@homie-rocks/studio 0.58.23 → 0.58.24

package/CHANGELOG.md

@@ -17,6 +17,16 @@ To bring a studio up to date, tell Claude: "Upgrade my studio to the newest Homi
 `npx -y @homie-rocks/studio@latest upgrade`, which shows what's new since the version your studio pins (from this
 file) and what the upgrade would change, and changes nothing until you agree.
 
+## [0.58.24] - 2026-10-29
+
+**Plugin 0.58.15**
+
+A studio Homie approved for test payments takes booking payments in Stripe TEST mode.
+
+### Added
+
+- Booking checkout (`studio_checkout`, Venue desk `venue_booking_confirm`) opens a Stripe TEST Checkout page on Homie's sandbox account when the studio's `HOMIE_PAYMENTS` binding says test payments are open (the owner asks Talk to Homie, the Homie Team approves). Paying with a Stripe test card confirms the booking. Every other studio's booking checkout stays `closed`; no real money moves.
+
 ## [0.58.23] - 2026-10-29
 
 **Plugin 0.58.15**

package/lib/template-history.json

@@ -4950,6 +4950,48 @@
      }
     }
    }
+  },
+  "0.58.24": {
+   "files": {
+    "CLAUDE.md": "ddf2b2a0376202f6",
+    "README.md": "684b3cca8001673c",
+    "HANDOFF.md": "29337e2ace95b2e7",
+    "games/README.md": "5ad32fe80c61f117",
+    "music/README.md": "a3dc042dadd39df8",
+    "videos/README.md": "16babc3437d5545b",
+    "posts/README.md": "37841aae476bd540",
+    "site/README.md": "1dbdf22c03a1e505",
+    "site/src/worker.mjs": "6cc5c6131eaf6fd0"
+   },
+   "sections": {
+    "AGENTS.md": {
+     "(intro)": "af7f2f732505d379",
+     "## Version-matched authoring guides": "f6261a0e5801b96b",
+     "## Layout": "f3a280b8c96cd068",
+     "## Apps: one screen, roles and parts": "2ecf713305fd26f5",
+     "## Commands (all through the pinned CLI in node_modules)": "661cbdf5d6a9dbae",
+     "## The site": "0cb8dd9a6f8a0096",
+     "## Making games": "644c1e7608bb9740",
+     "## The Game Codex and progress": "0738ef719cef3a4c",
+     "## Art direction and models": "a48fff7bf0a5f2fc",
+     "## Running live games (the back office)": "51ebf2ab756f6e4d",
+     "## Servers and AI seats": "1904f45b599a33e4",
+     "## Selling things (the shop)": "e5bd380cb77f2b11",
+     "## Continuing a build from the Claude app": "0d68081e924ca419",
+     "## Rules": "b2234d80f6cbe71d",
+     "## Telling Homie": "80b46fdd9e578db8",
+     "## Beta": "9d02638207a26e73"
+    }
+   },
+   "named": {
+    "Homie Arcade": {
+     "sections": {
+      "AGENTS.md": {
+       "## Commands (all through the pinned CLI in node_modules)": "0a7b2c36414a29a0"
+      }
+     }
+    }
+   }
   }
  }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homie-rocks/studio",
-  "version": "0.58.23",
+  "version": "0.58.24",
   "description": "Open-source tools that let your AI build and run a multiplayer game studio on its own Cloudflare: an MCP server, multiplayer starters, Workers and Durable Objects.",
   "type": "module",
   "license": "Apache-2.0",

package/worker/booking-holds.mjs

@@ -3,6 +3,7 @@ import {loadAndAllocateResources} from './booking-resources.mjs';
 import {normalizeBookingArgs} from './booking-options.mjs';
 import {BOOKINGS_MIGRATION} from './booking-store.mjs';
 import {linkConfig,hasStripeKey} from './shop-links.mjs';
+import {syncProviderOrder} from './booking-provider.mjs';
 export const BOOKING_HOLDS_MIGRATION_FILE='0029_booking_holds.sql';
 export const BOOKING_HOLDS_MIGRATION=`
 ALTER TABLE shop_bookings ADD COLUMN paid_at INTEGER;
@@ -62,7 +63,7 @@ export function bookingHolds(env,caller,cat){
   const changed=await env.DB.prepare(`UPDATE shop_bookings SET state=?2,version=version+1,updated_at=?3 WHERE id=?1 AND version=?4 AND state IN ('held','confirmed') AND (?2='released' OR hold_until>?3) RETURNING *`).bind(row.id,state,Date.now(),args.version).first();
   if(!changed)throw refusal('Booking changed or expired; reload',409,'hold_changed_or_expired');return result(changed);
  };
- return Object.freeze({
+ const holds=Object.freeze({
   calendar({app,...options}){const meta=cat.games.find(g=>g.id===app&&g.kind==='app');if(!meta)throw refusal('Unknown app');return calendarSlots({timeZone:meta.timeZone,...options});},
   async hold(input){
    const args=normalizeBookingArgs(input);
@@ -107,9 +108,18 @@ export function bookingHolds(env,caller,cat){
    if(token!==undefined&&!(typeof token==='string'&&/^[a-f0-9]{32,128}$/.test(token)))throw refusal('Invalid private booking token',400,'invalid_token');
    if(!token&&!caller.id)throw refusal('Pass the private token you gave studio_book',400,'token_required');
    const rows=(await env.DB.prepare(`SELECT * FROM shop_bookings WHERE (${token?'token_hash=?1':'actor=?1'}) AND (?2 IS NULL OR app=?2 OR app LIKE ?2||':check:%') AND (?3=0 OR (state='confirmed' OR state='held' AND hold_until>?4)) ORDER BY updated_at DESC LIMIT 50`).bind(token?await hash(token):caller.id,app??null,active?1:0,Date.now()).all()).results??[];
-   return rows.filter(r=>!caller.testScope||r.app.endsWith(':check:'+caller.testScope)).map(result);
+   const own=rows.filter(r=>!caller.testScope||r.app.endsWith(':check:'+caller.testScope));
+   let synced=false;
+   for(const r of own.filter(r=>r.state==='held'&&typeof r.order_id==='string'&&r.order_id.startsWith('ord_')).slice(0,3))synced=await syncProviderOrder(env,cat,r.order_id)||synced;
+   if(synced)return holds.mine({token,app,active});
+   return own.map(result);
+  },
+  async get(args){
+   let row=await ownedHold(env,caller,args);
+   // A booking paid through the host's checkout provider is recorded when its owner next looks (booking-provider.mjs).
+   if(row.state==='held'&&typeof row.order_id==='string'&&row.order_id.startsWith('ord_')&&await syncProviderOrder(env,cat,row.order_id))row=await ownedHold(env,caller,args);
+   return result(row);
   },
-  async get(args){return result(await ownedHold(env,caller,args));},
   confirm:args=>change(args,'confirmed'),release:args=>change(args,'released'),
   async releaseExpired({app,collection,now=Date.now()}){
    if(!caller.owner)throw refusal('Owner or scheduled function required');
@@ -118,6 +128,7 @@ export function bookingHolds(env,caller,cat){
    const r=await env.DB.prepare("UPDATE shop_bookings SET state='released',version=version+1,updated_at=?3 WHERE app=?1 AND collection=?2 AND order_id='hold:'||id AND state='held' AND hold_until<=?3").bind(scope,collection,now).run();return {released:r.meta.changes};
   }
  });
+ return holds;
 }
 /** Used in the same transaction as the order reservation. A second checkout cannot claim the hold. */
 export function claimHoldStatement(env,{hold,app,collection,slots,slot,quantity,order,now=Date.now()}){

package/worker/booking-provider.mjs

@@ -0,0 +1,54 @@
+import { hasStripeKey } from './shop-links.mjs';
+/**
+ * A HOSTED BOOKING CHECKOUT PROVIDER (0.58.24). A host may bind HOMIE_PAYMENTS, a service that opens Stripe Checkout
+ * for a studio's bookings on the host's own Stripe account (Homie's managed hosting does, in Stripe test mode, for
+ * studios its operator approved). With no such binding, or with the studio's own STRIPE_KEY, nothing here changes
+ * anything: the studio's own Stripe and Payment Links paths run as before. Every call fails closed: a missing method,
+ * a thrown call or any answer but `true` means the provider is not open.
+ *
+ * Provider contract (all plain JSON):
+ *   bookingCheckoutOpen() -> true when this studio may open a booking checkout now
+ *   bookingCheckout(params) -> { id: 'cs_…', url: 'https://…', expires_at, livemode } from the toolkit's own
+ *                              Checkout Session params (sessionParams)
+ *   bookingSession(id) -> the Checkout Session (Stripe's shape, payment_intent expanded) or null
+ */
+const META = (order) => `booking-provider:${order}`;
+
+export async function providerOpen(env) {
+  if (!env?.HOMIE_PAYMENTS || hasStripeKey(env)) return false;
+  try { return (await env.HOMIE_PAYMENTS.bookingCheckoutOpen()) === true; } catch { return false; }
+}
+
+/** Opens the session through the provider and remembers that this order belongs to it. */
+export async function providerCheckout(env, orderId, params) {
+  const session = await env.HOMIE_PAYMENTS.bookingCheckout(JSON.parse(JSON.stringify(params)));
+  if (session?.state === 'rejected') throw Object.assign(new Error('The checkout is not open for this studio'), { code: 'closed' });
+  if (typeof session?.id !== 'string' || !/^cs_(test|live)_[A-Za-z0-9]+$/.test(session.id)) throw new Error('The payment provider answered without a session');
+  await env.DB.prepare('INSERT OR REPLACE INTO meta(key,value) VALUES(?1,?2)').bind(META(orderId), JSON.stringify({ session: session.id, livemode: session.livemode === true })).run();
+  return session;
+}
+
+/**
+ * Asks the provider whether one booking order was paid, and records it with the shop's own `paid` checks (order,
+ * buyer, currency, amount and tax must match). True when the order changed.
+ */
+export async function syncProviderOrder(env, cat, orderId) {
+  if (typeof orderId !== 'string' || !/^ord_[A-Za-z0-9]{8,64}$/.test(orderId) || !env?.HOMIE_PAYMENTS || !env.DB) return false;
+  try {
+    const meta = await env.DB.prepare('SELECT value FROM meta WHERE key=?1').bind(META(orderId)).first();
+    if (!meta) return false;
+    const saved = JSON.parse(meta.value);
+    const order = await env.DB.prepare('SELECT id,session,status,mode FROM shop_orders WHERE id=?1').bind(orderId).first();
+    if (!order || order.session !== saved.session || !['started', 'processing'].includes(order.status)) return false;
+    const session = await env.HOMIE_PAYMENTS.bookingSession(order.session);
+    if (!session || session.id !== order.session || session.livemode !== (order.mode === 'live') || session.metadata?.order !== orderId) return false;
+    if (session.status !== 'complete' || !['paid', 'no_payment_required'].includes(session.payment_status)) return false;
+    const { paid, shopOf } = await import('./shop.mjs');
+    const at = (session.payment_intent?.latest_charge?.created ?? session.payment_intent?.created ?? session.created ?? Math.floor(Date.now() / 1000)) * 1000;
+    const outcome = await paid(env, shopOf(cat), session, at);
+    return outcome !== 'mismatch' && outcome !== 'unknown-order';
+  } catch (error) {
+    console.warn('Booking provider sync', { order: orderId, reason: String(error?.message ?? error).slice(0, 200) });
+    return false;
+  }
+}

package/worker/build-id.mjs

@@ -1,2 +1,2 @@
 // Generated by lib/build-identity.mjs; identifies the bundled runtime sources.
-export const STUDIO_BUILD = Object.freeze({"version":"0.58.23","sha256":"d976ca461d623e45165982deaebc53e1bda766a4ccf398701f724ca80aa46d9f"});
+export const STUDIO_BUILD = Object.freeze({"version":"0.58.24","sha256":"e554d72f5dbf3c334bc37e6867fc1e92465a3648996ddc0fd497d4f7c014e601"});

package/worker/shop.mjs

@@ -6,6 +6,7 @@ import { bindSubscription, subscriptionEvent, subscriptionPortal } from './shop-
 import { bookingStatement } from './booking-store.mjs';
 import { paymentRefunds } from './shop-refunds.mjs';
 import { selling } from './extensions.mjs';
+import { providerOpen, providerCheckout } from './booking-provider.mjs';
 /**
  * THE SHOP (@homie-rocks/studio 0.24.0): a studio sells with ITS OWN Stripe account (shop/SHOP.md is the guide).
  * The studio is the seller; homie.rocks never sees, holds or moves its money, and Homie takes no cut.
@@ -514,9 +515,10 @@ export async function reconcileOrders(env, shop, player = null, { expireOpen = f
 }
 
 /** Make the order row, then Stripe's Checkout Session. Returns { order, url } or a refusal Response. */
-async function startCheckout(env, url, cat, shop, item, { player, game, amount, parent = false, lines = null, reference = null, booking = null, requestAt = Date.now() }) {
+async function startCheckout(env, url, cat, shop, item, { player, game, amount, parent = false, lines = null, reference = null, booking = null, requestAt = Date.now(), provider = false }) {
   lines ??= [{ item, amount, quantity: 1 }];
-  const keyless = (amount > 0 || lines.some(l => l.item.interval)) && !hasStripeKey(env);
+  if (provider && (!booking || lines.some(l => l.item.interval))) provider = false;
+  const keyless = (amount > 0 || lines.some(l => l.item.interval)) && !hasStripeKey(env) && !provider;
   const config=linkConfig(env);
   if(booking?.hold&&keyless)return {error:fail(409,'booking','A held slot needs session checkout; keyless payment links cannot claim it.')};
   if(booking && amount===0 && !hasStripeKey(env) && config?.slots?.some(l=>l.app===game&&l.slots===booking.slots&&l.slot===booking.slot))return {error:fail(409,'booking','Publish a separate local slot for a free booking; it cannot share a paid Stripe capacity budget.')};
@@ -595,9 +597,9 @@ async function startCheckout(env, url, cat, shop, item, { player, game, amount,
     try {
       const checkoutParams = params();
       if (booking) await env.DB.prepare('INSERT INTO meta(key,value) VALUES(?1,?2)').bind(`booking-checkout:${order.id}`, JSON.stringify(checkoutParams)).run();
-      session = await createCheckoutSession(env, checkoutParams, { idempotencyKey: `checkout-${order.id}` });
+      session = provider ? await providerCheckout(env, order.id, checkoutParams) : await createCheckoutSession(env, checkoutParams, { idempotencyKey: `checkout-${order.id}` });
     } catch (error) {
-      if (!useCatalog || !isMissingProduct(error)) throw error;
+      if (provider || !useCatalog || !isMissingProduct(error)) throw error;
       for (const line of lines) line.product = null;
       session = await createCheckoutSession(env, params(), { idempotencyKey: `checkout-${order.id}-inline` });
     }
@@ -634,7 +636,9 @@ async function buyRoute(request, env, url, cat, shop, ready, ctx, requestAt) {
   const reference = b.body.reference ?? null;
   if (reference !== null && (typeof reference !== 'string' || !reference.trim() || /[\u0000-\u001f\u007f]/.test(reference))) return fail(400, 'reference', 'reference must be a nonempty string without control characters');
   const freeOnly = (b.body.lines ?? [{ item: b.body.item }]).every?.((l) => shop.items.some((i) => i.id === l?.item && i.price === 0 && !i.interval));
-  if (!ready.ready && !(freeOnly && ready.missing.every((m) => ['payment-links', 'webhook-secret', 'fuller-checkout'].includes(m)))) return fail(503, 'closed', 'The shop is not open yet.', { missing: ready.missing, next: ready.next, migration: ready.migration });
+  // A host's booking checkout provider (booking-provider.mjs) takes the place of the studio's own Stripe setup, for bookings only.
+  const provider = b.body.booking !== undefined && !ready.ready && ready.missing.every((m) => ['payment-links', 'webhook-secret', 'fuller-checkout', 'stripe-key'].includes(m)) && await providerOpen(env);
+  if (!ready.ready && !provider && !(freeOnly && ready.missing.every((m) => ['payment-links', 'webhook-secret', 'fuller-checkout'].includes(m)))) return fail(503, 'closed', 'The shop is not open yet.', { missing: ready.missing, next: ready.next, migration: ready.migration });
   const requested = b.body.lines ?? [{ item: b.body.item, quantity: b.body.quantity ?? 1, amount: b.body.amount }];
   // Stripe's documented limit, not a studio policy: https://docs.stripe.com/api/checkout/sessions/create#line_items
   if (!Array.isArray(requested) || !requested.length || requested.length > 100) return fail(400, 'stripe-lines', 'Stripe Checkout takes between 1 and 100 lines.');
@@ -694,7 +698,7 @@ async function buyRoute(request, env, url, cat, shop, ready, ctx, requestAt) {
       }catch{return fail(403,'booking','Booking owner required');}
     }
   }
-  const r = await startCheckout(env, url, cat, shop, item, { player, game, amount, lines, reference, booking, requestAt });
+  const r = await startCheckout(env, url, cat, shop, item, { player, game, amount, lines, reference, booking, requestAt, provider: provider && !!booking });
   const response = r.error ?? json({ ok: true, order: r.order.id, url: r.url, ...(booking ? { booking: booking.hold??r.order.id } : {}) });
   if (!r.error && !r.reconciled && ctx?.waitUntil) ctx.waitUntil(reconcileOrders(env, shop, player.id).catch((error) => logOrderError(env, r.order.id, error)));
   for (const cookie of cookies) response.headers.append('set-cookie', cookie);

package/worker/version.mjs

@@ -1,2 +1,2 @@
 /** The @homie-rocks/studio version this Worker code is (package.json's; a test keeps them equal). Cache-busts /_homie/site.js. */
-export const STUDIO_VERSION_TAG = '0.58.23';
+export const STUDIO_VERSION_TAG = '0.58.24';