@xgamesfun/xcore 0.1.0 → 0.2.1

package/lib/client/gamesfun.js

@@ -1,15 +1,15 @@
 // gamesfun.js: sign-in, saves, leaderboards, the game's own database and multiplayer rooms for a game published on
-// games.fun, from any engine. One file with no dependencies: a <script src="gamesfun.js"> in the page (or an import of it), and Godot's and
+// xgames.fun, from any engine. One file with no dependencies: a <script src="gamesfun.js"> in the page (or an import of it), and Godot's and
 // Unity's glue (xcore add signin) load the same file. It sets globalThis.GamesFun; every call answers
-// {data, error, status} and none throws, so a game plays on, as a guest, wherever games.fun is not there. A refusal from
-// games.fun also carries code, its word for why (for example 'server-only': a board only the game's server writes).
+// {data, error, status} and none throws, so a game plays on, as a guest, wherever xgames.fun is not there. A refusal from
+// xgames.fun also carries code, its word for why (for example 'server-only': a board only the game's server writes).
 //
 //   const gf = GamesFun;
-//   await gf.ready;                                   // what the page already knows (a sign-in the games.fun page has)
+//   await gf.ready;                                   // what the page already knows (a sign-in the xgames.fun page has)
 //   gf.player;                                        // null, or {id, name, level, wallet, x}
 //   gf.local;                                         // true on this machine (localhost, xcore check, xcore dev)
 //   gf.dev;                                           // true under xcore dev, where the game's server, saves and
-//                                                     // sign-in answer as games.fun's will: "no server here" is
+//                                                     // sign-in answer as xgames.fun's will: "no server here" is
 //                                                     // gf.local && !gf.dev, never gf.local alone
 //   await gf.signIn();                                // from a click: the player signs in → player | null
 //   gf.onChange(player => …);                         // sign-in and sign-out
@@ -17,26 +17,27 @@
 //                                                     // when true, only as a quiet line: X's login hides the window's state
 //   await gf.saves.put('main', {level: 3});           // this player's saves: JSON, 64 KB each, 16 a player
 //   await gf.scores.submit('best', 1200);             // leaderboards: a player's best is kept
-//   await gf.db.add('levels', {name: 'Moon'});        // the game's own database (xcore add database)
+//   await gf.db.add('levels', {name: 'Moon'});        // the game's own database (xcore add database): each player
+//                                                     // their own documents; gf.db.list pages with {after}
 //   await gf.api('scores', {method: 'POST', body: {}}); // the game's own server (server/), signed in
 //   const {data: room} = await gf.rooms.join(gf.rooms.fromLink() ?? gf.rooms.code()); // multiplayer (xcore add multiplayer)
 //   room.on('message', (from, data) => …); room.send({x: 1}); share gf.rooms.link(room.code)
 //
-// Where sign-in comes from (games.fun's player sign-in: X first, a wallet as well):
-// - inside games.fun's play page, the page above signs the player in and hands this page a token (gf:host / gf:auth);
-//   only games.fun's own page may: framed by any other site (one embedding the game), the game signs in by itself;
-// - on the game's own link or inside a post on X, a small window on games.fun signs in (or a code the player types at
+// Where sign-in comes from (xgames.fun's player sign-in: X first, a wallet as well):
+// - inside xgames.fun's play page, the page above signs the player in and hands this page a token (gf:host / gf:auth);
+//   only xgames.fun's own page may: framed by any other site (one embedding the game), the game signs in by itself;
+// - on the game's own link or inside a post on X, a small window on xgames.fun signs in (or a code the player types at
 //   <site>/go on any device), and this page asks the play host until it is answered (/player/v1/request);
 // - on this machine (localhost, 127.0.0.1, xcore check), a local player and this browser's storage stand in, so the
 //   game can be made and tested before it is published;
-// - in `xcore dev` (its pages set globalThis.GAMESFUN_DEV), the dev host answers as games.fun would: a local sign-in
+// - in `xcore dev` (its pages set globalThis.GAMESFUN_DEV), the dev host answers as xgames.fun would: a local sign-in
 //   (each tab its own player), saves and scores on its platform, the game's own server for the database and rooms.
 // The token lasts an hour and is kept in memory only. A server checks it with env.GF.verifyPlayer (server/), or any
 // JWT library against <play host>/player/v1/key (a server of your own).
 (function () {
   'use strict';
   if (globalThis.GamesFun) return;
-  var VERSION = '1.3.0';
+  var VERSION = '1.4.0';
   var PLATFORM = '/platform/v1/';
   var SEG = /^[A-Za-z0-9_-]{1,64}$/;
   var POLL_MS = 2000;
@@ -48,11 +49,11 @@
   var edge = pathSlug ? null : /^([a-z0-9]+(?:-[a-z0-9]+)*)-play\.([a-z0-9.-]+(?::\d+)?)$/.exec(loc.host);
   var slug = pathSlug || (edge ? edge[1] : null);
   var local = loc.protocol === 'file:' || /^(localhost|127\.\d+\.\d+\.\d+|\[::1\])$/.test(loc.hostname);
-  // xcore dev: everything goes to the dev host, as it would to games.fun; only the sign-in is its own
+  // xcore dev: everything goes to the dev host, as it would to xgames.fun; only the sign-in is its own
   var dev = local && !!globalThis.GAMESFUN_DEV;
   if (dev) local = false;
-  // on the game's own domain (play.mygame.com, xcore domain): games.fun's play edge says which game this is and where
-  // games.fun is (GET /platform/v1/site, asked once at load; gf.ready waits for it)
+  // on the game's own domain (play.mygame.com, xcore domain): xgames.fun's play edge says which game this is and where
+  // xgames.fun is (GET /platform/v1/site, asked once at load; gf.ready waits for it)
   var site = null;
   function siteOrigin(v) {
     try {
@@ -60,7 +61,7 @@
       if (u.origin !== v) return null;
       if (u.protocol === 'https:' || (u.protocol === 'http:' && /^(localhost|127\.\d+\.\d+\.\d+)$/.test(u.hostname)))
         return u.origin;
-      // a stand-in games.fun in tests (http on a name this machine resolves)
+      // a stand-in xgames.fun in tests (http on a name this machine resolves)
       return u.protocol === 'http:' && /\.test$/.test(u.hostname) ? u.origin : null;
     } catch {
       return null;
@@ -182,7 +183,7 @@
   function signedOut() {
     return Promise.resolve({ data: null, error: 'Sign in first.', status: 401 });
   }
-  /** games.fun's word for a refusal (r.code), kept on the answer made from r. */
+  /** xgames.fun's word for a refusal (r.code), kept on the answer made from r. */
   function withCode(answer, r) {
     if (r.code) answer.code = r.code;
     return answer;
@@ -242,7 +243,7 @@
     });
   }
 
-  // ---- the page above (games.fun's play page) ----
+  // ---- the page above (xgames.fun's play page) ----
   var above = null; // the parent window, once it answered gf:host
   var aboveAuth = false;
   var framed;
@@ -252,7 +253,7 @@
     framed = true;
   }
   var waiters = [];
-  // a token from games.fun: the player as the platform knows them (the token's subject), said once
+  // a token from xgames.fun: the player as the platform knows them (the token's subject), said once
   function takeToken(token, guess, expires) {
     gf.token = token;
     gf.expires = expires;
@@ -281,7 +282,7 @@
   gf.ready = new Promise(function (resolve) {
     readyResolve = resolve;
   });
-  // A message from the page above counts only from games.fun's own page (its origin, or www. of it): a site that
+  // A message from the page above counts only from xgames.fun's own page (its origin, or www. of it): a site that
   // embeds the game can't hand it a sign-in or take its sign-in over.
   function fromSite(origin) {
     var s = studio();
@@ -351,63 +352,79 @@
     } else readyResolve(gf.player);
   }
 
-  // ---- sign-in by itself: a request answered on games.fun (its own link, a post on X) ----
-  var req = null,
-    pollTimer = null,
-    popup = null;
+  // ---- sign-in by itself: a request answered on xgames.fun (its own link, a post on X) ----
+  // One sign-in at a time: {promise, resolve, timer, popup, req}. A second click shares it, a sign-out ends it with
+  // null, and an answer from xgames.fun that comes after it ended (a poll already on its way) is dropped.
+  var pending = null;
   function post(path, body) {
     return call(
       path,
       { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) },
-      'games.fun sign-in',
+      'xgames.fun sign-in',
     );
   }
-  function poll(done) {
-    clearTimeout(pollTimer);
-    if (!req) return done(null);
-    if (req.expires <= Date.now()) {
-      req = null;
-      gf.code = null;
-      return done(null);
+  function closePopup(p) {
+    try {
+      if (p.popup) p.popup.close();
+    } catch {
+      /* closed */
     }
-    pollTimer = setTimeout(function () {
-      post('/player/v1/request/status', { id: req.id, secret: req.secret }).then(function (r) {
+    p.popup = null;
+  }
+  // the sign-in `p` is over: answered with `player` (once; nothing if it ended already)
+  function endSignIn(p, player) {
+    if (pending !== p) return;
+    pending = null;
+    clearTimeout(p.timer);
+    p.req = null;
+    gf.code = null;
+    closePopup(p);
+    p.resolve(player);
+  }
+  function poll(p) {
+    if (pending !== p) return;
+    clearTimeout(p.timer);
+    if (p.req.expires <= Date.now()) return endSignIn(p, null);
+    p.timer = setTimeout(function () {
+      if (pending !== p || !p.req) return;
+      post('/player/v1/request/status', { id: p.req.id, secret: p.req.secret }).then(function (r) {
+        if (pending !== p || !p.req) return; // signed out (or ended) while this was on its way
         var s = r.data || {};
         if (s.state === 'signed-in') {
-          req = null;
+          p.req = null;
           gf.code = null;
-          try {
-            if (popup) popup.close();
-          } catch {
-            /* closed */
-          }
-          popup = null;
-          var p = s.player || {};
-          var x = p.x && p.x.handle ? p.x : null;
+          closePopup(p);
+          var pl = s.player || {};
+          var x = pl.x && pl.x.handle ? pl.x : null;
           var guess = {
             id: '',
-            name: x ? '@' + x.handle : p.wallet || '',
-            level: p.level,
-            wallet: p.wallet || '',
+            name: x ? '@' + x.handle : pl.wallet || '',
+            level: pl.level,
+            wallet: pl.wallet || '',
             x: x,
           };
-          takeToken(s.token, guess, s.expires).then(done);
+          // still this sign-in's until the token is taken: a click meanwhile waits for the same player
+          takeToken(s.token, guess, s.expires).then(function (player) {
+            endSignIn(p, player);
+          });
           return;
         }
-        if (s.state === 'expired') {
-          req = null;
-          gf.code = null;
-          return done(null);
-        }
-        poll(done);
+        if (s.state === 'expired') return endSignIn(p, null);
+        poll(p);
       });
     }, POLL_MS);
   }
   function requestSignIn(how) {
     if (!slug) return Promise.resolve(null);
+    if (pending) return pending.promise;
+    var p = { promise: null, resolve: null, timer: null, popup: null, req: null };
+    p.promise = new Promise(function (resolve) {
+      p.resolve = resolve;
+    });
+    pending = p;
     // the window opens at the click (one opened after an await is blocked), then goes to the code's page
     try {
-      popup = globalThis.open(
+      p.popup = globalThis.open(
         studio() + '/go',
         'gamesfun-signin',
         'popup,width=440,height=600,left=' +
@@ -416,33 +433,25 @@
           Math.max(0, Math.round((screen.availHeight || 800) / 2 - 300)),
       );
     } catch {
-      popup = null;
+      p.popup = null;
     }
-    return post('/player/v1/request', { slug: slug, with: how }).then(function (r) {
-      if (!r.data || !r.data.id) {
-        try {
-          if (popup) popup.close();
-        } catch {
-          /* closed */
-        }
-        popup = null;
-        return null;
-      }
-      req = { id: r.data.id, secret: r.data.secret, expires: r.data.expires };
-      gf.code = { code: r.data.code, site: r.data.site, url: r.data.url, window: !!popup };
-      if (popup && !popup.closed) {
+    post('/player/v1/request', { slug: slug, with: how }).then(function (r) {
+      if (pending !== p) return; // signed out before xgames.fun answered
+      if (!r.data || !r.data.id) return endSignIn(p, null);
+      p.req = { id: r.data.id, secret: r.data.secret, expires: r.data.expires };
+      gf.code = { code: r.data.code, site: r.data.site, url: r.data.url, window: !!p.popup };
+      if (p.popup && !p.popup.closed) {
         try {
-          popup.location.href = r.data.url + (r.data.url.indexOf('?') < 0 ? '?' : '&') + 'with=' + how;
+          p.popup.location.href = r.data.url + (r.data.url.indexOf('?') < 0 ? '?' : '&') + 'with=' + how;
         } catch {
-          popup = null;
+          p.popup = null;
         }
       }
       // always said: the game may show the code, and must when no window opened (a phone, a blocked window)
       emit(codeFns, gf.code);
-      return new Promise(function (resolve) {
-        poll(resolve);
-      });
+      poll(p);
     });
+    return p.promise;
   }
 
   /**
@@ -452,6 +461,8 @@
   gf.signIn = function (opts) {
     opts = opts || {};
     var how = opts.how === 'wallet' ? 'wallet' : 'x';
+    // a sign-in on its way (to its last step, the player's token being taken): this click waits for the same one
+    if (pending && opts.prompt !== false) return pending.promise;
     if (gf.token && gf.expires > Date.now() + 60e3) return Promise.resolve(gf.player);
     if (dev) return opts.prompt === false ? Promise.resolve(gf.player) : devSignIn(opts.name);
     if (local) {
@@ -482,8 +493,7 @@
     return requestSignIn(how);
   };
   gf.signOut = function () {
-    clearTimeout(pollTimer);
-    req = null;
+    if (pending) endSignIn(pending, null);
     gf.code = null;
     if (local) store('signedIn', null);
     if (dev) devTab(Object.assign(devTab() || {}, { signedIn: false }));
@@ -701,16 +711,27 @@
         );
       },
     );
-    var spec = fetch(at('xsolana.json'), { cache: 'no-store' }).then(function (r) {
-      if (!r.ok) throw new Error('This game has no economy here (no xsolana.json beside it).');
-      return r.text().then(function (t) {
-        try {
-          return JSON.parse(t);
-        } catch {
-          throw new Error('xsolana.json is not JSON: check it with xcore loot check.');
-        }
+    // xsolana.json; a game made before it was named so keeps loot.json (read only when there is no xsolana.json)
+    var specFile = function (name) {
+      return fetch(at(name), { cache: 'no-store' }).then(function (r) {
+        return { name: name, r: r };
+      });
+    };
+    var spec = specFile('xsolana.json')
+      .then(function (f) {
+        return f.r.status === 404 ? specFile('loot.json') : f;
+      })
+      .then(function (f) {
+        if (f.r.status === 404) throw new Error('This game has no economy here (no xsolana.json beside it).');
+        if (!f.r.ok) throw new Error(f.name + ' could not be read (' + f.r.status + ').');
+        return f.r.text().then(function (t) {
+          try {
+            return JSON.parse(t);
+          } catch {
+            throw new Error(f.name + ' is not JSON: check it with xcore loot check.');
+          }
+        });
       });
-    });
     // the game's own RPC (xcore add rpc: server/rpc.js at api/rpc, its URL a secret of the server) when it has one;
     // else the play host's shared relay (PAGE_RPC). Asked once a page load; any other answer is the shared relay.
     var own = fetch(gf.apiUrl('rpc'), { cache: 'no-store' })
@@ -843,11 +864,22 @@
     },
   };
 
-  // ---- the game's own database (xcore add database: server/ with a SQLite database on games.fun) ----
-  // Documents in collections: {id, owner, value, updatedAt}. Anyone reads; a signed-in player writes their own (the
-  // rules at the top of server/database.js say otherwise per collection).
+  // ---- the game's own database (xcore add database: server/ with a SQLite database on xgames.fun) ----
+  // Documents in collections: {id, owner, value, updatedAt}. Each player has a space of their own in a collection (the
+  // same id in two players' spaces is two documents); a signed-in player reads and writes their own (the rules at the
+  // top of server/database.js, or gamesfun.json → database.collections, say otherwise per collection). opts.owner names
+  // another space to read: 'server' (what the game's server wrote) or a player's id.
+  // On this machine only the local player's space exists, in this browser's storage.
   function localDocs(c) {
-    return store('db:' + c) || {};
+    var docs = store('db2:' + c);
+    if (docs) return docs;
+    // an older gamesfun.js kept one id per collection here: each document moves to its owner's space
+    var old = store('db:' + c) || {};
+    docs = {};
+    Object.keys(old).forEach(function (id) {
+      docs[old[id].owner + '/' + id] = old[id];
+    });
+    return docs;
   }
   function newId() {
     var a = new Uint8Array(9);
@@ -865,53 +897,131 @@
       })
       .join('');
   }
+  function localOwner(opts) {
+    var o = opts && opts.owner;
+    return !o || o === 'me' ? LOCAL_PLAYER.id : String(o);
+  }
+  // a list's place: the last document of a page ([updatedAt, owner, id]), handed back as it came
+  function localCursor(d) {
+    return btoa(JSON.stringify([d.updatedAt, d.owner, d.id]));
+  }
+  function localAfter(text) {
+    try {
+      var c = JSON.parse(atob(String(text)));
+      return Array.isArray(c) && c.length === 3 ? c : null;
+    } catch {
+      return null;
+    }
+  }
+  function order3(a, b) {
+    var x = [a.updatedAt, a.owner, a.id],
+      y = [b.updatedAt, b.owner, b.id];
+    for (var i = 0; i < 3; i++) if (x[i] !== y[i]) return x[i] < y[i] ? -1 : 1;
+    return 0;
+  }
+  function notYours() {
+    return Promise.resolve({ data: null, error: 'A player writes only their own documents.', status: 403 });
+  }
   var localDb = {
-    get: function (c, id) {
-      return ok(localDocs(c)[id] || null);
+    get: function (c, id, opts) {
+      return ok(localDocs(c)[localOwner(opts) + '/' + id] || null);
     },
-    put: function (c, id, value) {
+    put: function (c, id, value, opts) {
+      if (localOwner(opts) !== LOCAL_PLAYER.id) return notYours();
       var docs = localDocs(c);
-      if (docs[id] && docs[id].owner !== LOCAL_PLAYER.id)
-        return Promise.resolve({ data: null, error: 'Another player owns this document.', status: 403 });
-      docs[id] = { id: id, owner: LOCAL_PLAYER.id, value: value, updatedAt: Date.now() };
-      store('db:' + c, docs);
-      return ok(docs[id]);
+      var key = LOCAL_PLAYER.id + '/' + id;
+      docs[key] = { id: id, owner: LOCAL_PLAYER.id, value: value, updatedAt: Date.now() };
+      store('db2:' + c, docs);
+      return ok(docs[key]);
     },
     add: function (c, value) {
       return localDb.put(c, newId(), value);
     },
     list: function (c, opts) {
       opts = opts || {};
-      var all = Object.keys(localDocs(c)).map(function (k) {
-        return localDocs(c)[k];
+      if (noOffset(opts)) return noOffset(opts);
+      var docs = localDocs(c);
+      var all = Object.keys(docs).map(function (k) {
+        return docs[k];
       });
       if (opts.owner)
         all = all.filter(function (d) {
-          return d.owner === (opts.owner === 'me' ? LOCAL_PLAYER.id : opts.owner);
+          return d.owner === localOwner(opts);
         });
+      var old = opts.order === 'old';
       all.sort(function (a, b) {
-        return opts.order === 'old' ? a.updatedAt - b.updatedAt : b.updatedAt - a.updatedAt;
+        return old ? order3(a, b) : order3(b, a);
+      });
+      if (opts.after) {
+        var at = localAfter(opts.after);
+        if (!at) return Promise.resolve({ data: null, error: "after is the last answer's after.", status: 400 });
+        var mark = { updatedAt: at[0], owner: at[1], id: at[2] };
+        all = all.filter(function (d) {
+          return old ? order3(d, mark) > 0 : order3(d, mark) < 0;
+        });
+      }
+      var n = Math.max(1, Math.min(100, opts.limit | 0 || 50));
+      var page = all.slice(0, n);
+      var more = all.length > n;
+      return Promise.resolve({
+        data: page,
+        after: more ? localCursor(page[page.length - 1]) : null,
+        more: more,
+        error: null,
+        status: 200,
       });
-      var offset = opts.offset | 0;
-      return ok(all.slice(offset, offset + (opts.limit | 0 || 50)));
     },
-    delete: function (c, id) {
+    delete: function (c, id, opts) {
+      if (localOwner(opts) !== LOCAL_PLAYER.id) return notYours();
       var docs = localDocs(c);
-      var had = !!docs[id];
-      delete docs[id];
-      store('db:' + c, docs);
+      var key = LOCAL_PLAYER.id + '/' + id;
+      var had = !!docs[key];
+      delete docs[key];
+      store('db2:' + c, docs);
       return ok({ deleted: had });
     },
   };
   function useLocalDb() {
     return local;
   }
+  var ownerSaid = {};
+  // offset paging is gone (each player has a space of their own, and a page follows the last one's place): a real
+  // offset is refused, so code that pages with it stops at once instead of reading its first page again and again;
+  // 0 (or none) is the first page, which is what it always was
+  function noOffset(opts) {
+    var o = opts && opts.offset;
+    return o !== undefined && o !== null && o !== '' && Number(o) !== 0
+      ? Promise.resolve({
+          data: null,
+          error:
+            "gf.db.list takes no offset any more: pass the last answer's after for the next page (gf.db.list(c, {after}))",
+          status: 0,
+          code: 'offset',
+        })
+      : null;
+  }
+  function ownerQuery(opts) {
+    return opts && opts.owner !== undefined && opts.owner !== null && opts.owner !== ''
+      ? '?owner=' + encodeURIComponent(opts.owner)
+      : '';
+  }
   gf.db = {
-    /** → {data: {id, owner, value, updatedAt} | null} */
-    get: function (c, id) {
+    /** opts {owner: 'me' | 'server' | a player's id}; without it, the player's own (in a collection only the server
+     * writes: the server's, then the player's own). Another player's document is read by its owner: gf.db.get(c, id,
+     * {owner: doc.owner}). → {data: {id, owner, value, updatedAt} | null} */
+    get: function (c, id, opts) {
       if (!seg(c) || !seg(id)) return bad('collection or id');
-      if (useLocalDb()) return localDb.get(c, id);
-      return gf.api('db/' + seg(c) + '/' + seg(id)).then(function (r) {
+      if (useLocalDb()) return localDb.get(c, id, opts);
+      return gf.api('db/' + seg(c) + '/' + seg(id) + ownerQuery(opts)).then(function (r) {
+        // not in this player's space, and another player has a document with this id: null, as any document that is
+        // not there, and said once, since an id alone named any player's before (gamesfun.js 1.3)
+        if (r.code === 'owner') {
+          if (!ownerSaid[c]) {
+            ownerSaid[c] = true;
+            if (globalThis.console) console.warn('gf.db.get: ' + r.error);
+          }
+          return { data: null, error: null, status: 404, code: 'owner', why: r.error };
+        }
         return withCode(
           { data: r.data ? r.data.item : null, error: r.status === 404 ? null : r.error, status: r.status },
           r.status === 404 ? {} : r,
@@ -928,7 +1038,7 @@
         });
       });
     },
-    /** A new document with an id made for it. → {data: the document} */
+    /** A new document of the player's own, with an id made for it. → {data: the document} */
     add: function (c, value) {
       if (!seg(c)) return bad('collection');
       if (useLocalDb()) return localDb.add(c, value);
@@ -938,21 +1048,30 @@
         });
       });
     },
-    /** → {data: [document]}; opts {owner: 'me' | a player id, limit (≤ 100), offset, order: 'new' | 'old'} */
+    /** → {data: [document], after, more}: newest first, a page at a time; pass `after` back for the next page.
+     * opts {owner: 'me' | 'server' | a player's id, limit (≤ 100), after, order: 'new' | 'old'}; an offset but 0 is
+     * refused.
+     * The order is by when each document was last written: one written between two pages moves to the front, so a
+     * listing taken while players write can show it twice or miss it. */
     list: function (c, opts) {
       opts = opts || {};
       if (!seg(c)) return bad('collection');
+      if (noOffset(opts)) return noOffset(opts);
       if (useLocalDb()) return localDb.list(c, opts);
       var q = [];
-      ['owner', 'limit', 'offset', 'order'].forEach(function (k) {
-        if (opts[k] !== undefined) q.push(k + '=' + encodeURIComponent(opts[k]));
+      ['owner', 'limit', 'after', 'order'].forEach(function (k) {
+        if (opts[k] !== undefined && opts[k] !== null) q.push(k + '=' + encodeURIComponent(opts[k]));
       });
       return gf.api('db/' + seg(c) + (q.length ? '?' + q.join('&') : '')).then(function (r) {
-        return pick(r, function (d) {
+        var a = pick(r, function (d) {
           return d.items;
         });
+        a.after = (r.data && r.data.after) || null;
+        a.more = !!(r.data && r.data.more);
+        return a;
       });
     },
+    /** Deletes the player's own document. → {data: {deleted}} */
     delete: function (c, id) {
       if (!seg(c) || !seg(id)) return bad('collection or id');
       if (useLocalDb()) return localDb.delete(c, id);
@@ -960,7 +1079,7 @@
     },
   };
 
-  // ---- multiplayer rooms (xcore add multiplayer: server/rooms.js on games.fun) ----
+  // ---- multiplayer rooms (xcore add multiplayer: server/rooms.js on xgames.fun) ----
   // A room is a relay with a host: the first player in is the host (id 1), the others get ids of their own; a message
   // goes to one player (to: id), to everyone else (0), or to everyone but one (-id). On this machine, tabs of the same
   // browser share a room instead (BroadcastChannel), so two tabs play together before the game is published.
@@ -1228,16 +1347,17 @@
     ch.postMessage({ t: 'who', nonce: nonce });
     return new Promise(function (resolve) {
       setTimeout(function () {
+        // refused: answered (the channel closes below), as a refusal online is
+        if (opts.host === true && replies.length)
+          return resolve({ data: null, error: 'Someone is in this room already: choose another code.', status: 4009 });
+        if (opts.host === false && !replies.length)
+          return resolve({ data: null, error: 'No one is in this room.', status: 4004 });
         var taken = {};
         for (var i = 0; i < replies.length; i++) {
           room.peers[replies[i].peer.id] = replies[i].peer;
           times[replies[i].peer.id] = replies[i].joined;
           taken[replies[i].peer.id] = true;
         }
-        if (opts.host === true && replies.length)
-          return { data: null, error: 'Someone is in this room already: choose another code.', status: 4009 };
-        if (opts.host === false && !replies.length)
-          return { data: null, error: 'No one is in this room.', status: 4004 };
         room.id = replies.length ? 0 : 1;
         while (!room.id || taken[room.id]) room.id = 2 + Math.floor(Math.random() * 0x7ffffffd);
         times[room.id] = joined;
@@ -1285,7 +1405,7 @@
       for (var i = 0; i < a.length; i++) s += CODE_CHARS[a[i] % CODE_CHARS.length];
       return s;
     },
-    /** The room this page was opened for (?room=CODE, as games.fun's room links and their X cards pass it), or null. */
+    /** The room this page was opened for (?room=CODE, as xgames.fun's room links and their X cards pass it), or null. */
     fromLink: function () {
       try {
         return roomCode(new URLSearchParams(loc.search || '').get('room'));
@@ -1293,7 +1413,7 @@
         return null;
       }
     },
-    /** The link that opens the game in this room: games.fun's play page once published (its X card shows the room). */
+    /** The link that opens the game in this room: xgames.fun's play page once published (its X card shows the room). */
     link: function (code) {
       var c = roomCode(code);
       if (!c) return null;