@homie-rocks/studio 0.52.0 → 0.53.0

package/worker/index.mjs

@@ -123,7 +123,7 @@ import { cookieValues, count, countVisit, counter, isQa, onlyOf, ownerAllowed, p
 import { ownerRoutes } from './stats-page.mjs';
 import { playerRoutes, players as playerAccounts } from './players.mjs';
 import {
-  accessOf, accountSub, gatePage, holders, isOwner, joinHolders, launchOf, regateArgs, officeRoutes, publicCatalogue, redeemInvite, sameOrigin, seatsFor, settingsOf, ticketAllows,
+  appAssetTicket, accessOf, accountSub, gatePage, holders, isOwner, joinHolders, launchOf, regateArgs, officeRoutes, publicCatalogue, redeemInvite, sameOrigin, seatsFor, settingsOf, ticketAllows,
   ticketFor, ticketSub, usePlayers, verifyControl,
 } from './office.mjs';
 
@@ -154,7 +154,7 @@ export { mergeSaves } from './saves.mjs';
 const GAME_ID = /^[a-z0-9][a-z0-9-]{0,39}$/;
 const POST_SLUG = /^[a-z0-9][a-z0-9-]{0,79}$/;
 /** A game's own files, framed by its play page: never x-frame-options DENY. */
-const GAME_FILES = /^\/[a-z0-9][a-z0-9-]{0,39}\/__game(?:\/|$)/;
+const GAME_FILES = /^\/[a-z0-9][a-z0-9-]{0,39}\/(?:__game|__assets)(?:\/|$)/;
 const MEDIA_FILE = /\.(mp4|webm|m4v|mov|mp3|m4a|aac|ogg|opus|wav|flac)$/i;
 /** A browser's room key (random, kept in the play page's own storage) and a play ticket, as they may appear in an address. */
 const BROWSER_KEY = /^[A-Za-z0-9_-]{16,43}$/;
@@ -539,7 +539,8 @@ async function gameDocument(request, env, url, game, meta, cat, { agent = null }
   };
   let html = await res.text();
   const fallback = meta?.kind === 'app' ? `<script>addEventListener('DOMContentLoaded',()=>(${appGraphicsFallback.toString()})(${JSON.stringify(meta.words?.fallback ?? 'This device cannot display the 3D scene. Use the text controls to continue.').replace(/</g, '\\u003c')}));</script>` : '';
-  const head = `<script>${JOIN_AREA_FRAME_JS}</script>` + (meta.kind==='app'?`<script>${APP_STORAGE_JS}</script>`:'') + fallback + `${embedded ? `<script>${EMBED_GAME_JS}</script>` : ''}<script>window.HOMIE_NET=${JSON.stringify(cfg).replace(/</g, '\\u003c')}</script>`;
+  const assetBase = meta.kind === 'app' && !url.pathname.includes('/__assets/') && launchOf(meta, await settingsOf(env, {fresh:true}), env) !== 'public' ? `<base href="/${game}/__assets/${await appAssetTicket(env,game)}/">` : '';
+  const head = assetBase + `<script>${JOIN_AREA_FRAME_JS}</script>` + (meta.kind==='app'?`<script>${APP_STORAGE_JS}</script>`:'') + fallback + `${embedded ? `<script>${EMBED_GAME_JS}</script>` : ''}<script>window.HOMIE_NET=${JSON.stringify(cfg).replace(/</g, '\\u003c')}</script>`;
   html = /<head[^>]*>/i.test(html) ? html.replace(/<head([^>]*)>/i, `<head$1>${head}`) : head + html;
   return new Response(html, {
     headers: {
@@ -637,6 +638,8 @@ export default {
     env=await loadShopLinks(env,new URL(request.url).origin);
     await removeReferralLeftovers(env);
     const url = new URL(request.url);
+    if(env.HOMIE_CONCEPT==='1' && url.pathname==='/robots.txt')return new Response('User-agent: *\nDisallow: /\n',{headers:{'content-type':'text/plain','x-robots-tag':'noindex, nofollow'}});
+    if(env.HOMIE_CONCEPT==='1' && url.pathname==='/.well-known/homie-studio.json')return json({ok:false,error:'concept-unlisted'},404,{'x-robots-tag':'noindex, nofollow'});
     await (await import('./functions.mjs')).syncFunctions(env);
     const dispatch=()=>import('./functions.mjs').then(m=>m.runFunctions(env,()=>catalogue(env,url.origin),url.origin));
     // Some routes reconcile shop state in waitUntil after returning their page.
@@ -665,6 +668,16 @@ export default {
         if(ctx?.waitUntil)ctx.waitUntil(delivery);else await delivery;
       }
     }
+    if(env.HOMIE_CONCEPT==='1' && res.status!==101) {
+      const headers=new Headers(res.headers);headers.set('x-robots-tag','noindex, nofollow');
+      let body=res.body;
+      if(/text\/html/i.test(headers.get('content-type')??'')) {
+        const html=await res.text(),banner='<aside role="status" style="position:fixed;z-index:2147483647;top:0;left:0;right:0;text-align:center;background:#ffda44;color:#171717;padding:6px;font:bold 14px system-ui;pointer-events:none">TEST / CONCEPT</aside>';
+        body=/<body[^>]*>/i.test(html)?html.replace(/<body[^>]*>/i,m=>m+banner):banner+html;
+        headers.delete('content-length');
+      }
+      res=new Response(body,{status:res.status,headers});
+    }
     if (appLobby || appRecords) return appCors(request, res);
     return res;
   },
@@ -842,7 +855,7 @@ async function route(request, env, ctx) {
     if (own.ok) return own;
     const cat = await getCat();
     const method = request.method;
-    if (path === '/robots.txt') return discoveryResponse(robotsTxt(cat, url.origin, { preview: env.HOMIE_PREVIEW === '1' }), 'text/plain', { method });
+    if (path === '/robots.txt') return discoveryResponse(robotsTxt(cat, url.origin, { preview: env.HOMIE_PREVIEW === '1' || env.HOMIE_CONCEPT === '1' }), 'text/plain', { method });
     const all = await getAll();
     if (path === '/sitemap.xml') return discoveryResponse(sitemapXml(cat, url.origin, { all }), 'application/xml', { method });
     const full = path === '/llms-full.txt';
@@ -927,6 +940,10 @@ async function route(request, env, ctx) {
     return postPage(cat, post, { origin: url.origin });
   }
 
+  if(parts[0]==='games' && parts.length>2) {
+    const all=await getAll(),app=(all.games??[]).find(g=>g.id===parts[1]&&g.kind==='app');
+    if(app && launchOf(app,await settingsOf(env,{fresh:true}),env)!=='public')return json({ok:false,error:'not-found'},404);
+  }
   const game = parts[0];
   if (game && GAME_ID.test(game)) {
     const all = await getAll();
@@ -949,7 +966,20 @@ async function route(request, env, ctx) {
     const launch = launchOf(meta, settings, env);
     const max = seatsFor(meta, settings);
     if (meta.kind === 'app') {
-      if (launch !== 'public' && !(await accessOf(request, env, game, launch)).ok) return json({ ok: false, error: 'not-found' }, 404);
+      const asset=/^__assets\/([^/]+)\/(.+)$/.exec(sub);
+      if(asset) {
+        if(!(await appAssetTicket(env,game,asset[1])))return json({ok:false,error:'not-found'},404);
+        const response=asset[2]==='index.html'?await gameDocument(request,env,url,game,meta,cat):await gameAsset(request,env,url,game,asset[2]);
+        response.headers.set('cache-control','private, no-store');
+        response.headers.set('referrer-policy','no-referrer');
+        return response;
+      }
+      const frameTicket = ['__game','__game/','__game/index.html','__net','__watch'].includes(sub) && await ticketAllows(env, await ticketSub(env,game,url.searchParams.get('t')), launch);
+      if (launch !== 'public' && !frameTicket && !(await accessOf(request, env, game, launch)).ok && (await (await import('./local-test.mjs')).localSession(request,env))?.app!==game) return json({ ok: false, error: 'not-found' }, 404);
+      if(launch==='public') {
+        const web=await (await import('./app-web.mjs')).appWeb(request,env,meta,url,sub,()=>gameDocument(request,env,url,game,meta,cat));
+        if(web)return web;
+      }
       if(sub==='api/app/live') {
         if(request.method!=='GET')return new Response('GET required',{status:405});
         const {appHub}=await import('./app-streams.mjs');
@@ -965,7 +995,7 @@ async function route(request, env, ctx) {
           if (a.status === 401) return Response.redirect(`${url.origin}/account/?next=${encodeURIComponent(url.pathname + url.search)}`, 302);
           return json({ ok: false, error: a.error }, a.status);
         }
-        if(!meta.room)return recordsPage(meta,url,cat,await availableShellShop(env,cat,game),Boolean(await (await import('./local-test.mjs')).localSession(request,env)));
+        if(!meta.room)return recordsPage(meta,url,cat,await availableShellShop(env,cat,game),Boolean(await (await import('./local-test.mjs')).localSession(request,env)),launch!=='public'?await appAssetTicket(env,game):null);
       }
     }
     const lobby = () => env.LOBBY.get(env.LOBBY.idFromName(game));

package/worker/local-test.mjs

@@ -1,6 +1,8 @@
 /** Only dev supplies this secret. Neither a loopback URL nor a role parameter grants authority. */
 const local = (request, env) => env.HOMIE_LOCAL_TEST_SECRET && ['localhost','127.0.0.1','[::1]'].includes(new URL(request.url).hostname);
 export async function localCaller(request, env) {
+  const remote=await remoteSession(request,env);
+  if(remote)return {id:`check-${remote.app}-${remote.role}`,owner:false,client:null,localTest:true,remoteTest:true,roles:{[remote.app]:[remote.role]},testApp:remote.app,testScope:remote.scope};
   if (!local(request, env) || request.headers.get('authorization') !== `Bearer ${env.HOMIE_LOCAL_TEST_SECRET}`) return null;
   const session=await localSession(request,env);
   // A supplied but invalid signed session must never fall back to owner.
@@ -9,6 +11,7 @@ export async function localCaller(request, env) {
   return {id:'local-test-owner',owner:true,client:null};
 }
 export async function localSession(request, env) {
+  const remote=await remoteSession(request,env);if(remote)return remote;
   if (!local(request, env)) return null;
   const token = /(?:^|;\s*)homie_test=([^;]+)/.exec(request.headers.get('cookie') ?? '')?.[1];
   if (!token) return null;
@@ -21,3 +24,10 @@ export async function localSession(request, env) {
     return /^[a-z][a-z0-9-]*$/.test(session.app) && /^[a-z][a-z0-9-]*$/.test(session.role) && (!session.scope || /^[a-zA-Z0-9-]+$/.test(session.scope)) ? session : null;
   } catch { return null; }
 }
+
+async function remoteSession(request,env) {
+ const token=/(?:^|;\s*)homie_check=([^;]+)/.exec(request.headers.get('cookie')??'')?.[1];
+ if(!token)return null;
+ const session=await (await import('./office.mjs')).checkSessionTicket(env,null,token);
+ return session?.origin===new URL(request.url).origin?{...session,remoteTest:true}:null;
+}

package/worker/mcp-events.mjs

@@ -41,9 +41,9 @@ export async function pollEvents(env,cat,caller,params,now=Date.now()){
   const rows=(await env.DB.prepare(`SELECT seq,id,type,data,at FROM studio_events
     WHERE type=?1 AND seq>?2 AND seq<=?3 AND scope IS ?7
       AND (?4 IS NULL OR (json_extract(data,'$.app')=?4 AND json_extract(data,'$.collection')=?5))
-    ORDER BY seq LIMIT ?6`).bind(feed.event,start.after,start.through,feed.event==='record.changed'?(env.HOMIE_LOCAL_TEST_SECRET&&caller.localTest&&caller.testScope?`${feed.app}:check:${caller.testScope}`:feed.app):null,feed.collection??null,max+1,feed.event==='record.changed'?null:caller.testScope??null).all()).results;
+    ORDER BY seq LIMIT ?6`).bind(feed.event,start.after,start.through,feed.event==='record.changed'?((env.HOMIE_LOCAL_TEST_SECRET||caller.remoteTest)&&caller.localTest&&caller.testScope?`${feed.app}:check:${caller.testScope}`:feed.app):null,feed.collection??null,max+1,feed.event==='record.changed'?null:caller.testScope??null).all()).results;
   const hasMore=rows.length>max,page=rows.slice(0,max);
-  const events=page.map(row=>{const data=JSON.parse(row.data);if(env.HOMIE_LOCAL_TEST_SECRET&&caller.localTest&&caller.testScope&&feed.event==='record.changed')data.app=feed.app;return occurrence(params.name,{...row,data},cursorOf(params.name,row.seq));});
+  const events=page.map(row=>{const data=JSON.parse(row.data);if((env.HOMIE_LOCAL_TEST_SECRET||caller.remoteTest)&&caller.localTest&&caller.testScope&&feed.event==='record.changed')data.app=feed.app;return occurrence(params.name,{...row,data},cursorOf(params.name,row.seq));});
   const after=hasMore?page.at(-1).seq:start.through;
   return {events,cursor:cursorOf(params.name,after),truncated:start.truncated,hasMore,nextPollMs:5000};
 }

package/worker/mcp-tools.mjs

@@ -1,3 +1,4 @@
+import {bookingInputSchema,normalizeBookingArgs} from './booking-options.mjs';
 import {bookingHolds} from './booking-holds.mjs';
 import {toolDatabase} from './tool-database.mjs';
 import { selling } from './extensions.mjs';
@@ -16,7 +17,7 @@ export async function allowed(audience, caller, env) {
   if (audience === 'studio-staff') return caller.owner === true || Boolean(await env.DB.prepare("SELECT player FROM app_roles WHERE app='*' AND role='staff' AND player=?1").bind(caller.id).first());
   if (audience === 'owner') return caller.owner === true;
   if (audience && typeof audience === 'object' && audience.app && audience.role) {
-    if(env.HOMIE_LOCAL_TEST_SECRET && caller.localTest)return caller.owner || Boolean(caller.roles?.[audience.app]?.includes(audience.role));
+    if((env.HOMIE_LOCAL_TEST_SECRET || caller.remoteTest) && caller.localTest)return caller.owner || Boolean(caller.roles?.[audience.app]?.includes(audience.role));
     return caller.owner || Boolean(await env.DB.prepare("SELECT player FROM app_roles WHERE app IN (?1,'*') AND role=?2 AND player=?3").bind(audience.app,audience.role,caller.id).first());
   }
   return false;
@@ -38,9 +39,11 @@ export async function currentCaller(env, props) {
 }
 export function services(env, cat, origin, caller, namespace, definition = {}) {
   const records = async ({app,role,collection,id,operation='read',data,version}) => {
+    if(operation!=='read'&&!id)throw Object.assign(new Error('Put id at the top level of the arguments, alongside app and collection (1–64 letters, digits, underscore or hyphen).'),{name:'StudioOperationError'});
+    if(caller.remoteTest&&app!==caller.testApp)throw new Error('Test session belongs to another app');
     const meta = cat.games.find(g=>g.id===app && g.kind==='app');
     if (!meta || !/^[a-z][a-z0-9-]{0,39}$/.test(collection) || (id!==undefined && !/^[A-Za-z0-9_-]{1,64}$/.test(id))) throw Object.assign(new Error('Unknown app or collection; collection names start with a lowercase letter and use lowercase letters, digits and hyphens (1–40). Record id: 1–64 letters, digits, underscore or hyphen.'),{name:'StudioOperationError'});
-    if (!caller.owner && launchOf(meta,await settingsOf(env,{fresh:true}),env)!=='public') throw new Error('app is private');
+    if (!caller.owner && !caller.remoteTest && launchOf(meta,await settingsOf(env,{fresh:true}),env)!=='public') throw new Error('app is private');
     if(!role) {
       const candidates=[];
       for(const [name,declared] of Object.entries(meta.roles??{})) {
@@ -90,6 +93,13 @@ export function services(env, cat, origin, caller, namespace, definition = {}) {
 export function builtins(env,cat,origin) {
   const tool=(name,description,audience,inputSchema,handler)=>({name,description,audience,inputSchema,handler});
   const tools=[
+    tool('studio_check_session','Owner: create a short-lived app-role test session with isolated records. Never grants global owner access.','owner',object({app:str,role:str,scope:{type:'string',pattern:'^check-[a-zA-Z0-9-]{1,64}$'}},['app','role','scope']),async(args,ctx)=>{
+      if(!ctx.caller.owner)throw new Error('Owner required');
+      const meta=cat.games.find(g=>g.id===args.app&&g.kind==='app');
+      if(!meta?.roles?.[args.role])throw new Error('Name a declared app role');
+      const token=await (await import('./office.mjs')).checkSessionTicket(env,{...args,origin});
+      return {token,expiresIn:900};
+    }),
     tool('studio_events_clear','Owner: permanently clear retained events and deliveries through a sequence number. Newer events remain.','owner',object({through:{type:'integer',minimum:0}},['through']),async({through},ctx)=>{
       if(!ctx.caller.owner)throw new Error('Owner only');
       if(!Number.isSafeInteger(through)||through<0)throw new Error('Invalid event cursor');
@@ -166,6 +176,14 @@ export function builtins(env,cat,origin) {
       const collections=new Set(Object.values(roles).flatMap(r=>r.can.map(cap=>cap.split(':')[1])));
       return {app,roles,collections:Object.fromEntries(Object.entries(meta.records?.collections??{}).filter(([name])=>collections.has(name)))};
     }),
+    tool('studio_book','Reserve a declared booking slot. Accepts slot/time, resource/preferredResource, and addons/addOns as an array or quantity object. Supply a stable id, future expiresAt and a private token for an anonymous booking. Payment is separate.','public',bookingInputSchema,async(input,ctx)=>{
+      const args=normalizeBookingArgs(input),meta=cat.games.find(g=>g.id===args.app&&g.kind==='app'),spec=meta?.records?.collections?.[args.collection]?.booking;
+      if(!spec)throw Object.assign(new Error('Unknown booking collection'),{name:'StudioOperationError'});
+      const minutes=Number.isSafeInteger(spec.holdMinutes)&&spec.holdMinutes>0?Math.min(spec.holdMinutes,1440):15;
+      if(!Number.isSafeInteger(args.expiresAt)||args.expiresAt<=Date.now()||args.expiresAt>Date.now()+minutes*60000)throw Object.assign(new Error(`Hold expiry must be within ${minutes} minutes`),{name:'StudioOperationError'});
+      await ctx.records({app:args.app,collection:spec.slots,id:args.slot});
+      return ctx.bookings.hold(args);
+    }),
     tool('app_records','List, read, create, update or delete app records with the app role and record version.','public',object({app:str,role:str,collection:{type:'string',pattern:'^[a-z][a-z0-9-]{0,39}$'},id:{type:'string',pattern:'^[A-Za-z0-9_-]{1,64}$',description:'1–64 letters, digits, underscore or hyphen'},operation:{enum:['read','create','update','delete']},data:{type:'object',propertyNames:{pattern:'^[a-z][a-z0-9_]*$'},description:'Field names start with a lowercase letter and use lowercase letters, digits and underscore; discover fields with app_schema.'},version:{type:'integer',minimum:1}},['app','collection']), (args,ctx)=>ctx.records(args)),
   ];
   for(const [name,path,description] of [

package/worker/office.mjs

@@ -1377,3 +1377,30 @@ export async function officeRoutes(request, env, url, { catalogueOf }) {
   }
   return null;
 }
+
+/** Asset-only capability: cannot authenticate records, tools or room sockets. */
+export async function appAssetTicket(env, app, ticket) {
+  const key=await officeKey(env);if(!key)return null;
+  if(ticket===undefined) {
+    const exp=(Date.now()+5*60_000).toString(36);
+    return `${exp}.${(await mac(key,`app-assets|${app}|${exp}`)).slice(0,32)}`;
+  }
+  const m=/^([a-z0-9]+)\.([A-Za-z0-9_-]{32})$/.exec(ticket);
+  return Boolean(m && parseInt(m[1],36)>Date.now() && same((await mac(key,`app-assets|${app}|${m[1]}`)).slice(0,32),m[2]));
+}
+
+/** Owner-issued test role, scoped to one app/record namespace; never an owner credential. */
+export async function checkSessionTicket(env, data, token) {
+ const key=await officeKey(env);if(!key)return null;
+ if(token===undefined) {
+  const payload=b64url(new TextEncoder().encode(JSON.stringify({...data,expires:Date.now()+15*60_000})));
+  return payload+'.'+await mac(key,'check-session|'+payload);
+ }
+ try {
+  const [payload,signature,...extra]=token.split('.');
+  if(extra.length||!signature||!same(await mac(key,'check-session|'+payload),signature))return null;
+  const session=JSON.parse(atob(payload.replaceAll('-','+').replaceAll('_','/')));
+  if(session.expires<=Date.now()||!Number.isSafeInteger(session.expires)||!/^check-[a-zA-Z0-9-]{1,64}$/.test(session.scope)||!GAME_ID.test(session.app)||!/^[a-z][a-z0-9-]{0,39}$/.test(session.role))return null;
+  return session;
+ }catch{return null;}
+}

package/worker/records-page.mjs

@@ -5,10 +5,10 @@ import {SHOP_SHELL_JS, SHOP_SHELL_CSS} from './shop-page.mjs';
 import {RECORDS_PREFS_JS} from './records-prefs.mjs';
 import {APP_SHELL_JS} from './app-shell.mjs';
 /** A records-only app has no room simulation. The shell owns one frame and its authenticated records bridge. */
-export function recordsPage(meta,url,cat={},shop=null,test=false) {
+export function recordsPage(meta,url,cat={},shop=null,test=false,assetTicket=null) {
  const params=new URLSearchParams(url.search);params.delete('access');params.set('pf','1');params.set('role',appRole(meta,url));if(!params.has('surface'))params.set('surface',url.pathname.endsWith('/tv')?'wall':'phone');
  const tags=Object.entries(playerProperties(cat,meta,{origin:url.origin})).map(([name,content])=>`<meta name="${esc(name)}" content="${esc(content)}">`).join('');
  const boot={kind:'app',test,game:meta.id,screen:url.pathname.endsWith('/tv'),shop};
- const source=`/${meta.id}/__game/?${params}`;
+ const source=assetTicket?`/${meta.id}/__assets/${assetTicket}/index.html?${params}`:`/${meta.id}/__game/?${params}`;
  return new Response(`<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${esc(meta.name)}</title>${tags}<style>${SHOP_SHELL_CSS}html,body{margin:0;height:100%;background:#10151c;color:white;font:18px system-ui}iframe{border:0;width:100%;height:100%;display:block}[data-arrive]{position:fixed;inset:0;display:grid;place-items:center;background:#10151c}[data-arrive][hidden]{display:none;opacity:0;visibility:hidden}</style></head><body><div data-arrive>Opening ${esc(meta.name)}…</div><iframe class="game" title="${esc(meta.name)}" sandbox="allow-scripts allow-forms allow-modals allow-popups allow-downloads" allow="autoplay *; fullscreen *; web-share *"></iframe><script>window.__HOMIE_APP=${JSON.stringify(boot).replace(/</g,'\\u003c')};window.__HOMIE_PLAY=window.__HOMIE_APP;window.__shell={room:new URLSearchParams(location.search).get('room')||'main',link:{state:'connecting'},arrival:{phase:'loading'}};</script><script>${APP_SHELL_JS}</script><script>${RECORDS_PREFS_JS}</script><script>${SHOP_SHELL_JS}</script><script>const frame=document.querySelector('iframe');frame.addEventListener('load',()=>{if(!frame.getAttribute('src'))return;requestAnimationFrame(()=>requestAnimationFrame(()=>{document.querySelector('[data-arrive]').hidden=true;window.__shell.link.state='online';window.__shell.arrival.phase='done';}));});frame.src=${JSON.stringify(source).replace(/</g,'\\u003c')};</script></body></html>`,{headers:{'content-type':'text/html;charset=utf-8','cache-control':'no-store, no-transform','x-frame-options':'SAMEORIGIN'}});
 }

package/worker/shop.mjs

@@ -577,7 +577,7 @@ async function startCheckout(env, url, cat, shop, item, { player, game, amount,
   }
   if (keyless) {
     const checkout = new URL(link.url); checkout.searchParams.set('client_reference_id', order.id);
-    if(menu?.basket)checkout.searchParams.set('prefilled_amount',String(amount));
+    if(menu?.basket || item.kind==='deposit')checkout.searchParams.set('prefilled_amount',String(amount));
     return { order, url: checkout.href, reconciled };
   }
   let session = null;
@@ -650,6 +650,8 @@ async function buyRoute(request, env, url, cat, shop, ready, ctx, requestAt) {
     if (!item) return fail(404, 'item', 'no such item here');
     const quantity = entry.quantity ?? 1;
     if (!Number.isSafeInteger(quantity) || quantity < 1) return fail(400, 'arithmetic', 'Quantity is a positive safe integer.');
+    if(!hasStripeKey(env) && ['supporter','deposit'].includes(item.kind) && quantity!==1)return fail(400,'quantity','This payment link has quantity fixed at one.');
+    if(item.kind==='deposit' && (!reference || !Number.isSafeInteger(entry.amount??item.price) || (entry.amount??item.price)<=0))return fail(400,'deposit','A deposit requires the app reference and its saved positive amount.');
     if (!shop.policy.repeatPurchases && (quantity > 1 || seen.has(item.id))) return fail(403, 'owned', 'The studio has disabled repeat purchases.');
     seen.add(item.id);
     const v = await itemsView(env, shop, { game, ...facts, player, open: true, item, purchasing: true });
@@ -679,6 +681,7 @@ async function buyRoute(request, env, url, cat, shop, ready, ctx, requestAt) {
     const collection = requestedBooking?.collection;
     const spec = app?.records?.collections?.[collection]?.booking;
     if (!spec || !/^[A-Za-z0-9_-]{1,64}$/.test(requestedBooking?.slot ?? '') || lines.length !== 1 || item.id !== spec.item || item.interval) return fail(400, 'booking', 'Choose a declared booking slot and its service item.');
+    if(spec.resources&&requestedBooking.hold===undefined)return fail(409,'booking','Reserve the resource through the booking tool and pass its hold before checkout.');
     const local = await localSession(request, env);
     booking = { app: local?.app === game && local.scope ? `${game}:check:${local.scope}` : game, collection, slots: spec.slots, slot: requestedBooking.slot, quantity: lines[0].quantity };
     if(requestedBooking.hold!==undefined){
@@ -976,7 +979,9 @@ async function bindLinkSession(env, session, mode) {
   if (!link || (session.payment_link?.id ?? session.payment_link) !== link.id || session.metadata?.revision !== link.revision || session.currency !== source.currency) return false;
   const amount = session.amount_subtotal;
   if (!Number.isSafeInteger(amount) || amount <= 0) return false;
+  if(item.kind==='deposit' && amount!==source.amount)return false;
   const quantity = item.price === 'choose' ? 1 : amount / item.price;
+  if(['supporter','deposit'].includes(item.kind) && quantity!==1)return false;
   if (!Number.isSafeInteger(quantity) || quantity < 1 || quantity > 999999) return false;
   if (item.price === 'choose' && (amount < item.min || item.max !== null && amount > item.max)) return false;
   // Claim the first session atomically. A repeated URL creates a separate paid order, never loses a payment.

package/worker/version.mjs

@@ -1,2 +1,2 @@
 /** The @homie-rocks/studio version this Worker code is (package.json's; a test keeps them equal). Cache-busts /_homie/site.js. */
-export const STUDIO_VERSION_TAG = '0.52.0';
+export const STUDIO_VERSION_TAG = '0.53.0';