@homie-rocks/studio 0.52.0 → 0.54.0

package/worker/servers.mjs

@@ -1,3 +1,4 @@
+import {databaseBinding, ORIGINAL_DB} from './request-db.mjs';
 /**
  * SERVERS (@homie-rocks/studio 0.16.0; NETPLAY.md section 17): a named, lasting pool of rooms for one game, with its
  * own policy, its own door and its own Lobby pool. Strangers are matched only inside one server, never across.
@@ -171,8 +172,8 @@ const serverCache = new WeakMap();
 /** Every server row of every game (D1), read at most every 5 s per Worker instance; an empty map before migration 0006. */
 async function rowsOf(env, { fresh = false } = {}) {
   if (!env?.DB || env.HOMIE_PREVIEW === '1') return new Map();
-  const hit = serverCache.get(env.DB);
-  if (!fresh && hit && Date.now() - hit.at < 5000) return hit.map;
+  const hit = serverCache.get(databaseBinding(env.DB));
+  if (!env.DB[ORIGINAL_DB] && !fresh && hit && Date.now() - hit.at < 5000) return hit.map;
   let map = new Map();
   try {
     const { results } = await env.DB.prepare('SELECT * FROM servers LIMIT 2000').all();
@@ -182,10 +183,10 @@ async function rowsOf(env, { fresh = false } = {}) {
       map.set(r.game, list);
     }
   } catch { map = new Map(); }
-  serverCache.set(env.DB, { at: Date.now(), map });
+  serverCache.set(databaseBinding(env.DB), { at: Date.now(), map });
   return map;
 }
-export const forgetServers = (env) => { if (env?.DB) serverCache.delete(env.DB); };
+export const forgetServers = (env) => { if (env?.DB) serverCache.delete(databaseBinding(env.DB)); };
 
 /**
  * A game's servers: `public` first, then the rest by when they were made. The game.json seeds (the catalogue's

package/worker/shop-links.mjs

@@ -55,5 +55,5 @@ export async function loadShopLinks(env, origin='https://studio.invalid') {
     const response=await env.ASSETS.fetch(new Request(new URL(env.STRIPE_SHOP_LINKS_ASSET,origin)));
     if(response.ok)value=await response.json();
   } catch {}
-  return {...env,STRIPE_SHOP_LINKS:JSON.stringify(value?.config??null),STRIPE_SHOP_SETUP:value?.next??'Ask your AI to finish stripe_shop_plan with verify:true.'};
+  return {...env,STRIPE_SHOP_LINKS:JSON.stringify(value?.config??null),...(value?.purchases?{PURCHASE_LINKS:JSON.stringify(value.purchases)}:{}),STRIPE_SHOP_SETUP:value?.next??'Ask your AI to finish stripe_shop_plan with verify:true.'};
 }

package/worker/shop-page.mjs

@@ -298,6 +298,7 @@ export const SHOP_JS = String.raw`(function () {
     (function poll() {
       tries += 1;
       api('GET', '/api/shop/order?session=' + encodeURIComponent(boot.thanks)).then(function (r) {
+        if (r.status === 'review') { $('[data-thanks-title]').textContent='Payment received'; $('[data-thanks-line]').textContent=r.note || 'Staff are reviewing your payment and will arrange fulfillment or a refund.'; return; }
         if (r.status === 'paid') { returnToPage(false); $('[data-thanks-title]').textContent = boot.giving ? 'Thank you for your gift' : 'It\'s yours'; $('[data-thanks-line]').textContent = boot.giving ? 'Your gift is confirmed.' : 'Paid. It is on your account now, in every game of ' + boot.studio + ' that uses it.'; if (r.simulated) { $('[data-thanks-title]').textContent = 'Simulation confirmed'; $('[data-thanks-line]').textContent = 'This was an offline test. No money moved and no Stripe receipt was sent.'; } return; }
         if (tries < 40) setTimeout(poll, 1500);
         else $('[data-thanks-line]').textContent = boot.giving ? 'Stripe has not confirmed your gift yet. Check your email for its receipt.' : 'Stripe has not confirmed it yet. It will be on your account as soon as it does; your receipt comes by email.';

package/worker/shop-rules.mjs

@@ -183,10 +183,11 @@ export function checkShop(raw, { games = null, audience = 'general', studioName
       else if (Array.isArray(games) && !games.includes(String(it.game))) err(`${at}.game`, `there is no game "${it.game}" in games/`);
     }
     if (it.taxCode !== undefined && !TAX_CODE.test(String(it.taxCode))) err(`${at}.taxCode`, 'taxCode is a Stripe product tax code such as "txcd_10000000"');
+    if(it.maxQuantity!==undefined && (!Number.isSafeInteger(it.maxQuantity)||it.maxQuantity<1||it.maxQuantity>999999))err(`${at}.maxQuantity`,'use a whole number from 1 to 999999');
     const advantage = it.advantage === true;
     const badge = gives.find((g) => g.startsWith('badge:'));
     for (const key of Object.keys(it)) {
-      if (!['id', 'kind', 'name', 'blurb', 'description', 'interval', 'price', 'min', 'max', 'gives', 'badge', 'days', 'starts', 'ends', 'game', 'taxCode', 'advantage'].includes(key)) warnings.push({ at: `${at}.${key}`, message: 'This field is not published by the shop. Describe any buyer-facing meaning in blurb so buyers can read it.' });
+      if (!['id', 'kind', 'name', 'blurb', 'description', 'interval', 'price', 'min', 'max', 'gives', 'badge', 'days', 'starts', 'ends', 'game', 'taxCode', 'advantage', 'maxQuantity'].includes(key)) warnings.push({ at: `${at}.${key}`, message: 'This field is not published by the shop. Describe any buyer-facing meaning in blurb so buyers can read it.' });
     }
     items.push({
       id, kind, name, ...(it.interval === 'month' ? { interval: 'month' } : {}), ...(blurb ? { blurb } : {}),
@@ -194,7 +195,7 @@ export function checkShop(raw, { games = null, audience = 'general', studioName
       gives, ...(badge ? { badge: badgeWord(badge, it) } : {}),
       ...(days !== null ? { days } : {}), ...(Number.isFinite(starts) ? { starts: new Date(starts).toISOString() } : {}), ...(Number.isFinite(ends) ? { ends: new Date(ends).toISOString() } : {}),
       ...(it.game ? { game: String(it.game) } : {}), ...(it.taxCode ? { taxCode: String(it.taxCode) } : {}),
-      advantage,
+      advantage, ...(it.maxQuantity!==undefined?{maxQuantity:it.maxQuantity}:{}),
     });
   });
 

package/worker/shop-store.mjs

@@ -1,3 +1,4 @@
+import {databaseBinding} from './request-db.mjs';
 /**
  * The shop's rows in the studio's own D1 (@homie-rocks/studio 0.24.0, migration 0008_studio_shop.sql). Kept apart
  * from worker/shop.mjs so player accounts (worker/players.mjs) can export and forget a player's purchases without
@@ -137,7 +138,7 @@ const completeSchemas = new WeakSet();
 /** Name the first missing schema migration, including a present table with an older shape. */
 export async function migrationNeeded(env) {
   if (!env?.DB) return SHOP_MIGRATION_FILE;
-  if (completeSchemas.has(env.DB)) return null;
+  if (completeSchemas.has(databaseBinding(env.DB))) return null;
   for (const [file, query] of [
     [SHOP_MIGRATION_FILE, 'SELECT 1 FROM shop_orders LIMIT 1'],
     [SHOP_RESERVATIONS_FILE, 'SELECT expires_at FROM shop_orders LIMIT 1'],
@@ -148,7 +149,7 @@ export async function migrationNeeded(env) {
   ]) {
     try { await env.DB.prepare(query).first(); } catch { return file; }
   }
-  completeSchemas.add(env.DB);
+  completeSchemas.add(databaseBinding(env.DB));
   return null;
 }
 
@@ -244,7 +245,7 @@ export const orderByPayment = (env, payment) => env.DB.prepare('SELECT * FROM sh
 export function orderView(r) {
   return {
     id: r.id, refundedAmount: Number(r.refunded_amount ?? 0), item: r.item, game: r.game ?? null, amount: Number(r.amount), currency: r.currency, tax: r.tax === null ? null : Number(r.tax), total: r.total === null ? null : Number(r.total),
-    status: r.status, till: r.till, mode: r.mode, parent: Number(r.parent) === 1,
+    status: r.status, ...(r.status==='review'?{note:'Payment received. Staff will reconcile the payment or refund it.'}:{}), till: r.till, mode: r.mode, parent: Number(r.parent) === 1,
     createdAt: Number(r.created_at), paidAt: r.paid_at === null ? null : Number(r.paid_at), refundedAt: r.refunded_at === null ? null : Number(r.refunded_at),
   };
 }

package/worker/shop.mjs

@@ -347,7 +347,7 @@ async function orderRoute(request, env, url, shop) {
     } catch (error) { logOrderError(env, o.id, error); }
   }
   const reference = await env.DB.prepare('SELECT value FROM meta WHERE key=?1').bind(`shop-reference:${o.id}`).first();
-  return json({ ok: true, order: o.id, simulated: apiBase(env) !== STRIPE_API, status: playerOrderStatus(o), item: o.item, game: o.game ?? null, reference: reference?.value ?? null });
+  return json({ ok: true, order: o.id, simulated: apiBase(env) !== STRIPE_API, status: playerOrderStatus(o), ...(o.status==='review'?{note:'Payment received. Staff will reconcile the payment or refund it.'}:{}), item: o.item, game: o.game ?? null, reference: reference?.value ?? null });
 }
 
 /** The neutral age question: a year of birth, once. Nothing hints which answer opens anything; no default. */
@@ -524,14 +524,13 @@ async function startCheckout(env, url, cat, shop, item, { player, game, amount,
   if(keyless && lines.length>1 && !menu)return {error:fail(409,'menu','These items need separate Stripe menus. Custom amounts and monthly gifts use their own links.')};
   if(keyless && (!link || !paymentLinkURL(link.url)))return {error:fail(503,'payment-links','Ask the owner’s AI to sync the shop and published booking slots.')};
   if(keyless && booking) {
-    if(booking.quantity!==1)return {error:fail(400,'quantity','Book one seat per checkout; Stripe counts completed sessions.')};
     const slot=await env.DB.prepare('SELECT value FROM app_records WHERE app=?1 AND collection=?2 AND id=?3').bind(booking.app,booking.slots,booking.slot).first();
     if(!slot || JSON.parse(slot.value).capacity!==link.capacity)return {error:fail(409,'slot-sync','This slot changed; ask the owner’s AI to sync its Stripe link.')};
     const confirmed=await env.DB.prepare("SELECT COALESCE(SUM(quantity),0) n FROM shop_bookings WHERE app=?1 AND slots=?2 AND slot=?3 AND state='confirmed'").bind(booking.app,booking.slots,booking.slot).first();
     const update=await env.DB.prepare('SELECT value FROM meta WHERE key=?1').bind(`shop-slot-link:${link.id}`).first();
     const observed=update?JSON.parse(update.value):null;
     const status=observed && observed.capacity===(link.limit??link.capacity) ? observed : link;
-    if(!status.active || status.count>=(link.limit??link.capacity) || confirmed.n>=link.capacity)return {error:fail(409,'capacity','That slot is full. Choose another slot.')};
+    if(!status.active || status.count>=(link.limit??link.capacity) || confirmed.n+booking.quantity>link.capacity)return {error:fail(409,'capacity','That slot is full. Choose another slot.')};
   }
   if(keyless && item.price==='choose' && lines[0].quantity!==1)return {error:fail(400,'quantity','A tip is one chosen amount; choose it on Stripe.')};
   if(menu && menu.items.some(e=>{const i=shop.items.find(i=>i.id===e.item);return !i || i.game && i.game!==game;}))return {error:fail(409,'menu','This menu includes items from another app; sync separate menus for each app.')};
@@ -577,7 +576,7 @@ async function startCheckout(env, url, cat, shop, item, { player, game, amount,
   }
   if (keyless) {
     const checkout = new URL(link.url); checkout.searchParams.set('client_reference_id', order.id);
-    if(menu?.basket)checkout.searchParams.set('prefilled_amount',String(amount));
+    if(menu?.basket || item.kind==='deposit')checkout.searchParams.set('prefilled_amount',String(amount));
     return { order, url: checkout.href, reconciled };
   }
   let session = null;
@@ -649,7 +648,10 @@ async function buyRoute(request, env, url, cat, shop, ready, ctx, requestAt) {
     const item = shop.items.find((i) => i.id === entry?.item);
     if (!item) return fail(404, 'item', 'no such item here');
     const quantity = entry.quantity ?? 1;
+    if (item.maxQuantity!==undefined&&quantity>item.maxQuantity)return fail(400,'quantity','This quantity exceeds the studio item maximum.');
     if (!Number.isSafeInteger(quantity) || quantity < 1) return fail(400, 'arithmetic', 'Quantity is a positive safe integer.');
+    if(!hasStripeKey(env) && ['supporter','deposit'].includes(item.kind) && quantity!==1)return fail(400,'quantity','This payment link has quantity fixed at one.');
+    if(item.kind==='deposit' && (!reference || !Number.isSafeInteger(entry.amount??item.price) || (entry.amount??item.price)<=0))return fail(400,'deposit','A deposit requires the app reference and its saved positive amount.');
     if (!shop.policy.repeatPurchases && (quantity > 1 || seen.has(item.id))) return fail(403, 'owned', 'The studio has disabled repeat purchases.');
     seen.add(item.id);
     const v = await itemsView(env, shop, { game, ...facts, player, open: true, item, purchasing: true });
@@ -679,6 +681,7 @@ async function buyRoute(request, env, url, cat, shop, ready, ctx, requestAt) {
     const collection = requestedBooking?.collection;
     const spec = app?.records?.collections?.[collection]?.booking;
     if (!spec || !/^[A-Za-z0-9_-]{1,64}$/.test(requestedBooking?.slot ?? '') || lines.length !== 1 || item.id !== spec.item || item.interval) return fail(400, 'booking', 'Choose a declared booking slot and its service item.');
+    if(spec.resources&&requestedBooking.hold===undefined)return fail(409,'booking','Reserve the resource through the booking tool and pass its hold before checkout.');
     const local = await localSession(request, env);
     booking = { app: local?.app === game && local.scope ? `${game}:check:${local.scope}` : game, collection, slots: spec.slots, slot: requestedBooking.slot, quantity: lines[0].quantity };
     if(requestedBooking.hold!==undefined){
@@ -713,6 +716,7 @@ async function parentLinkRoute(request, env, url, cat, shop, ready) {
     const item = shop.items.find((i) => i.id === entry?.item);
     if (!item) return fail(404, 'item', 'no such item here');
     const quantity = entry.quantity ?? 1;
+    if (item.maxQuantity!==undefined&&quantity>item.maxQuantity)return fail(400,'quantity','This quantity exceeds the studio item maximum.');
     if (!Number.isSafeInteger(quantity) || quantity < 1) return fail(400, 'arithmetic', 'Quantity is a positive safe integer.');
     if (!shop.policy.repeatPurchases && (quantity > 1 || seen.has(item.id))) return fail(403, 'owned', 'The studio has disabled repeat purchases.');
     seen.add(item.id);
@@ -874,7 +878,7 @@ async function hook(request, env, cat, shop, ready) {
     if (subscriptionResult !== null) return json({ ok: true, did: subscriptionResult });
     const sessionEvent = ev.type.startsWith('checkout.session.');
     if (!sessionEvent) await rememberMoneyEvent(env, ev);
-    if (sessionEvent && obj.payment_link && !(await bindLinkSession(env, obj, ev.livemode ? 'live' : 'test'))) return json({ ok: true, did: 'mismatch' });
+    if (sessionEvent && obj.payment_link && !(await bindLinkSession(env, obj, ev.livemode ? 'live' : 'test'))) return json({ok:true,did:await reviewLinkPayment(env,obj,ev.livemode?'live':'test')?'review':'mismatch'});
     if (sessionEvent && obj.metadata?.order && !obj.payment_link) {
       await env.DB.prepare(`UPDATE shop_orders SET session=?2 WHERE id=?1 AND session IS NULL AND mode=?3
         AND EXISTS(SELECT 1 FROM meta WHERE key='booking-checkout:' || shop_orders.id)`)
@@ -947,20 +951,64 @@ async function hook(request, env, cat, shop, ready) {
       default:
         break;
     }
+    if(did==='mismatch'&&obj.payment_link&&await reviewLinkPayment(env,obj,ev.livemode?'live':'test'))did='review';
     if (did === 'needs-keyed-recovery') return fail(503, did, 'This earlier multi-item checkout needs its original connection to recover tax per line. Reconnect it, then resend this event.');
     if (did === 'missing-item' || did === 'unknown-order') return fail(503, did, did === 'missing-item' ? 'Restore this order item in shop.json to grant it; the office can refund its payment.' : 'Payment order is not recorded yet; retry this event.');
     await env.DB.prepare('INSERT INTO shop_events (id, type, at) VALUES (?1, ?2, ?3) ON CONFLICT(id) DO NOTHING').bind(ev.id, ev.type, Date.now()).run();
     if (Math.random() < 0.02) await env.DB.prepare('DELETE FROM shop_events WHERE at < ?1').bind(Date.now() - 60 * DAY).run();
     return json({ ok: true, did });
   } catch (error) {
+    if(/(?:booking|resource) capacity unavailable/.test(error.message)&&obj.payment_link&&await reviewLinkPayment(env,obj,ev.livemode?'live':'test','The paid group exceeds remaining capacity. Staff will arrange a replacement or refund.'))return json({ok:true,did:'review'});
     logOrderError(env, null, error);
     return fail(503, 'stripe-retry', 'Payment reconciliation is temporarily unavailable; retry this event.');
   }
 }
 
+/** Retain a verified payment even when its frozen order cannot be fulfilled. No grants. */
+async function reviewLinkPayment(env,session,mode,reason='The paid amount differs from the order. Staff will reconcile the payment or refund it.') {
+ if(session.payment_status!=='paid'||!/^cs_[A-Za-z0-9_]+$/.test(session.id??'')||!Number.isSafeInteger(session.amount_total)||session.amount_total<0)return false;
+ if((await orderBySession(env,session.id))?.status==='review')return true;
+ const source=await orderById(env,session.client_reference_id);
+ const lines=source?await orderLines(env,source.id):[],link=lines[0]?.snapshot&&JSON.parse(lines[0].snapshot).paymentLink;
+ const linkId=session.payment_link?.id??session.payment_link,config=linkConfig(env);
+ const owned=[...(config?.items??[]),...(config?.menus??[]),...(config?.slots??[])].some(l=>l.id===linkId) || Boolean(await env.DB.prepare("SELECT 1 FROM shop_order_lines WHERE json_extract(snapshot,'$.paymentLink.id')=?1 LIMIT 1").bind(linkId).first());
+ if(!owned)return false;
+ if(!source||source.mode!==mode||session.currency!==source.currency||!link||link.id!==linkId||session.metadata?.revision!==link.revision){
+  const now=Date.now(),id=`ord_${(await sha256Hex(session.id)).slice(0,20)}`,payment=typeof session.payment_intent==='string'?session.payment_intent:session.payment_intent?.id;
+  const note='Payment received; missing or mismatched order context. Staff must reconcile or refund it.';
+  await env.DB.batch([
+   env.DB.prepare("INSERT OR IGNORE INTO shop_orders(id,item,amount,total,currency,till,mode,status,session,payment,created_at,updated_at,attention,note) VALUES(?1,'payment-review',?2,?2,?3,'stripe',?4,'review',?5,?6,?7,?7,1,?8)").bind(id,session.amount_total,session.currency,mode,session.id,payment??null,now,note),
+   env.DB.prepare('INSERT OR IGNORE INTO meta(key,value) VALUES(?1,?2)').bind('payment-review:'+session.id,JSON.stringify({session:session.id,receivedAt:now,payment,amount:session.amount_total,currency:session.currency,reference:session.client_reference_id,link:linkId,reason:note})),
+   env.DB.prepare("INSERT OR IGNORE INTO studio_events(id,type,data,at) VALUES(?1,'payment.review',?2,?3)").bind('payment-review:'+session.id,JSON.stringify({order:id,payment,amount:session.amount_total,currency:session.currency,note}),now),
+  ]);
+  return true;
+ }
+ await env.DB.prepare('UPDATE shop_orders SET session=?2 WHERE id=?1 AND session IS NULL').bind(source.id,session.id).run();
+ let order=await orderBySession(env,session.id);
+ if(!order) {
+  const id=`ord_${(await sha256Hex(session.id)).slice(0,20)}`;
+  await env.DB.batch([
+   env.DB.prepare("INSERT OR IGNORE INTO shop_orders(id,player,checkout_player,item,game,amount,currency,till,mode,status,parent,created_at,updated_at,session) SELECT ?2,player,checkout_player,item,game,amount,currency,till,mode,'started',parent,?4,?4,?3 FROM shop_orders WHERE id=?1").bind(source.id,id,session.id,Date.now()),
+   env.DB.prepare('INSERT OR IGNORE INTO meta(key,value) SELECT ?1,value FROM meta WHERE key=?2').bind(`shop-reference:${id}`,`shop-reference:${source.id}`),
+   ...lines.map((l,i)=>env.DB.prepare('INSERT OR IGNORE INTO shop_order_lines(id,order_id,position,item,quantity,unit_amount,amount,snapshot) VALUES(?1,?2,?3,?4,?5,?6,?7,?8)').bind(`${id}_${i}`,id,i,l.item,l.quantity,l.unit_amount,l.amount,l.snapshot)),
+  ]);order=await orderBySession(env,session.id);
+ }
+ if(order.status==='review')return true;
+ if(order.paid_at!==null)return false;
+ const payment=typeof session.payment_intent==='string'?session.payment_intent:session.payment_intent?.id;
+ const note='Payment received. '+reason,now=Date.now();
+ await env.DB.batch([
+  env.DB.prepare("UPDATE shop_orders SET status='review',payment=?2,total=?3,updated_at=?4,attention=1,note=?5 WHERE id=?1 AND paid_at IS NULL").bind(order.id,payment??null,session.amount_total,now,note),
+  env.DB.prepare("INSERT OR IGNORE INTO meta(key,value) VALUES(?1,?2)").bind('payment-review:'+session.id,JSON.stringify({session:session.id,receivedAt:now,payment,amount:session.amount_total,currency:session.currency,expected:source.amount,reason})),
+  env.DB.prepare("INSERT OR IGNORE INTO studio_events(id,type,data,at) VALUES(?1,'payment.review',?2,?3)").bind('payment-review:'+session.id,JSON.stringify({order:order.id,payment,amount:session.amount_total,currency:session.currency,note}),now),
+ ]);
+ return true;
+}
+
 /** Payment Links can be reopened. Each signed Session becomes its own order; the URL reference
  * selects a frozen local intent, never an entitlement or a buyer-supplied price. */
 async function bindLinkSession(env, session, mode) {
+  if(session.id&&(await orderBySession(env,session.id))?.status==='review')return false;
   if (!/^ord_[A-Za-z0-9]{20}$/.test(session.client_reference_id ?? '') || !/^cs_[A-Za-z0-9_]+$/.test(session.id ?? '')) return false;
   const source = await orderById(env, session.client_reference_id);
   if (!source || source.mode !== mode) return false;
@@ -976,8 +1024,10 @@ async function bindLinkSession(env, session, mode) {
   if (!link || (session.payment_link?.id ?? session.payment_link) !== link.id || session.metadata?.revision !== link.revision || session.currency !== source.currency) return false;
   const amount = session.amount_subtotal;
   if (!Number.isSafeInteger(amount) || amount <= 0) return false;
+  if(item.kind==='deposit' && amount!==source.amount)return false;
   const quantity = item.price === 'choose' ? 1 : amount / item.price;
-  if (!Number.isSafeInteger(quantity) || quantity < 1 || quantity > 999999) return false;
+  if(['supporter','deposit'].includes(item.kind) && quantity!==1)return false;
+  if (!Number.isSafeInteger(quantity) || quantity < 1 || quantity > (item.maxQuantity??link.maxQuantity??999999)) return false;
   if (item.price === 'choose' && (amount < item.min || item.max !== null && amount > item.max)) return false;
   // Claim the first session atomically. A repeated URL creates a separate paid order, never loses a payment.
   await env.DB.prepare('UPDATE shop_orders SET session = ?2 WHERE id = ?1 AND session IS NULL').bind(source.id, session.id).run();
@@ -989,13 +1039,14 @@ async function bindLinkSession(env, session, mode) {
       env.DB.prepare("INSERT INTO shop_orders (id, player, checkout_player, item, game, amount, currency, till, mode, status, parent, created_at, updated_at, session) SELECT ?2, player, checkout_player, item, game, ?4, currency, till, mode, 'started', parent, ?5, ?5, ?3 FROM shop_orders WHERE id = ?1 ON CONFLICT DO NOTHING").bind(source.id, id, session.id, amount, Date.now()),
       env.DB.prepare("INSERT OR IGNORE INTO meta(key,value) SELECT ?1,CASE WHEN value=?3 THEN ?4 ELSE value END FROM meta WHERE key=?2").bind(`shop-reference:${id}`, `shop-reference:${source.id}`,source.id,id),
       env.DB.prepare('INSERT INTO shop_order_lines (id, order_id, position, item, quantity, unit_amount, amount, snapshot) VALUES (?1, ?2, 0, ?3, ?4, ?5, ?6, ?7) ON CONFLICT DO NOTHING').bind(`${id}_0`, id, item.id, quantity, amount / quantity, amount, lines[0].snapshot),
-      ...(booking ? [bookingStatement(env,{...booking,slot:link.slot,slots:link.slots,id,order:id,pending:true})] : []),
+      ...(booking ? [bookingStatement(env,{...booking,quantity,slot:link.slot,slots:link.slots,id,order:id,pending:true})] : []),
     ]);
     order = await orderBySession(env, session.id);
 
   }
   if (!order) return false;
   if (order.paid_at === null) await env.DB.batch([
+    ...(link.slot?[env.DB.prepare("UPDATE shop_bookings SET quantity=?2 WHERE order_id=?1 AND state='pending'").bind(order.id,quantity)]:[]),
     env.DB.prepare('UPDATE shop_orders SET amount = ?2 WHERE id = ?1 AND paid_at IS NULL').bind(order.id, amount),
     env.DB.prepare('UPDATE shop_order_lines SET quantity = ?2, unit_amount = ?3, amount = ?4 WHERE order_id = ?1 AND EXISTS (SELECT 1 FROM shop_orders WHERE id = ?1 AND paid_at IS NULL)').bind(order.id, quantity, amount / quantity, amount),
   ]);
@@ -1028,7 +1079,7 @@ async function paidBasket(env,shop,o,lines,session,paidAt) {
   if(session.payment_status!=='paid' || session.currency!==o.currency || !Number.isSafeInteger(total) || total<=0 || session.amount_subtotal!==total)return 'mismatch';
   if(o.paid_at!==null)return 'already';
   const expected=lines.reduce((n,l)=>n+Number(l.amount),0);
-  if(!Number.isSafeInteger(expected)||expected<=0)return 'mismatch';
+  if(!Number.isSafeInteger(expected)||expected<=0||total!==expected)return 'mismatch';
   const writes=[];let cumulative=0,allocated=0;
   for(const l of lines) {
     cumulative+=Number(l.amount);
@@ -1060,6 +1111,7 @@ async function bindMenuSession(env,session,source,lines) {
   for(const l of invoice.lines?.data??[]) {
     const line=lines.find(x=>JSON.parse(x.snapshot).stripePrice===(l.price?.id??l.pricing?.price_details?.price));
     if(!line || !Number.isSafeInteger(l.quantity) || l.quantity<1 || l.amount!==JSON.parse(line.snapshot).price*l.quantity)throw new Error('Unknown invoice line');
+    if(l.quantity>(JSON.parse(line.snapshot).maxQuantity??link.items?.find(i=>i.item===line.item)?.maxQuantity??999999))return false;
     paidLines.push({...line,quantity:l.quantity,amount:l.amount});
   }
   if(!paidLines.length || paidLines.reduce((n,l)=>n+l.amount,0)!==session.amount_subtotal)throw new Error('Invoice subtotal mismatch');
@@ -1084,6 +1136,7 @@ async function bindMenuSession(env,session,source,lines) {
 export async function paid(env, shop, session, paidAt = Date.now()) {
   const o = await orderBySession(env, session.id);
   if (!o) return 'unknown-order';
+  if(o.status==='review')return 'review';
   // The session must be the one this order opened, for this player and this price.
   const savedLines=await orderLines(env,o.id);
   if(savedLines[0]?.snapshot && JSON.parse(savedLines[0].snapshot).paymentLink?.basket)return paidBasket(env,shop,o,savedLines,session,paidAt);
@@ -1189,6 +1242,11 @@ export async function syncRefunds(env, payment, freeOrder = null, freeLines = []
   }
   const gross = Number(o.total ?? o.amount);
   if (!Number.isSafeInteger(amount) || amount > gross) throw new Error('Stripe refund total exceeds payment');
+  if(o.status==='review') {
+    // Review never grants anything, even when a later refund is reversed.
+    await env.DB.prepare("UPDATE shop_orders SET refunded_amount=?2,refunded_net=?2,updated_at=?3,note=?4 WHERE id=?1 AND status='review'").bind(o.id,amount,Date.now(),`Payment received; staff review required. Refunded ${amount} of ${gross} ${o.currency} minor units.`).run();
+    return 'review';
+  }
   const moneyFull = amount === gross && gross > 0;
   const whole = moneyFull && [...refunds.values()].some((r) => r.status === 'succeeded' && !r.metadata?.line);
   const taggedGross = [...totals.values()].reduce((n, value) => n + value, 0);
@@ -1227,6 +1285,7 @@ export async function syncRefunds(env, payment, freeOrder = null, freeLines = []
 async function disputed(env, payment, disputeId) {
   const o = payment ? await orderByPayment(env, payment) : null;
   if (!o) return 'unknown-order';
+  if(o.status==='review'){await env.DB.prepare("UPDATE shop_orders SET dispute=?2,note='Payment received; disputed payment requires staff review.',updated_at=?3 WHERE id=?1").bind(o.id,disputeId,Date.now()).run();return 'review';}
   await env.DB.prepare("UPDATE shop_orders SET status = 'disputed', dispute = ?2, updated_at = ?3 WHERE id = ?1 AND status = 'paid'").bind(o.id, disputeId, Date.now()).run();
   return 'disputed';
 }
@@ -1235,6 +1294,7 @@ async function disputed(env, payment, disputeId) {
 async function disputeClosed(env, payment, status) {
   const o = payment ? await orderByPayment(env, payment) : null;
   if (!o) return 'unknown-order';
+  if(o.status==='review'){await env.DB.prepare("UPDATE shop_orders SET note=?2,updated_at=?3 WHERE id=?1").bind(o.id,`Payment received; dispute ${status}. Staff review required.`,Date.now()).run();return 'review';}
   const now = Date.now();
   if (!['paid', 'disputed'].includes(o.status)) return 'already';
   if (status === 'lost') {

package/worker/version.mjs

@@ -1,2 +1,2 @@
 /** The @homie-rocks/studio version this Worker code is (package.json's; a test keeps them equal). Cache-busts /_homie/site.js. */
-export const STUDIO_VERSION_TAG = '0.52.0';
+export const STUDIO_VERSION_TAG = '0.54.0';