Linework — system architecture Diagram

Trust boundaries

Public internet → Cloudflare edge → one Worker → D1; nothing runs on the home server
Secrets (Stripe keys, STUDIO_PASSCODE, SESSION_SECRET) exist only as Worker secrets
D1 holds couples' contact details and guests' replies, readable only through the couple's owner_token link or the admin cookie

Payments

The Worker creates a Stripe Checkout Session and 303-redirects the couple; Stripe holds the card data
Payment truth comes from the signed webhook (or an explicit admin 'mark paid'), never from the browser redirect
stripe_events makes the webhook idempotent; with no keys a labelled demo checkout stands in for Stripe

Deployed

Hono 4 + TypeScript, server-rendered; one small script for the builder's live preview
Art under public/art is found by file name (p1_frame_{design}.png, p1_illus_{design}_{layer}.png, og_{couple}.jpg, p2_film_{couple}.mp4); missing files render as gray labelled slots
Couple's page is an unguessable owner_token link; guests are remembered by a device-key cookie; admin is a passcode → HMAC-signed expiring cookie

Proposed, not deployed

R2 private bucket with signed URLs for photos, films and locked decor (R2 is disabled on the account until the owner enables it)
Email Routing send_email for inquiry and paid-order notifications
Durable Objects (or polling) for live updates in the package 3 world; Turnstile for abuse control