@homie-rocks/studio 0.50.7 → 0.51.0

package/lib/dev-stripe-sandbox.mjs

@@ -0,0 +1,80 @@
+/** Local acceptance adapter. Stripe's CLI retains its credentials and forwards
+ * genuine sandbox events. Never deploy this adapter: the desktop is test-only. */
+import { createServer } from 'node:http';
+import { spawn } from 'node:child_process';
+import { randomBytes } from 'node:crypto';
+import { redactStripe } from '../worker/stripe.mjs';
+import { stripeProcess } from './stripe-connect.mjs';
+export async function startStripeSandbox({ origin, profile }) {
+  const target = new URL(origin);
+  if (target.protocol !== 'http:' || !['127.0.0.1','localhost'].includes(target.hostname)) throw new Error('Sandbox acceptance requires loopback');
+  if (!profile || typeof profile !== 'string') throw new Error('An explicit Stripe sandbox profile is required');
+  const call = async (method,path,params=new URLSearchParams(),idempotency) => {
+    const args=['--project-name',profile,method.toLowerCase(),path,'--stripe-version','2025-03-31.basil'];
+    if(method.toUpperCase()==='DELETE')args.push('--confirm');
+    for(const [k,v] of params)args.push('-d',`${k}=${v}`);
+    if(idempotency)args.push('--idempotency',idempotency);
+    const r=await stripeProcess(args);let body;try{body=JSON.parse(r.stdout);}catch{}
+    if(r.code!==0 || body?.error || !body) throw new Error('Stripe sandbox request failed: '+redactStripe(body?.error?.message ?? r.stderr ?? 'no response').slice(0,600));
+    return body;
+  };
+  // A mode-bearing object verifies test context without reading any credential.
+  const probe=await call('GET','/v1/prices',new URLSearchParams({limit:'1'}));
+  if(probe.data?.some(p=>p.livemode))throw new Error('Sandbox adapter refuses live data');
+  const key=`rk_test_${randomBytes(24).toString('hex')}`;
+  const server=createServer(async(req,res)=>{
+    const send=(value,status=200)=>{res.writeHead(status,{'content-type':'application/json'});res.end(JSON.stringify(value));};
+    if(req.headers.authorization!==`Bearer ${key}`)return send({error:{message:'Unauthorized sandbox adapter'}},401);
+    try{
+      const url=new URL(req.url,'http://127.0.0.1');
+      if(!url.pathname.startsWith('/v1/')||!['GET','POST','DELETE'].includes(req.method))return send({},404);
+      let body='';for await(const chunk of req){body+=chunk;if(body.length>262144)return send({},413);}
+      const data=await call(req.method,url.pathname,req.method==='GET'?url.searchParams:new URLSearchParams(body),req.headers['idempotency-key']);
+      if(data.livemode===true)throw new Error('Live object refused');
+      send(data);
+    }catch{send({error:{message:'Stripe sandbox adapter request failed'}},502);}
+  });
+  await new Promise(r=>server.listen(0,'127.0.0.1',r));
+  const childEnv={...process.env};for(const k of Object.keys(childEnv))if(k.startsWith('STRIPE_'))delete childEnv[k];
+  const listener=spawn('stripe',['--project-name',profile,'listen','--events','payment_link.updated,checkout.session.completed,checkout.session.expired,invoice.paid,invoice.payment_failed,customer.subscription.updated,customer.subscription.deleted,charge.refunded,refund.created,refund.updated','--forward-to',`${target.origin}/api/shop/hook`],{env:childEnv,stdio:['ignore','pipe','pipe']});
+  const close=async()=>{listener.kill();await new Promise(r=>server.close(r));};
+  try {
+    const secret=await new Promise((resolve,reject)=>{
+      let buffer='';const timer=setTimeout(()=>reject(new Error('Stripe listener did not become ready')),30000);
+      const collect=b=>{buffer=(buffer+b).slice(-16000);const match=/whsec_[A-Za-z0-9]+/.exec(buffer);if(match){clearTimeout(timer);resolve(match[0]);}};
+      listener.stdout.on('data',collect);listener.stderr.on('data',collect);
+      listener.on('error',()=>{clearTimeout(timer);reject(new Error('Stripe listener failed'));});
+      listener.on('exit',()=>{clearTimeout(timer);reject(new Error('Stripe listener exited: '+redactStripe(buffer).slice(-1200)));});
+    });
+    return {bindings:{STRIPE_CHECKOUT_MODE: 'sessions', STRIPE_KEY:key,STRIPE_WEBHOOK_SECRET:secret,STRIPE_API_BASE:`http://127.0.0.1:${server.address().port}`},call,close};
+  }catch(e){await close();throw e;}
+}
+
+/** Local keyless acceptance: only links and the listener's signing secret reach
+ * the Worker. Object sync uses the approved CLI directly, never an API adapter. */
+export async function startKeylessStripeSandbox({origin,profile,shop,bookingSlots=[],name='keyless-dev'}) {
+  const {syncPaymentLinks}=await import('./shop-links.mjs');
+  const {checkShop}=await import('../worker/shop-rules.mjs');
+  const {formEncode}=await import('../worker/stripe.mjs');
+  const checked=checkShop(shop);
+  if(!checked.ok)throw new Error('Check shop.json before sandbox setup');
+  const sandbox=await startStripeSandbox({origin,profile});
+  let links,endpoint;
+  const api=(method,path,params={},idempotency)=>sandbox.call(method,path,formEncode(params),idempotency);
+  const synchronize=async bookingSlots=>{
+    const result=await syncPaymentLinks({api,shop:checked.shop,slug:name,site:`https://${name}.example.com`,mode:'test',bookingSlots,
+      w:async(args,opts)=>{if(args[1]==='list')return{code:0,stdout:'[]'};if(args[1]==='bulk')links=JSON.parse(opts.input).STRIPE_SHOP_LINKS;return{code:0};},saveReceipt:r=>{endpoint=r.endpoint??endpoint;}});
+    if(!result.ok)throw Error('Sandbox Payment Link sync failed');
+    // The placeholder endpoint points at an unreachable example address; signed
+    // events reach the loopback studio through `stripe listen`. Remove it so
+    // repeated syncs never accumulate toward Stripe's per-account endpoint limit.
+    if(endpoint){await api('DELETE',`/v1/webhook_endpoints/${endpoint}`);endpoint=undefined;}
+    return {links:JSON.parse(links),bindings:{STRIPE_CHECKOUT_MODE:'links',STRIPE_SHOP_LINKS:'base64:'+Buffer.from(links).toString('base64'),STRIPE_WEBHOOK_SECRET:sandbox.bindings.STRIPE_WEBHOOK_SECRET}};
+  };
+  try {
+    const client={...await synchronize(bookingSlots),call:api,
+      sync:async slots=>{Object.assign(client,await synchronize(slots));return client;},
+      close:async()=>{try{const config=JSON.parse(links);for(const link of [...config.items,...config.menus,...config.slots])await api('POST',`/v1/payment_links/${link.id}`,{active:false});}finally{await sandbox.close();}}};
+    return client;
+  }catch(e){await sandbox.close();throw e;}
+}

package/lib/mcp-tools.mjs

@@ -20,7 +20,7 @@ import { providerKey } from './provider-key.mjs';
 import { prepareNode } from './prepare.mjs';
 import { studioDomain } from './domain.mjs';
 import { spawnSync } from 'node:child_process';
-import { copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync } from 'node:fs';
+import { copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { renderCodex, newCodex } from './codex.mjs';
@@ -1177,6 +1177,20 @@ export function toolDefs(ctx, avail = {}) {
         return startRun(ctx, root, { kind: 'deploy', game: null, title: `${studio.name}: online`, steps: [{ label: 'deploy', args: ['deploy', ...(a.ownRoute === true ? ['--own-route'] : [])] }] });
       },
     },
+    {
+      name:'stripe_bookings_sync', title:'Sync published booking slots to Stripe',
+      description:'Owner AI: after reading published slot records, supply the complete slot manifest. Creates/updates Stripe Payment Links with completed-session capacity limits through the approved CLI profile. Before moving a booking, sync target active:false to deactivate and expire open sessions. After the versioned staff move, sync current confirmed counts for affected slots to restore the remaining budget. Removed slots deactivate and expire open sessions. No Worker API key. Follow studio_job. Never increase capacity merely to reopen a full slot.',
+      inputSchema:{type:'object',properties:{...STUDIO_ARG,slots:{type:'array',items:{type:'object',properties:{app:{type:'string'},collection:{type:'string'},slots:{type:'string'},slot:{type:'string'},item:{type:'string'},capacity:{type:'integer',minimum:0},confirmed:{type:'integer',minimum:0},active:{type:'boolean'}},required:['app','collection','slots','slot','item','capacity'],additionalProperties:false}},live:{type:'boolean'}},required:['slots']},
+      annotations:{readOnlyHint:false,destructiveHint:false,openWorldHint:true},
+      run:async a=>{
+        const root=ctx.root(a.studio);
+        mkdirSync(join(root,'.studio'),{recursive:true});
+        writeFileSync(join(root,'.studio','booking-slots.json'),JSON.stringify(a.slots,null,2));
+        const job=cliJob(root,'Sync Stripe booking links',['shop','connect',...(a.live?['--live']:[])],{cli:join(PACKAGE_ROOT,'bin','homie-studio.mjs'),keep:false});
+        await waitJob(job,Math.min(ctx.waitMs,1000));
+        return ok('Booking link sync started. Check studio_job for completion.',{kind:'job',...jobView(job)});
+      },
+    },
     {
       name: 'stripe_login', title: 'Connect the studio to Stripe',
       description: 'Connect and sync shop.json through Stripe’s official CLI with one browser approval if needed. Creates Products, Prices, Payment Links and the webhook; installs only links and signing secret, no API key in the Worker. Repeat after edits. Follow studio_job. An existing key supports fuller checkout; manual only if explicitly chosen for those features. live only when the owner says go live.',

package/lib/scaffold.mjs

@@ -1,4 +1,6 @@
 import {TOOL_DATABASE_MIGRATION,TOOL_DATABASE_MIGRATION_FILE} from '../worker/tool-database.mjs';
+import { SUBSCRIPTIONS_MIGRATION, SUBSCRIPTIONS_MIGRATION_FILE } from '../worker/shop-subscriptions.mjs';
+import { BOOKINGS_MIGRATION, BOOKINGS_MIGRATION_FILE } from '../worker/booking-store.mjs';
 import { FUNCTIONS_RUNS_MIGRATION, FUNCTIONS_RUNS_MIGRATION_FILE, FUNCTIONS_REFERENCE_MIGRATION, FUNCTIONS_REFERENCE_MIGRATION_FILE, FUNCTIONS_META_MIGRATION, FUNCTIONS_META_MIGRATION_FILE, FUNCTIONS_MIGRATION, FUNCTIONS_MIGRATION_FILE, FUNCTIONS_CURSOR_MIGRATION, FUNCTIONS_CURSOR_MIGRATION_FILE } from '../worker/functions-schema.mjs';
 import { MCP_MIGRATION, MCP_MIGRATION_FILE } from '../worker/mcp-store.mjs';
 import { APPS_MIGRATION, APPS_MIGRATION_FILE } from '../worker/app-records.mjs';
@@ -822,6 +824,8 @@ export { default, Table, Lobby, Gate, Concentrator } from '@homie-rocks/studio/w
     [`site/migrations/${SHOP_REMOVE_REFERRALS_FILE}`]: SHOP_REMOVE_REFERRALS,
     [`site/migrations/${APPS_MIGRATION_FILE}`]: APPS_MIGRATION,
     [`site/migrations/${TOOL_DATABASE_MIGRATION_FILE}`]: TOOL_DATABASE_MIGRATION,
+    [`site/migrations/${BOOKINGS_MIGRATION_FILE}`]: BOOKINGS_MIGRATION,
+    [`site/migrations/${SUBSCRIPTIONS_MIGRATION_FILE}`]: SUBSCRIPTIONS_MIGRATION,
     [`site/migrations/${MCP_MIGRATION_FILE}`]: MCP_MIGRATION,
     [`site/migrations/${FUNCTIONS_MIGRATION_FILE}`]: FUNCTIONS_MIGRATION,
     [`site/migrations/${FUNCTIONS_CURSOR_MIGRATION_FILE}`]: FUNCTIONS_CURSOR_MIGRATION,
@@ -999,6 +1003,16 @@ function ensurePartsStateMigration(root) {
   return `site/migrations/${PURCHASE_STATE_FILE}`;
 }
 
+function ensureSubscriptions(root) {
+  const file=join(root,'site','migrations',SUBSCRIPTIONS_MIGRATION_FILE);
+  if(existsSync(file))return null;
+  mkdirSync(dirname(file),{recursive:true});writeFileSync(file,SUBSCRIPTIONS_MIGRATION);return `site/migrations/${SUBSCRIPTIONS_MIGRATION_FILE}`;
+}
+function ensureBookings(root) {
+  const file=join(root,'site','migrations',BOOKINGS_MIGRATION_FILE);
+  if(existsSync(file))return null;
+  mkdirSync(dirname(file),{recursive:true});writeFileSync(file,BOOKINGS_MIGRATION);return `site/migrations/${BOOKINGS_MIGRATION_FILE}`;
+}
 function ensureFunctionRuns(root) {
   const file=join(root,'site','migrations',FUNCTIONS_RUNS_MIGRATION_FILE);
   if(existsSync(file))return null;
@@ -1035,7 +1049,7 @@ function ensureToolDatabase(root) {
   mkdirSync(dirname(file),{recursive:true});writeFileSync(file,TOOL_DATABASE_MIGRATION);return `site/migrations/${TOOL_DATABASE_MIGRATION_FILE}`;
 }
 export function ensureMigrations(root) {
-  return [ensureStatsMigration(root), ensurePlayersMigration(root), ensureOfficeMigration(root), ensureServersMigration(root), ensureChatMigration(root), ensureShopMigration(root), ensureLoungeMigration(root), ensureShopReservations(root), ensureShopLines(root), ensureAppsMigration(root), ensurePartsMigration(root), ensurePartsStateMigration(root), ensureMcpMigration(root), ensureFunctionsMigration(root), ensureFunctionCursors(root), ensureFunctionMeta(root), ensureFunctionReference(root), ensureShopRemoveReferrals(root), ensureFunctionRuns(root), ensureToolDatabase(root)].filter(Boolean);
+  return [ensureStatsMigration(root), ensurePlayersMigration(root), ensureOfficeMigration(root), ensureServersMigration(root), ensureChatMigration(root), ensureShopMigration(root), ensureLoungeMigration(root), ensureShopReservations(root), ensureShopLines(root), ensureAppsMigration(root), ensurePartsMigration(root), ensurePartsStateMigration(root), ensureMcpMigration(root), ensureFunctionsMigration(root), ensureFunctionCursors(root), ensureFunctionMeta(root), ensureFunctionReference(root), ensureShopRemoveReferrals(root), ensureFunctionRuns(root), ensureToolDatabase(root), ensureBookings(root), ensureSubscriptions(root)].filter(Boolean);
 }
 
 /** What a migration file the template added is for, in a few words (deploy and dev say it). */

package/lib/shop-links.mjs

@@ -6,7 +6,7 @@ import { LINKS_STRIPE_VERSION, linkSettings, paymentLinkURL } from '../worker/sh
 import { HOOK_EVENTS, SHOP_HOOK_EVENTS } from './shop.mjs';
 const hash = (value) => createHash('sha256').update(JSON.stringify(value)).digest('hex');
 const same = (a, b) => Object.keys(a ?? {}).length === Object.keys(b).length && Object.entries(b).every(([k, v]) => a?.[k] === v);
-export async function syncPaymentLinks({ root, api, shop, slug, site, mode, w, receipt, saveReceipt }) {
+export async function syncPaymentLinks({ root, api, shop, slug, site, mode, w, receipt, saveReceipt, bookingSlots = [] }) {
   const list = async (path, params = {}) => {
     const all = []; let cursor;
     do {
@@ -28,15 +28,17 @@ export async function syncPaymentLinks({ root, api, shop, slug, site, mode, w, r
   const links = await list('/v1/payment_links');
   const own = (o) => o.metadata?.homie === 'shop-links-v1' && o.metadata?.studio === slug && o.metadata?.origin === site;
   const config = { v: 1, mode, settings: linkSettings(shop), items: [] };
+  const customText=shop.giving?.receiptText ? {custom_text:{submit:{message:shop.giving.receiptText}}} : {};
+  const catalogPrices = new Map();
   const keepPrices = new Set(), keepLinks = new Set(), keepProducts = new Set();
   for (const item of shop.items) {
     const id = await productIdOf(slug, item.id);
     keepProducts.add(id);
     const metadata = { homie: 'shop-links-v1', studio: slug, origin: site };
-    const fields = { name: item.name, description: item.blurb ?? '', tax_code: item.taxCode ?? defaultTaxCode(item), metadata, active: true };
+    const fields = { name: item.name, ...(item.blurb ? {description:item.blurb} : {}), tax_code: item.taxCode ?? defaultTaxCode(item), metadata, active: true };
     let product = products.find((p) => p.id === id);
     if (!product) product = await api('POST', '/v1/products', { id, ...fields }, `product-${hash(id)}`);
-    else if (!same(product.metadata, metadata) || product.name !== fields.name || (product.description ?? '') !== fields.description || (product.tax_code?.id ?? product.tax_code) !== fields.tax_code || !product.active) await api('POST', `/v1/products/${id}`, fields);
+    else if (!same(product.metadata, metadata) || product.name !== fields.name || (product.description ?? '') !== (fields.description ?? '') || (product.tax_code?.id ?? product.tax_code) !== fields.tax_code || !product.active) await api('POST', `/v1/products/${id}`, fields);
     // Omit an unset minimum: Stripe applies its settlement-currency floor itself.
     // https://docs.stripe.com/api/prices/create#create_price-custom_unit_amount-minimum
     const priceFields = { product: id, currency: shop.currency, ...(item.interval ? { recurring: { interval: item.interval } } : {}), tax_behavior: 'exclusive', ...(item.price === 'choose'
@@ -47,9 +49,10 @@ export async function syncPaymentLinks({ root, api, shop, slug, site, mode, w, r
     if (!price) price = await api('POST', '/v1/prices', { ...priceFields, metadata: { ...metadata, revision } }, `price-${hash({ priceFields, metadata })}`);
     if (!price.active) await api('POST', `/v1/prices/${price.id}`, { active: true });
     keepPrices.add(price.id);
+    catalogPrices.set(item.id, price.id);
     if ((product.default_price?.id ?? product.default_price) !== price.id) await api('POST', `/v1/products/${id}`, { default_price: price.id });
     if (item.price === 0) continue; // Free orders never leave the studio.
-    const params = { line_items: [{ price: price.id, quantity: 1, ...(item.price !== 'choose' ? { adjustable_quantity: { enabled: shop.policy.repeatPurchases, minimum: 1, maximum: 999999 } } : {}) }],
+    const params = { ...customText, line_items: [{ price: price.id, quantity: 1, ...(item.price !== 'choose' ? { adjustable_quantity: { enabled: shop.policy.repeatPurchases, minimum: 1, maximum: 999999 } } : {}) }],
       after_completion: { type: 'redirect', redirect: { url: `${site}/shop/thanks?session_id={CHECKOUT_SESSION_ID}` } },
       ...(shop.till === 'stripe-managed' ? { managed_payments: { enabled: true } } : { automatic_tax: { enabled: shop.automaticTax } }),
       ...(item.interval ? { subscription_data: { metadata } } : { payment_intent_data: { metadata } }),
@@ -60,7 +63,76 @@ export async function syncPaymentLinks({ root, api, shop, slug, site, mode, w, r
     if (!link.active) await api('POST', `/v1/payment_links/${link.id}`, { active: true });
     if (!paymentLinkURL(link.url) || !/^plink_\w+$/.test(link.id)) throw new Error('Invalid Payment Link');
     keepLinks.add(link.id);
-    config.items.push({ item: item.id, id: link.id, url: link.url, revision: linkRevision });
+    config.items.push({ item: item.id, id: link.id, url: link.url, price: price.id, revision: linkRevision });
+  }
+  // Menus use paid invoice snapshots: Checkout events omit their line items.
+  // Stripe allows 20 Payment Link lines; invoice snapshots include only the first
+  // 10. Split catalogues so keyless fulfillment needs no authenticated pagination.
+  config.menus = [];
+  const menuItems = shop.items.filter(i => typeof i.price === 'number' && i.price > 0 && !i.interval);
+  const metadata = { homie: 'shop-links-v1', studio: slug, origin: site };
+  const groups=Map.groupBy(menuItems,i=>i.game??'');
+  for(const group of groups.values()) for (let offset = 0; offset < group.length; offset += 10) {
+    const items = group.slice(offset, offset + 10);
+    if (items.length < 2) continue;
+    const params = { ...customText, line_items: items.map(i => ({price:catalogPrices.get(i.id),quantity:1,adjustable_quantity:{enabled:true,minimum:0,maximum:shop.policy.repeatPurchases?999999:1}})),
+      invoice_creation:{enabled:true,invoice_data:{metadata}},
+      after_completion:{type:'redirect',redirect:{url:`${site}/shop/thanks?session_id={CHECKOUT_SESSION_ID}`}},
+      automatic_tax:{enabled:shop.automaticTax}, payment_intent_data:{metadata} };
+    const revision=hash(params);
+    let link=links.find(p=>own(p)&&p.metadata?.revision===revision);
+    if(!link)link=await api('POST','/v1/payment_links',{...params,metadata:{...metadata,revision}},`menu-${revision}`);
+    if(!link.active)await api('POST',`/v1/payment_links/${link.id}`,{active:true});
+    keepLinks.add(link.id);
+    config.menus.push({id:link.id,url:link.url,revision,items:items.map(i=>({item:i.id,price:catalogPrices.get(i.id)}))});
+  }
+  config.slots=[];
+  const pause=async link=>{
+    await api('POST',`/v1/payment_links/${link.id}`,{active:false});
+    for(const session of await list('/v1/checkout/sessions',{payment_link:link.id,status:'open'})) {
+      await api('POST',`/v1/checkout/sessions/${session.id}/expire`);
+    }
+  };
+  const slotKeys=new Set();
+  for(const slot of bookingSlots) {
+    if(!['app','collection','slots','slot','item'].every(k=>typeof slot[k]==='string'&&/^[a-zA-Z0-9_-]{1,64}$/.test(slot[k])) || !Number.isSafeInteger(slot.capacity) || slot.capacity<0 || slot.confirmed!==undefined && (!Number.isSafeInteger(slot.confirmed)||slot.confirmed<0||slot.confirmed>slot.capacity))throw new Error('Invalid booking slot manifest');
+    const resource=JSON.stringify([slot.app,slot.slots,slot.slot]);
+    if(slotKeys.has(resource))throw new Error('Publish only one service Payment Link per capacity slot');
+    slotKeys.add(resource);
+    const item=shop.items.find(i=>i.id===slot.item);
+    if(!item || item.interval || item.price==='choose')throw new Error('Bookings require a fixed one-time service price');
+    if(!item.price)continue;
+    const identity=hash({slug,site,app:slot.app,collection:slot.collection,slots:slot.slots,slot:slot.slot});
+    let link=links.find(p=>own(p)&&p.metadata?.slot===identity);
+    if(!link && (!slot.capacity||slot.active===false))continue;
+    if(link?.metadata?.price && link.metadata.price!==catalogPrices.get(item.id))throw new Error('Slot service price changed. Deactivate the old slot and publish a new slot ID after reviewing existing bookings.');
+    if(slot.confirmed!==undefined && link?.active && slot.active!==false)throw new Error('Pause affected slot links before recounting confirmed seats; wait for signed payments, move/refund, then sync the fresh counts.');
+    const count=link?.restrictions?.completed_sessions?.count??0;
+    // Initial publication uses capacity exactly. After a reviewed move/refund the
+    // AI supplies current confirmed seats; keep the existing Stripe lifetime count.
+    const limit=slot.confirmed===undefined ? slot.capacity : count+slot.capacity-slot.confirmed;
+    const active=slot.active!==false && limit>count;
+    const params={...customText,line_items:[{price:catalogPrices.get(item.id),quantity:1}],payment_method_types:['card'],
+      restrictions:{completed_sessions:{limit:Math.max(1,limit)}},after_completion:{type:'redirect',redirect:{url:`${site}/shop/thanks?session_id={CHECKOUT_SESSION_ID}`}}};
+    if(!link)link=await api('POST','/v1/payment_links',{...params,metadata:{...metadata,slot:identity,revision:identity,price:catalogPrices.get(item.id)}},`slot-${identity}`);
+    else {
+      // Pause first whenever publishing a changed budget, so old sessions cannot
+      // spend a previous capacity after staff moves or removes a slot.
+      if(!active || link.restrictions?.completed_sessions?.limit!==limit)await pause(link);
+      link=await api('POST',`/v1/payment_links/${link.id}`,{restrictions:params.restrictions,active});
+    }
+    keepLinks.add(link.id);
+    config.slots.push({...slot,id:link.id,url:link.url,price:catalogPrices.get(item.id),revision:identity,active:link.active,count:link.restrictions?.completed_sessions?.count??0,limit,paused:slot.active===false});
+  }
+  // Retired booking links must be closed before publishing a configuration which
+  // no longer names them; staff can then move into that local-only slot safely.
+  for(const link of links.filter(p=>own(p)&&p.metadata?.slot&&!keepLinks.has(p.id)))await pause(link);
+  if(shop.items.some(i=>i.interval)) {
+    const portals=await list('/v1/billing_portal/configurations');
+    let portal=portals.find(p=>own(p));
+    const params={features:{subscription_cancel:{enabled:true},payment_method_update:{enabled:true},invoice_history:{enabled:true}},login_page:{enabled:true},business_profile:{headline:'Manage your membership or giving'},default_return_url:`${site}/shop/`,metadata};
+    portal=await api('POST',portal?`/v1/billing_portal/configurations/${portal.id}`:'/v1/billing_portal/configurations',params);
+    config.portal=portal.login_page?.url;
   }
   const purchases = root ? await (await import('./purchase-links.mjs')).syncPurchaseLinks({ root, api, slug, site, mode, list, till: shop.purchasesTill ?? shop.till }) : null;
   const purchaseSecrets = {};
@@ -69,7 +141,7 @@ export async function syncPaymentLinks({ root, api, shop, slug, site, mode, w, r
     const pair = await generateKeyPair('Ed25519', { extractable: true });
     purchaseSecrets.PURCHASE_SIGNING_KEYS = JSON.stringify([await exportJWK(pair.privateKey)]);
   }
-  const events = purchases?.config.offers.length ? HOOK_EVENTS : SHOP_HOOK_EVENTS;
+  const events = purchases?.config.offers.length ? [...new Set([...HOOK_EVENTS,...SHOP_HOOK_EVENTS])] : SHOP_HOOK_EVENTS;
   const endpoints = await list('/v1/webhook_endpoints');
   const url = `${site}/api/shop/hook`;
   const current = endpoints.find((e) => e.id === receipt?.endpoint && e.url === url && e.status === 'enabled' && events.every((event) => e.enabled_events?.includes(event)));
@@ -84,7 +156,7 @@ export async function syncPaymentLinks({ root, api, shop, slug, site, mode, w, r
   const fingerprint = hash({config, purchases:purchases?.config});
   const unchanged = current && !secret && receipt?.fingerprint === fingerprint && has('STRIPE_SHOP_LINKS') && !has('STRIPE_KEY');
   if (!unchanged) {
-    const saved = await w(['secret', 'bulk'], { input: JSON.stringify({ STRIPE_SHOP_LINKS: JSON.stringify(config), ...purchaseSecrets, ...(purchases && (purchases.config.offers.length || has('PURCHASE_LINKS')) ? { PURCHASE_LINKS: JSON.stringify(purchases.config) } : {}), ...(secret ? { STRIPE_WEBHOOK_SECRET: secret } : {}) }) });
+    const saved = await w(['secret', 'bulk'], { input: JSON.stringify({ STRIPE_CHECKOUT_MODE: 'links', STRIPE_SHOP_LINKS: JSON.stringify(config), ...purchaseSecrets, ...(purchases && (purchases.config.offers.length || has('PURCHASE_LINKS')) ? { PURCHASE_LINKS: JSON.stringify(purchases.config) } : {}), ...(secret ? { STRIPE_WEBHOOK_SECRET: secret } : {}) }) });
     if (saved.code !== 0) return { ok: false, needs: 'cloudflare', why: 'Cloudflare could not save the shop connection. Run shop connect again; existing webhooks remain active.' };
     // Explicitly running connect selects keyless; manual selects the existing keyed checkout.
     if (has('STRIPE_KEY') && (await w(['secret', 'delete', 'STRIPE_KEY'], { input: 'y\n' })).code !== 0) return { ok: false, needs: 'cloudflare', why: 'The links are ready; run shop connect again to finish removing the old checkout credential.' };

package/lib/shop.mjs

@@ -63,6 +63,7 @@ export const KEY_PERMISSIONS = Object.freeze([
 ]);
 
 export const SHOP_HOOK_EVENTS = Object.freeze([
+  'payment_link.updated', 'invoice.paid', 'invoice.payment_failed', 'customer.subscription.updated', 'customer.subscription.deleted',
   'checkout.session.completed', 'checkout.session.async_payment_succeeded', 'checkout.session.async_payment_failed', 'checkout.session.expired',
   'charge.refunded', 'refund.created', 'refund.updated', 'refund.failed', 'charge.dispute.created', 'charge.dispute.closed',
 ]);
@@ -114,7 +115,7 @@ export function shopInit(root, { supporter = false, giving = false, currency = n
   const shop = {
     ...(giving ? { giving: { receiptText: '' } } : {}),
     till: managed ? 'stripe-managed' : 'stripe', currency: String(currency ?? studio.currency ?? 'usd').toLowerCase(),
-    items: giving ? [1000, 2500, 5000].flatMap(amount => [false, true].map(monthly => ({ id: `gift-${amount}${monthly ? '-monthly' : ''}`, kind: 'donation', name: monthly ? 'Monthly gift' : 'One-time gift', price: amount, ...(monthly ? { interval: 'month' } : {}), gives: [], blurb: monthly ? 'Give this amount each month. Manage your gift through Stripe.' : 'A gift to support our work.' }))) : supporter ? [supporterItem({ price: Number(price) })] : [],
+    items: giving ? [1000, 2000, 2500, 5000].flatMap(amount => [false, true].map(monthly => ({ id: `gift-${amount}${monthly ? '-monthly' : ''}`, kind: 'donation', name: monthly ? 'Monthly gift' : 'One-time gift', price: amount, ...(monthly ? { interval: 'month' } : {}), gives: [], blurb: monthly ? 'Give this amount each month. Manage your gift through Stripe.' : 'A gift to support our work.' }))) : supporter ? [supporterItem({ price: Number(price) })] : [],
   };
   const r = checkShop(shop, { games: listGames(root).map((g) => g.id) });
   if (!r.ok) return { ok: false, command: 'shop init', why: r.errors.map((e) => e.message).join('; ') };
@@ -323,7 +324,8 @@ export async function shopConnectManual(root, { fromClipboard = false, clipboard
             const machineNote = ` Machine payments: ${Object.entries(machine.machine).map(([name, enabled]) => `${name}: ${enabled ? 'permission check passed' : machine.reasons[name] ?? 'unavailable'}`).join('; ')}.`;
             finished = true;
             const a = w(['secret', 'put', 'STRIPE_KEY'], { input: `${key}\n` });
-            const b = a.code === 0 ? w(['secret', 'put', 'STRIPE_WEBHOOK_SECRET'], { input: `${hook}\n` }) : { code: 1 };
+            const selected = a.code === 0 ? w(['secret','put','STRIPE_CHECKOUT_MODE'],{input:'sessions\n'}) : {code:1};
+            const b = selected.code === 0 ? w(['secret', 'put', 'STRIPE_WEBHOOK_SECRET'], { input: `${hook}\n` }) : { code: 1 };
             hook = '';
             const readiness = { ...machine, key: createHash('sha256').update(key).digest('hex'), mode: modeOf(key), recurring: recurringReady };
             const c = !paidParts ? b : b.code === 0 ? w(['secret', 'put', 'PURCHASE_PAYMENT_CAPABILITIES'], { input: JSON.stringify(readiness) }) : { code: 1 };

package/lib/stripe-connect.mjs

@@ -134,6 +134,7 @@ export async function shopConnect(root, options = {}) {
     const receiptFile = join(dir, `${mode}.json`);
     const receipt = existsSync(receiptFile) ? json(readFileSync(receiptFile, 'utf8')) : null;
     const result = await syncPaymentLinks({ root, api, shop: checked.shop, slug: studio.slug, site: target.origin, mode, w, receipt,
+      bookingSlots: options.bookingSlots ?? (existsSync(join(root,'.studio','booking-slots.json')) ? JSON.parse(readFileSync(join(root,'.studio','booking-slots.json'),'utf8')) : []),
       saveReceipt: (record) => {
         writeFileSync(`${receiptFile}.tmp`, JSON.stringify(record), { mode: 0o600 });
         renameSync(`${receiptFile}.tmp`, receiptFile);

package/lib/template-history.json

@@ -3492,6 +3492,48 @@
      }
     }
    }
+  },
+  "0.51.0": {
+   "files": {
+    "CLAUDE.md": "ddf2b2a0376202f6",
+    "README.md": "684b3cca8001673c",
+    "HANDOFF.md": "29337e2ace95b2e7",
+    "games/README.md": "5ad32fe80c61f117",
+    "music/README.md": "a3dc042dadd39df8",
+    "videos/README.md": "16babc3437d5545b",
+    "posts/README.md": "37841aae476bd540",
+    "site/README.md": "1dbdf22c03a1e505",
+    "site/src/worker.mjs": "6cc5c6131eaf6fd0"
+   },
+   "sections": {
+    "AGENTS.md": {
+     "(intro)": "394cbbe934e80722",
+     "## Version-matched authoring guides": "f6261a0e5801b96b",
+     "## Layout": "f3a280b8c96cd068",
+     "## Apps: one screen, roles and parts": "c10aa0441ea89702",
+     "## Commands (all through the pinned CLI in node_modules)": "5222e08ca55e326e",
+     "## The site": "0cb8dd9a6f8a0096",
+     "## Making games": "bb715272fd1a615b",
+     "## The Game Codex and progress": "0738ef719cef3a4c",
+     "## Art direction and models": "a48fff7bf0a5f2fc",
+     "## Running live games (the back office)": "51ebf2ab756f6e4d",
+     "## Servers and AI seats": "1ccfd549d2369a60",
+     "## Selling things (the shop)": "43a3556be93d1235",
+     "## Continuing a build from the Claude app": "0d68081e924ca419",
+     "## Rules": "b2234d80f6cbe71d",
+     "## Telling Homie": "80b46fdd9e578db8",
+     "## Beta": "9d02638207a26e73"
+    }
+   },
+   "named": {
+    "Homie Arcade": {
+     "sections": {
+      "AGENTS.md": {
+       "## Commands (all through the pinned CLI in node_modules)": "611b437f5b3303f0"
+      }
+     }
+    }
+   }
   }
  }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homie-rocks/studio",
-  "version": "0.50.7",
+  "version": "0.51.0",
   "description": "A studio for games, music and video on its own Cloudflare: scaffold, multiplayer starters on the netplay contract, a port toolkit that makes existing single-player web games multiplayer, the site Worker with public rooms (Table/Lobby Durable Objects and D1, all on the free Workers plan, no payment method), a site with the hub's sections (Home, Games, Music, Videos, Rooms, Posts with feeds) in the studio's own look, an epic landing page for every game, big songs and videos in the studio's own R2 once it has storage (uploaded, checked by SHA-256, served at the same addresses), deploy, and the homie.rocks directory.",
   "type": "module",
   "license": "Apache-2.0",

package/shop/SELLING.md

@@ -15,7 +15,7 @@ A player can refund items within a window you set; a tip stays given unless you
 Stripe handles payments, receipts, payment limits, held refunds and disputes. Stripe Tax is optional;
 Managed Payments is another selectable integration. Your office links Stripe's own pages.
 
-`homie-studio shop connect` opens Stripe's approval page if needed, then your AI syncs your products, prices, payment links and webhook. You never handle a key. The shop sends buyers to Stripe, where they confirm quantity or choose a tip; your Worker holds only the webhook signing secret and link settings. Buy different items separately. Refund in Stripe or ask your connected AI; signed events update your shop. A missing payment stays pending until Stripe resends its event. Free orders need no Stripe.
+`homie-studio shop connect` opens Stripe's approval page if needed, then your AI syncs your products, prices, payment links and webhook. You never handle a key. The shop sends buyers to Stripe, where they confirm quantity or choose a tip; your Worker holds only the webhook signing secret and link settings. Menus let guests choose several items and quantities on Stripe. Paid bookings use a capacity-limited link for each slot: opening is pending, payment secures the seat. Monthly presets charge through recurring Stripe Prices, with a Stripe login link to manage or cancel. Refund in Stripe or ask your connected AI; signed events update your shop. A missing payment stays pending until Stripe resends its event. Free orders need no Stripe.
 
-The fuller connection adds combined carts, spending limits, custom checkout expiry, automatic recovery and refunds in the office. An existing Worker key selects it; your AI explains it only if you ask for those features. The optional manual setup remains available, but is not the default.
+The optional fuller connection adds exact app-built carts, spending reservations, exclusive unpaid holds, custom expiry, automatic recovery and office refunds. It needs explicit session mode as well as an existing Worker key; a key alone never selects it. The optional manual setup remains available, but is not the default.
 The scaffold has no policy, cap or refund window. Test mode is available before choosing live mode.

package/shop/SHOP.md

@@ -108,7 +108,7 @@ If the studio is not deployed yet, approval is retained: deploy with `studio_dep
 `cloudflare_login` first if needed), then rerun connect. Webhooks require the deployed HTTPS address.
 
 **The default is keyless.** Connect syncs one Product and Price for each shop.json item and one
-Payment Link for each paid item. Tip Prices use custom amounts; free orders stay local. It creates
+Payment Link for each paid item, adjustable-quantity menus, and one capacity-limited link per published booking slot. Tip Prices use custom amounts; free orders stay local. It creates
 an account webhook at `<site>/api/shop/hook`, captures its signing secret without displaying it,
 and installs `STRIPE_WEBHOOK_SECRET` and `STRIPE_SHOP_LINKS` through Wrangler stdin. No Stripe
 API key goes into the Worker. Repeat connect after editing shop.json: changed prices get new
@@ -132,7 +132,7 @@ items; failed refunds restore the financial booking. A lost dispute revokes good
 
 | Need | Keyless behavior / fuller connection |
 |---|---|
-| Several different items in one payment | Buy separately. Stripe supports static multi-item links (up to 20 fixed-price lines), but they are not an arbitrary buyer cart. Dynamic carts use the keyed path. |
+| Several different items in one payment | A synced menu opens several fixed-price lines; guests choose quantities on Stripe, including zero. Stripe limits Payment Links to 20 lines; larger catalogues use separate menus. Custom amounts and subscriptions keep separate links. |
 | Reserve an optional spending allowance | Requires keyed Checkout; a reusable public link cannot atomically reserve this studio's local cap. No silent weakening of a configured cap. |
 | Expire an abandoned session | Stripe controls the lifetime; deactivating a link prevents new sessions, not existing sessions. Custom expiry/cancellation requires the keyed path. |
 | Refund in one tap / player self-refund | Owner uses Stripe Dashboard or asks their Stripe-connected AI. Signed events update books. Office shows guidance instead of a paid-order refund button. Free refunds remain local. |
@@ -142,8 +142,7 @@ items; failed refunds restore the financial booking. A lost dispute revokes good
 | Managed Payments | Payment Links support managed_payments.enabled; connect uses it when the studio selects Stripe as seller, subject to Stripe eligibility and terms. |
 | Currency display | Payment Links always enable Stripe Adaptive Pricing. Bookkeeping uses integration currency; presentment details describe what the customer saw. |
 
-An existing `STRIPE_KEY` selects the fuller path automatically. Only if requested, explain:
-“The fuller connection adds combined carts, spending limits, automatic recovery and refunds here.”
+A key alone never selects the fuller path. It requires explicit `STRIPE_CHECKOUT_MODE=sessions` as well as a Worker key. Only if requested, explain: “The optional session connection adds exact app-built carts, spending reservations, expiring holds and runtime refunds.”
 The explicit `shop connect --manual` path remains available, including `--live`, but requires the
 owner's existing Dashboard key step; it does not satisfy one approval. Never choose it automatically.
 Running default connect again saves links, removes the API key, and keeps signed-event fulfillment.
@@ -202,7 +201,7 @@ the full amount toward a cap. The additive schema preserves its original rows an
 
 ## Shop button on the screen
 
-An open shop with items for this game or app shows **Shop** above its play/open screen. The shell reserves 52 pixels plus the safe area above the content, so the button never covers its controls. In `game.json` or `app.json`, set `"screen": { "shop": false }` to hide this button (merge with any existing screen settings). The room panel and your own shop buttons still work. Closed shops, kids policies and an empty selection show no button.
+An open shop with items for this game or app shows **Shop** above its play/open screen. The shell reserves 52 pixels plus the safe area above the content, so the button never covers its controls. In `game.json` or `app.json`, set `"screen": { "shop": false }` to disable the experience’s shop (merge with any existing screen settings). Keep it true or omitted when your app uses its own `createShop` buttons; false also refuses their checkout bridge requests. Closed shops, kids policies and an empty selection show no button.
 
 ```ts
 import { createShop } from '@homie-rocks/studio/shop';
@@ -218,3 +217,119 @@ These calls open the same shop in games and apps. Inside a player card, purchase
 Create the booking/ticket/gift intention first. `shop.buy('full-tune', 1, undefined, { reference: booking.id })` or `shop.checkout({ reference: booking.id })` sends the app's own reference through checkout. Existing boolean returns are unchanged: checkout opened is not paid. The verified durable `order.paid` event carries `data.order`, `data.reference` (null if omitted) and `data.app`. Reopened Payment Links retain the reference. A reference is buyer-supplied correlation, not authorization: verify the record, app, amount and currency, deduplicate by event/order ID, then fulfil it. Keep personal data out of references. Before Stripe is connected, local prices and unpaid requests can be demonstrated; actual payment and recurring collection remain unverified. Test events must be labelled simulations.
 
 For referrals, use Stripe Connect to split payments or a Stripe-based affiliate service; Homie builds none.
+
+## Keyless menus, paid seats and monthly giving (0.51.0)
+
+Use `shop connect` by default. All objects belong to the owner's Stripe account and
+are created through its approved CLI session. Homie has no platform key, OAuth
+backend, payment intermediary or cut. A desktop is needed to sync, not to take money.
+
+**A round to table 7:** declare fixed-price drinks in shop.json and run connect.
+
+```ts
+shop.add('negroni', 2);
+shop.add('spritz', 1);
+await shop.checkout({ reference: 'table-7' });
+```
+
+The default opens the synced Stripe menu containing those items. The guest chooses
+final quantities **on Stripe**, starting at one for each menu line; the local cart's
+quantities are not prefilled. Adjustable quantity minimum is zero (Stripe prevents
+removing the last item). Payment Links support at most 20 lines. Keyless sync splits catalogues into menus of ten to fit signed invoice snapshots without authenticated pagination. Split larger menus;
+if selected items span menus, the app receives `menu` and should offer separate
+checkouts. Custom amounts cannot be mixed into this menu; offer a separate tip link.
+Stripe invoice creation is enabled for menus (Stripe's invoice pricing applies).
+Only signed paid invoice lines supply `order.paid.data.lines`, including actual
+item, quantity and amount; no quantity is guessed from the total. Incomplete invoice
+snapshots remain pending for recovery rather than granting a guessed order.
+
+The opaque local order ID is `client_reference_id`; its durable reference maps back
+to `table-7` in `order.paid.data.reference` and the buyer's order response. No personal
+data goes in that reference. A return URL is never proof of payment.
+
+**Book a tune; the seat is held only when paid:** declare a staff-written `slots`
+collection with integer `capacity` and a server-managed `bookings` collection with
+`"booking":{"slots":"slots","item":"full-tune"}`. Publish slot records, then have
+the owner's AI write the complete manifest to `.studio/booking-slots.json` and run
+`shop connect`, or call local MCP `stripe_bookings_sync` with the same `slots` array:
+
+```json
+[{"app":"tune","collection":"bookings","slots":"slots","slot":"sat-0900","item":"full-tune","capacity":1}]
+```
+
+Sync after publishing or changing slots. Removed or inactive slots deactivate their
+links. Each link has `restrictions.completed_sessions.limit = capacity`, with one
+fixed service and one seat per checkout. Re-sync preserves Stripe's lifetime completed
+count. Free slots stay local and use separate slot records from paid links. Never increment capacity just to hide a full-link error.
+Refunds do not decrement Stripe's completed-session counter; the owner's AI must
+review availability and resync explicitly. A changed price should use a new slot;
+do not replace a sold link and accidentally reset its capacity counter.
+
+```ts
+const result = await shop.book('full-tune', {collection:'bookings',slot:'sat-0900'});
+// result.booking is the tracking record ID.
+```
+
+Opening the link creates local `pending` state, best effort. It does **not** block
+other guests. Confirmed payment creates `confirmed`; expiry/failure/refund releases
+the local record. The app must say “Pay to secure your seat,” not promise an exclusive
+unpaid hold. Slot reads expose `record.booking.full`, `available` and `synced` for the
+UI; Stripe's full-link update and verified confirmations make the app show Full.
+Events include `booking.pending`, `.confirmed`, `.released`, `.moved`; free and
+explicit keyed bookings also use `.held`. Before staff moves, the owner's AI syncs **both affected slots** with `active:false`;
+sync deactivates their links and expires open sessions. Wait for signed payment events,
+then staff makes the versioned `{slot:...}` update. Moving into an unpaused paid target
+is refused. Read fresh confirmed booking counts and sync each affected slot with
+`confirmed:<count>` and `active:true`. Sync adjusts the lifetime completion budget to
+`Stripe completed + capacity - confirmed` (initial publication uses capacity exactly).
+This also reopens refunded availability after an explicit review. Never use a stale
+confirmed count or skip pausing: local staff movement cannot mutate Stripe by itself.
+An explicit keyed session connection retains exclusive expiring unpaid holds.
+
+**Give $20 monthly:** `shop init --giving --currency CAD` includes fixed suggested
+monthly gifts. Declare a recurring item, then run connect:
+
+```json
+{"id":"monthly-gift","kind":"donation","name":"Give $20 monthly","price":2000,"interval":"month","gives":[]}
+```
+
+`shop.buy('monthly-gift',1,undefined,{reference:'gift-20'})` opens a recurring Price
+on a Payment Link (subscription mode). The giver chooses among the preset options.
+Arbitrary custom monthly amounts require the explicitly selected keyed connection;
+never silently request it or ask the person to find/paste a key. One-time custom
+amounts remain keyless. `giving.receiptText` is the owner's receipt wording.
+
+Signed `subscription.started`, `.renewed`, `.failed`, `.cancelled` events drive
+membership and giving. Membership access ends at the paid invoice line's period end;
+failed invoices cannot extend it and cancellation ends access. Unknown Prices grant
+nothing. Keyless portal configuration supports cancellation, payment-method updates
+and invoice history. `shop connect` enables `login_page.enabled` through the CLI API
+and stores Stripe's no-code login URL; **no Dashboard toggle is required**. Givers
+verify their email with Stripe to manage/cancel. The buyer-owned `/api/shop/portal`
+returns this URL. Plan changes require deliberate portal configuration and fulfilment
+mapping; the optional keyed path retains current-provider reconciliation for upgrades.
+
+For offline development, import `startStripeFixture` from the installed toolkit's
+`lib/dev-stripe-fixture.mjs`, start it with `{origin:'http://127.0.0.1:8787'}`, and
+write its `bindings` as local Wrangler `.dev.vars` in a disposable studio. Keep it
+running alongside `homie-studio dev`. The checkout page explicitly says simulation;
+it takes no card and no money. Call `close()` and delete the disposable studio when
+finished. This tests signed webhook plumbing, not Stripe account permissions.
+
+The giving starter now reads the actual shop donation options with `shop.catalog()`.
+`shop init --giving --currency CAD` includes $20 monthly; `app new giving --from giving`
+opens Checkout for the selected amount and frequency. A disconnected shop displays
+a disabled preview. No intention record or unverified collected total is created.
+Use the Manage my gifts link for the buyer-owned Stripe portal in the shop.
+
+For real sandbox acceptance without copying any API key, import `startKeylessStripeSandbox`
+from `lib/dev-stripe-sandbox.mjs` and pass `{origin, profile, shop, bookingSlots}` with an explicit
+sandbox CLI profile and loopback studio origin. It drives only that profile's
+Stripe CLI, starts `stripe listen --forward-to` with the required events, and
+returns local dev `bindings` and `close()`. Keep bindings private: the webhook
+signing secret is real even in test mode. The keyless helper encodes link configuration for safe .dev.vars transport; do not decode or rewrite that binding. Use the helper’s `links` property for native link IDs when testing. `await helper.sync(manifest)` updates its `links` and `bindings`; save the new bindings and restart dev after a slot sync. `close()` deactivates its sandbox links and stops forwarding. Supply them to the local dev harness
+only, never source control or logs. The local webhook forwarding listener needs the desktop; production uses the signed public webhook directly. No API adapter or key is installed in the keyless Worker. It never exports CLI credentials.
+Use Stripe's published CLI test fixtures/tokens to complete Checkout via API;
+never type card details into a form. Stop on an expired profile and ask the owner
+to approve `stripe login --project-name <profile>` once. Stop the adapter and remove
+dev bindings and disposable studios when finished.