announce-text">Announce</label><input type="text" id="announce-text" maxlength="280" placeholder="A line every player sees, in the game" autocomplete="off">
 <select id="announce-scope" aria-label="Who sees it"><option value="">every room of every game</option>${options}</select><button type="submit">Send</button>

package/worker/players.mjs

@@ -1,3 +1,4 @@
+import { toolIdentity } from './tool-identity.mjs';
 /**
  * PLAYERS — accounts on ONE studio, passkey first, and the cloud saves a persistent game keeps (saves/SAVES.md).
  *
@@ -236,8 +237,8 @@ async function sessionOf(request, env, url = new URL(request.url)) {
 /** A guest for a request with no player yet (the first save). Refused past the address's or the day's limit. */
 async function newGuest(request, env, url, addressLimit = PLAYER_LIMITS.newPlayersPerHour, counter = 'new') {
   const ip = addressOf(request);
-  if (limited(`${counter}:${ip}`, addressLimit, HOUR)) return { error: fail(429, 'rate', 'too many new players from this address; try again later') };
-  const capped = await dailyCapReached(env);
+  if (addressLimit !== null && limited(`${counter}:${ip}`, addressLimit, HOUR)) return { error: fail(429, 'rate', 'too many new players from this address; try again later') };
+  const capped = (counter !== 'shop-new' || env.PLAYER_LIMIT_DAILY !== undefined) && await dailyCapReached(env);
   if (capped) return { error: fail(503, 'busy', 'this studio has taken all the new players it takes in one day; try again tomorrow') };
   const id = newPlayerId();
   const now = Date.now();
@@ -383,6 +384,8 @@ export const players = Object.freeze({
   },
   /** The request's signed-in player ({ id, name, guest, owner }), or null. */
   async of(request, env) {
+    const identity=toolIdentity(request);
+    if(identity?.id && !identity.id.startsWith('office-')) { const p=await env.DB.prepare('SELECT id,name,guest,owner FROM players WHERE id=?1').bind(identity.id).first();return p?{...p,guest:Boolean(p.guest),owner:Boolean(p.owner)}:null; }
     try { const s = await sessionOf(request, env); return s ? { id: s.player.id, name: s.player.name, guest: s.player.guest, owner: s.player.owner } : null; } catch { return null; }
   },
   /** Shop guest creation uses the studio's new-guest address rate and the daily player limit. */

package/worker/purchase-delivery.mjs

@@ -55,6 +55,7 @@ export async function grantPurchase(env, origin, o, b = {}) {
     : null;
   if (!rights || !rights.active)
     return fail(402, `Purchase is ${coreOrder.state}; delivery is unavailable`);
+  await resourceKind(o.resource_kind).fulfill?.(env,origin,o);
   const key = await signingKey(env);
   const now = Math.floor(Date.now() / 1000);
   const claims = {

package/worker/purchase-hosted-readiness.mjs

@@ -8,7 +8,6 @@ import { recurringReady } from './purchase-store.mjs';
 export async function hostedReadiness(env, catalogue, recurring = false) {
   const missing = [];
   if (!env.DB || env.HOMIE_PREVIEW === '1') missing.push('Studio purchases need the deployed database');
-  if (!env.PURCHASE_RATE_LIMITER) missing.push('Deploy the purchase rate limiting binding');
   try { await signingKey(env); } catch { missing.push('Create a valid purchase signing key'); }
   if ((!hasStripeKey(env) && !purchaseLinks(env)) || !WEBHOOK_SECRET_SHAPE.test(env.STRIPE_WEBHOOK_SECRET ?? '') || !['stripe', 'stripe-managed'].includes(catalogue.shop?.purchasesTill ?? catalogue.shop?.till)) missing.push('Connect this studio shop to Stripe first');
   if (recurring && hasStripeKey(env) && !(await recurringReady(env))) missing.push('Reconnect the shop to verify subscription permissions and webhook events before selling recurring resources');

package/worker/purchase-links.mjs

@@ -5,5 +5,5 @@ export function purchaseLinks(env) {
   try { const c = JSON.parse(env.PURCHASE_LINKS ?? 'null'); return c?.v === 1 && c.mode === linkConfig(env)?.mode && Array.isArray(c.offers) ? c : null; } catch { return null; }
 }
 export function purchaseLink(env, o) {
-  return purchaseLinks(env)?.offers.find((link) => (link.quantity ?? 1) === o.quantity && link.kind === o.resource_kind && link.resource === o.resource_id && link.version === JSON.parse(o.manifest).version && link.offer === canonicalJson(JSON.parse(o.offer)) && paymentLinkURL(link.url));
+  return purchaseLinks(env)?.offers.find((link) => (link.quantity ?? 1) === o.quantity && link.kind === o.resource_kind && link.resource === (o.resource_kind==='service'?JSON.parse(o.manifest).tool:o.resource_id) && link.version === JSON.parse(o.manifest).version && link.offer === canonicalJson(JSON.parse(o.offer)) && paymentLinkURL(link.url));
 }

package/worker/purchase-machine.mjs

@@ -154,6 +154,7 @@ export async function machineResource(
     .first();
   o = await byId(env, o.id);
   if (["paid", "fulfilled", "disputed"].includes(o.status)) {
+    if(mcp && core?.transport==='checkout') {const result=await response();return result instanceof Response?result:machineMcpDelivery(result,dependencies);}
     const recorded = stored ? null : await env.DB.prepare("SELECT payload FROM purchase_jobs WHERE order_id = ?1 ORDER BY updated_at DESC LIMIT 1").bind(o.id).first();
     const recording = recorded && JSON.parse(recorded.payload);
     const challengeId = recording?.params?.metadata?.mpp_challenge_id;

package/worker/purchase-office.mjs

@@ -27,7 +27,7 @@ export async function extendOffice(env, cat, origin, out) {
   try {
     out.purchases = await purchaseReadiness(env, origin, cat);
     const rows = (await env.DB.prepare('SELECT o.*, r.manifest AS manifest FROM purchase_orders o JOIN resource_snapshots r ON r.hash=o.manifest_hash ORDER BY o.created_at DESC LIMIT 100').all()).results ?? [];
-    for (const r of rows) out.orders.push({ id: r.id, status: r.status, resourceKind: r.resource_kind, resource: r.resource_id, name: JSON.parse(r.manifest).name, shown: money(r.amount,r.currency), amount:r.amount, currency:r.currency, createdAt:r.created_at, mode:r.mode, player:{name:r.buyer_label}, stripe:r.payment ? dashboardLink(r.mode,'payment',r.payment):null, refundable:hasStripeKey(env) && ['paid','fulfilled'].includes(r.status), manualRefund:await manualRefundDetails(env,r) });
+    for (const r of rows.filter(r=>!out.orders.some(o=>o.id===r.id))) out.orders.push({ id: r.id, status: r.status, resourceKind: r.resource_kind, resource: r.resource_id, name: JSON.parse(r.manifest).name, shown: money(r.amount,r.currency), amount:r.amount, currency:r.currency, createdAt:r.created_at, mode:r.mode, player:{name:r.buyer_label}, stripe:r.payment ? dashboardLink(r.mode,'payment',r.payment):null, refundable:hasStripeKey(env) && ['paid','fulfilled'].includes(r.status), manualRefund:await manualRefundDetails(env,r) });
     out.orders.sort((a,b)=>b.createdAt-a.createdAt);
     out.paymentRecovery = (await env.DB.prepare(`SELECT id AS request_key, order_id, state, payment, error, attempts, updated_at FROM purchase_jobs WHERE ${jobsSQL('visible')} ORDER BY updated_at`).all()).results ?? [];
     out.settlementRecovery = (await env.DB.prepare('SELECT order_id, network, state, reference, error, created_at, updated_at FROM purchase_settlements ORDER BY created_at').all()).results ?? [];

package/worker/purchase-owner.mjs

@@ -109,8 +109,6 @@ export async function purchaseReadiness(env, origin, catalogue = {}) {
     missing.push(
       "Reconnect the shop to verify subscription permissions and webhook events",
     );
-  if (!env.PURCHASE_RATE_LIMITER)
-    missing.push("Deploy the Cloudflare purchase rate limiting binding");
   if (!env.PURCHASE_SIGNING_KEYS)
     missing.push("Create the separate purchase signing key");
   const machine = await machineCapabilities(env);

package/worker/purchase-reconciliation.mjs

@@ -298,6 +298,7 @@ export async function reconcileOneTime(env, o) {
 export async function reconcileOrder(env, o) {
   if (o.subscription && hasStripeKey(env) && !await linkOf(env,o.id)) await reconcileSubscription(env, o);
   else await reconcileOneTime(env, o);
+  if(o.resource_kind==='cart' && o.payment) await (await import('./shop.mjs')).syncRefunds(env,o.payment);
 }
 
 /** Called only AFTER the existing shop webhook signature/mode check. Return null for player orders. */

package/worker/purchase-routes.mjs

@@ -136,19 +136,7 @@ export async function purchaseRoutes(
   if (env.HOMIE_PREVIEW === "1" || !env.DB)
     return fail(503, "Studio purchases need the deployed database");
   try {
-    if (!env.PURCHASE_RATE_LIMITER)
-      return fail(
-        503,
-        "Deploy the Cloudflare purchase rate limiting binding before selling",
-      );
-    if (
-      !(
-        await env.PURCHASE_RATE_LIMITER.limit({
-          key: `${request.headers.get("cf-connecting-ip") ?? "unknown"}:${request.method}`,
-        })
-      ).success
-    )
-      return fail(429, "Too many purchase requests. Try again shortly");
+    if (env.PURCHASE_RATE_LIMITER && !(await env.PURCHASE_RATE_LIMITER.limit({key: `${request.headers.get('cf-connecting-ip') ?? 'unknown'}:${request.method}`})).success) return fail(429, 'Studio purchase rate limit reached');
     if (path === "/api/purchases/mcp") {
       const { purchaseMcp } = await import("./purchase-mcp.mjs");
       return purchaseMcp(request, env, url, cat);
@@ -193,7 +181,7 @@ export async function purchaseRoutes(
       ].includes(path) &&
       request.method === "POST"
     ) {
-      return await claimedPurchase(request, env, url, path);
+      return await claimedPurchase(request, env, url, path, cat);
     }
     return fail(404, "No such studio purchase route");
   } catch (error) {
@@ -484,7 +472,7 @@ async function verifyPurchaseEvidence(request, env, url) {
   });
 }
 
-async function claimedPurchase(request, env, url, path) {
+async function claimedPurchase(request, env, url, path, cat) {
   const claim = bearer(request);
   if (!/^[a-f0-9]{64}$/.test(claim ?? ""))
     return fail(401, "Purchase claim required");
@@ -514,6 +502,12 @@ async function claimedPurchase(request, env, url, path) {
       await reconcileSubscription(env, o);
       o = await byId(env, o.id);
     }
+    if (o.resource_kind === 'cart') {
+      const { refundableShopOrder, shopOf } = await import('./shop.mjs');
+      const { orderById } = await import('./shop-store.mjs');
+      if (!await refundableShopOrder(env, await orderById(env, o.id), shopOf(cat)))
+        return fail(403, 'Ask the studio for this refund. Tips and used items follow the studio refund settings.');
+    }
     const days = termsOf(o).refundWindowDays;
     let paidAt = Number(o.paid_at);
     if (o.subscription && o.payment) {
@@ -536,12 +530,12 @@ async function claimedPurchase(request, env, url, path) {
     }
     if (o.paid_at && !o.payment) return fail(409, 'Stripe has not recorded this chain payment. Contact the seller for a direct refund to the original payer.');
     if (!o.paid_at) return fail(409, "This order is not paid; there is no payment to refund");
-    if (
+    if (o.resource_kind !== 'cart' && (
       !Number.isFinite(days) ||
       days <= 0 ||
       !paidAt ||
       Date.now() > paidAt + days * 86400000
-    )
+    ))
       return fail(
         403,
         "This purchase is outside the seller self-service refund window; contact the seller with your receipt",

package/worker/purchase-store.mjs

@@ -75,6 +75,7 @@ export async function privateRelease(env, kind, id, version) {
 export async function listedRelease(env, origin, kind, id, version) {
   if (await env.DB.prepare("SELECT 1 FROM resource_retirements WHERE resource = ?1").bind(`${shopMode(env)}:${kind}:${id}`).first()) return null;
   const adapter = resourceKind(kind);
+  if (adapter.listed) return adapter.listed(env,id,version,origin);
   const listed = (await adapter.list(env,origin)).find((r)=>r.id===id && r.version===version);
   if (!listed) return null;
   const resource = await privateRelease(env,kind,id,version);

package/worker/selling/runtime.mjs

@@ -1,3 +1,5 @@
+import {pruneOffers} from '../customer-resources.mjs';
+import { customerTools, paidTool } from '../customer-mcp.mjs';
 import { productDescription, entryDescription, discoveryRoutes } from '../parts-purchase-catalogue.mjs';
 import { officeScript } from '../purchase-office-script.mjs';
 import { officeRoutes } from '../purchase-office-routes.mjs';
@@ -27,10 +29,11 @@ import { paidFile } from '../parts-protected.mjs';
 import { priceWords } from '../purchase-pricing.mjs';
 import { purchaseDiscovery } from '../purchase-discovery.mjs';
 import { testPaymentExchange } from '../payment-test-exchange.mjs';
-useSelling({ enabled: true, productDescription, entryDescription, discoveryRoutes, officeScript, officeRoutes, refundOrder, extendOffice, testPaymentExchange, jobsSQL, manualRefundDetails, confirmManualRefund, listOffers, orderFact, resourceOrder, currentPurchaseOrder, purchasePaymentEvent, refundPurchasePayment, purchaseReadiness, purchaseRoutes, recordOrderState, authorizePurchaseTest, expirePurchaseCheckouts, reissuePurchaseClaim, retireResource, reconcileRecordings, machineCapabilities, paidFile, priceWords, purchaseDiscovery });
+useSelling({ enabled: true, customerTools, paidTool, productDescription, entryDescription, discoveryRoutes, officeScript, officeRoutes, refundOrder, extendOffice, testPaymentExchange, jobsSQL, manualRefundDetails, confirmManualRefund, listOffers, orderFact, resourceOrder, currentPurchaseOrder, purchasePaymentEvent, refundPurchasePayment, purchaseReadiness, purchaseRoutes, recordOrderState, authorizePurchaseTest, expirePurchaseCheckouts, reissuePurchaseClaim, retireResource, reconcileRecordings, machineCapabilities, paidFile, priceWords, purchaseDiscovery });
 export default { ...worker,
   async scheduled(controller, env, ctx) {
     await worker.scheduled(controller, env, ctx);
+    if(env.DB)await pruneOffers(env);
     if (!env.PURCHASE_MACHINE_PAYMENTS || !env.DB) return;
     const { refreshMachineCapabilities } = await import('../payment-capabilities.mjs');
     const errors = [];

package/worker/service-run.mjs

@@ -0,0 +1,25 @@
+/** A running service is never executed again, even if its Worker disappears.
+ * Heartbeats follow active work; an abandoned run goes to refund recovery. */
+export async function serviceResult(env,id,handler,refund,{now=Date.now,leaseMs=60000}={}) {
+  await env.DB.prepare(`INSERT OR IGNORE INTO service_results(order_id,state,due) VALUES(?1,'pending',0)`).bind(id).run();
+  const lease=crypto.randomUUID();
+  const claimed=await env.DB.prepare(`UPDATE service_results SET state='running',lease=?2,due=?3 WHERE order_id=?1 AND state='pending'`).bind(id,lease,now()+leaseMs).run();
+  const fail=async()=>env.DB.prepare(`UPDATE service_results SET state='refund-pending' WHERE order_id=?1 AND state='running'`).bind(id).run();
+  if(claimed.meta.changes) {
+    let renewal=Promise.resolve();
+    const timer=setInterval(()=>{renewal=renewal.then(()=>env.DB.prepare(`UPDATE service_results SET due=?3 WHERE order_id=?1 AND lease=?2 AND state='running'`).bind(id,lease,now()+leaseMs).run()).catch(()=>{});},leaseMs/3);
+    try {
+      const value=await handler();
+      await env.DB.prepare(`UPDATE service_results SET state='complete',result=?3 WHERE order_id=?1 AND lease=?2 AND state='running'`).bind(id,lease,JSON.stringify(value??null)).run();
+    } catch {await fail();}
+    finally{clearInterval(timer);await renewal;}
+  }
+  let saved=await env.DB.prepare('SELECT state,result,due FROM service_results WHERE order_id=?1').bind(id).first();
+  if(saved.state==='running' && saved.due<=now()){await fail();saved.state='refund-pending';}
+  if(saved.state==='refund-pending') {
+    let outcome;try{outcome=await refund();}catch{outcome={ok:false};}
+    if(outcome.ok && !outcome.pending){await env.DB.prepare(`UPDATE service_results SET state='refunded',result=?2 WHERE order_id=?1 AND state='refund-pending'`).bind(id,JSON.stringify({message:'The tool failed. Your payment was automatically refunded.'})).run();}
+    saved=await env.DB.prepare('SELECT state,result,due FROM service_results WHERE order_id=?1').bind(id).first();
+  }
+  return {order:id,state:saved.state,...(saved.state==='complete'?{data:JSON.parse(saved.result)}:saved.state==='refunded'?JSON.parse(saved.result):saved.state==='refund-pending'?{message:'The tool failed. An automatic refund is pending; retry this same claim to check it. The tool will not run again.'}:{retry:'Retry this same claim; the service is running.'})};
+}

package/worker/service-terms.mjs

@@ -0,0 +1,2 @@
+/** Shared immutable terms for priced tools and their Stripe Payment Links. */
+export const serviceTerms = (price) => ({billing:'one-time',scope:'service',updates:'none',source:false,commercialUse:true,transferable:false,onRefund:'terminate',onExpiry:'terminate',refund:'Ask the studio for a refund.',...price});

package/worker/shop-rules.mjs

@@ -128,14 +128,15 @@ export function checkShop(raw, { games = null, audience = 'general', studioName
   const requestBytes = optionalNumber(raw.requestBytes, 'requestBytes');
   const refundDays = optionalNumber(raw.refundDays, 'refundDays');
   const cap = optionalNumber(raw.capPerPlayerMonth, 'capPerPlayerMonth');
-  // 600 new buyers per hour allows a school or venue to arrive together without disabling flood protection.
-  const guestBuyersPerAddressPerHour = numeric(raw.guestBuyersPerAddressPerHour ?? 600);
-  if (!Number.isSafeInteger(guestBuyersPerAddressPerHour) || guestBuyersPerAddressPerHour < 1) err('guestBuyersPerAddressPerHour', 'use a positive whole number for new guest flood protection');
-  const purchaseAttemptsPerMinute = numeric(raw.purchaseAttemptsPerMinute ?? 6);
-  // A school or venue can share an address; its aggregate bucket must allow many independent accounts.
-  const purchaseAttemptsPerAddressPerMinute = numeric(raw.purchaseAttemptsPerAddressPerMinute ?? 600);
-  if (!Number.isSafeInteger(purchaseAttemptsPerAddressPerMinute) || purchaseAttemptsPerAddressPerMinute < 1) err('purchaseAttemptsPerAddressPerMinute', 'use a positive whole number for address flood protection');
-  if (!Number.isSafeInteger(purchaseAttemptsPerMinute) || purchaseAttemptsPerMinute < 1) err('purchaseAttemptsPerMinute', 'use a positive whole number for the studio account rate limit');
+  const ratePolicy = key => {
+    if(raw[key] === undefined || raw[key] === null)return null;
+    const value=numeric(raw[key]);
+    if(!Number.isSafeInteger(value)||value<1)err(key,'use a positive whole number, or omit the rate policy');
+    return value;
+  };
+  const guestBuyersPerAddressPerHour = ratePolicy('guestBuyersPerAddressPerHour');
+  const purchaseAttemptsPerMinute = ratePolicy('purchaseAttemptsPerMinute');
+  const purchaseAttemptsPerAddressPerMinute = ratePolicy('purchaseAttemptsPerAddressPerMinute');
 
   for (const key of ['automaticTax', 'referralNewPlayersOnly']) if (raw[key] !== undefined && typeof raw[key] !== 'boolean') err(key, 'use a boolean');
   const items = [];

package/worker/shop.mjs

@@ -556,8 +556,8 @@ const WAY_WORDS = Object.freeze({
 });
 
 function purchaseLimited(request, shop, player, kind) {
-  const account = player && limited(`${kind}:account:${player}`, shop.purchaseAttemptsPerMinute, 60_000);
-  const address = limited(`${kind}:address:${addressOf(request)}`, shop.purchaseAttemptsPerAddressPerMinute, 60_000);
+  const account = player && shop.purchaseAttemptsPerMinute !== null && limited(`${kind}:account:${player}`, shop.purchaseAttemptsPerMinute, 60_000);
+  const address = shop.purchaseAttemptsPerAddressPerMinute !== null && limited(`${kind}:address:${addressOf(request)}`, shop.purchaseAttemptsPerAddressPerMinute, 60_000);
   return account || address;
 }
 
@@ -707,6 +707,18 @@ function refundableNow(order, owns, shop, now = Date.now()) {
   return shop.policy.refundUsedItems || !owns.some((o) => o.item === order.item && o.used);
 }
 
+/** Shared authorization for web and claim refunds, using persisted grants and line snapshots. */
+export async function refundableShopOrder(env, order, shop, lines = null) {
+  if (!order || !shop) return false;
+  lines ??= await orderLines(env, order.id);
+  if (!lines.length) return false;
+  for (const line of lines) {
+    const used = await lineWasUsed(env, order.id, line);
+    if (!refundableNow({ ...lineView(line), paidAt: order.paid_at }, used ? [{ item: line.item, used: true }] : [], shop)) return false;
+  }
+  return true;
+}
+
 /** A player's own refund follows the studio window and used-item setting, excluding tips. */
 async function selfRefundRoute(request, env, shop, ready) {
   const b = await bodyOf(request, requestSize(shop));
@@ -717,10 +729,7 @@ async function selfRefundRoute(request, env, shop, ready) {
   if (!o || o.player !== p.id) return fail(404, 'order', 'no such order on this account');
   const lines = (await orderLines(env, o.id)).filter((l) => !b.body.line || l.id === b.body.line);
   if (!lines.length) return fail(404, 'line', 'no such line on this order');
-  for (const line of lines) {
-    const used = await lineWasUsed(env, o.id, line);
-    if (!refundableNow({ ...lineView(line), paidAt: o.paid_at }, used ? [{ item: line.item, used: true }] : [], shop)) return fail(403, 'not-refundable', 'Ask the studio for this refund. Tips are not refundable by the player; items follow the studio refund settings.');
-  }
+  if (!await refundableShopOrder(env, o, shop, lines)) return fail(403, 'not-refundable', 'Ask the studio for this refund. Tips are not refundable by the player; items follow the studio refund settings.');
   if (Number(o.amount) !== 0 && !hasStripeKey(env)) return fail(409, 'ask-studio', 'Ask the studio to refund this payment in Stripe.');
   const r = await refundOrder(env, o, { reason: 'requested_by_customer', by: 'player', line: b.body.line });
   if (r.held) return json({ ...r, error: r.error === 'pending' ? 'pending' : 'held', message: r.error === 'pending' ? r.message : 'The studio approves this refund in Stripe first. Your money comes back once they do, and the item leaves your account then.' }, 202);
@@ -743,7 +752,11 @@ async function hook(request, env, cat, shop, ready) {
   if (selling.enabled) {
     if (typeof ev.livemode === 'boolean' && ev.livemode !== (shopMode(env) === 'live')) return json({ ok: true, ignored: 'mode' });
     const purchase = await selling.purchasePaymentEvent(env, ev);
-    if (purchase !== null) { await env.DB.prepare('INSERT INTO shop_events (id, type, at) VALUES (?1, ?2, ?3) ON CONFLICT(id) DO NOTHING').bind(ev.id, ev.type, Date.now()).run(); return json({ ok: true, did: purchase }); }
+    if (purchase !== null) {
+      // Resource carts share the web shop's grants and refund bookkeeping.
+      const payment = typeof obj.payment_intent === 'string' ? obj.payment_intent : obj.payment_intent?.id;
+      if (payment) await syncRefunds(env, payment);
+      await env.DB.prepare('INSERT INTO shop_events (id, type, at) VALUES (?1, ?2, ?3) ON CONFLICT(id) DO NOTHING').bind(ev.id, ev.type, Date.now()).run(); return json({ ok: true, did: purchase }); }
   }
   if (!needed.includes(ev.type)) return json({ ok: true, did: 'ignored' });
   if (typeof ev.livemode === 'boolean' && (hasStripeKey(env) || linkConfig(env)) && ev.livemode !== (shopMode(env) === 'live')) return json({ ok: true, ignored: 'mode' });
@@ -864,7 +877,7 @@ async function bindLinkSession(env, session, mode) {
 }
 
 /** A paid checkout: the order is paid, its entitlements granted, a referral line written. Idempotent. */
-async function paid(env, shop, session, paidAt = Date.now()) {
+export async function paid(env, shop, session, paidAt = Date.now()) {
   const o = await orderBySession(env, session.id);
   if (!o) return 'unknown-order';
   // The session must be the one this order opened, for this player and this price.
@@ -950,7 +963,7 @@ async function paid(env, shop, session, paidAt = Date.now()) {
  * https://docs.stripe.com/api/refunds/object#refund_object-status
  * https://docs.stripe.com/api/refunds/list
  */
-async function syncRefunds(env, payment, freeOrder = null, freeLines = []) {
+export async function syncRefunds(env, payment, freeOrder = null, freeLines = []) {
   const o = freeOrder ?? await orderByPayment(env, payment);
   if (!o) return 'unknown-order';
   const all = await orderLines(env, o.id);

package/worker/tool-webhook.mjs

@@ -6,6 +6,7 @@ export async function toolWebhook(request,env,{cat,definitions}) {
   const name=new URL(request.url).pathname.split('/').pop(),tool=definitions.find(t=>t.name===name&&t.webhook);
   const fail=(status)=>Response.json({ok:false},{status});
   if(!tool||request.method!=='POST')return fail(404);
+  if(tool.price)return Response.json({ok:false,error:'Use /mcp to approve and pay for this tool'},{status:402});
   const timestamp=request.headers.get('x-studio-timestamp')??'',delivery=request.headers.get('x-studio-delivery')??'',signature=request.headers.get('x-studio-signature')??'';
   if(!/^\d{10}$/.test(timestamp)||Math.abs(Date.now()/1000-Number(timestamp))>300||!/^[a-zA-Z0-9_-]{8,100}$/.test(delivery)||!/^[a-f0-9]{64}$/.test(signature))return fail(401);
   const secret=env[tool.webhook.secret];if(typeof secret!=='string'||secret.length<32)return fail(503);

package/worker/version.mjs

@@ -1,2 +1,2 @@
 /** The @homie-rocks/studio version this Worker code is (package.json's; a test keeps them equal). Cache-busts /_homie/site.js. */
-export const STUDIO_VERSION_TAG = '0.40.0';
+export const STUDIO_VERSION_TAG = '0.43.0';