@flayerlabs/gamemode-gate 0.6.0 → 0.7.1

package/dist/standings.js

@@ -27,7 +27,7 @@ export class Standings {
     async forCoin(coin, now = Date.now()) {
         if (typeof coin !== 'string' || !isAddress(coin, { strict: false }))
             return null;
-        const rounds = await this.pool.query(`select id, pool_id, coin_address, coin_symbol, opens_at, closes_at,
+        const rounds = await this.pool.query(`select id, pool_id, coin_address, coin_symbol, opens_at, closes_at, books_close_at, settled_at,
               spend_token, spend_symbol, spend_decimals, usd_per_spend_token, usd_per_eth
          from rounds
         where lower(coin_address) = $1 and game_id = $2
@@ -50,6 +50,9 @@ export class Standings {
             ]),
         ]);
         const window = { opensAt: Number(round.opens_at), closesAt: Number(round.closes_at) };
+        // `settled_at` is stamped by the gate's ticker after its last clean reconcile, so it is the one
+        // fact that separates "ended, still settling" from "final". The phase is clock-based and cannot.
+        const settledAt = round.settled_at === null ? null : Number(round.settled_at);
         return {
             roundId: round.id,
             poolId: round.pool_id,
@@ -57,6 +60,9 @@ export class Standings {
             symbol: round.coin_symbol,
             phase: roundPhaseAt(window, now),
             ...window,
+            booksCloseAt: Number(round.books_close_at),
+            settledAt,
+            final: settledAt !== null,
             spendToken: {
                 address: round.spend_token,
                 symbol: round.spend_symbol,

package/dist/standings.js.map

@@ -1 +1 @@
-{"version":3,"file":"standings.js","sourceRoot":"","sources":["../src/standings.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEjC,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,YAAY,GAGb,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtC;;;;;;;;;GASG;AACH,MAAM,OAAO,SAAS;IAED;IACA;IAFnB,YACmB,IAAU,EACV,MAAc;QADd,SAAI,GAAJ,IAAI,CAAM;QACV,WAAM,GAAN,MAAM,CAAQ;IAC9B,CAAC;IAEJ;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,IAAa,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;QACnD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QAEjF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAalC;;;;;gBAKU,EACV,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAClC,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,4FAA4F;QAC5F,0FAA0F;QAC1F,+EAA+E;QAC/E,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,KAAK,CACb;;;;mBAIW,EACX,CAAC,KAAK,CAAC,EAAE,EAAE,qBAAqB,CAAC,CAClC;YACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAoB,kEAAkE,EAAE;gBACrG,KAAK,CAAC,EAAE;aACT,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACtF,OAAO;YACL,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,MAAM,EAAE,KAAK,CAAC,OAAO;YACrB,WAAW,EAAE,KAAK,CAAC,YAAY;YAC/B,MAAM,EAAE,KAAK,CAAC,WAAW;YACzB,KAAK,EAAE,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC;YAChC,GAAG,MAAM;YACT,UAAU,EAAE;gBACV,OAAO,EAAE,KAAK,CAAC,WAAW;gBAC1B,MAAM,EAAE,KAAK,CAAC,YAAY;gBAC1B,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC;gBACtC,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC,OAAO;aACtE;YACD,4FAA4F;YAC5F,6EAA6E;YAC7E,gBAAgB,EACd,KAAK,CAAC,mBAAmB,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC;YACpG,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;gBACzC,IAAI,EAAE,KAAK,GAAG,CAAC;gBACf,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;gBAC1B,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC;aACrC,CAAC,CAAC;YACH,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;SAChD,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CACb,OAAe,EACf,SAAwC;QAExC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACvC,IAAI,CAAC,IAAI,CAAC,KAAK,CACb;;;;mBAIW,EACX,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAC9B;YACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAoB,kEAAkE,EAAE;gBACrG,OAAO;aACR,CAAC;SACH,CAAC,CAAC;QACH,OAAO;YACL,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC/B,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;gBAC1B,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC;aACjC,CAAC,CAAC;YACH,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;SAC/C,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"standings.js","sourceRoot":"","sources":["../src/standings.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEjC,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,YAAY,GAGb,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtC;;;;;;;;;GASG;AACH,MAAM,OAAO,SAAS;IAED;IACA;IAFnB,YACmB,IAAU,EACV,MAAc;QADd,SAAI,GAAJ,IAAI,CAAM;QACV,WAAM,GAAN,MAAM,CAAQ;IAC9B,CAAC;IAEJ;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,IAAa,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;QACnD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QAEjF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAelC;;;;;gBAKU,EACV,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAClC,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,4FAA4F;QAC5F,0FAA0F;QAC1F,+EAA+E;QAC/E,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,KAAK,CACb;;;;mBAIW,EACX,CAAC,KAAK,CAAC,EAAE,EAAE,qBAAqB,CAAC,CAClC;YACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAoB,kEAAkE,EAAE;gBACrG,KAAK,CAAC,EAAE;aACT,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACtF,gGAAgG;QAChG,iGAAiG;QACjG,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC9E,OAAO;YACL,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,MAAM,EAAE,KAAK,CAAC,OAAO;YACrB,WAAW,EAAE,KAAK,CAAC,YAAY;YAC/B,MAAM,EAAE,KAAK,CAAC,WAAW;YACzB,KAAK,EAAE,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC;YAChC,GAAG,MAAM;YACT,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC;YAC1C,SAAS;YACT,KAAK,EAAE,SAAS,KAAK,IAAI;YACzB,UAAU,EAAE;gBACV,OAAO,EAAE,KAAK,CAAC,WAAW;gBAC1B,MAAM,EAAE,KAAK,CAAC,YAAY;gBAC1B,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC;gBACtC,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC,OAAO;aACtE;YACD,4FAA4F;YAC5F,6EAA6E;YAC7E,gBAAgB,EACd,KAAK,CAAC,mBAAmB,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC;YACpG,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;gBACzC,IAAI,EAAE,KAAK,GAAG,CAAC;gBACf,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;gBAC1B,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC;aACrC,CAAC,CAAC;YACH,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;SAChD,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CACb,OAAe,EACf,SAAwC;QAExC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACvC,IAAI,CAAC,IAAI,CAAC,KAAK,CACb;;;;mBAIW,EACX,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAC9B;YACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAoB,kEAAkE,EAAE;gBACrG,OAAO;aACR,CAAC;SACH,CAAC,CAAC;QACH,OAAO;YACL,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC/B,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;gBAC1B,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC;aACjC,CAAC,CAAC;YACH,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;SAC/C,CAAC;IACJ,CAAC;CACF"}

package/dist/store.d.ts

@@ -6,7 +6,7 @@ import type { Pool, PoolClient } from 'pg';
  * table is how a schema drifts: one adds a column, the other's migration never runs, and the
  * failure appears somewhere neither of them looks.
  */
-export declare const SCHEMA = "\ncreate table if not exists rounds (\n  id             text primary key,\n  game_id        text not null check (game_id <> ''),\n  wei_per_point  numeric(78,0) not null check (wei_per_point > 0),\n  wallet_cap_wei numeric(78,0) not null check (wallet_cap_wei > 0),\n  -- The two settings that produced wei_per_point, frozen beside it. They are gate-process config,\n  -- so an operator who restarts with a new ETH price must not retroactively change what a round\n  -- was priced at.\n  points_per_dollar double precision not null check (points_per_dollar > 0),\n  usd_per_eth       double precision not null check (usd_per_eth > 0),\n  -- The token spend is measured in: the coin's paired token, in whose base units every *_wei column\n  -- of this round is denominated. Defaults describe ETH, which is what every round was before the\n  -- columns existed, so a pre-existing row reads back exactly as it was priced. usd_per_eth holds\n  -- the rate normalised to eighteen decimals (see economy.ts); usd_per_spend_token the token's own\n  -- price, null on rows that predate it (for which usd_per_eth is that price).\n  spend_token    text not null default '0x0000000000000000000000000000000000000000' check (spend_token <> ''),\n  spend_symbol   text not null default 'ETH' check (spend_symbol <> ''),\n  spend_decimals integer not null default 18 check (spend_decimals between 0 and 36),\n  usd_per_spend_token double precision check (usd_per_spend_token > 0),\n  max_points_per_player bigint not null check (max_points_per_player > 0),\n  score_authority text not null check (score_authority in ('rules', 'external-server')),\n  pool_id        text not null,\n  opens_at       bigint not null,\n  closes_at      bigint not null,\n  books_close_at bigint not null,\n  coin_address   text,\n  coin_name      text not null,\n  coin_symbol    text not null,\n  coin_image_url text,\n  -- The game's own state, opaque to the platform. Written after every command, so a restart\n  -- resumes from here rather than replaying history.\n  state          jsonb not null,\n  -- Commands applied so far. Doubles as the cursor a reconnecting client resumes from.\n  seq            integer not null default 0 check (seq >= 0),\n  constraint rounds_window check (opens_at < closes_at),\n  constraint rounds_books_tail check (books_close_at >= closes_at)\n);\n\n-- A developer may already have run the first published schema without creating any rounds. Add\n-- the new authority fields in place for that empty setup. Existing round data needs a deliberate\n-- reset because its original reward bound cannot be reconstructed safely.\nalter table rounds\n  add column if not exists game_id text check (game_id <> '');\nalter table rounds\n  add column if not exists max_points_per_player bigint check (max_points_per_player > 0);\nalter table rounds\n  add column if not exists score_authority text check (score_authority in ('rules', 'external-server'));\nalter table rounds\n  add column if not exists points_per_dollar double precision check (points_per_dollar > 0);\nalter table rounds\n  add column if not exists usd_per_eth double precision check (usd_per_eth > 0);\ndo $$\nbegin\n  if exists (\n    select 1 from rounds\n    where game_id is null or max_points_per_player is null or score_authority is null\n       or points_per_dollar is null or usd_per_eth is null\n  ) then\n    raise exception 'pre-release round rows cannot be upgraded safely'\n      using hint = 'Delete the pre-release round data, then run migrate(pool) again.';\n  end if;\nend\n$$;\nalter table rounds alter column game_id set not null;\nalter table rounds alter column max_points_per_player set not null;\nalter table rounds alter column score_authority set not null;\nalter table rounds alter column points_per_dollar set not null;\nalter table rounds alter column usd_per_eth set not null;\n\n-- Paired-token rounds (0.5.0). Every earlier round was an ETH round, so the defaults ARE the\n-- backfill: Postgres fills a new not-null column with its default, and ETH/18 is exactly what those\n-- rows were priced in. No guard is needed \u2014 nothing here has to be guessed.\nalter table rounds\n  add column if not exists spend_token text not null default '0x0000000000000000000000000000000000000000' check (spend_token <> '');\nalter table rounds\n  add column if not exists spend_symbol text not null default 'ETH' check (spend_symbol <> '');\nalter table rounds\n  add column if not exists spend_decimals integer not null default 18 check (spend_decimals between 0 and 36);\nalter table rounds\n  add column if not exists usd_per_spend_token double precision check (usd_per_spend_token > 0);\n\n-- Any wired PositionManager (0.6.0). The manager a round's coin was launched on, as the gate\n-- resolved it from the coin at adoption. Null on rounds adopted before the gate recorded it, and on\n-- demo and mock rounds; nothing reads it back for gameplay, it is provenance for the operator.\nalter table rounds\n  add column if not exists position_manager text check (position_manager <> '');\n\ncreate table if not exists balances (\n  round_id text not null references rounds(id) on delete cascade,\n  player   text not null,\n  points   bigint not null default 0 check (points >= 0),\n  -- What the chain says this wallet has already spent on this pool. The contract keeps this and\n  -- enforces it whatever we believe, so it is the only figure that is actually true.\n  chain_spent_wei numeric(78,0) not null default 0 check (chain_spent_wei >= 0),\n  primary key (round_id, player)\n);\n\n-- One row per authorisation ever issued. Nothing is deleted: a signature that exists in the world\n-- cannot be un-issued, so the ledger records its fate instead of forgetting it.\ncreate table if not exists claims (\n  nonce         bigint generated always as identity primary key,\n  round_id      text not null references rounds(id) on delete cascade,\n  player        text not null,\n  request_id    varchar(128) not null check (request_id <> ''),\n  requested_wei numeric(78,0) not null check (requested_wei > 0),\n  wei           numeric(78,0) not null check (wei > 0 and wei <= requested_wei),\n  -- Held or released, and nothing else. Whether a swap LANDED is the chain's to say, not ours.\n  status        text not null check (status in ('held', 'released')),\n  deadline      bigint not null,\n  -- Persisted before a payload leaves the gate. Until signing completes, both values are null.\n  signature     text,\n  signer        text,\n  created_at    timestamptz not null default now(),\n  constraint claims_by_request unique (round_id, player, request_id),\n  constraint claims_signature_pair check ((signature is null) = (signer is null))\n);\n\ncreate index if not exists claims_by_player on claims (round_id, player) where status = 'held';\n\n-- Trusted creator servers use one stable event id for every score increment. The event and the\n-- balance update commit together, so a retry can recover the first result without paying twice.\ncreate table if not exists award_events (\n  round_id  text not null references rounds(id) on delete cascade,\n  event_id  varchar(128) not null check (event_id <> ''),\n  player    text not null,\n  points    bigint not null check (points > 0),\n  total_points bigint not null check (total_points >= points),\n  created_at timestamptz not null default now(),\n  primary key (round_id, event_id)\n);\n\n-- Which game a coin plays. Addresses are chain-local, so the pin is one row per (chain, coin).\ncreate table if not exists registrations (\n  chain_id    bigint not null check (chain_id > 0),\n  coin        text not null check (coin <> ''),\n  game_id     text not null check (game_id <> ''),\n  gate_origin text not null check (gate_origin <> ''),\n  deploy_id   text not null check (deploy_id <> ''),\n  game_server_origins text[] not null default '{}'::text[],\n  disabled_at timestamptz,\n  updated_at  timestamptz not null default now(),\n  constraint registrations_game_server_origins_bounded check (cardinality(game_server_origins) <= 4),\n  primary key (chain_id, coin)\n);\n\n-- Accepted play sessions: one row per wallet and round, keyed by a hash of both so a wallet is never\n-- stored in the clear. Independent of scoring and of websocket reconnects. play_tracking records\n-- when this gate began counting, so a dashboard can tell \"no plays\" from \"not yet tracked\".\ncreate table if not exists play_sessions (\n  id text primary key,\n  round_id text not null references rounds(id) on delete cascade,\n  started_at bigint not null\n);\ncreate index if not exists play_sessions_started_id_idx on play_sessions(started_at, id);\ncreate table if not exists play_tracking (\n  id boolean primary key default true check (id),\n  started_at bigint not null\n);\ninsert into play_tracking(id, started_at) values (true, (extract(epoch from clock_timestamp()) * 1000)::bigint) on conflict do nothing;\n\n-- What actually happened, in order. Not used to rebuild state \u2014 the snapshot does that \u2014 but it is\n-- the record of why a state looks the way it does, which is what an incident needs.\ncreate table if not exists commands (\n  round_id text not null references rounds(id) on delete cascade,\n  seq      integer not null check (seq > 0),\n  command  jsonb not null,\n  primary key (round_id, seq)\n);\n";
+export declare const SCHEMA = "\ncreate table if not exists rounds (\n  id             text primary key,\n  game_id        text not null check (game_id <> ''),\n  wei_per_point  numeric(78,0) not null check (wei_per_point > 0),\n  wallet_cap_wei numeric(78,0) not null check (wallet_cap_wei > 0),\n  -- The two settings that produced wei_per_point, frozen beside it. They are gate-process config,\n  -- so an operator who restarts with a new ETH price must not retroactively change what a round\n  -- was priced at.\n  points_per_dollar double precision not null check (points_per_dollar > 0),\n  usd_per_eth       double precision not null check (usd_per_eth > 0),\n  -- The token spend is measured in: the coin's paired token, in whose base units every *_wei column\n  -- of this round is denominated. Defaults describe ETH, which is what every round was before the\n  -- columns existed, so a pre-existing row reads back exactly as it was priced. usd_per_eth holds\n  -- the rate normalised to eighteen decimals (see economy.ts); usd_per_spend_token the token's own\n  -- price, null on rows that predate it (for which usd_per_eth is that price).\n  spend_token    text not null default '0x0000000000000000000000000000000000000000' check (spend_token <> ''),\n  spend_symbol   text not null default 'ETH' check (spend_symbol <> ''),\n  spend_decimals integer not null default 18 check (spend_decimals between 0 and 36),\n  usd_per_spend_token double precision check (usd_per_spend_token > 0),\n  max_points_per_player bigint not null check (max_points_per_player > 0),\n  score_authority text not null check (score_authority in ('rules', 'external-server')),\n  pool_id        text not null,\n  opens_at       bigint not null,\n  closes_at      bigint not null,\n  books_close_at bigint not null,\n  coin_address   text,\n  coin_name      text not null,\n  coin_symbol    text not null,\n  coin_image_url text,\n  -- The game's own state, opaque to the platform. Written after every command, so a restart\n  -- resumes from here rather than replaying history.\n  state          jsonb not null,\n  -- Commands applied so far. Doubles as the cursor a reconnecting client resumes from.\n  seq            integer not null default 0 check (seq >= 0),\n  constraint rounds_window check (opens_at < closes_at),\n  constraint rounds_books_tail check (books_close_at >= closes_at)\n);\n\n-- A developer may already have run the first published schema without creating any rounds. Add\n-- the new authority fields in place for that empty setup. Existing round data needs a deliberate\n-- reset because its original reward bound cannot be reconstructed safely.\nalter table rounds\n  add column if not exists game_id text check (game_id <> '');\nalter table rounds\n  add column if not exists max_points_per_player bigint check (max_points_per_player > 0);\nalter table rounds\n  add column if not exists score_authority text check (score_authority in ('rules', 'external-server'));\nalter table rounds\n  add column if not exists points_per_dollar double precision check (points_per_dollar > 0);\nalter table rounds\n  add column if not exists usd_per_eth double precision check (usd_per_eth > 0);\ndo $$\nbegin\n  if exists (\n    select 1 from rounds\n    where game_id is null or max_points_per_player is null or score_authority is null\n       or points_per_dollar is null or usd_per_eth is null\n  ) then\n    raise exception 'pre-release round rows cannot be upgraded safely'\n      using hint = 'Delete the pre-release round data, then run migrate(pool) again.';\n  end if;\nend\n$$;\nalter table rounds alter column game_id set not null;\nalter table rounds alter column max_points_per_player set not null;\nalter table rounds alter column score_authority set not null;\nalter table rounds alter column points_per_dollar set not null;\nalter table rounds alter column usd_per_eth set not null;\n\n-- Paired-token rounds (0.5.0). Every earlier round was an ETH round, so the defaults ARE the\n-- backfill: Postgres fills a new not-null column with its default, and ETH/18 is exactly what those\n-- rows were priced in. No guard is needed \u2014 nothing here has to be guessed.\nalter table rounds\n  add column if not exists spend_token text not null default '0x0000000000000000000000000000000000000000' check (spend_token <> '');\nalter table rounds\n  add column if not exists spend_symbol text not null default 'ETH' check (spend_symbol <> '');\nalter table rounds\n  add column if not exists spend_decimals integer not null default 18 check (spend_decimals between 0 and 36);\nalter table rounds\n  add column if not exists usd_per_spend_token double precision check (usd_per_spend_token > 0);\n\n-- Any wired PositionManager (0.6.0). The manager a round's coin was launched on, as the gate\n-- resolved it from the coin at adoption. Null on rounds adopted before the gate recorded it, and on\n-- demo and mock rounds; nothing reads it back for gameplay, it is provenance for the operator.\nalter table rounds\n  add column if not exists position_manager text check (position_manager <> '');\n\n-- Round finalization (0.7.0). The moment the gate finished its last clean settlement pass past\n-- books_close_at, in ms since the epoch: from here chain_spent_wei cannot move. Null while a round is still\n-- settling, and on rounds a gate below 0.7.0 closed \u2014 nothing can reconstruct it for those.\nalter table rounds\n  add column if not exists settled_at bigint;\n\ncreate table if not exists balances (\n  round_id text not null references rounds(id) on delete cascade,\n  player   text not null,\n  points   bigint not null default 0 check (points >= 0),\n  -- What the chain says this wallet has already spent on this pool. The contract keeps this and\n  -- enforces it whatever we believe, so it is the only figure that is actually true.\n  chain_spent_wei numeric(78,0) not null default 0 check (chain_spent_wei >= 0),\n  primary key (round_id, player)\n);\n\n-- One row per signed authorisation, kept only so a retried or replica-raced request returns the\n-- exact bytes already handed out. Nothing here is a reservation: the signature carries a\n-- cumulative ceiling the calculator compares against its own walletSpentWei, so an unused one\n-- costs nothing and there is no fate to record.\ncreate table if not exists authorisations (\n  round_id          text not null references rounds(id) on delete cascade,\n  player            text not null,\n  request_id        varchar(128) not null check (request_id <> ''),\n  -- What the caller asked for, so a retry with a different amount is refused, not silently served.\n  requested_wei     numeric(78,0) not null check (requested_wei > 0),\n  -- The signed field: min(earned, wallet cap) at issue, in the round's spend-token base units.\n  spend_ceiling_wei numeric(78,0) not null check (spend_ceiling_wei > 0),\n  -- The exact-in amount the caller intended, clamped to what was available. Echoed, not signed.\n  spend_wei         numeric(78,0) not null check (spend_wei > 0 and spend_wei <= spend_ceiling_wei),\n  deadline          bigint not null,\n  signature         text not null,\n  signer            text not null,\n  created_at        timestamptz not null default now(),\n  primary key (round_id, player, request_id)\n);\n\n-- 0.7.0 hard cutover. Holds no longer exist, and every row the old table could carry was signed\n-- under the version 1 calculator domain that a 0.7.0 gate cannot serve. Dropping it is the honest\n-- migration; a gate should not be upgraded until every live round has passed its books close.\ndrop index if exists claims_by_player;\ndrop table if exists claims;\n\n-- Trusted creator servers use one stable event id for every score increment. The event and the\n-- balance update commit together, so a retry can recover the first result without paying twice.\ncreate table if not exists award_events (\n  round_id  text not null references rounds(id) on delete cascade,\n  event_id  varchar(128) not null check (event_id <> ''),\n  player    text not null,\n  points    bigint not null check (points > 0),\n  total_points bigint not null check (total_points >= points),\n  created_at timestamptz not null default now(),\n  primary key (round_id, event_id)\n);\n\n-- Which game a coin plays. Addresses are chain-local, so the pin is one row per (chain, coin).\ncreate table if not exists registrations (\n  chain_id    bigint not null check (chain_id > 0),\n  coin        text not null check (coin <> ''),\n  game_id     text not null check (game_id <> ''),\n  gate_origin text not null check (gate_origin <> ''),\n  deploy_id   text not null check (deploy_id <> ''),\n  game_server_origins text[] not null default '{}'::text[],\n  disabled_at timestamptz,\n  updated_at  timestamptz not null default now(),\n  constraint registrations_game_server_origins_bounded check (cardinality(game_server_origins) <= 32),\n  primary key (chain_id, coin)\n);\n\n-- 0.7.1 raised the reviewed origin bound from four to thirty-two: twenty game servers plus the\n-- other-chain gate origins a platform folds into the same list. The create table above only runs\n-- for a new database, so rewrite the check in place for a gate that already has the table.\nalter table registrations drop constraint if exists registrations_game_server_origins_bounded;\nalter table registrations\n  add constraint registrations_game_server_origins_bounded check (cardinality(game_server_origins) <= 32);\n\n-- Accepted play sessions: one row per wallet and round, keyed by a hash of both so a wallet is never\n-- stored in the clear. Independent of scoring and of websocket reconnects. play_tracking records\n-- when this gate began counting, so a dashboard can tell \"no plays\" from \"not yet tracked\".\ncreate table if not exists play_sessions (\n  id text primary key,\n  round_id text not null references rounds(id) on delete cascade,\n  started_at bigint not null\n);\ncreate index if not exists play_sessions_started_id_idx on play_sessions(started_at, id);\ncreate table if not exists play_tracking (\n  id boolean primary key default true check (id),\n  started_at bigint not null\n);\ninsert into play_tracking(id, started_at) values (true, (extract(epoch from clock_timestamp()) * 1000)::bigint) on conflict do nothing;\n\n-- What actually happened, in order. Not used to rebuild state \u2014 the snapshot does that \u2014 but it is\n-- the record of why a state looks the way it does, which is what an incident needs.\ncreate table if not exists commands (\n  round_id text not null references rounds(id) on delete cascade,\n  seq      integer not null check (seq > 0),\n  command  jsonb not null,\n  primary key (round_id, seq)\n);\n";
 /**
  * Run `fn` inside a transaction, committing on success and rolling back on failure.
  *

package/dist/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAE3C;;;;;;GAMG;AACH,eAAO,MAAM,MAAM,4oSAyKlB,CAAC;AAMF;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAiBjG;AAED,sGAAsG;AACtG,wBAAsB,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAKvD;AAED;;;GAGG;AACH,eAAO,MAAM,QAAQ,GAAI,OAAO,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,KAAG,MAA4B,CAAC"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAE3C;;;;;;GAMG;AACH,eAAO,MAAM,MAAM,47UA2LlB,CAAC;AAMF;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAiBjG;AAED,sGAAsG;AACtG,wBAAsB,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAKvD;AAED;;;GAGG;AACH,eAAO,MAAM,QAAQ,GAAI,OAAO,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,KAAG,MAA4B,CAAC"}

package/dist/store.js

@@ -93,6 +93,12 @@ alter table rounds
 alter table rounds
   add column if not exists position_manager text check (position_manager <> '');
 
+-- Round finalization (0.7.0). The moment the gate finished its last clean settlement pass past
+-- books_close_at, in ms since the epoch: from here chain_spent_wei cannot move. Null while a round is still
+-- settling, and on rounds a gate below 0.7.0 closed — nothing can reconstruct it for those.
+alter table rounds
+  add column if not exists settled_at bigint;
+
 create table if not exists balances (
   round_id text not null references rounds(id) on delete cascade,
   player   text not null,
@@ -103,27 +109,32 @@ create table if not exists balances (
   primary key (round_id, player)
 );
 
--- One row per authorisation ever issued. Nothing is deleted: a signature that exists in the world
--- cannot be un-issued, so the ledger records its fate instead of forgetting it.
-create table if not exists claims (
-  nonce         bigint generated always as identity primary key,
-  round_id      text not null references rounds(id) on delete cascade,
-  player        text not null,
-  request_id    varchar(128) not null check (request_id <> ''),
-  requested_wei numeric(78,0) not null check (requested_wei > 0),
-  wei           numeric(78,0) not null check (wei > 0 and wei <= requested_wei),
-  -- Held or released, and nothing else. Whether a swap LANDED is the chain's to say, not ours.
-  status        text not null check (status in ('held', 'released')),
-  deadline      bigint not null,
-  -- Persisted before a payload leaves the gate. Until signing completes, both values are null.
-  signature     text,
-  signer        text,
-  created_at    timestamptz not null default now(),
-  constraint claims_by_request unique (round_id, player, request_id),
-  constraint claims_signature_pair check ((signature is null) = (signer is null))
+-- One row per signed authorisation, kept only so a retried or replica-raced request returns the
+-- exact bytes already handed out. Nothing here is a reservation: the signature carries a
+-- cumulative ceiling the calculator compares against its own walletSpentWei, so an unused one
+-- costs nothing and there is no fate to record.
+create table if not exists authorisations (
+  round_id          text not null references rounds(id) on delete cascade,
+  player            text not null,
+  request_id        varchar(128) not null check (request_id <> ''),
+  -- What the caller asked for, so a retry with a different amount is refused, not silently served.
+  requested_wei     numeric(78,0) not null check (requested_wei > 0),
+  -- The signed field: min(earned, wallet cap) at issue, in the round's spend-token base units.
+  spend_ceiling_wei numeric(78,0) not null check (spend_ceiling_wei > 0),
+  -- The exact-in amount the caller intended, clamped to what was available. Echoed, not signed.
+  spend_wei         numeric(78,0) not null check (spend_wei > 0 and spend_wei <= spend_ceiling_wei),
+  deadline          bigint not null,
+  signature         text not null,
+  signer            text not null,
+  created_at        timestamptz not null default now(),
+  primary key (round_id, player, request_id)
 );
 
-create index if not exists claims_by_player on claims (round_id, player) where status = 'held';
+-- 0.7.0 hard cutover. Holds no longer exist, and every row the old table could carry was signed
+-- under the version 1 calculator domain that a 0.7.0 gate cannot serve. Dropping it is the honest
+-- migration; a gate should not be upgraded until every live round has passed its books close.
+drop index if exists claims_by_player;
+drop table if exists claims;
 
 -- Trusted creator servers use one stable event id for every score increment. The event and the
 -- balance update commit together, so a retry can recover the first result without paying twice.
@@ -147,10 +158,17 @@ create table if not exists registrations (
   game_server_origins text[] not null default '{}'::text[],
   disabled_at timestamptz,
   updated_at  timestamptz not null default now(),
-  constraint registrations_game_server_origins_bounded check (cardinality(game_server_origins) <= 4),
+  constraint registrations_game_server_origins_bounded check (cardinality(game_server_origins) <= 32),
   primary key (chain_id, coin)
 );
 
+-- 0.7.1 raised the reviewed origin bound from four to thirty-two: twenty game servers plus the
+-- other-chain gate origins a platform folds into the same list. The create table above only runs
+-- for a new database, so rewrite the check in place for a gate that already has the table.
+alter table registrations drop constraint if exists registrations_game_server_origins_bounded;
+alter table registrations
+  add constraint registrations_game_server_origins_bounded check (cardinality(game_server_origins) <= 32);
+
 -- Accepted play sessions: one row per wallet and round, keyed by a hash of both so a wallet is never
 -- stored in the clear. Independent of scoring and of websocket reconnects. play_tracking records
 -- when this gate began counting, so a dashboard can tell "no plays" from "not yet tracked".

package/dist/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyKrB,CAAC;AAEF,MAAM,cAAc,GAAG;;EAErB,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAI,IAAU,EAAE,EAAkC;IACnF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5B,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACzB,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,+BAA+B;QACjC,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,OAAO,EAAE,CAAC;IACf,CAAC;AACH,CAAC;AAED,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAU;IACtC,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QACrC,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAC/B,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,KAAyC,EAAU,EAAE,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC"}
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2LrB,CAAC;AAEF,MAAM,cAAc,GAAG;;EAErB,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAI,IAAU,EAAE,EAAkC;IACnF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5B,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACzB,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,+BAA+B;QACjC,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,OAAO,EAAE,CAAC;IACf,CAAC;AACH,CAAC;AAED,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAU;IACtC,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QACrC,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAC/B,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,KAAyC,EAAU,EAAE,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC"}

package/dist/version.js

@@ -1,6 +1,6 @@
 // Generated by scripts/write-version.mjs from package.json at build time. Do not edit.
 /** The published version of @flayerlabs/gamemode-gate, as a literal so it survives any bundler. */
-export const GATE_VERSION = "0.6.0";
+export const GATE_VERSION = "0.7.1";
 /** `@flayerlabs/gamemode-gate@<version>`: the text a build of this package can be searched for. */
-export const GATE_MARKER = "@flayerlabs/gamemode-gate@0.6.0";
+export const GATE_MARKER = "@flayerlabs/gamemode-gate@0.7.1";
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flayerlabs/gamemode-gate",
-  "version": "0.6.0",
+  "version": "0.7.1",
   "description": "Server-authoritative rooms, economy, admission and registry for Flaunch Game Modes",
   "license": "MIT",
   "author": "Flayer Labs",
@@ -45,7 +45,7 @@
   "dependencies": {
     "@fastify/cors": "^11.3.0",
     "@fastify/websocket": "^11.3.0",
-    "@flayerlabs/gamemode-spec": "^0.6.0",
+    "@flayerlabs/gamemode-spec": "^0.7.1",
     "@types/node": "^22.10.2",
     "@types/pg": "^8.21.0",
     "fastify": "^5.11.3",

package/src/chain/chains.ts

@@ -102,7 +102,9 @@ export const PAIRED_DEPLOYMENTS: Record<number, GateDeployment> = {
    */
   84532: {
     positionManager: '0x8D346f24278C5CD786309161aAC0fC2bbe4c25dc',
-    spendGatedCalculator: '0x54cdcf0bcbc3a33f470e07134c10582f93058a32',
+    // v2 (cumulative spend ceilings, domain version 2), deployed 2026-09-14 at block 46822712 on the
+    // same dispatcher as v1 0x54cdcf0b…, which stays registered for pools launched before it.
+    spendGatedCalculator: '0x8a36826253882c8b505d6d78a71b780ac9c98ea9',
     flaunchVariant: 'v1_3',
     poolSwap: '0xf0f388a31a1745a5e2378b812ed51525f70595be',
     fleth: '0x79FC52701cD4BE6f9Ba9aDC94c207DE37e3314eb',

package/src/chain/signer.ts

@@ -3,15 +3,19 @@ import { privateKeyToAccount, type PrivateKeyAccount } from 'viem/accounts';
 import { gateReadinessTypedData, READINESS_TTL_SECONDS, type GateReadiness, spendAuthorisationTypedData } from '@flayerlabs/gamemode-spec/embed';
 
 /**
- * Issues the signed authorizations SpendGatedSignerFeeCalculator.trackSwap verifies.
+ * Issues the signed authorisations SpendGatedSignerFeeCalculator.trackSwap verifies.
  *
- * EIP-712, over the `SpendAuthorization` struct the calculator declares. It used to be an
- * EIP-191 personal-sign over `keccak256(abi.encodePacked(...))`, which committed to the five
- * fields and nothing else — no chain id, no verifying contract. An audit flagged that as the
- * same defect already raised against the parent calculator (M-6, remediated there in the
- * EIP-712 PR but never ported to this fork): the protocol deploys deterministically across
- * chains, so the same poolId genuinely recurs, and one signing key shared between two
- * environments made an authorization issued for one valid on the other. The domain closes it.
+ * EIP-712, over the `SpendAuthorization` struct the calculator declares, under the
+ * `FlaunchSpendGate` version `2` domain. The struct carries a cumulative ceiling: the most this
+ * buyer may EVER have spent on this pool, which the calculator compares against its own
+ * `walletSpentWei` accumulator. There is no nonce and no per-purchase amount, because there is
+ * nothing to consume — two authorisations with the same ceiling cannot add up, so reusing one is
+ * harmless by construction and the gate holds nothing against it.
+ *
+ * The domain matters: the protocol deploys deterministically across chains, so the same poolId
+ * genuinely recurs, and one signing key shared between two environments would otherwise make an
+ * authorisation issued for one valid on the other. Version `2` also keeps 0.5.x signatures (a
+ * five-field struct with a nonce) from verifying on this calculator and vice versa.
  *
  * The digest MUST match `hashSpendAuthorization` on the calculator exactly. That function is
  * public for this reason — a domain drift is otherwise a silent `InvalidSigner` at swap time
@@ -22,8 +26,7 @@ export interface SignedPayload {
   buyer: `0x${string}`;
   poolId: `0x${string}`;
   deadline: bigint;
-  maxSpendWei: bigint;
-  nonce: bigint;
+  spendCeilingWei: bigint;
   signature: `0x${string}`;
   signer: `0x${string}`;
 }
@@ -62,15 +65,10 @@ export class PayloadSigner {
     buyer: `0x${string}`,
     poolId: `0x${string}`,
     deadline: bigint,
-    maxSpendWei: bigint,
-    nonce: bigint,
+    spendCeilingWei: bigint,
   ): `0x${string}` {
     return hashTypedData(
-      spendAuthorisationTypedData(
-        { buyer, poolId, deadline, maxSpendWei, nonce },
-        this.chainId,
-        this.verifyingContract,
-      ),
+      spendAuthorisationTypedData({ buyer, poolId, deadline, spendCeilingWei }, this.chainId, this.verifyingContract),
     );
   }
 
@@ -78,23 +76,21 @@ export class PayloadSigner {
     buyer: `0x${string}`,
     poolId: `0x${string}`,
     deadline: bigint,
-    maxSpendWei: bigint,
-    nonce: bigint,
+    spendCeilingWei: bigint,
   ): Promise<SignedPayload> {
     const signature = await this.account.signTypedData(
-      spendAuthorisationTypedData(
-        { buyer, poolId, deadline, maxSpendWei, nonce },
-        this.chainId,
-        this.verifyingContract,
-      ),
+      spendAuthorisationTypedData({ buyer, poolId, deadline, spendCeilingWei }, this.chainId, this.verifyingContract),
     );
-    return { buyer, poolId, deadline, maxSpendWei, nonce, signature, signer: this.account.address };
+    return { buyer, poolId, deadline, spendCeilingWei, signature, signer: this.account.address };
   }
 }
 
 /**
  * Encodes a signed payload as the hookData the swap must carry:
- * `abi.encode(address referrer, SignedMessage{buyer, poolId, deadline, maxSpendWei, nonce, signature})`
+ * `abi.encode(address referrer, SignedMessage{buyer, poolId, deadline, spendCeilingWei, signature})`
+ *
+ * The referrer word is always zero. The calculator ignores it, but the trusted page checks it, so
+ * a creator iframe cannot redirect attribution while keeping a valid signature.
  */
 export function encodeHookData(payload: SignedPayload): `0x${string}` {
   return encodeAbiParameters(
@@ -106,8 +102,7 @@ export function encodeHookData(payload: SignedPayload): `0x${string}` {
           { name: 'buyer', type: 'address' },
           { name: 'poolId', type: 'bytes32' },
           { name: 'deadline', type: 'uint256' },
-          { name: 'maxSpendWei', type: 'uint256' },
-          { name: 'nonce', type: 'uint256' },
+          { name: 'spendCeilingWei', type: 'uint256' },
           { name: 'signature', type: 'bytes' },
         ],
       },
@@ -118,8 +113,7 @@ export function encodeHookData(payload: SignedPayload): `0x${string}` {
         buyer: payload.buyer,
         poolId: payload.poolId,
         deadline: payload.deadline,
-        maxSpendWei: payload.maxSpendWei,
-        nonce: payload.nonce,
+        spendCeilingWei: payload.spendCeilingWei,
         signature: payload.signature,
       },
     ],

package/src/claims.ts

@@ -2,26 +2,23 @@ import type { Pool } from 'pg';
 import type { PlayerId } from '@flayerlabs/gamemode-spec';
 import type { EconomyBalance } from '@flayerlabs/gamemode-spec/live';
 import { maxUint256 } from 'viem';
-import { Ledger, type BalanceKey, type Claim } from './ledger.js';
+import { Ledger, type Authorisation as StoredAuthorisation } from './ledger.js';
 import type { PayloadSigner, SignedPayload } from './chain/signer.js';
 
 /**
  * Turning points into something a player can actually spend.
  *
  * Two parties have to agree before a buy can happen, and they check different things. The ledger
- * knows what this player earned and what they have already been authorised for. The signer knows
- * whether it is willing to vouch for this pool at all. Only when both say yes does an
- * authorisation exist.
+ * knows what this player earned and what the chain says they have spent. The signer knows whether
+ * it is willing to vouch for this pool at all. Only when both say yes does an authorisation exist.
  *
- * The order matters and is not interchangeable: the hold is recorded first, then signed. A
- * signature that exists without a hold is spending nobody is tracking; a hold without a signature
- * is a refund waiting to happen. Only one of those costs money.
+ * What gets signed is a ceiling, not a purchase: the most this wallet may ever have spent on the
+ * pool. The calculator compares it against its own running total, so the gate reserves nothing
+ * and a signature that is never used costs nobody anything. The one thing this file must get
+ * right is idempotency — a retried request must receive the same bytes — and that is a primary
+ * key, not a lock.
  */
 
-/** How long an authorisation stays valid. Long enough to approve in a wallet, short enough that an
- *  abandoned one does not sit around spendable. */
-export const CLAIM_AUTHORIZATION_TTL_MS = 5 * 60_000;
-const DEADLINE_SECONDS = CLAIM_AUTHORIZATION_TTL_MS / 1_000;
 const REQUEST_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
 
 /** Request ids cross an unauthenticated parser before they reach Postgres, so bound them here too. */
@@ -35,7 +32,7 @@ export function isClaimAmount(value: unknown): value is bigint {
 }
 
 export type Authorisation =
-  | { ok: true; payload: SignedPayload }
+  | { ok: true; payload: SignedPayload; /** Exact-in amount for this buy, clamped to what was available. */ spend: bigint }
   | { ok: false; refuse: string };
 
 export class Claims {
@@ -43,76 +40,68 @@ export class Claims {
     private readonly pool: Pool,
     private readonly ledger: Ledger,
     private readonly signer: PayloadSigner,
-    /** Called when a hold could neither be signed nor released, and needs a human. */
-    private readonly onStrandedHold?: (nonce: bigint, error: unknown) => void,
     /** An internal seam for exact window-boundary tests. Production uses the process clock. */
     private readonly now: () => number = Date.now,
   ) {}
 
   /**
-   * Authorise a player to spend up to `upToWei`, or explain why not.
+   * Authorise a player to spend up to `spendWei`, or explain why not.
    *
-   * The ledger's ceiling is a conservative mirror of the chain's: the contract tracks
-   * `walletSpentWei` per pool per wallet and enforces it whatever we believe. Being ahead of the
-   * chain is safe — we simply authorise less than we could. Being behind it would mean issuing a
-   * signature that reverts at the swap, which to a player is indistinguishable from being robbed.
+   * Returns the largest amount available rather than refusing an over-ask: a player pressing buy
+   * wants to spend what they have, and telling them "you asked for too much" when they asked for
+   * everything is a worse product than giving them everything. The ceiling in the signature is the
+   * same either way — it is what they have earned, not what they asked for.
+   *
+   * The ledger's view of spend is a conservative mirror of the chain's. Being behind it means
+   * signing a ceiling the calculator will refuse at the swap, which to a player is
+   * indistinguishable from being robbed; settlement keeps the gap to one reconciliation pass.
    */
-  async authorise(roundId: string, player: PlayerId, upToWei: bigint, requestId: string): Promise<Authorisation> {
+  async authorise(roundId: string, player: PlayerId, spendWei: bigint, requestId: string): Promise<Authorisation> {
     if (!isClaimRequestId(requestId)) return { ok: false, refuse: 'claim.request_invalid' };
-    if (!isClaimAmount(upToWei)) return { ok: false, refuse: 'claim.amount_invalid' };
+    if (!isClaimAmount(spendWei)) return { ok: false, refuse: 'claim.amount_invalid' };
 
     const round = await this.pool.query<{ pool_id: string }>(`select pool_id from rounds where id = $1`, [roundId]);
     const row = round.rows[0];
     if (!row) return { ok: false, refuse: 'claim.no_such_round' };
+    const poolId = row.pool_id as `0x${string}`;
 
-    // The deadline is decided before the hold so both agree on when it stops being spendable.
-    const now = this.now();
-    const deadline = BigInt(Math.floor(now / 1000) + DEADLINE_SECONDS);
-    // Idempotency and the clock are decided under the same player lock. If an accepted request is
-    // still committing at the buzzer, a retry waits for it and recovers it rather than observing
-    // no row outside the transaction and being refused as a new, late request.
-    const held = await this.ledger.claim(roundId, player, upToWei, requestId, deadline, now);
-    if (!held.ok) return { ok: false, refuse: held.refuse };
+    // An existing request deliberately wins over the clock and the current balance: it was issued
+    // under the earlier call's window, and a retry must get the same answer.
+    const existing = await this.ledger.findAuthorisation(roundId, player, requestId);
+    if (existing) return this.answer(poolId, existing, spendWei);
 
-    // Another replica may have completed the request while this one waited for the balance lock.
-    if (held.claim.signature && held.claim.signer) {
-      return { ok: true, payload: payload(row.pool_id, held.claim) };
-    }
-    if (held.claim.status === 'released') return { ok: false, refuse: 'claim.request_released' };
-    return this.finish(row.pool_id, held.claim);
-  }
+    const quote = await this.ledger.quote(roundId, player, this.now());
+    if (!quote.ok) return { ok: false, refuse: quote.refuse };
 
-  private async finish(poolId: string, claim: Claim): Promise<Authorisation> {
-    try {
-      const candidate = await this.signer.sign(
-        claim.player as `0x${string}`,
-        poolId as `0x${string}`,
-        claim.deadline,
-        claim.wei,
-        claim.nonce,
-      );
-      // Never return bytes that were not durably recorded. Concurrent signers both return the one
-      // stored winner, so retries stay byte-identical even if an implementation signs randomly.
-      const completed = await this.ledger.completeClaim(claim.nonce, candidate.signature, candidate.signer);
-      if (!completed?.signature || !completed.signer) throw new Error('claim could not be completed');
-      return { ok: true, payload: payload(poolId, completed) };
-    } catch (error) {
-      // The hold was taken and nothing will ever be spent against it, so it goes back. Without
-      // this, a signer outage quietly eats a player's allowance for the rest of the round.
-      //
-      // If the release ALSO fails, the original error still wins. Replacing it with a database
-      // error would hide the reason and leave the nonce nowhere in the logs — so it is named here,
-      // because that number is what a person needs to give the allowance back by hand.
-      await this.ledger.releaseUnsigned(claim.nonce).catch((releaseError: unknown) => {
-        this.onStrandedHold?.(claim.nonce, releaseError);
-      });
-      throw error;
-    }
+    const spend = spendWei < quote.available ? spendWei : quote.available;
+    const signed = await this.signer.sign(player as `0x${string}`, poolId, quote.deadlineSeconds, quote.ceiling);
+    const stored = await this.ledger.storeAuthorisation(roundId, {
+      player,
+      requestId,
+      requestedWei: spendWei,
+      spendCeilingWei: signed.spendCeilingWei,
+      spendWei: spend,
+      deadline: signed.deadline,
+      signature: signed.signature,
+      signer: signed.signer,
+    });
+    return this.answer(poolId, stored, spendWei);
   }
 
-  /** Give back every authorisation that expired unspent. */
-  releaseExpired(): Promise<BalanceKey[]> {
-    return this.ledger.releaseExpired(Math.floor(this.now() / 1000));
+  private answer(poolId: `0x${string}`, stored: StoredAuthorisation, requestedWei: bigint): Authorisation {
+    if (stored.requestedWei !== requestedWei) return { ok: false, refuse: 'claim.request_mismatch' };
+    return {
+      ok: true,
+      payload: {
+        buyer: stored.player as `0x${string}`,
+        poolId,
+        deadline: stored.deadline,
+        spendCeilingWei: stored.spendCeilingWei,
+        signature: stored.signature,
+        signer: stored.signer,
+      },
+      spend: stored.spendWei,
+    };
   }
 
   /** What this player could spend right now. */
@@ -125,16 +114,3 @@ export class Claims {
     return this.ledger.economyBalance(roundId, player);
   }
 }
-
-function payload(poolId: string, claim: Claim): SignedPayload {
-  if (!claim.signature || !claim.signer) throw new Error('claim is not signed');
-  return {
-    buyer: claim.player as `0x${string}`,
-    poolId: poolId as `0x${string}`,
-    deadline: claim.deadline,
-    maxSpendWei: claim.wei,
-    nonce: claim.nonce,
-    signature: claim.signature,
-    signer: claim.signer,
-  };
-}

package/src/demo.ts

@@ -62,7 +62,7 @@ export interface Demo {
   /** The throwaway wallet standing in for the player's real one. */
   walletAddress: `0x${string}`;
   /** Everything the fake wallet was asked to buy, in order. Empty until somebody buys. */
-  purchases: { maxSpendWei: string; at: number }[];
+  purchases: { spend: string; at: number }[];
   pool: pg.Pool;
 }
 
@@ -160,7 +160,7 @@ export async function createDemoGate<Config, State, Event, Action, PublicView, P
   });
 
   const wallet = privateKeyToAccount(DEMO_WALLET_KEY);
-  const purchases: { maxSpendWei: string; at: number }[] = [];
+  const purchases: { spend: string; at: number }[] = [];
 
   // Standing in for the page a game is embedded in. In production this is flaunch.gg holding the
   // player's real wallet; here the signature is real and the purchase is only written down.
@@ -169,9 +169,9 @@ export async function createDemoGate<Config, State, Event, Action, PublicView, P
     signature: await wallet.signMessage({ message: (request.body as { message: string }).message }),
   }));
   app.post('/dev/wallet/buy', (request) => {
-    const { maxSpendWei } = request.body as { maxSpendWei: string };
-    purchases.push({ maxSpendWei, at: Date.now() });
-    return { spent: maxSpendWei };
+    const { spend } = request.body as { spend: string };
+    purchases.push({ spend, at: Date.now() });
+    return { spent: spend };
   });
 
   return { app, roundId, opensAt, walletAddress: wallet.address, purchases, pool };

package/src/index.ts

@@ -23,8 +23,7 @@ export { createTurnstileAdmit } from './turnstile.js';
 export type { TurnstileAdmitOptions } from './turnstile.js';
 
 export { Ledger } from './ledger.js';
-export type { BalanceKey, Claim, ClaimResult } from './ledger.js';
-export { CLAIM_AUTHORIZATION_TTL_MS } from './claims.js';
+export type { Authorisation, Quote } from './ledger.js';
 export { PayloadSigner, encodeHookData } from './chain/signer.js';
 export type { SignedPayload } from './chain/signer.js';
 export { Discovery, WiringCache, poolIdOf, resolvePositionManager, verifyLaunch } from './chain/discover.js';