@homie-rocks/studio 0.50.7 → 0.51.0

package/shop/shop.ts

@@ -44,10 +44,19 @@ export interface ShopOptions {
 
 export interface CartLine { item: string; quantity: number; amount?: number }
 
+export interface ShopCatalog {
+  open: boolean;
+  currency: string;
+  currencyScale: number;
+  items: Array<{ id: string; kind: string; name: string; interval?: 'month'; price: number | 'choose'; min?: number; max?: number | null; shown: string; way: string }>;
+}
+
 export interface Shop {
   /** Resolves once the shell answered (or after `timeoutMs` with no shell: an empty, closed shop). */
   readonly ready: Promise<ShopState>;
   readonly state: ShopState;
+  /** Current gift/item options and payment readiness, without exposing account details. */
+  catalog(): Promise<ShopCatalog>;
   /** Whether the player owns this entitlement key now ("skin:ember", "badge:supporter"). Synchronous, for a render loop. */
   has(key: string): boolean;
   /** Every key the player owns now. */
@@ -61,6 +70,8 @@ export interface Shop {
   add(item: string, quantity?: number, amount?: number): void;
   cart(): CartLine[];
   clear(): void;
+  /** Opens Checkout: keyless bookings are pending until paid; explicit session checkout holds capacity. The returned ID tracks the public booking record. */
+  book(item: string, booking: { collection: string; slot: string }, quantity?: number): Promise<{ ok: boolean; booking?: string; error?: string }>;
   checkout(options?: { reference?: string }): Promise<boolean>;
   buy(item: string, quantity?: number, amount?: number, options?: { reference?: string }): Promise<boolean>;
   /** Mark an item used; the studio's refundUsedItems policy decides whether self-service refunds still apply. */
@@ -121,6 +132,20 @@ export function createShop(opts: ShopOptions = {}): Shop {
   let cart: CartLine[] = [];
   const shop: Shop = {
     ready,
+    catalog: async () => {
+      const result: ShopCatalog = { open: false, currency: 'usd', currencyScale: 100, items: [] };
+      let cursor: string | undefined;
+      do {
+        const m = await send({ op: 'catalog', cursor });
+        if (!m.ok) return result;
+        result.open = Boolean(m.open);
+        result.currency = String(m.currency ?? 'usd');
+        result.currencyScale = Number(m.currencyScale) || 100;
+        if (Array.isArray(m.items)) result.items.push(...m.items as ShopCatalog['items']);
+        cursor = typeof m.nextCursor === 'string' ? m.nextCursor : undefined;
+      } while (cursor);
+      return result;
+    },
     get state() { return { ...state }; },
     has: (key) => owns.includes(String(key)),
     entitlements: () => owns.slice(),
@@ -129,6 +154,10 @@ export function createShop(opts: ShopOptions = {}): Shop {
     add: (item, quantity = 1, amount) => { cart.push({ item, quantity, ...(amount === undefined ? {} : { amount }) }); },
     cart: () => cart.map((line) => ({ ...line })),
     clear: () => { cart = []; },
+    book: async (item, booking, quantity = 1) => {
+      const r = await send({ op: 'checkout', booking, lines: [{ item, quantity }] });
+      return { ok: Boolean(r.ok), ...(typeof r.booking === 'string' ? { booking: r.booking } : {}), ...(typeof r.message === 'string' ? { error: r.message } : {}) };
+    },
     checkout: async (options = {}) => { const ok = Boolean((await send({ op: 'checkout', lines: cart, reference: options.reference })).ok); if (ok) cart = []; return ok; },
     buy: async (item, quantity = 1, amount, options = {}) => Boolean((await send({ op: 'checkout', reference: options.reference, lines: [{ item, quantity, ...(amount === undefined ? {} : { amount }) }] })).ok),
     close: () => { void send({ op: 'close' }); },

package/worker/app-format.mjs

@@ -20,6 +20,12 @@ export function appProblems(meta) {
     if (!key.test(id) || !object(c) || !object(c.fields)) { bad.push(`collection ${id}: declare fields`); continue; }
     for (const [field, spec] of Object.entries(c.fields)) if (!/^[a-z][a-z0-9_]*$/.test(field) || !object(spec) || !['string', 'number', 'boolean'].includes(spec.type) || (spec.enum && (!Array.isArray(spec.enum) || !spec.enum.length))) bad.push(`collection ${id}.${field}: invalid field: names start with a lowercase letter and use lowercase letters, digits and underscore; declare a string, number or boolean type`);
   }
+  for (const [id, c] of Object.entries(collections)) if (c.booking) {
+    const spec = c.booking;
+    if (!object(spec) || !key.test(spec.slots ?? '') || !collections[spec.slots] || typeof spec.item !== 'string' || !spec.item.trim()) bad.push(`collection ${id}: booking needs slots collection and shop item`);
+    if (!meta.records.persist) bad.push(`collection ${id}: bookings need persistent records`);
+    for (const role of Object.values(roles)) if (!role.signIn && (role.can ?? []).some(cap => ['create','update','delete'].some(op => cap === `${op}:${id}` || cap === `${op}:${spec.slots}`))) bad.push(`collection ${id}: booking and slot writes require a signed-in staff role`);
+  }
   for (const r of Object.values(roles)) for (const cap of Array.isArray(r?.can) ? r.can : []) if (!Object.hasOwn(meta.records?.collections ?? {}, String(cap).split(':')[1])) bad.push(`unknown collection in ${cap}`);
   for (const [k, v] of Object.entries(meta.words ?? {})) if (!/^[a-z][a-zA-Z0-9-]*$/.test(k) || typeof v !== 'string' || v.length > 500) bad.push(`words.${k}: use a short label`);
   return bad;

package/worker/app-records.mjs

@@ -1,4 +1,6 @@
+import { linkConfig } from './shop-links.mjs';
 import {localSession} from './local-test.mjs';
+import { moveBooking } from './booking-store.mjs';
 import { toolIdentity } from './tool-identity.mjs';
 /** Lasting app records in the studio's own D1. Room hosts never authorize writes. */
 import { appRole, recordProblem } from './app-format.mjs';
@@ -96,10 +98,29 @@ export async function appRecordsRoute(request, env, meta, url, sub) {
     if (op === 'read') {
       const rows = id ? [await env.DB.prepare('SELECT id, value, version, updated_at FROM app_records WHERE app = ?1 AND collection = ?2 AND id = ?3').bind(recordApp, collection, id).first()].filter(Boolean)
         : (await env.DB.prepare('SELECT id, value, version, updated_at FROM app_records WHERE app = ?1 AND collection = ?2 ORDER BY updated_at, id LIMIT 1000').bind(recordApp, collection).all()).results;
-      return json({ ok: true, records: rows.map((r) => ({ id: r.id, data: JSON.parse(r.value), version: r.version, updatedAt: r.updated_at })) });
+      const records=[];
+      for(const r of rows) {
+        const record={id:r.id,data:JSON.parse(r.value),version:r.version,updatedAt:r.updated_at};
+        const link=linkConfig(env)?.slots?.find(l=>l.app===meta.id&&l.slots===collection&&l.slot===r.id);
+        if(link) {
+          const saved=await env.DB.prepare('SELECT value FROM meta WHERE key=?1').bind(`shop-slot-link:${link.id}`).first();
+          const observed=saved?JSON.parse(saved.value):null;
+          const status=observed && observed.capacity===(link.limit??link.capacity) ? observed : link;
+          const count=await env.DB.prepare("SELECT COALESCE(SUM(quantity),0) n FROM shop_bookings WHERE app=?1 AND slots=?2 AND slot=?3 AND state='confirmed'").bind(recordApp,collection,r.id).first();
+          record.booking={full:!status.active||status.count>=(link.limit??link.capacity)||count.n>=link.capacity,available:status.active?Math.max(0,Math.min(link.capacity-count.n,(link.limit??link.capacity)-status.count)):0,synced:link.capacity===record.data.capacity};
+        }
+        records.push(record);
+      }
+      return json({ok:true,records});
     }
     if (!id) return fail(400, 'record id required');
     const body = await bodyOf(request);
+    if (meta.records.collections[collection].booking) {
+      if (op !== 'update' || !meta.roles[access.role].signIn) return fail(403, 'bookings are created and released through checkout');
+      if (!Number.isSafeInteger(body.version) || !ID.test(body.data?.slot ?? '') || Object.keys(body.data ?? {}).some(k => k !== 'slot')) return fail(400, 'move requires slot and current version');
+      const moved = await moveBooking(env, { app: recordApp, collection, id, slot: body.data.slot, version: body.version });
+      return moved ? json({ ok: true, id, version: body.version + 1 }) : fail(409, 'booking changed or is released; reload');
+    }
     if (op !== 'delete') { const bad = recordProblem(meta.records.collections[collection], body.data, { create: op === 'create' }); if (bad) return fail(400, bad); }
     if (op !== 'create' && (!Number.isSafeInteger(body.version) || body.version < 1)) return fail(400, 'record version required');
     const stmt = op === 'create'
@@ -109,6 +130,7 @@ export async function appRecordsRoute(request, env, meta, url, sub) {
     const result = await stmt.run();
     return result.meta.changes ? json({ ok: true, id, version: op === 'create' ? 1 : body.version + 1 }) : fail(409, 'record changed, already exists, or collection full; reload');
   } catch (error) {
+    if (/booking capacity|capacity below|slot has active/.test(error.message)) return fail(409, error.message);
     if (error instanceof SyntaxError || error.message === 'body too large') return fail(400, error.message);
     return fail(503, 'app database unavailable; apply studio migrations');
   }

package/worker/booking-store.mjs

@@ -0,0 +1,79 @@
+import { linkConfig, hasStripeKey } from './shop-links.mjs';
+/** Capacity belongs to the studio database. Checkout expiry is a provider fact,
+ * never an inference from a browser return or the local clock. */
+export const BOOKINGS_MIGRATION_FILE = '0025_bookings.sql';
+export const BOOKINGS_MIGRATION = `
+CREATE TABLE shop_bookings (
+ id TEXT PRIMARY KEY, app TEXT NOT NULL, collection TEXT NOT NULL,
+ slots TEXT NOT NULL, slot TEXT NOT NULL, quantity INTEGER NOT NULL CHECK(quantity > 0),
+ order_id TEXT NOT NULL UNIQUE, state TEXT NOT NULL DEFAULT 'held'
+ CHECK(state IN ('pending','held','confirmed','released')),
+ version INTEGER NOT NULL DEFAULT 1, updated_at INTEGER NOT NULL
+);
+CREATE INDEX shop_bookings_capacity ON shop_bookings(app, slots, slot, state);
+CREATE TRIGGER booking_capacity_insert BEFORE INSERT ON shop_bookings WHEN NEW.state != 'pending' BEGIN
+ SELECT RAISE(ABORT,'booking capacity unavailable') WHERE NOT EXISTS (
+  SELECT 1 FROM app_records s WHERE s.app=NEW.app AND s.collection=NEW.slots AND s.id=NEW.slot
+  AND json_type(s.value,'$.capacity')='integer' AND json_extract(s.value,'$.capacity') >= NEW.quantity +
+   (SELECT COALESCE(SUM(quantity),0) FROM shop_bookings WHERE app=NEW.app AND slots=NEW.slots AND slot=NEW.slot AND state IN ('held','confirmed'))
+ );
+END;
+CREATE TRIGGER booking_capacity_move BEFORE UPDATE OF slot ON shop_bookings
+WHEN NEW.state IN ('held','confirmed') BEGIN
+ SELECT RAISE(ABORT,'booking capacity unavailable') WHERE NOT EXISTS (
+  SELECT 1 FROM app_records s WHERE s.app=NEW.app AND s.collection=NEW.slots AND s.id=NEW.slot
+  AND json_type(s.value,'$.capacity')='integer' AND json_extract(s.value,'$.capacity') >= NEW.quantity +
+   (SELECT COALESCE(SUM(quantity),0) FROM shop_bookings WHERE app=NEW.app AND slots=NEW.slots AND slot=NEW.slot AND id!=NEW.id AND state IN ('held','confirmed'))
+ );
+END;
+CREATE TRIGGER booking_slot_update BEFORE UPDATE OF value ON app_records
+WHEN EXISTS (SELECT 1 FROM shop_bookings WHERE app=OLD.app AND slots=OLD.collection AND slot=OLD.id AND state IN ('held','confirmed')) BEGIN
+ SELECT RAISE(ABORT,'capacity below existing bookings') WHERE json_type(NEW.value,'$.capacity') IS NOT 'integer' OR json_extract(NEW.value,'$.capacity') <
+  (SELECT SUM(quantity) FROM shop_bookings WHERE app=OLD.app AND slots=OLD.collection AND slot=OLD.id AND state IN ('held','confirmed'))
+;
+END;
+CREATE TRIGGER booking_slot_delete BEFORE DELETE ON app_records
+WHEN EXISTS (SELECT 1 FROM shop_bookings WHERE app=OLD.app AND slots=OLD.collection AND slot=OLD.id AND state IN ('held','confirmed')) BEGIN
+ SELECT RAISE(ABORT,'slot has active bookings');
+END;
+CREATE TRIGGER booking_order_state AFTER UPDATE OF status ON shop_orders BEGIN
+ UPDATE shop_bookings SET state=CASE WHEN NEW.status='paid' THEN 'confirmed' ELSE 'released' END,
+ version=version+1, updated_at=NEW.updated_at
+ WHERE order_id=NEW.id AND ((state IN ('pending','held') AND NEW.status IN ('paid','expired','failed')) OR (state IN ('pending','held','confirmed') AND NEW.status IN ('refunded','lost')));
+END;
+${['INSERT', 'UPDATE'].map(op => `CREATE TRIGGER booking_record_${op.toLowerCase()} AFTER ${op} ON shop_bookings BEGIN
+ INSERT INTO app_records(app,collection,id,value,version,updated_at)
+ VALUES(NEW.app,NEW.collection,NEW.id,json_object('slot',NEW.slot,'quantity',NEW.quantity,'state',NEW.state),NEW.version,NEW.updated_at)
+ ON CONFLICT(app,collection,id) DO UPDATE SET value=excluded.value,version=excluded.version,updated_at=excluded.updated_at;
+ INSERT OR IGNORE INTO studio_events(id,type,data,at)
+ SELECT 'booking:' || NEW.id || ':' || NEW.version,'booking.' || ${op === 'INSERT' ? "NEW.state" : "CASE WHEN OLD.slot!=NEW.slot THEN 'moved' ELSE NEW.state END"},
+ json_object('booking',NEW.id,'app',NEW.app,'collection',NEW.collection,'slot',NEW.slot,'state',NEW.state,'quantity',NEW.quantity,'order',NEW.order_id,'version',NEW.version),NEW.updated_at
+ WHERE EXISTS(SELECT 1 FROM function_subscriptions WHERE type='booking.' || ${op === 'INSERT' ? "NEW.state" : "CASE WHEN OLD.slot!=NEW.slot THEN 'moved' ELSE NEW.state END"});
+END;`).join('\n')}
+DROP TRIGGER IF EXISTS shop_orders_function_paid;
+CREATE TRIGGER shop_orders_function_paid AFTER UPDATE ON shop_orders
+WHEN EXISTS (SELECT 1 FROM function_subscriptions WHERE type='order.paid')
+ AND OLD.paid_at IS NULL AND NEW.paid_at IS NOT NULL
+ AND NOT EXISTS (SELECT 1 FROM purchase_orders WHERE id=NEW.id) BEGIN
+ INSERT OR IGNORE INTO studio_events(id,type,data,at)
+ VALUES('shop_orders:' || NEW.id || ':paid','order.paid',
+ json_object('order',NEW.id,'source','shop_orders','amount',NEW.amount,'currency',NEW.currency,'mode',NEW.mode,
+ 'app',NEW.game,'reference',(SELECT value FROM meta WHERE key='shop-reference:' || NEW.id),
+ 'lines',json((SELECT json_group_array(json_object('item',item,'quantity',quantity,'amount',amount,'total',total)) FROM shop_order_lines WHERE order_id=NEW.id))),NEW.paid_at);
+END;
+`;
+
+export function bookingStatement(env, { id, app, collection, slots, slot, quantity, order, pending = false, now = Date.now() }) {
+  return env.DB.prepare(`INSERT INTO shop_bookings(id,app,collection,slots,slot,quantity,order_id,updated_at,state)
+    SELECT ?1,?2,?3,?4,?5,?6,?7,?8,?9 WHERE EXISTS(SELECT 1 FROM shop_orders WHERE id=?7)`).bind(id, app, collection, slots, slot, quantity, order, now, pending ? 'pending' : 'held');
+}
+
+/** Staff movement uses the same version contract as app records. */
+export async function moveBooking(env, { app, collection, id, slot, version }) {
+  const target=linkConfig(env)?.slots?.find(l=>l.app===app&&l.collection===collection&&l.slot===slot);
+  if(!hasStripeKey(env) && target && !target.paused)throw new Error('booking capacity: ask the owner’s AI to pause the target slot and expire open links before moving; then sync confirmed seat counts');
+  const result = await env.DB.prepare(`UPDATE shop_bookings SET slot=?4,version=version+1,updated_at=?6
+    WHERE app=?1 AND collection=?2 AND id=?3 AND version=?5 AND state IN ('held','confirmed')`)
+    .bind(app, collection, id, slot, version, Date.now()).run();
+  return result.meta.changes > 0;
+}

package/worker/build-id.mjs

@@ -1,2 +1,2 @@
 // Generated by lib/build-identity.mjs; identifies the bundled runtime sources.
-export const STUDIO_BUILD = Object.freeze({"version":"0.50.7","sha256":"94d707956333f370dc0a5a65762e08418b6474d19302096c765b96090d9d4845"});
+export const STUDIO_BUILD = Object.freeze({"version":"0.51.0","sha256":"5a8e0df9f204fbe4978d618b507fe5ae0c5005ef4f106ac4b78dfac5f6c02b7b"});

package/worker/index.mjs

@@ -185,7 +185,10 @@ async function sellingShop(env, cat) {
 }
 
 async function availableShellShop(env, cat, game, options) {
-  return await sellingShop(env, cat) ? shellShop(cat, game, options) : null;
+  // The shell can show a disabled catalog before payment setup is complete.
+  // Checkout readiness is enforced by the shop API, separately from visibility.
+  const preview = (cat.games ?? []).find(g => g.id === game)?.screen?.shopPreview === true;
+  return (preview && !shopOf(cat)?.broken || await sellingShop(env, cat)) ? shellShop(cat, game, options) : null;
 }
 
 async function postsOf(env, origin) {
@@ -930,7 +933,7 @@ async function route(request, env, ctx) {
           if (a.status === 401) return Response.redirect(`${url.origin}/account/?next=${encodeURIComponent(url.pathname + url.search)}`, 302);
           return json({ ok: false, error: a.error }, a.status);
         }
-        if(!meta.room)return recordsPage(meta,url,cat);
+        if(!meta.room)return recordsPage(meta,url,cat,await availableShellShop(env,cat,game));
       }
     }
     const lobby = () => env.LOBBY.get(env.LOBBY.idFromName(game));

package/worker/records-page.mjs

@@ -1,12 +1,13 @@
 import {playerProperties} from './embed.mjs';
 import {appRole} from './app-format.mjs';
 import {esc} from './site.mjs';
+import {SHOP_SHELL_JS, SHOP_SHELL_CSS} from './shop-page.mjs';
 import {APP_SHELL_JS} from './app-shell.mjs';
 /** A records-only app has no room simulation. The shell owns one frame and its authenticated records bridge. */
-export function recordsPage(meta,url,cat={}) {
+export function recordsPage(meta,url,cat={},shop=null) {
  const params=new URLSearchParams(url.search);params.delete('access');params.set('role',appRole(meta,url));if(!params.has('surface'))params.set('surface',url.pathname.endsWith('/tv')?'wall':'phone');
  const tags=Object.entries(playerProperties(cat,meta,{origin:url.origin})).map(([name,content])=>`<meta name="${esc(name)}" content="${esc(content)}">`).join('');
- const boot={kind:'app',game:meta.id,screen:url.pathname.endsWith('/tv')};
+ const boot={kind:'app',game:meta.id,screen:url.pathname.endsWith('/tv'),shop};
  const source=`/${meta.id}/__game/?${params}`;
- return new Response(`<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${esc(meta.name)}</title>${tags}<style>html,body{margin:0;height:100%;background:#10151c;color:white;font:18px system-ui}iframe{border:0;width:100%;height:100%;display:block}[data-arrive]{position:fixed;inset:0;display:grid;place-items:center;background:#10151c}[data-arrive][hidden]{display:none;opacity:0;visibility:hidden}</style></head><body><div data-arrive>Opening ${esc(meta.name)}…</div><iframe class="game" title="${esc(meta.name)}" sandbox="allow-scripts allow-forms allow-modals allow-popups" allow="autoplay *; fullscreen *"></iframe><script>window.__HOMIE_APP=${JSON.stringify(boot).replace(/</g,'\\u003c')};window.__shell={room:new URLSearchParams(location.search).get('room')||'main',link:{state:'connecting'},arrival:{phase:'loading'}};</script><script>${APP_SHELL_JS}</script><script>const frame=document.querySelector('iframe');frame.addEventListener('load',()=>{if(!frame.getAttribute('src'))return;requestAnimationFrame(()=>requestAnimationFrame(()=>{document.querySelector('[data-arrive]').hidden=true;window.__shell.link.state='online';window.__shell.arrival.phase='done';}));});frame.src=${JSON.stringify(source).replace(/</g,'\\u003c')};</script></body></html>`,{headers:{'content-type':'text/html;charset=utf-8','cache-control':'no-store, no-transform','x-frame-options':'SAMEORIGIN'}});
+ return new Response(`<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${esc(meta.name)}</title>${tags}<style>${SHOP_SHELL_CSS}html,body{margin:0;height:100%;background:#10151c;color:white;font:18px system-ui}iframe{border:0;width:100%;height:100%;display:block}[data-arrive]{position:fixed;inset:0;display:grid;place-items:center;background:#10151c}[data-arrive][hidden]{display:none;opacity:0;visibility:hidden}</style></head><body><div data-arrive>Opening ${esc(meta.name)}…</div><iframe class="game" title="${esc(meta.name)}" sandbox="allow-scripts allow-forms allow-modals allow-popups" allow="autoplay *; fullscreen *"></iframe><script>window.__HOMIE_APP=${JSON.stringify(boot).replace(/</g,'\\u003c')};window.__HOMIE_PLAY=window.__HOMIE_APP;window.__shell={room:new URLSearchParams(location.search).get('room')||'main',link:{state:'connecting'},arrival:{phase:'loading'}};</script><script>${APP_SHELL_JS}</script><script>${SHOP_SHELL_JS}</script><script>const frame=document.querySelector('iframe');frame.addEventListener('load',()=>{if(!frame.getAttribute('src'))return;requestAnimationFrame(()=>requestAnimationFrame(()=>{document.querySelector('[data-arrive]').hidden=true;window.__shell.link.state='online';window.__shell.arrival.phase='done';}));});frame.src=${JSON.stringify(source).replace(/</g,'\\u003c')};</script></body></html>`,{headers:{'content-type':'text/html;charset=utf-8','cache-control':'no-store, no-transform','x-frame-options':'SAMEORIGIN'}});
 }

package/worker/shop-links.mjs

@@ -2,9 +2,9 @@
 import { KEY_SHAPE, modeOf } from './stripe.mjs';
 // Current documented Payment Link fields, isolated from the existing keyed transport version.
 export const LINKS_STRIPE_VERSION = '2026-09-30.endive';
-export const hasStripeKey = (env) => KEY_SHAPE.test(String(env?.STRIPE_KEY ?? ''));
+export const hasStripeKey = (env) => env?.STRIPE_CHECKOUT_MODE === 'sessions' && KEY_SHAPE.test(String(env?.STRIPE_KEY ?? ''));
 export function linkConfig(env) {
-  try { const c = JSON.parse(env?.STRIPE_SHOP_LINKS ?? 'null'); return c?.v === 1 && ['test', 'live'].includes(c.mode) && Array.isArray(c.items) ? c : null; } catch { return null; }
+  try { const raw=env?.STRIPE_SHOP_LINKS??'null'; const c = JSON.parse(raw.startsWith('base64:') ? new TextDecoder().decode(Uint8Array.from(atob(raw.slice(7)),c=>c.charCodeAt(0))) : raw); return c?.v === 1 && ['test', 'live'].includes(c.mode) && Array.isArray(c.items) ? c : null; } catch { return null; }
 }
 export const shopMode = (env) => hasStripeKey(env) ? modeOf(env.STRIPE_KEY) : linkConfig(env)?.mode ?? 'test';
 export function linkSettings(shop) {
@@ -12,6 +12,7 @@ export function linkSettings(shop) {
     cap: shop.capPerPlayerMonth, checkoutMinutes: shop.checkoutMinutes, items: shop.items });
 }
 export function fullerReason(shop) {
+  if (shop.items.some(item => item.interval && item.price === 'choose')) return 'A giver-chosen monthly amount needs a Stripe Checkout connection.';
   if (shop.capPerPlayerMonth !== null) return 'Reserving a spending allowance before payment needs the fuller checkout connection.';
   if (shop.checkoutMinutes !== 1440) return 'Choosing when abandoned checkouts expire needs the fuller checkout connection.';
   return null;

package/worker/shop-page.mjs

@@ -207,6 +207,14 @@ export const SHOP_JS = String.raw`(function () {
         age.appendChild(sel); age.appendChild(ok);
       }
     }
+    (s.menus || []).forEach(function (menu, index) {
+      var button = el('button', {type:'button',class:'buy'}, s.menus.length > 1 ? 'Choose items on Stripe · Menu ' + (index+1) : 'Choose several items on Stripe');
+      button.onclick = function () {
+        button.disabled=true;
+        api('POST','/api/shop/buy',{lines:menu.items.map(function(item){return {item:item,quantity:1};}),game:boot.game||undefined}).then(function(r){if(!r.ok||!r.url)throw new Error(r.message||'Could not open menu');location.href=r.url;}).catch(function(e){button.disabled=false;say(e.message,true);});
+      };
+      list.appendChild(button);
+    });
     s.items.forEach(function (i) {
       var card = el('article', { class: 'item', id: 'item-' + i.id });
       card.appendChild(el('h2', null, i.name));
@@ -236,7 +244,7 @@ export const SHOP_JS = String.raw`(function () {
         var add = el('button', { type: 'button', class: 'plain' }, 'Add to cart');
         add.onclick = function () { cart.push({ item: i.id, name: i.name, quantity: Number(quantity.value), amount: amount ? units(amount.value, s.currencyScale) : undefined }); drawCart(); };
         if (!s.keyless) { act.appendChild(quantity); act.appendChild(add); }
-        else if (i.price !== 0) act.appendChild(el('p', { class: 'note' }, i.price === 'choose' ? 'Choose your amount on Stripe.' : boot.giving ? 'Confirm your gift on Stripe.' : 'Confirm quantity on Stripe. Buy different items separately.'));
+        else if (i.price !== 0) act.appendChild(el('p', { class: 'note' }, i.price === 'choose' ? 'Choose your amount on Stripe.' : boot.giving ? 'Confirm your gift on Stripe.' : 'Confirm quantity on Stripe, or use a menu above for several items.'));
       } else if (i.way === 'owned') {
         act.appendChild(el('span', { class: 'owned' }, 'Yours ✓'));
       } else if (i.way === 'make-an-account') {
@@ -261,6 +269,14 @@ export const SHOP_JS = String.raw`(function () {
       list.appendChild(card);
     });
     if (s.nextCursor) { var next = el('button', { type: 'button' }, 'Next items'); next.onclick = function () { load(s.nextCursor); }; list.appendChild(next); }
+    if(s.portalLogin)list.appendChild(el('a',{href:s.portalLogin,target:'_blank',rel:'noopener',class:'plain'},'Manage monthly giving or membership on Stripe'));
+    if (!s.portalLogin && s.items.some(function(i) { return i.interval; })) api('GET', '/api/shop/subscriptions').then(function(r) {
+      (r.subscriptions || []).forEach(function(sub) {
+        var manage = el('button', { type: 'button', class: 'plain' }, 'Manage subscription on Stripe');
+        manage.onclick = function() { var tab = window.open('', '_blank'); api('POST', '/api/shop/portal', { subscription: sub.id }).then(function(result) { if (!result.ok || !result.url) throw new Error(result.message || 'Portal unavailable'); if (tab) tab.location.href = result.url; else location.href = result.url; }).catch(function(e) { if (tab) tab.close(); say(e.message, true); }); };
+        list.appendChild(manage);
+      });
+    }).catch(function() {});
     if (!s.items.length) list.appendChild(el('p', null, boot.giving ? 'No gift options are available right now.' : 'Nothing for sale here right now.'));
     if (boot.item) { var at = document.getElementById('item-' + boot.item); if (at && at.scrollIntoView) at.scrollIntoView({ block: 'center' }); }
   }
@@ -282,7 +298,7 @@ export const SHOP_JS = String.raw`(function () {
     (function poll() {
       tries += 1;
       api('GET', '/api/shop/order?session=' + encodeURIComponent(boot.thanks)).then(function (r) {
-        if (r.status === 'paid') { returnToPage(false); $('[data-thanks-title]').textContent = boot.giving ? 'Thank you for your gift' : 'It\'s yours'; $('[data-thanks-line]').textContent = boot.giving ? 'Your gift is confirmed. Your receipt comes from Stripe by email.' : 'Paid. It is on your account now, in every game of ' + boot.studio + ' that uses it.'; return; }
+        if (r.status === 'paid') { returnToPage(false); $('[data-thanks-title]').textContent = boot.giving ? 'Thank you for your gift' : 'It\'s yours'; $('[data-thanks-line]').textContent = boot.giving ? 'Your gift is confirmed. Your receipt comes from Stripe by email.' : 'Paid. It is on your account now, in every game of ' + boot.studio + ' that uses it.'; if (r.simulated) { $('[data-thanks-title]').textContent = 'Simulation confirmed'; $('[data-thanks-line]').textContent = 'This was an offline test. No money moved and no Stripe receipt was sent.'; } return; }
         if (tries < 40) setTimeout(poll, 1500);
         else $('[data-thanks-line]').textContent = boot.giving ? 'Stripe has not confirmed your gift yet. Check your email for its receipt.' : 'Stripe has not confirmed it yet. It will be on your account as soon as it does; your receipt comes by email.';
       }).catch(function () { if (tries < 40) setTimeout(poll, 3000); });
@@ -485,13 +501,19 @@ export const SHOP_SHELL_JS = String.raw`(function () {
       if (!cfg || kids) return reply({ ok: true, open: false, kids: kids, screen: screen, owns: [] });
       return refresh().then(function () { reply({ ok: true, open: true, kids: false, screen: screen, owns: owns }); });
     }
+    if (m.op === 'catalog') {
+      if (kids) return reply({ ok: true, open: false, items: [] });
+      return api('GET', '/api/shop?game=' + encodeURIComponent(GAME) + '&server=' + encodeURIComponent(SERVER) + '&cursor=' + encodeURIComponent(typeof m.cursor === 'string' ? m.cursor : '')).then(function (r) {
+        reply({ ok: r.ok, open: r.open, currency: r.currency, currencyScale: r.currencyScale, items: r.items, nextCursor: r.nextCursor });
+      }).catch(function () { reply({ ok: false }); });
+    }
     if (m.op === 'owns') return refresh().then(function () { reply({ ok: true, owns: owns }); });
     if (m.op === 'open') { open(typeof m.item === 'string' ? m.item : null); return reply({ ok: true, shown: true }); }
     if (m.op === 'close') { close(); return reply({ ok: true }); }
     if (m.op === 'checkout') {
       if (!cfg || kids || screen) return reply({ ok: false, error: 'policy' });
       var checkoutTab = window.open('', '_blank');
-      return api('POST', '/api/shop/buy', { lines: m.lines, reference: m.reference, game: GAME, server: SERVER }).then(function (r) {
+      return api('POST', '/api/shop/buy', { lines: m.lines, reference: m.reference, booking: m.booking, game: GAME, server: SERVER }).then(function (r) {
         if (r.ok && r.url) { leaveForCheckout(checkoutTab, r); watch(); } else if (checkoutTab) checkoutTab.close();
         reply(r);
       }).catch(function () { if (checkoutTab) checkoutTab.close(); reply({ ok: false }); });

package/worker/shop-rules.mjs

@@ -49,6 +49,7 @@ export function amountError(amount, currency) {
 
 /** Checkout wording is shared by validation and the request path. */
 export function checkoutMessage(shop, studio = 'this studio', parent = false) {
+  if (shop.giving?.receiptText) return shop.giving.receiptText;
   return `${parent ? "This is for your child's account. " : ''}Delivered at once to the player's account on ${studio}. ${shop.policy.withdrawalAcknowledgement ? 'By paying you ask for it now, which ends the 14-day withdrawal right;' : 'Your statutory rights still apply.'} ${shop.refundDays === null ? (shop.policy.withdrawalAcknowledgement ? 'ask the studio about refunds.' : 'Ask the studio about refunds.') : `${shop.policy.refundUsedItems ? 'an item' : 'an unused item'} can still be refunded within ${shop.refundDays} days.`}`;
 }
 
@@ -157,7 +158,7 @@ export function checkShop(raw, { games = null, audience = 'general', studioName
       if (why) err(`${at}.price`, why);
       else price = numeric(it.price);
     }
-    if (it.interval !== undefined && (it.interval !== 'month' || chosen)) err(`${at}.interval`, 'monthly gifts need a fixed suggested amount');
+    if (it.interval !== undefined && it.interval !== 'month') err(`${at}.interval`, 'interval must be month');
     const charge = chosen ? min : price;
     if (currencyScale(currency) === 1000 && charge % 10) warnings.push({ at: `${at}.price`, message: 'This three-decimal amount uses the smallest minor unit. Confirm support with your Stripe payment method; Stripe decides acceptance (https://docs.stripe.com/currencies).' });
     if (charge > 0 && charge < minimumCharge(currency)) warnings.push({ at: `${at}.price`, message: `Stripe's minimum for settlement in ${currency.toUpperCase()} is ${money(minimumCharge(currency), currency)}. Your settlement currency and payment method determine the actual minimum at checkout.` });

package/worker/shop-store.mjs

@@ -286,7 +286,7 @@ export function forgetPlayerShop(env, player) {
 /** Grant an order's entitlements (idempotent on player, key and order). */
 export function grantStatements(env, order, item, now = Date.now(), line = { id: order.id + '_0', quantity: 1 }) {
   const starts = item.starts ? Math.max(now, Date.parse(item.starts)) : now;
-  const ends = item.ends ? Date.parse(item.ends) : item.days !== undefined && item.days !== null ? starts + Math.round(item.days * DAY) : null;
+  const ends = item.interval ? starts : item.ends ? Date.parse(item.ends) : item.days !== undefined && item.days !== null ? starts + Math.round(item.days * DAY) : null;
   return (item.gives ?? []).flatMap((key) => [
     env.DB.prepare("INSERT INTO entitlements (player, key, item, order_id, starts_at, ends_at, state, used_at) VALUES (?1, ?2, ?3, ?4, ?5, ?6, 'active', NULL) ON CONFLICT(player, key, order_id) DO UPDATE SET starts_at = MIN(starts_at, excluded.starts_at), ends_at = CASE WHEN ends_at IS NULL OR excluded.ends_at IS NULL THEN NULL ELSE MAX(ends_at, excluded.ends_at) END").bind(order.player, key, item.id, order.id, starts, ends),
     env.DB.prepare("INSERT INTO shop_entitlement_lines (player, key, item, order_id, line_id, quantity, starts_at, ends_at, state) SELECT ?1, ?2, ?3, ?4, ?7, ?8, ?5, ?6, 'active' WHERE NOT EXISTS (SELECT 1 FROM entitlements WHERE player = ?1 AND key = ?2 AND order_id = ?4 AND state != 'active') ON CONFLICT DO NOTHING").bind(order.player, key, item.id, order.id, starts, ends, line.id, line.quantity),

package/worker/shop-subscriptions.mjs

@@ -0,0 +1,198 @@
+import { linkConfig, hasStripeKey } from './shop-links.mjs';
+import { KEY_SHAPE, stripeCall } from './stripe.mjs';
+/** Only verified shop Checkout sessions establish ownership. Provider customer IDs
+ * stay private, and are never accepted from a browser. */
+export const SUBSCRIPTIONS_MIGRATION_FILE = '0026_shop_subscriptions.sql';
+export const SUBSCRIPTIONS_MIGRATION = `
+CREATE TABLE shop_subscriptions (
+ id TEXT PRIMARY KEY, order_id TEXT NOT NULL UNIQUE, customer TEXT NOT NULL,
+ state TEXT NOT NULL DEFAULT 'active', event_at INTEGER NOT NULL DEFAULT 0
+);
+CREATE TABLE shop_subscription_events (
+ id TEXT PRIMARY KEY, subscription TEXT NOT NULL, type TEXT NOT NULL,
+ invoice TEXT, amount INTEGER, currency TEXT, at INTEGER NOT NULL
+);
+CREATE TRIGGER shop_subscription_event AFTER INSERT ON shop_subscription_events BEGIN
+ INSERT OR IGNORE INTO studio_events(id,type,data,at)
+ SELECT 'subscription:' || NEW.id,NEW.type,
+ json_object('subscription',NEW.subscription,'order',s.order_id,'app',o.game,
+ 'reference',(SELECT value FROM meta WHERE key='shop-reference:' || o.id),
+ 'invoice',NEW.invoice,'amount',NEW.amount,'currency',NEW.currency,'mode',o.mode),NEW.at
+ FROM shop_subscriptions s JOIN shop_orders o ON o.id=s.order_id
+ WHERE s.id=NEW.subscription AND EXISTS(SELECT 1 FROM function_subscriptions WHERE type=NEW.type);
+END;
+`;
+const idOf = x => typeof x === 'string' ? x : x?.id;
+export async function bindSubscription(env, order, session, shop) {
+  const subscription=idOf(session.subscription), customer=idOf(session.customer);
+  if (!subscription || !customer || !/^sub_[A-Za-z0-9]+$/.test(subscription) || !/^cus_[A-Za-z0-9]+$/.test(customer)) throw new Error('Stripe subscription identity missing');
+  await env.DB.batch([
+    env.DB.prepare('INSERT OR IGNORE INTO shop_subscriptions(id,order_id,customer) VALUES(?1,?2,?3)').bind(subscription,order.id,customer),
+    env.DB.prepare(`INSERT OR IGNORE INTO shop_subscription_events(id,subscription,type,invoice,amount,currency,at)
+      VALUES(?1,?2,'subscription.started',NULL,?3,?4,?5)`).bind(`started:${subscription}`,subscription,order.amount,order.currency,order.paid_at),
+  ]);
+  await reconcileMembership(env, subscription, shop);
+  if(!hasStripeKey(env)) {
+    const invoice=typeof session.invoice==='string'?session.invoice:session.invoice?.id;
+    if(invoice) {
+      const saved=await env.DB.prepare('SELECT value FROM meta WHERE key=?1').bind(`shop-invoice:${invoice}`).first();
+      if(saved)await invoiceMembership(env,subscription,JSON.parse(saved.value));
+    }
+  }
+}
+
+/** Stripe retries unknown subscriptions until their Checkout has established ownership.
+ * Ignore unrelated invoices, and never infer a successful renewal from a status update. */
+export async function subscriptionEvent(env, event, shop) {
+  if (!['invoice.paid','invoice.payment_failed','customer.subscription.updated','customer.subscription.deleted'].includes(event.type)) return null;
+  const obj=event.data.object;
+  const subscription=event.type.startsWith('customer.subscription.') ? obj.id : idOf(obj.parent?.subscription_details?.subscription ?? obj.subscription);
+  if (!subscription) return 'ignored';
+  let row;
+  try {
+    row=await env.DB.prepare('SELECT s.*,o.mode FROM shop_subscriptions s JOIN shop_orders o ON o.id=s.order_id WHERE s.id=?1').bind(subscription).first();
+  } catch (error) {
+    // Existing studios have no subscription ownership until they opt in and migrate.
+    // Preserve retries for database failures other than an absent opt-in table.
+    if (!/no such table: (?:main\.)?shop_subscriptions\b/.test(String(error?.message))) throw error;
+  }
+  if (!row) {
+    const metadata=obj.parent?.subscription_details?.metadata ?? obj.subscription_details?.metadata ?? obj.metadata;
+    if (metadata?.homie === 'shop-v1' || metadata?.homie === 'shop-links-v1') throw new Error('Subscription Checkout has not arrived; retry');
+    return 'ignored';
+  }
+  if (event.livemode !== (row.mode === 'live')) return 'ignored';
+  await reconcileMembership(env, subscription, shop);
+  if(event.type==='invoice.paid' && !hasStripeKey(env))await invoiceMembership(env,subscription,obj);
+  const at=(event.created ?? 0)*1000;
+  let type, state;
+  if (event.type === 'customer.subscription.deleted') { type='subscription.cancelled'; state='cancelled'; }
+  else if (event.type === 'invoice.paid') { if (obj.billing_reason === 'subscription_create') return 'initial'; type='subscription.renewed'; state='active'; }
+  else if (event.type === 'invoice.payment_failed') { type='subscription.failed'; state='past_due'; }
+  else { return 'updated'; } // Scheduling cancellation is not cancellation; Stripe sends deleted when it ends.
+  const eventId=type === 'subscription.renewed' ? `paid:${obj.id}` : event.id;
+  await env.DB.batch([
+    env.DB.prepare(`UPDATE shop_subscriptions SET state=?2,event_at=?3 WHERE id=?1 AND state!='cancelled' AND event_at<=?3 AND ?4=0`).bind(subscription,state,at,hasStripeKey(env)?1:0),
+    env.DB.prepare(`INSERT OR IGNORE INTO shop_subscription_events(id,subscription,type,invoice,amount,currency,at)
+      VALUES(?1,?2,?3,?4,?5,?6,?7)`).bind(eventId,subscription,type,event.type.startsWith('invoice.')?obj.id:null,obj.amount_paid??obj.amount_due??null,obj.currency??null,at),
+    ...(state === 'cancelled' ? [env.DB.prepare(`UPDATE shop_entitlement_lines SET ends_at=MIN(COALESCE(ends_at,?2),?2)
+      WHERE order_id=?1 AND line_id IN (SELECT id FROM shop_order_lines WHERE order_id=?1 AND json_extract(snapshot,'$.interval') IS NOT NULL)`)
+      .bind(row.order_id,at)] : []),
+  ]);
+  return type;
+}
+export async function subscriptionPortal(env, player, subscription, origin) {
+  const row=await env.DB.prepare(`SELECT s.customer FROM shop_subscriptions s JOIN shop_orders o ON o.id=s.order_id WHERE s.id=?1 AND o.player=?2`).bind(subscription,player).first();
+  if (!row) return null;
+  if(!hasStripeKey(env)) {
+    const url=linkConfig(env)?.portal;
+    return typeof url==='string' && /^https:\/\/billing\.stripe\.com\/p\/login\//.test(url)?url:null;
+  }
+  const portal=await stripeCall(env,'POST','/v1/billing_portal/sessions',{customer:row.customer,return_url:`${origin}/shop/`});
+  if (typeof portal?.url !== 'string' || new URL(portal.url).origin !== 'https://billing.stripe.com') throw new Error('Invalid Stripe portal response');
+  return portal.url;
+}
+
+/** Reconcile membership access from current provider truth, not delivery order.
+ * A subscription item stays attached to its original order line across portal plan
+ * changes. Only catalogued products can supply replacement grants. Unknown plans
+ * grant nothing. Financial order snapshots remain immutable.
+ */
+export async function reconcileMembership(env, subscription, shop) {
+  if (!hasStripeKey(env)) return;
+  const row = await env.DB.prepare(`SELECT s.*,o.player,o.status AS order_status,o.mode
+    FROM shop_subscriptions s JOIN shop_orders o ON o.id=s.order_id WHERE s.id=?1`).bind(subscription).first();
+  if (!row) return;
+  const lines = (await env.DB.prepare(`SELECT * FROM shop_order_lines WHERE order_id=?1
+    AND json_extract(snapshot,'$.interval') IS NOT NULL`).bind(row.order_id).all()).results;
+  if (!lines.length) return;
+  const revision = crypto.randomUUID(), syncKey = `subscription-sync:${subscription}`;
+  await env.DB.prepare('INSERT INTO meta(key,value) VALUES(?1,?2) ON CONFLICT(key) DO UPDATE SET value=excluded.value').bind(syncKey,revision).run();
+  const current = await stripeCall(env,'GET',`/v1/subscriptions/${subscription}`,{
+    expand:['items.data.price.product','latest_invoice'],
+  });
+  if (current.id !== subscription || idOf(current.customer) !== row.customer || current.livemode !== (row.mode === 'live')) throw new Error('Subscription identity mismatch');
+  if (current.items?.has_more) current.items = await allPages(env,'/v1/subscription_items',{subscription,expand:['data.price.product']});
+  const invoice = current.latest_invoice;
+  if (invoice?.lines?.has_more) invoice.lines = await allPages(env,`/v1/invoices/${invoice.id}/lines`);
+  // Every mutation is conditional on the read generation. A slower request cannot
+  // overwrite a newer reconciliation, including when Stripe events share a second.
+  const guard = `EXISTS(SELECT 1 FROM meta WHERE key=?1 AND value=?2)`;
+  const writes = [env.DB.prepare(`UPDATE shop_subscriptions SET state=?3 WHERE id=?4 AND ${guard}`)
+    .bind(syncKey,revision,current.status,subscription)];
+  const active = ['active','trialing','past_due'].includes(current.status) && row.order_status === 'paid';
+  const used = new Set();
+  for (const item of current.items?.data ?? []) {
+    const mappingKey = `subscription-item:${subscription}:${item.id}`;
+    const saved = await env.DB.prepare('SELECT value FROM meta WHERE key=?1').bind(mappingKey).first();
+    const product = item.price?.product;
+    let line = lines.find(l => l.id === saved?.value);
+    if (!line) line = lines.find(l => !used.has(l.id) && (product?.metadata?.line === l.id ||
+      [product?.metadata?.item,product?.metadata?.homie_item].includes(l.item) ||
+      (idOf(product) && JSON.parse(l.snapshot).stripeProduct === idOf(product))));
+    if (!line) continue;
+    used.add(line.id);
+    writes.push(env.DB.prepare(`INSERT INTO meta(key,value) SELECT ?3,?4 WHERE ${guard} ON CONFLICT(key) DO NOTHING`).bind(syncKey,revision,mappingKey,line.id));
+    const original = JSON.parse(line.snapshot);
+    const originalProduct = product?.metadata?.item === original.id || product?.metadata?.homie_item === original.id || (idOf(product) && original.stripeProduct === idOf(product));
+    const plan = originalProduct ? original : shop?.items?.find(p => p.interval && ((idOf(product) && p.stripeProduct === idOf(product)) || [product?.metadata?.item,product?.metadata?.homie_item].includes(p.id)));
+    // A paid invoice line identifies both the price and subscription item. A
+    // pending invoice/portal upgrade never creates an unpaid entitlement period.
+    const paidLine = invoice?.status === 'paid' && invoice.lines?.data?.find(l =>
+      (idOf(l.subscription_item ?? l.parent?.subscription_item_details?.subscription_item) === item.id) &&
+      idOf(l.price ?? l.pricing?.price_details?.price) === item.price.id &&
+      (l.amount ?? 0) >= 0);
+    const paidEnd = Number(paidLine?.period?.end) * 1000;
+    const previous = await env.DB.prepare('SELECT value FROM meta WHERE key=?1').bind(`subscription-period:${subscription}:${item.id}`).first();
+    const prior = previous ? JSON.parse(previous.value) : null;
+    const end = Number.isSafeInteger(paidEnd) && paidEnd > 0 ? paidEnd : prior?.price === item.price.id ? prior.end : 0;
+    const allowedEnd = active && plan && line.status !== 'refunded' ? Math.min(end, plan.ends ? Date.parse(plan.ends) : Infinity) : 0;
+    writes.push(env.DB.prepare(`INSERT INTO meta(key,value) SELECT ?3,?4 WHERE ${guard} ON CONFLICT(key) DO UPDATE SET value=excluded.value`)
+      .bind(syncKey,revision,`subscription-period:${subscription}:${item.id}`,JSON.stringify({price:item.price.id,end})));
+    // Retain old rows with zero access: removing them would activate the legacy
+    // aggregate fallback used by pre-line studios.
+    writes.push(env.DB.prepare(`UPDATE shop_entitlement_lines SET ends_at=0 WHERE line_id=?3 AND order_id=?4 AND ${guard}`).bind(syncKey,revision,line.id,row.order_id));
+    for (const key of row.player ? plan?.gives ?? [] : []) {
+      writes.push(env.DB.prepare(`INSERT INTO entitlements(player,key,item,order_id,starts_at,ends_at,state,used_at)
+        SELECT ?3,?4,?5,?6,0,?7,'active',NULL WHERE ${guard}
+        ON CONFLICT(player,key,order_id) DO UPDATE SET state=CASE WHEN ?8 THEN 'active' ELSE entitlements.state END`)
+        .bind(syncKey,revision,row.player,key,plan.id,row.order_id,allowedEnd,active?1:0));
+      writes.push(env.DB.prepare(`INSERT INTO shop_entitlement_lines(player,key,item,order_id,line_id,quantity,starts_at,ends_at,state)
+        SELECT ?3,?4,?5,?6,?7,?8,0,?9,'active' WHERE ${guard}
+        ON CONFLICT DO UPDATE SET item=excluded.item,quantity=excluded.quantity,ends_at=excluded.ends_at`)
+        .bind(syncKey,revision,row.player,key,plan.id,row.order_id,line.id,item.quantity,allowedEnd));
+    }
+  }
+  for (const line of lines) if (!used.has(line.id)) writes.push(env.DB.prepare(`UPDATE shop_entitlement_lines SET ends_at=0 WHERE line_id=?3 AND order_id=?4 AND ${guard}`).bind(syncKey,revision,line.id,row.order_id));
+  await env.DB.batch(writes);
+}
+
+async function allPages(env, path, params = {}) {
+  const data=[];let after;
+  for (;;) {
+    const page=await stripeCall(env,'GET',path,{...params,limit:100,starting_after:after});
+    data.push(...page.data);
+    if (!page.has_more) return {data,has_more:false};
+    const next=page.data.at(-1)?.id;
+    if (!next || next===after) throw new Error('Stripe pagination did not advance');
+    after=next;
+  }
+}
+
+/** Paid signed invoices grant only their stated periods. Failure never extends access. */
+async function invoiceMembership(env,subscription,invoice) {
+  if(invoice.status!=='paid' || invoice.lines?.has_more)throw new Error('Complete paid invoice required');
+  const row=await env.DB.prepare('SELECT s.*,o.player,o.status order_status FROM shop_subscriptions s JOIN shop_orders o ON o.id=s.order_id WHERE s.id=?1').bind(subscription).first();
+  if(!row || row.state==='cancelled' || row.order_status!=='paid')return;
+  const lines=(await env.DB.prepare('SELECT * FROM shop_order_lines WHERE order_id=?1').bind(row.order_id).all()).results;
+  const writes=[];
+  for(const l of lines) {
+    const item=JSON.parse(l.snapshot);
+    if(!item.interval)continue;
+    const paid=invoice.lines.data.find(x=>(x.price?.id??x.pricing?.price_details?.price)===item.stripePrice && x.quantity===l.quantity && x.amount>=0);
+    const end=Number(paid?.period?.end)*1000;
+    if(!Number.isSafeInteger(end)||end<=0)continue;
+    writes.push(env.DB.prepare('UPDATE shop_entitlement_lines SET ends_at=MAX(COALESCE(ends_at,0),?2) WHERE line_id=?1').bind(l.id,end));
+  }
+  if(writes.length)await env.DB.batch(writes);
+}