@flayerlabs/gamemode-gate 0.7.0 → 0.8.0

package/src/server.ts

@@ -5,6 +5,7 @@ import { isAddress } from 'viem';
 import type { Pool } from 'pg';
 import type { Command, GameModule, PlayerId } from '@flayerlabs/gamemode-spec';
 import { isRefusal } from '@flayerlabs/gamemode-spec';
+import { MAX_GAME_SERVER_ORIGINS } from '@flayerlabs/gamemode-spec/embed';
 import type {
   EconomyBalance,
   PresenceState,
@@ -28,9 +29,10 @@ import { resolveEconomy } from './economy.js';
 import { encodeHookData } from './chain/signer.js';
 import { hasBearerToken } from './bearer.js';
 import { GameServerAwards, type GameServerAwardRequest } from './game-server-awards.js';
-import { issuePlayerJoinTicket } from './player-join-tickets.js';
+import { JoinTickets, type JoinTicketPolicy } from './join-ticket-ledger.js';
 import { gameServerOrigins } from './registry.js';
 import { GATE_VERSION } from './version.js';
+import { IpBlocks } from './ip-blocks.js';
 
 /**
  * The gate's door.
@@ -106,6 +108,17 @@ interface GateBaseOptions {
    * Omitted, everything is admitted, which is what a laptop and a test want.
    */
   admit?: Admit;
+  /**
+   * How many reverse proxies stand between the internet and this process.
+   *
+   * Zero, the default, reports the socket's own address, which is right only when nothing proxies
+   * the gate. Count every address between the player and the process: Railway is two (its public
+   * edge, then an internal router), and a CDN in front adds one. Set too low, players share a
+   * proxy's address and an IP policy refuses them together. Set too high, a caller chooses their
+   * own address with a header. Only safe when the process cannot be reached except through those
+   * proxies: a caller who connects directly can forge the whole chain.
+   */
+  trustedProxyHops?: number;
   /** The only cosmetic reaction IDs this game may broadcast. Omitted disables reactions. */
   reactionIds?: readonly string[];
 }
@@ -146,6 +159,8 @@ export interface GameServerGateOptions extends GateBaseOptions {
   awardToken: string;
   /** Reviewed HTTPS origins that may receive player join tickets. The gate origin is always allowed. */
   gameServerOrigins?: readonly string[];
+  /** How freely one wallet may be issued join tickets. Omitted, only the per-minute default applies. */
+  tickets?: JoinTicketPolicy;
 }
 
 /**
@@ -207,6 +222,20 @@ export interface GateAnnouncement {
   publicLaunchesOpen: boolean;
   /** This library has no private-lobby registrar; announced false so no page offers the toggle. */
   privateLaunches: boolean;
+  /**
+   * What the trusted parent must send as session evidence. Absent means sign-in needs none.
+   *
+   * Announced because the parent renders the widget, not the gate: without the site key in public
+   * config, a gate that verifies Turnstile refuses every sign-in from a page that cannot know to
+   * show one.
+   */
+  admission?: AdmissionAnnouncement;
+}
+
+/** The public half of a gate's admission policy. Never carries a secret. */
+export interface AdmissionAnnouncement {
+  /** Render a Cloudflare Turnstile widget with this site key and action; send its token as `evidence`. */
+  turnstile?: { siteKey: string; action: string };
 }
 
 /**
@@ -220,12 +249,18 @@ export interface ServedGateAnnouncement extends GateAnnouncement {
 
 /** Where an admission check is being made. Enough to tell a sign-in from a spend. */
 export interface AdmissionRequest {
-  /** `session` on sign-in, `action` on gameplay, `claim` when allowance is about to be committed. */
-  at: 'session' | 'action' | 'claim';
+  /**
+   * `session` on sign-in, `ticket` when a join ticket for an external game server is requested,
+   * `action` on gameplay, `claim` when allowance is about to be committed.
+   */
+  at: 'session' | 'ticket' | 'action' | 'claim';
   /** Null at `session`, because nobody has proved who they are yet. */
   player: PlayerId | null;
   roundId: string | null;
-  /** Straight from the socket, so a limiter can key on it. Absent behind some proxies. */
+  /**
+   * The caller's address, so a limiter can key on it. The socket's own unless `trustedProxyHops`
+   * says how many proxies to read past; behind a proxy with that left at zero this is the proxy.
+   */
   ip: string | null;
   /** Opaque and operator-defined: a captcha solution, a device token, whatever was sent. */
   evidence: unknown;
@@ -243,7 +278,10 @@ export type Admit = (request: AdmissionRequest) => Admission | Promise<Admission
 
 const ADMIT_ALL: Admit = () => ({ ok: true });
 
-/** What the socket says, which is only the truth when nothing is proxying in front of the gate. */
+/** More hops than any real deployment has; a larger number is a typo, not a topology. */
+export const MAX_TRUSTED_PROXY_HOPS = 8;
+
+/** Fastify resolves this through `trustProxy`, which `trustedProxyHops` sets. */
 const ipOf = (request: FastifyRequest): string | null => request.ip || null;
 
 /** Bigint has no JSON form, so terms cross as decimal strings, exactly as the economy balance does. */
@@ -309,6 +347,7 @@ type AdoptionResult<Config, State, Event, Action, PublicView, PlayerView> =
 interface AwardEndpoint {
   token: string;
   awards: GameServerAwards;
+  tickets: JoinTickets;
   ticketAudiences: ReadonlySet<string>;
 }
 
@@ -372,12 +411,17 @@ export function createGameServerGate(options: GameServerGateOptions): FastifyIns
     typeof maximum === 'function'
       ? async (launch) => ({ maxPointsPerPlayer: await maximum(launch) })
       : { maxPointsPerPlayer: maximum };
-  const ticketAudiences = new Set([options.sessions.origin, ...gameServerOrigins(options.gameServerOrigins)]);
-  const { gameId, maxPointsPerPlayer: _maximum, awardToken, gameServerOrigins: _origins, ...base } = options;
+  const ticketAudiences = new Set([options.sessions.origin, ...gameServerOrigins(options.gameServerOrigins, MAX_GAME_SERVER_ORIGINS)]);
+  const { gameId, maxPointsPerPlayer: _maximum, awardToken, gameServerOrigins: _origins, tickets, ...base } = options;
   return createGateRuntime(
     { ...base, game: gameServerModule(gameId), config },
     'external-server',
-    { token: awardToken, awards: new GameServerAwards(options.pool, gameId), ticketAudiences },
+    {
+      token: awardToken,
+      awards: new GameServerAwards(options.pool, gameId),
+      tickets: new JoinTickets(options.pool, gameId, tickets),
+      ticketAudiences,
+    },
   );
 }
 
@@ -387,7 +431,23 @@ function createGateRuntime<Config, State, Event, Action, PublicView, PlayerView>
   awardEndpoint?: AwardEndpoint,
 ): FastifyInstance {
   const { pool, game, sessions, claims, discovery, settlement } = options;
-  const admit = options.admit ?? ADMIT_ALL;
+  const operatorAdmit = options.admit ?? ADMIT_ALL;
+  const ipBlocks = new IpBlocks(pool);
+  const startedAt = Date.now();
+  const refused: Record<AdmissionRequest['at'], number> = { session: 0, ticket: 0, action: 0, claim: 0 };
+  /**
+   * The block list first, then the operator's policy, and every refusal counted.
+   *
+   * The block list is the gate's own because its record is the gate's own table. It is consulted
+   * before the operator's policy so a blocked caller costs no Turnstile check and no rate budget.
+   */
+  const admit: Admit = async (request) => {
+    const admission: Admission = (await ipBlocks.blocks(request.ip))
+      ? { ok: false, reason: 'you cannot play from this network' }
+      : await operatorAdmit(request);
+    if (!admission.ok) refused[request.at] += 1;
+    return admission;
+  };
   // Rules config is persisted as JSON, so a function here can only be the documented factory.
   const configIsFactory = typeof options.config === 'function';
   const allowedReactions = new Set(options.reactionIds ?? []);
@@ -398,8 +458,20 @@ function createGateRuntime<Config, State, Event, Action, PublicView, PlayerView>
   if (!Number.isSafeInteger(settlementTailMs) || settlementTailMs <= 0) {
     throw new RangeError('settlementTailMs must be a positive number of milliseconds');
   }
+  const trustedProxyHops = options.trustedProxyHops ?? 0;
+  if (!Number.isSafeInteger(trustedProxyHops) || trustedProxyHops < 0 || trustedProxyHops > MAX_TRUSTED_PROXY_HOPS) {
+    throw new RangeError(`trustedProxyHops must be an integer from 0 to ${MAX_TRUSTED_PROXY_HOPS}`);
+  }
   // A body limit costs nothing and is the cheapest protection against an endpoint that parses.
-  const app = Fastify({ logger: process.env.GATE_LOG === '1', bodyLimit: 64 * 1024 });
+  const app = Fastify({
+    logger: process.env.GATE_LOG === '1',
+    bodyLimit: 64 * 1024,
+    // A hop count, never `true`: trusting every forwarded header lets a caller name their own address.
+    // Passed as a function because Fastify refuses a bare number (from 5.12 it trusts nothing for
+    // one), on the grounds that a hop count cannot tell a proxy from a direct caller. That holds
+    // here too, and is why the option is documented as safe only behind the proxies it counts.
+    ...(trustedProxyHops > 0 ? { trustProxy: (_address: string, hop: number) => hop < trustedProxyHops } : {}),
+  });
   const rooms = new Map<string, Room<Config, State, Event, Action, PublicView, PlayerView>>();
   type Watcher = {
     viewer: PlayerId | null;
@@ -676,6 +748,9 @@ function createGateRuntime<Config, State, Event, Action, PublicView, PlayerView>
         total: row.total,
       })),
       lastRoundAt: totals.last_round_at === null ? null : Number(totals.last_round_at),
+      // Counted in memory since this process started, not lifetime: a refusal is not worth a write.
+      // Counts only, never reasons, so a caller cannot read a threshold off a public route.
+      admission: { since: startedAt, refused: { ...refused } },
       // The same version `/config` reports, so a dashboard already reading stats needs no second call.
       gateVersion: GATE_VERSION,
     };
@@ -825,16 +900,111 @@ function createGateRuntime<Config, State, Event, Action, PublicView, PlayerView>
       if (typeof audience !== 'string' || !awardEndpoint.ticketAudiences.has(audience)) {
         return reply.code(400).send({ message: 'that game server is not registered' });
       }
-      await recordPlaySession(pool, id, who);
-      return issuePlayerJoinTicket({
+      const admission = await admit({ at: 'ticket', player: who, roundId: id, ip: ipOf(request), evidence: undefined });
+      if (!admission.ok) return reply.code(403).send({ message: admission.reason });
+      const issued = await awardEndpoint.tickets.issue({
         awardToken: awardEndpoint.token,
         player: who,
-        gameId: game.id,
         roundId: id,
         audience,
         closesAt: room.window.closesAt,
         now,
       });
+      if (!issued.ok) {
+        // Sentences a player can act on. The thresholds stay here.
+        return reply.code(429).send({
+          message:
+            issued.refuse === 'ticket.seat_open'
+              ? 'you are already connected to this game'
+              : 'too many tries, wait a minute',
+        });
+      }
+      await recordPlaySession(pool, id, who);
+      return issued.ticket;
+    });
+
+    /**
+     * Accept a ticket a browser presented to the game server, exactly once.
+     *
+     * The gate does the whole check, so a server needs no MAC code and no replay cache: a second
+     * presentation of the same ticket is refused here.
+     */
+    app.post('/internal/rounds/:id/tickets/consume', async (request, reply) => {
+      if (!hasBearerToken(request.headers.authorization, awardEndpoint.token)) {
+        return reply.code(401).send({ message: 'game server authentication failed' });
+      }
+      const body = (request.body ?? {}) as { ticket?: unknown; audience?: unknown };
+      const result = await awardEndpoint.tickets.consume({
+        awardToken: awardEndpoint.token,
+        roundId: (request.params as { id: string }).id,
+        ticket: body.ticket,
+        audience: body.audience,
+      });
+      if (!result.ok) {
+        const status = result.refuse === 'ticket.invalid' ? 400 : result.refuse === 'ticket.no_such_round' ? 404 : 409;
+        return reply.code(status).send({ refuse: result.refuse });
+      }
+      return reply.header('cache-control', 'no-store').send({ ticket: result.ticket, otherOpen: result.otherOpen });
+    });
+
+    /** Give seats back: one ticket, one wallet's tickets, or every ticket in the round. */
+    app.post('/internal/rounds/:id/tickets/release', async (request, reply) => {
+      if (!hasBearerToken(request.headers.authorization, awardEndpoint.token)) {
+        return reply.code(401).send({ message: 'game server authentication failed' });
+      }
+      const result = await awardEndpoint.tickets.release((request.params as { id: string }).id, request.body);
+      if (!result.ok) {
+        return reply.code(result.refuse === 'ticket.invalid' ? 400 : 404).send({ refuse: result.refuse });
+      }
+      return { released: result.released };
+    });
+
+    /** What one wallet has been issued in a round, newest first, so a server can see who minted what. */
+    app.get('/internal/rounds/:id/tickets', async (request, reply) => {
+      if (!hasBearerToken(request.headers.authorization, awardEndpoint.token)) {
+        return reply.code(401).send({ message: 'game server authentication failed' });
+      }
+      const wallet = (request.query as { player?: unknown }).player;
+      if (typeof wallet !== 'string' || !isAddress(wallet, { strict: false })) {
+        return reply.code(400).send({ refuse: 'ticket.invalid' });
+      }
+      const tickets = await awardEndpoint.tickets.list((request.params as { id: string }).id, wallet);
+      if (!tickets) return reply.code(404).send({ refuse: 'ticket.no_such_round' });
+      return reply.header('cache-control', 'no-store').send({ tickets });
+    });
+
+    /**
+     * The gate's block list, for the game server that sees the abuse.
+     *
+     * A game server is where a cheat is noticed: it can block the address here and the gate stops
+     * issuing that address sessions and tickets, instead of the server refusing it one connection
+     * at a time.
+     */
+    app.get('/internal/admission/ip-blocks', async (request, reply) => {
+      if (!hasBearerToken(request.headers.authorization, awardEndpoint.token)) {
+        return reply.code(401).send({ message: 'game server authentication failed' });
+      }
+      return reply.header('cache-control', 'no-store').send({ blocks: await ipBlocks.list() });
+    });
+
+    app.put('/internal/admission/ip-blocks', async (request, reply) => {
+      if (!hasBearerToken(request.headers.authorization, awardEndpoint.token)) {
+        return reply.code(401).send({ message: 'game server authentication failed' });
+      }
+      const result = await ipBlocks.add((request.body ?? {}) as Record<string, unknown>);
+      if (!result.ok) {
+        return reply.code(result.refuse === 'ip_block.invalid' ? 400 : 409).send({ refuse: result.refuse });
+      }
+      return result.block;
+    });
+
+    app.delete('/internal/admission/ip-blocks', async (request, reply) => {
+      if (!hasBearerToken(request.headers.authorization, awardEndpoint.token)) {
+        return reply.code(401).send({ message: 'game server authentication failed' });
+      }
+      const removed = await ipBlocks.remove((request.query as { cidr?: unknown }).cidr);
+      if (removed === null) return reply.code(400).send({ refuse: 'ip_block.invalid' });
+      return { removed };
     });
 
     app.post('/internal/rounds/:id/awards', async (request, reply) => {
@@ -887,10 +1057,13 @@ function createGateRuntime<Config, State, Event, Action, PublicView, PlayerView>
 
       // `spent` rises whenever settlement sees a purchase land, so this answer is only true at the
       // moment it is read. Points are monotone; the wei beside them are not.
-      const balance = await claims.economyBalance(result.standing.roundId, result.standing.player);
+      const [balance, tickets] = await Promise.all([
+        claims.economyBalance(result.standing.roundId, result.standing.player),
+        awardEndpoint.tickets.counts(result.standing.roundId, result.standing.player),
+      ]);
       return reply
         .header('cache-control', 'no-store')
-        .send({ ...result.standing, economy: wireEconomy(balance) });
+        .send({ ...result.standing, economy: wireEconomy(balance), tickets });
     });
   }
 

package/src/store.ts

@@ -160,10 +160,17 @@ create table if not exists registrations (
   game_server_origins text[] not null default '{}'::text[],
   disabled_at timestamptz,
   updated_at  timestamptz not null default now(),
-  constraint registrations_game_server_origins_bounded check (cardinality(game_server_origins) <= 4),
+  constraint registrations_game_server_origins_bounded check (cardinality(game_server_origins) <= 32),
   primary key (chain_id, coin)
 );
 
+-- 0.7.1 raised the reviewed origin bound from four to thirty-two: twenty game servers plus the
+-- other-chain gate origins a platform folds into the same list. The create table above only runs
+-- for a new database, so rewrite the check in place for a gate that already has the table.
+alter table registrations drop constraint if exists registrations_game_server_origins_bounded;
+alter table registrations
+  add constraint registrations_game_server_origins_bounded check (cardinality(game_server_origins) <= 32);
+
 -- Accepted play sessions: one row per wallet and round, keyed by a hash of both so a wallet is never
 -- stored in the clear. Independent of scoring and of websocket reconnects. play_tracking records
 -- when this gate began counting, so a dashboard can tell "no plays" from "not yet tracked".
@@ -179,6 +186,31 @@ create table if not exists play_tracking (
 );
 insert into play_tracking(id, started_at) values (true, (extract(epoch from clock_timestamp()) * 1000)::bigint) on conflict do nothing;
 
+-- Every join ticket the gate signs for an external game server, and what became of it. The wallet
+-- is stored in the clear, as balances and award_events store it: the game server that owns the
+-- connection asks by wallet. consumed_at is set once, by the server accepting the ticket;
+-- released_at by the server giving the seat back, or voiding a ticket nobody presented.
+create table if not exists join_tickets (
+  jti         varchar(128) primary key check (jti <> ''),
+  round_id    text not null references rounds(id) on delete cascade,
+  player      text not null,
+  audience    text not null check (audience <> ''),
+  issued_at   bigint not null,
+  expires_at  bigint not null check (expires_at > issued_at),
+  consumed_at bigint,
+  released_at bigint
+);
+create index if not exists join_tickets_round_player_idx on join_tickets(round_id, player, issued_at);
+
+-- Addresses and networks the operator refuses. Postgres canonicalises and deduplicates the network;
+-- the gate matches requests against an in-memory copy.
+create table if not exists ip_blocks (
+  cidr       cidr primary key,
+  reason     varchar(200),
+  created_at bigint not null,
+  expires_at bigint
+);
+
 -- What actually happened, in order. Not used to rebuild state — the snapshot does that — but it is
 -- the record of why a state looks the way it does, which is what an incident needs.
 create table if not exists commands (

package/src/turnstile.ts

@@ -1,10 +1,27 @@
-import type { Admit } from './server.js';
+import type { AdmissionAnnouncement, Admit } from './server.js';
 
 const SITEVERIFY = 'https://challenges.cloudflare.com/turnstile/v0/siteverify';
 const MAX_TOKEN_LENGTH = 2_048;
 const DEFAULT_TIMEOUT_MS = 8_000;
 const FAILURE = { ok: false, reason: 'human verification failed, please try again' } as const;
 
+/**
+ * Cloudflare's published testing secrets: always pass, always fail, and "token already spent".
+ *
+ * Siteverify answers them with hostname `example.com` and no action, whatever page rendered the
+ * widget, so the hostname and action pins cannot hold and are skipped for exactly these secrets.
+ * Keyed on the configured secret, never on the response: a production secret rejects a testing
+ * token outright, so nothing a caller sends can switch the pins off.
+ */
+const TESTING_SECRETS: ReadonlySet<string> = new Set([
+  '1x0000000000000000000000000000000AA',
+  '2x0000000000000000000000000000000AA',
+  '3x0000000000000000000000000000000AA',
+]);
+
+/** Whether a secret is one of Cloudflare's testing secrets, which verify nothing about a caller. */
+export const isTurnstileTestingSecret = (secret: string): boolean => TESTING_SECRETS.has(secret);
+
 export interface TurnstileAdmitOptions {
   secret: string;
   /** Exact hostnames on which the trusted parent may render the widget. */
@@ -32,6 +49,7 @@ export function createTurnstileAdmit(options: TurnstileAdmitOptions): Admit {
     throw new RangeError('Turnstile timeoutMs must be a positive safe integer');
   }
   const verify = options.fetch ?? globalThis.fetch;
+  const testing = isTurnstileTestingSecret(options.secret);
 
   return async (request) => {
     if (request.at !== 'session') return { ok: true };
@@ -58,8 +76,9 @@ export function createTurnstileAdmit(options: TurnstileAdmitOptions): Admit {
       });
       if (!response.ok) return FAILURE;
       const result = (await response.json()) as { success?: unknown; hostname?: unknown; action?: unknown };
+      if (result.success !== true) return FAILURE;
+      if (testing) return { ok: true };
       if (
-        result.success !== true ||
         typeof result.hostname !== 'string' ||
         !hostnames.has(result.hostname.toLowerCase()) ||
         result.action !== options.action
@@ -72,3 +91,78 @@ export function createTurnstileAdmit(options: TurnstileAdmitOptions): Admit {
     }
   };
 }
+
+type Env = Record<string, string | undefined>;
+
+/** A Turnstile widget and the secret that verifies it, as one operator-supplied unit. */
+export interface TurnstileConfig {
+  secret: string;
+  /** Public. The trusted parent renders the widget with it. */
+  siteKey: string;
+  action: string;
+  hostnames: readonly string[];
+}
+
+const DEFAULT_ACTION = 'game-session';
+const SITE_KEY = /^[A-Za-z0-9_-]{1,128}$/;
+// Cloudflare's own bound on a widget action.
+const ACTION = /^[A-Za-z0-9_-]{1,32}$/;
+const HOSTNAME = /^[a-z0-9]([a-z0-9.-]{0,251}[a-z0-9])?$/;
+
+/**
+ * Read a Turnstile widget from the environment, or null when none is configured.
+ *
+ *   TURNSTILE_SITE_KEY   the widget's public site key, announced in `/config`
+ *   TURNSTILE_SECRET     the widget's secret, never announced
+ *   TURNSTILE_ACTION     default `game-session`
+ *   TURNSTILE_HOSTNAMES  comma-separated hostnames the widget may render on; defaults to the
+ *                        host of `signInDomain`, the page the player is looking at
+ *
+ * Half a pair is refused rather than ignored. A secret without a site key verifies tokens no page
+ * was told to fetch, so every sign-in fails; a site key without a secret shows a challenge nobody
+ * checks, which looks like protection and is none.
+ */
+export function resolveTurnstileEnv(env: Env, signInDomain: string): TurnstileConfig | null {
+  const secret = env['TURNSTILE_SECRET'] || undefined;
+  const siteKey = env['TURNSTILE_SITE_KEY'] || undefined;
+  if (!secret && !siteKey) return null;
+  if (!secret || !siteKey) {
+    throw new Error('TURNSTILE_SECRET and TURNSTILE_SITE_KEY must be set together, from the same widget');
+  }
+  if (!SITE_KEY.test(siteKey)) throw new Error('TURNSTILE_SITE_KEY is not a Turnstile site key');
+  const action = env['TURNSTILE_ACTION'] || DEFAULT_ACTION;
+  if (!ACTION.test(action)) {
+    throw new Error('TURNSTILE_ACTION must be 1 to 32 letters, digits, underscores or hyphens');
+  }
+  // SIGN_IN_DOMAIN may carry a port in development; a Turnstile hostname never does.
+  const hostnames = (env['TURNSTILE_HOSTNAMES'] || signInDomain.replace(/:\d+$/, ''))
+    .split(',')
+    .map((hostname) => hostname.trim().toLowerCase())
+    .filter((hostname) => hostname.length > 0);
+  if (hostnames.length === 0 || hostnames.some((hostname) => !HOSTNAME.test(hostname))) {
+    throw new Error('TURNSTILE_HOSTNAMES must be comma-separated hostnames, without a scheme, port or path');
+  }
+  return { secret, siteKey, action, hostnames };
+}
+
+/**
+ * The two halves of one Turnstile policy: what the gate enforces and what it tells the parent.
+ *
+ * Built together so they cannot disagree. Pass `admit` to the gate and put `admission` in the
+ * announcement served at `/config`.
+ */
+export function turnstileAdmission(
+  config: TurnstileConfig,
+  options: Pick<TurnstileAdmitOptions, 'fetch' | 'timeoutMs'> = {},
+): { admit: Admit; admission: AdmissionAnnouncement } {
+  if (!SITE_KEY.test(config.siteKey)) throw new RangeError('Turnstile siteKey is not a site key');
+  return {
+    admit: createTurnstileAdmit({
+      secret: config.secret,
+      hostnames: config.hostnames,
+      action: config.action,
+      ...options,
+    }),
+    admission: { turnstile: { siteKey: config.siteKey, action: config.action } },
+  };
+}

package/src/version.ts

@@ -1,5 +1,5 @@
 // Generated by scripts/write-version.mjs from package.json at build time. Do not edit.
 /** The published version of @flayerlabs/gamemode-gate, as a literal so it survives any bundler. */
-export const GATE_VERSION: string = "0.7.0";
+export const GATE_VERSION: string = "0.8.0";
 /** `@flayerlabs/gamemode-gate@<version>`: the text a build of this package can be searched for. */
-export const GATE_MARKER: string = "@flayerlabs/gamemode-gate@0.7.0";
+export const GATE_MARKER: string = "@flayerlabs/gamemode-gate@0.8.0";