@colyseus/core 0.17.43 → 0.18.0

package/build/utils/UserSessionIndex.d.ts

@@ -0,0 +1,166 @@
+/**
+ * User → active sessions index: "which active rooms is user X in?"
+ *
+ * Without this, answering that question would require fanning out
+ * `getInspectorView()` across every running room — O(rooms) per lookup.
+ * Instead, each Room writes a small Presence hash entry on `_onJoin` and
+ * removes it on `_onAfterLeave` / dispose. The admin endpoint reads the
+ * hash with a single `hgetall`, then reconciles against the matchmaker's
+ * live room listing to drop stale entries left behind by hard crashes
+ * (no `onLeave` ran).
+ *
+ * Hash schema:
+ *   key:   colyseus:user-rooms:{userId}
+ *   field: sessionId
+ *   value: JSON `{ roomId, roomName, joinedAt }` (joinedAt is unix ms)
+ *
+ * Anonymous clients (no userId resolvable) are skipped — the index is
+ * for forensic / support workflows, not anonymous traffic. A Room can
+ * also opt out wholesale by setting `trackUserSessions = false` (e.g.
+ * a high-volume relay room that doesn't want to pay the Presence
+ * write per join).
+ *
+ * Per-Room state (which sessionIds have an entry, and under which userId)
+ * lives in a module-level WeakMap rather than as a field on Room itself.
+ * Two reasons:
+ *
+ *   1. Room.ts stays thin — it only knows about three call points
+ *      (`trackRoomJoin`, `releaseRoomLeave`, `sweepRoomDispose`) and
+ *      doesn't have to carry an extra Map field or two private helper
+ *      methods solely for this concern.
+ *   2. The WeakMap is GC-tied to the Room — when a Room instance is
+ *      collected, its entries vanish automatically. No explicit teardown
+ *      hook needed beyond the dispose sweep that drains Presence.
+ *
+ * @internal
+ */
+import type { Presence } from '../presence/Presence.ts';
+export declare const USER_ROOMS_KEY_PREFIX = "colyseus:user-rooms:";
+export declare function userRoomsKey(userId: string): string;
+/**
+ * What's serialized into the Presence hash value (sessionId is the
+ * hash field key, not part of the body). Internal write-side shape.
+ */
+export interface UserRoomEntry {
+    roomId: string;
+    roomName: string;
+    joinedAt: number;
+}
+/**
+ * Public read-side shape returned by `listUserSessions`: a parsed
+ * `UserRoomEntry` plus its sessionId, optionally enriched with
+ * `processId` when reconcile against the matchmaker was on.
+ */
+export interface UserSessionInfo extends UserRoomEntry {
+    sessionId: string;
+    /**
+     * Process hosting the room, per the matchmaker. Populated only
+     * when `listUserSessions` was called with `reconcile: true` AND
+     * the room is still in the matchmaker roster.
+     */
+    processId?: string;
+}
+/**
+ * Structural subset of `Room` needed by the index. Lets this module
+ * avoid importing `Room` (which would create a cycle) while still
+ * staying typed at the call site.
+ */
+interface InspectorRoomShape {
+    roomId: string;
+    roomName: string;
+    presence: Presence;
+}
+/**
+ * Structural subset of a Client we read at join/leave. `userId` and
+ * `auth` are both optional — the index simply skips clients without
+ * either, which is the correct "anonymous traffic doesn't show up
+ * in support tooling" behavior.
+ */
+interface InspectorClientShape {
+    sessionId: string;
+    userId?: string;
+    auth?: {
+        id?: string;
+    } | null;
+}
+/**
+ * Best-effort: write the join entry. Errors are swallowed because the
+ * index is observability metadata — a Presence outage shouldn't reject
+ * a player's join. Exposed as a pure helper for tests + the admin
+ * endpoint; `trackRoomJoin` is the Room-flavored entrypoint.
+ */
+export declare function trackUserSession(presence: Presence, userId: string, sessionId: string, entry: UserRoomEntry): Promise<void>;
+/**
+ * Best-effort: remove the join entry. Errors are swallowed so a Presence
+ * blip doesn't bubble into `_onAfterLeave` / `_dispose`.
+ */
+export declare function releaseUserSession(presence: Presence, userId: string, sessionId: string): Promise<void>;
+/**
+ * Record `client`'s join under `room` in the reverse index. No-op for
+ * clients with no resolvable userId (anonymous), and when the room
+ * carries no presence (shouldn't happen — defensive for unit tests).
+ *
+ * Fire-and-forget against Presence; the in-memory tracking map updates
+ * synchronously so a follow-up `releaseRoomLeave` always finds the
+ * right userId even if the Presence write is still in flight.
+ */
+export declare function trackRoomJoin(room: InspectorRoomShape, client: InspectorClientShape): void;
+/**
+ * Drop `client`'s entry from the reverse index. Idempotent — no-op
+ * when the client wasn't tracked (anonymous, or tracking failed at
+ * join time).
+ */
+export declare function releaseRoomLeave(room: InspectorRoomShape, client: InspectorClientShape): void;
+/**
+ * Sweep any still-tracked sessions for `room`. Called during dispose to
+ * cover the case where `disconnect()` races the per-client `_onAfterLeave`
+ * path — the read-side reconcile handles cross-process crash recovery,
+ * but this is the cheap deterministic cleanup for a clean local dispose.
+ *
+ * Awaits the pending `hdel`s so the caller can sequence against "the
+ * index is now coherent" — the dispose path uses that ordering.
+ */
+export declare function sweepRoomDispose(room: InspectorRoomShape): Promise<void>;
+/**
+ * Minimal shape of a matchmaker room record needed for reconcile —
+ * keeps this module decoupled from the matchmaker / driver types.
+ * `matchMaker.query()`'s actual return (`IRoomCache[]`) is structurally
+ * a supertype of this, so callers can pass `matchMaker.query` directly.
+ */
+interface MatchmakerRoomLike {
+    roomId: string;
+    processId?: string;
+}
+export interface ListUserSessionsOptions {
+    /**
+     * Drop entries whose `roomId` is no longer in the matchmaker roster
+     * (the index can lag a crashed process). When `true`, the returned
+     * entries also carry `processId` from the live room record.
+     *
+     * Off by default — most callers (kick everyone, count) don't need it
+     * and the extra `matchMaker.query` round-trip isn't free.
+     */
+    reconcile?: boolean;
+    /**
+     * Fire-and-forget `hdel` for stale entries — those dropped by
+     * reconcile (matchmaker doesn't know the room anymore) plus any
+     * with corrupt JSON. Lets read endpoints self-heal the index on
+     * each call. No-op when `reconcile` is `false`.
+     */
+    removeStale?: boolean;
+}
+/**
+ * Read the user → active sessions index. Pure helper — the
+ * `Presence` + matchmaker batch lookup are injected so this module
+ * stays free of matchmaker imports (and so unit tests can drive it
+ * with fake deps).
+ *
+ * Wire-op count per call:
+ *   - 1 HGETALL on the user's hash (always).
+ *   - 1 batch room lookup when `reconcile: true` AND there are
+ *     entries to verify; skipped otherwise.
+ *
+ * Bounded at 2 wire ops regardless of the user's session count.
+ */
+export declare function listUserSessions(presence: Presence, findRooms: (roomIds: string[]) => Promise<Map<string, MatchmakerRoomLike>>, userId: string, options?: ListUserSessionsOptions): Promise<UserSessionInfo[]>;
+export {};

package/build/utils/UserSessionIndex.mjs

@@ -0,0 +1,130 @@
+// packages/core/src/utils/UserSessionIndex.ts
+var USER_ROOMS_KEY_PREFIX = "colyseus:user-rooms:";
+function userRoomsKey(userId) {
+  return USER_ROOMS_KEY_PREFIX + userId;
+}
+var tracked = /* @__PURE__ */ new WeakMap();
+function getTrackingMap(room) {
+  let map = tracked.get(room);
+  if (!map) {
+    map = /* @__PURE__ */ new Map();
+    tracked.set(room, map);
+  }
+  return map;
+}
+function resolveUserId(client) {
+  return client.userId ?? client.auth?.id;
+}
+async function trackUserSession(presence, userId, sessionId, entry) {
+  try {
+    await presence.hset(userRoomsKey(userId), sessionId, JSON.stringify(entry));
+  } catch {
+  }
+}
+async function releaseUserSession(presence, userId, sessionId) {
+  try {
+    await presence.hdel(userRoomsKey(userId), sessionId);
+  } catch {
+  }
+}
+function trackRoomJoin(room, client) {
+  if (!room.presence) {
+    return;
+  }
+  const userId = resolveUserId(client);
+  if (!userId) {
+    return;
+  }
+  getTrackingMap(room).set(client.sessionId, userId);
+  const entry = {
+    roomId: room.roomId,
+    roomName: room.roomName,
+    joinedAt: Date.now()
+  };
+  void trackUserSession(room.presence, userId, client.sessionId, entry);
+}
+function releaseRoomLeave(room, client) {
+  if (!room.presence) {
+    return;
+  }
+  const map = tracked.get(room);
+  const userId = map?.get(client.sessionId);
+  if (!userId || !map) {
+    return;
+  }
+  map.delete(client.sessionId);
+  void releaseUserSession(room.presence, userId, client.sessionId);
+}
+async function sweepRoomDispose(room) {
+  if (!room.presence) {
+    return;
+  }
+  const map = tracked.get(room);
+  if (!map || map.size === 0) {
+    return;
+  }
+  const pending = [];
+  for (const [sessionId, userId] of map) {
+    pending.push(releaseUserSession(room.presence, userId, sessionId));
+  }
+  map.clear();
+  await Promise.all(pending);
+}
+async function listUserSessions(presence, findRooms, userId, options = {}) {
+  const reconcile = options.reconcile === true;
+  const removeStale = reconcile && options.removeStale === true;
+  let raw;
+  try {
+    raw = await presence.hgetall(userRoomsKey(userId));
+  } catch {
+    return [];
+  }
+  const fields = Object.keys(raw);
+  if (fields.length === 0) {
+    return [];
+  }
+  const staleSessions = [];
+  const parsed = [];
+  for (const sessionId of fields) {
+    try {
+      parsed.push({ sessionId, entry: JSON.parse(raw[sessionId]) });
+    } catch {
+      staleSessions.push(sessionId);
+    }
+  }
+  if (!reconcile) {
+    return parsed.map(({ sessionId, entry }) => ({ sessionId, ...entry }));
+  }
+  const live = parsed.length > 0 ? await findRooms(parsed.map((p) => p.entry.roomId)) : /* @__PURE__ */ new Map();
+  const result = [];
+  for (const { sessionId, entry } of parsed) {
+    const room = live.get(entry.roomId);
+    if (!room) {
+      staleSessions.push(sessionId);
+      continue;
+    }
+    const info = { sessionId, ...entry };
+    if (room.processId !== void 0) {
+      info.processId = room.processId;
+    }
+    result.push(info);
+  }
+  if (removeStale && staleSessions.length > 0) {
+    const key = userRoomsKey(userId);
+    void Promise.all(
+      staleSessions.map((s) => presence.hdel(key, s))
+    ).catch(() => {
+    });
+  }
+  return result;
+}
+export {
+  USER_ROOMS_KEY_PREFIX,
+  listUserSessions,
+  releaseRoomLeave,
+  releaseUserSession,
+  sweepRoomDispose,
+  trackRoomJoin,
+  trackUserSession,
+  userRoomsKey
+};

package/build/utils/UserSessionIndex.mjs.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/utils/UserSessionIndex.ts"],
+  "sourcesContent": ["/**\n * User \u2192 active sessions index: \"which active rooms is user X in?\"\n *\n * Without this, answering that question would require fanning out\n * `getInspectorView()` across every running room \u2014 O(rooms) per lookup.\n * Instead, each Room writes a small Presence hash entry on `_onJoin` and\n * removes it on `_onAfterLeave` / dispose. The admin endpoint reads the\n * hash with a single `hgetall`, then reconciles against the matchmaker's\n * live room listing to drop stale entries left behind by hard crashes\n * (no `onLeave` ran).\n *\n * Hash schema:\n *   key:   colyseus:user-rooms:{userId}\n *   field: sessionId\n *   value: JSON `{ roomId, roomName, joinedAt }` (joinedAt is unix ms)\n *\n * Anonymous clients (no userId resolvable) are skipped \u2014 the index is\n * for forensic / support workflows, not anonymous traffic. A Room can\n * also opt out wholesale by setting `trackUserSessions = false` (e.g.\n * a high-volume relay room that doesn't want to pay the Presence\n * write per join).\n *\n * Per-Room state (which sessionIds have an entry, and under which userId)\n * lives in a module-level WeakMap rather than as a field on Room itself.\n * Two reasons:\n *\n *   1. Room.ts stays thin \u2014 it only knows about three call points\n *      (`trackRoomJoin`, `releaseRoomLeave`, `sweepRoomDispose`) and\n *      doesn't have to carry an extra Map field or two private helper\n *      methods solely for this concern.\n *   2. The WeakMap is GC-tied to the Room \u2014 when a Room instance is\n *      collected, its entries vanish automatically. No explicit teardown\n *      hook needed beyond the dispose sweep that drains Presence.\n *\n * @internal\n */\nimport type { Presence } from '../presence/Presence.ts';\n\nexport const USER_ROOMS_KEY_PREFIX = 'colyseus:user-rooms:';\n\nexport function userRoomsKey(userId: string): string {\n  return USER_ROOMS_KEY_PREFIX + userId;\n}\n\n/**\n * What's serialized into the Presence hash value (sessionId is the\n * hash field key, not part of the body). Internal write-side shape.\n */\nexport interface UserRoomEntry {\n  roomId: string;\n  roomName: string;\n  joinedAt: number;\n}\n\n/**\n * Public read-side shape returned by `listUserSessions`: a parsed\n * `UserRoomEntry` plus its sessionId, optionally enriched with\n * `processId` when reconcile against the matchmaker was on.\n */\nexport interface UserSessionInfo extends UserRoomEntry {\n  sessionId: string;\n  /**\n   * Process hosting the room, per the matchmaker. Populated only\n   * when `listUserSessions` was called with `reconcile: true` AND\n   * the room is still in the matchmaker roster.\n   */\n  processId?: string;\n}\n\n/**\n * Structural subset of `Room` needed by the index. Lets this module\n * avoid importing `Room` (which would create a cycle) while still\n * staying typed at the call site.\n */\ninterface InspectorRoomShape {\n  roomId: string;\n  roomName: string;\n  presence: Presence;\n}\n\n/**\n * Structural subset of a Client we read at join/leave. `userId` and\n * `auth` are both optional \u2014 the index simply skips clients without\n * either, which is the correct \"anonymous traffic doesn't show up\n * in support tooling\" behavior.\n */\ninterface InspectorClientShape {\n  sessionId: string;\n  userId?: string;\n  auth?: { id?: string } | null;\n}\n\n/**\n * sessionId \u2192 userId for clients currently registered in the index,\n * scoped per Room. WeakMap-keyed so a forgotten Room takes its tracking\n * map with it.\n */\nconst tracked = new WeakMap<InspectorRoomShape, Map<string, string>>();\n\nfunction getTrackingMap(room: InspectorRoomShape): Map<string, string> {\n  let map = tracked.get(room);\n  if (!map) {\n    map = new Map();\n    tracked.set(room, map);\n  }\n  return map;\n}\n\nfunction resolveUserId(client: InspectorClientShape): string | undefined {\n  return client.userId ?? client.auth?.id;\n}\n\n/**\n * Best-effort: write the join entry. Errors are swallowed because the\n * index is observability metadata \u2014 a Presence outage shouldn't reject\n * a player's join. Exposed as a pure helper for tests + the admin\n * endpoint; `trackRoomJoin` is the Room-flavored entrypoint.\n */\nexport async function trackUserSession(\n  presence: Presence,\n  userId: string,\n  sessionId: string,\n  entry: UserRoomEntry,\n): Promise<void> {\n  try {\n    await presence.hset(userRoomsKey(userId), sessionId, JSON.stringify(entry));\n  } catch {\n    // intentional: see fn-doc\n  }\n}\n\n/**\n * Best-effort: remove the join entry. Errors are swallowed so a Presence\n * blip doesn't bubble into `_onAfterLeave` / `_dispose`.\n */\nexport async function releaseUserSession(\n  presence: Presence,\n  userId: string,\n  sessionId: string,\n): Promise<void> {\n  try {\n    await presence.hdel(userRoomsKey(userId), sessionId);\n  } catch {\n    // intentional: see fn-doc\n  }\n}\n\n/**\n * Record `client`'s join under `room` in the reverse index. No-op for\n * clients with no resolvable userId (anonymous), and when the room\n * carries no presence (shouldn't happen \u2014 defensive for unit tests).\n *\n * Fire-and-forget against Presence; the in-memory tracking map updates\n * synchronously so a follow-up `releaseRoomLeave` always finds the\n * right userId even if the Presence write is still in flight.\n */\nexport function trackRoomJoin(room: InspectorRoomShape, client: InspectorClientShape): void {\n  if (!room.presence) { return; }\n  const userId = resolveUserId(client);\n  if (!userId) { return; }\n  getTrackingMap(room).set(client.sessionId, userId);\n  const entry: UserRoomEntry = {\n    roomId: room.roomId,\n    roomName: room.roomName,\n    joinedAt: Date.now(),\n  };\n  void trackUserSession(room.presence, userId, client.sessionId, entry);\n}\n\n/**\n * Drop `client`'s entry from the reverse index. Idempotent \u2014 no-op\n * when the client wasn't tracked (anonymous, or tracking failed at\n * join time).\n */\nexport function releaseRoomLeave(room: InspectorRoomShape, client: InspectorClientShape): void {\n  if (!room.presence) { return; }\n  const map = tracked.get(room);\n  const userId = map?.get(client.sessionId);\n  if (!userId || !map) { return; }\n  map.delete(client.sessionId);\n  void releaseUserSession(room.presence, userId, client.sessionId);\n}\n\n/**\n * Sweep any still-tracked sessions for `room`. Called during dispose to\n * cover the case where `disconnect()` races the per-client `_onAfterLeave`\n * path \u2014 the read-side reconcile handles cross-process crash recovery,\n * but this is the cheap deterministic cleanup for a clean local dispose.\n *\n * Awaits the pending `hdel`s so the caller can sequence against \"the\n * index is now coherent\" \u2014 the dispose path uses that ordering.\n */\nexport async function sweepRoomDispose(room: InspectorRoomShape): Promise<void> {\n  if (!room.presence) { return; }\n  const map = tracked.get(room);\n  if (!map || map.size === 0) { return; }\n  const pending: Promise<void>[] = [];\n  for (const [sessionId, userId] of map) {\n    pending.push(releaseUserSession(room.presence, userId, sessionId));\n  }\n  map.clear();\n  await Promise.all(pending);\n}\n\n/**\n * Minimal shape of a matchmaker room record needed for reconcile \u2014\n * keeps this module decoupled from the matchmaker / driver types.\n * `matchMaker.query()`'s actual return (`IRoomCache[]`) is structurally\n * a supertype of this, so callers can pass `matchMaker.query` directly.\n */\ninterface MatchmakerRoomLike {\n  roomId: string;\n  processId?: string;\n}\n\nexport interface ListUserSessionsOptions {\n  /**\n   * Drop entries whose `roomId` is no longer in the matchmaker roster\n   * (the index can lag a crashed process). When `true`, the returned\n   * entries also carry `processId` from the live room record.\n   *\n   * Off by default \u2014 most callers (kick everyone, count) don't need it\n   * and the extra `matchMaker.query` round-trip isn't free.\n   */\n  reconcile?: boolean;\n\n  /**\n   * Fire-and-forget `hdel` for stale entries \u2014 those dropped by\n   * reconcile (matchmaker doesn't know the room anymore) plus any\n   * with corrupt JSON. Lets read endpoints self-heal the index on\n   * each call. No-op when `reconcile` is `false`.\n   */\n  removeStale?: boolean;\n}\n\n/**\n * Read the user \u2192 active sessions index. Pure helper \u2014 the\n * `Presence` + matchmaker batch lookup are injected so this module\n * stays free of matchmaker imports (and so unit tests can drive it\n * with fake deps).\n *\n * Wire-op count per call:\n *   - 1 HGETALL on the user's hash (always).\n *   - 1 batch room lookup when `reconcile: true` AND there are\n *     entries to verify; skipped otherwise.\n *\n * Bounded at 2 wire ops regardless of the user's session count.\n */\nexport async function listUserSessions(\n  presence: Presence,\n  findRooms: (roomIds: string[]) => Promise<Map<string, MatchmakerRoomLike>>,\n  userId: string,\n  options: ListUserSessionsOptions = {},\n): Promise<UserSessionInfo[]> {\n  const reconcile = options.reconcile === true;\n  const removeStale = reconcile && options.removeStale === true;\n\n  let raw: Record<string, string>;\n  try {\n    raw = await presence.hgetall(userRoomsKey(userId));\n  } catch {\n    // Presence outage \u2014 observability shouldn't bring down the caller.\n    return [];\n  }\n  const fields = Object.keys(raw);\n  if (fields.length === 0) { return []; }\n\n  const staleSessions: string[] = [];\n  const parsed: Array<{ sessionId: string; entry: UserRoomEntry }> = [];\n  for (const sessionId of fields) {\n    try {\n      parsed.push({ sessionId, entry: JSON.parse(raw[sessionId]) as UserRoomEntry });\n    } catch {\n      // Corrupt JSON \u2014 index drift. Removable even without reconcile.\n      staleSessions.push(sessionId);\n    }\n  }\n\n  if (!reconcile) {\n    return parsed.map(({ sessionId, entry }) => ({ sessionId, ...entry }));\n  }\n\n  // One batch lookup for the K roomIds we care about. K = entries\n  // surviving the JSON.parse stage, not cluster size.\n  const live = parsed.length > 0\n    ? await findRooms(parsed.map((p) => p.entry.roomId))\n    : new Map<string, MatchmakerRoomLike>();\n\n  const result: UserSessionInfo[] = [];\n  for (const { sessionId, entry } of parsed) {\n    const room = live.get(entry.roomId);\n    if (!room) {\n      // Matchmaker doesn't know this roomId anymore \u2014 stale entry\n      // from a crashed process. Drop it (and remove if requested).\n      staleSessions.push(sessionId);\n      continue;\n    }\n    const info: UserSessionInfo = { sessionId, ...entry };\n    if (room.processId !== undefined) { info.processId = room.processId; }\n    result.push(info);\n  }\n\n  if (removeStale && staleSessions.length > 0) {\n    const key = userRoomsKey(userId);\n    void Promise.all(\n      staleSessions.map((s) => presence.hdel(key, s)),\n    ).catch(() => { /* presence outage, swallow */ });\n  }\n\n  return result;\n}\n"],
+  "mappings": ";AAsCO,IAAM,wBAAwB;AAE9B,SAAS,aAAa,QAAwB;AACnD,SAAO,wBAAwB;AACjC;AAuDA,IAAM,UAAU,oBAAI,QAAiD;AAErE,SAAS,eAAe,MAA+C;AACrE,MAAI,MAAM,QAAQ,IAAI,IAAI;AAC1B,MAAI,CAAC,KAAK;AACR,UAAM,oBAAI,IAAI;AACd,YAAQ,IAAI,MAAM,GAAG;AAAA,EACvB;AACA,SAAO;AACT;AAEA,SAAS,cAAc,QAAkD;AACvE,SAAO,OAAO,UAAU,OAAO,MAAM;AACvC;AAQA,eAAsB,iBACpB,UACA,QACA,WACA,OACe;AACf,MAAI;AACF,UAAM,SAAS,KAAK,aAAa,MAAM,GAAG,WAAW,KAAK,UAAU,KAAK,CAAC;AAAA,EAC5E,QAAQ;AAAA,EAER;AACF;AAMA,eAAsB,mBACpB,UACA,QACA,WACe;AACf,MAAI;AACF,UAAM,SAAS,KAAK,aAAa,MAAM,GAAG,SAAS;AAAA,EACrD,QAAQ;AAAA,EAER;AACF;AAWO,SAAS,cAAc,MAA0B,QAAoC;AAC1F,MAAI,CAAC,KAAK,UAAU;AAAE;AAAA,EAAQ;AAC9B,QAAM,SAAS,cAAc,MAAM;AACnC,MAAI,CAAC,QAAQ;AAAE;AAAA,EAAQ;AACvB,iBAAe,IAAI,EAAE,IAAI,OAAO,WAAW,MAAM;AACjD,QAAM,QAAuB;AAAA,IAC3B,QAAQ,KAAK;AAAA,IACb,UAAU,KAAK;AAAA,IACf,UAAU,KAAK,IAAI;AAAA,EACrB;AACA,OAAK,iBAAiB,KAAK,UAAU,QAAQ,OAAO,WAAW,KAAK;AACtE;AAOO,SAAS,iBAAiB,MAA0B,QAAoC;AAC7F,MAAI,CAAC,KAAK,UAAU;AAAE;AAAA,EAAQ;AAC9B,QAAM,MAAM,QAAQ,IAAI,IAAI;AAC5B,QAAM,SAAS,KAAK,IAAI,OAAO,SAAS;AACxC,MAAI,CAAC,UAAU,CAAC,KAAK;AAAE;AAAA,EAAQ;AAC/B,MAAI,OAAO,OAAO,SAAS;AAC3B,OAAK,mBAAmB,KAAK,UAAU,QAAQ,OAAO,SAAS;AACjE;AAWA,eAAsB,iBAAiB,MAAyC;AAC9E,MAAI,CAAC,KAAK,UAAU;AAAE;AAAA,EAAQ;AAC9B,QAAM,MAAM,QAAQ,IAAI,IAAI;AAC5B,MAAI,CAAC,OAAO,IAAI,SAAS,GAAG;AAAE;AAAA,EAAQ;AACtC,QAAM,UAA2B,CAAC;AAClC,aAAW,CAAC,WAAW,MAAM,KAAK,KAAK;AACrC,YAAQ,KAAK,mBAAmB,KAAK,UAAU,QAAQ,SAAS,CAAC;AAAA,EACnE;AACA,MAAI,MAAM;AACV,QAAM,QAAQ,IAAI,OAAO;AAC3B;AA8CA,eAAsB,iBACpB,UACA,WACA,QACA,UAAmC,CAAC,GACR;AAC5B,QAAM,YAAY,QAAQ,cAAc;AACxC,QAAM,cAAc,aAAa,QAAQ,gBAAgB;AAEzD,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,SAAS,QAAQ,aAAa,MAAM,CAAC;AAAA,EACnD,QAAQ;AAEN,WAAO,CAAC;AAAA,EACV;AACA,QAAM,SAAS,OAAO,KAAK,GAAG;AAC9B,MAAI,OAAO,WAAW,GAAG;AAAE,WAAO,CAAC;AAAA,EAAG;AAEtC,QAAM,gBAA0B,CAAC;AACjC,QAAM,SAA6D,CAAC;AACpE,aAAW,aAAa,QAAQ;AAC9B,QAAI;AACF,aAAO,KAAK,EAAE,WAAW,OAAO,KAAK,MAAM,IAAI,SAAS,CAAC,EAAmB,CAAC;AAAA,IAC/E,QAAQ;AAEN,oBAAc,KAAK,SAAS;AAAA,IAC9B;AAAA,EACF;AAEA,MAAI,CAAC,WAAW;AACd,WAAO,OAAO,IAAI,CAAC,EAAE,WAAW,MAAM,OAAO,EAAE,WAAW,GAAG,MAAM,EAAE;AAAA,EACvE;AAIA,QAAM,OAAO,OAAO,SAAS,IACzB,MAAM,UAAU,OAAO,IAAI,CAAC,MAAM,EAAE,MAAM,MAAM,CAAC,IACjD,oBAAI,IAAgC;AAExC,QAAM,SAA4B,CAAC;AACnC,aAAW,EAAE,WAAW,MAAM,KAAK,QAAQ;AACzC,UAAM,OAAO,KAAK,IAAI,MAAM,MAAM;AAClC,QAAI,CAAC,MAAM;AAGT,oBAAc,KAAK,SAAS;AAC5B;AAAA,IACF;AACA,UAAM,OAAwB,EAAE,WAAW,GAAG,MAAM;AACpD,QAAI,KAAK,cAAc,QAAW;AAAE,WAAK,YAAY,KAAK;AAAA,IAAW;AACrE,WAAO,KAAK,IAAI;AAAA,EAClB;AAEA,MAAI,eAAe,cAAc,SAAS,GAAG;AAC3C,UAAM,MAAM,aAAa,MAAM;AAC/B,SAAK,QAAQ;AAAA,MACX,cAAc,IAAI,CAAC,MAAM,SAAS,KAAK,KAAK,CAAC,CAAC;AAAA,IAChD,EAAE,MAAM,MAAM;AAAA,IAAiC,CAAC;AAAA,EAClD;AAEA,SAAO;AACT;",
+  "names": []
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@colyseus/core",
-  "version": "0.17.43",
+  "version": "0.18.0",
   "description": "Multiplayer Framework for Node.js.",
   "type": "module",
   "input": "./src/index.ts",
@@ -46,31 +46,35 @@
     "node": ">= 22.x"
   },
   "dependencies": {
-    "@colyseus/msgpackr": "^1.11.2",
+    "msgpackr": "^2.0.1",
     "@colyseus/timer": "^2.0.0",
     "@standard-schema/spec": "^1.0.0",
     "debug": "^4.3.4",
     "nanoid": "^3.3.11",
-    "@colyseus/shared-types": "^0.17.6",
-    "@colyseus/greeting-banner": "^3.0.8",
-    "@colyseus/better-call": "^1.3.1"
+    "@colyseus/better-call": "^1.3.1",
+    "@colyseus/shared-types": "^0.18.0",
+    "@colyseus/greeting-banner": "^4.0.0"
   },
   "devDependencies": {
-    "@colyseus/schema": "^4.0.7",
+    "@colyseus/schema": "^5.0.3",
     "express": "^5.0.0",
-    "@colyseus/redis-driver": "^0.17.7",
-    "@colyseus/redis-presence": "^0.17.7",
-    "@colyseus/tools": "^0.17.19"
+    "@colyseus/redis-driver": "^0.18.0",
+    "@colyseus/tools": "^0.18.0",
+    "@colyseus/redis-presence": "^0.18.0"
   },
   "peerDependencies": {
-    "@colyseus/schema": "^4.0.7",
+    "@colyseus/schema": "^5.0.3",
     "@pm2/io": "^6.1.0",
     "express": "^4.16.0 || ^5.0.0",
     "zod": "^4.1.12",
     "@colyseus/better-call": "^1.3.1",
-    "@colyseus/ws-transport": "^0.17.13"
+    "@colyseus/auth": "^0.18.0",
+    "@colyseus/ws-transport": "^0.18.0"
   },
   "peerDependenciesMeta": {
+    "@colyseus/auth": {
+      "optional": true
+    },
     "@colyseus/ws-transport": {
       "optional": true
     },
@@ -85,12 +89,13 @@
     }
   },
   "optionalPeerDependencies": {
-    "@colyseus/tools": "0.17.x",
-    "@colyseus/redis-driver": "0.17.x",
-    "@colyseus/redis-presence": "0.17.x"
+    "@colyseus/tools": "0.18.x",
+    "@colyseus/redis-driver": "0.18.x",
+    "@colyseus/redis-presence": "0.18.x"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "tag": "next"
   },
   "gitHead": "c45b410e99eadffff4b74e701339992e2faa15f8"
 }

package/src/MatchMaker.ts

@@ -321,6 +321,20 @@ export async function query<T extends Room = any>(
   return await driver.query<T>(conditions, sortOptions);
 }
 
+/**
+ * Batch-resolve room caches by roomId in a single backend round
+ * trip. Returns a Map keyed by roomId; missing roomIds are absent.
+ *
+ * Hot paths (per-join uniqueness checks, by-user reverse-index
+ * lookups) reach for this instead of `query({})` — the latter scans
+ * the whole room cache and grows linearly with cluster size, while
+ * `findRoomsByIds` is O(K) in the caller's input.
+ */
+export async function findRoomsByIds(roomIds: string[]): Promise<Map<string, IRoomCache>> {
+  if (roomIds.length === 0) { return new Map(); }
+  return await driver.findByIds(roomIds);
+}
+
 /**
  * Find for a public and unlocked room available.
  *
@@ -939,13 +953,33 @@ export function buildSeatReservation(room: IRoomCache, sessionId: string) {
 
 async function callOnAuth(roomName: string, clientOptions?: ClientOptions, authContext?: AuthContext) {
   const roomClass = getRoomClass(roomName);
-  if (roomClass && roomClass['onAuth'] && roomClass['onAuth'] !== Room['onAuth']) {
-    const result = await roomClass['onAuth'](authContext.token, clientOptions, authContext)
-    if (!result) {
-      throw new ServerError(ErrorCode.AUTH_FAILED, 'onAuth failed');
-    }
-    return result;
+  const onAuth = roomClass?.['onAuth'];
+  if (!onAuth) { return; }
+
+  // Server-initiated joins (e.g. internal `matchMaker.create()` from
+  // bots/tests/cron) skip auth — there's no transport, no headers, no
+  // token. Treat the absence of authContext as "no auth performed",
+  // which leaves client.auth undefined just like the legacy short-
+  // circuit did.
+  if (!authContext) { return; }
+
+  // Always invoke onAuth when an auth context is present — even when
+  // the room hasn't overridden it. The base `Room.onAuth` returns
+  // `true` (or whatever a side-effect import like @colyseus/auth swapped
+  // it for), and we use the return value to populate `client.auth` when
+  // it's a payload object. Pre-change this call was skipped when the
+  // subclass inherited the default, which made it impossible to install
+  // a workspace-wide token decoder by patching `Room.onAuth` once.
+  const result = await onAuth(authContext.token, clientOptions, authContext);
+
+  // Auth-result semantics:
+  //   false / null / undefined  → AUTH_FAILED
+  //   true                      → succeeded but no payload (don't set client.auth)
+  //   anything else (object)    → succeeded; the value becomes client.auth
+  if (result === false || result === null || result === undefined) {
+    throw new ServerError(ErrorCode.AUTH_FAILED, 'onAuth failed');
   }
+  return result === true ? undefined : result;
 }
 
 /**