@colyseus/core 0.17.44 → 0.18.1

package/build/rooms/RelayRoom.cjs.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/rooms/RelayRoom.ts"],
-  "sourcesContent": ["import { CloseCode } from '@colyseus/shared-types';\nimport { defineTypes, MapSchema, Schema } from '@colyseus/schema';\n\nimport { Room } from '../Room.ts';\nimport type { Client } from '../Transport.ts';\n\nclass Player extends Schema {\n  public connected: boolean;\n  public name: string;\n  public sessionId: string;\n}\ndefineTypes(Player, {\n  connected: 'boolean',\n  name: 'string',\n  sessionId: 'string',\n});\n\nclass State extends Schema {\n  public players = new MapSchema<Player>();\n}\ndefineTypes(State, {\n  players: { map: Player },\n});\n\n/**\n * client.joinOrCreate(\"relayroom\", {\n *   maxClients: 10,\n *   allowReconnectionTime: 20\n * });\n */\n\nexport class RelayRoom extends Room {\n  public state = new State();\n  public allowReconnectionTime: number = 0;\n\n  public onCreate(options: Partial<{\n    maxClients: number,\n    allowReconnectionTime: number,\n    metadata: any,\n  }>) {\n    if (options.maxClients) {\n      this.maxClients = options.maxClients;\n    }\n\n    if (options.allowReconnectionTime) {\n      this.allowReconnectionTime = Math.min(options.allowReconnectionTime, 40);\n    }\n\n    if (options.metadata) {\n      this.setMetadata(options.metadata);\n    }\n\n    this.onMessage('*', (client: Client, type: string | number, message: any) => {\n      this.broadcast(type, [client.sessionId, message], { except: client });\n    });\n  }\n\n  public onJoin(client: Client, options: any = {}) {\n    const player = new Player();\n\n    player.connected = true;\n    player.sessionId = client.sessionId;\n\n    if (options.name) {\n      player.name = options.name;\n    }\n\n    this.state.players.set(client.sessionId, player);\n  }\n\n  public async onLeave(client: Client, code: number) {\n    if (this.allowReconnectionTime > 0) {\n      const player = this.state.players.get(client.sessionId);\n      player.connected = false;\n\n      try {\n        if (code === CloseCode.CONSENTED) {\n          throw new Error('consented leave');\n        }\n\n        await this.allowReconnection(client, this.allowReconnectionTime);\n        player.connected = true;\n\n      } catch (e) {\n        this.state.players.delete(client.sessionId);\n      }\n    }\n  }\n\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,0BAA0B;AAC1B,oBAA+C;AAE/C,kBAAqB;AAGrB,IAAM,SAAN,cAAqB,qBAAO;AAI5B;AAAA,IACA,2BAAY,QAAQ;AAAA,EAClB,WAAW;AAAA,EACX,MAAM;AAAA,EACN,WAAW;AACb,CAAC;AAED,IAAM,QAAN,cAAoB,qBAAO;AAAA,EAA3B;AAAA;AACE,SAAO,UAAU,IAAI,wBAAkB;AAAA;AACzC;AAAA,IACA,2BAAY,OAAO;AAAA,EACjB,SAAS,EAAE,KAAK,OAAO;AACzB,CAAC;AASM,IAAM,YAAN,cAAwB,iBAAK;AAAA,EAA7B;AAAA;AACL,SAAO,QAAQ,IAAI,MAAM;AACzB,SAAO,wBAAgC;AAAA;AAAA,EAEhC,SAAS,SAIZ;AACF,QAAI,QAAQ,YAAY;AACtB,WAAK,aAAa,QAAQ;AAAA,IAC5B;AAEA,QAAI,QAAQ,uBAAuB;AACjC,WAAK,wBAAwB,KAAK,IAAI,QAAQ,uBAAuB,EAAE;AAAA,IACzE;AAEA,QAAI,QAAQ,UAAU;AACpB,WAAK,YAAY,QAAQ,QAAQ;AAAA,IACnC;AAEA,SAAK,UAAU,KAAK,CAAC,QAAgB,MAAuB,YAAiB;AAC3E,WAAK,UAAU,MAAM,CAAC,OAAO,WAAW,OAAO,GAAG,EAAE,QAAQ,OAAO,CAAC;AAAA,IACtE,CAAC;AAAA,EACH;AAAA,EAEO,OAAO,QAAgB,UAAe,CAAC,GAAG;AAC/C,UAAM,SAAS,IAAI,OAAO;AAE1B,WAAO,YAAY;AACnB,WAAO,YAAY,OAAO;AAE1B,QAAI,QAAQ,MAAM;AAChB,aAAO,OAAO,QAAQ;AAAA,IACxB;AAEA,SAAK,MAAM,QAAQ,IAAI,OAAO,WAAW,MAAM;AAAA,EACjD;AAAA,EAEA,MAAa,QAAQ,QAAgB,MAAc;AACjD,QAAI,KAAK,wBAAwB,GAAG;AAClC,YAAM,SAAS,KAAK,MAAM,QAAQ,IAAI,OAAO,SAAS;AACtD,aAAO,YAAY;AAEnB,UAAI;AACF,YAAI,SAAS,8BAAU,WAAW;AAChC,gBAAM,IAAI,MAAM,iBAAiB;AAAA,QACnC;AAEA,cAAM,KAAK,kBAAkB,QAAQ,KAAK,qBAAqB;AAC/D,eAAO,YAAY;AAAA,MAErB,SAAS,GAAG;AACV,aAAK,MAAM,QAAQ,OAAO,OAAO,SAAS;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AAEF;",
+  "sourcesContent": ["import { CloseCode } from '@colyseus/shared-types';\nimport { schema, t, type SchemaType } from '@colyseus/schema';\n\nimport { Room } from '../Room.ts';\nimport type { Client } from '../Transport.ts';\n\nexport const Player = schema({\n  connected: t.boolean(),\n  name: t.string(),\n  sessionId: t.string(),\n});\nexport type Player = SchemaType<typeof Player>;\n\nexport const State = schema({\n  players: t.map(Player),\n});\nexport type State = SchemaType<typeof State>;\n\n/**\n * client.joinOrCreate(\"relayroom\", {\n *   maxClients: 10,\n *   allowReconnectionTime: 20\n * });\n */\n\nexport class RelayRoom extends Room {\n  public state = new State();\n  public allowReconnectionTime: number = 0;\n\n  public onCreate(options: Partial<{\n    maxClients: number,\n    allowReconnectionTime: number,\n    metadata: any,\n  }>) {\n    if (options.maxClients) {\n      this.maxClients = options.maxClients;\n    }\n\n    if (options.allowReconnectionTime) {\n      this.allowReconnectionTime = Math.min(options.allowReconnectionTime, 40);\n    }\n\n    if (options.metadata) {\n      this.setMetadata(options.metadata);\n    }\n\n    this.onMessage('*', (client: Client, type: string | number, message: any) => {\n      this.broadcast(type, [client.sessionId, message], { except: client });\n    });\n  }\n\n  public onJoin(client: Client, options: any = {}) {\n    const player = new Player();\n\n    player.connected = true;\n    player.sessionId = client.sessionId;\n\n    if (options.name) {\n      player.name = options.name;\n    }\n\n    this.state.players.set(client.sessionId, player);\n  }\n\n  public async onLeave(client: Client, code: number) {\n    if (this.allowReconnectionTime > 0) {\n      const player = this.state.players.get(client.sessionId);\n      player.connected = false;\n\n      try {\n        if (code === CloseCode.CONSENTED) {\n          throw new Error('consented leave');\n        }\n\n        await this.allowReconnection(client, this.allowReconnectionTime);\n        player.connected = true;\n\n      } catch (e) {\n        this.state.players.delete(client.sessionId);\n      }\n    }\n  }\n\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,0BAA0B;AAC1B,oBAA2C;AAE3C,kBAAqB;AAGd,IAAM,aAAS,sBAAO;AAAA,EAC3B,WAAW,gBAAE,QAAQ;AAAA,EACrB,MAAM,gBAAE,OAAO;AAAA,EACf,WAAW,gBAAE,OAAO;AACtB,CAAC;AAGM,IAAM,YAAQ,sBAAO;AAAA,EAC1B,SAAS,gBAAE,IAAI,MAAM;AACvB,CAAC;AAUM,IAAM,YAAN,cAAwB,iBAAK;AAAA,EAA7B;AAAA;AACL,SAAO,QAAQ,IAAI,MAAM;AACzB,SAAO,wBAAgC;AAAA;AAAA,EAEhC,SAAS,SAIZ;AACF,QAAI,QAAQ,YAAY;AACtB,WAAK,aAAa,QAAQ;AAAA,IAC5B;AAEA,QAAI,QAAQ,uBAAuB;AACjC,WAAK,wBAAwB,KAAK,IAAI,QAAQ,uBAAuB,EAAE;AAAA,IACzE;AAEA,QAAI,QAAQ,UAAU;AACpB,WAAK,YAAY,QAAQ,QAAQ;AAAA,IACnC;AAEA,SAAK,UAAU,KAAK,CAAC,QAAgB,MAAuB,YAAiB;AAC3E,WAAK,UAAU,MAAM,CAAC,OAAO,WAAW,OAAO,GAAG,EAAE,QAAQ,OAAO,CAAC;AAAA,IACtE,CAAC;AAAA,EACH;AAAA,EAEO,OAAO,QAAgB,UAAe,CAAC,GAAG;AAC/C,UAAM,SAAS,IAAI,OAAO;AAE1B,WAAO,YAAY;AACnB,WAAO,YAAY,OAAO;AAE1B,QAAI,QAAQ,MAAM;AAChB,aAAO,OAAO,QAAQ;AAAA,IACxB;AAEA,SAAK,MAAM,QAAQ,IAAI,OAAO,WAAW,MAAM;AAAA,EACjD;AAAA,EAEA,MAAa,QAAQ,QAAgB,MAAc;AACjD,QAAI,KAAK,wBAAwB,GAAG;AAClC,YAAM,SAAS,KAAK,MAAM,QAAQ,IAAI,OAAO,SAAS;AACtD,aAAO,YAAY;AAEnB,UAAI;AACF,YAAI,SAAS,8BAAU,WAAW;AAChC,gBAAM,IAAI,MAAM,iBAAiB;AAAA,QACnC;AAEA,cAAM,KAAK,kBAAkB,QAAQ,KAAK,qBAAqB;AAC/D,eAAO,YAAY;AAAA,MAErB,SAAS,GAAG;AACV,aAAK,MAAM,QAAQ,OAAO,OAAO,SAAS;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AAEF;",
   "names": []
 }

package/build/rooms/RelayRoom.d.ts

@@ -1,14 +1,30 @@
-import { MapSchema, Schema } from '@colyseus/schema';
+import { type SchemaType } from '@colyseus/schema';
 import { Room } from '../Room.ts';
 import type { Client } from '../Transport.ts';
-declare class Player extends Schema {
-    connected: boolean;
-    name: string;
-    sessionId: string;
-}
-declare class State extends Schema {
-    players: MapSchema<Player, string>;
-}
+export declare const Player: import("@colyseus/schema").SchemaWithExtendsConstructor<{
+    connected: import("@colyseus/schema").FieldBuilder<boolean, false, false>;
+    name: import("@colyseus/schema").FieldBuilder<string, false, false>;
+    sessionId: import("@colyseus/schema").FieldBuilder<string, false, false>;
+}, import("@colyseus/schema").BuilderInitProps<{
+    connected: import("@colyseus/schema").FieldBuilder<boolean, false, false>;
+    name: import("@colyseus/schema").FieldBuilder<string, false, false>;
+    sessionId: import("@colyseus/schema").FieldBuilder<string, false, false>;
+}>, typeof import("@colyseus/schema").Schema>;
+export type Player = SchemaType<typeof Player>;
+export declare const State: import("@colyseus/schema").SchemaWithExtendsConstructor<{
+    players: import("@colyseus/schema").FieldBuilder<import("@colyseus/schema").MapSchema<{} & {
+        sessionId?: string;
+        name?: string;
+        connected?: boolean;
+    } & import("@colyseus/schema").Schema<any> & import("@colyseus/schema").Schema<unknown>, string>, true, false>;
+}, import("@colyseus/schema").BuilderInitProps<{
+    players: import("@colyseus/schema").FieldBuilder<import("@colyseus/schema").MapSchema<{} & {
+        sessionId?: string;
+        name?: string;
+        connected?: boolean;
+    } & import("@colyseus/schema").Schema<any> & import("@colyseus/schema").Schema<unknown>, string>, true, false>;
+}>, typeof import("@colyseus/schema").Schema>;
+export type State = SchemaType<typeof State>;
 /**
  * client.joinOrCreate("relayroom", {
  *   maxClients: 10,
@@ -16,7 +32,13 @@ declare class State extends Schema {
  * });
  */
 export declare class RelayRoom extends Room {
-    state: State;
+    state: {} & {
+        players?: import("@colyseus/schema").MapSchema<{} & {
+            sessionId?: string;
+            name?: string;
+            connected?: boolean;
+        } & import("@colyseus/schema").Schema<any> & import("@colyseus/schema").Schema<unknown>, string>;
+    } & import("@colyseus/schema").Schema<any> & import("@colyseus/schema").Schema<unknown>;
     allowReconnectionTime: number;
     onCreate(options: Partial<{
         maxClients: number;
@@ -26,4 +48,3 @@ export declare class RelayRoom extends Room {
     onJoin(client: Client, options?: any): void;
     onLeave(client: Client, code: number): Promise<void>;
 }
-export {};

package/build/rooms/RelayRoom.mjs

@@ -1,22 +1,14 @@
 // packages/core/src/rooms/RelayRoom.ts
 import { CloseCode } from "@colyseus/shared-types";
-import { defineTypes, MapSchema, Schema } from "@colyseus/schema";
+import { schema, t } from "@colyseus/schema";
 import { Room } from "../Room.mjs";
-var Player = class extends Schema {
-};
-defineTypes(Player, {
-  connected: "boolean",
-  name: "string",
-  sessionId: "string"
+var Player = schema({
+  connected: t.boolean(),
+  name: t.string(),
+  sessionId: t.string()
 });
-var State = class extends Schema {
-  constructor() {
-    super(...arguments);
-    this.players = new MapSchema();
-  }
-};
-defineTypes(State, {
-  players: { map: Player }
+var State = schema({
+  players: t.map(Player)
 });
 var RelayRoom = class extends Room {
   constructor() {
@@ -64,5 +56,7 @@ var RelayRoom = class extends Room {
   }
 };
 export {
-  RelayRoom
+  Player,
+  RelayRoom,
+  State
 };

package/build/rooms/RelayRoom.mjs.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/rooms/RelayRoom.ts"],
-  "sourcesContent": ["import { CloseCode } from '@colyseus/shared-types';\nimport { defineTypes, MapSchema, Schema } from '@colyseus/schema';\n\nimport { Room } from '../Room.ts';\nimport type { Client } from '../Transport.ts';\n\nclass Player extends Schema {\n  public connected: boolean;\n  public name: string;\n  public sessionId: string;\n}\ndefineTypes(Player, {\n  connected: 'boolean',\n  name: 'string',\n  sessionId: 'string',\n});\n\nclass State extends Schema {\n  public players = new MapSchema<Player>();\n}\ndefineTypes(State, {\n  players: { map: Player },\n});\n\n/**\n * client.joinOrCreate(\"relayroom\", {\n *   maxClients: 10,\n *   allowReconnectionTime: 20\n * });\n */\n\nexport class RelayRoom extends Room {\n  public state = new State();\n  public allowReconnectionTime: number = 0;\n\n  public onCreate(options: Partial<{\n    maxClients: number,\n    allowReconnectionTime: number,\n    metadata: any,\n  }>) {\n    if (options.maxClients) {\n      this.maxClients = options.maxClients;\n    }\n\n    if (options.allowReconnectionTime) {\n      this.allowReconnectionTime = Math.min(options.allowReconnectionTime, 40);\n    }\n\n    if (options.metadata) {\n      this.setMetadata(options.metadata);\n    }\n\n    this.onMessage('*', (client: Client, type: string | number, message: any) => {\n      this.broadcast(type, [client.sessionId, message], { except: client });\n    });\n  }\n\n  public onJoin(client: Client, options: any = {}) {\n    const player = new Player();\n\n    player.connected = true;\n    player.sessionId = client.sessionId;\n\n    if (options.name) {\n      player.name = options.name;\n    }\n\n    this.state.players.set(client.sessionId, player);\n  }\n\n  public async onLeave(client: Client, code: number) {\n    if (this.allowReconnectionTime > 0) {\n      const player = this.state.players.get(client.sessionId);\n      player.connected = false;\n\n      try {\n        if (code === CloseCode.CONSENTED) {\n          throw new Error('consented leave');\n        }\n\n        await this.allowReconnection(client, this.allowReconnectionTime);\n        player.connected = true;\n\n      } catch (e) {\n        this.state.players.delete(client.sessionId);\n      }\n    }\n  }\n\n}\n"],
-  "mappings": ";AAAA,SAAS,iBAAiB;AAC1B,SAAS,aAAa,WAAW,cAAc;AAE/C,SAAS,YAAY;AAGrB,IAAM,SAAN,cAAqB,OAAO;AAI5B;AACA,YAAY,QAAQ;AAAA,EAClB,WAAW;AAAA,EACX,MAAM;AAAA,EACN,WAAW;AACb,CAAC;AAED,IAAM,QAAN,cAAoB,OAAO;AAAA,EAA3B;AAAA;AACE,SAAO,UAAU,IAAI,UAAkB;AAAA;AACzC;AACA,YAAY,OAAO;AAAA,EACjB,SAAS,EAAE,KAAK,OAAO;AACzB,CAAC;AASM,IAAM,YAAN,cAAwB,KAAK;AAAA,EAA7B;AAAA;AACL,SAAO,QAAQ,IAAI,MAAM;AACzB,SAAO,wBAAgC;AAAA;AAAA,EAEhC,SAAS,SAIZ;AACF,QAAI,QAAQ,YAAY;AACtB,WAAK,aAAa,QAAQ;AAAA,IAC5B;AAEA,QAAI,QAAQ,uBAAuB;AACjC,WAAK,wBAAwB,KAAK,IAAI,QAAQ,uBAAuB,EAAE;AAAA,IACzE;AAEA,QAAI,QAAQ,UAAU;AACpB,WAAK,YAAY,QAAQ,QAAQ;AAAA,IACnC;AAEA,SAAK,UAAU,KAAK,CAAC,QAAgB,MAAuB,YAAiB;AAC3E,WAAK,UAAU,MAAM,CAAC,OAAO,WAAW,OAAO,GAAG,EAAE,QAAQ,OAAO,CAAC;AAAA,IACtE,CAAC;AAAA,EACH;AAAA,EAEO,OAAO,QAAgB,UAAe,CAAC,GAAG;AAC/C,UAAM,SAAS,IAAI,OAAO;AAE1B,WAAO,YAAY;AACnB,WAAO,YAAY,OAAO;AAE1B,QAAI,QAAQ,MAAM;AAChB,aAAO,OAAO,QAAQ;AAAA,IACxB;AAEA,SAAK,MAAM,QAAQ,IAAI,OAAO,WAAW,MAAM;AAAA,EACjD;AAAA,EAEA,MAAa,QAAQ,QAAgB,MAAc;AACjD,QAAI,KAAK,wBAAwB,GAAG;AAClC,YAAM,SAAS,KAAK,MAAM,QAAQ,IAAI,OAAO,SAAS;AACtD,aAAO,YAAY;AAEnB,UAAI;AACF,YAAI,SAAS,UAAU,WAAW;AAChC,gBAAM,IAAI,MAAM,iBAAiB;AAAA,QACnC;AAEA,cAAM,KAAK,kBAAkB,QAAQ,KAAK,qBAAqB;AAC/D,eAAO,YAAY;AAAA,MAErB,SAAS,GAAG;AACV,aAAK,MAAM,QAAQ,OAAO,OAAO,SAAS;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AAEF;",
+  "sourcesContent": ["import { CloseCode } from '@colyseus/shared-types';\nimport { schema, t, type SchemaType } from '@colyseus/schema';\n\nimport { Room } from '../Room.ts';\nimport type { Client } from '../Transport.ts';\n\nexport const Player = schema({\n  connected: t.boolean(),\n  name: t.string(),\n  sessionId: t.string(),\n});\nexport type Player = SchemaType<typeof Player>;\n\nexport const State = schema({\n  players: t.map(Player),\n});\nexport type State = SchemaType<typeof State>;\n\n/**\n * client.joinOrCreate(\"relayroom\", {\n *   maxClients: 10,\n *   allowReconnectionTime: 20\n * });\n */\n\nexport class RelayRoom extends Room {\n  public state = new State();\n  public allowReconnectionTime: number = 0;\n\n  public onCreate(options: Partial<{\n    maxClients: number,\n    allowReconnectionTime: number,\n    metadata: any,\n  }>) {\n    if (options.maxClients) {\n      this.maxClients = options.maxClients;\n    }\n\n    if (options.allowReconnectionTime) {\n      this.allowReconnectionTime = Math.min(options.allowReconnectionTime, 40);\n    }\n\n    if (options.metadata) {\n      this.setMetadata(options.metadata);\n    }\n\n    this.onMessage('*', (client: Client, type: string | number, message: any) => {\n      this.broadcast(type, [client.sessionId, message], { except: client });\n    });\n  }\n\n  public onJoin(client: Client, options: any = {}) {\n    const player = new Player();\n\n    player.connected = true;\n    player.sessionId = client.sessionId;\n\n    if (options.name) {\n      player.name = options.name;\n    }\n\n    this.state.players.set(client.sessionId, player);\n  }\n\n  public async onLeave(client: Client, code: number) {\n    if (this.allowReconnectionTime > 0) {\n      const player = this.state.players.get(client.sessionId);\n      player.connected = false;\n\n      try {\n        if (code === CloseCode.CONSENTED) {\n          throw new Error('consented leave');\n        }\n\n        await this.allowReconnection(client, this.allowReconnectionTime);\n        player.connected = true;\n\n      } catch (e) {\n        this.state.players.delete(client.sessionId);\n      }\n    }\n  }\n\n}\n"],
+  "mappings": ";AAAA,SAAS,iBAAiB;AAC1B,SAAS,QAAQ,SAA0B;AAE3C,SAAS,YAAY;AAGd,IAAM,SAAS,OAAO;AAAA,EAC3B,WAAW,EAAE,QAAQ;AAAA,EACrB,MAAM,EAAE,OAAO;AAAA,EACf,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,QAAQ,OAAO;AAAA,EAC1B,SAAS,EAAE,IAAI,MAAM;AACvB,CAAC;AAUM,IAAM,YAAN,cAAwB,KAAK;AAAA,EAA7B;AAAA;AACL,SAAO,QAAQ,IAAI,MAAM;AACzB,SAAO,wBAAgC;AAAA;AAAA,EAEhC,SAAS,SAIZ;AACF,QAAI,QAAQ,YAAY;AACtB,WAAK,aAAa,QAAQ;AAAA,IAC5B;AAEA,QAAI,QAAQ,uBAAuB;AACjC,WAAK,wBAAwB,KAAK,IAAI,QAAQ,uBAAuB,EAAE;AAAA,IACzE;AAEA,QAAI,QAAQ,UAAU;AACpB,WAAK,YAAY,QAAQ,QAAQ;AAAA,IACnC;AAEA,SAAK,UAAU,KAAK,CAAC,QAAgB,MAAuB,YAAiB;AAC3E,WAAK,UAAU,MAAM,CAAC,OAAO,WAAW,OAAO,GAAG,EAAE,QAAQ,OAAO,CAAC;AAAA,IACtE,CAAC;AAAA,EACH;AAAA,EAEO,OAAO,QAAgB,UAAe,CAAC,GAAG;AAC/C,UAAM,SAAS,IAAI,OAAO;AAE1B,WAAO,YAAY;AACnB,WAAO,YAAY,OAAO;AAE1B,QAAI,QAAQ,MAAM;AAChB,aAAO,OAAO,QAAQ;AAAA,IACxB;AAEA,SAAK,MAAM,QAAQ,IAAI,OAAO,WAAW,MAAM;AAAA,EACjD;AAAA,EAEA,MAAa,QAAQ,QAAgB,MAAc;AACjD,QAAI,KAAK,wBAAwB,GAAG;AAClC,YAAM,SAAS,KAAK,MAAM,QAAQ,IAAI,OAAO,SAAS;AACtD,aAAO,YAAY;AAEnB,UAAI;AACF,YAAI,SAAS,UAAU,WAAW;AAChC,gBAAM,IAAI,MAAM,iBAAiB;AAAA,QACnC;AAEA,cAAM,KAAK,kBAAkB,QAAQ,KAAK,qBAAqB;AAC/D,eAAO,YAAY;AAAA,MAErB,SAAS,GAAG;AACV,aAAK,MAAM,QAAQ,OAAO,OAAO,SAAS;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AAEF;",
   "names": []
 }

package/build/router/default_routes.cjs

@@ -62,6 +62,9 @@ var postMatchmakeMethod = (0, import_better_call.createEndpoint)("/matchmake/:me
     if (transport.protocol !== void 0) {
       response.protocol = transport.protocol;
     }
+    if (transport.fingerprint !== void 0) {
+      response.fingerprint = transport.fingerprint;
+    }
     const json = JSON.stringify(response);
     return new Response(json, {
       headers: {
@@ -78,7 +81,7 @@ var postMatchmakeMethod = (0, import_better_call.createEndpoint)("/matchmake/:me
   }
 });
 function getDefaultRouter() {
-  return (0, import_better_call.createRouter)({ postMatchmakeMethod });
+  return (0, import_better_call.createRouter)({ postMatchmakeMethod }, { openapi: { disabled: true } });
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/build/router/default_routes.cjs.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/router/default_routes.ts"],
-  "sourcesContent": ["import { createEndpoint, createRouter } from \"@colyseus/better-call\";\nimport * as matchMaker from \"../MatchMaker.ts\";\nimport { getBearerToken } from \"../utils/Utils.ts\";\nimport { getTransport } from \"../Transport.ts\";\n\nexport const postMatchmakeMethod = createEndpoint(\"/matchmake/:method/:roomName\", { method: \"POST\" }, async (ctx) => {\n  // do not accept matchmaking requests if already shutting down\n  if (matchMaker.state === matchMaker.MatchMakerState.SHUTTING_DOWN) {\n    throw ctx.error(503);\n  }\n\n  const requestHeaders = ctx.request.headers;\n\n  const method = ctx.params.method;\n  const roomName = ctx.params.roomName;\n\n  try {\n    const clientOptions = ctx.body;\n    const response = await matchMaker.controller.invokeMethod(\n      method,\n      roomName,\n      clientOptions,\n      {\n        token: getBearerToken(ctx.request.headers.get('authorization')),\n        headers: ctx.request.headers,\n        ip: requestHeaders.get('x-forwarded-for') ?? requestHeaders.get('x-client-ip') ?? requestHeaders.get('x-real-ip'),\n        req: ctx.request as any,\n      },\n    );\n\n    //\n    // TODO: refactor here.\n    // expose protocol, if available.\n    //\n    const transport = getTransport();\n    if (transport.protocol !== undefined) {\n      response.protocol = transport.protocol;\n    }\n\n    const json = JSON.stringify(response);\n\n    return new Response(json, {\n      headers: {\n        'content-type': 'application/json',\n        //\n        // Set content length manually to avoid \"chunked\" transfer-encoding header\n        // See https://github.com/haxetink/tink_http/issues/27\n        //\n        'content-length': json.length.toString(),\n      },\n    }) as any;\n\n  } catch (e: any) {\n    throw ctx.error(e.code, { code: e.code, error: e.message, });\n  }\n\n});\n\nexport function getDefaultRouter() {\n  return createRouter({ postMatchmakeMethod });\n}"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,yBAA6C;AAC7C,iBAA4B;AAC5B,mBAA+B;AAC/B,uBAA6B;AAEtB,IAAM,0BAAsB,mCAAe,gCAAgC,EAAE,QAAQ,OAAO,GAAG,OAAO,QAAQ;AAEnH,MAAe,qBAAqB,2BAAgB,eAAe;AACjE,UAAM,IAAI,MAAM,GAAG;AAAA,EACrB;AAEA,QAAM,iBAAiB,IAAI,QAAQ;AAEnC,QAAM,SAAS,IAAI,OAAO;AAC1B,QAAM,WAAW,IAAI,OAAO;AAE5B,MAAI;AACF,UAAM,gBAAgB,IAAI;AAC1B,UAAM,WAAW,MAAiB,sBAAW;AAAA,MAC3C;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,QACE,WAAO,6BAAe,IAAI,QAAQ,QAAQ,IAAI,eAAe,CAAC;AAAA,QAC9D,SAAS,IAAI,QAAQ;AAAA,QACrB,IAAI,eAAe,IAAI,iBAAiB,KAAK,eAAe,IAAI,aAAa,KAAK,eAAe,IAAI,WAAW;AAAA,QAChH,KAAK,IAAI;AAAA,MACX;AAAA,IACF;AAMA,UAAM,gBAAY,+BAAa;AAC/B,QAAI,UAAU,aAAa,QAAW;AACpC,eAAS,WAAW,UAAU;AAAA,IAChC;AAEA,UAAM,OAAO,KAAK,UAAU,QAAQ;AAEpC,WAAO,IAAI,SAAS,MAAM;AAAA,MACxB,SAAS;AAAA,QACP,gBAAgB;AAAA;AAAA;AAAA;AAAA;AAAA,QAKhB,kBAAkB,KAAK,OAAO,SAAS;AAAA,MACzC;AAAA,IACF,CAAC;AAAA,EAEH,SAAS,GAAQ;AACf,UAAM,IAAI,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,OAAO,EAAE,QAAS,CAAC;AAAA,EAC7D;AAEF,CAAC;AAEM,SAAS,mBAAmB;AACjC,aAAO,iCAAa,EAAE,oBAAoB,CAAC;AAC7C;",
+  "sourcesContent": ["import { createEndpoint, createRouter } from \"@colyseus/better-call\";\nimport * as matchMaker from \"../MatchMaker.ts\";\nimport { getBearerToken } from \"../utils/Utils.ts\";\nimport { getTransport } from \"../Transport.ts\";\n\nexport const postMatchmakeMethod = createEndpoint(\"/matchmake/:method/:roomName\", { method: \"POST\" }, async (ctx) => {\n  // do not accept matchmaking requests if already shutting down\n  if (matchMaker.state === matchMaker.MatchMakerState.SHUTTING_DOWN) {\n    throw ctx.error(503);\n  }\n\n  const requestHeaders = ctx.request.headers;\n\n  const method = ctx.params.method;\n  const roomName = ctx.params.roomName;\n\n  try {\n    const clientOptions = ctx.body;\n    const response = await matchMaker.controller.invokeMethod(\n      method,\n      roomName,\n      clientOptions,\n      {\n        token: getBearerToken(ctx.request.headers.get('authorization')),\n        headers: ctx.request.headers,\n        ip: requestHeaders.get('x-forwarded-for') ?? requestHeaders.get('x-client-ip') ?? requestHeaders.get('x-real-ip'),\n        req: ctx.request as any,\n      },\n    );\n\n    //\n    // TODO: refactor here.\n    // expose protocol, if available.\n    //\n    const transport = getTransport();\n    if (transport.protocol !== undefined) {\n      response.protocol = transport.protocol;\n    }\n    // WebTransport (h3): client pins the self-signed cert via serverCertificateHashes.\n    if (transport.fingerprint !== undefined) {\n      response.fingerprint = transport.fingerprint;\n    }\n\n    const json = JSON.stringify(response);\n\n    return new Response(json, {\n      headers: {\n        'content-type': 'application/json',\n        //\n        // Set content length manually to avoid \"chunked\" transfer-encoding header\n        // See https://github.com/haxetink/tink_http/issues/27\n        //\n        'content-length': json.length.toString(),\n      },\n    }) as any;\n\n  } catch (e: any) {\n    throw ctx.error(e.code, { code: e.code, error: e.message, });\n  }\n\n});\n\nexport function getDefaultRouter() {\n  // no public docs page \u2014 the docs surface is playground's gated /__apidocs\n  return createRouter({ postMatchmakeMethod }, { openapi: { disabled: true } });\n}"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,yBAA6C;AAC7C,iBAA4B;AAC5B,mBAA+B;AAC/B,uBAA6B;AAEtB,IAAM,0BAAsB,mCAAe,gCAAgC,EAAE,QAAQ,OAAO,GAAG,OAAO,QAAQ;AAEnH,MAAe,qBAAqB,2BAAgB,eAAe;AACjE,UAAM,IAAI,MAAM,GAAG;AAAA,EACrB;AAEA,QAAM,iBAAiB,IAAI,QAAQ;AAEnC,QAAM,SAAS,IAAI,OAAO;AAC1B,QAAM,WAAW,IAAI,OAAO;AAE5B,MAAI;AACF,UAAM,gBAAgB,IAAI;AAC1B,UAAM,WAAW,MAAiB,sBAAW;AAAA,MAC3C;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,QACE,WAAO,6BAAe,IAAI,QAAQ,QAAQ,IAAI,eAAe,CAAC;AAAA,QAC9D,SAAS,IAAI,QAAQ;AAAA,QACrB,IAAI,eAAe,IAAI,iBAAiB,KAAK,eAAe,IAAI,aAAa,KAAK,eAAe,IAAI,WAAW;AAAA,QAChH,KAAK,IAAI;AAAA,MACX;AAAA,IACF;AAMA,UAAM,gBAAY,+BAAa;AAC/B,QAAI,UAAU,aAAa,QAAW;AACpC,eAAS,WAAW,UAAU;AAAA,IAChC;AAEA,QAAI,UAAU,gBAAgB,QAAW;AACvC,eAAS,cAAc,UAAU;AAAA,IACnC;AAEA,UAAM,OAAO,KAAK,UAAU,QAAQ;AAEpC,WAAO,IAAI,SAAS,MAAM;AAAA,MACxB,SAAS;AAAA,QACP,gBAAgB;AAAA;AAAA;AAAA;AAAA;AAAA,QAKhB,kBAAkB,KAAK,OAAO,SAAS;AAAA,MACzC;AAAA,IACF,CAAC;AAAA,EAEH,SAAS,GAAQ;AACf,UAAM,IAAI,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,OAAO,EAAE,QAAS,CAAC;AAAA,EAC7D;AAEF,CAAC;AAEM,SAAS,mBAAmB;AAEjC,aAAO,iCAAa,EAAE,oBAAoB,GAAG,EAAE,SAAS,EAAE,UAAU,KAAK,EAAE,CAAC;AAC9E;",
   "names": []
 }

package/build/router/default_routes.mjs

@@ -27,6 +27,9 @@ var postMatchmakeMethod = createEndpoint("/matchmake/:method/:roomName", { metho
     if (transport.protocol !== void 0) {
       response.protocol = transport.protocol;
     }
+    if (transport.fingerprint !== void 0) {
+      response.fingerprint = transport.fingerprint;
+    }
     const json = JSON.stringify(response);
     return new Response(json, {
       headers: {
@@ -43,7 +46,7 @@ var postMatchmakeMethod = createEndpoint("/matchmake/:method/:roomName", { metho
   }
 });
 function getDefaultRouter() {
-  return createRouter({ postMatchmakeMethod });
+  return createRouter({ postMatchmakeMethod }, { openapi: { disabled: true } });
 }
 export {
   getDefaultRouter,

package/build/router/default_routes.mjs.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/router/default_routes.ts"],
-  "sourcesContent": ["import { createEndpoint, createRouter } from \"@colyseus/better-call\";\nimport * as matchMaker from \"../MatchMaker.ts\";\nimport { getBearerToken } from \"../utils/Utils.ts\";\nimport { getTransport } from \"../Transport.ts\";\n\nexport const postMatchmakeMethod = createEndpoint(\"/matchmake/:method/:roomName\", { method: \"POST\" }, async (ctx) => {\n  // do not accept matchmaking requests if already shutting down\n  if (matchMaker.state === matchMaker.MatchMakerState.SHUTTING_DOWN) {\n    throw ctx.error(503);\n  }\n\n  const requestHeaders = ctx.request.headers;\n\n  const method = ctx.params.method;\n  const roomName = ctx.params.roomName;\n\n  try {\n    const clientOptions = ctx.body;\n    const response = await matchMaker.controller.invokeMethod(\n      method,\n      roomName,\n      clientOptions,\n      {\n        token: getBearerToken(ctx.request.headers.get('authorization')),\n        headers: ctx.request.headers,\n        ip: requestHeaders.get('x-forwarded-for') ?? requestHeaders.get('x-client-ip') ?? requestHeaders.get('x-real-ip'),\n        req: ctx.request as any,\n      },\n    );\n\n    //\n    // TODO: refactor here.\n    // expose protocol, if available.\n    //\n    const transport = getTransport();\n    if (transport.protocol !== undefined) {\n      response.protocol = transport.protocol;\n    }\n\n    const json = JSON.stringify(response);\n\n    return new Response(json, {\n      headers: {\n        'content-type': 'application/json',\n        //\n        // Set content length manually to avoid \"chunked\" transfer-encoding header\n        // See https://github.com/haxetink/tink_http/issues/27\n        //\n        'content-length': json.length.toString(),\n      },\n    }) as any;\n\n  } catch (e: any) {\n    throw ctx.error(e.code, { code: e.code, error: e.message, });\n  }\n\n});\n\nexport function getDefaultRouter() {\n  return createRouter({ postMatchmakeMethod });\n}"],
-  "mappings": ";AAAA,SAAS,gBAAgB,oBAAoB;AAC7C,YAAY,gBAAgB;AAC5B,SAAS,sBAAsB;AAC/B,SAAS,oBAAoB;AAEtB,IAAM,sBAAsB,eAAe,gCAAgC,EAAE,QAAQ,OAAO,GAAG,OAAO,QAAQ;AAEnH,MAAe,qBAAqB,2BAAgB,eAAe;AACjE,UAAM,IAAI,MAAM,GAAG;AAAA,EACrB;AAEA,QAAM,iBAAiB,IAAI,QAAQ;AAEnC,QAAM,SAAS,IAAI,OAAO;AAC1B,QAAM,WAAW,IAAI,OAAO;AAE5B,MAAI;AACF,UAAM,gBAAgB,IAAI;AAC1B,UAAM,WAAW,MAAiB,sBAAW;AAAA,MAC3C;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,QACE,OAAO,eAAe,IAAI,QAAQ,QAAQ,IAAI,eAAe,CAAC;AAAA,QAC9D,SAAS,IAAI,QAAQ;AAAA,QACrB,IAAI,eAAe,IAAI,iBAAiB,KAAK,eAAe,IAAI,aAAa,KAAK,eAAe,IAAI,WAAW;AAAA,QAChH,KAAK,IAAI;AAAA,MACX;AAAA,IACF;AAMA,UAAM,YAAY,aAAa;AAC/B,QAAI,UAAU,aAAa,QAAW;AACpC,eAAS,WAAW,UAAU;AAAA,IAChC;AAEA,UAAM,OAAO,KAAK,UAAU,QAAQ;AAEpC,WAAO,IAAI,SAAS,MAAM;AAAA,MACxB,SAAS;AAAA,QACP,gBAAgB;AAAA;AAAA;AAAA;AAAA;AAAA,QAKhB,kBAAkB,KAAK,OAAO,SAAS;AAAA,MACzC;AAAA,IACF,CAAC;AAAA,EAEH,SAAS,GAAQ;AACf,UAAM,IAAI,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,OAAO,EAAE,QAAS,CAAC;AAAA,EAC7D;AAEF,CAAC;AAEM,SAAS,mBAAmB;AACjC,SAAO,aAAa,EAAE,oBAAoB,CAAC;AAC7C;",
+  "sourcesContent": ["import { createEndpoint, createRouter } from \"@colyseus/better-call\";\nimport * as matchMaker from \"../MatchMaker.ts\";\nimport { getBearerToken } from \"../utils/Utils.ts\";\nimport { getTransport } from \"../Transport.ts\";\n\nexport const postMatchmakeMethod = createEndpoint(\"/matchmake/:method/:roomName\", { method: \"POST\" }, async (ctx) => {\n  // do not accept matchmaking requests if already shutting down\n  if (matchMaker.state === matchMaker.MatchMakerState.SHUTTING_DOWN) {\n    throw ctx.error(503);\n  }\n\n  const requestHeaders = ctx.request.headers;\n\n  const method = ctx.params.method;\n  const roomName = ctx.params.roomName;\n\n  try {\n    const clientOptions = ctx.body;\n    const response = await matchMaker.controller.invokeMethod(\n      method,\n      roomName,\n      clientOptions,\n      {\n        token: getBearerToken(ctx.request.headers.get('authorization')),\n        headers: ctx.request.headers,\n        ip: requestHeaders.get('x-forwarded-for') ?? requestHeaders.get('x-client-ip') ?? requestHeaders.get('x-real-ip'),\n        req: ctx.request as any,\n      },\n    );\n\n    //\n    // TODO: refactor here.\n    // expose protocol, if available.\n    //\n    const transport = getTransport();\n    if (transport.protocol !== undefined) {\n      response.protocol = transport.protocol;\n    }\n    // WebTransport (h3): client pins the self-signed cert via serverCertificateHashes.\n    if (transport.fingerprint !== undefined) {\n      response.fingerprint = transport.fingerprint;\n    }\n\n    const json = JSON.stringify(response);\n\n    return new Response(json, {\n      headers: {\n        'content-type': 'application/json',\n        //\n        // Set content length manually to avoid \"chunked\" transfer-encoding header\n        // See https://github.com/haxetink/tink_http/issues/27\n        //\n        'content-length': json.length.toString(),\n      },\n    }) as any;\n\n  } catch (e: any) {\n    throw ctx.error(e.code, { code: e.code, error: e.message, });\n  }\n\n});\n\nexport function getDefaultRouter() {\n  // no public docs page \u2014 the docs surface is playground's gated /__apidocs\n  return createRouter({ postMatchmakeMethod }, { openapi: { disabled: true } });\n}"],
+  "mappings": ";AAAA,SAAS,gBAAgB,oBAAoB;AAC7C,YAAY,gBAAgB;AAC5B,SAAS,sBAAsB;AAC/B,SAAS,oBAAoB;AAEtB,IAAM,sBAAsB,eAAe,gCAAgC,EAAE,QAAQ,OAAO,GAAG,OAAO,QAAQ;AAEnH,MAAe,qBAAqB,2BAAgB,eAAe;AACjE,UAAM,IAAI,MAAM,GAAG;AAAA,EACrB;AAEA,QAAM,iBAAiB,IAAI,QAAQ;AAEnC,QAAM,SAAS,IAAI,OAAO;AAC1B,QAAM,WAAW,IAAI,OAAO;AAE5B,MAAI;AACF,UAAM,gBAAgB,IAAI;AAC1B,UAAM,WAAW,MAAiB,sBAAW;AAAA,MAC3C;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,QACE,OAAO,eAAe,IAAI,QAAQ,QAAQ,IAAI,eAAe,CAAC;AAAA,QAC9D,SAAS,IAAI,QAAQ;AAAA,QACrB,IAAI,eAAe,IAAI,iBAAiB,KAAK,eAAe,IAAI,aAAa,KAAK,eAAe,IAAI,WAAW;AAAA,QAChH,KAAK,IAAI;AAAA,MACX;AAAA,IACF;AAMA,UAAM,YAAY,aAAa;AAC/B,QAAI,UAAU,aAAa,QAAW;AACpC,eAAS,WAAW,UAAU;AAAA,IAChC;AAEA,QAAI,UAAU,gBAAgB,QAAW;AACvC,eAAS,cAAc,UAAU;AAAA,IACnC;AAEA,UAAM,OAAO,KAAK,UAAU,QAAQ;AAEpC,WAAO,IAAI,SAAS,MAAM;AAAA,MACxB,SAAS;AAAA,QACP,gBAAgB;AAAA;AAAA;AAAA;AAAA;AAAA,QAKhB,kBAAkB,KAAK,OAAO,SAAS;AAAA,MACzC;AAAA,IACF,CAAC;AAAA,EAEH,SAAS,GAAQ;AACf,UAAM,IAAI,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,OAAO,EAAE,QAAS,CAAC;AAAA,EAC7D;AAEF,CAAC;AAEM,SAAS,mBAAmB;AAEjC,SAAO,aAAa,EAAE,oBAAoB,GAAG,EAAE,SAAS,EAAE,UAAU,KAAK,EAAE,CAAC;AAC9E;",
   "names": []
 }

package/build/router/index.cjs

@@ -30,15 +30,17 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // packages/core/src/router/index.ts
 var router_exports = {};
 __export(router_exports, {
-  __globalEndpoints: () => __globalEndpoints,
+  basicAuth: () => basicAuth,
   bindRouterToTransport: () => bindRouterToTransport,
   createEndpoint: () => import_better_call2.createEndpoint,
   createInternalContext: () => import_better_call2.createInternalContext,
   createMiddleware: () => import_better_call2.createMiddleware,
   createRouter: () => createRouter,
+  dualModeEndpoints: () => dualModeEndpoints,
   toNodeHandler: () => import_node.toNodeHandler
 });
 module.exports = __toCommonJS(router_exports);
+var import_node_crypto = require("node:crypto");
 var import_better_call = require("@colyseus/better-call");
 var import_node = require("@colyseus/better-call/node");
 var import_Transport = require("../Transport.cjs");
@@ -104,18 +106,82 @@ function expressRootRoute(expressApp) {
   }
   return stack.find((layer) => layer.match("/") && !["query", "expressInit"].includes(layer.name));
 }
-var __globalEndpoints = {};
 function createRouter(endpoints, config = {}) {
-  __globalEndpoints = endpoints;
-  return (0, import_better_call.createRouter)({ ...endpoints }, config);
+  return (0, import_better_call.createRouter)({ ...endpoints }, {
+    // better-call's /api/reference page dumps the full API surface
+    // unauthenticated — opt back in by passing `openapi` explicitly.
+    openapi: { disabled: true },
+    ...config
+  });
+}
+function basicAuth(opts) {
+  const { users, validate } = opts;
+  if (!users && !validate) {
+    throw new Error("[basicAuth] provide `users` or `validate`");
+  }
+  const challenge = `Basic realm="${(opts.realm ?? "Restricted").replace(/"/g, "")}", charset="UTF-8"`;
+  return (0, import_better_call.createMiddleware)(async (ctx) => {
+    const creds = parseBasicHeader(ctx.getHeader("authorization"));
+    const ok = !!creds && (validate ? await validate(creds.username, creds.password) : staticCheck(users, creds.username, creds.password));
+    if (!ok) {
+      throw new import_better_call.APIError(401, { message: "authentication required" }, { "WWW-Authenticate": challenge });
+    }
+  });
+}
+function parseBasicHeader(header) {
+  if (!header) {
+    return null;
+  }
+  const sep = header.indexOf(" ");
+  if (sep < 0 || header.slice(0, sep).toLowerCase() !== "basic") {
+    return null;
+  }
+  let decoded;
+  try {
+    decoded = Buffer.from(header.slice(sep + 1), "base64").toString("utf8");
+  } catch {
+    return null;
+  }
+  const colon = decoded.indexOf(":");
+  if (colon < 0) {
+    return null;
+  }
+  return { username: decoded.slice(0, colon), password: decoded.slice(colon + 1) };
+}
+function staticCheck(users, username, password) {
+  const expected = Object.prototype.hasOwnProperty.call(users, username) ? users[username] : void 0;
+  return safeEqual(password, expected ?? "\0") && expected !== void 0;
+}
+function safeEqual(a, b) {
+  return (0, import_node_crypto.timingSafeEqual)(
+    (0, import_node_crypto.createHash)("sha256").update(a).digest(),
+    (0, import_node_crypto.createHash)("sha256").update(b).digest()
+  );
+}
+function dualModeEndpoints(endpoints, opts) {
+  const fullRouter = createRouter(endpoints);
+  const fullHandler = (0, import_node.toNodeHandler)(fullRouter.handler);
+  const specificEndpoints = opts.catchAllKey ? Object.fromEntries(
+    Object.entries(endpoints).filter(([k]) => k !== opts.catchAllKey)
+  ) : endpoints;
+  const specificRouter = createRouter(specificEndpoints);
+  const specificHandler = (0, import_node.toNodeHandler)(specificRouter.handler);
+  const middleware = opts.buildMiddleware({
+    specificRouter,
+    specificHandler,
+    fullRouter,
+    fullHandler
+  });
+  return Object.assign(middleware, endpoints);
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  __globalEndpoints,
+  basicAuth,
   bindRouterToTransport,
   createEndpoint,
   createInternalContext,
   createMiddleware,
   createRouter,
+  dualModeEndpoints,
   toNodeHandler
 });

package/build/router/index.cjs.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/router/index.ts"],
-  "sourcesContent": ["import type express from \"express\";\nimport type { IncomingMessage, ServerResponse } from \"http\";\nimport { type Endpoint, type Router, type RouterConfig, createRouter as createBetterCallRouter, createEndpoint } from \"@colyseus/better-call\";\nimport { toNodeHandler, getRequest, setResponse } from \"@colyseus/better-call/node\";\nimport { Transport } from \"../Transport.ts\";\nimport { controller } from \"../matchmaker/controller.ts\";\nimport pkg from \"../../package.json\" with { type: \"json\" };\n\nexport {\n  createEndpoint,\n  createMiddleware,\n  createInternalContext,\n\n  // Re-export types needed for declaration emit\n  type Router,\n  type RouterConfig,\n  type Endpoint,\n  type EndpointHandler,\n  type EndpointOptions,\n  type EndpointContext,\n  type StrictEndpoint,\n} from \"@colyseus/better-call\";\n\nexport { toNodeHandler };\n\nexport function bindRouterToTransport(transport: Transport, router: Router, useExpress: boolean) {\n  // add default \"/__healthcheck\" endpoint\n  router.addEndpoint(createEndpoint(\"/__healthcheck\", { method: \"GET\" }, async (ctx) => {\n    return new Response(\"OK\", { status: 200 });\n  }));\n\n  const server = transport.server;\n\n  // check if the server is bound to an express app\n  const expressApp: express.Application = (useExpress)\n    ? transport.getExpressApp() as express.Application\n    // fallback searching for express app in server listeners\n    : server?.listeners('request').find((listener: Function) => listener.name === \"app\" && listener['mountpath'] === '/') as express.Application;\n\n  // add default \"/\" route, if not provided.\n  const hasRootRoute = (\n    // check if express app has a root route\n    (expressApp && expressRootRoute(expressApp) !== undefined) ||\n\n    // check if router has a root route\n    Object.values(router.endpoints).some(endpoint => endpoint.path === \"/\")\n  );\n\n  if (!hasRootRoute) {\n    router.addEndpoint(createEndpoint(\"/\", { method: \"GET\" }, async (ctx) => {\n      return new Response(`Colyseus ${pkg.version}`, { status: 200 });\n    }));\n  }\n\n  // use custom bindRouter method if provided\n  if (!server && transport.bindRouter) {\n    transport.bindRouter(router);\n    return;\n  }\n\n  // which route handler to use\n  // (router + fallback to express, or just router)\n  let next: any;\n\n  if (expressApp) {\n    server.removeListener('request', expressApp);\n\n    next = async (req: IncomingMessage, res: ServerResponse) => {\n      // check if the route is defined in the router\n      // if so, use the router handler, otherwise fallback to express\n      if (router.findRoute(req.method, req.url.split('?')[0]) !== undefined) {\n        const protocol = req.headers[\"x-forwarded-proto\"] || ((req.socket as any).encrypted ? \"https\" : \"http\");\n        const base = `${protocol}://${req.headers[\":authority\"] || req.headers.host}`;\n        const response = await router.handler(getRequest({ base, request: req }));\n        return setResponse(res, response);\n\n      } else {\n        return expressApp['handle'](req, res);\n      }\n    };\n\n  } else {\n    next = toNodeHandler(router.handler);\n  }\n\n  // handle cors headers for all requests by default\n  server.prependListener('request', (req: IncomingMessage, res: ServerResponse) => {\n    const corsHeaders = {\n      ...controller.DEFAULT_CORS_HEADERS,\n      ...controller.getCorsHeaders(new Headers(req.headers as any)),\n    };\n\n    if (req.method === \"OPTIONS\") {\n      res.writeHead(204, corsHeaders);\n      res.end();\n      return;\n    }\n\n    Object.entries(corsHeaders).forEach(([key, value]) => {\n      res.setHeader(key, value);\n    });\n\n    next(req, res);\n  });\n}\n\nfunction expressRootRoute(expressApp: express.Application) {\n  //\n  // express v5 uses `app.router`, express v4 uses `app._router`\n  // check for `app._router` first, then `app.router`\n  //\n  // (express v4 will show a warning if `app.router` is used)\n  //\n  const stack = (expressApp as any)?._router?.stack ?? (expressApp as any)?.router?.stack;\n\n  if (!stack) {\n    return false;\n  }\n\n  return stack.find((layer: any) => layer.match('/') && !['query', 'expressInit'].includes(layer.name));\n}\n\n/**\n * Do not use this directly. This is used internally by `@colyseus/playground`.\n * TODO: refactor. Avoid using globals.\n * @internal\n */\nexport let __globalEndpoints: Record<string, Endpoint> = {};\n\nexport function createRouter<\n  E extends Record<string, Endpoint>,\n  Config extends RouterConfig\n>(endpoints: E, config: Config = {} as Config) {\n  // TODO: refactor. Avoid using globals.\n  __globalEndpoints = endpoints;\n\n  return createBetterCallRouter({ ...endpoints }, config);\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,yBAAsH;AACtH,kBAAuD;AACvD,uBAA0B;AAC1B,wBAA2B;AAC3B,qBAAgB;AAEhB,IAAAA,sBAaO;AAIA,SAAS,sBAAsB,WAAsB,QAAgB,YAAqB;AAE/F,SAAO,gBAAY,mCAAe,kBAAkB,EAAE,QAAQ,MAAM,GAAG,OAAO,QAAQ;AACpF,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3C,CAAC,CAAC;AAEF,QAAM,SAAS,UAAU;AAGzB,QAAM,aAAmC,aACrC,UAAU,cAAc,IAExB,QAAQ,UAAU,SAAS,EAAE,KAAK,CAAC,aAAuB,SAAS,SAAS,SAAS,SAAS,WAAW,MAAM,GAAG;AAGtH,QAAM;AAAA;AAAA,IAEH,cAAc,iBAAiB,UAAU,MAAM;AAAA,IAGhD,OAAO,OAAO,OAAO,SAAS,EAAE,KAAK,cAAY,SAAS,SAAS,GAAG;AAAA;AAGxE,MAAI,CAAC,cAAc;AACjB,WAAO,gBAAY,mCAAe,KAAK,EAAE,QAAQ,MAAM,GAAG,OAAO,QAAQ;AACvE,aAAO,IAAI,SAAS,YAAY,eAAAC,QAAI,OAAO,IAAI,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChE,CAAC,CAAC;AAAA,EACJ;AAGA,MAAI,CAAC,UAAU,UAAU,YAAY;AACnC,cAAU,WAAW,MAAM;AAC3B;AAAA,EACF;AAIA,MAAI;AAEJ,MAAI,YAAY;AACd,WAAO,eAAe,WAAW,UAAU;AAE3C,WAAO,OAAO,KAAsB,QAAwB;AAG1D,UAAI,OAAO,UAAU,IAAI,QAAQ,IAAI,IAAI,MAAM,GAAG,EAAE,CAAC,CAAC,MAAM,QAAW;AACrE,cAAM,WAAW,IAAI,QAAQ,mBAAmB,MAAO,IAAI,OAAe,YAAY,UAAU;AAChG,cAAM,OAAO,GAAG,QAAQ,MAAM,IAAI,QAAQ,YAAY,KAAK,IAAI,QAAQ,IAAI;AAC3E,cAAM,WAAW,MAAM,OAAO,YAAQ,wBAAW,EAAE,MAAM,SAAS,IAAI,CAAC,CAAC;AACxE,mBAAO,yBAAY,KAAK,QAAQ;AAAA,MAElC,OAAO;AACL,eAAO,WAAW,QAAQ,EAAE,KAAK,GAAG;AAAA,MACtC;AAAA,IACF;AAAA,EAEF,OAAO;AACL,eAAO,2BAAc,OAAO,OAAO;AAAA,EACrC;AAGA,SAAO,gBAAgB,WAAW,CAAC,KAAsB,QAAwB;AAC/E,UAAM,cAAc;AAAA,MAClB,GAAG,6BAAW;AAAA,MACd,GAAG,6BAAW,eAAe,IAAI,QAAQ,IAAI,OAAc,CAAC;AAAA,IAC9D;AAEA,QAAI,IAAI,WAAW,WAAW;AAC5B,UAAI,UAAU,KAAK,WAAW;AAC9B,UAAI,IAAI;AACR;AAAA,IACF;AAEA,WAAO,QAAQ,WAAW,EAAE,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM;AACpD,UAAI,UAAU,KAAK,KAAK;AAAA,IAC1B,CAAC;AAED,SAAK,KAAK,GAAG;AAAA,EACf,CAAC;AACH;AAEA,SAAS,iBAAiB,YAAiC;AAOzD,QAAM,QAAS,YAAoB,SAAS,SAAU,YAAoB,QAAQ;AAElF,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AAEA,SAAO,MAAM,KAAK,CAAC,UAAe,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,SAAS,aAAa,EAAE,SAAS,MAAM,IAAI,CAAC;AACtG;AAOO,IAAI,oBAA8C,CAAC;AAEnD,SAAS,aAGd,WAAc,SAAiB,CAAC,GAAa;AAE7C,sBAAoB;AAEpB,aAAO,mBAAAC,cAAuB,EAAE,GAAG,UAAU,GAAG,MAAM;AACxD;",
+  "sourcesContent": ["import type express from \"express\";\nimport type { IncomingMessage, ServerResponse } from \"http\";\nimport { createHash, timingSafeEqual } from \"node:crypto\";\nimport { type Endpoint, type Router, type RouterConfig, createRouter as createBetterCallRouter, createEndpoint, createMiddleware, APIError } from \"@colyseus/better-call\";\nimport { toNodeHandler, getRequest, setResponse } from \"@colyseus/better-call/node\";\nimport { Transport } from \"../Transport.ts\";\nimport { controller } from \"../matchmaker/controller.ts\";\nimport pkg from \"../../package.json\" with { type: \"json\" };\n\nexport {\n  createEndpoint,\n  createMiddleware,\n  createInternalContext,\n\n  // Re-export types needed for declaration emit\n  type Router,\n  type RouterConfig,\n  type Endpoint,\n  type EndpointHandler,\n  type EndpointOptions,\n  type EndpointContext,\n  type StrictEndpoint,\n} from \"@colyseus/better-call\";\n\nexport { toNodeHandler };\n\nexport function bindRouterToTransport(transport: Transport, router: Router, useExpress: boolean) {\n  // add default \"/__healthcheck\" endpoint\n  router.addEndpoint(createEndpoint(\"/__healthcheck\", { method: \"GET\" }, async (ctx) => {\n    return new Response(\"OK\", { status: 200 });\n  }));\n\n  const server = transport.server;\n\n  // check if the server is bound to an express app\n  const expressApp: express.Application = (useExpress)\n    ? transport.getExpressApp() as express.Application\n    // fallback searching for express app in server listeners\n    : server?.listeners('request').find((listener: Function) => listener.name === \"app\" && listener['mountpath'] === '/') as express.Application;\n\n  // add default \"/\" route, if not provided.\n  const hasRootRoute = (\n    // check if express app has a root route\n    (expressApp && expressRootRoute(expressApp) !== undefined) ||\n\n    // check if router has a root route\n    Object.values(router.endpoints).some(endpoint => endpoint.path === \"/\")\n  );\n\n  if (!hasRootRoute) {\n    router.addEndpoint(createEndpoint(\"/\", { method: \"GET\" }, async (ctx) => {\n      return new Response(`Colyseus ${pkg.version}`, { status: 200 });\n    }));\n  }\n\n  // use custom bindRouter method if provided\n  if (!server && transport.bindRouter) {\n    transport.bindRouter(router);\n    return;\n  }\n\n  // which route handler to use\n  // (router + fallback to express, or just router)\n  let next: any;\n\n  if (expressApp) {\n    server.removeListener('request', expressApp);\n\n    next = async (req: IncomingMessage, res: ServerResponse) => {\n      // check if the route is defined in the router\n      // if so, use the router handler, otherwise fallback to express\n      if (router.findRoute(req.method, req.url.split('?')[0]) !== undefined) {\n        const protocol = req.headers[\"x-forwarded-proto\"] || ((req.socket as any).encrypted ? \"https\" : \"http\");\n        const base = `${protocol}://${req.headers[\":authority\"] || req.headers.host}`;\n        const response = await router.handler(getRequest({ base, request: req }));\n        return setResponse(res, response);\n\n      } else {\n        return expressApp['handle'](req, res);\n      }\n    };\n\n  } else {\n    next = toNodeHandler(router.handler);\n  }\n\n  // handle cors headers for all requests by default\n  server.prependListener('request', (req: IncomingMessage, res: ServerResponse) => {\n    const corsHeaders = {\n      ...controller.DEFAULT_CORS_HEADERS,\n      ...controller.getCorsHeaders(new Headers(req.headers as any)),\n    };\n\n    if (req.method === \"OPTIONS\") {\n      res.writeHead(204, corsHeaders);\n      res.end();\n      return;\n    }\n\n    Object.entries(corsHeaders).forEach(([key, value]) => {\n      res.setHeader(key, value);\n    });\n\n    next(req, res);\n  });\n}\n\nfunction expressRootRoute(expressApp: express.Application) {\n  //\n  // express v5 uses `app.router`, express v4 uses `app._router`\n  // check for `app._router` first, then `app.router`\n  //\n  // (express v4 will show a warning if `app.router` is used)\n  //\n  const stack = (expressApp as any)?._router?.stack ?? (expressApp as any)?.router?.stack;\n\n  if (!stack) {\n    return false;\n  }\n\n  return stack.find((layer: any) => layer.match('/') && !['query', 'expressInit'].includes(layer.name));\n}\n\nexport function createRouter<\n  E extends Record<string, Endpoint>,\n  Config extends RouterConfig\n>(endpoints: E, config: Config = {} as Config) {\n  return createBetterCallRouter({ ...endpoints }, {\n    // better-call's /api/reference page dumps the full API surface\n    // unauthenticated \u2014 opt back in by passing `openapi` explicitly.\n    openapi: { disabled: true },\n    ...config,\n  });\n}\n\nexport interface BasicAuthOptions {\n  /** username \u2192 password. The common static case. */\n  users?: Record<string, string>;\n  /** Custom validator (e.g. DB-backed). Takes precedence over `users`. */\n  validate?: (username: string, password: string) => boolean | Promise<boolean>;\n  /** Realm shown in the browser prompt. Default 'Restricted'. */\n  realm?: string;\n}\n\n/**\n * HTTP Basic Auth middleware. Drop into any endpoint's `use:` slot to gate\n * it behind a browser credentials prompt:\n *\n *   playground({ use: [basicAuth({ users: { admin: 's3cret' } })] })\n */\nexport function basicAuth(opts: BasicAuthOptions) {\n  const { users, validate } = opts;\n  if (!users && !validate) {\n    throw new Error('[basicAuth] provide `users` or `validate`');\n  }\n  // Realm is interpolated into a header \u2014 strip `\"` so it can't break out.\n  const challenge = `Basic realm=\"${(opts.realm ?? 'Restricted').replace(/\"/g, '')}\", charset=\"UTF-8\"`;\n\n  return createMiddleware(async (ctx) => {\n    const creds = parseBasicHeader(ctx.getHeader('authorization'));\n    const ok = !!creds && (validate\n      ? await validate(creds.username, creds.password)\n      : staticCheck(users!, creds.username, creds.password));\n    if (!ok) {\n      throw new APIError(401, { message: 'authentication required' }, { 'WWW-Authenticate': challenge });\n    }\n  });\n}\n\nfunction parseBasicHeader(header: string | null | undefined) {\n  if (!header) { return null; }\n  const sep = header.indexOf(' ');\n  if (sep < 0 || header.slice(0, sep).toLowerCase() !== 'basic') { return null; }\n  let decoded: string;\n  try { decoded = Buffer.from(header.slice(sep + 1), 'base64').toString('utf8'); } catch { return null; }\n  const colon = decoded.indexOf(':');\n  if (colon < 0) { return null; }\n  return { username: decoded.slice(0, colon), password: decoded.slice(colon + 1) };\n}\n\nfunction staticCheck(users: Record<string, string>, username: string, password: string): boolean {\n  const expected = Object.prototype.hasOwnProperty.call(users, username) ? users[username] : undefined;\n  // Compare even for an unknown user so reject timing doesn't reveal which\n  // usernames exist.\n  return safeEqual(password, expected ?? '\\0') && expected !== undefined;\n}\n\n// Hash both sides first: equalizes length (timingSafeEqual throws on a\n// length mismatch, which would itself leak the secret's length).\nfunction safeEqual(a: string, b: string): boolean {\n  return timingSafeEqual(\n    createHash('sha256').update(a).digest(),\n    createHash('sha256').update(b).digest(),\n  );\n}\n\n// ---------------------------------------------------------------------------\n// dualModeEndpoints \u2014 shared express-compat layer for @colyseus/admin,\n// @colyseus/monitor, @colyseus/playground. Builds the two local routers\n// (specific = no catch-all, full = everything) and the matching node\n// handlers, then packages the express middleware so the return value works\n// both as `{...spread}` into createRouter AND as `app.use(\"/\", x)` middleware.\n// ---------------------------------------------------------------------------\n\nexport type ExpressMiddleware = (\n  req: IncomingMessage,\n  res: ServerResponse,\n  next: (err?: any) => void,\n) => void;\n\nexport type NodeHandler = (req: IncomingMessage, res: ServerResponse) => Promise<void>;\n\nexport interface DualModeHelpers {\n  specificRouter: Router;\n  specificHandler: NodeHandler;\n  fullRouter: Router;\n  fullHandler: NodeHandler;\n}\n\nexport function dualModeEndpoints<E extends Record<string, Endpoint>>(\n  endpoints: E,\n  opts: {\n    /** Key in `endpoints` whose path is a catch-all. Excluded from `specificRouter` so it doesn't eat fall-through decisions. */\n    catchAllKey?: keyof E;\n    /** Build the express middleware given the pre-built routers + node handlers. */\n    buildMiddleware: (helpers: DualModeHelpers) => ExpressMiddleware;\n  },\n): ExpressMiddleware & E {\n  const fullRouter = createRouter(endpoints);\n  const fullHandler = toNodeHandler(fullRouter.handler) as NodeHandler;\n\n  const specificEndpoints = opts.catchAllKey\n    ? Object.fromEntries(\n        Object.entries(endpoints).filter(([k]) => k !== opts.catchAllKey),\n      ) as Partial<E>\n    : endpoints;\n  const specificRouter = createRouter(specificEndpoints as E);\n  const specificHandler = toNodeHandler(specificRouter.handler) as NodeHandler;\n\n  const middleware = opts.buildMiddleware({\n    specificRouter, specificHandler, fullRouter, fullHandler,\n  });\n  return Object.assign(middleware, endpoints) as ExpressMiddleware & E;\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,yBAA4C;AAC5C,yBAAkJ;AAClJ,kBAAuD;AACvD,uBAA0B;AAC1B,wBAA2B;AAC3B,qBAAgB;AAEhB,IAAAA,sBAaO;AAIA,SAAS,sBAAsB,WAAsB,QAAgB,YAAqB;AAE/F,SAAO,gBAAY,mCAAe,kBAAkB,EAAE,QAAQ,MAAM,GAAG,OAAO,QAAQ;AACpF,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3C,CAAC,CAAC;AAEF,QAAM,SAAS,UAAU;AAGzB,QAAM,aAAmC,aACrC,UAAU,cAAc,IAExB,QAAQ,UAAU,SAAS,EAAE,KAAK,CAAC,aAAuB,SAAS,SAAS,SAAS,SAAS,WAAW,MAAM,GAAG;AAGtH,QAAM;AAAA;AAAA,IAEH,cAAc,iBAAiB,UAAU,MAAM;AAAA,IAGhD,OAAO,OAAO,OAAO,SAAS,EAAE,KAAK,cAAY,SAAS,SAAS,GAAG;AAAA;AAGxE,MAAI,CAAC,cAAc;AACjB,WAAO,gBAAY,mCAAe,KAAK,EAAE,QAAQ,MAAM,GAAG,OAAO,QAAQ;AACvE,aAAO,IAAI,SAAS,YAAY,eAAAC,QAAI,OAAO,IAAI,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChE,CAAC,CAAC;AAAA,EACJ;AAGA,MAAI,CAAC,UAAU,UAAU,YAAY;AACnC,cAAU,WAAW,MAAM;AAC3B;AAAA,EACF;AAIA,MAAI;AAEJ,MAAI,YAAY;AACd,WAAO,eAAe,WAAW,UAAU;AAE3C,WAAO,OAAO,KAAsB,QAAwB;AAG1D,UAAI,OAAO,UAAU,IAAI,QAAQ,IAAI,IAAI,MAAM,GAAG,EAAE,CAAC,CAAC,MAAM,QAAW;AACrE,cAAM,WAAW,IAAI,QAAQ,mBAAmB,MAAO,IAAI,OAAe,YAAY,UAAU;AAChG,cAAM,OAAO,GAAG,QAAQ,MAAM,IAAI,QAAQ,YAAY,KAAK,IAAI,QAAQ,IAAI;AAC3E,cAAM,WAAW,MAAM,OAAO,YAAQ,wBAAW,EAAE,MAAM,SAAS,IAAI,CAAC,CAAC;AACxE,mBAAO,yBAAY,KAAK,QAAQ;AAAA,MAElC,OAAO;AACL,eAAO,WAAW,QAAQ,EAAE,KAAK,GAAG;AAAA,MACtC;AAAA,IACF;AAAA,EAEF,OAAO;AACL,eAAO,2BAAc,OAAO,OAAO;AAAA,EACrC;AAGA,SAAO,gBAAgB,WAAW,CAAC,KAAsB,QAAwB;AAC/E,UAAM,cAAc;AAAA,MAClB,GAAG,6BAAW;AAAA,MACd,GAAG,6BAAW,eAAe,IAAI,QAAQ,IAAI,OAAc,CAAC;AAAA,IAC9D;AAEA,QAAI,IAAI,WAAW,WAAW;AAC5B,UAAI,UAAU,KAAK,WAAW;AAC9B,UAAI,IAAI;AACR;AAAA,IACF;AAEA,WAAO,QAAQ,WAAW,EAAE,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM;AACpD,UAAI,UAAU,KAAK,KAAK;AAAA,IAC1B,CAAC;AAED,SAAK,KAAK,GAAG;AAAA,EACf,CAAC;AACH;AAEA,SAAS,iBAAiB,YAAiC;AAOzD,QAAM,QAAS,YAAoB,SAAS,SAAU,YAAoB,QAAQ;AAElF,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AAEA,SAAO,MAAM,KAAK,CAAC,UAAe,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,SAAS,aAAa,EAAE,SAAS,MAAM,IAAI,CAAC;AACtG;AAEO,SAAS,aAGd,WAAc,SAAiB,CAAC,GAAa;AAC7C,aAAO,mBAAAC,cAAuB,EAAE,GAAG,UAAU,GAAG;AAAA;AAAA;AAAA,IAG9C,SAAS,EAAE,UAAU,KAAK;AAAA,IAC1B,GAAG;AAAA,EACL,CAAC;AACH;AAiBO,SAAS,UAAU,MAAwB;AAChD,QAAM,EAAE,OAAO,SAAS,IAAI;AAC5B,MAAI,CAAC,SAAS,CAAC,UAAU;AACvB,UAAM,IAAI,MAAM,2CAA2C;AAAA,EAC7D;AAEA,QAAM,YAAY,iBAAiB,KAAK,SAAS,cAAc,QAAQ,MAAM,EAAE,CAAC;AAEhF,aAAO,qCAAiB,OAAO,QAAQ;AACrC,UAAM,QAAQ,iBAAiB,IAAI,UAAU,eAAe,CAAC;AAC7D,UAAM,KAAK,CAAC,CAAC,UAAU,WACnB,MAAM,SAAS,MAAM,UAAU,MAAM,QAAQ,IAC7C,YAAY,OAAQ,MAAM,UAAU,MAAM,QAAQ;AACtD,QAAI,CAAC,IAAI;AACP,YAAM,IAAI,4BAAS,KAAK,EAAE,SAAS,0BAA0B,GAAG,EAAE,oBAAoB,UAAU,CAAC;AAAA,IACnG;AAAA,EACF,CAAC;AACH;AAEA,SAAS,iBAAiB,QAAmC;AAC3D,MAAI,CAAC,QAAQ;AAAE,WAAO;AAAA,EAAM;AAC5B,QAAM,MAAM,OAAO,QAAQ,GAAG;AAC9B,MAAI,MAAM,KAAK,OAAO,MAAM,GAAG,GAAG,EAAE,YAAY,MAAM,SAAS;AAAE,WAAO;AAAA,EAAM;AAC9E,MAAI;AACJ,MAAI;AAAE,cAAU,OAAO,KAAK,OAAO,MAAM,MAAM,CAAC,GAAG,QAAQ,EAAE,SAAS,MAAM;AAAA,EAAG,QAAQ;AAAE,WAAO;AAAA,EAAM;AACtG,QAAM,QAAQ,QAAQ,QAAQ,GAAG;AACjC,MAAI,QAAQ,GAAG;AAAE,WAAO;AAAA,EAAM;AAC9B,SAAO,EAAE,UAAU,QAAQ,MAAM,GAAG,KAAK,GAAG,UAAU,QAAQ,MAAM,QAAQ,CAAC,EAAE;AACjF;AAEA,SAAS,YAAY,OAA+B,UAAkB,UAA2B;AAC/F,QAAM,WAAW,OAAO,UAAU,eAAe,KAAK,OAAO,QAAQ,IAAI,MAAM,QAAQ,IAAI;AAG3F,SAAO,UAAU,UAAU,YAAY,IAAI,KAAK,aAAa;AAC/D;AAIA,SAAS,UAAU,GAAW,GAAoB;AAChD,aAAO;AAAA,QACL,+BAAW,QAAQ,EAAE,OAAO,CAAC,EAAE,OAAO;AAAA,QACtC,+BAAW,QAAQ,EAAE,OAAO,CAAC,EAAE,OAAO;AAAA,EACxC;AACF;AAyBO,SAAS,kBACd,WACA,MAMuB;AACvB,QAAM,aAAa,aAAa,SAAS;AACzC,QAAM,kBAAc,2BAAc,WAAW,OAAO;AAEpD,QAAM,oBAAoB,KAAK,cAC3B,OAAO;AAAA,IACL,OAAO,QAAQ,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,KAAK,WAAW;AAAA,EAClE,IACA;AACJ,QAAM,iBAAiB,aAAa,iBAAsB;AAC1D,QAAM,sBAAkB,2BAAc,eAAe,OAAO;AAE5D,QAAM,aAAa,KAAK,gBAAgB;AAAA,IACtC;AAAA,IAAgB;AAAA,IAAiB;AAAA,IAAY;AAAA,EAC/C,CAAC;AACD,SAAO,OAAO,OAAO,YAAY,SAAS;AAC5C;",
   "names": ["import_better_call", "pkg", "createBetterCallRouter"]
 }

package/build/router/index.d.ts

@@ -1,15 +1,10 @@
+import type { IncomingMessage, ServerResponse } from "http";
 import { type Endpoint, type Router, type RouterConfig } from "@colyseus/better-call";
 import { toNodeHandler } from "@colyseus/better-call/node";
 import { Transport } from "../Transport.ts";
 export { createEndpoint, createMiddleware, createInternalContext, type Router, type RouterConfig, type Endpoint, type EndpointHandler, type EndpointOptions, type EndpointContext, type StrictEndpoint, } from "@colyseus/better-call";
 export { toNodeHandler };
 export declare function bindRouterToTransport(transport: Transport, router: Router, useExpress: boolean): void;
-/**
- * Do not use this directly. This is used internally by `@colyseus/playground`.
- * TODO: refactor. Avoid using globals.
- * @internal
- */
-export declare let __globalEndpoints: Record<string, Endpoint>;
 export declare function createRouter<E extends Record<string, Endpoint>, Config extends RouterConfig>(endpoints: E, config?: Config): {
     handler: (request: Request) => Promise<Response>;
     endpoints: E;
@@ -162,3 +157,32 @@ export declare function createRouter<E extends Record<string, Endpoint>, Config
         };
     };
 };
+export interface BasicAuthOptions {
+    /** username → password. The common static case. */
+    users?: Record<string, string>;
+    /** Custom validator (e.g. DB-backed). Takes precedence over `users`. */
+    validate?: (username: string, password: string) => boolean | Promise<boolean>;
+    /** Realm shown in the browser prompt. Default 'Restricted'. */
+    realm?: string;
+}
+/**
+ * HTTP Basic Auth middleware. Drop into any endpoint's `use:` slot to gate
+ * it behind a browser credentials prompt:
+ *
+ *   playground({ use: [basicAuth({ users: { admin: 's3cret' } })] })
+ */
+export declare function basicAuth(opts: BasicAuthOptions): <InputCtx extends import("@colyseus/better-call").MiddlewareInputContext<import("@colyseus/better-call").MiddlewareOptions>>(inputContext: InputCtx) => Promise<void>;
+export type ExpressMiddleware = (req: IncomingMessage, res: ServerResponse, next: (err?: any) => void) => void;
+export type NodeHandler = (req: IncomingMessage, res: ServerResponse) => Promise<void>;
+export interface DualModeHelpers {
+    specificRouter: Router;
+    specificHandler: NodeHandler;
+    fullRouter: Router;
+    fullHandler: NodeHandler;
+}
+export declare function dualModeEndpoints<E extends Record<string, Endpoint>>(endpoints: E, opts: {
+    /** Key in `endpoints` whose path is a catch-all. Excluded from `specificRouter` so it doesn't eat fall-through decisions. */
+    catchAllKey?: keyof E;
+    /** Build the express middleware given the pre-built routers + node handlers. */
+    buildMiddleware: (helpers: DualModeHelpers) => ExpressMiddleware;
+}): ExpressMiddleware & E;

package/build/router/index.mjs

@@ -1,12 +1,13 @@
 // packages/core/src/router/index.ts
-import { createRouter as createBetterCallRouter, createEndpoint } from "@colyseus/better-call";
+import { createHash, timingSafeEqual } from "node:crypto";
+import { createRouter as createBetterCallRouter, createEndpoint, createMiddleware, APIError } from "@colyseus/better-call";
 import { toNodeHandler, getRequest, setResponse } from "@colyseus/better-call/node";
 import "../Transport.mjs";
 import { controller } from "../matchmaker/controller.mjs";
 import pkg from "../../package.json" with { type: "json" };
 import {
   createEndpoint as createEndpoint2,
-  createMiddleware,
+  createMiddleware as createMiddleware2,
   createInternalContext
 } from "@colyseus/better-call";
 function bindRouterToTransport(transport, router, useExpress) {
@@ -68,17 +69,81 @@ function expressRootRoute(expressApp) {
   }
   return stack.find((layer) => layer.match("/") && !["query", "expressInit"].includes(layer.name));
 }
-var __globalEndpoints = {};
 function createRouter(endpoints, config = {}) {
-  __globalEndpoints = endpoints;
-  return createBetterCallRouter({ ...endpoints }, config);
+  return createBetterCallRouter({ ...endpoints }, {
+    // better-call's /api/reference page dumps the full API surface
+    // unauthenticated — opt back in by passing `openapi` explicitly.
+    openapi: { disabled: true },
+    ...config
+  });
+}
+function basicAuth(opts) {
+  const { users, validate } = opts;
+  if (!users && !validate) {
+    throw new Error("[basicAuth] provide `users` or `validate`");
+  }
+  const challenge = `Basic realm="${(opts.realm ?? "Restricted").replace(/"/g, "")}", charset="UTF-8"`;
+  return createMiddleware(async (ctx) => {
+    const creds = parseBasicHeader(ctx.getHeader("authorization"));
+    const ok = !!creds && (validate ? await validate(creds.username, creds.password) : staticCheck(users, creds.username, creds.password));
+    if (!ok) {
+      throw new APIError(401, { message: "authentication required" }, { "WWW-Authenticate": challenge });
+    }
+  });
+}
+function parseBasicHeader(header) {
+  if (!header) {
+    return null;
+  }
+  const sep = header.indexOf(" ");
+  if (sep < 0 || header.slice(0, sep).toLowerCase() !== "basic") {
+    return null;
+  }
+  let decoded;
+  try {
+    decoded = Buffer.from(header.slice(sep + 1), "base64").toString("utf8");
+  } catch {
+    return null;
+  }
+  const colon = decoded.indexOf(":");
+  if (colon < 0) {
+    return null;
+  }
+  return { username: decoded.slice(0, colon), password: decoded.slice(colon + 1) };
+}
+function staticCheck(users, username, password) {
+  const expected = Object.prototype.hasOwnProperty.call(users, username) ? users[username] : void 0;
+  return safeEqual(password, expected ?? "\0") && expected !== void 0;
+}
+function safeEqual(a, b) {
+  return timingSafeEqual(
+    createHash("sha256").update(a).digest(),
+    createHash("sha256").update(b).digest()
+  );
+}
+function dualModeEndpoints(endpoints, opts) {
+  const fullRouter = createRouter(endpoints);
+  const fullHandler = toNodeHandler(fullRouter.handler);
+  const specificEndpoints = opts.catchAllKey ? Object.fromEntries(
+    Object.entries(endpoints).filter(([k]) => k !== opts.catchAllKey)
+  ) : endpoints;
+  const specificRouter = createRouter(specificEndpoints);
+  const specificHandler = toNodeHandler(specificRouter.handler);
+  const middleware = opts.buildMiddleware({
+    specificRouter,
+    specificHandler,
+    fullRouter,
+    fullHandler
+  });
+  return Object.assign(middleware, endpoints);
 }
 export {
-  __globalEndpoints,
+  basicAuth,
   bindRouterToTransport,
   createEndpoint2 as createEndpoint,
   createInternalContext,
-  createMiddleware,
+  createMiddleware2 as createMiddleware,
   createRouter,
+  dualModeEndpoints,
   toNodeHandler
 };

package/build/router/index.mjs.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/router/index.ts"],
-  "sourcesContent": ["import type express from \"express\";\nimport type { IncomingMessage, ServerResponse } from \"http\";\nimport { type Endpoint, type Router, type RouterConfig, createRouter as createBetterCallRouter, createEndpoint } from \"@colyseus/better-call\";\nimport { toNodeHandler, getRequest, setResponse } from \"@colyseus/better-call/node\";\nimport { Transport } from \"../Transport.ts\";\nimport { controller } from \"../matchmaker/controller.ts\";\nimport pkg from \"../../package.json\" with { type: \"json\" };\n\nexport {\n  createEndpoint,\n  createMiddleware,\n  createInternalContext,\n\n  // Re-export types needed for declaration emit\n  type Router,\n  type RouterConfig,\n  type Endpoint,\n  type EndpointHandler,\n  type EndpointOptions,\n  type EndpointContext,\n  type StrictEndpoint,\n} from \"@colyseus/better-call\";\n\nexport { toNodeHandler };\n\nexport function bindRouterToTransport(transport: Transport, router: Router, useExpress: boolean) {\n  // add default \"/__healthcheck\" endpoint\n  router.addEndpoint(createEndpoint(\"/__healthcheck\", { method: \"GET\" }, async (ctx) => {\n    return new Response(\"OK\", { status: 200 });\n  }));\n\n  const server = transport.server;\n\n  // check if the server is bound to an express app\n  const expressApp: express.Application = (useExpress)\n    ? transport.getExpressApp() as express.Application\n    // fallback searching for express app in server listeners\n    : server?.listeners('request').find((listener: Function) => listener.name === \"app\" && listener['mountpath'] === '/') as express.Application;\n\n  // add default \"/\" route, if not provided.\n  const hasRootRoute = (\n    // check if express app has a root route\n    (expressApp && expressRootRoute(expressApp) !== undefined) ||\n\n    // check if router has a root route\n    Object.values(router.endpoints).some(endpoint => endpoint.path === \"/\")\n  );\n\n  if (!hasRootRoute) {\n    router.addEndpoint(createEndpoint(\"/\", { method: \"GET\" }, async (ctx) => {\n      return new Response(`Colyseus ${pkg.version}`, { status: 200 });\n    }));\n  }\n\n  // use custom bindRouter method if provided\n  if (!server && transport.bindRouter) {\n    transport.bindRouter(router);\n    return;\n  }\n\n  // which route handler to use\n  // (router + fallback to express, or just router)\n  let next: any;\n\n  if (expressApp) {\n    server.removeListener('request', expressApp);\n\n    next = async (req: IncomingMessage, res: ServerResponse) => {\n      // check if the route is defined in the router\n      // if so, use the router handler, otherwise fallback to express\n      if (router.findRoute(req.method, req.url.split('?')[0]) !== undefined) {\n        const protocol = req.headers[\"x-forwarded-proto\"] || ((req.socket as any).encrypted ? \"https\" : \"http\");\n        const base = `${protocol}://${req.headers[\":authority\"] || req.headers.host}`;\n        const response = await router.handler(getRequest({ base, request: req }));\n        return setResponse(res, response);\n\n      } else {\n        return expressApp['handle'](req, res);\n      }\n    };\n\n  } else {\n    next = toNodeHandler(router.handler);\n  }\n\n  // handle cors headers for all requests by default\n  server.prependListener('request', (req: IncomingMessage, res: ServerResponse) => {\n    const corsHeaders = {\n      ...controller.DEFAULT_CORS_HEADERS,\n      ...controller.getCorsHeaders(new Headers(req.headers as any)),\n    };\n\n    if (req.method === \"OPTIONS\") {\n      res.writeHead(204, corsHeaders);\n      res.end();\n      return;\n    }\n\n    Object.entries(corsHeaders).forEach(([key, value]) => {\n      res.setHeader(key, value);\n    });\n\n    next(req, res);\n  });\n}\n\nfunction expressRootRoute(expressApp: express.Application) {\n  //\n  // express v5 uses `app.router`, express v4 uses `app._router`\n  // check for `app._router` first, then `app.router`\n  //\n  // (express v4 will show a warning if `app.router` is used)\n  //\n  const stack = (expressApp as any)?._router?.stack ?? (expressApp as any)?.router?.stack;\n\n  if (!stack) {\n    return false;\n  }\n\n  return stack.find((layer: any) => layer.match('/') && !['query', 'expressInit'].includes(layer.name));\n}\n\n/**\n * Do not use this directly. This is used internally by `@colyseus/playground`.\n * TODO: refactor. Avoid using globals.\n * @internal\n */\nexport let __globalEndpoints: Record<string, Endpoint> = {};\n\nexport function createRouter<\n  E extends Record<string, Endpoint>,\n  Config extends RouterConfig\n>(endpoints: E, config: Config = {} as Config) {\n  // TODO: refactor. Avoid using globals.\n  __globalEndpoints = endpoints;\n\n  return createBetterCallRouter({ ...endpoints }, config);\n}\n"],
-  "mappings": ";AAEA,SAAwD,gBAAgB,wBAAwB,sBAAsB;AACtH,SAAS,eAAe,YAAY,mBAAmB;AACvD,OAA0B;AAC1B,SAAS,kBAAkB;AAC3B,OAAO,SAAS,qBAAqB,KAAK,EAAE,MAAM,OAAO;AAEzD;AAAA,EACE,kBAAAA;AAAA,EACA;AAAA,EACA;AAAA,OAUK;AAIA,SAAS,sBAAsB,WAAsB,QAAgB,YAAqB;AAE/F,SAAO,YAAY,eAAe,kBAAkB,EAAE,QAAQ,MAAM,GAAG,OAAO,QAAQ;AACpF,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3C,CAAC,CAAC;AAEF,QAAM,SAAS,UAAU;AAGzB,QAAM,aAAmC,aACrC,UAAU,cAAc,IAExB,QAAQ,UAAU,SAAS,EAAE,KAAK,CAAC,aAAuB,SAAS,SAAS,SAAS,SAAS,WAAW,MAAM,GAAG;AAGtH,QAAM;AAAA;AAAA,IAEH,cAAc,iBAAiB,UAAU,MAAM;AAAA,IAGhD,OAAO,OAAO,OAAO,SAAS,EAAE,KAAK,cAAY,SAAS,SAAS,GAAG;AAAA;AAGxE,MAAI,CAAC,cAAc;AACjB,WAAO,YAAY,eAAe,KAAK,EAAE,QAAQ,MAAM,GAAG,OAAO,QAAQ;AACvE,aAAO,IAAI,SAAS,YAAY,IAAI,OAAO,IAAI,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChE,CAAC,CAAC;AAAA,EACJ;AAGA,MAAI,CAAC,UAAU,UAAU,YAAY;AACnC,cAAU,WAAW,MAAM;AAC3B;AAAA,EACF;AAIA,MAAI;AAEJ,MAAI,YAAY;AACd,WAAO,eAAe,WAAW,UAAU;AAE3C,WAAO,OAAO,KAAsB,QAAwB;AAG1D,UAAI,OAAO,UAAU,IAAI,QAAQ,IAAI,IAAI,MAAM,GAAG,EAAE,CAAC,CAAC,MAAM,QAAW;AACrE,cAAM,WAAW,IAAI,QAAQ,mBAAmB,MAAO,IAAI,OAAe,YAAY,UAAU;AAChG,cAAM,OAAO,GAAG,QAAQ,MAAM,IAAI,QAAQ,YAAY,KAAK,IAAI,QAAQ,IAAI;AAC3E,cAAM,WAAW,MAAM,OAAO,QAAQ,WAAW,EAAE,MAAM,SAAS,IAAI,CAAC,CAAC;AACxE,eAAO,YAAY,KAAK,QAAQ;AAAA,MAElC,OAAO;AACL,eAAO,WAAW,QAAQ,EAAE,KAAK,GAAG;AAAA,MACtC;AAAA,IACF;AAAA,EAEF,OAAO;AACL,WAAO,cAAc,OAAO,OAAO;AAAA,EACrC;AAGA,SAAO,gBAAgB,WAAW,CAAC,KAAsB,QAAwB;AAC/E,UAAM,cAAc;AAAA,MAClB,GAAG,WAAW;AAAA,MACd,GAAG,WAAW,eAAe,IAAI,QAAQ,IAAI,OAAc,CAAC;AAAA,IAC9D;AAEA,QAAI,IAAI,WAAW,WAAW;AAC5B,UAAI,UAAU,KAAK,WAAW;AAC9B,UAAI,IAAI;AACR;AAAA,IACF;AAEA,WAAO,QAAQ,WAAW,EAAE,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM;AACpD,UAAI,UAAU,KAAK,KAAK;AAAA,IAC1B,CAAC;AAED,SAAK,KAAK,GAAG;AAAA,EACf,CAAC;AACH;AAEA,SAAS,iBAAiB,YAAiC;AAOzD,QAAM,QAAS,YAAoB,SAAS,SAAU,YAAoB,QAAQ;AAElF,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AAEA,SAAO,MAAM,KAAK,CAAC,UAAe,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,SAAS,aAAa,EAAE,SAAS,MAAM,IAAI,CAAC;AACtG;AAOO,IAAI,oBAA8C,CAAC;AAEnD,SAAS,aAGd,WAAc,SAAiB,CAAC,GAAa;AAE7C,sBAAoB;AAEpB,SAAO,uBAAuB,EAAE,GAAG,UAAU,GAAG,MAAM;AACxD;",
-  "names": ["createEndpoint"]
+  "sourcesContent": ["import type express from \"express\";\nimport type { IncomingMessage, ServerResponse } from \"http\";\nimport { createHash, timingSafeEqual } from \"node:crypto\";\nimport { type Endpoint, type Router, type RouterConfig, createRouter as createBetterCallRouter, createEndpoint, createMiddleware, APIError } from \"@colyseus/better-call\";\nimport { toNodeHandler, getRequest, setResponse } from \"@colyseus/better-call/node\";\nimport { Transport } from \"../Transport.ts\";\nimport { controller } from \"../matchmaker/controller.ts\";\nimport pkg from \"../../package.json\" with { type: \"json\" };\n\nexport {\n  createEndpoint,\n  createMiddleware,\n  createInternalContext,\n\n  // Re-export types needed for declaration emit\n  type Router,\n  type RouterConfig,\n  type Endpoint,\n  type EndpointHandler,\n  type EndpointOptions,\n  type EndpointContext,\n  type StrictEndpoint,\n} from \"@colyseus/better-call\";\n\nexport { toNodeHandler };\n\nexport function bindRouterToTransport(transport: Transport, router: Router, useExpress: boolean) {\n  // add default \"/__healthcheck\" endpoint\n  router.addEndpoint(createEndpoint(\"/__healthcheck\", { method: \"GET\" }, async (ctx) => {\n    return new Response(\"OK\", { status: 200 });\n  }));\n\n  const server = transport.server;\n\n  // check if the server is bound to an express app\n  const expressApp: express.Application = (useExpress)\n    ? transport.getExpressApp() as express.Application\n    // fallback searching for express app in server listeners\n    : server?.listeners('request').find((listener: Function) => listener.name === \"app\" && listener['mountpath'] === '/') as express.Application;\n\n  // add default \"/\" route, if not provided.\n  const hasRootRoute = (\n    // check if express app has a root route\n    (expressApp && expressRootRoute(expressApp) !== undefined) ||\n\n    // check if router has a root route\n    Object.values(router.endpoints).some(endpoint => endpoint.path === \"/\")\n  );\n\n  if (!hasRootRoute) {\n    router.addEndpoint(createEndpoint(\"/\", { method: \"GET\" }, async (ctx) => {\n      return new Response(`Colyseus ${pkg.version}`, { status: 200 });\n    }));\n  }\n\n  // use custom bindRouter method if provided\n  if (!server && transport.bindRouter) {\n    transport.bindRouter(router);\n    return;\n  }\n\n  // which route handler to use\n  // (router + fallback to express, or just router)\n  let next: any;\n\n  if (expressApp) {\n    server.removeListener('request', expressApp);\n\n    next = async (req: IncomingMessage, res: ServerResponse) => {\n      // check if the route is defined in the router\n      // if so, use the router handler, otherwise fallback to express\n      if (router.findRoute(req.method, req.url.split('?')[0]) !== undefined) {\n        const protocol = req.headers[\"x-forwarded-proto\"] || ((req.socket as any).encrypted ? \"https\" : \"http\");\n        const base = `${protocol}://${req.headers[\":authority\"] || req.headers.host}`;\n        const response = await router.handler(getRequest({ base, request: req }));\n        return setResponse(res, response);\n\n      } else {\n        return expressApp['handle'](req, res);\n      }\n    };\n\n  } else {\n    next = toNodeHandler(router.handler);\n  }\n\n  // handle cors headers for all requests by default\n  server.prependListener('request', (req: IncomingMessage, res: ServerResponse) => {\n    const corsHeaders = {\n      ...controller.DEFAULT_CORS_HEADERS,\n      ...controller.getCorsHeaders(new Headers(req.headers as any)),\n    };\n\n    if (req.method === \"OPTIONS\") {\n      res.writeHead(204, corsHeaders);\n      res.end();\n      return;\n    }\n\n    Object.entries(corsHeaders).forEach(([key, value]) => {\n      res.setHeader(key, value);\n    });\n\n    next(req, res);\n  });\n}\n\nfunction expressRootRoute(expressApp: express.Application) {\n  //\n  // express v5 uses `app.router`, express v4 uses `app._router`\n  // check for `app._router` first, then `app.router`\n  //\n  // (express v4 will show a warning if `app.router` is used)\n  //\n  const stack = (expressApp as any)?._router?.stack ?? (expressApp as any)?.router?.stack;\n\n  if (!stack) {\n    return false;\n  }\n\n  return stack.find((layer: any) => layer.match('/') && !['query', 'expressInit'].includes(layer.name));\n}\n\nexport function createRouter<\n  E extends Record<string, Endpoint>,\n  Config extends RouterConfig\n>(endpoints: E, config: Config = {} as Config) {\n  return createBetterCallRouter({ ...endpoints }, {\n    // better-call's /api/reference page dumps the full API surface\n    // unauthenticated \u2014 opt back in by passing `openapi` explicitly.\n    openapi: { disabled: true },\n    ...config,\n  });\n}\n\nexport interface BasicAuthOptions {\n  /** username \u2192 password. The common static case. */\n  users?: Record<string, string>;\n  /** Custom validator (e.g. DB-backed). Takes precedence over `users`. */\n  validate?: (username: string, password: string) => boolean | Promise<boolean>;\n  /** Realm shown in the browser prompt. Default 'Restricted'. */\n  realm?: string;\n}\n\n/**\n * HTTP Basic Auth middleware. Drop into any endpoint's `use:` slot to gate\n * it behind a browser credentials prompt:\n *\n *   playground({ use: [basicAuth({ users: { admin: 's3cret' } })] })\n */\nexport function basicAuth(opts: BasicAuthOptions) {\n  const { users, validate } = opts;\n  if (!users && !validate) {\n    throw new Error('[basicAuth] provide `users` or `validate`');\n  }\n  // Realm is interpolated into a header \u2014 strip `\"` so it can't break out.\n  const challenge = `Basic realm=\"${(opts.realm ?? 'Restricted').replace(/\"/g, '')}\", charset=\"UTF-8\"`;\n\n  return createMiddleware(async (ctx) => {\n    const creds = parseBasicHeader(ctx.getHeader('authorization'));\n    const ok = !!creds && (validate\n      ? await validate(creds.username, creds.password)\n      : staticCheck(users!, creds.username, creds.password));\n    if (!ok) {\n      throw new APIError(401, { message: 'authentication required' }, { 'WWW-Authenticate': challenge });\n    }\n  });\n}\n\nfunction parseBasicHeader(header: string | null | undefined) {\n  if (!header) { return null; }\n  const sep = header.indexOf(' ');\n  if (sep < 0 || header.slice(0, sep).toLowerCase() !== 'basic') { return null; }\n  let decoded: string;\n  try { decoded = Buffer.from(header.slice(sep + 1), 'base64').toString('utf8'); } catch { return null; }\n  const colon = decoded.indexOf(':');\n  if (colon < 0) { return null; }\n  return { username: decoded.slice(0, colon), password: decoded.slice(colon + 1) };\n}\n\nfunction staticCheck(users: Record<string, string>, username: string, password: string): boolean {\n  const expected = Object.prototype.hasOwnProperty.call(users, username) ? users[username] : undefined;\n  // Compare even for an unknown user so reject timing doesn't reveal which\n  // usernames exist.\n  return safeEqual(password, expected ?? '\\0') && expected !== undefined;\n}\n\n// Hash both sides first: equalizes length (timingSafeEqual throws on a\n// length mismatch, which would itself leak the secret's length).\nfunction safeEqual(a: string, b: string): boolean {\n  return timingSafeEqual(\n    createHash('sha256').update(a).digest(),\n    createHash('sha256').update(b).digest(),\n  );\n}\n\n// ---------------------------------------------------------------------------\n// dualModeEndpoints \u2014 shared express-compat layer for @colyseus/admin,\n// @colyseus/monitor, @colyseus/playground. Builds the two local routers\n// (specific = no catch-all, full = everything) and the matching node\n// handlers, then packages the express middleware so the return value works\n// both as `{...spread}` into createRouter AND as `app.use(\"/\", x)` middleware.\n// ---------------------------------------------------------------------------\n\nexport type ExpressMiddleware = (\n  req: IncomingMessage,\n  res: ServerResponse,\n  next: (err?: any) => void,\n) => void;\n\nexport type NodeHandler = (req: IncomingMessage, res: ServerResponse) => Promise<void>;\n\nexport interface DualModeHelpers {\n  specificRouter: Router;\n  specificHandler: NodeHandler;\n  fullRouter: Router;\n  fullHandler: NodeHandler;\n}\n\nexport function dualModeEndpoints<E extends Record<string, Endpoint>>(\n  endpoints: E,\n  opts: {\n    /** Key in `endpoints` whose path is a catch-all. Excluded from `specificRouter` so it doesn't eat fall-through decisions. */\n    catchAllKey?: keyof E;\n    /** Build the express middleware given the pre-built routers + node handlers. */\n    buildMiddleware: (helpers: DualModeHelpers) => ExpressMiddleware;\n  },\n): ExpressMiddleware & E {\n  const fullRouter = createRouter(endpoints);\n  const fullHandler = toNodeHandler(fullRouter.handler) as NodeHandler;\n\n  const specificEndpoints = opts.catchAllKey\n    ? Object.fromEntries(\n        Object.entries(endpoints).filter(([k]) => k !== opts.catchAllKey),\n      ) as Partial<E>\n    : endpoints;\n  const specificRouter = createRouter(specificEndpoints as E);\n  const specificHandler = toNodeHandler(specificRouter.handler) as NodeHandler;\n\n  const middleware = opts.buildMiddleware({\n    specificRouter, specificHandler, fullRouter, fullHandler,\n  });\n  return Object.assign(middleware, endpoints) as ExpressMiddleware & E;\n}\n"],
+  "mappings": ";AAEA,SAAS,YAAY,uBAAuB;AAC5C,SAAwD,gBAAgB,wBAAwB,gBAAgB,kBAAkB,gBAAgB;AAClJ,SAAS,eAAe,YAAY,mBAAmB;AACvD,OAA0B;AAC1B,SAAS,kBAAkB;AAC3B,OAAO,SAAS,qBAAqB,KAAK,EAAE,MAAM,OAAO;AAEzD;AAAA,EACE,kBAAAA;AAAA,EACA,oBAAAC;AAAA,EACA;AAAA,OAUK;AAIA,SAAS,sBAAsB,WAAsB,QAAgB,YAAqB;AAE/F,SAAO,YAAY,eAAe,kBAAkB,EAAE,QAAQ,MAAM,GAAG,OAAO,QAAQ;AACpF,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3C,CAAC,CAAC;AAEF,QAAM,SAAS,UAAU;AAGzB,QAAM,aAAmC,aACrC,UAAU,cAAc,IAExB,QAAQ,UAAU,SAAS,EAAE,KAAK,CAAC,aAAuB,SAAS,SAAS,SAAS,SAAS,WAAW,MAAM,GAAG;AAGtH,QAAM;AAAA;AAAA,IAEH,cAAc,iBAAiB,UAAU,MAAM;AAAA,IAGhD,OAAO,OAAO,OAAO,SAAS,EAAE,KAAK,cAAY,SAAS,SAAS,GAAG;AAAA;AAGxE,MAAI,CAAC,cAAc;AACjB,WAAO,YAAY,eAAe,KAAK,EAAE,QAAQ,MAAM,GAAG,OAAO,QAAQ;AACvE,aAAO,IAAI,SAAS,YAAY,IAAI,OAAO,IAAI,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChE,CAAC,CAAC;AAAA,EACJ;AAGA,MAAI,CAAC,UAAU,UAAU,YAAY;AACnC,cAAU,WAAW,MAAM;AAC3B;AAAA,EACF;AAIA,MAAI;AAEJ,MAAI,YAAY;AACd,WAAO,eAAe,WAAW,UAAU;AAE3C,WAAO,OAAO,KAAsB,QAAwB;AAG1D,UAAI,OAAO,UAAU,IAAI,QAAQ,IAAI,IAAI,MAAM,GAAG,EAAE,CAAC,CAAC,MAAM,QAAW;AACrE,cAAM,WAAW,IAAI,QAAQ,mBAAmB,MAAO,IAAI,OAAe,YAAY,UAAU;AAChG,cAAM,OAAO,GAAG,QAAQ,MAAM,IAAI,QAAQ,YAAY,KAAK,IAAI,QAAQ,IAAI;AAC3E,cAAM,WAAW,MAAM,OAAO,QAAQ,WAAW,EAAE,MAAM,SAAS,IAAI,CAAC,CAAC;AACxE,eAAO,YAAY,KAAK,QAAQ;AAAA,MAElC,OAAO;AACL,eAAO,WAAW,QAAQ,EAAE,KAAK,GAAG;AAAA,MACtC;AAAA,IACF;AAAA,EAEF,OAAO;AACL,WAAO,cAAc,OAAO,OAAO;AAAA,EACrC;AAGA,SAAO,gBAAgB,WAAW,CAAC,KAAsB,QAAwB;AAC/E,UAAM,cAAc;AAAA,MAClB,GAAG,WAAW;AAAA,MACd,GAAG,WAAW,eAAe,IAAI,QAAQ,IAAI,OAAc,CAAC;AAAA,IAC9D;AAEA,QAAI,IAAI,WAAW,WAAW;AAC5B,UAAI,UAAU,KAAK,WAAW;AAC9B,UAAI,IAAI;AACR;AAAA,IACF;AAEA,WAAO,QAAQ,WAAW,EAAE,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM;AACpD,UAAI,UAAU,KAAK,KAAK;AAAA,IAC1B,CAAC;AAED,SAAK,KAAK,GAAG;AAAA,EACf,CAAC;AACH;AAEA,SAAS,iBAAiB,YAAiC;AAOzD,QAAM,QAAS,YAAoB,SAAS,SAAU,YAAoB,QAAQ;AAElF,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AAEA,SAAO,MAAM,KAAK,CAAC,UAAe,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,SAAS,aAAa,EAAE,SAAS,MAAM,IAAI,CAAC;AACtG;AAEO,SAAS,aAGd,WAAc,SAAiB,CAAC,GAAa;AAC7C,SAAO,uBAAuB,EAAE,GAAG,UAAU,GAAG;AAAA;AAAA;AAAA,IAG9C,SAAS,EAAE,UAAU,KAAK;AAAA,IAC1B,GAAG;AAAA,EACL,CAAC;AACH;AAiBO,SAAS,UAAU,MAAwB;AAChD,QAAM,EAAE,OAAO,SAAS,IAAI;AAC5B,MAAI,CAAC,SAAS,CAAC,UAAU;AACvB,UAAM,IAAI,MAAM,2CAA2C;AAAA,EAC7D;AAEA,QAAM,YAAY,iBAAiB,KAAK,SAAS,cAAc,QAAQ,MAAM,EAAE,CAAC;AAEhF,SAAO,iBAAiB,OAAO,QAAQ;AACrC,UAAM,QAAQ,iBAAiB,IAAI,UAAU,eAAe,CAAC;AAC7D,UAAM,KAAK,CAAC,CAAC,UAAU,WACnB,MAAM,SAAS,MAAM,UAAU,MAAM,QAAQ,IAC7C,YAAY,OAAQ,MAAM,UAAU,MAAM,QAAQ;AACtD,QAAI,CAAC,IAAI;AACP,YAAM,IAAI,SAAS,KAAK,EAAE,SAAS,0BAA0B,GAAG,EAAE,oBAAoB,UAAU,CAAC;AAAA,IACnG;AAAA,EACF,CAAC;AACH;AAEA,SAAS,iBAAiB,QAAmC;AAC3D,MAAI,CAAC,QAAQ;AAAE,WAAO;AAAA,EAAM;AAC5B,QAAM,MAAM,OAAO,QAAQ,GAAG;AAC9B,MAAI,MAAM,KAAK,OAAO,MAAM,GAAG,GAAG,EAAE,YAAY,MAAM,SAAS;AAAE,WAAO;AAAA,EAAM;AAC9E,MAAI;AACJ,MAAI;AAAE,cAAU,OAAO,KAAK,OAAO,MAAM,MAAM,CAAC,GAAG,QAAQ,EAAE,SAAS,MAAM;AAAA,EAAG,QAAQ;AAAE,WAAO;AAAA,EAAM;AACtG,QAAM,QAAQ,QAAQ,QAAQ,GAAG;AACjC,MAAI,QAAQ,GAAG;AAAE,WAAO;AAAA,EAAM;AAC9B,SAAO,EAAE,UAAU,QAAQ,MAAM,GAAG,KAAK,GAAG,UAAU,QAAQ,MAAM,QAAQ,CAAC,EAAE;AACjF;AAEA,SAAS,YAAY,OAA+B,UAAkB,UAA2B;AAC/F,QAAM,WAAW,OAAO,UAAU,eAAe,KAAK,OAAO,QAAQ,IAAI,MAAM,QAAQ,IAAI;AAG3F,SAAO,UAAU,UAAU,YAAY,IAAI,KAAK,aAAa;AAC/D;AAIA,SAAS,UAAU,GAAW,GAAoB;AAChD,SAAO;AAAA,IACL,WAAW,QAAQ,EAAE,OAAO,CAAC,EAAE,OAAO;AAAA,IACtC,WAAW,QAAQ,EAAE,OAAO,CAAC,EAAE,OAAO;AAAA,EACxC;AACF;AAyBO,SAAS,kBACd,WACA,MAMuB;AACvB,QAAM,aAAa,aAAa,SAAS;AACzC,QAAM,cAAc,cAAc,WAAW,OAAO;AAEpD,QAAM,oBAAoB,KAAK,cAC3B,OAAO;AAAA,IACL,OAAO,QAAQ,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,KAAK,WAAW;AAAA,EAClE,IACA;AACJ,QAAM,iBAAiB,aAAa,iBAAsB;AAC1D,QAAM,kBAAkB,cAAc,eAAe,OAAO;AAE5D,QAAM,aAAa,KAAK,gBAAgB;AAAA,IACtC;AAAA,IAAgB;AAAA,IAAiB;AAAA,IAAY;AAAA,EAC/C,CAAC;AACD,SAAO,OAAO,OAAO,YAAY,SAAS;AAC5C;",
+  "names": ["createEndpoint", "createMiddleware"]
 }