@homie-rocks/studio 0.51.7 → 0.52.0

package/guides/shop/SKILL.md

@@ -49,27 +49,34 @@ calling it; tool argument shapes can change. See https://docs.stripe.com/mcp.
 3. Append `{ "method": "POST", "path": "…", "params": {…}, "body": <Stripe response> }`
    for **writes as well as reads**. Keep this setup's observations across batches.
    Product creation includes its default Price; link creation expands line items.
-   Product and Price Search use studio/origin metadata. Existing links are fetched by
-   IDs from the verified configuration; Stripe has no Payment Link metadata search.
-   Keep `.studio/stripe-mcp.json` when moving the studio to another computer. Without
-   it, repeat creates use their idempotency keys; outside Stripe's idempotency retention
-   window, recover the studio's existing link IDs before setup to avoid duplicates.
-   Follow search `next_page` cursors. Search is eventually consistent: write responses
-   are the immediate evidence. On an uncertain write, retry its exact idempotency key;
-   never discard successful responses or invent IDs. Start a new read set when checking
-   later external edits, changing accounts, or changing mode.
+   Product and Price Search use studio/origin metadata. Payment Links use paginated
+   list reads with `expand[]=data.line_items`, then filter studio/origin metadata locally;
+   Stripe has no Payment Link metadata search. There is no per-link read loop.
+   The planner saves public observations in `.studio/stripe-mcp-observations.json` and
+   reuses them on the next call; send only new responses. Keep that file and
+   `.studio/stripe-mcp.json` when moving computers. Changed shop/slot settings refresh
+   mutable links while retaining product/price discovery. Account, mode and origin
+   changes start separate reads. Pass `refresh: true` for Dashboard changes or a fresh
+   verification before webhook installation (CLI: include it in `--have` input).
+   Follow search `next_page` and list `starting_after` cursors. On an uncertain write,
+   retry its exact idempotency key; never discard successful responses or invent IDs.
 4. Call `stripe_shop_plan` with `verify: true` using those observations (CLI
    `homie-studio shop verify --have plan-input.json`). Verification checks real fields,
    line items, menus, slot limits and portal settings. It saves compact public Worker
    configuration and provenance to `.studio/stripe-mcp.json`, never API response history.
-   Deploy installs those links. Checkout then reports only `webhook-secret` missing;
+   Build writes public links to `site/dist/_site/stripe-shop-links.json`; deploy ships
+   that asset, with only its path in Wrangler vars. Large catalogues never use a text
+   binding. Deploy after verifying, including when setup began on an already-live site. Checkout then reports only `webhook-secret` missing;
    it cannot open until signed payment events can confirm orders. Changing shop.json,
    the slot manifest or origin requires verification again. Local test configuration
    goes to `.dev.vars`.
 5. For a deployed HTTPS studio, run `stripe_webhook` (CLI `homie-studio shop webhook`).
    Follow `studio_job`. This uses Stripe CLI only for private webhook installation,
-   checks the same account as the MCP, and installs the signing secret and verified
-   links through Wrangler stdin. The CLI needs one separate browser approval if its
+   checks the same account as the MCP, and installs only the signing secret through
+   Wrangler stdin. If Stripe CLI is missing, the tool installs the official
+   `@stripe/cli@latest` npm package automatically, checks the executable, then continues.
+   An installation failure reports npm permissions/PATH and a retry command. The CLI
+   needs one separate browser approval if its
    studio profile is not already connected. MCP approval cannot be reused or exported.
    Cloudflare authorization and an existing deployment are prerequisites.
 6. After installation, perform the returned `retire` operations through Stripe MCP to
@@ -80,6 +87,14 @@ calling it; tool argument shapes can change. See https://docs.stripe.com/mcp.
    endpoint's delivery result and the app's verified records. Do not type a card into
    a page for an automated proof; use Stripe's documented test PaymentMethods/fixtures.
 
+Upgrades accept 0.51.6 verifications without a source fingerprint only when their
+saved content fingerprint still matches the current shop, slots, site and mode.
+Actual changes name the affected settings and require verification. An unfinished
+setup still builds and deploys with checkout closed and one next step: finish
+`stripe_shop_plan` with `verify: true`. Missing/unreadable assets also close checkout;
+old link secrets cannot reopen it. Cached observations never renew the verification
+time; use fresh reads if the private webhook tool requests them.
+
 Never create a webhook through model-visible Stripe MCP: its response exposes the signing secret.
 
 **Why the separate approval (checked 2026-10-14).** Stripe's

package/guides/studio-setup/SKILL.md

@@ -409,3 +409,7 @@ and slug. It fills missing generated files and retries installation, preserving
 already there. A different studio or unrelated nonempty folder is still refused.
 New studios do not request a directory listing by default; set `homie.directory: true`
 or a directory URL only when the person chooses listing.
+
+Cloudflare's official MCP request interface cannot authorize new static-asset uploads with an upload JWT; deploy with Wrangler, Cloudflare's own CLI using browser OAuth.
+
+An owner's existing Wrangler login can connect another studio without a new browser approval: in that studio run `homie-studio connector --tools <exact-tool-names> --out <private-config.json>`, then load the file directly into the AI client's connector configuration. Never print the bearer or paste the file in chat. Revoke with `homie-studio connector --revoke <id>`. See the installed `docs/toolkit-place-patterns.md` for scope and expiry.

package/lib/app-needs.mjs

@@ -23,7 +23,7 @@ export function readAppNeeds(root, id) {
 }
 
 /** Run real UI actions. A failed or absent flow stays visible; continue collecting other needs. */
-export async function proveAppNeeds({ plan, surfaces, shots, report, ready = async () => {}, root, headless }) {
+export async function proveAppNeeds({ plan, surfaces, shots, report, ready = async () => {}, root, headless, restart }) {
   const results = [];
   const appBarrier=ready;
   ready=async (s,options)=>{await s.page.bringToFront?.();if(s.external){s.frame=s.page.mainFrame();return;}await appBarrier(s,options);};
@@ -31,7 +31,7 @@ export async function proveAppNeeds({ plan, surfaces, shots, report, ready = asy
   const surface = name => { const s = surfaces.find(s => s.name === name && (!activeRole || s.role === activeRole)) ?? surfaces.find(s => s.name === name); if (!s) throw new Error(`unknown surface ${name}`); return s; };
   for (const need of plan.needs) {
     activeRole = need.role;
-    const names = [...new Set([...(need.steps ?? []), ...(need.assertions ?? [])].map(s => s.surface).filter(Boolean))];
+    const names = [...new Set([...needSteps(need.steps), ...(need.assertions ?? [])].map(s => s.surface).filter(Boolean))];
     const saved = new Map();
     const run = async item => { if (!headless) throw new Error('headless MCP proof requires local dev and its test credential'); return headless(item,item.role ?? need.role); };
     let waiting = 'validating assertions';
@@ -41,19 +41,34 @@ export async function proveAppNeeds({ plan, surfaces, shots, report, ready = asy
       const popupNames=new Set((need.steps??[]).map(s=>s.popup).filter(Boolean));
       for (const name of names) { if(popupNames.has(name))continue; const s = surface(name); if (need.role && s.role !== need.role) throw new Error(`${name} requires role ${need.role}, got ${s.role ?? 'unspecified'}`); }
       for (const name of new Set(need.assertions.filter(a => a.effect).map(a => a.surface))) await surface(name).frame.evaluate(() => { window.__homieNeedsEffects = []; });
-      for (const rawStep of need.steps ?? []) {
+      const perform = async rawStep => {
         const step=resolveNeedResults(rawStep,saved);
+        if(step.concurrent){
+          if(!Array.isArray(step.concurrent)||step.concurrent.length<2)throw new Error('concurrent needs at least two steps');
+          if(needSteps(step.concurrent).some(s=>s.restart||s.capabilities))throw new Error('Restart and capabilities changes must be outside a race');
+          const results=await Promise.allSettled(step.concurrent.map(perform));
+          const failed=results.find(r=>r.status==='rejected');if(failed)throw failed.reason;return;
+        }
+        if(step.restart){if(!restart)throw new Error('Restart requires the local dev controller');await restart();for(const s of surfaces)await ready(s);return;}
+
         if (step.mcp || step.schedule) {
           waiting = step.mcp ? `MCP ${step.mcp.tool ?? step.mcp.method} as ${step.role ?? need.role ?? 'unspecified'}` : `schedule ${step.schedule.name}`;
           const value = await run(step);
           if (step.save) { if(saved.has(step.save))throw new Error(`duplicate saved result ${step.save}`); saved.set(step.save,value); }
-          continue;
+          return;
         }
         const target=surface(step.surface);
         if(!step.reload)await ready(target);
         const { page } = target;
+        if(step.capabilities){
+          if(typeof step.capabilities.webgl!=='boolean')throw new Error('capabilities.webgl must be boolean');
+          await page.evaluateOnNewDocument(configureWebGL,step.capabilities.webgl);
+          await page.reload({waitUntil:'domcontentloaded'});await ready(target);return;
+        }
+        if(Object.hasOwn(step,'clock')){await page.evaluate(value=>window.homieApp.setTestClock(value),step.clock);return;}
+
         waiting = `${step.surface}: ${step.reload ? 'reload and arrival readiness' : step.selector}`;
-        if (step.reload) { await page.reload({ waitUntil: 'domcontentloaded' }); await ready(surface(step.surface)); continue; }
+        if (step.reload) { await page.reload({ waitUntil: 'domcontentloaded' }); await ready(surface(step.surface)); return; }
         const act = fn => actInApp(target,step.selector,fn,{ready});
         if (step.click && step.popup) {
           let listener,timer;
@@ -67,11 +82,15 @@ export async function proveAppNeeds({ plan, surfaces, shots, report, ready = asy
             await page.bringToFront();
           } finally {clearTimeout(timer);page.off('popup',listener);}
         }
+        else if(step.forceClick){await act(frame=>frame.$eval(step.selector,el=>{
+          const disabled=el.disabled;try{el.disabled=false;el.click();}finally{el.disabled=disabled;}
+        }));}
         else if (step.click) {await act(frame=>frame.click(step.selector));await page.bringToFront?.();}
         else if (step.fill !== undefined) { await act(async frame=>{ await frame.$eval(step.selector, el => { el.value = ''; el.dispatchEvent(new Event('input', { bubbles: true })); }); await frame.type(step.selector, String(step.fill)); }); }
         else if (step.select !== undefined) await act(frame=>frame.select(step.selector, String(step.select)));
         else throw new Error('step needs click, fill, select or reload');
-      }
+      };
+      for(const step of need.steps??[])await perform(step);
       for (const rawAssertion of need.assertions) {
         const assertion=resolveNeedResults(rawAssertion,saved);
         if (assertion.result || assertion.records || assertion.file || assertion.mcp) {
@@ -170,3 +189,19 @@ export function resolveNeedResults(value,saved) {
   }
   return value;
 }
+
+/** Flatten only action groups; used for browser/role discovery before a race starts. */
+export function needSteps(steps = []) { return steps.flatMap(s => s.concurrent ? needSteps(s.concurrent) : [s]); }
+export function configureWebGL(enabled) {
+  window.__homieWebGLDisabled = !enabled;
+  if(window.__homieWebGLWrapped)return;
+  window.__homieWebGLWrapped = true;
+  for(const proto of [globalThis.HTMLCanvasElement?.prototype,globalThis.OffscreenCanvas?.prototype]) {
+    if(!proto)continue;
+    const original = proto.getContext;
+    proto.getContext = function(kind, ...args) {
+      if(window.__homieWebGLDisabled && /^(webgl2?|experimental-webgl)$/.test(kind))return null;
+      return Reflect.apply(original,this,[kind,...args]);
+    };
+  }
+}

package/lib/app-ready.mjs

@@ -56,6 +56,28 @@ export async function actInApp(surface, selector, action, {ready=appReady,timeou
   for (;;) {
     try {
       await waitInApp(surface,selector,frame=>frame.waitForSelector(selector,{visible:true,timeout:Math.max(1,end-Date.now())}),{ready,timeout:Math.max(1,end-Date.now())});
+      const handle=await surface.frame.$?.(selector);
+      if(handle)try {
+        await handle.scrollIntoView();
+        const point=await handle.clickablePoint();
+        const ancestors=[];
+        for(let frame=surface.frame;frame.parentFrame();frame=frame.parentFrame())ancestors.unshift(await frame.frameElement());
+        const describeHit=(el,p)=>{
+          const hit=document.elementFromPoint(p.x,p.y);
+          return hit&&!el.contains(hit)?hit.tagName.toLowerCase()+(hit.id?'#'+hit.id:'')+[...hit.classList].map(c=>'.'+c).join(''):null;
+        };
+        let local={...point};
+        try {
+          for(const ancestor of ancestors){
+            const covered=await ancestor.evaluate(describeHit,local);
+            if(covered)throw new Error(`${surface.name}: ${selector} is covered at the click point by ${covered}`);
+            const offset=await ancestor.evaluate(el=>{const r=el.getBoundingClientRect();return {x:r.x+el.clientLeft,y:r.y+el.clientTop};});
+            local={x:local.x-offset.x,y:local.y-offset.y};
+          }
+          const covered=await handle.evaluate(describeHit,local);
+          if(covered)throw new Error(`${surface.name}: ${selector} is covered at the click point by ${covered}`);
+        }finally{await Promise.all(ancestors.map(h=>h.dispose()));}
+      }finally{await handle.dispose();}
       return await action(surface.frame);
     } catch(error) {
       if(!/node is detached|element.*(?:detach|stale)|stale.*element/i.test(error.message)) {
@@ -69,3 +91,12 @@ export async function actInApp(surface, selector, action, {ready=appReady,timeou
     }
   }
 }
+
+/** Install before navigation: every app iframe observes a real context creation failure. */
+export function forceWebglFailure() {
+ for(const proto of [globalThis.HTMLCanvasElement?.prototype,globalThis.OffscreenCanvas?.prototype]) {
+  if(!proto)continue;
+  const original=proto.getContext;
+  proto.getContext=function(kind,...args){return /^(webgl2?|experimental-webgl)$/.test(kind)?null:Reflect.apply(original,this,[kind,...args]);};
+ }
+}

package/lib/build.mjs

@@ -1,3 +1,4 @@
+import {verifiedMcpConfig,publicMcpSetup} from './shop-mcp.mjs';
 import { directoryUrl } from '../worker/directory-choice.mjs';
 import { domainOrigin } from './studio.mjs';
 import { appProblems } from '../worker/app-format.mjs';
@@ -686,6 +687,10 @@ async function buildInto(dist, { esbuild, studio, shop, live, games, before, typ
   // GAME PARTS: every packed version of every SHARED part into dist/parts/, and its index; a private part is never copied.
   const partsBuilt = buildParts(root, dist, { studio, log });
   mkdirSync(join(dist, '_site'), { recursive: true });
+  if(publicMcpSetup(root)) {
+    const verified=verifiedMcpConfig(root);
+    writeFileSync(join(dist,'_site','stripe-shop-links.json'),JSON.stringify({config:verified?.result.config??null,next:verified?null:'Ask your AI to finish stripe_shop_plan with verify:true.'}));
+  }
   writeFileSync(join(dist, '_site', 'posts.json'), `${JSON.stringify({ v: 1, posts })}\n`);
   const studioExtras = schemaExtras(s.schema, { where: 'studio.json site', types: 'Organization', log });
   // The Lounge (0.29.0): studio.json "lounge", checked; off when a game already has /lounge/.

package/lib/check.mjs

@@ -1,8 +1,8 @@
 import {needsHeadless} from './needs-headless.mjs';
 import {randomBytes} from 'node:crypto';
-import {actInApp,appReady,observeEffects,waitInApp,answerDialogs} from './app-ready.mjs';
+import {actInApp,appReady,observeEffects,forceWebglFailure,waitInApp,answerDialogs} from './app-ready.mjs';
 import {localCredential,localCookie} from './local-test.mjs';
-import { readAppNeeds, proveAppNeeds, saveAppNeeds } from './app-needs.mjs';
+import { readAppNeeds, proveAppNeeds, saveAppNeeds, needSteps } from './app-needs.mjs';
 /**
  * `homie-studio check [<game>] [--url <site> | --live]` — the promise, measured (where it runs and on which games
  * when nobody says: lib/check-site.mjs; never the live site unless asked): two fresh
@@ -132,7 +132,7 @@ export function judgeRounds(browsers, missed = new Map()) {
   return null;
 }
 
-export async function check({ isolate = true, root = null, url, game, roundTimeoutMs = 150_000, rounds = 3, shots = null, userAgentTag = 'homie-studio-check', log = () => {}, report = null }) {
+export async function check({ webglFailure = false, isolate = true, root = null, url, game, roundTimeoutMs = 150_000, rounds = 3, shots = null, userAgentTag = 'homie-studio-check', log = () => {}, report = null }) {
   if (!url || !game) throw new Error('usage: homie-studio check <game> --url <site url>');
   const base = String(url).replace(/\/+$/, '');
   const play = `${base}/${game}/play`;
@@ -152,14 +152,15 @@ export async function check({ isolate = true, root = null, url, game, roundTimeo
   if(appMeta && !appMeta.check?.action) {
     try {
       const plan=readAppNeeds(root,game);
-      if(plan && !plan.needs.some(n=>[...(n.steps??[]),...(n.assertions??[])].some(i=>i.surface)))return checkApp({isolate,root,url:base,game,meta:appMeta,shots,log,report});
+      if(plan && !plan.needs.some(n=>[...needSteps(n.steps),...(n.assertions??[])].some(i=>i.surface)))return checkApp({webglFailure,isolate,root,url:base,game,meta:appMeta,shots,log,report});
     } catch(error) {return {ok:false,command:'check',kind:'app',why:error.message};}
   }
   const chrome = findChrome();
   if (!chrome) return { ok: false, command: 'check', why: noChrome() };
   let puppeteer;
   try { puppeteer = (await import('puppeteer-core')).default; } catch { return { ok: false, command: 'check', why: 'puppeteer-core is not installed (it comes with @homie-rocks/studio; run npm install)' }; }
-  if (appMeta) return checkApp({ isolate, root, url: base, game, meta: appMeta, shots, log, report, puppeteer, chrome });
+  if (appMeta) return checkApp({ webglFailure, isolate, root, url: base, game, meta: appMeta, shots, log, report, puppeteer, chrome });
+  if(webglFailure)return {ok:false,command:'check',why:'--webgl-failure requires an app with UI checks'};
   if (shots) mkdirSync(shots, { recursive: true });
   const profiles = [];
   const browsers = [];
@@ -354,7 +355,7 @@ export async function check({ isolate = true, root = null, url, game, roundTimeo
 }
 
 /** Apps prove a real action crossing surfaces and a reconnect, without inventing a round. */
-export async function checkApp({ isolate = true, root = null, url, game, meta, shots = null, log = () => {}, report = null, puppeteer, chrome }) {
+export async function checkApp({ webglFailure = false, isolate = true, root = null, url, game, meta, shots = null, log = () => {}, report = null, puppeteer, chrome }) {
   let plan;
   try { plan = readAppNeeds(root, game); } catch (error) { return { ok: false, command: 'check', kind: 'app', why: error.message }; }
   const secret=localCredential(root,url);
@@ -364,13 +365,14 @@ export async function checkApp({ isolate = true, root = null, url, game, meta, s
   const proof = meta.check??{};
   const baseline=typeof proof.action==='string'&&typeof proof.observe==='string';
   if (!baseline && !plan) return { ok: false, command: 'check', kind: 'app', why: 'app.json check needs action and observe CSS selectors for a real shared action' };
+  if(webglFailure&&!baseline&&!plan?.needs.some(n=>[...needSteps(n.steps),...(n.assertions??[])].some(i=>i.surface)))return {ok:false,command:'check',why:'--webgl-failure requires UI steps or assertions'};
   const captureWarnings=[];
   const profile = mkdtempSync(join(tmpdir(), 'homie-app-check-'));
   let browser;
   const surfaces = [];
   const room = `check-${randomBytes(10).toString('hex')}`;
   try {
-    if(baseline || plan?.needs.some(n=>[...(n.steps??[]),...(n.assertions??[])].some(i=>i.surface))) browser = await puppeteer.launch({ executablePath: chrome, headless: true, userDataDir: profile, timeout: LAUNCH_TIMEOUT_MS, args: chromeArgs() });
+    if(baseline || plan?.needs.some(n=>[...needSteps(n.steps),...(n.assertions??[])].some(i=>i.surface))) browser = await puppeteer.launch({ executablePath: chrome, headless: true, userDataDir: profile, timeout: LAUNCH_TIMEOUT_MS, args: chromeArgs() });
     const openSurface = async (name, role) => {
       const dimensions={wall:[1280,720],phone:[390,844],'phone-two':[390,844],tablet:[1024,768],staff:[1024,768],kiosk:[1080,1920]};
       if(!dimensions[name])throw new Error(`Unknown needs surface ${name}`);
@@ -382,6 +384,7 @@ export async function checkApp({ isolate = true, root = null, url, game, meta, s
       const page=await context.newPage();
       answerDialogs(page,name,dialogs,report);
       await page.evaluateOnNewDocument(observeEffects);
+      if(webglFailure)await page.evaluateOnNewDocument(forceWebglFailure);
       const [width,height]=dimensions[name];
       await page.setViewport({width,height,isMobile:name!=='wall',hasTouch:name!=='wall'});
       const params=new URLSearchParams(proof.params??{});params.set('room',room);params.set('role',role);params.set('surface',name==='staff'?'tablet':name==='phone-two'?'phone':name);
@@ -414,16 +417,16 @@ export async function checkApp({ isolate = true, root = null, url, game, meta, s
     }
     report?.check?.('app-action', 'pass', { note: 'action reached wall and both phones; reconnect retained it' });
     }
-    for(const need of plan?.needs??[])for(const item of [...(need.steps??[]),...(need.assertions??[])]) {
+    for(const need of plan?.needs??[])for(const item of [...needSteps(need.steps),...(need.assertions??[])]) {
       if(!item.surface)continue;
       if(plan.needs.some(n=>(n.steps??[]).some(s=>s.popup===item.surface)))continue;
       const role=item.role??need.role??meta.surfaces?.[item.surface]??(item.surface==='staff'?'staff':undefined);
       if(!surfaces.some(s=>s.name===item.surface&&s.role===role))await openSurface(item.surface,role);
     }
-    const needs = plan ? await proveAppNeeds({ plan, surfaces, shots, report, ready:appReady, root, headless:needsHeadless({url,secret,app:game,meta,scope:isolate?room:null}) }) : null;
+    const needs = plan ? await proveAppNeeds({ plan, surfaces, shots, report, ready:appReady, root, restart:()=>import('./dev-restart.mjs').then(m=>m.requestDevRestart(root,url)), headless:needsHeadless({url,secret,app:game,meta,scope:isolate?room:null}) }) : null;
     if (plan) { saveAppNeeds(root, game, plan, needs); const { refreshCodexFile } = await import('./codex.mjs'); refreshCodexFile(root, game); }
     const ok = !needs || needs.every(n => n.status === 'met');
-    return { ok, ...(needs ? { needs, why: ok ? undefined : 'Some needs from the person’s Codex are not yet met; see needs and captures' } : {}), command: 'check', kind: 'app', isolatedRecords:isolate, captureWarnings, dialogs, room, surfaces: surfaces.map((s) => s.name), action: proof.action, before, after, reconnect: baseline };
+    return { ok, ...(needs ? { needs, why: ok ? undefined : 'Some needs from the person’s Codex are not yet met; see needs and captures' } : {}), command: 'check', kind: 'app', webglFailure, isolatedRecords:isolate, captureWarnings, dialogs, room, surfaces: surfaces.map((s) => s.name), action: proof.action, before, after, reconnect: baseline };
   } catch (error) { return { ok: false, command: 'check', kind: 'app', dialogs, why: error.message }; }
   finally { await browser?.close().catch(() => {}); rmSync(profile, { recursive: true, force: true }); }
 }

package/lib/cloudflare.mjs

@@ -595,8 +595,8 @@ export function configNames(root) {
  * nothing back (a CI checkout is thrown away). On the very first deploy the database may not exist yet: Wrangler
  * creates the one the binding names while it deploys, and the migrations run right after.
  */
-export async function ciDeploy(root, { log = () => {} } = {}) {
-  const w = runner(root, {});
+export async function ciDeploy(root, { log = () => {}, wrangler = null } = {}) {
+  const w = wrangler ?? runner(root, {});
   refreshWorkerConfig(root);
   const names = configNames(root);
   const steps = [];

package/lib/connector-token.mjs

@@ -0,0 +1,30 @@
+import {randomBytes,createHash} from 'node:crypto';
+import {mkdtempSync,writeFileSync,rmSync} from 'node:fs';
+import {tmpdir} from 'node:os';
+import {join,resolve} from 'node:path';
+import {runner,configNames} from './cloudflare.mjs';
+import {siteUrl} from './studio.mjs';
+/** D1 administration uses the owner's existing Wrangler login. No bearer enters stdout or argv. */
+export async function connectorToken(root,{url,tools,out,revoke,days=30,execute}={}) {
+ const run=execute??(async file=>{const names=configNames(root);if(!names.d1)throw new Error('Studio database is not configured');const result=runner(root)(['d1','execute',names.d1,'--remote','--file',file]);if(result.code!==0)throw new Error('Connector token database operation failed; check the existing Wrangler login and studio database');});
+ const scratch=mkdtempSync(join(tmpdir(),'homie-connector-'));
+ const sql=async text=>{const file=join(scratch,'token.sql');writeFileSync(file,text,{mode:0o600});await run(file);};
+ const quote=value=>"'"+value.replaceAll("'","''")+"'";
+ try {
+ if(revoke){if(!/^[a-f0-9]{64}$/.test(revoke))throw new Error('Invalid connector id');await sql(`DELETE FROM mcp_kv WHERE key='connector:${revoke}';`);return {ok:true,command:'connector',revoked:revoke};}
+ if(!Array.isArray(tools)||!tools.length||tools.length>100||tools.some(t=>! /^[a-zA-Z0-9_-]{1,128}$/.test(t)))throw new Error('Provide explicit tool names with --tools (no wildcard)');
+ if(!out)throw new Error('Provide --out for the private connector configuration');
+ if(!Number.isInteger(days)||days<1||days>90)throw new Error('Expiry must be 1–90 days');
+ const origin=new URL(url??siteUrl(root)).origin;if(!origin.startsWith('https://'))throw new Error('Connector requires HTTPS');
+ const token='homie_owner_'+randomBytes(32).toString('hex');const id=createHash('sha256').update(token).digest('hex');
+ const expires=Math.floor(Date.now()/1000)+days*86400;
+ const value=JSON.stringify({origin,tools:[...new Set(tools)],expires});
+ // Reserve the destination before minting; never overwrite a credential or follow a symlink.
+ const path=resolve(root,out);writeFileSync(path,'',{flag:'wx',mode:0o600});
+ try{
+ await sql(`INSERT INTO mcp_kv(key,value,expires) VALUES('connector:${id}',${quote(value)},${expires});`);
+ writeFileSync(path,JSON.stringify({mcpServers:{studio:{url:origin+'/mcp/auth',headers:{Authorization:'Bearer '+token}}}},null,2)+'\n',{mode:0o600});
+ }catch(error){rmSync(path,{force:true});throw error;}
+ return {ok:true,command:'connector',id,file:path,expires,tools:[...new Set(tools)]};
+ }finally{rmSync(scratch,{recursive:true,force:true});}
+}

package/lib/dev-restart.mjs

@@ -0,0 +1,25 @@
+import {readFileSync,writeFileSync,rmSync} from 'node:fs';
+import {join} from 'node:path';
+import {randomUUID} from 'node:crypto';
+import {localCredential} from './local-test.mjs';
+const read=file=>{try{return JSON.parse(readFileSync(file,'utf8'));}catch{return null;}};
+export function takeDevRestart(root,secret){
+ const file=join(root,'.studio','restart-request.json'),value=read(file);
+ if(!value)return null;
+ rmSync(file,{force:true});
+ return value.secret===secret&&typeof value.id==='string'?value.id:null;
+}
+export function acknowledgeDevRestart(root,id){writeFileSync(join(root,'.studio','restart-result.json'),JSON.stringify({id}),{mode:0o600});}
+export async function requestDevRestart(root,url,{timeout=60000}={}){
+ const secret=localCredential(root,url);if(!secret)throw new Error('Restart requires this studio’s local dev credential');
+ const id=randomUUID(),file=join(root,'.studio','restart-request.json');
+ writeFileSync(file,JSON.stringify({id,secret}),{mode:0o600});
+ try{
+  const end=Date.now()+timeout;
+  while(Date.now()<end){
+   if(read(join(root,'.studio','restart-result.json'))?.id===id)return;
+   await new Promise(resolve=>setTimeout(resolve,100));
+  }
+  throw new Error('Dev did not acknowledge restart; run the current homie-studio dev');
+ }finally{if(read(file)?.id===id)rmSync(file,{force:true});}
+}

package/lib/dev.mjs

@@ -1,3 +1,4 @@
+import {takeDevRestart,acknowledgeDevRestart} from './dev-restart.mjs';
 import {createLocalCredential} from './local-test.mjs';
 import {workerEntry} from './worker-build.mjs';
 import { networkInterfaces } from 'node:os';
@@ -371,7 +372,7 @@ export async function dev(root, { lan = false, port: askedPort = 8787, remoteAi
 
   let child = null;
   let ending = false;
-  let restart = null;
+  let restart = null, proofRestart = null;
   let failed = null;
   const lineState = {};
   // Stopping this process stops Wrangler with it, so no dev server is left running on its own.
@@ -395,6 +396,9 @@ export async function dev(root, { lan = false, port: askedPort = 8787, remoteAi
     if (busy || ending || restart || !up) return;
     busy = true;
     try {
+      const requested=takeDevRestart(root,localSecret);
+      if(requested){proofRestart=requested;restart='proof';child?.kill('SIGTERM');return;}
+
       const built = builtIds(root);
       if (!built) return; // mid-build: site/dist is being written
       for (const g of listGames(root)) {
@@ -490,6 +494,7 @@ export async function dev(root, { lan = false, port: askedPort = 8787, remoteAi
       await new Promise((r) => setTimeout(r, 500));
     }
     if (!up) return;
+    if(proofRestart){acknowledgeDevRestart(root,proofRestart);proofRestart=null;}
     const game = (builtIds(root) ?? [])[0];
     if (!game) return;
     const bad = await socketOriginProblem(origin, game);

package/lib/functions-build.mjs

@@ -1,3 +1,4 @@
+import {CfWorkerJsonSchemaValidator} from '@modelcontextprotocol/server/validators/cf-worker';
 import {callbackUrl} from '../worker/mcp-events-wire.mjs';
 import {validateWebhook,webhookName} from '../worker/event-webhook-config.mjs';
 import {parseSchedule,nextDue,scheduleStatus} from '../worker/function-schedule.mjs';
@@ -12,6 +13,7 @@ export async function buildFunctions(root,esbuild,{log=()=>{}}={}) {
   const feeds=readStudio(root).mcp?.events??{};
   if(!feeds||typeof feeds!=='object'||Array.isArray(feeds))throw new Error('mcp.events must be a map of named event feeds');
   for(const [name,feed] of Object.entries(feeds)) {
+    if(feed?.schema)new CfWorkerJsonSchemaValidator().getValidator(feed.schema);
     if(feed?.webhook)validateWebhook(name,feed.webhook);
     if(feed?.maxSubscriptions!==undefined&&(!Number.isSafeInteger(feed.maxSubscriptions)||feed.maxSubscriptions<1))throw new Error('maxSubscriptions must be a positive integer');
     if(feed?.receivers!==undefined){if(!Array.isArray(feed.receivers))throw new Error('Event receivers must be an array of exact HTTPS callback URLs');for(const url of feed.receivers)callbackUrl(url);}
@@ -37,6 +39,7 @@ export async function buildFunctions(root,esbuild,{log=()=>{}}={}) {
       try {if(nextDue(parseSchedule(fn.schedule))===null)throw new Error('no matching date');}
       catch(error) {throw new Error(`Function ${fn.name} cannot run: invalid schedule ${JSON.stringify(fn.schedule)} (${error.message})`);}
     }
+    for(const name of fn.publish??[])if(!feeds[name]?.schema)throw new Error(`Function ${fn.name}: publish feed ${name} needs a declared schema`);
     names.add(fn.name);
   }
   const worker=join(root,'site/src/worker.mjs');

package/lib/mcp-tools.mjs

@@ -1178,8 +1178,8 @@ export function toolDefs(ctx, avail = {}) {
     },
     {
       name: 'stripe_shop_plan', title: 'Plan or verify the Stripe shop',
-      description: 'Default setup with Stripe official MCP. Supply public API observations as {method,path,params,body}, account ID, mode, and complete booking slots. Returns every independent operation in a dependency-ordered batch, with metadata and idempotency. Execute via Stripe stripe_api_search/details/read/write, retain write responses as observations and replan until verified. verify:true saves compact public config for deploy and stripe_webhook. Never pass webhook creation responses or secrets.',
-      inputSchema: {type:'object',properties:{...STUDIO_ARG,account:{type:'string'},mode:{enum:['test','live']},url:{type:'string'},slots:{type:'array',items:{type:'object'}},observations:{type:'array',items:{type:'object'}},verify:{type:'boolean'}}},
+      description: 'Default setup with Stripe official MCP. Supply public API observations as {method,path,params,body}, account ID, mode, and complete booking slots. Returns every independent operation in a dependency-ordered batch, with metadata and idempotency. Execute via Stripe stripe_api_search/details/read/write, supply new write responses as observations and replan until verified; earlier public observations are saved automatically. refresh:true checks external Stripe changes using paginated expanded link lists. verify:true saves compact public config for deploy and stripe_webhook. Never pass webhook creation responses or secrets.',
+      inputSchema: {type:'object',properties:{...STUDIO_ARG,account:{type:'string'},mode:{enum:['test','live']},url:{type:'string'},slots:{type:'array',items:{type:'object'}},observations:{type:'array',items:{type:'object'}},verify:{type:'boolean'},refresh:{type:'boolean',description:'Discard saved observations and read current Stripe state (after Dashboard edits or before private webhook installation).'}}},
       annotations:{readOnlyHint:false,destructiveHint:false,openWorldHint:false},
       run:async a=>{
         const {shopMcpPlan,saveMcpVerification}=await import('./shop-mcp.mjs');

package/lib/scaffold.mjs

@@ -1,3 +1,6 @@
+import {BOOKING_HOLDS_MIGRATION,BOOKING_HOLDS_MIGRATION_FILE} from '../worker/booking-holds.mjs';
+import {BUSINESS_EVENTS_MIGRATION,BUSINESS_EVENTS_MIGRATION_FILE} from '../worker/business-events.mjs';
+import {APP_LIVE_MIGRATION,APP_LIVE_MIGRATION_FILE} from '../worker/app-streams.mjs';
 import {TOOL_DATABASE_MIGRATION,TOOL_DATABASE_MIGRATION_FILE} from '../worker/tool-database.mjs';
 import { SUBSCRIPTIONS_MIGRATION, SUBSCRIPTIONS_MIGRATION_FILE } from '../worker/shop-subscriptions.mjs';
 import { BOOKINGS_MIGRATION, BOOKINGS_MIGRATION_FILE } from '../worker/booking-store.mjs';
@@ -823,6 +826,9 @@ export { default, Table, Lobby, Gate, Concentrator } from '@homie-rocks/studio/w
     [`site/migrations/${SHOP_LINES_FILE}`]: SHOP_LINES,
     [`site/migrations/${SHOP_REMOVE_REFERRALS_FILE}`]: SHOP_REMOVE_REFERRALS,
     [`site/migrations/${APPS_MIGRATION_FILE}`]: APPS_MIGRATION,
+    [`site/migrations/${BUSINESS_EVENTS_MIGRATION_FILE}`]: BUSINESS_EVENTS_MIGRATION,
+    [`site/migrations/${BOOKING_HOLDS_MIGRATION_FILE}`]: BOOKING_HOLDS_MIGRATION,
+    [`site/migrations/${APP_LIVE_MIGRATION_FILE}`]: APP_LIVE_MIGRATION,
     [`site/migrations/${TOOL_DATABASE_MIGRATION_FILE}`]: TOOL_DATABASE_MIGRATION,
     [`site/migrations/${BOOKINGS_MIGRATION_FILE}`]: BOOKINGS_MIGRATION,
     [`site/migrations/${SUBSCRIPTIONS_MIGRATION_FILE}`]: SUBSCRIPTIONS_MIGRATION,
@@ -1048,8 +1054,23 @@ function ensureToolDatabase(root) {
   if(existsSync(file))return null;
   mkdirSync(dirname(file),{recursive:true});writeFileSync(file,TOOL_DATABASE_MIGRATION);return `site/migrations/${TOOL_DATABASE_MIGRATION_FILE}`;
 }
+function ensureAppLive(root) {
+  const file=join(root,'site','migrations',APP_LIVE_MIGRATION_FILE);
+  if(existsSync(file))return null;
+  mkdirSync(dirname(file),{recursive:true});writeFileSync(file,APP_LIVE_MIGRATION);return `site/migrations/${APP_LIVE_MIGRATION_FILE}`;
+}
+function ensureBusinessEvents(root) {
+  const file=join(root,'site','migrations',BUSINESS_EVENTS_MIGRATION_FILE);
+  if(existsSync(file))return null;
+  mkdirSync(dirname(file),{recursive:true});writeFileSync(file,BUSINESS_EVENTS_MIGRATION);return `site/migrations/${BUSINESS_EVENTS_MIGRATION_FILE}`;
+}
+function ensureBookingHolds(root) {
+  const file=join(root,'site','migrations',BOOKING_HOLDS_MIGRATION_FILE);
+  if(existsSync(file))return null;
+  mkdirSync(dirname(file),{recursive:true});writeFileSync(file,BOOKING_HOLDS_MIGRATION);return `site/migrations/${BOOKING_HOLDS_MIGRATION_FILE}`;
+}
 export function ensureMigrations(root) {
-  return [ensureStatsMigration(root), ensurePlayersMigration(root), ensureOfficeMigration(root), ensureServersMigration(root), ensureChatMigration(root), ensureShopMigration(root), ensureLoungeMigration(root), ensureShopReservations(root), ensureShopLines(root), ensureAppsMigration(root), ensurePartsMigration(root), ensurePartsStateMigration(root), ensureMcpMigration(root), ensureFunctionsMigration(root), ensureFunctionCursors(root), ensureFunctionMeta(root), ensureFunctionReference(root), ensureShopRemoveReferrals(root), ensureFunctionRuns(root), ensureToolDatabase(root), ensureBookings(root), ensureSubscriptions(root)].filter(Boolean);
+  return [ensureStatsMigration(root), ensurePlayersMigration(root), ensureOfficeMigration(root), ensureServersMigration(root), ensureChatMigration(root), ensureShopMigration(root), ensureLoungeMigration(root), ensureShopReservations(root), ensureShopLines(root), ensureAppsMigration(root), ensurePartsMigration(root), ensurePartsStateMigration(root), ensureMcpMigration(root), ensureFunctionsMigration(root), ensureFunctionCursors(root), ensureFunctionMeta(root), ensureFunctionReference(root), ensureShopRemoveReferrals(root), ensureFunctionRuns(root), ensureToolDatabase(root), ensureBookings(root), ensureSubscriptions(root), ensureAppLive(root), ensureBusinessEvents(root), ensureBookingHolds(root)].filter(Boolean);
 }
 
 /** What a migration file the template added is for, in a few words (deploy and dev say it). */

package/lib/shop-links.mjs

@@ -7,7 +7,7 @@ import { HOOK_EVENTS, SHOP_HOOK_EVENTS } from './shop.mjs';
 const hash = (value) => createHash('sha256').update(JSON.stringify(value)).digest('hex');
 const same = (a, b) => Object.keys(a ?? {}).length === Object.keys(b).length && Object.entries(b).every(([k, v]) => a?.[k] === v);
 export const matchesFields = (actual, expected) => Array.isArray(expected) ? Array.isArray(actual) && actual.length === expected.length && expected.every((v,i)=>matchesFields(actual[i],v)) : expected && typeof expected === 'object' ? Object.entries(expected).every(([k,v]) => matchesFields(actual?.[k],v)) : actual === expected;
-export async function reconcilePaymentLinks({ api, shop, slug, site, mode, bookingSlots = [], verifyObjects = false, scoped = false, knownLinks = [], knownPortal }) {
+export async function reconcilePaymentLinks({ api, shop, slug, site, mode, bookingSlots = [], verifyObjects = false, scoped = false, knownPortal }) {
   if(scoped) {
     const transport=api;
     api=(method,path,params={},idempotency)=>transport(method,path,method==='POST'&&path.startsWith('/v1/payment_links/')?{...params,expand:['line_items']}:params,idempotency);
@@ -44,7 +44,7 @@ export async function reconcilePaymentLinks({ api, shop, slug, site, mode, booki
   const [products,prices,links]=await parallel([
     ()=>scoped?search('products'):list('/v1/products'),
     ()=>scoped?search('prices'):list('/v1/prices'),
-    ()=>scoped?parallel([...new Set(knownLinks)].map(id=>()=>api('GET',`/v1/payment_links/${id}`,{expand:['line_items']}))):list('/v1/payment_links'),
+    ()=>list('/v1/payment_links',scoped?{expand:['data.line_items']}:{}),
   ]);
   const own = (o) => o.metadata?.homie === 'shop-links-v1' && o.metadata?.studio === slug && o.metadata?.origin === site;
   const verifyLink = async (link, params) => {
@@ -258,9 +258,9 @@ export async function syncPaymentLinks(options) {
     secret = endpoint.secret;
   }
   const fingerprint = hash({config, purchases:purchases?.config});
-  const unchanged = current && !secret && receipt?.fingerprint === fingerprint && has('STRIPE_SHOP_LINKS') && !has('STRIPE_KEY');
+  const unchanged = current && !secret && receipt?.fingerprint === fingerprint && (options.catalog || has('STRIPE_SHOP_LINKS')) && !has('STRIPE_KEY');
   if (!unchanged) {
-    const saved = await w(['secret', 'bulk'], { input: JSON.stringify({ STRIPE_CHECKOUT_MODE: 'links', STRIPE_SHOP_LINKS: JSON.stringify(config), ...purchaseSecrets, ...(purchases && (purchases.config.offers.length || has('PURCHASE_LINKS')) ? { PURCHASE_LINKS: JSON.stringify(purchases.config) } : {}), ...(secret ? { STRIPE_WEBHOOK_SECRET: secret } : {}) }) });
+    const saved = await w(['secret', 'bulk'], { input: JSON.stringify({ STRIPE_CHECKOUT_MODE: 'links', ...(options.catalog ? {} : {STRIPE_SHOP_LINKS: JSON.stringify(config)}), ...purchaseSecrets, ...(purchases && (purchases.config.offers.length || has('PURCHASE_LINKS')) ? { PURCHASE_LINKS: JSON.stringify(purchases.config) } : {}), ...(secret ? { STRIPE_WEBHOOK_SECRET: secret } : {}) }) });
     if (saved.code !== 0) return { ok: false, needs: 'cloudflare', why: 'Cloudflare could not save the shop connection. Run shop connect again; existing webhooks remain active.' };
     // Explicitly running connect selects keyless; manual selects the existing keyed checkout.
     if (has('STRIPE_KEY') && (await w(['secret', 'delete', 'STRIPE_KEY'], { input: 'y\n' })).code !== 0) return { ok: false, needs: 'cloudflare', why: 'The links are ready; run shop connect again to finish removing the old checkout credential.' };