@homie-rocks/studio 0.51.8 → 0.52.0

package/shop/SHOP.md

@@ -122,27 +122,34 @@ calling it; tool argument shapes can change. See https://docs.stripe.com/mcp.
 3. Append `{ "method": "POST", "path": "…", "params": {…}, "body": <Stripe response> }`
    for **writes as well as reads**. Keep this setup's observations across batches.
    Product creation includes its default Price; link creation expands line items.
-   Product and Price Search use studio/origin metadata. Existing links are fetched by
-   IDs from the verified configuration; Stripe has no Payment Link metadata search.
-   Keep `.studio/stripe-mcp.json` when moving the studio to another computer. Without
-   it, repeat creates use their idempotency keys; outside Stripe's idempotency retention
-   window, recover the studio's existing link IDs before setup to avoid duplicates.
-   Follow search `next_page` cursors. Search is eventually consistent: write responses
-   are the immediate evidence. On an uncertain write, retry its exact idempotency key;
-   never discard successful responses or invent IDs. Start a new read set when checking
-   later external edits, changing accounts, or changing mode.
+   Product and Price Search use studio/origin metadata. Payment Links use paginated
+   list reads with `expand[]=data.line_items`, then filter studio/origin metadata locally;
+   Stripe has no Payment Link metadata search. There is no per-link read loop.
+   The planner saves public observations in `.studio/stripe-mcp-observations.json` and
+   reuses them on the next call; send only new responses. Keep that file and
+   `.studio/stripe-mcp.json` when moving computers. Changed shop/slot settings refresh
+   mutable links while retaining product/price discovery. Account, mode and origin
+   changes start separate reads. Pass `refresh: true` for Dashboard changes or a fresh
+   verification before webhook installation (CLI: include it in `--have` input).
+   Follow search `next_page` and list `starting_after` cursors. On an uncertain write,
+   retry its exact idempotency key; never discard successful responses or invent IDs.
 4. Call `stripe_shop_plan` with `verify: true` using those observations (CLI
    `homie-studio shop verify --have plan-input.json`). Verification checks real fields,
    line items, menus, slot limits and portal settings. It saves compact public Worker
    configuration and provenance to `.studio/stripe-mcp.json`, never API response history.
-   Deploy installs those links. Checkout then reports only `webhook-secret` missing;
+   Build writes public links to `site/dist/_site/stripe-shop-links.json`; deploy ships
+   that asset, with only its path in Wrangler vars. Large catalogues never use a text
+   binding. Deploy after verifying, including when setup began on an already-live site. Checkout then reports only `webhook-secret` missing;
    it cannot open until signed payment events can confirm orders. Changing shop.json,
    the slot manifest or origin requires verification again. Local test configuration
    goes to `.dev.vars`.
 5. For a deployed HTTPS studio, run `stripe_webhook` (CLI `homie-studio shop webhook`).
    Follow `studio_job`. This uses Stripe CLI only for private webhook installation,
-   checks the same account as the MCP, and installs the signing secret and verified
-   links through Wrangler stdin. The CLI needs one separate browser approval if its
+   checks the same account as the MCP, and installs only the signing secret through
+   Wrangler stdin. If Stripe CLI is missing, the tool installs the official
+   `@stripe/cli@latest` npm package automatically, checks the executable, then continues.
+   An installation failure reports npm permissions/PATH and a retry command. The CLI
+   needs one separate browser approval if its
    studio profile is not already connected. MCP approval cannot be reused or exported.
    Cloudflare authorization and an existing deployment are prerequisites.
 6. After installation, perform the returned `retire` operations through Stripe MCP to
@@ -153,6 +160,14 @@ calling it; tool argument shapes can change. See https://docs.stripe.com/mcp.
    endpoint's delivery result and the app's verified records. Do not type a card into
    a page for an automated proof; use Stripe's documented test PaymentMethods/fixtures.
 
+Upgrades accept 0.51.6 verifications without a source fingerprint only when their
+saved content fingerprint still matches the current shop, slots, site and mode.
+Actual changes name the affected settings and require verification. An unfinished
+setup still builds and deploys with checkout closed and one next step: finish
+`stripe_shop_plan` with `verify: true`. Missing/unreadable assets also close checkout;
+old link secrets cannot reopen it. Cached observations never renew the verification
+time; use fresh reads if the private webhook tool requests them.
+
 Never create a webhook through model-visible Stripe MCP: its response exposes the signing secret.
 
 **Why the separate approval (checked 2026-10-14).** Stripe's

package/shop/shop.ts

@@ -71,7 +71,7 @@ export interface Shop {
   cart(): CartLine[];
   clear(): void;
   /** Opens Checkout: keyless bookings are pending until paid; explicit session checkout holds capacity. The returned ID tracks the public booking record. */
-  book(item: string, booking: { collection: string; slot: string }, quantity?: number): Promise<{ ok: boolean; booking?: string; error?: string }>;
+  book(item: string, booking: { collection: string; slot: string; hold?: string; token?: string }, quantity?: number): Promise<{ ok: boolean; booking?: string; error?: string }>;
   checkout(options?: { reference?: string }): Promise<boolean>;
   buy(item: string, quantity?: number, amount?: number, options?: { reference?: string }): Promise<boolean>;
   /** Mark an item used; the studio's refundUsedItems policy decides whether self-service refunds still apply. */

package/tools/tools.ts

@@ -6,6 +6,14 @@ export interface ToolContext {
   records(args: { app: string; role?: string; collection: string; id?: string; operation?: 'read' | 'create' | 'update' | 'delete'; data?: Record<string, unknown>; version?: number }): Promise<unknown>;
   office(path: string, body?: Record<string, unknown>, query?: Record<string, string>): Promise<unknown>;
   shop(): Promise<unknown>;
+  bookings: {
+    hold(args: {app: string; collection: string; slot: string; quantity?: number; id: string; token?: string; expiresAt: number}): Promise<BookingHold>;
+    get(args: {id: string; token?: string}): Promise<BookingHold>;
+    confirm(args: {id: string; token?: string; version: number}): Promise<BookingHold>;
+    release(args: {id: string; token?: string; version: number}): Promise<BookingHold>;
+    releaseExpired(args: {app: string; collection: string; now?: number}): Promise<{released: number}>;
+  };
+  events: { publish(event: {feed: string; id: string; data: unknown}): Promise<{id: string}> };
   rooms: { send(event: {game: string; room: string; event: string; data: unknown}): Promise<unknown> };
   database: {
     get(key: string): Promise<unknown>;
@@ -32,7 +40,11 @@ export interface StudioTool<Input = Record<string, unknown>> {
   namespace?: string;
   /** A named HMAC secret delegates this one tool as an existing account. */
   webhook?: { secret: string; person: string };
+  /** Named business feeds this trusted definition may publish. */
+  publish?: string[];
   events?: Record<string, {game: string; schema: Record<string, unknown>; audience?: Audience}>;
   handler(input: Input, context: ToolContext): unknown | Promise<unknown>;
 }
 export function defineTool<Input = Record<string, unknown>>(tool: StudioTool<Input>): StudioTool<Input> { return tool; }
+
+export interface BookingHold { id: string; slot: string; quantity: number; state: string; version: number; expiresAt: number | null; paid: boolean }

package/worker/app-records.mjs

@@ -103,11 +103,15 @@ export async function appRecordsRoute(request, env, meta, url, sub) {
       for(const r of rows) {
         const record={id:r.id,data:JSON.parse(r.value),version:r.version,updatedAt:r.updated_at};
         const link=linkConfig(env)?.slots?.find(l=>l.app===meta.id&&l.slots===collection&&l.slot===r.id);
+        if(Object.values(meta.records.collections).some(c=>c.booking?.slots===collection)) {
+          const count=await env.DB.prepare("SELECT COALESCE(SUM(quantity),0) n FROM shop_bookings WHERE app=?1 AND slots=?2 AND slot=?3 AND state IN ('held','confirmed')").bind(recordApp,collection,r.id).first();
+          record.booking={full:count.n>=record.data.capacity,available:Math.max(0,record.data.capacity-count.n),synced:true};
+        }
         if(link) {
           const saved=await env.DB.prepare('SELECT value FROM meta WHERE key=?1').bind(`shop-slot-link:${link.id}`).first();
           const observed=saved?JSON.parse(saved.value):null;
           const status=observed && observed.capacity===(link.limit??link.capacity) ? observed : link;
-          const count=await env.DB.prepare("SELECT COALESCE(SUM(quantity),0) n FROM shop_bookings WHERE app=?1 AND slots=?2 AND slot=?3 AND state='confirmed'").bind(recordApp,collection,r.id).first();
+          const count=await env.DB.prepare("SELECT COALESCE(SUM(quantity),0) n FROM shop_bookings WHERE app=?1 AND slots=?2 AND slot=?3 AND state IN ('held','confirmed')").bind(recordApp,collection,r.id).first();
           record.booking={full:!status.active||status.count>=(link.limit??link.capacity)||count.n>=link.capacity,available:status.active?Math.max(0,Math.min(link.capacity-count.n,(link.limit??link.capacity)-status.count)):0,synced:link.capacity===record.data.capacity};
         }
         records.push(record);

package/worker/app-shell.mjs

@@ -13,14 +13,14 @@ export const APP_SHELL_JS = String.raw`(function () {
   function share(m) { accept(m); if (channel) channel.postMessage(m); }
   function locked(run) { return typeof navigator !== 'undefined' && navigator.locks ? navigator.locks.request('homie-app-records-v1', run) : run(); }
   async function request(path, m) {
-    var read = m.method === 'GET';
+    var read = m.type!=='homie-app-tool' && m.method === 'GET';
     if (read && pending.has(path)) return pending.get(path);
     var job = locked(async function() {
       var cached = recent.get(path);
       if (read && cached && cached.until > Date.now()) return cached.result;
       var result;
       try {
-        var res = await fetch(path, { method: m.method, headers: { 'content-type': 'application/json' }, body: read ? undefined : JSON.stringify({ data: m.data, version: m.version }), signal: AbortSignal.timeout(8000) });
+        var res = await fetch(path, { method: m.type==='homie-app-tool'?'POST':m.method, headers: { 'content-type': 'application/json' }, body: m.type==='homie-app-tool'?JSON.stringify({name:m.name,input:m.input}):read ? undefined : JSON.stringify({ data: m.data, version: m.version }), signal: AbortSignal.timeout(8000) });
         result = await res.json();
         if (res.status === 429 || res.status >= 500) throw new Error('reconnect');
         failures.delete(path);
@@ -35,15 +35,38 @@ export const APP_SHELL_JS = String.raw`(function () {
     if (read) { pending.set(path, job); job.finally(function() { pending.delete(path); }); }
     return job;
   }
+  var live, collections=new Set(), presence=0, clock=null;
+  function query() {
+    var q=new URLSearchParams();
+    ['role','surface','access','room'].forEach(function(k){var v=params.get(k);if(v)q.set(k,v);});
+    if(boot.screen&&!q.has('role'))q.set('surface','wall');
+    return q;
+  }
+  function context() {return {app:boot.game,origin:location.origin,url:location.origin+'/'+boot.game+'/open',presence:presence,now:clock};}
+  function sendContext(){frame?.contentWindow?.postMessage({type:'homie-app-context',context:context()},'*');}
+  function connect(){
+    live?.close();
+    var q=query();collections.forEach(function(c){q.append('collection',c);});
+    live=new EventSource((boot.site||'')+'/'+boot.game+'/api/app/live?'+q);
+    live.onmessage=function(e){var value=JSON.parse(e.data);if(presence!==value.presence){presence=value.presence;sendContext();}if(value.collections?.length){share({invalidate:true});Promise.allSettled([...pending.values()]).then(function(){share({invalidate:true});frame?.contentWindow?.postMessage({type:'homie-app-changed',collections:value.collections},'*');});}};
+  }
+  window.homieApp=Object.freeze({get context(){return context();},setTestClock:function(value){if(!boot.test)throw new Error('Local proof session required');if(value!==null&&!Number.isFinite(value))throw new Error('Invalid clock');clock=value;sendContext();}});
+  addEventListener('pagehide',function(){live?.close();});
   addEventListener('message', async function (e) {
     var m = e.data;
+    if(frame&&e.source===frame.contentWindow&&m?.type==='homie-app-context'){sendContext();return;}
+    if(frame&&e.source===frame.contentWindow&&m?.type==='homie-app-subscribe'){
+      if(!Array.isArray(m.collections)||m.collections.some(c=>!/^[a-z][a-z0-9-]{0,39}$/.test(c)))return;
+      m.collections.forEach(c=>collections.add(c));connect();return;
+    }
     if (frame && e.source === frame.contentWindow && m?.type === 'homie-app-ticket' && /^[a-f0-9]{32}$/.test(m.ticket)) { params.set('ticket', m.ticket); history.replaceState(null, '', location.pathname + '?' + params); return; }
-    if (!frame || e.source !== frame.contentWindow || !m || m.type !== 'homie-app' || !/^[a-f0-9]{32}$/.test(m.id || '')) return;
-    if (!/^[a-z][a-z0-9-]{0,39}$/.test(m.collection || '') || !['GET','POST','PUT','DELETE'].includes(m.method) || (m.record !== undefined && !/^[A-Za-z0-9_-]{1,64}$/.test(m.record))) return;
+    if (!frame || e.source !== frame.contentWindow || !m || !['homie-app','homie-app-tool'].includes(m.type) || !/^[a-f0-9]{32}$/.test(m.id || '')) return;
+    if (m.type==='homie-app' && (!/^[a-z][a-z0-9-]{0,39}$/.test(m.collection || '') || !['GET','POST','PUT','DELETE'].includes(m.method) || (m.record !== undefined && !/^[A-Za-z0-9_-]{1,64}$/.test(m.record)))) return;
     var q = new URLSearchParams();
     ['role','surface','access'].forEach(function (k) { var v = params.get(k); if (v) q.set(k, v); });
     if (boot.screen && !q.has('role')) q.set('surface', 'wall');
     var path = (boot.site || '') + '/' + boot.game + '/api/app/records/' + m.collection + (m.record ? '/' + m.record : '') + '?' + q;
+    if(m.type==='homie-app-tool')path=(boot.site||'')+'/'+boot.game+'/api/app/tools?'+q;
     var result = await request(path, m);
     e.source.postMessage({ type: 'homie-app-result', id: m.id, result: result }, '*');
   });

package/worker/app-streams.mjs

@@ -0,0 +1,57 @@
+import {appAccess} from './app-records.mjs';
+import {localSession} from './local-test.mjs';
+import {settingsOf,launchOf,accessOf} from './office.mjs';
+export const APP_LIVE_MIGRATION_FILE='0027_app_live.sql';
+export const APP_LIVE_MIGRATION=`
+CREATE TABLE app_record_revisions(app TEXT NOT NULL,collection TEXT NOT NULL,revision INTEGER NOT NULL,PRIMARY KEY(app,collection));
+${['INSERT','UPDATE','DELETE'].map(op=>{const row=op==='DELETE'?'OLD':'NEW';return `CREATE TRIGGER app_records_live_${op.toLowerCase()} AFTER ${op} ON app_records BEGIN
+ INSERT INTO app_record_revisions VALUES(${row}.app,${row}.collection,1) ON CONFLICT(app,collection) DO UPDATE SET revision=revision+1;
+END;`;}).join('\n')}
+`;
+const frame=value=>new TextEncoder().encode('data: '+JSON.stringify(value)+'\n\n');
+export const appHub=(env,app)=>env.LOBBY.get(env.LOBBY.idFromName('@app-records/'+app));
+export async function pushAppRecords(env,cat){
+ if(!env.LOBBY||!env.DB)return;
+ await Promise.all((cat.games??[]).filter(g=>g.kind==='app').map(meta=>appHub(env,meta.id).fetch('https://app/__app_records',{method:'POST',body:JSON.stringify({op:'wake',meta})}).catch(error=>console.error('App notification wake failed',error))));
+}
+/** Collection invalidations, never record bodies or identifiers. Reads recheck current authorization. */
+export class AppRecordStreams {
+ constructor(env,ctx){this.env=env;this.ctx=ctx;this.streams=new Set();}
+ dispose(){for(const s of [...this.streams])this.close(s);}
+ close(s){if(!this.streams.delete(s))return;clearInterval(s.timer);try{s.controller.close();}catch{}this.presence();}
+ count(s){return [...this.streams].filter(x=>x.app===s.app&&x.room===s.room).length;}
+ send(s,data){if(s.controller.desiredSize<=0){this.close(s);return;}try{s.controller.enqueue(frame(data));}catch{this.close(s);}}
+ presence(){for(const s of this.streams)this.send(s,{presence:this.count(s)});}
+ async authorized(s){
+  const access=await appAccess(s.request,this.env,s.meta,s.url);
+  if(!access.ok||s.collections.some(c=>!access.can.includes('read:'+c)))return false;
+  const launch=launchOf(s.meta,await settingsOf(this.env,{fresh:true}),this.env);
+  return launch==='public'||(await accessOf(s.request,this.env,s.meta.id,launch)).ok;
+ }
+ async revisions(s){return (await this.env.DB.prepare('SELECT collection,revision FROM app_record_revisions WHERE app=?1').bind(s.app).all()).results;}
+ async open({meta,url,headers,collections=[]}){
+  if(!Array.isArray(collections)||collections.some(c=>typeof c!=='string'||!Object.hasOwn(meta.records?.collections??{},c)))return new Response('unknown collection',{status:400});
+  const s={meta,url:new URL(url),request:new Request(url,{headers}),collections,seen:new Map()};
+  if(!await this.authorized(s))return new Response('role cannot read collections',{status:403});
+  const session=await localSession(s.request,this.env);
+  s.app=session?.app===meta.id&&session.scope?`${meta.id}:check:${session.scope}`:meta.id;
+  s.room=s.url.searchParams.get('room')??'main';
+  for(const row of await this.revisions(s))s.seen.set(row.collection,row.revision);
+  const body=new ReadableStream({start:controller=>{s.controller=controller;},cancel:()=>this.close(s)});
+  this.streams.add(s);this.send(s,{collections:s.collections,presence:this.count(s),reset:true});
+  for(const other of this.streams)if(other!==s)this.send(other,{presence:this.count(other)});
+  // Recovery after a missed wake; this is not the screen's refresh clock.
+  s.timer=setInterval(()=>this.ctx.waitUntil(this.pump(s)),15000);
+  return new Response(body,{headers:{'content-type':'text/event-stream','cache-control':'no-store'}});
+ }
+ async pump(s){
+  if(!this.streams.has(s))return;if(s.busy){s.dirty=true;return;}s.busy=true;
+  try{
+   if(!await this.authorized(s)){this.close(s);return;}
+   const changed=[];
+   for(const row of await this.revisions(s)){if(s.collections.includes(row.collection)&&s.seen.get(row.collection)!==row.revision)changed.push(row.collection);s.seen.set(row.collection,row.revision);}
+   this.send(s,{collections:changed,presence:this.count(s)});
+  }catch{this.close(s);}finally{s.busy=false;if(s.dirty){s.dirty=false;await this.pump(s);}}
+ }
+ async wake(meta){for(const s of this.streams)if(meta)s.meta=meta;await Promise.all([...this.streams].map(s=>this.pump(s)));return new Response('ok');}
+}

package/worker/app-tools.mjs

@@ -0,0 +1,44 @@
+import {CfWorkerJsonSchemaValidator} from '@modelcontextprotocol/server/validators/cf-worker';
+import {allowed,services} from './mcp-tools.mjs';
+import {appAccess} from './app-records.mjs';
+import {localSession} from './local-test.mjs';
+import {players} from './players.mjs';
+import {isOwner,sameOrigin} from './office.mjs';
+import {audit,callsPerMinute,rateLimit} from './mcp-store.mjs';
+const validator=new CfWorkerJsonSchemaValidator();
+export async function invokeAppTool(tool,input,context){
+ if(!validator.getValidator(tool.inputSchema)(input).valid)throw Object.assign(new Error('Input does not match the tool schema'),{status:400});
+ return tool.handler(input,context);
+}
+export async function appCaller(request,env,meta,url){
+ const access=await appAccess(request,env,meta,url);
+ if(!access.ok)throw Object.assign(new Error(access.error),{status:access.status});
+ const session=await localSession(request,env);
+ if(session?.app===meta.id)return {id:`local-test-${session.app}-${session.role}`,owner:session.role==='owner',client:null,localTest:true,roles:{[meta.id]:[session.role]},testApp:meta.id,testScope:session.scope};
+ const person=await players.of(request,env);
+ const owner=await isOwner(request,env);
+ const roles={};
+ if(person&&!person.guest){for(const row of (await env.DB.prepare('SELECT app,role FROM app_roles WHERE player=?1').bind(person.id).all()).results)(roles[row.app]??=[]).push(row.role);}
+ return {id:owner?(person?.id??'browser-owner'):person&&!person.guest?person.id:null,owner,client:null,roles};
+}
+/** Same-origin shell transport; body fields never supply an identity or a role. */
+export async function appToolsRoute(request,env,meta,url,cat,definitions){
+ const fail=(status,error)=>Response.json({ok:false,error},{status});
+ if(request.method!=='POST')return fail(405,'POST required');
+ if(!sameOrigin(request,url))return fail(403,'same origin required');
+ let caller,tool,outcome='error';
+ try{
+  caller=await appCaller(request,env,meta,url);
+  const reader=request.body?.getReader();let size=0,text='';const decoder=new TextDecoder();
+  if(reader)for(;;){const {done,value}=await reader.read();if(done)break;size+=value.byteLength;if(size>12288){await reader.cancel();return fail(413,'body too large');}text+=decoder.decode(value,{stream:true});}
+  const body=JSON.parse(text+decoder.decode());
+  tool=definitions.find(t=>t.name===body.name&&(!t.kind||t.kind==='tool'));
+  if(!tool||!await allowed(tool.audience,caller,env)){outcome='denied';return fail(403,'Permission denied or unknown tool');}
+  if(tool.price)return fail(402,'Use MCP to approve payment for this tool');
+  if(!await rateLimit(env,caller.id??`public:${request.headers.get('cf-connecting-ip')??'local'}`,callsPerMinute(cat)))return fail(429,'Rate limit reached');
+  const namespace=(tool.namespace??tool.name)+(caller.testScope?':check:'+caller.testScope:'');
+  const data=await invokeAppTool(tool,body.input??{},services(env,cat,url.origin,caller,namespace,tool));
+  outcome='ok';return Response.json({ok:true,data});
+ }catch(error){return fail(error.status??(error instanceof SyntaxError?400:500),error.status||error.name==='StudioOperationError'?error.message:'Tool request failed');}
+ finally{if(caller)await audit(env,caller,tool?.name??'unknown-tool',outcome);}
+}

package/worker/booking-holds.mjs

@@ -0,0 +1,87 @@
+import {BOOKINGS_MIGRATION} from './booking-store.mjs';
+import {linkConfig,hasStripeKey} from './shop-links.mjs';
+export const BOOKING_HOLDS_MIGRATION_FILE='0029_booking_holds.sql';
+export const BOOKING_HOLDS_MIGRATION=`
+ALTER TABLE shop_bookings ADD COLUMN paid_at INTEGER;
+ALTER TABLE shop_bookings ADD COLUMN actor TEXT;
+ALTER TABLE shop_bookings ADD COLUMN token_hash TEXT;
+ALTER TABLE shop_bookings ADD COLUMN hold_until INTEGER;
+DROP TRIGGER booking_capacity_move;
+CREATE TRIGGER booking_capacity_move BEFORE UPDATE OF slot,quantity,state ON shop_bookings
+WHEN NEW.state IN ('held','confirmed') BEGIN
+ SELECT RAISE(ABORT,'booking capacity unavailable') WHERE NOT EXISTS (
+ SELECT 1 FROM app_records s WHERE s.app=NEW.app AND s.collection=NEW.slots AND s.id=NEW.slot
+ AND json_type(s.value,'$.capacity')='integer' AND json_extract(s.value,'$.capacity') >= NEW.quantity +
+ (SELECT COALESCE(SUM(quantity),0) FROM shop_bookings WHERE app=NEW.app AND slots=NEW.slots AND slot=NEW.slot AND id!=NEW.id AND state IN ('held','confirmed')));
+END;
+CREATE TRIGGER booking_hold_claim BEFORE UPDATE OF order_id ON shop_bookings BEGIN
+ SELECT RAISE(ABORT,'booking hold changed or expired') WHERE NEW.order_id IS NULL OR OLD.order_id!='hold:'||OLD.id OR OLD.state NOT IN ('held','confirmed') OR (OLD.state='held' AND OLD.hold_until<=NEW.updated_at);
+END;
+DROP TRIGGER booking_order_state;
+CREATE TRIGGER booking_order_state AFTER UPDATE OF status,paid_at ON shop_orders
+WHEN NEW.status!=OLD.status OR (OLD.paid_at IS NULL AND NEW.paid_at IS NOT NULL) BEGIN
+ UPDATE shop_bookings SET state=CASE WHEN NEW.status='paid' THEN 'confirmed' ELSE 'released' END,
+ paid_at=COALESCE(NEW.paid_at,paid_at),version=version+1,updated_at=NEW.updated_at
+ WHERE order_id=NEW.id AND ((state IN ('pending','held','confirmed') AND NEW.status='paid')
+ OR (state IN ('pending','held') AND NEW.status IN ('expired','failed'))
+ OR (state IN ('pending','held','confirmed') AND NEW.status IN ('refunded','lost')));
+END;
+${['insert','update'].map(op=>{
+ const trigger=BOOKINGS_MIGRATION.match(new RegExp('CREATE TRIGGER booking_record_'+op+'[\\s\\S]*?END;'))[0];
+ return 'DROP TRIGGER booking_record_'+op+';\n'+trigger.replace("'state',NEW.state)","'state',NEW.state,'paid',json(CASE WHEN NEW.paid_at IS NULL THEN 'false' ELSE 'true' END))");
+}).join('\n')}
+UPDATE shop_bookings SET paid_at=(SELECT paid_at FROM shop_orders WHERE id=order_id),version=version+1 WHERE EXISTS(SELECT 1 FROM shop_orders WHERE id=order_id AND paid_at IS NOT NULL);
+`;
+const refusal=(message,status=400)=>Object.assign(new Error(message),{name:'StudioOperationError',status});
+const valid=v=>typeof v==='string'&&/^[A-Za-z0-9_-]{1,64}$/.test(v);
+const hash=async token=>Array.from(new Uint8Array(await crypto.subtle.digest('SHA-256',new TextEncoder().encode(token))),b=>b.toString(16).padStart(2,'0')).join('');
+export async function ownedHold(env,caller,{id,token}){
+ if(!valid(id))throw refusal('Invalid booking id');
+ const row=await env.DB.prepare('SELECT * FROM shop_bookings WHERE id=?1').bind(id).first();
+ if(!row||!(caller.owner||row.actor&&row.actor===caller.id||row.token_hash&&typeof token==='string'&&await hash(token)===row.token_hash))throw refusal('Booking owner required',403);
+ if(caller.testScope&&!row.app.endsWith(':check:'+caller.testScope))throw refusal('Booking owner required',403);
+ return row;
+}
+/** A hold is the very row checkout later confirms. Secrets never enter its public projection. */
+export function bookingHolds(env,caller,cat){
+ const result=r=>({id:r.id,slot:r.slot,quantity:r.quantity,state:r.state,version:r.version,expiresAt:r.hold_until,paid:r.paid_at!==null});
+ const change=async(args,state)=>{
+  const row=await ownedHold(env,caller,args);
+  if(row.order_id!=='hold:'+row.id)throw refusal('Checkout owns this booking; reconcile payment before release');
+  if(!Number.isSafeInteger(args.version)||args.version<1)throw refusal('Booking version required');
+  const changed=await env.DB.prepare(`UPDATE shop_bookings SET state=?2,version=version+1,updated_at=?3 WHERE id=?1 AND version=?4 AND state IN ('held','confirmed') AND (?2='released' OR hold_until>?3) RETURNING *`).bind(row.id,state,Date.now(),args.version).first();
+  if(!changed)throw refusal('Booking changed or expired; reload',409);return result(changed);
+ };
+ return Object.freeze({
+  async hold({app,collection,slot,quantity=1,id,token,expiresAt}){
+   const meta=cat.games.find(g=>g.id===app&&g.kind==='app'),spec=meta?.records?.collections?.[collection]?.booking;
+   if(!spec||!valid(id)||!valid(slot)||!Number.isSafeInteger(quantity)||quantity<1)throw refusal('Choose a declared slot, positive quantity and stable booking id');
+   if(!Number.isSafeInteger(expiresAt)||expiresAt<=Date.now())throw refusal('Hold needs a future expiry');
+   if(token!==undefined&&!(typeof token==='string'&&/^[a-f0-9]{32,128}$/.test(token)))throw refusal('Invalid private booking token');
+   if(!caller.id&&!token)throw refusal('Booking owner or private token required');
+   if(!hasStripeKey(env)&&linkConfig(env)?.slots?.some(l=>l.app===app&&l.slots===spec.slots&&l.slot===slot))throw refusal('Keyless Stripe inventory cannot share local holds; configure session checkout first');
+   const scope=caller.testScope?`${app}:check:${caller.testScope}`:app;
+   id=await hash(JSON.stringify([scope,collection,id]));
+   const secret=token?await hash(token):null;
+   try {await env.DB.prepare(`INSERT INTO shop_bookings(id,app,collection,slots,slot,quantity,order_id,state,updated_at,actor,token_hash,hold_until)
+    SELECT ?1,?2,?3,?4,?5,?6,'hold:'||?1,'held',?7,?8,?9,?10 WHERE NOT EXISTS(SELECT 1 FROM shop_bookings WHERE id=?1)`).bind(id,scope,collection,spec.slots,slot,quantity,Date.now(),caller.id??null,secret,expiresAt).run();}catch(error){if(/booking capacity unavailable/.test(error.message))throw refusal('That slot is full. No place has been taken.',409);throw error;}
+   const row=await ownedHold(env,caller,{id,token});
+   if(row.app!==scope||row.collection!==collection||row.slot!==slot||row.quantity!==quantity)throw refusal('Booking id reused with different request',409);
+   return result(row);
+  },
+  async get(args){return result(await ownedHold(env,caller,args));},
+  confirm:args=>change(args,'confirmed'),release:args=>change(args,'released'),
+  async releaseExpired({app,collection,now=Date.now()}){
+   if(!caller.owner)throw refusal('Owner or scheduled function required');
+   if(!Number.isSafeInteger(now))throw refusal('Invalid release time');
+   const scope=caller.testScope?`${app}:check:${caller.testScope}`:app;
+   const r=await env.DB.prepare("UPDATE shop_bookings SET state='released',version=version+1,updated_at=?3 WHERE app=?1 AND collection=?2 AND order_id='hold:'||id AND state='held' AND hold_until<=?3").bind(scope,collection,now).run();return {released:r.meta.changes};
+  }
+ });
+}
+/** Used in the same transaction as the order reservation. A second checkout cannot claim the hold. */
+export function claimHoldStatement(env,{hold,app,collection,slots,slot,quantity,order,now=Date.now()}){
+ return env.DB.prepare(`UPDATE shop_bookings SET order_id=CASE WHEN app=?4 AND collection=?5 AND slots=?6 AND slot=?7 AND quantity=?8 THEN ?2 ELSE NULL END,version=version+1,updated_at=?3
+ WHERE id=?1
+ AND EXISTS(SELECT 1 FROM shop_orders WHERE id=?2)`).bind(hold,order,now,app,collection,slots,slot,quantity);
+}

package/worker/build-id.mjs

@@ -1,2 +1,2 @@
 // Generated by lib/build-identity.mjs; identifies the bundled runtime sources.
-export const STUDIO_BUILD = Object.freeze({"version":"0.51.8","sha256":"ac2d23a60cc25247d09af506854dec3345b9219d57dbde5f3b1abe5640abde84"});
+export const STUDIO_BUILD = Object.freeze({"version":"0.52.0","sha256":"f2d43374183c3a1d807c67754b0b9e868b18d5f6b137e0fd5f224fd6e5866e17"});

package/worker/business-events.mjs

@@ -0,0 +1,31 @@
+import {canonicalJson} from './canonical-json.mjs';
+export const BUSINESS_EVENTS_MIGRATION_FILE='0028_business_events.sql';
+export const BUSINESS_EVENTS_MIGRATION=`
+ALTER TABLE studio_events ADD COLUMN scope TEXT;
+CREATE TABLE event_publications(id TEXT PRIMARY KEY,digest TEXT NOT NULL);
+${['INSERT','UPDATE','DELETE'].map(op=>{const row=op==='DELETE'?'OLD':'NEW';return `
+DROP TRIGGER IF EXISTS app_records_function_${op.toLowerCase()};
+CREATE TRIGGER app_records_function_${op.toLowerCase()} AFTER ${op} ON app_records
+WHEN EXISTS (SELECT 1 FROM function_subscriptions WHERE type='record.changed') BEGIN
+ INSERT INTO studio_events(id,type,data,at) VALUES(lower(hex(randomblob(16))),'record.changed',
+ json_object('app',${row}.app,'collection',${row}.collection,'record',${row}.id,'version',${row}.version,'operation','${op.toLowerCase()}',
+ 'data',json(${row}.value),'previous',${op==='INSERT'?'NULL':'json(OLD.value)'}),${row}.updated_at);
+END;`;}).join('\n')}
+`;
+/** Durable idempotency survives feed retention/pruning; no sleep or read-back races. */
+export async function publishBusinessEvent(env,caller,definition,namespace,{feed,id,data}){
+ const declaration=JSON.parse(env.STUDIO_EVENT_FEEDS??'{}')[feed];
+ if(!definition.publish?.includes(feed)||!declaration?.schema)throw new Error('Business feed must be declared with a schema and publish capability');
+ if(typeof id!=='string'||!id.length||id.length>128)throw new Error('Event id must contain 1–128 characters');
+ const {CfWorkerJsonSchemaValidator}=await import('@modelcontextprotocol/server/validators/cf-worker');
+ if(!new CfWorkerJsonSchemaValidator().getValidator(declaration.schema)(data).valid)throw new Error('Event data does not match feed schema');
+ const text=canonicalJson(data);if(text.length>8192)throw new Error('Event exceeds 8192 characters');
+ const key=JSON.stringify([namespace,feed,id]),digest=Array.from(new Uint8Array(await crypto.subtle.digest('SHA-256',new TextEncoder().encode(declaration.event+'\n'+text))),b=>b.toString(16).padStart(2,'0')).join('');
+ await env.DB.batch([
+  env.DB.prepare('INSERT OR IGNORE INTO studio_events(id,type,data,at,scope) SELECT ?1,?2,?3,?4,?5 WHERE NOT EXISTS (SELECT 1 FROM event_publications WHERE id=?1)').bind(key,declaration.event,text,Date.now(),caller.testScope??null),
+  env.DB.prepare('INSERT OR IGNORE INTO event_publications(id,digest) VALUES(?1,?2)').bind(key,digest)
+ ]);
+ const saved=await env.DB.prepare('SELECT digest FROM event_publications WHERE id=?1').bind(key).first();
+ if(saved.digest!==digest)throw new Error('Event id already published with different data');
+ return {id:key};
+}

package/worker/event-resources.mjs

@@ -28,7 +28,7 @@ export async function readableFeed(env,cat,caller,name) {
 export async function feedEvents(env,name,{after=0,through=Number.MAX_SAFE_INTEGER,caller}={}) {
   const feed=eventFeeds(env)[name];if(!feed)return [];
   const scopedApp=env.HOMIE_LOCAL_TEST_SECRET&&caller?.localTest&&caller.testScope&&feed.event==='record.changed'?`${feed.app}:check:${caller.testScope}`:null;
-  const rows=(await env.DB.prepare("SELECT seq,id,type,data,at FROM studio_events WHERE type=?1 AND seq>?2 AND seq<=?3 AND (?4 IS NULL OR json_extract(data,'$.app')=?4) ORDER BY seq LIMIT 100").bind(feed.event,after,through,scopedApp).all()).results;
+  const rows=(await env.DB.prepare("SELECT seq,id,type,data,at FROM studio_events WHERE type=?1 AND seq>?2 AND seq<=?3 AND scope IS ?5 AND (?4 IS NULL OR json_extract(data,'$.app')=?4) ORDER BY seq LIMIT 100").bind(feed.event,after,through,scopedApp,feed.event==='record.changed'?null:caller?.testScope??null).all()).results;
   const events=rows.map(r=>({...r,data:JSON.parse(r.data)}));
   if(env.HOMIE_LOCAL_TEST_SECRET && caller?.localTest && caller.testScope && feed.event==='record.changed') {
     const app=`${feed.app}:check:${caller.testScope}`;

package/worker/functions.mjs

@@ -43,6 +43,10 @@ export async function pruneEvents(env) {
 /** A lease is for retry after a crashed Worker, not a deadline imposed on studio code. */
 export async function runFunctions(env, cat, origin, {definitions, now = Date.now, leaseMs = 60000, webhookOptions = {}} = {}) {
   if(!env.DB)return;
+  if(env.LOBBY){
+    if(typeof cat==='function')cat=await cat();
+    await (await import('./app-streams.mjs')).pushAppRecords(env,cat);
+  }
   definitions = await syncFunctions(env,definitions,now());
   if(!definitions.length&&!env.STUDIO_EVENT_FEEDS)return;
   if(typeof cat==='function')cat=await cat();
@@ -95,6 +99,7 @@ export async function runFunctions(env, cat, origin, {definitions, now = Date.no
       }
     }
   } while(more);
+  await (await import('./app-streams.mjs')).pushAppRecords(env,cat);
   await notifications;
   await notify();
   await pruneEvents(env);

package/worker/index.mjs

@@ -1,5 +1,6 @@
 import {appGraphicsFallback} from './app-graphics.mjs';
 import {JOIN_AREA_FRAME_JS} from './join-area.mjs';
+import {loadShopLinks} from './shop-links.mjs';
 import { directoryUrl } from './directory-choice.mjs';
 import {APP_STORAGE_JS} from './app-frame.mjs';
 import {recordsPage} from './records-page.mjs';
@@ -621,6 +622,7 @@ async function removeReferralLeftovers(env) {
 
 export default {
   async scheduled(event, env, ctx) {
+    env=await loadShopLinks(env);
     const maintenance=(async () => {
       await removeReferralLeftovers(env);
       const cat = await catalogue(env, 'https://studio.invalid');
@@ -632,6 +634,7 @@ export default {
     await maintenance;
   },
   async fetch(request, env, ctx) {
+    env=await loadShopLinks(env,new URL(request.url).origin);
     await removeReferralLeftovers(env);
     const url = new URL(request.url);
     await (await import('./functions.mjs')).syncFunctions(env);
@@ -947,6 +950,12 @@ async function route(request, env, ctx) {
     const max = seatsFor(meta, settings);
     if (meta.kind === 'app') {
       if (launch !== 'public' && !(await accessOf(request, env, game, launch)).ok) return json({ ok: false, error: 'not-found' }, 404);
+      if(sub==='api/app/live') {
+        if(request.method!=='GET')return new Response('GET required',{status:405});
+        const {appHub}=await import('./app-streams.mjs');
+        return appHub(env,meta.id).fetch('https://app/__app_records',{method:'POST',body:JSON.stringify({op:'open',meta,url:request.url,headers:Object.fromEntries(request.headers),collections:url.searchParams.getAll('collection')})});
+      }
+      if(sub==='api/app/tools')return (await import('./app-tools.mjs')).appToolsRoute(request,env,meta,url,cat,await studioTools());
       const api = await appRecordsRoute(request, env, meta, url, sub);
       if (api) return api;
       if (['play', 'tv', 'watch'].includes(sub)) {
@@ -956,7 +965,7 @@ async function route(request, env, ctx) {
           if (a.status === 401) return Response.redirect(`${url.origin}/account/?next=${encodeURIComponent(url.pathname + url.search)}`, 302);
           return json({ ok: false, error: a.error }, a.status);
         }
-        if(!meta.room)return recordsPage(meta,url,cat,await availableShellShop(env,cat,game));
+        if(!meta.room)return recordsPage(meta,url,cat,await availableShellShop(env,cat,game),Boolean(await (await import('./local-test.mjs')).localSession(request,env)));
       }
     }
     const lobby = () => env.LOBBY.get(env.LOBBY.idFromName(game));
@@ -1101,11 +1110,11 @@ async function route(request, env, ctx) {
         const sh = await availableShellShop(env, cat, game, { kids: pol.kids });
         let shopQr = null;
         if (sh && !local) try { shopQr = qrSvg(`${url.origin}/shop/?game=${encodeURIComponent(game)}`, { title: `Shop: ${meta.name ?? game}` }); } catch { shopQr = null; }
-        return playPage(cat, meta, { origin: url.origin, screen: true, joinUrl, qr, local, room, ticket, owner: d.owner, launch, server, shop: sh ? { ...sh, qr: shopQr, url: `${url.origin}/shop/?game=${game}` } : null });
+        return playPage(cat, meta, { test: Boolean(await (await import('./local-test.mjs')).localSession(request,env)), origin: url.origin, screen: true, joinUrl, qr, local, room, ticket, owner: d.owner, launch, server, shop: sh ? { ...sh, qr: shopQr, url: `${url.origin}/shop/?game=${game}` } : null });
       }
       await countVisit(request, env, ctx, game, 'play');
       shareDaily(cat, url, ctx);
-      const page=playPage(cat, meta, { origin: url.origin, embed, preview: env.HOMIE_EMBED_PREVIEW === '1', ticket: embed ? null : ticket, owner: !embed && d.owner, launch, server, ...(embed ? {} : await chatWho(env, game, srv, d.acct)), shop: await availableShellShop(env, cat, game, { kids: pol.kids }) });
+      const page=playPage(cat, meta, { test: Boolean(await (await import('./local-test.mjs')).localSession(request,env)), origin: url.origin, embed, preview: env.HOMIE_EMBED_PREVIEW === '1', ticket: embed ? null : ticket, owner: !embed && d.owner, launch, server, ...(embed ? {} : await chatWho(env, game, srv, d.acct)), shop: await availableShellShop(env, cat, game, { kids: pol.kids }) });
       for(const cookie of recordsGuest?.cookies??[])page.headers.append('set-cookie',cookie);return page;
     }
     if (sub === 'watch') {
@@ -1123,7 +1132,7 @@ async function route(request, env, ctx) {
       const ticket = d.holder ? await ticketFor(env, game, d.holder) : null;
       await countVisit(request, env, ctx, game, 'watch');
       shareDaily(cat, url, ctx);
-      return watchPage(cat, meta, { origin: url.origin, room: asked, ticket, policy, owner: d.owner, ...(await chatWho(env, game, srv, d.acct)) });
+      return watchPage(cat, meta, { test: Boolean(await (await import('./local-test.mjs')).localSession(request,env)), origin: url.origin, room: asked, ticket, policy, owner: d.owner, ...(await chatWho(env, game, srv, d.acct)) });
     }
     if (sub === 'api/watch') {
       if (!door.ok || watchOf(meta) === 'off') return json({ ok: false, error: 'not-found' }, 404);
@@ -2604,6 +2613,12 @@ export class Lobby {
 
   /** A request that throws is said with what it was (never its body) and answered as a failure, not left uncaught. */
   async fetch(request) {
+    if(new URL(request.url).pathname==='/__app_records') {
+      const {AppRecordStreams}=await import('./app-streams.mjs');
+      this.appStreams??=new AppRecordStreams(this.env,this.ctx);
+      const input=await request.json();
+      return input.op==='open'?this.appStreams.open(input):this.appStreams.wake(input.meta);
+    }
     if(new URL(request.url).pathname==='/__studio_events') {
       const {EventStreams}=await import('./event-resources.mjs');
       this.eventStreams??=new EventStreams(this.env,this.ctx);

package/worker/mcp-events.mjs

@@ -39,9 +39,9 @@ export async function pollEvents(env,cat,caller,params,now=Date.now()){
   // Filter before limiting: unrelated collections must not create a false hasMore
   // or force the client through pages containing no matching occurrences.
   const rows=(await env.DB.prepare(`SELECT seq,id,type,data,at FROM studio_events
-    WHERE type=?1 AND seq>?2 AND seq<=?3
+    WHERE type=?1 AND seq>?2 AND seq<=?3 AND scope IS ?7
       AND (?4 IS NULL OR (json_extract(data,'$.app')=?4 AND json_extract(data,'$.collection')=?5))
-    ORDER BY seq LIMIT ?6`).bind(feed.event,start.after,start.through,feed.event==='record.changed'?(env.HOMIE_LOCAL_TEST_SECRET&&caller.localTest&&caller.testScope?`${feed.app}:check:${caller.testScope}`:feed.app):null,feed.collection??null,max+1).all()).results;
+    ORDER BY seq LIMIT ?6`).bind(feed.event,start.after,start.through,feed.event==='record.changed'?(env.HOMIE_LOCAL_TEST_SECRET&&caller.localTest&&caller.testScope?`${feed.app}:check:${caller.testScope}`:feed.app):null,feed.collection??null,max+1,feed.event==='record.changed'?null:caller.testScope??null).all()).results;
   const hasMore=rows.length>max,page=rows.slice(0,max);
   const events=page.map(row=>{const data=JSON.parse(row.data);if(env.HOMIE_LOCAL_TEST_SECRET&&caller.localTest&&caller.testScope&&feed.event==='record.changed')data.app=feed.app;return occurrence(params.name,{...row,data},cursorOf(params.name,row.seq));});
   const after=hasMore?page.at(-1).seq:start.through;

package/worker/mcp-tools.mjs

@@ -1,3 +1,4 @@
+import {bookingHolds} from './booking-holds.mjs';
 import {toolDatabase} from './tool-database.mjs';
 import { selling } from './extensions.mjs';
 import { withToolIdentity } from './tool-identity.mjs';
@@ -66,6 +67,8 @@ export function services(env, cat, origin, caller, namespace, definition = {}) {
   const key = v=>{if(typeof v!=='string'||v.length>128||!v.length)throw new Error('invalid key');return v;};
   return Object.freeze({
     caller:Object.freeze({...caller,roles:Object.freeze(Object.fromEntries(Object.entries(caller.roles??{}).map(([app,roles])=>[app,Object.freeze([...roles])])) )}), records, office,
+    bookings:bookingHolds(env,caller,cat),
+    events:Object.freeze({publish:args=>import('./business-events.mjs').then(m=>m.publishBusinessEvent(env,caller,definition,namespace,args))}),
     rooms:Object.freeze({send:args=>import('./tool-events.mjs').then(m=>m.sendToolEvent(env,caller,definition,args))}),
     shop:()=>office('/_studio/api/shop'),
     database:toolDatabase(env.DB,namespace),

package/worker/mcp.mjs

@@ -123,7 +123,7 @@ export async function remoteMcp(request,env,ctx,{catalogueOf,definitions=[]}) {
           if (!toolInScope(caller,tool.name) || !await allowed(tool.audience,caller,env)) continue;
           s.registerPrompt(tool.name,{description:tool.description,argsSchema:fromJsonSchema(tool.inputSchema,validator)},async(args)=>read('prompt:'+tool.name,async fresh=>{
             if(!toolInScope(fresh,tool.name)||!await allowed(tool.audience,fresh,env))throw new Error('Permission denied');
-            const text=await tool.handler(args,services(env,cat,origin,fresh,tool.namespace??tool.name,tool));
+            const text=await tool.handler(args,services(env,cat,origin,fresh,(tool.namespace??tool.name)+(fresh.testScope?':check:'+fresh.testScope:''),tool));
             return {messages:[{role:'user',content:{type:'text',text:JSON.stringify({kind:'studio-prompt-data',prompt:tool.name,data:text})}}]};
           }));continue;
         }
@@ -135,10 +135,10 @@ export async function remoteMcp(request,env,ctx,{catalogueOf,definitions=[]}) {
             const fresh=await identity();
             if(!toolInScope(fresh,tool.name)||!await allowed(tool.audience,fresh,env)){outcome='denied';throw new Error('Permission denied');}
             try{await rate(fresh);}catch(error){outcome='limited';throw error;}
-            const context=services(env,cat,origin,fresh,tool.namespace??tool.name,tool);
+            const context=services(env,cat,origin,fresh,(tool.namespace??tool.name)+(fresh.testScope?':check:'+fresh.testScope:''),tool);
             if(tool.price) {const result=await selling.paidTool(env,cat,origin,tool,args,context,extra);outcome=result.isError?'error':'ok';return result;}
             if(tool.protocol) {const result=await tool.handler(args,{...context,paymentExtra:extra});outcome=result.isError?'error':'ok';return result;}
-            const value=await tool.handler(args,{...context,request});
+            const value=await (await import('./app-tools.mjs')).invokeAppTool(tool,args,{...context,request});
             const text=JSON.stringify({kind:'untrusted-tool-data',tool:tool.name,data:value});
             outcome='ok';return {content:[{type:'text',text}]};
           }catch(error){if(error?.code===-32042)throw error;return {isError:true,content:[{type:'text',text:outcome==='denied'||outcome==='limited'||error?.name==='StudioOperationError'?error.message:(freshErrorMessage(error,env,caller))}]};}