@homie-rocks/studio 0.52.0 → 0.54.0

package/shop/SHOP.md

@@ -305,7 +305,7 @@ await shop.checkout({ reference: 'table-7' });
 The default opens the synced Stripe menu containing those items. The guest chooses
 final quantities **on Stripe**, starting at one for each menu line; the local cart's
 quantities are not prefilled. Adjustable quantity minimum is zero (Stripe prevents
-removing the last item). Payment Links support at most 20 lines. Keyless sync splits catalogues into menus of ten to fit signed invoice snapshots without authenticated pagination. Split larger menus;
+removing the last item); maximum is the item’s `maxQuantity` from shop.json, default 99 (a positive integer up to 999999). Payment Links support at most 20 lines. Keyless sync splits catalogues into menus of ten to fit signed invoice snapshots without authenticated pagination. Split larger menus;
 if selected items span menus, the app receives `menu` and should offer separate
 checkouts. Custom amounts cannot be mixed into this menu; offer a separate tip link.
 Stripe invoice creation is enabled for menus (Stripe's invoice pricing applies).
@@ -329,8 +329,7 @@ the owner's AI write the complete manifest to `.studio/booking-slots.json` and r
 
 Sync after publishing or changing slots. Removed or inactive slots deactivate their
 links. Each link has `restrictions.completed_sessions.limit = capacity`, with one
-fixed service and one seat per checkout. Re-sync preserves Stripe's lifetime completed
-count. Free slots stay local and use separate slot records from paid links. Never increment capacity just to hide a full-link error.
+fixed service and an adjustable group quantity up to the published remaining seats. Stripe counts completed sessions, not seats: supply the reviewed `confirmed` seat total when resyncing. The database confirms the paid quantity atomically; a capacity race becomes a visible review order rather than an overbooking. Re-sync preserves Stripe's lifetime completed count. Free slots stay local and use separate slot records from paid links. Never increment capacity just to hide a full-link error.
 Refunds do not decrement Stripe's completed-session counter; the owner's AI must
 review availability and resync explicitly. A changed price should use a new slot;
 do not replace a sold link and accidentally reset its capacity counter.
@@ -441,15 +440,20 @@ stored preset or an empty amount; keep the expected total visible on the phone.
 
 After a signed paid session matches the frozen link, revision, mode, currency and
 order reference, `order.paid` contains the **saved basket lines**, `amount` (actual
-payment), `basketTotal` (expected total), and `settlement` (`paid` or `short`).
+payment), `basketTotal` (expected total), and `settlement` (`paid`).
 Line `amount` is the saved extended amount (unit price × quantity); line `total`
 is its proportionally allocated share of the actual aggregate payment for refunds.
-A short payment emits the event so staff can resolve it, but grants no automatic
-entitlements. Apps must compare the actual payment with `basketTotal`, show a
-shortfall explicitly, and deduplicate by order ID. More than the total is paid.
-Reopening and paying the link creates another order for the same frozen basket;
-repeated delivery of the same session never creates another round.
+A payment that differs from the saved basket total emits `payment.review`, retains
+the actual payment, and shows the customer a staff-review notice. It never emits
+`order.paid` or grants entitlements. Staff reconcile or refund the difference.
+Exact payments emit `order.paid`; deduplicate fulfillment by order ID.
 
 The Stripe heading is the connected Stripe account's business name. A sandbox
 account named “Homie sandbox” shows that name; a real pub's account shows the pub's
 name. The basket's product name and description use the pub's own wording.
+
+### Payments requiring review
+
+A signed paid deposit or basket that cannot match its saved order is retained as a `review` order, with the payment ID and actual total, a customer notice and a durable `payment.review` event. Staff reconcile fulfillment or refund in Stripe. Group payments that exceed remaining capacity follow the same path without granting seats. Repeated events do not duplicate the review order.
+
+Full connect saves `.studio/stripe-mcp.json` and public purchase configuration for the build’s JSON asset, just like plugin verification. Rebuild/deploy before retiring old links. `STRIPE_CHECKOUT_MODE` stays in public Wrangler vars; only the webhook signing secret and private purchase signing keys use secrets.

package/shop/shop.ts

@@ -71,7 +71,7 @@ export interface Shop {
   cart(): CartLine[];
   clear(): void;
   /** Opens Checkout: keyless bookings are pending until paid; explicit session checkout holds capacity. The returned ID tracks the public booking record. */
-  book(item: string, booking: { collection: string; slot: string; hold?: string; token?: string }, quantity?: number): Promise<{ ok: boolean; booking?: string; error?: string }>;
+  book(item: string, booking: { collection: string; slot: string; hold?: string; token?: string }, quantity?: number, options?: { reference?: string }): Promise<{ ok: boolean; booking?: string; error?: string }>;
   checkout(options?: { reference?: string }): Promise<boolean>;
   buy(item: string, quantity?: number, amount?: number, options?: { reference?: string }): Promise<boolean>;
   /** Mark an item used; the studio's refundUsedItems policy decides whether self-service refunds still apply. */
@@ -154,8 +154,8 @@ export function createShop(opts: ShopOptions = {}): Shop {
     add: (item, quantity = 1, amount) => { cart.push({ item, quantity, ...(amount === undefined ? {} : { amount }) }); },
     cart: () => cart.map((line) => ({ ...line })),
     clear: () => { cart = []; },
-    book: async (item, booking, quantity = 1) => {
-      const r = await send({ op: 'checkout', booking, lines: [{ item, quantity }] });
+    book: async (item, booking, quantity = 1, options = {}) => {
+      const r = await send({ op: 'checkout', booking, reference: options.reference, lines: [{ item, quantity }] });
       return { ok: Boolean(r.ok), ...(typeof r.booking === 'string' ? { booking: r.booking } : {}), ...(typeof r.message === 'string' ? { error: r.message } : {}) };
     },
     checkout: async (options = {}) => { const ok = Boolean((await send({ op: 'checkout', lines: cart, reference: options.reference })).ok); if (ok) cart = []; return ok; },

package/tools/tools.ts

@@ -7,7 +7,8 @@ export interface ToolContext {
   office(path: string, body?: Record<string, unknown>, query?: Record<string, string>): Promise<unknown>;
   shop(): Promise<unknown>;
   bookings: {
-    hold(args: {app: string; collection: string; slot: string; quantity?: number; id: string; token?: string; expiresAt: number}): Promise<BookingHold>;
+    calendar(args: {app:string;startDate:string;endDate:string;timeZone?:string;time?:string;days?:number;durationMinutes?:number;capacity?:number;weekdays?:number[];resources?:string[];options?:unknown[];prefix?:string}): Array<{id:string;start:string;end:string;capacity:number;date:string;timeZone:string}>;
+    hold(args: {app: string; collection: string; slot?: string; time?: string; option?: string; resource?: string; preferredResource?: string; addons?: string[] | Record<string,number>; addOns?: string[] | Record<string,number>; quantity?: number; id: string; token?: string; expiresAt: number}): Promise<BookingHold>;
     get(args: {id: string; token?: string}): Promise<BookingHold>;
     confirm(args: {id: string; token?: string; version: number}): Promise<BookingHold>;
     release(args: {id: string; token?: string; version: number}): Promise<BookingHold>;
@@ -47,4 +48,4 @@ export interface StudioTool<Input = Record<string, unknown>> {
 }
 export function defineTool<Input = Record<string, unknown>>(tool: StudioTool<Input>): StudioTool<Input> { return tool; }
 
-export interface BookingHold { id: string; slot: string; quantity: number; state: string; version: number; expiresAt: number | null; paid: boolean }
+export interface BookingHold { allocations?: Array<{resource:string;collection:string;start:number;end:number;units:number}>; choices?: {option:string|null;resource:string|null;addons:Record<string,number>}; id: string; slot: string; quantity: number; state: string; version: number; expiresAt: number | null; paid: boolean }

package/worker/app-format.mjs

@@ -6,6 +6,7 @@ const object = (x) => x && typeof x === 'object' && !Array.isArray(x);
 export function appProblems(meta) {
   const bad = [];
   if (!object(meta)) return ['app.json must be an object'];
+  if(meta.web!==undefined && (!object(meta.web)||!object(meta.web.manifest)||meta.web.serviceWorker!==undefined&&(typeof meta.web.serviceWorker!=='string'||meta.web.serviceWorker.includes('..')||!/^[-\w/]+\.js$/.test(meta.web.serviceWorker))))bad.push('web needs a manifest object and optional relative serviceWorker .js path');
   const roles = object(meta.roles) ? meta.roles : {};
   const collections = object(meta.records?.collections) ? meta.records.collections : {};
   if (!object(meta.roles) || !Object.keys(meta.roles).length) bad.push('roles must declare at least one role');
@@ -18,13 +19,15 @@ export function appProblems(meta) {
   if (!object(meta.records) || typeof meta.records.persist !== 'boolean' || !object(meta.records.collections)) bad.push('records declares persist and collections');
   for (const [id, c] of Object.entries(collections)) {
     if (!key.test(id) || !object(c) || !object(c.fields)) { bad.push(`collection ${id}: declare fields`); continue; }
-    for (const [field, spec] of Object.entries(c.fields)) if (!/^[a-z][a-z0-9_]*$/.test(field) || !object(spec) || !['string', 'number', 'boolean'].includes(spec.type) || (spec.enum && (!Array.isArray(spec.enum) || !spec.enum.length))) bad.push(`collection ${id}.${field}: invalid field: names start with a lowercase letter and use lowercase letters, digits and underscore; declare a string, number or boolean type`);
+    for (const [field, spec] of Object.entries(c.fields)) if (!/^[a-z][a-z0-9_]*$/.test(field) || !object(spec) || !['string', 'number', 'boolean', 'array', 'object'].includes(spec.type) || (spec.enum && (!Array.isArray(spec.enum) || !spec.enum.length))) bad.push(`collection ${id}.${field}: invalid field: names start with a lowercase letter and use lowercase letters, digits and underscore; declare a string, number, boolean, array or object type`);
   }
   for (const [id, c] of Object.entries(collections)) if (c.booking) {
     const spec = c.booking;
     if (!object(spec) || !key.test(spec.slots ?? '') || !collections[spec.slots] || typeof spec.item !== 'string' || !spec.item.trim()) bad.push(`collection ${id}: booking needs slots collection and shop item`);
+    if(spec.resources!==undefined&&(!key.test(spec.resources)||!collections[spec.resources]))bad.push(`collection ${id}: booking needs a declared resources collection`);
+    if(spec.holdMinutes!==undefined&&(!Number.isSafeInteger(spec.holdMinutes)||spec.holdMinutes<1||spec.holdMinutes>1440))bad.push(`collection ${id}: holdMinutes is 1–1440`);
     if (!meta.records.persist) bad.push(`collection ${id}: bookings need persistent records`);
-    for (const role of Object.values(roles)) if (!role.signIn && (role.can ?? []).some(cap => ['create','update','delete'].some(op => cap === `${op}:${id}` || cap === `${op}:${spec.slots}`))) bad.push(`collection ${id}: booking and slot writes require a signed-in staff role`);
+    for (const role of Object.values(roles)) if (!role.signIn && (role.can ?? []).some(cap => ['create','update','delete'].some(op => cap === `${op}:${id}` || cap === `${op}:${spec.slots}` || spec.resources&&cap === `${op}:${spec.resources}`))) bad.push(`collection ${id}: booking, slot and resource writes require a signed-in staff role`);
   }
   for (const r of Object.values(roles)) for (const cap of Array.isArray(r?.can) ? r.can : []) if (!Object.hasOwn(meta.records?.collections ?? {}, String(cap).split(':')[1])) bad.push(`unknown collection in ${cap}`);
   for (const [k, v] of Object.entries(meta.words ?? {})) if (!/^[a-z][a-zA-Z0-9-]*$/.test(k) || typeof v !== 'string' || v.length > 500) bad.push(`words.${k}: use a short label`);
@@ -43,7 +46,7 @@ export function recordProblem(collection, data, { create = false } = {}) {
   for (const [k, s] of Object.entries(collection.fields)) {
     const v = data[k];
     if (v === undefined) { if (s.required) return `missing ${k}`; continue; }
-    if (typeof v !== s.type || (s.type === 'number' && !Number.isFinite(v)) || (typeof v === 'string' && v.length > (s.maxLength ?? 256)) || (s.enum && !s.enum.includes(v)) || (create && s.initial !== undefined && v !== s.initial)) return `invalid ${k}`;
+    if ((s.type==='array'?!Array.isArray(v):s.type==='object'?!object(v):typeof v !== s.type) || (s.type === 'number' && !Number.isFinite(v)) || (typeof v === 'string' && v.length > (s.maxLength ?? 256)) || (s.enum && !s.enum.includes(v)) || (create && s.initial !== undefined && v !== s.initial)) return `invalid ${k}`;
   }
   return null;
 }

package/worker/app-records.mjs

@@ -4,9 +4,9 @@ import { moveBooking } from './booking-store.mjs';
 import { toolIdentity } from './tool-identity.mjs';
 /** Lasting app records in the studio's own D1. Room hosts never authorize writes. */
 import { appRole, recordProblem } from './app-format.mjs';
-import { isOwner, sameOrigin } from './office.mjs';
+import { appAssetTicket, isOwner, sameOrigin, launchOf, settingsOf } from './office.mjs';
 import { players } from './players.mjs';
-import { ownerAllowed } from './stats.mjs';
+import { cookieValues, ownerAllowed } from './stats.mjs';
 import { appOriginOf } from './standalone.mjs';
 export const APPS_MIGRATION_FILE = '0014_studio_apps.sql';
 export const APPS_MIGRATION = `CREATE TABLE IF NOT EXISTS app_records (
@@ -47,11 +47,13 @@ export async function appAccess(request, env, meta, url) {
   const caller = toolIdentity(request);
   if (caller) {
     if (caller.owner) return { ok: true, role, can: declared.can };
-    if(env.HOMIE_LOCAL_TEST_SECRET && caller.localTest && caller.roles?.[meta.id]?.includes(role))return {ok:true,role,can:declared.can};
+    if((env.HOMIE_LOCAL_TEST_SECRET || caller.remoteTest) && caller.localTest && caller.roles?.[meta.id]?.includes(role))return {ok:true,role,can:declared.can};
     if (!caller.id) return { ok: false, status: 401, error: 'sign in to this studio' };
     const grant = await env.DB.prepare("SELECT player FROM app_roles WHERE app IN (?1, '*') AND role = ?2 AND player = ?3").bind(meta.id, role, caller.id).first();
     return grant ? { ok: true, role, can: declared.can } : { ok: false, status: 403, error: 'this account has no role grant' };
   }
+  const handoff=cookieValues(request,`studio_app_${meta.id}_${role}`)[0];
+  if(handoff&&await appAssetTicket(env,meta.id,handoff,{meta,purpose:'handoff',expectedRole:role,launch:launchOf(meta,await settingsOf(env),env)}))return {ok:true,role,can:declared.can};
   const link = await env.DB.prepare('SELECT token FROM app_role_links WHERE app = ?1 AND role = ?2').bind(meta.id, role).first();
   if (!link || link.token !== url.searchParams.get('access')) return { ok: false, status: 404, error: 'private role link required' };
   if (await isOwner(request, env)) return { ok: true, role, can: declared.can };
@@ -91,7 +93,7 @@ export async function appRecordsRoute(request, env, meta, url, sub) {
     if (!access.ok) return fail(access.status, access.error);
     const [, collection, id] = match;
     const session = await localSession(request, env);
-    const testScope = (session?.app === meta.id ? session.scope : null) ?? (env.HOMIE_LOCAL_TEST_SECRET ? toolIdentity(request)?.testScope : null);
+    const testScope = (session?.app === meta.id ? session.scope : null) ?? (env.HOMIE_LOCAL_TEST_SECRET || toolIdentity(request)?.remoteTest ? toolIdentity(request)?.testScope : null);
     const recordApp = testScope ? `${meta.id}:check:${testScope}` : meta.id;
     const op = ({ GET: 'read', POST: 'create', PUT: 'update', DELETE: 'delete' })[request.method];
     if (!op || !access.can.includes(`${op}:${collection}`)) return fail(403, 'role cannot perform this operation');
@@ -118,7 +120,7 @@ export async function appRecordsRoute(request, env, meta, url, sub) {
       }
       return json({ok:true,records});
     }
-    if (!id) return fail(400, 'record id required');
+    if (!id) return fail(400, `Put the record id in the URL: /${meta.id}/api/app/records/${collection}/<id> (1–64 letters, digits, underscore or hyphen).`);
     const body = await bodyOf(request);
     if (meta.records.collections[collection].booking) {
       if (op !== 'update' || !meta.roles[access.role].signIn) return fail(403, 'bookings are created and released through checkout');
@@ -132,7 +134,19 @@ export async function appRecordsRoute(request, env, meta, url, sub) {
       ? env.DB.prepare('INSERT OR IGNORE INTO app_records (app, collection, id, value, version, updated_at) VALUES (?1, ?2, ?3, ?4, 1, ?5)').bind(recordApp, collection, id, JSON.stringify(body.data), Date.now())
       : op === 'update' ? env.DB.prepare('UPDATE app_records SET value = ?4, version = version + 1, updated_at = ?5 WHERE app = ?1 AND collection = ?2 AND id = ?3 AND version = ?6').bind(recordApp, collection, id, JSON.stringify(body.data), Date.now(), body.version)
       : env.DB.prepare('DELETE FROM app_records WHERE app = ?1 AND collection = ?2 AND id = ?3 AND version = ?4').bind(recordApp, collection, id, body.version);
-    const result = await stmt.run();
+    const bookingCollections=Object.entries(meta.records.collections).filter(([,c])=>c.booking?.slots===collection);
+    const writes=[stmt];
+    if(!testScope&&op!=='delete')for(const [bookings,c] of bookingCollections) {
+      const link=linkConfig(env)?.slots?.find(l=>l.app===meta.id&&l.slots===collection&&l.slot===id);
+      if(link&&link.capacity===body.data?.capacity)continue;
+      const expected=op==='create'?1:body.version+1;
+      writes.push(env.DB.prepare(`INSERT OR IGNORE INTO studio_events(id,type,data,at)
+        SELECT ?1,'booking.slots_need_payment_links',json_object('app',?2,'slots',json_array(json_object('app',?2,'collection',?3,'slots',?4,'slot',?5,'item',?6,'capacity',json_extract(value,'$.capacity')))),?7
+        FROM app_records WHERE app=?8 AND collection=?4 AND id=?5 AND version=?9
+        AND EXISTS(SELECT 1 FROM function_subscriptions WHERE type='booking.slots_need_payment_links')`)
+        .bind(`slot-links:${recordApp}:${collection}:${id}:${expected}`,meta.id,bookings,collection,id,c.booking.item,Date.now(),recordApp,expected));
+    }
+    const result=writes.length>1?(await env.DB.batch(writes))[0]:await stmt.run();
     return result.meta.changes ? json({ ok: true, id, version: op === 'create' ? 1 : body.version + 1 }) : fail(409, 'record changed or already exists; reload');
   } catch (error) {
     if (/booking capacity|capacity below|slot has active/.test(error.message)) return fail(409, error.message);

package/worker/app-shell.mjs

@@ -2,9 +2,14 @@
 export const APP_SHELL_JS = String.raw`(function () {
   var boot = window.__HOMIE_PLAY || window.__HOMIE_APP || window.__HOMIE_WATCH;
   if (!boot || boot.kind !== 'app') return;
-  var frame = document.querySelector('iframe.game') || document.querySelector('iframe');
+  var frame = boot.direct ? {contentWindow:window} : document.querySelector('iframe.game') || document.querySelector('iframe');
   var params = new URLSearchParams(location.search);
-  // Share short-lived reads across same-origin screens with the exact same role/access.
+  // Authorized shell responses have already set the HttpOnly role handoff.
+  if(params.has('access')) {
+    params.delete('access');
+    history.replaceState(null,'',location.pathname+(params.size?'?'+params:'')+(location.hash||''));
+  }
+  // Share short-lived reads across same-origin screens with the same role and browser cookies.
   // No records are persisted. Writes always reach the Worker and invalidate all views.
   var recent = new Map(), failures = new Map(), pending = new Map();
   var channel; try { channel = new BroadcastChannel('homie-app-records-v1'); } catch (_) {}
@@ -38,11 +43,11 @@ export const APP_SHELL_JS = String.raw`(function () {
   var live, collections=new Set(), presence=0, clock=null;
   function query() {
     var q=new URLSearchParams();
-    ['role','surface','access','room'].forEach(function(k){var v=params.get(k);if(v)q.set(k,v);});
+    ['role','surface','room'].forEach(function(k){var v=params.get(k);if(v)q.set(k,v);});
     if(boot.screen&&!q.has('role'))q.set('surface','wall');
     return q;
   }
-  function context() {return {app:boot.game,origin:location.origin,url:location.origin+'/'+boot.game+'/open',presence:presence,now:clock};}
+  function context() {var room=new URLSearchParams(location.search).get('room');return {app:boot.game,origin:location.origin,url:location.origin+'/'+boot.game+'/open'+(room&&/^[A-Za-z0-9_-]{1,32}$/.test(room)?'?room='+encodeURIComponent(room):''),presence:presence,now:clock};}
   function sendContext(){frame?.contentWindow?.postMessage({type:'homie-app-context',context:context()},'*');}
   function connect(){
     live?.close();
@@ -63,7 +68,7 @@ export const APP_SHELL_JS = String.raw`(function () {
     if (!frame || e.source !== frame.contentWindow || !m || !['homie-app','homie-app-tool'].includes(m.type) || !/^[a-f0-9]{32}$/.test(m.id || '')) return;
     if (m.type==='homie-app' && (!/^[a-z][a-z0-9-]{0,39}$/.test(m.collection || '') || !['GET','POST','PUT','DELETE'].includes(m.method) || (m.record !== undefined && !/^[A-Za-z0-9_-]{1,64}$/.test(m.record)))) return;
     var q = new URLSearchParams();
-    ['role','surface','access'].forEach(function (k) { var v = params.get(k); if (v) q.set(k, v); });
+    ['role','surface'].forEach(function (k) { var v = params.get(k); if (v) q.set(k, v); });
     if (boot.screen && !q.has('role')) q.set('surface', 'wall');
     var path = (boot.site || '') + '/' + boot.game + '/api/app/records/' + m.collection + (m.record ? '/' + m.record : '') + '?' + q;
     if(m.type==='homie-app-tool')path=(boot.site||'')+'/'+boot.game+'/api/app/tools?'+q;

package/worker/app-streams.mjs

@@ -1,3 +1,4 @@
+import {databaseBinding} from './request-db.mjs';
 import {appAccess} from './app-records.mjs';
 import {localSession} from './local-test.mjs';
 import {settingsOf,launchOf,accessOf} from './office.mjs';
@@ -10,15 +11,28 @@ END;`;}).join('\n')}
 `;
 const frame=value=>new TextEncoder().encode('data: '+JSON.stringify(value)+'\n\n');
 export const appHub=(env,app)=>env.LOBBY.get(env.LOBBY.idFromName('@app-records/'+app));
+const pushedRevisions=new WeakMap();
 export async function pushAppRecords(env,cat){
- if(!env.LOBBY||!env.DB)return;
- await Promise.all((cat.games??[]).filter(g=>g.kind==='app').map(meta=>appHub(env,meta.id).fetch('https://app/__app_records',{method:'POST',body:JSON.stringify({op:'wake',meta})}).catch(error=>console.error('App notification wake failed',error))));
+ const apps=(cat.games??[]).filter(g=>g.kind==='app');
+ if(!env.LOBBY||!env.DB||!apps.length)return;
+ const rows=(await env.DB.prepare(`SELECT app,collection,revision FROM app_record_revisions
+ UNION ALL SELECT a.app,'*',SUM(COALESCE(r.revision,0)) FROM app_tool_namespaces a LEFT JOIN tool_data_revisions r ON r.namespace=a.namespace GROUP BY a.app`).all()).results;
+ const signatures=new Map();for(const row of rows){const app=row.app.split(':check:')[0];signatures.set(app,(signatures.get(app)??'')+JSON.stringify(row));}
+ const binding=databaseBinding(env.DB),previous=pushedRevisions.get(binding)??new Map();
+ for(const meta of apps){
+  const signature=signatures.get(meta.id)??'';
+  if((previous.get(meta.id)??'')===signature)continue;
+  const response=await appHub(env,meta.id).fetch('https://app/__app_records',{method:'POST',body:JSON.stringify({op:'wake',meta})});
+  if(!response.ok)throw new Error('App notification wake failed');
+  previous.set(meta.id,signature);
+ }
+ pushedRevisions.set(binding,previous);
 }
 /** Collection invalidations, never record bodies or identifiers. Reads recheck current authorization. */
 export class AppRecordStreams {
  constructor(env,ctx){this.env=env;this.ctx=ctx;this.streams=new Set();}
  dispose(){for(const s of [...this.streams])this.close(s);}
- close(s){if(!this.streams.delete(s))return;clearInterval(s.timer);try{s.controller.close();}catch{}this.presence();}
+ close(s){if(!this.streams.delete(s))return;clearInterval(s.timer);clearTimeout(s.reconnect);try{s.controller.close();}catch{}this.presence();}
  count(s){return [...this.streams].filter(x=>x.app===s.app&&x.room===s.room).length;}
  send(s,data){if(s.controller.desiredSize<=0){this.close(s);return;}try{s.controller.enqueue(frame(data));}catch{this.close(s);}}
  presence(){for(const s of this.streams)this.send(s,{presence:this.count(s)});}
@@ -28,7 +42,7 @@ export class AppRecordStreams {
   const launch=launchOf(s.meta,await settingsOf(this.env,{fresh:true}),this.env);
   return launch==='public'||(await accessOf(s.request,this.env,s.meta.id,launch)).ok;
  }
- async revisions(s){return (await this.env.DB.prepare('SELECT collection,revision FROM app_record_revisions WHERE app=?1').bind(s.app).all()).results;}
+ async revisions(s){return (await this.env.DB.prepare("SELECT collection,revision FROM app_record_revisions WHERE app=?1 UNION ALL SELECT '*',COALESCE(SUM(r.revision),0) FROM app_tool_namespaces a JOIN tool_data_revisions r ON r.namespace=a.namespace WHERE a.app=?1").bind(s.app).all()).results;}
  async open({meta,url,headers,collections=[]}){
   if(!Array.isArray(collections)||collections.some(c=>typeof c!=='string'||!Object.hasOwn(meta.records?.collections??{},c)))return new Response('unknown collection',{status:400});
   const s={meta,url:new URL(url),request:new Request(url,{headers}),collections,seen:new Map()};
@@ -40,17 +54,20 @@ export class AppRecordStreams {
   const body=new ReadableStream({start:controller=>{s.controller=controller;},cancel:()=>this.close(s)});
   this.streams.add(s);this.send(s,{collections:s.collections,presence:this.count(s),reset:true});
   for(const other of this.streams)if(other!==s)this.send(other,{presence:this.count(other)});
+  // A fresh HTTP response renews the role cookie; SSE frames cannot set cookies.
+  s.reconnect=setTimeout(()=>this.close(s),240000);
   // Recovery after a missed wake; this is not the screen's refresh clock.
-  s.timer=setInterval(()=>this.ctx.waitUntil(this.pump(s)),15000);
+  s.timer=setInterval(()=>this.ctx.waitUntil(this.pump(s,true)),15000);
   return new Response(body,{headers:{'content-type':'text/event-stream','cache-control':'no-store'}});
  }
- async pump(s){
+ async pump(s,recheck=false){
   if(!this.streams.has(s))return;if(s.busy){s.dirty=true;return;}s.busy=true;
   try{
+   const changed=new Set();
+   for(const row of await this.revisions(s)){if(s.seen.get(row.collection)!==row.revision){if(row.collection==='*')for(const c of s.collections)changed.add(c);else if(s.collections.includes(row.collection))changed.add(row.collection);}s.seen.set(row.collection,row.revision);}
+   if(!changed.size&&!recheck)return;
    if(!await this.authorized(s)){this.close(s);return;}
-   const changed=[];
-   for(const row of await this.revisions(s)){if(s.collections.includes(row.collection)&&s.seen.get(row.collection)!==row.revision)changed.push(row.collection);s.seen.set(row.collection,row.revision);}
-   this.send(s,{collections:changed,presence:this.count(s)});
+   this.send(s,{collections:[...changed],presence:this.count(s)});
   }catch{this.close(s);}finally{s.busy=false;if(s.dirty){s.dirty=false;await this.pump(s);}}
  }
  async wake(meta){for(const s of this.streams)if(meta)s.meta=meta;await Promise.all([...this.streams].map(s=>this.pump(s)));return new Response('ok');}

package/worker/app-tools.mjs

@@ -14,7 +14,7 @@ export async function appCaller(request,env,meta,url){
  const access=await appAccess(request,env,meta,url);
  if(!access.ok)throw Object.assign(new Error(access.error),{status:access.status});
  const session=await localSession(request,env);
- if(session?.app===meta.id)return {id:`local-test-${session.app}-${session.role}`,owner:session.role==='owner',client:null,localTest:true,roles:{[meta.id]:[session.role]},testApp:meta.id,testScope:session.scope};
+ if(session?.app===meta.id)return {id:`local-test-${session.app}-${session.role}`,owner:!session.remoteTest&&session.role==='owner',client:null,localTest:true,...(session.remoteTest?{remoteTest:true}:{}),roles:{[meta.id]:[session.role]},testApp:meta.id,testScope:session.scope};
  const person=await players.of(request,env);
  const owner=await isOwner(request,env);
  const roles={};
@@ -37,6 +37,7 @@ export async function appToolsRoute(request,env,meta,url,cat,definitions){
   if(tool.price)return fail(402,'Use MCP to approve payment for this tool');
   if(!await rateLimit(env,caller.id??`public:${request.headers.get('cf-connecting-ip')??'local'}`,callsPerMinute(cat)))return fail(429,'Rate limit reached');
   const namespace=(tool.namespace??tool.name)+(caller.testScope?':check:'+caller.testScope:'');
+  await env.DB.prepare('INSERT OR IGNORE INTO app_tool_namespaces(app,namespace) VALUES(?1,?2)').bind(meta.id+(caller.testScope?':check:'+caller.testScope:''),namespace).run();
   const data=await invokeAppTool(tool,body.input??{},services(env,cat,url.origin,caller,namespace,tool));
   outcome='ok';return Response.json({ok:true,data});
  }catch(error){return fail(error.status??(error instanceof SyntaxError?400:500),error.status||error.name==='StudioOperationError'?error.message:'Tool request failed');}

package/worker/app-web.mjs

@@ -0,0 +1,23 @@
+import {APP_SHELL_JS} from './app-shell.mjs';
+/** Explicit same-origin, public app surface for installation. */
+export async function appWeb(request,env,meta,url,sub,document) {
+ if(!meta.web?.manifest)return null;
+ const base=`/${meta.id}/`;
+ if(sub==='manifest.webmanifest')return Response.json({...meta.web.manifest,id:base,start_url:base+'install',scope:base,display:meta.web.manifest.display??'standalone'},{headers:{'content-type':'application/manifest+json'}});
+ if(sub==='service-worker.js') {
+  const file=meta.web.serviceWorker;
+  if(typeof file!=='string'||file.includes('..')||!/^[-\w/]+\.js$/.test(file))return new Response('not found',{status:404});
+  const res=await env.ASSETS.fetch(new Request(url.origin+`/games/${meta.id}/${file}`));
+  return new Response(res.body,{status:res.status,headers:{'content-type':'text/javascript','service-worker-allowed':base,'cache-control':'no-cache'}});
+ }
+ if(sub!=='install')return null;
+ const role=meta.surfaces?.phone;
+ if(meta.room||meta.roles?.[role]?.signIn!==false)return new Response('Install requires a public records-only app',{status:409});
+ const response=await document(),headers=new Headers(response.headers);
+ if(!response.ok)return response;
+ headers.set('content-security-policy',"frame-ancestors 'self'");
+ const boot=JSON.stringify({kind:'app',direct:true,game:meta.id}).replace(/</g,'\\u003c');
+ const tags=`<base href="${base}__game/"><link rel="manifest" href="${base}manifest.webmanifest"><script>window.__HOMIE_APP=${boot};</script><script>${APP_SHELL_JS}</script>${meta.web.serviceWorker?`<script>if('serviceWorker' in navigator)navigator.serviceWorker.register('${base}service-worker.js',{scope:'${base}'}).catch(console.error);</script>`:''}`;
+ const html=await response.text();
+ return new Response(/<head[^>]*>/i.test(html)?html.replace(/<head[^>]*>/i,m=>m+tags):tags+html,{headers});
+}

package/worker/booking-calendar.mjs

@@ -0,0 +1,26 @@
+const dayMs=86400000;
+const date=value=>{if(!/^\d{4}-\d{2}-\d{2}$/.test(value??''))throw new Error('Use a calendar date YYYY-MM-DD');const stamp=Date.parse(value+'T00:00:00Z');if(!Number.isFinite(stamp)||new Date(stamp).toISOString().slice(0,10)!==value)throw new Error('Invalid calendar date');return stamp;};
+/** Resolve wall time, refusing DST gaps and ambiguous times instead of silently moving a booking. */
+function instant(day,time,format) {
+ const wanted=day+'T'+time,base=Date.parse(wanted+':00Z');
+ const parts=stamp=>Object.fromEntries(format.formatToParts(stamp).map(p=>[p.type,p.value]));
+ const local=stamp=>{const p=parts(stamp);return `${p.year}-${p.month}-${p.day}T${p.hour}:${p.minute}`;};
+ const offsets=new Set([-dayMs,0,dayMs].map(delta=>{const p=parts(base+delta);return Date.UTC(+p.year,+p.month-1,+p.day,+p.hour,+p.minute)-(base+delta);}));
+ const matches=[...offsets].map(offset=>base-offset).filter(stamp=>local(stamp)===wanted);
+ if(matches.length!==1)throw new Error(`${wanted} does not exist or is ambiguous in this time zone; choose another time or publish an explicit offset timestamp`);
+ return matches[0];
+}
+/** Inclusive season dates; each returned slot may span several local calendar days. */
+export function calendarSlots({startDate,endDate,timeZone,time='09:00',days,durationMinutes=60,capacity=1,weekdays,resources,options,prefix='slot'}) {
+ const start=date(startDate),end=date(endDate);
+ if(end<start||end-start>3660*dayMs||!/^([01]\d|2[0-3]):[0-5]\d$/.test(time)||!Number.isSafeInteger(capacity)||capacity<1||days!==undefined&&(!Number.isSafeInteger(days)||days<1)||!Number.isSafeInteger(durationMinutes)||durationMinutes<1)throw new Error('Invalid calendar range, time, duration or capacity');
+ if(weekdays&&(!Array.isArray(weekdays)||weekdays.some(n=>!Number.isInteger(n)||n<0||n>6)))throw new Error('weekdays uses 0 (Sunday) through 6 (Saturday)');
+ if(typeof timeZone!=='string'||!timeZone)throw new Error('Declare the place timeZone');
+ const format=new Intl.DateTimeFormat('en-CA',{timeZone,year:'numeric',month:'2-digit',day:'2-digit',hour:'2-digit',minute:'2-digit',hourCycle:'h23'}),slots=[];
+ for(let at=start;at<=end;at+=dayMs) {
+  if(weekdays&&!weekdays.includes(new Date(at).getUTCDay()))continue;
+  const day=new Date(at).toISOString().slice(0,10),from=instant(day,time,format),to=days?instant(new Date(at+days*dayMs).toISOString().slice(0,10),time,format):from+durationMinutes*60000;
+  slots.push({id:`${prefix}-${day}-${time.replace(':','')}`,date:day,timeZone,start:new Date(from).toISOString(),end:new Date(to).toISOString(),capacity,...(resources?{resources}:{}),...(options?{options}:{})});
+ }
+ return slots;
+}

package/worker/booking-holds.mjs

@@ -1,3 +1,6 @@
+import {calendarSlots} from './booking-calendar.mjs';
+import {allocateResources} from './booking-resources.mjs';
+import {normalizeBookingArgs} from './booking-options.mjs';
 import {BOOKINGS_MIGRATION} from './booking-store.mjs';
 import {linkConfig,hasStripeKey} from './shop-links.mjs';
 export const BOOKING_HOLDS_MIGRATION_FILE='0029_booking_holds.sql';
@@ -44,7 +47,7 @@ export async function ownedHold(env,caller,{id,token}){
 }
 /** A hold is the very row checkout later confirms. Secrets never enter its public projection. */
 export function bookingHolds(env,caller,cat){
- const result=r=>({id:r.id,slot:r.slot,quantity:r.quantity,state:r.state,version:r.version,expiresAt:r.hold_until,paid:r.paid_at!==null});
+ const result=r=>({id:r.id,slot:r.slot,quantity:r.quantity,state:r.state,version:r.version,expiresAt:r.hold_until,paid:r.paid_at!==null,...(r.allocation&&r.allocation!=='[]'?{allocations:JSON.parse(r.allocation)}:{}),...(r.choices&&r.choices!=='{}'?{choices:JSON.parse(r.choices)}:{})});
  const change=async(args,state)=>{
   const row=await ownedHold(env,caller,args);
   if(row.order_id!=='hold:'+row.id)throw refusal('Checkout owns this booking; reconcile payment before release');
@@ -53,7 +56,10 @@ export function bookingHolds(env,caller,cat){
   if(!changed)throw refusal('Booking changed or expired; reload',409);return result(changed);
  };
  return Object.freeze({
-  async hold({app,collection,slot,quantity=1,id,token,expiresAt}){
+  calendar({app,...options}){const meta=cat.games.find(g=>g.id===app&&g.kind==='app');if(!meta)throw refusal('Unknown app');return calendarSlots({timeZone:meta.timeZone,...options});},
+  async hold(input){
+   const args=normalizeBookingArgs(input);
+   let {app,collection,slot,quantity=1,id,token,expiresAt}=args;
    const meta=cat.games.find(g=>g.id===app&&g.kind==='app'),spec=meta?.records?.collections?.[collection]?.booking;
    if(!spec||!valid(id)||!valid(slot)||!Number.isSafeInteger(quantity)||quantity<1)throw refusal('Choose a declared slot, positive quantity and stable booking id');
    if(!Number.isSafeInteger(expiresAt)||expiresAt<=Date.now())throw refusal('Hold needs a future expiry');
@@ -62,11 +68,18 @@ export function bookingHolds(env,caller,cat){
    if(!hasStripeKey(env)&&linkConfig(env)?.slots?.some(l=>l.app===app&&l.slots===spec.slots&&l.slot===slot))throw refusal('Keyless Stripe inventory cannot share local holds; configure session checkout first');
    const scope=caller.testScope?`${app}:check:${caller.testScope}`:app;
    id=await hash(JSON.stringify([scope,collection,id]));
+   const choices={option:args.option??null,resource:args.resource??null,addons:args.addons??{}};
+   if(await env.DB.prepare('SELECT id FROM shop_bookings WHERE id=?1').bind(id).first()) {
+     const previous=await ownedHold(env,caller,{id,token});
+     if(previous.app!==scope||previous.collection!==collection||previous.slot!==slot||previous.quantity!==quantity||JSON.stringify({...choices,...JSON.parse(previous.choices??'{}')})!==JSON.stringify(choices))throw refusal('Booking id reused with different request',409);
+     return result(previous);
+   }
+   let allocation;try{allocation=await allocateResources(env,scope,spec,slot,args);}catch(error){throw refusal(error.message,409);}
    const secret=token?await hash(token):null;
-   try {await env.DB.prepare(`INSERT INTO shop_bookings(id,app,collection,slots,slot,quantity,order_id,state,updated_at,actor,token_hash,hold_until)
-    SELECT ?1,?2,?3,?4,?5,?6,'hold:'||?1,'held',?7,?8,?9,?10 WHERE NOT EXISTS(SELECT 1 FROM shop_bookings WHERE id=?1)`).bind(id,scope,collection,spec.slots,slot,quantity,Date.now(),caller.id??null,secret,expiresAt).run();}catch(error){if(/booking capacity unavailable/.test(error.message))throw refusal('That slot is full. No place has been taken.',409);throw error;}
+   try {await env.DB.prepare(`INSERT INTO shop_bookings(id,app,collection,slots,slot,quantity,order_id,state,updated_at,actor,token_hash,hold_until,allocation,choices)
+    SELECT ?1,?2,?3,?4,?5,?6,'hold:'||?1,'held',?7,?8,?9,?10,?11,?12 WHERE NOT EXISTS(SELECT 1 FROM shop_bookings WHERE id=?1)`).bind(id,scope,collection,spec.slots,slot,quantity,Date.now(),caller.id??null,secret,expiresAt,JSON.stringify(allocation),JSON.stringify(choices)).run();}catch(error){if(/booking capacity unavailable|resource capacity unavailable/.test(error.message))throw refusal('That slot or resource capacity is unavailable. No place has been taken.',409);throw error;}
    const row=await ownedHold(env,caller,{id,token});
-   if(row.app!==scope||row.collection!==collection||row.slot!==slot||row.quantity!==quantity)throw refusal('Booking id reused with different request',409);
+   if(row.app!==scope||row.collection!==collection||row.slot!==slot||row.quantity!==quantity||JSON.stringify(JSON.parse(row.choices??'{}'))!==JSON.stringify(choices))throw refusal('Booking id reused with different request',409);
    return result(row);
   },
   async get(args){return result(await ownedHold(env,caller,args));},

package/worker/booking-options.mjs

@@ -0,0 +1,23 @@
+/** Shared by trusted booking tools and phone flows. Aliases never silently win. */
+export function normalizeBookingArgs(input) {
+ const args={...input};
+ for(const [canonical,aliases] of [['slot',['time']],['resource',['preferredResource','preferred_resource']],['addons',['addOns','add-ons']]]) {
+  for(const alias of aliases)if(args[alias]!==undefined) {
+   if(args[canonical]!==undefined&&JSON.stringify(args[canonical])!==JSON.stringify(args[alias]))throw Object.assign(new Error(`conflicting ${canonical}/${alias}`),{name:'StudioOperationError',status:400});
+   args[canonical]=args[alias];delete args[alias];
+  }
+ }
+ if(args.addons!==undefined) {
+  const list=Array.isArray(args.addons)?args.addons.map(id=>[id,1]):Object.entries(args.addons??{}),addons={};
+  for(const [id,count] of list) {
+   if(!/^[a-z][a-z0-9-]{0,39}$/.test(id)||!Number.isSafeInteger(count)||count<1||count>100)throw new Error('Invalid add-on id or quantity');
+   addons[id]=(addons[id]??0)+count;
+  }
+  args.addons=Object.fromEntries(Object.entries(addons).sort(([a],[b])=>a.localeCompare(b)));
+ }
+ return args;
+}
+
+const text={type:'string',maxLength:64};
+const addons={oneOf:[{type:'array',maxItems:100,items:text},{type:'object',additionalProperties:{type:'integer',minimum:1,maximum:100}}]};
+export const bookingInputSchema={type:'object',properties:{app:text,collection:text,slot:text,time:text,option:text,resource:text,preferredResource:text,preferred_resource:text,addons,addOns:addons,'add-ons':addons,quantity:{type:'integer',minimum:1},id:text,token:{type:'string',pattern:'^[a-f0-9]{32,128}$'},expiresAt:{type:'integer'}},required:['app','collection','id','expiresAt'],additionalProperties:false};

package/worker/booking-resources.mjs

@@ -0,0 +1,55 @@
+export const BOOKING_RESOURCES_MIGRATION_FILE='0030_booking_resources.sql';
+const capacityCheck=`
+ SELECT RAISE(ABORT,'resource capacity unavailable') WHERE EXISTS (
+ WITH wanted AS (SELECT json_extract(value,'$.resource') resource,json_extract(value,'$.collection') collection,json_extract(value,'$.start') start,json_extract(value,'$.end') end,json_extract(value,'$.units') units FROM json_each(NEW.allocation)),
+ existing AS (SELECT json_extract(a.value,'$.resource') resource,json_extract(a.value,'$.collection') collection,json_extract(a.value,'$.start') start,json_extract(a.value,'$.end') end,json_extract(a.value,'$.units') units FROM shop_bookings b,json_each(b.allocation) a WHERE b.app=NEW.app AND b.id!=NEW.id AND b.state IN ('held','confirmed')),
+ points AS (SELECT resource,collection,start point FROM wanted UNION SELECT resource,collection,start FROM existing)
+ SELECT 1 FROM points p WHERE EXISTS(SELECT 1 FROM wanted w WHERE w.resource=p.resource AND w.collection=p.collection AND w.start<=p.point AND w.end>p.point)
+ AND (COALESCE((SELECT SUM(units) FROM wanted w WHERE w.resource=p.resource AND w.collection=p.collection AND w.start<=p.point AND w.end>p.point),0)+COALESCE((SELECT SUM(units) FROM existing e WHERE e.resource=p.resource AND e.collection=p.collection AND e.start<=p.point AND e.end>p.point),0))>
+ COALESCE((SELECT json_extract(value,'$.capacity') FROM app_records WHERE app=NEW.app AND collection=p.collection AND id=p.resource),0));`;
+export const BOOKING_RESOURCES_MIGRATION=`ALTER TABLE shop_bookings ADD COLUMN allocation TEXT NOT NULL DEFAULT '[]';
+ALTER TABLE shop_bookings ADD COLUMN choices TEXT NOT NULL DEFAULT '{}';
+${['INSERT','UPDATE OF state,allocation'].map((op,i)=>`CREATE TRIGGER booking_resource_${i} BEFORE ${op} ON shop_bookings WHEN NEW.state IN ('held','confirmed') BEGIN ${capacityCheck} END;`).join('\n')}
+CREATE TRIGGER booking_resource_move BEFORE UPDATE OF slot,quantity ON shop_bookings WHEN (OLD.slot!=NEW.slot OR OLD.quantity!=NEW.quantity) AND OLD.allocation!='[]' AND OLD.state IN ('held','confirmed') BEGIN SELECT RAISE(ABORT,'resource booking move requires release and a new allocation'); END;
+CREATE TRIGGER booking_resource_edit BEFORE UPDATE OF value ON app_records WHEN EXISTS(SELECT 1 FROM shop_bookings b,json_each(b.allocation) a WHERE b.app=OLD.app AND b.state IN ('held','confirmed') AND json_extract(a.value,'$.resource')=OLD.id AND json_extract(a.value,'$.collection')=OLD.collection) AND NEW.value!=OLD.value BEGIN SELECT RAISE(ABORT,'resource has active bookings; release or finish them before editing'); END;
+CREATE TRIGGER booking_resource_delete BEFORE DELETE ON app_records WHEN EXISTS(SELECT 1 FROM shop_bookings b,json_each(b.allocation) a WHERE b.app=OLD.app AND b.state IN ('held','confirmed') AND json_extract(a.value,'$.resource')=OLD.id AND json_extract(a.value,'$.collection')=OLD.collection) BEGIN SELECT RAISE(ABORT,'resource has active bookings'); END;
+`;
+export async function allocateResources(env,app,spec,slot,args) {
+ const row=await env.DB.prepare('SELECT value FROM app_records WHERE app=?1 AND collection=?2 AND id=?3').bind(app,spec.slots,slot).first();
+ if(!row)throw new Error('Slot unavailable');
+ const data=JSON.parse(row.value),option=args.option===undefined?null:data.options?.find(o=>o.id===args.option);
+ if(args.option!==undefined&&!option)throw new Error('Choose a declared option');
+ if(data.requireOption&&!option)throw new Error('Choose an option');
+ const parts=option?.components??(data.resources?[{resources:data.resources,skills:data.skills,attributes:data.attributes}]:[]);
+ const components=[...parts];
+ for(const [id,count] of Object.entries(args.addons??{})) {
+  const addon=data.addons?.find(a=>a.id===id);if(!addon)throw new Error('Unknown add-on');
+  for(const component of addon.components??[])components.push({...component,units:(component.units??1)*count});
+ }
+ if(!components.length){if(args.resource)throw new Error('This slot has no declared resources');return [];}
+ if(!spec.resources)throw new Error('Declare booking.resources collection');
+ const start=Date.parse(data.start),end=Date.parse(data.end);
+ if(!Number.isFinite(start)||!Number.isFinite(end)||end<=start)throw new Error('Resource slot needs start and end timestamps');
+ if(components.length>32)throw new Error('A package supports at most 32 resource components');
+ const active=(await env.DB.prepare("SELECT allocation FROM shop_bookings WHERE app=?1 AND state IN ('held','confirmed')").bind(app).all()).results.flatMap(r=>JSON.parse(r.allocation));
+ const allocations=[];
+ for(const [index,c] of components.entries()) {
+  if(!Array.isArray(c.resources)||!c.resources.length||c.resources.length>64)throw new Error('Declare candidate resources');
+  const candidates=index===0&&args.resource?[args.resource]:c.resources;
+  if(candidates.some(id=>!c.resources.includes(id)))throw new Error('Preferred resource is unavailable for this option');
+  const from=start+(c.offsetMinutes??0)*60000,to=c.durationMinutes?from+c.durationMinutes*60000:end,units=(c.units??1)*(args.quantity??1);
+  if(!Number.isSafeInteger(from)||!Number.isSafeInteger(to)||from<start||to>end||to<=from||!Number.isSafeInteger(units)||units<1)throw new Error('Invalid package resource interval or units');
+  let selected,qualified=false;
+  for(const resource of candidates) {
+   const record=await env.DB.prepare('SELECT value FROM app_records WHERE app=?1 AND collection=?2 AND id=?3').bind(app,spec.resources,resource).first();
+   if(!record)continue;const r=JSON.parse(record.value);
+   if(!Number.isSafeInteger(r.capacity)||r.capacity<1||(c.skills??[]).some(skill=>!r.skills?.includes(skill))||Object.entries(c.attributes??{}).some(([k,v])=>r.attributes?.[k]!==v))continue;
+   qualified=true;const overlapping=[...active,...allocations].filter(a=>a.resource===resource&&a.collection===spec.resources&&a.start<to&&a.end>from);
+   if([from,...overlapping.map(a=>a.start).filter(t=>t>=from)].some(at=>units+overlapping.filter(a=>a.start<=at&&a.end>at).reduce((n,a)=>n+a.units,0)>r.capacity))continue;
+   selected={resource,collection:spec.resources,start:from,end:to,units};break;
+  }
+  if(!selected)throw new Error(qualified?'Resource capacity unavailable for these dates':'No resource matches the required skills or attributes');
+  allocations.push(selected);
+ }
+ return allocations;
+}

package/worker/build-id.mjs

@@ -1,2 +1,2 @@
 // Generated by lib/build-identity.mjs; identifies the bundled runtime sources.
-export const STUDIO_BUILD = Object.freeze({"version":"0.52.0","sha256":"f2d43374183c3a1d807c67754b0b9e868b18d5f6b137e0fd5f224fd6e5866e17"});
+export const STUDIO_BUILD = Object.freeze({"version":"0.54.0","sha256":"4f65918ccb0f52120d8d0fa6cf761f2243b4636fdf10ccef395479318d603370"});

package/worker/chat-store.mjs

@@ -1,3 +1,4 @@
+import {databaseBinding, ORIGINAL_DB} from './request-db.mjs';
 /**
  * ROOM CHAT IN THE STUDIO'S OWN D1 (@homie-rocks/studio 0.23.0, NETPLAY.md section 19): the owner's chat rules per game
  * and per server, and the reports players make. Never the chat itself: what people say lives a few minutes in the
@@ -51,8 +52,8 @@ const cache = new WeakMap();
 /** Every chat rule row (D1), read at most every 5 s per Worker instance; empty before migration 0007. */
 export async function chatRowsOf(env, { fresh = false } = {}) {
   if (!env?.DB || env.HOMIE_PREVIEW === '1') return new Map();
-  const hit = cache.get(env.DB);
-  if (!fresh && hit && Date.now() - hit.at < 5000) return hit.map;
+  const hit = cache.get(databaseBinding(env.DB));
+  if (!env.DB[ORIGINAL_DB] && !fresh && hit && Date.now() - hit.at < 5000) return hit.map;
   let map = new Map();
   try {
     const { results } = await env.DB.prepare('SELECT game, server, rules, updated_at FROM chat_rules LIMIT 1000').all();
@@ -62,10 +63,10 @@ export async function chatRowsOf(env, { fresh = false } = {}) {
       if (rules && typeof rules === 'object') map.set(`${r.game}/${r.server ?? ''}`, { ...rules, at: Number(r.updated_at) || 0 });
     }
   } catch { map = new Map(); }
-  cache.set(env.DB, { at: Date.now(), map });
+  cache.set(databaseBinding(env.DB), { at: Date.now(), map });
   return map;
 }
-export const forgetChat = (env) => { if (env?.DB) cache.delete(env.DB); };
+export const forgetChat = (env) => { if (env?.DB) cache.delete(databaseBinding(env.DB)); };
 
 /**
  * A room's chat rules: the game's game.json "chat", the owner's rules for the game, then for this server (a server's

package/worker/customer-mcp.mjs

@@ -26,7 +26,7 @@ export function customerTools(env,cat,origin) {
   return [
     {name:'studio_catalogue',description:'Browse the public shop, paid parts and app goods. Prices use the studio’s currency minor units.',audience:'public',inputSchema:object(),handler:async(_args,ctx)=>({shop:await customerShop(env,cat,origin,ctx.caller,'/api/shop'),resources:await listOffers(env,origin)})},
     {name:'studio_cart',description:'Quote a cart for agent payment. Retain the returned private account cookies to use guest purchases. Approve this immutable offerVersion before purchase.',audience:'public',inputSchema:cartSchema,handler:(args,ctx)=>quoteCart(env,cat,origin,ctx.caller,args,ctx.request)},
-    {name:'studio_checkout',description:'Open the studio’s Stripe checkout for a person to approve. Uses the same cart, account, order and refund as the website.',audience:'public',inputSchema:cartSchema,handler:(args,ctx)=>customerShop(env,cat,origin,ctx.caller,'/api/shop/buy',args)},
+    {name:'studio_checkout',description:'Open the studio’s Stripe checkout for a person to approve. Uses the same cart, account, order and refund as the website.',audience:'public',inputSchema:{...cartSchema,properties:{...cartSchema.properties,reference:str,booking:object({collection:str,slot:str,hold:str,token:str},['collection','slot'])}},handler:(args,ctx)=>customerShop(env,cat,origin,ctx.caller,'/api/shop/buy',args)},
     {name:'studio_purchase',description:'Buy an approved offer with the MCP payment binding. Generate private random 32-byte hex buyer and claim values; retain the claim for retries. For x402 use the returned HTTP resource address.',audience:'public',inputSchema:{...purchaseSchema,properties:{...purchaseSchema.properties,checkout:{type:'boolean'}}},protocol:true,handler:async(args,ctx)=>{if(args.checkout&&args.kind==='cart'){const resource=await resourceKind('cart').get(env,args.resource,args.version);if(!resource)throw new Error('Cart unavailable');const result=await customerShop(env,cat,origin,{...ctx.caller,id:resource.player},'/api/shop/buy',{lines:resource.lines.map(l=>({item:l.item.id,quantity:l.quantity,amount:l.amount}))});return {content:[{type:'text',text:JSON.stringify(result)}],...(result.ok?{}:{isError:true})};}return buy(env,cat,origin,args,ctx.paymentExtra);}},
     {name:'studio_customer_refund',description:'Request a refund for your shop order under the studio refund policy.',audience:'signed-in',inputSchema:object({order:str,line:str},['order']),handler:(args,ctx)=>customerShop(env,cat,origin,ctx.caller,'/api/shop/refund',args)},
     {name:'studio_purchase_refund',description:'Request a resource or service refund with the original private purchase claim.',audience:'public',inputSchema:object({claim:{type:'string',pattern:'^[a-f0-9]{64}$'}},['claim']),handler:async({claim})=>{const url=new URL('/api/purchases/refund',origin);const response=await purchaseRoutes(new Request(url,{method:'POST',headers:{authorization:'Bearer '+claim,'content-type':'application/json'},body:'{}'}),env,url,cat);return response.json();}},

package/worker/event-resources.mjs

@@ -1,3 +1,4 @@
+import {databaseBinding} from './request-db.mjs';
 import {McpEventStreams} from './mcp-event-streams.mjs';
 import {listEvents} from './mcp-events.mjs';
 import {notification,sseFrame} from './mcp-events-wire.mjs';
@@ -141,13 +142,16 @@ export class EventStreams {
   }
 }
 
+const toolCatalogues=new WeakMap();
 /** Refresh active streams whenever this Worker observes a new tool catalogue. */
 export async function pushToolList(env,cat,tools,origin) {
   if(!env.LOBBY)return;
   const publicShape=tools.map(({name,description,inputSchema,audience,kind})=>({name,description,inputSchema,audience,kind}));
   const signature=JSON.stringify([publicShape,eventFeeds(env)]);
+  const binding=databaseBinding(env.DB);
+  if(toolCatalogues.get(binding)===signature)return;
   const previous=await env.DB.prepare("SELECT value FROM mcp_kv WHERE key='tools-catalogue'").first();
-  if(previous?.value===signature)return;
+  if(previous?.value===signature){toolCatalogues.set(binding,signature);return;}
   await env.DB.prepare("INSERT INTO mcp_kv(key,value) VALUES('tools-catalogue',?1) ON CONFLICT(key) DO UPDATE SET value=excluded.value").bind(signature).run();
   let after='';
   for(;;){
@@ -155,4 +159,5 @@ export async function pushToolList(env,cat,tools,origin) {
     for(const row of rows){const connection=JSON.parse(row.value).connection;await eventHub(env,connection).fetch('https://events/__studio_events',{method:'POST',body:JSON.stringify({op:'tools',connection,cat,tools:publicShape,origin})});}
     if(rows.length<100)break;after=rows.at(-1).key;
   }
+  toolCatalogues.set(binding,signature);
 }