@xgamesfun/xcore 0.2.1 → 0.4.0

package/lib/client/gamesfun.js

@@ -6,15 +6,18 @@
 //
 //   const gf = GamesFun;
 //   await gf.ready;                                   // what the page already knows (a sign-in the xgames.fun page has)
-//   gf.player;                                        // null, or {id, name, level, wallet, x}
+//   gf.player;                                        // null, or {id, name, level, wallet, x, google}
 //   gf.local;                                         // true on this machine (localhost, xcore check, xcore dev)
 //   gf.dev;                                           // true under xcore dev, where the game's server, saves and
 //                                                     // sign-in answer as xgames.fun's will: "no server here" is
 //                                                     // gf.local && !gf.dev, never gf.local alone
 //   await gf.signIn();                                // from a click: the player signs in → player | null
+//   await gf.signIn({how: 'google'});                 // the same with Google ('x', the default: with X)
 //   gf.onChange(player => …);                         // sign-in and sign-out
 //   gf.onCode(({code, site, url, window}) => …);      // the code: show it plainly when window is false (blocked);
 //                                                     // when true, only as a quiet line: X's login hides the window's state
+//   await gf.fullscreen();                            // from a click: full screen (again: back); → {on, how}
+//   gf.onFullscreen(on => …);                         // it went in or out (Esc, the page, the browser)
 //   await gf.saves.put('main', {level: 3});           // this player's saves: JSON, 64 KB each, 16 a player
 //   await gf.scores.submit('best', 1200);             // leaderboards: a player's best is kept
 //   await gf.db.add('levels', {name: 'Moon'});        // the game's own database (xcore add database): each player
@@ -22,8 +25,13 @@
 //   await gf.api('scores', {method: 'POST', body: {}}); // the game's own server (server/), signed in
 //   const {data: room} = await gf.rooms.join(gf.rooms.fromLink() ?? gf.rooms.code()); // multiplayer (xcore add multiplayer)
 //   room.on('message', (from, data) => …); room.send({x: 1}); share gf.rooms.link(room.code)
+//   const {data: live} = await gf.live.get();         // what the owner set on xgames.fun/console (Live), no republish:
+//                                                     // {announcement, config, version, maintenance}; a banner shows
+//                                                     // the announcement (gf.live.banner(false) turns it off)
+//   gf.live.onChange(live => …);                      // asked again every minute while the page is in view
 //
-// Where sign-in comes from (xgames.fun's player sign-in: X first, a wallet as well):
+// Where sign-in comes from (xgames.fun's player sign-in: X or Google; a wallet is linked to that account on xgames.fun's
+// account page and comes with every sign-in, but never signs anyone in: a copycat game could relay that signature):
 // - inside xgames.fun's play page, the page above signs the player in and hands this page a token (gf:host / gf:auth);
 //   only xgames.fun's own page may: framed by any other site (one embedding the game), the game signs in by itself;
 // - on the game's own link or inside a post on X, a small window on xgames.fun signs in (or a code the player types at
@@ -37,7 +45,7 @@
 (function () {
   'use strict';
   if (globalThis.GamesFun) return;
-  var VERSION = '1.4.0';
+  var VERSION = '1.6.0';
   var PLATFORM = '/platform/v1/';
   var SEG = /^[A-Za-z0-9_-]{1,64}$/;
   var POLL_MS = 2000;
@@ -147,6 +155,9 @@
             var why = (data && (data.why || data.error)) || label + ' answered ' + res.status;
             var no = { data: null, error: why, status: res.status };
             if (data && data.code) no.code = data.code;
+            // the game was paused (Live, maintenance) while it was open: the banner says so at once (xgames.fun's
+            // refusal is a 503; a game's own server that says 'maintenance' with another status is its own business)
+            if (res.status === 503 && data && data.code === 'maintenance') liveMaintenance(data);
             return no;
           });
       })
@@ -269,7 +280,16 @@
       if (gf.token && a.status !== 'signing') setPlayer(null, '', 0);
     } else if (token !== gf.token) {
       var x = a.x && a.x.handle ? a.x : null;
-      var guess = { id: '', name: x ? '@' + x.handle : a.short || '', level: a.level, wallet: a.wallet || '', x: x };
+      // the name players see: @handle for X; a Google account's player name (never with an @, which only X has)
+      var g = a.google && a.google.name ? { name: String(a.google.name) } : null;
+      var guess = {
+        id: '',
+        name: x ? '@' + x.handle : g ? g.name : a.short || '',
+        level: a.level,
+        wallet: a.wallet || '',
+        x: x,
+        google: g,
+      };
       done = takeToken(token, guess, a.expires || Date.now() + 3600e3);
     }
     return done.then(function () {
@@ -326,6 +346,8 @@
           above = e.source;
           aboveAuth = e.data.auth !== false;
           readyResolve(gf.player);
+        } else if (e.data.type === 'gf:fullscreen-state') {
+          setFull(e.data.on === true);
         } else if (e.data.type === 'gf:auth') {
           above = e.source;
           takeAuth(e.data).then(function () {
@@ -396,12 +418,14 @@
           closePopup(p);
           var pl = s.player || {};
           var x = pl.x && pl.x.handle ? pl.x : null;
+          var g = pl.google && pl.google.name ? { name: String(pl.google.name) } : null;
           var guess = {
             id: '',
-            name: x ? '@' + x.handle : pl.wallet || '',
+            name: x ? '@' + x.handle : g ? g.name : pl.wallet || '',
             level: pl.level,
             wallet: pl.wallet || '',
             x: x,
+            google: g,
           };
           // still this sign-in's until the token is taken: a click meanwhile waits for the same player
           takeToken(s.token, guess, s.expires).then(function (player) {
@@ -456,11 +480,12 @@
 
   /**
    * The player's sign-in. From a click (a window may open). → player | null. `prompt: false` opens nothing and only
-   * takes a sign-in the page already has. `how`: 'x' (default) or 'wallet'.
+   * takes a sign-in the page already has. `how`: 'x' (default) or 'google' ('wallet', from before, signs in with X: a
+   * wallet signs nobody in now; the player links one on xgames.fun's account page).
    */
   gf.signIn = function (opts) {
     opts = opts || {};
-    var how = opts.how === 'wallet' ? 'wallet' : 'x';
+    var how = opts.how === 'google' ? 'google' : 'x';
     // a sign-in on its way (to its last step, the player's token being taken): this click waits for the same one
     if (pending && opts.prompt !== false) return pending.promise;
     if (gf.token && gf.expires > Date.now() + 60e3) return Promise.resolve(gf.player);
@@ -487,7 +512,7 @@
           } else waiters.push(wait); // an answer without a token yet (the page is still signing)
         };
         waiters.push(wait);
-        above.postMessage(how === 'x' ? { type: 'gf:auth-signin', with: 'x' } : { type: 'gf:auth-signin' }, '*');
+        above.postMessage({ type: 'gf:auth-signin', with: how }, '*');
       });
     }
     return requestSignIn(how);
@@ -502,6 +527,317 @@
     return Promise.resolve(null);
   };
 
+  // ---- live: what the game's owner sets on xgames.fun/console (the Live tab), with no republish ----
+  // GET /platform/v1/live, answered by the play edge itself from one cached record a game: {announcement: {id, text,
+  // level: 'info'|'warning', startsAt, endsAt} | null, config: {…}, version, maintenance: {message, since} | null}. The
+  // config is the owner's JSON object (8 KB); while maintenance is on, players who open the game get xgames.fun's
+  // holding page instead, and the game's api/ and saves and scores answer code 'maintenance'. A change reaches players
+  // within about 35 seconds. On this machine (localhost, xcore check) nothing is live; `xcore dev` answers from the
+  // game's .gamesfun/live.json; where there is no such route (an older host) nothing is live and nothing is asked again.
+  //   A small banner shows the announcement (each one until the player closes it), and a pause that starts while the
+  //   game is open. Off: globalThis.GAMESFUN_LIVE_BANNER = false before this file, data-live-banner="off" on its
+  //   <script>, or gf.live.banner(false) before the page has loaded.
+  var LIVE_EMPTY = { announcement: null, config: {}, version: 0, maintenance: null };
+  var LIVE_POLL_MS = 60000; // asked again this often while gf.live.onChange has a listener (and the page is in view)
+  var LIVE_BANNER_MS = 300000; // and this often for the banner alone
+  var liveValue = null,
+    liveAt = 0,
+    liveFlight = null,
+    liveFns = [],
+    liveGone = false,
+    liveTimer = null,
+    banner = null,
+    bannerKey = '',
+    bannerEnd = null;
+  var me = globalThis.document && document.currentScript;
+  var bannerOn =
+    globalThis.GAMESFUN_LIVE_BANNER !== false &&
+    !(me && me.getAttribute && me.getAttribute('data-live-banner') === 'off');
+  var num = function (v) {
+    return typeof v === 'number' && isFinite(v) && v > 0 ? v : null;
+  };
+  /** An answer → what a game gets: an announcement only inside its window (by this clock too), a plain-object config. */
+  function liveClean(d) {
+    if (!d || typeof d !== 'object') return LIVE_EMPTY;
+    var now = Date.now();
+    var a = d.announcement;
+    a =
+      a && typeof a === 'object' && typeof a.text === 'string' && a.text
+        ? {
+            id: String(a.id || 'a'),
+            text: a.text,
+            level: a.level === 'warning' ? 'warning' : 'info',
+            startsAt: num(a.startsAt),
+            endsAt: num(a.endsAt),
+          }
+        : null;
+    if (a && ((a.startsAt && a.startsAt > now) || (a.endsAt && a.endsAt <= now))) a = null;
+    var m = d.maintenance;
+    return {
+      announcement: a,
+      config: d.config && typeof d.config === 'object' && !Array.isArray(d.config) ? d.config : {},
+      version: num(d.version) || 0,
+      maintenance: m && typeof m === 'object' ? { message: String(m.message || ''), since: num(m.since) } : null,
+    };
+  }
+  function setLive(v) {
+    var before = liveValue ? JSON.stringify(liveValue) : '';
+    liveValue = v;
+    gf.live.value = v;
+    if (JSON.stringify(v) !== before) {
+      emit(liveFns, v);
+      renderBanner();
+    }
+  }
+  function liveRefresh() {
+    if (local) {
+      setLive(LIVE_EMPTY);
+      return ok(LIVE_EMPTY);
+    }
+    if (liveFlight) return liveFlight;
+    liveFlight = call(PLATFORM + 'live', { method: 'GET' }, "the game's live settings").then(function (r) {
+      liveFlight = null;
+      liveAt = Date.now();
+      if (r.data) {
+        setLive(liveClean(r.data));
+        return { data: liveValue, error: null, status: r.status };
+      }
+      // no such route here (an older host): nothing is live, and nothing is asked again
+      if (r.status === 404) {
+        liveGone = true;
+        setLive(LIVE_EMPTY);
+        return { data: liveValue, error: null, status: 404 };
+      }
+      // not reachable now: what was known stays
+      return withCode({ data: liveValue || LIVE_EMPTY, error: r.error, status: r.status }, r);
+    });
+    return liveFlight;
+  }
+  function liveMaintenance(d) {
+    var v = liveValue || LIVE_EMPTY;
+    if (v.maintenance) return;
+    setLive({
+      announcement: v.announcement,
+      config: v.config,
+      version: v.version,
+      maintenance: { message: String(d.why || ''), since: num(d.since) },
+    });
+  }
+  function livePoll() {
+    if (liveTimer || liveGone || local || typeof setInterval !== 'function') return;
+    liveTimer = setInterval(function () {
+      if (liveGone) {
+        clearInterval(liveTimer);
+        liveTimer = null;
+        return;
+      }
+      if (globalThis.document && document.visibilityState === 'hidden') return;
+      var every = liveFns.length ? LIVE_POLL_MS : bannerOn ? LIVE_BANNER_MS : 0;
+      if (every && Date.now() - liveAt >= every) liveRefresh();
+    }, 15000);
+  }
+  // the banner: one line at the top, above the game, closable; text only (never HTML)
+  function renderBanner() {
+    var doc = globalThis.document;
+    if (!doc || typeof doc.createElement !== 'function') return;
+    if (!doc.body) {
+      doc.addEventListener('DOMContentLoaded', renderBanner, { once: true });
+      return;
+    }
+    var v = liveValue,
+      show = null;
+    if (bannerOn && v && v.maintenance)
+      show = {
+        key: 'm' + (v.maintenance.since || ''),
+        text: v.maintenance.message || 'This game is paused for maintenance.',
+        level: 'warning',
+      };
+    else if (bannerOn && v && v.announcement)
+      show = { key: v.announcement.id, text: v.announcement.text, level: v.announcement.level };
+    if (show && store('live-closed') === show.key) show = null;
+    clearTimeout(bannerEnd);
+    if (!show) {
+      if (banner && banner.parentNode) banner.parentNode.removeChild(banner);
+      banner = null;
+      return;
+    }
+    // an announcement that ends while the game is open goes when it ends
+    var ends = !v.maintenance && v.announcement.endsAt;
+    if (ends)
+      bannerEnd = setTimeout(
+        function () {
+          setLive(liveClean(liveValue));
+        },
+        Math.min(Math.max(ends - Date.now(), 0), 2147483647),
+      );
+    if (!banner) {
+      banner = doc.createElement('div');
+      banner.setAttribute('data-gamesfun', 'live');
+      var root = banner.attachShadow ? banner.attachShadow({ mode: 'open' }) : banner;
+      root.innerHTML =
+        '<div role="status" aria-live="polite" style="position:fixed;top:8px;left:50%;transform:translateX(-50%);z-index:2147483647;' +
+        'box-sizing:border-box;max-width:min(640px,calc(100vw - 16px));display:flex;align-items:flex-start;gap:10px;padding:8px 10px 8px 14px;' +
+        'border-radius:10px;font:14px/1.4 system-ui,-apple-system,sans-serif;box-shadow:0 4px 18px rgba(0,0,0,.35);pointer-events:auto">' +
+        '<span style="white-space:pre-wrap;overflow-wrap:anywhere"></span>' +
+        '<button type="button" aria-label="Close" style="all:unset;cursor:pointer;padding:0 4px;font-size:18px;line-height:1;opacity:.75">×</button></div>';
+      root.querySelector('button').addEventListener('click', function () {
+        store('live-closed', bannerKey);
+        renderBanner();
+      });
+      doc.body.appendChild(banner);
+    }
+    var root2 = banner.shadowRoot || banner;
+    var box = root2.querySelector('[role=status]');
+    box.style.background = show.level === 'warning' ? '#4a3510' : '#1d1d26';
+    box.style.color = show.level === 'warning' ? '#ffe6b0' : '#e8e8f0';
+    box.style.border = '1px solid ' + (show.level === 'warning' ? '#a8761c' : '#3a3a4a');
+    root2.querySelector('span').textContent = show.text;
+    bannerKey = show.key;
+  }
+  gf.live = {
+    /** The last answer (null until one came). */
+    value: null,
+    /** → {data: {announcement, config, version, maintenance}}: what is known if it is under a minute old, else asked. */
+    get: function () {
+      if (liveValue && (liveGone || local || Date.now() - liveAt < LIVE_POLL_MS) && !liveFlight) return ok(liveValue);
+      return liveRefresh();
+    },
+    /** Asks now. → as get */
+    refresh: liveRefresh,
+    /** fn(live) on every change; while any listener is there it is asked every minute (the page in view). → unsubscribe */
+    onChange: function (fn) {
+      if (typeof fn === 'function') liveFns.push(fn);
+      livePoll();
+      if (!liveAt && !liveFlight) liveRefresh();
+      return function () {
+        liveFns = liveFns.filter(function (f) {
+          return f !== fn;
+        });
+      };
+    },
+    /** The default banner on (true) or off (false): a game that shows the announcement its own way turns it off. */
+    banner: function (on) {
+      bannerOn = on !== false;
+      renderBanner();
+      if (bannerOn && !local) {
+        livePoll();
+        if (!liveAt && !liveFlight) liveRefresh();
+      }
+    },
+  };
+  // the banner's first look once the page has loaded (so a game's own scripts can turn it off first), then every 5 min
+  if (!local && globalThis.document && typeof document.addEventListener === 'function') {
+    var liveStart = function () {
+      setTimeout(function () {
+        if (bannerOn && !liveAt && !liveFlight) liveRefresh();
+        if (bannerOn) livePoll();
+      }, 0);
+    };
+    if (document.readyState === 'loading') document.addEventListener('DOMContentLoaded', liveStart, { once: true });
+    else liveStart();
+    document.addEventListener('visibilitychange', function () {
+      if (document.visibilityState !== 'visible' || liveGone || !(liveFns.length || bannerOn)) return;
+      if (liveAt && Date.now() - liveAt >= LIVE_POLL_MS) liveRefresh();
+    });
+  }
+
+  // ---- full screen, from a click: a post on X and a phone show the game in a small frame first ----
+  // Inside xgames.fun's play page the page around the game goes full screen (gf:fullscreen), or fills the screen where the
+  // browser has no full screen (an app's own browser: X's, Phantom's); a click in the game lets that page ask. Anywhere
+  // else the browser's own full screen; framed where that is not allowed (another site's frame, a post on X), the game's
+  // own link in a tab of its own. An iPhone's Safari has no full screen for a page: {on: false, how: 'none'}, the game
+  // plays as it is (its button can say "Add to Home Screen" there).
+  var fullFns = [];
+  gf.isFullscreen = false;
+  function setFull(on) {
+    if (gf.isFullscreen === on) return;
+    gf.isFullscreen = on;
+    emit(fullFns, on);
+  }
+  gf.onFullscreen = function (fn) {
+    if (typeof fn === 'function') fullFns.push(fn);
+    return function () {
+      fullFns = fullFns.filter(function (f) {
+        return f !== fn;
+      });
+    };
+  };
+  var doc = globalThis.document;
+  function nativeFull() {
+    return !!doc && !!(doc.fullscreenElement || doc.webkitFullscreenElement);
+  }
+  if (doc && doc.addEventListener)
+    ['fullscreenchange', 'webkitfullscreenchange'].forEach(function (ev) {
+      doc.addEventListener(ev, function () {
+        setFull(nativeFull());
+      });
+    });
+  /** on: true (in), false (out), or left out (the other way). → {data: {on, how: 'page'|'browser'|'tab'|'none'}} */
+  gf.fullscreen = function (on) {
+    var want = on === undefined ? !gf.isFullscreen : !!on;
+    if (above) {
+      // the play page answers gf:fullscreen-state; it tells only a change, so a refusal there leaves it as it was
+      try {
+        above.postMessage({ type: 'gf:fullscreen', v: 1, on: want }, '*');
+      } catch {
+        /* gone */
+      }
+      return new Promise(function (resolve) {
+        var off,
+          timer = setTimeout(function () {
+            off();
+            resolve(ok({ on: gf.isFullscreen, how: 'page' }));
+          }, 1500);
+        off = gf.onFullscreen(function (now) {
+          clearTimeout(timer);
+          off();
+          resolve(ok({ on: now, how: 'page' }));
+        });
+      });
+    }
+    var el = doc && doc.documentElement;
+    if (!want) {
+      var exit = doc && (doc.exitFullscreen || doc.webkitExitFullscreen);
+      if (exit && nativeFull())
+        return Promise.resolve(exit.call(doc)).then(
+          function () {
+            return ok({ on: false, how: 'browser' });
+          },
+          function () {
+            return ok({ on: nativeFull(), how: 'browser' });
+          },
+        );
+      return Promise.resolve(ok({ on: false, how: 'none' }));
+    }
+    var req = el && (el.requestFullscreen || el.webkitRequestFullscreen);
+    var allowed = doc && doc.fullscreenEnabled !== false && doc.webkitFullscreenEnabled !== false;
+    var tab = function () {
+      // framed by a page that allows no full screen (a post on X): the game's own link, where it can
+      // (noopener: open answers null either way, so 'tab' says it was asked for, not that a popup blocker let it)
+      if (!framed || !globalThis.open) return ok({ on: false, how: 'none' });
+      try {
+        globalThis.open(loc.href, '_blank', 'noopener');
+      } catch {
+        return ok({ on: false, how: 'none' });
+      }
+      return ok({ on: false, how: 'tab' });
+    };
+    if (!req || !allowed) return Promise.resolve(tab());
+    return Promise.resolve()
+      .then(function () {
+        return req.call(el);
+      })
+      .then(
+        function () {
+          setFull(nativeFull());
+          return ok({ on: nativeFull(), how: 'browser' });
+        },
+        function () {
+          return tab();
+        },
+      );
+  };
+
   // ---- saves: this player's own, any JSON value (64 KB each, 16 a player) ----
   function seg(s) {
     return SEG.test(String(s)) ? encodeURIComponent(s) : null;
@@ -593,7 +929,10 @@
       if (opts.order) body.order = opts.order;
       return json('POST', PLATFORM + 'scores/' + seg(board), body, 'submitting the score');
     },
-    /** → {data: [{rank, player, name, score, at}]}; anyone may read, signed in or not */
+    /**
+     * → {data: [{rank, player, name, score, at, me?}]}: `player` is an id of this game's own (never the account), `me`
+     * true on the signed-in player's entry. Anyone may read; signed out, the top 100 only (offset + limit past 100: 401)
+     */
     top: function (board, opts) {
       opts = opts || {};
       if (!seg(board)) return bad('board name');

package/lib/client/godot/gamesfun.gd

@@ -10,6 +10,7 @@
 #   await GamesFun.saves_put("main", {"level": 3}) # this player's saves (JSON, 64 KB each, 16 a player)
 #   var r = await GamesFun.saves_get("main")       # r.data is the value, or null
 #   await GamesFun.scores_submit("best", 1200)     # leaderboards: r.data {improved, best, rank}
+#   await GamesFun.fullscreen()                    # from a button: full screen (again: back)
 #   var top = await GamesFun.scores_top("best")    # top.data: [{rank, player, name, score, at}]
 #   await GamesFun.db_add("levels", {"name": "Moon"})  # the game's own database (xcore add database)
 #   multiplayer.multiplayer_peer = await GamesFun.join_room(code)  # Godot's multiplayer over xgames.fun (xcore add multiplayer)
@@ -122,7 +123,7 @@ func _run(path: String, args: Array):
 	return result
 
 
-## The player's sign-in, from a button press (a window may open). how: "x" or "wallet". -> Dictionary or null
+## The player's sign-in, from a button press (a window may open). how: "x" or "google". -> Dictionary or null
 func sign_in(how := "x"):
 	var p = await _run("signIn", [{"how": how}])
 	_set_player(p)
@@ -134,6 +135,14 @@ func sign_out():
 	_set_player(null)
 
 
+## Full screen, from a button press: on xgames.fun the page around the game goes full screen (or fills the screen in an
+## app's own browser, X's among them); elsewhere the browser's own, or the game's link in a tab of its own (a post on X).
+## on: true, false, or null (the other way). -> {"on": bool, "how": "page" | "browser" | "tab" | "none"}
+func fullscreen(on = null):
+	var r = await _run("fullscreen", [] if on == null else [on])
+	return r.get("data") if r is Dictionary and r.get("data") != null else {"on": false, "how": "none"}
+
+
 func is_signed_in() -> bool:
 	return player != null
 

package/lib/client/server/0001_init.sql

@@ -3,7 +3,7 @@
 -- does the same on this machine. Once this one is published, never change it: put the next change in
 -- 0002_<what>.sql (ALTER TABLE players ADD COLUMN …).
 CREATE TABLE players (
-  id TEXT PRIMARY KEY,                -- the player's id: env.GF.verifyPlayer's sub (withPlayer in gf-db.js)
+  id TEXT PRIMARY KEY,                -- the player's id: env.GF.verifyPlayer's sub (withPlayer in gf-db.js), never the wallet
   gold INTEGER NOT NULL DEFAULT 0,
   runs INTEGER NOT NULL DEFAULT 3,    -- runs left today
   updated_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now'))

package/lib/client/server/database.js

@@ -9,7 +9,8 @@
 //   POST   api/db/<collection>       {value}   a new id, the player's own        → {ok, item}
 //   DELETE api/db/<collection>/<id>            the player's own                  → {ok, deleted}
 //
-// A document is {id, owner, value, updatedAt}: `owner` is the player's id (env.GF.verifyPlayer's `sub`), or "server"
+// A document is {id, owner, value, updatedAt}: `owner` is the player's id (env.GF.verifyPlayer's `sub`: the account,
+// x:<X id> or for Google g:<id>, different in every game; never the wallet), or "server"
 // for what this server's own code writes. Every player has a space of their own in each collection: a document is
 // found by its collection, its owner and its id, so two players can both have a "main", and no player can take an id
 // in anyone else's space. A page names whose document it wants with `owner`; without it, the player's own (in a

package/lib/client/server/gf-db.js

@@ -5,7 +5,7 @@
 // database on this machine. Add a migration for each change; never change one that was published.
 //
 //   import { db, withPlayer } from './gf-db.js';
-//   const sub = await withPlayer(request, env);             // the signed-in player's id, or null
+//   const sub = await withPlayer(request, env);             // the signed-in player's id (never the wallet), or null
 //   if (!sub) return Response.json({ why: 'Sign in first.' }, { status: 401 });
 //   const me = await db(env).first('SELECT gold, runs FROM players WHERE id = ?', sub);
 //   // a rule in one statement, so two requests at once cannot both pass it
@@ -46,7 +46,11 @@ export function db(env) {
   };
 }
 
-/** The signed-in player's id (env.GF.verifyPlayer's sub), from the token gamesfun.js sends; null for a guest. */
+/**
+ * The signed-in player's id (env.GF.verifyPlayer's sub: the account, x:<X id> or for Google g:<id>, different in every
+ * game; never the wallet, which is v.wallet), from the token gamesfun.js sends; null for a guest, at once and with no
+ * call when the request has no token, so a stranger costs the server nothing: answer 401 then, before any work.
+ */
 export async function withPlayer(request, env) {
   const token = /^Bearer\s+(\S+)$/i.exec(request.headers.get('authorization') ?? '')?.[1];
   if (!token) return null;

package/lib/client/server/rooms.js

@@ -177,6 +177,7 @@ export class GameRoom extends DurableObject {
     let player = null;
     if (m.token) {
       const v = await this.env.GF.verifyPlayer(String(m.token));
+      // id: the account (x:<X id>, or g:<id> for Google, different in every game); the wallet is its own claim
       if (v?.ok) player = { id: v.sub, x: v.x?.handle ?? null, wallet: v.wallet ?? null };
     }
     // its own storage: the room takes no other message while it waits on that

package/lib/client/server/vouchers.js

@@ -50,9 +50,9 @@ import ECONOMY from '__ECONOMY__';
  * player's daily total there, not in check, so a refusal after check (no proven wallet, a round already used) costs
  * them nothing. Not again for the same round asked twice at once or signed anew near its expiry; if paid throws, the
  * round is not counted and a later ask for it runs paid again.
- * Every wallet is a new player on a chain, and a wallet sign-in costs nothing: cap what a person can take with
- * VOUCHERS.payOnly 'x' (only players signed in with X, counted per X account) for rewards worth farming, and give each
- * grant a perDay total in xsolana.json.
+ * Every wallet is a new player on a chain, and a wallet costs nothing: cap what a person can take with VOUCHERS.payOnly
+ * 'x' (only players signed in with X, counted per X account) or 'account' (X or Google, counted per account; a Google
+ * account is easier to make than an X one) for rewards worth farming, and give each grant a perDay total in xsolana.json.
  */
 export const PAY = {
   async check() {
@@ -60,8 +60,8 @@ export const PAY = {
   },
 };
 
-/** payOnly: 'any' (every signed-in player) | 'x' (only players signed in with X); perMinute: pay and link requests a
- *  player may make a minute; linkSeconds: how long a link text may be signed. */
+/** payOnly: 'any' (every signed-in player) | 'account' (players signed in with X or Google) | 'x' (only players signed
+ *  in with X); perMinute: pay and link requests a player may make a minute; linkSeconds: how long a link text may be signed. */
 export const VOUCHERS = {
   seconds: 7 * 86400,
   renewWithin: 3600,
@@ -106,7 +106,12 @@ async function roundOf(id) {
   return hex(new Uint8Array(await crypto.subtle.digest('SHA-256', te.encode(text))).subarray(0, 16));
 }
 
-/** One person (an X account) as the grant counts them: never the account itself, and a different hash per grant. */
+/**
+ * The person a signed-in player is, for per-person limits: their X account's id, else their Google account's (g:<id>;
+ * an account with both is its X), else null (a wallet's own sign-in from before 2026-11-09).
+ */
+const personOf = player => player?.x?.id ?? (player?.google?.id ? `g:${player.google.id}` : null);
+/** One person (an X account, or a Google account with no X) as the grant counts them: never the account itself, and a different hash per grant. */
 async function personHashOf(signer, grantAddress, person) {
   if (person === null || person === undefined || person === '') return null;
   const own = await hmac(signer.raw, 'xcore voucher person v1');
@@ -313,7 +318,7 @@ async function signRound(env, { grant, wallet, round, amount, person = null }) {
   const r = await roundOf(round);
   if (!r) return refuse(400, 'round', 'A voucher needs the result’s own id (round), used once.');
   if (g.perPerson > 0 && (person === null || person === undefined || person === ''))
-    return refuse(403, 'person', 'This reward counts people: sign in with X to be paid.');
+    return refuse(403, 'person', 'This reward counts people: sign in with X or Google to be paid.');
   let units;
   try {
     // 'grant': the grant's own amount (the voucher names 0); otherwise a whole number of base units above 0
@@ -439,6 +444,8 @@ export async function handleVouchers(request, env) {
   if (method !== 'POST') return reply(refuse(405, 'method', 'POST api/vouchers/pay.'));
   if (VOUCHERS.payOnly === 'x' && !player.x?.id)
     return reply(refuse(403, 'x-only', 'This game pays players signed in with X: sign in with X to be paid.'));
+  if (VOUCHERS.payOnly === 'account' && !personOf(player))
+    return reply(refuse(403, 'account-only', 'This game pays players signed in with X or Google: sign in to be paid.'));
   const b = await bodyOf(request);
   if (!b.ok) return reply(b);
   const body = b.body;
@@ -462,7 +469,7 @@ export async function handleVouchers(request, env) {
     wallet,
     round: pays.round,
     amount: pays.amount,
-    person: player.x?.id ?? null,
+    person: personOf(player),
   });
   // paid once a round: the object flips the round to counted once, so two asks at once can't both run it; one that
   // throws puts it back, so a later ask runs it again (the voucher stays the round's either way)

package/lib/client/unity/GamesFun.cs

@@ -71,7 +71,7 @@ public class GamesFun : MonoBehaviour
 #endif
     }
 
-    /// <summary>The player's sign-in, from a button press (a window may open). how: "x" or "wallet". → the player JSON, or "null".</summary>
+    /// <summary>The player's sign-in, from a button press (a window may open). how: "x" or "google". → the player JSON, or "null".</summary>
     public static Task<string> SignIn(string how = "x") => Call("signIn", "[{\"how\":" + Str(how) + "}]");
     public static Task<string> SignOut() => Call("signOut", "[]");