@flayerlabs/gamemode-gate 0.2.0 → 0.3.1

package/src/player-join-tickets.ts

@@ -0,0 +1,151 @@
+import { createHmac, randomUUID, timingSafeEqual } from 'node:crypto';
+import { isAddress } from 'viem';
+import type { PlayerId } from '@flayerlabs/gamemode-spec';
+import type { PlayerJoinTicket } from '@flayerlabs/gamemode-spec/live';
+
+export const PLAYER_JOIN_TICKET_TTL_MS = 30_000;
+
+const DOMAIN = 'flaunch.game-mode/player-join/v1';
+const CLOCK_SKEW_MS = 5_000;
+const MAX_TICKET_LENGTH = 2_048;
+const ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+
+export interface VerifiedPlayerJoin {
+  player: PlayerId;
+  gameId: string;
+  roundId: string;
+  audience: string;
+  issuedAt: number;
+  expiresAt: number;
+  jti: string;
+}
+
+export interface VerifyPlayerJoinTicketOptions {
+  awardToken: string;
+  gameId: string;
+  roundId: string;
+  audience: string;
+}
+
+interface IssuePlayerJoinTicketOptions extends VerifyPlayerJoinTicketOptions {
+  player: PlayerId;
+  closesAt: number;
+  now: number;
+}
+
+interface TicketBody extends VerifiedPlayerJoin {
+  v: 1;
+  kind: 'player-join';
+}
+
+// The authoritative game server already holds award authority. Domain separation stops a ticket
+// MAC from being usable as an award bearer token while keeping deployment to one server secret.
+const key = (awardToken: string): Buffer => createHmac('sha256', awardToken).update(DOMAIN).digest();
+const mac = (body: string, awardToken: string): string => createHmac('sha256', key(awardToken)).update(body).digest('base64url');
+
+function exactOrigin(value: string): boolean {
+  try {
+    const parsed = new URL(value);
+    return (parsed.protocol === 'https:' || parsed.protocol === 'http:') && parsed.origin === value;
+  } catch {
+    return false;
+  }
+}
+
+function matches(body: string, signature: string, awardToken: string): boolean {
+  const expected = Buffer.from(mac(body, awardToken));
+  const received = Buffer.from(signature);
+  return expected.length === received.length && timingSafeEqual(expected, received);
+}
+
+/** Internal issuer used by an authenticated external-server gate route. */
+export function issuePlayerJoinTicket(options: IssuePlayerJoinTicketOptions): PlayerJoinTicket {
+  if (options.awardToken.length < 32) throw new RangeError('awardToken must be at least 32 characters');
+  const { now } = options;
+  if (!Number.isSafeInteger(now)) throw new RangeError('now must be a safe integer');
+  if (!Number.isSafeInteger(options.closesAt) || options.closesAt <= now) {
+    throw new RangeError('the round must still be open');
+  }
+  const expiresAt = Math.min(now + PLAYER_JOIN_TICKET_TTL_MS, options.closesAt);
+  const claims: TicketBody = {
+    v: 1,
+    kind: 'player-join',
+    player: options.player.toLowerCase(),
+    gameId: options.gameId,
+    roundId: options.roundId,
+    audience: options.audience,
+    issuedAt: now,
+    expiresAt,
+    jti: randomUUID(),
+  };
+  const body = Buffer.from(JSON.stringify(claims)).toString('base64url');
+  return { ticket: `gmj1.${body}.${mac(body, options.awardToken)}`, expiresAt };
+}
+
+/** Verify an opaque browser join ticket before binding a socket to its wallet. */
+export function verifyPlayerJoinTicket(
+  ticket: unknown,
+  options: VerifyPlayerJoinTicketOptions,
+): VerifiedPlayerJoin | null {
+  if (
+    options.awardToken.length < 32 ||
+    typeof ticket !== 'string' ||
+    ticket.length === 0 ||
+    ticket.length > MAX_TICKET_LENGTH
+  ) {
+    return null;
+  }
+  const parts = ticket.split('.');
+  if (parts.length !== 3 || parts[0] !== 'gmj1') return null;
+  const [, body, signature] = parts as [string, string, string];
+  if (!body || !signature || !matches(body, signature, options.awardToken)) return null;
+
+  let value: Record<string, unknown>;
+  try {
+    const parsed: unknown = JSON.parse(Buffer.from(body, 'base64url').toString());
+    if (typeof parsed !== 'object' || parsed === null) return null;
+    value = parsed as Record<string, unknown>;
+  } catch {
+    return null;
+  }
+
+  const now = Date.now();
+  if (
+    value.v !== 1 ||
+    value.kind !== 'player-join' ||
+    typeof value.player !== 'string' ||
+    !isAddress(value.player, { strict: false }) ||
+    value.player !== value.player.toLowerCase() ||
+    typeof value.gameId !== 'string' ||
+    !ID.test(value.gameId) ||
+    typeof value.roundId !== 'string' ||
+    !ID.test(value.roundId) ||
+    typeof value.audience !== 'string' ||
+    !exactOrigin(value.audience) ||
+    typeof value.issuedAt !== 'number' ||
+    !Number.isSafeInteger(value.issuedAt) ||
+    typeof value.expiresAt !== 'number' ||
+    !Number.isSafeInteger(value.expiresAt) ||
+    typeof value.jti !== 'string' ||
+    !ID.test(value.jti) ||
+    value.gameId !== options.gameId ||
+    value.roundId !== options.roundId ||
+    value.audience !== options.audience ||
+    value.issuedAt > now + CLOCK_SKEW_MS ||
+    value.expiresAt <= now ||
+    value.expiresAt <= value.issuedAt ||
+    value.expiresAt - value.issuedAt > PLAYER_JOIN_TICKET_TTL_MS
+  ) {
+    return null;
+  }
+
+  return {
+    player: value.player,
+    gameId: value.gameId,
+    roundId: value.roundId,
+    audience: value.audience,
+    issuedAt: value.issuedAt,
+    expiresAt: value.expiresAt,
+    jti: value.jti,
+  };
+}

package/src/registry.ts

@@ -1,5 +1,9 @@
 import type { Pool } from 'pg';
-import type { GameRegistration } from '@flayerlabs/gamemode-spec/embed';
+import {
+  parseGameServerOrigins,
+  type GameRegistration,
+  type GameSecurityProfile,
+} from '@flayerlabs/gamemode-spec/embed';
 
 /**
  * Which game a coin plays, and everything the page embedding it needs to know.
@@ -15,10 +19,7 @@ export type Registration = GameRegistration;
  * Semantic fields, never CSP text: a policy assembled by string concatenation somewhere else is a
  * policy someone can inject into.
  */
-export interface SecurityProfile {
-  kind: 'game';
-  connect: { https: string; wss: string };
-}
+export type SecurityProfile = GameSecurityProfile;
 
 export class InvalidRegistration extends Error {
   constructor(message: string) {
@@ -96,16 +97,32 @@ export function gateOrigin(value: unknown): string {
   return url.origin;
 }
 
+/** Validate the reviewed origins a creator-owned authoritative game server may use. */
+export function gameServerOrigins(value: unknown): readonly string[] {
+  const origins = parseGameServerOrigins(value);
+  if (origins === null) {
+    throw new InvalidRegistration('game server origins must be at most four distinct public HTTPS origins');
+  }
+  return origins;
+}
+
 /** The profile for a registration. The websocket address is derived, never supplied separately. */
-export function securityProfile(registration: Pick<Registration, 'gateOrigin'>): SecurityProfile {
+export function securityProfile(
+  registration: Pick<Registration, 'gateOrigin' | 'gameServerOrigins'>,
+): SecurityProfile {
   // Revalidated here on purpose: this is the value that leaves for another system, and checking it
   // at the boundary costs nothing.
   const origin = gateOrigin(registration.gateOrigin);
+  const servers = gameServerOrigins(registration.gameServerOrigins);
   return {
     kind: 'game',
     // Same host, same port, different scheme. Deriving it means the two can never name different
     // servers, which a second hand-entered field eventually would.
-    connect: { https: origin, wss: `wss://${new URL(origin).host}` },
+    connect: {
+      https: origin,
+      wss: `wss://${new URL(origin).host}`,
+      ...(servers.length === 0 ? {} : { gameServerOrigins: servers }),
+    },
   };
 }
 
@@ -136,12 +153,14 @@ export function checkRegistration(entry: Registration): Registration {
   if (typeof entry?.coin !== 'string' || !ADDRESS.test(entry.coin)) {
     throw new InvalidRegistration('coin must be a wallet address');
   }
+  const servers = gameServerOrigins(entry.gameServerOrigins);
   return {
     chainId: chainId(entry.chainId),
     coin: entry.coin.toLowerCase(),
     gameId: id(entry.gameId, 'game'),
     deployId: deployId(entry.deployId),
     gateOrigin: gateOrigin(entry.gateOrigin),
+    ...(servers.length === 0 ? {} : { gameServerOrigins: servers }),
   };
 }
 
@@ -150,16 +169,19 @@ export function checkRegistration(entry: Registration): Registration {
  */
 export async function pinGameRegistration(pool: Pool, entry: Registration): Promise<Registration> {
   const checked = checkRegistration(entry);
+  const servers = checked.gameServerOrigins ?? [];
   const result = await pool.query(
-    `insert into registrations (chain_id, coin, game_id, gate_origin, deploy_id) values ($1, $2, $3, $4, $5)
+    `insert into registrations (chain_id, coin, game_id, gate_origin, deploy_id, game_server_origins)
+     values ($1, $2, $3, $4, $5, $6)
      on conflict (chain_id, coin) do update set
        updated_at = registrations.updated_at
      where registrations.disabled_at is null
        and registrations.game_id = excluded.game_id
        and registrations.gate_origin = excluded.gate_origin
        and registrations.deploy_id = excluded.deploy_id
+       and registrations.game_server_origins = excluded.game_server_origins
      returning coin`,
-    [checked.chainId, checked.coin, checked.gameId, checked.gateOrigin, checked.deployId],
+    [checked.chainId, checked.coin, checked.gameId, checked.gateOrigin, checked.deployId, servers],
   );
   if (result.rows.length === 0) throw new RegistrationConflict();
   return checked;
@@ -180,8 +202,9 @@ export async function resolveGameRegistration(
     game_id: string;
     gate_origin: string;
     deploy_id: string;
+    game_server_origins: string[];
   }>(
-    `select chain_id::text, coin, game_id, gate_origin, deploy_id
+    `select chain_id::text, coin, game_id, gate_origin, deploy_id, game_server_origins
      from registrations where chain_id = $1 and coin = $2 and disabled_at is null`,
     [checkedChainId, coin.toLowerCase()],
   );
@@ -193,6 +216,7 @@ export async function resolveGameRegistration(
         gameId: row.game_id,
         gateOrigin: row.gate_origin,
         deployId: row.deploy_id,
+        gameServerOrigins: row.game_server_origins,
       })
     : null;
 }

package/src/room.ts

@@ -1,7 +1,7 @@
 import type { Pool } from 'pg';
 import { Round } from '@flayerlabs/gamemode-spec/round';
 import type { Award, Command, Decision, GameModule, PlayerId, Refusal, RoundWindow } from '@flayerlabs/gamemode-spec';
-import type { LaunchContext } from '@flayerlabs/gamemode-spec/live';
+import type { LaunchContext, RoundTerms } from '@flayerlabs/gamemode-spec/live';
 import { isRefusal } from '@flayerlabs/gamemode-spec';
 import { inTransaction, toBigInt } from './store.js';
 
@@ -39,8 +39,7 @@ export class Room<Config, State, Event, Action, PublicView, PlayerView> {
     private round: Round<Config, State, Event, Action, PublicView, PlayerView>,
     readonly window: RoundWindow,
     readonly launch: LaunchContext,
-    readonly weiPerPoint: bigint,
-    readonly maxPointsPerPlayer: number,
+    readonly terms: RoundTerms,
     readonly scoreAuthority: ScoreAuthority,
     private seq: number,
   ) {}
@@ -55,6 +54,8 @@ export class Room<Config, State, Event, Action, PublicView, PlayerView> {
       window: RoundWindow;
       weiPerPoint: bigint;
       walletCapWei: bigint;
+      pointsPerDollar: number;
+      usdPerEth: number;
       maxPointsPerPlayer: number;
       scoreAuthority: ScoreAuthority;
       poolId: string;
@@ -85,18 +86,28 @@ export class Room<Config, State, Event, Action, PublicView, PlayerView> {
       closesAt: round.window.closesAt,
       booksCloseAt,
     });
+    const terms: RoundTerms = Object.freeze({
+      maxPointsPerPlayer: round.maxPointsPerPlayer,
+      walletCapWei: round.walletCapWei,
+      weiPerPoint: round.weiPerPoint,
+      pointsPerDollar: round.pointsPerDollar,
+      usdPerEth: round.usdPerEth,
+    });
     const started = Round.start(game, round.config, round.seed, round.window);
     await pool.query(
       `insert into rounds (
-         id, game_id, wei_per_point, wallet_cap_wei, max_points_per_player, score_authority,
+         id, game_id, wei_per_point, wallet_cap_wei, points_per_dollar, usd_per_eth,
+         max_points_per_player, score_authority,
          pool_id, opens_at, closes_at, books_close_at,
          coin_address, coin_name, coin_symbol, coin_image_url, state, seq
-       ) values ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, 0)`,
+       ) values ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, 0)`,
       [
         round.id,
         game.id,
         round.weiPerPoint.toString(),
         round.walletCapWei.toString(),
+        round.pointsPerDollar,
+        round.usdPerEth,
         round.maxPointsPerPlayer,
         round.scoreAuthority,
         round.poolId,
@@ -117,8 +128,7 @@ export class Room<Config, State, Event, Action, PublicView, PlayerView> {
       started,
       round.window,
       launch,
-      round.weiPerPoint,
-      round.maxPointsPerPlayer,
+      terms,
       round.scoreAuthority,
       0,
     );
@@ -142,11 +152,15 @@ export class Room<Config, State, Event, Action, PublicView, PlayerView> {
       coin_symbol: string;
       coin_image_url: string | null;
       wei_per_point: string;
+      wallet_cap_wei: string;
+      points_per_dollar: number;
+      usd_per_eth: number;
       max_points_per_player: string;
       score_authority: ScoreAuthority;
       game_id: string;
     }>(
       `select state, seq, pool_id, opens_at, closes_at, books_close_at, wei_per_point,
+              wallet_cap_wei, points_per_dollar, usd_per_eth,
               max_points_per_player, score_authority, game_id,
               coin_address, coin_name, coin_symbol, coin_image_url
        from rounds where id = $1`,
@@ -167,6 +181,13 @@ export class Room<Config, State, Event, Action, PublicView, PlayerView> {
       ...window,
       booksCloseAt: Number(row.books_close_at),
     });
+    const terms: RoundTerms = Object.freeze({
+      maxPointsPerPlayer: Number(row.max_points_per_player),
+      walletCapWei: toBigInt(row.wallet_cap_wei),
+      weiPerPoint: toBigInt(row.wei_per_point),
+      pointsPerDollar: Number(row.points_per_dollar),
+      usdPerEth: Number(row.usd_per_eth),
+    });
     return new Room(
       pool,
       game,
@@ -174,8 +195,7 @@ export class Room<Config, State, Event, Action, PublicView, PlayerView> {
       Round.resume(game, row.state, window),
       window,
       launch,
-      toBigInt(row.wei_per_point),
-      Number(row.max_points_per_player),
+      terms,
       row.score_authority,
       row.seq,
     );
@@ -250,14 +270,14 @@ export class Room<Config, State, Event, Action, PublicView, PlayerView> {
         // Same transaction as the state that earned them. Points credited without the state that
         // justifies them, or the reverse, is a ledger nobody can reconcile.
         const points = Math.floor(award.points);
-        if (points > this.maxPointsPerPlayer) {
+        if (points > this.terms.maxPointsPerPlayer) {
           throw new Error(`${this.game.id}: awards exceeded the declared maximum for ${award.player}`);
         }
         const credited = await tx.query(
           `insert into balances (round_id, player, points) values ($1, $2, $3)
            on conflict (round_id, player) do update set points = balances.points + excluded.points
            where balances.points + excluded.points <= $4`,
-          [this.id, award.player, points, this.maxPointsPerPlayer],
+          [this.id, award.player, points, this.terms.maxPointsPerPlayer],
         );
         if (credited.rowCount !== 1) {
           throw new Error(`${this.game.id}: awards exceeded the declared maximum for ${award.player}`);

package/src/server.ts

@@ -4,7 +4,13 @@ import cors from '@fastify/cors';
 import type { Pool } from 'pg';
 import type { Command, GameModule, PlayerId } from '@flayerlabs/gamemode-spec';
 import { isRefusal } from '@flayerlabs/gamemode-spec';
-import type { PresenceState } from '@flayerlabs/gamemode-spec/live';
+import type {
+  EconomyBalance,
+  PresenceState,
+  RoundTerms,
+  WireEconomyBalance,
+  WireRoundTerms,
+} from '@flayerlabs/gamemode-spec/live';
 import { isReactionId, LIVE_PROTOCOL_VERSION } from '@flayerlabs/gamemode-spec/live';
 import { Room, type ScoreAuthority } from './room.js';
 import { CLAIM_AUTHORIZATION_TTL_MS, Claims, isClaimAmount, isClaimRequestId } from './claims.js';
@@ -15,6 +21,8 @@ import { resolveEconomy } from './economy.js';
 import { encodeHookData } from './chain/signer.js';
 import { hasBearerToken } from './bearer.js';
 import { GameServerAwards, type GameServerAwardRequest } from './game-server-awards.js';
+import { issuePlayerJoinTicket } from './player-join-tickets.js';
+import { gameServerOrigins } from './registry.js';
 
 /**
  * The gate's door.
@@ -82,6 +90,8 @@ export interface GameServerGateOptions extends GateBaseOptions {
   maxPointsPerPlayer: number | MaxPointsForLaunch;
   /** Dedicated server-to-server token. Never expose it to browser game code. */
   awardToken: string;
+  /** Reviewed HTTPS origins that may receive player join tickets. The gate origin is always allowed. */
+  gameServerOrigins?: readonly string[];
 }
 
 /** Where an admission check is being made. Enough to tell a sign-in from a spend. */
@@ -112,6 +122,25 @@ const ADMIT_ALL: Admit = () => ({ ok: true });
 /** What the socket says, which is only the truth when nothing is proxying in front of the gate. */
 const ipOf = (request: FastifyRequest): string | null => request.ip || null;
 
+/** Wei has no JSON form, so terms cross as decimal strings, exactly as the economy balance does. */
+const wireTerms = (terms: RoundTerms): WireRoundTerms => ({
+  maxPointsPerPlayer: terms.maxPointsPerPlayer,
+  walletCapWei: terms.walletCapWei.toString(),
+  weiPerPoint: terms.weiPerPoint.toString(),
+  pointsPerDollar: terms.pointsPerDollar,
+  usdPerEth: terms.usdPerEth,
+});
+
+/** The same encoding for the per-player balance, wherever it leaves the process. */
+const wireEconomy = (balance: EconomyBalance): WireEconomyBalance => ({
+  weiPerPoint: balance.weiPerPoint.toString(),
+  earnedWei: balance.earnedWei.toString(),
+  heldWei: balance.heldWei.toString(),
+  spentWei: balance.spentWei.toString(),
+  availableWei: balance.availableWei.toString(),
+  holdExpiresAt: balance.holdExpiresAt,
+});
+
 /** How often each open room is nudged so a deadline nobody is watching still fires. */
 const TICK_MS = 250;
 
@@ -141,6 +170,7 @@ type AdoptionResult<Config, State, Event, Action, PublicView, PlayerView> =
 interface AwardEndpoint {
   token: string;
   awards: GameServerAwards;
+  ticketAudiences: ReadonlySet<string>;
 }
 
 interface GameServerConfig {
@@ -203,11 +233,12 @@ export function createGameServerGate(options: GameServerGateOptions): FastifyIns
     typeof maximum === 'function'
       ? async (launch) => ({ maxPointsPerPlayer: await maximum(launch) })
       : { maxPointsPerPlayer: maximum };
-  const { gameId, maxPointsPerPlayer: _maximum, awardToken, ...base } = options;
+  const ticketAudiences = new Set([options.sessions.origin, ...gameServerOrigins(options.gameServerOrigins)]);
+  const { gameId, maxPointsPerPlayer: _maximum, awardToken, gameServerOrigins: _origins, ...base } = options;
   return createGateRuntime(
     { ...base, game: gameServerModule(gameId), config },
     'external-server',
-    { token: awardToken, awards: new GameServerAwards(options.pool, gameId) },
+    { token: awardToken, awards: new GameServerAwards(options.pool, gameId), ticketAudiences },
   );
 }
 
@@ -331,6 +362,8 @@ function createGateRuntime<Config, State, Event, Action, PublicView, PlayerView>
         seed: Number(BigInt(launch.poolId) % 2147483647n),
         window: { opensAt: launch.opensAt, closesAt: launch.closesAt },
         weiPerPoint: economy.economy.weiPerPoint,
+        pointsPerDollar: economy.economy.pointsPerDollar,
+        usdPerEth: economy.economy.usdPerEth,
         walletCapWei: launch.walletCapWei,
         maxPointsPerPlayer,
         scoreAuthority,
@@ -464,12 +497,40 @@ function createGateRuntime<Config, State, Event, Action, PublicView, PlayerView>
     }
     const adopted = await flight;
     if (!adopted.ok) return reply.code(adopted.status).send({ message: adopted.message });
+    // Terms ride alongside the launch rather than replacing it, so a caller that already parses
+    // this body as a LaunchContext keeps working and one that wants the round's economy does not
+    // need a second request for a value that was fixed by this very call.
     return reply
       .code(createdByThisRequest && adopted.created ? 201 : 200)
-      .send(adopted.room.launch);
+      .send({ ...adopted.room.launch, terms: wireTerms(adopted.room.terms) });
   });
 
   if (awardEndpoint) {
+    app.post('/rounds/:id/join-ticket', async (request, reply) => {
+      const who = player(request);
+      const id = (request.params as { id: string }).id;
+      const room = await roomFor(id);
+      if (!room) return reply.code(404).send({ message: 'that game is not running' });
+      const now = Date.now();
+      if (now >= room.window.closesAt) {
+        return reply.code(409).send({ message: 'that game has ended' });
+      }
+      const requested = (request.body as { audience?: unknown } | null)?.audience;
+      const audience = requested === undefined ? sessions.origin : requested;
+      if (typeof audience !== 'string' || !awardEndpoint.ticketAudiences.has(audience)) {
+        return reply.code(400).send({ message: 'that game server is not registered' });
+      }
+      return issuePlayerJoinTicket({
+        awardToken: awardEndpoint.token,
+        player: who,
+        gameId: game.id,
+        roundId: id,
+        audience,
+        closesAt: room.window.closesAt,
+        now,
+      });
+    });
+
     app.post('/internal/rounds/:id/awards', async (request, reply) => {
       if (!hasBearerToken(request.headers.authorization, awardEndpoint.token)) {
         return reply.code(401).send({ message: 'game server authentication failed' });
@@ -494,6 +555,37 @@ function createGateRuntime<Config, State, Event, Action, PublicView, PlayerView>
       announcePlayer(result.award.roundId, result.award.player);
       return reply.code(result.created ? 201 : 200).send(result.award);
     });
+
+    /**
+     * What one wallet has earned, so a game server can refuse a seat before the player sits in it.
+     *
+     * Advisory, and deliberately so. The award route still enforces the ceiling inside the
+     * transaction that moves the balance, so a caller that stops handling `award.limit_exceeded`
+     * because it checked here first has moved the check out of the only place it is atomic.
+     *
+     * Never routed through `roomFor`: that resurrects rooms, advances game state and returns
+     * nothing once the books close — none of which a read should do.
+     */
+    app.get('/internal/rounds/:id/players/:player', async (request, reply) => {
+      if (!hasBearerToken(request.headers.authorization, awardEndpoint.token)) {
+        return reply.code(401).send({ message: 'game server authentication failed' });
+      }
+      const params = request.params as { id: string; player: string };
+      const result = await awardEndpoint.awards.pointsFor({
+        roundId: params.id,
+        player: params.player as PlayerId,
+      });
+      if (!result.ok) {
+        return reply.code(result.refuse === 'award.invalid' ? 400 : 404).send({ refuse: result.refuse });
+      }
+
+      // `heldWei` moves on its own when an authorisation expires, so this answer is only true at the
+      // moment it is read. Points are monotone; the wei beside them are not.
+      const balance = await claims.economyBalance(result.standing.roundId, result.standing.player);
+      return reply
+        .header('cache-control', 'no-store')
+        .send({ ...result.standing, economy: wireEconomy(balance) });
+    });
   }
 
   app.get('/rounds/:id', async (request, reply) => {
@@ -503,7 +595,12 @@ function createGateRuntime<Config, State, Event, Action, PublicView, PlayerView>
     const before = room.sequence();
     await room.tick(Date.now());
     if (room.sequence() !== before) announce(id);
-    return { sequence: room.sequence(), view: room.publicView(), launch: room.launch };
+    return {
+      sequence: room.sequence(),
+      view: room.publicView(),
+      launch: room.launch,
+      terms: wireTerms(room.terms),
+    };
   });
 
   app.post('/rounds/:id/join', async (request, reply) => {
@@ -679,21 +776,14 @@ function createGateRuntime<Config, State, Event, Action, PublicView, PlayerView>
       const balance = viewer
         ? await claims.economyBalance(id, viewer)
         : {
-            weiPerPoint: room.weiPerPoint,
+            weiPerPoint: room.terms.weiPerPoint,
             earnedWei: 0n,
             heldWei: 0n,
             spentWei: 0n,
             availableWei: 0n,
             holdExpiresAt: null,
           };
-      const economy = {
-        weiPerPoint: balance.weiPerPoint.toString(),
-        earnedWei: balance.earnedWei.toString(),
-        heldWei: balance.heldWei.toString(),
-        spentWei: balance.spentWei.toString(),
-        availableWei: balance.availableWei.toString(),
-        holdExpiresAt: balance.holdExpiresAt,
-      };
+      const economy = wireEconomy(balance);
       return {
         v: LIVE_PROTOCOL_VERSION,
         type: 'snapshot',
@@ -702,6 +792,7 @@ function createGateRuntime<Config, State, Event, Action, PublicView, PlayerView>
         view: room.publicView(),
         you: viewer ? room.playerView(viewer) : null,
         economy,
+        terms: wireTerms(room.terms),
         launch: room.launch,
         presence: presence(id),
       };

package/src/sessions.ts

@@ -66,6 +66,11 @@ export class Sessions {
     }
   }
 
+  /** Exact configured gate origin, used as the default audience for a co-located game server. */
+  get origin(): string {
+    return this.gateOrigin;
+  }
+
   private sign(value: string): string {
     return createHmac('sha256', this.secret).update(value).digest('base64url');
   }

package/src/store.ts

@@ -13,6 +13,11 @@ create table if not exists rounds (
   game_id        text not null check (game_id <> ''),
   wei_per_point  numeric(78,0) not null check (wei_per_point > 0),
   wallet_cap_wei numeric(78,0) not null check (wallet_cap_wei > 0),
+  -- The two settings that produced wei_per_point, frozen beside it. They are gate-process config,
+  -- so an operator who restarts with a new ETH price must not retroactively change what a round
+  -- was priced at.
+  points_per_dollar double precision not null check (points_per_dollar > 0),
+  usd_per_eth       double precision not null check (usd_per_eth > 0),
   max_points_per_player bigint not null check (max_points_per_player > 0),
   score_authority text not null check (score_authority in ('rules', 'external-server')),
   pool_id        text not null,
@@ -41,11 +46,16 @@ alter table rounds
   add column if not exists max_points_per_player bigint check (max_points_per_player > 0);
 alter table rounds
   add column if not exists score_authority text check (score_authority in ('rules', 'external-server'));
+alter table rounds
+  add column if not exists points_per_dollar double precision check (points_per_dollar > 0);
+alter table rounds
+  add column if not exists usd_per_eth double precision check (usd_per_eth > 0);
 do $$
 begin
   if exists (
     select 1 from rounds
     where game_id is null or max_points_per_player is null or score_authority is null
+       or points_per_dollar is null or usd_per_eth is null
   ) then
     raise exception 'pre-release round rows cannot be upgraded safely'
       using hint = 'Delete the pre-release round data, then run migrate(pool) again.';
@@ -55,6 +65,8 @@ $$;
 alter table rounds alter column game_id set not null;
 alter table rounds alter column max_points_per_player set not null;
 alter table rounds alter column score_authority set not null;
+alter table rounds alter column points_per_dollar set not null;
+alter table rounds alter column usd_per_eth set not null;
 
 create table if not exists balances (
   round_id text not null references rounds(id) on delete cascade,
@@ -107,8 +119,10 @@ create table if not exists registrations (
   game_id     text not null check (game_id <> ''),
   gate_origin text not null check (gate_origin <> ''),
   deploy_id   text not null check (deploy_id <> ''),
+  game_server_origins text[] not null default '{}'::text[],
   disabled_at timestamptz,
   updated_at  timestamptz not null default now(),
+  constraint registrations_game_server_origins_bounded check (cardinality(game_server_origins) <= 4),
   primary key (chain_id, coin)
 );