@xgamesfun/xcore 0.1.0 → 0.2.1

package/lib/client/godot/gamesfun.gd

@@ -1,8 +1,8 @@
-# GamesFun: sign-in, saves, leaderboards and the game's own database on games.fun, for a Godot 4 Web export.
+# GamesFun: sign-in, saves, leaderboards and the game's own database on xgames.fun, for a Godot 4 Web export.
 # Written by `xcore add signin` (autoloaded as GamesFun in project.godot); `xcore add signin` again brings it up to date.
-# It loads games.fun's page client (gamesfun.js, carried inside this file) into the page and calls it. Every call
+# It loads xgames.fun's page client (gamesfun.js, carried inside this file) into the page and calls it. Every call
 # answers a Dictionary {data, error, status}; outside a Web export (the editor, a desktop build) the error says so and
-# the game plays on. Export for the Web with Thread Support off: games.fun pages are not cross-origin isolated.
+# the game plays on. Export for the Web with Thread Support off: xgames.fun pages are not cross-origin isolated.
 #
 #   var player = await GamesFun.sign_in()          # from a button press: the player signs in -> Dictionary or null
 #   GamesFun.player_changed.connect(func(p): ...)  # sign-in and sign-out (p: Dictionary or null)
@@ -12,7 +12,7 @@
 #   await GamesFun.scores_submit("best", 1200)     # leaderboards: r.data {improved, best, rank}
 #   var top = await GamesFun.scores_top("best")    # top.data: [{rank, player, name, score, at}]
 #   await GamesFun.db_add("levels", {"name": "Moon"})  # the game's own database (xcore add database)
-#   multiplayer.multiplayer_peer = await GamesFun.join_room(code)  # Godot's multiplayer over games.fun (xcore add multiplayer)
+#   multiplayer.multiplayer_peer = await GamesFun.join_room(code)  # Godot's multiplayer over xgames.fun (xcore add multiplayer)
 #   await GamesFun.loot_call("shop")               # the game's Solana economy (xcore loot add): loot_ready, loot_connect
 #
 # A script that also runs without the autoload (headless tests, `godot --script`) fails to parse on the bare name
@@ -113,7 +113,7 @@ func _set_player(p):
 
 func _run(path: String, args: Array):
 	if _bridge == null:
-		return {"data": null, "error": "games.fun runs in a Web export only", "status": 0}
+		return {"data": null, "error": "xgames.fun runs in a Web export only", "status": 0}
 	var pending = _Pending.new()
 	_keep.append(pending)
 	_bridge.run(path, JSON.stringify(args), pending.callback)
@@ -168,8 +168,10 @@ func scores_mine(board: String):
 	return await _run("scores.mine", [board])
 
 
-func db_get(collection: String, id: String):
-	return await _run("db.get", [collection, id])
+## opts: {"owner": "me" | "server" | a player's id}; without it, the player's own. Another player's document is read
+## by its owner: db_get(c, id, {"owner": doc.owner})
+func db_get(collection: String, id: String, opts := {}):
+	return await _run("db.get", [collection, id, opts])
 
 
 func db_put(collection: String, id: String, value):
@@ -180,8 +182,12 @@ func db_add(collection: String, value):
 	return await _run("db.add", [collection, value])
 
 
-## opts: {"owner": "me", "limit": 50, "offset": 0, "order": "new" | "old"}
+## opts: {"owner": "me" | "server" | a player's id, "limit": 50, "after": the last answer's "after", "order": "new" | "old"}
+## The answer's "after" is null on the last page. An "offset" but 0 is refused (it is gone: page with "after"), here as
+## well, so a loop that paged with it stops in the editor too.
 func db_list(collection: String, opts := {}):
+	if opts.has("offset") and opts["offset"] != null and str(opts["offset"]) != "" and float(str(opts["offset"])) != 0.0:
+		return {"data": null, "error": "db_list takes no offset any more: pass the last answer's after for the next page", "status": 0, "code": "offset"}
 	return await _run("db.list", [collection, opts])
 
 
@@ -241,7 +247,7 @@ func room_code() -> String:
 	return s
 
 
-## The room this page was opened for (games.fun's room links and their X cards pass ?room=CODE), or "".
+## The room this page was opened for (xgames.fun's room links and their X cards pass ?room=CODE), or "".
 func room_from_link() -> String:
 	if _bridge == null:
 		return ""
@@ -249,7 +255,7 @@ func room_from_link() -> String:
 	return str(c) if c != null else ""
 
 
-## The link that opens the game in this room (games.fun's play page once published; its X card shows the room).
+## The link that opens the game in this room (xgames.fun's play page once published; its X card shows the room).
 func room_link(code: String) -> String:
 	if _bridge == null:
 		return ""
@@ -304,5 +310,5 @@ func api(path: String, init := {}):
 	return await _run("api", [path, init])
 
 
-# games.fun's page client (lib/client/gamesfun.js), as base64
+# xgames.fun's page client (lib/client/gamesfun.js), as base64
 const SOURCE = "__GAMESFUN_SOURCE_B64__"

package/lib/client/godot/gamesfun_peer.gd

@@ -1,5 +1,5 @@
-# GamesFunPeer: a games.fun room as Godot's MultiplayerPeer, so a game's high-level multiplayer (RPCs,
-# MultiplayerSpawner, MultiplayerSynchronizer, multiplayer.peer_connected …) runs over games.fun as it runs over ENet.
+# GamesFunPeer: an xgames.fun room as Godot's MultiplayerPeer, so a game's high-level multiplayer (RPCs,
+# MultiplayerSpawner, MultiplayerSynchronizer, multiplayer.peer_connected …) runs over xgames.fun as it runs over ENet.
 # Written by `xcore add multiplayer`; made by GamesFun.join_room(), never by hand:
 #
 #   var peer = await GamesFun.join_room(GamesFun.room_from_link() if GamesFun.room_from_link() != "" else GamesFun.room_code())

package/lib/client/server/0001_init.sql

@@ -0,0 +1,10 @@
+-- The game's first tables, written by `xcore add database`: an example to change before the game is published.
+-- xgames.fun applies each migration once, in name order, before the version that brings it goes live; `xcore dev`
+-- does the same on this machine. Once this one is published, never change it: put the next change in
+-- 0002_<what>.sql (ALTER TABLE players ADD COLUMN …).
+CREATE TABLE players (
+  id TEXT PRIMARY KEY,                -- the player's id: env.GF.verifyPlayer's sub (withPlayer in gf-db.js)
+  gold INTEGER NOT NULL DEFAULT 0,
+  runs INTEGER NOT NULL DEFAULT 3,    -- runs left today
+  updated_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now'))
+);

package/lib/client/server/database.js

@@ -1,181 +1,304 @@
-// The game's own database on games.fun, written into server/ by `xcore add database`. It is part of the game's server
+// The game's own database on xgames.fun, written into server/ by `xcore add database`. It is part of the game's server
 // code (docs/SERVER.md): one Durable Object with SQLite storage, published with the game, at the game's own
 // api/db/. Nothing to sign up for and no keys. The page uses it through gamesfun.js (gf.db); this server's own code
 // through dataOf(env).
 //
-//   GET    api/db/<collection>?owner=me|<id>&limit=&offset=&order=new|old   → {ok, items, more}
-//   GET    api/db/<collection>/<id>                                          → {ok, item}
-//   PUT    api/db/<collection>/<id>  {value}   a signed-in player's own      → {ok, item}
-//   POST   api/db/<collection>       {value}   a new id                      → {ok, item}
-//   DELETE api/db/<collection>/<id>            the owner's                   → {ok, deleted}
+//   GET    api/db/<collection>?owner=me|server|<id>&limit=&after=&order=new|old  → {ok, items, more, after}
+//   GET    api/db/<collection>/<id>?owner=me|server|<id>                         → {ok, item}
+//   PUT    api/db/<collection>/<id>  {value}   the signed-in player's own        → {ok, item}
+//   POST   api/db/<collection>       {value}   a new id, the player's own        → {ok, item}
+//   DELETE api/db/<collection>/<id>            the player's own                  → {ok, deleted}
 //
-// A document is {id, owner, value, updatedAt}: `owner` is the player's id (env.GF.verifyPlayer's `sub`), or "server".
+// A document is {id, owner, value, updatedAt}: `owner` is the player's id (env.GF.verifyPlayer's `sub`), or "server"
+// for what this server's own code writes. Every player has a space of their own in each collection: a document is
+// found by its collection, its owner and its id, so two players can both have a "main", and no player can take an id
+// in anyone else's space. A page names whose document it wants with `owner`; without it, the player's own (in a
+// collection only the server writes: the server's, then the player's own, which the server wrote for them). A get by
+// id alone that finds another player's document in a collection anyone reads answers 400 `owner`: name its owner.
+// Lists come newest first (by when a document was last written), a page at a time: pass the answer's `after` back to
+// get the next page. A document written between two pages moves to the front, so a listing taken while players write
+// can show it twice or not at all: list what must be exact in one page (limit up to 100), or by a field of its own.
 // Change who may read and write a collection in RULES below; that is the whole of its security, so read it once.
 
 import { DurableObject } from 'cloudflare:workers';
 
 /**
  * Who may read and write each collection; '*' is every collection not named.
- * read:  'anyone' (signed in or not) | 'owner' (a player reads only their own documents)
+ * read:  'owner' (a player reads only their own documents) | 'anyone' (signed in or not: any player's, by its owner)
  * write: 'owner' (a signed-in player writes only their own documents) | 'server' (only this server: dataOf(env))
  */
 export const RULES = {
-  '*': { read: 'anyone', write: 'owner' },
+  '*': { read: 'owner', write: 'owner' },
 };
 
-export const LIMITS = { valueBytes: 64 * 1024, docsPerPlayer: 1000, list: 100, offset: 10000 };
+export const LIMITS = { valueBytes: 64 * 1024, docsPerPlayer: 1000, list: 100 };
+
+// ---- the documents' code (xcore add copies it, from here to the end mark, into server/gf-docs.js as well) ----
 
 const NAME = /^[A-Za-z0-9_-]{1,64}$/;
 const SERVER = 'server';
+const OWNER_CHARS = 128;
 const te = new TextEncoder();
 
 const refuse = (status, code, why) => ({ ok: false, status, code, why });
+const own = (o, k) => (Object.hasOwn(o, k) ? o[k] : undefined);
 const ruleOf = (collection, rules) => ({
-  read: 'anyone',
+  read: 'owner',
   write: 'owner',
-  ...(rules['*'] ?? {}),
-  ...(rules[collection] ?? {}),
+  ...(own(rules, '*') ?? {}),
+  ...(own(rules, collection) ?? {}),
 });
+/** RULES, checked: a mistyped rule (read: 'everyone') would otherwise be read as something else. Throws in words. */
+export function checkRules(rules) {
+  if (!rules || typeof rules !== 'object' || Array.isArray(rules))
+    throw new Error("RULES is an object: { '*': { read: 'owner', write: 'owner' } }.");
+  for (const [name, rule] of Object.entries(rules)) {
+    if (name !== '*' && !NAME.test(name))
+      throw new Error(`RULES: ${JSON.stringify(name)} is not a collection (1 to 64 letters, digits, - or _; or '*').`);
+    const ok =
+      rule &&
+      typeof rule === 'object' &&
+      !Array.isArray(rule) &&
+      Object.keys(rule).every(k => k === 'read' || k === 'write') &&
+      (rule.read === undefined || rule.read === 'owner' || rule.read === 'anyone') &&
+      (rule.write === undefined || rule.write === 'owner' || rule.write === 'server');
+    if (!ok) throw new Error(`RULES.${name} is { read: 'owner' | 'anyone', write: 'owner' | 'server' }.`);
+  }
+  return rules;
+}
 const row = r => r && { id: r.id, owner: r.owner, value: JSON.parse(r.value), updatedAt: r.updated };
 
+// the list's place: the last document of a page, as text the page hands back (it never needs to read it)
+const b64url = s =>
+  btoa(String.fromCharCode(...te.encode(s)))
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/, '');
+const unb64url = s =>
+  new TextDecoder().decode(Uint8Array.from(atob(s.replace(/-/g, '+').replace(/_/g, '/')), c => c.charCodeAt(0)));
+export const cursorOf = d => b64url(JSON.stringify([d.updatedAt, d.owner, d.id]));
+function readCursor(text) {
+  try {
+    const [updated, owner, id] = JSON.parse(unb64url(String(text)));
+    if (Number.isSafeInteger(updated) && typeof owner === 'string' && typeof id === 'string')
+      return { updated, owner, id };
+  } catch {}
+  return null;
+}
+
+/**
+ * The tables, made on first use. An older database.js kept one id per collection (whoever wrote it first owned it);
+ * its documents move to the new table as they are, each under its owner. Every step can run again: a move stopped
+ * half way is finished the next time.
+ */
+async function prepare(exec, table) {
+  const made = async name =>
+    (await exec(`SELECT sql FROM sqlite_master WHERE type = 'table' AND name = ?`, name))[0]?.sql ?? null;
+  const create = name =>
+    exec(
+      `CREATE TABLE IF NOT EXISTS ${name} (collection TEXT NOT NULL, owner TEXT NOT NULL, id TEXT NOT NULL, value TEXT NOT NULL, updated INTEGER NOT NULL, PRIMARY KEY (collection, owner, id))`,
+    );
+  const now = await made(table);
+  const next = `${table}_v2`;
+  if (now && /PRIMARY KEY\s*\(\s*collection\s*,\s*id\s*\)/i.test(now)) {
+    await create(next);
+    await exec(
+      `INSERT OR IGNORE INTO ${next} (collection, owner, id, value, updated) SELECT collection, owner, id, value, updated FROM ${table}`,
+    );
+    await exec(`DROP TABLE ${table}`);
+    await exec(`ALTER TABLE ${next} RENAME TO ${table}`);
+  } else if (!now && (await made(next))) await exec(`ALTER TABLE ${next} RENAME TO ${table}`);
+  await create(table);
+  await exec(`CREATE INDEX IF NOT EXISTS ${table}_by_owner ON ${table} (collection, owner, updated, id)`);
+  await exec(`CREATE INDEX IF NOT EXISTS ${table}_by_time ON ${table} (collection, updated, owner, id)`);
+  await exec(`CREATE INDEX IF NOT EXISTS ${table}_by_id ON ${table} (collection, id)`);
+}
+
 /**
- * The database over SQLite: `sql.exec(query, ...bindings)` answers the rows (a Durable Object's ctx.storage.sql, or
- * any SQLite with that shape). `who` is the player's id, '' for a guest, or "server" for the server's own code.
+ * The database over SQLite. `exec(query, ...bindings)` answers the rows, or a promise of them (a Durable Object's
+ * ctx.storage.sql, D1, or any SQLite with that shape). Every call is async. `who` is the player's id, '' for a guest,
+ * or "server" for the server's own code. `opts.owner` names whose space a document is in: 'me', 'server' or a
+ * player's id.
  */
-export function createData(sql, { rules = RULES, limits = LIMITS, now = () => Date.now() } = {}) {
-  sql.exec(
-    'CREATE TABLE IF NOT EXISTS docs (collection TEXT NOT NULL, id TEXT NOT NULL, owner TEXT NOT NULL, value TEXT NOT NULL, updated INTEGER NOT NULL, PRIMARY KEY (collection, id))',
-  );
-  sql.exec('CREATE INDEX IF NOT EXISTS docs_owner ON docs (collection, owner, updated)');
-  sql.exec('CREATE INDEX IF NOT EXISTS docs_updated ON docs (collection, updated)');
-  const rows = (q, ...b) => [...sql.exec(q, ...b)];
+export function createData(exec, { rules = RULES, limits = LIMITS, now = () => Date.now(), table = 'docs' } = {}) {
+  checkRules(rules);
+  const rows = async (q, ...b) => [...(await exec(q, ...b))];
+  const ready = prepare(rows, table);
   const named = (collection, id) =>
     !NAME.test(String(collection))
       ? refuse(400, 'bad', 'A collection is 1 to 64 letters, digits, - or _.')
       : id !== undefined && !NAME.test(String(id))
         ? refuse(400, 'bad', 'An id is 1 to 64 letters, digits, - or _.')
         : null;
-  const canWrite = (rule, who) =>
+  /** Whose space `owner` names for `who`: {owner} or a refusal. Without one: the player's own, or the server's. */
+  const spaceOf = (rule, owner, who) => {
+    if (owner === undefined || owner === null || owner === '')
+      owner = who === SERVER || rule.write === 'server' ? SERVER : 'me';
+    if (owner === 'me') {
+      if (!who) return refuse(401, 'player', 'Sign in first, or name whose document it is (owner).');
+      return { owner: who };
+    }
+    if (typeof owner !== 'string' || owner.length > OWNER_CHARS)
+      return refuse(400, 'bad', `An owner is "me", "server" or a player's id (at most ${OWNER_CHARS} characters).`);
+    return { owner };
+  };
+  /** May `who` write in `owner`'s space of this collection? null, or the refusal. */
+  const canWrite = (rule, owner, who) =>
     who === SERVER
       ? null
       : rule.write === 'server'
         ? refuse(403, 'server-only', 'Only the game itself writes here.')
-        : who
-          ? null
-          : refuse(401, 'player', 'Sign in first.');
+        : !who
+          ? refuse(401, 'player', 'Sign in first.')
+          : owner !== who
+            ? refuse(403, 'not-yours', 'A player writes only their own documents.')
+            : null;
+  const canRead = (rule, owner, who) => who === SERVER || rule.read === 'anyone' || owner === who;
 
   const data = {
-    get(collection, id, who = '') {
+    async get(collection, id, opts = {}, who = '') {
+      await ready;
       const bad = named(collection, id);
       if (bad) return bad;
-      const item = row(rows('SELECT * FROM docs WHERE collection = ? AND id = ?', collection, id)[0]);
-      if (!item) return refuse(404, 'unknown', 'No such document.');
       const rule = ruleOf(collection, rules);
-      if (rule.read === 'owner' && who !== SERVER && item.owner !== who)
-        return refuse(404, 'unknown', 'No such document.');
-      return { ok: true, item };
+      const space = spaceOf(rule, opts?.owner, who);
+      if (!space.owner) return space;
+      const byIdAlone = opts?.owner === undefined || opts?.owner === null || opts?.owner === '';
+      // where to look: the space named; by id alone in a collection only the server writes, the server's and then the
+      // player's own (what the server wrote for them)
+      const spaces = [space.owner];
+      if (byIdAlone && rule.write === 'server' && who && who !== SERVER) spaces.push(who);
+      for (const owner of spaces) {
+        // read: 'owner': another player's document is not there, not even that it exists
+        if (!canRead(rule, owner, who)) continue;
+        const item = row(
+          (
+            await rows(`SELECT * FROM ${table} WHERE collection = ? AND owner = ? AND id = ?`, collection, owner, id)
+          )[0],
+        );
+        if (item) return { ok: true, item };
+      }
+      // by id alone, in a collection anyone reads, another player's document (how ids worked before each player had a
+      // space of their own): said, with what to send instead
+      if (byIdAlone && rule.read === 'anyone' && who !== SERVER) {
+        const other = (
+          await rows(`SELECT owner FROM ${table} WHERE collection = ? AND id = ? LIMIT 1`, collection, id)
+        )[0];
+        if (other)
+          return refuse(
+            400,
+            'owner',
+            `${collection}/${id} is not in your own space: every player has a space of their own, so name whose document it is with {owner} (gf.db.get('${collection}', '${id}', {owner}), GET api/db/${collection}/${id}?owner=<their id>). A document's owner is in it, and in each item of a list.`,
+          );
+      }
+      return refuse(404, 'unknown', 'No such document.');
     },
-    put(collection, id, value, who = '') {
+    async put(collection, id, value, opts = {}, who = '') {
+      await ready;
       const bad = named(collection, id);
       if (bad) return bad;
       const rule = ruleOf(collection, rules);
-      const denied = canWrite(rule, who);
+      const space = spaceOf(rule, opts?.owner, who);
+      if (!space.owner) return space;
+      const denied = canWrite(rule, space.owner, who);
       if (denied) return denied;
       if (value === undefined) return refuse(400, 'bad', 'A document needs a value (any JSON).');
       const text = JSON.stringify(value);
       if (te.encode(text).byteLength > limits.valueBytes)
         return refuse(413, 'too-big', `A document may be ${limits.valueBytes / 1024} KB.`);
-      const was = rows('SELECT owner FROM docs WHERE collection = ? AND id = ?', collection, id)[0];
-      if (was && who !== SERVER && was.owner !== who)
-        return refuse(403, 'not-yours', 'Another player owns this document.');
-      if (!was && who !== SERVER) {
-        const n = rows('SELECT count(*) AS n FROM docs WHERE collection = ? AND owner = ?', collection, who)[0].n;
-        if (n >= limits.docsPerPlayer)
-          return refuse(409, 'full', `A player may keep ${limits.docsPerPlayer} documents in ${collection}.`);
-      }
-      const owner = was ? was.owner : who;
       const t = now();
-      sql.exec(
-        'INSERT INTO docs (collection, id, owner, value, updated) VALUES (?, ?, ?, ?, ?) ON CONFLICT (collection, id) DO UPDATE SET value = excluded.value, updated = excluded.updated',
+      // one statement, so two calls at once cannot both pass the count: a document already there is replaced; a new
+      // one only while its owner has room (the server's own space has no cap)
+      const cap = space.owner === SERVER ? Number.MAX_SAFE_INTEGER : limits.docsPerPlayer;
+      const done = await rows(
+        `INSERT INTO ${table} (collection, owner, id, value, updated) SELECT ?, ?, ?, ?, ? WHERE EXISTS (SELECT 1 FROM ${table} WHERE collection = ? AND owner = ? AND id = ?) OR (SELECT count(*) FROM ${table} WHERE collection = ? AND owner = ?) < ? ON CONFLICT (collection, owner, id) DO UPDATE SET value = excluded.value, updated = excluded.updated RETURNING id`,
         collection,
+        space.owner,
         id,
-        owner,
         text,
         t,
+        collection,
+        space.owner,
+        id,
+        collection,
+        space.owner,
+        cap,
       );
-      return { ok: true, item: { id, owner, value: JSON.parse(text), updatedAt: t } };
+      if (!done.length)
+        return refuse(409, 'full', `A player may keep ${limits.docsPerPlayer} documents in ${collection}.`);
+      return { ok: true, item: { id, owner: space.owner, value: JSON.parse(text), updatedAt: t } };
     },
-    add(collection, value, who = '') {
-      return data.put(collection, crypto.randomUUID().replaceAll('-', '').slice(0, 20), value, who);
+    async add(collection, value, opts = {}, who = '') {
+      return data.put(collection, crypto.randomUUID().replaceAll('-', '').slice(0, 20), value, opts, who);
     },
-    list(collection, { owner = '', limit = 50, offset = 0, order = 'new' } = {}, who = '') {
+    async list(collection, { owner = '', limit = 50, after = '', order = 'new', offset } = {}, who = '') {
+      await ready;
       const bad = named(collection);
       if (bad) return bad;
+      if (offset !== undefined && offset !== '' && Number(offset) !== 0)
+        return refuse(400, 'bad', "offset is gone: page with after (the last answer's after).");
       const rule = ruleOf(collection, rules);
-      let of = owner === 'me' ? who : String(owner || '');
-      if (owner === 'me' && !who) return refuse(401, 'player', 'Sign in first.');
-      if (rule.read === 'owner' && who !== SERVER) {
+      let of = '';
+      if (owner) {
+        const space = spaceOf(rule, owner, who);
+        if (!space.owner) return space;
+        of = space.owner;
+      }
+      // anything but read: 'anyone' is the player's own only (fail closed: a rule this code does not know shows nothing)
+      if (rule.read !== 'anyone' && who !== SERVER) {
         if (!who) return refuse(401, 'player', 'Sign in first.');
         of = who; // a player lists only their own here
       }
       const n = Math.max(1, Math.min(limits.list, Number(limit) | 0 || 50));
-      const skip = Math.max(0, Math.min(limits.offset, Number(offset) | 0));
-      const dir = order === 'old' ? 'ASC' : 'DESC';
-      const found = of
-        ? rows(
-            `SELECT * FROM docs WHERE collection = ? AND owner = ? ORDER BY updated ${dir}, id LIMIT ? OFFSET ?`,
-            collection,
-            of,
-            n + 1,
-            skip,
-          )
-        : rows(
-            `SELECT * FROM docs WHERE collection = ? ORDER BY updated ${dir}, id LIMIT ? OFFSET ?`,
-            collection,
-            n + 1,
-            skip,
-          );
-      return { ok: true, items: found.slice(0, n).map(row), more: found.length > n };
+      const from = after ? readCursor(after) : null;
+      if (after && !from) return refuse(400, 'bad', "after is the last answer's after, as it came.");
+      const old = order === 'old';
+      const dir = old ? 'ASC' : 'DESC';
+      const where = [`collection = ?`];
+      const args = [collection];
+      if (of) (where.push('owner = ?'), args.push(of));
+      if (from)
+        (where.push(`(updated, owner, id) ${old ? '>' : '<'} (?, ?, ?)`), args.push(from.updated, from.owner, from.id));
+      const found = await rows(
+        `SELECT * FROM ${table} WHERE ${where.join(' AND ')} ORDER BY updated ${dir}, owner ${dir}, id ${dir} LIMIT ?`,
+        ...args,
+        n + 1,
+      );
+      const items = found.slice(0, n).map(row);
+      const more = found.length > n;
+      return { ok: true, items, more, after: more ? cursorOf(items.at(-1)) : null };
     },
-    delete(collection, id, who = '') {
+    async delete(collection, id, opts = {}, who = '') {
+      await ready;
       const bad = named(collection, id);
       if (bad) return bad;
       const rule = ruleOf(collection, rules);
-      const denied = canWrite(rule, who);
+      const space = spaceOf(rule, opts?.owner, who);
+      if (!space.owner) return space;
+      const denied = canWrite(rule, space.owner, who);
       if (denied) return denied;
-      const was = rows('SELECT owner FROM docs WHERE collection = ? AND id = ?', collection, id)[0];
-      if (!was) return { ok: true, deleted: false };
-      if (who !== SERVER && was.owner !== who) return refuse(403, 'not-yours', 'Another player owns this document.');
-      sql.exec('DELETE FROM docs WHERE collection = ? AND id = ?', collection, id);
-      return { ok: true, deleted: true };
+      const gone = await rows(
+        `DELETE FROM ${table} WHERE collection = ? AND owner = ? AND id = ? RETURNING id`,
+        collection,
+        space.owner,
+        id,
+      );
+      return { ok: true, deleted: gone.length > 0 };
     },
   };
+  data.ready = ready;
   return data;
 }
 
-/** The Durable Object that holds the database (gamesfun.json → server.objects: {class: "GameData", binding: "GAME_DATA"}). */
-export class GameData extends DurableObject {
-  constructor(ctx, env) {
-    super(ctx, env);
-    this.data = createData(ctx.storage.sql);
-  }
-  /** One call, over RPC: op is get | put | add | list | delete, args as createData's. */
-  run(op, args) {
-    if (!Object.hasOwn(this.data, op)) return refuse(400, 'bad', `No such call: ${op}.`);
-    return this.data[op](...args);
-  }
-}
-
-const stubOf = env => env.GAME_DATA.get(env.GAME_DATA.idFromName('main'));
-
-/** This server's own access, past the players' rules (owner "server"): await dataOf(env).put('news', 'today', {…}). */
-export function dataOf(env) {
-  const stub = stubOf(env);
-  const as =
-    op =>
-    (...args) =>
-      stub.run(op, op === 'list' ? [args[0], args[1] ?? {}, SERVER] : [...args, SERVER]);
-  return { get: as('get'), put: as('put'), add: as('add'), list: as('list'), delete: as('delete') };
+/** dataOf's calls over any `run(op, args)` (the Durable Object's, or the stock server's D1). */
+export function serverData(run) {
+  return {
+    get: (collection, id, opts = {}) => run('get', [collection, id, opts, SERVER]),
+    put: (collection, id, value, opts = {}) => run('put', [collection, id, value, opts, SERVER]),
+    add: (collection, value, opts = {}) => run('add', [collection, value, opts, SERVER]),
+    list: (collection, opts = {}) => run('list', [collection, opts, SERVER]),
+    delete: (collection, id, opts = {}) => run('delete', [collection, id, opts, SERVER]),
+  };
 }
 
 const reply = (a, status = a.ok ? 200 : a.status) => {
@@ -183,8 +306,11 @@ const reply = (a, status = a.ok ? 200 : a.status) => {
   return Response.json(body, { status, headers: { 'cache-control': 'no-store' } });
 };
 
-/** The page's calls to api/db/…; null for any other path, so the server's own routes go on. */
-export async function handleDatabase(request, env) {
+/**
+ * The page's calls to api/db/…, answered by `run(op, args)` (createData's calls). → the Response, or null for any
+ * other path, so the server's own routes go on.
+ */
+export async function routeDatabase(request, env, run) {
   const url = new URL(request.url);
   const m = /\/api\/db\/([^/]+)(?:\/([^/]+))?\/?$/.exec(url.pathname);
   if (!m) return null;
@@ -195,7 +321,7 @@ export async function handleDatabase(request, env) {
   } catch {
     return reply(refuse(400, 'bad', 'Not a path.'));
   }
-  // who is asking: the sign-in token the page sends (gamesfun.js does), checked by games.fun
+  // who is asking: the sign-in token the page sends (gamesfun.js does), checked by xgames.fun
   const bearer = /^Bearer\s+(\S+)$/i.exec(request.headers.get('authorization') ?? '')?.[1];
   let who = '';
   if (bearer) {
@@ -204,6 +330,9 @@ export async function handleDatabase(request, env) {
       return reply(
         refuse(401, 'player', `Sign in again: ${String(v?.why ?? 'not a player token').replace(/\.$/, '')}.`),
       );
+    // "server" is the server's own space: no player is it
+    if (typeof v.sub !== 'string' || !v.sub || v.sub === SERVER)
+      return reply(refuse(401, 'player', 'Sign in again: not a player.'));
     who = v.sub;
   }
   const method = request.method.toUpperCase();
@@ -218,12 +347,45 @@ export async function handleDatabase(request, env) {
       return reply(refuse(400, 'bad', 'The body is not JSON.'));
     }
   }
-  const stub = stubOf(env);
   const q = Object.fromEntries(url.searchParams);
-  if (id === undefined && method === 'GET') return reply(await stub.run('list', [collection, q, who]));
-  if (id === undefined && method === 'POST') return reply(await stub.run('add', [collection, body.value, who]));
-  if (id !== undefined && method === 'GET') return reply(await stub.run('get', [collection, id, who]));
-  if (id !== undefined && method === 'PUT') return reply(await stub.run('put', [collection, id, body.value, who]));
-  if (id !== undefined && method === 'DELETE') return reply(await stub.run('delete', [collection, id, who]));
+  const opts = q.owner === undefined ? {} : { owner: q.owner };
+  if (id === undefined && method === 'GET') return reply(await run('list', [collection, q, who]));
+  if (id === undefined && method === 'POST') return reply(await run('add', [collection, body.value, opts, who]));
+  if (id !== undefined && method === 'GET') return reply(await run('get', [collection, id, opts, who]));
+  if (id !== undefined && method === 'PUT') return reply(await run('put', [collection, id, body.value, opts, who]));
+  if (id !== undefined && method === 'DELETE') return reply(await run('delete', [collection, id, opts, who]));
   return reply(refuse(405, 'method', `${method} is not a database call here.`));
 }
+
+// ---- end of the documents' code ----
+
+/** The Durable Object that holds the database (gamesfun.json → server.objects: {class: "GameData", binding: "GAME_DATA"}). */
+export class GameData extends DurableObject {
+  constructor(ctx, env) {
+    super(ctx, env);
+    this.data = createData((q, ...b) => ctx.storage.sql.exec(q, ...b));
+    // the tables are ready (an older one moved) before the first call
+    ctx.blockConcurrencyWhile?.(() => this.data.ready);
+  }
+  /** One call, over RPC: op is get | put | add | list | delete, args as createData's. */
+  run(op, args) {
+    if (!['get', 'put', 'add', 'list', 'delete'].includes(op)) return refuse(400, 'bad', `No such call: ${op}.`);
+    return this.data[op](...args);
+  }
+}
+
+const stubOf = env => env.GAME_DATA.get(env.GAME_DATA.idFromName('main'));
+
+/**
+ * This server's own access, past the players' rules. Without an owner it reads and writes the server's own space
+ * (owner "server"): await dataOf(env).put('news', 'today', {…}). With one, a player's: dataOf(env).get('profiles',
+ * 'main', {owner: sub}). A list without an owner is everyone's.
+ */
+export function dataOf(env) {
+  return serverData((op, args) => stubOf(env).run(op, args));
+}
+
+/** The page's calls to api/db/…, to the one Durable Object; null for any other path. */
+export function handleDatabase(request, env) {
+  return routeDatabase(request, env, (op, args) => stubOf(env).run(op, args));
+}