@xgamesfun/xcore 0.1.0 → 0.2.1

package/lib/client/server/gf-db.js

@@ -0,0 +1,55 @@
+// The game's database on xgames.fun (a D1 database of its own: gamesfun.json → database), for this server's own code.
+// Written by `xcore add database`; running it again brings this file up to date.
+// Its tables come from the migrations in server/migrations/ (0001_init.sql, then 0002_….sql): xgames.fun applies the
+// new ones, in name order, before the version that brings them goes live, and `xcore dev` does the same with a
+// database on this machine. Add a migration for each change; never change one that was published.
+//
+//   import { db, withPlayer } from './gf-db.js';
+//   const sub = await withPlayer(request, env);             // the signed-in player's id, or null
+//   if (!sub) return Response.json({ why: 'Sign in first.' }, { status: 401 });
+//   const me = await db(env).first('SELECT gold, runs FROM players WHERE id = ?', sub);
+//   // a rule in one statement, so two requests at once cannot both pass it
+//   const left = await db(env).first('UPDATE players SET runs = runs - 1 WHERE id = ? AND runs > 0 RETURNING runs', sub);
+//   await db(env).batch([['INSERT INTO runs (player) VALUES (?)', sub], ['UPDATE players SET gold = gold + 5 WHERE id = ?', sub]]);
+//
+// Always pass a value as a ? and an argument, never inside the SQL's text: a player's words in the SQL are a way in.
+
+/** The database's name on env (gamesfun.json → database.binding). */
+const BINDING = '__BINDING__';
+
+/** Prepared queries on the game's database. */
+export function db(env) {
+  const d1 = env[BINDING];
+  if (!d1) throw new Error(`The game's database is not bound as env.${BINDING} (gamesfun.json → database).`);
+  const statement = (sql, params) => d1.prepare(sql).bind(...params);
+  return {
+    /** Every row it answers. → [row] */
+    async all(sql, ...params) {
+      return (await statement(sql, params).all()).results ?? [];
+    },
+    /** The first row, or null. */
+    first(sql, ...params) {
+      return statement(sql, params).first();
+    },
+    /** A write. → {changes, lastRowId} */
+    async run(sql, ...params) {
+      const r = await statement(sql, params).run();
+      return { changes: r.meta?.changes ?? 0, lastRowId: r.meta?.last_row_id ?? null };
+    },
+    /** Several statements, all of them or none: [[sql, ...params], …]. → the rows of each */
+    async batch(list) {
+      const done = await d1.batch(list.map(([sql, ...params]) => statement(sql, params)));
+      return done.map(r => r.results ?? []);
+    },
+    /** D1 itself, for anything else (env.<BINDING>). */
+    d1,
+  };
+}
+
+/** The signed-in player's id (env.GF.verifyPlayer's sub), from the token gamesfun.js sends; null for a guest. */
+export async function withPlayer(request, env) {
+  const token = /^Bearer\s+(\S+)$/i.exec(request.headers.get('authorization') ?? '')?.[1];
+  if (!token) return null;
+  const v = await env.GF.verifyPlayer(token);
+  return v?.ok && typeof v.sub === 'string' && v.sub ? v.sub : null;
+}

package/lib/client/server/gf-docs.js

@@ -0,0 +1,56 @@
+// The page's documents (gf.db in gamesfun.js) in the game's own D1 database, for a game with a server of its own.
+// Written by `xcore add` (database, multiplayer, rpc, vouchers) when gamesfun.json → database has `collections`;
+// running it again brings this file up to date. It answers api/db/* with the same routes and answers as xcore's stock
+// server, from the same table (gf_docs), under the same rules: gamesfun.json → database.collections, read from that
+// file when the server is bundled, so the rules are in one place. Route it first thing in the server's fetch:
+//
+//   import { handleDocs } from './gf-docs.js';
+//   const db = await handleDocs(request, env);
+//   if (db) return db;
+//
+//   GET    api/db/<collection>?owner=me|server|<id>&limit=&after=&order=new|old  → {ok, items, more, after}
+//   GET    api/db/<collection>/<id>?owner=me|server|<id>                         → {ok, item}
+//   PUT    api/db/<collection>/<id>  {value}   the signed-in player's own        → {ok, item}
+//   POST   api/db/<collection>       {value}   a new id, the player's own        → {ok, item}
+//   DELETE api/db/<collection>/<id>            the player's own                  → {ok, deleted}
+//
+// This server's own code reads and writes past the rules with docsOf(env) (the server's own space, owner "server", by
+// default; a player's with {owner: sub}): await docsOf(env).put('news', 'today', {…}).
+import config from '../gamesfun.json';
+
+/** Who may read and write each collection: gamesfun.json → database.collections ('*' is every collection not named). */
+const RULES = config?.database?.collections ?? { '*': { read: 'owner', write: 'owner' } };
+/** The database's name on env (gamesfun.json → database.binding). */
+const BINDING = config?.database?.binding ?? 'DB';
+
+export const LIMITS = { valueBytes: 64 * 1024, docsPerPlayer: 1000, list: 100 };
+
+// __DOCS_CORE__
+
+/** D1 as createData's exec(query, ...bindings) → rows. */
+const d1 =
+  db =>
+  async (q, ...b) => {
+    const r = await db
+      .prepare(q)
+      .bind(...b)
+      .all();
+    return r.results ?? [];
+  };
+
+let data = null;
+const docs = env => {
+  const db = env[BINDING];
+  if (!db) throw new Error(`The game's database is not bound as env.${BINDING} (gamesfun.json → database).`);
+  return (data ??= createData(d1(db), { rules: RULES, table: 'gf_docs' }));
+};
+
+/** The page's calls to api/db/…, from the game's database; null for any other path, so the server's routes go on. */
+export function handleDocs(request, env) {
+  return routeDatabase(request, env, (op, args) => docs(env)[op](...args));
+}
+
+/** This server's own access to the documents, past the players' rules (as server/database.js's dataOf). */
+export function docsOf(env) {
+  return serverData((op, args) => docs(env)[op](...args));
+}

package/lib/client/server/rooms.js

@@ -1,4 +1,4 @@
-// The game's multiplayer rooms on games.fun, written into server/ by `xcore add multiplayer`. Part of the game's server
+// The game's multiplayer rooms on xgames.fun, written into server/ by `xcore add multiplayer`. Part of the game's server
 // code (docs/SERVER.md): one Durable Object a room, holding its players' WebSockets at the game's own
 // api/rooms/<CODE>. Nothing to sign up for and no keys; publish puts it up with the game. The page joins through
 // gamesfun.js (GamesFun.rooms.join), Godot's high-level multiplayer through the GamesFun peer, Unity through
@@ -27,7 +27,7 @@ import { DurableObject } from 'cloudflare:workers';
 export const ROOM = {
   /** Most players in one room. */
   maxPlayers: 16,
-  /** Only players signed in to games.fun may join (their games.fun id and X handle come with them). */
+  /** Only players signed in to xgames.fun may join (their xgames.fun id and X handle come with them). */
   signedIn: false,
   /** The largest message, in bytes. */
   messageBytes: 64 * 1024,
@@ -172,19 +172,23 @@ export class GameRoom extends DurableObject {
       /* not JSON */
     }
     if (m?.t !== 'hello') return ws.close(4000, 'Say hello first.');
+    // the sign-in check first: it goes out to xgames.fun, and the room takes other players' hellos while it waits, so
+    // who is in the room is read only after it (two players hosting one code at once: one host, the other refused)
+    let player = null;
+    if (m.token) {
+      const v = await this.env.GF.verifyPlayer(String(m.token));
+      if (v?.ok) player = { id: v.sub, x: v.x?.handle ?? null, wallet: v.wallet ?? null };
+    }
+    // its own storage: the room takes no other message while it waits on that
+    const locked = (await this.ctx.storage.get('locked')) === true;
+    // from here to the seat taken below, nothing is awaited: the checks and the seat are one step
     const players = seated(this.ctx);
     // a Host button opens a room of its own, a Join button joins one that is there (as over ENet)
     if (m.host === true && players.length)
       return ws.close(4009, 'Someone is in this room already: choose another code.');
     if (m.host === false && !players.length) return ws.close(4004, 'No one is in this room.');
     if (players.length >= ROOM.maxPlayers) return ws.close(4003, 'The room is full.');
-    if (players.length && (await this.ctx.storage.get('locked')) === true) return ws.close(4003, 'The room is closed.');
-    if (!players.length) await this.ctx.storage.delete('locked');
-    let player = null;
-    if (m.token) {
-      const v = await this.env.GF.verifyPlayer(String(m.token));
-      if (v?.ok) player = { id: v.sub, x: v.x?.handle ?? null, wallet: v.wallet ?? null };
-    }
+    if (players.length && locked) return ws.close(4003, 'The room is closed.');
     if (ROOM.signedIn && !player) return ws.close(4001, 'Sign in to join this room.');
     const name = String(m.name ?? player?.x ?? '')
       // eslint-disable-next-line no-control-regex -- a name never carries control characters
@@ -208,6 +212,9 @@ export class GameRoom extends DurableObject {
     });
     const join = JSON.stringify({ t: 'join', peer: { id, name, player } });
     for (const p of players) said(p.ws, join);
+    // the first in: a lock left from the room's last players goes (asked after the seat is taken, so it is never
+    // between this player's seat and the room hearing of it)
+    if (!players.length && locked) await this.ctx.storage.delete('locked');
   }
 
   allowed(ws, id) {

package/lib/client/server/rpc.js

@@ -1,12 +1,12 @@
-// The game's own Solana RPC on games.fun, written into server/ by `xcore add rpc`. Part of the game's server code
+// The game's own Solana RPC on xgames.fun, written into server/ by `xcore add rpc`. Part of the game's server code
 // (docs/SERVER.md): the economy's page client (gamesfun.js → GamesFun.loot) reads and sends through the game's own
-// api/rpc instead of games.fun's shared relay (/loot/v1/rpc), so the game's calls go to the RPC its owner pays for
+// api/rpc instead of xgames.fun's shared relay (/loot/v1/rpc), so the game's calls go to the RPC its owner pays for
 // (Helius, Triton, QuickNode: a devnet one, like loot) and never count toward the game's plan as relay calls.
 //
 // The RPC's URL (its key in it) is a secret of the game's server, never the page's:
-//   xcore secret set XSOLANA_RPC_URL <folder>     on games.fun (asked for, never shown)
+//   xcore secret set XSOLANA_RPC_URL <folder>     on xgames.fun (asked for, never shown)
 //   XSOLANA_RPC_URL=… in the folder's .dev.vars   under xcore dev
-// Unset, api/rpc says so and the page keeps using games.fun's shared relay: nothing breaks.
+// Unset, api/rpc says so and the page keeps using xgames.fun's shared relay: nothing breaks.
 //
 //   GET  api/rpc   → {gamesfun: 'rpc', own: true | false}       what the page asks first, once a page load
 //   POST api/rpc   one JSON-RPC request → the RPC's own answer
@@ -16,7 +16,7 @@
 // call counts as one request to the game's server (its plan's rates).
 
 export const RPC = {
-  /** The JSON-RPC methods loot's page client calls (the same list as games.fun's shared relay). */
+  /** The JSON-RPC methods loot's page client calls (the same list as xgames.fun's shared relay). */
   methods: [
     'getAccountInfo',
     'getAsset',
@@ -145,7 +145,7 @@ export async function handleRpc(request, env) {
     return refuse(
       null,
       -32000,
-      "This game has no RPC of its own (XSOLANA_RPC_URL, a devnet https URL): use games.fun's /loot/v1/rpc.",
+      "This game has no RPC of its own (XSOLANA_RPC_URL, a devnet https URL): use xgames.fun's /loot/v1/rpc.",
       503,
     );
   const text = await request.text();
@@ -195,7 +195,7 @@ export async function handleRpc(request, env) {
   }
   const type = upstream.headers.get('content-type') ?? '';
   if (!upstream.ok && !type.includes('json')) {
-    // games.fun's own refusal (an origin not in backend.json) or the RPC's: in words, never the URL with its key
+    // xgames.fun's own refusal (an origin not in backend.json) or the RPC's: in words, never the URL with its key
     const said = (await upstream.text()).split(rpc).join(new URL(rpc).origin).slice(0, 300);
     return refuse(call.id, -32000, `The game's RPC call was refused (${upstream.status}): ${said}`, 502);
   }

package/lib/client/server/stock.js

@@ -0,0 +1,37 @@
+// xcore's stock server: the server a game gets when gamesfun.json has a database and the game has no server/ of its
+// own. It serves the page's api/db/* (gf.db in gamesfun.js) from the game's D1 database, with the same routes and
+// answers as server/database.js (./database.js: the two share that code), under the rules in gamesfun.json →
+// database.collections. Its documents live in a table of its own, gf_docs, which it makes itself; the game's own
+// migrations make any other tables. xcore bundles this file with the rules and the binding's name (gf:stock) as the
+// game's server, so nothing of it is in the game folder.
+import { createData, routeDatabase } from './database.js';
+import SETTINGS from 'gf:stock';
+
+/** D1 as createData's exec(query, ...bindings) → rows. */
+function d1(db) {
+  return async (q, ...b) => {
+    const r = await db
+      .prepare(q)
+      .bind(...b)
+      .all();
+    return r.results ?? [];
+  };
+}
+
+let data = null;
+const dataOf = env => {
+  const db = env[SETTINGS.binding];
+  if (!db) throw new Error(`The game's database is not bound as env.${SETTINGS.binding}.`);
+  return (data ??= createData(d1(db), { rules: SETTINGS.rules, table: 'gf_docs' }));
+};
+
+export default {
+  async fetch(request, env) {
+    const db = await routeDatabase(request, env, (op, args) => dataOf(env)[op](...args));
+    if (db) return db;
+    // gamesfun.js asks once a page load whether the game has its own RPC (xcore add rpc): it has not
+    if (request.method === 'GET' && /\/api\/rpc\/?$/.test(new URL(request.url).pathname))
+      return Response.json({ gamesfun: 'rpc', own: false });
+    return Response.json({ ok: false, code: 'unknown', why: 'Not a route of this game.' }, { status: 404 });
+  },
+};

package/lib/client/server/vouchers.js

@@ -1,8 +1,8 @@
-// The game's own voucher key on games.fun, written into server/ by `xcore add vouchers`. Part of the game's server code
+// The game's own voucher key on xgames.fun, written into server/ by `xcore add vouchers`. Part of the game's server code
 // (docs/SERVER.md, "Paying a result"): a reward for a result (a score, a win, a clear) is a grant in the game's economy
 // claimed with a voucher, and this server signs the voucher once its own check says the result pays. The key is the
 // owner's secret, never the page's:
-//   xcore secret set VOUCHER_SEED --new-key <folder>   on games.fun: a live key made there, never on this machine
+//   xcore secret set VOUCHER_SEED --new-key <folder>   on xgames.fun: a live key, sent there only, never kept on this machine
 //   VOUCHER_SEED=… in the folder's .dev.vars           under xcore dev: a key of its own, for testing
 // Unset, nothing is paid and api/vouchers/key says so.
 //
@@ -18,8 +18,9 @@
 //
 // One result pays one wallet once: each voucher names a round (the result's own id) and the GameVouchers Durable
 // Object remembers every round it signed, so the same result asked again gets the same voucher, never one for another
-// wallet or amount, and never one for the grant once it has been made again (a new campaign pays new rounds). The
-// voucher bytes are loot's own (server/gf-loot/, a copy of @xgamesfun/solana that publish keeps current).
+// wallet or amount, and never one for the grant once it has been made again (a new campaign pays new rounds). A round
+// goes free → reserved → signed, and roundStep below is the one place that moves it on. The voucher bytes are loot's
+// own (server/gf-loot/, a copy of @xgamesfun/solana that publish keeps current).
 
 import { DurableObject } from 'cloudflare:workers';
 import { proofRequest, signVoucher, verifyProof } from './gf-loot/results/index.js';
@@ -45,8 +46,10 @@ import ECONOMY from '__ECONOMY__';
  *     return { grant: 'clear', round: body.runId, amount: 'grant' }; // the grant's own amount, once a run
  *   },
  *
- * paid (optional) runs once a voucher is signed, with what check answered and the voucher: count a player's daily
- * total there, not in check, so a refusal after check (no proven wallet, a round already used) costs them nothing.
+ * paid (optional) runs once a round, after its voucher is signed, with what check answered and the voucher: count a
+ * player's daily total there, not in check, so a refusal after check (no proven wallet, a round already used) costs
+ * them nothing. Not again for the same round asked twice at once or signed anew near its expiry; if paid throws, the
+ * round is not counted and a later ask for it runs paid again.
  * Every wallet is a new player on a chain, and a wallet sign-in costs nothing: cap what a person can take with
  * VOUCHERS.payOnly 'x' (only players signed in with X, counted per X account) for rewards worth farming, and give each
  * grant a perDay total in xsolana.json.
@@ -68,7 +71,7 @@ export const VOUCHERS = {
   linkSeconds: 600,
 };
 
-const RELAY = 'https://play.xgames.fun/loot/v1/rpc'; // games.fun's devnet relay (the public RPC refuses Workers)
+const RELAY = 'https://play.xgames.fun/loot/v1/rpc'; // xgames.fun's devnet relay (the public RPC refuses Workers)
 const PATH = /\/api\/vouchers\/(key|pay|link)\/?$/;
 const te = new TextEncoder();
 const hex = bytes => Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
@@ -131,6 +134,88 @@ function grantOf(grant) {
   return { ok: true, project: live.project, id: g.id, key: g.key, perPerson: Number(g.limits?.perPerson ?? 0) };
 }
 
+/** A round's record in GameVouchers: `${grant id}:${round}`. */
+const roundKey = (grant, round) => `${grant}:${round}`;
+
+/**
+ * A round's record, {incarnation, wallet, amount, voucher, counted}, is in one of three states:
+ *   free      no record: no wallet has asked for this result yet.
+ *   reserved  voucher null: the round is this wallet's while its voucher is signed, so a second wallet asking at once
+ *             is refused. A signing that failed leaves it here: the same wallet may sign it again, at a corrected
+ *             amount (nothing was handed out for it); any other wallet is still refused.
+ *   signed    a voucher: this wallet and this amount for good. Asked again it gets the same voucher, or one signed
+ *             anew (same wallet, round and amount) when that one is near its expiry or was signed with an earlier
+ *             voucher key: the program pays a wallet each round once, so a second signature never pays twice.
+ * counted: PAY.paid ran for the round (false until it has; a signed record from before counted existed had its paid
+ * run when it was signed, so it counts as counted). A record of an earlier incarnation of the grant is never signed
+ * again: grant-remade.
+ */
+const stateOf = record => (!record ? 'free' : record.voucher ? 'signed' : 'reserved');
+const countedOf = record => record.counted ?? stateOf(record) === 'signed';
+
+/** The voucher a signed record can give back as it is: this wallet and amount, the current key, not near expiry. */
+const freshFor = (record, { wallet, amount, publicKey, now }) =>
+  stateOf(record) === 'signed' &&
+  record.wallet === wallet &&
+  record.amount === amount &&
+  record.voucher.publicKey === publicKey &&
+  record.voucher.expires - now > VOUCHERS.renewWithin;
+
+const roundUsed = () =>
+  refuse(
+    409,
+    'round-used',
+    'This result has its voucher already (for another wallet or amount): a new result needs its own round.',
+  );
+
+/**
+ * The one place a round's record moves on. `had` is the record (or undefined), `event` one of
+ *   {ask: {incarnation, wallet, amount, publicKey, now}}   a wallet asks for the round's voucher
+ *   {signed: {incarnation, wallet, amount, voucher}}       the voucher an ask signed, to keep
+ *   {count: true} | {count: false}                         PAY.paid is to run (or it threw: not counted after all)
+ * → {record?: the record to store (none: unchanged), answer}. An ask answers {ok, sign: true} (sign it), {ok, voucher}
+ * (the one it has) or a refusal; signed answers {ok} or a refusal (the round moved on meanwhile: this voucher is not
+ * given out); count answers {ok, count} (true: run paid now).
+ */
+function roundStep(had, event) {
+  const state = stateOf(had);
+  if (event.ask) {
+    const { incarnation, wallet, amount } = event.ask;
+    if (state === 'free')
+      return {
+        record: { incarnation, wallet, amount, voucher: null, counted: false },
+        answer: { ok: true, sign: true },
+      };
+    if (had.incarnation !== incarnation)
+      return {
+        answer: refuse(
+          409,
+          'grant-remade',
+          'This result was paid by the grant before it was made again; a new campaign pays new rounds.',
+        ),
+      };
+    if (had.wallet !== wallet) return { answer: roundUsed() };
+    // reserved: nothing was handed out, so its wallet may sign it again, at the amount asked now
+    if (state === 'reserved') return { record: { ...had, amount, counted: false }, answer: { ok: true, sign: true } };
+    if (had.amount !== amount) return { answer: roundUsed() };
+    if (freshFor(had, event.ask)) return { answer: { ok: true, voucher: had.voucher } };
+    return { answer: { ok: true, sign: true } }; // near its expiry, or an earlier key's: signed anew
+  }
+  if (event.signed) {
+    const { incarnation, wallet, amount, voucher } = event.signed;
+    if (state === 'free' || had.incarnation !== incarnation || had.wallet !== wallet || had.amount !== amount)
+      return { answer: roundUsed() };
+    return { record: { ...had, voucher, counted: countedOf(had) }, answer: { ok: true } };
+  }
+  if (event.count === true) {
+    if (state !== 'signed' || countedOf(had)) return { answer: { ok: true, count: false } };
+    return { record: { ...had, counted: true }, answer: { ok: true, count: true } };
+  }
+  if (event.count === false && state === 'signed' && had.counted === true)
+    return { record: { ...had, counted: false }, answer: { ok: true, count: false } };
+  return { answer: { ok: true, count: false } };
+}
+
 /**
  * The Durable Object that remembers each round signed and each player's linked wallet (gamesfun.json →
  * server.objects: GameVouchers, GAME_VOUCHERS).
@@ -145,17 +230,13 @@ export class GameVouchers extends DurableObject {
     return this.ctx.storage.get(key);
   }
   /**
-   * The round's record, or null when `want` was just stored as it. One step: an object takes no other call while it
-   * waits on its own storage, so two requests for the same round at once can't both find it free.
+   * A round's record moved on by `event` (roundStep), and its answer. One step: an object takes no other call while it
+   * waits on its own storage, so two requests for the same round at once can't both find it free, or both count it.
    */
-  async take(key, want) {
-    const had = await this.ctx.storage.get(key);
-    if (had) return had;
-    await this.ctx.storage.put(key, want);
-    return null;
-  }
-  remember(key, value) {
-    return this.ctx.storage.put(key, value);
+  async step(key, event) {
+    const { record, answer } = roundStep(await this.ctx.storage.get(key), event);
+    if (record) await this.ctx.storage.put(key, record);
+    return answer;
   }
   /** One more request from `player` this minute: false past `limit`. */
   hit(player, limit) {
@@ -212,7 +293,13 @@ export async function walletOf(env, player) {
  * person? (an X account id: a grant with perPerson pays only a person)}. The caller names the wallet: a proven one
  * (walletOf). → {ok, voucher, again?} (again: the voucher this result had already) | {ok: false, code, why}
  */
-export async function voucherFor(env, { grant, wallet, round, amount, person = null }) {
+export async function voucherFor(env, ask) {
+  const { key: _key, ...out } = await signRound(env, ask);
+  return out;
+}
+
+/** voucherFor's work, with the round's record key (`key`) when it answers a voucher. */
+async function signRound(env, { grant, wallet, round, amount, person = null }) {
   const signer = await voucherKey(env.VOUCHER_SEED);
   if (!signer)
     return refuse(
@@ -241,12 +328,12 @@ export async function voucherFor(env, { grant, wallet, round, amount, person = n
       "Name the amount: base units above 0, or 'grant' for the grant's own amount (never left out, so it never pays the most by mistake).",
     );
   const stub = stubOf(env);
-  const key = `${g.id}:${r}`;
-  const now = Math.floor(Date.now() / 1000);
-  // the same result asked again: its voucher, with no chain read (a stale incarnation's voucher pays nothing anyway)
+  const key = roundKey(g.id, r);
+  const want = { wallet, amount: String(units), publicKey: signer.address, now: Math.floor(Date.now() / 1000) };
+  // the same result asked again: its voucher, with no chain read. (One of an earlier incarnation of the grant comes
+  // back here too: it pays nothing, and telling would take the chain read this saves; past here it is grant-remade.)
   const seen = await stub.peek(key);
-  if (seen?.voucher && seen.wallet === wallet && seen.amount === String(units))
-    if (seen.voucher.expires - now > VOUCHERS.renewWithin) return { ok: true, voucher: seen.voucher, again: true };
+  if (freshFor(seen, want)) return { ok: true, voucher: seen.voucher, again: true, key };
   // the grant as it is now: a voucher pays only the incarnation it was signed for
   const rpc =
     typeof env.XSOLANA_RPC_URL === 'string' && env.XSOLANA_RPC_URL.trim() ? env.XSOLANA_RPC_URL.trim() : RELAY;
@@ -256,23 +343,9 @@ export async function voucherFor(env, { grant, wallet, round, amount, person = n
     return refuse(409, 'grant', `The grant ${g.key ?? g.id} is not on the chain (closed, or not live yet).`);
   const incarnation = String(decode('Grant', account.data).incarnation);
   // the round is this wallet's from here on, before anything is signed (a second wallet asking at once is refused)
-  const had = await stub.take(key, { incarnation, wallet, amount: String(units), voucher: null });
-  if (had) {
-    if (had.incarnation !== incarnation)
-      return refuse(
-        409,
-        'grant-remade',
-        'This result was paid by the grant before it was made again; a new campaign pays new rounds.',
-      );
-    if (had.wallet !== wallet || had.amount !== String(units))
-      return refuse(
-        409,
-        'round-used',
-        'This result has its voucher already (for another wallet or amount): a new result needs its own round.',
-      );
-    if (had.voucher && had.voucher.expires - now > VOUCHERS.renewWithin)
-      return { ok: true, voucher: had.voucher, again: true };
-  }
+  const asked = await stub.step(key, { ask: { ...want, incarnation } });
+  if (!asked.ok) return asked;
+  if (asked.voucher) return { ok: true, voucher: asked.voucher, again: true, key };
   const voucher = await signVoucher({
     signer,
     game: g.project,
@@ -280,13 +353,14 @@ export async function voucherFor(env, { grant, wallet, round, amount, person = n
     incarnation,
     wallet,
     round: r,
-    now,
+    now: want.now,
     seconds: VOUCHERS.seconds,
     personHash: await personHashOf(signer, address, person),
     amount: units,
   });
-  await stub.remember(key, { incarnation, wallet, amount: String(units), voucher });
-  return { ok: true, voucher };
+  const kept = await stub.step(key, { signed: { incarnation, wallet, amount: want.amount, voucher } });
+  if (!kept.ok) return kept;
+  return { ok: true, voucher, key };
 }
 
 /** The signed-in player of a request (env.GF.verifyPlayer's answer), or a refusal. */
@@ -383,14 +457,21 @@ export async function handleVouchers(request, env) {
     );
   if (isWallet(body?.wallet) && body.wallet !== wallet)
     return reply(refuse(403, 'wallet', `This pays your proven wallet (${wallet.slice(0, 4)}…), not the one named.`));
-  const out = await voucherFor(env, {
+  const { key, ...out } = await signRound(env, {
     grant: pays.grant,
     wallet,
     round: pays.round,
     amount: pays.amount,
     person: player.x?.id ?? null,
   });
-  if (out.ok && !out.again && typeof PAY.paid === 'function')
-    await PAY.paid({ body, player, env, pays, voucher: out.voucher });
+  // paid once a round: the object flips the round to counted once, so two asks at once can't both run it; one that
+  // throws puts it back, so a later ask runs it again (the voucher stays the round's either way)
+  if (out.ok && typeof PAY.paid === 'function' && (await stub.step(key, { count: true })).count)
+    try {
+      await PAY.paid({ body, player, env, pays, voucher: out.voucher });
+    } catch (e) {
+      await stub.step(key, { count: false }).catch(() => {});
+      throw e;
+    }
   return reply(out);
 }

package/lib/client/unity/GamesFun.cs

@@ -1,9 +1,9 @@
-// GamesFun: sign-in, saves, leaderboards and the game's own database on games.fun, for a Unity WebGL build.
+// GamesFun: sign-in, saves, leaderboards and the game's own database on xgames.fun, for a Unity WebGL build.
 // Written by `xcore add signin` (with GamesFun.jslib beside it); `xcore add signin` again brings it up to date.
 // Every call answers the JSON text {"data": …, "error": …, "status": …}; parse it with JsonUtility or your own JSON
 // library. Outside a WebGL build (the editor, a desktop build) the error says so and the game plays on. In Player
 // Settings → Publishing Settings, keep Compression Format Disabled (or turn on Decompression Fallback) and keep
-// threads off: games.fun sends files as they are and its pages are not cross-origin isolated.
+// threads off: xgames.fun sends files as they are and its pages are not cross-origin isolated.
 //
 //   string player = await GamesFun.SignIn();                     // from a button press: the player JSON, or "null"
 //   GamesFun.PlayerChanged += json => { … };                     // sign-in and sign-out
@@ -44,7 +44,7 @@ public class GamesFun : MonoBehaviour
 
     private static int next;
     private static readonly Dictionary<int, TaskCompletionSource<string>> pending = new Dictionary<int, TaskCompletionSource<string>>();
-    private const string NotHere = "{\"data\":null,\"error\":\"games.fun runs in a WebGL build only\",\"status\":0}";
+    private const string NotHere = "{\"data\":null,\"error\":\"xgames.fun runs in a WebGL build only\",\"status\":0}";
 
     [RuntimeInitializeOnLoadMethod(RuntimeInitializeLoadType.BeforeSceneLoad)]
     private static void Boot()
@@ -57,7 +57,7 @@ public class GamesFun : MonoBehaviour
 #endif
     }
 
-    /// <summary>One call into games.fun's page client: a path ("saves.put") and its arguments as a JSON array.</summary>
+    /// <summary>One call into xgames.fun's page client: a path ("saves.put") and its arguments as a JSON array.</summary>
     public static Task<string> Call(string path, string argsJson)
     {
 #if UNITY_WEBGL && !UNITY_EDITOR
@@ -90,13 +90,16 @@ public class GamesFun : MonoBehaviour
         Call("scores.top", "[" + Str(board) + ",{\"limit\":" + limit + ",\"offset\":" + offset + "}]");
     public static Task<string> ScoresMine(string board) => Call("scores.mine", "[" + Str(board) + "]");
 
-    public static Task<string> DbGet(string collection, string id) => Call("db.get", "[" + Str(collection) + "," + Str(id) + "]");
+    /// <summary>owner: "me" (or null: the player's own), "server" or a player's id.</summary>
+    public static Task<string> DbGet(string collection, string id, string owner = null) =>
+        Call("db.get", "[" + Str(collection) + "," + Str(id) + (owner != null ? ",{\"owner\":" + Str(owner) + "}" : "") + "]");
     public static Task<string> DbPut(string collection, string id, string valueJson) => Call("db.put", "[" + Str(collection) + "," + Str(id) + "," + valueJson + "]");
     public static Task<string> DbAdd(string collection, string valueJson) => Call("db.add", "[" + Str(collection) + "," + valueJson + "]");
-    /// <summary>owner: "me", a player id, or null for everyone's; order: "new" or "old".</summary>
-    public static Task<string> DbList(string collection, string owner = null, int limit = 50, int offset = 0, string order = "new") =>
+    /// <summary>owner: "me", "server", a player id, or null for everyone's; after: the last answer's "after" (null on
+    /// the last page), for the next page; order: "new" or "old".</summary>
+    public static Task<string> DbList(string collection, string owner = null, int limit = 50, string after = null, string order = "new") =>
         Call("db.list", "[" + Str(collection) + ",{" + (owner != null ? "\"owner\":" + Str(owner) + "," : "")
-            + "\"limit\":" + limit + ",\"offset\":" + offset + ",\"order\":" + Str(order) + "}]");
+            + (after != null ? "\"after\":" + Str(after) + "," : "") + "\"limit\":" + limit + ",\"order\":" + Str(order) + "}]");
     public static Task<string> DbDelete(string collection, string id) => Call("db.delete", "[" + Str(collection) + "," + Str(id) + "]");
 
     // ---- the game's Solana economy (xcore loot add: xsolana.json and gf/loot/ beside the build's index.html) ----
@@ -134,14 +137,14 @@ public class GamesFun : MonoBehaviour
         return b.ToString();
     }
 
-    /// <summary>The room the page was opened for (?room=CODE, as games.fun's room links pass it), or null.</summary>
+    /// <summary>The room the page was opened for (?room=CODE, as xgames.fun's room links pass it), or null.</summary>
     public static async Task<string> RoomFromLink()
     {
         var r = await Call("rooms.fromLink", "[]");
         return r == "null" || r.StartsWith("{") ? null : r.Trim('"');
     }
 
-    /// <summary>The link that opens the game in this room (games.fun's play page once published).</summary>
+    /// <summary>The link that opens the game in this room (xgames.fun's play page once published).</summary>
     public static async Task<string> RoomLink(string code)
     {
         var r = await Call("rooms.link", "[" + Str(code) + "]");
@@ -170,7 +173,7 @@ public class GamesFun : MonoBehaviour
         return room;
 #else
         await Task.Yield();
-        RoomError = "games.fun rooms run in a WebGL build only";
+        RoomError = "xgames.fun rooms run in a WebGL build only";
         return null;
 #endif
     }
@@ -236,7 +239,7 @@ public class GamesFun : MonoBehaviour
 }
 
 /// <summary>
-/// A games.fun room (GamesFun.JoinRoom): a relay with a host. The first player in is the host (Id 1); a message goes to
+/// A xgames.fun room (GamesFun.JoinRoom): a relay with a host. The first player in is the host (Id 1); a message goes to
 /// one player (to: their id), to everyone else (0), or to everyone but one (-id). Events come on Unity's main thread.
 /// </summary>
 public class GamesFunRoom

package/lib/client/unity/GamesFun.jslib

@@ -1,4 +1,4 @@
-// GamesFun for a Unity WebGL build: games.fun's page client (gamesfun.js, carried here as base64) and the two entry
+// GamesFun for a Unity WebGL build: xgames.fun's page client (gamesfun.js, carried here as base64) and the two entry
 // points GamesFun.cs calls. Written by `xcore add signin`; `xcore add signin` again brings it up to date.
 mergeInto(LibraryManager.library, {
   GamesFunInit: function (objectNamePtr) {

package/lib/config-dir.mjs

@@ -1,4 +1,4 @@
-// The folder that keeps a person's games.fun sign-in on this machine (and an installed kit's state, under state/): the
+// The folder that keeps a person's xgames.fun sign-in on this machine (and an installed kit's state, under state/): the
 // same folder for this package and the kit, so signing in with either is signing in with both.
 import os from 'node:os';
 import path from 'node:path';