@flayerlabs/gamemode-gate 0.7.1 → 0.8.0

package/dist/ip-blocks.js

@@ -0,0 +1,125 @@
+import { BlockList, isIP } from 'node:net';
+import { normaliseIp } from './admission.js';
+/** A list longer than this is a job for a firewall in front of the gate, not a table inside it. */
+export const MAX_IP_BLOCKS = 10_000;
+const MAX_REASON_LENGTH = 200;
+const DEFAULT_REFRESH_MS = 30_000;
+const block = (row) => ({
+    cidr: row.cidr,
+    reason: row.reason,
+    createdAt: Number(row.created_at),
+    expiresAt: row.expires_at === null ? null : Number(row.expires_at),
+});
+/** An address or a network in CIDR form, or null. Host bits are allowed here and cleared on write. */
+function parseCidr(value) {
+    if (typeof value !== 'string' || value.length === 0 || value.length > 64)
+        return null;
+    const [address, prefixText, ...rest] = value.trim().split('/');
+    if (!address || rest.length > 0)
+        return null;
+    const family = isIP(address);
+    if (family !== 4 && family !== 6)
+        return null;
+    const widest = family === 4 ? 32 : 128;
+    if (prefixText === undefined)
+        return { address, prefix: widest, family };
+    if (!/^\d{1,3}$/.test(prefixText))
+        return null;
+    const prefix = Number(prefixText);
+    // /0 would block every caller. That is turning the gate off, and not what a block list is for.
+    if (prefix < 1 || prefix > widest)
+        return null;
+    return { address, prefix, family };
+}
+/**
+ * Addresses and networks this gate refuses, kept in Postgres and matched in memory.
+ *
+ * The table is the record; the in-memory list is what a request is checked against, because an
+ * admission check runs on every action and a query per action is not affordable. The list is
+ * rebuilt after every write through this instance and at most every `refreshMs` otherwise, so a
+ * block written by another process takes effect within that interval.
+ */
+export class IpBlocks {
+    pool;
+    refreshMs;
+    matcher = new BlockList();
+    loadedAt = -Infinity;
+    loading = null;
+    constructor(pool, refreshMs = DEFAULT_REFRESH_MS) {
+        this.pool = pool;
+        this.refreshMs = refreshMs;
+    }
+    /** Whether an address is blocked. Loads the list on first use and refreshes it when stale. */
+    async blocks(ip, now = Date.now()) {
+        if (!ip)
+            return false;
+        if (this.loadedAt === -Infinity)
+            await this.reload(now);
+        // A stale list is refreshed behind the request: the answer is at most one interval old.
+        else if (now - this.loadedAt >= this.refreshMs)
+            void this.reload(now).catch(() => undefined);
+        const address = normaliseIp(ip);
+        const family = isIP(address);
+        if (family !== 4 && family !== 6)
+            return false;
+        return this.matcher.check(address, family === 4 ? 'ipv4' : 'ipv6');
+    }
+    /** Block an address or network. Blocking it again updates the reason and expiry. */
+    async add(input, now = Date.now()) {
+        const parsed = parseCidr(input?.cidr);
+        const reason = input?.reason ?? null;
+        const expiresAt = input?.expiresAt ?? null;
+        if (!parsed ||
+            (reason !== null && (typeof reason !== 'string' || reason.length > MAX_REASON_LENGTH)) ||
+            (expiresAt !== null && (!Number.isSafeInteger(expiresAt) || expiresAt <= now))) {
+            return { ok: false, refuse: 'ip_block.invalid' };
+        }
+        const result = await this.pool.query(`insert into ip_blocks (cidr, reason, created_at, expires_at)
+       select network(set_masklen($1::inet, $2)), $3, $4, $5
+       where (select count(*) from ip_blocks) < $6
+          or exists (select 1 from ip_blocks where cidr = network(set_masklen($1::inet, $2)))
+       on conflict (cidr) do update set reason = excluded.reason, expires_at = excluded.expires_at
+       returning cidr::text, reason, created_at, expires_at`, [parsed.address, parsed.prefix, reason, now, expiresAt, MAX_IP_BLOCKS]);
+        const row = result.rows[0];
+        if (!row)
+            return { ok: false, refuse: 'ip_block.limit_exceeded' };
+        await this.reload(now);
+        return { ok: true, block: block(row) };
+    }
+    /** Remove a block. True if there was one. */
+    async remove(cidr, now = Date.now()) {
+        const parsed = parseCidr(cidr);
+        if (!parsed)
+            return null;
+        const result = await this.pool.query('delete from ip_blocks where cidr = network(set_masklen($1::inet, $2))', [parsed.address, parsed.prefix]);
+        await this.reload(now);
+        return (result.rowCount ?? 0) > 0;
+    }
+    /** Every block still in force, newest first. */
+    async list(now = Date.now()) {
+        const result = await this.pool.query(`select cidr::text, reason, created_at, expires_at from ip_blocks
+       where expires_at is null or expires_at > $1
+       order by created_at desc, cidr`, [now]);
+        return result.rows.map(block);
+    }
+    reload(now) {
+        this.loading ??= (async () => {
+            try {
+                // Expired rows are cleared here rather than by a timer: a gate nobody calls has no work to do.
+                await this.pool.query('delete from ip_blocks where expires_at is not null and expires_at <= $1', [now]);
+                const rows = await this.pool.query('select host(cidr) as address, masklen(cidr) as prefix, family(cidr) as family from ip_blocks');
+                const next = new BlockList();
+                for (const row of rows.rows) {
+                    next.addSubnet(row.address, Number(row.prefix), Number(row.family) === 4 ? 'ipv4' : 'ipv6');
+                }
+                this.matcher = next;
+                this.loadedAt = now;
+            }
+            finally {
+                this.loading = null;
+            }
+        })();
+        return this.loading;
+    }
+}
+//# sourceMappingURL=ip-blocks.js.map

package/dist/ip-blocks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ip-blocks.js","sourceRoot":"","sources":["../src/ip-blocks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAE3C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,mGAAmG;AACnG,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC;AACpC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAuBlC,MAAM,KAAK,GAAG,CAAC,GAAgB,EAAW,EAAE,CAAC,CAAC;IAC5C,IAAI,EAAE,GAAG,CAAC,IAAI;IACd,MAAM,EAAE,GAAG,CAAC,MAAM;IAClB,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;IACjC,SAAS,EAAE,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;CACnE,CAAC,CAAC;AAEH,sGAAsG;AACtG,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IACtF,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/D,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IACvC,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACzE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAClC,+FAA+F;IAC/F,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,MAAM;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,QAAQ;IAMA;IACA;IANX,OAAO,GAAG,IAAI,SAAS,EAAE,CAAC;IAC1B,QAAQ,GAAG,CAAC,QAAQ,CAAC;IACrB,OAAO,GAAyB,IAAI,CAAC;IAE7C,YACmB,IAAU,EACV,YAAY,kBAAkB;QAD9B,SAAI,GAAJ,IAAI,CAAM;QACV,cAAS,GAAT,SAAS,CAAqB;IAC9C,CAAC;IAEJ,8FAA8F;IAC9F,KAAK,CAAC,MAAM,CAAC,EAAiB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QAC9C,IAAI,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QACtB,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,QAAQ;YAAE,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxD,wFAAwF;aACnF,IAAI,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS;YAAE,KAAK,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC7F,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACrE,CAAC;IAED,oFAAoF;IACpF,KAAK,CAAC,GAAG,CAAC,KAAgE,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QAC1F,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,KAAK,EAAE,MAAM,IAAI,IAAI,CAAC;QACrC,MAAM,SAAS,GAAG,KAAK,EAAE,SAAS,IAAI,IAAI,CAAC;QAC3C,IACE,CAAC,MAAM;YACP,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,iBAAiB,CAAC,CAAC;YACtF,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAK,SAAoB,IAAI,GAAG,CAAC,CAAC,EAC1F,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACnD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAClC;;;;;4DAKsD,EACtD,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,aAAa,CAAC,CACvE,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;QAClE,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;IACzC,CAAC;IAED,6CAA6C;IAC7C,KAAK,CAAC,MAAM,CAAC,IAAa,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAClC,uEAAuE,EACvE,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAChC,CAAC;QACF,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IAED,gDAAgD;IAChD,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAClC;;sCAEgC,EAChC,CAAC,GAAG,CAAC,CACN,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAEO,MAAM,CAAC,GAAW;QACxB,IAAI,CAAC,OAAO,KAAK,CAAC,KAAK,IAAI,EAAE;YAC3B,IAAI,CAAC;gBACH,+FAA+F;gBAC/F,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,yEAAyE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;gBACxG,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAChC,8FAA8F,CAC/F,CAAC;gBACF,MAAM,IAAI,GAAG,IAAI,SAAS,EAAE,CAAC;gBAC7B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;oBAC5B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBAC9F,CAAC;gBACD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;gBACpB,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC;YACtB,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACtB,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;CACF"}

package/dist/join-ticket-ledger.d.ts

@@ -0,0 +1,135 @@
+import type { Pool } from 'pg';
+import type { PlayerId } from '@flayerlabs/gamemode-spec';
+import type { PlayerJoinTicket } from '@flayerlabs/gamemode-spec/live';
+/** Enough for a player whose connection keeps dropping; far too few to farm seats with. */
+export declare const DEFAULT_MAX_JOIN_TICKETS_PER_MINUTE = 20;
+/**
+ * Where a ticket is in its life.
+ *
+ * `issued` is waiting to be presented. `expired` was never presented in time. `consumed` is a seat
+ * the game server accepted and has not given back. `released` is finished, by the server's word.
+ */
+export type JoinTicketStatus = 'issued' | 'expired' | 'consumed' | 'released';
+export interface JoinTicketRecord {
+    jti: string;
+    roundId: string;
+    player: PlayerId;
+    audience: string;
+    issuedAt: number;
+    expiresAt: number;
+    consumedAt: number | null;
+    releasedAt: number | null;
+    status: JoinTicketStatus;
+}
+/** How freely one wallet may be handed tickets. The gate operator's choice, per game. */
+export interface JoinTicketPolicy {
+    /**
+     * The most tickets one wallet may hold open in a round: issued and unexpired, or consumed and not
+     * yet released. Omitted, there is no limit.
+     *
+     * Set it only if your game server releases every seat it consumes, and releases them all when it
+     * restarts. A server that consumes and never releases locks its own players out for the round.
+     */
+    maxOpenPerPlayer?: number;
+    /** Tickets one wallet may be issued in a round in any minute. Defaults to twenty. */
+    maxIssuedPerMinutePerPlayer?: number;
+}
+export type JoinTicketIssueRefusal = 'ticket.rate_limited' | 'ticket.seat_open';
+export type JoinTicketIssueResult = {
+    ok: true;
+    ticket: PlayerJoinTicket;
+} | {
+    ok: false;
+    refuse: JoinTicketIssueRefusal;
+};
+export type JoinTicketConsumeRefusal = 'ticket.invalid' | 'ticket.no_such_round' | 'ticket.wrong_audience' | 'ticket.expired' | 'ticket.already_consumed' | 'ticket.released';
+/** The seat a server just accepted, and any other seats the same wallet still holds. */
+export interface JoinTicketConsumption {
+    ticket: JoinTicketRecord;
+    /**
+     * Other consumed, unreleased tickets for this wallet in this round, oldest first.
+     *
+     * A reconnecting player arrives before the server has noticed the old socket died. Close these
+     * connections and release them, and the wallet holds one seat.
+     */
+    otherOpen: string[];
+}
+export type JoinTicketConsumeResult = ({
+    ok: true;
+} & JoinTicketConsumption) | {
+    ok: false;
+    refuse: JoinTicketConsumeRefusal;
+};
+/** Exactly one selector: one ticket, one wallet's tickets, or every ticket in the round. */
+export type JoinTicketReleaseSelector = {
+    jti: string;
+} | {
+    player: PlayerId;
+} | {
+    all: true;
+};
+export type JoinTicketReleaseResult = {
+    ok: true;
+    released: string[];
+} | {
+    ok: false;
+    refuse: 'ticket.invalid' | 'ticket.no_such_round';
+};
+export interface JoinTicketCounts {
+    /** Every ticket this wallet has been issued in the round. */
+    issued: number;
+    /** Seats the game server consumed and has not released. */
+    open: number;
+}
+interface IssueInput {
+    awardToken: string;
+    roundId: string;
+    player: PlayerId;
+    audience: string;
+    closesAt: number;
+    now: number;
+}
+/**
+ * The gate's record of every join ticket it signs, and what became of each.
+ *
+ * A ticket by itself is a stateless MAC: the gate that signed it cannot say how many a wallet
+ * holds, and every game server has to keep its own replay cache to stop one being presented twice.
+ * Writing each ticket down moves both jobs here. Issue is rationed per wallet, consume succeeds
+ * exactly once, and release is how the server that owns the connection says the seat is free.
+ *
+ * Scoped by game in every statement, so another game's round reads as no such round.
+ */
+export declare class JoinTickets {
+    private readonly pool;
+    private readonly gameId;
+    private readonly maxOpenPerPlayer;
+    private readonly maxIssuedPerMinutePerPlayer;
+    constructor(pool: Pool, gameId: string, policy?: JoinTicketPolicy);
+    /** Sign a ticket and write it down, or refuse a wallet that already holds too many. */
+    issue(input: IssueInput): Promise<JoinTicketIssueResult>;
+    /**
+     * Accept a ticket a browser presented, exactly once.
+     *
+     * The gate verifies the MAC, the round, the audience and the expiry, so a game server in any
+     * language can admit a player with one request and no cryptography of its own.
+     */
+    consume(input: {
+        awardToken: string;
+        roundId: string;
+        ticket: unknown;
+        audience?: unknown;
+    }, now?: number): Promise<JoinTicketConsumeResult>;
+    /**
+     * Give seats back. Releasing an unpresented ticket voids it.
+     *
+     * Idempotent: a ticket already released is not released again and is not an error, so a server
+     * can call this from every code path that ends a connection.
+     */
+    release(roundId: string, selector: unknown, now?: number): Promise<JoinTicketReleaseResult>;
+    /** One wallet's most recent tickets in a round, newest first. Null for a round this game does not own. */
+    list(roundId: string, player: string, now?: number): Promise<JoinTicketRecord[] | null>;
+    counts(roundId: string, player: string): Promise<JoinTicketCounts>;
+    private roundExists;
+}
+export {};
+//# sourceMappingURL=join-ticket-ledger.d.ts.map

package/dist/join-ticket-ledger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"join-ticket-ledger.d.ts","sourceRoot":"","sources":["../src/join-ticket-ledger.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,IAAI,CAAC;AAE3C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAQvE,2FAA2F;AAC3F,eAAO,MAAM,mCAAmC,KAAK,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,CAAC;AAE9E,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,QAAQ,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAED,yFAAyF;AACzF,MAAM,WAAW,gBAAgB;IAC/B;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qFAAqF;IACrF,2BAA2B,CAAC,EAAE,MAAM,CAAC;CACtC;AAED,MAAM,MAAM,sBAAsB,GAAG,qBAAqB,GAAG,kBAAkB,CAAC;AAEhF,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GACtC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,CAAC;AAElD,MAAM,MAAM,wBAAwB,GAChC,gBAAgB,GAChB,sBAAsB,GACtB,uBAAuB,GACvB,gBAAgB,GAChB,yBAAyB,GACzB,iBAAiB,CAAC;AAEtB,wFAAwF;AACxF,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,gBAAgB,CAAC;IACzB;;;;;OAKG;IACH,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,MAAM,uBAAuB,GAC/B,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG,qBAAqB,CAAC,GACtC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,wBAAwB,CAAA;CAAE,CAAC;AAEpD,4FAA4F;AAC5F,MAAM,MAAM,yBAAyB,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,GAAG,EAAE,IAAI,CAAA;CAAE,CAAC;AAE/F,MAAM,MAAM,uBAAuB,GAC/B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GAChC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,gBAAgB,GAAG,sBAAsB,CAAA;CAAE,CAAC;AAErE,MAAM,WAAW,gBAAgB;IAC/B,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;CACd;AAED,UAAU,UAAU;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,QAAQ,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb;AAuCD;;;;;;;;;GASG;AACH,qBAAa,WAAW;IAKpB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IALzB,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAgB;IACjD,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAS;gBAGlC,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,MAAM,EAC/B,MAAM,GAAE,gBAAqB;IAQ/B,uFAAuF;IACjF,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,qBAAqB,CAAC;IA+B9D;;;;;OAKG;IACG,OAAO,CACX,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,EACnF,GAAG,SAAa,GACf,OAAO,CAAC,uBAAuB,CAAC;IA6CnC;;;;;OAKG;IACG,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,SAAa,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAsBrG,0GAA0G;IACpG,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,OAAO,CAAC,gBAAgB,EAAE,GAAG,IAAI,CAAC;IAY3F,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;YAU1D,WAAW;CAO1B"}

package/dist/join-ticket-ledger.js

@@ -0,0 +1,190 @@
+import { randomUUID } from 'node:crypto';
+import { isAddress } from 'viem';
+import { issuePlayerJoinTicket, readPlayerJoinTicket } from './player-join-tickets.js';
+import { inTransaction } from './store.js';
+const IDENTIFIER = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+const RATE_WINDOW_MS = 60_000;
+const LIST_LIMIT = 100;
+/** Enough for a player whose connection keeps dropping; far too few to farm seats with. */
+export const DEFAULT_MAX_JOIN_TICKETS_PER_MINUTE = 20;
+const COLUMNS = 'jti, round_id, player, audience, issued_at, expires_at, consumed_at, released_at';
+function statusOf(row, now) {
+    if (row.released_at !== null)
+        return 'released';
+    if (row.consumed_at !== null)
+        return 'consumed';
+    return Number(row.expires_at) > now ? 'issued' : 'expired';
+}
+const record = (row, now) => ({
+    jti: row.jti,
+    roundId: row.round_id,
+    player: row.player,
+    audience: row.audience,
+    issuedAt: Number(row.issued_at),
+    expiresAt: Number(row.expires_at),
+    consumedAt: row.consumed_at === null ? null : Number(row.consumed_at),
+    releasedAt: row.released_at === null ? null : Number(row.released_at),
+    status: statusOf(row, now),
+});
+function positiveInteger(value, name) {
+    if (value === undefined)
+        return null;
+    if (!Number.isSafeInteger(value) || value <= 0)
+        throw new RangeError(`${name} must be a positive safe integer`);
+    return value;
+}
+/**
+ * The gate's record of every join ticket it signs, and what became of each.
+ *
+ * A ticket by itself is a stateless MAC: the gate that signed it cannot say how many a wallet
+ * holds, and every game server has to keep its own replay cache to stop one being presented twice.
+ * Writing each ticket down moves both jobs here. Issue is rationed per wallet, consume succeeds
+ * exactly once, and release is how the server that owns the connection says the seat is free.
+ *
+ * Scoped by game in every statement, so another game's round reads as no such round.
+ */
+export class JoinTickets {
+    pool;
+    gameId;
+    maxOpenPerPlayer;
+    maxIssuedPerMinutePerPlayer;
+    constructor(pool, gameId, policy = {}) {
+        this.pool = pool;
+        this.gameId = gameId;
+        this.maxOpenPerPlayer = positiveInteger(policy.maxOpenPerPlayer, 'tickets.maxOpenPerPlayer');
+        this.maxIssuedPerMinutePerPlayer =
+            positiveInteger(policy.maxIssuedPerMinutePerPlayer, 'tickets.maxIssuedPerMinutePerPlayer') ??
+                DEFAULT_MAX_JOIN_TICKETS_PER_MINUTE;
+    }
+    /** Sign a ticket and write it down, or refuse a wallet that already holds too many. */
+    async issue(input) {
+        const player = input.player.toLowerCase();
+        const jti = randomUUID();
+        // Signed before the transaction: it is pure, and its bounds checks should fail before a lock.
+        const ticket = issuePlayerJoinTicket({ ...input, player, gameId: this.gameId, jti });
+        return inTransaction(this.pool, async (tx) => {
+            // Two requests from one wallet must not both read "under the limit" and both insert.
+            await lockPlayer(tx, input.roundId, player);
+            const counts = await tx.query(`select count(*) filter (where issued_at > $3)::text as recent,
+                count(*) filter (
+                  where released_at is null and (consumed_at is not null or expires_at > $4)
+                )::text as open
+         from join_tickets where round_id = $1 and player = $2`, [input.roundId, player, input.now - RATE_WINDOW_MS, input.now]);
+            const { recent, open } = counts.rows[0];
+            if (Number(recent) >= this.maxIssuedPerMinutePerPlayer)
+                return { ok: false, refuse: 'ticket.rate_limited' };
+            if (this.maxOpenPerPlayer !== null && Number(open) >= this.maxOpenPerPlayer) {
+                return { ok: false, refuse: 'ticket.seat_open' };
+            }
+            await tx.query(`insert into join_tickets (jti, round_id, player, audience, issued_at, expires_at)
+         values ($1, $2, $3, $4, $5, $6)`, [jti, input.roundId, player, input.audience, input.now, ticket.expiresAt]);
+            return { ok: true, ticket };
+        });
+    }
+    /**
+     * Accept a ticket a browser presented, exactly once.
+     *
+     * The gate verifies the MAC, the round, the audience and the expiry, so a game server in any
+     * language can admit a player with one request and no cryptography of its own.
+     */
+    async consume(input, now = Date.now()) {
+        if (typeof input.roundId !== 'string' || !IDENTIFIER.test(input.roundId)) {
+            return { ok: false, refuse: 'ticket.invalid' };
+        }
+        if (input.audience !== undefined && typeof input.audience !== 'string') {
+            return { ok: false, refuse: 'ticket.invalid' };
+        }
+        const claims = readPlayerJoinTicket(input.ticket, input.awardToken);
+        if (!claims || claims.gameId !== this.gameId)
+            return { ok: false, refuse: 'ticket.invalid' };
+        if (!(await this.roundExists(input.roundId)))
+            return { ok: false, refuse: 'ticket.no_such_round' };
+        if (claims.roundId !== input.roundId)
+            return { ok: false, refuse: 'ticket.invalid' };
+        // A ticket minted for one server must not seat a player on another that shares the gate.
+        if (input.audience !== undefined && input.audience !== claims.audience) {
+            return { ok: false, refuse: 'ticket.wrong_audience' };
+        }
+        const updated = await this.pool.query(`update join_tickets set consumed_at = $3
+       where jti = $1 and round_id = $2 and consumed_at is null and released_at is null and expires_at > $3
+       returning ${COLUMNS}`, [claims.jti, input.roundId, now]);
+        const row = updated.rows[0];
+        if (!row) {
+            const existing = await this.pool.query(`select ${COLUMNS} from join_tickets where jti = $1 and round_id = $2`, [claims.jti, input.roundId]);
+            const found = existing.rows[0];
+            // A valid MAC with no row was signed by something other than this ledger.
+            if (!found)
+                return { ok: false, refuse: 'ticket.invalid' };
+            if (found.released_at !== null)
+                return { ok: false, refuse: 'ticket.released' };
+            if (found.consumed_at !== null)
+                return { ok: false, refuse: 'ticket.already_consumed' };
+            return { ok: false, refuse: 'ticket.expired' };
+        }
+        const others = await this.pool.query(`select jti from join_tickets
+       where round_id = $1 and player = $2 and jti <> $3 and consumed_at is not null and released_at is null
+       order by consumed_at, jti`, [input.roundId, row.player, row.jti]);
+        return { ok: true, ticket: record(row, now), otherOpen: others.rows.map((other) => other.jti) };
+    }
+    /**
+     * Give seats back. Releasing an unpresented ticket voids it.
+     *
+     * Idempotent: a ticket already released is not released again and is not an error, so a server
+     * can call this from every code path that ends a connection.
+     */
+    async release(roundId, selector, now = Date.now()) {
+        const parsed = parseSelector(selector);
+        if (typeof roundId !== 'string' || !IDENTIFIER.test(roundId) || !parsed) {
+            return { ok: false, refuse: 'ticket.invalid' };
+        }
+        if (!(await this.roundExists(roundId)))
+            return { ok: false, refuse: 'ticket.no_such_round' };
+        const [filter, value] = 'jti' in parsed
+            ? ['and jti = $3', parsed.jti]
+            : 'player' in parsed
+                ? ['and player = $3', parsed.player.toLowerCase()]
+                : ['', null];
+        const released = await this.pool.query(`update join_tickets set released_at = $2
+       where round_id = $1 and released_at is null ${filter}
+       returning jti`, value === null ? [roundId, now] : [roundId, now, value]);
+        return { ok: true, released: released.rows.map((row) => row.jti) };
+    }
+    /** One wallet's most recent tickets in a round, newest first. Null for a round this game does not own. */
+    async list(roundId, player, now = Date.now()) {
+        if (!(await this.roundExists(roundId)))
+            return null;
+        const rows = await this.pool.query(`select ${COLUMNS} from join_tickets
+       where round_id = $1 and player = $2
+       order by issued_at desc, jti
+       limit ${LIST_LIMIT}`, [roundId, player.toLowerCase()]);
+        return rows.rows.map((row) => record(row, now));
+    }
+    async counts(roundId, player) {
+        const result = await this.pool.query(`select count(*)::text as issued,
+              count(*) filter (where consumed_at is not null and released_at is null)::text as open
+       from join_tickets where round_id = $1 and player = $2`, [roundId, player.toLowerCase()]);
+        return { issued: Number(result.rows[0].issued), open: Number(result.rows[0].open) };
+    }
+    async roundExists(roundId) {
+        const round = await this.pool.query(`select 1 from rounds where id = $1 and game_id = $2 and score_authority = 'external-server'`, [roundId, this.gameId]);
+        return round.rows.length > 0;
+    }
+}
+function lockPlayer(tx, roundId, player) {
+    return tx.query(`select pg_advisory_xact_lock(hashtextextended($1, 0))`, [`gamemode_join_ticket:${roundId}:${player}`]);
+}
+function parseSelector(value) {
+    if (typeof value !== 'object' || value === null)
+        return null;
+    const { jti, player, all } = value;
+    // Exactly one, so a body that names a ticket and also says "all" cannot empty a round by accident.
+    if ([jti, player, all].filter((entry) => entry !== undefined).length !== 1)
+        return null;
+    if (jti !== undefined)
+        return typeof jti === 'string' && IDENTIFIER.test(jti) ? { jti } : null;
+    if (player !== undefined) {
+        return typeof player === 'string' && isAddress(player, { strict: false }) ? { player } : null;
+    }
+    return all === true ? { all: true } : null;
+}
+//# sourceMappingURL=join-ticket-ledger.js.map

package/dist/join-ticket-ledger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"join-ticket-ledger.js","sourceRoot":"","sources":["../src/join-ticket-ledger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAGjC,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACvF,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,MAAM,UAAU,GAAG,qCAAqC,CAAC;AACzD,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,UAAU,GAAG,GAAG,CAAC;AAEvB,2FAA2F;AAC3F,MAAM,CAAC,MAAM,mCAAmC,GAAG,EAAE,CAAC;AAoGtD,MAAM,OAAO,GAAG,kFAAkF,CAAC;AAEnG,SAAS,QAAQ,CAAC,GAAiB,EAAE,GAAW;IAC9C,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI;QAAE,OAAO,UAAU,CAAC;IAChD,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI;QAAE,OAAO,UAAU,CAAC;IAChD,OAAO,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,GAAiB,EAAE,GAAW,EAAoB,EAAE,CAAC,CAAC;IACpE,GAAG,EAAE,GAAG,CAAC,GAAG;IACZ,OAAO,EAAE,GAAG,CAAC,QAAQ;IACrB,MAAM,EAAE,GAAG,CAAC,MAAM;IAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;IACtB,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;IACjC,UAAU,EAAE,GAAG,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;IACrE,UAAU,EAAE,GAAG,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;IACrE,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;CAC3B,CAAC,CAAC;AAEH,SAAS,eAAe,CAAC,KAAyB,EAAE,IAAY;IAC9D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,GAAG,IAAI,kCAAkC,CAAC,CAAC;IAChH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,WAAW;IAKH;IACA;IALF,gBAAgB,CAAgB;IAChC,2BAA2B,CAAS;IAErD,YACmB,IAAU,EACV,MAAc,EAC/B,SAA2B,EAAE;QAFZ,SAAI,GAAJ,IAAI,CAAM;QACV,WAAM,GAAN,MAAM,CAAQ;QAG/B,IAAI,CAAC,gBAAgB,GAAG,eAAe,CAAC,MAAM,CAAC,gBAAgB,EAAE,0BAA0B,CAAC,CAAC;QAC7F,IAAI,CAAC,2BAA2B;YAC9B,eAAe,CAAC,MAAM,CAAC,2BAA2B,EAAE,qCAAqC,CAAC;gBAC1F,mCAAmC,CAAC;IACxC,CAAC;IAED,uFAAuF;IACvF,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;QACzB,8FAA8F;QAC9F,MAAM,MAAM,GAAG,qBAAqB,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAErF,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;YAC3C,qFAAqF;YACrF,MAAM,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B;;;;+DAIuD,EACvD,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,GAAG,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,CAC/D,CAAC;YACF,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;YACzC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,2BAA2B;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;YAC5G,IAAI,IAAI,CAAC,gBAAgB,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBAC5E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;YACnD,CAAC;YACD,MAAM,EAAE,CAAC,KAAK,CACZ;yCACiC,EACjC,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,CAC1E,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CACX,KAAmF,EACnF,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QAEhB,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QACjD,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACvE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QACjD,CAAC;QACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QAC7F,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;QACnG,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QACrF,yFAAyF;QACzF,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YACvE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;QACxD,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACnC;;mBAEa,OAAO,EAAE,EACtB,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CACjC,CAAC;QACF,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACpC,UAAU,OAAO,qDAAqD,EACtE,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAC5B,CAAC;YACF,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC/B,0EAA0E;YAC1E,IAAI,CAAC,KAAK;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;YAC3D,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;YAChF,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;YACxF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QACjD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAClC;;iCAE2B,EAC3B,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CACrC,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;IAClG,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,OAAe,EAAE,QAAiB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QAChE,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACxE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QACjD,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;QAE7F,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GACnB,KAAK,IAAI,MAAM;YACb,CAAC,CAAC,CAAC,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC;YAC9B,CAAC,CAAC,QAAQ,IAAI,MAAM;gBAClB,CAAC,CAAC,CAAC,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;gBAClD,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACnB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACpC;qDAC+C,MAAM;qBACtC,EACf,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CACxD,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;IACrE,CAAC;IAED,0GAA0G;IAC1G,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,MAAc,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QAC1D,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAChC,UAAU,OAAO;;;eAGR,UAAU,EAAE,EACrB,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAChC,CAAC;QACF,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,MAAc;QAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAClC;;6DAEuD,EACvD,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAChC,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,EAAE,CAAC;IACxF,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,OAAe;QACvC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACjC,6FAA6F,EAC7F,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CACvB,CAAC;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/B,CAAC;CACF;AAED,SAAS,UAAU,CAAC,EAAc,EAAE,OAAe,EAAE,MAAc;IACjE,OAAO,EAAE,CAAC,KAAK,CAAC,uDAAuD,EAAE,CAAC,wBAAwB,OAAO,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC;AAC1H,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,KAAgC,CAAC;IAC9D,mGAAmG;IACnG,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACxF,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/F,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAChG,CAAC;IACD,OAAO,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC"}

package/dist/main.d.ts

@@ -4,6 +4,7 @@ import type { FastifyInstance } from 'fastify';
 import type { GameModule } from '@flayerlabs/gamemode-spec';
 import { type PriceFor } from './server.js';
 import { type GateDeployment } from './chain/chains.js';
+import { type TurnstileConfig } from './turnstile.js';
 /**
  * A production gate from an environment, assembled and checked.
  *
@@ -53,6 +54,12 @@ export interface ResolvedGateConfig {
     pairedTokenCapHeadroomPercent: number;
     /** May lift the gate early or rotate the signer on-chain. Defaults to the signing key's address. */
     settler: `0x${string}` | null;
+    /** Reverse proxies between the internet and this process; decides whose address a request has. */
+    trustedProxyHops: number;
+    /** The Turnstile widget that guards sign-in, or null when sign-in needs no evidence. */
+    turnstile: TurnstileConfig | null;
+    /** Sign-ins one address may make in a minute. Zero is no limit. */
+    sessionsPerIpPerMinute: number;
 }
 export interface SpendTokenPricing {
     address: `0x${string}`;
@@ -94,6 +101,15 @@ export interface SpendTokenPricing {
  *                            would otherwise quote; tokens neither here nor approved on the
  *                            manager's PairedTokenRegistry are refused.
  *   PAIRED_TOKEN_CAP_HEADROOM_PERCENT  default 25; headroom on caps sized for registry-priced pairings
+ *   TRUSTED_PROXY_HOPS       default 0; reverse proxies in front of the gate (2 on Railway, 3 with
+ *                            a CDN in front of that). Decides the address admission policy sees.
+ *   SESSIONS_PER_IP_PER_MINUTE  sign-ins one address may make in a minute. Default 30 when
+ *                            TRUSTED_PROXY_HOPS is set, otherwise 0 (no limit): until the gate is
+ *                            told its proxies it cannot tell one player's address from another's.
+ *   TURNSTILE_SITE_KEY       optional; with TURNSTILE_SECRET, sign-in requires a Turnstile token
+ *   TURNSTILE_SECRET         optional; set together with TURNSTILE_SITE_KEY or not at all
+ *   TURNSTILE_ACTION         default game-session
+ *   TURNSTILE_HOSTNAMES      default the host of SIGN_IN_DOMAIN; comma-separated
  */
 export declare function resolveGateEnv(env: Env): ResolvedGateConfig;
 export interface StartedGate {

package/dist/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAiD,KAAK,YAAY,EAAE,MAAM,MAAM,CAAC;AACxF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAE5D,OAAO,EAA+D,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AASzG,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAIvE;;;;;;;;;;;;GAYG;AAEH,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAE9C,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,KAAK,MAAM,EAAE,CAAC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,yFAAyF;IACzF,YAAY,EAAE,MAAM,CAAC;IACrB,kGAAkG;IAClG,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,cAAc,CAAC;IAC3B,iFAAiF;IACjF,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,0FAA0F;IAC1F,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,WAAW,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACpD;;;;OAIG;IACH,6BAA6B,EAAE,MAAM,CAAC;IACtC,oGAAoG;IACpG,OAAO,EAAE,KAAK,MAAM,EAAE,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;IACvB,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAC;CACnB;AAuED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,GAAG,GAAG,kBAAkB,CAmF3D;AA8BD,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,eAAe,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,0FAA0F;IAC1F,MAAM,EAAE,KAAK,MAAM,EAAE,CAAC;IACtB,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,EAAE,GAAG,CAAC;IACV,qEAAqE;IACrE,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,iEAAiE;IACjE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,aAAa,CAAC,EAAE,QAAQ,CAAC;CAC1B;AAED,wBAAsB,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAClF,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,EACtE,UAAU,EAAE,MAAM,EAClB,SAAS,GAAE,kBAAuB,GACjC,OAAO,CAAC,WAAW,CAAC,CA0ItB"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAiD,KAAK,YAAY,EAAE,MAAM,MAAM,CAAC;AACxF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAE5D,OAAO,EAKL,KAAK,QAAQ,EACd,MAAM,aAAa,CAAC;AASrB,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGvE,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AAGxB;;;;;;;;;;;;GAYG;AAEH,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAE9C,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,KAAK,MAAM,EAAE,CAAC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,yFAAyF;IACzF,YAAY,EAAE,MAAM,CAAC;IACrB,kGAAkG;IAClG,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,cAAc,CAAC;IAC3B,iFAAiF;IACjF,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,0FAA0F;IAC1F,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,WAAW,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACpD;;;;OAIG;IACH,6BAA6B,EAAE,MAAM,CAAC;IACtC,oGAAoG;IACpG,OAAO,EAAE,KAAK,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9B,kGAAkG;IAClG,gBAAgB,EAAE,MAAM,CAAC;IACzB,wFAAwF;IACxF,SAAS,EAAE,eAAe,GAAG,IAAI,CAAC;IAClC,mEAAmE;IACnE,sBAAsB,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;IACvB,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAC;CACnB;AAuED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,GAAG,GAAG,kBAAkB,CA4F3D;AA8BD,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,eAAe,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,0FAA0F;IAC1F,MAAM,EAAE,KAAK,MAAM,EAAE,CAAC;IACtB,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,EAAE,GAAG,CAAC;IACV,qEAAqE;IACrE,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,iEAAiE;IACjE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,aAAa,CAAC,EAAE,QAAQ,CAAC;CAC1B;AAED,wBAAsB,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAClF,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,EACtE,UAAU,EAAE,MAAM,EAClB,SAAS,GAAE,kBAAuB,GACjC,OAAO,CAAC,WAAW,CAAC,CA2JtB"}

package/dist/main.js

@@ -1,7 +1,7 @@
 import { createGateReadiness } from './readiness.js';
 import pg from 'pg';
 import { createPublicClient, http, isAddress, parseAbi } from 'viem';
-import { createGate } from './server.js';
+import { MAX_TRUSTED_PROXY_HOPS, createGate, } from './server.js';
 import { Ledger } from './ledger.js';
 import { Claims } from './claims.js';
 import { Sessions } from './sessions.js';
@@ -13,6 +13,8 @@ import { resolveEconomy } from './economy.js';
 import { deploymentFor } from './chain/chains.js';
 import { assertSecureConfig } from './chain/secure.js';
 import { RegistryPrices } from './chain/registry-prices.js';
+import { isTurnstileTestingSecret, resolveTurnstileEnv, turnstileAdmission, } from './turnstile.js';
+import { composeAdmit, createRateLimitAdmit } from './admission.js';
 function required(env, name) {
     const value = env[name];
     if (!value)
@@ -121,6 +123,15 @@ function address(env, name) {
  *                            would otherwise quote; tokens neither here nor approved on the
  *                            manager's PairedTokenRegistry are refused.
  *   PAIRED_TOKEN_CAP_HEADROOM_PERCENT  default 25; headroom on caps sized for registry-priced pairings
+ *   TRUSTED_PROXY_HOPS       default 0; reverse proxies in front of the gate (2 on Railway, 3 with
+ *                            a CDN in front of that). Decides the address admission policy sees.
+ *   SESSIONS_PER_IP_PER_MINUTE  sign-ins one address may make in a minute. Default 30 when
+ *                            TRUSTED_PROXY_HOPS is set, otherwise 0 (no limit): until the gate is
+ *                            told its proxies it cannot tell one player's address from another's.
+ *   TURNSTILE_SITE_KEY       optional; with TURNSTILE_SECRET, sign-in requires a Turnstile token
+ *   TURNSTILE_SECRET         optional; set together with TURNSTILE_SITE_KEY or not at all
+ *   TURNSTILE_ACTION         default game-session
+ *   TURNSTILE_HOSTNAMES      default the host of SIGN_IN_DOMAIN; comma-separated
  */
 export function resolveGateEnv(env) {
     const chainId = Number(required(env, 'CHAIN_ID'));
@@ -170,13 +181,18 @@ export function resolveGateEnv(env) {
         : origin);
     if (allowedOrigins.length === 0)
         throw new Error('ALLOWED_ORIGINS names no origins');
+    const signInDomain = required(env, 'SIGN_IN_DOMAIN');
+    const trustedProxyHops = integer(env, 'TRUSTED_PROXY_HOPS', 0);
+    if (trustedProxyHops > MAX_TRUSTED_PROXY_HOPS) {
+        throw new Error(`TRUSTED_PROXY_HOPS must be at most ${MAX_TRUSTED_PROXY_HOPS}`);
+    }
     return {
         chainId,
         rpcUrl: required(env, 'RPC_URL'),
         signerPrivateKey: signerPrivateKey,
         databaseUrl: required(env, 'DATABASE_URL'),
         sessionSecret: required(env, 'SESSION_SECRET'),
-        signInDomain: required(env, 'SIGN_IN_DOMAIN'),
+        signInDomain,
         gateOrigin: required(env, 'GATE_ORIGIN'),
         allowedOrigins,
         port: integer(env, 'PORT', 8790),
@@ -196,6 +212,9 @@ export function resolveGateEnv(env) {
         spendTokens: spendTokens(env),
         pairedTokenCapHeadroomPercent: integer(env, 'PAIRED_TOKEN_CAP_HEADROOM_PERCENT', 25),
         settler: address(env, 'SETTLER'),
+        trustedProxyHops,
+        turnstile: resolveTurnstileEnv(env, signInDomain),
+        sessionsPerIpPerMinute: integer(env, 'SESSIONS_PER_IP_PER_MINUTE', trustedProxyHops > 0 ? 30 : 0),
     };
 }
 const erc20 = parseAbi(['function symbol() view returns (string)', 'function decimals() view returns (uint8)']);
@@ -296,6 +315,18 @@ export async function startGate(game, gameConfig, overrides = {}) {
     const ledger = new Ledger(pool);
     const signer = new PayloadSigner(config.signerPrivateKey, config.chainId, config.deployment.spendGatedCalculator);
     const settler = config.settler ?? signer.address;
+    const turnstile = config.turnstile ? turnstileAdmission(config.turnstile) : null;
+    if (config.turnstile && isTurnstileTestingSecret(config.turnstile.secret)) {
+        // Loud because it is silent otherwise: the widget renders and every caller passes.
+        console.warn('TURNSTILE_SECRET is a Cloudflare testing secret: sign-in is not protected');
+    }
+    // The rate limit first: a caller over budget is refused before a Turnstile token is spent on them.
+    const rateLimit = config.sessionsPerIpPerMinute > 0
+        ? createRateLimitAdmit({
+            limits: { session: { perIp: { max: config.sessionsPerIpPerMinute, windowMs: 60_000 } } },
+        })
+        : undefined;
+    const admit = rateLimit || turnstile ? composeAdmit(rateLimit, turnstile?.admit) : undefined;
     const announce = () => ({
         chainId: config.chainId,
         contracts: {
@@ -317,6 +348,7 @@ export async function startGate(game, gameConfig, overrides = {}) {
         accepting: true,
         publicLaunchesOpen: true,
         privateLaunches: false,
+        ...(turnstile ? { admission: turnstile.admission } : {}),
     });
     const app = createGate({
         pool,
@@ -345,6 +377,8 @@ export async function startGate(game, gameConfig, overrides = {}) {
         }),
         settlement: new Settlement(pool, ledger, client, config.deployment.spendGatedCalculator),
         allowedOrigins: config.allowedOrigins,
+        trustedProxyHops: config.trustedProxyHops,
+        ...(admit ? { admit } : {}),
         announce,
         readiness: createGateReadiness({ origin: config.gateOrigin, chainId: config.chainId,
             positionManager: config.deployment.positionManager, signer, pool, client }),