@flayerlabs/gamemode-gate 0.1.0 → 0.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flayerlabs/gamemode-gate",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Server-authoritative rooms, economy, admission and registry for Flaunch Game Modes",
   "license": "MIT",
   "author": "Flayer Labs",
@@ -42,9 +42,9 @@
     "db": "docker run -d --rm --name gamemode-pg -e POSTGRES_PASSWORD=gamemode -e POSTGRES_DB=gamemode -p 55439:5432 postgres:16-alpine"
   },
   "dependencies": {
-    "@flayerlabs/gamemode-spec": "^0.1.0",
     "@fastify/cors": "^11.3.0",
     "@fastify/websocket": "^11.3.0",
+    "@flayerlabs/gamemode-spec": "^0.3.0",
     "@types/node": "^22.10.2",
     "@types/pg": "^8.21.0",
     "fastify": "^5.11.3",

package/src/bearer.ts

@@ -0,0 +1,8 @@
+import { createHash, timingSafeEqual } from 'node:crypto';
+
+/** Compare a server-to-server bearer token without leaking how much of it matched. */
+export function hasBearerToken(header: string | undefined, expected: string): boolean {
+  const supplied = header?.startsWith('Bearer ') ? header.slice('Bearer '.length) : '';
+  const digest = (value: string): Buffer => createHash('sha256').update(value).digest();
+  return timingSafeEqual(digest(supplied), digest(expected));
+}

package/src/demo.ts

@@ -86,8 +86,9 @@ export async function createDemoGate<Config, State, Event, Action, PublicView, P
 
   // The same check the real gate runs at boot. A demo that silently used an impossible economy
   // would teach a builder that their numbers work when they do not.
+  const maxPointsPerPlayer = game.rewardBounds(config).maxPointsPerPlayer;
   const economy = resolveEconomy({
-    maxPointsPerPlayer: game.rewardBounds(config).maxPointsPerPlayer,
+    maxPointsPerPlayer,
     walletCapWei,
     pointsPerDollar,
     usdPerEth,
@@ -110,7 +111,11 @@ export async function createDemoGate<Config, State, Event, Action, PublicView, P
     seed: Math.floor(Math.random() * 1_000_000),
     window: { opensAt, closesAt: opensAt + roundMs },
     weiPerPoint: economy.economy.weiPerPoint,
+    pointsPerDollar: economy.economy.pointsPerDollar,
+    usdPerEth: economy.economy.usdPerEth,
     walletCapWei,
+    maxPointsPerPlayer,
+    scoreAuthority: 'rules',
     poolId: DEMO_POOL_ID,
   });
 

package/src/economy.ts

@@ -27,6 +27,15 @@ export interface Economy {
   weiPerPoint: bigint;
   /** What a flawless round pays. Always at or under `walletCapWei`, or this would not exist. */
   maxPayoutWei: bigint;
+  /**
+   * The two inputs, returned beside the rate they produced.
+   *
+   * They travel together so a caller cannot persist a rate from one calculation and a dollar
+   * figure from another. Both are process-wide settings, so the only place they are true of a
+   * particular round is the moment that round's rate was fixed.
+   */
+  pointsPerDollar: number;
+  usdPerEth: number;
 }
 
 export type EconomyResult =
@@ -53,7 +62,7 @@ export function resolveEconomy(input: EconomyInput): EconomyResult {
   if (!Number.isFinite(usdPerEth) || usdPerEth <= 0) {
     return { ok: false, problem: 'the ETH price must be a positive number', suggestedPointsPerDollar: pointsPerDollar };
   }
-  if (!Number.isFinite(maxPointsPerPlayer) || maxPointsPerPlayer <= 0) {
+  if (!Number.isSafeInteger(maxPointsPerPlayer) || maxPointsPerPlayer <= 0) {
     return {
       ok: false,
       problem: 'the game says a player can earn at most 0 points, so there is nothing to pay',
@@ -99,7 +108,7 @@ export function resolveEconomy(input: EconomyInput): EconomyResult {
     };
   }
 
-  return { ok: true, economy: { weiPerPoint, maxPayoutWei } };
+  return { ok: true, economy: { weiPerPoint, maxPayoutWei, pointsPerDollar, usdPerEth } };
 }
 
 /**

package/src/game-registry.ts

@@ -1,8 +1,8 @@
 import Fastify, { type FastifyInstance } from 'fastify';
 import cors from '@fastify/cors';
-import { createHash, timingSafeEqual } from 'node:crypto';
 import type { Pool } from 'pg';
 import { isAddress } from 'viem';
+import { hasBearerToken } from './bearer.js';
 import {
   InvalidRegistration,
   RegistrationConflict,
@@ -19,12 +19,6 @@ export interface GameRegistryOptions {
   writerToken: string;
 }
 
-const authorised = (header: string | undefined, token: string): boolean => {
-  const supplied = header?.startsWith('Bearer ') ? header.slice('Bearer '.length) : '';
-  const digest = (value: string): Buffer => createHash('sha256').update(value).digest();
-  return timingSafeEqual(digest(supplied), digest(token));
-};
-
 const routeChainId = (value: string): number | null => {
   if (!/^[1-9][0-9]*$/.test(value)) return null;
   const parsed = Number(value);
@@ -35,7 +29,7 @@ const internalRoute = (
   request: { headers: { authorization?: string | undefined }; params: unknown },
   token: string,
 ) => {
-  if (!authorised(request.headers.authorization, token)) {
+  if (!hasBearerToken(request.headers.authorization, token)) {
     return { ok: false as const, status: 401 as const, message: 'registry writer authentication failed' };
   }
   const { chainId: rawChainId, coin } = request.params as { chainId: string; coin: string };
@@ -53,7 +47,7 @@ const internalRoute = (
  */
 export function createGameRegistry(options: GameRegistryOptions): FastifyInstance {
   if (options.writerToken.length < 32) throw new RangeError('registry writer token must be at least 32 characters');
-  const app = Fastify({ bodyLimit: 1_024 });
+  const app = Fastify({ bodyLimit: 2_048 });
   void app.register(cors, { origin: [...options.allowedOrigins], methods: ['GET'] });
 
   app.get('/games/:chainId/:coin', async (request, reply) => {
@@ -72,7 +66,12 @@ export function createGameRegistry(options: GameRegistryOptions): FastifyInstanc
   app.put('/internal/games/:chainId/:coin', async (request, reply) => {
     const route = internalRoute(request, options.writerToken);
     if (!route.ok) return reply.code(route.status).send({ message: route.message });
-    const body = (request.body ?? {}) as { gameId?: unknown; gateOrigin?: unknown; deployId?: unknown };
+    const body = (request.body ?? {}) as {
+      gameId?: unknown;
+      gateOrigin?: unknown;
+      deployId?: unknown;
+      gameServerOrigins?: unknown;
+    };
     try {
       const registration = await pinGameRegistration(options.pool, {
         chainId: route.chainId,
@@ -80,6 +79,9 @@ export function createGameRegistry(options: GameRegistryOptions): FastifyInstanc
         gameId: body.gameId as string,
         gateOrigin: body.gateOrigin as string,
         deployId: body.deployId as string,
+        ...(body.gameServerOrigins === undefined
+          ? {}
+          : { gameServerOrigins: body.gameServerOrigins as readonly string[] }),
       });
       return reply.send(registration);
     } catch (error) {

package/src/game-server-awards.ts

@@ -0,0 +1,285 @@
+import type { Pool } from 'pg';
+import { isAddress } from 'viem';
+import type { PlayerId } from '@flayerlabs/gamemode-spec';
+import { inTransaction } from './store.js';
+
+const IDENTIFIER = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+
+/** The JSON body a trusted creator server sends to the gate. */
+export interface GameServerAwardRequest {
+  eventId: string;
+  player: PlayerId;
+  points: number;
+}
+
+/** The durable receipt returned for a new award or an identical retry. */
+export interface GameServerAwardReceipt extends GameServerAwardRequest {
+  roundId: string;
+  totalPoints: number;
+}
+
+export type GameServerAwardRefusal =
+  | 'award.invalid'
+  | 'award.no_such_round'
+  | 'award.wrong_authority'
+  | 'award.not_open_yet'
+  | 'award.window_closed'
+  | 'award.event_mismatch'
+  | 'award.limit_exceeded';
+
+export type GameServerAwardResult =
+  | { ok: true; created: boolean; award: GameServerAwardReceipt }
+  | { ok: false; refuse: GameServerAwardRefusal };
+
+/** What one wallet has earned in a round, and how much more it is allowed to earn. */
+export interface GameServerPlayerStanding {
+  roundId: string;
+  player: PlayerId;
+  /** This wallet's current round total, the same number an award receipt reports. */
+  totalPoints: number;
+  maxPointsPerPlayer: number;
+  /** `maxPointsPerPlayer` minus `totalPoints`, never below zero. */
+  remainingPoints: number;
+}
+
+/**
+ * A read cannot fail for a reason that only applies to a write, so it cannot return one.
+ *
+ * Extracted from the award vocabulary rather than restated beside it: the codes a game server
+ * switches on stay one list, and this read can only ever narrow that list, never extend it.
+ */
+export type GameServerPlayerRefusal = Extract<
+  GameServerAwardRefusal,
+  'award.invalid' | 'award.no_such_round' | 'award.wrong_authority'
+>;
+
+export type GameServerPlayerResult =
+  | { ok: true; standing: GameServerPlayerStanding }
+  | { ok: false; refuse: GameServerPlayerRefusal };
+
+interface GameServerAwardInput extends GameServerAwardRequest {
+  roundId: string;
+}
+
+interface StoredAward {
+  round_id: string;
+  event_id: string;
+  player: string;
+  points: string;
+  total_points: string;
+}
+
+/** A result that must roll back any setup writes before it reaches the caller. */
+class RollbackResult extends Error {
+  constructor(readonly result: GameServerAwardResult) {
+    super('game server award did not commit');
+  }
+}
+
+const receipt = (row: StoredAward): GameServerAwardReceipt => ({
+  roundId: row.round_id,
+  eventId: row.event_id,
+  player: row.player,
+  points: Number(row.points),
+  totalPoints: Number(row.total_points),
+});
+
+const matches = (stored: GameServerAwardReceipt, input: GameServerAwardInput): boolean =>
+  stored.roundId === input.roundId &&
+  stored.eventId === input.eventId &&
+  stored.player === input.player &&
+  stored.points === input.points;
+
+const replay = (stored: GameServerAwardReceipt, input: GameServerAwardInput): GameServerAwardResult =>
+  matches(stored, input)
+    ? { ok: true, created: false, award: stored }
+    : { ok: false, refuse: 'award.event_mismatch' };
+
+/**
+ * Credit events from one trusted creator game server.
+ *
+ * The event receipt and balance move in one transaction. A stable event id makes retries safe,
+ * while the adopted round fixes the wallet, time and reward ceilings this module enforces.
+ */
+export class GameServerAwards {
+  constructor(
+    private readonly pool: Pool,
+    private readonly gameId: string,
+  ) {}
+
+  async record(candidate: GameServerAwardInput): Promise<GameServerAwardResult> {
+    if (
+      !candidate ||
+      typeof candidate.roundId !== 'string' ||
+      !IDENTIFIER.test(candidate.roundId) ||
+      typeof candidate.eventId !== 'string' ||
+      !IDENTIFIER.test(candidate.eventId) ||
+      typeof candidate.player !== 'string' ||
+      !isAddress(candidate.player, { strict: false }) ||
+      !Number.isSafeInteger(candidate.points) ||
+      candidate.points <= 0
+    ) {
+      return { ok: false, refuse: 'award.invalid' };
+    }
+
+    const input = { ...candidate, player: candidate.player.toLowerCase() };
+    const receivedAt = Date.now();
+
+    try {
+      return await inTransaction(this.pool, async (tx) => {
+        const prior = await tx.query<StoredAward>(
+          `select awards.round_id, awards.event_id, awards.player,
+                  awards.points::text, awards.total_points::text
+           from award_events awards
+           join rounds on rounds.id = awards.round_id
+           where awards.round_id = $1 and awards.event_id = $2 and rounds.game_id = $3`,
+          [input.roundId, input.eventId, this.gameId],
+        );
+        if (prior.rows[0]) return replay(receipt(prior.rows[0]), input);
+
+        const round = await tx.query<{
+          opens_at: string;
+          closes_at: string;
+          max_points_per_player: string;
+          score_authority: 'rules' | 'external-server';
+          game_id: string;
+        }>(
+          `select opens_at, closes_at, max_points_per_player, score_authority, game_id
+           from rounds where id = $1`,
+          [input.roundId],
+        );
+        const terms = round.rows[0];
+        if (!terms || terms.game_id !== this.gameId) {
+          return { ok: false, refuse: 'award.no_such_round' } as const;
+        }
+        if (terms.score_authority !== 'external-server') {
+          return { ok: false, refuse: 'award.wrong_authority' } as const;
+        }
+
+        // Reserve the event id before checking the balance. A concurrent retry waits on this
+        // unique row and then reads the first request's receipt. Without that ordering, it could
+        // see the first request's new balance and incorrectly fail the reward ceiling check.
+        const inserted = await tx.query<StoredAward>(
+          `insert into award_events (round_id, event_id, player, points, total_points)
+           values ($1, $2, $3, $4, $4)
+           on conflict (round_id, event_id) do nothing
+           returning round_id, event_id, player, points::text, total_points::text`,
+          [input.roundId, input.eventId, input.player, input.points],
+        );
+        if (!inserted.rows[0]) {
+          const concurrent = await tx.query<StoredAward>(
+            `select round_id, event_id, player, points::text, total_points::text
+             from award_events where round_id = $1 and event_id = $2`,
+            [input.roundId, input.eventId],
+          );
+          const stored = concurrent.rows[0];
+          if (!stored) throw new Error(`${input.roundId}: award conflict disappeared`);
+          throw new RollbackResult(replay(receipt(stored), input));
+        }
+
+        // Establish idempotency before checking the clock. A retry may arrive after closesAt while
+        // the original request is still committing; it must recover that result, not lose it.
+        if (receivedAt < Number(terms.opens_at)) {
+          throw new RollbackResult({ ok: false, refuse: 'award.not_open_yet' });
+        }
+        if (receivedAt >= Number(terms.closes_at)) {
+          throw new RollbackResult({ ok: false, refuse: 'award.window_closed' });
+        }
+
+        // A claim locks the same row. Creating it before locking means a first award and first claim
+        // cannot both pass through a missing row without seeing each other.
+        await tx.query(
+          `insert into balances (round_id, player, points) values ($1, $2, 0)
+           on conflict (round_id, player) do nothing`,
+          [input.roundId, input.player],
+        );
+        const balance = await tx.query<{ points: string }>(
+          `select points::text from balances where round_id = $1 and player = $2 for update`,
+          [input.roundId, input.player],
+        );
+        const total = BigInt(balance.rows[0]?.points ?? '0') + BigInt(input.points);
+        if (total > BigInt(terms.max_points_per_player)) {
+          throw new RollbackResult({ ok: false, refuse: 'award.limit_exceeded' });
+        }
+
+        await tx.query(`update balances set points = $3 where round_id = $1 and player = $2`, [
+          input.roundId,
+          input.player,
+          total.toString(),
+        ]);
+        await tx.query(
+          `update award_events set total_points = $3 where round_id = $1 and event_id = $2`,
+          [input.roundId, input.eventId, total.toString()],
+        );
+        return {
+          ok: true,
+          created: true,
+          award: { ...input, totalPoints: Number(total) },
+        };
+      });
+    } catch (error) {
+      if (error instanceof RollbackResult) return error.result;
+      throw error;
+    }
+  }
+
+  /**
+   * What this wallet has earned so far, and how much more it may earn.
+   *
+   * Advisory. It takes no lock, so a concurrent award can move it between this answer and the next
+   * request; {@link record} remains the only arbiter of the ceiling, and a caller must still handle
+   * `award.limit_exceeded`. It lives here rather than in the route because it reads the same two
+   * tables under the same game scope as `record`, and a second copy of that scoping in the
+   * transport layer is how one of them ends up missing.
+   */
+  async pointsFor(query: { roundId: string; player: PlayerId }): Promise<GameServerPlayerResult> {
+    if (
+      !query ||
+      typeof query.roundId !== 'string' ||
+      !IDENTIFIER.test(query.roundId) ||
+      typeof query.player !== 'string' ||
+      !isAddress(query.player, { strict: false })
+    ) {
+      return { ok: false, refuse: 'award.invalid' };
+    }
+    // Balances are keyed by the lower-cased wallet, exactly as `record` writes them. Reading with a
+    // checksummed address instead would quietly answer zero for a player who has already scored.
+    const player = query.player.toLowerCase();
+
+    // Scoped by game in the `where`, so another game's round reads as no such round rather than as
+    // an empty standing — the same answer `record` gives, in one round trip instead of two.
+    const result = await this.pool.query<{
+      max_points_per_player: string;
+      score_authority: 'rules' | 'external-server';
+      points: string;
+    }>(
+      `select rounds.max_points_per_player::text,
+              rounds.score_authority,
+              coalesce(balances.points, 0)::text as points
+       from rounds
+       left join balances on balances.round_id = rounds.id and balances.player = $2
+       where rounds.id = $1 and rounds.game_id = $3`,
+      [query.roundId, player, this.gameId],
+    );
+    const round = result.rows[0];
+    if (!round) return { ok: false, refuse: 'award.no_such_round' };
+    if (round.score_authority !== 'external-server') {
+      return { ok: false, refuse: 'award.wrong_authority' };
+    }
+
+    // Safe as numbers because the ceiling is a safe integer at round creation and the award path
+    // never lets a balance pass it.
+    const maxPointsPerPlayer = Number(round.max_points_per_player);
+    const totalPoints = Number(round.points);
+    return {
+      ok: true,
+      standing: {
+        roundId: query.roundId,
+        player,
+        totalPoints,
+        maxPointsPerPlayer,
+        remainingPoints: Math.max(0, maxPointsPerPlayer - totalPoints),
+      },
+    };
+  }
+}

package/src/index.ts

@@ -5,13 +5,16 @@ export {
   Room,
   Sessions,
   createGate,
+  createGameServerGate,
 } from './server.js';
 export type {
   Admission,
   AdmissionRequest,
   Admit,
   ConfigForLaunch,
+  GameServerGateOptions,
   GateOptions,
+  MaxPointsForLaunch,
   VerifiedLaunch,
 } from './server.js';
 export { createTurnstileAdmit } from './turnstile.js';
@@ -43,3 +46,13 @@ export {
 export type { Registration, SecurityProfile } from './registry.js';
 export { createGameRegistry } from './game-registry.js';
 export type { GameRegistryOptions } from './game-registry.js';
+export type {
+  GameServerAwardReceipt,
+  GameServerAwardRefusal,
+  GameServerAwardRequest,
+  GameServerPlayerRefusal,
+  GameServerPlayerResult,
+  GameServerPlayerStanding,
+} from './game-server-awards.js';
+export { PLAYER_JOIN_TICKET_TTL_MS, verifyPlayerJoinTicket } from './player-join-tickets.js';
+export type { VerifiedPlayerJoin, VerifyPlayerJoinTicketOptions } from './player-join-tickets.js';

package/src/ledger.ts

@@ -87,16 +87,6 @@ export class Ledger {
     await migrate(this.pool);
   }
 
-  /** Credit points. Called once per award the game emits. */
-  async award(roundId: string, player: PlayerId, points: number): Promise<void> {
-    if (points <= 0) return;
-    await this.pool.query(
-      `insert into balances (round_id, player, points) values ($1, $2, $3)
-       on conflict (round_id, player) do update set points = balances.points + excluded.points`,
-      [roundId, player, Math.floor(points)],
-    );
-  }
-
   /**
    * Authorise up to `upToWei`, or refuse.
    *

package/src/player-join-tickets.ts

@@ -0,0 +1,151 @@
+import { createHmac, randomUUID, timingSafeEqual } from 'node:crypto';
+import { isAddress } from 'viem';
+import type { PlayerId } from '@flayerlabs/gamemode-spec';
+import type { PlayerJoinTicket } from '@flayerlabs/gamemode-spec/live';
+
+export const PLAYER_JOIN_TICKET_TTL_MS = 30_000;
+
+const DOMAIN = 'flaunch.game-mode/player-join/v1';
+const CLOCK_SKEW_MS = 5_000;
+const MAX_TICKET_LENGTH = 2_048;
+const ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+
+export interface VerifiedPlayerJoin {
+  player: PlayerId;
+  gameId: string;
+  roundId: string;
+  audience: string;
+  issuedAt: number;
+  expiresAt: number;
+  jti: string;
+}
+
+export interface VerifyPlayerJoinTicketOptions {
+  awardToken: string;
+  gameId: string;
+  roundId: string;
+  audience: string;
+}
+
+interface IssuePlayerJoinTicketOptions extends VerifyPlayerJoinTicketOptions {
+  player: PlayerId;
+  closesAt: number;
+  now: number;
+}
+
+interface TicketBody extends VerifiedPlayerJoin {
+  v: 1;
+  kind: 'player-join';
+}
+
+// The authoritative game server already holds award authority. Domain separation stops a ticket
+// MAC from being usable as an award bearer token while keeping deployment to one server secret.
+const key = (awardToken: string): Buffer => createHmac('sha256', awardToken).update(DOMAIN).digest();
+const mac = (body: string, awardToken: string): string => createHmac('sha256', key(awardToken)).update(body).digest('base64url');
+
+function exactOrigin(value: string): boolean {
+  try {
+    const parsed = new URL(value);
+    return (parsed.protocol === 'https:' || parsed.protocol === 'http:') && parsed.origin === value;
+  } catch {
+    return false;
+  }
+}
+
+function matches(body: string, signature: string, awardToken: string): boolean {
+  const expected = Buffer.from(mac(body, awardToken));
+  const received = Buffer.from(signature);
+  return expected.length === received.length && timingSafeEqual(expected, received);
+}
+
+/** Internal issuer used by an authenticated external-server gate route. */
+export function issuePlayerJoinTicket(options: IssuePlayerJoinTicketOptions): PlayerJoinTicket {
+  if (options.awardToken.length < 32) throw new RangeError('awardToken must be at least 32 characters');
+  const { now } = options;
+  if (!Number.isSafeInteger(now)) throw new RangeError('now must be a safe integer');
+  if (!Number.isSafeInteger(options.closesAt) || options.closesAt <= now) {
+    throw new RangeError('the round must still be open');
+  }
+  const expiresAt = Math.min(now + PLAYER_JOIN_TICKET_TTL_MS, options.closesAt);
+  const claims: TicketBody = {
+    v: 1,
+    kind: 'player-join',
+    player: options.player.toLowerCase(),
+    gameId: options.gameId,
+    roundId: options.roundId,
+    audience: options.audience,
+    issuedAt: now,
+    expiresAt,
+    jti: randomUUID(),
+  };
+  const body = Buffer.from(JSON.stringify(claims)).toString('base64url');
+  return { ticket: `gmj1.${body}.${mac(body, options.awardToken)}`, expiresAt };
+}
+
+/** Verify an opaque browser join ticket before binding a socket to its wallet. */
+export function verifyPlayerJoinTicket(
+  ticket: unknown,
+  options: VerifyPlayerJoinTicketOptions,
+): VerifiedPlayerJoin | null {
+  if (
+    options.awardToken.length < 32 ||
+    typeof ticket !== 'string' ||
+    ticket.length === 0 ||
+    ticket.length > MAX_TICKET_LENGTH
+  ) {
+    return null;
+  }
+  const parts = ticket.split('.');
+  if (parts.length !== 3 || parts[0] !== 'gmj1') return null;
+  const [, body, signature] = parts as [string, string, string];
+  if (!body || !signature || !matches(body, signature, options.awardToken)) return null;
+
+  let value: Record<string, unknown>;
+  try {
+    const parsed: unknown = JSON.parse(Buffer.from(body, 'base64url').toString());
+    if (typeof parsed !== 'object' || parsed === null) return null;
+    value = parsed as Record<string, unknown>;
+  } catch {
+    return null;
+  }
+
+  const now = Date.now();
+  if (
+    value.v !== 1 ||
+    value.kind !== 'player-join' ||
+    typeof value.player !== 'string' ||
+    !isAddress(value.player, { strict: false }) ||
+    value.player !== value.player.toLowerCase() ||
+    typeof value.gameId !== 'string' ||
+    !ID.test(value.gameId) ||
+    typeof value.roundId !== 'string' ||
+    !ID.test(value.roundId) ||
+    typeof value.audience !== 'string' ||
+    !exactOrigin(value.audience) ||
+    typeof value.issuedAt !== 'number' ||
+    !Number.isSafeInteger(value.issuedAt) ||
+    typeof value.expiresAt !== 'number' ||
+    !Number.isSafeInteger(value.expiresAt) ||
+    typeof value.jti !== 'string' ||
+    !ID.test(value.jti) ||
+    value.gameId !== options.gameId ||
+    value.roundId !== options.roundId ||
+    value.audience !== options.audience ||
+    value.issuedAt > now + CLOCK_SKEW_MS ||
+    value.expiresAt <= now ||
+    value.expiresAt <= value.issuedAt ||
+    value.expiresAt - value.issuedAt > PLAYER_JOIN_TICKET_TTL_MS
+  ) {
+    return null;
+  }
+
+  return {
+    player: value.player,
+    gameId: value.gameId,
+    roundId: value.roundId,
+    audience: value.audience,
+    issuedAt: value.issuedAt,
+    expiresAt: value.expiresAt,
+    jti: value.jti,
+  };
+}