@homie-rocks/studio 0.53.0 → 0.55.0

package/worker/shop.mjs

@@ -1,3 +1,4 @@
+const officeShopPage = async (...args) => (await import('./shop-page.mjs')).officeShopPage(...args);
 import {claimHoldStatement,ownedHold} from './booking-holds.mjs';
 import { stripeEventOwner } from './stripe-ownership.mjs';
 import { localSession } from './local-test.mjs';
@@ -47,7 +48,7 @@ import {
   setBand, shopDataOf, spentThisMonth,
 } from './shop-store.mjs';
 import { apiBase, STRIPE_API, redactStripe, WEBHOOK_SECRET_SHAPE, KEY_SHAPE, stripeCall, StripeError, createCheckoutSession, createRefund, expireCheckoutSession, dashboardLink, isApprovalRequired, isMissingProduct, productIdOf, verifyWebhook } from './stripe.mjs';
-import { SHOP_JS, officeShopPage, parentPage, refundsPage, shopPage, thanksPage } from './shop-page.mjs';
+
 import { notFoundPage } from './site.mjs';
 
 export { forgetPlayerShop, officeShopPage, shopDataOf };
@@ -217,7 +218,7 @@ export async function shopRoutes(request, env, ctx, url, { catalogueOf }) {
   const requestAt = Date.now();
   const path = url.pathname;
   const read = request.method === 'GET' || request.method === 'HEAD';
-  if (path === '/_homie/shop.js') return new Response(SHOP_JS, { headers: { 'content-type': 'text/javascript; charset=utf-8', 'cache-control': 'public, max-age=300', 'x-content-type-options': 'nosniff' } });
+  if (path === '/_homie/shop.js') return new Response((await import('./shop-page.mjs')).SHOP_JS, { headers: { 'content-type': 'text/javascript; charset=utf-8', 'cache-control': 'public, max-age=300', 'x-content-type-options': 'nosniff' } });
   const shopPath = path === '/shop' || path === '/shop/' || path.startsWith('/shop/') || path === '/api/shop' || path.startsWith('/api/shop/') || path === '/api/player/owns';
   if (selling.enabled && (path.startsWith('/api/purchases/') || path.startsWith('/purchases/'))) return selling.purchaseRoutes(request, env, url, await catalogueOf());
   if (!shopPath) return null;
@@ -230,7 +231,7 @@ export async function shopRoutes(request, env, ctx, url, { catalogueOf }) {
     if (path === '/api/player/owns') return json({ ok: true, owns: [], open: false });
     if (path.startsWith('/api/')) return json({ ok: true, open: false, items: [], missing: [shop ? 'kids-studio' : 'shop.json'] });
     // No shop.json: /shop/ is the studio's own to use (a page in site/pages, say). The policy can close a kids studio's shop.
-    if(!shop && path==='/shop/' && read && !cat.site?.pages?.includes('/shop/')) return shopPage(cat,checkShop({}).shop,{origin:url.origin,open:false});
+    if(!shop && path==='/shop/' && read && !cat.site?.pages?.includes('/shop/')) return (await import('./shop-page.mjs')).shopPage(cat,checkShop({}).shop,{origin:url.origin,open:false});
     return shop ? notFoundPage('This studio sells nothing.', cat) : null;
   }
   const ready = await readiness(env, shop);
@@ -271,9 +272,9 @@ export async function shopRoutes(request, env, ctx, url, { catalogueOf }) {
     if (path === '/api/shop/parent' && request.method === 'POST') return await parentLinkRoute(request, env, url, cat, shop, ready);
     if (path === '/api/shop/used' && request.method === 'POST') return await usedRoute(request, env, shop);
     if (path === '/api/shop/refund' && request.method === 'POST') return await selfRefundRoute(request, env, shop, ready);
-    if (path === '/shop/' && read) return shopPage(cat, shop, { origin: url.origin, game: GAME_ID.test(url.searchParams.get('game') ?? '') ? url.searchParams.get('game') : null, item: url.searchParams.get('item'), open: ready.ready, mode: ready.mode });
-    if (path === '/shop/thanks' && read) return thanksPage(cat, shop, { session: /^cs_[A-Za-z0-9_]{1,200}$/.test(url.searchParams.get('session_id') ?? '') ? url.searchParams.get('session_id') : null, game: GAME_ID.test(url.searchParams.get('game') ?? '') ? url.searchParams.get('game') : null });
-    if ((path === '/shop/refunds/' || path === '/shop/refunds') && read) return refundsPage(cat, shop);
+    if (path === '/shop/' && read) return (await import('./shop-page.mjs')).shopPage(cat, shop, { origin: url.origin, game: GAME_ID.test(url.searchParams.get('game') ?? '') ? url.searchParams.get('game') : null, item: url.searchParams.get('item'), open: ready.ready, mode: ready.mode });
+    if (path === '/shop/thanks' && read) return (await import('./shop-page.mjs')).thanksPage(cat, shop, { session: /^cs_[A-Za-z0-9_]{1,200}$/.test(url.searchParams.get('session_id') ?? '') ? url.searchParams.get('session_id') : null, game: GAME_ID.test(url.searchParams.get('game') ?? '') ? url.searchParams.get('game') : null });
+    if ((path === '/shop/refunds/' || path === '/shop/refunds') && read) return (await import('./shop-page.mjs')).refundsPage(cat, shop);
     const parent = /^\/shop\/parent\/([A-Za-z0-9_-]{43})$/.exec(path);
     if (parent) return await parentRoute(request, env, url, cat, shop, ready, parent[1], ctx);
   } catch (error) {
@@ -347,7 +348,7 @@ async function orderRoute(request, env, url, shop) {
     } catch (error) { logOrderError(env, o.id, error); }
   }
   const reference = await env.DB.prepare('SELECT value FROM meta WHERE key=?1').bind(`shop-reference:${o.id}`).first();
-  return json({ ok: true, order: o.id, simulated: apiBase(env) !== STRIPE_API, status: playerOrderStatus(o), item: o.item, game: o.game ?? null, reference: reference?.value ?? null });
+  return json({ ok: true, order: o.id, simulated: apiBase(env) !== STRIPE_API, status: playerOrderStatus(o), ...(o.status==='review'?{note:'Payment received. Staff will reconcile the payment or refund it.'}:{}), item: o.item, game: o.game ?? null, reference: reference?.value ?? null });
 }
 
 /** The neutral age question: a year of birth, once. Nothing hints which answer opens anything; no default. */
@@ -524,14 +525,13 @@ async function startCheckout(env, url, cat, shop, item, { player, game, amount,
   if(keyless && lines.length>1 && !menu)return {error:fail(409,'menu','These items need separate Stripe menus. Custom amounts and monthly gifts use their own links.')};
   if(keyless && (!link || !paymentLinkURL(link.url)))return {error:fail(503,'payment-links','Ask the owner’s AI to sync the shop and published booking slots.')};
   if(keyless && booking) {
-    if(booking.quantity!==1)return {error:fail(400,'quantity','Book one seat per checkout; Stripe counts completed sessions.')};
     const slot=await env.DB.prepare('SELECT value FROM app_records WHERE app=?1 AND collection=?2 AND id=?3').bind(booking.app,booking.slots,booking.slot).first();
     if(!slot || JSON.parse(slot.value).capacity!==link.capacity)return {error:fail(409,'slot-sync','This slot changed; ask the owner’s AI to sync its Stripe link.')};
     const confirmed=await env.DB.prepare("SELECT COALESCE(SUM(quantity),0) n FROM shop_bookings WHERE app=?1 AND slots=?2 AND slot=?3 AND state='confirmed'").bind(booking.app,booking.slots,booking.slot).first();
     const update=await env.DB.prepare('SELECT value FROM meta WHERE key=?1').bind(`shop-slot-link:${link.id}`).first();
     const observed=update?JSON.parse(update.value):null;
     const status=observed && observed.capacity===(link.limit??link.capacity) ? observed : link;
-    if(!status.active || status.count>=(link.limit??link.capacity) || confirmed.n>=link.capacity)return {error:fail(409,'capacity','That slot is full. Choose another slot.')};
+    if(!status.active || status.count>=(link.limit??link.capacity) || confirmed.n+booking.quantity>link.capacity)return {error:fail(409,'capacity','That slot is full. Choose another slot.')};
   }
   if(keyless && item.price==='choose' && lines[0].quantity!==1)return {error:fail(400,'quantity','A tip is one chosen amount; choose it on Stripe.')};
   if(menu && menu.items.some(e=>{const i=shop.items.find(i=>i.id===e.item);return !i || i.game && i.game!==game;}))return {error:fail(409,'menu','This menu includes items from another app; sync separate menus for each app.')};
@@ -649,6 +649,7 @@ async function buyRoute(request, env, url, cat, shop, ready, ctx, requestAt) {
     const item = shop.items.find((i) => i.id === entry?.item);
     if (!item) return fail(404, 'item', 'no such item here');
     const quantity = entry.quantity ?? 1;
+    if (item.maxQuantity!==undefined&&quantity>item.maxQuantity)return fail(400,'quantity','This quantity exceeds the studio item maximum.');
     if (!Number.isSafeInteger(quantity) || quantity < 1) return fail(400, 'arithmetic', 'Quantity is a positive safe integer.');
     if(!hasStripeKey(env) && ['supporter','deposit'].includes(item.kind) && quantity!==1)return fail(400,'quantity','This payment link has quantity fixed at one.');
     if(item.kind==='deposit' && (!reference || !Number.isSafeInteger(entry.amount??item.price) || (entry.amount??item.price)<=0))return fail(400,'deposit','A deposit requires the app reference and its saved positive amount.');
@@ -716,6 +717,7 @@ async function parentLinkRoute(request, env, url, cat, shop, ready) {
     const item = shop.items.find((i) => i.id === entry?.item);
     if (!item) return fail(404, 'item', 'no such item here');
     const quantity = entry.quantity ?? 1;
+    if (item.maxQuantity!==undefined&&quantity>item.maxQuantity)return fail(400,'quantity','This quantity exceeds the studio item maximum.');
     if (!Number.isSafeInteger(quantity) || quantity < 1) return fail(400, 'arithmetic', 'Quantity is a positive safe integer.');
     if (!shop.policy.repeatPurchases && (quantity > 1 || seen.has(item.id))) return fail(403, 'owned', 'The studio has disabled repeat purchases.');
     seen.add(item.id);
@@ -737,35 +739,35 @@ async function parentRoute(request, env, url, cat, shop, ready, token, ctx) {
   const cart = row ? row.cart ? JSON.parse(row.cart) : [{ item: row.item, quantity: 1 }] : [];
   const lines = cart.map((entry) => ({ item: shop.items.find((i) => i.id === entry.item), quantity: entry.quantity }));
   const item = lines[0]?.item;
-  if (lines.some((line) => !line.item)) return parentPage(cat, shop, { gone: true });
-  if (!row || !item || Number(row.expires_at) < Date.now()) return parentPage(cat, shop, { gone: true });
+  if (lines.some((line) => !line.item)) return (await import('./shop-page.mjs')).parentPage(cat, shop, { gone: true });
+  if (!row || !item || Number(row.expires_at) < Date.now()) return (await import('./shop-page.mjs')).parentPage(cat, shop, { gone: true });
   const kid = await players.get(env, row.player);
-  if (!kid) return parentPage(cat, shop, { gone: true });
+  if (!kid) return (await import('./shop-page.mjs')).parentPage(cat, shop, { gone: true });
   const done = row.order_id ? await orderById(env, row.order_id) : null;
-  if (done?.status === 'paid') return parentPage(cat, shop, { item, lines, name: kid.name, paid: true });
-  if (request.method === 'GET' || request.method === 'HEAD') return parentPage(cat, shop, { item, lines, name: kid.name, token, open: ready.ready });
+  if (done?.status === 'paid') return (await import('./shop-page.mjs')).parentPage(cat, shop, { item, lines, name: kid.name, paid: true });
+  if (request.method === 'GET' || request.method === 'HEAD') return (await import('./shop-page.mjs')).parentPage(cat, shop, { item, lines, name: kid.name, token, open: ready.ready });
   if (request.method !== 'POST' || !sameOrigin(request, url)) return new Response('Not allowed', { status: 403 });
   let form = null;
   try { form = await request.formData(); } catch { form = null; }
-  if (String(form?.get('grownup') ?? '') !== 'yes') return parentPage(cat, shop, { item, lines, name: kid.name, token, open: ready.ready, said: 'Tick the box to say you are their parent or guardian and an adult.' });
-  if (!ready.ready) return parentPage(cat, shop, { item, lines, name: kid.name, token, open: false });
-  if (purchaseLimited(request, shop, row.player, 'parentpay')) return parentPage(cat, shop, { item, lines, name: kid.name, token, open: true, said: 'One moment: too many tries.' });
+  if (String(form?.get('grownup') ?? '') !== 'yes') return (await import('./shop-page.mjs')).parentPage(cat, shop, { item, lines, name: kid.name, token, open: ready.ready, said: 'Tick the box to say you are their parent or guardian and an adult.' });
+  if (!ready.ready) return (await import('./shop-page.mjs')).parentPage(cat, shop, { item, lines, name: kid.name, token, open: false });
+  if (purchaseLimited(request, shop, row.player, 'parentpay')) return (await import('./shop-page.mjs')).parentPage(cat, shop, { item, lines, name: kid.name, token, open: true, said: 'One moment: too many tries.' });
   const band = await bandOfPlayer(env, row.player);
   const owns = await ownsOf(env, row.player);
   let amount = 0;
   for (const [index, line] of lines.entries()) {
     const it = line.item;
     const owned = it.gives.length > 0 && it.gives.every((key) => owns.some((o) => o.key === key && o.item === it.id));
-    if (wayFor(it, { player: kid, band, owned, spent: 0, cap: null, policy: shop.policy }) !== 'ask-a-parent') return parentPage(cat, shop, { gone: true });
+    if (wayFor(it, { player: kid, band, owned, spent: 0, cap: null, policy: shop.policy }) !== 'ask-a-parent') return (await import('./shop-page.mjs')).parentPage(cat, shop, { gone: true });
     line.amount = it.price === 'choose' ? parseAmount(form?.get(lines.length === 1 ? 'amount' : `amount_${index}`), currencyScale(shop.currency)) : it.price;
     const invalid = amountError(line.amount, shop.currency);
-    if (invalid || it.price === 'choose' && (line.amount < it.min || it.max !== null && line.amount > it.max)) return parentPage(cat, shop, { item, lines, name: kid.name, token, said: invalid ?? 'This amount is outside the studio range.' });
+    if (invalid || it.price === 'choose' && (line.amount < it.min || it.max !== null && line.amount > it.max)) return (await import('./shop-page.mjs')).parentPage(cat, shop, { item, lines, name: kid.name, token, said: invalid ?? 'This amount is outside the studio range.' });
     const total = BigInt(amount) + BigInt(line.amount) * BigInt(line.quantity);
-    if (total > BigInt(Number.MAX_SAFE_INTEGER)) return parentPage(cat, shop, { item, lines, name: kid.name, token, said: 'The total exceeds safe integer arithmetic.' });
+    if (total > BigInt(Number.MAX_SAFE_INTEGER)) return (await import('./shop-page.mjs')).parentPage(cat, shop, { item, lines, name: kid.name, token, said: 'The total exceeds safe integer arithmetic.' });
     amount = Number(total);
   }
   const r = await startCheckout(env, url, cat, shop, item, { player: { id: row.player }, game: row.game, amount, parent: true, lines });
-  if (r.error) return parentPage(cat, shop, { item, lines, name: kid.name, token, open: true, said: (await r.error.json()).message });
+  if (r.error) return (await import('./shop-page.mjs')).parentPage(cat, shop, { item, lines, name: kid.name, token, open: true, said: (await r.error.json()).message });
   await env.DB.prepare('UPDATE shop_parent_links SET order_id = ?2 WHERE hash = ?1').bind(await sha256Hex(token), r.order.id).run();
   if (!r.reconciled && ctx?.waitUntil) ctx.waitUntil(reconcileOrders(env, shop, row.player).catch((error) => logOrderError(env, r.order.id, error)));
   return Response.redirect(r.url, 303);
@@ -835,7 +837,13 @@ async function hook(request, env, cat, shop, ready) {
   if (payload === null) return fail(413, 'too-large', 'The studio webhook byte limit was reached.');
   const v = await verifyWebhook(payload, request.headers.get('stripe-signature'), env.STRIPE_WEBHOOK_SECRET);
   if (!v.ok) return fail(v.why === 'no-secret' ? 503 : 400, v.why, 'not a webhook from this studio\'s Stripe');
-  const ev = v.event;
+  if(env.BACKGROUND)return (await import('./stripe-intake.mjs')).acceptStripeEvent(env,v.event,new URL(request.url).origin);
+  return reconcileShopEvent(request,env,shop,v.event);
+}
+
+/** Internal verified-event seam shared by direct legacy intake and the queue consumer. */
+export async function reconcileShopEvent(request,env,shop,ev) {
+  shop??=checkShop({}).shop;
   const obj = ev.data?.object ?? {};
   const needed = ['checkout.session.completed', 'checkout.session.async_payment_succeeded', 'checkout.session.async_payment_failed', 'checkout.session.expired', 'charge.refunded', 'refund.created', 'refund.updated', 'refund.failed', 'charge.dispute.created', 'charge.dispute.closed'];
   if (selling.enabled) {
@@ -877,7 +885,7 @@ async function hook(request, env, cat, shop, ready) {
     if (subscriptionResult !== null) return json({ ok: true, did: subscriptionResult });
     const sessionEvent = ev.type.startsWith('checkout.session.');
     if (!sessionEvent) await rememberMoneyEvent(env, ev);
-    if (sessionEvent && obj.payment_link && !(await bindLinkSession(env, obj, ev.livemode ? 'live' : 'test'))) return json({ ok: true, did: 'mismatch' });
+    if (sessionEvent && obj.payment_link && !(await bindLinkSession(env, obj, ev.livemode ? 'live' : 'test'))) return json({ok:true,did:await reviewLinkPayment(env,obj,ev.livemode?'live':'test')?'review':'mismatch'});
     if (sessionEvent && obj.metadata?.order && !obj.payment_link) {
       await env.DB.prepare(`UPDATE shop_orders SET session=?2 WHERE id=?1 AND session IS NULL AND mode=?3
         AND EXISTS(SELECT 1 FROM meta WHERE key='booking-checkout:' || shop_orders.id)`)
@@ -950,20 +958,63 @@ async function hook(request, env, cat, shop, ready) {
       default:
         break;
     }
+    if(did==='mismatch'&&obj.payment_link&&await reviewLinkPayment(env,obj,ev.livemode?'live':'test'))did='review';
     if (did === 'needs-keyed-recovery') return fail(503, did, 'This earlier multi-item checkout needs its original connection to recover tax per line. Reconnect it, then resend this event.');
     if (did === 'missing-item' || did === 'unknown-order') return fail(503, did, did === 'missing-item' ? 'Restore this order item in shop.json to grant it; the office can refund its payment.' : 'Payment order is not recorded yet; retry this event.');
     await env.DB.prepare('INSERT INTO shop_events (id, type, at) VALUES (?1, ?2, ?3) ON CONFLICT(id) DO NOTHING').bind(ev.id, ev.type, Date.now()).run();
-    if (Math.random() < 0.02) await env.DB.prepare('DELETE FROM shop_events WHERE at < ?1').bind(Date.now() - 60 * DAY).run();
     return json({ ok: true, did });
   } catch (error) {
+    if(/(?:booking|resource) capacity unavailable/.test(error.message)&&obj.payment_link&&await reviewLinkPayment(env,obj,ev.livemode?'live':'test','The paid group exceeds remaining capacity. Staff will arrange a replacement or refund.'))return json({ok:true,did:'review'});
     logOrderError(env, null, error);
     return fail(503, 'stripe-retry', 'Payment reconciliation is temporarily unavailable; retry this event.');
   }
 }
 
+/** Retain a verified payment even when its frozen order cannot be fulfilled. No grants. */
+async function reviewLinkPayment(env,session,mode,reason='The paid amount differs from the order. Staff will reconcile the payment or refund it.') {
+ if(session.payment_status!=='paid'||!/^cs_[A-Za-z0-9_]+$/.test(session.id??'')||!Number.isSafeInteger(session.amount_total)||session.amount_total<0)return false;
+ if((await orderBySession(env,session.id))?.status==='review')return true;
+ const source=await orderById(env,session.client_reference_id);
+ const lines=source?await orderLines(env,source.id):[],link=lines[0]?.snapshot&&JSON.parse(lines[0].snapshot).paymentLink;
+ const linkId=session.payment_link?.id??session.payment_link,config=linkConfig(env);
+ const owned=[...(config?.items??[]),...(config?.menus??[]),...(config?.slots??[])].some(l=>l.id===linkId) || Boolean(await env.DB.prepare("SELECT 1 FROM shop_order_lines WHERE json_extract(snapshot,'$.paymentLink.id')=?1 LIMIT 1").bind(linkId).first());
+ if(!owned)return false;
+ if(!source||source.mode!==mode||session.currency!==source.currency||!link||link.id!==linkId||session.metadata?.revision!==link.revision){
+  const now=Date.now(),id=`ord_${(await sha256Hex(session.id)).slice(0,20)}`,payment=typeof session.payment_intent==='string'?session.payment_intent:session.payment_intent?.id;
+  const note='Payment received; missing or mismatched order context. Staff must reconcile or refund it.';
+  await env.DB.batch([
+   env.DB.prepare("INSERT OR IGNORE INTO shop_orders(id,item,amount,total,currency,till,mode,status,session,payment,created_at,updated_at,attention,note) VALUES(?1,'payment-review',?2,?2,?3,'stripe',?4,'review',?5,?6,?7,?7,1,?8)").bind(id,session.amount_total,session.currency,mode,session.id,payment??null,now,note),
+   env.DB.prepare('INSERT OR IGNORE INTO meta(key,value) VALUES(?1,?2)').bind('payment-review:'+session.id,JSON.stringify({session:session.id,receivedAt:now,payment,amount:session.amount_total,currency:session.currency,reference:session.client_reference_id,link:linkId,reason:note})),
+   env.DB.prepare("INSERT OR IGNORE INTO studio_events(id,type,data,at) VALUES(?1,'payment.review',?2,?3)").bind('payment-review:'+session.id,JSON.stringify({order:id,payment,amount:session.amount_total,currency:session.currency,note}),now),
+  ]);
+  return true;
+ }
+ await env.DB.prepare('UPDATE shop_orders SET session=?2 WHERE id=?1 AND session IS NULL').bind(source.id,session.id).run();
+ let order=await orderBySession(env,session.id);
+ if(!order) {
+  const id=`ord_${(await sha256Hex(session.id)).slice(0,20)}`;
+  await env.DB.batch([
+   env.DB.prepare("INSERT OR IGNORE INTO shop_orders(id,player,checkout_player,item,game,amount,currency,till,mode,status,parent,created_at,updated_at,session) SELECT ?2,player,checkout_player,item,game,amount,currency,till,mode,'started',parent,?4,?4,?3 FROM shop_orders WHERE id=?1").bind(source.id,id,session.id,Date.now()),
+   env.DB.prepare('INSERT OR IGNORE INTO meta(key,value) SELECT ?1,value FROM meta WHERE key=?2').bind(`shop-reference:${id}`,`shop-reference:${source.id}`),
+   ...lines.map((l,i)=>env.DB.prepare('INSERT OR IGNORE INTO shop_order_lines(id,order_id,position,item,quantity,unit_amount,amount,snapshot) VALUES(?1,?2,?3,?4,?5,?6,?7,?8)').bind(`${id}_${i}`,id,i,l.item,l.quantity,l.unit_amount,l.amount,l.snapshot)),
+  ]);order=await orderBySession(env,session.id);
+ }
+ if(order.status==='review')return true;
+ if(order.paid_at!==null)return false;
+ const payment=typeof session.payment_intent==='string'?session.payment_intent:session.payment_intent?.id;
+ const note='Payment received. '+reason,now=Date.now();
+ await env.DB.batch([
+  env.DB.prepare("UPDATE shop_orders SET status='review',payment=?2,total=?3,updated_at=?4,attention=1,note=?5 WHERE id=?1 AND paid_at IS NULL").bind(order.id,payment??null,session.amount_total,now,note),
+  env.DB.prepare("INSERT OR IGNORE INTO meta(key,value) VALUES(?1,?2)").bind('payment-review:'+session.id,JSON.stringify({session:session.id,receivedAt:now,payment,amount:session.amount_total,currency:session.currency,expected:source.amount,reason})),
+  env.DB.prepare("INSERT OR IGNORE INTO studio_events(id,type,data,at) VALUES(?1,'payment.review',?2,?3)").bind('payment-review:'+session.id,JSON.stringify({order:order.id,payment,amount:session.amount_total,currency:session.currency,note}),now),
+ ]);
+ return true;
+}
+
 /** Payment Links can be reopened. Each signed Session becomes its own order; the URL reference
  * selects a frozen local intent, never an entitlement or a buyer-supplied price. */
 async function bindLinkSession(env, session, mode) {
+  if(session.id&&(await orderBySession(env,session.id))?.status==='review')return false;
   if (!/^ord_[A-Za-z0-9]{20}$/.test(session.client_reference_id ?? '') || !/^cs_[A-Za-z0-9_]+$/.test(session.id ?? '')) return false;
   const source = await orderById(env, session.client_reference_id);
   if (!source || source.mode !== mode) return false;
@@ -982,7 +1033,7 @@ async function bindLinkSession(env, session, mode) {
   if(item.kind==='deposit' && amount!==source.amount)return false;
   const quantity = item.price === 'choose' ? 1 : amount / item.price;
   if(['supporter','deposit'].includes(item.kind) && quantity!==1)return false;
-  if (!Number.isSafeInteger(quantity) || quantity < 1 || quantity > 999999) return false;
+  if (!Number.isSafeInteger(quantity) || quantity < 1 || quantity > (item.maxQuantity??link.maxQuantity??999999)) return false;
   if (item.price === 'choose' && (amount < item.min || item.max !== null && amount > item.max)) return false;
   // Claim the first session atomically. A repeated URL creates a separate paid order, never loses a payment.
   await env.DB.prepare('UPDATE shop_orders SET session = ?2 WHERE id = ?1 AND session IS NULL').bind(source.id, session.id).run();
@@ -994,13 +1045,14 @@ async function bindLinkSession(env, session, mode) {
       env.DB.prepare("INSERT INTO shop_orders (id, player, checkout_player, item, game, amount, currency, till, mode, status, parent, created_at, updated_at, session) SELECT ?2, player, checkout_player, item, game, ?4, currency, till, mode, 'started', parent, ?5, ?5, ?3 FROM shop_orders WHERE id = ?1 ON CONFLICT DO NOTHING").bind(source.id, id, session.id, amount, Date.now()),
       env.DB.prepare("INSERT OR IGNORE INTO meta(key,value) SELECT ?1,CASE WHEN value=?3 THEN ?4 ELSE value END FROM meta WHERE key=?2").bind(`shop-reference:${id}`, `shop-reference:${source.id}`,source.id,id),
       env.DB.prepare('INSERT INTO shop_order_lines (id, order_id, position, item, quantity, unit_amount, amount, snapshot) VALUES (?1, ?2, 0, ?3, ?4, ?5, ?6, ?7) ON CONFLICT DO NOTHING').bind(`${id}_0`, id, item.id, quantity, amount / quantity, amount, lines[0].snapshot),
-      ...(booking ? [bookingStatement(env,{...booking,slot:link.slot,slots:link.slots,id,order:id,pending:true})] : []),
+      ...(booking ? [bookingStatement(env,{...booking,quantity,slot:link.slot,slots:link.slots,id,order:id,pending:true})] : []),
     ]);
     order = await orderBySession(env, session.id);
 
   }
   if (!order) return false;
   if (order.paid_at === null) await env.DB.batch([
+    ...(link.slot?[env.DB.prepare("UPDATE shop_bookings SET quantity=?2 WHERE order_id=?1 AND state='pending'").bind(order.id,quantity)]:[]),
     env.DB.prepare('UPDATE shop_orders SET amount = ?2 WHERE id = ?1 AND paid_at IS NULL').bind(order.id, amount),
     env.DB.prepare('UPDATE shop_order_lines SET quantity = ?2, unit_amount = ?3, amount = ?4 WHERE order_id = ?1 AND EXISTS (SELECT 1 FROM shop_orders WHERE id = ?1 AND paid_at IS NULL)').bind(order.id, quantity, amount / quantity, amount),
   ]);
@@ -1033,7 +1085,7 @@ async function paidBasket(env,shop,o,lines,session,paidAt) {
   if(session.payment_status!=='paid' || session.currency!==o.currency || !Number.isSafeInteger(total) || total<=0 || session.amount_subtotal!==total)return 'mismatch';
   if(o.paid_at!==null)return 'already';
   const expected=lines.reduce((n,l)=>n+Number(l.amount),0);
-  if(!Number.isSafeInteger(expected)||expected<=0)return 'mismatch';
+  if(!Number.isSafeInteger(expected)||expected<=0||total!==expected)return 'mismatch';
   const writes=[];let cumulative=0,allocated=0;
   for(const l of lines) {
     cumulative+=Number(l.amount);
@@ -1065,6 +1117,7 @@ async function bindMenuSession(env,session,source,lines) {
   for(const l of invoice.lines?.data??[]) {
     const line=lines.find(x=>JSON.parse(x.snapshot).stripePrice===(l.price?.id??l.pricing?.price_details?.price));
     if(!line || !Number.isSafeInteger(l.quantity) || l.quantity<1 || l.amount!==JSON.parse(line.snapshot).price*l.quantity)throw new Error('Unknown invoice line');
+    if(l.quantity>(JSON.parse(line.snapshot).maxQuantity??link.items?.find(i=>i.item===line.item)?.maxQuantity??999999))return false;
     paidLines.push({...line,quantity:l.quantity,amount:l.amount});
   }
   if(!paidLines.length || paidLines.reduce((n,l)=>n+l.amount,0)!==session.amount_subtotal)throw new Error('Invoice subtotal mismatch');
@@ -1089,6 +1142,7 @@ async function bindMenuSession(env,session,source,lines) {
 export async function paid(env, shop, session, paidAt = Date.now()) {
   const o = await orderBySession(env, session.id);
   if (!o) return 'unknown-order';
+  if(o.status==='review')return 'review';
   // The session must be the one this order opened, for this player and this price.
   const savedLines=await orderLines(env,o.id);
   if(savedLines[0]?.snapshot && JSON.parse(savedLines[0].snapshot).paymentLink?.basket)return paidBasket(env,shop,o,savedLines,session,paidAt);
@@ -1194,6 +1248,11 @@ export async function syncRefunds(env, payment, freeOrder = null, freeLines = []
   }
   const gross = Number(o.total ?? o.amount);
   if (!Number.isSafeInteger(amount) || amount > gross) throw new Error('Stripe refund total exceeds payment');
+  if(o.status==='review') {
+    // Review never grants anything, even when a later refund is reversed.
+    await env.DB.prepare("UPDATE shop_orders SET refunded_amount=?2,refunded_net=?2,updated_at=?3,note=?4 WHERE id=?1 AND status='review'").bind(o.id,amount,Date.now(),`Payment received; staff review required. Refunded ${amount} of ${gross} ${o.currency} minor units.`).run();
+    return 'review';
+  }
   const moneyFull = amount === gross && gross > 0;
   const whole = moneyFull && [...refunds.values()].some((r) => r.status === 'succeeded' && !r.metadata?.line);
   const taggedGross = [...totals.values()].reduce((n, value) => n + value, 0);
@@ -1232,6 +1291,7 @@ export async function syncRefunds(env, payment, freeOrder = null, freeLines = []
 async function disputed(env, payment, disputeId) {
   const o = payment ? await orderByPayment(env, payment) : null;
   if (!o) return 'unknown-order';
+  if(o.status==='review'){await env.DB.prepare("UPDATE shop_orders SET dispute=?2,note='Payment received; disputed payment requires staff review.',updated_at=?3 WHERE id=?1").bind(o.id,disputeId,Date.now()).run();return 'review';}
   await env.DB.prepare("UPDATE shop_orders SET status = 'disputed', dispute = ?2, updated_at = ?3 WHERE id = ?1 AND status = 'paid'").bind(o.id, disputeId, Date.now()).run();
   return 'disputed';
 }
@@ -1240,6 +1300,7 @@ async function disputed(env, payment, disputeId) {
 async function disputeClosed(env, payment, status) {
   const o = payment ? await orderByPayment(env, payment) : null;
   if (!o) return 'unknown-order';
+  if(o.status==='review'){await env.DB.prepare("UPDATE shop_orders SET note=?2,updated_at=?3 WHERE id=?1").bind(o.id,`Payment received; dispute ${status}. Staff review required.`,Date.now()).run();return 'review';}
   const now = Date.now();
   if (!['paid', 'disputed'].includes(o.status)) return 'already';
   if (status === 'lost') {
@@ -1388,6 +1449,7 @@ export async function shopOffice(env, cat, origin, itemCursor = 0, orderCursor =
     },
     keyless: !hasStripeKey(env),
     hook: `${origin}/api/shop/hook`,
+    ...(env.BACKGROUND ? {delivery:await (await import('./stripe-intake.mjs')).stripeIntakeStatus(env)} : {}),
     totals: null, orders: [],
   };
   if (!(await migrated(env, { complete: false }))) return out;

package/worker/stats.mjs

@@ -1,3 +1,4 @@
+import {writePageMetric,analyticsStatus} from './analytics.mjs';
 /**
  * STUDIO METRICS: count, don't track (@homie-rocks/studio 0.6.0).
  *
@@ -5,7 +6,7 @@
  * party, no cookie is set on a visitor, and no visitor is identified: a count is a number on a day, never a row
  * about a person. Referrers are kept as a host name only (never a path, a query or an address).
  *
- * WHAT IS COUNTED, one D1 row write each (an UPSERT on a daily counter; never per frame):
+ * WHAT IS COUNTED (page metrics go to Analytics Engine; daily rollups preserve D1 history):
  *   visit   a page opened (home, a game's page, /music/, a song's page, /videos/, a video's page)
  *   play    a game's play page opened: somebody pressed Play (or followed a Play link or QR code)
  *   screen  a big screen opened (/<game>/tv)
@@ -36,9 +37,8 @@
  * (HttpOnly, SameSite=Lax; from 0.13.0 at / so the owner is recognised in their own games, never readable by a
  * page or a game). There is no other way in.
  *
- * FREE PLAN: D1 allows 100,000 row writes and 5 million row reads a day. A visit, a play, a room and a
- * song or video start are one write each; a finished round is three (its row in `rounds`, the round and the
- * humans counters). Past the day's writes, counting stops until 00:00 UTC and the site keeps working.
+ * Page totals refresh hourly and can be sampled at high traffic. Older wrappers without the analytics
+ * binding retain D1 counting. Game, payment and budget facts remain in durable storage.
  */
 
 export const STATS_MIGRATION_FILE = '0002_studio_stats.sql';
@@ -97,9 +97,10 @@ export function counter(env, { metric, subject = '', source = '', n = 1, day = t
 
 /** Run a counter write after the response (ctx.waitUntil), or before it when the caller gave no ctx. Never throws. */
 export async function count(env, ctx, row) {
+  if (writePageMetric(env, row)) return;
   const stmt = counter(env, row);
   if (!stmt) return;
-  const p = stmt.run().catch(() => {}); // before migration 0002, or past the free plan's daily writes: not counted
+  const p = stmt.run().catch(error => console.warn("Studio counter dropped:",error.message)); // before migration 0002, or past the free plan's daily writes: not counted
   if (ctx?.waitUntil) ctx.waitUntil(p); else await p;
 }
 
@@ -339,7 +340,7 @@ export async function readStats(env, cat, { range, only = null, studios = new Se
     // The studio's own pages: its home, and the /music/ and /videos/ lists (a catalogue's road).
     pages: Object.fromEntries(['home', 'games', 'rooms', 'posts', 'music', 'videos'].map((p) => [p, sum((r) => r.metric === 'visit' && r.subject === p)])),
     games: perGame, songs: media(songs, 'song', 'music'), videos: media(videos, 'video', 'videos'), referrers, days,
-    note: 'Counts, never people: a visit is a page a browser opened, a play is a Play press, a round is a finished round. Prefetches, crawlers and house QA are not counted. Times are UTC days.',
+    note: 'Counts, never people: a visit is a page a browser opened, a play is a Play press, a round is a finished round. Prefetches, crawlers and house QA are not counted. Times are UTC days.' + (env.STUDIO_ANALYTICS && env.STUDIO_ANALYTICS_DATASET ? ' Page visits, plays, screens and watches show the last hourly rollup; recent activity appears after ingestion and the next rollup. These counters may be sampled at high traffic.' + await analyticsStatus(env).then(s=>s.delayed ? ' Counts are delayed: '+(s.error??'awaiting a successful rollup')+'.' : '') : ''),
   };
 }
 

package/worker/stream-objects.mjs

@@ -0,0 +1,18 @@
+/** Streams use independent namespaces so subscribers never warm matchmaking state. */
+export class AppRecordHub {
+  constructor(ctx, env) { this.ctx=ctx; this.env=env; }
+  async fetch(request) {
+    const {AppRecordStreams}=await import('./app-streams.mjs');
+    this.streams??=new AppRecordStreams(this.env,this.ctx);
+    const input=await request.json();
+    return input.op==='open'?this.streams.open(input):this.streams.wake(input.meta);
+  }
+}
+export class EventHub {
+  constructor(ctx, env) { this.ctx=ctx; this.env=env; }
+  async fetch(request) {
+    const {EventStreams}=await import('./event-resources.mjs');
+    this.streams??=new EventStreams(this.env,this.ctx);
+    return this.streams.fetch(request);
+  }
+}

package/worker/stripe-intake.mjs

@@ -0,0 +1,79 @@
+import {RECONCILE_GUARD,guardedDatabase} from './reconcile-guard.mjs';
+/** Called only after raw-body signature verification. D1 owns the work; queues
+ * are wakeups and may be unavailable or exhaust their daily allowance. */
+export async function acceptStripeEvent(env,event,origin) {
+  await env.DB.prepare('INSERT INTO stripe_intake(id,payload,origin,received) VALUES(?1,?2,?3,?4) ON CONFLICT(id) DO NOTHING')
+    .bind(event.id,JSON.stringify(event),origin,Date.now()).run();
+  try { await env.BACKGROUND.send({v:1,type:'stripe.event',id:event.id}); }
+  catch(error) { console.warn('Stripe delivery deferred to the scheduled D1 sweep:',error.message); }
+  return Response.json({ok:true,queued:true});
+}
+async function reconcile(env,row,event,cat) {
+  const {reconcileShopEvent,shopOf}=await import('./shop.mjs');
+  return reconcileShopEvent(new Request(new URL('/api/shop/hook',row.origin)),env,shopOf(cat),event);
+}
+export async function reconcileStripeEvent(env,id,cat,{leaseMs=300000,reconcile:deliver=reconcile}={}) {
+  const now=Date.now();let lease=now+leaseMs;
+  const row=await env.DB.prepare('UPDATE stripe_intake SET lease=?2 WHERE id=?1 AND done IS NULL AND lease<?3 RETURNING *').bind(id,lease,now).first();
+  if(!row) {
+    const pending=await env.DB.prepare('SELECT done,lease FROM stripe_intake WHERE id=?1').bind(id).first();
+    if(pending?.done)return;
+    const error=new Error('Stripe event is missing or already being reconciled');
+    if(pending?.lease>=now)error.retryAfterSeconds=Math.max(1,Math.min(301,Math.ceil((pending.lease-now)/1000)+1));
+    throw error;
+  }
+  let renewal=Promise.resolve(),lost=null;
+  const timer=setInterval(()=>{
+    renewal=renewal.then(async()=>{
+      if(lost)return;
+      const next=Date.now()+leaseMs;
+      const renewed=await env.DB.prepare('UPDATE stripe_intake SET lease=?3 WHERE id=?1 AND lease=?2 AND done IS NULL RETURNING id').bind(id,lease,next).first();
+      if(!renewed)throw new Error('Stripe reconciliation lease was lost');
+      lease=next;
+    }).catch(error=>{lost=error;});
+  },Math.max(1,Math.floor(leaseMs/3)));
+  const check=async()=>{
+    await renewal;
+    if(lost)throw lost;
+    if(Date.now()>=lease)throw new Error('Stripe reconciliation lease expired');
+  };
+  const guarded={...env,DB:guardedDatabase(env.DB,check),[RECONCILE_GUARD]:check};
+  try {
+    await check();
+    const event=JSON.parse(row.payload);
+    if(event.id!==id)throw new Error('Stored Stripe event id differs');
+    const response=await deliver(guarded,row,event,cat);
+    if(!response.ok)throw new Error('Stripe reconciliation needs retry ('+response.status+')');
+    clearInterval(timer);await renewal;
+    if(lost)throw lost;
+    const done=await env.DB.prepare('UPDATE stripe_intake SET done=?2,lease=0 WHERE id=?1 AND lease=?3 AND lease>?2 RETURNING id').bind(id,Date.now(),lease).first();
+    if(!done)throw new Error('Stripe reconciliation lease lost before completion');
+  } catch(error) {
+    clearInterval(timer);await renewal;
+    await env.DB.prepare('UPDATE stripe_intake SET lease=?3 WHERE id=?1 AND lease=?2').bind(id,lease,Date.now()+60000).run();
+    throw error;
+  } finally {clearInterval(timer);}
+}
+export async function stripeIntakeStatus(env) {
+  if(!env.DB)return {pending:0,stuck:0};
+  const row=await env.DB.prepare('SELECT COUNT(*) AS pending,COALESCE(SUM(received<?1),0) AS stuck,MIN(received) AS oldest FROM stripe_intake WHERE done IS NULL').bind(Date.now()-3600000).first();
+  return {...row,message:row?.stuck?'Stripe deliveries are delayed. Check Worker logs and Stripe key permissions; scheduled recovery retries unfinished events.':null};
+}
+export async function sweepStripeEvents(env,cat) {
+  if(!env.DB)return;
+  const rows=(await env.DB.prepare('SELECT id FROM stripe_intake WHERE done IS NULL AND lease<?1 ORDER BY lease,received,id LIMIT 100').bind(Date.now()).all()).results??[];
+  for(const row of rows) {
+    try {await reconcileStripeEvent(env,row.id,cat);}
+    catch(error) {console.error('Stripe intake recovery failed',row.id,error.message);}
+  }
+  const status=await stripeIntakeStatus(env);
+  if(status.stuck)console.error('Stripe intake needs attention',status);
+  return status;
+}
+export async function pruneStripeEvents(env) {
+  const cutoff=Date.now()-60*86400000;
+  await env.DB.batch([
+    ...(env.BACKGROUND?[env.DB.prepare('DELETE FROM stripe_intake WHERE id IN (SELECT id FROM stripe_intake WHERE done<?1 ORDER BY done LIMIT 1000)').bind(cutoff)]:[]),
+    env.DB.prepare('DELETE FROM shop_events WHERE id IN (SELECT id FROM shop_events WHERE at<?1 ORDER BY at LIMIT 1000)').bind(cutoff),
+  ]);
+}

package/worker/stripe.mjs

@@ -1,3 +1,4 @@
+import {RECONCILE_GUARD} from './reconcile-guard.mjs';
 /**
  * THE STUDIO'S OWN STRIPE, from its Worker (@homie-rocks/studio 0.24.0). No SDK: a few form-encoded calls with the
  * studio's key (a Worker secret), and Stripe's documented webhook signature check with WebCrypto.
@@ -95,6 +96,7 @@ export async function productIdOf(slug, item) {
 
 /** One call with the studio's key. `idempotencyKey` makes a retried POST do the work once (Stripe keeps it 24 h). */
 export async function stripeCall(env, method, path, params = null, { idempotencyKey = null, fetcher = fetch, version = STRIPE_VERSION, timeout = 15_000 } = {}) {
+  await env?.[RECONCILE_GUARD]?.();
   const key = String(env?.STRIPE_KEY ?? '');
   if (!KEY_SHAPE.test(key)) throw new StripeError(0, { error: { message: 'no Stripe key on this Worker', code: 'no-key' } });
   const body = params && method !== 'GET' ? formEncode(params).toString() : null;
@@ -119,6 +121,7 @@ export async function stripeCall(env, method, path, params = null, { idempotency
     error.idempotentReplayed = res.headers.get('idempotent-replayed') === 'true';
     throw error;
   }
+  await env?.[RECONCILE_GUARD]?.();
   return json;
 }