@vibes.diy/prompts 14.3.191 → 14.3.193

package/llms/access.md

@@ -30,7 +30,7 @@ writes.
 
 **UserContext:** `{ userHandle: string, displayName?: string, backend?: "scheduled" | "onChange" | "fetch" }` — `userHandle` is stable unique id (use for all auth checks), `displayName` is display only (never use for identity checks), and `backend` is present only when the app's own `backend.js` issued this write, naming the handler that did (`scheduled`, `onChange` or `fetch`). Every write from a browser or the CLI arrives with `backend` absent, the app owner's own writes included — it says where a write came from, never who the writer is. Gate on `ctx.requireBackend(...)` rather than throwing on `user.backend` yourself: a bare `throw` on `user.backend` refuses the hand-repair lane admin mode exists for, and returns no descriptor for the write it refused.
 
-**Helpers (`ctx`):** Opaque closures over the materialized grant state. They throw or pass — you cannot enumerate channels, list members, or iterate grants. They also throw when `user` is null: `ctx.requireAccess(channelId)` throws if user is not in the channel, `ctx.requireRole(roleName)` throws if user is not in the role, and `ctx.requireBackend()` throws unless the app's own `backend.js` issued this write — `ctx.requireBackend("scheduled")` narrows that to one handler. All three no-op under admin mode.
+**Helpers (`ctx`):** Opaque closures over the materialized grant state. They throw or pass — you cannot enumerate channels, list members, or iterate grants. They also throw when `user` is null: `ctx.requireAccess(channelId)` throws if user is not in the channel, `ctx.requireRole(roleName)` throws if user is not in the role, and `ctx.requireBackend()` throws unless the app's own `backend.js` issued this write — `ctx.requireBackend("scheduled")` narrows that to one handler. `ctx.requireBackend` reads the write's origin, not its writer, so it also passes when nobody is signed in (a guest calling your `fetch` handler, or an `onChange` run a signed-out write triggered), while `user` stays null and the write still needs `allowAnonymous: true`. All three no-op under admin mode.
 
 Express every refusal about **who may act** through the supplied validators — `ctx.requireAccess`, `ctx.requireRole`, `ctx.requireBackend` — so that admin mode passes them and the function still runs, applying your own channels and grants to the repaired document; a refusal about the document's own **shape**, like an unknown type or a missing field, stays a plain `throw` and is right to, while a write-once check sits in between and is worth naming in a comment, since a schema repair has to get past it.
 

package/llms/backend.md

@@ -85,6 +85,15 @@ escalation. For documents only the server should control, use `scheduled` and
 gate them on the origin with `ctx.requireBackend("scheduled")`, which admits the
 run and turns every ordinary client write away.
 
+The origin travels with the write even when nobody is signed in, for every
+handler. A guest's `apiFetch` into the `fetch` handler arrives with `user` null,
+and `ctx.requireBackend("fetch")` still passes for it, so a guest-checkout
+record can be one only the handler writes; an `onChange` run triggered by a
+signed-out writer passes `ctx.requireBackend("onChange")` the same way. The function still opts that anonymous
+write in with `allowAnonymous: true`, and the app's anonymous-write setting
+still has to admit signed-out writers; `user.backend` itself is read only off a
+signed-in user, so gate with `ctx.requireBackend`.
+
 `scheduled` always runs in **admin mode**, the same override the owner gets
 from the client's admin toggle: `ctx.requireAccess(...)`, `ctx.requireRole(...)`
 and `ctx.requireBackend(...)` all no-op, and its `ctx.db.query` reads are

package/llms/cues.js.map

@@ -1 +1 @@
-{"version":3,"file":"cues.js","sourceRoot":"","sources":["../../jsr/llms/cues.ts"],"names":[],"mappings":"AAIA,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAGD,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,GAAW;IAClD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,OAAO,IAAI,MAAM,CAAC,gBAAgB,IAAI,cAAc,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxE,CAAC;AASD,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,OAAmC;IAChF,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACvG,CAAC"}
+{"version":3,"file":"cues.js","sourceRoot":"","sources":["../../jsr/llms/cues.ts"],"names":[],"mappings":"AAKA,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAGD,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,GAAW;IAClD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,OAAO,IAAI,MAAM,CAAC,gBAAgB,IAAI,cAAc,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxE,CAAC;AASD,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,OAAmC;IAChF,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACvG,CAAC"}

package/llms/custom-look.js

@@ -17,9 +17,10 @@ export const customLookConfig = {
         "shadcn",
         "neo-brutalist",
         "neobrutalism",
-        "gumroad",
+        "like gumroad",
         "terminal style",
-        "newspaper",
+        "like a newspaper",
+        "newspaper style",
         "linear style",
         "like linear",
         "ios settings",

package/llms/custom-look.js.map

@@ -1 +1 @@
-{"version":3,"file":"custom-look.js","sourceRoot":"","sources":["../../jsr/llms/custom-look.ts"],"names":[],"mappings":"AAWA,MAAM,CAAC,MAAM,gBAAgB,GAAc;IACzC,IAAI,EAAE,aAAa;IACnB,KAAK,EAAE,aAAa;IACpB,WAAW,EACT,gXAAgX;IAClX,IAAI,EAAE;QACJ,aAAa;QACb,iBAAiB;QACjB,eAAe;QACf,eAAe;QACf,cAAc;QACd,aAAa;QACb,YAAY;QACZ,UAAU;QACV,iBAAiB;QACjB,YAAY;QACZ,cAAc;QACd,QAAQ;QACR,eAAe;QACf,cAAc;QACd,SAAS;QACT,gBAAgB;QAChB,WAAW;QACX,cAAc;QACd,aAAa;QACb,cAAc;KACf;CACF,CAAC"}
+{"version":3,"file":"custom-look.js","sourceRoot":"","sources":["../../jsr/llms/custom-look.ts"],"names":[],"mappings":"AAeA,MAAM,CAAC,MAAM,gBAAgB,GAAc;IACzC,IAAI,EAAE,aAAa;IACnB,KAAK,EAAE,aAAa;IACpB,WAAW,EACT,gXAAgX;IAClX,IAAI,EAAE;QACJ,aAAa;QACb,iBAAiB;QACjB,eAAe;QACf,eAAe;QACf,cAAc;QACd,aAAa;QACb,YAAY;QACZ,UAAU;QACV,iBAAiB;QACjB,YAAY;QACZ,cAAc;QACd,QAAQ;QACR,eAAe;QACf,cAAc;QACd,cAAc;QACd,gBAAgB;QAChB,kBAAkB;QAClB,iBAAiB;QACjB,cAAc;QACd,aAAa;QACb,cAAc;KACf;CACF,CAAC"}

package/llms/stripe-subscriptions.md

@@ -51,8 +51,7 @@ a link to the exact page and uses the words that page uses:
    or change a card, and the portal exists once it is saved.
 3. Come back to the app. The Join buttons work in test mode the moment both
    items are done; the card `4242 4242 4242 4242` with any future date pays.
-4. Go live, one app at a time. Once a test payment goes through and live
-   payments are open on vibes.diy, press **Go live with Stripe** under
+4. Go live, one app at a time. Once a test payment goes through, press **Go live with Stripe** under
    **Payments** on the Settings tab and finish Stripe's live setup (once, for
    every app). Then press **Take live payments in this app** on this app's
    Setup screen, and save the **Customer portal** once more in live mode at

package/llms/stripe.js

@@ -1,7 +1,7 @@
 export const stripeConfig = {
     name: "stripe",
     label: "Stripe payments",
-    description: "Taking real money through Stripe Checkout: load it whenever the person asks for money to move — anyone pays, tips, donates or buys, a charge, a deposit, dues, tickets, a checkout, or the word Stripe — one-time charges into the owner's own Stripe account through ctx.stripe, connected once with Connect Stripe (a monthly or yearly subscription is the stripe-subscriptions skill): the Connect Stripe setup item read from ctx.stripe.status(), test mode first with the order's mode passed on every call and live once the owner takes this app live, every Stripe call in backend.js with no Stripe.js in the page, one pending order then one Checkout Session opened in a new tab, an order marked paid only after the backend reads the session back from Stripe and matches it to the order, integer amounts in cents, and a scheduled sweep that settles orders whose buyer never came back. A storefront, plans page or booking page that only records orders takes no payment and does not need this; offer it as the [pay] option instead",
+    description: "Taking real money through Stripe Checkout: load it whenever the person asks for money to move — pay the bill, split the check, a restaurant check, pay at the table or at the counter, a tip or a tip jar, donate or a donation page, sell tickets, a charge, a deposit, dues, a checkout, pay with Stripe, or the word Stripe — one-time charges into the owner's own Stripe account through ctx.stripe, connected once with Connect Stripe (a monthly or yearly subscription is the stripe-subscriptions skill): guest checkout by default for paying a venue (a check, a tip, a donation — no sign-in, the payment keyed to the thing paid and its session, written by backend.js for the guest) and a signed-in order where the record is the buyer's to keep (dues on a roster, my orders), one payer paying the whole check by default with splitting as a second choice and the balance reserved with a revision-checked write before any session opens, the Connect Stripe setup item read from ctx.stripe.status(), test mode first with the order's mode passed on every call and live once the owner takes this app live, every Stripe call in backend.js with no Stripe.js in the page, one pending order then one Checkout Session opened in a new tab, an order marked paid only after the backend reads the session back from Stripe and matches it to the order, integer amounts in cents, and a scheduled sweep that settles orders whose buyer never came back. A storefront, plans page or booking page that only records orders takes no payment and does not need this; offer it as the [pay] option instead",
     cues: [
         "stripe",
         "take payments",
@@ -16,6 +16,16 @@ export const stripeConfig = {
         "sell tickets",
         "charge",
         "paywall",
+        "pay the bill",
+        "split the check",
+        "restaurant check",
+        "pay at the table",
+        "pay at the counter",
+        "tip jar",
+        "donate",
+        "donation",
+        "donations",
+        "pay with stripe",
     ],
 };
 //# sourceMappingURL=stripe.js.map

package/llms/stripe.js.map

@@ -1 +1 @@
-{"version":3,"file":"stripe.js","sourceRoot":"","sources":["../../jsr/llms/stripe.ts"],"names":[],"mappings":"AAWA,MAAM,CAAC,MAAM,YAAY,GAAc;IACrC,IAAI,EAAE,QAAQ;IACd,KAAK,EAAE,iBAAiB;IACxB,WAAW,EACT,8/BAA8/B;IAChgC,IAAI,EAAE;QACJ,QAAQ;QACR,eAAe;QACf,cAAc;QACd,iBAAiB;QACjB,eAAe;QACf,cAAc;QACd,aAAa;QACb,UAAU;QACV,SAAS;QACT,MAAM;QACN,cAAc;QACd,QAAQ;QACR,SAAS;KACV;CACF,CAAC"}
+{"version":3,"file":"stripe.js","sourceRoot":"","sources":["../../jsr/llms/stripe.ts"],"names":[],"mappings":"AAWA,MAAM,CAAC,MAAM,YAAY,GAAc;IACrC,IAAI,EAAE,QAAQ;IACd,KAAK,EAAE,iBAAiB;IACxB,WAAW,EACT,miDAAmiD;IACriD,IAAI,EAAE;QACJ,QAAQ;QACR,eAAe;QACf,cAAc;QACd,iBAAiB;QACjB,eAAe;QACf,cAAc;QACd,aAAa;QACb,UAAU;QACV,SAAS;QACT,MAAM;QACN,cAAc;QACd,QAAQ;QACR,SAAS;QACT,cAAc;QACd,iBAAiB;QACjB,kBAAkB;QAClB,kBAAkB;QAClB,oBAAoB;QACpB,SAAS;QACT,QAAQ;QACR,UAAU;QACV,WAAW;QACX,iBAAiB;KAClB;CACF,CAAC"}

package/llms/stripe.md

@@ -1,7 +1,8 @@
 # Stripe payments — take real money into the owner's own Stripe account
 
-When someone asks to **take money** — charge for a booking, collect dues, sell
-tickets, take a deposit, sell a download — build it on **Stripe
+When someone asks to **take money** — pay the bill at a table, split the check,
+take tips or donations, charge for a booking, collect dues, sell tickets, take
+a deposit, sell a download — build it on **Stripe
 Checkout** from `backend.js`, through `ctx.stripe` — the owner connects their
 Stripe account once with **Connect Stripe**, and the platform holds the
 credential. This is a `backend.js` feature (see the backend docs for the
@@ -16,8 +17,9 @@ that way until the person asks to charge for them. What you may do unasked is
 **offer** it: on an app that sells, books, collects dues or sells tickets, the
 closing row's capability option is `▸ [pay] Take card payments with Stripe`,
 gold when nothing else fits better, and a tap on it is the ask. Words that are
-the ask: "charge", "pay", "paid", "payment", "deposit", "dues", "tickets",
-"sell", "checkout", "Stripe". Words that are not: "orders",
+the ask: "charge", "pay", "paid", "payment", "pay the bill", "split the check",
+"tip", "donate", "deposit", "dues", "tickets", "sell", "checkout", "Stripe".
+Words that are not: "orders",
 "price", "plans", "cart" — those describe records, not money moving.
 
 **One-time charges only.** This recipe takes a payment and records that it
@@ -31,12 +33,30 @@ a monthly club — is the `stripe-subscriptions` skill, which mirrors Stripe's
 subscription state into the app and takes the person's cancellations and failed
 renewals into account.
 
-**The money is the owner's, and so is the account.** Every buyer pays the same
-Stripe account, the one the owner connected; the app is a merchant's page,
-and a buyer is a signed-in person whose order is a record between them and the
-merchant. An app where *each visitor* collects money into *their own* Stripe
-account is a marketplace, a bigger thing than this recipe — say so plainly and
-build the one-merchant half.
+**The money is the owner's, and so is the account.** Every payer pays the same
+Stripe account, the one the owner connected; the app is a merchant's page. An
+app where *each visitor* collects money into *their own* Stripe account is a
+marketplace, a bigger thing than this recipe — say so plainly and build the
+one-merchant half.
+
+**Who pays: a guest, unless the record is theirs to keep.**
+
+A payment to a venue is guest checkout: the payer needs no Vibes DIY account, the payment record is keyed to the thing being paid and its Checkout Session, and backend.js writes it on the guest's behalf.
+
+A restaurant check, a split-the-check page, a tip jar, a donation page, a
+pay-at-the-counter page, event tickets bought on the spot — the payer is a
+guest at the owner's place, and Stripe's own page asks for their email and
+sends the receipt. Security rests on Stripe, not on a sign-in: the backend
+reads every session back from Stripe before anything counts as paid.
+*Guest checkout at a venue* at the end of this page is that recipe, with a
+table's check as the worked example.
+
+Sign-in is the shape when the record belongs to a person over time: a member's
+dues on the roster, a booking under their name, a "my orders" or "my tickets"
+page they come back to, and every subscription (the `stripe-subscriptions`
+skill). Then the order carries the buyer's handle, and *Complete backend.js*
+below is that recipe, with club dues as the worked example. Sections 1 to 6
+hold for both.
 
 ## 1. The setup item: Connect Stripe
 
@@ -59,8 +79,7 @@ a link to the exact page and uses the words that page uses:
 2. Come back to the app. The Pay buttons work in test mode the moment Stripe
    says the account is ready, with no redeploy; the card
    `4242 4242 4242 4242` with any future date pays.
-3. Go live, one app at a time. Once a test payment goes through and live
-   payments are open on vibes.diy, press **Go live with Stripe** under
+3. Go live, one app at a time. Once a test payment goes through, press **Go live with Stripe** under
    **Payments** on the Settings tab and finish Stripe's live setup (once, for
    every app). Then press **Take live payments in this app** on this app's
    Setup screen. This step stays on the Setup screen after the item is done,
@@ -161,11 +180,13 @@ start two purchases.
 
 ## 3. One order, then one Checkout Session
 
-The order exists before the money moves. The `/checkout` route runs as the
-signed-in buyer (the page calls it with `apiFetch`, so `ctx.userInfo` is set),
-writes an `order` document in `pending` with the buyer's handle, the title, the
-amount and the mode it is made in, and only then asks Stripe for a session for
-exactly that order:
+The order exists before the money moves. In the signed-in recipe the
+`/checkout` route runs as the signed-in buyer (the page calls it with
+`apiFetch`, so `ctx.userInfo` is set), writes an `order` document in `pending`
+with the buyer's handle, the title, the amount and the mode it is made in, and
+only then asks Stripe for a session for exactly that order. A guest's payment
+goes the same way once it has reserved its share of the check (*Guest
+checkout at a venue*).
 
 Every order records the mode it was made in, and every ctx.stripe.fetch call for that order passes the order's own mode.
 
@@ -195,8 +216,10 @@ Every order records the mode it was made in, and every ctx.stripe.fetch call for
 
 The routes read the `orders` database, which `access.js` binds, so `backend.js`
 declares `config.fetch.unfilteredReads` for it — the obligation that comes
-with it is yours: every route checks `order.buyerHandle` against the caller
-before it returns or settles anything, and no route lists orders for anyone.
+with it is yours: in the signed-in recipe every route checks
+`order.buyerHandle` against the caller before it returns or settles anything,
+on a guest page every route answers only about the check and the payment the
+request names, and no route lists orders for anyone.
 The owner's view of every order is the page's own live query, which the
 access function's `orders` channel already scopes to the owner role.
 
@@ -262,9 +285,12 @@ reading Stripe. A buyer never edits an order; they make a new one.
 
 ## 5. What the buyer and the owner each see
 
-- A buyer sees their own orders and each one's state — *pending* with a
-  "Finish paying" link that reuses the session URL while it is open, *paid*
-  with the date, *expired* with a fresh "Pay" button that makes a new order.
+- A signed-in buyer sees their own orders and each one's state — *pending*
+  with a "Finish paying" link that reuses the session URL while it is open,
+  *paid* with the date, *expired* with a fresh "Pay" button that makes a new
+  order. A guest sees the thing they paid toward: the table's check moving to
+  *Paid in full*, the tip jar's total rising, and a thank-you the moment they
+  come back from Stripe.
 - The owner sees every order: who, what, how much, when, and a total of what
   has been paid. This is the app's own ledger; it is also in the Stripe
   dashboard, and the two agree because the app only ever copies Stripe's
@@ -288,6 +314,9 @@ and hand the reason to the page, which reads it as *Checkout is not open yet*.
 
 ## Complete backend.js
 
+The signed-in recipe, with a club's dues as the example: the order carries the
+buyer's handle because the roster reads it for the rest of the year.
+
 ### `backend.js`
 ```js app=stripe-dues
 // Stripe Checkout for one merchant: the owner's connected Stripe account, hosted Checkout,
@@ -723,3 +752,768 @@ per item in `PRICES` and one `pay(kind)` per button. Something that recurs is a
 new order each period — next year's dues are next year's `pay("dues")` — and a
 true subscription, where Stripe renews and retries on its own, is the
 `stripe-subscriptions` skill.
+
+## Guest checkout at a venue: a table's check
+
+A restaurant check is the fullest venue page; a tip jar, a donation page or a
+pay-at-the-counter page is the same recipe with one line and no splitting.
+Staff open a check with its lines, its link goes on the table as a QR code,
+and anyone at the table opens it and pays, with no account.
+
+A check is paid by one payer by default: one primary button pays the whole remaining balance plus the tip, and splitting is a second choice the table opens.
+
+Below the primary *Pay $X*, a quiet *Split the check* opens the other two
+ways: the lines I had, or an even share of what is left. The page sends
+*what* is paid (`pay: "rest"`, `"lines"` with ids, or `"share"` with how many
+ways) and a tip percentage from its own list; the backend prices it from the
+check.
+
+Every record is written by `backend.js`, guest or not: `access.js` takes a
+payment's creation only from `ctx.requireBackend("fetch")` and its settling
+only from the backend, keeps each type at its own ids, and takes the go-live
+record only from the owner. A page writes nothing but the owner's own checks.
+
+A guest's write through the route is still a signed-out write: `user` is
+null, `ctx.requireBackend("fetch")` passes, the record returns
+`allowAnonymous: true`, and the app's anonymous-write setting has to admit
+it. So the owner's Setup screen carries a *let guests pay* step: publishing
+from the editor turns the setting on, and after a CLI push the owner runs
+`vibes-diy app anon-write <handle>/<slug> on`, with the real handle and slug
+filled in. With it off, `/checkout` answers `guests-closed` and the page
+reads *Checkout is not open yet*.
+
+Before a Checkout Session is created, the payment reserves its share of the check with one revision-checked write.
+
+- **One ledger per check per mode** (`ledger:<mode>:<checkId>`) holds what is
+  paid, which lines are paid, and what each open payment holds. `/checkout`
+  reads it, prices the request against what is free, adds a hold and writes
+  it back with `ifRev`; a second payer who moved in the same instant meets
+  `conflict`, reads again, and finds the balance held — the answer is
+  *someone at the table is paying right now*. So no balance and no line is
+  ever in two open sessions.
+- **The payer pays what they were shown.** The page sends the subtotal it
+  displayed as `quote`; when the check moved in between, the route reserves
+  nothing and answers `quote-changed` with the new amount for the page to
+  show.
+- **An even split is fixed once chosen.** The first share writes the split
+  onto the ledger: N shares of what was free, the rounding cents on the last
+  share. Every later share pays the next open one, so two ways on $100 is $50
+  and $50 however the first one ends.
+- **Settling moves the hold.** `/confirm` reads the session back from Stripe;
+  paid adds the hold to the ledger's paid total and lines, expired gives it
+  back, and the ledger's `settled` map makes a repeat a no-op. A failed
+  session create, a payer back from Stripe without paying (`/release` expires
+  their session) and a second press of Pay (which replaces the payer's own
+  attempt) all give the hold back the same way. A read-back Stripe cannot
+  answer right now changes nothing: the hold stays, and a payer replacing
+  their own attempt hears *try again in a moment*.
+- **The sweep is the safety net**: every minute it settles payments whose
+  payer closed the tab, and anything still pending a day after its
+  `createdAt` is expired whatever its session says, since sessions close
+  after 30 minutes (`expires_at`).
+- The page reads the ledger for its mode with a live query: paid and left
+  move on every phone at once, and *Paid in full* shows at zero.
+
+Stripe's page asks the payer for their email and sends the receipt (the owner
+turns receipts on under customer emails in their Stripe Dashboard); the app
+keeps no email and no name. `submit_type: "pay"` makes Stripe's button read
+*Pay*; a donation page passes `"donate"`.
+
+### `backend.js`
+```js app=table-check
+// A table's check, paid by guests through Stripe Checkout into the owner's connected account.
+// Anyone with the table's link pays; every record is written here, never by a page.
+export const config = {
+  scheduled: { interval: "1m" },
+  // Guests have no account, so the routes read unfiltered; each answers only about the check or
+  // the payment the request names.
+  fetch: { unfilteredReads: { dbs: ["checks"], why: "guests pay a table's check without an account; /checkout, /confirm and /release read only the check, its ledger and the payment the request names" } },
+};
+
+const DB = "checks";
+const SESSION_TTL_MS = 24 * 60 * 60 * 1000;
+const HOLD_SECONDS = 30 * 60; // a Checkout Session closes after 30 minutes
+const TIPS = [0, 15, 18, 20, 25]; // percent of the subtotal
+const LIVE_CHOICE = "setup:live";
+
+function json(body, status = 200) {
+  return new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
+}
+
+function appUrl(ctx, hash) {
+  return `https://vibes.diy/vibe/${ctx.appInfo.ownerHandle}/${ctx.appInfo.appSlug}${hash}`;
+}
+
+async function checkoutMode(ctx) {
+  const choice = await ctx.db.get(LIVE_CHOICE, { db: DB });
+  const mode = choice?.type === "setup" && choice.mode === "live" ? "live" : "test";
+  let st;
+  try {
+    st = await ctx.stripe.status();
+  } catch (e) {
+    ctx.log("warn", "stripe status unavailable", { message: e.message });
+    return { mode, open: false, state: "unavailable", liveOpen: false, liveReady: false };
+  }
+  return { mode, open: st[mode].state === "ready", state: st[mode].state, liveOpen: st.live.available, liveReady: st.live.state === "ready" };
+}
+
+async function stripe(ctx, mode, method, path, form, headers = {}) {
+  let res;
+  try {
+    res = await ctx.stripe.fetch(`/v1${path}`, { method, body: form, headers, mode });
+  } catch (e) {
+    ctx.log("warn", "stripe call refused", { reason: e.reason });
+    return { ok: false, reason: e.reason ?? "not_available" };
+  }
+  const body = await res.json().catch(() => null);
+  if (!res.ok) return { ok: false, reason: "stripe", message: body?.error?.message ?? `HTTP ${res.status}` };
+  return { ok: true, body };
+}
+
+// One ledger per check per mode holds the money: what is paid, which lines are paid, and what
+// each open payment has reserved. Every change is revision-checked, so two payers can never
+// reserve the same balance or the same line.
+const ledgerId = (checkId, mode) => `ledger:${mode}:${checkId}`;
+
+async function changeLedger(ctx, checkId, mode, change) {
+  const id = ledgerId(checkId, mode);
+  for (let attempt = 0; attempt < 5; attempt += 1) {
+    const stored = await ctx.db.get(id, { db: DB });
+    const ledger = stored ?? { _id: id, type: "ledger", checkId, mode, paid: 0, linesPaid: {}, holds: {}, settled: {} };
+    const next = change(structuredClone(ledger));
+    if (!next) return ledger; // nothing to change, or the change was refused
+    try {
+      await ctx.db.put(next, { db: DB, id, ifRev: stored ? stored._rev : null });
+      return next;
+    } catch (err) {
+      if (err.code !== "conflict") throw err; // another payer moved first: read again and retry
+    }
+  }
+  throw new Error("the check is busy");
+}
+
+// The sum a ledger has free to reserve, and the lines nobody has paid or reserved.
+function freeOf(check, ledger) {
+  const total = check.lines.reduce((n, l) => n + l.price, 0);
+  const held = Object.values(ledger.holds);
+  const taken = new Set([...Object.keys(ledger.linesPaid), ...held.flatMap((h) => h.lines)]);
+  return { left: Math.max(0, total - ledger.paid), free: Math.max(0, total - ledger.paid - held.reduce((n, h) => n + h.subtotal, 0)), taken };
+}
+
+// An even split is fixed the first time someone picks it: N shares of what was free, the
+// rounding cents on the last share, so a 2-way split of $100 stays $50 and $50.
+function splitShares(free, ways) {
+  const each = Math.floor(free / ways);
+  return Array.from({ length: ways }, (_, i) => ({ amount: i === ways - 1 ? free - each * (ways - 1) : each, by: null }));
+}
+
+// Settle one pending payment by what Stripe says: paid moves its hold into the ledger's paid
+// total, expired gives the hold back. /confirm, /release and the sweep all come here. A read-back
+// Stripe could not answer keeps the hold until Stripe can, or until the day is out; `giveUp` is a
+// payment whose session Stripe never opened.
+async function settle(ctx, p, giveUp = false) {
+  if (p.status !== "pending") return p;
+  let outcome = null;
+  if (p.sessionId) {
+    const session = await stripe(ctx, p.mode, "GET", `/checkout/sessions/${p.sessionId}`);
+    const s = session.ok ? session.body : null;
+    const matches = s && s.client_reference_id === p._id && s.amount_total === p.amount && s.currency === p.currency;
+    if (s && !matches) ctx.log("warn", "stripe session does not match its payment", { paymentId: p._id });
+    if (matches && s.payment_status === "paid") outcome = "paid";
+    else if (matches && s.status === "expired") outcome = "expired";
+  }
+  // Sessions close after 30 minutes, so a payment still pending a day later is over, whatever it holds.
+  if (outcome === null && (giveUp || Date.now() - p.createdAt > SESSION_TTL_MS)) outcome = "expired";
+  if (outcome === null) return p;
+  await changeLedger(ctx, p.checkId, p.mode, (ledger) => {
+    if (ledger.settled[p._id]) return null; // this payment already counted
+    delete ledger.holds[p.holdId];
+    ledger.settled[p._id] = outcome;
+    const share = ledger.split?.shares[p.share];
+    if (share) share.by = outcome === "paid" ? p._id : null;
+    if (outcome === "paid") {
+      ledger.paid += p.subtotal;
+      for (const id of p.lines) ledger.linesPaid[id] = p._id;
+    }
+    return ledger;
+  });
+  const next = outcome === "paid" ? { ...p, status: "paid", paidAt: Date.now() } : { ...p, status: "expired" };
+  try {
+    await ctx.db.put(next, { db: DB, id: p._id, ifRev: p._rev });
+  } catch (err) {
+    if (err.code !== "conflict") throw err;
+    const stored = await ctx.db.get(p._id, { db: DB }); // another call settled it first
+    if (stored && stored.status !== "pending") return stored;
+    throw err;
+  }
+  return next;
+}
+
+// A payer who came back without paying lets go of what they reserved, straight away.
+async function release(ctx, paymentId) {
+  const p = typeof paymentId === "string" ? await ctx.db.get(paymentId, { db: DB }) : null;
+  if (p?.type !== "payment" || p.status !== "pending") return null;
+  if (p.sessionId) await stripe(ctx, p.mode, "POST", `/checkout/sessions/${p.sessionId}/expire`);
+  return settle(ctx, p);
+}
+
+export async function fetch(request, ctx) {
+  const url = new URL(request.url);
+
+  if (url.pathname === "/setup" && request.method === "GET") {
+    const owner = ctx.userInfo?.userHandle === ctx.appInfo.ownerHandle;
+    const { mode, open, state, liveOpen, liveReady } = await checkoutMode(ctx);
+    const item = { id: "stripe-connect", label: "Connect Stripe", done: open, state };
+    if (mode === "live" && !liveOpen) item.problem = "Vibes DIY has paused live payments for now; checkout reopens here by itself when they return.";
+    const items = [item];
+    const ready = items.every((i) => i.done);
+    if (!owner) return json({ ok: true, ready, owner, mode });
+    return json({ ok: true, ready, owner, mode, liveOpen, liveReady, items, ownerHandle: ctx.appInfo.ownerHandle, appSlug: ctx.appInfo.appSlug });
+  }
+
+  // The owner, and only the owner, takes this app live.
+  if (url.pathname === "/go-live" && request.method === "POST") {
+    if (ctx.userInfo?.userHandle !== ctx.appInfo.ownerHandle) return json({ ok: false, reason: "owner-only" }, 403);
+    const { liveReady } = await checkoutMode(ctx);
+    if (!liveReady) return json({ ok: false, reason: "not_ready" }, 409);
+    const chosen = await ctx.db.get(LIVE_CHOICE, { db: DB });
+    if (!chosen) await ctx.db.put({ _id: LIVE_CHOICE, type: "setup", mode: "live", chosenAt: Date.now() }, { db: DB, id: LIVE_CHOICE });
+    return json({ ok: true, mode: "live" });
+  }
+
+  // Pay toward a check. Nobody signs in: the payment is keyed to the check and its session.
+  if (url.pathname === "/checkout" && request.method === "POST") {
+    const { mode, open, state } = await checkoutMode(ctx);
+    const { checkId, pay, lineIds, ways, quote, tipPercent, replaces, mode: shown } = await request.json().catch(() => ({}));
+    if (shown !== mode) return json({ ok: false, reason: "mode-changed", mode }, 409);
+    if (!open) return json({ ok: false, reason: state === "disconnected" ? "account_disconnected" : "not_ready" }, 503);
+    const check = typeof checkId === "string" ? await ctx.db.get(checkId, { db: DB }) : null;
+    if (check?.type !== "check") return json({ ok: false, reason: "not-found" }, 404);
+    // The payer's own earlier attempt lets go first; while Stripe cannot say how it ended, it keeps its hold.
+    const earlier = await release(ctx, replaces);
+    if (earlier?.status === "pending") return json({ ok: false, reason: "try-again" }, 503);
+
+    // Reserve before Stripe hears of it: one revision-checked ledger write, priced from the check,
+    // at exactly the amount the payer was shown.
+    const id = "pay-" + crypto.randomUUID();
+    const holdId = crypto.randomUUID();
+    let hold = null;
+    let refusal = { reason: "being-paid" };
+    const refused = await changeLedger(ctx, check._id, mode, (ledger) => {
+      const { left, free, taken } = freeOf(check, ledger);
+      let lines = [];
+      let share;
+      let subtotal = free; // the default: everything still free on the check
+      if (pay === "lines") {
+        lines = [...new Set(Array.isArray(lineIds) ? lineIds : [])].map((lid) => check.lines.find((l) => l.id === lid));
+        if (lines.length === 0 || lines.some((l) => !l || taken.has(l.id))) {
+          refusal = { reason: "taken" };
+          return null;
+        }
+        subtotal = lines.reduce((n, l) => n + l.price, 0);
+      } else if (pay === "share") {
+        if (!ledger.split) {
+          const n = Math.min(20, Math.max(2, Math.round(Number(ways) || 2)));
+          ledger.split = { ways: n, shares: splitShares(free, n) };
+        }
+        share = ledger.split.shares.findIndex((s) => s.by === null);
+        subtotal = share < 0 ? 0 : ledger.split.shares[share].amount;
+      }
+      if (left === 0) refusal = { reason: "paid-in-full" };
+      if (subtotal <= 0 || subtotal > free) return null;
+      if (subtotal !== quote) {
+        refusal = { reason: "quote-changed", quote: subtotal }; // the check moved since the page drew it
+        return null;
+      }
+      hold = { subtotal, lines: lines.map((l) => l.id), share: share ?? null };
+      ledger.holds[holdId] = hold;
+      if (share !== undefined) ledger.split.shares[share].by = holdId;
+      return ledger;
+    }).then(
+      () => null,
+      (err) => err
+    );
+    if (refused) {
+      // Most often the app's anonymous-write setting is off, so a guest's payment cannot be recorded.
+      ctx.log("warn", "check reservation refused", { code: refused.code, message: refused.message });
+      return json({ ok: false, reason: "guests-closed" }, 503);
+    }
+    if (!hold) return json({ ok: false, ...refusal }, 409);
+
+    const tip = TIPS.includes(tipPercent) ? tipPercent : 0;
+    const tipAmount = Math.round((hold.subtotal * tip) / 100);
+    const payment = {
+      _id: id,
+      type: "payment",
+      checkId: check._id,
+      holdId,
+      lines: hold.lines,
+      share: hold.share,
+      subtotal: hold.subtotal,
+      tip: tipAmount,
+      amount: hold.subtotal + tipAmount,
+      currency: check.currency,
+      mode,
+      status: "pending",
+      createdAt: Date.now(),
+    };
+    await ctx.db.put(payment, { db: DB, id, ifRev: null });
+
+    const what = pay === "lines" ? check.lines.filter((l) => hold.lines.includes(l.id)).map((l) => l.name).join(", ").slice(0, 200) : pay === "share" ? "A share of the check" : "The check";
+    const form = new URLSearchParams({
+      mode: "payment",
+      submit_type: "pay",
+      "line_items[0][quantity]": "1",
+      "line_items[0][price_data][currency]": check.currency,
+      "line_items[0][price_data][unit_amount]": String(hold.subtotal),
+      "line_items[0][price_data][product_data][name]": `${check.table} · ${what}`,
+      client_reference_id: id,
+      "metadata[checkId]": check._id,
+      expires_at: String(Math.floor(Date.now() / 1000) + HOLD_SECONDS),
+      success_url: appUrl(ctx, `#check=${check._id}&paid=${id}`),
+      cancel_url: appUrl(ctx, `#check=${check._id}&cancelled=${id}`),
+    });
+    if (tipAmount > 0) {
+      form.set("line_items[1][quantity]", "1");
+      form.set("line_items[1][price_data][currency]", check.currency);
+      form.set("line_items[1][price_data][unit_amount]", String(tipAmount));
+      form.set("line_items[1][price_data][product_data][name]", `Tip (${tip}%)`);
+    }
+    const session = await stripe(ctx, mode, "POST", "/checkout/sessions", form, { "idempotency-key": id });
+    if (!session.ok) {
+      await settle(ctx, await ctx.db.get(id, { db: DB }), true); // no session: give the hold back now
+      return json(session, session.reason === "stripe" ? 502 : 503);
+    }
+    const stored = await ctx.db.get(id, { db: DB });
+    await ctx.db.put({ ...stored, sessionId: session.body.id }, { db: DB, id, ifRev: stored._rev });
+    return json({ ok: true, paymentId: id, url: session.body.url });
+  }
+
+  // The payer is back: settle by what Stripe says, and answer from it.
+  if (url.pathname === "/confirm" && request.method === "POST") {
+    const { paymentId } = await request.json().catch(() => ({}));
+    const p = typeof paymentId === "string" ? await ctx.db.get(paymentId, { db: DB }) : null;
+    if (p?.type !== "payment") return json({ ok: false, reason: "not-found" }, 404);
+    const settled = await settle(ctx, p);
+    return json({ ok: true, state: settled.status });
+  }
+
+  if (url.pathname === "/release" && request.method === "POST") {
+    const { paymentId } = await request.json().catch(() => ({}));
+    await release(ctx, paymentId);
+    return json({ ok: true });
+  }
+
+  return json({ ok: false, reason: "not-found" }, 404);
+}
+
+// The safety net: a payer who paid and closed the tab, or walked away from Stripe's page, is
+// settled within a minute, and their hold comes back to the table.
+export async function scheduled(event, ctx) {
+  let after;
+  let settled = 0;
+  do {
+    const page = await ctx.db.query({ db: DB, field: "status", key: "pending", limit: 100, after });
+    for (const p of page) {
+      if (p.type !== "payment") continue;
+      const next = await settle(ctx, p);
+      if (next !== p) settled += 1;
+    }
+    after = page.next;
+  } while (after);
+  ctx.log("info", "check sweep", { settled, at: event.scheduledTime });
+}
+```
+
+### `access.js`
+```js app=table-check
+export function checks(doc, oldDoc, user, ctx) {
+  const table = (checkId) => {
+    if (typeof checkId !== "string" || !/^check-[\w-]+$/.test(checkId)) throw { forbidden: "a record names its check" };
+    return `check:${checkId}`;
+  };
+  // Each type owns its ids, so no record can stand in for another.
+  const idFor = { setup: "setup:live", check: doc._id?.startsWith("check-") && doc._id, payment: doc._id?.startsWith("pay-") && doc._id, ledger: `ledger:${doc.mode}:${doc.checkId}` };
+  if (!(doc.type in idFor) || doc._id !== idFor[doc.type]) throw { forbidden: "that id belongs to another kind of record" };
+  if (oldDoc && oldDoc.type !== doc.type) throw { forbidden: "a record keeps its type" };
+
+  // The owner's go-live choice: backend.js writes it on the owner's own /go-live call.
+  if (doc.type === "setup") {
+    ctx.requireBackend("fetch");
+    ctx.requireRole("owner");
+    if (doc.mode !== "live") throw { forbidden: "the setup record says live" };
+    return { channels: ["admin"], grant: { roles: { owner: ["admin"] } } };
+  }
+  // A check: the owner opens it with its lines, and anyone with the table's link reads it.
+  if (doc.type === "check") {
+    ctx.requireRole("owner");
+    const priced = Array.isArray(doc.lines) && doc.lines.every((l) => typeof l.id === "string" && Number.isInteger(l.price) && l.price > 0);
+    if (!priced) throw { forbidden: "each line has an id and a whole-cent price" };
+    if (oldDoc && oldDoc.lines.some((l) => !doc.lines.some((m) => m.id === l.id && m.price === l.price))) {
+      throw { forbidden: "a check keeps the lines it opened with; add a new line instead" };
+    }
+    return { channels: [table(doc._id)], grant: { public: [table(doc._id)] } };
+  }
+  if (doc.mode !== "test" && doc.mode !== "live") throw { forbidden: "money records name their mode" };
+  // A payment: /checkout writes it pending for a guest, and only backend.js settles it.
+  if (doc.type === "payment") {
+    if (oldDoc) {
+      ctx.requireBackend(); // /confirm, /release or the sweep, each after reading Stripe
+      if (doc.checkId !== oldDoc.checkId || doc.amount !== oldDoc.amount || doc.currency !== oldDoc.currency || doc.mode !== oldDoc.mode || doc.holdId !== oldDoc.holdId) {
+        throw { forbidden: "a payment keeps its check, its amount, its mode and its hold" };
+      }
+    } else {
+      ctx.requireBackend("fetch");
+      if (doc.status !== "pending" || !Number.isInteger(doc.amount) || !Number.isInteger(doc.createdAt)) {
+        throw { forbidden: "a payment starts pending, in whole cents, with the time it was made" };
+      }
+    }
+    table(doc.checkId);
+    // allowAnonymous: backend.js writes it while serving a guest who has no account.
+    return { channels: ["payments"], grant: { roles: { owner: ["payments"] } }, allowAnonymous: true };
+  }
+  // The check's ledger in one mode: written by backend.js alone, read by the whole table.
+  ctx.requireBackend();
+  if (!Number.isInteger(doc.paid) || doc.paid < 0) throw { forbidden: "a ledger counts whole cents" };
+  return { channels: [table(doc.checkId)], allowAnonymous: true };
+}
+```
+
+### `App.jsx`
+```jsx app=table-check
+import React, { useEffect, useRef, useState } from "react";
+import { useFireproof } from "use-fireproof";
+import { apiFetch } from "use-vibes";
+import { Badge, Button, Field, Figure, Heading, Input, Metric, Row, Segmented, Stack, Text } from "@vibes.diy/pouf";
+import { Checkbox } from "@vibes.diy/pouf/interactive";
+
+const money = (cents) => `$${(cents / 100).toFixed(2)}`;
+const post = (body) => ({ method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body) });
+const TIPS = [
+  { value: "0", label: "No tip" },
+  { value: "15", label: "15%" },
+  { value: "18", label: "18%" },
+  { value: "20", label: "20%" },
+  { value: "25", label: "25%" },
+];
+
+// Where a check stands in this mode, read off its ledger, which backend.js alone writes.
+function useStanding(check, checkId, mode) {
+  const { useLiveQuery } = useFireproof("checks");
+  const { docs } = useLiveQuery("_id", { key: `ledger:${mode}:${checkId}` });
+  const ledger = docs[0];
+  const total = check ? check.lines.reduce((n, l) => n + l.price, 0) : 0;
+  const paid = Math.min(total, ledger?.paid ?? 0);
+  const holds = Object.values(ledger?.holds ?? {});
+  const free = Math.max(0, total - paid - holds.reduce((n, h) => n + h.subtotal, 0));
+  const taken = new Set([...Object.keys(ledger?.linesPaid ?? {}), ...holds.flatMap((h) => h.lines)]);
+  // An even split, once someone picks it, is fixed on the ledger: the next open share's amount.
+  const split = ledger?.split;
+  const share = (ways) => (split ? (split.shares.find((s) => s.by === null)?.amount ?? 0) : Math.floor(free / ways));
+  return { total, paid, left: total - paid, free, taken, paidLines: new Set(Object.keys(ledger?.linesPaid ?? {})), busy: holds.length > 0, split, share };
+}
+
+// The setup verdict, read on mount and again whenever the app comes back into view.
+function useSetup() {
+  const [setup, setSetup] = useState(null);
+  const latest = useRef(0);
+  useEffect(() => {
+    const load = () => {
+      const n = ++latest.current;
+      apiFetch("/setup").then((r) => r.json()).catch(() => ({ ready: false, owner: false })).then((s) => { if (n === latest.current) setSetup(s); });
+    };
+    load();
+    const onVisible = () => { if (document.visibilityState === "visible") load(); };
+    document.addEventListener("visibilitychange", onVisible);
+    window.addEventListener("focus", load);
+    window.addEventListener("setup-changed", load);
+    return () => { document.removeEventListener("visibilitychange", onVisible); window.removeEventListener("focus", load); window.removeEventListener("setup-changed", load); };
+  }, []);
+  return setup;
+}
+
+const STRIPE_BUTTON = { absent: "Connect Stripe", onboarding: "Finish Stripe setup", disconnected: "Connect Stripe again" };
+
+// The owner's Setup surface: Connect Stripe, the go-live step, and guests' writes for this app.
+function SetupScreen({ setup }) {
+  const vibe = `${setup.ownerHandle}/${setup.appSlug}`;
+  const settingsUrl = `https://vibes.diy/vibes/mine/${vibe}/settings`;
+  const item = setup.items.find((i) => i.id === "stripe-connect");
+  const live = setup.mode === "live";
+  const takeLive = () => apiFetch("/go-live", { method: "POST" }).then(() => window.dispatchEvent(new Event("setup-changed")));
+  return (
+    <Stack>
+      <Heading>Setup</Heading>
+      <Row gap={2}>
+        <Text>{item.label}</Text>
+        <Badge tone={item.done ? "up" : "info"}>{item.done ? "Done" : item.state === "onboarding" ? "Stripe is finishing up" : "To do"}</Badge>
+      </Row>
+      {item.problem && <Text muted>{item.problem}</Text>}
+      <ol>
+        <li>
+          Open <a href={settingsUrl} target="_blank" rel="noreferrer">this vibe's Settings tab</a> (My Vibes → this vibe → Settings)
+          and press <b>{STRIPE_BUTTON[item.state] ?? "Connect Stripe"}</b> under <b>Payments</b>. Stripe opens its own setup pages.
+        </li>
+        <li>
+          Let guests pay without an account: publishing from the editor turns this on, and after a CLI push run{" "}
+          <b>vibes-diy app anon-write {vibe} on</b>. The page never writes for them; this app's server records each payment.
+        </li>
+        <li>
+          Come back here: tables can pay as soon as Stripe says your account is ready. In test mode the card 4242 4242 4242 4242 with any future date pays.
+        </li>
+        <li>
+          <Badge tone={live ? "up" : "info"}>{live ? "Live" : "Test mode"}</Badge>{" "}
+          {live ? (
+            <>This app takes real payments into your Stripe account; refunds and payouts are in your Stripe Dashboard.</>
+          ) : setup.liveReady ? (
+            <>Your live Stripe account is ready. <Button onClick={takeLive}>Take live payments in this app</Button></>
+          ) : setup.liveOpen ? (
+            <>When a test payment goes through, press <b>Go live with Stripe</b> under <b>Payments</b> on <a href={settingsUrl} target="_blank" rel="noreferrer">the same Settings tab</a>, then come back here to take this app live.</>
+          ) : (
+            <>Test mode runs the whole flow end to end. The <b>Go live with Stripe</b> button appears under <b>Payments</b> on the same Settings tab when vibes.diy opens live payments.</>
+          )}
+        </li>
+      </ol>
+    </Stack>
+  );
+}
+
+// One open check on the owner's list: its table link as a QR code, and what is paid and left.
+function CheckRow({ check, setup }) {
+  const s = useStanding(check, check._id, setup.mode);
+  const link = `https://vibes.diy/vibe/${setup.ownerHandle}/${setup.appSlug}#check=${check._id}`;
+  return (
+    <Stack>
+      <Row gap={2}>
+        <Heading level={3}>{check.table}</Heading>
+        {s.left === 0 ? <Badge tone="up">Paid in full</Badge> : <Badge tone="info">{money(s.left)} left</Badge>}
+      </Row>
+      <Text muted>{money(s.paid)} of {money(s.total)} paid · {link}</Text>
+      <Figure src={`https://api.qrserver.com/v1/create-qr-code/?size=200x200&data=${encodeURIComponent(link)}`} alt={`QR code for ${check.table}`} width={200} height={200} />
+    </Stack>
+  );
+}
+
+// The owner opens a check: a table name and its lines, prices kept in whole cents.
+function Tables({ setup }) {
+  const { database, useLiveQuery } = useFireproof("checks");
+  const { docs: checks } = useLiveQuery("type", { key: "check" });
+  const [table, setTable] = useState("");
+  const [lines, setLines] = useState([]);
+  const [name, setName] = useState("");
+  const [price, setPrice] = useState("");
+  const addLine = () => {
+    const cents = Math.round(Number(price) * 100);
+    if (!name.trim() || !(cents > 0)) return;
+    setLines([...lines, { id: crypto.randomUUID().slice(0, 8), name: name.trim(), price: cents }]);
+    setName("");
+    setPrice("");
+  };
+  const openCheck = () => {
+    const check = { _id: "check-" + crypto.randomUUID(), type: "check", table: table.trim(), lines, currency: "usd", openedAt: Date.now() };
+    // The form empties as the owner presses Open; the draft comes back only if the write is refused.
+    setTable("");
+    setLines([]);
+    database.put(check).catch(() => {
+      setTable(check.table);
+      setLines(check.lines);
+    });
+  };
+  return (
+    <Stack>
+      <Heading>Open a check</Heading>
+      <Field label="Table"><Input value={table} onChange={(e) => setTable(e.target.value)} placeholder="Table 4" /></Field>
+      <Row gap={2}>
+        <Field label="Item"><Input value={name} onChange={(e) => setName(e.target.value)} placeholder="Margherita" /></Field>
+        <Field label="Price"><Input value={price} onChange={(e) => setPrice(e.target.value)} placeholder="14.50" inputMode="decimal" /></Field>
+        <Button variant="quiet" onClick={addLine}>Add item</Button>
+      </Row>
+      {lines.map((l) => <Text key={l.id}>{l.name} · {money(l.price)}</Text>)}
+      <Button onClick={openCheck} disabled={!table.trim() || lines.length === 0}>Open the check</Button>
+      {checks.map((c) => <CheckRow key={c._id} check={c} setup={setup} />)}
+    </Stack>
+  );
+}
+
+const SORRY = {
+  "being-paid": "Someone at the table is paying right now. This page updates the moment they finish.",
+  "paid-in-full": "This check is paid in full.",
+  taken: "Someone is paying for one of those. Pick again from what is left.",
+  "mode-changed": "Payments here just changed mode. Refresh the page and press Pay again.",
+  "try-again": "Stripe did not answer just now. Press Pay again in a moment.",
+};
+
+// The table's page: one button pays everything that is left, and splitting is there for the table that wants it.
+function TableCheck({ checkId, setup }) {
+  const { useLiveQuery } = useFireproof("checks");
+  const { docs: found } = useLiveQuery("_id", { key: checkId });
+  const check = found.find((d) => d.type === "check");
+  const s = useStanding(check, checkId, setup?.mode);
+  const [splitting, setSplitting] = useState(false);
+  const [how, setHow] = useState("lines");
+  const [picked, setPicked] = useState([]);
+  const [ways, setWays] = useState("2");
+  const [tip, setTip] = useState("18");
+  const [mine, setMine] = useState(null); // this payer's latest payment: { id, state }
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState(null);
+
+  // Back from Stripe: /confirm settles the payment by what Stripe says, and the ledger moves for everyone.
+  useEffect(() => {
+    const back = () => {
+      const h = new URLSearchParams(location.hash.slice(1));
+      const paid = h.get("paid");
+      const cancelled = h.get("cancelled");
+      if (!paid && !cancelled) return;
+      history.replaceState(null, "", `${location.pathname}#check=${checkId}`);
+      if (cancelled) {
+        apiFetch("/release", post({ paymentId: cancelled }));
+        setMine(null);
+        return;
+      }
+      setMine({ id: paid, state: "pending" });
+      apiFetch("/confirm", post({ paymentId: paid })).then((r) => r.json()).then((d) => setMine({ id: paid, state: d.state ?? "pending" }));
+    };
+    back();
+    window.addEventListener("hashchange", back);
+    return () => window.removeEventListener("hashchange", back);
+  }, [checkId]);
+
+  const withTip = (cents) => cents + Math.round((cents * Number(tip)) / 100);
+  // `quote` is the subtotal this page shows; the backend charges exactly that or answers with the new one.
+  const pay = async (what) => {
+    setError(null);
+    const tab = window.open("", "_blank"); // opened inside the click, before any await
+    if (!tab) {
+      setError("Your browser blocked the Stripe tab. Allow pop-ups for this page and press Pay again.");
+      return;
+    }
+    setBusy(true);
+    try {
+      const replaces = mine?.state === "pending" ? mine.id : undefined;
+      const res = await apiFetch("/checkout", post({ checkId, ...what, tipPercent: Number(tip), replaces, mode: setup.mode }));
+      const data = await res.json();
+      if (!data.ok) {
+        tab.close();
+        setError(
+          data.reason === "stripe" ? data.message
+          : data.reason === "quote-changed" ? `The check just changed: your part is now ${money(withTip(data.quote))}. Press Pay again to pay that.`
+          : SORRY[data.reason] ?? "Checkout is not open yet."
+        );
+        return;
+      }
+      setMine({ id: data.paymentId, state: "pending" });
+      tab.location.href = data.url;
+    } finally {
+      setBusy(false);
+    }
+  };
+
+  if (!check) return <Text muted>Finding this table's check…</Text>;
+  const open = check.lines.filter((l) => !s.taken.has(l.id));
+  const pickedTotal = open.filter((l) => picked.includes(l.id)).reduce((n, l) => n + l.price, 0);
+  const share = s.share(Number(ways));
+  return (
+    <Stack>
+      <Heading>{check.table}</Heading>
+      <Row gap={2}>
+        <Metric label="Total" value={money(s.total)} />
+        <Metric label="Paid" value={money(s.paid)} />
+        <Metric label="Left" value={money(s.left)} />
+      </Row>
+      {check.lines.map((l) => (
+        <Row key={l.id} gap={2}>
+          <Text>{l.name}</Text>
+          <Text num>{money(l.price)}</Text>
+          {s.paidLines.has(l.id) && <Badge tone="up">Paid</Badge>}
+        </Row>
+      ))}
+      {mine?.state === "paid" && <Badge tone="up">Paid. Thank you!</Badge>}
+      {s.busy && mine?.state !== "pending" && <Text muted>Someone at the table is paying right now.</Text>}
+      {s.left === 0 ? (
+        <Badge tone="up">Paid in full</Badge>
+      ) : !setup?.ready ? (
+        <Text muted>Checkout is not open yet.</Text>
+      ) : (
+        <Stack>
+          {setup.mode === "test" && (
+            <Row gap={2}>
+              <Badge tone="info">Test mode</Badge>
+              <Text muted>{setup.owner ? "Pay with the test card 4242 4242 4242 4242 and any future date." : "This is a rehearsal: test payments end when the app goes live."}</Text>
+            </Row>
+          )}
+          <Segmented label="Tip" value={tip} onChange={setTip} options={TIPS} />
+          {!splitting ? (
+            <Stack>
+              <Button onClick={() => pay({ pay: "rest", quote: s.free })} disabled={busy || s.free === 0} loading={busy}>
+                Pay {money(withTip(s.free))} — Stripe opens in a new tab
+              </Button>
+              <Button variant="quiet" onClick={() => setSplitting(true)}>Split the check</Button>
+            </Stack>
+          ) : (
+            <Stack>
+              <Segmented label="Split by" value={how} onChange={setHow} options={[{ value: "lines", label: "What I had" }, { value: "share", label: "Even shares" }]} />
+              {how === "lines" ? (
+                <Stack>
+                  {open.map((l) => (
+                    <Checkbox key={l.id} label={`${l.name} · ${money(l.price)}`} checked={picked.includes(l.id)} onChange={(on) => setPicked(on ? [...picked, l.id] : picked.filter((id) => id !== l.id))} />
+                  ))}
+                  <Button onClick={() => pay({ pay: "lines", lineIds: picked, quote: pickedTotal })} disabled={busy || pickedTotal === 0} loading={busy}>
+                    Pay {money(withTip(pickedTotal))} for what I had
+                  </Button>
+                </Stack>
+              ) : (
+                <Stack>
+                  {s.split ? (
+                    <Text muted>This check is split {s.split.ways} ways.</Text>
+                  ) : (
+                    <Segmented label="Ways" value={ways} onChange={setWays} options={["2", "3", "4", "5", "6"].map((n) => ({ value: n, label: `${n} ways` }))} />
+                  )}
+                  <Button onClick={() => pay({ pay: "share", ways: Number(ways), quote: share })} disabled={busy || share === 0} loading={busy}>
+                    Pay my share, {money(withTip(share))}
+                  </Button>
+                </Stack>
+              )}
+              <Button variant="quiet" onClick={() => setSplitting(false)}>Pay the whole check instead</Button>
+            </Stack>
+          )}
+        </Stack>
+      )}
+      {error && <Text>{error}</Text>}
+    </Stack>
+  );
+}
+
+export default function App() {
+  const setup = useSetup();
+  const [hash, setHash] = useState(() => location.hash);
+  const [screen, setScreen] = useState("tables");
+  useEffect(() => {
+    const onHash = () => setHash(location.hash);
+    window.addEventListener("hashchange", onHash);
+    return () => window.removeEventListener("hashchange", onHash);
+  }, []);
+  const checkId = new URLSearchParams(hash.slice(1)).get("check");
+  if (checkId) return <TableCheck checkId={checkId} setup={setup} />;
+  if (!setup?.owner) return <Text muted>Scan the code on your table to see your check and pay.</Text>;
+  return (
+    <Stack>
+      {/* The owner's own screens: the tables, and Setup while an item is still to do. */}
+      <Row gap={2}>
+        <Button variant="quiet" onClick={() => setScreen("tables")}>Tables</Button>
+        {setup?.owner && (
+          <Button variant={setup.ready ? "quiet" : "solid"} onClick={() => setScreen("setup")}>
+            Setup{setup.ready ? "" : " · to do"}
+          </Button>
+        )}
+      </Row>
+      {screen === "setup" && setup?.owner ? <SetupScreen setup={setup} /> : <Tables setup={setup} />}
+    </Stack>
+  );
+}
+```
+
+A tip jar or a donation page keeps this shape with one standing check the
+owner opens once and amounts the backend prices from the page's own list, and
+no split. Staff who are not the owner open checks through a `staff` role, the
+way the access docs teach roles.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibes.diy/prompts",
-  "version": "14.3.191",
+  "version": "14.3.193",
   "type": "module",
   "main": "./index.js",
   "exports": {
@@ -39,10 +39,10 @@
   "license": "Apache-2.0",
   "dependencies": {
     "@adviser/cement": "~0.5.34",
-    "@vibes.diy/api-types": "14.3.191",
-    "@vibes.diy/call-ai-v2": "14.3.191",
-    "@vibes.diy/identity": "14.3.191",
-    "@vibes.diy/use-vibes-types": "14.3.191",
+    "@vibes.diy/api-types": "14.3.193",
+    "@vibes.diy/call-ai-v2": "14.3.193",
+    "@vibes.diy/identity": "14.3.193",
+    "@vibes.diy/use-vibes-types": "14.3.193",
     "arktype": "~2.2.8",
     "json-schema-faker": "~0.6.3"
   },